sdlc-agent-4-enterprise-server 1.0.0

package/extension/src/langgraph/graphs/security-audit-graph.ts

@@ -0,0 +1,98 @@
+/**
+ * Security Audit Subgraph — Full Security Scan Pipeline
+ * OWASP-style audit across dependencies, code patterns, and configuration.
+ *
+ * Flow: __start__ → scan_dependencies → scan_code_patterns → scan_config → generate_report → __end__
+ */
+
+import { StateGraph, END } from "@langchain/langgraph";
+import { PipelineAnnotation, PipelineState } from "../state";
+import { McpBridge } from "../mcp-bridge";
+import { StreamHandler } from "../stream-handler";
+import type { LlmProvider } from "../llm-provider";
+import { SecurityNode } from "../nodes/security-node";
+
+/**
+ * Build the security audit subgraph.
+ */
+export async function buildSecurityAuditSubgraph(
+  mcpBridge: McpBridge,
+  streamHandler: StreamHandler,
+  llmProvider?: LlmProvider
+) {
+  const depScanNode = new SecurityNode("scan_dependencies", mcpBridge, streamHandler, llmProvider);
+  const codeScanNode = new SecurityNode("scan_code_patterns", mcpBridge, streamHandler, llmProvider);
+  const configScanNode = new SecurityNode("scan_config", mcpBridge, streamHandler, llmProvider);
+
+  const graph = new StateGraph(PipelineAnnotation)
+    // Scan dependencies for known vulnerabilities
+    .addNode("scan_dependencies", (state: PipelineState) => depScanNode.run(state))
+
+    // Scan code patterns for security anti-patterns
+    .addNode("scan_code_patterns", (state: PipelineState) => codeScanNode.run(state))
+
+    // Scan configuration for security misconfigurations
+    .addNode("scan_config", (state: PipelineState) => configScanNode.run(state))
+
+    // Generate consolidated security assessment report
+    .addNode("generate_report", async (state: PipelineState) => {
+      const streamId = state.currentStreamId || `stream-security-${Date.now()}`;
+      streamHandler.emitStatus("generate_report", "active", streamId);
+
+      const outputs = state.agentOutputs || [];
+      const depFindings = outputs.find(o => o.nodeId === "scan_dependencies")?.content || "No dependency issues.";
+      const codeFindings = outputs.find(o => o.nodeId === "scan_code_patterns")?.content || "No code pattern issues.";
+      const configFindings = outputs.find(o => o.nodeId === "scan_config")?.content || "No config issues.";
+
+      let report = [
+        "# Security Assessment Report",
+        "",
+        "## 1. Dependency Vulnerabilities",
+        depFindings,
+        "",
+        "## 2. Code Security Patterns",
+        codeFindings,
+        "",
+        "## 3. Configuration Security",
+        configFindings,
+        "",
+        "## Summary",
+        "Security audit complete. Review findings above and address critical issues.",
+      ].join("\n");
+
+      if (llmProvider) {
+        try {
+          report = await llmProvider.chat(
+            [
+              { role: "system", content: "You are a security auditor. Generate a professional Security Assessment Report in markdown format. Categorize findings by severity (Critical, High, Medium, Low). Include remediation recommendations for each finding." },
+              { role: "user", content: `Dependency scan:\n${depFindings}\n\nCode patterns:\n${codeFindings}\n\nConfig scan:\n${configFindings}` },
+            ],
+            { temperature: 0.2, maxTokens: 4096 }
+          );
+        } catch {
+          // Use basic report
+        }
+      }
+
+      streamHandler.emitComplete("generate_report", 0, streamId);
+
+      return {
+        agentOutputs: [{
+          nodeId: "generate_report",
+          content: report,
+          timestamp: new Date().toISOString(),
+          metadata: { action: "security_report" },
+        }],
+        pipelineStatus: "completed" as const,
+        lastUpdatedAt: new Date().toISOString(),
+      };
+    })
+
+    .addEdge("__start__", "scan_dependencies")
+    .addEdge("scan_dependencies", "scan_code_patterns")
+    .addEdge("scan_code_patterns", "scan_config")
+    .addEdge("scan_config", "generate_report")
+    .addEdge("generate_report", END);
+
+  return graph.compile();
+}

package/extension/src/langgraph/graphs/verify-node.ts

@@ -0,0 +1,161 @@
+/**
+ * VerifyResponse node — self-review mechanism for chat agent.
+ * Evaluates if response is complete, routes to retry or end.
+ */
+
+import { PipelineState } from "../state";
+import { StreamHandler } from "../stream-handler";
+import type { LlmProvider, LlmMessage } from "../llm-provider";
+import { DEFAULT_VERIFY_PROMPT, buildVerifyMessages } from "./verify-prompt";
+import { debugLog } from "../../debug-logger";
+
+const MAX_VERIFY_RETRIES = 5;
+const VERIFY_TIMEOUT_MS = 15000;
+
+export interface VerifyResult {
+  verdict: "complete" | "incomplete" | "tool_needed";
+  feedback?: string;
+  toolName?: string;
+  toolArgs?: Record<string, unknown>;
+}
+
+export function createVerifyResponseNode(
+  llmProvider: LlmProvider | undefined,
+  streamHandler: StreamHandler,
+  verifyPrompt?: string
+) {
+  const prompt = verifyPrompt || DEFAULT_VERIFY_PROMPT;
+
+  return async (state: PipelineState): Promise<Partial<PipelineState>> => {
+    const verifyCount = (state.agentIterations || 0);
+    if (!llmProvider || verifyCount >= MAX_VERIFY_RETRIES) {
+      return { lastUpdatedAt: new Date().toISOString() };
+    }
+
+    const lastOutput = state.agentOutputs?.at(-1);
+    const agentResponse = lastOutput?.content || "";
+    const userRequest = (state.chatHistory || [])
+      .filter(m => m.role === "user").pop()?.content || "";
+
+    if (!agentResponse || !userRequest) {
+      return { lastUpdatedAt: new Date().toISOString() };
+    }
+
+    // Don't verify very short responses (likely "ok", "done", etc.)
+    if (agentResponse.length < 20) {
+      return { lastUpdatedAt: new Date().toISOString() };
+    }
+
+    try {
+      const messages = buildVerifyMessages(
+        userRequest,
+        agentResponse.slice(0, 2000),
+        prompt
+      );
+
+      const timeoutPromise = new Promise<string>((_, reject) =>
+        setTimeout(() => reject(new Error("verify timeout")), VERIFY_TIMEOUT_MS)
+      );
+
+      debugLog(`[VERIFY-REQ] userRequest="${userRequest.slice(0, 80)}", agentResponse="${agentResponse.slice(0, 100)}"`);
+
+      const verdictRaw = await Promise.race([
+        llmProvider.chat(messages as LlmMessage[], { maxTokens: 100, temperature: 0 }),
+        timeoutPromise,
+      ]);
+
+      debugLog(`[VERIFY-RES] raw="${verdictRaw.trim()}"`);
+
+      const result = parseVerdict(verdictRaw.trim());
+
+      streamHandler.emitDirect({
+        type: "chat:toolCall",
+        toolCall: {
+          id: `verify-${Date.now()}`,
+          name: "verify_response",
+          args: { verdict: result.verdict, feedback: result.feedback || "" },
+          status: "completed",
+          result: verdictRaw.slice(0, 100),
+          duration: 0,
+        },
+      } as any);
+
+      if (result.verdict === "complete") {
+        debugLog(`[verify] Response is COMPLETE`);
+        return { lastUpdatedAt: new Date().toISOString() };
+      }
+
+      if (result.verdict === "tool_needed" && result.toolName) {
+        debugLog(`[verify] TOOL_NEEDED: ${result.toolName}`);
+        return {
+          toolCalls: [{
+            id: `verify-tc-${Date.now()}`,
+            name: result.toolName,
+            arguments: result.toolArgs || {},
+          }],
+          agentOutputs: [],
+          agentIterations: verifyCount + 1,
+          lastUpdatedAt: new Date().toISOString(),
+        } as Partial<PipelineState>;
+      }
+
+      // INCOMPLETE — add feedback and retry
+      debugLog(`[verify] INCOMPLETE: ${result.feedback}`);
+      const feedbackMsg: LlmMessage = {
+        role: "user",
+        content: `[SYSTEM REVIEW: Your response was incomplete. ${result.feedback}. Please try again using tools.]`,
+      };
+
+      // Append feedback to existing scratchpad (reducer replaces, so we accumulate here)
+      const updatedScratchpad: LlmMessage[] = [...(state.agentScratchpad || []), feedbackMsg];
+
+      return {
+        agentScratchpad: updatedScratchpad,
+        agentOutputs: [],
+        agentIterations: verifyCount + 1,
+        lastUpdatedAt: new Date().toISOString(),
+      } as Partial<PipelineState>;
+    } catch (err) {
+      debugLog(`[verify] Error: ${(err as Error).message} — skipping verify`);
+      return { lastUpdatedAt: new Date().toISOString() };
+    }
+  };
+}
+
+function parseVerdict(raw: string): VerifyResult {
+  const upper = raw.toUpperCase();
+  if (upper.startsWith("COMPLETE")) {
+    return { verdict: "complete" };
+  }
+  if (upper.startsWith("TOOL_NEEDED:")) {
+    const rest = raw.slice("TOOL_NEEDED:".length).trim();
+    const spaceIdx = rest.indexOf(" ");
+    if (spaceIdx > 0) {
+      const toolName = rest.slice(0, spaceIdx);
+      let toolArgs: Record<string, unknown> = {};
+      try { toolArgs = JSON.parse(rest.slice(spaceIdx + 1)); } catch { /* empty */ }
+      return { verdict: "tool_needed", toolName, toolArgs };
+    }
+    return { verdict: "tool_needed", toolName: rest || "list_directory", toolArgs: { path: "src", recursive: true } };
+  }
+  if (upper.startsWith("INCOMPLETE")) {
+    // Treat INCOMPLETE as TOOL_NEEDED with list_directory fallback
+    return { verdict: "tool_needed", toolName: "list_directory", toolArgs: { path: "src", recursive: true } };
+  }
+  // Default: treat as complete (don't infinite loop)
+  return { verdict: "complete" };
+}
+
+export function routeAfterVerify(state: PipelineState): string {
+  // If LLM failed (server down), stop immediately — don't loop back
+  if (state.pipelineStatus === "failed" || (state.errors && state.errors.length > 0)) {
+    return "__end__";
+  }
+  if (state.toolCalls && state.toolCalls.length > 0) {
+    return "execute_tools";
+  }
+  if (!state.agentOutputs || state.agentOutputs.length === 0) {
+    return "agent_step";
+  }
+  return "__end__";
+}

package/extension/src/langgraph/graphs/verify-prompt.ts

@@ -0,0 +1,45 @@
+/**
+ * Default verify prompt — evaluates if agent response satisfies user request.
+ * Can be overridden by .kiro/steering/verify-criteria.md
+ */
+
+export const DEFAULT_VERIFY_PROMPT = `You are a strict QA reviewer for an AI coding assistant.
+
+## THE MOST IMPORTANT RULE:
+The agent has access to tools (list_directory, read_file, grep_search).
+If the agent ASKS THE USER for file paths or information instead of using tools — that is ALWAYS wrong.
+The agent must NEVER ask the user for information it can look up itself.
+
+## Evaluation:
+- COMPLETE: Agent used tools AND provided a substantive answer with real data/code references
+- TOOL_NEEDED: Agent should call a specific tool (ALWAYS prefer this over INCOMPLETE)
+
+## Your output (EXACTLY one line, no explanation):
+- COMPLETE
+- TOOL_NEEDED: read_file {"path":"src/index.ts"}
+- TOOL_NEEDED: list_directory {"path":"src","recursive":true}
+
+## DECISION LOGIC:
+1. If agent said "please provide", "which file", "cho tôi biết", "bạn muốn" → respond:
+   TOOL_NEEDED: list_directory {"path":"src","recursive":true}
+2. If agent listed directory but didn't read any file → respond:
+   TOOL_NEEDED: read_file {"path":"src/index.ts"}
+3. If agent read files AND gave substantive review with code references → respond:
+   COMPLETE
+
+## CRITICAL: NEVER respond with just "INCOMPLETE". ALWAYS use TOOL_NEEDED with a specific tool.
+`;
+
+export function buildVerifyMessages(
+  userRequest: string,
+  agentResponse: string,
+  verifyPrompt: string
+): Array<{ role: string; content: string }> {
+  return [
+    { role: "system", content: verifyPrompt },
+    {
+      role: "user",
+      content: `User request: "${userRequest}"\n\nAgent response: "${agentResponse}"\n\nVerdict (one line only):`,
+    },
+  ];
+}

package/extension/src/langgraph/hook-commands.ts

@@ -0,0 +1,84 @@
+/**
+ * HookCommands — KSA-249
+ * Registers VS Code commands for userTriggered hooks.
+ * Each hook with when.type === "userTriggered" gets a command:
+ *   kiro-sdlc.hook.{sanitized-name}
+ */
+
+import * as vscode from "vscode";
+import { HookDefinition, loadHooks } from "./hook-loader";
+import { HookExecutor, HookContext } from "./hook-executor";
+
+export class HookCommands implements vscode.Disposable {
+  private disposables: vscode.Disposable[] = [];
+  private executor: HookExecutor;
+  private outputChannel: vscode.OutputChannel;
+  private workspaceRoot: string;
+
+  constructor(workspaceRoot: string, outputChannel: vscode.OutputChannel) {
+    this.workspaceRoot = workspaceRoot;
+    this.outputChannel = outputChannel;
+    this.executor = new HookExecutor(outputChannel);
+  }
+
+  /**
+   * Register VS Code commands for all userTriggered hooks.
+   * Disposes previous registrations before re-registering.
+   */
+  async registerCommands(): Promise<void> {
+    this.dispose();
+
+    const hooks = await loadHooks(this.workspaceRoot);
+    const userTriggered = hooks.filter(
+      h => h.when.type === "userTriggered" && h.enabled !== false
+    );
+
+    for (const hook of userTriggered) {
+      const commandId = `kiro-sdlc.hook.${this.sanitizeName(hook.name)}`;
+
+      const disposable = vscode.commands.registerCommand(commandId, async () => {
+        this.outputChannel.appendLine(`[CMD] Executing userTriggered hook: "${hook.name}"`);
+        const context: HookContext = {};
+        const result = await this.executor.execute(hook, context);
+
+        if (result.status === "completed") {
+          vscode.window.setStatusBarMessage(`Hook: ${hook.name}`, 3000);
+        } else {
+          vscode.window.showWarningMessage(`Hook "${hook.name}" ${result.status}: ${result.error || ""}`);
+        }
+      });
+
+      this.disposables.push(disposable);
+      this.outputChannel.appendLine(`[CMD] Registered: ${commandId}`);
+    }
+
+    if (userTriggered.length > 0) {
+      this.outputChannel.appendLine(`[CMD] ${userTriggered.length} userTriggered commands registered`);
+    }
+  }
+
+  /**
+   * Get list of registered command IDs.
+   */
+  async getRegisteredCommands(): Promise<string[]> {
+    const hooks = await loadHooks(this.workspaceRoot);
+    return hooks
+      .filter(h => h.when.type === "userTriggered" && h.enabled !== false)
+      .map(h => `kiro-sdlc.hook.${this.sanitizeName(h.name)}`);
+  }
+
+  /**
+   * Sanitize hook name to valid VS Code command segment.
+   */
+  private sanitizeName(name: string): string {
+    return name
+      .toLowerCase()
+      .replace(/[^a-z0-9]+/g, "-")
+      .replace(/^-+|-+$/g, "");
+  }
+
+  dispose(): void {
+    this.disposables.forEach(d => d.dispose());
+    this.disposables = [];
+  }
+}

package/extension/src/langgraph/hook-emitter.ts

@@ -0,0 +1,37 @@
+/**
+ * Hook Emitter — extracted from HookEngine
+ * Emits hook execution results as visible UI blocks via StreamHandler.
+ */
+
+import { StreamHandler } from "./stream-handler";
+import type { HookDefinition } from "./hook-loader";
+import type { HookResult } from "./hook-executor";
+
+const STATUS_MAP: Record<string, string> = {
+  completed: "completed",
+  failed: "failed",
+  timed_out: "failed",
+  denied: "completed",
+};
+
+export function emitHookFired(
+  streamHandler: StreamHandler,
+  streamId: string,
+  hook: HookDefinition,
+  event: string,
+  toolName: string | undefined,
+  result: HookResult,
+  duration: number
+): void {
+  streamHandler.emitDirect({
+    type: "chat:toolCall",
+    toolCall: {
+      id: `hook-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`,
+      name: "hook_fired",
+      args: { hookName: hook.name, event, toolName: toolName || "", action: hook.then.type },
+      status: STATUS_MAP[result.status] || "failed",
+      result: result.output ? result.output.slice(0, 200) : result.error || result.status,
+      duration,
+    },
+  } as any);
+}

package/extension/src/langgraph/hook-engine.ts

@@ -0,0 +1,171 @@
+/**
+ * HookEngine — KSA-280
+ * Unified hook engine for the Chat Panel LangGraph pipeline.
+ * Fires hooks at checkpoints (preToolUse, postToolUse, promptSubmit, agentStop).
+ */
+
+import { debugLog, debugError } from "../debug-logger";
+import { StreamHandler } from "./stream-handler";
+import { HookDefinition, loadHooks, clearHookCache, filterHooksByType } from "./hook-loader";
+import { HookExecutor, HookContext, HookResult } from "./hook-executor";
+import { classifyTool, getMatchingToolHooks, extractFilePath, matchGlob } from "./hook-tool-matcher";
+import { emitHookFired } from "./hook-emitter";
+import * as vscode from "vscode";
+
+export interface PreToolUseHookResult {
+  denied: boolean;
+  hookName?: string;
+  reason?: string;
+  injectedPrompts: string[];
+}
+
+export interface PostToolUseHookResult {
+  injectedPrompts: string[];
+}
+
+export class HookEngine {
+  private hooks: HookDefinition[] = [];
+  private loaded = false;
+  private executionStack: Set<string> = new Set();
+  private executor: HookExecutor;
+  private outputChannel: vscode.OutputChannel;
+
+  constructor(private readonly workspaceRoot: string) {
+    this.outputChannel = vscode.window.createOutputChannel("Kiro Hooks Engine");
+    this.executor = new HookExecutor(this.outputChannel, 60_000);
+  }
+
+  async initialize(): Promise<void> {
+    if (this.loaded) return;
+    try {
+      this.hooks = await loadHooks(this.workspaceRoot);
+      this.loaded = true;
+      debugLog(`[HookEngine] Initialized with ${this.hooks.length} hooks`);
+    } catch (err) {
+      debugError("[HookEngine] Failed to load hooks", err as Error);
+      this.hooks = [];
+      this.loaded = true;
+    }
+  }
+
+  async reload(): Promise<void> {
+    clearHookCache();
+    this.loaded = false;
+    await this.initialize();
+  }
+
+  async firePreToolUse(
+    toolName: string, args: Record<string, unknown>, streamHandler: StreamHandler, streamId: string
+  ): Promise<PreToolUseHookResult> {
+    await this.initialize();
+    const category = classifyTool(toolName);
+    const matching = getMatchingToolHooks(this.hooks, "preToolUse", toolName, category);
+    if (matching.length === 0) return { denied: false, injectedPrompts: [] };
+
+    const injectedPrompts: string[] = [];
+    const context: HookContext = { toolName, toolArgs: args };
+    for (const hook of matching) {
+      const result = await this.execSafe(hook, context, streamHandler, streamId, "preToolUse", toolName);
+      if (!result) continue;
+      if (result.status === "denied") {
+        return { denied: true, hookName: hook.name, reason: result.error, injectedPrompts };
+      }
+      if (hook.then.type === "askAgent" && result.status === "completed" && result.output) {
+        injectedPrompts.push(result.output);
+      }
+    }
+    return { denied: false, injectedPrompts };
+  }
+
+  async firePostToolUse(
+    toolName: string, args: Record<string, unknown>, toolResult: string,
+    streamHandler: StreamHandler, streamId: string
+  ): Promise<PostToolUseHookResult> {
+    await this.initialize();
+    const category = classifyTool(toolName);
+    const injectedPrompts: string[] = [];
+    const postHooks = getMatchingToolHooks(this.hooks, "postToolUse", toolName, category);
+    const context: HookContext = { toolName, toolArgs: args, toolResult };
+
+    for (const hook of postHooks) {
+      const r = await this.execSafe(hook, context, streamHandler, streamId, "postToolUse", toolName);
+      if (r && hook.then.type === "askAgent" && r.status === "completed" && r.output) injectedPrompts.push(r.output);
+    }
+
+    if (category === "write") {
+      const filePath = extractFilePath(toolName, args);
+      if (filePath) injectedPrompts.push(...await this.fireFileHooks(filePath, toolName, streamHandler, streamId));
+    }
+    return { injectedPrompts };
+  }
+
+  async firePromptSubmit(text: string, streamHandler: StreamHandler, streamId?: string): Promise<string[]> {
+    await this.initialize();
+    const matching = filterHooksByType(this.hooks, "promptSubmit");
+    if (matching.length === 0) return [];
+    const sid = streamId || `hook-prompt-${Date.now()}`;
+    const prompts: string[] = [];
+    for (const hook of matching) {
+      const r = await this.execSafe(hook, { toolArgs: { text } }, streamHandler, sid, "promptSubmit", undefined);
+      if (r && hook.then.type === "askAgent" && r.status === "completed" && r.output) prompts.push(r.output);
+    }
+    return prompts;
+  }
+
+  async fireAgentStop(streamHandler: StreamHandler, streamId?: string): Promise<string[]> {
+    await this.initialize();
+    const matching = filterHooksByType(this.hooks, "agentStop");
+    if (matching.length === 0) return [];
+    const sid = streamId || `hook-stop-${Date.now()}`;
+    const prompts: string[] = [];
+    for (const hook of matching) {
+      const r = await this.execSafe(hook, {}, streamHandler, sid, "agentStop", undefined);
+      if (r && hook.then.type === "askAgent" && r.status === "completed" && r.output) prompts.push(r.output);
+    }
+    return prompts;
+  }
+
+  getHookCount(): number { return this.hooks.length; }
+
+  dispose(): void {
+    this.outputChannel.dispose();
+    this.hooks = [];
+    this.loaded = false;
+    this.executionStack.clear();
+  }
+
+  private async execSafe(
+    hook: HookDefinition, context: HookContext, sh: StreamHandler,
+    streamId: string, event: string, toolName: string | undefined
+  ): Promise<HookResult | null> {
+    if (this.executionStack.has(hook.name)) return null;
+    this.executionStack.add(hook.name);
+    const start = Date.now();
+    try {
+      const result = await this.executor.execute(hook, context);
+      emitHookFired(sh, streamId, hook, event, toolName, result, Date.now() - start);
+      return result;
+    } catch (err) {
+      debugError(`[HookEngine] ${event} hook "${hook.name}" error`, err as Error);
+      return null;
+    } finally {
+      this.executionStack.delete(hook.name);
+    }
+  }
+
+  private async fireFileHooks(filePath: string, toolName: string, sh: StreamHandler, streamId: string): Promise<string[]> {
+    const eventType = (toolName === "fs_write" || toolName === "stream_write_file") ? "fileCreated" : "fileEdited";
+    const matching = this.hooks.filter(h => {
+      if (h.when.type !== eventType) return false;
+      if (!h.when.patterns || h.when.patterns.length === 0) return true;
+      return h.when.patterns.some(p => matchGlob(p, filePath));
+    });
+    const prompts: string[] = [];
+    const context: HookContext = { toolName, toolArgs: { filePath }, toolResult: filePath };
+    for (const hook of matching) {
+      const r = await this.execSafe(hook, context, sh, streamId, eventType, filePath);
+      if (r && hook.then.type === "askAgent" && r.status === "completed" && r.output) prompts.push(r.output);
+    }
+    return prompts;
+  }
+}