codeintely-cli 0.1.0__tar.gz

codeintely_cli-0.1.0/LICENSE

@@ -0,0 +1,193 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the
+      purposes of this License, Derivative Works shall not include works
+      that remain separable from, or merely link (or bind by name) to the
+      interfaces of, the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including the
+      original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright
+      owner or by an individual or Legal Entity authorized to submit on
+      behalf of the copyright owner. For the purposes of this definition,
+      "submitted" means any form of electronic, verbal, or written
+      communication sent to the Licensor or its representatives,
+      including but not limited to communication on electronic mailing
+      lists, source code control systems, and issue tracking systems that
+      are managed by, or on behalf of, the Licensor for the purpose of
+      discussing and improving the Work, but excluding communication that
+      is conspicuously marked or otherwise designated in writing by the
+      copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have
+      made, use, offer to sell, sell, import, and otherwise transfer the
+      Work, where such license applies only to those patent claims
+      licensable by such Contributor that are necessarily infringed by
+      their Contribution(s) alone or by combination of their
+      Contribution(s) with the Work to which such Contribution(s) was
+      submitted. If You institute patent litigation against any entity
+      (including a cross-claim or counterclaim in a lawsuit) alleging
+      that the Work or a Contribution incorporated within the Work
+      constitutes direct or contributory patent infringement, then any
+      patent licenses granted to You under this License for that Work
+      shall terminate as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing
+      the origin of the Work and reproducing the content of the NOTICE
+      file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this
+      License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   Copyright 2026 FNTN Consultancy Inc
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

codeintely_cli-0.1.0/PKG-INFO

@@ -0,0 +1,72 @@
+Metadata-Version: 2.4
+Name: codeintely-cli
+Version: 0.1.0
+Summary: CodeIntely local/pre-commit security scanner — the same custom rule pack (identity security, AppSec breadth, IaC/container config) the GitHub App and VS Code extension use, runnable before you ever push.
+License-Expression: Apache-2.0
+Project-URL: Homepage, https://codeintely.com
+Project-URL: Repository, https://github.com/mdfaisalbe84/codeintely
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: Topic :: Security
+Classifier: Topic :: Software Development :: Quality Assurance
+Classifier: Programming Language :: Python :: 3
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: semgrep>=1.90
+Requires-Dist: pyyaml>=6.0
+Dynamic: license-file
+
+# codeintely-cli
+
+Local security scanner for the [CodeIntely](https://codeintely.com) platform — the same rule pack the GitHub App and VS Code extension use, runnable before you ever push. No account, no network calls to CodeIntely's own servers, no Django project required.
+
+```bash
+pip install codeintely-cli
+codeintely scan .
+```
+
+## What it checks
+
+- **Custom rule pack** (bundled, always runs) — identity security, tenant isolation/IDOR, mass assignment, and general AppSec breadth, via [Semgrep](https://semgrep.dev).
+- **Secrets** — [Gitleaks](https://github.com/gitleaks/gitleaks).
+- **Dependency CVEs** — [OSV-Scanner](https://github.com/google/osv-scanner).
+- **IaC misconfiguration** (Terraform/Kubernetes/Dockerfile) — [Trivy](https://github.com/aquasecurity/trivy).
+
+Gitleaks/OSV-Scanner/Trivy are auto-installed on first use if not already on `PATH` (downloaded once into `~/.codeintely/bin/`, reused after) — a plain `pip install` gets full coverage without separately installing three more tools by hand.
+
+## Usage
+
+```bash
+codeintely scan [PATH]                       # defaults to the current directory
+codeintely scan . --format json               # machine-readable output
+codeintely scan . --severity-threshold HIGH    # exit non-zero only at/above this severity (default: HIGH)
+codeintely scan . --no-color                   # disable ANSI color
+```
+
+Exit code is `0` when nothing at or above `--severity-threshold` was found, `1` otherwise — safe to use directly in CI or a git hook.
+
+## Pre-commit hook
+
+Add to your repo's `.pre-commit-config.yaml`:
+
+```yaml
+repos:
+  - repo: https://github.com/mdfaisalbe84/codeintely
+    rev: main  # pin to a tag once one exists
+    hooks:
+      - id: codeintely
+```
+
+Then:
+
+```bash
+pip install pre-commit
+pre-commit install
+```
+
+Every `git commit` now runs the scan first — a finding at or above `HIGH` blocks the commit before it ever reaches version control.
+
+## Why local, not just the GitHub App
+
+The hosted GitHub App scans pull requests *after* they reach GitHub — it can block a merge, not a `git push`. This CLI runs the same rules entirely offline, before a commit is even made.

