@kb-labs/review-llm 0.5.0

package/dist/index.js

@@ -0,0 +1,2020 @@
+import { BaseLLMAnalyzer } from '@kb-labs/review-contracts';
+export { BaseLLMAnalyzer } from '@kb-labs/review-contracts';
+import { useCache, useAnalytics, useLLM, useLogger, useConfig } from '@kb-labs/sdk';
+import * as path from 'path';
+import { readFile, access, readdir } from 'fs/promises';
+
+// src/index.ts
+
+// src/prompts/architecture.prompts.ts
+function buildSystemPrompt(context) {
+  const sections = [
+    "You are an expert code reviewer specializing in software architecture.",
+    "",
+    "**Your role:**",
+    "- Identify architecture violations and anti-patterns",
+    "- Check adherence to project conventions",
+    "- Suggest improvements with clear rationale",
+    "",
+    "**CRITICAL RULES:**",
+    "1. ONLY report issues that exist in the provided code",
+    "2. Reference line numbers that actually exist in the file",
+    "3. Quote exact code snippets when referencing issues",
+    "4. Provide concrete, actionable suggestions",
+    "5. Reference project conventions and ADRs when applicable",
+    ""
+  ];
+  for (const [category, content] of Object.entries(context.conventions)) {
+    sections.push(`**Project Conventions (${category}):**`);
+    sections.push(content);
+    sections.push("");
+  }
+  if (context.taskContext) {
+    sections.push("**Current Task Context:**");
+    sections.push(context.taskContext);
+    sections.push("");
+    sections.push("IMPORTANT: Evaluate architecture decisions in the context of this specific task.");
+    sections.push("");
+  }
+  if (context.repoScope && context.repoScope.length > 0) {
+    sections.push("**Repositories in Scope:**");
+    sections.push(context.repoScope.map((r) => `- ${r}`).join("\n"));
+    sections.push("");
+    sections.push("NOTE: Changes may span multiple repositories as part of one logical task.");
+    sections.push("");
+  }
+  if (context.relatedADRs.length > 0) {
+    sections.push("**Related Architecture Decisions:**");
+    for (const adr of context.relatedADRs) {
+      sections.push(`- ${adr.id}: ${adr.title} - ${adr.summary}`);
+    }
+    sections.push("");
+  }
+  if (context.examples.length > 0) {
+    sections.push("**Examples from codebase (informative, not normative):**");
+    for (const ex of context.examples.slice(0, 3)) {
+      sections.push(`- ${ex.file}: ${ex.description}`);
+    }
+    sections.push("");
+  }
+  sections.push("Use the report_architecture_finding tool to report issues.");
+  return sections.join("\n");
+}
+function analyzeFile(file) {
+  const lines = file.content.split("\n");
+  const numbered = lines.map((line, idx) => `${idx + 1}: ${line}`).join("\n");
+  return `Review this file for architecture issues:
+
+File: ${file.path}
+Language: ${file.language}
+
+\`\`\`${file.language}
+${numbered}
+\`\`\`
+
+Report any architecture violations, anti-patterns, or violations of project conventions.`;
+}
+
+// src/analyzers/architecture-analyzer.ts
+var ARCHITECTURE_FINDING_TOOL = {
+  name: "report_architecture_finding",
+  description: "Report an architecture issue or suggestion",
+  inputSchema: {
+    type: "object",
+    properties: {
+      severity: {
+        type: "string",
+        enum: ["error", "warning", "info"],
+        description: "Severity level of the finding"
+      },
+      message: {
+        type: "string",
+        description: "Clear description of the architecture issue"
+      },
+      line: {
+        type: "number",
+        description: "Line number where issue occurs (must exist in file)"
+      },
+      suggestion: {
+        type: "string",
+        description: "Concrete fix suggestion with code example"
+      },
+      rationale: {
+        type: "string",
+        description: "Why this is an issue (reference conventions/ADRs if applicable)"
+      }
+    },
+    required: ["severity", "message", "line", "suggestion", "rationale"]
+  }
+};
+function mapSeverity(llmSeverity) {
+  switch (llmSeverity) {
+    case "error":
+      return "high";
+    case "warning":
+      return "medium";
+    case "info":
+      return "info";
+    default:
+      return "medium";
+  }
+}
+var ArchitectureAnalyzer = class extends BaseLLMAnalyzer {
+  id = "architecture";
+  name = "Architecture Analysis";
+  // eslint-disable-next-line sonarjs/cognitive-complexity -- Complex LLM-based analysis with caching, error handling, and result validation
+  async analyze(files, context) {
+    const findings = [];
+    const cache = useCache();
+    const analytics = useAnalytics();
+    for (const file of files) {
+      const cacheKey = this.generateCacheKey(file, context.preset);
+      if (cache) {
+        const cached = await cache.get(cacheKey);
+        if (cached) {
+          findings.push(...cached);
+          continue;
+        }
+      }
+      const systemPrompt = buildSystemPrompt(context);
+      const userPrompt = analyzeFile(file);
+      const llm = useLLM({ tier: "medium" });
+      if (!llm?.chatWithTools) {
+        throw new Error("LLM not configured or does not support tool calling");
+      }
+      try {
+        const response = await llm.chatWithTools(
+          [
+            { role: "system", content: systemPrompt },
+            { role: "user", content: userPrompt }
+          ],
+          {
+            tools: [ARCHITECTURE_FINDING_TOOL],
+            temperature: 0.2
+            // Low temp for consistency
+          }
+        );
+        if (!response || typeof response !== "object") {
+          useLogger()?.debug(`[ArchitectureAnalyzer] Invalid response from LLM for ${file.path}`);
+          continue;
+        }
+        if (analytics && response.usage) {
+          await analytics.track("review.architecture.complete", {
+            file: file.path,
+            tokensUsed: (response.usage.promptTokens ?? 0) + (response.usage.completionTokens ?? 0),
+            toolCalls: response.toolCalls?.length ?? 0
+          });
+        }
+        const fileFindings = this.processToolCalls(response.toolCalls || [], file);
+        findings.push(...fileFindings);
+        if (cache) {
+          await cache.set(cacheKey, fileFindings, 864e5);
+        }
+      } catch (error) {
+        const errorMessage = error instanceof Error ? error.message : String(error);
+        const errorName = error instanceof Error ? error.name : "UnknownError";
+        useLogger()?.debug(`[ArchitectureAnalyzer] Failed to analyze ${file.path}:`, {
+          error,
+          errorName,
+          errorMessage
+        });
+        continue;
+      }
+    }
+    return findings;
+  }
+  /**
+   * Process LLM tool calls into ReviewFindings
+   */
+  processToolCalls(toolCalls, file) {
+    const findings = [];
+    for (const call of toolCalls) {
+      if (call.name === "report_architecture_finding") {
+        const args = call.input;
+        const lineCount = file.content.split("\n").length;
+        const line = typeof args.line === "number" ? args.line : parseInt(args.line, 10);
+        if (isNaN(line) || line < 1 || line > lineCount) {
+          useLogger()?.debug(`[ArchitectureAnalyzer] Invalid line number ${args.line} for ${file.path}`);
+          continue;
+        }
+        const severity = mapSeverity(String(args.severity || "warning"));
+        findings.push({
+          id: this.buildFindingId(file, line, "arch"),
+          ruleId: "llm:architecture",
+          type: "architecture",
+          severity,
+          confidence: "likely",
+          // LLM findings are "likely", not "certain"
+          file: file.path,
+          line,
+          message: String(args.message || "").slice(0, 500),
+          suggestion: args.suggestion ? String(args.suggestion).slice(0, 1e3) : void 0,
+          rationale: args.rationale ? String(args.rationale).slice(0, 500) : void 0,
+          engine: "llm",
+          source: "llm-architecture",
+          // For agent mode gating
+          scope: "local",
+          // Architecture can be local or global
+          automated: false
+          // LLM suggestions need human review
+        });
+      }
+    }
+    return findings;
+  }
+};
+
+// src/prompts/security.prompts.ts
+function buildSystemPrompt2(context) {
+  const sections = [
+    "You are an expert security auditor specializing in application security.",
+    "",
+    "**Your role:**",
+    "- Identify security vulnerabilities and weaknesses",
+    "- Check for common security anti-patterns (OWASP Top 10)",
+    "- Suggest secure coding practices with clear rationale",
+    "",
+    "**CRITICAL RULES:**",
+    "1. ONLY report security issues that exist in the provided code",
+    "2. Reference line numbers that actually exist in the file",
+    "3. Quote exact code snippets when referencing issues",
