Skip to content

Restrict agent internet access on Refactoring (RF) tasks #16

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
mohit-raghavendra wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Restrict agent internet access on Refactoring (RF) tasks #16

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 20 additions & 0 deletions data/rf/task-69391d8d1ce51c407be1e531/environment/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1 +1,21 @@
FROM ghcr.io/scaleapi/swe-atlas:swe_atlas_RF_trufflesecurity_trufflehog_69391d8d1ce51c407be1e531_1.0@sha256:53ded8a7c81c92abf3403686725fff8db21e8ececf626ca594b0cff6ae4ab328

ENV PATH="/usr/local/go/bin:${PATH}"

# Make offline (agent-phase, allowlisted) Go builds work without a module proxy.
# Vendored repos already carry their modules in vendor/ (fetching the full graph
# would chase dead vanity hosts like go.buf.build); just build from vendor, which
# also triggers any needed toolchain download. Non-vendored repos: download the
# module graph. Either way, install the resolved toolchain as the default GOROOT.
# No WORKDIR override: the base image's WORKDIR is the repo root (varies per repo).
RUN if [ -d vendor ]; then \
GOTOOLCHAIN=auto go build -mod=vendor ./... 2>/dev/null || true; \
else \
GOTOOLCHAIN=auto go mod download all; \
fi && \
Comment on lines +10 to +15

@greptile-apps greptile-apps Bot Jul 24, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Silent failure masks toolchain-download errors for vendored repos

2>/dev/null || true ensures the Dockerfile layer never fails on compilation errors (intentional—the build may not compile cleanly), but it also hides toolchain-download failures. If GOTOOLCHAIN=auto fails to fetch the required toolchain (e.g., a transient network issue during image build), the TC glob finds nothing, the if [ -n "$TC" ] block is skipped, and the original /usr/local/go is kept intact. With GOTOOLCHAIN=local baked in by the subsequent ENV, the agent will then use the original (potentially incompatible) toolchain version and produce opaque build failures at run time. At minimum, keeping toolchain-download errors on stderr (omitting 2>/dev/null) would make image-build logs actionable. The same pattern is used across all ~25 Go task Dockerfiles.

Prompt To Fix With AI 
This is a comment left during a code review.
Path: data/rf/task-69391d8d1ce51c407be1e531/environment/Dockerfile
Line: 10-15

Comment:
**Silent failure masks toolchain-download errors for vendored repos**

`2>/dev/null || true` ensures the Dockerfile layer never fails on compilation errors (intentional—the build may not compile cleanly), but it also hides toolchain-download failures. If `GOTOOLCHAIN=auto` fails to fetch the required toolchain (e.g., a transient network issue during image build), the `TC` glob finds nothing, the `if [ -n "$TC" ]` block is skipped, and the original `/usr/local/go` is kept intact. With `GOTOOLCHAIN=local` baked in by the subsequent `ENV`, the agent will then use the original (potentially incompatible) toolchain version and produce opaque build failures at run time. At minimum, keeping toolchain-download errors on stderr (omitting `2>/dev/null`) would make image-build logs actionable. The same pattern is used across all ~25 Go task Dockerfiles.

How can I resolve this? If you propose a fix, please make it concise.

Fix in Cursor Fix in Claude Code Fix in Codex

TC="$(ls -d /go/pkg/mod/golang.org/toolchain@*/ 2>/dev/null | sort -V | tail -1)" && \
if [ -n "$TC" ]; then rm -rf /usr/local/go && cp -a "${TC%/}" /usr/local/go && chmod -R a+rX /usr/local/go; fi

ENV GOPROXY=off \
GOSUMDB=off \
GOTOOLCHAIN=local
19 changes: 18 additions & 1 deletion data/rf/task-69391d8d1ce51c407be1e531/task.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,9 +15,26 @@ EVAL_MODEL = "${EVAL_MODEL:-anthropic/claude-opus-4-5-20251101}"

[agent]
timeout_sec = 10800
network_mode = "allowlist"
allowed_hosts = [
"pypi.org",
"files.pythonhosted.org",
"deb.debian.org",
"security.debian.org",
"ftp.debian.org",
"snapshot.debian.org",
"archive.ubuntu.com",
"security.ubuntu.com",
"ports.ubuntu.com",
"dl-cdn.alpinelinux.org",
"go.dev",
"dl.google.com",
"registry.npmjs.org",
"registry.yarnpkg.com",
"nodejs.org",
]

