.NET: Harden LocalCodeAct OS validation

[Eduard van Valkenburg (eavanvalkenburg)]

Motivation & Context

LocalCodeAct validation did not consistently apply its OS access policy across aliases, nested attributes, and derived values. This change makes the existing allow-list behavior consistent before generated code reaches execution.

Description & Review Guide

• What are the major changes? Track OS-derived provenance across imports and value propagation, allow only lexical path transformations and read-only environment access, and add regression coverage that verifies rejected code never starts the runner.
• What is the impact of these changes? Unknown OS-derived chains, reflective access, environment mutation, and process or network capability paths are rejected. The LocalCodeAct unit suite passes on .NET 10, and the validator compatibility matrix passes on Python 3.10 through 3.13.
• What do you want reviewers to focus on? The explicit safe-chain policy and conservative provenance handling.

Related Issue

N/A — no high-confidence overlapping open issue identified.

Contribution Checklist

• The code builds clean without any errors or warnings
• All unit tests pass, and I have added new tests where possible
• The PR follows the Contribution Guidelines
• This PR is linked to an issue and there is no other open PR for this issue (see Related Issue above).
• This is not a breaking change. If it is a breaking change, add the breaking change label (or add "[BREAKING]" to the title prefix, before or after any language prefix) — a workflow keeps the label and the title prefix in sync automatically.

[Copilot]

🟡 Changes recommended

Two validation bypasses permit environment mutation and loss of OS provenance through shadowed builtin names.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Hardens LocalCodeAct’s Python validator by tracking OS-derived values and enforcing explicit read-only policies before execution.

Changes:

• Adds OS provenance tracking across imports, aliases, containers, and assignments.
• Restricts OS path/environment operations and blocks reflective capability access.
• Adds regression tests confirming rejected code never starts the runner.

File summaries

File	Description
dotnet/src/Microsoft.Agents.AI.LocalCodeAct/Resources/validator.py	Implements OS provenance and access policies.
dotnet/tests/Microsoft.Agents.AI.LocalCodeAct.UnitTests/LocalExecuteCodeFunctionIntegrationTests.cs	Expands allowed/rejected access coverage.
dotnet/src/Microsoft.Agents.AI.LocalCodeAct/README.md	Documents the hardened policy.

Review details

• Files reviewed: 3/3 changed files
• Comments generated: 2
• Review effort level: Balanced

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.