prism-code-review 2.0.0__py3-none-any.whl

prism/agents_security.py

@@ -0,0 +1,243 @@
+"""
+Security Agent - Scans for hardcoded secrets, dangerous patterns,
+insecure dependencies, and common vulnerability signatures.
+
+Rule IDs follow SonarQube convention: SECU-XXX
+"""
+
+import re
+from typing import List
+from prism.agents import BaseAgent, Finding, Severity, Blocker, register_agent
+from prism.langs import LANGUAGES, lang_for
+
+
+SECRET_PATTERNS = [
+    (r'(?i)(api[_-]?key|apikey)\s*[:=]\s*["\']([A-Za-z0-9_\-]{16,})["\']', "API Key", "SECU-101"),
+    # Prefixed names are the norm in real config (DB_PASSWORD, STRIPE_SECRET,
+    # SESSION_KEY); requiring the bare name at line start missed them all.
+    (r'(?i)(secret[_-]?key|secretkey|session[_-]?key|sessionkey)\s*[:=]\s*["\']([A-Za-z0-9_\-]{16,})["\']', "Secret Key", "SECU-102"),
+    (r'(?i)^\s*(?:[A-Za-z0-9]+[_-])?(?:password|passwd|pwd)\s*[:=]\s*["\']([^\s\'\"\n]{8,})["\']', "Password", "SECU-103"),
+    (r'(?i)(token|access_token)\s*[:=]\s*["\']([A-Za-z0-9_\-\.]{20,})["\']', "Auth Token", "SECU-104"),
+    (r'AKIA[0-9A-Z]{16}', "AWS Access Key ID", "SECU-105"),
+    (r'(?i)(github|gitlab)_token\s*[:=]\s*["\']([A-Za-z0-9_\-]{20,})["\']', "Git Token", "SECU-106"),
+    (r'(?i)(private_key|privatekey)\s*[:=]\s*["\']([^\s\'\"\n]{20,})["\']', "Private Key", "SECU-107"),
+    (r'(?i)(mysql|postgres|mongodb)://[^\s\'\"<>]+', "Database Connection String", "SECU-108"),
+    # --- Gitleaks-style provider-specific secrets (researched from gitleaks, trufflehog, detect-secrets) ---
+    (r'(?i)slack[_-]?token\s*[:=]\s*["\']([xox[baprs]-[A-Za-z0-9\-]{10,})["\']', "Slack Token", "SECU-109"),
+    (r'(?i)slack[_-]?webhook\s*[:=]\s*["\'](https://hooks\.slack\.com/services/[A-Za-z0-9/]+)["\']', "Slack Webhook URL", "SECU-110"),
+    # Real Stripe test keys are ~16 chars after the prefix (sk_test_51H8...),
+    # so a 24-char minimum let them through.
+    (r'(?i)(sk|pk)_(live|test)_[A-Za-z0-9]{12,}', "Stripe Key", "SECU-111"),
+    (r'(?i)twilio[_-]?(auth[_-]?token|sid)\s*[:=]\s*["\']([A-Za-z0-9]{20,})["\']', "Twilio Credential", "SECU-112"),
+    (r'(?i)sendgrid[_-]?api[_-]?key\s*[:=]\s*["\']([A-Za-z0-9_\-\.]{20,})["\']', "SendGrid API Key", "SECU-113"),
+    (r'(?i)(google[_-]?api[_-]?key|gcp[_-]?key)\s*[:=]\s*["\']([A-Za-z0-9_\-]{20,})["\']', "Google API Key", "SECU-114"),
+    (r'AIza[0-9A-Za-z_\-]{35}', "Google API Key (literal)", "SECU-115"),
+    (r'-----BEGIN (RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----', "PEM Private Key Block", "SECU-116"),
+    (r'(?i)jwt[_-]?secret\s*[:=]\s*["\']([^\s\'\"\n]{8,})["\']', "JWT Secret", "SECU-117"),
+    (r'(?i)(npm[_-]?token|npm[_-]?access[_-]?token)\s*[:=]\s*["\']([A-Za-z0-9_\-]{20,})["\']', "npm Token", "SECU-118"),
+    (r'(?i)(heroku|digitalocean)[_-]?(api[_-]?key|token)\s*[:=]\s*["\']([A-Za-z0-9_\-]{20,})["\']', "Cloud Provider Token", "SECU-119"),
+    (r'(?i)(auth[_-]?token|authtoken)\s*[:=]\s*["\']([A-Za-z0-9_\-\.]{16,})["\']', "Auth Token (generic)", "SECU-120"),
+    (r'(?i)(client[_-]?secret)\s*[:=]\s*["\']([^\s\'\"\n]{16,})["\']', "Client Secret", "SECU-121"),
+    (r'(?i)(access[_-]?key[_-]?id)\s*[:=]\s*["\']([A-Za-z0-9]{16,})["\']', "Access Key ID", "SECU-122"),
+    # Unquoted dotenv-style assignments (PASSWORD=hunter2). Quoted values are
+    # covered by the provider-specific patterns above; this catches .env files,
+    # which are the most common place for real secrets to leak.
+    (r'(?i)^\s*(?:\w+[_-])?(?:api[_-]?key|apikey|secret[_-]?(?:access[_-]?)?key|secretkey|password|passwd|pwd|token|access[_-]?key[_-]?id|access[_-]?token|auth[_-]?token|client[_-]?secret)\s*[:=]\s*([^\s"\']{6,})\s*$', "Unquoted Dotenv Secret", "SECU-123"),
+    # The generic patterns expect `name = "value"` or `name: "value"`. A C
+    # preprocessor constant and a shell export say the same thing with a keyword
+    # in front, and both were invisible.
+    (r'(?i)^\s*#define\s+\w*(?:key|token|secret|password|passwd|pwd)\s+"([^"\n]{8,})"', "C Preprocessor Secret", "SECU-124"),
+    (r'(?i)^\s*export\s+\w*(?:key|token|secret|password|passwd|pwd)\s*=\s*([^\s"\']{8,})', "Shell Exported Secret", "SECU-125"),
+]
+
+# `name := "value"` declares a variable in Go the way `name = "value"` assigns
+# one elsewhere. The generic patterns only knew `:` and `=`, so a literal secret
+# in a short declaration was invisible; widening the operator once covers every
+# pattern above.
+SECRET_PATTERNS = [
+    (pattern.replace(r"\s*[:=]\s*", r"\s*(?::=|[:=])\s*"), label, rule_id)
+    for pattern, label, rule_id in SECRET_PATTERNS
+]
+
+# The base list is Python/Node-shaped. These are the same defect classes in the
+# languages a regex can see without a parser, keyed by LanguageSpec.name.
+_LANG_DANGEROUS = {
+    "go": [
+        (r'exec\.Command\(\s*"(?:/bin/|/usr/bin/)?(?:ba)?sh"', "Shell command via sh - command injection risk", "SECU-220"),
+        (r'template\.HTML\s*\(', "Unescaped HTML in template - XSS risk", "SECU-221"),
+    ],
+    "java": [
+        (r'Runtime\.getRuntime\(\)\.exec\s*\(', "Runtime.exec - command injection risk", "SECU-222"),
+        (r'MessageDigest\.getInstance\(\s*"MD5"', "Use of MD5 - weak hash", "SECU-223"),
+    ],
+    "csharp": [
+        (r'\bProcess\.Start\s*\(', "Process.Start - command injection risk", "SECU-224"),
+        (r'\bMD5\.Create\s*\(', "Use of MD5 - weak hash", "SECU-225"),
+    ],
+    "c": [
+        (r'\bsystem\s*\(', "Use of system() - command injection risk", "SECU-226"),
+        (r'\bgets\s*\(', "Use of gets() - unbounded read, buffer overflow", "SECU-227"),
+        (r'\bstrcpy\s*\(', "Use of strcpy() - unbounded copy, buffer overflow", "SECU-228"),
+    ],
+    "cpp": [
+        (r'\bsystem\s*\(', "Use of system() - command injection risk", "SECU-226"),
+        (r'\bgets\s*\(', "Use of gets() - unbounded read, buffer overflow", "SECU-227"),
+        (r'\bstrcpy\s*\(', "Use of strcpy() - unbounded copy, buffer overflow", "SECU-228"),
+    ],
+    "rust": [
+        (r'Command::new\(\s*"(?:/bin/|/usr/bin/)?(?:ba)?sh"', "Shell command via sh - command injection risk", "SECU-229"),
+        (r'\bmd5\s*::', "Use of MD5 - weak hash", "SECU-230"),
+    ],
+    "php": [
+        (r'\b(?:system|exec|shell_exec|passthru|proc_open)\s*\(', "Shell execution - command injection risk", "SECU-231"),
+        (r'\bmd5\s*\(', "Use of MD5 - weak hash", "SECU-232"),
+    ],
+    "ruby": [
+        (r'\bsystem\s*\(', "Use of system() - command injection risk", "SECU-233"),
+        (r'Digest::MD5\b', "Use of MD5 - weak hash", "SECU-234"),
+    ],
+    "javascript": [
+        (r'dangerouslySetInnerHTML', "dangerouslySetInnerHTML - XSS risk", "SECU-235"),
+        (r'child_process\.exec\s*\(', "child_process.exec - command injection risk", "SECU-236"),
+    ],
+}
+
+# Gitleaks-style false-positive filtering, split into two tiers:
+#   SECRET_VALUE_ALLOWLIST  — obvious placeholders inside the secret itself
+#                            (e.g. "xxx", "changeme", "your_key_here").
+#                            Kept narrow on purpose so real-looking keys like
+#                            AKIAIOSFODNN7EXAMPLE still get flagged.
+#   SECRET_LINE_ALLOWLIST  — the surrounding line reads like a test fixture,
+#                            env-var lookup, or config template.
+SECRET_VALUE_ALLOWLIST = [
+    r'(?i)xxx|yyy|zzz|changeme|placeholder|your[_-]?key|dummy[_-]?key|sample[_-]?key',
+    r'(?i)<your[_-]?[^>]*>|<insert[^>]*>',
+    r'\{\{[^}]*\}\}',
+]
+
+SECRET_LINE_ALLOWLIST = [
+    r'(?i)test[_-]?key|mock[_-]?key|fake[_-]?key|dev[_-]?key',
+    r'(?i)os\.getenv|os\.environ|process\.env|import\.env',
+    r'\.env\b|\.env\.example|\.env\.template',
+    r'(?i)redacted|sanitized|scrubbed',
+]
+
+DANGEROUS_PATTERNS = [
+    (r"\beval\s*\(", "Use of eval() - code injection risk", "SECU-201"),
+    (r"\bexec\s*\(", "Use of exec() - code injection risk", "SECU-202"),
+    (r"subprocess\.(call|run|Popen)\s*\([^)]*shell\s*=\s*True", "Shell=True in subprocess - command injection risk", "SECU-203"),
+    (r"os\.system\s*\(", "Use of os.system() - command injection risk", "SECU-204"),
+    (r"pickle\.loads?\s*\(", "Use of pickle - deserialization risk", "SECU-205"),
+    (r"yaml\.load\s*\(", "Use of yaml.load() without SafeLoader - deserialization risk", "SECU-206"),
+    (r"yaml\.load\s*\([^)]*Loader\s*=\s*c\.SafeLoader", "yaml.load with SafeLoader (safe, no finding)", "SECU-206-SAFE"),
+    (r"SELECT\s+.+\s+FROM\s+.+\s+WHERE\s+.+\s*=\s*['\"].*\+", "SQL injection - string concatenation in query", "SECU-207"),
+    (r"document\.getElementById\([^)]*\)\.innerHTML\s*=", "XSS - innerHTML assignment", "SECU-208"),
+    (r"\.\w+\s*\+\s*['\"]", "Potential XSS - string concatenation in HTML", "SECU-209"),
+    (r"md5\s*\(", "Use of MD5 - weak hash", "SECU-210"),
+    (r"\bsha1\s*\(", "Use of SHA1 - weak hash", "SECU-211"),
+    (r"random\.random\(\)\s*\)?\s*==|random\.randint\(\s*0\s*,", "Insecure randomness (not crypto-safe)", "SECU-212"),
+    (r"requests\.(get|post|put|delete)\s*\([^)]*verify\s*=\s*False", "TLS verification disabled", "SECU-213"),
+    (r"chmod\s+777|os\.chmod\([^)]*0o?777", "Overly permissive file permissions (777)", "SECU-214"),
+    (r"harvest|harvesting|harvested", "Possible data exfiltration keyword", "SECU-215"),
+]
+
+INSECURE_DEPENDENCIES = {
+    "lodash": ("Use lodash-es or individual packages", "SECU-301"),
+    "moment": ("Replace with date-fns or luxon", "SECU-302"),
+    "axios": ("Use fetch or got", "SECU-303"),
+    "request": ("Deprecated - use got or node-fetch", "SECU-304"),
+    "node-uuid": ("Replace with crypto.randomUUID()", "SECU-305"),
+    "uuid": ("Use crypto.randomUUID() instead", "SECU-306"),
+    "request-promise": ("Use native fetch or got", "SECU-307"),
+    "body-parser": ("Use express.json() directly", "SECU-308"),
+    "helmet": ("Outdated - use express-helmet or helmet v5+", "SECU-309"),
+}
+
+
+@register_agent
+class SecurityAgent(BaseAgent):
+    name = "security"
+    description = "Scans for secrets, dangerous patterns, and vulnerabilities"
+
+    def _check(self, file_path: str, content: str, diff: str,
+               skeleton: str = "", line_count: int = None,
+               fast: bool = False) -> List[Finding]:
+        findings: List[Finding] = []
+        lines = content.split("\n")
+        current_file = file_path
+        spec = lang_for(file_path)
+
+        # Reading a secret from the environment is a lookup, not a hardcoded
+        # value. Every language spells it differently, so a Go or Java
