fix(core): treat cloned repo targets as source-aware whitebox scans - #885
Open
timhaines wants to merge 2 commits into
Open
fix(core): treat cloned repo targets as source-aware whitebox scans#885timhaines wants to merge 2 commits into
timhaines wants to merge 2 commits into
Conversation
A `repository` target is cloned into `/workspace/<subdir>` and returned by `collect_local_sources`, exactly like a `local_code` target, but both whitebox checks tested only `type == "local_code"`. Scanning a GitHub repo — alone or alongside a domain — therefore ran with `is_whitebox=False`, so the source-aware skills were not preloaded (`agents/prompt.py:47-49`) and telemetry recorded the scan as blackbox, while the agent had full source in the workspace and diff-scoping was already driving off that same `local_sources` list. Bisects to 1e641e5, which replaced `bool(args.local_sources)` with a type check covering only the first branch of `collect_local_sources`, not the `repository`/`cloned_repo_path` one. The predicate was also duplicated — `interface/utils.py:1247` feeds telemetry, an inlined copy at `core/runner.py:211` gates skills — so the two could drift. Both now share one helper in `strix/core/inputs.py`, which already owns target-dict interpretation and sits on the right side of the interface -> core import direction. Tests: cloned-repo target is whitebox; the predicate agrees with `collect_local_sources` across target-type combinations; the runner's flag reaches `build_strix_agent`; `_resolve_skills(is_whitebox=True)` pulls in the source-aware skills. The first three fail against the old predicate. Fixes usestrix#884 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Contributor
Greptile SummaryThis PR centralizes white-box scan classification and recognizes successfully cloned repository targets as source-aware.
Confidence Score: 5/5The PR appears safe to merge. No blocking failure remains. Important Files Changed
Reviews (2): Last reviewed commit: "docs(core): scope the whitebox predicate..." | Re-trigger Greptile |
…sert The helper does not exactly mirror ``collect_local_sources`` — it accepts ``local_code`` without ``target_path``, and treats ``cloned_repo_path`` by truthiness rather than key presence. Those shapes are unreachable through the CLI, so the predicate is unchanged; only the claim is narrowed. Same for the test, which checks enumerated representative cases rather than a universal invariant. Also records why classification is target-derived: ``_load_resume_state`` restores ``local_sources`` conditionally while requiring ``targets_info``, so an older resumed run can describe a cloned repo with no ``local_sources``, and deriving from the latter would disable source-aware behavior in a sandbox that still has the source. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Contributor
Author
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #884.
A
repositorytarget is cloned into/workspace/<subdir>and returned bycollect_local_sources, exactly like alocal_codetarget — but both whitebox checks tested onlytype == "local_code". Sostrix -t https://github.com/org/repo -t https://your-app.com, the invocationdocs/quickstart.mdx:63documents as "white-box testing", ran withis_whitebox=False: source-aware skills not preloaded, telemetry recording blackbox.Before / after
Change
The predicate was duplicated —
interface/utils.py:1247feeds telemetry, an inlined copy atcore/runner.py:211gates skills — so the two could drift. Both now share one helper, aligned withcollect_local_sourcesfor the target shapes the CLI produces:It lives in
strix/core/inputs.py, which already owns target-dict interpretation (build_root_task,build_scope_context) and sits on the right side of the interface → core import direction, sorunner.pycan reach it. If you'd rather keep it ininterface/utils.py, I'm happy to drop the move and patch both sites in place.Tests
7 new, across
test_inputs.py,test_runner_root_prompt.py, and a newtest_prompt_skills.py:bool(collect_local_sources(...))on representative target-type combinations, including repo+domain and an uncloned repo — this covers the seam that was missing, so narrowing either function in isolation should now trip a testbuild_strix_agent_resolve_skills(is_whitebox=True)pulls incoordination/source_aware_whiteboxandcustom/source_aware_sastVerified by reverting the predicate in place: exactly the three behavior tests fail (421 passed), and pass again on restore.
Checks
424 passed. ruff, mypy, pyright and bandit all at parity with
main— pyright total is unchanged at 981 (inputs.py40→42,runner.py15→13; the twodict.get()errors moved with the code). No docs change needed:docs/quickstart.mdx:63anddocs/usage/cli.mdx:105already document the fixed behavior.🤖 Generated with Claude Code