opencode/picoclaw
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(security): add config env_allowlist support

Browse source
This commit is contained in:
Keith Patrick 2026-03-08 23:04:15 +00:00
parent ceac1e7671
commit bf7279e2a1
2 changed files with 8 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
pkg/config/config.go
View file

@ -646,6 +646,7 @@ type ExecConfig struct {
CustomAllowPatterns []string ` env:"PICOCLAW_TOOLS_EXEC_CUSTOM_ALLOW_PATTERNS" json:"custom_allow_patterns"`
TimeoutSeconds int ` env:"PICOCLAW_TOOLS_EXEC_TIMEOUT_SECONDS" json:"timeout_seconds"` // 0 means use default (60s)
EnvSet map[string]string ` json:"env_set"` // env vars to set for all exec commands
EnvAllowlist []string ` json:"env_allowlist"` // additional env vars to allow (extends default)
}
type SkillsToolsConfig struct {

8
pkg/tools/shell.go
View file

@ -138,11 +138,15 @@ func NewExecToolWithConfig(workingDir string, restrict bool, config *config.Conf
timeout = time.Duration(config.Tools.Exec.TimeoutSeconds) * time.Second
}
// Get envSet from config (if provided)
// Get envSet and envAllowlist from config (if provided)
var envSet map[string]string
var envAllowlist []string
if config != nil && config.Tools.Exec.EnvSet != nil {
envSet = config.Tools.Exec.EnvSet
}
if config != nil && config.Tools.Exec.EnvAllowlist != nil {
envAllowlist = config.Tools.Exec.EnvAllowlist
}
return &ExecTool{
workingDir: workingDir,
@ -151,7 +155,7 @@ func NewExecToolWithConfig(workingDir string, restrict bool, config *config.Conf
allowPatterns: nil,
customAllowPatterns: customAllowPatterns,
restrictToWorkspace: restrict,
cachedEnv: shell.BuildSanitizedEnv(os.Environ(), nil, envSet, nil),
cachedEnv: shell.BuildSanitizedEnv(os.Environ(), envAllowlist, envSet, nil),
}, nil
}