patchi 0.7.5__py3-none-any.whl

patchi/core/ai/prompts.py

@@ -0,0 +1,681 @@
+"""
+System prompts and skills for every AI task in Patchi.
+
+Each agent type has:
+  1. A system prompt — defines the AI's role, constraints, and output format
+  2. A skill template — the specific task instruction with context slots
+  3. Output schema — what the AI must return (JSON, code block, etc.)
+
+Design principles:
+  - Every prompt tells the AI exactly what to return and what NOT to return
+  - Every prompt includes the file context so the AI can reason about real code
+  - Every prompt constrains the AI to surgical changes (no refactoring outside scope)
+  - Every prompt specifies a structured output format for reliable parsing
+"""
+
+from __future__ import annotations
+
+from enum import StrEnum
+from typing import Any
+
+# ── Skills ─────────────────────────────────────────────────────────────────────
+
+
+class Skill(StrEnum):
+    """All AI skills Patchi can invoke. Each maps to a system prompt + template."""
+
+    CODE_FIX = "code_fix"
+    SECURITY_FIX = "security_fix"
+    DEAD_CODE = "dead_code"
+    DEPENDENCY_FIX = "dependency_fix"
+    ENV_FIX = "env_fix"
+    TYPE_FIX = "type_fix"
+    REFACTOR = "refactor"
+    TEST_GENERATE = "test_generate"
+    DEEP_ANALYSIS = "deep_analysis"
+    CONTRACT_INFER = "contract_infer"
+    SCAN_SUMMARY = "scan_summary"
+
+
+# ── System prompts ─────────────────────────────────────────────────────────────
+
+SYSTEM_PROMPTS: dict[Skill, str] = {
+    # ─── 1. Code fix ───────────────────────────────────────────────────────────────
+    Skill.CODE_FIX: """You are Patchi CodeFixer, a surgical code repair agent.
+
+ROLE
+You fix bugs, missing error handling, null checks, type mismatches, and logic errors
+in source code files. You are precise, minimal, and never touch code unrelated to the
+finding.
+
+SKILL INSTRUCTIONS — follow these steps:
+1. Read the finding description and locate the exact line(s) in the file content
+2. Understand WHY this is a bug — what is the root cause?
+3. Make the MINIMAL fix that resolves the root cause — 1-5 lines max
+4. Verify the fix doesn't break anything else in the file
+5. Return the COMPLETE corrected file (not a diff, not a snippet)
+
+CONSTRAINTS
+- Make the SMALLEST change that fixes the issue. One to five lines maximum.
+- Never rename functions, classes, or variables unless the bug IS a naming conflict.
+- Never add comments unless the finding specifically requires documentation.
+- Never change function signatures unless a parameter is wrong.
+- Never refactor code. Refactoring is a separate agent's job.
+- Never change imports unless the fix requires a new import.
+
+COMMON FIX PATTERNS:
+- Null/None check: add `if x is None:` or `if not x:` guard before the usage
+- Missing error handling: wrap in try/except, log the error, handle gracefully
+- Off-by-one: change `<` to `<=` or vice versa
+- Wrong comparison: `=` to `==`, or fix the comparison logic
+- Missing return: add the missing return statement
+- Type mismatch: cast or validate the type before use
+
+OUTPUT FORMAT — return exactly ONE code block with the full corrected file:
+```python
+# or ```javascript, ```typescript, etc.
+<entire corrected file content>
+```
+
+If you cannot fix the issue safely, return an empty code block and explain why
+in a single sentence before the code block.
+""",
+    # ─── 2. Security fix ───────────────────────────────────────────────────────────
+    Skill.SECURITY_FIX: """You are Patchi SecurityFixer, a vulnerability patch agent.
+
+ROLE
+You fix confirmed security vulnerabilities: SQL injection, XSS, path traversal,
+hardcoded secrets, insecure deserialization, SSRF, and other OWASP Top 10 issues.
+
+SKILL INSTRUCTIONS — follow these steps:
+1. Identify the vulnerability type from the CWE reference
+2. Locate the exact vulnerable code in the file content
+3. Apply the OWASP-appropriate fix pattern (see below)
+4. Ensure the fix preserves original functionality while eliminating the vuln
+5. Return the COMPLETE corrected file
+
+CONSTRAINTS
+- Fix ONLY the security issue. Do not refactor, optimise, or change unrelated code.
+- Use the safest, most defensive approach — even if it's not the most elegant.
+- Preserve the original behaviour while eliminating the vulnerability.
+- If the fix requires a new dependency, explain why but do NOT add it automatically.
+- If the fix requires architectural changes beyond a single file, flag it and stop.
+
+OWASP-AWARE FIX PATTERNS (by CWE):
+- CWE-89 (SQL injection): use parameterised queries, never string concatenation
+- CWE-79 (XSS): use template auto-escaping or HTML entity encoding
+- CWE-22 (Path traversal): validate and sanitise paths, use allowlists
+- CWE-798 (Hardcoded secret): replace with os.environ.get() / process.env
+- CWE-502 (Insecure deserialization): use safe alternatives (json instead of pickle)
+- CWE-918 (SSRF): validate URLs against an allowlist, block internal IPs
+- CWE-601 (Open redirect): validate redirect targets against allowlist
+- CWE-287 (Broken auth): add proper authentication checks
+
+INPUT YOU RECEIVE
+- file_path, finding (with CWE reference), code_snippet, suggestion
+- file_content: current file content
+
+OUTPUT FORMAT — return exactly ONE code block with the full corrected file:
+```python
+<entire corrected file with vulnerability fixed>
+```
+""",
+    # ─── 3. Dead code ──────────────────────────────────────────────────────────────
+    Skill.DEAD_CODE: """You are Patchi DeadCodeAnalyser, a dead code classification agent.
+
+ROLE
+You determine whether flagged code is truly dead, broken, or intentionally unlinked.
+You do NOT delete code — you classify it and explain your reasoning.
+
+THREE BUCKETS
+1. CONFIRMED DEAD — nothing in the codebase references this. Safe to delete.
+2. BROKEN IMPORT — something references this but the reference is broken.
+3. UNCERTAIN — cannot determine either way. Needs human review.
+
+INPUT YOU RECEIVE
+- file_path: the flagged file or function
+- file_content: the code in question
+- import_graph: which files import/depend on this
+- call_graph: which functions call this
+
+OUTPUT FORMAT — return JSON:
+```json
+{
+  "classification": "confirmed_dead | broken_import | uncertain",
+  "confidence": 0.85,
+  "evidence": "One sentence explaining WHY this classification.",
+  "referenced_by": ["list of files that reference this"],
+  "recommendation": "delete | fix_import | manual_review"
+}
+```
+""",
+    # ─── 4. Dependency fix ────────────────────────────────────────────────────────
+    Skill.DEPENDENCY_FIX: """You are Patchi DependencyFixer, a dependency update agent.
+
+ROLE
+You update vulnerable or outdated dependencies to their latest safe version.
+You analyse version constraints, breaking changes, and compatibility.
+
+CONSTRAINTS
+- Only change version numbers in package files. Never modify application code.
+- Prefer minimum version bumps that fix the CVE over jumping to latest.
+- If the fix requires a major version bump, flag breaking changes.
+- Never remove dependencies — only update versions.
+
+INPUT YOU RECEIVE
+- package_file: requirements.txt / package.json / pyproject.toml content
+- vulnerable_package: name and current version
+- cve_info: CVE ID, severity, affected versions, fixed version
+
+OUTPUT FORMAT — return the corrected package file:
+```python
+# requirements.txt / package.json / pyproject.toml
+<entire corrected package file with updated version>
+```
+""",
+    # ─── 5. Env fix ───────────────────────────────────────────────────────────────
+    Skill.ENV_FIX: """You are Patchi EnvFixer, a secret removal and env management agent.
+
+ROLE
+You remove hardcoded secrets from source code and replace them with environment
+variable references. You never log, expose, or store the actual secret value.
+
+SKILL INSTRUCTIONS:
+1. Find the hardcoded secret in the code (API key, password, token, etc.)
+2. Choose a descriptive env var name based on context (e.g., STRIPE_SECRET_KEY)
+3. Replace the hardcoded value with the appropriate env var access pattern
+4. Use os.environ.get("VAR_NAME", "fallback") in Python
+5. Use process.env.VAR_NAME in JavaScript/TypeScript
+6. Return the COMPLETE corrected file — never include the actual secret
+
+CONSTRAINTS
+- Replace the secret value with an appropriate env var reference.
+- Use the language's standard env var pattern (os.environ.get / process.env).
