ghagga-core 2.8.1 → 2.9.0

package/dist/pipeline.js

@@ -16,24 +16,34 @@
  */
 import { runConsensusReview } from './agents/consensus.js';
 import { runDiagnosticReview } from './agents/diagnostic.js';
-import { runFanOutReview } from './agents/fan-out-lenses.js';
-import { buildStackHints } from './agents/prompts.js';
+import { loadLensesFromDir, runFanOutReview } from './agents/fan-out-lenses.js';
+import { buildCodeIntelSection, buildStackHints } from './agents/prompts.js';
 import { runSimpleReview } from './agents/simple.js';
 import { runWorkflowReview } from './agents/workflow.js';
 import { buildChecklistContext, resolveChecklistConfig, scoreFindings } from './checklist/index.js';
+import { buildCodeIntelContext } from './code-intel/context.js';
+import { extractChangedSymbols as extractChangedSymbolsFromDiff, scanDocsForSymbols as scanDocsForSymbolRefs, } from './doc-validation/index.js';
 import { enhanceFindings, mergeEnhanceResult } from './enhance/index.js';
 import { serializeFindings } from './enhance/prompt.js';
-import { analyzeExploitability } from './exploitability/index.js';
+import { analyzeExploitability, analyzeUsage } from './exploitability/index.js';
+import { detectFlood } from './flood/index.js';
 import { computeBlastRadius } from './graph/blast-radius.js';
+import { buildCallChainFromDiff } from './graph/call-chain.js';
+import { buildReverseDependencyMap, findDependents } from './graph/reverse-deps.js';
 import { isGraphStale } from './graph/schema.js';
 import { persistReviewObservations } from './memory/persist.js';
 import { searchMemoryForContext } from './memory/search.js';
+import { SqliteMemoryStorage } from './memory/sqlite.js';
+import { formatNegativeExamplesPrompt } from './negative.js';
 import { resolveCredentialEnvVar } from './providers/cli-bridge.js';
-import { createAISDKGenerateFn, createCLIBridgeGenerateFn, createGatewayGenerateFn, } from './providers/generate-fn.js';
+import { createCLIBridgeGenerateFn, createGatewayGenerateFn, createOllamaGenerateFn, } from './providers/generate-fn.js';
+import { rankFindings } from './ranking/index.js';
 import { recursiveReview } from './recursive/index.js';
+import { deriveRules, formatRulesForPrompt, loadFeedback } from './self-improve/index.js';
 import { initializeDefaultTools } from './tools/plugins/index.js';
 import { toolRegistry } from './tools/registry.js';
 import { formatStaticAnalysisContext, isToolRegistryEnabled, runStaticAnalysis, } from './tools/runner.js';
+import { computeAuthorTrustScore, getReviewModeForTier } from './trust/index.js';
 import { buildProgressiveContext } from './utils/context-levels.js';
 import { filterDiffFiles, parseDiffFiles, truncateDiff } from './utils/diff.js';
 import { detectStacks } from './utils/stack-detect.js';
@@ -63,8 +73,20 @@ function validateInput(input) {
     if (input.provider === 'gateway') {
         return;
     }
-    // Single provider mode (CLI/Action backward compat)
-    if (!input.apiKey) {
+    // Ollama mode: no API key required (local instance)
+    if (input.provider === 'ollama') {
+        return;
+    }
+    // Single provider mode — must be one of the 3 supported providers
+    if (input.provider) {
+        const supported = ['gateway', 'cli-bridge', 'ollama'];
+        if (!supported.includes(input.provider)) {
+            throw new Error(`Provider '${input.provider}' is no longer supported directly. ` +
+                `Set provider: 'gateway' and configure credentials in mcp-llm-bridge. ` +
+                `See docs/configuration.md#gateway-mode-mcp-llm-bridge`);
+        }
+    }
+    if (!input.apiKey && input.provider !== 'cli-bridge' && input.provider !== 'ollama') {
         throw new Error('Review input must include an API key');
     }
     if (!input.provider) {
@@ -89,6 +111,8 @@ function validateInput(input) {
 export async function reviewPipeline(input) {
     const startTime = Date.now();
     const emit = input.onProgress ?? (() => { });
+    // Track steps that failed but were gracefully degraded
+    const failedSteps = [];
     // Resolve whether AI review is enabled
     const aiEnabled = resolveAiEnabled(input);
     // ── Step 1: Validate ───────────────────────────────────────
@@ -116,6 +140,30 @@ export async function reviewPipeline(input) {
         message: `Parsed ${allFiles.length} files from diff, ${filteredFiles.length} after filtering (${blocked.length} blocked, ${redacted.length} redacted)`,
         detail: filteredFiles.map((f) => `  ${f.path}`).join('\n'),
     });
+    // ── Step 2.1: Flood / spam detection ──────────────────────
+    // Runs before any expensive operation (static analysis, LLM).
+    const linesChanged = allFiles.reduce((sum, f) => sum + f.additions + f.deletions, 0);
+    const floodResult = detectFlood({
+        authorLogin: input.author ?? '',
+        prTitle: input.context?.commitMessages[0] ?? '',
+        prBody: input.context?.commitMessages.slice(1).join('\n') ?? null,
+        linesChanged,
+        recentPrCount: undefined,
+    });
+    if (floodResult.isFlood) {
+        emit({
+            step: 'flood-detection',
+            message: `Flood detected: ${floodResult.recommendation}`,
+            detail: floodResult.signals.map((s) => `  [${s.type}] ${s.detail}`).join('\n'),
+        });
+    }
+    if (floodResult.recommendation === 'skip') {
+        const skipped = createSkippedResult(input, startTime);
+        return {
+            ...skipped,
+            summary: 'Flood detection: PR skipped (bot author or spam signal).',
+        };
+    }
     // If all files were filtered out, skip the review
     if (filteredFiles.length === 0) {
         return createSkippedResult(input, startTime);
@@ -190,6 +238,10 @@ export async function reviewPipeline(input) {
         }
         catch (error) {
             console.warn('[ghagga] Blast-radius failed (degrading gracefully):', error);
+            failedSteps.push({
+                step: 'blast-radius',
+                error: error instanceof Error ? error.message : String(error),
+            });
             emit({ step: 'blast-radius', message: 'Blast radius: skipped (error loading graph)' });
             blastRadiusMetadata = {
                 enabled: true,
@@ -200,6 +252,54 @@ export async function reviewPipeline(input) {
             };
         }
     }
+    // ── Step 2.6: Call-chain + reverse-deps (optional, runs when blast-radius enabled) ──
+    let callChainContext = '';
+    if (input.settings.enableBlastRadius) {
+        try {
+            if (input.fileReader) {
+                const fileContentsMap = new Map();
+                for (const fp of fileList) {
+                    try {
+                        const content = await input.fileReader(fp);
+                        if (content)
+                            fileContentsMap.set(fp, content);
+                    }
+                    catch {
+                        // non-fatal — skip unreadable files
+                    }
+                }
+                if (fileContentsMap.size > 0) {
+                    const callChain = buildCallChainFromDiff(filteredDiff, fileContentsMap);
+                    if (callChain.affectedSymbols.length > 0) {
+                        const affectedFiles = [...new Set(callChain.affectedSymbols.map((s) => s.filePath))];
+                        callChainContext = `\n## Call-Chain Impact\n${callChain.affectedSymbols.length} symbol(s) across ${affectedFiles.length} file(s) may be affected by these changes (depth: ${callChain.depth}).\n`;
+                        emit({
+                            step: 'call-chain',
+                            message: `Call-chain: ${callChain.changedSymbols.length} changed symbol(s), ${callChain.affectedSymbols.length} affected symbol(s)`,
+                        });
+                    }
+                    const reverseDepMap = buildReverseDependencyMap([...fileContentsMap.keys()], fileContentsMap);
+                    const highRiskFiles = [];
+                    for (const fp of fileList) {
+                        const result = findDependents(fp, reverseDepMap, 2);
+                        if (result.transitiveCount >= 3) {
+                            highRiskFiles.push(`${fp} (${result.transitiveCount} dependents)`);
+                        }
+                    }
+                    if (highRiskFiles.length > 0) {
+                        callChainContext += `\n## High-Risk Files (many dependents)\nThese changed files have many transitive dependents — review carefully:\n${highRiskFiles.map((f) => `- ${f}`).join('\n')}\n`;
+                        emit({
+                            step: 'reverse-deps',
+                            message: `Reverse deps: ${highRiskFiles.length} high-risk file(s) detected`,
+                        });
+                    }
+                }
+            }
+        }
+        catch (error) {
+            console.warn('[ghagga] Call-chain/reverse-deps failed (degrading gracefully):', error instanceof Error ? error.message : String(error));
+        }
+    }
     // ── Step 3: Detect tech stacks ─────────────────────────────
     const stacks = detectStacks(fileList);
     const stackHints = buildStackHints(stacks);
@@ -225,33 +325,104 @@ export async function reviewPipeline(input) {
             ? 'Using precomputed static analysis from runner...'
             : 'Running static analysis & memory search...',
     });
-    const [staticResult, rawMemoryContext] = await Promise.all([
+    const [staticResult, rawMemoryContext, codeIntelResults] = await Promise.all([
         input.precomputedStaticAnalysis
             ? Promise.resolve(input.precomputedStaticAnalysis)
-            : runStaticAnalysisSafe(fileList, input),
-        aiEnabled ? searchMemorySafe(input, fileList) : Promise.resolve(null),
+            : runStaticAnalysisSafe(fileList, input, failedSteps),
+        aiEnabled ? searchMemorySafe(input, fileList, failedSteps) : Promise.resolve(null),
+        queryCodeIntelSafe(input, fileList, emit, failedSteps),
     ]);
+    // ── Step 5.0: Negative examples (optional) ────────────────────
+    // Load dismissed findings for the files in this diff and prepend them
+    // to the memory context so agents suppress known false positives.
+    let negativeExamplesPrompt = '';
+    if (input.features?.negativeExamples !== false &&
+        input.memoryStorage instanceof SqliteMemoryStorage) {
+        try {
+            const allNegativeExamples = fileList.flatMap((filePath) => input.memoryStorage.getNegativeExamplesForFile(filePath));
+            // De-duplicate by findingHash
+            const seen = new Set();
+            const uniqueExamples = allNegativeExamples.filter((e) => {
+                if (seen.has(e.findingHash))
+                    return false;
+                seen.add(e.findingHash);
+                return true;
+            });
+            negativeExamplesPrompt = formatNegativeExamplesPrompt(uniqueExamples);
+            if (negativeExamplesPrompt) {
+                emit({
+                    step: 'negative-examples',
+                    message: `Loaded ${uniqueExamples.length} dismissed finding(s) — injecting suppression context`,
+                });
+            }
+        }
+        catch (error) {
+            // Non-fatal — degraded gracefully
+            console.warn('[ghagga] Negative examples load failed (degrading gracefully):', error instanceof Error ? error.message : String(error));
+        }
+    }
+    // ── Step 5.0a: Self-improve rules (optional) ─────────────────
+    let selfImproveRulesPrompt = '';
+    if (input.settings.selfImprovePath) {
+        try {
+            const feedback = await loadFeedback(input.settings.selfImprovePath);
+            if (feedback.length > 0) {
+                const rules = deriveRules(feedback);
+                selfImproveRulesPrompt = formatRulesForPrompt(rules);
+                if (selfImproveRulesPrompt) {
+                    emit({
+                        step: 'self-improve',
+                        message: `Self-improve: loaded ${feedback.length} feedback record(s), derived ${rules.length} rule(s)`,
+                    });
+                }
+            }
+        }
+        catch (error) {
+            console.warn('[ghagga] Self-improve rules load failed (degrading gracefully):', error instanceof Error ? error.message : String(error));
+        }
+    }
     // Build full (L2) context first, then choose fidelity level based on budget
     const fullStaticContext = formatStaticAnalysisContext(staticResult);
+    // Prepend self-improve rules + negative examples to memory context
+    const rawMemoryContextWithNegatives = [selfImproveRulesPrompt, negativeExamplesPrompt, rawMemoryContext].filter(Boolean).join('\n') ||
+        null;
     const progressiveContext = buildProgressiveContext({
         staticResult,
-        memoryContext: rawMemoryContext,
+        memoryContext: rawMemoryContextWithNegatives,
         stackHints,
         contextBudget,
         fullStaticContext,
     });
     const staticContext = progressiveContext.staticContext;
     const memoryContext = progressiveContext.memoryContext;
+    // ── Step 5.1b: Build code intelligence context (optional) ───
+    const codeIntelContext = codeIntelResults.length > 0
+        ? buildCodeIntelSection(buildCodeIntelContext(codeIntelResults, input.settings.codeIntelMaxTokens))
+        : '';
+    let codeIntelMetadata;
+    if (input.settings.enableCodeIntel) {
+        codeIntelMetadata = {
+            enabled: true,
+            providerAvailable: !!input.codeIntelProvider,
+            filesQueried: fileList.length,
+            filesWithData: codeIntelResults.filter((r) => r.callers.length > 0 || r.callees.length > 0 || r.imports.length > 0).length,
+            queryDurationMs: 0, // Timing captured in queryCodeIntelSafe
+        };
+    }
     {
         const toolsSummary = Object.entries(staticResult)
             .map(([name, result]) => `  ${name}: ${result.status} (${result.findings.length} findings)`)
             .join('\n');
         const levelDetail = `  context levels: static=${progressiveContext.staticLevel}, memory=${progressiveContext.memoryLevel}`;
+        const codeIntelDetail = codeIntelContext
+            ? `\n  code-intel: ${codeIntelResults.length} file(s) with structural data`
+            : '\n  code-intel: disabled or unavailable';
         emit({
             step: 'static-results',
             message: `Static analysis complete (context: static=${progressiveContext.staticLevel}, memory=${progressiveContext.memoryLevel})`,
             detail: toolsSummary +
                 (rawMemoryContext ? '\n  memory: loaded' : '\n  memory: disabled') +
+                codeIntelDetail +
                 '\n' +
                 levelDetail,
         });
@@ -269,6 +440,11 @@ export async function reviewPipeline(input) {
         }
     }
     // ── Step 5.5: AI Enhance (optional) ─────────────────────────
+    // Resolve active provider early — needed by enhance block below and by Step 6
+    const activeProvider = input.providerChain?.[0]?.provider ?? input.provider ?? 'gateway';
+    const isCliBridge = activeProvider === 'cli-bridge';
+    const isGateway = activeProvider === 'gateway';
+    const isOllama = activeProvider === 'ollama';
     let enhancedStaticFindings;
     let enhanceMetadata;
     if (input.enhance) {
@@ -281,17 +457,23 @@ export async function reviewPipeline(input) {
             emit({ step: 'static-analysis', message: 'Enhancing findings with AI...' });
             try {
                 const primary = resolvePrimaryProvider(input);
+                const enhanceGenerateFn = resolveGenerateTextFns(input, isCliBridge, isGateway, isOllama)[0];
                 const serialized = serializeFindings(allStaticFindings);
                 const { result: eResult, metadata: eMeta } = await enhanceFindings({
                     findings: serialized,
                     provider: primary.provider,
                     model: primary.model,
                     apiKey: primary.apiKey,
+                    generateFn: enhanceGenerateFn,
                 });
                 enhancedStaticFindings = mergeEnhanceResult(allStaticFindings, eResult);
                 enhanceMetadata = eMeta;
             }
-            catch {
+            catch (enhanceError) {
+                failedSteps.push({
+                    step: 'ai-enhance',
+                    error: enhanceError instanceof Error ? enhanceError.message : String(enhanceError),
+                });
                 emit({
                     step: 'static-analysis',
                     message: 'AI enhance failed — continuing without enhancement',
@@ -299,29 +481,62 @@ export async function reviewPipeline(input) {
             }
         }
     }
+    // ── Step 5.6: Author trust scoring (optional) ──────────────
+    // When features.authorTrust is enabled and input.author is set, compute a
+    // trust score from git history and potentially override the review mode.
+    let trustOverrideMode;
+    if (input.features?.authorTrust && input.author) {
+        try {
+            const author = input.author;
+            const sqliteStorage = input.memoryStorage instanceof SqliteMemoryStorage ? input.memoryStorage : null;
+            // Check for a cached (fresh) score — recompute if older than 1 day
+            const ONE_DAY_MS = 24 * 60 * 60 * 1000;
+            let trustScore = sqliteStorage?.getTrustScore(author) ?? null;
+            const isStale = !trustScore || Date.now() - trustScore.lastUpdated.getTime() > ONE_DAY_MS;
+            if (isStale) {
+                trustScore = await computeAuthorTrustScore(author, { cwd: process.cwd() });
+                sqliteStorage?.upsertTrustScore(trustScore);
+            }
+            if (!trustScore) {
+                throw new Error('Trust score unavailable');
+            }
+            const recommendedMode = getReviewModeForTier(trustScore.tier, input.mode);
+            if (recommendedMode !== input.mode) {
+                trustOverrideMode = recommendedMode;
+            }
+            emit({
+                step: 'author-trust',
+                message: `[trust] author=${author} score=${trustScore.score} tier=${trustScore.tier} → mode=${recommendedMode}`,
+            });
+        }
+        catch (error) {
+            console.warn('[ghagga] Author trust scoring failed (non-fatal):', error instanceof Error ? error.message : String(error));
+            failedSteps.push({
+                step: 'author-trust',
+                error: error instanceof Error ? error.message : String(error),
+            });
+        }
+    }
+    // Effective input mode — may be overridden by trust scoring
+    const resolvedInputMode = trustOverrideMode ?? input.mode;
     // ── Step 6: Execute agent mode (or skip if AI disabled) ────
     let result;
-    // Check if CLI bridge should be used (intercept before normal provider flow)
-    const isCliBridge = input.provider === 'cli-bridge' ||
-        input.providerChain?.[0]?.provider === 'cli-bridge';
-    // Check if LLM Gateway should be used (intercept before normal provider flow)
-    const isGateway = input.provider === 'gateway' ||
-        input.providerChain?.[0]?.provider === 'gateway';
+    // activeProvider / isCliBridge / isGateway / isOllama are resolved above (Step 5.5)
     if (!aiEnabled) {
         // Static-only mode: no LLM calls
         emit({ step: 'agent-start', message: 'AI review disabled — returning static analysis only' });
-        result = createStaticOnlyResult(staticResult, input.mode, startTime);
+        result = createStaticOnlyResult(staticResult, resolvedInputMode, startTime);
     }
     else {
         // ── Unified dispatch: all backends, all modes ──────────────
         // Step 1: Build GenerateTextFn(s) for the detected backend
-        const generateFns = resolveGenerateTextFns(input, isCliBridge, isGateway);
+        const generateFns = resolveGenerateTextFns(input, isCliBridge, isGateway, isOllama);
         // Step 2: Resolve effective mode (diagnostic → simple for non-SDK backends)
-        const effectiveMode = resolveEffectiveMode(input.mode, isCliBridge, isGateway);
-        if (effectiveMode !== input.mode) {
+        const effectiveMode = resolveEffectiveMode(resolvedInputMode, isCliBridge, isGateway, isOllama);
+        if (effectiveMode !== resolvedInputMode) {
             emit({
                 step: 'mode-fallback',
-                message: `Diagnostic mode not supported with ${isCliBridge ? 'CLI bridge' : 'gateway'} — falling back to simple mode`,
+                message: `Diagnostic mode not supported with ${isCliBridge ? 'CLI bridge' : isOllama ? 'Ollama' : 'gateway'} — falling back to simple mode`,
             });
         }
         // Resolve primary provider for progress messages and metadata
@@ -330,6 +545,8 @@ export async function reviewPipeline(input) {
             step: 'agent-start',
             message: `Running ${effectiveMode} agent with ${primary.provider}/${primary.model}...`,
         });
+        // Combine stack hints, code intelligence context, and call-chain context for agent prompts
+        const combinedStackHints = stackHints + codeIntelContext + callChainContext;
         try {
             switch (effectiveMode) {
                 case 'simple':
@@ -337,7 +554,7 @@ export async function reviewPipeline(input) {
                         diff: truncatedDiff,
                         staticContext,
                         memoryContext,
-                        stackHints,
+                        stackHints: combinedStackHints,
                         checklistContext,
                         reviewLevel: input.settings.reviewLevel,
                         onProgress: input.onProgress,
@@ -353,11 +570,13 @@ export async function reviewPipeline(input) {
                         diff: truncatedDiff,
                         staticContext,
                         memoryContext,
-                        stackHints,
+                        stackHints: combinedStackHints,
                         checklistContext,
                         reviewLevel: input.settings.reviewLevel,
                         onProgress: input.onProgress,
                         generateFns,
+                        concurrency: input.settings?.reviewConcurrency,
+                        delayMs: input.settings?.reviewDelayMs,
                         // Backward compat fields (not used when generateFns is provided)
                         provider: primary.provider ?? 'cli-bridge',
                         model: primary.model ?? 'auto',
@@ -371,11 +590,13 @@ export async function reviewPipeline(input) {
                         models: buildConsensusModels(input.providerChain, primary),
                         staticContext,
                         memoryContext,
-                        stackHints,
+                        stackHints: combinedStackHints,
                         checklistContext,
                         reviewLevel: input.settings.reviewLevel,
                         onProgress: input.onProgress,
                         generateFns,
+                        concurrency: input.settings?.reviewConcurrency,
+                        delayMs: input.settings?.reviewDelayMs,
                     });
                     break;
                 case 'diagnostic':
@@ -387,13 +608,17 @@ export async function reviewPipeline(input) {
                         apiKey: primary.apiKey,
                         staticContext,
                         memoryContext,
-                        stackHints,
+                        stackHints: combinedStackHints,
                         checklistContext,
                         reviewLevel: input.settings.reviewLevel,
                         onProgress: input.onProgress,
                     });
                     break;
                 case 'fan-out':
+                    // Load custom lenses from directory (if configured)
+                    if (input.settings.lensDir) {
+                        await loadLensesFromDir(input.settings.lensDir, input.onProgress);
+                    }
                     result = await runFanOutReview({
                         diff: truncatedDiff,
                         provider: primary.provider ?? 'cli-bridge',
@@ -401,11 +626,13 @@ export async function reviewPipeline(input) {
                         apiKey: primary.apiKey ?? '',
                         staticContext,
                         memoryContext,
-                        stackHints,
+                        stackHints: combinedStackHints,
                         checklistContext,
                         reviewLevel: input.settings.reviewLevel,
                         onProgress: input.onProgress,
                         generateFns,
+                        // Forward lens selection from settings (CLI flags > config > defaults)
+                        ...(input.settings.lenses ? { lenses: input.settings.lenses } : {}),
                     });
                     break;
                 default: {
@@ -417,8 +644,12 @@ export async function reviewPipeline(input) {
         catch (error) {
             // Agent failed — return static results with NEEDS_HUMAN_REVIEW
             console.warn('[ghagga] AI review failed, returning static analysis only:', error instanceof Error ? error.message : String(error));
+            failedSteps.push({
+                step: 'ai-review',
+                error: error instanceof Error ? error.message : String(error),
+            });
             emit({ step: 'agent-failed', message: 'AI review failed — returning static analysis only' });
-            result = createStaticOnlyResult(staticResult, input.mode, startTime);
+            result = createStaticOnlyResult(staticResult, resolvedInputMode, startTime);
             result.status = 'NEEDS_HUMAN_REVIEW';
             result.summary = `AI review failed (${error instanceof Error ? error.message : 'unknown error'}). Static analysis results are shown below.`;
         }
@@ -460,6 +691,10 @@ export async function reviewPipeline(input) {
     if (blastRadiusMetadata) {
         result.metadata.blastRadius = blastRadiusMetadata;
     }
+    // Add code intelligence metadata (if applicable)
+    if (codeIntelMetadata) {
+        result.codeIntelMetadata = codeIntelMetadata;
+    }
     // ── Step 7.4: Exploitability analysis (optional) ────────────
     if (input.settings.enableBlastRadius && result.findings.length > 0) {
         const trivyCveCount = result.findings.filter((f) => f.source === 'trivy' && f.category === 'dependency-vulnerability').length;
@@ -486,9 +721,35 @@ export async function reviewPipeline(input) {
                     step: 'exploitability',
                     message: `Exploitability analysis complete: ${exploitable} exploitable, ${potential} potentially, ${notExploitable} not exploitable`,
                 });
+                // Function-level usage analysis (requires fileReader)
+                if (input.fileReader) {
+                    emit({
+                        step: 'usage-analysis',
+                        message: 'Analyzing function-level usage of vulnerable packages...',
+                    });
+                    await analyzeUsage(result.findings, exploitGraph, input.fileReader);
+                    const usageLabels = result.findings
+                        .filter((f) => f.usageLabel)
+                        .reduce((acc, f) => {
+                        const key = f.usageLabel ?? 'unknown';
+                        acc[key] = (acc[key] ?? 0) + 1;
+                        return acc;
+                    }, {});
+                    const inUse = usageLabels['in-use'] ?? 0;
+                    const importedNotCalled = usageLabels['imported-not-called'] ?? 0;
+                    const notInUse = usageLabels['not-in-use'] ?? 0;
+                    emit({
+                        step: 'usage-analysis',
+                        message: `Usage analysis complete: ${inUse} in-use, ${importedNotCalled} imported-not-called, ${notInUse} not-in-use`,
+                    });
+                }
             }
             catch (error) {
                 console.warn('[ghagga] Exploitability analysis failed (non-fatal):', error instanceof Error ? error.message : String(error));
+                failedSteps.push({
+                    step: 'exploitability',
+                    error: error instanceof Error ? error.message : String(error),
+                });
                 emit({
                     step: 'exploitability',
                     message: 'Exploitability analysis failed — continuing without',
@@ -508,7 +769,7 @@ export async function reviewPipeline(input) {
     if (input.settings.enableRecursiveReview && aiEnabled && result.findings.length > 0) {
         emit({ step: 'recursive-review', message: 'Running recursive review on suggested fixes...' });
         try {
-            const generateFns = resolveGenerateTextFns(input, isCliBridge, isGateway);
+            const generateFns = resolveGenerateTextFns(input, isCliBridge, isGateway, isOllama);
             const report = await recursiveReview({
                 originalDiff: truncatedDiff,
                 findings: result.findings,
@@ -538,15 +799,97 @@ export async function reviewPipeline(input) {
         }
         catch (error) {
             console.warn('[ghagga] Recursive review failed (non-fatal):', error instanceof Error ? error.message : String(error));
+            failedSteps.push({
+                step: 'recursive-review',
+                error: error instanceof Error ? error.message : String(error),
+            });
             emit({ step: 'recursive-review', message: 'Recursive review failed — continuing without' });
         }
     }
+    // ── Step 7.7: Code-doc validation (optional) ───────────────────
+    if (input.settings.enableDocValidation && filteredFiles.length > 0) {
+        try {
+            const changedSymbols = extractChangedSymbolsFromDiff(filteredDiff);
+            if (changedSymbols.length > 0) {
+                emit({
+                    step: 'doc-validation',
+                    message: `Scanning docs for ${changedSymbols.length} changed symbol(s)...`,
+                });
+                const docResult = scanDocsForSymbolRefs(changedSymbols, allFiles, fileList);
+                result.docValidation = docResult;
+                if (docResult.staleReferences.length > 0) {
+                    // Convert stale references to findings
+                    for (const ref of docResult.staleReferences) {
+                        result.findings.push({
+                            severity: 'low',
+                            category: 'documentation',
+                            file: ref.file,
+                            line: ref.line,
+                            message: `Documentation references \`${ref.symbol}\` which was changed in this PR but this doc was not updated.`,
+                            suggestion: `Review and update the reference to \`${ref.symbol}\` in this file.`,
+                            source: 'doc-validation',
+                        });
+                    }
+                    emit({
+                        step: 'doc-validation',
