zairo 0.1.0__py3-none-any.whl

zairo/__init__.py

@@ -0,0 +1 @@
+__version__ = "0.1.0"

zairo/__main__.py

@@ -0,0 +1,4 @@
+from .cli import main
+
+if __name__ == "__main__":
+    main()

zairo/_util.py

@@ -0,0 +1,12 @@
+from typing import Any
+
+
+def display_name(name: Any, limit: int = 60) -> str:
+    """Collapses a node name to one short line for log display. Some graph
+    nodes (e.g. Trailmark misparsing a chained expression like
+    `.map(fn).filter(...)`) end up with a "name" that's actually a chunk of
+    raw multi-line source text -- printing that verbatim floods the log."""
+    text = " ".join(str(name).split())
+    if len(text) > limit:
+        text = text[:limit - 1] + "…"
+    return text

zairo/analyzer.py

@@ -0,0 +1,121 @@
+import os
+from typing import Callable, Dict, List, Optional, Set, Any
+from trailmark.query.api import QueryEngine
+from .git_utils import get_modified_lines
+from ._util import display_name as _display_name
+
+
+def analyze_impact(
+    repo_path: str,
+    depth: int = 1,
+    base: str = None,
+    target: str = None,
+    language: str = "auto",
+    log: Optional[Callable[[str], None]] = None,
+) -> Dict[str, Any]:
+    """
+    `repo_path` must already be checked out at the state to be indexed: the
+    caller is responsible for pointing it at a worktree checked out to
+    `target` when diffing two commits, so that node locations/contents line
+    up with the line numbers `git diff base target` reports.
+    """
+    log = log or (lambda msg: None)
+
+    analysis_root = os.path.abspath(repo_path)
+
+    modified_files_lines = get_modified_lines(analysis_root, base, target, log=log)
+    log(f"git diff found {len(modified_files_lines)} modified file(s):")
+    for f, lines in modified_files_lines.items():
+        log(f"  {f}: {len(lines)} line(s) changed -> {sorted(lines.keys())}")
+
+    # Initialize Trailmark
+    log(f"Indexing {analysis_root} with Trailmark (language={language})...")
+    engine = QueryEngine.from_directory(analysis_root, language=language)
+    total_nodes = len(engine._store._graph.nodes)
+    total_edges = len(engine._store._graph.edges)
+    log(f"Trailmark graph: {total_nodes} node(s), {total_edges} edge(s)")
+
+    # 1. Identify seed nodes (modified/added)
+    seed_nodes = set()
+    node_metadata = {}
+
+    for node_id, node in engine._store._graph.nodes.items():
+        node_metadata[node_id] = {
+            "id": node_id,
+            "name": getattr(node, 'name', node_id),
+            "kind": node.kind.value if hasattr(node, 'kind') and hasattr(node.kind, 'value') else str(getattr(node, 'kind', 'unknown')),
+            "file": node.location.file_path if getattr(node, 'location', None) else None,
+            "start_line": node.location.start_line if getattr(node, 'location', None) else None,
+            "end_line": node.location.end_line if getattr(node, 'location', None) else None,
+            "complexity": getattr(node, 'cyclomatic_complexity', 0),
+            "status": "unchanged" # default
+        }
+
+        if getattr(node, 'location', None) and node.location.file_path in modified_files_lines:
+            file_mod_lines = modified_files_lines[node.location.file_path]
+            start = node.location.start_line
+            end = node.location.end_line
+            changed_lines = {ln: text for ln, text in file_mod_lines.items() if start <= ln <= end}
+            if changed_lines:
+                seed_nodes.add(node_id)
+                node_metadata[node_id]["status"] = "modified"
+                node_metadata[node_id]["changed_lines"] = changed_lines
+                log(f"  seed: {_display_name(node_metadata[node_id]['name'])} ({node.location.file_path}:{start}-{end}), {len(changed_lines)} line(s) changed")
+
+    log(f"Identified {len(seed_nodes)} seed node(s)")
+
+    # 2. Traverse graph to build subgraph up to `depth`
+    subgraph_nodes = set(seed_nodes)
+    current_frontier = set(seed_nodes)
+
+    for hop in range(depth):
+        next_frontier = set()
+        for edge in engine._store._graph.edges:
+            source = edge.source_id
+            edge_target = edge.target_id
+
+            if source in current_frontier and edge_target not in subgraph_nodes:
+                next_frontier.add(edge_target)
+                subgraph_nodes.add(edge_target)
+            elif edge_target in current_frontier and source not in subgraph_nodes:
+                next_frontier.add(source)
+                subgraph_nodes.add(source)
+
+        log(f"Hop {hop + 1}/{depth}: added {len(next_frontier)} node(s), frontier now {len(subgraph_nodes)} total")
+        current_frontier = next_frontier
+
+    # Extract edges for subgraph
+    final_edges = []
+    for edge in engine._store._graph.edges:
+        if edge.source_id in subgraph_nodes and edge.target_id in subgraph_nodes:
+            final_edges.append({
+                "source": edge.source_id,
+                "target": edge.target_id,
+                "kind": edge.kind.value if hasattr(edge, 'kind') and hasattr(edge.kind, 'value') else str(getattr(edge, 'kind', 'unknown')),
+                "confidence": edge.confidence.value if hasattr(edge, 'confidence') and hasattr(edge.confidence, 'value') else "unknown"
+            })
+
+    nodes = []
+    for n_id in subgraph_nodes:
+        # An edge can reference a node id Trailmark's own graph has no entry
+        # for (a dangling/malformed reference -- seen from complex chained
+        # expressions like `.map(fn).filter(...)`). The fallback must carry
+        # the same fields as a normal node, or downstream code that assumes
+        # e.g. 'file' always exists (to read source for LLM context) crashes
+        # with a bare KeyError on this one bad node instead of just treating
+        # it as having no known location.
+        nodes.append(node_metadata.get(n_id, {
+            "id": n_id,
+            "name": n_id,
+            "kind": "unknown",
+            "file": None,
+            "start_line": None,
+            "end_line": None,
+            "complexity": 0,
+            "status": "unchanged",
+        }))
+
+    return {
+        "nodes": nodes,
+        "edges": final_edges
+    }

