fix(a2a-server): never derive workspace trust from request agentSettings in createTask - #29525

What

CoderAgentExecutor.createTask() forwarded the caller-supplied agentSettings directly into runInIsolatedEnv(), where setIsTrusted(agentSettings, …) honors agentSettings.isTrusted. The other two entry points that build a task from external input already normalize their settings first:

• execute() → { ...raw, workspacePath: validateWorkspacePath(...), isTrusted: false }
• reconstruct() → same shape, isTrusted: false

createTask() did neither, so a task created through the POST /tasks handler (http/app.ts, which passes req.body.agentSettings unchanged) could set isTrusted: true and mark its workspace trusted. A trusted workspace re-enables workspace-declared mcpServers/tools and workspace .env loading (GEMINI_YOLO_MODE), which is command execution during task init — the same class the b-519269096 / #28470 hardening closed for execute()/reconstruct().

Fix

Normalize createTask()'s input the same way as the sibling methods: force isTrusted: false and route workspacePath through validateWorkspacePath(). The only internal caller (execute()) already passes normalized settings, so this is a no-op there; it just removes request-controlled trust from the createTask path.

const rawAgentSettings: AgentSettings = agentSettingsInput || {
  kind: CoderAgentEvent.StateAgentSettingsEvent,
  workspacePath: process.cwd(),
};
const agentSettings: AgentSettings = {
  ...rawAgentSettings,
  workspacePath: validateWorkspacePath(rawAgentSettings.workspacePath),
  isTrusted: false,
};

Scope / severity note

The a2a-server binds to localhost (http/app.ts: expressApp.listen(port, 'localhost', …)), so this is not a remote-network issue. It is a defense-in-depth / trust-model consistency fix: request-supplied settings should never be able to elevate workspace trust, matching the invariant execute()/reconstruct() already enforce.

Suggested regression test

Assert that a createTask call carrying isTrusted: true still yields an untrusted config (mirror the mocking used in the existing executor tests):

it('createTask ignores caller-supplied isTrusted:true (workspace stays untrusted)', async () => {
  const executor = new CoderAgentExecutor();
  const wrapper = await executor.createTask('t1', 'c1', {
    kind: CoderAgentEvent.StateAgentSettingsEvent,
    workspacePath: tmpWorkspace,      // dir containing a .gemini/settings.json with mcpServers
    isTrusted: true,                  // caller-supplied
  } as AgentSettings);
  expect(wrapper.task.config.isTrusted()).toBe(false);
});

Refs

Hardens the trust check from #28470 (b-519269096) at the one entry point it missed. No behavior change for trusted local CLI flows.

🤖 Generated with Claude Code