Restrict PowerShell discovery to scoped filesystem grants by MGudgin · Pull Request #1590 · microsoft/mxc

Gudge (MGudgin) · 2026-10-27T15:21:22Z

This PR prevents Rust and Node V1 tool discovery from implicitly granting
recursive read access to the system-drive root when PowerShell is present.
It preserves tool-directory and PSReadLine history access, keeps
ProcessContainer errors actionable, and documents the security-servicing
exception within V1.

Details

Preserve real Win32 launch errors and nonzero workload results instead of
recommending drive-root access.
Keep discovery fixtures under their crate or test directories so host
temporary storage beneath the Windows directory does not filter them out.
Require tool-read/private-sibling-denial validation and an explicit
discovered-path assertion in scheduled ProcessContainer tests.
Document the specific V1 exception and PowerShell startup guidance in
the versioning policy, SDK READMEs, and API references.

Tests

cargo fmt --all -- --check and
cargo clippy -p mxc-sdk --lib --tests -- -D warnings passed.
cargo test -p mxc-sdk --lib launch_diagnostics passed (26 tests).
The Rust discovery regression also passed (1 test).
Diagnostic and TEMP/WINDIR fixture regressions demonstrated failures
before their fixes and passed afterward.
Node policy tests passed (10 tests); SDK npm run build and
npm run build:test-unit passed.

Copilot-Session: 76847b9f-ffd6-497e-95cb-e6d395704e3a
Copilot-Session: 1ce18a71-9051-4c4d-9d5f-23155754276f
Generated-with: gpt-6.1-sol

Microsoft Reviewers: Open in CodeFlow

azure-pipelines · 2026-10-27T15:21:34Z

Azure Pipelines: There may be pipelines that require an authorized user to comment /azp run to run.

Copilot

🟡 Changes recommended

The change breaks V1 Rust and Node SDK compatibility by removing system-drive root access needed by some PowerShell callers, so the restricted behavior should use new versioned APIs with migration guidance.

1 open issue

Avoid replacing V1 available tools policy behavior · New

What changed in this PR

This PR narrows Windows tool-discovery permissions in the Rust and Node SDKs by removing the implicit drive-root read-only grant when pwsh.exe is found. The .NET SDK is unaffected.

Changes:

Preserve PSReadLine history access without automatically granting drive-root reads.
Update unit tests and add a required ProcessContainer regression test for tool access and sibling-file denial.
Document the restricted permissions and potential PowerShell startup impact.

File	Description
`src/mxc-sdk/src/policy.rs`	Removes the Rust root grant and updates regression coverage.
`src/mxc-sdk/README.md`	Explains discovery permissions and startup limitations.
`sdk/node/tests/unit/policy.test.ts`	Asserts discovery no longer adds drive-root access.
`sdk/node/tests/integration/windows-process-container.test.ts`	Tests tool reads and private sibling-file denial.
`sdk/node/src/v1/policy/filesystem.ts`	Removes the Node root grant while retaining history access.
`sdk/node/README.md`	Documents restricted discovery permissions.
`scripts/ci/run_backend_validation_tests.ps1`	Requires the new filesystem regression test.
`docs/development/build-and-test/ci-validation-infrastructure.md`	Describes the regression scenario and required-test gate.
`docs/api-reference/rust/v1/api.md`	Updates Rust discovery behavior and limitations.
`docs/api-reference/node/v1/api.md`	Updates Node discovery behavior and limitations.

_{Review effort: Balanced}

Copilot

🟡 Changes recommended

The Rust and Node V1 policy helpers remove an existing system-drive root grant, breaking supported callers without a new versioned surface or migration guidance.

3 open issues

_{Review effort: Balanced}

This PR prevents Rust and Node V1 tool discovery from implicitly granting recursive read access to the system-drive root when PowerShell is present. It preserves tool-directory and PSReadLine history access, keeps ProcessContainer errors actionable, and documents the security-servicing exception within V1. Details * Preserve real Win32 launch errors and nonzero workload results instead of recommending drive-root access. * Keep discovery fixtures under their crate or test directories so host temporary storage beneath the Windows directory does not filter them out. * Require tool-read/private-sibling-denial validation and an explicit discovered-path assertion in scheduled ProcessContainer tests. * Document the specific V1 exception and PowerShell startup guidance in the versioning policy, SDK READMEs, and API references. Tests * `cargo fmt --all -- --check` and `cargo clippy -p mxc-sdk --lib --tests -- -D warnings` passed. * `cargo test -p mxc-sdk --lib launch_diagnostics` passed (26 tests). The Rust discovery regression also passed (1 test). * Diagnostic and TEMP/WINDIR fixture regressions demonstrated failures before their fixes and passed afterward. * Node policy tests passed (10 tests); SDK `npm run build` and `npm run build:test-unit` passed. Co-authored-by: Gudge <gudge@microsoft.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 76847b9f-ffd6-497e-95cb-e6d395704e3a Copilot-Session: 1ce18a71-9051-4c4d-9d5f-23155754276f Generated-with: gpt-6.1-sol

Copilot

🔵 Needs a closer look

The security-sensitive containment regressions still need successful execution on a supported Windows ProcessContainer host before human approval.

No open issues 🎉

3 resolved since last review

_{Review effort: Balanced}

Copilot

🔵 Needs a closer look

Human approval should confirm the filesystem-isolation and native-launch regressions pass on a supported Windows ProcessContainer host.

