devguard-scanner 0.2.0__tar.gz → 0.3.0__tar.gz

{devguard_scanner-0.2.0 → devguard_scanner-0.3.0}/CHANGELOG.md

@@ -3,6 +3,17 @@
 All notable changes are documented here. The format follows [Keep a Changelog](https://keepachangelog.com/) and
 the project uses [semantic versioning](https://semver.org).
 
+## 0.3.0
+
+- The default drop folder for local scans (`DEVGUARD_API_LOCAL_ROOT`, and the folder `compose.yaml` mounts) is
+  now `~/devguard-scanner-data` instead of `~/devguard-scanner`. Move the folder, or set the variable to keep
+  the old location.
+- File locations use `devguard-scanner` (only the command is still `devguard`): config
+  `~/.config/devguard-scanner/config.toml` (the old `~/.config/devguard/config.toml` is still read if the new one
+  is missing), app data `~/.local/share/devguard-scanner/` (AI consent and cache, MCP audit log), and reports
+  `~/devguard-scanner/reports/` on every OS. In the container image the config is
+  `/etc/devguard-scanner/config.toml`.
+
 ## 0.2.0
 
 Remote scanning, the HTTP API, and the container image.

{devguard_scanner-0.2.0 → devguard_scanner-0.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: devguard-scanner
-Version: 0.2.0
+Version: 0.3.0
 Summary: Scan untrusted code repositories for malware before you open, install, or run them. Files are analyzed as data and never executed.
 Project-URL: Homepage, https://github.com/yilmazhasan/devguard-scanner
 Project-URL: Documentation, https://github.com/yilmazhasan/devguard-scanner/tree/main/docs
@@ -65,7 +65,7 @@ Findings: 5 (1 critical, 2 high, 1 medium, 1 low)
   - [critical] Automatic trigger reaches dangerous code (package.json:5)
   - [high] Browser profile data targeted (lib/collect.js:7)
   - [high] Cryptocurrency wallet data targeted (lib/collect.js:10)
-Report (md): ~/.local/share/devguard/reports/interview-task-1a2b3c4d/latest/report.md
+Report (md): ~/devguard-scanner/reports/interview-task-1a2b3c4d/latest/report.md
 ```
 
 | Verdict | Meaning |
@@ -96,7 +96,7 @@ curl -s 'https://devguard-scanner.vercel.app/v1/scans/github/owner/repo?format=m
 # one-off scan in a throwaway container
 docker run --rm ghcr.io/yilmazhasan/devguard-scanner scan https://github.com/owner/repo --stdout md
 
-# self-hosted API, plus local scans of anything you copy into ~/devguard-scanner (mounted read-only)
+# self-hosted API, plus local scans of anything you copy into ~/devguard-scanner-data (mounted read-only)
 docker compose up -d
 ```
 

{devguard_scanner-0.2.0 → devguard_scanner-0.3.0}/README.md

@@ -27,7 +27,7 @@ Findings: 5 (1 critical, 2 high, 1 medium, 1 low)
   - [critical] Automatic trigger reaches dangerous code (package.json:5)
   - [high] Browser profile data targeted (lib/collect.js:7)
   - [high] Cryptocurrency wallet data targeted (lib/collect.js:10)
-Report (md): ~/.local/share/devguard/reports/interview-task-1a2b3c4d/latest/report.md
+Report (md): ~/devguard-scanner/reports/interview-task-1a2b3c4d/latest/report.md
 ```
 
 | Verdict | Meaning |
@@ -58,7 +58,7 @@ curl -s 'https://devguard-scanner.vercel.app/v1/scans/github/owner/repo?format=m
 # one-off scan in a throwaway container
 docker run --rm ghcr.io/yilmazhasan/devguard-scanner scan https://github.com/owner/repo --stdout md
 
-# self-hosted API, plus local scans of anything you copy into ~/devguard-scanner (mounted read-only)
+# self-hosted API, plus local scans of anything you copy into ~/devguard-scanner-data (mounted read-only)
 docker compose up -d
 ```
 

{devguard_scanner-0.2.0 → devguard_scanner-0.3.0}/src/devguard/__init__.py

@@ -1,5 +1,5 @@
 """DevGuard: pre-open security scanner for untrusted code workspaces."""
 
-__version__ = "0.2.0"
+__version__ = "0.3.0"
 RULESET_VERSION = "2026.10.0"
 SCHEMA_VERSION = "1"

{devguard_scanner-0.2.0 → devguard_scanner-0.3.0}/src/devguard/api/local.py

@@ -1,8 +1,8 @@
 """Local scans for a self-hosted API: directories inside one drop folder (DEVGUARD_API_LOCAL_ROOT).
 
-Put a repository into the drop folder (default ~/devguard-scanner; /workspace in Docker, mounted read-only) and
+Put a repository into the drop folder (default ~/devguard-scanner-data; /workspace in Docker, mounted read-only) and
 ask the API to scan it by name. Instead of copying, a top-level entry may be a symlink to the repository
-(`ln -s /path/to/repo ~/devguard-scanner/repo`); in Docker, bind-mount it instead
+(`ln -s /path/to/repo ~/devguard-scanner-data/repo`); in Docker, bind-mount it instead
 (`-v /path/to/repo:/workspace/repo:ro`), since the container cannot see symlink targets on the host.
 
 Only what you put there is reachable: names are relative, `..` and absolute paths are refused, and symlinks
@@ -47,7 +47,7 @@ def resolve_local(root: Path, name: str) -> Path:
         st = os.lstat(current)
     except FileNotFoundError:
         raise LocalPathError(404, "not_found", f"{first!r} is not in the drop folder") from None
-    if stat.S_ISLNK(st.st_mode):  # a link you placed in the drop folder, e.g. ln -s ~/code/repo ~/devguard-scanner/
+    if stat.S_ISLNK(st.st_mode):  # a link placed in the drop folder: ln -s ~/code/repo ~/devguard-scanner-data/
         try:
             current = current.resolve(strict=True)
         except (OSError, RuntimeError):

{devguard_scanner-0.2.0 → devguard_scanner-0.3.0}/src/devguard/api/settings.py

@@ -4,7 +4,7 @@
     DEVGUARD_API_<NAME>     overrides one field, e.g. DEVGUARD_API_MAX_REPO_MB=200
     DEVGUARD_GITHUB_TOKEN   GitHub token without scopes (5,000 API requests/hour instead of 60)
     DEVGUARD_API_MONGODB_URI (or MONGODB_URI)  enables the request log in MongoDB
-    DEVGUARD_API_LOCAL_ROOT drop folder for local scans (default ~/devguard-scanner; ignored by the public profile)
+    DEVGUARD_API_LOCAL_ROOT drop folder for local scans (default ~/devguard-scanner-data; ignored by the public profile)
 
 Nothing in a request can change these.
 """
@@ -51,7 +51,7 @@ class APISettings(BaseModel):
     ai_max_cost_usd: float = 1.0
     github_token: SecretStr | None = None
     # Self-host only: scan directories copied into this drop folder (POST /v1/scans/local). Never public.
-    local_root: str | None = "~/devguard-scanner"
+    local_root: str | None = "~/devguard-scanner-data"
     # request log (optional; see devguard.api.traffic)
     mongodb_uri: SecretStr | None = None
     mongodb_db: str = "devguard"

{devguard_scanner-0.2.0 → devguard_scanner-0.3.0}/src/devguard/cli.py

@@ -342,10 +342,10 @@ def _doctor() -> int:
     import platform
 
     from devguard.ai.registry import AIConfig, available_entry_points
-    from devguard.core.config import user_config_dir
+    from devguard.core.config import user_config_file
 
     print(f"devguard {__version__}, ruleset {RULESET_VERSION}, Python {platform.python_version()}")
-    cfg_file = user_config_dir() / "config.toml"
+    cfg_file = user_config_file()
     print(f"User config: {cfg_file} ({'found' if cfg_file.is_file() else 'not found'})")
     try:
         cfg = load_config(None, None)