+    "4. Classify severity accurately (error = exploitable, warning = weakness)",
+    "5. Provide concrete, actionable mitigation steps",
+    "",
+    "**Focus areas:**",
+    "- SQL injection, XSS, CSRF",
+    "- Authentication/authorization bypass",
+    "- Insecure cryptography",
+    "- Secrets in code",
+    "- Command injection",
+    "- Path traversal",
+    "- Unsafe deserialization",
+    ""
+  ];
+  for (const [category, content] of Object.entries(context.conventions)) {
+    sections.push(`**Project Conventions (${category}):**`);
+    sections.push(content);
+    sections.push("");
+  }
+  if (context.taskContext) {
+    sections.push("**Current Task Context:**");
+    sections.push(context.taskContext);
+    sections.push("");
+    sections.push("IMPORTANT: Pay special attention to security implications in the context of this task.");
+    sections.push("");
+  }
+  if (context.repoScope && context.repoScope.length > 0) {
+    sections.push("**Repositories in Scope:**");
+    sections.push(context.repoScope.map((r) => `- ${r}`).join("\n"));
+    sections.push("");
+    sections.push("NOTE: Check for security issues that may arise from cross-repo interactions.");
+    sections.push("");
+  }
+  sections.push("Use the report_security_finding tool to report vulnerabilities.");
+  return sections.join("\n");
+}
+function analyzeFile2(file) {
+  const lines = file.content.split("\n");
+  const numbered = lines.map((line, idx) => `${idx + 1}: ${line}`).join("\n");
+  return `Review this file for security vulnerabilities:
+
+File: ${file.path}
+Language: ${file.language}
+
+\`\`\`${file.language}
+${numbered}
+\`\`\`
+
+Report any security vulnerabilities or weaknesses. Focus on exploitable issues.`;
+}
+
+// src/analyzers/security-analyzer.ts
+var SECURITY_FINDING_TOOL = {
+  name: "report_security_finding",
+  description: "Report a security vulnerability or weakness",
+  inputSchema: {
+    type: "object",
+    properties: {
+      severity: {
+        type: "string",
+        enum: ["blocker", "high", "medium", "low"],
+        description: "Severity level (blocker=exploitable, high=serious weakness)"
+      },
+      vulnerabilityType: {
+        type: "string",
+        description: "Type of vulnerability (e.g., SQL injection, XSS, CSRF)"
+      },
+      message: {
+        type: "string",
+        description: "Clear description of the security issue"
+      },
+      line: {
+        type: "number",
+        description: "Line number where vulnerability occurs"
+      },
+      mitigation: {
+        type: "string",
+        description: "Concrete mitigation steps with code example"
+      },
+      impact: {
+        type: "string",
+        description: "Potential impact if exploited"
+      }
+    },
+    required: ["severity", "vulnerabilityType", "message", "line", "mitigation", "impact"]
+  }
+};
+var VALID_SEVERITIES = ["blocker", "high", "medium", "low"];
+var MAX_RETRIES = 3;
+var INITIAL_DELAY_MS = 1e3;
+var BATCH_SIZE = 5;
+function sleep(ms) {
+  return new Promise((resolve2) => {
+    setTimeout(resolve2, ms);
+  });
+}
+var SecurityAnalyzer = class extends BaseLLMAnalyzer {
+  id = "security";
+  name = "Security Analysis";
+  /** Track failed files for reporting */
+  failedFiles = [];
+  async analyze(files, context) {
+    const findings = [];
+    const cache = useCache();
+    this.failedFiles = [];
+    const filesToAnalyze = [];
+    for (const file of files) {
+      const cacheKey = this.generateCacheKey(file, context.preset);
+      if (cache) {
+        const cached = await cache.get(cacheKey);
+        if (cached) {
+          findings.push(...cached);
+          continue;
+        }
+      }
+      filesToAnalyze.push(file);
+    }
+    for (let i = 0; i < filesToAnalyze.length; i += BATCH_SIZE) {
+      const batch = filesToAnalyze.slice(i, i + BATCH_SIZE);
+      const batchResults = await Promise.allSettled(
+        batch.map((file) => this.analyzeFile(file, context, cache))
+      );
+      for (let j = 0; j < batchResults.length; j++) {
+        const result = batchResults[j];
+        const file = batch[j];
+        if (result.status === "fulfilled") {
+          findings.push(...result.value);
+        } else {
+          this.failedFiles.push({ file: file.path, error: result.reason?.message ?? "Unknown error" });
+        }
+      }
+    }
+    if (this.failedFiles.length > 0) {
+      useLogger()?.debug(`[SecurityAnalyzer] Failed to analyze ${this.failedFiles.length} file(s):`, {
+        files: this.failedFiles
+      });
+    }
+    return findings;
+  }
+  /**
+   * Analyze a single file with retry logic
+   */
+  async analyzeFile(file, context, cache) {
+    const analytics = useAnalytics();
+    const systemPrompt = buildSystemPrompt2(context);
+    const userPrompt = analyzeFile2(file);
+    const llm = useLLM({ tier: "medium" });
+    if (!llm?.chatWithTools) {
+      throw new Error("LLM not configured or does not support tool calling");
+    }
+    let lastError = null;
+    for (let attempt = 1; attempt <= MAX_RETRIES; attempt++) {
+      try {
+        const response = await llm.chatWithTools(
+          [
+            { role: "system", content: systemPrompt },
+            { role: "user", content: userPrompt }
+          ],
+          {
+            tools: [SECURITY_FINDING_TOOL],
+            temperature: 0.1
+          }
+        );
+        if (analytics) {
+          await analytics.track("review.security.complete", {
+            file: file.path,
+            tokensUsed: response.usage.promptTokens + response.usage.completionTokens,
+            toolCalls: response.toolCalls?.length ?? 0,
+            attempts: attempt
+          });
+        }
+        const fileFindings = this.processToolCalls(response.toolCalls || [], file);
+        if (cache) {
+          const cacheKey = this.generateCacheKey(file, context.preset);
+          await cache.set(cacheKey, fileFindings, 864e5);
+        }
+        return fileFindings;
+      } catch (error) {
+        lastError = error instanceof Error ? error : new Error(String(error));
+        useLogger()?.debug(`[SecurityAnalyzer] Attempt ${attempt}/${MAX_RETRIES} failed for ${file.path}:`, { error });
+        if (attempt < MAX_RETRIES) {
+          const delay = INITIAL_DELAY_MS * Math.pow(2, attempt - 1);
+          await sleep(delay);
+        }
+      }
+    }
+    throw lastError ?? new Error("Analysis failed");
+  }
+  /**
+   * Get list of files that failed analysis
+   */
+  getFailedFiles() {
+    return [...this.failedFiles];
+  }
+  /**
+   * Process LLM tool calls into ReviewFindings
+   */
+  // eslint-disable-next-line sonarjs/cognitive-complexity -- Complex validation and mapping of LLM tool call results to structured findings
+  processToolCalls(toolCalls, file) {
+    const findings = [];
+    for (const call of toolCalls) {
+      if (call.name === "report_security_finding") {
+        const args = call.input;
+        const lineCount = file.content.split("\n").length;
+        const line = typeof args.line === "number" ? args.line : parseInt(args.line, 10);
+        if (isNaN(line) || line < 1 || line > lineCount) {
+          useLogger()?.debug(`[SecurityAnalyzer] Invalid line number ${args.line} for ${file.path}`);
+          continue;
+        }
+        const severity = args.severity;
+        if (!VALID_SEVERITIES.includes(severity)) {
+          useLogger()?.debug(`[SecurityAnalyzer] Invalid severity "${severity}" for finding in ${file.path}:${line}`);
+          continue;
+        }
+        const vulnerabilityType = String(args.vulnerabilityType || "unknown").replace(/[^a-zA-Z0-9_-]/g, "_").slice(0, 50);
+        findings.push({
+          id: this.buildFindingId(file, line, "sec"),
+          ruleId: `llm:security:${vulnerabilityType}`,
+          type: "security",
+          severity,
+          confidence: "likely",
+          // LLM findings are "likely", not "certain"
+          file: file.path,
+          line,
+          message: `[${vulnerabilityType}] ${String(args.message || "").slice(0, 500)}`,
+          suggestion: args.mitigation ? String(args.mitigation).slice(0, 1e3) : void 0,
+          rationale: args.impact ? `Impact: ${String(args.impact).slice(0, 500)}` : void 0,
+          engine: "llm",
+          source: "llm-security",
+          // For agent mode gating
+          scope: "local",
+          automated: false
+          // Security fixes need human review
+        });
+      }
+    }
+    return findings;
+  }
+};
+
+// src/prompts/naming.prompts.ts
+function buildSystemPrompt3(context) {
+  const sections = [
+    "You are a code quality expert specializing in naming conventions and code clarity.",
+    "",
