Skip to content

v0.2.0a17

Pre-release
Pre-release

Choose a tag to compare

View all tags
@yfxiao16 yfxiao16 released this 04 Oct 17:52
v0.2.0a17
957cb52
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

A security release. It closes an external report (thanks to kta1kri) and the follow-ups that finishing it turned up. If you enforce contracts in production, upgrade. TypeScript @sponsio/sdk@0.2.0-alpha.7 carries the same fixes.

pip install --pre -U sponsio

A rule that cannot be evaluated no longer counts as satisfied

The common root of the report: missing input read as "not violated".

  • Tool names meet on one spelling. A rule on issue_refund used to miss Issue_Refund, issue_refund and mcp__finance__issue_refund, which is our own MCP wire format. must_precede then reported the rule as satisfied.
  • Amounts are read the way a model writes them. A cap that stopped 5000 let '$5,000', '5,000' and '5000 USD' through. This affected the library cap (arg_value_range, which YAML and the pattern factory produce) on both runtimes. A value that is present but is not a number is now refused instead of being compared as 0.
  • Missing arguments are refused when a rule reads them, including under MCP spellings. SPONSIO_ALLOW_MISSING_ARGS=1 restores the old behaviour.
  • Overflow ('1e400') blocks on both runtimes.

Behaviour changes

  • EscalateToHuman refuses the call. The docs said it refuses and notifies, but the call ran while the agent was told it was paused. It now returns a block with escalation=True. Use EscalateToHuman(hold=False) for notify-only.
  • A guard whose state was changed behind its API refuses (guard:tampered). This covers flipping the monitor to observe, emptying the contract list, and swapping a strategy. Code in the same process can still defeat the check itself, so it makes tampering visible but does not prevent it.

Host hooks (Claude Code, Cursor, OpenClaw)

  • sponsio host install <host> --strict refuses tools that have no contract library. Without it they still run, with a one-time running UNCHECKED warning.
  • The hook wiring is protected. .claude/settings.json and .cursor/hooks.json are covered now; previously the rules guarded only the rule files.
  • Deleting the rules directory is blocked. rm -rf ~/.sponsio used to remove every library.
  • The secret-exfiltration rule catches more forms. It no longer depends on the order of steps (SECRETS=$(env); curl -d "$SECRETS"), and it covers -F, --post-data and uploads.
  • Concurrent tool calls are counted correctly. rate_limit(Bash, 1) used to admit several parallel calls.
  • A reinstall keeps your defaults:, including mode and --strict.

Other

  • OpenAI with_raw_response / with_streaming_response are checked. If a tool call must be stopped, the guard raises ToolCallBlocked.
  • The cached cloud rulebook is verified with an HMAC before offline use. If you go offline right after upgrading, before a successful pull, the copy cached by an older version will be refused, because it has no HMAC.
  • The LangGraph whole-graph wrappers gate nodes before they run, and every other adapter gates the call its framework actually makes (independent verification by Trenyx).
  • sponsio --version is correct again. It had reported 0.2.0a11 since a12.

Full list in CHANGELOG.md.

Assets 2
Loading