{devguard_scanner-0.2.0 → devguard_scanner-0.3.0}/src/devguard/core/config.py

@@ -51,22 +51,37 @@ class ScanConfig(BaseModel):
         }
 
 
-def user_config_dir() -> Path:
+APP_DIR = "devguard-scanner"  # directory name for config, data, and reports; only the command is `devguard`
+_LEGACY_APP_DIR = "devguard"  # used up to 0.2.0
+
+
+def user_config_dir(name: str = APP_DIR) -> Path:
     if sys.platform == "win32":
         base = os.environ.get("APPDATA") or str(Path.home() / "AppData" / "Roaming")
-        return Path(base) / "devguard"
+        return Path(base) / name
     if sys.platform == "darwin":
-        return Path.home() / "Library" / "Application Support" / "devguard"
-    return Path(os.environ.get("XDG_CONFIG_HOME") or Path.home() / ".config") / "devguard"
+        return Path.home() / "Library" / "Application Support" / name
+    return Path(os.environ.get("XDG_CONFIG_HOME") or Path.home() / ".config") / name
+
+
+def user_config_file() -> Path:
+    """The user config file, falling back to the pre-0.3 location when only that one exists."""
+    current = user_config_dir() / "config.toml"
+    legacy = user_config_dir(_LEGACY_APP_DIR) / "config.toml"
+    return legacy if not current.is_file() and legacy.is_file() else current
 
 
 def user_data_dir() -> Path:
     if sys.platform == "win32":
         base = os.environ.get("LOCALAPPDATA") or str(Path.home() / "AppData" / "Local")
-        return Path(base) / "devguard"
+        return Path(base) / APP_DIR
     if sys.platform == "darwin":
-        return Path.home() / "Library" / "Application Support" / "devguard"
-    return Path(os.environ.get("XDG_DATA_HOME") or Path.home() / ".local" / "share") / "devguard"
+        return Path.home() / "Library" / "Application Support" / APP_DIR
+    return Path(os.environ.get("XDG_DATA_HOME") or Path.home() / ".local" / "share") / APP_DIR
+
+
+def reports_dir() -> Path:
+    return Path.home() / APP_DIR / "reports"
 
 
 def is_within(path: Path, root: Path) -> bool:
@@ -80,11 +95,11 @@ def is_within(path: Path, root: Path) -> bool:
 def default_output_dir(target: Path) -> Path:
     resolved = target.resolve()
     digest = hashlib.sha256(str(resolved).encode()).hexdigest()[:8]
-    return user_data_dir() / "reports" / f"{resolved.name or 'root'}-{digest}"
+    return reports_dir() / f"{resolved.name or 'root'}-{digest}"
 
 
 def remote_output_dir(owner: str, repo: str) -> Path:
-    return user_data_dir() / "reports" / f"github-{owner}-{repo}"
+    return reports_dir() / f"github-{owner}-{repo}"
 
 
 def _read_toml(path: Path, target: Path | None) -> dict[str, Any]:
@@ -108,7 +123,7 @@ def load_config(
     overrides: dict[str, Any] | None = None,
 ) -> ScanConfig:
     data: dict[str, Any] = {}
-    user_file = user_config_dir() / "config.toml"
+    user_file = user_config_file()
     if user_file.is_file():
         data = _merge(data, _read_toml(user_file, target))
     if explicit is not None:

{devguard_scanner-0.2.0 → devguard_scanner-0.3.0}/tests/test_report_cli.py

@@ -116,3 +116,17 @@ def test_example_config_is_valid(tmp_path: Path) -> None:
     ai = AIConfig.model_validate(cfg.ai)
     assert set(ai.profiles) == {"claude", "gpt", "local"}
     assert cfg.mcp["allowed_roots"] == ["~/code"]
+
+
+def test_user_config_falls_back_to_legacy_dir(tmp_path, monkeypatch) -> None:
+    from devguard.core.config import user_config_file
+
+    monkeypatch.setenv("XDG_CONFIG_HOME", str(tmp_path))
+    legacy = tmp_path / "devguard" / "config.toml"
+    legacy.parent.mkdir()
+    legacy.write_text("[scan]\n")
+    assert user_config_file() == legacy
+    current = tmp_path / "devguard-scanner" / "config.toml"
+    current.parent.mkdir()
+    current.write_text("[scan]\n")
+    assert user_config_file() == current