codejury 0.14.5__tar.gz → 0.14.7__tar.gz

{codejury-0.14.5 → codejury-0.14.7}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codejury
-Version: 0.14.5
+Version: 0.14.7
 Summary: AI code security review: an adversarial diff-audit engine and an agent-driven whole-repo review methodology, with security knowledge as rich rules
 Author: AISecLabs
 License-Expression: MIT
@@ -34,8 +34,9 @@ Dynamic: license-file
 AI code security review, in two paths matched to their nature:
 
 - **Diff review** (coded): audit a pull request's diff for newly introduced,
-  exploitable risks. A single balanced LLM call, or an adversarial
-  Finder/Challenger/Judge pass for higher coverage and fewer false positives.
+  exploitable risks. A single balanced LLM call (the default), or an adversarial
+  Finder/Challenger/Judge pass that trades roughly 3x the cost for extra recall
+  on subtle, cross-cutting flaws.
 - **Whole-repo review** (agent-driven): a methodology an interactive agent
   (Claude Code, Codex) runs to traverse a codebase from its API entrypoints,
   verify issues with a real PoC, and iterate over rounds with a persistent
@@ -65,7 +66,7 @@ codejury review diff --repo /path/to/app --git-range origin/main...HEAD
 # from stdin
 git diff HEAD~1 | codejury review diff
 
-# adversarial mode: Finder + Challenger + Judge (higher coverage, lower FP, ~3x cost)
+# adversarial mode: Finder + Challenger + Judge (extra recall on subtle flaws, ~3x cost)
 codejury review diff --diff-file changes.diff --mode adversarial
 
 # CI gate + SARIF
@@ -77,6 +78,35 @@ Configure a backend with `--provider`/`--model`/`--api-key`/`--api-base` or the
 `codejury review diff --dry-run` exercises the engine with a mock provider and
 no key (it uses a built-in demo diff when you do not pass one).
 
+### Choosing a model and mode
+
+Detection quality is dominated by the model first, then the mode. On real-diff
+probes:
+
+- A strong model (Claude Sonnet tier) in **standard** mode caught every planted
+  vulnerability with near-zero false positives. A weaker model raised false
+  positives in both modes, so the model is the lever that matters most.
+- **Adversarial** mode did not lower false positives over standard on those
+  probes and costs ~3x. Reach for it for extra recall on subtle, cross-file
+  logic, not as a false-positive reducer.
+
+Default to **standard mode with a strong model** (set it with `--model` or
+`CODEJURY_MODEL`). False positives are held down by the do-not-report list and
+the post-filter, not by the mode.
+
+### Use in CI (GitHub Actions)
+
+Audit every pull request and surface findings in the code scanning tab. Copy
+[`examples/codejury-pr-review.yml`](examples/codejury-pr-review.yml) into
+`.github/workflows/`, add a `CODEJURY_API_KEY` repo secret, and it will:
+
+1. diff the PR against its base (`--git-range origin/<base>...HEAD`),
+2. write SARIF and upload it with `github/codeql-action/upload-sarif`,
+3. fail the check on a HIGH or CRITICAL finding (`--fail-on high`).
+
+The job makes one model call per PR (standard mode); the SARIF is uploaded even
+when the gate fails, so findings always show up on the PR.
+
 ## Whole-repo review
 
 ```bash

{codejury-0.14.5 → codejury-0.14.7}/README.md

@@ -3,8 +3,9 @@
 AI code security review, in two paths matched to their nature:
 
 - **Diff review** (coded): audit a pull request's diff for newly introduced,
-  exploitable risks. A single balanced LLM call, or an adversarial
-  Finder/Challenger/Judge pass for higher coverage and fewer false positives.
+  exploitable risks. A single balanced LLM call (the default), or an adversarial
+  Finder/Challenger/Judge pass that trades roughly 3x the cost for extra recall
+  on subtle, cross-cutting flaws.
 - **Whole-repo review** (agent-driven): a methodology an interactive agent
   (Claude Code, Codex) runs to traverse a codebase from its API entrypoints,
   verify issues with a real PoC, and iterate over rounds with a persistent
@@ -34,7 +35,7 @@ codejury review diff --repo /path/to/app --git-range origin/main...HEAD
 # from stdin
 git diff HEAD~1 | codejury review diff
 
-# adversarial mode: Finder + Challenger + Judge (higher coverage, lower FP, ~3x cost)
+# adversarial mode: Finder + Challenger + Judge (extra recall on subtle flaws, ~3x cost)
 codejury review diff --diff-file changes.diff --mode adversarial
 
 # CI gate + SARIF
@@ -46,6 +47,35 @@ Configure a backend with `--provider`/`--model`/`--api-key`/`--api-base` or the
 `codejury review diff --dry-run` exercises the engine with a mock provider and
 no key (it uses a built-in demo diff when you do not pass one).
 
+### Choosing a model and mode
+
+Detection quality is dominated by the model first, then the mode. On real-diff
+probes:
+
+- A strong model (Claude Sonnet tier) in **standard** mode caught every planted
+  vulnerability with near-zero false positives. A weaker model raised false
+  positives in both modes, so the model is the lever that matters most.
+- **Adversarial** mode did not lower false positives over standard on those
+  probes and costs ~3x. Reach for it for extra recall on subtle, cross-file
+  logic, not as a false-positive reducer.
+
+Default to **standard mode with a strong model** (set it with `--model` or
+`CODEJURY_MODEL`). False positives are held down by the do-not-report list and
+the post-filter, not by the mode.
+
+### Use in CI (GitHub Actions)
+
+Audit every pull request and surface findings in the code scanning tab. Copy
+[`examples/codejury-pr-review.yml`](examples/codejury-pr-review.yml) into
+`.github/workflows/`, add a `CODEJURY_API_KEY` repo secret, and it will:
+
+1. diff the PR against its base (`--git-range origin/<base>...HEAD`),
+2. write SARIF and upload it with `github/codeql-action/upload-sarif`,
+3. fail the check on a HIGH or CRITICAL finding (`--fail-on high`).
+
+The job makes one model call per PR (standard mode); the SARIF is uploaded even
+when the gate fails, so findings always show up on the PR.
+
 ## Whole-repo review
 
