Greptile Summary

This PR fixes a sandbox-bypass regression by tightening isRequestedExecTargetAllowed: the previous auto-wildcard shortcut allowed any model-supplied host value to be accepted when the operator had configured tools.exec.host=auto, effectively making auto an open allowlist. The fix reduces the function to a strict equality check, so a requested target must exactly match the configured target; anything else throws \"exec host not allowed\". The implementation change is correct and the unit test is updated to assert the new throw behaviour.

• Security logic is sound \u2014 removing the auto wildcard is the right fail-closed default; auto resolution now falls back to sandbox/gateway automatically without trusting model-supplied overrides.
• Misleading error message hint \u2014 the resolveExecTarget throw references configuredTarget in the "configure to allow" hint, so when configuredTarget === \"auto\" the message says configure tools.exec.host=auto to allow \u2014 which is already the current setting. Using requestedTarget in the hint would give actionable guidance.
• Thin test coverage \u2014 the new test covers requestedTarget: \"node\" but not the symmetrical gateway override or the still-valid auto\u2192auto pass-through case.
• elevatedRequested path not addressed \u2014 the elevatedRequested: true branch still bypasses the target check and hard-selects gateway; this is out of scope and intentional, but operators should be aware a model-supplied elevated=true can still route to the gateway host."

Confidence Score: 5/5

Safe to merge — the security fix is correct and no regressions are introduced; remaining findings are P2 quality/UX suggestions.

The core logic change is simple, correct, and well-targeted. Both findings are P2: the error message hint is cosmetic/informational and the test gaps are minor coverage improvements rather than evidence of broken behaviour. No P0/P1 issues found.

No files require special attention for merge safety, but src/agents/bash-tools.exec-runtime.ts lines 248–251 contain the misleading error message worth fixing in a follow-up.

This is a comment left during a code review.
Path: src/agents/bash-tools.exec-runtime.ts
Line: 248-251

Comment:
**Misleading "configure to allow" hint in error message**

The error message tells users `configure tools.exec.host=auto to allow` when `configuredTarget` is `"auto"` — but `auto` is _already_ the configured value and explicitly does **not** allow host overrides after this fix. The hint should name the `requestedTarget` so the user knows which concrete value to set:

```suggestion
    throw new Error(
      `exec host not allowed (requested ${renderExecTargetLabel(requestedTarget)}; ` +
        `configure tools.exec.host=${renderExecTargetLabel(requestedTarget)} to allow).`,
    );
```

Before this PR, `auto` would never reach this throw; the change makes this code path reachable for the first time, exposing the pre-existing misleading hint.

How can I resolve this? If you propose a fix, please make it concise.

---

This is a comment left during a code review.
Path: src/agents/bash-tools.exec-runtime.test.ts
Line: 50-59

Comment:
**Narrow test coverage for the new restriction**

The single test only asserts that `requestedTarget: "node"` is rejected. The symmetrical `gateway` override (`requestedTarget: "gateway"`) and the still-valid `auto`→`auto` pass-through are not exercised. Consider adding:

```ts
it("also rejects gateway override when configured host is auto", () => {
  expect(() =>
    resolveExecTarget({
      configuredTarget: "auto",
      requestedTarget: "gateway",
      elevatedRequested: false,
      sandboxAvailable: true,
    }),
  ).toThrow("exec host not allowed");
});

it("allows explicit auto request when configured host is auto", () => {
  expect(
    resolveExecTarget({
      configuredTarget: "auto",
      requestedTarget: "auto",
      elevatedRequested: false,
      sandboxAvailable: true,
    }),
  ).toMatchObject({ selectedTarget: "auto", effectiveHost: "sandbox" });
});
```

How can I resolve this? If you propose a fix, please make it concise.

_{Reviews (1): Last reviewed commit: "Merge branch 'main' into codex/fix-exec-..." | Re-trigger Greptile}

Addressed the review in follow-up commit 8eb3fd1.

What changed:

• keep the stricter auto-host override guard
• add the missing gateway override regression case
• add the missing auto-to-auto pass-through case
• tighten the error hint so it points at the requested host the caller would need to configure, not the already-configured host
• drop the extra internal markdown file from the PR

Verification:

• pnpm test -- src/agents/bash-tools.exec-runtime.test.ts
• pnpm check

Added the missing changelog entry in follow-up commit a5f828bdec.

Landed via temp rebase onto main.

• Gate: pnpm check && pnpm build && pnpm test
• Land commit: 68c3945
• Merge commit: 45c8207

Thanks @vincentkoc!