[Eduard van Valkenburg (eavanvalkenburg)]

Motivation & Context

Apply LocalCodeAct's existing OS and process-capability policy consistently across helper functions, loop iterations, aliases, and imports.

Description & Review Guide

• What are the major changes? Collect OS provenance before checking its uses. Use a deduplicated name-dependency worklist instead of repeated full scans. Normalize unsupported chains into one forbidden state and retain a finite-state propagation bound. Extend the capability policy with _make_subprocess_transport, _UnixSubprocessTransport, _WindowsSubprocessTransport, Popen, and _winapi. Add regression coverage and document conservative name tracking.

• What is the impact of these changes? Unsupported OS-derived uses are rejected regardless of their position in helper or loop bodies. Lexical path helpers, read-only environment access, and policy overrides remain supported. Negative regressions verify rejection before a marker-only runner starts. Large reverse-ordered alias chains have deterministic linear producer-visit coverage without executing generated source. This does not change the requirement for external isolation.

  Validation from dotnet/, using .NET SDK 10.0.401 and CPython 3.12.7:

  dotnet build src/Microsoft.Agents.AI.LocalCodeAct -f net10.0 --no-restore --tl:off
  # Passed: 0 warnings, 0 errors.
  dotnet test --project tests/Microsoft.Agents.AI.LocalCodeAct.UnitTests -f net10.0 --no-restore --filter-query '/*/Microsoft.Agents.AI.LocalCodeAct.UnitTests/LocalExecuteCodeFunctionIntegrationTests/*'
  # Passed: 232 tests, 0 skipped.
  dotnet test --project tests/Microsoft.Agents.AI.LocalCodeAct.UnitTests -f net10.0 --no-build
  # Passed: 264 tests, 0 skipped.
  dotnet format tests/Microsoft.Agents.AI.LocalCodeAct.UnitTests --no-restore --verify-no-changes --include tests/Microsoft.Agents.AI.LocalCodeAct.UnitTests/LocalExecuteCodeFunctionIntegrationTests.cs --verbosity quiet
  # Passed.

  The same filtered regressions also passed with CPython 3.10.15, 3.11.10, and 3.13.1 (232 tests per interpreter, 0 skipped):

  for version in 3.10 3.11 3.13; do
      export LOCAL_CODEACT_PYTHON="$(uv python find --no-python-downloads "$version")"
      dotnet test --project tests/Microsoft.Agents.AI.LocalCodeAct.UnitTests -f net10.0 --no-build --filter-query '/*/Microsoft.Agents.AI.LocalCodeAct.UnitTests/LocalExecuteCodeFunctionIntegrationTests/*'
  done
  # Passed for all three interpreters.

• What do you want reviewers to focus on? Finite-state convergence and dependency scheduling, conservative propagation across assignments and scopes, safe path/environment compatibility, and capability rejection across member access and from-imports.

Related Issue

N/A

AI Assistance

• No material AI assistance was used.
• This is an AI-assisted contribution. I reviewed, understood, and verified all submitted content and accept responsibility for it.

AI assistance details: GitHub Copilot assisted with implementation, regression tests, documentation, and this PR description.

Contribution Checklist

• The code builds clean without any errors or warnings
• All unit tests pass, and I have added new tests where possible
• The PR follows the Contribution Guidelines
• This PR links to an agreed issue with no competing open PR, or the Related Issue section documents a trivial-change or repository-automation exception.
• This is not a breaking change. If it is a breaking change, add the breaking change label (or add "[BREAKING]" to the title prefix, before or after any language prefix) — a workflow keeps the label and the title prefix in sync automatically.

[Copilot]

🟢 Approval recommended

No active review issues block approval of the Python validation hardening changes.

No open issues 🎉

What changed in this PR

This PR hardens LocalCodeAct’s Python validation within the .NET package by applying OS provenance and process-capability restrictions consistently across helpers, aliases, imports, and loop iterations. External isolation remains required.

Changes:

• Collects OS provenance before checking uses, with a finite-state bound for cyclic aliases.
• Blocks additional private asyncio and Windows process capabilities.
• Adds regression coverage for rejection before execution, convergence, policy overrides, and permitted path/environment access; documents conservative tracking.

File	Description
dotnet/​tests/​Microsoft.Agents.AI.LocalCodeAct.UnitTests/​LocalExecuteCodeFunctionIntegrationTests.cs	Adds capability, provenance, convergence, and compatibility regressions.
dotnet/​src/​Microsoft.Agents.AI.LocalCodeAct/​Resources/​validator.py	Adds bounded provenance collection and expands blocked process capabilities.
dotnet/​src/​Microsoft.Agents.AI.LocalCodeAct/​README.md	Explains provenance tracking, conservative rejection, and capability restrictions.

_{Review effort: Balanced}

[github-actions]

MAF Automated Review — Iteration 1

Result: Findings reported
Scope: full PR (1 commit(s)): 3838f675a49d
Model: gpt-5.6-sol

Overview

The change strengthens LocalCodeAct validation by collecting OS provenance before use checks, normalizing unsupported chains to a finite state, and unconditionally blocking additional process capabilities. State reset, subprocess isolation, validation timeouts, and broad regression coverage provide meaningful guardrails. However, the fixed-point implementation rescans all producers on every propagation sweep, allowing modest model-generated inputs to consume the full validation timeout.

Reviewed the supplied pull-request change set across correctness, security/reliability, architecture, and failure behavior.
1 verified finding remained after source verification (1 medium) across 1 file. Details are attached to the affected lines below.

Affected areas: dotnet/src/Microsoft.Agents.AI.LocalCodeAct/Resources/validator.py

[github-actions]

MAF Automated Review — Iteration 2

Result: No findings
Scope: 1 net-new commit(s): 5498d84b5519
Model: gpt-5.6-sol

Overview

The incremental worklist replaces repeated full sweeps with dependency-indexed rescheduling while preserving finite-chain normalization and bounded propagation. Regression coverage instruments 250- and 2,000-alias reverse chains and constrains producer visits, while validator state remains per invocation and is cleared after collection. No Critical, High, or Medium defect introduced by this incremental change was established.

Reviewed the supplied incremental change set across correctness, security/reliability, architecture, and failure behavior.
No publishable findings remained after source verification for this scope.