Add synchronous ACP harness tool interception

[xeophon]

Overview

Add synchronous native tool interception to ACP-backed coding harnesses while retaining Bash as the built-in reference path. Task request policies can block proposed tools before execution and replace completed results before the harness advances to the next model turn.

Details

• Add a rollout-scoped tool-policy endpoint with a capability separate from model inference and task state.
• Route Claude Code SDK hooks through LiveACPClient permission metadata, keeping the policy bearer out of the agent process.
• Connect Codex through trusted native PreToolUse and PostToolUse hooks while codex-acp continues to own the ACP session.
• Connect Pi through its built-in awaited tool_call, tool_result, and message_end extension events.
• Preserve approved results exactly in the canonical trace, serialize concurrent callbacks, and fail the rollout if a required native hook is skipped.
• Keep generic ACP tool updates observational; a harness advertises interception only when it owns an awaited execution boundary.

---

Note

High Risk
Changes authentication boundaries, synchronous tool gating, and trace commit ordering across multiple agent harnesses; mis-sequencing or credential exposure could block rollouts or leak secrets into model-controlled subprocesses.

Overview
Adds synchronous native tool interception so task request interceptors and stops run at real tool boundaries—before execution and before the harness advances to the next model turn—not only on model HTTP traffic.

The interception server now issues a separate tool_secret (fourth slot capability) for POST /tool, with serialized handling, fatal_error for non-retryable tool failures, and stricter sequencing in RolloutSession.handle_tool (assistant-node keyed state, before/after phases, allow/rewrite/stop).

Harness wiring: tool_interception is a (url, secret) tuple passed through sessions. Bash delivers the tool bearer via run_with_input on stdin instead of argv/env. Pi installs tool_hook.mjs with one-shot credential files. Claude Code and Codex add wrapper.mjs / tool_hook.mjs bridges; ACP LiveACPClient routes permission requests to /tool. require_terminal_tool_status fails ACP runs that end with unfinished tool calls.

Rollouts enable the path only when the harness advertises SUPPORTS_TOOL_INTERCEPTION and request policies exist; after each turn they verify terminal tool calls were observed. Node is bumped to 22.21 for env-proxy support.

^{Reviewed by Cursor Bugbot for commit d22f55d. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Add synchronous ACP harness tool interception

• Adds SUPPORTS_PRE_TOOL_INTERCEPTION and SUPPORTS_POST_TOOL_INTERCEPTION flags to harnesses, replacing the single interception capability flag.
• Implements configure_tool_interception for Codex, Pi, Claude Code, and Bash harnesses, installing hooks or wrappers that route tool calls and results to an external policy endpoint.
• Updates RolloutSession in session.py to track native tool approvals per tool call, enforce pre/post sequencing invariants, and surface unrecoverable errors via fatal_error.
• Adds a /tool endpoint and tool_secret provisioning to InterceptionServer in server.py, and a run_with_input method to Runtime in base.py to securely pass secrets via stdin.
• Risk: Slot in base.py expands from a 3-tuple to a 4-tuple to include tool_secret; Node.js requirement bumped to 22.21.0 in node.py.

^{Macroscope summarized 3325ab5.}

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This PR adds a substantial new feature: synchronous tool interception for multiple agent harnesses (Bash, Claude Code, Codex, Pi). It introduces new JavaScript hook files, new session state tracking with locking, new error handling paths, and significant changes to request interception logic. The scope and complexity warrant human review.

^{You can add or adjust custom eligibility rules. Learn more.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 4edcd30858

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 68941f52ef

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e34d4e0758

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: df227d6ee3

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: cccba87422

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 4726f72bce

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a6d70fd828

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

verifiers/verifiers/v1/interception/tool_hook.mjs

Line 132 in e167ed4

return claudeContent(hook.tool_response.stdout, hook.tool_name);

Include Claude Bash stderr in the intercepted result

For a successful Bash command that writes to stderr, this sends only stdout to /tool, so native request policy cannot inspect the agent-visible stderr and caches a different prepared result; when Claude includes that stderr in the subsequent model request, the policy runs again at the model boundary. Fresh evidence beyond the earlier structured-result concern is that the current claudeToolOutput explicitly clears stderr when applying a rewrite, while this allow-path normalization silently discards it.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 4050c7f1b2

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 0a04144d22

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

There are 2 total unresolved issues (including 1 from previous review).

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want reviews to match your repository better? Bugbot Learning can learn team-specific rules from PR activity. A team admin can enable Learning in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit cc17ea5. Configure here.}