feat(bump): working on next release

Author: Mte90

README.md

@@ -36,14 +36,18 @@ pip install semgrep
 # 3. Set your LLM API key
 export MISTRAL_API_KEY="your-key-here"
 
+# 4. Configure and scan
 # 4. Configure and scan
 cp config.example.toml my-config.toml
 # Edit my-config.toml: set [project] path to your target code
 ./target/release/baco scan --config my-config.toml
 
-# 5. View the report
-open baco-output/report.html
-```
+# First scan sequence:
+# 1. Set your LLM API key (via env or config file)
+# 2. Run the scan: ./target/release/baco scan --config my-config.toml
+- **24 phases run**: 4 parallel (Indexing, Semgrep, CpgSlice, LlmStaticAnalysis) + 20 sequential — see [Architecture](docs/architecture.md)
+- **Output in `baco-output/`**: `findings.json`, `report.html`, `report.sarif`
+- **Resume interrupted scans**: the scanner writes a `checkpoint.json` to the output directory after each phase. Use `./target/release/baco resume --checkpoint baco-output/checkpoint.json` to restart from the last successful phase.
 
 ### What happens next
 

config.example.toml

@@ -196,3 +196,73 @@ project = "libxml2"
 # trusted_paths = ["."] # Filesystem paths the agent is allowed to access
 # keep_artifacts = false  # Keep agent work artifacts (logs, temp files)
 
+
+# CPG-guided slicing (P3.1)
+[cpg]
+# Whether CPG slicing is enabled
+# enabled = false
+# Path to Joern binary (None = search PATH)
+# joern_path = ""
+# Maximum lines to include in a slice
+# slice_budget_lines = 200
+
+# Exploit synthesis (T3.2)
+[exploit]
+# Whether exploit synthesis is enabled
+# enabled = false
+# Docker image for sandboxed exploit execution
+# sandbox_image = "python:3.11-slim"
+# Timeout for exploit execution in seconds
+# timeout_secs = 30
+# Maximum number of exploit attempts per finding
+# max_exploits_per_finding = 1
+
+# Soundness validation (CORRECT paper)
+[validate]
+# Whether the Validate phase is enabled
+# enabled = false
+
+# Triple-path context augmentation (P1: VulTriage)
+[vultriage]
+# Whether triple-path context augmentation is enabled
+# enabled = false
+# Whether to include the control path (AST/CFG/DFG verbalisation)
+# control_path = true
+# Whether to include the knowledge path (CWE pattern RAG)
+# knowledge_path = true
+# Whether to include the semantic path (function summary)
+# semantic_path = true
+
+# Policy-based generation (P2.2: VulnLLM-R)
+[policy_sampling]
+# Whether policy-based generation is enabled
+# enabled = false
+# Number of sampling rounds to build the policy
+# samples = 4
+
+# Agent scaffold (P2.5: VulnLLM-R)
+[agent_scaffold]
+# Whether the agent scaffold is enabled
+# enabled = false
+# Maximum interaction rounds per target function
+# max_rounds = 5
+# Number of call-graph paths to sample per target function
+# paths_per_target = 3
+
+# Primitive-API abstraction (P4: PacVD)
+[pacvd]
+# Whether PacVD abstraction is enabled
+# enabled = false
+# Abstraction level 1-4 (1=fuzzy, 4=concrete)
+# level = 2
+# Whether to auto-select the level based on the configured LLM model
+# auto_level = false
+
+# Multi-agent harness synthesis (P5: AgentFlow)
+[agent_flow]
+# Whether AgentFlow is enabled
+# enabled = false
+# Maximum search-loop iterations
+# max_iterations = 10
+# Whether the target must be built with coverage/sanitizer instrumentation
+# requires_instrumented_target = false

src/indexer.rs

@@ -90,6 +90,7 @@ impl FileIndex {
         languages: &[String],
         max_size: u64,
         excludes: &[String],
+        pb: Option<&indicatif::ProgressBar>,
     ) -> Result<(Self, FileHashStore), std::io::Error> {
         if !std::path::Path::new(project_path).exists() {
             tracing::error!("\u{1B}[31m[INDEXING]\u{1B}[0m ERROR: Path does not exist!");
@@ -143,14 +144,23 @@ impl FileIndex {
             total_size / (1024 * 1024)
         );
 
