tzero-mcp 10.7.0 → 10.7.2

package/src/tzero_fixer/polyglot_build_healer.py

@@ -0,0 +1,364 @@
+# -*- coding: utf-8 -*-
+"""
+T-Zero Polyglot Build, Container, & Infrastructure Healer
+========================================================
+Specialized AST & syntax healer for cross-language build tools, Dockerfiles,
+Makefiles, container configurations, web server rules, and multi-ecosystem manifests.
+
+Key Capabilities:
+  - Dockerfile best-practice auditor & .dockerignore generator
+  - Makefile tab-vs-space indentation healer (eliminates 'missing separator' errors)
+  - Makefile .PHONY target generator
+  - Nginx / Caddy reverse proxy syntax and semicolon validator
+  - Rust Cargo.toml & Go go.mod basic syntax integrity checkers
+
+Author: Siber Akademi T-Zero R&D Team
+Version: 10.5.0 | 100% Free & Local Offline | Zero-Leak Certified
+"""
+
+from __future__ import annotations
+
+import os
+import re
+from dataclasses import dataclass
+from pathlib import Path
+from typing import Any, Dict, List, Optional, Tuple
+
+from tzero_fixer.models import (
+    DiagnosticCategory,
+    DiagnosticIssue,
+    HealAction,
+    SeverityLevel,
+)
+
+
+class PolyglotBuildHealer:
+    """Surgeon for polyglot build scripts, container files, and infrastructure recipes."""
+
+    @classmethod
+    def diagnose_workspace(cls, workspace_path: str) -> List[DiagnosticIssue]:
+        """Audit build and container files across the workspace."""
+        issues: List[DiagnosticIssue] = []
+        root = Path(workspace_path).resolve()
+
+        # 1. Dockerfile check
+        for dockerfile in root.glob("**/Dockerfile*"):
+            if dockerfile.is_file() and not cls._is_ignored(dockerfile):
+                issues.extend(cls._audit_dockerfile(dockerfile, root))
+
+        # 2. Makefile check
+        for makefile in root.glob("**/Makefile*"):
+            if makefile.is_file() and not cls._is_ignored(makefile):
+                issues.extend(cls._audit_makefile(makefile))
+
+        # 3. Nginx / Caddy conf check
+        for conf in root.glob("**/*.conf"):
+            if conf.is_file() and not cls._is_ignored(conf):
+                issues.extend(cls._audit_webserver_conf(conf))
+
+        # 4. Cargo.toml check
+        for cargo in root.glob("**/Cargo.toml"):
+            if cargo.is_file() and not cls._is_ignored(cargo):
+                issues.extend(cls._audit_cargo_toml(cargo))
+
+        # 5. go.mod check
+        for gopkg in root.glob("**/go.mod"):
+            if gopkg.is_file() and not cls._is_ignored(gopkg):
+                issues.extend(cls._audit_go_mod(gopkg))
+
+        return issues
+
+    @classmethod
+    def _is_ignored(cls, p: Path) -> bool:
+        """Check if path is inside ignored VCS, venv, or build folders."""
+        parts = p.parts
+        ignored_names = {".git", ".venv", "venv", "node_modules", "dist", "build", ".tox", "__pycache__"}
+        return any(part in ignored_names for part in parts)
+
+    @classmethod
+    def _audit_dockerfile(cls, dockerfile: Path, root: Path) -> List[DiagnosticIssue]:
+        """Audit Dockerfile for best practices and check for .dockerignore."""
+        issues: List[DiagnosticIssue] = []
+        try:
+            content = dockerfile.read_text(encoding="utf-8", errors="replace")
+            lines = content.splitlines()
+        except Exception:
+            return issues
+
+        # Check for missing .dockerignore in directory
+        dockerignore = dockerfile.parent / ".dockerignore"
+        if not dockerignore.is_file():
+            issues.append(DiagnosticIssue(
+                category=DiagnosticCategory.WORKSPACE,
+                severity=SeverityLevel.WARNING,
+                description=f"Dockerfile in '{dockerfile.parent.name}' lacks a '.dockerignore' file (unnecessary files like .git or .venv will bloat context)",
+                file_path=str(dockerfile),
+                suggested_fix="Generate optimized .dockerignore to exclude git, venv, cache, and build artifacts",
+                metadata={"issue_type": "missing_dockerignore", "target_dir": str(dockerfile.parent)},
+            ))
+
+        for idx, line in enumerate(lines, start=1):
+            stripped = line.strip()
+
+            # FROM :latest warning
+            if stripped.startswith("FROM ") and ":latest" in stripped:
+                issues.append(DiagnosticIssue(
+                    category=DiagnosticCategory.WORKSPACE,
+                    severity=SeverityLevel.INFO,
+                    description=f"Dockerfile uses unpinned ':latest' base image: '{stripped}'",
+                    file_path=str(dockerfile),
+                    line_number=idx,
+                    suggested_fix="Pin base image to specific digest or version tag for deterministic builds",
+                    metadata={"issue_type": "unpinned_docker_image"},
+                ))
+
+            # ADD instead of COPY
+            if stripped.startswith("ADD ") and not ("://" in stripped or stripped.endswith(".tar.gz") or stripped.endswith(".tgz")):
+                issues.append(DiagnosticIssue(
+                    category=DiagnosticCategory.WORKSPACE,
+                    severity=SeverityLevel.INFO,
+                    description=f"Using 'ADD' instead of 'COPY' for simple local file copy: '{stripped}'",
+                    file_path=str(dockerfile),
+                    line_number=idx,
+                    suggested_fix="Replace 'ADD' with 'COPY' for local files as per Dockerfile best practices",
+                    metadata={"issue_type": "docker_add_to_copy", "line_num": idx},
+                ))
+
+            # apt-get install without cleanup
+            if "apt-get install" in stripped and "rm -rf /var/lib/apt/lists" not in stripped and not stripped.endswith("\\"):
+                issues.append(DiagnosticIssue(
+                    category=DiagnosticCategory.WORKSPACE,
+                    severity=SeverityLevel.WARNING,
+                    description=f"apt-get install without cache cleanup in same RUN layer: '{stripped}'",
+                    file_path=str(dockerfile),
+                    line_number=idx,
+                    suggested_fix="Append '&& rm -rf /var/lib/apt/lists/*' to reduce container image footprint",
+                    metadata={"issue_type": "docker_apt_cleanup"},
+                ))
+
+        return issues
+
+    @classmethod
+    def _audit_makefile(cls, makefile: Path) -> List[DiagnosticIssue]:
+        """Audit Makefile for space vs tab indentation and missing .PHONY declarations."""
+        issues: List[DiagnosticIssue] = []
+        try:
+            content = makefile.read_text(encoding="utf-8", errors="replace")
+            lines = content.splitlines()
+        except Exception:
+            return issues
+
+        in_rule = False
+        space_indented_lines: List[int] = []
+        targets: List[str] = []
+
+        for idx, line in enumerate(lines, start=1):
+            if not line.strip() or line.strip().startswith("#"):
+                continue
+
+            # Detect target rule
+            target_match = re.match(r"^([a-zA-Z0-9_\-\.]+)\s*:\s*(.*)$", line)
+            if target_match:
+                in_rule = True
+                tgt = target_match.group(1)
+                if not tgt.startswith("."):
+                    targets.append(tgt)
+                continue
+
+            # Recipe lines must start with TAB, not spaces
+            if in_rule:
+                if line.startswith("    ") or (line.startswith(" ") and not line.startswith("\t")):
+                    space_indented_lines.append(idx)
+
+        if space_indented_lines:
+            issues.append(DiagnosticIssue(
+                category=DiagnosticCategory.SYNTAX,
+                severity=SeverityLevel.ERROR,
+                description=f"Makefile contains {len(space_indented_lines)} recipe line(s) indented with spaces instead of tabs (causes '*** missing separator' error)",
+                file_path=str(makefile),
+                line_number=space_indented_lines[0],
+                suggested_fix="Convert leading spaces on recipe lines to real tab (\\t) characters",
+                metadata={"issue_type": "makefile_spaces_to_tabs", "lines": space_indented_lines},
+            ))
+
+        if targets and ".PHONY:" not in content:
+            issues.append(DiagnosticIssue(
+                category=DiagnosticCategory.WORKSPACE,
+                severity=SeverityLevel.INFO,
+                description="Makefile declares targets without '.PHONY' directive (can conflict with files named after targets)",
+                file_path=str(makefile),
+                suggested_fix=f"Declare targets as .PHONY: {', '.join(targets[:5])}",
+                metadata={"issue_type": "makefile_missing_phony", "targets": targets},
+            ))
+
+        return issues
+
+    @classmethod
+    def _audit_webserver_conf(cls, conf_file: Path) -> List[DiagnosticIssue]:
+        """Audit Nginx / reverse proxy config files for missing semicolons."""
