Patching

​

Overview

• Automated patch generation for security vulnerabilities
• Code analysis and dataflow understanding
• Lint, type-check, and test verification
• Sandbox support for isolated patching
• Pull request metadata generation
• Multiple file change support

​

runPatchingAgent

1. Analyze: Read and understand the vulnerability details
2. Locate: Find the vulnerable code in the codebase
3. Research: Understand the context and dataflow
4. Patch: Generate and apply appropriate fixes
5. Verify: Run lints, type-checks, and tests
6. Document: Prepare PR metadata with changes

import { runPatchingAgent } from '@pensar/apex/api/patching';

const result = await runPatchingAgent({
  cwd: '/path/to/project',
  vulnerability: {
    name: 'SQL Injection in User Search',
    severity: 'HIGH',
    description: 'User input is directly concatenated into SQL query',
    location: 'src/controllers/userController.ts',
    startLineNumber: 42,
    endLineNumber: 45,
  },
  model: 'claude-sonnet-4-20250514',
  session: sessionInfo,
});

console.log(`Patched ${result.filesChanged.length} files`);
console.log(`PR Title: ${result.prTitle}`);

​

Parameters

​

Response

​

Usage Examples

import { runPatchingAgent } from '@pensar/apex/api/patching';
import { createSession } from '@pensar/apex/session';

const session = await createSession({
  name: 'Patch SQLi',
  targets: [],
});

const result = await runPatchingAgent({
  cwd: '/home/user/projects/my-app',
  vulnerability: {
    name: 'SQL Injection in User Search',
    severity: 'HIGH',
    description: 'User input from search parameter is directly ' +
                 'concatenated into SQL query without sanitization',
    location: 'src/controllers/userController.ts',
    startLineNumber: 42,
    endLineNumber: 45,
    cweMapping: ['CWE-89'],
  },
  model: 'claude-sonnet-4-20250514',
  session,
});

console.log(`Patched ${result.filesChanged.length} files:`);
result.filesChanged.forEach((file) => {
  console.log(`  ${file.filePath}: ${file.changesDescription}`);
});

console.log(`\nPR Title: ${result.prTitle}`);
console.log(`\nPR Description:\n${result.prDescription}`);

​

Patching Capabilities

​

Code Analysis

• Read and understand complex codebases
• Trace dataflow through functions and modules
• Identify input validation gaps
• Understand framework-specific patterns
• Analyze dependencies and imports

​

Patch Generation

• Input validation: Add sanitization and validation
• Parameterized queries: Convert to prepared statements
• Output encoding: Add HTML/URL/SQL escaping
• Access control: Add authorization checks
• Cryptographic fixes: Upgrade weak algorithms
• Configuration hardening: Fix insecure defaults

​

Verification

1. Runs linters to ensure code quality
2. Executes type checkers (TypeScript, mypy, etc.)
3. Runs existing test suites
4. Verifies the vulnerability is resolved
5. Ensures no regressions introduced

​

Best Practices

​

Provide Detailed Context

• Include precise line numbers
• Provide CWE mappings
• Include PoC scripts when available
• Add dataflow analysis if available

​

Review Generated Patches

• Verify the fix addresses the root cause
• Check for edge cases
• Ensure coding standards are met
• Validate test coverage

​

Use Sandboxes for Safety

• Always use sandbox isolation
• Never patch production code directly
• Test patches in staging first

​

Related APIs