Environment
- Maka commit
58465213, CLI 0.2.0
- macOS 26.6.1 (arm64)
- Node.js 24.19.0
- TUI entry point:
packages/cli/dist/dev-cli.js
- Connection: Custom relay (OpenAI Chat-compatible), captured between Maka and the relay
Summary
After switching a production TUI session to Full access, the Runtime ledger correctly records a bypass sandbox boundary, but the composed model tool surface continues to describe a boundary that the host will not enforce. Bash still advertises boundary_intent and required_boundary, and the composition layer still includes the request_sandbox_boundary capability.
buildManagedBashTool already supports declareSandboxBoundary: false and explicitly documents that parameters no host enforces are pure noise. buildBuiltinTools does not expose or forward that option, while interactive-run-composer.ts has the session permission mode but does not use it when projecting the built-in tool surface.
Evidence
- In the original Full access capture, 87/87 provider requests still carried both
boundary_intent and required_boundary in the Bash schema even though sandbox_boundary_log recorded {"kind":"bypass"}.
- The provider-visible Bash description still ended with
Enforced by the current session sandbox boundary.
- A direct factory comparison produced six fields through
buildBuiltinTools({ shellRuns }):
command, timeout_ms, run_in_background, pty, boundary_intent, required_boundary.
- The same managed Bash factory with
declareSandboxBoundary: false produced only four fields:
command, timeout_ms, run_in_background, pty.
This is the provider-visible reproduction requested when item 8 of #4267 withdrew the earlier schema-boilerplate change.
Why it matters
The optional nested boundary schema is also the point where we saw OpenAI models on a Chat-compatible relay degenerate into whitespace-only tool-argument streams (#4861). Full access should be the clean way around that schema, but today it keeps sending it.
Even without that provider behavior, advertising ignored boundary arguments and an inapplicable expansion tool gives the model a false description of the active execution contract.
Expected behavior
- Full access (
permissionMode: bypass) advertises Bash without boundary_intent or required_boundary and without the boundary-enforcement description suffix.
- Full access composition omits
request_sandbox_boundary because a bypass boundary has nothing to expand.
- Auto modes (
ask and explore) keep the existing six-field Bash schema and the boundary-request capability.
- Switching back from Full access restores the Auto tool surface on the next composed run.
Scope note
This issue is only about projecting the model-visible tool surface from the permission mode already available during run composition. It does not change sandbox execution, boundary persistence, or the Auto-to-Bypass refresh behavior tracked in #3349.
Environment
58465213, CLI0.2.0packages/cli/dist/dev-cli.jsSummary
After switching a production TUI session to Full access, the Runtime ledger correctly records a
bypasssandbox boundary, but the composed model tool surface continues to describe a boundary that the host will not enforce. Bash still advertisesboundary_intentandrequired_boundary, and the composition layer still includes therequest_sandbox_boundarycapability.buildManagedBashToolalready supportsdeclareSandboxBoundary: falseand explicitly documents that parameters no host enforces are pure noise.buildBuiltinToolsdoes not expose or forward that option, whileinteractive-run-composer.tshas the session permission mode but does not use it when projecting the built-in tool surface.Evidence
boundary_intentandrequired_boundaryin the Bash schema even thoughsandbox_boundary_logrecorded{"kind":"bypass"}.Enforced by the current session sandbox boundary.buildBuiltinTools({ shellRuns }):command,timeout_ms,run_in_background,pty,boundary_intent,required_boundary.declareSandboxBoundary: falseproduced only four fields:command,timeout_ms,run_in_background,pty.This is the provider-visible reproduction requested when item 8 of #4267 withdrew the earlier schema-boilerplate change.
Why it matters
The optional nested boundary schema is also the point where we saw OpenAI models on a Chat-compatible relay degenerate into whitespace-only tool-argument streams (#4861). Full access should be the clean way around that schema, but today it keeps sending it.
Even without that provider behavior, advertising ignored boundary arguments and an inapplicable expansion tool gives the model a false description of the active execution contract.
Expected behavior
permissionMode: bypass) advertises Bash withoutboundary_intentorrequired_boundaryand without the boundary-enforcement description suffix.request_sandbox_boundarybecause a bypass boundary has nothing to expand.askandexplore) keep the existing six-field Bash schema and the boundary-request capability.Scope note
This issue is only about projecting the model-visible tool surface from the permission mode already available during run composition. It does not change sandbox execution, boundary persistence, or the Auto-to-Bypass refresh behavior tracked in #3349.