Cherry-pick: feat: enhance sandbox boundary checks to prevent access to internal constructors and ensure plain JSON serialization of tool schemas

[frontegg-david]

• Cherry-pick: chore: update mcp-from-openapi to version 2.5.1 in package.json and yarn.lock (Cherry-pick: chore: update mcp-from-openapi to version 2.5.1 in package.json and yarn.lock #509)

Cherry-picked from #508 (merged to release/1.5.x)
Original commit: 82f5351

Co-authored-by: agentfront[bot] <agentfront[bot]@users.noreply.github.com>
Co-authored-by: frontegg-david 69419539+frontegg-david@users.noreply.github.com

• Cherry-pick: fix: enhance SSRF protection in OpenAPI polling to block internal addresses by default and allow configuration for trusted environments (Cherry-pick: fix: enhance SSRF protection in OpenAPI polling to block internal addresses by default and allow configuration for trusted environments #511)

Cherry-picked from #510 (merged to release/1.5.x)
Original commit: 077201e

Co-authored-by: agentfront[bot] <agentfront[bot]@users.noreply.github.com>
Co-authored-by: frontegg-david 69419539+frontegg-david@users.noreply.github.com

• feat: enhance sandbox boundary checks to prevent access to internal constructors and ensure plain JSON serialization of tool schemas

• feat: enhance tool introspection to return undefined for tools outside the allowedTools whitelist and improve plain JSON schema handling

• feat: update tool description retrieval to handle undefined cases and improve schema handling

• feat: update tool description retrieval to handle undefined cases and improve schema handling

• feat: update tool description retrieval to handle undefined cases and improve schema handling

• feat: update tool description retrieval to handle undefined cases and improve schema handling

---

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: agentfront[bot] <agentfront[bot]@users.noreply.github.com>

Summary by CodeRabbit

• Security Enhancements

  • Strengthened CodeCall sandbox boundaries by exposing tool metadata only as safe, plain JSON Schema data.
  • Blocked introspection and constructor-based escape attempts within sandboxed scripts.
  • Prevented unsafe tool discovery and access beyond configured permissions.
  • Hardened package installation against invalid paths, symlink escapes, and non-regular files.

• Bug Fixes

  • Ensured sandbox inputs and tool results are safely copied and rejected when not representable as plain data.

• Documentation

  • Clarified getTool behavior, including unavailable tools and optional metadata.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: f338b9a2-1eb8-4ca1-9606-46288a64efb1

📥 Commits

Reviewing files that changed from the base of the PR and between a307c49 and 081caa3.

⛔ Files ignored due to path filters (1)

• yarn.lock is excluded by !**/yarn.lock, !**/*.lock

📒 Files selected for processing (19)

• apps/e2e/demo-e2e-codecall/e2e/codecall.e2e.spec.ts
• docs/frontmcp/plugins/codecall/agentscript.mdx
• libs/cli/src/commands/package/__tests__/install.spec.ts
• libs/cli/src/commands/package/install.ts
• libs/sdk/package.json
• libs/sdk/src/job/enclave/__tests__/job-enclave.bridge.spec.ts
• libs/sdk/src/job/enclave/job-enclave.bridge.ts
• libs/utils/package.json
• package.json
• plugins/plugin-codecall/package.json
• plugins/plugin-codecall/src/README.md
• plugins/plugin-codecall/src/__tests__/execute.tool.spec.ts
• plugins/plugin-codecall/src/__tests__/mcp-result.spec.ts
• plugins/plugin-codecall/src/__tests__/plain-json.spec.ts
• plugins/plugin-codecall/src/codecall.symbol.ts
• plugins/plugin-codecall/src/tools/execute.tool.ts
• plugins/plugin-codecall/src/utils/index.ts
• plugins/plugin-codecall/src/utils/mcp-result.ts
• plugins/plugin-codecall/src/utils/plain-json.ts

---

📝 Walkthrough

Walkthrough

The PR hardens CodeCall and enclave boundaries by plainizing tool metadata and MCP content, cloning sandbox inputs and outputs, blocking sandbox escape paths, validating package installation containment, and synchronizing related package versions.

Changes

CodeCall boundary hardening

Layer / File(s)	Summary
Plain JSON tool metadata and result isolation plugins/plugin-codecall/src/..., docs/frontmcp/plugins/codecall/agentscript.mdx	getTool now returns filtered, plain JSON-schema metadata or undefined; complex MCP content is also plainized, with expanded tests and documentation.
Sandbox value isolation libs/sdk/src/job/enclave/..., apps/e2e/demo-e2e-codecall/e2e/codecall.e2e.spec.ts	Sandbox inputs and tool results are cloned before crossing the boundary, while end-to-end cases cover schema exposure, meta-tool filtering, and constructor escape rejection.
Contained package installation libs/cli/src/commands/package/...	Installation validates manifest names and bundle paths, resolves symlinks safely, copies only contained regular files, and tests discovery, sources, setup, and registry behavior.
Runtime dependency alignment package.json, libs/*/package.json, plugins/plugin-codecall/package.json	Enclave and FrontMCP package versions are updated to the corresponding releases.

Estimated code review effort: 4 (Complex) | ~60 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Script
  participant CodeCall
  participant Enclave
  participant Tool
  Script->>CodeCall: getTool(name)
  CodeCall->>CodeCall: filter and plainize metadata
  CodeCall-->>Script: metadata or undefined
  Script->>Enclave: execute(input)
  Enclave->>Tool: callTool or getTool
  Tool-->>Enclave: tool result
  Enclave-->>Script: cloned result or ToolError

Loading

Possibly related PRs

• agentfront/frontmcp#81: Introduces the CodeCall security and error-handling framework extended by these metadata and sandbox changes.
• agentfront/frontmcp#505: Modifies the same JobEnclaveBridge.execute path used for sandbox input and output preparation.
• agentfront/frontmcp#512: Contains closely related CodeCall sandbox-boundary tests and plain JSON schema handling.

Suggested reviewers: copilot

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch cherry-pick-pr-512

---

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

Pull request overview

This PR hardens sandbox boundary behavior and tool introspection, primarily in the CodeCall plugin and the SDK’s Enclave bridge, while also updating related package versions and strengthening CLI install-time path containment checks.

Changes:

• Updated CodeCall’s getTool introspection and tool-result extraction to return plain JSON projections (or undefined) and to enforce the same self-reference + allowedTools visibility rules as tool execution.
• Tightened the SDK Job Enclave bridge boundary by structured-cloning inputs and tool callback results before they cross into the sandbox.
• Strengthened frontmcp install file-copy handling (plugin name validation + contained, realpath-resolved regular-file checks) and refreshed dependency/package versions (incl. @enclave-vm/*, mcp-from-openapi, and workspace version bumps).

Reviewed changes

Copilot reviewed 19 out of 20 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
yarn.lock	Updates lockfile for dependency/version bumps (workspace + enclave-vm + mcp-from-openapi).
plugins/plugin-codecall/src/utils/plain-json.ts	Adds toPlainJson helper to project values into plain JSON-safe structures.
plugins/plugin-codecall/src/utils/mcp-result.ts	Uses toPlainJson for complex MCP content extraction to avoid leaking prototypes/constructors.
plugins/plugin-codecall/src/utils/index.ts	Re-exports the new plain-JSON helper.
plugins/plugin-codecall/src/tools/execute.tool.ts	Aligns getTool introspection visibility with callTool rules and returns plain JSON schemas.
plugins/plugin-codecall/src/README.md	Documents getTool returning undefined and schema/null behavior.
plugins/plugin-codecall/src/codecall.symbol.ts	Introduces CodeCallToolDescription and clarifies getTool return semantics.
plugins/plugin-codecall/src/tests/plain-json.spec.ts	Adds unit coverage for JSON projection behavior and edge cases (cycles, pinned props).
plugins/plugin-codecall/src/tests/mcp-result.spec.ts	Adds tests ensuring multi-content results are copied/flattened or become undefined if non-representable.
plugins/plugin-codecall/src/tests/execute.tool.spec.ts	Updates/extends tests for getTool schema projection, whitelist behavior, and meta-tool hiding.
plugins/plugin-codecall/package.json	Bumps plugin version and aligns deps/peerDeps to 1.5.6 and enclave-vm ^2.15.1.
package.json	Bumps root dependency on @enclave-vm/core to ^2.15.1.
libs/utils/package.json	Bumps @enclave-vm/ast to ^2.15.1.
libs/sdk/src/job/enclave/job-enclave.bridge.ts	Adds boundary cloning via structuredClone for inputs and tool callback results.
libs/sdk/src/job/enclave/tests/job-enclave.bridge.spec.ts	Adds test coverage for clone semantics, lifecycle, and rejection of non-cloneables.
libs/sdk/package.json	Bumps SDK version and aligns internal deps/peerDeps to 1.5.6 and enclave-vm ^2.15.1.
libs/cli/src/commands/package/install.ts	Validates plugin name and ensures copied files are contained + regular files using realpath/stat.
libs/cli/src/commands/package/tests/install.spec.ts	Adds extensive tests for install source handling and containment/symlink/file-type protections.
docs/frontmcp/plugins/codecall/agentscript.mdx	Updates docs for getTool visibility rules and plain JSON schema/null behavior.
apps/e2e/demo-e2e-codecall/e2e/codecall.e2e.spec.ts	Adds E2E coverage for schema inertness and sandbox boundary escape hardening.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.