From 3fd242eb946aac4c6683ae5459f31402ddcc44f7 Mon Sep 17 00:00:00 2001
From: Dnyaneshvn <dvnimbalkar24@gmail.com>
Date: Thu, 20 Aug 2026 17:35:44 +0530
Subject: [PATCH] Catch tool names bordered by . : - in the A2A progress
 leak-guard

_clean_update only treated "_" as a word boundary when checking for echoed tool
names, but the normaliser keeps ".", ":" and "-". So a tool name next to one of
those ("bash-based", "edit.py") got past the guard and sent to the untrusted
remote agent via a2a_reply.

- match echoed tool names across any non-alphanumeric boundary, not just "_"
- add tests for names bordered by "-", "." and ":"

Fixes #66
---
 inkbox_claude/a2a_progress.py |  2 +-
 tests/test_a2a_gateway.py     | 16 ++++++++++++++++
 2 files changed, 17 insertions(+), 1 deletion(-)

diff --git a/inkbox_claude/a2a_progress.py b/inkbox_claude/a2a_progress.py
index 51c9934..266cc6e 100644
--- a/inkbox_claude/a2a_progress.py
+++ b/inkbox_claude/a2a_progress.py
@@ -107,7 +107,7 @@ def _clean_update(value: Any, tool_names: list[str]) -> str:
         return _fallback_update()
     normalized_text = _normalize_identifier_text(text)
     if any(
-        re.search(rf"(?:^|_){re.escape(tool_name)}(?:_|$)", normalized_text)
+        re.search(rf"(?<![a-z0-9]){re.escape(tool_name)}(?![a-z0-9])", normalized_text)
         for tool_name in tool_names
         if tool_name
     ):
diff --git a/tests/test_a2a_gateway.py b/tests/test_a2a_gateway.py
index fced570..75984d1 100644
--- a/tests/test_a2a_gateway.py
+++ b/tests/test_a2a_gateway.py
@@ -646,6 +646,22 @@ def test_a2a_progress_summary_rejects_echoed_tool_identifier():
         )
 
 
+def test_a2a_progress_summary_rejects_tool_identifier_across_separators():
+    # The leak guard must suppress an echoed tool name regardless of the
+    # surrounding punctuation, not only underscores. The remote agent controls
+    # the task text (an untrusted prompt-injection surface), and the update is
+    # sent on to that untrusted agent, so a tool name bordered by '-', '.', or
+    # ':' must not slip through to them.
+    for update in (
+        "Running bash-based checks now",
+        "Inspecting the bash.exe helper",
+        "Using bash:mode for this step",
+    ):
+        assert progress_mod._clean_update(update, ["bash"]) == (
+            "I'm continuing the requested work."
+        )
+
+
 def test_a2a_progress_tool_names_are_bounded_and_do_not_retain_inputs():
     progress_mod.start_a2a_progress("task-1")