secure-code-agent 0.6.0__tar.gz → 0.8.0__tar.gz

{secure_code_agent-0.6.0/src/secure_code_agent.egg-info → secure_code_agent-0.8.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: secure-code-agent
-Version: 0.6.0
+Version: 0.8.0
 Summary: Deterministic security gate + bounded AI remediation prompt generator. NIST SSDF / OWASP ASVS / CWE Top 25 anchored.
 Author: Marshall Guillory
 License: MIT

{secure_code_agent-0.6.0 → secure_code_agent-0.8.0/src/secure_code_agent.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: secure-code-agent
-Version: 0.6.0
+Version: 0.8.0
 Summary: Deterministic security gate + bounded AI remediation prompt generator. NIST SSDF / OWASP ASVS / CWE Top 25 anchored.
 Author: Marshall Guillory
 License: MIT

{secure_code_agent-0.6.0 → secure_code_agent-0.8.0}/src/secure_code_audit/__init__.py

@@ -12,4 +12,4 @@
 #:
 #: PyPI is immutable, so 0.4.0 stays wrong. 0.5.0 is the first build whose
 #: artifacts name their own producer correctly.
-__version__ = "0.6.0"
+__version__ = "0.8.0"

{secure_code_agent-0.6.0 → secure_code_agent-0.8.0}/src/secure_code_audit/cli.py

@@ -56,6 +56,7 @@ from secure_code_audit.scoring import (
 )
 from secure_code_audit.scoring import score as score_findings
 from secure_code_audit.scoring import verdict as build_verdict
+from secure_code_audit.standards import categories_for_scanner
 
 
 def _parser() -> argparse.ArgumentParser:
@@ -501,6 +502,12 @@ def _prepare_audit(
         raise ValueError("multiple scan roots are not supported; provide one repository root")
     # The target is resolved first because the default config belongs to it.
     target = Path(args.paths[0]).resolve()
+    # A typo in the path used to reach the scanners, where the first adapter
+    # passed the missing directory as a subprocess `cwd` and the run died
+    # with a raw `FileNotFoundError` traceback. An operator who mistypes a
+    # path should be told so, not handed a stack trace from `subprocess.py`.
+    if not target.exists():
+        raise ValueError(f"scan root does not exist: {target}")
     cfg = config_mod.load(args.config, default_root=target)
     # Set from the command line only. Threading it through the loaded config
     # would let a repository-supplied file assert its own trustworthiness.
@@ -623,14 +630,24 @@ def _measurable_categories(
             domains.add(policy.domain)
 
     measurable = {category for category in Category if category.value in domains}
-    if "multiple" in domains:
-        # builtin_rules reads several categories and declares none of them.
-        measurable |= {
-            Category.SECRETS,
-            Category.CODE_VULNERABILITIES,
-            Category.CRYPTO,
-            Category.CONFIG_IAC,
-        }
+    for execution in executions:
+        # A scanner declaring `multiple` reads several categories and names
+        # none of them, so ask the standards map which rules it actually has.
+        #
+        # This list used to be written out by hand and was wrong in both
+        # directions: it claimed `builtin_rules` covered `secrets` and
+        # `config_iac` — its rules are Python and shell language primitives,
+        # it has never had one of either — and omitted `supply_chain`, which
+        # it does cover. An IaC repository carrying a `public-read` S3
+        # bucket, a 0.0.0.0/0 ingress rule, `USER root` and `chmod 777`
+        # scored `config_iac` **5.0** with neither checkov nor hadolint
+        # installed. A category graded perfectly because nothing could read
+        # it is the absence-as-value defect this function exists to prevent.
+        if execution.outcome not in COVERING_OUTCOMES:
+            continue
+        policy = floor.policy(execution.name)
+        if policy is not None and policy.domain == "multiple":
+            measurable |= categories_for_scanner(execution.name)
     measurable |= {finding.category for finding in findings if not finding.suppressed}
     return measurable
 
