codefence 1.0.4__tar.gz → 1.0.11__tar.gz

{codefence-1.0.4 → codefence-1.0.11}/CHANGELOG.md

@@ -5,6 +5,99 @@ All notable changes to CodeFence.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 Versioning follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.0.11] — 2026-09-18
+
+### Fixed
+
+- `pyproject.toml` project URLs pointed at a placeholder `USERNAME` and a
+  non-existent `codefence.dev` domain. They now point to the canonical
+  repository at `github.com/codefence-dev/codefence`.
+- `pyproject.toml` build requirement pinned `setuptools==76.1.0` exactly,
+  which could break builds in environments where that exact version is
+  unavailable. Relaxed to `setuptools>=76.1.0`.
+
+## [1.0.10] — 2026-09-18
+
+### Added
+- `docs/DETECTION_METHODOLOGY.md` — 607-line document with per-rule
+  samples, known false-positive scenarios, known false-negative
+  scenarios, and explicit scope limits (no dataflow, no taint
+  tracking, no interprocedural analysis). Ships inside the wheel and
+  sdist.
+- README: Free vs Pro section with activation instructions.
+- README: reference to DETECTION_METHODOLOGY.md next to the scope
+  disclaimers.
+
+### Changed
+- Tagline: `Check AI-written code before you commit it.` replaces
+  `A tiny offline policy gate for code.`
+- Secondary line: `Offline. Zero dependencies. No account. No
+  telemetry.`
+- Price: $12 → $19 (README, TERMS_OF_USE.md, license error message).
+- CLI `--help` and welcome screen show the new tagline.
+- PyPI summary now reflects the new tagline.
+
+### Notes
+- No behavior changes to detection logic. No new rules. No rule
+  removed. This is a documentation, positioning, and pricing release.
+
+[1.0.11]: https://github.com/codefence-dev/codefence/releases/tag/v1.0.11
+[1.0.10]: https://github.com/codefence-dev/codefence/releases/tag/v1.0.10
+
+## [1.0.9] — 2026-09-18
+
+### Added
+- Pro tier license system with offline HMAC-SHA256 verification
+- License source priority: `CODEFENCE_LICENSE_KEY` env var, then
+  `~/.codefence/license.key`
+- `tools/gen_license.py` seller-side key generation tool (not shipped)
+- README: Free vs Pro feature table with activation instructions
+
+### Changed
+- Pro features are now gated when no valid license is present:
+  - `--staged`, `--diff`, `--policy`, `--evidence`, `--history`
+  - `--format sarif`, `--format html`
+  - Subcommands: `init`, `init-hook`, `uninstall-hook`, `init-github`,
+    `baseline`, `policy`, `history`, `stats`, `explain`
+- Payment methods: removed USDC, added SOL
+- Free tier message shows clear upgrade path when Pro features are used
+
+### Fixed
+- Integration tests use an autouse Pro license fixture
+
+[1.0.9]: https://github.com/codefence-dev/codefence/releases/tag/v1.0.9
+
+## [1.0.8] — 2026-09-18
+
+### Added
+- `report_cli_gate`: three-state compact output for `--staged` and git hooks
+  - `commit blocked` when blocking findings are present
+  - `commit allowed (warning)` when only warn-action findings are present
+  - `commit passed` when clean
+- `--verbose` flag for direct scans to show code snippets and fix examples
+- `--quiet` short output: one-line header + one-line summary
+- Footer with tool version, offline note, and honest scope statement in HTML
+
+### Changed
+- CLI: replaced banner box with a single-line header
+- CLI: replaced bottom summary box with a one-line severity summary
+- CLI: snippet and fix diff are now opt-in via `--verbose` (default compact)
+- HTML: replaced 5-card dashboard with a horizontal severity summary line
+- HTML: severity card left border reduced from 4px to 2px
+- HTML: fix panels use neutral diff styling (`-` muted red, `+` muted green)
+  instead of a blue "after" block
+- HTML: card radius from 12px to 8px, softer shadows
+- HTML: typography and spacing tuned for readability
+
+### Fixed
+- HTML: multi-line diff rendering in fix panels (newlines were being collapsed)
+- Tests: SARIF test now reads tool version dynamically instead of hardcoding 1.0.0
+
+### Internal
+- Renamed test-only references from legacy product name to CodeFence
+
+[1.0.8]: https://github.com/codefence-dev/codefence/releases/tag/v1.0.8
+
 ## [1.0.0] — 2026-09-16
 
