codejury 0.14.6__tar.gz → 0.14.7__tar.gz

{codejury-0.14.6 → codejury-0.14.7}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codejury
-Version: 0.14.6
+Version: 0.14.7
 Summary: AI code security review: an adversarial diff-audit engine and an agent-driven whole-repo review methodology, with security knowledge as rich rules
 Author: AISecLabs
 License-Expression: MIT
@@ -34,8 +34,9 @@ Dynamic: license-file
 AI code security review, in two paths matched to their nature:
 
 - **Diff review** (coded): audit a pull request's diff for newly introduced,
-  exploitable risks. A single balanced LLM call, or an adversarial
-  Finder/Challenger/Judge pass for higher coverage and fewer false positives.
+  exploitable risks. A single balanced LLM call (the default), or an adversarial
+  Finder/Challenger/Judge pass that trades roughly 3x the cost for extra recall
+  on subtle, cross-cutting flaws.
 - **Whole-repo review** (agent-driven): a methodology an interactive agent
   (Claude Code, Codex) runs to traverse a codebase from its API entrypoints,
   verify issues with a real PoC, and iterate over rounds with a persistent
@@ -65,7 +66,7 @@ codejury review diff --repo /path/to/app --git-range origin/main...HEAD
 # from stdin
 git diff HEAD~1 | codejury review diff
 
-# adversarial mode: Finder + Challenger + Judge (higher coverage, lower FP, ~3x cost)
+# adversarial mode: Finder + Challenger + Judge (extra recall on subtle flaws, ~3x cost)
 codejury review diff --diff-file changes.diff --mode adversarial
 
 # CI gate + SARIF
@@ -77,6 +78,35 @@ Configure a backend with `--provider`/`--model`/`--api-key`/`--api-base` or the
 `codejury review diff --dry-run` exercises the engine with a mock provider and
 no key (it uses a built-in demo diff when you do not pass one).
 
+### Choosing a model and mode
+
+Detection quality is dominated by the model first, then the mode. On real-diff
+probes:
+
+- A strong model (Claude Sonnet tier) in **standard** mode caught every planted
+  vulnerability with near-zero false positives. A weaker model raised false
+  positives in both modes, so the model is the lever that matters most.
+- **Adversarial** mode did not lower false positives over standard on those
+  probes and costs ~3x. Reach for it for extra recall on subtle, cross-file
+  logic, not as a false-positive reducer.
+
+Default to **standard mode with a strong model** (set it with `--model` or
+`CODEJURY_MODEL`). False positives are held down by the do-not-report list and
+the post-filter, not by the mode.
+
+### Use in CI (GitHub Actions)
+
+Audit every pull request and surface findings in the code scanning tab. Copy
+[`examples/codejury-pr-review.yml`](examples/codejury-pr-review.yml) into
+`.github/workflows/`, add a `CODEJURY_API_KEY` repo secret, and it will:
+
+1. diff the PR against its base (`--git-range origin/<base>...HEAD`),
+2. write SARIF and upload it with `github/codeql-action/upload-sarif`,
+3. fail the check on a HIGH or CRITICAL finding (`--fail-on high`).
+
+The job makes one model call per PR (standard mode); the SARIF is uploaded even
+when the gate fails, so findings always show up on the PR.
+
 ## Whole-repo review
 
 ```bash

{codejury-0.14.6 → codejury-0.14.7}/README.md

@@ -3,8 +3,9 @@
 AI code security review, in two paths matched to their nature:
 
 - **Diff review** (coded): audit a pull request's diff for newly introduced,
-  exploitable risks. A single balanced LLM call, or an adversarial
-  Finder/Challenger/Judge pass for higher coverage and fewer false positives.
+  exploitable risks. A single balanced LLM call (the default), or an adversarial
+  Finder/Challenger/Judge pass that trades roughly 3x the cost for extra recall
+  on subtle, cross-cutting flaws.
 - **Whole-repo review** (agent-driven): a methodology an interactive agent
   (Claude Code, Codex) runs to traverse a codebase from its API entrypoints,
   verify issues with a real PoC, and iterate over rounds with a persistent
@@ -34,7 +35,7 @@ codejury review diff --repo /path/to/app --git-range origin/main...HEAD
 # from stdin
 git diff HEAD~1 | codejury review diff
 
-# adversarial mode: Finder + Challenger + Judge (higher coverage, lower FP, ~3x cost)
+# adversarial mode: Finder + Challenger + Judge (extra recall on subtle flaws, ~3x cost)
 codejury review diff --diff-file changes.diff --mode adversarial
 
 # CI gate + SARIF
@@ -46,6 +47,35 @@ Configure a backend with `--provider`/`--model`/`--api-key`/`--api-base` or the
 `codejury review diff --dry-run` exercises the engine with a mock provider and
 no key (it uses a built-in demo diff when you do not pass one).
 
+### Choosing a model and mode
+
+Detection quality is dominated by the model first, then the mode. On real-diff
+probes:
+
+- A strong model (Claude Sonnet tier) in **standard** mode caught every planted
+  vulnerability with near-zero false positives. A weaker model raised false
+  positives in both modes, so the model is the lever that matters most.
+- **Adversarial** mode did not lower false positives over standard on those
+  probes and costs ~3x. Reach for it for extra recall on subtle, cross-file
+  logic, not as a false-positive reducer.
+
+Default to **standard mode with a strong model** (set it with `--model` or
+`CODEJURY_MODEL`). False positives are held down by the do-not-report list and
+the post-filter, not by the mode.
+
+### Use in CI (GitHub Actions)
+
+Audit every pull request and surface findings in the code scanning tab. Copy
+[`examples/codejury-pr-review.yml`](examples/codejury-pr-review.yml) into
+`.github/workflows/`, add a `CODEJURY_API_KEY` repo secret, and it will:
+
+1. diff the PR against its base (`--git-range origin/<base>...HEAD`),
+2. write SARIF and upload it with `github/codeql-action/upload-sarif`,
+3. fail the check on a HIGH or CRITICAL finding (`--fail-on high`).
+
+The job makes one model call per PR (standard mode); the SARIF is uploaded even
+when the gate fails, so findings always show up on the PR.
+
 ## Whole-repo review
 
