cyfendo 2.0.0__tar.gz

cyfendo-2.0.0/PKG-INFO

@@ -0,0 +1,59 @@
+Metadata-Version: 2.4
+Name: cyfendo
+Version: 2.0.0
+Summary: Lightweight, zero-dependency CLI scanner for the Cyfendo Autonomous Security Platform
+Author: Cyfendo Security Team
+Author-email: Cyfendo Security Team <contact@cyfendo.com>
+License-Expression: MIT
+Project-URL: Homepage, https://cyfendo.com
+Project-URL: Documentation, https://cyfendo.com/docs
+Project-URL: Developer Settings, https://cyfendo.com/settings/developer
+Keywords: security,sast,vulnerability-scanner,appsec,cyfendo,patching
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.8
+Classifier: Programming Language :: Python :: 3.9
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Operating System :: OS Independent
+Classifier: Topic :: Security
+Classifier: Topic :: Software Development :: Quality Assurance
+Requires-Python: >=3.8
+Description-Content-Type: text/markdown
+Dynamic: author
+Dynamic: requires-python
+
+# Cyfendo CLI
+
+> **Fast, zero-dependency command-line interface for Cyfendo Autonomous Security Platform.**
+
+## Installation
+
+```bash
+# Global pip install
+pip install cyfendo
+
+# Or install in editable/development mode
+pip install -e ./cli
+```
+
+## Quick Start
+
+```bash
+# 1. Authenticate with your Cyfendo API Key
+cyfendo login --key cy_live_xxxxxxxxxxxxxxxx
+
+# 2. Run a vulnerability scan in the current directory
+cyfendo scan .
+
+# 3. Target an existing protected project
+cyfendo scan . --project "payment-gateway"
+
+# 4. View and export individual AI remediation patches
+cyfendo patches
+cyfendo patch fnd_8b22 --show
+cyfendo patch fnd_8b22 --apply
+
+# 5. CI/CD automation with SARIF export and threshold gate
+cyfendo scan . --fail-on=high --sarif=results.sarif --no-interactive
+```

cyfendo-2.0.0/README.md

@@ -0,0 +1,34 @@
+# Cyfendo CLI
+
+> **Fast, zero-dependency command-line interface for Cyfendo Autonomous Security Platform.**
+
+## Installation
+
+```bash
+# Global pip install
+pip install cyfendo
+
+# Or install in editable/development mode
+pip install -e ./cli
+```
+
+## Quick Start
+
+```bash
+# 1. Authenticate with your Cyfendo API Key
+cyfendo login --key cy_live_xxxxxxxxxxxxxxxx
+
+# 2. Run a vulnerability scan in the current directory
+cyfendo scan .
+
+# 3. Target an existing protected project
+cyfendo scan . --project "payment-gateway"
+
+# 4. View and export individual AI remediation patches
+cyfendo patches
+cyfendo patch fnd_8b22 --show
+cyfendo patch fnd_8b22 --apply
+
+# 5. CI/CD automation with SARIF export and threshold gate
+cyfendo scan . --fail-on=high --sarif=results.sarif --no-interactive
+```

cyfendo-2.0.0/cyfendo/__init__.py

@@ -0,0 +1,7 @@
+"""
+Cyfendo CLI - Lightweight Local Scanner
+Fast, zero-dependency command-line interface for the Cyfendo Autonomous Security Platform.
+"""
+
+__version__ = "2.0.0"
+__author__ = "Cyfendo Security Team"

cyfendo-2.0.0/cyfendo/client.py

@@ -0,0 +1,218 @@
+"""
+Cyfendo API Client Module
+Lightweight HTTP client built entirely with Python standard libraries (urllib).
+Handles API Key authentication, multipart file uploads, and streaming endpoints.
+"""
+
+import os
+import json
+import uuid
+import urllib.request
+import urllib.parse
+import urllib.error
+import ssl
+from pathlib import Path
+from typing import Optional, Dict, Any, Tuple
+try:
+    from . import __version__
+except ImportError:
+    from cyfendo import __version__
+
+
+DEFAULT_SERVER_URL = os.environ.get("CYFENDO_SERVER_URL", "https://cyfendo.com")
+CONFIG_DIR = Path.home() / ".cyfendo"
+CONFIG_FILE = CONFIG_DIR / "config.json"
+
+
+class CyfendoClientError(Exception):
+    """Base exception for Cyfendo API client errors."""
+    def __init__(self, message: str, status_code: Optional[int] = None, response_data: Optional[dict] = None):
+        super().__init__(message)
+        self.status_code = status_code
+        self.response_data = response_data or {}
+
+
+class CyfendoClient:
+    def __init__(self, api_key: Optional[str] = None, server_url: Optional[str] = None):
+        self.config = self.load_config()
+        self.api_key = api_key or os.environ.get("CYFENDO_API_KEY") or self.config.get("api_key")
+        self.server_url = (server_url or os.environ.get("CYFENDO_SERVER_URL") or self.config.get("server_url") or DEFAULT_SERVER_URL).rstrip("/")
+
+    @staticmethod
+    def load_config() -> Dict[str, Any]:
+        """Loads credentials and settings from ~/.cyfendo/config.json."""
+        if CONFIG_FILE.is_file():
+            try:
+                with open(CONFIG_FILE, "r", encoding="utf-8") as f:
+                    return json.load(f)
+            except Exception:
+                return {}
+        return {}
+
+    @classmethod
+    def save_config(cls, api_key: str, server_url: Optional[str] = None) -> None:
+        """Saves authentication credentials to ~/.cyfendo/config.json."""
+        CONFIG_DIR.mkdir(parents=True, exist_ok=True)
+        config_data = cls.load_config()
+        config_data["api_key"] = api_key.strip()
+        if server_url:
+            config_data["server_url"] = server_url.rstrip("/")
+        with open(CONFIG_FILE, "w", encoding="utf-8") as f:
+            json.dump(config_data, f, indent=2)
+        os.chmod(CONFIG_FILE, 0o600)
+
+    @classmethod
+    def clear_config(cls) -> None:
+        """Clears local credentials."""
+        if CONFIG_FILE.is_file():
+            try:
+                os.remove(CONFIG_FILE)
+            except Exception:
+                pass
+
+    def _get_headers(self, content_type: Optional[str] = None) -> Dict[str, str]:
+        """Builds default request headers with Bearer API Key."""
+        headers = {
+            "User-Agent": f"Cyfendo-CLI/{__version__}",
+            "Accept": "application/json"
+        }
+        if self.api_key:
+            headers["Authorization"] = f"Bearer {self.api_key}"
+            headers["X-Cyfendo-Api-Key"] = self.api_key
+        if content_type:
+            headers["Content-Type"] = content_type
+        return headers
+
+    def _make_request(
+        self,
+        path: str,
+        method: str = "GET",
+        data: Optional[bytes] = None,
+        headers: Optional[Dict[str, str]] = None,
+        timeout: int = 60
+    ) -> Tuple[int, Any]:
+        """Executes HTTP request via standard library urllib."""
+        url = f"{self.server_url}{path}" if path.startswith("/") else f"{self.server_url}/{path}"
+        req_headers = self._get_headers()
+        if headers:
+            req_headers.update(headers)
+
+        req = urllib.request.Request(url, data=data, headers=req_headers, method=method)
+        ctx = ssl.create_default_context()
+
+        try:
+            with urllib.request.urlopen(req, timeout=timeout, context=ctx) as response:
+                status_code = response.getcode()
+                content_type = response.headers.get("Content-Type", "")
+                raw_bytes = response.read()
+
+                if "application/json" in content_type:
+                    return status_code, json.loads(raw_bytes.decode("utf-8"))
+                return status_code, raw_bytes
+        except urllib.error.HTTPError as e:
+            err_body = e.read().decode("utf-8", errors="replace")
+            err_json = {}
+            try:
+                err_json = json.loads(err_body)
+                err_msg = err_json.get("error") or err_json.get("message") or str(e)
+            except Exception:
+                err_msg = err_body[:200] if err_body else str(e)
+            raise CyfendoClientError(err_msg, status_code=e.code, response_data=err_json)
+        except urllib.error.URLError as e:
+            raise CyfendoClientError(f"Connection failed to {self.server_url}: {e.reason}")
+        except Exception as e:
+            raise CyfendoClientError(f"Unexpected network error: {str(e)}")
+
+    def whoami(self) -> Dict[str, Any]:
+        """Retrieves authenticated user identity and workspace status."""
+        _, data = self._make_request("/api/v1/cli/whoami")
+        return data
+
+    def list_projects(self) -> Dict[str, Any]:
+        """Retrieves list of active protected projects in workspace."""
+        _, data = self._make_request("/api/v1/cli/status")
+        return data
+
+    def submit_scan(
+        self,
+        zip_bytes: bytes,
+        project_name: str,
+        project_id: Optional[str] = None,
+        scan_profile: str = "deep_agentic",
+        confirm_separate: bool = False,
+        generate_patches: bool = False,
+        dedup_scope: str = "root_cause",
+        benchmark_mode: bool = False
+    ) -> Dict[str, Any]:
+        """
+        Submits workspace archive to the single-shot CLI scan endpoint.
+        Uses pure standard library multipart/form-data encoding.
+        """
+        boundary = f"----CyfendoBoundary{uuid.uuid4().hex}"
+        body_parts = []
+
+        # Form fields
+        fields = {
+            "repo_name": project_name,
+            "scan_profile": scan_profile,
+            "confirm_separate": "true" if confirm_separate else "false",
+            "generate_patches": "true" if generate_patches else "false",
+            "dedup_scope": str(dedup_scope or "root_cause"),
+            "benchmark_mode": "true" if benchmark_mode else "false"
+        }
+        if project_id:
+            fields["project_id"] = project_id
+
+        for k, v in fields.items():
+            body_parts.append(f"--{boundary}\r\n".encode("utf-8"))
+            body_parts.append(f'Content-Disposition: form-data; name="{k}"\r\n\r\n'.encode("utf-8"))
+            body_parts.append(f"{v}\r\n".encode("utf-8"))
+
+        # File part
+        body_parts.append(f"--{boundary}\r\n".encode("utf-8"))
+        body_parts.append(f'Content-Disposition: form-data; name="file"; filename="source.zip"\r\n'.encode("utf-8"))
+        body_parts.append(b"Content-Type: application/zip\r\n\r\n")
+        body_parts.append(zip_bytes)
+        body_parts.append(b"\r\n")
+        body_parts.append(f"--{boundary}--\r\n".encode("utf-8"))
+
+        payload = b"".join(body_parts)
+        content_type = f"multipart/form-data; boundary={boundary}"
+
+        _, data = self._make_request(
+            "/api/v1/cli/scan",
+            method="POST",
+            data=payload,
+            headers={"Content-Type": content_type},
+            timeout=120
+        )
+        return data
+
+    def get_scan(self, scan_id: str) -> Dict[str, Any]:
+        """Retrieves scan details, summary, and findings."""
+        _, data = self._make_request(f"/api/v1/scans/{scan_id}")
+        return data
+
+    def get_patches(self, scan_id: str) -> Dict[str, Any]:
+        """Retrieves all finding patches for scan."""
+        _, data = self._make_request(f"/api/v1/scans/{scan_id}/patches")
+        return data
+
+    def get_sarif(self, scan_id: str) -> Dict[str, Any]:
+        """Retrieves standard SARIF 2.1.0 report."""
+        _, data = self._make_request(f"/api/v1/scans/{scan_id}/export/sarif")
+        return data
+
+    def get_markdown_report(self, scan_id: str) -> str:
+        """Retrieves full Markdown audit report text."""
+        _, data = self._make_request(f"/api/v1/scans/{scan_id}/export/markdown")
+        if isinstance(data, bytes):
+            return data.decode("utf-8", errors="replace")
+        return str(data)
+
+    def get_unified_patch(self, scan_id: str) -> str:
+        """Retrieves aggregated unified diff patch file."""
+        _, data = self._make_request(f"/api/v1/scans/{scan_id}/export/patch")
+        if isinstance(data, bytes):
+            return data.decode("utf-8", errors="replace")
+        return str(data)

