chore(sync): merge main into kontext-dev

[michiosw]

Hard-cutover sync stage 2: merge updated main into kontext-dev using a real merge commit (no squash).

---

[kontext-review]

⚠️ Kontext Review: REQUEST_CHANGES (2 findings, Advisory)

Verification certificate:

• Verdict: REQUEST_CHANGES
• Depth: full
• Confidence: 0.75
• Certificate valid: yes
• Scenarios traced: 1
• Verification bounds:
  • Changed files and explicitly traced call paths

Inline findings posted:

• [LOW][correctness] Correct Handling of Inherited File Descriptors (unknown:1)
• [LOW][maintainability] Improved Lifecycle Management for Escalation Server (unknown:1)

Reviewer summary:

• This pull request, despite its title suggesting a simple sync, introduces a significant refactoring and feature enhancement related to shell command execution on Unix-like systems. The core changes involve integrating the zsh-fork shell escalation backend with the unified_exec tool, which was previously only available for the shell_command tool.
• A new EscalationSession struct is introduced to robustly manage the lifecycle of the escalation server, its background task, and the associated socket file descriptor. This improves resource management and correctness through its Drop implementation.
• A generic after_spawn hook has been plumbed through the process execution stack. This hook is used by the zsh-fork backend to correctly close the parent process's copy of the inherited socket file descriptor immediately after the child process is spawned, which is a critical pattern for correctness in this scenario.
• The changes are architecturally sound, with platform-specific logic being well-encapsulated. The integration with unified_exec allows PTY-based sessions to benefit from the fine-grained command interception provided by the zsh-fork mechanism.

Scores and diagnostics

• Architecture: 7.0/10
• Organization: 7.0/10
• Cleanliness: 7.0/10
• Overall: 7.0/10
• Candidate findings: 2
• Published inline: 2
• Published summary-only: 0
• Suppressed findings: 0
• Verification verdict: REQUEST_CHANGES

Limitations

• This review is based on static analysis of the provided diff and does not include runtime testing.

• The verification assumes that the underlying operating system's execve and file descriptor inheritance semantics behave as expected.

• The effectiveness of the zsh-fork command interception itself is outside the scope of this review, which focuses on the integration and lifecycle management aspects.

• Model: gemini-3.1-pro-preview

• Omitted files: 0

Generated at 2026-03-05T09:08:38.827Z.

[devin-ai-integration]

Devin Review found 1 potential issue.

View 5 additional findings in Devin Review.

[devin-ai-integration]

🔴 Single-use helper execute_exec_request_with_after_spawn violates AGENTS.md rule

AGENTS.md states: "Do not create small helper methods that are referenced only once." The function execute_exec_request_with_after_spawn at codex-rs/core/src/sandboxing/mod.rs:428-435 is a 7-line wrapper around execute_exec_request and is called exactly once, at codex-rs/core/src/tools/runtimes/shell/unix_escalation.rs:768. The caller should directly invoke execute_exec_request (as codex-rs/core/src/tasks/user_shell.rs:180 already does) instead of going through this single-use wrapper.

Prompt for agents

Remove the single-use helper function `execute_exec_request_with_after_spawn` from codex-rs/core/src/sandboxing/mod.rs (lines 428-435). In its single call site at codex-rs/core/src/tools/runtimes/shell/unix_escalation.rs line 768, replace the call with a direct invocation of `execute_exec_request`, inlining the sandbox_policy clone. For example, change:

  let result = crate::sandboxing::execute_exec_request_with_after_spawn(
      exec_request,
      None,
      after_spawn,
  ).await?;

to:

  let effective_policy = exec_request.sandbox_policy.clone();
  let result = crate::exec::execute_exec_request(
      exec_request,
      &effective_policy,
      None,
      after_spawn,
  ).await?;

This matches the pattern already used at codex-rs/core/src/tasks/user_shell.rs:180.

---

Was this helpful? React with 👍 or 👎 to provide feedback.