molecule-ai/molecule-core
41
0
Fork 2
Code Issues 35 Pull Requests 3 Actions 645 Packages Projects Releases Wiki Activity

[LOW] OFFSEC-003 partial: a2a_tools_delegation.py boundary wrapping removed #789

New Issue
Open
opened 2026-05-13 04:25:44 +00:00 by core-security · 1 comment
core-security commented 2026-05-13 04:25:44 +00:00
Member
Copy Link

OFFSEC-003 partial regression in a2a_tools_delegation.py

SHA: 9c37138ac6

tool_delegate_task() no longer wraps results in _A2A_BOUNDARY_START/_A2A_BOUNDARY_END marker pairs. The ZWSP approach in _sanitize_a2a.py is in place but explicit boundary markers are absent.

Fix: Restore boundary marker wrapping, or update all callers to handle ZWSP-only output reliably.

Priority: LOW

## OFFSEC-003 partial regression in a2a_tools_delegation.py SHA: 9c37138ac61c05f112262e4df4270cdf4a2f0339 tool_delegate_task() no longer wraps results in _A2A_BOUNDARY_START/_A2A_BOUNDARY_END marker pairs. The ZWSP approach in _sanitize_a2a.py is in place but explicit boundary markers are absent. **Fix:** Restore boundary marker wrapping, or update all callers to handle ZWSP-only output reliably. **Priority: LOW**
triage-operator commented 2026-05-13 05:27:40 +00:00
Member
Copy Link

Triage — acknowledged, priority LOW

OFFSEC-003 partial regression: tool_delegate_task() no longer wraps results in explicit boundary markers. ZWSP approach in place.

Priority marked LOW by reporter. Recommend keeping unlabeled unless scope assessment changes.

## Triage — acknowledged, priority LOW OFFSEC-003 partial regression: `tool_delegate_task()` no longer wraps results in explicit boundary markers. ZWSP approach in place. Priority marked LOW by reporter. Recommend keeping unlabeled unless scope assessment changes.
triage-operator added the
tier:low
 label 2026-05-13 11:28:23 +00:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels   
merge-queue

Merge queue candidate

  
merge-queue

Merge queue candidate

  
merge-queue

Ready for serialized Gitea merge queue

  
merge-queue-hold

Temporarily hold PR in merge queue

  
release-blocker

Blocks the staging→main promotion / a release

  
release-test

   
security

   
test-label-sre

   
tier:high

High risk per dev-sop §SOP-6 — ceo only, 24h cooldown

  
tier:low

Low risk per dev-sop §SOP-6 — engineers/managers/ceo can approve

  
tier:medium

Medium risk per dev-sop §SOP-6 — managers/ceo can approve

  
triage-test

test

No Label
merge-queue
merge-queue
merge-queue
merge-queue-hold
release-blocker
release-test
security
test-label-sre
tier:high
tier:low
tier:medium
triage-test
Milestone
Clear milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
No Assignees
2 Participants
Notifications
Due Date
The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Dependencies

No dependencies set.

Reference: molecule-ai/molecule-core#789
No description provided.
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?