Pre-install AgentRx on a portable CPython instead of pip-installing in the sandbox

[Copilot]

The Daily AgentRx Trace Optimizer instructed the agent to pip install git+https://github.com/microsoft/AgentRx.git from inside the agent sandbox, which cannot work: the microVM guest only ships PyPy 3.10/3.11 (no wheels for numpy/aiohttp, and building jiter needs a firewall-blocked Rust toolchain), and the runner's CPython 3.12 fails in the guest with a glibc mismatch. The agent reported AgentRx as a missing tool every run.

Changes

• Install on the runner, not in the sandbox — new pre-agent steps: block clones AgentRx and installs it into a uv-managed CPython 3.12 (python-build-standalone, glibc 2.17+, so it executes inside the guest). Everything lands under /tmp/gh-aw/python/agentrx, which is mounted read-write into the sandbox. PyPI access happens outside the agent firewall and resolves to prebuilt wheels, so no Rust build is triggered.
• runtimes: uv added to frontmatter for astral-sh/setup-uv.
• Clone, not just install — run.py is not shipped in the wheel (agentrx.cli errors with "run.py not found"), so the checkout is kept at .../agentrx/src and invoked directly.
• Prompt updated to reference the pre-installed interpreter and to forbid in-agent pip install/venv creation, falling back to missing_tool if the interpreter is absent.
• ir stage now gets --run-dir like the other stages; previously it defaulted to <repo_root>/runs/, writing artifacts into the AgentRx checkout instead of the run directory the later stages read.

runtimes:
uv: {}steps:
- name: Install AgentRx with a sandbox-compatible CPythonenv:
UV_PYTHON_INSTALL_DIR: /tmp/gh-aw/python/uv-pythonAGENTRX_HOME: /tmp/gh-aw/python/agentrxrun: | set -euo pipefail rm -rf "$AGENTRX_HOME"; mkdir -p "$AGENTRX_HOME" git clone --depth 1 https://github.com/microsoft/AgentRx.git "$AGENTRX_HOME/src" uv venv --python 3.12 --python-preference only-managed "$AGENTRX_HOME/.venv" uv pip install --python "$AGENTRX_HOME/.venv/bin/python" "$AGENTRX_HOME/src" "$AGENTRX_HOME/.venv/bin/python" "$AGENTRX_HOME/src/run.py" --help >/dev/null

Notes for reviewers

• The clone tracks AgentRx's default branch (unpinned), matching the previous pip install git+… behavior; pinning to a SHA is an easy follow-up if desired.
• The ir/judge stages additionally require a copilot CLI endpoint that the guest may not have. Left as-is — the existing guardrail already tells the agent to continue with completed artifacts.
• .lock.yml regenerated via gh aw compile.

• Fixes[aw] Daily AgentRx Trace Optimizer is missing required tool #53607

[Copilot]

Pull request overview

Moves AgentRx installation outside the sandbox to provide a compatible CPython runtime.

Changes:

• Adds runner-side AgentRx and uv-managed CPython setup.
• Updates pipeline commands and artifact paths.
• Regenerates the compiled workflow.

Show a summary per file

File	Description
.github/workflows/daily-agentrx-trace-optimizer.md	Configures installation and updates AgentRx instructions.
.github/workflows/daily-agentrx-trace-optimizer.lock.yml	Applies generated runtime and setup changes.

Review details

Suppressed comments (2)

.github/workflows/daily-agentrx-trace-optimizer.md:48

• set -e makes any clone, download, install, or smoke-test failure abort the job before the agent starts, so the new missing_tool fallback cannot run for the failures it is intended to handle. Allow this setup step to fail so the agent can continue with the pre-downloaded evidence and apply the documented fallback.

 run: |
set -euo pipefail

.github/workflows/daily-agentrx-trace-optimizer.md:58

• This fetches and executes AgentRx's mutable default branch in a steps: block, which runs outside the firewall sandbox. A compromised or force-pushed upstream branch can execute during installation or the smoke test with runner-level access; unlike the previous prompt-driven sandbox install, this materially expands the impact. Pin the checkout to a reviewed full commit SHA before installing it, and preferably freeze its dependency resolution as well.

 git clone --depth 1 https://github.com/microsoft/AgentRx.git "$AGENTRX_HOME/src"
uv venv --python 3.12 --python-preference only-managed "$AGENTRX_HOME/.venv"
uv pip install --python "$AGENTRX_HOME/.venv/bin/python" "$AGENTRX_HOME/src"
"$AGENTRX_HOME/.venv/bin/python" "$AGENTRX_HOME/src/run.py" --help >/dev/null

• Files reviewed: 2/2 changed files
• Comments generated: 1
• Review effort level: Balanced

[github-actions]

🎉 This pull request is included in a new release.

Release: v0.87.1