chore: rebrand to BitterSecurity and add CI test gate

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -18,7 +18,7 @@ body:
           required: true
         - label: I am using the latest version of Vigilo
           required: true
-        - label: I have read the [documentation](https://github.com/PurpleAILAB/Vigilo#readme)
+        - label: I have read the [documentation](https://github.com/BitterSecurity/Vigilo#readme)
           required: true
 
   - type: textarea

.github/ISSUE_TEMPLATE/config.yml

@@ -1,5 +1,5 @@
 blank_issues_enabled: false
 contact_links:
   - name: Documentation
-    url: https://github.com/PurpleAILAB/Vigilo#readme
+    url: https://github.com/BitterSecurity/Vigilo#readme
     about: Read the documentation and guides

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -16,7 +16,7 @@ body:
       options:
         - label: I have searched existing issues and discussions to avoid duplicates
           required: true
-        - label: I have read the [documentation](https://github.com/PurpleAILAB/Vigilo#readme)
+        - label: I have read the [documentation](https://github.com/BitterSecurity/Vigilo#readme)
           required: true
 
   - type: textarea

.github/ISSUE_TEMPLATE/general.yml

@@ -16,7 +16,7 @@ body:
       options:
         - label: I have searched existing issues and discussions
           required: true
-        - label: I have read the [documentation](https://github.com/PurpleAILAB/Vigilo#readme)
+        - label: I have read the [documentation](https://github.com/BitterSecurity/Vigilo#readme)
           required: true
         - label: This is a question (not a bug report or feature request)
           required: true

.github/scripts/check-bench-data.ts

@@ -0,0 +1,40 @@
+// Offline, deterministic sanity check for packages/bench/data (no LLM, no network).
+// Verifies every stored baseline parses, has findings, and maps to a dataset entry with ground truth.
+import { readdirSync, readFileSync } from "node:fs"
+import { join } from "node:path"
+
+const dataDir = join(import.meta.dir, "../../packages/bench/data")
+const dataset = JSON.parse(readFileSync(join(dataDir, "dataset.json"), "utf-8")) as Array<{
+  project_id: string
+  codebases: Array<{ repo_url: string; commit: string }>
+  vulnerabilities: Array<{ finding_id: string; title: string; severity: string }>
+}>
+const ids = new Set(dataset.map((p) => p.project_id))
+const errors: string[] = []
+const warnings: string[] = []
+
+for (const p of dataset) {
+  if (!p.codebases?.[0]?.repo_url) errors.push(`${p.project_id}: missing codebase repo_url`)
+  // checkout.ts uses codebases[0].commit; an empty commit means the clone is not pinned (warn only).
+  else if (!p.codebases[0].commit) warnings.push(`${p.project_id}: codebases[0].commit is empty (checkout not pinned)`)
+  if (!p.vulnerabilities?.length) errors.push(`${p.project_id}: no ground-truth vulnerabilities`)
+}
+
+const baselines = readdirSync(join(dataDir, "baselines")).filter((f) => f.endsWith(".json"))
+for (const f of baselines) {
+  const id = f.replace(/^baseline_/, "").replace(/\.json$/, "")
+  const b = JSON.parse(readFileSync(join(dataDir, "baselines", f), "utf-8"))
+  if (!ids.has(id)) errors.push(`${f}: no matching dataset entry "${id}"`)
+  if (!Array.isArray(b.findings) || b.findings.length === 0) errors.push(`${f}: no findings`)
+  for (const [i, x] of (b.findings ?? []).entries()) {
+    if (!x.title || !x.severity) errors.push(`${f}: finding[${i}] missing title/severity`)
+  }
+}
+
+for (const w of warnings) console.warn(`warning: ${w}`)
+console.log(`dataset entries: ${dataset.length}, baselines: ${baselines.length}`)
+if (errors.length) {
+  console.error(errors.join("\n"))
+  process.exit(1)
+}
+console.log("bench data OK")

.github/workflows/ci.yml

@@ -0,0 +1,65 @@
+name: ci
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  opencode:
+    name: opencode (typecheck, test, build)
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: packages/opencode
+    steps:
+      - uses: actions/checkout@v4
+      - uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: "1.4.2"
+      - name: Install dependencies
+        run: bun install
+        env:
+          BUN_INSTALL_ALLOW_SCRIPTS: "@ast-grep/napi"
+      - name: Typecheck
+        run: bun run typecheck
+      - name: Unit tests
+        run: bun test
+      - name: Build plugin
+        run: bun run build
+      - name: CLI smoke test
+        run: bun run src/cli/index.ts --version
+
+  bench:
+    name: bench (typecheck, offline tests, data check)
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: packages/bench
+    steps:
+      - uses: actions/checkout@v4
+      - uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: "1.4.2"
+      - name: Install dependencies
+        run: bun install --frozen-lockfile
+      - name: Typecheck
+        run: bun run typecheck
+      # src/scorer/baseline-scorer.test.ts calls scoreBaseline() with real findings, which needs a
+      # live OpenCode server + LLM and hard-exits the runner (process.exit in utils.error). Only the
+      # offline test files run here until that test is mocked.
+      - name: Unit tests (offline only)
+        run: bun test src/utils.test.ts src/__tests__/setup.test.ts
+      - name: Build CLI
+        run: bun run build
+      - name: Offline bench data check (no LLM, no network)
+        run: bun run ../../.github/scripts/check-bench-data.ts
+      - name: Report smoke test (no scores -> no-op)
+        run: bun run src/cli.ts report --all

README.md

@@ -15,10 +15,10 @@
 <div align="center">
 
 [![npm version](https://img.shields.io/npm/v/vigilo?color=cb3837&labelColor=black&logo=npm&style=flat-square)](https://www.npmjs.com/package/vigilo)
-[![GitHub Release](https://img.shields.io/github/v/release/PurpleAILAB/Vigilo?color=369eff&labelColor=black&logo=github&style=flat-square)](https://github.com/PurpleAILAB/Vigilo/releases)
-[![GitHub Stars](https://img.shields.io/github/stars/PurpleAILAB/Vigilo?color=ffcb47&labelColor=black&style=flat-square)](https://github.com/PurpleAILAB/Vigilo/stargazers)
-[![GitHub Issues](https://img.shields.io/github/issues/PurpleAILAB/Vigilo?color=ff80eb&labelColor=black&style=flat-square)](https://github.com/PurpleAILAB/Vigilo/issues)
-[![License](https://img.shields.io/badge/license-BSL--1.1-white?labelColor=black&style=flat-square)](https://github.com/PurpleAILAB/Vigilo/blob/main/LICENSE)
+[![GitHub Release](https://img.shields.io/github/v/release/BitterSecurity/Vigilo?color=369eff&labelColor=black&logo=github&style=flat-square)](https://github.com/BitterSecurity/Vigilo/releases)
+[![GitHub Stars](https://img.shields.io/github/stars/BitterSecurity/Vigilo?color=ffcb47&labelColor=black&style=flat-square)](https://github.com/BitterSecurity/Vigilo/stargazers)
+[![GitHub Issues](https://img.shields.io/github/issues/BitterSecurity/Vigilo?color=ff80eb&labelColor=black&style=flat-square)](https://github.com/BitterSecurity/Vigilo/issues)
+[![License](https://img.shields.io/badge/license-BSL--1.1-white?labelColor=black&style=flat-square)](https://github.com/BitterSecurity/Vigilo/blob/main/LICENSE)
 
 </div>
 
@@ -71,7 +71,7 @@ Paste this into your LLM agent session:
 
 ```
 Install and configure vigilo by following the instructions here:
-https://raw.githubusercontent.com/PurpleAILAB/Vigilo/main/packages/opencode/docs/installation.md
+https://raw.githubusercontent.com/BitterSecurity/Vigilo/main/packages/opencode/docs/installation.md
 ```
 
 ### Manual Install
@@ -83,7 +83,7 @@ bunx vigilo install
 ### Claude Code
 
 ```bash
-/plugin marketplace add PurpleAILAB/Vigilo
+/plugin marketplace add BitterSecurity/Vigilo
 /plugin install vigilo@Vigilo
 ```
 
