Three security fixes from code review:
1. CRITICAL: Block Container-domain tools from executing on the
orchestrator host. The ToolExecutor now checks tool.domain() and
rejects Container tools with PtcError::DomainBlocked, preventing
sandbox escape / RCE.
2. MEDIUM: Floor client-provided nesting_depth at 1 instead of trusting
the worker's value. A malicious worker can no longer send
nesting_depth=0 to bypass MAX_NESTING_DEPTH.
3. MEDIUM: Redact tool parameters in SSE JobToolUse events to prevent
leaking sensitive data (API keys, passwords) to web UI observers.
4. Python SDK: Always send timeout_secs to server and use server_timeout+5
for client-side HTTP timeout to prevent premature client timeouts.
Regression test: test_container_domain_blocked verifies Container-domain
tools are rejected.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
- Fix Python SDK client timeout to use actual timeout_secs + 5s buffer
instead of enforcing 60s minimum
- Cap tool execution timeout at MAX_TIMEOUT_SECS instead of falling
back to default when exceeded
- Use RAII guard for tool_nesting_depth to ensure decrement on panic
Co-Authored-By: Claude Opus 4.6 <[email protected]>
- Python SDK: remove 60s minimum timeout enforcement, respect
requested timeout with 5s network buffer
- Rust executor: cap timeout at MAX_TIMEOUT_SECS instead of
falling back to default when exceeded
- WASM wrapper: use RAII guard for nesting depth to prevent
leak on panic
Addresses Gemini review feedback on PR #408.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
Add ToolExecutor for standalone tool dispatch used by both the
orchestrator HTTP RPC endpoint and the WASM tool_invoke host function.
Includes Python SDK for container scripts, WASM test fixture, and
comprehensive E2E test coverage across all PTC paths.
Implementation:
- ToolExecutor with timeout, nesting depth limit, safety sanitization
- Orchestrator POST /worker/{job_id}/tools/call endpoint with SSE events
- WASM tool_invoke host function with alias resolution
- Python SDK (stdlib-only) with call_tool + convenience wrappers
Tests (16 new):
- 6 orchestrator HTTP RPC tests (auth, echo, not-found, timeout, SSE, no-executor)
- 3 executor integration tests (sanitization, invalid params, sequential)
- 4 Python SDK tests (env vars, request format, HTTP error, wrappers)
- 3 WASM E2E tests (echo via alias, alias not granted, no capability)
Refs #407
Co-Authored-By: Claude Opus 4.6 <[email protected]>
