opencode/picoclaw
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(security): add config env_set support

Browse source 
- Add EnvSet field to ExecConfig for config file
- Merge env_set into cachedEnv at ExecTool init
- LLM env overrides still checked against blocklist
This commit is contained in:
Keith Patrick 2026-03-08 19:55:11 +00:00
parent 1b0393fed3
commit b43acf4aba
2 changed files with 12 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
pkg/config/config.go
View file

@ -641,10 +641,11 @@ type CronToolsConfig struct {
type ExecConfig struct { type ExecConfig struct {
ToolConfig ` envPrefix:"PICOCLAW_TOOLS_EXEC_"` ToolConfig ` envPrefix:"PICOCLAW_TOOLS_EXEC_"`
EnableDenyPatterns bool ` env:"PICOCLAW_TOOLS_EXEC_ENABLE_DENY_PATTERNS" json:"enable_deny_patterns"` EnableDenyPatterns bool ` env:"PICOCLAW_TOOLS_EXEC_ENABLE_DENY_PATTERNS" json:"enable_deny_patterns"`
CustomDenyPatterns []string ` env:"PICOCLAW_TOOLS_EXEC_CUSTOM_DENY_PATTERNS" json:"custom_deny_patterns"` CustomDenyPatterns []string ` env:"PICOCLAW_TOOLS_EXEC_CUSTOM_DENY_PATTERNS" json:"custom_deny_patterns"`
CustomAllowPatterns []string ` env:"PICOCLAW_TOOLS_EXEC_CUSTOM_ALLOW_PATTERNS" json:"custom_allow_patterns"` CustomAllowPatterns []string ` env:"PICOCLAW_TOOLS_EXEC_CUSTOM_ALLOW_PATTERNS" json:"custom_allow_patterns"`
TimeoutSeconds int ` env:"PICOCLAW_TOOLS_EXEC_TIMEOUT_SECONDS" json:"timeout_seconds"` // 0 means use default (60s) TimeoutSeconds int ` env:"PICOCLAW_TOOLS_EXEC_TIMEOUT_SECONDS" json:"timeout_seconds"` // 0 means use default (60s)
EnvSet map[string]string ` json:"env_set"` // env vars to set for all exec commands
} }
type SkillsToolsConfig struct { type SkillsToolsConfig struct {

8
pkg/tools/shell.go
View file

@ -138,6 +138,12 @@ func NewExecToolWithConfig(workingDir string, restrict bool, config *config.Conf
timeout = time.Duration(config.Tools.Exec.TimeoutSeconds) * time.Second timeout = time.Duration(config.Tools.Exec.TimeoutSeconds) * time.Second
} }
// Get envSet from config (if provided)
var envSet map[string]string
if config != nil && config.Tools.Exec.EnvSet != nil {
envSet = config.Tools.Exec.EnvSet
}
return &ExecTool{ return &ExecTool{
workingDir: workingDir, workingDir: workingDir,
timeout: timeout, timeout: timeout,
@ -145,7 +151,7 @@ func NewExecToolWithConfig(workingDir string, restrict bool, config *config.Conf
allowPatterns: nil, allowPatterns: nil,
customAllowPatterns: customAllowPatterns, customAllowPatterns: customAllowPatterns,
restrictToWorkspace: restrict, restrictToWorkspace: restrict,
cachedEnv: shell.BuildSanitizedEnv(os.Environ(), nil, nil, nil), cachedEnv: shell.BuildSanitizedEnv(os.Environ(), nil, envSet, nil),
}, nil }, nil
} }