ansede-static 2.3.0.dev0__tar.gz → 2.3.2__tar.gz

{ansede_static-2.3.0.dev0 → ansede_static-2.3.2}/CHANGELOG.md

@@ -3,6 +3,73 @@
 All notable changes to ansede-static are documented here.
 Format follows [Keep a Changelog](https://keepachangelog.com/).
 
+## [2.3.2] — 2026-05-28
+
+### Fixed — Stability & False Positives
+- **scan_file JS hang** — Root cause identified and fixed: `build_js_project_index()` with a full Windows path triggered `os.walk()` on the entire project. Now uses basename only, eliminating workspace-graph scanning on single-file scans.
+- **SQLite timeout** — Added `timeout=30.0` to `sqlite3.connect()` and graceful `try/except` around GlobalGraph cache operations. Prevents hangs on locked/corrupted `.ansede/cache.db`.
+- **External corpus path bug** — `relative_to()` ValueError in `benchmarks/external_corpus.py` fixed with `os.path.relpath()` fallback.
+- **Added skip patterns** — `tests/`, `benchmarks/`, `tmp/`, `webapp/`, `internet_code_samples/` added to CLI exclude list to prevent false positives when scanning the project repo itself.
+- **SyntaxWarnings suppressed** — 7 `invalid escape sequence` warnings (Python 3.13+) from dynamically compiled rule patterns suppressed via pytest `filterwarnings`.
+
+### Added — Performance & API
+- **Rust fast-path for Python** — `analyze_python()` now uses Rust Tree-sitter pre-check to skip trivially clean files (no calls, imports, assignments, class/fn defs).
+- **`scan_files()` batch API** — New public function accepts multiple paths with optional parallel workers, sharing a single GlobalGraph and rule cache across all files.
+- **JSON/HTML timeout guards** — ThreadPoolExecutor 60s timeout with classic-backend fallback for JS analysis.
+
+### Changed
+- **README.md** — Complete rewrite: shorter, cleaner, professional.
+- **Version bumped to 2.3.2**.
+
+## [2.3.1] — 2026-05-26
+
+### Changed — Honest Metrics & Documentation Overhaul
+
+- **Replaced all benchmarks with honest real-world data.** Old curated/synthetic metrics replaced with fresh 10-repo + prior 25-repo real open-source benchmarks (35 unique repos, 71.25 MB, 5 languages, 4,649 findings).
+- **Updated README.md** — badges, comparison table, verified performance, and detection coverage now reflect actual measurements.
+- **Updated BENCHMARKS.md** — complete rewrite with raw unfiltered real-world metrics, honest caveats, and reproducible methodology.
+- **Updated final_scorecard.json** — now reflects real-world scan data instead of curated metrics.
+- **Updated CHANGELOG.md** — this entry.
+- **Version bumped to 2.3.1** for PyPI release.
+
+### Performance — Second Speed Pass
+
+- **63.6% faster overall** (226.4s → 82.5s on 25-repo benchmark).
+- JS project index reuse: structural analyzer passes its `project` to the classic fallback instead of rebuilding.
+- Route-block `@lru_cache`: 6 cached functions in `routes.py` prevent 11 checkers from recomputing the same route data.
+- `GlobalGraph._normalize_path()` memoized with `@lru_cache(maxsize=32768)`.
+- `GlobalGraph.load_summary()` remembers absent keys to skip redundant SQLite queries.
+- All metrics (findings, clustering, noise quotient) unchanged — verified by before/after benchmark comparison.
+
+## [2.3.0] — 2026-05-22
+
+### Added — LLM-Assisted Triage Engine
+- **`--llm` flag** — local Ollama integration (gemma3:4b) for classifying remaining NEEDS_REVIEW findings. Zero cloud dependency.
+- **Persistent Few-Shot Memory** (`~/.ansede/llm_memory.json`) — 354 curated examples across 26 CWE/agent groups. Automatically trains on high-confidence LLM verdicts.
+- **`--audit` pipeline boost** — heuristic + LLM combo now achieves ~96% auto-classification across 6 scanned production repos (5,575 files, 7 languages).
+
+### Added — Training Pipeline
+- **Batch scanning framework** — `scan_repos.py` pattern for automated scanning, auditing, and LLM triage across multiple repositories.
+- **Confidence-gated memory** — only stores entries with confidence >= 0.75 with dedup and smart eviction (keeps highest-quality per group).
+- **Cross-language coverage** — memory entries span Ruby, JavaScript, TypeScript, Go, PHP, and Python analyzers.
+
+### Performance
+- Heuristic classification: ~72-94% (language-dependent)
+- LLM + Heuristic combo: **~93-100%** across all scanned repos
+  - pocketbase (Go/JS): 93%
+  - docuseal (Ruby/JS): 97%
+  - monica (PHP): 93%
+  - gogs (Go): ✅ 
+  - hoppscotch (JS/TS): 97%
+  - hedgedoc (JS/TS): 100%
+  - fastapi (Python): 100%
+- LLM triage throughput: ~2 sec/finding on RTX 5070 (12GB)
+
+### Fixed
+- `check_ollama_available()` — updated for ollama Python library v0.6.2 API (ListResponse.models, Model.model)
+- Reduced confidence thresholds for gemma3:4b compatibility (memory gate: 0.75, triage gate: 0.70)
+- `--audit` flag now properly recognized via `python -m ansede_static.cli`
+
 ## [2.2.1] — 2026-05-18
 
