secure-code-agent 0.3.0__tar.gz → 0.5.0__tar.gz

{secure_code_agent-0.3.0/src/secure_code_agent.egg-info → secure_code_agent-0.5.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: secure-code-agent
-Version: 0.3.0
+Version: 0.5.0
 Summary: Deterministic security gate + bounded AI remediation prompt generator. NIST SSDF / OWASP ASVS / CWE Top 25 anchored.
 Author: Marshall Guillory
 License: MIT
@@ -32,6 +32,7 @@ Requires-Dist: PyYAML<7,>=6.0.2
 Provides-Extra: required-scanners
 Requires-Dist: bandit==1.9.4; extra == "required-scanners"
 Requires-Dist: pip-audit==2.10.1; extra == "required-scanners"
+Requires-Dist: njsscan==1.0.0; extra == "required-scanners"
 Provides-Extra: python-scanners
 Requires-Dist: secure-code-agent[required-scanners]; extra == "python-scanners"
 Requires-Dist: semgrep<2,>=1.172; extra == "python-scanners"
@@ -173,7 +174,9 @@ collapsed before scoring; reports preserve the original scanner evidence.
         ├── Hadolint          (Dockerfile lint)
         ├── OSV-Scanner       (multi-ecosystem SCA via osv.dev)
         ├── OpenSSF Scorecard (repo hygiene + supply chain)
-        ├── eslint-plugin-security  (JS/TS SAST)                     [v0.3]
+        ├── njsscan           (JS/TS SAST, offline, no Node needed)
+        ├── RuboCop           (Ruby security cops, --only Security)
+        ├── gosec             (Go SAST — opt-in; needs the Go toolchain)
         ├── CodeQL SARIF      (ingest GitHub-hosted analysis)
         └── Built-in regex rules (high-confidence, low-FP)
 ```
@@ -287,6 +290,10 @@ for repositories whose `pyproject.toml` is their authoritative audit input.
   reason:  "Slated for rewrite Q3 2026 — gated by initiative INV-44."
   expires: "2026-09-30"
 
+  fingerprint: 0aaa689f8a967d8c   # optional: pin to ONE finding (16 hex, from the report)
+
+  line: 18                          # optional: with fingerprint, pins the exact location
+
 - rule_id: "B101"
   paths:   ["tests/"]
   reason:  "assert statements are legitimate in test code."
@@ -368,6 +375,31 @@ SARIF upload. Pin production usage to a full commit SHA; the version tag above
 is shown for readability. See [`action.yml`](action.yml) and
 [`examples/github-actions/`](examples/github-actions/) for full workflows.
 
+## maintainability-agent integration
+
+`maintainability-agent` declares Security a **delegated** pillar naming this
+tool, and reports it as `NotApplicable` so silence is never read as safety.
+This tool emits the artifact that completes the picture:
+
+```bash
+secure-code-agent . --security-pillar security-pillar.json
+maintainability-agent . --security-pillar security-pillar.json
+```
+
+Standalone use is unaffected — without the flag nothing is written and every
+other output is identical. MA never executes this tool, and this tool never
+imports MA; two independently releasable packages exchanging one document.
+
+The artifact carries **two values that are never averaged**: a practice level
+read from configuration and CI (*is anything preventing the next
+vulnerability?*) and a code condition read from the scanners (*what did they
+find?*). `condition` is `null` whenever scanner coverage is incomplete — this
+tool's score is a rate over findings, so removing scanners makes the raw number
+go **up**, and an unscanned repository must not arrive at MA looking measured.
+
+Full contract, invariants and the practice rubric:
+[`docs/ma-integration.md`](docs/ma-integration.md).
+
 ## What this is NOT
 
 - ❌ **Not a SAST engine.** We delegate to Semgrep / Bandit / CodeQL / etc. — we don't write yet another AST analyzer.
@@ -390,6 +422,9 @@ Full design philosophy in [`docs/design.md`](docs/design.md).
 ## Documentation
 
 - [`docs/product-intent.md`](docs/product-intent.md) — Why this exists, who it serves, what it refuses to become
+- [`docs/decisions.md`](docs/decisions.md)        — Decision register: rulings the code alone cannot answer
+- [`docs/ma-integration.md`](docs/ma-integration.md) — The `security-pillar.json` contract maintainability-agent reads
+- [`docs/calibration.md`](docs/calibration.md)   — The calibration study, its corpus, and what it found
 - [`docs/design.md`](docs/design.md)              — Architecture + non-goals + scanner protocol
 - [`docs/architecture.md`](docs/architecture.md)  — Audit of the system as built + remediation sequence
 - [`docs/release-blockers.md`](docs/release-blockers.md) — Open v0.3.0 release blockers (do not tag until closed)

{secure_code_agent-0.3.0 → secure_code_agent-0.5.0}/README.md

@@ -128,7 +128,9 @@ collapsed before scoring; reports preserve the original scanner evidence.
         ├── Hadolint          (Dockerfile lint)
         ├── OSV-Scanner       (multi-ecosystem SCA via osv.dev)
         ├── OpenSSF Scorecard (repo hygiene + supply chain)
-        ├── eslint-plugin-security  (JS/TS SAST)                     [v0.3]
+        ├── njsscan           (JS/TS SAST, offline, no Node needed)
+        ├── RuboCop           (Ruby security cops, --only Security)
+        ├── gosec             (Go SAST — opt-in; needs the Go toolchain)
         ├── CodeQL SARIF      (ingest GitHub-hosted analysis)
         └── Built-in regex rules (high-confidence, low-FP)
 ```
@@ -242,6 +244,10 @@ for repositories whose `pyproject.toml` is their authoritative audit input.
   reason:  "Slated for rewrite Q3 2026 — gated by initiative INV-44."
   expires: "2026-09-30"
 
