codejury 0.14.6__tar.gz → 0.15.0__tar.gz

{codejury-0.14.6 → codejury-0.15.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codejury
-Version: 0.14.6
+Version: 0.15.0
 Summary: AI code security review: an adversarial diff-audit engine and an agent-driven whole-repo review methodology, with security knowledge as rich rules
 Author: AISecLabs
 License-Expression: MIT
@@ -34,13 +34,14 @@ Dynamic: license-file
 AI code security review, in two paths matched to their nature:
 
 - **Diff review** (coded): audit a pull request's diff for newly introduced,
-  exploitable risks. A single balanced LLM call, or an adversarial
-  Finder/Challenger/Judge pass for higher coverage and fewer false positives.
+  exploitable risks. A single balanced LLM call (the default), or an adversarial
+  Finder/Challenger/Judge pass that trades roughly 3x the cost for extra recall
+  on subtle, cross-cutting flaws.
 - **Whole-repo review** (agent-driven): a methodology an interactive agent
-  (Claude Code, Codex) runs to traverse a codebase from its API entrypoints,
-  verify issues with a real PoC, and iterate over rounds with a persistent
-  memory. Too large for a single LLM call, so codejury ships the methodology and
-  scaffolds the workspace rather than running a pipeline.
+  (Claude Code, Codex) runs to map a codebase's attack surface, trace inputs to
+  sinks across files, verify issues with a real PoC, and iterate over rounds with
+  a persistent memory. Too large for a single LLM call, so codejury ships the
+  methodology and scaffolds the workspace rather than running a pipeline.
 
 Security knowledge lives in **rich rules** (`codejury/data/rules/*.md`, with
 per-language vulnerable/secure examples), injected into the audit prompt, not
@@ -65,7 +66,7 @@ codejury review diff --repo /path/to/app --git-range origin/main...HEAD
 # from stdin
 git diff HEAD~1 | codejury review diff
 
-# adversarial mode: Finder + Challenger + Judge (higher coverage, lower FP, ~3x cost)
+# adversarial mode: Finder + Challenger + Judge (extra recall on subtle flaws, ~3x cost)
 codejury review diff --diff-file changes.diff --mode adversarial
 
 # CI gate + SARIF
@@ -77,18 +78,48 @@ Configure a backend with `--provider`/`--model`/`--api-key`/`--api-base` or the
 `codejury review diff --dry-run` exercises the engine with a mock provider and
 no key (it uses a built-in demo diff when you do not pass one).
 
+### Choosing a model and mode
+
+Detection quality is dominated by the model first, then the mode. On real-diff
+probes:
+
+- A strong model (Claude Sonnet tier) in **standard** mode caught every planted
+  vulnerability with near-zero false positives. A weaker model raised false
+  positives in both modes, so the model is the lever that matters most.
+- **Adversarial** mode did not lower false positives over standard on those
+  probes and costs ~3x. Reach for it for extra recall on subtle, cross-file
+  logic, not as a false-positive reducer.
+
+Default to **standard mode with a strong model** (set it with `--model` or
+`CODEJURY_MODEL`). False positives are held down by the do-not-report list and
+the post-filter, not by the mode.
+
+### Use in CI (GitHub Actions)
+
+Audit every pull request and surface findings in the code scanning tab. Copy
+[`examples/codejury-pr-review.yml`](examples/codejury-pr-review.yml) into
+`.github/workflows/`, add a `CODEJURY_API_KEY` repo secret, and it will:
+
+1. diff the PR against its base (`--git-range origin/<base>...HEAD`),
+2. write SARIF and upload it with `github/codeql-action/upload-sarif`,
+3. fail the check on a HIGH or CRITICAL finding (`--fail-on high`).
+
+The job makes one model call per PR (standard mode); the SARIF is uploaded even
+when the gate fails, so findings always show up on the PR.
+
 ## Whole-repo review
 
 ```bash
 codejury review repo /path/to/your/repo
 ```
 
-This scaffolds a review workspace (`api/`, `issues/`, `analysis/`, and a
-`security-review-memory.md`), seeds the API inventory from a deterministic scan,
-and prints the methodology. Run it with an interactive agent: it reads the
-methodology and the rules, traverses the code from its API entrypoints, records
-high-confidence issues with a PoC, and asks you to confirm credentials or false
-positives along the way. Nothing runs against production.
+This scaffolds a review workspace (`entrypoints/`, `issues/`, `analysis/`, and a
+`security-review-memory.md`), seeds the entrypoint inventory from a
+deterministic scan, and prints the methodology. Run it with an interactive
+agent: it reads the methodology and the rules, maps the attack surface, traces
+inputs to sinks across files, records high-confidence issues with a PoC, and
+asks you to confirm credentials or false positives along the way. Nothing runs
+against production.
 
