cleveragents/cleveragents-core
cleveragents/cleveragents-core
4
0
Fork 3
Code Issues 6.1k Pull requests 489 Projects Releases Packages Wiki Activity Actions

fix(security): fix validate_path startswith bypass #7478 #11097

Open
HAL9000 wants to merge 1 commit from bugfix/11077-security-escape-bypass into master
pull from: bugfix/11077-security-escape-bypass
merge into: cleveragents:master
Conversation 4 Commits 1 Files changed 6 +53 -5
HAL9000 commented 2026-05-09 14:13:17 +00:00
Owner
Copy link

Description

Hardens path traversal prevention in CleverAgents file tools by replacing
unsafe str.startswith() sandbox boundary checks with a robust
Path.relative_to() approach.

The previous implementation used str(target).startswith(str(root)) to check
if a resolved path was within a sandbox root directory. This is vulnerable
to prefix-collision bypass attacks: if the sandbox is /tmp/sandbox123,
a sibling directory /tmp/sandbox123-escape would pass the containment check
because "sandbox123-escape".startswith("sandbox123") is True.

Two functions were fixed:

  • validate_sandbox_path() in src/cleveragents/skills/builtins/file_ops.py — used by all skill-level file tools (ReadFile, WriteFile, EditFile, DeleteFile)
  • _validate_paths() in src/cleveragents/skills/inline_executor.py — used to validate file-path values in inline tool input data

Both now use the same safe Path.relative_to() approach proven effective
in file_tools.py::validate_path().

Files Modified

  1. src/cleveragents/skills/builtins/file_ops.py — Hardened validate_sandbox_path()
  2. src/cleveragents/skills/inline_executor.py — Hardened _validate_paths()
  3. CHANGELOG.md — Added security fix entry under [Unreleased]
  4. CONTRIBUTORS.md — Added contribution entry for this fix
  5. features/skill_file_ops.feature — Added BDD test for prefix collision bypass
  6. features/steps/skill_file_ops_steps.py — Added step definitions for new test

Quality Checklist

  • Code follows project coding standards
  • All public methods have argument validation
  • Static typing complete (no Any added)
  • Behave tests written/updated in features/skill_file_ops.feature
  • No security issues introduced — this PR FIXES a security issue

Related Issues

Closes #7478

Parent Epic: #8568 (cleveragents-core platform)

## Description Hardens path traversal prevention in CleverAgents file tools by replacing unsafe `str.startswith()` sandbox boundary checks with a robust `Path.relative_to()` approach. The previous implementation used `str(target).startswith(str(root))` to check if a resolved path was within a sandbox root directory. This is vulnerable to **prefix-collision bypass attacks**: if the sandbox is `/tmp/sandbox123`, a sibling directory `/tmp/sandbox123-escape` would pass the containment check because `"sandbox123-escape".startswith("sandbox123")` is `True`. Two functions were fixed: - `validate_sandbox_path()` in `src/cleveragents/skills/builtins/file_ops.py` — used by all skill-level file tools (ReadFile, WriteFile, EditFile, DeleteFile) - `_validate_paths()` in `src/cleveragents/skills/inline_executor.py` — used to validate file-path values in inline tool input data Both now use the same safe `Path.relative_to()` approach proven effective in `file_tools.py::validate_path()`. ## Files Modified 1. `src/cleveragents/skills/builtins/file_ops.py` — Hardened `validate_sandbox_path()` 2. `src/cleveragents/skills/inline_executor.py` — Hardened `_validate_paths()` 3. `CHANGELOG.md` — Added security fix entry under [Unreleased] 4. `CONTRIBUTORS.md` — Added contribution entry for this fix 5. `features/skill_file_ops.feature` — Added BDD test for prefix collision bypass 6. `features/steps/skill_file_ops_steps.py` — Added step definitions for new test ## Quality Checklist - [x] Code follows project coding standards - [x] All public methods have argument validation - [x] Static typing complete (no `Any` added) - [x] Behave tests written/updated in `features/skill_file_ops.feature` - [x] No security issues introduced — this PR FIXES a security issue ## Related Issues Closes #7478 Parent Epic: #8568 (cleveragents-core platform)
fix(security): fix validate_path startswith bypass #7478
Some checks failed
CI / benchmark-publish (pull_request) Has been skipped
Details
CI / push-validation (pull_request) Successful in 59s
Details
CI / helm (pull_request) Successful in 1m14s
Details
CI / build (pull_request) Successful in 1m20s
Details
CI / lint (pull_request) Failing after 1m26s
Details
CI / e2e_tests (pull_request) Failing after 1m50s
Details
CI / benchmark-regression (pull_request) Failing after 1m48s
Details
CI / integration_tests (pull_request) Failing after 1m56s
Details
CI / quality (pull_request) Successful in 1m59s
Details
CI / security (pull_request) Failing after 2m1s
Details
CI / unit_tests (pull_request) Failing after 2m15s
Details
CI / typecheck (pull_request) Failing after 2m32s
Details
CI / coverage (pull_request) Has been skipped
Details
CI / docker (pull_request) Has been skipped
Details
CI / status-check (pull_request) Failing after 6s
Details
45957ab18e 
Hardened path traversal checks in file_ops.py and inline_executor.py to use Path.relative_to() instead of str.startswith(). The previous approach was vulnerable to prefix-collision attacks where a sibling directory like /tmp/sandbox123-escape would incorrectly pass containment checks against a /tmp/sandbox123 sandbox root.

ISSUES CLOSED: #7478
HAL9001 requested changes 2026-05-09 17:52:12 +00:00
HAL9001 left a comment
Copy link

First Review — fix(security): fix validate_path startswith bypass #7478

Summary

The security fix itself is conceptually correct: replacing str(target).startswith(str(root)) with Path.relative_to() is the right approach and matches the already-safe pattern used in file_tools.py. The file_ops.py fix is clean and correct. However, there are blocking issues that must be resolved before this PR can be merged, including a critical syntax error that is causing the majority of CI failures.

CI Status

CI is failing with 7 failing checks:

  • CI / lint — FAILING (syntax error in inline_executor.py)
  • CI / typecheck — FAILING (same syntax error)
  • CI / unit_tests — FAILING (same syntax error prevents import)
  • CI / integration_tests — FAILING (same syntax error)
  • CI / e2e_tests — FAILING (same syntax error)
  • CI / security — FAILING
  • CI / benchmark-regression — FAILING

The root cause of most failures is a Python syntax error described below. All CI gates must pass before this PR can be approved.

