Run `ruff check --fix` across all components to fix I001 import sorting
violations in src/ and test/ directories.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* style: apply ruff auto-fixes and formatting across entire codebase
Applied safe auto-fixes from ruff v0.12.9 with --select ALL to improve code quality:
- Reorder imports (stdlib → third-party → local)
- Use modern type hints (collections.abc.Generator instead of typing.Generator)
- Add trailing commas for better diffs
- Format multi-line function parameters for readability
- Add strict=False to zip() calls for explicit behavior
- Simplify redundant elif to if after return statements
- Consistent code formatting with ruff format
These are all mechanical, non-controversial changes that improve code consistency
without altering functionality. Changes affect 180 files across all modules:
common, fuzzer, orchestrator, patcher, program-model, and seed-gen.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
* re-applt ruff after merge
---------
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: Michael D Brown <michael.brown@trailofbits.com>
* refactor: standardize packaging across all components
- Standardize Python version to >=3.12,<3.13 for all components
- Migrate from [project.optional-dependencies] to modern [dependency-groups] (PEP 735)
- Standardize ruff line-length to 120 characters across all components
- Add consistent project metadata:
- AGPL-3.0 license field
- Repository and Issues URLs
- Improved, descriptive description fields
- Fix email addresses to include .com domain
This improves consistency, maintainability, and follows modern Python
packaging best practices with uv/pip standards.
* fix: address PR review comments
- Move requires-python field to standard position (after license) in seed-gen
- Update all components to use latest ruff version (>=0.12.8)
- Ensure consistent dependency ordering across all components
* refactor: standardize dependency pinning strategy
Apply consistent dependency versioning across all components:
- Use ~= (compatible release) for core dependencies:
- Infrastructure: redis, pydantic, fastapi, uvicorn, sqlalchemy
- AI/LLM: openai, langchain-community, langgraph-checkpoint
- Parsing: tree-sitter, tree-sitter-language-pack
- Web: requests, urllib3, pyyaml
- Utils: python-dotenv, unidiff, argon2-cffi, pymongo, six
- Keep >= for stable dev tools:
- pytest, mypy, ruff, flake8 (want latest versions)
- types-* packages (want latest type definitions)
- rich, beautifulsoup4 (stable, backwards compatible)
- Keep exact pins for known issues:
- protobuf (narrow range for compatibility)
- openlit==1.32.12 (documented issue with 1.33)
- clusterfuzz==2.6.0 (complex, version-sensitive)
This provides predictable builds with automatic patch updates while
preventing unexpected breaking changes from major/minor version bumps.
* feat: add project metadata for discoverability
Add comprehensive metadata to all components:
Keywords:
- common: cybersecurity, crs, utilities, protobuf, redis, telemetry
- fuzzer: fuzzing, oss-fuzz, libfuzzer, vulnerability-discovery, coverage
- orchestrator: orchestration, task-management, scheduler, api, fastapi
- patcher: patching, vulnerability-repair, llm, ai, code-generation
- program-model: static-analysis, codequery, tree-sitter, semantic-analysis
- seed-gen: test-generation, input-generation, fuzzing, seed-corpus, llm
Classifiers:
- Development Status :: 4 - Beta (all components)
- License :: OSI Approved :: GNU Affero General Public License v3
- Programming Language :: Python :: 3.12
- Topic :: Security (all components)
- Component-specific topics (Testing, AI, Distributed Computing, etc.)
- Operating System :: POSIX :: Linux
URLs:
- Added Documentation URL pointing to README for all components
This improves package discoverability, provides clear metadata for tools,
and gives the project a more professional appearance.
