kingwl 0e49615a3d feat(tool-bash): sandbox escalation — one approved wider retry after a denial ...

The tool gate advertises sandbox_permissions (an enum of exactly the modes
STRICTLY WIDER than the mounted executor default — the schema makes a
non-widening request inexpressible) plus a required justification, exactly
when ctx.bash.sandboxMode reports a confining mode at registration:
composition truth, never a dead lever. An escalating call resolves
ctx.approval BEFORE anything executes with the audit-self-contained reason
"escalate sandbox to <mode>: <justification>"; allowed-once stamps the
granted mode onto that one bash request (the seam-level per-call override),
while rejected / cancelled / unavailable and the no-service / no-agent
paths each fail closed with their own error text and execute nothing. The
description teaches the flow only when the fields exist: retry the SAME
command once after a real denial, never preemptively; a rejected
escalation is final. No new session events: the attempt is an ordinary
tool/call, the decision is the approval audit pair, the outcome an
ordinary tool/result whose facts name the mode it ran under.

2026-07-10 15:43:28 +08:00

..

integration.spec.ts

feat(events): interception seams — the typed-Decision surface for hooks

2026-06-30 17:11:18 +08:00

tools.spec.ts

feat(tool-bash): sandbox escalation — one approved wider retry after a denial

2026-07-10 15:43:28 +08:00