+  fingerprint: 0aaa689f8a967d8c   # optional: pin to ONE finding (16 hex, from the report)
+
+  line: 18                          # optional: with fingerprint, pins the exact location
+
 - rule_id: "B101"
   paths:   ["tests/"]
   reason:  "assert statements are legitimate in test code."
@@ -323,6 +329,31 @@ SARIF upload. Pin production usage to a full commit SHA; the version tag above
 is shown for readability. See [`action.yml`](action.yml) and
 [`examples/github-actions/`](examples/github-actions/) for full workflows.
 
+## maintainability-agent integration
+
+`maintainability-agent` declares Security a **delegated** pillar naming this
+tool, and reports it as `NotApplicable` so silence is never read as safety.
+This tool emits the artifact that completes the picture:
+
+```bash
+secure-code-agent . --security-pillar security-pillar.json
+maintainability-agent . --security-pillar security-pillar.json
+```
+
+Standalone use is unaffected — without the flag nothing is written and every
+other output is identical. MA never executes this tool, and this tool never
+imports MA; two independently releasable packages exchanging one document.
+
+The artifact carries **two values that are never averaged**: a practice level
+read from configuration and CI (*is anything preventing the next
+vulnerability?*) and a code condition read from the scanners (*what did they
+find?*). `condition` is `null` whenever scanner coverage is incomplete — this
+tool's score is a rate over findings, so removing scanners makes the raw number
+go **up**, and an unscanned repository must not arrive at MA looking measured.
+
+Full contract, invariants and the practice rubric:
+[`docs/ma-integration.md`](docs/ma-integration.md).
+
 ## What this is NOT
 
 - ❌ **Not a SAST engine.** We delegate to Semgrep / Bandit / CodeQL / etc. — we don't write yet another AST analyzer.
@@ -345,6 +376,9 @@ Full design philosophy in [`docs/design.md`](docs/design.md).
 ## Documentation
 