* Standardize tool configurations across all components
- Add pytest.ini_options configuration to all components
- Add coverage configuration with consistent exclude patterns
- Standardize ruff configuration with target-version and lint rules
- Fix missing readme field in fuzzer/pyproject.toml
- Fix python-dotenv spacing inconsistency in seed-gen
- Standardize all dev dependencies to use ~= operator for consistency
* Fix trailing whitespace and line length issues
- Remove trailing whitespace from tree-sitter query strings
- Remove trailing whitespace from test output strings
- Fix line length issues in logger.info() calls by splitting format strings
- Fix line length in datetime formatting by extracting variables
- Split long Pydantic Field descriptions and docstrings
- Leave test data strings unchanged to avoid breaking tests
* Fix dependency resolution issues
- Update argon2-cffi from ~=21.0.0 to ~=21.3.0 (21.0.x doesn't exist on PyPI)
- Update langgraph-checkpoint from ~=2.0.25 to ~=2.1.0 to match langgraph requirements
- Standardize spacing around ~= operators in all dependency specifications
- All components now successfully resolve dependencies with uv
* Apply ruff auto-fixes across project
- Fix import sorting (I001) in fuzzer, orchestrator, and patcher
- Update to PEP 585 type annotations (List->list, Dict->dict, etc.)
- Update to PEP 604 union syntax (Optional[X] -> X | None)
- Remove unnecessary UTF-8 encoding declarations
- Remove redundant file open modes
- Modernize type annotations throughout the codebase
Remaining issues are primarily line length (E501) which require manual review
* Fix line length issues in program-model component
- Break up long Java code strings in test assertions using implicit concatenation
- Split long constructor and method definitions across multiple lines
- Add noqa: E501 comment for 10,977 character struct definition test data
- All program-model line length issues resolved
* fix: revert protobuf enum type annotations to Optional
Protobuf enums (EnumTypeWrapper) don't support the | operator for type unions.
The ruff UP035 rule converted Optional[ProtobufEnum] to ProtobufEnum | None,
but this causes TypeError at runtime. Reverted these specific changes while
keeping the modern type union syntax for regular Python types.
* chore: add ruff protection for protobuf enum type annotations
- Configure ruff to ignore UP045 rule in test_submissions.py
- Add inline noqa comments to document why Optional is needed
- Protobuf enums (EnumTypeWrapper) don't support the | operator
- This prevents future automated fixes from breaking the code
* fix: modernize Python syntax and fix formatting issues
- Convert printf-style formatting to f-strings (UP031)
- Remove trailing whitespace from blank lines (W293)
- Use PEP 695 generic class syntax for Python 3.12+ (UP046)
- Use PEP 695 type alias syntax with 'type' keyword (UP040)
These changes modernize the codebase to use Python 3.12+ features
and fix formatting inconsistencies detected by ruff.
* fix: resolve undefined MsgType reference after PEP 695 conversion
When converting to PEP 695 generic class syntax, the MsgType TypeVar
was removed but was still referenced in overloaded method signatures.
Changed the generic fallback overload to use Message directly.
* fix: resolve line length violations across entire codebase
Applied Black formatter and manual fixes to resolve E501 line length violations:
- Fixed 178 line length issues across common, fuzzer, orchestrator, patcher, and program-model components
- Used Black formatter for automatic reformatting where possible
- Manually split long strings, function calls, and complex expressions
- All files now comply with 120-character line limit
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
* fix: revert PEP 695 type alias syntax in node_local.py
The PEP 695 syntax (type X = Y) creates TypeAliasType objects that cannot
be used as constructors at runtime. Since node_local.py uses NodeLocalPath
and RemotePath as constructors (e.g., NodeLocalPath(path)), we must use
the old TypeAlias syntax to maintain runtime functionality.
Added noqa comments to prevent ruff from attempting to modernize these
aliases in the future.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
* chore: configure ruff to ignore UP040 for node_local.py
Added per-file configuration to prevent ruff from attempting to convert
TypeAlias annotations to PEP 695 syntax in node_local.py. This protects
the runtime functionality that relies on these type aliases being usable
as constructors.
Also removed redundant inline noqa comments since the ignore is now
configured at the project level.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
* fix: correct MsgType reference in static method decorator
The _ensure_group_name static method decorator was incorrectly
referencing MsgType in the wrapper function signature. Since MsgType
is a class-level type parameter and not accessible in static method
scope, changed it to Message which is the appropriate bound type.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
* docs: add explanatory comment for Message type in decorator
Added a comment explaining why we must use Message instead of MsgType
in the _ensure_group_name decorator's wrapper function. This prevents
future confusion and protects against accidental "fixes" that would
break the code.
