security: apply sanitize_for_prompt before LLM submission in all three code-reading agents

app/agents/bug_detection_agent.py

@@ -5,6 +5,8 @@ from app.tools.file_scanner import get_python_files
 from app.core.llm import call_llm_for_json
 from app.core.prompts import BUG_DETECTION_PROMPT
 from app.models.issue import IssueReport, Bug, Warning, Suggestion
+from app.tools.file_scanner import scan_repository, get_python_files, sanitize_for_prompt
+
 
 logger = get_logger(__name__)
 
@@ -27,6 +29,7 @@ async def run(local_path: str) -> IssueReport:
         try:
             with open(file_path, "r", encoding="utf-8", errors="ignore") as f:
                 content = f.read()[:2000]  # Limit to 2000 chars per file
+                content = sanitize_for_prompt(content) 
                 code_samples.append(f"### {file_path}\n{content}")
         except Exception as e:   # nosec B110
             logger.warning("Failed to read file", extra={"file": file_path, "error": str(e)})

app/agents/code_review_agent.py

@@ -1,5 +1,5 @@
 from app.core.logger import get_logger
-
+from app.tools.file_scanner import scan_repository, get_python_files, sanitize_for_prompt
 import os
 from app.tools.file_scanner import get_python_files
 from app.core.llm import call_llm_for_json
@@ -25,6 +25,7 @@ async def run(local_path: str, metadata: RepositoryMetadata) -> ReviewSuggestion
         try:
             with open(file_path, "r", encoding="utf-8", errors="ignore") as f:
                 content = f.read()[:2500]
+                content = sanitize_for_prompt(content)  
                 source_samples.append(f"### {file_path}\n{content}")
         except Exception as e:   # nosec B110
             logger.warning("Failed to read file", extra={"file": file_path, "error": str(e)})

app/agents/test_generation_agent.py

@@ -7,6 +7,8 @@ from app.core.prompts import TEST_GENERATION_PROMPT
 from app.models.review import GeneratedTests
 import subprocess # nosec B404
 import sys
+from app.tools.file_scanner import scan_repository, get_python_files, sanitize_for_prompt
+
 
 logger = get_logger(__name__)
 
@@ -52,6 +54,7 @@ async def run(local_path: str) -> GeneratedTests:
             try:
                 with open(file_path, "r", encoding="utf-8", errors="ignore") as f:
                     content = f.read()[:3000]
+                    content = sanitize_for_prompt(content)  
                     source_code_samples.append(f"### {file_path}\n{content}")
             except Exception:   # nosec B110
                 pass
@@ -77,7 +80,7 @@ async def run(local_path: str) -> GeneratedTests:
             line for i, line in enumerate(lines)
             if not (i == 0 and line.startswith("```")) and line != "```"
         )
-        
+
     # Step 4 - Count generated tests
     test_count = llm_response.count("def test_")
     coverage_before = _measure_coverage(local_path)