universal-dev-security 1.0.0__py3-none-any.whl

universal_dev_security/scanners/semgrep.py

@@ -0,0 +1,130 @@
+"""Semgrep adapter: static code analysis (https://semgrep.dev)."""
+from __future__ import annotations
+
+import json
+import os
+from pathlib import Path
+from typing import Any
+
+from universal_dev_security.detector import has_source_code, recommended_semgrep_configs
+from universal_dev_security.findings import Category, Finding, Severity
+from universal_dev_security.projectfiles import ProjectInventory
+from universal_dev_security.redaction import redact
+from universal_dev_security.scanners.base import (
+    ScannerAdapter,
+    ScannerExecutionError,
+    ScanOptions,
+    relative_path,
+    run_tool,
+)
+
+# Semgrep rule severities. Current Semgrep rules may use CRITICAL/HIGH/MEDIUM/LOW
+# directly; legacy values are documented by Semgrep as ERROR=High,
+# WARNING=Medium, INFO=Low. Anything else stays unclassified.
+SEVERITY_MAP = {
+    "CRITICAL": Severity.CRITICAL,
+    "HIGH": Severity.HIGH,
+    "ERROR": Severity.HIGH,
+    "MEDIUM": Severity.MEDIUM,
+    "WARNING": Severity.MEDIUM,
+    "LOW": Severity.LOW,
+    "INFO": Severity.LOW,
+}
+
+
+def _strings(value: Any, limit: int = 10) -> list[str]:
+    if isinstance(value, str):
+        return [value]
+    if isinstance(value, list):
+        return [str(v) for v in value if isinstance(v, (str, int, float))][:limit]
+    return []
+
+
+def normalize(data: dict[str, Any], root: Path) -> list[Finding]:
+    results = data.get("results")
+    if not isinstance(results, list):
+        raise ScannerExecutionError("Semgrep output has an unexpected format.")
+    findings = []
+    for item in results:
+        if not isinstance(item, dict):
+            continue
+        extra = item.get("extra") if isinstance(item.get("extra"), dict) else {}
+        metadata = extra.get("metadata") if isinstance(extra.get("metadata"), dict) else {}
+        raw_severity = str(extra.get("severity") or "").upper()
+        severity = SEVERITY_MAP.get(raw_severity, Severity.UNCLASSIFIED)
+        start = item.get("start") if isinstance(item.get("start"), dict) else {}
+        end = item.get("end") if isinstance(item.get("end"), dict) else {}
+        rule_id = str(item.get("check_id") or "unknown")[:300]
+        cwe = ", ".join(_strings(metadata.get("cwe"), 3))
+        references = _strings(metadata.get("references")) + _strings(metadata.get("source"), 1)
+        message = redact(str(extra.get("message") or ""))[:800]  # messages can interpolate matched code
+        findings.append(Finding(
+            tool="semgrep",
+            category=Category.CODE,
+            rule_id=rule_id,
+            title=rule_id.rsplit(".", 1)[-1].replace("-", " ").capitalize()[:200],
+            message=message,
+            file=relative_path(item.get("path"), root),
+            start_line=start.get("line"),
+            end_line=end.get("line"),
+            severity=severity,
+            severity_source="scanner" if severity is not Severity.UNCLASSIFIED else "none",
+            scanner_severity=raw_severity or None,
+            references=references,
+            remediation=("Review the flagged code and apply the rule guidance" + (f" ({cwe})." if cwe else ".")),
+        ))
+    return findings
+
+
+class SemgrepAdapter(ScannerAdapter):
+    name = "semgrep"
+    display_name = "Semgrep"
+    category = Category.CODE
+    executable_names = ("semgrep",)
+    min_version = (1, 0, 0)
+    downloads_data = True
+    network_note = ("downloads rule packs from the Semgrep Registry when registry configs are used; "
+                    "UDS disables Semgrep metrics and does not upload source code.")
+    docs_url = "https://semgrep.dev/docs/getting-started/quickstart"
+    install_hints = {
+        "windows": "python -m pip install semgrep  (inside the UDS virtual environment)",
+        "macos": "brew install semgrep  or  python3 -m pip install semgrep",
+        "linux": "python3 -m pip install semgrep",
+    }
+
+    def applicable(self, inventory: ProjectInventory) -> tuple[bool, str]:
+        if has_source_code(inventory):
+            return True, "Source code files detected."
+        return False, "No source code files supported by Semgrep were found."
+
+    def configs(self, options: ScanOptions) -> list[str]:
+        configs = options.semgrep_configs or recommended_semgrep_configs(options.technologies)
+        # `--config auto` requires sending metrics to Semgrep; replace it with the default pack.
+        return [("p/default" if c.strip().lower() == "auto" else c.strip()) for c in configs if c.strip()][:20]
+
+    def build_command(self, executable: str, options: ScanOptions) -> list[str]:
+        command = [executable, "scan", "--json", "--metrics=off", "--disable-version-check", "--quiet",
+                   "--timeout", "30"]
+        for config in self.configs(options):
+            command += ["--config", config]
+        for excluded in options.excluded_dirs:
+            if excluded != ".git":
+                command += ["--exclude", excluded]
+        return command + ["."]
+
+    def execute(self, executable: str, version: str, target: Path, options: ScanOptions) -> list[Finding]:
+        env = {"SEMGREP_SEND_METRICS": "off", "SEMGREP_ENABLE_VERSION_CHECK": "0"}
+        if os.name == "nt":
+            env["PYTHONUTF8"] = "1"
+        completed = run_tool(self.build_command(executable, options), cwd=target,
+                             timeout=options.timeout_seconds, env_overrides=env)
+        # 0 = success, 1 = findings with --error. Everything else is a failure.
+        if completed.returncode not in (0, 1):
+            raise ScannerExecutionError(f"Semgrep exited with code {completed.returncode}; raw output was suppressed.")
+        try:
+            data = json.loads(completed.stdout or "")
+        except ValueError as exc:
+            raise ScannerExecutionError("Semgrep output could not be parsed; raw output was suppressed.") from exc
+        if not isinstance(data, dict):
+            raise ScannerExecutionError("Semgrep output has an unexpected format.")
+        return normalize(data, target)

universal_dev_security/scanners/trivy.py

@@ -0,0 +1,139 @@
+"""Trivy adapter: dependency vulnerabilities and misconfiguration (https://trivy.dev)."""
+from __future__ import annotations
+
+import json
+import tempfile
+from pathlib import Path
+from typing import Any
+
+from universal_dev_security.detector import has_dependency_manifests, has_iac
+from universal_dev_security.findings import Category, Finding, Severity
+from universal_dev_security.projectfiles import ProjectInventory
+from universal_dev_security.scanners.base import (
+    ScannerAdapter,
+    ScannerExecutionError,
+    ScanOptions,
+    relative_path,
+    run_tool,
+)
+
+# Trivy reports CRITICAL/HIGH/MEDIUM/LOW/UNKNOWN natively.
+SEVERITY_MAP = {
+    "CRITICAL": Severity.CRITICAL,
+    "HIGH": Severity.HIGH,
+    "MEDIUM": Severity.MEDIUM,
+    "LOW": Severity.LOW,
+}
+
+
+def _refs(item: dict[str, Any]) -> list[str]:
+    refs = []
+    if item.get("PrimaryURL"):
+        refs.append(str(item["PrimaryURL"]))
+    refs.extend(str(r) for r in (item.get("References") or [])[:5] if isinstance(r, str))
+    return refs
+
+
+def _severity(item: dict[str, Any]) -> tuple[Severity, str | None]:
+    raw = str(item.get("Severity") or "").upper()
+    return SEVERITY_MAP.get(raw, Severity.UNCLASSIFIED), raw or None
+
+
+def normalize(data: dict[str, Any], root: Path) -> list[Finding]:
+    results = data.get("Results")
+    if results is None:
+        return []
+    if not isinstance(results, list):
+        raise ScannerExecutionError("Trivy output has an unexpected format.")
+    findings: list[Finding] = []
+    for result in results:
+        if not isinstance(result, dict):
+            continue
+        target_file = relative_path(result.get("Target"), root)
+        for vuln in result.get("Vulnerabilities") or []:
+            if not isinstance(vuln, dict):
+                continue
+            severity, raw = _severity(vuln)
+            pkg = str(vuln.get("PkgName") or "unknown")[:200]
+            fixed = str(vuln.get("FixedVersion") or "")[:200] or None
+            findings.append(Finding(
+                tool="trivy", category=Category.DEPENDENCY,
+                rule_id=str(vuln.get("VulnerabilityID") or "unknown")[:100],
+                title=str(vuln.get("Title") or f"Known vulnerability in {pkg}")[:300],
+                message=str(vuln.get("Description") or "")[:800],
+                file=target_file, package=pkg,
+                installed_version=str(vuln.get("InstalledVersion") or "")[:100] or None,
+                fixed_version=fixed, severity=severity,
+                severity_source="scanner" if severity is not Severity.UNCLASSIFIED else "none",
+                scanner_severity=raw, references=_refs(vuln),
+                remediation=(f"Upgrade {pkg} to {fixed} or later, then run the test suite."
+                             if fixed else f"No fixed version is listed; assess exposure of {pkg}."),
+            ))
+        for misconf in result.get("Misconfigurations") or []:
+            if not isinstance(misconf, dict) or str(misconf.get("Status") or "FAIL").upper() == "PASS":
+                continue
+            severity, raw = _severity(misconf)
+            cause = misconf.get("CauseMetadata") if isinstance(misconf.get("CauseMetadata"), dict) else {}
+            findings.append(Finding(
+                tool="trivy", category=Category.CONFIGURATION,
+                rule_id=str(misconf.get("AVDID") or misconf.get("ID") or "unknown")[:100],
+                title=str(misconf.get("Title") or "Misconfiguration")[:300],
+                message=str(misconf.get("Message") or misconf.get("Description") or "")[:800],
+                file=target_file, start_line=cause.get("StartLine"), end_line=cause.get("EndLine"),
+                severity=severity,
+                severity_source="scanner" if severity is not Severity.UNCLASSIFIED else "none",
+                scanner_severity=raw, references=_refs(misconf),
+                remediation=str(misconf.get("Resolution") or "Apply the documented secure configuration.")[:500],
+            ))
+    return findings
+
+
+class TrivyAdapter(ScannerAdapter):
+    name = "trivy"
+    display_name = "Trivy"
+    category = Category.CONFIGURATION
+    executable_names = ("trivy",)
+    min_version = (0, 45, 0)
+    downloads_data = True
+    network_note = ("downloads its vulnerability database and misconfiguration checks; "
+                    "project files are analysed locally and are not uploaded.")
+    docs_url = "https://trivy.dev/latest/getting-started/installation/"
+    install_hints = {
+        "windows": "winget install --id AquaSecurity.Trivy -e",
+        "macos": "brew install trivy",
+        "linux": "Use the official repository or release from https://trivy.dev/latest/getting-started/installation/",
+    }
+
+    def applicable(self, inventory: ProjectInventory) -> tuple[bool, str]:
+        reasons = []
+        if has_dependency_manifests(inventory):
+            reasons.append("dependency manifests")
+        if has_iac(inventory):
+            reasons.append("container / infrastructure-as-code files")
+        if reasons:
+            return True, "Detected " + " and ".join(reasons) + "."
+        return False, "No dependency manifests or infrastructure-as-code files were found."
+
+    def build_command(self, executable: str, report: Path, options: ScanOptions) -> list[str]:
+        # Secret scanning is handled by Gitleaks; Trivy's secret output includes matched text.
+        command = [executable, "fs", "--quiet", "--format", "json", "--output", str(report),
+                   "--scanners", "vuln,misconfig", "--exit-code", "0"]
+        skip = [d for d in options.excluded_dirs if d != ".git"]
+        if skip:
+            command += ["--skip-dirs", ",".join(skip)]
+        return command + ["."]
+
+    def execute(self, executable: str, version: str, target: Path, options: ScanOptions) -> list[Finding]:
+        with tempfile.TemporaryDirectory(prefix="uds-trivy-") as temp_dir:
+            report = Path(temp_dir) / "trivy.json"
+            completed = run_tool(self.build_command(executable, report, options), cwd=target,
+                                 timeout=options.timeout_seconds)
+            if completed.returncode != 0:
+                raise ScannerExecutionError(f"Trivy exited with code {completed.returncode}; raw output was suppressed.")
+            try:
+                data = json.loads(report.read_text(encoding="utf-8") or "{}")
+            except (OSError, ValueError, UnicodeDecodeError) as exc:
+                raise ScannerExecutionError("Trivy report could not be parsed; raw output was suppressed.") from exc
+        if not isinstance(data, dict):
+            raise ScannerExecutionError("Trivy output has an unexpected format.")
+        return normalize(data, target)

universal_dev_security/testing.py

@@ -0,0 +1,100 @@
+"""Project test detection and execution (used by `uds test` and after fixes)."""
+from __future__ import annotations
+
+import json
+import os
+import shutil
+import subprocess
+import sys
+import time
+import tomllib
+from pathlib import Path
+from typing import Any
+
+from universal_dev_security.config import ProjectConfig
+from universal_dev_security.redaction import redact
+
+NPM_DEFAULT_TEST = 'echo "Error: no test specified" && exit 1'
+OUTPUT_TAIL = 6000
+
+
+def _project_python(root: Path) -> str:
+    for candidate in (root / ".venv" / "Scripts" / "python.exe", root / ".venv" / "bin" / "python",
+                      root / "venv" / "Scripts" / "python.exe", root / "venv" / "bin" / "python"):
+        if candidate.is_file():
+            return str(candidate)
+    return sys.executable
+
+
+def _uses_pytest(root: Path) -> bool:
+    if (root / "pytest.ini").is_file() or (root / "conftest.py").is_file():
+        return True
+    pyproject = root / "pyproject.toml"
+    if pyproject.is_file():
+        try:
+            data = tomllib.loads(pyproject.read_text(encoding="utf-8"))
+        except (OSError, tomllib.TOMLDecodeError, UnicodeDecodeError):
+            data = {}
+        if "pytest" in data.get("tool", {}):
+            return True
+    tests = root / "tests"
+    return tests.is_dir() and any(tests.glob("test_*.py"))
+
+
+def detect_test_command(root: Path, config: ProjectConfig | None = None) -> tuple[list[str] | None, str]:
+    """Return (command, explanation). Commands are argument lists; no shell is used."""
+    root = root.expanduser().resolve()
+    if config and config.test_command:
+        return list(config.test_command), "configured in .uds/config.toml"
+    if _uses_pytest(root):
+        return [_project_python(root), "-m", "pytest", "-q"], "pytest project detected"
+    package = root / "package.json"
+    if package.is_file():
+        try:
+            scripts = json.loads(package.read_text(encoding="utf-8")).get("scripts", {})
+        except (OSError, ValueError, AttributeError):
+            scripts = {}
+        if isinstance(scripts, dict) and scripts.get("test") and scripts["test"].strip() != NPM_DEFAULT_TEST:
+            return ["npm", "test", "--silent"], "package.json test script"
+    if any(root.glob("*.sln")) or any(root.glob("*.csproj")):
+        return ["dotnet", "test"], ".NET solution/project"
+    if (root / "pom.xml").is_file():
+        return ["mvn", "-q", "test"], "Maven project"
+    if (root / "gradlew").is_file() or (root / "gradlew.bat").is_file():
+        return [str(root / ("gradlew.bat" if os.name == "nt" else "gradlew")), "test"], "Gradle wrapper"
+    if (root / "go.mod").is_file():
+        return ["go", "test", "./..."], "Go module"
+    if (root / "Cargo.toml").is_file():
+        return ["cargo", "test"], "Cargo project"
+    if (root / "vendor" / "bin" / "phpunit").is_file():
+        return [str(root / "vendor" / "bin" / "phpunit")], "PHPUnit"
+    return None, "No test suite detected. Configure [testing] command in .uds/config.toml."
+
+
+def run_tests(root: Path, config: ProjectConfig | None = None, timeout: int | None = None) -> dict[str, Any]:
+    root = root.expanduser().resolve()
+    command, why = detect_test_command(root, config)
+    if not command:
+        return {"status": "not_configured", "passed": None, "command": None, "message": why}
+    executable = command[0]
+    resolved = executable if Path(executable).is_file() else shutil.which(executable)
+    if not resolved:
+        return {"status": "error", "passed": False, "command": command, "message": f"{executable!r} was not found on PATH."}
+    started = time.monotonic()
+    try:
+        # The command is the project's own, fixed test runner (no user-supplied arguments are
+        # interpolated), so running Windows .cmd shims such as npm.cmd is acceptable here.
+        completed = subprocess.run(  # noqa: S603
+            [resolved, *command[1:]], cwd=str(root), stdin=subprocess.DEVNULL, capture_output=True, text=True,
+            encoding="utf-8", errors="replace", timeout=timeout or (config.test_timeout_seconds if config else 900),
+            check=False, shell=False,
+        )
+    except subprocess.TimeoutExpired:
+        return {"status": "timeout", "passed": False, "command": command, "message": "Test run timed out."}
+    except OSError as exc:
+        return {"status": "error", "passed": False, "command": command, "message": f"Could not start tests: {type(exc).__name__}"}
+    output = redact((completed.stdout or "") + (completed.stderr or ""))[-OUTPUT_TAIL:]
+    passed = completed.returncode == 0
+    return {"status": "passed" if passed else "failed", "passed": passed, "command": command, "reason": why,
+            "exit_code": completed.returncode, "duration_seconds": round(time.monotonic() - started, 2),
+            "output_tail": output}

universal_dev_security/updates.py

@@ -0,0 +1,84 @@
+"""Update checks for UDS and its scanners.
+
+UDS never updates itself or installs scanners. ``check_uds_update`` contacts a
+network source only when one is given explicitly, sends nothing but an HTTPS
+GET request, and only reports what is available.
+"""
+from __future__ import annotations
+
+import json
+import re
+import urllib.error
+import urllib.request
+from typing import Any
+
+from universal_dev_security import __version__
+from universal_dev_security.scanners import available_scanners, get_scanner
+from universal_dev_security.scanners.base import parse_version
+
+PYPI_PROJECT = "universal-dev-security"
+_REPO_RE = re.compile(r"^[A-Za-z0-9-]{1,39}/[A-Za-z0-9._-]{1,100}$")
+MAX_RESPONSE = 2 * 1024 * 1024
+
+
+class _HttpsOnlyRedirects(urllib.request.HTTPRedirectHandler):
+    def redirect_request(self, req, fp, code, msg, headers, newurl):  # type: ignore[no-untyped-def]
+        if not str(newurl).startswith("https://"):
+            raise urllib.error.URLError("Refusing a redirect to a non-HTTPS URL")
+        return super().redirect_request(req, fp, code, msg, headers, newurl)
+
+
+def _fetch_json(url: str, timeout: int = 15) -> Any:
+    if not url.startswith("https://"):
+        raise ValueError("Only HTTPS update sources are allowed")
+    request = urllib.request.Request(url, headers={"User-Agent": f"uds-update-check/{__version__}",
+                                                   "Accept": "application/json"})
+    opener = urllib.request.build_opener(_HttpsOnlyRedirects())
+    with opener.open(request, timeout=timeout) as response:  # https enforced, including redirects
+        return json.loads(response.read(MAX_RESPONSE).decode("utf-8"))
+
+
+def _version_tuple(text: str) -> tuple[int, ...]:
+    """Release-ordering key. Pre-releases (rc/a/b) sort before the final release."""
+    parsed = parse_version(text) or (0, 0, 0)
+    pre = 0 if re.search(r"\d[.-]?(?:rc|a|b|alpha|beta|dev)\d*$", text.strip().lower()) else 1
+    return (*parsed, pre)
+
+
+def check_uds_update(source: str | None, fetch=_fetch_json) -> dict[str, Any]:
+    if not source:
+        return {"status": "source_not_configured", "current": __version__,
+                "message": "No update source given. Use --source pypi or --source github:OWNER/REPO. "
+                           "UDS does not contact the network unless you ask it to."}
+    try:
+        if source == "pypi":
+            data = fetch(f"https://pypi.org/pypi/{PYPI_PROJECT}/json")
+            latest = str(data["info"]["version"])
+            url = f"https://pypi.org/project/{PYPI_PROJECT}/"
+        elif source.startswith("github:"):
+            repo = source.split(":", 1)[1]
+            if not _REPO_RE.match(repo):
+                raise ValueError("Invalid GitHub repository; expected OWNER/REPO")
+            data = fetch(f"https://api.github.com/repos/{repo}/releases/latest")
+            latest = str(data["tag_name"]).lstrip("v")
+            url = str(data.get("html_url") or f"https://github.com/{repo}/releases")
+        else:
+            raise ValueError("Unknown source; use 'pypi' or 'github:OWNER/REPO'")
+    except (urllib.error.URLError, TimeoutError, OSError) as exc:
+        return {"status": "error", "current": __version__, "message": f"Update check failed: {type(exc).__name__}"}
+    except (KeyError, TypeError, ValueError) as exc:
+        return {"status": "error", "current": __version__, "message": f"Update check failed: {exc}"}
+    newer = _version_tuple(latest) > _version_tuple(__version__)
+    return {"status": "update_available" if newer else "up_to_date", "current": __version__, "latest": latest,
+            "url": url, "message": ("A newer version is available. Review the changelog, then upgrade with "
+                                    "`python -m pip install --upgrade <verified package>` and run `uds doctor`.")
+            if newer else "UDS is up to date."}
+
+
+def scanner_status() -> list[dict[str, Any]]:
+    rows = []
+    for name in available_scanners():
+        info = get_scanner(name).info()
+        rows.append({k: info[k] for k in ("name", "installed", "version", "minimum_version", "compatible",
+                                          "docs_url", "install_hints")})
+    return rows

universal_dev_security-1.0.0.dist-info/METADATA

@@ -0,0 +1,128 @@
+Metadata-Version: 2.4
+Name: universal-dev-security
+Version: 1.0.0
+Summary: One security system for every project: secrets, code, dependency and configuration scanning with a central policy engine, Git and AI-agent guards, and a local security dashboard.
+License-Expression: Apache-2.0
+Project-URL: Homepage, https://github.com/jet1x/Universal-Dev-Security
+Project-URL: Repository, https://github.com/jet1x/Universal-Dev-Security.git
+Project-URL: Issues, https://github.com/jet1x/Universal-Dev-Security/issues
+Project-URL: Changelog, https://github.com/jet1x/Universal-Dev-Security/blob/main/CHANGELOG.md
+Project-URL: Security, https://github.com/jet1x/Universal-Dev-Security/blob/main/SECURITY.md
+Keywords: security,devsecops,gitleaks,semgrep,osv-scanner,trivy,sast,sca,claude-code,secrets
+Classifier: Development Status :: 5 - Production/Stable
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: Operating System :: Microsoft :: Windows
+Classifier: Operating System :: POSIX :: Linux
+Classifier: Operating System :: MacOS
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3 :: Only
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Classifier: Topic :: Security
+Classifier: Topic :: Software Development :: Quality Assurance
+Requires-Python: >=3.11
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Provides-Extra: dev
+Requires-Dist: pytest>=8.0; extra == "dev"
+Dynamic: license-file
+
+# Universal Dev Security (UDS)
+
+**One Security System. Every Project.**
+
+UDS is an open-source, local-first security toolkit for developers. It runs
+industry-standard scanners on any project, normalizes their results into one
+schema, enforces a central security policy for Git and AI coding agents, and
+produces a dark, self-contained HTML security dashboard.
+
+> **Status:** `1.0.0` — first stable release. See
+> [DEVELOPMENT_STATUS.md](DEVELOPMENT_STATUS.md) for verified functionality,
+> known issues and test results. UDS reports what its scanners find; a clean
+> result is never proof that a project is secure.
+
+## What it does
+
+| Area | Capability |
+|---|---|
+| Secrets | [Gitleaks](https://github.com/gitleaks/gitleaks) directory, staged and outgoing-commit scanning (values always redacted) |
+| Code | [Semgrep](https://semgrep.dev) static analysis with technology-based rule packs (metrics disabled) |
+| Dependencies | [OSV-Scanner](https://google.github.io/osv-scanner/) and [Trivy](https://trivy.dev) vulnerability scanning |
+| Configuration | Trivy misconfiguration scanning (Dockerfile, Kubernetes, Terraform, …) |
+| Policy | Central engine: approval for `git push`, denial of hook bypasses and secret writes, project rules can only add restrictions |
+| Git | `pre-commit` / `pre-push` hooks that block secrets (fail closed) |
+| AI agents | Claude Code `PreToolUse` hooks; generic `uds guard` JSON protocol for any agent |
+| GitHub | Generated PR workflow with checksum-verified scanners and SARIF upload |
+| Reports | JSON, SARIF 2.1.0 and an offline dark HTML dashboard with filters, history and scan comparison |
+| Recovery | Checkpoints before every UDS change; rollback that never clobbers later user edits |
+| Fixes | Low-risk, reversible fixes verified by your test suite, rolled back automatically if tests fail |
+
+Scanner states are explicit — `clean`, `findings`, `not_installed`,
+`not_applicable`, `skipped`, `error` — and the overall status becomes
+`incomplete` when an applicable scanner did not run. Severity is shown only
+when the scanner supplies it or a published scale (CVSS) defines it; everything
+else is `unclassified`. No security score is invented.
+
+## Quick start
+
+Requirements: Python 3.11+, Windows, Linux or macOS. Git is recommended.
+
+```powershell
+# Windows (from a release folder containing the wheel and SHA256SUMS)
+.\scripts\install.ps1 -Wheel .\dist\1.0.0\universal_dev_security-1.0.0-py3-none-any.whl
+```
+
+```bash
+# Linux / macOS
+sh scripts/install.sh --wheel dist/1.0.0/universal_dev_security-1.0.0-py3-none-any.whl
+```
+
+Then, inside a project:
+
+```bash
+uds doctor                 # runtime, config and scanner availability (+ official install sources)
+uds init                   # create .uds/config.toml (never overwrites)
+uds scan                   # run applicable scanners, write JSON + HTML reports, record history
+uds dashboard --open       # open the dark HTML dashboard
+uds hooks install --apply  # block secrets at commit and push time
+uds integrate claude-code --apply   # enforce the UDS policy inside Claude Code
+```
+
+Every command that changes files is a **dry run by default** and shows a diff;
+`--apply` creates a recovery checkpoint first. See [docs/installation.md](docs/installation.md)
+for scanner installation and upgrades, and [docs/commands.md](docs/commands.md) for all commands.
+
+## Documentation
+
+- [Installation and upgrades](docs/installation.md)
+- [Commands](docs/commands.md)
+- [Scanners, severity and privacy](docs/scanners.md)
+- [Integrations: Claude Code, GitHub, VS Code, other agents](docs/integrations.md)
+- [Architecture](docs/architecture.md)
+- [Security model](docs/security-model.md) and [global policy](policies/GLOBAL_SECURITY_POLICY.md)
+- [Dashboard design system](docs/dashboard-design-system.md)
+- [Release process](docs/release.md)
+
+## Safety guarantees
+
+- No telemetry. The core never contacts the network; scanners' network use is documented and
+  OSV-Scanner (which sends package names/versions to osv.dev) runs only with explicit approval.
+- UDS never installs scanners, never commits, never pushes and never publishes.
+- Existing configuration is merged, never silently overwritten; invalid files are left untouched.
+- Secret values, matched text and raw scanner output never appear in output, reports or history.
+- Global policies cannot be weakened by project configuration or AI tools.
+
+Local Git hooks and AI-agent hooks are defense in depth — keep CI scanning and
+repository-level protections (for example GitHub push protection) enabled too.
+
+## Contributing and security
+
+See [CONTRIBUTING.md](CONTRIBUTING.md) and [SECURITY.md](SECURITY.md).
+Changes are listed in [CHANGELOG.md](CHANGELOG.md).
+
+## License
+
+Apache License 2.0. See [LICENSE](LICENSE).

