Skip to content

security: pass provider credentials via environment instead of CLI arguments #382

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
kagura-chen wants to merge 3 commits into from
Closed

security: pass provider credentials via environment instead of CLI arguments #382

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
f9957f5
security: pass credentials via environment instead of CLI arguments
Mar 19, 2026
574c3dd
fix(runner): use credential_env instead of hardcoded OPENAI_API_KEY
Mar 19, 2026
39cec73
restore generated d.ts map to main version
kjw3 Mar 20, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 10 additions & 8 deletions bin/lib/onboard.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -647,11 +647,13 @@ async function setupInference(sandboxName, model, provider) {

if (provider === "nvidia-nim") {
// Create nvidia-nim provider
// Use bare key form (--credential NVIDIA_API_KEY) so the actual key value
// is passed via the child process environment, not visible in `ps aux`.
run(
`openshell provider create --name nvidia-nim --type openai ` +
`--credential "NVIDIA_API_KEY=${process.env.NVIDIA_API_KEY}" ` +
`--credential NVIDIA_API_KEY ` +
`--config "OPENAI_BASE_URL=https://integrate.api.nvidia.com/v1" 2>&1 || true`,
{ ignoreError: true }
{ ignoreError: true, env: { NVIDIA_API_KEY: process.env.NVIDIA_API_KEY } }
);
run(
`openshell inference set --no-verify --provider nvidia-nim --model ${model} 2>/dev/null || true`,
Expand All @@ -666,11 +668,11 @@ async function setupInference(sandboxName, model, provider) {
const baseUrl = getLocalProviderBaseUrl(provider);
run(
`openshell provider create --name vllm-local --type openai ` +
`--credential "OPENAI_API_KEY=dummy" ` +
`--credential OPENAI_API_KEY ` +
`--config "OPENAI_BASE_URL=${baseUrl}" 2>&1 || ` +
`openshell provider update vllm-local --credential "OPENAI_API_KEY=dummy" ` +
`openshell provider update vllm-local --credential OPENAI_API_KEY ` +
`--config "OPENAI_BASE_URL=${baseUrl}" 2>&1 || true`,
{ ignoreError: true }
{ ignoreError: true, env: { OPENAI_API_KEY: "dummy" } }
);
run(
`openshell inference set --no-verify --provider vllm-local --model ${model} 2>/dev/null || true`,
Expand All @@ -686,11 +688,11 @@ async function setupInference(sandboxName, model, provider) {
const baseUrl = getLocalProviderBaseUrl(provider);
run(
`openshell provider create --name ollama-local --type openai ` +
`--credential "OPENAI_API_KEY=ollama" ` +
`--credential OPENAI_API_KEY ` +
`--config "OPENAI_BASE_URL=${baseUrl}" 2>&1 || ` +
`openshell provider update ollama-local --credential "OPENAI_API_KEY=ollama" ` +
`openshell provider update ollama-local --credential OPENAI_API_KEY ` +
`--config "OPENAI_BASE_URL=${baseUrl}" 2>&1 || true`,
{ ignoreError: true }
{ ignoreError: true, env: { OPENAI_API_KEY: "ollama" } }
);
run(
`openshell inference set --no-verify --provider ollama-local --model ${model} 2>/dev/null || true`,
Expand Down
13 changes: 11 additions & 2 deletions nemoclaw-blueprint/orchestrator/runner.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -57,13 +57,18 @@ def run_cmd(
*,
check: bool = True,
capture: bool = False,
extra_env: dict[str, str] | None = None,
) -> subprocess.CompletedProcess[str]:
"""Run a command as an argv list (never shell=True)."""
env = None
if extra_env:
env = {**os.environ, **extra_env}
return subprocess.run(
args,
check=check,
capture_output=capture,
text=True,
env=env,
)


Expand Down Expand Up @@ -209,12 +214,16 @@ def action_apply(
"--type",
provider_type,
]
# Use bare key form (--credential OPENAI_API_KEY) so the actual credential
# value is passed via the child process environment, not visible in `ps aux`.
provider_env: dict[str, str] = {}
if credential:
provider_args.extend(["--credential", f"OPENAI_API_KEY={credential}"])
provider_args.extend(["--credential", "OPENAI_API_KEY"])
provider_env["OPENAI_API_KEY"] = credential
if endpoint:
provider_args.extend(["--config", f"OPENAI_BASE_URL={endpoint}"])

run_cmd(provider_args, check=False, capture=True)
run_cmd(provider_args, check=False, capture=True, extra_env=provider_env)
Comment thread
coderabbitai[bot] marked this conversation as resolved.
Resolved

# Step 3: Set inference route
progress(70, "Setting inference route")
Expand Down
2 changes: 1 addition & 1 deletion nemoclaw/dist/commands/onboard.d.ts.map
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

11 changes: 6 additions & 5 deletions nemoclaw/dist/commands/onboard.js
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion nemoclaw/dist/commands/onboard.js.map
View file
Open in desktop

Large diffs are not rendered by default.

11 changes: 6 additions & 5 deletions nemoclaw/src/commands/onboard.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -216,10 +216,11 @@ async function promptEndpoint(
return (await promptSelect("Select your inference endpoint:", options)) as EndpointType;
}

function execOpenShell(args: string[]): string {
function execOpenShell(args: string[], options?: { env?: Record<string, string> }): string {
return execFileSync("openshell", args, {
encoding: "utf-8",
stdio: ["pipe", "pipe", "pipe"],
env: { ...process.env, ...options?.env },
});
}

Expand Down Expand Up @@ -450,10 +451,10 @@ export async function cliOnboard(opts: OnboardOptions): Promise<void> {
"--type",
"openai",
"--credential",
`${credentialEnv}=${apiKey}`,
credentialEnv,
"--config",
`OPENAI_BASE_URL=${endpointUrl}`,
]);
], { env: { [credentialEnv]: apiKey } });
logger.info(`Created provider: ${providerName}`);
} catch (err) {
const stderr =
Expand All @@ -465,10 +466,10 @@ export async function cliOnboard(opts: OnboardOptions): Promise<void> {
"update",
providerName,
"--credential",
`${credentialEnv}=${apiKey}`,
credentialEnv,
"--config",
`OPENAI_BASE_URL=${endpointUrl}`,
]);
], { env: { [credentialEnv]: apiKey } });
logger.info(`Updated provider: ${providerName}`);
} catch (updateErr) {
const updateStderr =
Expand Down