opencode/picoclaw
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add PICOCLAW_EXEC_TIME and PICOCLAW_EXEC_TIMEOUT env vars

Browse source 
- Add timestamp (RFC3339) and timeout to child process env
- Add PICOCLAW_* vars to blocklist so LLM cannot override
This commit is contained in:
Keith Patrick 2026-03-09 02:05:44 +00:00
parent b9dd313454
commit e0ffee8339
2 changed files with 18 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
pkg/tools/shell.go
View file

@ -184,7 +184,7 @@ func (t *ExecTool) Parameters() map[string]any {
},
"env": map[string]any{
"type": "object",
"description": "Additional environment variables to set for this command. Available: PICOCLAW_HOME, PICOCLAW_CONFIG, PICOCLAW_AGENT_WORKSPACE, PICOCLAW_EXE, PICOCLAW_SERVICE_NAME. Cannot override: PATH, HOME, USER, LOGNAME, SHELL, LD_PRELOAD, LD_LIBRARY_PATH, LD_AUDIT, LD_DEBUG",
"description": "Additional environment variables to set for this command. Available: PICOCLAW_HOME, PICOCLAW_CONFIG, PICOCLAW_AGENT_WORKSPACE, PICOCLAW_EXE, PICOCLAW_SERVICE_NAME, PICOCLAW_EXEC_TIME (RFC3339), PICOCLAW_EXEC_TIMEOUT. Cannot override: PATH, HOME, USER, LOGNAME, SHELL, LD_PRELOAD, LD_LIBRARY_PATH, LD_AUDIT, LD_DEBUG, PICOCLAW_*",
"additionalProperties": map[string]any{
"type": "string",
},
@ -252,9 +252,15 @@ func (t *ExecTool) Execute(ctx context.Context, args map[string]any) *ToolResult
}
}
// Add PICOCLAW_EXEC_TIME - timestamp when command is executed
execTimeEnv := map[string]string{
"PICOCLAW_EXEC_TIME": time.Now().Format(time.RFC3339),
"PICOCLAW_EXEC_TIMEOUT": t.timeout.String(),
}
// Use sanitized environment - strips secrets, prevents env-based attacks
// Pass extraEnv from LLM to apply blocklist filtering
cmd.Env = shell.BuildSanitizedEnv(t.cachedEnv, nil, nil, extraEnv)
cmd.Env = shell.BuildSanitizedEnv(t.cachedEnv, nil, execTimeEnv, extraEnv)
if cwd != "" {
cmd.Dir = cwd

10
pkg/tools/shell/env.go
View file

@ -55,6 +55,15 @@ var LLMBlocklist = map[string]bool{
"LD_LIBRARY_PATH": true, // Could hijack library resolution
"LD_AUDIT": true, // Could inject code
"LD_DEBUG": true, // Could leak info
// PICOCLAW_* vars - controlled by the agent, not LLM
"PICOCLAW_HOME": true,
"PICOCLAW_CONFIG": true,
"PICOCLAW_AGENT_WORKSPACE": true,
"PICOCLAW_EXE": true,
"PICOCLAW_SERVICE_NAME": true,
"PICOCLAW_EXEC_TIME": true,
"PICOCLAW_EXEC_TIMEOUT": true,
}
// windowsEnvAllowlist contains additional variables needed on Windows.
@ -78,6 +87,7 @@ var windowsEnvAllowlist = map[string]bool{
// envSet provides explicit key=value pairs from config (override inherited).
// extraEnv provides additional key=value pairs from tool call (merged with envSet).
func BuildSanitizedEnv(baseEnv []string, extraAllowlist []string, envSet, extraEnv map[string]string) []string {
// Use provided env or fall back to os.Environ
inherited := baseEnv
if inherited == nil {