🗺️ DSO Roadmap - Future Features

This document outlines planned bonus features that can be implemented in ~1 hour each.

1. `dso pr` - Automated Pull Request Creation

Estimated Time: ~1 hour Priority: High Status: Planned

Description

Automatically create a GitHub Pull Request with security fixes applied by DSO.

Features

Detect fixes applied by dso fix --auto
Create a new branch with fixes
Generate PR description with:
Summary of fixes applied
Security findings addressed
Before/after comparisons
Use GitHub CLI (gh) or GitHub API
Support for GitHub and GitLab

Implementation Plan

Step 1: Detect Applied Fixes (15 min)

// internal/pr/creator.go
type FixSummary struct {
 File string
 Line int
 Fix string
 Finding scanner.Finding
}

func CollectAppliedFixes(projectPath string) ([]FixSummary, error)

Step 2: Create Branch & Commit (15 min)

func CreateFixBranch(baseBranch string) (string, error)
func CommitFixes(branch string, fixes []FixSummary) error

Step 3: Generate PR Description (15 min)

func GeneratePRDescription(fixes []FixSummary, results *scanner.ScanResults) string

Step 4: Create PR via GitHub CLI/API (15 min)

// Use gh CLI or GitHub API
func CreatePR(title, body, baseBranch, headBranch string) (string, error)

Usage

bash

# Auto-fix and create PR
dso audit . --fix --pr

# Or explicitly
dso pr --base main --title "Security fixes from DSO audit"

Dependencies

GitHub CLI (gh) - brew install gh / apt install gh
Or GitHub API token in GITHUB_TOKEN env var

Example PR Description

markdown

## Security Fixes by DSO

This PR addresses **3 critical** and **5 high** severity security issues.

### Fixed Issues
- Removed hardcoded AWS key from `config/secrets.go:42`
- Updated vulnerable dependency `lodash@4.17.20` → `4.17.21`
- Fixed SQL injection in `api/users.go:89`

### Summary
- **Files changed:** 3
- **Fixes applied:** 8
- **Severity:** 3 Critical, 5 High

Generated by [DSO](https://github.com/dso-cli/dso-cli)

2. `dso watch` - Real-time Monitoring with Notifications

Estimated Time: ~1 hour Priority: Medium Status: Planned

Description

Continuously monitor the repository and send notifications to Slack/Teams when new security issues are detected.

Features

Watch mode with configurable interval
Slack webhook integration
Microsoft Teams webhook integration
Email notifications (optional)
Only notify on new findings (not duplicates)
Configurable severity thresholds

Implementation Plan

Step 1: Notification Backends (20 min)

// internal/notify/notifier.go
type Notifier interface {
 Send(notification Notification) error
}

type Notification struct {
 Title string
 Message string
 Severity string
 Findings []scanner.Finding
 ProjectPath string
}

// Slack implementation
type SlackNotifier struct {
 WebhookURL string
}

// Teams implementation
type TeamsNotifier struct {
 WebhookURL string
}

Step 2: Watch Mode Enhancement (20 min)

// cmd/watch.go - enhance existing watch command
func watchWithNotifications(path string, interval time.Duration, notifiers []Notifier) {
 lastResults := &scanner.ScanResults{}
 
 for {
 results := scanner.RunFullScan(path)
 newFindings := findNewFindings(lastResults, results)
 
 if len(newFindings) > 0 {
 notification := Notification{
 Title: "🚨 New Security Issues Detected",
 Findings: newFindings,
 // ...
 }
 
 for _, notifier := range notifiers {
 notifier.Send(notification)
 }
 }
 
 lastResults = results
 time.Sleep(interval)
 }
}

Step 3: Configuration (20 min)

