mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-16 11:49:28 +00:00
chore(harnessx-removal): delete HarnessX code and packaging (task 6)
Deletes harness_ext.py and hunter_harness.py with their HarnessX-only tests (the judge path, verify_judge.py, went in task 5). The harnessx extra, its mypy override and its uv.lock entries are removed (uv lock drops only packages; no remaining version changes). The conftest fixture becomes assert_cold_import; test_gate's two never-import checks become one allow-list (stdlib, openultrasast, yaml) over the governance planes' module-level imports, and the skipped live-extra tolerance test is deleted. Audit rows for the two modules are removed, stage_processors is reworded, and the module-audit manifest is regenerated (no orphan). test_removed_plane_references implements Req 2.4 over src, tests and pyproject.toml: a match must carry a `retired 2026-..` tag (the spec's own slug is not counted). The README part is a strict xfail until task 8 rewrites the README's plane sections. Co-Authored-By: Claude Opus 5.5 <[email protected]> Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo
This commit is contained in:
Marius Ciepluch
co-authored by
Claude Opus 5.5
Claude Opus 5.5
parent
cbadc38d5e
commit
b9afb66250
@@ -171,7 +171,7 @@ def within_tolerance(
|
||||
) -> bool:
|
||||
"""True if ``candidate`` recall/FP stay within tolerance of ``baseline``.
|
||||
|
||||
Used to confirm a HarnessX-backed stage does not drift detection beyond the
|
||||
Used to confirm a model-backed stage does not drift detection beyond the
|
||||
configured band of the zero-dependency baseline. Recall may not fall more than
|
||||
``recall_tolerance`` below baseline; FP may not rise more than ``fp_tolerance``
|
||||
above it.
|
||||
|
||||
@@ -1,97 +0,0 @@
|
||||
"""Capability guard for the optional HarnessX agentic plane.
|
||||
|
||||
HarnessX is an optional extra (``pip install 'openultrasast[harnessx]'``). The core
|
||||
install is zero-dependency, so nothing here imports ``harnessx`` at module load:
|
||||
:func:`has_harnessx` only probes importability via ``find_spec`` and
|
||||
:func:`require_harnessx` performs the import lazily, on demand. Every HarnessX-backed
|
||||
code path (Phase 3+: build_sast, the hunter sub-harness, the llm-judge verifier, the
|
||||
MetaAgent.evolve loop) routes through this seam.
|
||||
"""
|
||||
|
||||
from __future__ import annotations
|
||||
|
||||
import importlib
|
||||
import importlib.util
|
||||
from types import ModuleType
|
||||
from typing import TYPE_CHECKING, Any
|
||||
|
||||
if TYPE_CHECKING:
|
||||
from harnessx.core.harness import HarnessConfig
|
||||
|
||||
HARNESSX_EXTRA = "openultrasast[harnessx]"
|
||||
|
||||
# HarnessX providers OpenUltraSAST can drive for the hunter / llm-judge stages.
|
||||
# Each reads its own standard API-key env var (ANTHROPIC_API_KEY / OPENAI_API_KEY).
|
||||
SUPPORTED_PROVIDERS = ("anthropic", "openai", "litellm")
|
||||
|
||||
|
||||
class HarnessXUnavailableError(RuntimeError):
|
||||
"""Raised when a HarnessX-backed capability is requested but the extra is absent."""
|
||||
|
||||
|
||||
def has_harnessx() -> bool:
|
||||
"""Return True if the HarnessX extra is importable, without importing it."""
|
||||
return importlib.util.find_spec("harnessx") is not None
|
||||
|
||||
|
||||
def require_harnessx() -> ModuleType:
|
||||
"""Lazily import and return the ``harnessx`` module, or raise with install guidance."""
|
||||
if not has_harnessx():
|
||||
raise HarnessXUnavailableError(f"HarnessX is not installed. Install the optional agentic extra: pip install '{HARNESSX_EXTRA}'")
|
||||
return importlib.import_module("harnessx")
|
||||
|
||||
|
||||
def build_provider(model: str, provider: str = "anthropic") -> Any:
|
||||
"""Build a HarnessX LLM provider for ``model`` (lazy, capability-guarded).
|
||||
|
||||
The single place that knows HarnessX provider class names. The provider name is
|
||||
validated before any import so an unknown choice fails loudly even when the extra
|
||||
is absent; each provider reads its own standard API-key env var. Raises
|
||||
:class:`ValueError` on an unknown provider and :class:`HarnessXUnavailableError`
|
||||
when the extra is not installed.
|
||||
"""
|
||||
key = provider.lower()
|
||||
if key not in SUPPORTED_PROVIDERS:
|
||||
raise ValueError(f"unknown HarnessX provider {provider!r}; choose one of {SUPPORTED_PROVIDERS}")
|
||||
require_harnessx()
|
||||
if key == "anthropic":
|
||||
from harnessx.providers.anthropic_provider import AnthropicProvider
|
||||
|
||||
return AnthropicProvider(model=model)
|
||||
if key == "openai":
|
||||
from harnessx.providers.openai_provider import OpenAIProvider
|
||||
|
||||
return OpenAIProvider(model=model)
|
||||
from harnessx.providers.litellm_provider import LiteLLMProvider
|
||||
|
||||
return LiteLLMProvider(model=model)
|
||||
|
||||
|
||||
def build_sast(*, max_cost_usd: float = 2.0, token_threshold: int = 120_000) -> HarnessConfig:
|
||||
"""Compose the SAST hunter HarnessConfig (behaviour pipeline, model-free).
|
||||
|
||||
The single, strictly-localized HarnessX composition site (mirrors DocuHarnessX
|
||||
``make_docgen``): every ``harnessx`` import is inside this function so importing
|
||||
this module never touches the optional extra. Raises :class:`HarnessXUnavailableError`
|
||||
when the extra is absent. The per-task step budget is enforced on the task at run
|
||||
time, not composed here.
|
||||
"""
|
||||
require_harnessx()
|
||||
from harnessx.bundles.context import make_context
|
||||
from harnessx.bundles.control import make_control
|
||||
from harnessx.bundles.tools import make_tools
|
||||
from harnessx.core.builder import HarnessBuilder
|
||||
from harnessx.processors.context.strategies.system_prompt.default import DefaultSystemPromptBuilder
|
||||
|
||||
builder = (
|
||||
HarnessBuilder()
|
||||
| make_context(system_builder=DefaultSystemPromptBuilder())
|
||||
| make_tools(skill_loading=False)
|
||||
| make_control(
|
||||
include_reliability=True,
|
||||
include_budget=True,
|
||||
token_threshold=token_threshold,
|
||||
max_cost_usd=max_cost_usd,
|
||||
)
|
||||
)
|
||||
return builder.build()
|
||||
@@ -1,197 +0,0 @@
|
||||
"""HarnessX-backed hunter pool — a real LLM agent loop per ranked target.
|
||||
|
||||
A drop-in for :func:`hunter.run_hunter_pool` (same call shape, returns the same
|
||||
:class:`hunter.HunterPoolResult`) that runs the optional HarnessX agentic plane. It
|
||||
is lazy/guarded: importing this module never imports ``harnessx``; the extra is only
|
||||
touched once :meth:`HxScanOrchestrator.run_pool` runs. The agent ``.run()`` path makes
|
||||
LLM API calls and is therefore exercised only with the extra + credentials present;
|
||||
the default scan keeps using the deterministic :func:`hunter.run_hunter_pool`.
|
||||
"""
|
||||
|
||||
from __future__ import annotations
|
||||
|
||||
import json
|
||||
import re
|
||||
from collections.abc import Callable
|
||||
from dataclasses import dataclass
|
||||
from pathlib import Path
|
||||
from typing import Any
|
||||
|
||||
from .findings import SEVERITY_LABEL, StaticFinding, _reachability_conditions, _reachability_for_line
|
||||
from .harness_ext import build_provider, build_sast, require_harnessx
|
||||
from .hunter import (
|
||||
HunterPoolResult,
|
||||
HunterTask,
|
||||
HunterTrajectory,
|
||||
build_retrieval_context_by_path,
|
||||
schedule_hunter_tasks,
|
||||
)
|
||||
from .policy import CwePolicy, load_policy, resolve_severity
|
||||
from .preprocess import FileTarget
|
||||
from .rank import RankingScore
|
||||
from .ruleset import PatternRule
|
||||
|
||||
# The hunter agent is asked to emit findings as a JSON array of these objects.
|
||||
_FINDINGS_JSON = re.compile(r"\[\s*\{.*\}\s*\]", re.DOTALL)
|
||||
|
||||
|
||||
@dataclass(frozen=True)
|
||||
class ScanTask:
|
||||
"""Thin description of one bounded hunter task (wraps, not subclasses, BaseTask)."""
|
||||
|
||||
description: str
|
||||
success_criteria: str
|
||||
max_steps: int
|
||||
token_budget: int | None
|
||||
max_cost_usd: float | None
|
||||
|
||||
|
||||
class HxScanOrchestrator:
|
||||
"""Runs the hunter pool on a real HarnessX agent loop, one bounded task per target."""
|
||||
|
||||
def __init__(
|
||||
self,
|
||||
*,
|
||||
provider_model: str,
|
||||
provider: str = "anthropic",
|
||||
max_cost_usd: float = 2.0,
|
||||
token_threshold: int = 120_000,
|
||||
) -> None:
|
||||
require_harnessx()
|
||||
self._provider_model = provider_model
|
||||
self._provider = provider
|
||||
self._max_cost_usd = max_cost_usd
|
||||
self._token_threshold = token_threshold
|
||||
self._agent: Any = None
|
||||
|
||||
def _build_agent(self) -> Any:
|
||||
from harnessx.core.model_config import ModelConfig
|
||||
|
||||
config = build_sast(max_cost_usd=self._max_cost_usd, token_threshold=self._token_threshold)
|
||||
return ModelConfig(main=build_provider(self._provider_model, self._provider)).agentic(config)
|
||||
|
||||
def run_pool(
|
||||
self,
|
||||
root: Path,
|
||||
targets: list[FileTarget],
|
||||
rankings: list[RankingScore],
|
||||
*,
|
||||
scan_id: str,
|
||||
ruleset: tuple[PatternRule, ...] | None = None,
|
||||
policy: dict[str, CwePolicy] | None = None,
|
||||
emit: Callable[..., None] | None = None,
|
||||
) -> HunterPoolResult:
|
||||
import asyncio
|
||||
|
||||
tasks = schedule_hunter_tasks(targets, rankings, retrieval_context_by_path=build_retrieval_context_by_path(root, targets))
|
||||
resolved_policy = policy if policy is not None else load_policy()
|
||||
self._agent = self._agent or self._build_agent()
|
||||
return asyncio.run(self._run_all(scan_id, tasks, resolved_policy, emit))
|
||||
|
||||
async def _run_all(
|
||||
self,
|
||||
scan_id: str,
|
||||
tasks: list[HunterTask],
|
||||
policy: dict[str, CwePolicy],
|
||||
emit: Callable[..., None] | None,
|
||||
) -> HunterPoolResult:
|
||||
from harnessx.core.harness import BaseTask
|
||||
|
||||
findings: list[StaticFinding] = []
|
||||
trajectories: list[HunterTrajectory] = []
|
||||
agent = self._agent
|
||||
for task in tasks:
|
||||
base_task = BaseTask(
|
||||
description=self._describe(task),
|
||||
success_criteria="Enumerate each reachable tainted sink with file:line and a one-line rationale.",
|
||||
max_steps=task.budget.max_findings_per_target,
|
||||
token_budget=task.budget.retrieval_budget_chars * 4,
|
||||
max_cost_usd=self._max_cost_usd,
|
||||
)
|
||||
result = await agent.run(base_task, session_id=scan_id)
|
||||
task_findings = self._findings_from_result(task, result, policy)
|
||||
findings.extend(task_findings)
|
||||
trajectories.append(self._trajectory_from_result(scan_id, task, result, task_findings))
|
||||
if emit is not None:
|
||||
emit(
|
||||
"stage_end",
|
||||
f"hunter_pool:{task.target.path}",
|
||||
{
|
||||
"exit_reason": getattr(result, "exit_reason", "unknown"),
|
||||
"total_steps": getattr(result, "total_steps", 0),
|
||||
"total_cost_usd": getattr(result, "total_cost_usd", 0.0),
|
||||
},
|
||||
)
|
||||
await agent.cleanup()
|
||||
return HunterPoolResult(findings=sorted(findings, key=lambda item: item.finding_id), trajectories=trajectories)
|
||||
|
||||
def _describe(self, task: HunterTask) -> str:
|
||||
from .skills import select_skill_context
|
||||
|
||||
context = task.retrieval_context or f"[repo_code] {task.target.path}"
|
||||
skills = select_skill_context(task.target, stage="hunt", budget_chars=task.budget.skill_budget_chars)
|
||||
skill_block = f"\n\nRelevant security skills:\n{skills}" if skills else ""
|
||||
return (
|
||||
f"Audit `{task.target.path}` ({task.target.language}) for security-relevant vulnerabilities. "
|
||||
f"Report ONLY evidence-backed findings as a JSON array, each object: "
|
||||
f'{{"line": <int>, "title": <str>, "cwe": "CWE-NN" (optional), "rationale": <str>}}. '
|
||||
f"Emit `[]` if none.{skill_block}\n\nSource context:\n{context}"
|
||||
)
|
||||
|
||||
def _findings_from_result(self, task: HunterTask, result: object, policy: dict[str, CwePolicy]) -> list[StaticFinding]:
|
||||
items = _extract_findings(getattr(result, "final_output", "") or "")
|
||||
findings: list[StaticFinding] = []
|
||||
for item in items:
|
||||
line = item.get("line")
|
||||
line = int(line) if isinstance(line, int) else None
|
||||
reachability_status, function_name, reachability_evidence = (
|
||||
_reachability_for_line(task.target, line) if line is not None else ("unknown", None, [])
|
||||
)
|
||||
cwe = str(item.get("cwe", "")) or None
|
||||
severity = SEVERITY_LABEL.get(resolve_severity(policy, cwe), "medium") if cwe else "medium"
|
||||
line_part = line if line is not None else 0
|
||||
findings.append(
|
||||
StaticFinding(
|
||||
finding_id=f"hx-hunter:{task.target.path}:{line_part}",
|
||||
path=task.target.path,
|
||||
title=str(item.get("title", "HarnessX hunter finding")),
|
||||
severity=severity,
|
||||
confidence="medium",
|
||||
evidence_level="static_corroboration",
|
||||
rationale=str(item.get("rationale", "Reported by the HarnessX hunter; manual verification required.")),
|
||||
line=line,
|
||||
function_name=function_name,
|
||||
reachability_status=reachability_status,
|
||||
reachability_evidence=reachability_evidence,
|
||||
reachability_conditions=_reachability_conditions(reachability_evidence),
|
||||
tags=sorted(set(task.target.tags)),
|
||||
ranking_priority=task.ranking.priority,
|
||||
)
|
||||
)
|
||||
return findings
|
||||
|
||||
def _trajectory_from_result(
|
||||
self, scan_id: str, task: HunterTask, result: object, task_findings: list[StaticFinding]
|
||||
) -> HunterTrajectory:
|
||||
return HunterTrajectory(
|
||||
scan_id=scan_id,
|
||||
target_path=task.target.path,
|
||||
tier=task.tier,
|
||||
priority=task.ranking.priority,
|
||||
selected_skills=task.selected_skills,
|
||||
retrieval_context_chars=len(task.retrieval_context),
|
||||
findings=[finding.finding_id for finding in task_findings],
|
||||
status=str(getattr(result, "exit_reason", "completed")),
|
||||
)
|
||||
|
||||
|
||||
def _extract_findings(text: str) -> list[dict[str, object]]:
|
||||
"""Best-effort extraction of the findings JSON array from the agent's final output."""
|
||||
match = _FINDINGS_JSON.search(text)
|
||||
if match is None:
|
||||
return []
|
||||
try:
|
||||
parsed = json.loads(match.group(0))
|
||||
except json.JSONDecodeError:
|
||||
return []
|
||||
return [item for item in parsed if isinstance(item, dict)] if isinstance(parsed, list) else []
|
||||
@@ -77,9 +77,7 @@ STANDALONE = {
|
||||
"mcp": "narrow MCP server over stdio; its own `ousast mcp` entry point and OpenCode integration",
|
||||
"skills": "skill router; consumed by mcp and by the OpenCode integration, not by the scan path",
|
||||
"fusion": "two-panel adjudication engine; reached from the scan's report stage and used standalone",
|
||||
"harness_ext": "HarnessX extension surface; loaded by name when the optional harness is present",
|
||||
"hunter_harness": "harness wiring for the tool hunter; used by the hunter path and by mcp",
|
||||
"stage_processors": "HarnessX slot-contracted scan stages; pinned by the zero-dependency guard in test_gate",
|
||||
"stage_processors": "deterministic slot-contracted scan stages; pinned by the zero-dependency guard in test_gate",
|
||||
"slot_contract": "the slot/contract protocol stage_processors implements",
|
||||
}
|
||||
|
||||
|
||||
Reference in New Issue
Block a user