SafeAI-Static-Analyzer 2.2.0__tar.gz → 2.3.0__tar.gz

{safeai_static_analyzer-2.2.0 → safeai_static_analyzer-2.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: SafeAI-Static-Analyzer
-Version: 2.2.0
+Version: 2.3.0
 Summary: The lightweight, open-source Static AI Capability & Risk Analyzer for CI/CD pipelines.
 Author: IkarusCareer
 License-Expression: Apache-2.0
@@ -36,12 +36,12 @@ Dynamic: license-file
 [![CI](https://github.com/ikaruscareer/SafeAI/actions/workflows/ci.yml/badge.svg)](https://github.com/ikaruscareer/SafeAI/actions/workflows/ci.yml)
 [![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/ikaruscareer/SafeAI/badge)](https://scorecard.dev/viewer/?uri=github.com/ikaruscareer/SafeAI)
 [![Website](https://img.shields.io/badge/web-safeai--analyzer.ikaruscareer.com-0f766e)](https://safeai-analyzer.ikaruscareer.com)
-[![Latest Release](https://img.shields.io/badge/latest-v2.0.1-0f766e)](https://github.com/ikaruscareer/SafeAI/releases/tag/v2.0.1)
+[![Latest Release](https://img.shields.io/badge/latest-v2.3.0-0f766e)](https://github.com/ikaruscareer/SafeAI/releases/tag/v2.3.0)
 [![Best Practices](https://bestpractices.dev/projects/14126/badge)](https://www.bestpractices.dev/en/projects/14126)
 
 Enjoying SafeAI? A ⭐ on [GitHub](https://github.com/ikaruscareer/SafeAI) helps more security teams find it.
 
-**SafeAI** is a static analysis tool that scans AI application source code for security risks, capability exposure, and governance gaps. It runs entirely offline, never executes agents or calls LLMs, and integrates into CI/CD pipelines.
+**SafeAI** is a static analysis tool that scans AI application source code for security risks, capability exposure, and governance gaps. It is offline and source-private by default — it never executes agents or calls LLMs, and network activity occurs only through explicitly enabled integration commands (currently only `--pr-comment-post`). It integrates into CI/CD pipelines.
 
 > 🌐 [safeai-analyzer.ikaruscareer.com](https://safeai-analyzer.ikaruscareer.com) — project landing page
 
@@ -84,7 +84,7 @@ SafeAI sits before runtime guardrails and red-teaming tools in the security life
 
 | Feature | Description |
 |---------|-------------|
-| **Framework Detection** | Detects and parses 17 AI agent frameworks (AST + config + regex, no mutual exclusion) |
+| **Framework Detection** | Detects and parses 19 AI agent frameworks (AST + config + regex, no mutual exclusion) |
 | **Tool Identity & Access Modes** | Capabilities attributed to named tools (agent / MCP server / skill / tool / workflow node) on an access scale `none < read < write < mutate < execute`; inferred modes are flagged, never overstated |
 | **Capability Discovery** | Maps 19 capability categories (shell, filesystem, network, database, memory, MCP, ...) with evidence, confidence, and provenance |
 | **Capability Escalation Detection** | Per-tool authority diffs between scans (new shell, read→write widening, new MCP server, removed approval gate, ...) — 14 rules, including gating-aware subsumption |
@@ -170,6 +170,8 @@ Registry & Reports — shared SQLite registry; terminal, JSON, SARIF 2.1.0, HTML
 | n8n | ✔ | Partial | Minimal | Minimal | Experimental |
 | Cursor (.cursorrules) | ✔ | Minimal | Minimal | Minimal | Experimental |
 | Windsurf (.windsurfrules) | ✔ | Minimal | Minimal | Minimal | Experimental |
+| OpenClaw config | ✔ | Minimal | Minimal | Minimal | Experimental |
+| GitHub Copilot instructions | ✔ | Minimal | Minimal | Minimal | Experimental |
 
 
 ### Framework Support Details
@@ -194,6 +196,12 @@ Registry & Reports — shared SQLite registry; terminal, JSON, SARIF 2.1.0, HTML
 - **Cursor (.cursorrules)** — detects declared tools/permissions and
   capability-relevant keywords (shell, filesystem, HTTP, database) in the
   IDE's rules config, JSON, YAML, or free text
+- **Windsurf (.windsurfrules)** — detects declared tools, models, and
+  capability-relevant keywords in JSON, YAML, or free-text rules
+- **OpenClaw config** — detects JSON/YAML files under `.openclaw/` and
+  `.openclaw.yaml`, including declared tools, models, and MCP servers
+- **GitHub Copilot instructions** — detects repository instruction Markdown,
+  YAML frontmatter, and `.copilot/*.yml` tool or permission grants
 
 Maturity is on the scale defined in [`docs/reference/FRAMEWORK_SUPPORT.md`](docs/reference/FRAMEWORK_SUPPORT.md):
 **Partial** = reliable detection and discovery with capability/risk analysis over
@@ -211,6 +219,8 @@ Representative test fixtures and validation tests for framework detection:
 | LlamaIndex | `test_llamaindex_framework.py` | `fixtures/llamaindex/representative/agent.py` | @adnqcr7-code [#61] |
 | CrewAI | `test_crewai_framework.py` | `fixtures/crewai/representative/crew.py` | @adnqcr7-code [#62] |
 | Claude Code | `test_claude_code_deep.py` | `fixtures/claude_code/compatibility/` | @adnqcr7-code [#59] |
+| OpenClaw config | `test_config_adapters.py` | `fixtures/openclaw/representative/.openclaw/config.json` | @YaoSong808 [#159] |
+| GitHub Copilot instructions | `test_config_adapters.py` | `fixtures/copilot/representative/.github/copilot-instructions.md` | @YaoSong808 [#159] |
 
 ---
 
@@ -302,6 +312,16 @@ to a shared path, or use `--no-registry` for ephemeral scans.
 - Python 3.11, 3.12, or 3.13
 - PyYAML (for YAML configuration parsing)
 
+### Install from PyPI (recommended)
+
+```bash
+pip install SafeAI-Static-Analyzer
+```
+
+Unpinned on purpose — this always resolves to the latest stable
+release (see [releases](https://github.com/ikaruscareer/SafeAI/releases)).
+Verify the download with [`docs/reference/VERIFICATION.md`](docs/reference/VERIFICATION.md).
+
 ### Install from source
 
 ```bash
@@ -343,6 +363,7 @@ python -m safeai registry <subcommand> [options]
 | `--json` | — | JSON output path |
 | `--html` | — | HTML report output path |
 | `--manifest` | — | Canonical KYA manifest output path (`safeai-manifest.json`) |
+| `--digest-file` | — | With `--manifest`: write `<canonical-sha256>  <manifest-basename>` to this path. The digest is the one `safeai manifest verify` reports, not a raw file hash, so it is not `sha256sum -c` compatible |
 | `--baseline` | — | Prior manifest/report for new/existing comparison |
 | `--fail-on-new` | off | With `--baseline`: fail only on new/regressed findings |
 | `--policy` | `.safeai/policy.yml` | Policy-as-code YAML file |
@@ -450,7 +471,7 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-python@v5
         with: { python-version: '3.12' }
-      - uses: ikaruscareer/SafeAI@v1
+      - uses: ikaruscareer/SafeAI@v2
         with: { path: '.', fail-on: critical }
       - uses: github/codeql-action/upload-sarif@v3
         if: always()
@@ -504,6 +525,8 @@ contributors who have helped make AI safer:
 | [@hadbiaghiles](https://github.com/hadbiaghiles) | AutoGen framework documentation |
 | [@D05TL3](https://github.com/D05TL3) | GitHub Actions scanning example |
 | [@mikemikimike](https://github.com/mikemikimike) | Adapter negative detection tests |
+| [@burakeyler](https://github.com/burakeyler) | `--digest-file` manifest digest sidecar (PR #148) |
+| [@YaoSong808](https://github.com/YaoSong808) | OpenClaw and GitHub Copilot config-file adapters (PR #159) |
 | [@mah](https://github.com/mahirhir) | Claude Code deep analysis documentation |
 | [@asarakhatun17-lgtm](https://github.com/asarakhatun17-lgtm) | Supported frameworks consistency fix |
 | [@yugaaank](https://github.com/yugaaank) | Capability detectors (Docker, Kubernetes, Redis, S3, GCP, Slack, Jira, browser) |

{safeai_static_analyzer-2.2.0 → safeai_static_analyzer-2.3.0}/README.md

@@ -3,12 +3,12 @@
 [![CI](https://github.com/ikaruscareer/SafeAI/actions/workflows/ci.yml/badge.svg)](https://github.com/ikaruscareer/SafeAI/actions/workflows/ci.yml)
 [![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/ikaruscareer/SafeAI/badge)](https://scorecard.dev/viewer/?uri=github.com/ikaruscareer/SafeAI)
 [![Website](https://img.shields.io/badge/web-safeai--analyzer.ikaruscareer.com-0f766e)](https://safeai-analyzer.ikaruscareer.com)
-[![Latest Release](https://img.shields.io/badge/latest-v2.0.1-0f766e)](https://github.com/ikaruscareer/SafeAI/releases/tag/v2.0.1)
+[![Latest Release](https://img.shields.io/badge/latest-v2.3.0-0f766e)](https://github.com/ikaruscareer/SafeAI/releases/tag/v2.3.0)
 [![Best Practices](https://bestpractices.dev/projects/14126/badge)](https://www.bestpractices.dev/en/projects/14126)
 
 Enjoying SafeAI? A ⭐ on [GitHub](https://github.com/ikaruscareer/SafeAI) helps more security teams find it.
 
-**SafeAI** is a static analysis tool that scans AI application source code for security risks, capability exposure, and governance gaps. It runs entirely offline, never executes agents or calls LLMs, and integrates into CI/CD pipelines.
+**SafeAI** is a static analysis tool that scans AI application source code for security risks, capability exposure, and governance gaps. It is offline and source-private by default — it never executes agents or calls LLMs, and network activity occurs only through explicitly enabled integration commands (currently only `--pr-comment-post`). It integrates into CI/CD pipelines.
 
 > 🌐 [safeai-analyzer.ikaruscareer.com](https://safeai-analyzer.ikaruscareer.com) — project landing page
 
@@ -51,7 +51,7 @@ SafeAI sits before runtime guardrails and red-teaming tools in the security life
 
 | Feature | Description |
 |---------|-------------|
-| **Framework Detection** | Detects and parses 17 AI agent frameworks (AST + config + regex, no mutual exclusion) |
+| **Framework Detection** | Detects and parses 19 AI agent frameworks (AST + config + regex, no mutual exclusion) |
 | **Tool Identity & Access Modes** | Capabilities attributed to named tools (agent / MCP server / skill / tool / workflow node) on an access scale `none < read < write < mutate < execute`; inferred modes are flagged, never overstated |
 | **Capability Discovery** | Maps 19 capability categories (shell, filesystem, network, database, memory, MCP, ...) with evidence, confidence, and provenance |
 | **Capability Escalation Detection** | Per-tool authority diffs between scans (new shell, read→write widening, new MCP server, removed approval gate, ...) — 14 rules, including gating-aware subsumption |
@@ -137,6 +137,8 @@ Registry & Reports — shared SQLite registry; terminal, JSON, SARIF 2.1.0, HTML
 | n8n | ✔ | Partial | Minimal | Minimal | Experimental |
 | Cursor (.cursorrules) | ✔ | Minimal | Minimal | Minimal | Experimental |
 | Windsurf (.windsurfrules) | ✔ | Minimal | Minimal | Minimal | Experimental |
+| OpenClaw config | ✔ | Minimal | Minimal | Minimal | Experimental |
+| GitHub Copilot instructions | ✔ | Minimal | Minimal | Minimal | Experimental |
 
 
 ### Framework Support Details
@@ -161,6 +163,12 @@ Registry & Reports — shared SQLite registry; terminal, JSON, SARIF 2.1.0, HTML
 - **Cursor (.cursorrules)** — detects declared tools/permissions and
   capability-relevant keywords (shell, filesystem, HTTP, database) in the
   IDE's rules config, JSON, YAML, or free text
+- **Windsurf (.windsurfrules)** — detects declared tools, models, and
+  capability-relevant keywords in JSON, YAML, or free-text rules
+- **OpenClaw config** — detects JSON/YAML files under `.openclaw/` and
+  `.openclaw.yaml`, including declared tools, models, and MCP servers
+- **GitHub Copilot instructions** — detects repository instruction Markdown,
+  YAML frontmatter, and `.copilot/*.yml` tool or permission grants
 
 Maturity is on the scale defined in [`docs/reference/FRAMEWORK_SUPPORT.md`](docs/reference/FRAMEWORK_SUPPORT.md):
 **Partial** = reliable detection and discovery with capability/risk analysis over
@@ -178,6 +186,8 @@ Representative test fixtures and validation tests for framework detection:
 | LlamaIndex | `test_llamaindex_framework.py` | `fixtures/llamaindex/representative/agent.py` | @adnqcr7-code [#61] |
 | CrewAI | `test_crewai_framework.py` | `fixtures/crewai/representative/crew.py` | @adnqcr7-code [#62] |
 | Claude Code | `test_claude_code_deep.py` | `fixtures/claude_code/compatibility/` | @adnqcr7-code [#59] |
+| OpenClaw config | `test_config_adapters.py` | `fixtures/openclaw/representative/.openclaw/config.json` | @YaoSong808 [#159] |
+| GitHub Copilot instructions | `test_config_adapters.py` | `fixtures/copilot/representative/.github/copilot-instructions.md` | @YaoSong808 [#159] |
 
 ---
 
@@ -269,6 +279,16 @@ to a shared path, or use `--no-registry` for ephemeral scans.
 - Python 3.11, 3.12, or 3.13
 - PyYAML (for YAML configuration parsing)
 
+### Install from PyPI (recommended)
+
+```bash
+pip install SafeAI-Static-Analyzer
+```
+
+Unpinned on purpose — this always resolves to the latest stable
+release (see [releases](https://github.com/ikaruscareer/SafeAI/releases)).
+Verify the download with [`docs/reference/VERIFICATION.md`](docs/reference/VERIFICATION.md).
+
 ### Install from source
 
 ```bash
@@ -310,6 +330,7 @@ python -m safeai registry <subcommand> [options]
 | `--json` | — | JSON output path |
 | `--html` | — | HTML report output path |
 | `--manifest` | — | Canonical KYA manifest output path (`safeai-manifest.json`) |
+| `--digest-file` | — | With `--manifest`: write `<canonical-sha256>  <manifest-basename>` to this path. The digest is the one `safeai manifest verify` reports, not a raw file hash, so it is not `sha256sum -c` compatible |
 | `--baseline` | — | Prior manifest/report for new/existing comparison |
 | `--fail-on-new` | off | With `--baseline`: fail only on new/regressed findings |
 | `--policy` | `.safeai/policy.yml` | Policy-as-code YAML file |
@@ -417,7 +438,7 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-python@v5
         with: { python-version: '3.12' }
-      - uses: ikaruscareer/SafeAI@v1
+      - uses: ikaruscareer/SafeAI@v2
         with: { path: '.', fail-on: critical }
       - uses: github/codeql-action/upload-sarif@v3
         if: always()
@@ -471,6 +492,8 @@ contributors who have helped make AI safer:
 | [@hadbiaghiles](https://github.com/hadbiaghiles) | AutoGen framework documentation |
 | [@D05TL3](https://github.com/D05TL3) | GitHub Actions scanning example |
 | [@mikemikimike](https://github.com/mikemikimike) | Adapter negative detection tests |
+| [@burakeyler](https://github.com/burakeyler) | `--digest-file` manifest digest sidecar (PR #148) |
+| [@YaoSong808](https://github.com/YaoSong808) | OpenClaw and GitHub Copilot config-file adapters (PR #159) |
 | [@mah](https://github.com/mahirhir) | Claude Code deep analysis documentation |
 | [@asarakhatun17-lgtm](https://github.com/asarakhatun17-lgtm) | Supported frameworks consistency fix |
 | [@yugaaank](https://github.com/yugaaank) | Capability detectors (Docker, Kubernetes, Redis, S3, GCP, Slack, Jira, browser) |

{safeai_static_analyzer-2.2.0 → safeai_static_analyzer-2.3.0}/SafeAI_Static_Analyzer.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: SafeAI-Static-Analyzer
-Version: 2.2.0
+Version: 2.3.0
 Summary: The lightweight, open-source Static AI Capability & Risk Analyzer for CI/CD pipelines.
 Author: IkarusCareer
 License-Expression: Apache-2.0
@@ -36,12 +36,12 @@ Dynamic: license-file
 [![CI](https://github.com/ikaruscareer/SafeAI/actions/workflows/ci.yml/badge.svg)](https://github.com/ikaruscareer/SafeAI/actions/workflows/ci.yml)
 [![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/ikaruscareer/SafeAI/badge)](https://scorecard.dev/viewer/?uri=github.com/ikaruscareer/SafeAI)
 [![Website](https://img.shields.io/badge/web-safeai--analyzer.ikaruscareer.com-0f766e)](https://safeai-analyzer.ikaruscareer.com)
-[![Latest Release](https://img.shields.io/badge/latest-v2.0.1-0f766e)](https://github.com/ikaruscareer/SafeAI/releases/tag/v2.0.1)
+[![Latest Release](https://img.shields.io/badge/latest-v2.3.0-0f766e)](https://github.com/ikaruscareer/SafeAI/releases/tag/v2.3.0)
 [![Best Practices](https://bestpractices.dev/projects/14126/badge)](https://www.bestpractices.dev/en/projects/14126)
 
 Enjoying SafeAI? A ⭐ on [GitHub](https://github.com/ikaruscareer/SafeAI) helps more security teams find it.
 
-**SafeAI** is a static analysis tool that scans AI application source code for security risks, capability exposure, and governance gaps. It runs entirely offline, never executes agents or calls LLMs, and integrates into CI/CD pipelines.
+**SafeAI** is a static analysis tool that scans AI application source code for security risks, capability exposure, and governance gaps. It is offline and source-private by default — it never executes agents or calls LLMs, and network activity occurs only through explicitly enabled integration commands (currently only `--pr-comment-post`). It integrates into CI/CD pipelines.
 
 > 🌐 [safeai-analyzer.ikaruscareer.com](https://safeai-analyzer.ikaruscareer.com) — project landing page
 
@@ -84,7 +84,7 @@ SafeAI sits before runtime guardrails and red-teaming tools in the security life
 
 | Feature | Description |
 |---------|-------------|
-| **Framework Detection** | Detects and parses 17 AI agent frameworks (AST + config + regex, no mutual exclusion) |
+| **Framework Detection** | Detects and parses 19 AI agent frameworks (AST + config + regex, no mutual exclusion) |
 | **Tool Identity & Access Modes** | Capabilities attributed to named tools (agent / MCP server / skill / tool / workflow node) on an access scale `none < read < write < mutate < execute`; inferred modes are flagged, never overstated |
 | **Capability Discovery** | Maps 19 capability categories (shell, filesystem, network, database, memory, MCP, ...) with evidence, confidence, and provenance |
 | **Capability Escalation Detection** | Per-tool authority diffs between scans (new shell, read→write widening, new MCP server, removed approval gate, ...) — 14 rules, including gating-aware subsumption |
@@ -170,6 +170,8 @@ Registry & Reports — shared SQLite registry; terminal, JSON, SARIF 2.1.0, HTML
 | n8n | ✔ | Partial | Minimal | Minimal | Experimental |
 | Cursor (.cursorrules) | ✔ | Minimal | Minimal | Minimal | Experimental |
 | Windsurf (.windsurfrules) | ✔ | Minimal | Minimal | Minimal | Experimental |
+| OpenClaw config | ✔ | Minimal | Minimal | Minimal | Experimental |
+| GitHub Copilot instructions | ✔ | Minimal | Minimal | Minimal | Experimental |
 
