fix: allow AgentOS command execution

packages/primitives/src/agent-os.test.ts

@@ -9,10 +9,11 @@ describe("Codex agent-os config", () => {
     expect(config.software?.[0]).toBeTypeOf("object");
   });
 
-  it("allows outbound VM networking", () => {
+  it("allows repository execution capabilities", () => {
     const config = makeCodexAgentOsConfig();
     expect(config.permissions?.network).toBe("allow");
     expect(config.permissions?.fs).toBe("allow");
+    expect(config.permissions?.childProcess).toBe("allow");
   });
 
   it("builds model-provider session env", () => {

packages/primitives/src/agent-os.ts

@@ -114,14 +114,15 @@ export interface CodexAgentOsConfigInput {
 
 /**
  * are always present; software the caller passes is appended, never replacing
- * the harness or git. Filesystem and outbound networking are explicitly enabled
+ * the harness or git. Filesystem, child-process execution, and outbound network
- * for repository work and model-provider access. Model-provider env is supplied
+ * access are explicitly enabled for repository work and model-provider access.
- * per session via `codexSessionEnv`, not here — the actor config has no env field.
+ * Model-provider env is supplied per session via `codexSessionEnv`.
  */
 export const makeCodexAgentOsConfig = (
   input: CodexAgentOsConfigInput = {}
 ): AgentOSConfigInput<undefined> => ({
   permissions: {
+    childProcess: "allow",
     fs: "allow",
     network: "allow",
     ...input.permissions,