| 2026-03-04 |
Generated |
Initial threat model |
| 2026-03-04 |
Updated |
Added C13 (Functional API), C14 (BaseCache), DF11. Updated T1 for
BaseCache/serde event hooks. Added GHSA-mhr3-j7m5-c7c9 and
GHSA-9rwj-6rc7-p77c. Updated CLI config scope. Added External Context
section. |
| 2026-03-27 |
Deep refinement |
Mode upgraded to Deep. Added: Data Classification
section (DC1-DC8 with detailed analysis for Critical/High entries).
Added: C15 (Serde Event Hooks), C16 (Auth System). Added: Default?
column to Components. Added: Classification column to Data Flows. Added:
DF12-DF13 (SDK redirect flows). Added: T9 (SDK API key leak via Location
redirect), T10 (EncryptedSerializer encryption bypass), T11 (unbounded
checkpoint retention). Added: Validation column to Threats with flaw
validation for High/Critical. Added: Investigated and Dismissed section
(D1-D3: SQL injection and CLI command injection disproven). Added: Input
Source Coverage section. Updated external context with
GHSA-g48c-2wqr-h844 (new published advisory). Updated all code
references to file:SymbolName notation. Expanded trust boundary
details. |
| 2026-03-30 |
Diagram and Default? corrections |
Fixed architecture diagram: merged “User Code” and “User-Registered
Tools” into single “User Application Code” boundary; removed @entrypoint/@task as separate diagram
elements (both compile to Pregel — authoring style, not separate
component). Fixed Default? column: C3 ToolNode → No (explicit opt-in
required); C8 CLI → No (separate install). |
| 2026-03-28 |
Deep update |
Added: C17 (SDK Encryption Handlers — beta at-rest
encryption framework). DC9 (SDK Encryption context metadata). TB5 (SDK
Encryption Handler boundary). DF14 (ToolRuntime injection flow), DF15
(Encryption handler registration flow). D4 (Tool argument injection via
InjectedState dict-splatting — disproven with 4-layer defense evidence).
Updated: C1 description (v1/v2 output, durability
modes, interrupt_before/after). C2 description (SAFE_MSGPACK_TYPES now
47 entries including langchain_core messages, Document, GetOp). C3
description (InjectedState/InjectedStore/ToolRuntime injection support,
_inject_tool_args entry point). C8 description (WebhookUrlPolicy for
SSRF protection). TB1 details (tool injection merge order guarantees).
TB2 details (47 safe types, updated allowlist composition). TB4 details
(WebhookUrlPolicy). DF4 description (injection merge semantics). T1
details (noted secure_pickle.py proposed but never merged). T4 details
(Interrupt deprecated_kwargs ns parameter). Input Source Coverage (LLM
output row updated with injection validation points, encryption handler
row added). Out-of-Scope Threats (malicious encryption handler pattern
added). Commit updated to 0ba22143. External context confirmed no new
published advisories. |