@kb-labs/review-llm 0.5.0

package/dist/analyzers/security-analyzer.js

@@ -0,0 +1,261 @@
+import { BaseLLMAnalyzer } from '@kb-labs/review-contracts';
+import { useCache, useLogger, useAnalytics, useLLM } from '@kb-labs/sdk';
+
+// src/analyzers/security-analyzer.ts
+
+// src/prompts/security.prompts.ts
+function buildSystemPrompt(context) {
+  const sections = [
+    "You are an expert security auditor specializing in application security.",
+    "",
+    "**Your role:**",
+    "- Identify security vulnerabilities and weaknesses",
+    "- Check for common security anti-patterns (OWASP Top 10)",
+    "- Suggest secure coding practices with clear rationale",
+    "",
+    "**CRITICAL RULES:**",
+    "1. ONLY report security issues that exist in the provided code",
+    "2. Reference line numbers that actually exist in the file",
+    "3. Quote exact code snippets when referencing issues",
+    "4. Classify severity accurately (error = exploitable, warning = weakness)",
+    "5. Provide concrete, actionable mitigation steps",
+    "",
+    "**Focus areas:**",
+    "- SQL injection, XSS, CSRF",
+    "- Authentication/authorization bypass",
+    "- Insecure cryptography",
+    "- Secrets in code",
+    "- Command injection",
+    "- Path traversal",
+    "- Unsafe deserialization",
+    ""
+  ];
+  for (const [category, content] of Object.entries(context.conventions)) {
+    sections.push(`**Project Conventions (${category}):**`);
+    sections.push(content);
+    sections.push("");
+  }
+  if (context.taskContext) {
+    sections.push("**Current Task Context:**");
+    sections.push(context.taskContext);
+    sections.push("");
+    sections.push("IMPORTANT: Pay special attention to security implications in the context of this task.");
+    sections.push("");
+  }
+  if (context.repoScope && context.repoScope.length > 0) {
+    sections.push("**Repositories in Scope:**");
+    sections.push(context.repoScope.map((r) => `- ${r}`).join("\n"));
+    sections.push("");
+    sections.push("NOTE: Check for security issues that may arise from cross-repo interactions.");
+    sections.push("");
+  }
+  sections.push("Use the report_security_finding tool to report vulnerabilities.");
+  return sections.join("\n");
+}
+function analyzeFile(file) {
+  const lines = file.content.split("\n");
+  const numbered = lines.map((line, idx) => `${idx + 1}: ${line}`).join("\n");
+  return `Review this file for security vulnerabilities:
+
+File: ${file.path}
+Language: ${file.language}
+
+\`\`\`${file.language}
+${numbered}
+\`\`\`
+
+Report any security vulnerabilities or weaknesses. Focus on exploitable issues.`;
+}
+
+// src/analyzers/security-analyzer.ts
+var SECURITY_FINDING_TOOL = {
+  name: "report_security_finding",
+  description: "Report a security vulnerability or weakness",
+  inputSchema: {
+    type: "object",
+    properties: {
+      severity: {
+        type: "string",
+        enum: ["blocker", "high", "medium", "low"],
+        description: "Severity level (blocker=exploitable, high=serious weakness)"
+      },
+      vulnerabilityType: {
+        type: "string",
+        description: "Type of vulnerability (e.g., SQL injection, XSS, CSRF)"
+      },
+      message: {
+        type: "string",
+        description: "Clear description of the security issue"
+      },
+      line: {
+        type: "number",
+        description: "Line number where vulnerability occurs"
+      },
+      mitigation: {
+        type: "string",
+        description: "Concrete mitigation steps with code example"
+      },
+      impact: {
+        type: "string",
+        description: "Potential impact if exploited"
+      }
+    },
+    required: ["severity", "vulnerabilityType", "message", "line", "mitigation", "impact"]
+  }
+};
+var VALID_SEVERITIES = ["blocker", "high", "medium", "low"];
+var MAX_RETRIES = 3;
+var INITIAL_DELAY_MS = 1e3;
+var BATCH_SIZE = 5;
+function sleep(ms) {
+  return new Promise((resolve) => {
+    setTimeout(resolve, ms);
+  });
+}
+var SecurityAnalyzer = class extends BaseLLMAnalyzer {
+  id = "security";
+  name = "Security Analysis";
+  /** Track failed files for reporting */
+  failedFiles = [];
+  async analyze(files, context) {
+    const findings = [];
+    const cache = useCache();
+    this.failedFiles = [];
+    const filesToAnalyze = [];
+    for (const file of files) {
+      const cacheKey = this.generateCacheKey(file, context.preset);
+      if (cache) {
+        const cached = await cache.get(cacheKey);
+        if (cached) {
+          findings.push(...cached);
+          continue;
+        }
+      }
+      filesToAnalyze.push(file);
+    }
+    for (let i = 0; i < filesToAnalyze.length; i += BATCH_SIZE) {
+      const batch = filesToAnalyze.slice(i, i + BATCH_SIZE);
+      const batchResults = await Promise.allSettled(
+        batch.map((file) => this.analyzeFile(file, context, cache))
+      );
+      for (let j = 0; j < batchResults.length; j++) {
+        const result = batchResults[j];
+        const file = batch[j];
+        if (result.status === "fulfilled") {
+          findings.push(...result.value);
+        } else {
+          this.failedFiles.push({ file: file.path, error: result.reason?.message ?? "Unknown error" });
+        }
+      }
+    }
+    if (this.failedFiles.length > 0) {
+      useLogger()?.debug(`[SecurityAnalyzer] Failed to analyze ${this.failedFiles.length} file(s):`, {
+        files: this.failedFiles
+      });
+    }
+    return findings;
+  }
+  /**
+   * Analyze a single file with retry logic
+   */
+  async analyzeFile(file, context, cache) {
+    const analytics = useAnalytics();
+    const systemPrompt = buildSystemPrompt(context);
+    const userPrompt = analyzeFile(file);
+    const llm = useLLM({ tier: "medium" });
+    if (!llm?.chatWithTools) {
+      throw new Error("LLM not configured or does not support tool calling");
+    }
+    let lastError = null;
+    for (let attempt = 1; attempt <= MAX_RETRIES; attempt++) {
+      try {
+        const response = await llm.chatWithTools(
+          [
+            { role: "system", content: systemPrompt },
+            { role: "user", content: userPrompt }
+          ],
+          {
+            tools: [SECURITY_FINDING_TOOL],
+            temperature: 0.1
+          }
+        );
+        if (analytics) {
+          await analytics.track("review.security.complete", {
+            file: file.path,
+            tokensUsed: response.usage.promptTokens + response.usage.completionTokens,
+            toolCalls: response.toolCalls?.length ?? 0,
+            attempts: attempt
+          });
+        }
+        const fileFindings = this.processToolCalls(response.toolCalls || [], file);
+        if (cache) {
+          const cacheKey = this.generateCacheKey(file, context.preset);
+          await cache.set(cacheKey, fileFindings, 864e5);
+        }
+        return fileFindings;
+      } catch (error) {
+        lastError = error instanceof Error ? error : new Error(String(error));
+        useLogger()?.debug(`[SecurityAnalyzer] Attempt ${attempt}/${MAX_RETRIES} failed for ${file.path}:`, { error });
+        if (attempt < MAX_RETRIES) {
+          const delay = INITIAL_DELAY_MS * Math.pow(2, attempt - 1);
+          await sleep(delay);
+        }
+      }
+    }
+    throw lastError ?? new Error("Analysis failed");
+  }
+  /**
+   * Get list of files that failed analysis
+   */
+  getFailedFiles() {
+    return [...this.failedFiles];
+  }
+  /**
+   * Process LLM tool calls into ReviewFindings
+   */
+  // eslint-disable-next-line sonarjs/cognitive-complexity -- Complex validation and mapping of LLM tool call results to structured findings
+  processToolCalls(toolCalls, file) {
+    const findings = [];
+    for (const call of toolCalls) {
+      if (call.name === "report_security_finding") {
+        const args = call.input;
+        const lineCount = file.content.split("\n").length;
+        const line = typeof args.line === "number" ? args.line : parseInt(args.line, 10);
+        if (isNaN(line) || line < 1 || line > lineCount) {
+          useLogger()?.debug(`[SecurityAnalyzer] Invalid line number ${args.line} for ${file.path}`);
+          continue;
+        }
+        const severity = args.severity;
+        if (!VALID_SEVERITIES.includes(severity)) {
+          useLogger()?.debug(`[SecurityAnalyzer] Invalid severity "${severity}" for finding in ${file.path}:${line}`);
+          continue;
+        }
+        const vulnerabilityType = String(args.vulnerabilityType || "unknown").replace(/[^a-zA-Z0-9_-]/g, "_").slice(0, 50);
+        findings.push({
+          id: this.buildFindingId(file, line, "sec"),
+          ruleId: `llm:security:${vulnerabilityType}`,
+          type: "security",
+          severity,
+          confidence: "likely",
+          // LLM findings are "likely", not "certain"
+          file: file.path,
+          line,
+          message: `[${vulnerabilityType}] ${String(args.message || "").slice(0, 500)}`,
+          suggestion: args.mitigation ? String(args.mitigation).slice(0, 1e3) : void 0,
+          rationale: args.impact ? `Impact: ${String(args.impact).slice(0, 500)}` : void 0,
+          engine: "llm",
+          source: "llm-security",
+          // For agent mode gating
+          scope: "local",
+          automated: false
+          // Security fixes need human review
+        });
+      }
+    }
+    return findings;
+  }
+};
+
+export { SecurityAnalyzer };
+//# sourceMappingURL=security-analyzer.js.map
+//# sourceMappingURL=security-analyzer.js.map

package/dist/analyzers/security-analyzer.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/prompts/security.prompts.ts","../../src/analyzers/security-analyzer.ts"],"names":[],"mappings":";;;;;;AAUO,SAAS,kBAAkB,OAAA,EAAgC;AAChE,EAAA,MAAM,QAAA,GAAqB;AAAA,IACzB,0EAAA;AAAA,IACA,EAAA;AAAA,IACA,gBAAA;AAAA,IACA,oDAAA;AAAA,IACA,0DAAA;AAAA,IACA,wDAAA;AAAA,IACA,EAAA;AAAA,IACA,qBAAA;AAAA,IACA,gEAAA;AAAA,IACA,2DAAA;AAAA,IACA,sDAAA;AAAA,IACA,2EAAA;AAAA,IACA,kDAAA;AAAA,IACA,EAAA;AAAA,IACA,kBAAA;AAAA,IACA,4BAAA;AAAA,IACA,uCAAA;AAAA,IACA,yBAAA;AAAA,IACA,mBAAA;AAAA,IACA,qBAAA;AAAA,IACA,kBAAA;AAAA,IACA,0BAAA;AAAA,IACA;AAAA,GACF;AAGA,EAAA,KAAA,MAAW,CAAC,UAAU,OAAO,CAAA,IAAK,OAAO,OAAA,CAAQ,OAAA,CAAQ,WAAW,CAAA,EAAG;AACrE,IAAA,QAAA,CAAS,IAAA,CAAK,CAAA,uBAAA,EAA0B,QAAQ,CAAA,IAAA,CAAM,CAAA;AACtD,IAAA,QAAA,CAAS,KAAK,OAAO,CAAA;AACrB,IAAA,QAAA,CAAS,KAAK,EAAE,CAAA;AAAA,EAClB;AAGA,EAAA,IAAI,QAAQ,WAAA,EAAa;AACvB,IAAA,QAAA,CAAS,KAAK,2BAA2B,CAAA;AACzC,IAAA,QAAA,CAAS,IAAA,CAAK,QAAQ,WAAW,CAAA;AACjC,IAAA,QAAA,CAAS,KAAK,EAAE,CAAA;AAChB,IAAA,QAAA,CAAS,KAAK,wFAAwF,CAAA;AACtG,IAAA,QAAA,CAAS,KAAK,EAAE,CAAA;AAAA,EAClB;AAGA,EAAA,IAAI,OAAA,CAAQ,SAAA,IAAa,OAAA,CAAQ,SAAA,CAAU,SAAS,CAAA,EAAG;AACrD,IAAA,QAAA,CAAS,KAAK,4BAA4B,CAAA;AAC1C,IAAA,QAAA,CAAS,IAAA,CAAK,OAAA,CAAQ,SAAA,CAAU,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,EAAA,EAAK,CAAC,CAAA,CAAE,CAAA,CAAE,IAAA,CAAK,IAAI,CAAC,CAAA;AAC/D,IAAA,QAAA,CAAS,KAAK,EAAE,CAAA;AAChB,IAAA,QAAA,CAAS,KAAK,8EAA8E,CAAA;AAC5F,IAAA,QAAA,CAAS,KAAK,EAAE,CAAA;AAAA,EAClB;AAEA,EAAA,QAAA,CAAS,KAAK,iEAAiE,CAAA;AAE/E,EAAA,OAAO,QAAA,CAAS,KAAK,IAAI,CAAA;AAC3B;AAKO,SAAS,YAAY,IAAA,EAA0B;AACpD,EAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,OAAA,CAAQ,KAAA,CAAM,IAAI,CAAA;AACrC,EAAA,MAAM,QAAA,GAAW,KAAA,CACd,GAAA,CAAI,CAAC,MAAM,GAAA,KAAQ,CAAA,EAAG,GAAA,GAAM,CAAC,CAAA,EAAA,EAAK,IAAI,CAAA,CAAE,CAAA,CACxC,KAAK,IAAI,CAAA;AAEZ,EAAA,OAAO,CAAA;;AAAA,MAAA,EACI,KAAK,IAAI;AAAA,UAAA,EACL,KAAK,QAAQ;;AAAA,MAAA,EACjB,KAAK,QAAQ;AAAA,EAAK,QAAQ;AAAA;;AAAA,+EAAA,CAAA;AAEvC;;;ACpEA,IAAM,qBAAA,GAAwB;AAAA,EAC5B,IAAA,EAAM,yBAAA;AAAA,EACN,WAAA,EAAa,6CAAA;AAAA,EACb,WAAA,EAAa;AAAA,IACX,IAAA,EAAM,QAAA;AAAA,IACN,UAAA,EAAY;AAAA,MACV,QAAA,EAAU;AAAA,QACR,IAAA,EAAM,QAAA;AAAA,QACN,IAAA,EAAM,CAAC,SAAA,EAAW,MAAA,EAAQ,UAAU,KAAK,CAAA;AAAA,QACzC,WAAA,EAAa;AAAA,OACf;AAAA,MACA,iBAAA,EAAmB;AAAA,QACjB,IAAA,EAAM,QAAA;AAAA,QACN,WAAA,EAAa;AAAA,OACf;AAAA,MACA,OAAA,EAAS;AAAA,QACP,IAAA,EAAM,QAAA;AAAA,QACN,WAAA,EAAa;AAAA,OACf;AAAA,MACA,IAAA,EAAM;AAAA,QACJ,IAAA,EAAM,QAAA;AAAA,QACN,WAAA,EAAa;AAAA,OACf;AAAA,MACA,UAAA,EAAY;AAAA,QACV,IAAA,EAAM,QAAA;AAAA,QACN,WAAA,EAAa;AAAA,OACf;AAAA,MACA,MAAA,EAAQ;AAAA,QACN,IAAA,EAAM,QAAA;AAAA,QACN,WAAA,EAAa;AAAA;AACf,KACF;AAAA,IACA,UAAU,CAAC,UAAA,EAAY,qBAAqB,SAAA,EAAW,MAAA,EAAQ,cAAc,QAAQ;AAAA;AAEzF,CAAA;AAGA,IAAM,gBAAA,GAAmB,CAAC,SAAA,EAAW,MAAA,EAAQ,UAAU,KAAK,CAAA;AAI5D,IAAM,WAAA,GAAc,CAAA;AACpB,IAAM,gBAAA,GAAmB,GAAA;AAGzB,IAAM,UAAA,GAAa,CAAA;AAKnB,SAAS,MAAM,EAAA,EAA2B;AACxC,EAAA,OAAO,IAAI,QAAQ,CAAA,OAAA,KAAW;AAAE,IAAA,UAAA,CAAW,SAAS,EAAE,CAAA;AAAA,EAAG,CAAC,CAAA;AAC5D;AAMO,IAAM,gBAAA,GAAN,cAA+B,eAAA,CAAgB;AAAA,EAC3C,EAAA,GAAK,UAAA;AAAA,EACL,IAAA,GAAO,mBAAA;AAAA;AAAA,EAGR,cAAsD,EAAC;AAAA,EAE/D,MAAM,OAAA,CAAQ,KAAA,EAAqB,OAAA,EAAkD;AACnF,IAAA,MAAM,WAA4B,EAAC;AACnC,IAAA,MAAM,QAAQ,QAAA,EAAS;AACvB,IAAA,IAAA,CAAK,cAAc,EAAC;AAGpB,IAAA,MAAM,iBAA+B,EAAC;AAEtC,IAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACxB,MAAA,MAAM,QAAA,GAAW,IAAA,CAAK,gBAAA,CAAiB,IAAA,EAAM,QAAQ,MAAM,CAAA;AAE3D,MAAA,IAAI,KAAA,EAAO;AAET,QAAA,MAAM,MAAA,GAAS,MAAM,KAAA,CAAM,GAAA,CAAqB,QAAQ,CAAA;AACxD,QAAA,IAAI,MAAA,EAAQ;AACV,UAAA,QAAA,CAAS,IAAA,CAAK,GAAG,MAAM,CAAA;AACvB,UAAA;AAAA,QACF;AAAA,MACF;AAEA,MAAA,cAAA,CAAe,KAAK,IAAI,CAAA;AAAA,IAC1B;AAGA,IAAA,KAAA,IAAS,IAAI,CAAA,EAAG,CAAA,GAAI,cAAA,CAAe,MAAA,EAAQ,KAAK,UAAA,EAAY;AAC1D,MAAA,MAAM,KAAA,GAAQ,cAAA,CAAe,KAAA,CAAM,CAAA,EAAG,IAAI,UAAU,CAAA;AAIpD,MAAA,MAAM,YAAA,GAAe,MAAM,OAAA,CAAQ,UAAA;AAAA,QACjC,KAAA,CAAM,IAAI,CAAA,IAAA,KAAQ,IAAA,CAAK,YAAY,IAAA,EAAM,OAAA,EAAS,KAAK,CAAC;AAAA,OAC1D;AAGA,MAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,YAAA,CAAa,QAAQ,CAAA,EAAA,EAAK;AAC5C,QAAA,MAAM,MAAA,GAAS,aAAa,CAAC,CAAA;AAC7B,QAAA,MAAM,IAAA,GAAO,MAAM,CAAC,CAAA;AAEpB,QAAA,IAAI,MAAA,CAAO,WAAW,WAAA,EAAa;AACjC,UAAA,QAAA,CAAS,IAAA,CAAK,GAAG,MAAA,CAAO,KAAK,CAAA;AAAA,QAC/B,CAAA,MAAO;AACL,UAAA,IAAA,CAAK,WAAA,CAAY,IAAA,CAAK,EAAE,IAAA,EAAM,IAAA,CAAK,IAAA,EAAM,KAAA,EAAO,MAAA,CAAO,MAAA,EAAQ,OAAA,IAAW,eAAA,EAAiB,CAAA;AAAA,QAC7F;AAAA,MACF;AAAA,IACF;AAGA,IAAA,IAAI,IAAA,CAAK,WAAA,CAAY,MAAA,GAAS,CAAA,EAAG;AAC/B,MAAA,SAAA,IAAa,KAAA,CAAM,CAAA,qCAAA,EAAwC,IAAA,CAAK,WAAA,CAAY,MAAM,CAAA,SAAA,CAAA,EAAa;AAAA,QAC7F,OAAO,IAAA,CAAK;AAAA,OACb,CAAA;AAAA,IACH;AAEA,IAAA,OAAO,QAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,WAAA,CACZ,IAAA,EACA,OAAA,EACA,KAAA,EAC0B;AAC1B,IAAA,MAAM,YAAY,YAAA,EAAa;AAC/B,IAAA,MAAM,YAAA,GAA+B,kBAAkB,OAAO,CAAA;AAC9D,IAAA,MAAM,UAAA,GAA6B,YAAY,IAAI,CAAA;AAEnD,IAAA,MAAM,GAAA,GAAM,MAAA,CAAO,EAAE,IAAA,EAAM,UAAU,CAAA;AACrC,IAAA,IAAI,CAAC,KAAK,aAAA,EAAe;AACvB,MAAA,MAAM,IAAI,MAAM,qDAAqD,CAAA;AAAA,IACvE;AAGA,IAAA,IAAI,SAAA,GAA0B,IAAA;AAC9B,IAAA,KAAA,IAAS,OAAA,GAAU,CAAA,EAAG,OAAA,IAAW,WAAA,EAAa,OAAA,EAAA,EAAW;AACvD,MAAA,IAAI;AAEF,QAAA,MAAM,QAAA,GAAW,MAAM,GAAA,CAAI,aAAA;AAAA,UACzB;AAAA,YACE,EAAE,IAAA,EAAM,QAAA,EAAU,OAAA,EAAS,YAAA,EAAa;AAAA,YACxC,EAAE,IAAA,EAAM,MAAA,EAAQ,OAAA,EAAS,UAAA;AAAW,WACtC;AAAA,UACA;AAAA,YACE,KAAA,EAAO,CAAC,qBAAqB,CAAA;AAAA,YAC7B,WAAA,EAAa;AAAA;AACf,SACF;AAGA,QAAA,IAAI,SAAA,EAAW;AAEb,UAAA,MAAM,SAAA,CAAU,MAAM,0BAAA,EAA4B;AAAA,YAChD,MAAM,IAAA,CAAK,IAAA;AAAA,YACX,UAAA,EAAY,QAAA,CAAS,KAAA,CAAM,YAAA,GAAe,SAAS,KAAA,CAAM,gBAAA;AAAA,YACzD,SAAA,EAAW,QAAA,CAAS,SAAA,EAAW,MAAA,IAAU,CAAA;AAAA,YACzC,QAAA,EAAU;AAAA,WACX,CAAA;AAAA,QACH;AAGA,QAAA,MAAM,eAAe,IAAA,CAAK,gBAAA,CAAiB,SAAS,SAAA,IAAa,IAAI,IAAI,CAAA;AAGzE,QAAA,IAAI,KAAA,EAAO;AACT,UAAA,MAAM,QAAA,GAAW,IAAA,CAAK,gBAAA,CAAiB,IAAA,EAAM,QAAQ,MAAM,CAAA;AAE3D,UAAA,MAAM,KAAA,CAAM,GAAA,CAAI,QAAA,EAAU,YAAA,EAAc,KAAQ,CAAA;AAAA,QAClD;AAEA,QAAA,OAAO,YAAA;AAAA,MACT,SAAS,KAAA,EAAO;AACd,QAAA,SAAA,GAAY,iBAAiB,KAAA,GAAQ,KAAA,GAAQ,IAAI,KAAA,CAAM,MAAA,CAAO,KAAK,CAAC,CAAA;AACpE,QAAA,SAAA,EAAU,EAAG,KAAA,CAAM,CAAA,2BAAA,EAA8B,OAAO,CAAA,CAAA,EAAI,WAAW,CAAA,YAAA,EAAe,IAAA,CAAK,IAAI,CAAA,CAAA,CAAA,EAAK,EAAE,KAAA,EAAO,CAAA;AAE7G,QAAA,IAAI,UAAU,WAAA,EAAa;AACzB,UAAA,MAAM,QAAQ,gBAAA,GAAmB,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,UAAU,CAAC,CAAA;AAExD,UAAA,MAAM,MAAM,KAAK,CAAA;AAAA,QACnB;AAAA,MACF;AAAA,IACF;AAEA,IAAA,MAAM,SAAA,IAAa,IAAI,KAAA,CAAM,iBAAiB,CAAA;AAAA,EAChD;AAAA;AAAA;AAAA;AAAA,EAKA,cAAA,GAAyD;AACvD,IAAA,OAAO,CAAC,GAAG,IAAA,CAAK,WAAW,CAAA;AAAA,EAC7B;AAAA;AAAA;AAAA;AAAA;AAAA,EAMQ,gBAAA,CAAiB,WAAkB,IAAA,EAAmC;AAC5E,IAAA,MAAM,WAA4B,EAAC;AAEnC,IAAA,KAAA,MAAW,QAAQ,SAAA,EAAW;AAC5B,MAAA,IAAI,IAAA,CAAK,SAAS,yBAAA,EAA2B;AAE3C,QAAA,MAAM,OAAO,IAAA,CAAK,KAAA;AAGlB,QAAA,MAAM,SAAA,GAAY,IAAA,CAAK,OAAA,CAAQ,KAAA,CAAM,IAAI,CAAA,CAAE,MAAA;AAC3C,QAAA,MAAM,IAAA,GAAO,OAAO,IAAA,CAAK,IAAA,KAAS,QAAA,GAAW,KAAK,IAAA,GAAO,QAAA,CAAS,IAAA,CAAK,IAAA,EAAM,EAAE,CAAA;AAC/E,QAAA,IAAI,MAAM,IAAI,CAAA,IAAK,IAAA,GAAO,CAAA,IAAK,OAAO,SAAA,EAAW;AAC/C,UAAA,SAAA,EAAU,EAAG,MAAM,CAAA,uCAAA,EAA0C,IAAA,CAAK,IAAI,CAAA,KAAA,EAAQ,IAAA,CAAK,IAAI,CAAA,CAAE,CAAA;AACzF,UAAA;AAAA,QACF;AAGA,QAAA,MAAM,WAAW,IAAA,CAAK,QAAA;AACtB,QAAA,IAAI,CAAC,gBAAA,CAAiB,QAAA,CAAS,QAAyB,CAAA,EAAG;AACzD,UAAA,SAAA,EAAU,EAAG,MAAM,CAAA,qCAAA,EAAwC,QAAQ,oBAAoB,IAAA,CAAK,IAAI,CAAA,CAAA,EAAI,IAAI,CAAA,CAAE,CAAA;AAC1G,UAAA;AAAA,QACF;AAGA,QAAA,MAAM,iBAAA,GAAoB,MAAA,CAAO,IAAA,CAAK,iBAAA,IAAqB,SAAS,CAAA,CACjE,OAAA,CAAQ,iBAAA,EAAmB,GAAG,CAAA,CAC9B,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA;AAEd,QAAA,QAAA,CAAS,IAAA,CAAK;AAAA,UACZ,EAAA,EAAI,IAAA,CAAK,cAAA,CAAe,IAAA,EAAM,MAAM,KAAK,CAAA;AAAA,UACzC,MAAA,EAAQ,gBAAgB,iBAAiB,CAAA,CAAA;AAAA,UACzC,IAAA,EAAM,UAAA;AAAA,UACN,QAAA;AAAA,UACA,UAAA,EAAY,QAAA;AAAA;AAAA,UAEZ,MAAM,IAAA,CAAK,IAAA;AAAA,UACX,IAAA;AAAA,UAEA,OAAA,EAAS,CAAA,CAAA,EAAI,iBAAiB,CAAA,EAAA,EAAK,MAAA,CAAO,IAAA,CAAK,OAAA,IAAW,EAAE,CAAA,CAAE,KAAA,CAAM,CAAA,EAAG,GAAG,CAAC,CAAA,CAAA;AAAA,UAC3E,UAAA,EAAY,IAAA,CAAK,UAAA,GAAa,MAAA,CAAO,IAAA,CAAK,UAAU,CAAA,CAAE,KAAA,CAAM,CAAA,EAAG,GAAI,CAAA,GAAI,MAAA;AAAA,UACvE,SAAA,EAAW,IAAA,CAAK,MAAA,GAAS,CAAA,QAAA,EAAW,MAAA,CAAO,IAAA,CAAK,MAAM,CAAA,CAAE,KAAA,CAAM,CAAA,EAAG,GAAG,CAAC,CAAA,CAAA,GAAK,MAAA;AAAA,UAE1E,MAAA,EAAQ,KAAA;AAAA,UACR,MAAA,EAAQ,cAAA;AAAA;AAAA,UAGR,KAAA,EAAO,OAAA;AAAA,UACP,SAAA,EAAW;AAAA;AAAA,SACZ,CAAA;AAAA,MACH;AAAA,IACF;AAEA,IAAA,OAAO,QAAA;AAAA,EACT;AACF","file":"security-analyzer.js","sourcesContent":["/**\n * @module @kb-labs/review-llm/prompts/security\n * Security review prompts\n */\n\nimport type { ReviewContext, ParsedFile } from '@kb-labs/review-contracts';\n\n/**\n * Build system prompt with context\n */\nexport function buildSystemPrompt(context: ReviewContext): string {\n  const sections: string[] = [\n    'You are an expert security auditor specializing in application security.',\n    '',\n    '**Your role:**',\n    '- Identify security vulnerabilities and weaknesses',\n    '- Check for common security anti-patterns (OWASP Top 10)',\n    '- Suggest secure coding practices with clear rationale',\n    '',\n    '**CRITICAL RULES:**',\n    '1. ONLY report security issues that exist in the provided code',\n    '2. Reference line numbers that actually exist in the file',\n    '3. Quote exact code snippets when referencing issues',\n    '4. Classify severity accurately (error = exploitable, warning = weakness)',\n    '5. Provide concrete, actionable mitigation steps',\n    '',\n    '**Focus areas:**',\n    '- SQL injection, XSS, CSRF',\n    '- Authentication/authorization bypass',\n    '- Insecure cryptography',\n    '- Secrets in code',\n    '- Command injection',\n    '- Path traversal',\n    '- Unsafe deserialization',\n    '',\n  ];\n\n  // Add all project conventions\n  for (const [category, content] of Object.entries(context.conventions)) {\n    sections.push(`**Project Conventions (${category}):**`);\n    sections.push(content);\n    sections.push('');\n  }\n\n  // Add task context (if reviewing a specific task)\n  if (context.taskContext) {\n    sections.push('**Current Task Context:**');\n    sections.push(context.taskContext);\n    sections.push('');\n    sections.push('IMPORTANT: Pay special attention to security implications in the context of this task.');\n    sections.push('');\n  }\n\n  // Add repo scope (if multi-repo review)\n  if (context.repoScope && context.repoScope.length > 0) {\n    sections.push('**Repositories in Scope:**');\n    sections.push(context.repoScope.map((r) => `- ${r}`).join('\\n'));\n    sections.push('');\n    sections.push('NOTE: Check for security issues that may arise from cross-repo interactions.');\n    sections.push('');\n  }\n\n  sections.push('Use the report_security_finding tool to report vulnerabilities.');\n\n  return sections.join('\\n');\n}\n\n/**\n * Build user prompt for file analysis\n */\nexport function analyzeFile(file: ParsedFile): string {\n  const lines = file.content.split('\\n');\n  const numbered = lines\n    .map((line, idx) => `${idx + 1}: ${line}`)\n    .join('\\n');\n\n  return `Review this file for security vulnerabilities:\\n\\n` +\n    `File: ${file.path}\\n` +\n    `Language: ${file.language}\\n\\n` +\n    `\\`\\`\\`${file.language}\\n${numbered}\\n\\`\\`\\`\\n\\n` +\n    `Report any security vulnerabilities or weaknesses. Focus on exploitable issues.`;\n}\n","/**\n * @module @kb-labs/review-llm/analyzers/security-analyzer\n * Security vulnerability analyzer using LLM with tool calling\n */\n\nimport type { ReviewFinding, ParsedFile, ReviewContext } from '@kb-labs/review-contracts';\nimport { BaseLLMAnalyzer } from '@kb-labs/review-contracts';\nimport { useLLM, useCache, useAnalytics, useLogger } from '@kb-labs/sdk';\nimport * as securityPrompts from '../prompts/security.prompts.js';\n\n/**\n * Tool schema for security findings (structured output)\n */\nconst SECURITY_FINDING_TOOL = {\n  name: 'report_security_finding',\n  description: 'Report a security vulnerability or weakness',\n  inputSchema: {\n    type: 'object',\n    properties: {\n      severity: {\n        type: 'string',\n        enum: ['blocker', 'high', 'medium', 'low'],\n        description: 'Severity level (blocker=exploitable, high=serious weakness)',\n      },\n      vulnerabilityType: {\n        type: 'string',\n        description: 'Type of vulnerability (e.g., SQL injection, XSS, CSRF)',\n      },\n      message: {\n        type: 'string',\n        description: 'Clear description of the security issue',\n      },\n      line: {\n        type: 'number',\n        description: 'Line number where vulnerability occurs',\n      },\n      mitigation: {\n        type: 'string',\n        description: 'Concrete mitigation steps with code example',\n      },\n      impact: {\n        type: 'string',\n        description: 'Potential impact if exploited',\n      },\n    },\n    required: ['severity', 'vulnerabilityType', 'message', 'line', 'mitigation', 'impact'],\n  },\n} as const;\n\n/** Valid severity values */\nconst VALID_SEVERITIES = ['blocker', 'high', 'medium', 'low'] as const;\ntype ValidSeverity = (typeof VALID_SEVERITIES)[number];\n\n/** Retry