codefence 1.0.0__tar.gz → 1.0.1__tar.gz

codefence-1.0.1/PKG-INFO

@@ -0,0 +1,329 @@
+Metadata-Version: 2.4
+Name: codefence
+Version: 1.0.1
+Summary: A tiny offline policy gate for code. Check AI-generated code before it reaches Git.
+Author: CodeFence
+License-Expression: LicenseRef-CodeFence-EULA
+Project-URL: Homepage, https://codefence.dev
+Project-URL: Source, https://github.com/USERNAME/codefence
+Project-URL: Issues, https://github.com/USERNAME/codefence/issues
+Project-URL: Changelog, https://github.com/USERNAME/codefence/blob/main/CHANGELOG.md
+Keywords: security,static-analysis,pre-commit,git-hook,ai-generated-code,sast,sarif,offline,policy
+Classifier: Development Status :: 5 - Production/Stable
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: Software Development :: Quality Assurance
+Classifier: Topic :: Software Development :: Testing
+Classifier: Topic :: Security
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+License-File: LICENSE.txt
+License-File: LICENSE_FAQ.md
+License-File: NOTICE.md
+Dynamic: license-file
+
+# CodeFence
+
+**A tiny offline policy gate for code.**
+
+Check AI-generated code before it reaches Git.
+
+---
+
+## What it does
+
+CodeFence is a single-file, zero-dependency Python CLI that scans
+source code for selected dangerous patterns before you commit. It
+runs a curated set of rules and reports findings with:
+
+- severity (critical / high / medium / low / info)
+- exact location (file:line:column)
+- code snippet
+- short remediation
+- typical before/after fix example
+
+It is designed around the risks commonly encountered in AI-assisted
+development, but scans ordinary source code regardless of how it
+was written.
+
+**The gate workflow:**
+
+    AI writes code
+         |
+         v
+    CodeFence runs on staged files
+         |
+         v
+    policy evaluation (allow / warn / block)
+         |
+         v
+    PASS or BLOCKED
+         |
+         v
+    git commit
+
+## What it does NOT do
+
+- Not an autofixer. It shows a typical fix; it does not edit files.
+- Not a security audit. It is a pattern-based sanity checker.
+- Not a replacement for Semgrep, CodeQL, or professional review.
+- Not interprocedural. No dataflow, no taint analysis.
+- Not a guarantee. A clean scan does not mean the code is secure.
+
+## Install
+
+    pip install codefence
+
+Or run it directly:
+
+    python3 codefence.py app.py
+
+## Quick start
+
+**One-time setup in a git repository:**
+
+    codefence init
+
+This installs a pre-commit hook and creates .codefence/config.json.
+Every commit is then gated automatically.
+
+**Daily usage:**
+
+    codefence --staged          # scan only what is staged
+    codefence --staged --diff   # only NEW findings since baseline
+    codefence baseline          # snapshot current findings
+
+**One-off scans:**
+
+    codefence src/
+    codefence --format json --output report.json src/
+    codefence --format html --output report.html src/
+    codefence --format sarif --output results.sarif .
+
+**Policy-as-code:**
+
+    codefence --policy company-policy.json --staged
+    codefence policy validate company-policy.json
+
+**Explanation:**
+
+    codefence explain R002
+## The 30 rules
+
+Rules are shipped in rules.json (human-readable JSON). You can
+inspect them, and you can add or disable rules for your own use.
+
+### Secrets
+- R001 - Hardcoded API keys / secrets
+- R011 - Hardcoded database credentials
+- R028 - Env var with hardcoded fallback secret
+
+### Injection
+- R002 - SQL injection via string concatenation (Python)
+- R003 - eval() / exec() on untrusted input (Python)
+- R004 - Command injection via shell=True (Python)
+- R005 - innerHTML with unsanitized data (JavaScript)
+- R010 - Path traversal
+- R014 - Prototype pollution (JavaScript)
+- R019 - Unsafe deserialization (pickle, yaml.load)
+
+### Authentication
+- R006 - Missing authentication on endpoints
+- R015 - Missing rate limiting on public endpoints
+- R018 - Open redirect
+- R020 - Never-expiring tokens / JWT
+
+### Cryptography
+- R008 - Insecure random for security tokens (Python)
+- R009 - Disabled TLS/SSL verification
+- R016 - MD5 / SHA1 for password hashing
+
+### Configuration
+- R007 - Overly permissive CORS (*)
+- R017 - Debug mode left enabled
+- R021 - Missing security headers (Express)
+
+### Reliability
+- R022 - Race conditions (check-then-act)
+- R026 - HTTP request without timeout
+- R027 - Naive datetime (no timezone, context-aware)
+
+### Quality
+- R012 - Broad except: pass
+- R013 - Mutable default arguments
+- R023 - Logging sensitive data
+- R024 - Unused imports / dead code