 ## Findings
 

codejury-0.15.0/README.md

@@ -0,0 +1,104 @@
+# codejury
+
+AI code security review, in two paths matched to their nature:
+
+- **Diff review** (coded): audit a pull request's diff for newly introduced,
+  exploitable risks. A single balanced LLM call (the default), or an adversarial
+  Finder/Challenger/Judge pass that trades roughly 3x the cost for extra recall
+  on subtle, cross-cutting flaws.
+- **Whole-repo review** (agent-driven): a methodology an interactive agent
+  (Claude Code, Codex) runs to map a codebase's attack surface, trace inputs to
+  sinks across files, verify issues with a real PoC, and iterate over rounds with
+  a persistent memory. Too large for a single LLM call, so codejury ships the
+  methodology and scaffolds the workspace rather than running a pipeline.
+
+Security knowledge lives in **rich rules** (`codejury/data/rules/*.md`, with
+per-language vulnerable/secure examples), injected into the audit prompt, not
+buried in code.
+
+## Install
+
+```bash
+pip install codejury                 # core
+pip install "codejury[anthropic]"    # or [openai] / [litellm] for a backend
+```
+
+## Diff review
+
+```bash
+# audit a diff file
+codejury review diff --diff-file changes.diff
+
+# audit a git range in a repo
+codejury review diff --repo /path/to/app --git-range origin/main...HEAD
+
+# from stdin
+git diff HEAD~1 | codejury review diff
+
+# adversarial mode: Finder + Challenger + Judge (extra recall on subtle flaws, ~3x cost)
+codejury review diff --diff-file changes.diff --mode adversarial
+
+# CI gate + SARIF
+codejury review diff --diff-file changes.diff --format sarif --fail-on high
+```
+
+Configure a backend with `--provider`/`--model`/`--api-key`/`--api-base` or the
+`CODEJURY_API_KEY` / `CODEJURY_MODEL` / `CODEJURY_API_BASE` environment variables.
+`codejury review diff --dry-run` exercises the engine with a mock provider and
+no key (it uses a built-in demo diff when you do not pass one).
+
+### Choosing a model and mode
+
+Detection quality is dominated by the model first, then the mode. On real-diff
+probes:
+
+- A strong model (Claude Sonnet tier) in **standard** mode caught every planted
+  vulnerability with near-zero false positives. A weaker model raised false
+  positives in both modes, so the model is the lever that matters most.
+- **Adversarial** mode did not lower false positives over standard on those
+  probes and costs ~3x. Reach for it for extra recall on subtle, cross-file
+  logic, not as a false-positive reducer.
+
+Default to **standard mode with a strong model** (set it with `--model` or
+`CODEJURY_MODEL`). False positives are held down by the do-not-report list and
+the post-filter, not by the mode.
+
+### Use in CI (GitHub Actions)
+
+Audit every pull request and surface findings in the code scanning tab. Copy
+[`examples/codejury-pr-review.yml`](examples/codejury-pr-review.yml) into
+`.github/workflows/`, add a `CODEJURY_API_KEY` repo secret, and it will:
+
+1. diff the PR against its base (`--git-range origin/<base>...HEAD`),
+2. write SARIF and upload it with `github/codeql-action/upload-sarif`,
+3. fail the check on a HIGH or CRITICAL finding (`--fail-on high`).
+
+The job makes one model call per PR (standard mode); the SARIF is uploaded even
+when the gate fails, so findings always show up on the PR.
+
+## Whole-repo review
+
+```bash
+codejury review repo /path/to/your/repo
+```
+
+This scaffolds a review workspace (`entrypoints/`, `issues/`, `analysis/`, and a
+`security-review-memory.md`), seeds the entrypoint inventory from a
+deterministic scan, and prints the methodology. Run it with an interactive
+agent: it reads the methodology and the rules, maps the attack surface, traces
+inputs to sinks across files, records high-confidence issues with a PoC, and
+asks you to confirm credentials or false positives along the way. Nothing runs
+against production.
+
+## Findings
+
+Each finding carries a file and line, a severity and category, a concrete
+exploit scenario, a recommendation, and a confidence. A false-positive filter
+drops test/mock-path and low-confidence noise; the model is also told not to
+report dependency CVEs, style notes, speculation, or config-leak-only risks.
+
+## Extending
+
+Add a vulnerability class by dropping a new `codejury/data/rules/<class>.md` with
+the standard frontmatter (title, impact, tags, triggers) and vulnerable/secure
+examples. It is data; no code change needed.

