mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-16 03:49:26 +00:00
Marius CiepluchandClaude Opus 4.8
e255eb264f
Add a [harnessx] config block so the agentic plane can be steered from
openultrasast.toml, and make the LLM provider selectable (the hunter and verifier
previously hardcoded AnthropicProvider).
- config.HarnessxConfig: provider ("anthropic"|"openai"|"litellm", default
anthropic), max_cost_usd (2.0), token_threshold (120000); parsed from [harnessx].
- harness_ext.build_provider: single lazy, capability-guarded provider factory.
The provider name is validated before any import, so an unknown choice fails with
a clear ValueError even when the extra is absent; each provider reads its own
standard key env var (openai -> OPENAI_API_KEY, anthropic -> ANTHROPIC_API_KEY).
- HxScanOrchestrator and verify_findings_dispatch take a provider and route through
build_provider; cli threads config.harnessx.{provider,max_cost_usd,token_threshold}
into both the hunter and the verifier.
- README: "Configuring the HarnessX agentic plane" section (install, models,
provider, budgets, fallback/degradation).
Test isolation: convert the "harnessx not in sys.modules" import-guards to a
hermetic subprocess fixture (tests/conftest.py assert_cold_of_harnessx) and
simulate extra-absent in the CLI dispatch tests, so the suite is deterministic
whether or not the optional extra is installed (it now is, locally). Verified the
OpenAI path constructs end-to-end (build_provider -> OpenAIProvider; orchestrator
-> Harness) with the budget threaded through.
137 passed, 3 skipped; ruff + mypy clean; detection gate PASS.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
45 lines
1.9 KiB
Python
45 lines
1.9 KiB
Python
"""HarnessX hunter sub-harness: guarding, findings parsing, construction smoke (task 6.1)."""
|
|
|
|
import pytest
|
|
|
|
from openultrasast.harness_ext import HarnessXUnavailableError, build_sast, has_harnessx
|
|
from openultrasast.hunter_harness import HxScanOrchestrator, _extract_findings
|
|
|
|
|
|
def test_module_import_does_not_pull_harnessx(assert_cold_of_harnessx) -> None: # type: ignore[no-untyped-def]
|
|
assert_cold_of_harnessx("import openultrasast.hunter_harness")
|
|
|
|
|
|
def test_extract_findings_parses_json_array_and_tolerates_garbage() -> None:
|
|
text = 'Here are the findings:\n[{"line": 9, "title": "SQLi", "cwe": "CWE-89", "rationale": "concat"}]\nDone.'
|
|
items = _extract_findings(text)
|
|
assert items == [{"line": 9, "title": "SQLi", "cwe": "CWE-89", "rationale": "concat"}]
|
|
assert _extract_findings("no findings here") == []
|
|
assert _extract_findings("[not, valid, json]") == []
|
|
|
|
|
|
@pytest.mark.skipif(has_harnessx(), reason="exercises the extra-absent guard")
|
|
def test_build_sast_raises_without_extra() -> None:
|
|
with pytest.raises(HarnessXUnavailableError):
|
|
build_sast()
|
|
|
|
|
|
@pytest.mark.skipif(has_harnessx(), reason="exercises the extra-absent guard")
|
|
def test_orchestrator_construction_raises_without_extra() -> None:
|
|
with pytest.raises(HarnessXUnavailableError):
|
|
HxScanOrchestrator(provider_model="claude-sonnet-4-6")
|
|
|
|
|
|
@pytest.mark.skipif(not has_harnessx(), reason="construction smoke; requires the harnessx extra")
|
|
def test_build_sast_returns_harness_config_offline() -> None:
|
|
from harnessx.core.harness import HarnessConfig
|
|
|
|
assert isinstance(build_sast(), HarnessConfig)
|
|
|
|
|
|
@pytest.mark.skipif(not has_harnessx(), reason="construction smoke; requires the harnessx extra")
|
|
def test_orchestrator_builds_agent_offline() -> None:
|
|
# Constructs the model + harness without any LLM call (provider client is lazy).
|
|
agent = HxScanOrchestrator(provider_model="claude-sonnet-4-6")._build_agent()
|
|
assert type(agent).__name__ == "Harness"
|