feat(runtime): project process connections through providers

README.md

@@ -153,6 +153,11 @@ environment-owned, workspace-local endpoint. The endpoint is available only to
 `bwrap` workspaces with network isolation and is bound to the exact CLI process
 selected by the harness. Platform credentials stay in the environment-owned
 relay rather than the CLI environment, workspace manifest, or child processes.
+Codex therefore uses the environment sandbox instead of starting a nested
+Codex sandbox for process-bound hosted execution.
+The workspace probes its substrate and uses either seccomp notification or a
+ptrace-backed seccomp guard; it does not advertise process-bound connections
+when neither enforcement backend is available.
 
 → [Run & deploy](https://docs.hud.ai/v6/reference/runtime)
 

hud/agents/codex/agent.py

@@ -215,6 +215,7 @@ def codex_command(
     connection: Connection | None = None,
 ) -> str:
     env: dict[str, str] = {}
+    sandbox = "danger-full-access" if connection is not None else config.sandbox
     args = [
         executable,
         "exec",
@@ -224,7 +225,7 @@ def codex_command(
         "--color",
         "never",
         "--sandbox",
-        config.sandbox,
+        sandbox,
         "--model",
         config.model,
     ]

hud/agents/tests/test_codex_cli_agent.py

@@ -106,15 +106,22 @@ def test_command_follows_explicit_gateway_routing(monkeypatch: pytest.MonkeyPatc
         assert command.endswith(" -")
 
 
-def test_command_uses_process_bound_connection_without_its_credential() -> None:
+@pytest.mark.parametrize("sandbox", ["read-only", "workspace-write", "danger-full-access"])
+def test_command_uses_process_bound_connection_without_its_credential(
+    sandbox: str,
+) -> None:
     connection = Connection(
         name="inference",
         capability="ssh",
         url="https://inference.hud.so",
         headers={"Authorization": "Bearer scoped-runtime-token"},
     )
 
-    command = codex_command(CodexCLIConfig(use_hud_gateway=True), "bash", connection=connection)
+    command = codex_command(
+        CodexCLIConfig.model_validate({"use_hud_gateway": True, "sandbox": sandbox}),
+        "bash",
+        connection=connection,
+    )
 
     assert "scoped-runtime-token" not in command
     assert "HUD_CONNECTION_CREDENTIAL=hud-process-bound" in command
@@ -123,6 +130,9 @@ def test_command_uses_process_bound_connection_without_its_credential() -> None:
     assert f'model_providers.hud.base_url="{connection.client_url}"' in command
     assert "Trace-Id" not in command
     assert "exec env" in command
+    assert "--sandbox danger-full-access" in command
+    assert "--sandbox workspace-write" not in command
+    assert "--sandbox read-only" not in command
 
 
 @pytest.mark.parametrize("shell", ["bash", "powershell"])

hud/agents/types.py

@@ -195,6 +195,8 @@ class CodexCLIConfig(AgentConfig):
 
     Without an explicit inference connection or API key, the agent leaves
     ``CODEX_HOME`` unchanged so a login in that execution environment can apply.
+    A process-bound inference connection runs Codex without its inner sandbox;
+    the connection is available only inside the environment's isolated workspace.
     """
 
     model_name: str = "Codex CLI"