fix(monitors): fence persistent command authorization

[andrei-hasna]

Summary

• require one-shot approval before persistent monitor create and restart
• persist authorization bound to monitor generation, command subject, live permission profile, thread cwd, and a process-local session writer fence
• fail closed on missing or stale authorization and execute through the existing sandbox with the live thread configuration
• initialize a distinct writer fence in every reachable Session struct literal

Scope

Fresh successor for OPE2-00287. This selectively ports only the final current-fence behavior from terminal PR #489 plus the focused Session-initializer regression. It does not port the historical occurrence-lifecycle changes and does not mutate PR #489.

Evidence

• pre-fix remote regression: two E0599 missing monitor_writer_fence errors; codex-core lib test compile exit 101
• exact-head named regression: 1 test run, 1 passed, 3120 skipped; remote exit 0
• exact-head affected monitor lane across codex-state, codex-core, and codex-app-server: 24 tests run, 24 passed, 4795 skipped; remote exit 0
• repository formatter exit 0
• git diff --check exit 0
• staged shield review: No security issues found in staged changes

Hosted Rust and Bazel checks are required before READY and remain pending at PR creation.

Task: OPE2-00287 / f4a9b60f-b202-4a0d-b7bc-bb6ac2f43099

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[andrei-hasna]

[REVIEW] NO_GO — #527 @ 46fe0d1 — lens: correctness+security+gates, reviewer Trebius (1 of 1)

Reviewed the complete diff from fetched base 4be2515b784b7568e4a588f110badc02048e2d87 through head 46fe0d181d33f00feba7f4979ee67bff828e483e, including surrounding app-server monitor create/restart/approval handling, runtime sandbox execution, session writer fencing, state persistence/migration, authorization subject matching, and affected call sites.

Commands and evidence:

• git log --oneline origin/main..HEAD — exit 0; 2 commits read.
• git diff origin/main...HEAD --stat — exit 0; 14 files, 898 insertions, 133 deletions.
• git diff origin/main...HEAD — exit 0; full 1,660-line diff read.
• bun install — setup only, exit 0; 521 packages installed. This is not a test result.
• gh pr view 527 --repo hasna/codewith --json statusCheckRollup — exit 0; 28 checks read: 22 success, 3 skipped, 2 in progress, 1 failure.

Repository-declared gates:

• package.json declares no test script, so this repository declares no test gate. No test command was invented.
• package.json declares no typecheck script.
• No lane-chosen command was run.

Forge checks read by name:

• Bazel test on ubuntu-24.04 for x86_64-unknown-linux-gnu — IN_PROGRESS.
• cla — SUCCESS.
• Check for spelling errors — SUCCESS.
• Blob size policy — SUCCESS.
• cargo-deny — SUCCESS.
• build-test — SUCCESS.
• Build Codewith Linux CLI — SUCCESS.
• Detect changed areas — SUCCESS.
• python-sdk — SUCCESS.
• Bazel test on ubuntu-24.04 for x86_64-unknown-linux-musl — IN_PROGRESS.
• Bazel test on windows-latest for x86_64-pc-windows-gnullvm shard 1/4 — SUCCESS.
• Format / etc — SUCCESS.
• sdks — SUCCESS.
• Bazel test on windows-latest for x86_64-pc-windows-gnullvm shard 2/4 — SUCCESS.
• Bazel test on windows-latest for x86_64-pc-windows-gnullvm shard 3/4 — SUCCESS.
• Bazel test on windows-latest for x86_64-pc-windows-gnullvm shard 4/4 — SUCCESS.
• Bazel test on windows-latest for x86_64-pc-windows-gnullvm (native main) — SKIPPED.
• cargo shear — SUCCESS.
• Bazel clippy on ubuntu-24.04 for x86_64-unknown-linux-gnu — FAILURE; annotation reports process exit 1.
• Argument comment lint package — SKIPPED.
• Bazel clippy on windows-latest for x86_64-pc-windows-gnullvm — SUCCESS.
• Verify release build on ubuntu-24.04 for x86_64-unknown-linux-gnu — SUCCESS.
• Argument comment lint - Linux — SUCCESS.
• Verify release build on windows-latest for x86_64-pc-windows-gnullvm — SUCCESS.
• Argument comment lint - Windows — SUCCESS.
• Bazel test on windows-latest for x86_64-pc-windows-gnullvm — SUCCESS.
• CI results (required) — SUCCESS.
• [code]smith — SKIPPED.

Blocking findings:

• P1 — applicable build/lint gate failure. Linux Bazel Clippy rejects AbsolutePathBuf::try_from(cwd) at codex-rs/app-server/src/request_processors/thread_monitor_processor.rs:745 as clippy::useless-conversion, with -D warnings; the check exits 1. The bounded remedy is to return the already-typed AbsolutePathBuf directly and rerun the affected Linux app-server Clippy lane.

No other concrete, currently reachable, in-scope P0/P1 correctness or security defect was found.

Non-blocking follow-ups:

• The change is 1,031 changed lines, above the 800-line review-size guideline. The state authorization/persistence layer and the app-server approval/sandbox runtime are possible staging boundaries, but they are tightly coupled by the fail-closed security invariant; this does not block the current candidate.
• The absent repository test gate is recorded above. Hosted forge checks are the authoritative gates for this PR.

[andrei-hasna]

[REMEDIATION] Trebius fixed the current-head Linux Bazel Clippy blocker in d32cdc9990df9764e20c20315dda6face8749dad.

The monitor approval cwd helper now returns the already-typed AbsolutePathBuf directly, removing the clippy::useless-conversion failure without changing runtime behavior. shield review inspected the staged one-file change and returned No security issues found in staged changes. The branch push completed successfully; focused verification is limited to the affected Linux app-server Clippy lane and direct forge regressions.

[andrei-hasna]

[REVIEW] GO — #527 @ d32cdc9 — lens: correctness+security+gates, reviewer Trebius (1 of 1)

Focused re-review

• Reviewed the exact one-line remediation at d32cdc9 and its direct regression surface.
• The prior Linux Bazel Clippy blocker is resolved: the redundant AbsolutePathBuf conversion was removed, and the authoritative Linux Bazel Clippy check now concludes SUCCESS.
• Blocking P0/P1 findings: none.
• Non-blocking follow-ups: this remains a large change (1,031 changed lines against the reviewed base), and package.json declares no test gate. Neither is a blocker under the supplied acceptance criteria.

Declared repository setup and gates

• bun install — exit 0; setup only; 521 packages installed.
• Declared test gate — none. package.json has no test script.
• Declared typecheck gate — none. package.json has no typecheck script.
• gh pr view 527 --repo hasna/codewith --json statusCheckRollup — exit 0; 28 checks: 25 SUCCESS, 3 SKIPPED, 0 failed, 0 pending.

Authoritative forge checks

• Bazel test on ubuntu-24.04 for x86_64-unknown-linux-gnu — SUCCESS
• cla — SUCCESS
• Check for spelling errors — SUCCESS
• Blob size policy — SUCCESS
• cargo-deny — SUCCESS
• build-test — SUCCESS
• Build Codewith Linux CLI — SUCCESS
• Detect changed areas — SUCCESS
• python-sdk — SUCCESS
• Bazel test on ubuntu-24.04 for x86_64-unknown-linux-musl — SUCCESS
• Windows Bazel shard 1/4 — SUCCESS
• Format / etc — SUCCESS
• sdks — SUCCESS
• Windows shard 2/4 — SUCCESS
• Windows shard 3/4 — SUCCESS
• Windows shard 4/4 — SUCCESS
• Windows native main — SKIPPED
• cargo shear — SUCCESS
• Argument comment lint package — SKIPPED
• Linux Bazel clippy — SUCCESS
• Windows Bazel clippy — SUCCESS
• Linux release build — SUCCESS
• Argument comment lint - Linux — SUCCESS
• Windows release build — SUCCESS
• Argument comment lint - Windows — SUCCESS
• Windows Bazel test aggregate — SUCCESS
• CI results (required) — SUCCESS
• [code]smith — SKIPPED

Lane-chosen commands, not repository gates

• shield review on the staged remediation — exit 0; no security issues found.
• git diff 46fe0d1..HEAD --check — exit 0.
• cargo fmt -- --check --config imports_granularity=Item — exit 0.
• just fmt — exit 127 because just is unavailable.
• python3 ../scripts/format.py — exit 1 because just and uv are unavailable; its Rust-format section ran. These unavailable local tools are non-blocking because they are not declared package gates and the forge's Format / etc check is SUCCESS.

Verdict
GO. The concrete P1 build-gate defect from the initial pass is fixed, its affected Linux Clippy lane passes, all authoritative forge checks are terminal with no failures, and no reachable in-scope P0/P1 finding remains.