feat: fix scanner failures, expand dispatch to 40+ patterns, implement automaton stubs

Scanner fixes (was 78% failure rate):
- Stop swallowing stderr in run-fleet.sh and fleet-coordinator.sh
- Distinguish exit 0 (clean), exit 1 (findings), exit 2 (error)
- Add fallback hypatia-cli.sh paths in fleet-coordinator.sh
- Validate JSON output is non-empty before parsing

Dispatch expansion (was 9 patterns, now 40+):
- Expand strategy 3 case mapping to cover all hypatia finding types
- Map workflow hygiene, code safety, root hygiene, and structural rules
- Use combined pattern+type matching for broader coverage

Robot-repo-automaton stubs implemented:
- detector.rs: detect_language_mismatch checks workflow language matrices
  against actual repo languages; detect_content_match does regex scanning
- hypatia.rs: fetch_ruleset tries API then falls back to local verisimdb-data
  recipes; Command fixes execute via subprocess; Patch fixes use git apply
  with dry-run check; 5 core RSR rules as baseline
- fleet.rs: session persistence to ~/.gitbot-fleet/sessions/ as JSON

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

fleet-coordinator.sh

@@ -66,24 +66,45 @@ run_hypatia_scan() {
     # Generate findings file with timestamp
     local findings_file="$repo_findings_dir/${SESSION_ID}.json"
 
+    local scan_stderr
+    scan_stderr=$(mktemp /tmp/hypatia-stderr-XXXXXX)
+    local scan_exit=0
+
     if [[ -x "$FLEET_DIR/../hypatia/hypatia-cli.sh" ]]; then
         HYPATIA_FORMAT=json "$FLEET_DIR/../hypatia/hypatia-cli.sh" scan "$repo_path" \
-            > "$findings_file" 2>/dev/null || true
+            > "$findings_file" 2>"$scan_stderr" || scan_exit=$?
+    elif [[ -x "/var/mnt/eclipse/repos/hypatia/hypatia-cli.sh" ]]; then
+        HYPATIA_FORMAT=json "/var/mnt/eclipse/repos/hypatia/hypatia-cli.sh" scan "$repo_path" \
+            > "$findings_file" 2>"$scan_stderr" || scan_exit=$?
     else
-        log_warn "Hypatia CLI not found, using POC scanner"
-        "$FLEET_DIR/../hypatia/poc-scanner.sh" "$repo_path" > "$findings_file" 2>/dev/null || true
+        log_warn "Hypatia CLI not found at expected paths"
+        rm -f "$scan_stderr"
+        return 1
+    fi
+
+    # Exit 2 = real error; exit 0 = clean; exit 1 = findings found (both valid)
+    if [[ "$scan_exit" -eq 2 ]]; then
+        local err_msg
+        err_msg=$(head -3 "$scan_stderr" 2>/dev/null || echo "unknown error")
+        log_error "Scanner error for $repo_name (exit 2): $err_msg"
+        rm -f "$scan_stderr" "$findings_file"
+        return 1
     fi
+    rm -f "$scan_stderr"
 
-    if [[ -f "$findings_file" ]]; then
-        local issue_count=$(jq 'length' "$findings_file" 2>/dev/null || echo 0)
+    # Validate JSON output
+    if [[ -f "$findings_file" ]] && [[ -s "$findings_file" ]] && jq empty "$findings_file" 2>/dev/null; then
+        local issue_count
+        issue_count=$(jq 'if type == "array" then length elif .findings then (.findings | length) else 0 end' "$findings_file" 2>/dev/null || echo 0)
         log_bot "hypatia" "Found $issue_count issues in $repo_name"
 
         # Create/update latest.json symlink
         ln -sf "$(basename "$findings_file")" "$repo_findings_dir/latest.json"
 
         echo "$findings_file"
     else
-        log_error "Scan failed for $repo_name"
+        log_error "Scan produced invalid/empty JSON for $repo_name"
+        rm -f "$findings_file"
         return 1
     fi
 }

robot-repo-automaton/Cargo.lock

@@ -64,6 +64,7 @@ anyhow = "1"
 glob = "0.3"
 walkdir = "2"
 regex = "1"
+dirs = "6.0"
 
