Skip to content

Conversation

abhisek
Copy link
Member

@abhisek abhisek commented Jul 8, 2025

This PR introduces two features:

  1. sqlite3 report generation for vet
  2. Agentic query system

It also lays the foundation for building AI agents in vet.

To test, consider the doc:

https://github.com/safedep/vet/blob/feat/vet-query-interaction-agent/docs/agent.md

Copy link

github-actions bot commented Jul 8, 2025

vet Summary Report

This report is generated by vet

Policy Checks

  • ❌ Vulnerability
  • ✅ Malware
  • ✅ License
  • ❌ Popularity
  • ❌ Maintenance
  • ✅ Security Posture
  • ✅ Threats

Malicious Package Analysis

Malicious package analysis was performed using SafeDep Cloud API

Malicious Package Analysis Report
Ecosystem Package Version Status Report
ECOSYSTEM_GO github.com/aws/aws-sdk-go-v2/credentials 1.17.59 🔗
ECOSYSTEM_GO github.com/googleapis/enterprise-certificate-proxy 0.3.6 🔗
ECOSYSTEM_GO github.com/muesli/ansi 0.0.0-20230316100256-276c6243b2f6 🔗
ECOSYSTEM_GO golang.org/x/net 0.41.0 🔗
ECOSYSTEM_GO golang.org/x/sync 0.15.0 🔗
ECOSYSTEM_GO github.com/anthropics/anthropic-sdk-go 1.4.0 🔗
ECOSYSTEM_GO github.com/aws/aws-sdk-go-v2 1.36.1 🔗
ECOSYSTEM_GO github.com/tidwall/sjson 1.2.5 🔗
ECOSYSTEM_GO github.com/go-openapi/swag 0.19.5 🔗
ECOSYSTEM_GO github.com/go-openapi/jsonpointer 0.19.5 🔗
ECOSYSTEM_GO github.com/getkin/kin-openapi 0.118.0 🔗
ECOSYSTEM_GO github.com/charmbracelet/x/ansi 0.9.3 🔗
ECOSYSTEM_GO github.com/cloudwego/eino-ext/components/model/claude 0.1.1 🔗
ECOSYSTEM_GO github.com/aws/aws-sdk-go-v2/service/sts 1.33.14 🔗
ECOSYSTEM_GO github.com/charmbracelet/lipgloss 1.1.0 🔗
ECOSYSTEM_GO github.com/mattn/go-localereader 0.0.2-0.20220822084749-2491eb6c1c75 🔗
ECOSYSTEM_GO github.com/cloudwego/eino 0.3.47 🔗
ECOSYSTEM_GO github.com/lucasb-eyer/go-colorful 1.2.0 🔗
ECOSYSTEM_GO github.com/atotto/clipboard 0.1.4 🔗
ECOSYSTEM_GO github.com/muesli/termenv 0.16.0 🔗
ECOSYSTEM_GO github.com/meguminnnnnnnnn/go-openai 0.0.0-20250620092828-0d508a1dcdde 🔗
ECOSYSTEM_GO github.com/googleapis/gax-go/v2 2.14.2 🔗
ECOSYSTEM_GO github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding 1.12.2 🔗
ECOSYSTEM_GO github.com/slongfield/pyfmt 0.0.0-20220222012616-ea85ff4c361f 🔗
ECOSYSTEM_GO cloud.google.com/go/compute/metadata 0.7.0 🔗
ECOSYSTEM_GO github.com/google/s2a-go 0.1.9 🔗
ECOSYSTEM_GO github.com/evanphx/json-patch 0.5.2 🔗
ECOSYSTEM_GO github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 2.6.32 🔗
ECOSYSTEM_GO github.com/yuin/goldmark 1.7.4 🔗
ECOSYSTEM_GO cloud.google.com/go 0.121.2 🔗
ECOSYSTEM_GO github.com/dustin/go-humanize 1.0.1 🔗
ECOSYSTEM_GO github.com/mohae/deepcopy 0.0.0-20170929034955-c48cc78d4826 🔗
ECOSYSTEM_GO github.com/erikgeiser/coninput 0.0.0-20211004153227-1c3628e74d0f 🔗
ECOSYSTEM_GO github.com/aws/aws-sdk-go-v2/service/ssooidc 1.28.14 🔗
ECOSYSTEM_GO github.com/cloudwego/eino-ext/components/model/gemini 0.1.1 🔗
ECOSYSTEM_GO github.com/muesli/reflow 0.3.0 🔗
ECOSYSTEM_GO github.com/charmbracelet/glamour 0.8.0 🔗
ECOSYSTEM_GO google.golang.org/genai 1.14.0 🔗
ECOSYSTEM_GO github.com/aws/aws-sdk-go-v2/service/internal/presigned-url 1.12.13 🔗
ECOSYSTEM_GO golang.org/x/mod 0.25.0 🔗
ECOSYSTEM_GO github.com/charmbracelet/x/term 0.2.1 🔗
ECOSYSTEM_GO github.com/aws/aws-sdk-go-v2/internal/configsources 1.3.32 🔗
ECOSYSTEM_GO golang.org/x/crypto 0.39.0 🔗
ECOSYSTEM_GO github.com/charmbracelet/x/cellbuf 0.0.13 🔗
ECOSYSTEM_GO github.com/yargevad/filepathx 1.0.0 🔗
ECOSYSTEM_GO github.com/aws/aws-sdk-go-v2/service/sso 1.24.15 🔗
ECOSYSTEM_GO github.com/nikolalohinski/gonja 1.5.3 🔗
ECOSYSTEM_GO cloud.google.com/go/auth 0.16.1 🔗
ECOSYSTEM_GO github.com/cloudwego/eino-ext/components/model/openai 0.0.0-20250707040601-2fab92740585 🔗
ECOSYSTEM_GO github.com/perimeterx/marshmallow 1.1.4 🔗
ECOSYSTEM_GO github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream 1.6.3 🔗
ECOSYSTEM_GO github.com/charmbracelet/colorprofile 0.3.1 🔗
ECOSYSTEM_GO github.com/aws/aws-sdk-go-v2/feature/ec2/imds 1.16.28 🔗
ECOSYSTEM_GO github.com/aws/aws-sdk-go-v2/config 1.29.6 🔗
ECOSYSTEM_GO github.com/cloudwego/eino-ext/components/tool/mcp 0.0.3 🔗
ECOSYSTEM_GO github.com/muesli/cancelreader 0.2.2 🔗
ECOSYSTEM_GO github.com/yuin/goldmark-emoji 1.0.3 🔗
ECOSYSTEM_GO github.com/aws/smithy-go 1.22.2 🔗
ECOSYSTEM_GO github.com/gorilla/websocket 1.5.3 🔗
ECOSYSTEM_GO github.com/goph/emperror 0.17.2 🔗
ECOSYSTEM_GO github.com/charmbracelet/bubbles 0.21.0 🔗
ECOSYSTEM_GO github.com/charmbracelet/bubbletea 1.3.5 🔗
ECOSYSTEM_GO github.com/aymanbagabas/go-osc52/v2 2.0.1 🔗
ECOSYSTEM_GO github.com/cloudwego/eino-ext/libs/acl/openai 0.0.0-20250626133421-3c142631c961 🔗
ECOSYSTEM_GO github.com/alecthomas/chroma/v2 2.14.0 🔗
ECOSYSTEM_GO github.com/aws/aws-sdk-go-v2/internal/ini 1.8.2 🔗
ECOSYSTEM_GO github.com/invopop/yaml 0.1.0 🔗
  • ℹ️ 67 packages have been actively analyzed for malicious behaviour.
  • ✅ No malicious packages found.

Note: Some of the package analysis jobs may still be running.Please check back later. Consider increasing the timeout for better coverage.

Changed Packages

Changed Packages

  • ✅ [Go] github.com/cloudwego/eino-ext/components/model/openai@0.0.0-20250707040601-2fab92740585
  • ✅ [Go] github.com/cloudwego/eino@0.3.47
  • ⚠️ [Go] github.com/muesli/termenv@0.16.0
  • ✅ [Go] github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@1.6.3
  • ⚠️ [Go] github.com/googleapis/enterprise-certificate-proxy@0.3.6
  • ⚠️ [Go] github.com/getkin/kin-openapi@0.118.0
  • ⚠️ [Go] github.com/muesli/reflow@0.3.0
  • ✅ [Go] golang.org/x/net@0.41.0
  • ✅ [Go] github.com/aws/aws-sdk-go-v2/service/sso@1.24.15
  • ✅ [Go] golang.org/x/crypto@0.39.0
  • ✅ [Go] github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding@1.12.2
  • ✅ [Go] github.com/aws/aws-sdk-go-v2/service/ssooidc@1.28.14
  • ✅ [Go] cloud.google.com/go/auth@0.16.1
  • ✅ [Go] github.com/aws/aws-sdk-go-v2/feature/ec2/imds@1.16.28
  • ✅ [Go] cloud.google.com/go/compute/metadata@0.7.0
  • ✅ [Go] github.com/charmbracelet/x/term@0.2.1
  • ⚠️ [Go] github.com/go-openapi/jsonpointer@0.19.5
  • ✅ [Go] github.com/aws/aws-sdk-go-v2/internal/ini@1.8.2
  • ✅ [Go] github.com/google/s2a-go@0.1.9
  • ✅ [Go] github.com/aws/aws-sdk-go-v2/internal/configsources@1.3.32
  • ⚠️ [Go] github.com/meguminnnnnnnnn/go-openai@0.0.0-20250620092828-0d508a1dcdde
  • ✅ [Go] github.com/charmbracelet/colorprofile@0.3.1
  • ✅ [Go] github.com/aws/aws-sdk-go-v2@1.36.1
  • ✅ [Go] github.com/googleapis/gax-go/v2@2.14.2
  • ⚠️ [Go] github.com/evanphx/json-patch@0.5.2
  • ✅ [Go] golang.org/x/mod@0.25.0
  • ✅ [Go] github.com/go-openapi/swag@0.19.5
  • ✅ [Go] cloud.google.com/go@0.121.2
  • ✅ [Go] github.com/cloudwego/eino-ext/components/tool/mcp@0.0.3
  • ⚠️ [Go] github.com/atotto/clipboard@0.1.4
  • ✅ [Go] github.com/charmbracelet/x/ansi@0.9.3
  • ✅ [Go] github.com/aws/aws-sdk-go-v2/service/internal/presigned-url@1.12.13
  • ✅ [Go] github.com/aws/aws-sdk-go-v2/internal/endpoints/v2@2.6.32
  • ⚠️ [Go] github.com/gorilla/websocket@1.5.3
  • ⚠️ [Go] github.com/muesli/ansi@0.0.0-20230316100256-276c6243b2f6
  • ⚠️ [Go] github.com/muesli/cancelreader@0.2.2
  • ✅ [Go] github.com/cloudwego/eino-ext/components/model/gemini@0.1.1
  • ⚠️ [Go] github.com/aymanbagabas/go-osc52/v2@2.0.1
  • ⚠️ [Go] github.com/mattn/go-localereader@0.0.2-0.20220822084749-2491eb6c1c75
  • ⚠️ [Go] github.com/mohae/deepcopy@0.0.0-20170929034955-c48cc78d4826
  • ⚠️ [Go] github.com/goph/emperror@0.17.2
  • ✅ [Go] github.com/charmbracelet/glamour@0.8.0
  • ✅ [Go] golang.org/x/sync@0.15.0
  • ✅ [Go] github.com/charmbracelet/bubbles@0.21.0
  • ✅ [Go] github.com/alecthomas/chroma/v2@2.14.0
  • ⚠️ [Go] github.com/tidwall/sjson@1.2.5
  • ✅ [Go] github.com/yuin/goldmark@1.7.4
  • ✅ [Go] github.com/aws/aws-sdk-go-v2/service/sts@1.33.14
  • ✅ [Go] github.com/cloudwego/eino-ext/libs/acl/openai@0.0.0-20250626133421-3c142631c961
  • ⚠️ [Go] github.com/yuin/goldmark-emoji@1.0.3
  • ⚠️ [Go] github.com/invopop/yaml@0.1.0
  • ⚠️ [Go] github.com/erikgeiser/coninput@0.0.0-20211004153227-1c3628e74d0f
  • ✅ [Go] github.com/anthropics/anthropic-sdk-go@1.4.0
  • ⚠️ [Go] github.com/yargevad/filepathx@1.0.0
  • ✅ [Go] google.golang.org/genai@1.14.0
  • ⚠️ [Go] github.com/slongfield/pyfmt@0.0.0-20220222012616-ea85ff4c361f
  • ✅ [Go] github.com/aws/aws-sdk-go-v2/config@1.29.6
  • ✅ [Go] github.com/aws/aws-sdk-go-v2/credentials@1.17.59
  • ✅ [Go] github.com/cloudwego/eino-ext/components/model/claude@0.1.1
  • ✅ [Go] github.com/charmbracelet/x/cellbuf@0.0.13
  • ✅ [Go] github.com/charmbracelet/lipgloss@1.1.0
  • ✅ [Go] github.com/charmbracelet/bubbletea@1.3.5
  • ✅ [Go] golang.org/x/text@0.26.0
  • ✅ [Go] github.com/dustin/go-humanize@1.0.1
  • ✅ [Go] github.com/aws/smithy-go@1.22.2
  • ⚠️ [Go] github.com/nikolalohinski/gonja@1.5.3
  • ⚠️ [Go] github.com/lucasb-eyer/go-colorful@1.2.0
  • ⚠️ [Go] github.com/perimeterx/marshmallow@1.1.4
Policy Violations

