codejury 0.13.3__tar.gz → 0.14.0__tar.gz

{codejury-0.13.3 → codejury-0.14.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codejury
-Version: 0.13.3
+Version: 0.14.0
 Summary: AI code security review: an adversarial diff-audit engine and an agent-driven whole-repo review methodology, with security knowledge as rich rules
 Author: AISecLabs
 License-Expression: MIT
@@ -57,29 +57,30 @@ pip install "codejury[anthropic]"    # or [openai] / [litellm] for a backend
 
 ```bash
 # audit a diff file
-codejury audit --diff-file changes.diff
+codejury review diff --diff-file changes.diff
 
 # audit a git range in a repo
-codejury audit --repo /path/to/app --git-range origin/main...HEAD
+codejury review diff --repo /path/to/app --git-range origin/main...HEAD
 
 # from stdin
-git diff HEAD~1 | codejury audit
+git diff HEAD~1 | codejury review diff
 
 # adversarial mode: Finder + Challenger + Judge (higher coverage, lower FP, ~3x cost)
-codejury audit --diff-file changes.diff --mode adversarial
+codejury review diff --diff-file changes.diff --mode adversarial
 
 # CI gate + SARIF
-codejury audit --diff-file changes.diff --format sarif --fail-on high
+codejury review diff --diff-file changes.diff --format sarif --fail-on high
 ```
 
 Configure a backend with `--provider`/`--model`/`--api-key`/`--api-base` or the
 `CODEJURY_API_KEY` / `CODEJURY_MODEL` / `CODEJURY_API_BASE` environment variables.
-`codejury dry-run` exercises the engine with a mock provider and no key.
+`codejury review diff --dry-run` exercises the engine with a mock provider and
+no key (it uses a built-in demo diff when you do not pass one).
 
 ## Whole-repo review
 
 ```bash
-codejury full-review /path/to/your/repo
+codejury review repo /path/to/your/repo
 ```
 
 This scaffolds a review workspace (`api/`, `issues/`, `analysis/`, and a

{codejury-0.13.3 → codejury-0.14.0}/README.md

@@ -26,29 +26,30 @@ pip install "codejury[anthropic]"    # or [openai] / [litellm] for a backend
 
 ```bash
 # audit a diff file
-codejury audit --diff-file changes.diff
+codejury review diff --diff-file changes.diff
 
 # audit a git range in a repo
-codejury audit --repo /path/to/app --git-range origin/main...HEAD
+codejury review diff --repo /path/to/app --git-range origin/main...HEAD
 
 # from stdin
-git diff HEAD~1 | codejury audit
+git diff HEAD~1 | codejury review diff
 
 # adversarial mode: Finder + Challenger + Judge (higher coverage, lower FP, ~3x cost)
-codejury audit --diff-file changes.diff --mode adversarial
+codejury review diff --diff-file changes.diff --mode adversarial
 
 # CI gate + SARIF
-codejury audit --diff-file changes.diff --format sarif --fail-on high
+codejury review diff --diff-file changes.diff --format sarif --fail-on high
 ```
 
 Configure a backend with `--provider`/`--model`/`--api-key`/`--api-base` or the
 `CODEJURY_API_KEY` / `CODEJURY_MODEL` / `CODEJURY_API_BASE` environment variables.
-`codejury dry-run` exercises the engine with a mock provider and no key.
+`codejury review diff --dry-run` exercises the engine with a mock provider and
+no key (it uses a built-in demo diff when you do not pass one).
 
 ## Whole-repo review
 
 ```bash
-codejury full-review /path/to/your/repo
+codejury review repo /path/to/your/repo
 ```
 
 This scaffolds a review workspace (`api/`, `issues/`, `analysis/`, and a

{codejury-0.13.3 → codejury-0.14.0}/codejury/cli.py

@@ -19,6 +19,7 @@ import sys
 
 import dataclasses
 
+from codejury import __version__
 from codejury.diff.debate import AdversarialAuditRunner
 from codejury.diff.engine import AuditRunner
 from codejury.diff.findings_filter import FindingsFilter
@@ -82,11 +83,13 @@ def audit_diff(
     finder_model: str | None = None,
     challenger_model: str | None = None,
     judge_model: str | None = None,
+    exclude_paths: tuple[str, ...] = (),
 ) -> tuple[list[Finding], list[tuple[Finding, str]]]:
     """Audit a diff and return (kept findings, dropped (finding, reason)).
 
     A diff over the size budget is audited one file at a time so it does not
-    overflow the context. Finding categories are normalized to the rule-id set."""
+    overflow the context. Finding categories are normalized to the rule-id set.
+    ``exclude_paths`` are operator-supplied path substrings to drop."""
     def _run_one(d: str) -> list[Finding]:
         if mode == "adversarial":
             return AdversarialAuditRunner(
@@ -104,7 +107,7 @@ def audit_diff(
     allowed = set(allowed_categories())
     findings = [dataclasses.replace(f, category=normalize_category(f.category, allowed)) for f in findings]
     if filter_findings:
-        return FindingsFilter().filter(findings)
+        return FindingsFilter(exclude_paths=exclude_paths).filter(findings)
     return findings, []
 
 
@@ -124,54 +127,82 @@ def _dry_run_diff() -> str:
     return "+++ b/app.py\n@@ -0,0 +1 @@\n+cursor.execute('SELECT * FROM u WHERE n=' + name)\n"
 
 
+# canned reply for `review diff --dry-run`: a mock provider returns this so the
+# pipeline runs end to end with no key and no backend call
+_MOCK_REPLY = (
+    '{"findings": [{"file": "app.py", "line": 1, "severity": "HIGH", '
+    '"category": "sql_injection", "description": "[mock] no backend called", '
+    '"confidence": 0.9}]}'
+)
+
+
+def _add_audit_args(p) -> None:
+    """The diff-audit flags for `review diff`."""
+    p.add_argument("--diff-file", default=None, help="unified diff file (default: read stdin)")
+    p.add_argument("--repo", default=None, help="repo path for --git-range")
+    p.add_argument("--git-range", default=None, help="git range to diff, e.g. origin/main...HEAD")
+    p.add_argument("--dry-run", action="store_true",
+                   help="run the engine with a mock provider and no key (a built-in demo diff if none is given)")
+    p.add_argument("--exclude", action="append", default=None, metavar="PATH",
+                   help="drop findings whose file path contains this substring (repeatable)")
+    p.add_argument("--mode", choices=("standard", "adversarial"), default="standard")
+    p.add_argument("--rounds", type=int, default=3, help="adversarial only: debate rounds")
+    p.add_argument("--provider", choices=PROVIDERS, default="anthropic")
+    p.add_argument("--model", default=DEFAULT_MODEL)
+    p.add_argument("--finder-model", default=DEFAULT_FINDER_MODEL, help="adversarial only: finder role model (default: --model)")
+    p.add_argument("--challenger-model", default=DEFAULT_CHALLENGER_MODEL, help="adversarial only: challenger role model")
+    p.add_argument("--judge-model", default=DEFAULT_JUDGE_MODEL, help="adversarial only: judge role model")
+    p.add_argument("--api-base", default=DEFAULT_API_BASE)
+    p.add_argument("--api-key", default=DEFAULT_API_KEY)
+    p.add_argument("--retries", type=int, default=2, help="provider retry attempts on transient failure")
+    p.add_argument("--format", choices=_FORMATS, default="text", dest="fmt")
+    p.add_argument("--no-filter", action="store_true", help="skip the false-positive filter")
+    p.add_argument("--fail-on", choices=_FAIL_ON, default=None, dest="fail_on")
+
+
 def main(argv: list[str] | None = None) -> int:
     parser = argparse.ArgumentParser(prog="codejury")
+    parser.add_argument("--version", action="version", version=f"codejury {__version__}")
     sub = parser.add_subparsers(dest="command")
 
-    sub.add_parser("dry-run", help="run the diff engine with a mock provider, no key")
-
-    a = sub.add_parser("audit", help="audit a unified diff for security findings")
-    a.add_argument("--diff-file", default=None, help="unified diff file (default: read stdin)")
-    a.add_argument("--repo", default=None, help="repo path for --git-range")
-    a.add_argument("--git-range", default=None, help="git range to diff, e.g. origin/main...HEAD")
-    a.add_argument("--mode", choices=("standard", "adversarial"), default="standard")
-    a.add_argument("--rounds", type=int, default=3, help="adversarial debate rounds")
-    a.add_argument("--provider", choices=PROVIDERS, default="anthropic")
-    a.add_argument("--model", default=DEFAULT_MODEL)
-    a.add_argument("--finder-model", default=DEFAULT_FINDER_MODEL, help="adversarial: finder role model (default: --model)")
-    a.add_argument("--challenger-model", default=DEFAULT_CHALLENGER_MODEL, help="adversarial: challenger role model")
-    a.add_argument("--judge-model", default=DEFAULT_JUDGE_MODEL, help="adversarial: judge role model")
-    a.add_argument("--api-base", default=DEFAULT_API_BASE)
-    a.add_argument("--api-key", default=DEFAULT_API_KEY)
-    a.add_argument("--retries", type=int, default=2, help="provider retry attempts on transient failure")
-    a.add_argument("--format", choices=_FORMATS, default="text", dest="fmt")
-    a.add_argument("--no-filter", action="store_true", help="skip the false-positive filter")
-    a.add_argument("--fail-on", choices=_FAIL_ON, default=None, dest="fail_on")
-
-    fr = sub.add_parser("full-review", help="scaffold a whole-repo review for an interactive agent")
-    fr.add_argument("directory", help="target repository to review")
-    fr.add_argument("--workspace", default="codejury-review", help="where to create the review workspace")
+    review = sub.add_parser("review", help="review code for security findings")
+    rsub = review.add_subparsers(dest="scope")
+    _add_audit_args(rsub.add_parser("diff", help="audit a unified diff (the coded engine)"))
+    repo = rsub.add_parser("repo", help="scaffold a whole-repo review for an interactive agent")
+    repo.add_argument("directory", help="target repository to review")
+    repo.add_argument("--workspace", default="codejury-review", help="where to create the review workspace")
 
     args = parser.parse_args(argv)
     try:
         return _dispatch(args, parser)
     except Exception as exc:
-        print(f"{args.command or 'codejury'} failed: {exc}", file=sys.stderr)
+        label = getattr(args, "command", None) or "codejury"
+        print(f"{label} failed: {exc}", file=sys.stderr)
         return 1
 
 
 def _dispatch(args, parser) -> int:
-    if args.command == "audit":
-        provider = make_provider(args.provider, api_key=args.api_key, api_base=args.api_base, retries=args.retries)
+    scope = getattr(args, "scope", None)
+    if args.command == "review" and scope == "diff":
+        if args.dry_run:
+            provider = MockProvider(default=_MOCK_REPLY)
+            model = "mock"
+            # zero-config smoke test: fall back to a built-in demo diff when none is supplied
+            diff = _read_diff(args) if (args.diff_file or args.git_range) else _dry_run_diff()
+        else:
+            provider = make_provider(args.provider, api_key=args.api_key, api_base=args.api_base, retries=args.retries)
+            model = args.model
+            diff = _read_diff(args)
         kept, _ = audit_diff(
-            _read_diff(args), provider=provider, model=args.model,
+            diff, provider=provider, model=model,
             mode=args.mode, max_rounds=args.rounds, filter_findings=not args.no_filter,
             finder_model=args.finder_model, challenger_model=args.challenger_model, judge_model=args.judge_model,
+            exclude_paths=tuple(args.exclude or ()),
         )
         print(render(args.fmt, kept))
         return 1 if gate(kept, args.fail_on) else 0
 
-    if args.command == "full-review":
+    if args.command == "review" and scope == "repo":
         res = scaffold(args.directory, args.workspace)
         print(f"Workspace: {res.workspace}", file=sys.stderr)
         print(f"Seeded {res.entrypoints} entrypoints into {res.workspace}/api/_entrypoints.md", file=sys.stderr)
@@ -180,16 +211,11 @@ def _dispatch(args, parser) -> int:
         print(res.methodology)
         return 0
 
-    if args.command in (None, "dry-run"):
-        kept, _ = audit_diff(
-            _dry_run_diff(),
-            provider=MockProvider(default='{"findings": [{"file": "app.py", "line": 1, "severity": "HIGH", '
-                                          '"category": "sql_injection", "description": "[mock] no backend called", '
-                                          '"confidence": 0.9}]}'),
-            model="mock",
-        )
-        print(render("text", kept))
-        return 0
+    if args.command == "review":  # no scope given
+        print("usage: codejury review {diff,repo} ...", file=sys.stderr)
+        print("  diff   audit a unified diff for security findings", file=sys.stderr)
+        print("  repo   scaffold a whole-repo review for an interactive agent", file=sys.stderr)
+        return 1
 
