codejury 0.15.0__tar.gz → 0.16.0__tar.gz

{codejury-0.15.0 → codejury-0.16.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codejury
-Version: 0.15.0
+Version: 0.16.0
 Summary: AI code security review: an adversarial diff-audit engine and an agent-driven whole-repo review methodology, with security knowledge as rich rules
 Author: AISecLabs
 License-Expression: MIT

{codejury-0.15.0 → codejury-0.16.0}/codejury/cli.py

@@ -133,6 +133,8 @@ def _dispatch(args, parser) -> int:
         res = scaffold(args.directory, args.workspace)
         print(f"Workspace: {res.workspace}", file=sys.stderr)
         print(f"Seeded {res.entrypoints} entrypoints into {res.workspace}/entrypoints/_entrypoints.md", file=sys.stderr)
+        if res.guides:
+            print(f"Detected stack ({', '.join(res.guides)}); notes in {res.workspace}/_stack.md", file=sys.stderr)
         print(f"Memory: {res.memory_path}", file=sys.stderr)
         print("\nRun this review with an interactive agent (Claude Code / Codex) using the methodology below.\n")
         print(res.methodology)

{codejury-0.15.0 → codejury-0.16.0}/codejury/data/agent/repo-review.md

@@ -21,7 +21,10 @@ Workspace: `<workspace>/<project>/` (created for you), holding `entrypoints/`,
 2. Read `entrypoints/_entrypoints.md` (seeded for you from a deterministic AST
    scan) as a *starting* map of the attack surface. It lists HTTP routes and CLI
    commands only, a subset, not the whole surface (see "Map the attack surface").
-3. Read the relevant rule files under the shipped `rules/` for the target's stack
+3. Read `_stack.md` (seeded): the detected languages and frameworks and review
+   notes for them, so you know where this stack's entrypoints, sinks, and auth
+   checks live. If it matched nothing, lean on your own knowledge of the stack.
+4. Read the relevant rule files under the shipped `rules/` for the target's stack
    (sql-injection, idor, ssrf, authentication-jwt, insecure-deserialization, ...).
 
 ## Map the attack surface

codejury-0.16.0/codejury/data/frameworks/django.md

@@ -0,0 +1,30 @@
+---
+id: django
+title: Django
+kind: framework
+detect:
+  files: ["*urls.py", "manage.py", "*settings.py"]
+  manifest: ["django"]
+  imports: ["from django", "import django"]
+---
+# Django — review notes
+
+## Entrypoints
+- Routes live in `urls.py`: `path()` / `re_path()` map a URL to a view.
+  `include('app.urls')` mounts a sub-urlconf and the URL prefix accumulates.
+  Class-based views are wired as `SomeView.as_view()`.
+- Also: Django REST Framework viewsets/routers/serializers, management commands,
+  signals, and middleware.
+
+## Authorization / IDOR
+- Auth is enforced by decorators (`@login_required`), DRF permission classes, or
+  middleware. Note where it is and where it is missing.
+- Classic IDOR shape: `Model.objects.get(pk=<user input>)` (or `filter(id=...)`)
+  with no owner/tenant scoping, then returned to the caller. Inspect every object
+  fetch keyed by a user-supplied id.
+
+## Common sinks / gotchas
+- SQL: `.raw()`, `.extra()`, `RawSQL`, or string-built SQL via `connection.cursor()`.
+- Templates: `mark_safe`, `|safe`, `format_html` on unescaped user input; autoescape off.
+- `pickle` / `yaml.load` on a cookie or upload; `DEBUG=True` leaking internals;
+  a hardcoded `SECRET_KEY`.

codejury-0.16.0/codejury/data/languages/python.md

@@ -0,0 +1,24 @@
+---
+id: python
+title: Python
+kind: language
+detect:
+  files: ["*.py"]
+  manifest: []
+  imports: []
+---
+# Python — review notes
+
+Where untrusted input enters (beyond web routes, which the framework guide covers):
+CLI (`argparse`/`click`), scheduled jobs, queue consumers, and any function fed an
+external value. Non-HTTP sources matter as much as routes:
+
+- deserialization: `pickle.loads`, `yaml.load` without `SafeLoader`, `marshal`;
+- code execution: `eval`, `exec`, `subprocess(..., shell=True)`, `os.system`;
+- XML/XXE: `lxml`/`xml.etree` parsing attacker XML;
+- filesystem: `open()` / `os.path.join` on a path built from user input;
+- network: `requests.get(user_url)` and friends (SSRF).
+
+Common sinks: string-built SQL handed to a DB cursor or ORM `.raw()`/`.extra()`,
+a shell command, `eval`/`exec`, a user-controlled file path, a fetch of a
+user-controlled URL, and template rendering of user input.

codejury-0.16.0/codejury/repo/guides.py

@@ -0,0 +1,79 @@
+"""Language and framework review guides as data.
+
+Each `data/languages/*.md` and `data/frameworks/*.md` is a knowledge unit: YAML
+frontmatter declaring how to detect the language or framework in a target repo
+(file-name globs, dependency-manifest substrings, import markers), and a body of
+review guidance (where input enters, common sinks, auth conventions, gotchas).
+
+Selection is generic: a guide applies when its detect signals fire on the repo.
+Adding a language or framework is a drop-in file under the right directory, no
+code change, which keeps the unbounded language/framework axis out of code.
+"""
+
+from __future__ import annotations
+
+import fnmatch
+from dataclasses import dataclass
+from pathlib import Path
+
+import yaml
+
+from codejury.resources import FRAMEWORKS_DIR, LANGUAGES_DIR
+
+
+@dataclass(frozen=True, kw_only=True)
+class Guide:
+    id: str
+    kind: str            # "language" or "framework"
+    title: str
+    detect_files: tuple[str, ...]
+    detect_manifest: tuple[str, ...]
+    detect_imports: tuple[str, ...]
+    body: str
+
+
+def _parse(path: Path, kind: str) -> Guide:
+    text = path.read_text(encoding="utf-8")
+    meta: dict = {}
+    body = text
+    if text.startswith("---"):
+        parts = text.split("---", 2)
+        if len(parts) == 3:
+            meta = yaml.safe_load(parts[1]) or {}
+            body = parts[2].strip()
+    detect = meta.get("detect", {}) or {}
+    return Guide(
+        id=str(meta.get("id", path.stem)),
+        kind=kind,
+        title=str(meta.get("title", path.stem)),
+        detect_files=tuple(str(f) for f in detect.get("files", [])),
+        detect_manifest=tuple(str(m).lower() for m in detect.get("manifest", [])),
+        detect_imports=tuple(str(i) for i in detect.get("imports", [])),
+        body=body,
+    )
+
+
+def load_guides(languages_dir=LANGUAGES_DIR, frameworks_dir=FRAMEWORKS_DIR) -> list[Guide]:
+    out: list[Guide] = []
+    for directory, kind in ((languages_dir, "language"), (frameworks_dir, "framework")):
+        root = Path(directory)
+        if root.is_dir():
+            out += [_parse(p, kind) for p in sorted(root.glob("*.md")) if p.name != "SKILL.md"]
+    return out
+
+
+def _matches(guide: Guide, files: list[str], manifest: str) -> bool:
+    if any(fnmatch.fnmatch(f, pat) for pat in guide.detect_files for f in files):
+        return True
+    if any(m in manifest for m in guide.detect_manifest):
+        return True
+    return False
+
+
+def select_guides(files, *, manifest_text: str = "", guides: list[Guide] | None = None) -> list[Guide]:
+    """The guides whose detect signals fire on the repo (its file paths and the
+    concatenated text of its dependency manifests), languages first then frameworks."""
+    pool = load_guides() if guides is None else guides
+    file_list = list(files)
+    manifest = manifest_text.lower()
+    return [g for g in pool if _matches(g, file_list, manifest)]

{codejury-0.15.0 → codejury-0.16.0}/codejury/repo/scaffold.py

@@ -13,12 +13,19 @@ from __future__ import annotations
 from dataclasses import dataclass, field
 from pathlib import Path
 
+from codejury.repo.guides import Guide, select_guides
 from codejury.repo.model import build_repo_model_from_dir
 from codejury.resources import AGENT_DIR
 
