security

package
v1.9.0 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: May 21, 2026 License: MIT Imports: 16 Imported by: 0

Documentation

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func AOIAuditPrompt added in v1.4.0

func AOIAuditPrompt() string

AOIAuditPrompt returns the AOI scan system prompt for full-project audit mode.

func AOIScanPrompt

func AOIScanPrompt() string

AOIScanPrompt returns the AOI scan system prompt for PR review mode.

func AOIScanPromptHash added in v1.6.0

func AOIScanPromptHash(auditMode bool) string

AOIScanPromptHash returns a short sha256 hash of the AOI scan prompt for cache-invalidation purposes. Mixed into the Phase 2 AOI cache key so prompt edits (e.g. commit 7's TODO/FIXME + unit-type rules) auto-invalidate stale entries.

auditMode selects which prompt variant to hash. The two modes embed different mode-specific rules so they need separate hashes.

func SetAOIConcurrency added in v1.4.0

func SetAOIConcurrency(n int)

SetAOIConcurrency sets the max number of AOI batches run in parallel. Values <= 0 reset to the default. Not safe to call concurrently with scans in flight; intended to be called once at startup.

Types

type AOIDebugHook added in v1.4.0

type AOIDebugHook func(files []string, systemPrompt string, userMessage string, response string)

AOIDebugHook is called for each LLM call in the AOI scanner with the prompt, input, and response.

type AOIReport

type AOIReport struct {
	Files          []AOIScanResult `json:"files"`
	TotalAOIs      int             `json:"total_aois"`
	SecurityDigest string          `json:"-"` // formatted text for injection into review prompts
}

AOIReport is the complete result of scanning all changed files.

func ScanAreasOfInterest

func ScanAreasOfInterest(
	ctx context.Context,
	client ai.Client,
	rawDiffs map[string]string,
	cachedResults map[string]*AOIScanResult,
	onProgress func(status string),
) (*AOIReport, error)

ScanAreasOfInterest runs the AOI pre-scan on all changed files using a lightweight LLM. It batches files by category set (or all together if no classifications are provided) and runs up to aoiMaxConcurrency batches in parallel.

cachedResults maps file paths to previously cached AOIScanResult entries. Files with cached results are skipped — only uncached files are sent to the LLM. Pass nil to scan everything.

The onProgress callback is called with status updates for the UI. The client should be configured with a cheap/fast model.

func ScanAreasOfInterestClassified added in v1.4.0

func ScanAreasOfInterestClassified(
	ctx context.Context,
	client ai.Client,
	rawDiffs map[string]string,
	cachedResults map[string]*AOIScanResult,
	fileCategories map[string][]string,
	onProgress func(status string),
	debugHook AOIDebugHook,
	auditMode bool,
) (*AOIReport, error)

ScanAreasOfInterestClassified is like ScanAreasOfInterestDebug but with per-file category filtering. fileCategories maps file paths to their category slugs. Files not in the map get all categories. If fileCategories is nil, all files get all categories.

func ScanAreasOfInterestDebug added in v1.4.0

func ScanAreasOfInterestDebug(
	ctx context.Context,
	client ai.Client,
	rawDiffs map[string]string,
	cachedResults map[string]*AOIScanResult,
	onProgress func(status string),
	debugHook AOIDebugHook,
	auditMode bool,
) (*AOIReport, error)

ScanAreasOfInterestDebug is like ScanAreasOfInterest but with an optional debug hook.

type AOIScanResult

type AOIScanResult struct {
	File            string           `json:"file"`
	AreasOfInterest []AreaOfInterest `json:"areas_of_interest"`

	// Areas is the new-format field name. During parsing, if "areas" is present
	// in the JSON it takes precedence over "areas_of_interest".
	Areas []AreaOfInterest `json:"areas,omitempty"`
}

AOIScanResult holds the output of an AOI scan for a single file. Supports both the legacy format (areas_of_interest with snippets) and the new format (areas with category/subcategory/urgency).

func (*AOIScanResult) NormalizeAOIs added in v1.4.0

func (r *AOIScanResult) NormalizeAOIs()

NormalizeAOIs merges Areas into AreasOfInterest (if Areas is populated) so downstream code can always read AreasOfInterest. Call after unmarshaling.

type AreaOfInterest

type AreaOfInterest struct {
	File    string `json:"file"`
	Line    int    `json:"line"`
	EndLine int    `json:"end_line,omitempty"` // optional: range end

	// Category + Subcategory from the category taxonomy (e.g. "error-handling" / "swallowed-errors").
	Category    string `json:"category"`
	Subcategory string `json:"subcategory,omitempty"`

	// Urgency controls Phase 3 routing:
	//   "individual" — gets a dedicated deep review call
	//   "grouped"    — batched with other AOIs in the same subcategory
	// Empty string treated as "grouped" for backward compatibility.
	Urgency string `json:"urgency,omitempty"`

	// ID is a stable identifier for this AOI (e.g. "charge-go-float-currency").
	// Used for caching and cross-referencing between phases.
	ID string `json:"id,omitempty"`

	// Concern is a brief description of what the AOI scanner flagged.
	Concern string `json:"concern,omitempty"`

	// Context provides additional information about why this location matters.
	Context string `json:"context,omitempty"`

	// SiblingDeviation is set when this AOI was synthesized by Phase
	// 2.5 sibling clustering — it identifies the AOI as a 1-of-N
	// outlier and carries the conforming siblings so Phase 3 can
	// frame the review around "is this deviation intentional?". Nil
	// for AOIs produced by the regular scanner or by boundary
	// synthesis.
	SiblingDeviation *state.SiblingDeviation `json:"sibling_deviation,omitempty"`

	// Legacy fields — kept for backward compatibility with existing cached results.
	Snippet    string `json:"snippet,omitempty"`
	Reasoning  string `json:"reasoning,omitempty"`
	Confidence string `json:"confidence,omitempty"` // "high", "medium", "low"
}

AreaOfInterest represents a code location identified by the AOI scanner that warrants deeper review. Each AOI is tagged with a category/subcategory from the review category taxonomy and an urgency level that controls how it is reviewed in Phase 3.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL