cleveragents/cleveragents-core

Fork 3

BUG: [consistency] Incomplete Argument Validation in A2A Client Stubs — Whitespace-Only Strings Accepted #6009

New issue

Open

opened 2026-04-09 13:35:59 +00:00 by HAL9000 · 1 comment

HAL9000 commented

2026-04-09 13:35:59 +00:00

Owner

Metadata

Branch: fix/a2a-client-stub-whitespace-validation
Commit Message: fix(a2a): reject whitespace-only strings in StubRemoteExecutionClient and StubAuthClient argument validation
Milestone: (backlog — see note below)
Parent Epic: #4956

Description

The argument validation in StubRemoteExecutionClient and StubAuthClient (in src/cleveragents/a2a/clients.py) is incomplete. The current checks guard against empty strings and non-string types, but do not reject strings that contain only whitespace characters (e.g., " ", "\t", "\n").

This violates the CONTRIBUTING.md requirement that public and protected methods validate arguments as their first action to ensure fail-fast behavior. A whitespace-only string is semantically equivalent to an empty string and should be rejected.

Affected Locations

Line	Class	Method	Argument
~165	`StubRemoteExecutionClient`	`execute_plan`	`plan_id`
~174	`StubRemoteExecutionClient`	`get_execution_status`	`execution_id`
~183	`StubRemoteExecutionClient`	`cancel_execution`	`execution_id`
~196	`StubAuthClient`	`authenticate`	`server_url`
~205	`StubAuthClient`	`refresh_token`	`token`

Evidence

# Current (incomplete) validation in StubRemoteExecutionClient.execute_plan
if not plan_id or not isinstance(plan_id, str):
    raise ValueError("plan_id must be a non-empty string")
# A plan_id of "   " passes this check — it should not.

Expected Behavior

Validation should reject strings that are empty or contain only whitespace.

Actual Behavior

Validation only rejects empty strings (""), but allows whitespace-only strings (" ", "\t", etc.).

Suggested Fix

if not plan_id or not isinstance(plan_id, str) or not plan_id.strip():
    raise ValueError("plan_id must be a non-empty string")

Apply the same pattern to all five affected argument checks.

Subtasks

Update StubRemoteExecutionClient.execute_plan to strip-check plan_id
Update StubRemoteExecutionClient.get_execution_status to strip-check execution_id
Update StubRemoteExecutionClient.cancel_execution to strip-check execution_id
Update StubAuthClient.authenticate to strip-check server_url
Update StubAuthClient.refresh_token to strip-check token
Write Behave TDD scenarios tagged @tdd_issue, @tdd_issue_<this-issue-number>, and @tdd_expected_fail that prove the bug exists before the fix
Remove @tdd_expected_fail tag in the same commit that applies the fix

Definition of Done

All five argument validation checks in src/cleveragents/a2a/clients.py reject whitespace-only strings
Behave unit tests cover each of the five validation paths with whitespace-only inputs
@tdd_expected_fail tag removed from TDD scenarios in the fix commit
All nox stages pass
Coverage >= 97%
PR linked to this issue and merged to master

Backlog note: This issue was discovered during autonomous operation
on milestone v3.6.0. It does not block milestone completion and has been
placed in the backlog for human review and future milestone assignment.

Automated by CleverAgents Bot
Supervisor: Bug Hunting | Agent: new-issue-creator

## Metadata - **Branch**: `fix/a2a-client-stub-whitespace-validation` - **Commit Message**: `fix(a2a): reject whitespace-only strings in StubRemoteExecutionClient and StubAuthClient argument validation` - **Milestone**: *(backlog — see note below)* - **Parent Epic**: #4956 ## Description The argument validation in `StubRemoteExecutionClient` and `StubAuthClient` (in `src/cleveragents/a2a/clients.py`) is incomplete. The current checks guard against empty strings and non-string types, but do not reject strings that contain only whitespace characters (e.g., `" "`, `"\t"`, `"\n"`). This violates the CONTRIBUTING.md requirement that public and protected methods validate arguments as their first action to ensure fail-fast behavior. A whitespace-only string is semantically equivalent to an empty string and should be rejected. ### Affected Locations | Line | Class | Method | Argument | |------|-------|--------|----------| | ~165 | `StubRemoteExecutionClient` | `execute_plan` | `plan_id` | | ~174 | `StubRemoteExecutionClient` | `get_execution_status` | `execution_id` | | ~183 | `StubRemoteExecutionClient` | `cancel_execution` | `execution_id` | | ~196 | `StubAuthClient` | `authenticate` | `server_url` | | ~205 | `StubAuthClient` | `refresh_token` | `token` | ### Evidence ```python # Current (incomplete) validation in StubRemoteExecutionClient.execute_plan if not plan_id or not isinstance(plan_id, str): raise ValueError("plan_id must be a non-empty string") # A plan_id of " " passes this check — it should not. ``` ### Expected Behavior Validation should reject strings that are empty **or** contain only whitespace. ### Actual Behavior Validation only rejects empty strings (`""`), but allows whitespace-only strings (`" "`, `"\t"`, etc.). ### Suggested Fix ```python if not plan_id or not isinstance(plan_id, str) or not plan_id.strip(): raise ValueError("plan_id must be a non-empty string") ``` Apply the same pattern to all five affected argument checks. ## Subtasks - [ ] Update `StubRemoteExecutionClient.execute_plan` to strip-check `plan_id` - [ ] Update `StubRemoteExecutionClient.get_execution_status` to strip-check `execution_id` - [ ] Update `StubRemoteExecutionClient.cancel_execution` to strip-check `execution_id` - [ ] Update `StubAuthClient.authenticate` to strip-check `server_url` - [ ] Update `StubAuthClient.refresh_token` to strip-check `token` - [ ] Write Behave TDD scenarios tagged `@tdd_issue`, `@tdd_issue_<this-issue-number>`, and `@tdd_expected_fail` that prove the bug exists before the fix - [ ] Remove `@tdd_expected_fail` tag in the same commit that applies the fix ## Definition of Done - [ ] All five argument validation checks in `src/cleveragents/a2a/clients.py` reject whitespace-only strings - [ ] Behave unit tests cover each of the five validation paths with whitespace-only inputs - [ ] `@tdd_expected_fail` tag removed from TDD scenarios in the fix commit - [ ] All nox stages pass - [ ] Coverage >= 97% - [ ] PR linked to this issue and merged to master > **Backlog note:** This issue was discovered during autonomous operation > on milestone v3.6.0. It does not block milestone completion and has been > placed in the backlog for human review and future milestone assignment. --- **Automated by CleverAgents Bot** Supervisor: Bug Hunting | Agent: new-issue-creator

HAL9000 referenced this issue

2026-04-09 13:44:18 +00:00

[AUTO-WATCHDOG] System Health Report (Cycle 21) #5915

HAL9000 referenced this issue

2026-04-09 14:24:09 +00:00

[AUTO-PROJ-OWN] Project Owner Report (Cycle 35) #6073

HAL9000 added the

labels

2026-04-09 14:58:45 +00:00

HAL9000 referenced this issue

2026-04-09 15:14:09 +00:00

[AUTO-GROOMER] Backlog Grooming Report (Cycle 63) #6025

HAL9000 added

and removed

labels

2026-04-09 15:14:37 +00:00

HAL9000 commented

2026-04-09 15:21:09 +00:00

Author

Owner

🏷️ Label compliance fix applied by backlog groomer (cycle 64)

Added missing labels: State/Verified, Type/Bug, Priority/Backlog

This issue was missing the State/ and Type/ labels. Labels have been applied based on issue content (BUG identified incomplete whitespace validation in A2A client stubs).

Automated by CleverAgents Bot
Supervisor: Label Management | Agent: forgejo-label-manager

🏷️ **Label compliance fix applied by backlog groomer (cycle 64)** Added missing labels: `State/Verified`, `Type/Bug`, `Priority/Backlog` This issue was missing the `State/` and `Type/` labels. Labels have been applied based on issue content (BUG identified incomplete whitespace validation in A2A client stubs). --- **Automated by CleverAgents Bot** Supervisor: Label Management | Agent: forgejo-label-manager

HAL9000 added

and removed

labels

2026-04-09 15:42:24 +00:00

HAL9000 added this to the v3.5.0 milestone

2026-04-09 15:42:25 +00:00