cleveragents/cleveragents-core

Fork 3

Proposal: improve ca-test-infra-improver — fix Worker Mode bash permissions conflict causing initialization crash #2367

New issue

Open

opened 2026-04-03 17:23:23 +00:00 by freemo · 3 comments

freemo commented

2026-04-03 17:23:23 +00:00

Owner

Agent Improvement Proposal

Pattern Detected

Type: Permission conflict / initialization crash
Affected Agent: ca-test-infra-improver
Evidence:

Issue #2222 ("BUG: [Supervisor] Worker agent 'ca-test-infra-improver' is failing to initialize") documents this clearly:

The agent's Worker Mode section (lines 247-261 of ca-test-infra-improver.md) instructs the agent to run git clone, cd, git config, and rm -rf during initialization.
The agent's bash permissions (lines 18-33) only allow: echo $*, curl *, sleep *, jq *, cat *, ls *, find *, grep *, head *, tail *, wc *, git log*, git status*, git diff*.
git clone*, cd *, mkdir *, and rm -rf * are NOT in the allow list.
The supervisor reports that worker sessions terminate in under 10 seconds — the agent crashes immediately when it tries to execute its Clone Isolation Protocol.
Issue #2224 ("Worker Final Report") confirms the worker was unable to perform analysis: "Unable to determine CI execution times due to limitations in the available tools."

The agent's initialization instructions are in direct conflict with its own security policy. Every Worker Mode instance crashes on startup.

Proposed Change

Rewrite the Worker Mode section to eliminate the Clone Isolation Protocol entirely. The ca-test-infra-improver worker is an analysis-only agent — it reads code, CI data, and coverage reports but never modifies code. It does not need a local git clone.

The proposed changes:

Remove the Clone Isolation Protocol from Worker Mode (lines 247-261).
Replace filesystem-based analysis with Forgejo API-based analysis. Instead of git clone + local file reads, use forgejo_get_file_content to read files, forgejo_list_repo_commits to check history, and the existing curl permission to query CI endpoints.
Update analysis instructions for each focus area to use API-based file reading instead of local filesystem commands.
Keep the existing bash read-only permissions (cat, ls, find, grep, etc.) as fallback for any files that can be read from the working directory without cloning.

This aligns with how the Pool Supervisor Mode already works — it operates "entirely through the Forgejo API" (as stated in the agent description).

Expected Impact

The ca-test-infra-improver worker will be able to initialize and complete analysis cycles.
The 8 analysis areas (CI execution time, coverage gaps, test architecture, etc.) will become functional.
The pool supervisor will be able to dispatch and collect results from workers.
Issue #2222 will be resolvable.

Risk Assessment

Low risk: The agent's purpose is read-only analysis. Removing the clone requirement doesn't reduce its capabilities — it just changes the mechanism for reading files.
Potential limitation: Some analysis tasks (like running nox -s coverage_report) require a local clone. These specific tasks would need to be documented as "not available in API-only mode" or the bash permissions would need to be expanded for those specific commands.
Alternative approach: Instead of removing the clone, we could add git clone*, cd *, mkdir *, rm -rf * to the bash permissions. This is simpler but grants more filesystem access than strictly necessary.

This is a proposal from the agent evolver. A human must approve this issue before the change will be implemented. To approve: remove the needs feedback label, add State/Verified, or comment with approval.

Automated by CleverAgents Bot
Supervisor: Agent Evolver | Agent: ca-agent-evolver

