pt-code-scan

/pt-code-scan — Agentic Code Scanning (Stage 3)

Execute the analysis passes (CA-NNN) from code/code-plan.md as an AI agent — read each pass's targets, apply its technique + methodology, and reason about whether the pass's positive is present. This is agent-first and not tool-dependent: it runs with zero external scanners. Where a tool is available and adds value over pure reasoning (a SAST engine for breadth on a large repo, a dependency scanner for fresh CVE data, a secret scanner for entropy sweeps), the agent may run it and fold its output in as additional candidate signal. Output is normalized into candidate findings — raw signal for /pt-code-review to triage, never findings on their own.

When to use, when to skip

• Use to execute the planned passes into candidates before the confirmation pass.
• Skip the whole code stage if black-box (repo_access: false) → /pt-dynamic-plan. Skip an individual tool that adds nothing over the agent — tools are optional, not required.

Initial Response

• With <engagement-id>: proceed to Step 0.
• Without: print Usage: /pt-code-scan <engagement-id>. and STOP.

Inputs

• code/code-plan.md — [blocking] (the CA-NNN passes to execute).
• Source repositories — [blocking].
• scope.md — [blocking] (readiness ≠ blocked; repo_access: true).
• Available tools — [optional] — used only on a pass where they add value over the agent.
• Human-provided SBOM / advisory feed — [optional] — freshens dep-audit CVE coverage (hybrid SCA).

Process

Step 0: Validate + resume

Validate scope (repo_access: true, else STOP → /pt-dynamic-plan) and that code/code-plan.md exists. Act only on planned passes; a re-run appends a new dated result under code/scan-results/, never overwriting a prior one; leave scanned/reviewed passes alone.

Step 1: Execute each pass (agent-first)

For each planned CA-NNN: read its targets (R-NNN/path), apply the technique + methodology_refs, and reason for the pass's positive. Optional tools: where a tool is available and value-adding for this pass, run it over the repo (never the live target) and treat its output as extra candidate signal — dedup against the agent's own reasoning. For dep-audit, reason over lockfiles; if a human SBOM/advisory feed is present, use it for CVE freshness (pure agentic dep-audit is bounded by knowledge cutoff — say so honestly).