codejury 0.14.7__tar.gz → 0.15.0__tar.gz

{codejury-0.14.7 → codejury-0.15.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codejury
-Version: 0.14.7
+Version: 0.15.0
 Summary: AI code security review: an adversarial diff-audit engine and an agent-driven whole-repo review methodology, with security knowledge as rich rules
 Author: AISecLabs
 License-Expression: MIT
@@ -38,10 +38,10 @@ AI code security review, in two paths matched to their nature:
   Finder/Challenger/Judge pass that trades roughly 3x the cost for extra recall
   on subtle, cross-cutting flaws.
 - **Whole-repo review** (agent-driven): a methodology an interactive agent
-  (Claude Code, Codex) runs to traverse a codebase from its API entrypoints,
-  verify issues with a real PoC, and iterate over rounds with a persistent
-  memory. Too large for a single LLM call, so codejury ships the methodology and
-  scaffolds the workspace rather than running a pipeline.
+  (Claude Code, Codex) runs to map a codebase's attack surface, trace inputs to
+  sinks across files, verify issues with a real PoC, and iterate over rounds with
+  a persistent memory. Too large for a single LLM call, so codejury ships the
+  methodology and scaffolds the workspace rather than running a pipeline.
 
 Security knowledge lives in **rich rules** (`codejury/data/rules/*.md`, with
 per-language vulnerable/secure examples), injected into the audit prompt, not
@@ -113,12 +113,13 @@ when the gate fails, so findings always show up on the PR.
 codejury review repo /path/to/your/repo
 ```
 
-This scaffolds a review workspace (`api/`, `issues/`, `analysis/`, and a
-`security-review-memory.md`), seeds the API inventory from a deterministic scan,
-and prints the methodology. Run it with an interactive agent: it reads the
-methodology and the rules, traverses the code from its API entrypoints, records
-high-confidence issues with a PoC, and asks you to confirm credentials or false
-positives along the way. Nothing runs against production.
+This scaffolds a review workspace (`entrypoints/`, `issues/`, `analysis/`, and a
+`security-review-memory.md`), seeds the entrypoint inventory from a
+deterministic scan, and prints the methodology. Run it with an interactive
+agent: it reads the methodology and the rules, maps the attack surface, traces
+inputs to sinks across files, records high-confidence issues with a PoC, and
+asks you to confirm credentials or false positives along the way. Nothing runs
+against production.
 
 ## Findings
 

{codejury-0.14.7 → codejury-0.15.0}/README.md

@@ -7,10 +7,10 @@ AI code security review, in two paths matched to their nature:
   Finder/Challenger/Judge pass that trades roughly 3x the cost for extra recall
   on subtle, cross-cutting flaws.
 - **Whole-repo review** (agent-driven): a methodology an interactive agent
-  (Claude Code, Codex) runs to traverse a codebase from its API entrypoints,
-  verify issues with a real PoC, and iterate over rounds with a persistent
-  memory. Too large for a single LLM call, so codejury ships the methodology and
-  scaffolds the workspace rather than running a pipeline.
+  (Claude Code, Codex) runs to map a codebase's attack surface, trace inputs to
+  sinks across files, verify issues with a real PoC, and iterate over rounds with
+  a persistent memory. Too large for a single LLM call, so codejury ships the
+  methodology and scaffolds the workspace rather than running a pipeline.
 
 Security knowledge lives in **rich rules** (`codejury/data/rules/*.md`, with
 per-language vulnerable/secure examples), injected into the audit prompt, not
@@ -82,12 +82,13 @@ when the gate fails, so findings always show up on the PR.
 codejury review repo /path/to/your/repo
 ```
 
-This scaffolds a review workspace (`api/`, `issues/`, `analysis/`, and a
-`security-review-memory.md`), seeds the API inventory from a deterministic scan,
-and prints the methodology. Run it with an interactive agent: it reads the
-methodology and the rules, traverses the code from its API entrypoints, records
-high-confidence issues with a PoC, and asks you to confirm credentials or false
-positives along the way. Nothing runs against production.
+This scaffolds a review workspace (`entrypoints/`, `issues/`, `analysis/`, and a
+`security-review-memory.md`), seeds the entrypoint inventory from a
+deterministic scan, and prints the methodology. Run it with an interactive
+agent: it reads the methodology and the rules, maps the attack surface, traces
+inputs to sinks across files, records high-confidence issues with a PoC, and
+asks you to confirm credentials or false positives along the way. Nothing runs
+against production.
 
