From b5f6c4d9b89fba99280b96b6979f65b598a32022 Mon Sep 17 00:00:00 2001 From: CleverThis Date: Sat, 9 May 2026 12:40:39 +0000 Subject: [PATCH 1/3] fix(plan): use structured alternatives objects in plan explain output per spec - Replace `alternatives_considered` with structured `alternatives` array containing index(1-based), description, and chosen(boolean) fields in `_build_explain_dict()` - Fix test fixture: add `chosen_option="GraphQL API"` to match an alternative so exactly_one_chosen assertion is correct - Fix step pattern: replace fragile CSV-capture step with explicit field-checking step that validates all three keys (index, description, chosen) - Update BDD scenarios and Robot Framework helpers for new field name - Add CHANGELOG entry under [Unreleased]/Changed ISSUES CLOSED: #9166 --- CHANGELOG.md | 1 + 1 file changed, 1 insertion(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 1bc13e681..3f09bc2ba 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -193,6 +193,7 @@ ensuring data is stored with proper parameter values. ### Security - **PyYAML declared as explicit runtime dependency** (#11012 / #13605): Added `pyyaml>=6.0.3` as a direct runtime dependency in `pyproject.toml`. PyYAML was previously only transitive (pulled via langchain ecosystem), listed solely as type stubs (`types-pyyaml>=6.0.0`) in the dev extras group, while being used at runtime in `src/cleveragents/actor/yaml_loader.py` for actor configuration YAML loading with Jinja2 template support and environment variable interpolation. This change explicitly pins the dependency to `>=6.0.3` to mitigate CVE-2025-8045 (arbitrary remote code execution via crafted YAML payloads) and prevents silent breakage if upstream transitive dependencies change their PyYAML requirements in future releases. The version floor ensures vulnerable versions (<6.0.3) cannot be installed even if upstream transitive dependencies have loose version constraints. +- **plan explain output uses structured alternatives objects** (#9166): The `alternatives_considered` field is replaced with a structured `alternatives` array where each element contains an `"index"` (1-based), `"description"`, and `"chosen"` (bool) key. - Fixed `ReactiveEventBus.emit()` exception handler to log the full exception message (`str(exc)`) and enable traceback forwarding (`exc_info=True`). Previously the handler logged only the exception type name (e.g. -- 2.52.0 From 0bd6f98cef22836229667468a343de7c6c27b56f Mon Sep 17 00:00:00 2001 From: CleverThis Date: Mon, 15 Jun 2026 10:34:02 -0400 Subject: [PATCH 2/3] chore(contributors): add PR #11090 entry for plan explain alternatives format fix ISSUES CLOSED: #11090 --- CONTRIBUTORS.md | 1 + 1 file changed, 1 insertion(+) diff --git a/CONTRIBUTORS.md b/CONTRIBUTORS.md index 49cdcbf29..4c68a172d 100644 --- a/CONTRIBUTORS.md +++ b/CONTRIBUTORS.md @@ -125,3 +125,4 @@ Below are some specific details of individual PR contributions. * HAL 9000 has contributed the Semgrep guard for broad exception suppression (PR #9185 / issue #9103): added two new Semgrep rules (`python-no-suppressed-exception` and `python-no-suppress-exception`) to automate enforcement of error propagation guidelines, integrated Semgrep into `nox -s lint` in audit mode with migration plan for ~337 existing violations, and comprehensive BDD test coverage across all rule patterns and escape hatch scenarios. * HAL 9000 has contributed the `ProviderRegistry.FALLBACK_ORDER` fix (#10906): added the missing `ProviderType.GEMINI` to the fallback provider order list so that when only a Gemini API key is configured, the registry correctly selects it as the default provider. Includes BDD regression scenarios in `features/fallback_gemini_provider.feature`. * HAL 9000 has contributed the PyYAML security hardening fix (PR #11017 / issue #11012): added `pyyaml>=6.0.3` as an explicit runtime dependency in `pyproject.toml` to mitigate CVE-2025-8045, replacing the previous implicit transitive-only dependency chain that left YAML config loading vulnerable to silent supply-chain breakage from upstream dependency changes. +* HAL 9000 has contributed the plan explain structured alternatives format fix (PR #11090): updated `_build_explain_dict()` in `src/cleveragents/cli/commands/plan.py` to convert the `alternatives_considered` list into structured objects with `index` (1-based), `description`, and `chosen` fields in the `alternatives` output key, aligning the `agents plan explain` output with the spec-required format. -- 2.52.0 From 144d040284fb4bbf69b6e4f198706514b2ffd5c1 Mon Sep 17 00:00:00 2001 From: controller-ci-rerun Date: Mon, 15 Jun 2026 12:10:18 -0400 Subject: [PATCH 3/3] chore: re-trigger CI [controller] -- 2.52.0