devguard-scanner 0.3.0__tar.gz → 0.4.0__tar.gz

{devguard_scanner-0.3.0 → devguard_scanner-0.4.0}/CHANGELOG.md

@@ -3,6 +3,16 @@
 All notable changes are documented here. The format follows [Keep a Changelog](https://keepachangelog.com/) and
 the project uses [semantic versioning](https://semver.org).
 
+## 0.4.0
+
+- `devguard config init` writes the user config with an AI profile: numbered choices on a terminal (Enter takes
+  the default), or the defaults and flags with `-y` or without a terminal (`--provider anthropic|openai|local`,
+  `--model`, `--key-env`, `--base-url`, `--path`, `--force`). `devguard config path` prints the file location.
+- With a single AI profile, `--ai` uses it without `default_profile`. Without any profile, the error points to
+  `devguard config init`.
+- Container images are published on every push to `main` (`:main`, `:sha-<commit>`), and the hosted API on Vercel
+  is deployed from CI with that exact image digest.
+
 ## 0.3.0
 
 - The default drop folder for local scans (`DEVGUARD_API_LOCAL_ROOT`, and the folder `compose.yaml` mounts) is

{devguard_scanner-0.3.0 → devguard_scanner-0.4.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: devguard-scanner
-Version: 0.3.0
+Version: 0.4.0
 Summary: Scan untrusted code repositories for malware before you open, install, or run them. Files are analyzed as data and never executed.
 Project-URL: Homepage, https://github.com/yilmazhasan/devguard-scanner
 Project-URL: Documentation, https://github.com/yilmazhasan/devguard-scanner/tree/main/docs

{devguard_scanner-0.3.0 → devguard_scanner-0.4.0}/src/devguard/__init__.py

@@ -1,5 +1,5 @@
 """DevGuard: pre-open security scanner for untrusted code workspaces."""
 
-__version__ = "0.3.0"
+__version__ = "0.4.0"
 RULESET_VERSION = "2026.10.0"
 SCHEMA_VERSION = "1"

{devguard_scanner-0.3.0 → devguard_scanner-0.4.0}/src/devguard/ai/registry.py

@@ -101,8 +101,15 @@ def load_provider(
 ) -> LoadedProvider:
     """Load a profile's provider. `secrets` supplies already-resolved values (an API caller's own key)."""
     name = profile_name or cfg.default_profile
+    if not name and len(cfg.profiles) == 1:
+        name = next(iter(cfg.profiles))
     if not name:
-        raise ProviderError("no AI profile selected: pass --ai-profile or set ai.default_profile in your user config")
+        if not cfg.profiles:
+            raise ProviderError("no AI profile configured: run `devguard config init` to create one")
+        raise ProviderError(
+            f"several AI profiles ({', '.join(sorted(cfg.profiles))}) and no default: pass --ai-profile NAME "
+            "or set ai.default_profile in your config"
+        )
     profile = cfg.profiles.get(name)
     if profile is None:
         raise ProviderError(f"unknown AI profile {name!r}; configured: {', '.join(sorted(cfg.profiles)) or 'none'}")

{devguard_scanner-0.3.0 → devguard_scanner-0.4.0}/src/devguard/cli.py

@@ -108,6 +108,21 @@ def _parser() -> argparse.ArgumentParser:
     sv.add_argument("--port", type=int, help="Port (default: $PORT or 8000).")
     sv.add_argument("--profile", choices=["public", "selfhost", "dev"], help="Limits profile (default: selfhost).")
 
+    c = sub.add_parser("config", help="Create or locate the user config file.")
+    csub = c.add_subparsers(dest="config_command", required=True)
+    ci = csub.add_parser(
+        "init",
+        help="Write a config with an AI profile (asks on a terminal; -y or no terminal: defaults/flags).",
+    )
+    ci.add_argument("--provider", choices=["anthropic", "openai", "local"])
+    ci.add_argument("--model", help="Model id (default: claude-opus-5-5, gpt-4o, or llama3.1).")
+    ci.add_argument("--key-env", help="Environment variable that holds the API key (default: the provider's usual).")
+    ci.add_argument("--base-url", help="Server URL for --provider local (default: Ollama on localhost).")
+    ci.add_argument("--path", type=Path, help="Where to write it (default: the user config file).")
+    ci.add_argument("--force", action="store_true", help="Overwrite an existing file (kept as .bak).")
+    ci.add_argument("-y", "--yes", action="store_true", help="Do not ask; use the flags and defaults.")
+    csub.add_parser("path", help="Print the user config file path.")
+
     sub.add_parser("doctor", help="Check the installation and configuration.")
     return p
 
@@ -131,6 +146,8 @@ def main(argv: list[str] | None = None) -> int:
             return serve(roots, expose_investigation=args.expose_investigation_tools, config=cfg)
         if args.command == "serve":
             return _serve(args)
+        if args.command == "config":
+            return _config(args)
         if args.command == "doctor":
             return _doctor()
     except ConfigError as exc:
@@ -337,6 +354,33 @@ def _ai(args: argparse.Namespace) -> int:
     return EXIT_OK if report.ok else EXIT_FINDINGS
 
 
+def _config(args: argparse.Namespace) -> int:
+    from devguard.core.config import user_config_file
+
+    if args.config_command == "path":
+        path = user_config_file()
+        print(path if path.is_file() else f"{path} (not created yet: run `devguard config init`)")
+        return EXIT_OK
+    from devguard.core.config_init import run_init
+
+    result = run_init(
+        path=args.path,
+        provider=args.provider,
+        model=args.model,
+        key_env=args.key_env,
+        base_url=args.base_url,
+        force=args.force,
+        assume_defaults=args.yes,
+    )
+    print(f"\nWrote {result.path} (profile {result.choice.profile!r}, {result.choice.label}).")
+    print("Next:")
+    if result.key_env and not os.environ.get(result.key_env):
+        print(f"  export {result.key_env}=...        # your API key; it is not stored in the file")
+    print("  devguard ai test                 # checks the profile with synthetic data only")
+    print("  devguard scan ./repo --ai")
+    return EXIT_OK
+
+
 def _doctor() -> int:
     import importlib.util
     import platform

