chore(symexec): CI fixes + rebase plumbing + import hygiene

- fmt/clippy/rustdoc fixes: const fn on BranchTrace::{len,is_empty},
  allow too_many_arguments on SymBackend::propose, drop redundant clones
  in regression tests, fix broken intra-doc link, wrap SaferMaker URL
- demote 'pub mod symexec' to 'pub(crate)' (private_interfaces lint)
  and trim re-exports to the surface actually used by the crate
- propagate new CallDetails.value (introduced upstream in #14482)
  through the heuristic ABI rewrite
- hoist fully-qualified inline imports (crate::executors::symexec::*,
  crate::inspectors::BranchTrace, alloy_primitives::U256::ZERO,
  std::time::*, foundry_common::fs::write_json_file, std::fs::*) to
  top-of-file 'use' blocks across our diff
- drop unused MAX_SEEDS_PER_CYCLE constant

Amp-Thread-ID: https://ampcode.com/threads/T-019e2bc9-ece8-718f-9279-971e3e982bec
Co-authored-by: Amp <amp@ampcode.com>

Author: figtracer

crates/evm/evm/src/executors/corpus.rs

@@ -34,7 +34,7 @@
 //! - This all happens periodically, there is no clear order in which workers export or import
 //!   entries since it doesn't matter as long as the corpus eventually syncs across all workers
 
-use crate::executors::{Executor, RawCallResult, invariant::execute_tx};
+use crate::executors::{Executor, RawCallResult, invariant::execute_tx, symexec::SeedSnapshot};
 use alloy_dyn_abi::JsonAbiExt;
 use alloy_json_abi::Function;
 use alloy_primitives::{Bytes, I256};
@@ -1138,13 +1138,13 @@ impl WorkerCorpus {
     /// Snapshot a small candidate pool of seeds for symbolic-assist seed
     /// scoring. Returns at most `MAX` entries (kept tiny so scoring stays
     /// cheap).
-    pub fn symexec_seed_pool(&self) -> Vec<crate::executors::symexec::SeedSnapshot> {
+    pub fn symexec_seed_pool(&self) -> Vec<SeedSnapshot> {
         const MAX: usize = 16;
         self.in_memory_corpus
             .iter()
             .rev()
             .take(MAX)
-            .map(|e| crate::executors::symexec::SeedSnapshot {
+            .map(|e| SeedSnapshot {
                 uuid: e.uuid,
                 tx_seq: e.tx_seq.clone(),
                 is_favored: e.is_favored,

crates/evm/evm/src/executors/fuzz/mod.rs

@@ -511,8 +511,7 @@ impl<FEN: FoundryEvmNetwork> FuzzedExecutor<FEN> {
         // that flip an unseen branch, validates them via normal coverage,
         // and writes accepted candidates into its own `sync/` directory so
         // the existing corpus protocol distributes them.
-        let symexec_active =
-            worker_id == 0 && self.config.corpus.symexec_assist_active();
+        let symexec_active = worker_id == 0 && self.config.corpus.symexec_assist_active();
         let symexec_interval = self.config.corpus.symexec_assist_interval.max(1);
         let mut runs_since_symexec: u32 = 0;
         let mut symexec_state = SymExecState::default();

crates/evm/evm/src/executors/mod.rs

@@ -7,7 +7,7 @@
 // the concrete `Executor` type.
 
 use crate::inspectors::{
-    Cheatcodes, InspectorData, InspectorStack, cheatcodes::BroadcastableTransactions,
+    BranchTrace, Cheatcodes, InspectorData, InspectorStack, cheatcodes::BroadcastableTransactions,
 };
 use alloy_dyn_abi::{DynSolValue, FunctionExt, JsonAbiExt};
 use alloy_json_abi::Function;
@@ -63,7 +63,7 @@ pub use invariant::InvariantExecutor;
 
 mod corpus;
 mod sancov;
-pub mod symexec;
+pub(crate) mod symexec;
 mod trace;
 
 pub use trace::TracingExecutor;
@@ -985,7 +985,7 @@ pub struct RawCallResult<FEN: FoundryEvmNetwork = EthEvmNetwork> {
     /// The edge coverage info collected during the call
     pub edge_coverage: Option<Vec<u8>>,
     /// Branch observations collected by the symbolic-assist worker.
-    pub branch_trace: Option<crate::inspectors::BranchTrace>,
+    pub branch_trace: Option<BranchTrace>,
     /// Sancov edge coverage from instrumented native Rust crates (e.g. precompiles).
     /// Tracked separately from EVM edge coverage to avoid ID-space collisions.
     pub sancov_coverage: Option<Vec<u8>>,

crates/evm/evm/src/executors/symexec/mod.rs

@@ -2,20 +2,20 @@
 //!
 //! Implements the *worker-side* of the architectural plan inspired by
 //! Echidna's `Echidna.SymExec.Exploration` and the SaferMaker writeup at
-//! https://hackmd.io/@SaferMaker/EVM-Sym-Exec.
+//! <https://hackmd.io/@SaferMaker/EVM-Sym-Exec>.
 //!
 //! It is *not* a full symbolic-execution engine; it is a directed mutation
 //! assistant that:
 //!
 //! 1. takes a corpus seed (`Vec<BasicTxDetails>`),
 //! 2. replays it concretely under a [`crate::inspectors::BranchTraceInspector`],
 //! 3. picks the deepest *unseen* opposite-side branch as the "frontier",
-//! 4. proposes ABI-aware calldata rewrites that — given the recovered
-//!    compare operands — would flip the frontier branch,
-//! 5. validates each candidate through the normal executor (requiring a real
-//!    new edge in coverage), and
-//! 6. writes accepted candidates to the master worker's `sync/` directory so
-//!    the existing corpus protocol distributes them.
+//! 4. proposes ABI-aware calldata rewrites that — given the recovered compare operands — would flip
+//!    the frontier branch,
+//! 5. validates each candidate through the normal executor (requiring a real new edge in coverage),
+//!    and
+//! 6. writes accepted candidates to the master worker's `sync/` directory so the existing corpus
+//!    protocol distributes them.
 //!
 //! v1 is intentionally minimal:
 //! - master worker only,
@@ -29,28 +29,32 @@ use crate::{
     inspectors::BranchTrace,
 };
 use alloy_json_abi::Function;
-use alloy_primitives::{B256, keccak256, map::DefaultHashBuilder};
+use alloy_primitives::{B256, U256, keccak256, map::DefaultHashBuilder};
 use eyre::Result;
+use foundry_common::fs::write_json_file;
 use foundry_evm_core::evm::FoundryEvmNetwork;
 use foundry_evm_fuzz::{BasicTxDetails, invariant::FuzzRunIdentifiedContracts};
-use std::path::Path;
+use std::{
+    path::Path,
+    time::{SystemTime, UNIX_EPOCH},
+};
 
 mod mutate;
 mod select;
 mod types;
 
-pub use mutate::propose_calldata_rewrites;
-pub use select::{SeedSnapshot, pick_frontier, pick_seed, score_seed, unseen_in_history};
-pub use types::{
-    Candidate, FrontierKey, FrontierStats, MAX_CANDIDATES_PER_FRONTIER, MAX_FRONTIER_ATTEMPTS,
-    MAX_SEEDS_PER_CYCLE, SymExecState,
-};
+use mutate::propose_calldata_rewrites;
+pub use select::SeedSnapshot;
+use select::pick_seed;
+use types::Candidate;
+pub use types::SymExecState;
 
 /// Backend abstraction so v2 can swap the heuristic engine for a real SMT
 /// solver (or external `hevm`) without touching the assist loop.
 pub trait SymBackend {
     /// Generate candidate sequences from a seed and its branch trace.
     /// `tx_index` identifies the call to mutate (the last one, in v1).
+    #[allow(clippy::too_many_arguments)]
     fn propose(
         &self,
         seed: &[BasicTxDetails],
@@ -166,7 +170,7 @@ pub fn run_symexec_assist<FEN: FoundryEvmNetwork>(
             tx.sender,
             tx.call_details.target,
             tx.call_details.calldata.clone(),
-            alloy_primitives::U256::ZERO,
+            U256::ZERO,
         )?;
         if i == tx_index
             && let Some(t) = result.branch_trace.take()
@@ -181,9 +185,8 @@ pub fn run_symexec_assist<FEN: FoundryEvmNetwork>(
         return Ok(0);
     }
 
-    // 2. Resolve the ABI of the call slot we're allowed to mutate. For
-    //    invariant tests this is looked up from the targeted contracts;
-    //    for stateless fuzz the caller already supplied it.
+    // 2. Resolve the ABI of the call slot we're allowed to mutate. For invariant tests this is
+    //    looked up from the targeted contracts; for stateless fuzz the caller already supplied it.
     let resolved_function: Option<Function> = match (function, targeted_contracts) {
         (Some(f), _) => Some(f.clone()),
         (None, Some(targets)) => seed
@@ -251,11 +254,8 @@ fn candidate_hash(seq: &[BasicTxDetails]) -> B256 {
 /// JSON file into a worker's `sync/` directory.
 pub fn write_sync_entry(sync_dir: &Path, seq: &[BasicTxDetails]) -> Result<()> {
     let uuid = uuid::Uuid::new_v4();
-    let ts = std::time::SystemTime::now()
-        .duration_since(std::time::UNIX_EPOCH)
-        .map(|d| d.as_secs())
-        .unwrap_or(0);
+    let ts = SystemTime::now().duration_since(UNIX_EPOCH).map(|d| d.as_secs()).unwrap_or(0);
     let path = sync_dir.join(format!("{uuid}-{ts}.json"));
-    foundry_common::fs::write_json_file(&path, &seq)?;
+    write_json_file(&path, &seq)?;
     Ok(())
 }

crates/evm/evm/src/executors/symexec/mutate.rs

@@ -97,6 +97,7 @@ pub fn propose_calldata_rewrites(
                 call_details: CallDetails {
                     target: tx.call_details.target,
                     calldata: Bytes::from(new_calldata),
+                    value: tx.call_details.value,
                 },
             });
 

crates/evm/evm/src/executors/symexec/select.rs

@@ -49,11 +49,11 @@ pub fn pick_seed(candidates: &[SeedSnapshot]) -> Option<&SeedSnapshot> {
 /// Pick a frontier from a replay trace.
 ///
 /// Strategy:
-/// - prefer the *deepest* observation whose opposite edge is currently unseen
-///   (the seed already satisfies all earlier guards),
+/// - prefer the *deepest* observation whose opposite edge is currently unseen (the seed already
+///   satisfies all earlier guards),
 /// - skip frontiers that have hit `MAX_FRONTIER_ATTEMPTS`,
-/// - skip frontiers without a recoverable compare (v1 has no symbolic
-///   reasoning beyond ABI rewrites of compare operands).
+/// - skip frontiers without a recoverable compare (v1 has no symbolic reasoning beyond ABI rewrites
+///   of compare operands).
 pub fn pick_frontier<F>(
     trace: &BranchTrace,
     tx_index: u32,

crates/evm/evm/src/executors/symexec/types.rs

@@ -30,7 +30,7 @@ pub struct FrontierKey {
     pub selector: [u8; 4],
 }
 
-/// Per-frontier attempt bookkeeping, kept separately from [`super::corpus`]
+/// Per-frontier attempt bookkeeping, kept separately from the corpus
 /// stats so the symbolic worker doesn't pollute the fuzzer's counters.
 #[derive(Clone, Debug, Default)]
 pub struct FrontierStats {
@@ -46,9 +46,6 @@ pub const MAX_FRONTIER_ATTEMPTS: u16 = 3;
 /// Hard cap on candidates evaluated per frontier per cycle.
 pub const MAX_CANDIDATES_PER_FRONTIER: usize = 8;
 
-/// Hard cap on seeds processed per assist cycle.
-pub const MAX_SEEDS_PER_CYCLE: usize = 1;
-
 /// In-process state for the symbolic worker. Owned by the master worker; not
 /// persisted to disk (regenerated fresh each campaign).
 #[derive(Clone, Debug, Default)]

crates/evm/evm/src/inspectors/branch_trace.rs

@@ -121,11 +121,11 @@ impl BranchTrace {
         self.branches.clear();
     }
 
-    pub fn len(&self) -> usize {
+    pub const fn len(&self) -> usize {
         self.branches.len()
     }
 
-    pub fn is_empty(&self) -> bool {
+    pub const fn is_empty(&self) -> bool {
         self.branches.is_empty()
     }
 }

crates/forge/tests/cli/test_cmd/fuzz.rs

@@ -2,6 +2,7 @@ use alloy_primitives::U256;
 use foundry_evm::fuzz::BaseCounterExample;
 use foundry_test_utils::{TestCommand, forgetest_init, str};
 use regex::Regex;
+use std::fs::{read_dir, read_to_string};
 
 forgetest_init!(test_can_scrape_bytecode, |prj, cmd| {
     prj.update_config(|config| config.optimizer = Some(true));
@@ -1068,18 +1069,15 @@ contract SymExecAssistTest is Test {
     cmd.args(["test", "--mt", "testFuzz_FindMagic"]).assert_success();
 
     // Master corpus directory: `<corpus_dir>/<contract>/<test>/worker0/corpus/`.
-    let corpus_root = prj
-        .root()
-        .join("symexec_corpus")
-        .join("SymExecAssistTest")
-        .join("testFuzz_FindMagic");
+    let corpus_root =
+        prj.root().join("symexec_corpus").join("SymExecAssistTest").join("testFuzz_FindMagic");
     let master_corpus = corpus_root.join("worker0").join("corpus");
     let master_sync = corpus_root.join("worker0").join("sync");
 
     let magic_hex = "deadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeef";
 
-    let mut search_dirs = vec![master_corpus.clone(), master_sync.clone()];
-    if let Ok(entries) = std::fs::read_dir(&corpus_root) {
+    let mut search_dirs = vec![master_corpus, master_sync];
+    if let Ok(entries) = read_dir(&corpus_root) {
         for entry in entries.flatten() {
             let p = entry.path();
             if p.is_dir() {
@@ -1091,13 +1089,13 @@ contract SymExecAssistTest is Test {
 
     let mut found = false;
     'outer: for dir in &search_dirs {
-        let Ok(entries) = std::fs::read_dir(dir) else { continue };
+        let Ok(entries) = read_dir(dir) else { continue };
         for entry in entries.flatten() {
             let path = entry.path();
             if !path.is_file() {
                 continue;
             }
-            let Ok(contents) = std::fs::read_to_string(&path) else { continue };
+            let Ok(contents) = read_to_string(&path) else { continue };
             if contents.to_ascii_lowercase().contains(magic_hex) {
                 found = true;
                 break 'outer;

crates/forge/tests/cli/test_cmd/invariant/mod.rs

@@ -1,5 +1,6 @@
 use alloy_primitives::U256;
 use foundry_test_utils::{TestCommand, forgetest_init, snapbox::cmd::OutputAssert, str};
+use std::fs::{read_dir, read_to_string};
 
 mod common;
 mod handler;
@@ -1919,11 +1920,9 @@ contract SymExecAssistInvariantTest is Test {
 
     let magic_hex = "deadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeef";
 
-    let mut search_dirs = vec![
-        corpus_root.join("worker0").join("corpus"),
-        corpus_root.join("worker0").join("sync"),
-    ];
-    if let Ok(entries) = std::fs::read_dir(&corpus_root) {
+    let mut search_dirs =
+        vec![corpus_root.join("worker0").join("corpus"), corpus_root.join("worker0").join("sync")];
+    if let Ok(entries) = read_dir(&corpus_root) {
         for entry in entries.flatten() {
             let p = entry.path();
             if p.is_dir() {
@@ -1935,13 +1934,13 @@ contract SymExecAssistInvariantTest is Test {
 
     let mut found = false;
     'outer: for dir in &search_dirs {
-        let Ok(entries) = std::fs::read_dir(dir) else { continue };
+        let Ok(entries) = read_dir(dir) else { continue };
         for entry in entries.flatten() {
             let path = entry.path();
             if !path.is_file() {
                 continue;
             }
-            let Ok(contents) = std::fs::read_to_string(&path) else { continue };
+            let Ok(contents) = read_to_string(&path) else { continue };
             if contents.to_ascii_lowercase().contains(magic_hex) {
                 found = true;
                 break 'outer;