[BUG] autoswarm writer emits raw swarm_architecture.max_loops into generated Python
**Describe the bug**
`write_autoswarm_file()` interpolates `swarm_architecture.max_loops` directly into generated Python source instead of validating or literal-formatting it first.
That means a non-integer string value is emitted as executable Python code inside the generated module.
**To Reproduce**
1. Call `write_autoswarm_file()` with a config whose `swarm_architecture.max_loops` is a string expression instead of an integer.
2. Write the generated file.
3. Import or execute the generated module.
Minimal example:
```python
config = {
"agents": [{"agent_name": "Agent A", "system_prompt": "x"}],
"swarm_architecture": {
"name": "Research Pipeline",
"swarm_type": "SequentialWorkflow",
"max_loops": "(__import__('builtins').globals().__setitem__('INJECTED_FLAG', True) or 1)",
},
}
```
At HEAD, the generated file contains:
```python
max_loops=(__import__('builtins').globals().__setitem__('INJECTED_FLAG', True) or 1),
```
Locally I verified that the side effect runs when the generated module is imported.
**Expected behavior**
`max_loops` should be validated/coerced to an integer-compatible value before code generation, or rejected with a `ValueError`.
**Additional context**
- Confirmed locally against `master` (`cc1667a1`).
- Relevant code: `swarms/agents/auto_generate_swarm_config.py:346-349`
- This seems especially important because the project positions itself as enterprise-grade / production-ready, and this path writes ready-to-run Python files from LLM-derived config.
- I did not find an existing issue covering this specific code-generation sink; the related autoswarm issue/PRs I found were #1487, #1488, and #1489.
1 条评论