#!/usr/bin/env bash set -euo pipefail if [[ "$#" -ne 2 ]]; then echo "usage: $0 " >&2 exit 1 fi bash_path="$(cd "$(dirname "$1")" && pwd)/$(basename "$1")" zsh_path="$(cd "$(dirname "$2")" && pwd)/$(basename "$2")" temp_root="${RUNNER_TEMP:-/tmp}" work_root="$(mktemp -d "${temp_root%/}/codex-shell-chain.XXXXXX")" trap 'rm -rf "$work_root"' EXIT wrapper_path="${work_root}/exec-wrapper" # Stand in for codex-execve-wrapper: record each intercepted executable and # prove that the inherited escalation-socket descriptor is still open. cat > "$wrapper_path" <<'EOF' #!/usr/bin/env bash set -euo pipefail : "${CODEX_WRAPPER_LOG:?missing CODEX_WRAPPER_LOG}" : "${EXEC_WRAPPER:?missing EXEC_WRAPPER}" : "${CODEX_ESCALATE_SOCKET:?missing CODEX_ESCALATE_SOCKET}" printf 'socket-open\n' >&"${CODEX_ESCALATE_SOCKET}" printf '%s\n' "$@" >> "$CODEX_WRAPPER_LOG" file="$1" shift if [[ "$#" -eq 0 ]]; then exec "$file" fi arg0="$1" shift exec -a "$arg0" "$file" "$@" EOF chmod +x "$wrapper_path" run_chain() { local outer_shell="$1" local outer_flag="$2" local inner_shell="$3" local inner_flag="$4" local marker="$5" local wrapper_log="${work_root}/${marker}-wrapper.log" local socket_probe="${work_root}/${marker}-socket.log" local stdout="${work_root}/${marker}-stdout.txt" local command command="\"${inner_shell}\" ${inner_flag} '/bin/echo ${marker}'" # The inner shell and /bin/echo should each pass through EXEC_WRAPPER while # retaining the same inherited descriptor. CODEX_WRAPPER_LOG="$wrapper_log" \ CODEX_ESCALATE_SOCKET=9 \ EXEC_WRAPPER="$wrapper_path" \ "$outer_shell" "$outer_flag" "$command" > "$stdout" 9> "$socket_probe" grep -Fx "$marker" "$stdout" grep -Fx "$inner_shell" "$wrapper_log" grep -Fx "/bin/echo" "$wrapper_log" [[ "$(grep -Fxc "socket-open" "$socket_probe")" -eq 2 ]] } # Either patched shell may launch the other, so exercise both directions. run_chain "$bash_path" -c "$zsh_path" -fc bash-zsh-chain run_chain "$zsh_path" -fc "$bash_path" -c zsh-bash-chain