narvy-cli 1.0.3__tar.gz → 1.1.1__tar.gz

narvy_cli-1.1.1/CHANGELOG.md

@@ -0,0 +1,116 @@
+# Changelog
+
+All notable changes to this project are documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [1.1.1]
+
+### Added
+
+- Flask cookie checks: `set_cookie()` without `httponly=True` or
+  `secure=True`, the same checks Django already had.
+- `scan` warns when files or folders could not be read (permissions) instead
+  of skipping them silently; `-v` lists them and the JSON report has
+  `summary.unreadable_paths`.
+- `scan --format` is accepted as an alias of `--output`, like the other
+  commands.
+
+### Fixed
+
+- A second `scan` of the same folder picked up the report written by the
+  first one (`narvy.sarif`, the JSON report) and flagged the rule text quoted
+  in it as secrets. Narvy reports are now recognized by their content, and
+  the `--file` target is never scanned.
+- `--upload` with only `NARVY_TOKEN` set printed "Uploading ... to  for
+  server-side curation". The line now names the server (`narvy.io`, or
+  `NARVY_URL`), and a failed upload or login says which server refused it.
+- `web-scan http://localhost` said "internal/metadata addresses"; it now says
+  the address is loopback and explains why local and private targets are
+  refused.
+- The web-scan, host-audit and cloud-scan JSON output carries a `tool` field.
+- `narvy doctor` documents its exit codes (0 all required checks pass, 1 one
+  failed).
+
+## [1.1.0]
+
+First release of the community rule set. The 1.0.x preview releases were
+withdrawn; 1.1.0 replaces them.
+
+### Added
+
+- PHP: reflected XSS where request input is concatenated or interpolated into
+  an HTML string, and an `include`/`require` of a variable that is set in
+  another file (reported as HIGH, to review).
+- Python and Ruby rules: tainted module import, deprecated `ssl.wrap_socket`,
+  response header CRLF injection, SSRF from a request-controlled host.
+- A web repository that also holds an iOS app in a subdirectory (an Xcode
+  project, workspace or `Package.swift` next to a server directory) is now
+  scanned on both surfaces, and the report lists them. Sample, test and
+  vendored projects are skipped.
+- `--upload` prints a direct link to the scan in the dashboard.
+- Outside a terminal (CI logs), a "still running" line every 30 seconds
+  (`NARVY_PROGRESS_INTERVAL`, 0 = off).
+- Anonymous usage telemetry, listed field by field in the README, with a
+  notice on first run. Off with `narvy telemetry off`, `NARVY_TELEMETRY=0` or
+  `DO_NOT_TRACK=1`.
+
+### Changed
+
+- Framework-specific rules and the C#/.NET code rules are no longer in the
+  CLI; they run on Narvy paid plans. The CLI states in one line when a scanned
+  project uses one of those frameworks. C#/.NET projects get secrets and NuGet
+  dependency checks.
+- Exit codes are distinct and listed in `--help`: 0 completed, 1 `--fail-on`
+  threshold reached, 2 `--fail-on` could not certify the result (part of the
+  scan did not run), 3 target or arguments not usable, 4 scan, login, upload
+  or write failure. Exit 1 on `--fail-on` is unchanged.
+- The structural analysis uses at most 4 workers and a memory ceiling, and
+  trees above 20,000 files are scanned in directory batches. On the Linux
+  kernel tree, peak memory went from 13 GB to 2.2 GB with the same findings
+  (the scan takes longer). `NARVY_SEMGREP_JOBS`,
+  `NARVY_SEMGREP_MAX_MEMORY_MB`, `NARVY_SEMGREP_BATCH_FILES` override.
+- Help for `--upload` and `--fail-on` rewritten; the `.narvy-scope.yml` tip
+  links to the public documentation.
+- The FairPlay notice no longer says dynamic analysis always covers an
+  encrypted app's own code: it does for most apps, and strongly protected apps
+  can block it.
+
+### Fixed
+
+- PHP findings changed from one run to the next (49 to 52 on the same code):
+  the PHP parser is not safe with parallel workers. PHP rules now run in a
+  single worker.
+- PHP command injection with a trailing concatenation
+  (`shell_exec('ping ' . $target)`) was not detected, and escaping functions
+  were not recognized as sanitizers. Values checked with `is_numeric()`,
+  `ctype_digit()` or `filter_var()` are now treated as safe.
+- Private-key detection no longer fires on a lone `BEGIN PRIVATE KEY`
+  delimiter string; keys embedded as a single escaped string are still found.
+  The high-entropy secret rule ignores public keys, constant names and path
+  values. Rust: DDL statements built with `format!` are no longer reported as
+  SQL injection.
+- A web repository with an iOS app in a subdirectory was reported as web only,
+  with a coverage note pointing to a directory that did not exist.
+- SCA on an app with no identifiable dependency versions printed "0 known
+  CVEs across 0 dependencies", which reads as clean. It now says the check
+  was not applicable (`applicable: false` in JSON).
+- Upgrade links returned by the server as relative paths are printed as full
+  URLs.
+- semgrep installed by pipx or in a non-activated virtualenv was not found,
+  and the scan fell back to regex rules only.
+- Cancelling a scan (SIGTERM/SIGHUP, CI cancel) left semgrep workers running,
+  including workers that ignore SIGTERM.
+- Without network access, each semgrep pass stalled for about 100 seconds on
+  semgrep's own version check. The version check and semgrep metrics are now
+  off.
+- `web-scan --active` always timed out: its time budget assumed a third of the
+  real template set.
+- A corrupt or truncated APK/AAB/IPA exits 3 (unusable target) instead of 4.
+  `host-audit` rejects an invalid host, user or port before connecting (exit 3).
+- An output path that is a directory, or in a missing directory, is refused
+  before the scan starts, for `web-scan`, `host-audit` and `cloud-scan` too.
+- `narvy doctor` printed raw color codes from nuclei's version banner.
+- C/C++ files are reported as not analyzed instead of being silently skipped.
+- Plain APK results uploaded with `--upload` were filed as source scans.

