prism-code-review 2.0.0__tar.gz → 2.0.1__tar.gz

{prism_code_review-2.0.0/prism_code_review.egg-info → prism_code_review-2.0.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: prism-code-review
-Version: 2.0.0
+Version: 2.0.1
 Summary: Local pre-commit multi-agent code review (regex + AI providers)
 Author: PRISM contributors
 License-Expression: MIT
@@ -197,21 +197,12 @@ There are only three SDKs to install. The five OpenAI-compatible providers
 
 ### Hand the tool to a teammate (no `cd`, no venv on their side)
 
-Build the wheel once, attach it to a GitHub Release, and the teammate runs
-**one** command from any folder — no virtualenv, no source checkout, no build
-tools:
+One command from any folder — no virtualenv, no source checkout, no build tools:
 
 ```bash
-# On the machine that has the repo (you):
-py -m build          # -> dist/prism_code_review-2.0.0-py3-none-any.whl
-# then: GitHub -> Releases -> Draft a new release -> tag v2.0.0
-#       -> attach the .whl -> Publish
-
 # On the teammate's machine, once. The [all] extra installs every provider SDK
 # plus python-dotenv; without an extra the regex agents run but AI agents skip:
-# (the "prism-code-review[all] @ <url>" form is required: pip does not parse
-#  extras that are appended straight onto a direct wheel URL)
-pip install "prism-code-review[all] @ https://github.com/Bibekbwn/prism-code-review/releases/download/v2.0.0/prism_code_review-2.0.0-py3-none-any.whl"
+pip install "prism-code-review[all]"
 
 # Set the API key once for every project (tool-wide):
 prism key set --global --provider gemini --key YOUR_GEMINI_API_KEY
@@ -219,6 +210,18 @@ prism key set --global --provider gemini --key YOUR_GEMINI_API_KEY
 # Then in any project folder: git init, prism init, prism check ...
 ```
 
+No PyPI access (air-gapped machine, internal mirror)? Install straight from the
+GitHub Release wheel instead. Note the `name[extras] @ url` form — pip does not
+parse extras that are appended directly onto a wheel URL, so `...whl[all]`
+returns a 404:
+
+```bash
+pip install "prism-code-review[all] @ https://github.com/Bibekbwn/prism-code-review/releases/download/v2.0.0/prism_code_review-2.0.0-py3-none-any.whl"
+```
+
+Both routes give the same package. To cut a new release, see
+[Releasing](#releasing).
+
 Use `[all]` when you do not control which provider each developer will use. For
 a team standardised on one provider, install only that extra — `[gemini]`,
 `[claude]`, or `[openai]` (the last also covers openrouter, groq, together,
@@ -1380,12 +1383,22 @@ The suite covers:
 ## Releasing
 
 ```bash
-py -m build        # -> dist/prism_code_review-<version>-py3-none-any.whl
+py -m build              # -> dist/prism_code_review-<version>-*.whl and .tar.gz
+py -m twine check dist/* # fails the upload if the README does not render
+```
+
+Then publish to both places:
+
+```bash
+# PyPI (the short install path)
+py -m twine upload dist/*
+
+# GitHub (the wheel-only fallback for machines without PyPI access)
+#Releases -> Draft a new release -> tag v<version> -> attach the .whl -> Publish
 ```
 
-Then attach the wheel to a GitHub Release (Releases → Draft a new release → tag
-`v<version>` → attach the `.whl` → Publish). `dist/` is git-ignored, so the
-wheel is never committed; the Release asset URL is what developers install from.
+`dist/` is git-ignored, so the wheel is never committed — the Release asset and
+the PyPI project are what developers install from.
 
 The wheel declares no hard dependencies — providers are opt-in extras
 (`[gemini]`, `[claude]`, `[openai]`, `[all]`, `[dev]`), so a base install stays

{prism_code_review-2.0.0 → prism_code_review-2.0.1}/README.md

@@ -157,21 +157,12 @@ There are only three SDKs to install. The five OpenAI-compatible providers
 
 ### Hand the tool to a teammate (no `cd`, no venv on their side)
 
-Build the wheel once, attach it to a GitHub Release, and the teammate runs
-**one** command from any folder — no virtualenv, no source checkout, no build
-tools:
+One command from any folder — no virtualenv, no source checkout, no build tools:
 
 ```bash
-# On the machine that has the repo (you):
-py -m build          # -> dist/prism_code_review-2.0.0-py3-none-any.whl
-# then: GitHub -> Releases -> Draft a new release -> tag v2.0.0
-#       -> attach the .whl -> Publish
-
 # On the teammate's machine, once. The [all] extra installs every provider SDK
 # plus python-dotenv; without an extra the regex agents run but AI agents skip:
-# (the "prism-code-review[all] @ <url>" form is required: pip does not parse
-#  extras that are appended straight onto a direct wheel URL)
-pip install "prism-code-review[all] @ https://github.com/Bibekbwn/prism-code-review/releases/download/v2.0.0/prism_code_review-2.0.0-py3-none-any.whl"
+pip install "prism-code-review[all]"
 
 # Set the API key once for every project (tool-wide):
 prism key set --global --provider gemini --key YOUR_GEMINI_API_KEY
@@ -179,6 +170,18 @@ prism key set --global --provider gemini --key YOUR_GEMINI_API_KEY
 # Then in any project folder: git init, prism init, prism check ...
 ```
 
+No PyPI access (air-gapped machine, internal mirror)? Install straight from the
+GitHub Release wheel instead. Note the `name[extras] @ url` form — pip does not
+parse extras that are appended directly onto a wheel URL, so `...whl[all]`
+returns a 404:
+
+```bash
+pip install "prism-code-review[all] @ https://github.com/Bibekbwn/prism-code-review/releases/download/v2.0.0/prism_code_review-2.0.0-py3-none-any.whl"
+```
+
+Both routes give the same package. To cut a new release, see
+[Releasing](#releasing).
+
 Use `[all]` when you do not control which provider each developer will use. For
 a team standardised on one provider, install only that extra — `[gemini]`,
 `[claude]`, or `[openai]` (the last also covers openrouter, groq, together,
@@ -1340,12 +1343,22 @@ The suite covers:
 ## Releasing
 
 ```bash
-py -m build        # -> dist/prism_code_review-<version>-py3-none-any.whl
+py -m build              # -> dist/prism_code_review-<version>-*.whl and .tar.gz
+py -m twine check dist/* # fails the upload if the README does not render
+```
+
+Then publish to both places:
+
+```bash
+# PyPI (the short install path)
+py -m twine upload dist/*
+
+# GitHub (the wheel-only fallback for machines without PyPI access)
+#Releases -> Draft a new release -> tag v<version> -> attach the .whl -> Publish
 ```
 
-Then attach the wheel to a GitHub Release (Releases → Draft a new release → tag
-`v<version>` → attach the `.whl` → Publish). `dist/` is git-ignored, so the
-wheel is never committed; the Release asset URL is what developers install from.
+`dist/` is git-ignored, so the wheel is never committed — the Release asset and
+the PyPI project are what developers install from.
 
