Skip to content

feat(security): close capability policy (#690) - #749

Merged
kunaldhongade merged 1 commit into
mainfrom
feature/690-capability-policy-close
Aug 6, 2026
Merged

feat(security): close capability policy (#690)#749
kunaldhongade merged 1 commit into
mainfrom
feature/690-capability-policy-close

Conversation

@kunaldhongade

@kunaldhongade kunaldhongade commented Aug 6, 2026

Copy link
Copy Markdown
Member

Summary

  • Close remaining security(agent-runtime): enforce a capability policy across untrusted agent workflows #690 gaps: session-scoped exact-scope approvals with expiry/consume (UAT-SECURITY-5), sandbox required→blocked degrade (never silent full access), MCP confirmation scope binding, and trusted-evidence guards against forged agent/tool claims.
  • Add UAT-SECURITY-1..7 deterministic corpus plus threat-model updates for sandbox/approvals.
  • Config defaults capabilityPolicy.sandbox: best-effort.

Closes #690

Test plan

  • vitest run packages/execution/test/capability-uat.test.ts
  • vitest run packages/execution/test/capability-policy.test.ts
  • vitest run packages/config/test/capability-policy.test.ts
  • tsc -p tsconfig.base.json --noEmit
  • CI green on this PR

Made with Cursor

@kunaldhongade
feat(security): close capability policy with approvals, sandbox degra…
70144df 
…de, UAT

Add session-scoped exact-scope approvals, sandbox required→blocked degrade,
trusted-evidence guards, and UAT-SECURITY-1..7 coverage so #690 can close.
@github-actions github-actions Bot added documentation Improvements or additions to documentation type: test Test coverage, fixtures, or verification improvements area: docs README, community files, or documentation area: config CodeDecay project configuration area: mcp Model Context Protocol integration area: execution Safe command and behavior probe execution labels Aug 6, 2026
@github-actions

github-actions Bot commented Aug 6, 2026

Copy link
Copy Markdown

CodeDecay PR Check

Lead catch: No direct high-signal catch found

CodeDecay did not find a strong direct regression or weak-test signal in this run.

Risk: Medium · Merge 39/100 · Decay 54/100 · Security 0/100

This score is conservative pending stronger direct evidence. Treat structural-only signals as review guidance, not proof of a regression.

Full CodeDecay report

CodeDecay Report

Overall risk: Medium

Score Value
Merge risk 39/100
Decay risk 54/100
Security risk 0/100
Findings Count
High 4
Medium 9
Low 22

Changed Files

  • docs/security/threat-model.md modified (+14/-7)
  • packages/config/src/defaults/config.ts modified (+2/-1)
  • packages/config/src/index.ts modified (+1/-0)
  • packages/config/src/normalize/capability-policy.ts modified (+26/-4)
  • packages/config/src/types.ts modified (+2/-1)
  • packages/config/src/types/capability-policy.ts modified (+7/-0)
  • packages/config/test/capability-policy.test.ts modified (+4/-1)
  • packages/config/test/config-defaults-loading.test.ts modified (+2/-1)
  • packages/config/test/fixtures/full-config.ts modified (+2/-1)
  • packages/execution/src/capability/approvals.ts added (+192/-0)
  • packages/execution/src/capability/authorize.ts modified (+50/-4)
  • packages/execution/src/capability/evidence.ts added (+38/-0)
  • packages/execution/src/capability/index.ts modified (+21/-2)
  • packages/execution/src/capability/sandbox.ts added (+101/-0)
  • packages/execution/src/capability/types.ts modified (+16/-1)
  • packages/execution/src/command.ts modified (+2/-1)
  • packages/execution/src/index.ts modified (+20/-1)
  • packages/execution/src/types.ts modified (+10/-0)
  • packages/execution/test/capability-uat.test.ts added (+285/-0)
  • packages/mcp/src/execution/safety.ts modified (+1/-0)

Likely Impacted Areas

  • Low Documentation (docs): docs/security/threat-model.md
  • Low Source code (source): packages/config/src/defaults/config.ts, packages/config/src/index.ts, packages/config/src/normalize/capability-policy.ts, packages/config/src/types.ts, packages/config/src/types/capability-policy.ts, packages/execution/src/capability/approvals.ts, packages/execution/src/capability/authorize.ts, packages/execution/src/capability/evidence.ts, packages/execution/src/capability/index.ts, packages/execution/src/capability/sandbox.ts, packages/execution/src/capability/types.ts, packages/execution/src/command.ts, packages/execution/src/index.ts, packages/execution/src/types.ts, packages/mcp/src/execution/safety.ts
  • Low Tests (test): packages/config/test/capability-policy.test.ts, packages/config/test/config-defaults-loading.test.ts, packages/config/test/fixtures/full-config.ts, packages/execution/test/capability-uat.test.ts

Normalized Impact Graph

Graph artifact: .codedecay/local/impact-graph.json (4487 node(s), 9121 edge(s))

  • Confidence: Direct: 9121, inferred: 0, heuristic: 0
  • codedecay-js-babel-symbols via @babel/parser (available, adapter 1.0.0)
    • Limitation: Call expressions are not connected to target symbols in this adapter version.
    • Limitation: Only JavaScript and TypeScript files parsed by @babel/parser are represented.
    • Limitation: Static import resolution does not resolve runtime dependency injection or dynamic imports.
  • codedecay-python-lezer via @lezer/python (available, adapter 1.0.0)
    • Limitation: Dynamic imports, dependency injection, decorators without literal routes, and framework route registries are not resolved.
    • Limitation: Python impact evidence uses the @lezer/python grammar and conservative module-to-file resolution.
    • Limitation: Static test imports do not prove execution or assertion quality.
  • Graph limitation: A static test import does not prove the symbol executed or that assertions cover its behavior.

Symbol Impact Evidence

Graph artifact: .codedecay/local/symbol-impact-graph.json (939 file(s), 5652 edge(s))

  • packages/config/src/defaults/config.ts#DEFAULT_CODEDECAY_CONFIG -> packages/config/src/defaults.ts, packages/config/src/index.ts, packages/config/src/load.ts, packages/config/src/normalize/commands.ts, packages/config/src/normalize/llm.ts, packages/config/src/normalize/memory-providers.ts, packages/config/src/normalize/plugins.ts, packages/config/src/normalize/product.ts, packages/config/src/normalize/safety.ts
  • packages/config/src/index.ts#CodeDecayAgentBundleFormat -> packages/tool-adapters/src/agent-process/bundle.ts, packages/tool-adapters/src/agent-process/constants.ts, packages/tool-adapters/src/agent-process/evidence.ts, packages/tool-adapters/src/agent-process/types.ts, packages/tool-adapters/src/agent-process/validation.ts, packages/tool-adapters/src/types.ts
  • packages/config/src/index.ts#CodeDecayAgentProcessToolAdapter -> packages/tool-adapters/src/agent-process/configured.ts, packages/tool-adapters/src/types.ts
  • packages/config/src/index.ts#CodeDecayAgentProfile -> packages/tool-adapters/src/agent-process/bundle.ts, packages/tool-adapters/src/agent-process/constants.ts, packages/tool-adapters/src/agent-process/evidence.ts, packages/tool-adapters/src/agent-process/validation.ts, packages/tool-adapters/src/types.ts
  • packages/config/src/index.ts#CodeDecayCommandToolAdapter -> packages/tool-adapters/src/pact/configured.ts, packages/tool-adapters/src/playwright/configured.ts, packages/tool-adapters/src/types.ts
  • packages/config/src/index.ts#CodeDecayConfig -> packages/adapters/src/configured-commands.ts, packages/adapters/src/types.ts, packages/adapters/test/adapters.test.ts, packages/cli/src/commands/differential/api-contracts.ts, packages/cli/src/commands/loop.ts, packages/config/test/fixtures/full-config.ts, packages/redteam/src/checks.ts, packages/redteam/src/experiments.ts, packages/redteam/src/types.ts, packages/redteam/test/helpers/redteam.ts, packages/tool-adapters/src/index.ts, packages/tool-adapters/src/types.ts, packages/tool-adapters/test/helpers.ts
    • Likely tests: packages/adapters/test/adapters.test.ts, packages/config/test/fixtures/full-config.ts, packages/redteam/test/helpers/redteam.ts, packages/tool-adapters/test/helpers.ts
  • packages/config/src/index.ts#CodeDecayCoverageFailOn -> packages/tool-adapters/src/types.ts
  • packages/config/src/index.ts#CodeDecayCoverageToolAdapter -> packages/tool-adapters/src/types.ts
  • packages/config/src/index.ts#CodeDecayExternalMemoryProviderConfig -> packages/cli/src/memory/configured-providers.ts
  • packages/config/src/index.ts#CodeDecayLlmConfig -> packages/cli/src/commands/redteam-investigation.ts, packages/llm/src/providers/factory.ts
  • packages/config/src/index.ts#CodeDecayMemoryProvidersConfig -> packages/cli/src/memory/configured-providers.ts
  • packages/config/src/index.ts#CodeDecayProductApiEndpoint -> packages/cli/src/product/generated-tests/api.ts
  • ...and 87 more symbol impact(s)

Language And Parser Coverage

  • Source files classified: 19
  • Fully supported parser files: 19
  • Limited files: 0
  • Unsupported files: 0

Merge Risk Breakdown

  • Score: 39/100
  • Raw score before dampeners: 95/100
  • Adjusted score before severity cap: 79/100
  • Highest contributing severity: Low
  • Evidence mode: heuristic-only

Top contributors:

  • +9 Change size (structural): Changed lines amplify review cost across 20 file(s).
  • +6 File spread (structural): Change breadth spans 20 file(s).
  • +4 Docs area changed (heuristic): docs/security/threat-model.md touches a docs area and should be reviewed for regression impact.
  • +4 Source area changed (heuristic): packages/config/src/defaults/config.ts touches a source area and should be reviewed for regression impact.
  • +4 Source area changed (heuristic): packages/config/src/index.ts touches a source area and should be reviewed for regression impact.

Dampeners:

  • -16 Heuristic-only dampener: Merge risk stays conservative until direct evidence exists.

Notes:

  • Heuristic-only merge risk is capped at 54/100 until direct evidence exists.
  • Untrusted memory context is visible but contributes 0 score until trusted evidence corroborates it.

Decay Risk Breakdown

  • Score: 54/100
  • Raw score before dampeners: 100/100
  • Adjusted score before severity cap: 84/100
  • Highest contributing severity: High
  • Evidence mode: heuristic-only

Top contributors:

  • +18 High complexity in changed function (heuristic): authorizeCapability has estimated cyclomatic complexity 27.
  • +10 Broad unrelated change set (heuristic): This PR changes 19 files across 1 top-level areas and 2 risk categories.
  • +10 Duplicated added logic (heuristic): A similar block of added logic appears 2 times across 2 file(s).
  • +10 Duplicated added logic (heuristic): A similar block of added logic appears 3 times across 1 file(s).
  • +10 Duplicated added logic (heuristic): A similar block of added logic appears 2 times across 2 file(s).

Dampeners:

  • -16 Heuristic-only dampener: Decay stays conservative until direct evidence exists.

Notes:

  • Heuristic-only decay is capped at 54/100 until direct evidence exists.

Security Risk Breakdown

  • Score: 0/100
  • Raw score before dampeners: 0/100
  • Adjusted score before severity cap: 0/100

Security Matcher Coverage

  • Changed source files scanned: 15
  • Security candidates found: 0
  • Skipped files: 0

Test Evidence

  • Mode: heuristic-only
  • Sources: none
  • Changed source coverage:
  • packages/config/src/defaults/config.ts: not measured (no measurable changed lines)
  • packages/config/src/index.ts: not measured (no measurable changed lines)
  • packages/config/src/normalize/capability-policy.ts: not measured (no measurable changed lines)
  • packages/config/src/types.ts: not measured (no measurable changed lines)
  • packages/config/src/types/capability-policy.ts: not measured (no measurable changed lines)
  • packages/execution/src/capability/approvals.ts: not measured (no measurable changed lines)
  • packages/execution/src/capability/authorize.ts: not measured (no measurable changed lines)
  • packages/execution/src/capability/evidence.ts: not measured (no measurable changed lines)
  • Notes:
  • No runtime coverage artifact was found. Test audit remains heuristic-only.

Changed Path Test Proof

Status Count
Runtime-proven 0
Static-only 38
Weakened by mocks 0
Unproven 61
  • Unproven packages/config/src/defaults/config.ts#DEFAULT_CODEDECAY_CONFIG (missing-proof, heuristic)
    • Evidence: No runtime coverage or static test reference was found for this changed path.
    • Repair task: Add an integration test that reaches packages/config/src/defaults/config.ts#DEFAULT_CODEDECAY_CONFIG without mocking the changed boundary.
  • Unproven packages/config/src/index.ts#CodeDecayAgentBundleFormat (missing-proof, heuristic)
    • Evidence: No runtime coverage or static test reference was found for this changed path.
    • Repair task: Add an integration test that reaches packages/config/src/index.ts#CodeDecayAgentBundleFormat without mocking the changed boundary.
  • Unproven packages/config/src/index.ts#CodeDecayAgentProcessToolAdapter (missing-proof, heuristic)
    • Evidence: No runtime coverage or static test reference was found for this changed path.
    • Repair task: Add an integration test that reaches packages/config/src/index.ts#CodeDecayAgentProcessToolAdapter without mocking the changed boundary.
  • Unproven packages/config/src/index.ts#CodeDecayAgentProfile (missing-proof, heuristic)
    • Evidence: No runtime coverage or static test reference was found for this changed path.
    • Repair task: Add an integration test that reaches packages/config/src/index.ts#CodeDecayAgentProfile without mocking the changed boundary.
  • Unproven packages/config/src/index.ts#CodeDecayCommandToolAdapter (missing-proof, heuristic)
    • Evidence: No runtime coverage or static test reference was found for this changed path.
    • Repair task: Add an integration test that reaches packages/config/src/index.ts#CodeDecayCommandToolAdapter without mocking the changed boundary.
  • Static-only packages/config/src/index.ts#CodeDecayConfig (static-reference, deterministic)
    • Evidence: Referenced by packages/adapters/test/adapters.test.ts, packages/config/test/fixtures/full-config.ts, packages/redteam/test/helpers/redteam.ts, packages/tool-adapters/test/helpers.ts, but no runtime coverage artifact proves changed lines executed.
    • Static references: packages/adapters/test/adapters.test.ts, packages/config/test/fixtures/full-config.ts, packages/redteam/test/helpers/redteam.ts, packages/tool-adapters/test/helpers.ts
    • Repair task: Strengthen packages/adapters/test/adapters.test.ts so it executes packages/config/src/index.ts#CodeDecayConfig with assertions; static import alone is not proof.
  • Unproven packages/config/src/index.ts#CodeDecayCoverageFailOn (missing-proof, heuristic)
    • Evidence: No runtime coverage or static test reference was found for this changed path.
    • Repair task: Add an integration test that reaches packages/config/src/index.ts#CodeDecayCoverageFailOn without mocking the changed boundary.
  • Unproven packages/config/src/index.ts#CodeDecayCoverageToolAdapter (missing-proof, heuristic)
    • Evidence: No runtime coverage or static test reference was found for this changed path.
    • Repair task: Add an integration test that reaches packages/config/src/index.ts#CodeDecayCoverageToolAdapter without mocking the changed boundary.
  • ...and 91 more changed path proof entries

Untrusted Memory Context

  • Project invariant may be impacted (packages/config/src/defaults/config.ts:17): Untrusted memory context: invariant "No hidden cloud or model call" applies to this change. The OSS CLI must remain useful without telemetry, API keys, hosted services, required LLM calls, or CodeDecayCloud.
  • Project invariant may be impacted (packages/config/src/defaults/config.ts:17): Untrusted memory context: invariant "Commands are explicit" applies to this change. CodeDecay must not run project commands unless they are configured and safety.allowCommands is true.
  • Project invariant may be impacted (docs/security/threat-model.md:92): Untrusted memory context: invariant "Tool evidence is separate from AI suggestions" applies to this change. Reports must not present agent/model suggestions as verified evidence unless backed by deterministic checks or command output.
  • Project invariant may be impacted (docs/security/threat-model.md:92): Untrusted memory context: invariant "Output must be actionable" applies to this change. Redteam reports and agent bundles should say what behavior to verify, which test proof is weak or missing, and what task a coding agent should perform.
  • Architecture note applies (packages/execution/src/capability/approvals.ts:1): Untrusted architecture context: Local-first redteam workflow: codedecay redteam is deterministic and report-only by default. Command execution and LLM/provider use require explicit user configuration.
  • Architecture note applies (packages/mcp/src/execution/safety.ts:13): Untrusted architecture context: Agent-owned workflow: CodeDecay should produce evidence and task bundles that a user's own Codex, Claude Code, Cursor, OpenCode, Pi, desktop app, or MCP client can use.

High Risk Findings

  • High complexity in changed function (packages/execution/src/capability/authorize.ts:31): authorizeCapability has estimated cyclomatic complexity 27.

Medium Risk Findings

  • Broad unrelated change set: This PR changes 19 files across 1 top-level areas and 2 risk categories.
  • Duplicated added logic (packages/execution/src/capability/index.ts:9): A similar block of added logic appears 2 times across 2 file(s).
  • Duplicated added logic (packages/execution/src/capability/sandbox.ts:68): A similar block of added logic appears 3 times across 1 file(s).
  • Duplicated added logic (packages/execution/src/capability/types.ts:69): A similar block of added logic appears 2 times across 2 file(s).
  • Duplicated added logic (packages/execution/src/capability/types.ts:70): A similar block of added logic appears 2 times across 2 file(s).
  • High complexity in changed function (packages/execution/src/capability/approvals.ts:72): validateCapabilityApproval has estimated cyclomatic complexity 16.
  • High complexity in changed function (packages/execution/src/command.ts:13): runConfiguredCommand has estimated cyclomatic complexity 18.
  • Large changed function (packages/execution/src/command.ts:13): runConfiguredCommand spans 179 lines, which increases review and regression risk.

Low Risk Findings

  • Docs area changed (docs/security/threat-model.md:92): docs/security/threat-model.md touches a docs area and should be reviewed for regression impact.
  • Source area changed (packages/config/src/defaults/config.ts:17): packages/config/src/defaults/config.ts touches a source area and should be reviewed for regression impact.
  • Source area changed (packages/config/src/index.ts:15): packages/config/src/index.ts touches a source area and should be reviewed for regression impact.
  • Source area changed (packages/config/src/normalize/capability-policy.ts:1): packages/config/src/normalize/capability-policy.ts touches a source area and should be reviewed for regression impact.
  • Source area changed (packages/config/src/types.ts:25): packages/config/src/types.ts touches a source area and should be reviewed for regression impact.
  • Source area changed (packages/config/src/types/capability-policy.ts:33): packages/config/src/types/capability-policy.ts touches a source area and should be reviewed for regression impact.
  • Source area changed (packages/execution/src/capability/approvals.ts:1): packages/execution/src/capability/approvals.ts touches a source area and should be reviewed for regression impact.
  • Source area changed (packages/execution/src/capability/authorize.ts:1): packages/execution/src/capability/authorize.ts touches a source area and should be reviewed for regression impact.
  • Source area changed (packages/execution/src/capability/evidence.ts:1): packages/execution/src/capability/evidence.ts touches a source area and should be reviewed for regression impact.
  • Source area changed (packages/execution/src/capability/index.ts:2): packages/execution/src/capability/index.ts touches a source area and should be reviewed for regression impact.
  • Source area changed (packages/execution/src/capability/sandbox.ts:1): packages/execution/src/capability/sandbox.ts touches a source area and should be reviewed for regression impact.
  • Source area changed (packages/execution/src/capability/types.ts:38): packages/execution/src/capability/types.ts touches a source area and should be reviewed for regression impact.
  • Source area changed (packages/execution/src/command.ts:77): packages/execution/src/command.ts touches a source area and should be reviewed for regression impact.
  • Source area changed (packages/execution/src/index.ts:9): packages/execution/src/index.ts touches a source area and should be reviewed for regression impact.
  • Source area changed (packages/execution/src/types.ts:26): packages/execution/src/types.ts touches a source area and should be reviewed for regression impact.
  • Source area changed (packages/mcp/src/execution/safety.ts:13): packages/mcp/src/execution/safety.ts touches a source area and should be reviewed for regression impact.
  • Test area changed (packages/config/test/capability-policy.test.ts:11): packages/config/test/capability-policy.test.ts touches a test area and should be reviewed for regression impact.
  • Test area changed (packages/config/test/config-defaults-loading.test.ts:26): packages/config/test/config-defaults-loading.test.ts touches a test area and should be reviewed for regression impact.
  • Test area changed (packages/config/test/fixtures/full-config.ts:115): packages/config/test/fixtures/full-config.ts touches a test area and should be reviewed for regression impact.
  • Test area changed (packages/execution/test/capability-uat.test.ts:1): packages/execution/test/capability-uat.test.ts touches a test area and should be reviewed for regression impact.

Recommended Checks

  • Add an integration test that reaches packages/config/src/defaults/config.ts#DEFAULT_CODEDECAY_CONFIG without mocking the changed boundary.
  • Add an integration test that reaches packages/config/src/index.ts#CodeDecayAgentBundleFormat without mocking the changed boundary.
  • Add an integration test that reaches packages/config/src/index.ts#CodeDecayAgentProcessToolAdapter without mocking the changed boundary.
  • Add an integration test that reaches packages/config/src/index.ts#CodeDecayAgentProfile without mocking the changed boundary.
  • Add an integration test that reaches packages/config/src/index.ts#CodeDecayCommandToolAdapter without mocking the changed boundary.
  • Add an integration test that reaches packages/config/src/index.ts#CodeDecayCoverageFailOn without mocking the changed boundary.
  • Add an integration test that reaches packages/config/src/index.ts#CodeDecayCoverageToolAdapter without mocking the changed boundary.
  • Add an integration test that reaches packages/config/src/index.ts#CodeDecayExternalMemoryProviderConfig without mocking the changed boundary.
  • Add an integration test that reaches packages/config/src/index.ts#CodeDecayLlmConfig without mocking the changed boundary.
  • Add an integration test that reaches packages/config/src/index.ts#CodeDecayMemoryProvidersConfig without mocking the changed boundary.
  • Add an integration test that reaches packages/config/src/index.ts#CodeDecayProductApiEndpoint without mocking the changed boundary.
  • Add an integration test that reaches packages/config/src/index.ts#CodeDecayProductTarget without mocking the changed boundary.

Notes

CodeDecay is deterministic and local-first. This report was generated without telemetry, API keys, LLMs, or model calls.

Found by CodeDecay - deterministic, local-first, no telemetry.

@kunaldhongade
kunaldhongade merged commit de6100f into main Aug 6, 2026
10 checks passed
@kunaldhongade
kunaldhongade deleted the feature/690-capability-policy-close branch August 6, 2026 14:04
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

area: config CodeDecay project configuration area: docs README, community files, or documentation area: execution Safe command and behavior probe execution area: mcp Model Context Protocol integration documentation Improvements or additions to documentation type: test Test coverage, fixtures, or verification improvements

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

security(agent-runtime): enforce a capability policy across untrusted agent workflows

1 participant

@kunaldhongade