{narvy_cli-1.0.3/narvy_cli.egg-info → narvy_cli-1.1.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: narvy-cli
-Version: 1.0.3
+Version: 1.1.1
 Summary: Free, local SAST scanner for Android, iOS, and polyglot web/backend source - plus passive web, host-audit, and cloud-posture scanning.
 Author: Narvy
 License: Apache-2.0
@@ -45,18 +45,20 @@ cryptography, SSRF, injection, and more - in:
   `.apks`), or a raw Gradle/Kotlin source checkout
 - **iOS**: an unencrypted `.ipa`, or a raw Xcode/Swift source checkout
 - **Web/backend source**: JavaScript/TypeScript, Python, PHP, Go, Ruby,
-  Rust, Java/Kotlin, C#/.NET
+  Rust, Java/Kotlin, and C#/.NET (secrets and dependencies)
 
 It also ships three standalone scanners that need nothing but network
 access or your own existing credentials:
 
-- `web-scan` - passive Nuclei-based scan of a live URL
+- `web-scan` - Nuclei-based scan of a live URL (passive by default, `--active` opt-in)
 - `host-audit` - agentless host audit over your own SSH access (Narvy's own
   host checks plus Lynis (GPL-3.0) as the hardening baseline)
 - `cloud-scan` - AWS account posture check using your own ambient AWS
   credentials
 
-Nothing is uploaded anywhere unless you explicitly pass `--upload`.
+Your code, binaries and findings are never uploaded unless you explicitly
+pass `--upload`. The CLI does send anonymous usage statistics, described
+exactly in [Telemetry](#telemetry), which you can turn off.
 
 ## Install
 
@@ -120,14 +122,88 @@ machine's free memory, so an app that won't fit fails in about a second
 instead of after several minutes of doomed work. The estimate is a
 heuristic, not a hard limit - `--force` runs the decompile regardless.
 
