runtime: harden external process invocation

[Gregory Joseph (gnjoseph)]

Summary

• centralize external CLI launches behind a shell-free process abstraction
• validate Azure subscription and resource-group identifiers before process, app, or container-type side effects
• preserve Windows CLI shim resolution, timeout, error, and detached-process behavior
• release as @microsoft/spe-mcp@0.2.0-alpha.3

Validation

• local npm run ci passed with 915 tests and 7 skips
• sanitized local happy/failure proof is embedded below

Proof

Sanitized local proof generated from completed Vitest runs. All identifiers and process inputs shown are inert; no tenant data, credentials, or live environment evidence is included.

Shell-free happy path

Arguments remain discrete and both launch APIs force shell: false.

Invalid Azure identifier rejection

A malformed inert Azure identifier is rejected before the Azure CLI process seam.

Synchronous spawn error normalization

Pre-launch synchronous throws are normalized to the RunCommandError contract with message, stack, optional code, and initialized stdout/stderr.

[Copilot]

Pull request overview

This PR promotes the external process-invocation hardening work into main by centralizing az/azd/dev-server launches behind a shell-free process abstraction and tightening validation for Azure identifiers before they become CLI arguments.

Changes:

• Introduces src/proc-exec.ts (runCommand / spawnProcess) to ensure shell-free child process execution (including Windows .cmd/.bat shim resolution via cross-spawn).
• Adds strict Azure subscription ID + resource-group validation helpers (predicate/require/assert) and applies subscription validation in azure_resource_groups_list.
• Updates multiple tools/helpers and tests to use the new process seam; bumps package version to 0.2.0-alpha.2 and records the change in the changelog.

Reviewed changes

Copilot reviewed 16 out of 17 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
src/validation.ts	Adds allowlist-based Azure subscription/resource-group validation helpers (predicate/require/assert).
src/validation.test.ts	Adds regression coverage for the new Azure identifier validation helpers.
src/tools/run-local.ts	Switches dev-server spawning to the shared shell-free launcher.
src/tools/run-local.test.ts	Updates mocks/assertions to target proc-exec rather than node:child_process.
src/tools/list-azure.ts	Centralizes subscriptionId validation via requireAzureSubscriptionId before calling CLI helpers.
src/tools/list-azure.test.ts	Adds tests proving invalid/missing subscription IDs are rejected before invoking the CLI helper.
src/tools/deploy-azure.ts	Replaces direct execFile usage with runCommand for azd/az invocations.
src/tools/deploy-azure.test.ts	Updates mocks to the new launcher seam and adds argv-discreteness regression coverage.
src/proc-exec.ts	New shell-free process abstraction built on cross-spawn.
src/proc-exec.test.ts	Adds contract tests for shell-free behavior, argv discreteness, error shaping, and timeouts.
src/bootstrap.ts	Routes Azure CLI bootstrap calls through runCommand (shell-free).
src/bootstrap.test.ts	Updates mocking strategy to proc-exec and asserts shell-free invocation contract.
src/azure-cli.ts	Routes Azure CLI helper calls through runCommand and asserts identifier validity at the process seam.
src/azure-cli.proc.test.ts	Adds process-boundary contract tests (reject-before-spawn + discrete argv).
package.json	Bumps version to 0.2.0-alpha.2 and adds cross-spawn + typings.
package-lock.json	Updates lockfile for the version bump and new direct dependency.
CHANGELOG.md	Documents the process hardening and validation changes for 0.2.0-alpha.2.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 18 out of 19 changed files in this pull request and generated no new comments.