@@ -202,7 +202,7 @@ For contributors working on Vigilo itself.
 ### Setup
 
 ```bash
-git clone https://github.com/PurpleAILAB/Vigilo.git
+git clone https://github.com/BitterSecurity/Vigilo.git
 cd vigilo/packages/opencode
 bun install
 bun link
@@ -263,6 +263,6 @@ Commercial licensing: catower917@gmail.com
 
 **Ready to hunt bugs? 🔍**
 
-[Get Started](./packages/opencode/docs/installation.md) · [Report Bug](https://github.com/PurpleAILAB/Vigilo/issues) · [Request Feature](https://github.com/PurpleAILAB/Vigilo/issues)
+[Get Started](./packages/opencode/docs/installation.md) · [Report Bug](https://github.com/BitterSecurity/Vigilo/issues) · [Request Feature](https://github.com/BitterSecurity/Vigilo/issues)
 
 </div>

docs/installation.md

@@ -11,7 +11,7 @@
 
 ```bash
 # Register the marketplace
-/plugin marketplace add PurpleAILAB/Vigilo
+/plugin marketplace add BitterSecurity/Vigilo
 
 # Install the plugin
 /plugin install vigilo
@@ -29,7 +29,7 @@
 
 ```bash
 # Clone repository
-git clone https://github.com/PurpleAILAB/vigilo.git
+git clone https://github.com/BitterSecurity/Vigilo.git
 cd vigilo/packages/opencode
 
 # Install dependencies
@@ -71,7 +71,7 @@ For contributors developing Vigilo locally.
 ### Setup
 
 ```bash
-git clone https://github.com/PurpleAILAB/Vigilo.git
+git clone https://github.com/BitterSecurity/Vigilo.git
 cd vigilo/packages/opencode
 bun install
 bun link

packages/bench/package.json

@@ -5,7 +5,7 @@
   "type": "module",
   "repository": {
     "type": "git",
-    "url": "https://github.com/PurpleAILAB/Vigilo"
+    "url": "https://github.com/BitterSecurity/Vigilo"
   },
   "license": "BUSL-1.1",
   "bin": {

packages/claude/.claude-plugin/marketplace.json

@@ -13,16 +13,16 @@
       "name": "vigilo",
       "source": {
         "source": "github",
-        "repo": "PurpleAILAB/Vigilo"
+        "repo": "BitterSecurity/Vigilo"
       },
       "description": "AI-powered smart contract security audit. Full LSP support for Solidity and Rust, analysis support for Cairo and Move.",
       "version": "0.0.7",
       "author": {
         "name": "PurpleCHOIms",
         "email": "catower917@gmail.com"
       },
-      "homepage": "https://github.com/PurpleAILAB/Vigilo",
-      "repository": "https://github.com/PurpleAILAB/Vigilo",
+      "homepage": "https://github.com/BitterSecurity/Vigilo",
+      "repository": "https://github.com/BitterSecurity/Vigilo",
       "license": "BSL-1.1",
       "category": "security",
       "tags": ["security", "audit", "smart-contract", "solidity", "web3", "blockchain", "defi"],

packages/claude/.claude-plugin/plugin.json

@@ -6,8 +6,8 @@
     "name": "PurpleCHOIms",
     "email": "catower917@gmail.com"
   },
-  "repository": "https://github.com/PurpleAILAB/Vigilo",
-  "homepage": "https://github.com/PurpleAILAB/Vigilo",
+  "repository": "https://github.com/BitterSecurity/Vigilo",
+  "homepage": "https://github.com/BitterSecurity/Vigilo",
   "license": "BSL-1.1",
   "keywords": [
     "security",

packages/claude/README.md

@@ -21,7 +21,7 @@ From Latin *vigilo* — "I watch, I guard." An autonomous security legion inspir
 Register the marketplace:
 
 ```bash
-/plugin marketplace add PurpleAILAB/Vigilo
+/plugin marketplace add BitterSecurity/Vigilo
 ```
 
 Install the plugin:

packages/opencode/README.md

@@ -41,7 +41,7 @@ bunx vigilo install
 Or manually:
 
 ```bash
-git clone https://github.com/PurpleAILAB/Vigilo.git vigilo
+git clone https://github.com/BitterSecurity/Vigilo.git vigilo
 cd vigilo
 bun install
 bun run build

packages/opencode/docs/installation.md

@@ -5,7 +5,7 @@
 Paste this into your LLM agent session:
 ```
 Install and configure vigilo by following the instructions here:
-https://raw.githubusercontent.com/PurpleAILAB/Vigilo/main/packages/opencode/docs/installation.md
+https://raw.githubusercontent.com/BitterSecurity/Vigilo/main/packages/opencode/docs/installation.md
 ```
 
 **Alternative, do this by yourself**
@@ -160,7 +160,7 @@ After everything is set up and working, ask the user:
 
 If the user agrees, run:
 ```bash
-gh repo star PurpleAILAB/Vigilo
+gh repo star BitterSecurity/Vigilo
 ```
 
 **Important**: Only run the command if the user explicitly says yes. Never run it automatically without consent.

packages/opencode/package.json

@@ -87,10 +87,10 @@
   },
   "repository": {
     "type": "git",
-    "url": "https://github.com/PurpleAILAB/Vigilo"
+    "url": "https://github.com/BitterSecurity/Vigilo"
   },
   "bugs": {
-    "url": "https://github.com/PurpleAILAB/Vigilo/issues"
+    "url": "https://github.com/BitterSecurity/Vigilo/issues"
   },
-  "homepage": "https://github.com/PurpleAILAB/Vigilo#readme"
+  "homepage": "https://github.com/BitterSecurity/Vigilo#readme"
 }

packages/opencode/packages/darwin-arm64/package.json

@@ -5,7 +5,7 @@
   "license": "BSL-1.1",
   "repository": {
     "type": "git",
-    "url": "https://github.com/PurpleAILAB/Vigilo"
+    "url": "https://github.com/BitterSecurity/Vigilo"
   },
   "os": [
     "darwin"

packages/opencode/packages/darwin-x64/package.json

@@ -5,7 +5,7 @@
   "license": "BSL-1.1",
   "repository": {
     "type": "git",
-    "url": "https://github.com/PurpleAILAB/Vigilo"
+    "url": "https://github.com/BitterSecurity/Vigilo"
   },
   "os": [
     "darwin"

packages/opencode/packages/linux-arm64-musl/package.json

@@ -5,7 +5,7 @@
   "license": "BSL-1.1",
   "repository": {
     "type": "git",
-    "url": "https://github.com/PurpleAILAB/Vigilo"
+    "url": "https://github.com/BitterSecurity/Vigilo"
   },
   "os": [
     "linux"

packages/opencode/packages/linux-arm64/package.json

@@ -5,7 +5,7 @@
   "license": "BSL-1.1",
   "repository": {
     "type": "git",
-    "url": "https://github.com/PurpleAILAB/Vigilo"
+    "url": "https://github.com/BitterSecurity/Vigilo"
   },
   "os": [
     "linux"

packages/opencode/packages/linux-x64-musl/package.json

@@ -5,7 +5,7 @@
   "license": "BSL-1.1",
   "repository": {
     "type": "git",
-    "url": "https://github.com/PurpleAILAB/Vigilo"
+    "url": "https://github.com/BitterSecurity/Vigilo"
   },
   "os": [
     "linux"

packages/opencode/packages/linux-x64/package.json

@@ -5,7 +5,7 @@
   "license": "BSL-1.1",
   "repository": {
     "type": "git",
-    "url": "https://github.com/PurpleAILAB/Vigilo"
+    "url": "https://github.com/BitterSecurity/Vigilo"
   },
   "os": [
     "linux"

packages/opencode/packages/windows-x64/package.json

@@ -5,7 +5,7 @@
   "license": "BSL-1.1",
   "repository": {
     "type": "git",
-    "url": "https://github.com/PurpleAILAB/Vigilo"
+    "url": "https://github.com/BitterSecurity/Vigilo"
   },
   "os": [
     "win32"