0.65.7 — Security hardening

Hardens the GHSA-gjgq-w2m6-wr5q tool-origin filter against content laundering. Recommended for anyone running multi-agent flows that forward untrusted content (directly, or indirectly via RAG) through orchestration tools.

:::bash
pip install -U langroid

Security hardening

Tool-origin filter could be bypassed by laundering untrusted content (#1035, [#1038])

The GHSA-gjgq-w2m6-wr5q fix (0.65.3) blocks raw USER-origin tool JSON from invoking a handle=True, use=False handler. But langroid tools are JSON in message content, and the per-message tools_from_agent trust flag could be laundered: an agent that forwards untrusted user content through DonePassTool / AgentDoneTool re-emits tools parsed from that content as structurally-trusted agent tools, which — after a Task relabels the result to USER — the filter would still dispatch. This re-opened the same handle-only dispatch bypass for user-supplied JSON in multi-agent setups.

Fix: a tainted distrust signal on ChatDocMetaData. External user input is marked tainted at every entry point (ChatDocument.from_str, to_ChatDocument, create_user_response, the interactive user_response path, Task.init, and top-level USER ChatDocument inputs); the mark propagates through deepcopies and the DonePassTool / AgentDoneTool repackage; and _filter_user_origin_tools drops handle-only tools from a tainted message even when tools_from_agent is set. Legitimate agent→agent handoffs (LLM-emitted tools, which are never tainted) are unaffected.

Out of scope (the LLM-trust boundary): an LLM prompt-injected into emitting tool JSON in its content — taint cannot flow through an LLM generation. Tracked in #1035.

Behavior change

By default, a message derived from external user input no longer dispatches use=False, handle=True tools, even across a multi-agent handoff that relabels the sender to USER. Genuine LLM- or agent-emitted tool handoffs are unchanged, and no configuration changes are required.

Upgrade

:::bash
pip install -U langroid

Full changelog: 0.65.6...0.65.7