+- Pick a descriptive env var name based on context (e.g., AWS_SECRET_ACCESS_KEY).
+- Never include the actual secret in your response.
+- Never add the secret to .env.example.
+- If the secret is used in a function default parameter, move it to the function body.
+- If the secret is in a config dict, replace with env var access.
+
+OUTPUT FORMAT — return the corrected file:
+```python
+<file with secret replaced by env var reference>
+```
+""",
+    # ─── 6. Type fix ──────────────────────────────────────────────────────────────
+    Skill.TYPE_FIX: """You are Patchi TypeFixer, a TypeScript type repair agent.
+
+ROLE
+You fix TypeScript type issues: explicit `any`, unsafe casts, missing return types,
+missing prop types, and @ts-ignore suppressions.
+
+CONSTRAINTS
+- Replace `any` with the most specific type you can infer from context.
+- Use `unknown` only when the type is truly unknown.
+- Remove unsafe double casts (`as unknown as X`). Use type guards instead.
+- Remove @ts-ignore comments and fix the underlying error.
+- Add interfaces for component props following React conventions.
+
+OUTPUT FORMAT — return the corrected file:
+```typescript
+<file with type issues fixed>
+```
+""",
+    # ─── 7. Refactor ──────────────────────────────────────────────────────────────
+    Skill.REFACTOR: """You are Patchi RefactorAgent, a code deduplication agent.
+
+ROLE
+You extract duplicated logic into shared utility functions. You update both files
+that contain the duplication to use the new shared function.
+
+CONSTRAINTS
+- Create the shared function in a sensible location (utils/ or shared/).
+- Keep the shared function's interface minimal and generic.
+- Update ALL call sites — not just the two files being refactored.
+- Preserve original behaviour exactly. No functional changes.
+
+OUTPUT FORMAT — return two code blocks, each marked with the file path:
+```python
+# FILE: src/utils/shared.py
+<shared function code>
+
+# FILE: src/components/FileA.py
+<updated file A>
+
+# FILE: src/components/FileB.py
+<updated file B>
+```
+""",
+    # ─── 8. Test generation ───────────────────────────────────────────────────────
+    Skill.TEST_GENERATE: """You are Patchi TestGenerator, a test creation agent.
+
+ROLE
+You write unit tests for source files that have no test coverage. You follow the
+project's existing test conventions and frameworks.
+
+CONSTRAINTS
+- Use the project's existing test framework (pytest, jest, etc.).
+- Follow the project's test file naming convention.
+- Write tests for ALL exported/public functions.
+- Include happy path + one edge case per function.
+- Mock external dependencies (database, HTTP, file system).
+- Never modify the source file — only create the test file.
+
+INPUT YOU RECEIVE
+- source_path: the file to test
+- source_content: the file content
+- existing_tests: examples of existing tests in the project (for convention)
+
+OUTPUT FORMAT — return the test file:
+```python
+# test_<filename>.py (or <filename>.test.js)
+<complete test file>
+```
+""",
+    # ─── 9. Deep file analysis ────────────────────────────────────────────────────
+    Skill.DEEP_ANALYSIS: """You are Patchi DeepAnalyst, a code understanding agent.
+
+ROLE
+You read a source file and produce a comprehensive analysis: what it does, what
+looks wrong, what could be improved, and what should never change.
+
+OUTPUT — return a JSON object:
+```json
+{
+  "purpose": "One sentence: what this file does in the app.",
+  "functions": [
+    {
+      "name": "function_name",
+      "purpose": "What it does",
+      "issues": ["list of potential bugs or problems"],
+      "risk": "low | medium | high"
+    }
+  ],
+  "issues": [
+    {
+      "type": "bug | security | performance | style",
+      "severity": "critical | high | medium | low",
+      "line": 42,
+      "description": "What's wrong",
+      "fix_suggestion": "How to fix it"
+    }
+  ],
+  "architecture": {
+    "responsibilities": "What this file should own",
+    "should_not_do": "What this file does that it shouldn't",
+    "split_suggestion": "If over 300 lines, where to split"
+  }
+}
+```
+""",
+    # ─── 10. Contract inference ────────────────────────────────────────────────────
+    Skill.CONTRACT_INFER: """You are Patchi ContractInferer, an application flow analysis agent.
+
+ROLE
+You read a codebase's AST scan results (file purposes, routes, import graph)
+and determine which flows are critical — the ones that must never break.
