agent-framework-lib 0.8.8.post7__tar.gz → 0.8.8.post8__tar.gz

{agent_framework_lib-0.8.8.post7/agent_framework_lib.egg-info → agent_framework_lib-0.8.8.post8}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agent-framework-lib
-Version: 0.8.8.post7
+Version: 0.8.8.post8
 Summary: A comprehensive Python framework for building and serving conversational AI agents with FastAPI
 Author-email: Sebastian Pavel <sebastian@cinco.ai>, Elliott Girard <elliott.girard@icloud.com>
 Maintainer-email: Sebastian Pavel <sebastian@cinco.ai>

{agent_framework_lib-0.8.8.post7 → agent_framework_lib-0.8.8.post8}/agent_framework/security/sandbox_provider.py

@@ -491,24 +491,14 @@ class OpenShellProvider(SandboxProvider):
             )
         else:
             logger.info("[sandbox] pulled %d file(s) from %s for %s", pulled, src, name)
-        # Best-effort: remove the per-command subdir so a long-lived session does
-        # not accumulate output slices in /sandbox/output.
-        if out_subdir:
-            with contextlib.suppress(Exception):
-                self._run_cli(
-                    [
-                        "sandbox",
-                        "exec",
-                        "-n",
-                        name,
-                        "--no-tty",
-                        "--",
-                        "/bin/sh",
-                        "-c",
-                        f"rm -rf {src}",
-                    ],
-                    timeout=30,
-                )
+        # Do NOT delete the per-command subdir after collecting: multi-step
+        # workflows reuse earlier artifacts BY PATH inside the sandbox (e.g. the
+        # chart skill emits chart.png and the pdf skill embeds it as <img src>
+        # in a LATER command — deleting the slice here stripped the images from
+        # the PDFs). Per-command isolation only requires that each finalizer
+        # download its OWN slice (out_subdir), which still holds. The whole
+        # sandbox (and its accumulated output) is removed at session close /
+        # idle-reap, so slices never outlive the session.
 
     def close_session(self, session_id: str) -> None:
         self._delete_by_name(self._name(session_id))

{agent_framework_lib-0.8.8.post7 → agent_framework_lib-0.8.8.post8}/agent_framework/tools/shell_tool.py

@@ -276,18 +276,24 @@ class ShellTool(AgentTool):
     )
 
     def _workspace_secrets_to_inject(self, skill_env_keys: set[str]) -> dict[str, str]:
-        """Workspace secrets to expose for this call (just-in-time).
-
-        Only secrets a currently loaded skill declares it needs (``requires_env``)
-        are exposed, so the default sandbox holds none. The legacy blanket
-        behavior is available via ``SHELL_INJECT_ALL_WORKSPACE_SECRETS=true``.
+        """Workspace secrets to expose for this call.
+
+        ALL workspace secrets are injected by default: a workspace exists
+        precisely so the user can hand the agent secrets it must be able to USE
+        in the shell — gating them behind a skill's ``requires_env`` broke that
+        core flow (functional regression). The hardening boundary is the
+        CONTAINER env (infra creds, allowlisted out by ``build_shell_env``), not
+        the user's own workspace secrets; their values are still redacted in any
+        displayed output. Set ``SHELL_INJECT_ALL_WORKSPACE_SECRETS=false`` to
+        opt in to the restrictive just-in-time mode (only secrets declared by a
+        loaded skill's ``requires_env``).
         """
         if not self._workspace_secrets:
             return {}
-        raw = os.environ.get("SHELL_INJECT_ALL_WORKSPACE_SECRETS", "").strip().lower()
-        if raw in ("true", "1", "yes", "on"):
-            return dict(self._workspace_secrets)
-        return {k: v for k, v in self._workspace_secrets.items() if k in skill_env_keys}
+        raw = os.environ.get("SHELL_INJECT_ALL_WORKSPACE_SECRETS", "true").strip().lower()
+        if raw in ("false", "0", "no", "off"):
+            return {k: v for k, v in self._workspace_secrets.items() if k in skill_env_keys}
+        return dict(self._workspace_secrets)
 
     def set_workspace_secrets(self, secrets: dict[str, str] | None) -> None:
         """Set per-session workspace secrets injected as env vars in shell_exec.
@@ -335,11 +341,9 @@ class ShellTool(AgentTool):
             os.environ,
             skill_env_keys=skill_env_keys,
         )
-        # Workspace secrets are injected JUST-IN-TIME: only those a currently
-        # loaded skill explicitly declares it needs (requires_env). The default
-        # sandbox therefore holds NO workspace secrets — a cracked sandbox sees
-        # nothing. Set SHELL_INJECT_ALL_WORKSPACE_SECRETS=true to restore the
-        # legacy blanket injection (discouraged).
+        # Workspace secrets: ALL injected (the workspace flow — the user hands
+        # the agent secrets it must be able to use in the shell). The hardening
+        # boundary is the container env (allowlisted above), not these.
         injected_ws = self._workspace_secrets_to_inject(skill_env_keys)
         for key, value in injected_ws.items():
             env[key] = value

{agent_framework_lib-0.8.8.post7 → agent_framework_lib-0.8.8.post8/agent_framework_lib.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agent-framework-lib
-Version: 0.8.8.post7
+Version: 0.8.8.post8
 Summary: A comprehensive Python framework for building and serving conversational AI agents with FastAPI
 Author-email: Sebastian Pavel <sebastian@cinco.ai>, Elliott Girard <elliott.girard@icloud.com>
 Maintainer-email: Sebastian Pavel <sebastian@cinco.ai>

{agent_framework_lib-0.8.8.post7 → agent_framework_lib-0.8.8.post8}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "agent-framework-lib"
-version = "0.8.8post7"
+version = "0.8.8post8"
 description = "A comprehensive Python framework for building and serving conversational AI agents with FastAPI"
 readme = {file = "README.md", content-type = "text/markdown"}
 license = {text = "MIT"}