{codejury-0.14.6 → codejury-0.15.0}/codejury/cli.py

@@ -132,7 +132,7 @@ def _dispatch(args, parser) -> int:
     if args.command == "review" and scope == "repo":
         res = scaffold(args.directory, args.workspace)
         print(f"Workspace: {res.workspace}", file=sys.stderr)
-        print(f"Seeded {res.entrypoints} entrypoints into {res.workspace}/api/_entrypoints.md", file=sys.stderr)
+        print(f"Seeded {res.entrypoints} entrypoints into {res.workspace}/entrypoints/_entrypoints.md", file=sys.stderr)
         print(f"Memory: {res.memory_path}", file=sys.stderr)
         print("\nRun this review with an interactive agent (Claude Code / Codex) using the methodology below.\n")
         print(res.methodology)

codejury-0.14.6/codejury/data/agent/full-review.md → codejury-0.15.0/codejury/data/agent/repo-review.md

@@ -1,13 +1,13 @@
-# Full Security Review — Agent Methodology
+# Repo Security Review — Agent Methodology
 
-A whole-repository security audit, run by an interactive coding agent (Claude
-Code, Codex, etc.), not a one-shot LLM call. It maps the attack surface, traces
-inputs to sinks across files, verifies issues with a real PoC, and
-iterates over multiple rounds with a persistent memory. One round is roughly
-30 minutes; run as many rounds as needed.
+The `review repo` path: a whole-repository security audit, run by an interactive
+coding agent (Claude Code, Codex, etc.), not a one-shot LLM call. It maps the
+attack surface, traces inputs to sinks across files, verifies issues with a real
+PoC, and iterates over multiple rounds with a persistent memory. One round is
+roughly 30 minutes; run as many rounds as needed.
 
 Target repository: the directory you were given.
-Workspace: `<workspace>/<project>/` (created for you), holding `api/`,
+Workspace: `<workspace>/<project>/` (created for you), holding `entrypoints/`,
 `issues/`, `analysis/`, and `security-review-memory.md`.
 
 ---
@@ -18,9 +18,9 @@ Workspace: `<workspace>/<project>/` (created for you), holding `api/`,
    - skip every pattern under "Confirmed false positives";
    - do not re-report anything under "Fixed";
    - weight the files under "High-risk areas" more heavily.
-2. Read `api/_entrypoints.md` (seeded for you from a deterministic AST scan) as a
-   *starting* map of the attack surface. It lists HTTP routes and CLI commands
-   only, so it is a subset, not the whole surface (see "Map the attack surface").
+2. Read `entrypoints/_entrypoints.md` (seeded for you from a deterministic AST
+   scan) as a *starting* map of the attack surface. It lists HTTP routes and CLI
+   commands only, a subset, not the whole surface (see "Map the attack surface").
 3. Read the relevant rule files under the shipped `rules/` for the target's stack
    (sql-injection, idor, ssrf, authentication-jwt, insecure-deserialization, ...).
 
@@ -28,7 +28,7 @@ Workspace: `<workspace>/<project>/` (created for you), holding `api/`,
 
 The seeded inventory lists HTTP routes and CLI commands only. Before analysing,
 complete the surface: untrusted input enters at more than HTTP. Enumerate every
-source the attacker can influence and add it to `api/`:
+source the attacker can influence and add it to `entrypoints/`:
 
 - HTTP routes, GraphQL resolvers, gRPC / RPC handlers, WebSocket handlers;
 - CLI commands, scheduled jobs / cron, queue and topic consumers, webhooks and
@@ -40,8 +40,8 @@ source the attacker can influence and add it to `api/`:
   inter-service calls.
 
 `pickle.loads(cookie)` and `yaml.load(upload)` are entrypoints just as much as a
-route is. Record the inventory in `api/` (one file per module: source + auth
-method + review status ✅/⚠️/❌).
+route is. Record the inventory in `entrypoints/` (one file per module: source +
+auth method + review status ✅/⚠️/❌).
 
 ## Analyse each source
 

{codejury-0.14.6 → codejury-0.15.0}/codejury/data/rules/SKILL.md

@@ -8,7 +8,7 @@ description: "Application security rules for reviewing code for exploitable vuln
 Application-security rules, one file per weakness class under `rules/`, named by
 the specific weakness (CWE-style). Each rule states impact, the markers to hunt
 (`triggers`), and vulnerable-vs-secure examples. The diff-audit engine injects the
-rules relevant to a change into the prompt; the full-review agent reads them for
+rules relevant to a change into the prompt; the repo-review agent reads them for
 the target's stack. A finding's `category` is one of these ids.
 
 ## Rules by OWASP category

{codejury-0.14.6 → codejury-0.15.0}/codejury/repo/model.py

@@ -245,10 +245,18 @@ def _method(decorator_name: str, call: ast.Call | None, rule: str) -> str:
 
 def _view_name(call: ast.Call) -> str:
     # Django path("route", view): the view is the second positional argument
-    if len(call.args) >= 2:
-        view = call.args[1]
-        if isinstance(view, ast.Name):
-            return view.id
-        if isinstance(view, ast.Attribute):
-            return view.attr
+    if len(call.args) < 2:
+        return ""
+    view = call.args[1]
+    if isinstance(view, ast.Name):
+        return view.id
+    if isinstance(view, ast.Attribute):
+        return view.attr
+    # class-based view: SomeView.as_view() / views.SomeView.as_view() -> class name
+    if isinstance(view, ast.Call) and isinstance(view.func, ast.Attribute) and view.func.attr == "as_view":
+        target = view.func.value
+        if isinstance(target, ast.Name):
+            return target.id
+        if isinstance(target, ast.Attribute):
+            return target.attr
     return ""

{codejury-0.14.6 → codejury-0.15.0}/codejury/repo/scaffold.py

@@ -3,9 +3,9 @@
 The `review repo` path. Whole-repo review is too large for a single LLM call, so
 codejury does not run it as a pipeline. Instead it scaffolds a workspace for an
 interactive agent (Claude Code, Codex) and hands over the methodology: it creates
-the api/issues/analysis directories, copies the review-memory template, seeds the
-API inventory from a deterministic RepoModel scan, and returns the methodology
-text to print.
+the entrypoints/issues/analysis directories, copies the review-memory template,
+seeds the entrypoint inventory from a deterministic RepoModel scan, and returns
+the methodology text to print.
 """
 
 from __future__ import annotations
@@ -16,7 +16,7 @@ from pathlib import Path
 from codejury.repo.model import build_repo_model_from_dir
 from codejury.resources import AGENT_DIR
 
-_METHODOLOGY = AGENT_DIR / "full-review.md"
+_METHODOLOGY = AGENT_DIR / "repo-review.md"
 _MEMORY_TEMPLATE = AGENT_DIR / "security-review-memory.md"
 
 
@@ -33,7 +33,8 @@ class ScaffoldResult:
 def _entrypoints_md(model) -> str:
     http = [e for e in model.entrypoints if e.kind == "http"]
     cli = [e for e in model.entrypoints if e.kind == "cli"]
-    lines = ["# API Entrypoints (seeded from a deterministic scan)", "",
+    lines = ["# Entrypoints (seeded from a deterministic scan)", "",
+             "HTTP routes and CLI commands only; add non-HTTP sources here too.", "",
              "Status legend: ❌ not reviewed · ⚠️ to deepen · ✅ reviewed", ""]
     if http:
         lines += ["## HTTP routes", ""]
@@ -53,7 +54,7 @@ def scaffold(target: str | Path, workspace: str | Path) -> ScaffoldResult:
     project = target.name
     ws = Path(workspace) / project
     created: list[str] = []
-    for sub in ("api", "issues", "analysis"):
+    for sub in ("entrypoints", "issues", "analysis"):
         d = ws / sub
         if not d.exists():
             d.mkdir(parents=True, exist_ok=True)
@@ -66,7 +67,7 @@ def scaffold(target: str | Path, workspace: str | Path) -> ScaffoldResult:
         created.append(str(memory_path))
 
     model = build_repo_model_from_dir(target)
-    (ws / "api" / "_entrypoints.md").write_text(_entrypoints_md(model), encoding="utf-8")
+    (ws / "entrypoints" / "_entrypoints.md").write_text(_entrypoints_md(model), encoding="utf-8")
 
     return ScaffoldResult(
         project=project,

{codejury-0.14.6 → codejury-0.15.0}/codejury/resources.py

@@ -9,5 +9,5 @@ from pathlib import Path
 _DATA = Path(__file__).resolve().parent / "data"
 
 RULES_DIR = _DATA / "rules"            # security rules injected into the audit prompt
-AGENT_DIR = _DATA / "agent"            # full-review methodology and memory template
+AGENT_DIR = _DATA / "agent"            # repo-review methodology and memory template
 ENTRYPOINTS_FILE = _DATA / "entrypoints.yaml"  # framework signatures for RepoModel

{codejury-0.14.6 → codejury-0.15.0}/codejury.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codejury
-Version: 0.14.6
+Version: 0.15.0
 Summary: AI code security review: an adversarial diff-audit engine and an agent-driven whole-repo review methodology, with security knowledge as rich rules
 Author: AISecLabs
 License-Expression: MIT
@@ -34,13 +34,14 @@ Dynamic: license-file
 AI code security review, in two paths matched to their nature:
 
 - **Diff review** (coded): audit a pull request's diff for newly introduced,
-  exploitable risks. A single balanced LLM call, or an adversarial
-  Finder/Challenger/Judge pass for higher coverage and fewer false positives.
+  exploitable risks. A single balanced LLM call (the default), or an adversarial
+  Finder/Challenger/Judge pass that trades roughly 3x the cost for extra recall
+  on subtle, cross-cutting flaws.
 - **Whole-repo review** (agent-driven): a methodology an interactive agent
-  (Claude Code, Codex) runs to traverse a codebase from its API entrypoints,
-  verify issues with a real PoC, and iterate over rounds with a persistent
-  memory. Too large for a single LLM call, so codejury ships the methodology and
-  scaffolds the workspace rather than running a pipeline.
+  (Claude Code, Codex) runs to map a codebase's attack surface, trace inputs to
+  sinks across files, verify issues with a real PoC, and iterate over rounds with
+  a persistent memory. Too large for a single LLM call, so codejury ships the
+  methodology and scaffolds the workspace rather than running a pipeline.
 
 Security knowledge lives in **rich rules** (`codejury/data/rules/*.md`, with
 per-language vulnerable/secure examples), injected into the audit prompt, not
@@ -65,7 +66,7 @@ codejury review diff --repo /path/to/app --git-range origin/main...HEAD
 # from stdin
 git diff HEAD~1 | codejury review diff
 
-# adversarial mode: Finder + Challenger + Judge (higher coverage, lower FP, ~3x cost)
+# adversarial mode: Finder + Challenger + Judge (extra recall on subtle flaws, ~3x cost)
 codejury review diff --diff-file changes.diff --mode adversarial
 
 # CI gate + SARIF
@@ -77,18 +78,48 @@ Configure a backend with `--provider`/`--model`/`--api-key`/`--api-base` or the
 `codejury review diff --dry-run` exercises the engine with a mock provider and
 no key (it uses a built-in demo diff when you do not pass one).
 
+### Choosing a model and mode
+
+Detection quality is dominated by the model first, then the mode. On real-diff
+probes:
+
+- A strong model (Claude Sonnet tier) in **standard** mode caught every planted
+  vulnerability with near-zero false positives. A weaker model raised false
+  positives in both modes, so the model is the lever that matters most.
+- **Adversarial** mode did not lower false positives over standard on those
+  probes and costs ~3x. Reach for it for extra recall on subtle, cross-file
+  logic, not as a false-positive reducer.
+
+Default to **standard mode with a strong model** (set it with `--model` or
+`CODEJURY_MODEL`). False positives are held down by the do-not-report list and
+the post-filter, not by the mode.
+
+### Use in CI (GitHub Actions)
+
+Audit every pull request and surface findings in the code scanning tab. Copy
+[`examples/codejury-pr-review.yml`](examples/codejury-pr-review.yml) into
+`.github/workflows/`, add a `CODEJURY_API_KEY` repo secret, and it will:
+
+1. diff the PR against its base (`--git-range origin/<base>...HEAD`),
+2. write SARIF and upload it with `github/codeql-action/upload-sarif`,
+3. fail the check on a HIGH or CRITICAL finding (`--fail-on high`).
+
+The job makes one model call per PR (standard mode); the SARIF is uploaded even
+when the gate fails, so findings always show up on the PR.
+
 ## Whole-repo review
 
 ```bash
 codejury review repo /path/to/your/repo
 ```
 
-This scaffolds a review workspace (`api/`, `issues/`, `analysis/`, and a
-`security-review-memory.md`), seeds the API inventory from a deterministic scan,
-and prints the methodology. Run it with an interactive agent: it reads the
-methodology and the rules, traverses the code from its API entrypoints, records
-high-confidence issues with a PoC, and asks you to confirm credentials or false
-positives along the way. Nothing runs against production.
+This scaffolds a review workspace (`entrypoints/`, `issues/`, `analysis/`, and a
+`security-review-memory.md`), seeds the entrypoint inventory from a
+deterministic scan, and prints the methodology. Run it with an interactive
+agent: it reads the methodology and the rules, maps the attack surface, traces
+inputs to sinks across files, records high-confidence issues with a PoC, and
+asks you to confirm credentials or false positives along the way. Nothing runs
+against production.
 
 ## Findings
 

{codejury-0.14.6 → codejury-0.15.0}/codejury.egg-info/SOURCES.txt

@@ -13,7 +13,7 @@ codejury.egg-info/entry_points.txt
 codejury.egg-info/requires.txt
 codejury.egg-info/top_level.txt
 codejury/data/entrypoints.yaml
-codejury/data/agent/full-review.md
+codejury/data/agent/repo-review.md
 codejury/data/agent/security-review-memory.md
 codejury/data/rules/SKILL.md
 codejury/data/rules/business-logic.md

{codejury-0.14.6 → codejury-0.15.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "codejury"
-version = "0.14.6"
+version = "0.15.0"
 description = "AI code security review: an adversarial diff-audit engine and an agent-driven whole-repo review methodology, with security knowledge as rich rules"
 readme = "README.md"
 requires-python = ">=3.12"

{codejury-0.14.6 → codejury-0.15.0}/tests/test_repo_model.py

@@ -59,7 +59,8 @@ urlpatterns = [
 ]
 '''
 
-# include() mounts and class-based views resolve to no handler function: noise
+# include() to a module not in the tree resolves to no file: dropped.
+# class-based views resolve to the view class name.
 DJANGO_NOISE = '''
 from django.urls import path, include
 from .views import DashboardView
@@ -69,6 +70,7 @@ urlpatterns = [
     path("accounts/", include("allauth.urls")),
     path("profile/", views.profile),
     path("dash/", DashboardView.as_view()),
+    path("admin-panel/", views.AdminView.as_view()),
 ]
 '''
 
@@ -163,12 +165,16 @@ def test_django_include_mounts_subroutes_under_prefix():
     assert all(e.route != "users" for e in model.entrypoints)
 
 
-def test_django_include_and_cbv_with_no_resolvable_function_are_dropped():
-    # include() mounts and an unresolved .as_view() carry no handler function;
-    # only the plain function-based view survives, no empty `- -` noise entries
+def test_django_unresolvable_include_dropped_and_cbv_resolved():
+    # include() whose module is not in the tree resolves to no file and is dropped;
+    # class-based views resolve to the view class name (both Name and views.Attr forms)
     model = _model({"urls.py": DJANGO_NOISE})
-    assert _routes(model) == {("http", "django", "profile", "profile/", "")}
-    assert all(e.function for e in model.entrypoints)
+    assert _routes(model) == {
+        ("http", "django", "profile", "profile/", ""),
+        ("http", "django", "DashboardView", "dash/", ""),
+        ("http", "django", "AdminView", "admin-panel/", ""),
+    }
+    assert all(e.function for e in model.entrypoints)  # no empty `- -` noise entries
 
 
 def test_plain_module_has_no_entrypoints():

{codejury-0.14.6 → codejury-0.15.0}/tests/test_repo_scaffold.py

@@ -1,4 +1,4 @@
-"""RW-4: the full-review scaffold sets up the agent workspace (api/issues/
+"""RW-4: the repo-review scaffold sets up the agent workspace (entrypoints/issues/
 analysis + memory + seeded entrypoints) and returns the methodology. It does not
 run an LLM pipeline."""
 
