fix(core): prevent indirect prompt injection via build file modifications and untrusted flags - #29250

Code Review

This pull request introduces build file protection and untrusted context tracking to prevent unauthorized build modifications and command execution with untrusted flags. The reviewer provided critical feedback highlighting several security and architectural vulnerabilities: naive whitespace splitting and command parsing in findUntrustedFlags and isBuildOrTestCommand can be bypassed with quotes or prefixed environment variables; the policy engine's build file protection can be bypassed via MCP filesystem tools; and tracking modified build files using a module-level global Set violates repository rules against global state, risking race conditions in concurrent environments. The reviewer recommended using shell-quote and getCommandRoots for robust command parsing, expanding tool name matching to cover MCP tools, adopting a session-scoped WeakMap for tracking modified files, and suppressing persistent approval options in the UI when modified build files are detected.

_{Note: Security Review did not run due to the size of the PR.}

Code Review

This pull request introduces robust build file protection and untrusted command flag detection to enhance execution security. It adds utilities to identify build files and track untrusted context, ensuring that modifications to build configuration files or execution of commands with untrusted flags always require explicit user confirmation (downgrading to ASK_USER or DENY in non-interactive mode) and suppress persistent approvals. Additionally, it updates the CLI UI to display critical security warnings and prevent truncation of build file diffs. A high-severity issue was identified in packages/core/src/tools/shell.ts where getModifiedBuildFiles() is called without passing the session key (this.context.config), which would cause it to default to the global session key and fail to retrieve modified build files recorded with the active configuration.

_{Note: Security Review did not run due to the size of the PR.}

Code Review

This pull request introduces robust build file protection and untrusted command flag detection mechanisms to prevent malicious code execution. It adds utilities to identify build files and track untrusted context, updates the policy engine to require user confirmation for build file modifications, and enhances the CLI confirmation UI with critical security warnings. The review identified two critical issues: first, getModifiedBuildFiles in the shell tool is called without the session key, causing it to return an empty array and bypass the build file caution warning; second, applyShellHeuristics in the policy engine is missing the shellDirPath argument, which bypasses workspace boundary checks.

_{Note: Security Review did not run due to the size of the PR.}

Code Review

This pull request introduces robust security features, including Build File Protection and Untrusted Command Flags Detection, to prevent unauthorized modifications to build configurations and execution of untrusted commands. It adds utilities to identify build files and track untrusted context, updates the policy engine to require user confirmation for build file edits, and enhances the CLI to display critical security warnings and suppress persistent approvals. Feedback on the changes highlights a critical bug in shell.ts where getModifiedBuildFiles() is called without the session key, bypassing the caution warning, and a missing dependency (availableTerminalHeight) in a useCallback hook within ToolConfirmationMessage.tsx.

_{Note: Security Review did not run due to the size of the PR.}

Code Review

This pull request introduces a robust Build File Protection mechanism and untrusted command flag detection to enhance CLI security. It ensures that modifications to build configuration files (such as Bazel BUILD, package.json, and Makefiles) always require explicit user confirmation, even in automated or YOLO modes. It also tracks build files modified during a session to warn users before executing subsequent build commands, and detects untrusted command flags sourced from external contexts. The review feedback identifies a critical security vulnerability where redirection targets (e.g., shell output redirection) are ignored during token extraction, which could allow arbitrary file writes to bypass detection. Additionally, it is recommended to replace the module-level global regular expression with String.prototype.matchAll() to prevent state leakage and potential race conditions.

_{Note: Security Review did not run due to the size of the PR.}

Code Review

This pull request introduces Build File Protection and Untrusted Command Flags Detection to prevent unauthorized build configuration modifications and execution of untrusted command arguments. It adds utilities to identify build files, track untrusted conversation context, and warn users during tool execution. The review feedback highlights critical security bypasses on Windows platforms (due to path normalization issues and backslash escaping in shell parsing) and recommends avoiding module-level global state in the tracker to prevent cross-session data leakage in concurrent environments.

Code Review

This pull request implements a 'Build File Protection' feature to enhance security. It introduces a utility to identify build configuration files (e.g., BUILD, package.json, Dockerfile) and updates the PolicyEngine to require explicit user confirmation (ASK_USER) when these files are modified. Additionally, it adds tracking for modified build files and untrusted command flags during a session, surfacing these as critical security warnings in the UI. The DiffRenderer and colorizeCode components were updated to support disabling truncation for these sensitive diffs, and extensive tests were added to verify the new security policies and warning mechanisms. I have no feedback to provide as there were no review comments.

_{Note: Security Review did not run due to the size of the PR.}

Code Review

This pull request introduces robust security protections for build file modifications and untrusted command flags. It adds policy checks to downgrade build file modifications to user confirmation, tracks modified build files and untrusted flags across the session, and updates the CLI to display critical security warnings and suppress persistent approvals when these risks are detected. Additionally, it disables truncation in the diff renderer for build files to ensure complete visibility. A critical security issue was identified in ShellToolInvocation.getConfirmationDetails where early returns for additional permissions (sandbox expansion) can bypass the newly introduced security checks for untrusted flags and modified build files.

_{Note: Security Review did not run due to the size of the PR.}

Code Review

This pull request introduces a robust "Build File Protection" mechanism and untrusted command flag detection to enhance security. It ensures that modifications to build configuration files (such as Bazel BUILD, package.json, Makefile, etc.) or execution of shell commands containing untrusted flags require explicit user confirmation and suppress persistent approvals. Additionally, build file diffs are displayed without truncation in the UI. Feedback on the changes points out a potential security bypass on POSIX platforms due to a mismatch in backslash normalization between shell commands and untrusted texts, and suggests normalizing backslashes to forward slashes before performing substring checks.

_{Note: Security Review did not run due to the size of the PR.}

Code Review

This pull request introduces robust security features to protect against unauthorized build file modifications and untrusted command flag execution. It adds utilities to identify build configuration files, updates the PolicyEngine to downgrade modifications of these files to require explicit user confirmation, and tracks modified build files to warn users before executing subsequent build or test commands. Additionally, it detects and warns against executing shell commands containing flags sourced from untrusted conversation history. Feedback on these changes suggests enhancing the untrusted token indexing by splitting on slashes to capture individual path segments and filenames, and improving security warning clarity by capturing both the flag and its untrusted argument when a match is detected.

Code Review

This pull request implements security enhancements by introducing Build File Protection and Untrusted Flag Detection. It adds utilities to identify build files and track modifications during a session, updates the PolicyEngine to require user confirmation for build file edits and commands using untrusted flags, and improves the UI to display relevant security warnings. Additionally, it introduces a disableTruncation feature for build file diffs to ensure full visibility of changes. I have no feedback to provide.