codejury 0.16.1__tar.gz → 0.17.1__tar.gz

{codejury-0.16.1 → codejury-0.17.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codejury
-Version: 0.16.1
+Version: 0.17.1
 Summary: AI code security review: an adversarial diff-audit engine and an agent-driven whole-repo review methodology, with security knowledge as rich rules
 Author: AISecLabs
 License-Expression: MIT
@@ -104,7 +104,7 @@ Audit every pull request and surface findings in the code scanning tab. Copy
 2. write SARIF and upload it with `github/codeql-action/upload-sarif`,
 3. fail the check on a HIGH or CRITICAL finding (`--fail-on high`).
 
-The job makes one model call per PR (standard mode); the SARIF is uploaded even
+The job makes one model call per PR (standard mode). The SARIF is uploaded even
 when the gate fails, so findings always show up on the PR.
 
 ## Whole-repo review
@@ -125,11 +125,11 @@ against production.
 
 Each finding carries a file and line, a severity and category, a concrete
 exploit scenario, a recommendation, and a confidence. A false-positive filter
-drops test/mock-path and low-confidence noise; the model is also told not to
+drops test/mock-path and low-confidence noise. The model is also told not to
 report dependency CVEs, style notes, speculation, or config-leak-only risks.
 
 ## Extending
 
 Add a vulnerability class by dropping a new `codejury/data/rules/<class>.md` with
 the standard frontmatter (title, impact, tags, triggers) and vulnerable/secure
-examples. It is data; no code change needed.
+examples. It is data, no code change needed.

{codejury-0.16.1 → codejury-0.17.1}/README.md

@@ -73,7 +73,7 @@ Audit every pull request and surface findings in the code scanning tab. Copy
 2. write SARIF and upload it with `github/codeql-action/upload-sarif`,
 3. fail the check on a HIGH or CRITICAL finding (`--fail-on high`).
 
-The job makes one model call per PR (standard mode); the SARIF is uploaded even
+The job makes one model call per PR (standard mode). The SARIF is uploaded even
 when the gate fails, so findings always show up on the PR.
 
 ## Whole-repo review
@@ -94,11 +94,11 @@ against production.
 
 Each finding carries a file and line, a severity and category, a concrete
 exploit scenario, a recommendation, and a confidence. A false-positive filter
-drops test/mock-path and low-confidence noise; the model is also told not to
+drops test/mock-path and low-confidence noise. The model is also told not to
 report dependency CVEs, style notes, speculation, or config-leak-only risks.
 
 ## Extending
 
 Add a vulnerability class by dropping a new `codejury/data/rules/<class>.md` with
 the standard frontmatter (title, impact, tags, triggers) and vulnerable/secure
-examples. It is data; no code change needed.
+examples. It is data, no code change needed.

{codejury-0.16.1 → codejury-0.17.1}/codejury/cli.py

@@ -132,9 +132,10 @@ def _dispatch(args, parser) -> int:
     if args.command == "review" and scope == "repo":
         res = scaffold(args.directory, args.workspace)
         print(f"Workspace: {res.workspace}", file=sys.stderr)
-        print(f"Seeded {res.entrypoints} entrypoints into {res.workspace}/entrypoints/_entrypoints.md", file=sys.stderr)
         if res.guides:
-            print(f"Detected stack ({', '.join(res.guides)}); notes in {res.workspace}/_stack.md", file=sys.stderr)
+            print(f"Detected stack: {', '.join(res.guides)}. Notes in {res.workspace}/_stack.md", file=sys.stderr)
+        print(f"Flagged {len(res.candidate_files)} candidate entrypoint files into "
+              f"{res.workspace}/entrypoints/_entrypoints.md", file=sys.stderr)
         print(f"Memory: {res.memory_path}", file=sys.stderr)
         print("\nRun this review with an interactive agent (Claude Code / Codex) using the methodology below.\n")
         print(res.methodology)

{codejury-0.16.1 → codejury-0.17.1}/codejury/data/frameworks/django.md

@@ -6,8 +6,9 @@ detect:
   files: ["*urls.py", "manage.py", "*settings.py"]
   manifest: ["django"]
   imports: ["from django", "import django"]
+entrypoint_files: ["*urls.py"]
 ---
-# Django — review notes
+# Django review notes
 
 ## Entrypoints
 - Routes live in `urls.py`: `path()` / `re_path()` map a URL to a view.
@@ -25,6 +26,6 @@ detect:
 
 ## Common sinks / gotchas
 - SQL: `.raw()`, `.extra()`, `RawSQL`, or string-built SQL via `connection.cursor()`.
-- Templates: `mark_safe`, `|safe`, `format_html` on unescaped user input; autoescape off.
-- `pickle` / `yaml.load` on a cookie or upload; `DEBUG=True` leaking internals;
+- Templates: `mark_safe`, `|safe`, `format_html` on unescaped user input, autoescape off.
+- `pickle` / `yaml.load` on a cookie or upload, `DEBUG=True` leaking internals,
   a hardcoded `SECRET_KEY`.

{codejury-0.16.1 → codejury-0.17.1}/codejury/data/languages/python.md

@@ -7,16 +7,16 @@ detect:
   manifest: []
   imports: []
 ---
-# Python — review notes
+# Python review notes
 
 Where untrusted input enters (beyond web routes, which the framework guide covers):
 CLI (`argparse`/`click`), scheduled jobs, queue consumers, and any function fed an
 external value. Non-HTTP sources matter as much as routes:
 
-- deserialization: `pickle.loads`, `yaml.load` without `SafeLoader`, `marshal`;
-- code execution: `eval`, `exec`, `subprocess(..., shell=True)`, `os.system`;
-- XML/XXE: `lxml`/`xml.etree` parsing attacker XML;
-- filesystem: `open()` / `os.path.join` on a path built from user input;
+- deserialization: `pickle.loads`, `yaml.load` without `SafeLoader`, `marshal`
+- code execution: `eval`, `exec`, `subprocess(..., shell=True)`, `os.system`
+- XML/XXE: `lxml`/`xml.etree` parsing attacker XML
+- filesystem: `open()` / `os.path.join` on a path built from user input
 - network: `requests.get(user_url)` and friends (SSRF).
 
 Common sinks: string-built SQL handed to a DB cursor or ORM `.raw()`/`.extra()`,

{codejury-0.16.1/codejury/data/agent → codejury-0.17.1/codejury/data/methodology}/repo-review.md

@@ -1,10 +1,10 @@
-# Repo Security Review — Agent Methodology
+# Repo Security Review: Agent Methodology
 
 The `review repo` path: a whole-repository security audit, run by an interactive
-coding agent (Claude Code, Codex, etc.), not a one-shot LLM call. It maps the
+coding agent such as Claude Code or Codex, not a one-shot LLM call. It maps the
 attack surface, traces inputs to sinks across files, verifies issues with a real
 PoC, and iterates over multiple rounds with a persistent memory. One round is
-roughly 30 minutes; run as many rounds as needed.
+roughly 30 minutes. Run as many rounds as needed.
 
 Target repository: the directory you were given.
 Workspace: `<workspace>/<project>/` (created for you), holding `entrypoints/`,
@@ -12,15 +12,16 @@ Workspace: `<workspace>/<project>/` (created for you), holding `entrypoints/`,
 
 ---
 
-## On start (do this first)
+## On start
 
 1. Read `security-review-memory.md` in the workspace if it exists:
-   - skip every pattern under "Confirmed false positives";
-   - do not re-report anything under "Fixed";
+   - skip every pattern under "Confirmed false positives".
+   - do not re-report anything under "Fixed".
    - weight the files under "High-risk areas" more heavily.
-2. Read `entrypoints/_entrypoints.md` (seeded for you from a deterministic AST
-   scan) as a *starting* map of the attack surface. It lists HTTP routes and CLI
-   commands only, a subset, not the whole surface (see "Map the attack surface").
+2. Read `entrypoints/_entrypoints.md` (seeded): the files the detected stack
+   flags as likely to define entrypoints. Open them to find the actual
+   entrypoints. It is a *starting* subset, not the whole surface (see "Map the
+   attack surface").
 3. Read `_stack.md` (seeded): the detected languages and frameworks and review
    notes for them, so you know where this stack's entrypoints, sinks, and auth
    checks live. If it matched nothing, lean on your own knowledge of the stack.
@@ -33,12 +34,12 @@ The seeded inventory lists HTTP routes and CLI commands only. Before analysing,
 complete the surface: untrusted input enters at more than HTTP. Enumerate every
 source the attacker can influence and add it to `entrypoints/`:
 
-- HTTP routes, GraphQL resolvers, gRPC / RPC handlers, WebSocket handlers;
+- HTTP routes, GraphQL resolvers, gRPC / RPC handlers, WebSocket handlers.
 - CLI commands, scheduled jobs / cron, queue and topic consumers, webhooks and
-  third-party callbacks;
+  third-party callbacks.
 - deserialization points (pickle, yaml.load, marshal), file and document parsers
-  (XML / XXE, YAML, CSV, zip, image / office), template rendering of user input;
-- file uploads, archive extraction, and any filesystem path built from user input;
+  (XML / XXE, YAML, CSV, zip, image / office), template rendering of user input.
+- file uploads, archive extraction, and any filesystem path built from user input.
 - headers, cookies, environment, and config read as trusted, and inbound
   inter-service calls.
 
@@ -60,11 +61,11 @@ Read the implementation reachable from each source. For every one ask:
 - Mass assignment: is a user-controlled body bound wholesale into a model?
 - Signature: is a caller-supplied key trusted as the trust anchor?
 
-## Trace attack paths (the core work)
+## Trace attack paths, the core work
 
 A whole-repo review earns its keep by reasoning *across files*: a flaw is usually
 a source in one file reaching a dangerous sink in another, past a control defined
-in a third (a route that trusts a helper which skips signature checks; an id that
+in a third (a route that trusts a helper which skips signature checks, an id that
 reaches a query with no ownership check). For each promising source, trace the
 path and record it in `analysis/`:
 
@@ -128,7 +129,7 @@ destructive action without the operator's explicit go-ahead.
 ## Iteration
 
 Each round, read the workspace history first and do not repeat finished work.
-Process leftover TODOs; otherwise pick an unreviewed (❌) or to-deepen (⚠️)
+Process leftover TODOs, otherwise pick an unreviewed (❌) or to-deepen (⚠️)
 source from the inventory. When every source is ✅ and there are no TODOs,
 report the review complete.
 

{codejury-0.16.1/codejury/data/agent → codejury-0.17.1/codejury/data/methodology}/security-review-memory.md

@@ -1,4 +1,4 @@
-# Security Review Memory — <project>
+# Security Review Memory: <project>
 
 > Maintained by the security-review agent. Read at the start of every round,
 > updated at the end. It skips confirmed false positives, avoids re-reporting
@@ -22,7 +22,7 @@
 
 ## High-risk areas (weight every round)
 
-<!-- - `<path>` — <reason, e.g. past auth bypass> -->
+<!-- - `<path>`: <reason, for example a past auth bypass> -->
 
 ## Audit history
 

{codejury-0.16.1 → codejury-0.17.1}/codejury/data/rules/SKILL.md

@@ -8,7 +8,7 @@ description: "Application security rules for reviewing code for exploitable vuln
 Application-security rules, one file per weakness class under `rules/`, named by
 the specific weakness (CWE-style). Each rule states impact, the markers to hunt
 (`triggers`), and vulnerable-vs-secure examples. The diff-audit engine injects the
-rules relevant to a change into the prompt; the repo-review agent reads them for
+rules relevant to a change into the prompt. The repo-review agent reads them for
 the target's stack. A finding's `category` is one of these ids.
 
 ## Rules by OWASP category

{codejury-0.16.1 → codejury-0.17.1}/codejury/data/rules/code-injection.md

@@ -8,7 +8,7 @@ triggers: ["eval(", "exec(", "compile(", "pickle.loads", "new Function", "setTim
 
 ## Code Injection
 
-Passing untrusted input to a language evaluation primitive (eval, exec, compile, dynamic import, JS Function) lets an attacker execute arbitrary code. Never evaluate untrusted input; parse it with a data-only parser or dispatch through an allowlist.
+Passing untrusted input to a language evaluation primitive (eval, exec, compile, dynamic import, JS Function) lets an attacker execute arbitrary code. Never evaluate untrusted input. Parse it with a data-only parser or dispatch through an allowlist.
 
 ### Python
 Vulnerable:

{codejury-0.16.1 → codejury-0.17.1}/codejury/data/rules/command-injection.md

@@ -8,7 +8,7 @@ triggers: ["os.system", "os.popen", "subprocess", "shell=True", "Runtime.getRunt
 
 ## Command Injection
 
-Passing untrusted input to a shell lets an attacker run arbitrary commands. Never build a shell string from input; pass an argument list with the shell disabled.
+Passing untrusted input to a shell lets an attacker run arbitrary commands. Never build a shell string from input. Pass an argument list with the shell disabled.
 
 ### Python
 Vulnerable:

{codejury-0.16.1 → codejury-0.17.1}/codejury/data/rules/cross-site-request-forgery.md

@@ -18,4 +18,4 @@ Vulnerable:
 def change_email():
     current_user.email = request.form["email"]; db.commit()
 ```
-Secure: keep CSRF protection on; validate the token, or set the session cookie `SameSite="Lax"` and check the Origin header.
+Secure: keep CSRF protection on. Validate the token, or set the session cookie `SameSite="Lax"` and check the Origin header.

{codejury-0.16.1 → codejury-0.17.1}/codejury/data/rules/cross-site-scripting.md

@@ -22,4 +22,4 @@ el.textContent = "Hello " + username;
 
 ### Python (templates)
 Vulnerable: `return render_template_string("<div>" + user_input + "</div>")`
-Secure: rely on Jinja auto-escaping; never apply `| safe` to user data.
+Secure: rely on Jinja auto-escaping. Never apply `| safe` to user data.

{codejury-0.16.1 → codejury-0.17.1}/codejury/data/rules/hardcoded-secrets.md

@@ -8,7 +8,7 @@ triggers: ["api_key =", "API_KEY =", "password =", "secret =", "token =", "sk_li
 
 ## Hardcoded Secrets
 
-A literal credential, key, or token in source leaks with the code and cannot be rotated easily. Load secrets from environment variables or a secret manager. A variable that reads from the environment or is passed in as a parameter is fine; only an actual literal value is a finding.
+A literal credential, key, or token in source leaks with the code and cannot be rotated easily. Load secrets from environment variables or a secret manager. A variable that reads from the environment or is passed in as a parameter is fine. Only an actual literal value is a finding.
 
 ### Python
 Vulnerable:

{codejury-0.16.1 → codejury-0.17.1}/codejury/data/rules/http-response-splitting.md

@@ -8,7 +8,7 @@ triggers: ["set_header", "add_header", "Location", "Set-Cookie", "response.heade
 
 ## HTTP Response Splitting / Header Injection
 
-Putting untrusted input into a response header (or redirect Location, Set-Cookie) without stripping CR/LF lets an attacker inject headers or split the response. Strip or reject newline characters in any header value built from input; frameworks often do this, but manual header construction may not.
+Putting untrusted input into a response header (or redirect Location, Set-Cookie) without stripping CR/LF lets an attacker inject headers or split the response. Strip or reject newline characters in any header value built from input. Frameworks often do this, but manual header construction may not.
 
 ### Python
 Vulnerable:

{codejury-0.16.1 → codejury-0.17.1}/codejury/data/rules/improper-authentication.md

@@ -8,7 +8,7 @@ triggers: ["login", "authenticate", "password ==", "== token", "auth", "bypass",
 
 ## Improper Authentication
 
-Authentication is missing on a protected path, can be bypassed by a logic flaw, or compares credentials unsafely (a hardcoded bypass token, a non-constant-time compare, trusting a client-asserted identity). Verify identity server-side against a trusted store before granting access; compare secrets in constant time.
+Authentication is missing on a protected path, can be bypassed by a logic flaw, or compares credentials unsafely (a hardcoded bypass token, a non-constant-time compare, trusting a client-asserted identity). Verify identity server-side against a trusted store before granting access. Compare secrets in constant time.
 
 ### Python
 Vulnerable:

{codejury-0.16.1 → codejury-0.17.1}/codejury/data/rules/missing-authorization.md

@@ -8,7 +8,7 @@ triggers: ["@app.route", "@router", "@login_required", "requires_", "permission"
 
 ## Missing Authorization
 
-A privileged or state-changing endpoint performs its action without verifying the caller is allowed to, or derives the role/permission from a client-controlled value. Enforce authorization server-side, per request, from a trusted store; a route that mutates or exposes privileged data must check the caller's rights the same way its peers do.
+A privileged or state-changing endpoint performs its action without verifying the caller is allowed to, or derives the role/permission from a client-controlled value. Enforce authorization server-side, per request, from a trusted store. A route that mutates or exposes privileged data must check the caller's rights the same way its peers do.
 
 ### Python
 Vulnerable:

{codejury-0.16.1 → codejury-0.17.1}/codejury/data/rules/server-side-template-injection.md

@@ -8,7 +8,7 @@ triggers: ["render_template_string", "Template(", "from_string", "Jinja2", "{{",
 
 ## Server-Side Template Injection (SSTI)
 
-Building a template from untrusted input (rather than passing input as template data) lets an attacker inject template syntax that the engine evaluates, often reaching RCE. Pass untrusted values as data to a fixed template; never compile a template from user input.
+Building a template from untrusted input (rather than passing input as template data) lets an attacker inject template syntax that the engine evaluates, often reaching RCE. Pass untrusted values as data to a fixed template. Never compile a template from user input.
 
 ### Python (Jinja2)
 Vulnerable:

{codejury-0.16.1 → codejury-0.17.1}/codejury/data/rules/sql-injection.md

@@ -8,7 +8,7 @@ triggers: ["execute(", "executemany", ".raw(", "cursor", "SELECT ", "INSERT ", "
 
 ## SQL Injection
 
-Untrusted input concatenated or interpolated into a SQL statement lets an attacker change the query. Use parameterized queries / bound parameters; never build SQL from input. Identifiers (table/column names) cannot be parameterized, so validate them against an allowlist.
+Untrusted input concatenated or interpolated into a SQL statement lets an attacker change the query. Use parameterized queries / bound parameters. Never build SQL from input. Identifiers (table/column names) cannot be parameterized, so validate them against an allowlist.
 
 ### Python
 Vulnerable:

{codejury-0.16.1 → codejury-0.17.1}/codejury/diff/debate.py

@@ -34,7 +34,7 @@ class AdversarialResult:
     investigate: list[dict] = field(default_factory=list)
     rounds: int = 0
     converged: bool = False
-    degraded: bool = False  # the judge response was unusable; findings are the unjudged fallback
+    degraded: bool = False  # the judge response was unusable, findings are the unjudged fallback
 
 
 def _dicts(items: object) -> list[dict]:
@@ -91,16 +91,16 @@ class AdversarialAuditRunner:
     ) -> None:
         self._provider = provider
         self._max_tokens = max_tokens
-        # each role can run on its own model (a strong finder, a skeptical
-        # challenger, a careful judge); each defaults to the base model.
+        # each role can run on its own model, each defaults to the base model
         self._finder_model = finder_model or model
         self._challenger_model = challenger_model or model
         self._judge_model = judge_model or model
 
     def _ask(self, system: str, prompt: str, model: str) -> tuple[dict, bool]:
-        """Returns (parsed object, ok). ok is False when the response could not be
-        parsed into a JSON object (a provider error page, a blocked request, prose),
-        so the caller can avoid treating an unusable reply as an empty result."""
+        """Return the parsed object and an ok flag. ok is False when the response
+        could not be parsed into a JSON object, for example a provider error page,
+        a blocked request, or prose, so the caller does not treat an unusable reply
+        as an empty result."""
         try:
             result = self._provider.complete(
                 system=system,
@@ -109,15 +109,15 @@ class AdversarialAuditRunner:
                 max_tokens=self._max_tokens,
             )
         except Exception:
-            # a provider error (exhausted retries, blank body, transport failure)
-            # is an unusable reply, not an empty result; degrade gracefully
+            # a provider error such as exhausted retries or a transport failure
+            # is an unusable reply, not an empty result, so degrade gracefully
             return {}, False
         obj = extract_json_object(result.text)
         return (obj or {}), bool(obj)
 
     def run(self, diff: str, *, rules: str = "", context: str = "", max_rounds: int = 3) -> AdversarialResult:
         if not rules:
-            rules = rules_for_diff(diff)  # inject the rules relevant to this diff
+            rules = rules_for_diff(diff)
         prior: list[dict] = []
         prev_keys: set | None = None
         judged = AdversarialResult(findings=[])
@@ -142,14 +142,13 @@ class AdversarialAuditRunner:
             verdict, judge_ok = self._ask(JUDGE_SYSTEM, jp, self._judge_model)
             if not judge_ok:
                 # the judge is the filter that controls false positives, and an
-                # unusable reply is often transient (a flaky proxy, a blocked
-                # request); re-ask once before giving up on it
+                # unusable reply is usually transient, so re-ask once before degrading
                 verdict, judge_ok = self._ask(JUDGE_SYSTEM, jp, self._judge_model)
             if not judge_ok:
                 # judge still unusable: degrade, but apply the recall-safe
-                # challenger's dismissals so a transient judge outage does not pass
-                # through findings the challenger already showed are safe (this is
-                # what otherwise inflates false positives in degraded runs)
+                # challenger dismissals so a transient judge outage does not pass
+                # through findings the challenger already showed are safe. without
+                # this the degraded fallback inflates false positives
                 fallback = _dedup(_apply_dismissals(finder_findings, rebuttals) + new_findings)
                 judged = AdversarialResult(findings=findings_from_list(fallback), rounds=rounds, degraded=True)
                 degraded = True

{codejury-0.16.1 → codejury-0.17.1}/codejury/diff/debate_prompts.py

@@ -26,7 +26,7 @@ _FINDING_FIELDS = (
 
 FINDER_SYSTEM = (
     "You are a red-team application security engineer. Enumerate every plausible "
-    "exploitable vulnerability an attacker could reach; do not self-censor or pre-filter "
+    "exploitable vulnerability an attacker could reach. Do not self-censor or pre-filter "
     "for fear of false positives, the Challenger and Judge will do that. Respond with a "
     "single JSON object and nothing else."
 )
@@ -102,7 +102,7 @@ def judge_prompt(diff: str, finder_findings: list, rebuttals: list, new_findings
         "- UNRESOLVED: cannot decide from the code shown -> put it in `unresolved`.\n"
         "- INVESTIGATE: needs a dynamic/runtime check to confirm -> put it in `investigate`.\n"
         "Set `converged` to true when this round surfaced no new confirmed finding and nothing is left to "
-        "investigate; false if another round could still change the ruling.\n\n"
+        "investigate. Set it to false if another round could still change the ruling.\n\n"
         f"Code change (unified diff):\n```diff\n{diff}\n```\n\n{context_block}"
         f"Finder findings:\n{json.dumps(finder_findings, ensure_ascii=False)}\n\n"
         f"Challenger rebuttals:\n{json.dumps(rebuttals, ensure_ascii=False)}\n\n"

{codejury-0.16.1 → codejury-0.17.1}/codejury/diff/engine.py

@@ -7,12 +7,25 @@ coverage and lower false positives.
 
 from __future__ import annotations
 
+import re
+
 from codejury.domain.finding import Finding, findings_from_list
 from codejury.diff.prompts import SYSTEM, standard_audit_prompt
 from codejury.diff.rules import rules_for_diff
+from codejury.guides import select_guides
 from codejury.json_parse import extract_json_object
 from codejury.providers.base import Message, Provider
-from codejury.guides import guides_for_diff
+
+_DIFF_PATH = re.compile(r"^(?:\+\+\+ b/|diff --git a/\S+ b/)(\S+)", re.MULTILINE)
+
+
+def guides_for_diff(diff: str) -> str:
+    """Concatenated bodies of the language/framework guides relevant to a diff,
+    selected by its changed paths and its content. Empty when nothing matches.
+    Lives here, not in the shared guides module, because parsing a diff is a
+    diff-path concern."""
+    paths = _DIFF_PATH.findall(diff)
+    return "\n\n---\n\n".join(g.body for g in select_guides(paths, text=diff))
 
 
 class AuditError(RuntimeError):
@@ -33,8 +46,8 @@ class AuditRunner:
 
     def run(self, diff: str, *, rules: str = "", context: str = "") -> list[Finding]:
         if not rules:
-            rules = rules_for_diff(diff)  # inject the rules relevant to this diff
-        stack = guides_for_diff(diff)     # inject the target's language/framework conventions
+            rules = rules_for_diff(diff)
+        stack = guides_for_diff(diff)
         result = self._provider.complete(
             system=SYSTEM,
             messages=[Message(role="user", content=standard_audit_prompt(diff, rules=rules, context=context, stack=stack))],
@@ -44,8 +57,8 @@ class AuditRunner:
         obj = extract_json_object(result.text)
         if obj is None or "findings" not in obj:
             raise AuditError(
-                "the model reply was not a valid audit result (no JSON object, or a "
-                "JSON object without a `findings` key); treating it as a failed "
-                "audit rather than a clean pass"
+                "the model reply was not a valid audit result. it had no JSON object, "
+                "or a JSON object without a findings key, so it is a failed audit "
+                "rather than a clean pass"
             )
         return findings_from_list(obj.get("findings"))

{codejury-0.16.1 → codejury-0.17.1}/codejury/diff/prompts.py

@@ -33,7 +33,7 @@ Do NOT report, regardless of severity:
 - Risks that only matter if a production config is leaked (do not assume the code
   shown reflects production configuration).
 For input-driven issues, flag only when untrusted input can plausibly reach the
-sink; a constant, a stored field, trusted config, or an operator-supplied CLI
+sink. A constant, a stored field, trusted config, or an operator-supplied CLI
 argument is not attacker-controlled.
 """
 

{codejury-0.16.1 → codejury-0.17.1}/codejury/diff/rules.py

@@ -12,8 +12,7 @@ from __future__ import annotations
 from dataclasses import dataclass
 from pathlib import Path
 
-import yaml
-
+from codejury.mddoc import iter_md_docs
 from codejury.resources import RULES_DIR
 
 _IMPACT_RANK = {"CRITICAL": 3, "HIGH": 2, "MEDIUM": 1, "LOW": 0}
@@ -29,31 +28,19 @@ class Rule:
     body: str
 
 
-def _parse(path: Path) -> Rule | None:
-    text = path.read_text(encoding="utf-8")
-    meta: dict = {}
-    body = text
-    if text.startswith("---"):
-        parts = text.split("---", 2)
-        if len(parts) == 3:
-            meta = yaml.safe_load(parts[1]) or {}
-            body = parts[2].strip()
-    return Rule(
-        id=path.stem,
-        title=str(meta.get("title", path.stem)),
-        impact=str(meta.get("impact", "MEDIUM")).upper(),
-        tags=tuple(meta.get("tags", [])),
-        triggers=tuple(str(t) for t in meta.get("triggers", [])),
-        body=body,
-    )
-
-
 def load_rules(directory: str | Path = RULES_DIR) -> list[Rule]:
-    root = Path(directory)
-    if not root.is_dir():
-        return []
-    rules = [_parse(p) for p in root.glob("*.md") if p.name != "SKILL.md"]
-    return sorted([r for r in rules if r], key=lambda r: r.id)
+    rules = [
+        Rule(
+            id=path.stem,
+            title=str(meta.get("title", path.stem)),
+            impact=str(meta.get("impact", "MEDIUM")).upper(),
+            tags=tuple(meta.get("tags", [])),
+            triggers=tuple(str(t) for t in meta.get("triggers", [])),
+            body=body,
+        )
+        for path, meta, body in iter_md_docs(directory)
+    ]
+    return sorted(rules, key=lambda r: r.id)
 
 
 def select_rules(diff: str, rules: list[Rule], *, limit: int = 6) -> list[Rule]:

{codejury-0.16.1 → codejury-0.17.1}/codejury/domain/__init__.py

@@ -1,5 +1,5 @@
 """codejury.domain: the framework's typed data model.
 
-Layers communicate only through these structures; this package depends on no
+Layers communicate only through these structures. This package depends on no
 concrete implementation (Provider / Source / ...).
 """

{codejury-0.16.1 → codejury-0.17.1}/codejury/domain/finding.py

@@ -30,10 +30,10 @@ class Finding:
 
 
 def _to_float(value: object, default: float) -> float:
-    if isinstance(value, bool):
+    if isinstance(value, bool) or not isinstance(value, (int, float, str)):
         return default
     try:
-        f = float(value)  # type: ignore[arg-type]
+        f = float(value)
     except (TypeError, ValueError):
         return default
     return f if 0.0 <= f <= 1.0 else default

{codejury-0.16.1 → codejury-0.17.1}/codejury/guides.py

@@ -13,16 +13,11 @@ code change, which keeps the unbounded language/framework axis out of code.
 from __future__ import annotations
 
 import fnmatch
-import re
 from dataclasses import dataclass
-from pathlib import Path
-
-import yaml
 
+from codejury.mddoc import iter_md_docs
 from codejury.resources import FRAMEWORKS_DIR, LANGUAGES_DIR
 
-_DIFF_PATH = re.compile(r"^(?:\+\+\+ b/|diff --git a/\S+ b/)(\S+)", re.MULTILINE)
-
 
 @dataclass(frozen=True, kw_only=True)
 class Guide:
@@ -32,18 +27,11 @@ class Guide:
     detect_files: tuple[str, ...]
     detect_manifest: tuple[str, ...]
     detect_imports: tuple[str, ...]
+    entrypoint_files: tuple[str, ...]   # globs for files likely to define entrypoints
     body: str
 
 
-def _parse(path: Path, kind: str) -> Guide:
-    text = path.read_text(encoding="utf-8")
-    meta: dict = {}
-    body = text
-    if text.startswith("---"):
-        parts = text.split("---", 2)
-        if len(parts) == 3:
-            meta = yaml.safe_load(parts[1]) or {}
-            body = parts[2].strip()
+def _guide(path, meta: dict, body: str, kind: str) -> Guide:
     detect = meta.get("detect", {}) or {}
     return Guide(
         id=str(meta.get("id", path.stem)),
@@ -52,16 +40,24 @@ def _parse(path: Path, kind: str) -> Guide:
         detect_files=tuple(str(f) for f in detect.get("files", [])),
         detect_manifest=tuple(str(m).lower() for m in detect.get("manifest", [])),
         detect_imports=tuple(str(i) for i in detect.get("imports", [])),
+        entrypoint_files=tuple(str(g) for g in meta.get("entrypoint_files", [])),
         body=body,
     )
 
 
+def entrypoint_globs(guides: list[Guide]) -> tuple[str, ...]:
+    """The entrypoint-file globs declared by a set of guides, deduplicated."""
+    seen: dict[str, None] = {}
+    for g in guides:
+        for pat in g.entrypoint_files:
+            seen.setdefault(pat, None)
+    return tuple(seen)
+
+
 def load_guides(languages_dir=LANGUAGES_DIR, frameworks_dir=FRAMEWORKS_DIR) -> list[Guide]:
     out: list[Guide] = []
     for directory, kind in ((languages_dir, "language"), (frameworks_dir, "framework")):
-        root = Path(directory)
-        if root.is_dir():
-            out += [_parse(p, kind) for p in sorted(root.glob("*.md")) if p.name != "SKILL.md"]
+        out += [_guide(path, meta, body, kind) for path, meta, body in iter_md_docs(directory)]
     return out
 
 
@@ -77,21 +73,9 @@ def _matches(guide: Guide, files: list[str], text: str) -> bool:
 
 def select_guides(files, *, text: str = "", guides: list[Guide] | None = None) -> list[Guide]:
     """The guides whose detect signals fire on the target, languages first then
-    frameworks. `files` are the target's file paths; `text` is content to scan for
+    frameworks. `files` are the target's file paths. `text` is content to scan for
     manifest substrings and import markers (a repo's manifests, or a diff body)."""
     pool = load_guides() if guides is None else guides
     file_list = list(files)
     blob = text.lower()
     return [g for g in pool if _matches(g, file_list, blob)]
-
-
-def _changed_paths(diff: str) -> list[str]:
-    """The file paths touched by a unified diff (from its `+++ b/` / `diff --git` headers)."""
-    return _DIFF_PATH.findall(diff)
-
-
-def guides_for_diff(diff: str, *, guides: list[Guide] | None = None) -> str:
-    """Concatenated bodies of the language/framework guides relevant to a diff, by
-    its changed paths and its content. Empty when nothing matches."""
-    selected = select_guides(_changed_paths(diff), text=diff, guides=guides)
-    return "\n\n---\n\n".join(g.body for g in selected)