fix(agents): handle truncated tool calls and reject empty findings (#21)

[Mahajan-Sachin]

Summary

Closes #21.

When a reasoning model emits a long tool call (such as report_finding with an exploit script or detailed context) and hits max_tokens (finish_reason: "length"), JSON decoding fails and tool_call.arguments defaults to {} with tool_call.parse_error set. Previously, agent loops did not check parse_error, causing:

1. hunter.py to record an empty "ghost" finding with missing file/category/description.
2. validator.py to classify truncated validation verdicts as false positives.
3. Base & verifier agents to crash or execute tools with empty parameters.

Changes

1. Gate Tool Execution on parse_error: Before executing tool calls across hunter, validator, base, sandbox_verifier, and browser_verifier, check tool_call.parse_error. If set, return a structured tool_call_truncated error instructing the model to resend with concise arguments.
2. Defensive Validation in _handle_report_finding: Ensure file_path and description are non-empty before recording into self.findings.
3. Defensive Validation in _handle_validate_finding: Require a non-empty status before recording validation results.
4. Regression Tests: Added tests/test_tool_call_truncation.py with 7 unit tests verifying truncation handling and finding rejection across all agent scenarios.

Testing

Ran uv run pytest tests/test_tool_call_truncation.py:

• 7/7 tests passed.

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge; the remaining verifier test gap is non-blocking.

Findings

1.  Verifier fixes lack tests ▶

Fix with agent prompt

### Issue 1
tests/test_tool_call_truncation.py:206-207
The new tests cover `HunterAgent`, `ValidatorAgent`, and `BaseAgent`, but neither changed verifier loop is exercised. Each verifier has its own completion path, so the base-agent test cannot catch a regression that executes a truncated call or ends verification early.

Add tests for `BrowserVerifierAgent` and `SandboxVerifierAgent` with truncated action and completion calls. Assert that no handler runs, the error reaches the model, and a corrected retry succeeds.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Summary

The PR stops agents from executing tool calls whose arguments could not be parsed.

• Agents send truncated tool calls back for a shorter retry.
• The hunter stores findings only with a real file path and description.
• The validator records results only when they have a non-empty status.

_{Reviews (3) · Last reviewed commit: "fix(agents): validate input types and ad..." · Reviewed by Greptile}

[greptile-apps]

Verifier fixes lack tests

The new tests cover HunterAgent, ValidatorAgent, and BaseAgent, but neither changed verifier loop is exercised. Each verifier has its own completion path, so the base-agent test cannot catch a regression that executes a truncated call or ends verification early.

Add tests for BrowserVerifierAgent and SandboxVerifierAgent with truncated action and completion calls. Assert that no handler runs, the error reaches the model, and a corrected retry succeeds.

Prompt To Fix With AI

This is a comment left during a code review.
Path: tests/test_tool_call_truncation.py
Line: 177-178

Comment:
**Verifier fixes lack tests**

The new tests cover `HunterAgent`, `ValidatorAgent`, and `BaseAgent`, but neither changed verifier loop is exercised. Each verifier has its own completion path, so the base-agent test cannot catch a regression that executes a truncated call or ends verification early.

Add tests for `BrowserVerifierAgent` and `SandboxVerifierAgent` with truncated action and completion calls. Assert that no handler runs, the error reaches the model, and a corrected retry succeeds.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

[Mahajan-Sachin]

@greptile-apps Addressed both findings:

1. P1 (Type safety & resilient handlers): Added explicit isinstance(..., str) validation on file_path and description before calling .strip(), and wrapped handler dispatches in try/except blocks across HunterAgent and ValidatorAgent so non-string payloads can never raise AttributeError or terminate active loops.
2. P2 (Verifier tests): Added unit test coverage for SandboxVerifierAgent and BrowserVerifierAgent covering both truncated action calls and subsequent successful completion retries.

All 10/10 regression tests in tests/test_tool_call_truncation.py are passing.

[Mahajan-Sachin]

@greptile-apps is everything all right now?

[greptile-apps]

Yes — the follow-up changes address the remaining concerns. The handlers now validate types before calling .strip()/.lower(), dispatch failures are contained so malformed payloads cannot terminate the loops, and both sandbox and browser verifiers have retry-path coverage.

The parse_error gate is present across the base agent, hunter, validator, sandbox verifier, and browser verifier, so truncated calls are returned to the model without executing with {}. Based on the updated diff and the reported 10/10 regression tests, I don’t see any remaining blocking issues.

Tip: You can customize Greptile's behavior for this repo with .greptile/rules.md and .greptile/config.json.

[Mahajan-Sachin]

Hi @ananay,

This is ready for review and merge. It resolves #21 across the entire agent pipeline:

• Root Cause Fixed: Gated tool execution on tool_call.parse_error across BaseAgent, HunterAgent, ValidatorAgent, SandboxVerifierAgent, and BrowserVerifierAgent. When tokens overflow mid-stream, truncated calls return a structured retryable error instead of executing with empty {} arguments.
• Defensive Type Safety: _handle_report_finding and _handle_validate_finding now strictly validate string types before .strip() / normalization, and handler dispatches are wrapped so malformed payloads can't crash active loops.
• Test Coverage: Added tests/test_tool_call_truncation.py with 10/10 passing unit tests covering all agents and retry paths.
• Bot Review: Greptile re-review has passed with no blocking issues.

Whenever you have a moment, please take a look!