A managed Gemini repository review reached the native provider and successfully read a file, but its first native shell command failed with:
sandbox-exec: sandbox_apply: Operation not permitted
Agy then requested unsandboxed execution, which was denied. No substantive review verdict was produced. This is caller invocation brittleness, not a provider failure.
The original caller launched the ordinary coordinator under Codex's macOS workspace-write sandbox. The native provider retained its normal command sandbox. A paired, provider-free sandbox creation probe failed under the outer caller sandbox and succeeded through approved per-command host execution outside it.
Correction: document and use a host invocation that permits the provider's own sandbox to initialize. Preserve native sandboxing, permission decisions, normal capabilities, opaque output, and consumed-attempt semantics. Do not remove native sandboxing, automatically retry, switch providers, or invent output/tool gates.
Scope: public caller guidance plus the companion qualification runbook. Validate a fresh authorized native-shell task under the corrected host composition and retain positive tool output. No signed-runtime change is indicated. Keep the consumed original attempt separate from the operator-authorized corrected file-read review for #203.
Observed with plugin 7.0.5/runtime 5.0.7; manifest SHA-256 a11571908933c48fc301838d1cdb5d5f71433924af5b4b8419fd7b658695f440. Original consumed review request and full native diagnostics are retained privately. This issue contains no credential material or provider executor source.
A managed Gemini repository review reached the native provider and successfully read a file, but its first native shell command failed with:
Agy then requested unsandboxed execution, which was denied. No substantive review verdict was produced. This is caller invocation brittleness, not a provider failure.
The original caller launched the ordinary coordinator under Codex's macOS workspace-write sandbox. The native provider retained its normal command sandbox. A paired, provider-free sandbox creation probe failed under the outer caller sandbox and succeeded through approved per-command host execution outside it.
Correction: document and use a host invocation that permits the provider's own sandbox to initialize. Preserve native sandboxing, permission decisions, normal capabilities, opaque output, and consumed-attempt semantics. Do not remove native sandboxing, automatically retry, switch providers, or invent output/tool gates.
Scope: public caller guidance plus the companion qualification runbook. Validate a fresh authorized native-shell task under the corrected host composition and retain positive tool output. No signed-runtime change is indicated. Keep the consumed original attempt separate from the operator-authorized corrected file-read review for #203.
Observed with plugin 7.0.5/runtime 5.0.7; manifest SHA-256 a11571908933c48fc301838d1cdb5d5f71433924af5b4b8419fd7b658695f440. Original consumed review request and full native diagnostics are retained privately. This issue contains no credential material or provider executor source.