fix(sec-core): preserve seharden wrapper defaults#236
Open
chenzongyao200127 wants to merge 1 commit intoalibaba:release/agent-sec-core/v0.3from
Open
Conversation
Signed-off-by: Zongyao Chen <ZongYao.Chen@linux.alibaba.com>
chenzongyao200127
requested review from
casparant,
edonyzpc and
kid9
as code owners
|
|
Author
|
PTAL @RemindD |
There was a problem hiding this comment.
Pull request overview
Restores agent-sec-cli harden wrapper default behavior (scan + agentos_baseline) while shifting the hardening backend to a passthrough-args model that still preserves legacy kwargs support and keeps parsed SEHarden results in ActionResult.data.
Changes:
- Update
hardenCLI command to forward unknown SEHarden flags verbatim while re-applying wrapper defaults for zero-arg/config-only calls. - Refactor hardening backend to accept
args=[...]passthrough, preserve execution metadata (argv,tool_path,returncode), and keep structured parsed results (failures,fixed_items, summary counters). - Add/adjust unit tests and update documentation/examples to reflect
--scan/--reinforce/--dry-runflags instead of--mode.
Reviewed changes
Copilot reviewed 8 out of 8 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| src/agent-sec-core/tests/unit-test/test_cli.py | Adds regression tests for wrapper help text, default arg injection, passthrough, and downstream help behavior. |
| src/agent-sec-core/tests/unit-test/security_middleware/backends/test_hardening_backend.py | Updates backend tests for passthrough args, legacy defaults, resolved binary path behavior, and structured results. |
| src/agent-sec-core/skill/references/agent-sec-seharden.md | Updates skill reference commands/docs to the new harden invocation style. |
| src/agent-sec-core/skill/SKILL.md | Updates skill execution instructions/examples to match the new harden flags. |
| src/agent-sec-core/agent-sec-cli/src/agent_sec_cli/security_middleware/backends/hardening.py | Implements passthrough args execution + result metadata and parsing while preserving legacy kwargs defaults. |
| src/agent-sec-core/agent-sec-cli/src/agent_sec_cli/cli.py | Reworks harden Typer command to allow unknown args passthrough and inject wrapper defaults; adds concise custom help. |
| src/agent-sec-core/agent-sec-cli/README.md | Updates CLI + Python API usage examples to use args=[...] and new flags. |
| src/agent-sec-core/agent-sec-cli/BUILD.md | Updates build/install docs to reflect the new harden invocation. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
RemindD
reviewed
Apr 17, 2026
| """Run `loongshield seharden`.""" | ||
| if help_flag: | ||
| typer.echo(_HARDEN_HELP_TEXT.rstrip()) | ||
| raise typer.Exit(code=0) |
Collaborator
There was a problem hiding this comment.
harden --help 没有直接调loongshield --help的原因是想把提供的能力限定在以上三种吗？
Author
There was a problem hiding this comment.
是的，目前 loongshield 还有一些 subcmd，我觉得在 sec-core-cli 这个场景下不太适合暴露给用户
Author
edonyzpc
reviewed
Apr 17, 2026
| # --------------------------------------------------------------------------- | ||
| _ANSI_RE = re.compile(r"\x1b\[[0-9;]*m") | ||
|
|
||
| _DEFAULT_HARDEN_CONFIG = "agentos_baseline" |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Restore the
agent-sec-cli hardenwrapper defaults so zero-argument and config-only invocations continue to runsehardenin scan mode with theagentos_baselineprofile. The hardening backend now also keeps parsed SEHarden summary and per-rule results inActionResult.datawhile preserving passthrough execution metadata and captured stdout.The update keeps the concise wrapper help, downstream passthrough behavior, and legacy backend compatibility, and adds regression coverage for the wrapper defaults and structured hardening results.
Related Issue
no-issue: follow-up fix for an unreleased sec-core harden wrapper change
Type of Change
Scope
cosh(copilot-shell)sec-core(agent-sec-core)skill(os-skills)sight(agentsight)Checklist
cosh: Lint passes, type check passes, and tests passsec-core(Rust):cargo clippy -- -D warningsandcargo fmt --checkpasssec-core(Python): Ruff format and pytest passskill: Skill directory structure is valid and shell scripts pass syntax checksight:cargo clippy -- -D warningsandcargo fmt --checkpasspackage-lock.json/Cargo.lock)Testing
cd src/agent-sec-core agent-sec-cli/.venv/bin/python -m ruff check \ agent-sec-cli/src/agent_sec_cli/cli.py \ agent-sec-cli/src/agent_sec_cli/security_middleware/backends/hardening.py \ tests/unit-test/test_cli.py \ tests/unit-test/security_middleware/backends/test_hardening_backend.py agent-sec-cli/.venv/bin/python -m pytest \ tests/unit-test/test_cli.py \ tests/unit-test/security_middleware/backends/test_hardening_backend.py -q agent-sec-cli/.venv/bin/python -m pytest tests/unit-test -qResults:
ruff checkpassed for the touched Python files.26 passed.102 passed.Additional Notes
Running
pytest tests/insrc/agent-sec-coreis currently blocked by a pre-existing e2e collection error caused by duplicate module names:tests/e2e/linux-sandbox/e2e_test.pytests/e2e/skill-signing/e2e_test.pyThis PR does not modify those e2e tests.