[APPS-2945] Update: drop the in-process local execution guard in favor of Node's permission model by tyffical · Pull Request #563 · DataDog/build-plugins

tyffical · 2026-10-07T17:27:40Z

Motivation

Where a call can't run under Node's permission model, an in-process guard refused writes and subprocesses the Node backend runtime allows, blocking code that runs in production. (APPS-2945, design page)
Comparable local runners build no JavaScript file-system guard: they run unrestricted (serverless-offline, Netlify dev, Vercel dev) or on the real runtime (SAM local, wrangler); dev:verify is the parity check.
Stacked on [APPS-2945] Update: switch the apps plugin's static checks to the Node backend runtime #557; merge after [APPS-2961] Update: warn that Vite below 6.4 is deprecated and run the repo on Node 24 #627.

Architecture

flowchart TD
    E["/__dd/executeAction"] --> P{"Node's permission model usable?"}
    P -->|"yes"| C["call's own process under --permission"]
    C --> H["a refusal fails the call with a dev:verify hint"]
    P -->|"no, or --inspect without --allow-inspector"| U["call's own process, unrestricted"]
    U --> W["one warning per dev server"]

The permission-model path keeps the limits from [APPS-2961] Add: limit local call processes with Node's permission model #617.

Changes

8 changes across network-guard.ts, local-execution*.ts, package.json, README.md and tests

What changed	File
Delete the in-process guard and its tests.	`src/vite/network-guard.ts`, `src/vite/network-guard.test.ts` (deleted)
Stop installing the guard in a call's process.	`local-execution-child.ts`
Tell a sandboxed call by `process.permission`, which decides whether modules get `import.meta.resolve`.	`local-execution-child.ts`
Warn once per dev server when calls run unrestricted.	`local-execution-process.ts`
Map Node's refusals to messages with the hint and the refused path, or Node's reason when it gives no scope.	`local-execution-limits.ts`
Drop the unused `graceful-fs` devDependency.	`package.json`
Document the unrestricted paths and the hint.	`README.md`
Test the warning, unrestricted calls and hinted refusals, with the sandbox's no-warning check set to a Node with `module.registerHooks`.	`local-execution-limits.test.ts`, `local-execution-process.integration.test.ts`

QA Instructions

Typecheck, lint, integrity, the apps unit tests, and runs 1, 2 and 4 against a Datadog staging org pass at 58736e9f, run 1 also from a scaffold outside /tmp, using the helper scripts from [APPS-2945] Update: switch the apps plugin's static checks to the Node backend runtime #557.

Check	Result	Evidence
Typecheck, lint, integrity	Pass	Command 1
Apps unit tests	Pass, with a TMPDIR outside `/var`	Command 2
Vite 8 scaffold under `/tmp`, Node 20 and 24	Subprocess and root write refused with the hint	Run 1
Same, Node 24 symlink in the call's temp dir	Refused with the hint and Node's reason	Run 1
Same, Node 22 with `--inspect`	Unrestricted, one warning	Run 2
Same, Node 24 with `--inspect`	Refused as in run 1, no warning	Run 2
Same, scaffold outside `/tmp`, Node 20 and 24	Project and outside writes refused too	Run 1
`dev:verify`	Writes and subprocess succeed	Run 4

yarn typecheck:all && yarn lint && yarn cli integrity
# Expected: all exit 0, integrity leaves no file changes
TMPDIR=/private/tmp yarn test:unit packages/plugins/apps
# Expected: every suite passes

Fixtures, run commands and output

src/guardRefusal.backend.ts:

import { execFileSync } from 'child_process';
import fs from 'fs';
import path from 'path';
import { fileURLToPath } from 'url';

