codejury 0.10.0__tar.gz → 0.10.1__tar.gz

{codejury-0.10.0 → codejury-0.10.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codejury
-Version: 0.10.0
+Version: 0.10.1
 Summary: General-purpose Application Security AI audit framework -- five-layer architecture, capabilities as first-class data
 Author: AISecLabs
 License-Expression: MIT

{codejury-0.10.0 → codejury-0.10.1}/codejury/agents/debate.py

@@ -19,15 +19,18 @@ from codejury.agents.parsing import one_of, str_list, to_evidence, to_float
 from codejury.domain.artifact import CodeArtifact
 from codejury.domain.capability import Capability
 from codejury.domain.context import AnalysisContext
-from codejury.domain.observation import Concession, Finding, Observation
+from codejury.domain.observation import Concession, Finding, Observation, Severity
 from codejury.infrastructure.json_parse import extract_json_object
 from codejury.providers.base import Message, Provider
 
-_SEVERITY = {"CRITICAL", "HIGH", "MEDIUM", "LOW", "INFO"}
+from typing import get_args
+
+_SEVERITY = set(get_args(Severity))  # single source of truth: the Severity Literal
 
 _FINDING_SHAPE = (
     '{"capability": "id.sub", "title": "...", "severity": "HIGH", "cwe": "CWE-89", '
-    '"description": "...", "evidence": [{"file": "...", "line": 0, "code": "..."}], "confidence": 0.0}'
+    '"description": "...", "recommendation": "...", "matched_anti": ["id"], '
+    '"evidence": [{"file": "...", "line": 0, "code": "..."}], "confidence": 0.0}'
 )
 
 _DEEP_LENS = (

{codejury-0.10.0 → codejury-0.10.1}/codejury/agents/mock.py

@@ -2,8 +2,7 @@
 
 It really calls the provider (so the dry-run exercises the agent -> provider
 path), then emits one Verdict per in-scope capability, parking the model's reply
-in ``reasoning``. It does no real parsing or judgement; the Phase 3 VerifierAgent
-will.
+in ``reasoning``. It does no real parsing or judgement; ``VerifierAgent`` does.
 """
 
 from __future__ import annotations

codejury-0.10.1/codejury/agents/parsing.py

@@ -0,0 +1,45 @@
+"""Shared coercion from loosely-typed model JSON into domain values.
+
+Agents parse model output that may omit, mistype, or invent fields. These
+helpers coerce defensively -- they never raise on bad input, they fall back.
+"""
+
+import math
+
+from codejury.domain.observation import Evidence
+
+
+def str_list(value: object) -> list[str]:
+    return [str(x) for x in value] if isinstance(value, list) else []
+
+
+def to_float(value: object, default: float) -> float:
+    # reject bool (it is an int subclass) and non-finite values (json.loads accepts
+    # NaN/Infinity); a NaN confidence would silently corrupt every downstream sort.
+    if isinstance(value, bool):
+        return default
+    try:
+        result = float(value)  # type: ignore[arg-type]
+    except (TypeError, ValueError):
+        return default
+    return result if math.isfinite(result) else default
+
+
+def one_of(value: object, allowed: set[str], default: str) -> str:
+    # `value in allowed` would raise TypeError on an unhashable model value
+    # (e.g. status -> [] or {}); guard so bad input falls back, never raises.
+    return value if isinstance(value, str) and value in allowed else default
+
+
+def to_evidence(items: object) -> list[Evidence]:
+    if not isinstance(items, list):
+        return []
+    out: list[Evidence] = []
+    for e in items:
+        if not isinstance(e, dict):
+            continue
+        line = e.get("line")
+        # a location needs a real 1-based line; reject 0, negatives, and bool (an int subclass)
+        valid_line = line if isinstance(line, int) and not isinstance(line, bool) and line >= 1 else None
+        out.append(Evidence(file=str(e.get("file", "")), line=valid_line, code=str(e.get("code", ""))))
+    return out

{codejury-0.10.0 → codejury-0.10.1}/codejury/agents/verifier.py

@@ -15,11 +15,13 @@ from codejury.agents.base import Agent
 from codejury.agents.parsing import one_of, str_list, to_evidence, to_float
 from codejury.domain.capability import Capability
 from codejury.domain.context import AnalysisContext
-from codejury.domain.observation import Observation, Verdict
+from codejury.domain.observation import Observation, Verdict, VerdictStatus
 from codejury.infrastructure.json_parse import extract_json_object
 from codejury.providers.base import Message, Provider
 
