UAT: `AutomationGuard` missing `extra="forbid"` — extra fields in guard configuration silently ignored #5645

New issue

Open

opened 2026-04-09 08:04:37 +00:00 by HAL9000 · 0 comments

HAL9000 commented

2026-04-09 08:04:37 +00:00

Owner

Summary

AutomationGuard does not have extra="forbid" in its Pydantic model_config. This means unknown fields in guard configuration (e.g., from YAML files or API payloads) are silently ignored, potentially masking configuration errors.

What Was Tested

Code-level analysis of:

src/cleveragents/domain/models/core/automation_guard.py — AutomationGuard.model_config

Expected Behavior

AutomationGuard should reject unknown fields with a clear validation error, consistent with AutomationProfile which uses extra="forbid".

Actual Behavior

# automation_guard.py
class AutomationGuard(BaseModel):
    # ... fields ...
    model_config = ConfigDict(
        str_strip_whitespace=True,
        validate_assignment=True,
        # Missing: extra="forbid"
    )

A user who writes:

guards:
  max_tool_calls_per_step: 10
  require_approval_for_writez: true  # Typo: "writez" instead of "writes"

Will get require_approval_for_writes=False (the default) silently, with no error.

Impact

Configuration errors in AutomationGuard YAML are silently ignored
Typos in guard field names result in the default (permissive) behavior instead of an error
This is particularly dangerous for security-critical fields like require_approval_for_writes and tool_denylist

Code Location

src/cleveragents/domain/models/core/automation_guard.py — AutomationGuard.model_config

Fix Required

Add extra="forbid" to AutomationGuard.model_config:

model_config = ConfigDict(
    str_strip_whitespace=True,
    validate_assignment=True,
    extra="forbid",  # Add this
)

Automated by CleverAgents Bot
Supervisor: UAT Testing | Agent: uat-tester

## Summary `AutomationGuard` does not have `extra="forbid"` in its Pydantic `model_config`. This means unknown fields in guard configuration (e.g., from YAML files or API payloads) are silently ignored, potentially masking configuration errors. ## What Was Tested Code-level analysis of: - `src/cleveragents/domain/models/core/automation_guard.py` — `AutomationGuard.model_config` ## Expected Behavior `AutomationGuard` should reject unknown fields with a clear validation error, consistent with `AutomationProfile` which uses `extra="forbid"`. ## Actual Behavior ```python # automation_guard.py class AutomationGuard(BaseModel): # ... fields ... model_config = ConfigDict( str_strip_whitespace=True, validate_assignment=True, # Missing: extra="forbid" ) ``` A user who writes: ```yaml guards: max_tool_calls_per_step: 10 require_approval_for_writez: true # Typo: "writez" instead of "writes" ``` Will get `require_approval_for_writes=False` (the default) silently, with no error. ## Impact - Configuration errors in `AutomationGuard` YAML are silently ignored - Typos in guard field names result in the default (permissive) behavior instead of an error - This is particularly dangerous for security-critical fields like `require_approval_for_writes` and `tool_denylist` ## Code Location - `src/cleveragents/domain/models/core/automation_guard.py` — `AutomationGuard.model_config` ## Fix Required Add `extra="forbid"` to `AutomationGuard.model_config`: ```python model_config = ConfigDict( str_strip_whitespace=True, validate_assignment=True, extra="forbid", # Add this ) ``` --- **Automated by CleverAgents Bot** Supervisor: UAT Testing | Agent: uat-tester

HAL9000 added the

labels

2026-04-09 08:05:16 +00:00

HAL9000 added a new dependency