Spaces:

TALP-Project
/

multi-agent-smart-contracts

Runtime error

App Files Files Community

Uanderson Silva commited on May 25

Commit

32a4f79

1 Parent(s): 098ab50

integrate with coder agent

Browse files

Files changed (9) hide show

README_GH.md +2 -0
frontend/src/App.tsx +107 -15
package-lock.json +169 -169
src/agents/auditor/agent.ts +6 -4
src/agents/auditor/model.ts +0 -13
src/agents/auditor/prompts.ts +32 -33
src/config/llm.ts +7 -1
src/index.ts +7 -4
src/server.ts +35 -14

README_GH.md CHANGED Viewed

@@ -19,6 +19,8 @@ O sistema é implementado em **TypeScript** e **Node.js**, utilizando a bibliote
 O sistema é composto por agentes especializados que colaboram entre si em diferentes etapas do processo:
 1. **Exploração e análise dos requisitos**
    * Processamento e compreensão dos documentos fornecidos;

 O sistema é composto por agentes especializados que colaboram entre si em diferentes etapas do processo:
+![Arquitetura Geral](./assets/architecture.png)
 1. **Exploração e análise dos requisitos**
    * Processamento e compreensão dos documentos fornecidos;

frontend/src/App.tsx CHANGED Viewed

@@ -1,10 +1,25 @@
 import { useState, useRef, useCallback } from "react";
 interface AgentResult {
   contract?: string;
   compilationErrors?: string[];
   reviewSummary?: string;
-  vulnerabilities?: Array<{ type: string; severity: string; description: string }>;
   results?: unknown[];
 }
@@ -58,8 +73,10 @@ export function App() {
         for (const line of lines) {
           if (line.startsWith("event:")) {
             currentEvent = line.slice(6).trim();
           } else if (line.startsWith("data:")) {
             const data = line.slice(5).trim();
             switch (currentEvent) {
               case "log":
                 appendLog(data);
@@ -90,12 +107,10 @@ export function App() {
   return (
     <div style={styles.container}>
       <header style={styles.header}>
-        <h1 style={styles.title}>
-          Multi-Agent: Geração, Auditoria e Teste de Smart Contracts
-        </h1>
         <p style={styles.subtitle}>
-          Descreva um cenário ou requisito cuja solução seja um smart contract em Solidity.
-          O sistema irá gerar, compilar, auditar e testar o contrato automaticamente.
         </p>
       </header>
@@ -103,15 +118,21 @@ export function App() {
         <textarea
           value={requirements}
           onChange={(e) => setRequirements(e.target.value)}
-          placeholder={"Ex: Crie um token ERC20 com as seguintes características:\n- Nome: MeuToken, Símbolo: MTK\n- Supply inicial de 1.000.000 tokens\n- Funções de mint (apenas owner) e burn\n- Pausável pelo owner"}
           style={styles.textarea}
           rows={6}
           disabled={running}
         />
-        <button type="submit" disabled={running || !requirements.trim()} style={{
-          ...styles.button,
-          opacity: running || !requirements.trim() ? 0.5 : 1,
-        }}>
           {running ? "Executando pipeline..." : "Executar Pipeline"}
         </button>
       </form>
@@ -122,7 +143,9 @@ export function App() {
           <h2 style={styles.sectionTitle}>📋 Log de Execução</h2>
           <div style={styles.logBox}>
             {logs.map((log, i) => (
-              <div key={i} style={styles.logLine}>{log}</div>
             ))}
             <div ref={logsEndRef} />
           </div>
@@ -163,9 +186,33 @@ export function App() {
       {auditorResult && (
         <section style={styles.section}>
           <h2 style={styles.sectionTitle}>🔍 Agente Auditor</h2>
-          <div style={styles.codeBox}>
-            <pre style={styles.code}>{JSON.stringify(auditorResult.vulnerabilities, null, 2)}</pre>
-          </div>
         </section>
       )}
@@ -186,6 +233,19 @@ export function App() {
   );
 }
 const styles: Record<string, React.CSSProperties> = {
   container: {
     maxWidth: 900,
@@ -305,4 +365,36 @@ const styles: Record<string, React.CSSProperties> = {
     color: "#cbd5e1",
     whiteSpace: "pre-wrap",
   },
 };

 import { useState, useRef, useCallback } from "react";
+interface Finding {
+  title: string;
+  description: string;
+  recommendation: string;
+  severity: "high" | "medium" | "low";
+  codeSnippet: string;
+  location: string;
+  path: string;
+  judgeReview: {
+    review: string;
+    confidence: number;
+    exploitablePaths: string[];
+  };
+}
 interface AgentResult {
   contract?: string;
   compilationErrors?: string[];
   reviewSummary?: string;
+  findings?: Finding[];
   results?: unknown[];
 }
         for (const line of lines) {
           if (line.startsWith("event:")) {
             currentEvent = line.slice(6).trim();
+            console.log("event", currentEvent);
           } else if (line.startsWith("data:")) {
             const data = line.slice(5).trim();
+            console.log("data", data);
             switch (currentEvent) {
               case "log":
                 appendLog(data);
   return (
     <div style={styles.container}>
       <header style={styles.header}>
+        <h1 style={styles.title}>Multi-Agent: Geração, Auditoria e Teste de Smart Contracts</h1>
         <p style={styles.subtitle}>
+          Descreva um cenário ou requisito cuja solução seja um smart contract em Solidity. O sistema irá gerar,
+          compilar, auditar e testar o contrato automaticamente.
         </p>
       </header>
         <textarea
           value={requirements}
           onChange={(e) => setRequirements(e.target.value)}
+          placeholder={
+            "Ex: Crie um token ERC20 com as seguintes características:\n- Nome: MeuToken, Símbolo: MTK\n- Supply inicial de 1.000.000 tokens\n- Funções de mint (apenas owner) e burn\n- Pausável pelo owner"
+          }
           style={styles.textarea}
           rows={6}
           disabled={running}
         />
+        <button
+          type="submit"
+          disabled={running || !requirements.trim()}
+          style={{
+            ...styles.button,
+            opacity: running || !requirements.trim() ? 0.5 : 1,
+          }}
+        >
           {running ? "Executando pipeline..." : "Executar Pipeline"}
         </button>
       </form>
           <h2 style={styles.sectionTitle}>📋 Log de Execução</h2>
           <div style={styles.logBox}>
             {logs.map((log, i) => (
+              <div key={i} style={styles.logLine}>
+                {log}
+              </div>
             ))}
             <div ref={logsEndRef} />
           </div>
       {auditorResult && (
         <section style={styles.section}>
           <h2 style={styles.sectionTitle}>🔍 Agente Auditor</h2>
+          {auditorResult.findings && auditorResult.findings.length > 0 ? (
+            auditorResult.findings.map((f, i) => (
+              <div key={i} style={{ ...styles.findingCard, borderColor: severityColor(f.severity) }}>
+                <div style={styles.findingHeader}>
+                  <span style={{ ...styles.severityBadge, background: severityColor(f.severity) }}>
+                    {f.severity.toUpperCase()}
+                  </span>
+                  <span style={styles.findingTitle}>{f.title}</span>
+                </div>
+                <p style={styles.findingText}>{f.description}</p>
+                <p style={{ ...styles.findingText, color: "#94a3b8" }}>
+                  <strong>Localização:</strong> {f.location ?? "-"}
+                </p>
+                {f.codeSnippet && <pre style={styles.code}>{f.codeSnippet}</pre>}
+                <p style={{ ...styles.findingText, color: "#94a3b8" }}>
+                  <strong>Recomendação:</strong> {f.recommendation}
+                </p>
+                <p style={{ ...styles.findingText, color: "#64748b", fontSize: 12 }}>
+                  Confiança: {Math.round(f.judgeReview.confidence)}% — {f.judgeReview.review}
+                </p>
+              </div>
+            ))
+          ) : (
+            <div style={styles.resultBox}>
+              <p style={styles.resultText}>Nenhuma vulnerabilidade encontrada.</p>
+            </div>
+          )}
         </section>
       )}
   );
 }
+const severityColor = (severity: string) => {
+  switch (severity) {
+    case "high":
+      return "#ef4444";
+    case "medium":
+      return "#f97316";
+    case "low":
+      return "#eab308";
+    default:
+      return "#64748b";
+  }
+};
 const styles: Record<string, React.CSSProperties> = {
   container: {
     maxWidth: 900,
     color: "#cbd5e1",
     whiteSpace: "pre-wrap",
   },
+  findingCard: {
+    background: "#1e293b",
+    border: "1px solid",
+    borderRadius: 8,
+    padding: 16,
+    marginBottom: 12,
+  },
+  findingHeader: {
+    display: "flex",
+    alignItems: "center",
+    gap: 10,
+    marginBottom: 8,
+  },
+  severityBadge: {
+    fontSize: 11,
+    fontWeight: 700,
+    color: "#fff",
+    padding: "2px 8px",
+    borderRadius: 4,
+    letterSpacing: "0.05em",
+  },
+  findingTitle: {
+    fontSize: 15,
+    fontWeight: 600,
+    color: "#f8fafc",
+  },
+  findingText: {
+    margin: "4px 0",
+    fontSize: 13,
+    lineHeight: 1.6,
+    color: "#cbd5e1",
+  },
 };