 
 ### Framework Support Details
@@ -194,6 +196,12 @@ Registry & Reports — shared SQLite registry; terminal, JSON, SARIF 2.1.0, HTML
 - **Cursor (.cursorrules)** — detects declared tools/permissions and
   capability-relevant keywords (shell, filesystem, HTTP, database) in the
   IDE's rules config, JSON, YAML, or free text
+- **Windsurf (.windsurfrules)** — detects declared tools, models, and
+  capability-relevant keywords in JSON, YAML, or free-text rules
+- **OpenClaw config** — detects JSON/YAML files under `.openclaw/` and
+  `.openclaw.yaml`, including declared tools, models, and MCP servers
+- **GitHub Copilot instructions** — detects repository instruction Markdown,
+  YAML frontmatter, and `.copilot/*.yml` tool or permission grants
 
 Maturity is on the scale defined in [`docs/reference/FRAMEWORK_SUPPORT.md`](docs/reference/FRAMEWORK_SUPPORT.md):
 **Partial** = reliable detection and discovery with capability/risk analysis over
@@ -211,6 +219,8 @@ Representative test fixtures and validation tests for framework detection:
 | LlamaIndex | `test_llamaindex_framework.py` | `fixtures/llamaindex/representative/agent.py` | @adnqcr7-code [#61] |
 | CrewAI | `test_crewai_framework.py` | `fixtures/crewai/representative/crew.py` | @adnqcr7-code [#62] |
 | Claude Code | `test_claude_code_deep.py` | `fixtures/claude_code/compatibility/` | @adnqcr7-code [#59] |
+| OpenClaw config | `test_config_adapters.py` | `fixtures/openclaw/representative/.openclaw/config.json` | @YaoSong808 [#159] |
+| GitHub Copilot instructions | `test_config_adapters.py` | `fixtures/copilot/representative/.github/copilot-instructions.md` | @YaoSong808 [#159] |
 
 ---
 
@@ -302,6 +312,16 @@ to a shared path, or use `--no-registry` for ephemeral scans.
 - Python 3.11, 3.12, or 3.13
 - PyYAML (for YAML configuration parsing)
 
