[Aeyorl]

{
  "schema": "spark-compete-pr-v1",
  "event": "spark-compete",
  "submission_mode": "pr_review",
  "submission_target_url": "https://github.com/vibeforge1111/spark-cli/pull/1104",
  "team": {
    "name": "ARC DEBUG TEAM",
    "members": ["Aeyod7", "Shady-web", "AlgofootPrint"],
    "author": "Aeyod7"
  },
  "target_repo": "vibeforge1111/spark-cli",
  "issue": {
    "title": "Package runner commands bypass approval classification",
    "type": "security_approval_bypass",
    "severity": "high"
  },
  "evidence": {
    "actual_behavior": "npx, npm exec, pnpm dlx, and yarn dlx commands were classified as action=none, risk=none, requires_approval=false before this patch.",
    "expected_behavior": "Remote package runners should require approval because they can download and execute package code.",
    "tests": [
      "PYTHONPATH=src python3 -m pytest tests/test_cli.py -q -k 'package_runner or remote_script_execution or approval_enforcement_covers_publish_deploy_and_privileged_actions'",
      "PYTHONPATH=src python3 -m pytest tests/test_cli.py -q",
      "PYTHONPATH=src python3 -m compileall -q src tests",
      "git diff --check"
    ]
  },
  "proposed_fix": "Classify npx, npm exec, pnpm dlx, and yarn dlx as critical remote_code_execution actions and add regression coverage.",
  "pr": {
    "url": "https://github.com/vibeforge1111/spark-cli/pull/1104",
    "branch": "Aeyod7:hunt/package-runner-approval"
  },
  "review_claim": {
    "status": "ready_for_review",
    "duplicate_check": "Searched open PRs for npx, npm exec, pnpm dlx, yarn dlx, remote package execution, and package runner; no matching generic package-runner approval fix found. Nearby PRs #153, #490, and #779 cover different paths."
  }
}

actual_behavior

The approval classifier treated remote JavaScript package runners as harmless. Before the fix, these commands returned action_class=none, risk=none, and requires_approval=false:

• npx --yes cowsay@latest hello
• npm exec --yes cowsay@latest -- hello
• pnpm dlx cowsay@latest hello
• yarn dlx cowsay@latest hello

These commands can download package code and execute it without going through the existing remote-code approval gate.

expected_behavior

Package-runner commands that can fetch and execute code should require approval, matching the intent of the existing remote-code execution classifier for forms like curl ... | bash.

repro_steps

On origin/master, run:

PYTHONPATH=src python3 - <<'PY'
from spark_cli.security.approval import CommandContext, approval_required_for_command
for command in (
    ['npx','--yes','cowsay@latest','hello'],
    ['npm','exec','--yes','cowsay@latest','--','hello'],
    ['pnpm','dlx','cowsay@latest','hello'],
    ['yarn','dlx','cowsay@latest','hello'],
):
    d = approval_required_for_command(command, CommandContext(hosted=True, non_interactive=True))
    print(' '.join(command), d.action_class, d.risk, d.requires_approval, d.approval_mode)
PY

before_after_proof

Before:

npx --yes cowsay@latest hello => action=none risk=none requires=False mode=none
npm exec --yes cowsay@latest -- hello => action=none risk=none requires=False mode=none
pnpm dlx cowsay@latest hello => action=none risk=none requires=False mode=none
yarn dlx cowsay@latest hello => action=none risk=none requires=False mode=none

After this patch, the new regression test asserts each command requires approval as remote_code_execution, critical, and blocked in non-interactive hosted mode.

tests_or_smoke

PYTHONPATH=src python3 -m pytest tests/test_cli.py -q -k 'package_runner or remote_script_execution or approval_enforcement_covers_publish_deploy_and_privileged_actions'
3 passed, 662 deselected, 10 subtests passed in 0.66s

PYTHONPATH=src python3 -m pytest tests/test_cli.py -q
664 passed, 1 skipped, 164 subtests passed in 15.69s

PYTHONPATH=src python3 -m compileall -q src tests
passed

git diff --check
passed

duplicate_notes

Open PR search checked:

• npx: nearby PRs [spark-compete] Flag Prisma migration deploys in approval #153 and [spark-compete] fix(security): gate shell -c and PowerShell inline code #490, but they cover Prisma migration and shell/PowerShell inline-code gating, not generic package runners.
• npm exec: nearby PR [spark-compete] fix(security): restrict npm in module install commands to install/ci only #779 restricts install-command runtime policy, not this approval classifier gap.
• pnpm dlx: no open PRs found.
• yarn dlx: no open PRs found.
• remote package execution: no open PRs found.
• package runner: no open PRs found.

risk_notes

The change is intentionally narrow: it only adds approval gating for common package-runner execution entrypoints and adds regression coverage. It does not alter package install, publish, or general npm/pnpm/yarn behavior outside these runner forms.

review_claim

Ready for maintainer review. The patch is minimal, has focused and broader verification, and avoids duplicate lanes identified in the open PR preflight.