-_VALID_STATUS = {"SECURE", "VULNERABLE", "PARTIAL", "NOT_PRESENT", "UNKNOWN"}
+from typing import get_args
+
+_VALID_STATUS = set(get_args(VerdictStatus))  # single source of truth: the VerdictStatus Literal
 
 _SYSTEM = (
     "You are a security verifier. You check code against a checklist of correct and "
@@ -108,8 +110,10 @@ def _anti_pattern_cwes(cap: Capability) -> dict[str, tuple[int, str]]:
 
 
 def _resolve_cwe(matched_anti: list[str], cwe_by_id: dict[str, tuple[int, str]]) -> str:
+    # the most severe matched anti-pattern's CWE; ties broken by CWE id so the result
+    # is fully determined by the inputs, not by dict/list ordering.
     matched = [cwe_by_id[a] for a in matched_anti if a in cwe_by_id]
-    return max(matched, key=lambda rank_cwe: rank_cwe[0])[1] if matched else ""
+    return max(matched, key=lambda rank_cwe: (rank_cwe[0], rank_cwe[1]))[1] if matched else ""
 
 
 def _parse_verdicts(text: str, cap: Capability) -> list[Verdict]:

{codejury-0.10.0 → codejury-0.10.1}/codejury/assembly.py

@@ -88,7 +88,7 @@ def build_orchestration(
 def provider_tag(provider: Provider) -> str:
     """A stable short name for a provider (unwrapping RetryProvider) for cache keys,
     so two providers that accept the same model string do not share cached verdicts."""
-    return type(getattr(provider, "_inner", provider)).__name__
+    return type(getattr(provider, "inner", provider)).__name__
 
 
 def orchestration_descriptor(provider: Provider, strategy: str, model: str, max_tokens: int) -> str:

{codejury-0.10.0 → codejury-0.10.1}/codejury/baseline.py

@@ -15,13 +15,11 @@ NOT_PRESENT verdicts and concessions are always kept.
 
 from __future__ import annotations
 
-from codejury.domain.observation import Concession, Finding, Observation, Verdict
+from codejury.domain.observation import Concession, Finding, Observation, Verdict, is_problem
 from codejury.domain.result import AnalysisResult
 
 Results = list[tuple[str, AnalysisResult]]
 
-_PROBLEM_STATUSES = ("VULNERABLE", "PARTIAL")
-
 
 def finding_key(o: Observation) -> tuple:
     """A location-tolerant fingerprint for matching a finding across versions."""
@@ -39,13 +37,13 @@ def filter_new(results: Results, baseline: Results) -> tuple[Results, int]:
 
     Returns (filtered_results, dropped_count). Non-problem observations are kept.
     """
-    seen = {finding_key(o) for _, r in baseline for o in r.observations if _is_problem(o)}
+    seen = {finding_key(o) for _, r in baseline for o in r.observations if is_problem(o)}
     filtered: Results = []
     dropped = 0
     for path, result in results:
         kept: list[Observation] = []
         for o in result.observations:
-            if _is_problem(o) and finding_key(o) in seen:
+            if is_problem(o) and finding_key(o) in seen:
                 dropped += 1
             else:
                 kept.append(o)
@@ -53,10 +51,8 @@ def filter_new(results: Results, baseline: Results) -> tuple[Results, int]:
     return filtered, dropped
 
 
-def _is_problem(o: Observation) -> bool:
-    return isinstance(o, Finding) or (isinstance(o, Verdict) and o.status in _PROBLEM_STATUSES)
-
-
 def _evidence_sig(o: Observation) -> str:
+    # fingerprints only the first evidence snippet -- enough to distinguish findings
+    # in practice; two findings differing only in a later snippet would collide.
     evidence = getattr(o, "evidence", [])
     return " ".join(evidence[0].code.split()) if evidence and evidence[0].code else ""

{codejury-0.10.0 → codejury-0.10.1}/codejury/cli.py

@@ -280,6 +280,7 @@ def main(argv: list[str] | None = None) -> int:
     scan_p.add_argument("--no-suppress", action="store_true", help="disable the known-noise suppression filter")
     scan_p.add_argument("--no-cache", action="store_true", help="bypass the verdict cache (always re-query the model)")
     scan_p.add_argument("--baseline", default=None, help="a prior JSON report; report only findings new since it")
+    scan_p.add_argument("--retries", type=int, default=0, help="provider retry attempts on failure")
     scan_p.add_argument("--fail-on", choices=_FAIL_ON, default=None, dest="fail_on", help="exit 1 if a finding at/above this severity is found")
 
     run_p = sub.add_parser("run", help="run a named task preset against a unified diff")
@@ -301,9 +302,19 @@ def main(argv: list[str] | None = None) -> int:
     eval_p.add_argument("--model", default=DEFAULT_MODEL)
     eval_p.add_argument("--api-base", default=DEFAULT_API_BASE, help="provider base URL (env: CODEJURY_API_BASE)")
     eval_p.add_argument("--api-key", default=DEFAULT_API_KEY, help="provider API key (env: CODEJURY_API_KEY)")
+    eval_p.add_argument("--retries", type=int, default=0, help="provider retry attempts on failure")
 
     args = parser.parse_args(argv)
+    try:
+        return _dispatch(args, parser)
+    except Exception as exc:
+        # expected failures (missing diff file, provider auth, malformed input) become
+        # one stderr line, not a traceback. eval's own message is preserved by command name.
+        print(f"{args.command or 'codejury'} failed: {exc}", file=sys.stderr)
+        return 1
 
+
+def _dispatch(args, parser) -> int:
     if args.command == "audit":
         results = audit(
             _read_diff(args.diff),
@@ -326,12 +337,15 @@ def main(argv: list[str] | None = None) -> int:
         capabilities = load_capabilities(args.capabilities)
         if args.only:
             wanted = {x.strip() for x in args.only.split(",")}
+            unknown = wanted - {c.id for c in capabilities}
+            if unknown:
+                print(f"warning: --only names unknown capability id(s): {', '.join(sorted(unknown))}", file=sys.stderr)
             capabilities = [c for c in capabilities if c.id in wanted]
         extensions = tuple(e if e.startswith(".") else "." + e for e in args.ext.split(","))
         results = scan(
             args.directory,
             capabilities,
-            provider=make_provider(args.provider, api_key=args.api_key, api_base=args.api_base),
+            provider=make_provider(args.provider, api_key=args.api_key, api_base=args.api_base, retries=args.retries),
             model=args.model,
             max_tokens=args.max_tokens,
             strategy=args.orchestrator,
@@ -359,19 +373,13 @@ def main(argv: list[str] | None = None) -> int:
         return _gate_exit(results, args.fail_on)
 
     if args.command == "eval":
-        try:
-            report = evaluate(
-                load_cases(args.dataset, split=args.split),
-                load_capabilities(args.capabilities),
-                provider=make_provider(args.provider, api_key=args.api_key, api_base=args.api_base),
-                model=args.model,
-                strategy=args.orchestrator,
-            )
-        except Exception as exc:
-            # e.g. a missing API key surfaces as a provider auth error -- report it
-            # as one line, not a traceback (audit gets this via the orchestrator).
-            print(f"eval failed: {exc}")
-            return 1
+        report = evaluate(
+            load_cases(args.dataset, split=args.split),
+            load_capabilities(args.capabilities),
+            provider=make_provider(args.provider, api_key=args.api_key, api_base=args.api_base, retries=args.retries),
+            model=args.model,
+            strategy=args.orchestrator,
+        )
         print(json.dumps(report.to_dict(), indent=2) if args.fmt == "json" else _render_eval(report))
         return 0
 

{codejury-0.10.0 → codejury-0.10.1}/codejury/domain/capability.py

@@ -20,8 +20,12 @@ from typing import Any
 
 import yaml
 
+from typing import get_args
+
 from codejury.domain.observation import Severity
 
+_SEVERITIES = frozenset(get_args(Severity))
+
 
 @dataclass(frozen=True, kw_only=True)
 class CorrectPattern:
@@ -57,12 +61,18 @@ class AntiPattern:
 
     @classmethod
     def from_dict(cls, data: dict[str, Any]) -> AntiPattern:
+        severity = data.get("severity", "MEDIUM")
+        if severity not in _SEVERITIES:
+            raise ValueError(
+                f"anti_pattern {data.get('id')!r}: invalid severity {severity!r}; "
+                f"expected one of {', '.join(_SEVERITIES)}"
+            )
         return cls(
             id=data["id"],
             description=data.get("description", ""),
             signals=list(data.get("signals", [])),
             cwe=data.get("cwe", ""),
-            severity=data.get("severity", "MEDIUM"),
+            severity=severity,
             why_bad=data.get("why_bad", ""),
             example_bad=data.get("example_bad", ""),
             example_good=data.get("example_good", ""),
@@ -130,7 +140,10 @@ def load_capability(path: str | Path) -> Capability:
         data = yaml.safe_load(f)
     if not isinstance(data, dict):
         raise ValueError(f"{path}: expected a YAML mapping at the top level, got {type(data).__name__}")
-    return Capability.from_dict(data)
+    try:
+        return Capability.from_dict(data)
+    except (KeyError, ValueError) as exc:
+        raise ValueError(f"{path}: {exc}") from exc
 
 
 def load_capabilities(directory: str | Path) -> list[Capability]:

{codejury-0.10.0 → codejury-0.10.1}/codejury/domain/observation.py

@@ -14,6 +14,7 @@ across subclass inheritance.
 
 from __future__ import annotations
 
+import dataclasses
 from dataclasses import asdict, dataclass, field
 from typing import Any, ClassVar, Literal
 
@@ -112,13 +113,33 @@ _OBSERVATION_CLASSES: dict[ObservationKind, type[Observation]] = {
 }
 
 
+_PROBLEM_STATUSES = ("VULNERABLE", "PARTIAL")
+
+
+def is_problem(o: Observation) -> bool:
+    """A reportable problem: a Finding, or a VULNERABLE/PARTIAL Verdict. The single
+    definition shared by reporting, suppression, and the diff baseline."""
+    return isinstance(o, Finding) or (isinstance(o, Verdict) and o.status in _PROBLEM_STATUSES)
+
+
+def _only_known(cls: type, data: dict[str, Any]) -> dict[str, Any]:
+    fields = {f.name for f in dataclasses.fields(cls)}
+    return {k: v for k, v in data.items() if k in fields}
+
+
 def observation_from_dict(data: dict[str, Any]) -> Observation:
     """Reconstruct an observation from its ``to_dict`` form (inverse of it).
 
-    Used by the verdict cache to round-trip results through JSON.
+    Used to round-trip results through JSON (the verdict cache and the diff
+    baseline). On-disk reports are external input, so this fails with a clear
+    error on a missing/unknown ``kind`` and tolerates unknown extra keys (forward
+    compatibility) rather than crashing with KeyError/TypeError.
     """
     data = dict(data)
-    cls = _OBSERVATION_CLASSES[data.pop("kind")]
+    kind = data.pop("kind", None)
+    cls = _OBSERVATION_CLASSES.get(kind)
+    if cls is None:
+        raise ValueError(f"unknown observation kind: {kind!r}")
     if "evidence" in data:
-        data["evidence"] = [Evidence(**e) for e in data["evidence"]]
-    return cls(**data)
+        data["evidence"] = [Evidence(**_only_known(Evidence, e)) for e in data["evidence"]]
+    return cls(**_only_known(cls, data))

{codejury-0.10.0 → codejury-0.10.1}/codejury/evaluation.py

@@ -30,6 +30,7 @@ import yaml
 from codejury.domain.artifact import CodeArtifact
 from codejury.domain.capability import Capability
 from codejury.domain.context import AnalysisContext
+from codejury.domain.observation import Observation
 from codejury.providers.base import Provider
 
 
@@ -126,7 +127,12 @@ def load_cases(directory: str | Path, *, split: str | None = None) -> list[Golde
     for path in sorted(Path(directory).glob("*.yaml")):
         with open(path, encoding="utf-8") as f:
             data = yaml.safe_load(f)
-        case = GoldenCase.from_dict(path.stem, data)
+        if not isinstance(data, dict):
+            raise ValueError(f"{path}: expected a YAML mapping, got {type(data).__name__}")
+        try:
+            case = GoldenCase.from_dict(path.stem, data)
+        except KeyError as exc:
+            raise ValueError(f"{path}: golden case missing required key {exc}") from exc
         if split is None or case.split == split:
             cases.append(case)
     return cases
@@ -166,7 +172,7 @@ def evaluate(
     return report
 