codeintely_cli-0.1.0/README.md

@@ -0,0 +1,53 @@
+# codeintely-cli
+
+Local security scanner for the [CodeIntely](https://codeintely.com) platform — the same rule pack the GitHub App and VS Code extension use, runnable before you ever push. No account, no network calls to CodeIntely's own servers, no Django project required.
+
+```bash
+pip install codeintely-cli
+codeintely scan .
+```
+
+## What it checks
+
+- **Custom rule pack** (bundled, always runs) — identity security, tenant isolation/IDOR, mass assignment, and general AppSec breadth, via [Semgrep](https://semgrep.dev).
+- **Secrets** — [Gitleaks](https://github.com/gitleaks/gitleaks).
+- **Dependency CVEs** — [OSV-Scanner](https://github.com/google/osv-scanner).
+- **IaC misconfiguration** (Terraform/Kubernetes/Dockerfile) — [Trivy](https://github.com/aquasecurity/trivy).
+
+Gitleaks/OSV-Scanner/Trivy are auto-installed on first use if not already on `PATH` (downloaded once into `~/.codeintely/bin/`, reused after) — a plain `pip install` gets full coverage without separately installing three more tools by hand.
+
+## Usage
+
+```bash
+codeintely scan [PATH]                       # defaults to the current directory
+codeintely scan . --format json               # machine-readable output
+codeintely scan . --severity-threshold HIGH    # exit non-zero only at/above this severity (default: HIGH)
+codeintely scan . --no-color                   # disable ANSI color
+```
+
+Exit code is `0` when nothing at or above `--severity-threshold` was found, `1` otherwise — safe to use directly in CI or a git hook.
+
+## Pre-commit hook
+
+Add to your repo's `.pre-commit-config.yaml`:
+
+```yaml
+repos:
+  - repo: https://github.com/mdfaisalbe84/codeintely
+    rev: main  # pin to a tag once one exists
+    hooks:
+      - id: codeintely
+```
+
+Then:
+
+```bash
+pip install pre-commit
+pre-commit install
+```
+
+Every `git commit` now runs the scan first — a finding at or above `HIGH` blocks the commit before it ever reaches version control.
+
+## Why local, not just the GitHub App
+
+The hosted GitHub App scans pull requests *after* they reach GitHub — it can block a merge, not a `git push`. This CLI runs the same rules entirely offline, before a commit is even made.

codeintely_cli-0.1.0/codeintely_cli/__init__.py

@@ -0,0 +1 @@
+__version__ = "0.1.0"

