The Fine Print

from crewai import Agent, Task, Crew
from langchain_openai import ChatOpenAI
llm = ChatOpenAI(model="gpt-4-turbo", temperature=0)
context_agent = Agent(
    role='Application Architect',
    goal='Analyze the vulnerable code snippet and determine its dependencies and data flow.',
    backstory='Senior engineer who understands how all the pieces of the application fit together.',
    verbose=True,
    llm=llm
)
security_agent = Agent(
    role='Application Security Engineer',
    goal='Assess the SAST alert and determine the precise security control needed (e.g., escaping, parameterization).',
    backstory='Hardened AppSec professional who knows exactly how to neutralize exploits.',
    verbose=True,
    llm=llm
)
patch_agent = Agent(
    role='Patch Contributor',
    goal='Write the exact, modified code snippet that implements the security fix while maintaining original functionality.',
    backstory='Detail-oriented developer who writes clean, secure, and drop-in ready code.',
    verbose=True,
    llm=llm
)
sast_alert = """
File: database.py
Line 42: cursor.execute(f"SELECT * FROM users WHERE username = '{user_input}'")
Alert: High Severity - SQL Injection detected.
"""
context_task = Task(
    description=f'Analyze this SAST alert and explain what the code is trying to do and why it is vulnerable: {sast_alert}',
    expected_output='Explanation of the function and the data flow vulnerability.',
    agent=context_agent
)
sec_task = Task(
    description='Based on the architecture context, define the specific secure coding pattern required to fix this.',
    expected_output='Specific remediation instructions (e.g., how to parameterize the query).',
    agent=security_agent,
    context=[context_task]
)
patch_task = Task(
    description='Write the replacement code for Line 42. It MUST be a direct replacement snippet that fixes the SQLi.',
    expected_output='The final, secure Python code snippet.',
    agent=patch_agent,
    context=[sec_task]
)
devsecops_swarm = Crew(
    agents=[context_agent, security_agent, patch_agent],
    tasks=[context_task, sec_task, patch_task]
)
if __name__ == "__main__":
    print("Initiating Code Remediation Swarm...")
    pr_code = devsecops_swarm.kickoff()
    print("\n--- Proposed Pull Request Code ---\n")
    print(pr_code)