codejury 0.14.2__tar.gz → 0.14.4__tar.gz

{codejury-0.14.2 → codejury-0.14.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codejury
-Version: 0.14.2
+Version: 0.14.4
 Summary: AI code security review: an adversarial diff-audit engine and an agent-driven whole-repo review methodology, with security knowledge as rich rules
 Author: AISecLabs
 License-Expression: MIT

{codejury-0.14.2 → codejury-0.14.4}/codejury/diff/debate.py

@@ -56,6 +56,28 @@ def _dedup(items: list[dict]) -> list[dict]:
     return out
 
 
+_DISMISS_VERDICTS = frozenset({"dismiss", "dismissed", "false_positive", "reject", "rejected"})
+
+
+def _loc(d: dict) -> str:
+    line = d.get("line")
+    return f"{d.get('file')}:{line}" if line else str(d.get("file") or "")
+
+
+def _apply_dismissals(findings: list[dict], rebuttals: list[dict]) -> list[dict]:
+    """Drop findings the challenger dismissed. The challenger is recall-safe (it
+    dismisses only when the diff shows a safe pattern: a parameterized query,
+    basename, an allowlist, shell=False), so honoring its dismissals is sound even
+    when the judge is unavailable."""
+    dismissed = {
+        str(r.get("target")) for r in rebuttals
+        if str(r.get("verdict", "")).strip().lower() in _DISMISS_VERDICTS
+    }
+    if not dismissed:
+        return findings
+    return [f for f in findings if _loc(f) not in dismissed and str(f.get("file") or "") not in dismissed]
+
+
 class AdversarialAuditRunner:
     def __init__(
         self,
@@ -116,16 +138,19 @@ class AdversarialAuditRunner:
             rebuttals = _dicts(challenger.get("rebuttals"))
             new_findings = _dicts(challenger.get("new_findings"))
 
-            verdict, judge_ok = self._ask(
-                JUDGE_SYSTEM,
-                judge_prompt(diff, finder_findings, rebuttals, new_findings, context=context),
-                self._judge_model,
-            )
+            jp = judge_prompt(diff, finder_findings, rebuttals, new_findings, context=context)
+            verdict, judge_ok = self._ask(JUDGE_SYSTEM, jp, self._judge_model)
+            if not judge_ok:
+                # the judge is the filter that controls false positives, and an
+                # unusable reply is often transient (a flaky proxy, a blocked
+                # request); re-ask once before giving up on it
+                verdict, judge_ok = self._ask(JUDGE_SYSTEM, jp, self._judge_model)
             if not judge_ok:
-                # the judge reply was unusable (provider error, blocked request,
-                # prose): do not let that silently drop the candidate findings;
-                # fall back to the unjudged finder + challenger set, flagged degraded
-                fallback = _dedup(finder_findings + new_findings)
+                # judge still unusable: degrade, but apply the recall-safe
+                # challenger's dismissals so a transient judge outage does not pass
+                # through findings the challenger already showed are safe (this is
+                # what otherwise inflates false positives in degraded runs)
+                fallback = _dedup(_apply_dismissals(finder_findings, rebuttals) + new_findings)
                 judged = AdversarialResult(findings=findings_from_list(fallback), rounds=rounds, degraded=True)
                 degraded = True
                 break

{codejury-0.14.2 → codejury-0.14.4}/codejury/repo/model.py

@@ -86,7 +86,10 @@ def build_repo_model(root: str | Path, files: dict[str, str], *, signatures: _Si
             tree = ast.parse(content)
         except SyntaxError:
             continue
-        entrypoints.extend(_entrypoints_in(path, tree, sigs))
+        # an entrypoint must name a reviewable handler function; drop entries
+        # with no resolvable function (a Django include() mount, or a view the
+        # AST scan cannot resolve) so the seeded inventory stays clean
+        entrypoints.extend(e for e in _entrypoints_in(path, tree, sigs) if e.function)
     return RepoModel(root=str(root), files=tuple(sorted(files)), entrypoints=tuple(entrypoints))
 
 

{codejury-0.14.2 → codejury-0.14.4}/codejury.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codejury
-Version: 0.14.2
+Version: 0.14.4
 Summary: AI code security review: an adversarial diff-audit engine and an agent-driven whole-repo review methodology, with security knowledge as rich rules
 Author: AISecLabs
 License-Expression: MIT

{codejury-0.14.2 → codejury-0.14.4}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "codejury"
-version = "0.14.2"
+version = "0.14.4"
 description = "AI code security review: an adversarial diff-audit engine and an agent-driven whole-repo review methodology, with security knowledge as rich rules"
 readme = "README.md"
 requires-python = ">=3.12"

{codejury-0.14.2 → codejury-0.14.4}/tests/test_diff_debate.py

@@ -156,6 +156,29 @@ def test_provider_exception_degrades_rather_than_crashes():
     assert out.degraded is True
 
 
+def test_judge_retry_recovers_from_a_transient_unusable_reply():
+    # the judge's first reply is unusable, the retry succeeds: not degraded,
+    # and the judge verdict is applied normally
+    _, out = _run([_finder([_VULN]), _challenger(), "blocked by waf", _judge([_VULN])], max_rounds=1)
+    assert out.degraded is False
+    assert [f.category for f in out.findings] == ["sql_injection"]
+
+
+def test_degraded_fallback_drops_challenger_dismissed_findings():
+    # judge stays unusable (both the call and its retry); the degraded fallback
+    # must still honor the challenger's recall-safe dismissals rather than pass
+    # every finder finding through, which is what inflates false positives
+    second = {**_VULN, "line": 5, "category": "xss"}
+    _, out = _run(
+        [_finder([_VULN, second]),
+         _challenger(rebuttals=[{"target": "app.py:5", "verdict": "dismiss", "reason": "output is escaped"}]),
+         "blocked", "blocked"],   # judge call + its one retry both unusable
+        max_rounds=1,
+    )
+    assert out.degraded is True
+    assert [f.category for f in out.findings] == ["sql_injection"]   # the dismissed xss at app.py:5 is dropped
+
+
 def test_per_role_models_are_used():
     provider = MockProvider(responses=[_finder([]), _challenger(), _judge([])], default="{}")
     AdversarialAuditRunner(

{codejury-0.14.2 → codejury-0.14.4}/tests/test_repo_model.py

@@ -59,6 +59,19 @@ urlpatterns = [
 ]
 '''
 
+# include() mounts and class-based views resolve to no handler function: noise
+DJANGO_NOISE = '''
+from django.urls import path, include
+from .views import DashboardView
+
+urlpatterns = [
+    path("", include("app.urls")),
+    path("accounts/", include("allauth.urls")),
+    path("profile/", views.profile),
+    path("dash/", DashboardView.as_view()),
+]
+'''
+
 PLAIN = '''
 def helper(x):
     return x + 1
@@ -102,6 +115,14 @@ def test_django_path_calls_capture_view_and_route():
     }
 
 
+def test_django_include_and_cbv_with_no_resolvable_function_are_dropped():
+    # include() mounts and an unresolved .as_view() carry no handler function;
+    # only the plain function-based view survives, no empty `- -` noise entries
+    model = _model({"urls.py": DJANGO_NOISE})
+    assert _routes(model) == {("http", "django", "profile", "profile/", "")}
+    assert all(e.function for e in model.entrypoints)
+
+
 def test_plain_module_has_no_entrypoints():
     model = _model({"util.py": PLAIN})
     assert model.entrypoints == ()