From cd1c66110969202aed98a353614510109b969338 Mon Sep 17 00:00:00 2001
From: robert <robert@microcash.local>
Date: Sun, 7 Jun 2026 22:10:23 -0300
Subject: [PATCH] Harden builder sandbox package install

---
 a2a.yaml                    | 2 +-
 agent.py                    | 2 +-
 agent_builder/tools.py      | 9 ++++++++-
 tests/test_template_init.py | 2 ++
 4 files changed, 12 insertions(+), 3 deletions(-)

diff --git a/a2a.yaml b/a2a.yaml
index bb48acc..ee9993d 100644
--- a/a2a.yaml
+++ b/a2a.yaml
@@ -1,5 +1,5 @@
 name: agent-builder
-version: 0.1.1
+version: 0.1.4
 entrypoint: agent:AgentBuilder
 description: Generate, test, and deploy new a2a agents from natural language.
 expose:
diff --git a/agent.py b/agent.py
index 2281c87..268efbc 100644
--- a/agent.py
+++ b/agent.py
@@ -49,7 +49,7 @@ class AgentBuilder(A2AAgent[BuilderConfig, NoAuth]):
         "Writes the project into the user's workspace, validates it in a "
         "sandbox, then ships it via the control plane."
     )
-    version = "0.1.3"
+    version = "0.1.4"
 
     config_model = BuilderConfig
     auth_model = NoAuth
diff --git a/agent_builder/tools.py b/agent_builder/tools.py
index 7c5f288..3d4b04d 100644
--- a/agent_builder/tools.py
+++ b/agent_builder/tools.py
@@ -34,6 +34,7 @@ if TYPE_CHECKING:
 
 
 A2A_PACK_MIN_VERSION = "0.1.80"
+A2A_PACK_SANDBOX_FALLBACK_VERSION = "0.1.79"
 logger = logging.getLogger(__name__)
 
 
@@ -468,7 +469,13 @@ def build_tools(ctx: ToolContext) -> list[Any]:
         script = (
             "set -e\n"
             "export PYTHONDONTWRITEBYTECODE=1\n"
-            f"pip install --quiet 'a2a-pack>={A2A_PACK_MIN_VERSION}' >/dev/null\n"
+            "python -m pip install --quiet "
+            f"'a2a-pack>={A2A_PACK_MIN_VERSION}' >/dev/null || "
+            "(echo 'a2a-pack>="
+            f"{A2A_PACK_MIN_VERSION} unavailable; falling back to "
+            f"a2a-pack=={A2A_PACK_SANDBOX_FALLBACK_VERSION} for sandbox card validation' >&2; "
+            "python -m pip install --quiet --index-url https://pypi.org/simple "
+            f"'a2a-pack=={A2A_PACK_SANDBOX_FALLBACK_VERSION}' >/dev/null)\n"
             "mkdir -p /tmp/agent\n"
             f"echo '{b64}' | base64 -d | tar -xzf - -C /tmp/agent\n"
             "cd /tmp/agent\n"
diff --git a/tests/test_template_init.py b/tests/test_template_init.py
index 6e9d8dd..e6d341a 100644
--- a/tests/test_template_init.py
+++ b/tests/test_template_init.py
@@ -342,6 +342,8 @@ class TemplateInitTests(unittest.TestCase):
             "export PYTHONDONTWRITEBYTECODE=1",
             str(sandbox.calls[0]["script"]),
         )
+        self.assertIn("a2a-pack>=0.1.80 unavailable", str(sandbox.calls[0]["script"]))
+        self.assertIn("a2a-pack==0.1.79", str(sandbox.calls[0]["script"]))
         self.assertEqual(_FakeAsyncClient.posts, [])
 
     def test_cp_deploy_tarball_posts_agent_dsl(self) -> None: