[macOS Desktop] functions.exec does not expose effective sandbox escalation to PreToolUse hooks

Summary

On macOS Codex Desktop, a Bash PreToolUse hook cannot distinguish a nested exec_command running with sandbox_permissions=require_escalated from one running without that setting when the command is invoked through functions.exec.

This prevents a policy hook from safely allowing GitHub CLI commands only in the intended normal macOS execution context.

Environment

• Platform: macOS
• Surface: Codex Desktop functions.exec
• Nested tool: exec_command
• Hook event: PreToolUse for Bash

Reproduction

1. Configure a Bash PreToolUse hook that records only non-sensitive structural fields from its JSON input.
2. Invoke a harmless nested command such as /usr/bin/true through functions.exec with sandbox_permissions omitted.
3. Repeat with sandbox_permissions=require_escalated.
4. Compare the hook inputs.

Observed shape in both cases:

{
  "permission_mode": "default",
  "tool_input": {
    "command": "..."
  }
}

The nested tool_input.sandbox_permissions field is absent in both cases. The actual execution context may differ, but the hook receives no trusted field that represents the effective context or permission transition.

The issue was encountered with a policy hook protecting gh auth status and gh repo create. The hook must reject those commands when their execution context cannot be verified, so both commands were blocked before execution.

Expected behavior

A hook should receive a trusted, structured indication of the effective permission context, or a permission-resolved hook event should expose the requested transition. For example, the runtime could expose the current and requested sandbox context or a stable escalation category. The exact field names are implementation details.

The signal must be supplied by the Codex runtime after permission resolution; parsing the outer functions.exec JavaScript source for the string require_escalated would not be a safe substitute because that text is forgeable.

A PermissionRequest event with a stable structured escalation reason would also be sufficient if denying that event reliably prevents the elevated command from executing.

Related issue

• #28117 — Command escalation information look to be not available in Codex hooks

This report adds a macOS Desktop / nested functions.exec reproduction and focuses on the missing effective-context signal at the PreToolUse boundary.

Requested fix

Please document and expose a stable, trusted execution-context or permission-transition field to the relevant hook payload, and add regression coverage for nested functions.exec calls with and without sandbox_permissions=require_escalated.

Trace the macOS Desktop functions.exec path into nested exec_command handling, then inspect the PreToolUse and PermissionRequest payload boundaries. Reproduce both omitted and require_escalated cases with a harmless command and compare the hook inputs. Done means a trusted structured execution-context or permission-transition signal is exposed and regression coverage distinguishes both cases.