 
-def _predicted_vulnerable(observations: list) -> bool:
+def _predicted_vulnerable(observations: list[Observation]) -> bool:
     """Did the run flag a problem? A Finding (debate/reflexion) or a VULNERABLE
     Verdict (single/pipeline/taint) counts; SECURE verdicts and dismissed
     concessions do not. (A bare Finding has no ``status``, so checking only

{codejury-0.10.0 → codejury-0.10.1}/codejury/infrastructure/json_parse.py

@@ -10,13 +10,18 @@ from __future__ import annotations
 import json
 import re
 
-# Greedy so a fenced block with nested braces is captured whole.
-_FENCE = re.compile(r"```(?:json)?\s*(\{.*\})\s*```", re.DOTALL)
+# Non-greedy so a second code fence later in the text doesn't get swallowed into the
+# captured span; nested braces inside one block are still matched by the {...} anchors.
+_FENCE = re.compile(r"```(?:json)?\s*(\{.*?\})\s*```", re.DOTALL)
+
+# Defensive ceiling: model output is bounded by max_tokens, but never scan an
+# unbounded string (the balanced-brace pass is superlinear on pathological input).
+_MAX_SCAN = 1_000_000
 
 
 def extract_json_object(text: str) -> dict | None:
     """Return the first JSON object found in `text`, or None if there is none."""
-    text = text.strip()
+    text = text.strip()[:_MAX_SCAN]
 
     try:
         obj = json.loads(text)

{codejury-0.10.0 → codejury-0.10.1}/codejury/integrations/github.py

@@ -10,6 +10,7 @@ review body. The review requests changes when any problem is found.
 from __future__ import annotations
 
 import json
+import urllib.error
 import urllib.request
 from typing import Any, Callable
 
@@ -18,18 +19,21 @@ from codejury.domain.result import AnalysisResult
 
 Results = list[tuple[str, AnalysisResult]]
 
+# rank for ordering inline comments most-severe first before truncating to max_comments
+_COMMENT_RANK = {"CRITICAL": 0, "HIGH": 1, "VULNERABLE": 1, "MEDIUM": 2, "PARTIAL": 2, "LOW": 3, "INFO": 4}
+
 
 def build_review(results: Results, *, max_comments: int = 50) -> dict:
-    comments: list[dict] = []
-    problems = 0
+    ranked: list[tuple[int, dict]] = []
     for _path, result in results:
         for o in result.observations:
             comment = _inline_comment(o)
-            if comment is None:
-                continue
-            problems += 1
-            if len(comments) < max_comments:
-                comments.append(comment)
+            if comment is not None:
+                ranked.append((_comment_rank(o), comment))
+    problems = len(ranked)
+    # surface the most severe inline when there are more problems than the cap
+    ranked.sort(key=lambda rc: rc[0])
+    comments = [c for _, c in ranked[:max_comments]]
 
     body = (
         f"codejury found {problems} issue(s)." if problems else "codejury found no issues."
@@ -43,6 +47,11 @@ def build_review(results: Results, *, max_comments: int = 50) -> dict:
     }
 
 
+def _comment_rank(o: Observation) -> int:
+    key = o.severity if o.kind == "finding" else getattr(o, "status", "")
+    return _COMMENT_RANK.get(key, 5)
+
+
 def _inline_comment(o: Observation) -> dict | None:
     if o.kind == "finding":
         evidence = o.evidence[0] if o.evidence else None
@@ -75,8 +84,14 @@ def post_review(
     if transport is not None:
         return transport(url, data, headers)
     request = urllib.request.Request(url, data=data, headers=headers, method="POST")
-    with urllib.request.urlopen(request) as response:
-        return response.status
+    try:
+        with urllib.request.urlopen(request) as response:
+            return response.status
+    except urllib.error.HTTPError as exc:
+        # surface GitHub's error detail (auth 401, repo/PR 404, out-of-diff line 422);
+        # the token is in the request, not this response body, so it is safe to include.
+        detail = exc.read().decode("utf-8", "replace")[:500]
+        raise RuntimeError(f"GitHub review POST failed: {exc.code} {detail}") from exc
 
 
 def parse_pr_ref(ref: str) -> tuple[str, str, int]:

{codejury-0.10.0 → codejury-0.10.1}/codejury/orchestrators/base.py

@@ -16,4 +16,12 @@ from codejury.domain.result import AnalysisResult
 
 class Orchestrator(ABC):
     @abstractmethod
-    def run(self, agents: dict[str, Agent], context: AnalysisContext) -> AnalysisResult: ...
+    def run(self, agents: dict[str, Agent], context: AnalysisContext) -> AnalysisResult:
+        """Run the orchestration and return a result.
+
+        Contract: never raise for an agent/provider failure -- record it in
+        ``AnalysisResult.error`` and return the observations produced so far.
+        ``single`` deliberately stops at the first failure; the multi-agent
+        strategies record the error and return their partial ruling.
+        """
+        ...

{codejury-0.10.0 → codejury-0.10.1}/codejury/orchestrators/challenge.py

@@ -17,6 +17,7 @@ taint checks over-report.
 from __future__ import annotations
 
 import dataclasses
+from collections import Counter
 
 from codejury.agents.base import Agent
 from codejury.domain.context import AnalysisContext
@@ -50,10 +51,19 @@ class ChallengeOrchestrator(Orchestrator):
 
         refutations = agents["refuter"].run(dataclasses.replace(context, history=flagged))
         reasons = {c.target: c.reason for c in refutations if isinstance(c, Concession)}
+        # the refuter targets a capability, not an individual verdict; if a capability
+        # has more than one flagged verdict the refutation is ambiguous, so leave them
+        # all standing rather than risk dismissing one the refuter did not concede.
+        flagged_per_cap = Counter(v.capability for v in flagged)
 
         observations: list[Observation] = []
         for v in verdicts:
-            if isinstance(v, Verdict) and v.status == "VULNERABLE" and v.capability in reasons:
+            if (
+                isinstance(v, Verdict)
+                and v.status == "VULNERABLE"
+                and v.capability in reasons
+                and flagged_per_cap[v.capability] == 1
+            ):
                 observations.append(
                     Concession(
                         capability=v.capability,

{codejury-0.10.0 → codejury-0.10.1}/codejury/providers/retry.py

@@ -21,11 +21,18 @@ class RetryProvider(Provider):
         max_attempts: int = 3,
         base_delay: float = 1.0,
         sleep: Callable[[float], None] = time.sleep,
+        retryable: tuple[type[BaseException], ...] = (Exception,),
     ) -> None:
         self._inner = inner
         self._max_attempts = max_attempts
         self._base_delay = base_delay
         self._sleep = sleep
+        self._retryable = retryable
+
+    @property
+    def inner(self) -> Provider:
+        """The wrapped provider (so callers need not reach into a private field)."""
+        return self._inner
 
     def complete(
         self,
@@ -41,7 +48,7 @@ class RetryProvider(Provider):
                 return self._inner.complete(
                     system=system, messages=messages, model=model, max_tokens=max_tokens, cache=cache
                 )
-            except Exception:
+            except self._retryable:
                 if attempt == self._max_attempts:
                     raise
                 self._sleep(self._base_delay * attempt)

{codejury-0.10.0 → codejury-0.10.1}/codejury/reporting.py

@@ -11,7 +11,7 @@ from __future__ import annotations
 import json
 
 from codejury import __version__ as _tool_version
-from codejury.domain.observation import Observation, observation_from_dict
+from codejury.domain.observation import Observation, is_problem, observation_from_dict
 from codejury.domain.result import AnalysisResult
 
 Results = list[tuple[str, AnalysisResult]]
@@ -39,8 +39,17 @@ def to_json(results: Results) -> str:
 
 
 def from_json(text: str) -> Results:
-    """Parse a ``to_json`` report back into results (used to load a diff baseline)."""
-    payload = json.loads(text)
+    """Parse a ``to_json`` report back into results (used to load a diff baseline).
+
+    Raises ValueError on a malformed report (it is external, possibly hand-edited,
+    input) rather than an opaque KeyError/TypeError.
+    """
+    try:
+        payload = json.loads(text)
+    except json.JSONDecodeError as exc:
+        raise ValueError(f"baseline report is not valid JSON: {exc}") from exc
+    if not isinstance(payload, dict):
+        raise ValueError("baseline report must be a JSON object with a 'files' list")
     return [
         (
             f.get("path", ""),
@@ -61,7 +70,7 @@ def to_markdown(results: Results) -> str:
         if result.error:
             lines.append(f"> error: {result.error}")
 
-        problems = sorted((o for o in result.observations if _is_problem(o)), key=_rank)
+        problems = sorted((o for o in result.observations if is_problem(o)), key=_rank)
         cleared = [o for o in result.observations if o.kind == "verdict" and o.status in _CLEARED]
         dismissed = [o for o in result.observations if o.kind == "concession"]
 
@@ -93,16 +102,12 @@ def _summary(results: Results) -> list[str]:
                 dismissed += 1
     return [
         f"- files audited: {len(results)}",
-        f"- issues: {vulnerable} vulnerable verdict(s), {findings} finding(s)",
+        f"- issues: {vulnerable} problem verdict(s) (VULNERABLE/PARTIAL), {findings} finding(s)",
         f"- checked and clear: {cleared}",
         f"- dismissed: {dismissed}",
     ]
 
 
-def _is_problem(o: Observation) -> bool:
-    return o.kind == "finding" or (o.kind == "verdict" and o.status in _PROBLEM_STATUSES)
-
-
 def _rank(o: Observation) -> int:
     if o.kind == "finding":
         return _SEVERITY_ORDER.get(o.severity, 5)
@@ -146,7 +151,7 @@ def to_sarif(results: Results) -> str:
 
     for _, result in results:
         for o in result.observations:
-            if not _is_problem(o):
+            if not is_problem(o):
                 continue
             locations = _sarif_locations(o)
             if not locations:

{codejury-0.10.0 → codejury-0.10.1}/codejury/sources/callers.py

@@ -4,7 +4,9 @@ For a file under review, find where the functions and classes it defines are
 called elsewhere in the repository. Showing those call sites lets the verifier
 trace where an argument comes from -- which is exactly what single-file review
 lacks for taint-style issues (a path/command that is operator-supplied vs
-attacker-controlled). This is a textual usage finder, not a full call graph.
+attacker-controlled). This is a textual usage finder, not a full call graph: the
+call regex also matches a name inside a string, a comment, or a `def`/`class`
+line elsewhere, so treat the result as a hint, not a precise caller set.
 """
 
 from __future__ import annotations

{codejury-0.10.0 → codejury-0.10.1}/codejury/sources/diff.py

@@ -3,7 +3,8 @@
 Splits on ``diff --git`` headers (falling back to a single section for a plain
 diff with no git header). The path is taken from the +++ line, then the ---
 line, then the header -- skipping /dev/null so adds and deletes still resolve to
-the real file.
+the real file. Combined/merge diffs (``diff --cc``) are not split and would fold
+into the preceding section; the intended input is an ordinary two-way PR diff.
 """
 
 from __future__ import annotations

{codejury-0.10.0 → codejury-0.10.1}/codejury/sources/function.py

@@ -1,8 +1,10 @@
 """FunctionSource -- split Python source into one CodeArtifact per function.
 
-Parses the AST and emits an artifact for every function and method (including
-async and nested ones), in source order. Good for deeply auditing one handler at
-a time. The content must be valid Python; a parse failure raises SyntaxError.
+Parses the AST and emits an artifact for every top-level function and method
+(async included), in source order. Functions nested inside another function are
+skipped: their source already lives inside the enclosing function's artifact, so
+emitting them again would send the model overlapping, duplicated content. The
+content must be valid Python; a parse failure raises SyntaxError.
 """
 
 from __future__ import annotations
@@ -23,6 +25,7 @@ class FunctionSource(Source):
         functions = [
             node for node in ast.walk(tree) if isinstance(node, (ast.FunctionDef, ast.AsyncFunctionDef))
         ]
+        functions = [n for n in functions if not _nested_in_function(n, functions)]
         functions.sort(key=lambda n: n.lineno)
 
         artifacts = []
@@ -33,3 +36,9 @@ class FunctionSource(Source):
                     CodeArtifact(kind="function", path=f"{self._path}::{node.name}", content=segment)
                 )
         return artifacts
+
+
+def _nested_in_function(node: ast.AST, functions: list[ast.AST]) -> bool:
+    """True if ``node`` is defined inside another function (a method in a class is
+    not -- its enclosing scope is the class, not a function)."""
+    return any(other is not node and any(d is node for d in ast.walk(other)) for other in functions)