Restore explicit approval requirements for high-risk CEA tools

MI
3mo ago
+27-0

Motivation

  • A recent change removed the approval gate from high-risk tools that can run shell commands or mutate files, enabling auto-execution and creating a prompt-injection/command-execution vulnerability.

Description

  • Reintroduced needsApproval: true on the CEA tool definitions for shell_execute, shell_interact, write_file, edit_file, and delete_file (files under packages/cea/src/tools/).
  • Added a focused regression test packages/cea/src/tools/tool-approval.test.ts that asserts these tools expose needsApproval === true to prevent accidental removal in the future.
  • No other behavioral changes were made; tool implementations and safety checks remain unchanged.

Testing

  • Ran the targeted test invocation pnpm --filter plugsuits exec vitest run src/tools/tool-approval.test.ts src/tools/execute/shell-execute.test.ts src/tools/execute/shell-interact.test.ts src/tools/modify/write-file.test.ts src/tools/modify/edit-file.test.ts src/tools/modify/delete-file.test.ts and all specified suites passed (6 files, 152 tests passed).
  • Ran type-checking with pnpm --filter plugsuits typecheck which completed successfully.
  • Note: running the package-level pnpm --filter plugsuits test -- src/tools/execute/shell-interact.test.ts in this environment invoked the full src suite and failed due to unrelated workspace import resolution for @ai-sdk-tool/harness, which is not caused by this change.

Codex Task

Summary by cubic

Restores the approval gate for high‑risk CEA tools to prevent auto‑execution of shell and file‑mutation actions. No behavior changes.

  • Bug Fixes
    • Set needsApproval: true on shell_execute, shell_interact, write_file, edit_file, and delete_file.
    • Added tool-approval.test.ts to assert these tools require approval.
    • Added changeset to publish a patch for plugsuits.