+- R025 - Promise rejection ignored (JavaScript)
+
+### AI-specific
+- R030 - Typosquatted package imports
+- R031 - TODO / FIXME / HACK in new code
+
+Each rule carries a confidence level and a stable rule_version +
+fingerprint for baseline stability.
+
+## Configuration
+
+Options can be passed as CLI flags or through a JSON config file
+(auto-discovered at .codefence/config.json after 'codefence init').
+
+Example .codefence/config.json:
+
+    {
+      "schema": "codefence/config-v1",
+      "format": "json",
+      "severity": "medium",
+      "include": ["*.py", "*.js"],
+      "exclude": ["node_modules", ".git", "venv", "samples"],
+      "max_size": 2097152,
+      "cache": false
+    }
+
+Priority: CLI flags > config file > built-in defaults.
+
+### Optional cache
+
+Pass --cache to enable a local cache at ~/.cache/codefence/. The
+cache is keyed by SHA-256 of the file content plus a fingerprint
+of rules.json. It is off by default. See SECURITY.md for how the
+cache is protected.
+
+### Optional history
+
+Pass --history to record this scan in a local SQLite database at
+~/.local/share/codefence/history.db. Off by default.
+
+Set CODEFENCE_NO_HISTORY=1 to disable history entirely, even when
+--history is set.
+
+Query history:
+
+    codefence history
+    codefence stats
+## Security and privacy
+
+- Zero network calls. Zero.
+- Zero telemetry.
+- Zero data upload.
+- Writes only to --output, and optionally to:
+    ~/.cache/codefence/            (only when --cache is set)
+    ~/.local/share/codefence/      (only when --history is set)
+- Never writes to the files you scan.
+- Never executes the code you scan.
+
+The full threat model is documented in SECURITY.md.
+
+## Verifying the download
+
+Every shipped file is hashed in CHECKSUMS.txt. To verify:
+
+    sha256sum codefence.py rules.json
+
+Compare the output with the corresponding lines in CHECKSUMS.txt.
+If the hashes do not match, do not use the file.
+
+## Payment and pricing
+
+**$12 USD, one-time.**
+
+Includes the current major version (v1.x) and its maintenance
+releases. No subscription. No support. No account.
+
+Payments are available in cryptocurrency only:
+
+- USDT (TRC20 or BEP20)
+- USDC
+- BTC
+- TRX
+- XRP
+
+Official purchase channels:
+
+- Getly
+- SilkRoadx402
+- ctlx.cc
+
+If you find CodeFence on any other site claiming to sell it,
+treat that site as unofficial.
+
+## License
+
+Source-available. Not open source.
+
+Summary:
+
+- Personal use on up to 3 devices that you own or control.
+- Read, study, and privately modify the source.
+- No redistribution. No resale. No bundling.
+- No scanning-as-a-service on a commercial basis.
+
+For plain-language answers to common questions, see LICENSE_FAQ.md.
+For the full legal terms, see LICENSE.txt and TERMS_OF_USE.md.
+
+**Governing law:** England and Wales. Mandatory consumer
+protections in your country of residence remain fully applicable.
+
+## Support
+
+There is no support.
+
+- No email. No chat. No issue tracker.
+- No guaranteed updates.
+- No bug-fix commitments.
+
+If you need a product with ongoing support, please look elsewhere.
+
+## FAQ
+
+**Q: Will this find every security issue in my code?**
+A: No. It finds a curated set of dangerous patterns. It is a
+   sanity check, not a security audit.
+
+**Q: Can I use it in CI?**
+A: Yes. JSON and SARIF outputs are pure on stdout. Exit codes are
+   stable.
+
+**Q: Does it phone home?**
+A: No. Zero network calls. You can verify by reading the source
+   or by running it under strace.
+
+**Q: Does it fix my code?**
+A: No. It shows a typical before/after fix. You apply it yourself.
+
+**Q: Does it support TypeScript?**
+A: No. Python, JavaScript (.js, .mjs, .cjs).
+
+**Q: What about false positives?**
+A: Pattern-based scanners always produce some. Rules with lower
+   confidence are flagged as such. You can disable any rule in
+   rules.json or via policy overrides.
+
+**Q: Can I modify the source?**
+A: Yes, privately. See LICENSE_FAQ.md.
+
+**Q: Can my team use it?**
+A: Each developer using CodeFence on their own machine needs
+   their own license. One license covers one individual on up to
+   three devices.
+
+**Q: How do I get updates?**
+A: There are no guaranteed updates.
+
+**Q: Can I get a refund?**
+A: See REFUND_POLICY.md.
+
+## A note on honesty
+
+This product is built to do a specific, limited thing well. It
+does not overstate what it can do. Every claim in this README is
+traceable to a line of code or a test. If you find a claim that
+is not supported by what the tool actually does, please report
+it.
+
+*End of README.*