zairo/cli.py

@@ -0,0 +1,108 @@
+import os
+import typer
+from rich.console import Console
+from .analyzer import analyze_impact
+from .reporter import generate_reports
+from .llm_scanner import scan_graph_for_vulnerabilities
+from .git_utils import create_worktree, remove_worktree
+
+app = typer.Typer(add_completion=False)
+console = Console()
+
+@app.command()
+def analyze(
+    repo_path: str = typer.Argument(..., help="Path to the git repository"),
+    depth: int = typer.Option(1, "--depth", "-d", help="Depth of connections to traverse from changed nodes"),
+    output_dir: str = typer.Option("zairo_out", "--output", "-o", help="Output directory for reports"),
+    base: str = typer.Option(None, "--base", "-b", help="Base commit/ref to diff from (e.g. HEAD~3, main, a1b2c3d)"),
+    target: str = typer.Option(None, "--target", "-t", help="Target commit/ref to diff to (e.g. HEAD, feature-branch). Requires --base."),
+    language: str = typer.Option("auto", "--language", "-l", help="Language for Trailmark parsing (auto, python, typescript, rust, etc.)"),
+    llm: bool = typer.Option(False, "--llm", help="Run LLM vulnerability scanning on modified nodes"),
+    model: str = typer.Option("gemini/gemini-1.5-pro", "--model", help="LiteLLM model string to use for scanning"),
+    concurrency: int = typer.Option(5, "--concurrency", "-c", help="Number of LLM scan requests to run in parallel"),
+    cache: bool = typer.Option(True, "--cache/--no-cache", help="Cache LLM findings by content hash in <output>/.llm_cache.json to skip re-scanning unchanged nodes across runs"),
+    max_tokens: int = typer.Option(4096, "--max-tokens", help="Max output tokens per LLM scan request. Reasoning models count internal thinking against this budget too — too low can cause empty responses"),
+    tokens: bool = typer.Option(False, "--tokens", help="Show total LLM tokens used by the scan (prompt/completion/total, across real API calls -- cache hits don't count)"),
+    verbose: bool = typer.Option(False, "--verbose", "-v", help="Print detailed diagnostic output (git commands, worktree setup, node matching, per-node LLM scan progress)")
+):
+    def log(msg: str) -> None:
+        if verbose:
+            console.print(f"[dim]  · {msg}[/dim]")
+
+    if base and target:
+        console.print(f"[bold green]Analyzing {repo_path} at depth {depth} — diff {base}..{target}[/bold green]")
+    elif base:
+        console.print(f"[bold green]Analyzing {repo_path} at depth {depth} — diff {base}..working tree[/bold green]")
+    else:
+        console.print(f"[bold green]Analyzing {repo_path} at depth {depth} — uncommitted changes[/bold green]")
+    # When diffing two commits, all downstream steps (graph analysis AND the
+    # LLM scan, which re-reads source files from disk) need to see `target`'s
+    # tree — not whatever happens to be checked out in repo_path already.
+    # The worktree must stay alive until every step that reads files is done.
+    abs_repo = os.path.abspath(repo_path)
+    worktree_path = None
+    analysis_root = abs_repo
+    try:
+        if base and target:
+            log(f"Checking out '{target}' into a temporary worktree (base+target diff mode)...")
+            worktree_path = create_worktree(abs_repo, target)
+            analysis_root = worktree_path
+            log(f"Worktree ready at {worktree_path}")
+
+        graph_data = analyze_impact(analysis_root, depth, base, target, language, log=log)
+
+        num_modified = sum(1 for n in graph_data['nodes'] if n['status'] != 'unchanged')
+        console.print(f"[bold blue]Found {num_modified} modified/added nodes.[/bold blue]")
+        console.print(f"[bold blue]Total nodes in subgraph: {len(graph_data['nodes'])}[/bold blue]")
+        console.print(f"[bold blue]Total edges in subgraph: {len(graph_data['edges'])}[/bold blue]")
+
+        vulnerabilities = None
+        if llm:
+            console.print(f"[bold yellow]Running LLM scanner using {model} (concurrency={concurrency})...[/bold yellow]")
+            cache_path = os.path.join(output_dir, ".llm_cache.json") if cache else None
+            vulnerabilities, token_usage = scan_graph_for_vulnerabilities(
+                graph_data, model, log=log, concurrency=concurrency, cache_path=cache_path,
+                max_tokens=max_tokens,
+            )
+            console.print(f"[bold yellow]Found vulnerabilities in {len(vulnerabilities)} nodes.[/bold yellow]")
+
+            if tokens:
+                if token_usage['requests'] == 0:
+                    console.print("[dim]Token usage: no LLM requests were made (all results came from cache or were skipped).[/dim]")
+                elif token_usage['requests'] == token_usage['requests_without_usage']:
+                    console.print(
+                        f"[dim]Token usage: unavailable for all {token_usage['requests']} request(s) "
+                        f"(provider/backend did not report it).[/dim]"
+                    )
+                else:
+                    counted = token_usage['requests'] - token_usage['requests_without_usage']
+                    console.print(
+                        f"[bold magenta]Tokens used:[/bold magenta] "
+                        f"{token_usage['prompt_tokens']:,} prompt + {token_usage['completion_tokens']:,} completion "
+                        f"= {token_usage['total_tokens']:,} total across {counted} request(s)"
+                    )
+                    if token_usage['requests_without_usage']:
+                        console.print(
+                            f"[dim]  ({token_usage['requests_without_usage']} additional request(s) had no usage "
+                            f"data reported by the provider — not counted above)[/dim]"
+                        )
+
+        j_path, h_path = generate_reports(graph_data, output_dir, vulnerabilities)
+
+        console.print(f"[bold green]Success![/bold green] Reports generated:")
+        console.print(f"  - {j_path}")
+        console.print(f"  - {h_path}")
+
+    except Exception as e:
+        console.print(f"[bold red]Error:[/bold red] {e}")
+        raise typer.Exit(1)
+    finally:
+        if worktree_path:
+            log(f"Removing temporary worktree {worktree_path}")
+            remove_worktree(abs_repo, worktree_path)
+
+def main():
+    app()
+
+if __name__ == "__main__":
+    main()

