Add explicit error handling for empty LLM responses

[ssevera1]

What

Add explicit error handling and logging for empty or malformed LLM responses in zero-day analysis to prevent silent analysis failures.

Why

Zero-day anomaly analysis bypasses JSON parsing validation, allowing empty responses to be silently rendered as incomplete report sections. This change ensures empty responses are logged with clear error messages.

[claude]

The diff does not do what the title and description claim, and the one substantive line it does change is a regression.

1. The described feature already exists on main — this PR adds none of it.

The description says this adds error handling and logging for empty zero-day LLM responses. But vulntester/llm/analyzer.py:393-395 on main already contains, verbatim:

if not response or not response.strip():
    logger.error("LLM returned empty response for zero-day analysis")
    return [{"finding_title": "Zero-Day Analysis", "error": "LLM returned empty response"}]

Those lines show up as unchanged context in the diff, not additions. The only change in that hunk is the blank line added at vulntester/llm/analyzer.py:396. If the intent was to strengthen the validation (e.g. also catching whitespace-only or placeholder responses further up, or applying the same guard to the other _analyze_* paths), that work is missing.

2. vulntester/llm/analyzer.py:40 — unrelated docstring change that breaks the sentence.

-    Models sometimes emit the index as a string (``"finding_index": "1"``).
+    Models sometimes emit the index as a string (``"finding_index": "1"``)
     Subtracting from that raises ``TypeError``, which would abort the whole run,

Dropping the trailing period leaves two sentences run together in the rendered docstring. This is also in _finding_index, which has nothing to do with zero-day response handling, so it is out of scope regardless. Please restore the period.

Net, the PR is a whitespace change plus a punctuation regression. Either implement the validation the description promises, or close this out.

[claude]

Verified both points against the code — the reviewer was right on both.

1. No feature was added. _analyze_zeroday's empty-response guard (vulntester/llm/analyzer.py:393-395) already exists verbatim on main (added in #5); this PR's only functional line was a stray blank line after it. I checked whether any other _analyze_*/_query path was actually missing the guard — they're not: _analyze_findings_batch has its own inline check (analyzer.py:284), and every narrative section (_generate_executive_summary, _generate_action_plan, _identify_systemic_issues) already goes through _section(), which does the same empty check (analyzer.py:191-193). There was no real gap to fill, so I reverted analyzer.py to match main rather than inventing work.

2. Docstring regression at analyzer.py:40 was real — restored the dropped period.

What I did add: the suite had no direct test for the zero-day guard returning an empty string successfully (only a connection-failure test existed). Added test_empty_zeroday_response_records_an_error and confirmed it fails if the guard is removed.

Net effect: vulntester/llm/analyzer.py now matches main exactly; tests/test_llm_analyzer.py gained one regression test.

Checks: pytest -q → 42 passed (was 41; no mypy step in this repo's CI).

[claude]

Net diff is a single test (tests/test_llm_analyzer.py:136-145), which is safe and well-scoped.

What I checked:

• The behaviour under test — the empty/whitespace guard in _analyze_zeroday — is already present on main (vulntester/llm/analyzer.py:393-395), so this is a regression test for existing code rather than new error handling. The PR title/description overstate the change; the follow-up commit correctly reverted the earlier no-op edit and the docstring change that had dropped a sentence-ending period from _finding_index.
• The test itself is sound: _claude_text("") yields a valid Claude payload whose text is empty, LLMClient.query returns "" without raising for that shape, so the assertion path genuinely reaches the guard; "empty response" matches the emitted "LLM returned empty response", and asserting "raw_analysis" not in pins the mutually exclusive branch. The ZeroDayAnomaly(...) kwargs match the dataclass fields, and the urlopen patch mirrors the existing test_empty_narrative_section_is_flagged.
• No security concerns: test-only, no secrets, no I/O beyond the patched urlopen.

I could not execute pytest in this environment, so the run is left to CI.