From 76a727796114adb0b86021832738c6a8162e5600 Mon Sep 17 00:00:00 2001 From: Paul O'Reilly Date: Mon, 17 Aug 2026 10:11:22 +1200 Subject: [PATCH] fix(decompose-template): replace inline python3 -c paste with cp-cli decompose verb MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The python3 -c block imported internal entrypoint code directly and pasted module paths into agent prompts — a security boundary violation. Switch to the thin-client verb (added in agent-runtimes a116aedb). Claude-Session: https://claude.ai/code/session_0124mK2BVfCdkELLXDCr5Zzs --- .../workflow/scope-decompose-sonnet@1.yaml | 14 ++------------ 1 file changed, 2 insertions(+), 12 deletions(-) diff --git a/task-templates/workflow/scope-decompose-sonnet@1.yaml b/task-templates/workflow/scope-decompose-sonnet@1.yaml index 5de1376..4c54384 100644 --- a/task-templates/workflow/scope-decompose-sonnet@1.yaml +++ b/task-templates/workflow/scope-decompose-sonnet@1.yaml @@ -61,16 +61,6 @@ nodes: Include "airouter-eligible" in tags only for single-file, self-contained tasks that Qwen3.6 can handle alone. Omit tags for complex multi-file tasks. - After writing decompose.json, run this Python command to create the work items: + After writing decompose.json, run this command to create the work items: - python3 -c " - import sys, os - sys.path.insert(0, '/opt/agent') - cp_url = os.environ.get('CP_URL', 'http://controlplane.agent-runtimes.svc.cluster.local:8100').rstrip('/') - from actions.decompose_work_items import decompose_work_items_action - decompose_work_items_action( - {'cp_url': cp_url, 'plan_path': '/workspace/.agent-output/decompose.json'}, - {} - ) - print('decompose_work_items: done') - " \ No newline at end of file + python3 -m lib.cp_cli planner items decompose ${item.uuid} --file /workspace/.agent-output/decompose.json \ No newline at end of file