Sprint Oct 15th-28th - cleveragents - Gitea: Git with a cup of tea

Sprint Oct 15th-28th

1

Uncategorized

Security issues in CleverAgents...

cleveragents/cleveragents-core#7 by brent.edwards was closed 2026-02-22 22:28:49 +00:00

fix(strategize): propagate actor options (openai_api_base, openai_api_key) to LLM client creation in Strategize/Execute paths #11257

feat(tui): implement TuiMaterializer bridging A2A event queue to Output Rendering Framework #11241

refactor: extract actor + langgraph + templates into the new cleveractors library #11239

fix(acms): harden hot/warm/cold tier service reliability #11238

fix(lsp): wrap post-Popen init in cleanup guard to prevent orphaned processes #11237

fix(tui): rename ActorSelectionOverlay._render to _refresh_display #11201

fix(v3.7.0): resolve issue #1500 - actor add --update flag enforcement #11178

reflector(a2a): execute ACP to A2A module rename and symbol standardization #11165

TDD: Add test for timer firing after cancellation in McpClient #11159

fix(Python 3.13): replace deprecated asyncio.get_event_loop() and datetime.utcnow() calls #11156

fix(agents/graphs/auto_debug): return update dicts from node functions instead of mutating state in-place #11155

feat: implement structural component output validation #11147

fix(plan-executor): persist strategy decisions during Strategize phase #11138

fix(cli): add spec-required --data-dir, --config-path, and -v global options to main_callback #11122

chore: fix CI pipeline flakiness by stabilizing test fixtures and assertions #11119

feat(a2a): implement server-mode HTTP transport for A2A agent communication #11113

fix(a2a): implement A2A stdio transport (local mode) #11105

fix(cleanup): invalidate sandbox_dirs_cache after purge (#7527) #11091

fix(cli): remove positional NAME from agents actor add — read name from YAML file #11065

feat(plans): implement plan correct --mode=revert and --mode=append correction engine #11061

fix(cli): fix invariant add scope handling #11058

fix(tui): rename ActorSelectionOverlay._render to _refresh_display to avoid shadowing Textual Widget._render #11042

fix(actor): move namespace filter inside lock in ActorLoader.list_actors (#8660) #11038

ci(pipeline): guard integration/e2e jobs when LLM secrets unavailable #10996

[FIX] fix: isolate CheckpointRepository prune test to dedicated plan (#8853) #10978

test(core): add comprehensive test levels for async_cleanup module #10958

fix(actor): Get responses from actor-run #10900

Fix race condition in McpClient.start() double initialization #10892

fix(cli/session): emit JSON envelope in session delete for non-rich formats #10888

docs(timeline): update timeline with milestone progress for 2026-04-16 [AUTO-TIME-1] #10868

docs(timeline): verify timeline status for 2026-04-16 Cycle 2 [AUTO-TIME-3] #10855

feat(server): LangGraph Platform RemoteGraph integration #10792

feat(acms): design and implement ACMS index data model with file metadata, tags, and tier assignment #10788

refactor: route CLI→Application communication through A2A boundary #10787

feat(resources): design and implement resource type extension interface #10784

feat(acms): implement hot storage tier as in-memory LRU cache with configurable capacity #10783

feat(acms): implement context show and context clear CLI commands #10780

feat(context): implement PriorityContextStrategy with configurable priority scoring #10772

test(providers): add failing BDD scenario for get_provider_registry() thread-safety race condition #10754

fix(tui): convert PermissionsScreen from Static widget to proper Textual Screen subclass #10744

feat(context): integrate custom scope resolvers into ContextAssembler pipeline #10672

test(context): add integration tests for advanced context strategies #10671

test(a2a): add regression tests to verify zero acp references after module rename #10668

refactor: unify service initialization and dependency injection #10657

refactor: unify API naming conventions and method signatures #10654

fix(lsp): add per-message read timeout to prevent DoS in _read_message() #10650

fix(lsp): validate workspace boundary in _read_file to prevent path traversal #10644

fix(tui): run shell commands asynchronously to prevent event loop blocking #10638

feat(tui): complete v3.7.0 TUI milestone with PersonaRegistry and web mode #10637

fix(scripts): prevent command injection in check-quality-gates.py #10635

fix(lsp): prevent resource exhaustion DoS in language discovery directory traversal #10632

feat(tui): implement PersonaRegistry with YAML persistence and cycle_persona() method [RETRY] #10630

refactor: address critical TODO/FIXME comments in codebase #10629

fix(lsp): sanitize environment variables in LSP server process creation #10625

feat(plugins): implement agents plugin CLI subcommand group and built-in plugin discovery #10621

feat(context): implement adaptive context strategy selector and fusion #10619

test(e2e): implement E2E workflow tests for project creation, plan execution, and correction #10614

feat(resources): implement virtual resource type base class for abstract/computed resources #10605

feat(plugins): implement plugin architecture extension points with documentation #10594

feat(llm): refactor LLMProvider abstraction to support pluggable backends #10587

feat(governance): implement cost and session budget tracking and enforcement #10586

