open-kritt 漏洞扫描 Agent 控制面

76def build_pending_jobs(
77    *,
78    scan: dict[str, Any],
79    workflow: Workflow,
80    completed: set[tuple[int, int, str | None, int]],
81    step_results: dict[tuple[int, int, str | None, int], list[StepResultRow]],
82    claimed: set[tuple[int, int, str | None, int]] | None = None,
83) -> list[Job]:
84    pending: list[Job] = []
85    if claimed is None:
86        claimed = completed
87    runs = repeat_runs(scan)
88    states = [State(prev_id=0, prev_table=None, repeat_run=1, context=scan_context(scan))]
89    previous_depth_complete = True
90
91    for depth in workflow.depths:
92        steps = workflow.steps_at_depth(depth)
93        next_states: list[State] = []
94        depth_complete = previous_depth_complete
95
96        if _depth_consumes_all(steps, depth):
97            # Do not start a batch until every branch in the previous depth has
98            # completed. Otherwise a concurrent worker could run it over a
99            # partial result set.
100            input_states = [_batch_state(scan, states, depth - 1)] if previous_depth_complete and states else []
101        else:
102            input_states = states
103
104        for state in input_states:
105            for step in steps:
106                task_complete = True
107                task_next_states: list[State] = []
108                for repeat_run in range(1, runs + 1):
109                    repeated_state = _state_for_repeat(state, repeat_run)
110                    key = metadata_key(step.id, repeated_state)
111                    if key not in completed:
112                        task_complete = False
113                        depth_complete = False
114                        if key not in claimed:
115                            pending.append(Job(step=step, state=repeated_state))
116                        # The next repeat needs the output from this one, and the
117                        # next depth needs the complete accumulated task output.
118                        break
119                    task_next_states.extend(_next_states(step, repeated_state, step_results))
120                if task_complete:
121                    next_states.extend(task_next_states)
122
123        states = next_states
124        previous_depth_complete = depth_complete
125
126    return sorted(
127        pending,
128        key=lambda job: (-job.depth, job.state.repeat_run, job.step.order, job.state.prev_id),
129    )

296router.post('/', async (req, res, next) => {
297  try {
298    const valid = validateScan(req.body, { localNames: localRepoNames() });
299    await assertModelSelectionAvailable(valid);
300    const activeScanCount = await prisma.scan.count({ where: { status: { in: ACTIVE_SCAN_STATUSES } } });
301    const launchDecision = scanLaunchDecision(req.body, activeScanCount);
302    if (launchDecision.kind === 'choice-required') {
303      return res.status(409).json({
304        error: 'Another scan is running. Choose whether to start immediately or queue this scan.',
305        code: 'scan_launch_policy_required',
306        errors: [
307          {
308            field: 'launchPolicy',
309            message: 'Choose whether to start immediately or queue this scan.',
310          },
311        ],
312      });
313    }
314
315    const configurationObject =
316      valid.configuration && typeof valid.configuration === 'object' && !Array.isArray(valid.configuration)
317        ? valid.configuration
318        : {};
319    const configuredPostScriptIds = [
320      ...new Set(
321        [
322          `${valid.postScriptId}`,
323          ...(Array.isArray(configurationObject.post_script_ids)
324            ? configurationObject.post_script_ids
325            : Array.isArray(configurationObject.post_scripts)
326              ? configurationObject.post_scripts
327              : []
328          ).map((id) => `${id}`),
329        ].filter((id) => id.trim() !== '')
330      ),
331    ];
332    const invalidPostScriptIds = configuredPostScriptIds.filter((id) => !/^\d+$/.test(id));
333    const queryPostScriptIds = configuredPostScriptIds.filter((id) => /^\d+$/.test(id));
334    const requestedAgentSkills =
335      req.body?.agentSkillIds ??
336      req.body?.agent_skill_ids ??
337      configurationObject.agent_skill_ids ??
338      configurationObject.agent_skills ??
339      [];
340    const configuredAgentSkillIds = [
341      ...new Set(
342        (Array.isArray(requestedAgentSkills)
343          ? requestedAgentSkills
344          : typeof requestedAgentSkills === 'string'
345            ? requestedAgentSkills.split(',')
346            : []
347        )
348          .map((item) => (item && typeof item === 'object' ? item.id : item))
349          .map((id) => `${id}`.trim())
350          .filter(Boolean)
351      ),
352    ];
353    const invalidAgentSkillIds = configuredAgentSkillIds.filter((id) => !/^\d+$/.test(id));
354    const queryAgentSkillIds = configuredAgentSkillIds.filter((id) => /^\d+$/.test(id));
355
356    const created = await prisma.$transaction(async (tx) => {
357      await lockScanConfigurationResources(tx, {
358        workflowId: BigInt(valid.workflowId),
359        postScriptIds: queryPostScriptIds.map((id) => BigInt(id)),
360        agentSkillIds: queryAgentSkillIds.map((id) => BigInt(id)),
361      });
362      const [workflow, postScripts, agentSkills] = await Promise.all([
363        tx.workflow.findUnique({ where: { id: BigInt(valid.workflowId) } }),
364        tx.postScript.findMany({ where: { id: { in: queryPostScriptIds.map((id) => BigInt(id)) } } }),
365        tx.agentSkill.findMany({ where: { id: { in: queryAgentSkillIds.map((id) => BigInt(id)) } } }),

821    def process_scan(self, scan: dict[str, Any], worker_id: int = 1) -> bool:
822        scan_id = int(scan["id"])
823        did_work = False
824        with self.db.connect() as conn:
825            workflow = self.db.load_workflow(conn, int(scan["workflow_id"]))
826
827        while True:
828            with self.db.connect() as conn:
829                current = self.db.load_scan(conn, scan_id)
830                if not current or current["status"] in NON_RUNNABLE_SCAN_STATUSES:
831                    return did_work
832                if not self._worker_can_pick_job(worker_id):
833                    return did_work
834                if current["status"] == PREWARMING_SCAN_STATUS:
835                    conn.commit()
836                    jobs = None
837                    completed = claimed = set()
838                elif current["status"] == "post_processing":
839                    conn.commit()
840                    jobs = None
841                    completed = claimed = set()
842                else:
843                    completed = self.db.load_completed_metadata(conn, scan_id)
844                    claimed = self.db.load_claimed_metadata(conn, scan_id)
845                    step_results = self.db.load_step_results(conn, scan_id)
846                    jobs = build_pending_jobs(
847                        scan=current,
848                        workflow=workflow,
849                        completed=completed,
850                        claimed=claimed,
851                        step_results=step_results,
852                    )
853                    conn.commit()
854
855            needs_new_container = current["status"] == "post_processing" or bool(jobs)
856            if needs_new_container and not self._new_scan_container_allowed(scan_id):
857                return did_work
858
859            harness = harness_for(
860                normalize_harness_name(current["harness"]),
861                timeout_seconds=self.runtime_harness_timeout_seconds(),
862                model_provider=scan_model_provider(current),
863                codex_model_provider=getattr(self.config, "codex_model_provider", None),
864                codex_cli_gate=self.codex_cli_gate,
865            )
866
867            if current["status"] == PREWARMING_SCAN_STATUS:
868                if self._ensure_scan_cache_prewarmed(current, restore_status="running"):
869                    did_work = True
870                    continue
871
872            if current["status"] != "post_processing" and jobs:
873                if self._ensure_scan_cache_prewarmed(current, restore_status="running"):
874                    did_work = True
875                    continue
876
877            if current["status"] == "post_processing":
878                if self._ensure_scan_cache_prewarmed(current, restore_status="post_processing"):
879                    did_work = True
880                    continue
881                if not self._worker_can_pick_job(worker_id):
882                    return did_work
883                did_post_work = self.post_processor.process_once(current, harness)
884                if did_post_work:
885                    return True
886                return did_work
887
888            if not jobs:
889                if claimed != completed:
890                    return did_work
891                with self.db.connect() as conn:
892                    transitioned = self.db.set_scan_status_if_current(conn, scan_id, "running", "post_processing")
893                    conn.commit()
894                if not transitioned:
895                    return did_work
896                LOGGER.info("scan %s workflow completed; starting post-processing", scan_id)
897                did_work = True
898                continue
899
900            did_claim = False
901            for job in jobs:
902                if not self._worker_can_pick_job(worker_id):
903                    return did_work
904                did_claim = self.execute_job(
905                    scan=current,
906                    workflow_id=workflow.id,
907                    job=job,
908                    harness=harness,
909                )
910                if did_claim:

46test('generation and scan model selections share normalization rules', () => {
47  const selection = validateModelSelection({
48    model: ' gpt-5.6 ',
49    model_provider: 'CODEX',
50    harness: 'codex-cli',
51    thinking_effort: 'high',
52  });
53  assert.deepEqual(selection, {
54    model: 'gpt-5.6',
55    modelProvider: 'codex',
56    harness: 'codex',
57    thinkingEffort: 'high',
58  });
59  assert.deepEqual(
60    validateGeneration({
61      kind: 'post_script',
62      request: '  Generate a triage summary. ',
63      model: 'gpt-5.6',
64      model_provider: 'codex',
65      harness: 'codex',
66      thinking_effort: 'high',
67    }),
68    {
69      kind: 'post_script',
70      request: 'Generate a triage summary.',
71      ...selection,
72    }
73  );
74
75  assert.throws(
76    () => validateGeneration({ kind: 'unknown', request: '', model: '', harness: '' }),
77    (error) =>
78      error instanceof ValidationError &&
79      ['kind', 'request', 'model', 'harness'].every((field) => error.errors.some((item) => item.field === field))
80  );
81
82  assert.throws(
83    () =>
84      validateGeneration({
85        kind: 'workflow',
86        request: 'x'.repeat(20_001),
87        model: 'gpt-5.6',
88        model_provider: 'codex',
89        harness: 'codex',
90      }),
91    (error) =>
92      error instanceof ValidationError &&
93      error.errors.some((item) => item.field === 'request' && item.message.includes('20,000'))
94  );
95});
96
97test('model selection accepts the provider effort union', () => {
98  for (const thinkingEffort of ['default', 'low', 'medium', 'high', 'xhigh', 'max', 'ultra']) {
99    assert.equal(
100      validateModelSelection({
101        model: 'custom-model',
102        model_provider: 'codex',
103        harness: 'codex',
104        thinking_effort: thinkingEffort,
105      }).thinkingEffort,
106      thinkingEffort
107    );
108  }
109  assert.throws(
110    () =>
111      validateModelSelection({
112        model: 'claude-fable-5',
113        model_provider: 'claude',
114        harness: 'claude-code',
115        thinking_effort: 'ultra',
116      }),
117    (error) =>
118      error instanceof ValidationError &&
119      error.errors.some(
120        (item) => item.field === 'thinking_effort' && item.message.includes('not supported by harness "claude-code"')
121      )
122  );
123});

32// PATCH /api/vulnerabilities/:id — user review: interesting flag and/or comments.
33// interesting: 1 (interesting), 0 (not interesting), or null (unmarked).
34router.patch('/:id', async (req, res, next) => {
35  try {
36    const id = BigInt(req.params.id);
37    const existing = await prisma.vulnerability.findUnique({ where: { id }, select: { id: true } });
38    if (!existing) return res.status(404).json({ error: 'Vulnerability not found.' });
39
40    const body = req.body || {};
41    const data = {};
42    if ('interesting' in body) {
43      const val = body.interesting;
44      if (val === null) data.interesting = null;
45      else if (val === 0 || val === 1 || val === '0' || val === '1') data.interesting = BigInt(Number(val));
46      else
47        return res
48          .status(422)
49          .json({ errors: [{ field: 'interesting', message: 'interesting must be 0, 1, or null.' }] });
50    }
51    if ('comments' in body) {
52      data.comments = body.comments === null || body.comments === '' ? null : String(body.comments);
53    }
54    if (Object.keys(data).length === 0) {
55      return res.status(422).json({ errors: [{ field: 'body', message: 'Provide interesting and/or comments.' }] });
56    }
57
58    const updated = await prisma.vulnerability.update({
59      where: { id },
60      data,
61      select: { id: true, interesting: true, comments: true },
62    });
63    res.json({
64      id: updated.id.toString(),
65      interesting:
66        updated.interesting === null || updated.interesting === undefined ? null : Number(updated.interesting),
67      comments: updated.comments ?? null,
68    });