codejury 0.13.1__tar.gz → 0.13.3__tar.gz

{codejury-0.13.1 → codejury-0.13.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codejury
-Version: 0.13.1
+Version: 0.13.3
 Summary: AI code security review: an adversarial diff-audit engine and an agent-driven whole-repo review methodology, with security knowledge as rich rules
 Author: AISecLabs
 License-Expression: MIT

{codejury-0.13.1 → codejury-0.13.3}/codejury/diff/debate.py

@@ -79,12 +79,17 @@ class AdversarialAuditRunner:
         """Returns (parsed object, ok). ok is False when the response could not be
         parsed into a JSON object (a provider error page, a blocked request, prose),
         so the caller can avoid treating an unusable reply as an empty result."""
-        result = self._provider.complete(
-            system=system,
-            messages=[Message(role="user", content=prompt)],
-            model=model,
-            max_tokens=self._max_tokens,
-        )
+        try:
+            result = self._provider.complete(
+                system=system,
+                messages=[Message(role="user", content=prompt)],
+                model=model,
+                max_tokens=self._max_tokens,
+            )
+        except Exception:
+            # a provider error (exhausted retries, blank body, transport failure)
+            # is an unusable reply, not an empty result; degrade gracefully
+            return {}, False
         obj = extract_json_object(result.text)
         return (obj or {}), bool(obj)
 

{codejury-0.13.1 → codejury-0.13.3}/codejury/diff/engine.py

@@ -14,6 +14,16 @@ from codejury.infrastructure.json_parse import extract_json_object
 from codejury.providers.base import Message, Provider
 
 
+class AuditError(RuntimeError):
+    """The model reply could not be parsed into an audit result.
+
+    Raised instead of returning an empty findings list, so a failed or blank
+    call is never reported as a clean audit. The prompt requires a JSON object
+    carrying a ``findings`` key (an empty ``{"findings": []}`` when there is
+    nothing to report), so a reply that yields no object, or an object without
+    that key, is a failure, not a pass."""
+
+
 class AuditRunner:
     def __init__(self, *, provider: Provider, model: str, max_tokens: int = 4096) -> None:
         self._provider = provider
@@ -29,5 +39,11 @@ class AuditRunner:
             model=self._model,
             max_tokens=self._max_tokens,
         )
-        obj = extract_json_object(result.text) or {}
+        obj = extract_json_object(result.text)
+        if obj is None or "findings" not in obj:
+            raise AuditError(
+                "the model reply was not a valid audit result (no JSON object, or a "
+                "JSON object without a `findings` key); treating it as a failed "
+                "audit rather than a clean pass"
+            )
         return findings_from_list(obj.get("findings"))

{codejury-0.13.1 → codejury-0.13.3}/codejury/providers/retry.py

@@ -2,7 +2,10 @@
 
 Real model calls fail intermittently, for example on timeouts or rate limits.
 This decorator retries with linear backoff and re-raises the last error once
-attempts are exhausted. ``sleep`` is injectable so tests do not actually wait.
+attempts are exhausted. A 200 response with a blank body is treated as a
+transient failure and retried too, since an empty reply is unusable and must
+not be passed downstream as a clean (no-findings) result. ``sleep`` is
+injectable so tests do not actually wait.
 """
 
 from __future__ import annotations
@@ -13,6 +16,10 @@ from typing import Callable
 from codejury.providers.base import CompletionResult, Message, Provider
 
 
+class EmptyResponseError(RuntimeError):
+    """The provider returned a blank body on every attempt."""
+
+
 class RetryProvider(Provider):
     def __init__(
         self,
@@ -45,11 +52,18 @@ class RetryProvider(Provider):
     ) -> CompletionResult:
         for attempt in range(1, self._max_attempts + 1):
             try:
-                return self._inner.complete(
+                result = self._inner.complete(
                     system=system, messages=messages, model=model, max_tokens=max_tokens, cache=cache
                 )
             except self._retryable:
                 if attempt == self._max_attempts:
                     raise
                 self._sleep(self._base_delay * attempt)
+                continue
+            if result.text.strip():
+                return result
+            # 200 OK but blank body: a transient upstream hiccup, retry it
+            if attempt == self._max_attempts:
+                raise EmptyResponseError("provider returned a blank response after all attempts")
+            self._sleep(self._base_delay * attempt)
         raise AssertionError("unreachable")  # pragma: no cover

{codejury-0.13.1 → codejury-0.13.3}/codejury.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codejury
-Version: 0.13.1
+Version: 0.13.3
 Summary: AI code security review: an adversarial diff-audit engine and an agent-driven whole-repo review methodology, with security knowledge as rich rules
 Author: AISecLabs
 License-Expression: MIT

{codejury-0.13.1 → codejury-0.13.3}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "codejury"
-version = "0.13.1"
+version = "0.13.3"
 description = "AI code security review: an adversarial diff-audit engine and an agent-driven whole-repo review methodology, with security knowledge as rich rules"
 readme = "README.md"
 requires-python = ">=3.12"

{codejury-0.13.1 → codejury-0.13.3}/tests/test_diff_debate.py

@@ -134,6 +134,28 @@ def test_unusable_judge_includes_challenger_independent_findings():
     assert [f.category for f in out.findings] == ["idor"] and out.degraded is True
 
 
+def test_provider_exception_degrades_rather_than_crashes():
+    # a raising provider (exhausted retries, transport error) on the judge call
+    # must degrade to the unjudged finder set, not propagate and abort the run.
+    from codejury.providers.base import CompletionResult, Provider
+
+    class _RaiseOnJudge(Provider):
+        def __init__(self):
+            self.calls = 0
+
+        def complete(self, **kwargs):
+            self.calls += 1
+            if self.calls == 1:
+                return CompletionResult(text=_finder([_VULN]))
+            if self.calls == 2:
+                return CompletionResult(text=_challenger())
+            raise RuntimeError("provider down")
+
+    out = AdversarialAuditRunner(provider=_RaiseOnJudge(), model="m").run(_DIFF, max_rounds=1)
+    assert [f.category for f in out.findings] == ["sql_injection"]
+    assert out.degraded is True
+
+
 def test_per_role_models_are_used():
     provider = MockProvider(responses=[_finder([]), _challenger(), _judge([])], default="{}")
     AdversarialAuditRunner(

{codejury-0.13.1 → codejury-0.13.3}/tests/test_diff_engine.py

@@ -60,8 +60,28 @@ def test_engine_empty_on_no_findings():
     assert AuditRunner(provider=MockProvider(default='{"findings": []}'), model="m").run(_DIFF) == []
 
 
-def test_engine_tolerates_garbage_reply():
-    assert AuditRunner(provider=MockProvider(default="not json"), model="m").run(_DIFF) == []
+def test_engine_raises_on_unparseable_reply():
+    # an unusable reply (provider error page, blank body, prose) must not be
+    # reported as a clean audit; it is a failure
+    import pytest
+
+    from codejury.diff.engine import AuditError
+
+    with pytest.raises(AuditError):
+        AuditRunner(provider=MockProvider(default="not json"), model="m").run(_DIFF)
+    with pytest.raises(AuditError):
+        AuditRunner(provider=MockProvider(default=""), model="m").run(_DIFF)
+
+
+def test_engine_raises_on_wrong_shape_json():
+    # valid JSON but no `findings` key is a malformed reply, not a clean audit
+    import pytest
+
+    from codejury.diff.engine import AuditError
+
+    for bad in ("{}", '{"result": "ok"}'):
+        with pytest.raises(AuditError):
+            AuditRunner(provider=MockProvider(default=bad), model="m").run(_DIFF)
 
 
 def test_prompt_carries_diff_focus_and_do_not_report():

{codejury-0.13.1 → codejury-0.13.3}/tests/test_retry_provider.py

@@ -1,7 +1,7 @@
 import pytest
 
 from codejury.providers.base import CompletionResult, Message, Provider
-from codejury.providers.retry import RetryProvider
+from codejury.providers.retry import EmptyResponseError, RetryProvider
 
 
 class _Flaky(Provider):
@@ -47,3 +47,30 @@ def test_no_retry_on_first_success():
     )
     assert inner.calls == 1
     assert slept == []
+
+
+class _Blank(Provider):
+    """Returns a blank body `blank_times` times, then a real reply."""
+
+    def __init__(self, blank_times):
+        self._blank_times = blank_times
+        self.calls = 0
+
+    def complete(self, **kwargs):
+        self.calls += 1
+        return CompletionResult(text="" if self.calls <= self._blank_times else "ok")
+
+
+def test_retries_blank_body_then_succeeds():
+    inner = _Blank(blank_times=1)
+    provider = RetryProvider(inner, max_attempts=3, sleep=lambda _: None)
+    assert _call(provider).text == "ok"      # the blank 200 is retried, not passed through
+    assert inner.calls == 2
+
+
+def test_raises_when_body_blank_every_attempt():
+    inner = _Blank(blank_times=5)
+    provider = RetryProvider(inner, max_attempts=3, sleep=lambda _: None)
+    with pytest.raises(EmptyResponseError):
+        _call(provider)
+    assert inner.calls == 3