fix(engine): keep filter input under env allowlist #28

Merged

thklein merged 3 commits from fix/filter-env-allowlist into main 2026-10-18 17:23:17 +00:00

Conversation 0 Commits 3 Files changed 8 +139 -11

thklein commented 2026-10-18 17:03:41 +00:00

Owner

Copy link

With GPTSCRIPT_TOOL_ENV_ALLOWLIST=true, input and output filters lost their payload: the runner hands an output filter {output, continuation, chat} and an input filter {input}, filters declare no Param for those, and the allowlist only exempted TOOL_CALL_ARGS/TOOL_CALL_BODY. A filter reading $OUTPUT (e.g. bpai-tools' result-formatter) got an empty string.

The exemption is keyed by the call's tool category, so an ordinary tool call still cannot receive these keys as undeclared env, and a filter call still cannot pass any other undeclared key.

• newCommand / runHTTP pass ctx.ToolCategory; daemons use NoCategory.
• Tests: filter keys survive for input/output categories and are still refused for an ordinary call; a filter call cannot slip another undeclared key through.
• No behaviour change with the flag off (default).

With `GPTSCRIPT_TOOL_ENV_ALLOWLIST=true`, input and output filters lost their payload: the runner hands an output filter `{output, continuation, chat}` and an input filter `{input}`, filters declare no `Param` for those, and the allowlist only exempted `TOOL_CALL_ARGS`/`TOOL_CALL_BODY`. A filter reading `$OUTPUT` (e.g. bpai-tools' result-formatter) got an empty string. The exemption is keyed by the call's tool category, so an ordinary tool call still cannot receive these keys as undeclared env, and a filter call still cannot pass any other undeclared key. - `newCommand` / `runHTTP` pass `ctx.ToolCategory`; daemons use `NoCategory`. - Tests: filter keys survive for input/output categories and are still refused for an ordinary call; a filter call cannot slip another undeclared key through. - No behaviour change with the flag off (default).

thklein added 1 commit 2026-10-18 17:03:41 +00:00

fix(engine): keep filter input under env allowlist ... 85ccd1e207

Input and output filters receive their payload as runner-supplied
keys (input; output, continuation, chat) that they never declare as
parameters, so with GPTSCRIPT_TOOL_ENV_ALLOWLIST=true a filter reading
$OUTPUT got an empty string. Treat those keys as engine-supplied, but
only for a call of the matching tool category.

thklein force-pushed fix/filter-env-allowlist from 85ccd1e207 to 95597ac18e 2026-10-18 17:07:24 +00:00 Compare

thklein added 1 commit 2026-10-18 17:11:46 +00:00

refactor(runner): rename filter subcall helper 092ecaf220

thklein merged commit eb776a3ed4 into main 2026-10-18 17:23:17 +00:00

thklein deleted branch fix/filter-env-allowlist 2026-10-18 17:23:18 +00:00

thklein referenced this pull request from a commit 2026-10-18 17:23:19 +00:00

fix(engine): keep filter input under env allowlist (#28)

thklein referenced this pull request from a commit 2026-10-18 21:37:25 +00:00

chore(deps): bump gptscript to v0.9.12

thklein referenced this pull request from a commit 2026-10-18 21:41:36 +00:00

chore(deps): bump gptscript to v0.9.12 (#1411)

thklein referenced this pull request from a commit 2026-10-18 21:46:10 +00:00

chore(release): 0.123.1 (#1413)

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

area/engine

  

clarity/clear

  

enhancement

  

security

  

size/M

No labels

area/engine

clarity/clear

enhancement

security

size/M

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

basepeak-ai/gptscript!28

No description provided.