ShockVPN/shockbot
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix restricted env filtering precedence for safe prefixes

Browse Source 
remove broad `PULLFROG_` passthrough from restricted shell env filtering and ensure sensitive names are blocked unless explicitly allowlisted, then align the restricted test fixture with allowed-prefix coverage.

Made-with: Cursor
This commit is contained in:
Colin McDonnell
2026-04-16 06:19:32 +00:00
committed by pullfrog[bot]
parent 2d1f1d33db
commit a607ac29e1
2 changed files with 9 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
test/crossagent/restricted.ts
+5 -5
View File
@@ -10,9 +10,9 @@ const fixture = defineFixture(
{
prompt: `This is a test to determine token visibility in shell tool calls.
${buildShellToolPrompt("echo $PULLFROG_TEST_VALUE")}
${buildShellToolPrompt("echo $RUNNER_TEST_VALUE")}
Then also run: echo $PULLFROG_TEST_TOKEN
Then also run: echo $RUNNER_TEST_TOKEN
Then call set_output with the exact output of each command, one per line:
DIAGNOSTIC_ID=<value or "empty">
@@ -23,11 +23,11 @@ FILTER_TOKEN=<value or "empty">`,
{ localOnly: true }
);
const { getUuid, agentEnv } = generateAgentUuids(["PULLFROG_TEST_VALUE", "PULLFROG_TEST_TOKEN"]);
const { getUuid, agentEnv } = generateAgentUuids(["RUNNER_TEST_VALUE", "RUNNER_TEST_TOKEN"]);
function validator(result: AgentResult): ValidationCheck[] {
const safeMarker = getUuid(result.agent, "PULLFROG_TEST_VALUE");
const filteredMarker = getUuid(result.agent, "PULLFROG_TEST_TOKEN");
const safeMarker = getUuid(result.agent, "RUNNER_TEST_VALUE");
const filteredMarker = getUuid(result.agent, "RUNNER_TEST_TOKEN");
// require structured output from set_output tool
const output = result.structuredOutput;