 The wheel declares no hard dependencies — providers are opt-in extras
 (`[gemini]`, `[claude]`, `[openai]`, `[all]`, `[dev]`), so a base install stays

{prism_code_review-2.0.0 → prism_code_review-2.0.1}/prism/__init__.py

@@ -8,7 +8,7 @@ before code is pushed to GitHub. Each agent checks a specific concern.
 import os
 from pathlib import Path
 
-__version__ = "2.0.0"
+__version__ = "2.0.1"
 
 _ENV_LOADED = False
 

{prism_code_review-2.0.0 → prism_code_review-2.0.1}/prism/autofix.py

@@ -12,6 +12,7 @@ from typing import List, Optional, Tuple
 from prism.agents import Finding
 from prism.langs import lang_for
 from prism.logging_config import logger
+from prism.reports import looks_like_secret
 
 # A declaration is a name preceded by modifiers, a type, or a qualifier
 # (`const token`, `String apiKey`, `self.password`). Taking the name from the
@@ -23,6 +24,13 @@ _SECRET_ASSIGN = re.compile(
     r'(?P<op>\s*(?::=|(?<![=!<>:])=(?!=)|:(?!=))\s*)'
     r'(?P<q>["\'])(?P<lit>.*?)(?P=q)(?P<tail>.*)$')
 
+# The unquoted counterpart: `PASSWORD=hunter2`, `export TOKEN=abc`,
+# `#define API_KEY abc123`. Kept separate from _SECRET_ASSIGN so the value is
+# masked rather than copied into a suggested fix.
+_UNQUOTED_ASSIGN = re.compile(
+    r'^(?P<head>\s*(?:export\s+|#define\s+)?[\w$.\[\]]+\s*'
+    r'(?::=|(?<![=!<>:])=(?!=)|:(?!=))\s*)(?P<val>.*)$')
+
 
 def _is_valid_python(source: str) -> bool:
     """True when source parses as a complete Python module."""
@@ -143,7 +151,7 @@ def _remove_line(lines: list, idx: int) -> str:
     return ""
 
 
-def _replace_secret(line: str, finding: Finding, spec=None) -> str:
+def _replace_secret(line: str, finding: Finding, spec=None) -> Optional[str]:
     """Replace a hardcoded secret with a read from the environment.
 
     The declaration is left as it is and only the literal is swapped, so
@@ -151,10 +159,23 @@ def _replace_secret(line: str, finding: Finding, spec=None) -> str:
     becomes the language's own lookup (``os.Getenv("APIKEY")`` in Go,
     ``process.env.APIKEY`` in JS). Emitting ``os.getenv`` into a Go file would
     not compile, which is worse than offering no fix at all.
+
+    Returns None when the line cannot be rewritten safely: the suggestion is
+    rendered in the dashboard and the JSON report, so echoing the original line
+    back would copy the live credential into a file that is meant to be shared.
     """
     env_read = spec.env_read if spec is not None else 'os.getenv("{name}")'
     match = _SECRET_ASSIGN.match(line)
     if not match:
+        # Not a quoted declaration. Three cases, and only one of them is safe
+        # to echo back:
+        #   - an unquoted assignment (SECU-123/125) -> mask the value
+        #   - a credential embedded in some other expression -> offer no fix
+        #   - no credential at all (a comparison, a call) -> the old no-op
+        if _UNQUOTED_ASSIGN.match(line):
+            return _mask_secret_value(line)
+        if looks_like_secret(line):
+            return None
         return line
     # PHP declares `$key`; the sigil is not part of the variable's name.
     name = re.sub(r"[^A-Za-z0-9]", "_", match.group("name").lstrip("$")).upper()
@@ -162,6 +183,21 @@ def _replace_secret(line: str, finding: Finding, spec=None) -> str:
             + env_read.format(name=name) + match.group("tail"))
 
 
+def _mask_secret_value(line: str) -> Optional[str]:
+    """Mask the value of an unquoted secret assignment.
+
+    SECU-123/125 match dotenv-style (``PASSWORD=hunter2``) and shell-export
+    (``export TOKEN=abc``) secrets, which have no quoted literal for
+    :data:`_SECRET_ASSIGN` to swap. Returning the line unchanged put the live
+    credential into the report, and the dashboard renders ``suggested_code``
+    verbatim. Masking keeps the fix useful without copying the secret.
+    """
+    match = _UNQUOTED_ASSIGN.match(line)
+    if not match:
+        return None
+    return match.group("head") + '"***REDACTED***"'
+
+
 def _remove_dangerous_call(line: str, name: str, spec=None) -> str:
     """Replace a dangerous call with a syntactically valid, inert statement.
 

{prism_code_review-2.0.0 → prism_code_review-2.0.1}/prism/cli_commands.py

@@ -586,6 +586,8 @@ def _cmd_check_diff(args):
 
     base = getattr(args, "base", None) or os.getenv("PRISM_BASE") or "origin/main"
 
+    requested_base = base
+
     def _ref_ok(ref):
         try:
             return subprocess.run(
@@ -603,6 +605,10 @@ def _cmd_check_diff(args):
         else:
             print("Cannot resolve base ref '{}'".format(base), file=sys.stderr)
             sys.exit(2)
+        # A typo'd branch used to fall through to HEAD~1 in silence, so the
+        # review looked like it covered the requested ref. Say which one won.
+        _status("Base ref '{}' not found - reviewing against '{}' instead".format(
+            requested_base, base))
 
     files = [f for f in get_diff_files(base) if Path(f).exists()]
     # check-staged honours .prismignore (get_staged_files applies it); check-diff

{prism_code_review-2.0.0 → prism_code_review-2.0.1}/prism/commands_reports.py

@@ -12,6 +12,8 @@ from prism.codebase_cache import get_changed_files, get_cache_stats, clear_cache
 from prism.feedback import load_feedback, suppress_summary
 from prism.reports import load_report, delete_report, clear_reports, get_report_summary
 
+VALID_SEVERITIES = ("critical", "high", "medium", "low")
+
 
 def _cmd_reports(args):
     print(get_report_summary())
@@ -127,8 +129,13 @@ def open_dashboard(url):
 
 
 def _cmd_dashboard(args):
-    """Generate the dashboard and open it in the browser."""
-    build_dashboard(open_browser=True)
+    """Generate the dashboard and open it in the browser.
+
+    A missing template is a packaging failure, not an empty report: exit
+    non-zero so a script running `prism dashboard` does not read it as success.
+    """
+    if not build_dashboard(open_browser=True):
+        sys.exit(1)
 
 
 def _cmd_stats(args):
@@ -159,6 +166,24 @@ def _set_config_value(config, dotted, value):
     node[parts[-1]] = value
 
 
+def _validate_config_value(key, value):
+    """Return an error message for a value that would silently change behaviour.
+
+    ``block_on`` drives the quality gate. Written as a bare string it still
+    loads, but the membership test becomes a substring test, so every commit
+    passes while the config looks correct. Refuse the write instead.
+    """
+    if key == "block_on":
+        if not isinstance(value, list):
+            return 'block_on must be a list, e.g. ["critical", "high"]'
+        unknown = [v for v in value
+                   if not isinstance(v, str) or v.lower() not in VALID_SEVERITIES]
+        if unknown:
+            return "block_on has unknown severity value(s): {} (valid: {})".format(
+                ", ".join(repr(v) for v in unknown), ", ".join(VALID_SEVERITIES))
+    return None
+
+
 def _cmd_config(args):
     config = load_config()
     if getattr(args, "set", None):
@@ -167,6 +192,11 @@ def _cmd_config(args):
             value = json.loads(value)
         except json.JSONDecodeError:
             pass
+        problem = _validate_config_value(key, value)
+        if problem:
+            print("Invalid value for {}: {}".format(key, problem), file=sys.stderr)
+            print("No changes written.", file=sys.stderr)
+            sys.exit(1)
         _set_config_value(config, key, value)
         # Write back to the file we read from, not always prism.json.
         config_path = get_config_path()

prism_code_review-2.0.1/prism/dashboard.html

@@ -0,0 +1,343 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="UTF-8">
+<meta name="viewport" content="width=device-width, initial-scale=1.0">
+<title>PRISM Dashboard</title>
+<style>
+* { margin: 0; padding: 0; box-sizing: border-box; }
+body { font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif; background: #0f172a; color: #e2e8f0; padding: 20px; }
+h1 { font-size: 28px; margin-bottom: 8px; color: #38bdf8; }
+h2 { font-size: 18px; margin: 24px 0 12px; color: #cbd5e1; }
+.container { max-width: 1280px; margin: 0 auto; }
+
+/* Stat cards */
+.stats { display: grid; grid-template-columns: repeat(auto-fit, minmax(170px, 1fr)); gap: 16px; margin-bottom: 24px; }
+.stat-card { background: #1e293b; border-radius: 12px; padding: 20px; text-align: center; border: 1px solid #334155; }
+.stat-value { font-size: 36px; font-weight: bold; }
+.stat-label { font-size: 13px; color: #94a3b8; margin-top: 4px; }
+
+/* Charts */
+.charts { display: grid; grid-template-columns: 1fr 1fr; gap: 20px; margin-bottom: 24px; }
+.chart-card { background: #1e293b; border-radius: 12px; padding: 20px; border: 1px solid #334155; }
+.chart-title { font-size: 14px; color: #94a3b8; margin-bottom: 12px; text-transform: uppercase; letter-spacing: 0.5px; }
+.bar-row { display: flex; align-items: center; gap: 10px; margin-bottom: 8px; }
+.bar-label { width: 130px; font-size: 13px; color: #cbd5e1; text-align: right; flex-shrink: 0; }
+.bar-track { flex: 1; height: 22px; background: #0f172a; border-radius: 6px; overflow: hidden; position: relative; }
+.bar-fill { height: 100%; border-radius: 6px; transition: width 0.4s; }
+.bar-value { width: 40px; font-size: 13px; font-weight: bold; text-align: right; flex-shrink: 0; }
+.sev-critical { background: #ef4444; }
+.sev-high { background: #f97316; }
+.sev-medium { background: #eab308; }
+.sev-low { background: #22c55e; }
+.agent-security { background: #8b5cf6; }
+.agent-quality { background: #3b82f6; }
+.agent-policy { background: #06b6d4; }
+.agent-test { background: #10b981; }
+.agent-ai { background: #ec4899; }
+.token-fill { background: #a78bfa; }
+.bar-value.wide { width: 76px; }
+.bar-label.token-label { overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
+
+/* Filters */
+.filters { display: flex; gap: 10px; margin-bottom: 20px; flex-wrap: wrap; align-items: center; }
+.filter-label { font-size: 13px; color: #94a3b8; margin-right: 4px; }
+.chip { padding: 6px 14px; border-radius: 20px; border: 1px solid #334155; background: #1e293b; color: #cbd5e1; font-size: 13px; cursor: pointer; transition: all 0.15s; }
+.chip:hover { border-color: #38bdf8; }
+.chip.active { background: #38bdf8; color: #0f172a; border-color: #38bdf8; font-weight: bold; }
+
+/* Timeline */
+.timeline { position: relative; padding-left: 30px; }
+.timeline::before { content: ''; position: absolute; left: 8px; top: 0; bottom: 0; width: 2px; background: #334155; }
+.report-item { position: relative; margin-bottom: 20px; padding: 16px; background: #1e293b; border-radius: 10px; border: 1px solid #334155; cursor: pointer; transition: border-color 0.15s; }
+.report-item:hover { border-color: #38bdf8; }
+.report-item.expanded { border-color: #38bdf8; }
+.report-item::before { content: ''; position: absolute; left: -26px; top: 20px; width: 12px; height: 12px; border-radius: 50%; background: #60a5fa; }
+.report-item.allowed::before { background: #22c55e; }
+.report-item.blocked::before { background: #ef4444; }
+.report-date { font-size: 13px; color: #94a3b8; }
+.report-files { font-size: 14px; margin: 8px 0; color: #cbd5e1; }
+.report-risk { font-size: 18px; font-weight: bold; }
+.report-meta { display: flex; gap: 16px; margin-top: 8px; font-size: 13px; color: #94a3b8; }
+.badge { display: inline-block; padding: 2px 10px; border-radius: 6px; font-size: 12px; font-weight: bold; }
+.badge-pass { background: #22c55e; color: #052e16; }
+.badge-block { background: #ef4444; color: #fff; }
+
+/* Severity bar */
+.severity-bar { height: 8px; border-radius: 4px; margin: 8px 0; display: flex; gap: 2px; }
+.severity-bar div { height: 100%; border-radius: 4px; }
+
+/* Detail view */
+.detail-panel { margin-top: 14px; padding-top: 14px; border-top: 1px solid #334155; display: none; }
+.report-item.expanded .detail-panel { display: block; }
+.finding-item { padding: 10px 12px; margin-bottom: 8px; background: #0f172a; border-radius: 8px; border-left: 3px solid #334155; font-size: 13px; }
+.finding-item.critical { border-left-color: #ef4444; }
+.finding-item.high { border-left-color: #f97316; }
+.finding-item.medium { border-left-color: #eab308; }
+.finding-item.low { border-left-color: #22c55e; }
+.finding-head { display: flex; align-items: center; gap: 8px; margin-bottom: 6px; flex-wrap: wrap; }
+.finding-severity { display: inline-block; padding: 2px 8px; border-radius: 4px; font-size: 11px; font-weight: bold; }
+.finding-rule { font-family: 'Consolas', 'Monaco', monospace; font-size: 12px; color: #38bdf8; }
+.finding-msg { color: #e2e8f0; margin: 4px 0; }
+.finding-loc { color: #64748b; font-size: 12px; }
+.finding-suggestion { color: #94a3b8; margin-top: 4px; font-style: italic; }
+.finding-code { background: #020617; padding: 8px; border-radius: 6px; margin-top: 6px; font-family: 'Consolas', 'Monaco', monospace; font-size: 12px; color: #4ade80; overflow-x: auto; white-space: pre; }
+.finding-code-head { margin-top: 8px; font-size: 10px; letter-spacing: .08em; text-transform: uppercase; color: #64748b; }
+.finding-conf { color: #64748b; font-size: 11px; }
+.finding-also { font-size: 11px; color: #a78bfa; background: #1e293b; border: 1px solid #334155; border-radius: 4px; padding: 1px 6px; }
+.no-findings { color: #22c55e; font-size: 13px; padding: 8px 0; }
+.empty { text-align: center; padding: 40px; color: #64748b; }
+</style>
+</head>
+<body>
+<div class="container">
+<h1>PRISM Report Dashboard</h1>
+<div id="reports">Loading...</div>
+</div>
+<script>
+/* PRISM_DASHBOARD_DATA */
+function loadReports() {
+  render({reports: (typeof EMBEDDED_REPORTS !== 'undefined' ? EMBEDDED_REPORTS : [])});
+}
+
+function render(data) {
+  const reports = (data.reports || []).slice().reverse();
+  if (!reports.length) { document.getElementById('reports').innerHTML = '<p class="empty">No reports found. Run <code>prism check</code> to generate one.</p>'; return; }
+
+  // Aggregate stats
+  const total = reports.length;
+  const blocked = reports.filter(r => !r.commit_allowed).length;
+  const findings = reports.reduce((s, r) => s + (r.total_findings || 0), 0);
+  const blocking = reports.reduce((s, r) => s + (r.blocking || 0), 0);
+
+  // Token accounting. Reports written before token tracking existed have no
+  // token_usage field: they contribute nothing here and render as unknown in
+  // the timeline, so a cost trend never dips because of missing history.
+  const tokenReports = reports.filter(r => r.token_usage);
+  const tokens = tokenReports.reduce((s, r) => s + (r.token_usage.total_tokens || 0), 0);
+  const tokenCalls = tokenReports.reduce((s, r) => s + (r.token_usage.calls || 0), 0);
+  const estimatedCalls = tokenReports.reduce((s, r) => s + (r.token_usage.estimated_calls || 0), 0);
+
+  // Severity counts
+  const sevCounts = {critical: 0, high: 0, medium: 0, low: 0};
+  // Agent counts
+  const agentCounts = {};
+  // Rule counts
+  const ruleCounts = {};
+
+  reports.forEach(r => {
+    (r.findings || []).forEach(f => {
+      const sev = (f.severity || 'low').toLowerCase();
+      if (sevCounts[sev] !== undefined) sevCounts[sev]++;
+      const agent = f.agent || 'unknown';
+      agentCounts[agent] = (agentCounts[agent] || 0) + 1;
+      if (f.rule_id) ruleCounts[f.rule_id] = (ruleCounts[f.rule_id] || 0) + 1;
+    });
+  });
+
+  let html = '';
+
+  // Stat cards
+  html += '<div class="stats">';
+  html += '<div class="stat-card"><div class="stat-value" style="color:#38bdf8">' + total + '</div><div class="stat-label">Total Reviews</div></div>';
+  html += '<div class="stat-card"><div class="stat-value" style="color:#ef4444">' + blocked + '</div><div class="stat-label">Blocked</div></div>';
+  html += '<div class="stat-card"><div class="stat-value" style="color:#22c55e">' + (total - blocked) + '</div><div class="stat-label">Passed</div></div>';
+  html += '<div class="stat-card"><div class="stat-value" style="color:#f97316">' + findings + '</div><div class="stat-label">Total Findings</div></div>';
+  html += '<div class="stat-card"><div class="stat-value" style="color:#eab308">' + blocking + '</div><div class="stat-label">Blocking</div></div>';
+  html += '<div class="stat-card"><div class="stat-value" style="color:#a78bfa">' + tokens.toLocaleString() + '</div><div class="stat-label">Tokens (' + tokenCalls + ' call' + (tokenCalls === 1 ? '' : 's') + (estimatedCalls ? ', ' + estimatedCalls + ' est.' : '') + ')</div></div>';
+  html += '</div>';
+
+  // Charts row
+  html += '<div class="charts">';
+
+  // Severity chart
+  const sevMax = Math.max(1, ...Object.values(sevCounts));
+  html += '<div class="chart-card"><div class="chart-title">Findings by Severity</div>';
+  ['critical', 'high', 'medium', 'low'].forEach(sev => {
+    const c = sevCounts[sev] || 0;
+    const pct = (c / sevMax * 100).toFixed(0);