zairo/git_utils.py

@@ -0,0 +1,131 @@
+import subprocess
+import re
+import os
+import tempfile
+from collections import defaultdict
+from typing import Dict, List, Optional
+
+
+def create_worktree(repo_path: str, ref: str) -> str:
+    """
+    Checks out `ref` into a new temporary git worktree and returns its path.
+
+    Used so that node locations/contents indexed by Trailmark line up with the
+    line numbers reported by `git diff base target` — those line numbers refer
+    to `target`'s tree, which may differ arbitrarily from whatever happens to
+    be checked out in the caller's working directory.
+    """
+    worktree_path = tempfile.mkdtemp(prefix="zairo-worktree-")
+    result = subprocess.run(
+        ["git", "worktree", "add", "--detach", "--force", worktree_path, ref],
+        cwd=repo_path,
+        capture_output=True,
+        text=True,
+    )
+    if result.returncode != 0:
+        raise RuntimeError(f"Failed to check out '{ref}' into a worktree: {result.stderr.strip()}")
+    return worktree_path
+
+
+def remove_worktree(repo_path: str, worktree_path: str) -> None:
+    subprocess.run(
+        ["git", "worktree", "remove", "--force", worktree_path],
+        cwd=repo_path,
+        capture_output=True,
+        text=True,
+    )
+
+def get_modified_lines(
+    repo_path: str,
+    base: str = None,
+    target: str = None,
+    log: Optional[callable] = None,
+) -> Dict[str, Dict[int, str]]:
+    """
+    Parses `git diff -U0` to find which lines have been added/modified.
+
+    - No base/target: compares working tree vs HEAD (uncommitted changes).
+    - base only:      compares working tree vs that commit.
+    - base + target:  compares two commits (e.g. HEAD~3..HEAD).
+
+    Returns a dict mapping absolute file paths to a dict of
+    {target line number: representative changed text}. The text is used to
+    cheaply filter out non-substantive changes (comments, blank lines)
+    before spending an LLM call on them, and to build a windowed view of
+    large functions instead of sending their full body.
+
+    A hunk with zero added lines (a pure deletion, e.g. `@@ -11 +10,0 @@`)
+    has no "+" line to anchor to in the target tree, but the enclosing node
+    still changed — a deleted validation check or sanitization call is
+    exactly the kind of change a security scan most needs to catch. Those
+    are recorded under a synthetic marker at the deletion's boundary line
+    in the target file, with the removed text as its value, so the
+    enclosing node is still found instead of silently skipped.
+    """
+    log = log or (lambda msg: None)
+
+    # Build the git diff command
+    cmd = ["git", "diff", "-U0"]
+    if base and target:
+        cmd += [base, target]
+    elif base:
+        cmd += [base]
+    log(f"Running: {' '.join(cmd)} (cwd={repo_path})")
+    result = subprocess.run(cmd, cwd=repo_path, capture_output=True, text=True)
+
+    if result.returncode != 0:
+        log(f"git diff failed (exit {result.returncode}): {result.stderr.strip()}")
+        return {}
+
+    diff_output = result.stdout
+
+    modified_lines = defaultdict(dict)
+    current_file = None
+    next_line_num = None
+    pending_deletion_line = None
+    pending_deletion_text = []
+
+    def flush_pending_deletion():
+        if current_file and pending_deletion_line is not None and pending_deletion_text:
+            modified_lines[current_file][pending_deletion_line] = "\n".join(pending_deletion_text)
+
+    for line in diff_output.splitlines():
+        if line.startswith("+++ "):
+            flush_pending_deletion()
+            pending_deletion_line, pending_deletion_text = None, []
+            if line.startswith("+++ b/"):
+                # New file path — resolve to absolute so it matches Trailmark's locations
+                rel_path = line[6:]
+                current_file = os.path.abspath(os.path.join(repo_path, rel_path))
+            else:
+                # "+++ /dev/null": the whole file was deleted in the target.
+                # There's no target-side file to attribute this hunk to, and
+                # without resetting this, a stale current_file from the
+                # PREVIOUS file section in the diff would silently absorb
+                # this file's content -- a genuine cross-file data leak.
+                current_file = None
+            next_line_num = None
+        elif line.startswith("@@ ") and current_file:
+            flush_pending_deletion()
+            pending_deletion_line, pending_deletion_text = None, []
+            # Parse the + part of the hunk header
+            match = re.search(r'\+([0-9]+)(?:,([0-9]+))?', line)
+            if match:
+                start_line = int(match.group(1))
+                count = match.group(2)
+                count = int(count) if count is not None else 1
+                if count > 0:
+                    next_line_num = start_line
+                else:
+                    next_line_num = None
+                    pending_deletion_line = max(1, start_line)
+        elif current_file and next_line_num is not None and line.startswith("+") and not line.startswith("+++"):
+            # With -U0 there are no context lines, so every "+" line after a
+            # hunk header maps to the next line number in the added range.
+            modified_lines[current_file][next_line_num] = line[1:]
+            next_line_num += 1
+        elif current_file and pending_deletion_line is not None and line.startswith("-") and not line.startswith("---"):
+            pending_deletion_text.append(line[1:])
+
+    flush_pending_deletion()
+    return dict(modified_lines)

zairo/llm_scanner.py

@@ -0,0 +1,507 @@
+import hashlib
+import json
+import os
+import re
+import threading
+from concurrent.futures import ThreadPoolExecutor, as_completed
+from functools import lru_cache
+from typing import Callable, Dict, List, Optional, Tuple, Any
+
+# `litellm` transitively imports the openai/anthropic SDKs and their full
+# Pydantic type trees (~3s). Import it lazily, only once actual scanning
+# happens, so `--help` and non-`--llm` runs don't pay that cost.
+litellm = None
+
+def _ensure_litellm():
+    global litellm
+    if litellm is None:
+        import litellm as _litellm
+        litellm = _litellm
+    return litellm
+
+from ._util import display_name as _display_name
+
+# Comment/blank-only diffs (docs, version bumps, log messages) can't produce a
+# real vulnerability finding — skip them before spending an LLM call.
+_COMMENT_PREFIXES = ("//", "#", "*", "/*", "<!--", "-->", "--", "'''", '"""')
+
+# Test files aren't part of the shipped attack surface. Scanning them tends
+# to produce either a duplicate of a finding already attached to the real
+# implementation they exercise, or a category error (treating mock/test
+# scaffolding as if it were exploitable production code) -- wasted LLM calls
+# for low-value output either way.
+_TEST_DIR_NAMES = {'test', 'tests', '__tests__', 'spec', 'specs'}
+_TEST_STEM_PREFIXES = ('test_', 'test-')
+_TEST_STEM_SUFFIXES = ('_test', '-test', '.test', '_spec', '-spec', '.spec')
+
+
+def _is_test_file(file_path: Optional[str]) -> bool:
+    if not file_path:
+        return False
+    parts = re.split(r'[/\\]', file_path)
+    if any(p.lower() in _TEST_DIR_NAMES for p in parts[:-1]):
+        return True
+    # Strip exactly one extension so "index.test.ts" -> "index.test" (still
+    # matches the ".test" suffix) without over-stripping "test_utils.py".
+    stem = re.sub(r'\.[a-zA-Z0-9]+$', '', parts[-1]).lower()
+    return stem.startswith(_TEST_STEM_PREFIXES) or stem.endswith(_TEST_STEM_SUFFIXES)
+
+# Functions larger than this get a windowed view around the changed lines
+# instead of their full body, so a one-line change in a 600-line function
+# doesn't cost 600 lines of prompt. Padding is generous on purpose: a tight
+# window can hide the guard clause or sanitization that makes a line safe,
+# which turns "efficient" into "wrong" for a security review specifically.
+_LARGE_FUNCTION_LINES = 100
+_WINDOW_PADDING = 20
+# Signature + early guard clauses are usually here — always include them
+# even when the diff itself is much further down the function.
+_GUARD_HEAD_LINES = 15
+
+# Neighbor (caller/callee) context is for orientation, not full audit — cap it.
+_NEIGHBOR_MAX_LINES = 30
+
+# Reasoning ("thinking") models count their internal reasoning tokens against
+# this same budget. Too low a cap can make the model exhaust it mid-thought
+# and return empty content before ever writing the JSON answer — so this
+# needs real headroom, not just enough for the expected output size.
+_DEFAULT_MAX_OUTPUT_TOKENS = 4096
+
+
+@lru_cache(maxsize=4096)
+def get_source_code(file_path: str, start_line: Optional[int], end_line: Optional[int]) -> str:
+    if not file_path or not os.path.exists(file_path):
+        return ""
+    try:
+        with open(file_path, 'r', encoding='utf-8') as f:
+            lines = f.readlines()
+
+        if start_line is None or end_line is None:
+            return "".join(lines)
+
+        start_idx = max(0, start_line - 1)
+        end_idx = min(len(lines), end_line)
+        return "".join(lines[start_idx:end_idx])
+    except Exception as e:
+        return f"// Error reading file: {e}"
+
+
+def _is_trivial_change(changed_lines: Optional[Dict[int, str]]) -> bool:
+    """True if every added/removed line is blank or a comment — not worth an
+    LLM call. A pure-deletion marker can bundle several removed lines into
+    one multi-line value, so check each physical line within it, not just
+    the value as a whole."""
+    if not changed_lines:
+        return False  # no diff info available; don't risk a false skip
+    for text in changed_lines.values():
+        for physical_line in (text.splitlines() or [text]):
+            stripped = physical_line.strip()
+            if not stripped:
+                continue
+            if stripped.startswith(_COMMENT_PREFIXES):
+                continue
+            return False
+    return True
+
+
+def _windowed_source(file_path: str, start_line: int, end_line: int, changed_lines: Dict[int, str]) -> str:
+    """Full body for small functions; a padded window around changed lines for
+    large ones, plus the function's head (signature + early guard clauses)
+    unconditionally — a check made there determines whether a flagged line
+    further down is actually reachable/dangerous."""
+    if (end_line - start_line + 1) <= _LARGE_FUNCTION_LINES or not changed_lines:
+        return get_source_code(file_path, start_line, end_line)
+
+    ranges = []
+
+    def add_range(lo, hi):
+        if ranges and lo <= ranges[-1][1] + 1:
+            ranges[-1] = (ranges[-1][0], max(ranges[-1][1], hi))
+        else:
+            ranges.append((lo, hi))
+
+    add_range(start_line, min(end_line, start_line + _GUARD_HEAD_LINES - 1))
+    for ln in sorted(changed_lines.keys()):
+        lo = max(start_line, ln - _WINDOW_PADDING)
+        hi = min(end_line, ln + _WINDOW_PADDING)
+        add_range(lo, hi)
+
+    chunks = [f"# lines {lo}-{hi}\n{get_source_code(file_path, lo, hi)}" for lo, hi in ranges]
+    return "\n...\n".join(chunks)
+
+
+def _sibling_outline(mod_node: Dict[str, Any], nodes: Dict[str, Dict[str, Any]]) -> str:
+    """For a module/file-level node, a windowed snippet alone loses all
+    orientation — the model can't tell what else the file contains. List the
+    other definitions in the same file (name + line range only, no bodies)
+    so it has that context without paying to send them in full."""
+    siblings = [
+        n for n in nodes.values()
+        if n.get('file') == mod_node.get('file')
+        and n['id'] != mod_node['id']
+        and n.get('kind') in ('function', 'class', 'method')
+    ]
+    if not siblings:
+        return ""
+    siblings.sort(key=lambda n: n.get('start_line') or 0)
+    lines = [f"- {n['name']} ({n.get('kind')}, lines {n.get('start_line')}-{n.get('end_line')})" for n in siblings]
+    return "Other definitions in this file (not shown in full):\n" + "\n".join(lines)
+
+
+def _collapse_nested_definitions(
+    file_path: str, start_line: int, end_line: int, nested: List[Dict[str, Any]]
+) -> str:
+    """For a module/file-level node, replace the body of each nested
+    top-level function/class with a one-line placeholder instead of sending
+    it in full. A nested definition that changed is already covered by its
+    own, more specific seed node — including its full body here too means
+    the same vulnerable line gets independently re-flagged under the
+    enclosing module as well: wasted cost, and a confusing/duplicate
+    attribution in the report (e.g. a vulnerability inside `parse` showing
+    up as "module X is vulnerable" instead of "parse is vulnerable")."""
+    if not nested:
+        return get_source_code(file_path, start_line, end_line)
+
+    skip_ranges = sorted(
+        (max(start_line, n['start_line']), min(end_line, n['end_line']), n['name'])
+        for n in nested
+        if n.get('start_line') is not None and n.get('end_line') is not None
+        and n['end_line'] >= start_line and n['start_line'] <= end_line
+    )
+
+    chunks = []
+    cursor = start_line
+    for lo, hi, name in skip_ranges:
+        if lo < cursor:
+            continue  # nested-within-nested overlap already covered by a prior placeholder
+        if lo > cursor:
+            chunks.append(get_source_code(file_path, cursor, lo - 1))
