security(nodes): GATE/CAPTURE/AGENTRUN 子进程继承宿主全量 env——code 节点已修的 env 白名单未推广，capture stdout 零截断
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 5/5
- Estimated time
- Over a week
- Newbie friendliness
- 38/100
Research direction
Start with the allowlist implementation in code.py:500-508, then inspect gate.py:68, capture.py:72 and :95-96, and agent_run.py:101 and :324. Done means the affected subprocess paths use an explicit environment policy, capture output is bounded, and multi-tenant agent execution follows the stated fail-closed behavior.
Written by the indexing model from the issue text.
Description
场景 gap 单（okguitar 提报）· 优先级 P1 · 依赖：无
基线 HEAD = ddcedae。
Summary
code 节点 2026-09 已修 env 白名单（code.py:500-508，注释自认历史实现「等于把 API key/云凭证交给沙箱内代码」），但同类敏感操作节点没跟上：
plaita-nodes/src/plaita_nodes/gate.py:68：env = os.environ.copy()——worker 进程 env（含PLAITA_CREDENTIALS_KEY、DB/Redis URL、provider token）全量进入门禁命令；capture.py:72：同样os.environ.copy()，且输出{"stdout": stdout or ""}零截断（:95-96）——全量进节点输出 → checkpoint → console 执行页/事件流，viewer 角色可见；- AGENTRUN 直跑路径经 agentproc Python SDK，其 runner executor 路径同样是全量 env 透传（agentproc 仓配套单）；
agent_run.py:101还硬编码--permission-mode auto在宿主免审批执行，沙箱（workspace）是可选项（:324）而非默认。
影响
与 recursive #89（默认档 printenv 泄露）同构：worker 宿主上任何被门禁/capture 执行的命令、agent CLI 及其子进程都能读全部平台凭据；capture 输出把敏感内容直接带进可见状态。
建议
把 code 节点的 SUBPROCESS_ENV_ALLOWLIST 思路抽到公共层，gate/capture/agent 直跑统一白名单 + 显式 extra_env；capture stdout 加截断；多租户模式下 agent 直跑默认拒绝（fail-closed 到 workspace 沙箱）。
- Dominant language
- Python
- Stars
- 0
- Forks
- 1
- Avg merge
- 2h 22m
- Merged PRs (30d)
- 8
Getting set up
This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from jeffkit/plaita
-
fix(console): #274 并发同 dedup_key 双 POST 各自入队——预认领与占位行非原子，落败 id 永久 queued 且占配额Possibly taken @okguitar claimed this today. Open
Difficulty 5/5 Over a week Newbie friendliness 35/100
jeffkit/plaita#280 · 1 comment ·
Maintainers usually reply within 1 day
-
Difficulty 4/5 3-5 days Newbie friendliness 45/100
Maintainers usually reply within 1 day
-
fix(console): ${redis.url} 从配置文件而非数据面 effective URL 解析——metadata 档 worker 静默连 localhost，warnings 为空Open
Difficulty 4/5 3-5 days Newbie friendliness 48/100
Maintainers usually reply within 1 day
-
Difficulty 3/5 1-2 days Newbie friendliness 55/100
Maintainers usually reply within 1 day
-
refactor(expr): 摘除运行期字符串的二次求值（#104/#130 的终章）——契约定为「配置求值、运行期数据」Possibly taken @jeffkit claimed this today. Open
Difficulty 5/5 Over a week Newbie friendliness 25/100
jeffkit/plaita#268 · 1 comment ·
Maintainers usually reply within 1 day
Similar issues
-
Uninstall guide omits the CloudWatch log groups AWS CodeBuild creates for useCodeBuild pipelinesOpenbug documentation
Difficulty 1/5 1-3 hours Newbie friendliness 88/100
awslabs/visual-asset-management-system#552 ·
Maintainers usually reply within 1 day
-
netbox status: needs triage type: documentation
Difficulty 1/5 Under an hour Newbie friendliness 76/100
netbox-community/netbox#23460 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
awslabs/threat-composer#362 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
Maintainers usually reply within 1 day
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
ansys/pyansys-common-mcp#213 ·
Maintainers usually reply within 3 days