solidity-argus 0.3.7 → 0.5.7

package/src/skills/analysis/cluster.ts

@@ -1,6 +1,6 @@
 import { tokenJaccard } from "./similarity"
+import { STOPWORDS } from "./stopwords"
 
-/** Input finding from the PDF extraction pipeline */
 export interface ClusterFinding {
   title: string
   severity: string
@@ -10,7 +10,6 @@ export interface ClusterFinding {
   source_name?: string
 }
 
-/** A single cluster of related findings */
 export interface FindingCluster {
   id: number
   category: string
@@ -22,14 +21,12 @@ export interface FindingCluster {
   size: number
 }
 
-/** Configuration for clustering */
 export interface ClusterConfig {
   linkThreshold: number
   cohesionMinSimilarity: number
   minClusterSize: number
 }
 
-/** Full clustering result */
 export interface ClusterResult {
   clusters: FindingCluster[]
   singletons: ClusterFinding[]
@@ -49,116 +46,6 @@ export const DEFAULT_CLUSTER_CONFIG: ClusterConfig = {
   minClusterSize: 2,
 }
 
-const STOPWORDS = new Set([
-  "the",
-  "a",
-  "an",
-  "is",
-  "are",
-  "was",
-  "were",
-  "be",
-  "been",
-  "being",
-  "have",
-  "has",
-  "had",
-  "do",
-  "does",
-  "did",
-  "will",
-  "would",
-  "shall",
-  "should",
-  "may",
-  "might",
-  "can",
-  "could",
-  "of",
-  "in",
-  "to",
-  "for",
-  "with",
-  "on",
-  "at",
-  "by",
-  "from",
-  "as",
-  "into",
-  "through",
-  "during",
-  "before",
-  "after",
-  "above",
-  "below",
-  "between",
-  "out",
-  "off",
-  "over",
-  "under",
-  "again",
-  "further",
-  "then",
-  "once",
-  "here",
-  "there",
-  "where",
-  "when",
-  "how",
-  "all",
-  "each",
-  "every",
-  "both",
-  "few",
-  "more",
-  "most",
-  "other",
-  "some",
-  "such",
-  "no",
-  "nor",
-  "not",
-  "only",
-  "own",
-  "same",
-  "than",
-  "too",
-  "very",
-  "and",
-  "but",
-  "or",
-  "if",
-  "this",
-  "that",
-  "these",
-  "those",
-  "it",
-  "its",
-  "contract",
-  "function",
-  "solidity",
-  "smart",
-  "vulnerability",
-  "attack",
-  "attacker",
-  "token",
-  "address",
-  "value",
-  "state",
-  "require",
-  "modifier",
-  "external",
-  "internal",
-  "public",
-  "private",
-  "mapping",
-  "uint256",
-  "bool",
-  "returns",
-  "event",
-  "emit",
-])
-
 class UnionFind {
   parent: number[]
   rank: number[]

package/src/skills/analysis/normalize.ts

@@ -1,4 +1,6 @@
+import { isRecord } from "../../shared/type-guards"
 import { parseFrontmatter } from "../skill-schema"
+import { STOPWORDS } from "./stopwords"
 
 export interface SkillDoc {
   name: string
@@ -11,116 +13,6 @@ export interface SkillDoc {
   ruleTokens: string[]
 }
 
-const STOPWORDS = new Set([
-  "the",
-  "a",
-  "an",
-  "is",
-  "are",
-  "was",
-  "were",
-  "be",
-  "been",
-  "being",
-  "have",
-  "has",
-  "had",
-  "do",
-  "does",
-  "did",
-  "will",
-  "would",
-  "shall",
-  "should",
-  "may",
-  "might",
-  "can",
-  "could",
-  "of",
-  "in",
-  "to",
-  "for",
-  "with",
-  "on",
-  "at",
-  "by",
-  "from",
-  "as",
-  "into",
-  "through",
-  "during",
-  "before",
-  "after",
-  "above",
-  "below",
-  "between",
-  "out",
-  "off",
-  "over",
-  "under",
-  "again",
-  "further",
-  "then",
-  "once",
-  "here",
-  "there",
-  "where",
-  "when",
-  "how",
-  "all",
-  "each",
-  "every",
-  "both",
-  "few",
-  "more",
-  "most",
-  "other",
-  "some",
-  "such",
-  "no",
-  "nor",
-  "not",
-  "only",
-  "own",
-  "same",
-  "than",
-  "too",
-  "very",
-  "and",
-  "but",
-  "or",
-  "if",
-  "this",
-  "that",
-  "these",
-  "those",
-  "it",
-  "its",
-  "contract",
-  "function",
-  "solidity",
-  "smart",
-  "vulnerability",
-  "attack",
-  "attacker",
-  "token",
-  "address",
-  "value",
-  "state",
-  "require",
-  "modifier",
-  "external",
-  "internal",
-  "public",
-  "private",
-  "mapping",
-  "uint256",
-  "bool",
-  "returns",
-  "event",
-  "emit",
-])
-
 function stripFrontmatter(content: string): string {
   return content.replace(/^---[ \t]*\r?\n[\s\S]*?\r?\n---[ \t]*\r?\n?/, "")
 }
@@ -147,10 +39,6 @@ function tokenize(text: string): string[] {
     .filter((token) => !STOPWORDS.has(token))
 }
 