 _METHODOLOGY = AGENT_DIR / "repo-review.md"
 _MEMORY_TEMPLATE = AGENT_DIR / "security-review-memory.md"
 
+# top-level dependency manifests scanned to detect the stack (content, not names)
+_MANIFESTS = (
+    "requirements.txt", "requirements-dev.txt", "pyproject.toml", "setup.py", "Pipfile",
+    "package.json", "go.mod", "Gemfile", "pom.xml", "build.gradle", "Cargo.toml", "composer.json",
+)
+
 
 @dataclass(frozen=True, kw_only=True)
 class ScaffoldResult:
@@ -27,9 +34,37 @@ class ScaffoldResult:
     methodology: str
     memory_path: Path
     entrypoints: int
+    guides: tuple[str, ...] = ()
     created: list[str] = field(default_factory=list)
 
 
+def _read_manifests(target: Path) -> str:
+    parts: list[str] = []
+    for name in _MANIFESTS:
+        p = target / name
+        try:
+            if p.is_file():
+                parts.append(p.read_text(encoding="utf-8"))
+        except OSError:
+            pass
+    return "\n".join(parts)
+
+
+def _stack_md(guides: list[Guide]) -> str:
+    if not guides:
+        return ("# Detected stack — review notes\n\n"
+                "(no language or framework guide matched; rely on the methodology and "
+                "your own knowledge of the stack)\n")
+    langs = [g.id for g in guides if g.kind == "language"]
+    fws = [g.id for g in guides if g.kind == "framework"]
+    lines = ["# Detected stack — review notes", "",
+             f"Languages: {', '.join(langs) or '-'}",
+             f"Frameworks: {', '.join(fws) or '-'}", ""]
+    for g in guides:
+        lines += ["---", "", g.body, ""]
+    return "\n".join(lines) + "\n"
+
+
 def _entrypoints_md(model) -> str:
     http = [e for e in model.entrypoints if e.kind == "http"]
     cli = [e for e in model.entrypoints if e.kind == "cli"]
@@ -69,11 +104,16 @@ def scaffold(target: str | Path, workspace: str | Path) -> ScaffoldResult:
     model = build_repo_model_from_dir(target)
     (ws / "entrypoints" / "_entrypoints.md").write_text(_entrypoints_md(model), encoding="utf-8")
 
+    # detect the stack and seed its review guides (languages + frameworks)
+    guides = select_guides(model.files, manifest_text=_read_manifests(target))
+    (ws / "_stack.md").write_text(_stack_md(guides), encoding="utf-8")
+
     return ScaffoldResult(
         project=project,
         workspace=ws,
         methodology=_METHODOLOGY.read_text(encoding="utf-8"),
         memory_path=memory_path,
         entrypoints=len(model.entrypoints),
+        guides=tuple(g.id for g in guides),
         created=created,
     )

{codejury-0.15.0 → codejury-0.16.0}/codejury/resources.py

@@ -8,6 +8,8 @@ from pathlib import Path
 
 _DATA = Path(__file__).resolve().parent / "data"
 
-RULES_DIR = _DATA / "rules"            # security rules injected into the audit prompt
+RULES_DIR = _DATA / "rules"            # vulnerability-class detection rules (what to find)
+LANGUAGES_DIR = _DATA / "languages"    # per-language review guides (how the target works)
+FRAMEWORKS_DIR = _DATA / "frameworks"  # per-framework review guides (how the target works)
 AGENT_DIR = _DATA / "agent"            # repo-review methodology and memory template
 ENTRYPOINTS_FILE = _DATA / "entrypoints.yaml"  # framework signatures for RepoModel

{codejury-0.15.0 → codejury-0.16.0}/codejury.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codejury
-Version: 0.15.0
+Version: 0.16.0
 Summary: AI code security review: an adversarial diff-audit engine and an agent-driven whole-repo review methodology, with security knowledge as rich rules
 Author: AISecLabs
 License-Expression: MIT

{codejury-0.15.0 → codejury-0.16.0}/codejury.egg-info/SOURCES.txt

@@ -15,6 +15,8 @@ codejury.egg-info/top_level.txt
 codejury/data/entrypoints.yaml
 codejury/data/agent/repo-review.md
 codejury/data/agent/security-review-memory.md
+codejury/data/frameworks/django.md
+codejury/data/languages/python.md
 codejury/data/rules/SKILL.md
 codejury/data/rules/business-logic.md
 codejury/data/rules/code-injection.md
@@ -61,12 +63,14 @@ codejury/providers/openai.py
 codejury/providers/openai_format.py
 codejury/providers/retry.py
 codejury/repo/__init__.py
+codejury/repo/guides.py
 codejury/repo/model.py
 codejury/repo/scaffold.py
 tests/test_anthropic_provider.py
 tests/test_cli_audit.py
 tests/test_diff_debate.py
 tests/test_diff_engine.py
+tests/test_guides.py
 tests/test_json_parse.py
 tests/test_litellm_provider.py
 tests/test_openai_format.py

{codejury-0.15.0 → codejury-0.16.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "codejury"
-version = "0.15.0"
+version = "0.16.0"
 description = "AI code security review: an adversarial diff-audit engine and an agent-driven whole-repo review methodology, with security knowledge as rich rules"
 readme = "README.md"
 requires-python = ">=3.12"

codejury-0.16.0/tests/test_guides.py

@@ -0,0 +1,34 @@
+"""Language/framework review guides load and are selected by detection signals
+(file globs + dependency-manifest substrings), so adding one is a drop-in file."""
+
+from codejury.repo.guides import Guide, load_guides, select_guides
+
+
+def test_shipped_guides_load():
+    by_id = {g.id: g for g in load_guides()}
+    assert {"python", "django"} <= set(by_id)
+    assert by_id["python"].kind == "language"
+    assert by_id["django"].kind == "framework"
+    assert "IDOR" in by_id["django"].body or "idor" in by_id["django"].body.lower()
+
+
+def test_select_by_file_glob():
+    matched = {g.id for g in select_guides(["app/urls.py", "app/views.py", "manage.py"])}
+    assert "python" in matched      # *.py
+    assert "django" in matched      # *urls.py / manage.py
+
+
+def test_select_by_manifest_substring():
+    matched = {g.id for g in select_guides(["main.py"], manifest_text="Django==4.2\nrequests\n")}
+    assert "django" in matched and "python" in matched
+
+
+def test_no_signal_no_match():
+    assert select_guides(["index.html", "style.css"]) == []   # no .py, no django manifest
+
+
+def test_select_respects_injected_pool():
+    only = [Guide(id="x", kind="framework", title="X", detect_files=("*.xyz",),
+                  detect_manifest=(), detect_imports=(), body="b")]
+    assert [g.id for g in select_guides(["a.xyz"], guides=only)] == ["x"]
+    assert select_guides(["a.py"], guides=only) == []

{codejury-0.15.0 → codejury-0.16.0}/tests/test_repo_scaffold.py

@@ -47,6 +47,26 @@ def test_scaffold_seeds_entrypoints_from_repomodel(tmp_path):
     assert "list_users" in seeded and "❌" in seeded
 
 
+def test_scaffold_seeds_stack_guides(tmp_path):
+    # the Flask target is Python; the python language guide should be detected and
+    # its notes written to _stack.md
+    res = scaffold(_target(tmp_path), tmp_path / "work")
+    assert "python" in res.guides
+    stack = (res.workspace / "_stack.md").read_text()
+    assert "python" in stack.lower()
+
+
+def test_scaffold_detects_framework_from_files_and_manifest(tmp_path):
+    d = tmp_path / "dj"
+    d.mkdir()
+    (d / "manage.py").write_text("import django\n")
+    (d / "urls.py").write_text("from django.urls import path\nurlpatterns = []\n")
+    (d / "requirements.txt").write_text("Django==4.2\n")
+    res = scaffold(d, tmp_path / "work")
+    assert "django" in res.guides
+    assert "Django" in (res.workspace / "_stack.md").read_text()
+
+
 def test_methodology_is_returned(tmp_path):
     # the methodology text ships and is handed back for the agent to follow
     res = scaffold(_target(tmp_path), tmp_path / "work")