devguard_scanner-0.4.0/src/devguard/core/config_init.py

@@ -0,0 +1,167 @@
+"""`devguard config init`: write a user config with one AI profile.
+
+Interactive on a terminal (numbered choices, Enter takes the default); with `--yes` or without a terminal it
+writes the defaults, or whatever the flags say. The API key itself is never written: the profile references
+an environment variable.
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import re
+import sys
+from collections.abc import Callable
+from dataclasses import dataclass
+from pathlib import Path
+
+from devguard.core.config import ConfigError, user_config_dir
+
+
+@dataclass(frozen=True)
+class Choice:
+    key: str
+    label: str
+    provider: str
+    profile: str
+    model: str
+    key_env: str | None = None
+    base_url: str | None = None
+
+
+CHOICES = [
+    Choice("anthropic", "Claude (Anthropic)", "anthropic", "claude", "claude-opus-5-5", key_env="ANTHROPIC_API_KEY"),
+    Choice("openai", "OpenAI", "openai", "gpt", "gpt-4o", key_env="OPENAI_API_KEY"),
+    Choice(
+        "local",
+        "Local model via Ollama (code stays on this machine)",
+        "openai-compatible",
+        "local",
+        "llama3.1",
+        base_url="http://localhost:11434/v1",
+    ),
+]
+BY_KEY = {c.key: c for c in CHOICES}
+_MODEL = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._:/-]{0,99}$")
+_ENV = re.compile(r"^[A-Za-z_][A-Za-z0-9_]{0,63}$")
+
+
+def default_choice() -> Choice:
+    """Prefer the provider whose key is already in the environment."""
+    for c in CHOICES:
+        if c.key_env and os.environ.get(c.key_env):
+            return c
+    return CHOICES[0]
+
+
+def render(choice: Choice, model: str, key_env: str | None, base_url: str | None) -> str:
+    q = json.dumps  # a JSON string of these validated values is a valid TOML basic string
+    lines = [
+        "# DevGuard user configuration, written by `devguard config init`.",
+        "# All options: https://github.com/yilmazhasan/devguard-scanner/blob/main/docs/ai.md",
+        "",
+        "[ai]",
+        f"default_profile = {q(choice.profile)}",
+        "# max_cost_usd = 1.0     # per scan; enforced when the cost is known (see price_* below)",
+        "# send_excerpts = true   # false: send finding metadata only, no code excerpts",
+        "",
+        f"[ai.profiles.{choice.profile}]",
+        f"provider = {q(choice.provider)}",
+        f"model = {q(model)}",
+    ]
+    if base_url:
+        lines.append(f"base_url = {q(base_url)}")
+    if key_env:
+        lines.append(f"secrets = {{ api_key = {q('env:' + key_env)} }}   # the key is read from ${key_env}")
+    if choice.key == "local":
+        lines.append("data_stays_local = true   # no consent prompt; nothing leaves this machine")
+    if choice.provider == "openai":
+        lines += [
+            "# USD per 1M tokens for this model, so max_cost_usd is enforced:",
+            "# price_input_per_mtok = 0.0",
+            "# price_output_per_mtok = 0.0",
+        ]
+    return "\n".join(lines) + "\n"
+
+
+@dataclass
+class InitResult:
+    path: Path
+    choice: Choice
+    key_env: str | None
+
+
+def run_init(
+    *,
+    path: Path | None,
+    provider: str | None,
+    model: str | None,
+    key_env: str | None,
+    base_url: str | None,
+    force: bool,
+    assume_defaults: bool,
+    ask: Callable[[str], str] = input,
+    out: Callable[[str], None] = print,
+) -> InitResult:
+    interactive = not assume_defaults and sys.stdin.isatty()
+    target = (path or user_config_dir() / "config.toml").expanduser()
+
+    def prompt(question: str, default: str) -> str:
+        if not interactive:
+            return default
+        try:
+            answer = ask(f"{question} [{default}]: ").strip()
+        except EOFError:
+            answer = ""
+        return answer or default
+
+    if target.is_dir():
+        raise ConfigError(
+            f"{target} is a directory (Docker creates one when you mount a config file that does not exist yet). "
+            "Remove it, then run this again."
+        )
+    if target.exists() and not force:
+        if not interactive:
+            raise ConfigError(f"{target} already exists; pass --force to overwrite it")
+        answer = prompt(f"{target} exists. Overwrite it (the old file is kept as {target.name}.bak)? y/n", "n")
+        if answer.lower() not in ("y", "yes"):
+            raise ConfigError(f"{target} was not changed")
+
+    if provider is not None:
+        if provider not in BY_KEY:
+            raise ConfigError(f"unknown provider {provider!r}; choose one of {', '.join(BY_KEY)}")
+        choice = BY_KEY[provider]
+    else:
+        default = default_choice()
+        choice = default
+        if interactive:
+            out("Which AI provider?")
+            for i, c in enumerate(CHOICES, 1):
+                out(f"  {i}) {c.label}{'  (default)' if c is default else ''}")
+            while True:
+                picked = prompt(f"Choose 1-{len(CHOICES)}", str(CHOICES.index(default) + 1))
+                if picked.isdigit() and 1 <= int(picked) <= len(CHOICES):
+                    choice = CHOICES[int(picked) - 1]
+                    break
+                out(f"  Please enter a number from 1 to {len(CHOICES)}.")
+
+    model = model or prompt("Model", choice.model)
+    if not _MODEL.match(model):
+        raise ConfigError(f"invalid model id {model!r}")
+    if choice.key_env:
+        key_env = key_env or prompt("Environment variable that holds the API key", choice.key_env)
+        if not _ENV.match(key_env):
+            raise ConfigError(f"invalid environment variable name {key_env!r}")
+    else:
+        key_env = None
+    if choice.base_url:
+        base_url = base_url or prompt("Server URL", choice.base_url)
+    else:
+        base_url = None
+
+    text = render(choice, model, key_env, base_url)
+    target.parent.mkdir(parents=True, exist_ok=True)
+    if target.exists():
+        target.with_name(target.name + ".bak").write_bytes(target.read_bytes())
+    target.write_text(text, encoding="utf-8")
+    return InitResult(target, choice, key_env)

{devguard_scanner-0.3.0 → devguard_scanner-0.4.0}/tests/test_report_cli.py

@@ -121,6 +121,7 @@ def test_example_config_is_valid(tmp_path: Path) -> None:
 def test_user_config_falls_back_to_legacy_dir(tmp_path, monkeypatch) -> None:
     from devguard.core.config import user_config_file
 
+    monkeypatch.setattr("sys.platform", "linux")  # XDG_CONFIG_HOME only applies there
     monkeypatch.setenv("XDG_CONFIG_HOME", str(tmp_path))
     legacy = tmp_path / "devguard" / "config.toml"
     legacy.parent.mkdir()
@@ -130,3 +131,53 @@ def test_user_config_falls_back_to_legacy_dir(tmp_path, monkeypatch) -> None:
     current.parent.mkdir()
     current.write_text("[scan]\n")
     assert user_config_file() == current
+
+
+def test_config_init_defaults_write_a_loadable_profile(tmp_path, monkeypatch) -> None:
+    import tomllib
+
+    from devguard.ai.registry import AIConfig
+
+    monkeypatch.delenv("ANTHROPIC_API_KEY", raising=False)
+    monkeypatch.setenv("OPENAI_API_KEY", "sk-test")  # the provider with a key set is the default
+    path = tmp_path / "cfg" / "config.toml"
+    assert main(["config", "init", "-y", "--path", str(path)]) == 0
+    cfg = AIConfig.model_validate(tomllib.loads(path.read_text())["ai"])
+    assert cfg.default_profile == "gpt"
+    assert cfg.profiles["gpt"].secrets == {"api_key": "env:OPENAI_API_KEY"}
+    assert "sk-test" not in path.read_text()
+    # an existing file is kept unless --force; --force leaves a backup
+    assert main(["config", "init", "-y", "--path", str(path), "--provider", "local"]) == 2
+    assert main(["config", "init", "-y", "--path", str(path), "--provider", "local", "--force"]) == 0
+    assert "data_stays_local = true" in path.read_text()
+    assert "OPENAI_API_KEY" in (tmp_path / "cfg" / "config.toml.bak").read_text()
+
+
+def test_config_init_interactive_choices(tmp_path, monkeypatch) -> None:
+    from devguard.core.config_init import run_init
+
+    monkeypatch.setattr("sys.stdin.isatty", lambda: True)
+    answers = iter(["9", "1", "", "MY_KEY"])  # invalid pick, Claude, default model, custom key variable
+    result = run_init(
+        path=tmp_path / "config.toml",
+        provider=None,
+        model=None,
+        key_env=None,
+        base_url=None,
+        force=False,
+        assume_defaults=False,
+        ask=lambda _q: next(answers),
+        out=lambda _s: None,
+    )
+    text = result.path.read_text()
+    assert 'model = "claude-opus-5-5"' in text and '"env:MY_KEY"' in text
+
+
+def test_single_profile_needs_no_default() -> None:
+    from devguard.ai.registry import AIConfig, ProviderError, load_provider
+
+    one = AIConfig.model_validate({"profiles": {"only": {"provider": "nonexistent-provider"}}})
+    with pytest.raises(ProviderError, match="nonexistent-provider"):  # got past profile selection
+        load_provider(one, None, None)
+    with pytest.raises(ProviderError, match="devguard config init"):
+        load_provider(AIConfig(), None, None)