brasscoders 2.0.7__tar.gz → 2.0.8__tar.gz

{brasscoders-2.0.7/src/brasscoders.egg-info → brasscoders-2.0.8}/PKG-INFO

@@ -1,11 +1,13 @@
 Metadata-Version: 2.4
 Name: brasscoders
-Version: 2.0.7
+Version: 2.0.8
 Summary: BrassCoders — catches the bugs your AI coding assistant misses
 Author-email: Copper Sun Brass Team <info@coppersun.dev>
 License: Apache-2.0
 Project-URL: Homepage, https://coppersun.dev/
-Project-URL: Issues, https://github.com/CopperSunDev/brass-intelligence/issues
+Project-URL: Repository, https://github.com/CopperSunDev/brasscoders
+Project-URL: Issues, https://github.com/CopperSunDev/brasscoders/issues
+Project-URL: Documentation, https://coppersun.dev/install/
 Keywords: claude-code,ai-coding,code-review,noise-filter,static-analysis
 Classifier: Development Status :: 4 - Beta
 Classifier: Intended Audience :: Developers

{brasscoders-2.0.7 → brasscoders-2.0.8}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "brasscoders"
-version = "2.0.7"
+version = "2.0.8"
 description = "BrassCoders — catches the bugs your AI coding assistant misses"
 readme = "README.md"
 requires-python = ">=3.10"
@@ -67,13 +67,14 @@ performance = [
 brasscoders = "brass.cli.brass_cli:main"
 
 [project.urls]
-# Note: while github.com/CopperSunDev/brass-intelligence is private, the
-# Issues link will 404 for unauthenticated users. Make the repo public
-# (or set up a separate public issue tracker) before the first paying
-# customer can file issues. Email fallback: brass@coppersuncreative.com
-# (per cli/SECURITY.md).
+# Public OSS mirror of cli/ lives at github.com/CopperSunDev/brasscoders.
+# That repo is a subtree push from this monorepo's cli/ directory; the
+# monorepo itself stays private because it also contains the closed-source
+# gateway. See scripts/sync-oss-mirror.sh for the sync mechanism.
 Homepage = "https://coppersun.dev/"
-Issues = "https://github.com/CopperSunDev/brass-intelligence/issues"
+Repository = "https://github.com/CopperSunDev/brasscoders"
+Issues = "https://github.com/CopperSunDev/brasscoders/issues"
+Documentation = "https://coppersun.dev/install/"
 
 [tool.setuptools]
 include-package-data = true

{brasscoders-2.0.7 → brasscoders-2.0.8}/src/brass/__init__.py

@@ -5,5 +5,5 @@ Revolutionary architecture for providing fantastic intelligence to Claude Code
 and other AI assistants.
 """
 
-__version__ = "2.0.7"
+__version__ = "2.0.8"
 __author__ = "Copper Sun Brass Team"

{brasscoders-2.0.7 → brasscoders-2.0.8}/src/brass/output/yaml_builders/base_builder.py

@@ -41,7 +41,14 @@ _SECRET_LEAK_DETECTORS = frozenset({
     # does `detected_by.lower()` before lookup), so all entries must
     # be lowercase here.
     'auth_pattern_analyzer',  # AIAuthPatternAnalyzer.hardcoded_secrets
-    'bandit',  # B105 / B106 / B107 / B324 hit hardcoded credentials
+    # 'bandit' is NOT here — it's discriminated per-test_id below via
+    # _BANDIT_CREDENTIAL_TEST_IDS. Only B105/B106/B107 actually embed
+    # a credential literal in issue_text. Treating all bandit findings
+    # as credential-bearing collapsed B602 (command injection), B701
+    # (jinja2 autoescape), B301/B403 (deserialization) and others to
+    # the generic "Possible hardcoded credential" label, hiding the
+    # real vulnerability class from downstream AI consumers.
+    # (Bug reported 2026-06-02; fix landed in 2.0.8.)
     # The detect-secrets-backed SecretsScanner. Its findings' raw
     # context contains the credential string itself; sanitization
     # must strip it. Added 2026-05-15 after Phase D's code_snippet
@@ -84,6 +91,23 @@ _SECRET_LEAK_PATTERN_TYPES = frozenset({
 })
 
 
+# Bandit test_ids whose `issue_text` embeds a credential literal.
+# These get the full secret-redaction treatment at the YAML boundary
+# (title/description replaced with a generic safe form). Every other
+# bandit test_id passes through with its real issue_text preserved.
+#
+# Source: bandit plugin docs — these are the only tests in the
+# hardcoded-password family. B324 (weak hash) was previously grouped
+# here in a comment but its issue_text does NOT carry the digest
+# literal (Bandit reports the algorithm name, not the hash output),
+# so it stays out of this set.
+_BANDIT_CREDENTIAL_TEST_IDS = frozenset({
+    'B105',  # hardcoded_password_string
+    'B106',  # hardcoded_password_funcarg
+    'B107',  # hardcoded_password_default
+})
+
+
 # Defense-in-depth credential redaction applied to every finding's
 # ``description`` field at serialization time. Originally lived as a
 # staticmethod on ``LegacyPatternScanner._redact_secret_substrings``
@@ -360,7 +384,18 @@ class BaseYAMLBuilder(ABC):
                 or metadata.get('test_name', '')
             )
             pattern_type_lower = str(pattern_type).lower()
+            # Bandit findings discriminate by test_id: only B105/B106/B107
+            # embed the credential literal in issue_text. Other bandit
+            # tests (B602/B603/B604 shell injection, B701 jinja2
+            # autoescape, B301/B403 deserialization, etc.) have generic
+            # issue_text that should pass through unchanged so the AI
+            # consumer sees the real vuln class.
+            is_bandit_credential = (
+                detected_by == 'bandit'
+                and metadata.get('bandit_test_id') in _BANDIT_CREDENTIAL_TEST_IDS
+            )
             if (detected_by in _SECRET_LEAK_DETECTORS
+                    or is_bandit_credential
                     or pattern_type_lower in _SECRET_LEAK_PATTERN_TYPES):
                 for key in PRIVACY_SENSITIVE_METADATA_KEYS:
                     metadata.pop(key, None)
@@ -627,7 +662,7 @@ class BaseYAMLBuilder(ABC):
           - LHS must not match any known credential-shape pattern —
             blocks the edge case where the variable name itself
             is a credential literal (e.g.
-            ``AKIAIOSFODNN7EXAMPLE = "marker"``).
+            ``AKIAFIXTURE000000000 = "marker"``).
         """
         try:
             src_path = Path(file_path)

{brasscoders-2.0.7 → brasscoders-2.0.8/src/brasscoders.egg-info}/PKG-INFO

@@ -1,11 +1,13 @@
 Metadata-Version: 2.4
 Name: brasscoders
-Version: 2.0.7
+Version: 2.0.8
 Summary: BrassCoders — catches the bugs your AI coding assistant misses
 Author-email: Copper Sun Brass Team <info@coppersun.dev>
 License: Apache-2.0
 Project-URL: Homepage, https://coppersun.dev/
-Project-URL: Issues, https://github.com/CopperSunDev/brass-intelligence/issues
+Project-URL: Repository, https://github.com/CopperSunDev/brasscoders
+Project-URL: Issues, https://github.com/CopperSunDev/brasscoders/issues
+Project-URL: Documentation, https://coppersun.dev/install/
 Keywords: claude-code,ai-coding,code-review,noise-filter,static-analysis
 Classifier: Development Status :: 4 - Beta
 Classifier: Intended Audience :: Developers