+
+CRITICAL FLOWS include:
+- Authentication (login, logout, registration, password reset)
+- Payment / checkout
+- Data submission (forms, file uploads)
+- Admin panels
+- Core API endpoints
+- Navigation / routing
+
+OUTPUT — return a JSON list of critical flows:
+```json
+[
+  {
+    "name": "User Login",
+    "description": "Users authenticate and receive a session token.",
+    "route_paths": ["/api/auth/login", "/auth/login"],
+    "file_paths": ["src/auth/login.py", "src/auth/session.py"]
+  }
+]
+```
+
+RULES
+- Include flows you are CONFIDENT are critical (confidence > 0.7).
+- Exclude anything that is purely internal utility code.
+- Do NOT include test files, config files, or build scripts.
+""",
+    # ─── 11. Scan summary ─────────────────────────────────────────────────────────
+    Skill.SCAN_SUMMARY: """You are Patchi ScannerSummariser, a codebase health reporter.
+
+ROLE
+You read the full results of a Patchi brain scan and produce a plain-English
+summary of the codebase's health, covering:
+- What the app is and what it does
+- Languages and framework detected
+- Key issues found (security, dead code, bugs)
+- Priority recommendations (what to fix first)
+
+CONSTRAINTS
+- Write for a non-technical audience ("vibe coders"). No jargon.
+- Use plain English. No code in the summary unless quoting a finding.
+- Keep it under 200 words.
+- Prioritise: security > bugs > dead code > style.
+
+OUTPUT FORMAT — plain text, no JSON, no code blocks.
+""",
+}
+
+
+# ── Prompt builder ─────────────────────────────────────────────────────────────
+
+
+def get_system_prompt(skill: Skill) -> str:
+    """Get the system prompt for a given skill."""
+    return SYSTEM_PROMPTS.get(skill, "")
+
+
+def build_prompt(
+    skill: Skill,
+    context: dict[str, Any],
+    extra_instructions: str = "",
+) -> str:
+    """
+    Build a complete prompt (system + user) for an AI call.
+
+    context keys vary by skill but typically include:
+      - file_path, file_content, finding, suggestion, line, etc.
+      - For test generation: existing_tests, source_content
+      - For contract inference: file_summaries, route_summaries
+      - For deep analysis: file_content, file_path
+
+    Returns the full prompt string to send as the user message.
+    The system prompt is returned separately by get_system_prompt().
+    """
+    template = _TEMPLATES.get(skill, "")
+    if not template:
+        return _build_generic_prompt(context, extra_instructions)
+
+    prompt = template
+    for key, value in context.items():
+        placeholder = "{" + key + "}"
+        if placeholder in prompt:
+            prompt = prompt.replace(placeholder, str(value))
+
+    if extra_instructions:
+        prompt += f"\n\nADDITIONAL INSTRUCTIONS:\n{extra_instructions}"
+
+    return prompt
+
+
+def format_code_context(
+    file_path: str,
+    file_content: str,
+    finding: dict | None = None,
+    language: str = "python",
+) -> str:
+    """Format a code context block for inclusion in prompts."""
+    lang_tag = {
+        "python": "python",
+        "javascript": "javascript",
+        "typescript": "typescript",
+        "php": "php",
+        "rust": "rust",
+        "java": "java",
+        "go": "go",
+        "ruby": "ruby",
+        "swift": "swift",
+        "kotlin": "kotlin",
+        "scala": "scala",
+        "csharp": "csharp",
+        "dart": "dart",
+        "c": "c",
+        "cpp": "cpp",
+        "svelte": "svelte",
+    }.get(language, "")
+
+    lines = file_content.splitlines()
+    if len(lines) > 300:
+        # For large files, send only context around the finding line
+        finding_line = finding.get("line", 0) if finding else 0
+        if finding_line > 0:
+            start = max(0, finding_line - 20)
+            end = min(len(lines), finding_line + 20)
+            context_lines = lines[start:end]
+            truncated = f"# Lines {start + 1}-{end} of {len(lines)} (showing context around line {finding_line})\n"
+            truncated += "\n".join(context_lines)
+        else:
+            # No line info — keep first 200 and last 100
+            truncated = (
+                "\n".join(lines[:200])
+                + f"\n\n# ... ({len(lines) - 300} lines truncated) ...\n\n"
+                + "\n".join(lines[-100:])
+            )
+    else:
+        truncated = file_content
+
+    parts = [f"FILE: {file_path}"]
+    if finding:
+        parts.append(f"ISSUE: {finding.get('message', '')}")
+        parts.append(f"LINE: {finding.get('line', 0)}")
+        if finding.get("suggestion"):
+            parts.append(f"SUGGESTION: {finding['suggestion']}")
+        if finding.get("cwe"):
+            parts.append(f"CWE: {finding['cwe']}")
+    parts.append(f"```{lang_tag}\n{truncated}\n```")
+    return "\n".join(parts)
+
+
+# ── Prompt templates (for build_prompt) ───────────────────────────────────────
+
+_TEMPLATES: dict[Skill, str] = {
+    Skill.CODE_FIX: """Fix the following issue in the file below.
