Dylan Hurd 910ecccf30 Skip sandboxed shell commands in Guardian v2 by default (#39631) ...

## What changed

- Exclude sandboxed `exec_command` and `shell_command` calls from Guardian v2 classification by default while continuing to classify calls that request `require_escalated` permissions.
- Add `guardianv2.review_scope.sandboxed_exec_commands` to opt sandboxed shell commands back into classification.
- Keep other tools and namespaced shell tools in scope, and advance tool-call progress when a call is skipped.

## Testing

- Cover the default and configured review scopes, tool namespaces, permission modes, and skipped-call progress tracking.

GitOrigin-RevId: 32fb540c69959b9a82569f0f2fc76b5517496e6b

2026-08-20 07:08:31 +00:00

..

src

Skip sandboxed shell commands in Guardian v2 by default (#39631)

2026-08-20 07:08:31 +00:00

BUILD.bazel

build: run buildifier from just fmt (#28125)

2026-06-13 21:43:39 -07:00

Cargo.toml

Refactor config types into a separate crate (#16962)

2026-04-07 00:32:41 +00:00