jif 9cc14e7988 Add managed command checkpoints requiring fresh human approval (#58045) ...

## Why

Managed command policies need to require a human decision independently of automatic review, hook allowances, and saved approvals.

## What changed

- Support `decision = "prompt-user"` in managed `requirements.toml` prefix rules, requiring a fresh, one-time human decision for matching commands.
- Add experimental `humanCommand` approval requests for clients advertising both `experimentalApi` and `requiredHumanApproval`. Accept only `accept`, `decline`, or `cancel`; reject commands when no capable client is available.
- Restrict responses to capable clients that received the request, and replay pending prompts to compatible clients on reconnect.
- Enable the capability in the TUI and update protocol schemas and client bindings.

## Testing

Add coverage for fresh decisions overriding saved allowances, hook allowances, and automatic review, plus child-thread approval routing and rejection of responses from incompatible or unrelated clients.

GitOrigin-RevId: 0b95ff6aab7f8a04b7298c8a4329d1fddf6a603e

2026-10-29 11:23:51 +00:00

..

models

Track content provenance through prompt assembly and compaction (#53831)

2026-10-14 02:01:49 +00:00

openai_models

Centralize Guardian classification of multi-agent tool calls (#57455)

2026-10-27 13:55:51 +00:00

permissions

Protect metadata writes through macOS case aliases (#54273)

2026-10-15 12:01:04 +00:00

prompts/base_instructions

…

account.rs

Add a built-in Google Cloud Vertex AI provider (#56265)

2026-10-22 21:01:14 +00:00

agent_error.rs

Add bounded diagnostics for agent spawn failures (#51355)

2026-10-06 12:32:27 +00:00

agent_path.rs

…

approvals.rs

Add managed command checkpoints requiring fresh human approval (#58045)

2026-10-29 11:23:51 +00:00

auth.rs

Add support for Academic Researchers plans (#55387)

2026-10-19 21:43:19 +00:00

capabilities_tests.rs

…

capabilities.rs

Bind capability roots to environment selections (#51493)

2026-10-06 22:39:32 +00:00

codex_error_info.rs

Distinguish policy-restricted capacity failures from server overloads (#57452)

2026-10-27 13:31:38 +00:00

config_types.rs

Retire the personality feature flag and document deprecated settings (#45809)

2026-09-15 23:39:40 +00:00

conversation_start_params_tests.rs

Forward client voice session IDs in realtime requests (#53784)

2026-10-13 22:21:31 +00:00

dynamic_tools.rs

…

environment.rs

Add hook configuration to environment attachments (#56302)

2026-10-23 00:02:29 +00:00

error_tests.rs

Point usage and credit links to ChatGPT settings (#49874)

2026-10-01 05:16:40 +00:00

error.rs

Distinguish policy-restricted capacity failures from server overloads (#57452)

2026-10-27 13:31:38 +00:00

exec_output_tests.rs

…

exec_output.rs

…

guardian_transcript.rs

Add an optional JSON transcript format for Guardian (#51465)

2026-10-06 19:30:57 +00:00

hooks.rs

Add hook configuration to environment attachments (#56302)

2026-10-23 00:02:29 +00:00

items.rs

Track content provenance through prompt assembly and compaction (#53831)

2026-10-14 02:01:49 +00:00

legacy_events.rs

Expose and persist image generation IDs (#57552)

2026-10-27 19:43:27 +00:00

lib.rs

Add hook configuration to environment attachments (#56302)

2026-10-23 00:02:29 +00:00

local_media_tests.rs

Support image references by file ID in inputs and tool outputs (#45794)

2026-09-15 21:19:08 +00:00

local_media.rs

Support image references by file ID in inputs and tool outputs (#45794)

2026-09-15 21:19:08 +00:00

mcp_approval_meta.rs

Distinguish MCP approval cancellation reasons (#54679)

2026-10-16 19:08:19 +00:00

mcp_policy.rs

Enforce environment MCP policies (#39335)

2026-08-19 01:26:16 +00:00

mcp.rs

Discover and validate MCP authorization servers before ID-JAG exchange (#49478)

2026-09-30 04:30:01 +00:00

memory_citation.rs

…

memory_version.rs

Add configurable memory versions with isolated storage (#43797)

2026-09-08 10:55:48 +00:00

models.rs

Share additional tool declarations across response item clones (#54945)

2026-10-17 23:17:51 +00:00

network_policy.rs

…

num_format.rs

…

openai_models.rs

Support catalog headings for saved command-prefix notices (#57599)

2026-10-27 23:53:34 +00:00

parse_command.rs

…

permission_profile_intersection_tests.rs

Protect .aws directories under sandbox writable roots (#48176)

2026-09-25 19:14:31 +00:00

permission_profile_intersection.rs

Preserve target-native paths in command approvals (#42577)

2026-09-03 16:21:10 +00:00

permission_profile_snapshot_tests.rs

Preserve executor path URIs in permission profile workspace roots (#45863)

2026-09-16 04:23:46 +00:00

permission_profile_snapshot.rs

Preserve executor path URIs in permission profile workspace roots (#45863)

2026-09-16 04:23:46 +00:00

permissions.rs

Add MXC sandbox integrity dependency and policy preparation (#51831)

2026-10-07 21:16:25 +00:00

plan_tool.rs

…

protocol.rs

Add managed command checkpoints requiring fresh human approval (#58045)

2026-10-29 11:23:51 +00:00

realtime.rs

Persist realtime events in the thread timeline (#40508)

2026-08-25 01:03:20 +00:00

request_permissions.rs

Preserve target-native cwd in permission approval requests (#42314)

2026-09-02 17:27:50 +00:00

request_user_input_tests.rs

…

request_user_input.rs

…

response_item_id_tests.rs

…

response_item_id.rs

Preserve host-assigned user input IDs in Responses messages (#57538)

2026-10-27 19:00:03 +00:00

response_usage.rs

Preserve raw response usage metadata (#41980)

2026-09-01 05:17:11 +00:00

review_format.rs

…

sandbox.rs

Preserve sandbox overrides across execution requests (#51786)

2026-10-07 17:59:22 +00:00

sanitized_git_url_tests.rs

Sanitize credentials from Git remote metadata (#40713)

2026-08-25 21:34:05 +00:00

sanitized_git_url.rs

Sanitize credentials from Git remote metadata (#40713)

2026-08-25 21:34:05 +00:00

security_risk.rs

Record reviewed actions with security risk scores (#40901)

2026-08-26 15:02:21 +00:00

session_id.rs

…

shell_environment_tests.rs

Expose originating tool call metadata in command environments (#52119)

2026-10-08 13:45:19 +00:00

shell_environment.rs

Expose originating tool call metadata in command environments (#52119)

2026-10-08 13:45:19 +00:00

thread_id.rs

…

tool_name.rs

…

turn_input.rs

Preserve host-assigned user input IDs in Responses messages (#57538)

2026-10-27 19:00:03 +00:00

user_input.rs

Truncate input text in protocol debug output (#49415)

2026-09-30 00:51:15 +00:00