 ## Findings
 

{codejury-0.14.7 → codejury-0.15.0}/codejury/cli.py

@@ -132,7 +132,7 @@ def _dispatch(args, parser) -> int:
     if args.command == "review" and scope == "repo":
         res = scaffold(args.directory, args.workspace)
         print(f"Workspace: {res.workspace}", file=sys.stderr)
-        print(f"Seeded {res.entrypoints} entrypoints into {res.workspace}/api/_entrypoints.md", file=sys.stderr)
+        print(f"Seeded {res.entrypoints} entrypoints into {res.workspace}/entrypoints/_entrypoints.md", file=sys.stderr)
         print(f"Memory: {res.memory_path}", file=sys.stderr)
         print("\nRun this review with an interactive agent (Claude Code / Codex) using the methodology below.\n")
         print(res.methodology)

codejury-0.14.7/codejury/data/agent/full-review.md → codejury-0.15.0/codejury/data/agent/repo-review.md

@@ -1,13 +1,13 @@
-# Full Security Review — Agent Methodology
+# Repo Security Review — Agent Methodology
 
-A whole-repository security audit, run by an interactive coding agent (Claude
-Code, Codex, etc.), not a one-shot LLM call. It maps the attack surface, traces
-inputs to sinks across files, verifies issues with a real PoC, and
-iterates over multiple rounds with a persistent memory. One round is roughly
-30 minutes; run as many rounds as needed.
+The `review repo` path: a whole-repository security audit, run by an interactive
+coding agent (Claude Code, Codex, etc.), not a one-shot LLM call. It maps the
+attack surface, traces inputs to sinks across files, verifies issues with a real
+PoC, and iterates over multiple rounds with a persistent memory. One round is
+roughly 30 minutes; run as many rounds as needed.
 
 Target repository: the directory you were given.
-Workspace: `<workspace>/<project>/` (created for you), holding `api/`,
+Workspace: `<workspace>/<project>/` (created for you), holding `entrypoints/`,
 `issues/`, `analysis/`, and `security-review-memory.md`.
 
 ---
@@ -18,9 +18,9 @@ Workspace: `<workspace>/<project>/` (created for you), holding `api/`,
    - skip every pattern under "Confirmed false positives";
    - do not re-report anything under "Fixed";
    - weight the files under "High-risk areas" more heavily.
-2. Read `api/_entrypoints.md` (seeded for you from a deterministic AST scan) as a
-   *starting* map of the attack surface. It lists HTTP routes and CLI commands
-   only, so it is a subset, not the whole surface (see "Map the attack surface").
+2. Read `entrypoints/_entrypoints.md` (seeded for you from a deterministic AST
+   scan) as a *starting* map of the attack surface. It lists HTTP routes and CLI
+   commands only, a subset, not the whole surface (see "Map the attack surface").
 3. Read the relevant rule files under the shipped `rules/` for the target's stack
    (sql-injection, idor, ssrf, authentication-jwt, insecure-deserialization, ...).
 
@@ -28,7 +28,7 @@ Workspace: `<workspace>/<project>/` (created for you), holding `api/`,
 
 The seeded inventory lists HTTP routes and CLI commands only. Before analysing,
 complete the surface: untrusted input enters at more than HTTP. Enumerate every
-source the attacker can influence and add it to `api/`:
+source the attacker can influence and add it to `entrypoints/`:
 
 - HTTP routes, GraphQL resolvers, gRPC / RPC handlers, WebSocket handlers;
 - CLI commands, scheduled jobs / cron, queue and topic consumers, webhooks and
@@ -40,8 +40,8 @@ source the attacker can influence and add it to `api/`:
   inter-service calls.
 
 `pickle.loads(cookie)` and `yaml.load(upload)` are entrypoints just as much as a
-route is. Record the inventory in `api/` (one file per module: source + auth
-method + review status ✅/⚠️/❌).
+route is. Record the inventory in `entrypoints/` (one file per module: source +
+auth method + review status ✅/⚠️/❌).
 
