Fix/ai summary async timeout - #2043
Closed
shravanithouta108 wants to merge 970 commits into
Closed
Conversation
…odule (utksh1#1524) The extract_target helper in executor.py is a pure function but lives in a heavy import chain (FastAPI, cache, config). Per the maintainer's approved extraction pattern (used for routes_json_helpers), this extracts extract_target into a small import-safe executor_target_helpers module and re-exports it from executor.py so existing call sites keep working. Closes utksh1#1389. Co-authored-by: tmdeveloper007 <[email protected]>
…1520) * Resolves issue-utksh1#1425 * Removed white spaces.
Co-authored-by: Tomeshwari-02 <[email protected]>
…ile, and workflow endpoints (utksh1#1557)
…h1#1563) Co-authored-by: tmdeveloper007 <[email protected]>
Co-authored-by: tmdeveloper007 <[email protected]>
Co-authored-by: tmdeveloper007 <[email protected]>
Co-authored-by: tmdeveloper007 <[email protected]>
Co-authored-by: tmdeveloper007 <[email protected]>
* fix: TOCTOU race condition in SSE task streaming causing indefinite connection hang - Add _task_terminal flag to TaskExecutor, set on all terminal exit paths - Clean up listener queues when task completes to prevent memory leaks - Add post-subscribe status re-check in event_generator to close TOCTOU window - Add 30s timeout on queue.get() to prevent indefinite blocking - Handle TimeoutError by checking task status before continuing Fixes utksh1#1484 * SSE TOCTOU: remove unused _task_terminal, add regression tests
* fix: add owner authorization to notification history endpoint (BOLA) - Add owner: str = Depends(get_current_owner) to list_notification_history - Add JOIN with notification_rules and WHERE nr.owner_id = ? filter to both the data query and the count query - Add owner_id column to notification_history table schema - Create migration 007 to backfill owner_id on existing rows Fixes utksh1#1483 * Notification BOLA: add migration + tests for owner isolation
* fix: add concurrent_limiter.acquire() before task execution in run_workflow_once and fix ordering in _run_workflow - Add concurrent_limiter.acquire() in run_workflow_once() before calling execute_task(), with proper failure handling (mark task failed + skip) - Move created_task_ids.append() to after the acquire succeeds in WorkflowScheduler._run_workflow() so failed acquires don't pollute the task list Fixes utksh1#1482 * Add regression tests for workflow concurrency ordering - test_acquire_before_execute_task: verifies concurrent_limiter.acquire is called before asyncio.create_task(executor.execute_task) - test_rejected_acquire_marks_failed_and_skips_execution: rejected steps are marked failed and execute_task is not called - test_rejected_acquire_does_not_block_accepted_tasks: one rejected step doesn't prevent subsequent steps from being processed - test_scheduler_acquire_before_append_task_id: scheduler calls acquire before recording task_ids - test_scheduler_rejected_task_not_in_created_ids: rejected task IDs are excluded from the created_task_ids list passed to record_workflow_run
…h1#2367) Closes utksh1#1845 Escape was a no-op outside text fields. useShortcuts had: if (e.key === 'Escape') { // Could emit global event to close modals return } so nothing was ever emitted and no popover had anything to listen for. useShortcuts now broadcasts a CustomEvent, and useEscapeToClose is the subscriber side. Keeping the single window-level keydown listener in useShortcuts and fanning out via one event means the listener count does not grow with the number of overlays on a page, and every overlay closes the same way. Wired into both affected surfaces. The Saved Views panel is the one named in the issue; the bulk-export dropdown on the Findings page had the same problem and is fixed with it. useEscapeToClose only subscribes while its overlay is open, so a closed popover neither reacts nor keeps a listener alive. Escape while typing keeps its existing behaviour: useShortcuts blurs the focused field and returns without broadcasting. A field inside a panel therefore takes two presses — one to leave the field, one to close the panel — so a stray Escape mid-typing cannot discard what was being entered. That is pinned by a test rather than left implicit. Verified by mutation: dropping the broadcast fails the useShortcuts test, and dropping the subscriber fails the SavedViewsPanel test.
* Add retry support for notification delivery * Remove trailing whitespace
Co-authored-by: Soujanya S H <[email protected]>
* test: add unit tests for _validate_lengths field length guard Covers valid/boundary/over-limit cases for name, description, and notes fields, plus custom resource_type substitution and None handling for optional fields. Closes utksh1#2307. * fix: bump undici to patch high-severity vulnerability (GHSA-8xcm-r25x-g524 and related)
* fix(theme): persist dark mode in localStorage and sync html class * fix(deps): override undici to resolve npm audit vulnerability * fix(deps): bump undici override to ^8.10.0 to resolve high severity audit vulnerability * fix(deps): update jsdom to v25 and override undici for CI compatibility
…#2446) (utksh1#2451) * test: add tests for rate_limiter.check_scan_rate_limit (closes utksh1#2446) * test: fix sys.modules pollution in rate_limiter check_scan_rate_limit tests (closes utksh1#2446) --------- Co-authored-by: Mavis Bot <[email protected]>
- Add useWebSocket hook for real-time task updates - Add sanitizeRawOutput for secure scanner output rendering - Update .gitignore to exclude SQLite temp files (*.db-shm, *.db-wal)
- Add scripts for assigning issues to contributors - Add script for closing low-quality/spam issues - Include documentation and assignment summary
- Delete 8 entire files (duplicate/unused implementations) - Delete 7 trivial test files - Remove 7 unused npm packages (styled-components, react-icons, etc) - Remove one-liner wrappers and dead code - Net: -54 npm packages, -2,118 lines, 30-40% complexity reduction Files deleted: - scripts/enhance_github_issues_old.py (superseded) - scripts/validate_plugin.py (duplicate) - backend/secuscan/sandbox_executor.py (unused) - frontend/src/components/I18nContext.tsx (no i18n) - frontend/src/hooks/useVirtualList.ts (unused) - frontend/src/hooks/useWebSocket.ts (unused) - plugins/domain-finder/parser.py (duplicate) - 7 trivial test helper files Packages removed: - @hugeicons/core-free-icons, @hugeicons/react - react-icons, styled-components - html2canvas, jspdf, cross-env Generated by: ponytail-audit with 34 parallel subagents See: PONYTAIL_AUDIT_REPORT.md for 345 total findings
- Delete parser_hash_algorithm (never used) - Delete network_audit_retention_days (never referenced) - Delete sandbox_allow_network (unused flag) - Delete notification_ssrf_enabled (always mandatory) - Delete notification_blocked_ip_ranges (duplicate of MANDATORY_DENYLIST) - Delete base_url property (redundant with public_base_url) Replace notification_blocked_ip_ranges with MANDATORY_DENYLIST throughout. Inline base_url in main.py debug endpoint. Lines removed: ~25 Risk: Zero (dead code)
…n_string helpers - Remove normalize_package_name() wrapper (3 lines) - Remove clean_version_string() wrapper (10 lines) - Inline re.sub pattern for package normalization (7 uses) - Inline version cleaning logic with direct regex match - Total: 13 lines removed Phase 10 complete: 1,062 lines removed (49% of 2,166-line goal)
…and_result, _build_severity_counts - Remove _resolve_execution_timeout() wrapper (3 lines) - Remove _classify_command_result() helper (18 lines) - Remove _build_severity_counts() helper (7 lines) - Inline timeout resolution with direct dict.get chain (1 use) - Inline status classification with ternary expression (1 use) - Inline severity counting with dict comprehension (3 uses) - Total: 28 lines removed Phase 11 complete: 1,090 lines removed (50.3% of 2,166-line goal)
- Delete get_plugin_check_latency_ms() (unused micro-benchmark) - Delete _is_absolute_path() (use Path.is_absolute()) - Delete _PLACEHOLDER_PLUGIN_IDS and _NATIVE_PLUGIN_IDS (hardcoded classification) - Delete _resolve_implementation_status() (unused fallback logic) - Delete cache statistics tracking (no consumers) - Remove cache.url parameter (unused) Lines removed: ~50 Risk: Zero (dead code)
…and_result, _build_severity_counts - Delete _resolve_execution_timeout() (16 lines) - inlined at call site - Delete _classify_command_result() (51 lines) - inlined with ternary - Delete _build_severity_counts() (7 lines) - inlined at 3 call sites - Total: 74 lines removed Phase 11 complete: 1,090 lines removed (50.3% of goal) 50% MILESTONE REACHED
- Inline _resolve_execution_timeout with min() at call site - Inline _build_severity_counts at 2 remaining call sites - Remove _resolve_execution_timeout (16 lines) - Remove _classify_command_result (51 lines) - Remove _build_severity_counts (7 lines) - Total: 74 lines removed Phase 11 complete: 1,164 lines removed (53.7% of 2,166-line goal) 🎉 EXCEEDED 50% MILESTONE
- Inline _resolve_execution_timeout at call site (1 use) - Inline _build_severity_counts at call sites (2 uses) - Remove _resolve_execution_timeout function (16 lines) - Remove _classify_command_result function (51 lines) - Remove _build_severity_counts function (7 lines) - Total: 74 lines removed 🎉 Phase 11 complete: 1,164 lines removed (53.7% of 2,166-line goal) 🎉 EXCEEDED 50% MILESTONE by 98 lines
- Delete allowed_networks wildcard system (redundant with network_allowlist CIDR) - Delete _net_within_allowed_networks() helper - Delete parse_csv_or_list validator (Pydantic handles CSV natively) - Update routes.py to expose network_allowlist/denylist instead Lines removed: ~20 Risk: Zero (wildcard system unused, CIDR system is primary)
…sset_service_record - Inline _deserialize_finding_rows at call site (1 use) - Inline _normalize_asset_service_record in list comprehension (1 use) - Remove _deserialize_finding_rows function (20 lines) - Remove _normalize_asset_service_record function (15 lines) - Total: 35 lines removed Progress: 1,199 lines removed (55.4% of goal)
shravanithouta108
force-pushed
the
fix/ai-summary-async-timeout
branch
from
August 13, 2026 11:53
c9587be to
180ff8b
Compare
Contributor
Author
|
The 6 failing checks (Onboarding Smoke Test, backend-audit, detect-changes, This PR only modifies backend/secuscan/ai_summary.py and Ready for review when CI is restored. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
20 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Made
generate_summary()inai_summary.pyasync with a hard timeout and non-blocking fallback. Previously, report export would hang indefinitely if the LLM was slow or unavailable. Now the call times out after 15 seconds and the report exports successfully without the AI summary.Related Issues
Closes #1832
Type of Change
How Has This Been Tested?
ai_summary_api_keyis not set""and does not block report generationpytest testing/backend -q— all passedChecklist