feat: add --tools flag to run only static analysis and display tool findings in the CLI

LiveReview Pre-Commit Check: skipped

Author: Amazing-Stardom

internal/appcore/auth_recovery.go

@@ -92,8 +92,8 @@ func isLiveReviewAPIKeyInvalid(err error) bool {
 	return code == liveReviewAPIKeyInvalidCode
 }
 
-func submitReviewWithRecovery(config Config, base64Diff, repoName string, verbose bool) (reviewmodel.DiffReviewCreateResponse, Config, error) {
-	submitResp, err := reviewapi.SubmitReview(config.APIURL, config.APIKey, base64Diff, repoName, verbose)
+func submitReviewWithRecovery(config Config, base64Diff, repoName string, toolsOnly bool, verbose bool) (reviewmodel.DiffReviewCreateResponse, Config, error) {
+	submitResp, err := reviewapi.SubmitReview(config.APIURL, config.APIKey, base64Diff, repoName, toolsOnly, verbose)
 	if err == nil {
 		return submitResp, config, nil
 	}
@@ -107,7 +107,7 @@ func submitReviewWithRecovery(config Config, base64Diff, repoName string, verbos
 	}
 
 	fmt.Println("Retrying review submission with refreshed credentials...")
-	retryResp, retryErr := reviewapi.SubmitReview(recoveredConfig.APIURL, recoveredConfig.APIKey, base64Diff, repoName, verbose)
+	retryResp, retryErr := reviewapi.SubmitReview(recoveredConfig.APIURL, recoveredConfig.APIKey, base64Diff, repoName, toolsOnly, verbose)
 	if retryErr != nil {
 		return reviewmodel.DiffReviewCreateResponse{}, recoveredConfig, retryErr
 	}

internal/appcore/review_runtime.go

@@ -394,7 +394,7 @@ func runReviewWithOptions(opts reviewopts.Options) error {
 		submitResp = buildFakeSubmitResponse()
 	} else {
 		var updatedConfig Config
-		submitResp, updatedConfig, err = submitReviewWithRecovery(*config, base64Diff, repoName, verbose)
+		submitResp, updatedConfig, err = submitReviewWithRecovery(*config, base64Diff, repoName, opts.ToolsOnly, verbose)
 		config = &updatedConfig
 	}
 	if err != nil {
@@ -797,35 +797,43 @@ func runReviewWithOptions(opts reviewopts.Options) error {
 			}))
 			// Proxy endpoint for review-events API to avoid CORS
 			mux.HandleFunc("/api/v1/diff-review/", requireSession(reviewID, func(w http.ResponseWriter, r *http.Request) {
-				if fakeMode {
-					if r.Method != http.MethodGet {
-						w.WriteHeader(http.StatusMethodNotAllowed)
-						return
-					}
-					if !strings.HasSuffix(r.URL.Path, "/events") {
-						http.NotFound(w, r)
-						return
-					}
+				if r.Method != http.MethodGet {
+					w.WriteHeader(http.StatusMethodNotAllowed)
+					return
+				}
 
+				// Both fake and real modes handle the /events sub-path locally.
+				// The backend has no /api/v1/diff-review/:id/events route — only
+				// /api/v1/reviews/:id/events exists. Proxying would always return
+				// 404, causing fetchFinalReviewData in the JS to never be called.
+				// Instead, respond with meta.status from ReviewState so the JS
+				// detects "completed" and calls fetchFinalReviewData itself (which
+				// proxies to GET /api/v1/diff-review/:id — a route that does exist).
+				if strings.HasSuffix(r.URL.Path, "/events") {
 					reviewStateMu.RLock()
 					state := currentReviewState
 					reviewStateMu.RUnlock()
 					if state == nil {
 						http.Error(w, "No review in progress", http.StatusNotFound)
 						return
 					}
-
 					w.Header().Set("Content-Type", "application/json")
 					if err := json.NewEncoder(w).Encode(buildFakeEventsResponse(state.Snapshot())); err != nil {
 						if verbose {
-							log.Printf("failed to write fake events response: %v", err)
+							log.Printf("failed to write events response: %v", err)
 						}
 					}
 					return
 				}
 
+				if fakeMode {
+					http.NotFound(w, r)
+					return
+				}
+
 				handleReviewEventsProxy(w, r, *config, reviewID, verbose)
 			}))
+
 			// Proxy feedback endpoints — adds API key so browser never holds the key
 			mux.HandleFunc("/api/v1/feedback", requireSession(reviewID, func(w http.ResponseWriter, r *http.Request) {
 				handleFeedbackProxy(w, r, *config, verbose, reviewID)
@@ -1842,6 +1850,32 @@ func renderPretty(result *reviewmodel.DiffReviewResponse) error {
 		}
 	}
 
+	if len(result.ToolResults) > 0 {
+		hasFindings := false
+		for _, tr := range result.ToolResults {
+			if len(tr.Findings) > 0 {
+				hasFindings = true
+				break
+			}
+		}
+		if hasFindings {
+			fmt.Println("\nStatic Analysis Tool Results:")
+			for _, tr := range result.ToolResults {
+				for _, f := range tr.Findings {
+					colStr := ""
+					if f.Col > 0 {
+						colStr = fmt.Sprintf(":%d", f.Col)
+					}
+					ruleStr := ""
+					if f.Rule != "" {
+						ruleStr = fmt.Sprintf("  %s", f.Rule)
+					}
+					fmt.Printf("[%s] %s:%d%s%s  %s\n", tr.ToolName, f.File, f.Line, colStr, ruleStr, f.Message)
+				}
+			}
+		}
+	}
+
 	fmt.Println("\n" + strings.Repeat("=", 80))
 	fmt.Printf("Review complete: %d total comment(s)\n", countTotalComments(result.Files))
 	fmt.Println(strings.Repeat("=", 80) + "\n")

internal/appcore/review_state.go

@@ -88,7 +88,7 @@ func (rs *ReviewState) UpdateFromResult(result *reviewmodel.DiffReviewResponse)
 	rs.Status = result.Status
 	rs.Summary = result.Summary
 
-	// Merge comments from result into existing files (preserving hunks)
+	// Merge AI comments from result into existing files (preserving hunks)
 	totalComments := 0
 	for i := range rs.Files {
 		for _, resultFile := range result.Files {
@@ -99,7 +99,37 @@ func (rs *ReviewState) UpdateFromResult(result *reviewmodel.DiffReviewResponse)
 		}
 		totalComments += len(rs.Files[i].Comments)
 	}
+
+	// Inject tool_comments into the files list. Tool findings may reference
+	// files not in the diff (or lines outside hunks) so we handle them
+	// separately from the diff-matched AI comments above.
+	fileIndex := make(map[string]int, len(rs.Files))
+	for i, f := range rs.Files {
+		fileIndex[f.FilePath] = i
+	}
+	for _, tc := range result.ToolComments {
+		comment := reviewmodel.DiffReviewComment{
+			Line:     tc.Line,
+			Content:  tc.Content,
+			Severity: tc.Severity,
+			Category: tc.Category,
+		}
+		if idx, ok := fileIndex[tc.FilePath]; ok {
+			rs.Files[idx].Comments = append(rs.Files[idx].Comments, comment)
+		} else {
+			// File not in diff — create a stub entry so the comment is visible
+			rs.Files = append(rs.Files, reviewmodel.DiffReviewFileResult{
+				FilePath: tc.FilePath,
+				Comments: []reviewmodel.DiffReviewComment{comment},
+			})
+			fileIndex[tc.FilePath] = len(rs.Files) - 1
+		}
+		totalComments++
+	}
+
+
 	rs.TotalComments = totalComments
+	rs.TotalFiles = len(rs.Files)
 }
 
 // SetCompleted marks the review as completed

internal/reviewapi/helpers.go

@@ -144,10 +144,11 @@ func formatJSONParseError(body []byte, contentType string, parseErr error) error
 		parseErr, contentType, preview)
 }
 
-func SubmitReview(apiURL, apiKey, base64Diff, repoName string, verbose bool) (reviewmodel.DiffReviewCreateResponse, error) {
+func SubmitReview(apiURL, apiKey, base64Diff, repoName string, toolsOnly bool, verbose bool) (reviewmodel.DiffReviewCreateResponse, error) {
 	payload := reviewmodel.DiffReviewRequest{
 		DiffZipBase64: base64Diff,
 		RepoName:      repoName,
+		ToolsOnly:     toolsOnly,
 	}
 
 	if verbose {

internal/reviewmodel/types.go

@@ -38,16 +38,28 @@ type APIErrorPayload struct {
 type DiffReviewRequest struct {
 	DiffZipBase64 string `json:"diff_zip_base64"`
 	RepoName      string `json:"repo_name"`
+	ToolsOnly     bool   `json:"tools_only,omitempty"`
+}
+
+// ToolComment is a flat comment from a static analysis tool, including the file path.
+type ToolComment struct {
+	FilePath string `json:"file_path"`
+	Line     int    `json:"line"`
+	Content  string `json:"content"`
+	Severity string `json:"severity"`
+	Category string `json:"category"`
 }
 