codefence-1.0.1/codefence.egg-info/PKG-INFO

@@ -0,0 +1,329 @@
+Metadata-Version: 2.4
+Name: codefence
+Version: 1.0.1
+Summary: A tiny offline policy gate for code. Check AI-generated code before it reaches Git.
+Author: CodeFence
+License-Expression: LicenseRef-CodeFence-EULA
+Project-URL: Homepage, https://codefence.dev
+Project-URL: Source, https://github.com/USERNAME/codefence
+Project-URL: Issues, https://github.com/USERNAME/codefence/issues
+Project-URL: Changelog, https://github.com/USERNAME/codefence/blob/main/CHANGELOG.md
+Keywords: security,static-analysis,pre-commit,git-hook,ai-generated-code,sast,sarif,offline,policy
+Classifier: Development Status :: 5 - Production/Stable
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: Software Development :: Quality Assurance
+Classifier: Topic :: Software Development :: Testing
+Classifier: Topic :: Security
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+License-File: LICENSE.txt
+License-File: LICENSE_FAQ.md
+License-File: NOTICE.md
+Dynamic: license-file
+
+# CodeFence
+
+**A tiny offline policy gate for code.**
+
+Check AI-generated code before it reaches Git.
+
+---
+
+## What it does
+
+CodeFence is a single-file, zero-dependency Python CLI that scans
+source code for selected dangerous patterns before you commit. It
+runs a curated set of rules and reports findings with:
+
+- severity (critical / high / medium / low / info)
+- exact location (file:line:column)
+- code snippet
+- short remediation
+- typical before/after fix example
+
+It is designed around the risks commonly encountered in AI-assisted
+development, but scans ordinary source code regardless of how it
+was written.
+
+**The gate workflow:**
+
+    AI writes code
+         |
+         v
+    CodeFence runs on staged files
+         |
+         v
+    policy evaluation (allow / warn / block)
+         |
+         v
+    PASS or BLOCKED
+         |
+         v
+    git commit
+
+## What it does NOT do
+
+- Not an autofixer. It shows a typical fix; it does not edit files.
+- Not a security audit. It is a pattern-based sanity checker.
+- Not a replacement for Semgrep, CodeQL, or professional review.
+- Not interprocedural. No dataflow, no taint analysis.
+- Not a guarantee. A clean scan does not mean the code is secure.
+
+## Install
+
+    pip install codefence
+
+Or run it directly:
+
+    python3 codefence.py app.py
+
+## Quick start
+
+**One-time setup in a git repository:**
+
+    codefence init
+
+This installs a pre-commit hook and creates .codefence/config.json.
+Every commit is then gated automatically.
+
+**Daily usage:**
+
+    codefence --staged          # scan only what is staged
+    codefence --staged --diff   # only NEW findings since baseline
+    codefence baseline          # snapshot current findings
+
+**One-off scans:**
+
+    codefence src/
+    codefence --format json --output report.json src/
+    codefence --format html --output report.html src/
+    codefence --format sarif --output results.sarif .
+
+**Policy-as-code:**
+
+    codefence --policy company-policy.json --staged
+    codefence policy validate company-policy.json
+
+**Explanation:**
+
+    codefence explain R002
+## The 30 rules
+
+Rules are shipped in rules.json (human-readable JSON). You can
+inspect them, and you can add or disable rules for your own use.
+
+### Secrets
+- R001 - Hardcoded API keys / secrets
+- R011 - Hardcoded database credentials
+- R028 - Env var with hardcoded fallback secret
+
+### Injection
+- R002 - SQL injection via string concatenation (Python)
+- R003 - eval() / exec() on untrusted input (Python)
+- R004 - Command injection via shell=True (Python)
+- R005 - innerHTML with unsanitized data (JavaScript)
+- R010 - Path traversal
+- R014 - Prototype pollution (JavaScript)
+- R019 - Unsafe deserialization (pickle, yaml.load)
+
+### Authentication
+- R006 - Missing authentication on endpoints
+- R015 - Missing rate limiting on public endpoints
+- R018 - Open redirect
+- R020 - Never-expiring tokens / JWT
+
+### Cryptography
+- R008 - Insecure random for security tokens (Python)
+- R009 - Disabled TLS/SSL verification
+- R016 - MD5 / SHA1 for password hashing
+
+### Configuration
+- R007 - Overly permissive CORS (*)
+- R017 - Debug mode left enabled
+- R021 - Missing security headers (Express)
+
+### Reliability
+- R022 - Race conditions (check-then-act)
+- R026 - HTTP request without timeout
+- R027 - Naive datetime (no timezone, context-aware)
+
+### Quality
+- R012 - Broad except: pass
+- R013 - Mutable default arguments
+- R023 - Logging sensitive data
+- R024 - Unused imports / dead code
+- R025 - Promise rejection ignored (JavaScript)
+
+### AI-specific
+- R030 - Typosquatted package imports
+- R031 - TODO / FIXME / HACK in new code
+
+Each rule carries a confidence level and a stable rule_version +
+fingerprint for baseline stability.
+
+## Configuration
+
+Options can be passed as CLI flags or through a JSON config file
+(auto-discovered at .codefence/config.json after 'codefence init').
+
+Example .codefence/config.json:
+
+    {
+      "schema": "codefence/config-v1",
+      "format": "json",
+      "severity": "medium",
+      "include": ["*.py", "*.js"],
+      "exclude": ["node_modules", ".git", "venv", "samples"],
+      "max_size": 2097152,
+      "cache": false
+    }
+
+Priority: CLI flags > config file > built-in defaults.
+
+### Optional cache
+
+Pass --cache to enable a local cache at ~/.cache/codefence/. The
+cache is keyed by SHA-256 of the file content plus a fingerprint
+of rules.json. It is off by default. See SECURITY.md for how the
+cache is protected.
+
+### Optional history
+
+Pass --history to record this scan in a local SQLite database at
+~/.local/share/codefence/history.db. Off by default.
+
+Set CODEFENCE_NO_HISTORY=1 to disable history entirely, even when
+--history is set.
+
+Query history:
+
+    codefence history
+    codefence stats
+## Security and privacy
+
+- Zero network calls. Zero.
+- Zero telemetry.
+- Zero data upload.
+- Writes only to --output, and optionally to:
+    ~/.cache/codefence/            (only when --cache is set)
+    ~/.local/share/codefence/      (only when --history is set)
+- Never writes to the files you scan.
+- Never executes the code you scan.
+
+The full threat model is documented in SECURITY.md.
+
+## Verifying the download
+
+Every shipped file is hashed in CHECKSUMS.txt. To verify:
+
+    sha256sum codefence.py rules.json
+
+Compare the output with the corresponding lines in CHECKSUMS.txt.
+If the hashes do not match, do not use the file.
+
+## Payment and pricing
+
+**$12 USD, one-time.**
+
+Includes the current major version (v1.x) and its maintenance
+releases. No subscription. No support. No account.
+
+Payments are available in cryptocurrency only:
+
+- USDT (TRC20 or BEP20)
+- USDC
+- BTC
+- TRX
+- XRP
+
+Official purchase channels:
+
+- Getly
+- SilkRoadx402
+- ctlx.cc
+
+If you find CodeFence on any other site claiming to sell it,
+treat that site as unofficial.
+
+## License
+
+Source-available. Not open source.
+
+Summary:
+
+- Personal use on up to 3 devices that you own or control.
+- Read, study, and privately modify the source.
+- No redistribution. No resale. No bundling.
+- No scanning-as-a-service on a commercial basis.
+
+For plain-language answers to common questions, see LICENSE_FAQ.md.
+For the full legal terms, see LICENSE.txt and TERMS_OF_USE.md.
+
+**Governing law:** England and Wales. Mandatory consumer
+protections in your country of residence remain fully applicable.
+
+## Support
+
+There is no support.
+
+- No email. No chat. No issue tracker.
+- No guaranteed updates.
+- No bug-fix commitments.
+
+If you need a product with ongoing support, please look elsewhere.
+
+## FAQ
+
+**Q: Will this find every security issue in my code?**
+A: No. It finds a curated set of dangerous patterns. It is a
+   sanity check, not a security audit.
+
+**Q: Can I use it in CI?**
+A: Yes. JSON and SARIF outputs are pure on stdout. Exit codes are
+   stable.
+
+**Q: Does it phone home?**
+A: No. Zero network calls. You can verify by reading the source
+   or by running it under strace.
+
+**Q: Does it fix my code?**
+A: No. It shows a typical before/after fix. You apply it yourself.
+
+**Q: Does it support TypeScript?**
+A: No. Python, JavaScript (.js, .mjs, .cjs).
+
+**Q: What about false positives?**
+A: Pattern-based scanners always produce some. Rules with lower
+   confidence are flagged as such. You can disable any rule in
+   rules.json or via policy overrides.
+
+**Q: Can I modify the source?**
+A: Yes, privately. See LICENSE_FAQ.md.
+
+**Q: Can my team use it?**
+A: Each developer using CodeFence on their own machine needs
+   their own license. One license covers one individual on up to
+   three devices.
+
+**Q: How do I get updates?**
+A: There are no guaranteed updates.
+
+**Q: Can I get a refund?**
+A: See REFUND_POLICY.md.
+
+## A note on honesty
+
+This product is built to do a specific, limited thing well. It
+does not overstate what it can do. Every claim in this README is
+traceable to a line of code or a test. If you find a claim that
+is not supported by what the tool actually does, please report
+it.
+
+*End of README.*

