fix: complete bundled tool consolidation

.github/workflows/ceo-audit.yml

@@ -1,5 +1,5 @@
 # Purpose: CEO Audit — SOTA repository review (47 gates, 8 axes)
-# Docs: https://github.com/OpenSIN-Code/SIN-Code/tree/main/src/sin_code_bundle/skills/ceo-audit
+# Docs: https://github.com/OpenSIN-Code/SIN-Code/tree/main/skills/code-skills/skill-code-ceo-audit
 #
 # Runs the full CEO Audit on every push and PR. Posts a Markdown
 # comment on the PR with the grade, top 3 risks, and a link to the
@@ -45,9 +45,7 @@ jobs:
       AUDIT_RUN_ID: ${{ github.run_id }}
       AUDIT_SHA: ${{ github.sha }}
       CEO_AUDIT_OUTPUT: ${{ github.workspace }}/ceo-audit-output
-      # The bundle's audit.sh defaults to $HOME/ceo-audits; we override to
-      # match the workflow's expected ceo-audit-output/ path so score.json
-      # lands where the next steps (upload-sarif, comment) expect it.
+      # Keep every generated artifact inside the checked-out workspace.
     steps:
       - name: Checkout
         uses: actions/checkout@v7
@@ -60,40 +58,23 @@ jobs:
           python-version: '3.12'
           cache: 'pip'
 
-      - name: Install SIN-Code Bundle (with ceo-audit skill)
-        # Try PyPI first, fall back to GitHub (bundle is not yet on PyPI).
-        # Once published: pip install "sin-code-bundle[ceo-audit,dev]"
+      - name: Install current SIN-Code checkout
         run: |
-          pip install "sin-code-bundle[ceo-audit,dev]" || \
-            pip install "sin-code-bundle[ceo-audit,dev] @ git+https://github.com/OpenSIN-Code/SIN-Code.git@v0.4.4"
+          python -m pip install --upgrade pip
+          python -m pip install -e ".[dev]"
 
-      - name: Install ceo-audit skill
-        run: |
-          # sin-code-bundle does not yet ship the skill scripts.
-          # Clone the SSOT (Infra-SIN-OpenCode-Stack) to get audit.sh + axis scripts.
-          git clone --depth 1 --branch main https://github.com/OpenSIN-Code/Infra-SIN-OpenCode-Stack.git ${{ github.workspace }}/infra
-          mkdir -p ~/.config/opencode/skills/ceo-audit
-          cp -r ${{ github.workspace }}/infra/skills/ceo-audit/scripts ~/.config/opencode/skills/ceo-audit/
-          cp -r ${{ github.workspace }}/infra/skills/ceo-audit/lib ~/.config/opencode/skills/ceo-audit/
-          chmod +x ~/.config/opencode/skills/ceo-audit/scripts/audit.sh
-          ls ~/.config/opencode/skills/ceo-audit/scripts/audit.sh
-
-      - name: Locate audit.sh on PATH
+      - name: Locate canonical audit engine
         id: locate
         run: |
-          # After 'pip install sin-code-bundle[ceo-audit,dev]', audit.sh is
-          # shipped at <site-packages>/sin_code_bundle/resources/ceo-audit/scripts/audit.sh.
-          # We also accept a git-clone of the skill to ~/.config/opencode/skills/.
-          SITE_PKG_SCRIPT=$(python3 -c "import sin_code_bundle, os; root=os.path.dirname(sin_code_bundle.__file__); p=os.path.join(root,'resources','ceo-audit','scripts','audit.sh'); print(p if os.path.isfile(p) else '')" 2>/dev/null)
-          if [ -n "$SITE_PKG_SCRIPT" ] && [ -f "$SITE_PKG_SCRIPT" ]; then
-            echo "script=$SITE_PKG_SCRIPT" >> $GITHUB_OUTPUT
-          elif [ -f ~/.config/opencode/skills/ceo-audit/scripts/audit.sh ]; then
-            echo "script=~/.config/opencode/skills/ceo-audit/scripts/audit.sh" >> $GITHUB_OUTPUT
-          else
-            echo '::error::Could not locate audit.sh (not in site-packages, not on disk)'
+          SCRIPT="${{ github.workspace }}/skills/code-skills/skill-code-ceo-audit/scripts/audit.sh"
+          if [ ! -x "$SCRIPT" ]; then
+            echo "::error::Canonical CEO Audit engine is missing or not executable: $SCRIPT"
             exit 1
           fi
-          echo "Located audit script: $SITE_PKG_SCRIPT"
+          echo "script=$SCRIPT" >> "$GITHUB_OUTPUT"
+          echo "skill_root=${{ github.workspace }}/skills/code-skills/skill-code-ceo-audit" >> "$GITHUB_OUTPUT"
+          bash -n "$SCRIPT"
+          "$SCRIPT" --help >/dev/null
 
       - name: Run CEO Audit
         id: audit
@@ -163,7 +144,7 @@ jobs:
             📥 [Download full report (Markdown)](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}#artifacts)
             📊 [Download SARIF (for Code Scanning)](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}#artifacts)
 
-            > Run `${{ env.AUDIT_PROFILE == 'FULL' && '~/.config/opencode/skills/ceo-audit/scripts/audit.sh . --profile=FULL' || '~/.config/opencode/skills/ceo-audit/scripts/audit.sh . --profile=QUICK' }}` locally to reproduce.
+            > Run `skills/code-skills/skill-code-ceo-audit/scripts/audit.sh . --profile=${{ env.AUDIT_PROFILE }}` locally to reproduce.
 
       - name: Post official audit comment (SIN-GitHub-Issues App)
         if: github.event_name == 'pull_request' && always()
@@ -176,13 +157,13 @@ jobs:
         # the workflow from blocking on App issues.
         continue-on-error: true
         env:
-          PYTHONPATH: ${{ github.workspace }}/infra/skills/ceo-audit/lib
+          PYTHONPATH: ${{ steps.locate.outputs.skill_root }}/lib
           SIN_GITHUB_APP_CLIENT_ID: Iv23livllaHIBTdQdyhY
           # Chain of GitHub tokens (post_audit_pr.py picks the first available).
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           SIN_GITHUB_FALLBACK_TOKEN: ${{ secrets.SIN_GITHUB_FALLBACK_TOKEN }}
         run: |
-          # post_audit_pr.py lives in the cloned Infra repo (see 'Install ceo-audit skill' step)
+          # post_audit_pr.py ships in the canonical SIN-Code CEO Audit skill.
           # score.json is written by audit.sh to ~/ceo-audits/<repo>-ceo-audit-<runid>/score.json
           # We search both ceo-audit-output/ and ~/ceo-audits/ to be robust.
           SCORE_FILE=$(find $HOME/ceo-audits ceo-audit-output -name 'score.json' 2>/dev/null | head -1)
@@ -191,7 +172,7 @@ jobs:
             exit 0
           fi
           echo "Using score.json: $SCORE_FILE"
-          python3 ${{ github.workspace }}/infra/skills/ceo-audit/scripts/post_audit_pr.py \
+          python3 ${{ steps.locate.outputs.skill_root }}/scripts/post_audit_pr.py \
             --repo ${{ github.repository }} \
             --pr ${{ github.event.pull_request.number }} \
             --score-json "$SCORE_FILE" \
@@ -202,7 +183,7 @@ jobs:
         if: github.event_name == 'pull_request'
         run: |
           GRADE="${{ steps.grade.outputs.grade }}"
-          GRADE_NUM="${{ steps.grade.outputs.score }}"
+          GRADE_NUM="${{ steps.grade.outputs.score || '0' }}"
           GATE="${{ env.AUDIT_GRADE }}"
           case "$GATE" in
             A) MIN=85 ;;
@@ -218,8 +199,8 @@ jobs:
           echo "::notice::Grade gate passed: $GRADE ($GRADE_NUM) ≥ $GATE ($MIN)"
 
       - name: Upload SARIF to Code Scanning
-        if: always()
-        uses: github/codeql-action/upload-sarif@v3
+        if: always() && hashFiles('ceo-audit-output/report.sarif') != ''
+        uses: github/codeql-action/upload-sarif@v4
         with:
           sarif_file: ${{ github.workspace }}/ceo-audit-output/report.sarif
           category: ceo-audit

.gitleaksignore

@@ -0,0 +1,30 @@
+# Existing synthetic scanner fixtures and documentation examples reviewed during
+# the CEO Audit migration. Entries are exact Gitleaks fingerprints, never broad
+# path allowlists: any new rule hit or shifted/new fixture must be reviewed again.
+SIN-Code-SAST-Tool/internal/engine/engine_test.go:generic-api-key:85
+SIN-Code-SAST-Tool/internal/engine/engine_test.go:generic-api-key:86
+SIN-Code-Secrets-Scanner/internal/engine/engine_test.go:generic-api-key:47
+SIN-WEBSEARCH-DIAGNOSE-2026-06-15.md:generic-api-key:87
+cmd/sin-code/internal/config/config_test.go:generic-api-key:233
+cmd/sin-code/internal/config/config_test.go:generic-api-key:258
+cmd/sin-code/internal/config_test.go:generic-api-key:615
+cmd/sin-code/internal/config_test.go:generic-api-key:815
+cmd/sin-code/internal/config_test.go:generic-api-key:850
+cmd/sin-code/internal/execute_extended_test.go:generic-api-key:296
+cmd/sin-code/internal/execute_extended_test.go:generic-api-key:307
+cmd/sin-code/internal/execute_extended_test.go:generic-api-key:315
+cmd/sin-code/internal/execute_extended_test.go:generic-api-key:323
+cmd/sin-code/internal/execute_extended_test.go:generic-api-key:366
+cmd/sin-code/internal/execute_extended_test.go:generic-api-key:374
+cmd/sin-code/internal/execute_extended_test.go:generic-api-key:382
+cmd/sin-code/internal/execute_extended_test.go:generic-api-key:390
+cmd/sin-code/internal/execute_extended_test.go:generic-api-key:406
+cmd/sin-code/internal/execute_extended_test.go:generic-api-key:414
+cmd/sin-code/internal/execute_extended_test.go:generic-api-key:585
+cmd/sin-code/internal/security_extended_test.go:generic-api-key:190
+cmd/sin-code/internal/permission/result_policy_test.go:jwt:28
+cmd/sin-code/internal/orchestrator/contract_test.go:stripe-access-token:38
+SIN-Code-Secrets-Scanner/pkg/rules/rules.go:private-key:159
+tests/fuzz/integration_tests.py:generic-api-key:227
+tests/test_delegate.py:generic-api-key:81
+tests/test_mcp_integration.py:generic-api-key:26

ECOSYSTEM.md

@@ -48,11 +48,11 @@
 | SIN-Code-Scheduler-Skill | `scheduler__*` | ask | ACTIVE |
 | SIN-Code-Goal-Mode-Skill | `goalmode__*` | ask | ACTIVE |
 | SIN-Code-Grill-Me-Skill | `grillme__*` | ask | ACTIVE |
-| SIN-Code-Marketplace-Skill | `marketplace__*` | ask | ACTIVE |
+| SIN-Code (bundled Marketplace) | `marketplace__*` | ask | ACTIVE |
 | SIN-Code-Doc-Coauthoring-Skill | `codocs__*` | ask | ACTIVE |
 | SIN-Code-Honcho-Rollback-Skill | `honcho__*` | ask (destructive) | ACTIVE |
 | SIN-Code-Frontend-Design-Skill | `frontend__*` | ask | ACTIVE |
-| SIN-Code-MCP-Server-Builder-Skill | `mcpbuilder__*` | ask | ACTIVE |
+| SIN-Code (bundled MCP Server Builder) | `mcpbuilder__*` | ask | ACTIVE |
 | SIN-Browser-Tools | `browser__*` (106 tools: navigation, click/type/fill, screenshots, PDF, tab/session, cookie/storage, diagnostics, Shadow DOM, OOPIF, SPA wait, network mocking, macOS Spaces, screen recording) | allow (35 read-only) + ask (71 mutating) — per-tool M4 split policy | ACTIVE |
 | GitHub CLI (gh) | `gh_query`, `gh_health`, `gh_execute` | allow / allow / ask (M4) | ACTIVE |
 | [OpenSIN-Code/sin-analyse-suite](https://github.com/OpenSIN-Code/sin-analyse-suite) | `analyse__*` (image, video, PDF, logs, data, audio) | allow (read-only) | ACTIVE |
@@ -63,6 +63,7 @@
 | SIN-Code (native_browser) | `native_browser__*` (e.g. `native_browser__navigate`, `native_browser__snapshot`, `native_browser__screenshot`) | allow (read-only) + ask (mutating) — split M4 policy (issue #382) | ACTIVE |
 | SIN-Code (research) | `research__dry_run`, `research__list`, `research__show`, `research__run` | allow / allow / allow / ask — split M4 policy (issue #384) | ACTIVE |
 | vibe-notion (Bridged-External) | `notion__notion_read_*` (10 read tools), `notion__notion_write_*` (6 write tools), `notion__notion_raw_cli` | allow (reads) + ask (writes) — split M4 policy | ACTIVE |
+| youtube-for-ai-agents (Bridged-External) | `youtube__*` (6 read tools, 3 download/edit tools) | allow (reads) + ask (download/clip/highlight) — split M4 policy | ACTIVE |
 | Template-fuer-Repo-Skill | Template for infrastructure skill repos | ACTIVE |
 | kubernetes-sota-practices | K8s best practices (Helm, k3s, HPA, Istio) for Code-Swarm & OpenSIN | ACTIVE |
 
@@ -78,6 +79,8 @@
 | Repo | Superseded by | Action |
 |---|---|---|
 | SIN-Code-Slash-Skill | `internal/commands` (C8, in-tree since v3.2.0) | ARCHIVE |
+| SIN-Code-Marketplace-Skill | `sin marketplace` + bundled MCP module | ARCHIVE after #512 |
+| SIN-Code-MCP-Server-Builder-Skill | `sin mcp-server` + bundled MCP module | ARCHIVE after #512 |
 | SIN-Code-Security-Bundle | in-tree Go vendors: SIN-Code-SAST-Tool, SIN-Code-SBOM-Generator-Go, SIN-Code-SCA-Tool-Go, SIN-Code-Secrets-Scanner | ACTIVE (vendored) |
 | SIN-Code-Security-Bundle-Python | `python -m sin_code_bundle.tools.security` | DEPRECATED (use vendored Go tools) |
 

MANIFEST.in

@@ -0,0 +1,6 @@
+include setup.py
+recursive-include skills/code-skills/skill-code-ceo-audit *
+prune skills/code-skills/skill-code-ceo-audit/tests
+recursive-exclude skills/code-skills/skill-code-ceo-audit __pycache__
+global-exclude *.py[cod]
+global-exclude .DS_Store

SECURITY.md

@@ -78,7 +78,7 @@ python3 -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().
 # → Set as SINATOR_ENCRYPTION_KEY env var
 
 # 2. Run ceo-audit regularly to detect regressions
-~/.config/opencode/skills/ceo-audit/scripts/audit.sh . --profile=SECURITY --grade=B
+sin ceo-audit run . --profile=SECURITY --grade=B
 
 # 3. Enable Dependabot/Renovate for automatic CVE patching
 # (configured in .github/dependabot.yml if you forked us)

cmd/sin-code/chat_tools_browser.go

@@ -15,11 +15,11 @@ import (
 	"fmt"
 	"os"
 	"path/filepath"
-	"strings"
 	"time"
 
 	"github.com/chromedp/chromedp"
 
+	"github.com/OpenSIN-Code/SIN-Code/cmd/sin-code/internal/egress"
 	"github.com/OpenSIN-Code/SIN-Code/pkg/browser/cdp"
 )
 
@@ -46,8 +46,10 @@ type activeBrowserSession struct {
 // toolBrowserNavigate drives headless Chrome to url, records the full CDP
 // event stream (including Web Vitals), and returns a short status string.
 func toolBrowserNavigate(ctx context.Context, url, step, waitSecStr, saveBaselineStr string) (string, error) {
-	if !strings.HasPrefix(url, "http://") && !strings.HasPrefix(url, "https://") {
-		return "", fmt.Errorf("sin_browser_navigate: only http(s) URLs are supported")
+	// Defense-in-depth preflight. Chrome resolves independently, so this blocks
+	// known private/literal/DNS destinations but is not equivalent to dial pinning.
+	if err := egress.Check(ctx, url, egress.Policy{}); err != nil {
+		return "", fmt.Errorf("sin_browser_navigate: destination denied: %w", err)
 	}
 
 	waitSec := 3

cmd/sin-code/internal/autonomy/autonomy_test.go

@@ -31,6 +31,7 @@ func resetHooks(t *testing.T) {
 	oldTimeSince := _timeSince
 	oldNewTicker := _newTicker
 	oldParseDuration := _parseDuration
+	oldFingerprint := _fingerprint
 	oldDirEntryInfo := _dirEntryInfo
 	t.Cleanup(func() {
 		_dbOpen = oldDBOpen
@@ -47,6 +48,7 @@ func resetHooks(t *testing.T) {
 		_timeSince = oldTimeSince
 		_newTicker = oldNewTicker
 		_parseDuration = oldParseDuration
+		_fingerprint = oldFingerprint
 		_dirEntryInfo = oldDirEntryInfo
 	})
 }
@@ -557,7 +559,14 @@ func TestRunnerWatchEnqueue(t *testing.T) {
 	_timeSince = func(since time.Time) time.Duration { return 100 * time.Second }
 
 	ws := t.TempDir()
-	_ = os.WriteFile(filepath.Join(ws, "a.txt"), []byte("v1"), 0o644)
+	fingerprintCalls := 0
+	_fingerprint = func(_, _ string) string {
+		fingerprintCalls++
+		if fingerprintCalls == 1 {
+			return "before"
+		}
+		return "after"
+	}
 
 	enqueued := make(chan struct{}, 1)
 	r := &Runner{
@@ -576,11 +585,6 @@ func TestRunnerWatchEnqueue(t *testing.T) {
 	ctx, cancel := context.WithCancel(context.Background())
 	done := make(chan struct{})
 
-	go func() {
-		time.Sleep(10 * time.Millisecond)
-		_ = os.WriteFile(filepath.Join(ws, "a.txt"), []byte("v2-version-two"), 0o644)
-	}()
-
 	captureStderr(t, func() {
 		go func() { _ = r.Run(ctx); close(done) }()
 		select {