Documentation
¶
Index ¶
- func APIKeyEnvVar(model string) string
- func CallLLM(commitMsg string, evidence []models.AuditEvidence, ...) (models.LLMResult, error)
- func RequiresAPIKey(model string) bool
- type AuditContext
- type SourceIndex
- func (idx *SourceIndex) Callers(name string) []string
- func (idx *SourceIndex) Functions() []*sourceFunc
- func (idx *SourceIndex) LineCount() int
- func (idx *SourceIndex) Lines(first, last int) string
- func (idx *SourceIndex) Lookup(name string) (fn *sourceFunc, note string, ok bool)
- func (idx *SourceIndex) Source(fn *sourceFunc) string
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func APIKeyEnvVar ¶
APIKeyEnvVar names the environment variable holding the API key for model's provider.
func CallLLM ¶
func CallLLM(commitMsg string, evidence []models.AuditEvidence, apiKey, model, apiBase string, audit *AuditContext) (models.LLMResult, error)
CallLLM asks model whether commitMsg accounts for evidence. With an AuditContext, a Claude model may also read the two files and the full diff through the audit tools (see tools.go); other providers judge the evidence alone, which carries each flagged function's bounded source.
func RequiresAPIKey ¶
RequiresAPIKey reports whether auditing with model needs an explicit API key. The Anthropic SDK resolves credentials itself (ANTHROPIC_API_KEY, ANTHROPIC_AUTH_TOKEN, an `ant auth login` profile, workload identity), so an empty key is not by itself a missing credential for Claude models.
Types ¶
type AuditContext ¶
type AuditContext struct {
Old, New *SourceIndex
Diff *models.DiffOutput
}
AuditContext is what the auditor may read while it judges a diff: the two sides as text and the full diff output. The model reaches it through the read-only tools in auditToolDefinitions; nothing in it runs code or touches the file system after construction.
func NewAuditContext ¶
func NewAuditContext(oldPath string, oldSrc []byte, newPath string, newSrc []byte, diff *models.DiffOutput) *AuditContext
NewAuditContext indexes the two sides of a diff. A missing side (an added or removed file) is passed as nil content.
func (*AuditContext) Call ¶
func (c *AuditContext) Call(name string, input json.RawMessage) (text string, isError bool)
Call runs the named tool on input and returns its text and whether that text is an error message. Output is bounded by models.MaxToolResultBytes.
func (*AuditContext) InlineSource ¶
func (c *AuditContext) InlineSource(fn models.FunctionDiff) (oldSrc, newSrc string)
InlineSource returns the bounded source of both sides of the function fn reports on, for the evidence payload. A side longer than models.MaxInlineSourceLines is cut with a marker, so the model knows to ask for the rest.
type SourceIndex ¶
type SourceIndex struct {
// contains filtered or unexported fields
}
SourceIndex is one side of an audited diff as text: its lines and the functions declared in it, keyed the way the diff names them ("F", "(*T).M", "F$1" for the first closure in F). It is built with go/parser alone, which reads text and runs nothing, so the auditor can serve source outside the sandbox the diff ran in.
func NewSourceIndex ¶
func NewSourceIndex(path string, src []byte) *SourceIndex
NewSourceIndex indexes src, which came from path. A file with syntax errors is indexed as far as it parses: the lines are always served, and a function that failed to parse is simply absent.
func (*SourceIndex) Callers ¶
func (idx *SourceIndex) Callers(name string) []string
Callers lists the declarations in this file whose body calls name: a function by its name, a method by its method name through any receiver. Syntactic, like Callees.
func (*SourceIndex) Functions ¶
func (idx *SourceIndex) Functions() []*sourceFunc
Functions lists the declarations in file order.
func (*SourceIndex) LineCount ¶
func (idx *SourceIndex) LineCount() int
LineCount is the number of lines in the file.
func (*SourceIndex) Lines ¶
func (idx *SourceIndex) Lines(first, last int) string
Lines returns the lines from first to last (1-based, inclusive, clamped to the file), each prefixed with its number.
func (*SourceIndex) Lookup ¶
func (idx *SourceIndex) Lookup(name string) (fn *sourceFunc, note string, ok bool)
Lookup finds the declaration the diff name refers to. A closure name ("F$1", "(*T).M$2$1") resolves to its enclosing declaration, and a type argument list ("F[int]") is ignored. The note says when the declaration shown is not exactly the function asked for.
func (*SourceIndex) Source ¶
func (idx *SourceIndex) Source(fn *sourceFunc) string
Source returns fn's declaration, each line prefixed with its number.
Source Files