devguard 0.2.0__py3-none-any.whl

devguard-0.2.0.dist-info/METADATA

@@ -0,0 +1,225 @@
+Metadata-Version: 2.4
+Name: devguard
+Version: 0.2.0
+Summary: Developer workstation security and hygiene sweeps -- secrets, deps, gitignore, SSH keys, AI editor configs, cargo publish CI, and more
+Project-URL: Homepage, https://github.com/arclabs561/devguard
+Project-URL: Repository, https://github.com/arclabs561/devguard
+Project-URL: Issues, https://github.com/arclabs561/devguard/issues
+Author: arclabs561
+License-Expression: MIT
+Keywords: dependency-audit,developer-tools,devops,secret-scanning,security
+Classifier: Development Status :: 4 - Beta
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: Security
+Classifier: Topic :: Software Development :: Quality Assurance
+Requires-Python: >=3.11
+Requires-Dist: httpx>=0.27.0
+Requires-Dist: pydantic-settings>=2.5.0
+Requires-Dist: pydantic>=2.9.0
+Requires-Dist: python-dotenv>=1.0.0
+Requires-Dist: pyyaml>=6.0.0
+Requires-Dist: rich>=13.7.0
+Requires-Dist: typer>=0.12.0
+Provides-Extra: all
+Requires-Dist: aiosmtplib>=3.0.0; extra == 'all'
+Requires-Dist: fastapi>=0.109.0; extra == 'all'
+Requires-Dist: mcp>=0.1.0; extra == 'all'
+Requires-Dist: openai>=1.0.0; extra == 'all'
+Requires-Dist: prometheus-client>=0.20.0; extra == 'all'
+Requires-Dist: pygithub>=2.2.0; extra == 'all'
+Requires-Dist: slowapi>=0.1.9; extra == 'all'
+Requires-Dist: uvicorn>=0.27.0; extra == 'all'
+Provides-Extra: dev
+Requires-Dist: hypothesis>=6.0.0; extra == 'dev'
+Requires-Dist: mypy>=1.11.0; extra == 'dev'
+Requires-Dist: pytest-asyncio>=0.24.0; extra == 'dev'
+Requires-Dist: pytest-cov>=5.0.0; extra == 'dev'
+Requires-Dist: pytest>=8.3.0; extra == 'dev'
+Requires-Dist: ruff>=0.6.0; extra == 'dev'
+Provides-Extra: flaudit
+Requires-Dist: openai>=1.0.0; extra == 'flaudit'
+Provides-Extra: monitoring
+Requires-Dist: aiosmtplib>=3.0.0; extra == 'monitoring'
+Requires-Dist: fastapi>=0.109.0; extra == 'monitoring'
+Requires-Dist: mcp>=0.1.0; extra == 'monitoring'
+Requires-Dist: prometheus-client>=0.20.0; extra == 'monitoring'
+Requires-Dist: pygithub>=2.2.0; extra == 'monitoring'
+Requires-Dist: slowapi>=0.1.9; extra == 'monitoring'
+Requires-Dist: uvicorn>=0.27.0; extra == 'monitoring'
+Description-Content-Type: text/markdown
+
+# devguard
+
+devguard scans your developer workspace for security and hygiene issues. It runs a set of sweeps -- automated checks across local repos, SSH keys, dependencies, and more -- and reports findings in one pass.
+
+```
+$ devguard sweep
+local_dev:                    142 repos scanned, 0 findings
+public_github_secrets:        18 repos scanned, 0 findings
+local_dirty_worktree_secrets: 47 repos scanned, 0 findings
+gitignore_audit:              3 repos with gaps (1 public)
+dependency_audit:             12 vulns across 5 repos (2 critical)
+ssh_key_audit:                1 weak key, 2 stale GitHub keys
+ai_editor_config_audit:       47 repos checked, 2 errors
+```
+
+## Quick start
+
+```bash
+pip install -e .              # or: uv pip install -e .
+devguard doctor                # check prerequisites (trufflehog, cargo-audit, etc.)
