Skip to content

feat(security): wire capabilityPolicy across execution surfaces (#690) - #745

Merged
kunaldhongade merged 1 commit into
mainfrom
feature/690-capability-policy-surfaces
Aug 6, 2026
Merged

feat(security): wire capabilityPolicy across execution surfaces (#690)#745
kunaldhongade merged 1 commit into
mainfrom
feature/690-capability-policy-surfaces

Conversation

@kunaldhongade

@kunaldhongade kunaldhongade commented Aug 6, 2026

Copy link
Copy Markdown
Member

Summary

  • Adds createSafeCommandPolicy and threads safety.capabilityPolicy through CLI product/loop, command adapters, and OSS tool adapters.
  • MCP execution/product safety notes now state confirmations are operation-scoped and still subject to capability policy.
  • Product startup also rejects shell substitution before spawn.

Test plan

  • tsc -p tsconfig.base.json --noEmit
  • vitest run packages/execution/test packages/adapters/test packages/tool-adapters/test packages/mcp/test/mcp-execution-tools.test.ts
  • CI green

Refs #690 (does not close; remaining: sandbox isolation, full adversarial UAT corpus, session-scoped approval expiry).

… loop

Pass the loaded capability policy into configured command execution across product, tool adapters, loop, and MCP surfaces, and document that MCP confirmations are operation-scoped. Refs #690.

Co-authored-by: Cursor <cursoragent@cursor.com>
@github-actions github-actions Bot added type: test Test coverage, fixtures, or verification improvements area: cli CLI package or command behavior area: adapters External tool adapter orchestration area: mcp Model Context Protocol integration area: execution Safe command and behavior probe execution labels Aug 6, 2026
@github-actions

github-actions Bot commented Aug 6, 2026

Copy link
Copy Markdown

CodeDecay PR Check

Lead catch: No direct high-signal catch found

CodeDecay did not find a strong direct regression or weak-test signal in this run.

Risk: Medium · Merge 39/100 · Decay 43/100 · Security 0/100

This score is conservative pending stronger direct evidence. Treat structural-only signals as review guidance, not proof of a regression.

Full CodeDecay report

CodeDecay Report

Overall risk: Medium

Score Value
Merge risk 39/100
Decay risk 43/100
Security risk 0/100
Findings Count
High 4
Medium 4
Low 30

Changed Files

  • packages/adapters/src/command-adapter.ts modified (+6/-4)
  • packages/cli/src/commands/loop.ts modified (+2/-1)
  • packages/cli/src/product/generated-tests/runner.ts modified (+6/-4)
  • packages/cli/src/product/generated-tests/runner/retry.ts modified (+6/-4)
  • packages/cli/src/product/runtime/service.ts modified (+21/-3)
  • packages/execution/src/index.ts modified (+1/-0)
  • packages/execution/src/safe-policy.ts added (+20/-0)
  • packages/execution/test/capability-policy.test.ts modified (+35/-0)
  • packages/mcp/src/execution/safety.ts modified (+3/-1)
  • packages/mcp/src/product/safety.ts modified (+2/-1)
  • packages/tool-adapters/src/agent-process/configured.ts modified (+3/-2)
  • packages/tool-adapters/src/agent-process/run.ts modified (+2/-4)
  • packages/tool-adapters/src/coverage/configured.ts modified (+3/-2)
  • packages/tool-adapters/src/coverage/run.ts modified (+2/-4)
  • packages/tool-adapters/src/index.ts modified (+11/-7)
  • packages/tool-adapters/src/pact/configured.ts modified (+3/-2)
  • packages/tool-adapters/src/pact/harness.ts modified (+2/-4)
  • packages/tool-adapters/src/playwright/configured.ts modified (+3/-2)
  • packages/tool-adapters/src/playwright/harness.ts modified (+2/-4)
  • packages/tool-adapters/src/safety.ts added (+11/-0)
  • ...and 7 more file(s)

Likely Impacted Areas

  • Low Source code (source): packages/adapters/src/command-adapter.ts, packages/cli/src/commands/loop.ts, packages/cli/src/product/generated-tests/runner.ts, packages/cli/src/product/generated-tests/runner/retry.ts, packages/cli/src/product/runtime/service.ts, packages/execution/src/index.ts, packages/execution/src/safe-policy.ts, packages/mcp/src/execution/safety.ts, packages/mcp/src/product/safety.ts, packages/tool-adapters/src/agent-process/configured.ts, packages/tool-adapters/src/agent-process/run.ts, packages/tool-adapters/src/coverage/configured.ts, packages/tool-adapters/src/coverage/run.ts, packages/tool-adapters/src/index.ts, packages/tool-adapters/src/pact/configured.ts, packages/tool-adapters/src/pact/harness.ts, packages/tool-adapters/src/playwright/configured.ts, packages/tool-adapters/src/playwright/harness.ts, packages/tool-adapters/src/safety.ts, packages/tool-adapters/src/schemathesis/configured.ts, packages/tool-adapters/src/schemathesis/harness.ts, packages/tool-adapters/src/semgrep/configured.ts, packages/tool-adapters/src/semgrep/run.ts, packages/tool-adapters/src/stryker/configured.ts, packages/tool-adapters/src/stryker/run.ts, packages/tool-adapters/src/types.ts
  • Low Tests (test): packages/execution/test/capability-policy.test.ts

Normalized Impact Graph

Graph artifact: .codedecay/local/impact-graph.json (4371 node(s), 8884 edge(s))

  • Confidence: Direct: 8884, inferred: 0, heuristic: 0
  • codedecay-js-babel-symbols via @babel/parser (available, adapter 1.0.0)
    • Limitation: Call expressions are not connected to target symbols in this adapter version.
    • Limitation: Only JavaScript and TypeScript files parsed by @babel/parser are represented.
    • Limitation: Static import resolution does not resolve runtime dependency injection or dynamic imports.
  • codedecay-python-lezer via @lezer/python (available, adapter 1.0.0)
    • Limitation: Dynamic imports, dependency injection, decorators without literal routes, and framework route registries are not resolved.
    • Limitation: Python impact evidence uses the @lezer/python grammar and conservative module-to-file resolution.
    • Limitation: Static test imports do not prove execution or assertion quality.
  • Graph limitation: A static test import does not prove the symbol executed or that assertions cover its behavior.

Symbol Impact Evidence

Graph artifact: .codedecay/local/symbol-impact-graph.json (929 file(s), 5520 edge(s))

  • packages/adapters/src/command-adapter.ts#createCommandAdapter -> packages/adapters/src/configured-commands.ts, packages/adapters/src/index.ts, packages/adapters/test/adapters.test.ts
    • Likely tests: packages/adapters/test/adapters.test.ts
  • packages/cli/src/commands/loop.ts#runLoopCommand -> packages/cli/src/commands/registry.ts
  • packages/cli/src/product/generated-tests/runner.ts#runGeneratedProductTests -> packages/cli/src/product/generated-tests/index.ts, packages/cli/src/product/runtime/target.ts
  • packages/cli/src/product/generated-tests/runner/retry.ts#attachGeneratedFailureRetryEvidence -> packages/cli/src/product/generated-tests/runner.ts
  • packages/cli/src/product/runtime/service.ts#runProductOneShotCommand -> packages/cli/src/product/runtime/target.ts
  • packages/cli/src/product/runtime/service.ts#startManagedProductProcess -> packages/cli/src/product/runtime/target.ts
  • packages/execution/src/index.ts#createSafeCommandPolicy -> packages/adapters/src/command-adapter.ts, packages/cli/src/product/generated-tests/runner.ts, packages/cli/src/product/generated-tests/runner/retry.ts, packages/cli/src/product/runtime/service.ts, packages/execution/test/capability-policy.test.ts, packages/tool-adapters/src/safety.ts
    • Likely tests: packages/execution/test/capability-policy.test.ts
  • packages/execution/src/safe-policy.ts#createSafeCommandPolicy -> packages/adapters/src/command-adapter.ts, packages/cli/src/product/generated-tests/runner.ts, packages/cli/src/product/generated-tests/runner/retry.ts, packages/cli/src/product/runtime/service.ts, packages/execution/src/index.ts, packages/execution/test/capability-policy.test.ts, packages/tool-adapters/src/safety.ts
    • Likely tests: packages/execution/test/capability-policy.test.ts
  • packages/mcp/src/execution/safety.ts#createExecutionSafety -> packages/mcp/src/handlers/execution/report.ts
  • packages/mcp/src/product/safety.ts#createProductSafety -> packages/mcp/src/handlers/product/plan.ts, packages/mcp/src/handlers/product/run.ts
  • packages/tool-adapters/src/agent-process/configured.ts#createConfiguredAgentProcessHarness -> packages/tool-adapters/src/agent-process/index.ts, packages/tool-adapters/src/index.ts
  • packages/tool-adapters/src/agent-process/run.ts#runAgentProcessPlan -> packages/tool-adapters/src/agent-process/harness.ts
  • ...and 20 more symbol impact(s)

Language And Parser Coverage

  • Source files classified: 27
  • Fully supported parser files: 27
  • Limited files: 0
  • Unsupported files: 0

Merge Risk Breakdown

  • Score: 39/100
  • Raw score before dampeners: 100/100
  • Adjusted score before severity cap: 84/100
  • Highest contributing severity: Low
  • Evidence mode: heuristic-only

Top contributors:

  • +6 File spread (structural): Change breadth spans 27 file(s).
  • +4 Source area changed (heuristic): packages/adapters/src/command-adapter.ts touches a source area and should be reviewed for regression impact.
  • +4 Source area changed (heuristic): packages/cli/src/commands/loop.ts touches a source area and should be reviewed for regression impact.
  • +4 Source area changed (heuristic): packages/cli/src/product/generated-tests/runner.ts touches a source area and should be reviewed for regression impact.
  • +4 Source area changed (heuristic): packages/cli/src/product/generated-tests/runner/retry.ts touches a source area and should be reviewed for regression impact.

Dampeners:

  • -16 Heuristic-only dampener: Merge risk stays conservative until direct evidence exists.

Notes:

  • Heuristic-only merge risk is capped at 54/100 until direct evidence exists.
  • Untrusted memory context is visible but contributes 0 score until trusted evidence corroborates it.

Decay Risk Breakdown

  • Score: 43/100
  • Raw score before dampeners: 57/100
  • Adjusted score before severity cap: 43/100
  • Highest contributing severity: High
  • Evidence mode: heuristic-only

Top contributors:

  • +18 Broad unrelated change set (heuristic): This PR changes 27 files across 1 top-level areas and 2 risk categories.
  • +10 Duplicated added logic (heuristic): A similar block of added logic appears 2 times across 2 file(s).
  • +10 High complexity in changed function (heuristic): runGeneratedProductTests has estimated cyclomatic complexity 16.
  • +10 Large changed function (heuristic): runGeneratedProductTests spans 146 lines, which increases review and regression risk.
  • +6 File spread (structural): Change breadth spans 27 file(s).

Dampeners:

  • -14 Heuristic-only dampener: Decay stays conservative until direct evidence exists.

Notes:

  • Heuristic-only decay is capped at 54/100 until direct evidence exists.

Security Risk Breakdown

  • Score: 0/100
  • Raw score before dampeners: 0/100
  • Adjusted score before severity cap: 0/100

Security Matcher Coverage

  • Changed source files scanned: 26
  • Security candidates found: 0
  • Skipped files: 0

Test Evidence

  • Mode: heuristic-only
  • Sources: none
  • Changed source coverage:
  • packages/adapters/src/command-adapter.ts: not measured (no measurable changed lines)
  • packages/cli/src/commands/loop.ts: not measured (no measurable changed lines)
  • packages/cli/src/product/generated-tests/runner.ts: not measured (no measurable changed lines)
  • packages/cli/src/product/generated-tests/runner/retry.ts: not measured (no measurable changed lines)
  • packages/cli/src/product/runtime/service.ts: not measured (no measurable changed lines)
  • packages/execution/src/index.ts: not measured (no measurable changed lines)
  • packages/execution/src/safe-policy.ts: not measured (no measurable changed lines)
  • packages/mcp/src/execution/safety.ts: not measured (no measurable changed lines)
  • Notes:
  • No runtime coverage artifact was found. Test audit remains heuristic-only.

Changed Path Test Proof

Status Count
Runtime-proven 0
Static-only 17
Weakened by mocks 0
Unproven 17
  • Static-only packages/adapters/src/command-adapter.ts#createCommandAdapter (static-reference, deterministic)
    • Evidence: Referenced by packages/adapters/test/adapters.test.ts, but no runtime coverage artifact proves changed lines executed.
    • Static references: packages/adapters/test/adapters.test.ts
    • Repair task: Strengthen packages/adapters/test/adapters.test.ts so it executes packages/adapters/src/command-adapter.ts#createCommandAdapter with assertions; static import alone is not proof.
  • Unproven packages/cli/src/commands/loop.ts#runLoopCommand (missing-proof, heuristic)
    • Evidence: No runtime coverage or static test reference was found for this changed path.
    • Repair task: Add an integration test that reaches packages/cli/src/commands/loop.ts#runLoopCommand without mocking the changed boundary.
  • Unproven packages/cli/src/product/generated-tests/runner.ts#runGeneratedProductTests (missing-proof, heuristic)
    • Evidence: No runtime coverage or static test reference was found for this changed path.
    • Repair task: Add an integration test that reaches packages/cli/src/product/generated-tests/runner.ts#runGeneratedProductTests without mocking the changed boundary.
  • Unproven packages/cli/src/product/generated-tests/runner/retry.ts#attachGeneratedFailureRetryEvidence (missing-proof, heuristic)
    • Evidence: No runtime coverage or static test reference was found for this changed path.
    • Repair task: Add an integration test that reaches packages/cli/src/product/generated-tests/runner/retry.ts#attachGeneratedFailureRetryEvidence without mocking the changed boundary.
  • Unproven packages/cli/src/product/runtime/service.ts#runProductOneShotCommand (missing-proof, heuristic)
    • Evidence: No runtime coverage or static test reference was found for this changed path.
    • Repair task: Add an integration test that reaches packages/cli/src/product/runtime/service.ts#runProductOneShotCommand without mocking the changed boundary.
  • Unproven packages/cli/src/product/runtime/service.ts#startManagedProductProcess (missing-proof, heuristic)
    • Evidence: No runtime coverage or static test reference was found for this changed path.
    • Repair task: Add an integration test that reaches packages/cli/src/product/runtime/service.ts#startManagedProductProcess without mocking the changed boundary.
  • Static-only packages/execution/src/index.ts#createSafeCommandPolicy (static-reference, deterministic)
    • Evidence: Referenced by packages/execution/test/capability-policy.test.ts, but no runtime coverage artifact proves changed lines executed.
    • Static references: packages/execution/test/capability-policy.test.ts
    • Repair task: Strengthen packages/execution/test/capability-policy.test.ts so it executes packages/execution/src/index.ts#createSafeCommandPolicy with assertions; static import alone is not proof.
  • Static-only packages/execution/src/safe-policy.ts#createSafeCommandPolicy (static-reference, deterministic)
    • Evidence: Referenced by packages/execution/test/capability-policy.test.ts, but no runtime coverage artifact proves changed lines executed.
    • Static references: packages/execution/test/capability-policy.test.ts
    • Repair task: Strengthen packages/execution/test/capability-policy.test.ts so it executes packages/execution/src/safe-policy.ts#createSafeCommandPolicy with assertions; static import alone is not proof.
  • ...and 26 more changed path proof entries

Untrusted Memory Context

  • Project invariant may be impacted (packages/adapters/src/command-adapter.ts:2): Untrusted memory context: invariant "No hidden cloud or model call" applies to this change. The OSS CLI must remain useful without telemetry, API keys, hosted services, required LLM calls, or CodeDecayCloud.
  • Project invariant may be impacted (packages/adapters/src/command-adapter.ts:2): Untrusted memory context: invariant "Commands are explicit" applies to this change. CodeDecay must not run project commands unless they are configured and safety.allowCommands is true.
  • Project invariant may be impacted (packages/adapters/src/command-adapter.ts:2): Untrusted memory context: invariant "Tool evidence is separate from AI suggestions" applies to this change. Reports must not present agent/model suggestions as verified evidence unless backed by deterministic checks or command output.
  • Project invariant may be impacted (packages/adapters/src/command-adapter.ts:2): Untrusted memory context: invariant "Output must be actionable" applies to this change. Redteam reports and agent bundles should say what behavior to verify, which test proof is weak or missing, and what task a coding agent should perform.
  • Architecture note applies (packages/cli/src/commands/loop.ts:71): Untrusted architecture context: CLI is the published surface: The public npm package is @submuxhq/codedecay and the binary is codedecay. Internal workspace packages are implementation details.
  • Architecture note applies (packages/execution/src/index.ts:3): Untrusted architecture context: Local-first redteam workflow: codedecay redteam is deterministic and report-only by default. Command execution and LLM/provider use require explicit user configuration.
  • Architecture note applies (packages/mcp/src/execution/safety.ts:11): Untrusted architecture context: Agent-owned workflow: CodeDecay should produce evidence and task bundles that a user's own Codex, Claude Code, Cursor, OpenCode, Pi, desktop app, or MCP client can use.

High Risk Findings

  • Broad unrelated change set: This PR changes 27 files across 1 top-level areas and 2 risk categories.

Medium Risk Findings

  • Duplicated added logic (packages/cli/src/product/generated-tests/runner.ts:102): A similar block of added logic appears 2 times across 2 file(s).
  • High complexity in changed function (packages/cli/src/product/generated-tests/runner.ts:18): runGeneratedProductTests has estimated cyclomatic complexity 16.
  • Large changed function (packages/cli/src/product/generated-tests/runner.ts:18): runGeneratedProductTests spans 146 lines, which increases review and regression risk.

Low Risk Findings

  • Source area changed (packages/adapters/src/command-adapter.ts:2): packages/adapters/src/command-adapter.ts touches a source area and should be reviewed for regression impact.
  • Source area changed (packages/cli/src/commands/loop.ts:71): packages/cli/src/commands/loop.ts touches a source area and should be reviewed for regression impact.
  • Source area changed (packages/cli/src/product/generated-tests/runner.ts:4): packages/cli/src/product/generated-tests/runner.ts touches a source area and should be reviewed for regression impact.
  • Source area changed (packages/cli/src/product/generated-tests/runner/retry.ts:2): packages/cli/src/product/generated-tests/runner/retry.ts touches a source area and should be reviewed for regression impact.
  • Source area changed (packages/cli/src/product/runtime/service.ts:5): packages/cli/src/product/runtime/service.ts touches a source area and should be reviewed for regression impact.
  • Source area changed (packages/execution/src/index.ts:3): packages/execution/src/index.ts touches a source area and should be reviewed for regression impact.
  • Source area changed (packages/execution/src/safe-policy.ts:1): packages/execution/src/safe-policy.ts touches a source area and should be reviewed for regression impact.
  • Source area changed (packages/mcp/src/execution/safety.ts:11): packages/mcp/src/execution/safety.ts touches a source area and should be reviewed for regression impact.
  • Source area changed (packages/mcp/src/product/safety.ts:15): packages/mcp/src/product/safety.ts touches a source area and should be reviewed for regression impact.
  • Source area changed (packages/tool-adapters/src/agent-process/configured.ts:14): packages/tool-adapters/src/agent-process/configured.ts touches a source area and should be reviewed for regression impact.
  • Source area changed (packages/tool-adapters/src/agent-process/run.ts:28): packages/tool-adapters/src/agent-process/run.ts touches a source area and should be reviewed for regression impact.
  • Source area changed (packages/tool-adapters/src/coverage/configured.ts:7): packages/tool-adapters/src/coverage/configured.ts touches a source area and should be reviewed for regression impact.
  • Source area changed (packages/tool-adapters/src/coverage/run.ts:27): packages/tool-adapters/src/coverage/run.ts touches a source area and should be reviewed for regression impact.
  • Source area changed (packages/tool-adapters/src/index.ts:36): packages/tool-adapters/src/index.ts touches a source area and should be reviewed for regression impact.
  • Source area changed (packages/tool-adapters/src/pact/configured.ts:7): packages/tool-adapters/src/pact/configured.ts touches a source area and should be reviewed for regression impact.
  • Source area changed (packages/tool-adapters/src/pact/harness.ts:30): packages/tool-adapters/src/pact/harness.ts touches a source area and should be reviewed for regression impact.
  • Source area changed (packages/tool-adapters/src/playwright/configured.ts:7): packages/tool-adapters/src/playwright/configured.ts touches a source area and should be reviewed for regression impact.
  • Source area changed (packages/tool-adapters/src/playwright/harness.ts:30): packages/tool-adapters/src/playwright/harness.ts touches a source area and should be reviewed for regression impact.
  • Source area changed (packages/tool-adapters/src/safety.ts:1): packages/tool-adapters/src/safety.ts touches a source area and should be reviewed for regression impact.
  • Source area changed (packages/tool-adapters/src/schemathesis/configured.ts:11): packages/tool-adapters/src/schemathesis/configured.ts touches a source area and should be reviewed for regression impact.
  • Source area changed (packages/tool-adapters/src/schemathesis/harness.ts:30): packages/tool-adapters/src/schemathesis/harness.ts touches a source area and should be reviewed for regression impact.
  • Source area changed (packages/tool-adapters/src/semgrep/configured.ts:7): packages/tool-adapters/src/semgrep/configured.ts touches a source area and should be reviewed for regression impact.
  • Source area changed (packages/tool-adapters/src/semgrep/run.ts:29): packages/tool-adapters/src/semgrep/run.ts touches a source area and should be reviewed for regression impact.
  • Source area changed (packages/tool-adapters/src/stryker/configured.ts:7): packages/tool-adapters/src/stryker/configured.ts touches a source area and should be reviewed for regression impact.
  • Source area changed (packages/tool-adapters/src/stryker/run.ts:29): packages/tool-adapters/src/stryker/run.ts touches a source area and should be reviewed for regression impact.
  • Source area changed (packages/tool-adapters/src/types.ts:7): packages/tool-adapters/src/types.ts touches a source area and should be reviewed for regression impact.
  • Test area changed (packages/execution/test/capability-policy.test.ts:10): packages/execution/test/capability-policy.test.ts touches a test area and should be reviewed for regression impact.

Recommended Checks

  • Add an integration test that reaches packages/cli/src/commands/loop.ts#runLoopCommand without mocking the changed boundary.
  • Add an integration test that reaches packages/cli/src/product/generated-tests/runner.ts#runGeneratedProductTests without mocking the changed boundary.
  • Add an integration test that reaches packages/cli/src/product/generated-tests/runner/retry.ts#attachGeneratedFailureRetryEvidence without mocking the changed boundary.
  • Add an integration test that reaches packages/cli/src/product/runtime/service.ts#runProductOneShotCommand without mocking the changed boundary.
  • Add an integration test that reaches packages/cli/src/product/runtime/service.ts#startManagedProductProcess without mocking the changed boundary.
  • Add an integration test that reaches packages/tool-adapters/src/agent-process/run.ts#runAgentProcessPlan without mocking the changed boundary.
  • Add an integration test that reaches packages/tool-adapters/src/coverage/run.ts without mocking the changed boundary.
  • Add an integration test that reaches packages/tool-adapters/src/semgrep/run.ts#runSemgrepPlan without mocking the changed boundary.
  • Add an integration test that reaches packages/tool-adapters/src/stryker/run.ts#runStrykerPlan without mocking the changed boundary.
  • Add an integration test that reaches packages/tool-adapters/src/types.ts#AgentProcessHarnessOptions without mocking the changed boundary.
  • Add an integration test that reaches packages/tool-adapters/src/types.ts#CoverageHarnessOptions without mocking the changed boundary.
  • Add an integration test that reaches packages/tool-adapters/src/types.ts#PactHarnessOptions without mocking the changed boundary.

Notes

CodeDecay is deterministic and local-first. This report was generated without telemetry, API keys, LLMs, or model calls.


Found by CodeDecay - deterministic, local-first, no telemetry.

@kunaldhongade
kunaldhongade merged commit 9d4c935 into main Aug 6, 2026
10 checks passed
@kunaldhongade
kunaldhongade deleted the feature/690-capability-policy-surfaces branch August 6, 2026 12:32
kunaldhongade added a commit that referenced this pull request Aug 6, 2026
… loop (#745)

Pass the loaded capability policy into configured command execution across product, tool adapters, loop, and MCP surfaces, and document that MCP confirmations are operation-scoped. Refs #690.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area: adapters External tool adapter orchestration area: cli CLI package or command behavior area: execution Safe command and behavior probe execution area: mcp Model Context Protocol integration type: test Test coverage, fixtures, or verification improvements

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant