feat(cloud-query): add python interpeter tool to tool query grpc server by floreks · Pull Request #4029 · pluralsh/console

floreks · 2026-08-20T14:16:13Z

This pull request introduces a new feature to the Cloud Query service: support for sandboxed Python execution using Monty (via the gomonty library), alongside the existing Lua support. It also upgrades the Go toolchain and dependencies across the project to version 1.26.6 and increases the default memory allocation for the Cloud Query service. The changes include updates to documentation, Dockerfiles, proto definitions, and service initialization logic.

New Python Execution Feature:

Added RunPython gRPC endpoint to the ToolQuery service, allowing execution of Monty's limited Python subset in a secure sandbox. This includes new proto messages (RunPythonInput, RunPythonOutput) and updates to API documentation describing the feature, its constraints, and usage. [1] [2] [3] [4] [5] [6]
Integrated the Python worker process into the main service entrypoint, with logic to launch and manage the worker subprocess. [1] [2]

Dependency and Toolchain Upgrades:

Upgraded Go version from 1.26.5 to 1.26.6 across all relevant go.mod files and Dockerfiles for build consistency and security. [1] [2] [3] [4] [5] [6] [7]
Updated and added Go module dependencies, including adding github.com/ewhauser/gomonty for Python sandboxing, and other indirect dependencies for improved functionality and compatibility. [1] [2] [3] [4] [5] [6]

Resource Allocation Improvements:

Increased the default memory request and set a memory limit for the Cloud Query service in charts/console/values.yaml to better support the new Python sandboxing feature and improve reliability.

Documentation Updates:

Expanded the Cloud Query README and API reference to document the new Python execution feature, its operational constraints, and usage instructions. [1] [2] [3]

Internal Service Initialization:

Refactored service startup to properly initialize the ToolQuery service with the new Python worker, and improved error handling during startup.

Test Plan

Test environment: https://console.plrl-dev-aws.onplural.sh/

Checklist

I have added a meaningful title and summary to convey the impact of this PR to a user.
If required, I have updated the Plural documentation accordingly.
I have added tests to cover my changes.
I have deployed the agent to a test environment and verified that it works as expected (required only when changing agent code).

Plural Flow: console

- Added `RunPythonInput` and `RunPythonOutput` message types in `toolquery.proto` for Python script execution - Introduced Python worker logic using a limited subset of Monty, with controlled execution environment and resources - Enhanced `Server` with graceful shutdown and service cleanup to safely terminate background processes - Updated `ToolQueryService` to support Python script execution with context handling - Added `Closer` interface for services that require resource cleanup - Implemented protocol versioning and request handling for Python execution in the worker process - Extended Elixir definitions in toolquery.pb.ex to include Python RPC services - Updated workbench documentation to incorporate Python tool information

- Removed obsolete Python protocol and worker logic - Introduced new worker and contract packages for improved modularity - Added `internal/worker/os.go` for handling OS-level operations in a sandboxed environment - Enhanced `ToolQueryService` to utilize the refactored Python runner interface - Simplified error handling and error message generation - Improved code organization by separating logic into distinct packages

linear · 2026-08-20T14:16:16Z

PROD-5143

soffi-ai · 2026-08-20T14:16:35Z

Soffi AI Summary

This PR extends the Cloud Query gRPC service with sandboxed Python execution capability, giving AI agents a safe way to run Python scripts alongside the existing Lua support. The new RunPython endpoint uses the gomonty library (a restricted Python subset via Monty) to execute user-supplied scripts in a secure sandbox, exposing results through a JSON output dictionary and capturing print() output as stdout. The PR also upgrades the Go toolchain to 1.26.6 across all modules and Dockerfiles, bumps indirect dependencies, and increases the default memory allocation for the Cloud Query service in the Helm chart to accommodate the new Python worker subprocess. Proto definitions, generated gRPC stubs, service initialization, documentation, and tests are all included.

Changes

Sandboxed Python execution in Cloud Query

Added the initial RunPython gRPC endpoint to the ToolQuery service, including new proto messages (RunPythonInput, RunPythonOutput), sandbox configuration, and the gomonty-backed Python worker. (f34b6e8)
Restructured the Python tool implementation into a cleaner internal package layout separating contract types, pool config, gRPC status mapping, and errors. (acc0d7d)
Merged upstream master changes into the feature branch. (252816f)
Updated runtime limits for the Python sandbox and added integration tests for the RunPython gRPC endpoint. (2fb11cd)
Renamed a struct in the Python contract error logic to improve clarity and consistency with the rest of the package naming. (f5ac395)
Normalized newline handling in the Python sandbox test to fix a flaky assertion. (5eb4203)
Added a unit test for tool result serialization in the memory engine to improve coverage of the Python tool output path. (c4e4484)
Simplified the tool_msg function logic in the memory engine for cleaner handling of Python tool results. (c5e67e5)
Removed the MemoryEngineTest wrapper and streamlined Python test output assertions for a leaner test suite. (4a65851)
Renamed the workbench_python module to python_sandbox to better reflect its sandboxed execution role. (f61b4d6)
Merged upstream master changes into the feature branch. (83251a7)
Updated naming conventions throughout the Python tool package and removed redundant imports after the rename refactor. (6f442fe)

Go toolchain and dependency upgrade

Updated Go module dependencies across the workspace, adding github.com/ewhauser/gomonty for Python sandboxing and refreshing indirect dependencies in go/cloud-query, go/ai-proxy, and go/client. (a478564)
Bumped the Go version from 1.26.5 to 1.26.6 in all go.mod files across the workspace. (c17503d)
Updated Dockerfiles to use Go 1.26.6 as the build base. (8ad5b0b)
Applied Go 1.26.6 version bump to remaining Dockerfiles for build consistency. (93d827b)
Fixed file ownership in the terratest Dockerfile after the Go version bump. (10925d5)

Updated: 2026-08-28 10:30 UTC

Deploy in Soffi

…-python-tool-in-tool-query-grpc-server

greptile-apps · 2026-08-20T14:19:32Z

Greptile Summary

The PR adds sandboxed Monty Python execution to Cloud Query and exposes it as a workbench tool.

Adds the RunPython gRPC contract, worker subprocess pool, protocol, validation, resource limits, shutdown handling, and tests.
Integrates Python execution into Console’s AI workbench and relevant subagents and prompts.
Updates Cloud Query deployment resources, documentation, generated clients, Go versions, and dependencies.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
go/cloud-query/internal/tools/python/internal/pool/pool.go	Implements the bounded worker subprocess pool, request queueing, recycling, cancellation, and shutdown lifecycle.
go/cloud-query/internal/tools/python/internal/worker/runtime.go	Executes validated requests in fresh Monty sessions under configured runtime limits.
go/cloud-query/internal/service/toolquery.go	Initializes the Python runner, exposes the RunPython RPC, translates errors, and closes workers during shutdown.
go/cloud-query/api/proto/toolquery.proto	Adds the RunPython request, response, and ToolQuery service method contract.
lib/console/ai/tools/workbench/python.ex	Integrates the Cloud Query Python endpoint as a Console AI workbench tool.
charts/console/values.yaml	Raises Cloud Query’s memory request and introduces a memory limit for the Python runtime workload.

_{Reviews (4): Last reviewed commit: "refactor(tests): remove MemoryEngineTest..." | Re-trigger Greptile}

socket-security · 2026-08-20T14:20:23Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	golang/github.com/ewhauser/gomonty@v0.0.14

View full report

- Increased Monty execution time to 60 seconds - Updated wall timeout to 65 seconds and Monty-managed memory to 100 MiB - Reduced recursion limit to 100 frames - Updated README and API reference documentation to reflect new limits - Added tests for wall timeout and Monty runtime limit validation

floreks · 2026-08-20T14:54:56Z

@greptileai

- Bumped Go version in `console/go/helm-test` from 1.26.5 to 1.26.6 - Added various indirect dependencies to `console/go/ai-proxy` - Updated `google.golang.org/genproto/googleapis/rpc` to new version in multiple modules - Aligned proto dependencies across projects

- Updated Go version from 1.26.5 to 1.26.6 in various modules - Ensured consistent Go version across all sub-projects

- Updated Go version from 1.26.5 to 1.26.6 for consistency across all Dockerfiles - Aligned version in various service and component Dockerfiles including datastore, deployment-operator, ai-proxy, and others

- Bumped Go version from 1.26.5 to 1.26.6 across all relevant Dockerfiles - Ensured version consistency in Kubernetes agent, cloud-query, and deployment-operator components - Modified GitHub workflow to align Go version with Dockerfile updates

- Changed `truncatedCause` to `truncatedCauseError` for clarity and consistency - Simplified detail truncation logic in `truncateDetail` function

- Added `--chown=65532:65532` to `COPY` command in `sentinel-harness/terratest.Dockerfile` to ensure correct file ownership within the container.

- Adjusted `stdout` newline representation in `python_test.exs` to use consistent newline character `\n`

floreks · 2026-08-21T10:09:55Z

@greptileai

floreks · 2026-08-21T10:16:37Z

plural deploy to dev

- Added `MemoryEngineTest` in `memory_engine_test.exs` to verify structured tool result serialization before next completion - Utilized `Mimic` for mocking provider calls - Included `MapTool` as an embedded schema for testing purposes - Enhanced `tool_msg` logic for proper result serialization in `memory_engine.ex`

floreks · 2026-08-21T11:17:50Z

plural deploy to dev

- Removed unnecessary recursion in `tool_msg` function within `memory_engine.ex` for improved clarity and efficiency

…utputs - Deleted `MemoryEngineTest` module for test suite simplification - Removed unused function `tool_result_content` in `memory_engine.ex` for cleaner code - Updated Python test cases to handle serialized outputs using `Output.json` - Added test for bounding oversized Python output in `python_test.exs` to ensure result size compliance

floreks · 2026-08-21T14:34:35Z

plural deploy to dev

floreks · 2026-08-21T14:49:11Z

@greptileai

- Updated reference in `job.md.eex` to `python_sandbox` for consistent naming - Changed function `name()` in `workbench/python.ex` to return `python_sandbox`

…-python-tool-in-tool-query-grpc-server

- Renamed `workbench_python` to `python_sandbox` in `python_test.exs` for consistency - Updated observability prompts to reflect tool name change - Removed redundant `Python` import in `infrastructure.ex`

floreks added 2 commits August 20, 2026 11:16

floreks self-assigned this Aug 20, 2026

floreks requested a review from a team as a code owner August 20, 2026 14:16

floreks added the enhancement New feature or request label Aug 20, 2026

Merge remote-tracking branch 'origin/master' into sebastian/prod-5143…

252816f

…-python-tool-in-tool-query-grpc-server

greptile-apps Bot reviewed Aug 20, 2026

View reviewed changes

Comment thread go/cloud-query/README.md Outdated

floreks added 7 commits August 20, 2026 17:01

chore(dependencies): bump Go version across all modules

c17503d

- Updated Go version from 1.26.5 to 1.26.6 in various modules - Ensured consistent Go version across all sub-projects

chore(docker): bump Go version in Dockerfiles to 1.26.6

8ad5b0b

- Updated Go version from 1.26.5 to 1.26.6 for consistency across all Dockerfiles - Aligned version in various service and component Dockerfiles including datastore, deployment-operator, ai-proxy, and others

refactor(errors): rename struct in Python contract error logic

f5ac395

- Changed `truncatedCause` to `truncatedCauseError` for clarity and consistency - Simplified detail truncation logic in `truncateDetail` function

chore(docker): set ownership for copied files in terratest Dockerfile

10925d5

- Added `--chown=65532:65532` to `COPY` command in `sentinel-harness/terratest.Dockerfile` to ensure correct file ownership within the container.

fix(tests): normalize newline character in Python test

5eb4203

- Adjusted `stdout` newline representation in `python_test.exs` to use consistent newline character `\n`

floreks added 2 commits August 21, 2026 13:27

refactor(memory_engine): simplify tool_msg function logic

c5e67e5

- Removed unnecessary recursion in `tool_msg` function within `memory_engine.ex` for improved clarity and efficiency

michaeljguarino reviewed Aug 27, 2026

View reviewed changes

Comment thread lib/console/ai/tools/workbench/python.ex Outdated

Comment thread priv/prompts/workbench/job.md.eex Outdated

refactor(python_tool): rename workbench_python to python_sandbox

f61b4d6

- Updated reference in `job.md.eex` to `python_sandbox` for consistent naming - Changed function `name()` in `workbench/python.ex` to return `python_sandbox`

floreks added 2 commits August 28, 2026 12:26

Merge remote-tracking branch 'origin/master' into sebastian/prod-5143…

83251a7

…-python-tool-in-tool-query-grpc-server

refactor(python): update naming and remove redundant imports

6f442fe

- Renamed `workbench_python` to `python_sandbox` in `python_test.exs` for consistency - Updated observability prompts to reflect tool name change - Removed redundant `Python` import in `infrastructure.ex`

Uh oh!

Conversation

floreks commented Aug 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Test Plan

Checklist

Uh oh!

linear Bot commented Aug 20, 2026

Uh oh!

soffi-ai Bot commented Aug 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Sandboxed Python execution in Cloud Query

Go toolchain and dependency upgrade

Uh oh!

greptile-apps Bot commented Aug 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Summary

Confidence Score: 5/5

Important Files Changed

Uh oh!

Uh oh!

socket-security Bot commented Aug 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

floreks commented Aug 20, 2026

Uh oh!

floreks commented Aug 21, 2026

Uh oh!

floreks commented Aug 21, 2026

Uh oh!

floreks commented Aug 21, 2026

Uh oh!

floreks commented Aug 21, 2026

Uh oh!

floreks commented Aug 21, 2026

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

floreks commented Aug 20, 2026 •

edited

Loading

soffi-ai Bot commented Aug 20, 2026 •

edited

Loading

greptile-apps Bot commented Aug 20, 2026 •

edited

Loading

socket-security Bot commented Aug 20, 2026 •

edited

Loading