use different models and add winston logger

package-lock.json

@@ -16,6 +16,7 @@
         "@solidity-parser/parser": "^0.20.2",
         "dotenv": "^17.4.2",
         "langchain": "^1.4.0",
+        "winston": "^3.19.0",
         "zod": "^4.4.3"
       },
       "devDependencies": {
@@ -223,6 +224,26 @@
       "integrity": "sha512-gAmrUZSGtKc3AiBL71iNWxDsyUC5uMaKKGdvzYsBoTW/xi42JQHl7eKV2OYzCUqvc+D2RCcf7EXY2iCyFIk6og==",
       "license": "MIT"
     },
+    "node_modules/@colors/colors": {
+      "version": "1.6.0",
+      "resolved": "https://registry.npmjs.org/@colors/colors/-/colors-1.6.0.tgz",
+      "integrity": "sha512-Ir+AOibqzrIsL6ajt3Rz3LskB7OiMVHqltZmspbW/TJuTVuyOMirVqAkjfY6JISiLHgyNqicAC8AyHHGzNd/dA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.1.90"
+      }
+    },
+    "node_modules/@dabh/diagnostics": {
+      "version": "2.0.8",
+      "resolved": "https://registry.npmjs.org/@dabh/diagnostics/-/diagnostics-2.0.8.tgz",
+      "integrity": "sha512-R4MSXTVnuMzGD7bzHdW2ZhhdPC/igELENcq5IjEverBvq5hn1SXCWcsi6eSsdWP0/Ur+SItRRjAktmdoX/8R/Q==",
+      "license": "MIT",
+      "dependencies": {
+        "@so-ric/colorspace": "^1.1.6",
+        "enabled": "2.0.x",
+        "kuler": "^2.0.0"
+      }
+    },
     "node_modules/@emnapi/core": {
       "version": "1.10.0",
       "resolved": "https://registry.npmjs.org/@emnapi/core/-/core-1.10.0.tgz",
@@ -756,6 +777,16 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/@so-ric/colorspace": {
+      "version": "1.1.6",
+      "resolved": "https://registry.npmjs.org/@so-ric/colorspace/-/colorspace-1.1.6.tgz",
+      "integrity": "sha512-/KiKkpHNOBgkFJwu9sh48LkHSMYGyuTcSFK/qMBdnOAlrRJzRSXAOFB5qwzaVQuDl8wAvHVMkaASQDReTahxuw==",
+      "license": "MIT",
+      "dependencies": {
+        "color": "^5.0.2",
+        "text-hex": "1.0.x"
+      }
+    },
     "node_modules/@solidity-parser/parser": {
       "version": "0.20.2",
       "resolved": "https://registry.npmjs.org/@solidity-parser/parser/-/parser-0.20.2.tgz",
@@ -820,6 +851,12 @@
         "undici-types": "~7.19.0"
       }
     },
+    "node_modules/@types/triple-beam": {
+      "version": "1.3.5",
+      "resolved": "https://registry.npmjs.org/@types/triple-beam/-/triple-beam-1.3.5.tgz",
+      "integrity": "sha512-6WaYesThRMCl19iryMYP7/x2OVgCtbIVflDGFpWnb9irXI3UjYE4AzmYuiUKY1AJstGijoY+MgUszMgRxIYTYw==",
+      "license": "MIT"
+    },
     "node_modules/@vitest/expect": {
       "version": "4.1.5",
       "resolved": "https://registry.npmjs.org/@vitest/expect/-/expect-4.1.5.tgz",
@@ -955,6 +992,12 @@
         "node": ">=12"
       }
     },
+    "node_modules/async": {
+      "version": "3.2.6",
+      "resolved": "https://registry.npmjs.org/async/-/async-3.2.6.tgz",
+      "integrity": "sha512-htCUDlxyyCLMgaM3xXg0C0LW2xqfuQ6p05pCEIsXuyQ+a1koYKTuBMzRNwmybfLgvJDMd0r1LTn4+E0Ti6C2AA==",
+      "license": "MIT"
+    },
     "node_modules/base64-js": {
       "version": "1.5.1",
       "resolved": "https://registry.npmjs.org/base64-js/-/base64-js-1.5.1.tgz",
@@ -997,6 +1040,52 @@
         "node": ">=18"
       }
     },
+    "node_modules/color": {
+      "version": "5.0.3",
+      "resolved": "https://registry.npmjs.org/color/-/color-5.0.3.tgz",
+      "integrity": "sha512-ezmVcLR3xAVp8kYOm4GS45ZLLgIE6SPAFoduLr6hTDajwb3KZ2F46gulK3XpcwRFb5KKGCSezCBAY4Dw4HsyXA==",
+      "license": "MIT",
+      "dependencies": {
+        "color-convert": "^3.1.3",
+        "color-string": "^2.1.3"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/color-convert": {
+      "version": "3.1.3",
+      "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-3.1.3.tgz",
+      "integrity": "sha512-fasDH2ont2GqF5HpyO4w0+BcewlhHEZOFn9c1ckZdHpJ56Qb7MHhH/IcJZbBGgvdtwdwNbLvxiBEdg336iA9Sg==",
+      "license": "MIT",
+      "dependencies": {
+        "color-name": "^2.0.0"
+      },
+      "engines": {
+        "node": ">=14.6"
+      }
+    },
+    "node_modules/color-name": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/color-name/-/color-name-2.1.0.tgz",
+      "integrity": "sha512-1bPaDNFm0axzE4MEAzKPuqKWeRaT43U/hyxKPBdqTfmPF+d6n7FSoTFxLVULUJOmiLp01KjhIPPH+HrXZJN4Rg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=12.20"
+      }
+    },
+    "node_modules/color-string": {
+      "version": "2.1.4",
+      "resolved": "https://registry.npmjs.org/color-string/-/color-string-2.1.4.tgz",
+      "integrity": "sha512-Bb6Cq8oq0IjDOe8wJmi4JeNn763Xs9cfrBcaylK1tPypWzyoy2G3l90v9k64kjphl/ZJjPIShFztenRomi8WTg==",
+      "license": "MIT",
+      "dependencies": {
+        "color-name": "^2.0.0"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
     "node_modules/convert-source-map": {
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/convert-source-map/-/convert-source-map-2.0.0.tgz",
@@ -1035,6 +1124,12 @@
         "url": "https://dotenvx.com"
       }
     },
+    "node_modules/enabled": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/enabled/-/enabled-2.0.0.tgz",
+      "integrity": "sha512-AKrN98kuwOzMIdAizXGI86UFBoo26CL21UM763y1h/GMSJ4/OHU9k2YlsmBpyScFo/wbLzWQJBMCW4+IO3/+OQ==",
+      "license": "MIT"
+    },
     "node_modules/es-module-lexer": {
       "version": "2.1.0",
       "resolved": "https://registry.npmjs.org/es-module-lexer/-/es-module-lexer-2.1.0.tgz",
@@ -1095,6 +1190,18 @@
         }
       }
     },
+    "node_modules/fecha": {
+      "version": "4.2.3",
+      "resolved": "https://registry.npmjs.org/fecha/-/fecha-4.2.3.tgz",
+      "integrity": "sha512-OP2IUU6HeYKJi3i0z4A19kHMQoLVs4Hc+DPqqxI2h/DPZHTm/vjsfC6P0b4jCMy14XizLBqvndQ+UilD7707Jw==",
+      "license": "MIT"
+    },
+    "node_modules/fn.name": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/fn.name/-/fn.name-1.1.0.tgz",
+      "integrity": "sha512-GRnmB5gPyJpAhTQdSZTSp9uaPSvl09KoYcMQtsB9rQoOmzs9dH6ffeccH+Z+cv6P68Hu5bC6JjRh4Ah/mHSNRw==",
+      "license": "MIT"
+    },
     "node_modules/fsevents": {
       "version": "2.3.3",
       "resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.3.3.tgz",
@@ -1110,6 +1217,12 @@
         "node": "^8.16.0 || ^10.6.0 || >=11.0.0"
       }
     },
+    "node_modules/inherits": {
+      "version": "2.0.4",
+      "resolved": "https://registry.npmjs.org/inherits/-/inherits-2.0.4.tgz",
+      "integrity": "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==",
+      "license": "ISC"
+    },
     "node_modules/is-network-error": {
       "version": "1.3.1",
       "resolved": "https://registry.npmjs.org/is-network-error/-/is-network-error-1.3.1.tgz",
@@ -1122,6 +1235,18 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
+    "node_modules/is-stream": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/is-stream/-/is-stream-2.0.1.tgz",
+      "integrity": "sha512-hFoiJiTl63nn+kstHGBtewWSKnQLpyb155KHheA1l39uvtO9nWIop1p3udqPcUd/xbF1VLMO4n7OI6p7RbngDg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
     "node_modules/js-tiktoken": {
       "version": "1.0.21",
       "resolved": "https://registry.npmjs.org/js-tiktoken/-/js-tiktoken-1.0.21.tgz",
@@ -1144,6 +1269,12 @@
         "node": ">=16"
       }
     },
+    "node_modules/kuler": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/kuler/-/kuler-2.0.0.tgz",
+      "integrity": "sha512-Xq9nH7KlWZmXAtodXDDRE7vs6DU1gTU8zYDHDiWLSip45Egwq3plLHzPn27NgvzL2r1LMPC1vdqh98sQxtqj4A==",
+      "license": "MIT"
+    },
     "node_modules/langchain": {
       "version": "1.4.0",
       "resolved": "https://registry.npmjs.org/langchain/-/langchain-1.4.0.tgz",
@@ -1456,6 +1587,23 @@
         "url": "https://opencollective.com/parcel"
       }
     },
+    "node_modules/logform": {
+      "version": "2.7.0",
+      "resolved": "https://registry.npmjs.org/logform/-/logform-2.7.0.tgz",
+      "integrity": "sha512-TFYA4jnP7PVbmlBIfhlSe+WKxs9dklXMTEGcBCIvLhE/Tn3H6Gk1norupVW7m5Cnd4bLcr08AytbyV/xj7f/kQ==",
+      "license": "MIT",
+      "dependencies": {
+        "@colors/colors": "1.6.0",
+        "@types/triple-beam": "^1.3.2",
+        "fecha": "^4.2.0",
+        "ms": "^2.1.1",
+        "safe-stable-stringify": "^2.3.1",
+        "triple-beam": "^1.3.0"
+      },
+      "engines": {
+        "node": ">= 12.0.0"
+      }
+    },
     "node_modules/magic-string": {
       "version": "0.30.21",
       "resolved": "https://registry.npmjs.org/magic-string/-/magic-string-0.30.21.tgz",
@@ -1466,6 +1614,12 @@
         "@jridgewell/sourcemap-codec": "^1.5.5"
       }
     },
+    "node_modules/ms": {
+      "version": "2.1.3",
+      "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
+      "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==",
+      "license": "MIT"
+    },
     "node_modules/mustache": {
       "version": "4.2.0",
       "resolved": "https://registry.npmjs.org/mustache/-/mustache-4.2.0.tgz",
@@ -1505,6 +1659,15 @@
       ],
       "license": "MIT"
     },
+    "node_modules/one-time": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/one-time/-/one-time-1.0.0.tgz",
+      "integrity": "sha512-5DXOiRKwuSEcQ/l0kGCF6Q3jcADFv5tSmRaJck/OqkVFcOzutB134KRSfF0xDrL39MNnqxbHBbUUcjZIhTgb2g==",
+      "license": "MIT",
+      "dependencies": {
+        "fn.name": "1.x.x"
+      }
+    },
     "node_modules/openai": {
       "version": "6.36.0",
       "resolved": "https://registry.npmjs.org/openai/-/openai-6.36.0.tgz",
@@ -1634,6 +1797,20 @@
         "node": "^10 || ^12 || >=14"
       }
     },
+    "node_modules/readable-stream": {
+      "version": "3.6.2",
+      "resolved": "https://registry.npmjs.org/readable-stream/-/readable-stream-3.6.2.tgz",
+      "integrity": "sha512-9u/sniCrY3D5WdsERHzHE4G2YCXqoG5FTHUiCC4SIbr6XcLZBY05ya9EKjYek9O5xOAwjGq+1JdGBAS7Q9ScoA==",
+      "license": "MIT",
+      "dependencies": {
+        "inherits": "^2.0.3",
+        "string_decoder": "^1.1.1",
+        "util-deprecate": "^1.0.1"
+      },
+      "engines": {
+        "node": ">= 6"
+      }
+    },
     "node_modules/rolldown": {
       "version": "1.0.0-rc.18",
       "resolved": "https://registry.npmjs.org/rolldown/-/rolldown-1.0.0-rc.18.tgz",
@@ -1668,6 +1845,35 @@
         "@rolldown/binding-win32-x64-msvc": "1.0.0-rc.18"
       }
     },
+    "node_modules/safe-buffer": {
+      "version": "5.2.1",
+      "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.2.1.tgz",
+      "integrity": "sha512-rp3So07KcdmmKbGvgaNxQSJr7bGVSVk5S9Eq1F+ppbRo70+YeaDxkw5Dd8NPN+GD6bjnYm2VuPuCXmpuYvmCXQ==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "license": "MIT"
+    },
+    "node_modules/safe-stable-stringify": {
+      "version": "2.5.0",
+      "resolved": "https://registry.npmjs.org/safe-stable-stringify/-/safe-stable-stringify-2.5.0.tgz",
+      "integrity": "sha512-b3rppTKm9T+PsVCBEOUR46GWI7fdOs00VKZ1+9c1EWDaDMvjQc6tUwuFyIprgGgTcWoVHSKrU8H31ZHA2e0RHA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=10"
+      }
+    },
     "node_modules/siginfo": {
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/siginfo/-/siginfo-2.0.0.tgz",
@@ -1685,6 +1891,15 @@
         "node": ">=0.10.0"
       }
     },
+    "node_modules/stack-trace": {
+      "version": "0.0.10",
+      "resolved": "https://registry.npmjs.org/stack-trace/-/stack-trace-0.0.10.tgz",
+      "integrity": "sha512-KGzahc7puUKkzyMt+IqAep+TVNbKP+k2Lmwhub39m1AsTSkaDutx56aDCo+HLDzf/D26BIHTJWNiTG1KAJiQCg==",
+      "license": "MIT",
+      "engines": {
+        "node": "*"
+      }
+    },
     "node_modules/stackback": {
       "version": "0.0.2",
       "resolved": "https://registry.npmjs.org/stackback/-/stackback-0.0.2.tgz",
@@ -1699,6 +1914,21 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/string_decoder": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/string_decoder/-/string_decoder-1.3.0.tgz",
+      "integrity": "sha512-hkRX8U1WjJFd8LsDJ2yQ/wWWxaopEsABU1XfkM8A+j0+85JAGppt16cr1Whg6KIbb4okU6Mql6BOj+uup/wKeA==",
+      "license": "MIT",
+      "dependencies": {
+        "safe-buffer": "~5.2.0"
+      }
+    },
+    "node_modules/text-hex": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/text-hex/-/text-hex-1.0.0.tgz",
+      "integrity": "sha512-uuVGNWzgJ4yhRaNSiubPY7OjISw4sw4E5Uv0wbjp+OzcbmVU/rsT8ujgcXJhn9ypzsgr5vlzpPqP+MBBKcGvbg==",
+      "license": "MIT"
+    },
     "node_modules/tinybench": {
       "version": "2.9.0",
       "resolved": "https://registry.npmjs.org/tinybench/-/tinybench-2.9.0.tgz",
@@ -1743,6 +1973,15 @@
         "node": ">=14.0.0"
       }
     },
+    "node_modules/triple-beam": {
+      "version": "1.4.1",
+      "resolved": "https://registry.npmjs.org/triple-beam/-/triple-beam-1.4.1.tgz",
+      "integrity": "sha512-aZbgViZrg1QNcG+LULa7nhZpJTZSLm/mXnHXnbAbjmN5aSa0y7V+wvv6+4WaBtpISJzThKy+PIPxc1Nq1EJ9mg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 14.0.0"
+      }
+    },
     "node_modules/ts-algebra": {
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/ts-algebra/-/ts-algebra-2.0.0.tgz",
@@ -1778,6 +2017,12 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/util-deprecate": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/util-deprecate/-/util-deprecate-1.0.2.tgz",
+      "integrity": "sha512-EPD5q1uXyFxJpCrLnCc1nHnq3gOa6DZBocAIiI2TaSCA7VCJ1UJDMagCzIkXNsUYfD1daK//LTEQ8xiIbrHtcw==",
+      "license": "MIT"
+    },
     "node_modules/uuid": {
       "version": "10.0.0",
       "resolved": "https://registry.npmjs.org/uuid/-/uuid-10.0.0.tgz",
@@ -1977,6 +2222,42 @@
         "node": ">=8"
       }
     },
+    "node_modules/winston": {
+      "version": "3.19.0",
+      "resolved": "https://registry.npmjs.org/winston/-/winston-3.19.0.tgz",
+      "integrity": "sha512-LZNJgPzfKR+/J3cHkxcpHKpKKvGfDZVPS4hfJCc4cCG0CgYzvlD6yE/S3CIL/Yt91ak327YCpiF/0MyeZHEHKA==",
+      "license": "MIT",
+      "dependencies": {
+        "@colors/colors": "^1.6.0",
+        "@dabh/diagnostics": "^2.0.8",
+        "async": "^3.2.3",
+        "is-stream": "^2.0.0",
+        "logform": "^2.7.0",
+        "one-time": "^1.0.0",
+        "readable-stream": "^3.4.0",
+        "safe-stable-stringify": "^2.3.1",
+        "stack-trace": "0.0.x",
+        "triple-beam": "^1.3.0",
+        "winston-transport": "^4.9.0"
+      },
+      "engines": {
+        "node": ">= 12.0.0"
+      }
+    },
+    "node_modules/winston-transport": {
+      "version": "4.9.0",
+      "resolved": "https://registry.npmjs.org/winston-transport/-/winston-transport-4.9.0.tgz",
+      "integrity": "sha512-8drMJ4rkgaPo1Me4zD/3WLfI/zPdA9o2IipKODunnGDcuqbHwjsbB79ylv04LCGGzU0xQ6vTznOMpQGaLhhm6A==",
+      "license": "MIT",
+      "dependencies": {
+        "logform": "^2.7.0",
+        "readable-stream": "^3.6.2",
+        "triple-beam": "^1.3.0"
+      },
+      "engines": {
+        "node": ">= 12.0.0"
+      }
+    },
     "node_modules/zod": {
       "version": "4.4.3",
       "resolved": "https://registry.npmjs.org/zod/-/zod-4.4.3.tgz",

package.json

@@ -34,6 +34,7 @@
     "@solidity-parser/parser": "^0.20.2",
     "dotenv": "^17.4.2",
     "langchain": "^1.4.0",
+    "winston": "^3.19.0",
     "zod": "^4.4.3"
   }
 }

src/agents/auditor/agent.ts

@@ -5,9 +5,10 @@ import { HumanMessage, SystemMessage } from "@langchain/core/messages";
 import { END, type GraphNode, START, StateGraph } from "@langchain/langgraph";
 import { z } from "zod";
 
-import { auditorModel } from "./model.ts";
-import { CRITIC_FINDINGS_PROMPT, FIND_VULNERABILITIES_PROMPT, GATHER_CONTEXT_PROMPT } from "./prompts.ts";
-import { AuditorState, CriticSchema, FindingSchema } from "./state.ts";
+import { logger } from "../../logger.ts";
+import { judgeFindingsModel, findVulnerabilitiesModel, gatherContextModel } from "./model.ts";
+import { JUDGE_FINDINGS_PROMPT, FIND_VULNERABILITIES_PROMPT, GATHER_CONTEXT_PROMPT } from "./prompts.ts";
+import { AuditorState, ReviewSchema, PartialFindingSchema } from "./state.ts";
 import { analyzeSolidityFile } from "./tools/solidity-analyzer-tool.ts";
 import {
   DOC_BASENAMES,
@@ -52,15 +53,23 @@ const walkDirectory = (dir: string, depth: number, solFiles: string[], docFiles:
 };
 
 const defineScope: GraphNode<typeof AuditorState> = async (state) => {
+  logger.info(`defineScope: walking repo at ${state.repoPath}`);
+
   const solFiles: string[] = [];
   const docFiles: string[] = [];
 
   walkDirectory(state.repoPath, 0, solFiles, docFiles);
 
+  logger.info(`defineScope: found ${solFiles.length} Solidity file(s), ${docFiles.length} doc file(s)`);
+  logger.debug(`defineScope: Solidity files: ${JSON.stringify(solFiles)}`);
+  logger.debug(`defineScope: doc files: ${JSON.stringify(docFiles)}`);
+
   return { scope: solFiles, docs: docFiles };
 };
 
 const gatherContext: GraphNode<typeof AuditorState> = async (state) => {
+  logger.info(`gatherContext: processing ${state.scope.length} Solidity file(s) and ${state.docs.length} doc file(s)`);
+
   const readFile = (filePath: string): string => {
     try {
       return fs.readFileSync(filePath, "utf-8");
@@ -74,7 +83,7 @@ const gatherContext: GraphNode<typeof AuditorState> = async (state) => {
   for (const filePath of state.scope) {
     const source = readFile(filePath).slice(0, MAX_SOL_CHARS);
     if (!source) continue;
-    const analysis = await analyzeSolidityFile(source, "short");
+    const analysis = await analyzeSolidityFile(source, "full");
     solidityEntries.push({ filePath, source, analysis });
   }
 
@@ -110,66 +119,82 @@ const gatherContext: GraphNode<typeof AuditorState> = async (state) => {
     parts.push(`### ${filePath}\n\`\`\`solidity\n${source}\n\`\`\``);
   }
 
-  const model = auditorModel.withStructuredOutput(z.object({ context: z.string() }));
-  const result = await model.invoke([new SystemMessage(GATHER_CONTEXT_PROMPT), new HumanMessage(parts.join("\n\n"))]);
+  // const model = gatherContextModel.withStructuredOutput(z.object({ context: z.string() }));
+  // const result = await model.invoke([new SystemMessage(GATHER_CONTEXT_PROMPT), new HumanMessage(parts.join("\n\n"))]);
+
+  logger.info(`gatherContext: context built (${parts.join("\n\n").length} chars)`);
+  logger.debug(`gatherContext: full context:\n${parts.join("\n\n")}`);
 
