mirror of
https://github.com/rennf93/roboco.git
synced 2026-08-03 07:23:24 +02:00
879afc14a4
* fix(board): LEARN decisions name the item, not its per-cycle index A cycle's reject reasons are rendered into the NEXT cycle's exploration prompt, but the ref recorded alongside each reason was the item's stored id (item-0/item-1) — a per-cycle index that means something different every cycle and appears nowhere the explorer can resolve. The reason survived the loop; what it was about did not. Record the item's title instead, via a shared learn_ref() helper (falls back to the id when title-less, and reads target_task_title for Scales, whose items name the live task they mutate). * chore(lint): satisfy ruff 0.16 — keyword-only signatures and markdown formatting The dev toolchain resolved ruff 0.16.0, which stabilises PLR0917 (too many positional arguments) and formats python code blocks inside markdown. Both fired repo-wide and neither had anything to do with the code they flagged. - 36 signatures gain a `*` so their tail arguments are keyword-only, and the 104 call sites that passed them positionally are converted. mypy was the safety net for the static ones; the full suite caught nine more that only bind at runtime (the MCP tool functions, whose real callers already pass named JSON arguments). - 28 markdown files reformatted by 0.16's code-block formatter. - One RUF036 (`None` mid-union) autofixed in the GitLab provider. * fix(gateway): log the reason when a verb rejects A rejected envelope rides an HTTP 200, its body is never logged, and there is no trace table — so in the access log a verb an agent could not satisfy looks identical to one that worked. On 2026-07-25 four Board Programs (Periscope, Sentinel, Scales, Barfly) each POSTed their propose verb three or four times, persisted nothing, and left their exploration tasks PENDING; the reason was unrecoverable afterwards, from the logs or from the agents' own transcripts. Log error/message/remediate/missing plus the calling agent at envelope_to_response — the one chokepoint every v1 flow and do route returns through. Success envelopes stay silent. --------- Co-authored-by: Renn F <rennf93@users.noreply.github.com>
88 lines
1.4 KiB
Markdown
88 lines
1.4 KiB
Markdown
# Python Security Standards
|
|
|
|
## No Hardcoded Secrets
|
|
|
|
NEVER hardcode secrets:
|
|
|
|
```python
|
|
# Bad - NEVER
|
|
API_KEY = "sk-abc123xyz789"
|
|
DATABASE_URL = "postgresql://user:password@host/db"
|
|
|
|
# Good - environment variables
|
|
from pydantic_settings import BaseSettings
|
|
|
|
|
|
class Settings(BaseSettings):
|
|
api_key: str
|
|
database_url: str
|
|
model_config = {"env_prefix": "ROBOCO_"}
|
|
```
|
|
|
|
## SQL Injection Prevention
|
|
|
|
NEVER use string concatenation for SQL:
|
|
|
|
```python
|
|
# Bad - SQL injection vulnerability
|
|
query = f"SELECT * FROM users WHERE id = '{user_id}'"
|
|
|
|
# Good - parameterized query
|
|
result = await session.execute(select(User).where(User.id == user_id))
|
|
```
|
|
|
|
## Command Injection Prevention
|
|
|
|
NEVER pass user input directly to shell:
|
|
|
|
```python
|
|
# Bad - command injection
|
|
import os
|
|
|
|
os.system(f"process_file {filename}")
|
|
|
|
# Good - use subprocess with list
|
|
import subprocess
|
|
|
|
subprocess.run(["process_file", filename], check=True)
|
|
```
|
|
|
|
## No eval() or exec()
|
|
|
|
NEVER use on untrusted input:
|
|
|
|
```python
|
|
# Bad - code injection
|
|
result = eval(user_input)
|
|
|
|
# Good - safe parsing
|
|
import ast
|
|
|
|
result = ast.literal_eval(user_input) # Only literals
|
|
```
|
|
|
|
## Non-Security Hashes
|
|
|
|
When hashing for non-security purposes:
|
|
|
|
```python
|
|
import hashlib
|
|
|
|
content_hash = hashlib.md5(
|
|
content.encode(),
|
|
usedforsecurity=False, # Required flag
|
|
).hexdigest()[:12]
|
|
```
|
|
|
|
## Security Tools
|
|
|
|
Run before merge:
|
|
|
|
```bash
|
|
# Security scan
|
|
uv run bandit -r roboco/ -ll
|
|
|
|
# Dependency audit
|
|
uv run pip-audit
|
|
```
|