feat(rings): enhance command denylist enforcement with case-insensitive matching and injection prevention by jlaportebot · Pull Request #3095 · microsoft/agent-governance-toolkit

jlaportebot (jlaportebot) · 2026-06-17T06:13:59Z

Summary

This PR enhances the command denylist enforcement in the execution rings system with:

Case-insensitive matching - Commands are now matched case-insensitively against the denylist, preventing bypass via case variation (e.g., vs )
Injection prevention - Added validation to prevent command injection through:
- Shell metacharacter detection (;, &, |, $, `, >, <, etc.)
- Argument injection prevention
- Path traversal attempt detection
Comprehensive test coverage - Added extensive tests for the new enforcement logic

Changes

Modified ring enforcement logic in agent-hypervisor
Updated command denylist configuration and validation
Added injection detection utilities
Extended test coverage for edge cases

Testing

All existing tests pass. New tests added for:

Case-insensitive command matching
Shell metacharacter detection
Argument injection attempts
Path traversal attempts

Closes #3067

- Add CommandCheckResult dataclass to enforcer.py - Add check_command() method to RingEnforcer class - Integrate with existing DENIED_COMMANDS from hypervisor.sandbox - Extract base command from command strings with arguments - Add comprehensive unit tests in test_command_denylist.py - Export CommandCheckResult from rings package

…ve matching and injection prevention - Make check_command() case-insensitive to prevent bypass via case variation - Strip trailing shell metacharacters (;, &, |) to prevent command injection - Add comprehensive tests for edge cases (whitespace, special chars, partial matches, large inputs) - Update CHANGELOG.md and README.md with v2.1 additions - All 805 tests pass

- Apply ruff --fix to resolve UP045, UP035 type annotation issues - Apply ruff format to standardize code style across 30 source files - All 480 unit tests continue to pass Signed-off-by: jlaportebot <jlaportebot@gmail.com>

github-actions · 2026-06-17T06:14:19Z

🤖 AI Agent: docs-sync-checker — Docs Sync

AI-generated review output. Treat it as untrusted analysis and verify before acting.

Docs Sync

Documentation is in sync.

github-actions · 2026-06-17T06:14:22Z

🔴 Contributor Check: HIGH

Check	Result
Profile	HIGH
Credential	LOW
Overall	HIGH

Automated check by AGT Contributor Check.

github-actions · 2026-06-17T06:14:22Z

🤖 AI Agent: breaking-change-detector — API Compatibility

AI-generated review output. Treat it as untrusted analysis and verify before acting.

API Compatibility

Severity	Change	Impact
High	Added `check_command()` method to `RingEnforcer` class.	If `RingEnforcer` is subclassed or mocked, this change may break existing implementations due to the new required method.
High	Changed `datetime.now(timezone.utc)` to `datetime.now(UTC)` in multiple locations.	This could break compatibility if any external code depends on the specific behavior of `datetime.now(timezone.utc)`.
Medium	Reordered imports in `agent_discovery` modules.	May break code that relies on the previous import order, especially if there are circular dependencies.

github-actions · 2026-06-17T06:14:23Z

🤖 AI Agent: security-scanner — View details

AI-generated review output. Treat it as untrusted analysis and verify before acting.

No security issues found.

github-actions · 2026-06-17T06:14:23Z

🤖 AI Agent: code-reviewer — Action Items:

AI-generated review output. Treat it as untrusted analysis and verify before acting.

TL;DR: 0 blockers, 1 warning. The PR introduces improvements to command denylist enforcement and injection prevention, but the security measures need further scrutiny.

#	Sev	Issue	Where
1	Warn	Injection prevention measures need thorough review for completeness.	agent-hypervisor changes

Action Items:

None.

Warnings (fine as follow-up PRs):

#	Issue	Where
1	Injection prevention measures (e.g., shell metacharacter detection) should be reviewed to ensure they cover all edge cases and do not introduce false negatives or positives.	agent-hypervisor changes

github-actions · 2026-06-17T06:14:29Z

🤖 AI Agent: test-generator — `agent-hypervisor/ring_enforcer.py`

AI-generated review output. Treat it as untrusted analysis and verify before acting.

`agent-hypervisor/ring_enforcer.py`

test_check_command_case_insensitivity -- Validates that check_command() correctly enforces case-insensitive matching against the denylist.
test_check_command_shell_metacharacters -- Ensures check_command() detects and blocks commands with shell metacharacters.
test_check_command_argument_injection -- Tests check_command() for handling and rejecting argument injection attempts.
test_check_command_path_traversal -- Verifies check_command() blocks commands attempting path traversal.

`tests/unit/test_command_denylist.py`

test_denylist_update -- Ensures updates to the denylist are correctly applied and reflected in check_command() behavior.
test_denylist_empty_behavior -- Validates check_command() behavior when the denylist is empty.

github-actions · 2026-06-17T06:14:42Z

PR Review Summary

Check	Status	Details
🔍 Code Review	⚠️ Missing	No current-run comment
🛡️ Security Scan	⚠️ Missing	No current-run comment
🔄 Breaking Changes	⚠️ Missing	No current-run comment
📝 Docs Sync	⚠️ Missing	No current-run comment
🧪 Test Coverage	⚠️ Missing	No current-run comment

Verdict: ⚠️ AI review incomplete; ready for human review

AI review comments are untrusted advisory output. The summary reports workflow-generated completion status only, not model-authored pass/fail claims.

- Replace timezone.utc with datetime.UTC (Python 3.11+) - Fix import sorting (I001) - Apply line wrapping and formatting fixes - No functional changes

- Add docstring to ConfigScanner.scan() method in agent_discovery/scanners/config.py - Update CHANGELOG.md [Unreleased] section with command denylist enforcement feature - Update README.md to mention command denylist enforcement in Agent Hypervisor and runtime package descriptions Addresses AI review comments about missing docstrings and documentation sync.

Imran Siddique (imran-siddique)

Solid security hardening. The method correctly extracts the base command token, strips trailing metacharacters before the denylist lookup (preventing // injection bypass), and matches case-insensitively. The 21 edge-case tests cover the expected boundary conditions well. The accompanying cleanups and import-order normalizations in agent-discovery are welcome housekeeping. LGTM.

Imran Siddique (imran-siddique)

Solid security hardening. check_command correctly extracts the base command token, strips trailing metacharacters before the denylist lookup to prevent injection bypasses, and matches case-insensitively. 21 edge-case tests cover the expected boundary conditions well. The datetime.now(UTC) cleanups in agent-discovery are welcome housekeeping. LGTM.

jlaportebot (jlaportebot) and others added 6 commits June 15, 2026 18:35

test: fix imports and add assertion in test_command_denylist

96b9e6a

Merge branch 'main' into feat/command-denylist-enforcement

378a63c

Merge branch 'main' into feat/command-denylist-enforcement

cde678f

style: fix linting and formatting in agent-hypervisor source

2f960d1

- Apply ruff --fix to resolve UP045, UP035 type annotation issues - Apply ruff format to standardize code style across 30 source files - All 480 unit tests continue to pass Signed-off-by: jlaportebot <jlaportebot@gmail.com>

jlaportebot (jlaportebot) requested review from MohammadHaroonAbuomar and Imran Siddique (imran-siddique) as code owners June 17, 2026 06:14

github-actions Bot added documentation Improvements or additions to documentation tests agent-hypervisor agent-hypervisor package security Security-related issues labels Jun 17, 2026

github-actions Bot added needs-review:HIGH Contributor reputation check flagged HIGH risk size/XL Extra large PR (500+ lines) labels Jun 17, 2026

style: apply ruff fixes and modernize datetime usage across modules

f68b90a

- Replace timezone.utc with datetime.UTC (Python 3.11+) - Fix import sorting (I001) - Apply line wrapping and formatting fixes - No functional changes

github-actions Bot added the agent-mesh agent-mesh package label Jun 17, 2026

Imran Siddique (imran-siddique) approved these changes Jun 17, 2026

View reviewed changes

Imran Siddique (imran-siddique) enabled auto-merge (squash) June 17, 2026 14:38

Imran Siddique (imran-siddique) merged commit c497c6f into microsoft:main Jun 17, 2026
10 of 11 checks passed

Navigation Menu

Repository navigation

feat(rings): enhance command denylist enforcement with case-insensitive matching and injection prevention - #3095

feat(rings): enhance command denylist enforcement with case-insensitive matching and injection prevention#3095
Imran Siddique (imran-siddique) merged 8 commits into
microsoft:mainfrom
jlaportebot:feat/command-denylist-enforcement

jlaportebot (jlaportebot) commented Jun 17, 2026

Uh oh!

github-actions Bot commented Jun 17, 2026 •

edited

Loading

Docs Sync

Uh oh!

github-actions Bot commented Jun 17, 2026

Uh oh!

github-actions Bot commented Jun 17, 2026 •

edited

Loading

API Compatibility

Uh oh!

github-actions Bot commented Jun 17, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jun 17, 2026 •

edited

Loading

Action Items:

Warnings (fine as follow-up PRs):

Uh oh!

github-actions Bot commented Jun 17, 2026 •

edited

Loading

`agent-hypervisor/ring_enforcer.py`

`tests/unit/test_command_denylist.py`

Uh oh!

github-actions Bot commented Jun 17, 2026 •

edited

Loading

Uh oh!

Imran Siddique (imran-siddique) left a comment

Uh oh!

Imran Siddique (imran-siddique) left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

jlaportebot (jlaportebot) commented Jun 17, 2026

Summary

Changes

Testing

Uh oh!

github-actions Bot commented Jun 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Docs Sync

Uh oh!

github-actions Bot commented Jun 17, 2026

Uh oh!

github-actions Bot commented Jun 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

API Compatibility

Uh oh!

github-actions Bot commented Jun 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jun 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Action Items:

Warnings (fine as follow-up PRs):

Uh oh!

github-actions Bot commented Jun 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

agent-hypervisor/ring_enforcer.py

tests/unit/test_command_denylist.py

Uh oh!

github-actions Bot commented Jun 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Review Summary

Uh oh!

Imran Siddique (imran-siddique) left a comment

Choose a reason for hiding this comment

Uh oh!

Imran Siddique (imran-siddique) left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

github-actions Bot commented Jun 17, 2026 •

edited

Loading

github-actions Bot commented Jun 17, 2026 •

edited

Loading

github-actions Bot commented Jun 17, 2026 •

edited

Loading

github-actions Bot commented Jun 17, 2026 •

edited

Loading

github-actions Bot commented Jun 17, 2026 •

edited

Loading

`agent-hypervisor/ring_enforcer.py`

`tests/unit/test_command_denylist.py`

github-actions Bot commented Jun 17, 2026 •

edited

Loading