Levi Neely 8bb5c098cc bypass: route approval through 9P instead of Unix socket ... This refactors the bypass (sandbox escape) mechanism to work with remote toolsrv deployments. Previously, bypass used a Unix socket which only works when toolsrv runs locally. Now: 1. toolsrv exposes bypass/{pending,resolve} 9P files - pending: blocking read returns next bypass request as JSON - resolve: write JSON {id, approved, error} to complete request 2. olliesrv reads bypass/pending in a loop per session - Evaluates requests through the existing bypass broker - Policy check, rate limiting, user notification all stay in olliesrv - Writes approval/denial back to bypass/resolve 3. When approved, toolsrv executes the command directly (no sandbox) - Execution happens on toolsrv's host (local or remote) - Output streams back through the normal tool call path This enables bypass to work when toolsrv is remote: - User sees the approval notification locally - Command executes on the remote host outside its sandbox Architecture: toolsrv (remote) olliesrv (local) ┌─────────────────┐ ┌──────────────────┐ │ sandboxed cmd │ │ bypass broker │ │ ↓ │ │ - policy │ │ bypass.Submit() │──────│ - notification │ │ ↓ │ 9P │ - rate limit │ │ wait for result │←─────│ - user approval │ │ ↓ │ └──────────────────┘ │ execute direct │ └─────────────────┘		2026-08-12 08:48:32 +02:00
..
exec.go	bypass: route approval through 9P instead of Unix socket	2026-08-12 08:48:32 +02:00