-### Optional Narvy Cloud scan
+### Sending results to your Narvy dashboard
+
+`narvy login` links the CLI to a Narvy account. Add `--upload` to a scan to
+send its results (the findings, never your code or binary) to your account,
+where they are de-duplicated, false-positive filtered and kept in the
+dashboard history; the CLI prints a direct link to the scan. This needs a
+paid plan (Starter and up) and is never on by default. `narvy upload-all
+<directory>` does the same for every binary target found in a folder in one
+command. `narvy scans` lists recent scans on your account from the terminal.
+
+### Exit codes
+
+| Code | Meaning |
+|------|---------|
+| 0 | Scan completed (and nothing reached the `--fail-on` threshold) |
+| 1 | `--fail-on`: at least one finding at or above the threshold |
+| 2 | `--fail-on`: nothing reached the threshold, but part of the scan did not run (timed-out pass, unreachable CVE database), so it cannot be certified clean |
+| 3 | The target or arguments are not usable (path not found, unsupported file type or project, refused URL, invalid option) |
+| 4 | The scan, login, upload or report write failed |
+| 130 | Interrupted (Ctrl-C, SIGTERM) |
+
+`narvy doctor` exits 0 when every required check passes and 1 when one fails.
+Missing optional tools are shown as INFO and do not change its exit code.
+
+### Resource limits
+
+The structural analysis pass runs with at most 4 parallel workers and a
+3 GB memory ceiling per analyzed file, so a very large repository does not
+exhaust the machine. `NARVY_SEMGREP_JOBS` and `NARVY_SEMGREP_MAX_MEMORY_MB`
+(0 = no ceiling) override them; files skipped because of the ceiling are
+listed in the scan notes. Outside a terminal (CI logs), a progress line is
+printed every 30 seconds; `NARVY_PROGRESS_INTERVAL` changes that (0 = off).
+
+## Telemetry
+
+The CLI sends one small anonymous event per command, so we can see which
+scan types are used and where they fail. It is sent in the background with
+a 1 second timeout, is never retried or stored for later, and never fails a
+scan. At most it adds 1 second at exit. A notice is printed the first time it runs.
+
+Exactly these fields are sent:
+
+| Field | Example |
+|-------|---------|
+| `schema` | `1`, the event format version |
+| `install_id` | a random UUID created on first run and stored in `~/.narvy/config.json` (not derived from your machine, user or account) |
+| `cli_version`, `python_version`, `os` | `1.1.1`, `3.11`, `linux` / `darwin` / `windows` / `other` |
+| `ci` | `true` when a CI environment variable is set |
+| `command` | `scan`, `web-scan`, `host-audit`, ... |
+| `surface` | `android`, `ios`, `source`, `web`, `host`, `cloud` or `none` |
+| `duration_bucket` | `<10s`, `10s-1m`, `1-5m`, `5-15m`, `15-60m`, `>60m` |
+| `findings` | per severity, a bucket: `0`, `1-5`, `6-20`, `21-100`, `101-500`, `>500` |
+| `exit_code` | the process exit code |
+| `error_class` | on a crash, the exception class name only (e.g. `ValueError`), never its message |
+
+Never sent: code, file, project, package or repository names, paths, URLs,
+hosts or IPs you scan, finding details, your account id or email.
+
+Turn it off with any of:
 
-`narvy login` links the CLI to a Narvy account. Add `--upload`
-to a scan to also submit it for a deeper cloud pass (full taint
-analysis, compliance mapping, dashboard history) - not required for local
-scanning, and not on by default. `narvy upload-all <directory>` does
-the same for every binary target found in a folder in one command.
-`narvy scans` lists recent scans on your account from the terminal.
+```bash
+narvy telemetry off        # saved in ~/.narvy/config.json; `narvy telemetry on` to re-enable
+export NARVY_TELEMETRY=0
+export DO_NOT_TRACK=1
+```
+
+`narvy telemetry status` shows the current state.
+
+## Free rules and premium rules
+
+The CLI ships the community rule set under Apache 2.0: the language-level
+rules for every supported language (injection, weak cryptography, dangerous
+configuration, storage, WebView, transport), every hardcoded-secret rule, and
+the Android and iOS rules. It is the same engine and the same community rules
+that Narvy runs on its servers.
+
+Framework-specific rules (Django, Flask, FastAPI, Express, Laravel, Symfony,
+Ruby on Rails, Spring and the Java persistence/serialization stack, Gin) and
+the C#/.NET code rules are premium: they run when a project is scanned on a
+Narvy paid plan, not in the CLI. When a scanned project uses one of those
+frameworks, the CLI says so in one line at the end of the scan, with the
+number of checks it did not run. It never hides a finding it did compute.
 
 ## Known limitations
 

{narvy_cli-1.0.3 → narvy_cli-1.1.1}/README.md

@@ -12,18 +12,20 @@ cryptography, SSRF, injection, and more - in:
   `.apks`), or a raw Gradle/Kotlin source checkout
 - **iOS**: an unencrypted `.ipa`, or a raw Xcode/Swift source checkout
 - **Web/backend source**: JavaScript/TypeScript, Python, PHP, Go, Ruby,
-  Rust, Java/Kotlin, C#/.NET
+  Rust, Java/Kotlin, and C#/.NET (secrets and dependencies)
 
 It also ships three standalone scanners that need nothing but network
 access or your own existing credentials:
 
-- `web-scan` - passive Nuclei-based scan of a live URL
+- `web-scan` - Nuclei-based scan of a live URL (passive by default, `--active` opt-in)
 - `host-audit` - agentless host audit over your own SSH access (Narvy's own
   host checks plus Lynis (GPL-3.0) as the hardening baseline)
 - `cloud-scan` - AWS account posture check using your own ambient AWS
   credentials
 
-Nothing is uploaded anywhere unless you explicitly pass `--upload`.
+Your code, binaries and findings are never uploaded unless you explicitly
+pass `--upload`. The CLI does send anonymous usage statistics, described
+exactly in [Telemetry](#telemetry), which you can turn off.
 
 ## Install
 
@@ -87,14 +89,88 @@ machine's free memory, so an app that won't fit fails in about a second
 instead of after several minutes of doomed work. The estimate is a
 heuristic, not a hard limit - `--force` runs the decompile regardless.
 
-### Optional Narvy Cloud scan
+### Sending results to your Narvy dashboard
+
+`narvy login` links the CLI to a Narvy account. Add `--upload` to a scan to
+send its results (the findings, never your code or binary) to your account,
+where they are de-duplicated, false-positive filtered and kept in the
+dashboard history; the CLI prints a direct link to the scan. This needs a
+paid plan (Starter and up) and is never on by default. `narvy upload-all
+<directory>` does the same for every binary target found in a folder in one
+command. `narvy scans` lists recent scans on your account from the terminal.
+
+### Exit codes
+
+| Code | Meaning |
+|------|---------|
+| 0 | Scan completed (and nothing reached the `--fail-on` threshold) |
+| 1 | `--fail-on`: at least one finding at or above the threshold |
+| 2 | `--fail-on`: nothing reached the threshold, but part of the scan did not run (timed-out pass, unreachable CVE database), so it cannot be certified clean |
+| 3 | The target or arguments are not usable (path not found, unsupported file type or project, refused URL, invalid option) |
+| 4 | The scan, login, upload or report write failed |
+| 130 | Interrupted (Ctrl-C, SIGTERM) |
+
+`narvy doctor` exits 0 when every required check passes and 1 when one fails.
+Missing optional tools are shown as INFO and do not change its exit code.
+
+### Resource limits
+
+The structural analysis pass runs with at most 4 parallel workers and a
+3 GB memory ceiling per analyzed file, so a very large repository does not
+exhaust the machine. `NARVY_SEMGREP_JOBS` and `NARVY_SEMGREP_MAX_MEMORY_MB`
+(0 = no ceiling) override them; files skipped because of the ceiling are
+listed in the scan notes. Outside a terminal (CI logs), a progress line is
+printed every 30 seconds; `NARVY_PROGRESS_INTERVAL` changes that (0 = off).
+
+## Telemetry
+
+The CLI sends one small anonymous event per command, so we can see which
+scan types are used and where they fail. It is sent in the background with
+a 1 second timeout, is never retried or stored for later, and never fails a
+scan. At most it adds 1 second at exit. A notice is printed the first time it runs.
+
+Exactly these fields are sent:
+
+| Field | Example |
+|-------|---------|
+| `schema` | `1`, the event format version |
+| `install_id` | a random UUID created on first run and stored in `~/.narvy/config.json` (not derived from your machine, user or account) |
+| `cli_version`, `python_version`, `os` | `1.1.1`, `3.11`, `linux` / `darwin` / `windows` / `other` |
+| `ci` | `true` when a CI environment variable is set |
+| `command` | `scan`, `web-scan`, `host-audit`, ... |
+| `surface` | `android`, `ios`, `source`, `web`, `host`, `cloud` or `none` |
+| `duration_bucket` | `<10s`, `10s-1m`, `1-5m`, `5-15m`, `15-60m`, `>60m` |
+| `findings` | per severity, a bucket: `0`, `1-5`, `6-20`, `21-100`, `101-500`, `>500` |
+| `exit_code` | the process exit code |
+| `error_class` | on a crash, the exception class name only (e.g. `ValueError`), never its message |
+
+Never sent: code, file, project, package or repository names, paths, URLs,
+hosts or IPs you scan, finding details, your account id or email.
+
+Turn it off with any of:
 
-`narvy login` links the CLI to a Narvy account. Add `--upload`
-to a scan to also submit it for a deeper cloud pass (full taint
-analysis, compliance mapping, dashboard history) - not required for local
-scanning, and not on by default. `narvy upload-all <directory>` does
-the same for every binary target found in a folder in one command.
-`narvy scans` lists recent scans on your account from the terminal.
+```bash
+narvy telemetry off        # saved in ~/.narvy/config.json; `narvy telemetry on` to re-enable
+export NARVY_TELEMETRY=0
+export DO_NOT_TRACK=1
+```
+
+`narvy telemetry status` shows the current state.
+
+## Free rules and premium rules
+
+The CLI ships the community rule set under Apache 2.0: the language-level
+rules for every supported language (injection, weak cryptography, dangerous
+configuration, storage, WebView, transport), every hardcoded-secret rule, and
+the Android and iOS rules. It is the same engine and the same community rules
+that Narvy runs on its servers.
+
+Framework-specific rules (Django, Flask, FastAPI, Express, Laravel, Symfony,
+Ruby on Rails, Spring and the Java persistence/serialization stack, Gin) and
+the C#/.NET code rules are premium: they run when a project is scanned on a
+Narvy paid plan, not in the CLI. When a scanned project uses one of those
+frameworks, the CLI says so in one line at the end of the scan, with the
+number of checks it did not run. It never hides a finding it did compute.
 
 ## Known limitations
 

{narvy_cli-1.0.3 → narvy_cli-1.1.1}/narvy/__init__.py

@@ -1,3 +1,3 @@
 """Narvy CLI - free, local SAST for Android, iOS and polyglot source."""
 
-__version__ = "1.0.3"
+__version__ = "1.1.1"