+        if let Some(pb) = pb {
+            pb.set_length(all_files.len() as u64);
+            pb.set_position(0);
+            pb.set_message("Indexing files...");
+        }
+
         let mut hasher = crate::file_hash::FileHasher::new();
         let mut hash_store = FileHashStore::new();
 
-        for file_info in &mut all_files {
+        for (i, file_info) in all_files.iter_mut().enumerate() {
             if let Ok(hash) = hasher.hash_file(&file_info.path) {
                 file_info.hash = Some(hash.clone());
                 hash_store.insert_hash(&file_info.path, hash);
             }
+            if let Some(pb) = pb {
+                pb.set_position((i + 1) as u64);
+            }
         }
 
         hash_store.set_last_scan(chrono::Utc::now().timestamp());

src/llm.rs

@@ -770,7 +770,6 @@ fn get_error_details(e: &reqwest::Error) -> (String, String, &'static str) {
     (status, url_e, kind)
 }
 
-/// Helper to create LLM client with metrics from phase config
 pub fn create_llm_client_with_metrics(
     scanner: &crate::scanner::Scanner,
     phase_name: &str,
@@ -781,7 +780,15 @@ pub fn create_llm_client_with_metrics(
         _ => return None,
     };
 
-    let api_key = phase_config.api_key.as_ref()?;
+    let api_key = phase_config.api_key.as_ref();
+    if api_key.is_none() {
+        eprintln!(
+                "\u{1B}[33m[SCANNER] {} skipped: LLM not configured (set LLM_API_KEY or llm.api_key)\u{1B}[0m",
+                phase_name
+            );
+    }
+
+    let api_key = api_key?;
 
     let llm_config = LlmConfig {
         base_url: phase_config.base_url.clone(),

src/phase/indexing.rs

@@ -61,6 +61,7 @@ impl ScanPhase for IndexingPhase {
             &ctx.scanner.config.project.languages,
             ctx.scanner.config.scanner.max_file_size_kb * 1024,
             &ctx.scanner.config.scanner.exclude_paths,
+            Some(ctx.pb),
         ) {
             Ok(result) => result,
             Err(e) => {

src/scanner/orchestrator.rs

@@ -480,10 +480,7 @@ async fn run_sequential_phases(
 pub(super) async fn run_scanner(
     scanner: &super::Scanner,
 ) -> Result<Vec<VulnerabilityFinding>, String> {
-    let (mut findings, completed_phases, mut analyzed_files) = if scanner.force {
-        tracing::info!("Force flag set - starting fresh, ignoring checkpoint");
-        (Vec::new(), Vec::new(), Vec::new())
-    } else if scanner.checkpoint_path.exists() {
+    let (mut findings, completed_phases, mut analyzed_files) = if !scanner.force && scanner.checkpoint_path.exists() {
         use crate::checkpoint::Checkpoint;
         match Checkpoint::load(&scanner.checkpoint_path.to_string_lossy()) {
             Ok(cp) => {
@@ -495,8 +492,18 @@ pub(super) async fn run_scanner(
                     );
                     return Ok(cp.findings_so_far);
                 }
+
+                let resume_phase =
+                    Checkpoint::resume_from(&scanner.checkpoint_path.to_string_lossy())
+                        .unwrap_or(ScanPhase::Indexing);
+                let phase_idx = scanner.phase_graph.phase_index(&resume_phase);
+                let total = scanner.phase_graph.total_phases();
+
                 eprintln!(
-                    "\u{1B}[33m[SCANNER] Resuming from checkpoint: {} phases already completed, {} findings loaded.\n         Use --force to start a fresh scan.\u{1B}[0m",
+                    "\u{1B}[33m[SCANNER] Resuming scan from phase {:?} ({}/{}) - {} phases already completed, {} findings loaded.\n         Use --force to start a fresh scan.\u{1B}[0m",
+                    resume_phase,
+                    phase_idx,
+                    total,
                     cp.completed_phases.len(),
                     cp.findings_so_far.len()
                 );

