From 61083278eff2d14ced9b0a0ac2f060504b2b58b2 Mon Sep 17 00:00:00 2001 From: Arron Bailiss Date: Thu, 3 Sep 2026 01:29:46 -0400 Subject: [PATCH 1/2] docs: correct default per-command timeout in README security section The "Secure Defaults" section claimed the shell has no per-command timeout by default and advised adding one. The source is the opposite: `ShellBuilder::default()` sets `timeout: Some(Duration::from_secs(30))` (src/shell.rs), and the config tests assert this default (`cfg.timeout_secs == Some(30.0)` in tests/config.rs; `cfg.timeout == 30.0`/`30` in the Python and JS config tests). `None` (no timeout) only arises via the custom-kernel embedding path (`Shell::with_kernel`), which bypasses the builder and reports `timeout_secs: None` (tests/config.rs::with_kernel_reports_default_config_snapshot). Rewrite the bullet so it states the real 30s default, that `timeout` adjusts it, and that the no-timeout state applies only to `with_kernel`. --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 39ef3cc..1c25c07 100644 --- a/README.md +++ b/README.md @@ -241,7 +241,7 @@ Out of the box, the shell is an empty sandbox — no files, no network, no crede - **Prefer `mode: "copy"` over `mode: "direct"` for source code.** Copy-on-create isolates the agent from your live files. Use `direct` only for output directories where the agent needs to persist results. - **Scope binds narrowly.** Bind `/my/project/src` rather than `/my/project` or `/`. The agent doesn't need your `.git/`, `.env`, or `node_modules/`. - **Allowlist URLs explicitly.** Don't use `allowed_urls: ["https://"]` — this disables SSRF protection entirely. List the specific API endpoints the agent needs. -- **Set timeouts.** The default has no per-command timeout. Set `timeout` to bound runaway commands (30s is reasonable for most agent loops). +- **Keep the timeout.** Each command runs under a 30-second per-command timeout by default, which bounds runaway commands out of the box. Set `timeout` to raise or lower it for your agent loop. The no-timeout case applies only when you embed a custom kernel via `with_kernel`. - **Use limits.** Set `max_output` to prevent agents from filling memory with unbounded command output (1MB is a good default). ## Commands From e5adda5fef6408ee0acfd7ed2468dd80db48b708 Mon Sep 17 00:00:00 2001 From: Arron Bailiss Date: Thu, 3 Sep 2026 09:37:17 -0400 Subject: [PATCH 2/2] docs: reframe timeout bullet as adjustable timeouts with 30s default --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 1c25c07..d5949ed 100644 --- a/README.md +++ b/README.md @@ -241,7 +241,7 @@ Out of the box, the shell is an empty sandbox — no files, no network, no crede - **Prefer `mode: "copy"` over `mode: "direct"` for source code.** Copy-on-create isolates the agent from your live files. Use `direct` only for output directories where the agent needs to persist results. - **Scope binds narrowly.** Bind `/my/project/src` rather than `/my/project` or `/`. The agent doesn't need your `.git/`, `.env`, or `node_modules/`. - **Allowlist URLs explicitly.** Don't use `allowed_urls: ["https://"]` — this disables SSRF protection entirely. List the specific API endpoints the agent needs. -- **Keep the timeout.** Each command runs under a 30-second per-command timeout by default, which bounds runaway commands out of the box. Set `timeout` to raise or lower it for your agent loop. The no-timeout case applies only when you embed a custom kernel via `with_kernel`. +- **Rely on adjustable timeouts.** Commands run under an adjustable per-command timeout, defaulting to 30 seconds, which bounds runaway commands out of the box. Set `timeout` to raise or lower it for your agent loop. - **Use limits.** Set `max_output` to prevent agents from filling memory with unbounded command output (1MB is a good default). ## Commands