From df651908c4584e54751e3fd911d415559e659fa9 Mon Sep 17 00:00:00 2001 From: Levi Neely Date: Sat, 25 Apr 2026 11:22:29 +0200 Subject: [PATCH] docs: document x/ namespace and x/elevate in scripts/README.md Add x/ to the namespace list and add an x/elevate section describing its role as the elevation plugin for execute_code elevated steps, the calling convention, the default superpowerd implementation, and how to replace or disable it. Co-Authored-By: Claude Sonnet 4.6 --- scripts/README.md | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/scripts/README.md b/scripts/README.md index dc29a46..75c0b92 100644 --- a/scripts/README.md +++ b/scripts/README.md @@ -20,6 +20,7 @@ Scripts are organized by the filesystem namespace they are hosted under: - `s/` — session management and one-shot query scripts - `u/` — utility scripts; compositions of other ollie primitives +- `x/` — elevation plugins; called by `execute_code` for privileged steps --- @@ -202,3 +203,23 @@ u/optimize "generate a hello world program. use c++." >[2]/dev/null | s/bfg ``` Outputs to stdout, making it composable with other pipeline stages. + +--- + +## x/elevate + +Elevation plugin invoked by `execute_code` when a step is marked `elevated: true`. +Runs the command outside the sandbox and returns its output. + +`execute_code` looks for `x/elevate` in the plugins path and calls it as: + +```sh +x/elevate -- +``` + +The default implementation delegates to `superpowerd` via a Unix socket. Replace the +script to use a different elevation mechanism — the interface is just stdin/stdout with +a shell exit code. + +To disable elevation entirely, remove or replace `x/elevate` with a script that exits +non-zero. Steps with `elevated: true` will then fail rather than run unsandboxed.