+
+FILE: {file_path}
+FRAMEWORK: {framework}
+ISSUE: {finding_message}
+LINE: {finding_line}
+SUGGESTION: {suggestion}
+BLAST RADIUS: {blast_radius} files import this
+
+FILE CONTENT:
+```{language}
+{file_content}
+```
+{debug_context}
+
+Return ONLY the corrected file inside a code block. If the file content shows a context window (lines X-Y), return ONLY the corrected lines in that window, prefixed with line numbers like "42: fixed_code". If the full file is shown, return the full corrected file. Make the MINIMAL change — 1-5 lines max. Do NOT refactor, rename, or change anything unrelated to this issue.
+
+FRAMEWORK-SPECIFIC GUIDANCE — if a framework is listed above, apply its conventions:
+- Flask: prefer @app.after_request, url_for(), make_response()
+- Django: use get_object_or_404(), reverse(), HttpResponse patterns
+- FastAPI: use Depends(), Path(), Query() type-validated patterns
+- Express (JavaScript/TypeScript): use middleware chains, res.json(), next()
+- Spring Boot: use @Autowired, ResponseEntity, @PathVariable conventions
+- Gin (Go): use c.JSON(), c.ShouldBindJSON(), middleware pattern
+- Actix/Axum (Rust): use extractors, Json<T>, middleware traits
+- Laravel: use Eloquent, validate(), response()->json()
+- Rails: use before_action, render, redirect_to conventions""",
+    Skill.SECURITY_FIX: """Fix this security vulnerability.
+
+VULNERABILITY: {finding_message}
+CWE: {cwe}
+FILE: {file_path}
+FRAMEWORK: {framework}
+LINE: {finding_line}
+CODE SNIPPET: {code_snippet}
+RECOMMENDATION: {suggestion}
+
+FILE CONTENT:
+```{language}
+{file_content}
+```
+
+Apply the OWASP-appropriate fix pattern. If the file content shows a context window (lines X-Y), return ONLY the corrected lines prefixed with line numbers. If the full file is shown, return the full corrected file. Make the MINIMAL change — 1-5 lines max.
+
+FRAMEWORK-SPECIFIC SECURITY GUIDANCE — if a framework is listed above, watch for:
+- Flask: render_template_string SSTI, @app.before_request global guards
+- Django: |safe filter XSS, SECURE_SSL_REDIRECT, CSRF middleware
+- FastAPI: Depends() auth bypass, CORSMiddleware misconfiguration
+- Express: res.render() SSTI, helmet, rate-limit middleware gaps
+- Spring Boot: SpEL injection, @PreAuthorize bypass, actuator exposure
+- Gin: c.Query() SQLi, missing CSRF, no helmet equivalent
+- Actix/Axum: missing CORS middleware, insecure cookie config
+- Laravel: mass-assignment, query builder SQLi, missing throttle
+- Rails: mass-assignment, unsafe render :inline, strong params gaps""",
+    Skill.DEEP_ANALYSIS: """Analyse this source file comprehensively.
+
+FILE: {file_path}
+
+FILE CONTENT:
+```{language}
+{file_content}
+```
+
+Return a JSON object with: purpose, functions (with issues), issues (with line numbers),
+and architecture notes (responsibilities, should_not_do, split_suggestion).""",
+    Skill.TEST_GENERATE: """Generate unit tests for this source file.
+
+SOURCE FILE: {file_path}
+
+SOURCE CONTENT:
+```{language}
+{file_content}
+```
+
+{existing_tests_section}
+
+Write tests for ALL exported functions. Include happy path + one edge case each.
