fix(security): preserve uv global link-mode authority evidence

[seonghobae]

Refs #401. Serialized child of canonical Agent Artifact Admission parent #129@fff3c349891a7a3fb12b1eee507595eba7588576.

Finding and boundary

Wardnet's uv_link_mode_authority recognized explicit --link-mode=symlink only for fixed-position uv pip install. Astral's documented uv [OPTIONS] <COMMAND> grammar allows reviewed top-level options before the active command, so uv --color never pip install ... --link-mode=symlink remained fail-closed as ForbiddenCommand but lost separate causal ArtifactNotApproved evidence for caller-selected symlink materialization from uv's global cache.

This remains Wardnet Agent Artifact Admission/security-evidence scope. It does not execute uv, inspect or mutate cache/filesystem state, authorize egress, widen supported install grammar, or duplicate quarantine-sandbox-runtime, EgressWeave, AppGuardrail, contextual-orchestrator, or other owner logic.

RED → repair

Clean test-only exact 01d0a524da802720135a0be8ba6d62e88022e7ea kept production source byte-identical to #129. Hosted CI 34748109281, rust job 103699647554, reached the focused contract and failed only the hostile global-option case because current source returned [ForbiddenCommand] without ArtifactNotApproved; the near-spelling control stayed GREEN.

Production eb0846b42303779e91a5db4b1bcd7d1528c146d1 reuses policy::uv_active_command_index, requires exact active pip followed by exact install, and inspects only that install argument slice for exact attached/separate symlink link-mode forms. supported_install_command is unchanged and exact submitted argv remains audit identity.

docs/doctoring/uv-symlink-link-mode-authority.md records vendor semantics, ownership boundary, RED evidence, and APA 7 traceability. Fresh primary-source verification on 2026-09-13 confirmed Astral's global-cache/symlink warning and that NIST SP 800-218 SSDF 1.1 remains final while SP 800-218 Rev. 1 / SSDF 1.2 remains draft; citation metadata was corrected forward-only in e0a6df1a6aa3f29f5d5cfb4d1ec6e1fb16e229ab.

Exact-current GREEN

Exact head: e0a6df1a6aa3f29f5d5cfb4d1ec6e1fb16e229ab.

• parent feat(security): gate AI-agent artifact installation #129 remained exact fff3c349891a7a3fb12b1eee507595eba7588576 in the final sweep;
• fresh compare: ahead_by=6, behind_by=0, exact parent is merge base;
• parent-relative delta: three paths only — classifier, hostile contract, focused doctoring;
• CI 34748392701 / rust 103700405731: SUCCESS (format, locked workspace tests, strict Clippy);
• Fuzz 34748392710 / fuzz 103700420398: SUCCESS (bounded targets; no crash upload required);
• CodeRabbit exact-head status: SUCCESS;
• submitted reviews: 0; inline review threads: 0.

Ready for ordinary expected-head integration into #129. No force update, destructive rebase, self/model approval, gate weakening, mutable foreign dependency, source copy, cross-service SQL, no-op dispatch churn, or routine bypass.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 8f1b7943-e2a8-4ff7-a2a0-36735a529b94

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

Devin Review found 1 potential issue.

[devin-ai-integration]

🟡 Option terminators fabricate symlink evidence

With reviewed globals, -- before a symlink-looking operand makes requests_unapproved_uv_symlink_link_mode report an explicit selector. The install slice crosses uv's option terminator, giving blocked requests false ArtifactNotApproved evidence.

Learn more

A -- token ends option parsing. Tokens after it are operands, even when they resemble options. The new active-command lookup now reaches globally prefixed installs, but the resulting install slice still scans every remaining token.

Example: uv --color never pip install cwl-example==1.2.3 -- --link-mode=symlink is blocked for its unsupported --. The final token is an operand, but the classifier also adds ArtifactNotApproved as if uv selected symlink mode.

Recommended fix: Bound install_arguments at the first --, matching the option-phase handling in requests_unsafe_uv_index_strategy and the other uv classifiers.

Suggested change

	let install_arguments = &arguments[command_index + 2..];
	let install_arguments = arguments[command_index + 2..]
	.split(|argument| argument.as_str() == "--")
	.next()
	.unwrap_or(&[]);

---

Was this helpful? React with 👍 or 👎 to provide feedback.