Skip to content

Python: Improve atomic writes for Memory and Todos - #9412

Merged
westey (westey-m) merged 2 commits into
microsoft:mainfrom
westey-m:python-momory-todo-security-file-save
Oct 15, 2026
Merged

westey (westey-m) merged 2 commits into
microsoft:mainfrom
westey-m:python-momory-todo-security-file-save

Conversation

@westey-m

Copy link
Copy Markdown
Collaborator

Motivation & Context

Both memory and todos had their own copy of atomic write capabilies

Description & Review Guide

Centralize functionality with some small improvements.

Related Issue

Fixes #

AI Assistance

  • No material AI assistance was used.
  • This is an AI-assisted contribution. I reviewed, understood, and verified all submitted content and accept responsibility for it.

AI assistance details:

Contribution Checklist

  • The code builds clean without any errors or warnings
  • All unit tests pass, and I have added new tests where possible
  • The PR follows the Contribution Guidelines
  • This PR links to an agreed issue with no competing open PR, or the Related Issue section documents a trivial-change or repository-automation exception.
  • This is not a breaking change. If it is a breaking change, add the breaking change label (or add "[BREAKING]" to the title prefix, before or after any language prefix) — a workflow keeps the label and title prefix in sync automatically.

Copilot AI balanced review requested due to automatic review settings October 15, 2026 11:50
@agent-framework-automation agent-framework-automation Bot added documentation Usage: [Issues, PRs], Target: documentation in the code base and learn docs python Usage: [Issues, PRs], Target: Python labels Oct 15, 2026
@github-actions github-actions Bot changed the title Improve atomic writes for Memory and Todos Python: Improve atomic writes for Memory and Todos Oct 15, 2026

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Changes recommended

Verified stream-initialization failures double-close the descriptor, masking the original error and leaving temporary files behind.

1 open finding
What changed in this PR

Centralizes atomic file writes for Python memory and todo storage.

Changes:

  • Adds a shared helper with unique temporary filenames and exclusive creation.
  • Migrates both stores and documents storage-directory trust requirements.
  • Updates failure tests and adds symbolic-link protection coverage.
File Description
python/​packages/​core/​tests/​core/​test_harness_memory.py Updates shared-helper patching and cleanup assertions.
python/​packages/​core/​tests/​core/​test_filesystem.py Tests rejection of preexisting symbolic links.
python/​packages/​core/​AGENTS.md Documents the filesystem helper’s expanded role.
python/​packages/​core/​agent_framework/​_harness/​_todo.py Uses shared atomic writes and documents directory trust.
python/​packages/​core/​agent_framework/​_harness/​_memory.py Removes duplicate implementation and documents directory trust.
python/​packages/​core/​agent_framework/​_filesystem.py Implements shared atomic text writes.

🧠 Review effort: Balanced


💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

Comment thread python/packages/core/agent_framework/_filesystem.py Outdated

@github-actions github-actions Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

MAF Automated Review — Iteration 1

Result: No findings
Scope: full PR (1 commit(s)): 4c0a977b9052
Model: gpt-5.6-sol

Overview

This PR centralizes the Memory and Todo atomic-write implementations in a private filesystem helper while preserving the stores' serialization and public API contracts. UUID-based sibling names, exclusive creation, atomic replacement, and failure-path tests guard the primary corruption and temporary-file redirection risks. No Critical, High, or Medium issue remains after reconciliation.

Reviewed the supplied pull-request change set across correctness, security/reliability, architecture, and failure behavior.
No publishable findings remained after source verification for this scope.

@westey-m
westey (westey-m) added this pull request to the merge queue Oct 15, 2026
Merged via the queue into microsoft:main with commit 220aec4 Oct 15, 2026
49 checks passed
@westey-m
westey (westey-m) deleted the python-momory-todo-security-file-save branch October 15, 2026 12:18

This branch was successfully deployed

1 active deployment
github-app-auth — cdddad4e Deployed Oct 15, 2026 by westey-m via add_label #25448
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

documentation Usage: [Issues, PRs], Target: documentation in the code base and learn docs python Usage: [Issues, PRs], Target: Python

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants