mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-16 11:49:28 +00:00
Marius CiepluchandClaude Opus 4.8
e255eb264f
Add a [harnessx] config block so the agentic plane can be steered from
openultrasast.toml, and make the LLM provider selectable (the hunter and verifier
previously hardcoded AnthropicProvider).
- config.HarnessxConfig: provider ("anthropic"|"openai"|"litellm", default
anthropic), max_cost_usd (2.0), token_threshold (120000); parsed from [harnessx].
- harness_ext.build_provider: single lazy, capability-guarded provider factory.
The provider name is validated before any import, so an unknown choice fails with
a clear ValueError even when the extra is absent; each provider reads its own
standard key env var (openai -> OPENAI_API_KEY, anthropic -> ANTHROPIC_API_KEY).
- HxScanOrchestrator and verify_findings_dispatch take a provider and route through
build_provider; cli threads config.harnessx.{provider,max_cost_usd,token_threshold}
into both the hunter and the verifier.
- README: "Configuring the HarnessX agentic plane" section (install, models,
provider, budgets, fallback/degradation).
Test isolation: convert the "harnessx not in sys.modules" import-guards to a
hermetic subprocess fixture (tests/conftest.py assert_cold_of_harnessx) and
simulate extra-absent in the CLI dispatch tests, so the suite is deterministic
whether or not the optional extra is installed (it now is, locally). Verified the
OpenAI path constructs end-to-end (build_provider -> OpenAIProvider; orchestrator
-> Harness) with the budget threaded through.
137 passed, 3 skipped; ruff + mypy clean; detection gate PASS.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
34 lines
1.0 KiB
Python
34 lines
1.0 KiB
Python
"""Shared test fixtures."""
|
|
|
|
import subprocess
|
|
import sys
|
|
|
|
import pytest
|
|
|
|
_HARNESSX_GUARD = (
|
|
"\nimport sys as _sys\n"
|
|
"_leaked = sorted(m for m in _sys.modules if m == 'harnessx' or m.startswith('harnessx.'))\n"
|
|
"assert not _leaked, 'leaked harnessx modules: ' + repr(_leaked)\n"
|
|
)
|
|
|
|
|
|
@pytest.fixture
|
|
def assert_cold_of_harnessx(): # type: ignore[no-untyped-def]
|
|
"""Run ``code`` in a fresh interpreter and assert it imported no ``harnessx`` module.
|
|
|
|
Hermetic by construction: the lazy-import guarantee is verified the same way
|
|
whether or not the optional extra is installed in this environment (a global
|
|
``sys.modules`` check would be polluted by other tests once the extra is present).
|
|
"""
|
|
|
|
def _check(code: str) -> str:
|
|
proc = subprocess.run(
|
|
[sys.executable, "-c", code + _HARNESSX_GUARD],
|
|
capture_output=True,
|
|
text=True,
|
|
)
|
|
assert proc.returncode == 0, f"exit={proc.returncode}\nstdout={proc.stdout}\nstderr={proc.stderr}"
|
|
return proc.stdout
|
|
|
|
return _check
|