From 355a8bb43743ce769e5ff3f72461c07127f3c45c Mon Sep 17 00:00:00 2001 From: Ahmed Allam Date: Fri, 18 Sep 2026 18:32:38 +0000 Subject: [PATCH] fix(reporting): move the git blame hint to the end of the tool description --- strix/tools/reporting/tool.py | 13 +++++++------ tests/test_reporting_fields.py | 13 +++++++------ 2 files changed, 14 insertions(+), 12 deletions(-) diff --git a/strix/tools/reporting/tool.py b/strix/tools/reporting/tool.py index ddc56296..720d42a4 100644 --- a/strix/tools/reporting/tool.py +++ b/strix/tools/reporting/tool.py @@ -1123,12 +1123,7 @@ async def create_vulnerability_report( but unverified follow-on risks separate; do not use them to set CVSS metrics. target: Affected URL / domain / repository. - technical_analysis: The mechanism and root cause. For code findings, - if the checkout has git history, a quick ``git blame`` (quote the - paths) on the vulnerable line is worth weaving into the analysis: - who last touched it, when, and in which commit — as part of the - prose, not a separate section. Skip it if the line is uncommitted - or the command fails. + technical_analysis: The mechanism and root cause. poc_description: Step-by-step reproduction (steps only, no code). poc_script_code: Working PoC (Python preferred). remediation_steps: Specific, actionable fix (prose, no code). @@ -1328,6 +1323,12 @@ async def create_vulnerability_report( A restrictive CSP that blocks inline script execution would reduce impact and lower the severity. fix_effort: "low" + + Nice to have: for code findings, if the checkout has git history, a quick + ``git blame`` (quote the paths) on the vulnerable line is worth weaving into + ``technical_analysis`` — who last touched it, when, and in which commit, as + part of the prose, not a separate section. Skip it if the line is + uncommitted or the command fails. """ ( http_exchange_ids, diff --git a/tests/test_reporting_fields.py b/tests/test_reporting_fields.py index 17181c39..cd40fe69 100644 --- a/tests/test_reporting_fields.py +++ b/tests/test_reporting_fields.py @@ -1089,12 +1089,13 @@ def test_tool_descriptions_include_formatting_guidance() -> None: assert "reachab" in dep_desc.lower() -def test_git_blame_hint_lives_only_in_technical_analysis() -> None: - summary, _, args = create_vulnerability_report.description.partition("Args:") - assert "blame" not in summary - field = args.split("technical_analysis:", 1)[1].split("poc_description:", 1)[0] - assert "git blame" in field - assert "not a separate section" in field +def test_git_blame_hint_is_a_trailing_note() -> None: + desc = create_vulnerability_report.description + assert desc.count("blame") == 1 + tail = desc[desc.index("Nice to have:") :] + assert "git blame" in tail + assert "technical_analysis" in tail + assert "Example" not in tail assert "blame" not in update_vulnerability_report.description