secaf

package
v0.8.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 14, 2026 License: Apache-2.0 Imports: 26 Imported by: 0

Documentation

Overview

Package secaf is sec: sec-af, the security auditor, as a program codeaf carries and runs, and nothing else can. It takes one brief — the whole repository, or the changes on this branch — reads the folder it is handed without changing it, hunts for vulnerabilities, sets each against the code to show it exploitable or rule it out, suggests fixes for the ones that stand, and ends with one report.

IT WAS A SEPARATE PROGRAM. sec-af (github.com/Agent-Field/sec-af) was an AgentField node: a control plane carried its calls, a router key it held paid for its models, and a coding-agent binary ran each of its agent sessions. It was copied into codeaf once, at the tag codeaf-absorb (47d57d7), and lives on only here (docs/design/security-audit/ABSORB.md). Its algorithm — the phases, the twelve hunters, the four-agent proof chain, the prompts — is in the packages below this one and is its own; what it runs on is codeaf's (internal/agentsession).

IT HAS NO ENTRY POINT OF ITS OWN. What codeaf needs of it is a delegate.Delegate value, and its command's body takes a delegate.Host, which only codeaf makes: `/sec` in the chat, `codeaf sec` at a shell, and `propose_task` with `via: "sec"`.

Index

Constants

View Source 
const Name = "sec"

Name is the program's name: its chat command and its shell verb.

Variables

View Source 
var Program = delegate.Delegate{
	Name:    Name,
	Summary: "a security audit of the repository or of its changes",
	Guide:   programguide.Sec,
	Lands:   delegate.LandsText,

	DefaultBrief: "whole repository",

	Words: true,
	Args:  "[changes [since <ref>]] [quick | thorough]",

	Title:      func(brief string) string { return "Security audit of " + ReadScope(brief, false, "", "").Describe() },
	Unattended: Unattended,

	FollowUp: "If it found confirmed or likely problems, offer to hand them to senior-dev as one task that fixes them, " +
		"naming which; propose that task only after the person says yes.",
	ModelFlag:           "model",
	AuxiliaryModelFlags: []string{"light"},
	CrewFlags:           crewFlags,
	StageWords:          stageWords,
	Present:             presentActions,
	Default:             "run",
	Page:                Name,
	Commands:            []delegate.Command{runCommand},
}

Program is sec as codeaf carries it.

View Source 
var Stages = []string{stageStarting, stageRecon, stageHunt, stageProve, stageRemediation, stageReport}

Stages is every stage the audit reports, in the order it reaches them.

View Source 
var Unattended = delegate.Ceilings{CostUSD: 5, Hours: 4}

Unattended is the audit's own ceilings: $5 and four hours, which stop a run nobody is watching. TIME IS THE CEILING A STANDARD AUDIT MEETS FIRST: one of a mid-sized Rust repository on 2026-10-05 made 1,952 calls, spent $2.40 of its $5 and was cut by two hours in prove with no fixes written, so the hours were doubled and the dollars left where they were.

Functions

This section is empty.

Types

type Changes 

type Changes struct {
	// Base is the commit the changes are measured from, and BaseName how the
	// person would say it (`origin/dev`, `main`, the ref they typed).
	Base, BaseName string
	// Changed is every scannable file that differs from the base; Nearby is
	// the files that name one of them; Relevant is both, sorted.
	Changed, Nearby, Relevant []string
	// Diff is the change itself, cut at [diffBytes].
	Diff string
}

Changes is the work an audit of the changes looks at.

func ReadChanges 

func ReadChanges(ctx context.Context, repo, base string) (Changes, error)

ReadChanges reads what changed in repo since base, or since the branch's own base when base is empty.

type Scope 

type Scope struct {
	// Changes is an audit of what changed since Base rather than of the whole
	// repository.
	Changes bool
	// Base is the revision the changes are measured from; empty is the
	// branch's own base, found when the audit starts ([findBase]).
	Base string
	// Depth is `quick`, `standard` or `thorough`.
	Depth string
	// Words is the brief as the person or the conversation wrote it.
	Words string
}

Scope is the audit a brief asks for.

func ReadScope 

func ReadScope(brief string, changesFlag bool, baseFlag, depthFlag string) Scope

ReadScope reads a brief, with the shell's own flags over it: a flag the person typed wins over a word in the brief.

func (Scope) Describe 

func (s Scope) Describe() string

Describe is the scope in a few words, for the first line of the report.

Source Files

View all Source files

Directories

Path Synopsis
Package afx holds the small ergonomics over the AgentField Go SDK that every reasoner handler, phase and orchestrator step in the SEC-AF port reuses:
 Package afx holds the small ergonomics over the AgentField Go SDK that every reasoner handler, phase and orchestrator step in the SEC-AF port reuses:
agents
dedup
Package dedup ports src/sec_af/agents/dedup.py — the HUNT-phase deduplicator and chain correlator that runs between the hunters and the PROVE phase.
 Package dedup ports src/sec_af/agents/dedup.py — the HUNT-phase deduplicator and chain correlator that runs between the hunters and the PROVE phase.
hunt
Package hunt ports src/sec_af/agents/hunt — the HUNT phase: twelve hunter modules, the two-step scan/enrich harness pipeline they share, and the run_hunt / run_hunt_streaming orchestration in that package's __init__.py.
 Package hunt ports src/sec_af/agents/hunt — the HUNT phase: twelve hunter modules, the two-step scan/enrich harness pipeline they share, and the run_hunt / run_hunt_streaming orchestration in that package's __init__.py.
prove
Package prove ports src/sec_af/agents/prove — the PROVE phase.
 Package prove ports src/sec_af/agents/prove — the PROVE phase.
recon
Package recon ports src/sec_af/agents/recon — the RECON phase of the SEC-AF pipeline.
 Package recon ports src/sec_af/agents/recon — the RECON phase of the SEC-AF pipeline.
remediation
Package remediation ports src/sec_af/agents/remediation.py — the agent that turns a finding into a concrete patch by running the coding harness against the repository.
 Package remediation ports src/sec_af/agents/remediation.py — the agent that turns a finding into a concrete patch by running the coding harness against the repository.
Package aix is the Go form of SEC-AF's `.ai(...)` gate calls — the single structured LLM request, as opposed to the multi-turn coding-agent session that internal/harnessx drives.
 Package aix is the Go form of SEC-AF's `.ai(...)` gate calls — the single structured LLM request, as opposed to the multi-turn coding-agent session that internal/harnessx drives.
Package audit is the security audit's entry point inside codeaf: the request, the repository it reads, the four-phase pipeline, and the in-process Caller that answers the pipeline's `.call`s.
 Package audit is the security audit's entry point inside codeaf: the request, the repository it reads, the four-phase pipeline, and the in-process Caller that answers the pipeline's `.call`s.
Package compliance ports src/sec_af/compliance/mapping.py: the static CWE -> framework-control table SEC-AF scores findings against, the lookup and normalization helpers around it, the AI fallback for CWEs the table does not cover, and the gap aggregation the audit result reports.
 Package compliance ports src/sec_af/compliance/mapping.py: the static CWE -> framework-control table SEC-AF scores findings against, the lookup and normalization helpers around it, the AI fallback for CWEs the table does not cover, and the gap aggregation the audit result reports.
Package config ports src/sec_af/config.py: the depth profiles, the budget thresholds, the runtime AuditConfig the orchestrator phases consume, and the retry and model settings the AI gates apply (AIIntegrationConfig).
 Package config ports src/sec_af/config.py: the depth profiles, the budget thresholds, the runtime AuditConfig the orchestrator phases consume, and the retry and model settings the AI gates apply (AIIntegrationConfig).
Package diffanalysis ports src/sec_af/diff_analysis.py — the diff-aware file selection SEC-AF uses in PR mode.
 Package diffanalysis ports src/sec_af/diff_analysis.py — the diff-aware file selection SEC-AF uses in PR mode.
Package focus is what an audit of the changes tells its hunters: which files changed, which sit near them, and the change itself.
 Package focus is what an audit of the changes tells its hunters: which files changed, which sit near them, and the change itself.
Package gates ports src/sec_af/harness.py — the two thin wrappers SEC-AF puts between its phases and the AgentField SDK.
 Package gates ports src/sec_af/harness.py — the two thin wrappers SEC-AF puts between its phases and the AgentField SDK.