No open issues 🎉

_{Review effort: Balanced}

Jeff Whiteside (jsidewhite) · 2026-10-27T20:21:04Z


+### Security-servicing exception: PowerShell tool discovery
+
+On Windows, the Rust V1


This versioning.md doc isn't about "things in specific versions" i.e. "thing X is in v1 for reason Y".

This doc is about the rules/dynamics of versioning.

Copilot

🔵 Needs a closer look

The security-sensitive containment change needs final human review with Windows ProcessContainer functional results, which are not included in the reported validation.

No open issues 🎉

_{Review effort: Balanced}

Gudge (MGudgin) requested a review from a team as a code owner October 27, 2026 15:21

Copilot AI balanced review requested due to automatic review settings October 27, 2026 15:21

Gudge (MGudgin) force-pushed the user/gudge/fix-tool-discovery-root-read branch from 42e431d to 61f3e7a Compare October 27, 2026 15:21

Copilot started reviewing on behalf of Gudge (MGudgin) October 27, 2026 15:21

View session

Gudge (MGudgin) force-pushed the user/gudge/fix-tool-discovery-root-read branch from 61f3e7a to 491ad6a Compare October 27, 2026 15:22

Copilot AI reviewed Oct 27, 2026

View reviewed changes

Comment thread src/mxc-sdk/src/policy.rs

Copilot AI balanced review requested due to automatic review settings October 27, 2026 15:27

Copilot started reviewing on behalf of Gudge (MGudgin) October 27, 2026 15:27

View session

Copilot AI reviewed Oct 27, 2026

View reviewed changes

Comment thread sdk/node/src/v1/policy/filesystem.ts

Comment thread sdk/node/tests/integration/windows-process-container.test.ts

Branden Bonaby (bbonaby) linked an issue Oct 27, 2026 that may be closed by this pull request

getAvailableToolsPolicy grants read access to the whole system drive on BaseContainer when pwsh is on PATH #1455

Closed

Gudge (MGudgin) force-pushed the user/gudge/fix-tool-discovery-root-read branch from 491ad6a to 64057fb Compare October 27, 2026 18:13

Copilot AI balanced review requested due to automatic review settings October 27, 2026 18:13

Copilot started reviewing on behalf of Gudge (MGudgin) October 27, 2026 18:14

View session

Gudge (MGudgin) changed the title ~~Address root c:\ readOnly grant issue~~ Restrict PowerShell discovery to scoped filesystem grants Oct 27, 2026

Gudge (MGudgin) force-pushed the user/gudge/fix-tool-discovery-root-read branch from 64057fb to 1035128 Compare October 27, 2026 18:15

Copilot AI reviewed Oct 27, 2026

View reviewed changes

Copilot AI balanced review requested due to automatic review settings October 27, 2026 18:16

Copilot started reviewing on behalf of Gudge (MGudgin) October 27, 2026 18:17

View session

Copilot AI reviewed Oct 27, 2026

View reviewed changes

Branden Bonaby (bbonaby) requested changes Oct 27, 2026

View reviewed changes

Comment thread docs/api-reference/node/v1/api.md Outdated

Comment thread sdk/node/src/v1/policy/filesystem.ts

Comment thread sdk/node/README.md Outdated

Comment thread src/mxc-sdk/README.md Outdated

microsoft-github-policy-service Bot assigned Gudge (MGudgin) Oct 27, 2026

microsoft-github-policy-service Bot added the Needs-Author-Feedback Waiting for additional information or action from the issue or pull-request author. label Oct 27, 2026

Jeff Whiteside (jsidewhite) reviewed Oct 27, 2026

View reviewed changes

Address PR feedback

8d29596

Copilot AI balanced review requested due to automatic review settings October 27, 2026 21:27

Copilot started reviewing on behalf of Gudge (MGudgin) October 27, 2026 21:27

View session

Copilot AI reviewed Oct 27, 2026

View reviewed changes

Branden Bonaby (bbonaby) approved these changes Oct 27, 2026

View reviewed changes

microsoft-github-policy-service Bot added Needs-Attention Requires attention or a decision from the MXC maintainers. and removed Needs-Author-Feedback Waiting for additional information or action from the issue or pull-request author. labels Oct 27, 2026

Gudge (MGudgin) merged commit 0c5a1f5 into main Oct 27, 2026
31 checks passed

Gudge (MGudgin) deleted the user/gudge/fix-tool-discovery-root-read branch October 27, 2026 21:58

microsoft-github-policy-service Bot removed the Needs-Attention Requires attention or a decision from the MXC maintainers. label Oct 27, 2026

Navigation Menu

Repository navigation

Restrict PowerShell discovery to scoped filesystem grants - #1590

Restrict PowerShell discovery to scoped filesystem grants#1590
Gudge (MGudgin) merged 2 commits into
mainfrom
user/gudge/fix-tool-discovery-root-read

Gudge (MGudgin) commented Oct 27, 2026 •

edited

Loading

Uh oh!

azure-pipelines Bot commented Oct 27, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Jeff Whiteside (jsidewhite) Oct 27, 2026

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants


		### Security-servicing exception: PowerShell tool discovery

		On Windows, the Rust V1

Conversation

Gudge (MGudgin) commented Oct 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Microsoft Reviewers: Open in CodeFlow

Uh oh!

azure-pipelines Bot commented Oct 27, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🔵 Needs a closer look

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🔵 Needs a closer look

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Jeff Whiteside (jsidewhite) Oct 27, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🔵 Needs a closer look

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Gudge (MGudgin) commented Oct 27, 2026 •

edited

Loading