safekeeping

Author: server

Scripts/extract-crash-js.sh

@@ -0,0 +1,104 @@
+#!/usr/bin/env bash
+# Extract lifted JavaScript for a program (crash) hash from the Fuzzilli Postgres DB.
+#
+# Usage:
+#   ./Scripts/extract-crash-js.sh <program_hash> [output.js]
+#
+# If output.js is omitted, writes to crashes/<program_hash>.js under the repo root.
+#
+# Environment (optional):
+#   POSTGRES_URL   e.g. postgresql://user:pass@host:5432/dbname
+#   DB_HOST, DB_PORT, DB_NAME, DB_USER, DB_PASSWORD  (defaults match fuzzer-stats.sh)
+#   FUZZILTOOL       path to FuzzILTool (default: <repo>/.build/debug/FuzzILTool)
+#   VERIFY_CRASH=1   require at least one crashed execution for this hash
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PROJECT_ROOT="$(cd "${SCRIPT_DIR}/.." && pwd)"
+
+if [ -f "${PROJECT_ROOT}/.env" ]; then
+  # shellcheck source=/dev/null
+  source "${PROJECT_ROOT}/.env"
+elif [ -f "${PROJECT_ROOT}/env.distributed" ]; then
+  # shellcheck source=/dev/null
+  source "${PROJECT_ROOT}/env.distributed"
+fi
+
+DB_HOST="${DB_HOST:-localhost}"
+DB_PORT="${DB_PORT:-5432}"
+DB_NAME="${DB_NAME:-fuzzilli_master}"
+DB_USER="${DB_USER:-fuzzilli}"
+DB_PASSWORD="${DB_PASSWORD:-fuzzilli123}"
+
+FUZZILTOOL="${FUZZILTOOL:-${PROJECT_ROOT}/.build/debug/FuzzILTool}"
+
+usage() {
+  echo "Usage: $0 <program_hash> [output.js]" >&2
+  echo "  program_hash: 64-char hex sha256 from program / crash records" >&2
+  echo "  output.js:    optional path (default: crashes/<program_hash>.js)" >&2
+  exit 1
+}
+
+if [ "${1:-}" = "-h" ] || [ "${1:-}" = "--help" ]; then
+  usage
+fi
+
+HASH="${1:-}"
+OUTFILE="${2:-}"
+
+if [ -z "$HASH" ]; then
+  usage
+fi
+
+if ! [[ "$HASH" =~ ^[0-9a-fA-F]{64}$ ]]; then
+  echo "Error: program_hash must be 64 hex characters, got: $HASH" >&2
+  exit 1
+fi
+
+HASH_LC="$(echo "$HASH" | tr '[:upper:]' '[:lower:]')"
+
+if [ ! -x "$FUZZILTOOL" ]; then
+  echo "Error: FuzzILTool not found or not executable: $FUZZILTOOL" >&2
+  echo "Set FUZZILTOOL or build: swift build" >&2
+  exit 1
+fi
+
+run_psql() {
+  local sql="$1"
+  if [ -n "${POSTGRES_URL:-}" ]; then
+    psql "$POSTGRES_URL" -t -A -c "$sql"
+  else
+    PGPASSWORD="$DB_PASSWORD" psql -h "$DB_HOST" -p "$DB_PORT" -U "$DB_USER" -d "$DB_NAME" -t -A -c "$sql"
+  fi
+}
+
+if [ "${VERIFY_CRASH:-0}" = "1" ]; then
+  crash_count="$(run_psql "SELECT COUNT(*)::text FROM execution WHERE program_hash = '$HASH_LC' AND execution_outcome_id = 1;" | tr -d '[:space:]')"
+  if [ "${crash_count:-0}" = "0" ]; then
+    echo "Error: no crashed execution (outcome 1) for hash $HASH_LC (set VERIFY_CRASH=0 to skip)" >&2
+    exit 1
+  fi
+fi
+
+b64="$(run_psql "SELECT program_base64 FROM program WHERE program_hash = '$HASH_LC' LIMIT 1;" | tr -d '[:space:]')"
+
+if [ -z "$b64" ]; then
+  echo "Error: no program row for hash $HASH_LC" >&2
+  exit 1
+fi
+
+WORKDIR="$(mktemp -d "${TMPDIR:-/tmp}/extract-crash-js.XXXXXX")"
+cleanup() { rm -rf "$WORKDIR"; }
+trap cleanup EXIT
+
+echo "$b64" | tr -d '[:space:]' | base64 --decode > "${WORKDIR}/program.fzil"
+
+if [ -z "$OUTFILE" ]; then
+  mkdir -p "${PROJECT_ROOT}/crashes"
+  OUTFILE="${PROJECT_ROOT}/crashes/${HASH_LC}.js"
+fi
+
+"$FUZZILTOOL" --liftToJS "${WORKDIR}/program.fzil" > "$OUTFILE"
+
+echo "Wrote $OUTFILE"

