agent-bober 0.18.0 → 0.19.0

package/dist/orchestrator/security-knowledge/diff-provider.js

@@ -0,0 +1,320 @@
+import { execa } from "execa";
+import { Buffer } from "node:buffer";
+import { logger } from "../../utils/logger.js";
+import { getGraphState, getGraphDeps } from "../tools/index.js";
+export const EMPTY_DIFF = { changedFiles: [], neighborhoodFiles: [], truncated: false };
+// bober: caps mirror security-scanners.ts's MAX_SCANNER_BUFFER rationale —
+// an unbounded diff (huge rewrite, vendored-file commit) cannot blow the
+// auditor prompt or exhaust memory; it degrades to truncated:true instead.
+const MAX_CHANGED_FILES = 60;
+const MAX_HUNK_BYTES = 256 * 1024; // total across all hunks
+const DIFF_CONTEXT_LINES = 3;
+const MAX_GIT_BUFFER = 1024 * 1024 * 10;
+/**
+ * Default runner: wraps execa with the EXACT options used by
+ * `security-scanners.ts`'s `defaultRunner` (cancelSignal ties the child's
+ * lifetime to the shared audit AbortSignal, SIGKILL on cancel/abort,
+ * `reject: false` so a missing `git` binary or nonzero exit resolves
+ * normally instead of throwing).
+ */
+const defaultGitRunner = async (args, opts) => {
+    const result = await execa("git", args, {
+        cwd: opts.cwd,
+        cancelSignal: opts.signal,
+        killSignal: "SIGKILL",
+        reject: false,
+        all: true,
+        maxBuffer: MAX_GIT_BUFFER,
+        env: { ...process.env, FORCE_COLOR: "0" },
+    });
+    return {
+        exitCode: result.exitCode,
+        stdout: result.all ?? result.stdout ?? "",
+        failed: result.failed,
+    };
+};
+// ── baseRef resolution (merge-base w/ default branch, HEAD~1 fallback) ──
+async function resolveDefaultBranchRef(runner, cwd, signal) {
+    const symbolic = await runner(["symbolic-ref", "-q", "--short", "refs/remotes/origin/HEAD"], {
+        cwd,
+        signal,
+    });
+    if (!symbolic.failed && symbolic.exitCode === 0) {
+        const ref = symbolic.stdout.trim();
+        if (ref)
+            return ref;
+    }
+    for (const candidate of ["origin/main", "origin/master", "main", "master"]) {
+        const check = await runner(["rev-parse", "--verify", "-q", candidate], { cwd, signal });
+        if (!check.failed && check.exitCode === 0)
+            return candidate;
+    }
+    return undefined;
+}
+/**
+ * Resolves the base ref to diff against: the explicit `baseRef` when given,
+ * else the merge-base with the detected default branch, else `HEAD~1`.
+ * Never throws — every git call goes through the never-throw `runner`.
+ */
+async function resolveBaseRef(runner, cwd, signal, explicit) {
+    if (explicit)
+        return explicit;
+    const defaultBranch = await resolveDefaultBranchRef(runner, cwd, signal);
+    if (defaultBranch) {
+        const mergeBase = await runner(["merge-base", defaultBranch, "HEAD"], { cwd, signal });
+        if (!mergeBase.failed && mergeBase.exitCode === 0 && mergeBase.stdout.trim()) {
+            return mergeBase.stdout.trim();
+        }
+    }
+    return "HEAD~1";
+}
+// ── Pure parsing helpers (never throw; feed ranking, not correctness) ──
+function parseNameStatus(raw) {
+    const map = new Map();
+    if (typeof raw !== "string" || !raw)
+        return map;
+    const lines = raw.split("\n").map((l) => l.trim()).filter(Boolean);
+    for (const line of lines) {
+        const parts = line.split("\t").filter(Boolean);
+        if (parts.length < 2)
+            continue;
+        const code = parts[0];
+        let status;
+        let path;
+        if (code.startsWith("R") || code.startsWith("C")) {
+            // rename/copy: "R100\told\tnew" — key by the new path.
+            status = "renamed";
+            path = parts[2] ?? parts[1];
+        }
+        else if (code.startsWith("A")) {
+            status = "added";
+            path = parts[1];
+        }
+        else if (code.startsWith("D")) {
+            status = "deleted";
+            path = parts[1];
+        }
+        else {
+            status = "modified";
+            path = parts[1];
+        }
+        if (path)
+            map.set(path, status);
+    }
+    return map;
+}
+function parseHunkHeader(line) {
+    const match = /^@@ -\d+(?:,\d+)? \+(\d+)(?:,(\d+))? @@/.exec(line);
+    return {
+        startLine: match ? Number(match[1]) : 0,
+        lineCount: match && match[2] ? Number(match[2]) : 1,
+    };
+}
+function parseHunks(raw) {
+    const map = new Map();
+    if (typeof raw !== "string" || !raw)
+        return map;
+    let currentPath;
+    let pendingOldPath;
+    let currentHunk;
+    let currentLines = [];
+    const flushHunk = () => {
+        if (currentPath && currentHunk) {
+            currentHunk.content = currentLines.join("\n");
+            const arr = map.get(currentPath) ?? [];
+            arr.push(currentHunk);
+            map.set(currentPath, arr);
+        }
+        currentHunk = undefined;
+        currentLines = [];
+    };
+    for (const line of raw.split("\n")) {
+        if (line.startsWith("diff --git ")) {
+            flushHunk();
+            currentPath = undefined;
+            pendingOldPath = undefined;
+            continue;
+        }
+        if (line.startsWith("--- ")) {
+            const m = /^--- a\/(.+)$/.exec(line);
+            pendingOldPath = m ? m[1] : undefined;
+            continue;
+        }
+        if (line.startsWith("+++ ")) {
+            const m = /^\+\+\+ b\/(.+)$/.exec(line);
+            // A deleted file's "+++" side is "/dev/null" — fall back to the "---" path.
+            currentPath = m ? m[1] : pendingOldPath;
+            continue;
+        }
+        if (line.startsWith("@@")) {
+            flushHunk();
+            const { startLine, lineCount } = parseHunkHeader(line);
+            currentHunk = { startLine, lineCount, content: "" };
+            currentLines = [line];
+            continue;
+        }
+        if (currentHunk) {
+            currentLines.push(line);
+        }
+    }
+    flushHunk();
+    return map;
+}
+/**
+ * Parse `git diff --name-status` + `git diff -U<n>` output into
+ * `ChangedFile[]`, bounded by `MAX_CHANGED_FILES` (file count) and
+ * `MAX_HUNK_BYTES` (total hunk content bytes). Pure and total — any
+ * structural surprise (non-string input, malformed lines) is skipped
+ * rather than thrown (Pattern B, mirrors `parseSlitherOutput`).
+ */
+export function parseUnifiedDiff(nameStatus, unified) {
+    const statusMap = parseNameStatus(nameStatus);
+    const hunksByPath = parseHunks(unified);
+    let truncated = false;
+    let paths = Array.from(statusMap.keys());
+    if (paths.length > MAX_CHANGED_FILES) {
+        paths = paths.slice(0, MAX_CHANGED_FILES);
+        truncated = true;
+    }
+    const files = [];
+    let totalBytes = 0;
+    for (const path of paths) {
+        const status = statusMap.get(path) ?? "modified";
+        const hunks = hunksByPath.get(path) ?? [];
+        const boundedHunks = [];
+        for (const hunk of hunks) {
+            const hunkBytes = Buffer.byteLength(hunk.content, "utf8");
+            if (totalBytes + hunkBytes > MAX_HUNK_BYTES) {
+                truncated = true;
+                break;
+            }
+            boundedHunks.push(hunk);
+            totalBytes += hunkBytes;
+        }
+        if (boundedHunks.length < hunks.length)
+            truncated = true;
+        files.push({ path, status, hunks: boundedHunks });
+    }
+    return { files, truncated };
+}
+// bober: substring list, not a grammar — cheap and total, good enough to
+// hint the selector's keyword-overlap ranking (selector.ts:20-23); it need
+// not be perfect (assumptions[2]).
+const NOTABLE_SUBSTRINGS = [
+    ".raw(",
+    "FOR UPDATE",
+    "postinstall",
+    "ecrecover",
+    "dangerouslySetInnerHTML",
+    "eval(",
+    "exec(",
+    "child_process",
+    "SELECT ",
+    "DROP TABLE",
+    "innerHTML",
+    "__proto__",
+];
+/**
+ * Tokenizes changed-hunk text into keywords for the selector's
+ * keyword-overlap ranking (selector.ts). Pure and total: guards every
+ * field access, never throws on malformed hunk content.
+ */
+export function extractDiffKeywords(files) {
+    if (!Array.isArray(files))
+        return [];
+    const keywords = new Set();
+    for (const file of files) {
+        const hunks = Array.isArray(file?.hunks) ? file.hunks : [];
+        for (const hunk of hunks) {
+            const content = typeof hunk?.content === "string" ? hunk.content : "";
+            if (!content)
+                continue;
+            for (const needle of NOTABLE_SUBSTRINGS) {
+                if (content.includes(needle))
+                    keywords.add(needle);
+            }
+            for (const line of content.split("\n")) {
+                if (line.startsWith("+++") || line.startsWith("---"))
+                    continue;
+                if (!line.startsWith("+") && !line.startsWith("-"))
+                    continue;
+                const tokens = line.match(/[A-Za-z_$][A-Za-z0-9_$]{2,}/g) ?? [];
+                for (const token of tokens)
+                    keywords.add(token);
+            }
+        }
+    }
+    return Array.from(keywords);
+}
+// ── Graph neighborhood expansion (sc-6-2, opt-in-within-opt-in) ────────
+/**
+ * Expands `changedFiles` into a call-graph neighborhood via
+ * `GraphClient.impact` when the graph engine is ready. A per-file impact
+ * miss (`{ok:false}` or a thrown call) never drops the others — each file
+ * is isolated, mirroring the scanner pre-filter's per-scanner isolation.
+ */
+async function collectGraphNeighborhood(paths, signal) {
+    const deps = getGraphDeps();
+    if (!deps)
+        return [];
+    const neighborhood = new Set();
+    await Promise.all(paths.map(async (path) => {
+        if (signal.aborted)
+            return;
+        try {
+            const result = await deps.client.impact(path);
+            if (result.ok) {
+                for (const node of result.data.affected) {
+                    neighborhood.add(node.file);
+                }
+            }
+        }
+        catch {
+            // one path's graph miss never drops the others (or the git-derived changedFiles).
+        }
+    }));
+    return Array.from(neighborhood);
+}
+/**
+ * Computes a real, bounded `AuditDiff` by shelling git in orchestrator
+ * Node. NEVER throws: any failure (missing git, not-a-repo, abort,
+ * malformed diff output) degrades to `EMPTY_DIFF`, which callers treat as
+ * "fall back to estimated-files" rather than an audit-crashing error.
+ */
+export const securityDiffProvider = {
+    async compute(input) {
+        const { projectRoot, baseRef: explicitBaseRef, expandWithGraph, signal, config, runner = defaultGitRunner, } = input;
+        try {
+            if (signal.aborted)
+                return EMPTY_DIFF;
+            const baseRef = await resolveBaseRef(runner, projectRoot, signal, explicitBaseRef);
+            const nameStatusResult = await runner(["diff", "--name-status", baseRef], {
+                cwd: projectRoot,
+                signal,
+            });
+            if (nameStatusResult.failed) {
+                logger.debug(`[security-diff-provider] git diff --name-status against "${baseRef}" failed — degrading to empty diff`);
+                return EMPTY_DIFF;
+            }
+            const unifiedResult = await runner(["diff", `-U${DIFF_CONTEXT_LINES}`, baseRef], {
+                cwd: projectRoot,
+                signal,
+            });
+            if (unifiedResult.failed) {
+                logger.debug(`[security-diff-provider] git diff -U${DIFF_CONTEXT_LINES} against "${baseRef}" failed — degrading to empty diff`);
+                return EMPTY_DIFF;
+            }
+            const { files, truncated } = parseUnifiedDiff(nameStatusResult.stdout, unifiedResult.stdout);
+            let neighborhoodFiles = [];
+            if (expandWithGraph && getGraphState(config).engineHealth === "ready") {
+                neighborhoodFiles = await collectGraphNeighborhood(files.map((f) => f.path), signal);
+            }
+            return { changedFiles: files, neighborhoodFiles, truncated };
+        }
+        catch (err) {
+            logger.debug(`[security-diff-provider] compute threw: ${err instanceof Error ? err.message : String(err)} — degrading to empty diff`);
+            return EMPTY_DIFF;
+        }
+    },
+};
+//# sourceMappingURL=diff-provider.js.map

package/dist/orchestrator/security-knowledge/diff-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"diff-provider.js","sourceRoot":"","sources":["../../../src/orchestrator/security-knowledge/diff-provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,OAAO,CAAC;AAC9B,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAGrC,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAsChE,MAAM,CAAC,MAAM,UAAU,GAAc,EAAE,YAAY,EAAE,EAAE,EAAE,iBAAiB,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;AAenG,2EAA2E;AAC3E,yEAAyE;AACzE,2EAA2E;AAC3E,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAC7B,MAAM,cAAc,GAAG,GAAG,GAAG,IAAI,CAAC,CAAC,yBAAyB;AAC5D,MAAM,kBAAkB,GAAG,CAAC,CAAC;AAC7B,MAAM,cAAc,GAAG,IAAI,GAAG,IAAI,GAAG,EAAE,CAAC;AAExC;;;;;;GAMG;AACH,MAAM,gBAAgB,GAAc,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;IACvD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE;QACtC,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,YAAY,EAAE,IAAI,CAAC,MAAM;QACzB,UAAU,EAAE,SAAS;QACrB,MAAM,EAAE,KAAK;QACb,GAAG,EAAE,IAAI;QACT,SAAS,EAAE,cAAc;QACzB,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE;KAC1C,CAAC,CAAC;IAEH,OAAO;QACL,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,MAAM,IAAI,EAAE;QACzC,MAAM,EAAE,MAAM,CAAC,MAAM;KACtB,CAAC;AACJ,CAAC,CAAC;AAEF,2EAA2E;AAE3E,KAAK,UAAU,uBAAuB,CACpC,MAAiB,EACjB,GAAW,EACX,MAAmB;IAEnB,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,CAAC,cAAc,EAAE,IAAI,EAAE,SAAS,EAAE,0BAA0B,CAAC,EAAE;QAC3F,GAAG;QACH,MAAM;KACP,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QAChD,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,GAAG;YAAE,OAAO,GAAG,CAAC;IACtB,CAAC;IAED,KAAK,MAAM,SAAS,IAAI,CAAC,aAAa,EAAE,eAAe,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC;QAC3E,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,CAAC,WAAW,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,CAAC,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;QACxF,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,QAAQ,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;IAC9D,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,cAAc,CAC3B,MAAiB,EACjB,GAAW,EACX,MAAmB,EACnB,QAA4B;IAE5B,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAE9B,MAAM,aAAa,GAAG,MAAM,uBAAuB,CAAC,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;IACzE,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,CAAC,YAAY,EAAE,aAAa,EAAE,MAAM,CAAC,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;QACvF,IAAI,CAAC,SAAS,CAAC,MAAM,IAAI,SAAS,CAAC,QAAQ,KAAK,CAAC,IAAI,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;YAC7E,OAAO,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACjC,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,0EAA0E;AAE1E,SAAS,eAAe,CAAC,GAAW;IAClC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAiC,CAAC;IACrD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG;QAAE,OAAO,GAAG,CAAC;IAEhD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACnE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC/C,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,SAAS;QAE/B,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACtB,IAAI,MAA6B,CAAC;QAClC,IAAI,IAAwB,CAAC;QAE7B,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACjD,uDAAuD;YACvD,MAAM,GAAG,SAAS,CAAC;YACnB,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC;QAC9B,CAAC;aAAM,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAChC,MAAM,GAAG,OAAO,CAAC;YACjB,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;aAAM,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAChC,MAAM,GAAG,SAAS,CAAC;YACnB,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,UAAU,CAAC;YACpB,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,IAAI,IAAI;YAAE,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAClC,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,eAAe,CAAC,IAAY;IACnC,MAAM,KAAK,GAAG,yCAAyC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnE,OAAO;QACL,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACvC,SAAS,EAAE,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;KACpD,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,GAAW;IAC7B,MAAM,GAAG,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC1C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG;QAAE,OAAO,GAAG,CAAC;IAEhD,IAAI,WAA+B,CAAC;IACpC,IAAI,cAAkC,CAAC;IACvC,IAAI,WAAiC,CAAC;IACtC,IAAI,YAAY,GAAa,EAAE,CAAC;IAEhC,MAAM,SAAS,GAAG,GAAG,EAAE;QACrB,IAAI,WAAW,IAAI,WAAW,EAAE,CAAC;YAC/B,WAAW,CAAC,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC9C,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;YACvC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YACtB,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;QAC5B,CAAC;QACD,WAAW,GAAG,SAAS,CAAC;QACxB,YAAY,GAAG,EAAE,CAAC;IACpB,CAAC,CAAC;IAEF,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,IAAI,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;YACnC,SAAS,EAAE,CAAC;YACZ,WAAW,GAAG,SAAS,CAAC;YACxB,cAAc,GAAG,SAAS,CAAC;YAC3B,SAAS;QACX,CAAC;QACD,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5B,MAAM,CAAC,GAAG,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACrC,cAAc,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACtC,SAAS;QACX,CAAC;QACD,