security

type AOIDebugHook func(files []string, systemPrompt string, userMessage string, response string)

type AOIReport struct {
	Files          []AOIScanResult `json:"files"`
	TotalAOIs      int             `json:"total_aois"`
	SecurityDigest string          `json:"-"` // formatted text for injection into review prompts
}

type AOIScanResult struct {
	File            string           `json:"file"`
	AreasOfInterest []AreaOfInterest `json:"areas_of_interest"`

	// Areas is the new-format field name. During parsing, if "areas" is present
	// in the JSON it takes precedence over "areas_of_interest".
	Areas []AreaOfInterest `json:"areas,omitempty"`
}

type AreaOfInterest struct {
	File    string `json:"file"`
	Line    int    `json:"line"`
	EndLine int    `json:"end_line,omitempty"` // optional: range end

	// Category + Subcategory from the dimension taxonomy (e.g. "error-handling" / "swallowed-errors").
	Category    string `json:"category"`
	Subcategory string `json:"subcategory,omitempty"`

	// Urgency controls Phase 3 routing:
	//   "individual" — gets a dedicated deep review call
	//   "grouped"    — batched with other AOIs in the same subcategory
	// Empty string treated as "grouped" for backward compatibility.
	Urgency string `json:"urgency,omitempty"`

	// Dimensions lists which review dimensions are relevant (e.g. ["correctness", "error-handling"]).
	// Used for --focus filtering at Phase 3.
	Dimensions []string `json:"dimensions,omitempty"`

	// ID is a stable identifier for this AOI (e.g. "charge-go-float-currency").
	// Used for caching and cross-referencing between phases.
	ID string `json:"id,omitempty"`

	// Concern is a brief description of what the AOI scanner flagged.
	Concern string `json:"concern,omitempty"`

	// Context provides additional information about why this location matters.
	Context string `json:"context,omitempty"`

	// SiblingDeviation is set when this AOI was synthesized by Phase
	// 2.5 sibling clustering — it identifies the AOI as a 1-of-N
	// outlier and carries the conforming siblings so Phase 3 can
	// frame the review around "is this deviation intentional?". Nil
	// for AOIs produced by the regular scanner or by boundary
	// synthesis.
	SiblingDeviation *state.SiblingDeviation `json:"sibling_deviation,omitempty"`

	// Legacy fields — kept for backward compatibility with existing cached results.
	Snippet    string `json:"snippet,omitempty"`
	Reasoning  string `json:"reasoning,omitempty"`
	Confidence string `json:"confidence,omitempty"` // "high", "medium", "low"
}

type FindingForRevalidation struct {
	Index      int    `json:"finding_index"`
	Severity   string `json:"severity"`
	Category   string `json:"category"`
	File       string `json:"file"`
	Line       int    `json:"line"`
	Title      string `json:"title"`
	Detail     string `json:"detail"`
	Suggestion string `json:"suggestion,omitempty"`
	CWE        string `json:"cwe,omitempty"`
}

type Revalidation struct {
	Verdict    string `json:"verdict"`    // "true-positive", "false-positive", "fixed", "uncertain"
	Reasoning  string `json:"reasoning"`  // why this verdict was chosen
	Confidence string `json:"confidence"` // "high", "medium", "low"
	CWE        string `json:"cwe,omitempty"`
}

type SecuritySummary struct {
	TotalFindings    int            `json:"total_findings"`
	BySeverity       map[string]int `json:"by_severity"`       // critical/high/medium/low counts
	ByCWE            map[string]int `json:"by_cwe,omitempty"`  // CWE-ID -> count
	AOIsCovered      int            `json:"aois_covered"`      // how many AOIs led to findings
	AOIsTotal        int            `json:"aois_total"`        // total AOIs identified
	RevalidatedCount int            `json:"revalidated_count"` // findings that were revalidated
	TruePositives    int            `json:"true_positives"`    // confirmed true positives
	FalsePositives   int            `json:"false_positives"`   // confirmed false positives
}