Scripts/minimize-flags.sh

@@ -8,7 +8,7 @@ set -e
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 PROJECT_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
 CRASH_JS="${1:-$SCRIPT_DIR/crash_repro.js}"
-D8="${2:-${D8_PATH:-/mnt/vdc/v8_vrig/v8/out/fuzzbuild/d8}}"
+D8="${2:-${D8_PATH:-/mnt/vdc/v8_vrig/v8/out/fuzzbuild_dbg/d8}}"
 
 FLAGS=(
   --expose-gc
@@ -24,23 +24,25 @@ FLAGS=(
   --wasm-staging
   --wasm-fast-api
   --expose-fast-api
-  --experimental-wasm-rab-integration
   --wasm-test-streaming
 )
+# --experimental-wasm-rab-integration
+
 
 if [ ! -f "$CRASH_JS" ]; then
   echo "Creating crash reproducer at $CRASH_JS"
   mkdir -p "$(dirname "$CRASH_JS")"
   cat > "$CRASH_JS" << 'CRASH_EOF'
-async function* f0(a1, a2, a3) {
-    function F4(a6, a7) {
-        if (!new.target) { throw 'must be called with new'; }
-    }
-    function F8(a10, a11, a12) {
-        if (!new.target) { throw 'must be called with new'; }
-        try { this(F4); } catch (e) {}
-    }
-    return a3;
+const v1 = Set(Set);
+function f2(a3, a4, a5) {
+    const v10 = {
+        get c() {
+            eval();
+            v1?.__proto__;
+            return v1;
+        },
+    };
+    return a5;
 }
 CRASH_EOF
 fi

Sources/Agentic_System/agents/EBG_crash.py

@@ -21,6 +21,7 @@
     base64_program_to_js_tool,
     db_get_crash_program_as_js_tool,
     db_query_tool,
+    db_store_generated_program_tool,
     db_list_programs_tool,
     db_get_fuzzer_performance_summary_tool,
     db_list_fuzzers_tool,
@@ -35,6 +36,7 @@
     create_generate_folder_tool,
     trace_v8_analysis_tool,
     list_v8_trace_options_tool,
+    minimize_crash_flags_tool,
     get_program_js_from_hash_tool,
     start_mi_debug_session_tool,
     stop_mi_debug_session_tool,
@@ -79,16 +81,17 @@
 from agent_logging import configure_process_logging
 
 # Default to OpenAI GPT-5 models. IkaCore routes these through the Responses API.
-MANAGER_MODEL = os.environ.get("EBG_MANAGER_MODEL", "gpt-5.4")
-WORKER_MODEL = os.environ.get("EBG_WORKER_MODEL", "gpt-5-mini")
+MANAGER_MODEL = os.environ.get("EBG_MANAGER_MODEL", "gpt-5.4-mini")
+WORKER_MODEL = os.environ.get("EBG_WORKER_MODEL", "gpt-5.4-mini")
+ROOT_MODEL = os.environ.get("EBG_ROOT_MODEL", "gpt-5.4")
 API_URL = os.environ.get("EBG_API_URL", "https://api.openai.com/v1/responses")
 
 
 logger = logging.getLogger("boiled_eggs")
 if not logger.handlers:
     logger.addHandler(logging.NullHandler())
 logger.propagate = False
-logger.disabled = True
+logger.disabled = False
 est_timezone = pytz.timezone("America/New_York")
 