 # Async utilities
 futures = "0.3"

robot-repo-automaton/Cargo.toml

@@ -188,18 +188,144 @@ impl Detector {
         }
     }
 
-    /// Detect language mismatch issues (e.g., CodeQL configured for wrong languages)
-    fn detect_language_mismatch(&self, _error_type: &ErrorType) -> Option<DetectedIssue> {
-        // This would require parsing the workflow file to compare configured vs actual
-        // For now, return None - implement when we have YAML parsing
-        None
+    /// Detect language mismatch issues (e.g., CodeQL configured for wrong languages).
+    ///
+    /// Checks that CI workflow language matrices match the actual languages
+    /// detected in the repository. Catches stale CodeQL configs, wrong
+    /// test runners, and mismatched linter configurations.
+    fn detect_language_mismatch(&self, error_type: &ErrorType) -> Option<DetectedIssue> {
+        let detection = &error_type.detection;
+
+        // extension_map maps workflow file patterns to expected language keys
+        // e.g., {"codeql.yml": "javascript-typescript", "rust.yml": "rust"}
+        if detection.extension_map.is_empty() {
+            return None;
+        }
+
+        let mut mismatches = Vec::new();
+
+        for (workflow_glob, expected_lang) in &detection.extension_map {
+            // Check if the workflow file exists
+            let matching_files = self.files_matching(workflow_glob);
+
+            if matching_files.is_empty() {
+                continue;
+            }
+
+            // Check if the expected language is actually present in the repo
+            let lang_present = self.languages.contains(expected_lang);
+
+            if !lang_present {
+                // Workflow references a language not found in this repo
+                for file in matching_files {
+                    mismatches.push(file.clone());
+                }
+            }
+        }
+
+        // Also check the reverse: repo has languages but no corresponding workflow
+        let repo_languages: Vec<String> = self.languages.iter().cloned().collect();
+        let configured_langs: Vec<&String> = detection.extension_map.values().collect();
+
+        for lang in &repo_languages {
+            // Map repo language to CodeQL language name
+            let codeql_lang = match lang.as_str() {
+                "javascript" | "typescript" => "javascript-typescript",
+                "python" => "python",
+                "go" => "go",
+                "rust" => "rust",
+                "java" | "kotlin" => "java-kotlin",
+                "ruby" => "ruby",
+                "csharp" => "csharp",
+                _ => continue,
+            };
+
+            if !configured_langs.iter().any(|c| c.as_str() == codeql_lang) {
+                // Language exists in repo but isn't in any workflow config
+                // This is informational, not always a problem
+            }
+        }
+
+        if mismatches.is_empty() {
+            None
+        } else {
+            Some(DetectedIssue {
+                error_type_id: error_type.id.clone(),
+                error_name: error_type.name.clone(),
+                severity: error_type.severity,
+                description: format!(
+                    "{} — {} workflow(s) reference languages not found in repo",
+                    error_type.description,
+                    mismatches.len()
+                ),
+                affected_files: mismatches,
+                confidence: 0.90,
+                suggested_fix: format!(
+                    "{:?} {} — update language matrix to match actual repo languages",
+                    error_type.fix.action, error_type.fix.target
+                ),
+                commit_message: error_type.commit_message.clone(),
+            })
+        }
     }
 
-    /// Detect content match issues
-    fn detect_content_match(&self, _error_type: &ErrorType) -> Option<DetectedIssue> {
-        // Would require regex matching in file contents
-        // Implement when needed
-        None
+    /// Detect content match issues by regex scanning file contents.
+    ///
+    /// Searches files matching the glob patterns in `detection.files` for
+    /// content matching the regex in `detection.condition`. This enables
+    /// detection of anti-patterns like `believe_me`, `sorry`, hardcoded
+    /// secrets, eval() usage, unpinned actions, etc.
+    fn detect_content_match(&self, error_type: &ErrorType) -> Option<DetectedIssue> {
+        let detection = &error_type.detection;
+
+        // condition holds the regex pattern to search for
+        let regex_str = detection.condition.as_deref()?;
+        let re = regex::Regex::new(regex_str).ok()?;
+
+        let mut affected = Vec::new();
+
+        // files holds glob patterns for which files to search
+        for file_glob in &detection.files {
+            let matching = self.files_matching(file_glob);
+
+            for file_path in matching {
+                // Skip binary files (> 1MB or non-UTF8)
+                if let Ok(metadata) = std::fs::metadata(file_path) {
+                    if metadata.len() > 1_048_576 {
+                        continue;
+                    }
+                }
+
+                if let Ok(content) = std::fs::read_to_string(file_path) {
+                    if re.is_match(&content) {
+                        affected.push(file_path.clone());
+                    }
+                }
+            }
+        }
+
+        if affected.is_empty() {
+            None
+        } else {
+            let match_count = affected.len();
+
+            Some(DetectedIssue {
+                error_type_id: error_type.id.clone(),
+                error_name: error_type.name.clone(),
+                severity: error_type.severity,
+                description: format!(
+                    "{} — pattern found in {} file(s)",
+                    error_type.description, match_count
+                ),
+                affected_files: affected,
+                confidence: 0.95,
+                suggested_fix: format!(
+                    "{:?} {}",
+                    error_type.fix.action, error_type.fix.target
+                ),
+                commit_message: error_type.commit_message.clone(),
+            })
+        }
     }
 
     /// Run all detections from a catalog

robot-repo-automaton/src/detector.rs

@@ -14,6 +14,8 @@ use crate::error::{Error, Result};
 use gitbot_shared_context::{BotId, Context, Finding, Severity as FleetSeverity};
 use std::path::PathBuf;
 use tracing::{debug, info};
+use chrono;
+use dirs;
 
 /// Fleet coordinator for robot-repo-automaton
 pub struct FleetCoordinator {
@@ -52,8 +54,13 @@ impl FleetCoordinator {
 
             ctx.complete_bot(BotId::RobotRepoAutomaton, findings_count, errors_count, files_analyzed)
                 .map_err(|e| Error::Internal(format!("Failed to complete bot: {}", e)))?;
+        }
 
-            // TODO: Persist context to ~/.gitbot-fleet/sessions/
+        // Persist session to disk (after mutable borrow is released)
+        if let Some(ref ctx) = self.context {
+            if let Err(e) = Self::persist_session_static(ctx) {
+                debug!("Failed to persist session (non-fatal): {}", e);
+            }
         }
 
         self.context = None;
@@ -187,6 +194,38 @@ impl FleetCoordinator {
         self.context.as_ref()
     }
 
+    /// Persist session context to disk for cross-session visibility.
+    ///
+    /// Writes a JSON summary of the session to ~/.gitbot-fleet/sessions/
+    /// so other bots and the fleet coordinator can see completed work.
+    fn persist_session_static(ctx: &Context) -> Result<()> {
+        let sessions_dir = dirs::home_dir()
+            .unwrap_or_else(|| std::path::PathBuf::from("/tmp"))
+            .join(".gitbot-fleet/sessions");
+
+        std::fs::create_dir_all(&sessions_dir)
+            .map_err(|e| Error::Internal(format!("Failed to create sessions dir: {}", e)))?;
+
+        let session_file = sessions_dir.join(format!("{}.json", ctx.session_id));
+
+        let session_data = serde_json::json!({
+            "session_id": ctx.session_id.to_string(),
+            "repo_name": ctx.repo_name,
+            "completed_at": chrono::Utc::now().to_rfc3339(),
+            "findings_count": ctx.findings_from(BotId::RobotRepoAutomaton).len(),
+            "bot": "robot-repo-automaton",
+        });
+
+        let json = serde_json::to_string_pretty(&session_data)
+            .map_err(|e| Error::Internal(format!("Failed to serialize session: {}", e)))?;
+
+        std::fs::write(&session_file, json)
+            .map_err(|e| Error::Internal(format!("Failed to write session file: {}", e)))?;
+
+        info!("Session persisted to {}", session_file.display());
+        Ok(())
+    }
+
     /// Check if connected to fleet
     pub fn is_connected(&self) -> bool {
         self.context.is_some()