fix(security): enforce explicit exception handling #320

Closed
opened 2026-02-22 23:41:16 +00:00 by freemo · 1 comment
Owner

Metadata

  • Commit Message: fix(security): enforce explicit exception handling
  • Branch: feature/m4-security-exceptions

Background

Silent exception handling is replaced with explicit errors and context propagation. Structured error types exist for config, provider, and file I/O failures with plan_id/project_name in error details. Unexpected exceptions are wrapped in CleverAgentsError with safe user-facing messages.

Acceptance Criteria

  • Replace silent exception handling with explicit errors and context propagation.
  • Add structured error types for config, provider, and file I/O failures and include plan_id/project_name in error details.
  • Ensure unexpected exceptions are wrapped in CleverAgentsError with a safe, user-facing message.
  • Add error code mapping table (error_code -> HTTP-like category) for CLI output consistency.
  • Ensure error details are redacted for secrets before logging.

Definition of Done

This issue is complete when:

  • All subtasks below are completed and checked off.
  • A Git commit is created where the first line of the commit message matches
    the Commit Message in Metadata exactly, followed by a blank line, then
    additional lines providing relevant details about the implementation. The
    commit body should be appropriate in size for a commit message and relatively
    complete in describing what was done.
  • The commit is pushed to the remote on the branch matching the Branch in
    Metadata exactly.
  • The commit is submitted as a pull request to master, reviewed, and
    merged before this issue is marked done.

Subtasks

  • Replace silent exception handling with explicit errors and context propagation.
  • Add structured error types for config, provider, and file I/O failures and include plan_id/project_name in error details.
  • Ensure unexpected exceptions are wrapped in CleverAgentsError with a safe, user-facing message.
  • Add error code mapping table (error_code -> HTTP-like category) for CLI output consistency.
  • Ensure error details are redacted for secrets before logging.
  • Document error propagation standards and logging rules.
  • Tests (Behave): Add features/security_exceptions.feature scenarios.
  • Tests (Robot): Add exception handling integration smoke tests.
  • Tests (ASV): Add benchmarks/security_exception_bench.py for error path overhead baseline.
  • Verify coverage >=97% via nox -s coverage_report. If coverage is <97% then review the current unit test coverage report at build/coverage.xml and use it to write new Behave based unit tests to improve code coverage. Specifically, write Behave style unit tests that are descriptively named and specifically improves coverage on whichever file has the most uncovered lines by writing tests that will target the uncovered lines in the report. Once that is done rerun nox -s coverage_report to verify all tests pass and coverage is above >=97%. Only mark this as complete once coverage is >=97%, if not repeat this task as many times as is needed until coverage reaches >=97%.
  • Run nox (all default sessions, including benchmark), fix any errors if needed ensuring nox passes across entire code base, do not ignore any failure even if it seems unrelated to this commit, fix it.

Section: ### Section 11: Security & Safety [WORKSTREAM F - Luis + Brent]
Status: Open

## Metadata - **Commit Message**: `fix(security): enforce explicit exception handling` - **Branch**: `feature/m4-security-exceptions` ## Background Silent exception handling is replaced with explicit errors and context propagation. Structured error types exist for config, provider, and file I/O failures with plan_id/project_name in error details. Unexpected exceptions are wrapped in `CleverAgentsError` with safe user-facing messages. ## Acceptance Criteria - [ ] Replace silent exception handling with explicit errors and context propagation. - [ ] Add structured error types for config, provider, and file I/O failures and include plan_id/project_name in error details. - [ ] Ensure unexpected exceptions are wrapped in `CleverAgentsError` with a safe, user-facing message. - [ ] Add error code mapping table (error_code -> HTTP-like category) for CLI output consistency. - [ ] Ensure error details are redacted for secrets before logging. ## Definition of Done This issue is complete when: - All subtasks below are completed and checked off. - A Git commit is created where the **first line** of the commit message matches the Commit Message in Metadata exactly, followed by a blank line, then additional lines providing relevant details about the implementation. The commit body should be appropriate in size for a commit message and relatively complete in describing what was done. - The commit is pushed to the remote on the branch matching the **Branch** in Metadata exactly. - The commit is submitted as a **pull request** to `master`, reviewed, and **merged** before this issue is marked done. ## Subtasks - [ ] Replace silent exception handling with explicit errors and context propagation. - [ ] Add structured error types for config, provider, and file I/O failures and include plan_id/project_name in error details. - [ ] Ensure unexpected exceptions are wrapped in `CleverAgentsError` with a safe, user-facing message. - [ ] Add error code mapping table (error_code -> HTTP-like category) for CLI output consistency. - [ ] Ensure error details are redacted for secrets before logging. - [ ] Document error propagation standards and logging rules. - [ ] Tests (Behave): Add `features/security_exceptions.feature` scenarios. - [ ] Tests (Robot): Add exception handling integration smoke tests. - [ ] Tests (ASV): Add `benchmarks/security_exception_bench.py` for error path overhead baseline. - [ ] Verify coverage >=97% via `nox -s coverage_report`. If coverage is <97% then review the current unit test coverage report at `build/coverage.xml` and use it to write new Behave based unit tests to improve code coverage. Specifically, write Behave style unit tests that are descriptively named and specifically improves coverage on whichever file has the most uncovered lines by writing tests that will target the uncovered lines in the report. Once that is done rerun `nox -s coverage_report` to verify all tests pass and coverage is above >=97%. Only mark this as complete once coverage is >=97%, if not repeat this task as many times as is needed until coverage reaches >=97%. - [ ] Run `nox` (all default sessions, including benchmark), fix any errors if needed ensuring nox passes across **entire** code base, do not ignore any failure even if it seems unrelated to this commit, fix it. **Section**: ### Section 11: Security & Safety [WORKSTREAM F - Luis + Brent] **Status**: Open
freemo added this to the (deleted) milestone 2026-02-22 23:41:16 +00:00
freemo modified the milestone from (deleted) to v3.3.0 2026-02-23 00:07:07 +00:00
Author
Owner

Expected completion updated (Day 15 rebaseline): Day 35 / 2026-03-15 (previously Day 26 / 2026-03-06)

**Expected completion updated (Day 15 rebaseline):** Day 35 / 2026-03-15 (previously Day 26 / 2026-03-06)
freemo added the due date 2026-02-20 2026-02-23 18:41:51 +00:00
CoreRasurae added reference develop-luis-2 2026-02-25 07:40:32 +00:00
Sign in to join this conversation.
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

2026-02-20

Reference
cleveragents/cleveragents-core#320
No description provided.