classifyre-cli 0.6.12__tar.gz → 0.6.14__tar.gz

classifyre_cli-0.6.14/.turbo/turbo-build.log

@@ -0,0 +1,3 @@
+$ uv sync
+Resolved 325 packages in 232ms
+Checked 52 packages in 3ms

{classifyre_cli-0.6.12 → classifyre_cli-0.6.14}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: classifyre-cli
-Version: 0.6.12
+Version: 0.6.14
 Summary: Classifyre CLI — scan and classify unstructured data sources
 License: MIT
 Keywords: data,ingestion,metadata,pii,secrets,unstructured

{classifyre_cli-0.6.12 → classifyre_cli-0.6.14}/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@classifyre/cli",
-  "version": "0.6.12",
+  "version": "0.6.14",
   "private": true,
   "scripts": {
     "build": "uv sync",

{classifyre_cli-0.6.12 → classifyre_cli-0.6.14}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "classifyre-cli"
-version = "0.6.12"
+version = "0.6.14"
 description = "Classifyre CLI — scan and classify unstructured data sources"
 readme = "README.md"
 # Upper bound is load-bearing: onnxruntime publishes no cp315 wheels (notably

{classifyre_cli-0.6.12 → classifyre_cli-0.6.14}/src/detectors/custom_detector/session.py

@@ -426,14 +426,28 @@ def prior_finding_payload(finding: Any) -> dict[str, Any]:
         "severity": str(getattr(data.get("severity"), "value", data.get("severity")) or ""),
         "confidence": data.get("confidence") or 0.0,
         "location": dict(location),
-        "metadata": {
-            key: value
-            for key, value in metadata.items()
-            if key in {"tabular_row_index", "tabular_column_name", "entity_label", "label"}
-        },
+        "metadata": {key: value for key, value in metadata.items() if key in _PRIOR_METADATA_KEYS},
     }
 
 
+#: What a rule may read of another detector's finding metadata: where it sits,
+#: what it is called, and what a model said -- an LLM's extracted ``fields``, a
+#: decision model's ``question`` and ``answer``. Runner internals stay out.
+_PRIOR_METADATA_KEYS = frozenset(
+    {
+        "tabular_row_index",
+        "tabular_column_name",
+        "entity_label",
+        "label",
+        "fields",
+        "question",
+        "answer",
+        "certainty",
+        "model",
+    }
+)
+
+
 __all__ = [
     "DEFAULT_LIMITS",
     "CustomDetectorSession",

{classifyre_cli-0.6.12 → classifyre_cli-0.6.14}/src/graph/edges.py

@@ -150,10 +150,17 @@ class FieldMapping:
     upstreams: Sequence[str] = ()
     transform: str | None = None
     type: FieldTransform = FieldTransform.TRANSFORMED
+    #: The transformations the value passes through, outermost first
+    #: (``("SUM", "CASE")``) — what a reader scans for before the full
+    #: ``transform`` text.
+    steps: Sequence[str] = ()
 
     def __post_init__(self) -> None:
         cleaned = tuple(str(name).strip() for name in self.upstreams if str(name).strip())
         object.__setattr__(self, "upstreams", cleaned)
+        object.__setattr__(
+            self, "steps", tuple(str(step).strip() for step in self.steps if str(step).strip())
+        )
         if self.downstream is not None:
             object.__setattr__(self, "downstream", str(self.downstream).strip() or None)
         if self.downstream is None and self.type is not FieldTransform.INDIRECT:
@@ -167,6 +174,7 @@ class FieldMapping:
             "downstream": self.downstream,
             "upstreams": list(self.upstreams),
             "transform": self.transform,
+            "steps": list(self.steps),
             "type": str(self.type),
         }
 
@@ -339,6 +347,7 @@ def edge_from_payload(payload: dict[str, Any]) -> Edge:
                 downstream=item.get("downstream"),
                 upstreams=item.get("upstreams") or [],
                 transform=item.get("transform"),
+                steps=item.get("steps") or [],
                 type=FieldTransform(str(item.get("type") or FieldTransform.TRANSFORMED)),
             )
             for item in payload.get("fields") or []

{classifyre_cli-0.6.12 → classifyre_cli-0.6.14}/src/models/generated_detectors.py

@@ -964,6 +964,11 @@ class DetectorScope(BaseModel):
         None,
         description='Asset-metadata equality predicate, e.g. {"doc_type": "jab"}. Every named key must be present on the asset and equal (compared as strings, so 4 and "4" match). A key the asset does not carry excludes it — an absent field is not a match.',
     )
+    content_pattern: str | None = Field(
+        None,
+        description='Regular expression (case-insensitive) the text of a payload must contain for this detector to run on it. Applied per payload, so on a paged document only the pages that match are read: a language model asked about free cash flow reads the pages that use the term, not all 500 pages of the annual report. Payloads without text (pictures, raw bytes) never match.',
+        max_length=2000,
+    )
 
 
 class DetectorBudget(BaseModel):
@@ -1868,6 +1873,9 @@ class CustomDetectorConfig(DetectorConfig):
     Configuration for user-defined detector execution
     """
 
+    model_config = ConfigDict(
+        extra='forbid',
+    )
     custom_detector_key: str = Field(
         ..., description='Stable key used to identify one custom detector instance'
     )

{classifyre_cli-0.6.12 → classifyre_cli-0.6.14}/src/models/generated_input.py

@@ -1357,6 +1357,10 @@ class PostgreSQLOptionalScope(BaseModel):
         None,
         description='Optional table allowlist. Accepted forms: schema.table or database.schema.table',
     )
+    include_views: bool | None = Field(
+        True,
+        description="Include view assets in extraction. A view's column lineage is read from its SQL.",
+    )
     table_limit: int | None = Field(
         None, description='Optional cap on number of table assets extracted', ge=1
     )
@@ -1443,6 +1447,10 @@ class MySQLOptionalScope(BaseModel):
         None,
         description='Optional table allowlist. Accepted forms: table or database.table',
     )
+    include_views: bool | None = Field(
+        True,
+        description="Include view assets in extraction. A view's column lineage is read from its SQL.",
+    )
     table_limit: int | None = Field(
         None,
         description='Optional cap on number of table assets extracted per database',
@@ -4979,6 +4987,9 @@ class CoreInput(BaseModel):
 
 
 class SlackInput(CoreInput):
+    model_config = ConfigDict(
+        extra='forbid',
+    )
     type: Literal['SLACK'] = Field(..., description='Type of the asset or source')
     required: SlackRequired
     masked: SlackMasked
@@ -5001,6 +5012,9 @@ class SlackInput(CoreInput):
 
 
 class EmailInput(CoreInput):
+    model_config = ConfigDict(
+        extra='forbid',
+    )
     type: Literal['EMAIL'] = Field(..., description='Type of the asset or source')
     required: EmailRequired
     masked: EmailMasked
@@ -5023,6 +5037,9 @@ class EmailInput(CoreInput):
 
 
 class S3CompatibleStorageInput(CoreInput):
+    model_config = ConfigDict(
+        extra='forbid',
+    )
     type: Literal['S3_COMPATIBLE_STORAGE'] = Field(
         ..., description='Type of the asset or source'
     )
@@ -5047,6 +5064,9 @@ class S3CompatibleStorageInput(CoreInput):
 
 
 class LocalFolderInput(CoreInput):
+    model_config = ConfigDict(
+        extra='forbid',
+    )
     type: Literal['LOCAL_FOLDER'] = Field(
         ..., description='Type of the asset or source'
     )
@@ -5071,6 +5091,9 @@ class LocalFolderInput(CoreInput):
 
 
 class SandboxInput(CoreInput):
+    model_config = ConfigDict(
+        extra='forbid',
+    )
     type: Literal['SANDBOX'] = Field(..., description='Type of the asset or source')
     required: SandboxRequired
     masked: SandboxMasked | None = None
@@ -5093,6 +5116,9 @@ class SandboxInput(CoreInput):
 
 
 class AzureBlobStorageInput(CoreInput):
+    model_config = ConfigDict(
+        extra='forbid',
+    )
     type: Literal['AZURE_BLOB_STORAGE'] = Field(
         ..., description='Type of the asset or source'
     )
@@ -5117,6 +5143,9 @@ class AzureBlobStorageInput(CoreInput):
 
 
 class GoogleCloudStorageInput(CoreInput):
+    model_config = ConfigDict(
+        extra='forbid',
+    )
     type: Literal['GOOGLE_CLOUD_STORAGE'] = Field(
         ..., description='Type of the asset or source'
     )
@@ -5141,6 +5170,9 @@ class GoogleCloudStorageInput(CoreInput):
 
 
 class WordPressInput(CoreInput):
+    model_config = ConfigDict(
+        extra='forbid',
+    )
     type: Literal['WORDPRESS'] = Field(..., description='Type of the asset or source')
     required: WordPressRequired
     masked: WordPressMasked
@@ -5163,6 +5195,9 @@ class WordPressInput(CoreInput):
 
 
 class PostgreSQLInput(CoreInput):
+    model_config = ConfigDict(
+        extra='forbid',
+    )
     type: Literal['POSTGRESQL'] = Field(..., description='Type of the asset or source')
     required: PostgreSQLRequired
     masked: PostgreSQLMasked
@@ -5185,6 +5220,9 @@ class PostgreSQLInput(CoreInput):
 
 
 class MySQLInput(CoreInput):
+    model_config = ConfigDict(
+        extra='forbid',
+    )
     type: Literal['MYSQL'] = Field(..., description='Type of the asset or source')
     required: MySQLRequired
     masked: MySQLMasked
@@ -5207,6 +5245,9 @@ class MySQLInput(CoreInput):
 
 
 class MSSQLInput(CoreInput):
+    model_config = ConfigDict(
+        extra='forbid',
+    )
     type: Literal['MSSQL'] = Field(..., description='Type of the asset or source')
     required: MSSQLRequired
     masked: MSSQLMasked
@@ -5229,6 +5270,9 @@ class MSSQLInput(CoreInput):
 
 
 class OracleInput(CoreInput):
+    model_config = ConfigDict(
+        extra='forbid',
+    )
     type: Literal['ORACLE'] = Field(..., description='Type of the asset or source')
     required: OracleRequired
     masked: OracleMasked
@@ -5251,6 +5295,9 @@ class OracleInput(CoreInput):
 
 
 class HiveInput(CoreInput):
+    model_config = ConfigDict(
+        extra='forbid',
+    )
     type: Literal['HIVE'] = Field(..., description='Type of the asset or source')
     required: HiveRequired
     masked: HiveMasked
@@ -5273,6 +5320,9 @@ class HiveInput(CoreInput):
 
 
 class DatabricksInput(CoreInput):
+    model_config = ConfigDict(
+        extra='forbid',
+    )
     type: Literal['DATABRICKS'] = Field(..., description='Type of the asset or source')
     required: PersonalAccessToken | ServicePrincipalOAuthM2M | AzureServicePrincipal = (
         Field(..., title='DatabricksRequired')
@@ -5299,6 +5349,9 @@ class DatabricksInput(CoreInput):
 
 
 class SnowflakeInput(CoreInput):
+    model_config = ConfigDict(
+        extra='forbid',
+    )
     type: Literal['SNOWFLAKE'] = Field(..., description='Type of the asset or source')
     required: (
         SnowflakeRequiredDefaultAuthenticator
@@ -5331,6 +5384,9 @@ class SnowflakeInput(CoreInput):
 
 
 class DremioInput(CoreInput):
+    model_config = ConfigDict(
+        extra='forbid',
+    )
     type: Literal['DREMIO'] = Field(..., description='Type of the asset or source')
     required: DremioRequiredSoftware | DremioRequiredCloud = Field(
         ..., title='DremioRequired'
@@ -5355,6 +5411,9 @@ class DremioInput(CoreInput):
 
 
 class MongoDBInput(CoreInput):
+    model_config = ConfigDict(
+        extra='forbid',
+    )
     type: Literal['MONGODB'] = Field(..., description='Type of the asset or source')
     required: MongoDBRequiredAtlas | MongoDBRequiredOnPrem = Field(
         ..., title='MongoDBRequired'
@@ -5381,6 +5440,9 @@ class MongoDBInput(CoreInput):
 
 
 class Neo4jInput(CoreInput):
+    model_config = ConfigDict(
+        extra='forbid',
+    )
     type: Literal['NEO4J'] = Field(..., description='Type of the asset or source')
     required: Neo4jRequired
     masked: Neo4jMaskedUsernamePassword | Neo4jMaskedNone = Field(
@@ -5405,6 +5467,9 @@ class Neo4jInput(CoreInput):
 
 
 class PowerBIInput(CoreInput):
+    model_config = ConfigDict(
+        extra='forbid',
+    )
     type: Literal['POWERBI'] = Field(..., description='Type of the asset or source')
     required: PowerBIRequiredServicePrincipal | PowerBIRequiredAccessToken = Field(
         ..., title='PowerBIRequired'
@@ -5431,6 +5496,9 @@ class PowerBIInput(CoreInput):
 
 
 class TableauInput(CoreInput):
+    model_config = ConfigDict(
+        extra='forbid',
+    )
     type: Literal['TABLEAU'] = Field(..., description='Type of the asset or source')
     required: TableauRequiredUsernamePassword | TableauRequiredPersonalAccessToken = (
         Field(..., title='TableauRequired')
@@ -5457,6 +5525,9 @@ class TableauInput(CoreInput):
 
 
 class ConfluenceInput(CoreInput):
+    model_config = ConfigDict(
+        extra='forbid',
+    )
     type: Literal['CONFLUENCE'] = Field(..., description='Type of the asset or source')
     required: ConfluenceRequired
     masked: ConfluenceMasked
@@ -5479,6 +5550,9 @@ class ConfluenceInput(CoreInput):
 
 
 class JiraInput(CoreInput):
+    model_config = ConfigDict(
+        extra='forbid',
+    )
     type: Literal['JIRA'] = Field(..., description='Type of the asset or source')
     required: JiraRequired
     masked: JiraMasked
@@ -5501,6 +5575,9 @@ class JiraInput(CoreInput):
 
 
 class ServiceDeskInput(CoreInput):
+    model_config = ConfigDict(
+        extra='forbid',
+    )
     type: Literal['SERVICEDESK'] = Field(..., description='Type of the asset or source')
     required: ServiceDeskRequired
     masked: ServiceDeskMasked
@@ -5523,6 +5600,9 @@ class ServiceDeskInput(CoreInput):
 
 
 class SQLiteInput(CoreInput):
+    model_config = ConfigDict(
+        extra='forbid',
+    )
     type: Literal['SQLITE'] = Field(..., description='Type of the asset or source')
     required: SQLiteRequired
     masked: dict[str, Any] | None = Field(
@@ -5549,6 +5629,9 @@ class SQLiteInput(CoreInput):
 
 
 class NotionInput(CoreInput):
+    model_config = ConfigDict(
+        extra='forbid',
+    )
     type: Literal['NOTION'] = Field(..., description='Type of the asset or source')
     required: NotionRequired
     masked: NotionMasked
@@ -5579,6 +5662,9 @@ class DeltaLakeOptional(BaseModel):
 
 
 class DeltaLakeInput(CoreInput):
+    model_config = ConfigDict(
+        extra='forbid',
+    )
     type: Literal['DELTA_LAKE'] = Field(..., description='Type of the asset or source')
     required: DeltaLakeRequired
     masked: S3CompatibleStorageMasked | None = None
@@ -5609,6 +5695,9 @@ class IcebergOptional(BaseModel):
 
 
 class IcebergInput(CoreInput):
+    model_config = ConfigDict(
+        extra='forbid',
+    )
     type: Literal['ICEBERG'] = Field(..., description='Type of the asset or source')
     required: IcebergRequired
     masked: S3CompatibleStorageMasked | None = None
@@ -5631,6 +5720,9 @@ class IcebergInput(CoreInput):
 
 
 class KafkaInput(CoreInput):
+    model_config = ConfigDict(
+        extra='forbid',
+    )
     type: Literal['KAFKA'] = Field(..., description='Type of the asset or source')
     required: (
         NoAuthentication
@@ -5664,6 +5756,9 @@ class KafkaInput(CoreInput):
 
 
 class ElasticsearchInput(CoreInput):
+    model_config = ConfigDict(
+        extra='forbid',
+    )
     type: Literal['ELASTICSEARCH'] = Field(
         ..., description='Type of the asset or source'
     )
@@ -5692,6 +5787,9 @@ class ElasticsearchInput(CoreInput):
 
 
 class OpenSearchInput(CoreInput):
+    model_config = ConfigDict(
+        extra='forbid',
+    )
     type: Literal['OPENSEARCH'] = Field(..., description='Type of the asset or source')
     required: NoAuthentication2 | BasicUsernamePassword | APIKeyBearerToken = Field(
         ..., title='OpenSearchRequired'
@@ -5718,6 +5816,9 @@ class OpenSearchInput(CoreInput):
 
 
 class MeilisearchInput(CoreInput):
+    model_config = ConfigDict(
+        extra='forbid',
+    )
     type: Literal['MEILISEARCH'] = Field(..., description='Type of the asset or source')
     required: NoAuthentication4 | APIKeyBearerToken2 = Field(
         ..., title='MeilisearchRequired'
@@ -5744,6 +5845,9 @@ class MeilisearchInput(CoreInput):
 
 
 class Microsoft365Input(CoreInput):
+    model_config = ConfigDict(
+        extra='forbid',
+    )
     type: Literal['MICROSOFT_365'] = Field(
         ..., description='Type of the asset or source'
     )
@@ -5776,6 +5880,9 @@ class Microsoft365Input(CoreInput):
 
