secure-code-agent 0.12.9__tar.gz → 0.12.11__tar.gz

{secure_code_agent-0.12.9/src/secure_code_agent.egg-info → secure_code_agent-0.12.11}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: secure-code-agent
-Version: 0.12.9
+Version: 0.12.11
 Summary: Deterministic security gate + bounded AI remediation prompt generator. NIST SSDF / OWASP ASVS / CWE Top 25 anchored.
 Author: Marshall Guillory
 License: MIT
@@ -30,11 +30,11 @@ Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: PyYAML<7,>=6.0.2
 Provides-Extra: mcp
-Requires-Dist: mcp<2,>=1.0; extra == "mcp"
+Requires-Dist: mcp<3,>=1.0; extra == "mcp"
 Provides-Extra: required-scanners
 Requires-Dist: bandit==1.9.4; extra == "required-scanners"
 Requires-Dist: pip-audit==2.10.1; extra == "required-scanners"
-Requires-Dist: njsscan==1.0.0; extra == "required-scanners"
+Requires-Dist: njsscan==1.0.1; extra == "required-scanners"
 Provides-Extra: python-scanners
 Requires-Dist: secure-code-agent[required-scanners]; extra == "python-scanners"
 Requires-Dist: semgrep<2,>=1.172; extra == "python-scanners"
@@ -43,7 +43,8 @@ Provides-Extra: dev
 Requires-Dist: secure-code-agent[required-scanners]; extra == "dev"
 Requires-Dist: pytest>=8.0; extra == "dev"
 Requires-Dist: pytest-cov>=4.0; extra == "dev"
-Requires-Dist: ruff==0.16.2; extra == "dev"
+Requires-Dist: ruff==0.16.9; extra == "dev"
+Requires-Dist: markdown>=3.5; extra == "dev"
 Dynamic: license-file
 
 # secure-code-agent
@@ -454,6 +455,44 @@ for repositories whose `pyproject.toml` is their authoritative audit input.
 
 Wildcard rule (`rule_id: "*"`) requires a `file` or `paths` scope — you cannot disable a rule globally.
 
+## Extending the standards mapping
+
+The shipped mapping table lives in `data/standards.yaml` and covers the rules
+this project curates. Semgrep alone publishes thousands, so point
+`standards_overlay` at your own file to map or correct a rule without waiting
+for a release:
+
+```json
+{ "standards_overlay": "security/standards-overlay.yaml" }
+```
+
+```yaml
+version: 1
+entries:
+  - scanner: semgrep
+    rule_id: python.lang.security.audit.my-rule
+    canonical_cwe: CWE-22
+    owasp_top10: A01
+    asvs_section: V12.3.1
+    nist_ssdf: PW.5.1
+    short_desc: Path traversal in our request handler.
+    fix_hint: Resolve the path and contain it under the upload root.
+```
+
+An overlay entry wins over the shipped table for the fields it sets, and an
+adapter asserting its own CWE still wins over both.
+
+**An overlay cannot set `severity`, `confidence` or `category`**, and a file
+that tries is refused with the reason rather than ignored. Those three are the
+scoring inputs: an overlay that set them could move the grade, which is the
+hole [D32](docs/decisions.md) closed on the configuration side. An overlay says
+*what weakness a rule describes*; it does not say *how much it counts*. Set
+severity policy with `severity_overrides` in a config kept outside the audited
+tree.
+
+A declared overlay that cannot be read fails the run rather than being skipped,
+for the same reason a malformed `.scignore.yaml` does.
+
 ## Baseline + incremental adoption
 
