Repository navigation
Run one off Bash commands from the composer - #7
Conversation
Execute bang-prefixed submissions in the thread workspace and send bounded, redacted results through the existing provider turn flow. Reuse command activities, cancellation, and terminal authorization. Implemented by GPT-6-Astra through the Codex harness.
- Parse command output into stdout, stderr, and exit code - Add Bash mode and result status disclosures across web and mobile - Remove duplicate Bash activity rows
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
github-actions
Bot
added
vouch:trusted
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 5c43d44694
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| const stderrIndex = body.startsWith("stderr:\n") ? 0 : body.indexOf("\nstderr:\n"); | ||
| const stdoutPart = stderrIndex === -1 ? body : body.slice(0, Math.max(stderrIndex, 0)); | ||
| const stderr = stderrIndex === -1 ? "" : body.slice(stderrIndex + (stderrIndex === 0 ? 8 : 9)); |
There was a problem hiding this comment.
When legitimate stdout contains a line beginning with stderr:, this parser treats the remainder as stderr even if the process wrote nothing to stderr. For example, !printf 'before\nstderr:\nafter\n' is displayed with after as error output. Carry structured stdout/stderr fields from the server or use an encoding that cannot collide with command output.
Useful? React with 👍 / 👎.
| : hasWideBlock || | ||
| (entry.bashCommand && props.expandedWorkRows[`bash:${message.id}`]) | ||
| ? { width: props.userBubbleMaxWidth } |
There was a problem hiding this comment.
In the mobile thread feed, expansion is now tracked under bash-collapsed:${message.id}, but this width condition still checks the obsolete bash:${message.id} key. Consequently, the condition never widens a normally expanded Bash result, so short commands such as !ls can leave multiline output cramped into the command bubble instead of using userBubbleMaxWidth.
Useful? React with 👍 / 👎.
| for (const [name, value] of Object.entries(process.env)) { | ||
| if ( | ||
| /(?:TOKEN|SECRET|PASSWORD|API_KEY|PRIVATE_KEY|CREDENTIAL)/i.test(name) && | ||
| value && | ||
| value.length >= 4 | ||
| ) { | ||
| sanitized = sanitized.replaceAll(value, "[redacted]"); |
There was a problem hiding this comment.
Credential replacement follows environment iteration order, so overlapping values can leak a suffix. If SHORT_TOKEN=abcd is visited before DATABASE_PASSWORD=abcdefgh, output containing abcdefgh becomes [redacted]efgh; the later replacement can no longer match the full password, and that partial credential is then persisted and sent to the provider. Deduplicate and sort sensitive values by descending length before replacing them.
Useful? React with 👍 / 👎.
What Changed
Added
!composer commands that execute once in the thread workspace and send their output to the agent as context. Command results appear inline on the user message in web and mobile, with expandable stdout and stderr, exit status, and running or failure states.Why
Users can run a quick command and give its result to the agent without switching to a terminal or copying output manually.
UI Changes
Added a Bash mode indicator in the composer and expandable command results on messages. Before/after screenshots and an interaction video are not included.
Checklist