fix(backend/copilot): stop refusing sub-agent briefs and to-dos that mention sudo or subprocess

[Pwuts]

Why / What / How

AutoPilot no longer refuses a sub-agent brief or a to-do item because its text mentions sudo, subprocess, rm -rf, os.system or a similar word.

Stacked on #15123.

Why: Such a call was refused with "[SECURITY] Input contains a blocked pattern. This is enforced by the platform and cannot be bypassed." The model then rewords the brief and tries again, which costs a turn and teaches it to talk around a security message. Nothing was protected. Words in a brief execute nothing, and the commands themselves already run unscanned through bash_exec.

What: The copilot's pre-tool-use hook no longer scans tool input for words. Commands still run only through the sandboxed bash_exec. The CLI's own Bash stays blocked. #15123's gate still denies every tool outside the session's allowed set.

How: This deletes DANGEROUS_PATTERNS from sdk/tool_adapter.py, and the loop in _validate_tool_access (sdk/security_hooks.py) that matched each pattern against the JSON of a tool's input. Only three tools ever reached that loop: Task, Agent and TodoWrite, the allowed CLI built-ins, which take prose and run nothing. The rest never got there:

• the hook routes the copilot's own MCP tools, bash_exec, run_capability and the skill tools among them, around _validate_tool_access;
• blocked tools are refused before the loop;
• Read, Glob and Grep return from their path check before it.

The approval gate never read the list. This lands after #15123 because the scan stops being the last check on a built-in only once that gate denies everything outside the allowed set.

What the real hook decided, before and after, with and without E2B:

Call	Before	After
bash_exec: sudo pip install requests && npm install left-pad && python -c 'import subprocess; …'	allowed	allowed
Agent brief: "Check whether deploy.sh calls sudo or subprocess.run"	denied	allowed
TodoWrite item: "Replace the sudo subprocess call"	denied	allowed
ListAgents2, a CLI built-in outside the allowed set	denied	denied

Changes 🏗️

• Delete DANGEROUS_PATTERNS and the hook's scan over it, with the json and re imports only it used.
• Replace test_dangerous_pattern_blocked and test_subprocess_pattern_blocked with test_prose_naming_a_command_is_allowed. The old tests pinned the scan on a made-up SomeTool. The new one drives the real PreToolUse hook with an Agent brief, a Task brief and a TodoWrite item.

Agents and large language models used

• Claude Code with Claude Opus 5.5

Checklist 📋

For code changes:

• I have clearly listed my changes in the PR description
• I have made a test plan
• I have tested my changes according to the test plan:
  • Verified: I ran all of copilot/sdk/ with Claude Code's own CLAUDE* variables stripped: 1,560 passed, 4 xfailed, none skipped, cli_builtin_tools_test.py included (2 passed). I also ran util/architecture_test.py and blocks/test/test_block.py: 3,699 passed, 84 skipped. Putting the scan back fails the new test 3 of 3. Removing fix(backend/copilot): deny every tool outside the session's allowed set, and fail CI on an unclassified CLI built-in #15123's allowed-set check fails test_tool_outside_allowed_set_denied[ListAgents2]. That test already covers an unlisted CLI built-in, so the case gets no new test. The table above comes from calling the real hook on fix(backend/copilot): deny every tool outside the session's allowed set, and fail CI on an unclassified CLI built-in #15123's head and on this one. This PR's base is a feature branch outside a GitHub stack, so backend CI is dispatched by hand: run 38816249199 on 1ca20ac934.

🤖 Generated with Claude Code

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Pwuts]

🤖 Evidence

What the real PreToolUse hook decides. This is create_security_hooks(...)["PreToolUse"] called with get_copilot_tool_names(use_e2b=...), first on #15123's head 8256f305eb (before), then on 7147366a9e (after):

== BEFORE (8256f305eb)
e2b=False mcp__copilot__bash_exec    allow
e2b=False Agent                      deny  [SECURITY] Input contains a blocked pattern. This is enforce
e2b=False Agent                      deny  [SECURITY] Input contains a blocked pattern. This is enforce
e2b=False TodoWrite                  deny  [SECURITY] Input contains a blocked pattern. This is enforce
e2b=False ListAgents2                deny  [SECURITY] Tool 'ListAgents2' is not available in this sessi
e2b=True  mcp__copilot__bash_exec    allow
e2b=True  Agent                      deny  [SECURITY] Input contains a blocked pattern. This is enforce
e2b=True  Agent                      deny  [SECURITY] Input contains a blocked pattern. This is enforce
e2b=True  TodoWrite                  deny  [SECURITY] Input contains a blocked pattern. This is enforce
e2b=True  ListAgents2                deny  [SECURITY] Tool 'ListAgents2' is not available in this sessi
== AFTER (7147366a9e)
e2b=False mcp__copilot__bash_exec    allow
e2b=False Agent                      allow
e2b=False Agent                      allow
e2b=False TodoWrite                  allow
e2b=False ListAgents2                deny  [SECURITY] Tool 'ListAgents2' is not available in this sessi
e2b=True  mcp__copilot__bash_exec    allow
e2b=True  Agent                      allow
e2b=True  Agent                      allow
e2b=True  TodoWrite                  allow
e2b=True  ListAgents2                deny  [SECURITY] Tool 'ListAgents2' is not available in this sessi

The inputs, in that order:

• bash_exec sudo pip install requests && npm install left-pad && python -c 'import subprocess; os.system(1)'
• Agent "Run sudo pip install requests in the sandbox"
• Agent "Check whether deploy.sh calls sudo or subprocess.run"
• TodoWrite "Replace the sudo subprocess call"
• ListAgents2 with no input

Package installs go through bash_exec either way. The hook sends every mcp__copilot__* tool past _validate_tool_access (security_hooks.py:282 and :287 on 8256f305eb), so the scan never saw an install command. It only saw prose that mentioned one.

Mutations.

== M1: put the pattern scan back (8256f305eb's two files)
FAILED security_hooks_test.py::test_prose_naming_a_command_is_allowed[Agent-tool_input0]
FAILED security_hooks_test.py::test_prose_naming_a_command_is_allowed[Task-tool_input1]
FAILED security_hooks_test.py::test_prose_naming_a_command_is_allowed[TodoWrite-tool_input2]
3 failed, 47 deselected
== M2: drop #15123's allowed-set check for CLI built-ins
FAILED security_hooks_test.py::test_tool_outside_allowed_set_denied[ListAgents2]
FAILED security_hooks_test.py::test_tool_outside_allowed_set_denied[mcp__other__tool]
2 failed, 4 passed, 44 deselected

Local suites on 7147366a9e.

• security_hooks_test.py: 50 passed.
• copilot/sdk/: 1,433 passed, 4 xfailed, 0 skipped. Every CLAUDE*, AI_AGENT and MCP_CONNECTION* variable was stripped, and OPEN_ROUTER_API_KEY was emptied.
• cli_builtin_tools_test.py: 2 passed ([False] and [True]), in the same clean environment.
• util/architecture_test.py + blocks/test/test_block.py: 3,669 passed, 84 skipped.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 85.50%. Comparing base (4a99a1b) to head (1ca20ac).

Additional details and impacted files

@@                          Coverage Diff                          @@
##           pwuts/copilot-default-deny-cli-tools   #15562   +/-   ##
=====================================================================
  Coverage                                 85.50%   85.50%           
=====================================================================
  Files                                      4875     4875           
  Lines                                    375597   375590    -7     
  Branches                                  33597    33595    -2     
=====================================================================
+ Hits                                     321139   321155   +16     
+ Misses                                    48784    48769   -15     
+ Partials                                   5674     5666    -8     

Flag	Coverage Δ
platform-backend	90.16% <100.00%> (-0.01%)	⬇️
platform-frontend-e2e	29.80% <ø> (+0.24%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Components	Coverage Δ
Platform Backend	90.17% <100.00%> (-0.01%)	⬇️
Platform Frontend	64.62% <ø> (+0.03%)	⬆️
AutoGPT Libs	∅ <ø> (∅)
Classic AutoGPT	28.43% <ø> (ø)

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Pwuts]

🤖 Resolved: dev (with #15309's Dockerfile fix) is merged into #15123, and #15123 is merged into this branch at 1ca20ac934. Full-stack CI is green on that head, and the hand-dispatched backend run 38816249199 passed.

The red end-to-end tests was inherited from the base: the backend image build failed at pip3 install poetry --break-system-packages ("Cannot uninstall packaging 25.0"), which #15309 fixed on dev.