feat: #297 — --disable-ocap/--yolo interim exec escape hatch

[hartsock]

Ref #297.

What this PR does

The explicit, loud, interim bypass for the stub-shell fail-closed exec problem (#297):

• --disable-ocap (alias --yolo) + NEWT_DISABLE_OCAP=1 — global CLI flag threaded via env exactly like feat: #263 — --prompt-for-permissions (prompted ocap grants with session record) #289's --prompt-for-permissions. Deliberately no config-file key: the bypass must be asserted per invocation and can never silently persist. The env read is fail-closed: only the exact value 1 asserts it.
• Bypass mechanism (newt-core/src/agentic/tools.rs): when asserted, run_command skips agent_bridle::registry().dispatch("shell", …) and runs the command on the plain host shell — bash -c with sh -c fallback (cmd /C on Windows) — with the same venv_cmd_prefix() applied, and wraps the result in an envelope structurally identical to the bridle one: { exit_code, stdout, stderr, sandbox_kind: "none" } with denied/denials omitted exactly as the bridle envelope omits them when nothing was denied. envelope_denied / shell_envelope_output and the loop's truncation/denial/exit-code handling needed zero changes.
• web_fetch finding (empirical): NOT broken on stub builds, therefore NOT bypassed. The feat/stub-shell branch (locked rev 2129c91) stubs only the shell tool (ShellTool::invoke unconditionally returns the "temporarily unavailable… feat(core): add CommandInterceptor exec/open hook to ShellExtensions reubeno/brush#1184" error); agent-bridle-tool-web on the same rev is the full real implementation (net allowlist, SSRF screen, redirect re-check, IP pin, actual fetch). The existing web_fetch leash-denial tests passing on stub CI corroborate this. Scoped to actual breakage, per the issue.
• fs fence untouched: read_file/write_file/edit_file/list_dir keep the newt-native workspace fence under yolo — unconfined exec, fenced fs, never a global authority-off switch.
• Surfacing: unmissable session-start banner (⚠ ocap DISABLED (--disable-ocap): commands run unconfined on the host shell …) plus ONE record in the feat(permissions): --prompt-for-permissions — interactive grant on capability denial, with a session-recorded decision log #263 permission log: { tool: "run_command", kind: "exec", target: "*", decision: "ocap-disabled", scope: "session" }.
• Precedence: --disable-ocap > --prompt-for-permissions for exec — nothing is denied, so the feat(permissions): --prompt-for-permissions — interactive grant on capability denial, with a session-recorded decision log #263 gate is structurally unreachable for run_command; fs prompting unaffected (tested).
• Interim contract: every new item is doc-marked INTERIM referencing ocap escape hatch: --disable-ocap (--yolo) runs exec unconfined until brush upstreams CommandInterceptor #297, agent-bridle#20, and feat(core): add CommandInterceptor exec/open hook to ShellExtensions reubeno/brush#1184, to be removed (or demoted to a debug flag) when brush upstreams CommandInterceptor.

Test plan

13 new tests (8 newt-core, 4 newt-tui, 1 newt-cli), all env-mutating ones serialized behind async-aware locks with RAII env restore:

• Flag off = current behavior pinned: the stub dispatch error surfaces verbatim (error: … reubeno/brush/pull/1184).
• Flag on: a command the stub shell fails closed on succeeds via host shell (echo yolo-ok → yolo-ok\n); empty output keeps the (exit N) shape.
• Envelope parity: exit_code/stdout/stderr/sandbox_kind present, denied/denials omitted, envelope_denied reads false, shell_envelope_output formats it identically.
• venv/PATH prefix rides the host shell (echo "$VIRTUAL_ENV" under NEWT_VENV).
• Banner content; ocap-disabled record shape + jsonl round-trip.
• fs fence still enforced under yolo (workspace-escape write denied, file not created; out-of-scope read denied) — in both newt-core and newt-tui suites.
• Precedence: exec never consults the gate under yolo (panic-gate + decision-count proofs); an fs denial still prompts and an allow-once still grants.
• NEWT_DISABLE_OCAP exact-value semantics (1 on; 0/empty/true/yes off) — the env-var-equivalence half (the flag just exports the var).
• --disable-ocap and --yolo alias parse (bare and explicit code), off by default.
• Corrective tool-name guard still answers before the bypass.

Gates: just check green, just cov-ci green at 90.10% (floor 80%), just shell-check green (no patch-wiring changes).

Out of scope

• Removing the [patch.crates-io] block or any agent-bridle changes (tracked by agent-bridle#20 / its crates.io release).
• Any config-file key for the bypass — deliberately excluded by the issue.
• Bypassing web_fetch — empirically not broken on stub builds (see finding above).
• The MCP server's own bridle dispatch surface; ocap escape hatch: --disable-ocap (--yolo) runs exec unconfined until brush upstreams CommandInterceptor #297 scopes to the agentic loop's run_command.

🤖 Generated with Claude Code