Omar SobhandClaude Opus 5
d90a42b759
Validating P0 against production found one bug in each of the three pieces, none of which any test would have caught. **The scanners were installed but not allow-listed.** Mission 019fc058's condition asked for a gitleaks result; `gitleaks detect` came back `ran=false`, and the judge said it could not verify. P0.3 put the binaries in the image and never added them to `evaluator_tools::ALLOWED_PROGRAMS`, so the judge could not invoke the tools installed for it. Adds gitleaks, trivy, semgrep and `which`. **Every `continue` after a fire claim leaked the claim.** Introduced by the scheduler fix itself: the orphan-agent and empty-action paths skipped `complete_fire`, so the row stayed `claimed` — which reads as a crash mid-fire, meaning the routine is re-claimed forever and the table grows one stuck row per occurrence. Observed in production: five `claimed` rows, no dispatch, no `routine_runs`. Both paths now settle with a reason, and log it. **The agent writes its own identity files into the user's repository.** `workspace.path` is pinned to the repo root, so the runtime drops AGENTS.md, HEARTBEAT.md, IDENTITY.md, MEMORY.md, SOUL.md, TOOLS.md and USER.md into the checkout — SOUL.md opens "Who You Are / You're not a chatbot." Two consequences: every mission's tree is permanently dirty, so a `done_when` about a clean tree can never pass; and P1's `git add -A` would have committed the agent's SOUL.md into someone's repository and pushed it. The P1 deny-list covered build artifacts and would not have caught this. Fixed by writing the names to `.git/info/exclude` after clone — local to the checkout, never itself a change, and it suppresses only *untracked* files, so a repo that genuinely tracks its own AGENTS.md still reports modifications to it. Idempotent, and preserves any pre-existing exclude. Co-Authored-By: Claude Opus 5 <[email protected]>
73 lines
2.1 KiB
TOML
73 lines
2.1 KiB
TOML
[package]
|
|
name = "cm-api"
|
|
version = "0.1.0"
|
|
edition.workspace = true
|
|
rust-version.workspace = true
|
|
license.workspace = true
|
|
publish.workspace = true
|
|
|
|
[dependencies]
|
|
getrandom = "0.2"
|
|
toml = "0.8"
|
|
toml_edit = "0.22"
|
|
serde_yaml = "0.9"
|
|
hex = "0.4"
|
|
hmac = "0.12"
|
|
sha2 = "0.10"
|
|
base64 = "0.22"
|
|
async-stream = "0.3"
|
|
axum = { version = "0.8", features = ["ws"] }
|
|
# Docker API — matches cm-sandbox's version so the workspace resolves cleanly.
|
|
# Used by research_container to spawn/stop per-topic team runtimes via the
|
|
# same socket-proxy the server already talks to.
|
|
bollard = "0.19"
|
|
futures = "0.3"
|
|
serde = { workspace = true }
|
|
serde_json = { workspace = true }
|
|
sqlx = { workspace = true }
|
|
reqwest = { version = "0.12", default-features = false, features = ["json", "rustls-tls"] }
|
|
cm-auth = { path = "../cm-auth" }
|
|
cm-billing = { path = "../cm-billing" }
|
|
cm-brain = { path = "../cm-brain" }
|
|
cm-config = { path = "../cm-config" }
|
|
cm-db = { path = "../cm-db" }
|
|
cm-domain = { path = "../cm-domain" }
|
|
cm-llm = { path = "../cm-llm" }
|
|
cm-orchestrator = { path = "../cm-orchestrator", features = ["provider"] }
|
|
cm-runtime = { path = "../cm-runtime" }
|
|
cm-sandbox = { path = "../cm-sandbox" }
|
|
cm-safety = { path = "../cm-safety" }
|
|
async-trait = "0.1"
|
|
cm-scheduler = { path = "../cm-scheduler" }
|
|
cm-secrets = { path = "../cm-secrets" }
|
|
cm-topology = { path = "../cm-topology" }
|
|
thiserror = { workspace = true }
|
|
tokio-tungstenite = { version = "0.26", features = ["rustls-tls-webpki-roots"] }
|
|
tower-http = { version = "0.6", features = ["trace"] }
|
|
time = { workspace = true }
|
|
tokio = { workspace = true }
|
|
urlencoding = "2"
|
|
uuid = { workspace = true }
|
|
|
|
[dev-dependencies]
|
|
axum = { version = "0.8", features = ["ws"] }
|
|
tempfile = "3"
|
|
jsonwebtoken = "9"
|
|
eventsource-stream = "0.2"
|
|
reqwest = { version = "0.12", default-features = false, features = [
|
|
"json",
|
|
"rustls-tls",
|
|
"stream",
|
|
] }
|
|
cm-llm = { path = "../cm-llm" }
|
|
cm-testkit = { path = "../cm-testkit" }
|
|
hex = "0.4"
|
|
hmac = "0.12"
|
|
base64 = "0.22"
|
|
rand_core = { version = "0.6", features = ["getrandom"] }
|
|
rsa = { version = "0.9", features = ["pem"] }
|
|
sha2 = "0.10"
|
|
|
|
[lints]
|
|
workspace = true
|