Package harnessx is the single choke point every SEC-AF agent uses to call the AgentField harness for structured output.
 Package harnessx is the single choke point every SEC-AF agent uses to call the AgentField harness for structured output.
Package monitoring ports src/sec_af/monitoring.py — continuous monitoring: baseline storage and regression detection.
 Package monitoring ports src/sec_af/monitoring.py — continuous monitoring: baseline storage and regression detection.
Package orch ports src/sec_af/orchestrator.py — the AuditOrchestrator class, its budget/cost bookkeeping, its checkpoint format, and the output-generation step every entry point funnels through.
 Package orch ports src/sec_af/orchestrator.py — the AuditOrchestrator class, its budget/cost bookkeeping, its checkpoint format, and the output-generation step every entry point funnels through.
Package output ports src/sec_af/output: the four artifact generators the orchestrator writes at the end of an audit — SARIF, the full/summary JSON, the Markdown report and the compliance report.
 Package output ports src/sec_af/output: the four artifact generators the orchestrator writes at the end of an audit — SARIF, the full/summary JSON, the Markdown report and the compliance report.
Package phases ports src/sec_af/reasoners/phases.py — the four `*_phase` reasoners that ARE the SEC-AF control-plane DAG, plus the two helpers that live in the same module (`_recon_summary_string`, `expand_cwes_for_hunt`) and the `run_cwe_expansion` reasoner body.
 Package phases ports src/sec_af/reasoners/phases.py — the four `*_phase` reasoners that ARE the SEC-AF control-plane DAG, plus the two helpers that live in the same module (`_recon_summary_string`, `expand_cwes_for_hunt`) and the `run_cwe_expansion` reasoner body.
Package policies ports src/sec_af/policies.py — evaluation of org-specific security policies against a codebase.
 Package policies ports src/sec_af/policies.py — evaluation of org-specific security policies against a codebase.
Package prompts holds byte-identical copies of every prompt template that ships inside the Python package at src/sec_af/prompts, embedded into the Go binary.
 Package prompts holds byte-identical copies of every prompt template that ships inside the Python package at src/sec_af/prompts, embedded into the Go binary.
Package pyfmt reproduces the CPython value-formatting primitives that SEC-AF's Python source leaks into observable output: round(), str(float), str(x) and repr(x).
 Package pyfmt reproduces the CPython value-formatting primitives that SEC-AF's Python source leaks into observable output: round(), str(float), str(x) and repr(x).
Package reasoners ports src/sec_af/reasoners/{__init__,recon,hunt,prove}.py — the thin adapter layer between the reasoner surface the pipeline `.call`s and the agent functions under internal/agents.
 Package reasoners ports src/sec_af/reasoners/{__init__,recon,hunt,prove}.py — the thin adapter layer between the reasoner surface the pipeline `.call`s and the agent functions under internal/agents.
Package recontext ports src/sec_af/context.py — the strategy-aware RECON projections that every HUNT prompt embeds.
 Package recontext ports src/sec_af/context.py — the strategy-aware RECON projections that every HUNT prompt embeds.
Package schemas ports every pydantic model and enum SEC-AF exchanges over a JSON boundary: `src/sec_af/schemas/*.py` (compliance, gates, hunt, input, output, prove, recon, views) plus `PolicyEvalResult` from `src/sec_af/policies.py`, which `evaluate_policy` hands to `app.harness(schema=...)`.
 Package schemas ports every pydantic model and enum SEC-AF exchanges over a JSON boundary: `src/sec_af/schemas/*.py` (compliance, gates, hunt, input, output, prove, recon, views) plus `PolicyEvalResult` from `src/sec_af/policies.py`, which `evaluate_policy` hands to `app.harness(schema=...)`.
Package scoring ports src/sec_af/scoring.py — the deterministic exploitability scoring engine: the severity/evidence/reachability weight tables, the CWE severity floors, and the score → label mapping.
 Package scoring ports src/sec_af/scoring.py — the deterministic exploitability scoring engine: the severity/evidence/reachability weight tables, the CWE severity floors, and the score → label mapping.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.