Conversation
…ard, vet fix
AI provider fallback:
- ui_api.go adds aiChat(): tries OpenRouter (UI header key or OPENROUTER_API_KEY)
then falls back to the shared brain.ChatWithAI chain (OpenCode -> Z.ai -> Gemini).
apiValidateFinding and apiReportFinding now use it, so an OpenCode-only setup no
longer fails with "No OpenRouter API key configured".
Multi-finding AI report:
- New POST /api/findings/report-batch (apiReportFindingsBatch): accepts 1..N
selected findings (capped at 25), builds a prompt from each finding's
target/type/severity/module/evidence, and uses an attacker-mindset system
prompt enforcing the Title/Summary/Steps-to-Reproduce/Impact structure
(one report per finding, separated by ---). Routed through aiChat.
- scan-detail.js: new "Report selected (AI)" toolbar button reusing the existing
finding checkboxes; collects checked rows, POSTs them, and shows the generated
report in a copyable modal (Copy / Close / Esc).
Programs cache hardening:
- programsCacheEnabled() gates the DB-backed cache on DB_HOST. Without a DB the
handler now skips cache + background refresh entirely and just does a live
fetch, preventing a DB-less deployment from looping expensive upstream rebuilds
that can never be persisted.
CI fix:
- zerodays.go: use net.JoinHostPort instead of fmt.Sprintf("%s:%d", ...) for the
MongoDB dial address. Fixes `CGO_ENABLED=1 go vet ./...` failing with
"address format %s:%d does not work with IPv6".
CI replicated locally: go vet, go build, go test all pass (CGO_ENABLED=1).
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes the failing CI pipeline, fixes an AI-provider gap introduced when OpenCode became the default, and adds a multi-finding AI report feature.
What changed
CI fix (the failing pipeline)
CGO_ENABLED=1 go vet ./...was failing with:The MongoDB dial address now uses
net.JoinHostPort(host, strconv.Itoa(port))instead offmt.Sprintf("%s:%d", ...), which is IPv6-safe. Replicated the full CI sequence locally —go vet,go build,go test ./...(allCGO_ENABLED=1) — all pass.AI provider fallback
The dashboard "validate finding" and "report" helpers required OpenRouter specifically (
openRouterChat, hardcodedopenai/gpt-4o-mini). After OpenCode became the default free provider, a user who set onlyOPENCODE_API_KEYgot "No OpenRouter API key configured."New
aiChat()helper tries OpenRouter first (UIX-OpenRouter-Keyheader orOPENROUTER_API_KEY), then falls back to the sharedbrain.ChatWithAIchain (OpenCode → Z.ai → Gemini).apiValidateFindingandapiReportFindingnow use it.Multi-finding AI report (new feature)
POST /api/findings/report-batch(apiReportFindingsBatch) accepts 1..N selected findings (capped at 25), builds a prompt from each finding's target/type/severity/module/evidence, and uses an attacker-mindset system prompt that enforces the exact## Title / ## Summary / ## Steps to Reproduce / ## Impactstructure (one report per finding, separated by---; merges same-class findings). Routed throughaiChat, so it works on any configured provider.scan-detail.js): new "Report selected (AI)" toolbar button that reuses the existing finding checkboxes + select-all, collects the checked rows (with file/line/url/match evidence fromraw), POSTs them, and shows the generated report in a copyable modal (Copy / Close / Esc).Programs cache hardening
programsCacheEnabled()gates the DB-backed programs cache onDB_HOST. Without a DB, the handler skips the cache + background refresh and just does a live fetch — preventing a DB-less deployment from looping expensive ~1000-call upstream rebuilds that can never be persisted.Reviewer notes
testingwas already merged tomasterearlier, so this PR is just the one new commit on top.CGO_ENABLED=1 go vet ./...,go build,go test ./...all green;node --checkon the modified JS passes.🤖 Generated with Claude Code