package-lock.json CHANGED Viewed

@@ -330,9 +330,9 @@
       }
     },
     "node_modules/@langchain/core": {
-      "version": "1.1.47",
-      "resolved": "https://registry.npmjs.org/@langchain/core/-/core-1.1.47.tgz",
-      "integrity": "sha512-+fiPu6ZFnJMrZyKeM77OIVPoMPAY6OKWacnPlojHtXTbMMzb2cEOKAJV0U07cDl86NHSCIYYa0i4CyKZzXbHQQ==",
       "license": "MIT",
       "dependencies": {
         "@cfworker/json-schema": "^4.0.2",
@@ -363,13 +363,13 @@
       }
     },
     "node_modules/@langchain/langgraph": {
-      "version": "1.3.0",
-      "resolved": "https://registry.npmjs.org/@langchain/langgraph/-/langgraph-1.3.0.tgz",
-      "integrity": "sha512-QvhTjiyqFPz81A+y6LHs223w6DTjv5+882DT4mup72bd72rRhNjTYo5fhes5um0swnKArvY/arc7KeFInfHHWw==",
       "license": "MIT",
       "dependencies": {
         "@langchain/langgraph-checkpoint": "^1.0.2",
-        "@langchain/langgraph-sdk": "~1.9.0",
         "@langchain/protocol": "^0.0.15",
         "@standard-schema/spec": "1.1.0",
         "uuid": "^10.0.0"
@@ -418,12 +418,11 @@
       }
     },
     "node_modules/@langchain/langgraph-sdk": {
-      "version": "1.9.1",
-      "resolved": "https://registry.npmjs.org/@langchain/langgraph-sdk/-/langgraph-sdk-1.9.1.tgz",
-      "integrity": "sha512-pHojybde9HoMz7ZDtyW3pgDdomAN4C0pbdgXASjccFS+S2Cqx75iZBtBUUg1A/CSer5xh9GakdIqyihxZOf7VA==",
       "license": "MIT",
       "dependencies": {
-        "@langchain/core": "^1.1.44",
         "@langchain/protocol": "^0.0.15",
         "@types/json-schema": "^7.0.15",
         "p-queue": "^9.0.1",
@@ -431,6 +430,7 @@
         "uuid": "^13.0.0"
       },
       "peerDependencies": {
         "react": "^18 || ^19",
         "react-dom": "^18 || ^19",
         "svelte": "^4.0.0 || ^5.0.0",
@@ -458,9 +458,9 @@
       "license": "MIT"
     },
     "node_modules/@langchain/langgraph-sdk/node_modules/p-queue": {
-      "version": "9.2.0",
-      "resolved": "https://registry.npmjs.org/p-queue/-/p-queue-9.2.0.tgz",
-      "integrity": "sha512-dWgLE8AH0HjQ9fe74pUkKkvzzYT18Inp4zra3lKHnnwqGvcfcUBrvF2EAVX+envufDNBOzpPq/IBUONDbI7+3g==",
       "license": "MIT",
       "dependencies": {
         "eventemitter3": "^5.0.4",
@@ -1061,6 +1061,26 @@
         "url": "https://github.com/chalk/ansi-styles?sponsor=1"
       }
     },
     "node_modules/assertion-error": {
       "version": "2.0.1",
       "resolved": "https://registry.npmjs.org/assertion-error/-/assertion-error-2.0.1.tgz",
@@ -1203,41 +1223,6 @@
         "node": ">=8"
       }
     },
-    "node_modules/color-convert": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
-      "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "color-name": "~1.1.4"
-      },
-      "engines": {
-        "node": ">=7.0.0"
-      }
-    },
-    "node_modules/color-name": {
-      "version": "1.1.4",
-      "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
-      "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
-      "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/command-exists": {
-      "version": "1.2.9",
-      "resolved": "https://registry.npmjs.org/command-exists/-/command-exists-1.2.9.tgz",
-      "integrity": "sha512-LTQ/SGc+s0Xc0Fu5WaKnR0YiygZkm9eKFvyS+fRsU7/ZWFF8ykFM6Pc9aCVf1+xasOOZpO3BAVgVrKvsqKHV7w==",
-      "license": "MIT"
-    },
-    "node_modules/commander": {
-      "version": "8.3.0",
-      "resolved": "https://registry.npmjs.org/commander/-/commander-8.3.0.tgz",
-      "integrity": "sha512-OkTL9umf+He2DZkUq8f8J9of7yL6RJKI24dVITBmNfZBmri9zYZQrKkuXiKhyfPSu8tUhnVBB1iKXevvnlR4Ww==",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 12"
-      }
-    },
     "node_modules/color": {
       "version": "5.0.3",
       "resolved": "https://registry.npmjs.org/color/-/color-5.0.3.tgz",
@@ -1284,6 +1269,21 @@
         "node": ">=18"
       }
     },
     "node_modules/convert-source-map": {
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/convert-source-map/-/convert-source-map-2.0.0.tgz",
@@ -1361,6 +1361,12 @@
         "node": ">= 0.4"
       }
     },
     "node_modules/es-define-property": {
       "version": "1.0.1",
       "resolved": "https://registry.npmjs.org/es-define-property/-/es-define-property-1.0.1.tgz",
@@ -1381,12 +1387,6 @@
         "node": ">= 0.4"
       }
     },
-    "node_modules/enabled": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/enabled/-/enabled-2.0.0.tgz",
-      "integrity": "sha512-AKrN98kuwOzMIdAizXGI86UFBoo26CL21UM763y1h/GMSJ4/OHU9k2YlsmBpyScFo/wbLzWQJBMCW4+IO3/+OQ==",
-      "license": "MIT"
-    },
     "node_modules/es-module-lexer": {
       "version": "2.1.0",
       "resolved": "https://registry.npmjs.org/es-module-lexer/-/es-module-lexer-2.1.0.tgz",
@@ -1460,6 +1460,12 @@
         }
       }
     },
     "node_modules/fill-range": {
       "version": "7.1.1",
       "resolved": "https://registry.npmjs.org/fill-range/-/fill-range-7.1.1.tgz",
@@ -1483,6 +1489,12 @@
         "micromatch": "^4.0.2"
       }
     },
     "node_modules/follow-redirects": {
       "version": "1.16.0",
       "resolved": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.16.0.tgz",
@@ -1518,18 +1530,6 @@
         "node": ">=12"
       }
     },
-    "node_modules/fecha": {
-      "version": "4.2.3",
-      "resolved": "https://registry.npmjs.org/fecha/-/fecha-4.2.3.tgz",
-      "integrity": "sha512-OP2IUU6HeYKJi3i0z4A19kHMQoLVs4Hc+DPqqxI2h/DPZHTm/vjsfC6P0b4jCMy14XizLBqvndQ+UilD7707Jw==",
-      "license": "MIT"
-    },
-    "node_modules/fn.name": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/fn.name/-/fn.name-1.1.0.tgz",
-      "integrity": "sha512-GRnmB5gPyJpAhTQdSZTSp9uaPSvl09KoYcMQtsB9rQoOmzs9dH6ffeccH+Z+cv6P68Hu5bC6JjRh4Ah/mHSNRw==",
-      "license": "MIT"
-    },
     "node_modules/fsevents": {
       "version": "2.3.3",
       "resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.3.3.tgz",
@@ -1672,6 +1672,12 @@
         "node": ">=16.9.0"
       }
     },
     "node_modules/is-docker": {
       "version": "2.2.1",
       "resolved": "https://registry.npmjs.org/is-docker/-/is-docker-2.2.1.tgz",
@@ -1688,16 +1694,10 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
-    "node_modules/inherits": {
-      "version": "2.0.4",
-      "resolved": "https://registry.npmjs.org/inherits/-/inherits-2.0.4.tgz",
-      "integrity": "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==",
-      "license": "ISC"
-    },
     "node_modules/is-network-error": {
-      "version": "1.3.1",
-      "resolved": "https://registry.npmjs.org/is-network-error/-/is-network-error-1.3.1.tgz",
-      "integrity": "sha512-6QCxa49rQbmUWLfk0nuGqzql9U8uaV2H6279bRErPBHe/109hCzsLUBUHfbEtvLIHBd6hyXbgedBSHevm43Edw==",
       "license": "MIT",
       "engines": {
         "node": ">=16"
@@ -1716,6 +1716,18 @@
         "node": ">=0.12.0"
       }
     },
     "node_modules/is-wsl": {
       "version": "2.2.0",
       "resolved": "https://registry.npmjs.org/is-wsl/-/is-wsl-2.2.0.tgz",
@@ -1749,18 +1761,6 @@
       "integrity": "sha512-gF1cRrHhIzNfToc802P800N8PpXS+evLLXfsVpowqmAFR9uwbi89WvXg2QspOmXL8QL86J4T1EpFu+yUkwJY3Q==",
       "license": "MIT"
     },
-    "node_modules/is-stream": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/is-stream/-/is-stream-2.0.1.tgz",
-      "integrity": "sha512-hFoiJiTl63nn+kstHGBtewWSKnQLpyb155KHheA1l39uvtO9nWIop1p3udqPcUd/xbF1VLMO4n7OI6p7RbngDg==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=8"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
     "node_modules/js-tiktoken": {
       "version": "1.0.21",
       "resolved": "https://registry.npmjs.org/js-tiktoken/-/js-tiktoken-1.0.21.tgz",
@@ -1770,6 +1770,19 @@
         "base64-js": "^1.5.1"
       }
     },
     "node_modules/json-stable-stringify": {
       "version": "1.3.0",
       "resolved": "https://registry.npmjs.org/json-stable-stringify/-/json-stable-stringify-1.3.0.tgz",
@@ -1823,19 +1836,6 @@
         "graceful-fs": "^4.1.11"
       }
     },
-    "node_modules/json-schema-to-ts": {
-      "version": "3.1.1",
-      "resolved": "https://registry.npmjs.org/json-schema-to-ts/-/json-schema-to-ts-3.1.1.tgz",
-      "integrity": "sha512-+DWg8jCJG2TEnpy7kOm/7/AxaYoaRbjVB4LFZLySZlWn8exGs3A4OLJR966cVvU26N7X9TWxl+Jsw7dzAqKT6g==",
-      "license": "MIT",
-      "dependencies": {
-        "@babel/runtime": "^7.18.3",
-        "ts-algebra": "^2.0.0"
-      },
-      "engines": {
-        "node": ">=16"
-      }
-    },
     "node_modules/kuler": {
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/kuler/-/kuler-2.0.0.tgz",
@@ -1843,12 +1843,12 @@
       "license": "MIT"
     },
     "node_modules/langchain": {
-      "version": "1.4.0",
-      "resolved": "https://registry.npmjs.org/langchain/-/langchain-1.4.0.tgz",
-      "integrity": "sha512-p3H5U1vfO0T4ri/xxqI6jccRP3LYmOW6KGxaJcwI5mIGVR/G6eNhZyjSZB9d7me6J7an4Pc6zA8tH8Qa6/7xwA==",
       "license": "MIT",
       "dependencies": {
-        "@langchain/langgraph": "^1.3.0",
         "@langchain/langgraph-checkpoint": "^1.0.1",
         "langsmith": ">=0.5.0 <1.0.0",
         "zod": "^3.25.76 || ^4"
@@ -1857,7 +1857,7 @@
         "node": ">=20"
       },
       "peerDependencies": {
-        "@langchain/core": "^1.1.44"
       }
     },
     "node_modules/langsmith": {
@@ -2291,6 +2291,15 @@
       ],
       "license": "MIT"
     },
     "node_modules/open": {
       "version": "7.4.2",
       "resolved": "https://registry.npmjs.org/open/-/open-7.4.2.tgz",
@@ -2308,15 +2317,6 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
-    "node_modules/one-time": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/one-time/-/one-time-1.0.0.tgz",
-      "integrity": "sha512-5DXOiRKwuSEcQ/l0kGCF6Q3jcADFv5tSmRaJck/OqkVFcOzutB134KRSfF0xDrL39MNnqxbHBbUUcjZIhTgb2g==",
-      "license": "MIT",
-      "dependencies": {
-        "fn.name": "1.x.x"
-      }
-    },
     "node_modules/openai": {
       "version": "6.36.0",
       "resolved": "https://registry.npmjs.org/openai/-/openai-6.36.0.tgz",
@@ -2566,6 +2566,35 @@
         "@rolldown/binding-win32-x64-msvc": "1.0.0-rc.18"
       }
     },
     "node_modules/semver": {
       "version": "5.7.2",
       "resolved": "https://registry.npmjs.org/semver/-/semver-5.7.2.tgz",
@@ -2616,35 +2645,6 @@
         "node": ">=8"
       }
     },
-    "node_modules/safe-buffer": {
-      "version": "5.2.1",
-      "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.2.1.tgz",
-      "integrity": "sha512-rp3So07KcdmmKbGvgaNxQSJr7bGVSVk5S9Eq1F+ppbRo70+YeaDxkw5Dd8NPN+GD6bjnYm2VuPuCXmpuYvmCXQ==",
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/feross"
-        },
-        {
-          "type": "patreon",
-          "url": "https://www.patreon.com/feross"
-        },
-        {
-          "type": "consulting",
-          "url": "https://feross.org/support"
-        }
-      ],
-      "license": "MIT"
-    },
-    "node_modules/safe-stable-stringify": {
-      "version": "2.5.0",
-      "resolved": "https://registry.npmjs.org/safe-stable-stringify/-/safe-stable-stringify-2.5.0.tgz",
-      "integrity": "sha512-b3rppTKm9T+PsVCBEOUR46GWI7fdOs00VKZ1+9c1EWDaDMvjQc6tUwuFyIprgGgTcWoVHSKrU8H31ZHA2e0RHA==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=10"
-      }
-    },
     "node_modules/siginfo": {
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/siginfo/-/siginfo-2.0.0.tgz",
@@ -2716,6 +2716,15 @@
       "dev": true,
       "license": "MIT"
     },
     "node_modules/supports-color": {
       "version": "7.2.0",
       "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
@@ -2729,15 +2738,6 @@
         "node": ">=8"
       }
     },
-    "node_modules/string_decoder": {
-      "version": "1.3.0",
-      "resolved": "https://registry.npmjs.org/string_decoder/-/string_decoder-1.3.0.tgz",
-      "integrity": "sha512-hkRX8U1WjJFd8LsDJ2yQ/wWWxaopEsABU1XfkM8A+j0+85JAGppt16cr1Whg6KIbb4okU6Mql6BOj+uup/wKeA==",
-      "license": "MIT",
-      "dependencies": {
-        "safe-buffer": "~5.2.0"
-      }
-    },
     "node_modules/text-hex": {
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/text-hex/-/text-hex-1.0.0.tgz",
@@ -3087,22 +3087,6 @@
         "node": ">=8"
       }
     },
-    "node_modules/yaml": {
-      "version": "2.9.0",
-      "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.9.0.tgz",
-      "integrity": "sha512-2AvhNX3mb8zd6Zy7INTtSpl1F15HW6Wnqj0srWlkKLcpYl/gMIMJiyuGq2KeI2YFxUPjdlB+3Lc10seMLtL4cA==",
-      "dev": true,
-      "license": "ISC",
-      "bin": {
-        "yaml": "bin.mjs"
-      },
-      "engines": {
-        "node": ">= 14.6"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/eemeli"
-      }
-    },
     "node_modules/winston": {
       "version": "3.19.0",
       "resolved": "https://registry.npmjs.org/winston/-/winston-3.19.0.tgz",
@@ -3139,6 +3123,22 @@
         "node": ">= 12.0.0"
       }
     },
     "node_modules/zod": {
       "version": "4.4.3",
       "resolved": "https://registry.npmjs.org/zod/-/zod-4.4.3.tgz",

