feat(core): zsh exec bridge

[owenlin0]

zsh fork PR stack:

• feat(core): plumb distinct approval ids for command approvals #12051
• feat(core): zsh exec bridge #12052 👈

Summary

This PR introduces a feature-gated native shell runtime path that routes shell execution through a patched zsh exec bridge, removing MCP-specific behavior from the shell hot path while preserving existing CommandExecution lifecycle semantics.

When shell_zsh_fork is enabled, shell commands run via patched zsh with per-execve interception through EXEC_WRAPPER. Core receives wrapper IPC requests over a Unix socket, applies existing approval policy, and returns allow/deny before the subcommand executes.

What’s included

1) New zsh exec bridge runtime in core

• Wrapper-mode entrypoint (maybe_run_zsh_exec_wrapper_mode) for EXEC_WRAPPER invocations.
• Per-execution Unix-socket IPC handling for wrapper requests/responses.
• Approval callback integration using existing core approval orchestration.
• Streaming stdout/stderr deltas to existing command output event pipeline.
• Error handling for malformed IPC, denial/abort, and execution failures.

2) Session lifecycle integration
SessionServices now owns a ZshExecBridge.
Session startup initializes bridge state; shutdown tears it down cleanly.

3) Shell runtime routing (feature-gated)
When shell_zsh_fork is enabled:

• Build execution env/spec as usual.
• Add wrapper socket env wiring.
• Execute via zsh_exec_bridge.execute_shell_request(...) instead of the regular shell path.
• Non-zsh-fork behavior remains unchanged.

4) Config + feature wiring

• Added Feature::ShellZshFork (under development).
• Added config support for zsh_path (optional absolute path to patched zsh):
• Config, ConfigToml, ConfigProfile, overrides, and schema.
• Session startup validates that zsh_path exists/usable when zsh-fork is enabled.
• Added startup test for missing zsh_path failure mode.

5) Seatbelt/sandbox updates for wrapper IPC

• Extended seatbelt policy generation to optionally allow outbound connection to explicitly permitted Unix sockets.
• Wired sandboxing path to pass wrapper socket path through to seatbelt policy generation.
• Added/updated seatbelt tests for explicit socket allow rule and argument emission.

6) Runtime entrypoint hooks

• This allows the same binary to act as the zsh wrapper subprocess when invoked via EXEC_WRAPPER.

7) Tool selection behavior

• ToolsConfig now prefers ShellCommand type when shell_zsh_fork is enabled.
• Added test coverage for precedence with unified-exec enabled.

[owenlin0]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 92b057f8c1

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[bolinfest]

Onward!