cleveragents/cleveragents-core

Fork 3

Security: Arbitrary shell execution via `CLEVERAGENTS_ALLOW_DANGEROUS_SHELL` — add session-level first-use confirmation dialog #8881

New issue

Open

opened 2026-04-14 03:19:30 +00:00 by HAL9000 · 1 comment

HAL9000 commented

2026-04-14 03:19:30 +00:00

Owner

Metadata

Commit Message: feat(tui): add session-level shell execution confirmation dialog on first use
Branch: feat/tui-shell-session-confirmation-dialog

Background and Context

The TUI allows arbitrary shell command execution when the CLEVERAGENTS_ALLOW_DANGEROUS_SHELL environment variable is set to 1 or true. While this is an intentional feature for advanced users, it presents a security risk if a user is unaware that the variable is set in their environment, or if they are tricked into setting it.

The shell_confirm lambda in src/cleveragents/tui/app.py (within on_input_submitted) only checks for the presence of the environment variable and does not provide any in-session warning or confirmation step:

shell_confirm=lambda _cmd: (
    os.environ.get("CLEVERAGENTS_ALLOW_DANGEROUS_SHELL", "").strip()
    in {"1", "true"}
),

This means a user who has CLEVERAGENTS_ALLOW_DANGEROUS_SHELL=1 set (e.g., from a previous session, a shared shell profile, or a social-engineering attack) will silently execute arbitrary shell commands with no in-application warning or confirmation prompt.

Note: This issue is distinct from #6361, which tracks wiring the ShellSafetyService / DangerousPatternDetector infrastructure for pattern-based danger-level detection and visual warning overlays. This issue specifically addresses the absence of a session-level, first-use confirmation gate that must be acknowledged before any shell command is executed in a given TUI session.

Steps to Reproduce:

Set the environment variable: export CLEVERAGENTS_ALLOW_DANGEROUS_SHELL=1
Run the CleverAgents TUI.
Enter a shell command prefixed with !, for example: !ls -l
The command executes immediately with no confirmation prompt.

Expected Behavior

The application should display a clear, explicit confirmation dialog the first time the user attempts to use the shell execution feature in a session, even if CLEVERAGENTS_ALLOW_DANGEROUS_SHELL is set. This dialog must require explicit user confirmation before the command is executed. Subsequent shell commands within the same session may proceed without re-confirmation.

Acceptance Criteria

The first shell command (!-prefixed input) in any TUI session triggers a confirmation dialog before execution, regardless of the CLEVERAGENTS_ALLOW_DANGEROUS_SHELL value.
The confirmation dialog clearly states that shell execution is enabled and warns the user of the risk of arbitrary command execution.
If the user confirms, the command executes and subsequent shell commands in the same session proceed without re-prompting.
If the user cancels/dismisses the dialog, the command is not executed and the shell warning flag remains unset (so the next attempt will prompt again).
The SessionView dataclass gains a shell_warning_shown: bool = False field (or equivalent) to track per-session confirmation state.
The confirmation state is not persisted across sessions — each new TUI session requires fresh confirmation.
BDD scenarios cover: first-use prompt shown, user confirms → command executes, user cancels → command not executed, second use in same session → no re-prompt.
Integration tests verify the full flow with a real InputModeRouter.
Test coverage remains ≥ 97%.
All nox sessions pass with no errors.

Subtasks

Add shell_warning_shown: bool = False field to SessionView dataclass in src/cleveragents/tui/app.py
Implement a ShellConfirmationOverlay widget (or reuse an existing modal pattern) that displays the first-use warning and requires explicit confirmation
Update on_input_submitted in _TextualCleverAgentsTuiApp: if result.mode == InputMode.SHELL and self._session.shell_warning_shown is False, show the confirmation dialog instead of executing immediately
On user confirmation: set self._session.shell_warning_shown = True and execute the pending shell command
On user cancellation: do not execute the command; leave shell_warning_shown = False
Tests (Behave): Add BDD scenarios for first-use confirmation flow (confirm path, cancel path, second-use no-reprompt path)
Tests (Robot): Add integration test for the full shell confirmation flow
Verify coverage ≥ 97% via nox -s coverage_report
Run nox (all default sessions), fix any errors

Definition of Done

This issue is complete when:

All subtasks above are completed and checked off.
A Git commit is created where the first line of the commit message matches the Commit Message in Metadata exactly (feat(tui): add session-level shell execution confirmation dialog on first use), followed by a blank line, then additional lines providing relevant implementation details.
The commit is pushed to the remote on the branch matching the Branch in Metadata exactly (feat/tui-shell-session-confirmation-dialog).
The commit is submitted as a pull request to master, reviewed, and merged before this issue is marked done.

Automated by CleverAgents Bot
Agent: new-issue-creator

## Metadata - **Commit Message**: `feat(tui): add session-level shell execution confirmation dialog on first use` - **Branch**: `feat/tui-shell-session-confirmation-dialog` ## Background and Context The TUI allows arbitrary shell command execution when the `CLEVERAGENTS_ALLOW_DANGEROUS_SHELL` environment variable is set to `1` or `true`. While this is an intentional feature for advanced users, it presents a security risk if a user is unaware that the variable is set in their environment, or if they are tricked into setting it. The `shell_confirm` lambda in `src/cleveragents/tui/app.py` (within `on_input_submitted`) only checks for the presence of the environment variable and does not provide any in-session warning or confirmation step: ```python shell_confirm=lambda _cmd: ( os.environ.get("CLEVERAGENTS_ALLOW_DANGEROUS_SHELL", "").strip() in {"1", "true"} ), ``` This means a user who has `CLEVERAGENTS_ALLOW_DANGEROUS_SHELL=1` set (e.g., from a previous session, a shared shell profile, or a social-engineering attack) will silently execute arbitrary shell commands with no in-application warning or confirmation prompt. **Note:** This issue is distinct from #6361, which tracks wiring the `ShellSafetyService` / `DangerousPatternDetector` infrastructure for pattern-based danger-level detection and visual warning overlays. This issue specifically addresses the absence of a session-level, first-use confirmation gate that must be acknowledged before any shell command is executed in a given TUI session. **Steps to Reproduce:** 1. Set the environment variable: `export CLEVERAGENTS_ALLOW_DANGEROUS_SHELL=1` 2. Run the CleverAgents TUI. 3. Enter a shell command prefixed with `!`, for example: `!ls -l` 4. The command executes immediately with no confirmation prompt. ## Expected Behavior The application should display a clear, explicit confirmation dialog the **first time** the user attempts to use the shell execution feature in a session, even if `CLEVERAGENTS_ALLOW_DANGEROUS_SHELL` is set. This dialog must require explicit user confirmation before the command is executed. Subsequent shell commands within the same session may proceed without re-confirmation. ## Acceptance Criteria - [ ] The first shell command (`!`-prefixed input) in any TUI session triggers a confirmation dialog before execution, regardless of the `CLEVERAGENTS_ALLOW_DANGEROUS_SHELL` value. - [ ] The confirmation dialog clearly states that shell execution is enabled and warns the user of the risk of arbitrary command execution. - [ ] If the user confirms, the command executes and subsequent shell commands in the same session proceed without re-prompting. - [ ] If the user cancels/dismisses the dialog, the command is not executed and the shell warning flag remains unset (so the next attempt will prompt again). - [ ] The `SessionView` dataclass gains a `shell_warning_shown: bool = False` field (or equivalent) to track per-session confirmation state. - [ ] The confirmation state is **not** persisted across sessions — each new TUI session requires fresh confirmation. - [ ] BDD scenarios cover: first-use prompt shown, user confirms → command executes, user cancels → command not executed, second use in same session → no re-prompt. - [ ] Integration tests verify the full flow with a real `InputModeRouter`. - [ ] Test coverage remains ≥ 97%. - [ ] All `nox` sessions pass with no errors. ## Subtasks - [ ] Add `shell_warning_shown: bool = False` field to `SessionView` dataclass in `src/cleveragents/tui/app.py` - [ ] Implement a `ShellConfirmationOverlay` widget (or reuse an existing modal pattern) that displays the first-use warning and requires explicit confirmation - [ ] Update `on_input_submitted` in `_TextualCleverAgentsTuiApp`: if `result.mode == InputMode.SHELL` and `self._session.shell_warning_shown is False`, show the confirmation dialog instead of executing immediately - [ ] On user confirmation: set `self._session.shell_warning_shown = True` and execute the pending shell command - [ ] On user cancellation: do not execute the command; leave `shell_warning_shown = False` - [ ] Tests (Behave): Add BDD scenarios for first-use confirmation flow (confirm path, cancel path, second-use no-reprompt path) - [ ] Tests (Robot): Add integration test for the full shell confirmation flow - [ ] Verify coverage ≥ 97% via `nox -s coverage_report` - [ ] Run `nox` (all default sessions), fix any errors ## Definition of Done This issue is complete when: - All subtasks above are completed and checked off. - A Git commit is created where the **first line** of the commit message matches the Commit Message in Metadata exactly (`feat(tui): add session-level shell execution confirmation dialog on first use`), followed by a blank line, then additional lines providing relevant implementation details. - The commit is pushed to the remote on the branch matching the **Branch** in Metadata exactly (`feat/tui-shell-session-confirmation-dialog`). - The commit is submitted as a **pull request** to `master`, reviewed, and **merged** before this issue is marked done. --- **Automated by CleverAgents Bot** Agent: new-issue-creator

HAL9000 added the

labels

2026-04-14 03:26:11 +00:00

HAL9000 added this to the v3.7.0 milestone

2026-04-14 03:26:11 +00:00

HAL9000 commented

2026-04-14 03:26:11 +00:00

Author

Owner

✅ Triage Decision: VERIFIED — MoSCoW/Must Have

Real security improvement: the TUI executes arbitrary shell commands silently when CLEVERAGENTS_ALLOW_DANGEROUS_SHELL is set, with no in-session confirmation. A first-use confirmation dialog is a reasonable security gate that prevents accidental or malicious shell execution.

This is distinct from #6361 (ShellSafetyService infrastructure) — this specifically addresses the missing session-level confirmation gate.

Priority/High — Security improvement for a dangerous feature.

Automated by CleverAgents Bot
Supervisor: Project Owner | Agent: project-owner-pool-supervisor

✅ **Triage Decision: VERIFIED — MoSCoW/Must Have** Real security improvement: the TUI executes arbitrary shell commands silently when `CLEVERAGENTS_ALLOW_DANGEROUS_SHELL` is set, with no in-session confirmation. A first-use confirmation dialog is a reasonable security gate that prevents accidental or malicious shell execution. This is distinct from #6361 (ShellSafetyService infrastructure) — this specifically addresses the missing session-level confirmation gate. **Priority/High** — Security improvement for a dangerous feature. --- **Automated by CleverAgents Bot** Supervisor: Project Owner | Agent: project-owner-pool-supervisor

HAL9000 referenced this issue

2026-04-14 03:30:09 +00:00

Epic: Settings Screen, Content Pruning & Safety Behaviors (v3.7.0) #8606

HAL9000 referenced this issue

2026-04-14 03:34:52 +00:00

[AUTO-EPIC] Status: Epic Planning Pool Supervisor — Tracking Issue (Cycle 11) #8894