feat: add Analysis Mode setting for Security Agent

[kilo-code-bot]

Summary

Adds an analysis_mode setting to the Security Agent configuration that lets users control the depth of vulnerability analysis. Three modes are available:

• Auto (default): Current behavior — triage runs first, sandbox analysis runs only if triage determines it's needed.
• Shallow: Triage only — never proceeds to sandbox analysis, regardless of triage output.
• Deep: Always forces sandbox analysis (leverages the existing forceSandbox mechanism).

Key Design Decisions

• No database migration needed: The analysis_mode field fits inside the existing JSONB config column on agent_configs. The default-merge pattern in getSecurityAgentConfig() means all existing users automatically get 'auto' mode.
• Leverages existing forceSandbox: The deep mode reuses the existing sandbox-forcing mechanism.
• Shallow mode overrides forceSandbox: Even if forceSandbox is explicitly set, shallow mode will never run sandbox analysis.

Changes

Config Schema & Defaults

• Added AnalysisMode type ('auto' | 'shallow' | 'deep') to src/lib/security-agent/core/types.ts
• Added analysis_mode field to SecurityAgentConfigSchema with default 'auto'
• Added AnalysisModeSchema to src/lib/security-agent/core/schemas.ts
• Updated DEFAULT_SECURITY_AGENT_CONFIG in src/lib/security-agent/core/constants.ts

Analysis Pipeline

• Updated startSecurityAnalysis() in src/lib/security-agent/services/analysis-service.ts to accept and respect analysisMode
• Pipeline logic: deep → always sandbox; shallow → never sandbox; auto → respect triage recommendation

API / Routers

• Both security-agent-router.ts (personal) and organization-security-agent-router.ts (org) now:
  • Return analysisMode from getConfig
  • Accept analysisMode in saveConfig
  • Read analysis_mode from config when starting analysis

UI

• Added radio group control in SecurityConfigForm.tsx with three options and descriptive help text
• Wired through SecurityAgentPageClient.tsx

Tracking

• Added analysisMode to PostHog config-saved event

Tests

• Added comprehensive tests for all three modes in analysis-service.test.ts:
  • Auto mode: runs sandbox when triage recommends it
  • Auto mode: skips sandbox when triage says not needed
  • Shallow mode: never runs sandbox even when triage recommends it
  • Shallow mode: never runs sandbox even with forceSandbox
  • Deep mode: always runs sandbox even when triage says not needed
  • Defaults to auto mode when analysisMode is not specified

Rollout

Ships behind existing Security Agent feature flag. Default 'auto' means no behavioral change for existing users.

---

Built for jean by Kilo for Slack

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

This PR cleanly replaces the forceSandbox boolean with a three-value analysisMode enum (auto / shallow / deep). The refactor is consistent across all layers:

• Core types/schemas — AnalysisMode type and Zod schemas added with .default('auto') for backward compatibility
• Analysis service — Decision logic correctly maps modes: deep → always sandbox, shallow → never sandbox, auto → triage-driven
• Routers — Both personal and org routers fetch config unconditionally (needed for analysis_mode) and pass it through correctly
• UI — SecurityConfigForm adds a RadioGroup with clear descriptions; follows existing patterns (as const, as AnalysisMode)
• PostHog tracking — forceSandbox: boolean → analysisMode?: string in event types
• Tests — Good coverage of all three modes plus default behavior
• No migration needed — Config is stored as JSON blob; Zod default handles existing configs

Other Observations (not in diff)

Issues found in unchanged code that cannot receive inline comments:

File	Line	Issue
src/lib/security-agent/services/analysis-service.ts	6	SUGGESTION: Module-level doc comment still says "only if needed or forced" — should be updated to reference analysisMode

Files Reviewed (10 files)

• src/components/security-agent/SecurityAgentPageClient.tsx - 0 issues
• src/components/security-agent/SecurityConfigForm.tsx - 0 issues
• src/lib/security-agent/core/constants.ts - 0 issues
• src/lib/security-agent/core/schemas.ts - 0 issues
• src/lib/security-agent/core/types.ts - 0 issues
• src/lib/security-agent/posthog-tracking.ts - 0 issues
• src/lib/security-agent/services/analysis-service.test.ts - 0 issues
• src/lib/security-agent/services/analysis-service.ts - 0 issues
• src/routers/organizations/organization-security-agent-router.ts - 0 issues
• src/routers/security-agent-router.ts - 0 issues