Sync stale submodule snapshot: restore test helpers + gofumpt

VERSION

@@ -1 +1 @@
-0.1.0
+0.1.2

checks.go

@@ -38,7 +38,7 @@
 // check prompt.
 //
 // Returns an empty slice (not an error) if the directory does not exist.
 func LoadChecks(dir string) ([]CustomCheck, error) {
 	entries, err := os.ReadDir(dir)
 	if err != nil {
 		if os.IsNotExist(err) {
@@ -57,7 +57,7 @@
 		}
 
 		path := filepath.Join(dir, entry.Name())
-		data, err := os.ReadFile(path)
+		data, err := os.ReadFile(path) // #nosec G304 -- path is joined from the checks directory being loaded (typically ".sight/checks/") and an entry name from os.ReadDir on that same directory, not raw user input
 		if err != nil {
 			continue
 		}
@@ -72,14 +72,14 @@
 
 // LoadChecksFromRepo is a convenience that looks for .sight/checks/ relative
 // to the given repository root directory.
 func LoadChecksFromRepo(repoDir string) ([]CustomCheck, error) {
 	return LoadChecks(filepath.Join(repoDir, ".sight", "checks"))
 }
 
 // CustomChecksToConcerns converts loaded custom checks into internal Concern
 // values suitable for the review pipeline. Only enabled checks are included.
 // If languages is non-empty, the concern prompt notes which languages apply.
 func CustomChecksToConcerns(checks []CustomCheck) []review.Concern {
 	var concerns []review.Concern
 	for _, c := range checks {
 		if !c.Enabled {
@@ -105,7 +105,7 @@
 // additional concerns to the review. This is the primary integration point:
 //
 //	sight.Review(ctx, diff, sight.WithCustomChecks(".sight/checks"))
 func WithCustomChecks(dir string) Option {
 	return optFunc(func(c *config) {
 		checks, err := LoadChecks(dir)
 		if err != nil || len(checks) == 0 {
@@ -120,7 +120,7 @@
 }
 
 // WithCustomChecksFromRepo loads checks from .sight/checks/ within the repo root.
 func WithCustomChecksFromRepo(repoDir string) Option {
 	return WithCustomChecks(filepath.Join(repoDir, ".sight", "checks"))
 }
 

config.go

@@ -19,6 +19,8 @@ type FileConfig struct {
 	Reflection *bool             `json:"reflection"`
 	Parallel   *bool             `json:"parallel"`
 	Prompts    map[string]string `json:"prompts"`
+	Graph      *bool             `json:"graph"`
+	Audit      *string           `json:"audit"` // "none", "hooks", "mcp", "full"
 }
 
 // LoadConfigFile reads .sight.toml from the given directory (or parents).
@@ -38,7 +40,7 @@ func LoadConfigFile(dir string) (*FileConfig, error) {
 		return nil, fmt.Errorf("config file %s is too large (%d bytes, max %d bytes)", path, info.Size(), maxConfigSize)
 	}
 
-	data, err := os.ReadFile(path)
+	data, err := os.ReadFile(path) // #nosec G304 -- path comes from findConfigFile(dir), which searches for .sight.toml in the project directory being reviewed or its parents, not attacker-controlled input
 	if err != nil {
 		return nil, err
 	}
@@ -78,6 +80,12 @@ func ApplyFileConfig(fc *FileConfig) []Option {
 	if len(fc.Exclude) > 0 {
 		opts = append(opts, WithExclude(fc.Exclude...))
 	}
+	if fc.Graph != nil {
+		opts = append(opts, WithGraph(*fc.Graph))
+	}
+	if fc.Audit != nil {
+		opts = append(opts, WithAuditMode(ParseAuditMode(*fc.Audit)))
+	}
 
 	return opts
 }
@@ -152,6 +160,11 @@ func parseTOMLConfig(content string) (*FileConfig, error) {
 		case "parallel":
 			b := value == "true"
 			cfg.Parallel = &b
+		case "graph":
+			b := value == "true"
+			cfg.Graph = &b
+		case "audit":
+			cfg.Audit = &value
 		}
 	}
 

docs/architecture.md

@@ -126,3 +126,89 @@ srv.ServeHTTP("127.0.0.1:8080") // 🌐 streamable HTTP transport, served at /mc
 **30+ built-in rules** run without LLM overhead — hardcoded secret patterns, SQL injection sinks, unsafe deserialization, etc. Fused with LLM results.
 
 **Taint analysis** (exposed via the `sight_taint` MCP tool and the taint-analysis API) uses SSA-based cross-function tracking to detect source→sink data flows. Sources, sinks, and sanitizers are configurable.
+
+---
+
+## 🔗 Structural Dependency Graph
+
+The `internal/graph` package provides **optional structural dependency analysis** for code reviews:
+
+**Key capabilities:**
+- Parse Go AST to build structural dependency graph
+- Blast-radius analysis: identify all files affected by changes
+- Transitive dependency tracking
+- Impact scoring based on depth and number of dependents
+- SQLite persistence for incremental updates
+
+**Usage:**
+```go
+// Enable graph-backed review
+g := graph.New()
+// ... build graph or load from SQLite ...
+
+// Run blast radius analysis
+result := g.GetBlastRadius([]string{"file.go"})
+fmt.Printf("Direct: %d, Transitive: %d\n", result.Direct, result.Transitive)
+```
+
+**Tools exposed via MCP:** `sight_graph_blastRadius`, `sight_graph_query`, `sight_graph_stats`
+
+---
+
+## 🔒 Security Auditing
+
+The `internal/audit` package provides **agent surface security auditing**:
+
+**Key capabilities:**
+- Concurrent security scanning of multiple targets
+- Filter findings by severity (critical, high, medium, low) or category
+- Integration with MCP hooks, permissions, and endpoints
+- Webhook validation and test requests
+- JSON-serializable audit findings
+
+**Usage:**
+```go
+// Create audit scope
+auditScope := &audit.AuditScope{
+    Targets: []audit.AuditTarget{
+        {Type: audit.AuditTargetHooks, Path: "/hooks/webhook"},
+        {Type: audit.AuditTargetEndpoints, Path: "/api/endpoint"},
+    },
+    Rules: []string{"detect_unauthenticated_endpoints", "detect_hardcoded_secrets"},
+}
+
+// Run audit
+report, err := audit.Audit(ctx, auditScope)
+if report.Count() > 0 {
+    fmt.Printf("Found %d security issues\n", report.Count())
+}
+```
+
+---
+
+## 🌐 Browser Automation Tools
+
+The `internal/tool` package provides **HTTP-based browser automation** capabilities:
+
+**Key capabilities:**
+- HTTP client with configurable timeouts and redirects
+- Browser tool with GET, POST, and header management
+- Response parsing with JSON support
+- Webhook testing: send test payloads and validate responses
+- Formatter for structured output
+
+**Usage:**
+```go
+// Create browser tool
+browser := tool.NewBrowserTool()
+
+// Make requests
+resp, err := browser.Get(ctx, "https://example.com")
+if err == nil && resp.IsSuccess() {
+    fmt.Printf("Status: %d\n", resp.StatusCode)
+}
+
+// Test webhooks
+webhook := tool.NewWebhookTester()
+resp, err := webhook.SendTestRequest(ctx, "https://webhook.example.com", payload)
+```

eval.go

@@ -93,7 +93,7 @@ func RunEval(ctx context.Context, suite *EvalSuite, opts ...Option) ([]EvalResul
 
 // LoadEvalSuite loads eval cases from a JSON file.
 func LoadEvalSuite(path string) (*EvalSuite, error) {
-	data, err := os.ReadFile(path)
+	data, err := os.ReadFile(path) // #nosec G304 -- path is a caller-supplied eval suite file location (this tool's own eval fixtures), not attacker-controlled input
 	if err != nil {
 		return nil, fmt.Errorf("loading eval suite: %w", err)
 	}