{narvy_cli-1.0.3 → narvy_cli-1.1.1}/narvy/android/source_analyzer.py

@@ -1,7 +1,4 @@
-"""Android source-repo (Gradle/Java/Kotlin) SAST entry point.
-
-Public API: analyze_source(source_dir, override_config=None) -> dict.
-"""
+"""Android source (Gradle/Java/Kotlin) SAST. Entry point: analyze_source()."""
 from __future__ import annotations
 
 import os
@@ -85,16 +82,13 @@ def _is_prefkey_echo_or_typename(line: str) -> bool:
     if not lhs:
         return False
     name = lhs.group(1)
-    # Echo: the value repeats the constant name, or the constant is a KEY_*/PREF_*
-    # preference-key holding a settings-store key slug (e.g. KEY_SECRET_TOKEN =
-    # "secret_token_pref").
+    # The value just echoes the constant name, or it's a KEY_*/PREF_* settings key
+    # (e.g. KEY_SECRET_TOKEN = "secret_token_pref").
     return val.lower() in name.lower() or bool(_PREFKEY_CONST_RE.match(name))
 
 
 def _has_no_string_literal_rhs(line: str) -> bool:
-    """A name-based secret match whose right-hand side has NO string literal - a
-    function call or identifier (e.g. `val apiKey = getApiKeyOrDefault()`), not a
-    hardcoded secret. A real hardcoded secret is always a quoted literal."""
+    """True when a name-based secret match is assigned from a call or identifier, not a literal."""
     return not _QUOTED_RE.search(line)
 
 

{narvy_cli-1.0.3 → narvy_cli-1.1.1}/narvy/android/split_bundle.py

@@ -1,5 +1,4 @@
-"""Split-APK bundle support (.apkm / .xapk / .apks) for the Android scan path: extract the
-app module, preferred ABI split and any dex-bearing feature module, without merging splits."""
+"""Split-APK bundles (.apkm/.xapk/.apks): pull out the app module, ABI split and dex feature modules."""
 
 import json
 import logging

{narvy_cli-1.0.3 → narvy_cli-1.1.1}/narvy/android_rule_context.py

@@ -1,5 +1,4 @@
-"""Call-site and element context gates for the Android regex rules: read the surrounding
-call or manifest element and drop or re-grade the finding (rule_engine can't look around a match)."""
+"""Context gates for the Android regex rules: look at the call site or manifest element around a match."""
 from __future__ import annotations
 
 import re

{narvy_cli-1.0.3 → narvy_cli-1.1.1}/narvy/apk_memory_preflight.py

@@ -1,5 +1,4 @@
-"""Pre-flight memory estimate for the JADX decompilation path: estimate the Java
-heap jadx needs from DEX header counts and warn before OOM. Advisory only; `--force` overrides."""
+"""Estimate the jadx heap from DEX header counts and warn before an OOM. `--force` skips it."""
 
 import ctypes
 import logging

{narvy_cli-1.0.3 → narvy_cli-1.1.1}/narvy/ci_templates/bitbucket.yml

@@ -1,6 +1,6 @@
 # Narvy SAST for Bitbucket Pipelines. Written by `narvy init-ci --bitbucket`; edit freely.
 # Already have a bitbucket-pipelines.yml? Copy the step below into it instead of overwriting.
-# Note: SARIF is stored as a build artifact (not Code Insights); the --fail-on gate still fails the build.
+# SARIF is kept as a build artifact (not Code Insights); --fail-on still fails the build.
 image: python:3.11
 
 pipelines:

{narvy_cli-1.0.3 → narvy_cli-1.1.1}/narvy/ci_templates/gitlab.yml

@@ -1,6 +1,6 @@
 # Narvy SAST for GitLab CI. Written by `narvy init-ci --gitlab`; edit freely.
 # Already have a .gitlab-ci.yml? Copy the narvy_sast job below into it instead of overwriting.
-# Note: SARIF is stored as a plain artifact (not GitLab's SAST schema), but the --fail-on gate still blocks the MR.
+# SARIF is kept as a plain artifact (not GitLab's SAST schema); --fail-on still blocks the MR.
 stages:
   - test
 

{narvy_cli-1.0.3 → narvy_cli-1.1.1}/narvy/cloud/aws_scan.py

@@ -1,6 +1,4 @@
-"""AWS cloud posture scanner: security-group, IAM, storage and logging checks
-across every enabled region. Credentials resolve through boto3's normal chain.
-"""
+"""AWS posture checks (security groups, IAM, storage, logging) across enabled regions."""
 