// ~/.dso/notify.yaml
slack:
 webhook_url: "https://hooks.slack.com/services/..."
 enabled: true
 severity_threshold: "high" # only notify on high/critical

teams:
 webhook_url: "https://outlook.office.com/webhook/..."
 enabled: true

Usage

bash

# Watch with Slack notifications
dso watch . --slack-webhook $SLACK_WEBHOOK

# Watch with Teams notifications
dso watch . --teams-webhook $TEAMS_WEBHOOK

# Watch with both
dso watch . --notify slack,teams

# Configure in ~/.dso/notify.yaml
dso watch . --notify-config ~/.dso/notify.yaml

Slack Message Format

json

{
 "text": "🚨 New Security Issues Detected",
 "blocks": [
 {
 "type": "section",
 "text": {
 "type": "mrkdwn",
 "text": "*3 new critical issues* found in `my-project`"
 }
 },
 {
 "type": "section",
 "fields": [
 {"type": "mrkdwn", "text": "*File:* `config/secrets.go`"},
 {"type": "mrkdwn", "text": "*Line:* 42"},
 {"type": "mrkdwn", "text": "*Issue:* Hardcoded AWS key"}
 ]
 }
 ]
}

Teams Message Format

json

{
 "@type": "MessageCard",
 "summary": "Security Alert",
 "sections": [{
 "activityTitle": "🚨 New Security Issues",
 "facts": [
 {"name": "Project", "value": "my-project"},
 {"name": "Critical", "value": "3"},
 {"name": "High", "value": "5"}
 ]
 }]
}

3. Support for Gemini/Claude API

Estimated Time: ~1 hour Priority: Low (Ollama is sufficient for most users) Status: Planned

Description

Add support for cloud-based AI models (Google Gemini, Anthropic Claude) for users who want more powerful analysis or don't want to run Ollama locally.

Features

Google Gemini API integration
Anthropic Claude API integration
Fallback to Ollama if API fails
Configurable via environment variables
Cost estimation/warnings

Implementation Plan

Step 1: AI Provider Interface (15 min)

// internal/llm/provider.go
type AIProvider interface {
 Analyze(results *scanner.ScanResults, projectPath string) (*Analysis, error)
 Name() string
 IsAvailable() bool
}

// Existing Ollama implementation
type OllamaProvider struct { ... }

// New Gemini implementation
type GeminiProvider struct {
 APIKey string
 Model string // gemini-pro, gemini-pro-vision
}

// New Claude implementation
type ClaudeProvider struct {
 APIKey string
 Model string // claude-3-opus, claude-3-sonnet, claude-3-haiku
}

Step 2: Gemini Integration (20 min)

// internal/llm/gemini.go
func (p *GeminiProvider) Analyze(results *scanner.ScanResults, projectPath string) (*Analysis, error) {
 prompt := buildAnalysisPrompt(results, projectPath)
 
 req := &gemini.Request{
 Contents: []gemini.Content{
 {Parts: []gemini.Part{{Text: prompt}}},
 },
 }
 
 resp, err := p.client.GenerateContent(ctx, req)
 // Parse response...
}

Step 3: Claude Integration (20 min)

// internal/llm/claude.go
func (p *ClaudeProvider) Analyze(results *scanner.ScanResults, projectPath string) (*Analysis, error) {
 prompt := buildAnalysisPrompt(results, projectPath)
 
 resp, err := p.client.Messages.Create(context.Background(), &claude.MessagesCreateParams{
 Model: p.Model,
 Messages: []claude.Message{
 {Role: "user", Content: prompt},
 },
 })
 // Parse response...
}

Step 4: Provider Selection Logic (5 min)

// internal/llm/factory.go
func NewAIProvider() (AIProvider, error) {
 // Priority: ENV var > Config > Default (Ollama)
 
 if apiKey := os.Getenv("GEMINI_API_KEY"); apiKey != "" {
 return NewGeminiProvider(apiKey), nil
 }
 
 if apiKey := os.Getenv("CLAUDE_API_KEY"); apiKey != "" {
 return NewClaudeProvider(apiKey), nil
 }
 
 // Default to Ollama
 return NewOllamaClient(), nil
}

Usage

bash

# Use Gemini
export GEMINI_API_KEY="your-key"
dso audit . --ai gemini

# Use Claude
export CLAUDE_API_KEY="your-key"
dso audit . --ai claude

# Use Ollama (default)
dso audit . --ai ollama

# Auto-detect (try Gemini → Claude → Ollama)
dso audit . --ai auto

Configuration

yaml

# ~/.dso/config
AI_PROVIDER=gemini # or claude, ollama
GEMINI_API_KEY=your-key
CLAUDE_API_KEY=your-key
GEMINI_MODEL=gemini-pro
CLAUDE_MODEL=claude-3-sonnet

Cost Estimation

// Warn user about API costs
func EstimateCost(provider string, tokenCount int) {
 switch provider {
 case "gemini":
 cost := float64(tokenCount) / 1000 * 0.0005 // $0.50 per 1M tokens
 fmt.Printf(" Estimated cost: $%.2f\n", cost)
 case "claude":
 cost := float64(tokenCount) / 1000 * 0.003 // $3 per 1M tokens
 fmt.Printf(" Estimated cost: $%.2f\n", cost)
 }
}

Dependencies

// go.mod additions
require (
 github.com/google/generative-ai-go v0.5.0 // Gemini
 github.com/anthropics/anthropic-sdk-go v1.0.0 // Claude
)

Implementation Priority

dso pr - High priority (automates workflow)
dso watch - Medium priority (nice to have)
Gemini/Claude - Low priority (Ollama is sufficient)

Notes

Each feature can be implemented independently
All features maintain backward compatibility
Configuration files use YAML for flexibility
Error handling and fallbacks are important for production use

Author: Ismail MOUYAHADA Last Updated: 2024

🗺️ DSO Roadmap - Future Features ​

1. dso pr - Automated Pull Request Creation ​

Description ​

Features ​

Implementation Plan ​

Step 1: Detect Applied Fixes (15 min) ​

Step 2: Create Branch & Commit (15 min) ​

Step 3: Generate PR Description (15 min) ​

Step 4: Create PR via GitHub CLI/API (15 min) ​

Usage ​

Dependencies ​

Example PR Description ​

2. dso watch - Real-time Monitoring with Notifications ​

Description ​

Features ​

Implementation Plan ​

Step 1: Notification Backends (20 min) ​

Step 2: Watch Mode Enhancement (20 min) ​

Step 3: Configuration (20 min) ​

Usage ​

Slack Message Format ​

Teams Message Format ​

3. Support for Gemini/Claude API ​

Description ​

Features ​

Implementation Plan ​

Step 1: AI Provider Interface (15 min) ​

Step 2: Gemini Integration (20 min) ​

Step 3: Claude Integration (20 min) ​

Step 4: Provider Selection Logic (5 min) ​

Usage ​

Configuration ​

Cost Estimation ​

Dependencies ​

Implementation Priority ​

Notes ​

🗺️ DSO Roadmap - Future Features

1. `dso pr` - Automated Pull Request Creation

Description

Features

Implementation Plan

Step 1: Detect Applied Fixes (15 min)

Step 2: Create Branch & Commit (15 min)

Step 3: Generate PR Description (15 min)

Step 4: Create PR via GitHub CLI/API (15 min)

Usage

Dependencies

Example PR Description

2. `dso watch` - Real-time Monitoring with Notifications

Description

Features

Implementation Plan

Step 1: Notification Backends (20 min)

Step 2: Watch Mode Enhancement (20 min)

Step 3: Configuration (20 min)

Usage

Slack Message Format

Teams Message Format

3. Support for Gemini/Claude API

Description

Features

Implementation Plan

Step 1: AI Provider Interface (15 min)

Step 2: Gemini Integration (20 min)

Step 3: Claude Integration (20 min)

Step 4: Provider Selection Logic (5 min)

Usage

Configuration

Cost Estimation

Dependencies

Implementation Priority

Notes