@@ -787,7 +804,7 @@ def _write_outputs(
     if paths.json_out is not None:
         renderers.write_json(findings, score, gate, paths.json_out, coverage, verdict, axes)
     if paths.sarif is not None:
-        sarif.write(findings, paths.sarif, coverage)
+        sarif.write(findings, paths.sarif, coverage, lambda f: renderers.axis_of(f, axes))
     if paths.comment is not None:
         renderers.write_pr_comment(findings, score, gate, paths.comment, coverage, verdict)
     if paths.prompt is not None:
@@ -880,7 +897,15 @@ def _under_root(root: Path, value: str) -> Path:
 def _print_summary(
     verdict, score, gate, ran, unavailable, coverage, paths, axes=(), trend=None
 ) -> None:
-    status = "PASS" if gate.passed else "FAIL"
+    # "PASS" is a claim that something was checked. With no gate configured
+    # nothing was, and saying so is the difference between a report and a
+    # false assurance.
+    if not gate.passed:
+        status = "FAIL"
+    elif gate.enforced:
+        status = "PASS"
+    else:
+        status = "NOT CONFIGURED"
     print(f"secure-code-agent  ·  score {verdict.headline()}  ·  gate {status}")
     for reason in verdict.reasons:
         print(f"  ! grade withheld: {reason}")
@@ -904,6 +929,15 @@ def _print_summary(
     if not gate.passed:
         for reason in gate.reasons:
             print(f"  ✗ {reason}")
+    elif not gate.enforced:
+        print(
+            "  ! no gate is configured, so nothing here could have failed. "
+            "This audit is a report, not a check."
+        )
+        print(
+            "    Set gates.fail_on_severity in secure-code-agent.json to make "
+            "findings block a build; read the work order either way."
+        )
     written = [
         str(p)
         for p in (

{secure_code_agent-0.6.0 → secure_code_agent-0.8.0}/src/secure_code_audit/config.py

@@ -75,6 +75,13 @@ DEFAULT_INCLUDE_EXTS: tuple[str, ...] = (
     ".yaml",
     ".yml",
     ".json",
+    # Terraform. checkov is in the floor and reads `.tf`, so its findings
+    # were being scored against a line count that excluded every file it
+    # had read — an IaC repository measured six lines for a Dockerfile and
+    # counted none of its ten lines of Terraform. Numerator and denominator
+    # have to describe the same tree.
+    ".tf",
+    ".tfvars",
     "Dockerfile",
 )
 

{secure_code_agent-0.6.0 → secure_code_agent-0.8.0}/src/secure_code_audit/findings.py

@@ -207,6 +207,46 @@ RULE_ALIASES: dict[str, dict[str, str]] = {
 }
 
 
+def _canonical_rule(finding: Finding) -> str:
+    """A rule id with aliases resolved, scoped to its scanner."""
+    alias = RULE_ALIASES.get(finding.scanner, {})
+    return f"{finding.scanner}:{alias.get(finding.rule_id, finding.rule_id)}"
+
+
+def _same_weakness(a: Finding, b: Finding) -> bool:
+    """Are these two reports of one weakness, or two weaknesses at one line?
+
+    Two conditions, and a CWE match alone is not enough.
+
+    **Two different rules from the same scanner are two different checks.**
+    Bandit files `B602` (shell=True), `B603` (subprocess call) and `B607`
+    (partial executable path) all under CWE-78, and they are not the same
+    finding: one is fixed with an argument list, one with an absolute path.
+    Keying on the CWE merged them and the work order lost a finding: a
+    one-line shell-enabled subprocess call reported `B607` alone, with the
+    more serious `B602` hidden inside it as a footnote.
+
+    (The example is described rather than quoted. Writing the offending
+    call out verbatim put a real `B602` on the primary axis of this file
+    and failed the repository's own gate — the second time in two days that
+    documenting a vulnerable pattern created one. Prose is scanned too.)
+
+    An earlier test asserted exactly this must not happen and passed anyway,
+    because its fixtures carried no CWE. Reading Bandit's CWEs gave them one
+    and turned a passing test into a false assurance.
+
+    So: the same scanner merges only through the hand-checked alias table.
+    Different scanners merge on a shared CWE, which is the corroboration
+    this function exists for — bandit and our own rule catching one
+    `shell=True` is one finding with two witnesses.
+    """
+    if a.file_path != b.file_path or a.line_start != b.line_start:
+        return False
+    if a.scanner == b.scanner:
+        return _canonical_rule(a) == _canonical_rule(b)
+    return bool(a.canonical_cwe) and a.canonical_cwe == b.canonical_cwe
+
+
 def _merge_key(finding: Finding) -> tuple:
     """What makes two reports the same report.
 
@@ -250,25 +290,35 @@ def merge_corroborating(findings: Iterable[Finding]) -> list[Finding]:
     because a report that lists one line twice is wrong about the code, and
     a work order derived from it would ask for the same fix twice.
     """
-    merged: dict[tuple, Finding] = {}
-    extra: dict[tuple, list[str]] = {}
+    # Keyed by line so the pairwise test only runs against plausible
+    # neighbours; `_same_weakness` decides the rest.
+    by_line: dict[tuple, list[int]] = {}
+    kept: list[Finding] = []
+    witnesses: list[list[str]] = []
 
     for finding in findings:
-        key = _merge_key(finding)
-        kept = merged.get(key)
-        if kept is None:
-            merged[key] = finding
-            extra[key] = []
+        locus = (finding.file_path.as_posix(), finding.line_start)
+        slot = None
+        for index in by_line.get(locus, []):
+            if _same_weakness(kept[index], finding):
+                slot = index
+                break
+        if slot is None:
+            by_line.setdefault(locus, []).append(len(kept))
+            kept.append(finding)
+            witnesses.append([])
             continue
         label = f"{finding.scanner}:{finding.rule_id}"
-        if label not in extra[key] and label != f"{kept.scanner}:{kept.rule_id}":
-            extra[key].append(label)
-        if finding.severity.rank > kept.severity.rank or (
-            finding.severity.rank == kept.severity.rank
-            and CONFIDENCE_RANK[finding.confidence] > CONFIDENCE_RANK[kept.confidence]
+        existing = kept[slot]
+        if label not in witnesses[slot] and label != f"{existing.scanner}:{existing.rule_id}":
+            witnesses[slot].append(label)
+        if finding.severity.rank > existing.severity.rank or (
+            finding.severity.rank == existing.severity.rank
+            and CONFIDENCE_RANK[finding.confidence] > CONFIDENCE_RANK[existing.confidence]
         ):
-            merged[key] = replace(finding, corroborated_by=kept.corroborated_by)
+            kept[slot] = finding
 
     return [
-        replace(f, corroborated_by=tuple(extra[k])) if extra[k] else f for k, f in merged.items()
+        replace(f, corroborated_by=tuple(seen)) if seen else f
+        for f, seen in zip(kept, witnesses, strict=True)
     ]

{secure_code_agent-0.6.0 → secure_code_agent-0.8.0}/src/secure_code_audit/git_tools.py