src/scanner/phases/llm_phases/agent_verification.rs

@@ -6,7 +6,7 @@ use crate::findings::VulnerabilityFinding;
 use crate::scanner::phases::PhaseConfig;
 use std::sync::Arc;
 
-/// Run Security Agent verification phase (Phase 6/20)
+/// Run Security Agent verification phase (Phase 10/24)
 pub async fn run_security_agent_verification(
     scanner: &crate::scanner::Scanner,
     cfg: PhaseConfig<'_>,
@@ -28,19 +28,19 @@ pub async fn run_security_agent_verification(
 
     if !config.agent.enabled {
         tracing::debug!("Agent mode disabled, skipping Security Agent verification");
-        pb.set_message("Phase 6/20: Agent mode disabled - skipping");
+        pb.set_message("Phase 10/24: Agent mode disabled - skipping");
         pb.set_position(base + 100);
         return Ok((findings, analyzed_files.to_vec()));
     }
 
     let Some(_api_key) = &config.llm.phases.discovery.api_key else {
         tracing::debug!("No API key for agent, skipping Security Agent verification");
-        pb.set_message("Phase 6/20: No API key - skipping");
+        pb.set_message("Phase 10/24: No API key - skipping");
         pb.set_position(base + 100);
         return Ok((findings, analyzed_files.to_vec()));
     };
 
-    pb.set_message("Phase 6/20: Security Agent verification (tool-based analysis)...");
+    pb.set_message("Phase 10/24: Security Agent verification (tool-based analysis)...");
 
     let total_findings = findings.len();
 
@@ -134,7 +134,7 @@ pub async fn run_security_agent_verification(
         };
         pb.set_position(base + progress_pct);
         pb.set_message(format!(
-            "Phase 6/20: Security Agent verifying [{}/{}] - {}",
+            "Phase 10/24: Security Agent verifying [{}/{}] - {}",
             i + 1,
             total_findings,
             finding.title
@@ -276,7 +276,7 @@ pub async fn run_security_agent_verification(
         };
 
         if enter_agent_flow {
-            pb.set_message("Phase 6/20: AgentFlow harness synthesis...");
+            pb.set_message("Phase 10/24: AgentFlow harness synthesis...");
 
             for finding in findings.iter_mut() {
                 // Build a minimal harness from the finding

src/scanner/phases/llm_phases/discovery.rs

@@ -6,7 +6,7 @@ use crate::llm;
 use crate::scanner::phases::PhaseConfig;
 use std::sync::Arc;
 
-/// Run LLM discovery phase (Phase 4/20)
+/// Run LLM discovery phase (Phase 7/24)
 pub async fn run_llm_discovery(
     scanner: &crate::scanner::Scanner,
     cfg: PhaseConfig<'_>,
@@ -25,11 +25,11 @@ pub async fn run_llm_discovery(
     tracing::info!("Running LLM discovery phase...");
     let base = pb.position();
     pb.set_message(
-        "Phase 4/20: LLM discovery (enriching vulnerability descriptions with AI context)...",
+        "Phase 7/24: LLM discovery (enriching vulnerability descriptions with AI context)...",
     );
 
     // Step 1: Detect project stack and fetch CVEs for threat intelligence
-    pb.set_message("Phase 4/20: Detecting project stack and fetching CVE data...");
+    pb.set_message("Phase 7/24: Detecting project stack and fetching CVE data...");
     let target_path_str = target_path.to_string_lossy().to_string();
     let bootstrapper = CveBootstrapper::new(target_path_str.clone());
 
