rafter-cli 0.8.6__tar.gz → 0.8.7__tar.gz

{rafter_cli-0.8.6 → rafter_cli-0.8.7}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: rafter-cli
-Version: 0.8.6
+Version: 0.8.7
 Summary: Rafter CLI — the default security agent for AI workflows. Free for individuals and open source.
 License: MIT
 Author: Rafter Team

{rafter_cli-0.8.6 → rafter_cli-0.8.7}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "rafter-cli"
-version = "0.8.6"
+version = "0.8.7"
 description = "Rafter CLI — the default security agent for AI workflows. Free for individuals and open source."
 authors = ["Rafter Team <hello@rafter.so>"]
 license = "MIT"

{rafter_cli-0.8.6 → rafter_cli-0.8.7}/rafter_cli/commands/mcp_server.py

@@ -175,6 +175,18 @@ def handle_get_docs_resource() -> str:
     return json.dumps(handle_list_docs(), indent=2)
 
 
+def handle_suppress_finding(
+    path: str,
+    rules: list[str] | None = None,
+    reason: str | None = None,
+) -> dict:
+    """Persist a false-positive suppression into the project's .rafter.yml."""
+    from ..core.suppression_writer import write_suppression
+
+    result = write_suppression([path], rules=rules, reason=reason)
+    return {"ok": True, **result}
+
+
 # ── MCP server factory ────────────────────────────────────────────────
 
 
@@ -249,6 +261,29 @@ def create_mcp_server():
         """
         return json.dumps(handle_get_doc(id_or_tag, refresh))
 
+    @mcp.tool()
+    def suppress_finding(
+        path: str,
+        rules: list[str] | None = None,
+        reason: str | None = None,
+    ) -> str:
+        """Triage a false positive by persisting a suppression rule into .rafter.yml.
+
+        Use when a scan_secrets finding (or a remote scan finding) is a confirmed
+        false positive — e.g. a test fixture or sample credential. Suppressed
+        findings still surface under '_suppressed' in scan output, so the decision
+        is reviewable and version-controlled. Always include a reason.
+
+        Args:
+            path: File path or glob to suppress findings in (e.g. 'test/fixtures/**').
+            rules: Specific rules to suppress, matched case-insensitively against a
+                finding's rule name OR rule id — e.g. 'AWS Access Key' (local pattern
+                name) or 'R-6D5E2' (remote SAST/SCA rule id). Omit to suppress all
+                rules for the path. Honored by both local scans and remote `rafter run`.
+            reason: Why this is a false positive — persisted with the rule. Strongly recommended.
+        """
+        return json.dumps(handle_suppress_finding(path, rules, reason))
+
     @mcp.resource("rafter://config")
     def config_resource() -> str:
         """Current Rafter configuration."""

{rafter_cli-0.8.6 → rafter_cli-0.8.7}/rafter_cli/core/policy_loader.py

@@ -30,13 +30,13 @@ POLICY_FILENAMES = [".rafter.yml", ".rafter.yaml"]
 _KNOWN_DOC_KEYS = {"id", "path", "url", "description", "tags", "cache"}
 
 
-def find_policy_file() -> Path | None:
-    """Walk from cwd up to git root looking for a policy file.
+def find_policy_file(start_dir: str | Path | None = None) -> Path | None:
+    """Walk from ``start_dir`` (default cwd) up to git root looking for a policy file.
 
     Returns the first candidate that exists, in the precedence order
     declared by ``POLICY_FILE_CANDIDATES``.
     """
-    cwd = Path.cwd()
+    cwd = Path(start_dir) if start_dir else Path.cwd()
     root = get_git_root()
     stop = Path(root) if root else cwd.anchor and Path(cwd.anchor)
 

