narvy-cli 1.0.0__tar.gz → 1.0.1__tar.gz

{narvy_cli-1.0.0 → narvy_cli-1.0.1}/CHANGELOG.md

@@ -5,6 +5,47 @@ All notable changes to this project are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.0.1]
+
+### Fixed
+
+- `--fail-on` no longer green-passes a build whose scan silently degraded. An
+  SCA run that could not reach OSV.dev (outage / cold cache) is now reported as
+  `degraded` and fails the gate (exit 2), not a clean 0. `cloud-scan`,
+  `web-scan` and `host-audit` now feed their own coverage gaps (skipped AWS
+  analyzers, SSRF-blocked redirect, partial non-root audit) into `--fail-on`.
+- `cloud-scan`: one AccessDenied no longer aborts the remaining analyzers for a
+  region; each runs in isolation and skipped checks are reported under
+  `coverage` in the output.
+- SARIF output on every surface (`scan`, `web-scan`, `host-audit`, `cloud-scan`)
+  now carries a per-result `level` and a `security-severity` property, so
+  GitHub/GitLab code scanning can rank findings.
+
+### Changed
+
+- `web-scan`, `host-audit` and `cloud-scan` now use `-o`/`--output` for the
+  format and `-f`/`--file` for the destination, consistent with `scan`. The
+  older `--format` / `--output-file` long options still work as aliases. A file
+  path that is actually a format name (e.g. `-f json`) is now rejected loudly
+  instead of writing a mis-named text file.
+
+## [1.0.0]
+
+First stable release, published to PyPI as `narvy-cli`.
+
+### Changed
+
+- Distribution name is `narvy-cli` on PyPI (`pip install narvy-cli`); the
+  command and import package remain `narvy`.
+- Web/backend rule packs are Narvy-authored and run on the Semgrep OSS engine,
+  which is invoked as a dependency.
+
+### Notes
+
+- Runs entirely on your machine; nothing is uploaded unless you pass `--upload`.
+- Honest coverage limits are surfaced in the tool's own output (for example,
+  FairPlay-encrypted iOS binaries and partial multi-ABI native coverage).
+
 ## [0.9.0]
 
 First public release. A free, local security scanner that runs entirely on your

{narvy_cli-1.0.0/narvy_cli.egg-info → narvy_cli-1.0.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: narvy-cli
-Version: 1.0.0
+Version: 1.0.1
 Summary: Free, local SAST scanner for Android, iOS, and polyglot web/backend source - plus passive web, host-audit, and cloud-posture scanning.
 Author: Narvy
 License: Apache-2.0
@@ -161,5 +161,7 @@ as Narvy's own.
 ## Contributing
 
 Issues and pull requests welcome, especially new or improved detection
-rules. Rule packs live under `narvy/rules/`: Android/iOS
-(`rules/android`, `rules/ios`) and web/backend (`rules/web`, Semgrep-based).
+rules. All rule packs are Narvy's own, under `narvy/rules/`: Android/iOS
+(`rules/android`, `rules/ios`) and web/backend (`rules/web`). The
+web/backend packs run on the Semgrep OSS engine, which Narvy invokes as a
+dependency; the rules themselves are authored by Narvy (Apache-2.0).

{narvy_cli-1.0.0 → narvy_cli-1.0.1}/README.md

@@ -128,5 +128,7 @@ as Narvy's own.
 ## Contributing
 
 Issues and pull requests welcome, especially new or improved detection
-rules. Rule packs live under `narvy/rules/`: Android/iOS
-(`rules/android`, `rules/ios`) and web/backend (`rules/web`, Semgrep-based).
+rules. All rule packs are Narvy's own, under `narvy/rules/`: Android/iOS
+(`rules/android`, `rules/ios`) and web/backend (`rules/web`). The
+web/backend packs run on the Semgrep OSS engine, which Narvy invokes as a
+dependency; the rules themselves are authored by Narvy (Apache-2.0).

{narvy_cli-1.0.0 → narvy_cli-1.0.1}/narvy/__init__.py

@@ -1,3 +1,3 @@
 """Narvy CLI - free, local SAST for Android, iOS and polyglot source."""
 
-__version__ = "1.0.0"
+__version__ = "1.0.1"

{narvy_cli-1.0.0 → narvy_cli-1.0.1}/narvy/cloud/aws_scan.py

@@ -1055,6 +1055,18 @@ def analyze_aws_security(credentials, region=None, endpoint_url=None):
         # letting the per-check handlers below report an empty, clean scan.
         _verify_credentials(endpoint_url=endpoint_url)
 
+        # Track every analyzer that could not complete (AccessDenied / throttling /
+        # missing permission) so 0 findings from a blinded scan is reported as a
+        # coverage gap, not as a clean pass.
+        coverage_errors = []
+
+        def _collect(dest, label, fn):
+            try:
+                dest.extend(fn())
+            except Exception as e:
+                coverage_errors.append(f"{label}: {e}")
+                logger.error(f"Error analyzing {label}: {e}")
+
         all_vulnerable_groups = []
         all_vulnerable_vpcs = []
         all_vulnerable_rds = []
@@ -1085,84 +1097,56 @@ def analyze_aws_security(credentials, region=None, endpoint_url=None):
             logger.info(f"Scanning {len(regions)} region(s)")
         except Exception as e:
             logger.error(f"Error getting regions: {str(e)}")
+            coverage_errors.append(f"region enumeration (ec2:DescribeRegions): {e}")
             regions = []
 
