ITADN

[BUG] autoswarm writer emits raw swarm_architecture.max_loops into generated Python

#1535Openshaun0927 创建于 2026-04-16
S
shaun0927commented
**Describe the bug** `write_autoswarm_file()` interpolates `swarm_architecture.max_loops` directly into generated Python source instead of validating or literal-formatting it first. That means a non-integer string value is emitted as executable Python code inside the generated module. **To Reproduce** 1. Call `write_autoswarm_file()` with a config whose `swarm_architecture.max_loops` is a string expression instead of an integer. 2. Write the generated file. 3. Import or execute the generated module. Minimal example: ```python config = { "agents": [{"agent_name": "Agent A", "system_prompt": "x"}], "swarm_architecture": { "name": "Research Pipeline", "swarm_type": "SequentialWorkflow", "max_loops": "(__import__('builtins').globals().__setitem__('INJECTED_FLAG', True) or 1)", }, } ``` At HEAD, the generated file contains: ```python max_loops=(__import__('builtins').globals().__setitem__('INJECTED_FLAG', True) or 1), ``` Locally I verified that the side effect runs when the generated module is imported. **Expected behavior** `max_loops` should be validated/coerced to an integer-compatible value before code generation, or rejected with a `ValueError`. **Additional context** - Confirmed locally against `master` (`cc1667a1`). - Relevant code: `swarms/agents/auto_generate_swarm_config.py:346-349` - This seems especially important because the project positions itself as enterprise-grade / production-ready, and this path writes ready-to-run Python files from LLM-derived config. - I did not find an existing issue covering this specific code-generation sink; the related autoswarm issue/PRs I found were #1487, #1488, and #1489.
1 条评论