fix(RBR-943/RBR-1029): AGENT_HOME must be the run's own agent home, never a foreign agent's - #28
Merged
Merged
Conversation
…ever a foreign agent's Retarget of upstream PR paperclipai#11002 onto our fork's master (we do not have push/merge rights on paperclipai/paperclip; verified push:false). Re-applied the verified 2-file diff cleanly on top of current fork/master (rebase across 585 commits hit unrelated conflicts elsewhere; hand-applied just this diff instead, verified identical to the PR-head commit content). 13/13 new tests pass, 60/60 hermes-adapter suite passes, tsc --noEmit clean. Root cause: execute() built the child-process AGENT_HOME from whatever the adapter inherited or the config supplied, with no check that the value actually belongs to the agent running this specific execution. Under concurrent runs for different agents on the same host, one agent's run could inherit another agent's AGENT_HOME. Fix: resolveAgentHomeEnv() only accepts context.paperclipWorkspace.agentHome (the heartbeat-resolved, run-scoped value) or an inherited value that can be attributed to ctx.agent.id; anything else is dropped with a warning logged to the run, rather than silently passed through.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Retarget of upstream PR paperclipai#11002 onto our fork's master. We do not have push/merge rights on paperclipai/paperclip (verified:
gh api repos/paperclipai/paperclip -q .permissions-> push:false), so this ships via our fork instead per RBR-1028/RBR-1029.Content is the exact 2-file diff from the upstream PR (
execute.ts,execute.agent-home.test.ts), hand-applied cleanly on current fork/master (a straight rebase across 585 divergent commits hit unrelated conflicts elsewhere in the tree; this avoids touching anything outside the two intended files).Verified locally this run:
execute.agent-home.test.ts)tsc --noEmitclean on the packageCloses RBR-1028, RBR-1029 (land the RBR-943 AGENT_HOME isolation fix on a real, CI-tracked master we actually control).