shipit-agent 2.2.0__tar.gz → 2.2.1__tar.gz

{shipit_agent-2.2.0/shipit_agent.egg-info → shipit_agent-2.2.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: shipit-agent
-Version: 2.2.0
+Version: 2.2.1
 Summary: A clean, powerful agent runtime with tools, MCP support, profiles, and streaming events.
 Author: Rahul Raj
 License: MIT

{shipit_agent-2.2.0 → shipit_agent-2.2.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "shipit-agent"
-version = "2.2.0"
+version = "2.2.1"
 description = "A clean, powerful agent runtime with tools, MCP support, profiles, and streaming events."
 readme = "README.md"
 requires-python = ">=3.11"

{shipit_agent-2.2.0 → shipit_agent-2.2.1}/shipit_agent/tool_healing.py

@@ -235,6 +235,13 @@ def _match_by_schema(
         if isinstance(schemas.get(name), dict)
         and _arguments_fit_schema(coerced, schemas[name], strict_required=True)
     ]
+    if len(fits) > 1:
+        # Several tools accept the object; the one that declares every key the
+        # model wrote is the call it meant ({"path", "content"} is write_file,
+        # not read_file, which only knows "path"). Still a tie → leave it.
+        complete = [name for name in fits
+                    if set(coerced) <= set((schemas[name].get("properties") or {}))]
+        fits = complete if len(complete) == 1 else fits
     if len(fits) != 1:
         return None
     return ToolCall(name=fits[0], arguments=coerced)

{shipit_agent-2.2.0 → shipit_agent-2.2.1}/shipit_agent/tools/bash/bash_tool.py

@@ -10,6 +10,7 @@ from typing import Any
 
 from shipit_agent.tools.base import ToolContext, ToolOutput
 from shipit_agent.tools.formatting import clip_text
+from shipit_agent.tools.subprocess_env import build_tool_env
 
 from .prompt import BASH_PROMPT
 
@@ -58,6 +59,14 @@ class BashTool:
         #: a full shell when the environment is already trusted /
         #: sandboxed. The allowlist and blocked-substring checks still apply.
         unrestricted: bool = False,
+        #: The child shell gets a scrubbed environment (PATH, HOME, locale,
+        #: TERM, TMPDIR and similar) so host secrets are not readable with
+        #: ``printenv``. ``env_allowlist`` passes named host variables through,
+        #: ``extra_env`` sets explicit values (e.g. ``{"HOME": workspace}``),
+        #: and ``inherit_env=True`` restores the full host environment.
+        env_allowlist: list[str] | None = None,
+        extra_env: dict[str, str] | None = None,
+        inherit_env: bool = False,
     ) -> None:
         self.root_dir = Path(root_dir).resolve()
         self.name = name
@@ -67,6 +76,9 @@ class BashTool:
         self.default_timeout = default_timeout
         self.max_timeout = max_timeout
         self.unrestricted = unrestricted
+        self.env_allowlist = list(env_allowlist or [])
+        self.extra_env = dict(extra_env or {})
+        self.inherit_env = inherit_env
         #: Live background jobs, id → {process, log_path, command}, for the
         #: companion poll/kill tool.
         self.background_jobs: dict[str, dict[str, Any]] = {}
@@ -336,6 +348,7 @@ class BashTool:
         completed = subprocess.run(
             ["/bin/bash", "-lc", command],
             cwd=str(cwd),
+            env=self._child_env(),
             capture_output=True,
             text=True,
             timeout=timeout,
@@ -366,6 +379,13 @@ class BashTool:
             },
         )
 
+    def _child_env(self) -> dict[str, str]:
+        return build_tool_env(
+            allowlist=self.env_allowlist,
+            extra_env=self.extra_env,
+            inherit=self.inherit_env,
+        )
+
     def _run_background(self, command: str, cwd: Path) -> ToolOutput:
         """Spawn a long-running command detached, log to a file the LLM can tail.
 
