[AlexSanchez-bit]

No description provided.

[github-actions]

🛑 AI review — Sensitive area, extra care recommended

This PR touches critical paths or introduces changes the model cannot judge with sufficient confidence. Review carefully before merging.

🛑 architecture (silas-1.7-pro) — high/critical — please review

Summary: Adds threat-intel analyst conversation persistence with a new GORM model/schema and frontend store migration; needs schema/rollout review.

• high backend/database/migrations.go:72 — Registering AnalystConversation in Models() changes the persisted schema through the migration path. Ensure the GORM auto-migration is safe for production, additive, and has a tested roll-forward/rollback plan.
• medium backend/modules/threatintel/domain/analyst_conversation.go:16 — Client-generated string ID is the global primary key while tenant/user scoping is only enforced in queries. Use a server-generated UUID or composite primary key (tenant_id, id) to avoid cross-tenant collisions and ID guessing.
• medium backend/modules/threatintel/domain/analyst_conversation.go:19 — Unique index on (tenant_id, title) prevents two users in the same tenant from having conversations with the same title. If title uniqueness is intended per user, include user_id in the unique index.
• medium backend/modules/threatintel/module.go:27 — ThreatIntel module now couples to *gorm.DB and conditionally registers analyst routes when db is nil. This makes the HTTP contract environment-dependent; prefer an explicit feature flag or always require the DB for this module.
• medium backend/modules/threatintel/handler/analyst.go:82 — Create accepts and persists the caller-supplied conversation ID without validation beyond non-empty. Validate length/charset or generate the ID server-side to avoid primary-key conflicts and malformed persisted IDs.
• low backend/modules/threatintel/handler/analyst.go:112 — Update treats store.Get database errors as 500 without audit, while not-found is audited. Audit or distinguish infrastructure failures consistently.
• low frontend/src/features/threat-intel/console/store.ts:104 — initConsoleStore performs a one-time localStorage-to-backend migration in app code and can race across tabs or duplicate if backend state changes. Make migration idempotent (upsert by ID) or move it to a server-side migration.
• low frontend/src/features/threat-intel/console/agent.ts:34 — Module-level stepCounter is new mutable global state. Use a per-run counter or UUID to keep agent execution state isolated.
• low frontend/src/features/threat-intel/console/markdown.tsx:1 — A custom markdown parser is introduced under the console feature. Check whether shared/ already provides markdown rendering to avoid duplicating UI logic.
• medium frontend/src/features/threat-intel/lib/casework.ts:1 — New frontend casework client calls threat-intel proxy endpoints for cases, watchlists, alerts, and report association that are not introduced in this diff. Confirm these are existing tenant-scoped contracts or add the corresponding server routes.

🛑 bugs (silas-1.7-pro) — high/critical — please review

Summary: Compaction summary is silently discarded before being sent to the model; casework API endpoints are called but never registered in backend routes.

• high frontend/src/features/threat-intel/console/agent.ts:1145 — Compaction summary is discarded. compacted.messages is [system_prompt, summary, ...retained], but slice(2) skips both the system prompt AND the summary, so convo only contains the retained recent turns. The summary is never included in requestMessages, meaning the model loses all condensed context from older turns. Fix: use slice(1) to keep the summary, or explicitly push compacted.messages[1] into convo before the retained messages.
• high frontend/src/features/threat-intel/lib/casework.ts:72 — All casework endpoints (/cases, /watchlists, /alerts, /report/association) are called via proxyFetch but no corresponding routes are registered in backend/modules/threatintel/routes.go. Every casework tool (list_cases, create_case, pin_to_case, add_case_note, list_watchlists, create_watchlist, add_watchlist_item, list_alerts, link_entities) will return 404 at runtime. The backend needs these routes implemented, or the tools should be removed/guarded.
• medium backend/modules/threatintel/domain/analyst_conversation.go:14 — Composite unique index idx_ti_analyst_conv_tenant_id on (tenant_id, title) prevents two conversations from sharing a title within the same tenant. The frontend auto-creates conversations with the default title "New conversation", so a second conversation with that title will fail with a unique-constraint violation (500). The frontend then falls back to localStorage, but the conversation is lost on next refresh if other backend conversations exist (migration only triggers on empty backend list). Consider removing the unique constraint on title or making titles unique per user.
• low backend/modules/threatintel/handler/analyst.go:143 — Delete handler returns 200 OK even when no rows are affected (conversation not found or belongs to a different user). GORM's Delete returns nil error with RowsAffected=0 for no-match. Should check Result.RowsAffected and return 404 when zero, to distinguish 'deleted' from 'not found'.
• low frontend/src/shared/i18n/locales/fr.json:6072 — Multiple typos in French translation: "Signale" → "Signalé", "partage" → "partagé", "L ingestion" → "L'ingestion" (missing apostrophe), "immediatement" → "immédiatement", "rechercheable" → "recherchable". Also line 6073: "enregistre" → "enregistré", "inferable" → "inférable".
• low frontend/src/shared/i18n/locales/it.json:6072 — Typos in Italian translation: "L ingestione" → "L'ingestione" (missing apostrophe), "e asincrona" → "è asincrona" (missing accent on è).
• low frontend/src/shared/i18n/locales/pt.json:6072 — Typos in Portuguese translation: "ingestao" → "ingestão", "e assincrona" → "é assíncrona", "nao" → "não", "pesquisavel" → "pesquisável". Also line 6073: "Nao" → "Não", "nao" → "não", "inferivel" → "inferível".
• low frontend/src/shared/i18n/locales/ru.json:6098 — Typo in Russian translation: "ищется" is not a valid Russian word. Should be "находится" (is found) or "индексируется" (is indexed) depending on intended meaning.

🛑 security (silas-1.7-pro) — high/critical — please review

Summary: New authenticated CRUD endpoints for analyst conversations expand the auth-protected API surface; no vulnerabilities identified, human review recommended.

No findings.

🔴 go-deps — pending updates

🔍 Discovered 31 Go projects

📦 Dependencies with updates available:

  📁 ./plugins/gcp:
     - google.golang.org/api: v0.305.0 → v0.308.0

  📁 ./plugins/aws:
     - github.com/aws/aws-sdk-go-v2: v1.47.3 → v1.47.4
     - github.com/aws/aws-sdk-go-v2/config: v1.33.9 → v1.33.10
     - github.com/aws/aws-sdk-go-v2/credentials: v1.20.9 → v1.20.10
     - github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs: v1.90.0 → v1.90.2

  📁 ./backend:
     - github.com/aws/aws-sdk-go-v2/config: v1.33.9 → v1.33.10
     - github.com/aws/aws-sdk-go-v2/credentials: v1.20.9 → v1.20.10
     - github.com/aws/aws-sdk-go-v2/service/sts: v1.51.4 → v1.51.5
     - google.golang.org/api: v0.305.0 → v0.308.0

  📁 ./tools/rulecheck:
     - github.com/threatwinds/go-sdk: v1.1.31 → v1.1.38

  📁 ./agent-manager:
     - github.com/threatwinds/go-sdk: v1.1.31 → v1.1.38

  📁 ./log-input:
     - github.com/threatwinds/go-sdk: v1.1.31 → v1.1.38

  📁 ./agent:
     - github.com/threatwinds/go-sdk: v1.1.28 → v1.1.38

  📁 ./collectors/utmstack:
     - github.com/threatwinds/go-sdk: v1.1.31 → v1.1.38

  📁 ./collectors/forwarder:
     - github.com/threatwinds/go-sdk: v1.1.31 → v1.1.38

  📁 ./collectors/as400:
     - github.com/threatwinds/go-sdk: v1.1.31 → v1.1.38

❌ Please update dependencies before merging.