@namzu/sdk 44.3.0 → 45.0.0

package/src/runtime/query/executor.ts

@@ -1,6 +1,7 @@
 import { join } from 'node:path'
 import type { Span } from '@opentelemetry/api'
 import type { AuthorizationGate } from '../../authorization/gate.js'
+import { type SkillGrantSet, compileSkillGrant } from '../../authorization/skill-grant.js'
 import { extractFromToolCall, extractFromToolResult } from '../../compaction/extractor.js'
 import type { WorkingStateManager } from '../../compaction/manager.js'
 import { GENAI, NAMZU } from '../../constants/telemetry/index.js'
@@ -10,7 +11,8 @@ import { ProbeVetoError } from '../../probe/errors.js'
 import { probe as defaultProbeRegistry } from '../../probe/registry.js'
 import type { ProbeEnforcement } from '../../probe/registry.js'
 import type { ActivityStore } from '../../store/activity/memory.js'
-import { SKILL_TOOL_NAME } from '../../tools/builtins/skill.js'
+import { sandboxShellSpawn, withoutBashStartup } from '../../tools/command-shell.js'
+import { isAlwaysDestructive } from '../../tools/defineTool.js'
 import { createFileReadTracker } from '../../tools/file-read-tracker.js'
 import { pathOutsideRoots, toolRoots } from '../../tools/paths.js'
 import type { ToolResultGuardrailSpec } from '../../types/guardrail/index.js'
@@ -33,6 +35,7 @@ import type {
 	FileReadTracker,
 	PreparedToolExecution,
 	RequestToolPause,
+	ShellDialect,
 	SkillRegistryRef,
 	ToolContext,
 	ToolDispatchOptions,
@@ -449,6 +452,12 @@ export interface ToolExecutorConfig {
 	authorizationGate?: AuthorizationGate
 	/** Durable refusal sink paired with {@link authorizationGate}. */
 	recordAudit?: (input: AuditEventInput) => Promise<unknown>
+	/**
+	 * Where the `skill` tool's `allowed-tools` pre-approvals are recorded for
+	 * this turn. The review phase reads the same set. Absent: a loaded skill
+	 * grants nothing, and its tool says so.
+	 */
+	skillGrants?: SkillGrantSet
 }
 
 /**
@@ -692,58 +701,83 @@ export class ToolExecutor {
 	private batchMode?: PermissionMode
 
 	/**
-	 * The tool scope a loaded skill declared, and the batch it applies from.
-	 *
-	 * `allowed-tools` was parsed, stored and rendered into the prompt, and
-	 * read by nothing — advice phrased as a declaration. This is what makes
-	 * it a restriction, on the same line that already enforces the step's
-	 * list, because a narrowing the model can decline is not one.
+	 * The step's list where it has one; the turn's is the default.
 	 *
-	 * Two fields rather than one, and the second is the point: a skill
-	 * loaded MID-batch must not retroactively refuse the calls the model
-	 * issued alongside it. The model chose that batch under the old scope,
-	 * and refusing half of it teaches nothing except that tools fail at
-	 * random. `adoptedInBatch` is compared against the batch counter, so the
-	 * scope takes effect from the next one.
-	 *
-	 * **`adoptedInBatch` is redundant TODAY and kept deliberately**, the same
-	 * bargain `batchMode` above documents. `buildToolContext()` runs once per
-	 * batch, so every call in a batch already shares one `allowedTools` array
-	 * computed before any of them could adopt anything — remove this
-	 * comparison and no test changes, because the guarantee currently comes
-	 * from where the context happens to be built rather than from here.
-	 * Moving the context into the per-call spread is a plausible refactor,
-	 * and it would silently produce a batch whose second half is refused for
-	 * a scope its first half installed. That is precisely the incoherent
-	 * batch this line exists to make impossible.
+	 * A loaded skill no longer narrows this. Its `allowed-tools` used to be
+	 * intersected in here from the next batch on, which read the field as a
+	 * restriction when it is a pre-approval; see `grantSkillTools`.
 	 */
-	private skillScope?: {
-		skill: string
-		allowedTools: readonly string[]
-		adoptedInBatch: number
+	private effectiveAllowedTools(): readonly string[] | undefined {
+		return this.stepAllowedTools ?? this.config.allowedTools
 	}
-	private batchCounter = 0
 
 	/**
-	 * The step's list, narrowed by any skill scope in force.
+	 * Compile a skill's `allowed-tools` into pre-approvals for the rest of the
+	 * turn, say what they would be, and record them only on `commit()`.
 	 *
-	 * An INTERSECTION, never a replacement: a skill cannot hand the model a
-	 * tool the step withheld. Widening has to be unexpressible rather than
-	 * discouraged — the same rule `CreateTaskOptions.toolScope` states for
-	 * delegation, and for the same reason: a skill file is content, and
-	 * content that can grant tools is a privilege-escalation surface wearing
-	 * the word "scope".
+	 * Names resolve against THIS turn's registry, case-insensitively and
+	 * through the Agent Skills aliases (`Read` is `read`, `WebFetch` is
+	 * `web_fetch`), so a grant can only ever name a tool the turn already has.
+	 * An entry that resolves to nothing, or to a tool every call of which is
+	 * destructive (and therefore always reviewed), is reported and grants
+	 * nothing.
 	 *
-	 * The `skill` tool itself always survives. A skill that narrowed the
-	 * model out of reaching for another skill would be a one-way door, and
-	 * the tool reads instructions and changes nothing.
+	 * Two steps because the `skill` tool can still fail after it knows what
+	 * to say — its instructions may not fit the output budget — and a skill
+	 * the model never received must not have approved anything.
 	 */
-	private effectiveAllowedTools(): readonly string[] | undefined {
-		const base = this.stepAllowedTools ?? this.config.allowedTools
-		const scope = this.skillScope
-		if (!scope || scope.adoptedInBatch >= this.batchCounter) return base
-		const narrowed = new Set([...scope.allowedTools, SKILL_TOOL_NAME])
-		return base === undefined ? [...narrowed] : base.filter((name) => narrowed.has(name))
+	private grantSkillTools(grant: {
+		readonly skill: string
+		readonly allowedTools: readonly string[]
+		readonly skillDirectory?: string
+	}): {
+		readonly granted: readonly string[]
+		readonly ignored: readonly {
+			readonly entry: string
+			readonly reason: string
+		}[]
+		readonly commit: () => void
+	} {
+		const grants = this.config.skillGrants
+		if (!grants) return { granted: [], ignored: [], commit: () => {} }
+		const tools = this.config.tools
+		const byLowerName = new Map<string, string>()
+		for (const name of tools.listNames()) byLowerName.set(name.toLowerCase(), name)
+		// A grant can only ever name a tool this turn — or this step — can call.
+		// The registry holds more than that when `allowedTools` withholds some,
+		// and telling the model a withheld tool is pre-approved is a promise the
+		// executor will refuse to keep.
+		const allowed = this.effectiveAllowedTools()
+		const compiled = compileSkillGrant(grant.allowedTools, {
+			resolveTool: (name) => {
+				const registered = byLowerName.get(name.toLowerCase())
+				if (registered === undefined) return undefined
+				const definition = tools.get(registered)
+				const commandArgument = definition?.commandArgument
+				return {
+					name: registered,
+					...(allowed !== undefined && !allowed.includes(registered) ? { unavailable: true } : {}),
+					...(commandArgument === undefined ? {} : { commandArgument }),
+					...(definition && isAlwaysDestructive(definition) ? { alwaysDestructive: true } : {}),
+				}
+			},
+			...(grant.skillDirectory ? { skillDirectory: grant.skillDirectory } : {}),
+		})
+		return {
+			granted: compiled.entries.map((entry) =>
+				entry.pattern === undefined ? entry.tool : entry.declared,
+			),
+			ignored: compiled.ignored,
+			commit: () => {
+				grants.grant(grant.skill, compiled)
+				if (compiled.ignored.length > 0) {
+					this.log.warn('Skill allowed-tools entries were ignored', {
+						'namzu.skill.name': grant.skill,
+						'namzu.skill.ignored': compiled.ignored.map((item) => item.entry),
+					})
+				}
+			},
+		}
 	}
 
 	private resolvePermissionMode(): PermissionMode {
@@ -757,9 +791,20 @@ export class ToolExecutor {
 			toolName,
 			toolInput: input,
 			toolDef: this.config.tools.get(toolName),
+			commandDialect: this.commandDialect(toolName),
 		})
 	}
 
+	/**
+	 * The shell a tool's command line will run in this turn, for the
+	 * permission rules to read it in. A tool that does not say is `sh`, the
+	 * reading that holds for any POSIX shell.
+	 */
+	commandDialect(toolName: string): ShellDialect {
+		const tool = this.config.tools.get(toolName)
+		return tool?.commandDialect?.({ sandboxed: this.config.sandbox !== undefined }) ?? 'sh'
+	}
+
 	/**
 	 * Resolve repairs and pre-tool hooks, then decode each call exactly once.
 	 * The returned projection is what policy and a human review; execution later
@@ -883,8 +928,6 @@ export class ToolExecutor {
 		}
 		assertUniqueToolCallIds(toolCalls)
 
-		this.batchCounter += 1
-
 		// Sampled here, once, and held for every call below. See the note on
 		// `permissionMode` in the config type.
 		this.batchMode = this.resolvePermissionMode()
@@ -1212,6 +1255,7 @@ export class ToolExecutor {
 			toolName: name,
 			toolInput: preparedInput,
 			toolDef: this.config.tools.get(name),
+			commandDialect: this.commandDialect(name),
 		})
 		if (gateResult && gateResult.decision !== 'allow') {
 			const reason =
@@ -1442,11 +1486,11 @@ export class ToolExecutor {
 			// Same precedence the request already uses when it decides which
 			// schemas to send, so the menu and the kitchen agree.
 			allowedTools: this.effectiveAllowedTools(),
-			// Recorded, not applied here: a skill loaded during this batch
-			// narrows the NEXT one. See `skillScope`.
-			adoptSkillScope: (scope) => {
-				this.skillScope = { ...scope, adoptedInBatch: this.batchCounter }
-			},
+			// A skill loaded during this batch pre-approves calls from the NEXT
+			// review on; this batch was already reviewed. See `grantSkillTools`.
+			...(this.config.skillGrants
+				? { grantSkillTools: (grant) => this.grantSkillTools(grant) }
+				: {}),
 			maxToolOutputChars: this.config.maxToolOutputChars ?? DEFAULT_MAX_TOOL_OUTPUT_CHARS,
 			// The turn's screens, defaulted HERE rather than on the registry: a
 			// host builds the registry and hands it over, so a registry-side
@@ -1498,11 +1542,11 @@ export class ToolExecutor {
 												readonly env?: Record<string, string>
 											}): JobProcess =>
 												(this.config.sandbox as Sandbox).spawnDetached?.(
-													'/bin/sh',
-													['-c', job.command],
+													sandboxShellSpawn(job.command).file,
+													sandboxShellSpawn(job.command).args,
 													{
 														cwd: job.workingDirectory,
-														...(job.env ? { env: job.env } : {}),
+														...(job.env ? { env: withoutBashStartup(job.env) } : {}),
 													},
 												) as JobProcess,
 										}

package/src/runtime/query/index.ts

@@ -6,6 +6,7 @@ import {
 	assertBudgetEnforceable,
 } from '../../advisory/index.js'
 import { AuthorizationGate } from '../../authorization/gate.js'
+import { SkillGrantSet } from '../../authorization/skill-grant.js'
 import { repairToolMessageHistory, toolHistoryRepairChanged } from '../../compaction/dangling.js'
 import { extractFromUserMessage } from '../../compaction/extractor.js'
 import { WorkingStateManager } from '../../compaction/manager.js'
@@ -1197,8 +1198,13 @@ export async function* query(params: QueryParams): AsyncGenerator<SessionEvent,
 			: undefined
 		awaitedJobs?.attach()
 