-  return { solidityFile, repoContext: result.context };
+  return { solidityFile, repoContext: parts.join("\n\n") };
 };
 
 const findVulnerabilities: GraphNode<typeof AuditorState> = async (state) => {
-  const model = auditorModel.withStructuredOutput(z.object({ findings: z.array(FindingSchema) }));
+  const model = findVulnerabilitiesModel.withStructuredOutput(z.object({ findings: z.array(PartialFindingSchema) }));
 
   let userMessage = `Contract:\n\n${state.solidityFile}\n\nProtocol Context:\n${state.repoContext}`;
 
-  if (state.criticReviews.length > 0) {
-    const feedback = state.criticReviews
+  if (state.judgeReviews.length > 0) {
+    const feedback = state.judgeReviews
       .map(
-        (r) =>
-          `- "${r.findingTitle}": ${r.isFalsePositive ? "FALSE POSITIVE" : "TRUE POSITIVE"}\n  Critic: ${r.review}`,
+        (r) => `- "${r /*.title*/}": ${r.isFalsePositive ? "FALSE POSITIVE" : "TRUE POSITIVE"}\n  Judge: ${r.review}`,
       )
       .join("\n");
-    userMessage += `\n\nCritic feedback from previous iteration (iteration ${state.reflectionCount}):\n${feedback}\n\nRevise your findings accordingly.`;
+    userMessage += `\n\nJudge feedback from previous iteration (iteration ${state.reflectionCount}):\n${feedback}\n\nRevise your findings accordingly.`;
   }
 
+  logger.info(`findVulnerabilities: invoking LLM (iteration ${state.reflectionCount + 1})`);
+  logger.debug(`findVulnerabilities: user message:\n${userMessage}`);
+
   const result = await model.invoke([new SystemMessage(FIND_VULNERABILITIES_PROMPT), new HumanMessage(userMessage)]);
 
-  return { candidateFindings: result.findings };
+  logger.info(`findVulnerabilities: LLM returned ${result.findings.length} candidate finding(s)`);
+  logger.debug(`findVulnerabilities: findings:\n${JSON.stringify(result.findings, null, 2)}`);
+
+  return { candidateFindings: result.findings.map((finding: any) => ({ ...finding, path: "/", location: "1-14" })) };
 };
 
-const criticFindings: GraphNode<typeof AuditorState> = async (state) => {
+const judgeFindings: GraphNode<typeof AuditorState> = async (state) => {
   if (state.candidateFindings.length === 0) {
+    logger.info("judgeFindings: no candidate findings to review, skipping LLM call");
     return {
-      criticReviews: [],
+      judgeReviews: [],
       findings: [],
       reflectionCount: state.reflectionCount + 1,
     };
   }
 
-  const model = auditorModel.withStructuredOutput(z.object({ reviews: z.array(CriticSchema) }));
+  const model = findVulnerabilitiesModel.withStructuredOutput(z.object({ reviews: z.array(ReviewSchema) }));
 
   const findingsText = state.candidateFindings
     .map(
       (f, i) =>
-        `[Finding ${i + 1}] ${f.title}\nSeverity: ${f.severity} | Auditor confidence: ${f.confidence}/100\nDescription: ${f.description}\nLocation: ${f.path} lines ${f.location}\nCode:\n\`\`\`solidity\n${f.codeSnippet}\n\`\`\`\nExploit paths:\n${f.exploitablePaths.map((p) => `  - ${p}`).join("\n")}`,
+        `[Finding ${i + 1}] ${f.title}\nSeverity: ${f.severity}\nDescription: ${f.description}\nLocation: ${f.path} lines ${f.location}\nCode:\n\`\`\`solidity\n${f.codeSnippet}\n\`\`\``,
     )
     .join("\n\n---\n\n");
 
+  logger.info(`judgeFindings: reviewing ${state.candidateFindings.length} candidate finding(s)`);
+  logger.debug(`judgeFindings: findings text:\n${findingsText}`);
+
   const result = await model.invoke([
-    new SystemMessage(CRITIC_FINDINGS_PROMPT),
+    new SystemMessage(JUDGE_FINDINGS_PROMPT),
     new HumanMessage(
       `Contract:\n\n${state.solidityFile}\n\nProtocol Context:\n${state.repoContext}\n\nCandidate Findings to Review:\n\n${findingsText}`,
     ),
   ]);
 
-  const reviewsByTitle = new Map(result.reviews.map((r) => [r.findingTitle.toLowerCase(), r]));
+  const reviewsByTitle = new Map(result.reviews.map((r: any) => [r.findingTitle.toLowerCase(), r]));
 
   const confirmedFindings = state.candidateFindings.filter((f, i) => {
     const review = reviewsByTitle.get(f.title.toLowerCase()) ?? result.reviews[i];
     return review ? !review.isFalsePositive : true;
   });
 
+  const falsePositiveCount = state.candidateFindings.length - confirmedFindings.length;
+  logger.info(`judgeFindings: ${confirmedFindings.length} confirmed, ${falsePositiveCount} false positive(s)`);
+  logger.debug(`judgeFindings: reviews:\n${JSON.stringify(result.reviews, null, 2)}`);
+
   return {
-    criticReviews: result.reviews,
+    judgeReviews: result.reviews,
     findings: confirmedFindings,
     reflectionCount: state.reflectionCount + 1,
   };
@@ -179,16 +204,24 @@ export const auditorAgent = new StateGraph(AuditorState)
   .addNode("defineScope", defineScope)
   .addNode("gatherContext", gatherContext)
   .addNode("findVulnerabilities", findVulnerabilities)
-  .addNode("criticFindings", criticFindings)
+  .addNode("judgeFindings", judgeFindings)
   .addEdge(START, "defineScope")
   .addEdge("defineScope", "gatherContext")
   .addEdge("gatherContext", "findVulnerabilities")
-  .addEdge("findVulnerabilities", "criticFindings")
-  .addConditionalEdges("criticFindings", (state) => {
-    const hasFalsePositives = state.criticReviews.some((r) => r.isFalsePositive);
+  .addEdge("findVulnerabilities", "judgeFindings")
+  .addConditionalEdges("judgeFindings", (state) => {
+    const hasFalsePositives = state.judgeReviews.some((r) => r.isFalsePositive);
     if (hasFalsePositives && state.reflectionCount < MAX_REFLECTIONS) {
       return "findVulnerabilities";
     }
     return END;
   })
   .compile();
+
+export const testAgent = new StateGraph(AuditorState)
+  .addNode("defineScope", defineScope)
+  .addNode("gatherContext", gatherContext)
+  .addEdge(START, "defineScope")
+  .addEdge("defineScope", "gatherContext")
+  .addEdge("gatherContext", END)
+  .compile();

src/agents/auditor/model.ts

@@ -1,5 +1,13 @@
 import { ChatAnthropic } from "@langchain/anthropic";
 
-export const auditorModel = new ChatAnthropic({
+export const gatherContextModel = new ChatAnthropic({
+  model: "claude-haiku-4-5",
+});
+
+export const findVulnerabilitiesModel = new ChatAnthropic({
+  model: "claude-sonnet-4-6",
+});
+
+export const judgeFindingsModel = new ChatAnthropic({
   model: "claude-sonnet-4-6",
 });

src/agents/auditor/prompts.ts

@@ -1,3 +1,4 @@
+// TODO: Compact the entire full context (parts: docs + static analysis) and infer the sections conciselly
 export const GATHER_CONTEXT_PROMPT = `You are a smart contract security expert. You will receive documentation, a structural analysis, and the full source of all in-scope Solidity contracts. Produce a thorough protocol context that will guide vulnerability discovery.
 
 Structure your output in the following sections:
@@ -30,25 +31,20 @@ For each vulnerability provide ALL of the following fields:
 - **description**: Explain the EXPECTED behavior vs the OBSERVED (vulnerable) behavior in 2–4 sentences.
 - **recommendation**: Specific, actionable remediation (e.g., "Apply checks-effects-interactions pattern", "Add onlyOwner modifier").
 - **severity**: One of "high" (direct fund loss or contract takeover), "medium" (indirect or conditional risk), "low" (best-practice issue, no immediate financial risk).
-- **confidence**: Integer 0–100 reflecting your confidence this is a real, exploitable vulnerability.
 - **codeSnippet**: The exact vulnerable code block as it appears in the source.
-- **location**: Line range as "start-end" (e.g., "42-58"). Use "unknown" if lines are not determinable.
-- **path**: File path of the vulnerable contract. Use the contract name if a single inline source is provided.
-- **exploitablePaths**: Array of one or more concrete exploit traces. Each trace must describe the attacker steps with realistic inputs/values (e.g., "1. Attacker calls deposit(100 ETH) 2. Attacker contract fallback re-enters withdraw() before balance update 3. Attacker drains 100 ETH twice").
 
 Vulnerability categories to systematically check: reentrancy (single- and cross-function), access control, integer overflow/underflow, oracle manipulation, flash loan attacks, front-running/MEV, signature replay, storage collisions, uninitialized proxies, unsafe delegatecall, gas griefing, denial of service, precision loss, and logic/business rule violations.
 
-If critic feedback is provided from a previous iteration, remove confirmed false positives from your list and refine or expand remaining findings based on the critique.`;
+If judge feedback is provided from a previous iteration, remove confirmed false positives from your list and refine or expand remaining findings based on the critique.`;
 
-export const CRITIC_FINDINGS_PROMPT = `You are a rigorous smart contract security reviewer. Evaluate each candidate vulnerability submitted by the auditor and determine whether it is a true positive or a false positive.
+export const JUDGE_FINDINGS_PROMPT = `You are a rigorous smart contract security reviewer. Evaluate each candidate vulnerability submitted by the auditor and determine whether it is a true positive or a false positive.
 
 For each finding provide ALL of the following fields:
 
-- **findingTitle**: Must match exactly the title of the finding you are reviewing.
 - **review**: Detailed analysis (3–6 sentences) explaining why the vulnerability is or isn't real. Reference specific code, protocol invariants, preconditions, and mitigating controls.
 - **isFalsePositive**: true if the finding is NOT exploitable in practice; false if it IS a real vulnerability.
 - **confidence**: Integer 0–100 reflecting your confidence in this verdict.
-- **exploitablePaths**: If a true positive, provide concrete paths confirming exploitability with real values. If a false positive, provide the reasoning that blocks the exploit.
+- **exploitablePaths**: If a true positive, provide concrete paths confirming exploitability with real values. Each trace must describe the attacker steps with realistic inputs/values (e.g., "1. Attacker calls deposit(100 ETH) 2. Attacker contract fallback re-enters withdraw() before balance update 3. Attacker drains 100 ETH twice"). If a false positive, provide the reasoning that blocks the exploit.
 
 A finding is a false positive if and only if: the exploit path is unreachable given access controls or preconditions, it is already fully mitigated by the code, it requires impossible or economically infeasible conditions, or it is explicitly documented as by-design behavior in the protocol assumptions.
 

src/agents/auditor/state.ts

@@ -1,20 +1,25 @@
 import { StateSchema } from "@langchain/langgraph";
 import { z } from "zod";
 
+export const PartialFindingSchema = z.object({
+  title: z.string(),
+  description: z.string(),
+  recommendation: z.string(),
+  severity: z.enum(["high", "medium", "low"]),
+  codeSnippet: z.string(),
+});
+
 export const FindingSchema = z.object({
   title: z.string(),
   description: z.string(),
   recommendation: z.string(),
   severity: z.enum(["high", "medium", "low"]),
-  confidence: z.number(),
   codeSnippet: z.string(),
   location: z.string(),
   path: z.string(),
-  exploitablePaths: z.array(z.string()),
 });
 
-export const CriticSchema = z.object({
-  findingTitle: z.string(),
+export const ReviewSchema = z.object({
   review: z.string(),
   isFalsePositive: z.boolean(),
   confidence: z.number(),
@@ -28,7 +33,7 @@ export const AuditorState = new StateSchema({
   docs: z.array(z.string()).default([]),
   repoContext: z.string().default(""),
   candidateFindings: z.array(FindingSchema).default([]),
-  criticReviews: z.array(CriticSchema).default([]),
+  judgeReviews: z.array(ReviewSchema).default([]),
   findings: z.array(FindingSchema).default([]),
   reflectionCount: z.number().default(0),
 });

src/logger.ts

@@ -0,0 +1,29 @@
+import fs from "node:fs";
+import path from "node:path";
+
+import winston from "winston";
+
+const logsDir = path.join(process.cwd(), "logs");
+fs.mkdirSync(logsDir, { recursive: true });
+
+const runTimestamp = new Date().toISOString().replace(/[:.]/g, "-");
+
+const { combine, colorize, errors, printf, timestamp } = winston.format;
+
+const lineFormat = printf(({ level, message, timestamp: ts, stack }) => {
+  const base = `${ts} [${level}] ${message}`;
+  return stack ? `${base}\n${stack}` : base;
+});
+
+export const logger = winston.createLogger({
+  level: "debug",
+  transports: [
+    new winston.transports.Console({
+      format: combine(colorize({ all: true }), timestamp({ format: "HH:mm:ss" }), errors({ stack: true }), lineFormat),
+    }),
+    new winston.transports.File({
+      filename: path.join(logsDir, `app-${runTimestamp}.log`),
+      format: combine(timestamp(), errors({ stack: true }), lineFormat),
+    }),
+  ],
+});