Sandboxed agent actions pause for automatic approval after external context

[RaresKeY]

Prerequisites

• I searched open and closed issues, open pull requests, and discussions for agent-action approvals, approval gates, external context, sandboxed execution, and tainted tool results. Add Codex-style sandboxed agent execution for safer use with untrusted content #4754 and Make agent execution authority deterministic across untrusted context and privileged tools #5815 own the broader sandbox/execution-authority work, while Proposal: a 5-mode composer (Plan / Manual / Accept-Edits) with server-side permission enforcement #553 describes related permission modes; no existing issue owns this temporary default-on gate behavior as a focused bug.
• This is not a security vulnerability. It is a temporary agent execution behavior that should be disabled while the stronger sandbox and longer-term authority model remain under review.
• I confirmed the deterministic policy path on current dev at 032967af. The current regression suite explicitly verifies that external tool output arms the gate and a later Bash action is denied.

Odysseus Revision

032967a (2026-08-17)

Install Method

Manual Python install (pip / venv)

Operating System

Linux

Steps to Reproduce

1. Check out current dev and start an Agent turn in the default sandboxed execution mode.
2. Let the agent receive a model-visible external tool result, such as a web search result.
3. Let the same run request a later sandboxed action such as Bash.
4. Observe that the run pauses and emits an exact-action approval request instead of continuing under the selected sandbox boundary.

Expected Behaviour

After the process-sandbox slice lands, agent-requested actions should continue inside the selected server-enforced process boundary without an additional automatic per-action approval card.

Actual Behaviour

Model-visible external content arms ToolRunSecurityContext, and later actions with workspace, process, network, private-data, UI, admin, or destructive effects are denied until an exact approval is recorded. This interrupts the normal sandboxed agent flow even though the automatic gate was intended as a temporary layer.

Logs / Screenshots

External untrusted context has already influenced this run. Tool 'bash' requires a separate user-authorized action because it can cause execute_code.

The current decision path blocks the action at src/tool_capabilities.py:627, and the existing regression demonstrates the web-result-to-Bash transition at tests/test_external_context_tool_gate.py:98.

Model / Backend (if relevant)

Not model-specific. Server-owned Agent tool policy.

Are you willing to submit a fix?

Yes — I can open a focused PR.

Additional Information

Parent tracker: #5815. Broader sandbox issue: #4754. This transition slice should land after sandbox child #6091 / PR #5818 and before authority-mode child #6092 / PR #5819.

The narrow fix should add one explicit disabled-by-default switch, return an allow decision before the dormant gate logic, preserve the legacy gate coverage by opting it in inside that test module, and add a regression for the production default. It must not remove or bypass Bubblewrap sandboxing, add Full Access behavior, change Teacher persistence, or absorb provenance tracking. The rest of the disabled automatic approval implementation should be deleted in a separate follow-up so this transition change does not expand into approval-store, continuation, frontend, or unrelated persistence cleanup.