Packages Violating Policy

[Go] github.com/muesli/termenv@0.16.0 🔗

  • ➡️ Found in manifest go.mod
  • ⚠️ Component appears to be unmaintained

[Go] github.com/googleapis/enterprise-certificate-proxy@0.3.6 🔗

  • ➡️ Found in manifest go.mod
  • ⚠️ Component appears to be unmaintained

[Go] github.com/getkin/kin-openapi@0.118.0 🔗

  • ➡️ Found in manifest go.mod
  • ⚠️ Critical or high risk vulnerabilities were found
  • ⚡ Upgrade to github.com/getkin/kin-openapi@v0.132.0

[Go] github.com/muesli/reflow@0.3.0 🔗

  • ➡️ Found in manifest go.mod
  • ⚠️ Component appears to be unmaintained

[Go] github.com/go-openapi/jsonpointer@0.19.5 🔗

  • ➡️ Found in manifest go.mod
  • ⚠️ Component appears to be unmaintained

[Go] github.com/meguminnnnnnnnn/go-openai@0.0.0-20250620092828-0d508a1dcdde 🔗

  • ➡️ Found in manifest go.mod
  • ⚠️ Component popularity is low by Github stars count
  • ⚡ Use an alternative package that is popular

[Go] github.com/evanphx/json-patch@0.5.2 🔗

  • ➡️ Found in manifest go.mod
  • ⚠️ Component appears to be unmaintained

[Go] github.com/atotto/clipboard@0.1.4 🔗

  • ➡️ Found in manifest go.mod
  • ⚠️ Component appears to be unmaintained

[Go] github.com/gorilla/websocket@1.5.3 🔗

  • ➡️ Found in manifest go.mod
  • ⚠️ Component appears to be unmaintained

[Go] github.com/muesli/ansi@0.0.0-20230316100256-276c6243b2f6 🔗

  • ➡️ Found in manifest go.mod
  • ⚠️ Component appears to be unmaintained

[Go] github.com/muesli/cancelreader@0.2.2 🔗

  • ➡️ Found in manifest go.mod
  • ⚠️ Component appears to be unmaintained

[Go] github.com/aymanbagabas/go-osc52/v2@2.0.1 🔗

  • ➡️ Found in manifest go.mod
  • ⚠️ Component appears to be unmaintained

[Go] github.com/mattn/go-localereader@0.0.2-0.20220822084749-2491eb6c1c75 🔗

  • ➡️ Found in manifest go.mod
  • ⚠️ Component popularity is low by Github stars count
  • ⚡ Use an alternative package that is popular

[Go] github.com/mohae/deepcopy@0.0.0-20170929034955-c48cc78d4826 🔗

  • ➡️ Found in manifest go.mod
  • ⚠️ Component appears to be unmaintained

[Go] github.com/goph/emperror@0.17.2 🔗

  • ➡️ Found in manifest go.mod
  • ⚠️ Component popularity is low by Github stars count
  • ⚡ Use an alternative package that is popular

[Go] github.com/tidwall/sjson@1.2.5 🔗

  • ➡️ Found in manifest go.mod
  • ⚠️ Component appears to be unmaintained

[Go] github.com/yuin/goldmark-emoji@1.0.3 🔗

  • ➡️ Found in manifest go.mod
  • ⚠️ Component appears to be unmaintained

[Go] github.com/invopop/yaml@0.1.0 🔗

  • ➡️ Found in manifest go.mod
  • ⚠️ Component appears to be unmaintained

[Go] github.com/erikgeiser/coninput@0.0.0-20211004153227-1c3628e74d0f 🔗

  • ➡️ Found in manifest go.mod
  • ⚠️ Component appears to be unmaintained

[Go] github.com/yargevad/filepathx@1.0.0 🔗

  • ➡️ Found in manifest go.mod
  • ⚠️ Component appears to be unmaintained

[Go] github.com/slongfield/pyfmt@0.0.0-20220222012616-ea85ff4c361f 🔗

  • ➡️ Found in manifest go.mod
  • ⚠️ Component appears to be unmaintained

[Go] github.com/nikolalohinski/gonja@1.5.3 🔗

  • ➡️ Found in manifest go.mod
  • ⚠️ Component appears to be unmaintained

[Go] github.com/lucasb-eyer/go-colorful@1.2.0 🔗

  • ➡️ Found in manifest go.mod
  • ⚠️ Component appears to be unmaintained

[Go] github.com/perimeterx/marshmallow@1.1.4 🔗

  • ➡️ Found in manifest go.mod
  • ⚠️ Component appears to be unmaintained

Copy link

codecov bot commented Jul 8, 2025

Codecov Report

Attention: Patch coverage is 3.38008% with 9233 lines in your changes missing coverage. Please review.

Project coverage is 8.09%. Comparing base (cd7caff) to head (cd8f634).
Report is 1 commits behind head on main.

Files with missing lines Patch % Lines
ent/client.go 0.00% 1083 Missing ⚠️
ent/reportdependencygraph_update.go 0.00% 585 Missing ⚠️
ent/reportpackage_create.go 0.00% 461 Missing ⚠️
ent/reportdependency_update.go 0.00% 439 Missing ⚠️
ent/reportdependencygraph/where.go 0.00% 414 Missing ⚠️
ent/reportmalware_update.go 0.00% 405 Missing ⚠️
ent/reportdependency_query.go 0.00% 401 Missing ⚠️
ent/reportlicense_query.go 0.00% 401 Missing ⚠️
ent/reportmalware_query.go 0.00% 401 Missing ⚠️
ent/reportlicense_update.go 0.00% 381 Missing ⚠️
... and 38 more
Additional details and impacted files
@@            Coverage Diff            @@
##             main    #535      +/-   ##
=========================================
- Coverage   18.04%   8.09%   -9.96%     
=========================================
  Files         176     278     +102     
  Lines       17009   45761   +28752     
=========================================
+ Hits         3070    3706     +636     
- Misses      13705   41783   +28078     
- Partials      234     272      +38     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Copy link
Member

@KunalSin9h KunalSin9h left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

docs missing: --insights-v2

abhisek and others added 8 commits July 9, 2025 16:08
- Remove decorative borders and excessive styling to maximize output area
- Implement clean minimal design similar to modern TUI interfaces
- Add bordered input area for clear visual separation
- Move thinking indicator above input area for better visibility
- Enhance input field reset logic for proper line alignment
- Remove verbose help text and status messages
- Optimize layout calculations for full width utilization
- Add smooth animations for agent thinking state with spinner
- Clean up code structure and remove unused progress bar functionality

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>
@abhisek abhisek marked this pull request as ready for review July 11, 2025 13:01
@abhisek abhisek requested a review from Copilot July 11, 2025 13:02
Copy link
Contributor

@Copilot Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

This PR adds Ent-generated schema and CRUD support for two new entities (ReportPackage and ReportMalware), laying the groundwork for an agentic query system and SQLite3 report generation in vet.

  • Introduces ReportPackage entity: create, update, delete, query, predicates, and model code.
  • Introduces ReportMalware entity: create, update, delete, query, predicates, and model code.
  • Foundations for agentic query interactions via documented schema and client methods.

Reviewed Changes

Copilot reviewed 57 out of 133 changed files in this pull request and generated no comments.

Show a summary per file
File Description
ent/reportpackage_delete.go Generated delete builder for ReportPackage
ent/reportpackage_create.go Generated create builder and defaults for ReportPackage
ent/reportpackage/where.go Generated filters (predicates) for ReportPackage
ent/reportpackage/reportpackage.go Generated constants, edges, and OrderOption definitions for ReportPackage
ent/reportpackage.go Generated model, JSON scanning/assignment, and client-query methods for ReportPackage
ent/reportmalware_update.go Generated update builder for ReportMalware
ent/reportmalware_query.go Generated query builder and eager-load support for ReportMalware
ent/reportmalware_delete.go Generated delete builder for ReportMalware
ent/reportmalware_create.go Generated create builder and defaults for ReportMalware
ent/reportmalware/where.go Generated filters (predicates) for ReportMalware
ent/reportmalware/reportmalware.go Generated constants, edges, OrderOption definitions, and model scanning/assignment for ReportMalware
Comments suppressed due to low confidence (3)

ent/reportpackage_create.go:1

  • [nitpick] Generated CRUD code for ReportPackage lacks corresponding unit tests; consider adding tests to cover creation, querying, updating, and deletion of ReportPackage entities.
// Code generated by ent, DO NOT EDIT.

ent/reportmalware_create.go:1

  • [nitpick] Generated CRUD code for ReportMalware lacks corresponding unit tests; consider adding tests to cover creation, querying, updating, and deletion of ReportMalware entities.
// Code generated by ent, DO NOT EDIT.

ent/reportpackage/where.go:1

  • [nitpick] Consider excluding the generated ent directory from test coverage and linting to focus on hand-written code and reduce noise in reports.
// Code generated by ent, DO NOT EDIT.

@abhisek abhisek merged commit 5f4cccb into main Jul 11, 2025
6 of 11 checks passed
@abhisek abhisek deleted the feat/vet-query-interaction-agent branch July 11, 2025 13:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants