Skip to content

feat(peachfuzz): import reviewed PeachTree seed manifests - #1

Open
0ai-Cyberviser wants to merge 4 commits into
cyberviser:mainfrom
0ai-Cyberviser:feat/peachfuzz-import-peachtree
Open

feat(peachfuzz): import reviewed PeachTree seed manifests#1
0ai-Cyberviser wants to merge 4 commits into
cyberviser:mainfrom
0ai-Cyberviser:feat/peachfuzz-import-peachtree

Conversation

@0ai-Cyberviser

Copy link
Copy Markdown

Summary

Adds a local-only importer for reviewed PeachTree seed manifests so PeachFuzz can consume approved corpus exports from PeachTree.

Changes

  • Add PeachTreeSeedImporter
  • Validate manifest provenance and target type
  • Reject absolute paths and parent-directory traversal
  • Add importer tests and docs

Safety controls

  • Local-only import
  • No network contact
  • No shell execution
  • No CactusFuzz scope escalation
  • Requires manifest policy fields for no_network and no_execution

Tests

  • pytest -q tests/test_peachtree_import.py
  • pytest -q
  • ruff check src tests
  • mypy src

Rollback plan

Revert the importer module, tests, CLI registration, and docs. Existing PeachFuzz commands remain unchanged.

Release note

PeachFuzz can import reviewed PeachTree seed manifests into local fuzz corpora.

Copilot AI review requested due to automatic review settings April 25, 2026 05:07

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 70c298e140

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment on lines +65 to +66
destination = out / source.name
shutil.copyfile(source, destination)

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Avoid clobbering seeds with identical basenames

Using destination = out / source.name flattens every imported seed to its basename, so two valid manifest entries like a/seed.json and b/seed.json overwrite each other in the output directory. In that case imported is incremented twice but only one file remains, which silently drops corpus coverage and can corrupt experiment inputs. This should preserve a unique path per seed (or detect and reject collisions) instead of overwriting.

Useful? React with 👍 / 👎.

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants