Disable dynamic PowerShell execution by default

[jebrans]

Summary

• Disable dynamic PowerShell execution by default.
• Require both powershell.dynamicExecution.enabled: true and powershell.brokerExecution.enabled: true before any generated, imported, edited, seeded, or manually stored script can run.
• Run all dynamic scripts in a Windows AppContainer with no network capability, a sanitized environment, explicit inherited handles, and a kill-on-close Job Object limited to one process.
• Apply ConstrainedLanguage and positive AST/command validation inside the brokered host.
• Preserve reviewed built-in namespace actions on a separate trusted execution path.
• Track script provenance and fail closed for missing or unknown origins.

Security boundary

Dynamic script text no longer reaches the legacy FullLanguage host directly. The TypeScript runner sends a bounded JSON request over stdin to an architecture-specific broker. The broker:

• creates or derives a dedicated AppContainer profile;
• writes the request only into the AppContainer profile;
• launches Windows PowerShell using PROC_THREAD_ATTRIBUTE_SECURITY_CAPABILITIES;
• inherits only stdin/stdout/stderr handles;
• assigns PowerShell to a Job Object with ACTIVE_PROCESS_LIMIT=1, DIE_ON_UNHANDLED_EXCEPTION, and KILL_ON_JOB_CLOSE;
• supplies a minimal environment with no parent-process credentials or API keys;
• terminates the complete job on timeout or broker shutdown;
• cleans the profile before and after execution.

The brokered host rejects type expressions, unsafe type conversions, member invocation, redirection, invocation operators, dynamic commands, using statements, module requirements, and ForEach-Object member-invocation parameter sets. It accepts only a small server-defined command set for data transformation and output.

Capability policy

Dynamic PowerShell currently receives no external filesystem, module, network, executable, service, registry, COM, or child-process capability. Model-authored allowedModules, networkAccess, and path grants are no longer accepted as authority. Requests containing unsupported commands or capabilities fail with a non-retryable policy denial.

This intentionally means custom file/network/process PowerShell flows remain unavailable. Reviewed built-in actions such as listFiles remain available through their separate static registry. Additional dynamic capabilities require future broker-mediated implementations and security review; they must not be added by widening the model-authored policy.

Original incident validation

With both opt-in gates enabled:

• The reported sibling-path [System.IO.File]::ReadAllText case is denied and returns no file contents.
• Static .NET file writes and process creation are denied with no marker side effect.
• ForEach-Object -MemberName and positional member invocation are denied.
• using module and #requires -Modules are denied.
• Network, module, filesystem, and process capability requests are denied.
• Parent-process secrets are absent from the AppContainer environment.
• Timeout and cancellation terminate the sandbox job.
• Missing or failed broker startup has no legacy fallback.

Packaging

• Adds a trimmed self-contained .NET 8 broker for win-x64 and win-arm64.
• Adds platform/architecture-aware agent asset mapping so non-Windows bundles exclude the broker and cross-target bundles select the requested architecture.
• Extends packaged-artifact validation to require the matching broker on Windows.

Validation

• pnpm run build packages/agents/powershell
• pnpm --filter @typeagent/powershell-typeagent test (79 tests)
• pnpm --filter @typeagent/config test (199 tests)
• Broker Debug and Release builds, zero warnings
• Dedicated Windows broker integration lane and fast monorepo Windows unit lane
• Windows x64 bundle includes only the x64 broker; Linux bundle excludes broker assets
• pnpm run prettier:changed:fix
• lint, complexity, circular-dependency, and test-debt PR ratchets

Rollback

Turning either execution gate off disables dynamic PowerShell. There is no fallback from brokered dynamic execution to the legacy host. Reviewed static actions remain available independently.