+                        message: `Doc validation: ${docResult.staleReferences.length} stale reference(s) found in ${docResult.docsScanned} doc(s)`,
+                    });
+                }
+                else {
+                    emit({
+                        step: 'doc-validation',
+                        message: `Doc validation: no stale references (${docResult.docsScanned} docs scanned)`,
+                    });
+                }
+            }
+        }
+        catch (error) {
+            console.warn('[ghagga] Doc validation failed (non-fatal):', error instanceof Error ? error.message : String(error));
+            failedSteps.push({
+                step: 'doc-validation',
+                error: error instanceof Error ? error.message : String(error),
+            });
+            emit({ step: 'doc-validation', message: 'Doc validation failed — continuing without' });
+        }
+    }
+    // ── Step 7.8: Semantic ranking of findings (optional) ─────────
+    const semanticRankingEnabled = input.features?.semanticRanking !== false && !!input.embeddingProvider;
+    if (semanticRankingEnabled && result.findings.length > 1) {
+        emit({ step: 'semantic-ranking', message: 'Reranking findings by semantic relevance...' });
+        try {
+            result.findings = await rankFindings(result.findings, input.embeddingProvider);
+            emit({
+                step: 'semantic-ranking',
+                message: `Semantic ranking complete (${result.findings.length} findings reranked)`,
+            });
+        }
+        catch (error) {
+            console.warn('[ghagga] Semantic ranking failed (non-fatal):', error instanceof Error ? error.message : String(error));
+            failedSteps.push({
+                step: 'semantic-ranking',
+                error: error instanceof Error ? error.message : String(error),
+            });
+            emit({ step: 'semantic-ranking', message: 'Semantic ranking failed — continuing without' });
+        }
+    }
     // ── Step 8: Persist to memory (awaited for SQLite correctness) ──
     if (input.settings.enableMemory && input.memoryStorage && input.context) {
         await persistReviewObservations(input.memoryStorage, input.context.repoFullName, input.context.prNumber, result).catch((error) => {
             console.warn('[ghagga] Memory persist failed (non-fatal):', error instanceof Error ? error.message : String(error));
+            failedSteps.push({
+                step: 'memory-persist',
+                error: error instanceof Error ? error.message : String(error),
+            });
         });
     }
+    // ── Step 9: Attach failed steps and mark as PARTIAL ─────────
+    if (failedSteps.length > 0) {
+        result.failedSteps = failedSteps;
+        // Only downgrade to PARTIAL if the review otherwise appeared successful
+        if (result.status === 'PASSED') {
+            result.status = 'PARTIAL';
+        }
+    }
     return result;
 }
 // ─── Provider Resolution ────────────────────────────────────────
@@ -621,11 +964,14 @@ function resolvePrimaryModel(input) {
 /**
  * Create the appropriate GenerateTextFn(s) based on the provider type.
  *
- * - CLI Bridge: single fn wrapping generateViaCLI
- * - Gateway: single fn wrapping generateViaGateway
- * - AI SDK: one fn per provider chain entry (for round-robin distribution)
+ * - cli-bridge: single fn wrapping generateViaCLI
+ * - gateway: one fn per gateway chain entry (for round-robin distribution)
+ * - ollama: single fn wrapping local Ollama OpenAI-compatible API
+ *
+ * Providers that are no longer supported directly (anthropic, openai, etc.)
+ * throw a migration error pointing users to gateway mode.
  */
-function resolveGenerateTextFns(input, isCliBridge, isGateway) {
+function resolveGenerateTextFns(input, isCliBridge, isGateway, isOllama) {
     if (isCliBridge) {
         // Resolve CLI bridge options from provider chain or flat input fields
         const cliBridgeEntry = input.providerChain?.[0];
@@ -676,23 +1022,25 @@ function resolveGenerateTextFns(input, isCliBridge, isGateway) {
             }),
         ];
     }
-    // AI SDK: one function per chain entry (for round-robin distribution)
-    const chain = input.providerChain && input.providerChain.length > 0 ? input.providerChain : null;
-    if (chain) {
-        return chain.map((entry) => createAISDKGenerateFn(entry.provider, entry.model, entry.apiKey));
+    if (isOllama) {
+        const model = input.model && input.model !== 'auto' ? input.model : 'llama3';
+        return [createOllamaGenerateFn(model, input.ollamaBaseURL)];
     }
-    // Single provider from flat fields (backward compat)
-    const primary = resolvePrimaryProvider(input);
-    return [createAISDKGenerateFn(primary.provider, primary.model, primary.apiKey)];
+    // Legacy provider migration guard — should never reach here with the narrowed type,
+    // but protects against runtime strings from older configs.
+    const legacyProvider = input.providerChain?.[0]?.provider ?? input.provider ?? 'unknown';
+    throw new Error(`Provider '${legacyProvider}' is no longer supported directly. ` +
+        `Set provider: 'gateway' and configure credentials in mcp-llm-bridge. ` +
+        `See docs/configuration.md#gateway-mode-mcp-llm-bridge`);
 }
 /**
  * Resolve the effective review mode.
