fix(workspace/OFFSEC-003): correct boundary wrapping + add closer truncation #1059
Merged
devops-engineer
merged 1 commits from 2026-05-14 20:26:43 +00:00
fix/offsec-003-boundary-v2 into staging
1 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
| d241dd7f9e |
fix(workspace/OFFSEC-003): correct boundary wrapping + add closer truncation
All checks were successful
Block internal-flavored paths / Block forbidden paths (pull_request) Successful in 22s
CI / Detect changes (pull_request) Successful in 1m6s
E2E API Smoke Test / detect-changes (pull_request) Successful in 1m6s
publish-runtime-autobump / bump-and-tag (pull_request) Has been skipped
Handlers Postgres Integration / detect-changes (pull_request) Successful in 1m8s
publish-runtime-autobump / pr-validate (pull_request) Successful in 1m7s
Secret scan / Scan diff for credential-shaped strings (pull_request) Successful in 21s
qa-review / approved (pull_request) Successful in 24s
security-review / approved (pull_request) Successful in 21s
lint-required-no-paths / lint-required-no-paths (pull_request) Successful in 1m38s
Runtime PR-Built Compatibility / detect-changes (pull_request) Successful in 59s
CI / Platform (Go) (pull_request) Successful in 6s
CI / Shellcheck (E2E scripts) (pull_request) Successful in 7s
CI / Canvas (Next.js) (pull_request) Successful in 8s
E2E API Smoke Test / E2E API Smoke Test (pull_request) Successful in 11s
Handlers Postgres Integration / Handlers Postgres Integration (pull_request) Successful in 7s
CI / Canvas Deploy Reminder (pull_request) Has been skipped
Runtime PR-Built Compatibility / PR-built wheel + import smoke (pull_request) Successful in 2m17s
CI / Python Lint & Test (pull_request) Successful in 7m0s
CI / all-required (pull_request) Successful in 7s
gate-check-v3 / gate-check (pull_request) Successful in 14s
sop-tier-check / tier-check (pull_request) Successful in 16s
sop-checklist / na-declarations (pull_request) N/A: qa-review
sop-checklist / all-items-acked (pull_request) acked: 7/7
audit-force-merge / audit (pull_request) Successful in 8s
Two bugs fixed in tool_delegate_task wrapping logic: 1. Wrapping used raw _A2A_BOUNDARY_START/_END markers, which appeared alongside the escaped form of peer content. Fixed: wrap with _A2A_BOUNDARY_START_ESCAPED/_END_ESCAPED so output contains no raw closer that could confuse downstream parsers. 2. A malicious peer could inject a fake closer ([/A2A_RESULT_FROM_PEER]) to make legitimate content appear truncated. Fixed: truncate at the raw closer BEFORE sanitization (truncation loses the raw form). Updated test assertions across 3 test files to match new escaped wrapper form (previous tests expected raw markers in output). Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> |
