fix(core): treat a cloned repository as a source-aware (white-box) scan

[samirhvbr]

Fixes #884. Supersedes #885, which no longer applies to main.

Problem

A repository target is cloned into the sandbox workspace and collected into local_sources exactly like a local_code target (collect_local_sources), but the two white-box checks only looked at type == "local_code":

• runner.py decided is_whitebox inline, so scanning a GitHub repo (alone or beside a domain) ran with is_whitebox=False: coordination/source_aware_whitebox and custom/source_aware_sast were not preloaded for the root agent, and the first is internal so it cannot be loaded on demand;
• interface/utils.py:is_whitebox_scan fed telemetry, which recorded the scan as black-box.

The docs describe this invocation as white-box testing. As the issue bisects, it regressed in 1e641e5, which replaced bool(args.local_sources) with the local_code check.

Fix

One is_whitebox_scan(targets_info) that says "source is in front of the agent": a local_code target, or a repository target that was cloned (details["cloned_repo_path"]). The runner and scan setup both use it, and the second copy is removed. A repository that was not cloned still does not count.

It lives in a new dependency-free strix/core/targets.py rather than core/inputs.py: scan_setup imports core.inputs lazily inside a function on purpose (it pulls in the agents SDK), so importing the predicate from there at module level would change that.

Tests

• tests/test_scan_targets.py: each target mix (none, web only, local directory, cloned repository, repository that was not cloned, repository beside a domain in either order, missing details).
• tests/test_runner_root_prompt.py: through the real run_strix_scan, the root agent is built with is_whitebox=True for a cloned repository and for a repository beside a domain.

On main the two repository cases of the runner test fail while the local_code and web-only controls pass; with the change everything passes. ruff, mypy and bandit are clean on the touched files and the 617 neighbouring scan-setup/CLI/runner/target/resume tests pass.

🤖 Generated with Claude Code

https://claude.ai/code/session_01TavwVMH7PvrD68JTDfd6Hb

[greptile-apps]

Confidence Score: 4/5

[Medium risk] Expands whitebox scan detection to include cloned repositories.

The PR appears safe to merge, with a non-blocking gap in telemetry test coverage.

Findings

1.  Telemetry result lacks a test ▶

Fix with agent prompt

### Issue 1
tests/test_scan_targets.py:43
The new tests check what `is_whitebox_scan` returns and what the runner passes to the agent, but neither checks what `telemetry_start` reports after cloning a repository. Add a test for that reported value. Otherwise, a later change to scan setup could label cloned-repository scans as black-box while these tests still pass.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Summary

Cloned repositories now count as white-box scans for root-agent setup and scan telemetry. The shared check still excludes repositories that were not cloned.

• Cloned repositories now count as white-box scans.

_{Reviews (1) · Last reviewed commit: "fix(core): treat a cloned repository as ..."}

[greptile-apps]

Telemetry result lacks a test

The new tests check what is_whitebox_scan returns and what the runner passes to the agent, but neither checks what telemetry_start reports after cloning a repository. Add a test for that reported value. Otherwise, a later change to scan setup could label cloned-repository scans as black-box while these tests still pass.

Knowledge Base Used: CLI launch and scan setup

Prompt To Fix With AI

This is a comment left during a code review.
Path: tests/test_scan_targets.py
Line: 43

Comment:
**Telemetry result lacks a test**

The new tests check what `is_whitebox_scan` returns and what the runner passes to the agent, but neither checks what `telemetry_start` reports after cloning a repository. Add a test for that reported value. Otherwise, a later change to scan setup could label cloned-repository scans as black-box while these tests still pass.

**Knowledge Base Used:** [CLI launch and scan setup](https://app.greptile.com/strix-org-3/-/custom-context/knowledge-base/usestrix/strix/-/docs/cli-launch-and-scan-setup.md)

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!