+### Install from PyPI (recommended)
+
+```bash
+pip install SafeAI-Static-Analyzer
+```
+
+Unpinned on purpose — this always resolves to the latest stable
+release (see [releases](https://github.com/ikaruscareer/SafeAI/releases)).
+Verify the download with [`docs/reference/VERIFICATION.md`](docs/reference/VERIFICATION.md).
+
 ### Install from source
 
 ```bash
@@ -343,6 +363,7 @@ python -m safeai registry <subcommand> [options]
 | `--json` | — | JSON output path |
 | `--html` | — | HTML report output path |
 | `--manifest` | — | Canonical KYA manifest output path (`safeai-manifest.json`) |
+| `--digest-file` | — | With `--manifest`: write `<canonical-sha256>  <manifest-basename>` to this path. The digest is the one `safeai manifest verify` reports, not a raw file hash, so it is not `sha256sum -c` compatible |
 | `--baseline` | — | Prior manifest/report for new/existing comparison |
 | `--fail-on-new` | off | With `--baseline`: fail only on new/regressed findings |
 | `--policy` | `.safeai/policy.yml` | Policy-as-code YAML file |
@@ -450,7 +471,7 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-python@v5
         with: { python-version: '3.12' }
-      - uses: ikaruscareer/SafeAI@v1
+      - uses: ikaruscareer/SafeAI@v2
         with: { path: '.', fail-on: critical }
       - uses: github/codeql-action/upload-sarif@v3
         if: always()
@@ -504,6 +525,8 @@ contributors who have helped make AI safer:
 | [@hadbiaghiles](https://github.com/hadbiaghiles) | AutoGen framework documentation |
 | [@D05TL3](https://github.com/D05TL3) | GitHub Actions scanning example |
 | [@mikemikimike](https://github.com/mikemikimike) | Adapter negative detection tests |
+| [@burakeyler](https://github.com/burakeyler) | `--digest-file` manifest digest sidecar (PR #148) |
+| [@YaoSong808](https://github.com/YaoSong808) | OpenClaw and GitHub Copilot config-file adapters (PR #159) |
 | [@mah](https://github.com/mahirhir) | Claude Code deep analysis documentation |
 | [@asarakhatun17-lgtm](https://github.com/asarakhatun17-lgtm) | Supported frameworks consistency fix |
 | [@yugaaank](https://github.com/yugaaank) | Capability detectors (Docker, Kubernetes, Redis, S3, GCP, Slack, Jira, browser) |

{safeai_static_analyzer-2.2.0 → safeai_static_analyzer-2.3.0}/SafeAI_Static_Analyzer.egg-info/SOURCES.txt

@@ -83,6 +83,8 @@ safeai/frameworks/claude_code/commands.py
 safeai/frameworks/claude_code/parser.py
 safeai/frameworks/claude_code/permissions.py
 safeai/frameworks/claude_code/settings.py
+safeai/frameworks/copilot/__init__.py
+safeai/frameworks/copilot/parser.py
 safeai/frameworks/crewai/__init__.py
 safeai/frameworks/crewai/parser.py
 safeai/frameworks/cursorrules/__init__.py
@@ -107,6 +109,8 @@ safeai/frameworks/n8n/__init__.py
 safeai/frameworks/n8n/parser.py
 safeai/frameworks/openai_agents/__init__.py
 safeai/frameworks/openai_agents/parser.py
+safeai/frameworks/openclaw/__init__.py
+safeai/frameworks/openclaw/parser.py
 safeai/frameworks/semantic_kernel/__init__.py
 safeai/frameworks/semantic_kernel/parser.py
 safeai/frameworks/windsurf/__init__.py
@@ -122,6 +126,7 @@ safeai/kya/fingerprints.py
 safeai/kya/identity.py
 safeai/kya/importer.py
 safeai/kya/integrity.py
+safeai/kya/lockfile.py
 safeai/kya/manifest.py
 safeai/kya/policy.py
 safeai/kya/suppressions.py
@@ -143,6 +148,7 @@ safeai/report/terminal.py
 safeai/rules/__init__.py
 safeai/rules/base_rules.yaml
 safeai/rules/loader.py
+safeai/rules/pack_test.py
 safeai/scoring/__init__.py
 safeai/scoring/engine.py
 safeai/telemetry/__init__.py
@@ -161,6 +167,7 @@ tests/test_compatibility.py
 tests/test_component_graph.py
 tests/test_component_hash.py
 tests/test_confidence_arbitration.py
+tests/test_config_adapters.py
 tests/test_control_mappings.py
 tests/test_crewai_framework.py
 tests/test_cursorrules_framework.py
@@ -185,6 +192,7 @@ tests/test_mcp_validation.py
 tests/test_n8n_workflow.py
 tests/test_parser_aggregation.py
 tests/test_phase15.py
+tests/test_plugin_sdk.py
 tests/test_policy.py
 tests/test_pr_comment.py
 tests/test_pr_comment_cli.py
@@ -193,10 +201,12 @@ tests/test_registry.py
 tests/test_registry_cli.py
 tests/test_registry_html.py
 tests/test_regression_fixtures.py
+tests/test_release_assets.py
 tests/test_release_fixes.py
 tests/test_release_validation.py
 tests/test_rules_loader_determinism.py
 tests/test_sarif.py
+tests/test_scan_framework.py
 tests/test_scan_phase11.py
 tests/test_scorecard.py
 tests/test_scoring.py

{safeai_static_analyzer-2.2.0 → safeai_static_analyzer-2.3.0}/pyproject.toml

@@ -55,6 +55,10 @@ safeai = "safeai.cmd.cli:main"
 # Built-in parsers are loaded directly by safeai.frameworks.
 [project.entry-points."safeai.parsers"]
 
+# Third-party analyzer classes can expose themselves through this group.
+# Built-in analyzers are loaded directly by safeai.analyzers.
+[project.entry-points."safeai.analyzers"]
+
 [tool.ruff.lint]
 ignore = ["BLE001", "S110", "S112", "RUF012"]
 extend-per-file-ignores = { "tests/fixtures/action/**" = ["I001", "F841", "PLW1510", "T201"] }

safeai_static_analyzer-2.3.0/safeai/analyzers/__init__.py

@@ -0,0 +1,169 @@
+"""Analyzer registry and installed analyzer-plugin loader.
+
+Analyzers register themselves here so that ``safeai.engine.orchestrator``
+does not need a hard-coded class list.  Built-in analyzers self-register
+with a ``phase`` of ``"core"`` (run over file sources) or ``"component"``
+(run over extracted components); the orchestrator preserves that order.
+
+External plugins may register through the ``safeai.analyzers`` Python
+entry point group or call ``register_analyzer`` at import time.  External
+analyzers run after built-ins in the component phase, must accept
+``components=None``, and never fail a scan: a raising external analyzer
+is skipped with a warning (see orchestrator isolation).
+"""
+
+import inspect
+import logging
+from importlib import import_module, metadata
+
+logger = logging.getLogger(__name__)
+
+CORE = "core"
+COMPONENT = "component"
+_PHASES = (CORE, COMPONENT)
+
+# Each entry: {"name", "cls", "phase", "external", "version"}.
+# ``version`` is the installed distribution version for entry-point
+# plugins, else None (resolved to the SafeAI version at record time).
+_ANALYZER_REGISTRY = []
+_ANALYZER_NAMES = set()
+
+
+def register_analyzer(cls=None, *, phase=CORE, external=False, version=None):
+    """Register an analyzer class.
+
+    Usable bare (``@register_analyzer``) for core analyzers or with
+    keywords (``@register_analyzer(phase="component")``).
+
+    The class must define a non-empty ``name`` and a ``run()`` method.
+    Component-phase analyzers must accept ``components=None``.
+    """
+
+    def _register(target):
+        name = getattr(target, "name", None)
+        run = getattr(target, "run", None)
+        if not name or not callable(run):
+            raise TypeError("Analyzer must define a non-empty name and run()")
+        if phase not in _PHASES:
+            raise ValueError(f"Analyzer phase must be one of {_PHASES}, got {phase!r}")
+        if phase == COMPONENT:
+            try:
+                params = inspect.signature(run).parameters
+            except (TypeError, ValueError):
+                params = {}
+            accepts_components = (
+                "components" in params
+                or any(p.kind == inspect.Parameter.VAR_KEYWORD for p in params.values())
+            )
+            if not accepts_components:
+                raise TypeError(
+                    f"Component-phase analyzer {name!r} must accept components=None"
+                )
+        if name not in _ANALYZER_NAMES:
+            _ANALYZER_REGISTRY.append(
+                {
+                    "name": name,
+                    "cls": target,
+                    "phase": phase,
+                    "external": external,
+                    "version": version,
+                }
+            )
+            _ANALYZER_NAMES.add(name)
+        return target
+
+    if cls is None:
+        return _register
+    return _register(cls)
+
+
+def _load_external_analyzers():
+    """Load analyzer classes exposed by installed ``safeai.analyzers`` plugins."""
+    try:
+        entries = metadata.entry_points()
+        if hasattr(entries, "select"):
+            entries = entries.select(group="safeai.analyzers")
+        else:
+            entries = entries.get("safeai.analyzers", [])
+    except Exception as exc:
+        logger.debug("Unable to enumerate analyzer plugins: %s", exc)
+        return
+
+    for entry in entries:
+        try:
+            dist_version = getattr(entry.dist, "version", None) if hasattr(entry, "dist") else None
+            register_analyzer(
+                entry.load(), phase=COMPONENT, external=True, version=dist_version
+            )
+        except Exception as exc:
+            logger.warning("Unable to load analyzer plugin %s: %s", entry.name, exc)
+
+
+# Built-in analyzers as (module, class, phase) in legacy run order.
+# The table (not import order) is the source of truth for run order, so
+# ``_import_builtin_analyzers`` is idempotent and order-canonical no
+# matter which modules were already imported.
+_BUILTIN_ANALYZERS = (
+    ("safeai.analyzers.capability.analyzer", "CapabilityAnalyzer", CORE),
+    ("safeai.analyzers.prompt.analyzer", "PromptAnalyzer", CORE),
+    ("safeai.analyzers.data_leakage.analyzer", "DataLeakageAnalyzer", CORE),
+    ("safeai.analyzers.env_dependency.analyzer", "EnvDependencyAnalyzer", CORE),
+    ("safeai.analyzers.mcp.analyzer", "MCPAnalyzer", CORE),
+    ("safeai.analyzers.claude_code.analyzer", "ClaudeCodeAnalyzer", CORE),
+    ("safeai.analyzers.skill.analyzer", "SkillAnalyzer", COMPONENT),
+    ("safeai.analyzers.prompt_file.analyzer", "PromptFileAnalyzer", COMPONENT),
+    ("safeai.analyzers.tool_def.analyzer", "ToolDefAnalyzer", COMPONENT),
+    ("safeai.analyzers.model_config.analyzer", "ModelConfigAnalyzer", COMPONENT),
+    ("safeai.analyzers.workflow.analyzer", "WorkflowAnalyzer", COMPONENT),
+    ("safeai.analyzers.governance.analyzer", "GovernanceAnalyzer", COMPONENT),
+    ("safeai.analyzers.dataflow.analyzer", "DataFlowAnalyzer", COMPONENT),
+)
+
+
+def _import_builtin_analyzers():
+    """Register built-in analyzers in legacy run order (idempotent)."""
+    for module_name, class_name, phase in _BUILTIN_ANALYZERS:
+        module = import_module(module_name)
+        register_analyzer(getattr(module, class_name), phase=phase)
+
+
+def discover_analyzers(phase=None, include_external=True):
+    """Return registered analyzer instances, built-ins first, in run order.
+
+    Parameters
+    ----------
+    phase : str, optional
+        ``"core"`` or ``"component"`` to filter; None returns all in phase
+        order (core first, then component).
+    """
+    _import_builtin_analyzers()
+    if include_external:
+        _load_external_analyzers()
+    entries = list(_ANALYZER_REGISTRY)
+    if phase is not None:
+        entries = [e for e in entries if e["phase"] == phase]
+    else:
+        entries = sorted(entries, key=lambda e: (e["phase"] != CORE,))
+    instances = []
+    for entry in entries:
+        instance = entry["cls"]()
+        # Marker consumed by the orchestrator for plugin isolation.
+        instance._safeai_external = entry["external"]
+        instances.append(instance)
+    return instances
+
+
+def analyzer_records(include_external=True):
+    """Return registry metadata (name/phase/external/version) for recording."""
+    _import_builtin_analyzers()
+    if include_external:
+        _load_external_analyzers()
+    return [
+        {
+            "name": e["name"],
+            "phase": e["phase"],
+            "external": e["external"],
+            "version": e["version"],
+        }
+        for e in _ANALYZER_REGISTRY
+    ]

{safeai_static_analyzer-2.2.0 → safeai_static_analyzer-2.3.0}/safeai/analyzers/capability/analyzer.py

@@ -10,6 +10,8 @@ Operates in two passes:
 
 import re
 
+from safeai.analyzers import register_analyzer
+
 CAP_PATTERNS = {
     "shell": re.compile(r"subprocess|os\.system|popen", re.IGNORECASE),
     "filesystem": re.compile(r"open\(|os\.remove|os\.write|pathlib", re.IGNORECASE),
@@ -99,6 +101,7 @@ def _iter_evidence(value):
         yield str(value)
 
 
+@register_analyzer
 class CapabilityAnalyzer:
     name = "capability"
 

{safeai_static_analyzer-2.2.0 → safeai_static_analyzer-2.3.0}/safeai/analyzers/claude_code/analyzer.py

@@ -12,6 +12,7 @@ scope — reading it would leak a developer's personal environment into a
 CI artifact. Multi-scope discovery is deferred to a later release.
 """
 
+from safeai.analyzers import register_analyzer
 from safeai.analyzers.prompt.analyzer import analyze_prompt_text
 from safeai.frameworks.claude_code import commands as cc_commands
 from safeai.frameworks.claude_code import permissions as cc_permissions
@@ -116,6 +117,7 @@ def _finding(rule_id, rule_map, message, path, line, evidence, reason, severity=
     }
 
 
+@register_analyzer
 class ClaudeCodeAnalyzer:
     """Emit authority findings for Claude Code project configuration."""
 

{safeai_static_analyzer-2.2.0 → safeai_static_analyzer-2.3.0}/safeai/analyzers/data_leakage/analyzer.py

@@ -11,6 +11,8 @@ full secret values.
 
 import re
 
+from safeai.analyzers import register_analyzer
+
 PATTERNS = {
     "API_KEY": re.compile(r"(api[_-]?key)\s*=\s*[\"']?[A-Za-z0-9_-]{16,}" , re.IGNORECASE),
     "TOKEN": re.compile(r"(token)\s*=\s*[\"']?[A-Za-z0-9._-]{16,}", re.IGNORECASE),
@@ -77,6 +79,7 @@ def mask_secret_evidence(line):
     return _SECRET_VALUE_RE.sub(_repl, line.strip())
 
 
+@register_analyzer
 class DataLeakageAnalyzer:
     name = "data_leakage"
 

{safeai_static_analyzer-2.2.0 → safeai_static_analyzer-2.3.0}/safeai/analyzers/dataflow/analyzer.py

@@ -16,6 +16,8 @@ scope, and are reported as such in each finding's ``limitation`` field.
 import ast
 import re
 
+from safeai.analyzers import register_analyzer
+
 # Untrusted input sources
 SOURCE_PATTERNS = [
     re.compile(r"\b(?:user_input|user_message|user_query|user_prompt)\b", re.IGNORECASE),
@@ -300,6 +302,7 @@ def _finding(rule_id, rule, message, path, line, evidence=None):
     }
 
 
+@register_analyzer(phase="component")
 class DataFlowAnalyzer:
     """Detects untrusted input propagation into sensitive sinks.
 

{safeai_static_analyzer-2.2.0 → safeai_static_analyzer-2.3.0}/safeai/analyzers/env_dependency/analyzer.py

@@ -18,6 +18,8 @@ user-facing value.
 
 import re
 
+from safeai.analyzers import register_analyzer
+
 INVENTORY_RULE_ID = "ENV_DEP_INVENTORY"
 
 #: Python ``os.getenv(...)`` / ``os.environ[...]`` / ``os.environ.get(...)``.
@@ -141,6 +143,7 @@ def analyze_file_inventory(path, content):
     return refs
 
 
+@register_analyzer
 class EnvDependencyAnalyzer:
     """Detects references to external configuration and credentials."""
 

{safeai_static_analyzer-2.2.0 → safeai_static_analyzer-2.3.0}/safeai/analyzers/governance/analyzer.py

@@ -12,6 +12,8 @@ scoring category and HTML report governance summary section.
 
 import re
 
+from safeai.analyzers import register_analyzer
+
 # Patterns for detecting governance controls in code
 _TIMEOUT_RE = re.compile(
     r"\b(?:timeout|time_out|request_timeout|connect_timeout|read_timeout)"
@@ -157,6 +159,7 @@ def _finding(rule_id, rule, message, path, line, tool_name=None, evidence=None,
     }
 
 
+@register_analyzer(phase="component")
 class GovernanceAnalyzer:
     """Detects missing operational governance controls on agent tools.