Skip to content

Release v0.9.7: Security Validation and Connector Contract - #88

Merged
wxai-space merged 1 commit into
mainfrom
codex/develop-v0.9.7
Aug 15, 2026
Merged

Release v0.9.7: Security Validation and Connector Contract#88
wxai-space merged 1 commit into
mainfrom
codex/develop-v0.9.7

Conversation

@wxai-space

Copy link
Copy Markdown
Collaborator

Summary

  • Add a dependency-free ConnectorManifest, offline validator, structured diagnostics, and top-level public APIs for composing existing Tools, Skills, MCP settings, Hooks, memory adapters, optional extras, and documentation.
  • Add credential-free local research and enterprise API connector examples, with tests proving validation does not execute components or perform network access.
  • Expand Python executor AST hardening for aliases, dynamic dispatch, getattr, attrgetter, __dict__/subscript access, dangerous builtins, nested imports, and safe false-positive cases.
  • Expand shared Graph Memory adversarial coverage and add an explicitly opt-in Mem0 Graph backend matrix without overstating the framework mitigation as a complete backend fix.
  • Add Connector, Python executor security, shared Graph Memory validation, and v1.0 public API compatibility documentation.
  • Bump the package version to v0.9.7 and update the roadmap.

Compatibility

  • Existing agent.run("hello"), structured results, streaming, LightFlow, Hooks, Guardrails, review, and memory APIs remain compatible.
  • Connector manifests compose existing extension points and do not introduce a parallel plugin runtime.
  • Connector validation does not install dependencies, start MCP services, call tools/hooks, or perform default network requests.
  • No new required core dependency is introduced.

Security Scope

The tracked fake-backend tests validate LightAgent's framework boundary against destructive shared-memory behavior. The real Mem0 Graph test remains opt-in and must run against the exact isolated backend version and storage configuration before issue #39 can be scoped or closed.

Testing

  • Full future-CI suite: 193 passed, 1 skipped
  • Skipped: opt-in real Mem0 Graph backend matrix
  • python -m compileall -q ... passed
  • git diff --check passed
  • Wheel build passed: lightagent-0.9.7-py3-none-any.whl
  • Wheel metadata verified: Version: 0.9.7, Requires-Python: >=3.10,<4.0

Closes #5
Refs #39

@wxai-space
wxai-space marked this pull request as ready for review August 15, 2026 07:19
@wxai-space
wxai-space merged commit b070815 into main Aug 15, 2026
4 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Define a lightweight plugin and connector contract

1 participant