+        chunks.append(f"    # ... body of `{name}` NOT SHOWN (reviewed separately -- do not guess its contents) ...")
+        cursor = hi + 1
+
+    if cursor <= end_line:
+        chunks.append(get_source_code(file_path, cursor, end_line))
+
+    return "".join(chunks)
+
+
+def _neighbor_snippet(n: Dict[str, Any]) -> Optional[str]:
+    # .get() throughout: a neighbor can be a malformed/dangling graph node
+    # missing these fields entirely (see analyzer.py's subgraph-assembly
+    # fallback) -- treat it as having no known source rather than crashing.
+    code = get_source_code(n.get('file'), n.get('start_line'), n.get('end_line'))
+    if not code.strip():
+        return None
+    lines = code.splitlines()
+    if len(lines) > _NEIGHBOR_MAX_LINES:
+        truncated = len(lines) - _NEIGHBOR_MAX_LINES
+        code = "\n".join(lines[:_NEIGHBOR_MAX_LINES]) + f"\n... ({truncated} more line(s) truncated)"
+    return f"Function: {n.get('name', '?')}\n```\n{code}\n```"
+
+
+def _hash_prompt(model: str, mod_code: str, neighbor_contexts: List[str]) -> str:
+    h = hashlib.sha256()
+    h.update(model.encode('utf-8'))
+    h.update(b'\x00')
+    h.update(mod_code.encode('utf-8', errors='ignore'))
+    for c in sorted(neighbor_contexts):
+        h.update(b'\x00')
+        h.update(c.encode('utf-8', errors='ignore'))
+    return h.hexdigest()
+
+
+def _load_cache(cache_path: Optional[str]) -> Dict[str, List[Dict]]:
+    if not cache_path or not os.path.exists(cache_path):
+        return {}
+    try:
+        with open(cache_path, 'r') as f:
+            return json.load(f)
+    except Exception:
+        return {}
+
+
+def _save_cache(cache_path: Optional[str], cache: Dict[str, List[Dict]]) -> None:
+    if not cache_path:
+        return
+    try:
+        os.makedirs(os.path.dirname(cache_path) or ".", exist_ok=True)
+        with open(cache_path, 'w') as f:
+            json.dump(cache, f)
+    except Exception:
+        pass
+
+
+# Strips a leading/trailing code fence regardless of language tag
+# (```json, ```JSON, or bare ```), which is the only variant the old
+# literal-string `startswith("```json")` check handled.
+_FENCE_RE = re.compile(r'^\s*```[a-zA-Z]*\s*\n?|\n?\s*```\s*$')
+
+# Some models embed regex-like text (e.g. \w, \d) directly inside a JSON
+# string without escaping the backslash -- only \", \\, \/, \b, \f, \n, \r,
+# \t, \uXXXX are valid JSON escapes, so a raw \w is a hard parse error.
+# The first alternative below matches (and leaves untouched) any already-
+# valid escape as a single unit; the second only fires on a lone/invalid
+# backslash, so this is a no-op on already-valid JSON.
+_INVALID_ESCAPE_RE = re.compile(r'\\(["\\/bfnrtu])|\\')
+
+
+def _fix_invalid_escapes(s: str) -> str:
+    return _INVALID_ESCAPE_RE.sub(lambda m: m.group(0) if m.group(1) else '\\\\', s)
+
+
+_JSON_DECODER = json.JSONDecoder(strict=False)  # strict=False: tolerate raw
+# control characters (e.g. literal newlines) inside string values, which
+# some models emit instead of a proper \n escape.
+
+
+def _extract_json(content: str) -> dict:
+    """Parses the model's response, tolerating fence variants, stray prose,
+    trailing content after the JSON (some smaller/less-aligned models keep
+    generating after a complete answer — duplicate output, trailing
+    commentary — which plain json.loads() rejects outright as "Extra data"),
+    invalid backslash escapes from embedded regex-like text, and a bare
+    `[...]` findings array where a `{"vulnerabilities": [...]}` object was
+    asked for (normalized back into that shape here, at the parsing
+    boundary, so callers can always rely on a dict with a "vulnerabilities"
+    key). Uses JSONDecoder.raw_decode, which parses the first complete JSON
+    value and stops there instead of requiring the whole string to be one
+    value.
+    """
+    fixed = _fix_invalid_escapes(content)
+    stripped = _FENCE_RE.sub('', fixed).strip()
+
+    candidates = [stripped]
+    first_brace = fixed.find('{')
+    if first_brace != -1:
+        candidates.append(fixed[first_brace:].strip())
+
+    last_err = None
+    last_candidate = None
+    for candidate in candidates:
+        if not candidate:
+            continue
+        try:
+            obj, _ = _JSON_DECODER.raw_decode(candidate)
+            if isinstance(obj, list):
+                obj = {"vulnerabilities": obj}
+            return obj
+        except json.JSONDecodeError as e:
+            last_err, last_candidate = e, candidate
+
+    # Show the text around the actual failure point, not just the start of
+    # the response — a generic head-of-string preview doesn't help diagnose
+    # a structural error (e.g. a missing comma) that occurs deep in the doc.
+    if last_err is not None:
+        pos = last_err.pos
+        window = last_candidate[max(0, pos - 80):pos + 80]
+        raise ValueError(f"could not find valid JSON ({last_err}); near failure point: {window!r}")
+
+    raise ValueError(f"could not find valid JSON in model response: {content[:200]!r}")
+
+
+def _build_prompt(mod_node: Dict[str, Any], mod_code: str, neighbor_contexts: List[str]) -> str:
+    kind_label = mod_node.get('kind') or 'function'
+    return f"""
+You are an expert security auditor. Analyze the following modified {kind_label} for vulnerabilities.
+Modified {kind_label.capitalize()}: {mod_node['name']}
+```
+{mod_code}
+```
+Context Functions (Callers/Callees):
+{chr(10).join(neighbor_contexts)}
+
+Base every finding strictly on the code actually shown above. Do not speculate about the contents of omitted/NOT-SHOWN function bodies, imports, or third-party libraries based on their name alone — if you haven't seen the code, don't report a vulnerability in it.
+
+Return ONLY a JSON object with a single key 'vulnerabilities' — no markdown code fence, no prose before or after it. The value should be a list of objects containing 'title', 'description', and 'impact'. Keep each field to 1-2 sentences. If no vulnerabilities are found, return {{"vulnerabilities": []}}.
+"""
+
+
+def scan_graph_for_vulnerabilities(
+    graph_data: Dict[str, Any],
+    model: str,
+    log: Optional[Callable[[str], None]] = None,
+    concurrency: int = 5,
+    cache_path: Optional[str] = None,
+    max_tokens: int = _DEFAULT_MAX_OUTPUT_TOKENS,
+) -> Tuple[Dict[str, List[Dict]], Dict[str, int]]:
+    """Returns (vulnerabilities, token_usage). token_usage has
+    prompt_tokens/completion_tokens/total_tokens summed across every real
+    LLM call made (cache hits don't count -- they made no call), plus
+    requests/requests_without_usage so a caller can tell whether the token
+    totals are complete or partial (e.g. some providers don't report it)."""
+    log = log or (lambda msg: None)
+    log_lock = threading.Lock()
+
+    def safe_log(msg: str) -> None:
+        with log_lock:
+            log(msg)
+
+    vulnerabilities = {}
+    nodes = {n['id']: n for n in graph_data['nodes']}
+    edges = graph_data['edges']
+    cache = _load_cache(cache_path)
+
+    model_label = model
+
+    modified_nodes = [n for n in graph_data['nodes'] if n['status'] in ['modified', 'added']]
+    log(f"Scanning {len(modified_nodes)} modified/added node(s) with {model_label}")
+
+    # Build prompts up front (cheap, local) so trivial/cached nodes never
+    # touch the network, and only real work goes into the thread pool.
+    jobs = []
+    for mod_node in modified_nodes:
+        if mod_node.get('kind') == 'proxy':
+            # A proxy node represents an external/unresolved call target
+            # (e.g. `fs.unlinkSync`), shared across every call site to it in
+            # the whole codebase -- it isn't first-party source with a real
+            # body of its own. Scanning it pulls in ALL of its callers as
+            # "context" (anyone who calls fs.unlinkSync, anywhere), which
+            # leaks fully unrelated, unchanged functions from other files