universal_dev_security-1.0.0.dist-info/RECORD

@@ -0,0 +1,37 @@
+universal_dev_security/__init__.py,sha256=b5Kl-jI1dq6h4flmJzGOz-7yvG4HNBmMvsRdoJLlp3I,101
+universal_dev_security/__main__.py,sha256=RQ8MzzL5ITUXhnOLEODb1QGzdvgXiiXcv05Dn5G7FSk,120
+universal_dev_security/cli.py,sha256=xCYUtrLp8fH-de6WurD0h8V8gxlNyk2kz_byes_rrtc,17011
+universal_dev_security/cli_extra.py,sha256=XpuMUkjNlS0UQNVCwIiVBBddCTh-3q6x6p6kvlz6mQY,10871
+universal_dev_security/config.py,sha256=vqwKZKKR_we4oohjfZMHwgP0W4dtSYZoH0POCYwo8TU,7992
+universal_dev_security/detector.py,sha256=KnBbTJFX2uthr0d8dl-wepckvTk7K-njNwBzZgIGpwo,10103
+universal_dev_security/engine.py,sha256=Dz5UJjxmoZh_SEEjWkNjQcAeUjdpcoUrnWvta4UYWv4,8973
+universal_dev_security/findings.py,sha256=8-RrA0U8p0j40ZCxOutlunoPLmCl2auayiDshH5zQfI,6736
+universal_dev_security/fixes.py,sha256=ha1_NmteDt3kNOtg9CUwcuPY3gsTyajX6tG2ugzzpJA,6214
+universal_dev_security/gitguard.py,sha256=2kuQBQ5rqpCqfNTs7KxBAxDKPToRmOSlUBOPYe6taDI,11263
+universal_dev_security/history.py,sha256=QkPHIMY9dP-bcnuVscIhp2dvVj12Hm6QNgEYtQPIJT4,6084
+universal_dev_security/initializer.py,sha256=npH_3USo2jhkfWMO65XDWPYZsW0-CKLVoj6-MEh_YsY,4259
+universal_dev_security/policy.py,sha256=9ItX9ANR6vT4o5C8edorjz4TbsQhiQWco-4MqfRrDWE,20018
+universal_dev_security/projectfiles.py,sha256=WYrg5coVY6y3ZaDTa0PxwGcIiS-Toal4kejhA3nUIYc,2983
+universal_dev_security/recovery.py,sha256=C-O2_xNfZoTTrWFnA_7bDiWiXaETyCHuh3c7xlwPmAc,7234
+universal_dev_security/redaction.py,sha256=TkwrwM7YQF2PGJ7N6PcWXzx2cQTg6hLA-ylz7NLJ6wg,5595
+universal_dev_security/reports.py,sha256=-H38BMyaLTK9VY-wh5hjUKgeMtmB4gATt6MMqINZG-Y,31640
+universal_dev_security/scanner.py,sha256=IbasoQc49eIjKgS1SSiNrgPcbWUXbNgpgGGM5Tf2UV0,1308
+universal_dev_security/testing.py,sha256=dWeCEhgkqODzHmE0eCRBXWgA2xi24MP8mMkARaF0C_g,4804
+universal_dev_security/updates.py,sha256=UqRWAl4Km8XNxnnXKxa2a-LH-cuqfQKc6KB5lRbBkUg,4190
+universal_dev_security/integrations/__init__.py,sha256=cp0s3KYhIpk5w7bYmGaW8ZPp61aneBivGEDGbwZrcDY,2013
+universal_dev_security/integrations/agents.py,sha256=bCom-QgbACFT-PEErxb1VCzQc2D5EvGlRB4mVnQoVTs,1869
+universal_dev_security/integrations/claude_code.py,sha256=-0hPYrayogCTRdtYw1g71EudrpxViW_9iexS4f4_ipA,9369
+universal_dev_security/integrations/github.py,sha256=3kHUqF5-smbSgwE4UyoeLSGAujUB09qFVJCbRNyN-IQ,6500
+universal_dev_security/integrations/vscode.py,sha256=JAreeGLGglQg7J1MdpMpH--KGDji1t4W-92nA55Ycb8,2076
+universal_dev_security/scanners/__init__.py,sha256=DYc2eNyhj3g-8zebajxc7sbOgVHzGfc_e8moJYlsDDI,1268
+universal_dev_security/scanners/base.py,sha256=Zms8fwESZEOJueLDrm648TexcFQcUI1mBzEwyP9Z4Lo,11186
+universal_dev_security/scanners/gitleaks.py,sha256=WYMiGy4hO3exQF5YbdE76vTTyVqgSPXPg-hz42Noynw,6211
+universal_dev_security/scanners/osv.py,sha256=WbDzC4Z73PwmElNaeLs2hZxGDFnPMnP3gkHkjEazp78,7852
+universal_dev_security/scanners/semgrep.py,sha256=PpSxUe8dz222EK3mCzUR8zBTbjL8QHJ_-Y2DTB4Ca_A,5959
+universal_dev_security/scanners/trivy.py,sha256=ii4dMDiuw2v6taw90Gr1aOZb_T-iwMInIadwkWoiqg0,6685
+universal_dev_security-1.0.0.dist-info/licenses/LICENSE,sha256=ReLrsC1BngysN-NSvsmNb5WaZ_1UOweZEZne3VkEzFY,9156
+universal_dev_security-1.0.0.dist-info/METADATA,sha256=383DW1f9ULS0X1W0WGH_y5XGYowNbrIUgwu-_N43hjs,6531
+universal_dev_security-1.0.0.dist-info/WHEEL,sha256=mOdXR9C3wMVov7cSY8PY-XCzo3SmmWCHvGQr5csJoao,91
+universal_dev_security-1.0.0.dist-info/entry_points.txt,sha256=3KgyciEul9-L9tn_V8fAIf7R8qtJdbyg77ApiwO2iVs,56
+universal_dev_security-1.0.0.dist-info/top_level.txt,sha256=FOgKdp-7KYU_0VL00cer496y6qMWuSSy3b8RjzFyv3Y,23
+universal_dev_security-1.0.0.dist-info/RECORD,,

universal_dev_security-1.0.0.dist-info/WHEEL

@@ -0,0 +1,5 @@
+Wheel-Version: 1.0
+Generator: setuptools (84.2.1)
+Root-Is-Purelib: true
+Tag: py3-none-any
+

universal_dev_security-1.0.0.dist-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+uds = universal_dev_security.cli:main