codex: address PR review feedback (#14988)

codex-rs/app-server-protocol/schema/json/ClientRequest.json

@@ -2884,7 +2884,7 @@
     "ThreadShellCommandParams": {
       "properties": {
         "command": {
-          "description": "Shell command string evaluated by the thread's configured shell. Unlike `command/exec`, this intentionally preserves shell syntax such as pipes, redirects, and quoting.",
+          "description": "Shell command string evaluated by the thread's configured shell. Unlike `command/exec`, this intentionally preserves shell syntax such as pipes, redirects, and quoting. This matches legacy TUI `!` behavior and runs unsandboxed with full access rather than inheriting the thread sandbox policy.",
           "type": "string"
         },
         "threadId": {

codex-rs/app-server-protocol/schema/json/codex_app_server_protocol.schemas.json

@@ -13142,7 +13142,7 @@
         "$schema": "http://json-schema.org/draft-07/schema#",
         "properties": {
           "command": {
-            "description": "Shell command string evaluated by the thread's configured shell. Unlike `command/exec`, this intentionally preserves shell syntax such as pipes, redirects, and quoting.",
+            "description": "Shell command string evaluated by the thread's configured shell. Unlike `command/exec`, this intentionally preserves shell syntax such as pipes, redirects, and quoting. This matches legacy TUI `!` behavior and runs unsandboxed with full access rather than inheriting the thread sandbox policy.",
             "type": "string"
           },
           "threadId": {

codex-rs/app-server-protocol/schema/json/codex_app_server_protocol.v2.schemas.json

@@ -10902,7 +10902,7 @@
       "$schema": "http://json-schema.org/draft-07/schema#",
       "properties": {
         "command": {
-          "description": "Shell command string evaluated by the thread's configured shell. Unlike `command/exec`, this intentionally preserves shell syntax such as pipes, redirects, and quoting.",
+          "description": "Shell command string evaluated by the thread's configured shell. Unlike `command/exec`, this intentionally preserves shell syntax such as pipes, redirects, and quoting. This matches legacy TUI `!` behavior and runs unsandboxed with full access rather than inheriting the thread sandbox policy.",
           "type": "string"
         },
         "threadId": {

codex-rs/app-server-protocol/schema/json/v2/ThreadShellCommandParams.json

@@ -2,7 +2,7 @@
   "$schema": "http://json-schema.org/draft-07/schema#",
   "properties": {
     "command": {
-      "description": "Shell command string evaluated by the thread's configured shell. Unlike `command/exec`, this intentionally preserves shell syntax such as pipes, redirects, and quoting.",
+      "description": "Shell command string evaluated by the thread's configured shell. Unlike `command/exec`, this intentionally preserves shell syntax such as pipes, redirects, and quoting. This matches legacy TUI `!` behavior and runs unsandboxed with full access rather than inheriting the thread sandbox policy.",
       "type": "string"
     },
     "threadId": {

codex-rs/app-server-protocol/schema/typescript/v2/ThreadShellCommandParams.ts

@@ -6,6 +6,8 @@ export type ThreadShellCommandParams = { threadId: string,
 /**
  * Shell command string evaluated by the thread's configured shell.
  * Unlike `command/exec`, this intentionally preserves shell syntax
- * such as pipes, redirects, and quoting.
+ * such as pipes, redirects, and quoting. This matches legacy TUI `!`
+ * behavior and runs unsandboxed with full access rather than inheriting
+ * the thread sandbox policy.
  */
 command: string, };

codex-rs/app-server-protocol/src/protocol/v2.rs

@@ -2883,7 +2883,9 @@ pub struct ThreadShellCommandParams {
     pub thread_id: String,
     /// Shell command string evaluated by the thread's configured shell.
     /// Unlike `command/exec`, this intentionally preserves shell syntax
-    /// such as pipes, redirects, and quoting.
+    /// such as pipes, redirects, and quoting. This matches legacy TUI `!`
+    /// behavior and runs unsandboxed with full access rather than inheriting
+    /// the thread sandbox policy.
     pub command: String,
 }
 

codex-rs/app-server/README.md

@@ -139,7 +139,7 @@ Example with notification opt-out:
 - `thread/name/set` — set or update a thread’s user-facing name for either a loaded thread or a persisted rollout; returns `{}` on success and emits `thread/name/updated` to initialized, opted-in clients. Thread names are not required to be unique; name lookups resolve to the most recently updated thread.
 - `thread/unarchive` — move an archived rollout file back into the sessions directory; returns the restored `thread` on success and emits `thread/unarchived`.
 - `thread/compact/start` — trigger conversation history compaction for a thread; returns `{}` immediately while progress streams through standard turn/item notifications.
-- `thread/shellCommand` — run a user-initiated `!` shell command against a thread; returns `{}` immediately while progress streams through standard turn/item notifications and any active turn receives the formatted output in its message stream.
+- `thread/shellCommand` — run a user-initiated `!` shell command against a thread; this mirrors legacy TUI `!` behavior and runs unsandboxed with full access rather than inheriting the thread sandbox policy. Returns `{}` immediately while progress streams through standard turn/item notifications and any active turn receives the formatted output in its message stream.
 - `thread/backgroundTerminals/clean` — terminate all running background terminals for a thread (experimental; requires `capabilities.experimentalApi`); returns `{}` when the cleanup request is accepted.
 - `thread/rollback` — drop the last N turns from the agent’s in-memory context and persist a rollback marker in the rollout so future resumes see the pruned history; returns the updated `thread` (with `turns` populated) on success.
 - `turn/start` — add user input to a thread and begin Codex generation; responds with the initial `turn` object and streams `turn/started`, `item/*`, and `turn/completed` notifications. For `collaborationMode`, `settings.developer_instructions: null` means "use built-in instructions for the selected mode".
@@ -415,6 +415,8 @@ While compaction is running, the thread is effectively in a turn so clients shou
 ### Example: Run a thread shell command
 
 Use `thread/shellCommand` for the TUI `!` workflow. The request returns immediately with `{}`.
+This API mirrors legacy TUI `!` behavior and runs unsandboxed with full access;
+it does not inherit the thread sandbox policy.
 
 If the thread already has an active turn, the command runs as an auxiliary action on that turn. In that case, progress is emitted as standard `item/*` notifications on the existing turn and the formatted output is injected into the turn’s message stream with the same behavior as legacy TUI `!` commands: