Labels: bug, config, async
Severity: S1. ConfigRegistry.get is async; a sync caller that neither awaits it nor guards with hasattr(x, "__await__") gets a coroutine object where it expects a value.
Established idiom: platform/tasks/queue.py:467 and platform/services/reasoning.py:164 correctly do if hasattr(x, "__await__"): <fallback>. These sites do not:
| Finding (path:line) |
Issue |
modules/vulnerability/providers/_http.py:33-45 (_resolve_proxy) |
Sync def computes str(registry.get("platform","https_proxy") or "").strip(). registry.get(...) is a coroutine (truthy) -> str(coroutine) is "<coroutine object ...>" (non-empty) -> the function returns that garbage as the proxy URL and never reaches the env-var fallback. Every provider HTTP client built with a registry gets a broken proxy, plus an unawaited-coroutine RuntimeWarning. NEW |
platform/llm/cost.py:149 (_resolve_ceiling) |
Same class -- already tracked in #38 (per-run token budget is dead code). Listed for the root-cause fix |
Root cause: ConfigRegistry.get is async-only, forcing every sync caller onto the fragile hasattr(__await__) dance. There is no honesty-audit rule for "async function called without await" (a discarded coroutine), which has now produced three sites (#38 budget, #45 redis url, this proxy bug).
Acceptance: _resolve_proxy awaits (make the resolver async) or the registry exposes a get_sync() for sync callers; add an honesty-audit rule that flags a call to a known-async ConfigRegistry method whose result is used without await and without an __await__ guard.
Labels: bug, config, async
Severity: S1.
ConfigRegistry.getisasync; a sync caller that neither awaits it nor guards withhasattr(x, "__await__")gets a coroutine object where it expects a value.Established idiom:
platform/tasks/queue.py:467andplatform/services/reasoning.py:164correctly doif hasattr(x, "__await__"): <fallback>. These sites do not:modules/vulnerability/providers/_http.py:33-45(_resolve_proxy)defcomputesstr(registry.get("platform","https_proxy") or "").strip().registry.get(...)is a coroutine (truthy) ->str(coroutine)is"<coroutine object ...>"(non-empty) -> the function returns that garbage as the proxy URL and never reaches the env-var fallback. Every provider HTTP client built with a registry gets a broken proxy, plus an unawaited-coroutine RuntimeWarning. NEWplatform/llm/cost.py:149(_resolve_ceiling)Root cause:
ConfigRegistry.getis async-only, forcing every sync caller onto the fragilehasattr(__await__)dance. There is no honesty-audit rule for "async function called without await" (a discarded coroutine), which has now produced three sites (#38 budget, #45 redis url, this proxy bug).Acceptance:
_resolve_proxyawaits (make the resolver async) or the registry exposes aget_sync()for sync callers; add an honesty-audit rule that flags a call to a known-async ConfigRegistry method whose result is used withoutawaitand without an__await__guard.