Merge branch 'master' into xtr/agent-loop-message-machine

2026-07-24 22:48:18 +08:00
parent 992cf894af b97b1b4a3f
commit b36a82fc98
544 changed files with 14951 additions and 222 deletions
@@ -2,6 +2,8 @@

 Status: implemented

+English | [中文](2026-07-06-sandbox.zh.md)
+
 ## Problem

 A coding agent needs this product path: bash subprocesses — and the hook commands that ride them — execute under a restricted file sandbox by default; if and only if the sandbox actually denies an operation, the model may request one user approval for that same operation and, once granted, retry it once with wider permissions. An every-tool boundary is deliberately NOT the claim: fs/web/todo execute in-process where an `execve` wrapper is meaningless (§ In-process tools), and the cross-family boundary is staged follow-up work (§ Deferred phases). Without a shared vocabulary, every tool reinvents approval fields, denial parsing, retry matching, and permission-state hints.