Best possible solution:

Use #73982 as the canonical follow-up: land a focused fix that makes chat-bash inherit the same effective exec defaults as the normal exec tool, preserves broad bang-command routing, and resolves the remaining maintainer/security review questions there.

Security review:

Security review cleared: The PR touches host-exec policy but only forwards existing config defaults and tests command routing; it does not add dependencies, workflows, package scripts, secret handling, or new code-download/execution paths.

What I checked:

• Current main still has the original gap: handleBashChatCommand forwards timeoutSec, notifyOnExit, and notifyOnExitEmptySuccess into createExecTool, but not host, security, or ask. (src/auto-reply/reply/bash-command.ts:347, 7c51cd2baf1c)
• Normal exec path already forwards policy defaults: The regular agent exec path resolves agent/global exec defaults and passes host, security, ask, node, PATH, safe-bin, strict inline-eval, timeout, approval notice, and notification defaults to the lazy exec tool. (src/agents/pi-tools.ts:195, 7c51cd2baf1c)
• Exec runtime consumes those defaults: createExecTool derives the effective target from defaults.host, then merges configured/default security and ask before gateway/node approval handling. (src/agents/bash-tools.exec.ts:1546, 7c51cd2baf1c)
• Docs define tools.exec as policy input: Exec approval docs say the effective policy is the stricter of tools.exec.* and approval defaults, and exec docs list tools.exec.host, tools.exec.security, and tools.exec.ask as config defaults. Public docs: docs/tools/exec-approvals.md. (docs/tools/exec-approvals.md:18, 7c51cd2baf1c)
• PR diff introduces a bang-route regression: The PR changes bashBangRequested from startsWith("!") to a regex that only accepts whitespace, colon, alnum, or end-of-string after !, excluding existing commands such as !/bin/ls, !./script.sh, and !$SHELL -lc .... (src/auto-reply/reply/commands-bash.ts:13, 6246b6e75b0d)
• Existing review already identified the regression: The PR has a P2 review comment on commands-bash.ts asking to preserve punctuation-prefixed bang aliases because parseBashRequest still supports arbitrary command text after !. (src/auto-reply/reply/commands-bash.ts:13, 6246b6e75b0d)

Likely related people:

• steipete: Recent commits touch chat runtime policy isolation, command gating/security, exec YOLO semantics, and exec timeout behavior around the same policy surface. (role: recent maintainer and exec policy owner; confidence: high; commits: 6b41ef311f31, 08e020881d6e, 4a846dd129b1; files: src/auto-reply/reply/bash-command.ts, src/auto-reply/reply/directive-handling.persist.ts, src/agents/bash-tools.exec.ts)
• Takhoffman: Recent focused commits changed bash wrapper routing and target-session behavior in the files this PR modifies. (role: recent bash wrapper maintainer; confidence: medium; commits: 9b95d65ea26f, 55f35708e181; files: src/auto-reply/reply/commands-bash.ts, src/auto-reply/reply/bash-command.ts, src/auto-reply/reply/commands-bash-alias.test.ts)
• vincentkoc: Recent command flag and cycle refactors touched adjacent auto-reply and agent tool configuration surfaces that affect how this command path is wired. (role: adjacent command/config maintainer; confidence: medium; commits: 3059b36306ac, 74e7b8d47b18; files: src/auto-reply/reply/bash-command.ts, src/agents/pi-tools.ts)

Codex review notes: model gpt-5.5, reasoning high; reviewed against 7c51cd2baf1c.