+        # Each analyzer is isolated: one AccessDenied must not skip its siblings for the region.
         for reg in regions:
             logger.info(f"Analyzing region: {reg}")
-            try:
-                all_vulnerable_groups.extend(analyze_security_groups(reg, endpoint_url=endpoint_url))
-                all_vulnerable_vpcs.extend(analyze_vpc_configuration(reg, endpoint_url=endpoint_url))
-                all_vulnerable_rds.extend(analyze_rds_instances(reg, endpoint_url=endpoint_url))
-                all_vulnerable_lambdas.extend(analyze_lambda_functions(reg, endpoint_url=endpoint_url))
-                all_vulnerable_ecs.extend(analyze_ecs_clusters(reg, endpoint_url=endpoint_url))
-                all_vulnerable_eb.extend(analyze_elastic_beanstalk(reg, endpoint_url=endpoint_url))
-                all_vulnerable_apis.extend(analyze_api_gateway(reg, endpoint_url=endpoint_url))
-                all_vulnerable_dynamodb.extend(analyze_dynamodb(reg, endpoint_url=endpoint_url))
-                all_gd_issues.extend(analyze_guardduty(reg, endpoint_url=endpoint_url))
-                all_vulnerable_eks.extend(analyze_eks(reg, endpoint_url=endpoint_url))
-                all_vulnerable_redshift.extend(analyze_redshift(reg, endpoint_url=endpoint_url))
-                all_vulnerable_secrets.extend(analyze_secrets_manager(reg, endpoint_url=endpoint_url))
-                all_vulnerable_sqs.extend(analyze_sqs(reg, endpoint_url=endpoint_url))
-                all_vulnerable_sns.extend(analyze_sns(reg, endpoint_url=endpoint_url))
-                all_vulnerable_glue_jobs.extend(analyze_glue(reg, endpoint_url=endpoint_url))
-                all_vulnerable_emr_clusters.extend(analyze_emr(reg, endpoint_url=endpoint_url))
-                all_vulnerable_kms_keys.extend(analyze_kms(reg, endpoint_url=endpoint_url))
-                all_waf_issues.extend(analyze_waf(reg, endpoint_url=endpoint_url))
-            except Exception as e:
-                logger.error(f"Error analyzing region {reg}: {str(e)}")
+            _collect(all_vulnerable_groups, f"{reg}/ec2_security_groups", lambda r=reg: analyze_security_groups(r, endpoint_url=endpoint_url))
+            _collect(all_vulnerable_vpcs, f"{reg}/vpc_configuration", lambda r=reg: analyze_vpc_configuration(r, endpoint_url=endpoint_url))
+            _collect(all_vulnerable_rds, f"{reg}/rds_instances", lambda r=reg: analyze_rds_instances(r, endpoint_url=endpoint_url))
+            _collect(all_vulnerable_lambdas, f"{reg}/lambda_functions", lambda r=reg: analyze_lambda_functions(r, endpoint_url=endpoint_url))
+            _collect(all_vulnerable_ecs, f"{reg}/ecs_clusters", lambda r=reg: analyze_ecs_clusters(r, endpoint_url=endpoint_url))
+            _collect(all_vulnerable_eb, f"{reg}/elastic_beanstalk", lambda r=reg: analyze_elastic_beanstalk(r, endpoint_url=endpoint_url))
+            _collect(all_vulnerable_apis, f"{reg}/api_gateway", lambda r=reg: analyze_api_gateway(r, endpoint_url=endpoint_url))
+            _collect(all_vulnerable_dynamodb, f"{reg}/dynamodb", lambda r=reg: analyze_dynamodb(r, endpoint_url=endpoint_url))
+            _collect(all_gd_issues, f"{reg}/guardduty", lambda r=reg: analyze_guardduty(r, endpoint_url=endpoint_url))
+            _collect(all_vulnerable_eks, f"{reg}/eks_clusters", lambda r=reg: analyze_eks(r, endpoint_url=endpoint_url))
+            _collect(all_vulnerable_redshift, f"{reg}/redshift_clusters", lambda r=reg: analyze_redshift(r, endpoint_url=endpoint_url))
+            _collect(all_vulnerable_secrets, f"{reg}/secrets_manager", lambda r=reg: analyze_secrets_manager(r, endpoint_url=endpoint_url))
+            _collect(all_vulnerable_sqs, f"{reg}/sqs_queues", lambda r=reg: analyze_sqs(r, endpoint_url=endpoint_url))
+            _collect(all_vulnerable_sns, f"{reg}/sns_topics", lambda r=reg: analyze_sns(r, endpoint_url=endpoint_url))
+            _collect(all_vulnerable_glue_jobs, f"{reg}/glue_jobs", lambda r=reg: analyze_glue(r, endpoint_url=endpoint_url))
+            _collect(all_vulnerable_emr_clusters, f"{reg}/emr_clusters", lambda r=reg: analyze_emr(r, endpoint_url=endpoint_url))
+            _collect(all_vulnerable_kms_keys, f"{reg}/kms_keys", lambda r=reg: analyze_kms(r, endpoint_url=endpoint_url))
+            _collect(all_waf_issues, f"{reg}/waf", lambda r=reg: analyze_waf(r, endpoint_url=endpoint_url))
 
         # Account-scoped checks: run once against the primary region only.
         primary_region = regions[0] if regions else (region or 'us-east-1')
-        try:
-            all_cloudtrail_issues.extend(
-                analyze_cloudtrail(primary_region, endpoint_url=endpoint_url))
-        except Exception as e:
-            logger.error(f"Error analyzing CloudTrail: {str(e)}")
-        try:
-            all_config_issues.extend(
-                analyze_config(primary_region, endpoint_url=endpoint_url))
-        except Exception as e:
-            logger.error(f"Error analyzing Config: {str(e)}")
-        try:
-            all_cloudwatch_issues.extend(
-                analyze_cloudwatch(primary_region, endpoint_url=endpoint_url))
-        except Exception as e:
-            logger.error(f"Error analyzing CloudWatch: {str(e)}")
+        _collect(all_cloudtrail_issues, "cloudtrail", lambda: analyze_cloudtrail(primary_region, endpoint_url=endpoint_url))
+        _collect(all_config_issues, "config", lambda: analyze_config(primary_region, endpoint_url=endpoint_url))
+        _collect(all_cloudwatch_issues, "cloudwatch", lambda: analyze_cloudwatch(primary_region, endpoint_url=endpoint_url))
 
-        try:
-            logger.info("Analyzing S3 Buckets...")
-            vulnerable_buckets = analyze_s3_buckets(endpoint_url=endpoint_url)
-        except Exception as e:
-            logger.error(f"Error analyzing S3 buckets: {str(e)}")
-            vulnerable_buckets = []
+        vulnerable_buckets = []
+        logger.info("Analyzing S3 Buckets...")
+        _collect(vulnerable_buckets, "s3_buckets", lambda: analyze_s3_buckets(endpoint_url=endpoint_url))
 
-        try:
-            logger.info("Analyzing IAM Users for MFA...")
-            users_without_mfa = analyze_iam_users(endpoint_url=endpoint_url)
-        except Exception as e:
-            logger.error(f"Error analyzing IAM users: {str(e)}")
-            users_without_mfa = []
+        users_without_mfa = []
+        logger.info("Analyzing IAM Users for MFA...")
+        _collect(users_without_mfa, "iam_users", lambda: analyze_iam_users(endpoint_url=endpoint_url))
 
-        try:
-            logger.info("Analyzing IAM Policies...")
-            risky_policies = analyze_iam_policies(endpoint_url=endpoint_url)
-        except Exception as e:
-            logger.error(f"Error analyzing IAM policies: {str(e)}")
-            risky_policies = []
+        risky_policies = []
+        logger.info("Analyzing IAM Policies...")
+        _collect(risky_policies, "iam_policies", lambda: analyze_iam_policies(endpoint_url=endpoint_url))
 
-        try:
-            logger.info("Analyzing CloudFront Distributions...")
-            vulnerable_cf = analyze_cloudfront(endpoint_url=endpoint_url)
-        except Exception as e:
-            logger.error(f"Error analyzing CloudFront: {str(e)}")
-            vulnerable_cf = []
+        vulnerable_cf = []
+        logger.info("Analyzing CloudFront Distributions...")
+        _collect(vulnerable_cf, "cloudfront", lambda: analyze_cloudfront(endpoint_url=endpoint_url))
 
-        try:
-            logger.info("Checking CIS Compliance...")
-            compliance_issues = check_cis_compliance(endpoint_url=endpoint_url)
-        except Exception as e:
-            logger.error(f"Error checking CIS compliance: {str(e)}")
-            compliance_issues = []
+        compliance_issues = []
+        logger.info("Checking CIS Compliance...")
+        _collect(compliance_issues, "cis_compliance", lambda: check_cis_compliance(endpoint_url=endpoint_url))
 
         logger.info("Generating report")
         report = generate_report(
@@ -1175,6 +1159,14 @@ def analyze_aws_security(credentials, region=None, endpoint_url=None):
             all_vulnerable_kms_keys, all_config_issues, all_cloudtrail_issues, all_cloudwatch_issues
         )
 
+        # Coverage: a scan that could not read some services/regions is NOT a clean 0.
+        report["coverage"] = {
+            "status": "partial" if coverage_errors else "complete",
+            "regions_scanned": len(regions),
+            "checks_skipped": len(coverage_errors),
+            "errors": coverage_errors,
+        }
+
         logger.info("AWS security analysis complete")
         return report
 

{narvy_cli-1.0.0 → narvy_cli-1.0.1}/narvy/main.py

@@ -19,7 +19,7 @@ from rich.markup import escape as rich_escape
 from rich.prompt import Confirm
 
 from narvy import __version__
-from narvy.reporter import generate_sarif_report
+from narvy.reporter import generate_sarif_report, sarif_level, sarif_security_severity
 from .decompiler import decompile_apk
 from .rule_engine import load_rules_from_dir, run_rules_on_file
 from . import auth, uploader
@@ -551,13 +551,19 @@ def _sca_coverage(stats):
         reasons.append("osv_dependency_cap")
     if stats.get("github_rate_limited"):
         reasons.append("github_advisory_rate_limit")
+    # An OSV outage / cold cache means "0 CVEs" is UNKNOWN, not clean: degrade, don't pass.
+    unreachable = bool(stats.get("osv_unreachable"))
+    if unreachable:
+        reasons.append("osv_unreachable")
     cov = {
-        "status": "partial" if reasons else "complete",
+        "status": "degraded" if unreachable else ("partial" if reasons else "complete"),
         "dependencies_detected": detected,
         "dependencies_checked": checked,
     }
     if reasons:
         cov["degraded_reasons"] = reasons
+    if stats.get("osv_dependencies_unresolved"):
+        cov["dependencies_unresolved"] = stats["osv_dependencies_unresolved"]
     return cov
 
 
@@ -1240,10 +1246,28 @@ def cmd_scan(args):
         console.print("[dim]This is a flat, unfiltered list (one row per rule hit). The cloud groups, de-duplicates and false-positive-filters the same findings and shows a severity-ranked default view, so its headline count for the same code is often different - and can be smaller - by design, not because it found less.[/dim]")
         console.print("Run `narvy login` then re-run with [bold]--upload[/bold] for the full server-side scan (compliance mapping, ML triage, dashboard history) - [link=https://narvy.io]narvy.io[/link]")
 
+    # SCA that could not reach OSV.dev (outage / cold cache) reports 0 CVEs as UNKNOWN, not clean.
+    sca_cov = scan_meta.get("sca_coverage")
+    if isinstance(sca_cov, dict) and sca_cov.get("status") == "degraded":
+        _unres = sca_cov.get("dependencies_unresolved", 0)
+        console.print(
+            f"[bold yellow]SCA is INCOMPLETE: the OSV.dev vulnerability database was "
+            f"unreachable (network error / cold cache), so {_unres} dependency(ies) "
+            f"could not be checked. Treat 0 CVEs on those as UNKNOWN, not as clean - "
+            f"re-run with network access to OSV.dev.[/bold yellow]"
+        )
+
     # Must stay last so failing the build never swallows the report/upload.
     # A coverage gap = a pass that couldn't read the target, where exit 0 would falsely claim clean.
     coverage_gaps = []
     if getattr(args, "fail_on", None):
+        if isinstance(sca_cov, dict) and sca_cov.get("status") == "degraded":
+            coverage_gaps.append(
+                "The SCA dependency pass could not reach the OSV.dev vulnerability "
+                f"database for {sca_cov.get('dependencies_unresolved', 0)} dependency(ies) "
+                "(network error / cold cache), so their CVE status is UNKNOWN. Re-run "
+                "with network access to OSV.dev."
+            )
         if encrypted_scan:
             coverage_gaps.append(
                 "This IPA is FairPlay-encrypted, so the rules that read code and string "
@@ -1361,6 +1385,17 @@ def cmd_upload_all(args):
         raise SystemExit(1)
 
 
+def _reject_format_as_file(output_file):
+    """Catch a swapped flag: -f/--file given a format name (e.g. `-f json`) instead of a path."""
+    if output_file in ("text", "json", "sarif"):
+        console.print(
+            f"[bold red]ERROR:[/bold red] -f/--file expects a file path but got "
+            f"'{output_file}', which is a format name. Use [bold]-o {output_file}[/bold] "
+            f"to select the format, and -f/--file for the output path ('-' for stdout)."
+        )
+        raise SystemExit(2)
+
+
 def _write_or_print(output_text, output_path):
     if output_path and output_path != "-":
         try:
@@ -1435,25 +1470,48 @@ def _exit_on_fail_on(findings, fail_on, get_severity=lambda f: f.get("severity",
     raise SystemExit(1)
 
 
+def _sarif_result(rule_id, message_text, uri, severity):
+    """One SARIF result carrying level + security-severity, so consumers can rank it."""
+    return {
+        "ruleId": rule_id,
+        "level": sarif_level(severity),
+        "message": {"text": message_text},
+        "locations": [{"physicalLocation": {"artifactLocation": {"uri": uri or ""}}}],
+        "properties": {"security-severity": sarif_security_severity(severity)},
+    }
+
+
 def _distinct_rules_from_results(results):
     """tool.driver.rules descriptors for the distinct ruleIds in `results`, in insertion order.
-    SARIF consumers resolve results[].ruleId against tool.driver.rules[].id, so every referenced id must be declared."""
+    SARIF consumers resolve results[].ruleId against tool.driver.rules[].id, so every referenced id must be
+    declared; each carries the highest security-severity/level seen for that id."""
     rules = []
-    seen = set()
+    seen = {}
     for r in results:
         rid = r.get("ruleId")
-        if rid and rid not in seen:
-            seen.add(rid)
-            rules.append({"id": rid})
+        if not rid:
+            continue
+        ss = r.get("properties", {}).get("security-severity", "0.0")
+        lvl = r.get("level", "warning")
+        if rid not in seen:
+            entry = {"id": rid,
+                     "defaultConfiguration": {"level": lvl},
+                     "properties": {"security-severity": ss}}
+            seen[rid] = entry
+            rules.append(entry)
+        elif float(ss) > float(seen[rid]["properties"]["security-severity"]):
+            seen[rid]["properties"]["security-severity"] = ss
+            seen[rid]["defaultConfiguration"]["level"] = lvl
     return rules
 
 
 def _web_to_sarif(findings):
-    results = [{
-        "ruleId": f.get("template_id", "web-finding"),
-        "message": {"text": f.get("title", f.get("description", ""))},
-        "locations": [{"physicalLocation": {"artifactLocation": {"uri": f.get("url", "")}}}],
-    } for f in findings]
+    results = [_sarif_result(
+        f.get("template_id", "web-finding"),
+        f.get("title", f.get("description", "")),
+        f.get("url", ""),
+        f.get("severity"),
+    ) for f in findings]
     return {
         "$schema": "https://schemastore.azurewebsites.net/schemas/json/sarif-2.1.0-rtm.5.json",
         "version": "2.1.0",
@@ -1466,6 +1524,7 @@ def _web_to_sarif(findings):
 
 
 def cmd_web_scan(args):
+    _reject_format_as_file(args.output_file)
     # nuclei treats a non-positive rate as no rate limiting at all.
     rate_limit = max(1, min(args.rate_limit, WEB_MAX_RATE_LIMIT))
 
@@ -1543,15 +1602,24 @@ def cmd_web_scan(args):
         output = "\n".join(lines)
 
     _write_or_print(output, args.output_file)
-    _exit_on_fail_on(findings, args.fail_on)
+    coverage_gaps = []
+    if result.get("coverage_incomplete"):
+        coverage_gaps.append(
+            result.get("redirect_note")
+            or "Only part of the target could be scanned (a redirect led to a host the "
+               "SSRF policy would not follow), so these results are incomplete - 0 "
+               "findings means UNKNOWN, not clean."
+        )
+    _exit_on_fail_on(findings, args.fail_on, coverage_gaps=coverage_gaps)
 
 
 def _host_to_sarif(findings, coverage="unknown", audit_privilege="unknown"):
-    results = [{
-        "ruleId": f.get("rule_id") or "host-finding",
-        "message": {"text": f.get("title") or f.get("description", "")},
-        "locations": [{"physicalLocation": {"artifactLocation": {"uri": "lynis"}}}],
-    } for f in findings]
+    results = [_sarif_result(
+        f.get("rule_id") or "host-finding",
+        f.get("title") or f.get("description", ""),
+        f.get("location") or "lynis",
+        f.get("severity"),
+    ) for f in findings]
     return {
         "$schema": "https://schemastore.azurewebsites.net/schemas/json/sarif-2.1.0-rtm.5.json",
         "version": "2.1.0",
@@ -1584,6 +1652,7 @@ def _split_host_port(host, port):
 
 
 def cmd_host_audit(args):
+    _reject_format_as_file(args.output_file)
     args.host, args.port = _split_host_port(args.host, args.port)
     if args.format == "text":
         console.print(f"\n[bold]Narvy Host Audit[/bold] - {args.user}@{args.host}:{args.port}")
@@ -1690,7 +1759,15 @@ def cmd_host_audit(args):
         output = "\n".join(lines)
 
     _write_or_print(output, args.output_file)
-    _exit_on_fail_on(findings, args.fail_on)
+    coverage_gaps = []
+    if coverage == "partial":
+        coverage_gaps.append(
+            f"This was a PARTIAL audit (privilege: {audit_privilege}) - the root-only "
+            "CIS/deep hardening checks were skipped, so 0 findings at/above the "
+            "threshold means UNKNOWN for those checks, not clean. Run as root or with "
+            "NOPASSWD sudo for full coverage."
+        )
+    _exit_on_fail_on(findings, args.fail_on, coverage_gaps=coverage_gaps)
 
 
 def _cloud_flatten(report):
@@ -1716,11 +1793,12 @@ def _cloud_flatten(report):
 
 
 def _cloud_to_sarif(findings):
-    results = [{
-        "ruleId": f["category"],
-        "message": {"text": f["title"]},
-        "locations": [{"physicalLocation": {"artifactLocation": {"uri": f["resource"] or f["category"]}}}],
-    } for f in findings]
+    results = [_sarif_result(
+        f["category"],
+        f["title"],
+        f["resource"] or f["category"],
+        f.get("severity"),
+    ) for f in findings]
     return {
         "$schema": "https://schemastore.azurewebsites.net/schemas/json/sarif-2.1.0-rtm.5.json",
         "version": "2.1.0",
@@ -1733,6 +1811,7 @@ def _cloud_to_sarif(findings):
 
 
 def cmd_cloud_scan(args):
+    _reject_format_as_file(args.output_file)
     try:
         from .cloud.aws_scan import analyze_aws_security
     except ImportError:
@@ -1763,10 +1842,24 @@ def cmd_cloud_scan(args):
 
     findings = _cloud_flatten(report)
 
+    coverage = report.get("coverage") or {}
+    coverage_partial = coverage.get("status") == "partial"
+    coverage_gaps = []
+    if coverage_partial:
+        skipped = coverage.get("checks_skipped", 0)
+        coverage_gaps.append(
+            f"{skipped} AWS analyzer(s) could not complete (e.g. AccessDenied / "
+            "throttling / a denied permission), so those services/regions were NOT "
+            "assessed. 0 findings there means UNKNOWN, not clean. See coverage.errors "
+            "in the JSON output and re-run with a role that can read them."
+        )
+
     if args.format == "json":
         output = json.dumps(report, indent=2, default=str)
     elif args.format == "sarif":
-        output = json.dumps(_cloud_to_sarif(findings), indent=2)
+        sarif = _cloud_to_sarif(findings)
+        sarif["runs"][0]["properties"] = {"coverage": coverage}
+        output = json.dumps(sarif, indent=2)
     else:
         lines = [
             "=" * 60, "NARVY CLOUD POSTURE RESULTS", "=" * 60, "",
@@ -1780,14 +1873,24 @@ def cmd_cloud_scan(args):
             if by_sev.get(sev):
                 lines.append(f"  {sev.upper()}: {by_sev[sev]}")
         lines.append("")
+        if coverage_partial:
+            lines.append(
+                f"Coverage: PARTIAL - {coverage.get('checks_skipped', 0)} analyzer(s) "
+                "could not complete (AccessDenied / throttling / denied permission). "
+                "Those services/regions were NOT assessed; 0 findings there is UNKNOWN, "
+                "not clean:")
+            for err in coverage.get("errors", []):
+                lines.append(f"  - {err}")
+            lines.append("")
         for f in findings:
             lines.append(f"[{f['severity'].upper()}] ({f['category']}) {f['title']}")
         if not findings:
-            lines.append("No issues found.")
+            lines.append("No issues found." if not coverage_partial
+                         else "No issues found among the services that COULD be assessed (see coverage note above).")
         output = "\n".join(lines)
 
     _write_or_print(output, args.output_file)
-    _exit_on_fail_on(findings, args.fail_on)
+    _exit_on_fail_on(findings, args.fail_on, coverage_gaps=coverage_gaps)
 
 
 _CI_TEMPLATES = {
@@ -1942,8 +2045,11 @@ def cli():
                         help="Dynamic mode: run nuclei's full template set (sends non-GET probes, checks input handling, etc.) instead of the passive GET-only subset. Only scan targets you own or are explicitly authorized to test. Destructive tags (dos, fuzzing, brute-force, intrusive) stay excluded.")
     p_web.add_argument("--rate-limit", type=int, default=WEB_MAX_RATE_LIMIT,
                         help=f"Requests per second (max {WEB_MAX_RATE_LIMIT}, enforced)")
-    p_web.add_argument("--format", "-f", choices=["text", "json", "sarif"], default="text")
-    p_web.add_argument("--output-file", "-o", help="Output file path (default: stdout)")
+    p_web.add_argument("--output", "-o", "--format", dest="format", choices=["text", "json", "sarif"],
+                       default="text", type=str.lower,
+                       help="Output format: text (default), json or sarif. Consistent with `scan`: -o = format.")
+    p_web.add_argument("--file", "-f", "--output-file", dest="output_file", default=None,
+                       help="Write output to this path ('-' = stdout, the default). Consistent with `scan`: -f = file.")
     p_web.add_argument("--fail-on", choices=["critical", "high", "medium", "low", "any"])
     p_web.set_defaults(func=cmd_web_scan)
 
@@ -1955,16 +2061,22 @@ def cli():
                         help="Authenticate with an SSH password (prompted, or read from the NARVY_SSH_PASSWORD env var) instead of a key. The host key is captured on first contact (trust-on-first-use) and pinned for the duration of this run. Note: this is not a defence against an active man-in-the-middle, which would have its own key pinned; only send a password over a network you trust, and prefer key auth where possible.")
     p_host.add_argument("--privilege", choices=["auto", "root", "nopasswd_sudo", "none"],
                          default="auto", help="Privilege mode (default: auto-detect)")
-    p_host.add_argument("--format", "-f", choices=["text", "json", "sarif"], default="text")
-    p_host.add_argument("--output-file", "-o", help="Output file path (default: stdout)")
+    p_host.add_argument("--output", "-o", "--format", dest="format", choices=["text", "json", "sarif"],
+                        default="text", type=str.lower,
+                        help="Output format: text (default), json or sarif. Consistent with `scan`: -o = format.")
+    p_host.add_argument("--file", "-f", "--output-file", dest="output_file", default=None,
+                        help="Write output to this path ('-' = stdout, the default). Consistent with `scan`: -f = file.")
     p_host.add_argument("--fail-on", choices=["critical", "high", "medium", "low", "any"])
     p_host.set_defaults(func=cmd_host_audit)
 
     p_cloud = sub.add_parser("cloud-scan", help="Cloud posture scan using your own ambient credentials (aws configure / env vars / IAM role - zero credential custody)")
     p_cloud.add_argument("--provider", choices=["aws"], default="aws", help="Cloud provider (GCP/Azure not yet in the CLI)")
     p_cloud.add_argument("--region", help="Specific region to scan (default: all regions)")
-    p_cloud.add_argument("--format", "-f", choices=["text", "json", "sarif"], default="text")
-    p_cloud.add_argument("--output-file", "-o", help="Output file path (default: stdout)")
+    p_cloud.add_argument("--output", "-o", "--format", dest="format", choices=["text", "json", "sarif"],
+                         default="text", type=str.lower,
+                         help="Output format: text (default), json or sarif. Consistent with `scan`: -o = format.")
+    p_cloud.add_argument("--file", "-f", "--output-file", dest="output_file", default=None,
+                         help="Write output to this path ('-' = stdout, the default). Consistent with `scan`: -f = file.")
     p_cloud.add_argument("--fail-on", choices=["critical", "high", "medium", "low", "any"])
     p_cloud.set_defaults(func=cmd_cloud_scan)
 

{narvy_cli-1.0.0 → narvy_cli-1.0.1}/narvy/reporter.py

@@ -3,6 +3,28 @@ from typing import List, Dict, Any
 
 from narvy import __version__
 
+# Canonical SARIF severity mapping, shared by every emitter (scan + web/host/cloud).
+# level = SARIF's per-result rank; security-severity = GitHub/GitLab 0-10 code-scanning score.
+_SARIF_LEVEL_BY_SEV = {
+    "critical": "error", "high": "error",
+    "medium": "warning",
+    "low": "note", "info": "note",
+}
+_SARIF_SECURITY_SEVERITY_BY_SEV = {
+    "critical": "9.5", "high": "8.0", "medium": "5.5", "low": "2.0", "info": "0.0",
+}
+
+
+def sarif_level(severity: str) -> str:
+    """SARIF result level (error/warning/note) for a finding severity."""
+    return _SARIF_LEVEL_BY_SEV.get(str(severity or "").strip().lower(), "warning")
+
+
+def sarif_security_severity(severity: str) -> str:
+    """GitHub/GitLab code-scanning security-severity (0-10 string) for a finding severity."""
+    return _SARIF_SECURITY_SEVERITY_BY_SEV.get(str(severity or "").strip().lower(), "0.0")
+
+
 _FAIRPLAY_RULE_ID = "IOS-FAIRPLAY-ENCRYPTED"
 _FAIRPLAY_COVERAGE_TEXT = (
     "Partial coverage: this iOS binary is FairPlay-encrypted (App Store DRM, "
@@ -51,6 +73,7 @@ def generate_sarif_report(findings: List[Dict[str, Any]], rules: List[Dict[str,
                 "confidence": confidence,
                 "precision": _SARIF_PRECISION.get(confidence, "medium"),
                 "severity": _sev or "UNKNOWN",
+                "security-severity": sarif_security_severity(_sev),
                 **({"prngContext": finding['details']['prng_context'],
                     "prngContextEvidence": finding['details'].get('prng_context_evidence', '')}
                    if isinstance(finding.get('details'), dict)
@@ -81,6 +104,7 @@ def generate_sarif_report(findings: List[Dict[str, Any]], rules: List[Dict[str,
     tool_rules = []
     for rule in rules:
         rule_confidence = rule.get('confidence', 'MEDIUM')
+        _rule_sev = str(rule.get('severity', '') or '').lower()
         tool_rules.append({
             "id": rule['id'],
             "name": rule['name'],
@@ -93,10 +117,12 @@ def generate_sarif_report(findings: List[Dict[str, Any]], rules: List[Dict[str,
             "help": {
                 "text": f"CWE: {rule['details'].get('cwe')}\nMASVS: {rule['details'].get('masvs')}"
             },
+            "defaultConfiguration": {"level": sarif_level(_rule_sev)},
             "properties": {
                 "tags": ["security", "android", rule.get('masvs', '').lower()],
                 "precision": _SARIF_PRECISION.get(rule_confidence, "medium"),
-                "problem.severity": rule.get('severity', 'UNKNOWN').lower()
+                "problem.severity": rule.get('severity', 'UNKNOWN').lower(),
+                "security-severity": sarif_security_severity(_rule_sev),
             }
         })
 

{narvy_cli-1.0.0 → narvy_cli-1.0.1}/narvy/sca/android_deps.py

@@ -330,6 +330,8 @@ def scan(apk_path: str, osv_client: OSVClient = None) -> Tuple[List[Dict[str, An
     rule_defs: List[Dict[str, Any]] = []
     vulnerable_coords: Set[str] = set()
 
+    unresolved_before = getattr(client, "query_failures_no_cache", 0)
+
     for dep in deduped:
         if not dep.version or dep.version == "unknown":
             continue
@@ -346,4 +348,7 @@ def scan(apk_path: str, osv_client: OSVClient = None) -> Tuple[List[Dict[str, An
             vulnerable_coords.add(dep.maven_name)
 
     stats["vulnerable_dependencies"] = len(vulnerable_coords)
+    unresolved = getattr(client, "query_failures_no_cache", 0) - unresolved_before
+    stats["osv_dependencies_unresolved"] = unresolved
+    stats["osv_unreachable"] = unresolved > 0
     return findings, rule_defs, stats

{narvy_cli-1.0.0 → narvy_cli-1.0.1}/narvy/sca/ios_deps.py

@@ -544,6 +544,8 @@ def _scan_deps(deps: List[_IOSDep], osv_client: Optional[OSVClient] = None) -> T
     vulnerable_names: set = set()
     gh_used_for = 0
 
+    unresolved_before = getattr(client, "query_failures_no_cache", 0)
+
     for dep in unique_deps:
         use_github = gh_used_for < _GH_MAX_QUERIES_PER_SCAN
         cve_hits = _check_all_sources(dep, client, gh_budget, use_github)
@@ -563,6 +565,9 @@ def _scan_deps(deps: List[_IOSDep], osv_client: Optional[OSVClient] = None) -> T
         "github_queries_made": gh_budget.queries_made,
         "github_rate_limited": gh_budget.exhausted,
     }
+    unresolved = getattr(client, "query_failures_no_cache", 0) - unresolved_before
+    stats["osv_dependencies_unresolved"] = unresolved
+    stats["osv_unreachable"] = unresolved > 0
     return findings, rule_defs, stats
 
 

{narvy_cli-1.0.0 → narvy_cli-1.0.1}/narvy/sca/osv_client.py

@@ -472,6 +472,9 @@ class OSVClient:
         self.batch_url = batch_url
         self.timeout = timeout
         self.cache = cache or OSVCache()
+        # Coverage counters: tell "0 CVEs because OSV said so" from "0 because OSV was unreachable".
+        self.batch_failures = 0
+        self.query_failures_no_cache = 0
         self._session = session or requests.Session()
         self._session.headers.update(
             {
@@ -543,6 +546,8 @@ class OSVClient:
                     )
                     if f is not None
                 ]
+            # Failed and nothing cached: this dependency is UNKNOWN, not clean.
+            self.query_failures_no_cache += 1
             return []
 
     def query_dict(self, package_name: str, version: str, ecosystem: str = "Maven") -> List[Dict[str, Any]]:
@@ -590,14 +595,21 @@ class OSVClient:
                 resp.raise_for_status()
                 data = resp.json()
                 results = data.get("results", []) or []
-                for idx, r in enumerate(results):
-                    if idx >= len(chunk):
-                        break
-                    vulns = r.get("vulns") or []
-                    if vulns:
+                # A short/empty results array leaves some queried deps unanswered:
+                # mark each unresolved (defer to query()) so the coverage gate sees it.
+                incomplete = False
+                for idx in range(len(chunk)):
+                    r = results[idx] if idx < len(results) else None
+                    if not isinstance(r, dict):
                         result[chunk[idx]] = True
+                        incomplete = True
+                    elif r.get("vulns"):
+                        result[chunk[idx]] = True
+                if incomplete:
+                    self.batch_failures += 1
             except (requests.RequestException, ValueError, json.JSONDecodeError) as exc:
                 logger.warning(f"OSV batch query failed (chunk {i}-{i+len(chunk)}): {exc}")
+                self.batch_failures += 1
                 # Unknown for this chunk: defer to query() rather than under-report.
                 for name, version in chunk:
                     result[(name, version)] = True

{narvy_cli-1.0.0 → narvy_cli-1.0.1}/narvy/sca/web_deps.py

@@ -932,6 +932,8 @@ def scan(source_dir: str, osv_client: OSVClient = None) -> Tuple[List[Dict[str,
     rule_defs: List[Dict[str, Any]] = []
     vulnerable_coords: Set[str] = set()
 
+    unresolved_before = getattr(client, "query_failures_no_cache", 0)
+
     for ecosystem, eco_deps in by_ecosystem.items():
         pkg_version_pairs = [(d.name, d.version) for d in eco_deps]
         has_vuln = client.has_any_vuln_batch(pkg_version_pairs, ecosystem=ecosystem)
@@ -952,4 +954,7 @@ def scan(source_dir: str, osv_client: OSVClient = None) -> Tuple[List[Dict[str,
                 vulnerable_coords.add(f"{dep.ecosystem}:{dep.name}")
 
     stats["vulnerable_dependencies"] = len(vulnerable_coords)
+    unresolved = getattr(client, "query_failures_no_cache", 0) - unresolved_before
+    stats["osv_dependencies_unresolved"] = unresolved
+    stats["osv_unreachable"] = unresolved > 0
     return findings, rule_defs, stats

{narvy_cli-1.0.0 → narvy_cli-1.0.1}/narvy/web/scanner.py

@@ -173,7 +173,7 @@ class NucleiScanner:
         """Follow `target`'s redirect chain through the SSRF guard; never raises
         (keeps the original target on failure). Returns {url, note, final_status}."""
         from .ssrf_guard import safe_get as _ssrf_safe_get, SSRFBlocked as _Blocked
-        out = {"url": target, "note": None, "final_status": None}
+        out = {"url": target, "note": None, "final_status": None, "coverage_incomplete": False}
         try:
             resp = _ssrf_safe_get(
                 target, timeout=10, verify=False,
@@ -188,6 +188,7 @@ class NucleiScanner:
                 f"Only the redirect stub at {target} was scanned - treat these results "
                 f"as incomplete."
             )
+            out["coverage_incomplete"] = True
             logger.warning(f"_resolve_redirect_target: {out['note']}")
             return out
         except Exception as e:
@@ -210,6 +211,7 @@ class NucleiScanner:
                     f"(SSRF policy: {e}). Only the redirect stub at {target} was "
                     f"scanned - treat these results as incomplete."
                 )
+                out["coverage_incomplete"] = True
                 logger.warning(f"_resolve_redirect_target: {out['note']}")
                 return out
             out["url"] = final_url
@@ -379,6 +381,7 @@ class NucleiScanner:
             "target": target,
             "scanned_url": scan_target,
             "redirect_note": redirect_note,
+            "coverage_incomplete": redirect.get("coverage_incomplete", False),
             "degraded": False,
             "degraded_reason": None,
         }

{narvy_cli-1.0.0 → narvy_cli-1.0.1/narvy_cli.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: narvy-cli
-Version: 1.0.0
+Version: 1.0.1
 Summary: Free, local SAST scanner for Android, iOS, and polyglot web/backend source - plus passive web, host-audit, and cloud-posture scanning.
 Author: Narvy
 License: Apache-2.0
@@ -161,5 +161,7 @@ as Narvy's own.
 ## Contributing
 
 Issues and pull requests welcome, especially new or improved detection
-rules. Rule packs live under `narvy/rules/`: Android/iOS
-(`rules/android`, `rules/ios`) and web/backend (`rules/web`, Semgrep-based).
+rules. All rule packs are Narvy's own, under `narvy/rules/`: Android/iOS
+(`rules/android`, `rules/ios`) and web/backend (`rules/web`). The
+web/backend packs run on the Semgrep OSS engine, which Narvy invokes as a
+dependency; the rules themselves are authored by Narvy (Apache-2.0).