[Paulo Salem (paulosalem)]

Summary

Promote development to main with TinyTroupe 0.8.1 and a fix for the reported CWE-918 SSRF path in webpage grounding.

• Route all webpage-grounding fetches, including deserialization-triggered fetches, through a controlled HTTP/HTTPS fetcher.
• Enforce exact hostname allowlisting, resolved-address restrictions, redirect validation, and connections pinned to validated addresses while preserving HTTPS certificate verification.
• Enable safeguards by default, with a small public-host starter allowlist and separate opt-in permissions for localhost/private networks. An explicit enforcement opt-out logs a warning.
• Preserve document identity and only mark URLs loaded after successful fetching/indexing.
• Add security regression coverage and update the README, example configuration guidance, and Investment Firm notebook documentation.
• Bump the patch version from 0.8.0 to 0.8.1.

Existing development changes included

This is a full development → main promotion, not a security-only branch. It also includes the existing DnD vision example with agent/image assets and the paper-experiment updates already on development.

Validation

• 98 security/configuration regression tests passed on the latest security/configuration changes.
• A broader targeted run previously passed 101 tests covering security, configuration, and credential-free grounding behavior.
• Reproduced the original nested TinyPerson.load_specification deserialization path: localhost (IPv4/IPv6), cloud metadata, an attacker hostname, and a lookalike hostname were all rejected before DNS/network access. Serialized attempts to disable the policy were ignored.
• Real local HTTP fixtures exercised permitted fetching and redirect rejection; an explicitly allowlisted public HTTPS fetch also passed.
• Confirmed example configurations inherit the safeguards and notebook code/output cells were unchanged.
• Full core/model-dependent regression runs could not complete because OpenAI credentials were unavailable; those runs were stopped, not counted as passing.

Security considerations

The reported SSRF path is remediated under secure defaults. Trusted application configuration can deliberately relax or disable destination restrictions. Deserialization still fetches approved pages, so this change is not a general guarantee that arbitrary serialized agents are safe. Campaign scanner revalidation is still required.