test(tools): comprehensive test suite for verify_exploit tool function (+49 tests)

[manus-use]

Summary

Comprehensive test suite for the verify_exploit tool function — the main orchestration entry point that coordinates Docker-based PoC verification (image builds, container starts, network modes, exploit execution, and cleanup).

What's tested (+49 tests)

Tool specification validation (5 tests)

• TOOL_SPEC name, description, required fields, exploit_mode enum, target_env property

Input validation (4 tests)

• Missing dockerfile_content, missing exploit_code, both missing, toolUseId preservation

Docker preflight failures (3 tests)

• DockerConnectionError with diagnosis/remediation
• Generic Docker exceptions
• Transient errors marked as retryable

Image build failures (2 tests)

• build_target exception yields build_error
• Very long build logs are truncated

Target container start failures (2 tests)

• start_target exception yields target_error with exit code
• target_env forwarded to start_target

Remote mode — wait for target (1 test)

• wait_for_target returning False yields target_error with port info

Remote mode — exploit execution (6 tests)

• Exit code 0 → "verified" with summary containing CVE/software/vuln type
• Non-zero exit code → "failed" with exit code in summary
• InterpreterNotFoundError → infra_error (not retryable)
• Transient Docker error → infra_error (retryable)
• Non-transient error → target_error
• TARGET_PORT env var passed correctly to run_exploit

Local mode — health wait (3 tests)

• Non-transient wait failure → target_error
• Transient wait failure → infra_error (retryable)
• Skips health wait when target_container is None

Local mode — exploit execution (6 tests)

• Exit code 0 → "verified"
• Non-zero exit code → "failed"
• InterpreterNotFoundError → target_error (not retryable, different from remote)
• Transient error → infra_error (retryable)
• Non-transient error → target_error
• run_local_exploit receives correct code and language

Unexpected top-level exceptions (2 tests)

• Non-transient unexpected error → target_error with "unexpected" stage
• Transient unexpected error → infra_error (retryable)

Cleanup guarantees (3 tests)

• sandbox.cleanup() called on success
• sandbox.cleanup() called on build error
• sandbox.cleanup() called on unexpected error

Default values and edge cases (5 tests)

• Default timeout (300s), custom timeout forwarded
• Default target_port (80), default exploit_mode (remote)
• None target_env becomes empty dict

Result structure validation (2 tests)

• Success result has all expected keys
• Error result has all expected keys including error object

Logging integration (2 tests)

• log_tool_output_size called on success and on error

Summary content (3 tests)

• Verified summary includes CVE ID, software name, vuln type
• Failed summary includes exit code
• Missing target_info fields default to "unknown"

Approach

• All 49 tests are fully mocked — no real Docker calls, no network access
• Tests exercise every branch in the main verify_exploit() function including both remote and local modes, all error categories (infra_error, build_error, target_error), and the full success path
• Existing helper tests in test_submit_cves_and_logger.py (_truncate_text, _result, _error_obj) are complementary — this suite tests the orchestration that USES those helpers

Test results

1207 passed, 3 deselected, 0 failures

(Baseline: 1158 + 49 new tests)

Duplicate check

Confirmed no overlap with existing open PRs:

• test(tools): comprehensive test suite for submit_cves, tool_output_logger, and verify_exploit helpers #93 (tests submit_cves/tool_output_logger/verify_exploit helpers only — _truncate_text, _result, _error_obj)
• test(tools): comprehensive test suite for code_execute module (+45 tests) #141 (code_execute tests — different module)
• test(sandbox): comprehensive test suite for docker_sandbox module (+69 tests) #143 (docker_sandbox tests — different module)
• test(sandbox): comprehensive test suite for exploit_sandbox module (+76 tests) #144 (exploit_sandbox tests — different module)
• test(tools): comprehensive test suite for track_vendor_response (+67 tests) #137 (track_vendor_response tests — different module)

No open or merged PR tests the main verify_exploit() orchestration function.