 ## Analyse each source
 

{codejury-0.14.7 → codejury-0.15.0}/codejury/data/rules/SKILL.md

@@ -8,7 +8,7 @@ description: "Application security rules for reviewing code for exploitable vuln
 Application-security rules, one file per weakness class under `rules/`, named by
 the specific weakness (CWE-style). Each rule states impact, the markers to hunt
 (`triggers`), and vulnerable-vs-secure examples. The diff-audit engine injects the
-rules relevant to a change into the prompt; the full-review agent reads them for
+rules relevant to a change into the prompt; the repo-review agent reads them for
 the target's stack. A finding's `category` is one of these ids.
 
 ## Rules by OWASP category

{codejury-0.14.7 → codejury-0.15.0}/codejury/repo/scaffold.py

@@ -3,9 +3,9 @@
 The `review repo` path. Whole-repo review is too large for a single LLM call, so
 codejury does not run it as a pipeline. Instead it scaffolds a workspace for an
 interactive agent (Claude Code, Codex) and hands over the methodology: it creates
-the api/issues/analysis directories, copies the review-memory template, seeds the
-API inventory from a deterministic RepoModel scan, and returns the methodology
-text to print.
+the entrypoints/issues/analysis directories, copies the review-memory template,
+seeds the entrypoint inventory from a deterministic RepoModel scan, and returns
+the methodology text to print.
 """
 
 from __future__ import annotations
@@ -16,7 +16,7 @@ from pathlib import Path
 from codejury.repo.model import build_repo_model_from_dir
 from codejury.resources import AGENT_DIR
 
-_METHODOLOGY = AGENT_DIR / "full-review.md"
+_METHODOLOGY = AGENT_DIR / "repo-review.md"
 _MEMORY_TEMPLATE = AGENT_DIR / "security-review-memory.md"
 
 
@@ -33,7 +33,8 @@ class ScaffoldResult:
 def _entrypoints_md(model) -> str:
     http = [e for e in model.entrypoints if e.kind == "http"]
     cli = [e for e in model.entrypoints if e.kind == "cli"]
-    lines = ["# API Entrypoints (seeded from a deterministic scan)", "",
+    lines = ["# Entrypoints (seeded from a deterministic scan)", "",
+             "HTTP routes and CLI commands only; add non-HTTP sources here too.", "",
              "Status legend: ❌ not reviewed · ⚠️ to deepen · ✅ reviewed", ""]
     if http:
         lines += ["## HTTP routes", ""]
@@ -53,7 +54,7 @@ def scaffold(target: str | Path, workspace: str | Path) -> ScaffoldResult:
     project = target.name
     ws = Path(workspace) / project
     created: list[str] = []
-    for sub in ("api", "issues", "analysis"):
+    for sub in ("entrypoints", "issues", "analysis"):
         d = ws / sub
         if not d.exists():
             d.mkdir(parents=True, exist_ok=True)
@@ -66,7 +67,7 @@ def scaffold(target: str | Path, workspace: str | Path) -> ScaffoldResult:
         created.append(str(memory_path))
 
     model = build_repo_model_from_dir(target)
-    (ws / "api" / "_entrypoints.md").write_text(_entrypoints_md(model), encoding="utf-8")
+    (ws / "entrypoints" / "_entrypoints.md").write_text(_entrypoints_md(model), encoding="utf-8")
 
     return ScaffoldResult(
         project=project,

{codejury-0.14.7 → codejury-0.15.0}/codejury/resources.py

@@ -9,5 +9,5 @@ from pathlib import Path
 _DATA = Path(__file__).resolve().parent / "data"
 
 RULES_DIR = _DATA / "rules"            # security rules injected into the audit prompt
-AGENT_DIR = _DATA / "agent"            # full-review methodology and memory template
+AGENT_DIR = _DATA / "agent"            # repo-review methodology and memory template
 ENTRYPOINTS_FILE = _DATA / "entrypoints.yaml"  # framework signatures for RepoModel

{codejury-0.14.7 → codejury-0.15.0}/codejury.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codejury
-Version: 0.14.7
+Version: 0.15.0
 Summary: AI code security review: an adversarial diff-audit engine and an agent-driven whole-repo review methodology, with security knowledge as rich rules
 Author: AISecLabs
 License-Expression: MIT
@@ -38,10 +38,10 @@ AI code security review, in two paths matched to their nature:
   Finder/Challenger/Judge pass that trades roughly 3x the cost for extra recall
   on subtle, cross-cutting flaws.
 - **Whole-repo review** (agent-driven): a methodology an interactive agent
-  (Claude Code, Codex) runs to traverse a codebase from its API entrypoints,
-  verify issues with a real PoC, and iterate over rounds with a persistent
-  memory. Too large for a single LLM call, so codejury ships the methodology and
-  scaffolds the workspace rather than running a pipeline.
+  (Claude Code, Codex) runs to map a codebase's attack surface, trace inputs to
+  sinks across files, verify issues with a real PoC, and iterate over rounds with
+  a persistent memory. Too large for a single LLM call, so codejury ships the
+  methodology and scaffolds the workspace rather than running a pipeline.
 
 Security knowledge lives in **rich rules** (`codejury/data/rules/*.md`, with
 per-language vulnerable/secure examples), injected into the audit prompt, not
@@ -113,12 +113,13 @@ when the gate fails, so findings always show up on the PR.
 codejury review repo /path/to/your/repo
 ```
 
-This scaffolds a review workspace (`api/`, `issues/`, `analysis/`, and a
-`security-review-memory.md`), seeds the API inventory from a deterministic scan,
-and prints the methodology. Run it with an interactive agent: it reads the
-methodology and the rules, traverses the code from its API entrypoints, records
-high-confidence issues with a PoC, and asks you to confirm credentials or false
-positives along the way. Nothing runs against production.
+This scaffolds a review workspace (`entrypoints/`, `issues/`, `analysis/`, and a
+`security-review-memory.md`), seeds the entrypoint inventory from a
+deterministic scan, and prints the methodology. Run it with an interactive
+agent: it reads the methodology and the rules, maps the attack surface, traces
+inputs to sinks across files, records high-confidence issues with a PoC, and
+asks you to confirm credentials or false positives along the way. Nothing runs
+against production.
 
 ## Findings
 

{codejury-0.14.7 → codejury-0.15.0}/codejury.egg-info/SOURCES.txt

@@ -13,7 +13,7 @@ codejury.egg-info/entry_points.txt
 codejury.egg-info/requires.txt
 codejury.egg-info/top_level.txt
 codejury/data/entrypoints.yaml
-codejury/data/agent/full-review.md
+codejury/data/agent/repo-review.md
 codejury/data/agent/security-review-memory.md
 codejury/data/rules/SKILL.md
 codejury/data/rules/business-logic.md

{codejury-0.14.7 → codejury-0.15.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "codejury"
-version = "0.14.7"
+version = "0.15.0"
 description = "AI code security review: an adversarial diff-audit engine and an agent-driven whole-repo review methodology, with security knowledge as rich rules"
 readme = "README.md"
 requires-python = ">=3.12"

{codejury-0.14.7 → codejury-0.15.0}/tests/test_repo_scaffold.py

@@ -1,4 +1,4 @@
-"""RW-4: the full-review scaffold sets up the agent workspace (api/issues/
+"""RW-4: the repo-review scaffold sets up the agent workspace (entrypoints/issues/
 analysis + memory + seeded entrypoints) and returns the methodology. It does not
 run an LLM pipeline."""
 
@@ -32,7 +32,7 @@ def test_scaffold_creates_workspace(tmp_path):
 
     assert res.project == "myservice"
     assert res.workspace == ws_root / "myservice"
-    for sub in ("api", "issues", "analysis"):
+    for sub in ("entrypoints", "issues", "analysis"):
         assert (res.workspace / sub).is_dir()
     assert res.memory_path.is_file()
     assert "Security Review Memory" in res.memory_path.read_text()
@@ -42,7 +42,7 @@ def test_scaffold_creates_workspace(tmp_path):
 def test_scaffold_seeds_entrypoints_from_repomodel(tmp_path):
     res = scaffold(_target(tmp_path), tmp_path / "work")
     assert res.entrypoints == 2
-    seeded = (res.workspace / "api" / "_entrypoints.md").read_text()
+    seeded = (res.workspace / "entrypoints" / "_entrypoints.md").read_text()
     assert "/users" in seeded and "/admin/users/<uid>" in seeded
     assert "list_users" in seeded and "❌" in seeded
 
@@ -71,4 +71,4 @@ def test_no_python_entrypoints_still_scaffolds(tmp_path):
     (d / "notes.txt").write_text("hi")
     res = scaffold(d, tmp_path / "work")
     assert res.entrypoints == 0
-    assert "enumerate them manually" in (res.workspace / "api" / "_entrypoints.md").read_text()
+    assert "enumerate them manually" in (res.workspace / "entrypoints" / "_entrypoints.md").read_text()