@@ -8,9 +8,19 @@ from pathlib import Path
 
 
 def find_repo_root(start: Path) -> Path:
-    """Walk up from `start` until a .git directory is found. Returns `start`
-    if no git repo is present (a tarball / archive run is still supported)."""
+    """Walk up from `start` until a .git directory is found.
+
+    Returns the nearest directory when no git repo is present, so a tarball
+    or archive run is still supported.
+
+    **A root is always a directory.** Auditing a single file outside a git
+    repository used to return the file itself, and every path built under it
+    became nonsense — `secure-code-agent one.py` died writing its report to
+    `one.py/secure-code-report.md`.
+    """
     cur = start.resolve()
+    if not cur.is_dir():
+        cur = cur.parent
     for parent in (cur, *cur.parents):
         if (parent / ".git").exists():
             return parent
@@ -107,7 +117,12 @@ def loc_under(
     skip = {p.resolve() for p in skip}
     primary = 0
     test = 0
-    for path in root.rglob("*"):
+    # `rglob` on a file yields nothing, so a single-file audit reported zero
+    # lines — and a zero denominator is not normalised at all, so the grade
+    # became the raw subtotal. Auditing one file is supported; it should be
+    # measured against that file.
+    candidates = root.rglob("*") if root.is_dir() else [root]
+    for path in candidates:
         if not path.is_file():
             continue
         if path.resolve() in skip:

{secure_code_agent-0.6.0 → secure_code_agent-0.8.0}/src/secure_code_audit/renderers.py

@@ -51,6 +51,12 @@ def to_json(
         },
         "gate": {
             "passed": gate.passed,
+            # Which gates could actually have failed. Empty means no policy
+            # was configured, and `passed: true` then says only that nothing
+            # tripped — not that anything was checked. A consumer treating
+            # `passed` as a security signal needs to see this.
+            "configured": list(gate.configured),
+            "enforced": gate.enforced,
             "reasons": list(gate.reasons),
             "tripped": list(gate.tripped),
         },

{secure_code_agent-0.6.0 → secure_code_agent-0.8.0}/src/secure_code_audit/sarif.py

@@ -29,7 +29,11 @@ _SARIF_LEVEL = {
 }
 
 
-def emit(findings: Iterable[Finding], coverage: CoverageReport | None = None) -> dict:
+def emit(
+    findings: Iterable[Finding],
+    coverage: CoverageReport | None = None,
+    axis_of=lambda _f: "primary",
+) -> dict:
     """Build a SARIF 2.1.0 document from canonical findings."""
     findings = list(findings)
 
@@ -41,7 +45,7 @@ def emit(findings: Iterable[Finding], coverage: CoverageReport | None = None) ->
         rid = f.rule_id
         if rid not in rule_meta:
             rule_meta[rid] = _rule(f)
-        results.append(_result(f))
+        results.append(_result(f, axis_of(f)))
 
     run = {
         "tool": {
@@ -114,14 +118,63 @@ def _rule(f: Finding) -> dict:
     return rule
 
 
-def _result(f: Finding) -> dict:
+#: Axes whose findings are reported but are not defects to raise an alert
+#: for. Same set the work order files under §ACCEPT.
+_SIDE_AXES = frozenset({"test tree", "documentation"})
+
+
+def _suppressions(f: Finding, axis: str) -> list[dict] | None:
+    """The SARIF-standard suppression array, or None to raise an alert.
+
+    SARIF is consumed by code-scanning platforms that turn each result into
+    an alert, and `suppressions` is the field they honour. We were writing
+    `properties.suppressed` instead — a field of our own invention that no
+    consumer reads — so two kinds of finding raised alerts they should not:
+
+    * findings the operator had explicitly suppressed in `.scignore.yaml`,
+      with a reason and an expiry, which is as clear a "do not alert me
+      about this" as exists;
+    * and every test-tree and documentation finding, which the product
+      itself reports as "not scored" and the work order files under §ACCEPT
+      with "do not patch these".
+
+    Auditing `maintainability-agent` produced 4,929 SARIF results of which
+    **4,847 were test fixtures**. Uploaded to code scanning that is 4,847
+    alerts for deliberately-vulnerable test data, burying the 82 findings in
+    the shipped source.
+
+    Suppressed, not omitted. The finding stays in the file with its
+    location and justification, so nothing is hidden from a reader — it
+    simply does not become someone's ticket.
+    """
+    if f.suppressed:
+        return [
+            {
+                "kind": "external",
+                "justification": f.suppression_note or "suppressed by operator configuration",
+            }
+        ]
+    if axis in _SIDE_AXES:
+        return [
+            {
+                "kind": "external",
+                "justification": (
+                    f"reported on the {axis} axis: outside the shipped source, "
+                    f"not scored as code condition, and not a patch target"
+                ),
+            }
+        ]
+    return None
+
+
+def _result(f: Finding, axis: str = "primary") -> dict:
     region: dict = {"startLine": max(1, f.line_start)}
     if f.line_end and f.line_end != f.line_start:
         region["endLine"] = f.line_end
     if f.code_snippet:
         region["snippet"] = {"text": f.code_snippet}
 