 ### Added

{codefence-1.0.4 → codefence-1.0.11}/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.2
+Metadata-Version: 2.4
 Name: codefence
-Version: 1.0.4
+Version: 1.0.11
 Summary: A tiny offline policy gate for code. Check AI-generated code before it reaches Git.
 Author: CodeFence
 License: CODEFENCE
@@ -198,10 +198,9 @@ License: CODEFENCE
         END OF LICENSE
         --------------------------------------------------------------------
         
-Project-URL: Homepage, https://codefence.dev
-Project-URL: Source, https://github.com/USERNAME/codefence
-Project-URL: Issues, https://github.com/USERNAME/codefence/issues
-Project-URL: Changelog, https://github.com/USERNAME/codefence/blob/main/CHANGELOG.md
+Project-URL: Source, https://github.com/codefence-dev/codefence
+Project-URL: Issues, https://github.com/codefence-dev/codefence/issues
+Project-URL: Changelog, https://github.com/codefence-dev/codefence/blob/main/CHANGELOG.md
 Keywords: security,static-analysis,pre-commit,git-hook,ai-generated-code,sast,sarif,offline,policy
 Classifier: Development Status :: 5 - Production/Stable
 Classifier: Environment :: Console
@@ -220,12 +219,15 @@ Description-Content-Type: text/markdown
 License-File: LICENSE.txt
 License-File: LICENSE_FAQ.md
 License-File: NOTICE.md
+Dynamic: license-file
 
 # CodeFence
 
-**A tiny offline policy gate for code.**
+**Check AI-written code before you commit it.**
 
-Check AI-generated code before it reaches Git.
+Offline. Zero dependencies. No account. No telemetry.
+
+<img src="docs/screenshots/hero_blocked.jpg" alt="CodeFence v1.0.10 blocking a git commit: 4 findings including hardcoded API keys, SQL injection, and command injection" width="500">
 
 ---
 
@@ -241,6 +243,8 @@ runs a curated set of rules and reports findings with:
 - short remediation
 - typical before/after fix example
 
+<img src="docs/screenshots/cli_scan.jpg" alt="CodeFence CLI scan output: 6 critical, 1 high, 2 medium findings across R001-R012 with file:line:column locations and remediation hints" width="500">
+
 It is designed around the risks commonly encountered in AI-assisted
 development, but scans ordinary source code regardless of how it
 was written.
@@ -269,6 +273,10 @@ was written.
 - Not interprocedural. No dataflow, no taint analysis.
 - Not a guarantee. A clean scan does not mean the code is secure.
 
+For per-rule samples, known false-positive scenarios, false-negative
+scenarios, and the full detection methodology, see
+[`docs/DETECTION_METHODOLOGY.md`](docs/DETECTION_METHODOLOGY.md).
+
 ## Install
 
     pip install codefence
@@ -307,6 +315,9 @@ Every commit is then gated automatically.
 **Explanation:**
 
     codefence explain R002
+
+<img src="docs/screenshots/cli_verbose.jpg" alt="CodeFence --verbose output: each finding includes the matched code snippet and a typical before/after fix example" width="500">
+
 ## The 30 rules
 
 Rules are shipped in rules.json (human-readable JSON). You can
@@ -421,9 +432,61 @@ Every shipped file is hashed in CHECKSUMS.txt. To verify:
 Compare the output with the corresponding lines in CHECKSUMS.txt.
 If the hashes do not match, do not use the file.
 
