codejury 0.10.6__tar.gz → 0.12.0__tar.gz

codejury-0.12.0/PKG-INFO

@@ -0,0 +1,102 @@
+Metadata-Version: 2.4
+Name: codejury
+Version: 0.12.0
+Summary: AI code security review: an adversarial diff-audit engine and an agent-driven whole-repo review methodology, with security knowledge as rich rules
+Author: AISecLabs
+License-Expression: MIT
+Project-URL: Homepage, https://github.com/aiseclabs/codejury
+Project-URL: Repository, https://github.com/aiseclabs/codejury
+Keywords: security,appsec,static analysis,llm,owasp,asvs,code review
+Classifier: Development Status :: 4 - Beta
+Classifier: Intended Audience :: Developers
+Classifier: Topic :: Security
+Classifier: Topic :: Software Development :: Quality Assurance
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Operating System :: OS Independent
+Requires-Python: >=3.12
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: pyyaml>=6.0
+Provides-Extra: anthropic
+Requires-Dist: anthropic>=0.40; extra == "anthropic"
+Provides-Extra: openai
+Requires-Dist: openai>=1.0; extra == "openai"
+Provides-Extra: litellm
+Requires-Dist: litellm>=1.0; extra == "litellm"
+Provides-Extra: dev
+Requires-Dist: pytest>=8.0; extra == "dev"
+Requires-Dist: jsonschema>=4.0; extra == "dev"
+Dynamic: license-file
+
+# codejury
+
+AI code security review, in two paths matched to their nature:
+
+- **Diff review** (coded): audit a pull request's diff for newly introduced,
+  exploitable risks. A single balanced LLM call, or an adversarial
+  Finder/Challenger/Judge pass for higher coverage and fewer false positives.
+- **Whole-repo review** (agent-driven): a methodology an interactive agent
+  (Claude Code, Codex) runs to traverse a codebase from its API entrypoints,
+  verify issues with a real PoC, and iterate over rounds with a persistent
+  memory. Too large for a single LLM call, so codejury ships the methodology and
+  scaffolds the workspace rather than running a pipeline.
+
+Security knowledge lives in **rich rules** (`codejury/data/rules/*.md`, with
+per-language vulnerable/secure examples), injected into the audit prompt, not
+buried in code.
+
+## Install
+
+```bash
+pip install codejury                 # core
+pip install "codejury[anthropic]"    # or [openai] / [litellm] for a backend
+```
+
+## Diff review
+
+```bash
+# audit a diff file
+codejury audit --diff-file changes.diff
+
+# audit a git range in a repo
+codejury audit --repo /path/to/app --git-range origin/main...HEAD
+
+# from stdin
+git diff HEAD~1 | codejury audit
+
+# adversarial mode: Finder + Challenger + Judge (higher coverage, lower FP, ~3x cost)
+codejury audit --diff-file changes.diff --mode adversarial
+
+# CI gate + SARIF
+codejury audit --diff-file changes.diff --format sarif --fail-on high
+```
+
+Configure a backend with `--provider`/`--model`/`--api-key`/`--api-base` or the
+`CODEJURY_API_KEY` / `CODEJURY_MODEL` / `CODEJURY_API_BASE` environment variables.
+`codejury dry-run` exercises the engine with a mock provider and no key.
+
+## Whole-repo review
+
+```bash
+codejury full-review /path/to/your/repo
+```
+
+This scaffolds a review workspace (`api/`, `issues/`, `analysis/`, and a
+`security-review-memory.md`), seeds the API inventory from a deterministic scan,
+and prints the methodology. Run it with an interactive agent: it reads the
+methodology and the rules, traverses the code from its API entrypoints, records
+high-confidence issues with a PoC, and asks you to confirm credentials or false
+positives along the way. Nothing runs against production.
+
+## Findings
+
+Each finding carries a file and line, a severity and category, a concrete
+exploit scenario, a recommendation, and a confidence. A false-positive filter
+drops test/mock-path and low-confidence noise; the model is also told not to
+report dependency CVEs, style notes, speculation, or config-leak-only risks.
+
+## Extending
+
+Add a vulnerability class by dropping a new `codejury/data/rules/<class>.md` with
+the standard frontmatter (title, impact, tags, triggers) and vulnerable/secure
+examples. It is data; no code change needed.

codejury-0.12.0/README.md

@@ -0,0 +1,72 @@
+# codejury
+
+AI code security review, in two paths matched to their nature:
+
+- **Diff review** (coded): audit a pull request's diff for newly introduced,
+  exploitable risks. A single balanced LLM call, or an adversarial
+  Finder/Challenger/Judge pass for higher coverage and fewer false positives.
+- **Whole-repo review** (agent-driven): a methodology an interactive agent
+  (Claude Code, Codex) runs to traverse a codebase from its API entrypoints,
+  verify issues with a real PoC, and iterate over rounds with a persistent
+  memory. Too large for a single LLM call, so codejury ships the methodology and
+  scaffolds the workspace rather than running a pipeline.
+
+Security knowledge lives in **rich rules** (`codejury/data/rules/*.md`, with
+per-language vulnerable/secure examples), injected into the audit prompt, not
+buried in code.
+
+## Install
+
+```bash
+pip install codejury                 # core
+pip install "codejury[anthropic]"    # or [openai] / [litellm] for a backend
+```
+
+## Diff review
+
+```bash
+# audit a diff file
+codejury audit --diff-file changes.diff
+
+# audit a git range in a repo
+codejury audit --repo /path/to/app --git-range origin/main...HEAD
+
+# from stdin
+git diff HEAD~1 | codejury audit
+
+# adversarial mode: Finder + Challenger + Judge (higher coverage, lower FP, ~3x cost)
+codejury audit --diff-file changes.diff --mode adversarial
+
+# CI gate + SARIF
+codejury audit --diff-file changes.diff --format sarif --fail-on high
+```
+
+Configure a backend with `--provider`/`--model`/`--api-key`/`--api-base` or the
+`CODEJURY_API_KEY` / `CODEJURY_MODEL` / `CODEJURY_API_BASE` environment variables.
+`codejury dry-run` exercises the engine with a mock provider and no key.
+
+## Whole-repo review
+
+```bash
+codejury full-review /path/to/your/repo
+```
+
+This scaffolds a review workspace (`api/`, `issues/`, `analysis/`, and a
+`security-review-memory.md`), seeds the API inventory from a deterministic scan,
+and prints the methodology. Run it with an interactive agent: it reads the
+methodology and the rules, traverses the code from its API entrypoints, records
+high-confidence issues with a PoC, and asks you to confirm credentials or false
+positives along the way. Nothing runs against production.
+
+## Findings
+
+Each finding carries a file and line, a severity and category, a concrete
+exploit scenario, a recommendation, and a confidence. A false-positive filter
+drops test/mock-path and low-confidence noise; the model is also told not to
+report dependency CVEs, style notes, speculation, or config-leak-only risks.
+
+## Extending
+
+Add a vulnerability class by dropping a new `codejury/data/rules/<class>.md` with
+the standard frontmatter (title, impact, tags, triggers) and vulnerable/secure
+examples. It is data; no code change needed.

codejury-0.12.0/codejury/__init__.py

@@ -0,0 +1,14 @@
+"""codejury: an AI code security review tool.
+
+Two paths matched to their nature: a coded diff-audit engine (standard single
+call or adversarial Finder/Challenger/Judge), and a whole-repo review run as a
+methodology by an interactive agent. Security knowledge lives in rich markdown
+rules (data/rules) injected into the audit prompt, not in a rendered schema.
+"""
+
+from importlib.metadata import PackageNotFoundError, version
+
+try:
+    __version__ = version("codejury")
+except PackageNotFoundError:  # running from a source tree without an install
+    __version__ = "0.0.0"

codejury-0.12.0/codejury/analysis/repo_model.py

@@ -0,0 +1,180 @@
+"""RepoModel (P6-01): a deterministic, AST-built map of a repository.
+
+The first stage of a whole-repo audit. Before any model call, this records what
+the repo is: its files and its entrypoints, the functions where external input
+arrives (HTTP routes, CLI commands). Later stages review the API surface (P6-02)
+and trace attack paths (P6-03) on top of it.
+
+Entrypoint signatures live in data, ``data/entrypoints.yaml``, so a new framework
+is added without touching this analyzer. Detection is pure AST, no model call, so
+the model is deterministic and cacheable.
+"""
+
+from __future__ import annotations
+
+import ast
+from dataclasses import dataclass
+from pathlib import Path
+
+import yaml
+
+from codejury.resources import ENTRYPOINTS_FILE
+
+
+@dataclass(frozen=True, kw_only=True)
+class Entrypoint:
+    file: str
+    line: int
+    function: str
+    kind: str            # "http" or "cli"
+    framework: str
+    route: str = ""
+    method: str = ""
+
+
+@dataclass(frozen=True, kw_only=True)
+class RepoModel:
+    root: str
+    files: tuple[str, ...]
+    entrypoints: tuple[Entrypoint, ...]
+
+
+@dataclass(frozen=True)
+class _Signatures:
+    decorators: tuple[dict, ...]
+    calls: tuple[dict, ...]
+
+
+def load_entrypoint_signatures(path: str | Path = ENTRYPOINTS_FILE) -> _Signatures:
+    with open(path, encoding="utf-8") as f:
+        data = yaml.safe_load(f) or {}
+    return _Signatures(decorators=tuple(data.get("decorators", [])), calls=tuple(data.get("calls", [])))
+
+
+_SKIP_DIRS = frozenset({".git", ".venv", "venv", "node_modules", "__pycache__", ".mypy_cache", ".pytest_cache"})
+
+
+def _read_python_files(root: Path) -> dict[str, str]:
+    """{relative path: content} for .py files under root, skipping noise dirs and
+    symlinks that escape the tree."""
+    root = root.resolve()
+    files: dict[str, str] = {}
+    for path in root.rglob("*.py"):
+        rel = path.relative_to(root)
+        if any(part in _SKIP_DIRS for part in rel.parts):
+            continue
+        try:
+            if not path.resolve().is_relative_to(root):
+                continue  # symlink escaping the tree
+            files[str(rel)] = path.read_text(encoding="utf-8")
+        except (OSError, UnicodeDecodeError, ValueError):
+            continue
+    return files
+
+
+def build_repo_model_from_dir(root: str | Path, *, signatures: _Signatures | None = None) -> RepoModel:
+    """Build a RepoModel by reading the .py files under a directory."""
+    return build_repo_model(root, _read_python_files(Path(root)), signatures=signatures)
+
+
+def build_repo_model(root: str | Path, files: dict[str, str], *, signatures: _Signatures | None = None) -> RepoModel:
+    """Build a RepoModel from {path: content}. Files that do not parse are skipped."""
+    sigs = signatures or load_entrypoint_signatures()
+    entrypoints: list[Entrypoint] = []
+    for path, content in sorted(files.items()):
+        try:
+            tree = ast.parse(content)
+        except SyntaxError:
+            continue
+        entrypoints.extend(_entrypoints_in(path, tree, sigs))
+    return RepoModel(root=str(root), files=tuple(sorted(files)), entrypoints=tuple(entrypoints))
+
+
+def _entrypoints_in(path: str, tree: ast.Module, sigs: _Signatures) -> list[Entrypoint]:
+    out: list[Entrypoint] = []
+    for node in ast.walk(tree):
+        if isinstance(node, (ast.FunctionDef, ast.AsyncFunctionDef)):
+            for dec in node.decorator_list:
+                ep = _decorator_entrypoint(path, node, dec, sigs.decorators)
+                if ep is not None:
+                    out.append(ep)
+        elif isinstance(node, ast.Call):
+            ep = _call_entrypoint(path, node, sigs.calls)
+            if ep is not None:
+                out.append(ep)
+    return out
+
+
+def _decorator_name(dec: ast.AST) -> str | None:
+    func = dec.func if isinstance(dec, ast.Call) else dec
+    if isinstance(func, ast.Attribute):
+        return func.attr
+    if isinstance(func, ast.Name):
+        return func.id
+    return None
+
+
+def _decorator_entrypoint(path, func, dec, deco_sigs) -> Entrypoint | None:
+    name = _decorator_name(dec)
+    if name is None:
+        return None
+    sig = next((s for s in deco_sigs if name in s["names"]), None)
+    if sig is None:
+        return None
+    call = dec if isinstance(dec, ast.Call) else None
+    return Entrypoint(
+        file=path,
+        line=func.lineno,
+        function=func.name,
+        kind=sig["kind"],
+        framework=sig["framework"],
+        route=_first_str_arg(call) if call else "",
+        method=_method(name, call, sig.get("method", "")),
+    )
+
+
+def _call_entrypoint(path, call, call_sigs) -> Entrypoint | None:
+    name = call.func.attr if isinstance(call.func, ast.Attribute) else (
+        call.func.id if isinstance(call.func, ast.Name) else None
+    )
+    sig = next((s for s in call_sigs if name in s["names"]), None)
+    if sig is None:
+        return None
+    return Entrypoint(
+        file=path,
+        line=call.lineno,
+        function=_view_name(call),
+        kind=sig["kind"],
+        framework=sig["framework"],
+        route=_first_str_arg(call),
+    )
+
+
+def _first_str_arg(call: ast.Call) -> str:
+    if call.args and isinstance(call.args[0], ast.Constant) and isinstance(call.args[0].value, str):
+        return call.args[0].value
+    return ""
+
+
+def _method(decorator_name: str, call: ast.Call | None, rule: str) -> str:
+    if rule == "name":
+        return decorator_name.upper()
+    if rule == "kwarg:methods" and call is not None:
+        for kw in call.keywords:
+            if kw.arg == "methods" and isinstance(kw.value, (ast.List, ast.Tuple)):
+                methods = [e.value for e in kw.value.elts if isinstance(e, ast.Constant) and isinstance(e.value, str)]
+                if methods:
+                    return ",".join(methods)
+        return "GET"  # the framework default when methods is omitted
+    return ""
+
+
+def _view_name(call: ast.Call) -> str:
+    # Django path("route", view): the view is the second positional argument
+    if len(call.args) >= 2:
+        view = call.args[1]
+        if isinstance(view, ast.Name):
+            return view.id
+        if isinstance(view, ast.Attribute):
+            return view.attr
+    return ""

