Documentation
¶
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func AOIScanPrompt ¶
func AOIScanPrompt() string
AOIScanPrompt returns the embedded AOI scan system prompt.
func FormatSecuritySummary ¶
func FormatSecuritySummary(s *SecuritySummary) string
FormatSecuritySummary renders a SecuritySummary as a human-readable markdown block suitable for display in the TUI review pane.
func RevalidatePrompt ¶
func RevalidatePrompt() string
RevalidatePrompt returns the embedded revalidation system prompt.
Types ¶
type AOIModelProfile ¶
type AOIModelProfile struct {
// Model is the model ID (e.g. "gemini-2.5-flash-lite").
Model string
// ContextLines controls how many surrounding lines of diff context
// are passed to the AOI scanner. More context helps trace data flow
// (source → sink), but too much noise hurts weaker models.
//
// Benchmark results (TestAOIContextLineComparison):
// gemini-2.5-flash-lite: U3=6/6 FP:1 vs U10=5/6 FP:4 → U3 wins
// gemini-3-flash-preview: U3=6/6 FP:0 vs U10=6/6 FP:1 → U10 fine
ContextLines int
// Temperature for generation. Lower = more deterministic.
Temperature float64
// ThinkingBudget is the thinking token budget (0 = disabled).
ThinkingBudget int
// MaxOutputTokens caps the model's response length.
MaxOutputTokens int
}
AOIModelProfile holds tuned settings for a specific model used in the AOI security pre-scan. Values are derived from benchmark results in aoi_model_comparison_test.go (TestAOIContextLineComparison).
When adding a new model, run the comparison tests first to determine optimal settings, then add a profile here.
func GetAOIProfile ¶
func GetAOIProfile(model string) AOIModelProfile
GetAOIProfile returns the benchmark-tuned profile for the given model. Falls back to conservative defaults for unknown models.
type AOIReport ¶
type AOIReport struct {
Files []AOIScanResult `json:"files"`
OverallRisk string `json:"overall_risk"` // highest risk across all files
TotalAOIs int `json:"total_aois"`
HighRiskFiles []string `json:"high_risk_files"` // files rated critical or high
SecurityDigest string `json:"-"` // formatted text for injection into review prompts
}
AOIReport is the complete result of scanning all changed files.
func ScanAreasOfInterest ¶
func ScanAreasOfInterest( ctx context.Context, client ai.Client, rawDiffs map[string]string, cachedResults map[string]*AOIScanResult, onProgress func(status string), ) (*AOIReport, error)
ScanAreasOfInterest runs the AOI pre-scan on all changed files using a lightweight LLM. It batches files by directory (like the main review) and runs up to aoiMaxConcurrency batches in parallel.
cachedResults maps file paths to previously cached AOIScanResult entries. Files with cached results are skipped — only uncached files are sent to the LLM. Pass nil to scan everything.
The onProgress callback is called with status updates for the UI. The client should be configured with a cheap/fast model.
type AOIScanResult ¶
type AOIScanResult struct {
File string `json:"file"`
AreasOfInterest []AreaOfInterest `json:"areas_of_interest"`
RiskLevel string `json:"risk_level"` // "critical", "high", "medium", "low", "none"
RiskSummary string `json:"risk_summary"`
}
AOIScanResult holds the output of an AOI scan for a single file.
type AreaOfInterest ¶
type AreaOfInterest struct {
File string `json:"file"`
Line int `json:"line"`
EndLine int `json:"end_line,omitempty"` // optional: range end
Category string `json:"category"` // e.g. "user-input", "sql", "exec", "auth", "crypto", "secrets", "deserialization", "file-access", "network", "redirect"
Snippet string `json:"snippet"` // the relevant code fragment
Reasoning string `json:"reasoning"` // why this is security-sensitive
Confidence string `json:"confidence"` // "high", "medium", "low"
}
AreaOfInterest represents a security-sensitive code location identified by the lightweight AOI scanner. These are injected into the main review prompts so the AI knows where to apply extra scrutiny.
type FindingForRevalidation ¶
type FindingForRevalidation struct {
Index int `json:"finding_index"`
Severity string `json:"severity"`
Category string `json:"category"`
File string `json:"file"`
Line int `json:"line"`
Title string `json:"title"`
Detail string `json:"detail"`
Suggestion string `json:"suggestion,omitempty"`
CWE string `json:"cwe,omitempty"`
}
FindingForRevalidation is a simplified finding struct for the revalidation prompt.
type Revalidation ¶
type Revalidation struct {
Verdict string `json:"verdict"` // "true-positive", "false-positive", "fixed", "uncertain"
Reasoning string `json:"reasoning"` // why this verdict was chosen
Confidence string `json:"confidence"` // "high", "medium", "low"
CWE string `json:"cwe,omitempty"`
}
Revalidation holds the result of a security revalidation pass on a finding.
func RevalidateFindings ¶
func RevalidateFindings( ctx context.Context, client ai.Client, findings []FindingForRevalidation, onProgress func(status string), ) ([]Revalidation, error)
RevalidateFindings runs a security-focused revalidation pass on the security-category findings from a review. Returns revalidation verdicts.
type SecuritySummary ¶
type SecuritySummary struct {
TotalFindings int `json:"total_findings"`
BySeverity map[string]int `json:"by_severity"` // critical/high/medium/low counts
ByCWE map[string]int `json:"by_cwe,omitempty"` // CWE-ID -> count
HighRiskFiles []string `json:"high_risk_files"` // files with critical/high findings
AOIsCovered int `json:"aois_covered"` // how many AOIs led to findings
AOIsTotal int `json:"aois_total"` // total AOIs identified
RevalidatedCount int `json:"revalidated_count"` // findings that were revalidated
TruePositives int `json:"true_positives"` // confirmed true positives
FalsePositives int `json:"false_positives"` // confirmed false positives
}
SecuritySummary aggregates security metrics for a PR review.
func BuildSecuritySummary ¶
func BuildSecuritySummary( findings []FindingForRevalidation, revalidations []Revalidation, aoiReport *AOIReport, ) *SecuritySummary
BuildSecuritySummary aggregates security metrics from review findings and AOI scan results into a SecuritySummary.
Source Files