 - [`docs/product-intent.md`](docs/product-intent.md) — Why this exists, who it serves, what it refuses to become
+- [`docs/decisions.md`](docs/decisions.md)        — Decision register: rulings the code alone cannot answer
+- [`docs/ma-integration.md`](docs/ma-integration.md) — The `security-pillar.json` contract maintainability-agent reads
+- [`docs/calibration.md`](docs/calibration.md)   — The calibration study, its corpus, and what it found
 - [`docs/design.md`](docs/design.md)              — Architecture + non-goals + scanner protocol
 - [`docs/architecture.md`](docs/architecture.md)  — Audit of the system as built + remediation sequence
 - [`docs/release-blockers.md`](docs/release-blockers.md) — Open v0.3.0 release blockers (do not tag until closed)

{secure_code_agent-0.3.0 → secure_code_agent-0.5.0}/pyproject.toml

@@ -4,7 +4,15 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "secure-code-agent"
-version = "0.3.0"
+# Derived from `secure_code_audit.__version__`, which is the only place the
+# number is written. It used to be duplicated here, and the two drifted: this
+# file said 0.4.0 while the package said 0.3.0, so the released v0.4.0 wheel
+# stamped 0.3.0 into every SARIF document, JSON report, Markdown header,
+# `--version` and the pillar artifact handed to maintainability-agent. The
+# release workflow compared the tag against *this* line and never looked at the
+# package, so nothing caught it. A test asserting the two agree would only
+# police the duplication; removing it is the fix.
+dynamic = ["version"]
 description = "Deterministic security gate + bounded AI remediation prompt generator. NIST SSDF / OWASP ASVS / CWE Top 25 anchored."
 readme = "README.md"
 requires-python = ">=3.10"
@@ -47,12 +55,18 @@ dependencies = [
 required-scanners = [
   "bandit==1.9.4",
   "pip-audit==2.10.1",
+  # njsscan is in the floor (D12) and is a Python package carrying its own
+  # rules, so a JavaScript repository can be scanned on a host with no Node.
+  # Pinned for the same reason as the rest: the floor is a claim about what
+  # ran, and an unpinned ruleset makes that claim unreproducible.
+  "njsscan==1.0.0",
 ]
 # The remaining Python-packaged scanners. Bounded rather than pinned because
 # they are optional; the coverage gate does not require them by default.
-# Scanners distributed as standalone binaries (gitleaks, hadolint, npm,
-# osv-scanner, scorecard, trivy, trufflehog) cannot be installed from PyPI —
-# see docs/scanners.md for their install commands and the SARIF-import route.
+# Scanners distributed as standalone binaries or through another language's
+# package manager (gitleaks, gosec, hadolint, npm, osv-scanner, rubocop,
+# scorecard, trivy, trufflehog) cannot be installed from PyPI — see
+# docs/scanners.md for their install commands and the SARIF-import route.
 python-scanners = [
   "secure-code-agent[required-scanners]",
   "semgrep>=1.172,<2",
@@ -80,6 +94,12 @@ Documentation = "https://github.com/marshallguillory86/secure-code-agent/tree/ma
 Issues        = "https://github.com/marshallguillory86/secure-code-agent/issues"
 Changelog     = "https://github.com/marshallguillory86/secure-code-agent/blob/main/CHANGELOG.md"
 
+[tool.setuptools.dynamic]
+# The single source of truth for the version. `src/secure_code_audit/__init__.py`
+# holds the literal; this reads it. The two cannot drift because there is only
+# one of them.
+version = { attr = "secure_code_audit.__version__" }
+
 [tool.setuptools.packages.find]
 where = ["src"]
 
@@ -92,7 +112,12 @@ target-version = "py310"
 # Ruff 0.16 formats Python blocks embedded in Markdown. Our docs use those
 # blocks illustratively — excerpted statements, aligned-comment schemas — and
 # reformatting them damages the documentation without improving any code.
-extend-exclude = ["**/*.md"]
+extend-exclude = [
+  "**/*.md",
+  # Scanner fixtures are deliberately vulnerable sample code. Linting them
+  # would demand we fix the very patterns the rules exist to detect.
+  "tests/fixtures/**",
+]
 
 [tool.ruff.lint]
 select = ["E", "F", "I", "B", "UP", "SIM", "C4"]

{secure_code_agent-0.3.0 → secure_code_agent-0.5.0/src/secure_code_agent.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: secure-code-agent
-Version: 0.3.0
+Version: 0.5.0
 Summary: Deterministic security gate + bounded AI remediation prompt generator. NIST SSDF / OWASP ASVS / CWE Top 25 anchored.
 Author: Marshall Guillory
 License: MIT
@@ -32,6 +32,7 @@ Requires-Dist: PyYAML<7,>=6.0.2
 Provides-Extra: required-scanners
 Requires-Dist: bandit==1.9.4; extra == "required-scanners"
 Requires-Dist: pip-audit==2.10.1; extra == "required-scanners"
+Requires-Dist: njsscan==1.0.0; extra == "required-scanners"
 Provides-Extra: python-scanners
 Requires-Dist: secure-code-agent[required-scanners]; extra == "python-scanners"
 Requires-Dist: semgrep<2,>=1.172; extra == "python-scanners"
@@ -173,7 +174,9 @@ collapsed before scoring; reports preserve the original scanner evidence.
         ├── Hadolint          (Dockerfile lint)
         ├── OSV-Scanner       (multi-ecosystem SCA via osv.dev)
         ├── OpenSSF Scorecard (repo hygiene + supply chain)
-        ├── eslint-plugin-security  (JS/TS SAST)                     [v0.3]
+        ├── njsscan           (JS/TS SAST, offline, no Node needed)
+        ├── RuboCop           (Ruby security cops, --only Security)
+        ├── gosec             (Go SAST — opt-in; needs the Go toolchain)
         ├── CodeQL SARIF      (ingest GitHub-hosted analysis)
         └── Built-in regex rules (high-confidence, low-FP)
 ```
@@ -287,6 +290,10 @@ for repositories whose `pyproject.toml` is their authoritative audit input.
   reason:  "Slated for rewrite Q3 2026 — gated by initiative INV-44."
   expires: "2026-09-30"
 
+  fingerprint: 0aaa689f8a967d8c   # optional: pin to ONE finding (16 hex, from the report)
+
+  line: 18                          # optional: with fingerprint, pins the exact location
+
 - rule_id: "B101"
   paths:   ["tests/"]
   reason:  "assert statements are legitimate in test code."
@@ -368,6 +375,31 @@ SARIF upload. Pin production usage to a full commit SHA; the version tag above
 is shown for readability. See [`action.yml`](action.yml) and
 [`examples/github-actions/`](examples/github-actions/) for full workflows.
 
+## maintainability-agent integration
+
+`maintainability-agent` declares Security a **delegated** pillar naming this
+tool, and reports it as `NotApplicable` so silence is never read as safety.
+This tool emits the artifact that completes the picture:
+
+```bash
+secure-code-agent . --security-pillar security-pillar.json
+maintainability-agent . --security-pillar security-pillar.json
+```
+
+Standalone use is unaffected — without the flag nothing is written and every
+other output is identical. MA never executes this tool, and this tool never
+imports MA; two independently releasable packages exchanging one document.
+
+The artifact carries **two values that are never averaged**: a practice level
+read from configuration and CI (*is anything preventing the next
+vulnerability?*) and a code condition read from the scanners (*what did they
+find?*). `condition` is `null` whenever scanner coverage is incomplete — this
+tool's score is a rate over findings, so removing scanners makes the raw number
+go **up**, and an unscanned repository must not arrive at MA looking measured.
+
+Full contract, invariants and the practice rubric:
+[`docs/ma-integration.md`](docs/ma-integration.md).
+
 ## What this is NOT
 
 - ❌ **Not a SAST engine.** We delegate to Semgrep / Bandit / CodeQL / etc. — we don't write yet another AST analyzer.
@@ -390,6 +422,9 @@ Full design philosophy in [`docs/design.md`](docs/design.md).
 ## Documentation
 
 - [`docs/product-intent.md`](docs/product-intent.md) — Why this exists, who it serves, what it refuses to become
+- [`docs/decisions.md`](docs/decisions.md)        — Decision register: rulings the code alone cannot answer
+- [`docs/ma-integration.md`](docs/ma-integration.md) — The `security-pillar.json` contract maintainability-agent reads
+- [`docs/calibration.md`](docs/calibration.md)   — The calibration study, its corpus, and what it found
 - [`docs/design.md`](docs/design.md)              — Architecture + non-goals + scanner protocol
 - [`docs/architecture.md`](docs/architecture.md)  — Audit of the system as built + remediation sequence
 - [`docs/release-blockers.md`](docs/release-blockers.md) — Open v0.3.0 release blockers (do not tag until closed)

{secure_code_agent-0.3.0 → secure_code_agent-0.5.0}/src/secure_code_agent.egg-info/SOURCES.txt

@@ -14,23 +14,31 @@ src/secure_code_audit/config.py
 src/secure_code_audit/findings.py
 src/secure_code_audit/git_tools.py
 src/secure_code_audit/instructions.py
+src/secure_code_audit/pillar.py
+src/secure_code_audit/practice.py
 src/secure_code_audit/remediation.py
 src/secure_code_audit/renderers.py
+src/secure_code_audit/ruleset.py
 src/secure_code_audit/sarif.py
 src/secure_code_audit/scanner_status.py
 src/secure_code_audit/scoring.py
 src/secure_code_audit/standards.py
 src/secure_code_audit/suppressions.py
+src/secure_code_audit/data/semgrep-offline.yaml
 src/secure_code_audit/scanners/__init__.py
 src/secure_code_audit/scanners/bandit_scanner.py
 src/secure_code_audit/scanners/base.py
 src/secure_code_audit/scanners/builtin_rules.py
 src/secure_code_audit/scanners/checkov_scanner.py
+src/secure_code_audit/scanners/floor.py
 src/secure_code_audit/scanners/gitleaks_scanner.py
+src/secure_code_audit/scanners/gosec_scanner.py
 src/secure_code_audit/scanners/hadolint_scanner.py
+src/secure_code_audit/scanners/njsscan_scanner.py
 src/secure_code_audit/scanners/npm_audit_scanner.py
 src/secure_code_audit/scanners/osv_scanner.py
 src/secure_code_audit/scanners/pip_audit_scanner.py
+src/secure_code_audit/scanners/rubocop_scanner.py
 src/secure_code_audit/scanners/scorecard_scanner.py
 src/secure_code_audit/scanners/semgrep_scanner.py
 src/secure_code_audit/scanners/trivy_scanner.py

{secure_code_agent-0.3.0 → secure_code_agent-0.5.0}/src/secure_code_agent.egg-info/requires.txt

@@ -14,3 +14,4 @@ checkov<4,>=3.3
 [required-scanners]
 bandit==1.9.4
 pip-audit==2.10.1
+njsscan==1.0.0

secure_code_agent-0.5.0/src/secure_code_audit/__init__.py

@@ -0,0 +1,15 @@
+"""secure-code-agent — deterministic security gate + bounded AI remediation prompts."""
+
+#: The only place the version is written. `pyproject.toml` derives it via
+#: `[tool.setuptools.dynamic]`, so the two cannot drift.
+#:
+#: They did drift once, and it shipped: pyproject said 0.4.0 while this said
+#: 0.3.0, so the released v0.4.0 wheel stamped 0.3.0 into every SARIF document,
+#: every JSON report, the Markdown header, `--version`, and the
+#: `security-pillar.json` handed to maintainability-agent. The release workflow
+#: compared the tag against pyproject's line and never looked here — it
+#: verified the half that was right and shipped the half that was wrong.
+#:
+#: PyPI is immutable, so 0.4.0 stays wrong. 0.5.0 is the first build whose
+#: artifacts name their own producer correctly.
+__version__ = "0.5.0"