Skip to content

refactor(@angular/cli): restrict MCP host process spawning to Angular CLI executable - #33132

Merged
clydin merged 1 commit into
angular:mainfrom
clydin:refactor/mcp-host-ng-restriction
May 8, 2026
Merged

refactor(@angular/cli): restrict MCP host process spawning to Angular CLI executable#33132
clydin merged 1 commit into
angular:mainfrom
clydin:refactor/mcp-host-ng-restriction

Conversation

@clydin

@clydin clydin commented May 5, 2026

Copy link
Copy Markdown
Member

Update the Host abstraction inside the Model Context Protocol (MCP) layer to tighten the system shell surface and improve semantics. The generic spawn and execute methods are replaced with specialized counterparts that default to the Angular CLI, enabling stronger path security containment for developers while also clarifying the distinct control flows needed for buffered discrete commands and long-running background services.

@clydin clydin added the target: minor This PR is targeted for the next minor release label May 5, 2026
@clydin
clydin force-pushed the refactor/mcp-host-ng-restriction branch from 78a278f to 352e6d4 Compare May 5, 2026 17:31
@clydin
clydin marked this pull request as ready for review May 5, 2026 19:50
@clydin clydin added the action: review The PR is still awaiting reviews from at least one requested reviewer label May 5, 2026

@gemini-code-assist gemini-code-assist Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request refactors the Host interface by renaming runCommand to executeNgCommand and spawn to startNgProcess, while removing the redundant command parameter as these methods now specifically target the Angular CLI. These changes are consistently applied across the devserver, build, e2e, and test tools, as well as their mock implementations and unit tests. Feedback identifies that the options parameters in the createRootRestrictedHost implementation are typed too narrowly, which may cause properties like timeout, stdio, or env to be inaccessible or lost when delegating to the base host.

Comment thread packages/angular/cli/src/commands/mcp/host.ts Outdated
Comment thread packages/angular/cli/src/commands/mcp/host.ts Outdated
@clydin
clydin force-pushed the refactor/mcp-host-ng-restriction branch from 352e6d4 to edde1be Compare May 5, 2026 20:10
… CLI executable

Update the Host abstraction inside the Model Context Protocol (MCP) layer to tighten the system shell surface and improve semantics. The generic spawn and execute methods are replaced with specialized counterparts that default to the Angular CLI, enabling stronger path security containment for developers while also clarifying the distinct control flows needed for buffered discrete commands and long-running background services.
@clydin
clydin force-pushed the refactor/mcp-host-ng-restriction branch from edde1be to e1aaddd Compare May 5, 2026 20:29
@clydin
clydin requested a review from alan-agius4 May 8, 2026 12:52
@alan-agius4 alan-agius4 added action: merge The PR is ready for merge by the caretaker and removed action: review The PR is still awaiting reviews from at least one requested reviewer labels May 8, 2026
@clydin
clydin merged commit 240936d into angular:main May 8, 2026
35 checks passed
@clydin

clydin commented May 8, 2026

Copy link
Copy Markdown
Member Author

This PR was merged into the repository. The changes were merged into the following branches:

@clydin
clydin deleted the refactor/mcp-host-ng-restriction branch May 8, 2026 14:06
@angular-automatic-lock-bot

Copy link
Copy Markdown

This pull request has been automatically locked due to inactivity.
Please file a new issue if you are encountering a similar or related problem.

Read more about our automatic conversation locking policy.

This action has been performed automatically by a bot.

@angular-automatic-lock-bot angular-automatic-lock-bot Bot locked and limited conversation to collaborators Jun 8, 2026
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

action: merge The PR is ready for merge by the caretaker area: @angular/cli target: minor This PR is targeted for the next minor release

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants