…chCisco

enrichCisco guarded on a non-empty cisco entry and then deleted the cisco key
before backfilling. Since CveContent.Empty() is Summary=="", a detection-built
Cisco content for an advisory with an empty description was treated as empty,
deleted, and rebuilt with nil Optional — silently dropping the vuls2-sources
provenance that only the detection path can attach.

Switch to a presence-based skip (matching enrichNVD / enrichRedHatCVE): if any
cisco content is already present, leave it untouched. The detection path never
writes empty placeholders (it emits no cisco key when it has nothing), so the
backfill still runs for CVEs the Cisco CPE path did not detect.

Add regression tests:
- Test_mergeVulnInfo: a CVE with two Cisco advisories keeps both CveContents
  (the (type, source link) merge key), instead of collapsing by type.
- Test_enrich case: enrichCisco skips a CVE that already carries detection-built
  cisco content, preserving its vuls2-sources provenance.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

…s/fixtures

vulsio/vuls-data-update#844 (cisco-json extractor) is merged. Replace the
synthetic Test_postConvert Cisco case (cisco-sa-test / cisco:test_product) with
a real extracted advisory from the merged golden: cisco-sa-3100_4200_tlsdos
(CVE-2025-20127, cpe:2.3:a:cisco:firepower_threat_defense, vendor SIR High,
CWE-404, cisco.com references, distinct published/modified dates). The product
version (7.4.0.0) is paren-free, keeping CPE strings clean; the long advisory
description is trimmed to one real sentence.

Align the cisco-json fixture datasource name with the extractor's output
("Cisco Security Advisories: openVuln API"). The n39k enrich fixture content
already matches the merged golden (only the canonical raws path differs).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

…ontentsFromAdvs

The vulnerability-stub CveContent literal lived inline in postConvert's vuln
loop, deeply indented and long. Move it into cveContentsFromVulns in vendor.go
so the source-origin switch reads symmetrically: each arm is a one-line call
(cveContentsFromVulns for stub-sourced, cveContentsFromAdvs for advisory-sourced).

The vuls2-sources provenance (optional) is now computed once before the switch
and passed to both. References are still merged in the caller (the advisory-ref
merge can fail) and handed in, so cveContentsFromVulns stays error-free and
symmetric with cveContentsFromAdvs. No behavior change.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

…romVulns

Follow-up to the cveContentsFromVulns extraction: also move the CVSS computation
(toCvss) and the reference merge (vulnerability refs + the source's advisory
references, the part that can fail) into cveContentsFromVulns — both are used
only on the vulnerability-sourced path. It now takes (src, cctype, v, fdas,
optional) and returns (CveContents, error); cveContentsFromAdvs gains a matching
(CveContents, error) signature (nil error today) so the two read symmetrically.

The postConvert vuln loop now builds the VulnInfo first and assigns
vinfo.CveContents from the switch, dropping the local cvss/rs/ccs vars and the
inline reference-merge loop; a single error check follows the switch.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

…switch arm

Move the error check into each switch arm (a local ccs, err := ... then assign
vinfo.CveContents) instead of a single post-switch check that reassigned the
outer err. Slightly more verbose (one temp per arm) but keeps each arm's error
handling self-contained and the failure message specific.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

RunTui logged gocui.ErrQuit (the normal-quit sentinel) as an error and called
os.Exit(1), so a normal TUI quit looked like a failure and bypassed the deferred
g.Close() cleanup. Gate on errors.Is(err, gocui.ErrQuit): return ExitSuccess on
a normal quit and ExitFailure (logged) only for a real error, letting the
deferred Close run in every case. Dropping the always-true `err != nil` also
removes the staticcheck SA4023 suppression.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

…lean exit

Refine the previous tui change: still treat gocui.ErrQuit (normal quit) as a
clean exit so a normal quit no longer logs an error or exits 1 (and the deferred
g.Close runs), but for a real error keep the original behavior — explicit
g.Close, log, os.Exit(1) — rather than returning ExitFailure, to avoid changing
the error-path exit semantics. Using errors.Is means there is no always-true
`err != nil` comparison, so no staticcheck SA4023 to suppress.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Express the "Cisco emits no per-CVE CveContent" rule as a switch on cctype
(empty case models.Cisco, default builds the content) instead of a negated if,
so the advisory-shaped exception reads as its own labelled branch.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>