Process And Pty Control

Agent runs commands.run('pytest -q') in the sandbox and must decide pass/fail from the result.

Branch on the command's exit code, not on whether stdout is non-empty: exit 0 is success, non-zero is failure, and stderr may carry the actionable message. Read stdout and stderr as separate streams. Surface the exit code to the model so it can decide whether to fix and re-run.

A build command emits output over 90 seconds. The agent wants live logs rather than a single blob at the end.

Attach stdout/stderr handlers to stream command output as it is produced, and still read the final result for the authoritative exit code. Treat streamed lines as progress, not as the terminal success signal. Bound the command with a timeout so a hung build does not run indefinitely.

The model builds a shell command by interpolating a user-supplied string, e.g. commands.run(f'ls {user_dir}') where user_dir is attacker-controlled.

Avoid string-interpolating untrusted input into a shell command; pass arguments as a list / use safe quoting so injected shell metacharacters cannot run arbitrary commands. The sandbox limits blast radius to the microVM, but injection can still trash the task, read in-sandbox secrets, or abuse netw…