cyfendo-2.0.0/cyfendo/events.py

@@ -0,0 +1,81 @@
+"""
+Live Telemetry & SSE Streaming Module
+Connects to Cyfendo Server-Sent Events (SSE) endpoint to stream live multi-agent scanning progress.
+"""
+
+import json
+import time
+import urllib.request
+import ssl
+from typing import Callable, Optional, Dict, Any
+
+
+class SSEStreamError(Exception):
+    pass
+
+
+def stream_scan_events(
+    server_url: str,
+    scan_id: str,
+    api_key: Optional[str] = None,
+    on_event: Optional[Callable[[Dict[str, Any]], None]] = None,
+    timeout: int = 300
+) -> Dict[str, Any]:
+    """
+    Subscribes to /api/v1/scans/<scan_id>/events and yields live telemetry events.
+    Returns the final completion event payload.
+    """
+    url = f"{server_url.rstrip('/')}/api/v1/scans/{scan_id}/events"
+    headers = {
+        "Accept": "text/event-stream",
+        "Cache-Control": "no-cache",
+        "User-Agent": "Cyfendo-CLI/2.0.0"
+    }
+    if api_key:
+        headers["Authorization"] = f"Bearer {api_key}"
+        headers["X-Cyfendo-Api-Key"] = api_key
+
+    req = urllib.request.Request(url, headers=headers, method="GET")
+    ctx = ssl.create_default_context()
+    
+    start_time = time.time()
+    last_event: Dict[str, Any] = {"stage": "running", "progress_percentage": 0}
+
+    try:
+        with urllib.request.urlopen(req, timeout=timeout, context=ctx) as response:
+            buffer = ""
+            for raw_chunk in response:
+                if time.time() - start_time > timeout:
+                    raise SSEStreamError(f"Scan telemetry stream timed out after {timeout} seconds.")
+
+                chunk = raw_chunk.decode("utf-8", errors="replace")
+                buffer += chunk
+
+                while "\n\n" in buffer:
+                    message_block, buffer = buffer.split("\n\n", 1)
+                    lines = message_block.split("\n")
+                    
+                    event_data = None
+                    for line in lines:
+                        line = line.strip()
+                        if line.startswith("data:"):
+                            raw_data = line[5:].strip()
+                            try:
+                                event_data = json.loads(raw_data)
+                            except Exception:
+                                event_data = {"message": raw_data}
+
+                    if event_data:
+                        last_event = event_data
+                        if on_event:
+                            on_event(event_data)
+
+                        stage = event_data.get("stage", "")
+                        if stage in ("completed", "failed", "cancelled"):
+                            return last_event
+
+    except (urllib.error.URLError, OSError) as e:
+        # If SSE stream drops, return last observed state
+        return last_event
+
+    return last_event