+## Free vs Pro
+
+**Free gives you the full scanner. Pro gives you the workflow.**
+
+You are not paying for more detection. The Free tier includes all 30
+rules. You are paying for the automation layer that turns findings
+into a gate.
+
+| Feature | Free | Pro ($19) |
+|---|---|---|
+| All 30 rules (Python + JavaScript) | Yes | Yes |
+| CLI output (colored, compact, verbose) | Yes | Yes |
+| JSON output | Yes | Yes |
+| Configuration, include/exclude, severity filters | Yes | Yes |
+| Offline, zero dependencies, zero network | Yes | Yes |
+| `--format sarif` | - | Yes |
+| `--format html` | - | Yes |
+| Git pre-commit hook (`init-hook`) | - | Yes |
+| `--staged` / `--diff` | - | Yes |
+| `baseline` | - | Yes |
+| `--policy` + `policy validate` | - | Yes |
+| `--evidence` (deterministic hashes) | - | Yes |
+| `--history` + `history` / `stats` | - | Yes |
+| `explain RXXX` | - | Yes |
+| `init-github` (GitHub Actions workflow) | - | Yes |
+| `init` (one-command setup) | - | Yes |
+
+<img src="docs/screenshots/report_light.jpg" alt="CodeFence HTML report (light theme): summary bar, per-finding cards with severity, snippet, copyable fix, and dark mode toggle" width="400">
+
+Free = detect. Pro = enforce.
+
+### Activating Pro
+
+After purchase you receive a license key of the form
+`identifier:signature`. Store it in one of two places.
+
+**Option 1 — File:**
+
+    mkdir -p ~/.codefence
+    echo 'YOUR-LICENSE-KEY' > ~/.codefence/license.key
+
+**Option 2 — Environment variable (recommended for CI):**
+
+    export CODEFENCE_LICENSE_KEY='YOUR-LICENSE-KEY'
+
+Verify activation:
+
+    cfence init-hook    # works only with a valid Pro license
+
+The license is verified locally with HMAC-SHA256. No network call, no
+telemetry, no activation server.
+
 ## Payment and pricing
 
-**$12 USD, one-time.**
+**$19 USD, one-time.**
 
 Includes the current major version (v1.x) and its maintenance
 releases. No subscription. No support. No account.
@@ -431,8 +494,8 @@ releases. No subscription. No support. No account.
 Payments are available in cryptocurrency only:
 
 - USDT (TRC20 or BEP20)
-- USDC
 - BTC
+- SOL
 - TRX
 - XRP
 
@@ -497,6 +560,8 @@ A: Pattern-based scanners always produce some. Rules with lower
    confidence are flagged as such. You can disable any rule in
    rules.json or via policy overrides.
 
+<img src="docs/screenshots/cli_clean.jpg" alt="CodeFence clean scan: no findings, a green checkmark, and a single line confirming the file passed" width="400">
+
 **Q: Can I modify the source?**
 A: Yes, privately. See LICENSE_FAQ.md.
 

{codefence-1.0.4 → codefence-1.0.11}/README.md

@@ -1,8 +1,10 @@
 # CodeFence
 
-**A tiny offline policy gate for code.**
+**Check AI-written code before you commit it.**
 
-Check AI-generated code before it reaches Git.
+Offline. Zero dependencies. No account. No telemetry.
+
+<img src="docs/screenshots/hero_blocked.jpg" alt="CodeFence v1.0.10 blocking a git commit: 4 findings including hardcoded API keys, SQL injection, and command injection" width="500">
 
 ---
 
@@ -18,6 +20,8 @@ runs a curated set of rules and reports findings with:
 - short remediation
 - typical before/after fix example
 
+<img src="docs/screenshots/cli_scan.jpg" alt="CodeFence CLI scan output: 6 critical, 1 high, 2 medium findings across R001-R012 with file:line:column locations and remediation hints" width="500">
+
 It is designed around the risks commonly encountered in AI-assisted
 development, but scans ordinary source code regardless of how it
 was written.
@@ -46,6 +50,10 @@ was written.
 - Not interprocedural. No dataflow, no taint analysis.
 - Not a guarantee. A clean scan does not mean the code is secure.
 
