feat(python): enable Python and TypeScript in BashTool

[chaliy]

What changed

• Let Python BashTool opt into sandboxed Monty Python and ZapCode TypeScript with python=True / typescript=True.
• Forward runtime flags and initial env through LangChain and deepagents integrations. Both languages share the tool's VFS, and configuration persists through reset and snapshot reconstruction.
• Keep both runtimes disabled by default. Preserve Python's constructor-time host permission: env={"BASHKIT_ALLOW_INPROCESS_PYTHON": "1"} is required; an agent script cannot enable it with export.
• Update typing, user guides, generated API docs, and capability/knowledge records.

Why

Agents using the LangChain/deepagents Bash tool need to execute Python and TypeScript against their virtual files without launching host processes.

Closes #2702.

Before / After

Before: the native constructor rejected the requested configuration:

TypeError: BashTool.__new__() got an unexpected keyword argument 'python'
TypeError: BashTool.__new__() got an unexpected keyword argument 'typescript'

After: a real Anthropic model (claude-haiku-5-5, discovered via the provider's models API) called each framework's Bash tool. TypeScript wrote [19, 23] to /tmp/numbers.json, then Python read that same VFS file and printed the sum:

langchain: model=claude-haiku-5-5, tool_calls=1, marker=RUNTIME_SMOKE_OK=42
  actual tool output: 'RUNTIME_SMOKE_OK=42\n'
deepagents: model=claude-haiku-5-5, tool_calls=1, marker=RUNTIME_SMOKE_OK=42
  actual tool output: 'RUNTIME_SMOKE_OK=42'

Example host configuration:

from bashkit.langchain import create_bash_tool

tool = create_bash_tool(
    python=True,
    typescript=True,
    env={"BASHKIT_ALLOW_INPROCESS_PYTHON": "1"},
)

Risk

• Medium: Python wheels now compile the existing TypeScript runtime; this adds bundled interpreter code, but neither runtime is registered unless explicitly requested.
• No new host-process or filesystem permissions. Existing VFS/runtime limits and Python's host-controlled gate remain in effect.
• Regression tests cover default denial, independent runtime selection, metadata, sync/async calls, shared VFS, reset, keyed/unkeyed snapshot factories, framework forwarding/tool invocation, invalid programs, and rejection of script-only Python permission.

Validation

• Full Python suite: 868 passed, 5 skipped.
• just pre-pr passed under GNU Bash (the first macOS Bash 3.2 run hit an existing differential-test compatibility gap; the GNU Bash rerun passed without weakening tests).
• just test passed with feature-sliced Rust tests, including serialized failpoint/security coverage.
• cargo clippy --all-targets --all-features -- -D warnings passed.
• Ruff, formatting, generated API-doc freshness, capability parity, OKF, doc links, and diff checks passed.
• Live LLM tool-calling smoke passed for both integrations.

Checklist

• Tests added or updated
• Backward compatibility considered — new flags default to False; existing default behavior is unchanged

Produced by yolop

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	bashkit	e026073	Commit Preview URL Branch Preview URL	Oct 14 2026, 06:11 AM