Harden command execution and implement autonomous tool installation#4
Merged
Conversation
The agent runs LLM-generated commands via ToolRunner. Execution was inconsistent across paths: POSIX sync used shlex.split (safe), but the Windows sync path used shell=True (cmd.exe) and execute_async() used create_subprocess_shell — both shell-injection surfaces. validate_command only checked the first token against the allowlist and never rejected shell operators or command substitution. - execute(): use shell=False on all platforms. On Windows the raw string goes to CreateProcess (no cmd.exe), so metacharacters are not interpreted. - execute_async(): replace create_subprocess_shell with create_subprocess_exec and bring it to parity with execute() (plugin interception, risky-command confirmation, output truncation, FileNotFoundError handling, logging, on_output) so it can never become a future footgun. - validate_command(): reject command substitution ($(...), backticks) and standalone shell-operator tokens (; | || & && > >> < <<) via a token-based check that does not false-positive on URLs (& inside a quoted arg). Handle unbalanced quotes gracefully instead of crashing. - Factor truncation into _truncate_output() (removes a duplicated long line). Adds 12 tests covering operator/substitution rejection, URL-with-ampersand acceptance, unbalanced-quote handling, shell-free proof (chained command's second half never runs; $HOME not interpolated), and async parity. Full suite: 755 passed, 40 skipped.
Harden command execution: shell-free and consistent across all paths
…lover [codex] feat: add DeepSeek key management
…un-sidebar-collapse [codex] Improve GUI agent auto-run and sidebar collapse
Spec for a new agent `install` action plus ToolInstaller module that auto-installs missing security tools through the existing hardened ToolRunner boundary. Allowlist-bounded by default, layered package managers (apt/dnf/pacman/brew + pipx/pip/go), respects safe_mode. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…tall drivers Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Remove package managers from the global allowlist so the agent cannot run them via a normal execute action. ToolInstaller.install now invokes them through a dedicated allow_install_drivers bypass on ToolRunner that permits only config.INSTALL_DRIVERS. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…l-install feat: autonomous security-tool installation
fix: make runner tests pass on Windows
Bring hackbot1 up to date with hackbot (19 commits)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This branch brings in 20 commits spanning runner hardening, multi-provider key management, GUI improvements, and an autonomous tool-installation system.
🔒 Runner & security hardening
99a3647— Harden the runner: shell-free, consistent command execution (removes shell interpolation risk).ab2107e— Enforce install-drivers-only via a runner bypass, preventing arbitrary install execution.e51b1e3— Document the enforced install-drivers-only mechanism (spec).🔑 DeepSeek multi-key failover (PR #2)
009b8aa— Add DeepSeek API key management.f3280d7— Merge multi-key failover support (rotates across keys on failure).🖥️ GUI improvements (PR #3)
a7e6165— Improve GUI agent auto-run behavior and sidebar collapse.5c05f14— Merge the GUI auto-run / sidebar work.📦 Autonomous tool installation (PR #4)
c16a358/fab9f81— Design doc + implementation plan for autonomous security-tool installation.59327a1— AddTOOL_INSTALL_MAP,allow_arbitrary_installflag, and install drivers to config.c82561e—ToolInstaller: package-manager detection and install planning.299fa9a— Execute installs via the runner and verify the binary resolves afterward.a2e130d— Allowlist-boundedinstallaction gated bysafe_mode.98beff7— Document the install action in the agent system prompt.3152bee— Add/installCLI command andhackbot installsubcommand.🧪 Tests & platform fixes (PR #5)
75dfbc3— Make runner tests pass on Windows.032cb22,8a930f8,0b3bee9integrate the above feature branches.Base
8f0a97e—Update README.md(the shared starting point).