codejury 0.20.0__tar.gz → 0.22.0__tar.gz

{codejury-0.20.0 → codejury-0.22.0}/PKG-INFO

@@ -1,7 +1,7 @@
 Metadata-Version: 2.4
 Name: codejury
-Version: 0.20.0
-Summary: AI code security review for diffs and whole repositories.
+Version: 0.22.0
+Summary: AI code security review for diffs and repos.
 Author: AISecLabs
 License-Expression: MIT
 Project-URL: Homepage, https://github.com/aiseclabs/codejury
@@ -38,25 +38,15 @@ Dynamic: license-file
  ╚═════╝ ╚═════╝ ╚═════╝ ╚══════╝ ╚════╝  ╚═════╝ ╚═╝  ╚═╝   ╚═╝
 ```
 
-> AI code security review for diffs and whole repositories.
+An AI code security review tool. It works two ways. `review diff` audits a pull
+request diff for newly introduced exploitable risk in one command. `review repo`
+sets up an interactive agent such as Claude Code or Codex to audit a whole
+repository, mapping the attack surface, tracing inputs to sinks across files, and
+verifying each issue with a real PoC.
 
-codejury runs two paths matched to their nature.
-
-- **Diff Review** is coded. It audits a pull request diff for newly introduced
-  exploitable risk, as a single balanced LLM call or an adversarial Finder,
-  Challenger, and Judge pass that trades roughly 3x the cost for extra recall on
-  subtle flaws that span files. One command in, findings out.
-- **Repo Review** is agent driven. A whole repository is too large for one LLM
-  call, so codejury scaffolds a workspace and hands an interactive agent such as
-  Claude Code or Codex a methodology to run. The agent maps the attack surface,
-  traces inputs to sinks across files, verifies issues with a real PoC, and
-  iterates over rounds with a persistent memory.
-
-Security knowledge is data, not code. Vulnerability classes live in
-`codejury/data/vulnerabilities/*.md` with a vulnerable and a secure example per
-language, and the stack guides live under `data/languages`, `data/frameworks`,
-and `data/protocols`. The engine stays language neutral and names no framework,
-so adding a stack is a drop-in markdown file.
+Security knowledge is data, not code. Drop-in markdown guides hold the
+vulnerability classes, languages, frameworks, and protocols, so the engine names
+no language and adding a stack is a new file.
 
 ## Install
 
@@ -67,37 +57,80 @@ codejury install-slash-command             # Claude Code, ~/.claude/commands/
 codejury install-slash-command --agent codex   # Codex, ~/.codex/prompts/
 ```
 
-`install-slash-command` copies the `/codejury-review` command into the agent's
-command directory. The command body is the same for every agent, only the
-directory differs, so pass `--dir` for any other agent. The repo review itself is
-agent neutral, so even without the command you can run `codejury review` and
-tell any agent to follow the methodology it writes.
+`install-slash-command` copies the `/codejury-review-repo` command into the
+agent's command directory. The command body is the same for every agent, only the
+directory differs, so pass `--dir` for any other agent.
 
 ## Diff Review
 
+The coded engine. It audits a diff in one command, as a single balanced LLM call
+or an adversarial Finder, Challenger, and Judge pass that trades roughly 3x the
+cost for extra recall on subtle flaws that span files.
+
 ```bash
-# audit a diff file
-codejury diff --diff-file changes.diff
+# a diff file
+codejury review diff --file changes.diff
 
-# audit a git range in a repo
-codejury diff --repo /path/to/app --git-range origin/main...HEAD
+# a git range in a repo
+codejury review diff --repo /path/to/app --git-range origin/main...HEAD
 
 # from stdin
-git diff HEAD~1 | codejury diff
+git diff HEAD~1 | codejury review diff
 
 # adversarial mode, more recall on subtle flaws, about 3x the cost
-codejury diff --diff-file changes.diff --mode adversarial
+codejury review diff --file changes.diff --mode adversarial
 
 # CI gate and SARIF
-codejury diff --diff-file changes.diff --format sarif --fail-on high
+codejury review diff --file changes.diff --format sarif --fail-on high
 ```
 
 Configure a backend with `--provider`, `--model`, `--api-key`, `--api-base`, or
 the `CODEJURY_API_KEY`, `CODEJURY_MODEL`, and `CODEJURY_API_BASE` environment
-variables. `codejury diff --dry-run` exercises the engine with a mock
+variables. `codejury review diff --dry-run` exercises the engine with a mock
 provider and no key, and falls back to a built in demo diff when you pass none.
 
-### Choosing a Model and Mode
+## Repo Review
+
+The agent path. A whole repo is too large for one LLM call, so this sets up a
+review for an interactive agent rather than running a pipeline.
+
+```bash
+codejury review repo /path/to/your/repo
+```
+
+It detects the stack, seeds the entrypoint inventory and the downstream trace
+targets from a deterministic scan, writes the methodology to
+`<workspace>/METHODOLOGY.md`, and prints a short pointer. The workspace:
+
+```
+entrypoints/   the candidate entrypoint files to start from
+issues/        one write-up per confirmed or suspected issue
+pocs/          a runnable PoC per issue, same name as the issue
+analysis/      _trace_targets.md, the round ledger, and trace notes
+METHODOLOGY.md and MEMORY.md
+```
+
+Then run it with an interactive agent. In Claude Code or Codex:
+
+```
+/codejury-review-repo /path/to/your/repo
+```
+
+Any agent works, the slash command is just a shortcut. Without it, tell the agent
+to follow the `METHODOLOGY.md` the scaffold wrote. The agent maps the attack
+surface including non HTTP sources, traces each input to its sink through the
+downstream layers, runs an Authorization Model pass for missing-auth and IDOR,
+and follows a control into a library when an entrypoint delegates it. It iterates
+until a Completeness Gate passes, confirms each issue with a real PoC against a
+sandbox or dev environment, and asks you for any credential it needs. Only a
+reproduced PoC is a confirmed finding, and nothing runs against production.
+
+The supported stacks today are Python with Django, Celery, Flask, and FastAPI,
+Go with Gin and Echo, JavaScript and TypeScript with Express and NestJS, and the
+OAuth and OIDC protocol. The methodology still works on an unguided stack, it just
+leans more on the agent's own knowledge.
+
+## Choosing a Model and Mode
 
 Detection quality is dominated by the model first, then the mode. On real diff
 probes:
@@ -113,7 +146,7 @@ Default to standard mode with a strong model, set with `--model` or
 `CODEJURY_MODEL`. False positives are held down by the do not report list and the
 post filter, not by the mode.
 
-### Use in CI with GitHub Actions
+## Use in CI with GitHub Actions
 
 Audit every pull request and surface findings in the code scanning tab. Copy
 `examples/codejury-pr-review.yml` into `.github/workflows/`, add a
@@ -127,52 +160,6 @@ The job makes one model call per pull request in standard mode. The SARIF is
 uploaded even when the gate fails, so findings always show up on the pull
 request.
 
-## Repo Review
-
-Repo Review does not scan and print findings. It sets up a review for an agent to
-run, because a whole repository needs many rounds of reading, cross-file tracing,
-and PoC work that an agent does, not a single call.
-
-```bash
-codejury review /path/to/your/repo
-```
-
-This detects the stack, seeds the entrypoint inventory and the downstream trace
-targets from a deterministic scan, writes the methodology to
-`<workspace>/METHODOLOGY.md`, and prints a short pointer. It creates the
-workspace:
-
-```
-entrypoints/   the candidate entrypoint files to start from
-issues/        one write-up per confirmed or suspected issue
-pocs/          a runnable PoC per issue, same name as the issue
-analysis/      _trace_targets.md, the round ledger, and trace notes
-security-review-memory.md
-```
-
-Then run it with an interactive agent. In Claude Code or Codex:
-
-```
-/codejury-review /path/to/your/repo
-```
-
-Any agent works, the slash command is just a shortcut. Without it, tell the agent
-to follow the `METHODOLOGY.md` the scaffold wrote.
-
-The agent follows `METHODOLOGY.md`: it maps the attack surface including non HTTP
-sources, traces each input to its sink through the downstream layers, runs an
-Authorization Model pass for missing-auth and IDOR, and follows a control into a
-library when an entrypoint delegates it. It keeps going until a Completeness Gate
-passes, two consecutive rounds that add nothing new. It confirms each issue with
-a real PoC against a sandbox or dev environment and asks you for any credential or
-test data it needs. Only a reproduced PoC is a confirmed finding, and nothing
-runs against production.
-
-The supported stacks today are Python with Django, Celery, Flask, and FastAPI,
-Go with Gin and Echo, JavaScript and TypeScript with Express and NestJS, and the
-OAuth and OIDC protocol. The methodology still works on an unguided stack, it just
-leans more on the agent's own knowledge.
-
 ## Findings
 
 Each finding carries a file and line, a severity and category, a concrete exploit
@@ -194,4 +181,3 @@ change.
   entrypoint markers, and downstream logic layers.
 - A protocol such as OAuth: `codejury/data/protocols/<name>.md`, detected by
   language neutral content tokens.
-```

{codejury-0.20.0 → codejury-0.22.0}/README.md

@@ -7,25 +7,15 @@
  ╚═════╝ ╚═════╝ ╚═════╝ ╚══════╝ ╚════╝  ╚═════╝ ╚═╝  ╚═╝   ╚═╝
 ```
 
-> AI code security review for diffs and whole repositories.
-
-codejury runs two paths matched to their nature.
-
-- **Diff Review** is coded. It audits a pull request diff for newly introduced
-  exploitable risk, as a single balanced LLM call or an adversarial Finder,
-  Challenger, and Judge pass that trades roughly 3x the cost for extra recall on
-  subtle flaws that span files. One command in, findings out.
-- **Repo Review** is agent driven. A whole repository is too large for one LLM
-  call, so codejury scaffolds a workspace and hands an interactive agent such as
-  Claude Code or Codex a methodology to run. The agent maps the attack surface,
-  traces inputs to sinks across files, verifies issues with a real PoC, and
-  iterates over rounds with a persistent memory.
-
-Security knowledge is data, not code. Vulnerability classes live in
-`codejury/data/vulnerabilities/*.md` with a vulnerable and a secure example per
-language, and the stack guides live under `data/languages`, `data/frameworks`,
-and `data/protocols`. The engine stays language neutral and names no framework,
-so adding a stack is a drop-in markdown file.
+An AI code security review tool. It works two ways. `review diff` audits a pull
+request diff for newly introduced exploitable risk in one command. `review repo`
+sets up an interactive agent such as Claude Code or Codex to audit a whole
+repository, mapping the attack surface, tracing inputs to sinks across files, and
+verifying each issue with a real PoC.
+
+Security knowledge is data, not code. Drop-in markdown guides hold the
+vulnerability classes, languages, frameworks, and protocols, so the engine names
+no language and adding a stack is a new file.
 
 ## Install
 
@@ -36,37 +26,80 @@ codejury install-slash-command             # Claude Code, ~/.claude/commands/
 codejury install-slash-command --agent codex   # Codex, ~/.codex/prompts/
 ```
 
-`install-slash-command` copies the `/codejury-review` command into the agent's
-command directory. The command body is the same for every agent, only the
-directory differs, so pass `--dir` for any other agent. The repo review itself is
-agent neutral, so even without the command you can run `codejury review` and
-tell any agent to follow the methodology it writes.
+`install-slash-command` copies the `/codejury-review-repo` command into the
+agent's command directory. The command body is the same for every agent, only the
+directory differs, so pass `--dir` for any other agent.
 
 ## Diff Review
 
+The coded engine. It audits a diff in one command, as a single balanced LLM call
+or an adversarial Finder, Challenger, and Judge pass that trades roughly 3x the
+cost for extra recall on subtle flaws that span files.
+
 ```bash
-# audit a diff file
-codejury diff --diff-file changes.diff
+# a diff file
+codejury review diff --file changes.diff
 
-# audit a git range in a repo
-codejury diff --repo /path/to/app --git-range origin/main...HEAD
+# a git range in a repo
+codejury review diff --repo /path/to/app --git-range origin/main...HEAD
 
 # from stdin
-git diff HEAD~1 | codejury diff
+git diff HEAD~1 | codejury review diff
 
 # adversarial mode, more recall on subtle flaws, about 3x the cost
-codejury diff --diff-file changes.diff --mode adversarial
+codejury review diff --file changes.diff --mode adversarial
 
 # CI gate and SARIF
-codejury diff --diff-file changes.diff --format sarif --fail-on high
+codejury review diff --file changes.diff --format sarif --fail-on high
 ```
 
 Configure a backend with `--provider`, `--model`, `--api-key`, `--api-base`, or
 the `CODEJURY_API_KEY`, `CODEJURY_MODEL`, and `CODEJURY_API_BASE` environment
-variables. `codejury diff --dry-run` exercises the engine with a mock
+variables. `codejury review diff --dry-run` exercises the engine with a mock
 provider and no key, and falls back to a built in demo diff when you pass none.
 
-### Choosing a Model and Mode
+## Repo Review
+
+The agent path. A whole repo is too large for one LLM call, so this sets up a
+review for an interactive agent rather than running a pipeline.
+
+```bash
+codejury review repo /path/to/your/repo
+```
+
+It detects the stack, seeds the entrypoint inventory and the downstream trace
+targets from a deterministic scan, writes the methodology to
+`<workspace>/METHODOLOGY.md`, and prints a short pointer. The workspace:
+
+```
+entrypoints/   the candidate entrypoint files to start from
+issues/        one write-up per confirmed or suspected issue
+pocs/          a runnable PoC per issue, same name as the issue
+analysis/      _trace_targets.md, the round ledger, and trace notes
+METHODOLOGY.md and MEMORY.md
+```
+
+Then run it with an interactive agent. In Claude Code or Codex:
+
+```
+/codejury-review-repo /path/to/your/repo
+```
+
+Any agent works, the slash command is just a shortcut. Without it, tell the agent
+to follow the `METHODOLOGY.md` the scaffold wrote. The agent maps the attack
+surface including non HTTP sources, traces each input to its sink through the
+downstream layers, runs an Authorization Model pass for missing-auth and IDOR,
+and follows a control into a library when an entrypoint delegates it. It iterates
+until a Completeness Gate passes, confirms each issue with a real PoC against a
+sandbox or dev environment, and asks you for any credential it needs. Only a
+reproduced PoC is a confirmed finding, and nothing runs against production.
+
+The supported stacks today are Python with Django, Celery, Flask, and FastAPI,
+Go with Gin and Echo, JavaScript and TypeScript with Express and NestJS, and the
+OAuth and OIDC protocol. The methodology still works on an unguided stack, it just
+leans more on the agent's own knowledge.
+
+## Choosing a Model and Mode
 
 Detection quality is dominated by the model first, then the mode. On real diff
 probes:
@@ -82,7 +115,7 @@ Default to standard mode with a strong model, set with `--model` or
 `CODEJURY_MODEL`. False positives are held down by the do not report list and the
 post filter, not by the mode.
 
-### Use in CI with GitHub Actions
+## Use in CI with GitHub Actions
 
 Audit every pull request and surface findings in the code scanning tab. Copy
 `examples/codejury-pr-review.yml` into `.github/workflows/`, add a
@@ -96,52 +129,6 @@ The job makes one model call per pull request in standard mode. The SARIF is
 uploaded even when the gate fails, so findings always show up on the pull
 request.
 
-## Repo Review
-
-Repo Review does not scan and print findings. It sets up a review for an agent to
-run, because a whole repository needs many rounds of reading, cross-file tracing,
-and PoC work that an agent does, not a single call.
-
-```bash
-codejury review /path/to/your/repo
-```
-
-This detects the stack, seeds the entrypoint inventory and the downstream trace
-targets from a deterministic scan, writes the methodology to
-`<workspace>/METHODOLOGY.md`, and prints a short pointer. It creates the
-workspace:
-
-```
-entrypoints/   the candidate entrypoint files to start from
-issues/        one write-up per confirmed or suspected issue
-pocs/          a runnable PoC per issue, same name as the issue
-analysis/      _trace_targets.md, the round ledger, and trace notes
-security-review-memory.md
-```
-
-Then run it with an interactive agent. In Claude Code or Codex:
-
-```
-/codejury-review /path/to/your/repo
-```
-
-Any agent works, the slash command is just a shortcut. Without it, tell the agent
-to follow the `METHODOLOGY.md` the scaffold wrote.
-
-The agent follows `METHODOLOGY.md`: it maps the attack surface including non HTTP
-sources, traces each input to its sink through the downstream layers, runs an
-Authorization Model pass for missing-auth and IDOR, and follows a control into a
-library when an entrypoint delegates it. It keeps going until a Completeness Gate
-passes, two consecutive rounds that add nothing new. It confirms each issue with
-a real PoC against a sandbox or dev environment and asks you for any credential or
-test data it needs. Only a reproduced PoC is a confirmed finding, and nothing
-runs against production.
-
-The supported stacks today are Python with Django, Celery, Flask, and FastAPI,
-Go with Gin and Echo, JavaScript and TypeScript with Express and NestJS, and the
-OAuth and OIDC protocol. The methodology still works on an unguided stack, it just
-leans more on the agent's own knowledge.
-
 ## Findings
 
 Each finding carries a file and line, a severity and category, a concrete exploit
@@ -163,4 +150,3 @@ change.
   entrypoint markers, and downstream logic layers.
 - A protocol such as OAuth: `codejury/data/protocols/<name>.md`, detected by
   language neutral content tokens.
-```

codejury-0.22.0/codejury/__init__.py

@@ -0,0 +1,15 @@
+"""AI code security review tool.
+
+Two paths matched to their nature: a coded diff-audit engine, a standard single
+call or an adversarial Finder/Challenger/Judge pass, and a whole-repo review run
+as a methodology by an interactive agent. Security knowledge lives in rich
+markdown vulnerability classes under data/vulnerabilities, injected into the
+audit prompt, not in a rendered schema.
+"""
+
+from importlib.metadata import PackageNotFoundError, version
+
+try:
+    __version__ = version("codejury")
+except PackageNotFoundError:  # running from a source tree without an install
+    __version__ = "0.0.0"

{codejury-0.20.0 → codejury-0.22.0}/codejury/cli.py

@@ -2,14 +2,14 @@
 
 Two paths matched to their nature:
 
-- ``diff`` runs the coded diff engine over a unified diff: a single balanced call
-  (standard) or the adversarial Finder/Challenger/Judge pass.
-- ``review <dir>`` scaffolds a workspace and prints the methodology for an
-  interactive agent to run a whole-repo review (it does not run an LLM pipeline,
-  which a single call cannot do for a whole codebase).
-
-``diff --dry-run`` exercises the engine with a mock provider and no key.
-The audit orchestration itself lives in ``codejury.diff.runner``.
+- ``review diff`` runs the coded diff engine over a unified diff: a single
+  balanced call in standard mode or the adversarial Finder/Challenger/Judge pass.
+- ``review repo <dir>`` scaffolds a workspace and prints the methodology for an
+  interactive agent to run a whole-repo review. It does not run an LLM pipeline,
+  which a single call cannot do for a whole codebase.
+
+``review diff --dry-run`` exercises the engine with a mock provider and no key.
+The audit orchestration itself lives in ``codejury.review.diff.runner``.
 """
 
 from __future__ import annotations
@@ -21,7 +21,7 @@ from pathlib import Path
 
 from codejury import __version__
 from codejury.report import gate, render
-from codejury.diff.runner import audit_diff
+from codejury.review.diff.runner import audit_diff
 from codejury.providers.factory import (
     DEFAULT_API_BASE,
     DEFAULT_API_KEY,
@@ -33,15 +33,15 @@ from codejury.providers.factory import (
     make_provider,
 )
 from codejury.providers.mock import MockProvider
-from codejury.repo.scaffold import scaffold
+from codejury.review.repo.scaffold import scaffold
 
 _FORMATS = ("text", "markdown", "json", "sarif")
 _FAIL_ON = ("critical", "high", "medium", "low")
 
 
 def _read_diff(args) -> str:
-    if args.diff_file:
-        with open(args.diff_file, encoding="utf-8") as f:
+    if args.file:
+        with open(args.file, encoding="utf-8") as f:
             return f.read()
     if args.git_range:
         return subprocess.run(
@@ -66,7 +66,7 @@ _MOCK_REPLY = (
 
 def _add_audit_args(p) -> None:
     """The diff-audit flags for `review diff`."""
-    p.add_argument("--diff-file", default=None, help="unified diff file (default: read stdin)")
+    p.add_argument("--file", default=None, help="unified diff file (default: read stdin)")
     p.add_argument("--repo", default=None, help="repo path for --git-range")
     p.add_argument("--git-range", default=None, help="git range to diff, e.g. origin/main...HEAD")
     p.add_argument("--dry-run", action="store_true",
@@ -93,14 +93,15 @@ def main(argv: list[str] | None = None) -> int:
     parser.add_argument("--version", action="version", version=f"codejury {__version__}")
     sub = parser.add_subparsers(dest="command")
 
-    _add_audit_args(sub.add_parser("diff", help="audit a unified diff (the coded engine)"))
-
-    review = sub.add_parser("review", help="scaffold a whole-repo review for an interactive agent")
-    review.add_argument("directory", help="target repository to review")
-    review.add_argument("--workspace", default="codejury-review", help="where to create the review workspace")
+    review = sub.add_parser("review", help="review code for security findings")
+    rsub = review.add_subparsers(dest="scope")
+    _add_audit_args(rsub.add_parser("diff", help="audit a unified diff (the coded engine)"))
+    repo = rsub.add_parser("repo", help="scaffold a whole-repo review for an interactive agent")
+    repo.add_argument("directory", help="target repository to review")
+    repo.add_argument("--workspace", default="codejury-review", help="where to create the review workspace")
 
     inst = sub.add_parser("install-slash-command",
-                          help="install the /codejury-review slash command for an agent")
+                          help="install the /codejury-review-repo slash command for an agent")
     inst.add_argument("--agent", choices=("claude", "codex"), default="claude",
                       help="which agent's command directory to install into")
     inst.add_argument("--dir", default=None, help="explicit target directory, overrides --agent")
@@ -115,12 +116,13 @@ def main(argv: list[str] | None = None) -> int:
 
 
 def _dispatch(args, parser) -> int:
-    if args.command == "diff":
+    scope = getattr(args, "scope", None)
+    if args.command == "review" and scope == "diff":
         if args.dry_run:
             provider = MockProvider(default=_MOCK_REPLY)
             model = "mock"
             # zero-config smoke test: fall back to a built-in demo diff when none is supplied
-            diff = _read_diff(args) if (args.diff_file or args.git_range) else _dry_run_diff()
+            diff = _read_diff(args) if (args.file or args.git_range) else _dry_run_diff()
         else:
             provider = make_provider(args.provider, api_key=args.api_key, api_base=args.api_base, retries=args.retries)
             model = args.model
@@ -134,7 +136,7 @@ def _dispatch(args, parser) -> int:
         print(render(args.fmt, kept))
         return 1 if gate(kept, args.fail_on) else 0
 
-    if args.command == "review":
+    if args.command == "review" and scope == "repo":
         res = scaffold(args.directory, args.workspace)
         (Path(res.workspace) / "METHODOLOGY.md").write_text(res.methodology, encoding="utf-8")
         print(f"Workspace ready: {res.workspace}", file=sys.stderr)
@@ -146,7 +148,7 @@ def _dispatch(args, parser) -> int:
         print(
             "This command sets up the review, it does not find the issues itself. Next, have an "
             f"interactive agent follow {res.workspace}/METHODOLOGY.md to run the review, or use the "
-            "/codejury-review command in Claude Code or Codex. Findings are written to "
+            "/codejury-review-repo command in Claude Code or Codex. Findings are written to "
             f"{res.workspace}/issues/."
         )
         return 0
@@ -160,13 +162,19 @@ def _dispatch(args, parser) -> int:
         }
         target_dir = Path(args.dir) if args.dir else agent_dirs[args.agent]
         target_dir.mkdir(parents=True, exist_ok=True)
-        name = "codejury-review.md"
+        name = "codejury-review-repo.md"
         dst = target_dir / name
         dst.write_text((COMMANDS_DIR / name).read_text(encoding="utf-8"), encoding="utf-8")
         print(f"Installed slash command to {dst}")
-        print("Run it in the agent with: /codejury-review <repository>")
+        print("Run it in the agent with: /codejury-review-repo <repository>")
         return 0
 
+    if args.command == "review":  # no scope given
+        print("usage: codejury review {diff,repo} ...", file=sys.stderr)
+        print("  diff   audit a unified diff for security findings", file=sys.stderr)
+        print("  repo   scaffold a whole-repo review for an interactive agent", file=sys.stderr)
+        return 1
+
     parser.print_help()
     return 1
 

codejury-0.20.0/codejury/data/commands/codejury-review.md → codejury-0.22.0/codejury/data/commands/codejury-review-repo.md

@@ -1,12 +1,12 @@
 ---
 description: Run a codejury whole-repo security review on a repository, interactively
 ---
-Run a codejury whole-repository security review of: $ARGUMENTS
+Run a codejury whole-repo security review of: $ARGUMENTS
 
 1. Scaffold the workspace:
 
    ```
-   codejury review $ARGUMENTS --workspace /tmp/codejury-review
+   codejury review repo $ARGUMENTS --workspace /tmp/codejury-review
    ```
 
    If `codejury` is not on PATH it is a pip-installed console script, so activate

{codejury-0.20.0 → codejury-0.22.0}/codejury/data/methodologies/repo-review.md

@@ -1,6 +1,6 @@
 # Repo Security Review: Agent Methodology
 
-The `review repo` path: a whole-repository security audit, run by an interactive
+The `review repo` path: a whole-repo security audit, run by an interactive
 coding agent such as Claude Code or Codex, not a one-shot LLM call. It maps the
 attack surface, traces inputs to sinks across files, verifies issues with a real
 PoC, and iterates over multiple rounds with a persistent memory. One round is
@@ -8,13 +8,13 @@ roughly 30 minutes. Run as many rounds as needed.
 
 Target repository: the directory you were given.
 Workspace: `<workspace>/<project>/`, created for you, holding `entrypoints/`,
-`issues/`, `analysis/`, and `security-review-memory.md`.
+`issues/`, `analysis/`, and `MEMORY.md`.
 
 ---
 
 ## On Start
 
-1. Read `security-review-memory.md` in the workspace if it exists:
+1. Read `MEMORY.md` in the workspace if it exists:
    - skip every pattern under "Confirmed false positives".
    - do not re-report anything under "Fixed".
    - weight the files under "High-risk areas" more heavily.
@@ -226,6 +226,6 @@ If any item fails, run another round. State which items pass when you report.
 
 Report the confirmed findings, the ones with a reproduced PoC, separately from
 the suspected ones still blocked on verification, so the two are never conflated.
-Append a row to the audit history in `security-review-memory.md`, and ask the
+Append a row to the audit history in `MEMORY.md`, and ask the
 operator which findings were false positives. Record those under "Confirmed false
 positives" so future rounds skip them.

{codejury-0.20.0 → codejury-0.22.0}/codejury/domain/__init__.py

@@ -1,5 +1,5 @@
 """The framework's typed data model.
 
 Layers communicate only through these structures. This package depends on no
-concrete implementation (Provider / Source / ...).
+concrete implementation such as a Provider or a Source.
 """

{codejury-0.20.0 → codejury-0.22.0}/codejury/domain/finding.py

@@ -45,7 +45,7 @@ def _to_line(value: object) -> int | None:
 
 def finding_from_dict(data: dict[str, Any]) -> Finding | None:
     """Map one loosely-typed model finding onto a Finding, or None if it has no
-    location (invariant: every finding carries a file)."""
+    location, since every finding carries a file, that is the invariant."""
     if not isinstance(data, dict):
         return None
     file = str(data.get("file", "")).strip()