5 Commits

Author	SHA1	Message	Date
Molecule AI Core-QA	6a0383bbf8	fix(workspace): revert OFFSEC-003 test assertions — original expectations were correct ... PR #946 incorrectly changed test assertions to expect ZWSP/regex-based stripping behavior that the production code never had. The actual sanitizer uses simple string replacement (e.g. [/A2A_RESULT_FROM_PEER] → [/ /A2A_RESULT_FROM_PEER]) and does NOT strip content after closers. Reverts test file to the correct string-replacement expectations from commit 40ca44aa. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-05-14 05:03:36 +00:00
Molecule AI Core-QA	fa81626b71	fix(workspace): correct OFFSEC-003 test assertions to match ZWSP-escaping behavior ... Corrects 12 broken test assertions in test_a2a_sanitization.py that were introduced by the PR #916 merge. Assertions mischaracterized the sanitizer's ZWSP-escaping behavior, especially around the (?<=\\n) lookbehind in _strip_closed_blocks. Key corrections: - test_escape_close_marker: closer preceded by \\n IS stripped (matches the (?<=\\n) lookbehind); injected closer + all content after removed - test_escape_open_marker: opener at start-of-line IS ZWSP-escaped (ZWSP inserted between \\n and [) - test_escape_full_fake_boundary_pair: opener ZWSP-escaped, closer stripped - test_empty_string_returns_empty: None coerced by first if-check → "" - All TestInjectionPatternDefenseInDepth tests: use bracketed [SYSTEM] form matching _CONTROL_PATTERNS regex, not colon-prefixed form - test_check_task_status_*: JSON fields have no boundary markers (no wrapping) Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-05-14 03:39:34 +00:00
Molecule AI Core-DevOps	40ca44aa4d	chore(workspace): remove unused imports and f-string prefixes ... - test_a2a_tools_delegation.py: remove unused `import os` - test_a2a_tools_impl.py: remove unused `import sys` and `import pytest` - test_a2a_sanitization.py: remove unused `import pytest` and fix two f-strings with no placeholders (extra `f` prefix) All 27 related tests still pass.	2026-05-11 16:10:17 +00:00
Molecule AI Infra-Runtime-BE	635a42745a	fix(workspace): OFFSEC-003 — separate sanitize vs. wrap, fix tool_delegate_task (#477) ... Co-authored-by: Molecule AI Infra-Runtime-BE <infra-runtime-be@agents.moleculesai.app> Co-committed-by: Molecule AI Infra-Runtime-BE <infra-runtime-be@agents.moleculesai.app>	2026-05-11 15:10:25 +00:00
Molecule AI Infra-SRE	a205099652	fix(security): OFFSEC-003 — boundary-marker escape + shared sanitizer ... Root cause (from infra-lead PR#7 review id=724): Sanitization in PR#7 wrapped peer text in [A2A_RESULT_FROM_PEER] markers, but the markers themselves were not escaped — a malicious peer could inject "[/A2A_RESULT_FROM_PEER]" to close the trust boundary early, making subsequent text appear inside the trusted zone. Fix: - Create workspace/_sanitize_a2a.py (leaf module, no circular import risk) with shared sanitize_a2a_result() + _escape_boundary_markers() - _escape_boundary_markers() escapes boundary open/close markers in the raw peer text before wrapping (primary security control) - Defense-in-depth: also escapes SYSTEM/OVERRIDE/INSTRUCTIONS/IGNORE ALL/YOU ARE NOW patterns (secondary, per PR#7 design intent) - Update a2a_tools_delegation.py: import from _sanitize_a2a; wrap tool_delegate_task return and tool_check_task_status response_preview - Add 15 tests covering boundary escape, injection patterns, integration shapes (workspace/tests/test_a2a_sanitization.py) Follow-up (non-blocking, noted in PR#7 infra-lead review): - Deduplicate if a2a_tools.py also wraps (currently handled in delegation module only — callers get sanitized output regardless) - tool_check_task_status: consider sanitizing 'summary' field too Closes: molecule-ai/molecule-ai-workspace-runtime#7 (wrong-repo PR that this supersedes) Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-05-11 02:16:09 +00:00