Add shell approval disposition matrix by Aaronontheweb · Pull Request #1750 · netclaw-dev/netclaw

Aaronontheweb · 2026-08-04T01:28:28Z

Summary

add one xUnit theory with 59 Bash approval cases
use the Personal policy that a new installation stores
use the real approval actor, service, store, policy, and dispatcher seam
use the built-in safe verbs and hard-deny rules
add a review snapshot with outcomes, reasons, candidate verbs, and complex-command status
keep narrow unit tests for explicit Auto, Deny, and missing-policy configuration

Corpus

cover command chains, pipelines, redirects, subshells, wrappers, multiline input, heredocs, and malformed input
cover session and persistent approvals
cover directory and audience scope
cover interactive and non-interactive calls
remove all custom policy and safe-verb data from the matrix

Current parser gaps

The snapshot records current results that PR #1733 should change.

a hard-deny pipeline tail requests approval instead of a deny
echo $(git push) runs through the side-effect exemption
git status & git push runs through the safe-verb grant
bash -lc "git push" uses bash as its approval candidate

These rows make each future result change explicit in the snapshot review.

Shared install policy

ToolAudienceProfileDefaults.CreateProfilesForPosture now owns the installed audience profiles.

The setup wizard, the security editor, and the matrix use this factory.

No OpenSpec or product specification file changed.

Security fixes

require approval for side-effect commands that redirect output
evaluate path operands and redirect targets before a safe-verb grant
evaluate every pipeline clause so an unsafe tail cannot hide behind a safe head
resolve relative redirect targets from the invocation working directory

Validation

2,719 actor tests passed
60 approval matrix tests passed
30 focused CLI tests passed
6 focused configuration tests passed
all 22 native smoke tapes passed
all 9 smoke scenarios passed
dotnet slopwatch analyze
pwsh ./scripts/Add-FileHeaders.ps1 -Verify
git diff --check

Copilot

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

+        foreach (var redirect in clause.Redirects)
+        {
+            var directory = ResolveRedirectDirectory(redirect);
+            if (directory is not null)
+                directories.Add(directory);
+        }


+        var rootDirectory = Path.Combine(
+            Path.GetTempPath(),
+            "netclaw-approval-matrix",
+            Guid.NewGuid().ToString("N"));


+            Path.GetTempPath(),
+            "netclaw-approval-matrix",
+            Guid.NewGuid().ToString("N"));
+        var projectDirectory = Path.Combine(rootDirectory, "project");


+            "netclaw-approval-matrix",
+            Guid.NewGuid().ToString("N"));
+        var projectDirectory = Path.Combine(rootDirectory, "project");
+        var sessionDirectory = Path.Combine(rootDirectory, "session");


+            Guid.NewGuid().ToString("N"));
+        var projectDirectory = Path.Combine(rootDirectory, "project");
+        var sessionDirectory = Path.Combine(rootDirectory, "session");
+        var externalDirectory = Path.Combine(rootDirectory, "external");


+        Directory.CreateDirectory(sessionDirectory);
+        Directory.CreateDirectory(externalDirectory);
+
+        var store = new ToolApprovalStore(Path.Combine(rootDirectory, "tool-approvals.json"));


Copilot

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

+        => isMessy switch
+        {
+            true => "Yes",
+            false => "No",


+        {
+            true => "Yes",
+            false => "No",
+            null => "Not applicable"


Copilot

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

Copilot

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

Aaronontheweb

LGTM

Aaronontheweb · 2026-08-04T02:54:57Z

        if (!OperatingSystem.IsWindows())
        {
-            foreach (var unit in ExtractApprovalUnitsViaBashParser(command))
+            foreach (var unit in ExtractApprovalUnitsViaBashParser(command, workingDirectory))


LGTM - better to pass this in explicitly

Aaronontheweb · 2026-08-04T02:55:56Z

Aaronontheweb · 2026-08-04T02:56:28Z

+    /// Creates the audience profiles that a new installation stores for the selected posture.
+    /// Personal installations require approval for shell commands unless another authorization gate permits the command.
+    /// </summary>
+    public static ToolAudienceProfiles CreateProfilesForPosture(DeploymentPosture posture)


LGTM - shell is denied in other security postures by default.

Aaronontheweb · 2026-08-04T02:57:22Z

    /// </summary>
    public bool ShortCircuitsApproval(string candidateVerb, string? cwd, ToolInvocationContext context)
-        => AllShortCircuit([candidateVerb], cwd, context);
+        => AllShortCircuit([new ApprovalCandidate(candidateVerb, Directory: null)], cwd, context);


It's possible to have verbs without a specific CWD

Aaronontheweb · 2026-08-04T02:58:13Z

LGTM - has good coverage of built in defaults / likely user-defined pairings

Aaronontheweb added 2 commits August 4, 2026 01:03

Fix shell approval scope extraction

c0c587f

Add shell approval disposition matrix

e5dd3f4

Copilot AI review requested due to automatic review settings August 4, 2026 01:28

Copilot AI reviewed Aug 4, 2026

github-code-quality Bot found potential problems Aug 4, 2026

View reviewed changes

Use the Personal install policy in approval tests

a0159db

Copilot AI review requested due to automatic review settings August 4, 2026 02:22

Copilot AI reviewed Aug 4, 2026

github-code-quality Bot found potential problems Aug 4, 2026

View reviewed changes

Comment thread src/Netclaw.Actors.Tests/Tools/ShellApprovalCaseCatalog.cs

=> isMessy switch

{

true => "Yes",

false => "No",

Comment thread src/Netclaw.Actors.Tests/Tools/ShellApprovalCaseCatalog.cs

{

true => "Yes",

false => "No",

null => "Not applicable"

Aaronontheweb added tests All issues related to testing, quality assurance, and smoke testing. security Security-related changes shell Issues related to the shell tool, since it has the largest security perimeter. labels Aug 4, 2026

Use the host temp path in approval snapshots

c7b13f1

Copilot AI review requested due to automatic review settings August 4, 2026 02:32

Copilot AI reviewed Aug 4, 2026

Aaronontheweb mentioned this pull request Aug 4, 2026

Close shell approval gaps exposed by the Bash corpus #1751

Closed

Name observed shell candidate verbs precisely

69e5af2

Copilot AI review requested due to automatic review settings August 4, 2026 02:56

Copilot AI reviewed Aug 4, 2026

Aaronontheweb commented Aug 4, 2026

View reviewed changes

Aaronontheweb enabled auto-merge (squash) August 4, 2026 02:58

Aaronontheweb merged commit c1ce6ba into dev Aug 4, 2026
21 checks passed

Aaronontheweb deleted the test/approval-matrix-contract branch August 4, 2026 03:23

Navigation Menu

Uh oh!

Add shell approval disposition matrix - #1750

Add shell approval disposition matrix#1750
Aaronontheweb merged 5 commits into
devfrom
test/approval-matrix-contract

Aaronontheweb commented Aug 4, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Aaronontheweb left a comment

Uh oh!

Aaronontheweb Aug 4, 2026

Uh oh!

Aaronontheweb Aug 4, 2026

Uh oh!

Aaronontheweb Aug 4, 2026

Uh oh!

Aaronontheweb Aug 4, 2026

Uh oh!

Aaronontheweb Aug 4, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

Aaronontheweb commented Aug 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Corpus

Current parser gaps

Shared install policy

Security fixes

Validation

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Aaronontheweb left a comment

Choose a reason for hiding this comment

Uh oh!

Aaronontheweb Aug 4, 2026

Choose a reason for hiding this comment

Uh oh!

Aaronontheweb Aug 4, 2026

Choose a reason for hiding this comment

Uh oh!

Aaronontheweb Aug 4, 2026

Choose a reason for hiding this comment

Uh oh!

Aaronontheweb Aug 4, 2026

Choose a reason for hiding this comment

Uh oh!

Aaronontheweb Aug 4, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Aaronontheweb commented Aug 4, 2026 •

edited

Loading