@@ -32,7 +32,7 @@ def test_scaffold_creates_workspace(tmp_path):
 
     assert res.project == "myservice"
     assert res.workspace == ws_root / "myservice"
-    for sub in ("api", "issues", "analysis"):
+    for sub in ("entrypoints", "issues", "analysis"):
         assert (res.workspace / sub).is_dir()
     assert res.memory_path.is_file()
     assert "Security Review Memory" in res.memory_path.read_text()
@@ -42,7 +42,7 @@ def test_scaffold_creates_workspace(tmp_path):
 def test_scaffold_seeds_entrypoints_from_repomodel(tmp_path):
     res = scaffold(_target(tmp_path), tmp_path / "work")
     assert res.entrypoints == 2
-    seeded = (res.workspace / "api" / "_entrypoints.md").read_text()
+    seeded = (res.workspace / "entrypoints" / "_entrypoints.md").read_text()
     assert "/users" in seeded and "/admin/users/<uid>" in seeded
     assert "list_users" in seeded and "❌" in seeded
 
@@ -71,4 +71,4 @@ def test_no_python_entrypoints_still_scaffolds(tmp_path):
     (d / "notes.txt").write_text("hi")
     res = scaffold(d, tmp_path / "work")
     assert res.entrypoints == 0
-    assert "enumerate them manually" in (res.workspace / "api" / "_entrypoints.md").read_text()
+    assert "enumerate them manually" in (res.workspace / "entrypoints" / "_entrypoints.md").read_text()

codejury-0.14.6/README.md

@@ -1,73 +0,0 @@
-# codejury
-
-AI code security review, in two paths matched to their nature:
-
-- **Diff review** (coded): audit a pull request's diff for newly introduced,
-  exploitable risks. A single balanced LLM call, or an adversarial
-  Finder/Challenger/Judge pass for higher coverage and fewer false positives.
-- **Whole-repo review** (agent-driven): a methodology an interactive agent
-  (Claude Code, Codex) runs to traverse a codebase from its API entrypoints,
-  verify issues with a real PoC, and iterate over rounds with a persistent
-  memory. Too large for a single LLM call, so codejury ships the methodology and
-  scaffolds the workspace rather than running a pipeline.
-
-Security knowledge lives in **rich rules** (`codejury/data/rules/*.md`, with
-per-language vulnerable/secure examples), injected into the audit prompt, not
-buried in code.
-
-## Install
-
-```bash
-pip install codejury                 # core
-pip install "codejury[anthropic]"    # or [openai] / [litellm] for a backend
-```
-
-## Diff review
-
-```bash
-# audit a diff file
-codejury review diff --diff-file changes.diff
-
-# audit a git range in a repo
-codejury review diff --repo /path/to/app --git-range origin/main...HEAD
-
-# from stdin
-git diff HEAD~1 | codejury review diff
-
-# adversarial mode: Finder + Challenger + Judge (higher coverage, lower FP, ~3x cost)
-codejury review diff --diff-file changes.diff --mode adversarial
-
-# CI gate + SARIF
-codejury review diff --diff-file changes.diff --format sarif --fail-on high
-```
-
-Configure a backend with `--provider`/`--model`/`--api-key`/`--api-base` or the
-`CODEJURY_API_KEY` / `CODEJURY_MODEL` / `CODEJURY_API_BASE` environment variables.
-`codejury review diff --dry-run` exercises the engine with a mock provider and
-no key (it uses a built-in demo diff when you do not pass one).
-
-## Whole-repo review
-
-```bash
-codejury review repo /path/to/your/repo
-```
-
-This scaffolds a review workspace (`api/`, `issues/`, `analysis/`, and a
-`security-review-memory.md`), seeds the API inventory from a deterministic scan,
-and prints the methodology. Run it with an interactive agent: it reads the
-methodology and the rules, traverses the code from its API entrypoints, records
-high-confidence issues with a PoC, and asks you to confirm credentials or false
-positives along the way. Nothing runs against production.
-
-## Findings
-
-Each finding carries a file and line, a severity and category, a concrete
-exploit scenario, a recommendation, and a confidence. A false-positive filter
-drops test/mock-path and low-confidence noise; the model is also told not to
-report dependency CVEs, style notes, speculation, or config-leak-only risks.
-
-## Extending
-
-Add a vulnerability class by dropping a new `codejury/data/rules/<class>.md` with
-the standard frontmatter (title, impact, tags, triggers) and vulnerable/secure
-examples. It is data; no code change needed.