+For per-rule samples, known false-positive scenarios, false-negative
+scenarios, and the full detection methodology, see
+[`docs/DETECTION_METHODOLOGY.md`](docs/DETECTION_METHODOLOGY.md).
+
 ## Install
 
     pip install codefence
@@ -84,6 +92,9 @@ Every commit is then gated automatically.
 **Explanation:**
 
     codefence explain R002
+
+<img src="docs/screenshots/cli_verbose.jpg" alt="CodeFence --verbose output: each finding includes the matched code snippet and a typical before/after fix example" width="500">
+
 ## The 30 rules
 
 Rules are shipped in rules.json (human-readable JSON). You can
@@ -198,9 +209,61 @@ Every shipped file is hashed in CHECKSUMS.txt. To verify:
 Compare the output with the corresponding lines in CHECKSUMS.txt.
 If the hashes do not match, do not use the file.
 
+## Free vs Pro
+
+**Free gives you the full scanner. Pro gives you the workflow.**
+
+You are not paying for more detection. The Free tier includes all 30
+rules. You are paying for the automation layer that turns findings
+into a gate.
+
+| Feature | Free | Pro ($19) |
+|---|---|---|
+| All 30 rules (Python + JavaScript) | Yes | Yes |
+| CLI output (colored, compact, verbose) | Yes | Yes |
+| JSON output | Yes | Yes |
+| Configuration, include/exclude, severity filters | Yes | Yes |
+| Offline, zero dependencies, zero network | Yes | Yes |
+| `--format sarif` | - | Yes |
+| `--format html` | - | Yes |
+| Git pre-commit hook (`init-hook`) | - | Yes |
+| `--staged` / `--diff` | - | Yes |
+| `baseline` | - | Yes |
+| `--policy` + `policy validate` | - | Yes |
+| `--evidence` (deterministic hashes) | - | Yes |
+| `--history` + `history` / `stats` | - | Yes |
+| `explain RXXX` | - | Yes |
+| `init-github` (GitHub Actions workflow) | - | Yes |
+| `init` (one-command setup) | - | Yes |
+
+<img src="docs/screenshots/report_light.jpg" alt="CodeFence HTML report (light theme): summary bar, per-finding cards with severity, snippet, copyable fix, and dark mode toggle" width="400">
+
+Free = detect. Pro = enforce.
+
+### Activating Pro
+
+After purchase you receive a license key of the form
+`identifier:signature`. Store it in one of two places.
+
+**Option 1 — File:**
+
+    mkdir -p ~/.codefence
+    echo 'YOUR-LICENSE-KEY' > ~/.codefence/license.key
+
+**Option 2 — Environment variable (recommended for CI):**
+
+    export CODEFENCE_LICENSE_KEY='YOUR-LICENSE-KEY'
+
+Verify activation:
+
+    cfence init-hook    # works only with a valid Pro license
+
+The license is verified locally with HMAC-SHA256. No network call, no
+telemetry, no activation server.
+
 ## Payment and pricing
 
-**$12 USD, one-time.**
+**$19 USD, one-time.**
 
 Includes the current major version (v1.x) and its maintenance
 releases. No subscription. No support. No account.
@@ -208,8 +271,8 @@ releases. No subscription. No support. No account.
 Payments are available in cryptocurrency only:
 
 - USDT (TRC20 or BEP20)
-- USDC
 - BTC
+- SOL
 - TRX
 - XRP
 
@@ -274,6 +337,8 @@ A: Pattern-based scanners always produce some. Rules with lower
    confidence are flagged as such. You can disable any rule in
    rules.json or via policy overrides.
 
+<img src="docs/screenshots/cli_clean.jpg" alt="CodeFence clean scan: no findings, a green checkmark, and a single line confirming the file passed" width="400">
+
 **Q: Can I modify the source?**
 A: Yes, privately. See LICENSE_FAQ.md.
 

{codefence-1.0.4 → codefence-1.0.11}/TERMS_OF_USE.md

@@ -40,15 +40,15 @@ The Software is licensed, not sold. Your rights are defined in
 
 ## 3. Payment
 
-The Software is sold for a one-time fee of **USD 12** (or the
+The Software is sold for a one-time fee of **USD 19** (or the
 equivalent in a supported cryptocurrency) via the official sales
 channels listed in `README.md`.
 
 Supported payment methods (subject to change):
 
 - USDT (TRC20 or BEP20)
-- USDC
 - BTC
+- SOL
 - TRX
 - XRP
 
@@ -112,7 +112,7 @@ To the maximum extent permitted by applicable law:
 
 - the Software is provided AS-IS, without warranty,
 - the total aggregate liability of the vendor is capped at the
-  amount you actually paid (USD 12),
+  amount you actually paid (USD 19),
 - the vendor is not liable for indirect, incidental, or
   consequential damages.
 

{codefence-1.0.4 → codefence-1.0.11}/codefence.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.2
+Metadata-Version: 2.4
 Name: codefence
-Version: 1.0.4
+Version: 1.0.11
 Summary: A tiny offline policy gate for code. Check AI-generated code before it reaches Git.
 Author: CodeFence
 License: CODEFENCE
@@ -198,10 +198,9 @@ License: CODEFENCE
         END OF LICENSE
         --------------------------------------------------------------------
         
-Project-URL: Homepage, https://codefence.dev
-Project-URL: Source, https://github.com/USERNAME/codefence
-Project-URL: Issues, https://github.com/USERNAME/codefence/issues
-Project-URL: Changelog, https://github.com/USERNAME/codefence/blob/main/CHANGELOG.md
+Project-URL: Source, https://github.com/codefence-dev/codefence
+Project-URL: Issues, https://github.com/codefence-dev/codefence/issues
+Project-URL: Changelog, https://github.com/codefence-dev/codefence/blob/main/CHANGELOG.md
 Keywords: security,static-analysis,pre-commit,git-hook,ai-generated-code,sast,sarif,offline,policy
 Classifier: Development Status :: 5 - Production/Stable
 Classifier: Environment :: Console
@@ -220,12 +219,15 @@ Description-Content-Type: text/markdown
 License-File: LICENSE.txt
 License-File: LICENSE_FAQ.md
 License-File: NOTICE.md
+Dynamic: license-file
 
 # CodeFence
 
-**A tiny offline policy gate for code.**
+**Check AI-written code before you commit it.**
 
-Check AI-generated code before it reaches Git.
+Offline. Zero dependencies. No account. No telemetry.
+
+<img src="docs/screenshots/hero_blocked.jpg" alt="CodeFence v1.0.10 blocking a git commit: 4 findings including hardcoded API keys, SQL injection, and command injection" width="500">
 
 ---
 
@@ -241,6 +243,8 @@ runs a curated set of rules and reports findings with:
 - short remediation
 - typical before/after fix example
 
+<img src="docs/screenshots/cli_scan.jpg" alt="CodeFence CLI scan output: 6 critical, 1 high, 2 medium findings across R001-R012 with file:line:column locations and remediation hints" width="500">
+
 It is designed around the risks commonly encountered in AI-assisted
 development, but scans ordinary source code regardless of how it
 was written.
@@ -269,6 +273,10 @@ was written.
 - Not interprocedural. No dataflow, no taint analysis.
 - Not a guarantee. A clean scan does not mean the code is secure.
 