@@ -382,6 +402,7 @@ class BashTool:
             process = subprocess.Popen(
                 ["/bin/bash", "-lc", command],
                 cwd=str(cwd),
+                env=self._child_env(),
                 stdout=log_file,
                 stderr=subprocess.STDOUT,
                 start_new_session=True,

{shipit_agent-2.2.0 → shipit_agent-2.2.1}/shipit_agent/tools/code_execution/code_execution_tool.py

@@ -1,5 +1,6 @@
 from __future__ import annotations
 
+import os
 import shutil
 import subprocess
 from pathlib import Path
@@ -8,6 +9,7 @@ from typing import ClassVar
 
 from shipit_agent.tools.base import ToolContext, ToolOutput
 from shipit_agent.tools.formatting import clip_text
+from shipit_agent.tools.subprocess_env import build_tool_env
 from .prompt import CODE_EXECUTION_PROMPT
 from .sandbox import (
     SANDBOX_CMDS as _SANDBOX_CMDS,
@@ -67,6 +69,10 @@ class CodeExecutionTool:
         description: str = "Execute Python or shell code in a local subprocess workspace.",
         prompt: str | None = None,
         timeout_seconds: int = 15,
+        # Scrubbed child environment by default; see BashTool for semantics.
+        env_allowlist: list[str] | None = None,
+        extra_env: dict[str, str] | None = None,
+        inherit_env: bool = False,
     ) -> None:
         self.workspace_root = Path(workspace_root)
         self.name = name
@@ -74,6 +80,9 @@ class CodeExecutionTool:
         self.prompt = prompt or CODE_EXECUTION_PROMPT
         self.prompt_instructions = "Use this for deterministic local execution, transformations, parsing, and script-based validation."
         self.timeout_seconds = timeout_seconds
+        self.env_allowlist = list(env_allowlist or [])
+        self.extra_env = dict(extra_env or {})
+        self.inherit_env = inherit_env
 
     def schema(self) -> dict:
         return {
@@ -200,6 +209,17 @@ class CodeExecutionTool:
             else:
                 command = self._command_for_language(language, script_path)
                 cwd = workspace_root
+            child_env = build_tool_env(
+                allowlist=self.env_allowlist,
+                extra_env=self.extra_env,
+                inherit=self.inherit_env,
+            )
+            if sandbox:
+                # The docker CLI needs these to find its daemon (colima, remote
+                # hosts); the container itself never inherits host env.
+                child_env.update(
+                    (k, v) for k, v in os.environ.items() if k.startswith("DOCKER_")
+                )
 
             try:
                 completed = subprocess.run(
@@ -208,6 +228,7 @@ class CodeExecutionTool:
                     capture_output=True,
                     text=True,
                     timeout=timeout_seconds,
+                    env=child_env,
                     check=False,
                 )
             except FileNotFoundError as err:

shipit_agent-2.2.1/shipit_agent/tools/subprocess_env.py

@@ -0,0 +1,72 @@
+"""Environment for subprocesses that run model-written commands.
+
+Tools like ``bash`` and ``run_code`` execute whatever the model asks for, so
+whatever is in the host process environment (API keys loaded by dotenv, DB
+passwords, ``SECRET_KEY``) is one ``printenv`` away from the model. Those tools
+build their child environment here: a short list of non-secret basics, plus
+only what the caller explicitly opts in to.
+"""
+
+from __future__ import annotations
+
+import os
+from collections.abc import Iterable, Mapping
+
+#: Non-secret variables a shell or interpreter needs to behave normally.
+#: Deliberately excludes ``SSH_AUTH_SOCK`` (an agent socket is a credential)
+#: and anything provider/cloud specific.
+SAFE_ENV_NAMES: frozenset[str] = frozenset(
+    {
+        "PATH",
+        "HOME",
+        "USER",
+        "LOGNAME",
+        "SHELL",
+        "LANG",
+        "LANGUAGE",
+        "TERM",
+        "TZ",
+        "TMPDIR",
+        "TMP",
+        "TEMP",
+        "PYTHONIOENCODING",
+        # Windows: Python and most CLIs fail to start without these.
+        "SYSTEMROOT",
+        "WINDIR",
+        "COMSPEC",
+        "PATHEXT",
+    }
+)
+SAFE_ENV_PREFIXES: tuple[str, ...] = ("LC_",)
+
+
+def build_tool_env(
+    *,
+    allowlist: Iterable[str] = (),
+    extra_env: Mapping[str, str] | None = None,
+    inherit: bool = False,
+    parent: Mapping[str, str] | None = None,
+) -> dict[str, str]:
+    """Return the environment for a model-controlled subprocess.
+
+    Precedence, lowest to highest: the safe basics (or the whole parent
+    environment when ``inherit`` is true), then parent variables named in
+    ``allowlist``, then ``extra_env`` verbatim.
+    """
+    source = os.environ if parent is None else parent
+    if inherit:
+        env = dict(source)
+    else:
+        env = {
+            name: value
+            for name, value in source.items()
+            if name in SAFE_ENV_NAMES or name.startswith(SAFE_ENV_PREFIXES)
+        }
+    env.setdefault("PATH", os.defpath)
+    env.setdefault("PYTHONIOENCODING", "utf-8")
+    for name in allowlist:
+        if name in source:
+            env[name] = source[name]
+    if extra_env:
+        env.update(extra_env)
+    return env

{shipit_agent-2.2.0 → shipit_agent-2.2.1/shipit_agent.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: shipit-agent
-Version: 2.2.0
+Version: 2.2.1
 Summary: A clean, powerful agent runtime with tools, MCP support, profiles, and streaming events.
 Author: Rahul Raj
 License: MIT

{shipit_agent-2.2.0 → shipit_agent-2.2.1}/shipit_agent.egg-info/SOURCES.txt

@@ -344,6 +344,7 @@ shipit-icon.svg
 ./shipit_agent/tools/formatting.py
 ./shipit_agent/tools/function.py
 ./shipit_agent/tools/helpers.py
+./shipit_agent/tools/subprocess_env.py
 ./shipit_agent/tools/webhook_payload.py
 ./shipit_agent/tools/apps/__init__.py
 ./shipit_agent/tools/apps/apps_tools.py
@@ -1034,6 +1035,7 @@ shipit_agent/tools/contracts.py
 shipit_agent/tools/formatting.py
 shipit_agent/tools/function.py
 shipit_agent/tools/helpers.py
+shipit_agent/tools/subprocess_env.py
 shipit_agent/tools/webhook_payload.py
 shipit_agent/tools/apps/__init__.py
 shipit_agent/tools/apps/apps_tools.py
@@ -1481,6 +1483,7 @@ tests/test_tool_output_streaming.py
 tests/test_tool_prompts.py
 tests/test_tool_schemas_bedrock_compat.py
 tests/test_tool_section_placement.py
+tests/test_tool_subprocess_env.py
 tests/test_tracing_exporters.py
 tests/test_triggers.py
 tests/test_user_prompt_hooks.py

{shipit_agent-2.2.0 → shipit_agent-2.2.1}/tests/test_heal_json_answer.py

@@ -32,3 +32,27 @@ def test_a_named_call_to_a_no_argument_tool_still_heals():
     raw = '{"name": "list_documents", "arguments": {}}'
     _, calls = heal_tool_calls(raw, set(SCHEMAS), schemas=SCHEMAS)
     assert [c.name for c in calls] == ["list_documents"]
+
+
+FILE_SCHEMAS = {
+    "write_file": {"type": "object", "properties": {"path": {"type": "string"}, "content": {"type": "string"}},
+                   "required": ["path", "content"]},
+    "read_file": {"type": "object", "properties": {"path": {"type": "string"}}, "required": ["path"]},
+    "present_file": {"type": "object", "properties": {"path": {"type": "string"}}, "required": ["path"]},
+}
+
+
+def test_the_one_tool_that_declares_every_key_wins_a_tie():
+    """Found live: a text <tool_call> {"path", "content"} fit write_file,
+    read_file and present_file (all declare path), so it was dropped as
+    ambiguous and the file was never written."""
+    text = ('I will create the file.\n<tool_call>\n{"path": "notes.md", "content": "# Notes"}\n'
+            '</tool_call>')
+    _, calls = heal_tool_calls(text, set(FILE_SCHEMAS), schemas=FILE_SCHEMAS)
+    assert [(c.name, c.arguments) for c in calls] == [("write_file", {"path": "notes.md", "content": "# Notes"})]
+
+
+def test_a_real_tie_is_still_left_alone():
+    text = '<tool_call>\n{"path": "notes.md"}\n</tool_call>'
+    _, calls = heal_tool_calls(text, {"read_file", "present_file"}, schemas=FILE_SCHEMAS)
+    assert calls == []

shipit_agent-2.2.1/tests/test_tool_subprocess_env.py

@@ -0,0 +1,248 @@
+"""Model-controlled subprocess tools must not leak the host environment.
+
+``bash`` and ``run_code`` run commands the model wrote. Anything in the host
+process environment (API keys loaded by dotenv, DB passwords, SECRET_KEY) was
+readable with ``printenv`` / ``os.environ``. These tests pin the scrubbed
+default and the explicit opt-ins.
+"""
+
+from __future__ import annotations
+
+import os
+import subprocess
+import sys
+import time
+from pathlib import Path
+from typing import Any
+
+import pytest
+
+from shipit_agent.tools.base import ToolContext
+from shipit_agent.tools.bash.bash_tool import BashJobTool, BashTool
+from shipit_agent.tools.code_execution import CodeExecutionTool
+from shipit_agent.tools.subprocess_env import SAFE_ENV_NAMES, build_tool_env
+
+SECRET_NAME = "SHIPIT_TEST_SECRET_7F3A"
+SECRET_VALUE = "s3cr3t-value-that-must-not-leak"
+
+
+@pytest.fixture()
+def secret_env(monkeypatch: pytest.MonkeyPatch) -> None:
+    monkeypatch.setenv(SECRET_NAME, SECRET_VALUE)
+
+
+def _ctx() -> ToolContext:
+    return ToolContext(prompt="env test")
+
+
+class TestBuildToolEnv:
+    def test_drops_unlisted_vars(self) -> None:
+        env = build_tool_env(parent={"PATH": "/bin", SECRET_NAME: SECRET_VALUE})
+        assert env["PATH"] == "/bin"
+        assert SECRET_NAME not in env
+
+    def test_keeps_safe_basics_and_locale_prefix(self) -> None:
+        parent = {
+            "HOME": "/home/u",
+            "LANG": "en_US.UTF-8",
+            "LC_ALL": "en_US.UTF-8",
+            "LC_CTYPE": "UTF-8",
+            "TERM": "xterm",
+            "TMPDIR": "/tmp/x",
+            "PATH": "/usr/bin",
+        }
+        env = build_tool_env(parent=parent)
+        for name, value in parent.items():
+            assert env[name] == value
+
+    def test_path_falls_back_to_default_when_missing(self) -> None:
+        env = build_tool_env(parent={})
+        assert env["PATH"] == os.defpath
+        assert env["PYTHONIOENCODING"] == "utf-8"
+
+    def test_does_not_keep_ssh_agent_socket(self) -> None:
+        env = build_tool_env(parent={"SSH_AUTH_SOCK": "/tmp/agent.sock"})
+        assert "SSH_AUTH_SOCK" not in env
+        assert "SSH_AUTH_SOCK" not in SAFE_ENV_NAMES
+
+    def test_allowlist_passes_named_vars_only(self) -> None:
+        parent = {SECRET_NAME: SECRET_VALUE, "OTHER": "x"}
+        env = build_tool_env(parent=parent, allowlist=[SECRET_NAME, "MISSING"])
+        assert env[SECRET_NAME] == SECRET_VALUE
+        assert "OTHER" not in env
+        assert "MISSING" not in env
+
+    def test_extra_env_overrides_everything(self) -> None:
+        env = build_tool_env(
+            parent={"HOME": "/home/u"},
+            extra_env={"HOME": "/workspace", "FEATURE": "on"},
+        )
+        assert env["HOME"] == "/workspace"
+        assert env["FEATURE"] == "on"
+
+    def test_inherit_passes_whole_parent(self) -> None:
+        env = build_tool_env(parent={SECRET_NAME: SECRET_VALUE}, inherit=True)
+        assert env[SECRET_NAME] == SECRET_VALUE
+
+    def test_empty_inputs(self) -> None:
+        env = build_tool_env(parent={}, allowlist=[], extra_env={})
+        assert set(env) == {"PATH", "PYTHONIOENCODING"}
+
+    def test_defaults_to_os_environ(self, secret_env: None) -> None:
+        env = build_tool_env()
+        assert SECRET_NAME not in env
+        assert env["PATH"] == os.environ["PATH"]
+
+
+class TestBashToolEnv:
+    def test_secret_not_visible_to_printenv(
+        self, tmp_path: Path, secret_env: None
+    ) -> None:
+        out = BashTool(root_dir=tmp_path).run(_ctx(), command=f"printenv {SECRET_NAME}")
+        assert SECRET_VALUE not in out.text
+        assert out.metadata["exit_code"] != 0
+
+    def test_secret_not_in_env_dump(self, tmp_path: Path, secret_env: None) -> None:
+        out = BashTool(root_dir=tmp_path).run(_ctx(), command="env")
+        assert out.metadata["exit_code"] == 0
+        assert SECRET_VALUE not in out.metadata["stdout"]
+        assert SECRET_NAME not in out.metadata["stdout"]
+
+    def test_path_still_resolves_commands(
+        self, tmp_path: Path, secret_env: None
+    ) -> None:
+        (tmp_path / "marker.txt").write_text("x")
+        out = BashTool(root_dir=tmp_path).run(_ctx(), command="ls")
+        assert out.metadata["exit_code"] == 0
+        assert "marker.txt" in out.metadata["stdout"]
+
+    def test_allowlisted_var_passes_through(
+        self, tmp_path: Path, secret_env: None
+    ) -> None:
+        tool = BashTool(root_dir=tmp_path, env_allowlist=[SECRET_NAME])
+        out = tool.run(_ctx(), command=f"printenv {SECRET_NAME}")
+        assert out.metadata["stdout"].strip() == SECRET_VALUE
+
+    def test_extra_env_sets_value(self, tmp_path: Path) -> None:
+        tool = BashTool(root_dir=tmp_path, extra_env={"SHIPIT_FLAG": "on"})
+        out = tool.run(_ctx(), command="printenv SHIPIT_FLAG")
+        assert out.metadata["stdout"].strip() == "on"
+
+    def test_inherit_env_opt_in(self, tmp_path: Path, secret_env: None) -> None:
+        tool = BashTool(root_dir=tmp_path, inherit_env=True)
+        out = tool.run(_ctx(), command=f"printenv {SECRET_NAME}")
+        assert out.metadata["stdout"].strip() == SECRET_VALUE
+
+    def test_background_job_does_not_see_secret(
+        self, tmp_path: Path, secret_env: None
+    ) -> None:
+        bash = BashTool(root_dir=tmp_path)
+        started = bash.run(_ctx(), command="env", background=True)
+        job_id = started.metadata["job_id"]
+        job = BashJobTool(bash)
+        deadline = time.monotonic() + 10
+        result = job.run(_ctx(), job_id=job_id, tail_lines=500)
+        while result.metadata["running"] and time.monotonic() < deadline:
+            time.sleep(0.1)
+            result = job.run(_ctx(), job_id=job_id, tail_lines=500)
+        assert result.metadata["exit_code"] == 0
+        assert "PATH=" in result.metadata["output"]
+        assert SECRET_VALUE not in result.metadata["output"]
+
+    def test_background_job_allowlist(
+        self, tmp_path: Path, secret_env: None
+    ) -> None:
+        bash = BashTool(root_dir=tmp_path, env_allowlist=[SECRET_NAME])
+        started = bash.run(_ctx(), command=f"printenv {SECRET_NAME}", background=True)
+        assert SECRET_VALUE in started.metadata["early_output"]
+
+
+class TestCodeExecutionEnv:
+    def _run_python(self, tool: CodeExecutionTool) -> Any:
+        return tool.run(
+            _ctx(),
+            language="python",
+            code=f"import os; print(os.environ.get({SECRET_NAME!r}))",
+        )
+
+    def test_secret_not_visible(self, tmp_path: Path, secret_env: None) -> None:
+        out = self._run_python(CodeExecutionTool(workspace_root=tmp_path))
+        assert out.metadata["exit_code"] == 0
+        assert out.metadata["stdout"].strip() == "None"
+
+    def test_bash_language_cannot_printenv_secret(
+        self, tmp_path: Path, secret_env: None
+    ) -> None:
+        out = CodeExecutionTool(workspace_root=tmp_path).run(
+            _ctx(), language="bash", code=f"printenv {SECRET_NAME} || echo absent"
+        )
+        assert out.metadata["stdout"].strip() == "absent"
+
+    def test_allowlist_opt_in(self, tmp_path: Path, secret_env: None) -> None:
+        tool = CodeExecutionTool(workspace_root=tmp_path, env_allowlist=[SECRET_NAME])
+        assert self._run_python(tool).metadata["stdout"].strip() == SECRET_VALUE
+
+    def test_inherit_env_opt_in(self, tmp_path: Path, secret_env: None) -> None:
+        tool = CodeExecutionTool(workspace_root=tmp_path, inherit_env=True)
+        assert self._run_python(tool).metadata["stdout"].strip() == SECRET_VALUE
+
+    def test_extra_env_sets_value(self, tmp_path: Path) -> None:
+        tool = CodeExecutionTool(workspace_root=tmp_path, extra_env={"SHIPIT_FLAG": "on"})
+        out = tool.run(
+            _ctx(),
+            language="python",
+            code="import os; print(os.environ['SHIPIT_FLAG'])",
+        )
+        assert out.metadata["stdout"].strip() == "on"
+
+    def test_sandbox_docker_cli_keeps_docker_vars_not_secrets(
+        self,
+        tmp_path: Path,
+        monkeypatch: pytest.MonkeyPatch,
+        secret_env: None,
+    ) -> None:
+        monkeypatch.setenv("DOCKER_HOST", "unix:///tmp/colima.sock")
+        monkeypatch.setenv("DOCKER_CONTEXT", "colima")
+        captured: dict[str, Any] = {}
+
+        def _fake_run(argv: list[str], **kw: Any) -> Any:
+            captured.update(kw)
+            return subprocess.CompletedProcess(argv, 0, "ok\n", "")
+
+        monkeypatch.setattr(subprocess, "run", _fake_run)
+        CodeExecutionTool(workspace_root=tmp_path).run(
+            _ctx(), language="python", code="print(1)", sandbox=True
+        )
+        env = captured["env"]
+        assert env["DOCKER_HOST"] == "unix:///tmp/colima.sock"
+        assert env["DOCKER_CONTEXT"] == "colima"
+        assert SECRET_NAME not in env
+
+    def test_local_path_does_not_pass_docker_vars(
+        self,
+        tmp_path: Path,
+        monkeypatch: pytest.MonkeyPatch,
+    ) -> None:
+        monkeypatch.setenv("DOCKER_HOST", "unix:///tmp/colima.sock")
+        captured: dict[str, Any] = {}
+
+        def _fake_run(argv: list[str], **kw: Any) -> Any:
+            captured.update(kw)
+            return subprocess.CompletedProcess(argv, 0, "ok\n", "")
+
+        monkeypatch.setattr(subprocess, "run", _fake_run)
+        CodeExecutionTool(workspace_root=tmp_path).run(
+            _ctx(), language="python", code="print(1)"
+        )
+        assert "DOCKER_HOST" not in captured["env"]
+
+
+def test_python_interpreter_runs_under_scrubbed_env() -> None:
+    completed = subprocess.run(
+        [sys.executable, "-c", "print('ok')"],
+        env=build_tool_env(parent={}),
+        capture_output=True,
+        text=True,
+        check=False,
+    )
+    assert completed.stdout.strip() == "ok"