 
 class GoogleWorkspaceInput(CoreInput):
+    model_config = ConfigDict(
+        extra='forbid',
+    )
     type: Literal['GOOGLE_WORKSPACE'] = Field(
         ..., description='Type of the asset or source'
     )
@@ -5804,6 +5911,9 @@ class GoogleWorkspaceInput(CoreInput):
 
 
 class DropboxInput(CoreInput):
+    model_config = ConfigDict(
+        extra='forbid',
+    )
     type: Literal['DROPBOX'] = Field(..., description='Type of the asset or source')
     required: (
         DropboxOAuthRefreshTokenRecommended
@@ -5832,6 +5942,9 @@ class DropboxInput(CoreInput):
 
 
 class HuggingFaceInput(CoreInput):
+    model_config = ConfigDict(
+        extra='forbid',
+    )
     type: Literal['HUGGING_FACE'] = Field(
         ..., description='Type of the asset or source'
     )
@@ -5856,6 +5969,9 @@ class HuggingFaceInput(CoreInput):
 
 
 class GitInput(CoreInput):
+    model_config = ConfigDict(
+        extra='forbid',
+    )
     type: Literal['GIT'] = Field(..., description='Type of the asset or source')
     required: GitRequired
     masked: GitMasked | None = None
@@ -5907,6 +6023,9 @@ class CustomCohortWeights(BaseModel):
 
 
 class YouTubeInput(CoreInput):
+    model_config = ConfigDict(
+        extra='forbid',
+    )
     type: Literal['YOUTUBE'] = Field(..., description='Type of the asset or source')
     required: YouTubeRequired
     masked: YouTubeMasked | None = None
@@ -5929,6 +6048,9 @@ class YouTubeInput(CoreInput):
 
 
 class RedditInput(CoreInput):
+    model_config = ConfigDict(
+        extra='forbid',
+    )
     type: Literal['REDDIT'] = Field(..., description='Type of the asset or source')
     required: (
         RedditRequiredReadOnly | RedditRequiredScript | RedditRequiredRefreshToken
@@ -5983,6 +6105,9 @@ class CustomOptional(BaseModel):
 
 
 class CustomInput(CoreInput):
+    model_config = ConfigDict(
+        extra='forbid',
+    )
     type: Literal['CUSTOM'] = Field(..., description='Type of the asset or source')
     required: CustomRequired
     masked: CustomMasked | None = None

{classifyre_cli-0.6.12 → classifyre_cli-0.6.14}/src/notebook/sdk.py

@@ -716,12 +716,14 @@ class Context:
 
     @property
     def config_changed(self) -> bool:
-        """True on the first run after this source's settings changed.
+        """True on the first run after this source's settings changed, and on a
+        run started as a full rescan.
 
         "Settings" is anything in the source's configuration -- scope,
         sampling, variables, the notebook itself, which detectors are on --
         and the definition of any custom detector it uses. Rotating a secret
-        does not count.
+        does not count. A full rescan asks for the whole sweep again with the
+        same settings, so it sets the flag as well.
 
         A built-in source starts its sweep over when that happens. A notebook
         owns its own cursor, so nothing is taken from it; it is told instead,
@@ -758,10 +760,11 @@ class Context:
         ``(rank, id)``: ``rank`` is what makes an item newer -- a timestamp, an
         increasing number -- and must be an int, float or string of one
         consistent type that only changes when the item does; ``id`` is unique
-        to the item. Each run gets ``limit`` items (``rows_per_page`` by
-        default): everything newer than what earlier runs read comes first,
-        the rest continues backwards from where the last run stopped, and once
-        the whole listing has been read only new items are returned.
+        to the item. Each run gets ``limit`` items -- by default ``ctx.limit``:
+        the whole listing under the ALL strategy, ``rows_per_page`` otherwise.
+        Everything newer than what earlier runs read comes first, the rest
+        continues backwards from where the last run stopped, and once the whole
+        listing has been read only new items are returned.
 
