feat(update): working on next release

♬ Stefano Di Carlo - Tema

Author: Mte90

src/exploit/prompt.rs

@@ -194,7 +194,12 @@ malicious = "../../../etc/passwd"
 /// Generic prompt template for unknown CWEs
 fn generic_prompt(finding: &VulnerabilityFinding, vulnerable_code: &str, expected: &str) -> String {
     let title = &finding.title;
-    let cwe = finding.cwe_id.as_deref().unwrap_or("Unknown CWE");
+    // "Unknown CWE" reads as a classification. The absence is the fact, and the
+    // PoC writer needs to know it is inferring rather than confirming a class.
+    let cwe = match finding.cwe_id.as_deref() {
+        Some(c) if !c.is_empty() => c,
+        _ => "(none assigned to this finding; infer the class from the code)",
+    };
 
     format!(
         r#"You are a security researcher generating a Proof of Concept (PoC) for a vulnerability.

src/llm/mod.rs

@@ -429,6 +429,23 @@ async fn execute_with_retry(
                                 .unwrap_or("")
                                 .to_string();
 
+                            // A model answering in prose may omit tool_calls entirely. A
+                            // tool_calls key that is present but not a list is a corrupt
+                            // payload, and parse_tool_calls would turn it into an empty vec,
+                            // leaving the agent as though the model chose not to act.
+                            match message.get("tool_calls") {
+                                None | Some(serde_json::Value::Null) => {}
+                                Some(tc) if tc.is_array() => {}
+                                Some(_) => {
+                                    return Err(ScanError::Parse {
+                                        message:
+                                            "Malformed tools response: tool_calls is not a list"
+                                                .to_string(),
+                                        source: None,
+                                    });
+                                }
+                            }
+
                             let tool_calls = parse_tool_calls(message);
 
                             if tools_response_is_malformed(&content, tool_calls.len()) {
@@ -951,11 +968,10 @@ impl LlmClient {
                 Ok(response)
             }
             Err(e) => {
-                tracing::warn!("LLM API (with tools) {} failed: {}", chat_url, e);
-                Err(ScanError::Network {
-                    message: "LLM API request failed".to_string(),
-                    source: None,
-                })
+                // A malformed response is not a network failure. Collapsing every
+                // error into Network made a corrupt payload indistinguishable from a
+                // connection problem, and dropped the detail that says which.
+                Err(e)
             }
         }
     }

src/llm_analysis.rs

@@ -1685,8 +1685,18 @@ impl LlmAnalyzer {
                                     snippet.push('\n');
                                 }
                             }
-                            snippet.push_str(">>> VULNERABLE CODE <<<\n");
-                            snippet.push_str(code);
+                            // before/after are already omitted when empty. The vulnerable body was not:
+                            // an absent snippet still produced a "VULNERABLE CODE" header
+                            // over nothing, which reads as source that was examined.
+                            if code.trim().is_empty() {
+                                snippet.push_str(
+                                    "(no source captured for this finding; the location was \
+                                     reported without its code)\n",
+                                );
+                            } else {
+                                snippet.push_str(">>> VULNERABLE CODE <<<\n");
+                                snippet.push_str(code);
+                            }
                             if !code.ends_with('\n') {
                                 snippet.push('\n');
                             }

src/llm_verification.rs

@@ -136,22 +136,33 @@ where
     variables.insert("FILE_PATH".to_string(), finding.file_path.clone());
     variables.insert(
         "LINE_NUMBER".to_string(),
-        finding
-            .line_number
-            .map(|l| l.to_string())
-            .unwrap_or_default(),
+        match finding.line_number {
+            Some(l) => l.to_string(),
+            None => "not recorded".to_string(),
+        },
     );
     variables.insert(
         "CWE_ID".to_string(),
-        finding.cwe_id.clone().unwrap_or_default(),
+        match finding.cwe_id.as_deref() {
+            Some(c) if !c.is_empty() => c.to_string(),
+            _ => "not assigned".to_string(),
+        },
     );
     variables.insert(
         "VULNERABILITY_DESCRIPTION".to_string(),
         finding.description.clone(),
     );
     variables.insert(
         "CODE_SNIPPET".to_string(),
-        finding.code_snippet.clone().unwrap_or_default(),
+        match finding.code_snippet.as_deref() {
+            Some(s) if !s.trim().is_empty() => s.to_string(),
+            // An empty slot here reads as "this code is empty", which is evidence
+            // of something. Say that no source was captured, so the judge weighs
+            // the reasoning instead of the absence of code.
+            _ => "(no source snippet was captured for this finding; \
+                  do not read the absence of code as evidence either way)"
+                .to_string(),
+        },
     );
 
     let prompt = render_template(RATIONALE_CHECK_PROMPT_TEMPLATE, &variables);

src/prompt/engine.rs

@@ -280,7 +280,10 @@ impl PromptEngine {
         // Git analysis
         vars.insert("FINDING_TITLE".to_string(), "<finding_title>".to_string());
         vars.insert("FILE_PATH".to_string(), "<file_path>".to_string());
-        vars.insert("LINE_NUMBER".to_string(), "0".to_string());
+        // "0" was the odd one out here: every other entry is bracketed as a
+        // placeholder, and a bare 0 reads to anything consuming the registry as a
+        // real line number.
+        vars.insert("LINE_NUMBER".to_string(), "<line_number>".to_string());
         vars.insert(
             "VULNERABILITY_DESCRIPTION".to_string(),
             "<vulnerability_description>".to_string(),

src/scanner/phases/llm_phases/static_analysis.rs

@@ -627,6 +627,29 @@ pub fn triage_snippet(path: &std::path::Path, max_lines: usize) -> std::io::Resu
 /// input here -- the function has no other judgement of its own -- and the bug
 /// this test exists for is entirely about what happens when the reply is a valid
 /// JSON that simply omits a file.
+/// The next batch cursor, or `None` once every file has been sent.
+///
+/// Returning the cursor instead of only the end lets the caller assert that the
+/// sweep terminates for any batch size. `batch_end = batch_start + batch_size` with
+/// a batch size of zero pins the cursor, and the sweep then runs forever without
+/// ever yielding, which no timeout can interrupt.
+/// Where the next batch ends, or `None` once every file has been sent.
+///
+/// Returning the end rather than only asserting it inside the loop is what makes
+/// the sweep's termination checkable. `end = start + batch_size` with a batch size
+/// of zero leaves the cursor pinned and the loop runs forever without ever yielding,
+/// which no timeout can interrupt — a mutation run caught this as a 600s timeout on
+/// `default_triage_batch_size -> 0` rather than as a failing test.
+pub fn next_batch_end(total: usize, start: usize, batch_size: u8) -> Option<usize> {
+    if start >= total {
+        return None;
+    }
+    Some(std::cmp::min(
+        start + std::cmp::max(batch_size, 1) as usize,
+        total,
+    ))
+}
+
 pub async fn run_triage_cascade<'a>(
     client: &impl crate::llm::LlmChatClient,
     files: &'a [crate::indexer::FileInfo],
@@ -651,10 +674,12 @@ pub async fn run_triage_cascade<'a>(
     let mut skipped_files = Vec::new();
     let mut unreadable_files: Vec<String> = Vec::new();
 
-    // Process files in batches
+    // The cursor arithmetic is extracted so it can be asserted directly. Running
+    // the loop to observe a hang does not work: a `while` that never yields
+    // cannot be interrupted by tokio::time::timeout, so a regression takes the
+    // whole test binary down instead of failing one test.
     let mut batch_start = 0;
-    while batch_start < files.len() {
-        let batch_end = std::cmp::min(batch_start + batch_size as usize, files.len());
+    while let Some(batch_end) = next_batch_end(files.len(), batch_start, batch_size) {
         let batch = &files[batch_start..batch_end];
 
         // A file we cannot read is not a clean file. Sending it with an empty

src/scanner/phases/llm_phases/verification.rs

@@ -123,29 +123,42 @@ pub fn refute_with_primitive_check(
     if status != VerificationStatus::Confirmed {
         return (status, notes.to_string());
     }
-    if let Some((_body, found)) = anchored_body_containing_primitive(finding, primitives) {
-        let reason = format!(
-            "not confirmed: {} found in the body of the function this finding names",
-            found
-        );
-        let merged = if notes.trim().is_empty() {
-            reason
-        } else {
-            format!("{notes} ({reason})")
-        };
-        return (VerificationStatus::FalsePositive, merged);
+    match anchored_body_containing_primitive(finding, primitives) {
+        Some(Ok((_body, found))) => {
+            let reason = format!(
+                "not confirmed: {} found in the body of the function this finding names",
+                found
+            );
+            let merged = if notes.trim().is_empty() {
+                reason
+            } else {
+                format!("{notes} ({reason})")
+            };
+            (VerificationStatus::FalsePositive, merged)
+        }
+        Some(Err(read_error)) => {
+            let reason = format!("{read_error}: {path}", path = finding.file_path);
+            let merged = if notes.trim().is_empty() {
+                reason
+            } else {
+                format!("{notes} ({reason})")
+            };
+            (VerificationStatus::NeedsReview, merged)
+        }
+        None => (status, notes.to_string()),
     }
-    (status, notes.to_string())
 }
 
 /// The body of the function the title names, if it contains a primitive.
 ///
-/// Returns the body and which primitive matched, so the reason names the
-/// evidence rather than asserting that a check happened.
+/// Returns:
+/// - `Some(Ok((body, primitive)))` if the file was read and a primitive was found
+/// - `Some(Err(String))` if the file could not be read (missing, permissions, etc.)
+/// - `None` if the file was read but no primitive was found, or if language/name could not be determined
 fn anchored_body_containing_primitive(
     finding: &VulnerabilityFinding,
     primitives: &std::collections::HashMap<String, Vec<String>>,
-) -> Option<(String, String)> {
+) -> Option<Result<(String, String), String>> {
     let language = extract_language_from_path(&finding.file_path);
     let for_language = primitives.get(&language)?;
     if for_language.is_empty() {
@@ -154,7 +167,10 @@ fn anchored_body_containing_primitive(
     let name = crate::llm_analysis::function_names_in_title(&finding.title)
         .into_iter()
         .next()?;
-    let content = std::fs::read_to_string(&finding.file_path).ok()?;
+    let content = match std::fs::read_to_string(&finding.file_path) {
+        Ok(c) => c,
+        Err(e) => return Some(Err(format!("cannot read file: {}", e))),
+    };
     let ranges = crate::llm_analysis::function_line_ranges(&content, &language);
     let (start, end) = *ranges.get(&name)?;
 
@@ -163,7 +179,7 @@ fn anchored_body_containing_primitive(
         .iter()
         .find(|p| !p.is_empty() && body.contains(p.as_str()))?
         .clone();
-    Some((body, found))
+    Some(Ok((body, found)))
 }
 
 /// The function body, by its 1-indexed line range.

src/scanner/phases/other_phases/patching.rs

@@ -1,5 +1,6 @@
 use crate::error::ScanResult;
 use crate::findings::VulnerabilityFinding;
+use crate::llm::phase_llm_config;
 use crate::scanner::phases::PhaseConfig;
 
 /// Run auto patching phase (phase 19 of 23).
@@ -12,7 +13,7 @@ pub async fn run_auto_patching(
         findings,
         pb: _,
         analyzed_files,
-        metrics_tracker: _,
+        metrics_tracker,
         target_path,
         config,
         project_stack: _,
@@ -26,10 +27,23 @@ pub async fn run_auto_patching(
 
     tracing::info!("Running auto patching phase");
 
-    let patcher = crate::staging::AutoPatcher::new(target_path.to_path_buf());
+    let llm_config = match phase_llm_config(config, "auto_patching", None) {
+        Ok(c) => c,
+        Err(e) => {
+            tracing::warn!("Auto patching has no usable LLM config: {e}");
+            return Ok((findings, analyzed_files.to_vec()));
+        }
+    };
+    let client = std::sync::Arc::new(crate::llm::LlmClient::with_metrics(
+        llm_config,
+        Some(metrics_tracker.clone()),
+    ));
+    let patcher = crate::staging::AutoPatcher::with_llm(target_path.to_path_buf(), client);
     let patching_config = crate::staging::PatchingConfig::default();
 
-    match patcher.execute_batch_with_vuln_spec(&findings, &patching_config, Some(&config.vuln_spec))
+    match patcher
+        .execute_batch_with_vuln_spec(&findings, &patching_config, Some(&config.vuln_spec))
+        .await
     {
         Ok(patched_findings) => {
             tracing::info!(