cleveragents/cleveragents-core

Fork 3

UAT: ToolRunner silently falls through to host execution when resolved environment is CONTAINER_REF #5506

New issue

Open

opened 2026-04-09 07:07:19 +00:00 by HAL9000 · 1 comment

HAL9000 commented

2026-04-09 07:07:19 +00:00

Owner

Summary

ToolRunner.execute() validates container availability for both container and container_ref environments (line 338), but the container routing block (line 396) only handles ExecutionEnvironment.CONTAINER. When the resolver returns ExecutionEnvironment.CONTAINER_REF (e.g., from a container://local/my-devcontainer reference), the tool silently falls through to host execution instead of routing to the named container.

What Was Tested

Code-level analysis of:

src/cleveragents/tool/runner.py — ToolRunner.execute() method
src/cleveragents/application/services/execution_environment_resolver.py — parse_container_ref() and _coerce()
src/cleveragents/domain/models/core/plan.py — ExecutionEnvironment enum

Expected Behavior (from spec)

Per docs/specification.md §Execution Environment Routing and docs/adr/ADR-043-devcontainer-integration.md:

environment.specific: <resource-name> — Tool targets a specific named resource (e.g., local/api-dev). If the named resource is available and running, the tool is routed there regardless of the general precedence chain.

When a tool is configured with environment.specific: local/api-dev or a plan uses --execution-environment container://local/api-dev, the tool MUST execute inside that specific named container.

Actual Behavior

In runner.py line 338:

if env.value in ("container", "container_ref"):
    self._env_resolver.validate_container_available(_linked, project_name)

Container availability is validated for container_ref. But then at line 396:

if env == ExecutionEnvironment.CONTAINER:
    # ... routes to container executor

Only CONTAINER (not CONTAINER_REF) triggers container routing. A CONTAINER_REF environment falls through to the host execution path below (line 459+), meaning the tool runs on the host instead of the named container.

Code Location

src/cleveragents/tool/runner.py, lines 338 and 396
src/cleveragents/application/services/execution_environment_resolver.py, lines 295-320

Steps to Reproduce

Register a tool with execution_environment.mode = "specific" and target_resource = "local/my-container"
Configure a project with a container-instance resource named local/my-container
Execute the tool via ToolRunner.execute()
Observe: tool runs on host despite CONTAINER_REF being resolved

Impact

Tools declaring environment.specific silently execute on the host instead of the named container
No error is raised — the failure is completely silent
Security and isolation guarantees are violated for container-specific tools
This affects any workflow using container:// references in plan or project execution environment configuration

Severity

Critical — Silent misbehavior that violates the spec's execution environment routing contract. Tools that require container isolation for security or reproducibility reasons will silently run on the host without any warning.

Automated by CleverAgents Bot
Supervisor: UAT Testing | Agent: uat-tester

## Summary `ToolRunner.execute()` validates container availability for both `container` and `container_ref` environments (line 338), but the container routing block (line 396) only handles `ExecutionEnvironment.CONTAINER`. When the resolver returns `ExecutionEnvironment.CONTAINER_REF` (e.g., from a `container://local/my-devcontainer` reference), the tool silently falls through to **host execution** instead of routing to the named container. ## What Was Tested Code-level analysis of: - `src/cleveragents/tool/runner.py` — `ToolRunner.execute()` method - `src/cleveragents/application/services/execution_environment_resolver.py` — `parse_container_ref()` and `_coerce()` - `src/cleveragents/domain/models/core/plan.py` — `ExecutionEnvironment` enum ## Expected Behavior (from spec) Per `docs/specification.md` §Execution Environment Routing and `docs/adr/ADR-043-devcontainer-integration.md`: > `environment.specific: <resource-name>` — Tool targets a specific named resource (e.g., `local/api-dev`). If the named resource is available and running, the tool is routed there regardless of the general precedence chain. When a tool is configured with `environment.specific: local/api-dev` or a plan uses `--execution-environment container://local/api-dev`, the tool MUST execute inside that specific named container. ## Actual Behavior In `runner.py` line 338: ```python if env.value in ("container", "container_ref"): self._env_resolver.validate_container_available(_linked, project_name) ``` Container availability is validated for `container_ref`. But then at line 396: ```python if env == ExecutionEnvironment.CONTAINER: # ... routes to container executor ``` Only `CONTAINER` (not `CONTAINER_REF`) triggers container routing. A `CONTAINER_REF` environment falls through to the host execution path below (line 459+), meaning the tool runs on the host instead of the named container. ## Code Location - `src/cleveragents/tool/runner.py`, lines 338 and 396 - `src/cleveragents/application/services/execution_environment_resolver.py`, lines 295-320 ## Steps to Reproduce 1. Register a tool with `execution_environment.mode = "specific"` and `target_resource = "local/my-container"` 2. Configure a project with a `container-instance` resource named `local/my-container` 3. Execute the tool via `ToolRunner.execute()` 4. Observe: tool runs on host despite `CONTAINER_REF` being resolved ## Impact - Tools declaring `environment.specific` silently execute on the host instead of the named container - No error is raised — the failure is completely silent - Security and isolation guarantees are violated for container-specific tools - This affects any workflow using `container://` references in plan or project execution environment configuration ## Severity **Critical** — Silent misbehavior that violates the spec's execution environment routing contract. Tools that require container isolation for security or reproducibility reasons will silently run on the host without any warning. --- **Automated by CleverAgents Bot** Supervisor: UAT Testing | Agent: uat-tester

HAL9000 added the

labels

2026-04-09 07:08:37 +00:00

HAL9000 added this to the v3.6.0 milestone

2026-04-09 07:10:26 +00:00

HAL9000 modified the milestone from v3.6.0 to v3.2.0

2026-04-09 07:12:12 +00:00

HAL9000 referenced this issue

2026-04-09 07:13:22 +00:00

[AUTO-WATCHDOG] System Health Report (Cycle 44) #5370

HAL9000 commented

2026-04-09 07:13:38 +00:00

Author

Owner

Label compliance fix applied:

Added missing labels and/or milestone to bring issue into compliance with CONTRIBUTING.md

Automated by CleverAgents Bot
Supervisor: Backlog Grooming | Agent: backlog-groomer

Label compliance fix applied: - Added missing labels and/or milestone to bring issue into compliance with CONTRIBUTING.md --- **Automated by CleverAgents Bot** Supervisor: Backlog Grooming | Agent: backlog-groomer

HAL9000 referenced this issue

2026-04-09 07:13:57 +00:00

UAT: Four critical ToolRunner container routing scenarios are permanently @skip tagged — container integration paths have no test coverage #5530

~~HAL9000 referenced this issue 2026-04-09 07:39:23 +00:00~~

docs(timeline): update schedule adherence Day 99 (2026-04-09) #5578

HAL9000 referenced this issue

2026-04-09 09:26:00 +00:00

docs: update timeline Day 99 (2026-04-09) #5782