From 5dca81271cd7d7f90b1608ea8758ed1fbbcfee3f Mon Sep 17 00:00:00 2001
From: Vincent Koc <vincentkoc@ieee.org>
Date: Wed, 1 Apr 2026 18:26:07 +0900
Subject: [PATCH] fix(exec): clarify and cover auto host override guard

---
 src/agents/bash-tools.exec-runtime.test.ts | 27 ++++++++++++++++++++++
 src/agents/bash-tools.exec-runtime.ts      |  2 +-
 2 files changed, 28 insertions(+), 1 deletion(-)

diff --git a/src/agents/bash-tools.exec-runtime.test.ts b/src/agents/bash-tools.exec-runtime.test.ts
index e328df2ed9b..a9dc655dec3 100644
--- a/src/agents/bash-tools.exec-runtime.test.ts
+++ b/src/agents/bash-tools.exec-runtime.test.ts
@@ -57,6 +57,33 @@ describe("resolveExecTarget", () => {
       }),
     ).toThrow("exec host not allowed");
   });
+
+  it("also rejects gateway override when configured host is auto", () => {
+    expect(() =>
+      resolveExecTarget({
+        configuredTarget: "auto",
+        requestedTarget: "gateway",
+        elevatedRequested: false,
+        sandboxAvailable: true,
+      }),
+    ).toThrow("exec host not allowed");
+  });
+
+  it("allows explicit auto request when configured host is auto", () => {
+    expect(
+      resolveExecTarget({
+        configuredTarget: "auto",
+        requestedTarget: "auto",
+        elevatedRequested: false,
+        sandboxAvailable: true,
+      }),
+    ).toMatchObject({
+      configuredTarget: "auto",
+      requestedTarget: "auto",
+      selectedTarget: "auto",
+      effectiveHost: "sandbox",
+    });
+  });
 });
 
 describe("emitExecSystemEvent", () => {
diff --git a/src/agents/bash-tools.exec-runtime.ts b/src/agents/bash-tools.exec-runtime.ts
index ee204dead6d..8849f0605f6 100644
--- a/src/agents/bash-tools.exec-runtime.ts
+++ b/src/agents/bash-tools.exec-runtime.ts
@@ -249,7 +249,7 @@ export function resolveExecTarget(params: {
   ) {
     throw new Error(
       `exec host not allowed (requested ${renderExecTargetLabel(requestedTarget)}; ` +
-        `configure tools.exec.host=${renderExecTargetLabel(configuredTarget)} to allow).`,
+        `configure tools.exec.host=${renderExecTargetLabel(requestedTarget)} to allow).`,
     );
   }
   const selectedTarget = requestedTarget ?? configuredTarget;