 // DiffReviewResponse models the response from GET /api/v1/diff-review/:id.
 type DiffReviewResponse struct {
 	Status       string                 `json:"status"`
 	Summary      string                 `json:"summary,omitempty"`
 	Files        []DiffReviewFileResult `json:"files,omitempty"`
+	ToolComments []ToolComment          `json:"tool_comments,omitempty"`
 	Message      string                 `json:"message,omitempty"`
 	FriendlyName string                 `json:"friendly_name,omitempty"`
 	Envelope     *PlanUsageEnvelope     `json:"envelope,omitempty"`
+	ToolResults  []ToolResultEventData  `json:"tool_results,omitempty"`
 }
 
 type DiffReviewCreateResponse struct {
@@ -90,3 +102,20 @@ type DiffReviewComment struct {
 	Category    string `json:"category"`
 	Subcategory string `json:"subcategory"`
 }
+
+type ToolFinding struct {
+	File    string `json:"file"`
+	Line    int    `json:"line"`
+	Col     int    `json:"col"`
+	Rule    string `json:"rule"`
+	Message string `json:"message"`
+}
+
+type ToolResultEventData struct {
+	ToolID      int64         `json:"tool_id"`
+	ToolName    string        `json:"tool_name"`
+	ExitCode    int           `json:"exit_code"`
+	Findings    []ToolFinding `json:"findings"`
+	LinesOfCode int           `json:"lines_of_code"`
+	Stderr      string        `json:"stderr"`
+}

internal/reviewopts/options.go

@@ -43,6 +43,7 @@ type Options struct {
 	Force                 bool
 	Vouch                 bool
 	InitialMsg            string
+	ToolsOnly             bool
 }
 
 func BuildFromContext(c *cli.Context, includeDebug bool) (Options, error) {
@@ -76,6 +77,7 @@ func BuildFromContext(c *cli.Context, includeDebug bool) (Options, error) {
 		SaveJSON:              c.String("save-json"),
 		SaveText:              c.String("save-text"),
 		InitialMsg:            initialMsg,
+		ToolsOnly:             c.Bool("tools"),
 	}
 
 	if opts.Skip || opts.Vouch {

main.go

@@ -42,6 +42,7 @@ var baseFlags = []cli.Flag{
 	&cli.BoolFlag{Name: "skip", Usage: "mark review as skipped and write attestation without contacting the API", EnvVars: []string{"LRC_SKIP"}},
 	&cli.BoolFlag{Name: "force", Usage: "force rerun by removing existing attestation/hash for current tree", EnvVars: []string{"LRC_FORCE"}},
 	&cli.BoolFlag{Name: "vouch", Usage: "vouch for changes manually without running AI review (records attestation with coverage stats from prior iterations)", EnvVars: []string{"LRC_VOUCH"}},
+	&cli.BoolFlag{Name: "tools", Usage: "run only static analysis tools review, bypassing AI review", EnvVars: []string{"LRC_TOOLS"}},
 }
 
 var debugFlags = []cli.Flag{

network/network_status.md

@@ -72,7 +72,7 @@ This document tracks network-side operations in git-lrc as an auditable inventor
 | Client.DoJSON | api | Request/response JSON payload bytes | Standard JSON HTTP call wrapper | Medium | Medium risk from broad transport usage and status-handling variance | Compensated by centralized transport wrapper with timeout controls; acceptable risk | [network/http_client.go](http_client.go#L43) |
 | Client.Do | api | Raw HTTP request/response bytes | Generic HTTP call wrapper for non-JSON/raw workflows | Medium | Medium risk from raw payload handling flexibility | Partially compensated by shared client boundary; Suggestion: document callsite expectations for raw bodies | [network/http_client.go](http_client.go#L89) |
 | SetupEnsureCloudUserURL | api | Base URL plus endpoint normalization inputs | Normalize endpoint composition and reduce path ambiguity | Medium | Medium risk if normalization logic diverges from endpoint assumptions | Compensated by centralized URL builder utility; acceptable risk | [network/endpoints.go](endpoints.go#L13) |
-| PollReview | api | Review IDs, status payloads, timeout state | Timeout-bounded polling orchestration in review runtime | High | High availability/latency risk if review service is degraded | Compensated by bounded timeout and interval controls; residual risk acceptable | [internal/reviewapi/helpers.go](../internal/reviewapi/helpers.go#L201) |
+| PollReview | api | Review IDs, status payloads, timeout state | Timeout-bounded polling orchestration in review runtime | High | High availability/latency risk if review service is degraded | Compensated by bounded timeout and interval controls; residual risk acceptable | [internal/reviewapi/helpers.go](../internal/reviewapi/helpers.go#L202) |
 | formatJSONParseError | api | Response body text for parse diagnostics | Improve operator diagnostics when endpoint/port mismatches occur | Low | Low risk diagnostic utility behavior | Compensated by safer error interpretation path; acceptable risk | [internal/reviewapi/helpers.go](../internal/reviewapi/helpers.go#L129) |
 
 ## Control Signals For Security Review