With `--run-selected`, an automatically selected README command runs locally with the full environment
Source references: 5The reproduction entry point extracts commands from the target README or linked documentation and selects a goal automatically. When execution is enabled, it hands that command to the persistent runner; unless a separate child environment is supplied, the process receives a copy of all controller environment variables. A malicious or compromised repository can therefore disguise a dangerous command as documentation.
The command can read or modify user-accessible files, use credentials present in the environment, and access the network. Timeout and cancellation terminate the process tree but cannot undo file, account, or network actions already performed.
This occurs only when the user enables `--run-selected`, but the script then automatically selects a command extracted from repository documentation and executes it in the target repository. When `child_env` is absent, the runtime copies the controller's full environment. A malicious documented command could therefore read files, use the network, or access environment variables. Direct mode reduces shell parsing risk but is not an OS sandbox. Users can require per-command confirmation and run in an isolated environment with a minimal environment.
parser.add_argument("--user-language", default="en", help="Language tag for human-readable reports.") parser.add_argument("--run-selected", action="store_true", help="Execute the selected documented command.") parser.add_argument("--include-analysis-pass", action="store_true", help="Run analyze-project and record its outputs in the stage ledger.")Show 4 other places
) elif args.run_selected: if chosen["selected_goal"] == "training": run_data = maybe_run_training( repo_path=repo_path, command=chosen["documented_command"], train_script=train_execute_script, lane=args.lane, user_language=args.user_language, full_training_authorized=args.full_training_authorized, train_timeout=args.train_timeout, dataset_hint=dataset_hint, checkpoint_hint=checkpoint_hint, resume_from=args.resume_from, max_train_steps=args.max_train_steps, shell_mode=args.shell_mode, runtime_root=runtime_root, model_profile_json=args.model_profile_json, required_model_capabilities=args.require_model_capability, gpu_monitor_enabled=not args.no_gpu_monitor, ) else: run_data = maybe_run_command( repo_path, chosen["documented_command"], args.timeout, args.user_language, args.shell_mode, runtime_root, model_adapter, args.monitor_gpu, ) try: argv = build_command(command, shell_mode) environment = dict(os.environ if child_env is None else child_env) spec["requested_argv"] = list(argv) atomic_write_json(run_dir / "spec.json", spec) if shell_mode == "direct": argv = resolve_direct_argv(argv, repo, environment) spec["argv"] = list(argv) atomic_write_json(run_dir / "spec.json", spec) creationflags = subprocess.CREATE_NEW_PROCESS_GROUP if os.name == "nt" else 0 process = subprocess.Popen( argv, env=environment, cwd=repo, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, encoding="utf-8", errors="replace", bufsize=1, creationflags=creationflags, start_new_session=os.name != "nt", ) except (FileNotFoundError, ShellSyntaxRequired, OSError, ValueError) as exc: chosen = choose_goal(command_data.get("commands", []), repo_path) dataset_hint = derive_dataset_hint(asset_data) else: run_data = maybe_run_command( repo_path, chosen["documented_command"], args.timeout, args.user_language, args.shell_mode, runtime_root, model_adapter, args.monitor_gpu, )