#v0.1003

LM Studio Shell Command Runner Plugin

An LM Studio plugin that enables AI models to execute shell commands with comprehensive security controls.

Features

Core Functionality

• Execute shell commands in Linux/macOS (Bash) or Windows (CMD) environments
• Read command output (stdout/stderr) as string responses
• Configurable execution timeout and working directory

Security Controls

Execution Policy

• Allow All (Block Forbidden): Default mode - all commands allowed unless explicitly blacklisted
• Allow Only (Strict Whitelist): Only whitelisted commands can execute

Blacklist

• Blocks dangerous commands like rm -rf /, shutdown, sudo, dd if=/dev/zero
• Applies in BOTH execution policy modes
• Configurable via plugin settings

Whitelist

• When "Allow Only" mode is enabled, only explicitly listed commands can run
• Example: git, npm, ls, cat (comma-separated)
• Empty whitelist with "Allow Only" mode blocks all commands

Sandbox Mode

• Restricts command execution to a specified project root directory
• Prevents access to files outside the sandbox
• Blocks absolute paths and parent directory traversal (..)
• Fixed: Windows drive letter detection now only matches C:\\ or D:/ style paths, not colons in sed patterns or URLs

Special cd Command Exception

• Allows cd {sandboxRoot} commands even if cd is blacklisted
• Also allows cd {sandboxRoot} && ... patterns for chaining commands
• Only permits navigation to the exact sandbox root directory
• Subdirectories and other paths are blocked with a clear error message

Disable Blacklist Commands

• Comma-separated list of commands that bypass the blacklist entirely
• Use this for containerized workloads (e.g., podman run, docker run) where dangerous commands like rm are needed inside containers
• Example: podman run, docker run
• When a command matches an entry in this list, the blacklist is completely skipped

Never Allowed Commands

• Comma-separated list of commands that are ALWAYS blocked, even if they appear in "Disable Blacklist Commands"
• Use this for critical system commands that should never execute (e.g., shutdown, reboot)
• Example: shutdown, reboot
• This acts as a final safety layer - if shutdown is in both lists, it will ALWAYS be blocked

Test Mode (Dry Run)

When enabled, the plugin validates commands against all security checks but never executes them. Returns:

• "COMMAND ALLOWED: The command '...' passes all security checks." if all checks pass
• Security error messages if any check fails

Test mode works independently of "Allow Automatic Execution" - it runs AFTER security checks complete.

Safety Switches

Allow Automatic Execution (Master Kill Switch)

• OFF (default): All commands blocked before any security checks
• ON: Commands proceed through security validation
• Prevents accidental command execution by default

Tools Provided

1. run_shell_command

Executes shell commands with full security validation.

Parameters:

• command (string): The command to execute
• cwd (optional string): Subdirectory to run in (must be inside sandbox)
• timeout (optional number): Execution timeout in milliseconds

Returns: Command output, errors, or security rejection messages

2. get_whitelist

Retrieves current allowed commands configuration.

Parameters: None

Returns: List of whitelisted commands with count, or status if whitelist not active

3. get_blacklist

Retrieves current forbidden commands configuration.

Parameters: None

Returns: List of blacklisted commands with count

Configuration Options

Setting	Type	Default	Description
Operating System	Select	Windows	Target shell: Windows (CMD) or Linux/macOS (Bash)
Sandbox / Project Root	String	Empty	Absolute path for sandbox restriction
Execution Policy	Select	Allow All	Filter mode: Allow All or Allow Only
Allowed Commands	String	Empty	Comma-separated whitelist (Allow Only mode only)
Forbidden Commands	String	Empty	Comma-separated blacklist (applies to both modes)
Disable Blacklist Commands	String	Empty	Comma-separated commands that bypass blacklist (e.g., podman run, docker run)
Never Allowed Commands	String	Empty	Comma-separated commands ALWAYS blocked (e.g., shutdown, reboot)
Environment PATH Extensions	String	Empty	Additional paths to add to system PATH
Timeout (ms)	Numeric	15000	Maximum command execution time
Allow Automatic Execution	Boolean	false	Master switch for command execution
Test Mode (Dry Run)	Boolean	false	Validate without executing

Usage Examples

Basic Command

With Subdirectory

Test Mode Validation

When Test Mode is enabled:

• Blacklist check runs first
• Whitelist check runs second (if applicable)
• Sandbox validation runs third
• Returns "COMMAND ALLOWED" without executing

Containerized Workloads with Disable Blacklist Commands

When running containerized workloads that need dangerous commands inside containers:

Configuration for This Session

Updated Features

• Added get_whitelist tool - Retrieves current whitelist configuration

Security Check Order

• Allow Automatic Execution check
• Never Allowed Commands check (ALWAYS blocks these, even if in Disable Blacklist list)
• Disable Blacklist Commands check (skips blacklist if matched)
• Blacklist check (only if not disabled)
• Whitelist check (if "Allow Only" mode)
• Sandbox validation
• Test Mode check (returns without executing if enabled)
• Environment setup
• Command execution (only if all checks pass AND testMode is OFF)

Bug Fixes

• Fixed false positive for drive letter detection - Windows path detection now only matches C:\ or D:/ style paths, not colons in sed replacement patterns (s/old:new/) or strings like "BUILD: SUCCESS"
• Fixed exit code 1 handling - Commands that return exit code 1 (like grep with no matches) no longer show error messages; only actual failures (exit codes ≠ 1) show errors

Complete Command List Examples

1. Allowed Commands (Whitelist) - "Allow Only" Mode

When using "Allow Only" execution policy, specify which commands can run:

2. Forbidden Commands (Blacklist) - Default Mode

Add dangerous commands that should always be blocked:

3. Disable Blacklist Commands

Commands that bypass the blacklist (for containerized workloads):

4. Never Allowed Commands

Commands that are ALWAYS blocked, even if in Disable Blacklist list:

Author

• Author: Techstat
• License: MIT
• AI: Vibe-Coded additions via Qwen3 Coder Next Bartowski Q4 Quant.

Versions

v0.1000 - Initial Updates v0.1001 - Added "Special cd Command Exception" v0.1002 - Added "Disable Blacklist Commands" and "Never Allowed Commands" v0.1003 - Added Complete Command List Examples to README