feat: subprocess provider, SQLite LLM cache, meta-analyzer batching, and scan UX improvements#234

Open

scholesgx wants to merge 42 commits into

NVIDIA:mainfrom

scholesgx:feature/use-skillspector-inside-agent-session

Commits on Jun 24, 2026

fix: meta_analyzer init outside try, add exc_info tracebacks, update stale tests

Gaylene Scholes
and
claude
committed
feat: add SubprocessChatModel that routes prompts via shell command

Gaylene Scholes
and
claude
committed
fix: widen with_structured_output signature, fix multi-modal fallback, single-strip
Gaylene Scholes
committed
feat: add SubprocessProvider implementing LLMProvider protocol

Gaylene Scholes
and
claude
committed
feat: register subprocess provider in provider selector
Gaylene Scholes
committed
docs: document subprocess provider and SKILLSPECTOR_LLM_COMMAND in .env.example
Gaylene Scholes
committed
fix: Windows shlex, ValueError on missing command, dict schema support, timeout handling
Gaylene Scholes
committed
fix: add DEFAULT_MODEL and SLOT_DEFAULTS class attrs to SubprocessProvider
Gaylene Scholes
committed
fix: standards compliance — ruff B904/F401, mypy types, pydocstyle docstrings, bandit nosec, 99% coverage
Gaylene Scholes
committed
docs: add subprocess provider to README, DEVELOPMENT.md, PI_EXTENSION.md, and CLI help
Gaylene Scholes
committed

Commits on Jun 25, 2026

docs: add subprocess provider acceptance test plan and results

Gaylene Scholes
and
claude
committed

Commits on Jun 26, 2026

fix: baseline writes to target directory by default (Problem 8)

Gaylene Scholes
and
claude
committed
fix: YARA YR1/YR4 reduce confidence on negation/education context (Problem 12)

Gaylene Scholes
and
claude
committed
fix: rephrase TP4 prompt to avoid enterprise injection-detection trigger (Problem 1)

Gaylene Scholes
and
claude
committed
fix: LP1/LP3 remediation includes accepted type names and capability snippet (Problems 7 + 11)

Gaylene Scholes
and
claude
committed
fix: subprocess exit-code-1 enterprise diagnostic + --no-llm fallback hint (Problem 2)

Gaylene Scholes
and
claude
committed
feat: AST4/PE3 test-fixture heuristics + --include-test-fixtures flag (Problem 5)

Gaylene Scholes
and
claude
committed
fix: add --include-test-fixtures docstring; tighten PE3 keyword scope to function name

Gaylene Scholes
and
claude
committed
feat: auto-discover .skillspector-baseline.yaml + --no-baseline flag (Problem 10)
Gaylene Scholes
committed
feat: --recursive --depth N flag + improved fallback warning (Problem 9)

Gaylene Scholes
and
claude
committed
feat: --recursive --detail flag for full findings in JSON output (Problem 4)

Gaylene Scholes
and
claude
committed
feat: offensive_security classification skips score-based recommendation (Problem 13)

Gaylene Scholes
and
claude
committed
feat: emit LLM progress to stderr during analysis (Problem 6)

Gaylene Scholes
and
claude
committed
feat: --skip-meta flag to bypass meta-analyzer LLM pass (Problem 3b)

Gaylene Scholes
and
claude
committed
feat: SQLite LLM response cache by content hash (Problem 3c)

Gaylene Scholes
and
claude
committed
fix: wire LLM cache to semantic analyzer nodes; move json import to module level

Gaylene Scholes
and
claude
committed
fix: correct _cache_key return type annotation to CacheKey

Gaylene Scholes
and
claude
committed

Commits on Jun 27, 2026

feat: meta-analyzer batching with SKILLSPECTOR_META_BATCH_SIZE (Problem 3a)

Gaylene Scholes
and
claude
committed
fix: move Counter import to module level; isolate META_BATCH_SIZE reload in tests

Gaylene Scholes
and
claude
committed
fix: remove dead PE3 constant, add LLMResponseCache __del__, document TP4 cache exclusion

Gaylene Scholes
and
claude
committed

Commits on Jun 29, 2026

chore: align README tables, fix CLI formatting, add bridge/baseline/plan files

Gaylene Scholes
and
claude
committed
merge: integrate origin/main — bedrock provider, PE5, E5, builtins evasion tests

Gaylene Scholes
and
claude
committed

Commits on Jul 1, 2026

fix: remove leftover conflict-marker lines

Gaylene Scholes
and
claude
committed
Merge remote-tracking branch 'origin/main' into feature/use-skillspector-inside-agent-session
Gaylene Scholes
committed
fix: coerce plain-string prompts in subprocess provider structured output

Gaylene Scholes
and
claude
committed
fix: move LLM cache outside scanned skill directory

Gaylene Scholes
and
claude
committed
test: fix llm_cache edge-case test to actually reproduce the gap it documents
Gaylene Scholes
committed
fix: derive LLM cache key from rendered prompt, model, and schema hash
Gaylene Scholes
committed
fix: make baseline auto-discovery opt-in via --auto-baseline
Gaylene Scholes
committed
fix: make self-declared offensive_security classification opt-in to trust

Gaylene Scholes
and
claude
committed
test: add SARIF coverage for multi-skill --output regression
Gaylene Scholes
committed
chore: ruff format + fix pre-existing lint drift

Gaylene Scholes
and
claude
committed