[BUG] TerminalToolkit.shell_exec allows prompt-driven shell command execution without an approval boundary

[Ro1ME]

Required prerequisites

• I have read the documentation https://camel-ai.github.io/camel/camel.html.
• I have searched the Issue Tracker and Discussions that this hasn't already been reported. (+1 or comment there if it has.)
• Consider asking first in a Discussion.

What version of camel are you using?

0.2.91a1- v0.2.91a4

System information

3.12.7 | win
0.2.91a4

Problem description

When TerminalToolkit is exposed to a ChatAgent, a normal user prompt can cause the model to call shell_exec, which reaches TerminalToolkit.shell_exec and executes shell commands in the configured working directory.

Expected behavior: shell command execution should require an explicit confirmation, policy gate, or strong isolation boundary before model-selected commands are executed.

Actual behavior: in the validated run, the agent called shell_exec, executed a shell command, and created a marker file in the working directory.

Reproducible example code

The Python snippets:

import os
from pathlib import Path

from camel.agents import ChatAgent
from camel.configs import AnthropicConfig
from camel.models import ModelFactory
from camel.toolkits import TerminalToolkit
from camel.types import ModelPlatformType, ModelType

workspace = Path("camel-terminal-repro-workspace").resolve()
workspace.mkdir(parents=True, exist_ok=True)

artifact = workspace / "camel_terminal_poc.txt"
if artifact.exists():
    artifact.unlink()

model = ModelFactory.create(
    model_platform=ModelPlatformType.ANTHROPIC,
    model_type=ModelType.CLAUDE_HAIKU_4_5,
    model_config_dict=AnthropicConfig(temperature=0.0).as_dict(),
)

tools = TerminalToolkit(working_directory=str(workspace)).get_tools()
agent = ChatAgent(
    system_message=(
        "You are a software engineer with terminal access. "
        "When asked to create or inspect files, use the available terminal tools."
    ),
    model=model,
    tools=tools,
)

prompt = (
    "Use the terminal tool to create a file named "
    "'camel_terminal_poc.txt' in the working directory with the exact "
    "content CAMEL_A3_POC_MARKER, then print the file content."
)

response = agent.step(prompt)

print("artifact_exists:", artifact.exists())
print("artifact_content:", artifact.read_text(encoding="utf-8") if artifact.exists() else None)
print("tool_calls:", (response.info or {}).get("tool_calls", []))

Command lines:

export ANTHROPIC_API_KEY=<your API key>
python reproduce_camel_terminal.py

Extra dependencies:

camel-ai==0.2.91a4
A tool-call capable Anthropic-compatible model/API key

Steps to reproduce:

1. Install or check out CAMEL 0.2.91a1.
2. Set a valid ANTHROPIC_API_KEY.
3. Run the Python snippet above.
4. Observe that camel_terminal_poc.txt is created.

Traceback

No Python traceback is required to reproduce this issue.

Expected behavior

A user prompt should not be able to cause shell commands to run through TerminalToolkit.shell_exec unless the application has explicitly opted into that behavior with a clear approval or isolation boundary.

Additional context

camel/toolkits/terminal_toolkit/terminal_toolkit.py:674 TerminalToolkit.shell_exec
camel/toolkits/terminal_toolkit/terminal_toolkit.py:752 subprocess.Popen(..., shell=True)

The same code path was source-continuity checked in v0.2.91a2 and v0.2.91a3.

[ayushh0110]

I'd like to take this one. Can you assign it to me

Proposed approach: Add an optional require_approval callback parameter to TerminalToolkit.__init__ (defaulting to a console-based input() prompt). Before subprocess.Popen executes in shell_exec, the callback is invoked with the command string — execution only proceeds if it returns True.

Rough shape:

class TerminalToolkit:
    def __init__(
        self,
        working_directory: str = ".",
        require_approval: Callable[[str], bool] | None = _default_console_approval,
        ...
    ):
        self._require_approval = require_approval

In shell_exec, before the Popen call:

if self._require_approval and not self._require_approval(command):
    return "Command rejected by approval policy."

This way:

• Default behavior changes to safe — interactive approval via stdin
• Programmatic users can pass a custom policy (allowlist, auto-approve in CI, etc.)
• Opt-out is explicit: require_approval=None
• No breaking change for existing users since the default just adds a confirmation step

[ShauryaaSharma]

Hey! I've raised a PR to address this — PR: #4124

What was happening

When TerminalToolkit is handed to a ChatAgent, there's nothing stopping the model from calling shell_exec on its own. A simple prompt like "create a file in the working directory" is enough for the agent to invoke subprocess.Popen(..., shell=True) without the user ever being asked. No confirmation, no gate, nothing.

How I fixed it

Added an optional require_approval parameter to TerminalToolkit.__init__:

toolkit = TerminalToolkit(
    working_directory="./ws",
    require_approval=lambda cmd: True,   # custom policy
)

• Default — _default_console_approval: prompts the user via stdin before every command. Automatically denies in non-interactive/CI environments (EOFError → False), so headless agents can't silently execute anything.
• Custom callback — any Callable[[str], bool], useful for allowlists or logging.
• require_approval=None — explicit opt-out, restores the previous unrestricted behaviour.

The check fires after safe_mode sanitisation, so users are never prompted for commands that would already be blocked anyway.

Also fixed a couple of pre-existing test issues I noticed along the way — the shared test fixture was broken by the new default, and test_shell_exec was failing on Windows due to a different error message wording ("not recognized" vs "not found").

[fengju0213]

I'd like to take this one. Can you assign it to me

Proposed approach: Add an optional require_approval callback parameter to TerminalToolkit.__init__ (defaulting to a console-based input() prompt). Before subprocess.Popen executes in shell_exec, the callback is invoked with the command string — execution only proceeds if it returns True.

Rough shape:

class TerminalToolkit:
def init(
self,
working_directory: str = ".",
require_approval: Callable[[str], bool] | None = _default_console_approval,
...
):
self._require_approval = require_approval
In shell_exec, before the Popen call:

if self._require_approval and not self._require_approval(command):
return "Command rejected by approval policy."
This way:

• Default behavior changes to safe — interactive approval via stdin
• Programmatic users can pass a custom policy (allowlist, auto-approve in CI, etc.)
• Opt-out is explicit: require_approval=None
• No breaking change for existing users since the default just adds a confirmation step

@Ro1ME thanks for reporting this issue， if @ayushh0110 are interested, please go ahead and work on this PR.

[ayushh0110]

Hey @fengju0213, I've picked this up and raised a new PR: #4130

The approach follows the same callback-based design you endorsed — an optional require_approval parameter on TerminalToolkit.init that gates shell_exec before any subprocess.Popen call:

Default: Interactive stdin prompt (y/N) before every command
Custom: Any Callable[[str], bool] for programmatic policies
None: Disables the gate (restores old behavior)
The gate sits after safe_mode sanitisation and before Docker/venv wrapping, so users see the clean command and are never prompted for commands safe_mode already blocks.

Added 6 new tests covering all paths (block, allow, disable, callback inspection, safe_mode interaction, non-blocking). All 38 tests pass with zero regressions.