       }
     },
     "node_modules/@langchain/core": {
+      "version": "1.1.48",
+      "resolved": "https://registry.npmjs.org/@langchain/core/-/core-1.1.48.tgz",
+      "integrity": "sha512-fQU6Guyb1pwc2fEplmA8FPbKfOMAofjnyJzExevro0FxEiuGHE18Ov/ZHmT9trWCDTZRI9eW1VIc6aChxV8pAQ==",
       "license": "MIT",
       "dependencies": {
         "@cfworker/json-schema": "^4.0.2",
       }
     },
     "node_modules/@langchain/langgraph": {
+      "version": "1.3.2",
+      "resolved": "https://registry.npmjs.org/@langchain/langgraph/-/langgraph-1.3.2.tgz",
+      "integrity": "sha512-SL7Ktsr681R7da+1b2MVOWEbaCoFJOXEJPTGOjg4JIG4C7quWbTYC8DzxhcCxte6D/8cGp0rYDBnbKLXEpNqlA==",
       "license": "MIT",
       "dependencies": {
         "@langchain/langgraph-checkpoint": "^1.0.2",
+        "@langchain/langgraph-sdk": "~1.9.4",
         "@langchain/protocol": "^0.0.15",
         "@standard-schema/spec": "1.1.0",
         "uuid": "^10.0.0"
       }
     },
     "node_modules/@langchain/langgraph-sdk": {
+      "version": "1.9.6",
+      "resolved": "https://registry.npmjs.org/@langchain/langgraph-sdk/-/langgraph-sdk-1.9.6.tgz",
+      "integrity": "sha512-cem5LckknNULd8o4WiOpf+rv+Qxvfpf5MzXiCQb9JnEfJdCRrWsl0/qBeZRpAXMf/1Va3uDMZouTmw9odmI0Hw==",
       "license": "MIT",
       "dependencies": {
         "@langchain/protocol": "^0.0.15",
         "@types/json-schema": "^7.0.15",
         "p-queue": "^9.0.1",
         "uuid": "^13.0.0"
       },
       "peerDependencies": {
+        "@langchain/core": "^1.1.44",
         "react": "^18 || ^19",
         "react-dom": "^18 || ^19",
         "svelte": "^4.0.0 || ^5.0.0",
       "license": "MIT"
     },
     "node_modules/@langchain/langgraph-sdk/node_modules/p-queue": {
+      "version": "9.3.0",
+      "resolved": "https://registry.npmjs.org/p-queue/-/p-queue-9.3.0.tgz",
+      "integrity": "sha512-7NED7xhQ74Ngp4JP/2e0VZHp7vSWfJfqeiR92jPgxsz6m0Se4P03YoTKa9dDXyZ3r6P616gUXttrB6nnHYKang==",
       "license": "MIT",
       "dependencies": {
         "eventemitter3": "^5.0.4",
         "url": "https://github.com/chalk/ansi-styles?sponsor=1"
       }
     },
+    "node_modules/ansi-styles/node_modules/color-convert": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
+      "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "color-name": "~1.1.4"
+      },
+      "engines": {
+        "node": ">=7.0.0"
+      }
+    },
+    "node_modules/ansi-styles/node_modules/color-name": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
+      "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/assertion-error": {
       "version": "2.0.1",
       "resolved": "https://registry.npmjs.org/assertion-error/-/assertion-error-2.0.1.tgz",
         "node": ">=8"
       }
     },
     "node_modules/color": {
       "version": "5.0.3",
       "resolved": "https://registry.npmjs.org/color/-/color-5.0.3.tgz",
         "node": ">=18"
       }
     },
+    "node_modules/command-exists": {
+      "version": "1.2.9",
+      "resolved": "https://registry.npmjs.org/command-exists/-/command-exists-1.2.9.tgz",
+      "integrity": "sha512-LTQ/SGc+s0Xc0Fu5WaKnR0YiygZkm9eKFvyS+fRsU7/ZWFF8ykFM6Pc9aCVf1+xasOOZpO3BAVgVrKvsqKHV7w==",
+      "license": "MIT"
+    },
+    "node_modules/commander": {
+      "version": "8.3.0",
+      "resolved": "https://registry.npmjs.org/commander/-/commander-8.3.0.tgz",
+      "integrity": "sha512-OkTL9umf+He2DZkUq8f8J9of7yL6RJKI24dVITBmNfZBmri9zYZQrKkuXiKhyfPSu8tUhnVBB1iKXevvnlR4Ww==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 12"
+      }
+    },
     "node_modules/convert-source-map": {
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/convert-source-map/-/convert-source-map-2.0.0.tgz",
         "node": ">= 0.4"
       }
     },
+    "node_modules/enabled": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/enabled/-/enabled-2.0.0.tgz",
+      "integrity": "sha512-AKrN98kuwOzMIdAizXGI86UFBoo26CL21UM763y1h/GMSJ4/OHU9k2YlsmBpyScFo/wbLzWQJBMCW4+IO3/+OQ==",
+      "license": "MIT"
+    },
     "node_modules/es-define-property": {
       "version": "1.0.1",
       "resolved": "https://registry.npmjs.org/es-define-property/-/es-define-property-1.0.1.tgz",
         "node": ">= 0.4"
       }
     },
     "node_modules/es-module-lexer": {
       "version": "2.1.0",
       "resolved": "https://registry.npmjs.org/es-module-lexer/-/es-module-lexer-2.1.0.tgz",
         }
       }
     },
+    "node_modules/fecha": {
+      "version": "4.2.3",
+      "resolved": "https://registry.npmjs.org/fecha/-/fecha-4.2.3.tgz",
+      "integrity": "sha512-OP2IUU6HeYKJi3i0z4A19kHMQoLVs4Hc+DPqqxI2h/DPZHTm/vjsfC6P0b4jCMy14XizLBqvndQ+UilD7707Jw==",
+      "license": "MIT"
+    },
     "node_modules/fill-range": {
       "version": "7.1.1",
       "resolved": "https://registry.npmjs.org/fill-range/-/fill-range-7.1.1.tgz",
         "micromatch": "^4.0.2"
       }
     },
+    "node_modules/fn.name": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/fn.name/-/fn.name-1.1.0.tgz",
+      "integrity": "sha512-GRnmB5gPyJpAhTQdSZTSp9uaPSvl09KoYcMQtsB9rQoOmzs9dH6ffeccH+Z+cv6P68Hu5bC6JjRh4Ah/mHSNRw==",
+      "license": "MIT"
+    },
     "node_modules/follow-redirects": {
       "version": "1.16.0",
       "resolved": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.16.0.tgz",
         "node": ">=12"
       }
     },
     "node_modules/fsevents": {
       "version": "2.3.3",
       "resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.3.3.tgz",
         "node": ">=16.9.0"
       }
     },
+    "node_modules/inherits": {
+      "version": "2.0.4",
+      "resolved": "https://registry.npmjs.org/inherits/-/inherits-2.0.4.tgz",
+      "integrity": "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==",
+      "license": "ISC"
+    },
     "node_modules/is-docker": {
       "version": "2.2.1",
       "resolved": "https://registry.npmjs.org/is-docker/-/is-docker-2.2.1.tgz",