+        issues: List[DiagnosticIssue] = []
+        try:
+            content = conf_file.read_text(encoding="utf-8", errors="replace")
+            lines = content.splitlines()
+        except Exception:
+            return issues
+
+        # Only audit if it looks like an nginx/caddy configuration
+        if "server {" not in content and "http {" not in content and "location " not in content:
+            return issues
+
+        for idx, line in enumerate(lines, start=1):
+            stripped = line.strip()
+            if not stripped or stripped.startswith("#") or stripped.endswith("{") or stripped.endswith("}"):
+                continue
+            if not stripped.endswith(";"):
+                issues.append(DiagnosticIssue(
+                    category=DiagnosticCategory.SYNTAX,
+                    severity=SeverityLevel.ERROR,
+                    description=f"Missing terminating semicolon in Nginx directive: '{stripped}'",
+                    file_path=str(conf_file),
+                    line_number=idx,
+                    suggested_fix="Append ';' to directive line",
+                    metadata={"issue_type": "nginx_missing_semicolon", "line_num": idx},
+                ))
+
+        return issues
+
+    @classmethod
+    def _audit_cargo_toml(cls, cargo_file: Path) -> List[DiagnosticIssue]:
+        """Audit Rust Cargo.toml for basic sections."""
+        issues: List[DiagnosticIssue] = []
+        try:
+            content = cargo_file.read_text(encoding="utf-8", errors="replace")
+        except Exception:
+            return issues
+
+        if "[package]" not in content and "[workspace]" not in content:
+            issues.append(DiagnosticIssue(
+                category=DiagnosticCategory.DEPENDENCY,
+                severity=SeverityLevel.ERROR,
+                description="Cargo.toml is missing mandatory '[package]' or '[workspace]' header",
+                file_path=str(cargo_file),
+                suggested_fix="Add '[package]' table with name, version, and edition = '2021'",
+                metadata={"issue_type": "cargo_missing_package"},
+            ))
+
+        return issues
+
+    @classmethod
+    def _audit_go_mod(cls, go_mod_file: Path) -> List[DiagnosticIssue]:
+        """Audit Go go.mod for module declaration."""
+        issues: List[DiagnosticIssue] = []
+        try:
+            content = go_mod_file.read_text(encoding="utf-8", errors="replace")
+        except Exception:
+            return issues
+
+        if not re.search(r"^module\s+\S+", content, re.MULTILINE):
+            issues.append(DiagnosticIssue(
+                category=DiagnosticCategory.DEPENDENCY,
+                severity=SeverityLevel.ERROR,
+                description="go.mod is missing mandatory 'module <path>' declaration",
+                file_path=str(go_mod_file),
+                suggested_fix="Declare module path on first line of go.mod",
+                metadata={"issue_type": "go_missing_module"},
+            ))
+
+        return issues
+
+    @classmethod
+    def heal_issue(cls, issue: DiagnosticIssue, dry_run: bool = False) -> HealAction:
+        """Autonomously heal polyglot build and container issues."""
+        itype = issue.metadata.get("issue_type")
+        file_path = issue.file_path
+
+        if itype == "missing_dockerignore":
+            target_dir = Path(issue.metadata.get("target_dir", "."))
+            dignore = target_dir / ".dockerignore"
+            if dry_run:
+                return HealAction(issue=issue, success=True, details=f"[Dry-Run] Would create .dockerignore in {target_dir}")
+
+            ignore_content = (
+                "# T-Zero Autonomous Dockerignore\n"
+                ".git\n"
+                ".gitignore\n"
+                ".venv\n"
+                "venv/\n"
+                "env/\n"
+                "node_modules/\n"
+                "__pycache__/\n"
+                "*.pyc\n"
+                "*.pyo\n"
+                "dist/\n"
+                "build/\n"
+                "*.egg-info/\n"
+                ".DS_Store\n"
+                "Thumbs.db\n"
+                ".env\n"
+                ".env.local\n"
+                "coverage/\n"
+                ".pytest_cache/\n"
+            )
+            dignore.write_text(ignore_content, encoding="utf-8")
+            return HealAction(issue=issue, success=True, details=f"Generated high-performance .dockerignore in '{target_dir.name}'")
+
+        if itype == "makefile_spaces_to_tabs" and file_path:
+            p = Path(file_path)
+            if dry_run:
+                return HealAction(issue=issue, success=True, details="[Dry-Run] Would convert recipe spaces to tabs in Makefile")
+
+            lines = p.read_text(encoding="utf-8", errors="replace").splitlines()
+            new_lines = []
+            converted = 0
+            in_rule = False
+
+            for line in lines:
+                if not line.strip() or line.strip().startswith("#"):
+                    new_lines.append(line)
+                    continue
+
+                if re.match(r"^[a-zA-Z0-9_\-\.]+\s*:\s*.*$", line):
+                    in_rule = True
+                    new_lines.append(line)
+                    continue
+
+                if in_rule:
+                    if line.startswith("    "):
+                        new_lines.append("\t" + line[4:])
+                        converted += 1
+                        continue
+                    elif line.startswith("  "):
+                        new_lines.append("\t" + line.lstrip(" "))
+                        converted += 1
+                        continue
+
+                new_lines.append(line)
+
+            p.write_text("\n".join(new_lines) + "\n", encoding="utf-8")
+            return HealAction(issue=issue, success=True, details=f"Converted {converted} recipe lines from spaces to real tabs in Makefile")
+
+        if itype == "makefile_missing_phony" and file_path:
+            p = Path(file_path)
+            targets = issue.metadata.get("targets", [])
+            if dry_run:
+                return HealAction(issue=issue, success=True, details=f"[Dry-Run] Would prepend .PHONY: {' '.join(targets)} to Makefile")
+
+            content = p.read_text(encoding="utf-8", errors="replace")
+            phony_line = f".PHONY: {' '.join(targets)}\n\n"
+            p.write_text(phony_line + content, encoding="utf-8")
+            return HealAction(issue=issue, success=True, details=f"Injected .PHONY target declarations into Makefile")
+
+        if itype == "docker_add_to_copy" and file_path:
+            p = Path(file_path)
+            line_num = issue.metadata.get("line_num")
+            if dry_run:
+                return HealAction(issue=issue, success=True, details=f"[Dry-Run] Would replace ADD with COPY on line {line_num}")
+
+            lines = p.read_text(encoding="utf-8", errors="replace").splitlines()
+            if line_num and 1 <= line_num <= len(lines):
+                lines[line_num - 1] = re.sub(r"^ADD\s+", "COPY ", lines[line_num - 1])
+                p.write_text("\n".join(lines) + "\n", encoding="utf-8")
+                return HealAction(issue=issue, success=True, details=f"Replaced 'ADD' with 'COPY' on line {line_num} of Dockerfile")
+
+        return HealAction(issue=issue, success=False, details=f"No automated repair for issue type '{itype}'")
+

package/src/tzero_fixer/polyglot_config_healer.py

@@ -0,0 +1,318 @@
+# -*- coding: utf-8 -*-
+"""T-Zero Polyglot Configuration & Environment Files Healer.
+
+Performs forensic repair and hygiene checks on configuration files:
+- JSON repair engine (strips trailing commas, single quotes, unquoted keys, and JS comments).
+- Gitignore & Security hygiene (verifies .env, *.pem, *.key are in .gitignore).
+- Gitattributes LF/CRLF normalizer (* text=auto eol=lf).
+- EditorConfig generator and validator.
+
+Author: Toprak Ahmet Aydogmus (Siber Akademi)
+Version: 10.4.0
+"""
+
+import difflib
+import json
+import os
+import re
+import time
+from dataclasses import dataclass
+from pathlib import Path
+from typing import Any, Dict, List, Optional, Set, Tuple
+
+from .models import (
+    DiagnosticCategory,
+    DiagnosticIssue,
+    HealAction,
+    SeverityLevel,
+)
+
+
+class PolyglotConfigHealer:
+    """Specialized repair engine for JSON, YAML, Gitignore, and Gitattributes files."""
+
+    SENSITIVE_GITIGNORE_ENTRIES = [
+        ".env",
+        ".env.local",
+        "*.pem",
+        "*.key",
+        "*.pfx",
+        "*.p12",
+        "id_rsa",
+        "id_ed25519",
+        ".tzero/fixer_backups/",
+    ]
+
+    # -------------------------------------------------------------------------
+    # 1. JSON SURGICAL REPAIR ENGINE
+    # -------------------------------------------------------------------------
+    @classmethod
+    def heal_json_string(cls, content: str) -> Any:
+        """Helper to repair trailing commas and single quotes in JSON strings."""
+        @dataclass
+        class JsonHealResult:
+            original_content: str
+            repaired_content: str
+            changed: bool
+
+        changed, repaired = cls.repair_json_text(content)
+        return JsonHealResult(
+            original_content=content,
+            repaired_content=repaired,
+            changed=changed,
+        )
+
+    @classmethod
+    def repair_json_text(cls, text: str) -> Tuple[bool, str]:
+        """Surgically repair trailing commas, single quotes, and comments in JSON."""
+        repaired = text
+
+        # Strip line comments // ...
+        repaired = re.sub(r"^\s*//.*$", "", repaired, flags=re.MULTILINE)
+        # Strip block comments /* ... */
+        repaired = re.sub(r"/\*.*?\*/", "", repaired, flags=re.DOTALL)
+
+        # Convert single quotes to double quotes (around keys/values)
+        repaired = re.sub(r"\'([^\'\\]*)\'", r'"\1"', repaired)
+
+        # Strip trailing commas in objects: , } -> }
+        repaired = re.sub(r",\s*(\})", r"\1", repaired)
+        # Strip trailing commas in arrays: , ] -> ]
+        repaired = re.sub(r",\s*(\])", r"\1", repaired)
+
+        try:
+            json.loads(repaired)
+            return True, repaired
+        except Exception:
+            return False, text
+
+    @classmethod
+    def check_json_files(cls, workspace_dir: str = ".") -> List[DiagnosticIssue]:
+        """Inspect all JSON files in workspace for syntax errors and trailing commas."""
+        issues: List[DiagnosticIssue] = []
+        root = Path(workspace_dir).resolve()
+
+        for jf in root.glob("**/*.json"):
+            if not jf.is_file() or any(p in jf.parts for p in (".git", "node_modules", ".venv", "venv", "dist", "build")):
+                continue
+
+            try:
+                with open(jf, "r", encoding="utf-8") as f:
+                    content = f.read()
+                json.loads(content)
+            except json.JSONDecodeError as jde:
+                can_heal, _ = cls.repair_json_text(content)
+                issues.append(DiagnosticIssue(
+                    category=DiagnosticCategory.POLYGLOT.value,
+                    severity=SeverityLevel.ERROR.value,
+                    file_path=str(jf),
+                    line=jde.lineno,
+                    column=jde.colno,
+                    error_code="TZ-JSON-SYNTAX-ERROR",
+                    message=f"JSON syntax error in {jf.name}: {jde.msg}",
+                    suggested_fix="Surgically heal trailing commas, comments, and quotes" if can_heal else "Fix JSON structure",
+                    auto_fixable=can_heal,
+                    metadata={"action": "repair_json_file", "path": str(jf)}
+                ))
+            except Exception:
+                continue
+
+        return issues
+
+    # -------------------------------------------------------------------------
+    # 2. GITIGNORE HYGIENE DOCTOR
+    # -------------------------------------------------------------------------
+    @classmethod
+    def check_gitignore_hygiene(cls, workspace_dir: str = ".") -> List[DiagnosticIssue]:
+        """Verify .gitignore exists and contains critical secret patterns (.env, *.key)."""
