Python: Improve regex validation for shell and file access

[westey (westey-m)]

Motivation & Context

Description & Review Guide

• What are the major changes?
• What is the impact of these changes?
• What do you want reviewers to focus on?

Related Issue

Fixes #

Contribution Checklist

• The code builds clean without any errors or warnings
• All unit tests pass, and I have added new tests where possible
• The PR follows the Contribution Guidelines
• This PR is linked to an issue and there is no other open PR for this issue (see Related Issue above).
• This is not a breaking change. If it is a breaking change, add the breaking change label (or add "[BREAKING]" to the title prefix, before or after any language prefix) — a workflow keeps the label and title prefix in sync automatically.

[Copilot]

🟡 Changes recommended

Precompiled Python patterns still permit unbounded ReDoS, and invalid patterns introduce an exception compatibility break.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Adds bounded regex evaluation to prevent ReDoS in file searches and shell policies across Python and .NET.

Changes:

• Uses timeout-capable regex matching with fail-closed shell-policy behavior.
• Adds shared search deadlines and ReDoS regression tests.
• Updates dependencies, documentation, and related formatting.

File summaries

File	Description
python/uv.lock	Locks the new regex dependency.
python/packages/tools/tests/test_policy.py	Tests shell-policy timeouts and compiled patterns.
python/packages/tools/pyproject.toml	Adds regex to tools dependencies.
python/packages/tools/agent_framework_tools/shell/_policy.py	Implements bounded policy matching.
python/packages/core/tests/workflow/test_agent_executor_tool_calls.py	Formatting-only change.
python/packages/core/tests/core/test_harness_tool_approval.py	Formatting-only change.
python/packages/core/tests/core/test_harness_file_access.py	Adds file-search ReDoS tests.
python/packages/core/tests/core/test_function_invocation_logic.py	Formatting-only change.
python/packages/core/pyproject.toml	Adds regex to core dependencies.
python/packages/core/AGENTS.md	Documents the search timeout contract.
python/packages/core/agent_framework/_workflows/_agent_executor.py	Formatting-only change.
python/packages/core/agent_framework/_tools.py	Formatting-only change.
python/packages/core/agent_framework/_harness/_file_access.py	Implements deadline-bounded file searching.
dotnet/tests/Microsoft.Agents.AI.Tools.Shell.UnitTests/ShellPolicyTests.cs	Tests .NET timeout behavior.
dotnet/src/Microsoft.Agents.AI.Tools.Shell/ShellPolicy.cs	Adds per-match .NET regex timeouts.

Review details

• Files reviewed: 14/15 changed files
• Comments generated: 3
• Review effort level: Balanced

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

MAF Automated Review — Iteration 1

Result: Findings reported
Scope: full PR (1 commit(s)): b2ee4b2de3f9
Model: gpt-5.6-sol-fast

Overview

The PR replaces uninterruptible string-pattern matching with timeout-capable engines, fails shell policy checks closed, and applies a shared deadline plus an outer timeout to file searches. The new tests cover catastrophic backtracking, event-loop responsiveness, normal policy decisions, and all built-in file-store paths. The remaining risk is compatibility: the Python engine switch changes established Unicode case-insensitive behavior in both shell policy and file search, and shell-policy construction no longer preserves the prior re.error exception contract.

Reviewed the supplied pull-request change set across correctness, security/reliability, architecture, and failure behavior.
3 verified findings remained after source verification (3 medium) across 2 files. Details are attached to the affected lines below.

Affected areas: python/packages/core/agent_framework/_harness/_file_access.py, python/packages/tools/agent_framework_tools/shell/_policy.py

[Eduard van Valkenburg (eavanvalkenburg)]

small nit on the code