Repository navigation
Conditional Python Execution
Ash conditionally publishes its dedicated run_python3 tool. This keeps Python authoring and execution unavailable when ash cannot resolve an interpreter or when strict security mode is enabled.
Ash selects an interpreter in this order: ASH_PYTHON, the complete managed virtualenv at ~/.ash/venv, then system python3. run_python3 is published only if the selected interpreter resolves to a runnable executable and ASH_STRICT is off.
ASH_STRICT=1 blocks Python regardless of interpreter availability. It removes run_python3 from the tool list and rejects attempts to run ash-managed bundled .py tools. This is defense in depth; it does not sandbox any separately allowlisted general-purpose executable.
run_python3 accepts exactly one mode per call:
-
code: non-empty inline source executed withpython3 -c. -
script_path: the exactabsolute_pathreturned byash_write_scratch_filefor an existing.pyfile in the current session scratch directory.
Optional argv values are passed directly to the selected mode. Ash validates that script paths remain inside the current scratch session, so do not construct a path manually. argv values are also rejected if they reference a hidden dotfile (see Security-Model-and-Environment-Variables). This dedicated tool is separate from ~/.ash/.ash_tools; adding python3 to the Unix allowlist is unnecessary and grants broad interpreter access.
The canonical ~/.ash/.ash_system prompt contains $IF_PYTHON_AVAILABLE. Ash replaces it with Python workflow guidance when the capability is available, otherwise with an explicit prohibition on writing or invoking Python. $IF_PYTHON_AVAILABLE and $TOOLS_DIR_LIST are reserved internal Ash substitutions, never environment variables. $TOOLS_DIR_LIST renders only allowed regular scripts in ~/.ash/tools/ with read and execute bits. Lines beginning with # in that prompt or injected instruction assets are author comments and are never sent to the AI.
The Python workflow guidance renders the effective ASH_MAX_TOOL_ITERS value. Unset, invalid, and negative values use the default of 16; valid zero and positive overrides render exactly and remain enforced by the tool loop.