 ```bash

{codejury-0.14.6 → codejury-0.14.7}/codejury/repo/model.py

@@ -245,10 +245,18 @@ def _method(decorator_name: str, call: ast.Call | None, rule: str) -> str:
 
 def _view_name(call: ast.Call) -> str:
     # Django path("route", view): the view is the second positional argument
-    if len(call.args) >= 2:
-        view = call.args[1]
-        if isinstance(view, ast.Name):
-            return view.id
-        if isinstance(view, ast.Attribute):
-            return view.attr
+    if len(call.args) < 2:
+        return ""
+    view = call.args[1]
+    if isinstance(view, ast.Name):
+        return view.id
+    if isinstance(view, ast.Attribute):
+        return view.attr
+    # class-based view: SomeView.as_view() / views.SomeView.as_view() -> class name
+    if isinstance(view, ast.Call) and isinstance(view.func, ast.Attribute) and view.func.attr == "as_view":
+        target = view.func.value
+        if isinstance(target, ast.Name):
+            return target.id
+        if isinstance(target, ast.Attribute):
+            return target.attr
     return ""

{codejury-0.14.6 → codejury-0.14.7}/codejury.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codejury
-Version: 0.14.6
+Version: 0.14.7
 Summary: AI code security review: an adversarial diff-audit engine and an agent-driven whole-repo review methodology, with security knowledge as rich rules
 Author: AISecLabs
 License-Expression: MIT
@@ -34,8 +34,9 @@ Dynamic: license-file
 AI code security review, in two paths matched to their nature:
 
 - **Diff review** (coded): audit a pull request's diff for newly introduced,
-  exploitable risks. A single balanced LLM call, or an adversarial
-  Finder/Challenger/Judge pass for higher coverage and fewer false positives.
+  exploitable risks. A single balanced LLM call (the default), or an adversarial
+  Finder/Challenger/Judge pass that trades roughly 3x the cost for extra recall
+  on subtle, cross-cutting flaws.
 - **Whole-repo review** (agent-driven): a methodology an interactive agent
   (Claude Code, Codex) runs to traverse a codebase from its API entrypoints,
   verify issues with a real PoC, and iterate over rounds with a persistent
@@ -65,7 +66,7 @@ codejury review diff --repo /path/to/app --git-range origin/main...HEAD
 # from stdin
 git diff HEAD~1 | codejury review diff
 
-# adversarial mode: Finder + Challenger + Judge (higher coverage, lower FP, ~3x cost)
+# adversarial mode: Finder + Challenger + Judge (extra recall on subtle flaws, ~3x cost)
 codejury review diff --diff-file changes.diff --mode adversarial
 
 # CI gate + SARIF
@@ -77,6 +78,35 @@ Configure a backend with `--provider`/`--model`/`--api-key`/`--api-base` or the
 `codejury review diff --dry-run` exercises the engine with a mock provider and
 no key (it uses a built-in demo diff when you do not pass one).
 
+### Choosing a model and mode
+
+Detection quality is dominated by the model first, then the mode. On real-diff
+probes:
+
+- A strong model (Claude Sonnet tier) in **standard** mode caught every planted
+  vulnerability with near-zero false positives. A weaker model raised false
+  positives in both modes, so the model is the lever that matters most.
+- **Adversarial** mode did not lower false positives over standard on those
+  probes and costs ~3x. Reach for it for extra recall on subtle, cross-file
+  logic, not as a false-positive reducer.
+
+Default to **standard mode with a strong model** (set it with `--model` or
+`CODEJURY_MODEL`). False positives are held down by the do-not-report list and
+the post-filter, not by the mode.
+
+### Use in CI (GitHub Actions)
+
+Audit every pull request and surface findings in the code scanning tab. Copy
+[`examples/codejury-pr-review.yml`](examples/codejury-pr-review.yml) into
+`.github/workflows/`, add a `CODEJURY_API_KEY` repo secret, and it will:
+
+1. diff the PR against its base (`--git-range origin/<base>...HEAD`),
+2. write SARIF and upload it with `github/codeql-action/upload-sarif`,
+3. fail the check on a HIGH or CRITICAL finding (`--fail-on high`).
+
+The job makes one model call per PR (standard mode); the SARIF is uploaded even
+when the gate fails, so findings always show up on the PR.
+
 ## Whole-repo review
 
 ```bash

{codejury-0.14.6 → codejury-0.14.7}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "codejury"
-version = "0.14.6"
+version = "0.14.7"
 description = "AI code security review: an adversarial diff-audit engine and an agent-driven whole-repo review methodology, with security knowledge as rich rules"
 readme = "README.md"
 requires-python = ">=3.12"

{codejury-0.14.6 → codejury-0.14.7}/tests/test_repo_model.py

@@ -59,7 +59,8 @@ urlpatterns = [
 ]
 '''
 
-# include() mounts and class-based views resolve to no handler function: noise
+# include() to a module not in the tree resolves to no file: dropped.
+# class-based views resolve to the view class name.
 DJANGO_NOISE = '''
 from django.urls import path, include
 from .views import DashboardView
@@ -69,6 +70,7 @@ urlpatterns = [
     path("accounts/", include("allauth.urls")),
     path("profile/", views.profile),
     path("dash/", DashboardView.as_view()),
+    path("admin-panel/", views.AdminView.as_view()),
 ]
 '''
 
@@ -163,12 +165,16 @@ def test_django_include_mounts_subroutes_under_prefix():
     assert all(e.route != "users" for e in model.entrypoints)
 
 
-def test_django_include_and_cbv_with_no_resolvable_function_are_dropped():
-    # include() mounts and an unresolved .as_view() carry no handler function;
-    # only the plain function-based view survives, no empty `- -` noise entries
+def test_django_unresolvable_include_dropped_and_cbv_resolved():
+    # include() whose module is not in the tree resolves to no file and is dropped;
+    # class-based views resolve to the view class name (both Name and views.Attr forms)
     model = _model({"urls.py": DJANGO_NOISE})
-    assert _routes(model) == {("http", "django", "profile", "profile/", "")}
-    assert all(e.function for e in model.entrypoints)
+    assert _routes(model) == {
+        ("http", "django", "profile", "profile/", ""),
+        ("http", "django", "DashboardView", "dash/", ""),
+        ("http", "django", "AdminView", "admin-panel/", ""),
+    }
+    assert all(e.function for e in model.entrypoints)  # no empty `- -` noise entries
 
 
 def test_plain_module_has_no_entrypoints():