[VW-334] add missing cvssScore, cvssVector in extracted and pass to LLM, fix typo in remediation

[perrydev17]

Jira ticket: https://northeastern-patch.atlassian.net/browse/VW-334 and https://northeastern-patch.atlassian.net/browse/VW-335

While Testing, I found a bug where updates to existing Vulnerability records were not working correctly. The issue was caused by cvssScore and cvssVector not being included in the renderCandidate function, preventing those extracted values from being passed to LLM for comparison during the update workflow

Summary by CodeRabbit

• Bug Fixes
  • Improved matching for asset records so serial numbers are handled more accurately.
  • Updated candidate details used in matching to include more complete vulnerability information and better-structured asset identifiers.
  • Refined remediation labeling in matching output for more consistent results.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
viper	Ready	Preview, Comment	Jul 7, 2026 2:40pm

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
viper-demo	Ignored		Jul 7, 2026 2:40pm

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: cc13358b-db7a-4b3c-9b14-54f669ef0ea0

📥 Commits

Reviewing files that changed from the base of the PR and between 9c597ef and 9b19051.

📒 Files selected for processing (1)

• src/features/inbox/agent/match.ts

🚧 Files skipped from review as they are similar to previous changes (1)

• src/features/inbox/agent/match.ts

---

📝 Walkthrough

Walkthrough

This PR updates prompt strings used by renderCandidates for vulnerability, remediation, and asset matching. It adds CVSS and asset identity fields to extracted summaries, changes candidate row formatting, and fixes the asset serialNumber source.

Changes

Match Prompt Text Updates

Layer / File(s)	Summary
Vulnerability candidate prompt fields src/features/inbox/agent/match.ts	Extracted vulnerability line now includes CVSS score and vector; candidate rows show id, CVE id, CVSS score, and CVSS vector instead of description.
Remediation prompt label formatting src/features/inbox/agent/match.ts	Extracted remediation line label text is adjusted while referencing the same underlying values.
Asset candidate prompt fields and serialNumber fix src/features/inbox/agent/match.ts	Extracted asset line now includes IP/hostname/mac/serial, and candidate row serialNumber is corrected to source from the candidate record instead of the extracted asset.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• PATCH-UPGRADE/viper#147: Both PRs modify the same renderCandidates prompt text in src/features/inbox/agent/match.ts for vulnerability, remediation, and asset candidate rendering.

Suggested reviewers: 0xcad

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately reflects the main vulnerability prompt fix and remediation typo correction, though it omits the asset serialNumber change.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch vw-334-vw-335

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/features/inbox/agent/match.ts`:
- Line 164: The template literal in the remediations log line is broken in
match.ts: the fallback for e.description is outside the interpolation, so the
prompt text becomes garbled. Fix the line in the remediation extraction loop by
moving the nullish-coalescing fallback inside the ${...} expression for
description, matching the existing linkedCveId pattern, so the generated string
cleanly falls back to "?" when e.description is nullish.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: be017ace-f59a-4026-b1bb-a4753e484372

📥 Commits

Reviewing files that changed from the base of the PR and between 62e1ede and 9c597ef.

📒 Files selected for processing (1)

• src/features/inbox/agent/match.ts

[0xcad]

Approve with one note on change you can make