 ```bash

{codejury-0.14.5 → codejury-0.14.7}/codejury/repo/model.py

@@ -80,31 +80,32 @@ def build_repo_model_from_dir(root: str | Path, *, signatures: _Signatures | Non
 def build_repo_model(root: str | Path, files: dict[str, str], *, signatures: _Signatures | None = None) -> RepoModel:
     """Build a RepoModel from {path: content}. Files that do not parse are skipped."""
     sigs = signatures or load_entrypoint_signatures()
-    entrypoints: list[Entrypoint] = []
+    asts: dict[str, ast.Module] = {}
     for path, content in sorted(files.items()):
         try:
-            tree = ast.parse(content)
+            asts[path] = ast.parse(content)
         except SyntaxError:
-            continue
-        # an entrypoint must name a reviewable handler function; drop entries
-        # with no resolvable function (a Django include() mount, or a view the
-        # AST scan cannot resolve) so the seeded inventory stays clean
-        entrypoints.extend(e for e in _entrypoints_in(path, tree, sigs) if e.function)
+            continue  # unparseable file is skipped, not fatal
+    entrypoints: list[Entrypoint] = []
+    for path, tree in asts.items():
+        entrypoints.extend(_decorator_entrypoints_in(path, tree, sigs.decorators))
+    # route-call entrypoints (Django path()): resolved across files so an
+    # include() mount contributes its sub-routes under the mount's prefix
+    entrypoints.extend(_route_call_entrypoints(asts, sigs.calls))
+    # an entrypoint must name a reviewable handler function; drop entries with no
+    # resolvable function (an unresolved view) so the seeded inventory stays clean
+    entrypoints = [e for e in entrypoints if e.function]
     return RepoModel(root=str(root), files=tuple(sorted(files)), entrypoints=tuple(entrypoints))
 
 
-def _entrypoints_in(path: str, tree: ast.Module, sigs: _Signatures) -> list[Entrypoint]:
+def _decorator_entrypoints_in(path: str, tree: ast.Module, deco_sigs) -> list[Entrypoint]:
     out: list[Entrypoint] = []
     for node in ast.walk(tree):
         if isinstance(node, (ast.FunctionDef, ast.AsyncFunctionDef)):
             for dec in node.decorator_list:
-                ep = _decorator_entrypoint(path, node, dec, sigs.decorators)
+                ep = _decorator_entrypoint(path, node, dec, deco_sigs)
                 if ep is not None:
                     out.append(ep)
-        elif isinstance(node, ast.Call):
-            ep = _call_entrypoint(path, node, sigs.calls)
-            if ep is not None:
-                out.append(ep)
     return out
 
 
@@ -136,21 +137,91 @@ def _decorator_entrypoint(path, func, dec, deco_sigs) -> Entrypoint | None:
     )
 
 
-def _call_entrypoint(path, call, call_sigs) -> Entrypoint | None:
-    name = call.func.attr if isinstance(call.func, ast.Attribute) else (
-        call.func.id if isinstance(call.func, ast.Name) else None
-    )
-    sig = next((s for s in call_sigs if name in s["names"]), None)
-    if sig is None:
+# names of the call that mounts a sub-urlconf (Django include()); a route call
+# whose view position is one of these recurses into the included module
+_INCLUDE_NAMES = frozenset({"include"})
+
+
+def _call_name(call: ast.Call) -> str | None:
+    f = call.func
+    if isinstance(f, ast.Attribute):
+        return f.attr
+    if isinstance(f, ast.Name):
+        return f.id
+    return None
+
+
+def _route_calls(tree: ast.Module, names: set[str]) -> list[ast.Call]:
+    return [n for n in ast.walk(tree) if isinstance(n, ast.Call) and _call_name(n) in names]
+
+
+def _include_module(call: ast.Call) -> str | None:
+    """If this route call mounts a sub-urlconf via include('a.b.urls'), return the
+    dotted module; else None. Handles include('mod') and include(('mod', 'ns'))."""
+    if len(call.args) < 2 or not isinstance(call.args[1], ast.Call):
         return None
-    return Entrypoint(
-        file=path,
-        line=call.lineno,
-        function=_view_name(call),
-        kind=sig["kind"],
-        framework=sig["framework"],
-        route=_first_str_arg(call),
-    )
+    inc = call.args[1]
+    if _call_name(inc) not in _INCLUDE_NAMES or not inc.args:
+        return None
+    a = inc.args[0]
+    if isinstance(a, ast.Constant) and isinstance(a.value, str):
+        return a.value
+    if isinstance(a, ast.Tuple) and a.elts and isinstance(a.elts[0], ast.Constant) and isinstance(a.elts[0].value, str):
+        return a.elts[0].value
+    return None
+
+
+def _module_to_file(module: str, files: set[str]) -> str | None:
+    """Resolve a dotted module ('app.urls') to a file in the repo, by exact path or
+    a suffix match (the dotted path may be rooted above the scanned tree)."""
+    candidate = module.replace(".", "/") + ".py"
+    if candidate in files:
+        return candidate
+    matches = sorted(f for f in files if f.endswith("/" + candidate))
+    return matches[0] if matches else None
+
+
+def _route_call_entrypoints(asts: dict[str, ast.Module], call_sigs) -> list[Entrypoint]:
+    if not call_sigs:
+        return []
+    names = {n for s in call_sigs for n in s["names"]}
+    sig_by_name = {n: s for s in call_sigs for n in s["names"]}
+    files = set(asts)
+
+    # files mounted by another file's include() are not roots; they are emitted
+    # only through the include chain, with the mount prefix, never standalone
+    mounted: set[str] = set()
+    for tree in asts.values():
+        for call in _route_calls(tree, names):
+            mod = _include_module(call)
+            target = _module_to_file(mod, files) if mod else None
+            if target:
+                mounted.add(target)
+
+    out: list[Entrypoint] = []
+    for path in sorted(asts):
+        if path not in mounted:
+            _emit_routes(path, "", asts, files, names, sig_by_name, {path}, out)
+    return out
+
+
+def _emit_routes(path, prefix, asts, files, names, sig_by_name, visited, out) -> None:
+    for call in _route_calls(asts[path], names):
+        seg = _first_str_arg(call)
+        mod = _include_module(call)
+        if mod:
+            target = _module_to_file(mod, files)
+            if target and target not in visited:
+                _emit_routes(target, prefix + seg, asts, files, names, sig_by_name, visited | {target}, out)
+            continue
+        view = _view_name(call)
+        if not view:
+            continue
+        sig = sig_by_name[_call_name(call)]
+        out.append(Entrypoint(
+            file=path, line=call.lineno, function=view,
+            kind=sig["kind"], framework=sig["framework"], route=prefix + seg,
+        ))
 
 
 def _first_str_arg(call: ast.Call) -> str:
@@ -174,10 +245,18 @@ def _method(decorator_name: str, call: ast.Call | None, rule: str) -> str:
 
 def _view_name(call: ast.Call) -> str:
     # Django path("route", view): the view is the second positional argument
-    if len(call.args) >= 2:
-        view = call.args[1]
-        if isinstance(view, ast.Name):
-            return view.id
-        if isinstance(view, ast.Attribute):
-            return view.attr
+    if len(call.args) < 2:
+        return ""
+    view = call.args[1]
+    if isinstance(view, ast.Name):
+        return view.id
+    if isinstance(view, ast.Attribute):
+        return view.attr
+    # class-based view: SomeView.as_view() / views.SomeView.as_view() -> class name
+    if isinstance(view, ast.Call) and isinstance(view.func, ast.Attribute) and view.func.attr == "as_view":
+        target = view.func.value
+        if isinstance(target, ast.Name):
+            return target.id
+        if isinstance(target, ast.Attribute):
+            return target.attr
     return ""

{codejury-0.14.5 → codejury-0.14.7}/codejury.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codejury
-Version: 0.14.5
+Version: 0.14.7
 Summary: AI code security review: an adversarial diff-audit engine and an agent-driven whole-repo review methodology, with security knowledge as rich rules
 Author: AISecLabs
 License-Expression: MIT
@@ -34,8 +34,9 @@ Dynamic: license-file
 AI code security review, in two paths matched to their nature:
 
 - **Diff review** (coded): audit a pull request's diff for newly introduced,
-  exploitable risks. A single balanced LLM call, or an adversarial
-  Finder/Challenger/Judge pass for higher coverage and fewer false positives.
+  exploitable risks. A single balanced LLM call (the default), or an adversarial
+  Finder/Challenger/Judge pass that trades roughly 3x the cost for extra recall
+  on subtle, cross-cutting flaws.
 - **Whole-repo review** (agent-driven): a methodology an interactive agent
   (Claude Code, Codex) runs to traverse a codebase from its API entrypoints,
   verify issues with a real PoC, and iterate over rounds with a persistent
@@ -65,7 +66,7 @@ codejury review diff --repo /path/to/app --git-range origin/main...HEAD
 # from stdin
 git diff HEAD~1 | codejury review diff
 
-# adversarial mode: Finder + Challenger + Judge (higher coverage, lower FP, ~3x cost)
+# adversarial mode: Finder + Challenger + Judge (extra recall on subtle flaws, ~3x cost)
 codejury review diff --diff-file changes.diff --mode adversarial
 
 # CI gate + SARIF
@@ -77,6 +78,35 @@ Configure a backend with `--provider`/`--model`/`--api-key`/`--api-base` or the
 `codejury review diff --dry-run` exercises the engine with a mock provider and
 no key (it uses a built-in demo diff when you do not pass one).
 
+### Choosing a model and mode
+
+Detection quality is dominated by the model first, then the mode. On real-diff
+probes:
+
+- A strong model (Claude Sonnet tier) in **standard** mode caught every planted
+  vulnerability with near-zero false positives. A weaker model raised false
+  positives in both modes, so the model is the lever that matters most.
+- **Adversarial** mode did not lower false positives over standard on those
+  probes and costs ~3x. Reach for it for extra recall on subtle, cross-file
+  logic, not as a false-positive reducer.
+
+Default to **standard mode with a strong model** (set it with `--model` or
+`CODEJURY_MODEL`). False positives are held down by the do-not-report list and
+the post-filter, not by the mode.
+
+### Use in CI (GitHub Actions)
+
+Audit every pull request and surface findings in the code scanning tab. Copy
+[`examples/codejury-pr-review.yml`](examples/codejury-pr-review.yml) into
+`.github/workflows/`, add a `CODEJURY_API_KEY` repo secret, and it will:
+
+1. diff the PR against its base (`--git-range origin/<base>...HEAD`),
+2. write SARIF and upload it with `github/codeql-action/upload-sarif`,
+3. fail the check on a HIGH or CRITICAL finding (`--fail-on high`).
+
+The job makes one model call per PR (standard mode); the SARIF is uploaded even
+when the gate fails, so findings always show up on the PR.
+
 ## Whole-repo review
 
 ```bash

{codejury-0.14.5 → codejury-0.14.7}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "codejury"
-version = "0.14.5"
+version = "0.14.7"
 description = "AI code security review: an adversarial diff-audit engine and an agent-driven whole-repo review methodology, with security knowledge as rich rules"
 readme = "README.md"
 requires-python = ">=3.12"

{codejury-0.14.5 → codejury-0.14.7}/tests/test_repo_model.py

@@ -59,7 +59,8 @@ urlpatterns = [
 ]
 '''
 
-# include() mounts and class-based views resolve to no handler function: noise
+# include() to a module not in the tree resolves to no file: dropped.
+# class-based views resolve to the view class name.
 DJANGO_NOISE = '''
 from django.urls import path, include
 from .views import DashboardView
@@ -69,6 +70,7 @@ urlpatterns = [
     path("accounts/", include("allauth.urls")),
     path("profile/", views.profile),
     path("dash/", DashboardView.as_view()),
+    path("admin-panel/", views.AdminView.as_view()),
 ]
 '''
 
@@ -115,12 +117,64 @@ def test_django_path_calls_capture_view_and_route():
     }
 
 
-def test_django_include_and_cbv_with_no_resolvable_function_are_dropped():
-    # include() mounts and an unresolved .as_view() carry no handler function;
-    # only the plain function-based view survives, no empty `- -` noise entries
+DJANGO_ROOT = '''
+from django.urls import path, include
+urlpatterns = [
+    path("", include("introduction.urls")),
+    path("api/", include("api.urls")),
+    path("health/", views.health),
+]
+'''
+DJANGO_INTRO = '''
+from django.urls import path
+from . import views
+urlpatterns = [
+    path("home/", views.home),
+    path("xss", views.xss),
+]
+'''
+DJANGO_API = '''
+from django.urls import path, include
+urlpatterns = [
+    path("v1/", include("api.v1.urls")),
+]
+'''
+DJANGO_API_V1 = '''
+from django.urls import path
+urlpatterns = [
+    path("users", views.users),
+]
+'''
+
+
+def test_django_include_mounts_subroutes_under_prefix():
+    model = _model({
+        "urls.py": DJANGO_ROOT,
+        "introduction/urls.py": DJANGO_INTRO,
+        "api/urls.py": DJANGO_API,
+        "api/v1/urls.py": DJANGO_API_V1,
+    })
+    routes = {(e.function, e.route) for e in model.entrypoints}
+    assert routes == {
+        ("health", "health/"),     # direct route on the root urlconf
+        ("home", "home/"),         # included at "" prefix
+        ("xss", "xss"),
+        ("users", "api/v1/users"),  # nested include: "api/" + "v1/" + "users"
+    }
+    # the included sub-urlconfs are not also emitted standalone (no bare "users")
+    assert all(e.route != "users" for e in model.entrypoints)
+
+
+def test_django_unresolvable_include_dropped_and_cbv_resolved():
+    # include() whose module is not in the tree resolves to no file and is dropped;
+    # class-based views resolve to the view class name (both Name and views.Attr forms)
     model = _model({"urls.py": DJANGO_NOISE})
-    assert _routes(model) == {("http", "django", "profile", "profile/", "")}
-    assert all(e.function for e in model.entrypoints)
+    assert _routes(model) == {
+        ("http", "django", "profile", "profile/", ""),
+        ("http", "django", "DashboardView", "dash/", ""),
+        ("http", "django", "AdminView", "admin-panel/", ""),
+    }
+    assert all(e.function for e in model.entrypoints)  # no empty `- -` noise entries
 
 
 def test_plain_module_has_no_entrypoints():