feat(agents): add bundle install flow and registry auditing #129
Conversation
Signed-off-by: Ivan Iufriakov <tomatyss@gmail.com>
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| let mut staging_guard = StagingGuard::new(staging_dir.clone()); | ||
| copy_dir_all(&bundle_root, &staging_dir)?; | ||
| fs::rename(&staging_dir, &dest_dir)?; |
There was a problem hiding this comment.
The new rlp agent install validates the bundle before staging, but after validation it copies only the manifest directory into the staging dir and never re‑verifies the staged copy. If a manifest declares entry_wasm, entry_native, or artifacts.tools paths that point outside the manifest directory (e.g., ../bin/agent.wasm), those files are present during validation so the check passes, but they are not copied by the staging step and the command still returns success, leaving the installed bundle missing its binaries/tools at runtime. The installer should either reject paths that escape the bundle root or re‑validate after staging to ensure the installed bundle actually contains the declared artifacts.
Useful? React with 👍 / 👎.
Summary
Testing
Checklist