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
     "node_modules/is-network-error": {
+      "version": "1.3.2",
+      "resolved": "https://registry.npmjs.org/is-network-error/-/is-network-error-1.3.2.tgz",
+      "integrity": "sha512-PhBY86zaxNZUuWP6h13Vu5oFe0XY6/UlKzQnYFELzGVHygP3MxmvTfYSG7GN3aIab/iWudSMgjSnG9Dq+nHrgA==",
       "license": "MIT",
       "engines": {
         "node": ">=16"
         "node": ">=0.12.0"
       }
     },
+    "node_modules/is-stream": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/is-stream/-/is-stream-2.0.1.tgz",
+      "integrity": "sha512-hFoiJiTl63nn+kstHGBtewWSKnQLpyb155KHheA1l39uvtO9nWIop1p3udqPcUd/xbF1VLMO4n7OI6p7RbngDg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
     "node_modules/is-wsl": {
       "version": "2.2.0",
       "resolved": "https://registry.npmjs.org/is-wsl/-/is-wsl-2.2.0.tgz",
       "integrity": "sha512-gF1cRrHhIzNfToc802P800N8PpXS+evLLXfsVpowqmAFR9uwbi89WvXg2QspOmXL8QL86J4T1EpFu+yUkwJY3Q==",
       "license": "MIT"
     },
     "node_modules/js-tiktoken": {
       "version": "1.0.21",
       "resolved": "https://registry.npmjs.org/js-tiktoken/-/js-tiktoken-1.0.21.tgz",
         "base64-js": "^1.5.1"
       }
     },
+    "node_modules/json-schema-to-ts": {
+      "version": "3.1.1",
+      "resolved": "https://registry.npmjs.org/json-schema-to-ts/-/json-schema-to-ts-3.1.1.tgz",
+      "integrity": "sha512-+DWg8jCJG2TEnpy7kOm/7/AxaYoaRbjVB4LFZLySZlWn8exGs3A4OLJR966cVvU26N7X9TWxl+Jsw7dzAqKT6g==",
+      "license": "MIT",
+      "dependencies": {
+        "@babel/runtime": "^7.18.3",
+        "ts-algebra": "^2.0.0"
+      },
+      "engines": {
+        "node": ">=16"
+      }
+    },
     "node_modules/json-stable-stringify": {
       "version": "1.3.0",
       "resolved": "https://registry.npmjs.org/json-stable-stringify/-/json-stable-stringify-1.3.0.tgz",
         "graceful-fs": "^4.1.11"
       }
     },
     "node_modules/kuler": {
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/kuler/-/kuler-2.0.0.tgz",
       "license": "MIT"
     },
     "node_modules/langchain": {
+      "version": "1.4.2",
+      "resolved": "https://registry.npmjs.org/langchain/-/langchain-1.4.2.tgz",
+      "integrity": "sha512-SLGipy0r4nqQD0aiUOBYLMeGFfB/QiYnMndfZ8sGN89vXDCIXbYqcE7G/4QDDX3nZsM7/emQpoScmlxEX6sDnQ==",
       "license": "MIT",
       "dependencies": {
+        "@langchain/langgraph": "^1.3.2",
         "@langchain/langgraph-checkpoint": "^1.0.1",
         "langsmith": ">=0.5.0 <1.0.0",
         "zod": "^3.25.76 || ^4"
         "node": ">=20"
       },
       "peerDependencies": {
+        "@langchain/core": "^1.1.48"
       }
     },
     "node_modules/langsmith": {
       ],
       "license": "MIT"
     },
+    "node_modules/one-time": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/one-time/-/one-time-1.0.0.tgz",
+      "integrity": "sha512-5DXOiRKwuSEcQ/l0kGCF6Q3jcADFv5tSmRaJck/OqkVFcOzutB134KRSfF0xDrL39MNnqxbHBbUUcjZIhTgb2g==",
+      "license": "MIT",
+      "dependencies": {
+        "fn.name": "1.x.x"
+      }
+    },
     "node_modules/open": {
       "version": "7.4.2",
       "resolved": "https://registry.npmjs.org/open/-/open-7.4.2.tgz",
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
     "node_modules/openai": {
       "version": "6.36.0",
       "resolved": "https://registry.npmjs.org/openai/-/openai-6.36.0.tgz",
         "@rolldown/binding-win32-x64-msvc": "1.0.0-rc.18"
       }
     },
+    "node_modules/safe-buffer": {
+      "version": "5.2.1",
+      "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.2.1.tgz",
+      "integrity": "sha512-rp3So07KcdmmKbGvgaNxQSJr7bGVSVk5S9Eq1F+ppbRo70+YeaDxkw5Dd8NPN+GD6bjnYm2VuPuCXmpuYvmCXQ==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "license": "MIT"
+    },
+    "node_modules/safe-stable-stringify": {
+      "version": "2.5.0",
+      "resolved": "https://registry.npmjs.org/safe-stable-stringify/-/safe-stable-stringify-2.5.0.tgz",
+      "integrity": "sha512-b3rppTKm9T+PsVCBEOUR46GWI7fdOs00VKZ1+9c1EWDaDMvjQc6tUwuFyIprgGgTcWoVHSKrU8H31ZHA2e0RHA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=10"
+      }
+    },
     "node_modules/semver": {
       "version": "5.7.2",
       "resolved": "https://registry.npmjs.org/semver/-/semver-5.7.2.tgz",
         "node": ">=8"
       }
     },
     "node_modules/siginfo": {
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/siginfo/-/siginfo-2.0.0.tgz",
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/string_decoder": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/string_decoder/-/string_decoder-1.3.0.tgz",
+      "integrity": "sha512-hkRX8U1WjJFd8LsDJ2yQ/wWWxaopEsABU1XfkM8A+j0+85JAGppt16cr1Whg6KIbb4okU6Mql6BOj+uup/wKeA==",
+      "license": "MIT",
+      "dependencies": {
+        "safe-buffer": "~5.2.0"
+      }
+    },
     "node_modules/supports-color": {
       "version": "7.2.0",
       "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
         "node": ">=8"
       }
     },
     "node_modules/text-hex": {
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/text-hex/-/text-hex-1.0.0.tgz",
         "node": ">=8"
       }
     },
     "node_modules/winston": {
       "version": "3.19.0",
       "resolved": "https://registry.npmjs.org/winston/-/winston-3.19.0.tgz",
         "node": ">= 12.0.0"
       }
     },
+    "node_modules/yaml": {
+      "version": "2.9.0",
+      "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.9.0.tgz",
+      "integrity": "sha512-2AvhNX3mb8zd6Zy7INTtSpl1F15HW6Wnqj0srWlkKLcpYl/gMIMJiyuGq2KeI2YFxUPjdlB+3Lc10seMLtL4cA==",
+      "dev": true,
+      "license": "ISC",
+      "bin": {
+        "yaml": "bin.mjs"
+      },
+      "engines": {
+        "node": ">= 14.6"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/eemeli"
+      }
+    },
     "node_modules/zod": {
       "version": "4.4.3",
       "resolved": "https://registry.npmjs.org/zod/-/zod-4.4.3.tgz",

src/agents/auditor/agent.ts CHANGED Viewed

@@ -6,7 +6,7 @@ import { END, type GraphNode, START, StateGraph } from "@langchain/langgraph";
 import { z } from "zod";
 import { logger } from "../../logger.ts";
-import { judgeFindingsModel, findVulnerabilitiesModel, gatherContextModel } from "./model.ts";
 import { JUDGE_FINDINGS_PROMPT, FIND_VULNERABILITIES_PROMPT, GATHER_CONTEXT_PROMPT } from "./prompts.ts";
 import { AuditorState, JudgeReviewSchema, CandidateFindingSchema } from "./state.ts";
 import { analyzeSolidityFile } from "./tools/solidity-analyzer-tool.ts";
@@ -24,6 +24,8 @@ import {
 } from "./config.ts";
 import { matchLines } from "./utils.ts";
 const walkDirectory = (dir: string, depth: number, solFiles: string[], docFiles: string[]) => {
   if (depth > MAX_DEPTH) return;
@@ -119,7 +121,7 @@ const gatherContext: GraphNode<typeof AuditorState> = async (state) => {
     parts.push(`### ${filePath}\n\`\`\`solidity\n${source}\n\`\`\``);
   }
-  const model = gatherContextModel.withStructuredOutput(z.object({ context: z.string() }));
   const result = await model.invoke([new SystemMessage(GATHER_CONTEXT_PROMPT), new HumanMessage(parts.join("\n\n"))]);
   logger.info(`gatherContext: context built (${parts.join("\n\n").length} chars)`);
@@ -129,7 +131,7 @@ const gatherContext: GraphNode<typeof AuditorState> = async (state) => {
 };
 const findVulnerabilities: GraphNode<typeof AuditorState> = async (state) => {
-  const model = findVulnerabilitiesModel.withStructuredOutput(z.object({ findings: z.array(CandidateFindingSchema) }));
   const previousFeedback =
     state.judgeReviews.length > 0
@@ -192,7 +194,7 @@ const judgeFindings: GraphNode<typeof AuditorState> = async (state) => {
     };
   }
-  const model = judgeFindingsModel.withStructuredOutput(JudgeReviewSchema);
   logger.info(`judgeFindings: reviewing ${state.candidateFindings.length} candidate finding(s) in parallel`);

 import { z } from "zod";
 import { logger } from "../../logger.ts";
+import { createLLM } from "../../config/llm.ts";
 import { JUDGE_FINDINGS_PROMPT, FIND_VULNERABILITIES_PROMPT, GATHER_CONTEXT_PROMPT } from "./prompts.ts";
 import { AuditorState, JudgeReviewSchema, CandidateFindingSchema } from "./state.ts";
 import { analyzeSolidityFile } from "./tools/solidity-analyzer-tool.ts";
 } from "./config.ts";
 import { matchLines } from "./utils.ts";
+const llm = createLLM();
 const walkDirectory = (dir: string, depth: number, solFiles: string[], docFiles: string[]) => {
   if (depth > MAX_DEPTH) return;
     parts.push(`### ${filePath}\n\`\`\`solidity\n${source}\n\`\`\``);
   }
+  const model = llm.withStructuredOutput(z.object({ context: z.string() }));
   const result = await model.invoke([new SystemMessage(GATHER_CONTEXT_PROMPT), new HumanMessage(parts.join("\n\n"))]);
   logger.info(`gatherContext: context built (${parts.join("\n\n").length} chars)`);
 };
 const findVulnerabilities: GraphNode<typeof AuditorState> = async (state) => {
+  const model = llm.withStructuredOutput(z.object({ findings: z.array(CandidateFindingSchema) }));
   const previousFeedback =
     state.judgeReviews.length > 0
     };
   }
+  const model = llm.withStructuredOutput(JudgeReviewSchema);
   logger.info(`judgeFindings: reviewing ${state.candidateFindings.length} candidate finding(s) in parallel`);

src/agents/auditor/model.ts DELETED Viewed

@@ -1,13 +0,0 @@
-import { ChatAnthropic } from "@langchain/anthropic";
-export const gatherContextModel = new ChatAnthropic({
-  model: "claude-haiku-4-5",
-});
-export const findVulnerabilitiesModel = new ChatAnthropic({
-  model: "claude-sonnet-4-6",
-});
-export const judgeFindingsModel = new ChatAnthropic({
-  model: "claude-sonnet-4-6",
-});

src/agents/auditor/prompts.ts CHANGED Viewed

@@ -1,51 +1,50 @@
-// TODO: Compact the entire full context (parts: docs + static analysis) and infer the sections conciselly
-export const GATHER_CONTEXT_PROMPT = `You are a smart contract security expert. You will receive documentation, a structural analysis, and the full source of all in-scope Solidity contracts. Produce a thorough protocol context that will guide vulnerability discovery.
-Structure your output in the following sections:
-## 1. Contract Overview
-For each contract: its purpose, kind (contract/interface/library/abstract), inheritance chain, and key dependencies on other in-scope contracts or external protocols.
-## 2. State & Storage Map
-List all meaningful state variables across contracts, what they represent, and which functions read or write them. Flag shared or inherited storage.
-## 3. Key Flows
-Trace the main execution paths and state transitions end-to-end across contracts (e.g., deposit → mint shares → updateRewards; withdraw → burn shares → transfer ETH). Include cross-contract calls.
-## 4. Invariants
-Conditions that must always hold (e.g., "total supply must equal sum of all balances", "contract ETH balance ≥ sum of all user deposits"). Derive these from both the source and any documentation.
-## 5. Design Assumptions
-What the protocol assumes about callers, external contracts, oracles, admin keys, and token behavior (e.g., "tokens are ERC-20 compliant", "admin is trusted", "no fee-on-transfer tokens").
-## 6. Business Rules
-Access controls, fee structures, timelocks, caps, pausing mechanisms, upgrade patterns, and any other domain constraints.
-Be precise and exhaustive — the richer the context, the more accurately vulnerabilities can be identified and validated.`;
-export const FIND_VULNERABILITIES_PROMPT = `You are an expert smart contract security auditor specializing in Solidity. Systematically analyze the contract source code and protocol context to identify security vulnerabilities.
-For each vulnerability provide ALL of the following fields:
-- **title**: Short, precise name (e.g., "Reentrancy in withdraw", "Missing access control on setFee").
-- **description**: Explain the EXPECTED behavior vs the OBSERVED (vulnerable) behavior in 2–4 sentences.
-- **recommendation**: Specific, actionable remediation (e.g., "Apply checks-effects-interactions pattern", "Add onlyOwner modifier").
-- **severity**: One of "high" (direct fund loss or contract takeover), "medium" (indirect or conditional risk), "low" (best-practice issue, no immediate financial risk).
-- **codeSnippet**: The exact vulnerable code block as it appears in the source.
-Vulnerability categories to systematically check: reentrancy (single- and cross-function), access control, integer overflow/underflow, oracle manipulation, flash loan attacks, front-running/MEV, signature replay, storage collisions, uninitialized proxies, unsafe delegatecall, gas griefing, denial of service, precision loss, and logic/business rule violations.
-If judge feedback is provided from a previous iteration, remove confirmed false positives from your list and refine or expand remaining findings based on the critique.`;
-export const JUDGE_FINDINGS_PROMPT = `You are a rigorous smart contract security reviewer. Evaluate each candidate vulnerability submitted by the auditor and determine whether it is a true positive or a false positive.
-For each finding provide ALL of the following fields:
-- **review**: Detailed analysis (3–6 sentences) explaining why the vulnerability is or isn't real. Reference specific code, protocol invariants, preconditions, and mitigating controls.
-- **isFalsePositive**: true if the finding is NOT exploitable in practice; false if it IS a real vulnerability.
-- **confidence**: Integer 0–100 reflecting your confidence in this verdict.
-- **exploitablePaths**: Array of strings. If a true positive, provide concrete paths confirming exploitability with real values. Each trace must describe the attacker steps with realistic inputs/values (e.g., "1. Attacker calls deposit(100 ETH) 2. Attacker contract fallback re-enters withdraw() before balance update 3. Attacker drains 100 ETH twice"). If a false positive, provide the reasoning that blocks the exploit.
-A finding is a false positive if and only if: the exploit path is unreachable given access controls or preconditions, it is already fully mitigated by the code, it requires impossible or economically infeasible conditions, or it is explicitly documented as by-design behavior in the protocol assumptions.
-You must provide exactly one review object per finding, in the same order as the findings were presented.`;

+export const GATHER_CONTEXT_PROMPT = `Você é um especialista em segurança de smart contracts. Você receberá documentação, uma análise estrutural e o código-fonte completo de todos os contratos Solidity em escopo. Produza um contexto detalhado do protocolo que guiará a descoberta de vulnerabilidades.
+Estruture sua resposta nas seguintes seções:
+## 1. Visão Geral dos Contratos
+Para cada contrato: seu propósito, tipo (contract/interface/library/abstract), cadeia de herança e principais dependências de outros contratos em escopo ou protocolos externos.
+## 2. Mapa de Estado e Armazenamento
+Liste todas as variáveis de estado relevantes entre os contratos, o que representam e quais funções as leem ou escrevem. Sinalize armazenamento compartilhado ou herdado.
+## 3. Fluxos Principais
+Trace os principais caminhos de execução e transições de estado de ponta a ponta entre contratos (ex.: depósito → cunhar shares → atualizar recompensas; saque → queimar shares → transferir ETH). Inclua chamadas entre contratos.
+## 4. Invariantes
+Condições que devem sempre ser verdadeiras (ex.: "o supply total deve ser igual à soma de todos os saldos", "o saldo de ETH do contrato ≥ soma de todos os depósitos dos usuários"). Derive-as tanto do código-fonte quanto da documentação.
+## 5. Premissas de Design
+O que o protocolo assume sobre chamadores, contratos externos, oráculos, chaves de administrador e comportamento de tokens (ex.: "tokens são compatíveis com ERC-20", "o admin é confiável", "sem tokens com taxa de transferência").
+## 6. Regras de Negócio
+Controles de acesso, estruturas de taxas, timelocks, limites, mecanismos de pausa, padrões de atualização e quaisquer outras restrições de domínio.
+Seja preciso e exaustivo — quanto mais rico o contexto, com mais precisão as vulnerabilidades podem ser identificadas e validadas.`;
+export const FIND_VULNERABILITIES_PROMPT = `Você é um auditor especialista em segurança de smart contracts com foco em Solidity. Analise sistematicamente o código-fonte do contrato e o contexto do protocolo para identificar vulnerabilidades de segurança.
+Para cada vulnerabilidade, forneça TODOS os seguintes campos:
+- **title**: Nome curto e preciso (ex.: "Reentrância em withdraw", "Controle de acesso ausente em setFee").
+- **description**: Explique o comportamento ESPERADO versus o comportamento OBSERVADO (vulnerável) em 2 a 4 frases.
+- **recommendation**: Correção específica e acionável (ex.: "Aplicar o padrão checks-effects-interactions", "Adicionar o modificador onlyOwner").
+- **severity**: Um de "high" (perda direta de fundos ou tomada de controle do contrato), "medium" (risco indireto ou condicional), "low" (problema de boas práticas, sem risco financeiro imediato).
+- **codeSnippet**: O bloco de código vulnerável exatamente como aparece no código-fonte.
+Categorias de vulnerabilidades a verificar sistematicamente: reentrância (simples e entre funções), controle de acesso, overflow/underflow de inteiros, manipulação de oráculo, ataques de flash loan, front-running/MEV, replay de assinatura, colisões de armazenamento, proxies não inicializados, delegatecall inseguro, griefing de gas, negação de serviço, perda de precisão e violações de lógica/regras de negócio.
+Se feedback do juiz de uma iteração anterior for fornecido, remova os falsos positivos confirmados da sua lista e refine ou expanda os achados restantes com base na crítica.`;
+export const JUDGE_FINDINGS_PROMPT = `Você é um revisor rigoroso de segurança de smart contracts. Avalie cada vulnerabilidade candidata submetida pelo auditor e determine se é um verdadeiro positivo ou um falso positivo.
+Para cada achado, forneça TODOS os seguintes campos:
+- **review**: Análise detalhada (3 a 6 frases) explicando por que a vulnerabilidade é ou não real. Referencie código específico, invariantes do protocolo, pré-condições e controles mitigadores.
+- **isFalsePositive**: true se o achado NÃO for explorável na prática; false se for uma vulnerabilidade real.
+- **confidence**: Número inteiro de 0 a 100 refletindo sua confiança no veredicto.
+- **exploitablePaths**: Array de strings. Se for verdadeiro positivo, forneça caminhos concretos confirmando a explorabilidade com valores reais. Cada rastreamento deve descrever os passos do atacante com entradas/valores realistas (ex.: "1. Atacante chama deposit(100 ETH) 2. Contrato do atacante no fallback chama withdraw() novamente antes da atualização do saldo 3. Atacante drena 100 ETH duas vezes"). Se for falso positivo, forneça o raciocínio que bloqueia o exploit.
+Um achado é falso positivo somente se: o caminho de exploit for inacessível dados os controles de acesso ou pré-condições, já estiver totalmente mitigado pelo código, exigir condições impossíveis ou economicamente inviáveis, ou for explicitamente documentado como comportamento esperado nas premissas do protocolo.
+Você deve fornecer exatamente um objeto de revisão por achado, na mesma ordem em que os achados foram apresentados.`;