configuration */\nconst MAX_RETRIES = 3;\nconst INITIAL_DELAY_MS = 1000;\n\n/** Batch size for parallel file processing */\nconst BATCH_SIZE = 5;\n\n/**\n * Sleep helper for retry delays\n */\nfunction sleep(ms: number): Promise<void> {\n  return new Promise(resolve => { setTimeout(resolve, ms); });\n}\n\n/**\n * Security analyzer\n * Uses LLM with tool calling for structured findings\n */\nexport class SecurityAnalyzer extends BaseLLMAnalyzer {\n  readonly id = 'security';\n  readonly name = 'Security Analysis';\n\n  /** Track failed files for reporting */\n  private failedFiles: Array<{ file: string; error: string }> = [];\n\n  async analyze(files: ParsedFile[], context: ReviewContext): Promise<ReviewFinding[]> {\n    const findings: ReviewFinding[] = [];\n    const cache = useCache();\n    this.failedFiles = [];\n\n    // Separate cached files from files needing analysis\n    const filesToAnalyze: ParsedFile[] = [];\n\n    for (const file of files) {\n      const cacheKey = this.generateCacheKey(file, context.preset);\n\n      if (cache) {\n        // eslint-disable-next-line no-await-in-loop -- Sequential cache check before batching\n        const cached = await cache.get<ReviewFinding[]>(cacheKey);\n        if (cached) {\n          findings.push(...cached);\n          continue;\n        }\n      }\n\n      filesToAnalyze.push(file);\n    }\n\n    // Process files in batches for controlled parallelism\n    for (let i = 0; i < filesToAnalyze.length; i += BATCH_SIZE) {\n      const batch = filesToAnalyze.slice(i, i + BATCH_SIZE);\n\n      // Process batch in parallel\n      // eslint-disable-next-line no-await-in-loop -- Intentional batching to limit concurrency\n      const batchResults = await Promise.allSettled(\n        batch.map(file => this.analyzeFile(file, context, cache))\n      );\n\n      // Collect results\n      for (let j = 0; j < batchResults.length; j++) {\n        const result = batchResults[j]!;\n        const file = batch[j]!;\n\n        if (result.status === 'fulfilled') {\n          findings.push(...result.value);\n        } else {\n          this.failedFiles.push({ file: file.path, error: result.reason?.message ?? 'Unknown error' });\n        }\n      }\n    }\n\n    // Log summary of failures if any\n    if (this.failedFiles.length > 0) {\n      useLogger()?.debug(`[SecurityAnalyzer] Failed to analyze ${this.failedFiles.length} file(s):`, {\n        files: this.failedFiles,\n      });\n    }\n\n    return findings;\n  }\n\n  /**\n   * Analyze a single file with retry logic\n   */\n  private async analyzeFile(\n    file: ParsedFile,\n    context: ReviewContext,\n    cache: ReturnType<typeof useCache>\n  ): Promise<ReviewFinding[]> {\n    const analytics = useAnalytics();\n    const systemPrompt = securityPrompts.buildSystemPrompt(context);\n    const userPrompt = securityPrompts.analyzeFile(file);\n\n    const llm = useLLM({ tier: 'medium' });\n    if (!llm?.chatWithTools) {\n      throw new Error('LLM not configured or does not support tool calling');\n    }\n\n    // Retry with exponential backoff\n    let lastError: Error | null = null;\n    for (let attempt = 1; attempt <= MAX_RETRIES; attempt++) {\n      try {\n        // eslint-disable-next-line no-await-in-loop -- Retry loop requires sequential attempts\n        const response = await llm.chatWithTools(\n          [\n            { role: 'system', content: systemPrompt },\n            { role: 'user', content: userPrompt },\n          ],\n          {\n            tools: [SECURITY_FINDING_TOOL],\n            temperature: 0.1,\n          }\n        );\n\n        // Track analytics\n        if (analytics) {\n          // eslint-disable-next-line no-await-in-loop -- Analytics tracking in retry loop\n          await analytics.track('review.security.complete', {\n            file: file.path,\n            tokensUsed: response.usage.promptTokens + response.usage.completionTokens,\n            toolCalls: response.toolCalls?.length ?? 