Skip to content

Fix critical bugs: JSON crash, data loss, thread safety, security vulnerabilities - #771

Open
618dt wants to merge 2 commits into
lsdefine:mainfrom
618dt:fix/security-vulnerabilities
Open

Fix critical bugs: JSON crash, data loss, thread safety, security vulnerabilities#771
618dt wants to merge 2 commits into
lsdefine:mainfrom
618dt:fix/security-vulnerabilities

Conversation

@618dt

@618dt 618dt commented Aug 17, 2026

Copy link
Copy Markdown

Fixes #770

Bug Fixes

Critical

  • agent_loop.py: Fix JSONDecodeError crash when LLM returns malformed tool arguments — now gracefully falls back to raw args instead of killing the agent loop
  • ga.py: Fix file_write prepend mode data loss on write failure — atomic write via tmpfile+rename ensures original file is never lost
  • ga.py: Sandboxed inline_eval — remove history exposure, restrict builtins to prevent prompt injection
  • ga_ultraplan.py: Add Bearer token auth to unauthenticated /exec HTTP endpoint

High

  • agentmain.py: Fix thread safety — use self.lock for is_running/stop_sig mutations across worker/main threads
  • llmcore.py: Fix tryparse unhandled exception on final fallback

Medium

  • agentmain.py: Fix 7 file handle leaks (open without with)
  • ga.py: Fix file handle leaks in code_run, _check_plan_completion

618dt and others added 2 commits August 17, 2026 15:32
…nerabilities

- agent_loop.py: Fix JSONDecodeError crash when LLM returns malformed tool args
- ga.py: Fix file_write prepend mode data loss on write failure (atomic write via tmpfile+rename)
- ga.py: Fix file handle leaks in code_run, _check_plan_completion
- ga.py: Sandboxed inline_eval - remove history exposure, restrict builtins
- agentmain.py: Fix thread safety - use self.lock for is_running/stop_sig mutations
- agentmain.py: Fix 7 file handle leaks (open without with)
- llmcore.py: Fix tryparse unhandled exception on final fallback
- ga_ultraplan.py: Add Bearer token auth to /exec HTTP endpoint
…c.compare_digest for auth

- ga.py: bare except → except Exception: in atomic write (prevents swallowing KeyboardInterrupt)
- ga.py: remove redundant import tempfile (already imported at top)
- ga.py: remove setattr from safe_builtins in inline_eval sandbox
- ga_ultraplan.py: use hmac.compare_digest() for constant-time token comparison
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Fix critical bugs: JSON crash, data loss, thread safety, security vulnerabilities

1 participant