bash: clean_env option — run task commands in the image's environment#151
Merged
Conversation
The worker environment is deliberately bundle-polluted (PATH and seven other path vars get /nix/runtime prefixes so the runtime's own tools resolve), and bash.run inherits it verbatim — so a task command like `python -m pytest` in a task image resolves the bundle venv's python instead of the image's toolchain, and native binaries can load /nix libs via LD_LIBRARY_PATH. The swebench plugin already had to hand-roll the subtraction before running the official harness. Three pieces make the subtraction a first-class, complete contract: - The worker spawn now RECORDS what it strips: interpreter-hostile vars (PYTHONPATH, LD_PRELOAD, ...) were removed with no trace, making the image's originals unrecoverable; they land under AGENTIX_SAVED_<NAME>, mirroring the AGENTIX_ADDED_* convention for prepends. On nested spawns the freshly-observed value overwrites an inherited snapshot — the newest observation of the image env is authoritative. - get_env_without_agentix() restores AGENTIX_SAVED_* vars (a live value wins over its pre-strip snapshot) in addition to subtracting recorded path additions. - bash.run/run_stream gain clean_env=False: opt-in per call, because the default (worker env) is correct for runtime tools — the claude CLI and bundled rg live under /nix — while clean_env=True is correct for task commands. In clean mode the shell itself is also the image's bash (restored vars like LD_PRELOAD target it, not the Nix bash), with the bundled bash only as a last resort. Caller env overrides win last either way. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Meirtz
added a commit
that referenced
this pull request
Jul 4, 2026
Follow-up to #151 per maintainer review: a boolean flag on run/run_stream adds cognitive cost to a tool that should read like subprocess.run, and the mechanism to pick an environment already exists — you pass env=. So instead of a mode flag: - bash.run/run_stream env= now follows subprocess.run exactly: omit it to inherit the worker's environment (right for bundle tools — the claude CLI, bundled rg), pass a dict to REPLACE it wholesale. No merge, no flag. (No production caller passed a partial env expecting a merge — only tests, updated to the replace idiom.) - image_env() is the extracted helper the swebench scorer hand-rolled: get_env_without_agentix() plus BASH_ENV -> ~/.bashrc (derived from the RESULT env's HOME, so a stripped-and-restored or overridden HOME picks the right rc file). Canonical name: agentix.bash.image_env, re-exported next to run(); implemented in agentix.runtime.shared.env because that module owns the ADDED/SAVED contract and a cross-plugin import would not resolve statically in the pkgutil namespace layout. swebench's score.py now calls it instead of its private copy. - The shell binary follows the env's PATH like everything else the command resolves: the default worker env lists the bundled bash first (behavior unchanged for bundle calls), while an image_env() PATH selects the image's own bash — its restored LD_PRELOAD targets that binary, not the Nix one. image_env() reads the calling process's live environment, so it is only meaningful inside the sandbox; the docs show the host-side recipe (env = await c.remote(image_env)) and warn that evaluating it host-side would ship the host's environment into the container. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Meirtz
added a commit
that referenced
this pull request
Jul 4, 2026
…ag) (#154) Follow-up to #151 per maintainer review: a boolean flag on run/run_stream adds cognitive cost to a tool that should read like subprocess.run, and the mechanism to pick an environment already exists — you pass env=. So instead of a mode flag: - bash.run/run_stream env= now follows subprocess.run exactly: omit it to inherit the worker's environment (right for bundle tools — the claude CLI, bundled rg), pass a dict to REPLACE it wholesale. No merge, no flag. (No production caller passed a partial env expecting a merge — only tests, updated to the replace idiom.) - image_env() is the extracted helper the swebench scorer hand-rolled: get_env_without_agentix() plus BASH_ENV -> ~/.bashrc (derived from the RESULT env's HOME, so a stripped-and-restored or overridden HOME picks the right rc file). Canonical name: agentix.bash.image_env, re-exported next to run(); implemented in agentix.runtime.shared.env because that module owns the ADDED/SAVED contract and a cross-plugin import would not resolve statically in the pkgutil namespace layout. swebench's score.py now calls it instead of its private copy. - The shell binary follows the env's PATH like everything else the command resolves: the default worker env lists the bundled bash first (behavior unchanged for bundle calls), while an image_env() PATH selects the image's own bash — its restored LD_PRELOAD targets that binary, not the Nix one. image_env() reads the calling process's live environment, so it is only meaningful inside the sandbox; the docs show the host-side recipe (env = await c.remote(image_env)) and warn that evaluating it host-side would ship the host's environment into the container. Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Agentix sandboxes overlay the
/nixruntime bundle onto a task image, and the worker environment is deliberately bundle-polluted:PATHand seven other path vars get/nix/runtimeprefixes so the runtime's own tools resolve.agentix.bash.runinherits that env verbatim — so a task command likepython -m pyteston a SWE-bench image resolves the bundle venv's python (no task deps) instead of the image's conda/toolchain, and native binaries can load/nixlibs viaLD_LIBRARY_PATH. Theagentix-dataset-sweplugin already hand-rolls this subtraction (get_env_without_agentix()) before running the official harness; this makes it a first-class, complete contract.What
PYTHONPATH,LD_PRELOAD,NIX_*, …) were removed with no trace, making the image's originals unrecoverable. They now land underAGENTIX_SAVED_<NAME>, mirroring the existingAGENTIX_ADDED_*convention for prepends. On nested spawns the freshly-observed value overwrites an inherited snapshot (newest observation of the image env wins).get_env_without_agentix()restores them (a live value beats its pre-strip snapshot) in addition to subtracting recorded path additions.bash.run/run_streamgainclean_env=False— opt-in per call. The default (worker env) is correct for runtime tools (the claude CLI, bundledrglive under/nix);clean_env=Trueis correct for task commands. In clean mode the shell itself is the image's bash too (restored vars likeLD_PRELOADtarget it, not the Nix bash), with the bundled bash only as a last resort.Tests
New coverage for the save/restore round-trip, the nested-spawn overwrite rule,
clean_envenv construction, and image-bash resolution. Env-sensitive tests clear ambient strippable vars so they assert the production rule, not the runner's environment.Reviewed by a second co-author (Codex) + an adversarial multi-agent pass; confirmed findings folded in (stale-snapshot overwrite, image bash in clean mode, test isolation).
🤖 Generated with Claude Code