-    return {
+    result = {
         "ruleId": f.rule_id,
         "level": _SARIF_LEVEL[f.severity],
         "message": {"text": f.message},
@@ -131,6 +184,7 @@ def _result(f: Finding) -> dict:
             "category": f.category.value,
             "is_new": f.is_new,
             "suppressed": f.suppressed,
+            "axis": axis,
         },
         "locations": [
             {
@@ -141,12 +195,19 @@ def _result(f: Finding) -> dict:
             }
         ],
     }
+    suppressions = _suppressions(f, axis)
+    if suppressions:
+        result["suppressions"] = suppressions
+    return result
 
 
 def write(
-    findings: Iterable[Finding], output: Path, coverage: CoverageReport | None = None
+    findings: Iterable[Finding],
+    output: Path,
+    coverage: CoverageReport | None = None,
+    axis_of=lambda _f: "primary",
 ) -> None:
-    output.write_text(json.dumps(emit(findings, coverage), indent=2), encoding="utf-8")
+    output.write_text(json.dumps(emit(findings, coverage, axis_of), indent=2), encoding="utf-8")
 
 
 # ----- ingest -------------------------------------------------------------

{secure_code_agent-0.6.0 → secure_code_agent-0.8.0}/src/secure_code_audit/scanners/base.py

@@ -156,7 +156,18 @@ class Scanner(ABC):
         """Run a scanner subprocess with sanitized env, no shell.
 
         Some scanners (npm audit, pip-audit) exit nonzero on findings; pass
-        `allowed_exits` to mark those as success."""
+        `allowed_exits` to mark those as success.
+
+        `cwd` is coerced to a directory. Auditing a single file is supported
+        — the CLI and several adapters carry `target if target.is_dir() else
+        target.parent` for exactly that — but every adapter passed the raw
+        target here, so `secure-code-agent path/to/one.py` died with
+        `NotADirectoryError` out of `subprocess.py` before any scanner ran.
+        Fixing it once here is better than asking fifteen adapters to
+        remember.
+        """
+        if cwd is not None and not cwd.is_dir():
+            cwd = cwd.parent
         env = self._sanitized_env()
         try:
             r = subprocess.run(

{secure_code_agent-0.6.0 → secure_code_agent-0.8.0}/src/secure_code_audit/scanners/checkov_scanner.py

@@ -24,7 +24,15 @@ from secure_code_audit.scanners.base import Scanner
 class CheckovScanner(Scanner):
     name = "checkov"
     binary = "checkov"
-    python_module = "checkov"
+    #: **No `python_module` fallback.** checkov ships no `__main__`, so
+    #: `python -m checkov` fails with "No module named checkov.__main__".
+    #: Declaring the fallback meant that with the package installed but the
+    #: console script off PATH, checkov resolved to a command that could
+    #: never run — reported as FAILED rather than the honest UNAVAILABLE.
+    #:
+    #: Caught by the test added alongside the identical semgrep defect,
+    #: running in CI where the full floor is installed. It passed locally
+    #: only because checkov was not installed on this machine.
     default_category = Category.CONFIG_IAC
     install_hint = "pip install 'secure-code-agent[python-scanners]'"
 

{secure_code_agent-0.6.0 → secure_code_agent-0.8.0}/src/secure_code_audit/scanners/semgrep_scanner.py

@@ -54,7 +54,20 @@ def _cwe_from_rule(rule: dict) -> str | None:
 class SemgrepScanner(Scanner):
     name = "semgrep"
     binary = "semgrep"
-    python_module = "semgrep"
+    #: **No `python_module` fallback.** Semgrep deprecated `python -m
+    #: semgrep` in 1.38.0: it now prints a notice, exits 0, and analyses
+    #: nothing. The fallback fires whenever the module is importable but the
+    #: binary is off PATH — which is the normal state after installing
+    #: njsscan, since that pulls semgrep in as a dependency.
+    #:
+    #: The outcome was FAILED rather than a silent COMPLETED, so coverage
+    #: caught it and no grade was claimed on an unrun scanner. But "semgrep
+    #: failed" is the wrong thing to tell an operator whose actual situation
+    #: is "semgrep is not on PATH", and it sent five of this project's own
+    #: tests from skipped to failing the moment njsscan was installed.
+    #:
+    #: bandit, njsscan, checkov and pip-audit all still run correctly under
+    #: `python -m`, so the mechanism stays; semgrep simply opts out.
     default_category = Category.CODE_VULNERABILITIES
     install_hint = "pip install 'secure-code-agent[python-scanners]'"
 

{secure_code_agent-0.6.0 → secure_code_agent-0.8.0}/src/secure_code_audit/scoring.py

@@ -551,6 +551,26 @@ class GateResult:
     passed: bool
     reasons: tuple[str, ...]  # human-readable trip reasons
     tripped: tuple[str, ...] = field(default_factory=tuple)
+    #: Gates that could actually have failed this run. Empty means no
+    #: policy was configured, which is **not** the same as passing one.
+    #:
+    #: `passed` stays True in that case — no gate tripped, which is
+    #: accurate — but reporting it as PASS is a claim nothing checked. A
+    #: 200,000-line repository carrying SQL injection, `shell=True`,
+    #: `pickle.loads` and `eval` printed "gate PASS" out of the box, with
+    #: no configuration, because an absent gate cannot trip. The work
+    #: order listed all seven findings correctly at the same time.
+    #:
+    #: `_require_configured_gates` already refuses `--fail-on-gate` in this
+    #: situation, calling it "a green build with no security floor". This
+    #: is the same fact, carried far enough to reach the summary line a
+    #: person actually reads.
+    configured: tuple[str, ...] = field(default_factory=tuple)
+
+    @property
+    def enforced(self) -> bool:
+        """Did any gate actually stand between these findings and a pass?"""
+        return bool(self.configured)
 
 
 # Every gate, with the predicate that decides whether it can actually trip.
@@ -611,6 +631,7 @@ def evaluate_gates(
         passed=not tripped,
         reasons=tuple(reasons),
         tripped=tuple(tripped),
+        configured=active_gates(gate_config),
     )
 
 

{secure_code_agent-0.6.0 → secure_code_agent-0.8.0}/src/secure_code_audit/standards.py

@@ -630,3 +630,19 @@ def owasp_for_cwe(canonical_cwe: str | None) -> str | None:
     if canonical_cwe is None:
         return None
     return _CWE_TO_OWASP.get(canonical_cwe)
+
+
+def categories_for_scanner(scanner: str) -> frozenset[Category]:
+    """Which categories this scanner has mapped rules for.
+
+    Used to work out what a run could have measured. Derived from the map
+    rather than written down a second time: the hand-maintained copy claimed
+    `builtin_rules` covered `secrets` and `config_iac`, which it never has —
+    its rules are Python and shell language primitives — and omitted
+    `supply_chain`, which it does cover. An IaC repository with a
+    `public-read` S3 bucket and an open security group therefore scored
+    `config_iac` 5.0 with no IaC scanner installed.
+    """
+    return frozenset(
+        entry.category for (name, _rule), entry in _MAP.items() if name == scanner.lower()
+    )