+For per-rule samples, known false-positive scenarios, false-negative
+scenarios, and the full detection methodology, see
+[`docs/DETECTION_METHODOLOGY.md`](docs/DETECTION_METHODOLOGY.md).
+
 ## Install
 
     pip install codefence
@@ -307,6 +315,9 @@ Every commit is then gated automatically.
 **Explanation:**
 
     codefence explain R002
+
+<img src="docs/screenshots/cli_verbose.jpg" alt="CodeFence --verbose output: each finding includes the matched code snippet and a typical before/after fix example" width="500">
+
 ## The 30 rules
 
 Rules are shipped in rules.json (human-readable JSON). You can
@@ -421,9 +432,61 @@ Every shipped file is hashed in CHECKSUMS.txt. To verify:
 Compare the output with the corresponding lines in CHECKSUMS.txt.
 If the hashes do not match, do not use the file.
 
+## Free vs Pro
+
+**Free gives you the full scanner. Pro gives you the workflow.**
+
+You are not paying for more detection. The Free tier includes all 30
+rules. You are paying for the automation layer that turns findings
+into a gate.
+
+| Feature | Free | Pro ($19) |
+|---|---|---|
+| All 30 rules (Python + JavaScript) | Yes | Yes |
+| CLI output (colored, compact, verbose) | Yes | Yes |
+| JSON output | Yes | Yes |
+| Configuration, include/exclude, severity filters | Yes | Yes |
+| Offline, zero dependencies, zero network | Yes | Yes |
+| `--format sarif` | - | Yes |
+| `--format html` | - | Yes |
+| Git pre-commit hook (`init-hook`) | - | Yes |
+| `--staged` / `--diff` | - | Yes |
+| `baseline` | - | Yes |
+| `--policy` + `policy validate` | - | Yes |
+| `--evidence` (deterministic hashes) | - | Yes |
+| `--history` + `history` / `stats` | - | Yes |
+| `explain RXXX` | - | Yes |
+| `init-github` (GitHub Actions workflow) | - | Yes |
+| `init` (one-command setup) | - | Yes |
+
+<img src="docs/screenshots/report_light.jpg" alt="CodeFence HTML report (light theme): summary bar, per-finding cards with severity, snippet, copyable fix, and dark mode toggle" width="400">
+
+Free = detect. Pro = enforce.
+
+### Activating Pro
+
+After purchase you receive a license key of the form
+`identifier:signature`. Store it in one of two places.
+
+**Option 1 — File:**
+
+    mkdir -p ~/.codefence
+    echo 'YOUR-LICENSE-KEY' > ~/.codefence/license.key
+
+**Option 2 — Environment variable (recommended for CI):**
+
+    export CODEFENCE_LICENSE_KEY='YOUR-LICENSE-KEY'
+
+Verify activation:
+
+    cfence init-hook    # works only with a valid Pro license
+
+The license is verified locally with HMAC-SHA256. No network call, no
+telemetry, no activation server.
+
 ## Payment and pricing
 
-**$12 USD, one-time.**
+**$19 USD, one-time.**
 
 Includes the current major version (v1.x) and its maintenance
 releases. No subscription. No support. No account.
@@ -431,8 +494,8 @@ releases. No subscription. No support. No account.
 Payments are available in cryptocurrency only:
 
 - USDT (TRC20 or BEP20)
-- USDC
 - BTC
+- SOL
 - TRX
 - XRP
 
@@ -497,6 +560,8 @@ A: Pattern-based scanners always produce some. Rules with lower
    confidence are flagged as such. You can disable any rule in
    rules.json or via policy overrides.
 
+<img src="docs/screenshots/cli_clean.jpg" alt="CodeFence clean scan: no findings, a green checkmark, and a single line confirming the file passed" width="400">
+
 **Q: Can I modify the source?**
 A: Yes, privately. See LICENSE_FAQ.md.
 

{codefence-1.0.4 → codefence-1.0.11}/codefence.egg-info/SOURCES.txt

@@ -14,6 +14,7 @@ codefence.egg-info/SOURCES.txt
 codefence.egg-info/dependency_links.txt
 codefence.egg-info/entry_points.txt
 codefence.egg-info/top_level.txt
+docs/DETECTION_METHODOLOGY.md
 samples/bad_javascript.js
 samples/bad_python.py
 samples/clean_example.js