feat: integrate the agents

Dockerfile

@@ -20,6 +20,14 @@ RUN npm run build
 FROM node:22-slim
 WORKDIR /app
 
+# Install Foundry dependencies
+RUN apt-get update && apt-get install -y curl git && rm -rf /var/lib/apt/lists/*
+
+# Install Foundry
+RUN curl -L https://foundry.paradigm.xyz | bash
+ENV PATH="/root/.foundry/bin:${PATH}"
+RUN foundryup
+
 COPY package.json package-lock.json* ./
 COPY patches/ ./patches/
 RUN npm install --omit=dev --ignore-scripts
@@ -30,4 +38,8 @@ COPY --from=frontend-build /app/frontend/dist ./frontend/dist
 ENV PORT=7860
 EXPOSE 7860
 
+# Ensure scripts are executable
+COPY scripts/ ./scripts/
+RUN chmod +x scripts/*.sh
+
 CMD ["node", "dist/server.js"]

frontend/src/App.tsx

@@ -20,7 +20,11 @@ interface AgentResult {
   compilationErrors?: string[];
   reviewSummary?: string;
   findings?: Finding[];
-  results?: unknown[];
+  // Tester fields
+  status?: string;
+  pocCode?: string;
+  executionLogs?: string[];
+  iterations?: number;
 }
 
 export function App() {
@@ -220,13 +224,38 @@ export function App() {
       {testerResult && (
         <section style={styles.section}>
           <h2 style={styles.sectionTitle}>🧪 Agente Tester</h2>
-          <div style={styles.codeBox}>
-            <pre style={styles.code}>
-              {testerResult.results && testerResult.results.length > 0
-                ? JSON.stringify(testerResult.results, null, 2)
-                : "Nenhum resultado de teste gerado."}
-            </pre>
+          <div style={styles.resultBox}>
+            <p style={styles.resultText}>
+              <strong>Status:</strong>{" "}
+              <span style={{ color: testerResult.status === "success" ? "#22c55e" : "#ef4444" }}>
+                {testerResult.status?.toUpperCase()}
+              </span>
+              <br />
+              <strong>Iterações:</strong> {testerResult.iterations}
+            </p>
           </div>
+
+          {testerResult.pocCode && (
+            <>
+              <h3 style={styles.subTitle}>Proof of Concept (Exploit)</h3>
+              <div style={styles.codeBox}>
+                <pre style={styles.code}>{testerResult.pocCode}</pre>
+              </div>
+            </>
+          )}
+
+          {testerResult.executionLogs && testerResult.executionLogs.length > 0 && (
+            <>
+              <h3 style={styles.subTitle}>Logs de Execução (Foundry)</h3>
+              <div style={styles.logBox}>
+                {testerResult.executionLogs.map((log, i) => (
+                  <div key={i} style={styles.logLine}>
+                    {log}
+                  </div>
+                ))}
+              </div>
+            </>
+          )}
         </section>
       )}
     </div>

scripts/setup-sandbox.sh

@@ -2,9 +2,13 @@
 set -e
 
 SANDBOX="/tmp/poc-sandbox"
-FORGE_BIN="$HOME/.foundry/bin/forge"
 
-echo "Inicializando sandbox Foundry em $SANDBOX..."
+# Tenta encontrar forge no PATH se a variável não estiver definida ou falhar
+if [ -z "$FORGE_BIN" ] || [ ! -f "$FORGE_BIN" ]; then
+    FORGE_BIN=$(which forge || echo "forge")
+fi
+
+echo "Inicializando sandbox Foundry em $SANDBOX usando $FORGE_BIN..."
 rm -rf "$SANDBOX"
 mkdir -p "$SANDBOX"
 cd "$SANDBOX"

src/agents/auditor/agent.ts

@@ -24,8 +24,6 @@ import {
 } from "./config.ts";
 import { matchLines } from "./utils.ts";
 
-const llm = createLLM();
-
 const walkDirectory = (dir: string, depth: number, solFiles: string[], docFiles: string[]) => {
   if (depth > MAX_DEPTH) return;
 
@@ -121,17 +119,29 @@ const gatherContext: GraphNode<typeof AuditorState> = async (state) => {
     parts.push(`### ${filePath}\n\`\`\`solidity\n${source}\n\`\`\``);
   }
 
-  const model = llm.withStructuredOutput(z.object({ context: z.string() }));
-  const result = await model.invoke([new SystemMessage(GATHER_CONTEXT_PROMPT), new HumanMessage(parts.join("\n\n"))]);
+  const llm = createLLM();
+  const result = await llm.invoke([new SystemMessage(GATHER_CONTEXT_PROMPT), new HumanMessage(parts.join("\n\n"))]);
+
+  const repoContext = typeof result.content === "string" ? result.content : JSON.stringify(result.content);
 
-  logger.info(`gatherContext: context built (${parts.join("\n\n").length} chars)`);
-  logger.debug(`gatherContext: full context:\n${parts.join("\n\n")}`);
+  logger.info(`gatherContext: context built (${repoContext.length} chars)`);
+  logger.debug(`gatherContext: full context:\n${repoContext}`);
 
-  return { repoContext: result.context };
+  return { repoContext };
 };
 
 const findVulnerabilities: GraphNode<typeof AuditorState> = async (state) => {
-  const model = llm.withStructuredOutput(z.object({ findings: z.array(CandidateFindingSchema) }));
+  console.log("[auditorAgent] Iniciando findVulnerabilities...");
+  const llm = createLLM();
+  const model = llm.withStructuredOutput(
+    z.object({
+      findings: z.array(CandidateFindingSchema),
+    }),
+    {
+      name: "vulnerability_report",
+      method: "jsonSchema",
+    },
+  );
 
   const previousFeedback =
     state.judgeReviews.length > 0
@@ -185,6 +195,7 @@ const findVulnerabilities: GraphNode<typeof AuditorState> = async (state) => {
 };
 
 const judgeFindings: GraphNode<typeof AuditorState> = async (state) => {
+  console.log(`[auditorAgent] Iniciando judgeFindings para ${state.candidateFindings.length} candidatos...`);
   if (state.candidateFindings.length === 0) {
     logger.info("judgeFindings: no candidate findings to review, skipping LLM call");
     return {
@@ -194,7 +205,16 @@ const judgeFindings: GraphNode<typeof AuditorState> = async (state) => {
     };
   }
 
-  const model = llm.withStructuredOutput(JudgeReviewSchema);
+  const llm = createLLM();
+  const model = llm.withStructuredOutput(
+    z.object({
+      review_result: JudgeReviewSchema,
+    }),
+    {
+      name: "judge_review",
+      method: "jsonSchema",
+    },
+  );
 
   logger.info(`judgeFindings: reviewing ${state.candidateFindings.length} candidate finding(s) in parallel`);
 
@@ -210,12 +230,13 @@ const judgeFindings: GraphNode<typeof AuditorState> = async (state) => {
       const findingText = `[Finding ${i + 1}] ${finding.title}\nSeverity: ${finding.severity}\nDescription: ${finding.description}\nLocation: ${finding.path} lines ${finding.location}\nCode:\n\`\`\`solidity\n${finding.codeSnippet}\n\`\`\``;
 
       logger.debug(`judgeFindings: reviewing finding ${i + 1}: ${finding.title}`);
-      return model.invoke([
+      const result = await model.invoke([
         new SystemMessage(JUDGE_FINDINGS_PROMPT),
         new HumanMessage(
           `Contract (${finding.path}):\n\n${source}\n\nProtocol Context:\n${state.repoContext}\n\nFinding to Review:\n\n${findingText}`,
         ),
       ]);
+      return result.review_result;
     }),
   );
 
