codejury 0.15.0__tar.gz → 0.16.1__tar.gz

{codejury-0.15.0 → codejury-0.16.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codejury
-Version: 0.15.0
+Version: 0.16.1
 Summary: AI code security review: an adversarial diff-audit engine and an agent-driven whole-repo review methodology, with security knowledge as rich rules
 Author: AISecLabs
 License-Expression: MIT

{codejury-0.15.0 → codejury-0.16.1}/codejury/cli.py

@@ -133,6 +133,8 @@ def _dispatch(args, parser) -> int:
         res = scaffold(args.directory, args.workspace)
         print(f"Workspace: {res.workspace}", file=sys.stderr)
         print(f"Seeded {res.entrypoints} entrypoints into {res.workspace}/entrypoints/_entrypoints.md", file=sys.stderr)
+        if res.guides:
+            print(f"Detected stack ({', '.join(res.guides)}); notes in {res.workspace}/_stack.md", file=sys.stderr)
         print(f"Memory: {res.memory_path}", file=sys.stderr)
         print("\nRun this review with an interactive agent (Claude Code / Codex) using the methodology below.\n")
         print(res.methodology)

{codejury-0.15.0 → codejury-0.16.1}/codejury/data/agent/repo-review.md

@@ -21,7 +21,10 @@ Workspace: `<workspace>/<project>/` (created for you), holding `entrypoints/`,
 2. Read `entrypoints/_entrypoints.md` (seeded for you from a deterministic AST
    scan) as a *starting* map of the attack surface. It lists HTTP routes and CLI
    commands only, a subset, not the whole surface (see "Map the attack surface").
-3. Read the relevant rule files under the shipped `rules/` for the target's stack
+3. Read `_stack.md` (seeded): the detected languages and frameworks and review
+   notes for them, so you know where this stack's entrypoints, sinks, and auth
+   checks live. If it matched nothing, lean on your own knowledge of the stack.
+4. Read the relevant rule files under the shipped `rules/` for the target's stack
    (sql-injection, idor, ssrf, authentication-jwt, insecure-deserialization, ...).
 
 ## Map the attack surface

codejury-0.16.1/codejury/data/frameworks/django.md

@@ -0,0 +1,30 @@
+---
+id: django
+title: Django
+kind: framework
+detect:
+  files: ["*urls.py", "manage.py", "*settings.py"]
+  manifest: ["django"]
+  imports: ["from django", "import django"]
+---
+# Django — review notes
+
+## Entrypoints
+- Routes live in `urls.py`: `path()` / `re_path()` map a URL to a view.
+  `include('app.urls')` mounts a sub-urlconf and the URL prefix accumulates.
+  Class-based views are wired as `SomeView.as_view()`.
+- Also: Django REST Framework viewsets/routers/serializers, management commands,
+  signals, and middleware.
+
+## Authorization / IDOR
+- Auth is enforced by decorators (`@login_required`), DRF permission classes, or
+  middleware. Note where it is and where it is missing.
+- Classic IDOR shape: `Model.objects.get(pk=<user input>)` (or `filter(id=...)`)
+  with no owner/tenant scoping, then returned to the caller. Inspect every object
+  fetch keyed by a user-supplied id.
+
+## Common sinks / gotchas
+- SQL: `.raw()`, `.extra()`, `RawSQL`, or string-built SQL via `connection.cursor()`.
+- Templates: `mark_safe`, `|safe`, `format_html` on unescaped user input; autoescape off.
+- `pickle` / `yaml.load` on a cookie or upload; `DEBUG=True` leaking internals;
+  a hardcoded `SECRET_KEY`.

codejury-0.16.1/codejury/data/languages/python.md

@@ -0,0 +1,24 @@
+---
+id: python
+title: Python
+kind: language
+detect:
+  files: ["*.py"]
+  manifest: []
+  imports: []
+---
+# Python — review notes
+
+Where untrusted input enters (beyond web routes, which the framework guide covers):
+CLI (`argparse`/`click`), scheduled jobs, queue consumers, and any function fed an
+external value. Non-HTTP sources matter as much as routes:
+
+- deserialization: `pickle.loads`, `yaml.load` without `SafeLoader`, `marshal`;
+- code execution: `eval`, `exec`, `subprocess(..., shell=True)`, `os.system`;
+- XML/XXE: `lxml`/`xml.etree` parsing attacker XML;
+- filesystem: `open()` / `os.path.join` on a path built from user input;
+- network: `requests.get(user_url)` and friends (SSRF).
+
+Common sinks: string-built SQL handed to a DB cursor or ORM `.raw()`/`.extra()`,
+a shell command, `eval`/`exec`, a user-controlled file path, a fetch of a
+user-controlled URL, and template rendering of user input.

{codejury-0.15.0 → codejury-0.16.1}/codejury/diff/engine.py

@@ -12,6 +12,7 @@ from codejury.diff.prompts import SYSTEM, standard_audit_prompt
 from codejury.diff.rules import rules_for_diff
 from codejury.json_parse import extract_json_object
 from codejury.providers.base import Message, Provider
+from codejury.guides import guides_for_diff
 
 
 class AuditError(RuntimeError):
@@ -33,9 +34,10 @@ class AuditRunner:
     def run(self, diff: str, *, rules: str = "", context: str = "") -> list[Finding]:
         if not rules:
             rules = rules_for_diff(diff)  # inject the rules relevant to this diff
+        stack = guides_for_diff(diff)     # inject the target's language/framework conventions
         result = self._provider.complete(
             system=SYSTEM,
-            messages=[Message(role="user", content=standard_audit_prompt(diff, rules=rules, context=context))],
+            messages=[Message(role="user", content=standard_audit_prompt(diff, rules=rules, context=context, stack=stack))],
             model=self._model,
             max_tokens=self._max_tokens,
         )

{codejury-0.15.0 → codejury-0.16.1}/codejury/diff/prompts.py

@@ -57,7 +57,8 @@ def category_block() -> str:
     )
 
 
-def standard_audit_prompt(diff: str, *, rules: str = "", context: str = "") -> str:
+def standard_audit_prompt(diff: str, *, rules: str = "", context: str = "", stack: str = "") -> str:
+    stack_block = f"Conventions of the target's language/framework:\n{stack}\n\n" if stack else ""
     rules_block = f"Relevant security rules for reference:\n{rules}\n\n" if rules else ""
     context_block = (
         f"Surrounding code for tracing where values come from (not under review):\n"
@@ -69,6 +70,7 @@ def standard_audit_prompt(diff: str, *, rules: str = "", context: str = "") -> s
         "Review the following code change for security vulnerabilities.\n\n"
         f"{FOCUS}\n{DO_NOT_REPORT}\n"
         f"{category_block()}"
+        f"{stack_block}"
         f"{rules_block}"
         f"Code change (unified diff):\n```diff\n{diff}\n```\n\n"
         f"{context_block}"

codejury-0.16.1/codejury/guides.py

@@ -0,0 +1,97 @@
+"""Language and framework review guides as data.
+
+Each `data/languages/*.md` and `data/frameworks/*.md` is a knowledge unit: YAML
+frontmatter declaring how to detect the language or framework in a target repo
+(file-name globs, dependency-manifest substrings, import markers), and a body of
+review guidance (where input enters, common sinks, auth conventions, gotchas).
+
+Selection is generic: a guide applies when its detect signals fire on the repo.
+Adding a language or framework is a drop-in file under the right directory, no
+code change, which keeps the unbounded language/framework axis out of code.
+"""
+
+from __future__ import annotations
+
+import fnmatch
+import re
+from dataclasses import dataclass
+from pathlib import Path
+
+import yaml
+
+from codejury.resources import FRAMEWORKS_DIR, LANGUAGES_DIR
+
+_DIFF_PATH = re.compile(r"^(?:\+\+\+ b/|diff --git a/\S+ b/)(\S+)", re.MULTILINE)
+
+
+@dataclass(frozen=True, kw_only=True)
+class Guide:
+    id: str
+    kind: str            # "language" or "framework"
+    title: str
+    detect_files: tuple[str, ...]
+    detect_manifest: tuple[str, ...]
+    detect_imports: tuple[str, ...]
+    body: str
+
+
+def _parse(path: Path, kind: str) -> Guide:
+    text = path.read_text(encoding="utf-8")
+    meta: dict = {}
+    body = text
+    if text.startswith("---"):
+        parts = text.split("---", 2)
+        if len(parts) == 3:
+            meta = yaml.safe_load(parts[1]) or {}
+            body = parts[2].strip()
+    detect = meta.get("detect", {}) or {}
+    return Guide(
+        id=str(meta.get("id", path.stem)),
+        kind=kind,
+        title=str(meta.get("title", path.stem)),
+        detect_files=tuple(str(f) for f in detect.get("files", [])),
+        detect_manifest=tuple(str(m).lower() for m in detect.get("manifest", [])),
+        detect_imports=tuple(str(i) for i in detect.get("imports", [])),
+        body=body,
+    )
+
+
+def load_guides(languages_dir=LANGUAGES_DIR, frameworks_dir=FRAMEWORKS_DIR) -> list[Guide]:
+    out: list[Guide] = []
+    for directory, kind in ((languages_dir, "language"), (frameworks_dir, "framework")):
+        root = Path(directory)
+        if root.is_dir():
+            out += [_parse(p, kind) for p in sorted(root.glob("*.md")) if p.name != "SKILL.md"]
+    return out
+
+
+def _matches(guide: Guide, files: list[str], text: str) -> bool:
+    if any(fnmatch.fnmatch(f, pat) for pat in guide.detect_files for f in files):
+        return True
+    if any(m in text for m in guide.detect_manifest):
+        return True
+    if any(i in text for i in guide.detect_imports):
+        return True
+    return False
+
+
+def select_guides(files, *, text: str = "", guides: list[Guide] | None = None) -> list[Guide]:
+    """The guides whose detect signals fire on the target, languages first then
+    frameworks. `files` are the target's file paths; `text` is content to scan for
+    manifest substrings and import markers (a repo's manifests, or a diff body)."""
+    pool = load_guides() if guides is None else guides
+    file_list = list(files)
+    blob = text.lower()
+    return [g for g in pool if _matches(g, file_list, blob)]
+
+
+def _changed_paths(diff: str) -> list[str]:
+    """The file paths touched by a unified diff (from its `+++ b/` / `diff --git` headers)."""
+    return _DIFF_PATH.findall(diff)
+
+
+def guides_for_diff(diff: str, *, guides: list[Guide] | None = None) -> str:
+    """Concatenated bodies of the language/framework guides relevant to a diff, by
+    its changed paths and its content. Empty when nothing matches."""
+    selected = select_guides(_changed_paths(diff), text=diff, guides=guides)
+    return "\n\n---\n\n".join(g.body for g in selected)

{codejury-0.15.0 → codejury-0.16.1}/codejury/repo/scaffold.py

@@ -13,12 +13,19 @@ from __future__ import annotations
 from dataclasses import dataclass, field
 from pathlib import Path
 
+from codejury.guides import Guide, select_guides
 from codejury.repo.model import build_repo_model_from_dir
 from codejury.resources import AGENT_DIR
 
 _METHODOLOGY = AGENT_DIR / "repo-review.md"
 _MEMORY_TEMPLATE = AGENT_DIR / "security-review-memory.md"
 
+# top-level dependency manifests scanned to detect the stack (content, not names)
+_MANIFESTS = (
+    "requirements.txt", "requirements-dev.txt", "pyproject.toml", "setup.py", "Pipfile",
+    "package.json", "go.mod", "Gemfile", "pom.xml", "build.gradle", "Cargo.toml", "composer.json",
+)
+
 
 @dataclass(frozen=True, kw_only=True)
 class ScaffoldResult:
@@ -27,9 +34,37 @@ class ScaffoldResult:
     methodology: str
     memory_path: Path
     entrypoints: int
+    guides: tuple[str, ...] = ()
     created: list[str] = field(default_factory=list)
 
 
+def _read_manifests(target: Path) -> str:
+    parts: list[str] = []
+    for name in _MANIFESTS:
+        p = target / name
+        try:
+            if p.is_file():
+                parts.append(p.read_text(encoding="utf-8"))
+        except OSError:
+            pass
+    return "\n".join(parts)
+
+
+def _stack_md(guides: list[Guide]) -> str:
+    if not guides:
+        return ("# Detected stack — review notes\n\n"
+                "(no language or framework guide matched; rely on the methodology and "
+                "your own knowledge of the stack)\n")
+    langs = [g.id for g in guides if g.kind == "language"]
+    fws = [g.id for g in guides if g.kind == "framework"]
+    lines = ["# Detected stack — review notes", "",
+             f"Languages: {', '.join(langs) or '-'}",
+             f"Frameworks: {', '.join(fws) or '-'}", ""]
+    for g in guides:
+        lines += ["---", "", g.body, ""]
+    return "\n".join(lines) + "\n"
+
+
 def _entrypoints_md(model) -> str:
     http = [e for e in model.entrypoints if e.kind == "http"]
     cli = [e for e in model.entrypoints if e.kind == "cli"]
@@ -69,11 +104,16 @@ def scaffold(target: str | Path, workspace: str | Path) -> ScaffoldResult:
     model = build_repo_model_from_dir(target)
     (ws / "entrypoints" / "_entrypoints.md").write_text(_entrypoints_md(model), encoding="utf-8")
 
+    # detect the stack and seed its review guides (languages + frameworks)
+    guides = select_guides(model.files, text=_read_manifests(target))
+    (ws / "_stack.md").write_text(_stack_md(guides), encoding="utf-8")
+
     return ScaffoldResult(
         project=project,
         workspace=ws,
         methodology=_METHODOLOGY.read_text(encoding="utf-8"),
         memory_path=memory_path,
         entrypoints=len(model.entrypoints),
+        guides=tuple(g.id for g in guides),
         created=created,
     )

{codejury-0.15.0 → codejury-0.16.1}/codejury/resources.py

@@ -8,6 +8,8 @@ from pathlib import Path
 
 _DATA = Path(__file__).resolve().parent / "data"
 
-RULES_DIR = _DATA / "rules"            # security rules injected into the audit prompt
+RULES_DIR = _DATA / "rules"            # vulnerability-class detection rules (what to find)
+LANGUAGES_DIR = _DATA / "languages"    # per-language review guides (how the target works)
+FRAMEWORKS_DIR = _DATA / "frameworks"  # per-framework review guides (how the target works)
 AGENT_DIR = _DATA / "agent"            # repo-review methodology and memory template
 ENTRYPOINTS_FILE = _DATA / "entrypoints.yaml"  # framework signatures for RepoModel

{codejury-0.15.0 → codejury-0.16.1}/codejury.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codejury
-Version: 0.15.0
+Version: 0.16.1
 Summary: AI code security review: an adversarial diff-audit engine and an agent-driven whole-repo review methodology, with security knowledge as rich rules
 Author: AISecLabs
 License-Expression: MIT

{codejury-0.15.0 → codejury-0.16.1}/codejury.egg-info/SOURCES.txt

@@ -3,6 +3,7 @@ README.md
 pyproject.toml
 codejury/__init__.py
 codejury/cli.py
+codejury/guides.py
 codejury/json_parse.py
 codejury/report.py
 codejury/resources.py
@@ -15,6 +16,8 @@ codejury.egg-info/top_level.txt
 codejury/data/entrypoints.yaml
 codejury/data/agent/repo-review.md
 codejury/data/agent/security-review-memory.md
+codejury/data/frameworks/django.md
+codejury/data/languages/python.md
 codejury/data/rules/SKILL.md
 codejury/data/rules/business-logic.md
 codejury/data/rules/code-injection.md
@@ -67,6 +70,7 @@ tests/test_anthropic_provider.py
 tests/test_cli_audit.py
 tests/test_diff_debate.py
 tests/test_diff_engine.py
+tests/test_guides.py
 tests/test_json_parse.py
 tests/test_litellm_provider.py
 tests/test_openai_format.py

{codejury-0.15.0 → codejury-0.16.1}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "codejury"
-version = "0.15.0"
+version = "0.16.1"
 description = "AI code security review: an adversarial diff-audit engine and an agent-driven whole-repo review methodology, with security knowledge as rich rules"
 readme = "README.md"
 requires-python = ">=3.12"

{codejury-0.15.0 → codejury-0.16.1}/tests/test_diff_engine.py

@@ -85,11 +85,12 @@ def test_engine_raises_on_wrong_shape_json():
 
 
 def test_prompt_carries_diff_focus_and_do_not_report():
-    p = standard_audit_prompt(_DIFF, rules="RULE-X", context="def caller(): ...")
+    p = standard_audit_prompt(_DIFF, rules="RULE-X", context="def caller(): ...", stack="STACK-NOTE")
     assert "SELECT * FROM u" in p          # the diff
     assert "Do NOT report" in p            # the noise-control list
     assert "IDOR" in p                     # the focus
     assert "RULE-X" in p                   # rules excerpt
+    assert "STACK-NOTE" in p               # language/framework conventions block
     assert "def caller()" in p             # context block
 
 

codejury-0.16.1/tests/test_guides.py

@@ -0,0 +1,45 @@
+"""Language/framework review guides load and are selected by detection signals
+(file globs + dependency-manifest substrings), so adding one is a drop-in file."""
+
+from codejury.guides import Guide, guides_for_diff, load_guides, select_guides
+
+
+def test_shipped_guides_load():
+    by_id = {g.id: g for g in load_guides()}
+    assert {"python", "django"} <= set(by_id)
+    assert by_id["python"].kind == "language"
+    assert by_id["django"].kind == "framework"
+    assert "IDOR" in by_id["django"].body or "idor" in by_id["django"].body.lower()
+
+
+def test_select_by_file_glob():
+    matched = {g.id for g in select_guides(["app/urls.py", "app/views.py", "manage.py"])}
+    assert "python" in matched      # *.py
+    assert "django" in matched      # *urls.py / manage.py
+
+
+def test_select_by_manifest_substring():
+    matched = {g.id for g in select_guides(["main.py"], text="Django==4.2\nrequests\n")}
+    assert "django" in matched and "python" in matched
+
+
+def test_no_signal_no_match():
+    assert select_guides(["index.html", "style.css"]) == []   # no .py, no django manifest
+
+
+def test_select_respects_injected_pool():
+    only = [Guide(id="x", kind="framework", title="X", detect_files=("*.xyz",),
+                  detect_manifest=(), detect_imports=(), body="b")]
+    assert [g.id for g in select_guides(["a.xyz"], guides=only)] == ["x"]
+    assert select_guides(["a.py"], guides=only) == []
+
+
+def test_guides_for_diff_by_path_and_content():
+    diff = ("diff --git a/app/urls.py b/app/urls.py\n"
+            "+from django.urls import path\n+urlpatterns = []\n")
+    notes = guides_for_diff(diff)
+    assert "Django" in notes and "Python" in notes   # urls.py + .py + the django import
+
+
+def test_guides_for_diff_empty_when_irrelevant():
+    assert guides_for_diff("+++ b/README.md\n+hello\n") == ""

{codejury-0.15.0 → codejury-0.16.1}/tests/test_repo_scaffold.py

@@ -47,6 +47,26 @@ def test_scaffold_seeds_entrypoints_from_repomodel(tmp_path):
     assert "list_users" in seeded and "❌" in seeded
 
 
+def test_scaffold_seeds_stack_guides(tmp_path):
+    # the Flask target is Python; the python language guide should be detected and
+    # its notes written to _stack.md
+    res = scaffold(_target(tmp_path), tmp_path / "work")
+    assert "python" in res.guides
+    stack = (res.workspace / "_stack.md").read_text()
+    assert "python" in stack.lower()
+
+
+def test_scaffold_detects_framework_from_files_and_manifest(tmp_path):
+    d = tmp_path / "dj"
+    d.mkdir()
+    (d / "manage.py").write_text("import django\n")
+    (d / "urls.py").write_text("from django.urls import path\nurlpatterns = []\n")
+    (d / "requirements.txt").write_text("Django==4.2\n")
+    res = scaffold(d, tmp_path / "work")
+    assert "django" in res.guides
+    assert "Django" in (res.workspace / "_stack.md").read_text()
+
+
 def test_methodology_is_returned(tmp_path):
     # the methodology text ships and is handed back for the agent to follow
     res = scaffold(_target(tmp_path), tmp_path / "work")