Function _format_vulns_guidance

plugins/security-guidance/hooks/llm.py:600–631

Render a vuln list into the user-facing guidance block. Shared by analyze_code_security, agentic_review, and the late-dedup paths in the Stop / commit-review handlers so that filtering vulns AFTER the LLM returns can rebuild an accurate message instead of emitting stale guidance tha

(vulns: List[Dict[str, Any]])

def _format_vulns_guidance(vulns: List[Dict[str, Any]]) -> Optional[str]:
    """Render a vuln list into the user-facing guidance block.

    Shared by analyze_code_security, agentic_review, and the late-dedup paths
    in the Stop / commit-review handlers so that filtering vulns AFTER the LLM
    returns can rebuild an accurate message instead of emitting stale guidance
    that still lists dropped findings.
    """
    if not vulns:
        return None
    severity_order = {"critical": 0, "high": 1, "medium": 2}
    vulns = sorted(vulns, key=lambda v: severity_order.get(v.get("severity", "medium"), 2))
    by_file: Dict[str, list] = {}
    for v in vulns:
        by_file.setdefault(v.get("filePath", "unknown"), []).append(v)
    lines = [
        "Security Review: Potential vulnerabilities detected",
        "",
        f"Affected files: {', '.join(by_file)}",
        "The following issues were flagged by automated security review. Address each, or briefly note why it doesn't apply. Valid reasons to proceed without changes: the user explicitly asked for this and you've already surfaced the security tradeoffs, or the pattern isn't actually exploitable in this context. Do not dismiss findings solely because the service is internal-only — internal services are common SSRF/IDOR targets:",
        "",
    ]
    n = 1
    for fp, vs in by_file.items():
        lines.append(f"  {fp}:")
        for v in vs:
            sev = (v.get("severity") or "medium").upper()
            lines.append(f"    {n}. [{sev}] [{v.get('category', 'Unknown')}] {v.get('vulnerableCode', 'N/A')}")
            lines.append(f"       Suggested fix: {v.get('fix', 'N/A')}")
            lines.append("")
            n += 1
    return "\n".join(lines)


# CC truncates the rewakeSummary override at 300 chars. Cap a little under so