feat(reporting): link HTTP exchange evidence - #1281
Merged
Merged
Conversation
Contributor
 The PR appears safe to merge; the previous same-second TUI synchronization issue is fully addressed and no new actionable failures remain.
|
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
…e proxy outages - existing_request_ids: use functools.partial so mypy can type the lookup - _do_create/_do_update/_do_create_dependency: catch any exception raised while committing a report and return a structured success:false result instead of leaking a generic tool error - _verify_http_exchange_ids: unknown IDs are still rejected, but a proxy lookup failure now keeps the IDs and attaches a warning to the result rather than blocking the finding
Contributor
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
…them When the proxy lookup itself fails, the finding is still filed but the http_exchange_ids are omitted and the result carries a warning telling the agent to attach them with update_vulnerability_report once the proxy responds. Unverified IDs are never recorded as evidence.
Contributor
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
…revisions An update that only carries http_exchange_ids used to fail with 'No fields to update' when the proxy could not be reached, hiding the retry guidance. It now returns the outage warning as the error.
Contributor
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
The update callback now fires before the in-memory report is replaced, so a snapshot taken on that notification can still show the old content. The periodic sync fingerprint tracks each report's updated_at as well as its id, so the next tick picks the revision up.
Contributor
…econd-resolution timestamp
Contributor
0xallam
approved these changes
Sep 9, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Add optional
http_exchange_idsto vulnerability creation and updates so findings retain references to the exact proxy requests and responses that support them. IDs are normalized and deduplicated before the ten-reference limit, then checked against the active Caido project. Failed downstream persistence leaves the original in-memory report unchanged so revisions can be retried.Validation: 211 focused engine tests passed. Real local LLM scan and chat flows verified linked baseline, exploit, and control exchanges through the dashboard and API, including persistence after sandbox removal. The full engine suite had 1,743 passes and five failures also reproduced on the original PR head.