feat(pair-corpus-honesty): add vibe-py, vfc-js and agent-vfc slices with mechanism vocabulary

Tasks 1.1, 5.1, 5.2, 5.4 and the data half of 5.3.

- mechanisms.toml: closed vocabulary v1 (20 ids) every expected row cites.
- vibe-py: 35 Real-Vuln-Benchmark pairs (Apache-2.0), human provenance only
  because the LLM-generated repositories carry no license (escalated).
- vfc-js: 17 Node fix-commit pairs harvested upstream (MIT/Apache-2.0),
  SecBench.js itself is not vendored (no license); sinks derived on 13/17.
- agent-vfc: 29 agent-trailer fixes as catalog-candidates.toml plus
  REVIEW.md; the loaded catalog stays empty until a human reviews them.
- datasets.toml and README document every slice and its review status.

Co-Authored-By: Claude Fable 5.1 <[email protected]>
Claude-Session: https://claude.ai/code/session_01T7XD7x5KonMdmGRkp63EQG

benchmarks/pairs/agent-vfc/rag-pipeline-utils-config-handler-76e5f0/fixed.js

@@ -0,0 +1,51 @@
+// Provenance: DevilsDev/rag-pipeline-utils  (fixed).
+// repo: DevilsDev/rag-pipeline-utils
+// commit: 76e5f0a94d6803d0e463d26a61cedb7da90857a7
+// parent: ba587867118f703632ff2dc63c4feb8ad6793420
+// commit_url: https://github.com/DevilsDev/rag-pipeline-utils/commit/76e5f0a94d6803d0e463d26a61cedb7da90857a7
+// cve: 
+// license: MIT
+// function: handleConfigSet
+// relpath: src/cli/handlers/config-handler.js
+// provenance: agent
+// mechanism: prototype_pollution
+
+async function handleConfigSet(globalOptions, key, value) {
+  try {
+    const config = JSON.parse(await fs.readFile(globalOptions.config, "utf-8"));
+
+    // Set value using dot notation
+    const keys = key.split(".");
+    const forbidden = new Set(["__proto__", "constructor", "prototype"]);
+    if (keys.some((k) => forbidden.has(k))) {
+      logger.error("Invalid configuration key: contains restricted property");
+      process.exit(1);
+    }
+
+    let current = config;
+
+    for (let i = 0; i < keys.length - 1; i++) {
+      if (!current[keys[i]]) {
+        current[keys[i]] = {};
+      }
+      current = current[keys[i]];
+    }
+
+    // Parse value
+    let parsedValue;
+    try {
+      parsedValue = JSON.parse(value);
+    } catch (error) {
+      parsedValue = value; // Keep as string
+    }
+
+    current[keys[keys.length - 1]] = parsedValue;
+
+    // Save configuration
+    await fs.writeFile(globalOptions.config, JSON.stringify(config, null, 2));
+    console.log("✅ Configuration updated");
+  } catch (error) {
+    logger.error("❌ Failed to set configuration:", error.message);
+    process.exit(1);
+  }
+}

benchmarks/pairs/agent-vfc/rag-pipeline-utils-config-handler-76e5f0/vuln.js

@@ -0,0 +1,45 @@
+// Provenance: DevilsDev/rag-pipeline-utils  (vuln).
+// repo: DevilsDev/rag-pipeline-utils
+// commit: ba587867118f703632ff2dc63c4feb8ad6793420
+// parent: ba587867118f703632ff2dc63c4feb8ad6793420
+// commit_url: https://github.com/DevilsDev/rag-pipeline-utils/commit/76e5f0a94d6803d0e463d26a61cedb7da90857a7
+// cve: 
+// license: MIT
+// function: handleConfigSet
+// relpath: src/cli/handlers/config-handler.js
+// provenance: agent
+// mechanism: prototype_pollution
+
+async function handleConfigSet(globalOptions, key, value) {
+  try {
+    const config = JSON.parse(await fs.readFile(globalOptions.config, "utf-8"));
+
+    // Set value using dot notation
+    const keys = key.split(".");
+    let current = config;
+
+    for (let i = 0; i < keys.length - 1; i++) {
+      if (!current[keys[i]]) {
+        current[keys[i]] = {};
+      }
+      current = current[keys[i]];
+    }
+
+    // Parse value
+    let parsedValue;
+    try {
+      parsedValue = JSON.parse(value);
+    } catch (error) {
+      parsedValue = value; // Keep as string
+    }
+
+    current[keys[keys.length - 1]] = parsedValue;
+
+    // Save configuration
+    await fs.writeFile(globalOptions.config, JSON.stringify(config, null, 2));
+    console.log("✅ Configuration updated");
+  } catch (error) {
+    logger.error("❌ Failed to set configuration:", error.message);
+    process.exit(1);
+  }
+}