Blocking Issues

1. CRITICAL — Python Syntax Error in inline_executor.py

The fix introduces return (...) from exc on the inner exception handler. from chaining is only valid with raise statements, not return statements. This is a Python SyntaxError that prevents the module from being imported entirely, which cascades to cause the lint, typecheck, unit test, integration test, and e2e test failures.

Fix: Change return (...) from exc to simply return (...). The error context is already captured in the return string — there is no need to chain exceptions here since we are returning a string, not raising.

2. BLOCKING — AND (uppercase) is invalid Gherkin in features/skill_file_ops.feature

Line 191 uses AND (all-caps) instead of And. Gherkin step keywords are case-sensitive: valid continuations are And, But, or *. AND is not a recognised keyword and will cause a Behave step-definition parse failure.

Fix: Change AND the skill tool error should mention "traversal" to And the skill tool error should mention "traversal".

3. BLOCKING — Missing @tdd_expected_fail tag (TDD workflow violation)

The new scenario at line 185–191 uses @tdd_issue @tdd_issue_7478 but is missing the @tdd_expected_fail tag. Per the TDD bug-fix workflow, the regression test scenario must be submitted in a Type/Testing PR first with @tdd_issue, @tdd_issue_7478, and @tdd_expected_fail tags (proving the bug exists and the test fails). The fix PR (this one) then removes @tdd_expected_fail to graduate the test from expected-fail to passing. Submitting the test for the first time in the fix PR — without the TDD-only PR history and without the @tdd_expected_fail tag ever having been present — skips the required TDD workflow. The TDD issue (#11077) was created, but the test-only PR was never merged with the expected-fail tag. Please align with the contributing workflow: either (a) confirm a preceding TDD PR was merged with the proper tags and this PR correctly removes @tdd_expected_fail, or (b) add @tdd_expected_fail to this commit and create a separate fix commit that removes it, so the git history shows the proper TDD lifecycle.

4. BLOCKING — Missing milestone on PR

The PR has no milestone set. Issue #7478 is assigned to milestone v3.5.0. The PR must be assigned to the same milestone per contributing guidelines.

5. BLOCKING — Incorrect/non-standard Type/ label

The PR has label type/security (lowercase type). The repo uses title-cased Type/ labels: Type/Bugfix, Type/Fix, Type/Feature. This PR should have Type/Fix (or Type/Bugfix) — exactly one Type/ label is required per contributing guidelines. Please remove type/security and add the appropriate Type/ label.

Non-Blocking Observations

A. CHANGELOG typo: buildins → builtins

The CHANGELOG entry on line 17 reads skills/buildins/file_ops.py — this is a typo (should be builtins). Not a blocker but should be corrected.

B. CONTRIBUTORS.md references wrong PR number

Line 9 of the diff says PR #11077 but the actual PR number is #11097. The number 11077 is the TDD issue, not this pull request. Should read PR #11097.

C. file_ops.py fix is correct and well-structured

The fix in validate_sandbox_path() — catching ValueError from relative_to() and re-raising as a chained ValueError — is clean, idiomatic, and exactly mirrors the reference implementation in file_tools.py::validate_path(). No issues here.

D. Step definition in skill_file_ops_steps.py is well-written

The step_given_sibling_prefix_dir and step_when_skill_read_sibling_escape step implementations are correct, well-documented, and properly register cleanup handlers. The escape path ../sibling-escape/secret.txt exercises exactly the intended bypass scenario.

Required Actions Before Approval

  1. Fix return (...) from exc → return (...) in inline_executor.py (syntax error)
  2. Fix AND → And in the Gherkin scenario
  3. Resolve the TDD workflow compliance issue (confirm or correct @tdd_expected_fail history)
  4. Assign the PR to milestone v3.5.0
  5. Replace type/security label with Type/Fix (or Type/Bugfix)
  6. (Optional but recommended) Fix buildins typo → builtins in CHANGELOG and correct PR #11077 → PR #11097 in CONTRIBUTORS.md

Automated by CleverAgents Bot
Supervisor: PR Review | Agent: pr-review-worker

## First Review — fix(security): fix validate_path startswith bypass #7478 ### Summary The security fix itself is conceptually correct: replacing `str(target).startswith(str(root))` with `Path.relative_to()` is the right approach and matches the already-safe pattern used in `file_tools.py`. The `file_ops.py` fix is clean and correct. However, there are **blocking issues** that must be resolved before this PR can be merged, including a **critical syntax error** that is causing the majority of CI failures. ### CI Status CI is failing with 7 failing checks: - `CI / lint` — **FAILING** (syntax error in `inline_executor.py`) - `CI / typecheck` — **FAILING** (same syntax error) - `CI / unit_tests` — **FAILING** (same syntax error prevents import) - `CI / integration_tests` — **FAILING** (same syntax error) - `CI / e2e_tests` — **FAILING** (same syntax error) - `CI / security` — **FAILING** - `CI / benchmark-regression` — **FAILING** The root cause of most failures is a Python syntax error described below. All CI gates must pass before this PR can be approved. --- ### Blocking Issues #### 1. CRITICAL — Python Syntax Error in `inline_executor.py` The fix introduces `return (...) from exc` on the inner exception handler. `from` chaining is **only valid with `raise` statements**, not `return` statements. This is a Python `SyntaxError` that prevents the module from being imported entirely, which cascades to cause the lint, typecheck, unit test, integration test, and e2e test failures. **Fix**: Change `return (...) from exc` to simply `return (...)`. The error context is already captured in the return string — there is no need to chain exceptions here since we are returning a string, not raising. #### 2. BLOCKING — `AND` (uppercase) is invalid Gherkin in `features/skill_file_ops.feature` Line 191 uses `AND` (all-caps) instead of `And`. Gherkin step keywords are case-sensitive: valid continuations are `And`, `But`, or `*`. `AND` is not a recognised keyword and will cause a Behave step-definition parse failure. **Fix**: Change `AND the skill tool error should mention "traversal"` to `And the skill tool error should mention "traversal"`. #### 3. BLOCKING — Missing `@tdd_expected_fail` tag (TDD workflow violation) The new scenario at line 185–191 uses `@tdd_issue @tdd_issue_7478` but is missing the `@tdd_expected_fail` tag. Per the TDD bug-fix workflow, the regression test scenario must be submitted in a *Type/Testing* PR first with `@tdd_issue`, `@tdd_issue_7478`, and `@tdd_expected_fail` tags (proving the bug exists and the test fails). The *fix* PR (this one) then removes `@tdd_expected_fail` to graduate the test from expected-fail to passing. Submitting the test for the first time *in the fix PR* — without the TDD-only PR history and without the `@tdd_expected_fail` tag ever having been present — skips the required TDD workflow. The TDD issue (#11077) was created, but the test-only PR was never merged with the expected-fail tag. Please align with the contributing workflow: either (a) confirm a preceding TDD PR was merged with the proper tags and this PR correctly removes `@tdd_expected_fail`, or (b) add `@tdd_expected_fail` to this commit and create a separate fix commit that removes it, so the git history shows the proper TDD lifecycle. #### 4. BLOCKING — Missing milestone on PR The PR has no milestone set. Issue #7478 is assigned to milestone **v3.5.0**. The PR must be assigned to the same milestone per contributing guidelines. #### 5. BLOCKING — Incorrect/non-standard `Type/` label The PR has label `type/security` (lowercase `type`). The repo uses title-cased `Type/` labels: `Type/Bugfix`, `Type/Fix`, `Type/Feature`. This PR should have **`Type/Fix`** (or `Type/Bugfix`) — exactly one `Type/` label is required per contributing guidelines. Please remove `type/security` and add the appropriate `Type/` label. --- ### Non-Blocking Observations #### A. CHANGELOG typo: `buildins` → `builtins` The CHANGELOG entry on line 17 reads `skills/buildins/file_ops.py` — this is a typo (should be `builtins`). Not a blocker but should be corrected. #### B. CONTRIBUTORS.md references wrong PR number Line 9 of the diff says `PR #11077` but the actual PR number is `#11097`. The number `11077` is the TDD issue, not this pull request. Should read `PR #11097`. #### C. `file_ops.py` fix is correct and well-structured The fix in `validate_sandbox_path()` — catching `ValueError` from `relative_to()` and re-raising as a chained `ValueError` — is clean, idiomatic, and exactly mirrors the reference implementation in `file_tools.py::validate_path()`. No issues here. #### D. Step definition in `skill_file_ops_steps.py` is well-written The `step_given_sibling_prefix_dir` and `step_when_skill_read_sibling_escape` step implementations are correct, well-documented, and properly register cleanup handlers. The escape path `../sibling-escape/secret.txt` exercises exactly the intended bypass scenario. --- ### Required Actions Before Approval 1. Fix `return (...) from exc` → `return (...)` in `inline_executor.py` (syntax error) 2. Fix `AND` → `And` in the Gherkin scenario 3. Resolve the TDD workflow compliance issue (confirm or correct `@tdd_expected_fail` history) 4. Assign the PR to milestone **v3.5.0** 5. Replace `type/security` label with `Type/Fix` (or `Type/Bugfix`) 6. (Optional but recommended) Fix `buildins` typo → `builtins` in CHANGELOG and correct `PR #11077` → `PR #11097` in CONTRIBUTORS.md --- Automated by CleverAgents Bot Supervisor: PR Review | Agent: pr-review-worker
CHANGELOG.md
HAL9001 commented 2026-05-09 17:52:12 +00:00
Owner
Copy link

Suggestion: Typo buildins should be builtins

The entry reads skills/buildins/file_ops.py — the directory name is builtins, not buildins. Please correct the typo.

Also note the CHANGELOG entry format uses **fix(security) - ...** which mixes conventional commit prefix with the entry header. Consider aligning with the existing CHANGELOG format used by other entries in this file (e.g., **Feature Name** (#N): description).

Automated by CleverAgents Bot
Supervisor: PR Review | Agent: pr-review-worker

**Suggestion: Typo `buildins` should be `builtins`** The entry reads `skills/buildins/file_ops.py` — the directory name is `builtins`, not `buildins`. Please correct the typo. Also note the CHANGELOG entry format uses `**fix(security) - ...`** which mixes conventional commit prefix with the entry header. Consider aligning with the existing CHANGELOG format used by other entries in this file (e.g., `**Feature Name** (#N): description`). --- Automated by CleverAgents Bot Supervisor: PR Review | Agent: pr-review-worker
CONTRIBUTORS.md
HAL9001 commented 2026-05-09 17:52:12 +00:00
Owner
Copy link

Suggestion: Wrong PR number — PR #11077 should be PR #11097

#11077 is the TDD issue number (matching the branch name bugfix/11077-security-escape-bypass), not the pull request number. The actual PR number is #11097. Please correct the reference.

Automated by CleverAgents Bot
Supervisor: PR Review | Agent: pr-review-worker

**Suggestion: Wrong PR number — `PR #11077` should be `PR #11097`** `#11077` is the TDD issue number (matching the branch name `bugfix/11077-security-escape-bypass`), not the pull request number. The actual PR number is `#11097`. Please correct the reference. --- Automated by CleverAgents Bot Supervisor: PR Review | Agent: pr-review-worker
features/skill_file_ops.feature
HAL9001 commented 2026-05-09 17:52:12 +00:00
Owner
Copy link

BLOCKING — Missing @tdd_expected_fail tag (TDD workflow violation)

Per the contributing TDD bug-fix workflow:

  1. A Type/Testing PR must first add the scenario with tags @tdd_issue, @tdd_issue_7478, and @tdd_expected_fail — proving the bug exists and the test fails.
  2. The fix PR (this one) removes @tdd_expected_fail, graduating the test to a passing regression guard.

This scenario is being added here for the first time in the fix PR, without @tdd_expected_fail ever having been present. That skips step 1 of the TDD lifecycle and means there is no git-history evidence that the test was ever in expected-fail mode.

Please either:

  • Confirm a prior TDD-only PR was merged with @tdd_expected_fail present (and link it), or
  • Add @tdd_expected_fail to this scenario in the current commit and create a follow-up fix commit that removes it, so the git log shows the required lifecycle.

Automated by CleverAgents Bot
Supervisor: PR Review | Agent: pr-review-worker

**BLOCKING — Missing `@tdd_expected_fail` tag (TDD workflow violation)** Per the contributing TDD bug-fix workflow: 1. A *Type/Testing* PR must first add the scenario with tags `@tdd_issue`, `@tdd_issue_7478`, **and `@tdd_expected_fail`** — proving the bug exists and the test fails. 2. The *fix* PR (this one) removes `@tdd_expected_fail`, graduating the test to a passing regression guard. This scenario is being added here for the first time in the fix PR, without `@tdd_expected_fail` ever having been present. That skips step 1 of the TDD lifecycle and means there is no git-history evidence that the test was ever in expected-fail mode. Please either: - Confirm a prior TDD-only PR was merged with `@tdd_expected_fail` present (and link it), **or** - Add `@tdd_expected_fail` to this scenario in the current commit and create a follow-up fix commit that removes it, so the git log shows the required lifecycle. --- Automated by CleverAgents Bot Supervisor: PR Review | Agent: pr-review-worker
features/skill_file_ops.feature
HAL9001 commented 2026-05-09 17:52:12 +00:00
Owner
Copy link

BLOCKING — Invalid Gherkin keyword AND (all-caps)

Gherkin step keywords are case-sensitive. Valid continuation keywords are And, But, and *. AND (all-caps) is not a recognised keyword in Behave and will cause a step-definition lookup failure when this scenario runs.

# WRONG
    AND the skill tool error should mention "traversal"

# CORRECT
    And the skill tool error should mention "traversal"

Automated by CleverAgents Bot
Supervisor: PR Review | Agent: pr-review-worker

**BLOCKING — Invalid Gherkin keyword `AND` (all-caps)** Gherkin step keywords are case-sensitive. Valid continuation keywords are `And`, `But`, and `*`. `AND` (all-caps) is not a recognised keyword in Behave and will cause a step-definition lookup failure when this scenario runs. ```gherkin # WRONG AND the skill tool error should mention "traversal" # CORRECT And the skill tool error should mention "traversal" ``` --- Automated by CleverAgents Bot Supervisor: PR Review | Agent: pr-review-worker
src/cleveragents/skills/inline_executor.py
HAL9001 commented 2026-05-09 17:52:12 +00:00
Owner
Copy link

BLOCKING — Python Syntax Error: return ... from exc is invalid

from exc chaining is only valid on raise statements. Using it on a return statement is a SyntaxError that prevents this module from being imported at all, causing the lint, typecheck, unit_tests, integration_tests, and e2e_tests CI failures.

# WRONG (SyntaxError)
return (
    f"Path {value} for key {key} escapes sandbox "
    f"root {sandbox_path}"
) from exc

# CORRECT
return (
    f"Path {value} for key {key} escapes sandbox "
    f"root {sandbox_path}"
)

The error context is already fully captured in the return string — exception chaining is unnecessary here since we are returning a descriptive string, not raising.

Automated by CleverAgents Bot
Supervisor: PR Review | Agent: pr-review-worker

**BLOCKING — Python Syntax Error: `return ... from exc` is invalid** `from exc` chaining is only valid on `raise` statements. Using it on a `return` statement is a `SyntaxError` that prevents this module from being imported at all, causing the lint, typecheck, unit_tests, integration_tests, and e2e_tests CI failures. ```python # WRONG (SyntaxError) return ( f"Path {value} for key {key} escapes sandbox " f"root {sandbox_path}" ) from exc # CORRECT return ( f"Path {value} for key {key} escapes sandbox " f"root {sandbox_path}" ) ``` The error context is already fully captured in the return string — exception chaining is unnecessary here since we are returning a descriptive string, not raising. --- Automated by CleverAgents Bot Supervisor: PR Review | Agent: pr-review-worker
HAL9001 commented 2026-05-09 17:52:25 +00:00
Owner
Copy link

Peer review complete — REQUEST_CHANGES submitted (review #8502).

Five blocking issues identified:

  1. Syntax Error in inline_executor.py: return (...) from exc is invalid Python — from chaining only works with raise. This is causing the lint, typecheck, unit_tests, integration_tests, and e2e_tests CI failures.
  2. Invalid Gherkin keyword AND (all-caps) in features/skill_file_ops.feature — must be And.
  3. TDD workflow violation: @tdd_expected_fail tag missing from the new BDD scenario — the TDD-only step was skipped.
  4. Missing milestone: PR has no milestone; issue #7478 is under v3.5.0.
  5. Wrong Type/ label: type/security (non-standard lowercase) instead of Type/Fix.

Two non-blocking suggestions also noted (CHANGELOG typo buildins → builtins, CONTRIBUTORS.md wrong PR number #11077 → #11097).

The core security fix logic in file_ops.py is correct and well-implemented. Once the syntax error and process issues are resolved, this PR should be straightforward to approve.

Automated by CleverAgents Bot
Supervisor: PR Review | Agent: pr-review-worker

Peer review complete — **REQUEST_CHANGES** submitted (review #8502). Five blocking issues identified: 1. **Syntax Error** in `inline_executor.py`: `return (...) from exc` is invalid Python — `from` chaining only works with `raise`. This is causing the lint, typecheck, unit_tests, integration_tests, and e2e_tests CI failures. 2. **Invalid Gherkin keyword** `AND` (all-caps) in `features/skill_file_ops.feature` — must be `And`. 3. **TDD workflow violation**: `@tdd_expected_fail` tag missing from the new BDD scenario — the TDD-only step was skipped. 4. **Missing milestone**: PR has no milestone; issue #7478 is under v3.5.0. 5. **Wrong `Type/` label**: `type/security` (non-standard lowercase) instead of `Type/Fix`. Two non-blocking suggestions also noted (CHANGELOG typo `buildins` → `builtins`, CONTRIBUTORS.md wrong PR number `#11077` → `#11097`). The core security fix logic in `file_ops.py` is correct and well-implemented. Once the syntax error and process issues are resolved, this PR should be straightforward to approve. --- Automated by CleverAgents Bot Supervisor: PR Review | Agent: pr-review-worker
HAL9001 requested changes 2026-05-09 18:46:40 +00:00
HAL9001 left a comment
Copy link

First Review — fix(security): fix validate_path startswith bypass #7478

Summary

The security fix concept is correct and well-targeted: replacing str.startswith() with Path.relative_to() is the right approach and the file_ops.py implementation is clean and idiomatic. However, there are multiple blocking issues that must be resolved before this PR can be merged — most critically, a Python syntax error in inline_executor.py that is causing the majority of CI failures.

CI Status — FAILING

7 failing checks: lint, typecheck, unit_tests, integration_tests, e2e_tests, security, benchmark-regression. The root cause of most failures is a Python syntax error described below. All CI gates must pass before this PR can be approved.

Blocking Issues

1. CRITICAL — Python Syntax Error in inline_executor.py

return (...) from exc is invalid Python — from chaining only works with raise, not return. This causes a SyntaxError preventing the module from being imported, cascading to lint/typecheck/unit_tests/integration_tests/e2e_tests failures.

Fix: Remove from exc from the return statement: return (f"Path {value}...")

2. BLOCKING — Unused variable exc in OSError handler (inline_executor.py)

except OSError as exc: binds exc but never uses it. Change to except OSError:.

3. BLOCKING — AND (uppercase) is invalid Gherkin (skill_file_ops.feature line 191)

Gherkin keywords are case-sensitive. AND is not valid — use And.

4. BLOCKING — Missing @tdd_expected_fail tag (TDD workflow violation)

The scenario has @tdd_issue @tdd_issue_7478 but is missing @tdd_expected_fail. The TDD workflow requires the test to be submitted with @tdd_expected_fail in a dedicated Type/Testing PR first, then removed in the fix PR. No TDD-only PR with this tag was ever merged.

5. BLOCKING — No milestone assigned

Issue #7478 is under milestone v3.5.0. This PR must be assigned to the same milestone.

6. BLOCKING — Non-standard Type/ label

Label type/security (lowercase) is not a valid repo label. Replace with Type/Fix (matching the linked issue #7478 label).

7. BLOCKING — Wrong PR number in CONTRIBUTORS.md

PR #11077 should be PR #11097 (#11077 is the TDD tracking issue).

Non-Blocking

  • CHANGELOG.md typo: skills/buildins/file_ops.py should be skills/builtins/file_ops.py
  • file_ops.py fix is correct and well-structured — no issues
  • Step definitions in skill_file_ops_steps.py are well-written and correct

Required Actions Before Approval

  1. Fix syntax error: return (...) from exc → return (...) in inline_executor.py
  2. Fix except OSError as exc: → except OSError: in inline_executor.py
  3. Fix AND → And in features/skill_file_ops.feature
  4. Resolve TDD workflow compliance re: @tdd_expected_fail
  5. Assign PR to milestone v3.5.0
  6. Replace type/security with Type/Fix label
  7. Fix PR #11077 → PR #11097 in CONTRIBUTORS.md
  8. (Recommended) Fix buildins → builtins typo in CHANGELOG.md

Automated by CleverAgents Bot
Supervisor: PR Review | Agent: pr-review-worker

## First Review — fix(security): fix validate_path startswith bypass #7478 ### Summary The **security fix concept is correct and well-targeted**: replacing `str.startswith()` with `Path.relative_to()` is the right approach and the `file_ops.py` implementation is clean and idiomatic. However, there are **multiple blocking issues** that must be resolved before this PR can be merged — most critically, a **Python syntax error** in `inline_executor.py` that is causing the majority of CI failures. ### CI Status — FAILING 7 failing checks: `lint`, `typecheck`, `unit_tests`, `integration_tests`, `e2e_tests`, `security`, `benchmark-regression`. The root cause of most failures is a Python syntax error described below. All CI gates must pass before this PR can be approved. --- ### Blocking Issues **1. CRITICAL — Python Syntax Error in `inline_executor.py`** `return (...) from exc` is invalid Python — `from` chaining only works with `raise`, not `return`. This causes a `SyntaxError` preventing the module from being imported, cascading to lint/typecheck/unit_tests/integration_tests/e2e_tests failures. **Fix**: Remove `from exc` from the return statement: `return (f"Path {value}...")` **2. BLOCKING — Unused variable `exc` in OSError handler (`inline_executor.py`)** `except OSError as exc:` binds `exc` but never uses it. Change to `except OSError:`. **3. BLOCKING — `AND` (uppercase) is invalid Gherkin (`skill_file_ops.feature` line 191)** Gherkin keywords are case-sensitive. `AND` is not valid — use `And`. **4. BLOCKING — Missing `@tdd_expected_fail` tag (TDD workflow violation)** The scenario has `@tdd_issue @tdd_issue_7478` but is missing `@tdd_expected_fail`. The TDD workflow requires the test to be submitted with `@tdd_expected_fail` in a dedicated Type/Testing PR first, then removed in the fix PR. No TDD-only PR with this tag was ever merged. **5. BLOCKING — No milestone assigned** Issue #7478 is under milestone v3.5.0. This PR must be assigned to the same milestone. **6. BLOCKING — Non-standard `Type/` label** Label `type/security` (lowercase) is not a valid repo label. Replace with `Type/Fix` (matching the linked issue #7478 label). **7. BLOCKING — Wrong PR number in `CONTRIBUTORS.md`** `PR #11077` should be `PR #11097` (`#11077` is the TDD tracking issue). --- ### Non-Blocking - CHANGELOG.md typo: `skills/buildins/file_ops.py` should be `skills/builtins/file_ops.py` - `file_ops.py` fix is correct and well-structured — no issues - Step definitions in `skill_file_ops_steps.py` are well-written and correct --- ### Required Actions Before Approval 1. Fix syntax error: `return (...) from exc` → `return (...)` in `inline_executor.py` 2. Fix `except OSError as exc:` → `except OSError:` in `inline_executor.py` 3. Fix `AND` → `And` in `features/skill_file_ops.feature` 4. Resolve TDD workflow compliance re: `@tdd_expected_fail` 5. Assign PR to milestone **v3.5.0** 6. Replace `type/security` with `Type/Fix` label 7. Fix `PR #11077` → `PR #11097` in `CONTRIBUTORS.md` 8. (Recommended) Fix `buildins` → `builtins` typo in CHANGELOG.md --- Automated by CleverAgents Bot Supervisor: PR Review | Agent: pr-review-worker
CHANGELOG.md
HAL9001 commented 2026-05-09 18:46:40 +00:00
Owner
Copy link

Suggestion — Typo: buildins should be builtins.

The entry reads skills/buildins/file_ops.py but the correct directory name is builtins.

Automated by CleverAgents Bot
Supervisor: PR Review | Agent: pr-review-worker

**Suggestion — Typo: `buildins` should be `builtins`.** The entry reads `skills/buildins/file_ops.py` but the correct directory name is `builtins`. --- Automated by CleverAgents Bot Supervisor: PR Review | Agent: pr-review-worker
CONTRIBUTORS.md
HAL9001 commented 2026-05-09 18:46:40 +00:00
Owner
Copy link

BLOCKING — Wrong PR number: PR #11077 should be PR #11097.

#11077 is the TDD tracking issue, not this pull request. The correct PR number is #11097.

Fix: Change PR #11077 / issue #7478 to PR #11097 / issue #7478.

Automated by CleverAgents Bot
Supervisor: PR Review | Agent: pr-review-worker

**BLOCKING — Wrong PR number: `PR #11077` should be `PR #11097`.** `#11077` is the TDD tracking issue, not this pull request. The correct PR number is `#11097`. **Fix**: Change `PR #11077 / issue #7478` to `PR #11097 / issue #7478`. --- Automated by CleverAgents Bot Supervisor: PR Review | Agent: pr-review-worker
features/skill_file_ops.feature
HAL9001 commented 2026-05-09 18:46:40 +00:00
Owner
Copy link

BLOCKING — Missing @tdd_expected_fail tag (TDD workflow violation).

The scenario has @tdd_issue @tdd_issue_7478 but is missing @tdd_expected_fail. Per the TDD bug-fix workflow, the regression test must first be submitted in a dedicated Type/Testing PR with all three tags, proving the bug exists. The fix PR then removes @tdd_expected_fail to graduate the test to a passing guard. Issue #11077 exists as the tracking issue but no TDD-only PR was ever merged with this tag.

Fix: Either confirm a preceding TDD-only PR was merged with @tdd_expected_fail (and this PR correctly removes it), or submit the TDD-only PR first and rebase this PR onto master before removing the tag.

Automated by CleverAgents Bot
Supervisor: PR Review | Agent: pr-review-worker

**BLOCKING — Missing `@tdd_expected_fail` tag (TDD workflow violation).** The scenario has `@tdd_issue @tdd_issue_7478` but is missing `@tdd_expected_fail`. Per the TDD bug-fix workflow, the regression test must first be submitted in a dedicated Type/Testing PR with all three tags, proving the bug exists. The fix PR then removes `@tdd_expected_fail` to graduate the test to a passing guard. Issue #11077 exists as the tracking issue but no TDD-only PR was ever merged with this tag. **Fix**: Either confirm a preceding TDD-only PR was merged with `@tdd_expected_fail` (and this PR correctly removes it), or submit the TDD-only PR first and rebase this PR onto master before removing the tag. --- Automated by CleverAgents Bot Supervisor: PR Review | Agent: pr-review-worker
features/skill_file_ops.feature
HAL9001 commented 2026-05-09 18:46:40 +00:00
Owner
Copy link

BLOCKING — AND is not a valid Gherkin step keyword.

Gherkin keywords are case-sensitive. Valid continuation keywords are And, But, or *. AND (all-caps) is not recognised and will cause a Behave parse failure.

Fix: Change AND the skill tool error... to And the skill tool error....

Automated by CleverAgents Bot
Supervisor: PR Review | Agent: pr-review-worker

**BLOCKING — `AND` is not a valid Gherkin step keyword.** Gherkin keywords are case-sensitive. Valid continuation keywords are `And`, `But`, or `*`. `AND` (all-caps) is not recognised and will cause a Behave parse failure. **Fix**: Change `AND the skill tool error...` to `And the skill tool error...`. --- Automated by CleverAgents Bot Supervisor: PR Review | Agent: pr-review-worker
src/cleveragents/skills/inline_executor.py
HAL9001 commented 2026-05-09 18:46:40 +00:00
Owner
Copy link

BLOCKING — Python Syntax Error: return (...) from exc is invalid Python.

Exception chaining with from is only valid with raise statements, not return. This causes a SyntaxError when the module is imported, which cascades to break lint, typecheck, unit_tests, integration_tests, and e2e_tests CI checks.

Fix:

# BROKEN — causes SyntaxError
except ValueError as exc:
    return (
        f"Path value escapes sandbox"
    ) from exc

# FIXED
except ValueError:
    return (
        f"Path value escapes sandbox"
    )

Automated by CleverAgents Bot
Supervisor: PR Review | Agent: pr-review-worker

**BLOCKING — Python Syntax Error: `return (...) from exc` is invalid Python.** Exception chaining with `from` is only valid with `raise` statements, not `return`. This causes a `SyntaxError` when the module is imported, which cascades to break lint, typecheck, unit_tests, integration_tests, and e2e_tests CI checks. **Fix**: ```python # BROKEN — causes SyntaxError except ValueError as exc: return ( f"Path value escapes sandbox" ) from exc # FIXED except ValueError: return ( f"Path value escapes sandbox" ) ``` --- Automated by CleverAgents Bot Supervisor: PR Review | Agent: pr-review-worker
src/cleveragents/skills/inline_executor.py
HAL9001 commented 2026-05-09 18:46:40 +00:00
Owner
Copy link

BLOCKING — Unused variable exc in OSError handler.

except OSError as exc: binds exc but it is never referenced in the return string. This triggers a lint unused-variable warning.

Fix: Change except OSError as exc: to except OSError:.

Automated by CleverAgents Bot
Supervisor: PR Review | Agent: pr-review-worker

**BLOCKING — Unused variable `exc` in OSError handler.** `except OSError as exc:` binds `exc` but it is never referenced in the return string. This triggers a lint unused-variable warning. **Fix**: Change `except OSError as exc:` to `except OSError:`. --- Automated by CleverAgents Bot Supervisor: PR Review | Agent: pr-review-worker
HAL9001 commented 2026-05-09 18:47:00 +00:00
Owner
Copy link

Peer review complete — REQUEST_CHANGES submitted (review #8505).

Seven blocking issues identified:

  1. Syntax Error in inline_executor.py: return (...) from exc is invalid Python — from chaining only works with raise. This is the root cause of the lint, typecheck, unit_tests, integration_tests, and e2e_tests CI failures.
  2. Unused variable in inline_executor.py: except OSError as exc: — exc is never used. Change to except OSError:.
  3. Invalid Gherkin keyword AND (all-caps) in features/skill_file_ops.feature — must be And.
  4. TDD workflow violation: @tdd_expected_fail tag missing from the new BDD scenario — a TDD-only PR with the expected-fail tag must be merged before the fix PR.
  5. Missing milestone: PR has no milestone; issue #7478 is under v3.5.0.
  6. Wrong Type/ label: type/security (non-standard lowercase) instead of Type/Fix.
  7. Wrong PR number in CONTRIBUTORS.md: PR #11077 should be PR #11097.

One non-blocking suggestion also noted: CHANGELOG.md typo buildins → builtins.

The core security fix logic in file_ops.py is correct and well-implemented. Once the syntax error and process issues are resolved, this PR should be straightforward to approve.

Automated by CleverAgents Bot
Supervisor: PR Review | Agent: pr-review-worker

Peer review complete — **REQUEST_CHANGES** submitted (review #8505). Seven blocking issues identified: 1. **Syntax Error** in `inline_executor.py`: `return (...) from exc` is invalid Python — `from` chaining only works with `raise`. This is the root cause of the lint, typecheck, unit_tests, integration_tests, and e2e_tests CI failures. 2. **Unused variable** in `inline_executor.py`: `except OSError as exc:` — `exc` is never used. Change to `except OSError:`. 3. **Invalid Gherkin keyword** `AND` (all-caps) in `features/skill_file_ops.feature` — must be `And`. 4. **TDD workflow violation**: `@tdd_expected_fail` tag missing from the new BDD scenario — a TDD-only PR with the expected-fail tag must be merged before the fix PR. 5. **Missing milestone**: PR has no milestone; issue #7478 is under v3.5.0. 6. **Wrong `Type/` label**: `type/security` (non-standard lowercase) instead of `Type/Fix`. 7. **Wrong PR number in `CONTRIBUTORS.md`**: `PR #11077` should be `PR #11097`. One non-blocking suggestion also noted: CHANGELOG.md typo `buildins` → `builtins`. The core security fix logic in `file_ops.py` is correct and well-implemented. Once the syntax error and process issues are resolved, this PR should be straightforward to approve. --- Automated by CleverAgents Bot Supervisor: PR Review | Agent: pr-review-worker
Some checks failed
CI / benchmark-publish (pull_request) Has been skipped
Details
CI / push-validation (pull_request) Successful in 59s
Details
CI / helm (pull_request) Successful in 1m14s
Details
CI / build (pull_request) Successful in 1m20s
Required
Details
CI / lint (pull_request) Failing after 1m26s
Required
Details
CI / e2e_tests (pull_request) Failing after 1m50s
Details
CI / benchmark-regression (pull_request) Failing after 1m48s
Details
CI / integration_tests (pull_request) Failing after 1m56s
Required
Details
CI / quality (pull_request) Successful in 1m59s
Required
Details
CI / security (pull_request) Failing after 2m1s
Required
Details
CI / unit_tests (pull_request) Failing after 2m15s
Required
Details
CI / typecheck (pull_request) Failing after 2m32s
Required
Details
CI / coverage (pull_request) Has been skipped
Required
Details
CI / docker (pull_request) Has been skipped
Required
Details
CI / status-check (pull_request) Failing after 6s
Details
This pull request has changes conflicting with the target branch.
  • CHANGELOG.md
  • src/cleveragents/skills/builtins/file_ops.py
View command line instructions

Manual merge helper

Use this merge commit message when completing the merge manually.

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin bugfix/11077-security-escape-bypass:bugfix/11077-security-escape-bypass
git switch bugfix/11077-security-escape-bypass
Sign in to join this conversation.
Reviewers
No reviewers
HAL9001
Labels
Clear labels   
auto/needs-reevaluation
Controller deferred this PR; awaiting Phase 6+ scope-evaluator or operator re-enablement.

  
controller-managed
Auto-agents controller manages this PR/issue (see tools/controller/deploy/RUNBOOK.md). Remove this label to abandon controller management.

  
auto/blocked-by-deps
PR blocked by an open issue dependency. Operator must close the dep (or remove the dependency link) before the merge driver can act. Auto-cleared by merge_drive when no open deps remain.

  
auto/ci-timeout
Most recent merge cycle hit CI timeout. Driver excludes this PR while last merge_cycle row is < 30 min old; label persists thereafter as visible history.

  
auto/claimed-implementer
Currently being processed by an implementer worker.

  
auto/claimed-merge
Currently being processed by the merge driver.

  
auto/claimed-reviewer
Currently being processed by a reviewer worker.

  
auto/driver-down
Merge driver heartbeat stale; pipeline halted. Closed automatically on next clean tick.

  
auto/invariant-violation
Detected master commit violating the strict merge invariant. Tracked as an issue (not a PR label); kept here for label completeness.

  
auto/last-attempt-tier-0
In-cycle escalation: most recent attempt ran at the Tier 0 slot (`tier-0`). Slot's model defined in .opencode/models/tiers.yaml.

  
auto/last-attempt-tier-1
In-cycle escalation: most recent attempt ran at the Tier 1 slot (`tier-1`). Slot's model defined in .opencode/models/tiers.yaml.

  
auto/last-attempt-tier-2
In-cycle escalation: most recent attempt ran at the Tier 2 slot (`tier-2`). Slot's model defined in .opencode/models/tiers.yaml. Gated behind IMPLEMENTER_ESCALATION_TIER2_ENABLED.

  
auto/last-attempt-tier-min
In-cycle escalation: most recent attempt ran at the Tier -1 slot (`tier-min`). Slot's model defined in .opencode/models/tiers.yaml. Suffix is ``-min`` (not ``--1``) so the Forgejo UI reads naturally.

  
Automation Tracking
Tracking issues used by the AI Automation system for agents to communicate and report.

  
auto/needs-conflict-resolution
Rebase conflict needs LLM conflict-resolver.

  
auto/needs-implementer
Failing CI needs implementer attention.

  
auto/postmortem
Documenting a driver incident or rollback.

  
auto/ready-to-merge
Reviewer has APPROVED this PR and no later REQUEST_CHANGES is outstanding. The merge driver requires this label to even consider a PR for merging. Set by the reviewer worker on APPROVE; cleared on REQUEST_CHANGES.

  
auto/restart-throttled
Train repeatedly lost master-tempo races. Driver excludes via merge_cycle until cooldown elapses; label persists as visible history.

  
auto/revert
Revert PR backing out an invariant violation. Fast-tracked through the merge driver.

  
auto/sentinel
Sentinel PR duplicated from upstream into a personal fork by tools/duplicate_prs_to_fork.py for pipeline testing. Lives only in the fork; the canonical pipeline never sees it.

  
auto/stale-inactivity
No implementer activity for N days. Flagged for human review. Auto-cleared on next push to head branch.

  
auto/unstable
Repeatedly fails on current master (>= 3 ci-fail-on-rebased-sha releases in 12 h). Excluded from driver until human triage.

  
Blocked
A ticket in a blocked state and unable to complete until some other task is completed first.

  
Bounty
$100
 A bounty of $100 for any open-source contributor who provides a MR that solves this issue

  
Bounty
$1000
 A bounty of $1000 for any open-source contributor who provides a MR that solves this issue

  
Bounty
$10000
 A bounty of $10000 for any open-source contributor who provides a MR that solves this issue

  
Bounty
$20
 A bounty of $20 for any open-source contributor who provides a MR that solves this issue

  
Bounty
$2000
 A bounty of $2000 for any open-source contributor who provides a MR that solves this issue

  
Bounty
$250
 A bounty of $250 for any open-source contributor who provides a MR that solves this issue

  
Bounty
$50
 A bounty of $50 for any open-source contributor who provides a MR that solves this issue

  
Bounty
$500
 A bounty of $500 for any open-source contributor who provides a MR that solves this issue

  
Bounty
$5000
 A bounty of $5000 for any open-source contributor who provides a MR that solves this issue

  
Bounty
$750
 A bounty of $750 for any open-source contributor who provides a MR that solves this issue

  
MoSCoW
Could have
 Could have feature in order to satisfy the epic/legendary.

  
MoSCoW
Must have
 Must have feature in order to satisfy the epic/legendary.

  
MoSCoW
Should have
 Should have feature in order to satisfy the epic/legendary.

  
Needs Feedback
There are questions in the ticket that can not be completed until the project owner provides clarity.

  
Points
1
 1 man-hours worth of work for an expert with no learning curve.

  
Points
13
 13 man-hours worth of work for an expert with no learning curve.

  
Points
2
 2 man-hours worth of work for an expert with no learning curve.

  
Points
21
 21 man-hours worth of work for an expert with no learning curve.

  
Points
3
 3 man-hours worth of work for an expert with no learning curve.

  
Points
34
 34 man-hours worth of work for an expert with no learning curve.

  
Points
5
 5 man-hours worth of work for an expert with no learning curve.

  
Points
55
 55 man-hours worth of work for an expert with no learning curve.

  
Points
8
 8 man-hours worth of work for an expert with no learning curve.

  
Points
88
 88 man-hours worth of work for an expert with no learning curve.

  
Priority
Backlog
 This ticket has backlogged priority and is not to be worked on yet

  
Priority
CI Blocker
 Critical priority issue that blocks CI/CD pipeline and prevents PR merges

  
Priority
Critical
 The priority is critical

  
Priority
High
 The priority is high

  
Priority
Low
 The priority is low

  
Priority
Medium
 The priority is medium

  
Signed-off: Owner
When an epic or legendary is in review it must be signed off by owner, tech lead, and scrum master before being marked as completed.

  
Signed-off: Scrum Master
When an epic or legendary is in review it must be signed off by owner, tech lead, and scrum master before being marked as completed.

  
Signed-off: Tech Lead
When an epic or legendary is in review it must be signed off by owner, tech lead, and scrum master before being marked as completed.

  
Spike
A ticket for learning a tool or technology that is needed to be able to do future planning and design.

  
State
Completed
 The ticket has been fully implemented, completed, and merged with the source code. This label should only be applied once a ticket is closed.

  
State
Duplicate
 A ticket that represents the same content as an existing ticket.

  
State
In Progress
 A ticket that is actively being developed.

  
State
In Review
 A ticket that has had some code completed to implement but is waiting to pass peer review and is not yet merged in.

  
State
Paused
 This ticket's work started but wasn't finished. It's on hold (likely in a feature branch) and will be resumed later, either due to a blocker or a delay.

  
State
Unverified
 All new tickets start in this state. A developer may set it to show the ticket is unverified. This means we haven't agreed to work on it. It will either move to a verified state or be closed as wontdo.

  
State
Verified
 The issue has been verified by a developer as legitimate. It will be worked on and verified tickets are now considered part of the backlog.

  
State
Wont Do
 This ticket has been decided it wont be done. This may mean the bug has been determined to not be real (cant verify) or the feature is one we have decided we dont want to adopt.

  
Type
Automation
 Any edits or discussion about the AI automated coding system.

  
Type
Bug
 Something that doesnt work as intended.

  
Type
Discussion
 Anytime a ticket represents a discussion about a subject and doesnt fall into one of the other categories.

  
Type
Documentation
 An error or improvement needed in the documentation.

  
Type
Epic
 Any first tier epic. That is, an epic which contains only issues as children and will not have sub-epics.

  
Type
Feature
 Some new functionality not present.

  
Type
Legendary
 A type of Epic which will contain other Epics.

  
Type
Refactor
 A code change that restructures existing code without changing its external behavior.

  
Type
Support
 Someone needs help using the project.

  
Type
Task
 A generic task that doesnt fit into the other type categories.

  
Type
Testing
 Work exclusively focusing on fixing or expanding testing.

No labels
auto/needs-reevaluation
controller-managed
auto/blocked-by-deps
auto/ci-timeout
auto/claimed-implementer
auto/claimed-merge
auto/claimed-reviewer
auto/driver-down
auto/invariant-violation
auto/last-attempt-tier-0
auto/last-attempt-tier-1
auto/last-attempt-tier-2
auto/last-attempt-tier-min
Automation Tracking
auto/needs-conflict-resolution
auto/needs-implementer
auto/postmortem
auto/ready-to-merge
auto/restart-throttled
auto/revert
auto/sentinel
auto/stale-inactivity
auto/unstable
Blocked
Bounty
$100
Bounty
$1000
Bounty
$10000
Bounty
$20
Bounty
$2000
Bounty
$250
Bounty
$50
Bounty
$500
Bounty
$5000
Bounty
$750
MoSCoW
Could have
MoSCoW
Must have
MoSCoW
Should have
Needs Feedback
Points
1
Points
13
Points
2
Points
21
Points
3
Points
34
Points
5
Points
55
Points
8
Points
88
Priority
Backlog
Priority
CI Blocker
Priority
Critical
Priority
High
Priority
Low
Priority
Medium
Signed-off: Owner
Signed-off: Scrum Master
Signed-off: Tech Lead
Spike
State
Completed
State
Duplicate
State
In Progress
State
In Review
State
Paused
State
Unverified
State
Verified
State
Wont Do
Type
Automation
Type
Bug
Type
Discussion
Type
Documentation
Type
Epic
Type
Feature
Type
Legendary
Type
Refactor
Type
Support
Type
Task
Type
Testing
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
2 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
cleveragents/cleveragents-core!11097
No description provided.