+devguard sweep                 # run all enabled sweeps
+```
+
+No spec file is required. Without one, devguard uses built-in defaults. Create `devguard.spec.yaml` to customize which sweeps run and their parameters.
+
+## Sweeps
+
+### Security
+
+| Sweep | Description |
+|-------|-------------|
+| `public_github_secrets` | Scan public GitHub repos for committed secrets (TruffleHog). |
+| `dependency_audit` | Check repos for known vulnerabilities in dependencies (npm audit, pip-audit, cargo-audit). |
+| `ssh_key_audit` | Audit local SSH keys for weak algorithms, short key lengths, and stale GitHub deploy keys. |
+| `local_dirty_worktree_secrets` | Scan uncommitted changes in local repos for secrets before they reach a commit. |
+
+### Hygiene
+
+| Sweep | Description |
+|-------|-------------|
+| `gitignore_audit` | Find repos missing `.gitignore` or lacking expected ignore patterns for their language. |
+| `ai_editor_config_audit` | Check AI editor configs (Cursor rules, Claude settings) for consistency across repos. |
+| `cargo_publish_audit` | Verify Rust crates have publish CI, correct metadata, and no publish blockers. |
+
+### Analysis
+
+| Sweep | Description |
+|-------|-------------|
+| `project_flaudit` | LLM-driven audit (OpenRouter/Gemini): README drift, test gaps, rule violations. |
+
+### Workspace
+
+| Sweep | Description |
+|-------|-------------|
+| `local_dev` | Scan local repos for accidentally committed large files, binaries, and dev artifacts. |
+
+## Configuration
+
+Copy `devguard.spec.example.yaml` to `devguard.spec.yaml` and edit to taste. The spec file controls which sweeps are enabled, their parameters, and output paths.
+
+Most sweeps work with zero configuration. Sweeps that need external access:
+
+- `public_github_secrets`: requires `GITHUB_TOKEN` (for GitHub API).
+- `project_flaudit`: requires `OPENROUTER_API_KEY`.
+- `ssh_key_audit` with `check_github: true`: requires `GITHUB_TOKEN`.
+- `dependency_audit`: requires audit tools installed (`npm`, `pip-audit`, `cargo-audit`).
+
+Environment variables can be set in `.env` or exported in your shell.
+
+## Pre-commit hooks
+
+devguard ships `.pre-commit-hooks.yaml` with three hooks: `devguard-gitignore`, `devguard-ai-config`, and `devguard-secrets`. Add to your `.pre-commit-config.yaml`:
+
+```yaml
+- repo: https://github.com/yourorg/devguard
+  rev: main
+  hooks:
+    - id: devguard-gitignore
+    - id: devguard-secrets
+```
+
+## Library usage
+
+Sweep modules can be imported directly for scripting or integration:
+
+```python
+from devguard.sweeps.ssh_key_audit import audit_ssh_keys
+from devguard.sweeps.dependency_audit import audit_dependencies
+```
+
+## Development
+
+```bash
+uv pip install -e ".[dev]"
+pytest
+ruff check .
+mypy devguard/
+```
+
+## License
+
+MIT
+
+<details>
+<summary>Legacy: Service monitoring (npm, Vercel, Fly.io, GitHub)</summary>
+
+devguard originally provided unified monitoring for npm packages, GitHub repositories, and Fly.io/Vercel deployments. This functionality still exists but is secondary to the sweep system.
+
+### Monitored services
+
+- **npm packages** for security vulnerabilities
+- **GitHub repositories** for Dependabot security alerts
+- **Fly.io deployments** for health status
+- **Vercel deployments** for deployment status
+- **Container/Dockerfile** security best practices
+- **Secret scanning** (TruffleHog or regex fallback)
+- **AWS IAM** security posture for satellite nodes
+- **AWS Cost** monitoring with budget alerts
+- **API usage/credits** for LLM providers (OpenRouter, Anthropic, OpenAI, Perplexity, Groq)
+- **Firecrawl API** credit usage
+- **Tavily API** usage tracking
+- **Tailscale** mesh network health
+- **Domain/SSL** certificate expiry
+- **Docker Swarm** cluster health
+- **Red team security testing** for deployment endpoints
+- **Web dashboard** for real-time monitoring
+- **MCP server** for AI agent integration
+
+### Legacy commands
+
+```bash
+devguard check           # run monitoring checks
+devguard check --watch   # continuous monitoring
+devguard mcp             # start MCP server
+devguard dashboard       # start web dashboard
+devguard discover        # auto-discover resources to monitor
+devguard config          # show current configuration
+devguard auth gh         # authenticate with GitHub
+devguard auth-status     # show auth status for all services
+```
+
+### Legacy configuration
+
+Set environment variables in `.env`:
+
+```bash
+GITHUB_TOKEN=your_github_token
+VERCEL_TOKEN=your_vercel_token
+FLY_API_TOKEN=your_fly_token
+SNYK_TOKEN=your_snyk_token
+GITHUB_ORG=your_org_name
+NPM_PACKAGES_TO_MONITOR=package1,package2
+GITHUB_REPOS_TO_MONITOR=owner/repo1,owner/repo2
+FLY_APPS_TO_MONITOR=app1,app2
+VERCEL_PROJECTS_TO_MONITOR=project1,project2
+DASHBOARD_ENABLED=false
+DASHBOARD_HOST=0.0.0.0
+DASHBOARD_PORT=8080
+DASHBOARD_API_KEY=your_secure_key
+```
+
+### Architecture (legacy)
+
+- **Guardian**: Main orchestrator managing checkers and reports
+- **BaseChecker**: Abstract base class for all checkers
+- **Reporter**: Output formatting, webhooks, email delivery
+- **Checkers**: NpmChecker, GitHubChecker, VercelChecker, FlyChecker, ContainerChecker, SecretChecker, AWSIAMChecker, RedTeamChecker
+
+</details>

devguard-0.2.0.dist-info/RECORD

@@ -0,0 +1,60 @@
+devguard/INTEGRATION_SUMMARY.md,sha256=tdDJKgo9ZpNeTqjRhxkCXCsz2jOfFwrM-HIQva-YN58,3286
+devguard/__init__.py,sha256=hs6HgdGWWxwTbt-YVV_OqXJx1eS6HBogaR3GoP_fX_Y,98
+devguard/__main__.py,sha256=v8JUiCNb3h74x6aSOxoubVnHWFCY0nllGw8CGE99SoQ,122
+devguard/cli.py,sha256=j1XCKsXd515uD1fCuHvAiD01PEki76Bk_XaK1ZtCW_k,58238
+devguard/cli_helpers.py,sha256=MTanW0D0rCJzDq2W277-5unYOsObxGif_Gz8_CehJfQ,6029
+devguard/config.py,sha256=-sYh0pT1V2a09w2XQSRlYJRkOOdDiYMKQ16YdPMFu58,10356
+devguard/core.py,sha256=96GcxpbCYpIJ6zTg10vyN2DjJmdKlBHyg9SJqv1ADCE,11356
+devguard/dashboard.py,sha256=qSi7jfUxqCFFXNjUCE6dvaqtWBX2GS3ig9OdbBDL6RQ,25639
+devguard/discovery.py,sha256=SwtHy58J35eo8EB31MtGAJuAKez-3IUPpFR-DgpgxbI,11991
+devguard/http_client.py,sha256=juHLA907aUIjuWcF02CPjfeuZm9LIK4-CLn4lBMkeCI,4477
+devguard/llm_service.py,sha256=yxIIJmQ66aIgE3g3TRZUoL42X8zzJDTvVRaGPVN4xWA,21224
+devguard/mcp_server.py,sha256=JBbYvGU43veT6ExsInepW_kbif7K5o1u56Orydz6YbY,8913
+devguard/metrics.py,sha256=xirsL65IQscw0z54kkRNaFhp4oQPqbodBKqJyfpZhhc,4247
+devguard/models.py,sha256=ujbrhqRWJsv399NkCdy5CpVMdi1uUcVENGaE9_XsIlA,7493
+devguard/reporting.py,sha256=9L6nb_GNUm3cFOEwtjbcyVPGOILwOlagSEPZEUi03DA,63249
+devguard/sarif.py,sha256=rrL1OEXL3P6ZStdvibBGHyKZxhE9ABYX0dfUnpnfXyM,9588
+devguard/spec.py,sha256=6MICRdZPmUjKwj3lroW2AZib05yq7h781jn9Y665PXA,23648
+devguard/utils.py,sha256=pOl_gtYwmaf9QSlTuecWNEyM7EW6dXq8o1_tBvdP9Yo,4541
+devguard/checkers/__init__.py,sha256=ZZzpwxcJKf-o4Le8B4IzxOnwq5XqeyXDIxMMjYqnbl0,1392
+devguard/checkers/api_usage.py,sha256=CE_u449o9_10K4fpt3Q4OFTqqHjmEvtt8nFV5XFOORk,21749
+devguard/checkers/aws_cost.py,sha256=lmsVgNrRANTibh7L0s8f_jHus3lFQSHjhWdzyvvofps,13005
+devguard/checkers/aws_iam.py,sha256=IF9Zd3tzVdWPgv0QkHXKjpd0y6-inZEGZcH6KkH9_Cs,10410
+devguard/checkers/base.py,sha256=B7ickLBylEE5gjP4bHZ7JHQLlEfmcb0EcCyei8bg3OU,607
+devguard/checkers/container.py,sha256=XAgH9-HOP-0KcZVTy_iBtV8rEZcgHTv_mh5A-knY2WU,4932
+devguard/checkers/domain.py,sha256=FarQRuSzfry3gbtaisWaT1Hw_PsAZZye9ikG7Ujowyc,7819
+devguard/checkers/firecrawl.py,sha256=7GUCtIZ0wgteHAoIljt-dEuTjAuq-gaOfDZ1BQn4_uQ,4191
+devguard/checkers/fly.py,sha256=vhD3HefnmVgppEoXfunsTJbyEvoZifkX01N0MkomznU,8633
+devguard/checkers/github.py,sha256=b0XGduRn1KxmsYNqVS0l4bWlBEdFzhmvQ8ebAZnH9-A,7983
+devguard/checkers/npm.py,sha256=HC_UnZ3RzTnbfQO6dFw-lEk6DwZhupBhNQB9sms5rBg,14640
+devguard/checkers/npm_security.py,sha256=mRvfe3anEtVU9LGlMzoOaBET1rZ9m5HH5u6ev_zg368,9522
+devguard/checkers/redteam.py,sha256=hhP8XW-oYjFkFWPLemsRU78_zdehRCt5Fpg-9yaEWgo,10595
+devguard/checkers/secret.py,sha256=jPwqzDIYwcxZ1bq5o0oiHIqIrZd9ikTutaiYEy8jntI,10940
+devguard/checkers/swarm.py,sha256=wwN0Mfm-srm2csJnhnoZuP14HrBWemqlLQDKJVXmVhs,15691
+devguard/checkers/tailscale.py,sha256=IVY0uOnBptO6mxj6SUEpSpgPX4EXbuF6a_z9rOPVEOk,5398
+devguard/checkers/tailsnitch.py,sha256=OFrIflicVGGjL2X-rSSr00XWaS5PjhG_gYpgyKcvhWM,12242
+devguard/checkers/tavily.py,sha256=pT0VpQh5hszq0MD1Nf5K6W4uX_9AKkr-eYpd4TkTdPU,6910
+devguard/checkers/vercel.py,sha256=s0SCmYeX5Zu-4wNFIc32glgA5JD8WSns8jVaSw5UX-Y,7244
+devguard/scripts/ANALYSIS_SUMMARY.md,sha256=l7BdMOWdYrYoC8BDpDdTbATzOqKhuCY8nDoba7TB9QQ,3718
+devguard/scripts/README.md,sha256=O8pPBElyWeJEUejpn8ZW04qKiZ3O08CvCfEjKzjsRuc,4967
+devguard/scripts/auto_fix_recommendations.py,sha256=7ZXjT2GuB1O-DlVcIUoZriTMFozlFKG6EWRJ6dJLWg4,4876
+devguard/scripts/generate_npmignore.py,sha256=vJBLgW-vl57k1OLINy87C0BKA63ZfV-qOj2ZmL3jays,4752
+devguard/scripts/generate_security_report.py,sha256=H7JmcozQzvZ5dcj0n4qGpzqMiz_XYQtLgoXzVO831Ug,10808
+devguard/scripts/prepublish_check.sh,sha256=0oxrp1DFitHuaVPLG4J7zFfq3eVUR5Zo4H12HOysmiM,786
+devguard/scripts/redteam_npm_packages.py,sha256=-SjJkAbvh8yONv0QZ4ULd0u7sTe-TJLy5EF_VjH-40I,49228
+devguard/scripts/review_all_repos.py,sha256=EEBC8AMjwkDPtg-Cu_ByndhdJU833MOtvu4sVTch3gM,11711
+devguard/sweeps/__init__.py,sha256=rTxr2v31gMUplFAMq_Cp9WkprCnQwf8CNACqDgnv-s8,550
+devguard/sweeps/ai_editor_config_audit.py,sha256=dBlDKsDd9gfwv9tNwJ-TuCURg74fKOQK15q0O-4p17c,26005
+devguard/sweeps/cargo_publish_audit.py,sha256=cObKPld8oWZp2Gh87fcbbQQUbcKiPisQz0e0rP3y3OE,24244
+devguard/sweeps/dependency_audit.py,sha256=al3uuK71HtWB6Wn37CiyV55mCFG6yvZm3w2Y4IQtc_s,14472
+devguard/sweeps/gitignore_audit.py,sha256=ZNL7FLont_DOBQh1NG4w0S4RQJnCsLcuGxT2PsBQ6CE,11803
+devguard/sweeps/local_dev.py,sha256=1S4-k7wWgLdJ2LPdzqxQW3jXtoEYVOyRnt_ow-C96PM,7784
+devguard/sweeps/local_dirty_worktree_secrets.py,sha256=VT2GGOGlYkYCmhgBG072L_8gPgwDUTQiAmqFxRMuuHo,18097
+devguard/sweeps/project_flaudit.py,sha256=EcjO-HMv0zabTig2AcMjvS414WlbMgeKU1vpxq-uOLI,22689
+devguard/sweeps/public_github_secrets.py,sha256=rZEhrJ4ddUF6h8mzuPuYI7FaZshQ1u2F6JO2RavS3gg,24667
+devguard/sweeps/publish_audit.py,sha256=IMV9oqAi6R0oLbJwfWsmc7uRoSC9x_Z54QsKqrl0p10,15557
+devguard/sweeps/ssh_key_audit.py,sha256=-AH-mnZLquKaoNEwpGGYwW0qxQqBgPEWcdbW561SL7Q,11637
+devguard-0.2.0.dist-info/METADATA,sha256=8ZHsUfGyL_eRBXAululOucZLOCHb6ym31lqzcG9iDXI,8400
+devguard-0.2.0.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
+devguard-0.2.0.dist-info/entry_points.txt,sha256=hRoADmIFOCpsRDQ6cZyyFI9x6Y8BiU_TkZH6f5hNmHA,47
+devguard-0.2.0.dist-info/RECORD,,

devguard-0.2.0.dist-info/WHEEL

@@ -0,0 +1,4 @@
+Wheel-Version: 1.0
+Generator: hatchling 1.29.0
+Root-Is-Purelib: true
+Tag: py3-none-any

devguard-0.2.0.dist-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+devguard = devguard.cli:main