marius/Open_Ultra_SAST
1
0
Fork 0
mirror of https://github.com/norandom/OpenUltraSAST.git synced 2026-10-17 03:59:28 +00:00
Code Issues Packages Projects Releases Wiki Activity

chore(config): retire unread keys [sandbox] network, [sandbox] workspace_readonly, [complexity] top_k

Browse Source 
Legacy inventory 2, item R3. The three keys loaded into ResolvedConfig and nothing read them: no
`.network`, `.workspace_readonly` or `.top_k` access exists in src outside config.py. The sandbox
runner always passes `--network none` and `--read-only` and rejects host networking by argv
inspection, so the two sandbox keys were knobs that turned nothing; no stage read top_k, and
`[complexity] max_hunter_hotspots` is the one complexity key the scan reads. They join RETIRED_KEYS
with the same 2026-10-02 mechanism as the other unread keys (RetiredConfigError naming the reason).
The fields and their loaders are removed; memory_mb, timeout_seconds, pids_limit (read by
regress/recipes.py and sandbox/runner.py) and max_hunter_hotspots stay. test_config.py covers the three
retirements and the override test now exercises max_hunter_hotspots. RELEASE_NOTES Unreleased carries
the line.

Co-Authored-By: Claude Fable 5.1 <[email protected]>
Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo
This commit is contained in:
Marius Ciepluch
2026-10-02 19:45:37 +02:00
co-authored by Claude Fable 5.1
parent adb70b6b98
commit 6db5a35f07
3 changed files with 19 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/test_config.py
+6 -10
View File
@@ -75,6 +75,9 @@ def test_retired_llm_keys_fail_naming_the_replacement(tmp_path: Path, body: str,
("[variants]\nmax_mechanisms = 10\n", "`[variants] max_mechanisms`"),
('[embeddings]\nmodel = "openai/text-embedding-3-small"\n', "`[embeddings] model`"),
('[embeddings]\nstore = "json-local"\n', "`[embeddings] store`"),
("[sandbox]\nnetwork = true\n", "`[sandbox] network`"),
("[sandbox]\nworkspace_readonly = false\n", "`[sandbox] workspace_readonly`"),
("[complexity]\ntop_k = 3\n", "`[complexity] top_k`"),
],
)
def test_unread_keys_fail_naming_why(tmp_path: Path, body: str, key: str) -> None:
@@ -147,24 +150,21 @@ def test_write_resolved_config_creates_json(tmp_path: Path) -> None:
def test_complexity_and_regress_defaults_when_section_absent() -> None:
config = load_config(None)
assert config.complexity.top_k == 20
assert config.complexity.max_hunter_hotspots == 8
assert config.regress.max_candidates == 5
assert config.regress.images == ()
assert config.sandbox.network is False
assert config.sandbox.workspace_readonly is True
assert config.sandbox.memory_mb == 2048
assert config.sandbox.timeout_seconds == 300
assert config.sandbox.pids_limit == 512
def test_override_changes_top_k_and_max_candidates_only(tmp_path: Path) -> None:
def test_override_changes_max_hunter_hotspots_and_max_candidates_only(tmp_path: Path) -> None:
config_path = tmp_path / "openultrasast.toml"
config_path.write_text(
"\n".join(
[
"[complexity]",
"top_k = 3",
"max_hunter_hotspots = 3",
"[regress]",
"max_candidates = 2",
]
@@ -173,12 +173,9 @@ def test_override_changes_top_k_and_max_candidates_only(tmp_path: Path) -> None:
config = load_config(config_path)
assert config.complexity.top_k == 3
assert config.complexity.max_hunter_hotspots == 3
assert config.regress.max_candidates == 2
assert config.complexity.max_hunter_hotspots == 8
assert config.regress.images == ()
assert config.sandbox.network is False
assert config.sandbox.workspace_readonly is True
assert config.sandbox.memory_mb == 2048
assert config.sandbox.timeout_seconds == 300
assert config.sandbox.pids_limit == 512
@@ -202,7 +199,6 @@ def test_load_config_reads_regress_image_pins(tmp_path: Path) -> None:
assert config.regress.max_candidates == 4
assert dict(config.regress.images) == {"python": "python:3.12-slim", "javascript": "node:22-slim"}
assert config.complexity.top_k == 20
assert config.complexity.max_hunter_hotspots == 8
assert config.sandbox.memory_mb == 2048