 `secure-code-baseline.json` fingerprints every current finding. On the next run:
@@ -515,7 +554,7 @@ For agents that support invokable skills, this repo ships a portable skill under
 ## GitHub Action
 
 ```yaml
-- uses: marshallguillory86/secure-code-agent@v0.12.9
+- uses: marshallguillory86/secure-code-agent@v0.12.11
   with:
     config: secure-code-agent.json
     fail-on-gate: true

{secure_code_agent-0.12.9 → secure_code_agent-0.12.11}/README.md

@@ -406,6 +406,44 @@ for repositories whose `pyproject.toml` is their authoritative audit input.
 
 Wildcard rule (`rule_id: "*"`) requires a `file` or `paths` scope — you cannot disable a rule globally.
 
+## Extending the standards mapping
+
+The shipped mapping table lives in `data/standards.yaml` and covers the rules
+this project curates. Semgrep alone publishes thousands, so point
+`standards_overlay` at your own file to map or correct a rule without waiting
+for a release:
+
+```json
+{ "standards_overlay": "security/standards-overlay.yaml" }
+```
+
+```yaml
+version: 1
+entries:
+  - scanner: semgrep
+    rule_id: python.lang.security.audit.my-rule
+    canonical_cwe: CWE-22
+    owasp_top10: A01
+    asvs_section: V12.3.1
+    nist_ssdf: PW.5.1
+    short_desc: Path traversal in our request handler.
+    fix_hint: Resolve the path and contain it under the upload root.
+```
+
+An overlay entry wins over the shipped table for the fields it sets, and an
+adapter asserting its own CWE still wins over both.
+
+**An overlay cannot set `severity`, `confidence` or `category`**, and a file
+that tries is refused with the reason rather than ignored. Those three are the
+scoring inputs: an overlay that set them could move the grade, which is the
+hole [D32](docs/decisions.md) closed on the configuration side. An overlay says
+*what weakness a rule describes*; it does not say *how much it counts*. Set
+severity policy with `severity_overrides` in a config kept outside the audited
+tree.
+
+A declared overlay that cannot be read fails the run rather than being skipped,
+for the same reason a malformed `.scignore.yaml` does.
+
 ## Baseline + incremental adoption
 
 `secure-code-baseline.json` fingerprints every current finding. On the next run:
@@ -467,7 +505,7 @@ For agents that support invokable skills, this repo ships a portable skill under
 ## GitHub Action
 
 ```yaml
-- uses: marshallguillory86/secure-code-agent@v0.12.9
+- uses: marshallguillory86/secure-code-agent@v0.12.11
   with:
     config: secure-code-agent.json
     fail-on-gate: true

{secure_code_agent-0.12.9 → secure_code_agent-0.12.11}/pyproject.toml

@@ -53,7 +53,7 @@ dependencies = [
 # server drives it by subprocess rather than reimplementing it — so nobody
 # who only wants the gate pays for an MCP dependency.
 mcp = [
-  "mcp>=1.0,<2",
+  "mcp>=1.0,<3",
 ]
 
 # Scanners the default configuration lists in gates.require_scanners. Pinned
@@ -66,7 +66,7 @@ required-scanners = [
   # rules, so a JavaScript repository can be scanned on a host with no Node.
   # Pinned for the same reason as the rest: the floor is a claim about what
   # ran, and an unpinned ruleset makes that claim unreproducible.
-  "njsscan==1.0.0",
+  "njsscan==1.0.1",
 ]
 # The remaining Python-packaged scanners. Bounded rather than pinned because
 # they are optional; the coverage gate does not require them by default.
@@ -87,7 +87,12 @@ dev = [
   "secure-code-agent[required-scanners]",
   "pytest>=8.0",
   "pytest-cov>=4.0",
-  "ruff==0.16.2",
+  "ruff==0.16.9",
+  # Renders docs/html, the reading copy of every document in the repository.
+  # A dev dependency, not a runtime one: the audit never renders documentation,
+  # and tests/unit/test_rendered_docs.py is what keeps the committed copy
+  # current. See tools/render_docs.py.
+  "markdown>=3.5",
 ]
 
 [project.scripts]
@@ -133,14 +138,41 @@ ignore = ["E501"]  # let line-length be a soft guide; long log strings are fine
 
 [tool.pytest.ini_options]
 testpaths = ["tests"]
-addopts = "-q --strict-markers"
+# Coverage is on by default, so the declared test command — plain `pytest`,
+# which is what maintainability-agent runs — reports it and the
+# `fail_under` below actually applies. Without this the suite was
+# measurable only by whoever remembered the flags, and MA scored
+# test_effectiveness as "not measurable" on every run.
+#
+# `xml` is not decoration: a consumer reads the *artifact*, never stdout.
+# MA looks for `coverage.xml`, `coverage/lcov.info` or `lcov.info` and
+# requires it to be newer than the moment before it ran the suite, so a
+# repository cannot hand it a committed report and set its own
+# test_effectiveness. With `term` alone the number was printed for humans
+# and invisible to every tool, which is the same defect one layer down.
+# `coverage.xml` is gitignored.
+#
+# A step that is not the one measuring passes `--no-cov`;
+# tests/unit/test_one_coverage_floor.py requires every CI invocation to say
+# which it is.
+addopts = "-q --strict-markers --cov=secure_code_audit --cov-branch --cov-report=term --cov-report=xml"
+# The suite tests this checkout, never an installed copy. Without it, bare
+# `pytest` imports whichever secure_code_audit the interpreter can find, and
+# an environment holding a plain install grades code nobody is editing —
+# which is how maintainability-agent came to report a bug fixed in #59.
+pythonpath = ["src"]
 
 [tool.coverage.run]
 source = ["secure_code_audit"]
 branch = true
 
 [tool.coverage.report]
-fail_under = 85
+# The house floor. Raised 85 -> 92 once the suite could actually clear it:
+# measured 93.79% branch coverage after the test seat covered --verify-against
+# (which had no test through main() at all), the four live-config keys, and the
+# loader's fail-closed paths. Raising it while the suite sat at 90.42% would
+# have bought a red build and no tests.
+fail_under = 92
 exclude_lines = [
   "pragma: no cover",
   "if __name__ == .__main__.:",

{secure_code_agent-0.12.9 → secure_code_agent-0.12.11/src/secure_code_agent.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: secure-code-agent
-Version: 0.12.9
+Version: 0.12.11
 Summary: Deterministic security gate + bounded AI remediation prompt generator. NIST SSDF / OWASP ASVS / CWE Top 25 anchored.
 Author: Marshall Guillory
 License: MIT
@@ -30,11 +30,11 @@ Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: PyYAML<7,>=6.0.2
 Provides-Extra: mcp
-Requires-Dist: mcp<2,>=1.0; extra == "mcp"
+Requires-Dist: mcp<3,>=1.0; extra == "mcp"
 Provides-Extra: required-scanners
 Requires-Dist: bandit==1.9.4; extra == "required-scanners"
 Requires-Dist: pip-audit==2.10.1; extra == "required-scanners"
-Requires-Dist: njsscan==1.0.0; extra == "required-scanners"
+Requires-Dist: njsscan==1.0.1; extra == "required-scanners"
 Provides-Extra: python-scanners
 Requires-Dist: secure-code-agent[required-scanners]; extra == "python-scanners"
 Requires-Dist: semgrep<2,>=1.172; extra == "python-scanners"
@@ -43,7 +43,8 @@ Provides-Extra: dev
 Requires-Dist: secure-code-agent[required-scanners]; extra == "dev"
 Requires-Dist: pytest>=8.0; extra == "dev"
 Requires-Dist: pytest-cov>=4.0; extra == "dev"
-Requires-Dist: ruff==0.16.2; extra == "dev"
+Requires-Dist: ruff==0.16.9; extra == "dev"
+Requires-Dist: markdown>=3.5; extra == "dev"
 Dynamic: license-file
 
 # secure-code-agent
@@ -454,6 +455,44 @@ for repositories whose `pyproject.toml` is their authoritative audit input.
 
 Wildcard rule (`rule_id: "*"`) requires a `file` or `paths` scope — you cannot disable a rule globally.
 
+## Extending the standards mapping
+
+The shipped mapping table lives in `data/standards.yaml` and covers the rules
+this project curates. Semgrep alone publishes thousands, so point
+`standards_overlay` at your own file to map or correct a rule without waiting
+for a release:
+
+```json
+{ "standards_overlay": "security/standards-overlay.yaml" }
+```
+
+```yaml
+version: 1
+entries:
+  - scanner: semgrep
+    rule_id: python.lang.security.audit.my-rule
+    canonical_cwe: CWE-22
+    owasp_top10: A01
+    asvs_section: V12.3.1
+    nist_ssdf: PW.5.1
+    short_desc: Path traversal in our request handler.
+    fix_hint: Resolve the path and contain it under the upload root.
+```
+
+An overlay entry wins over the shipped table for the fields it sets, and an
+adapter asserting its own CWE still wins over both.
+
+**An overlay cannot set `severity`, `confidence` or `category`**, and a file
+that tries is refused with the reason rather than ignored. Those three are the
+scoring inputs: an overlay that set them could move the grade, which is the
+hole [D32](docs/decisions.md) closed on the configuration side. An overlay says
+*what weakness a rule describes*; it does not say *how much it counts*. Set
+severity policy with `severity_overrides` in a config kept outside the audited
+tree.
+
+A declared overlay that cannot be read fails the run rather than being skipped,
+for the same reason a malformed `.scignore.yaml` does.
+
 ## Baseline + incremental adoption
 
 `secure-code-baseline.json` fingerprints every current finding. On the next run:
@@ -515,7 +554,7 @@ For agents that support invokable skills, this repo ships a portable skill under
 ## GitHub Action
 
 ```yaml
-- uses: marshallguillory86/secure-code-agent@v0.12.9
+- uses: marshallguillory86/secure-code-agent@v0.12.11
   with:
     config: secure-code-agent.json
     fail-on-gate: true

{secure_code_agent-0.12.9 → secure_code_agent-0.12.11}/src/secure_code_agent.egg-info/SOURCES.txt

@@ -31,7 +31,11 @@ src/secure_code_audit/suppressions.py
 src/secure_code_audit/triage.py
 src/secure_code_audit/verify.py
 src/secure_code_audit/data/semgrep-offline.yaml
+src/secure_code_audit/data/standards.yaml
 src/secure_code_audit/scanners/__init__.py
+src/secure_code_audit/scanners/_execution.py
+src/secure_code_audit/scanners/_finding_builder.py
+src/secure_code_audit/scanners/_resolution.py
 src/secure_code_audit/scanners/bandit_scanner.py
 src/secure_code_audit/scanners/base.py
 src/secure_code_audit/scanners/builtin_rules.py

{secure_code_agent-0.12.9 → secure_code_agent-0.12.11}/src/secure_code_agent.egg-info/requires.txt

@@ -4,10 +4,11 @@ PyYAML<7,>=6.0.2
 secure-code-agent[required-scanners]
 pytest>=8.0
 pytest-cov>=4.0
-ruff==0.16.2
+ruff==0.16.9
+markdown>=3.5
 
 [mcp]
-mcp<2,>=1.0
+mcp<3,>=1.0
 
 [python-scanners]
 secure-code-agent[required-scanners]
@@ -17,4 +18,4 @@ checkov<4,>=3.3
 [required-scanners]
 bandit==1.9.4
 pip-audit==2.10.1
-njsscan==1.0.0
+njsscan==1.0.1

{secure_code_agent-0.12.9 → secure_code_agent-0.12.11}/src/secure_code_audit/__init__.py

@@ -12,4 +12,4 @@
 #:
 #: PyPI is immutable, so 0.4.0 stays wrong. 0.5.0 is the first build whose
 #: artifacts name their own producer correctly.
-__version__ = "0.12.9"
+__version__ = "0.12.11"