+        # `getenv` used to be reported as a leaked secret.
+        line_allowlist = SECRET_LINE_ALLOWLIST + [
+            pattern for lang in LANGUAGES for pattern in lang.env_lookup
+        ]
+        dangerous = list(DANGEROUS_PATTERNS)
+        if spec is not None:
+            dangerous += _LANG_DANGEROUS.get(spec.name, [])
+
+        for i, line in enumerate(lines, 1):
+            for pattern, label, rule_id in SECRET_PATTERNS:
+                match = re.search(pattern, line, re.IGNORECASE)
+                if not match:
+                    continue
+                # Gitleaks-style two-tier false-positive filtering.
+                # Tier 1 (value): obvious placeholders inside the secret itself
+                #   — kept narrow so real-looking keys (e.g. AKIAIOSFODNN7EXAMPLE)
+                #     still get flagged.
+                # Tier 2 (line): the surrounding line reads like a test fixture,
+                #   env-var lookup, or config template.
+                captured = match.group(match.lastindex) if match.lastindex else ""
+                if any(re.search(v, captured, re.IGNORECASE)
+                       for v in SECRET_VALUE_ALLOWLIST):
+                    continue
+                if any(re.search(a, line, re.IGNORECASE)
+                       for a in line_allowlist):
+                    continue
+                findings.append(Finding(
+                    agent=self.name,
+                    severity=Severity.CRITICAL,
+                    category="Secret Exposure",
+                    message="Possible {} detected".format(label.lower()),
+                    file=current_file,
+                    line=i,
+                    suggestion="Remove hardcoded secret. Use environment variables or a secrets manager.",
+                    blocker=Blocker.BLOCKS,
+                    confidence=0.85,
+                    rule_id=rule_id,
+                ))
+
+            for pattern, label, rule_id in dangerous:
+                if rule_id == "SECU-206-SAFE":
+                    continue  # positive match, not a finding
+                if re.search(pattern, line, re.IGNORECASE):
+                    findings.append(Finding(
+                        agent=self.name,
+                        severity=Severity.HIGH,
+                        category="Dangerous Pattern",
+                        message=label,
+                        file=current_file,
+                        line=i,
+                        suggestion="Review this pattern for security risks.",
+                        blocker=Blocker.BLOCKS,
+                        confidence=0.80,
+                        rule_id=rule_id,
+                    ))
+
+        if file_path.endswith(("package.json", "requirements.txt", "Cargo.toml", "go.mod")):
+            for dep, (advice, rule_id) in INSECURE_DEPENDENCIES.items():
+                if dep in content:
+                    findings.append(Finding(
+                        agent=self.name,
+                        severity=Severity.MEDIUM,
+                        category="Insecure Dependency",
+                        message="Use of '{}' - {}".format(dep, advice),
+                        file=current_file,
+                        suggestion=advice,
+                        blocker=Blocker.WARNS,
+                        confidence=0.90,
+                        rule_id=rule_id,
+                    ))
+
+        return findings

prism/agents_test.py

@@ -0,0 +1,145 @@
+"""
+Test Agent - Validates that tests exist, tests pass, and measures coverage.
+
+Rule IDs follow SonarQube convention: TST-XXX
+"""
+
+import ast
+import re
+from typing import List
+from prism.agents import BaseAgent, Finding, Severity, Blocker, register_agent
+from prism.feedback import measure_coverage
+
+
+@register_agent
+class TestAgent(BaseAgent):
+    name = "test"
+    description = "Checks test coverage and validates test files"
+
+    def _check(self, file_path: str, content: str, diff: str,
+               skeleton: str = "", line_count: int = None,
+               fast: bool = False) -> List[Finding]:
+        findings: List[Finding] = []
+        lines = content.split("\n")
+        is_test_file = "test" in file_path.lower() or "spec" in file_path.lower()
+        is_python = file_path.endswith(".py")
+
+        # TST-101 is a WARNING, not a blocker. Missing tests are important to
+        # surface but should never block a commit — that would make the
+        # tool unusable on its own codebase (every module without a paired
+        # test file would fail). Developers see the warning and decide.
+        if not is_test_file and is_python and len(lines) > 20:
+            findings.append(Finding(
+                agent=self.name,
+                severity=Severity.MEDIUM,
+                category="Missing Tests",
+                message="No test file found for {}".format(file_path),
+                file=file_path,
+                suggestion="Add unit tests before committing.",
+                blocker=Blocker.WARNS,
+                confidence=0.75,
+                rule_id="TST-101",
+            ))
+
+        if is_test_file:
+            test_bodies = re.findall(
+                r'def\s+(test_\w+)\(.*\):\s*\n\s*"""(.*?)"""', content, re.DOTALL
+            )
+            for name, docstring in test_bodies:
+                if not docstring.strip():
+                    findings.append(Finding(
+                        agent=self.name,
+                        severity=Severity.LOW,
+                        category="Unclear Test",
+                        message="Test '{}' has no docstring".format(name),
+                        file=file_path,
+                        line=1,
+                        suggestion="Add a description of what the test validates.",
+                        blocker=Blocker.WARNS,
+                        confidence=0.85,
+                        rule_id="TST-102",
+                    ))
+            findings.extend(_check_weak_assertions(content, file_path))
+            findings.extend(_check_test_naming(content, file_path))
+
+        # Measure actual coverage. This is a repo-wide metric (runs pytest on the
+        # whole project), not a per-file one — running it on every file review
+        # made the LSP server take 5.6s per file. It now only runs in
+        # balanced/max effort (fast=False); lite mode skips it entirely.
+        if not fast and is_test_file:
+            try:
+                cov = measure_coverage()
+                if cov.get("coverage", 0) > 0 and cov["coverage"] < 0.80:
+                    findings.append(Finding(
+                        agent=self.name,
+                        severity=Severity.MEDIUM,
+                        category="Low Coverage",
+                        message="Test coverage is {:.0f}% (minimum 80%)".format(
+                            cov["coverage"] * 100),
+                        file=file_path,
+                        suggestion="Add more unit tests to improve coverage.",
+                        blocker=Blocker.WARNS,
+                        confidence=1.0,
+                        rule_id="TST-103",
+                    ))
+            except Exception:
+                pass
+
+        return findings
+
+
+def _check_weak_assertions(content: str, file_path: str) -> List[Finding]:
+    """Flag assertions that always pass or are otherwise meaningless."""
+    findings = []
+    lines = content.split("\n")
+    weak = [
+        (r'\bassert\s+True\b', "assert True always passes"),
+        (r'\bassert\s+1\b', "assert 1 always passes"),
+        (r'\bassert\s+0\b', "assert 0 always fails"),
+        (r'\bassert\s+None\b', "assert None always fails"),
+        (r'\bassert\s+False\b', "assert False always fails"),
+        (r'\bassert\s+\w+\s*!=\s*\w+\b', "assert x != y compares two variables (may be vacuous)"),
+    ]
+    for i, line in enumerate(lines):
+        for pattern, message in weak:
+            if re.search(pattern, line):
+                findings.append(Finding(
+                    agent="test",
+                    severity=Severity.MEDIUM,
+                    category="Weak Assertion",
+                    message=message,
+                    file=file_path,
+                    line=i + 1,
+                    suggestion="Assert on a meaningful condition.",
+                    blocker=Blocker.WARNS,
+                    confidence=0.80,
+                    rule_id="TST-104",
+                ))
+                break
+    return findings
+
+
+def _check_test_naming(content: str, file_path: str) -> List[Finding]:
+    """Flag test functions whose names don't follow conventions."""
+    findings = []
+    try:
+        tree = ast.parse(content)
+    except (SyntaxError, ValueError):
+        return findings
+    for node in ast.walk(tree):
+        if isinstance(node, (ast.FunctionDef, ast.AsyncFunctionDef)):
+            if not node.name.startswith("test_"):
+                if "test" in node.name.lower():
+                    findings.append(Finding(
+                        agent="test",
+                        severity=Severity.LOW,
+                        category="Test Naming",
+                        message="Test function '{}' should use 'test_' prefix".format(node.name),
+                        file=file_path,
+                        line=node.lineno,
+                        suggestion="Name tests as test_<scenario>_<expected>.",
+                        blocker=Blocker.WARNS,
+                        confidence=0.75,
+                        rule_id="TST-105",
+                    ))
+    return findings

prism/ai_architecture.py

@@ -0,0 +1,65 @@
+"""
+AI Architecture Agent - Uses Gemini for architectural code review.
+
+Catches: architectural smells, design pattern violations, coupling issues,
+modularity problems, and scalability concerns.
+
+Rule IDs follow SonarQube convention: ARC-XXX
+"""
+
+import logging
+from typing import List
+from prism.agents import BaseAgent, Finding, register_agent
+from prism.ai_common import review_with_agent
+
+logger = logging.getLogger(__name__)
+
+SYSTEM_PROMPT = """
+You are a software architect with 15+ years of experience designing large-scale systems.
+You review code for architectural issues that affect maintainability, scalability, and extensibility.
+
+Focus on:
+1. Tight coupling (classes/functions that do too much, depend on too many other components)
+2. Poor modularity (code that should be split into separate modules)
+3. God functions (single functions that do 10+ unrelated things)
+4. Missing abstraction (repeated patterns that should be interfaces or base classes)
+5. Layer violations (lower layers calling higher layers, creating cycles)
+6. Scalability concerns (in-memory state, unbounded collections, synchronous I/O in hot paths)
+7. Design pattern violations (using the wrong pattern for the problem)
+8. Hidden dependencies (functions relying on global state or hidden side effects)
+
+Rules:
+1. Return ONLY valid JSON. No markdown, no extra text.
+2. Be specific. Each finding must include: severity, category, message, file, line, suggestion, suggested_code.
+3. For suggested_code, provide the actual code that fixes the architectural issue.
+4. Focus on issues that will cause real problems as the system grows.
+5. If you find no issues, return empty findings array.
+
+Schema:
+{
+  "findings": [
+    {
+      "severity": "critical" | "high" | "medium" | "low",
+      "category": "string",
+      "message": "string",
+      "file": "string",
+      "line": number,
+      "suggestion": "string",
+      "suggested_code": "string or null"
+    }
+  ],
+  "summary": "2-3 sentence overall architectural assessment"
+}
+"""
+
+
+@register_agent
+class AIArchitectureAgent(BaseAgent):
+    name = "ai_architecture"
+    description = "AI-powered architecture reviewer using Gemini"
+
+    def _check(self, file_path: str, content: str, diff: str,
+               skeleton: str = "", line_count: int = None,
+               fast: bool = False) -> List[Finding]:
+        return review_with_agent(SYSTEM_PROMPT, file_path, content,
+                                 self.name, skeleton, line_count, diff, fast)

prism/ai_common.py

@@ -0,0 +1,32 @@
+"""Shared AI agent utilities — public API facade.
+
+Implementation is split across:
+  - ai_providers.py : provider init, API call dispatch, retry/circuit-breaker
+  - ai_findings.py  : JSON parsing, finding verification, cross-check
+  - ai_graph.py     : import graph and cross-file context
+  - ai_pipeline.py  : chunking, tiers, two-pass summarization, review_with_agent
+
+This module re-exports the names call sites already import so backwards
+compatibility is preserved. New code should import from the submodules
+directly.
+"""
+
+import logging
+
+from prism.ai_providers import (
+    get_model, API_TIMEOUT, MAX_RETRIES, MAX_CONTENT_CHARS,
+)
+from prism.ai_findings import parse_findings, verify_findings
+from prism.ai_graph import build_import_graph, get_cross_file_context
+from prism.ai_pipeline import (
+    chunk_content, build_skeleton, get_tier_for_file, review_with_agent,
+)
+
+logger = logging.getLogger(__name__)
+
+__all__ = [
+    "get_model", "parse_findings", "verify_findings",
+    "build_import_graph", "get_cross_file_context", "chunk_content",
+    "build_skeleton", "get_tier_for_file", "review_with_agent",
+    "API_TIMEOUT", "MAX_RETRIES", "MAX_CONTENT_CHARS",
+]

prism/ai_findings.py

@@ -0,0 +1,181 @@
+"""Parse LLM JSON into Finding objects and verify them before delivery.
+
+Verification catches hallucinated line numbers, invalid suggested code,
+duplicates, and findings whose message references code not at the claimed
+line. Categories with a deterministic regex equivalent also get a
+cross-check (the CodeRabbit "verification agent" pattern).
+"""
+
+import re
+import hashlib
+import logging
+
+from prism.langs import lang_for
+
+logger = logging.getLogger(__name__)
+
+_CROSS_CHECK_CATEGORIES = {
+    "Secret Exposure",
+    "Dangerous Pattern",
+    "Duplication",
+    "File Length",
+    "Todo",
+    "Naming Convention",
+}
+
+_AGENT_PREFIX = {
+    "ai_security": "SECU",
+    "ai_quality": "QUAL",
+    "ai_policy": "POL",
+    "ai_test": "TST",
+    "ai_architecture": "ARC",
+    "ai_performance": "PERF",
+}
+
+
+def _is_python(file_path):
+    """True when a suggested fix for ``file_path`` must parse as Python."""
+    spec = lang_for(file_path)
+    return spec is None or spec.name == "python"
+
+
+def _finding_id(prefix, item, file_path):
+    """Deterministic per-instance ID derived from the finding's content.
+
+    Using a content hash instead of a sequence number guarantees uniqueness
+    across calls — chunked reviews call parse_findings once per chunk, so a
+    sequence counter would restart and emit duplicate SECU-AI-001 IDs. The
+    hash is stable across runs, so the same finding gets the same ID.
+    """
+    raw = "{}|{}|{}|{}".format(
+        file_path,
+        item.get("line"),
+        item.get("message", ""),
+        item.get("category", ""),
+    )
+    digest = hashlib.sha256(raw.encode("utf-8")).hexdigest()[:4]
+    return "{}-AI-{}".format(prefix, digest)
+
+
+def parse_findings(result, file_path, agent_name):
+    """Parse LLM JSON response into Finding objects with unique rule IDs."""