+    "**Your role:**",
+    "- Check adherence to naming conventions",
+    "- Identify unclear or misleading names",
+    "- Suggest improvements for readability",
+    "",
+    "**CRITICAL RULES:**",
+    "1. ONLY report names that violate project conventions",
+    "2. Reference line numbers that actually exist",
+    "3. Quote exact names when referencing issues",
+    "4. Provide concrete, better alternatives",
+    "5. Focus on clarity and consistency",
+    "",
+    "**Common issues:**",
+    "- Inconsistent casing (camelCase vs snake_case)",
+    "- Abbreviations without clear meaning",
+    "- Generic names (data, temp, obj)",
+    "- Misleading names (opposite of actual behavior)",
+    ""
+  ];
+  for (const [category, content] of Object.entries(context.conventions)) {
+    sections.push(`**Project Conventions (${category}):**`);
+    sections.push(content);
+    sections.push("");
+  }
+  if (context.taskContext) {
+    sections.push("**Current Task Context:**");
+    sections.push(context.taskContext);
+    sections.push("");
+    sections.push("IMPORTANT: Consider naming in the context of this specific task and its domain.");
+    sections.push("");
+  }
+  if (context.repoScope && context.repoScope.length > 0) {
+    sections.push("**Repositories in Scope:**");
+    sections.push(context.repoScope.map((r) => `- ${r}`).join("\n"));
+    sections.push("");
+    sections.push("NOTE: Ensure naming consistency across these repositories.");
+    sections.push("");
+  }
+  sections.push("Use the report_naming_finding tool to report naming issues.");
+  return sections.join("\n");
+}
+function analyzeFile3(file) {
+  const lines = file.content.split("\n");
+  const numbered = lines.map((line, idx) => `${idx + 1}: ${line}`).join("\n");
+  return `Review this file for naming convention issues:
+
+File: ${file.path}
+Language: ${file.language}
+
+\`\`\`${file.language}
+${numbered}
+\`\`\`
+
+Report naming issues that reduce code clarity or violate conventions.`;
+}
+
+// src/analyzers/naming-analyzer.ts
+var NAMING_FINDING_TOOL = {
+  name: "report_naming_finding",
+  description: "Report a naming convention issue",
+  inputSchema: {
+    type: "object",
+    properties: {
+      severity: {
+        type: "string",
+        enum: ["warning", "info"],
+        description: "Severity level (naming issues are typically warning/info)"
+      },
+      currentName: {
+        type: "string",
+        description: "Current name that violates conventions"
+      },
+      suggestedName: {
+        type: "string",
+        description: "Suggested better name"
+      },
+      message: {
+        type: "string",
+        description: "Description of the naming issue"
+      },
+      line: {
+        type: "number",
+        description: "Line number where name appears"
+      },
+      rationale: {
+        type: "string",
+        description: "Why the current name is problematic"
+      }
+    },
+    required: ["severity", "currentName", "suggestedName", "message", "line", "rationale"]
+  }
+};
+var NamingAnalyzer = class extends BaseLLMAnalyzer {
+  id = "naming";
+  name = "Naming Conventions";
+  async analyze(files, context) {
+    const findings = [];
+    const cache = useCache();
+    const analytics = useAnalytics();
+    for (const file of files) {
+      const cacheKey = this.generateCacheKey(file, context.preset);
+      if (cache) {
+        const cached = await cache.get(cacheKey);
+        if (cached) {
+          findings.push(...cached);
+          continue;
+        }
+      }
+      const systemPrompt = buildSystemPrompt3(context);
+      const userPrompt = analyzeFile3(file);
+      const llm = useLLM({ tier: "small" });
+      if (!llm?.chatWithTools) {
+        throw new Error("LLM not configured or does not support tool calling");
+      }
+      try {
+        const response = await llm.chatWithTools(
+          [
+            { role: "system", content: systemPrompt },
+            { role: "user", content: userPrompt }
+          ],
+          {
+            tools: [NAMING_FINDING_TOOL],
+            temperature: 0.2
+            // Low temp for consistency
+          }
+        );
+        if (analytics) {
+          await analytics.track("review.naming.complete", {
+            file: file.path,
+            tokensUsed: response.usage.promptTokens + response.usage.completionTokens,
+            toolCalls: response.toolCalls?.length ?? 0
+          });
+        }
+        const fileFindings = this.processToolCalls(response.toolCalls || [], file);
+        findings.push(...fileFindings);
+        if (cache) {
+          await cache.set(cacheKey, fileFindings, 864e5);
+        }
+      } catch (error) {
+        useLogger()?.debug(`[NamingAnalyzer] Failed to analyze ${file.path}:`, { error });
+        continue;
+      }
+    }
+    return findings;
+  }
+  /**
+   * Process LLM tool calls into ReviewFindings
+   */
+  processToolCalls(toolCalls, file) {
+    const findings = [];
+    for (const call of toolCalls) {
+      if (call.name === "report_naming_finding") {
+        const args = call.input;
+        const lineCount = file.content.split("\n").length;
+        const line = typeof args.line === "number" ? args.line : parseInt(args.line, 10);
+        if (isNaN(line) || line < 1 || line > lineCount) {
+          useLogger()?.debug(`[NamingAnalyzer] Invalid line number ${args.line} for ${file.path}`);
+          continue;
+        }
+        const severity = args.severity === "warning" ? "medium" : "info";
+        const currentName = String(args.currentName || "").slice(0, 100);
+        const suggestedName = String(args.suggestedName || "").slice(0, 100);
+        findings.push({
+          id: this.buildFindingId(file, line, "naming"),
+          ruleId: "llm:naming",
+          type: "style",
+          severity,
+          confidence: "heuristic",
+          // Naming is subjective, low confidence
+          file: file.path,
+          line,
+          message: String(args.message || "").slice(0, 500),
+          suggestion: `Rename '${currentName}' to '${suggestedName}'`,
+          rationale: args.rationale ? String(args.rationale).slice(0, 500) : void 0,
+          engine: "llm",
+          source: "llm-naming",
+          // For agent mode gating
+          scope: "local",
+          automated: false
+          // Naming suggestions are optional
+        });
+      }
+    }
+    return findings;
+  }
+};
+function buildToolDefinitions(validCategories, validRuleIds = []) {
+  const ruleIdDescription = validRuleIds.length > 0 ? `Rule ID if matches a project rule. Available rules: ${validRuleIds.join(", ")}. Use null if finding doesn't match any rule.` : 'Rule ID if matches project rule (e.g., "security/no-eval"), null if ad-hoc finding';
+  return [
+    {
+      name: "get_diffs",
+      description: `Get git diffs for multiple files at once.
+Use this to see what changed in files that look suspicious.
+Select files based on: file names, change size (+lines/-lines), whether new/modified.
+Prefer files most likely to have issues (security-sensitive, complex logic, etc).`,
+      parameters: {
+        type: "object",
+        properties: {
+          files: {
+            type: "array",
+            items: { type: "string" },
+            maxItems: 15,
+            description: "File paths from the list (max 15 per call)"
+          }
+        },
+        required: ["files"]
+      }
+    },
+    {
+      name: "get_file_chunks",
+      description: `Get specific portions of files when diff alone isn't enough.
+Use when you need to see:
+- Code around a suspicious change (function context)
+- Definition that a change references
+- Import statements to understand dependencies
+Use sparingly - prefer analyzing diffs first.`,
+      parameters: {
+        type: "object",
+        properties: {
+          requests: {
+            type: "array",
+            items: {
+              type: "object",
+              properties: {
+                file: { type: "string" },
+                startLine: { type: "integer", description: "Start line (1-indexed)" },
+                endLine: { type: "integer", description: "End line (max startLine + 100)" }
+              },
+              required: ["file"]
+            },
+            maxItems: 5,
+            description: "Chunk requests (max 5 total across all calls)"
+          }
+        },
+        required: ["requests"]
+      }
+    },
+    {
+      name: "report_findings",
+      description: `Report all code review findings. Call once when done analyzing.
+Only report actual issues found in the code you reviewed - not hypotheticals.
+Include specific line numbers from the diffs you analyzed.
+Provide code snippets to help with verification.
+IMPORTANT: If a finding matches a project rule, you MUST include the exact ruleId from the list.`,
+      parameters: {
+        type: "object",
+        properties: {
+          findings: {
+            type: "array",
+            items: {
+              type: "object",
+              properties: {
+                file: { type: "string", description: "File path" },
+                line: { type: "integer", description: "Line number (from diff)" },
+                endLine: { type: "integer", description: "End line for ranges (optional)" },
+                severity: {
+                  type: "string",
+                  enum: ["blocker", "high", "medium", "low", "info"]
+                },
+                category: {
+                  type: "string",
+                  enum: validCategories.length > 0 ? validCategories : void 0,
+                  description: validCategories.length > 0 ? `Category must be one of: ${validCategories.join(", ")}` : "Category from project rules"
+                },
+                message: { type: "string", description: "Clear description of the issue" },
+                suggestion: { type: "string", description: "How to fix (optional)" },
+                codeSnippet: { type: "string", description: "Problematic code from diff" },
+                ruleId: {
+                  type: ["string", "null"],
+                  description: ruleIdDescription
+                }
+              },
+              required: ["file", "line", "severity", "category", "message"]
+            }
+          },
+          summary: {
+            type: "string",
+            description: "Brief summary of review findings"
+          }
+        },
+        required: ["findings"]
+      }
+    }
+  ];
+}
+var DEFAULT_BUDGET = {
+  maxDiffCalls: 2,
+  maxFilesPerDiff: 15,
+  maxChunkCalls: 2,
+  maxTotalChunks: 5,
+  maxLinesPerChunk: 100,
+  usage: {
+    diffCalls: 0,
+    filesRequested: 0,
+    chunkCalls: 0,
+    totalChunks: 0
+  }
+};
+var ToolExecutor = class {
+  diffProvider;
+  cwd;
+  budget;
+  changedFiles;
+  fetchedDiffs = /* @__PURE__ */ new Map();
+  constructor(cwd, changedFiles, diffProvider, budget) {
+    this.cwd = cwd;
+    this.diffProvider = diffProvider;
+    this.changedFiles = new Set(changedFiles);
+    this.budget = {
+      ...DEFAULT_BUDGET,
+      ...budget,
+      usage: { ...DEFAULT_BUDGET.usage }
+    };
+  }
+  /**
+   * Execute a tool call
+   */
+  async execute(toolCall) {
+    try {
+      switch (toolCall.name) {
+        case "get_diffs":
+          return await this.executeGetDiffs(toolCall.arguments);
+        case "get_file_chunks":
+          return await this.executeGetFileChunks(
+            toolCall.arguments
+          );
+        case "report_findings":
+          return this.executeReportFindings(
+            toolCall.arguments
+          );
+        default:
+          return {
+            name: toolCall.name,
+            result: null,
+            error: `Unknown tool: ${toolCall.name}`
+          };
+      }
+    } catch (error) {
+      return {
+        name: toolCall.name,
+        result: null,
+        error: error instanceof Error ? error.message : String(error)
+      };
+    }
+  }
+  /**
+   * Execute get_diffs tool
+   */
+  async executeGetDiffs(args) {
+    if (this.budget.usage.diffCalls >= this.budget.maxDiffCalls) {
+      return {
+        name: "get_diffs",
+        result: null,
+        error: `Budget exceeded: max ${this.budget.maxDiffCalls} diff calls allowed`
+      };
+    }
+    const resolvedCwd = path.resolve(this.cwd);
+    const validFiles = args.files.slice(0, this.budget.maxFilesPerDiff).filter((f) => {
+      if (!this.changedFiles.has(f)) {
+        return false;
+      }
+      const fullPath = path.resolve(this.cwd, f);
+      const relative2 = path.relative(resolvedCwd, fullPath);
+      return relative2 && !relative2.startsWith("..") && !path.isAbsolute(relative2);
+    });
+    if (validFiles.length === 0) {
+      return {
+        name: "get_diffs",
+        result: { diffs: [], message: "No valid files requested" },
+        error: void 0
+      };
+    }
+    this.budget.usage.diffCalls++;
+    this.budget.usage.filesRequested += validFiles.length;
+    const result = await this.diffProvider.getDiffs({
+      cwd: this.cwd,
+      files: validFiles,
+      staged: true,
+      unstaged: true,
+      maxLinesPerFile: 500
+    });
+    for (const diff of result.diffs) {
+      this.fetchedDiffs.set(diff.file, diff);
+    }
+    const formattedDiffs = result.diffs.map((d) => ({
+      file: d.file,
+      additions: d.additions,
+      deletions: d.deletions,
+      isNewFile: d.isNewFile,
+      diff: d.diff
+    }));
+    return {
+      name: "get_diffs",
+      result: {
+        diffs: formattedDiffs,
+        errors: result.errors,
+        budgetRemaining: {
+          diffCalls: this.budget.maxDiffCalls - this.budget.usage.diffCalls,
+          chunkCalls: this.budget.maxChunkCalls - this.budget.usage.chunkCalls
+        }
+      }
+    };
+  }
+  /**
+   * Execute get_file_chunks tool
+   */
+  async executeGetFileChunks(args) {
+    if (this.budget.usage.chunkCalls >= this.budget.maxChunkCalls) {
+      return {
+        name: "get_file_chunks",
+        result: null,
+        error: `Budget exceeded: max ${this.budget.maxChunkCalls} chunk calls allowed`
+      };
+    }
+    const remainingChunks = this.budget.maxTotalChunks - this.budget.usage.totalChunks;
+    if (remainingChunks <= 0) {
+      return {
+        name: "get_file_chunks",
+        result: null,
+        error: `Budget exceeded: max ${this.budget.maxTotalChunks} total chunks allowed`
+      };
+    }
+    const validRequests = args.requests.slice(0, remainingChunks).filter((r) => this.changedFiles.has(r.file));
+    if (validRequests.length === 0) {
+      return {
+        name: "get_file_chunks",
+        result: { chunks: [], message: "No valid files requested" }
+      };
+    }
+    this.budget.usage.chunkCalls++;
+    this.budget.usage.totalChunks += validRequests.length;
+    const chunks = [];
+    for (const request of validRequests) {
+      try {
+        const fullPath = path.resolve(this.cwd, request.file);
+        const resolvedCwd = path.resolve(this.cwd);
+        const relative2 = path.relative(resolvedCwd, fullPath);
+        if (!relative2 || relative2.startsWith("..") || path.isAbsolute(relative2)) {
+          useLogger()?.debug(`[ToolExecutor] Path traversal blocked: ${request.file}`);
+          continue;
+        }
+        const content = await readFile(fullPath, "utf-8");
+        const lines = content.split("\n");
+        const startLine = Math.max(1, request.startLine ?? 1);
+        const maxEndLine = Math.min(lines.length, startLine + this.budget.maxLinesPerChunk - 1);
+        const endLine = request.endLine ? Math.min(request.endLine, maxEndLine) : maxEndLine;
+        const chunkLines = lines.slice(startLine - 1, endLine);
+        chunks.push({
+          file: request.file,
+          startLine,
+          endLine,
+          content: chunkLines.join("\n")
+        });
+      } catch (error) {
+        useLogger()?.debug(`[ToolExecutor] Error reading ${request.file}:`, { error });
+      }
+    }
+    return {
+      name: "get_file_chunks",
+      result: {
+        chunks,
+        budgetRemaining: {
+          chunkCalls: this.budget.maxChunkCalls - this.budget.usage.chunkCalls,
+          totalChunks: this.budget.maxTotalChunks - this.budget.usage.totalChunks
+        }
+      }
+    };
+  }
+  /**
+   * Execute report_findings tool (just passes through)
+   */
+  executeReportFindings(args) {
+    return {
+      name: "report_findings",
+      result: {
+        findings: args.findings,
+        summary: args.summary,
+        accepted: true
+      }
+    };
+  }
+  /**
+   * Get fetched diffs (for verification)
+   */
+  getFetchedDiffs() {
+    return this.fetchedDiffs;
+  }
+  /**
+   * Get current budget usage
+   */
+  getBudgetUsage() {
+    return { ...this.budget.usage };
+  }
+  /**
+   * Check if a file was in the changed files list
+   */
+  isValidFile(file) {
+    return this.changedFiles.has(file);
+  }
+};
+function createToolExecutor(cwd, changedFiles, diffProvider, budget) {
+  return new ToolExecutor(cwd, changedFiles, diffProvider, budget);
+}
+var VALID_SEVERITIES2 = ["blocker", "high", "medium", "low", "info"];
+var SEVERITY_ALIASES = {
+  critical: "blocker",
+  error: "high",
+  warning: "medium",
+  warn: "medium",
+  minor: "low",
+  trivial: "info",
+  suggestion: "info",
+  hint: "info"
+};
+var SEVERITY_ORDER = ["blocker", "high", "medium", "low", "info"];
+var THRESHOLDS = {
+  KEEP: 0.7,
+  DOWNGRADE: 0.4
+};
+var SCORE_WEIGHTS = {
+  severityValid: 0.075,
+  categoryValid: 0.075,
+  fileExists: 0.2,
+  lineInBounds: 0.15,
+  lineInDiff: 0.2,
+  snippetMatch: 0.2,
+  contextValid: 0.1,
+  ruleIdValid: 0.05
+  // Bonus for using valid project rule ID
+};
+var VerificationEngine = class {
+  cwd;
+  changedFiles;
+  fetchedDiffs;
+  validCategories;
+  categoryAliases;
