sayan-oai

Honor per-environment login shell policy (#36811) ## What changed - Store the effective `allow_login_shell` setting on each turn environment, including inherited environments whose child thread has a different policy. - Expose the `login` argument for shell tools when any selected environment permits login shells. - Validate each command against the policy of its selected environment instead of the turn-wide configuration. ## Testing - Cover tool schema generation for single and multiple environments. - Cover login-shell rejection by both the command handler and the unified exec integration. GitOrigin-RevId: 5a93149a5c86f4087f2b92d663ebc33feff8a57c

Enforce environment MCP policies (#39335) ## What changed - Add environment-provided MCP restrictions for configured and plugin-provided servers. - Disable attachment-scoped servers while their environment configuration is pending, failed, or unselected, while preserving selected-plugin access and the controller-owned Apps server. - Apply the resolved policy to runtime startup, model tool exposure, telemetry, OAuth flows, and skill dependency installation. ## Testing - Cover policy filtering for configured and plugin servers, environment state transitions, Apps ownership, and managed OAuth rejection. GitOrigin-RevId: 7ca5d4dda14068e758497f88835d5cba685e159e

Keep step settings and approval environments consistent (#46556) ## Why Background processes can outlive their launching turn. Their approval reviews need the originating environment's filesystem restrictions, even when the active turn uses a different environment. Remote restrictions must also be resolved using executor paths rather than the local filesystem. ## What changed - Capture settings and environment selections together in `StepInputs`. Preserve the captured selection during active model updates while allowing environment startup to finish. - Carry environment IDs into Guardian network and `execve` requests, and use the owning process's environment with current review settings. Refresh environment readiness for network requests that fall back to the active turn. - Resolve remote denied paths and globs using the executor's policy context. Decline automatic approval when the request's environment is unavailable or an explicitly denied temporary directory cannot be resolved. ## Testing Add regression coverage for active model updates retaining their environment while the next turn adopts a new selection, background approvals using their owning environment, newly ready network environments, and remote denied paths and globs, including Windows paths and missing temporary-directory metadata. GitOrigin-RevId: b620d4b030c597a4f430fe0500864fa5469db3d4

Allow environment selection updates during an active turn (#47435) ## What changed - Add `environments` to `TurnSettingsUpdate` to replace the selection for subsequent steps without changing future turns. - Capture model settings and environments together so combined updates apply or reject atomically, while existing steps retain their captured selection. - Validate environment IDs, working directories, configuration ownership, and permission requirements against the running turn's selections. - Preserve executor startup behavior when switching environments and use the step's local working directory for tool hooks. ## Testing Add coverage for workspace switching and restoration on the next turn, atomic model and environment updates, permission validation, executor connection waits, and replacement of pending environment selections. GitOrigin-RevId: 02b5c57a78fd594b2aed84fc09d9e99eb97be28c

Defer environment selection changes until the next turn (#46310) ## Why Updating environment selections while a turn is running must not redirect its tools or prevent its pending environment setup from completing. ## What changed - Store future environment selections separately from active environments, and activate them when preparing new work with no task running. - Keep turn contexts and MCP workspace roots tied to the active environment snapshot. Report saved selections through thread settings and `environment_selections()`. - Route environment configuration and failure callbacks to matching active or future selections so each can finish setup independently. - Stop the running task before manual compaction adopts the saved environments. ## Testing Add regression tests that preserve a running task's working directory and workspace roots, then adopt the saved selection for the next task. Add remote environment coverage showing that future setup can complete while the active turn waits, with each turn receiving its own capability roots. GitOrigin-RevId: 09a6b90131d2ab2441ce2fe9b0368a3668889f31

Honor attachment-owned permissions for MCP servers (#40728) ## Why MCP servers attached to executor environments must retain their owner's permission profile instead of inheriting the thread-wide sandbox authority. ## What changed - Resolve and capture a permission profile for each enabled MCP server when publishing the runtime, and reject calls or elicitations when that authority is unavailable. - Use the captured server profile for tool approval decisions, elicitation, and sandbox metadata, including after runtime refreshes. - Materialize `:workspace_roots` from `PathUri` values so permissions preserve the path convention of remote executor environments. - Give threadless app discovery and resource reads an explicit default permission profile. ## Testing Added coverage for per-server elicitation authority, unresolved attachments, runtime refreshes, restricted tool calls, and foreign-platform workspace roots. GitOrigin-RevId: 6b188d4b08b29e9971ff7aa68a7785a0cdf9e394

Use turn environment permissions for tool execution (#37038) ## What changed - Derive sandboxing, approval, and permission-profile environment variables from the selected turn environment for shell, unified exec, `apply_patch`, image viewing, and network approval flows. - Materialize project-root permissions against every workspace root in that environment, allowing `apply_patch` to write to secondary workspace roots while preserving protected paths. - Carry the selected environment's permission profile into spawned or resumed agents and Guardian permission context. ## Testing - Add an integration test covering `apply_patch` writes in a secondary workspace root. - Extend tool, Guardian, and multi-agent tests to distinguish environment permissions from thread-level permissions. GitOrigin-RevId: e22da8974bcd3de1e724978b1a7790307a51e4bc

Use step environments for Guardian approval reviews (#37618) ## Why Deferred environments can become ready after a turn starts. Guardian approval reviews must use the environment selected for the current step so their working directory and permission context are not taken from the stale turn snapshot. ## What changed - Carry `StepContext` through tool execution and approval handling. - Add a Guardian review context that pairs the parent turn with the current step's environment snapshot. - Use that snapshot for Guardian prompts, reviewer sessions, and delegated reviewer threads while retaining turn-level fallbacks for callers without a step context. ## Testing Added an integration test that makes a deferred remote environment ready before an escalated command and verifies Guardian receives that environment's working directory and denied-read policy instead of the initial local environment's. GitOrigin-RevId: 779096bc7d0e0c7453a009c02141029714b9b407

Separate thread settings from environment configuration (#39597) ## Why Environment-owned permission profiles and workspace roots must remain effective without being persisted or restored as thread-owned settings. ## What changed - Keep thread settings snapshots and restore data separate from the effective configuration supplied by the primary environment. - Use resolved environment permissions, active profiles, workspace roots, and network policy when building turn context and session events. - Preserve environment selections when agents are evicted, resumed, or spawned, and validate owner configuration when it becomes ready. - Start memory initialization only after the primary environment is configured. ## Testing - Extend remote-environment and multi-agent tests to cover settings persistence, owner permission profiles, workspace roots, spawning, eviction, and resume. GitOrigin-RevId: d82f126981cd0190233020bbdd61d96c70558868

Enforce environment network policies for remote execution (#39980) ## Why `EnvironmentConfig.network_policy` could describe attachment-owned traffic restrictions, but core rejected every configured policy because execution did not enforce it. ## What changed - Resolve each remote environment's network policy for the selected command and apply it to the execution-scoped proxy. - Compose owner rules with controller constraints and saved network decisions while preserving inherited domain and Unix-socket denials. - Keep strict allowlists non-expandable, allow reviewable policies to use network approvals, and reject sandbox escalation that would bypass an owner policy. - Reject policies for local execution, disabled managed enforcement, or a disabled controller proxy. ## Testing Added coverage for policy composition, scoped remote proxy behavior, approval and denial flows, offline execution, and unsupported environment authority. GitOrigin-RevId: d9331f616df24de6cd13ed68196f0ff7b0ca4dd9