  *
- * Diagnostic mode only works with AI SDK (it needs direct model access).
- * For CLI bridge and gateway, fall back to simple mode.
+ * Diagnostic mode requires direct model access (not available in non-SDK backends).
+ * For CLI bridge, gateway, and Ollama, fall back to simple mode.
  */
-function resolveEffectiveMode(mode, isCliBridge, isGateway) {
-    if (mode === 'diagnostic' && (isCliBridge || isGateway)) {
+function resolveEffectiveMode(mode, isCliBridge, isGateway, isOllama) {
+    if (mode === 'diagnostic' && (isCliBridge || isGateway || isOllama)) {
         return 'simple';
     }
     // Fan-out works with all backends (uses generateFns like workflow/consensus)
@@ -703,7 +1051,7 @@ function resolveEffectiveMode(mode, isCliBridge, isGateway) {
  * Run static analysis with graceful degradation.
  * Returns a result with all tools skipped if anything goes wrong.
  */
-async function runStaticAnalysisSafe(fileList, input) {
+async function runStaticAnalysisSafe(fileList, input, failedSteps) {
     try {
         // Build a file map for static analysis (paths only, content from diff)
         const files = new Map();
@@ -721,6 +1069,10 @@ async function runStaticAnalysisSafe(fileList, input) {
     }
     catch (error) {
         console.warn('[ghagga] Static analysis failed (degrading gracefully):', error instanceof Error ? error.message : String(error));
+        failedSteps.push({
+            step: 'static-analysis',
+            error: error instanceof Error ? error.message : String(error),
+        });
         const errorResult = {
             status: 'error',
             findings: [],
@@ -738,7 +1090,7 @@ async function runStaticAnalysisSafe(fileList, input) {
  * Search memory with graceful degradation.
  * Returns null if memory is disabled or unavailable.
  */
-async function searchMemorySafe(input, fileList) {
+async function searchMemorySafe(input, fileList, failedSteps) {
     if (!input.settings.enableMemory || !input.memoryStorage || !input.context) {
         return null;
     }
@@ -747,9 +1099,66 @@ async function searchMemorySafe(input, fileList) {
     }
     catch (error) {
         console.warn('[ghagga] Memory search failed (degrading gracefully):', error instanceof Error ? error.message : String(error));
+        failedSteps.push({
+            step: 'memory-search',
+            error: error instanceof Error ? error.message : String(error),
+        });
         return null;
     }
 }
+/**
+ * Query the code intelligence provider for structural context.
+ * Returns an empty array when disabled, unavailable, or on error.
+ */
+async function queryCodeIntelSafe(input, fileList, emit, failedSteps) {
+    if (!input.settings.enableCodeIntel || !input.codeIntelProvider) {
+        return [];
+    }
+    const startTime = Date.now();
+    emit({
+        step: 'code-intel',
+        message: `Querying code intelligence for ${fileList.length} file(s)...`,
+    });
+    try {
+        const results = [];
+        const provider = input.codeIntelProvider;
+        // Query each changed file for structural data (parallel)
+        const queries = fileList.map(async (file) => {
+            const [imports, exports] = await Promise.all([
+                provider.getFileImports(file),
+                provider.getFileExports(file),
+            ]);
+            // Query callers/callees for each exported symbol
+            const callerResults = await Promise.all(exports.slice(0, 10).map((sym) => provider.getCallers(sym, file)));
+            const calleeResults = await Promise.all(exports.slice(0, 10).map((sym) => provider.getCallees(sym, file)));
+            const callers = callerResults.flat();
+            const callees = calleeResults.flat();
+            return { file, callers, callees, imports, exports };
+        });
+        const settled = await Promise.allSettled(queries);
+        for (const outcome of settled) {
+            if (outcome.status === 'fulfilled') {
+                results.push(outcome.value);
+            }
+        }
+        const durationMs = Date.now() - startTime;
+        const withData = results.filter((r) => r.callers.length > 0 || r.callees.length > 0 || r.imports.length > 0).length;
+        emit({
+            step: 'code-intel',
+            message: `Code intelligence: ${withData}/${results.length} files with structural data (${durationMs}ms)`,
+        });
+        return results;
+    }
+    catch (error) {
+        console.warn('[ghagga] Code intelligence query failed (degrading gracefully):', error instanceof Error ? error.message : String(error));
+        failedSteps.push({
+            step: 'code-intel',
+            error: error instanceof Error ? error.message : String(error),
+        });
+        emit({ step: 'code-intel', message: 'Code intelligence: failed — continuing without' });
+        return [];
+    }
+}
 /**
  * Create a SKIPPED result when all files are filtered out.
  */