{codefence-1.0.0 → codefence-1.0.1}/codefence.py

@@ -40,7 +40,7 @@ from typing import Callable, Iterable, Iterator, Sequence
 # =============================================================================
 
 TOOL_NAME = "codefence"
-TOOL_VERSION = "1.0.0"
+TOOL_VERSION = "1.0.1"
 RULES_SCHEMA = "codefence/rules-v1"
 DEFAULT_MAX_SIZE = 2 * 1024 * 1024
 DEFAULT_RULES_FILENAME = "rules.json"
@@ -3966,7 +3966,28 @@ def _build_argparser() -> argparse.ArgumentParser:
 
 
 def _default_rules_path() -> Path:
-    return Path(__file__).resolve().parent / DEFAULT_RULES_FILENAME
+    """Search common locations for rules.json.
+
+    Covers: source checkout, pip install with --user or --system,
+    data-files installation under sys.prefix or sys.prefix/share,
+    current working directory, and per-user config.
+    """
+    here = Path(__file__).resolve().parent
+    candidates = [
+        here / DEFAULT_RULES_FILENAME,
+        here.parent.parent.parent / DEFAULT_RULES_FILENAME,
+        Path(sys.prefix) / DEFAULT_RULES_FILENAME,
+        Path(sys.prefix) / "share" / "codefence" / DEFAULT_RULES_FILENAME,
+        Path(sys.prefix) / "local" / DEFAULT_RULES_FILENAME,
+        Path(sys.prefix) / "local" / "share" / "codefence" / DEFAULT_RULES_FILENAME,
+        Path.cwd() / DEFAULT_RULES_FILENAME,
+        Path.home() / ".codefence" / DEFAULT_RULES_FILENAME,
+        Path.home() / ".config" / "codefence" / DEFAULT_RULES_FILENAME,
+    ]
+    for c in candidates:
+        if c.is_file():
+            return c
+    return candidates[0]
 
 
 def _collect_paths(paths: Sequence[str],