From e658657d0b2c15c08d69b140211e7c1aa56fb69f Mon Sep 17 00:00:00 2001 From: suguanYang Date: Tue, 8 Sep 2026 21:50:34 +0800 Subject: [PATCH] fix: clear CodeQL alerts on agent_tools tool registration Addresses the remaining code-scanning comments from the main->staging PR #396 (alerts 417-419 were already fixed on main by b6a95a8f/7a0a51b8): - harness/base.py: replace the ineffectual "..." ellipsis placeholder in the Harness Protocol with "raise NotImplementedError", matching the convention used by other Protocols in this repo (CodeQL: statement has no effect). - agent_tools/__init__.py: perform the tools side-effect import (which registers every corpus.* tool via @register_tool) here, so any consumer importing a name from this package is guaranteed a fully populated REGISTRY; list "_tools" in __all__ as a deliberate re-export. - drop the now-redundant per-consumer side-effect imports of "agent_tools.tools" in dynamic_tools.py, cursor_harness.py, and openai_harness.py (CodeQL: unused import). Removing them outright would have broken tool registration - REGISTRY.all() would be empty. --- apps/api/app/mcp/dynamic_tools.py | 1 - .../retrieval/agent_explore/harness/base.py | 2 +- .../agent_explore/harness/cursor_harness.py | 1 - .../agent_explore/harness/openai_harness.py | 1 - .../services/retrieval/agent_tools/__init__.py | 14 +++++++++++++- 5 files changed, 14 insertions(+), 5 deletions(-) diff --git a/apps/api/app/mcp/dynamic_tools.py b/apps/api/app/mcp/dynamic_tools.py index 3a52b2fb..efb842f7 100644 --- a/apps/api/app/mcp/dynamic_tools.py +++ b/apps/api/app/mcp/dynamic_tools.py @@ -24,7 +24,6 @@ from sqlalchemy.ext.asyncio import AsyncSession from shared.services.retrieval.agent_tools import REGISTRY, ToolContext, ToolSpec -from shared.services.retrieval.agent_tools import tools as _agent_tools_registered # noqa: F401 DbFactory = Callable[[], AsyncContextManager[AsyncSession]] diff --git a/packages/shared-python/shared/services/retrieval/agent_explore/harness/base.py b/packages/shared-python/shared/services/retrieval/agent_explore/harness/base.py index 45c236f7..4bab470e 100644 --- a/packages/shared-python/shared/services/retrieval/agent_explore/harness/base.py +++ b/packages/shared-python/shared/services/retrieval/agent_explore/harness/base.py @@ -39,4 +39,4 @@ async def run_episode( so concurrent tool calls (a real Cursor SDK behavior, not just a theoretical one — see ``harness/cursor_harness.py``) are always safe. """ - ... + raise NotImplementedError diff --git a/packages/shared-python/shared/services/retrieval/agent_explore/harness/cursor_harness.py b/packages/shared-python/shared/services/retrieval/agent_explore/harness/cursor_harness.py index 0d84b566..6678be43 100644 --- a/packages/shared-python/shared/services/retrieval/agent_explore/harness/cursor_harness.py +++ b/packages/shared-python/shared/services/retrieval/agent_explore/harness/cursor_harness.py @@ -93,7 +93,6 @@ ToolResult, load_corpus_schema_text, ) -from shared.services.retrieval.agent_tools import tools as _agent_tools_registered # noqa: F401 # Grace period for the underlying agent run to actually stop, after a # best-effort run.cancel() following a wall_clock timeout, before this diff --git a/packages/shared-python/shared/services/retrieval/agent_explore/harness/openai_harness.py b/packages/shared-python/shared/services/retrieval/agent_explore/harness/openai_harness.py index edad393b..80fd5716 100644 --- a/packages/shared-python/shared/services/retrieval/agent_explore/harness/openai_harness.py +++ b/packages/shared-python/shared/services/retrieval/agent_explore/harness/openai_harness.py @@ -77,7 +77,6 @@ ) from shared.services.retrieval.agent_explore.types import AgentStep, EpisodeResult from shared.services.retrieval.agent_tools import REGISTRY, ToolBudget, load_corpus_schema_text -from shared.services.retrieval.agent_tools import tools as _agent_tools_registered # noqa: F401 # A tool-role message is kept in full for the turn it was produced plus this # many additional turns, then collapsed to a placeholder — see module diff --git a/packages/shared-python/shared/services/retrieval/agent_tools/__init__.py b/packages/shared-python/shared/services/retrieval/agent_tools/__init__.py index 9f5b4284..5583243f 100644 --- a/packages/shared-python/shared/services/retrieval/agent_tools/__init__.py +++ b/packages/shared-python/shared/services/retrieval/agent_tools/__init__.py @@ -9,7 +9,9 @@ The same ``REGISTRY`` is meant to be consumed by two harnesses (Phase 3): the API ``/mcp`` server (Cursor/Codex/Claude) and the in-process ``agent_explore`` tool-loop. Importing ``agent_tools.tools`` registers every -tool as a side effect. +tool as a side effect; this package performs that import itself (below), so +any consumer importing a name here (e.g. ``REGISTRY``) is guaranteed a fully +populated registry. """ from __future__ import annotations @@ -26,7 +28,17 @@ ) from shared.services.retrieval.agent_tools.schema_doc import load_corpus_schema_text +# Register every ``corpus.*`` tool into ``REGISTRY`` as an import side effect: +# each module under ``tools/`` calls ``@register_tool`` at import time. Kept +# here — not in ``registry.py``, which the tool modules import and would +# therefore create a cycle — so consumers importing any name from this package +# no longer need their own side-effect import of ``tools``. ``_tools`` is +# intentionally never referenced (listed in ``__all__`` as a deliberate +# re-export so tooling does not flag it as unused). +from shared.services.retrieval.agent_tools import tools as _tools + __all__ = [ + "_tools", "REGISTRY", "ToolBudget", "ToolContext",