+    from prism.agents import Finding, Severity, Blocker
+
+    prefix = _AGENT_PREFIX.get(agent_name, agent_name.upper()[:4])
+    findings = []
+    for item in result.get("findings", []):
+        try:
+            line_val = item.get("line")
+            if line_val is not None:
+                try:
+                    line_val = int(line_val)
+                except (ValueError, TypeError):
+                    line_val = None
+
+            sev_str = str(item.get("severity", "low")).lower()
+            confidence = item.get("confidence", 0.85)
+            try:
+                confidence = float(confidence)
+            except (ValueError, TypeError):
+                confidence = 0.85
+
+            findings.append(Finding(
+                agent=agent_name,
+                severity=Severity(sev_str),
+                category=item.get("category", agent_name),
+                message=item.get("message", ""),
+                file=item.get("file", file_path),
+                line=line_val,
+                suggestion=item.get("suggestion"),
+                suggested_code=item.get("suggested_code"),
+                blocker=Blocker.BLOCKS if sev_str in ("critical", "high") else Blocker.WARNS,
+                confidence=confidence,
+                rule_id=_finding_id(prefix, item, file_path),
+            ))
+        except Exception as exc:
+            logger.warning("Finding parse error: %s", exc)
+    return findings
+
+
+def verify_findings(findings, file_path, content):
+    """Validate AI-generated findings before they reach the user."""
+    if not findings:
+        return []
+
+    lines = content.split("\n")
+    max_line = len(lines)
+    verified, seen = [], set()
+
+    for f in findings:
+        if f.line is not None and (f.line < 1 or f.line > max_line):
+            logger.warning("Dropped: line %s out of bounds (%d lines)", f.line, max_line)
+            continue
+        if not file_path or '\x00' in file_path:
+            logger.warning("Dropped: invalid file path '%s'", file_path)
+            continue
+
+        key = (f.agent, f.line, f.message.strip().lower()[:100])
+        if key in seen:
+            logger.warning("Dropped duplicate: %s", f.message[:80])
+            continue
+        seen.add(key)
+
+        if f.suggested_code and _is_python(f.file):
+            # Only a Python fix can be parsed here. Rejecting a Go or Rust
+            # snippet for not being valid Python would discard a correct finding
+            # along with the suggestion attached to it.
+            try:
+                import ast
+                ast.parse(f.suggested_code)
+            except SyntaxError:
+                logger.warning("Dropped: invalid suggested_code: %s", f.suggested_code[:80])
+                continue
+
+        if f.line is not None and f.line <= max_line:
+            nearby = "\n".join(lines[max(0, f.line - 3):f.line + 3])
+            code_words = {
+                w for w in re.findall(r'[a-zA-Z_][a-zA-Z0-9_]{2,}', f.message)
+                if '_' in w or re.match(r'^[a-z]+[A-Z]', w)
+            }
+            if code_words and not any(w.lower() in nearby.lower() for w in code_words):
+                logger.warning("Dropped: message references code not at line %s", f.line)
+                continue
+
+        if f.category in _CROSS_CHECK_CATEGORIES:
+            confirmed, reason = _cross_check(f, lines)
+            if not confirmed:
+                f.confidence = max(0.1, f.confidence * 0.5)
+                logger.info("Verification: no deterministic support (%s) — confidence %.2f",
+                            reason, f.confidence)
+
+        verified.append(f)
+
+    logger.info("Verification: %d/%d findings passed", len(verified), len(findings))
+    return verified
+
+
+def _cross_check(finding, lines):
+    """Cross-check an AI finding against deterministic regex patterns."""
+    line_no = finding.line
+    if line_no is None or line_no < 1 or line_no > len(lines):
+        return False, "no line to check"
+    line_text = lines[line_no - 1]
+
+    if finding.category in ("Secret Exposure", "Dangerous Pattern"):
+        try:
+            from prism.agents_security import SECRET_PATTERNS, DANGEROUS_PATTERNS
+        except Exception:
+            return False, "security patterns unavailable"
+        for pattern, _label, _rule_id in SECRET_PATTERNS + DANGEROUS_PATTERNS:
+            if re.search(pattern, line_text, re.IGNORECASE):
+                return True, "regex pattern matches at claimed line"
+
+    if finding.category == "File Length" and len(line_text) > 120:
+        return True, "line exceeds 120 chars"
+    if finding.category == "Todo" and re.search(r'TODO|FIXME|XXX', line_text):
+        return True, "TODO marker found"
+    if finding.category == "Naming Convention" and finding.file and finding.file.endswith(".py"):
+        if re.search(r'\b[a-z]+[A-Z]\w*\s*=', line_text):
+            return True, "camelCase variable found"
+
+    return False, "no deterministic pattern supports this finding"