0.65.7 — Security hardening

Hardens the GHSA-gjgq-w2m6-wr5q tool-origin filter against content
laundering. Recommended for anyone running multi-agent flows that forward
untrusted content (directly, or indirectly via RAG) through orchestration
tools.

pip install -U langroid

Security hardening

Tool-origin filter could be bypassed by laundering untrusted content (#1035, #1038)

The GHSA-gjgq-w2m6-wr5q fix (0.65.3) blocks raw USER-origin tool JSON from
invoking a handle=True, use=False handler. But langroid tools are JSON in
message content, and the per-message tools_from_agent trust flag could be
laundered: an agent that forwards untrusted user content through
DonePassTool / AgentDoneTool re-emits tools parsed from that content as
structurally-trusted agent tools, which — after a Task relabels the result to
USER — the filter would still dispatch. This re-opened the same handle-only
dispatch bypass for user-supplied JSON in multi-agent setups.

Fix: a tainted distrust signal on ChatDocMetaData. External user input is
marked tainted at every entry point (ChatDocument.from_str, to_ChatDocument,
create_user_response, the interactive user_response path, Task.init, and
top-level USER ChatDocument inputs); the mark propagates through deepcopies
and the DonePassTool / AgentDoneTool repackage; and
_filter_user_origin_tools drops handle-only tools from a tainted message even
when tools_from_agent is set. Legitimate agent→agent handoffs (LLM-emitted
tools, which are never tainted) are unaffected.

Out of scope (the LLM-trust boundary): an LLM prompt-injected into emitting
tool JSON in its content — taint cannot flow through an LLM generation. Tracked
in #1035.

Behavior change

By default, a message derived from external user input no longer dispatches
use=False, handle=True tools, even across a multi-agent handoff that relabels
the sender to USER. Genuine LLM- or agent-emitted tool handoffs are unchanged,
and no configuration changes are required.

Upgrade

pip install -U langroid

Full changelog:
0.65.6...0.65.7