TimeCodeSecurity v1.0.1: Deterministic AST & Closed-Loop Remediation

🚀 What's New in v1.0.1

🛠️ Dedicated CLI Remediation Discovery

• Streamlined --fix Workflow: tcs scan <target> --fix now natively discovers auto-fixable vulnerabilities originating from uncalled function parameters without requiring the --audit-all flag.
• Preserved Conservative Scanning: Standard scans (tcs scan .) remain strictly high-signal with zero noise on uncalled library parameters.

🔍 Proof Graph Dataflow & Inversion Fixes

• Resolved Sink-as-Source Bug: Sinks (like subprocess.run) are no longer misattributed as taint sources. Uncalled function parameters (e.g. host (ping)) are accurately rendered as [SOURCE] HOP 1.
• Dynamic UI Confidence Badging: Web UI proof graph banners now dynamically bind to finding confidence — displaying POTENTIAL DATAFLOW PATH (Amber) for speculative flows and CONFIRMED PROOF PATH (Red) for verified taint flows.

🛡️ Vector D Closed-Loop Remediation Engine

• Two-Gate Compiler Invariant: Every automated patch is validated against AST syntax compilation (Invariant D-1) and verified via closed-loop in-memory re-scan (Invariant D-2) before touching disk.
• 100% Test Suite Verification: Passed all 19 workflow regression scenarios, 5 adversarial deep gauntlets (multi-finding collision, idempotency, CRLF preservation), and core Phase 9 SAST tests (110/110 green).

---

📦 Quick Install & Usage

# Install directly via Git
pip install git+[https://github.com/kushigaur3103-svg/time-code-security.git](https://github.com/kushigaur3103-svg/time-code-security.git)

# Safe dry-run preview (displays unified diff without modifying disk)
tcs scan ./my_project --fix

# Atomically apply verified patches to disk
tcs scan ./my_project --fix --write

TimeCodeSecurity v1.0.0 — Production Release

🚀 What's New in v1.0.0

We are proud to release TimeCodeSecurity (TCS) v1.0.0 — the first production-ready milestone of our deterministic security orchestrator. TCS moves beyond alerting by coupling AST-level static analysis with closed-loop, compile-verified automated patching.

---

Key Capabilities

• Deterministic Auto-Remediation (Vector D):
  • CWE-89 (SQL Injection): Automatic parameterized query rewriting with safe bind tuples.
  • CWE-78 (Command Injection): Safe argv tokenization via shlex and shell=False execution. Rejects dangerous shell semantics (|, >, &) safely.
  • CWE-22 (Path Traversal): Enforces strict .resolve() boundary canonicalization and .is_relative_to() containment guards.
• Multi-Finding Line-Shift Protection:
  • Uses opcode delta tracking (SequenceMatcher) and AST call site re-anchoring to allow multiple vulnerability fixes in the same file without offset corruption.
• Filesystem & Transactional Integrity:
  • Enforces atomic file writes via temporary sibling files and os.replace.
  • Preserves exact line-ending byte semantics (LF vs CRLF) without platform leaks.
  • Rejects symlinks, hardlinks (nlink > 1), and read-only files safely.
• PEP 517/621 Packaging:
  • Fully packaged Python distribution exposing the global tcs console script.
  • Verified to run seamlessly across arbitrary external working directories.
• Interactive Web Studio:
  • Full integration with FastAPI Web UI featuring syntax-highlighted unified diffs and one-click patch application.

---

📈 Verification & Benchmarks

• Comprehensive Test Suite: 266 / 266 PASS (Vectors A, B, C, D, and CLI packaging).
• End-to-End Pipeline Speed: 715 ms for a 3-microservice repository (Preview → Verification → Write → Re-audit).
• Security Score: 100/100 CLEAN achieved on live smoke repos.

---

📦 Quick Install

git clone [https://github.com/kushigaur3103-svg/time-code-security.git](https://github.com/kushigaur3103-svg/time-code-security.git)
cd time-code-security
pip install -e .
tcs --help