// Each lets its refusal reach the response instead of catching it.
const projectDir = path.dirname(path.dirname(fileURLToPath(import.meta.url)));

export async function spawnUncaught() {
    return execFileSync(process.execPath, ['-e', "process.stdout.write('spawned')"]).toString();
}

export async function writeProjectUncaught() {
    fs.writeFileSync(path.join(projectDir, 'qa-guard-probe.txt'), 'probe');
    return 'written';
}

export async function writeOutsideUncaught() {
    const outsideDir = path.join(path.dirname(projectDir), 'qa-outside-probe');
    fs.mkdirSync(outsideDir, { recursive: true });
    fs.writeFileSync(path.join(outsideDir, 'probe.txt'), 'probe');
    return 'written';
}

export async function writeRootUncaught() {
    fs.writeFileSync('/qa-limits-probe.txt', 'probe');
    return 'written';
}

src/guardRun.backend.ts:

import { execFileSync } from 'child_process';
import fs from 'fs';
import os from 'os';
import path from 'path';

function attempt(write: () => unknown): string {
    try {
        const result = write();
        return typeof result === 'string' ? result : 'written';
    } catch (error) {
        const message = error instanceof Error ? error.message : String(error);
        return `refused: ${message.slice(0, 40)}…`;
    }
}

export async function writeAndSpawn() {
    const projectFile = path.join(process.cwd(), 'qa-guard-probe.txt');
    const tmpFile = path.join(os.tmpdir(), 'qa-guard-probe.txt');
    const outsideDir = path.join(path.dirname(process.cwd()), 'qa-outside-probe');
    const outsideFile = path.join(outsideDir, 'probe.txt');
    const script = "process.stdout.write('spawned')";
    return {
        project: attempt(() => fs.writeFileSync(projectFile, 'probe')),
        tmp: attempt(() => fs.writeFileSync(tmpFile, 'probe')),
        outside: attempt(() => {
            fs.mkdirSync(outsideDir, { recursive: true });
            fs.writeFileSync(outsideFile, 'probe');
        }),
        subprocess: attempt(() => execFileSync(process.execPath, ['-e', script]).toString()),
    };
}

src/useFetch.backend.ts:

export async function getStatus() {
    const response = await fetch('https://example.com');
    return response.status;
}

src/symlinkRefusal.backend.ts:

import fs from 'fs';
import os from 'os';
import path from 'path';

// Lets the refusal reach the response instead of catching it.
export async function symlinkInTmpUncaught() {
    const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'qa-symlink-'));
    fs.writeFileSync(path.join(dir, 'target.txt'), 'x');
    fs.symlinkSync(path.join(dir, 'target.txt'), path.join(dir, 'link.txt'));
    return 'linked';
}

cd "$QA_DIR" && QA_APP=<vite 8 scaffold> ./install-plugin.sh 563 <build-plugins checkout of this branch>
QA_APP=<vite 8 scaffold> QA_NODE=<node 20.19.4, then node 24> ./qa-run.sh development guardRefusal useFetch symlinkRefusal
# spawnUncaught and writeRootUncaught: HTTP 500 "Spawning a subprocess is blocked..." / "Writing outside the call's temp dirs is blocked... Refused: /qa-limits-probe.txt"
# writeProjectUncaught, writeOutsideUncaught: written (the scaffold sits under /tmp); getStatus 200; no unrestricted warning
# From a scaffold outside /tmp, both also fail: "Writing outside the call's temp dirs is blocked... Refused: <scaffold>/qa-guard-probe.txt", and the same for ../qa-outside-probe
# symlinkInTmpUncaught: "linked" on Node 20; on Node 24 HTTP 500 "This operation is blocked... Refused: fs.symlink API requires full fs.read and fs.write permissions."
QA_APP=<vite 8 scaffold> QA_NODE=<node 22.23.3> QA_NODE_OPTIONS=--inspect=127.0.0.1:0 ./qa-run.sh development guardRefusal
# spawnUncaught "spawned", both writes written, writeRootUncaught fails with the OS's EROFS;
# one "Backend functions run locally without Node's permission model..." warning
# With QA_NODE=<node 24>: the same refusals as run 1 and no warning
QA_APP=<vite 8 scaffold> ./qa-run.sh dev-verify guardRun
# writeAndSpawn {"outside":"written","project":"written","subprocess":"spawned","tmp":"written"} on the real runtime

Blast Radius

No feature flag. Low risk: local only, and it removes refusals production doesn't make.
Local execution only: on a Node without a usable permission model, calls the guard refused now run, with one warning per dev server.

Out of Scope / Follow-ups

4 items deferred

Item	Status	Next step
The design page's decision to keep blocking subprocesses locally is superseded	Doc follow-up	Update its local execution section
A refusal the function catches, wraps or raises in a callback shows Node's raw text	Accepted	None
A project under `/tmp` is writable from a call's own process, since the permission model grants `/tmp`	Accepted	None
Node files some refusals under another scope (on Node 20, an `fs.cpSync` destination or symlink target as a read; everywhere, `module.register` as a worker thread), so the hint names that scope	Accepted	None

Documentation

🤖 Generated with Claude Code

datadog-datadog-prod-us1-2 · 2026-10-14T20:01:06Z

🎉 All green!

🧪 All tests passed
❄️ No new flaky tests detected

_{This comment will be updated automatically if new data arrives.

🔗 Commit SHA: 4b6c911 | Docs | View more details | Give us feedback!}

github-actions · 2026-10-23T15:39:19Z

Live Debugger Runtime Benchmark

SDK-loaded dormant-probe runtime overhead, measured against an uninstrumented bundle in the same browser session.

Browser	Workload	Quality	Per-call overhead upper
chrome	Hot	clean	<= 2.56 ns
chrome	Tiny	clean	<= 0.01 ns
firefox	Hot	clean	<= 9.83 ns
firefox	Tiny	clean	<= 0.03 ns
safari	Hot	clean	<= 2.95 ns
safari	Tiny	clean	<= 0.76 ns

What do the Tiny and Hot workloads represent?

Browser Debugger SDK: 7.16.2 · built 2026-10-27 · S3 ETag 872de873

Full diagnostics

browser  workload  quality  per-call overhead upper  overhead upper          95% CI        A/A diag        block CI  acf(1)   baseline  instrumented                         samples
-------  --------  -------  -----------------------  --------------  --------------  --------------  --------------  ------  ---------  ------------  ------------------------------
chrome   Hot       clean                 <= 2.56 ns        <= 5.15%   2.51..2.55 ns  -0.01..0.01 ns   2.51..2.56 ns    0.05  52.735 ms     55.415 ms   102 (trim 20%, outliers 5.9%)
chrome   Tiny      clean                 <= 0.01 ns        <= 0.09%  -0.01..0.01 ns  -0.01..0.02 ns  -0.02..0.01 ns    0.04  56.835 ms     56.845 ms  102 (trim 20%, outliers 13.7%)
firefox  Hot       clean                 <= 9.83 ns       <= 39.02%   9.80..9.82 ns  -0.01..0.01 ns   9.79..9.83 ns    0.09  39.700 ms     55.180 ms   102 (trim 20%, outliers 7.8%)
firefox  Tiny      clean                 <= 0.03 ns        <= 0.20%   0.02..0.03 ns  -0.00..0.00 ns   0.02..0.03 ns    0.07  53.740 ms     53.840 ms   102 (trim 20%, outliers 6.9%)
safari   Hot       clean                 <= 2.95 ns       <= 11.79%   2.94..2.95 ns  -0.01..0.01 ns   2.94..2.95 ns   -0.23  49.580 ms     55.400 ms   102 (trim 20%, outliers 2.9%)
safari   Tiny      clean                 <= 0.76 ns       <= 20.32%   0.53..0.65 ns  -0.00..0.00 ns   0.48..0.76 ns    0.86  41.100 ms     47.050 ms   102 (trim 20%, outliers 0.0%)

Raw samples are in the live-debugger-runtime-bench-results artifact.

Copilot

🟢 Approval recommended

Static review identified no blocking issues; the remaining feedback concerns only non-blocking coding conventions.

No open issues 🎉

What changed in this PR

This PR simplifies the apps plugin’s local backend execution by removing the in-process guard while retaining Node’s permission-model limits where available. Cloud execution, dev:verify, and builds remain unchanged.

Changes:

Remove the JavaScript guard and allow unrestricted execution on fallback paths, with a one-time warning.
Add actionable permission-refusal messages pointing to dev:verify.
Update documentation and tests, and remove the unused graceful-fs dependency.

File	Description
`yarn.lock`	Remove the apps workspace’s direct `graceful-fs` entry.
`packages/tests/src/_jest/fixtures/apps_backend_project/childSandbox.backend.ts`	Add fixtures for permission refusals and lookalike errors.
`packages/plugins/apps/src/vite/probe-dir.fixtures.ts`	Clarify a fixture comment’s terminology.
`packages/plugins/apps/src/vite/network-guard.ts`	Delete the in-process guard.
`packages/plugins/apps/src/vite/network-guard.test.ts`	Delete obsolete guard tests.
`packages/plugins/apps/src/vite/local-execution.ts`	Remove guard installation and guarded execution.
`packages/plugins/apps/src/vite/local-execution.test.ts`	Replace guard assertions with unrestricted execution coverage.
`packages/plugins/apps/src/vite/local-execution-sandbox.ts`	Update the fallback behavior docstring.
`packages/plugins/apps/src/vite/local-execution-protocol.ts`	Remove the guard-installation configuration field.
`packages/plugins/apps/src/vite/local-execution-process.ts`	Warn once when child calls run unrestricted.
`packages/plugins/apps/src/vite/local-execution-process.integration.test.ts`	Cover warnings, refusals, and child-entry imports.
`packages/plugins/apps/src/vite/local-execution-limits.ts`	Define warnings and permission-error hints.
`packages/plugins/apps/src/vite/local-execution-limits.test.ts`	Test hint mapping and unrelated-error preservation.
`packages/plugins/apps/src/vite/local-execution-child.ts`	Remove guards and attach permission hints to failures.
`packages/plugins/apps/src/vite/index.ts`	Replace guard setup with an unrestricted-execution warning.
`packages/plugins/apps/src/vite/index.test.ts`	Update startup and fallback warning coverage.
`packages/plugins/apps/src/vite/dev-server.integration.test.ts`	Remove guard-specific dynamic-import tests.
`packages/plugins/apps/src/index.test.ts`	Remove an obsolete guard-related comment.
`packages/plugins/apps/README.md`	Document unrestricted fallbacks and refusal hints.
`packages/plugins/apps/package.json`	Remove the unused `graceful-fs` devDependency.

_{Review effort: Balanced}

tyffical · 2026-10-28T16:32:04Z

/merge

gh-worker-devflow-routing-ef8351 · 2026-10-28T16:32:10Z

View all feedbacks in Devflow UI.

2026-10-28 16:32:10 UTC ℹ️ Start processing command /merge

2026-10-28 16:32:11 UTC ℹ️ MergeQueue: Stack detected — automatically merging the entire stack.

2026-10-28 16:32:28 UTC ℹ️ Devflow: Merging stacked PRs in the following order:

[APPS-2961 Update: require Vite 6.4 or later for the apps plugin ([APPS-2961] Update: require Vite 6.4 or later for the apps plugin #622)]([APPS-2961] Update: require Vite 6.4 or later for the apps plugin #622)
[APPS-2961 Refactor: move local execution's side-effect-free helpers into their own module ([APPS-2961] Refactor: move local execution's side-effect-free helpers into their own module #604)]([APPS-2961] Refactor: move local execution's side-effect-free helpers into their own module #604)
[APPS-2961 Update: run each local backend function call in a fresh process ([APPS-2961] Update: run each local backend function call in a fresh process #608)]([APPS-2961] Update: run each local backend function call in a fresh process #608)
[APPS-2961 Add: limit local call processes with Node's permission model ([APPS-2961] Add: limit local call processes with Node's permission model #617)]([APPS-2961] Add: limit local call processes with Node's permission model #617)
[APPS-2961 Update: run local backend function calls in parallel, with per-call log prefixes ([APPS-2961] Update: run local backend function calls in parallel, with per-call log prefixes #603)]([APPS-2961] Update: run local backend function calls in parallel, with per-call log prefixes #603)
[APPS-2945] Update: switch the apps plugin's static checks to the Node backend runtime (#557)
[APPS-2945] Update: drop the in-process local execution guard in favor of Node's permission model (#563)

Progress updates will be sent here directly.

2026-10-28 16:32:29 UTC ℹ️ Devflow: Merging [APPS-2961 Update: require Vite 6.4 or later for the apps plugin (#622)](#622)...

2026-10-28 16:32:34 UTC ℹ️ MergeQueue: pull request added to the queue

The expected merge time in master is approximately 2m (p90).

2026-10-28 16:34:12 UTC ℹ️ MergeQueue: This merge request was merged

2026-10-28 16:34:14 UTC ❌ MergeQueue

Failed to ensure [APPS-2961 Refactor: move local execution's side-effect-free helpers into their own module (#604)](#604) targets master before merging: activity error (type: github.PullRequestService_EditPullRequest, scheduledEventID: 179, startedEventID: 180, identity: 1@github-worker-6bdf54b798-kkc72@): failed to edit the pull request (Request ID: C300:4F56E:10145FD:34A39CF:6AE22405) (type: GitUnprocessableEntity, retryable: false): PATCH https://api.github.com/repos/DataDog/build-plugins/pulls/604: 422 Validation Failed [{Resource:PullRequest Field:base Code:invalid Message:Cannot change the base branch because the pull request is part of a stack.}] (type: ErrorResponse, retryable: true). The current stack is:

[APPS-2961 Refactor: move local execution's side-effect-free helpers into their own module ([APPS-2961] Refactor: move local execution's side-effect-free helpers into their own module #604)]([APPS-2961] Refactor: move local execution's side-effect-free helpers into their own module #604)
[APPS-2961 Update: run each local backend function call in a fresh process ([APPS-2961] Update: run each local backend function call in a fresh process #608)]([APPS-2961] Update: run each local backend function call in a fresh process #608)
[APPS-2961 Add: limit local call processes with Node's permission model ([APPS-2961] Add: limit local call processes with Node's permission model #617)]([APPS-2961] Add: limit local call processes with Node's permission model #617)
[APPS-2961 Update: run local backend function calls in parallel, with per-call log prefixes ([APPS-2961] Update: run local backend function calls in parallel, with per-call log prefixes #603)]([APPS-2961] Update: run local backend function calls in parallel, with per-call log prefixes #603)
[APPS-2945] Update: switch the apps plugin's static checks to the Node backend runtime (#557)
[APPS-2945] Update: drop the in-process local execution guard in favor of Node's permission model (#563)

… Node's permission model Local execution's in-process JavaScript guard patched fs, child_process, worker_threads and process.chdir to refuse writes and subprocesses on the paths where a call can't run under Node's permission model. The Node backend runtime itself allows those operations, and comparable local runners don't build a JavaScript file-system guard, so the guard blocked code that runs in production while not being a security boundary. The guard, its tests and its wiring are removed. On a Node without the permission model, or without --allow-inspector while debugging, a call's process runs unrestricted and the dev server warns once that production's limits aren't enforced locally and that dev:verify runs functions on the real runtime. A call's own process under the permission model keeps Node's limits. A refusal from Node's permission model that fails the call is reported with a message naming what was refused, the refused path for a file refusal or Node's own reason for an API it refuses without a scope, such as fs.symlink on Node 24, and the dev:verify hint, keeping the call's own stack frames. The unused graceful-fs devDependency goes with the guard's tests. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tyffical · 2026-10-28T16:55:40Z

/merge

gh-worker-devflow-routing-ef8351 · 2026-10-28T16:55:45Z

View all feedbacks in Devflow UI.

2026-10-28 16:55:45 UTC ℹ️ Start processing command /merge

2026-10-28 16:55:47 UTC ℹ️ MergeQueue: Stack detected — automatically merging the entire stack.

2026-10-28 16:55:59 UTC ℹ️ Devflow: Merging stacked PRs in the following order:

[APPS-2961 Refactor: move local execution's side-effect-free helpers into their own module ([APPS-2961] Refactor: move local execution's side-effect-free helpers into their own module #604)]([APPS-2961] Refactor: move local execution's side-effect-free helpers into their own module #604)
[APPS-2961 Update: run each local backend function call in a fresh process ([APPS-2961] Update: run each local backend function call in a fresh process #608)]([APPS-2961] Update: run each local backend function call in a fresh process #608)
[APPS-2961 Add: limit local call processes with Node's permission model ([APPS-2961] Add: limit local call processes with Node's permission model #617)]([APPS-2961] Add: limit local call processes with Node's permission model #617)
[APPS-2961 Update: run local backend function calls in parallel, with per-call log prefixes ([APPS-2961] Update: run local backend function calls in parallel, with per-call log prefixes #603)]([APPS-2961] Update: run local backend function calls in parallel, with per-call log prefixes #603)
[APPS-2945 Update: switch the apps plugin's static checks to the Node backend runtime ([APPS-2945] Update: switch the apps plugin's static checks to the Node backend runtime #557)]([APPS-2945] Update: switch the apps plugin's static checks to the Node backend runtime #557)
[APPS-2945 Update: drop the in-process local execution guard in favor of Node's permission model ([APPS-2945] Update: drop the in-process local execution guard in favor of Node's permission model #563)]([APPS-2945] Update: drop the in-process local execution guard in favor of Node's permission model #563)

Progress updates will be sent here directly.

2026-10-28 16:56:00 UTC ℹ️ Devflow: Merging [APPS-2961 Refactor: move local execution's side-effect-free helpers into their own module (#604)](#604)...

2026-10-28 16:56:05 UTC ℹ️ MergeQueue: pull request added to the queue

The expected merge time in master is approximately 2m (p90).

2026-10-28 16:57:27 UTC ℹ️ MergeQueue: This merge request was merged

2026-10-28 16:57:30 UTC ℹ️ Devflow: Merging [APPS-2961 Update: run each local backend function call in a fresh process (#608)](#608)...

2026-10-28 16:57:35 UTC ℹ️ MergeQueue: pull request added to the queue

The expected merge time in master is approximately 2m (p90).

2026-10-28 16:58:58 UTC ℹ️ MergeQueue: This merge request was merged

2026-10-28 16:59:01 UTC ℹ️ Devflow: Merging [APPS-2961 Add: limit local call processes with Node's permission model (#617)](#617)...

2026-10-28 16:59:07 UTC ℹ️ MergeQueue: pull request added to the queue

The expected merge time in master is approximately 2m (p90).

2026-10-28 17:00:30 UTC ℹ️ MergeQueue: This merge request was merged

2026-10-28 17:00:33 UTC ℹ️ Devflow: Merging [APPS-2961 Update: run local backend function calls in parallel, with per-call log prefixes (#603)](#603)...

2026-10-28 17:00:37 UTC ℹ️ MergeQueue: pull request added to the queue

The expected merge time in master is approximately 2m (p90).

2026-10-28 17:01:59 UTC ℹ️ MergeQueue: This merge request was merged

2026-10-28 17:02:02 UTC ℹ️ Devflow: Merging [APPS-2945 Update: switch the apps plugin's static checks to the Node backend runtime (#557)](#557)...

2026-10-28 17:02:06 UTC ℹ️ MergeQueue: pull request added to the queue

The expected merge time in master is approximately 2m (p90).

2026-10-28 17:03:30 UTC ℹ️ MergeQueue: This merge request was merged

2026-10-28 17:03:33 UTC ℹ️ Devflow: Merging [APPS-2945 Update: drop the in-process local execution guard in favor of Node's permission model (#563)](#563)...

2026-10-28 17:03:39 UTC ℹ️ MergeQueue: Pull request is not mergeable yet

It will be processed automatically as soon as GitHub reports it as mergeable. View in MergeQueue UI.

Run /code blockers to see what is blocking it.
Run /remove to cancel it.

2026-10-28 17:04:23 UTC ℹ️ MergeQueue: merge request added to the queue

The expected merge time in master is approximately 2m (p90).

2026-10-28 17:05:43 UTC ℹ️ MergeQueue: This merge request was merged

⏳ Processing

tyffical mentioned this pull request Oct 7, 2026

[APPS-2945] Update: switch the apps plugin's static checks to the Node backend runtime #557

Merged

tyffical force-pushed the tiffany.trinh/apps-2945-local-guard-messages branch from 9ff1de7 to 267c2ee Compare October 7, 2026 19:25

tyffical changed the base branch from master to tiffany.trinh/apps-2945-follow-terrapin-flag October 7, 2026 19:25

tyffical force-pushed the tiffany.trinh/apps-2945-local-guard-messages branch from 267c2ee to 7547a80 Compare October 7, 2026 19:37

tyffical changed the title ~~[APPS-2945] Fix: say local execution's guard blocks are local-only~~ [APPS-2945] Fix: guard local execution by the org's backend runtime Oct 7, 2026

tyffical force-pushed the tiffany.trinh/apps-2945-follow-terrapin-flag branch from e898bea to 481364f Compare October 8, 2026 03:14

tyffical force-pushed the tiffany.trinh/apps-2945-local-guard-messages branch from 7547a80 to 96f4d63 Compare October 8, 2026 03:24

tyffical force-pushed the tiffany.trinh/apps-2945-follow-terrapin-flag branch from 481364f to e574841 Compare October 8, 2026 03:44

tyffical force-pushed the tiffany.trinh/apps-2945-local-guard-messages branch 2 times, most recently from f05dc6f to 1bed9e6 Compare October 8, 2026 15:01

tyffical force-pushed the tiffany.trinh/apps-2945-follow-terrapin-flag branch from e574841 to 34a9189 Compare October 13, 2026 00:52

tyffical force-pushed the tiffany.trinh/apps-2945-local-guard-messages branch from 1bed9e6 to 1432b86 Compare October 13, 2026 01:22

tyffical force-pushed the tiffany.trinh/apps-2945-follow-terrapin-flag branch from 34a9189 to abf34ad Compare October 13, 2026 20:08

tyffical force-pushed the tiffany.trinh/apps-2945-local-guard-messages branch 3 times, most recently from 2903b26 to b358421 Compare October 14, 2026 15:21

tyffical force-pushed the tiffany.trinh/apps-2945-local-guard-messages branch from 10d99f9 to 121756b Compare October 14, 2026 23:54

tyffical force-pushed the tiffany.trinh/apps-2945-follow-terrapin-flag branch from abf34ad to 892bda9 Compare October 15, 2026 01:04

tyffical force-pushed the tiffany.trinh/apps-2945-local-guard-messages branch from 121756b to e2cb304 Compare October 15, 2026 02:04

tyffical force-pushed the tiffany.trinh/apps-2945-follow-terrapin-flag branch 2 times, most recently from bd21790 to 2352fe9 Compare October 15, 2026 15:37

tyffical force-pushed the tiffany.trinh/apps-2945-local-guard-messages branch from e2cb304 to c862d97 Compare October 15, 2026 16:46

tyffical force-pushed the tiffany.trinh/apps-2945-follow-terrapin-flag branch from 2352fe9 to e7d5434 Compare October 15, 2026 19:07

tyffical force-pushed the tiffany.trinh/apps-2945-local-guard-messages branch from c862d97 to 4154548 Compare October 15, 2026 21:09

tyffical force-pushed the tiffany.trinh/apps-2945-follow-terrapin-flag branch from e7d5434 to 1fa97d9 Compare October 15, 2026 22:20

tyffical force-pushed the tiffany.trinh/apps-2945-local-guard-messages branch from 4154548 to 7172f41 Compare October 15, 2026 23:14

tyffical force-pushed the tiffany.trinh/apps-2945-follow-terrapin-flag branch 2 times, most recently from e44fe4a to 141d960 Compare October 16, 2026 00:47

tyffical marked this pull request as ready for review October 16, 2026 01:26

tyffical force-pushed the tiffany.trinh/apps-2945-local-guard-messages branch from a24b4d7 to 1bc16e4 Compare October 23, 2026 13:20

tyffical force-pushed the tiffany.trinh/apps-2945-follow-terrapin-flag branch from 7509268 to eb7a6fb Compare October 23, 2026 13:41

tyffical force-pushed the tiffany.trinh/apps-2945-local-guard-messages branch from 1bc16e4 to 55ce6f0 Compare October 23, 2026 13:43

tyffical force-pushed the tiffany.trinh/apps-2945-follow-terrapin-flag branch from eb7a6fb to 92afaf2 Compare October 23, 2026 14:30

tyffical force-pushed the tiffany.trinh/apps-2945-local-guard-messages branch from 55ce6f0 to 8f7e414 Compare October 23, 2026 15:34

tyffical force-pushed the tiffany.trinh/apps-2945-follow-terrapin-flag branch from 92afaf2 to b71e121 Compare October 23, 2026 16:19

tyffical force-pushed the tiffany.trinh/apps-2945-local-guard-messages branch from 8f7e414 to 0b521ee Compare October 23, 2026 16:22

tyffical changed the title ~~[APPS-2945] Update: guard local execution with the Node backend runtime's rules~~ [APPS-2945] Update: drop the in-process local execution guard in favor of Node's permission model Oct 23, 2026

tyffical mentioned this pull request Oct 23, 2026

[APPS-2945] Add: warn on process.env reads in backend functions #565

Merged

ksun154 requested a balanced review from Copilot October 26, 2026 17:46

Copilot started reviewing on behalf of ksun154 October 26, 2026 17:47

View session

Copilot AI reviewed Oct 26, 2026

View reviewed changes

ksun154 approved these changes Oct 26, 2026

View reviewed changes

tyffical mentioned this pull request Oct 26, 2026

[APPS-2961] Update: run each local backend function call in a fresh process #608

Merged

tyffical force-pushed the tiffany.trinh/apps-2945-follow-terrapin-flag branch from b71e121 to 368c9ee Compare October 27, 2026 01:01

tyffical force-pushed the tiffany.trinh/apps-2945-local-guard-messages branch from 0b521ee to 8648292 Compare October 27, 2026 01:07

tyffical force-pushed the tiffany.trinh/apps-2945-follow-terrapin-flag branch from 368c9ee to 67fb3ed Compare October 27, 2026 03:08

tyffical force-pushed the tiffany.trinh/apps-2945-local-guard-messages branch from 8648292 to 852a786 Compare October 27, 2026 03:15

tyffical force-pushed the tiffany.trinh/apps-2945-follow-terrapin-flag branch from 67fb3ed to 539234b Compare October 27, 2026 20:16

tyffical force-pushed the tiffany.trinh/apps-2945-local-guard-messages branch from 852a786 to 4421a6b Compare October 27, 2026 20:16

tyffical force-pushed the tiffany.trinh/apps-2945-follow-terrapin-flag branch from 539234b to 2c6b514 Compare October 28, 2026 05:40

tyffical force-pushed the tiffany.trinh/apps-2945-local-guard-messages branch from 4421a6b to 58736e9 Compare October 28, 2026 05:40

tyffical mentioned this pull request Oct 28, 2026

[APPS-2961] Add: CI matrix running local execution against real Vite 7 and 8 installs #606

Merged

tyffical force-pushed the tiffany.trinh/apps-2945-follow-terrapin-flag branch from 2c6b514 to acb744e Compare October 28, 2026 16:13

Navigation Menu

Repository navigation

[APPS-2945] Update: drop the in-process local execution guard in favor of Node's permission model - #563

[APPS-2945] Update: drop the in-process local execution guard in favor of Node's permission model#563
gh-worker-dd-mergequeue-cf854d[bot] merged 1 commit into
masterfrom
tiffany.trinh/apps-2945-local-guard-messages

tyffical commented Oct 7, 2026 •

edited

Loading

Uh oh!

datadog-datadog-prod-us1-2 Bot commented Oct 14, 2026 •

edited by datadog-datadog-prod-us1 Bot

Loading

Uh oh!

github-actions Bot commented Oct 23, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

tyffical commented Oct 28, 2026

Uh oh!

gh-worker-devflow-routing-ef8351 Bot commented Oct 28, 2026 •

edited by atlassian Bot

Loading

Uh oh!

tyffical commented Oct 28, 2026

Uh oh!

gh-worker-devflow-routing-ef8351 Bot commented Oct 28, 2026 •

edited by atlassian Bot

Loading

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

tyffical commented Oct 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Motivation

Architecture

Changes

QA Instructions

Blast Radius

Out of Scope / Follow-ups

Documentation

Uh oh!

datadog-datadog-prod-us1-2 Bot commented Oct 14, 2026 • edited by datadog-datadog-prod-us1 Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Live Debugger Runtime Benchmark

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟢 Approval recommended

Uh oh!

tyffical commented Oct 28, 2026

Uh oh!

gh-worker-devflow-routing-ef8351 Bot commented Oct 28, 2026 • edited by atlassian Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

tyffical commented Oct 28, 2026

Uh oh!

gh-worker-devflow-routing-ef8351 Bot commented Oct 28, 2026 • edited by atlassian Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

tyffical commented Oct 7, 2026 •

edited

Loading

datadog-datadog-prod-us1-2 Bot commented Oct 14, 2026 •

edited by datadog-datadog-prod-us1 Bot

Loading

github-actions Bot commented Oct 23, 2026 •

edited

Loading

gh-worker-devflow-routing-ef8351 Bot commented Oct 28, 2026 •

edited by atlassian Bot

Loading

gh-worker-devflow-routing-ef8351 Bot commented Oct 28, 2026 •

edited by atlassian Bot

Loading