Agent dep installs: wheels-only by default (RCE guard) - #252
Merged
Conversation
Research into BO-7 surfaced a more urgent, more narrowly-scoped gap than the one it was written around: packages/acb_skills/acb_skills/loader.py installs an agent repo's requirements.txt/pyproject.toml deps straight into the SHARED gateway venv via pip/uv, ahead of any tool-call permission gate — an sdist's setup.py / PEP 517 build backend can run arbitrary code during that install, in the gateway's own process. This runs before agents.py is ever imported, so none of the BO-7 tool-gating work (permission_policy.decide(), the injected- tool gate) covers it — the install step itself needed its own fix. _install_agent_deps() now appends --only-binary=:all: to the pip/uv install command by default: wheels only, which is a pure unzip with no code-execution step, and covers the overwhelming majority of PyPI. A new settings flag (agent_deps_allow_source_builds, default False) is the explicit, narrow opt-out for an environment that genuinely needs a source-only package — mirrors the existing AGENT_PERMISSION_MODE/AGENT_PERMISSION_DENY_PATTERNS pattern of an env/settings-gated policy control rather than a silent behavior change. New tests/unit/test_loader_deps_install.py locks the default (flag present), the opt-out (flag omitted), and the no-declared-deps no-op case. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01T3fbeuEeDLJe56fB34QvtQ
6 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fast, narrowly-scoped follow-up from BO-7 research:
loader.py's_install_agent_deps()installs an agent repo'srequirements.txt/pyproject.tomldeps straight into the shared gateway venv via pip/uv, ahead of any tool-call permission gate — an sdist'ssetup.py/PEP 517 build backend can run arbitrary code during that install, in the gateway's own process. This runs beforeagents.pyis ever imported, so none of #251's tool-gating work covers it; the install step itself needed its own fix, prioritized ahead of the bigger containerization phase since it's the more urgent, more tractable gap._install_agent_deps()now appends--only-binary=:all:to the pip/uv install command by default — wheels only, a pure unzip with no code-execution step, covering the overwhelming majority of PyPI.agent_deps_allow_source_buildssetting (defaultFalse) is the explicit opt-out for an environment that genuinely needs a source-only package, mirroring the existingAGENT_PERMISSION_MODE-style settings-gated policy pattern rather than a silent behavior change.Test plan
tests/unit/test_loader_deps_install.py: default install includes--only-binary :all:; the opt-out omits it; no declared deps never invokes installpytest tests/unit/— 2286 passed (2283 baseline + 3 new), 0 failuresGenerated by Claude Code