vh/ratatoskr
1
0
Fork 0
Code Issues 4 Pull Requests Actions Packages Projects Releases Wiki Activity

fix(deps): repin worldtree-sdk 1.0.0→1.1.1 (path-encoding correctness fix)

Browse Source 
worldtree-sdk 1.1.1 fixes the _build_path encoder (quote safe="" — a
caller-shaped `/`/`../` in a path param no longer traverses the URL).
Our 1.0.0 carried the bug and we DO pass caller-shaped params (web
hands request.path_params session_id/agent_id to the SDK; tier3 CLI
takes agent_id as an operator arg) — auth-rejected, but a real client-
correctness bug. Same frozen wire as 1.0.0 (drop-in); suite 494 green.
Also brings additive define_or_reuse + set_persona_state_raw (our
parity #6) + a 64 KiB error-body alloc cap.

KNOWN RESIDUAL (flagged to wtsdk-dev): 1.1.1's fix patched _build_path
(request.py) but MISSED the parallel inline URL construction in
turn_stream.py:185 (`/sessions/{quote(session_id)}/messages`, still bare
quote, default safe="/"). No upstream session_id format validation (only
a non-empty-str type check at :153). So our highest-traffic path — the
SSE turn stream, which the web console feeds a caller-shaped session_id —
remains traversable until wtsdk patches it. Release-only cadence: no tag.
This commit is contained in:
Vuong Hoang
2026-08-01 00:33:57 -07:00
parent 3ef3a5ef83
commit d3a36f7008
2 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pyproject.toml
+1 -1
View File
@@ -16,7 +16,7 @@ keywords = ["worldtree", "debug", "sse", "web", "observability"]
# owned by worldtree-sdk post-cutover (#20 slice-7 dropped httpx-sse).
dependencies = [
"httpx>=0.27",
"worldtree-sdk==1.0.0", # #20 cutover: the consumer client layer (gitea PyPI); the hand-rolled wrappers now live behind ratatoskr.wt
"worldtree-sdk==1.1.1", # #20 cutover: the consumer client layer (gitea PyPI); the hand-rolled wrappers now live behind ratatoskr.wt. 1.1.1 = path-encoding correctness fix (quote safe="" — a caller-shaped `/`/`../` in a path param no longer traverses the URL; we pass caller-shaped session_id/agent_id) + additive define_or_reuse / set_persona_state_raw (our parity #6) + 64 KiB error-body alloc cap. Same frozen wire as 1.0.0 (drop-in).
]
[project.optional-dependencies]
uv.lock
Generated
+4 -4
View File
@@ -509,7 +509,7 @@ requires-dist = [
{ name = "sqlite-vec", marker = "extra == 'provider'", specifier = ">=0.1.6" },
{ name = "starlette", marker = "extra == 'web'", specifier = ">=0.40" },
{ name = "uvicorn", extras = ["standard"], marker = "extra == 'web'", specifier = ">=0.30" },
{ name = "worldtree-sdk", specifier = "==1.0.0", index = "https://gitea.phasefinal.com/api/packages/vh/pypi/simple/" },
{ name = "worldtree-sdk", specifier = "==1.1.1", index = "https://gitea.phasefinal.com/api/packages/vh/pypi/simple/" },
]
provides-extras = ["web", "provider", "dev"]
@@ -897,12 +897,12 @@ wheels = [
[[package]]
name = "worldtree-sdk"
version = "1.0.0"
version = "1.1.1"
source = { registry = "https://gitea.phasefinal.com/api/packages/vh/pypi/simple/" }
dependencies = [
{ name = "httpx" },
]
sdist = { url = "https://gitea.phasefinal.com/api/packages/vh/pypi/files/worldtree-sdk/1.0.0/worldtree_sdk-1.0.0.tar.gz", hash = "sha256:0b87001fd90b304befe5e76d21a41dd093057a9d59f86a25189fab80defcd043" }
sdist = { url = "https://gitea.phasefinal.com/api/packages/vh/pypi/files/worldtree-sdk/1.1.1/worldtree_sdk-1.1.1.tar.gz", hash = "sha256:75a1f8ca405b22f0c20fdba0342b103a10ec280ee86671cae2407bd4279eb5b6" }
wheels = [
{ url = "https://gitea.phasefinal.com/api/packages/vh/pypi/files/worldtree-sdk/1.0.0/worldtree_sdk-1.0.0-py3-none-any.whl", hash = "sha256:ec9cb03ecdb4662bf1280a64316ee4545bb1330db42e3135f34f56e62c07f6c5" },
{ url = "https://gitea.phasefinal.com/api/packages/vh/pypi/files/worldtree-sdk/1.1.1/worldtree_sdk-1.1.1-py3-none-any.whl", hash = "sha256:ce8fd18b2778bcd5babf63b145b5903f02e51803d4cfc0571cc6baa28c59058a" },
]