Hacktoberfest 2026: as issues que os mantenedores marcaram para outubro, abertas e boas para iniciantes. Ver issues do Hacktoberfest

create-task.sh templating: name/description text containing a frontmatter key substring corrupts the file

Aberta Para iniciantes
  • Algo errado?
#39 0 comentários 0 reações 0 responsáveis Ver no GitHub

Ninguém assumiu esta issue ainda.

Avaliação

Dificuldade
2/5
Tempo estimado
1-3 horas
Facilidade para iniciantes
76/100
Tipo de issue
Bug
Clareza
Claramente especificada
Status de atividade
Ativa
Stack de tecnologia
python, shell
Domínio
backend, cli

Direção de pesquisa

Comece em agents/task-create/create-task.sh, por volta das linhas 495–510, e inspecione o bloco de templating em Python e suas substituições. Verifique como name e description são inseridos em relação às substituições dos campos de frontmatter; reproduza com os exemplos fornecidos owner:human ou workflow_type:. Está concluído quando o texto do chamador é preservado, os campos obrigatórios de frontmatter são preenchidos e o arquivo da tarefa passa pela validação do esquema.

Escrita pelo modelo de indexação a partir do texto da issue.

Descrição

Context

  • Framework version: 1.6.768
  • Project: 1409-sprind (shared-tooling mode)
  • Reported: 2026-09-21T12:06:04Z

Description

Symptom

agents/task-create/create-task.sh can silently write a schema-invalid task file (required fields blank) and silently corrupt the caller-supplied name/description text, with no error raised, when the name or description happens to contain certain substrings.

Root cause

Around line 495-510, the Python templating block runs a sequence of t.replace(old, new, 1) calls in this order:

t = t.replace('name:', 'name: "' + name... , 1)
t = t.replace('description: >', 'description: >\n' + indent_block(desc), 1)
t = t.replace('status: captured', 'status: ' + e['TC_STATUS'])
t = t.replace('workflow_type:', 'workflow_type: ' + e['TC_WORKFLOW_TYPE'], 1)
t = t.replace('owner:', 'owner: ' + e['TC_OWNER'], 1)
t = t.replace('horizon: now', 'horizon: ' + e['TC_HORIZON'])
t = t.replace('tags: []', 'tags: ' + e['TC_TAGS_YAML'])
t = t.replace('related_tasks: []', 'related_tasks: ' + e['TC_RELATED_YAML'])
...

The name and description are spliced into t first. The subsequent replace(..., 1) calls for workflow_type:, owner:, tags: [], related_tasks: [], horizon: now, created:, last_update: all match the first literal occurrence anywhere in t — not the frontmatter key specifically. Since t now contains the caller's free-text name/description before the real frontmatter lines further down, any of those literal substrings appearing inside the caller-supplied text is matched instead of the intended frontmatter line.

Reproduction (both observed in one session against a real fw task create call)

  1. --name containing the literal text owner:human (as a natural-language description of an ownership condition) → written file: the name: frontmatter field reads "...owner: agenthuman..." (the string agent was spliced into the middle of the caller's own text), and the real owner: frontmatter line was left blank (a required field).
  2. --description containing the literal text workflow_type: → written file: the description text is corrupted with workflow_type: build spliced in mid-sentence, and the real workflow_type: frontmatter line was left blank (a required field).

Both corrupted files passed task creation with no warning or error — the schema-required fields being blank went undetected until a later gate (fw bvp estimate, in this case) refused to operate on the task.

Why it matters

This is a data-integrity bug in the framework's own primary task-creation entrypoint: required fields can end up silently blank, and free-text content the caller explicitly wrote is silently mangled, with zero error signal. Any task whose subject matter is about frontmatter fields (which is common for meta/tooling tasks, audit findings about the task schema itself, etc.) is at risk of triggering this.

Suggested fix

Anchor each frontmatter-field replace to the actual frontmatter line rather than a bare substring — e.g. a re.sub(r'^workflow_type:$', ..., t, count=1, flags=re.MULTILINE) (matching the empty-value template line specifically) instead of str.replace('workflow_type:', ..., 1). Alternatively, perform all frontmatter-field substitutions before splicing in the caller-supplied name/description text, so free text can never be a match target.

Scope note

Filed from a downstream project using .agentic-framework/ in shared-tooling (vendored, read-only) mode.

Reported via fw upstream report from field installation

Linguagem predominante
Shell
Estrelas
16
Forks
6
Merge médio
6h 24min
PRs com merge (30d)
5

Preparar o ambiente

Primeiros passos

  1. Leia a issue inteira e depois o guia de contribuição do projeto.
  2. Comente na issue dizendo que vai assumir — evita que duas pessoas façam o mesmo trabalho.
  3. Faça um fork do repositório e trabalhe em uma branch.
  4. Abra um pull request que referencie o número da issue.

Mais de DimitriGeelen/agentic-engineering-framework

Todas as issues de DimitriGeelen/agentic-engineering-framework

Issues semelhantes

Mais issues de Shell/Bash

Receba novas issues na sua caixa de entrada

Um resumo curto de issues do GitHub para quem está começando.