+  validRuleIds;
+  fileContents = /* @__PURE__ */ new Map();
+  constructor(cwd, changedFiles, fetchedDiffs, validCategories, categoryAliases = {}, validRuleIds = /* @__PURE__ */ new Set()) {
+    this.cwd = cwd;
+    this.changedFiles = new Set(changedFiles);
+    this.fetchedDiffs = fetchedDiffs;
+    this.validCategories = validCategories;
+    this.categoryAliases = categoryAliases;
+    this.validRuleIds = validRuleIds;
+  }
+  /**
+   * Verify all findings from LLM
+   */
+  async verify(findings) {
+    const verified = [];
+    const discarded = [];
+    let keptCount = 0;
+    let downgradedCount = 0;
+    for (const finding of findings) {
+      const result = await this.verifyFinding(finding);
+      if (result.action === "discard") {
+        discarded.push(result);
+      } else {
+        verified.push(result);
+        if (result.action === "keep") {
+          keptCount++;
+        } else {
+          downgradedCount++;
+        }
+      }
+    }
+    const total = findings.length;
+    const hallucinationRate = total > 0 ? discarded.length / total : 0;
+    return {
+      verified,
+      discarded,
+      stats: {
+        total,
+        kept: keptCount,
+        downgraded: downgradedCount,
+        discarded: discarded.length,
+        hallucinationRate
+      }
+    };
+  }
+  /**
+   * Verify a single finding
+   */
+  async verifyFinding(finding) {
+    const severityNorm = this.normalizeSeverity(finding.severity);
+    const categoryNorm = this.normalizeCategory(finding.category);
+    const ruleIdValid = this.validateRuleId(finding.ruleId);
+    const checks = {
+      severityValid: severityNorm.valid,
+      categoryValid: categoryNorm.valid,
+      fileExists: this.changedFiles.has(finding.file),
+      lineInBounds: await this.checkLineInBounds(finding.file, finding.line),
+      lineInDiff: this.checkLineInDiff(finding.file, finding.line),
+      snippetMatch: await this.matchSnippet(finding.file, finding.line, finding.codeSnippet),
+      contextValid: this.checkContext(finding),
+      ruleIdValid
+    };
+    const score = this.calculateScore(checks);
+    let action;
+    let adjustedSeverity;
+    if (score >= THRESHOLDS.KEEP) {
+      action = "keep";
+    } else if (score >= THRESHOLDS.DOWNGRADE) {
+      action = "downgrade";
+      adjustedSeverity = this.downgradeSeverity(severityNorm.normalized);
+    } else {
+      action = "discard";
+    }
+    const normalizedFinding = {
+      ...finding,
+      severity: adjustedSeverity ?? severityNorm.normalized,
+      category: categoryNorm.normalized
+    };
+    return {
+      finding: normalizedFinding,
+      score,
+      checks,
+      action,
+      adjustedSeverity,
+      enumNormalization: {
+        severityOriginal: finding.severity,
+        severityNormalized: severityNorm.normalized,
+        categoryOriginal: finding.category,
+        categoryNormalized: categoryNorm.normalized
+      }
+    };
+  }
+  /**
+   * Normalize severity value to RawFindingSeverity type.
+   */
+  normalizeSeverity(value) {
+    const lower = value.toLowerCase().trim();
+    if (VALID_SEVERITIES2.includes(lower)) {
+      return { valid: true, normalized: lower };
+    }
+    if (SEVERITY_ALIASES[lower]) {
+      return { valid: true, normalized: SEVERITY_ALIASES[lower] };
+    }
+    return { valid: false, normalized: "medium" };
+  }
+  /**
+   * Normalize category value
+   */
+  normalizeCategory(value) {
+    const lower = value.toLowerCase().trim();
+    if (this.validCategories.length === 0) {
+      return { valid: true, normalized: value };
+    }
+    if (this.validCategories.includes(lower)) {
+      return { valid: true, normalized: lower };
+    }
+    if (this.categoryAliases[lower]) {
+      return { valid: true, normalized: this.categoryAliases[lower] };
+    }
+    return { valid: false, normalized: this.validCategories[0] ?? "other" };
+  }
+  /**
+   * Check if line is within file bounds
+   */
+  async checkLineInBounds(file, line) {
+    if (line < 1) {
+      return false;
+    }
+    try {
+      const content = await this.getFileContent(file);
+      if (!content) {
+        return false;
+      }
+      const lineCount = content.split("\n").length;
+      return line <= lineCount;
+    } catch {
+      return false;
+    }
+  }
+  /**
+   * Check if line is in the diff (actually changed)
+   */
+  checkLineInDiff(file, line) {
+    const diff = this.fetchedDiffs.get(file);
+    if (!diff) {
+      return false;
+    }
+    return diff.changedLines.has(line);
+  }
+  /**
+   * Match code snippet against actual file content
+   */
+  async matchSnippet(file, targetLine, snippet) {
+    if (!snippet) {
+      return 0.5;
+    }
+    try {
+      const content = await this.getFileContent(file);
+      if (!content) {
+        return 0;
+      }
+      const lines = content.split("\n");
+      const windowSize = 5;
+      const start = Math.max(0, targetLine - windowSize - 1);
+      const end = Math.min(lines.length, targetLine + windowSize);
+      const window = lines.slice(start, end).join("\n");
+      if (window.includes(snippet)) {
+        return 1;
+      }
+      const trimmedSnippet = snippet.split("\n").map((l) => l.trim()).join("\n");
+      const trimmedWindow = window.split("\n").map((l) => l.trim()).join("\n");
+      if (trimmedWindow.includes(trimmedSnippet)) {
+        return 0.95;
+      }
+      if (!snippet.includes("\n")) {
+        const normalizedSnippet = this.normalizeCodeLine(snippet);
+        for (const line of lines.slice(start, end)) {
+          if (this.normalizeCodeLine(line).includes(normalizedSnippet)) {
+            return 0.9;
+          }
+        }
+      }
+      const snippetTokens = this.extractIdentifiers(snippet);
+      const windowTokens = new Set(this.extractIdentifiers(window));
+      const matchedTokens = snippetTokens.filter((t) => windowTokens.has(t));
+      const tokenScore = matchedTokens.length / Math.max(snippetTokens.length, 1);
+      return tokenScore * 0.8;
+    } catch {
+      return 0;
+    }
+  }
+  /**
+   * Normalize a single line of code (preserves strings)
+   */
+  normalizeCodeLine(line) {
+    const strings = [];
+    let normalized = line.replace(
+      /(['"`])(?:(?!\1)[^\\]|\\.)*\1/g,
+      (match) => {
+        strings.push(match);
+        return `__STR${strings.length - 1}__`;
+      }
+    );
+    normalized = normalized.replace(/\s+/g, " ").trim();
+    strings.forEach((str, i) => {
+      normalized = normalized.replace(`__STR${i}__`, str);
+    });
+    return normalized;
+  }
+  /**
+   * Extract identifiers from code
+   */
+  extractIdentifiers(code) {
+    const matches = code.match(/[a-zA-Z_$][a-zA-Z0-9_$]*/g) || [];
+    const keywords = /* @__PURE__ */ new Set([
+      "const",
+      "let",
+      "var",
+      "function",
+      "class",
+      "if",
+      "else",
+      "for",
+      "while",
+      "return",
+      "import",
+      "export",
+      "from",
+      "async",
+      "await",
+      "try",
+      "catch",
+      "throw",
+      "new",
+      "this",
+      "true",
+      "false",
+      "null",
+      "undefined",
+      "typeof"
+    ]);
+    return matches.filter((m) => !keywords.has(m) && m.length > 1);
+  }
+  /**
+   * Validate ruleId - must be null or a valid rule ID from project rules
+   */
+  validateRuleId(ruleId) {
+    if (ruleId === null || ruleId === void 0) {
+      return true;
+    }
+    if (this.validRuleIds.size === 0) {
+      return true;
+    }
+    return this.validRuleIds.has(ruleId);
+  }
+  /**
+   * Check if finding makes sense for file context
+   */
+  checkContext(finding) {
+    const fileLower = finding.file.toLowerCase();
+    const messageLower = finding.message.toLowerCase();
+    if (finding.category === "security" && messageLower.includes("sql") && !fileLower.includes("db") && !fileLower.includes("database") && !fileLower.includes("query") && !fileLower.includes("repository")) {
+      return false;
+    }
+    if (messageLower.includes("xss") && !fileLower.includes("component") && !fileLower.includes("page") && !fileLower.includes(".tsx") && !fileLower.includes(".jsx")) {
+      return false;
+    }
+    if (fileLower.includes(".test.") || fileLower.includes(".spec.")) ;
+    return true;
+  }
+  /**
+   * Calculate verification score
+   */
+  calculateScore(checks) {
+    let score = 0;
+    if (checks.severityValid) {
+      score += SCORE_WEIGHTS.severityValid;
+    }
+    if (checks.categoryValid) {
+      score += SCORE_WEIGHTS.categoryValid;
+    }
+    if (checks.fileExists) {
+      score += SCORE_WEIGHTS.fileExists;
+    }
+    if (checks.lineInBounds) {
+      score += SCORE_WEIGHTS.lineInBounds;
+    }
+    if (checks.lineInDiff) {
+      score += SCORE_WEIGHTS.lineInDiff;
+    }
+    score += checks.snippetMatch * SCORE_WEIGHTS.snippetMatch;
+    if (checks.contextValid) {
+      score += SCORE_WEIGHTS.contextValid;
+    }
+    if (checks.ruleIdValid) {
+      score += SCORE_WEIGHTS.ruleIdValid;
+    }
+    return score;
+  }
+  /**
+   * Downgrade severity by one level.
+   * Returns the next lower severity or 'info' if already at lowest.
+   */
+  downgradeSeverity(severity) {
+    const index = SEVERITY_ORDER.indexOf(severity);
+    if (index === -1 || index >= SEVERITY_ORDER.length - 1) {
+      return "info";
+    }
+    return SEVERITY_ORDER[index + 1] ?? "info";
+  }
+  /**
+   * Get file content (with caching)
+   */
+  async getFileContent(file) {
+    if (this.fileContents.has(file)) {
+      return this.fileContents.get(file);
+    }
+    try {
+      const fullPath = path.join(this.cwd, file);
+      const content = await readFile(fullPath, "utf-8");
+      this.fileContents.set(file, content);
+      return content;
+    } catch {
+      return null;
+    }
+  }
+};
+function createVerificationEngine(cwd, changedFiles, fetchedDiffs, validCategories, categoryAliases, validRuleIds) {
+  return new VerificationEngine(cwd, changedFiles, fetchedDiffs, validCategories, categoryAliases, validRuleIds);
+}
+var COMMON_CATEGORY_MAPPINGS = {
+  security: ["sec", "vulnerability", "vulnerabilities", "injection", "auth", "authentication", "authorization"],
+  performance: ["perf", "speed", "memory", "optimization", "optimisation"],
+  architecture: ["design", "structure", "pattern", "patterns", "arch"],
+  naming: ["names", "conventions", "identifiers", "naming-convention"],
+  consistency: ["style", "formatting", "code-style", "codestyle"],
+  testing: ["test", "tests", "coverage", "unit-test", "unittest"],
+  correctness: ["bug", "bugs", "logic", "error", "errors", "mistake"],
+  maintainability: ["readability", "complexity", "code-quality", "quality"]
+};
+var CategoryValidator = class {
+  validCategories = [];
+  categoryAliases = {};
+  defaultCategory = "other";
+  initialized = false;
+  /**
+   * Initialize validator - discovers categories from config-defined rules directory
+   *
+   * @param cwd - Project root directory (ctx.cwd from command handler)
+   */
+  async init(cwd) {
+    if (this.initialized) {
+      return;
+    }
+    this.validCategories = await discoverCategories(cwd);
+    if (this.validCategories.length === 0) {
+      this.initialized = true;
+      return;
+    }
+    this.categoryAliases = buildCategoryAliases(this.validCategories);
+    this.defaultCategory = this.validCategories[0] ?? "general";
+    this.initialized = true;
+  }
+  /**
+   * Validate and normalize a category value
+   */
+  validate(category) {
+    if (this.validCategories.length === 0) {
+      return { valid: false, normalized: category };
+    }
+    const lower = category.toLowerCase().trim();
+    if (this.validCategories.includes(lower)) {
+      return { valid: true, normalized: lower };
+    }
+    if (this.categoryAliases[lower]) {
+      return { valid: true, normalized: this.categoryAliases[lower] };
+    }
+    return { valid: false, normalized: this.defaultCategory };
+  }
+  /**
+   * Get list of valid categories
+   */
+  getValidCategories() {
+    return [...this.validCategories];
+  }
+  /**
+   * Get category aliases map
+   */
+  getCategoryAliases() {
+    return { ...this.categoryAliases };
+  }
+  /**
+   * Check if validator has been initialized
+   */
+  isInitialized() {
+    return this.initialized;
+  }
+};
+async function discoverCategories(cwd) {
+  try {
+    const config = await useConfig();
+    const rulesDir = config?.rulesDir ?? "ai-review/rules";
+    const kbDir = path.join(cwd, ".kb");
+    const fullPath = path.join(kbDir, rulesDir);
+    try {
+      await access(fullPath);
+    } catch {
+      return [];
+    }
+    const entries = await readdir(fullPath, { withFileTypes: true });
+    return entries.filter((e) => e.isDirectory() && !e.name.startsWith(".")).map((e) => e.name.toLowerCase());
+  } catch {
+    return [];
+  }
+}
+function buildCategoryAliases(validCategories) {
+  const aliases = {};
+  const categorySet = new Set(validCategories);
+  for (const category of validCategories) {
+    aliases[category] = category;
+    const mappings = COMMON_CATEGORY_MAPPINGS[category];
+    if (mappings) {
+      for (const alias of mappings) {
+        if (!categorySet.has(alias)) {
+          aliases[alias] = category;
+        }
+      }
+    }
+  }
+  return aliases;
+}
+function createCategoryValidator() {
+  return new CategoryValidator();
+}
+var globalValidator = null;
+async function getCategoryValidator(cwd) {
+  if (!globalValidator) {
+    globalValidator = new CategoryValidator();
+  }
+  if (!globalValidator.isInitialized()) {
+    await globalValidator.init(cwd);
+  }
+  return globalValidator;
+}
+var DEFAULT_SYSTEM_PROMPT = `You are a code reviewer analyzing changes in a codebase.
+
+Your goal is to find REAL issues in the code - not hypothetical problems.
+
+## Instructions
+
+1. First, use get_diffs() to fetch diffs for suspicious files
+2. Analyze the actual changes in the diffs
+3. If you need more context, use get_file_chunks() sparingly
+4. Report all findings using report_findings()
+
+## Important Rules
+
+- Only report issues you actually see in the code
+- Include specific line numbers FROM THE DIFFS
+- Include code snippets to prove the issue exists
+- Focus on: security, correctness, performance, maintainability
+- Don't report style issues unless they affect readability significantly
+
+## What NOT to Report (False Positives)
+
+- Constructor validation patterns - this is standard practice
+- "Make this configurable" suggestions unless explicitly broken
+- Async methods that don't await - may be intentional for interface compatibility
+- "Add error handling" for internal code paths that can't fail
+- Port/timeout validation for internal tools
+- Empty dispose() methods - placeholder for future cleanup
+- Optional logger parameters - dependency injection is valid
+
+## Severity Calibration
+
+Be CONSERVATIVE with severity. When in doubt, use lower severity.
+
+### blocker (ONLY for these)
+- Exploitable security vulnerability (SQL injection, XSS, RCE)
+- Data loss or corruption risk
+- Application crash in production path
+- Authentication/authorization bypass
+
+### high (Real bugs affecting behavior)
+- Logic error causing incorrect results
+- Race condition that can occur in practice
+- Resource leak (memory, file handles, connections)
+- Unhandled error that breaks functionality
+
+### medium (Code smells, potential issues)
+- Missing null/undefined check where input CAN be null
+- Floating promise without explicit void
+- Type safety bypass (any, type assertion without validation)
+
+### low (Suggestions)
+- Naming could be clearer
+- Code could be simplified
+- Missing documentation for public API
+
+### info (Notes)
+- FYI about pattern usage
+- Style preference (not rule violation)`;
+var DEFAULT_TASK_PROMPT = `## Your Task
+
+1. Review the file list and identify files most likely to have issues:
+   - Security-sensitive files (auth, crypto, input handling)
+   - Files with large changes (+50 lines)
+   - New files (need thorough review)
+   - Core business logic
+
+2. Use get_diffs() to fetch diffs for suspicious files (max 15 per call)
+
+3. Analyze the diffs for:
+   - Security vulnerabilities (REAL, exploitable ones)
+   - Logic errors and edge cases
+   - Performance issues (measurable impact)
+   - Code quality problems (actual bugs, not style)
+
+4. Report all findings using report_findings()
+
+## Quality Bar
+
+Before reporting a finding, ask yourself:
+- Is this a REAL issue or just my opinion?
+- Would fixing this actually improve the code?
+- Is the severity I'm assigning accurate?
+
+Focus on ACTUAL issues in the changed code, not hypothetical problems.`;
+async function loadPrompts(cwd) {
+  const config = await useConfig("review");
+  const kbDir = path.join(cwd, ".kb");
+  const rulesDir = path.join(kbDir, config?.rulesDir ?? "ai-review/rules");
+  const promptsDir = path.join(kbDir, config?.promptsDir ?? "ai-review/prompts");
+  const system = await loadPromptFile(promptsDir, "system.md", DEFAULT_SYSTEM_PROMPT);
+  const task = await loadPromptFile(promptsDir, "task.md", DEFAULT_TASK_PROMPT);
+  const rules = await loadRules(rulesDir);
+  const ruleIds = /* @__PURE__ */ new Set();
+  for (const categoryRules of Object.values(rules)) {
+    for (const rule of categoryRules) {
+      if (rule.id) {
+        ruleIds.add(rule.id);
+      }
+    }
+  }
+  const rulesContext = formatRulesContext(rules);
+  return { system, task, rules, rulesContext, ruleIds };
+}
+async function loadPromptFile(dir, filename, fallback) {
+  try {
+    const filePath = path.join(dir, filename);
+    await access(filePath);
+    const content = await readFile(filePath, "utf-8");
+    return content.trim();
+  } catch {
+    return fallback;
+  }
+}
+async function loadRules(rulesDir) {
+  const rules = {};
+  try {
+    await access(rulesDir);
+  } catch {
+    return rules;
+  }
+  const entries = await readdir(rulesDir, { withFileTypes: true });
+  const categories = entries.filter((e) => e.isDirectory() && !e.name.startsWith("."));
+  for (const categoryDir of categories) {
+    const category = categoryDir.name;
+    if (category.includes("..") || category.includes(path.sep) || category.includes("/")) {
+      continue;
+    }
+    const categoryPath = path.join(rulesDir, category);
+    const ruleFiles = await readdir(categoryPath, { withFileTypes: true });
+    const mdFiles = ruleFiles.filter((f) => f.isFile() && f.name.endsWith(".md"));
+    rules[category] = [];
+    for (const ruleFile of mdFiles) {
+      if (ruleFile.name.includes("..") || ruleFile.name.includes(path.sep) || ruleFile.name.includes("/")) {
+        continue;
+      }
+      const ruleName = ruleFile.name.replace(".md", "");
+      const rulePath = path.join(categoryPath, ruleFile.name);
+      try {
+        const rawContent = await readFile(rulePath, "utf-8");
+        const { frontmatter, body } = parseFrontmatter(rawContent);
+        rules[category].push({
+          category,
+          name: ruleName,
+          content: body.trim(),
+          id: frontmatter?.id,
+          severity: frontmatter?.severity,
+          type: frontmatter?.type ?? "positive"
+          // Default to positive rule
+        });
+      } catch {
+      }
+    }
+  }
+  return rules;
+}
+function formatRulesContext(rules) {
+  const positiveSections = [];
+  const negativeSections = [];
+  for (const [category, categoryRules] of Object.entries(rules)) {
+    if (categoryRules.length === 0) {
+      continue;
+    }
+    const positiveRules = categoryRules.filter((r) => r.type !== "negative");
+    const negativeRules = categoryRules.filter((r) => r.type === "negative");
+    if (positiveRules.length > 0) {
+      positiveSections.push(`## ${capitalize(category)} Rules
+`);
+      for (const rule of positiveRules) {
+        if (rule.id) {
+          positiveSections.push(`### Rule: ${rule.id}
+`);
+        }
+        positiveSections.push(rule.content);
+        positiveSections.push("");
+      }
+    }
+    if (negativeRules.length > 0) {
+      for (const rule of negativeRules) {
+        if (rule.id) {
+          negativeSections.push(`### ${rule.id}
+`);
+        }
+        negativeSections.push(rule.content);
+        negativeSections.push("");
+      }
+    }
+  }
+  if (positiveSections.length === 0 && negativeSections.length === 0) {
+    return "";
+  }
+  const allRuleIds = [];
+  for (const categoryRules of Object.values(rules)) {
+    for (const rule of categoryRules) {
+      if (rule.id && rule.type !== "negative") {
+        allRuleIds.push(rule.id);
+      }
+    }
+  }
+  const ruleIdList = allRuleIds.length > 0 ? `
+
+**Available Rule IDs:** ${allRuleIds.join(", ")}` : "";
+  const falsePositiveSection = negativeSections.length > 0 ? `
+
+## FALSE POSITIVE PREVENTION (Do NOT Report These)
+
+**CRITICAL:** Before reporting any issue, check if it matches a pattern below. If it does, DO NOT REPORT IT.
+
+${negativeSections.join("\n")}` : "";
+  return `# Project-Specific Rules (MANDATORY)
+
+## CRITICAL: You MUST Use Rule IDs
+
+When reporting findings, you MUST check if the issue matches one of these project rules and use the exact ruleId:
+${ruleIdList}
+
+### How to Report:
+
+1. **If issue matches a rule** \u2192 Use the EXACT ruleId from the list above
+   Example: \`"ruleId": "security/path-traversal"\` or \`"ruleId": "consistency/validation-logic"\`
+
+2. **If issue does NOT match any rule** \u2192 Use \`"ruleId": null\`
+
+### Examples:
+
+- Path traversal issue \u2192 \`"ruleId": "security/path-traversal"\`
+- Input validation issue \u2192 \`"ruleId": "security/input-validation"\`
+- Inconsistent validation logic \u2192 \`"ruleId": "consistency/validation-logic"\`
+- Dead code \u2192 \`"ruleId": "architecture/dead-code-paths"\`
+- Some other issue not in rules \u2192 \`"ruleId": null\`
+
+## Project Rules
+
+${positiveSections.join("\n")}${falsePositiveSection}`;
+}
+function capitalize(str) {
+  return str.charAt(0).toUpperCase() + str.slice(1);
+}
+function parseFrontmatter(content) {
+  const frontmatterRegex = /^---\n([\s\S]*?)\n---\n*/;
+  const match = content.match(frontmatterRegex);
+  if (!match) {
+    return { frontmatter: null, body: content };
+  }
+  const yamlContent = match[1] ?? "";
+  const body = content.slice(match[0].length);
+  const frontmatter = {};
+  for (const line of yamlContent.split("\n")) {
+    const colonIndex = line.indexOf(":");
+    if (colonIndex === -1) {
+      continue;
+    }
+    const key = line.slice(0, colonIndex).trim();
+    const value = line.slice(colonIndex + 1).trim();
+    if (key === "id") {
+      frontmatter.id = value;
+    } else if (key === "severity") {
+      const validSeverities = ["blocker", "high", "medium", "low", "info"];
+      if (validSeverities.includes(value)) {
+        frontmatter.severity = value;
+      }
+    } else if (key === "type" && (value === "positive" || value === "negative")) {
+      frontmatter.type = value;
+    }
+  }
+  if (!frontmatter.id) {
+    return { frontmatter: null, body: content };
+  }
+  return { frontmatter, body };
+}
+
+// src/llm-lite/llm-lite-analyzer.ts
+var DEFAULT_MIN_TURNS = 3;
+var DEFAULT_MAX_TURNS = 25;
+var DEFAULT_FILES_PER_TURN = 10;
+var DEFAULT_LINES_PER_TURN = 500;
+function calculateMaxTurns(fileCount, totalChangedLines, config) {
+  const minTurns = config?.minTurns ?? DEFAULT_MIN_TURNS;
+  const maxTurns = config?.maxTurns ?? DEFAULT_MAX_TURNS;
+  const filesPerTurn = config?.filesPerTurn ?? DEFAULT_FILES_PER_TURN;
+  const linesPerTurn = config?.linesPerTurn ?? DEFAULT_LINES_PER_TURN;
+  const baseTurns = minTurns;
+  const turnsForFiles = Math.ceil(fileCount / filesPerTurn);
+  const turnsForLines = Math.ceil(totalChangedLines / linesPerTurn);
+  return Math.min(maxTurns, baseTurns + turnsForFiles + turnsForLines);
+}
+var TOKEN_COSTS = {
+  input: 3e-5,
+  // $0.03 per 1K input tokens
+  output: 6e-5
+  // $0.06 per 1K output tokens
+};
+var LLMLiteAnalyzer = class {
+  cwd;
+  files;
+  taskContext;
+  repoScope;
+  diffProvider;
+  constructor(request) {
+    this.cwd = request.cwd;
+    this.files = request.files;
+    this.taskContext = request.taskContext;
+    this.repoScope = request.repoScope;
+    this.diffProvider = request.diffProvider;
+  }
+  /**
+   * Run LLM-Lite analysis
+   */
+  // eslint-disable-next-line sonarjs/cognitive-complexity -- Complex multi-phase LLM analysis workflow with prompt loading, validation, and result processing
+  async analyze() {
+    const startTime = Date.now();
+    const analytics = useAnalytics();
+    analytics?.track("review:llm-lite:started", {
+      fileCount: this.files.length,
+      hasTaskContext: !!this.taskContext
