Dylan Hurd a57b398351 Require approval for input to escalated terminals (#40978) ...

## What changed

- Add the `write_stdin_approval` feature flag, disabled by default, to require a fresh approval before sending non-empty input to an escalated unified-exec terminal.
- Route these reviews through hooks, Guardian, app-server, and the TUI as `writeStdin` approvals while keeping the parent command item unchanged.
- Preserve the terminal environment, launch directory, and escalation state across turns, and revalidate the process identity after approval before writing input.

## Testing

- Cover approval routing, policy decisions, process reuse, terminal identity preservation, app-server events, analytics, and TUI rendering.

GitOrigin-RevId: 4ba29eaae6208e934737ba078c96e589c7c2164d

2026-08-26 21:39:05 +00:00

..

models

Preserve content item kinds in message metadata (#40174)

2026-08-23 02:50:45 +00:00

openai_models

Honor Guardian runtime settings from model defaults (#39738)

2026-08-20 16:45:59 +00:00

prompts/base_instructions

chore(core) rm AskForApproval::OnFailure (#28418)

2026-06-23 12:13:54 -07:00

account.rs

Support Edu Plus and Edu Pro account plans (#39316)

2026-08-18 23:47:00 +00:00

agent_path.rs

…

approvals.rs

Require approval for input to escalated terminals (#40978)

2026-08-26 21:39:05 +00:00

auth.rs

Support managed AWS access keys for Amazon Bedrock (#40481)

2026-08-24 21:39:48 +00:00

capabilities_tests.rs

Make selected plugin roots URI-native (#28918)

2026-06-23 22:51:19 +01:00

capabilities.rs

Make selected plugin roots URI-native (#28918)

2026-06-23 22:51:19 +01:00

config_types.rs

Keep credentials out of app-server logs (#39993)

2026-08-21 19:04:32 +00:00

dynamic_tools.rs

Add audio output support to dynamic tools and code mode (#34080)

2026-07-18 23:22:13 +00:00

environment.rs

Honor environment-resolved workspace roots (#40912)

2026-08-26 16:28:35 +00:00

error_tests.rs

Classify streaming rate-limit errors (#40931)

2026-08-26 17:45:42 +00:00

error.rs

Expose resumable misalignment details through app server (#40952)

2026-08-26 18:42:44 +00:00

exec_output_tests.rs

…

exec_output.rs

…

items.rs

Track remaining multi-agent v2 tools in analytics (#40585)

2026-08-25 10:17:03 +00:00

legacy_events.rs

Track remaining multi-agent v2 tools in analytics (#40585)

2026-08-25 10:17:03 +00:00

lib.rs

Sanitize credentials from Git remote metadata (#40713)

2026-08-25 21:34:05 +00:00

local_media_tests.rs

Add durable user-message queue dispatch (#37204)

2026-08-06 03:11:42 +00:00

local_media.rs

Add durable user-message queue dispatch (#37204)

2026-08-06 03:11:42 +00:00

mcp_approval_meta.rs

Support MCP form input in full-access user threads (#37864)

2026-08-10 18:20:12 +00:00

mcp_policy.rs

Enforce environment MCP policies (#39335)

2026-08-19 01:26:16 +00:00

mcp.rs

Support cua_repl as a Node REPL-backed MCP server (#40257)

2026-08-23 17:02:21 +00:00

memory_citation.rs

…

models.rs

Preserve MCP tool output as content items (#40737)

2026-08-25 23:42:50 +00:00

network_policy.rs

…

num_format.rs

Remove unused Rust helpers (#34345)

2026-07-20 13:45:29 +00:00

openai_models.rs

Support persistent reasoning effort (#40799)

2026-08-26 05:00:23 +00:00

parse_command.rs

…

permission_profile_intersection_tests.rs

Add safe permission profile intersection (#39242)

2026-08-18 17:53:36 +00:00

permission_profile_intersection.rs

Add safe permission profile intersection (#39242)

2026-08-18 17:53:36 +00:00

permission_profile_snapshot.rs

Move permission profile snapshots into the protocol (#38651)

2026-08-14 21:17:29 +00:00

permissions.rs

Honor attachment-owned permissions for MCP servers (#40728)

2026-08-25 22:50:49 +00:00

plan_tool.rs

…

protocol.rs

Expose resumable misalignment details through app server (#40952)

2026-08-26 18:42:44 +00:00

realtime.rs

Persist realtime events in the thread timeline (#40508)

2026-08-25 01:03:20 +00:00

request_permissions.rs

Let permission hooks resolve strict auto-review requests (#32232)

2026-07-10 18:12:27 +00:00

request_user_input_tests.rs

Make user input blocking behavior explicit (#36410)

2026-08-01 00:38:10 +00:00

request_user_input.rs

Make user input blocking behavior explicit (#36410)

2026-08-01 00:38:10 +00:00

response_item_id_tests.rs

Require prefixes for outbound response item IDs (#32312)

2026-07-11 02:29:14 +00:00

response_item_id.rs

Require prefixes for outbound response item IDs (#32312)

2026-07-11 02:29:14 +00:00

review_format.rs

feat(core): emit canonical review mode items (#31473)

2026-07-08 09:59:50 -07:00

sanitized_git_url_tests.rs

Sanitize credentials from Git remote metadata (#40713)

2026-08-25 21:34:05 +00:00

sanitized_git_url.rs

Sanitize credentials from Git remote metadata (#40713)

2026-08-25 21:34:05 +00:00

security_risk.rs

Record reviewed actions with security risk scores (#40901)

2026-08-26 15:02:21 +00:00

session_id.rs

…

shell_environment_tests.rs

Prevent Node REPL auth tokens from reaching child processes (#39301)

2026-08-18 22:29:58 +00:00

shell_environment.rs

Add credential brokering to network proxy feature config (#40466)

2026-08-24 19:52:27 +00:00

thread_id.rs

Distinguish rollout IDs from thread IDs (#38127)

2026-08-12 05:20:32 +00:00

tool_name.rs

Canonicalize default tools under the functions namespace (#37022)

2026-08-05 04:07:59 +00:00

turn_input.rs

Add per-turn cyber access program selection (#40687)

2026-08-25 19:54:52 +00:00

user_input.rs

Forward audio inputs to the Responses API (#33932)

2026-07-18 00:26:24 +00:00