+        issues: List[DiagnosticIssue] = []
+        root = Path(workspace_dir).resolve()
+        gi_file = root / ".gitignore"
+
+        if not gi_file.is_file():
+            issues.append(DiagnosticIssue(
+                category=DiagnosticCategory.SECURITY.value,
+                severity=SeverityLevel.ERROR.value,
+                file_path=str(root),
+                line=None,
+                column=None,
+                error_code="TZ-GIT-MISSING-GITIGNORE",
+                message="No '.gitignore' file found in workspace root (risk of committing secrets)",
+                suggested_fix="Generate comprehensive .gitignore with .env and secret patterns",
+                auto_fixable=True,
+                metadata={"action": "create_gitignore", "path": str(gi_file)}
+            ))
+            return issues
+
+        try:
+            with open(gi_file, "r", encoding="utf-8", errors="replace") as f:
+                content = f.read()
+            lines = set(line.strip() for line in content.splitlines() if line.strip())
+
+            missing_entries = []
+            for entry in cls.SENSITIVE_GITIGNORE_ENTRIES:
+                if entry not in lines and not any(l.startswith(entry) for l in lines):
+                    missing_entries.append(entry)
+
+            if missing_entries:
+                issues.append(DiagnosticIssue(
+                    category=DiagnosticCategory.SECURITY.value,
+                    severity=SeverityLevel.WARNING.value,
+                    file_path=str(gi_file),
+                    line=1,
+                    column=0,
+                    error_code="TZ-GIT-UNPROTECTED-SECRETS",
+                    message=f".gitignore is missing critical secret patterns: {', '.join(missing_entries[:4])}",
+                    suggested_fix=f"Append {', '.join(missing_entries)} to .gitignore",
+                    auto_fixable=True,
+                    metadata={"action": "append_gitignore_entries", "entries": missing_entries, "path": str(gi_file)}
+                ))
+        except Exception:
+            pass
+
+        return issues
+
+    # -------------------------------------------------------------------------
+    # 3. GITATTRIBUTES LF/CRLF NORMALIZER
+    # -------------------------------------------------------------------------
+    @classmethod
+    def check_gitattributes(cls, workspace_dir: str = ".") -> List[DiagnosticIssue]:
+        """Verify .gitattributes exists to prevent cross-platform CRLF/LF chaos."""
+        issues: List[DiagnosticIssue] = []
+        root = Path(workspace_dir).resolve()
+        ga_file = root / ".gitattributes"
+
+        if not ga_file.is_file():
+            issues.append(DiagnosticIssue(
+                category=DiagnosticCategory.ENVIRONMENT.value,
+                severity=SeverityLevel.INFO.value,
+                file_path=str(ga_file),
+                line=None,
+                column=None,
+                error_code="TZ-GIT-MISSING-GITATTRIBUTES",
+                message="No '.gitattributes' found; cross-platform line endings (CRLF vs LF) may drift",
+                suggested_fix="Generate standard .gitattributes ('* text=auto eol=lf')",
+                auto_fixable=True,
+                metadata={"action": "create_gitattributes", "path": str(ga_file)}
+            ))
+
+        return issues
+
+    @classmethod
+    def diagnose_workspace(cls, workspace_dir: str = ".") -> List[DiagnosticIssue]:
+        """Run all polyglot configuration and git hygiene audits."""
+        issues: List[DiagnosticIssue] = []
+        issues.extend(cls.check_json_files(workspace_dir))
+        issues.extend(cls.check_gitignore_hygiene(workspace_dir))
+        issues.extend(cls.check_gitattributes(workspace_dir))
+        return issues
+
+    @classmethod
+    def execute_config_heals(cls, issues: List[DiagnosticIssue], dry_run: bool = False) -> List[HealAction]:
+        """Execute repairs for JSON files, .gitignore, and .gitattributes."""