+    });
+    const llm = useLLM({ tier: "medium" });
+    if (!llm) {
+      throw new Error("LLM not available for llm-lite mode");
+    }
+    const reviewConfig = await useConfig("review");
+    const llmConfig = reviewConfig?.llm;
+    const prompts = await loadPrompts(this.cwd);
+    const categoryValidator = await getCategoryValidator(this.cwd);
+    const validCategories = categoryValidator.getValidCategories();
+    const categoryAliases = categoryValidator.getCategoryAliases();
+    const fileSummaries = this.buildFileSummaries();
+    const totalChangedLines = fileSummaries.reduce(
+      (sum, f) => sum + f.additions + f.deletions,
+      0
+    );
+    const maxTurns = calculateMaxTurns(this.files.length, totalChangedLines, llmConfig);
+    const changedFiles = this.files.map((f) => f.path);
+    const toolExecutor = createToolExecutor(this.cwd, changedFiles, this.diffProvider);
+    const validRuleIds = Array.from(prompts.ruleIds);
+    const tools = buildToolDefinitions(validCategories, validRuleIds);
+    const systemPrompt = this.buildSystemPrompt(validCategories, prompts);
+    const initialPrompt = this.buildInitialPrompt(fileSummaries, prompts);
+    const messages = [
+      { role: "user", content: initialPrompt }
+    ];
+    let llmCalls = 0;
+    let totalInputTokens = 0;
+    let totalOutputTokens = 0;
+    let llmTimeMs = 0;
+    let rawFindings = [];
+    const toolCallCounts = {
+      get_diffs: 0,
+      get_file_chunks: 0,
+      report_findings: 0
+    };
+    for (let turn = 0; turn < maxTurns; turn++) {
+      const llmStart = Date.now();
+      const isLastTurn = turn === maxTurns - 1;
+      const availableTools = isLastTurn ? tools.filter((t) => t.name === "report_findings") : tools;
+      const response = await llm.chatWithTools(
+        [
+          { role: "system", content: systemPrompt },
+          ...messages
+        ],
+        {
+          tools: availableTools.map((t) => ({
+            name: t.name,
+            description: t.description,
+            inputSchema: t.parameters
+          }))
+        }
+      );
+      llmCalls++;
+      llmTimeMs += Date.now() - llmStart;
+      if (response.usage) {
+        totalInputTokens += response.usage.promptTokens ?? 0;
+        totalOutputTokens += response.usage.completionTokens ?? 0;
+      }
+      const toolCalls = response.toolCalls ?? [];
+      if (toolCalls.length === 0) {
+        break;
+      }
+      const assistantContent = response.content ?? "";
+      if (assistantContent.trim()) {
+        messages.push({
+          role: "assistant",
+          content: assistantContent
+        });
+      }
+      for (const toolCall of toolCalls) {
+        const parsed = {
+          name: toolCall.name,
+          arguments: toolCall.input
+        };
+        if (parsed.name in toolCallCounts) {
+          toolCallCounts[parsed.name]++;
+        }
+        const result = await toolExecutor.execute(parsed);
+        messages.push({
+          role: "user",
+          content: `Tool result (${parsed.name}):
+${JSON.stringify(result.result, null, 2)}`
+        });
+        if (parsed.name === "report_findings" && result.result) {
+          const reportResult = result.result;
+          if (reportResult.findings) {
+            rawFindings = reportResult.findings;
+          }
+        }
+      }
+      if (toolCallCounts.report_findings > 0) {
+        break;
+      }
+    }
+    const verifyStart = Date.now();
+    const verificationEngine = createVerificationEngine(
+      this.cwd,
+      changedFiles,
+      toolExecutor.getFetchedDiffs(),
+      validCategories,
+      categoryAliases,
+      prompts.ruleIds
+    );
+    const verificationResult = await verificationEngine.verify(rawFindings);
+    const verifyTimeMs = Date.now() - verifyStart;
+    const findings = this.convertToReviewFindings(verificationResult);
+    const estimatedCost = totalInputTokens * TOKEN_COSTS.input + totalOutputTokens * TOKEN_COSTS.output;
+    analytics?.track("review:llm-lite:completed", {
+      fileCount: this.files.length,
+      findingsCount: findings.length,
+      llmCalls,
+      hallucinationRate: verificationResult.stats.hallucinationRate,
+      estimatedCost
+    });
+    return {
+      findings,
+      metadata: {
+        llmCalls,
+        toolCalls: toolCallCounts,
+        tokens: {
+          input: totalInputTokens,
+          output: totalOutputTokens,
+          total: totalInputTokens + totalOutputTokens
+        },
+        estimatedCost,
+        verification: {
+          rawFindings: verificationResult.stats.total,
+          verified: verificationResult.verified.length,
+          downgraded: verificationResult.stats.downgraded,
+          discarded: verificationResult.stats.discarded,
+          hallucinationRate: verificationResult.stats.hallucinationRate
+        },
+        timing: {
+          totalMs: Date.now() - startTime,
+          llmMs: llmTimeMs,
+          verifyMs: verifyTimeMs
+        }
+      }
+    };
+  }
+  /**
+   * Build file summaries for initial prompt
+   */
+  buildFileSummaries() {
+    return this.files.map((f) => {
+      const lines = f.content.split("\n");
+      return {
+        path: f.path,
+        additions: lines.length,
+        deletions: 0,
+        isNewFile: false
+      };
+    });
+  }
+  /**
+   * Build system prompt from loaded prompts and rules
+   */
+  buildSystemPrompt(validCategories, prompts) {
+    const categoryList = validCategories.length > 0 ? `
+
+## Valid Categories
+
+You MUST use only these categories:
+${validCategories.map((c) => `- ${c}`).join("\n")}` : "";
+    let fullPrompt = prompts.system;
+    if (prompts.rulesContext) {
+      fullPrompt += `
+
+${prompts.rulesContext}`;
+    }
+    fullPrompt += categoryList;
+    return fullPrompt;
+  }
+  /**
+   * Build initial prompt with file list and task context
+   */
+  buildInitialPrompt(files, prompts) {
+    const fileList = files.map((f) => {
+      const stats = `+${f.additions}/-${f.deletions}`;
+      const status = f.isNewFile ? "new file" : "modified";
+      return `- ${f.path} (${stats}, ${status})`;
+    }).join("\n");
+    let prompt = `## Files Changed (${files.length} files)
+
+${fileList}`;
+    if (this.taskContext) {
+      prompt += `
+
+## Task Context
+${this.taskContext}`;
+    }
+    if (this.repoScope?.length) {
+      prompt += `
+
+## Repository Scope
+${this.repoScope.join(", ")}`;
+    }
+    prompt += `
+
+${prompts.task}`;
+    return prompt;
+  }
+  /**
+   * Convert verified findings to ReviewFinding format
+   */
+  convertToReviewFindings(result) {
+    return result.verified.map((v) => {
+      const confidence = v.action === "keep" ? "certain" : v.action === "downgrade" ? "likely" : "heuristic";
+      let projectRuleId = v.finding.ruleId;
+      if (projectRuleId?.startsWith("rule:")) {
+        projectRuleId = projectRuleId.slice(5);
+      }
+      const ruleId = projectRuleId ? `rule:${projectRuleId}` : `llm-lite:${v.finding.category}`;
+      const source = projectRuleId ? "rule" : "llm";
+      return {
+        id: `llm-lite-${v.finding.file}-${v.finding.line}`,
+        ruleId,
+        file: v.finding.file,
+        line: v.finding.line,
+        endLine: v.finding.endLine,
+        column: 1,
+        message: v.finding.message,
+        severity: v.finding.severity,
+        confidence,
+        type: v.finding.category,
+        engine: "llm-lite",
+        source,
+        suggestion: v.finding.suggestion,
+        snippet: v.finding.codeSnippet
+      };
+    });
+  }
+};
+async function runLLMLiteAnalysis(request) {
+  const analyzer = new LLMLiteAnalyzer(request);
+  return analyzer.analyze();
+}
+
+export { ArchitectureAnalyzer, CategoryValidator, DEFAULT_BUDGET, LLMLiteAnalyzer, NamingAnalyzer, SecurityAnalyzer, ToolExecutor, VerificationEngine, buildCategoryAliases, buildToolDefinitions, createCategoryValidator, createToolExecutor, createVerificationEngine, discoverCategories, getCategoryValidator, runLLMLiteAnalysis };
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map