Python: validate local shell approval binding

[Eduard van Valkenburg (eavanvalkenburg)]

Motivation & Context

Add end-to-end coverage that verifies a local shell invocation supplied through a labeled variable remains bound to the command reviewed during approval and cannot be replayed across turns or sessions.

Description & Review Guide

• What are the major changes? Added deterministic LocalShellTool regression coverage for exact approved argv, changed variable resolution, substituted approval fields, and replay isolation.
• What is the impact of these changes? Test-only coverage; runtime behavior and public APIs are unchanged. The LocalShellTool suite, focused core approval/security regressions, tools syntax checks, and tools test typing pass.
• What do you want reviewers to focus on? Confirm the scenarios exercise the full function-invocation, approval, variable-expansion, policy, and subprocess boundary without relying on a real shell process.

Related Issue

N/A - no high-confidence overlapping open issue was found.

Contribution Checklist

• The code builds clean without any errors or warnings
• All unit tests pass, and I have added new tests where possible
• The PR follows the Contribution Guidelines
• This PR is linked to an issue and there is no other open PR for this issue (see Related Issue above).
• This is not a breaking change. If it is a breaking change, add the breaking change label (or add "[BREAKING]" to the title prefix, before or after any language prefix) — a workflow keeps the label and the title prefix in sync automatically.

[Copilot]

🟢 Approval recommended

The test-only changes comprehensively validate the stated approval-binding scenarios without runtime or API impact.

Pull request overview

Adds deterministic end-to-end regression coverage for secure LocalShellTool approval binding.

Changes:

• Verifies exact approved argv execution and variable-change rejection.
• Tests substituted approval fields and replay isolation across turns and sessions.

File summaries

File	Description
python/packages/tools/tests/test_local_shell_tool.py	Adds mocked subprocess approval-binding security tests.

Review details

• Files reviewed: 1/1 changed files
• Comments generated: 0
• Review effort level: Balanced

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

MAF Automated Review — Iteration 1

Result: No findings
Scope: full PR (1 commit(s)): 94ff9d9be89a
Model: gpt-5.6-sol-fast

Overview

This test-only PR adds end-to-end LocalShellTool coverage across variable expansion, policy approval, immutable pending-request rebinding, subprocess execution, and replay handling. Existing occurrence identity, resolved-argument signatures, session-scoped state, and consume-on-bind behavior provide concrete guardrails, and the new assertions verify that substituted fields cannot alter executed argv. No PR-introduced Critical, High, or Medium defect was established.

Reviewed the supplied pull-request change set across correctness, security/reliability, architecture, and failure behavior.
No publishable findings remained after source verification for this scope.