CI adopter gaps: subprocess env, run limits, distribution, enterprise docs #245

Context

We ran a review from the point of view of a platform engineer adding an agent step to self-hosted CI (GitHub Enterprise, GitLab, Jenkins, Kubernetes jobs) behind a proxy, with an internal model gateway, who then has to pass a security review. These gaps block that path. Each one was checked against v0.5.4.

Security

• Tool subprocesses inherit the whole environment. bash passes process.env to every command (packages/cli/src/tool/bash.ts). In CI that includes model keys and tokens, so an allowed command such as gh pr comment * can expand $ANTHROPIC_API_KEY into public output. Options:
  • an env allowlist for tool subprocesses;
  • stripping known secret variables;
  • at least documenting the behaviour.
• Allow rules don't inspect the arguments of an allowed command. git diff --no-index /proc/self/environ /dev/null and gh pr comment --body-file <any path> both pass. Document this, and consider argument-aware patterns.
• Project config and plugins are loaded from the checked-out repository. This covers .aictrl/, .opencode/, plugin/*.ts and bun install of .aictrl/package.json. AICTRL_DISABLE_PROJECT_CONFIG exists, but nothing in the README describes it as the setting for untrusted checkouts.
• No SECURITY.md or disclosure policy. Support is only via Discord.

Limits

• No run-level caps. There's no flag for max steps, wall-clock time or cost budget; max steps exists only as the agent steps config. Related: Add configurable session cost budget with guardrail events #32 (session cost budget).
• The stream idle timeout is off by default. AICTRL_MODEL_STREAM_IDLE_TIMEOUT_MS=0 means a stalled call can hang until the job's own timeout. Consider a non-zero default in headless mode.

Distribution and verification

• No standalone binaries, checksums or published container image. GitHub Releases have no assets, and packages/cli/Dockerfile isn't published.
• npm provenance exists but isn't documented. Add npm audit signatures, or the equivalent check, to the README.

Documentation (the code supports it; the README doesn't say)

• Model endpoints: an OpenAI-compatible gateway (provider.<id>.options.baseURL, timeout), plus Azure, Bedrock and Vertex config examples.
• Proxy and custom CA: HTTPS_PROXY and NODE_EXTRA_CA_CERTS.
• On-disk state: the SQLite file at $XDG_DATA_HOME/aictrl/aictrl.db and log/, how to clean them up, and how to point XDG_* at a per-job directory on persistent runners or read-only root filesystems.
• Default permissions: what is allowed with no config (bash is allowed), and a recommended deny-all baseline for CI.
• Egress: the full list, including the project plugin bun install and the remote .well-known config fetch.
• CI examples: GitLab CI, Jenkins and a Kubernetes CronJob.
• Stale or inconsistent text:
  • the README quick start uses an old model id;
  • EVENTS.md shows cost as an object in message_complete but a number in subagent_message_complete;
  • the README says the CLI "switches" mode in a non-TTY;
  • packages/cli/package.json has its homepage set to aictrl.ai and contains filler scripts.

The aictrl.dev/agent quickstart already uses the safe pattern. It splits the job into three steps: fetch the diff with the GitHub token only, review with the model key only (read/glob/grep, AICTRL_DISABLE_PROJECT_CONFIG=true), and post with the GitHub token only. A README recipe should match it.