+            # into the prompt and produces findings misattributed to code
+            # that was never touched by this diff.
+            log(f"  skip (proxy node, not first-party source): {_display_name(mod_node['name'])}")
+            continue
+        if _is_test_file(mod_node.get('file')):
+            log(f"  skip (test file, not shipped attack surface): {_display_name(mod_node['name'])} ({mod_node.get('file')})")
+            continue
+        changed_lines = mod_node.get('changed_lines')
+        # Trivial-skip only applies to module-level edits (e.g. a version
+        # bump, a standalone doc comment). Skipping a function-kind node
+        # because its own diff happens to be comment-only would also skip
+        # scanning whatever pre-existing vulnerable code the rest of that
+        # (possibly still-unfixed) function contains -- and small functions
+        # cost nothing extra to scan in full anyway, so there's no real
+        # savings being traded away by not skipping them.
+        if mod_node.get('kind') == 'module' and _is_trivial_change(changed_lines):
+            log(f"  skip (trivial diff): {_display_name(mod_node['name'])} ({mod_node.get('file')})")
+            continue
+
+        start, end = mod_node.get('start_line'), mod_node.get('end_line')
+        if mod_node.get('kind') == 'module' and start is not None and end is not None:
+            # A module/file node's own scan shouldn't re-send full bodies of
+            # nested functions/classes -- those are already covered by their
+            # own, more specific seed node when they change, and including
+            # them here too just duplicates cost and mis-attributes their
+            # findings to the enclosing module instead of the actual function.
+            nested = [
+                n for n in nodes.values()
+                if n.get('file') == mod_node['file']
+                and n['id'] != mod_node['id']
+                and n.get('kind') in ('function', 'class')
+                and n.get('start_line') is not None and n.get('end_line') is not None
+                and n['start_line'] >= start and n['end_line'] <= end
+            ]
+            mod_code = _collapse_nested_definitions(mod_node['file'], start, end, nested)
+        elif changed_lines and start is not None and end is not None:
+            mod_code = _windowed_source(mod_node['file'], start, end, changed_lines)
+        else:
+            mod_code = get_source_code(mod_node['file'], start, end)
+
+        if not mod_code.strip():
+            log(f"  skip (no source found): {_display_name(mod_node['name'])}")
+            continue
+
+        # A module/file-level node's window is a tiny slice of the whole
+        # file — without an outline of what else is there, the model has no
+        # idea whether the flagged line is actually reachable in isolation.
+        if mod_node.get('kind') == 'module':
+            outline = _sibling_outline(mod_node, nodes)
+            if outline:
+                mod_code = outline + "\n\n" + mod_code
+
+        # "contains" edges are structural nesting (module -> its functions),
+        # not a caller/callee relationship -- pulling a contained child's
+        # full body in here as "context" would (a) re-leak exactly the
+        # content the collapse step above just excluded from a module's own
+        # scan, reintroducing the duplicate-attribution bug, and (b) for a
+        # function node, pointlessly pull in its enclosing module's source
+        # under a "Callers/Callees" label where it doesn't belong.
+        neighbor_ids = set()
+        for e in edges:
+            if e.get('kind') == 'contains':
+                continue
+            if e['source'] == mod_node['id']:
+                neighbor_ids.add(e['target'])
+            elif e['target'] == mod_node['id']:
+                neighbor_ids.add(e['source'])
+
+        neighbor_contexts = []
+        for n_id in neighbor_ids:
+            if n_id in nodes and n_id != mod_node['id']:
+                snippet = _neighbor_snippet(nodes[n_id])
+                if snippet:
+                    neighbor_contexts.append(snippet)
+
+        prompt_hash = _hash_prompt(model_label, mod_code, neighbor_contexts)
+        cached = cache.get(prompt_hash)
+        if cached is not None:
+            log(f"  cache hit: {_display_name(mod_node['name'])} ({len(cached)} finding(s))")
+            if cached:
+                vulnerabilities[mod_node['id']] = cached
+            continue
+
+        jobs.append((mod_node, prompt_hash, _build_prompt(mod_node, mod_code, neighbor_contexts)))
+
+    def run_job(job):
+        mod_node, prompt_hash, prompt = job
+        usage = None  # unavailable if the provider doesn't report it
+        try:
+            response = litellm.completion(
+                model=model,
+                messages=[{"role": "user", "content": prompt}],
+                max_tokens=max_tokens,
+            )
+            choice = response.choices[0]
+            content = choice.message.content or ""
+            finish_reason = getattr(choice, 'finish_reason', 'unknown')
+            empty_note = (
+                f" (finish_reason={finish_reason}) — likely exhausted max_tokens={max_tokens} "
+                f"on internal reasoning before writing an answer; try --max-tokens with a higher value"
+            )
+            resp_usage = getattr(response, 'usage', None)
+            if resp_usage is not None:
+                usage = {
+                    'prompt_tokens': getattr(resp_usage, 'prompt_tokens', 0) or 0,
+                    'completion_tokens': getattr(resp_usage, 'completion_tokens', 0) or 0,
+                    'total_tokens': getattr(resp_usage, 'total_tokens', 0) or 0,
+                }
+
+            if not content.strip():
+                safe_log(f"  error scanning {_display_name(mod_node['name'])}: model returned empty content{empty_note}")
+                return mod_node['id'], prompt_hash, None, usage
+
+            try:
+                parsed = _extract_json(content)
+            except ValueError as e:
+                safe_log(f"  error scanning {_display_name(mod_node['name'])}: {e}")
+                return mod_node['id'], prompt_hash, None, usage
+
+            findings = parsed.get("vulnerabilities", [])
+            safe_log(f"  found {len(findings)} vulnerability finding(s): {_display_name(mod_node['name'])}")
+            return mod_node['id'], prompt_hash, findings, usage
+        except Exception as e:
+            safe_log(f"  error scanning {_display_name(mod_node['name'])}: {e}")
+            return mod_node['id'], prompt_hash, None, usage
+
+    token_usage = {'prompt_tokens': 0, 'completion_tokens': 0, 'total_tokens': 0, 'requests': 0, 'requests_without_usage': 0}
+
+    if jobs:
+        _ensure_litellm()  # deferred until there's actually a request to make
+        with ThreadPoolExecutor(max_workers=max(1, concurrency)) as pool:
+            futures = [pool.submit(run_job, job) for job in jobs]
+            for future in as_completed(futures):
+                node_id, prompt_hash, findings, usage = future.result()
+                token_usage['requests'] += 1
+                if usage:
+                    token_usage['prompt_tokens'] += usage['prompt_tokens']
+                    token_usage['completion_tokens'] += usage['completion_tokens']
+                    token_usage['total_tokens'] += usage['total_tokens']
+                else:
+                    token_usage['requests_without_usage'] += 1
+                if findings is None:
+                    continue  # request failed; don't cache a non-result
+                cache[prompt_hash] = findings
+                if findings:
+                    vulnerabilities[node_id] = findings
+
+    _save_cache(cache_path, cache)
+    return vulnerabilities, token_usage

zairo/reporter.py

@@ -0,0 +1,197 @@
+import json
+import os
+from jinja2 import Template
+
+HTML_TEMPLATE = """
+<!DOCTYPE html>
+<html>
+<head>
+    <title>Zairo Impact Analysis</title>
+    <script src="https://cdnjs.cloudflare.com/ajax/libs/cytoscape/3.28.1/cytoscape.min.js"></script>
+    <script src="https://cdnjs.cloudflare.com/ajax/libs/dagre/0.8.5/dagre.min.js"></script>
+    <script src="https://cdn.jsdelivr.net/npm/cytoscape-dagre@2.5.0/cytoscape-dagre.min.js"></script>
+    <style>
+        body { font-family: sans-serif; margin: 0; padding: 0; display: flex; height: 100vh; background-color: #1e1e1e; color: #fff;}
+        #cy { width: 80%; height: 100%; }
+        #sidebar { width: 20%; height: 100%; background: #252526; padding: 20px; box-sizing: border-box; overflow-y: auto; border-left: 1px solid #3c3c3c;}
+        h1 { font-size: 1.2em; border-bottom: 1px solid #3c3c3c; padding-bottom: 10px; }
+        .details { margin-top: 20px; font-size: 0.9em; }
+        .details strong { color: #4fc1ff; }
+        button { background: #0e639c; color: white; border: none; padding: 8px 12px; cursor: pointer; margin-bottom: 10px; width: 100%; }
+        button:hover { background: #1177bb; }
+        .legend { margin-top: 20px; font-size: 0.9em; border-top: 1px solid #3c3c3c; padding-top: 10px;}
+        .legend-item { display: flex; align-items: center; margin-bottom: 5px; }
+        .color-box { width: 15px; height: 15px; margin-right: 10px; }
+    </style>
+</head>
+<body>
+    <div id="cy"></div>
+    <div id="sidebar">
+        <h1>Zairo Impact</h1>
+        <button id="btn-dagre">Layout: Hierarchical</button>
+        <button id="btn-cose">Layout: Force-Directed</button>
+        <button id="btn-toggle">Toggle Unchanged Nodes</button>
+        
+        <div class="legend">
+            <div class="legend-item"><div class="color-box" style="background: #4CAF50;"></div> Added</div>
+            <div class="legend-item"><div class="color-box" style="background: #d7ba7d;"></div> Modified</div>
+            <div class="legend-item"><div class="color-box" style="background: #808080;"></div> Unchanged</div>
+        </div>
+
+        <div class="details" id="node-details">
+            <p>Click a node to see details.</p>
+        </div>
+    </div>
+
+    <script>
+        const graphData = {{ graph_json }};
+        
+        const elements = [];
+        graphData.nodes.forEach(n => {
+            let color = '#808080';
+            if (n.status === 'modified') color = '#d7ba7d';
+            if (n.status === 'added') color = '#4CAF50';
+            
+            // Add red border if vulnerable
+            let borderColor = n.vulnerabilities && n.vulnerabilities.length > 0 ? '#ff0000' : 'transparent';
+            let borderWidth = n.vulnerabilities && n.vulnerabilities.length > 0 ? 3 : 0;
+            
+            elements.push({
+                data: {
+                    id: n.id,
+                    name: n.name,
+                    kind: n.kind || 'unknown',
+                    file: n.file || 'unknown',
+                    status: n.status,
+                    start_line: n.start_line || '?',
+                    end_line: n.end_line || '?',
+                    color: color,
+                    borderColor: borderColor,
+                    borderWidth: borderWidth,
+                    vulnerabilities: n.vulnerabilities || []
+                }
+            });
+        });
+        
+        graphData.edges.forEach(e => {
+            elements.push({
+                data: {
+                    source: e.source,
+                    target: e.target,
+                    kind: e.kind
+                }
+            });
+        });
+
+        if (typeof cytoscapeDagre !== 'undefined') {
+            cytoscape.use( cytoscapeDagre );
+        }
+
+        const cy = cytoscape({
+            container: document.getElementById('cy'),
+            elements: elements,
+            style: [
+                {
+                    selector: 'node',
+                    style: {
+                        'background-color': 'data(color)',
+                        'border-width': 'data(borderWidth)',
+                        'border-color': 'data(borderColor)',
+                        'label': 'data(name)',
+                        'color': '#fff',
+                        'text-valign': 'center',
+                        'text-outline-width': 2,
+                        'text-outline-color': '#222',
+                        'font-size': '10px'
+                    }
+                },
+                {
+                    selector: 'edge',
+                    style: {
+                        'width': 2,
+                        'line-color': '#555',
+                        'target-arrow-color': '#555',
+                        'target-arrow-shape': 'triangle',
+                        'curve-style': 'bezier',
+                        'label': 'data(kind)',
+                        'font-size': '8px',
+                        'text-rotation': 'autorotate',
+                        'color': '#888'
+                    }
+                }
+            ],
+            layout: {
+                name: 'dagre'
+            }
+        });
+
+        cy.on('tap', 'node', function(evt){
+            const node = evt.target;
+            const d = node.data();
+            let vulnHtml = '';
+            if (d.vulnerabilities && d.vulnerabilities.length > 0) {
+                vulnHtml = '<h3 style="color:#ff4444; margin-top:10px;">Vulnerabilities Found:</h3>';
+                d.vulnerabilities.forEach(v => {
+                    vulnHtml += `
+                        <div style="background:#440000; padding:10px; margin-bottom:10px; border-left: 3px solid #ff0000;">
+                            <strong>${v.title}</strong> (Impact: ${v.impact})<br>
+                            <p style="margin-top:5px; margin-bottom:0;">${v.description}</p>
+                        </div>
+                    `;
+                });
+            }
+            
+            document.getElementById('node-details').innerHTML = `
+                <p><strong>Name:</strong> ${d.name}</p>
+                <p><strong>ID:</strong> ${d.id}</p>
+                <p><strong>Kind:</strong> ${d.kind}</p>
+                <p><strong>Status:</strong> ${d.status}</p>
+                <p><strong>File:</strong> ${d.file}</p>
+                <p><strong>Lines:</strong> ${d.start_line} - ${d.end_line}</p>
+                ${vulnHtml}
+            `;
+        });
+
+        document.getElementById('btn-dagre').addEventListener('click', () => {
+            cy.layout({ name: 'dagre' }).run();
+        });
+        document.getElementById('btn-cose').addEventListener('click', () => {
+            cy.layout({ name: 'cose' }).run();
+        });
+        
+        let showUnchanged = true;
+        document.getElementById('btn-toggle').addEventListener('click', () => {
+            showUnchanged = !showUnchanged;
+            if (showUnchanged) {
+                cy.nodes('[status = "unchanged"]').show();
+            } else {
+                cy.nodes('[status = "unchanged"]').hide();
+            }
+        });
+    </script>
+</body>
+</html>
+"""
+
+def generate_reports(graph_data: dict, output_dir: str, vulnerabilities: dict = None):
+    os.makedirs(output_dir, exist_ok=True)
+    
+    # Attach vulnerabilities to graph_data
+    if vulnerabilities:
+        for node in graph_data['nodes']:
+            if node['id'] in vulnerabilities:
+                node['vulnerabilities'] = vulnerabilities[node['id']]
+                
+    json_path = os.path.join(output_dir, "report.json")
+    html_path = os.path.join(output_dir, "report.html")
+    
+    with open(json_path, 'w') as f:
+        json.dump(graph_data, f, indent=2)
+        
+    template = Template(HTML_TEMPLATE)
+    html_content = template.render(graph_json=json.dumps(graph_data))
+    
+    with open(html_path, 'w') as f:
+        f.write(html_content)
+        
+    return json_path, html_path

zairo-0.1.0.dist-info/METADATA

@@ -0,0 +1,75 @@
+Metadata-Version: 2.4
+Name: zairo
+Version: 0.1.0
+Summary: Git-diff-aware security impact analysis: builds a dependency subgraph around changed code and optionally scans it for vulnerabilities with an LLM.
+Author-email: iamavu <imailavantika@gmail.com>
+License-Expression: MIT
+Project-URL: Repository, https://github.com/iamavu/zairo
+Classifier: Development Status :: 3 - Alpha
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Topic :: Security
+Classifier: Topic :: Software Development :: Quality Assurance
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: typer>=0.27
+Requires-Dist: rich>=15.0
+Requires-Dist: jinja2>=3.1
+Requires-Dist: litellm>=1.98
+Requires-Dist: trailmark>=0.5
+Provides-Extra: dev
+Requires-Dist: pytest>=8.0; extra == "dev"
+Requires-Dist: build>=1.0; extra == "dev"
+Dynamic: license-file
+
+# zairo
+
+Git-diff-aware security impact analysis. `zairo` diffs a repository, builds a
+dependency subgraph (via [Trailmark](https://pypi.org/project/trailmark/))
+around whatever changed, and can run an LLM vulnerability scan limited to
+just that changed code — instead of re-scanning the whole codebase on every
+change.
+
+Output is a `report.json` (raw graph data) and a self-contained
+`report.html` (interactive dependency graph viewer).
+
+## Install
+
+```bash
+pip install zairo
+```
+
+For local development:
+
+```bash
+python -m venv venv
+source venv/bin/activate
+pip install -e ".[dev]"
+```
+
+## Usage
+
+```bash
+# Analyze uncommitted changes in a repo
+zairo /path/to/repo
+
+# Diff two refs, traverse 2 hops out from changed nodes, run an LLM scan
+zairo /path/to/repo --base main --target HEAD --depth 2 --llm
+```
+
+Run `zairo --help` for the full option list.
+
+## Development
+
+```bash
+pytest
+```
+
+## License
+
+MIT — see [LICENSE](LICENSE).

zairo-0.1.0.dist-info/RECORD

@@ -0,0 +1,14 @@
+zairo/__init__.py,sha256=kUR5RAFc7HCeiqdlX36dZOHkUI5wI6V_43RpEcD8b-0,22
+zairo/__main__.py,sha256=MSmt_5Xg84uHqzTN38JwgseJK8rsJn_11A8WD99VtEo,61
+zairo/_util.py,sha256=4jrbBrP1SedaK5MvaDG7q7yHxZWR7Z7x6O3RX6Y87Bk,489
+zairo/analyzer.py,sha256=qLLz4jHaYcZUuklnUdrWgOzf7pFXPPhCv2b2jDHO2OE,5344
+zairo/cli.py,sha256=e9rALqWbtKsphPPk5Nc8Q1C_FRu12T6_R24W44lmUZc,6252
+zairo/git_utils.py,sha256=yYvnONGz_aHG1CIQtCfg7YnP-I1zeBBXzqu5B0foc90,5506
+zairo/llm_scanner.py,sha256=G81WvZoyFRbrgY1NloOPYqZ8EfperS60Sa1wUNmqVWo,23202
+zairo/reporter.py,sha256=JIcz3-kYfFN1Vpdk-e5AryR_DqD-5yd8Zxn-RNOvJQo,7850
+zairo-0.1.0.dist-info/licenses/LICENSE,sha256=zhDOLhY1QgM2tk7fM3gvJnuxto_KqXF3Rc_LcRUbJhQ,1075
+zairo-0.1.0.dist-info/METADATA,sha256=ZCItOt4b5CuaOuTNN-JMbzXh73_HABlGR87vU8cF3Mw,2038
+zairo-0.1.0.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
+zairo-0.1.0.dist-info/entry_points.txt,sha256=UhpZuE-UJ416sCicqcjKZRkEqSPM_l_-LxPrqi8j8KM,41
+zairo-0.1.0.dist-info/top_level.txt,sha256=d4m_5jscq13hd1lZWevJ9EV6irrAJ-XgS0VoEJIc3Ys,6
+zairo-0.1.0.dist-info/RECORD,,

zairo-0.1.0.dist-info/WHEEL

@@ -0,0 +1,5 @@
+Wheel-Version: 1.0
+Generator: setuptools (84.0.0)
+Root-Is-Purelib: true
+Tag: py3-none-any
+

zairo-0.1.0.dist-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+zairo = zairo.cli:main

zairo-0.1.0.dist-info/licenses/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Avantika (@iamavu)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

zairo-0.1.0.dist-info/top_level.txt

@@ -0,0 +1 @@
+zairo