Add remote shell payload for remote REPL.

[mpereiraesaa]

Summary by CodeRabbit

• New Features
  • Remote Python shell: Execute Python commands remotely with captured output and error handling; supports utility commands for inspection and control
  • Remote shell client: Interactive TCP-based client for connecting to and issuing commands against the remote shell with automatic session management

[coderabbitai]

Walkthrough

New remote Python REPL implementation comprising server-side and client-side modules. The server processes special commands, executes Python code within a context, captures stdout/stderr, and frames responses with markers. The client provides interactive TCP communication for remote command execution and result retrieval.

Changes

Cohort / File(s)	Summary
Remote Shell Server payloads/remote_shell.py	New module implementing a socket-based Python REPL. Introduces handle_special_commands() to interpret .exit, .quit, .vars, .dir, .type, .repr commands; handle_command() to orchestrate command execution with eval/exec fallback; and a main REPL loop that handles client connections, prompts, per-byte input reading, stdout/stderr capture, and response framing with END_MARKER.
Remote Shell Client remote_client.py	New module implementing an interactive TCP client. Provides recv_until() utility to read data until marker and main() for connection setup and interactive loop handling user input, server responses, and exit commands.

Sequence Diagram

sequenceDiagram
    participant Client as Client
    participant Server as Remote Shell
    
    Client->>Server: Connect to host:port
    Server->>Client: Send greeting
    
    loop Command Loop
        Server->>Client: Send prompt "ps> "
        Client->>Client: Read user input
        Client->>Server: Send command
        
        alt Is Special Command
            Server->>Server: handle_special_commands()<br/>(parse .exit, .vars, etc.)
        else Regular Python Code
            Server->>Server: handle_command()<br/>(compile with eval/exec)<br/>(capture stdout/stderr)
        end
        
        Server->>Client: Send output
        Server->>Client: Send END_MARKER
        Client->>Client: Display output
    end
    
    Client->>Client: User sends exit command
    Client->>Server: Close connection
    Server->>Server: Send "Bye." and cleanup

Estimated Code Review Effort

🎯 3 (Moderate) | ⏱️ ~20–25 minutes

Areas requiring extra attention:

• Security model of arbitrary code execution within a captured context; potential for unintended namespace pollution or access
• Socket error handling and edge cases (client disconnect, malformed input, encoding mismatches)
• Stdout/stderr redirection mechanism and restoration safety—particularly in async or multi-threaded scenarios
• Special command parsing and error reporting for missing names (e.g., .type undefined_var)
• Byte-by-byte newline-terminated input handling; robustness for unusual line endings or binary data

Poem

🐰 A shell so remote, code flows through the wire,
Commands dance freely, fulfilling desire,
With markers and prompts, the output takes flight,
Client and server in sync, what a sight!
ps> whispers the rabbit, let's code through the night! 🚀

Pre-merge checks and finishing touches

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 25.00% which is insufficient. The required threshold is 80.00%.	You can run @coderabbitai generate docstrings to improve docstring coverage.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely summarizes the primary change: adding a remote shell payload that implements a remote REPL functionality.

✨ Finishing touches

• 📝 Generate docstrings

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

📜 Review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between bc04aed and 0ce8763.

📒 Files selected for processing (2)

• payloads/remote_shell.py (1 hunks)
• remote_client.py (1 hunks)

🧰 Additional context used

🧬 Code graph analysis (1)

payloads/remote_shell.py (2)

src/utils/rp.py (1)

• log (45-52)

payloads/updater_for_up_to_2.x.x.py (1)

• sc (16-34)

🪛 Ruff (0.14.4)

payloads/remote_shell.py

113-113: Use of possibly insecure function; consider using ast.literal_eval

(S307)

---

118-118: Use of exec detected

(S102)

---

121-121: Do not catch blind exception: Exception

(BLE001)

---

179-179: Comment contains ambiguous – (EN DASH). Did you mean - (HYPHEN-MINUS)?

(RUF003)

---

193-193: Do not catch blind exception: Exception

(BLE001)

[coderabbitai]

⚠️ Potential issue | 🔴 Critical

Fix exec usage for Python 2 REPL commands.

This payload runs under Python 2.7, so exec is still a statement. The current exec(code_obj, ctx, ctx) builds a tuple and triggers TypeError: exec() arg 1 must be a string or code object, meaning any statement command (x = 1, import os, etc.) fails. Switch back to the Python 2 form so statements execute correctly.

-                exec(code_obj, ctx, ctx)
+                exec code_obj in ctx, ctx

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	if mode == "eval":
	result = eval(code_obj, ctx, ctx)
	# Para ver contenido de expresiones tipo "renpy"
	if result is not None:
	print(repr(result))
	else:
	exec(code_obj, ctx, ctx)
	except SystemExit:
	if mode == "eval":
	result = eval(code_obj, ctx, ctx)
	# Para ver contenido de expresiones tipo "renpy"
	if result is not None:
	print(repr(result))
	else:
	exec code_obj in ctx, ctx
	except SystemExit:

🧰 Tools

🪛 Ruff (0.14.4)

113-113: Use of possibly insecure function; consider using ast.literal_eval

(S307)

---

118-118: Use of exec detected

(S102)

🤖 Prompt for AI Agents

In payloads/remote_shell.py around lines 112 to 119, the code uses
exec(code_obj, ctx, ctx) which is the Python 3 function form but this runs under
Python 2.7 where exec is a statement; the current call builds a tuple and raises
TypeError for statement inputs. Replace the function-call form with the Python 2
exec statement invocation so the compiled code object is executed in the
provided ctx namespace (e.g., use the exec statement form that takes the code
object and namespace), ensuring statements like assignments and imports run
correctly under Python 2.