mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-16 03:49:26 +00:00
Marius CiepluchandClaude Opus 4.8
ef59c0ae3d
Adopt HarnessX at the hunter loop and verifier, capability-gated so the default
zero-dependency scan is byte-identical and CI (no extra) exercises the fallback.
- 6.1/6.2 build_sast() (single, lazy HarnessX composition site in harness_ext.py,
mirrors DocuHarnessX make_docgen) + HxScanOrchestrator (hunter_harness.py): a
drop-in for run_hunter_pool that runs one bounded HarnessX agent task per ranked
target (ModelConfig(main=AnthropicProvider).agentic(build_sast()).run(BaseTask)),
parses findings from a JSON structured-output contract, returns the existing
HunterPoolResult, maps scan_id->session_id and emits per-target exit_reason/cost/
steps to the outer trace.
- 6.4 verify_judge.verify_findings_dispatch: a drop-in superset of
verification.verify_findings — structural verifier verbatim by default (rejects
unknown reachability), HarnessX llm-judge (build_judge_prompt/parse_judge_response)
when the extra + a verifier model are present; verdict mapped to VerificationResult
evidence-gated (plausible>=0.6 accepted; unsupported/refused rejected; infra
failure never auto-rejects).
- 6.5 cli capability gate (hx_hunter/hx_verify): selects HxScanOrchestrator /
judge only in standard mode with a configured model AND has_harnessx(); otherwise
falls back and records a {stage,reason:harnessx_extra_unavailable} degradation in
the manifest (new append-only write_manifest degradations kwarg). With no model
configured the manifest stays byte-identical.
- pyproject: mypy override ignore_missing_imports for harnessx.* (absent in the
type-check env).
Verified the HarnessX path constructs against the real extra in a throwaway venv
(build_sast -> HarnessConfig; orchestrator -> Harness; build_judge_prompt/
parse_judge_response/verdict mapping) — only the live agent.run()/provider.complete()
LLM calls are offline-untestable and stay gated. 109 tests pass (2 construction
smokes skip without the extra), ruff + mypy clean, detection gate 93.6%/0% intact.
Tasks 6.1/6.2/6.4/6.5 done; 6.3 (deterministic stages as HarnessX processors) deferred.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
49 lines
1.9 KiB
Python
49 lines
1.9 KiB
Python
"""HarnessX hunter sub-harness: guarding, findings parsing, construction smoke (task 6.1)."""
|
|
|
|
import sys
|
|
|
|
import pytest
|
|
|
|
from openultrasast.harness_ext import HarnessXUnavailableError, build_sast, has_harnessx
|
|
from openultrasast.hunter_harness import HxScanOrchestrator, _extract_findings
|
|
|
|
|
|
def test_module_import_does_not_pull_harnessx() -> None:
|
|
import openultrasast.hunter_harness # noqa: F401
|
|
|
|
assert "harnessx" not in sys.modules
|
|
|
|
|
|
def test_extract_findings_parses_json_array_and_tolerates_garbage() -> None:
|
|
text = 'Here are the findings:\n[{"line": 9, "title": "SQLi", "cwe": "CWE-89", "rationale": "concat"}]\nDone.'
|
|
items = _extract_findings(text)
|
|
assert items == [{"line": 9, "title": "SQLi", "cwe": "CWE-89", "rationale": "concat"}]
|
|
assert _extract_findings("no findings here") == []
|
|
assert _extract_findings("[not, valid, json]") == []
|
|
|
|
|
|
@pytest.mark.skipif(has_harnessx(), reason="exercises the extra-absent guard")
|
|
def test_build_sast_raises_without_extra() -> None:
|
|
with pytest.raises(HarnessXUnavailableError):
|
|
build_sast()
|
|
|
|
|
|
@pytest.mark.skipif(has_harnessx(), reason="exercises the extra-absent guard")
|
|
def test_orchestrator_construction_raises_without_extra() -> None:
|
|
with pytest.raises(HarnessXUnavailableError):
|
|
HxScanOrchestrator(provider_model="claude-sonnet-4-6")
|
|
|
|
|
|
@pytest.mark.skipif(not has_harnessx(), reason="construction smoke; requires the harnessx extra")
|
|
def test_build_sast_returns_harness_config_offline() -> None:
|
|
from harnessx.core.harness import HarnessConfig
|
|
|
|
assert isinstance(build_sast(), HarnessConfig)
|
|
|
|
|
|
@pytest.mark.skipif(not has_harnessx(), reason="construction smoke; requires the harnessx extra")
|
|
def test_orchestrator_builds_agent_offline() -> None:
|
|
# Constructs the model + harness without any LLM call (provider client is lazy).
|
|
agent = HxScanOrchestrator(provider_model="claude-sonnet-4-6")._build_agent()
|
|
assert type(agent).__name__ == "Harness"
|