From 89400db82dc73fc87351c9431db8941b4b77b9ec Mon Sep 17 00:00:00 2001
From: Amir Fathi <amirfathi.me@gmail.com>
Date: Tue, 22 Sep 2026 07:23:26 +0000
Subject: [PATCH] fix(vulnhunter-fix): pair cluster annotations by identity,
 not by name

Cluster names are not guaranteed unique: parse_issues.md Step 3(c)
documents the "Other clusters" overflow slot, which two clustering
runs can both legitimately produce. annotate_clusters_json recovered
each sorted cluster's members/severity_breakdown via
next(r for r in raw if r.get("name") == c.name), so two same-named
clusters both resolved to the first match, and the second cluster's
real findings vanished from the output.

Pair each Cluster with its source dict by identity at construction
time instead, since sort_clusters reorders the same objects rather
than copying them.

Adds a regression test that fails on main (both entries return the
first cluster's members; the second's Critical findings disappear)
and passes on this change.
---
 vulnhunter-fix/scripts/cluster_score.py    |  6 +++++-
 vulnhunter-fix/tests/test_cluster_score.py | 22 ++++++++++++++++++++++
 2 files changed, 27 insertions(+), 1 deletion(-)

diff --git a/vulnhunter-fix/scripts/cluster_score.py b/vulnhunter-fix/scripts/cluster_score.py
index abfa9c6..431de6e 100644
--- a/vulnhunter-fix/scripts/cluster_score.py
+++ b/vulnhunter-fix/scripts/cluster_score.py
@@ -134,10 +134,14 @@ def annotate_clusters_json(payload: dict[str, Any]) -> dict[str, Any]:
         )
         for c in raw
     ]
+    # `name` is not unique (the documented "Other clusters" overflow slot can
+    # appear twice), so pair each Cluster with its source dict by identity,
+    # not by re-deriving it from a name lookup after sorting.
+    original_by_id = {id(cluster): c for cluster, c in zip(clusters, raw)}
     sorted_clusters = sort_clusters(clusters)
     out_clusters = []
     for i, c in enumerate(sorted_clusters):
-        original = next(r for r in raw if r.get("name") == c.name)
+        original = original_by_id[id(c)]
         annotated = dict(original)
         annotated["score"] = c.score
         annotated["recommended"] = (i == 0)
diff --git a/vulnhunter-fix/tests/test_cluster_score.py b/vulnhunter-fix/tests/test_cluster_score.py
index 52ade4f..9e6c9ed 100644
--- a/vulnhunter-fix/tests/test_cluster_score.py
+++ b/vulnhunter-fix/tests/test_cluster_score.py
@@ -158,6 +158,28 @@ def test_allows_topic_derived_names(self):
             "Other clusters",
         ]
 
+    def test_duplicate_names_keep_their_own_members(self):
+        """Two clusters can legitimately share a name (the "Other clusters"
+        overflow slot, parse_issues.md Step 3(c)); each output entry must
+        carry its own members/severity_breakdown, not a same-named sibling's."""
+        payload = {
+            "clusters": [
+                {"name": "Other clusters", "members": [{"vuln": "VULN-LOW"}],
+                 "severity_breakdown": {"Low": 1}},
+                {"name": "Other clusters",
+                 "members": [{"vuln": "VULN-A"}, {"vuln": "VULN-B"}],
+                 "severity_breakdown": {"Critical": 2}},
+            ]
+        }
+        out = annotate_clusters_json(payload)
+        assert [c["score"] for c in out["clusters"]] == [16, 1]
+        assert out["clusters"][0]["members"] == [
+            {"vuln": "VULN-A"}, {"vuln": "VULN-B"},
+        ]
+        assert out["clusters"][0]["severity_breakdown"] == {"Critical": 2}
+        assert out["clusters"][1]["members"] == [{"vuln": "VULN-LOW"}]
+        assert out["clusters"][1]["severity_breakdown"] == {"Low": 1}
+
 
 class TestCli:
     def test_round_trip_via_file(self, tmp_path):