rafter_cli-0.8.7/rafter_cli/core/suppression_writer.py

@@ -0,0 +1,111 @@
+"""Persist finding suppressions into the project's .rafter.yml ignore list.
+
+Mirrors node/src/core/suppression-writer.ts — keep both in sync.
+"""
+from __future__ import annotations
+
+import json
+from pathlib import Path
+
+from ..utils.git import get_git_root
+from .policy_loader import find_policy_file
+
+
+def _rule_key(paths: list[str], rules: list[str] | None) -> str:
+    """Order- and duplicate-insensitive identity for an ignore rule.
+
+    Two rules are "the same" if they target the same set of paths and the
+    same set of rule names. Reason is excluded — re-suppressing the same
+    scope just updates the reason.
+    """
+    def norm(xs: list[str] | None) -> list[str]:
+        return sorted({str(x) for x in (xs or [])})
+
+    return json.dumps({"paths": norm(paths), "rules": norm(rules)}, sort_keys=True)
+
+
+def write_suppression(
+    paths: list[str],
+    rules: list[str] | None = None,
+    reason: str | None = None,
+    cwd: str | Path | None = None,
+) -> dict:
+    """Persist a finding suppression into the project's .rafter.yml ignore list.
+
+    Resolves the policy file via the same precedence the loader uses; if none
+    exists, creates a canonical ``.rafter.yml`` at the git root (or ``cwd``).
+
+    Merge semantics: if an existing ignore rule targets the same paths + rules,
+    its reason is updated in place rather than appending a duplicate.
+
+    ``cwd`` overrides the base directory for resolution (defaults to the process cwd).
+
+    Returns a dict: {file, action, entry, suppression_count}.
+    """
+    import yaml
+
+    norm_paths = [str(p) for p in (paths or []) if str(p)]
+    if not norm_paths:
+        raise ValueError('"paths" must be a non-empty list of file paths or globs.')
+    norm_rules = [str(r) for r in rules if str(r)] if isinstance(rules, list) else None
+    norm_reason = reason.strip() if isinstance(reason, str) and reason.strip() else None
+    base_dir = str(cwd) if cwd else str(Path.cwd())
+
+    target = find_policy_file(base_dir)
+    raw: dict = {}
+
+    if target and Path(target).exists():
+        parsed = yaml.safe_load(Path(target).read_text())
+        raw = parsed if isinstance(parsed, dict) else {}
+        action = "appended"
+    else:
+        root = get_git_root() or base_dir
+        target = Path(root) / ".rafter.yml"
+        action = "created"
+
+    target = Path(target)
+    ignore_list = raw.get("ignore") if isinstance(raw.get("ignore"), list) else []
+
+    new_entry: dict = {"paths": norm_paths}
+    if norm_rules:
+        new_entry["rules"] = norm_rules
+    if norm_reason:
+        new_entry["reason"] = norm_reason
+
+    key = _rule_key(norm_paths, norm_rules)
+    existing = next(
+        (
+            e
+            for e in ignore_list
+            if isinstance(e, dict)
+            and isinstance(e.get("paths"), list)
+            and _rule_key(e["paths"], e.get("rules")) == key
+        ),
+        None,
+    )
+
+    if existing is not None:
+        if norm_reason:
+            existing["reason"] = norm_reason
+        else:
+            existing.pop("reason", None)
+        if action != "created":
+            action = "updated"
+        entry = dict(new_entry)
+        if existing.get("reason"):
+            entry["reason"] = existing["reason"]
+    else:
+        ignore_list.append(new_entry)
+        entry = new_entry
+
+    raw["ignore"] = ignore_list
+
+    target.parent.mkdir(parents=True, exist_ok=True)
+    target.write_text(yaml.safe_dump(raw, sort_keys=False, default_flow_style=False))
+
+    return {
+        "file": str(target),
+        "action": action,
+        "entry": entry,
+        "suppression_count": len(ignore_list),
+    }

{rafter_cli-0.8.6 → rafter_cli-0.8.7}/rafter_cli/resources/rafter-security-skill.md

@@ -1,7 +1,7 @@
 ---
 name: rafter-security
 description: Security toolkit for AI workflows. Use when scanning code or repos for vulnerabilities, auditing third-party skills/MCPs/agent configs before installing, evaluating shell commands before running them, or generating secure design questions for new features. Provides `rafter run` (remote SAST + SCA, needs RAFTER_API_KEY), `rafter secrets` (offline secrets-only), `rafter agent exec --dry-run` (command-risk classification), and `rafter skill review`.
-version: 0.8.6
+version: 0.8.7
 homepage: https://rafter.so
 metadata:
   openclaw:

{rafter_cli-0.8.6 → rafter_cli-0.8.7}/rafter_cli/resources/skills/rafter/docs/finding-triage.md

@@ -53,7 +53,7 @@ If the finding is a leaked secret that was committed:
 
 ## Suppression — When It's OK
 
-Suppress only when the finding is a real false positive *for this context*, with a written reason. Two mechanisms:
+Suppress only when the finding is a real false positive *for this context*, with a written reason. Three mechanisms:
 
 - **`.rafter.yml`**: add an `ignore:` rule naming the path(s), the rule(s), and a `reason` (your evidence). Repo-tied; persists across scans:
   ```yaml
@@ -62,7 +62,8 @@ Suppress only when the finding is a real false positive *for this context*, with
       rules: ["AWS Access Key ID"]   # omit `rules` to suppress every finding on those paths
       reason: "fake test keys — no live path"
   ```
-  Match `rules` on the finding's **rule name** (case-insensitive), not a hashed `R-…` id. On a local `rafter scan`, suppressed findings move into a `_suppressed[]` array and don't affect the exit code — you only fail on a *non-suppressed* finding. Docs: https://docs.rafter.so/suppression
+  Each `rules` entry matches (case-insensitively) the finding's **rule name** (e.g. `AWS Access Key ID`) **or** its **rule id** (e.g. `R-6D5E2`) — use the name for local pattern findings, the id for remote SAST/SCA findings. Path globs are gitignore-style: `*` stays within a path segment, `**` crosses segments, a bare name matches the basename. The same `.rafter.yml ignore` block is honored by **local** scans and **remote `rafter run`** alike. Suppressed findings move into a `_suppressed[]` array and don't affect the exit code — you only fail on a *non-suppressed* finding. Docs: https://docs.rafter.so/suppression
+- **MCP `suppress_finding` tool**: agents can triage a false positive directly through the MCP — it writes the same `.rafter.yml` `ignore` rule above (path, optional rule names, reason). No hand-editing required.
 - **Baseline**: `rafter agent baseline create` snapshots current findings; scan with `rafter scan --baseline` so only *new* findings surface. Good for adopting Rafter on a legacy codebase without a big bang.
 
 Never suppress by: