feat(pair-corpus-honesty): add vibe-py, vfc-js and agent-vfc slices with mechanism vocabulary

Tasks 1.1, 5.1, 5.2, 5.4 and the data half of 5.3. - mechanisms.toml: closed vocabulary v1 (20 ids) every expected row cites. - vibe-py: 35 Real-Vuln-Benchmark pairs (Apache-2.0), human provenance only because the LLM-generated repositories carry no license (escalated). - vfc-js: 17 Node fix-commit pairs harvested upstream (MIT/Apache-2.0), SecBench.js itself is not vendored (no license); sinks derived on 13/17. - agent-vfc: 29 agent-trailer fixes as catalog-candidates.toml plus REVIEW.md; the loaded catalog stays empty until a human reviews them. - datasets.toml and README document every slice and its review status. Co-Authored-By: Claude Fable 5.1 <[email protected]> Claude-Session: https://claude.ai/code/session_01T7XD7x5KonMdmGRkp63EQG
2026-10-21 14:09:27 +00:00 · 2026-09-05 10:45:42 +02:00
parent c3e841003c
commit 8ab4207618
182 changed files with 31299 additions and 0 deletions
@@ -0,0 +1,43 @@
+// Provenance: nfriedly/node-bestzip  (fixed).
+// repo: nfriedly/node-bestzip
+// commit: 45d4a901478c6a8f396c8b959dd6cf8fd3f955b6
+// parent: fcea252e52b6078eff6caf5531bd32c53fccb59f
+// commit_url: https://github.com/nfriedly/node-bestzip/commit/45d4a901478c6a8f396c8b959dd6cf8fd3f955b6
+// cve: CVE-2020-7730
+// license: MIT
+// function: nativeZip
+// relpath: lib/bestzip.js
+// provenance: human
+// mechanism: source_reaches_sink
+// upstream_start: 66
+
+const nativeZip = options =>
+  new Promise((resolve, reject) => {
+    const cwd = options.cwd || process.cwd();
+    const command = "zip";
+    expandSources(cwd, options.source, (err, sources) => {
+      const args = ["--quiet", "--recurse-paths", options.destination].concat(
+        sources
+      );
+      const zipProcess = cp.spawn(command, args, {
+        stdio: "inherit",
+        cwd
+      });
+      zipProcess.on("error", reject);
+      zipProcess.on("close", exitCode => {
+        if (exitCode === 0) {
+          resolve();
+        } else {
+          // exit code 12 means "nothing to do" right?
+          //console.log('rejecting', zipProcess)
+          reject(
+            new Error(
+              `Unexpected exit code from native zip: ${exitCode}\n executed command '${command} ${args.join(
+                " "
+              )}'\n executed in directory '${cwd}'`
+            )
+          );
+        }
+      });
+    });
+  });
@@ -0,0 +1,41 @@
+// Provenance: nfriedly/node-bestzip  (vuln).
+// repo: nfriedly/node-bestzip
+// commit: fcea252e52b6078eff6caf5531bd32c53fccb59f
+// parent: fcea252e52b6078eff6caf5531bd32c53fccb59f
+// commit_url: https://github.com/nfriedly/node-bestzip/commit/45d4a901478c6a8f396c8b959dd6cf8fd3f955b6
+// cve: CVE-2020-7730
+// license: MIT
+// function: nativeZip
+// relpath: lib/bestzip.js
+// provenance: human
+// mechanism: source_reaches_sink
+// upstream_start: 66
+
+const nativeZip = options =>
+  new Promise((resolve, reject) => {
+    const sources = Array.isArray(options.source)
+      ? options.source.join(" ")
+      : options.source;
+    const command = `zip --quiet --recurse-paths ${
+      options.destination
+    } ${sources}`;
+    const zipProcess = cp.exec(command, {
+      stdio: "inherit",
+      cwd: options.cwd
+    });
+    zipProcess.on("error", reject);
+    zipProcess.on("close", exitCode => {
+      if (exitCode === 0) {
+        resolve();
+      } else {
+        // exit code 12 means "nothing to do" right?
+        //console.log('rejecting', zipProcess)
+        reject(
+          new Error(
+            `Unexpected exit code from native zip command: ${exitCode}\n executed command '${command}'\n executed inin directory '${options.cwd ||
+              process.cwd()}'`
+          )
+        );
+      }
+    });
+  });