forked from cleveragents/cleveragents-core
HAL9000
a3094dea2b
Three implementation contracts clarified in response to security/correctness bugs surfaced by the bug hunt pool: 1. Path containment: Sandbox path validation MUST use Path.is_relative_to() not string prefix comparison. String prefix allows /tmp/sandboxmalicious to pass a /tmp/sandbox root check. Canonical implementation provided. 2. Datetime handling: All stored ISO timestamp comparisons MUST parse back to timezone-aware datetime objects before comparing. String comparison of ISO timestamps is incorrect when timezone offsets differ in format. Canonical parse_utc_ts() pattern provided. 3. Plugin protocol validation: Protocol compliance MUST be checked structurally via issubclass() — never by instantiating the plugin class. Instantiation runs __init__ side effects before the plugin is approved. These are minor clarifications (implementation contracts, not architectural changes) added to the existing Security and Extensibility sections. Refs: BUG-HUNT issues #7336 (path traversal), #7341 (datetime comparison), #7331 (plugin instantiation)