src/config/llm.ts CHANGED Viewed

@@ -1,7 +1,8 @@
 import { ChatGoogleGenerativeAI } from "@langchain/google-genai";
 import type { BaseChatModel } from "@langchain/core/language_models/chat_models";
-export type LLMProvider = "google" | "openrouter";
 export function createLLM(overrideProvider?: LLMProvider): BaseChatModel {
   const provider = overrideProvider || (process.env.LLM_PROVIDER as LLMProvider) || "google";
@@ -14,6 +15,11 @@ export function createLLM(overrideProvider?: LLMProvider): BaseChatModel {
         temperature: 0.2,
       }) as BaseChatModel;
     }
     case "google":
     default:
       return new ChatGoogleGenerativeAI({

 import { ChatGoogleGenerativeAI } from "@langchain/google-genai";
+import { ChatAnthropic } from "@langchain/anthropic";
 import type { BaseChatModel } from "@langchain/core/language_models/chat_models";
+export type LLMProvider = "google" | "openrouter" | "anthropic";
 export function createLLM(overrideProvider?: LLMProvider): BaseChatModel {
   const provider = overrideProvider || (process.env.LLM_PROVIDER as LLMProvider) || "google";
         temperature: 0.2,
       }) as BaseChatModel;
     }
+    case "anthropic":
+      return new ChatAnthropic({
+        model: process.env.ANTHROPIC_MODEL || "claude-sonnet-4-6",
+        temperature: 0.2,
+      });
     case "google":
     default:
       return new ChatGoogleGenerativeAI({

src/index.ts CHANGED Viewed

@@ -27,9 +27,9 @@ console.log(coderResult.contract);
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const outputDir = resolve(__dirname, "agents/coder/outputs");
 mkdirSync(outputDir, { recursive: true });
-const outputPath = resolve(outputDir, "Contract.sol");
-writeFileSync(outputPath, coderResult.contract, "utf-8");
-console.log("\nContrato salvo em:", outputPath);
 console.log("\n======= Auditor =======");
 logger.info("Starting auditorAgent");
@@ -37,7 +37,10 @@ logger.info("Starting auditorAgent");
 const auditorResult = await auditorAgent.invoke({ repoPath: outputDir });
 logger.info("Agent completed");
-logger.debug(`Agent result:\n${JSON.stringify(auditorResult, null, 2)}`);
 const testerResult = await testerAgent.invoke({
   solidityFiles: [coderResult.contract],

 const __dirname = dirname(fileURLToPath(import.meta.url));
 const outputDir = resolve(__dirname, "agents/coder/outputs");
 mkdirSync(outputDir, { recursive: true });
+writeFileSync(resolve(outputDir, "Contract.sol"), coderResult.contract, "utf-8");
+writeFileSync(resolve(outputDir, "README.md"), requirementsText, "utf-8");
+console.log("\nContrato e requisitos salvos em:", outputDir);
 console.log("\n======= Auditor =======");
 logger.info("Starting auditorAgent");
 const auditorResult = await auditorAgent.invoke({ repoPath: outputDir });
 logger.info("Agent completed");
+logger.info(`Findings: ${auditorResult.findings.length}`);
+for (const f of auditorResult.findings) {
+  logger.info(`  [${f.severity.toUpperCase()}] ${f.title} — ${f.location}`);
+}
 const testerResult = await testerAgent.invoke({
   solidityFiles: [coderResult.contract],

src/server.ts CHANGED Viewed

@@ -1,4 +1,8 @@
 import "dotenv/config";
 import { serve } from "@hono/node-server";
 import { Hono } from "hono";
 import { cors } from "hono/cors";
@@ -42,32 +46,49 @@ app.post("/api/run", (c) => {
         await send("log", "[Coder] Contrato compilado sem erros.");
       }
-      await send("coder", JSON.stringify({
-        contract: coderResult.contract,
-        compilationErrors: coderResult.compilationErrors,
-        reviewSummary: coderResult.reviewSummary,
-      }));
       // === AUDITOR ===
       await send("log", "[Auditor] Iniciando auditoria de segurança...");
-      const auditorResult = await auditorAgent.invoke({ solidityFile: coderResult.contract });
-      await send("log", `[Auditor] ${auditorResult.vulnerabilities.length} vulnerabilidade(s) encontrada(s).`);
-      await send("auditor", JSON.stringify({
-        vulnerabilities: auditorResult.vulnerabilities,
-      }));
       // === TESTER ===
       await send("log", "[Tester] Gerando testes de prova de conceito...");
       const testerResult = await testerAgent.invoke({
         solidityFiles: [coderResult.contract],
-        vulnerability: auditorResult.vulnerabilities[0] ?? {},
       });
       await send("log", `[Tester] ${testerResult.results.length} resultado(s) de teste.`);
-      await send("tester", JSON.stringify({
-        results: testerResult.results,
-      }));
       await send("log", "Pipeline concluído.");
       await send("done", "ok");

 import "dotenv/config";
+import { mkdirSync, writeFileSync } from "node:fs";
+import { resolve } from "node:path";
+import { tmpdir } from "node:os";
 import { serve } from "@hono/node-server";
 import { Hono } from "hono";
 import { cors } from "hono/cors";
         await send("log", "[Coder] Contrato compilado sem erros.");
       }
+      await send(
+        "coder",
+        JSON.stringify({
+          contract: coderResult.contract,
+          compilationErrors: coderResult.compilationErrors,
+          reviewSummary: coderResult.reviewSummary,
+        }),
+      );
       // === AUDITOR ===
+      const outputDir = resolve(tmpdir(), `talp1-${Date.now()}`);
+      mkdirSync(outputDir, { recursive: true });
+      writeFileSync(resolve(outputDir, "Contract.sol"), coderResult.contract, "utf-8");
+      writeFileSync(resolve(outputDir, "README.md"), requirements, "utf-8");
       await send("log", "[Auditor] Iniciando auditoria de segurança...");
+      const auditorResult = await auditorAgent.invoke({ repoPath: outputDir });
+      await send("log", `[Auditor] ${auditorResult.findings.length} vulnerabilidade(s) encontrada(s).`);
+      for (const f of auditorResult.findings) {
+        await send("log", `[Auditor] [${f.severity.toUpperCase()}] ${f.title} — ${f.location}`);
+      }
+      await send(
+        "auditor",
+        JSON.stringify({
+          findings: auditorResult.findings,
+        }),
+      );
       // === TESTER ===
       await send("log", "[Tester] Gerando testes de prova de conceito...");
       const testerResult = await testerAgent.invoke({
         solidityFiles: [coderResult.contract],
+        vulnerability: auditorResult.findings[0] ?? {},
       });
       await send("log", `[Tester] ${testerResult.results.length} resultado(s) de teste.`);
+      await send(
+        "tester",
+        JSON.stringify({
+          results: testerResult.results,
+        }),
+      );
       await send("log", "Pipeline concluído.");
       await send("done", "ok");