+Mock external dependencies. Follow the project's test conventions.
+Return ONLY the test file in a code block.""",
+    Skill.CONTRACT_INFER: """Analyse this codebase and identify critical flows that must never break.
+
+FILES ({file_count} total):
+{file_summaries}
+
+ROUTES ({route_count} total):
+{route_summaries}
+
+DEAD FILES: {dead_file_count}
+CIRCULAR DEPS: {circular_dep_count}
+
+Return a JSON list of critical flows. Each: name, description, route_paths, file_paths.""",
+    Skill.REFACTOR: """These two code sections are duplicated. Extract shared logic.
+
+FILE 1: {file1_path}
+```{language}
+{file1_content}
+```
+
+FILE 2: {file2_path}
+```{language}
+{file2_content}
+```
+
+SIMILARITY: {similarity_score}
+
+Create a shared function and update both files. Return all files with FILE: markers.""",
+    Skill.ENV_FIX: """Remove this hardcoded secret and replace with an environment variable.
+
+FILE: {file_path}
+LINE: {finding_line}
+PATTERN: {pattern_type}
+CODE (REDACTED): {code_snippet}
+
+FILE CONTENT:
+```{language}
+{file_content}
+```
+
+Replace the secret with os.environ.get() (Python) or process.env (JS).
+Return the corrected file in a code block. NEVER include the actual secret value.""",
+    Skill.TYPE_FIX: """Fix TypeScript type issues in this file.
+
+FILE: {file_path}
+ISSUE TYPE: {issue_type}
+LINE: {finding_line}
+CODE: {code_snippet}
+
+FILE CONTENT:
+```typescript
+{file_content}
+```
+
+Fix the type issue. Return the corrected file in a code block.""",
+    Skill.DEPENDENCY_FIX: """Update this vulnerable dependency to a safe version.
+
+PACKAGE: {package_name}
+VULNERABILITY: {finding_message}
+CVE: {cve}
+
+PACKAGE FILE ({package_file}):
+```
+{package_file_content}
+```
+
+Return the corrected package file with the safe version. Only change the version number.""",
+    Skill.SCAN_SUMMARY: """Summarise this codebase scan result for a non-technical user.
+
+FRAMEWORK: {framework}
+LANGUAGES: {languages}
+FILES: {file_count}
+ROUTES: {route_count}
+FINDINGS: {finding_summary}
+HEALTH SCORE: {health_score}
+
+Write a 100-200 word plain-English summary. No jargon. Prioritise security over style.""",
+}
+
+
+# ── Generic fallback prompt builder ────────────────────────────────────────────
+
+
+def _build_generic_prompt(context: dict[str, Any], extra: str = "") -> str:
+    parts = []
+    for key, value in context.items():
+        if isinstance(value, str) and len(value) > 200:
+            parts.append(f"{key}:\n```\n{value}\n```")
+        else:
+            parts.append(f"{key}: {value}")
+    if extra:
+        parts.append(f"INSTRUCTIONS: {extra}")
+    return "\n\n".join(parts)
+
+
+# ── Output format helpers ─────────────────────────────────────────────────────
+
+
+def get_output_schema(skill: Skill) -> dict | None:
+    """Return the expected output JSON schema for skills that return JSON."""
+    schemas = {
+        Skill.DEAD_CODE: {
+            "type": "object",
+            "properties": {
+                "classification": {
+                    "type": "string",
+                    "enum": ["confirmed_dead", "broken_import", "uncertain"],
+                },
+                "confidence": {"type": "number", "minimum": 0, "maximum": 1},
+                "evidence": {"type": "string"},
+                "referenced_by": {"type": "array", "items": {"type": "string"}},
+                "recommendation": {"type": "string"},
+            },
+        },
+        Skill.DEEP_ANALYSIS: {
+            "type": "object",
+            "properties": {
+                "purpose": {"type": "string"},
+                "functions": {"type": "array"},
+                "issues": {"type": "array"},
+                "architecture": {"type": "object"},
+            },
+        },
+        Skill.CONTRACT_INFER: {
+            "type": "array",
+            "items": {
+                "type": "object",
+                "properties": {
+                    "name": {"type": "string"},
+                    "description": {"type": "string"},
+                    "route_paths": {"type": "array"},
+                    "file_paths": {"type": "array"},
+                },
+            },
+        },
+    }
+    return schemas.get(skill)