/plamen-wizard

description: "Plamen v2 Smart Contract audit wizard. Collects config, launches deterministic driver."

Plamen v2 — Smart Contract Audit Wizard

> This wizard collects audit parameters and launches `plamen_driver.py`. > The driver handles ALL phase sequencing deterministically — no LLM orchestration.

Step 1: Banner

Output:

██████╗ ██╗      █████╗ ███╗   ███╗███████╗███╗   ██╗
██╔══██╗██║     ██╔══██╗████╗ ████║██╔════╝████╗  ██║
██████╔╝██║     ███████║██╔████╔██║█████╗  ██╔██╗ ██║
██╔═══╝ ██║     ██╔══██║██║╚██╔╝██║██╔══╝  ██║╚██╗██║
██║     ███████╗██║  ██║██║ ╚═╝ ██║███████╗██║ ╚████║
╚═╝     ╚══════╝╚═╝  ╚═╝╚═╝     ╚═╝╚══════╝╚═╝  ╚═══╝

**Web3 Security Auditor** v2.2.4 — Deterministic Driver

Then run the toolchain probe:

export PATH="$HOME/.foundry/bin:$HOME/.local/share/solana/install/active_release/bin:$HOME/.avm/bin:$HOME/.cargo/bin:$HOME/.aptoscli/bin:$HOME/.local/bin:$HOME/go/bin:$PATH" && \
echo "Toolchain:" && \
echo -n "  Required: " && \
(command -v claude >/dev/null 2>&1 && echo -n "claude " || echo -n "MISSING:claude ") && \
(command -v python >/dev/null 2>&1 && echo -n "python " || (command -v python3 >/dev/null 2>&1 && echo -n "python " || echo -n "MISSING:python ")) && \
(command -v git >/dev/null 2>&1 && echo -n "git" || echo -n "MISSING:git") && echo "" && \
echo -n "  EVM:      " && \
(command -v forge >/dev/null 2>&1 && echo -n "forge " || echo -n "-forge ") && \
(command -v slither >/dev/null 2>&1 && echo -n "slither " || echo -n "-slither ") && \
(command -v medusa >/dev/null 2>&1 && echo -n "medusa" || echo -n "-medusa") && echo "" && \
echo -n "  Solana:   " && \
(command -v solana >/dev/null 2>&1 && echo -n "solana " || echo -n "-solana ") && \
(command -v anchor >/dev/null 2>&1 && echo -n "anchor " || echo -n "-anchor ") && \
(command -v trident >/dev/null 2>&1 && echo -n "trident" || echo -n "-trident") && echo "" && \
echo -n "  Move:     " && \
(command -v aptos >/dev/null 2>&1 && echo -n "aptos " || echo -n "-aptos ") && \
(command -v sui >/dev/null 2>&1 && echo -n "sui" || echo -n "-sui") && echo "" && \
echo -n "  Soroban:  " && \
(command -v stellar >/dev/null 2>&1 && echo -n "stellar " || echo -n "-stellar ") && \
(cargo scout-audit --version >/dev/null 2>&1 && echo -n "scout" || echo -n "-scout") && echo ""

Step 1.5: Detect Existing Audit

Before collecting config, check if an existing audit can be resumed. Search for `.scratchpad/config.json` in the current directory (or the path from `$ARGUMENTS` if provided):

# Check cwd and common patterns
if [ -f ".scratchpad/config.json" ]; then echo "FOUND:.scratchpad/config.json"
elif [ -f "src/.scratchpad/config.json" ]; then echo "FOUND:src/.scratchpad/config.json"
elif [ -f "contracts/.scratchpad/config.json" ]; then echo "FOUND:contracts/.scratchpad/config.json"
else echo "NONE"; fi

If a config is found, read the checkpoint file (`_v2_checkpoint.json` in that scratchpad) to determine progress, then offer:

AskUserQuestion(questions=[{
  question: "Existing audit detected. What would you like to do?",
  header: "Existing Audit Found",
  options: [
    { label: "Resume", description: "Continue from last checkpoint ({LAST_PHASE} → next)" },
    { label: "Fresh restart", description: "Wipe scratchpad and start over" },
    { label: "New audit", description: "Ignore existing, configure a new target" }
  ]
}])

• **Resume**: Skip to Step 3's launch section — use the existing `config.json` path directly. Launch with `run_in_background: true`.
• **Fresh restart**: Launch with `--fresh` flag. Skip to Step 3's launch section.
• **New audit**: Fall through to Step 2 (collect config normally).

If no config found, fall through to Step 2.

Step 2: Collect Configuration

Ask these questions using AskUserQuestion. Parse `$ARGUMENTS` first for shortcuts (`light`, `core`, `thorough`, `compare`, path arguments).

**Q1: Mode**

AskUserQuestion(questions=[{
  question: "Which audit mode?",
  header: "Mode",
  multiSelect: false,
  options: [
    { label: "Light (Pro plan)", description: "~18-22 Sonnet agents. Fast, fits Pro rate limits." },
    { label: "Core (Recommended)", description: "~30-50 agents (Max plan). Standard audit depth." },
    { label: "Thorough", description: "~40-100 agents (Max plan). Iterative depth, fuzz, skeptic-judge." },
    { label: "Compare", description: "Diff a past report against ground truth." }
  ]
}])

If "Compare" is selected, inform the user that compare mode is not yet ported to v2 and they should use `/plamen compare` with the v1 pipeline. Stop here.

**Q2: Target project**

AskUserQuestion(questions=[{
  question: "Is this the project to audit?",
  header: "Target",
  options: [
    { label: "Yes, use current directory", description: "{cwd}" },
    { label: "No, let me specify", description: "I'll provide a path" }
  ]
}])

If "No", ask for the path.

**Q3: Documentation**

AskUserQuestion(questions=[{
  question: "Do you have project docs with trust roles or actor permissions?",
  header: "Docs",
  options: [
    { label: "No docs", description: "Trust roles inferred from code" },
    { label: "Yes, local files", description: "Whitepaper/spec with trust info" },
    { label: "Yes, a URL", description: "Link to docs" }
  ]
}])

If local files or URL, ask for the path/URL.

**Q4: Scope**

AskUserQuestion(questions=[{
  question: "Limit the audit scope?",
  header: "Scope",
  options: [
    { label: "Full project", description: "Audit everything" },
    { label: "Scope file", description: "I have a scope.txt" },
    { label: "Scope notes", description: "I'll describe focus areas" }
  ]
}])

If scope file or notes, collect them.

**Q5: Proven-only mode**

AskUserQuestion(questions=[{
  question: "Enable proven-only mode? (unproven findings capped at Low)",
  header: "Proven-Only",
  options: [
    { label: "No (default)", description: "Standard severity rules" },
    { label: "Yes", descrip