         The position is kept in the cursor beside whatever you store there,
         one per ``name``, and starts over when ``ctx.config_changed``. Calling
@@ -770,10 +773,11 @@ class Context:
         stored = self._cursor.get("frontier")
         previous = stored.get(str(name)) if isinstance(stored, dict) else None
         frontier = ListFrontier(None if self._config_changed else previous)
-        window = frontier.window(
-            ((*order(item), item) for item in items),
-            int(limit) if limit else self.page_size,
-        )
+        entries = [(*order(item), item) for item in items]
+        # Without a limit of its own the run takes what the source's sampling
+        # asks for: everything under ALL, ``rows_per_page`` otherwise.
+        budget = int(limit) if limit else (self.limit if self.limit is not None else len(entries))
+        window = frontier.window(entries, budget)
         state = frontier.to_state()
         if state is not None:
             self._frontier_state[str(name)] = state

{classifyre_cli-0.6.12 → classifyre_cli-0.6.14}/src/pipeline/detector_pipeline.py

@@ -3,7 +3,9 @@
 from __future__ import annotations
 
 import asyncio
+import functools
 import logging
+import re
 import time
 from collections.abc import AsyncGenerator, Awaitable, Callable
 from datetime import UTC, datetime
@@ -107,6 +109,32 @@ def _detector_covers_content_type(detector: BaseDetector, content_type: str) ->
     return any(actual.startswith(str(prefix).strip().lower()) for prefix in content_types)
 
 
+@functools.lru_cache(maxsize=256)
+def _content_pattern(pattern: str) -> re.Pattern[str] | None:
+    try:
+        return re.compile(pattern, re.IGNORECASE)
+    except re.error:
+        logger.warning("Ignoring invalid detector scope content_pattern %r", pattern)
+        return None
+
+
+def _detector_covers_text(detector: BaseDetector, content: str | bytes) -> bool:
+    """Whether a payload's text contains the scope's ``content_pattern``.
+
+    Checked per payload, so a paged document is narrowed page by page: an
+    expensive model runs on the pages that use the words it is asked about,
+    not on the whole report. A payload without text never matches.
+    """
+    scope = _detector_scope(detector)
+    pattern = getattr(scope, "content_pattern", None) if scope is not None else None
+    if not pattern:
+        return True
+    if not isinstance(content, str):
+        return False
+    compiled = _content_pattern(str(pattern))
+    return compiled is None or compiled.search(content) is not None
+
+
 class _DetectorInfo:
     """Serialisable metadata for routing a detector through the process pool."""
 
@@ -909,6 +937,7 @@ class DetectorPipeline:
             # A declared scope narrows what the engine already supports; it
             # can never widen it, so this runs after the engine's own check.
             and _detector_covers_content_type(detector, content_type)
+            and _detector_covers_text(detector, content)
         ]
         async with self._breaker.first_contact(
             *(self._breaker_key_or_default(detector) for detector in compatible)

{classifyre_cli-0.6.12 → classifyre_cli-0.6.14}/src/pipeline/scan_cache.py

@@ -367,6 +367,7 @@ class ScanCache:
         self._verify: str = verify if verify in {"metadata", "content"} else "content"
 
         self._cacheable, self._always_run = self._build_fingerprints(recipe)
+        self._reads_findings = self._rules_reading_findings(recipe)
 
         if not supported:
             self._disabled_reason = "source does not support the scan cache"
@@ -423,6 +424,20 @@ class ScanCache:
 
         return cacheable, frozenset(always_run)
 
+    @staticmethod
+    def _rules_reading_findings(recipe: dict[str, Any]) -> frozenset[str]:
+        """Keys of the code detectors that read the other detectors' findings."""
+        keys: set[str] = set()
+        entries = recipe.get("detectors")
+        for entry in entries if isinstance(entries, list) else []:
+            if not isinstance(entry, dict) or not entry.get("enabled", True):
+                continue
+            config = entry.get("config")
+            schema = config.get("pipeline_schema") if isinstance(config, dict) else None
+            if isinstance(schema, dict) and schema.get("needs_findings"):
+                keys.add(detector_cache_key(str(entry.get("type") or ""), config))
+        return frozenset(keys)
+
     @property
     def enabled(self) -> bool:
         return self._enabled
@@ -515,8 +530,12 @@ class ScanCache:
             if prior.detectors.get(key) != fingerprint
         }
         run_keys = stale | set(self._always_run)
+        if run_keys & self._reads_findings:
+            # A rule with needs_findings sees only what ran in this pass: re-run
+            # alone, it would judge an asset as if nothing else had found anything.
+            run_keys |= set(self._cacheable)
         carried = {
-            key: fingerprint for key, fingerprint in self._cacheable.items() if key not in stale
+            key: fingerprint for key, fingerprint in self._cacheable.items() if key not in run_keys
         }
 
         # Media the workspace embeds and this asset has not yet sent under the