scriptoriumadmin/strix
1
0
Fork 0
mirror of https://github.com/usestrix/strix.git synced 2026-10-13 03:57:59 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

fix(reporting): keep the proxy-outage retry message on evidence-only revisions

Browse source 
An update that only carries http_exchange_ids used to fail with
'No fields to update' when the proxy could not be reached, hiding the
retry guidance. It now returns the outage warning as the error.
This commit is contained in:
Ahmed Allam 2026-09-09 09:18:14 +00:00
parent 618261aa6a
commit 9805d1a67d
2 changed files with 77 additions and 27 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

62
strix/tools/reporting/tool.py
View file

@ -1496,38 +1496,46 @@ async def update_vulnerability_report(
default=str,
)
fields = {
"title": title,
"description": description,
"impact": impact,
"target": target,
"technical_analysis": technical_analysis,
"poc_description": poc_description,
"poc_script_code": poc_script_code,
"remediation_steps": remediation_steps,
"evidence": evidence,
"assumptions": assumptions,
"counterevidence": counterevidence,
"confidence": confidence,
"confidence_rationale": confidence_rationale,
"severity_change_conditions": severity_change_conditions,
"fix_effort": fix_effort,
"cvss_breakdown": cvss_breakdown,
"endpoint": endpoint,
"method": method,
"cve": cve,
"cwe": cwe,
"code_locations": code_locations,
"http_exchange_ids": http_exchange_ids,
"fix_verification": fix_verification,
"fix_pr_body": fix_pr_body,
"contextual_cvss_reasoning": contextual_cvss_reasoning,
}
if http_exchange_warning and all(value is None for value in fields.values()):
return json.dumps(
{"success": False, "error": http_exchange_warning, "report_id": report_id},
ensure_ascii=False,
default=str,
)
agent_id, agent_name = _caller_identity(ctx)
result = await asyncio.to_thread(
_do_update,
report_id=report_id,
update_reason=update_reason,
fields={
"title": title,
"description": description,
"impact": impact,
"target": target,
"technical_analysis": technical_analysis,
"poc_description": poc_description,
"poc_script_code": poc_script_code,
"remediation_steps": remediation_steps,
"evidence": evidence,
"assumptions": assumptions,
"counterevidence": counterevidence,
"confidence": confidence,
"confidence_rationale": confidence_rationale,
"severity_change_conditions": severity_change_conditions,
"fix_effort": fix_effort,
"cvss_breakdown": cvss_breakdown,
"endpoint": endpoint,
"method": method,
"cve": cve,
"cwe": cwe,
"code_locations": code_locations,
"http_exchange_ids": http_exchange_ids,
"fix_verification": fix_verification,
"fix_pr_body": fix_pr_body,
"contextual_cvss_reasoning": contextual_cvss_reasoning,
},
fields=fields,
agent_id=agent_id,
agent_name=agent_name,
)

42
tests/test_reporting_fields.py
View file

@ -2,9 +2,11 @@
from __future__ import annotations
import json
from typing import TYPE_CHECKING, Any, cast
import pytest
from agents.tool_context import ToolContext
from strix.report.dedupe import (
_check_dependency_duplicate,
@ -1501,6 +1503,46 @@ async def test_create_reports_persistence_failure_as_tool_error(
assert report_state.vulnerability_reports == []
async def test_evidence_only_update_reports_proxy_outage_as_retryable(
report_state: ReportState,
monkeypatch: pytest.MonkeyPatch,
) -> None:
_seed_weak_report(report_state)
original = dict(report_state.vulnerability_reports[0])
async def existing_request_ids(
_ctx: Any,
_request_ids: list[str],
) -> set[str]:
raise RuntimeError("Caido client is not available")
monkeypatch.setattr(reporting_tool, "existing_request_ids", existing_request_ids)
ctx = ToolContext(
context={"agent_id": "root"},
tool_name="update_vulnerability_report",
tool_call_id="call-1",
tool_arguments="{}",
)
raw = await update_vulnerability_report.on_invoke_tool(
ctx,
json.dumps(
{
"report_id": "vuln-0009",
"update_reason": "A replay produced a clearer proving exchange.",
"http_exchange_ids": ["204"],
}
),
)
result = json.loads(raw)
assert result["success"] is False
assert "No fields to update" not in result["error"]
assert "update_vulnerability_report" in result["error"]
assert result["report_id"] == "vuln-0009"
assert report_state.vulnerability_reports[0] == original
def test_update_reports_persistence_failure_as_tool_error(report_state: ReportState) -> None:
_seed_weak_report(report_state)
original = dict(report_state.vulnerability_reports[0])