fix: block benchmark agents from global pip

scripts/compare_three_systems.py

@@ -240,9 +240,7 @@ def run_claude(
         text=True,
         timeout=120,
     )
-    env = _claude_environment(model)
-    env["VIRTUAL_ENV"] = str(command_venv)
-    env["PATH"] = f"{command_venv / 'bin'}{os.pathsep}{env.get('PATH', '')}"
+    env = _activate_command_venv(_claude_environment(model), command_venv)
     env["CLAUDE_CODE_DEBUG"] = "1"
     env["ANTHROPIC_MAX_TOKENS"] = "64000"
 
@@ -318,6 +316,16 @@ def _claude_environment(model: str) -> dict[str, str]:
     return env
 
 
+def _activate_command_venv(env: dict[str, str], command_venv: Path) -> dict[str, str]:
+    """Activate a task venv and reject pip calls that bypass it."""
+    activated = dict(env)
+    activated["VIRTUAL_ENV"] = str(command_venv)
+    activated["PATH"] = f"{command_venv / 'bin'}{os.pathsep}{activated.get('PATH', '')}"
+    activated["PIP_REQUIRE_VIRTUALENV"] = "true"
+    activated["PYTHONNOUSERSITE"] = "1"
+    return activated
+
+
 def preflight_claude_endpoint(model: str) -> None:
     """Verify Claude's endpoint before any task can be counted."""
     completed = subprocess.run(

swe_agent_local_runner.py

@@ -205,6 +205,8 @@ def _start_bash(self) -> None:
         if self.command_venv is not None:
             env["VIRTUAL_ENV"] = str(self.command_venv)
             env["PATH"] = f"{self.command_venv / 'bin'}{os.pathsep}{env.get('PATH', '')}"
+            env["PIP_REQUIRE_VIRTUALENV"] = "true"
+            env["PYTHONNOUSERSITE"] = "1"
         # Use a new session so we can kill the whole process group (bash +
         # any spawned children) when a command times out.
         self._proc = subprocess.Popen(

tests/test_swe_agent_local_runner.py

@@ -1,4 +1,5 @@
 import json
+import os
 import shlex
 import sys
 from pathlib import Path
@@ -9,6 +10,7 @@
 
 from agent.config import Config
 from scripts.compare_three_systems import (
+    _activate_command_venv,
     _claude_environment,
     build_goal_description,
     preflight_claude_endpoint,
@@ -62,6 +64,8 @@ def test_local_env_uses_per_task_command_venv(tmp_path):
         assert env.communicate('printf "$VIRTUAL_ENV"') == str(command_venv)
         path = env.communicate('printf "$PATH"')
         assert path.split(":")[1] == str(command_venv / "bin")
+        assert env.communicate('printf "$PIP_REQUIRE_VIRTUALENV"') == "true"
+        assert env.communicate('printf "$PYTHONNOUSERSITE"') == "1"
     finally:
         env.close()
 
@@ -167,6 +171,17 @@ def test_claude_environment_can_use_shared_benchmark_endpoint(monkeypatch):
     assert env["ANTHROPIC_MODEL"] == "deepseek-v4-flash[1m]"
 
 
+def test_claude_command_venv_blocks_global_pip(tmp_path):
+    command_venv = tmp_path / "command_venv"
+
+    env = _activate_command_venv({"PATH": "/usr/bin"}, command_venv)
+
+    assert env["VIRTUAL_ENV"] == str(command_venv)
+    assert env["PATH"].startswith(f"{command_venv / 'bin'}{os.pathsep}")
+    assert env["PIP_REQUIRE_VIRTUALENV"] == "true"
+    assert env["PYTHONNOUSERSITE"] == "1"
+
+
 def test_claude_preflight_allows_slow_official_endpoint(monkeypatch):
     observed = {}