jif 86b2eca691 Allow dangerous-command review when sandbox approvals are disabled (#59120) ...

## Why

Setting granular `sandbox_approval` to `false` also blocked approval requests for dangerous commands such as `rm -f`, even when they requested no additional permissions. Reviewing a dangerous command should remain possible within the existing permission profile.

## What changed

Allow heuristic dangerous-command approval requests with `sandbox_approval = false` when execution stays within current permissions. Do not propose reusable execution-policy amendments for these approvals, since reusable allow rules can bypass the sandbox on later calls.

Keep escalation requests, explicit policy rules, and Windows execution without required sandbox protection subject to their existing approval restrictions. Clarify the meaning of `sandbox_approval` in the protocol and generated schemas.

## Testing

Add coverage for POSIX and Windows approval decisions, approval and denial of deletion commands, preservation of read-only restrictions, and separate dangerous-command approval after turn-scoped or session-scoped write grants.

GitOrigin-RevId: 90adc137c7b7d3f3ee68efb1f6bea531229e7834

2026-11-03 11:14:59 +00:00

..

schema

Allow dangerous-command review when sandbox approvals are disabled (#59120)

2026-11-03 11:14:59 +00:00

scripts

Generate Python SDK types from repository app-server schemas (#44032)

2026-09-09 03:27:31 +00:00

src

Expose assistant content token counts in completion notifications (#59041)

2026-11-03 02:26:29 +00:00

BUILD.bazel

Use a dedicated binary for Bazel schema generation (#58083)

2026-10-29 13:37:06 +00:00

Cargo.toml

Keep credentials out of app-server logs (#39993)

2026-08-21 19:04:32 +00:00

schema_generator.rs

Use a dedicated binary for Bazel schema generation (#58083)

2026-10-29 13:37:06 +00:00