session/request_permission fails when rawInput.command is argv array #265
Description
In my testing, gpt-5.3-codex consistently sends rawInput.command as an argv array, whereas 5.2 and earlier sent it as a pure string. This difference results in the following issue.
In a fresh directory (with default "Read Only" permissions), create an agent-shell buffer using gpt-5.3-codex and submit the following prompt:
Can you create a file dummy.txt that says "hello"?
The observed behavior is that the agent responds with something like this:
I’ll create `dummy.txt` in `/Users/au710211/repos/test-repo/` with the exact content `hello`, then quickly verify it.
in progress execute Run printf 'hello
' > dummy.txt
...and then hangs, without executing the tool call.
Here are the key snippets from the logs (full logs below):
[...]
13:13:28.876 ← request session/request_permission
{"jsonrpc":"2.0","id":0,"method":"session/request_permission","params":{"sessionId":"<sessionID>","toolCall":{"toolCallId":"<toolCallId>","kind":"execute","status":"pending","title":"Run printf 'hello\n' > dummy.txt","content":[{"type":"content","content":{"type":"text","text":"I need escalated permissions to write a new file in this read-only sandbox.\nProposed Amendment: /bin/zsh\n-lc\nprintf 'hello\n' > dummy.txt"}}],"rawInput":{"call_id":"<toolCallId>","command":["/bin/zsh","-lc","printf 'hello\n' > dummy.txt"],"cwd":"~/repos/test-repo/","parsed_cmd":[{"cmd":"printf 'hello\n' > dummy.txt","type":"unknown"}],"proposed_execpolicy_amendment":["/bin/zsh","-lc","printf 'hello\n' > dummy.txt"],"reason":"I need escalated permissions to write a new file in this read-only sandbox.","turn_id":"1"}},"options":[{"optionId":"approved-for-session","name":"Always","kind":"allow_always"},{"optionId":"approved","name":"Yes","kind":"allow_once"},{"optionId":"abort","name":"No, provide feedback","kind":"reject_once"}]}}
↳ Routing as notification
↳ Routing as incoming request
REQUEST HANDLER ERROR >
Failed with error: (wrong-type-argument stringp ["/bin/zsh" "-lc" "printf 'hello
' > dummy.txt"])
It's clear what's happening: the command field of rawInput is being sent as a vector of strings, rather than a string:
I've fixed the issue in my fork (happy to send as a PR if you agree, or [...]): https://github.com/ultronozm/agent-shell/tree/fix/normalize-tool-commands
Full logs in case they're useful:
13:13:23.092 → request initialize
13:13:23.371 ← response result
13:13:23.371 → request authenticate
13:13:23.380 ← response unknown
13:13:23.380 → request session/new
13:13:23.425 ← response result
13:13:23.436 → request session/prompt
13:13:23.436 ← notification session/update
13:13:27.615 ← notification session/update
13:13:27.674 ← notification session/update
13:13:27.684 ← notification session/update
13:13:27.702 ← notification session/update
13:13:27.715 ← notification session/update
13:13:27.731 ← notification session/update
13:13:27.754 ← notification session/update
13:13:27.775 ← notification session/update
13:13:27.792 ← notification session/update
13:13:27.800 ← notification session/update
13:13:27.808 ← notification session/update
13:13:27.817 ← notification session/update
13:13:27.825 ← notification session/update
13:13:27.830 ← notification session/update
13:13:27.837 ← notification session/update
13:13:27.843 ← notification session/update
13:13:27.846 ← notification session/update
13:13:27.849 ← notification session/update
13:13:27.853 ← notification session/update
13:13:27.855 ← notification session/update
13:13:27.860 ← notification session/update
13:13:27.884 ← notification session/update
13:13:27.892 ← notification session/update
13:13:27.897 ← notification session/update
13:13:27.903 ← notification session/update
13:13:27.907 ← notification session/update
13:13:27.910 ← notification session/update
13:13:27.912 ← notification session/update
13:13:27.921 ← notification session/update
13:13:27.924 ← notification session/update
13:13:27.927 ← notification session/update
13:13:27.930 ← notification session/update
13:13:27.934 ← notification session/update
13:13:27.936 ← notification session/update
13:13:27.939 ← notification session/update
13:13:27.942 ← notification session/update
13:13:27.946 ← notification session/update
13:13:27.948 ← notification session/update
13:13:27.950 ← notification session/update
13:13:28.875 ← notification session/update
13:13:28.876 ← request session/request_permission
buffer: ACP traffic entry
:direction incoming
:kind request
:object
jsonrpc 2.0
id 0
method session/request_permission
params
sessionId <sessionId>
toolCall
toolCallId call_Kp2iQWLTxk5y4Y7PGPNG81DQ
kind execute
status pending
title Run printf 'hello
' > dummy.txt
content
type content
content
type text
text I need escalated permissions to write a new file in this read-only sandbox.
Proposed Amendment: /bin/zsh
-lc
printf 'hello
' > dummy.txt
rawInput
call_id <call_id>
command
cwd /Users/au710211/repos/test-repo/
parsed_cmd
cmd printf 'hello
' > dummy.txt
type unknown
proposed_execpolicy_amendment
reason I need escalated permissions to write a new file in this read-only sandbox.
turn_id 1
options
optionId approved-for-session
name Always
kind allow_always
optionId approved
name Yes
kind allow_once
optionId abort
name No, provide feedback
kind reject_once
INCOMING TEXT >
{"jsonrpc":"2.0","method":"session/update","params":{"sessionId":"<sessionID>","update":{"sessionUpdate":"tool_call","toolCallId":"<toolCallId>","title":"Run printf 'hello\n' > dummy.txt","kind":"execute","status":"in_progress","rawInput":{"call_id":"<toolCallId>","command":["/bin/zsh","-lc","printf 'hello\n' > dummy.txt"],"cwd":"~/repos/test-repo/","parsed_cmd":[{"cmd":"printf 'hello\n' > dummy.txt","type":"unknown"}],"source":"agent","turn_id":"1"}}}}
{"jsonrpc":"2.0","id":0,"method":"session/request_permission","params":{"sessionId":"<sessionID>","toolCall":{"toolCallId":"<toolCallId>","kind":"execute","status":"pending","title":"Run printf 'hello\n' > dummy.txt","content":[{"type":"content","content":{"type":"text","text":"I need escalated permissions to write a new file in this read-only sandbox.\nProposed Amendment: /bin/zsh\n-lc\nprintf 'hello\n' > dummy.txt"}}],"rawInput":{"call_id":"<toolCallId>","command":["/bin/zsh","-lc","printf 'hello\n' > dummy.txt"],"cwd":"~/repos/test-repo/","parsed_cmd":[{"cmd":"printf 'hello\n' > dummy.txt","type":"unknown"}],"proposed_execpolicy_amendment":["/bin/zsh","-lc","printf 'hello\n' > dummy.txt"],"reason":"I need escalated permissions to write a new file in this read-only sandbox.","turn_id":"1"}},"options":[{"optionId":"approved-for-session","name":"Always","kind":"allow_always"},{"optionId":"approved","name":"Yes","kind":"allow_once"},{"optionId":"abort","name":"No, provide feedback","kind":"reject_once"}]}}
INCOMING LINE >
{"jsonrpc":"2.0","method":"session/update","params":{"sessionId":"<sessionID>","update":{"sessionUpdate":"tool_call","toolCallId":"<toolCallId>","title":"Run printf 'hello\n' > dummy.txt","kind":"execute","status":"in_progress","rawInput":{"call_id":"<toolCallId>","command":["/bin/zsh","-lc","printf 'hello\n' > dummy.txt"],"cwd":"~/repos/test-repo/","parsed_cmd":[{"cmd":"printf 'hello\n' > dummy.txt","type":"unknown"}],"source":"agent","turn_id":"1"}}}}
INCOMING LINE >
{"jsonrpc":"2.0","id":0,"method":"session/request_permission","params":{"sessionId":"<sessionID>","toolCall":{"toolCallId":"<toolCallId>","kind":"execute","status":"pending","title":"Run printf 'hello\n' > dummy.txt","content":[{"type":"content","content":{"type":"text","text":"I need escalated permissions to write a new file in this read-only sandbox.\nProposed Amendment: /bin/zsh\n-lc\nprintf 'hello\n' > dummy.txt"}}],"rawInput":{"call_id":"<toolCallId>","command":["/bin/zsh","-lc","printf 'hello\n' > dummy.txt"],"cwd":"~/repos/test-repo/","parsed_cmd":[{"cmd":"printf 'hello\n' > dummy.txt","type":"unknown"}],"proposed_execpolicy_amendment":["/bin/zsh","-lc","printf 'hello\n' > dummy.txt"],"reason":"I need escalated permissions to write a new file in this read-only sandbox.","turn_id":"1"}},"options":[{"optionId":"approved-for-session","name":"Always","kind":"allow_always"},{"optionId":"approved","name":"Yes","kind":"allow_once"},{"optionId":"abort","name":"No, provide feedback","kind":"reject_once"}]}}
↳ Routing as notification
↳ Routing as incoming request
REQUEST HANDLER ERROR >
Failed with error: (wrong-type-argument stringp ["/bin/zsh" "-lc" "printf 'hello
' > dummy.txt"])