0,\n            attempts: attempt,\n          });\n        }\n\n        // Process tool calls\n        const fileFindings = this.processToolCalls(response.toolCalls || [], file);\n\n        // Cache results (24 hours)\n        if (cache) {\n          const cacheKey = this.generateCacheKey(file, context.preset);\n          // eslint-disable-next-line no-await-in-loop -- Cache storage in retry loop\n          await cache.set(cacheKey, fileFindings, 86400000);\n        }\n\n        return fileFindings;\n      } catch (error) {\n        lastError = error instanceof Error ? error : new Error(String(error));\n        useLogger()?.debug(`[SecurityAnalyzer] Attempt ${attempt}/${MAX_RETRIES} failed for ${file.path}:`, { error });\n\n        if (attempt < MAX_RETRIES) {\n          const delay = INITIAL_DELAY_MS * Math.pow(2, attempt - 1);\n          // eslint-disable-next-line no-await-in-loop -- Intentional delay between retry attempts\n          await sleep(delay);\n        }\n      }\n    }\n\n    throw lastError ?? new Error('Analysis failed');\n  }\n\n  /**\n   * Get list of files that failed analysis\n   */\n  getFailedFiles(): Array<{ file: string; error: string }> {\n    return [...this.failedFiles];\n  }\n\n  /**\n   * Process LLM tool calls into ReviewFindings\n   */\n  // eslint-disable-next-line sonarjs/cognitive-complexity -- Complex validation and mapping of LLM tool call results to structured findings\n  private processToolCalls(toolCalls: any[], file: ParsedFile): ReviewFinding[] {\n    const findings: ReviewFinding[] = [];\n\n    for (const call of toolCalls) {\n      if (call.name === 'report_security_finding') {\n         \n        const args = call.input as any;\n\n        // Validate line number\n        const lineCount = file.content.split('\\n').length;\n        const line = typeof args.line === 'number' ? args.line : parseInt(args.line, 10);\n        if (isNaN(line) || line < 1 || line > lineCount) {\n          useLogger()?.debug(`[SecurityAnalyzer] Invalid line number ${args.line} for ${file.path}`);\n          continue;\n        }\n\n        // Validate severity (reject invalid values instead of normalizing)\n        const severity = args.severity as string;\n        if (!VALID_SEVERITIES.includes(severity as ValidSeverity)) {\n          useLogger()?.debug(`[SecurityAnalyzer] Invalid severity \"${severity}\" for finding in ${file.path}:${line}`);\n          continue;\n        }\n\n        // Sanitize vulnerability type (alphanumeric, dash, underscore only)\n        const vulnerabilityType = String(args.vulnerabilityType || 'unknown')\n          .replace(/[^a-zA-Z0-9_-]/g, '_')\n          .slice(0, 50);\n\n        findings.push({\n          id: this.buildFindingId(file, line, 'sec'),\n          ruleId: `llm:security:${vulnerabilityType}`,\n          type: 'security',\n          severity: severity as ValidSeverity,\n          confidence: 'likely', // LLM findings are \"likely\", not \"certain\"\n\n          file: file.path,\n          line,\n\n          message: `[${vulnerabilityType}] ${String(args.message || '').slice(0, 500)}`,\n          suggestion: args.mitigation ? String(args.mitigation).slice(0, 1000) : undefined,\n          rationale: args.impact ? `Impact: ${String(args.impact).slice(0, 500)}` : undefined,\n\n          engine: 'llm',\n          source: 'llm-security',\n\n          // For agent mode gating\n          scope: 'local',\n          automated: false, // Security fixes need human review\n        });\n      }\n    }\n\n    return findings;\n  }\n}\n"]}