Harden sandbox return boundary by replacing host-side pickle deserialization

[Copilot]

Host-side RuntimeClient was deserializing sandbox return payloads with pickle.loads, allowing sandbox-influenced objects to execute code on the host during decode. This change moves return-value transport to msgpack decoding on the host boundary while preserving existing callable/argument behavior.

• Boundary hardening (host decode path)

  • Replaced host-side return decoding from pickle.loads(...) to unpack(...) (msgpack codec).
  • Added strict payload-type checks and explicit security-oriented decode errors for malformed/non-msgpack return payloads.

• Return-value wire format change (worker → host)

  • Worker now encodes RemoteResponse.value with shared msgpack codec (pack(result)) instead of pickling return objects.
  • Argument transport remains unchanged (pickle.dumps((args, kwargs))) to keep callable invocation behavior stable.

• Protocol/docs alignment

  • Updated runtime protocol and architecture docs to reflect: args are pickle, return values are msgpack.
  • Updated wire-model/framing descriptions accordingly.

• Test updates + security regression

  • Updated runtime tests that previously unpickled return payloads to use msgpack decode.
  • Added a focused regression test proving a malicious pickle payload is rejected by host decode and does not execute host-side effects.

def _decode_result_value(raw: Any) -> Any:
    if raw is None:
        return None
    if isinstance(raw, memoryview):
        raw = raw.tobytes()
    elif isinstance(raw, bytearray):
        raw = bytes(raw)
    if not isinstance(raw, bytes):
        raise RuntimeError("sandbox return value must be msgpack bytes; ...")
    return unpack(raw)

[Meirtz]

Review — the concern is real, but this fix breaks the plugin ecosystem as written

#116 is a genuine, present issue on master. The host decodes return bytes that originate inside the sandbox using pickle (agentix/runtime/client/client.py:111, at both the HTTP /call reply :274 and the SIO result :328; the worker packs returns at invoker.py:89). The trust model is what makes it matter: the sandbox runs autonomous agent code while the host holds the real credentials, so hardening the host-side decode of sandbox-produced bytes is a reasonable goal. This shouldn't be closed.

But the fix, as written, breaks essentially every non-dict/bytes remote target. msgpack can't encode a dataclass, and master's codec only has ndarray + pydantic extension hooks — so all seven shipped dataclass-returning targets would fail worker-side with ResultEncodeError:

• agentix.bash.run → BashResult, agentix.bash.run_stream → BashEvent union
• agentix.files.upload → UploadResult
• swe.prepare_env → PrepareEnvResult
• agentix.agents.claude_code.run → ClaudeCodeResult
• qwen_code.run → Result
• abridge TunnelHandle

And even a pydantic return decodes host-side to a plain dict, so every example's attribute access — r.exit_code, prepared.ok, result.returncode, svc.url, diff.stdout — breaks with AttributeError. The added regression test only checks the failure mode is neutralized; it doesn't exercise a real dataclass return, so CI stays green while the plugins/examples would fail at runtime (examples aren't in the pytest run, which is why this isn't caught).

It also contradicts the stated direction and conflicts with #122. ROADMAP is explicit that pickle is the default for "args, kwargs, and return values" and msgpack is a future optional path alongside pickle, not a replacement. Meanwhile #122 keeps returns on pickle and deletes the codec's extension hooks entirely — so #118 and #122 edit the same codec.py / PROTOCOL.md lines in opposite directions and cannot both merge without reconciliation.

Design options for the maintainers (this is a real decision, not a mechanical fix):

1. Restricted decode path — keep pickle for returns but decode host-side through an allowlist that refuses arbitrary object reconstruction. Preserves the "any Python object round-trips" surface ROADMAP promises; smallest blast radius.
2. msgpack returns + a dataclass codec hook — go the Harden sandbox return boundary by replacing host-side pickle deserialization #118 direction but first extend codec.py to encode/reconstruct dataclasses, so the plugin ecosystem keeps working. Larger change; must land before or with the switch.
3. Typed returns — constrain targets to declared return schemas.

I'd lean (1) as the least-disruptive way to actually address #116 while honoring the ROADMAP surface, but it's your call. Flagging rather than merging or closing, since whichever way this goes needs to be reconciled with #122's codec changes.

[Meirtz]

Closing as superseded. The host-side deserialization concern (#116) is being addressed on a different axis: a restricted-unpickler allowlist that fixes the escape vector without changing the return-value wire format — the msgpack-for-returns approach here would break every dataclass-returning shipped target (BashResult, ClaudeCodeResult, PrepareEnvResult, TunnelHandle, …) and conflicts with the codec work landing via the PR #122 split. Thanks for the initial fix; the direction we're taking keeps pickle as the default per the roadmap. Tracking the hardening under #116.