-function isRecord(value: unknown): value is Record<string, unknown> {
-  return typeof value === "object" && value !== null
-}
-
 function extractDetectionRules(frontmatter: Record<string, unknown>): string[] {
   const rawRules = frontmatter.detection_rules
   if (!Array.isArray(rawRules)) return []

package/src/skills/analysis/stopwords.ts

@@ -0,0 +1,109 @@
+export const STOPWORDS = new Set([
+  "the",
+  "a",
+  "an",
+  "is",
+  "are",
+  "was",
+  "were",
+  "be",
+  "been",
+  "being",
+  "have",
+  "has",
+  "had",
+  "do",
+  "does",
+  "did",
+  "will",
+  "would",
+  "shall",
+  "should",
+  "may",
+  "might",
+  "can",
+  "could",
+  "of",
+  "in",
+  "to",
+  "for",
+  "with",
+  "on",
+  "at",
+  "by",
+  "from",
+  "as",
+  "into",
+  "through",
+  "during",
+  "before",
+  "after",
+  "above",
+  "below",
+  "between",
+  "out",
+  "off",
+  "over",
+  "under",
+  "again",
+  "further",
+  "then",
+  "once",
+  "here",
+  "there",
+  "where",
+  "when",
+  "how",
+  "all",
+  "each",
+  "every",
+  "both",
+  "few",
+  "more",
+  "most",
+  "other",
+  "some",
+  "such",
+  "no",
+  "nor",
+  "not",
+  "only",
+  "own",
+  "same",
+  "than",
+  "too",
+  "very",
+  "and",
+  "but",
+  "or",
+  "if",
+  "this",
+  "that",
+  "these",
+  "those",
+  "it",
+  "its",
+  "contract",
+  "function",
+  "solidity",
+  "smart",
+  "vulnerability",
+  "attack",
+  "attacker",
+  "token",
+  "address",
+  "value",
+  "state",
+  "require",
+  "modifier",
+  "external",
+  "internal",
+  "public",
+  "private",
+  "mapping",
+  "uint256",
+  "bool",
+  "returns",
+  "event",
+  "emit",
+])

package/src/skills/argus-skill-resolver.ts

@@ -2,6 +2,7 @@ import { type Dirent, existsSync, readdirSync, readFileSync } from "node:fs"
 import { homedir } from "node:os"
 import { basename, extname, join, resolve } from "node:path"
 import type { ArgusConfig } from "../config/types"
+import { getTrailOfBitsCacheDir } from "../shared/cache-paths"
 import { createLogger } from "../shared/logger"
 import { parseFrontmatter, validateSkillFrontmatter } from "./skill-schema"
 
@@ -21,8 +22,6 @@ const OMO_PROJECT_SKILLS_DIR = [".opencode", "skills"]
 const OMO_GLOBAL_SKILLS_DIR = [".config", "opencode", "skills"]
 const CLAUDE_PROJECT_SKILLS_DIR = [".claude", "skills"]
 const CLAUDE_GLOBAL_SKILLS_DIR = [".claude", "skills"]
-const TOB_CACHE_DIR = join(homedir(), ".cache", "solidity-argus", "trailofbits-skills")
-
 const SKILL_NAME_ALIASES: Record<string, string> = {
   "vulnerability-patterns/reentrancy": "reentrancy",
   "vulnerability-patterns/oracle-manipulation": "oracle-manipulation",
@@ -55,6 +54,9 @@ function parseSkillDescriptionFromFrontmatter(content: string): string {
   return raw.replace(/^"|"$/g, "")
 }
 
+/** Filenames that are never skills — exclude from resolution and health checks. */
+const NON_SKILL_FILENAMES = new Set(["README.md", "INVENTORY.md", "CHANGELOG.md", "LICENSE.md"])
+
 function collectMarkdownFiles(root: string, maxDepth = 8): string[] {
   if (!existsSync(root)) return []
 
@@ -82,6 +84,7 @@ function collectMarkdownFiles(root: string, maxDepth = 8): string[] {
 
       if (!entry.isFile()) continue
       if (extname(entry.name).toLowerCase() !== ".md") continue
+      if (NON_SKILL_FILENAMES.has(entry.name)) continue
       files.push(fullPath)
     }
   }
@@ -90,7 +93,7 @@ function collectMarkdownFiles(root: string, maxDepth = 8): string[] {
 }
 
 function getTrailOfBitsRoots(): string[] {
-  const pluginsDir = join(TOB_CACHE_DIR, "plugins")
+  const pluginsDir = join(getTrailOfBitsCacheDir(), "plugins")
   if (!existsSync(pluginsDir)) return []
 
   let entries: Dirent[]