+		// Turn-scoped, like `toolGrants` below: what a skill loaded in this turn
+		// pre-approves ends with the turn. Shared by the executor, where the
+		// `skill` tool records a grant, and the review phase, which reads it.
+		const skillGrants = new SkillGrantSet()
 		const toolExecutor = ToolingBootstrap.init(
 			{
+				skillGrants,
 				tools: params.tools,
 				sessionId: ctx.sessionId,
 				turnId: ctx.turnId,
@@ -1496,6 +1502,7 @@ export async function* query(params: QueryParams): AsyncGenerator<SessionEvent,
 			// Turn-scoped. An approval is a statement about this turn's work;
 			// carrying one into a later turn would be reuse nobody agreed to.
 			toolGrants: new ToolGrantSet(),
+			skillGrants,
 			...(params.reviewAllowedCalls ? { reviewAllowedCalls: params.reviewAllowedCalls } : {}),
 			// Turn-scoped for the same reason. A repeat count carried into a later
 			// run is a claim about work nobody repeated, and a module-level map

package/src/runtime/query/iteration/index.ts

@@ -1826,6 +1826,11 @@ export class IterationOrchestrator {
 	private rememberUserMessage(message: Message, arriving = true): void {
 		if (!isOperatorUserMessage(message)) return
 		this.latestUserMessage = message
+		// A skill's `allowed-tools` pre-approves for the request that loaded
+		// it. The operator speaking again — a queued message or steering
+		// delivered into this same `query()` — is a new request, and it starts
+		// with nothing pre-approved, exactly as a new turn would.
+		if (arriving) this.ctx.skillGrants?.clear()
 		// The hook field alone does not reach the model. Preserve arrivals in
 		// the compaction state too, before their original message or attached
 		// tool result can be shed. Initial history was already extracted at seed.

package/src/runtime/query/iteration/phases/context.ts

@@ -1,4 +1,5 @@
 import type { AdvisoryContext } from '../../../../advisory/context.js'
+import type { SkillGrantSet } from '../../../../authorization/skill-grant.js'
 import type { AgentBus } from '../../../../bus/index.js'
 import type { WorkingStateManager } from '../../../../compaction/manager.js'
 import type { ContextReducer } from '../../../../compaction/reducer.js'
@@ -166,6 +167,12 @@ export interface IterationContext {
 	 * asked about again. Absent on paths that do not review tools.
 	 */
 	readonly toolGrants?: ToolGrantSet
+	/**
+	 * What skills loaded in this turn pre-approve (`allowed-tools`). Read by
+	 * the review phase to mark covered calls; the review policy decides
+	 * whether a mark skips the prompt. Absent: nothing is marked.
+	 */
+	readonly skillGrants?: SkillGrantSet
 	/** See `QueryParams.reviewAllowedCalls`. Absent: allowed and granted batches skip review. */
 	readonly reviewAllowedCalls?: () => boolean
 	/**

package/src/runtime/query/iteration/phases/tool-review.ts

@@ -2,6 +2,7 @@ import type { AuthorizationGate } from '../../../../authorization/index.js'
 import type { ToolCallSummary } from '../../../../types/hitl/index.js'
 import type { ChatCompletionResponse } from '../../../../types/provider/index.js'
 import type { SessionEvent } from '../../../../types/session/index.js'
+import type { ShellDialect } from '../../../../types/tool/index.js'
 import type { PreparedToolBatch, ToolCallDenials } from '../../executor.js'
 import {
 	awaitProjectInstructionCallback,
@@ -53,6 +54,15 @@ export async function* runToolReview(
 ): AsyncGenerator<SessionEvent, ToolReviewOutcome> {
 	let executed: readonly import('../../executor.js').ToolCallOutcome[] = []
 	let toolMs = 0
+	// The shell each call's command line will run in, for the rules and the
+	// skill grants to read it the same way. A test double without the method
+	// leaves it unset, which reads the line for any POSIX shell.
+	const dialectFor = (toolName: string): { commandDialect?: ShellDialect } => {
+		const executor = ctx.toolExecutor as { commandDialect?: (name: string) => ShellDialect }
+		return typeof executor.commandDialect === 'function'
+			? { commandDialect: executor.commandDialect(toolName) }
+			: {}
+	}
 
 	const finish = (decision: ToolReviewDecision): ToolReviewOutcome => ({
 		decision,
@@ -255,6 +265,7 @@ export async function* runToolReview(
 				toolName: tc.name,
 				toolInput: tc.input,
 				toolDef: ctx.tools.get(tc.name),
+				...dialectFor(tc.name),
 			}),
 		}))
 		for (const gr of gateResults) {
@@ -331,6 +342,24 @@ export async function* runToolReview(
 		})
 	}
 
+	// A skill's `allowed-tools` pre-approval, marked on the calls it covers
+	// and left for the review policy to honour. Marked, never decided here:
+	// only the policy knows the mode, and `plan` and `strict` must refuse a
+	// call a skill granted exactly as they refuse any other. Nothing stronger
+	// may stand in the way — an operator's deny or explicit ask, a
+	// destructive call, a path outside the roots or a sandbox escape all
+	// leave the call unmarked, so it is reviewed as though no skill had
+	// spoken.
+	if (ctx.skillGrants && ctx.skillGrants.size > 0) {
+		for (const tc of toolCallSummaries) {
+			if (gateDenied.has(tc.id)) continue
+			if (tc.authorization?.decision === 'deny' || tc.authorization?.explicitReview) continue
+			if (tc.isDestructive || tc.escalation !== undefined) continue
+			const skill = ctx.skillGrants.coveringSkill(tc, ctx.tools.get(tc.name), dialectFor(tc.name))
+			if (skill !== undefined) tc.skillGrant = { skill }
+		}
+	}
+
 	// Already approved, at a scope the approver chose — and nothing the
 	// operator's policy denied, because `gateDenied` is checked first.
 	// Re-asking about a call somebody has already said yes to is how an
@@ -490,6 +519,7 @@ export async function* runToolReview(
 						toolName: summary.name,
 						toolInput: summary.input,
 						toolDef: ctx.tools.get(summary.name),
+						...dialectFor(summary.name),
 					})
 					if (gateResult.decision === 'allow') continue
 					const reason =
@@ -550,6 +580,21 @@ export async function* runToolReview(
 			if (reviewDecision.action === 'approve_tools' && reviewDecision.remember) {
 				ctx.toolGrants?.grant(reviewDecision.remember)
 			}
+			// A call nobody was asked about, approved because a skill said so,
+			// is on the record naming that skill. Only a call that carried the
+			// mark counts: a policy that lists an unmarked id has not been
+			// given a skill's word for it.
+			if (reviewDecision.action === 'approve_tools' && reviewDecision.skillGranted) {
+				const listed = new Set(reviewDecision.skillGranted)
+				for (const tc of toolCallSummaries) {
+					if (!listed.has(tc.id) || !tc.skillGrant || gateDenied.has(tc.id)) continue
+					await ctx.recorder.recordAudit({
+						what: { action: 'tool_call', tool: tc.name },
+						outcome: 'approved',
+						reason: `pre-approved by the allowed-tools of skill "${tc.skillGrant.skill}" for this turn; nobody was asked`,
+					})
+				}
+			}
 
 			await ctx.emitEvent({
 				type: 'tool_review_completed',

package/src/runtime/query/review-policy.ts

@@ -238,6 +238,33 @@ export interface ReviewPolicyOptions {
 	 * in every mode that does not refuse the call outright.
 	 */
 	readonly unattendedSandboxEscape?: 'refuse' | 'allow'
+	/**
+	 * Whether a skill's `allowed-tools` pre-approval stands in for a person.
+	 *
+	 * `'honour'` (the default) approves a batch without asking when every call
+	 * that would be asked about carries `ToolCallSummary.skillGrant`. `'ignore'`
+	 * asks as though no skill had been loaded — the behaviour before
+	 * `allowed-tools` was read as a pre-approval, for a host that does not want
+	 * repository content to reduce its prompts. `plan` and `strict` refuse
+	 * either way.
+	 */
+	readonly skillGrants?: 'honour' | 'ignore'
+}
+
+/**
+ * Whether a skill's `allowed-tools` grant may stand in for a person on this
+ * call: the kernel marked it, and nothing that outranks a skill is present.
+ * The second half repeats what the kernel checked before marking, so a mark
+ * on a persisted or host-built summary cannot carry more than it should.
+ */
+function isSkillGranted(tc: ToolCallSummary): boolean {
+	return (
+		tc.skillGrant !== undefined &&
+		!tc.authorization?.explicitReview &&
+		tc.authorization?.decision !== 'deny' &&
+		!tc.isDestructive &&
+		tc.escalation === undefined
+	)
 }
 
 /** The handler behind `createReviewPolicy`, for a host that wants only the function. */
@@ -338,6 +365,32 @@ export function createReviewHandler(options: ReviewPolicyOptions = {}): ResumeHa
 		if (mode === 'auto' || !prompt || remembered.all) {
 			return { action: 'approve_tools' }
 		}
+		// Every call a person would be asked about is one a skill loaded in
+		// this turn pre-approved (`allowed-tools`). Reached only in `prompt`
+		// and `accept-edits`: `plan` and `strict` refused above, so a skill's
+		// word never outranks either, and the kernel only marks a call no
+		// deny, explicit ask, destructive flag or escalation stands behind.
+		// One unmarked call and the whole batch is asked about, as always.
+		const needsPerson = request.toolCalls.filter(
+			(tc) =>
+				tc.authorization?.explicitReview ||
+				tc.isDestructive ||
+				tc.escalation !== undefined ||
+				!(
+					exempt(tc.name, tc.input) ||
+					(mode === 'accept-edits' && ACCEPT_EDITS_TOOLS.has(tc.name))
+				),
+		)
+		if (
+			options.skillGrants !== 'ignore' &&
+			needsPerson.length > 0 &&
+			needsPerson.every(isSkillGranted)
+		) {
+			return {
+				action: 'approve_tools',
+				skillGranted: needsPerson.map((tc) => tc.id),
+			}
+		}
 		const answer = await prompt({
 			sessionId: request.sessionId,
 			turnId: request.turnId,

package/src/runtime/query/tooling.ts

@@ -1,4 +1,5 @@
 import type { AuthorizationGate } from '../../authorization/gate.js'
+import type { SkillGrantSet } from '../../authorization/skill-grant.js'
 import type { PluginLifecycleManager } from '../../plugin/lifecycle.js'
 import type { ActivityStore } from '../../store/activity/memory.js'
 import type { SessionId, TurnId } from '../../types/ids/index.js'
@@ -67,6 +68,8 @@ export interface ToolingBootstrapConfig {
 	recordAudit?: (input: AuditEventInput) => Promise<unknown>
 	/** Builds the durable-pause seam for one tool call; see ToolContext.requestPause. */
 	toolPause?: (toolUseId: string) => RequestToolPause
+	/** The turn's skill pre-approvals; see the executor's own field. */
+	skillGrants?: SkillGrantSet
 }
 
 export class ToolingBootstrap {
@@ -130,6 +133,7 @@ export class ToolingBootstrap {
 					: {}),
 				...(config.recordAudit !== undefined ? { recordAudit: config.recordAudit } : {}),
 				...(config.toolPause !== undefined ? { toolPause: config.toolPause } : {}),
+				...(config.skillGrants !== undefined ? { skillGrants: config.skillGrants } : {}),
 			},
 			activityStore,
 			emitEvent,

package/src/skills/loader.ts

@@ -12,6 +12,13 @@ import { type Logger, resolveLogger } from '../utils/logger.js'
 
 export const SKILL_FILENAME = 'SKILL.md'
 
+/**
+ * `allowed-tools` may be a YAML list. The Agent Skills format writes it
+ * space-separated, comma-separated or as a list, and all three must mean the
+ * same grant; the reader joins a list into the comma form.
+ */
+export const SKILL_FRONTMATTER_OPTIONS = { lists: ['allowed-tools'] } as const
+
 /**
  * How this file's errors name themselves. Passed to the shared reader so a
  * frontmatter failure still reads as a `SKILL.md` failure — the reader is
@@ -152,7 +159,7 @@ export async function loadSkill(
 ): Promise<SkillLoadResult> {
 	const skillMdPath = join(dirPath, SKILL_FILENAME)
 	const raw = await readFile(skillMdPath, 'utf-8')
-	const parsed = parseFrontmatter(raw, sourceLabel(dirPath))
+	const parsed = parseFrontmatter(raw, sourceLabel(dirPath), SKILL_FRONTMATTER_OPTIONS)
 	const metadata = toSkillMetadata(parsed, dirPath)
 
 	const skill: Skill = {

package/src/tools/builtins/bash.ts

@@ -6,6 +6,12 @@ import { DANGEROUS_PATTERNS } from '../../constants/tools/index.js'
 import { killTree } from '../../process/kill-tree.js'
 import { subscribeToAbort } from '../../utils/abort.js'
 import { readPositiveIntEnv } from '../../utils/env.js'
+import {
+	bashToolDialect,
+	hostShellSpawn,
+	sandboxShellSpawn,
+	withoutBashStartup,
+} from '../command-shell.js'
 import { defineTool } from '../defineTool.js'
 import { scrubInheritedEnv } from '../env-scrub.js'
 
@@ -146,13 +152,20 @@ function execHostShell(
 ): Promise<{ stdout: string; stderr: string }> {
 	options.signal?.throwIfAborted()
 	return new Promise((resolve, reject) => {
-		const child = spawn(command, {
+		// bash where the host has it, `/bin/sh` where it does not; the
+		// permission rules read the line in the matching dialect. See
+		// `../command-shell.ts`.
+		const shell = hostShellSpawn(command, options.env)
+		const spawnOptions = {
 			cwd: options.cwd,
-			env: options.env,
-			shell: true,
+			env: shell.env,
 			// killTree's negative PID must never target the caller's own group.
 			detached: process.platform !== 'win32',
-		})
+		}
+		const child =
+			shell.file === undefined
+				? spawn(command, { ...spawnOptions, shell: true })
+				: spawn(shell.file, [...shell.args], spawnOptions)
 		const captures = {
 			stdout: {
 				chunks: [] as Buffer[],
@@ -302,6 +315,8 @@ export const BashTool = defineTool({
 	// so a permission rule about it is a rule about several commands more often
 	// than not. Naming the argument is what lets the gate read it that way.
 	commandArgument: 'command',
+	// The shell that runs it, so the rules read the line as that shell will.
+	commandDialect: bashToolDialect,
 	// The kernel reviews a call that sets it under a sandbox every time and
 	// confirms it only by id; see `ToolDefinition.sandboxEscapeArgument`.
 	sandboxEscapeArgument: 'dangerously_disable_sandbox',
@@ -414,9 +429,12 @@ export const BashTool = defineTool({
 		// builtin doesn't have that requirement today.
 		const onOutput = shellProgress(context.report)
 		if (context.sandbox && !leaveSandbox) {
-			const result = await context.sandbox.exec('/bin/sh', ['-c', input.command], {
+			// bash if the guest has it, `/bin/sh` if not; read in the `sh`
+			// dialect, which holds for both.
+			const launch = sandboxShellSpawn(input.command)
+			const result = await context.sandbox.exec(launch.file, launch.args, {
 				timeout: input.timeout,
-				env: context.env,
+				...(context.env ? { env: withoutBashStartup(context.env) } : {}),
 				// Same reason as the host path below: a Stop must reach the
 				// process, not just the promise waiting on it.
 				signal: context.abortSignal,