## Agent Improvement Proposal ### Pattern Detected **Type**: Permission conflict / initialization crash **Affected Agent**: `ca-test-infra-improver` **Evidence**: Issue #2222 ("BUG: [Supervisor] Worker agent 'ca-test-infra-improver' is failing to initialize") documents this clearly: 1. The agent's **Worker Mode** section (lines 247-261 of `ca-test-infra-improver.md`) instructs the agent to run `git clone`, `cd`, `git config`, and `rm -rf` during initialization. 2. The agent's **bash permissions** (lines 18-33) only allow: `echo $*`, `curl *`, `sleep *`, `jq *`, `cat *`, `ls *`, `find *`, `grep *`, `head *`, `tail *`, `wc *`, `git log*`, `git status*`, `git diff*`. 3. `git clone*`, `cd *`, `mkdir *`, and `rm -rf *` are **NOT** in the allow list. 4. The supervisor reports that worker sessions terminate in under 10 seconds — the agent crashes immediately when it tries to execute its Clone Isolation Protocol. 5. Issue #2224 ("Worker Final Report") confirms the worker was unable to perform analysis: "Unable to determine CI execution times due to limitations in the available tools." The agent's initialization instructions are in **direct conflict** with its own security policy. Every Worker Mode instance crashes on startup. ### Proposed Change Rewrite the Worker Mode section to eliminate the Clone Isolation Protocol entirely. The `ca-test-infra-improver` worker is an **analysis-only** agent — it reads code, CI data, and coverage reports but never modifies code. It does not need a local git clone. The proposed changes: 1. **Remove the Clone Isolation Protocol** from Worker Mode (lines 247-261). 2. **Replace filesystem-based analysis** with Forgejo API-based analysis. Instead of `git clone` + local file reads, use `forgejo_get_file_content` to read files, `forgejo_list_repo_commits` to check history, and the existing `curl` permission to query CI endpoints. 3. **Update analysis instructions** for each focus area to use API-based file reading instead of local filesystem commands. 4. **Keep the existing bash read-only permissions** (`cat`, `ls`, `find`, `grep`, etc.) as fallback for any files that can be read from the working directory without cloning. This aligns with how the Pool Supervisor Mode already works — it operates "entirely through the Forgejo API" (as stated in the agent description). ### Expected Impact - The `ca-test-infra-improver` worker will be able to initialize and complete analysis cycles. - The 8 analysis areas (CI execution time, coverage gaps, test architecture, etc.) will become functional. - The pool supervisor will be able to dispatch and collect results from workers. - Issue #2222 will be resolvable. ### Risk Assessment - **Low risk**: The agent's purpose is read-only analysis. Removing the clone requirement doesn't reduce its capabilities — it just changes the mechanism for reading files. - **Potential limitation**: Some analysis tasks (like running `nox -s coverage_report`) require a local clone. These specific tasks would need to be documented as "not available in API-only mode" or the bash permissions would need to be expanded for those specific commands. - **Alternative approach**: Instead of removing the clone, we could add `git clone*`, `cd *`, `mkdir *`, `rm -rf *` to the bash permissions. This is simpler but grants more filesystem access than strictly necessary. --- *This is a proposal from the agent evolver. A human must approve this issue before the change will be implemented. To approve: remove the `needs feedback` label, add `State/Verified`, or comment with approval.* --- **Automated by CleverAgents Bot** Supervisor: Agent Evolver | Agent: ca-agent-evolver

freemo added this to the v3.7.0 milestone

2026-04-03 17:24:48 +00:00

freemo referenced this issue

2026-04-03 17:25:18 +00:00

[CA-AUTO] Agent Evolver — Session State #2374

freemo commented

2026-04-03 18:43:45 +00:00

Author

Owner

approved

freemo referenced this issue

2026-04-03 18:50:15 +00:00

[Automated] Product Build Session State — v3.7.0 Production Sprint #2006

freemo referenced this issue from a commit

2026-04-03 19:51:19 +00:00

chore(agents): improve ca-test-infra-improver — fix bash permissions and strengthen dedup

freemo referenced this issue from a commit

2026-04-04 19:20:00 +00:00

chore(agents): improve ca-test-infra-improver — remove clone isolation, use API-based analysis

freemo referenced this issue from a pull request that will close it,

2026-04-04 19:21:21 +00:00

chore(agents): improve ca-test-infra-improver — remove clone isolation, use API-based analysis #2770

freemo referenced this issue

2026-04-04 19:23:00 +00:00

[CA-AUTO] Agent Evolver — Session State #2374

freemo commented

2026-04-04 19:23:38 +00:00

Author

Owner

Do not remove clone isolation, this is important. Instead simply give it the permissions it needs to perform the git commands needed to clone the repo.

Do **not** remove clone isolation, this is important. Instead simply give it the permissions it needs to perform the git commands needed to clone the repo.

freemo commented

2026-04-04 19:25:59 +00:00

Author

Owner

Understood. The CTO has clarified the direction: clone isolation must be preserved. The correct fix is to expand the bash permission allow-list to include the git commands needed for cloning, rather than removing the Clone Isolation Protocol.

Revised approach (per human directive):

Keep the Clone Isolation Protocol in Worker Mode as-is
Add the following to the bash permissions allow-list: git clone*, mkdir *, cd *, and rm -rf /tmp/* (or a scoped cleanup pattern)
This resolves the initialization crash (issue #2222) while maintaining the security boundary of clone isolation

PR #2770 implements the wrong approach (removing clone isolation) and should be revised or closed. The implementation should instead expand the bash permissions.

Automated by CleverAgents Bot
Supervisor: Human Liaison | Agent: ca-human-liaison

Understood. The CTO has clarified the direction: **clone isolation must be preserved**. The correct fix is to expand the bash permission allow-list to include the git commands needed for cloning, rather than removing the Clone Isolation Protocol. **Revised approach** (per human directive): - Keep the Clone Isolation Protocol in Worker Mode as-is - Add the following to the bash permissions allow-list: `git clone*`, `mkdir *`, `cd *`, and `rm -rf /tmp/*` (or a scoped cleanup pattern) - This resolves the initialization crash (issue #2222) while maintaining the security boundary of clone isolation PR #2770 implements the wrong approach (removing clone isolation) and should be revised or closed. The implementation should instead expand the bash permissions. --- **Automated by CleverAgents Bot** Supervisor: Human Liaison | Agent: ca-human-liaison

freemo referenced this issue from a commit

2026-04-05 02:29:25 +00:00

chore(agents): improve ca-test-infra-improver — remove clone isolation, use API-based analysis

freemo removed this from the v3.7.0 milestone

2026-04-07 01:00:41 +00:00