solidity-argus 0.5.8 → 0.5.9

package/AGENTS.md

@@ -19,21 +19,21 @@ CLI: `argus doctor`, `argus init`, `argus install`.
 
 **Role**: Static analysis and testing specialist
 **Description**: Finds vulnerabilities through Slither static analysis, Foundry testing, fuzzing, and pattern matching. The tactical executor — runs tools, writes PoC tests, and verifies findings. Dispatched by Argus during Automated Scanning and Testing & Verification phases.
-**Model**: anthropic/claude-sonnet-4-7
+**Model**: anthropic/claude-sonnet-4-6
 **Tools**: argus_slither_analyze, argus_forge_test, argus_gas_analysis, argus_forge_fuzz, argus_forge_coverage, argus_analyze_contract, argus_check_patterns, argus_proxy_detection, argus_record_finding, skill
 
 ## pythia
 
 **Role**: Vulnerability researcher
 **Description**: Consults Solodit, SCVD, and the knowledge base to find historical precedents and known attack vectors. Searches 7,769+ real-world audit findings and 51 curated vulnerability pattern files. Dispatched by Argus during Vulnerability Research phase.
-**Model**: anthropic/claude-sonnet-4-7
+**Model**: anthropic/claude-sonnet-4-6
 **Tools**: argus_solodit_search, argus_check_patterns, argus_record_finding, skill
 
 ## scribe
 
 **Role**: Audit report writer
 **Description**: Transforms raw findings into professional markdown audit reports. Produces structured output with severity classifications (Critical/High/Medium/Low/Informational), impact assessments, proof-of-concept steps, and actionable recommendations. Dispatched by Argus only after all analysis is complete.
-**Model**: anthropic/claude-sonnet-4-7
+**Model**: anthropic/claude-sonnet-4-6
 **Tools**: argus_read_findings, argus_persist_deduped, argus_generate_report, skill
 
 ## themis

package/README.md

@@ -66,9 +66,9 @@ Argus will automatically:
 | Agent | Role | Model |
 |-------|------|-------|
 | `@argus` | Orchestrator — coordinates the full audit | claude-opus-4-7 |
-| `@sentinel` | Static analysis & testing specialist | claude-sonnet-4-7 |
-| `@pythia` | Vulnerability researcher | claude-sonnet-4-7 |
-| `@scribe` | Audit report writer | claude-sonnet-4-7 |
+| `@sentinel` | Static analysis & testing specialist | claude-sonnet-4-6 |
+| `@pythia` | Vulnerability researcher | claude-sonnet-4-6 |
+| `@scribe` | Audit report writer | claude-sonnet-4-6 |
 | `@themis` | Independent audit quality gate | gpt-5.5 |
 
 ### @argus — The Orchestrator
@@ -285,9 +285,9 @@ Create `.argus/solidity-argus.jsonc` in your project root. `.opencode/solidity-a
 {
   "agents": {
     "argus": { "model": "anthropic/claude-opus-4-7" },
-    "sentinel": { "model": "anthropic/claude-sonnet-4-7" },
-    "pythia": { "model": "anthropic/claude-sonnet-4-7" },
-    "scribe": { "model": "anthropic/claude-sonnet-4-7" },
+    "sentinel": { "model": "anthropic/claude-sonnet-4-6" },
+    "pythia": { "model": "anthropic/claude-sonnet-4-6" },
+    "scribe": { "model": "anthropic/claude-sonnet-4-6" },
     "themis": { "model": "openai/gpt-5.5" }
   },
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "solidity-argus",
-  "version": "0.5.8",
+  "version": "0.5.9",
   "description": "Solidity smart contract security auditing plugin for OpenCode — 5 specialized agents, 15 tools (14 core + optional Solodit), and a curated vulnerability knowledge base",
   "keywords": [
     "solidity",

package/src/agents/argus-prompt.ts

@@ -527,7 +527,7 @@ Scope: {list of audited files}
 
 STEPS:
 1. Call argus_read_findings with run_id above to load all findings
-2. Deduplicate: group findings by vulnerability class + code location, merge into single entries
+2. Deduplicate: group findings by vulnerability class + code location, merge into single entries. Include \`observation_ids\` on every deduped finding so each raw finding maps to exactly one report entry.
 3. Enrich: for each Critical/High finding, write specific impact and recommendation
 4. Call argus_persist_deduped with run_id and your deduped findings array — this writes the source-of-truth JSON to disk
 5. Call argus_generate_report with run_id, project_name, and scope — the tool reads deduped findings from disk
@@ -538,7 +538,7 @@ Overall risk assessment: {your assessment}
 
