create-task.sh templating: name/description text containing a frontmatter key substring corrupts the file

未关闭 适合新手
  • 哪里不对？
#39 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

还没有人认领这个 Issue。

评估

难度
2/5
预计耗时
1-3 小时
新手友好度
76/100
Issue 类型
缺陷
描述清晰度
描述清楚
活跃度
活跃
技术栈
python, shell
领域
backend, cli

调研方向

从 agents/task-create/create-task.sh 的第 495–510 行附近开始，检查 Python 模板处理代码块及其替换逻辑。检查相对于 frontmatter 字段替换，name 和 description 是如何插入的；使用提供的 owner:human 或 workflow_type: 示例进行复现。完成的标准是调用方文本得到保留，必需的 frontmatter 字段已填充，并且任务文件通过其 schema 验证。

由索引模型根据 Issue 内容生成。

描述

Context

  • Framework version: 1.6.768
  • Project: 1409-sprind (shared-tooling mode)
  • Reported: 2026-09-21T12:06:04Z

Description

Symptom

agents/task-create/create-task.sh can silently write a schema-invalid task file (required fields blank) and silently corrupt the caller-supplied name/description text, with no error raised, when the name or description happens to contain certain substrings.

Root cause

Around line 495-510, the Python templating block runs a sequence of t.replace(old, new, 1) calls in this order:

t = t.replace('name:', 'name: "' + name... , 1)
t = t.replace('description: >', 'description: >\n' + indent_block(desc), 1)
t = t.replace('status: captured', 'status: ' + e['TC_STATUS'])
t = t.replace('workflow_type:', 'workflow_type: ' + e['TC_WORKFLOW_TYPE'], 1)
t = t.replace('owner:', 'owner: ' + e['TC_OWNER'], 1)
t = t.replace('horizon: now', 'horizon: ' + e['TC_HORIZON'])
t = t.replace('tags: []', 'tags: ' + e['TC_TAGS_YAML'])
t = t.replace('related_tasks: []', 'related_tasks: ' + e['TC_RELATED_YAML'])
...

The name and description are spliced into t first. The subsequent replace(..., 1) calls for workflow_type:, owner:, tags: [], related_tasks: [], horizon: now, created:, last_update: all match the first literal occurrence anywhere in t — not the frontmatter key specifically. Since t now contains the caller's free-text name/description before the real frontmatter lines further down, any of those literal substrings appearing inside the caller-supplied text is matched instead of the intended frontmatter line.

Reproduction (both observed in one session against a real fw task create call)

  1. --name containing the literal text owner:human (as a natural-language description of an ownership condition) → written file: the name: frontmatter field reads "...owner: agenthuman..." (the string agent was spliced into the middle of the caller's own text), and the real owner: frontmatter line was left blank (a required field).
  2. --description containing the literal text workflow_type: → written file: the description text is corrupted with workflow_type: build spliced in mid-sentence, and the real workflow_type: frontmatter line was left blank (a required field).

Both corrupted files passed task creation with no warning or error — the schema-required fields being blank went undetected until a later gate (fw bvp estimate, in this case) refused to operate on the task.

Why it matters

This is a data-integrity bug in the framework's own primary task-creation entrypoint: required fields can end up silently blank, and free-text content the caller explicitly wrote is silently mangled, with zero error signal. Any task whose subject matter is about frontmatter fields (which is common for meta/tooling tasks, audit findings about the task schema itself, etc.) is at risk of triggering this.

Suggested fix

Anchor each frontmatter-field replace to the actual frontmatter line rather than a bare substring — e.g. a re.sub(r'^workflow_type:$', ..., t, count=1, flags=re.MULTILINE) (matching the empty-value template line specifically) instead of str.replace('workflow_type:', ..., 1). Alternatively, perform all frontmatter-field substitutions before splicing in the caller-supplied name/description text, so free text can never be a match target.

Scope note

Filed from a downstream project using .agentic-framework/ in shared-tooling (vendored, read-only) mode.

Reported via fw upstream report from field installation

主要语言
Shell
星标
16
派生
6
30 天内没有已合并 PR

环境准备

  • 提供 Dockerfile 或 Docker Compose 文件
  • 没有 Pull Request 模板
  • 阅读贡献指南

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

DimitriGeelen/agentic-engineering-framework 的其他 Issue

查看 DimitriGeelen/agentic-engineering-framework 的全部 Issue

相似的 Issue

更多 Shell/Bash Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。