Add platform-aware Bash and PowerShell execution context - #1733
Open
Aaronontheweb wants to merge 2 commits into
Open
Add platform-aware Bash and PowerShell execution context#1733Aaronontheweb wants to merge 2 commits into
Aaronontheweb wants to merge 2 commits into
Conversation
There was a problem hiding this comment.
Pull request overview
This pull request adds one canonical shell execution environment and uses it across execution, parsing, policy, and context.
It switches Windows shell execution from cmd.exe to PowerShell 7 (pwsh) and removes shell fallback behavior.
It hardens shell security so policy, approvals, and safe-verb logic evaluate every executable pipeline clause.
Changes:
- Add
ShellExecutionEnvironmentand route shell execution and parsing through it on each platform. - Update hard-deny, approval matching, trust-zone checks, and safe-verb auto-pass to inspect full pipelines and static path targets.
- Add execution-environment grounding to
[working-context], and update docs, skills, and evals to match.
Reviewed changes
Copilot reviewed 65 out of 65 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| TOOLING.md | Document the canonical shell per platform and the pwsh prerequisite. |
| src/Netclaw.Security/ShellTokenizer.cs | Split pipeline clauses for legacy segment scanning. |
| src/Netclaw.Security/ShellExecutionEnvironment.cs | Add canonical platform shell environment and parser selection. |
| src/Netclaw.Security/ShellCommandPolicy.cs | Evaluate hard-deny rules against canonical parsed clauses. |
| src/Netclaw.Security/ShellApprovalSemantics.cs | Improve wrapper inner-command extraction for -c / -Command. |
| src/Netclaw.Security/SecurityServiceExtensions.cs | Register canonical environment and matching parser in DI. |
| src/Netclaw.Security/IToolApprovalMatcher.cs | Rework ShellApprovalMatcher to use the canonical environment and parser. |
| src/Netclaw.Security.Tests/ShellSyntaxTreeIntegrationTests.cs | Assert parser type by OS and add PowerShell grammar tests. |
| src/Netclaw.Security.Tests/ShellCommandPolicyTests.cs | Add pipeline-tail and PowerShell native deny coverage. |
| src/Netclaw.Security.Tests/ShellCommandPolicyOverrideTests.cs | Update overrides tests for environment-aware policy construction. |
| src/Netclaw.Security.Tests/ShellApprovalMatcherTests.cs | Reconcile Bash and PowerShell matcher behavior and pipeline candidates. |
| src/Netclaw.Security.Tests/ShellApprovalMatcherMultilineTests.cs | Make multiline approval-unit tests apply across grammars. |
| src/Netclaw.Daemon/Program.cs | Wire ShellExecutionEnvironment and parser into daemon DI and policy creation. |
| src/Netclaw.Daemon.Tests/Mcp/ToolIndexUpdaterTests.cs | Update tool-policy construction for required shell policy dependency. |
| src/Netclaw.Configuration/SafeVerbs/safe-verbs.windows.json | Expand Windows safe verbs for read-only PowerShell pipeline cmdlets. |
| src/Netclaw.Configuration/Resources/AGENTS.md | Add guidance to follow execution_environment for shell command grammar. |
| src/Netclaw.Configuration.Tests/SafeVerbLoaderTests.cs | Validate Windows safe-verb list and explicit exclusions. |
| src/Netclaw.Configuration.Tests/FileSystemPromptProviderAudienceTests.cs | Assert shell environment guidance presence by audience. |
| src/Netclaw.Cli.Tests/Tui/ChatPageTests.cs | Update test wiring for required ShellCommandPolicy dependency. |
| src/Netclaw.Actors/Tools/ToolAccessPolicy.cs | Enforce pipeline-wide candidates and safe-verb auto-pass scoping. |
| src/Netclaw.Actors/Tools/ShellTool.cs | Execute commands via canonical Bash or PowerShell environment and fail loudly if missing. |
| src/Netclaw.Actors/Tools/ScopedShellSafeVerbPolicy.cs | Add IsWithinSafeSpace helper for per-path safe-space enforcement. |
| src/Netclaw.Actors/Tools/DispatchingToolExecutor.cs | Update default policy creation for required shell policy dependency. |
| src/Netclaw.Actors/SubAgents/SubAgentActor.cs | Update default policy creation for required shell policy dependency. |
| src/Netclaw.Actors/Sessions/WorkingContextSnapshot.cs | Add execution environment snapshot and audience-aware rendering. |
| src/Netclaw.Actors/Jobs/BackgroundJobManagerActor.cs | Pass canonical shell environment into job execution actors. |
| src/Netclaw.Actors/Jobs/BackgroundJobExecutionActor.cs | Use canonical shell for jobs and fail loudly when missing. |
| src/Netclaw.Actors.Tests/Tools/ToolRegistryTests.cs | Update first-party tool wiring for required shell policy dependency. |
| src/Netclaw.Actors.Tests/Tools/ToolArgumentValidatorTests.cs | Update tool registry and policy wiring for required shell policy dependency. |
| src/Netclaw.Actors.Tests/Tools/ToolApprovalGateTests.cs | Add pipeline-tail and safe-verb safe-space regressions. |
| src/Netclaw.Actors.Tests/Tools/SkillToolTests.cs | Update policy wiring and working-context snapshot provider dependencies. |
| src/Netclaw.Actors.Tests/Tools/ShellToolTests.cs | Add PowerShell execution tests and missing-shell failure tests. |
| src/Netclaw.Actors.Tests/Tools/ShellToolStreamingTests.cs | Update streaming tests for PowerShell and cross-platform stability. |
| src/Netclaw.Actors.Tests/Tools/SetWorkingDirectoryAudienceTests.cs | Update policy wiring for required shell policy dependency. |
| src/Netclaw.Actors.Tests/Tools/SearchToolsToolTests.cs | Update policy wiring for required shell policy dependency. |
| src/Netclaw.Actors.Tests/Tools/ScopedShellSafeVerbPolicyTests.cs | Add coverage for IsWithinSafeSpace. |
| src/Netclaw.Actors.Tests/Tools/SchedulingToolAudienceTests.cs | Update policy wiring for required shell policy dependency. |
| src/Netclaw.Actors.Tests/Tools/MetaFieldResolutionTests.cs | Update tool registry wiring for required shell policy dependency. |
| src/Netclaw.Actors.Tests/Tools/MessyCommandOneTimeApprovalTests.cs | Update DI wiring for required shell policy dependency. |
| src/Netclaw.Actors.Tests/Tools/McpToolAudienceGrantsTests.cs | Update policy wiring for required shell policy dependency. |
| src/Netclaw.Actors.Tests/Tools/DispatchingToolExecutorTests.cs | Update registry and policy wiring for required shell policy dependency. |
| src/Netclaw.Actors.Tests/SubAgents/SubAgentSpawnObservabilityTests.cs | Update working-context snapshot provider dependencies. |
| src/Netclaw.Actors.Tests/SubAgents/SubAgentSpawnerTests.cs | Propagate execution-environment snapshot into child runs. |
| src/Netclaw.Actors.Tests/SubAgents/SubAgentActorTests.cs | Update policy wiring for required shell policy dependency. |
| src/Netclaw.Actors.Tests/SubAgents/SpawnAgentStreamingTests.cs | Update policy wiring and snapshot provider dependencies. |
| src/Netclaw.Actors.Tests/Sessions/WorkingContextSnapshotTests.cs | Add execution environment rendering and resilience coverage. |
| src/Netclaw.Actors.Tests/Sessions/SubAgentSpawnIntegrationTests.cs | Assert child-run grounding includes execution_environment. |
| src/Netclaw.Actors.Tests/Sessions/LlmSessionTestExtensions.cs | Register execution environment services for session tests. |
| src/Netclaw.Actors.Tests/Sessions/CompactionIntegrationTests.cs | Assert environment survives compaction and prefix caching. |
| src/Netclaw.Actors.Tests/Jobs/BackgroundJobManagerActorTests.cs | Update job manager actor construction for canonical shell environment. |
| src/Netclaw.Actors.Tests/Jobs/BackgroundJobIntegrationTests.cs | Assert OS-appropriate create-directory hint. |
| src/Netclaw.Actors.Tests/Jobs/BackgroundJobExecutionActorTests.cs | Add missing-shell failure coverage for background jobs. |
| openspec/changes/canonical-bash-powershell-execution/tasks.md | Track implementation tasks for the change. |
| openspec/changes/canonical-bash-powershell-execution/specs/netclaw-tools/spec.md | Specify canonical shell execution and hard-deny ordering requirements. |
| openspec/changes/canonical-bash-powershell-execution/specs/netclaw-session/spec.md | Specify execution environment in working context and cache stability. |
| openspec/changes/canonical-bash-powershell-execution/specs/netclaw-agent-memory/spec.md | Specify shell grounding guidance in prompt assembly requirements. |
| openspec/changes/canonical-bash-powershell-execution/specs/canonical-shell-execution/spec.md | Define canonical shell environment and pipeline-wide structural policy. |
| openspec/changes/canonical-bash-powershell-execution/proposal.md | Document rationale, scope, and breaking change for Windows shell. |
| openspec/changes/canonical-bash-powershell-execution/design.md | Document design decisions and risks for canonical shell behavior. |
| openspec/changes/canonical-bash-powershell-execution/.openspec.yaml | Add OpenSpec change metadata. |
| feeds/skills/.system/files/netclaw-operations/SKILL.md | Update operations skill with execution-environment shell guidance. |
| evals/run-evals.sh | Add eval assertion that enforces declared shell grammar grounding. |
| evals/README.md | Update eval suite category counts for the new grounding case. |
| docs/spec/SPEC-011-daemon-architecture.md | Document canonical shell selection and no-fallback behavior. |
| Directory.Packages.props | Upgrade ShellSyntaxTree to 0.2.0-alpha. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 65 out of 65 changed files in this pull request and generated 1 comment.
Suppressed comments (2)
src/Netclaw.Security/IToolApprovalMatcher.cs:258
- ResolveClauseDirectory uses LooksLikePath on arg.Raw, but arg.Raw can keep surrounding quotes. On Windows this makes quoted drive paths (for example
'C:\work\logs') fail path detection, so directory-scoped approvals can lose their intended scope.
src/Netclaw.Security/IToolApprovalMatcher.cs:280 - Redirect path detection in ResolveClauseDirectory does not strip surrounding quotes before LooksLikePath/NormalizePathToken. This can miss quoted redirect targets and prevent correct directory scoping for side-effect verbs that write via redirects.
This was referenced Aug 3, 2026
- Add platform-aware Bash and PowerShell execution context - Auto-pass read-only PowerShell pipeline cmdlets on Windows - Drop Write-Output, Get-Command, Get-Help from Windows safe verbs - Let the shell parser decide 'messy', not a hand-rolled scan - Scope safe-verb auto-pass to the whole operation, not just cwd - Reconcile Bash-assuming shell tests for the PowerShell host
Aaronontheweb
force-pushed
the
feat/canonical-bash-powershell-execution-rebased
branch
from
August 4, 2026 14:10
76e7e1b to
8bed771
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Rebased on upstream/dev with all six original commits in one signed commit.
Supersedes #1698.
Builds on #1753.
That pull request owns the shared Bash syntax-tree changes.
It closes #1693 and #1751.
Issues resolved
Closes #964
Closes #965
Closes #899