+    html += '<div class="bar-row"><div class="bar-label">' + sev.toUpperCase() + '</div>';
+    html += '<div class="bar-track"><div class="bar-fill sev-' + sev + '" style="width:' + pct + '%"></div></div>';
+    html += '<div class="bar-value">' + c + '</div></div>';
+  });
+  html += '</div>';
+
+  // Agent chart
+  const agents = Object.entries(agentCounts).sort((a, b) => b[1] - a[1]);
+  const agentMax = Math.max(1, ...agents.map(a => a[1]));
+  html += '<div class="chart-card"><div class="chart-title">Findings by Agent</div>';
+  if (!agents.length) {
+    html += '<div class="empty" style="padding:12px">No findings</div>';
+  } else {
+    agents.forEach(([agent, c]) => {
+      const pct = (c / agentMax * 100).toFixed(0);
+      const cls = agent.startsWith('ai_') ? 'agent-ai' : 'agent-' + agent;
+      html += '<div class="bar-row"><div class="bar-label">' + agent + '</div>';
+      html += '<div class="bar-track"><div class="bar-fill ' + cls + '" style="width:' + pct + '%"></div></div>';
+      html += '<div class="bar-value">' + c + '</div></div>';
+    });
+  }
+  html += '</div>';
+
+  // Token chart: one bar per review that actually spent tokens.
+  const tokenSeries = tokenReports.filter(r => r.token_usage.calls)
+    .slice(0, 12).reverse();
+  html += '<div class="chart-card"><div class="chart-title">Tokens by Review</div>';
+  if (!tokenSeries.length) {
+    html += '<div class="empty" style="padding:12px">No AI usage recorded</div>';
+  } else {
+    const tokenMax = Math.max(1, ...tokenSeries.map(r => r.token_usage.total_tokens || 0));
+    tokenSeries.forEach(r => {
+      const value = r.token_usage.total_tokens || 0;
+      const pct = (value / tokenMax * 100).toFixed(0);
+      const when = new Date(r.timestamp).toLocaleDateString();
+      const rev = r.commit_hash ? r.commit_hash.substring(0, 7) : 'no-commit';
+      html += '<div class="bar-row"><div class="bar-label token-label" title="' + escapeHtml(when + ' ' + rev) + '">' + escapeHtml(when + ' ' + rev) + '</div>';
+      html += '<div class="bar-track"><div class="bar-fill token-fill" style="width:' + pct + '%"></div></div>';
+      html += '<div class="bar-value wide">' + value.toLocaleString() + '</div></div>';
+    });
+  }
+  html += '</div>';
+  html += '</div>';
+
+  // Filters
+  html += '<div class="filters">';
+  html += '<span class="filter-label">Filter:</span>';
+  html += '<span class="chip active" data-filter="all">All (' + total + ')</span>';
+  html += '<span class="chip" data-filter="blocked">Blocked (' + blocked + ')</span>';
+  html += '<span class="chip" data-filter="passed">Passed (' + (total - blocked) + ')</span>';
+  html += '</div>';
+
+  // Timeline
+  html += '<div class="timeline" id="timeline">';
+  reports.forEach((r, idx) => {
+    const cls = r.commit_allowed ? 'allowed' : 'blocked';
+    const date = new Date(r.timestamp).toLocaleDateString() + ' ' + new Date(r.timestamp).toLocaleTimeString([], {hour: '2-digit', minute:'2-digit'});
+    const badgeCls = r.commit_allowed ? 'badge-pass' : 'badge-block';
+    const badgeTxt = r.commit_allowed ? 'PASS' : 'BLOCKED';
+
+    // Severity bar for this report
+    const rSev = {critical: 0, high: 0, medium: 0, low: 0};
+    (r.findings || []).forEach(f => {
+      const sev = (f.severity || 'low').toLowerCase();
+      if (rSev[sev] !== undefined) rSev[sev]++;
+    });
+    const rTotal = rSev.critical + rSev.high + rSev.medium + rSev.low;
+    let sevBar = '<div class="severity-bar">';
+    if (rTotal > 0) {
+      ['critical', 'high', 'medium', 'low'].forEach(sev => {
+        if (rSev[sev] > 0) {
+          const w = (rSev[sev] / rTotal * 100).toFixed(0);
+          sevBar += '<div class="sev-' + sev + '" style="width:' + w + '%" title="' + sev + ': ' + rSev[sev] + '"></div>';
+        }
+      });
+    }
+    sevBar += '</div>';
+
+    html += '<div class="report-item ' + cls + '" data-idx="' + idx + '" data-status="' + (r.commit_allowed ? 'passed' : 'blocked') + '">';
+    html += '<div class="report-date">' + date + ' &middot; ' + (r.branch || 'main') + ' &middot; ' + (r.commit_hash ? r.commit_hash.substring(0,7) : 'no-commit') + '</div>';
+    html += '<div class="report-risk">Risk: ' + Math.round((r.risk_score || 0) * 100) + '% <span class="badge ' + badgeCls + '">' + badgeTxt + '</span></div>';
+    html += '<div class="report-files">' + (r.files_reviewed || []).join(', ') + '</div>';
+    html += sevBar;
+    html += '<div class="report-meta"><span>' + (r.total_findings || 0) + ' findings</span><span>' + (r.blocking || 0) + ' blocking</span><span' + (r.token_usage ? '' : ' title="report predates token tracking"') + '>' + tokenLabel(r) + '</span><span>Click for details</span></div>';
+
+    // Detail panel (per-finding)
+    html += '<div class="detail-panel">';
+    html += tokenDetail(r);
+    const findingsList = r.findings || [];
+    if (!findingsList.length) {
+      html += '<div class="no-findings">No findings - clean commit</div>';
+    } else {
+      findingsList.forEach(f => {
+        const sev = (f.severity || 'low').toLowerCase();
+        html += '<div class="finding-item ' + sev + '">';
+        html += '<div class="finding-head">';
+        html += '<span class="finding-severity tag-' + (sev === 'critical' || sev === 'high' ? 'block' : 'warn') + '" style="background:' + sevColor(sev) + ';color:' + (sev === 'medium' || sev === 'low' ? '#000' : '#fff') + '">' + sev.toUpperCase() + '</span>';
+        if (f.rule_id) html += '<span class="finding-rule">' + f.rule_id + '</span>';
+        if (f.confidence) html += '<span class="finding-conf">conf=' + Math.round(f.confidence * 100) + '%</span>';
+        if (f.blocking) html += '<span class="badge badge-block">BLOCK</span>';
+        if (f.corroborated_by && f.corroborated_by.length) {
+          html += '<span class="finding-also" title="This issue was raised by more than one agent and reported once">also: ' + escapeHtml(f.corroborated_by.join(', ')) + '</span>';
+        }
+        html += '</div>';
+        if (f.problem) html += '<div class="finding-msg">' + escapeHtml(f.problem) + '</div>';
+        if (f.file) html += '<div class="finding-loc">' + escapeHtml(f.file) + (f.line ? ':' + f.line : '') + '</div>';
+        if (f.suggestion) html += '<div class="finding-suggestion">Suggestion: ' + escapeHtml(f.suggestion) + '</div>';
+        if (f.suggested_code) {
+          const isAI = String(f.agent || '').indexOf('ai_') === 0;
+          const label = isAI ? 'AI suggested code' : 'Suggested fix';
+          html += '<div class="finding-code-head">' + escapeHtml(label) + '</div>';
+          html += '<pre class="finding-code"><code>' + escapeHtml(f.suggested_code) + '</code></pre>';
+        }
+        html += '</div>';
+      });
+    }
+    html += '</div>'; // detail-panel
+
+    html += '</div>';
+  });
+  html += '</div>';
+
+  document.getElementById('reports').innerHTML = html;
+
+  // Attach click handlers for expand/collapse
+  document.querySelectorAll('.report-item').forEach(el => {
+    el.addEventListener('click', () => el.classList.toggle('expanded'));
+  });
+
+  // Attach filter handlers
+  document.querySelectorAll('.chip').forEach(el => {
+    el.addEventListener('click', () => {
+      document.querySelectorAll('.chip').forEach(c => c.classList.remove('active'));
+      el.classList.add('active');
+      const filter = el.dataset.filter;
+      document.querySelectorAll('.report-item').forEach(item => {
+        const status = item.dataset.status;
+        const show = filter === 'all' || status === filter;
+        item.style.display = show ? '' : 'none';
+      });
+    });
+  });
+}
+
+function sevColor(sev) {
+  return {critical: '#ef4444', high: '#f97316', medium: '#eab308', low: '#22c55e'}[sev] || '#64748b';
+}
+
+// One-line token summary for a report card. Three states, never two:
+//   no field      -> "—" (report written before token tracking)
+//   field, 0 calls -> "0 tokens (regex)"
+//   field, N calls -> "1,234 tokens" (+ "(est.)" when the provider returned
+//                     no usage and PRISM had to estimate)
+function tokenLabel(r) {
+  const tu = r.token_usage;
+  if (!tu) return '—';
+  if (!tu.calls) return '0 tokens (regex)';
+  const total = (tu.total_tokens || 0).toLocaleString();
+  return total + ' tokens' + (tu.estimated_calls ? ' (est.)' : '');
+}
+
+// Expanded-view breakdown: input/output split plus per-provider totals.
+function tokenDetail(r) {
+  const tu = r.token_usage;
+  if (!tu || !tu.calls) return '';
+  const parts = Object.entries(tu.by_provider || {}).map(([name, v]) => {
+    const sum = (v.input_tokens || 0) + (v.output_tokens || 0);
+    return escapeHtml(name) + ': ' + v.calls + ' call(s), ' + sum.toLocaleString() + ' tok';
+  });
+  const split = (tu.input_tokens || 0).toLocaleString() + ' in / '
+              + (tu.output_tokens || 0).toLocaleString() + ' out';
+  const est = tu.estimated_calls ? ' (' + tu.estimated_calls + ' estimated)' : '';
+  return '<div class="finding-loc">Tokens: ' + split + est
+       + (parts.length ? ' &middot; ' + parts.join(' &middot; ') : '') + '</div>';
+}
+
+function escapeHtml(s) {
+  if (!s) return '';
+  return String(s).replace(/&/g,'&amp;').replace(/</g,'&lt;').replace(/>/g,'&gt;').replace(/"/g,'&quot;');
+}
+
+loadReports();
+</script>
+</body>
+</html>

prism_code_review-2.0.1/prism/pre-commit-hook.sh

@@ -0,0 +1,37 @@
+#!/bin/sh
+# PRISM Pre-Commit Hook
+# Runs PRISM review on staged files before allowing commit.
+# Install: prism install-hook
+# Or manually: copy this to .git/hooks/pre-commit and chmod +x
+
+echo "PRISM: Running pre-commit review..."
+
+# Run PRISM on staged changes. Human-readable report (not --json): the
+# developer must be able to read the findings before the commit is blocked.
+# The visual dashboard opens automatically after the review (see --no-dashboard
+# or PRISM_NO_DASHBOARD to opt out on headless machines).
+python -m prism.cli check-staged --prompt
+EXIT_CODE=$?
+
+# Show report interface after review completes
+echo ""
+echo "============================================"
+echo "  PRISM Review Complete"
+echo "============================================"
+echo ""
+
+if [ $EXIT_CODE -ne 0 ]; then
+    echo "Commit blocked. Fix the issues above and try again."
+    echo ""
+    echo "View detailed report:"
+    echo "  prism reports          # review history"
+    echo "  prism dashboard        # visual timeline"
+    echo "  prism feedback         # feedback loop stats"
+    exit 1
+else
+    echo "All checks passed."
+    echo ""
+    echo "View report:"
+    echo "  prism reports"
+    exit 0
+fi

{prism_code_review-2.0.0 → prism_code_review-2.0.1}/prism/reports.py

@@ -12,6 +12,7 @@ No server, no database, no cloud — just local JSON files.
 
 import json
 import os
+import re
 from datetime import datetime, timezone
 from pathlib import Path
 from typing import List, Optional
@@ -19,6 +20,50 @@ from typing import List, Optional
 REPORTS_DIR = ".prism-reports"
 REPORT_INDEX = os.path.join(REPORTS_DIR, "index.json")
 
+# Well-known credential prefixes. A report is meant to be shared (the dashboard
+# is a single self-contained HTML file), and an AI agent asked to fix a hardcoded
+# secret can quote it back in `suggested_code`. Masking the value keeps the
+# finding useful - rule, file, line - without copying the credential.
+_SECRET_VALUE_PATTERNS = [
+    re.compile(r"sk_(?:live|test)_[A-Za-z0-9]{10,}"),
+    re.compile(r"sk-[A-Za-z0-9_\-]{16,}"),
+    re.compile(r"gh[pousr]_[A-Za-z0-9]{20,}"),
+    re.compile(r"AKIA[0-9A-Z]{16}"),
+    re.compile(r"xox[baprs]-[A-Za-z0-9\-]{10,}"),
+    re.compile(r"AIza[0-9A-Za-z_\-]{30,}"),
+]
+
+REDACTED = "***REDACTED***"
+
+
+def redact_secrets(text):
+    """Mask credential-shaped substrings in ``text``; non-strings pass through."""
+    if not isinstance(text, str) or not text:
+        return text
+    for pattern in _SECRET_VALUE_PATTERNS:
+        text = pattern.sub(REDACTED, text)
+    return text
+
+
+def looks_like_secret(text) -> bool:
+    """True when ``text`` contains something shaped like a live credential."""
+    return isinstance(text, str) and redact_secrets(text) != text
+
+
+def _redact_findings(findings: List[dict]) -> List[dict]:
+    """Return a copy of ``findings`` with credential-shaped text masked."""
+    cleaned = []
+    for finding in findings:
+        if not isinstance(finding, dict):
+            cleaned.append(finding)
+            continue
+        safe = dict(finding)
+        for key in ("problem", "message", "suggestion", "suggested_code"):
+            if safe.get(key):
+                safe[key] = redact_secrets(safe[key])
+        cleaned.append(safe)
+    return cleaned
+
 
 def _ensure_dir():
     Path(REPORTS_DIR).mkdir(parents=True, exist_ok=True)
@@ -72,7 +117,7 @@ def save_report(
         "risk_score": risk_score,
         "commit_allowed": commit_allowed,
         "token_usage": token_usage,
-        "findings": findings,
+        "findings": _redact_findings(findings),
     }
 
     # Save individual report

{prism_code_review-2.0.0 → prism_code_review-2.0.1/prism_code_review.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: prism-code-review
-Version: 2.0.0
+Version: 2.0.1
 Summary: Local pre-commit multi-agent code review (regex + AI providers)
 Author: PRISM contributors
 License-Expression: MIT
@@ -197,21 +197,12 @@ There are only three SDKs to install. The five OpenAI-compatible providers
 
 ### Hand the tool to a teammate (no `cd`, no venv on their side)
 
-Build the wheel once, attach it to a GitHub Release, and the teammate runs
-**one** command from any folder — no virtualenv, no source checkout, no build
-tools:
+One command from any folder — no virtualenv, no source checkout, no build tools:
 
 ```bash
-# On the machine that has the repo (you):
-py -m build          # -> dist/prism_code_review-2.0.0-py3-none-any.whl
-# then: GitHub -> Releases -> Draft a new release -> tag v2.0.0
-#       -> attach the .whl -> Publish
-
 # On the teammate's machine, once. The [all] extra installs every provider SDK
 # plus python-dotenv; without an extra the regex agents run but AI agents skip:
-# (the "prism-code-review[all] @ <url>" form is required: pip does not parse
-#  extras that are appended straight onto a direct wheel URL)
-pip install "prism-code-review[all] @ https://github.com/Bibekbwn/prism-code-review/releases/download/v2.0.0/prism_code_review-2.0.0-py3-none-any.whl"
+pip install "prism-code-review[all]"
 
 # Set the API key once for every project (tool-wide):
 prism key set --global --provider gemini --key YOUR_GEMINI_API_KEY
@@ -219,6 +210,18 @@ prism key set --global --provider gemini --key YOUR_GEMINI_API_KEY
 # Then in any project folder: git init, prism init, prism check ...
 ```
 
+No PyPI access (air-gapped machine, internal mirror)? Install straight from the
+GitHub Release wheel instead. Note the `name[extras] @ url` form — pip does not
+parse extras that are appended directly onto a wheel URL, so `...whl[all]`
+returns a 404:
+
+```bash
+pip install "prism-code-review[all] @ https://github.com/Bibekbwn/prism-code-review/releases/download/v2.0.0/prism_code_review-2.0.0-py3-none-any.whl"
+```
+
+Both routes give the same package. To cut a new release, see
+[Releasing](#releasing).
+
 Use `[all]` when you do not control which provider each developer will use. For
 a team standardised on one provider, install only that extra — `[gemini]`,
 `[claude]`, or `[openai]` (the last also covers openrouter, groq, together,
@@ -1380,12 +1383,22 @@ The suite covers:
 ## Releasing
 
 ```bash
-py -m build        # -> dist/prism_code_review-<version>-py3-none-any.whl
+py -m build              # -> dist/prism_code_review-<version>-*.whl and .tar.gz
+py -m twine check dist/* # fails the upload if the README does not render
+```
+
+Then publish to both places:
+
+```bash
+# PyPI (the short install path)
+py -m twine upload dist/*
+
+# GitHub (the wheel-only fallback for machines without PyPI access)
+#Releases -> Draft a new release -> tag v<version> -> attach the .whl -> Publish
 ```
 
-Then attach the wheel to a GitHub Release (Releases → Draft a new release → tag
-`v<version>` → attach the `.whl` → Publish). `dist/` is git-ignored, so the
-wheel is never committed; the Release asset URL is what developers install from.
+`dist/` is git-ignored, so the wheel is never committed — the Release asset and
+the PyPI project are what developers install from.
 
 The wheel declares no hard dependencies — providers are opt-in extras
 (`[gemini]`, `[claude]`, `[openai]`, `[all]`, `[dev]`), so a base install stays

{prism_code_review-2.0.0 → prism_code_review-2.0.1}/prism_code_review.egg-info/SOURCES.txt

@@ -28,12 +28,14 @@ prism/codebase_cache.py
 prism/commands_common.py
 prism/commands_reports.py
 prism/commands_setup.py
+prism/dashboard.html
 prism/feedback.py
 prism/ignore.py
 prism/langs.py
 prism/logging_config.py
 prism/lsp.py
 prism/modes.py
+prism/pre-commit-hook.sh
 prism/reports.py
 prism/token_usage.py
 prism_code_review.egg-info/PKG-INFO

{prism_code_review-2.0.0 → prism_code_review-2.0.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "prism-code-review"
-version = "2.0.0"
+version = "2.0.1"
 description = "Local pre-commit multi-agent code review (regex + AI providers)"
 readme = "README.md"
 requires-python = ">=3.9"
@@ -45,6 +45,12 @@ dev = [
 [project.scripts]
 prism = "prism.cli:main"
 
+[tool.setuptools]
+include-package-data = true
+
+[tool.setuptools.package-data]
+prism = ["dashboard.html", "pre-commit-hook.sh"]
+
 [project.urls]
 Homepage = "https://github.com/Bibekbwn/prism-code-review"
 Issues = "https://github.com/Bibekbwn/prism-code-review/issues"

{prism_code_review-2.0.0 → prism_code_review-2.0.1}/tests/test_regressions.py

@@ -2508,3 +2508,88 @@ action="set", provider="bogus", key="sk-real-key-1234567890"))
         cs._cmd_key(argparse.Namespace(
             action="status", provider=None, key=None))
         assert "No API keys configured" in capsys.readouterr().out
+
+class TestSecretNeverEchoed:
+    """A suggested fix is rendered in the dashboard and the JSON report.
+
+    Returning the offending line verbatim copied the live credential into a
+    file that is meant to be shared, so an unquoted assignment must be masked
+    and an embedded credential must produce no fix at all.
+    """
+
+    def test_unquoted_assignment_is_masked(self):
+        from prism.autofix import generate_fix
+        line = "PASSWORD=hunter2"
+        fix = generate_fix(_finding(rule_id="SECU-103"), line)
+        assert "hunter2" not in (fix or "")
+        assert "REDACTED" in (fix or "")
+
+    def test_shell_export_is_masked(self):
+        from prism.autofix import generate_fix
+        line = "export SECRET_KEY=abcdef1234567890"
+        fix = generate_fix(_finding(rule_id="SECU-125"), line)
+        assert "abcdef1234567890" not in (fix or "")
+
+    def test_embedded_credential_gets_no_fix(self):
+        from prism.autofix import generate_fix
+        line = '    login(user, "sk-live-abcdefghij123456")'
+        assert generate_fix(_finding(), line) is None
+
+    def test_non_declaration_line_is_untouched(self):
+        from prism.autofix import generate_fix
+        line = '  if (token == "abc") {'
+        assert generate_fix(_finding(), line) == line
+
+    def test_report_redacts_prefixed_credentials(self):
+        from prism.reports import redact_secrets
+        text = 'key = "ghp_ABCDEFGHIJKLMNOPQRSTUVWXYZ012345"'
+        assert "ghp_ABCDEFGHIJKLMNOPQRSTUVWXYZ012345" not in redact_secrets(text)
+        assert "REDACTED" in redact_secrets(text)
+
+
+class TestBlockOnValidation:
+    """block_on drives the quality gate; a bare string silently disables it."""
+
+    def _set(self, tmp_path, monkeypatch, value):
+        import prism.commands_reports as cr
+        import prism.cli_config as cfg
+        monkeypatch.chdir(tmp_path)
+        (tmp_path / "prism.json").write_text('{"block_on": ["critical", "high"]}')
+        monkeypatch.setattr(cfg, "get_config_path",
+                            lambda: str(tmp_path / "prism.json"))
+        monkeypatch.setattr(cr, "get_config_path",
+                            lambda: str(tmp_path / "prism.json"))
+        cr._cmd_config(argparse.Namespace(set=["block_on", value],
+                                          get=None))
+        return json.loads((tmp_path / "prism.json").read_text())
+
+    def test_bare_string_is_rejected(self, tmp_path, monkeypatch):
+        with pytest.raises(SystemExit) as exc:
+            self._set(tmp_path, monkeypatch, "not-a-list")
+        assert exc.value.code == 1
+        assert json.loads((tmp_path / "prism.json").read_text())["block_on"] == [
+            "critical", "high"]
+
+    def test_unknown_severity_is_rejected(self, tmp_path, monkeypatch):
+        with pytest.raises(SystemExit) as exc:
+            self._set(tmp_path, monkeypatch, '["critical", "bogus"]')
+        assert exc.value.code == 1
+
+    def test_valid_list_is_accepted(self, tmp_path, monkeypatch):
+        config = self._set(tmp_path, monkeypatch, '["medium"]')
+        assert config["block_on"] == ["medium"]
+
+
+class TestDashboardPackaged:
+    """The dashboard template must ship inside the wheel, not just the repo."""
+
+    def test_template_is_next_to_the_module(self):
+        import prism.commands_reports as cr
+        template = Path(cr.__file__).parent / "dashboard.html"
+        assert template.is_file(), "dashboard.html missing from the package"
+        assert template.stat().st_size > 0
+
+    def test_hook_script_is_next_to_the_module(self):
+        import prism.commands_setup as cs
+        hook = Path(cs.__file__).parent / "pre-commit-hook.sh"
+        assert hook.is_file(), "pre-commit-hook.sh missing from the package"