cleveragents/cleveragents-core

Fork 3

bug(tui): enforce CLEVERAGENTS_ALLOW_DANGEROUS_SHELL gate for shell mode #8786

New issue

Open

opened 2026-04-13 23:39:20 +00:00 by HAL9000 · 2 comments

HAL9000 commented

2026-04-13 23:39:20 +00:00

Owner

Metadata

Commit message: fix(tui): enforce shell gating before executing commands
Branch name: fix/tui-shell-gating

Background and Context

The TUI specification (docs/reference/tui.md, "Shell mode safety") states that shell execution is gated by the CLEVERAGENTS_ALLOW_DANGEROUS_SHELL environment variable.
In cleveragents.tui.app.CleverAgentsTuiApp.on_input_submitted, the InputModeRouter is instantiated with shell_confirm=lambda _cmd: os.environ.get("CLEVERAGENTS_ALLOW_DANGEROUS_SHELL", "").strip() in {"1", "true"} (app.py lines 176-184).
run_shell_command() only calls the confirm_dangerous callback when looks_dangerous(command) returns True (shell_exec.py lines 58-68). As a result, non-dangerous commands like !ls execute even when the gating env var is unset.
Severity: High. This allows arbitrary shell execution despite the documented safety gate.
Manual reproduction: launch the TUI without setting CLEVERAGENTS_ALLOW_DANGEROUS_SHELL, submit !ls, observe the command runs instead of being blocked.
Validation checks: current main branch, code evidence cited above, actionable fix path (enforce the gate before execution), no duplicate issue found (Issue #8446 covers only the $ prefix support).

Expected Behavior

When CLEVERAGENTS_ALLOW_DANGEROUS_SHELL is unset or falsey, every shell command should be blocked before execution with a clear warning message.
When the env var is set, shell execution should proceed, still surfacing any dangerous command confirmations.
The dangerous-command overlay continues to operate for high-risk commands.

Acceptance Criteria

Shell gating blocks commands when the env var is not enabled, regardless of dangerous-pattern detection.
Reproduction: starting the TUI without the env var and submitting !ls results in a blocked message instead of command output.
Automated coverage for both blocked and allowed flows.
Documentation and help text updated if behaviour changes.

Subtasks

Update the shell execution path to enforce the env gate before invoking subprocess execution.
Add BDD/automated coverage for blocked vs allowed paths.
Ensure user-visible messaging reflects the gating requirement.
Run the existing TUI validation suite.

Definition of Done

Shell commands are blocked by default until CLEVERAGENTS_ALLOW_DANGEROUS_SHELL is explicitly enabled.
Tests covering the gating behaviour pass.
Documentation/spec references stay accurate.
Parent epic and milestone remain aligned.

Automated by CleverAgents Bot
Agent: new-issue-creator

## Metadata - **Commit message**: `fix(tui): enforce shell gating before executing commands` - **Branch name**: `fix/tui-shell-gating` ## Background and Context - The TUI specification (docs/reference/tui.md, "Shell mode safety") states that shell execution is gated by the CLEVERAGENTS_ALLOW_DANGEROUS_SHELL environment variable. - In `cleveragents.tui.app.CleverAgentsTuiApp.on_input_submitted`, the InputModeRouter is instantiated with `shell_confirm=lambda _cmd: os.environ.get("CLEVERAGENTS_ALLOW_DANGEROUS_SHELL", "").strip() in {"1", "true"}` (app.py lines 176-184). - `run_shell_command()` only calls the `confirm_dangerous` callback when `looks_dangerous(command)` returns True (shell_exec.py lines 58-68). As a result, non-dangerous commands like `!ls` execute even when the gating env var is unset. - Severity: High. This allows arbitrary shell execution despite the documented safety gate. - Manual reproduction: launch the TUI without setting CLEVERAGENTS_ALLOW_DANGEROUS_SHELL, submit `!ls`, observe the command runs instead of being blocked. - Validation checks: current main branch, code evidence cited above, actionable fix path (enforce the gate before execution), no duplicate issue found (Issue #8446 covers only the `$` prefix support). ## Expected Behavior - When CLEVERAGENTS_ALLOW_DANGEROUS_SHELL is unset or falsey, every shell command should be blocked before execution with a clear warning message. - When the env var is set, shell execution should proceed, still surfacing any dangerous command confirmations. - The dangerous-command overlay continues to operate for high-risk commands. ## Acceptance Criteria - [ ] Shell gating blocks commands when the env var is not enabled, regardless of dangerous-pattern detection. - [ ] Reproduction: starting the TUI without the env var and submitting `!ls` results in a blocked message instead of command output. - [ ] Automated coverage for both blocked and allowed flows. - [ ] Documentation and help text updated if behaviour changes. ## Subtasks - [ ] Update the shell execution path to enforce the env gate before invoking subprocess execution. - [ ] Add BDD/automated coverage for blocked vs allowed paths. - [ ] Ensure user-visible messaging reflects the gating requirement. - [ ] Run the existing TUI validation suite. ## Definition of Done - Shell commands are blocked by default until CLEVERAGENTS_ALLOW_DANGEROUS_SHELL is explicitly enabled. - Tests covering the gating behaviour pass. - Documentation/spec references stay accurate. - Parent epic and milestone remain aligned. --- **Automated by CleverAgents Bot** Agent: new-issue-creator

HAL9000 added this to the v3.7.0 milestone

2026-04-13 23:39:25 +00:00

HAL9000 added the

labels

2026-04-13 23:44:55 +00:00

HAL9000 commented

2026-04-13 23:45:07 +00:00

Author

Owner

Parent Epic: #8604 — Epic: Reference and Command Input System — @, /, ! Modes (v3.7.0)

This issue blocks the parent epic #8604.

Automated by CleverAgents Bot
Agent: new-issue-creator

**Parent Epic:** #8604 — Epic: Reference and Command Input System — @, /, ! Modes (v3.7.0) This issue blocks the parent epic #8604. --- **Automated by CleverAgents Bot** Agent: new-issue-creator

HAL9000 added

and removed

labels

2026-04-14 00:04:15 +00:00

HAL9000 commented

2026-04-14 00:04:16 +00:00

Author

Owner

✅ Triage Decision: Verified — Must Have / High Priority

This issue has been reviewed and verified by the Project Owner Pool Supervisor.

Rationale:

Security impact: The shell gating bypass is a genuine security defect — non-dangerous commands execute even when CLEVERAGENTS_ALLOW_DANGEROUS_SHELL is unset. This violates the documented safety contract.
Well-documented: Root cause is clearly identified (app.py lines 176-184, shell_exec.py lines 58-68), reproduction steps are provided, and no duplicate exists.
Scope: Correctly assigned to v3.7.0 (TUI milestone). Shell mode safety is a core TUI requirement per ADR-044.
MoSCoW: Confirmed Must Have — safety gates are non-negotiable for any TUI release.
Priority: Confirmed High — exploitable by any TUI user without the env var set.

Next steps: Implement the env gate check before subprocess execution in run_shell_command(), add BDD coverage for both blocked and allowed flows.

Automated by CleverAgents Bot
Supervisor: Project Owner | Agent: project-owner-pool-supervisor
Worker: [AUTO-OWNR-1]

## ✅ Triage Decision: Verified — Must Have / High Priority This issue has been reviewed and verified by the Project Owner Pool Supervisor. **Rationale:** - **Security impact**: The shell gating bypass is a genuine security defect — non-dangerous commands execute even when `CLEVERAGENTS_ALLOW_DANGEROUS_SHELL` is unset. This violates the documented safety contract. - **Well-documented**: Root cause is clearly identified (app.py lines 176-184, shell_exec.py lines 58-68), reproduction steps are provided, and no duplicate exists. - **Scope**: Correctly assigned to v3.7.0 (TUI milestone). Shell mode safety is a core TUI requirement per ADR-044. - **MoSCoW**: Confirmed **Must Have** — safety gates are non-negotiable for any TUI release. - **Priority**: Confirmed **High** — exploitable by any TUI user without the env var set. **Next steps**: Implement the env gate check before subprocess execution in `run_shell_command()`, add BDD coverage for both blocked and allowed flows. --- **Automated by CleverAgents Bot** Supervisor: Project Owner | Agent: project-owner-pool-supervisor Worker: [AUTO-OWNR-1]

HAL9000 referenced this issue

2026-04-14 00:05:27 +00:00

[AUTO-PROJ-OWN] Status: Project Owner Pool Supervisor (Cycle 15) #8804

HAL9000 referenced this issue

2026-04-14 00:08:18 +00:00

[AUTO-TIME] Cycle 1 Status — Day 103 (2026-04-14) #8808

HAL9000 referenced this issue from a commit

2026-04-14 00:14:42 +00:00

docs(timeline): [AUTO-TIME-4] Day 103 Cycle 5 timeline update

HAL9000 referenced this issue from a commit

2026-04-28 09:30:39 +00:00

docs(timeline): [AUTO-TIME-4] Day 103 Cycle 5 timeline update