codejury-0.12.0/codejury/cli.py

@@ -0,0 +1,142 @@
+"""codejury CLI.
+
+Two entry points matched to their nature:
+
+- ``audit`` runs the coded diff engine over a unified diff: a single balanced
+  call (standard) or the adversarial Finder/Challenger/Judge pass.
+- ``full-review`` scaffolds a workspace and prints the methodology for an
+  interactive agent to run a whole-repo review (it does not run an LLM pipeline,
+  which a single call cannot do for a whole codebase).
+
+``dry-run`` exercises the diff engine with a mock provider and no API key.
+"""
+
+from __future__ import annotations
+
+import argparse
+import subprocess
+import sys
+
+from codejury.diff.debate import AdversarialAuditRunner
+from codejury.diff.engine import AuditRunner
+from codejury.diff.findings_filter import FindingsFilter
+from codejury.diff.report import gate, render
+from codejury.domain.finding import Finding
+from codejury.fullreview.scaffold import scaffold
+from codejury.providers.factory import (
+    DEFAULT_API_BASE,
+    DEFAULT_API_KEY,
+    DEFAULT_MODEL,
+    PROVIDERS,
+    make_provider,
+)
+from codejury.providers.mock import MockProvider
+
+_FORMATS = ("text", "markdown", "json", "sarif")
+_FAIL_ON = ("critical", "high", "medium", "low")
+
+
+def audit_diff(
+    diff: str,
+    *,
+    provider,
+    model: str,
+    mode: str = "standard",
+    max_rounds: int = 3,
+    filter_findings: bool = True,
+) -> tuple[list[Finding], list[tuple[Finding, str]]]:
+    """Audit a diff and return (kept findings, dropped (finding, reason))."""
+    if mode == "adversarial":
+        findings = AdversarialAuditRunner(provider=provider, model=model).run(diff, max_rounds=max_rounds).findings
+    else:
+        findings = AuditRunner(provider=provider, model=model).run(diff)
+    if filter_findings:
+        return FindingsFilter().filter(findings)
+    return findings, []
+
+
+def _read_diff(args) -> str:
+    if args.diff_file:
+        with open(args.diff_file, encoding="utf-8") as f:
+            return f.read()
+    if args.git_range:
+        return subprocess.run(
+            ["git", "-C", args.repo or ".", "diff", args.git_range],
+            capture_output=True, text=True, check=True,
+        ).stdout
+    return sys.stdin.read()
+
+
+def _dry_run_diff() -> str:
+    return "+++ b/app.py\n@@ -0,0 +1 @@\n+cursor.execute('SELECT * FROM u WHERE n=' + name)\n"
+
+
+def main(argv: list[str] | None = None) -> int:
+    parser = argparse.ArgumentParser(prog="codejury")
+    sub = parser.add_subparsers(dest="command")
+
+    sub.add_parser("dry-run", help="run the diff engine with a mock provider, no key")
+
+    a = sub.add_parser("audit", help="audit a unified diff for security findings")
+    a.add_argument("--diff-file", default=None, help="unified diff file (default: read stdin)")
+    a.add_argument("--repo", default=None, help="repo path for --git-range")
+    a.add_argument("--git-range", default=None, help="git range to diff, e.g. origin/main...HEAD")
+    a.add_argument("--mode", choices=("standard", "adversarial"), default="standard")
+    a.add_argument("--rounds", type=int, default=3, help="adversarial debate rounds")
+    a.add_argument("--provider", choices=PROVIDERS, default="anthropic")
+    a.add_argument("--model", default=DEFAULT_MODEL)
+    a.add_argument("--api-base", default=DEFAULT_API_BASE)
+    a.add_argument("--api-key", default=DEFAULT_API_KEY)
+    a.add_argument("--retries", type=int, default=0)
+    a.add_argument("--format", choices=_FORMATS, default="text", dest="fmt")
+    a.add_argument("--no-filter", action="store_true", help="skip the false-positive filter")
+    a.add_argument("--fail-on", choices=_FAIL_ON, default=None, dest="fail_on")
+
+    fr = sub.add_parser("full-review", help="scaffold a whole-repo review for an interactive agent")
+    fr.add_argument("directory", help="target repository to review")
+    fr.add_argument("--workspace", default="codejury-review", help="where to create the review workspace")
+
+    args = parser.parse_args(argv)
+    try:
+        return _dispatch(args, parser)
+    except Exception as exc:
+        print(f"{args.command or 'codejury'} failed: {exc}", file=sys.stderr)
+        return 1
+
+
+def _dispatch(args, parser) -> int:
+    if args.command == "audit":
+        provider = make_provider(args.provider, api_key=args.api_key, api_base=args.api_base, retries=args.retries)
+        kept, _ = audit_diff(
+            _read_diff(args), provider=provider, model=args.model,
+            mode=args.mode, max_rounds=args.rounds, filter_findings=not args.no_filter,
+        )
+        print(render(args.fmt, kept))
+        return 1 if gate(kept, args.fail_on) else 0
+
+    if args.command == "full-review":
+        res = scaffold(args.directory, args.workspace)
+        print(f"Workspace: {res.workspace}", file=sys.stderr)
+        print(f"Seeded {res.entrypoints} entrypoints into {res.workspace}/api/_entrypoints.md", file=sys.stderr)
+        print(f"Memory: {res.memory_path}", file=sys.stderr)
+        print("\nRun this review with an interactive agent (Claude Code / Codex) using the methodology below.\n")
+        print(res.methodology)
+        return 0
+
+    if args.command in (None, "dry-run"):
+        kept, _ = audit_diff(
+            _dry_run_diff(),
+            provider=MockProvider(default='{"findings": [{"file": "app.py", "line": 1, "severity": "HIGH", '
+                                          '"category": "sql_injection", "description": "[mock] no backend called", '
+                                          '"confidence": 0.9}]}'),
+            model="mock",
+        )
+        print(render("text", kept))
+        return 0
+
+    parser.print_help()
+    return 1
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

codejury-0.12.0/codejury/data/agent/full-review.md

@@ -0,0 +1,102 @@
+# Full Security Review — Agent Methodology
+
+A whole-repository security audit, run by an interactive coding agent (Claude
+Code, Codex, etc.), not a one-shot LLM call. It traverses the codebase from its
+API entrypoints, reasons across files, verifies issues with a real PoC, and
+iterates over multiple rounds with a persistent memory. One round is roughly
+30 minutes; run as many rounds as needed.
+
+Target repository: the directory you were given.
+Workspace: `<workspace>/<project>/` (created for you), holding `api/`,
+`issues/`, `analysis/`, and `security-review-memory.md`.
+
+---
+
+## On start (do this first)
+
+1. Read `security-review-memory.md` in the workspace if it exists:
+   - skip every pattern under "Confirmed false positives";
+   - do not re-report anything under "Fixed";
+   - weight the files under "High-risk areas" more heavily.
+2. Read `api/_entrypoints.md` (seeded for you from a deterministic scan) as the
+   starting map of HTTP routes and CLI commands.
+3. Read the relevant rule files under the shipped `rules/` for the target's stack
+   (sql-injection, idor, ssrf, authentication-jwt, insecure-deserialization, ...).
+
+## Analysis
+
+Start from the API entrypoints and read the implementation of each one. For every
+endpoint ask:
+
+- What inputs can the attacker control?
+- Is authentication, authorization, signature verification, tenant isolation, or
+  a business-state check bypassed or missing?
+- IDOR: can a user reach another user's, tenant's, or service's resource by a
+  supplied id?
+- Do privileged operations (payment, signing, approval, state change) allow state
+  bypass or replay (no nonce / time window)?
+- Mass assignment: is a user-controlled body bound wholesale into a model?
+- Signature: is a caller-supplied key trusted as the trust anchor?
+
+Record the API inventory in `api/` (one file per module: route + auth method +
+review status ✅/⚠️/❌). Record architecture understanding and high-risk paths in
+`analysis/`.
+
+## Scope
+
+Report only HIGH / CRITICAL, exploitable, high-confidence issues. **Do not report**
+(regardless of severity): dependency CVEs, style or best-practice notes,
+speculative issues you cannot tie to a concrete exploit, and risks that only
+matter if production config is leaked.
+
+## Recording an issue
+
+Write one `issues/<name>.md` per confirmed issue. Do not write an issue you cannot
+confirm with high confidence. Each must have:
+
+```markdown
+# <title>
+
+- Risk: HIGH | CRITICAL
+- Type: IDOR | auth bypass | signature flaw | business logic | ...
+- Endpoint: `<METHOD> <path>`
+
+## Analysis
+(cite exact file paths and line numbers)
+
+## Attack path
+(end-to-end, actionable steps)
+
+## PoC
+(a curl command or script that actually triggers it)
+
+## Verification
+(result of actually running the PoC in a sandbox / dev environment)
+
+## Fix
+```
+
+## PoC verification (human in the loop)
+
+Confirm each issue by running the PoC against a sandbox / dev environment. When
+you need something only the operator has, stop and ask:
+
+- an auth cookie or token,
+- an MFA step,
+- specific test data or an account.
+
+Never run a PoC against production, and never use real credentials or perform a
+destructive action without the operator's explicit go-ahead.
+
+## Iteration
+
+Each round, read the workspace history first and do not repeat finished work.
+Process leftover TODOs; otherwise pick an unreviewed (❌) or to-deepen (⚠️)
+endpoint from the API inventory. When every endpoint is ✅ and there are no TODOs,
+report the review complete.
+
+## On finish
+
+Append a row to the audit history in `security-review-memory.md`, and ask the
+operator which findings were false positives. Record those under "Confirmed false
+positives" so future rounds skip them.

codejury-0.12.0/codejury/data/agent/security-review-memory.md

@@ -0,0 +1,30 @@
+# Security Review Memory — <project>
+
+> Maintained by the security-review agent. Read at the start of every round,
+> updated at the end. It skips confirmed false positives, avoids re-reporting
+> fixed issues, and focuses on historically risky areas.
+
+## Confirmed false positives (skip, do not report)
+
+<!-- FP-001 <short description>
+- Date: YYYY-MM-DD
+- Path/pattern: `tests/` or `apps/payment/mock_*.py`
+- Type: sql_injection / auth_bypass / ...
+- Why not a real issue: <reason>
+-->
+
+## Fixed (do not report again)
+
+<!-- FIXED-001 <issue title>
+- Date / commit: YYYY-MM-DD / abc1234
+- Original issue: <summary>
+-->
+
+## High-risk areas (weight every round)
+
+<!-- - `<path>` — <reason, e.g. past auth bypass> -->
+
+## Audit history
+
+| Date | Mode | HIGH | MEDIUM | Notes |
+|------|------|------|--------|-------|

codejury-0.12.0/codejury/data/entrypoints.yaml

@@ -0,0 +1,16 @@
+# Entrypoint signatures for the RepoModel (P6-01). Data, not code, so new
+# frameworks can be added without touching the analyzer.
+#
+# decorators: matched on the decorator's final attribute name, because the
+#   receiver varies (app, bp, router). method rule:
+#     name          the HTTP method is the decorator name, e.g. .get -> GET
+#     kwarg:methods  read the methods= keyword, default GET
+#     ""            no method, e.g. a CLI command
+# calls: module-level call forms that register a route, e.g. Django path("...", view).
+decorators:
+  - {kind: http, framework: flask,   names: [route],                          method: "kwarg:methods"}
+  - {kind: http, framework: fastapi, names: [get, post, put, delete, patch],  method: "name"}
+  - {kind: cli,  framework: click,   names: [command, group],                 method: ""}
+
+calls:
+  - {kind: http, framework: django,  names: [path, re_path, url]}