fix(cli): critical security fixes for subagent permissions, writeFile boundary, and policy bypass

JO
6mo ago
+56-26

Summary

Addresses three critical/high security findings from the 2026-04-28 AI Tooling Security Audit:

  1. Subagent bypasses permissions (Critical) — Removed the hard-coded policies: [{ tool: "*", permission: "allow" }] override in extensions/cli/src/subagent/executor.ts so subagents now inherit the main agent's tool permission policies instead of unconditionally allowing all tools.

  2. writeFile no boundary (High) — Added throwIfFileIsSecurityConcern checks to both the preprocess and run functions in extensions/cli/src/tools/writeFile.ts, aligning it with the security posture of readFile and edit tools.

  3. Policy bypass (High) — Fixed extensions/cli/src/permissions/permissionChecker.ts so that dynamic tool policy evaluation (e.g., terminal command security analysis) is respected rather than being overridden by static user allow policies. The fix takes the most restrictive of the static policy and the dynamically evaluated policy, and gracefully handles invalid evaluator responses.

Test Results

  • All existing CLI tests pass (1,848 passed, 29 skipped).
  • permissionChecker.test.ts and permissionChecker.integration.test.ts updated and passing.

Summary by cubic

Fixes three critical/high security issues in the CLI: subagents now inherit tool permissions, writeFile enforces path safety checks, and dynamic tool policy evaluation can’t be bypassed.

  • Bug Fixes
    • Subagent permissions: removed the allow-all override so subagents inherit the main agent’s tool policies.
    • writeFile boundary: added throwIfFileIsSecurityConcern in both preprocess and run to match readFile/edit posture.
    • Policy evaluation: permissionChecker now takes the most restrictive result between static policy and dynamic evaluation, and safely handles invalid evaluator outputs.
    • Tests: updated permissionChecker unit/integration tests; all CLI tests pass.