[briangreunke]

Problem

web-security installed pacu into the shared Python environment. pacu 1.7.0 pins urllib3>=1.26.4,<2.0.0 and botocore>=1.16,<1.32, and its dependency dsnap 1.0.1 also pins urllib3 below 2. Installing pacu downgraded urllib3 to 1.26.20, boto3 to 1.28.85 and botocore to 1.31.85 for every other package in that environment.

Change

• scripts/install_tools.sh: install_pacu runs uv tool install pacu==1.7.0 instead of py_install pacu. It is still guarded by have pacu and still prints WARN: pacu install failed, skipping on failure.
• docker/Dockerfile.runtime: removes pacu from pip install. A new layer runs uv tool install --python /usr/bin/python3 pacu==1.7.0 with UV_TOOL_DIR=/opt/uv-tools and UV_TOOL_BIN_DIR=/usr/local/bin, so the runner user can run it.
• tests/test_install_tools_offline.py: adds TestPacuOwnToolEnvironment.
• capability.yaml: 2.0.3 → 2.0.4.

pacu's own tool environment still has urllib3 1.26.20, because no pacu release supports urllib3 2.

Testing

• Dockerfile.runtime built on linux/amd64. As runner: command -v pacu → /usr/local/bin/pacu, pacu --help exits 0, shared urllib3 is 2.8.0.
• web-security dependency install through install_dependencies (runs install_tools.sh): pacu resolves to ~/.local/bin/pacu, pacu --help exits 0, uv tool list shows pacu v1.7.0, uv pip check is clean, and the shared venv keeps urllib3==2.8.0, boto3==1.43.75 and botocore==1.43.75 with no pacu.
• pytest capabilities/web-security/tests/test_install_tools_offline.py: 66 passed.
• pytest capabilities/web-security/tests: 742 passed, 2 failed. Both failures are test_wrangler.py::TestStatus, which needs wrangler on PATH. They also fail on main.
• just validate strict=true: 20 ok, 6 warn, 0 failed. The warnings are missing local binaries.

Base 30680eca1143cf5d018657e71fb85def85368095, head 9f6218f761dd30b60a03f405c18b12b425d90a41.

🤖 Generated with Claude Code

[Copilot]

🟢 Approval recommended

The focused dependency-isolation changes preserve CLI availability and failure handling, with no blocking issues identified.

No open issues 🎉

What changed in this PR

Isolates Pacu from web-security’s shared Python environment to prevent dependency downgrades.

Changes:

• Installs pinned Pacu 1.7.0 through uv tool in the installer and runtime image.
• Adds regression checks for isolated installation.
• Bumps the capability version to 2.0.4.

File	Description
capabilities/​web-security/​tests/​test_install_tools_offline.py	Adds isolated-installation regression checks.
capabilities/​web-security/​scripts/​install_tools.sh	Uses uv tool install, preserving existing guards and failure handling.
capabilities/​web-security/​docker/​Dockerfile.runtime	Isolates Pacu while keeping its launcher accessible to runner.
capabilities/​web-security/​capability.yaml	Bumps version to 2.0.4.

_{Review effort: Balanced}