agents: keep full-access truth for host runs

src/agents/pi-embedded-runner.buildembeddedsandboxinfo.test.ts

@@ -1,5 +1,6 @@
 import { describe, expect, it } from "vitest";
 import { buildEmbeddedSandboxInfo } from "./pi-embedded-runner.js";
+import { resolveEmbeddedFullAccessState } from "./pi-embedded-runner/sandbox-info.js";
 import type { SandboxContext } from "./sandbox.js";
 
 function createSandboxContext(overrides?: Partial<SandboxContext>): SandboxContext {
@@ -113,3 +114,36 @@ describe("buildEmbeddedSandboxInfo", () => {
     });
   });
 });
+
+describe("resolveEmbeddedFullAccessState", () => {
+  it("treats direct host runs with allowed elevation as full-access available", () => {
+    expect(
+      resolveEmbeddedFullAccessState({
+        sandboxEnabled: false,
+        execElevated: {
+          enabled: true,
+          allowed: true,
+          defaultLevel: "full",
+        },
+      }),
+    ).toEqual({ available: true });
+  });
+
+  it("keeps explicit runtime blocks even when host exec is allowed", () => {
+    expect(
+      resolveEmbeddedFullAccessState({
+        sandboxEnabled: false,
+        execElevated: {
+          enabled: true,
+          allowed: true,
+          defaultLevel: "full",
+          fullAccessAvailable: false,
+          fullAccessBlockedReason: "runtime",
+        },
+      }),
+    ).toEqual({
+      available: false,
+      blockedReason: "runtime",
+    });
+  });
+});

src/agents/pi-embedded-runner/sandbox-info.ts

@@ -6,12 +6,6 @@ export function resolveEmbeddedFullAccessState(params: {
   sandboxEnabled: boolean;
   execElevated?: ExecElevatedDefaults;
 }): { available: boolean; blockedReason?: EmbeddedFullAccessBlockedReason } {
-  if (!params.sandboxEnabled) {
-    return {
-      available: false,
-      blockedReason: "runtime",
-    };
-  }
   if (params.execElevated?.fullAccessAvailable === true) {
     return { available: true };
   }
@@ -27,6 +21,9 @@ export function resolveEmbeddedFullAccessState(params: {
       blockedReason: "host-policy",
     };
   }
+  if (!params.sandboxEnabled) {
+    return { available: true };
+  }
   return { available: true };
 }