     parser.print_help()
     return 1

{codejury-0.13.3 → codejury-0.14.0}/codejury.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codejury
-Version: 0.13.3
+Version: 0.14.0
 Summary: AI code security review: an adversarial diff-audit engine and an agent-driven whole-repo review methodology, with security knowledge as rich rules
 Author: AISecLabs
 License-Expression: MIT
@@ -57,29 +57,30 @@ pip install "codejury[anthropic]"    # or [openai] / [litellm] for a backend
 
 ```bash
 # audit a diff file
-codejury audit --diff-file changes.diff
+codejury review diff --diff-file changes.diff
 
 # audit a git range in a repo
-codejury audit --repo /path/to/app --git-range origin/main...HEAD
+codejury review diff --repo /path/to/app --git-range origin/main...HEAD
 
 # from stdin
-git diff HEAD~1 | codejury audit
+git diff HEAD~1 | codejury review diff
 
 # adversarial mode: Finder + Challenger + Judge (higher coverage, lower FP, ~3x cost)
-codejury audit --diff-file changes.diff --mode adversarial
+codejury review diff --diff-file changes.diff --mode adversarial
 
 # CI gate + SARIF
-codejury audit --diff-file changes.diff --format sarif --fail-on high
+codejury review diff --diff-file changes.diff --format sarif --fail-on high
 ```
 
 Configure a backend with `--provider`/`--model`/`--api-key`/`--api-base` or the
 `CODEJURY_API_KEY` / `CODEJURY_MODEL` / `CODEJURY_API_BASE` environment variables.
-`codejury dry-run` exercises the engine with a mock provider and no key.
+`codejury review diff --dry-run` exercises the engine with a mock provider and
+no key (it uses a built-in demo diff when you do not pass one).
 
 ## Whole-repo review
 
 ```bash
-codejury full-review /path/to/your/repo
+codejury review repo /path/to/your/repo
 ```
 
 This scaffolds a review workspace (`api/`, `issues/`, `analysis/`, and a

{codejury-0.13.3 → codejury-0.14.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "codejury"
-version = "0.13.3"
+version = "0.14.0"
 description = "AI code security review: an adversarial diff-audit engine and an agent-driven whole-repo review methodology, with security knowledge as rich rules"
 readme = "README.md"
 requires-python = ">=3.12"

{codejury-0.13.3 → codejury-0.14.0}/tests/test_cli_audit.py

@@ -5,7 +5,9 @@ big PR does not overflow the model context and silently truncate the reply; the
 per-file findings are then de-duplicated.
 """
 
-from codejury.cli import _dedup_findings, _split_diff_by_file, audit_diff
+import pytest
+
+from codejury.cli import _dedup_findings, _split_diff_by_file, audit_diff, main
 from codejury.domain.finding import Finding
 from codejury.providers.mock import MockProvider
 
@@ -43,3 +45,39 @@ def test_large_diff_is_audited_per_file(monkeypatch):
     assert len(provider.calls) == 2
     # category normalized onto the rule-id set
     assert all(f.category == "sql-injection" for f in kept)
+
+
+def test_audit_diff_honors_exclude_paths():
+    resp = ('{"findings": [{"file": "vendor/lib.py", "line": 1, "severity": "HIGH", '
+            '"category": "sql_injection", "description": "x", "confidence": 0.9}]}')
+    kept, dropped = audit_diff(
+        _FILE_A, provider=MockProvider(default=resp), model="mock", exclude_paths=("vendor/",)
+    )
+    assert kept == [] and dropped and "excluded path" in dropped[0][1]
+
+
+# --- CLI surface ---
+
+def test_version_flag_exits_zero(capsys):
+    with pytest.raises(SystemExit) as exc:
+        main(["--version"])
+    assert exc.value.code == 0
+    assert "codejury" in capsys.readouterr().out
+
+
+def test_review_diff_dry_run_is_zero_config(capsys):
+    # no diff input, no key: the built-in demo diff runs through the mock provider
+    rc = main(["review", "diff", "--dry-run"])
+    assert rc == 0
+    assert "sql-injection" in capsys.readouterr().out
+
+
+def test_review_diff_dry_run_respects_exclude(capsys):
+    rc = main(["review", "diff", "--dry-run", "--exclude", "app.py"])
+    assert rc == 0
+    assert "no findings" in capsys.readouterr().out
+
+
+def test_old_audit_command_is_gone(capsys):
+    with pytest.raises(SystemExit):   # argparse rejects the removed command
+        main(["audit", "--dry-run"])