The MsgType parameter is a class-level type variable that's not in
scope within the static method decorator context.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
* Add tools to let patcher select diffs it wants to see
* Simplify implementation using unidiff library and add unit tests for diff parsing
* Add more tests, test list_diffs tool
* Add final test for get_diffs and fix linting
* Set max diff length to max stack length
* Fix comments from review
---------
Co-authored-by: Boyan MILANOV <boyanmilanov@coder-boyanmilanov-aixcc-boyan.c.production-1-405717.internal>
* Use an internal_patch_id instead of indices
This is the first step in being able to merge sets of PoVs and test
patches against all PoVs within a task.
* Discard redundant builds
* Compare relevant fields
* CrashDir: store povs in <crash-token>/<sanitizer>
In Redis we were already differentiating between different sanitizers,
however we were storing all PoVs with the same crash-token in the same
directory, indipendently of the sanitizer that triggered the bug.
However, this information is necessary for the patcher that has to
reproduce the PoVs.
* patcher: builds the patch for multiple sanitizers
* tested
* fix Tuple
* Use original challenge only if same san
* fix lint
* patcher: change internal structures to support multiple PoVs
* patcher: move challenge_task_dir to PatchInputPoV
* Resolving lint issue after merge
* fix after git merge
---------
Co-authored-by: Michael D Brown <michael.brown@trailofbits.com>
* common: add get_clean_task method in ChallengeTask
* common: make exec_docker_cmd available for rw challenges only (and add exec_docker_cmd_rw)
* deployment: make tasks-storage volume available in the patcher as well
* patcher: go back to raw root cause analysis instead of structured one, to make the LLM more "creative"
* patcher: switch understand_code_snippet tool to GPT-4.1
* patcher: reduce max_patch_retries's default to 15
* patcher: increase LLM temperature in react agents
* patcher: make swe/rootcause agents with 'understand_code' tool
Provide a way for the SWE (patcher-strategy)/Rootcause agents to get a focused description
of some parts of a code snippet, so they don't have to come up with
everything while generating an answer.
* patcher: have fallback agents for rootcause
* patcher: have fallback agents for swe strategy
* patcher: update langgraph dependencies
* patcher: remove 'messages' from State because not used
* patcher: change CodeSnippetKey to use lines instead of IDs
* patcher: improve ContextRetrieverAgent
- use RunnableConfig and PatcherConfig to pass configuration options
more easily
- make the state serializable, so that we can use CheckPointer to save
and restore an agent state and get code snippets more easily in case
of failures
- add tests
- use prebuilt React agent for simplicity
- allow to track lines from a file
* patcher: move all agents to new CodeSnippetKey
* patcher: group patch attempts in a single class
* patcher: remove diff_analysis from state because unused
* patcher: make more use of PatcherConfig
* patcher: add patch description
* patcher: use renamed patch_attempts
* patcher: go back to identifier (random) for CodeSnippets
* patcher: parse stacktrace for initial context
* common: fix parse_stacktrace return type
* patcher: introduce reflection agenta and remove reviewer
* patcher: use structured rootcause analysis
* patcher: paralellize ctx requests
* patcher: have some best-effort json parser for rootcause
* tmp comit
* fix tests
* a few other fixes
* fix lint
* add libxml2 script
* patcher: remove some dead code
* ctx-retriever: use smaller models
* fix tests
* improve initial context
* add comment
* patcher: remove dead code
* fix none access
* other random fixes
* common|fuzzer: store crash token in protobuf
* patcher: some simplifications
* patcher: run all PoV variants for up to 30mins
* patcher: sync crashes dir
* patcher: fix deps updates
* patcher: fix tests due to missing pov_token
---------
Co-authored-by: Michael D Brown <michael.brown.uc@gmail.com>
Co-authored-by: Michael D Brown <michael.brown@trailofbits.com>
* Cleanup of submission logic
Retries patches, and moves on to next patch if available
Handles the errored state
Prepares for SARIF submission (missing the SARIF matching)
Patches bundles to include SARIF
* remove whitespace
* Limit impact of exceptions
If an exception is raised while processing a vulnerability, we
would previuosly stop processing any vulnerabilities. This change
enables processing to continue for other vulnerabilities.
Riccardo Schirone