[earakely-scale]

What and why

When a task loads an environment artifact into an MCP server or a website on a VM sandbox (the gateway deployment, which includes the default local provider), the env stages the file on the sandbox's host with a few bash lines. Those lines spliced in the artifact's file name and the env's name unquoted:

• MCPServerEnv: the docker exec … mkdir and rm -f <staged file> lines;
• WebsiteEnv: the docker compose exec, docker compose cp and rm -f lines.

A name holding shell syntax ran as commands on that host. On local, that host is the operator's machine, as the operator. The file name comes from whoever wrote the bundle or the stored artifact, so loading someone else's bundle was enough. The download before these lines already quoted the path, so the file was staged fine and the load still passed: nothing showed that a command had run.

This PR:

• Quotes the staging lines. MCPServerEnv removes the staged file through docker_cp(..., remove_source=True), which passes paths as arguments. WebsiteEnv quotes the service, the paths and the compose file.
• Refuses a file name that isn't one plain name before anything runs: one with a / or \, ., .., an empty name, or a control character. The env builds host and container paths from it (/data/<name>), so a name with a / could reach outside the staging directory. Names written by FileArtifact.put and bundle folders are basenames already; put_bytes(filename=...) and stored documents could carry others.

The env name itself isn't validated here. Its other uses, in the compose file and the deploy script, need their own change.

How it was tested

• Unit: tst/unit/env/envs/test_artifact_staging.py (new). A real LocalSandbox runs each env's staging lines, with a stub docker that logs its arguments. The cases are file and env names with ;, $(), backticks, quotes and spaces: each is staged and copied as one argument, the staged file is removed, and nothing runs. Names that aren't one plain file name are refused before any command runs. On main the same tests fail: the injected touch runs and the copy's arguments split. The full unit suite passes (11,348 passed, 66 skipped).

• Integration: test_gateway_with_agentenv_environment and test_gateway_with_website_env_v1 now also load a seed named $(touch pwned) \touch pwned`.jsonthrough a real gateway, and check that it loads and that nopwned` file appears.

• End to end on Linux (Ubuntu 24.04 box, local provider): a bundle whose environment artifact file is named $(touch pwned) \touch pwned`.json, run with agent-env run`:

  • main (33a9eab): the task passes, and pwned appears in the operator's working directory.
  • This branch: the task passes with the seed loaded, and no pwned file appears.

• Regression on the same box, against this branch: the local-provider integration tests that deploy envs and load artifacts into them. That's env/gateway/gateway_test.py, env/envs/server_env_local_test.py, env/envs/multi_env_local_test.py, env/task_step/task_steps_test.py, cli/run_bundle_built_envs_test.py and cli/run_bundle_cli_folder_test.py.

  • Result: 51 passed, 0 failed, in 33 min.
  • Every one of the 627 skips is a declared capability gap: remote_sandbox (535), mcp_server_sources (64), default_a2a_agent (20) and model_endpoint_configured (8).
  • The two extended gateway tests also ran against main's source, and both fail there. The MCP server load passes, but pwned appears. The website's docker compose cp line splits on the name, and the copy fails.

• Stress, on a second Linux box (local provider, this branch):

  • The parallel fast integration suite (-m 'not int_test_slow' -n auto) ran 3 times: 175 passed each time.
  • The artifact-load integration set above then ran 3 more times in a row: 51 passed and 0 failed each time, with only the allowed capability skips.

• modal_vm: test_gateway_with_multi_mcp_server[modal_vm] and test_gateway_triggers_extension[modal_vm] both passed on real Modal VM sandboxes. They load a universe and an environment artifact into MCP servers, so the changed staging path, including docker_cp(..., remove_source=True), runs over modal_vm's exec transport. No existing website test is parametrized by provider, so the website path ran on local only.

🤖 Generated with Claude Code

Confidence Score: 5/5

The PR appears safe to merge; no actionable issues were found.

Summary

The PR makes artifact staging treat names as data rather than shell commands.

• MCP servers and website envs keep artifact names literal while staging files.

Scope acknowledgment: earakely-scale explicitly deferred other uses of the environment name in compose generation and deployment scripts.

_{Reviews (1) · Last reviewed commit: "fix(env): stage a loaded artifact withou..." · Reviewed by Greptile}