 import boto3
 from botocore.exceptions import ClientError, NoCredentialsError, EndpointConnectionError
@@ -1055,9 +1053,8 @@ def analyze_aws_security(credentials, region=None, endpoint_url=None):
         # letting the per-check handlers below report an empty, clean scan.
         _verify_credentials(endpoint_url=endpoint_url)
 
-        # Track every analyzer that could not complete (AccessDenied / throttling /
-        # missing permission) so 0 findings from a blinded scan is reported as a
-        # coverage gap, not as a clean pass.
+        # Analyzers that couldn't finish (AccessDenied, throttling), so a blind scan
+        # shows up as a coverage gap instead of a clean pass.
         coverage_errors = []
 
         def _collect(dest, label, fn):

{narvy_cli-1.0.3 → narvy_cli-1.1.1}/narvy/comment_filter.py

@@ -1,6 +1,4 @@
-"""Comment-aware masking for C-family source (Java, Kotlin, Objective-C, Swift):
-mark byte offsets inside `//` and `/* */` comments so regex rules don't fire on
-commented-out code. String literals excluded; when unsure, treated as code (never drops a finding)."""
+"""Find `//` and `/* */` comment ranges in C-family source so regex rules skip commented-out code."""
 from __future__ import annotations
 
 from typing import List

{narvy_cli-1.0.3 → narvy_cli-1.1.1}/narvy/crypto_taint_lite.py

@@ -1,7 +1,4 @@
-"""Name-based correlation pass for hardcoded key and IV material reaching
-javax.crypto.spec.{SecretKeySpec,IvParameterSpec} through one level of
-indirection. Correlation is by variable name within a single file, not scope.
-"""
+"""Match hardcoded key/IV literals to SecretKeySpec/IvParameterSpec by variable name, one file at a time."""
 from __future__ import annotations
 
 import re

{narvy_cli-1.0.3 → narvy_cli-1.1.1}/narvy/doctor.py

@@ -1,5 +1,4 @@
-"""`narvy doctor`: preflight environment check.
-Prints a PASS/FAIL list with a concrete fix for each failure."""
+"""`narvy doctor`: check the local environment and print a fix for each failure."""
 import os
 import platform
 import re
@@ -132,12 +131,11 @@ def _check_network():
 
 
 def _check_semgrep():
-    """Informational: semgrep drives the deep AST/taint pass. A broken install leaves it off
-    PATH and `scan` silently falls back to regex-only rules."""
+    """semgrep runs the AST/taint pass; without it `scan` falls back to regex rules only."""
     from . import semgrep_engine
     if semgrep_engine.is_available():
-        return True, f"{shutil.which('semgrep')}", None
-    return True, "Not on PATH - scans fall back to regex-only (reduced coverage)", (
+        return True, f"{semgrep_engine.semgrep_bin()}", None
+    return True, "Not found - scans fall back to regex-only (reduced coverage)", (
         "semgrep is the deep structural analysis engine for `narvy scan` "
         "(Android/iOS/web source and binary modes). Without it, scans run regex "
         "rules only and miss AST/taint-based findings. Install it: "
@@ -158,7 +156,8 @@ def _check_nuclei():
             "connection can reach github.com, or install nuclei yourself "
             "and put it on PATH: https://github.com/projectdiscovery/nuclei/releases"
         )
-    return True, f"{nuclei_bin} ({version.splitlines()[0][:60]})", None
+    first = re.sub(r"\x1b\[[0-9;]*m", "", version.splitlines()[0])
+    return True, f"{nuclei_bin} ({first[:60]})", None
 
 
 def _check_ssh_client():
@@ -238,7 +237,8 @@ def run_doctor():
             console.print(f"\n[bold]{name}:[/bold] {_rich_escape(fix)}")
 
     for name, hint in optional_hints:
-        console.print(f"\n[bold cyan]{name} (optional):[/bold cyan] {_rich_escape(hint)}")
+        label = name if "optional" in name else f"{name} (optional)"
+        console.print(f"\n[bold cyan]{label}:[/bold cyan] {_rich_escape(hint)}")
 
     if not all_ok:
         sys.exit(1)

{narvy_cli-1.0.3 → narvy_cli-1.1.1}/narvy/host/audit.py

@@ -1,5 +1,4 @@
-"""Run Lynis on a remote host over SSH and return normalized findings.
-A sudo password is never sent, so full coverage needs a root key or NOPASSWD sudo."""
+"""Run Lynis on a remote host over SSH. Full coverage needs a root key or NOPASSWD sudo."""
 
 from __future__ import annotations
 
@@ -25,6 +24,8 @@ class AuditOutcome:
     hardening_index: Any
     meta: Dict[str, str]
     error: str = ""
+    # Raw Lynis .dat report, captured for --verbose; never streamed on its own.
+    raw: str = ""
 
 
 def _lynis_prefix(privilege: str) -> str:
@@ -154,4 +155,5 @@ def audit_host(conn: HostConn, privilege: str = "auto") -> AuditOutcome:
         findings=list(parsed["findings"]) + list(narvy_findings),
         hardening_index=parsed["hardening_index"],
         meta=meta,
+        raw=dat,
     )

{narvy_cli-1.0.3 → narvy_cli-1.1.1}/narvy/host/host_knowledge.py

@@ -1,7 +1,4 @@
-"""Knowledge base for host and infrastructure audit findings.
-
-Maps each hardening-engine test id to a control with a remediation and severity.
-"""
+"""Map host-audit test ids to a control, severity and remediation."""
 
 from __future__ import annotations
 
@@ -975,8 +972,7 @@ HOST_CONTROLS: Dict[str, HostControl] = {
 
 
 def lookup(test_id: str) -> Optional[HostControl]:
-    """Control for an engine test id, or None. Callers must keep emitting the
-    raw finding for an unknown id rather than dropping it."""
+    """Control for a test id, or None. Callers keep the raw finding for unknown ids."""
     if not test_id:
         return None
     return HOST_CONTROLS.get(test_id.strip().upper())

{narvy_cli-1.0.3 → narvy_cli-1.1.1}/narvy/host/lynis_bootstrap.py

@@ -1,6 +1,4 @@
-"""Ship a checksum-pinned Lynis to a target host for one audit, run it from a
-temporary directory, then remove it. Nothing is installed on the host.
-"""
+"""Copy a checksum-pinned Lynis to a temp dir on the host, run it, then remove it."""
 
 from __future__ import annotations
 

{narvy_cli-1.0.3 → narvy_cli-1.1.1}/narvy/host/lynis_parser.py

@@ -1,7 +1,4 @@
-"""Parse a Lynis `lynis-report.dat` into Narvy host-audit findings.
-
-The `.dat` is a flat key=value file; repeated keys use a `key[]=` suffix.
-"""
+"""Parse `lynis-report.dat` (flat key=value, `key[]=` for repeats) into findings."""
 
 from __future__ import annotations
 

{narvy_cli-1.0.3 → narvy_cli-1.1.1}/narvy/host/narvy_checks.py

@@ -1,6 +1,4 @@
-"""Host exposure checks run alongside the Lynis baseline: reachable unauthenticated
-data services, cloud metadata, container posture, and secret/VCS disclosure under a
-web root. Each fires only on a confirmed exposure; checks take a ``run`` probe callable."""
+"""Extra host exposure checks (open data services, metadata, containers, web-root leaks)."""
 
 from __future__ import annotations
 

{narvy_cli-1.0.3 → narvy_cli-1.1.1}/narvy/host/ssh_exec.py

@@ -1,6 +1,4 @@
-"""Agentless SSH exec helper for host audits, built on the system ssh client.
-Private keys go to a 0600 temp file wiped after use; hostname/user are validated
-before argv is built; host keys use a per-call known_hosts file."""
+"""Run commands on a host with the system ssh client, using a temp key file and per-call known_hosts."""
 
 from __future__ import annotations