feat(core) Add login to shell_command tool (#6846)

## Summary
Adds the `login` parameter to the `shell_command` tool - optional,
defaults to true.

## Testing
- [x] Tested locally

codex-rs/core/src/shell.rs

@@ -408,6 +408,48 @@ mod tests {
         }
     }
 
+    #[test]
+    fn derive_exec_args() {
+        let test_bash_shell = Shell {
+            shell_type: ShellType::Bash,
+            shell_path: PathBuf::from("/bin/bash"),
+        };
+        assert_eq!(
+            test_bash_shell.derive_exec_args("echo hello", false),
+            vec!["/bin/bash", "-c", "echo hello"]
+        );
+        assert_eq!(
+            test_bash_shell.derive_exec_args("echo hello", true),
+            vec!["/bin/bash", "-lc", "echo hello"]
+        );
+
+        let test_zsh_shell = Shell {
+            shell_type: ShellType::Zsh,
+            shell_path: PathBuf::from("/bin/zsh"),
+        };
+        assert_eq!(
+            test_zsh_shell.derive_exec_args("echo hello", false),
+            vec!["/bin/zsh", "-c", "echo hello"]
+        );
+        assert_eq!(
+            test_zsh_shell.derive_exec_args("echo hello", true),
+            vec!["/bin/zsh", "-lc", "echo hello"]
+        );
+
+        let test_powershell_shell = Shell {
+            shell_type: ShellType::PowerShell,
+            shell_path: PathBuf::from("pwsh.exe"),
+        };
+        assert_eq!(
+            test_powershell_shell.derive_exec_args("echo hello", false),
+            vec!["pwsh.exe", "-NoProfile", "-Command", "echo hello"]
+        );
+        assert_eq!(
+            test_powershell_shell.derive_exec_args("echo hello", true),
+            vec!["pwsh.exe", "-Command", "echo hello"]
+        );
+    }
+
     #[tokio::test]
     async fn test_current_shell_detects_zsh() {
         let shell = Command::new("sh")

codex-rs/core/src/tools/handlers/shell.rs

@@ -49,8 +49,7 @@ impl ShellCommandHandler {
         turn_context: &TurnContext,
     ) -> ExecParams {
         let shell = session.user_shell();
-        let use_login_shell = true;
-        let command = shell.derive_exec_args(&params.command, use_login_shell);
+        let command = shell.derive_exec_args(&params.command, params.login.unwrap_or(true));
 
         ExecParams {
             command,
@@ -276,9 +275,15 @@ impl ShellHandler {
 mod tests {
     use std::path::PathBuf;
 
+    use codex_protocol::models::ShellCommandToolCallParams;
+    use pretty_assertions::assert_eq;
+
+    use crate::codex::make_session_and_context;
+    use crate::exec_env::create_env;
     use crate::is_safe_command::is_known_safe_command;
     use crate::shell::Shell;
     use crate::shell::ShellType;
+    use crate::tools::handlers::ShellCommandHandler;
 
     /// The logic for is_known_safe_command() has heuristics for known shells,
     /// so we must ensure the commands generated by [ShellCommandHandler] can be
@@ -312,4 +317,43 @@ mod tests {
             &shell.derive_exec_args(command, /* use_login_shell */ false)
         ));
     }
+
+    #[test]
+    fn shell_command_handler_to_exec_params_uses_session_shell_and_turn_context() {
+        let (session, turn_context) = make_session_and_context();
+
+        let command = "echo hello".to_string();
+        let workdir = Some("subdir".to_string());
+        let login = None;
+        let timeout_ms = Some(1234);
+        let with_escalated_permissions = Some(true);
+        let justification = Some("because tests".to_string());
+
+        let expected_command = session.user_shell().derive_exec_args(&command, true);
+        let expected_cwd = turn_context.resolve_path(workdir.clone());
+        let expected_env = create_env(&turn_context.shell_environment_policy);
+
+        let params = ShellCommandToolCallParams {
+            command,
+            workdir,
+            login,
+            timeout_ms,
+            with_escalated_permissions,
+            justification: justification.clone(),
+        };
+
+        let exec_params = ShellCommandHandler::to_exec_params(params, &session, &turn_context);
+
+        // ExecParams cannot derive Eq due to the CancellationToken field, so we manually compare the fields.
+        assert_eq!(exec_params.command, expected_command);
+        assert_eq!(exec_params.cwd, expected_cwd);
+        assert_eq!(exec_params.env, expected_env);
+        assert_eq!(exec_params.expiration.timeout_ms(), timeout_ms);
+        assert_eq!(
+            exec_params.with_escalated_permissions,
+            with_escalated_permissions
+        );
+        assert_eq!(exec_params.justification, justification);
+        assert_eq!(exec_params.arg0, None);
+    }
 }

codex-rs/core/src/tools/spec.rs

@@ -331,6 +331,15 @@ fn create_shell_command_tool() -> ToolSpec {
             description: Some("The working directory to execute the command in".to_string()),
         },
     );
+    properties.insert(
+        "login".to_string(),
+        JsonSchema::Boolean {
+            description: Some(
+                "Whether to run the shell with login shell semantics. Defaults to true."
+                    .to_string(),
+            ),
+        },
+    );
     properties.insert(
         "timeout_ms".to_string(),
         JsonSchema::Number {