+        actions: List[HealAction] = []
+
+        for issue in issues:
+            action_type = issue.metadata.get("action")
+            file_p = issue.metadata.get("path")
+            if not issue.auto_fixable or not action_type or not file_p:
+                continue
+
+            t0 = time.time()
+            p = Path(file_p)
+
+            try:
+                # 1. Repair JSON file
+                if action_type == "repair_json_file" and p.is_file():
+                    with open(p, "r", encoding="utf-8", errors="replace") as f:
+                        content = f.read()
+                    success, rep = cls.repair_json_text(content)
+                    if success and rep != content:
+                        diff = "".join(difflib.unified_diff(
+                            content.splitlines(keepends=True),
+                            rep.splitlines(keepends=True),
+                            fromfile="before.json",
+                            tofile="after.json"
+                        ))
+                        if not dry_run:
+                            with open(p, "w", encoding="utf-8", newline="\n") as f:
+                                f.write(rep)
+                        actions.append(HealAction(
+                            category=DiagnosticCategory.POLYGLOT.value,
+                            action_type=action_type,
+                            file_path=file_p,
+                            description=f"Surgically repaired JSON syntax in {p.name}",
+                            success=True,
+                            diff=diff,
+                            duration_ms=round((time.time() - t0) * 1000, 2)
+                        ))
+
+                # 2. Create .gitignore
+                elif action_type == "create_gitignore":
+                    entries = ["# T-Zero Autonomous Security Gitignore", "__pycache__/", "*.pyc", ".venv/", "venv/", "node_modules/", "dist/", "build/"] + cls.SENSITIVE_GITIGNORE_ENTRIES
+                    content = "\n".join(entries) + "\n"
+                    if not dry_run:
+                        with open(p, "w", encoding="utf-8", newline="\n") as f:
+                            f.write(content)
+                    actions.append(HealAction(
+                        category=DiagnosticCategory.SECURITY.value,
+                        action_type=action_type,
+                        file_path=file_p,
+                        description="Generated secure .gitignore protecting .env and key files",
+                        success=True,
+                        duration_ms=round((time.time() - t0) * 1000, 2)
+                    ))
+
+                # 3. Append to .gitignore
+                elif action_type == "append_gitignore_entries":
+                    missing = issue.metadata.get("entries", [])
+                    if missing:
+                        append_str = "\n# T-Zero Security Guard Protections\n" + "\n".join(missing) + "\n"
+                        if not dry_run:
+                            with open(p, "a", encoding="utf-8") as f:
+                                f.write(append_str)
+                        actions.append(HealAction(
+                            category=DiagnosticCategory.SECURITY.value,
+                            action_type=action_type,
+                            file_path=file_p,
+                            description=f"Appended {len(missing)} security patterns ({', '.join(missing[:3])}) to .gitignore",
+                            success=True,
+                            duration_ms=round((time.time() - t0) * 1000, 2)
+                        ))
+
+                # 4. Create .gitattributes
+                elif action_type == "create_gitattributes":
+                    content = (
+                        "# T-Zero Standard Gitattributes - Normalize LF Line Endings\n"
+                        "* text=auto eol=lf\n"
+                        "*.py text eol=lf\n"
+                        "*.json text eol=lf\n"
+                        "*.md text eol=lf\n"
+                        "*.yml text eol=lf\n"
+                        "*.yaml text eol=lf\n"
+                        "*.sh text eol=lf\n"
+                        "*.bat text eol=crlf\n"
+                        "*.ps1 text eol=crlf\n"
+                    )
+                    if not dry_run:
+                        with open(p, "w", encoding="utf-8", newline="\n") as f:
+                            f.write(content)
+                    actions.append(HealAction(
+                        category=DiagnosticCategory.ENVIRONMENT.value,
+                        action_type=action_type,
+                        file_path=file_p,
+                        description="Created .gitattributes to ensure cross-platform LF line ending consistency",
+                        success=True,
+                        duration_ms=round((time.time() - t0) * 1000, 2)
+                    ))
+            except Exception as e:
+                actions.append(HealAction(
+                    category=DiagnosticCategory.POLYGLOT.value,
+                    action_type=action_type,
+                    file_path=file_p,
+                    description=f"Failed configuration remediation: {e}",
+                    success=False,
+                    duration_ms=round((time.time() - t0) * 1000, 2)
+                ))
+
+        return actions