@@ -133,7 +133,7 @@ pub async fn run_llm_discovery(
             };
             pb.set_position(base + progress_pct);
             pb.set_message(format!(
-                "Phase 4/20: Enriching findings [{}/{}] - {}",
+                "Phase 7/24: Enriching findings [{}/{}] - {}",
                 i + 1,
                 total_findings,
                 finding.title
@@ -213,12 +213,12 @@ Respond with ONLY JSON:
         }
         pb.set_position(base + 100);
         pb.set_message(format!(
-            "Phase 4/20: Discovery complete - enriched {} findings",
+            "Phase 7/24: Discovery complete - enriched {} findings",
             total_findings
         ));
     } else {
         tracing::debug!("No API key for discovery, skipping LLM enrichment");
-        pb.set_message("Phase 4/20: No API key configured - skipping discovery");
+        pb.set_message("Phase 7/24: No API key configured - skipping discovery");
         pb.set_position(base + 100);
     }
     Ok((findings, analyzed_files.to_vec()))

src/scanner/phases/llm_phases/static_analysis.rs

@@ -1,4 +1,4 @@
-use super::helpers::detect_language;
+/// Run LLM static analysis phase (Phase 4/24)
 use crate::context::callee_walker::extract_call_sites;
 use crate::context::pacvd_extractor::{self, AbstractionLevel};
 use crate::context::semantic_path;
@@ -97,7 +97,7 @@ pub async fn run_llm_static_analysis(
 
     // Capture base position for intra-phase progress
     let base = pb.position();
-    pb.set_message("Phase 3/20: LLM static analysis (analyzing files for vulnerabilities)...");
+    pb.set_message("Phase 4/24: LLM static analysis (analyzing files for vulnerabilities)...");
 
     let index = crate::indexer::FileIndex::index_project(
         target_path.to_str().unwrap_or("."),
@@ -165,15 +165,15 @@ pub async fn run_llm_static_analysis(
                 let progress_pct = ((i as f64 / file_count as f64) * 100.0) as u64;
                 pb.set_position(base + progress_pct);
                 pb.set_message(format!(
-                    "Phase 3/20: Skipping already analyzed [{}]: {}",
+                    "Phase 4/24: Skipping already analyzed [{}]: {}",
                     i + 1,
                     file_info.path.display()
                 ));
                 continue;
             }
             let progress_pct = ((i as f64 / file_count as f64) * 100.0) as u64;
             let msg = format!(
-                "Phase 3/20: LLM analyzing [{}/{}] ({:.0}%): {}",
+                "Phase 4/24: LLM analyzing [{}/{}] ({:.0}%): {}",
                 i + 1,
                 file_count,
                 progress_pct,
@@ -300,7 +300,7 @@ pub async fn run_llm_static_analysis(
                     llm_findings.extend(file_findings);
                     new_analyzed_files.push(file_path_str);
                     let msg = format!(
-                        "Phase 3/20: LLM analyzing [{}/{}] ({:.0}%): {} - {} findings total",
+                        "Phase 4/24: LLM analyzing [{}/{}] ({:.0}%): {} - {} findings total",
                         i + 1,
                         file_count,
                         progress_pct,
@@ -318,7 +318,7 @@ pub async fn run_llm_static_analysis(
                     let error_lines: Vec<&str> = e.lines().take(3).collect();
                     let error_summary = error_lines.join(" | ");
                     let msg = format!(
-                        "Phase 3/20: {} - {} - FAILED: {}",
+                        "Phase 4/24: {} - {} - FAILED: {}",
                         file_info.path.display(),
                         error_summary,
                         if i + 1 < file_count {
@@ -340,7 +340,7 @@ pub async fn run_llm_static_analysis(
 
         findings.extend(llm_findings.clone());
         pb.set_message(format!(
-            "Phase 3/20: LLM static analysis complete - {} findings discovered",
+            "Phase 4/24: LLM static analysis complete - {} findings discovered",
             llm_findings.len()
         ));
     } else {