Finish llm module unification: canonical paths, no compat shims

Author: Mte90

CHANGELOG.md

@@ -13,22 +13,52 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Changed
 - Threat-modeling phase disabled by default (`enable_threat_modeling = false`) — it generated a static STRIDE template rather than code-derived analysis
 
----
+## [1.1.0] - 2026-09-15
 
-## [1.1.0] - 2026-08-12
+First public release.
 
 ### Added
-- 24-phase scanner pipeline with Validate phase
-- P1-P5 paper integration tracks (VulTriage, VulnLLM-R, MoCQ, PacVD, AgentFlow) behind `enabled = false` defaults
+- `baco doctor` pre-flight checks: config parse, per-phase LLM slot validation (warns on phases without `api_key` that will be skipped), semgrep/python3 presence, output dir writability, disk space
+- `baco eval` detection-regression suite: 10 labeled targets with ground-truth oracles, precision/recall/F1, CI gate on pass-rate (`BACO_EVAL_FLOOR`, default 0.70)
+- `baco init [PATH]` config scaffolding with language detection and preset suggestions
+- Scan-health report (console + JSON section): per-phase run/skipped-with-reason, file counters (indexed/analyzed/dropped/chunked), LLM call outcomes by error class, token and cost totals per phase, blind-scan warning when all LLM phases are skipped
+- Pipeline profiles: `[scanner] profile = "core"` (default, 23 phases) or `"all"` (experimental phases included)
+- Presets: `django`, `laravel`, `cpp`; inline `custom_rules` Semgrep YAML in presets (self-contained detection packages)
+- Per-language default Semgrep rulesets derived from `project.languages`
+- Environment-variable bridges for all six LLM phase slots (`LLM_DISCOVERY_KEY`, `LLM_VERIFICATION_KEY`, `LLM_AGGREGATION_KEY`, `LLM_STATIC_ANALYSIS_KEY`, `LLM_SECURITY_AGENT_VERIFICATION_KEY`, `LLM_THREAT_MODELING_KEY`)
+- LLM cost transparency: optional `[llm.pricing]` table, token counts per phase and model surfaced in the health report
+- Configurable never-submit confidence filter (`never_submit_enabled`, `never_submit_multiplier`)
 - `max_reasoning_tokens` field for LLM config
 - Agent scaffold modules: `call_graph_paths`, `fn_lookup`
-- `docs/README.md` documentation index
+- Chunked analysis of oversized files via tree-sitter (previously dropped or truncated at 8 KB)
+- Config-driven per-language hook registry (`[knowledge.hook_registry.<language>]`) and `required_security_primitives` verification prompts
 
 ### Changed
-- Internal refactoring: split oversized modules into directory modules, extracted shared tree-sitter parser, consolidated tests under `tests/`
-- MSRV-compatible clippy fixes (replaced `is_none_or`, `is_multiple_of`)
+- Pipeline defined once in a declarative PhaseSpec table (checkpoint transitions, profile filtering, progress messages and docs all derive from it)
+- Semgrep severity read from `extra.severity` first (ERROR/WARNING/INFO mapping); `check_id` keywords can only raise, never lower
+- HTML report rendered via embedded minijinja templates
+- LLM internals consolidated under `src/llm/` (client, cache, metrics, traits) with canonical import paths
+- `max_file_size_kb` defaults to 512; early-termination threshold counts medium+ findings only
+- Verification batch parser accepts responses without `index` (positional fallback with warning)
+- Multi-model round-robin preserved per phase (`models` list no longer collapsed)
+- Internal refactoring: modules split into directory modules, shared tree-sitter parser, tests consolidated under `tests/`
 
 ### Fixed
+- LLM endpoint URL doubling (`/v1/v1/`) causing silent 404s
+- Discovery phase dropping findings that already had LLM evidence
+- API key printed in log output during static analysis
+- HTML report broken by unclosed `<style>`/`<div>` tags
+- Semgrep multi-hit findings attributed to placeholder `multiple_files` path
+- Custom-rule IDs prefixed with the materialized temp-file stem
+- Discovery enrichment silently overwriting detector severity (enrichment is raise-only)
+- LLM findings without a `line` field silently dropped (now salvaged with a warning)
+- JSON schema fields serialized as `type_` instead of `type`
 - C function-name extraction handles `function_declarator` tree-sitter node
 - Call-graph builder treats uncalled functions as entry points
-- Phase count references updated from 20 to 24 throughout
+
+### Removed
+- MultiVerifier stub phase (fabricated hash-based verdicts)
+- Dead modules: report aggregation, scan diff, worktree staging, severity rubric, phase scaffolding (~2,500 lines)
+- Phantom `[llm.phases.*]` config slots and unused configuration keys
+
+

README.md

@@ -60,6 +60,15 @@ cp config.toml my-config.toml
 # Verify findings
 ./target/release/baco verify --input findings.json
 
+# Scaffold a starter config (detects languages, suggests a preset)
+./target/release/baco init /path/to/project
+
+# List built-in presets
+./target/release/baco preset list
+
+# Resume an interrupted scan from its checkpoint
+./target/release/baco resume --checkpoint baco-output/checkpoint.json
+
 # Scan options
 ./target/release/baco scan --config my.toml --dry-run   # Print estimate and exit
 ./target/release/baco scan --config my.toml --target /path  # Override target path

config.example.toml

@@ -329,3 +329,8 @@ max_runs = 5
 # secret_storage = "vault"  # "vault" → ${VAULT_TOKEN} refs are placeholders, NOT leaks
 # risk_tolerance = "low"  # does NOT mean only report criticals — prioritize ruthlessly, report everything real
 # severity_rules = { "XSS" = "Critical", "SQLi" = "Critical" }  # OVERRIDE lines for specific rules
+
+[eval]
+# Minimum aggregate pass-rate for `baco eval` (0.0-1.0).
+# The BACO_EVAL_FLOOR environment variable overrides this value.
+floor = 0.70

docs/configuration.md

@@ -775,4 +775,92 @@ baco scan --config my.toml --preset my-project
 | `agent`      | `enabled`, `max_turns`, `tool_timeout_secs`               |
 | `knowledge`  | `fp_patterns` (map of CWE → list of false-positive indicator strings), `required_security_primitives` (map of language → list of required primitives), `hook_registry` (map of language → HookRegistryLanguageConfig with `hook_label`, `registrations` regexes with optional `(?P<hook>)` capture, `handler_patterns` override) |
 
-Unset fields keep the base `ScannerConfig` default; CLI flags still override the preset.
+Unset fields keep the base `ScannerConfig` default; CLI flags still override the preset.
+
+## Eval suite
+
+The `[eval]` section configures the detection-regression suite run by `baco eval`.
+
+| Key    | Type  | Default | Description                                                                                     |
+| ------ | ----- | ------- | ----------------------------------------------------------------------------------------------- |
+| `floor` | f32  | `0.70`  | Minimum aggregate pass-rate (0.0-1.0). The suite fails when the aggregate does not strictly exceed it. `BACO_EVAL_FLOOR` overrides it per invocation. |
+
+```toml
+[eval]
+floor = 0.9
+```
+
+
+## Agent scaffold
+
+The `[agent_scaffold]` section configures the call-graph-guided agent scaffold used during security-agent verification.
+
+| Key                 | Type | Default | Description                                          |
+| ------------------- | ---- | ------- | ---------------------------------------------------- |
+| `enabled`           | bool | `false` | Enables the agent scaffold modules                   |
+| `max_rounds`        | u8   | built-in | Maximum interaction rounds per target function      |
+| `paths_per_target`  | u8   | built-in | Number of call-graph paths to sample per target     |
+
+```toml
+[agent_scaffold]
+enabled = false
+```
+
+## Citation verification
+
+The `[citation_verification]` section controls verification that finding citations (file + line) actually resolve in the target source, downgrading unverifiable findings.
+
+| Key       | Type | Default | Description                                          |
+| --------- | ---- | ------- | ---------------------------------------------------- |
+| `enabled` | bool | `false` | Verify finding citations against source files        |
+
+```toml
+[citation_verification]
+enabled = false
+```
+
+## Prior runs
+
+The `[prior_runs]` section configures the cross-run findings history used for skip directives and coverage-gap targeting on subsequent scans.
+
+| Key       | Type  | Default | Description                                              |
+| --------- | ----- | ------- | -------------------------------------------------------- |
+| `enabled` | bool  | `false` | Enable the prior-runs store                              |
+| `max_runs`| usize | built-in | Maximum number of prior runs retained                    |
+
+```toml
+[prior_runs]
+enabled = false
+```
+
+## Policy sampling
+
+The `[policy_sampling]` section configures policy-based sampling rounds (VulnLLM-R style generation).
+
+| Key       | Type | Default | Description                                       |
+| --------- | ---- | ------- | ------------------------------------------------- |
+| `enabled` | bool | `false` | Enable policy-based generation                    |
+| `samples` | u8   | `4`     | Number of sampling rounds used to build the policy |
+
+```toml
+[policy_sampling]
+enabled = false
+```
+
+## Tickets
+
+The `[tickets]` section configures cross-referencing findings against external ticket systems.
+
+Each entry in `systems` describes one ticket backend:
+
+| Key           | Type            | Description                                        |
+| ------------- | --------------- | -------------------------------------------------- |
+| `system_type` | string          | `"github"` or `"gitlab"`                           |
+| `url`         | string          | Base URL of the system                             |
+| `api_key`     | string (option) | API token; `TICKET_GITHUB_KEY` / `TICKET_GITLAB_KEY` environment variables override it |
+
+```toml
+[[tickets.systems]]
+system_type = "github"
+url = "https://github.com/org/repo"
+```

eval/README.md

@@ -43,14 +43,20 @@ findings fixture (`eval/findings/<target>.json`) against its oracle, prints a
 per-target pass-rate table plus the aggregate, and exits non-zero when the
 aggregate does not exceed the floor.
 
-**`BACO_EVAL_FLOOR` is the single knob.** It is a fraction in `0.0..=1.0`
-(default `0.70`), read from the environment. The suite passes only when the
-aggregate pass-rate (total matched / total expected across all targets) is
-*strictly greater* than the floor; an unset or empty value falls back to the
-default. **The default of 0.70 is provisional pending maintainer sign-off.**
+**`[eval] floor` in the config is the knob.** Set a fraction in `0.0..=1.0`
+(default `0.70`) in your `baco.toml`; the suite passes only when the aggregate
+pass-rate (total matched / total expected across all targets) is *strictly
+greater* than the floor. The `BACO_EVAL_FLOOR` environment variable overrides
+the config value (unset or empty falls back to config).
+
+```toml
+[eval]
+# Fail unless the suite exceeds a stricter floor
+floor = 0.9
+```
 
 ```bash
-# Fail unless the suite exceeds a stricter floor
+# Or override per invocation via the environment
 BACO_EVAL_FLOOR=0.9 baco eval
 ```
 

presets/django.toml

@@ -182,7 +182,7 @@ max_llm_calls = 250
 ]
 
 [knowledge.hook_registry.python]
-hook_label = ""
+hook_label = "urlpatterns"
 registrations = [
   '''(?si)\bpath\s*\(\s*[\x27\x22](?P<hook>[^\x27\x22]*)[\x27\x22]\s*,\s*''',
   '''(?si)\bre_path\s*\(\s*[\x27\x22](?P<hook>[^\x27\x22]*)[\x27\x22]\s*,\s*''',

presets/laravel.toml

@@ -198,7 +198,7 @@ sink_patterns = [
 ]
 
 [knowledge.hook_registry.php]
-hook_label = ""
+hook_label = "rest_route"
 registrations = [
   '''(?si)\bRoute::\s*(?:get|post|put|patch|delete|options|any)\s*\(\s*[\x27\x22](?P<hook>[^\x27\x22]*)[\x27\x22]\s*,\s*''',
 ]

src/agent/session.rs

@@ -121,6 +121,7 @@ impl AgentSession {
         loop {
             turn += 1;
             if turn > self.max_turns {
+                turn -= 1;
                 tracing::warn!("Max turns ({}) reached", self.max_turns);
                 break;
             }
@@ -370,6 +371,7 @@ impl AgentSession {
         loop {
             turn += 1;
             if turn > self.max_turns {
+                turn -= 1;
                 tracing::warn!("Max turns ({}) during verification", self.max_turns);
                 break;
             }

src/citation_verification.rs

@@ -47,6 +47,18 @@ pub fn verify_citations(
 
         let file_path = project_path.join(&finding.file_path);
 
+        // Reject absolute paths and path traversal attempts
+        if finding.file_path.starts_with('/') || finding.file_path.contains("..") {
+            finding.confidence_score *= 0.5;
+            let note = format!(
+                "citation verification failed: path traversal rejected: {}",
+                finding.file_path
+            );
+            append_verification_note(&mut finding.verification_notes, &note);
+            report.failed += 1;
+            continue;
+        }
+
         // Check if file exists and is readable
         let file_content = match fs::read_to_string(&file_path) {
             Ok(content) => content,
@@ -64,6 +76,18 @@ pub fn verify_citations(
 
         // Check line number if present
         if let Some(line_num) = finding.line_number {
+            // Line 0 is invalid (lines are 1-indexed)
+            if line_num == 0 {
+                finding.confidence_score *= 0.5;
+                let note = format!(
+                    "citation verification failed: line 0 is invalid (1-indexed): {}",
+                    finding.file_path
+                );
+                append_verification_note(&mut finding.verification_notes, &note);
+                report.failed += 1;
+                continue;
+            }
+
             let line_count = file_content.lines().count();
 
             if line_num as usize > line_count {

src/config/mod.rs

@@ -21,6 +21,26 @@ use std::fmt;
 use std::fs;
 use std::path::PathBuf;
 
+/// Eval-suite settings (`[eval]` section).
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct EvalConfig {
+    /// Minimum aggregate pass-rate for `baco eval` (0.0..=1.0).
+    #[serde(default = "default_eval_floor")]
+    pub floor: f32,
+}
+
+fn default_eval_floor() -> f32 {
+    0.70
+}
+
+impl Default for EvalConfig {
+    fn default() -> Self {
+        Self {
+            floor: default_eval_floor(),
+        }
+    }
+}
+
 #[derive(Debug, Clone, Serialize, Deserialize, Default)]
 pub struct ScannerConfig {
     #[serde(default)]
@@ -64,6 +84,8 @@ pub struct ScannerConfig {
     #[serde(default)]
     pub pacvd: PacvdConfig,
     #[serde(default)]
+    pub eval: EvalConfig,
+    #[serde(default)]
     pub agent_flow: AgentFlowConfig,
     #[serde(default)]
     pub vuln_spec: VulnSpecConfig,