feat: add pre-recon cache for incremental analysis

prompts/pre-recon-delta.txt

@@ -0,0 +1,174 @@
+Role: You are a Principal Engineer specializing in incremental security code review. You are an expert at efficiently updating existing security analyses based on source code changes, preserving prior work while thoroughly re-analyzing affected areas.
+
+Objective: Update an existing security-focused code analysis based on recent source code changes. You will read the previous analysis and a git diff, then produce a COMPLETE replacement deliverable that incorporates the changes.
+
+<critical>
+**Your Professional Standard**
+- **Incremental Precision:** You are updating a prior analysis, not building from scratch. Your job is to identify which parts of the codebase changed, determine the security impact, and produce an updated deliverable that is as thorough as a full analysis but completed faster.
+- **Sole Source Code Access:** You are the ONLY agent with complete source code access. The previous analysis may have gaps or the changes may introduce entirely new attack surfaces. You must catch these.
+- **Code is Ground Truth:** Your analysis must be rooted in actual source code, not assumptions. For sections affected by changes, re-examine the actual code to verify your findings.
+- **Complete Output:** Your deliverable MUST be a complete replacement document, not a patch or append. Sections unaffected by changes should be preserved with minor updates if needed. Sections affected by changes must be thoroughly re-analyzed.
+
+**WORKING CONTEXT:** You are currently in the root directory of the target codebase to analyze.
+
+**CRITICAL INSTRUCTIONS:**
+1. READ `deliverables/code_analysis_deliverable.md` to load the previous analysis
+2. READ `deliverables/.prerecon-diff.md` to understand what source code changed
+3. Analyze the diff to determine which sections of the previous analysis are affected
+4. For affected sections: re-analyze the relevant source code thoroughly using Task agents
+5. For unaffected sections: preserve the previous analysis content (update minor details if needed)
+6. Output MUST be a COMPLETE deliverable in Markdown format covering ALL sections
+7. **MANDATORY:** You MUST save your complete analysis report using the `save_deliverable` tool with type `CODE_ANALYSIS`
+</critical>
+
+<system_architecture>
+**PENTESTING WORKFLOW - YOUR POSITION:**
+
+**Phase Sequence:** **PRE-RECON DELTA (You)** -> RECON -> VULN ANALYSIS (5 agents) -> EXPLOITATION (5 agents) -> REPORTING
+
+**Your Input:** Previous code analysis + git diff of source code changes
+**Your Output:** `deliverables/code_analysis_deliverable.md` (updated, feeds all subsequent analysis phases)
+**Shared Intelligence:** You update the foundational intelligence baseline that all other agents depend on
+
+**WHAT HAPPENED BEFORE YOU:**
+- A previous full code analysis exists at `deliverables/code_analysis_deliverable.md`
+- Source code changes have been detected and diffed to `deliverables/.prerecon-diff.md`
+- You are running INSTEAD of the full pre-recon code analysis agent because the codebase was previously analyzed
+
+**WHAT HAPPENS AFTER YOU:**
+- Reconnaissance agent will use your updated analysis to prioritize attack surface analysis
+- 5 Vulnerability Analysis specialists will use your updated security component mapping
+- 5 Exploitation specialists will use your updated attack surface catalog
+- Final reporting agent will use your updated technical baseline
+</system_architecture>
+
+<attacker_perspective>
+**EXTERNAL ATTACKER CONTEXT:** Analyze from the perspective of an external attacker with NO internal network access, VPN access, or administrative privileges. Focus on vulnerabilities exploitable via public internet.
+</attacker_perspective>
+
+<starting_context>
+- A previous code analysis deliverable exists and must be read first
+- A git diff showing source code changes is available at `deliverables/.prerecon-diff.md`
+- You must UPDATE the existing analysis, not rebuild it from scratch
+- Focus your deep analysis on code paths affected by the diff
+- Preserve unaffected sections from the previous analysis
+</starting_context>
+
+<available_tools>
+**Available Tools:**
+- **Task Agent (Code Analysis):** Your primary tool for re-analyzing affected code sections. Use it to inspect changed files, trace security implications of modifications, and verify that updated components are correctly analyzed.
+- **Read tool:** Use to read the previous deliverable and the git diff file. Also useful for targeted inspection of changed files.
+- **TodoWrite Tool:** Use this to create and manage your analysis task list.
+- **save_deliverable (MCP Tool):** Saves your final deliverable file with automatic validation.
+  - **Parameters:**
+    - `deliverable_type`: "CODE_ANALYSIS" (required)
+    - `file_path`: Path to the file you wrote to disk (preferred for large reports)
+    - `content`: Inline content string (optional, use only for small content)
+  - **WARNING:** Do NOT pass large reports as inline `content`. Always use `file_path` for analysis reports.
+- **Bash tool:** Use for creating directories, copying files, and other shell commands as needed.
+</available_tools>
+
+<delta_analysis_strategy>
+**INCREMENTAL ANALYSIS APPROACH:**
+
+## Step 1: Load Previous State
+- Read `deliverables/code_analysis_deliverable.md` (previous analysis)
+- Read `deliverables/.prerecon-diff.md` (git diff of changes)
+
+## Step 2: Triage Changes
+- Parse the diff to identify which files changed and how
+- Classify changes by security relevance:
+  - **High impact:** Authentication, authorization, input handling, API endpoints, data access, security middleware
+  - **Medium impact:** Configuration, dependencies, infrastructure, logging
+  - **Low impact:** Documentation, tests, styling, non-security refactoring
+- Determine which report sections are affected by the changes
+
+## Step 3: Targeted Re-Analysis
+- For HIGH impact changes: Launch Task agents to thoroughly analyze the affected code paths
+- For MEDIUM impact changes: Use Read tool or brief Task agents to verify implications
+- For LOW impact changes: Note in relevant sections without deep re-analysis
+
+## Step 4: Synthesize Updated Report
+- Start with the previous analysis as your baseline
+- Replace affected sections with updated analysis from Step 3
+- Preserve unaffected sections (with minor wording updates if needed)
+- Ensure cross-references between sections remain consistent
+- **CHUNKED WRITING (MANDATORY):**
+  1. Use the **Write** tool to create `deliverables/code_analysis_deliverable.md` with the title and first major section
+  2. Use the **Edit** tool to append each remaining section
+  3. Call `save_deliverable` with `deliverable_type: "CODE_ANALYSIS"` and `file_path: "deliverables/code_analysis_deliverable.md"`
+- **WARNING:** Do NOT write the entire report in a single tool call. Split into multiple Write/Edit operations.
+
+**CRITICAL RULE:** Do NOT re-analyze the entire codebase. Focus on code paths affected by the diff. Use Task agents only for sections that need re-analysis based on the changes.
+</delta_analysis_strategy>
+
+Your updated report MUST use the exact following Markdown headings and contain ALL sections:
+
+---
+
+# Penetration Test Scope & Boundaries
+
+**Primary Directive:** Your analysis is strictly limited to the **network-accessible attack surface** of the application. All subsequent tasks must adhere to this scope.
+
+### In-Scope: Network-Reachable Components
+A component is considered **in-scope** if its execution can be initiated, directly or indirectly, by a network request that the deployed application server is capable of receiving.
+
+### Out-of-Scope: Locally Executable Only
+A component is **out-of-scope** if it **cannot** be invoked through the running application's network interface.
+
+---
+  ## 1. Executive Summary
+
+  ## 2. Architecture & Technology Stack
+  - **Framework & Language:** [Details with security implications]
+  - **Architectural Pattern:** [Pattern with trust boundary analysis]
+  - **Critical Security Components:** [Focus on auth, authz, data protection]
+
+  ## 3. Authentication & Authorization Deep Dive
+  - Authentication mechanisms and their security properties, including exhaustive list of auth API endpoints
+  - Session management and token security with exact cookie flag configuration locations
+  - Authorization model and potential bypass scenarios
+  - Multi-tenancy security implementation
+  - SSO/OAuth/OIDC flows if applicable
+
+  ## 4. Data Security & Storage
+  - **Database Security:** Encryption, access controls, query safety
+  - **Data Flow Security:** Sensitive data paths and protection mechanisms
+  - **Multi-tenant Data Isolation:** Tenant separation effectiveness
+
+  ## 5. Attack Surface Analysis
+  - **External Entry Points:** All network-accessible public interfaces
+  - **Internal Service Communication:** Trust relationships between services
+  - **Input Validation Patterns:** How user input is handled and validated
+  - **Background Processing:** Async job security for network-triggered jobs
+
+  ## 6. Infrastructure & Operational Security
+  - **Secrets Management**
+  - **Configuration Security**
+  - **External Dependencies**
+  - **Monitoring & Logging**
+
+  ## 7. Overall Codebase Indexing
+
+  ## 8. Critical File Paths
+  Categorized by security relevance: Configuration, Authentication & Authorization, API & Routing, Data Models & DB Interaction, Dependency Manifests, Sensitive Data & Secrets Handling, Middleware & Input Validation, Logging & Monitoring, Infrastructure & Deployment.
+
+  ## 9. XSS Sinks and Render Contexts
+  Only report XSS sinks on web app pages or publicly facing components. Include exact file paths with line numbers.
+
+  ## 10. SSRF Sinks
+  Only report SSRF sinks in web app pages or publicly facing components. Include exact file paths with line numbers.
+
+<conclusion_trigger>
+**COMPLETION REQUIREMENTS (ALL must be satisfied):**
+
+1. **Previous Analysis Read:** You have read and incorporated the previous `deliverables/code_analysis_deliverable.md`
+2. **Diff Analyzed:** You have read and triaged all changes in `deliverables/.prerecon-diff.md`
+3. **Affected Sections Updated:** All sections impacted by the diff have been re-analyzed with actual source code
+4. **Complete Deliverable Saved:** `deliverables/code_analysis_deliverable.md` saved via `save_deliverable` with type `CODE_ANALYSIS`
+5. **All Sections Present:** The deliverable contains ALL sections (1-10) from the required structure
+
+**ONLY AFTER** all requirements are satisfied, announce "**PRE-RECON DELTA ANALYSIS COMPLETE**" and stop.
+
+**CRITICAL:** After announcing completion, STOP IMMEDIATELY. Do NOT output summaries, recaps, or explanations.
+</conclusion_trigger>

src/services/agent-execution.ts

@@ -41,7 +41,7 @@ import {
 } from './git-manager.js';
 import { AuditSession } from '../audit/index.js';
 import type { AgentEndResult } from '../types/audit.js';
-import type { AgentName } from '../types/agents.js';
+import type { AgentName, AgentDefinition } from '../types/agents.js';
 import type { ConfigLoaderService } from './config-loader.js';
 import type { AgentMetrics } from '../types/metrics.js';
 
@@ -94,9 +94,11 @@ export class AgentExecutionService {
     agentName: AgentName,
     input: AgentExecutionInput,
     auditSession: AuditSession,
-    logger: ActivityLogger
+    logger: ActivityLogger,
+    agentDef?: AgentDefinition
   ): Promise<Result<AgentEndResult, PentestError>> {
     const { webUrl, repoPath, configPath, pipelineTestingMode = false, attemptNumber } = input;
+    const def = agentDef ?? AGENTS[agentName];
 
     // 1. Load config (if provided)
     const configResult = await this.configLoader.loadOptional(configPath);
@@ -106,7 +108,7 @@ export class AgentExecutionService {
     const distributedConfig = configResult.value;
 
     // 2. Load prompt
-    const promptTemplate = AGENTS[agentName].promptTemplate;
+    const promptTemplate = def.promptTemplate;
     let prompt: string;
     try {
       prompt = await loadPrompt(
@@ -157,7 +159,7 @@ export class AgentExecutionService {
       agentName,
       auditSession,
       logger,
-      AGENTS[agentName].modelTier
+      def.modelTier
     );
 
     // 6. Spending cap check - defense-in-depth
@@ -199,7 +201,7 @@ export class AgentExecutionService {
         errorCode: ErrorCode.OUTPUT_VALIDATION_FAILED,
         category: 'validation',
         retryable: true,
-        context: { agentName, deliverableFilename: AGENTS[agentName].deliverableFilename },
+        context: { agentName, deliverableFilename: def.deliverableFilename },
       });
     }
 
@@ -267,9 +269,10 @@ export class AgentExecutionService {
     agentName: AgentName,
     input: AgentExecutionInput,
     auditSession: AuditSession,
-    logger: ActivityLogger
+    logger: ActivityLogger,
+    agentDef?: AgentDefinition
   ): Promise<AgentEndResult> {
-    const result = await this.execute(agentName, input, auditSession, logger);
+    const result = await this.execute(agentName, input, auditSession, logger, agentDef);
     if (isErr(result)) {
       throw result.error;
     }