pstack-runner: allow full-access sandbox for Codex writer lanes so they can self-verify

[vacq-am]

Problem

skills/poteto-mode/scripts/runner/commands.ts maps isolated-write to codex exec --sandbox workspace-write. On macOS that sandbox blocks launching a browser (Playwright/Chromium fails with bootstrap_check_in ... Permission denied), reaching the Docker socket, and writing into dot-folders such as .agents/. A Codex builder lane therefore cannot run the browser or database checks that prove its own work, which the Feature playbook's step 5 ("verify on the matching surface") expects. The user's own Codex config (sandbox_mode = "danger-full-access") is ignored because the flag on the command line wins.

Observed

A poteto-mode Feature run on 2026-09-21: builders reported EPERM on node_modules/.tmp and .vite-temp inside a symlinked worktree, "operation not permitted" writing under .agents/, Chromium launch denied, and Docker unreachable. The orchestrator had to run all browser and database verification itself, and four fixer rounds followed for assumptions the lane could not test.

Request

A configuration knob (for example an access field on the model sheet, an isolated-write-full mode, or an environment variable read by the runner) that lets a writer lane run with danger-full-access when the user opts in. The dedicated worktree already provides the isolation the runner cares about. Until then users must patch codexSandbox() locally and reapply it after every update; the uses bounded write modes without blanket bypasses test pins the current behaviour.

[mast-factory]

Type	feature request — Codex writer lanes intentionally use the bounded workspace-write sandbox; this requests an explicit opt-in to host-level danger-full-access for stronger self-verification.
Route	Await approval
Severity	🟡 medium — browser, Docker, and some dot-directory verification are blocked for affected macOS Codex writer lanes, but parent-side verification and local patching remain available.
Confidence	high — the command mapping, public mode surface, tests, policy, and introduction history all explicitly enforce the current bounded behavior.
Effort	medium — an approved opt-in spans runner option/config design, validation, command construction, policy/docs, focused tests, and live macOS verification.
Impact	medium — affected Codex-backed bug-fix, performance, hillclimb, and arena writer lanes cannot independently exercise important matching surfaces, increasing orchestrator work and fixer rounds.
Next step	Decide whether Open Pstack should expose a host-full-access Codex writer opt-in; if approved, plan a provider-specific, explicit setting that preserves workspace-write as the default.

Understanding

plugins/pstack/skills/poteto-mode/scripts/runner/commands.ts:45-47 maps Codex read-only to read-only and every writer invocation to workspace-write. The generated command also pins the assigned cwd and disables plugins, multi-agent, hooks, memories, and session persistence, but --cd and a dedicated worktree are organizational boundaries rather than host-security boundaries. A danger-full-access child could intentionally access the browser, Docker socket, and paths outside that worktree.

The behavior is deliberate rather than a regression: types.ts:4 and cli.ts:16-18,59-108 expose only read-only|isolated-write; commands.test.ts:116-147 explicitly asserts “bounded write modes without blanket bypasses”; and the implementation, tests, and provider-dispatch policy arrived together in release-sync commit de67e6b on September 10, 2026, with no later revision. The runner's explicit --sandbox workspace-write also explains why a user's ambient Codex sandbox_mode = "danger-full-access" does not control these lanes.

The request is nevertheless well motivated. The bug-fix, performance, and hillclimb playbooks default writer delegation to Codex with isolated-write, while matching-surface verification can require Chromium, Docker, or dot-directory writes. The reported September 21, 2026 Feature run therefore had to move browser/database checks back to the orchestrator and needed four fixer rounds.

If approved, keep workspace-write as the default and add an explicit Codex-only writer opt-in rather than silently elevating permissions after a sandbox failure or changing all isolated-write lanes. Reject full access for read-only and non-Codex providers; preserve assigned cwd, ephemeral execution, anti-recursion/ambient-feature controls, receipts, and dedicated-worktree requirements. Update command/CLI tests and provider-dispatch policy to distinguish preselected user policy from forbidden automatic elevation. Live acceptance should cover Chromium launch, Docker access, a required dot-directory write, receipt/model verification, and unchanged default/read-only behavior on macOS.

Related issue #34 is analogous only in using a provider-specific permission choice: its Grok proposal retains the workspace sandbox. Issue #78 concerns Grok failure evidence. No prior Codex full-access issue or merged implementation was found; PR #59 concerns Codex setup/output parsing rather than sandbox access.

Assumptions

• This is classified as a feature request, not a bug, because the bounded mapping is documented, tested, and unchanged since introduction.
• The reporter's macOS browser/Docker/dot-directory failures are attributable to Codex workspace-write; local command generation confirms that sandbox is forced, but this environment lacks the Codex CLI for an independent live provider run.
• The safe default is unchanged bounded access; any broader access must be explicit and provider-specific.
• A dedicated worktree limits intended edit scope but does not itself sandbox a danger-full-access process from the rest of the host.

Open questions

• Does the project want to support an explicit host-full-access option for Codex writer lanes despite the current bounded-provider policy? The exact configuration surface can be selected during planning if approved.

Reproduction

Live macOS reproduction was not available in this Linux triage sandbox, and the codex executable is not installed. A Node 24 source-level probe imported invocationCommand() with provider codex and mode isolated-write; it produced codex exec ... --sandbox workspace-write --cd /tmp/worktree ..., confirming the forced mapping and ambient-config override path. Git blame/history and the focused command tests independently confirm that result. Bun-based tests could not be rerun because Bun is absent from the triage environment.