@@ -234,6 +255,7 @@ const judgeFindings: GraphNode<typeof AuditorState> = async (state) => {
 
   const falsePositiveCount = state.candidateFindings.length - findings.length;
 
+  console.log(`[auditorAgent] Concluído: ${findings.length} confirmados, ${falsePositiveCount} falsos positivos.`);
   logger.info(`judgeFindings: ${findings.length} confirmed, ${falsePositiveCount} false positive(s)`);
   logger.debug(`judgeFindings: reviews:\n${JSON.stringify(reviews, null, 2)}`);
 

src/agents/auditor/prompts.ts

@@ -24,7 +24,9 @@ Seja preciso e exaustivo — quanto mais rico o contexto, com mais precisão as
 
 export const FIND_VULNERABILITIES_PROMPT = `Você é um auditor especialista em segurança de smart contracts com foco em Solidity. Analise sistematicamente o código-fonte do contrato e o contexto do protocolo para identificar vulnerabilidades de segurança.
 
-Para cada vulnerabilidade, forneça TODOS os seguintes campos:
+Sua resposta deve ser um objeto JSON contendo uma lista de achados sob a chave "findings".
+
+Para cada vulnerabilidade em "findings", forneça TODOS os seguintes campos:
 
 - **title**: Nome curto e preciso (ex.: "Reentrância em withdraw", "Controle de acesso ausente em setFee").
 - **description**: Explique o comportamento ESPERADO versus o comportamento OBSERVADO (vulnerável) em 2 a 4 frases.
@@ -38,7 +40,9 @@ Se feedback do juiz de uma iteração anterior for fornecido, remova os falsos p
 
 export const JUDGE_FINDINGS_PROMPT = `Você é um revisor rigoroso de segurança de smart contracts. Avalie cada vulnerabilidade candidata submetida pelo auditor e determine se é um verdadeiro positivo ou um falso positivo.
 
-Para cada achado, forneça TODOS os seguintes campos:
+Sua resposta deve ser um objeto JSON contendo a revisão sob a chave "review_result".
+
+Para o achado fornecido, preencha os seguintes campos em "review_result":
 
 - **review**: Análise detalhada (3 a 6 frases) explicando por que a vulnerabilidade é ou não real. Referencie código específico, invariantes do protocolo, pré-condições e controles mitigadores.
 - **isFalsePositive**: true se o achado NÃO for explorável na prática; false se for uma vulnerabilidade real.

src/agents/tester/agent.ts

@@ -12,7 +12,7 @@ import { analyzeFoundryLog } from "./utils/logAnalyzer.js";
 const MAX_ITERATIONS = 5;
 
 const llm = new ChatOpenRouter({
-  model: "deepseek/deepseek-v4-flash",
+  model: process.env.OPENROUTER_MODEL || "deepseek/deepseek-v4-flash",
   temperature: 0.2,
   apiKey: process.env.OPENROUTER_API_KEY,
 });
@@ -57,7 +57,7 @@ Scaffold (complete APENAS test_Exploit):
 ${oracleContext!.solidityScaffold}
 \`\`\``;
 
-  console.log(`[generatePoCNode] iteração ${iterations + 1}, isRetry=${isRetry}`);
+  console.log(`[testerAgent] generatePoCNode iteração ${iterations + 1}, isRetry=${isRetry}`);
 
   try {
     const response = await llm.invoke([
@@ -65,20 +65,24 @@ ${oracleContext!.solidityScaffold}
       { role: "user", content: userMessage },
     ]);
     const solidityCode = extractSolidity(response.content as string);
-    console.log("[generatePoCNode] Solidity extraído, tamanho:", solidityCode.length);
+    console.log("[testerAgent] Solidity extraído, tamanho:", solidityCode.length);
     return { pocCode: solidityCode, iterations: 1 };
   } catch (err) {
-    console.error("[generatePoCNode] falha:", (err as Error).message);
+    console.error("[testerAgent] falha na geração:", (err as Error).message);
     return { iterations: 1, lastError: `Erro na geração/extração: ${(err as Error).message}` };
   }
 }
 
 async function runFoundryNode(state: PoCState): Promise<Partial<PoCState>> {
+  console.log("[testerAgent] Executando runFoundryNode...");
   const result   = await runFoundry(state.pocCode);
   const analysis = analyzeFoundryLog(result);
   const passed   = result.exitCode === 0 && result.stdout.includes("ok");
 
-  console.log(`[runFoundryNode] exitCode=${result.exitCode}, passed=${passed}`);
+  console.log(`[testerAgent] Resultado Foundry: exitCode=${result.exitCode}, passed=${passed}`);
+  if (!passed) {
+    console.log(`[testerAgent] Falha detectada: ${analysis.summary}`);
+  }
 
   return {
     executionLogs: [result.combined],   // reducer append

src/config/llm.ts

@@ -1,5 +1,6 @@
 import { ChatGoogleGenerativeAI } from "@langchain/google-genai";
 import { ChatAnthropic } from "@langchain/anthropic";
+import { ChatOpenRouter } from "@langchain/openrouter";
 import type { BaseChatModel } from "@langchain/core/language_models/chat_models";
 
 export type LLMProvider = "google" | "openrouter" | "anthropic";
@@ -8,17 +9,20 @@ export function createLLM(overrideProvider?: LLMProvider): BaseChatModel {
   const provider = overrideProvider || (process.env.LLM_PROVIDER as LLMProvider) || "google";
 
   switch (provider) {
-    case "openrouter": {
-      const { ChatOpenRouter } = require("@langchain/openrouter");
+    case "openrouter":
       return new ChatOpenRouter({
-        model: process.env.OPENROUTER_MODEL || "google/gemini-2.5-flash",
+        model: process.env.OPENROUTER_MODEL || "openai/gpt-4o-mini",
         temperature: 0.2,
-      }) as BaseChatModel;
-    }
+        apiKey: process.env.OPENROUTER_API_KEY,
+        maxTokens: 4096,
+      });
+
+
     case "anthropic":
       return new ChatAnthropic({
         model: process.env.ANTHROPIC_MODEL || "claude-sonnet-4-6",
         temperature: 0.2,
+        maxTokens: 4096,
       });
     case "google":
     default:
@@ -26,6 +30,7 @@ export function createLLM(overrideProvider?: LLMProvider): BaseChatModel {
         apiKey: process.env.GOOGLE_API_KEY || "",
         model: process.env.MODEL_NAME || "gemini-2.5-flash",
         temperature: 0.2,
+        maxOutputTokens: 4096,
       });
   }
 }

src/index.ts

@@ -9,6 +9,7 @@ import { coderAgent } from "./agents/coder/agent.js";
 import { testerAgent } from "./agents/tester/agent.js";
 import { logger } from "./logger.js";
 import type { VulnerabilityReport, Finding } from "./agents/tester/types.js";
+import { mapFindingToReport } from "./utils/mapFinding.js";
 
 const inputPath = process.argv[2];
 
@@ -42,33 +43,6 @@ for (const f of auditorResult.findings) {
   logger.info(`  [${f.severity.toUpperCase()}] ${f.title} — ${f.location}`);
 }
 