 Scribe will:
 1. Read raw findings (may contain duplicates from different tools)
-2. Semantically deduplicate (e.g., merge reentrancy-eth + reentrancy-cei-violation at same location)
+2. Semantically deduplicate (e.g., merge reentrancy-eth + reentrancy-cei-violation at same location) while preserving \`observation_ids\` lineage for every raw finding
 3. Enrich Critical/High findings with specific impact and recommendation text
 4. Persist deduped findings to disk via \`argus_persist_deduped\` (source-of-truth JSON)
 5. Call \`argus_generate_report\` with \`run_id\` — the tool reads from disk and renders markdown

package/src/agents/scribe-prompt.ts

@@ -53,6 +53,7 @@ Argus provides you with a \`run_id\`. Your job: read findings, deduplicate, enri
    - Add "**Detected by:**" listing all tools/checks that flagged it
    - Example: reentrancy-eth + reentrancy-cei-violation + reentrancy-eth-withdraw-state-after-call at VulnerableVault.sol:18-23 → ONE finding
    - **PRESERVATION RULE**: Every raw finding MUST map to exactly one deduped finding. Only merge findings that are genuinely the SAME vulnerability at the SAME location. Different vulnerability classes (e.g., default-visibility vs dos-revert) are SEPARATE findings even if both are Informational. NEVER drop findings during deduplication.
+   - **LINEAGE RULE**: Every deduped finding MUST include \`observation_ids\` containing each raw finding's \`observation_id\`, plus \`observation_count\`, \`sources\`, and \`reported_by_agents\` when available. This lets \`argus_generate_report\` prove raw-to-deduped parity instead of emitting a "Finding parity not verifiable" warning.
 
 3. **Enrich** (MANDATORY for Critical/High):
    - Write specific \`impact\` (concrete consequence, not "could be exploited")
@@ -61,7 +62,7 @@ Argus provides you with a \`run_id\`. Your job: read findings, deduplicate, enri
 
 4. **Persist deduped findings**: Call \`argus_persist_deduped\` with:
    - \`run_id\`: the run ID from Argus
-   - \`deduped_findings\`: JSON array of your deduped and enriched findings
+   - \`deduped_findings\`: JSON array of your deduped and enriched findings, including \`observation_ids\` lineage for every merged raw observation
 
    This writes the source-of-truth JSON to disk at \`.argus/runs/{run_id}/deduped-findings.json\`.
 

package/src/cli/commands/doctor.ts

@@ -13,6 +13,8 @@ import {
 } from "../../skills/argus-skill-resolver"
 import { parseFrontmatter, validateSkillFrontmatter } from "../../skills/skill-schema"
 import { detectViaIr } from "../../tools/slither-tool"
+import { DEFAULT_SOLODIT_PORT } from "../../tools/solodit-search-tool"
+import { checkSoloditHealth } from "../../utils/solodit-health"
 import { cliOutput } from "../cli-output"
 import type { CliCommand } from "../types"
 
@@ -459,21 +461,13 @@ export const doctorCommand: CliCommand = {
 
     const soloditEnabled = config?.solodit?.enabled !== false
     if (soloditEnabled) {
-      try {
-        const response = await fetch(
-          "https://solodit.cyfrin.io/api/trpc/findings.get?batch=1&input=" +
-            encodeURIComponent(JSON.stringify({ 0: "[]" })),
-          {
-            signal: AbortSignal.timeout(5000),
-          },
-        )
-        if (response.ok) {
-          cliOutput.log(`${GREEN}✓${RESET} Solodit API: reachable`)
-        } else {
-          cliOutput.log(`${YELLOW}⚠${RESET} Solodit API: returned ${response.status}`)
-        }
-      } catch {
-        cliOutput.log(`${YELLOW}⚠${RESET} Solodit API: unreachable`)
+      const port = config?.solodit?.port ?? DEFAULT_SOLODIT_PORT
+      const status = await checkSoloditHealth(port, true)
+      if (status.reachable) {
+        cliOutput.log(`${GREEN}✓${RESET} Solodit MCP: reachable on port ${port}`)
+      } else {
+        const suffix = status.error ? ` (${status.error})` : ""
+        cliOutput.log(`${YELLOW}⚠${RESET} Solodit MCP: unreachable on port ${port}${suffix}`)
       }
     } else {
       cliOutput.log(`${YELLOW}⚠${RESET} Solodit: disabled in config`)

package/src/constants/defaults.ts

@@ -1,8 +1,8 @@
 export const DEFAULT_MODELS = {
   argus: "anthropic/claude-opus-4-7",
-  sentinel: "anthropic/claude-sonnet-4-7",
-  pythia: "anthropic/claude-sonnet-4-7",
-  scribe: "anthropic/claude-sonnet-4-7",
+  sentinel: "anthropic/claude-sonnet-4-6",
+  pythia: "anthropic/claude-sonnet-4-6",
+  scribe: "anthropic/claude-sonnet-4-6",
   themis: "openai/gpt-5.5",
 } as const
 

package/src/state/adapters.ts

@@ -62,6 +62,13 @@ const KNOWN_INPUT_FIELDS = new Set([
   "observationId",
   "observationFingerprint",
   "issueFingerprint",
+  "observation_ids",
+  "observationIds",
+  "observation_count",
+  "observationCount",
+  "reported_by_agents",
+  "reportedByAgents",
+  "sources",
   "elements",
   "location",
 ])
@@ -157,6 +164,20 @@ function pushValidationDiagnostics(errors: ValidationError[]): Diagnostic[] {
   }))
 }
 
+function normalizeStringArray(value: unknown): string[] | undefined {
+  if (!Array.isArray(value)) return undefined
+  const strings = value.filter(
+    (item): item is string => typeof item === "string" && item.length > 0,
+  )
+  return strings.length > 0
+    ? Array.from(new Set(strings)).sort((a, b) => a.localeCompare(b))
+    : undefined
+}
+
+function normalizePositiveInteger(value: unknown): number | undefined {
+  return typeof value === "number" && Number.isInteger(value) && value > 0 ? value : undefined
+}
+
 export function normalizeToCanonicalFinding(
   raw: Finding | Record<string, unknown>,
   runId: string,
@@ -288,6 +309,16 @@ export function normalizeToCanonicalFinding(
       observationId,
     })
 
+  const observationIds =
+    normalizeStringArray(input.observation_ids) ?? normalizeStringArray(input.observationIds)
+  const reportedByAgents =
+    normalizeStringArray(input.reported_by_agents) ?? normalizeStringArray(input.reportedByAgents)
+  const sources = normalizeStringArray(input.sources)
+  const observationCount =
+    normalizePositiveInteger(input.observation_count) ??
+    normalizePositiveInteger(input.observationCount) ??
+    observationIds?.length
+
   const canonical: CanonicalFinding = {
     id: observationId,
     check,
@@ -302,6 +333,10 @@ export function normalizeToCanonicalFinding(
     issue_fingerprint: issueFingerprint,
     observation_fingerprint: observationFingerprint,
     observation_id: observationId,
+    observation_ids: observationIds,
+    observation_count: observationCount,
+    reported_by_agents: reportedByAgents,
+    sources,
     impact: typeof input.impact === "string" && input.impact.length > 0 ? input.impact : undefined,
     recommendation:
       typeof input.recommendation === "string" && input.recommendation.length > 0

package/src/tools/persist-deduped-tool.ts

@@ -85,7 +85,7 @@ export const persistDedupedTool = tool({
     deduped_findings: tool.schema
       .string()
       .describe(
-        "Serialized JSON array of deduplicated and enriched findings. Each finding should have: check, severity, confidence, description, file, lines, source, impact, recommendation, proofOfConcept.",
+        "Serialized JSON array of deduplicated and enriched findings. Each finding should have: check, severity, confidence, description, file, lines, source, impact, recommendation, proofOfConcept, and observation_ids lineage proving which raw findings were merged.",
       ),
   },
   async execute(args, context) {

package/src/tools/report-generator-tool.ts

@@ -860,6 +860,31 @@ function hasDedupLineage(findings: Finding[]): boolean {
   })
 }
 
+function observationIdsForFinding(finding: Finding): string[] {
+  const observationIds = (finding as { observation_ids?: unknown }).observation_ids
+  if (Array.isArray(observationIds)) {
+    return observationIds.filter((id): id is string => typeof id === "string" && id.length > 0)
+  }
+  return typeof finding.observation_id === "string" && finding.observation_id.length > 0
+    ? [finding.observation_id]
+    : []
+}
+
+function compareObservationLineage(
+  eventFindings: Finding[],
+  reportFindings: Finding[],
+): { missing: string[]; extra: string[]; matches: boolean } {
+  const expected = new Set(eventFindings.flatMap(observationIdsForFinding))
+  const actual = new Set(reportFindings.flatMap(observationIdsForFinding))
+  const missing = Array.from(expected)
+    .filter((id) => !actual.has(id))
+    .sort((a, b) => a.localeCompare(b))
+  const extra = Array.from(actual)
+    .filter((id) => !expected.has(id))
+    .sort((a, b) => a.localeCompare(b))
+  return { missing, extra, matches: missing.length === 0 && extra.length === 0 }
+}
+
 export function validateReportQuality(
   findings: Finding[],
   policy: QualityGatePolicy,
@@ -1235,7 +1260,9 @@ export async function executeReportGeneration(
     const hasLineage = hasDedupLineage(reportInput.findings)
     const shouldCheckParity = eventFindings.length === inputFindings.length || hasLineage
     const parity = shouldCheckParity
-      ? compareIssueFingerprintSets(eventFindings, inputFindings)
+      ? hasLineage
+        ? compareObservationLineage(projectFindings(events), reportInput.findings)
+        : compareIssueFingerprintSets(eventFindings, inputFindings)
       : { missing: [], extra: [], matches: true }
 
     if (!shouldCheckParity) {
@@ -1260,11 +1287,12 @@ export async function executeReportGeneration(
       }
 
       warningBullets.push(`- Finding parity mismatch: ${mismatchSummary}`)
+      const parityLabel = hasLineage ? "observation IDs" : "issue fingerprints"
       if (parity.missing.length > 0) {
-        warningBullets.push(`- Missing issue fingerprints: ${parity.missing.join(", ")}`)
+        warningBullets.push(`- Missing ${parityLabel}: ${parity.missing.join(", ")}`)
       }
       if (parity.extra.length > 0) {
-        warningBullets.push(`- Extra issue fingerprints: ${parity.extra.join(", ")}`)
+        warningBullets.push(`- Extra ${parityLabel}: ${parity.extra.join(", ")}`)
       }
     }
   } catch (err) {