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5B,MAAM,CAAC,GAAG,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACxC,4EAA4E;YAC5E,WAAW,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC;YACxC,SAAS;QACX,CAAC;QACD,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1B,SAAS,EAAE,CAAC;YACZ,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;YACvD,WAAW,GAAG,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;YACpD,YAAY,GAAG,CAAC,IAAI,CAAC,CAAC;YACtB,SAAS;QACX,CAAC;QACD,IAAI,WAAW,EAAE,CAAC;YAChB,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IACD,SAAS,EAAE,CAAC;IAEZ,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAC9B,UAAkB,EAClB,OAAe;IAEf,MAAM,SAAS,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;IAC9C,MAAM,WAAW,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IAExC,IAAI,SAAS,GAAG,KAAK,CAAC;IAEtB,IAAI,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC;IACzC,IAAI,KAAK,CAAC,MAAM,GAAG,iBAAiB,EAAE,CAAC;QACrC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAC;QAC1C,SAAS,GAAG,IAAI,CAAC;IACnB,CAAC;IAED,MAAM,KAAK,GAAkB,EAAE,CAAC;IAChC,IAAI,UAAU,GAAG,CAAC,CAAC;IAEnB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC;QACjD,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QAE1C,MAAM,YAAY,GAAe,EAAE,CAAC;QACpC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC1D,IAAI,UAAU,GAAG,SAAS,GAAG,cAAc,EAAE,CAAC;gBAC5C,SAAS,GAAG,IAAI,CAAC;gBACjB,MAAM;YACR,CAAC;YACD,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACxB,UAAU,IAAI,SAAS,CAAC;QAC1B,CAAC;QACD,IAAI,YAAY,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM;YAAE,SAAS,GAAG,IAAI,CAAC;QAEzD,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;IACpD,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;AAC9B,CAAC;AAED,yEAAyE;AACzE,2EAA2E;AAC3E,mCAAmC;AACnC,MAAM,kBAAkB,GAAG;IACzB,OAAO;IACP,YAAY;IACZ,aAAa;IACb,WAAW;IACX,yBAAyB;IACzB,OAAO;IACP,OAAO;IACP,eAAe;IACf,SAAS;IACT,YAAY;IACZ,WAAW;IACX,WAAW;CACZ,CAAC;AAEF;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAoB;IACtD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAErC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IAEnC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,OAAO,GAAG,OAAO,IAAI,EAAE,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;YACtE,IAAI,CAAC,OAAO;gBAAE,SAAS;YAEvB,KAAK,MAAM,MAAM,IAAI,kBAAkB,EAAE,CAAC;gBACxC,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;oBAAE,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACrD,CAAC;YAED,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBACvC,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;oBAAE,SAAS;gBAC/D,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;oBAAE,SAAS;gBAC7D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,8BAA8B,CAAC,IAAI,EAAE,CAAC;gBAChE,KAAK,MAAM,KAAK,IAAI,MAAM;oBAAE,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAClD,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AAC9B,CAAC;AAED,0EAA0E;AAE1E;;;;;GAKG;AACH,KAAK,UAAU,wBAAwB,CAAC,KAAe,EAAE,MAAmB;IAC1E,MAAM,IAAI,GAAG,YAAY,EAAE,CAAC;IAC5B,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IAErB,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;IAEvC,MAAM,OAAO,CAAC,GAAG,CACf,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACvB,IAAI,MAAM,CAAC,OAAO;YAAE,OAAO;QAC3B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC9C,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;gBACd,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACxC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC9B,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,kFAAkF;QACpF,CAAC;IACH,CAAC,CAAC,CACH,CAAC;IAEF,OAAO,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;AAClC,CAAC;AAmBD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAyB;IACxD,KAAK,CAAC,OAAO,CAAC,KAAK;QACjB,MAAM,EACJ,WAAW,EACX,OAAO,EAAE,eAAe,EACxB,eAAe,EACf,MAAM,EACN,MAAM,EACN,MAAM,GAAG,gBAAgB,GAC1B,GAAG,KAAK,CAAC;QAEV,IAAI,CAAC;YACH,IAAI,MAAM,CAAC,OAAO;gBAAE,OAAO,UAAU,CAAC;YAEtC,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,eAAe,CAAC,CAAC;YAEnF,MAAM,gBAAgB,GAAG,MAAM,MAAM,CAAC,CAAC,MAAM,EAAE,eAAe,EAAE,OAAO,CAAC,EAAE;gBACxE,GAAG,EAAE,WAAW;gBAChB,MAAM;aACP,CAAC,CAAC;YACH,IAAI,gBAAgB,CAAC,MAAM,EAAE,CAAC;gBAC5B,MAAM,CAAC,KAAK,CACV,4DAA4D,OAAO,oCAAoC,CACxG,CAAC;gBACF,OAAO,UAAU,CAAC;YACpB,CAAC;YAED,MAAM,aAAa,GAAG,MAAM,MAAM,CAAC,CAAC,MAAM,EAAE,KAAK,kBAAkB,EAAE,EAAE,OAAO,CAAC,EAAE;gBAC/E,GAAG,EAAE,WAAW;gBAChB,MAAM;aACP,CAAC,CAAC;YACH,IAAI,aAAa,CAAC,MAAM,EAAE,CAAC;gBACzB,MAAM,CAAC,KAAK,CACV,uCAAuC,kBAAkB,aAAa,OAAO,oCAAoC,CAClH,CAAC;gBACF,OAAO,UAAU,CAAC;YACpB,CAAC;YAED,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,gBAAgB,CAAC,gBAAgB,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;YAE7F,IAAI,iBAAiB,GAAa,EAAE,CAAC;YACrC,IAAI,eAAe,IAAI,aAAa,CAAC,MAAM,CAAC,CAAC,YAAY,KAAK,OAAO,EAAE,CAAC;gBACtE,iBAAiB,GAAG,MAAM,wBAAwB,CAChD,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EACxB,MAAM,CACP,CAAC;YACJ,CAAC;YAED,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,iBAAiB,EAAE,SAAS,EAAE,CAAC;QAC/D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,KAAK,CACV,2CAA2C,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,4BAA4B,CACxH,CAAC;YACF,OAAO,UAAU,CAAC;QACpB,CAAC;IACH,CAAC;CACF,CAAC"}