 sys.path.append(str(Path(__file__).parent.parent))
@@ -199,6 +202,7 @@ def setup_agents(self, crash_program_hash: Optional[str] = None):
                 trace_v8_analysis_tool,
                 get_program_js_from_hash_tool,
                 read_from_generate_folder_tool,
+                write_to_generate_folder_tool,
                 list_generate_folder_tool,
                 start_mi_debug_session_tool,
                 stop_mi_debug_session_tool,
@@ -229,7 +233,21 @@ def setup_agents(self, crash_program_hash: Optional[str] = None):
             description="L2 Worker responsible for generating JavaScript program seeds from a crash PoC",
             prompt=self.get_prompt("JS_generator.txt"),
             system_prompt="You are JSGenerator.",
-            tools=[],
+            tools=[
+                db_store_generated_program_tool,
+                db_query_tool,
+                db_list_programs_tool,
+                execute_javascript_program_tool,
+                list_d8_flags_tool,
+                list_v8_trace_options_tool,
+                trace_v8_analysis_tool,
+                get_program_js_from_hash_tool,
+                read_from_generate_folder_tool,
+                write_to_generate_folder_tool,
+                delete_files_from_generate_folder_tool,
+                list_generate_folder_tool,
+                create_generate_folder_tool,
+            ],
             model_id=WORKER_MODEL,
             api_key=self.api_key,
             maxsteps=30,
@@ -248,6 +266,7 @@ def setup_agents(self, crash_program_hash: Optional[str] = None):
                 execute_javascript_program_tool,
                 list_d8_flags_tool,
                 list_v8_trace_options_tool,
+                minimize_crash_flags_tool,
                 trace_v8_analysis_tool,
                 read_from_generate_folder_tool,
                 list_generate_folder_tool,
@@ -273,7 +292,10 @@ def setup_agents(self, crash_program_hash: Optional[str] = None):
                 list_v8_trace_options_tool,
                 trace_v8_analysis_tool,
                 read_from_generate_folder_tool,
+                write_to_generate_folder_tool,
+                delete_files_from_generate_folder_tool,
                 list_generate_folder_tool,
+                create_generate_folder_tool,
             ],
             model_id=MANAGER_MODEL,
             api_key=self.api_key,
@@ -293,7 +315,7 @@ def setup_agents(self, crash_program_hash: Optional[str] = None):
             prompt=root_manager_prompt,
             system_prompt="You are RootManager.",
             tools=[],
-            model_id=MANAGER_MODEL,
+            model_id=ROOT_MODEL,
             api_key=self.api_key,
             subagents=root_managed,
             maxsteps=30,
@@ -328,8 +350,9 @@ def start_system(self):
 def main():
     parser = argparse.ArgumentParser(description="Run EBG Crash system for a specific crash program hash")
     parser.add_argument("--crash_program_hash", required=False, help="Program hash for the crashing corpus entry")
+    parser.add_argument("--debug", action="store_true", default=True, help="Enable debug logging (default: on)")
+    parser.add_argument("--no-debug", dest="debug", action="store_false", help="Disable debug logging")
     args = parser.parse_args()
-    args.debug = True
 
     if args.debug:
         log_path = configure_process_logging("ebg_crash", "EBG_crash", logger=logger)

Sources/Agentic_System/agents/EBG_plateau.py

@@ -72,8 +72,9 @@
 import logging
 from agent_logging import configure_process_logging
 
-MANAGER_MODEL = os.environ.get("EBG_MANAGER_MODEL", "gpt-5.4")
-WORKER_MODEL = os.environ.get("EBG_WORKER_MODEL", "gpt-5-mini")
+MANAGER_MODEL = os.environ.get("EBG_MANAGER_MODEL", "gpt-5.4-mini")
+WORKER_MODEL = os.environ.get("EBG_WORKER_MODEL", "gpt-5.4-mini")
+ROOT_MODEL = os.environ.get("EBG_ROOT_MODEL", "gpt-5.4")
 TOKENS = 30000 # 10k max output in an given message
 
 FUZZILLI_PATH = os.environ.get("FUZZILLI_PATH", str(Path(__file__).resolve().parents[3]))
@@ -108,6 +109,7 @@ def setup_agents(self, fuzzer_id: Optional[str] = None):
 
         worker_model = self.model_id if "/" in self.model_id else WORKER_MODEL
         manager_model = self.model_id if "/" in self.model_id else MANAGER_MODEL
+        root_model = self.model_id if "/" in self.model_id else ROOT_MODEL
 
         self.agents['v8_search'] = IkaBaseAgent(
             name="V8Search",
@@ -314,7 +316,7 @@ def setup_agents(self, fuzzer_id: Optional[str] = None):
             prompt=root_manager_prompt,
             system_prompt="You are RootManager.",
             tools=[],
-            model_id=manager_model,
+            model_id=root_model,
             api_key=self.api_key,
             subagents=root_managed,
             maxsteps=60,

Sources/Agentic_System/agents/FoG.py

@@ -69,7 +69,8 @@
 sys.path.append(str(Path(__file__).parent.parent))
 
 WORKER_MODEL = os.environ.get("FOG_WORKER_MODEL", "gpt-5.4-mini")
-MANAGER_MODEL = os.environ.get("FOG_MANAGER_MODEL", "gpt-5.4")
+MANAGER_MODEL = os.environ.get("FOG_MANAGER_MODEL", "gpt-5.4-mini")
+ROOT_MODEL = os.environ.get("FOG_ROOT_MODEL", "gpt-5.4")
 logger = logging.getLogger("fog")
 if not logger.handlers:
     logger.addHandler(logging.NullHandler())
@@ -295,7 +296,7 @@ def setup_agents(self):
                 search_chromium_issues_rag_tool,
                 search_chromium_issues_rag_hybrid_tool,
             ],
-            model_id=MANAGER_MODEL,
+            model_id=ROOT_MODEL,
             api_key=self.api_key,
             subagents=[self.agents['code_analyzer'], self.agents['program_builder'], self.agents['pick_section']],
             maxsteps=30,

Sources/Agentic_System/prompts/EBG-crash-prompts/JS_generator.txt

@@ -11,6 +11,8 @@ YOUR SOLE RESPONSIBILITY IS TO GENERATE THE VARIANT PROGRAMS, STORE THEM IN THE
 - NEVER SKIP STAGES IF YOU DO THIS IS A CRITICAL FAILURE!
 
 - NEVER REQUEST CHOICES FROM THE USER, YOU ARE AN AGENTIC SYSTEM AND MUST NOT RELY ON OUTSIDE INPUT
+- EVERY GENERATED VARIANT MUST BE MATERIALIZED AS A REAL FILE BEFORE YOU RETURN
+- NEVER CLAIM A VARIANT WAS STORED IF YOU DID NOT ACTUALLY CALL THE STORAGE TOOL
 
 ## STAGE 0
 RECEIVE AND ANALYZE THE INFORMATION PROVIDED BY YOUR MANAGING AGENT VARIANT ANALYSIS:
@@ -23,6 +25,8 @@ RECEIVE AND ANALYZE THE INFORMATION PROVIDED BY YOUR MANAGING AGENT VARIANT ANAL
 
 4. **FUZZER_ID**: Your managing agent will provide the fuzzer instance ID to associate the stored variants with.
 
+If a `FUZZER_ID` is NOT explicitly provided but you are given a crash hash / base crash path, resolve the target fuzzer id yourself before storage by using `db_query` / available DB context. Do not skip storage solely because the manager omitted the numeric id.
+
 UNDERSTAND:
 - The original crash PoC and how it currently works
 - The variant code paths that need to be targeted
@@ -48,8 +52,22 @@ GENERATE THE VARIANT PoC BASED ON THE PROVIDED INFORMATION FROM YOUR MANAGING AG
     - Incorporates the corresponding code block appropriately (if provided)
     - Maintains crash-inducing characteristics while adapting to new paths
 
-**STEP 2: STORE THE VARIANT IN THE DATABASE**
-Once you have generated the variant JavaScript program, use the `db_store_generated_program` tool to store it in the fuzzer table corpus.
+**STEP 2: MATERIALIZE THE VARIANT AS A FILE**
+Before returning any variant, you MUST:
+- ensure a generate folder exists with `create_generate_folder`
+- save each generated variant with `write_to_generate_folder`
+- capture the exact `file_path` returned by the tool
+
+If you do not have a concrete `file_path`, the variant is not ready for validation or storage.
+
+**STEP 3: OPTIONAL SANITY VALIDATION**
+Before storing, prefer at least one lightweight execution/trace attempt against the exact generated file path:
+- use `list_d8_flags` before assuming optional flags exist
+- use `execute_javascript_program` or `trace_v8_analysis` with the exact `file_path` returned from `write_to_generate_folder`
+- if validation fails because of tooling or environment issues, report that explicitly instead of pretending the file exists
+
+**STEP 4: STORE THE VARIANT IN THE DATABASE**
+Once you have generated the variant JavaScript program and materialized it as a file, use the `db_store_generated_program` tool to store it in the fuzzer table corpus.
 
 THE `db_store_generated_program` TOOL TAKES:
 - `js_program`: The generated JavaScript variant program (as a string)
@@ -73,6 +91,10 @@ IF THE TOOL RETURNS AN ERROR, ANALYZE WHY AND ADJUST YOUR APPROACH. ENSURE THE G
 RETURN THE STORED VARIANTS TO YOUR MANAGING AGENT.
 
 PROVIDE A CLEAR SUMMARY OF ALL GENERATED AND STORED VARIANTS.
+EVERY VARIANT ENTRY MUST STATE WHETHER IT WAS:
+- materialized to a concrete file
+- sanity-checked with execution/trace
+- stored successfully in the database
 
 USE THE FOLLOWING JSON FORMAT:
 {
@@ -81,9 +103,18 @@ USE THE FOLLOWING JSON FORMAT:
     "VARIANTS": [
         {
             "program_id": [program ID from db_store_generated_program response],
+            "file_name": "[name written via write_to_generate_folder]",
+            "file_path": "[exact file_path returned by write_to_generate_folder]",
             "js_code": "[The generated JavaScript variant code]",
             "targeted_path": "[The code path this variant targets]",
-            "code_block_used": "[The code block used for this variant, if provided]"
+            "code_block_used": "[The code block used for this variant, if provided]",
+            "validation": {
+                "attempted": [true/false],
+                "tool": "[execute_javascript_program or trace_v8_analysis or null]",
+                "flags_used": "[flags used or null]",
+                "return_code": "[return code or null]",
+                "evidence": "[short stderr/stdout evidence or null]"
+            }
         },
         ...
     ],