codedd-cli 0.1.5__tar.gz → 0.1.6__tar.gz

{codedd_cli-0.1.5 → codedd_cli-0.1.6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codedd-cli
-Version: 0.1.5
+Version: 0.1.6
 Summary: CLI tool for CodeDD — run code audits from your terminal
 License: MIT
 License-File: LICENSE

{codedd_cli-0.1.5 → codedd_cli-0.1.6}/codedd_cli/__init__.py

@@ -1,3 +1,3 @@
-"""CodeDD CLI — run code audits from your terminal."""
-
-__version__ = "0.1.5"
+"""CodeDD CLI — run code audits from your terminal."""
+
+__version__ = "0.1.6"

{codedd_cli-0.1.5 → codedd_cli-0.1.6}/codedd_cli/api/client.py

@@ -24,6 +24,7 @@ from codedd_cli.config.constants import (
     USER_AGENT_PREFIX,
 )
 from codedd_cli.config.settings import ConfigManager
+from codedd_cli.config.url_validation import should_verify_tls_for_api_url
 
 
 class CodeDDClient:
@@ -42,11 +43,7 @@ class CodeDDClient:
         self._base_url = self._config.api_url.rstrip("/")
         self._token = token if token is not None else TokenManager.retrieve()
 
-        # For localhost HTTP, disable TLS verification (not applicable anyway)
-        # For HTTPS, always verify certificates
-        verify_tls = not self._base_url.startswith("http://localhost") and not self._base_url.startswith(
-            "http://127.0.0.1"
-        )
+        verify_tls = should_verify_tls_for_api_url(self._base_url)
 
         self._client = httpx.Client(
             base_url=self._base_url,

{codedd_cli-0.1.5 → codedd_cli-0.1.6}/codedd_cli/api/endpoints.py

@@ -1,7 +1,9 @@
 """
 Server endpoint path constants.
 
-All paths are relative to the ``api_url`` stored in the CLI config
+All paths are absolute from the server host root (they include the ``/api/``
+prefix). The ``api_url`` in CLI config is the host only, e.g.
+``https://api.codedd.ai`` or ``http://localhost:8000``.
 """
 
 
@@ -17,7 +19,8 @@ class Endpoints:
     # Scope
     REGISTER_SCOPE = "/api/cli/scope/register/"
     SCOPE_FILES = "/api/cli/scope/files/"
-    DELETE_REPO_FROM_SCOPE = "/delete_repo_from_scope/"
+    # Legacy web route reused by the CLI (django_codedd.urls → api/delete_repo_from_scope/).
+    DELETE_REPO_FROM_SCOPE = "/api/delete_repo_from_scope/"
 
     # Audit lifecycle
     AUDIT_CAN_START = "/api/cli/audit/can-start/"
@@ -61,3 +64,7 @@ class Endpoints:
     # Fix access control (remediation module)
     FIX_ACCESS_STATUS = "/api/cli/fix/access/status/"
     FIX_ACCESS_TOGGLE = "/api/cli/fix/access/toggle/"
+
+    # Issue Compass saved selections (flag-issue slices from the web explorer)
+    FIX_ISSUE_COMPASS_SELECTIONS = "/api/cli/fix/issue-compass-selections/"
+    FIX_ISSUE_COMPASS_SELECTIONS_CATALOG = "/api/cli/fix/issue-compass-selections/catalog/"

{codedd_cli-0.1.5 → codedd_cli-0.1.6}/codedd_cli/api/exceptions.py

@@ -1,24 +1,24 @@
-"""
-API-layer exceptions with user-facing messages.
-
-Raised when the CLI cannot reach the CodeDD server (connection refused,
-timeout, server disconnected, etc.). Handled at the CLI entry point to
-display a single, clear message instead of a full traceback.
-"""
-
-# Pre-defined message shown when the remote is not responding.
-CONNECTION_ERROR_MESSAGE = (
-    "Unable to reach CodeDD. "
-    "Check that the server is running and your network connection is available, "
-    "or try again later."
-)
-
-
-class CodeDDConnectionError(Exception):
-    """
-    Raised when a request to the CodeDD API fails due to connection
-    or transport errors (e.g. server not responding, timeout, disconnect).
-    """
-
-    def __init__(self, message: str | None = None) -> None:
-        super().__init__(message or CONNECTION_ERROR_MESSAGE)
+"""
+API-layer exceptions with user-facing messages.
+
+Raised when the CLI cannot reach the CodeDD server (connection refused,
+timeout, server disconnected, etc.). Handled at the CLI entry point to
+display a single, clear message instead of a full traceback.
+"""
+
+# Pre-defined message shown when the remote is not responding.
+CONNECTION_ERROR_MESSAGE = (
+    "Unable to reach CodeDD. "
+    "Check that the server is running and your network connection is available, "
+    "or try again later."
+)
+
+
+class CodeDDConnectionError(Exception):
+    """
+    Raised when a request to the CodeDD API fails due to connection
+    or transport errors (e.g. server not responding, timeout, disconnect).
+    """
+
+    def __init__(self, message: str | None = None) -> None:
+        super().__init__(message or CONNECTION_ERROR_MESSAGE)

{codedd_cli-0.1.5 → codedd_cli-0.1.6}/codedd_cli/auditor/archetype_classifier.py

@@ -159,7 +159,7 @@ class DimensionScorer:
         has already been credited in another dimension."""
         credited_dims = self._tech_credit_ledger.get(tech_keyword, set())
         if dimension in credited_dims:
-            return base_points
+            return base_points * ATTENUATION_FACTOR
         if credited_dims:
             self._tech_credit_ledger.setdefault(tech_keyword, set()).add(dimension)
             return base_points * ATTENUATION_FACTOR

{codedd_cli-0.1.5 → codedd_cli-0.1.6}/codedd_cli/auditor/architecture_analyzer.py

@@ -24,10 +24,15 @@ from typing import Any
 
 from codedd_cli.auditor.archetype_classifier import classify_local
 from codedd_cli.auditor.architecture_prompts import CATEGORY_PROMPTS, CATEGORY_SCHEMAS
+from codedd_cli.auditor.architecture_schema_contract import (
+    ensure_schema_registry_valid,
+    normalize_llm_category_payload,
+)
 from codedd_cli.auditor.enhanced_architecture_detectors import (
     LocalEnhancedRelationshipDetector,
     LocalEnhancedTechnologyDetector,
 )
+from codedd_cli.utils.safe_path import resolve_path_within_base
 
 logger = logging.getLogger(__name__)
 
@@ -551,8 +556,8 @@ def _identify_technologies(
             if prefix and dep_path.startswith(prefix)
             else _get_relative_path(dep_path)
         )
-        local_path = os.path.normpath(os.path.join(local_base, rel))
-        if not os.path.isfile(local_path):
+        local_path = resolve_path_within_base(local_base, rel)
+        if not local_path or not os.path.isfile(local_path):
             continue
         file_name = os.path.basename(local_path)
         try:
@@ -837,9 +842,26 @@ def _build_phase2_skeleton(
     }
 
 
-def _read_file_safely_local(local_path: str, max_chars: int = _MAX_CONTENT_CHARS) -> str | None:
+def _read_file_safely_local(
+    local_path: str,
+    max_chars: int = _MAX_CONTENT_CHARS,
+    *,
+    local_base: str | None = None,
+) -> str | None:
     """Read file content with size limit; truncate by character count. Returns None on error."""
     try:
+        if local_base:
+            try:
+                base_real = os.path.realpath(local_base)
+                path_real = os.path.realpath(local_path)
+            except OSError:
+                return None
+            try:
+                if os.path.commonpath([base_real, path_real]) != base_real:
+                    return None
+            except ValueError:
+                return None
+            local_path = path_real
         if not os.path.isfile(local_path):
             return None
         size = os.path.getsize(local_path)
@@ -902,17 +924,9 @@ def _parse_llm_response(response_text: str, file_path: str, category: str) -> di
         return None
     if not isinstance(data, dict):
         return None
+    ensure_schema_registry_valid(CATEGORY_SCHEMAS, CATEGORY_PROMPTS)
     schema = CATEGORY_SCHEMAS.get(category, CATEGORY_SCHEMAS["config_files"])
-    for key in schema:
-        if key not in data:
-            data[key] = schema[key] if isinstance(schema[key], (list, dict)) else ""
-        else:
-            expected_type = type(schema[key])
-            if not isinstance(data[key], expected_type):
-                logger.warning(
-                    "Schema drift detected for category=%r key=%r: expected %s, got %s (file=%s)",
-                    category, key, expected_type.__name__, type(data[key]).__name__, file_path,
-                )
+    data = normalize_llm_category_payload(data, category, schema)
     data["file_path"] = file_path
     data["analysis_category"] = category
     data["analysis_timestamp"] = time.time()
@@ -1954,9 +1968,11 @@ def _analyze_single_file(
     gemini_client: Any,
     grok_client: Any,
     on_debug: Callable[[str], None] | None,
+    *,
+    local_base: str | None = None,
 ) -> dict[str, Any] | None:
     """Read file, build prompt, call LLM, parse. Returns analysis dict or None."""
-    content = _read_file_safely_local(local_path)
+    content = _read_file_safely_local(local_path, local_base=local_base)
     if not content:
         return None
     prompt = _build_analysis_prompt(file_path, content, category)
@@ -2088,8 +2104,8 @@ def run_phase2_with_llm(
             if not file_path.startswith(prefix):
                 continue
             rel = file_path[len(prefix):].lstrip("/")
-            local_path = os.path.normpath(os.path.join(local_base, rel))
-            if os.path.isfile(local_path):
+            local_path = resolve_path_within_base(local_base, rel)
+            if local_path and os.path.isfile(local_path):
                 work_items.append((category, file_path, local_path))
 
     total_files = len(work_items)
@@ -2119,7 +2135,9 @@ def run_phase2_with_llm(
             grok_key,
         )
         try:
-            result = _analyze_single_file(fp, lp, cat, a_client, o_client, g_client, x_client, on_debug)
+            result = _analyze_single_file(
+                fp, lp, cat, a_client, o_client, g_client, x_client, on_debug, local_base=local_base,
+            )
             with progress_lock:
                 done_counter[0] += 1
                 done = done_counter[0]

{codedd_cli-0.1.5 → codedd_cli-0.1.6}/codedd_cli/auditor/architecture_prompts.py

@@ -1,8 +1,12 @@
 """
 Category-specific prompts and output schemas for CLI architecture Phase 2.
 
-Kept in sync with the server's LLMAnalyzer.category_prompts and category_schemas
-so that per-file analysis produces the same structure the server expects.
+Schema contract (enforced at runtime — see ``architecture_schema_contract``):
+- ``SERVER_PARITY_CATEGORIES`` (8): key sets mirror server ``LLMAnalyzer.category_schemas``.
+- ``CLI_EXTENSION_CATEGORIES`` (4): CLI-only categories with the same validation rules.
+- ``SCHEMA_CONTRACT_VERSION``: bump when shared keys change on either side.
+
+Per-file LLM JSON is normalized in ``architecture_analyzer._parse_llm_response``.
 """
 
 # Output structure expected from the LLM per category (server-compatible)

codedd_cli-0.1.6/codedd_cli/auditor/architecture_schema_contract.py

@@ -0,0 +1,150 @@
+"""
+Runtime contract for architecture Phase 2 LLM category schemas.
+
+The eight ``SERVER_PARITY_CATEGORIES`` mirror ``LLMAnalyzer.category_schemas`` on
+the CodeDD server (django auditor).  Four ``CLI_EXTENSION_CATEGORIES`` are
+CLI-only enrichments; they use the same validation machinery but are not sent
+through the legacy server per-file parser.
+
+``SCHEMA_CONTRACT_VERSION`` must be bumped when either side changes shared keys.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import json
+import logging
+from typing import Any
+
+logger = logging.getLogger(__name__)
+
+SCHEMA_CONTRACT_VERSION = "1.0.0"
+
+# Categories whose key sets are kept in parity with the server LLMAnalyzer.
+SERVER_PARITY_CATEGORIES = frozenset(
+    {
+        "dependency_files",
+        "infrastructure_files",
+        "backend_files",
+        "frontend_files",
+        "database_files",
+        "ci_cd_files",
+        "testing_files",
+        "config_files",
+    }
+)
+
+# Additional CLI architecture categories (validated locally; not server-parity).
+CLI_EXTENSION_CATEGORIES = frozenset(
+    {
+        "api_schema_files",
+        "monitoring_files",
+        "message_queue_files",
+        "security_auth_files",
+    }
+)
+
+ALL_ARCHITECTURE_CATEGORIES = SERVER_PARITY_CATEGORIES | CLI_EXTENSION_CATEGORIES
+
+_registry_checked = False
+
+
+def category_schema_fingerprint(schema: dict[str, Any]) -> str:
+    """Stable short fingerprint of a schema's top-level keys (order-independent)."""
+    payload = json.dumps(sorted(schema.keys()), separators=(",", ":"))
+    return hashlib.sha256(payload.encode("utf-8")).hexdigest()[:16]
+
+
+def validate_schema_registry(
+    category_schemas: dict[str, dict[str, Any]],
+    category_prompts: dict[str, str],
+) -> list[str]:
+    """
+    Verify prompt/schema registry integrity.
+
+    Returns a list of human-readable errors (empty when valid).
+    """
+    errors: list[str] = []
+
+    schema_cats = set(category_schemas)
+    prompt_cats = set(category_prompts)
+
+    missing_prompts = schema_cats - prompt_cats
+    missing_schemas = prompt_cats - schema_cats
+    if missing_prompts:
+        errors.append(f"CATEGORY_SCHEMAS without prompts: {sorted(missing_prompts)}")
+    if missing_schemas:
+        errors.append(f"CATEGORY_PROMPTS without schemas: {sorted(missing_schemas)}")
+
+    for category, schema in category_schemas.items():
+        if not isinstance(schema, dict) or not schema:
+            errors.append(f"Empty or invalid schema for category {category!r}")
+            continue
+        if "file_type" not in schema:
+            errors.append(f"Schema for {category!r} missing required file_type key")
+
+    unknown = schema_cats - ALL_ARCHITECTURE_CATEGORIES
+    if unknown:
+        errors.append(f"Unknown architecture categories: {sorted(unknown)}")
+
+    return errors
+
+
+def ensure_schema_registry_valid(
+    category_schemas: dict[str, dict[str, Any]],
+    category_prompts: dict[str, str],
+) -> None:
+    """Run ``validate_schema_registry`` once per process; log errors on failure."""
+    global _registry_checked
+    if _registry_checked:
+        return
+    _registry_checked = True
+    errors = validate_schema_registry(category_schemas, category_prompts)
+    if errors:
+        logger.error(
+            "Architecture schema registry failed contract %s: %s",
+            SCHEMA_CONTRACT_VERSION,
+            "; ".join(errors),
+        )
+
+
+def normalize_llm_category_payload(
+    data: dict[str, Any],
+    category: str,
+    schema: dict[str, Any],
+) -> dict[str, Any]:
+    """
+    Enforce schema shape: backfill missing keys and coerce wrong JSON types.
+
+    Unknown keys from the LLM are preserved so forward-compatible fields are not
+    dropped.  Type coercion follows the template value in *schema*.
+    """
+    normalized = dict(data)
+    for key, template in schema.items():
+        if key not in normalized:
+            normalized[key] = (
+                list(template) if isinstance(template, list)
+                else dict(template) if isinstance(template, dict)
+                else template
+            )
+            continue
+        value = normalized[key]
+        if isinstance(template, list) and not isinstance(value, list):
+            logger.warning(
+                "Schema drift for category=%r key=%r: expected list, got %s",
+                category,
+                key,
+                type(value).__name__,
+            )
+            normalized[key] = []
+        elif isinstance(template, dict) and not isinstance(value, dict):
+            logger.warning(
+                "Schema drift for category=%r key=%r: expected dict, got %s",
+                category,
+                key,
+                type(value).__name__,
+            )
+            normalized[key] = {}
+        elif isinstance(template, str) and not isinstance(value, str):
+            normalized[key] = str(value) if value is not None else ""
+    return normalized

{codedd_cli-0.1.5 → codedd_cli-0.1.6}/codedd_cli/auditor/commit_classifier.py

@@ -243,7 +243,8 @@ class CommitClassifier:
 
         # === Tertiary: change-ratio heuristics ===
         if total_added > 0:
-            if total_deleted / total_added > 0.7:
+            deletion_ratio = total_deleted / total_added
+            if deletion_ratio > 0.7:
                 return {"type": "refactoring", "confidence": 0.6,
                         "method": "change_ratio", "keywords_matched": []}
             if total_changes < 50:

{codedd_cli-0.1.5 → codedd_cli-0.1.6}/codedd_cli/auditor/complexity_analyzer.py

@@ -41,6 +41,8 @@ from concurrent.futures import ThreadPoolExecutor, as_completed
 from dataclasses import dataclass
 from typing import Any
 
+from codedd_cli.utils.safe_path import resolve_path_within_base
+
 logger = logging.getLogger(__name__)
 
 
@@ -2009,10 +2011,13 @@ class LocalComplexityAnalyzer:
                 error="Missing local directory or relative path",
             )
 
-        disk_path = os.path.join(
-            local_dir,
-            relative_path.replace("\\", os.sep).replace("/", os.sep),
-        )
+        disk_path = resolve_path_within_base(local_dir, relative_path)
+        if disk_path is None:
+            return FileComplexityResult(
+                file_path=file_path,
+                relative_path=relative_path,
+                error="Relative path escapes the local scope directory",
+            )
 
         try:
             with open(disk_path, encoding="utf-8", errors="replace") as fh:

{codedd_cli-0.1.5 → codedd_cli-0.1.6}/codedd_cli/auditor/dependency_scanner.py

@@ -314,7 +314,7 @@ class ManifestParser:
                     raw_packages = dispatch_table[ext](file_content)
                 else:
                     for pattern, parser_func in dispatch_table.items():
-                        if file_path.endswith(pattern):
+                        if filename_lower == pattern.lower():
                             raw_packages = parser_func(file_content)
                             break
                     else: