fix(agents): isolate agents-shell workspaces

[gregkonush]

Summary

• issue authenticated, cryptographically random stateful MCP sessions and bind one contained workspace lease to each session/OAuth subject
• enforce canonical path/device/inode ownership, per-session UIDs, UID-wide process termination, independent no-hardlink clones, and inherited Landlock confinement while keeping the shared seed mutation-free
• run privileged Git management with a secret-free, non-executing config boundary; update refs/remotes/origin/main before resolving new lease bases; reject config includes and neutralize executable helpers
• run read-only Git with repository-specific clean/smudge/process, diff/textconv, fsmonitor, pager, credential, editor, GPG, remote, and submodule overrides; reject every explicit git grep pager form before execution
• bind read-only execution atomically to the authenticated lease identity, keep kubectl on /nonexistent HOME plus /dev/null kubeconfig with in-cluster discovery, and grant explicit read/traverse access to the root-owned seed
• garbage-collect only clean server-created released clones and their terminal records after durable release audit; preserve adopted, dirty, quarantined, revoked, orphaned, and subject-recovery evidence
• use descriptor-bound no-follow read_file, reject anonymous stateful allocation, keep lease expiry manager-owned after parent exit, package the native helper in Docker/Nix, and atomically enable the read-only seed mount during normal compatible-image promotion

Related Issues

Resolves PROOMPT-440.

Testing

Exact source head 8bf488c6367f32562936c441f596def0009245b6, one commit across exactly 40 files on base ae4d23650c20cecbde2bac8416bc2b734381cb69.

• corrective agents-shell isolation suite: 54 tests with 52 passed and 2 local compiler-gated skips; combined isolation plus MCP: 79 passed, 2 skipped;
• Agents smoke/promotion contract suite: 51 passed, 0 failed, 575 assertions; measured tool schema remains under the 24,576-byte ceiling
• complete feasible Agents suite: 745 passed, 2 local native/root-gated skips
• raw local Agents suite: 769 passed, 2 skipped, with the sole failure the unchanged fake app-server fixture whose executable path is unavailable in this shell; hosted Agents CI is authoritative for the complete suite
• promotion/chart/workflow contracts: 101 passed, 1,868 assertions
• Agents TypeScript, Oxfmt, scoped Oxlint with warnings denied, and Vite/SSR/Nitro build passed locally; hosted CI is authoritative for Helm/CRD/kubeconform, Nix images, Docker, and Kind
• fresh-base regression advances the bare origin after seed creation and proves default acquisition resolves the new exact commit through refs/remotes/origin/main
• private-origin refresh regression proves the server strips token environment from Git, injects only a server-owned non-executable scoped HTTPS authorization header, never installs a credential helper, and leaks no token into results or audit
• acquisition-failure regression expires the bearer token during a deliberately delayed refresh and proves the created clone, runtime directory, and unpersisted lease record are all removed
• local-config regression proves every privileged --local inspection is explicitly anchored with git -C to the validated repository; the production proof passes the acquired workspace path to owned read-only Git
• workflow regression requires kubectl -n "${namespace}" apply -f - for the production-isolation Pod
• exact Kind proof now acquires a real server-created clone, asserts its .git repository exists, and performs owned read-only Git through that acquired path rather than an adopted fixture path
• release data-loss regression commits locally into a clean clone and proves release quarantines and retains the exact HEAD when the branch is absent remotely; a second advanced clone is removed only after the current branch is published to the seed-approved origin and the local HEAD is proven reachable
• runtime symlink regression replaces a lease runtime component and config/gitconfig with symlinks to protected targets; descriptor-bound O_NOFOLLOW directory/file opens reject both, while fchown/fchmod leave target bytes, ownership, and mode unchanged
• exact Nix/Kind proof asserts CAP_FOWNER is absent, prepares the lease runtime twice, and verifies every runtime directory remains UID/GID 200000 mode 0700 and gitconfig mode 0600; mode normalization occurs before ownership transfer and final metadata is re-read from the same descriptor
• core.worktree exfiltration regression poisons an acquired repository, proves raw git diff reads the external root, then proves server-owned canonical --work-tree binding prevents the read for privileged and confined Git
• adopted-workspace regression performs three acquire/release cycles, retains the adopted repository, removes every per-lease runtime tree, and compacts terminal ownership state to one record
• kubectl output regression proves a file-backed Go template can print a world-readable projected credential with raw execution, then rejects custom-columns-file, go-template-file, and jsonpath-file across short, long, equals, and attached output forms before trusted kubectl starts
• adopted persistence-failure regression makes durable lease-state rename fail after chown/staging, proves the mapping, runtime, UID cursor, and in-memory lease are rolled back, reseals the adopted repository, and successfully reacquires it after the persistence sink is restored
• real Nix/Kind upgrade proof packages and executes the chart bootstrap script against a UID-1000 checkout whose core.fsmonitor demonstrably exfiltrates GIT_TOKEN before the fix; bootstrap chowns first, atomically replaces local config with non-executable server-owned settings, succeeds without CAP_FOWNER, and never executes the marker
• real Nix/Kind Git proof creates both a tracked README modification and an untracked file, then requires confined git diff --name-only and git status --short to report each through explicit canonical --git-dir plus --work-tree binding
• one-UID allocator regression releases, restarts, and reacquires the same UID while proving a quarantined lease keeps that UID unavailable and fails closed on exhaustion
• control-tree upgrade proof seeds /workspace/.agents-shell and its contents as UID/GID 1000, proves bootstrap migrates them to root without CAP_FOWNER, rejects root/nested symlinks and hard-linked files, and verifies every server directory is contained, server-owned, mode-normalized, and scratch-cleaned at restart
• read-only Git now holds a per-lease mutation barrier, rejects tracked or escaped lease-UID processes, snapshots the no-follow single-link index into a private one-use scratch directory, grants Landlock write access only to that scratch root, and removes it after every inspection or at restart
• race regressions run a live shell_start loop rewriting filter.racing.clean, prove inspection is rejected while the writer exists and new mutation is blocked during scan-to-spawn, then prove quiescent Git reports both tracked and untracked changes without invoking the helper
• selected-base regression creates a remote-only feature/selected branch, rejects ambiguous non-origin refs, fetches the exact selected origin refspec with server-owned auth, and checks out the expected commit; exact object IDs remain allowed only when present
• real Nix/Kind proof now requires successful mutation status and bytes, tracked git diff, untracked git status, private scratch cleanup, legacy control migration, absent CAP_FOWNER, and the packaged bootstrap exploit defense
• accepted read-only Git now refreshes the disposable scratch index with fixed non-executing update-index --really-refresh before the caller command, enables optional locks only for that private scratch, and records deterministic refresh-before-command audit ordering; the Nix proof requires nonzero captured status bytes and emits the full structured result on failure
• refresh and accepted Git now use both a descriptor-created private scratch index and a descriptor-created private empty global config under the same Landlock-writable root, eliminating the exact Nix /dev/null read-write failure while preserving zero writes outside scratch
• persisted lease state is validated field-by-field before recovery: single-link server-owned state file, UUID/session/head/status/timestamp/UID/job invariants, canonical workspace/runtime containment, and active dev/inode identity; forged /etc and traversal-ID regressions prove privileged recovery never runs or mutates the protected target
• authenticated publication proof no longer runs network Git inside the lease repository: a GIT_DIR=/dev/null probe uses the approved URL directly, disables generic and GitHub-scoped proxies, forces TLS verification, carries only the server-owned header, and deletes only when the advertised branch head exactly equals local HEAD; the regression plants hostile proxy/TLS config in the lease and proves it is absent from the probe and token/audit output
• every synchronous tool and long-running job now pins cwd through an anchored component-by-component O_NOFOLLOW directory-FD walk from the validated seed/lease root; the native Landlock helper requires the inherited FD, verifies it is a directory, fchdirs before confinement/UID drop, and never re-resolves the caller path. One regression swaps a parent to a projected-secret symlink before FD acquisition and proves fail-closed; another swaps the final path after acquisition and proves the process remains on the pinned safe inode; the real native test repeats the rename/symlink attack through compiled fchdir
• read-only Git refresh and accepted commands now use a descriptor-created private scratch index, private empty global/system config, and private empty hooks directory under the sole Landlock write root; all paths are O_NOFOLLOW, type/link/UID/GID/mode verified, never lease-controlled, and removed after each inspection. The real Nix proof requires lease-free git ls-files -- README.md to return README.md while read_file cannot expose the projected service-account token
• preserved checkouts moved out of the validated control tree to a sealed root-owned sibling quarantine; legacy control-tree checkouts are migrated before symlink validation, rejected seed links are deleted, and rejected .git links are deleted before regular working bytes are preserved outside the control tree. The packaged upgrade proof runs both cases and a second bootstrap restart for each, proving no preserved symlink can poison future initialization
• active workspace acquisition now renews an existing same-subject lease from the current verified token: the TTL/token cap is recalculated, renewedAt/expiresAt are persisted and required-audited, the prior expiry timer is replaced, and any audit failure revokes fail-closed. A real job sleeps beyond the original token expiry and completes only after a later-token renewal; durable state and audit evidence remain active at the renewed deadline
• the packaged nested-metadata exploit now invokes raw root Git with an explicit safe.directory, so the real Nix proof reaches and demonstrates the intended FETCH_HEAD symlink overwrite before the shipped bootstrap rejects symlink and hard-link variants
• bootstrap discards untrusted UID-1000 legacy lease state before server startup and rejects nested .git symlinks or hard-linked files before any root Git command; the packaged proof first demonstrates raw fetch overwrites a symlink target, then proves the exact chart blocks both symlink and hard-link variants without changing the target before a clean upgrade succeeds
• core.alternateRefsCommand is neutralized in both static and dynamically discovered privileged/read-only Git configs; a real alternate object database regression proves raw git log --alternate-refs executes a helper that reads a projected token, while the accepted tool path returns no token and never invokes the helper
• generic, OpenPGP, X.509, SSH, and dynamically discovered gpg.<format>.program verifier commands are neutralized; a synthetic signed-commit regression proves raw git log --show-signature executes an OpenPGP helper that reads a projected token, while accepted inspection returns no token and never invokes the helper
• failed expiry/revocation/restart UID sweeps now persist a confinement-failure quarantine without clearing active-job evidence or freeing the UID; a descriptor-survivor regression writes through an already-open FD, proves reassignment remains blocked, then permits recovery only after a successful later sweep
• clean expired/orphaned recovery removes the prior lease runtime before releasing/compacting its record; two restart/reacquisition cycles prove prior home/cache/temp trees and their secret fixtures never accumulate
• production-isolation workflow regression requires explicit -n "${namespace}" on namespace create, pod apply/log/get, and namespace cleanup
• retention regression repeatedly creates/releases clean server clones and proves each clone/runtime/terminal record is removed, while an adopted released workspace and a dirty quarantined created workspace remain retained with subject/recovery evidence
• seed bootstrap resets credential-only umask 077 to 022, applies a+rX, and the in-image proof requires lease-free UID 65534 seed search and read-only Git success
• read-only Git adversary configures local clean/smudge/process filters with required=true, external diff/textconv, fsmonitor, pager, and interactive filter; inspection succeeds and no helper marker is created
• initialized-submodule adversary proves raw git diff --submodule=diff executes a child clean filter; the read-only policy rejects all --submodule, --recurse-submodules, and caller --ignore-submodules forms while forcing submodule.recurse=false, short submodule rendering, disabled summaries, and --ignore-submodules=all
• kubectl client-loading adversary proves a caller-selected kubeconfig executes an ExecCredential plugin; every kubeconfig, endpoint, credential, TLS, context/user/cluster, short -s, and impersonation override is rejected before the trusted kubectl process starts
• kubectl adversary plants an executable kubeconfig plugin under the writable lease HOME; direct kubectl, delegated status, and delegated logs use HOME=/nonexistent, KUBECONFIG=/dev/null, retain only in-cluster discovery, and never execute the plugin or receive GitHub secrets
• explicit grep-pager adversary covers short, attached, combined, full long, equals, and abbreviated forms and proves no command, service-account read, or cluster action
• stateful request authorization is immutable and request-local through AsyncLocalStorage, while per-session validation/dispatch is serialized; a deterministic overlap regression pauses an anonymous request, authenticates a foreign subject concurrently, then proves the anonymous request revokes the session and the foreign request receives 404 with no kubectl execution
• chart defaults retain the deployed pre-isolation non-root UID/GID 1000 context with no added capabilities; the normal image promotion renderer atomically pins the lease-aware digest, enables seedReadOnly, and writes root plus exactly CHOWN/DAC_OVERRIDE/KILL/SETGID/SETUID
• exact-head Kind runs the built agents-shell image as root with only CHOWN/DAC_OVERRIDE/KILL/SETGID/SETUID, requiring UID/GID 200000 owned mutation/search/Git success, lease-free UID 65534 seed inspection, and foreign-subject search/Git rejection before integration smoke
• complete 20-tool wire payload remains 19,706 bytes, 4,870 below the explicit 24,576-byte startup ceiling

Breaking Changes

Agents-shell write tools require an authenticated stateful MCP session and active workspace lease. Stateful and read-only access to a leased workspace remains bound to that lease subject and UID. Stateless reads remain limited to the shared read-only seed.

Checklist

• Testing and local environment exceptions are documented.
• Screenshots are not applicable; breaking behavior is documented.
• Rollout follows the normal image/GitOps promotion path without bypasses.

[linear-code]

PROOMPT-440

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 88ed6002fc

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 4af2edfb73

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 6517ce057e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c560af0ab9

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 90455a6917

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 050aaaaf7b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a12e6cb92f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 448f1b7682

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 9d4ac8583e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 6c56aa640e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

lab/services/agents/src/server/agents-shell/cli-policy.ts

Lines 88 to 94 in d3eeeef

	if (READ_ONLY_KUBECTL_COMMANDS.has(command)) {
	if (command === 'auth' && !READ_ONLY_KUBECTL_AUTH_COMMANDS.has(args[1] ?? '')) {
	throw new Error(
	'kubectl auth supports read-only subcommands only; use kubectl_admin for other kubectl auth calls',
	)
	}
	return

Reject caller-selected kubeconfigs in read-only kubectl

Fresh evidence beyond the environment-only kubeconfig fix is that this branch accepts every argument after an allowlisted verb, so ['get', 'pods', '--kubeconfig=/leased/path/config'] overrides KUBECONFIG=/dev/null; the kubectl get parent options describe --kubeconfig as the path used for CLI requests. A lease owner can plant a kubeconfig containing an exec credential plugin, which kubectl then launches under the inspection identity; in the inspected production deployment that process can read the projected service-account credential and use the unrestricted egress plus cluster-admin binding to mutate the cluster through a tool declared read-only. Reject kubeconfig/credential/endpoint overrides or enforce a server-owned loading configuration that caller arguments cannot replace.

AGENTS.md reference: AGENTS.md:L97-L97

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[gregkonush]

Exact head 393bdbff199f84d6fad2b2ae4641300af2d4b516 also closes the review-body P1 on caller-selected kubectl client configuration. A real adversarial kubeconfig with an ExecCredential plugin is executed by raw kubectl first. The agents-shell read policy then rejects every separate/equals kubeconfig, server (--server and -s forms), token, client certificate/key, CA, insecure TLS, TLS server name, context, cluster, user, username/password, and impersonation override before kubectl starts; the plugin marker remains absent. The existing server-owned HOME=/nonexistent, KUBECONFIG=/dev/null, secret-free in-cluster environment remains unchanged.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 393bdbff19

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 3b4312a292

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: df3af813de

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: d9d3ffe035

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 4934c509b2

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 865752b024

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ad0ce955dd

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: f76b70047c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 8bf488c636

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e067803fb4

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

lab/services/agents/src/server/agents-shell/http.ts

Lines 321 to 322 in a63d396

	process.once('SIGTERM', () => runner.shutdown())
	process.once('SIGINT', () => runner.shutdown())

Stop the Bun server after handling termination signals

During Kubernetes termination, installing these signal listeners suppresses Bun's default exit behavior, but the callbacks only shut down the runner and never call server.stop() or exit. I reproduced this with the checked Bun runtime: a Bun.serve process with the same process.once('SIGTERM', ...) pattern remained alive and continued serving requests after SIGTERM. Consequently every agents-shell rollout waits for the chart's 30-second termination grace period and ends in SIGKILL; the shutdown handler should also stop the HTTP server and let the process terminate.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[gregkonush]

Published on exact-main head 732c927f91b55e46821f077119a4f0cae0cc43ba: SIGTERM/SIGINT now run an idempotent shutdown handler that stops Bun.serve, shuts down the runner, removes both signal listeners, and exits only after the server closes. Added a real child-process regression that starts the actual Bun server, sends SIGTERM, and proves exit code 0 within the bounded deadline; isolation/MCP matrix is 82 passed with 2 expected root-only skips. The same head also replaces only the agents-shell image Git with a source-patched build that skips Git 2.51.2’s unconditional /dev/null O_RDWR startup open when fds 0-2 are valid, retaining the existing no-follow UID-owned scratch index/private config as the sole read-only Landlock write root.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b57e16dacc

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 493669115f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 99413e127f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 16603fb964

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Sweep the lease UID when shell jobs time out

When a shell_start command ignores SIGTERM or moves a descendant into another process group with setsid, this timeout changes the job to timed_out but kills only the original process group. The surviving process can continue modifying the leased workspace, and because runningJobs() counts only running jobs, repeated timeouts can also bypass maxConcurrentJobs; use the same UID-wide sweep and stream cleanup already used by synchronous mutating-tool timeouts.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Discard stale token-expiry callbacks after refresh

When one stateful request holds dispatchTail, a same-subject refresh request can authenticate and queue before the old token expires, after which the old timer fires and queues this unconditional close behind the refresh. The refresh then schedules the new deadline, but the already-queued callback still runs next and revokes the valid session and its renewed lease; capture the scheduled expiry or a generation and recheck it when the callback reaches the dispatch queue.

Useful? React with 👍 / 👎.