feat(cloud-query): add python interpeter tool to tool query grpc server by floreks · Pull Request #4029 · pluralsh/console

floreks · 2026-08-20T14:16:13Z

This pull request introduces a new feature to the Cloud Query service: support for sandboxed Python execution using Monty (via the gomonty library), alongside the existing Lua support. It also upgrades the Go toolchain and dependencies across the project to version 1.26.6 and increases the default memory allocation for the Cloud Query service. The changes include updates to documentation, Dockerfiles, proto definitions, and service initialization logic.

New Python Execution Feature:

Added RunPython gRPC endpoint to the ToolQuery service, allowing execution of Monty's limited Python subset in a secure sandbox. This includes new proto messages (RunPythonInput, RunPythonOutput) and updates to API documentation describing the feature, its constraints, and usage. [1] [2] [3] [4] [5] [6]
Integrated the Python worker process into the main service entrypoint, with logic to launch and manage the worker subprocess. [1] [2]

Dependency and Toolchain Upgrades:

Upgraded Go version from 1.26.5 to 1.26.6 across all relevant go.mod files and Dockerfiles for build consistency and security. [1] [2] [3] [4] [5] [6] [7]
Updated and added Go module dependencies, including adding github.com/ewhauser/gomonty for Python sandboxing, and other indirect dependencies for improved functionality and compatibility. [1] [2] [3] [4] [5] [6]

Resource Allocation Improvements:

Increased the default memory request and set a memory limit for the Cloud Query service in charts/console/values.yaml to better support the new Python sandboxing feature and improve reliability.

Documentation Updates:

Expanded the Cloud Query README and API reference to document the new Python execution feature, its operational constraints, and usage instructions. [1] [2] [3]

Internal Service Initialization:

Refactored service startup to properly initialize the ToolQuery service with the new Python worker, and improved error handling during startup.

Test Plan

Test environment: https://console.plrl-dev-aws.onplural.sh/

Checklist

I have added a meaningful title and summary to convey the impact of this PR to a user.
If required, I have updated the Plural documentation accordingly.
I have added tests to cover my changes.
I have deployed the agent to a test environment and verified that it works as expected (required only when changing agent code).

Plural Flow: console

- Added `RunPythonInput` and `RunPythonOutput` message types in `toolquery.proto` for Python script execution - Introduced Python worker logic using a limited subset of Monty, with controlled execution environment and resources - Enhanced `Server` with graceful shutdown and service cleanup to safely terminate background processes - Updated `ToolQueryService` to support Python script execution with context handling - Added `Closer` interface for services that require resource cleanup - Implemented protocol versioning and request handling for Python execution in the worker process - Extended Elixir definitions in toolquery.pb.ex to include Python RPC services - Updated workbench documentation to incorporate Python tool information

- Removed obsolete Python protocol and worker logic - Introduced new worker and contract packages for improved modularity - Added `internal/worker/os.go` for handling OS-level operations in a sandboxed environment - Enhanced `ToolQueryService` to utilize the refactored Python runner interface - Simplified error handling and error message generation - Improved code organization by separating logic into distinct packages

linear · 2026-08-20T14:16:16Z

PROD-5143

soffi-ai · 2026-08-20T14:16:35Z

Soffi AI Summary

This PR adds sandboxed Python execution capability to the Cloud Query gRPC service, exposing it as a new RunPython RPC on the ToolQuery service. The motivation is to give AI agents in the workbench a safe way to run user-provided Python scripts (using the Monty limited-Python subset) for data transformation and computation tasks, without exposing host resources or requiring a full CPython runtime.

Key changes:

New RunPython gRPC endpoint (go/cloud-query/): Adds RunPythonInput/RunPythonOutput proto messages and the RunPython RPC to toolquery.proto, with generated Go stubs. Scripts receive JSON input via a global input dict and write structured results to a global output dict; print() output is captured separately in stdout. The implementation runs scripts in a sandboxed subprocess via the github.com/ewhauser/gomonty Monty interpreter with strict resource and security limits.
Python tool implementation (go/cloud-query/internal/tools/python/): New package with configuration (config.go), error handling (errors.go, internal/contract/errors.go), gRPC status mapping (grpc/status.go), and a README. Tests cover configuration validation, gRPC status translation, and end-to-end script execution (including newline normalization).
Elixir/server-side wiring (go/cloud-query/internal/service/): toolquery.go and service.go updated to route RunPython calls through the new tool implementation and register it in the server.
Dependency and build updates: Go version bumped to 1.26.6 across all relevant modules (go/cloud-query, go/ai-proxy, go/client) and Dockerfiles. Added github.com/ewhauser/gomonty and github.com/ebitengine/purego dependencies to support Monty integration.
Resource configuration: Default memory requests/limits for the Cloud Query service increased in charts/console/values.yaml to accommodate the Python worker's memory footprint.
Documentation: README.md and docs/api-reference.md updated to document the new Python execution feature, its limitations, and operational considerations.
Elixir AI subsystem (minor): tool_msg function in the memory engine simplified and a unit test added for tool result serialization.

Commits

Commit	Summary
`f34b6e8`	Introduces the core `RunPython` gRPC endpoint: adds proto messages (`RunPythonInput`/`RunPythonOutput`), the new RPC to `ToolQuery`, and the initial sandboxed Python execution implementation using the Monty interpreter.
`acc0d7d`	Refactors the Python tool into a structured package layout, separating config, error handling, gRPC status mapping, and execution logic into distinct files under `internal/tools/python/`.
`252816f`	Merge commit syncing with upstream master; no functional changes.
`2fb11cd`	Tightens runtime limits for the Python sandbox and adds end-to-end tests for script execution, output capture, and error cases.
`a478564`	Adds `github.com/ewhauser/gomonty`, `github.com/ebitengine/purego`, and other indirect dependencies required by the Monty Python interpreter integration.
`c17503d`	Bumps the Go version to 1.26.6 in `go.mod` files across `go/cloud-query`, `go/ai-proxy`, and `go/client` for consistency and security.
`8ad5b0b`	Updates Go base image to 1.26.6 in the `go/cloud-query` and related Dockerfiles.
`93d827b`	Continues Dockerfile Go version bump, ensuring all service Dockerfiles consistently use Go 1.26.6.
`f5ac395`	Renames an internal struct in the Python contract error logic for clarity; no behavioral change.
`10925d5`	Fixes file ownership for copied files in the terratest Dockerfile to resolve potential permission issues in CI.
`5eb4203`	Normalizes newline characters in the Python sandbox test to fix flaky test failures across different OS environments.
`c4e4484`	Adds a unit test for tool result serialization in the Elixir memory engine.
`c5e67e5`	Simplifies the `tool_msg` function in the Elixir memory engine by removing unnecessary branching.
`4a65851`	Removes the `MemoryEngineTest` module and cleans up Python test output assertions to reduce test noise.

Updated: 2026-08-21 12:59 UTC

Deploy in Soffi

…-python-tool-in-tool-query-grpc-server

greptile-apps · 2026-08-20T14:19:32Z

Greptile Summary

The PR adds sandboxed Monty Python execution to Cloud Query and exposes it as a workbench tool.

Adds the RunPython gRPC contract, worker subprocess pool, protocol, validation, resource limits, shutdown handling, and tests.
Integrates Python execution into Console’s AI workbench and relevant subagents and prompts.
Updates Cloud Query deployment resources, documentation, generated clients, Go versions, and dependencies.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
go/cloud-query/internal/tools/python/internal/pool/pool.go	Implements the bounded worker subprocess pool, request queueing, recycling, cancellation, and shutdown lifecycle.
go/cloud-query/internal/tools/python/internal/worker/runtime.go	Executes validated requests in fresh Monty sessions under configured runtime limits.
go/cloud-query/internal/service/toolquery.go	Initializes the Python runner, exposes the RunPython RPC, translates errors, and closes workers during shutdown.
go/cloud-query/api/proto/toolquery.proto	Adds the RunPython request, response, and ToolQuery service method contract.
lib/console/ai/tools/workbench/python.ex	Integrates the Cloud Query Python endpoint as a Console AI workbench tool.
charts/console/values.yaml	Raises Cloud Query’s memory request and introduces a memory limit for the Python runtime workload.

_{Reviews (4): Last reviewed commit: "refactor(tests): remove MemoryEngineTest..." | Re-trigger Greptile}

socket-security · 2026-08-20T14:20:23Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	golang/github.com/ewhauser/gomonty@v0.0.14

View full report

- Increased Monty execution time to 60 seconds - Updated wall timeout to 65 seconds and Monty-managed memory to 100 MiB - Reduced recursion limit to 100 frames - Updated README and API reference documentation to reflect new limits - Added tests for wall timeout and Monty runtime limit validation

floreks · 2026-08-20T14:54:56Z

@greptileai

- Bumped Go version in `console/go/helm-test` from 1.26.5 to 1.26.6 - Added various indirect dependencies to `console/go/ai-proxy` - Updated `google.golang.org/genproto/googleapis/rpc` to new version in multiple modules - Aligned proto dependencies across projects

- Updated Go version from 1.26.5 to 1.26.6 in various modules - Ensured consistent Go version across all sub-projects

- Updated Go version from 1.26.5 to 1.26.6 for consistency across all Dockerfiles - Aligned version in various service and component Dockerfiles including datastore, deployment-operator, ai-proxy, and others

- Bumped Go version from 1.26.5 to 1.26.6 across all relevant Dockerfiles - Ensured version consistency in Kubernetes agent, cloud-query, and deployment-operator components - Modified GitHub workflow to align Go version with Dockerfile updates

- Changed `truncatedCause` to `truncatedCauseError` for clarity and consistency - Simplified detail truncation logic in `truncateDetail` function

- Added `--chown=65532:65532` to `COPY` command in `sentinel-harness/terratest.Dockerfile` to ensure correct file ownership within the container.

- Adjusted `stdout` newline representation in `python_test.exs` to use consistent newline character `\n`

floreks · 2026-08-21T10:09:55Z

@greptileai

floreks · 2026-08-21T10:16:37Z

plural deploy to dev

- Added `MemoryEngineTest` in `memory_engine_test.exs` to verify structured tool result serialization before next completion - Utilized `Mimic` for mocking provider calls - Included `MapTool` as an embedded schema for testing purposes - Enhanced `tool_msg` logic for proper result serialization in `memory_engine.ex`

floreks · 2026-08-21T11:17:50Z

plural deploy to dev

- Removed unnecessary recursion in `tool_msg` function within `memory_engine.ex` for improved clarity and efficiency

…utputs - Deleted `MemoryEngineTest` module for test suite simplification - Removed unused function `tool_result_content` in `memory_engine.ex` for cleaner code - Updated Python test cases to handle serialized outputs using `Output.json` - Added test for bounding oversized Python output in `python_test.exs` to ensure result size compliance

floreks · 2026-08-21T14:34:35Z

plural deploy to dev

floreks · 2026-08-21T14:49:11Z

@greptileai

floreks added 2 commits August 20, 2026 11:16

floreks self-assigned this Aug 20, 2026

floreks requested a review from a team as a code owner August 20, 2026 14:16

floreks added the enhancement New feature or request label Aug 20, 2026

Merge remote-tracking branch 'origin/master' into sebastian/prod-5143…

252816f

…-python-tool-in-tool-query-grpc-server

greptile-apps Bot reviewed Aug 20, 2026

View reviewed changes

Comment thread go/cloud-query/README.md Outdated

floreks added 7 commits August 20, 2026 17:01

chore(dependencies): bump Go version across all modules

c17503d

- Updated Go version from 1.26.5 to 1.26.6 in various modules - Ensured consistent Go version across all sub-projects

chore(docker): bump Go version in Dockerfiles to 1.26.6

8ad5b0b

- Updated Go version from 1.26.5 to 1.26.6 for consistency across all Dockerfiles - Aligned version in various service and component Dockerfiles including datastore, deployment-operator, ai-proxy, and others

refactor(errors): rename struct in Python contract error logic

f5ac395

- Changed `truncatedCause` to `truncatedCauseError` for clarity and consistency - Simplified detail truncation logic in `truncateDetail` function

chore(docker): set ownership for copied files in terratest Dockerfile

10925d5

- Added `--chown=65532:65532` to `COPY` command in `sentinel-harness/terratest.Dockerfile` to ensure correct file ownership within the container.

fix(tests): normalize newline character in Python test

5eb4203

- Adjusted `stdout` newline representation in `python_test.exs` to use consistent newline character `\n`

floreks added 2 commits August 21, 2026 13:27

refactor(memory_engine): simplify tool_msg function logic

c5e67e5

- Removed unnecessary recursion in `tool_msg` function within `memory_engine.ex` for improved clarity and efficiency

Navigation Menu

Uh oh!

feat(cloud-query): add python interpeter tool to tool query grpc server - #4029

feat(cloud-query): add python interpeter tool to tool query grpc server#4029
floreks wants to merge 14 commits into
masterfrom
sebastian/prod-5143-python-tool-in-tool-query-grpc-server

floreks commented Aug 20, 2026 •

edited

Loading

Uh oh!

linear Bot commented Aug 20, 2026

Uh oh!

soffi-ai Bot commented Aug 20, 2026 •

edited

Loading

Commits

Uh oh!

greptile-apps Bot commented Aug 20, 2026 •

edited

Loading

Important Files Changed

Uh oh!

Uh oh!

socket-security Bot commented Aug 20, 2026 •

edited

Loading

Uh oh!

floreks commented Aug 20, 2026

Uh oh!

floreks commented Aug 21, 2026

Uh oh!

floreks commented Aug 21, 2026

Uh oh!

floreks commented Aug 21, 2026

Uh oh!

floreks commented Aug 21, 2026

Uh oh!

floreks commented Aug 21, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

floreks commented Aug 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Test Plan

Checklist

Uh oh!

linear Bot commented Aug 20, 2026

Uh oh!

soffi-ai Bot commented Aug 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Commits

Uh oh!

greptile-apps Bot commented Aug 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Summary

Confidence Score: 5/5

Important Files Changed

Uh oh!

Uh oh!

socket-security Bot commented Aug 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

floreks commented Aug 20, 2026

Uh oh!

floreks commented Aug 21, 2026

Uh oh!

floreks commented Aug 21, 2026

Uh oh!

floreks commented Aug 21, 2026

Uh oh!

floreks commented Aug 21, 2026

Uh oh!

floreks commented Aug 21, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

floreks commented Aug 20, 2026 •

edited

Loading

soffi-ai Bot commented Aug 20, 2026 •

edited

Loading

greptile-apps Bot commented Aug 20, 2026 •

edited

Loading

socket-security Bot commented Aug 20, 2026 •

edited

Loading