fix: reject all network effects in os_check

[cursor]

Bug and impact

os_check only treated bare net as forbidden for refactor/test grants even though the Lex trust lattice classifies mcp and llm_cloud as network egress effects too. A refactor-mode generated Lex file declaring [llm_cloud] or [mcp] could pass the grant check despite net=none, creating a policy bypass for cloud LLM/MCP calls.

Root cause

The deny list in src/tools/os_check.lex duplicated only part of upstream lex-types::trust::effect_requirement instead of covering every network-effect name.

Fix

Added a shared network_effects() helper containing net, http, mcp, and llm_cloud, and use it for all modes with network: none.

Validation

• Downloaded lex 0.9.7 and ran lex pkg install.
• Ran lex check src/tools/os_check.lex successfully.
• Verified lex --output json check emits required_effects: ["llm_cloud"] for a targeted fixture.
• Ran a temporary wrapper through os_check.execute and confirmed it returns grant_violation for llm_cloud under refactor mode.

  

[cursor]

Security review found two medium-confidence supply/permission-boundary issues in the changed code. I found no existing review threads to re-validate before posting this assessment.

  

_{Sent by Cursor Automation: PR Lex}

[cursor]

Medium: this network denylist misses the real llm effect name used elsewhere in the project ([env, net, llm, ...]). A refactor-mode change that introduces LLM access can pass os_check because llm_cloud is never emitted, bypassing the intended no-network/no-cloud grant and enabling prompt/data exfiltration or unintended model calls.

[cursor]

Medium: these dependencies now resolve from Git default branches without a pinned rev/tag or lockfile. Anyone who can alter one of those upstream repos, or a compromised upstream account, can change the code pulled into builds after review, creating a supply-chain code execution path. Pin immutable revisions or commit a lockfile.

[cursor]

No critical correctness bugs found.

Reviewed the PR diff and traced the os_check/permission-gate path through tools_for_spec, with_permission_gate, and runtime dispatch. Validation performed:

• lex check passed for src/tools/os_check.lex, src/tools/index.lex, src/agents/refactor.lex, and src/permissions/manifests.lex with Lex 0.9.7 after lex pkg install.
• Confirmed scoped network effects still report base net in lex --output json check, so the new os_check forbidden list catches scoped network use.
• Confirmed refactor tool exposure includes os_check and excludes network VCS push/pull.

Caveats below the critical bar: the full src/ check still fails at the pre-existing src/server/api.lex effect-row mismatch noted in repo memory, and lex fmt --check would reformat src/permissions/manifests.lex. I did not open a fix PR because neither is a newly confirmed critical issue from this review.

  

_{Sent by Cursor Automation: Quality of PR Lex}