fix(cli): block command injection and env leak in CLI protocol

[h3xxit]

• _substitute_utcp_args now shell-quotes substituted tool_args via shlex.quote on Unix and a PowerShell single-quoted literal on Windows, blocking metacharacter injection (;, |, &, backticks, $(), newlines). Each placeholder now expands to exactly one shell token; tools that relied on a single placeholder splitting into multiple flags must use one placeholder per flag. Backs GHSA-33p6-5jxp-p3x4.

• _prepare_environment no longer hands os.environ.copy() to the subprocess. Inheritance is now controlled by a new CliCallTemplate.inherit_env_vars field:

  • None (default): a built-in OS-specific safe allowlist (PATH, HOME / PATHEXT, SYSTEMROOT, USERPROFILE, etc.) is inherited.
  • []: strict mode; nothing from the host environment is inherited.
  • [names...]: exactly those host vars are inherited (replaces, not merges with, the default allowlist). env_vars is always layered on top and overrides any inherited value. Backs GHSA-5v57-8rxj-3p2r.

• REQUIRED docstrings + Field descriptions on CliCallTemplate and CommandStep updated so the new behavior surfaces in generated OpenAPI / JSON manuals.

• New tests/test_security.py covers shell quoting, env allowlist, inherit_env_vars semantics (None / [] / explicit list), unset-name skipping, env_vars override precedence, Pydantic round-trip, and a Unix end-to-end injection canary.

Bumps utcp-cli 1.1.1 -> 1.1.2.

---

Summary by cubic

Blocks command injection by switching UTCP_ARG_* to quote-aware variable references backed by per-call env vars, and prevents host env leaks via an explicit allowlist; bumps utcp-cli to 1.1.4. Increases discovery timeout to 60s to handle slow PowerShell startup.

• Bug Fixes

  • Context-aware substitution: Bash emits "$VAR"/${VAR}/'"$VAR"'; PowerShell uses braced ${env:VAR} and errors if inside single quotes. Values travel via nonce-scoped __UTCP_ARG_* env vars, not inlined. Closes GHSA-33p6-5jxp-p3x4 and the prior double-quote bypass.
  • Script builder returns (script, arg_env); call_tool/register_manual merge arg_env into the subprocess env so references resolve.
  • Tight env inheritance: inherit_env_vars: None uses a safe OS allowlist; [] inherits nothing; ["NAMES"] inherits exactly those (not merged). env_vars always overrides. Closes GHSA-5v57-8rxj-3p2r. Windows allowlist includes PSMODULEPATH. register_manual timeout set to 60s.

• Migration

  • Each UTCP_ARG_..._UTCP_END now expands to a single argument via env expansion. If you packed multiple flags into one placeholder, split them.
  • On Windows, placeholders inside single-quoted strings now raise; use double-quoted strings.
  • If you relied on broad env inheritance, list required vars in inherit_env_vars (include PATH if needed) or use [] for strict mode.

^{Written for commit 1deffbe. Summary will update on new commits.}

[cubic-dev-ai]

No issues found across 4 files

[h3xxit]

@cubic-dev-ai

[cubic-dev-ai]

@cubic-dev-ai

@h3xxit I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

1 issue found across 5 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="plugins/communication_protocols/cli/src/utcp_cli/cli_communication_protocol.py">

<violation number="1" location="plugins/communication_protocols/cli/src/utcp_cli/cli_communication_protocol.py:529">
P2: Use braced PowerShell env-variable syntax for substituted placeholders to avoid variable-name boundary parsing bugs when placeholders are adjacent to suffix characters.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[h3xxit]

@cubic-dev-ai

[cubic-dev-ai]

@cubic-dev-ai

@h3xxit I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

No issues found across 5 files