Apply automated fixes from shellcheck and shfmt to all shell scripts:
- Quote variables to prevent word splitting and globbing
- Use $(...) instead of backticks for command substitution
- Add proper shebang and set -euo pipefail where missing
- Fix array handling and iteration patterns
- Consistent indentation (4 spaces)
- Remove unnecessary curly braces and simplify expressions
Files fixed:
- deployment/*.sh
- scripts/*.sh
- orchestrator/scripts/*.sh
- fuzzer_runner/runner.sh
- protoc.sh
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* Use project specified in oss-fuzz
This will use the contents of the oss-fuzz provided container as the
projects contents instead of a user supplied git url. This will allow to
run projects very similar to how oss-fuzz does it. It will enable
analysis of e.g. libmodbus who was previously not possible due to the
fuzzing harnesses being overwritten/shadowed by the mount of project
directory.
Use project_name for focusdir when in doubt
libpng has changed the default branch to libpng18, but that doesn't
contain the oss-fuzz files. Let's use our own fork of oss-fuzz for now,
until https://github.com/google/oss-fuzz/pull/14080 is ready.
* style: apply ruff auto-fixes and formatting across entire codebase
Applied safe auto-fixes from ruff v0.12.9 with --select ALL to improve code quality:
- Reorder imports (stdlib → third-party → local)
- Use modern type hints (collections.abc.Generator instead of typing.Generator)
- Add trailing commas for better diffs
- Format multi-line function parameters for readability
- Add strict=False to zip() calls for explicit behavior
- Simplify redundant elif to if after return statements
- Consistent code formatting with ruff format
These are all mechanical, non-controversial changes that improve code consistency
without altering functionality. Changes affect 180 files across all modules:
common, fuzzer, orchestrator, patcher, program-model, and seed-gen.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
* re-applt ruff after merge
---------
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: Michael D Brown <michael.brown@trailofbits.com>
* refactor: standardize packaging across all components
- Standardize Python version to >=3.12,<3.13 for all components
- Migrate from [project.optional-dependencies] to modern [dependency-groups] (PEP 735)
- Standardize ruff line-length to 120 characters across all components
- Add consistent project metadata:
- AGPL-3.0 license field
- Repository and Issues URLs
- Improved, descriptive description fields
- Fix email addresses to include .com domain
This improves consistency, maintainability, and follows modern Python
packaging best practices with uv/pip standards.
* fix: address PR review comments
- Move requires-python field to standard position (after license) in seed-gen
- Update all components to use latest ruff version (>=0.12.8)
- Ensure consistent dependency ordering across all components
* refactor: standardize dependency pinning strategy
Apply consistent dependency versioning across all components:
- Use ~= (compatible release) for core dependencies:
- Infrastructure: redis, pydantic, fastapi, uvicorn, sqlalchemy
- AI/LLM: openai, langchain-community, langgraph-checkpoint
- Parsing: tree-sitter, tree-sitter-language-pack
- Web: requests, urllib3, pyyaml
- Utils: python-dotenv, unidiff, argon2-cffi, pymongo, six
- Keep >= for stable dev tools:
- pytest, mypy, ruff, flake8 (want latest versions)
- types-* packages (want latest type definitions)
- rich, beautifulsoup4 (stable, backwards compatible)
- Keep exact pins for known issues:
- protobuf (narrow range for compatibility)
- openlit==1.32.12 (documented issue with 1.33)
- clusterfuzz==2.6.0 (complex, version-sensitive)
This provides predictable builds with automatic patch updates while
preventing unexpected breaking changes from major/minor version bumps.
* feat: add project metadata for discoverability
Add comprehensive metadata to all components:
Keywords:
- common: cybersecurity, crs, utilities, protobuf, redis, telemetry
- fuzzer: fuzzing, oss-fuzz, libfuzzer, vulnerability-discovery, coverage
- orchestrator: orchestration, task-management, scheduler, api, fastapi
- patcher: patching, vulnerability-repair, llm, ai, code-generation
- program-model: static-analysis, codequery, tree-sitter, semantic-analysis
- seed-gen: test-generation, input-generation, fuzzing, seed-corpus, llm
Classifiers:
- Development Status :: 4 - Beta (all components)
- License :: OSI Approved :: GNU Affero General Public License v3
- Programming Language :: Python :: 3.12
- Topic :: Security (all components)
- Component-specific topics (Testing, AI, Distributed Computing, etc.)
- Operating System :: POSIX :: Linux
URLs:
- Added Documentation URL pointing to README for all components
This improves package discoverability, provides clear metadata for tools,
and gives the project a more professional appearance.
* Standardize tool configurations across all components
- Add pytest.ini_options configuration to all components
- Add coverage configuration with consistent exclude patterns
- Standardize ruff configuration with target-version and lint rules
- Fix missing readme field in fuzzer/pyproject.toml
- Fix python-dotenv spacing inconsistency in seed-gen
- Standardize all dev dependencies to use ~= operator for consistency
* Fix trailing whitespace and line length issues
- Remove trailing whitespace from tree-sitter query strings
- Remove trailing whitespace from test output strings
- Fix line length issues in logger.info() calls by splitting format strings
- Fix line length in datetime formatting by extracting variables
- Split long Pydantic Field descriptions and docstrings
- Leave test data strings unchanged to avoid breaking tests
* Fix dependency resolution issues
- Update argon2-cffi from ~=21.0.0 to ~=21.3.0 (21.0.x doesn't exist on PyPI)
- Update langgraph-checkpoint from ~=2.0.25 to ~=2.1.0 to match langgraph requirements
- Standardize spacing around ~= operators in all dependency specifications
- All components now successfully resolve dependencies with uv
* Apply ruff auto-fixes across project
- Fix import sorting (I001) in fuzzer, orchestrator, and patcher
- Update to PEP 585 type annotations (List->list, Dict->dict, etc.)
- Update to PEP 604 union syntax (Optional[X] -> X | None)
- Remove unnecessary UTF-8 encoding declarations
- Remove redundant file open modes
- Modernize type annotations throughout the codebase
Remaining issues are primarily line length (E501) which require manual review
* Fix line length issues in program-model component
- Break up long Java code strings in test assertions using implicit concatenation
- Split long constructor and method definitions across multiple lines
- Add noqa: E501 comment for 10,977 character struct definition test data
- All program-model line length issues resolved
* fix: revert protobuf enum type annotations to Optional
Protobuf enums (EnumTypeWrapper) don't support the | operator for type unions.
The ruff UP035 rule converted Optional[ProtobufEnum] to ProtobufEnum | None,
but this causes TypeError at runtime. Reverted these specific changes while
keeping the modern type union syntax for regular Python types.
* chore: add ruff protection for protobuf enum type annotations
- Configure ruff to ignore UP045 rule in test_submissions.py
- Add inline noqa comments to document why Optional is needed
- Protobuf enums (EnumTypeWrapper) don't support the | operator
- This prevents future automated fixes from breaking the code
* fix: modernize Python syntax and fix formatting issues
- Convert printf-style formatting to f-strings (UP031)
- Remove trailing whitespace from blank lines (W293)
- Use PEP 695 generic class syntax for Python 3.12+ (UP046)
- Use PEP 695 type alias syntax with 'type' keyword (UP040)
These changes modernize the codebase to use Python 3.12+ features
and fix formatting inconsistencies detected by ruff.
* fix: resolve undefined MsgType reference after PEP 695 conversion
When converting to PEP 695 generic class syntax, the MsgType TypeVar
was removed but was still referenced in overloaded method signatures.
Changed the generic fallback overload to use Message directly.
* fix: resolve line length violations across entire codebase
Applied Black formatter and manual fixes to resolve E501 line length violations:
- Fixed 178 line length issues across common, fuzzer, orchestrator, patcher, and program-model components
- Used Black formatter for automatic reformatting where possible
- Manually split long strings, function calls, and complex expressions
- All files now comply with 120-character line limit
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
* fix: revert PEP 695 type alias syntax in node_local.py
The PEP 695 syntax (type X = Y) creates TypeAliasType objects that cannot
be used as constructors at runtime. Since node_local.py uses NodeLocalPath
and RemotePath as constructors (e.g., NodeLocalPath(path)), we must use
the old TypeAlias syntax to maintain runtime functionality.
Added noqa comments to prevent ruff from attempting to modernize these
aliases in the future.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
* chore: configure ruff to ignore UP040 for node_local.py
Added per-file configuration to prevent ruff from attempting to convert
TypeAlias annotations to PEP 695 syntax in node_local.py. This protects
the runtime functionality that relies on these type aliases being usable
as constructors.
Also removed redundant inline noqa comments since the ignore is now
configured at the project level.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
* fix: correct MsgType reference in static method decorator
The _ensure_group_name static method decorator was incorrectly
referencing MsgType in the wrapper function signature. Since MsgType
is a class-level type parameter and not accessible in static method
scope, changed it to Message which is the appropriate bound type.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
* docs: add explanatory comment for Message type in decorator
Added a comment explaining why we must use Message instead of MsgType
in the _ensure_group_name decorator's wrapper function. This prevents
future confusion and protects against accidental "fixes" that would
break the code.
The MsgType parameter is a class-level type variable that's not in
scope within the static method decorator context.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
* scripts: Convert the challenge.sh script to Python
Latest macOS still relies on bash 3.2.57, which is not compatible
with the constructs used by the challenge.sh script.
* scripts: Replace the challenge.sh script with the Python version
* scripts: Print requests performed by challenge.py
* scripts: Remove type hints from global vars in challenge.py
* scripts: Refactor challenge.py to use kwargs for overrides
* scripts: Update challenge.py to use argparse
* scripts: Update the challenge.py help text
* scripts: Validate the challenge name in challenge.py
* Fix integration-test run
* use the proper oss-fuzz-aixcc commit to run integration-test
* determine OSS_FUZZ_CONTAINER_ORG at runtime
* use `git diff` in the patcher to create the patch to fix a problem
with patches affecting non-newline terminated files
* fix parsing
* fix program-model lint
* Modify CRS to work on MacOS/ARM
* Use LibUCL for testing
* use example-libpng
* fix linting
* common: fix tests
* Fix integration-test run
* use the proper oss-fuzz-aixcc commit to run integration-test
* determine OSS_FUZZ_CONTAINER_ORG at runtime
* use `git diff` in the patcher to create the patch to fix a problem
with patches affecting non-newline terminated files
* fix parsing
* fix program-model lint
* patcher: update langgraph dependencies
* patcher: remove 'messages' from State because not used
* patcher: change CodeSnippetKey to use lines instead of IDs
* patcher: improve ContextRetrieverAgent
- use RunnableConfig and PatcherConfig to pass configuration options
more easily
- make the state serializable, so that we can use CheckPointer to save
and restore an agent state and get code snippets more easily in case
of failures
- add tests
- use prebuilt React agent for simplicity
- allow to track lines from a file
* patcher: move all agents to new CodeSnippetKey
* patcher: group patch attempts in a single class
* patcher: remove diff_analysis from state because unused
* patcher: make more use of PatcherConfig
* patcher: add patch description
* patcher: use renamed patch_attempts
* patcher: go back to identifier (random) for CodeSnippets
* patcher: parse stacktrace for initial context
* common: fix parse_stacktrace return type
* patcher: introduce reflection agenta and remove reviewer
* patcher: use structured rootcause analysis
* patcher: paralellize ctx requests
* patcher: have some best-effort json parser for rootcause
* tmp comit
* fix tests
* a few other fixes
* fix lint
* add libxml2 script
* patcher: remove some dead code
* ctx-retriever: use smaller models
* fix tests
* improve initial context
* add comment
* patcher: remove dead code
* fix none access
* other random fixes
* Refactor common vuln discovery functionality
* Add vuln discovery for full mode
---------
Co-authored-by: Michael D Brown <michael.brown.uc@gmail.com>
* Implements task cancelation
- Cancel one or all tasks.
- delete_task.sh script for invoking
- refactored to keep deleted tasks in a separate set, update tasks as
needed from registry instead of updating the stored tasks.
* Refactor cancellation, update use in vulnerabilities
* Cleanup cancellation
* Remove package_name from protomsg
* Fix test case
* fix tests
* PR feedback
* Implements configurable authentication
This removes the hardcoded auth and introduces a tool for generating the
required keys/tokens/tokenhash values.
buttercup-auth-tool --env
this will output all information needed to configure the server and
client side.
* lint
* Use new auth in ci
Dan Guido