[AUTO-TIME-1] Update timeline: schedule adherence 2026-04-17 #10262

docs(timeline): [AUTO-TIME-1] Day 105 timeline update — 2026-04-15 #9881

fix(cli): wrap plan apply --format json output in spec-required JSON envelope #9817

[AUTO-DOCS-2] docs: Add v3.2.0 and v3.3.0 feature documentation (conflict-resolved) #9796

feat(acms): implement budget enforcement for max_file_size and max_total_size constraints #9673

feat(acms): implement context policy configuration loader and plan execution ACMS integration #9671

feat(cli): implement plan rollback CLI command for checkpoint-based plan state restoration #9612

feat(plans): implement configurable merge strategy (prefer-parent, prefer-subplan, manual) - Closes #9559 #9610

feat(plans): implement parallel subplan execution scheduler with max_parallel concurrency control #9609

feat(plans): implement ThreeWayMergeEngine for subplan result integration #9608

test(langgraph): Add missing PureGraph BDD and integration coverage #9601

feat(plans): implement plan correct --mode=revert and --mode=append correction engine #9599

fix(cli): add timing.started ISO timestamp to plan prompt JSON envelope #9447

fix(database): include alembic files in package distribution #9408

fix(acms): consolidate StrategyCapabilities to single domain model with spec-compliant fields #9329

fix(application): Remove error suppression in reactive_registry_adapter.py #9247

[AUTO-ARCH-14] docs(spec): clarify Anonymous Tool enforcement rules in glossary #9241

fix(agents): validate file paths in ContextAnalysisAgent._load_files to prevent path traversal #9229

fix(plan): include validation_summary and apply_summary in plan artifacts JSON output #9227

refactor(tests): clarify roles of behave and robot framework in test architecture #9219

docs(spec): document context_tier_hydrator module in ACMS architecture section #9208

fix(plan): include decision_id field in plan tree JSON output #9193

[TEST-INFRA] Add automated validation for CLI docstring examples #9186

test-infra: Add Semgrep guard for broad exception suppression #9185

[BUG] Add required @a2a, @session, @cli tags to BDD feature files #9183

fix(action): add default value type validation to ActionArgumentSchema #9178

fix(tui): restore LoadingThrobber widget and tui_throbber integration tests #8873

spec: Subplan System — spawning, parallel execution, parent tracking (v3.3.0) [AUTO-ARCH-6] #8733

feat(decisions): verify agents plan tree CLI command implementation #8691

feat(invariants): implement agents invariant remove CLI command #8686

fix(cli): add agents project switch command to project CLI #8675

test(plan-tree): add failing BDD scenario proving corrected nodes not visually marked #8671

fix(cli): add agents validation list command to validation CLI #8667

fix(cli): add agents plan start alias or update spec to reflect v3 plan use/execute commands #8661

fix(actor): move namespace filter inside lock in ActorLoader.list_actors #8660

feat(resource): add --clone-into to container-instance and fix devcontainer-instance sandbox strategy #8304

fix(plan-lifecycle): gate Apply phase on Definition-of-Done evaluation #8299

refactor: replace custom behave-parallel and pabot arg parsing in noxfile.py with standard libraries #8285

fix(engine_cache): guard MEMORY_ENGINES with lock to prevent TOCTOU race #8265

Fix changeset_repository.py get_for_plan to preserve per-changeset granularity #8194

chore(agents): add Type/Automation label and milestone assignment to agent-evolver improvement PRs #7922

docs: architecture — add Provider Registry and TUI Materializer spec sections; fix anchor mismatches #7839

Fix stdout restoration for concurrent validation pipelines #7811

fix(cli): allow global format flag after subcommands #7395

fix(plan): abort git merge on conflict and restore clean repo state #7251

feat(tests): replace all @skip tags with proper @tdd_expected_fail tags or remove them across the entire codebase #7221

docs(spec): add v3.8.0 Server Implementation milestone plan #6945

fix(resource): trigger auto-discovery when adding resource #6745

fix(cli): fix JSON/YAML envelope messages[].text to show actual content #6739

fix(cli): fix session tell output to return spec-required structured response #6729

fix(cli): fix session create JSON output data structure to match spec #6723

feat(tui): implement escape cascade key behavior #6684

feat(session): implement conversation content pruning #6628

fix(cli): fix project context set JSON/YAML output structure #6626

feat(cli): add actor context show command #6622

fix(cli): add --url flag to resource add for git resource type #6621

chore(agents): fix uat-tester parallel docs PR merge conflicts #5768

docs: document 2026-04-06 to 2026-04-08 agent system improvements #4830

docs: architecture — add Milestone Plan section to specification #4805

docs: add InvariantReconciliationActor API docs, devcontainer discovery module guide, and mkdocs nav #4381

docs: add showcase example for audit log and security commands #4221

UAT: `ProjectService` uses legacy `Project` model instead of spec-aligned `NamespacedProject` — `ProjectRepositoryProtocol` is disconnected from service layer #3900

chore(agents): fix ca-test-infra-improver — reduce health comment spam on session state issue #3551

chore(agents): fix ca-architecture-guard clone failure and self-issue-filing #3480

fix(config): remove undocumented LOCAL scope from ConfigLevel/ConfigScope enums and resolve() chain #3466

fix(providers): export dedicated LLM provider classes from providers/llm/__init__.py #3454

fix(a2a): wire _cleveragents/plan/execute handler to full PlanExecutor lifecycle #3353

fix(invariant): add action_name param to get_effective_invariants() — include action-scoped invariants in 4-tier merge #3329

fix(cli): implement spec-required panels in agents plan apply rich output #3309

fix(resources): remove unsupported executable resource type #3248

fix(action/schema): correct validate_name error message to say "valid Python identifier" and remove "or hyphens" claim #3243

fix(cli): fix format_output() to use rich and color renderers instead of JSON fallback #3227

fix(cli): add structured panels to plan cancel output #1473 #1510

fix(cli): handle skill: wrapper key in agents skill add YAML config #1472 #1506

fix(v3.7.0): ResourceHandler return type #1444 #1486

fix(tui): PermissionsScreen diff mode cycle uses split/auto per spec #1449 #1480

feat(tui): implement Textual MainScreen with sidebar states and Dracula theme #1302

fix(audit): forward DomainEvent.timestamp to AuditService.record() #1258

feat(cli): implement RendererRegistry and ElementRenderer architecture per spec #1193

fix(events): log full exception details in ReactiveEventBus.emit() error handler #1174

feat(server): team collaboration features #1126

feat(server): entity sync (_cleveragents/sync/*) #1125

feat(a2a): Agent Card discovery endpoint #1123

feat(server): container/devcontainer support lifecycle #1121

feat(server): implement PostgreSQL storage backend for server mode #1118

fix(db): align v3_plans schema with specification DDL #1074

test(cli): add regression-guard tests for Container.resolve() crash #1053

test: add TDD bug-capture test for #967 — plan execute phase processing #1050

feat(ci): enforce tdd_issue tag consistency via commit-history and Forgejo issue-status checks #1017

test(e2e): workflow example 17 — explicit container with directory mount (trusted profile) #819

test(e2e): workflow example 5 — database schema migration with safety nets (review profile) #816

test(e2e): workflow example 4 — multi-project dependency update (supervised profile) #815

test(e2e): workflow example 15 — disaster recovery, rollback a failed apply (trusted profile) #802

refactor(test): replace deprecated tempfile.mktemp() with tempfile.mkstemp() #736

feat(validation): implement Fix-then-Revalidate orchestration loop for required validations #711

feat(resource): add virtual resource equivalence tracking #664

feat(acms): implement UKO Layer 3 Technology Vocabularies (uko-py, uko-ts, uko-rs, uko-java) #660

feat(acms): implement Temporal Data Model (Revision-Aware RDF) with 3 storage tiers #615

feat(async): wire retry policies into services #614

feat(acms): implement Real-time Index Sync / UKOIndexer with pluggable analyzers #612

fix(security): close async resources and leaks #435

fix: add context isolation in CompositeAgent using deepcopy #37

fix: replace silent exception swallowing with proper logging #36

fix: fix deadlock in AgentWithMemory with reentrant lock implementation #35

fix: replace yaml.dump() with yaml.safe_dump() to prevent serialization of malicious objects #34

fix/server-side-request-forgery-security-fix #33

fix/file-system-security #32

fix/template-injection-fix #31

fix/data-injection-fix #30