feat(pair-corpus-honesty): add vibe-py, vfc-js and agent-vfc slices with mechanism vocabulary

Tasks 1.1, 5.1, 5.2, 5.4 and the data half of 5.3. - mechanisms.toml: closed vocabulary v1 (20 ids) every expected row cites. - vibe-py: 35 Real-Vuln-Benchmark pairs (Apache-2.0), human provenance only because the LLM-generated repositories carry no license (escalated). - vfc-js: 17 Node fix-commit pairs harvested upstream (MIT/Apache-2.0), SecBench.js itself is not vendored (no license); sinks derived on 13/17. - agent-vfc: 29 agent-trailer fixes as catalog-candidates.toml plus REVIEW.md; the loaded catalog stays empty until a human reviews them. - datasets.toml and README document every slice and its review status. Co-Authored-By: Claude Fable 5.1 <[email protected]> Claude-Session: https://claude.ai/code/session_01T7XD7x5KonMdmGRkp63EQG
2026-10-20 21:49:28 +00:00 · 2026-09-05 10:45:42 +02:00
parent c3e841003c
commit 8ab4207618
182 changed files with 31299 additions and 0 deletions
@@ -0,0 +1,91 @@
+// Provenance: Cap-go/capgo.app  (fixed).
+// repo: Cap-go/capgo.app
+// commit: 4dadd2580d02213d227a331eee0232aa59859b59
+// parent: 8c0ac7e233946abd8dc26581b871e9fcd0928899
+// commit_url: https://github.com/Cap-go/capgo.app/commit/4dadd2580d02213d227a331eee0232aa59859b59
+// cve: 
+// license: AGPL-3.0
+// function: next
+// relpath: supabase/functions/_backend/utils/hono.ts
+// provenance: agent
+// mechanism: permissive_default
+
+export function createHono(functionName: string, _version: string) {
+  let appGlobal
+  if (getRuntimeKey() === 'deno') {
+    appGlobal = new Hono<MiddlewareKeyVariables>().basePath(`/${functionName}`)
+  }
+  else {
+    appGlobal = new Hono<MiddlewareKeyVariables>()
+  }
+
+  // Plugin hot paths (/updates|/stats|/channel_self and the CF plugin worker).
+  // HAR/CPU inspect showed middleware + logging dominating non-DB request cost.
+  const pluginHotPath = functionName === 'plugin'
+    || functionName === 'updates'
+    || functionName === 'stats'
+    || functionName === 'channel_self'
+
+  appGlobal.use('*', (c, next): Promise<any> => {
+    // ADD HEADER TO IDENTIFY WORKER SOURCE
+    const name = `${getEnv(c, 'ENV_NAME') || functionName}-${CapgoVersion}`
+    c.header('X-Worker-Source', name)
+    const hostname = new URL(c.req.url).hostname
+    if (!isPreviewHost(hostname))
+      c.header('Content-Security-Policy', API_CONTENT_SECURITY_POLICY)
+    return next()
+  })
+
+  // Echo ACAO after the handler so Capacitor WebView origins work on routes
+  // that forgot useCors (GET /ok). Do not mount hono cors globally: it
+  // short-circuits OPTIONS and strips TUS discovery headers.
+  if (!pluginHotPath) {
+    appGlobal.use('*', async (c, next) => {
+      await next()
+      const origin = c.req.header('origin')
+      if (!origin)
+        return
+      const allowed = getAllowedCorsOrigin(origin, c)
+      if (allowed) {
+        c.header('Access-Control-Allow-Origin', allowed)
+        c.header('Vary', 'Origin', { append: true })
+      }
+    })
+  }
+
+  // Skip hono's access logger on plugin hot paths — it serializes every request
+  // on millions of device calls/day.
+  if (!pluginHotPath)
+    appGlobal.use('*', logger())
+  // Use platform-specific request IDs, fallback to generated UUID.
+  // Do not cloudlog inside the generator: it runs on every request (incl. cf-ray).
+  appGlobal.use('*', requestId({
+    generator: (c) => {
+      // Cloudflare provides the Ray ID in the cf-ray header
+      // Check this first as it's our primary deployment target
+      const cfRay = c.req.header('cf-ray')
+      if (cfRay)
+        return cfRay
+      // Supabase Edge Functions provide SB_EXECUTION_ID
+      const sbExecutionId = getEnv(c, 'SB_EXECUTION_ID')
+      if (sbExecutionId)
+        return sbExecutionId
+      // Fallback to crypto.randomUUID() if not on any known platform
+      return crypto.randomUUID()
+    },
+  }))
+
+  appGlobal.post('/ok', (c) => {
+    return c.json(BRES)
+  })
+  appGlobal.post('/ko', (c) => {
+    const defaultResponse: SimpleErrorResponse = {
+      error: 'unknown_error',
+      message: 'KO',
+      moreInfo: {},
+    }
+    return c.json(defaultResponse, 500)
+  })
+
+  return appGlobal
+}
@@ -0,0 +1,74 @@
+// Provenance: Cap-go/capgo.app  (vuln).
+// repo: Cap-go/capgo.app
+// commit: 8c0ac7e233946abd8dc26581b871e9fcd0928899
+// parent: 8c0ac7e233946abd8dc26581b871e9fcd0928899
+// commit_url: https://github.com/Cap-go/capgo.app/commit/4dadd2580d02213d227a331eee0232aa59859b59
+// cve: 
+// license: AGPL-3.0
+// function: next
+// relpath: supabase/functions/_backend/utils/hono.ts
+// provenance: agent
+// mechanism: permissive_default
+
+export function createHono(functionName: string, _version: string) {
+  let appGlobal
+  if (getRuntimeKey() === 'deno') {
+    appGlobal = new Hono<MiddlewareKeyVariables>().basePath(`/${functionName}`)
+  }
+  else {
+    appGlobal = new Hono<MiddlewareKeyVariables>()
+  }
+
+  // Plugin hot paths (/updates|/stats|/channel_self and the CF plugin worker).
+  // HAR/CPU inspect showed middleware + logging dominating non-DB request cost.
+  const pluginHotPath = functionName === 'plugin'
+    || functionName === 'updates'
+    || functionName === 'stats'
+    || functionName === 'channel_self'
+
+  appGlobal.use('*', (c, next): Promise<any> => {
+    // ADD HEADER TO IDENTIFY WORKER SOURCE
+    const name = `${getEnv(c, 'ENV_NAME') || functionName}-${CapgoVersion}`
+    c.header('X-Worker-Source', name)
+    const hostname = new URL(c.req.url).hostname
+    if (!isPreviewHost(hostname))
+      c.header('Content-Security-Policy', API_CONTENT_SECURITY_POLICY)
+    return next()
+  })
+
+  // Skip hono's access logger on plugin hot paths — it serializes every request
+  // on millions of device calls/day.
+  if (!pluginHotPath)
+    appGlobal.use('*', logger())
+  // Use platform-specific request IDs, fallback to generated UUID.
+  // Do not cloudlog inside the generator: it runs on every request (incl. cf-ray).
+  appGlobal.use('*', requestId({
+    generator: (c) => {
+      // Cloudflare provides the Ray ID in the cf-ray header
+      // Check this first as it's our primary deployment target
+      const cfRay = c.req.header('cf-ray')
+      if (cfRay)
+        return cfRay
+      // Supabase Edge Functions provide SB_EXECUTION_ID
+      const sbExecutionId = getEnv(c, 'SB_EXECUTION_ID')
+      if (sbExecutionId)
+        return sbExecutionId
+      // Fallback to crypto.randomUUID() if not on any known platform
+      return crypto.randomUUID()
+    },
+  }))
+
+  appGlobal.post('/ok', (c) => {
+    return c.json(BRES)
+  })
+  appGlobal.post('/ko', (c) => {
+    const defaultResponse: SimpleErrorResponse = {
+      error: 'unknown_error',
+      message: 'KO',
+      moreInfo: {},
+    }
+    return c.json(defaultResponse, 500)
+  })
+
+  return appGlobal
+}