-function mapFindingToReport(finding: any, sourceCode: string): VulnerabilityReport {
-  const title = finding.title || finding.type || "Unknown vulnerability";
-  const description = finding.description || "No description provided by auditor.";
-  
-  const nameMatch = finding.path?.match(/([^\/]+)\.sol$/);
-  const contractName = nameMatch ? nameMatch[1] : "TargetContract";
-
-  const exploitablePaths = finding.judgeReview?.exploitablePaths || [];
-
-  return {
-    id: title.toLowerCase().replace(/[^a-z0-9]+/g, "-").slice(0, 50),
-    severity: (finding.severity === "high" || finding.severity === "medium" || finding.severity === "low") 
-               ? finding.severity : "low",
-    type: finding.type || "custom",
-    title,
-    description,
-    affectedContract: {
-      name: contractName,
-      sourceCode,
-    },
-    attackVector: exploitablePaths[0] ?? "Unknown vector",
-    exploitablePaths,
-    codeSnippet: finding.codeSnippet,
-    location: finding.location
-  };
-}
-
 if (auditorResult.findings.length > 0) {
   const finding = auditorResult.findings[0];
   const report = mapFindingToReport(finding, coderResult.contract);

src/server.ts

@@ -12,6 +12,7 @@ import { serveStatic } from "@hono/node-server/serve-static";
 import { coderAgent } from "./agents/coder/agent.ts";
 import { auditorAgent } from "./agents/auditor/agent.ts";
 import { testerAgent } from "./agents/tester/agent.ts";
+import { mapFindingToReport } from "./utils/mapFinding.js";
 
 const app = new Hono();
 
@@ -77,18 +78,25 @@ app.post("/api/run", (c) => {
 
       // === TESTER ===
       await send("log", "[Tester] Gerando testes de prova de conceito...");
-      const testerResult = await testerAgent.invoke({
-        solidityFiles: [coderResult.contract],
-        vulnerability: auditorResult.findings[0] ?? {},
-      });
-      await send("log", `[Tester] ${testerResult.results.length} resultado(s) de teste.`);
 
-      await send(
-        "tester",
-        JSON.stringify({
-          results: testerResult.results,
-        }),
-      );
+      if (auditorResult.findings.length > 0) {
+        const report = mapFindingToReport(auditorResult.findings[0], coderResult.contract);
+        const testerResult = await testerAgent.invoke({ report });
+
+        await send("log", `[Tester] Execução concluída com status: ${testerResult.status}`);
+        await send(
+          "tester",
+          JSON.stringify({
+            status: testerResult.status,
+            pocCode: testerResult.pocCode,
+            executionLogs: testerResult.executionLogs,
+            iterations: testerResult.iterations,
+          }),
+        );
+      } else {
+        await send("log", "[Tester] Nenhuma vulnerabilidade para testar.");
+        await send("tester", JSON.stringify({ results: [] }));
+      }
 
       await send("log", "Pipeline concluído.");
       await send("done", "ok");

src/utils/mapFinding.ts

@@ -0,0 +1,32 @@
+import type { Finding, VulnerabilityReport } from "../agents/tester/types.js";
+
+/**
+ * Mapeia um achado (Finding) do Auditor para um relatório de vulnerabilidade (VulnerabilityReport)
+ * compatível com o Gerador de PoCs (Tester).
+ */
+export function mapFindingToReport(finding: any, sourceCode: string): VulnerabilityReport {
+  const title = finding.title || finding.type || "Unknown vulnerability";
+  const description = finding.description || "No description provided by auditor.";
+  
+  const nameMatch = finding.path?.match(/([^\/]+)\.sol$/);
+  const contractName = nameMatch ? nameMatch[1] : "TargetContract";
+
+  const exploitablePaths = finding.judgeReview?.exploitablePaths || [];
+
+  return {
+    id: title.toLowerCase().replace(/[^a-z0-9]+/g, "-").slice(0, 50),
+    severity: (finding.severity === "high" || finding.severity === "medium" || finding.severity === "low") 
+               ? finding.severity : "low",
+    type: finding.type || "custom",
+    title,
+    description,
+    affectedContract: {
+      name: contractName,
+      sourceCode,
+    },
+    attackVector: exploitablePaths[0] ?? "Unknown vector",
+    exploitablePaths,
+    codeSnippet: finding.codeSnippet,
+    location: finding.location
+  };
+}