secure-code-agent 0.12.9__tar.gz → 0.12.10__tar.gz

{secure_code_agent-0.12.9/src/secure_code_agent.egg-info → secure_code_agent-0.12.10}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: secure-code-agent
-Version: 0.12.9
+Version: 0.12.10
 Summary: Deterministic security gate + bounded AI remediation prompt generator. NIST SSDF / OWASP ASVS / CWE Top 25 anchored.
 Author: Marshall Guillory
 License: MIT
@@ -515,7 +515,7 @@ For agents that support invokable skills, this repo ships a portable skill under
 ## GitHub Action
 
 ```yaml
-- uses: marshallguillory86/secure-code-agent@v0.12.9
+- uses: marshallguillory86/secure-code-agent@v0.12.10
   with:
     config: secure-code-agent.json
     fail-on-gate: true

{secure_code_agent-0.12.9 → secure_code_agent-0.12.10}/README.md

@@ -467,7 +467,7 @@ For agents that support invokable skills, this repo ships a portable skill under
 ## GitHub Action
 
 ```yaml
-- uses: marshallguillory86/secure-code-agent@v0.12.9
+- uses: marshallguillory86/secure-code-agent@v0.12.10
   with:
     config: secure-code-agent.json
     fail-on-gate: true

{secure_code_agent-0.12.9 → secure_code_agent-0.12.10/src/secure_code_agent.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: secure-code-agent
-Version: 0.12.9
+Version: 0.12.10
 Summary: Deterministic security gate + bounded AI remediation prompt generator. NIST SSDF / OWASP ASVS / CWE Top 25 anchored.
 Author: Marshall Guillory
 License: MIT
@@ -515,7 +515,7 @@ For agents that support invokable skills, this repo ships a portable skill under
 ## GitHub Action
 
 ```yaml
-- uses: marshallguillory86/secure-code-agent@v0.12.9
+- uses: marshallguillory86/secure-code-agent@v0.12.10
   with:
     config: secure-code-agent.json
     fail-on-gate: true

{secure_code_agent-0.12.9 → secure_code_agent-0.12.10}/src/secure_code_audit/__init__.py

@@ -12,4 +12,4 @@
 #:
 #: PyPI is immutable, so 0.4.0 stays wrong. 0.5.0 is the first build whose
 #: artifacts name their own producer correctly.
-__version__ = "0.12.9"
+__version__ = "0.12.10"

{secure_code_agent-0.12.9 → secure_code_agent-0.12.10}/src/secure_code_audit/cli.py

@@ -306,6 +306,9 @@ def _do_preflight(args: argparse.Namespace) -> int:
                 "command": " ".join(scanner.command) or None,
                 "version": scanner.binary_version() if available else None,
                 "remedy": None if available else scanner.unavailable_fix_hint(),
+                # Disclosed, not silent: the tree asked for a command and was
+                # not given it. `--trust-target-config` grants it.
+                "ignored_command": scanner.ignored_command,
             }
         )
 
@@ -341,6 +344,11 @@ def _print_preflight(rows: list[dict], unselected: list[str], blocking: list[str
         print(f"  {mark} {row['scanner']:<14} {role:<8} {detail}")
         if row["remedy"]:
             print(f"      → {row['remedy']}")
+        if row.get("ignored_command"):
+            print(
+                "      ! the audited tree's config set this command; ignored "
+                "(pass --trust-target-config for a repository you own)"
+            )
     for name in unselected:
         print(f"  ✗ {name:<14} required  not enabled in this configuration")
     # Named, not omitted: a floor tool this run does not evaluate is a stated

{secure_code_agent-0.12.9 → secure_code_agent-0.12.10}/src/secure_code_audit/scanners/base.py

@@ -2,6 +2,7 @@
 
 from __future__ import annotations
 
+import dataclasses
 import importlib.util
 import os
 import re
@@ -18,6 +19,7 @@ from secure_code_audit.config import (
     containment_root,
     is_within,
     scanner_cfg,
+    target_config_is_untrusted,
     target_executables_allowed,
 )
 from secure_code_audit.findings import Category, Confidence, Finding, Severity
@@ -39,6 +41,9 @@ class Scanner(ABC):
     binary: str  # name of the executable on PATH
     version_flag: str = "--version"
     python_module: str | None = None
+    #: True when the audited tree's own config set this scanner's command and
+    #: it was not honoured. See `configure`.
+    ignored_command: bool = False
     default_category: Category = Category.CODE_VULNERABILITIES
     # How an operator obtains this scanner. Surfaced in the unavailable
     # finding and in --preflight. The agent never installs anything itself.
@@ -61,7 +66,17 @@ class Scanner(ABC):
         """
         root = containment_root(target)
         self._allow_target_executables = target_executables_allowed(config, target)
-        self._resolved_command = self._resolve_command(root, self.cfg(config))
+        chosen = self.cfg(config)
+        # An untrusted config does not choose the command — not just "not an
+        # executable from the tree". It could name any program on PATH with
+        # any arguments, and `python -c "<code>"` is any program; the
+        # `--version` probe ran it during preflight, before anything was
+        # audited (maintainability-agent's audit, 2026-10-02). The scanner
+        # resolves as it would with no config, and says it ignored one.
+        self.ignored_command = bool(chosen.command) and target_config_is_untrusted(config, target)
+        if self.ignored_command:
+            chosen = dataclasses.replace(chosen, command=[])
+        self._resolved_command = self._resolve_command(root, chosen)
 
     @property
     def command(self) -> tuple[str, ...]: