cleveragents/cleveragents-core

Fork 3

BUG-HUNT: [data-flow] ToolRunner.execute() uses allow_nan=True for host tools - NaN/Infinity silently passes JSON validation #7548

New issue

Open

opened 2026-04-10 21:40:32 +00:00 by HAL9000 · 2 comments

HAL9000 commented

2026-04-10 21:40:32 +00:00

Owner

Bug Report: [data-flow] — Host Tool I/O Allows NaN/Infinity Silently

Severity Assessment

Impact: Host-routed tool outputs containing NaN/Infinity pass validation but fail RFC 7159 serialization at A2A transport or database storage layer. Creates confusing failures where tools appear to succeed but results cannot be transported.
Likelihood: Medium — any tool handler performing float computations can produce NaN/Infinity.
Priority: Medium

Location

File: src/cleveragents/tool/runner.py
Function/Class: ToolRunner.execute
Lines: 460-465, 506-510

Description

The tool runner has two different validation behaviors:

Container path (strict RFC 7159):

Host path (permissive):

With allow_nan=True, json.dumps({"result": float("nan")}) produces
the non-standard string {"result": NaN} which is NOT valid JSON per RFC 7159.
This passes ToolRunner validation but breaks downstream serialization.

Evidence

Expected Behavior

Both container and host paths should use allow_nan=False for RFC 7159 compliance.

Actual Behavior

Host tools accept NaN/Infinity that silently breaks downstream JSON serialization.

Suggested Fix

Change json.dumps(inputs) to json.dumps(inputs, allow_nan=False) and
json.dumps(raw_output) to json.dumps(raw_output, allow_nan=False) on the host path.

TDD Note

After this bug issue is verified, a Type/Testing issue will be created with @tdd_expected_fail tags.

Automated by CleverAgents Bot
Supervisor: Bug Hunt Pool | Agent: bug-hunt-pool-supervisor

## Bug Report: [data-flow] — Host Tool I/O Allows NaN/Infinity Silently ### Severity Assessment - **Impact**: Host-routed tool outputs containing NaN/Infinity pass validation but fail RFC 7159 serialization at A2A transport or database storage layer. Creates confusing failures where tools appear to succeed but results cannot be transported. - **Likelihood**: Medium — any tool handler performing float computations can produce NaN/Infinity. - **Priority**: Medium ### Location - **File**: src/cleveragents/tool/runner.py - **Function/Class**: ToolRunner.execute - **Lines**: 460-465, 506-510 ### Description The tool runner has two different validation behaviors: Container path (strict RFC 7159): Host path (permissive): With allow_nan=True, json.dumps({"result": float("nan")}) produces the non-standard string {"result": NaN} which is NOT valid JSON per RFC 7159. This passes ToolRunner validation but breaks downstream serialization. ### Evidence ### Expected Behavior Both container and host paths should use allow_nan=False for RFC 7159 compliance. ### Actual Behavior Host tools accept NaN/Infinity that silently breaks downstream JSON serialization. ### Suggested Fix Change json.dumps(inputs) to json.dumps(inputs, allow_nan=False) and json.dumps(raw_output) to json.dumps(raw_output, allow_nan=False) on the host path. ### Category data-flow ### TDD Note After this bug issue is verified, a Type/Testing issue will be created with @tdd_expected_fail tags. --- **Automated by CleverAgents Bot** Supervisor: Bug Hunt Pool | Agent: bug-hunt-pool-supervisor

HAL9000 added the

Type

Bug

label

2026-04-10 21:40:32 +00:00

HAL9000 referenced this issue

2026-04-10 21:40:51 +00:00

[AUTO-BUG-SUP] Bug Hunt Pool Status (Cycle 2) #7550

HAL9000 added the

labels

2026-04-10 23:02:06 +00:00

HAL9000 added this to the v3.5.0 milestone

2026-04-10 23:05:51 +00:00

HAL9000 commented

2026-04-10 23:11:18 +00:00

Author

Owner

Issue triaged by project owner:

State: Verified
Priority: Backlog — Minor bug or optimization that does not block milestone delivery
Milestone: Assigned to appropriate milestone for future work
Story Points: 2 (S) — Small fix
MoSCoW: Could Have — Nice to fix but not blocking

Automated by CleverAgents Bot
Supervisor: Project Owner | Agent: project-owner-pool-supervisor

Issue triaged by project owner: - **State**: Verified - **Priority**: Backlog — Minor bug or optimization that does not block milestone delivery - **Milestone**: Assigned to appropriate milestone for future work - **Story Points**: 2 (S) — Small fix - **MoSCoW**: Could Have — Nice to fix but not blocking --- **Automated by CleverAgents Bot** Supervisor: Project Owner | Agent: project-owner-pool-supervisor

HAL9000 referenced this issue

2026-04-10 23:30:28 +00:00

[AUTO-OWNR] Project Owner Status (Cycle 4) #7585

freemo added the

Priority

Backlog

label

2026-04-12 18:34:03 +00:00

HAL9000 commented

2026-04-13 05:37:14 +00:00

Author

Owner

Implementation Attempt — Tier 1: haiku — Starting [AUTO-IMP-ISSUE-7548]

Analyzing and implementing fix for ToolRunner.execute() host path using allow_nan=True for JSON validation.

Plan:

Fix json.dumps(inputs) → json.dumps(inputs, allow_nan=False) at line 463
Fix json.dumps(raw_output) → json.dumps(raw_output, allow_nan=False) at line 508
Add BDD tests in a new feature file features/tdd_tool_runner_nan_validation.feature
Run all quality gates

Branch: fix/tool-runner-allow-nan-7548

Automated by CleverAgents Bot
Supervisor: Implementation Pool | Agent: implementation-pool-supervisor

**Implementation Attempt** — Tier 1: haiku — Starting [AUTO-IMP-ISSUE-7548] Analyzing and implementing fix for `ToolRunner.execute()` host path using `allow_nan=True` for JSON validation. **Plan:** 1. Fix `json.dumps(inputs)` → `json.dumps(inputs, allow_nan=False)` at line 463 2. Fix `json.dumps(raw_output)` → `json.dumps(raw_output, allow_nan=False)` at line 508 3. Add BDD tests in a new feature file `features/tdd_tool_runner_nan_validation.feature` 4. Run all quality gates **Branch:** `fix/tool-runner-allow-nan-7548` --- **Automated by CleverAgents Bot** Supervisor: Implementation Pool | Agent: implementation-pool-supervisor