[environment]
docker_image = "ghcr.io/scaleapi/swe-atlas:swe_atlas_RF_trufflesecurity_trufflehog_69391d8d1ce51c407be1e531_1.0@sha256:53ded8a7c81c92abf3403686725fff8db21e8ececf626ca594b0cff6ae4ab328"
build_timeout_sec = 1800
allow_internet = true
cpus = 16
Expand Down
18 changes: 18 additions & 0 deletions data/rf/task-69391d8d1ce51c407be1e533/task.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,24 @@ EVAL_MODEL = "${EVAL_MODEL:-anthropic/claude-opus-4-5-20251101}"

[agent]
timeout_sec = 10800
network_mode = "allowlist"
allowed_hosts = [
"pypi.org",
"files.pythonhosted.org",
"deb.debian.org",
"security.debian.org",
"ftp.debian.org",
"snapshot.debian.org",
"archive.ubuntu.com",
"security.ubuntu.com",
"ports.ubuntu.com",
"dl-cdn.alpinelinux.org",
"go.dev",
"dl.google.com",
"registry.npmjs.org",
"registry.yarnpkg.com",
"nodejs.org",
]

[environment]
docker_image = "ghcr.io/scaleapi/swe-atlas:swe_atlas_RF_simple-login_app_69391d8d1ce51c407be1e533_1.0@sha256:312f4320950e218babc8cab47a2c3617582d3c0fcc44859e1e95536539a712f5"
Expand Down
20 changes: 20 additions & 0 deletions data/rf/task-694b4b99829f00e24fd11885/environment/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1 +1,21 @@
FROM ghcr.io/scaleapi/swe-atlas:swe_atlas_RF_trufflesecurity_trufflehog_694b4b99829f00e24fd11885_1.0@sha256:29535eb72b8f6883a83ff50107bf812b5bf1092162ca7a22f7c3d63553f42b5f

ENV PATH="/usr/local/go/bin:${PATH}"

# Make offline (agent-phase, allowlisted) Go builds work without a module proxy.
# Vendored repos already carry their modules in vendor/ (fetching the full graph
# would chase dead vanity hosts like go.buf.build); just build from vendor, which
# also triggers any needed toolchain download. Non-vendored repos: download the
# module graph. Either way, install the resolved toolchain as the default GOROOT.
# No WORKDIR override: the base image's WORKDIR is the repo root (varies per repo).
RUN if [ -d vendor ]; then \
GOTOOLCHAIN=auto go build -mod=vendor ./... 2>/dev/null || true; \
else \
GOTOOLCHAIN=auto go mod download all; \
fi && \
TC="$(ls -d /go/pkg/mod/golang.org/toolchain@*/ 2>/dev/null | sort -V | tail -1)" && \
if [ -n "$TC" ]; then rm -rf /usr/local/go && cp -a "${TC%/}" /usr/local/go && chmod -R a+rX /usr/local/go; fi

ENV GOPROXY=off \
GOSUMDB=off \
GOTOOLCHAIN=local
19 changes: 18 additions & 1 deletion data/rf/task-694b4b99829f00e24fd11885/task.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,9 +15,26 @@ EVAL_MODEL = "${EVAL_MODEL:-anthropic/claude-opus-4-5-20251101}"

[agent]
timeout_sec = 10800
network_mode = "allowlist"
allowed_hosts = [
"pypi.org",
"files.pythonhosted.org",
"deb.debian.org",
"security.debian.org",
"ftp.debian.org",
"snapshot.debian.org",
"archive.ubuntu.com",
"security.ubuntu.com",
"ports.ubuntu.com",
"dl-cdn.alpinelinux.org",
"go.dev",
"dl.google.com",
"registry.npmjs.org",
"registry.yarnpkg.com",
"nodejs.org",
]

[environment]
docker_image = "ghcr.io/scaleapi/swe-atlas:swe_atlas_RF_trufflesecurity_trufflehog_694b4b99829f00e24fd11885_1.0@sha256:29535eb72b8f6883a83ff50107bf812b5bf1092162ca7a22f7c3d63553f42b5f"
build_timeout_sec = 1800
allow_internet = true
cpus = 16
Expand Down
20 changes: 20 additions & 0 deletions data/rf/task-694b4b99829f00e24fd11889/environment/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1 +1,21 @@
FROM ghcr.io/scaleapi/swe-atlas:swe_atlas_RF_trufflesecurity_trufflehog_694b4b99829f00e24fd11889_1.0@sha256:68f800df9360a8b9aac766a3f2345a70899f127fa4d7c0b78961c7ca72ea48f4

ENV PATH="/usr/local/go/bin:${PATH}"

# Make offline (agent-phase, allowlisted) Go builds work without a module proxy.
# Vendored repos already carry their modules in vendor/ (fetching the full graph
# would chase dead vanity hosts like go.buf.build); just build from vendor, which
# also triggers any needed toolchain download. Non-vendored repos: download the
# module graph. Either way, install the resolved toolchain as the default GOROOT.
# No WORKDIR override: the base image's WORKDIR is the repo root (varies per repo).
RUN if [ -d vendor ]; then \
GOTOOLCHAIN=auto go build -mod=vendor ./... 2>/dev/null || true; \
else \
GOTOOLCHAIN=auto go mod download all; \
fi && \
TC="$(ls -d /go/pkg/mod/golang.org/toolchain@*/ 2>/dev/null | sort -V | tail -1)" && \
if [ -n "$TC" ]; then rm -rf /usr/local/go && cp -a "${TC%/}" /usr/local/go && chmod -R a+rX /usr/local/go; fi

ENV GOPROXY=off \
GOSUMDB=off \
GOTOOLCHAIN=local
19 changes: 18 additions & 1 deletion data/rf/task-694b4b99829f00e24fd11889/task.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,9 +15,26 @@ EVAL_MODEL = "${EVAL_MODEL:-anthropic/claude-opus-4-5-20251101}"

[agent]
timeout_sec = 10800
network_mode = "allowlist"
allowed_hosts = [
"pypi.org",
"files.pythonhosted.org",
"deb.debian.org",
"security.debian.org",
"ftp.debian.org",
"snapshot.debian.org",
"archive.ubuntu.com",
"security.ubuntu.com",
"ports.ubuntu.com",
"dl-cdn.alpinelinux.org",
"go.dev",
"dl.google.com",
"registry.npmjs.org",
"registry.yarnpkg.com",
"nodejs.org",
]

[environment]
docker_image = "ghcr.io/scaleapi/swe-atlas:swe_atlas_RF_trufflesecurity_trufflehog_694b4b99829f00e24fd11889_1.0@sha256:68f800df9360a8b9aac766a3f2345a70899f127fa4d7c0b78961c7ca72ea48f4"
build_timeout_sec = 1800
allow_internet = true
cpus = 16
Expand Down
18 changes: 18 additions & 0 deletions data/rf/task-694b4b99829f00e24fd11891/task.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,24 @@ EVAL_MODEL = "${EVAL_MODEL:-anthropic/claude-opus-4-5-20251101}"

[agent]
timeout_sec = 10800
network_mode = "allowlist"
allowed_hosts = [
"pypi.org",
"files.pythonhosted.org",
"deb.debian.org",
"security.debian.org",
"ftp.debian.org",
"snapshot.debian.org",
"archive.ubuntu.com",
"security.ubuntu.com",
"ports.ubuntu.com",
"dl-cdn.alpinelinux.org",
"go.dev",
"dl.google.com",
"registry.npmjs.org",
"registry.yarnpkg.com",
"nodejs.org",
]

[environment]
docker_image = "ghcr.io/scaleapi/swe-atlas:swe_atlas_RF_Automattic_wp-calypso_694b4b99829f00e24fd11891_1.0@sha256:0dd613c90d6bcfc266fb8f266d350d5e6236872425bf86d022c1847b28a5d6d3"
Expand Down
18 changes: 18 additions & 0 deletions data/rf/task-694b4b99829f00e24fd118a1/task.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,24 @@ EVAL_MODEL = "${EVAL_MODEL:-anthropic/claude-opus-4-5-20251101}"

[agent]
timeout_sec = 10800
network_mode = "allowlist"
allowed_hosts = [
"pypi.org",
"files.pythonhosted.org",
"deb.debian.org",
"security.debian.org",
"ftp.debian.org",
"snapshot.debian.org",
"archive.ubuntu.com",
"security.ubuntu.com",
"ports.ubuntu.com",
"dl-cdn.alpinelinux.org",
"go.dev",
"dl.google.com",
"registry.npmjs.org",
"registry.yarnpkg.com",
"nodejs.org",
]

[environment]
docker_image = "ghcr.io/scaleapi/swe-atlas:swe_atlas_RF_secdev_scapy_694b4b99829f00e24fd118a1_1.0@sha256:63f1a9702fc2eb7ea14c3396b9ee8b51c3b039cb2fe31f6c806c76b7ed15a91f"
Expand Down
20 changes: 20 additions & 0 deletions data/rf/task-696719205599a51110d4b40c/environment/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1 +1,21 @@
FROM ghcr.io/scaleapi/swe-atlas:swe_atlas_RF_trufflesecurity_trufflehog_696719205599a51110d4b40c_1.0@sha256:c6fcd6e39177b9bd30fe550676e838918544f3ba53b02fb488c3f78f29041e1a

ENV PATH="/usr/local/go/bin:${PATH}"

# Make offline (agent-phase, allowlisted) Go builds work without a module proxy.
# Vendored repos already carry their modules in vendor/ (fetching the full graph
# would chase dead vanity hosts like go.buf.build); just build from vendor, which
# also triggers any needed toolchain download. Non-vendored repos: download the
# module graph. Either way, install the resolved toolchain as the default GOROOT.
# No WORKDIR override: the base image's WORKDIR is the repo root (varies per repo).
RUN if [ -d vendor ]; then \
GOTOOLCHAIN=auto go build -mod=vendor ./... 2>/dev/null || true; \
else \
GOTOOLCHAIN=auto go mod download all; \
fi && \
TC="$(ls -d /go/pkg/mod/golang.org/toolchain@*/ 2>/dev/null | sort -V | tail -1)" && \
if [ -n "$TC" ]; then rm -rf /usr/local/go && cp -a "${TC%/}" /usr/local/go && chmod -R a+rX /usr/local/go; fi

ENV GOPROXY=off \
GOSUMDB=off \
GOTOOLCHAIN=local
19 changes: 18 additions & 1 deletion data/rf/task-696719205599a51110d4b40c/task.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,9 +15,26 @@ EVAL_MODEL = "${EVAL_MODEL:-anthropic/claude-opus-4-5-20251101}"

[agent]
timeout_sec = 10800
network_mode = "allowlist"
allowed_hosts = [
"pypi.org",
"files.pythonhosted.org",
"deb.debian.org",
"security.debian.org",
"ftp.debian.org",
"snapshot.debian.org",
"archive.ubuntu.com",
"security.ubuntu.com",
"ports.ubuntu.com",
"dl-cdn.alpinelinux.org",
"go.dev",
"dl.google.com",
"registry.npmjs.org",
"registry.yarnpkg.com",
"nodejs.org",
]

[environment]
docker_image = "ghcr.io/scaleapi/swe-atlas:swe_atlas_RF_trufflesecurity_trufflehog_696719205599a51110d4b40c_1.0@sha256:c6fcd6e39177b9bd30fe550676e838918544f3ba53b02fb488c3f78f29041e1a"
build_timeout_sec = 1800
allow_internet = true
cpus = 16
Expand Down
20 changes: 20 additions & 0 deletions data/rf/task-696719205599a51110d4b419/environment/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1 +1,21 @@
FROM ghcr.io/scaleapi/swe-atlas:swe_atlas_RF_trufflesecurity_trufflehog_696719205599a51110d4b419_1.0@sha256:2e388e68c3c34864dce03bfc5d35bee9a5af2648fcd991abb8a2bd6a7a486680

ENV PATH="/usr/local/go/bin:${PATH}"

# Make offline (agent-phase, allowlisted) Go builds work without a module proxy.
# Vendored repos already carry their modules in vendor/ (fetching the full graph
# would chase dead vanity hosts like go.buf.build); just build from vendor, which
# also triggers any needed toolchain download. Non-vendored repos: download the
# module graph. Either way, install the resolved toolchain as the default GOROOT.
# No WORKDIR override: the base image's WORKDIR is the repo root (varies per repo).
RUN if [ -d vendor ]; then \
GOTOOLCHAIN=auto go build -mod=vendor ./... 2>/dev/null || true; \
else \
GOTOOLCHAIN=auto go mod download all; \
fi && \
TC="$(ls -d /go/pkg/mod/golang.org/toolchain@*/ 2>/dev/null | sort -V | tail -1)" && \
if [ -n "$TC" ]; then rm -rf /usr/local/go && cp -a "${TC%/}" /usr/local/go && chmod -R a+rX /usr/local/go; fi

ENV GOPROXY=off \
GOSUMDB=off \
GOTOOLCHAIN=local
19 changes: 18 additions & 1 deletion data/rf/task-696719205599a51110d4b419/task.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,9 +15,26 @@ EVAL_MODEL = "${EVAL_MODEL:-anthropic/claude-opus-4-5-20251101}"

[agent]
timeout_sec = 10800
network_mode = "allowlist"
allowed_hosts = [
"pypi.org",
"files.pythonhosted.org",
"deb.debian.org",
"security.debian.org",
"ftp.debian.org",
"snapshot.debian.org",
"archive.ubuntu.com",
"security.ubuntu.com",
"ports.ubuntu.com",
"dl-cdn.alpinelinux.org",
"go.dev",
"dl.google.com",
"registry.npmjs.org",
"registry.yarnpkg.com",
"nodejs.org",
]

[environment]
docker_image = "ghcr.io/scaleapi/swe-atlas:swe_atlas_RF_trufflesecurity_trufflehog_696719205599a51110d4b419_1.0@sha256:2e388e68c3c34864dce03bfc5d35bee9a5af2648fcd991abb8a2bd6a7a486680"
build_timeout_sec = 1800
allow_internet = true
cpus = 16
Expand Down
18 changes: 18 additions & 0 deletions data/rf/task-696719205599a51110d4b426/task.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,24 @@ EVAL_MODEL = "${EVAL_MODEL:-anthropic/claude-opus-4-5-20251101}"

[agent]
timeout_sec = 10800
network_mode = "allowlist"
allowed_hosts = [
"pypi.org",
"files.pythonhosted.org",
"deb.debian.org",
"security.debian.org",
"ftp.debian.org",
"snapshot.debian.org",
"archive.ubuntu.com",
"security.ubuntu.com",
"ports.ubuntu.com",
"dl-cdn.alpinelinux.org",
"go.dev",
"dl.google.com",
"registry.npmjs.org",
"registry.yarnpkg.com",
"nodejs.org",
]

[environment]
docker_image = "ghcr.io/scaleapi/swe-atlas:swe_atlas_RF_Automattic_wp-calypso_696719205599a51110d4b426_1.0@sha256:0da17570f329d0904c7f878f065979a3288ebac3e37b10741c377b7b9ef3f4b6"
Expand Down
18 changes: 18 additions & 0 deletions data/rf/task-696719205599a51110d4b428/task.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,24 @@ EVAL_MODEL = "${EVAL_MODEL:-anthropic/claude-opus-4-5-20251101}"

[agent]
timeout_sec = 10800
network_mode = "allowlist"
allowed_hosts = [
"pypi.org",
"files.pythonhosted.org",
"deb.debian.org",
"security.debian.org",
"ftp.debian.org",
"snapshot.debian.org",
"archive.ubuntu.com",
"security.ubuntu.com",
"ports.ubuntu.com",
"dl-cdn.alpinelinux.org",
"go.dev",
"dl.google.com",
"registry.npmjs.org",
"registry.yarnpkg.com",
"nodejs.org",
]

[environment]
docker_image = "ghcr.io/scaleapi/swe-atlas:swe_atlas_RF_Automattic_wp-calypso_696719205599a51110d4b428_1.0@sha256:9eb49e43f425eb3544035b46e3e20911fec86477337602f470d0c7db87b63c4b"
Expand Down
18 changes: 18 additions & 0 deletions data/rf/task-696719205599a51110d4b434/task.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,24 @@ EVAL_MODEL = "${EVAL_MODEL:-anthropic/claude-opus-4-5-20251101}"

[agent]
timeout_sec = 10800
network_mode = "allowlist"
allowed_hosts = [
"pypi.org",
"files.pythonhosted.org",
"deb.debian.org",
"security.debian.org",
"ftp.debian.org",
"snapshot.debian.org",
"archive.ubuntu.com",
"security.ubuntu.com",
"ports.ubuntu.com",
"dl-cdn.alpinelinux.org",
"go.dev",
"dl.google.com",
"registry.npmjs.org",
"registry.yarnpkg.com",
"nodejs.org",
]

[environment]
docker_image = "ghcr.io/scaleapi/swe-atlas:swe_atlas_RF_Automattic_wp-calypso_696719205599a51110d4b434_1.0@sha256:6b1f28b1fae730c0d00b2acdb6f68a32b270468fbbb4ec4581db62e0d3b0c887"
Expand Down
Loading