feat: Implementar `scaffoldGenerator` and Implementar `oracleNode`

src/agents/tester/agent.ts

@@ -1,9 +1,16 @@
 import { StateGraph, END, START } from "@langchain/langgraph";
 import { PoCStateAnnotation, PoCState } from "./state.js";
+import { generateLocalScaffold } from "./tools/scaffoldGenerator.js";
+import { OracleContext } from "./types.js";
 
 async function oracleNode(state: PoCState): Promise<Partial<PoCState>> {
-  console.log("[oracleNode] stub — report recebido:", state.report.id);
-  return {};
+  console.log("[oracleNode] gerando scaffold para:", state.report.title);
+
+  const solidityScaffold = generateLocalScaffold(state.report);
+  const oracleContext: OracleContext = { solidityScaffold };
+
+  console.log("[oracleNode] scaffold gerado, tamanho:", solidityScaffold.length, "chars");
+  return { oracleContext };
 }
 
 async function generatePoCNode(state: PoCState): Promise<Partial<PoCState>> {

src/agents/tester/tools/scaffoldGenerator.ts

@@ -0,0 +1,42 @@
+import { VulnerabilityReport } from "../types.js";
+
+export function generateLocalScaffold(report: VulnerabilityReport): string {
+  const cheatcodes = report.suggestedCheatcodes?.join(", ") ?? "vm.deal, vm.prank, vm.warp";
+
+  return `// SPDX-License-Identifier: UNLICENSED
+pragma solidity ^0.8.20;
+
+import "forge-std/Test.sol";
+import "forge-std/console.sol";
+
+// ── Código-fonte do contrato vulnerável ──────────────────────────────────────
+${report.affectedContract.sourceCode}
+// ─────────────────────────────────────────────────────────────────────────────
+
+contract ExploitTest is Test {
+    ${report.affectedContract.name} target;
+    address constant ATTACKER = address(0xBEEF);
+
+    // setUp() gerado automaticamente pelo Oracle — NÃO MODIFICAR
+    function setUp() public {
+        target = new ${report.affectedContract.name}();
+        vm.deal(address(target), 100 ether);
+        vm.deal(ATTACKER, 10 ether);
+        vm.label(address(target), "TARGET");
+        vm.label(ATTACKER, "ATTACKER");
+    }
+
+    // Vulnerabilidade: ${report.title}
+    // Tipo: ${report.type}
+    // Vetor: ${report.attackVector}
+    ${report.exploitablePaths ? `// Caminhos de Exploração:\n    // - ${report.exploitablePaths.join("\n    // - ")}` : ""}
+    // Cheatcodes sugeridos: ${cheatcodes}
+    //
+    // COMPLETE APENAS ESTA FUNÇÃO — não altere setUp() nem os campos acima
+    function test_Exploit() public {
+        vm.startPrank(ATTACKER);
+        // TODO: implementar exploit aqui
+        vm.stopPrank();
+    }
+}`.trim();
+}

src/agents/tester/types.ts

@@ -1,3 +1,18 @@
+export interface Finding {
+  title: string;
+  description: string;
+  recommendation: string;
+  severity: "high" | "medium" | "low";
+  codeSnippet: string;
+  location: string;
+  path: string;
+  judgeReview: {
+    review: string;
+    confidence: number;
+    exploitablePaths: string[];
+  };
+}
+
 export interface VulnerabilityReport {
   id: string;
   severity: "critical" | "high" | "medium" | "low";
@@ -10,6 +25,9 @@ export interface VulnerabilityReport {
   };
   attackVector: string;
   suggestedCheatcodes?: string[];
+  codeSnippet?: string;
+  location?: string;
+  exploitablePaths?: string[];
 }
 
 export interface OracleContext {

src/index.ts

@@ -1,9 +1,9 @@
 import "dotenv/config";
 
-import { auditorAgent } from "./agents/auditor/agent.ts";
-import { coderAgent } from "./agents/coder/agent.ts";
-import { testerAgent } from "./agents/tester/agent.ts";
-import type { VulnerabilityReport } from "./agents/tester/types.ts";
+import { auditorAgent } from "./agents/auditor/agent.js";
+import { coderAgent } from "./agents/coder/agent.js";
+import { testerAgent } from "./agents/tester/agent.js";
+import type { VulnerabilityReport, Finding } from "./agents/tester/types.js";
 
 const requirements = ["ERC20 token", "pausable", "ownable"];
 
@@ -15,24 +15,38 @@ const auditorResult = await auditorAgent.invoke({ solidityFile: coderResult.cont
 console.log("\n======= Auditor =======");
 // console.log(auditorResult.vulnerabilities);
 
-// Mapeamento temporário para satisfazer o novo estado do testerAgent
-const mockReport: VulnerabilityReport = {
-  id: "test-001",
-  severity: "high",
-  type: "reentrancy",
-  title: "Vulnerabilidade Detectada",
-  description: "Descrição da vulnerabilidade",
-  affectedContract: {
-    name: "Contract",
-    sourceCode: coderResult.contract,
-  },
-  attackVector: "Vetor de ataque",
-};
-
-const testerResult = await testerAgent.invoke({
-  report: mockReport,
-});
-
-console.log("\n======= Tester =======");
-console.log("Status:", testerResult.status);
-console.log("Iterations:", testerResult.iterations);
+function mapFindingToReport(finding: Finding, sourceCode: string): VulnerabilityReport {
+  // Extract contract name from path (e.g., "contracts/CafeToken.sol" -> "CafeToken")
+  const nameMatch = finding.path.match(/([^\/]+)\.sol$/);
+  const contractName = nameMatch ? nameMatch[1] : "TargetContract";
+
+  return {
+    id: finding.title.toLowerCase().replace(/[^a-z0-9]+/g, "-").slice(0, 50),
+    severity: finding.severity === "high" ? "high" : finding.severity === "medium" ? "medium" : "low",
+    type: "custom",
+    title: finding.title,
+    description: finding.description,
+    affectedContract: {
+      name: contractName,
+      sourceCode: sourceCode,
+    },
+    attackVector: finding.judgeReview.exploitablePaths[0] || "Unknown vector",
+    exploitablePaths: finding.judgeReview.exploitablePaths,
+    codeSnippet: finding.codeSnippet,
+    location: finding.location
+  };
+}
+
+if (auditorResult.vulnerabilities.length > 0) {
+  const finding = auditorResult.vulnerabilities[0] as Finding;
+  const report = mapFindingToReport(finding, coderResult.contract);
+
+  const testerResult = await testerAgent.invoke({ report });
+
+  console.log("\n======= Tester =======");
+  console.log("Status:", testerResult.status);
+  console.log("Iterations:", testerResult.iterations);
+} else {
+  console.log("\n======= Tester =======");
+  console.log("Nenhuma vulnerabilidade encontrada pelo Auditor.");
+}

tests/scaffold.test.ts

@@ -0,0 +1,35 @@
+import { generateLocalScaffold } from "../src/agents/tester/tools/scaffoldGenerator.js";
+
+const mockReport = {
+  id: "t1", 
+  severity: "high" as const, 
+  type: "reentrancy", 
+  title: "Reentrancy in withdraw()",
+  description: "withdraw() sends ETH before zeroing balance",
+  attackVector: "Malicious callback",
+  affectedContract: { 
+    name: "VulnerableBank", 
+    sourceCode: `
+pragma solidity ^0.8.20;
+contract VulnerableBank {
+  mapping(address=>uint) public balances;
+  function withdraw() external {
+    uint a = balances[msg.sender];
+    (bool ok,) = msg.sender.call{value:a}("");
+    require(ok); balances[msg.sender] = 0;
+  }
+}`
+  }
+};
+
+const scaffold = generateLocalScaffold(mockReport);
+console.log("--- Scaffold Output ---");
+console.log(scaffold);
+console.log("--- End Scaffold ---");
+
+console.assert(scaffold.includes("contract ExploitTest is Test"), "Scaffold missing ExploitTest");
+console.assert(scaffold.includes("VulnerableBank target"), "Scaffold missing target declaration");
+console.assert(scaffold.includes("function setUp()"), "Scaffold missing setUp");
+console.assert(scaffold.includes("function test_Exploit()"), "Scaffold missing test_Exploit");
+
+console.log("Scaffold generator test passed");