package/dist/orchestrator/security-knowledge/index.d.ts

@@ -0,0 +1,22 @@
+import type { SecuritySignature, SecurityStackId } from "./signature.js";
+/**
+ * Loads and memoises every `skills/bober.security-<stack>/SKILL.md` file's
+ * parsed signatures, once per process (ADR-7: no runtime cache invalidation).
+ *
+ * Iterates the registry's 8 known stack entries rather than `readdir`-ing
+ * the skills directory — that would sweep in `skills/bober.security-audit/`
+ * (the orchestration workflow skill, not a stack) and the parser needs a
+ * known `stackId` per file anyway.
+ */
+export declare class SecurityKnowledgeIndex {
+    private readonly skillsRoot;
+    private cache;
+    constructor(skillsRoot?: string);
+    /** Parses all 8 skill files once and memoises. Idempotent — a second call is a no-op. */
+    load(): Promise<void>;
+    /** That stack's signatures, or [] when missing/before load(). Never throws. */
+    forStack(stackId: SecurityStackId): SecuritySignature[];
+    /** The union of every stack's signatures. */
+    all(): SecuritySignature[];
+}
+//# sourceMappingURL=index.d.ts.map

package/dist/orchestrator/security-knowledge/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/orchestrator/security-knowledge/index.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAczE;;;;;;;;GAQG;AACH,qBAAa,sBAAsB;IAGrB,OAAO,CAAC,QAAQ,CAAC,UAAU;IAFvC,OAAO,CAAC,KAAK,CAA0D;gBAE1C,UAAU,GAAE,MAA4B;IAErE,yFAAyF;IACnF,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAoB3B,+EAA+E;IAC/E,QAAQ,CAAC,OAAO,EAAE,eAAe,GAAG,iBAAiB,EAAE;IAIvD,6CAA6C;IAC7C,GAAG,IAAI,iBAAiB,EAAE;CAG3B"}

package/dist/orchestrator/security-knowledge/index.js

@@ -0,0 +1,66 @@
+/**
+ * SecurityKnowledgeIndex — NOT a barrel. This module is the knowledge-index
+ * class (a per-process memoised catalog of every stack's parsed
+ * SecuritySignature[], ADR-7); it does not re-export sibling modules. Import
+ * it explicitly as `./security-knowledge/index.js`.
+ */
+import { readFile } from "node:fs/promises";
+import { join, dirname } from "node:path";
+import { fileURLToPath } from "node:url";
+import { SecuritySignatureParser } from "./parser.js";
+import { STACK_SKILL_MAP_ENTRIES } from "./registry.js";
+/**
+ * `security-knowledge/` is one directory deeper than `stack-knowledge.ts`
+ * (`src/orchestrator/`), so the default skills root needs three `..`, not
+ * two: src/orchestrator/security-knowledge/ -> package root is ../../.. ;
+ * skills live at <packageRoot>/skills.
+ */
+function defaultSkillsRoot() {
+    const currentDir = dirname(fileURLToPath(import.meta.url));
+    return join(currentDir, "..", "..", "..", "skills");
+}
+/**
+ * Loads and memoises every `skills/bober.security-<stack>/SKILL.md` file's
+ * parsed signatures, once per process (ADR-7: no runtime cache invalidation).
+ *
+ * Iterates the registry's 8 known stack entries rather than `readdir`-ing
+ * the skills directory — that would sweep in `skills/bober.security-audit/`
+ * (the orchestration workflow skill, not a stack) and the parser needs a
+ * known `stackId` per file anyway.
+ */
+export class SecurityKnowledgeIndex {
+    skillsRoot;
+    cache = null;
+    constructor(skillsRoot = defaultSkillsRoot()) {
+        this.skillsRoot = skillsRoot;
+    }
+    /** Parses all 8 skill files once and memoises. Idempotent — a second call is a no-op. */
+    async load() {
+        if (this.cache)
+            return;
+        const cache = new Map();
+        for (const { stackId, skillName } of STACK_SKILL_MAP_ENTRIES) {
+            const relPath = join(skillName, "SKILL.md");
+            let markdown;
+            try {
+                markdown = await readFile(join(this.skillsRoot, relPath), "utf-8");
+            }
+            catch {
+                // Missing/unreadable skill file -> empty signature set, never throw.
+                cache.set(stackId, []);
+                continue;
+            }
+            cache.set(stackId, SecuritySignatureParser.parse(stackId, markdown, relPath));
+        }
+        this.cache = cache;
+    }
+    /** That stack's signatures, or [] when missing/before load(). Never throws. */
+    forStack(stackId) {
+        return this.cache?.get(stackId) ?? [];
+    }
+    /** The union of every stack's signatures. */
+    all() {
+        return [...(this.cache?.values() ?? [])].flat();
+    }
+}
+//# sourceMappingURL=index.js.map

package/dist/orchestrator/security-knowledge/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/orchestrator/security-knowledge/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAEtD,OAAO,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AAExD;;;;;GAKG;AACH,SAAS,iBAAiB;IACxB,MAAM,UAAU,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3D,OAAO,IAAI,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;AACtD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,OAAO,sBAAsB;IAGJ;IAFrB,KAAK,GAAqD,IAAI,CAAC;IAEvE,YAA6B,aAAqB,iBAAiB,EAAE;QAAxC,eAAU,GAAV,UAAU,CAA8B;IAAG,CAAC;IAEzE,yFAAyF;IACzF,KAAK,CAAC,IAAI;QACR,IAAI,IAAI,CAAC,KAAK;YAAE,OAAO;QAEvB,MAAM,KAAK,GAAG,IAAI,GAAG,EAAwC,CAAC;QAC9D,KAAK,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,uBAAuB,EAAE,CAAC;YAC7D,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;YAC5C,IAAI,QAAgB,CAAC;YACrB,IAAI,CAAC;gBACH,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC;YACrE,CAAC;YAAC,MAAM,CAAC;gBACP,qEAAqE;gBACrE,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;gBACvB,SAAS;YACX,CAAC;YACD,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,uBAAuB,CAAC,KAAK,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;QAChF,CAAC;QAED,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;IAED,+EAA+E;IAC/E,QAAQ,CAAC,OAAwB;QAC/B,OAAO,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;IACxC,CAAC;IAED,6CAA6C;IAC7C,GAAG;QACD,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAClD,CAAC;CACF"}

package/dist/orchestrator/security-knowledge/parser.d.ts

@@ -0,0 +1,9 @@
+import type { SecuritySignature, SecurityStackId } from "./signature.js";
+export declare const SecuritySignatureParser: {
+    /**
+     * Pure and total: takes markdown text (no fs access), never throws, drops
+     * malformed blocks and returns the parseable subset.
+     */
+    parse(stackId: SecurityStackId, skillMarkdown: string, skillRelPath: string): SecuritySignature[];
+};
+//# sourceMappingURL=parser.d.ts.map

package/dist/orchestrator/security-knowledge/parser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parser.d.ts","sourceRoot":"","sources":["../../../src/orchestrator/security-knowledge/parser.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAqIzE,eAAO,MAAM,uBAAuB;IAClC;;;OAGG;mBACY,eAAe,iBAAiB,MAAM,gBAAgB,MAAM,GAAG,iBAAiB,EAAE;CAclG,CAAC"}

package/dist/orchestrator/security-knowledge/parser.js

@@ -0,0 +1,137 @@
+import { ALL_VULN_CLASSES } from "../stack-knowledge.js";
+import { parseFrontmatter } from "../../vault/frontmatter.js";
+/**
+ * Total parser turning a security skill file's markdown into typed
+ * SecuritySignature[] records (arch-20260712-security-audit-agent-team-architecture.md).
+ *
+ * Block format (mirrored in skills/bober.security-generic/SKILL.md's
+ * "## Signature Block Format" section — the two are one executable spec):
+ *
+ *   ### <signatureId>
+ *   - **Title:** <human-readable title>
+ *   - **CWE:** CWE-xx                (optional — omit for cwe: null)
+ *   - **Severity:** critical|high|medium|low|info
+ *   - **VulnClass:** <a VulnClass union member, verbatim>
+ *   - **Invariant:** <the safety invariant this signature protects>
+ *   - **Keywords:** comma, separated, keywords
+ *
+ *   **Unsafe:**
+ *   ```ts
+ *   <unsafe example>
+ *   ```
+ *
+ *   **Safe:**
+ *   ```ts
+ *   <safe example>
+ *   ```
+ *
+ * A block is split on a `### ` heading (heading text, trimmed, is the signatureId).
+ * Required: non-empty signatureId, Title, a VulnClass that is an ALL_VULN_CLASSES
+ * member, a valid Severity, and non-empty Unsafe/Safe fenced examples — any one
+ * missing/invalid drops the whole block. Mirrors parseSlitherOutput's defensive
+ * narrowing (security-scanners.ts:144-201): guard input type, `continue`/drop past
+ * malformed blocks, never throw, return the parseable subset.
+ */
+// ── Type guards (mirror isVulnClass at security-scanners.ts:74-76) ───
+function isVulnClass(value) {
+    return ALL_VULN_CLASSES.includes(value);
+}
+const SEVERITIES = ["critical", "high", "medium", "low", "info"];
+function isSeverity(value) {
+    return SEVERITIES.includes(value);
+}
+const LABEL_RE = /^-\s+\*\*(Title|CWE|Severity|VulnClass|Invariant|Keywords):\*\*\s*(.*)$/;
+function extractLabelledFields(block) {
+    const fields = {};
+    for (const rawLine of block.split("\n")) {
+        const match = LABEL_RE.exec(rawLine.trim());
+        if (match)
+            fields[match[1]] = match[2].trim();
+    }
+    return fields;
+}
+/**
+ * Extract the fenced code body following a labelled marker (e.g. "**Unsafe:**").
+ * Returns null when the marker, opening fence, or closing fence is missing —
+ * covers a truncated/unclosed code fence without throwing.
+ */
+function extractFencedExample(block, marker) {
+    const markerIdx = block.indexOf(marker);
+    if (markerIdx === -1)
+        return null;
+    const afterMarker = block.slice(markerIdx + marker.length);
+    const fenceOpenIdx = afterMarker.indexOf("```");
+    if (fenceOpenIdx === -1)
+        return null;
+    const afterFenceOpen = afterMarker.slice(fenceOpenIdx + 3);
+    const infoLineEnd = afterFenceOpen.indexOf("\n");
+    if (infoLineEnd === -1)
+        return null; // opening fence never closed with a newline
+    const body = afterFenceOpen.slice(infoLineEnd + 1);
+    const fenceCloseIdx = body.indexOf("```");
+    if (fenceCloseIdx === -1)
+        return null; // truncated/unclosed fence
+    return body.slice(0, fenceCloseIdx).trim();
+}
+// ── Block parsing ──────────────────────────────────────────────────
+/** Parse one "### <signatureId>" block. Returns null on any missing/invalid required field. */
+function parseBlock(stackId, block, skillRelPath) {
+    const newlineIdx = block.indexOf("\n");
+    const signatureId = (newlineIdx === -1 ? block : block.slice(0, newlineIdx)).trim();
+    if (signatureId === "")
+        return null;
+    const fields = extractLabelledFields(block);
+    const title = fields.Title;
+    if (!title)
+        return null;
+    const vulnClassRaw = fields.VulnClass;
+    if (!vulnClassRaw || !isVulnClass(vulnClassRaw))
+        return null;
+    const severityRaw = fields.Severity;
+    if (!severityRaw || !isSeverity(severityRaw))
+        return null;
+    const unsafeExample = extractFencedExample(block, "**Unsafe:**");
+    if (!unsafeExample)
+        return null;
+    const safeExample = extractFencedExample(block, "**Safe:**");
+    if (!safeExample)
+        return null;
+    const cwe = fields.CWE && fields.CWE.length > 0 ? fields.CWE : null;
+    const keywords = fields.Keywords
+        ? fields.Keywords.split(",").map((k) => k.trim()).filter((k) => k.length > 0)
+        : [];
+    return {
+        stackId,
+        signatureId,
+        title,
+        cwe,
+        severity: severityRaw,
+        vulnClass: vulnClassRaw,
+        invariant: fields.Invariant ?? "",
+        unsafeExample,
+        safeExample,
+        keywords,
+        skillRef: skillRelPath,
+    };
+}
+// ── Public parser ──────────────────────────────────────────────────
+export const SecuritySignatureParser = {
+    /**
+     * Pure and total: takes markdown text (no fs access), never throws, drops
+     * malformed blocks and returns the parseable subset.
+     */
+    parse(stackId, skillMarkdown, skillRelPath) {
+        if (typeof skillMarkdown !== "string")
+            return [];
+        const { body } = parseFrontmatter(skillMarkdown);
+        const blocks = body.split(/^### /m).slice(1);
+        const signatures = [];
+        for (const block of blocks) {
+            const signature = parseBlock(stackId, block, skillRelPath);
+            if (signature)
+                signatures.push(signature);
+        }
+        return signatures;
+    },
+};
+//# sourceMappingURL=parser.js.map

package/dist/orchestrator/security-knowledge/parser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"parser.js","sourceRoot":"","sources":["../../../src/orchestrator/security-knowledge/parser.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAG9D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,wEAAwE;AAExE,SAAS,WAAW,CAAC,KAAa;IAChC,OAAQ,gBAA6B,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,UAAU,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAU,CAAC;AAE1E,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAQ,UAAgC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC3D,CAAC;AAMD,MAAM,QAAQ,GAAG,yEAAyE,CAAC;AAE3F,SAAS,qBAAqB,CAAC,KAAa;IAC1C,MAAM,MAAM,GAAuC,EAAE,CAAC;IACtD,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QAC5C,IAAI,KAAK;YAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAc,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7D,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,SAAS,oBAAoB,CAAC,KAAa,EAAE,MAAc;IACzD,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACxC,IAAI,SAAS,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAElC,MAAM,WAAW,GAAG,KAAK,CAAC,KAAK,CAAC,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IAC3D,MAAM,YAAY,GAAG,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAChD,IAAI,YAAY,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAErC,MAAM,cAAc,GAAG,WAAW,CAAC,KAAK,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC;IAC3D,MAAM,WAAW,GAAG,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACjD,IAAI,WAAW,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,4CAA4C;IAEjF,MAAM,IAAI,GAAG,cAAc,CAAC,KAAK,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC;IACnD,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC1C,IAAI,aAAa,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,2BAA2B;IAElE,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC,IAAI,EAAE,CAAC;AAC7C,CAAC;AAED,sEAAsE;AAEtE,+FAA+F;AAC/F,SAAS,UAAU,CAAC,OAAwB,EAAE,KAAa,EAAE,YAAoB;IAC/E,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC,MAAM,WAAW,GAAG,CAAC,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACpF,IAAI,WAAW,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAEpC,MAAM,MAAM,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;IAE5C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;IAC3B,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAExB,MAAM,YAAY,GAAG,MAAM,CAAC,SAAS,CAAC;IACtC,IAAI,CAAC,YAAY,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC;QAAE,OAAO,IAAI,CAAC;IAE7D,MAAM,WAAW,GAAG,MAAM,CAAC,QAAQ,CAAC;IACpC,IAAI,CAAC,WAAW,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC;QAAE,OAAO,IAAI,CAAC;IAE1D,MAAM,aAAa,GAAG,oBAAoB,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;IACjE,IAAI,CAAC,aAAa;QAAE,OAAO,IAAI,CAAC;IAEhC,MAAM,WAAW,GAAG,oBAAoB,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IAC7D,IAAI,CAAC,WAAW;QAAE,OAAO,IAAI,CAAC;IAE9B,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IACpE,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ;QAC9B,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;QAC7E,CAAC,CAAC,EAAE,CAAC;IAEP,OAAO;QACL,OAAO;QACP,WAAW;QACX,KAAK;QACL,GAAG;QACH,QAAQ,EAAE,WAAW;QACrB,SAAS,EAAE,YAAY;QACvB,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,EAAE;QACjC,aAAa;QACb,WAAW;QACX,QAAQ;QACR,QAAQ,EAAE,YAAY;KACvB,CAAC;AACJ,CAAC;AAED,sEAAsE;AAEtE,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC;;;OAGG;IACH,KAAK,CAAC,OAAwB,EAAE,aAAqB,EAAE,YAAoB;QACzE,IAAI,OAAO,aAAa,KAAK,QAAQ;YAAE,OAAO,EAAE,CAAC;QAEjD,MAAM,EAAE,IAAI,EAAE,GAAG,gBAAgB,CAAC,aAAa,CAAC,CAAC;QACjD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAE7C,MAAM,UAAU,GAAwB,EAAE,CAAC;QAC3C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,MAAM,SAAS,GAAG,UAAU,CAAC,OAAO,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC;YAC3D,IAAI,SAAS;gBAAE,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC5C,CAAC;QAED,OAAO,UAAU,CAAC;IACpB,CAAC;CACF,CAAC"}

package/dist/orchestrator/security-knowledge/registry.d.ts

@@ -0,0 +1,25 @@
+import type { Stack } from "../../config/schema.js";
+import type { SecurityStackId } from "./signature.js";
+/** stackId -> skillName, 8 entries. The index iterates these to load each skill file. */
+export declare const STACK_SKILL_MAP_ENTRIES: ReadonlyArray<{
+    stackId: SecurityStackId;
+    skillName: string;
+}>;
+export interface StackResolution {
+    /** Always a real SecurityStackId — "generic" for unknown/absent/null (never null, never a throw). */
+    stackId: SecurityStackId;
+    /** The matched candidate string verbatim (e.g. "solidity"), or "unknown" when nothing matched. */
+    stackLabel: string;
+    /** Always "bober.security-<stackId>" — a real skill name, never null. */
+    skillName: string;
+}
+/**
+ * Resolves a declared/detected stack to one of the 8 `SecurityStackId`s and
+ * its `bober.security-<stack>` skill name. Unknown/absent/null stacks
+ * degrade to `{stackId: "generic", ...}` — never null, never a throw
+ * (sc-5-1).
+ */
+export declare const SecurityStackRegistry: {
+    resolve(stack: Stack | string | undefined): StackResolution;
+};
+//# sourceMappingURL=registry.d.ts.map

package/dist/orchestrator/security-knowledge/registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../../src/orchestrator/security-knowledge/registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AA4BtD,yFAAyF;AACzF,eAAO,MAAM,uBAAuB,EAAE,aAAa,CAAC;IAAE,OAAO,EAAE,eAAe,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CACN,CAAC;AAyE9F,MAAM,WAAW,eAAe;IAC9B,qGAAqG;IACrG,OAAO,EAAE,eAAe,CAAC;IACzB,kGAAkG;IAClG,UAAU,EAAE,MAAM,CAAC;IACnB,yEAAyE;IACzE,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB;mBACjB,KAAK,GAAG,MAAM,GAAG,SAAS,GAAG,eAAe;CAqB5D,CAAC"}