[Eduard van Valkenburg (eavanvalkenburg)]

Motivation & Context

Apply LocalCodeAct's existing OS and process-capability policy consistently across helper functions, loop iterations, aliases, and imports.

Description & Review Guide

• What are the major changes? Collect OS provenance before checking its uses. Use a deduplicated name-dependency worklist instead of repeated full scans. Normalize unsupported chains into one forbidden state and retain a finite-state propagation bound. Extend the capability policy with _make_subprocess_transport, _UnixSubprocessTransport, _WindowsSubprocessTransport, Popen, and _winapi. Add regression coverage and document conservative name tracking.

• What is the impact of these changes? Unsupported OS-derived uses are rejected regardless of their position in helper or loop bodies. Lexical path helpers, read-only environment access, and policy overrides remain supported. Negative regressions verify rejection before a marker-only runner starts. Large reverse-ordered alias chains have deterministic linear producer-visit coverage without executing generated source. This does not change the requirement for external isolation.

  Validation from dotnet/, using .NET SDK 10.0.401 and CPython 3.12.7:

  dotnet build src/Microsoft.Agents.AI.LocalCodeAct -f net10.0 --no-restore --tl:off
  # Passed: 0 warnings, 0 errors.
  dotnet test --project tests/Microsoft.Agents.AI.LocalCodeAct.UnitTests -f net10.0 --no-restore --filter-query '/*/Microsoft.Agents.AI.LocalCodeAct.UnitTests/LocalExecuteCodeFunctionIntegrationTests/*'
  # Passed: 232 tests, 0 skipped.
  dotnet test --project tests/Microsoft.Agents.AI.LocalCodeAct.UnitTests -f net10.0 --no-build
  # Passed: 264 tests, 0 skipped.
  dotnet format tests/Microsoft.Agents.AI.LocalCodeAct.UnitTests --no-restore --verify-no-changes --include tests/Microsoft.Agents.AI.LocalCodeAct.UnitTests/LocalExecuteCodeFunctionIntegrationTests.cs --verbosity quiet
  # Passed.

  The same filtered regressions also passed with CPython 3.10.15, 3.11.10, and 3.13.1 (232 tests per interpreter, 0 skipped):

  for version in 3.10 3.11 3.13; do
      export LOCAL_CODEACT_PYTHON="$(uv python find --no-python-downloads "$version")"
      dotnet test --project tests/Microsoft.Agents.AI.LocalCodeAct.UnitTests -f net10.0 --no-build --filter-query '/*/Microsoft.Agents.AI.LocalCodeAct.UnitTests/LocalExecuteCodeFunctionIntegrationTests/*'
  done
  # Passed for all three interpreters.

• What do you want reviewers to focus on? Finite-state convergence and dependency scheduling, conservative propagation across assignments and scopes, safe path/environment compatibility, and capability rejection across member access and from-imports.

Related Issue

N/A

AI Assistance

• No material AI assistance was used.
• This is an AI-assisted contribution. I reviewed, understood, and verified all submitted content and accept responsibility for it.

AI assistance details: GitHub Copilot assisted with implementation, regression tests, documentation, and this PR description.

Contribution Checklist

• The code builds clean without any errors or warnings
• All unit tests pass, and I have added new tests where possible
• The PR follows the Contribution Guidelines
• This PR links to an agreed issue with no competing open PR, or the Related Issue section documents a trivial-change or repository-automation exception.
• This is not a breaking change. If it is a breaking change, add the breaking change label (or add "[BREAKING]" to the title prefix, before or after any language prefix) — a workflow keeps the label and the title prefix in sync automatically.

[Copilot]

🟢 Approval recommended

No active review issues block approval of the Python validation hardening changes.

No open issues 🎉

What changed in this PR

This PR hardens LocalCodeAct’s Python validation within the .NET package by applying OS provenance and process-capability restrictions consistently across helpers, aliases, imports, and loop iterations. External isolation remains required.

Changes:

• Collects OS provenance before checking uses, with a finite-state bound for cyclic aliases.
• Blocks additional private asyncio and Windows process capabilities.
• Adds regression coverage for rejection before execution, convergence, policy overrides, and permitted path/environment access; documents conservative tracking.

File	Description
dotnet/​tests/​Microsoft.Agents.AI.LocalCodeAct.UnitTests/​LocalExecuteCodeFunctionIntegrationTests.cs	Adds capability, provenance, convergence, and compatibility regressions.
dotnet/​src/​Microsoft.Agents.AI.LocalCodeAct/​Resources/​validator.py	Adds bounded provenance collection and expands blocked process capabilities.
dotnet/​src/​Microsoft.Agents.AI.LocalCodeAct/​README.md	Explains provenance tracking, conservative rejection, and capability restrictions.

_{Review effort: Balanced}

[github-actions]

MAF Automated Review — Iteration 1

Result: Findings reported
Scope: full PR (1 commit(s)): 3838f675a49d
Model: gpt-5.6-sol

Overview

The change strengthens LocalCodeAct validation by collecting OS provenance before use checks, normalizing unsupported chains to a finite state, and unconditionally blocking additional process capabilities. State reset, subprocess isolation, validation timeouts, and broad regression coverage provide meaningful guardrails. However, the fixed-point implementation rescans all producers on every propagation sweep, allowing modest model-generated inputs to consume the full validation timeout.

Reviewed the supplied pull-request change set across correctness, security/reliability, architecture, and failure behavior.
1 verified finding remained after source verification (1 medium) across 1 file. Details are attached to the affected lines below.

Affected areas: dotnet/src/Microsoft.Agents.AI.LocalCodeAct/Resources/validator.py