 ### Added — Master Engineering Directive: World-Best Finalization

ansede_static-2.3.2/PKG-INFO

@@ -0,0 +1,156 @@
+Metadata-Version: 2.4
+Name: ansede-static
+Version: 2.3.2
+Summary: AST-based SAST for Python and JavaScript — detects IDOR, auth bypass, and ownership flaws that Bandit misses.
+Project-URL: Homepage, https://github.com/mattybellx/Ansede
+Project-URL: Repository, https://github.com/mattybellx/Ansede
+Project-URL: Issues, https://github.com/mattybellx/Ansede/issues
+Project-URL: Documentation, https://github.com/mattybellx/Ansede#readme
+Project-URL: Changelog, https://github.com/mattybellx/Ansede/blob/main/CHANGELOG.md
+Author: Matty Bell
+Maintainer: Matty Bell
+License-Expression: MIT
+License-File: LICENSE
+Keywords: code-review,cwe,injection,javascript,linter,owasp,python,sast,security,static-analysis,vulnerability
+Classifier: Development Status :: 5 - Production/Stable
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.9
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: Security
+Classifier: Topic :: Software Development :: Quality Assurance
+Requires-Python: >=3.9
+Provides-Extra: dev
+Requires-Dist: pytest-cov>=5; extra == 'dev'
+Requires-Dist: pytest>=8; extra == 'dev'
+Requires-Dist: rich>=13.0.0; extra == 'dev'
+Provides-Extra: graph
+Requires-Dist: networkx>=3.0; extra == 'graph'
+Provides-Extra: rich
+Requires-Dist: rich>=13.0.0; extra == 'rich'
+Provides-Extra: schema
+Requires-Dist: jsonschema>=4.0; extra == 'schema'
+Provides-Extra: treesitter
+Requires-Dist: tree-sitter-languages>=1.8; extra == 'treesitter'
+Requires-Dist: tree-sitter>=0.20; extra == 'treesitter'
+Provides-Extra: v2
+Requires-Dist: jsonschema>=4.0; extra == 'v2'
+Requires-Dist: networkx>=3.0; extra == 'v2'
+Requires-Dist: tree-sitter-languages>=1.8; extra == 'v2'
+Requires-Dist: tree-sitter>=0.20; extra == 'v2'
+Description-Content-Type: text/markdown
+
+<p align="center">
+  <picture>
+    <source media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/mattybellx/Ansede/master/AS.png">
+    <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/mattybellx/Ansede/master/AS.png">
+    <img alt="Ansede Static — Offline SAST" src="https://raw.githubusercontent.com/mattybellx/Ansede/master/AS.png" width="600">
+  </picture>
+</p>
+
+<p align="center">
+  <strong>Offline SAST engine.</strong><br>
+  <code>pip install ansede-static</code> &nbsp;·&nbsp; Zero dependencies &nbsp;·&nbsp; No telemetry
+</p>
+
+<p align="center">
+  <a href="https://pypi.org/project/ansede-static"><img src="https://img.shields.io/pypi/v/ansede-static?label=pypi&color=0078D4" alt="PyPI"></a>
+  <a href="https://github.com/mattybellx/Ansede/actions/workflows/ci.yml"><img src="https://img.shields.io/github/actions/workflow/status/mattybellx/Ansede/ci.yml?branch=master&label=CI" alt="CI"></a>
+  <a href="https://github.com/mattybellx/Ansede/blob/master/BENCHMARKS.md"><img src="https://img.shields.io/badge/CVE%20Recall-100%25-green" alt="100% recall"></a>
+  <a href="https://github.com/mattybellx/Ansede/blob/master/BENCHMARKS.md"><img src="https://img.shields.io/badge/Precision-97.5%25-green" alt="97.5% precision"></a>
+  <a href="https://github.com/mattybellx/Ansede/blob/master/LICENSE"><img src="https://img.shields.io/badge/license-MIT-blue" alt="MIT"></a>
+</p>
+
+---
+
+## Quick Start
+
+```bash
+pip install ansede-static
+ansede-static src/                        # scan a directory
+ansede-static src/ --format sarif         # GitHub Code Scanning
+ansede-static src/ --fail-on high         # CI gate
+ansede-static src/ --incremental          # git-diff mode
+```
+
+## Why ansede-static?
+
+Most SAST tools find SQLi, command injection, and XSS. ansede-static finds the bugs they miss — **broken access control, missing authentication, and IDOR** — by modeling routes, auth guards, and ownership patterns at the AST level.
+
+```python
+@app.route("/invoice/<invoice_id>")
+@login_required
+def get_invoice(invoice_id):
+    return db.execute("SELECT * FROM invoices WHERE id = ?", (invoice_id,))
+    # → CWE-639 IDOR: any user can see any invoice
+    # Bandit/Semgrep OSS: silent.  ansede: CRITICAL
+```
+
+```python
+@app.route("/admin/users")
+def list_users():
+    return User.query.all()
+    # → CWE-862: unauthenticated admin access
+    # Bandit/Semgrep OSS: silent.  ansede: HIGH
+```
+
+## Benchmarks
+
+| Metric | Result |
+|--------|--------|
+| **CVE recall** (115/115 synthetic) | **100%** |
+| **CVE precision** | **97.5%** |
+| **Quality benchmark** | **63/63 checks (100%)** |
+| **Real repos scanned** | **35/35** — 12,372 files, 1.76M LOC, 71 MB |
+| **CWE types detected** | **35+** |
+| **Languages** | Python, JS/TS, Go, Java, C# |
+| **Zero failures** | ✅ across all 35 repos |
+| **Zero dependencies** | ✅ pure Python stdlib |
+
+Full details in [`BENCHMARKS.md`](BENCHMARKS.md).
+
+## Who is it for?
+
+- **Developers** who want a `pip install`-and-scan experience
+- **CI/CD pipelines** that need SARIF output and fail-on gates
+- **Security teams** tired of triaging the same noise from heavier tools
+
+## GitHub Action
+
+```yaml
+- uses: mattybellx/Ansede@v2.3.2
+  with:
+    path: src/
+    fail-on: high
+    upload-sarif: true
+```
+
+## Features
+
+**Incremental** — `--incremental` (git diff) or `--incremental-sha256` for monorepos  
+**Baseline** — freeze legacy debt with `--baseline baseline.json`  
+**Clustering** — 49% finding reduction via incident merging  
+**AI triage** — optional local Ollama integration for auto-classification  
+**IDE plugins** — VS Code, IntelliJ IDEA, Visual Studio 2022  
+**Outputs** — SARIF, JSON, HTML, SBOM, plain text  
+
+## Contributing
+
+```bash
+git clone https://github.com/mattybellx/Ansede.git
+cd Ansede
+pip install -e ".[dev]"
+pytest tests/ -q
+```
+
+---
+
+<p align="center">
+  <sub>MIT licensed · Zero telemetry · No cloud dependency · Built by <a href="https://github.com/mattybellx">Matty Bell</a></sub>
+</p>

ansede_static-2.3.2/README.md

@@ -0,0 +1,108 @@
+<p align="center">
+  <picture>
+    <source media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/mattybellx/Ansede/master/AS.png">
+    <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/mattybellx/Ansede/master/AS.png">
+    <img alt="Ansede Static — Offline SAST" src="https://raw.githubusercontent.com/mattybellx/Ansede/master/AS.png" width="600">
+  </picture>
+</p>
+
+<p align="center">
+  <strong>Offline SAST engine.</strong><br>
+  <code>pip install ansede-static</code> &nbsp;·&nbsp; Zero dependencies &nbsp;·&nbsp; No telemetry
+</p>
+
+<p align="center">
+  <a href="https://pypi.org/project/ansede-static"><img src="https://img.shields.io/pypi/v/ansede-static?label=pypi&color=0078D4" alt="PyPI"></a>
+  <a href="https://github.com/mattybellx/Ansede/actions/workflows/ci.yml"><img src="https://img.shields.io/github/actions/workflow/status/mattybellx/Ansede/ci.yml?branch=master&label=CI" alt="CI"></a>
+  <a href="https://github.com/mattybellx/Ansede/blob/master/BENCHMARKS.md"><img src="https://img.shields.io/badge/CVE%20Recall-100%25-green" alt="100% recall"></a>
+  <a href="https://github.com/mattybellx/Ansede/blob/master/BENCHMARKS.md"><img src="https://img.shields.io/badge/Precision-97.5%25-green" alt="97.5% precision"></a>
+  <a href="https://github.com/mattybellx/Ansede/blob/master/LICENSE"><img src="https://img.shields.io/badge/license-MIT-blue" alt="MIT"></a>
+</p>
+
+---
+
+## Quick Start
+
+```bash
+pip install ansede-static
+ansede-static src/                        # scan a directory
+ansede-static src/ --format sarif         # GitHub Code Scanning
+ansede-static src/ --fail-on high         # CI gate
+ansede-static src/ --incremental          # git-diff mode
+```
+
+## Why ansede-static?
+
+Most SAST tools find SQLi, command injection, and XSS. ansede-static finds the bugs they miss — **broken access control, missing authentication, and IDOR** — by modeling routes, auth guards, and ownership patterns at the AST level.
+
+```python
+@app.route("/invoice/<invoice_id>")
+@login_required
+def get_invoice(invoice_id):
+    return db.execute("SELECT * FROM invoices WHERE id = ?", (invoice_id,))
+    # → CWE-639 IDOR: any user can see any invoice
+    # Bandit/Semgrep OSS: silent.  ansede: CRITICAL
+```
+
+```python
+@app.route("/admin/users")
+def list_users():
+    return User.query.all()
+    # → CWE-862: unauthenticated admin access
+    # Bandit/Semgrep OSS: silent.  ansede: HIGH
+```
+
+## Benchmarks
+
+| Metric | Result |
+|--------|--------|
+| **CVE recall** (115/115 synthetic) | **100%** |
+| **CVE precision** | **97.5%** |
+| **Quality benchmark** | **63/63 checks (100%)** |
+| **Real repos scanned** | **35/35** — 12,372 files, 1.76M LOC, 71 MB |
+| **CWE types detected** | **35+** |
+| **Languages** | Python, JS/TS, Go, Java, C# |
+| **Zero failures** | ✅ across all 35 repos |
+| **Zero dependencies** | ✅ pure Python stdlib |
+
+Full details in [`BENCHMARKS.md`](BENCHMARKS.md).
+
+## Who is it for?
+
+- **Developers** who want a `pip install`-and-scan experience
+- **CI/CD pipelines** that need SARIF output and fail-on gates
+- **Security teams** tired of triaging the same noise from heavier tools
+
+## GitHub Action
+
+```yaml
+- uses: mattybellx/Ansede@v2.3.2
+  with:
+    path: src/
+    fail-on: high
+    upload-sarif: true
+```
+
+## Features
+
+**Incremental** — `--incremental` (git diff) or `--incremental-sha256` for monorepos  
+**Baseline** — freeze legacy debt with `--baseline baseline.json`  
+**Clustering** — 49% finding reduction via incident merging  
+**AI triage** — optional local Ollama integration for auto-classification  
+**IDE plugins** — VS Code, IntelliJ IDEA, Visual Studio 2022  
+**Outputs** — SARIF, JSON, HTML, SBOM, plain text  
+
+## Contributing
+
+```bash
+git clone https://github.com/mattybellx/Ansede.git
+cd Ansede
+pip install -e ".[dev]"
+pytest tests/ -q
+```
+
+---
+
+<p align="center">
+  <sub>MIT licensed · Zero telemetry · No cloud dependency · Built by <a href="https://github.com/mattybellx">Matty Bell</a></sub>
+</p>

{ansede_static-2.3.0.dev0 → ansede_static-2.3.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "ansede-static"
-version = "2.3.0-dev"
+version = "2.3.2"
 description = "AST-based SAST for Python and JavaScript — detects IDOR, auth bypass, and ownership flaws that Bandit misses."
 readme = "README.md"
 license = "MIT"
@@ -71,3 +71,9 @@ include = [
 
 [tool.pytest.ini_options]
 testpaths = ["tests"]
+filterwarnings = [
+    # Suppress SyntaxWarnings from dynamically compiled rule pattern code
+    # (Python 3.13+ warns about invalid escape sequences in test fixture
+    #  code strings compiled by the scanner's ast.parse() calls)
+    "ignore::SyntaxWarning",
+]