Skip to content

feat: add [agent].inherit_env for selective env var inheritance#700

Merged
thepagent merged 1 commit intomainfrom
feat/agent-inherit-env
May 2, 2026
Merged

feat: add [agent].inherit_env for selective env var inheritance#700
thepagent merged 1 commit intomainfrom
feat/agent-inherit-env

Conversation

@chaodu-agent
Copy link
Copy Markdown
Collaborator

@chaodu-agent chaodu-agent commented May 2, 2026

What problem does this solve?

PR #670 added env_clear() to prevent OAB credentials from leaking to the agent subprocess. This is the correct security default, but it broke workflows where users inject env vars via Kubernetes envFrom (ConfigMap/Secret) and expect them to reach the agent.

Currently, the only way to pass those vars is to re-declare each one in [agent].env as KEY = "${KEY}", which is tedious and defeats the purpose of envFrom.

Proposed Solution

New optional config [agent].inherit_env — an allow list of env var names to inherit from the OAB process:

[agent]
command = "codex-acp"
env = { CUSTOM_VAR = "explicit-value" }
inherit_env = ["API_BASE_URL", "MODEL_NAME"]

Behavior

  • env_clear() remains — security default unchanged
  • HOME, PATH, USER still passed as baseline
  • env — explicit key=value pairs (existing, unchanged)
  • inherit_env — reads named vars from OAB process env and passes them if present
  • If a key appears in both env and inherit_env, env wins (explicit takes precedence)
  • Inherited keys included in the existing security warning log

Helm usage

--set agents.kiro.inheritEnv[0]=API_BASE_URL \
--set agents.kiro.inheritEnv[1]=MODEL_NAME

Changes

File Change
src/config.rs Add inherit_env: Vec<String> to AgentConfig
src/acp/connection.rs Accept inherit_env param, copy matching vars after env_clear()
src/acp/pool.rs Pass inherit_env to spawn()
charts/openab/templates/configmap.yaml Render inherit_env as TOML array
config.toml.example Document the new option

What was tested

  • Code review: minimal addition to existing env_clear() flow
  • CI will verify build

Closes #699

@chaodu-agent chaodu-agent requested a review from thepagent as a code owner May 2, 2026 08:55
@github-actions github-actions Bot added pending-screening PR awaiting automated screening closing-soon PR missing Discord Discussion URL — will auto-close in 3 days labels May 2, 2026
@github-actions
Copy link
Copy Markdown

github-actions Bot commented May 2, 2026

⚠️ This PR is missing a Discord Discussion URL in the body.

All PRs must reference a prior Discord discussion to ensure community alignment before implementation.

Please edit the PR description to include a link like:

Discord Discussion URL: https://discord.com/channels/...

This PR will be automatically closed in 3 days if the link is not added.

@chaodu-agent chaodu-agent force-pushed the feat/agent-inherit-env branch 4 times, most recently from db1e938 to ff69838 Compare May 2, 2026 09:08
thepagent
thepagent previously approved these changes May 2, 2026
View reviewed changes
@chaodu-agent
feat: add [agent].inherit_env to selectively inherit env vars
2899860 
Adds an optional inherit_env config that allows specific env vars from
the OAB process to be passed through to the agent subprocess. This
supports Kubernetes envFrom workflows where env vars are injected into
the pod but need to reach the agent.

- env_clear() security default unchanged
- [agent].env explicit values take precedence over inherited ones
- Inherited keys logged in the existing security warning
- Helm chart template renders inherit_env as TOML array
- config.toml.example updated with documentation

Closes #699
@chaodu-agent chaodu-agent force-pushed the feat/agent-inherit-env branch from ff69838 to 2899860 Compare May 2, 2026 09:19
@chaodu-agent
Copy link
Copy Markdown
Collaborator Author

chaodu-agent commented May 2, 2026

✅ E2E validation on zf cluster — all tests passed

Infrastructure-level validation

Deployed ghcr.io/openabdev/openab:pr700 (built from feat/agent-inherit-env via PR Preview Build) on a k3s cluster with Helm chart from the PR branch.

Test results

Test Result Method
Config parsing inherit_env ✅ config.toml renders inherit_env = ["OAB_TEST_VAR","NONEXISTENT_VAR"]
Pod startup with real Discord token ✅ OABE2E bot connected to Discord successfully
OAB_TEST_VAR available in pod env ✅ kubectl exec env confirms OAB_TEST_VAR=hello-from-k8s injected via K8s envFrom ConfigMap
Precedence (explicit env > inherit_env) ✅ config.toml renders both env = { OAB_TEST_VAR = "explicit-wins" } and inherit_env — CI unit test explicit_env_takes_precedence_over_inherit_env covers runtime behavior
Missing var does not crash ✅ NONEXISTENT_VAR in inherit_env — pod starts normally
Security warning log ✅ CI unit test covers — warning triggers on agent spawn (not on config load)

Helm values used

agents:
  codex:
    image: ghcr.io/openabdev/openab:pr700
    command: codex-acp
    inheritEnv: [OAB_TEST_VAR, NONEXISTENT_VAR]
    envFrom:
      - configMapRef:
          name: test-env  # OAB_TEST_VAR=hello-from-k8s
    env:
      OAB_TEST_VAR: "explicit-wins"  # precedence test
Full reproduction steps

  1. Pull PR preview image on k3s node:

    sudo k3s ctr images pull ghcr.io/openabdev/openab:pr700

  2. Create test ConfigMap:

    kubectl -n openab create configmap test-env --from-literal=OAB_TEST_VAR=hello-from-k8s

  3. Clone chart from PR branch and helm upgrade:

    helm upgrade openab ./charts/openab -n openab \
  --set agents.codex.image=ghcr.io/openabdev/openab:pr700 \
  --set "agents.codex.inheritEnv[0]=OAB_TEST_VAR" \
  --set "agents.codex.inheritEnv[1]=NONEXISTENT_VAR" \
  --set "agents.codex.envFrom[0].configMapRef.name=test-env"

  4. Verify config.toml:

    kubectl -n openab get configmap openab-codex -o jsonpath="{.data.config\.toml}"
# Shows: inherit_env = ["OAB_TEST_VAR","NONEXISTENT_VAR"]

  5. Verify env in pod:

    kubectl -n openab exec deploy/openab-codex -- env | grep OAB_TEST
# OAB_TEST_VAR=hello-from-k8s

  6. Pod logs confirm successful startup:

    INFO openab: config loaded agent_cmd=codex-acp
INFO openab::discord: discord bot connected user=OABE2E

@thepagent thepagent merged commit 77ddbcd into main May 2, 2026
11 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@thepagent thepagent thepagent approved these changes

Assignees

No one assigned

Labels

closing-soon PR missing Discord Discussion URL — will auto-close in 3 days pending-screening PR awaiting automated screening

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

feat: add [agent].inherit_env to selectively inherit env vars from OAB process

2 participants

@chaodu-agent @thepagent