Metadata-Version: 2.4
Name: cyberjury
Version: 0.2.0
Summary: AI-assisted security review for code diffs and repositories.
Author: eth4nr00t
License-Expression: Apache-2.0
Project-URL: Homepage, https://github.com/eth4nr00t/cyberjury
Project-URL: Repository, https://github.com/eth4nr00t/cyberjury
Project-URL: Changelog, https://github.com/eth4nr00t/cyberjury/releases
Keywords: appsec,security,code review,llm
Classifier: Intended Audience :: Developers
Classifier: Topic :: Security
Classifier: Topic :: Software Development :: Quality Assurance
Classifier: Programming Language :: Python :: 3.12
Classifier: Programming Language :: Python :: 3.13
Classifier: Programming Language :: Python :: 3.14
Classifier: Operating System :: OS Independent
Requires-Python: >=3.12
Description-Content-Type: text/markdown
License-File: LICENSE
Requires-Dist: pyyaml>=6.0
Requires-Dist: anthropic>=0.40
Requires-Dist: openai>=1.0
Requires-Dist: python-dotenv<2,>=1.0
Requires-Dist: tree-sitter>=0.25
Requires-Dist: tree-sitter-python>=0.23
Requires-Dist: tree-sitter-javascript>=0.23
Requires-Dist: tree-sitter-typescript>=0.23
Requires-Dist: tree-sitter-go>=0.23
Provides-Extra: dev
Requires-Dist: pytest>=8.0; extra == "dev"
Requires-Dist: ruff>=0.16; extra == "dev"
Requires-Dist: pre-commit>=3.5; extra == "dev"
Requires-Dist: jsonschema>=4.0; extra == "dev"
Dynamic: license-file

# Cyberjury

AI-assisted security review for code diffs and repositories.

The tool has two review paths:

- **Diff Review** audits a git range against its repository in one command.
- **Repository Review** fans out across a repository, reviews focused units, and deduplicates
  candidates.

Diff Review is fast and reports findings at post change lines shown in the patch. Every finding keeps
an exact old or new change anchor, so added behavior and removed controls use one scope contract. Each
diff unit is grounded with repository source context while its reportable boundary remains the patch.
Repository Review covers the complete repository as focused units, so a clean Diff Review does not
by itself clear the repository.

The review contract is data. One language-independent security reasoning kernel, one severity
rubric, and the file classification rules live in `src/cyberjury/review/contract/`. Language
support is the Tree-sitter query data in `src/cyberjury/review/syntax/queries.yaml`. A language
without queries is still reviewed from its raw source. Each review records a hash of these files
in `contract.json`.

A Repository Review of a Git work tree covers the tracked files and the untracked files Git does not
ignore. A plain directory is covered completely. Files that are not UTF-8 text, binary, or empty are
listed as skipped in `outcome.json`.

## Quick Review

```bash
cyberjury review diff --repository /path/to/app --git-range origin/main...HEAD
cyberjury review repository /path/to/repo
```

Re-running a repository review resumes open work. Use `--fresh` to start a new review session.

## Output and Exit Codes

Review commands print a JSON result and return a process style exit code. `0` means the requested
action completed. Exit code `1` means the run was degraded or incomplete. Every finding the finder
reports is kept, and the review does not run a second model to delete findings.

Diff and repository reviews write `findings.json` and `outcome.json` in the review
attempt workspace.

`findings.json` also groups findings into `issues`: findings that one code change fixes. Grouping
never removes a finding, and each finding names its `issue_id`. Findings of one category at the same
file and line form one issue. Other findings form one issue only when their cited source traces the
other's location and the model answers that one code change fixes both.

## Install

Requires Python 3.12 or newer. The base install includes tree-sitter and the grammar packages.

```bash
pip install cyberjury
cyberjury install-slash-command
```

The `cyberjury install-slash-command` command installs `/cyberjury-review` for Claude Code and Codex.

## Configure

All model settings come from a `.env` file in the working directory. An exported shell value wins
over the file. Copy [.env.example](.env.example) to `.env` and fill in what you use:

| Setting | Meaning |
|---|---|
| `OPENAI_API_KEY` | OpenAI key. When it is set the review uses OpenAI. |
| `ANTHROPIC_API_KEY` | Anthropic key, used when no OpenAI key is set. |
| `CYBERJURY_MODEL` | Model name, default `gpt-5.6` for OpenAI and `claude-opus-5` for Anthropic. |
| `CYBERJURY_API_BASE` | Gateway or proxy endpoint for the provider. |

One model finds the issues and also answers the issue grouping question, so use the strongest
model you can.