codeintely_cli-0.1.0/codeintely_cli/binaries.py

@@ -0,0 +1,178 @@
+"""Auto-installs gitleaks/osv-scanner/trivy on first use, so a plain
+`pip install codeintely-cli` gets full coverage (secrets, dependency CVEs,
+IaC misconfig) without a user separately installing three more tools by
+hand — the actual point of "include gitleaks/osv-scanner/trivy" rather
+than just reporting them as skipped.
+
+An existing PATH install is always preferred over downloading a second
+copy (shutil.which() checked first) — this only downloads when nothing
+is already available. Downloaded binaries are cached under
+~/.codeintely/bin/ and reused on every later run; only the very first
+`codeintely scan` after install pays the download cost.
+
+Versions are pinned to the exact same releases backend/Dockerfile uses
+in production (gitleaks v8.21.2, osv-scanner v2.4.0, trivy v0.74.0) —
+same detection behavior locally as the hosted GitHub App, not
+independently-drifting versions. Asset names/archive layouts below were
+confirmed against the real GitHub releases for these exact versions, not
+assumed from a naming convention.
+
+osv-scanner is pinned to v2.4.0 specifically, not the also-real v1.9.2:
+confirmed live that scanners.py's `scan source ...` invocation has no
+`source` subcommand in v1.9.2 (real syntax there is just `scan
+[directory]`) — it silently produces zero findings instead of erroring,
+since the failed run leaves the pre-created output file empty and the
+caller reads "empty file" as "clean scan." v2.4.0 is what this was
+actually written and tested against.
+"""
+
+import io
+import logging
+import platform
+import shutil
+import stat
+import sys
+import tarfile
+import urllib.error
+import urllib.request
+import zipfile
+from pathlib import Path
+
+logger = logging.getLogger(__name__)
+
+CACHE_DIR = Path.home() / ".codeintely" / "bin"
+DOWNLOAD_TIMEOUT_SECONDS = 180  # trivy's Windows build alone is ~170MB
+
+GITLEAKS_VERSION = "8.21.2"
+OSV_SCANNER_VERSION = "2.4.0"
+TRIVY_VERSION = "0.74.0"
+
+
+def _os_arch() -> tuple[str | None, str | None]:
+    system = platform.system()  # "Windows" | "Linux" | "Darwin"
+    machine = platform.machine().lower()
+    if machine in ("amd64", "x86_64"):
+        arch = "x64"
+    elif machine in ("arm64", "aarch64"):
+        arch = "arm64"
+    else:
+        arch = None  # a real, if rare, unsupported case (e.g. 32-bit) — no asset built for it
+    return (system if system in ("Windows", "Linux", "Darwin") else None), arch
+
+
+def _gitleaks_asset(system: str, arch: str) -> str | None:
+    os_name = {"Windows": "windows", "Linux": "linux", "Darwin": "darwin"}[system]
+    # Confirmed live: this exact pinned version has no windows_arm64 build
+    # (later releases added one) — a real, narrow gap, not a bug.
+    if system == "Windows" and arch == "arm64":
+        return None
+    ext = "zip" if system == "Windows" else "tar.gz"
+    return f"gitleaks_{GITLEAKS_VERSION}_{os_name}_{arch}.{ext}"
+
+
+def _osv_scanner_asset(system: str, arch: str) -> str | None:
+    os_name = {"Windows": "windows", "Linux": "linux", "Darwin": "darwin"}[system]
+    arch_name = "amd64" if arch == "x64" else "arm64"
+    ext = ".exe" if system == "Windows" else ""
+    return f"osv-scanner_{os_name}_{arch_name}{ext}"
+
+
+def _trivy_asset(system: str, arch: str) -> str | None:
+    # Confirmed live: real, inconsistent-but-real casing per OS — "Linux"
+    # and "macOS" are capitalized, "windows" isn't.
+    os_name = {"Windows": "windows", "Linux": "Linux", "Darwin": "macOS"}[system]
+    arch_name = "64bit" if arch == "x64" else "ARM64"
+    ext = "zip" if system == "Windows" else "tar.gz"
+    return f"trivy_{TRIVY_VERSION}_{os_name}-{arch_name}.{ext}"
+
+
+# {tool_name: (release_base_url, asset_fn, is_raw_binary)} — is_raw_binary
+# distinguishes osv-scanner (the GitHub asset itself IS the binary, no
+# archive) from gitleaks/trivy (a .zip/.tar.gz to extract from).
+_TOOLS = {
+    "gitleaks": (
+        f"https://github.com/gitleaks/gitleaks/releases/download/v{GITLEAKS_VERSION}",
+        _gitleaks_asset, False,
+    ),
+    "osv-scanner": (
+        f"https://github.com/google/osv-scanner/releases/download/v{OSV_SCANNER_VERSION}",
+        _osv_scanner_asset, True,
+    ),
+    "trivy": (
+        f"https://github.com/aquasecurity/trivy/releases/download/v{TRIVY_VERSION}",
+        _trivy_asset, False,
+    ),
+}
+
+
+def _download(url: str) -> bytes | None:
+    try:
+        with urllib.request.urlopen(url, timeout=DOWNLOAD_TIMEOUT_SECONDS) as resp:
+            return resp.read()
+    except (urllib.error.URLError, OSError, TimeoutError):
+        return None
+
+
+def _extract_binary(archive_bytes: bytes, asset_name: str, member_name: str, dest_path: Path) -> bool:
+    try:
+        if asset_name.endswith(".zip"):
+            with zipfile.ZipFile(io.BytesIO(archive_bytes)) as zf:
+                with zf.open(member_name) as src, open(dest_path, "wb") as dst:
+                    shutil.copyfileobj(src, dst)
+        elif asset_name.endswith(".tar.gz"):
+            with tarfile.open(fileobj=io.BytesIO(archive_bytes), mode="r:gz") as tf:
+                member = tf.getmember(member_name)
+                extracted = tf.extractfile(member)
+                if extracted is None:
+                    return False
+                with extracted, open(dest_path, "wb") as dst:
+                    shutil.copyfileobj(extracted, dst)
+        else:
+            # osv-scanner: the downloaded asset already IS the binary.
+            dest_path.write_bytes(archive_bytes)
+    except (zipfile.BadZipFile, tarfile.TarError, KeyError, OSError):
+        return False
+    return True
+
+
+def ensure_binary(name: str) -> str | None:
+    """Returns a usable path to `name` — an existing PATH install if
+    found, otherwise auto-downloads the pinned version into
+    ~/.codeintely/bin/ (reused on every later call/run). Returns None
+    only when neither a PATH install nor a download succeeds
+    (unsupported platform/architecture, no network, GitHub unreachable)
+    — callers treat that the same as "not installed."
+    """
+    existing = shutil.which(name)
+    if existing:
+        return existing
+
+    exe_name = f"{name}.exe" if sys.platform == "win32" else name
+    cached = CACHE_DIR / exe_name
+    if cached.is_file():
+        return str(cached)
+
+    system, arch = _os_arch()
+    if system is None or arch is None:
+        return None
+
+    base_url, asset_fn, is_raw_binary = _TOOLS[name]
+    asset = asset_fn(system, arch)
+    if asset is None:
+        return None
+
+    print(f"codeintely: downloading {name} (one-time, cached under {CACHE_DIR})...", file=sys.stderr)
+    data = _download(f"{base_url}/{asset}")
+    if data is None:
+        logger.error("Could not download %s from %s/%s", name, base_url, asset)
+        return None
+
+    CACHE_DIR.mkdir(parents=True, exist_ok=True)
+    member_name = exe_name if not is_raw_binary else asset
+    if not _extract_binary(data, asset, member_name, cached):
+        logger.error("Downloaded %s but couldn't extract/save it", name)
+        return None
+
+    if sys.platform != "win32":
+        cached.chmod(cached.stat().st_mode | stat.S_IEXEC | stat.S_IXGRP | stat.S_IXOTH)
+    return str(cached)

codeintely_cli-0.1.0/codeintely_cli/main.py

@@ -0,0 +1,76 @@
+"""`codeintely` CLI entry point (P2d). See pyproject.toml's [project.scripts]."""
+
+import argparse
+import sys
+from pathlib import Path
+
+from . import __version__, output, scanners
+
+# Windows consoles commonly default stdout to a legacy codepage (cp1252)
+# that can't encode the ✓ in a clean report or non-ASCII bytes a scanner
+# might legitimately emit (a file path, a finding message) — confirmed
+# live: a bare `print()` of this module's own "No findings" line crashed
+# with UnicodeEncodeError before this reconfigure. errors="replace" over a
+# stricter mode since a scan report should never crash on output — a
+# mangled character is a much smaller problem than the tool being unusable
+# on a stock Windows terminal.
+if hasattr(sys.stdout, "reconfigure"):
+    sys.stdout.reconfigure(encoding="utf-8", errors="replace")
+    sys.stderr.reconfigure(encoding="utf-8", errors="replace")
+
+SEVERITY_ORDER = output.SEVERITY_ORDER
+
+
+def build_parser() -> argparse.ArgumentParser:
+    parser = argparse.ArgumentParser(
+        prog="codeintely",
+        description="CodeIntely local security scanner — the same custom rule pack the GitHub App uses, run locally.",
+    )
+    parser.add_argument("--version", action="version", version=f"codeintely-cli {__version__}")
+    subparsers = parser.add_subparsers(dest="command", required=True)
+
+    scan = subparsers.add_parser("scan", help="Scan a local directory (default: current directory).")
+    scan.add_argument("path", nargs="?", default=".", help="Directory to scan (default: .)")
+    scan.add_argument("--format", choices=["text", "json"], default="text", help="Output format (default: text)")
+    scan.add_argument(
+        "--severity-threshold", choices=SEVERITY_ORDER, default="HIGH",
+        help="Exit non-zero only when a finding at or above this severity exists (default: HIGH) — matches "
+             "the same bar the GitHub App's PR check run uses.",
+    )
+    scan.add_argument("--no-color", action="store_true", help="Disable ANSI color in text output.")
+    return parser
+
+
+def _exceeds_threshold(findings: list[dict], threshold: str) -> bool:
+    threshold_index = SEVERITY_ORDER.index(threshold)
+    return any(
+        SEVERITY_ORDER.index(f["severity"]) <= threshold_index
+        for f in findings if f["severity"] in SEVERITY_ORDER
+    )
+
+
+def run_scan(args) -> int:
+    target_dir = Path(args.path).resolve()
+    if not target_dir.is_dir():
+        print(f"error: {target_dir} is not a directory", file=sys.stderr)
+        return 2
+
+    findings, skipped = scanners.run_all(target_dir)
+
+    if args.format == "json":
+        print(output.render_json(findings, skipped, target_dir))
+    else:
+        print(output.render_text(findings, skipped, target_dir, use_color=not args.no_color))
+
+    return 1 if _exceeds_threshold(findings, args.severity_threshold) else 0
+
+
+def main() -> None:
+    parser = build_parser()
+    args = parser.parse_args()
+    if args.command == "scan":
+        sys.exit(run_scan(args))
+
+
+if __name__ == "__main__":
+    main()

codeintely_cli-0.1.0/codeintely_cli/output.py

@@ -0,0 +1,63 @@
+"""Text/JSON reporting for the CLI. Stdlib-only ANSI coloring — no `rich`/
+`click` dependency, keeping `pip install codeintely-cli` lean.
+"""
+
+import json
+import sys
+
+SEVERITY_ORDER = ["CRITICAL", "HIGH", "MEDIUM", "LOW"]
+_SEVERITY_COLOR = {"CRITICAL": "\033[1;31m", "HIGH": "\033[31m", "MEDIUM": "\033[33m", "LOW": "\033[90m"}
+_RESET = "\033[0m"
+_BOLD = "\033[1m"
+
+
+def _supports_color() -> bool:
+    # Modern Windows terminals (10+) handle ANSI codes fine when attached
+    # to a real console; the only case to avoid coloring is output being
+    # redirected/piped (a file, `| less`, CI log capture), where isatty()
+    # is False on every platform.
+    return sys.stdout.isatty()
+
+
+def render_text(findings: list[dict], skipped: list[str], target_dir, use_color: bool) -> str:
+    lines = []
+    color = use_color and _supports_color()
+
+    def c(code, text):
+        return f"{code}{text}{_RESET}" if color else text
+
+    lines.append(c(_BOLD, f"codeintely scan — {target_dir}"))
+    lines.append("")
+
+    if skipped:
+        lines.append(f"Skipped (not installed): {', '.join(skipped)} — install for fuller coverage.")
+        lines.append("")
+
+    if not findings:
+        lines.append(c("\033[32m", "No findings. ✓"))
+        return "\n".join(lines)
+
+    findings_sorted = sorted(
+        findings, key=lambda f: SEVERITY_ORDER.index(f["severity"]) if f["severity"] in SEVERITY_ORDER else 99
+    )
+    for f in findings_sorted:
+        sev = f["severity"]
+        sev_label = c(_SEVERITY_COLOR.get(sev, ""), f"[{sev}]")
+        location = f"{f['file_path']}:{f['line_number']}" if f.get("line_number") else f["file_path"]
+        lines.append(f"{sev_label} {c(_BOLD, f['rule_id'])} ({f['scanner']}) — {location}")
+        lines.append(f"    {f['message']}")
+        lines.append("")
+
+    counts = {sev: sum(1 for f in findings if f["severity"] == sev) for sev in SEVERITY_ORDER}
+    summary = ", ".join(f"{counts[s]} {s}" for s in SEVERITY_ORDER if counts[s])
+    lines.append(c(_BOLD, f"{len(findings)} finding(s): {summary}"))
+    return "\n".join(lines)
+
+
+def render_json(findings: list[dict], skipped: list[str], target_dir) -> str:
+    return json.dumps({
+        "target": str(target_dir),
+        "skipped_scanners": skipped,
+        "finding_count": len(findings),
+        "findings": findings,
+    }, indent=2)