feat: refactor binary structure and expand library exports [5 of 8]

[whizzzkid]

Part 5 of 8

This is 5/8 of #265

Description of Changes (auto-gen)

Binary refactoring:

• Extract command routing to src/bin/cli/commands.rs
• Simplify src/bin/scope.rs to thin CLI wrapper
• Update scope-intercept.rs to use explicit imports

Library exports (src/lib.rs):

• Add comprehensive crate-level documentation
• Export CLI argument types (AnalyzeArgs, DoctorArgs, etc.)
• Export capture/logging utilities for CLI tools
• Export report builders and renderers
• Deprecate prelude module with migration guidance

Doctor module improvements:

• Add make_prompt_fn for bridging UserInteraction trait
• Update output format to use structured tracing fields
• Fix if-let chain pattern in cache migration

[dryrunsecurity]

This pull request introduces insecure temporary file handling in src/doctor/commands/run.rs where a hardcoded, world-writable path (/tmp/scope/cache-file.json) is used for cache migration, allowing an attacker to pre-create or symlink that path to sensitive files (e.g., /etc/shadow) so std::fs::copy will follow the symlink and leak sensitive data into the user's cache or let an attacker supply a malicious cache to subvert health checks or overwrite files (including via SCOPE_DOCTOR_CACHE_DIR or dangling symlinks).

Insecure Temporary File Handling in src/doctor/commands/run.rs

Vulnerability

Insecure Temporary File Handling

Description

The code in src/doctor/commands/run.rs uses a hardcoded, world-writable path /tmp/scope/cache-file.json as a source for cache migration. An attacker can pre-create this directory and file. If they create /tmp/scope/cache-file.json as a symbolic link to a sensitive file (e.g., /etc/shadow), the migration logic will use std::fs::copy, which follows symbolic links for the source argument. This causes the contents of the sensitive file to be copied to the user's new cache directory (typically ~/.cache/scope/cache-file.json). Furthermore, an attacker can provide a malicious cache file to subvert health checks performed by the doctor command, or potentially overwrite files if they can influence the destination cache directory (e.g., via the SCOPE_DOCTOR_CACHE_DIR environment variable or by pre-creating the destination as a dangling symlink).

scope/src/doctor/commands/run.rs

Lines 54 to 57 in 947cefe

	let old_default_cache_path = PathBuf::from("/tmp/scope/cache-file.json");
	// Handle backward compatibility: migrate from old location to new location
	let should_migrate =

---

All finding details can be found in the DryRun Security Dashboard.