feat(agent): add exact approvals and run modes

[RaresKeY]

Summary

Add thread-level Ask, Sandbox, and Full Access authority modes plus opaque exact-action approvals. The server binds each approval to the owner, session, originating run, exact tool name and input, workspace, selected mode, capability effects, and current provenance, then consumes it once so a model cannot widen, replay, or transfer the grant.

Sandbox is the safe default. Ask requires confirmation for each risky action, while Full Access is an explicit admin/single-user choice that permits direct host execution with the user's ordinary OS permissions. Mode state persists with the session and is enforced again at dispatch rather than relying on prompt compliance or frontend state.

Stack

This is the authority-mode slice in #5815 directly on the #6120 process-core foundation. The low-level #6119 and #6118 substrates are transitive through #6120; #6121 is deployment/runtime integration rather than a direct authority-code dependency. The #6084 gate change is a related sibling whose behavior was reconciled into this branch, not a required parent. #5821 remains the direct later provenance slice.

Target branch

• This PR targets dev, not main. All PRs land in dev; main is curated by the maintainer at each release.

Linked Issue

Part of #6092

Part of #5815

Part of #4754

Depends on PR #6120

Related: #6084

Related: #3709 and #553

Type of Change

• Bug fix (non-breaking — fixes a confirmed issue)
• New feature (non-breaking — adds new behaviour)
• Breaking change (changes or removes existing behaviour)
• Refactor / cleanup (behaviour unchanged)
• Documentation only
• CI / tooling / configuration

Checklist

• I searched open issues and open PRs; prior mode/approval work such as Add a 5-mode composer with server-side permission enforcement + approvals #555 and Agent execution modes (Auto / Accept Edits / Plan) + Speech-to-Text settings #1780 is closed, and no open PR implements exact one-use grants bound to the full execution context.
• This PR targets dev.
• My changes are limited to session authority modes, exact approvals, execution-profile routing, persistence/API wiring, focused UI state, and regression coverage.
• I actually ran the app end-to-end. Focused automated tests and JavaScript syntax checks pass; approval interaction, reload, desktop/mobile layout, and live host/sandbox execution were not exercised in the running app.

How to Test

1. Run:

   python -m pytest -q \
     tests/test_agent_run_policy.py \
     tests/test_execution_sandbox.py \
     tests/test_external_context_tool_gate.py \
     tests/test_session_mode_helpers.py \
     tests/test_ask_user_persistence.py \
     tests/test_teacher_eval_tier2.py
   
   node --check static/app.js
   node --check static/js/chat.js
   node --check static/js/chatRenderer.js
   node --check static/js/init.js
   node --check static/js/sessions.js

   Current secretless validation on the rebased public head passes 176 focused tests; the listed JavaScript syntax checks remain applicable.

2. Create a thread in Sandbox mode and verify Bash/Python use the workspace sandbox while public reads and ordinary interaction tools remain available.

3. Switch to Ask mode, request a risky tool, approve the exact action, and verify the grant is consumed once. Change the command, tool, workspace, session, mode, owner, or originating run and verify the approval is rejected.

4. As an admin/single-user, explicitly select Full Access, accept the warning, and verify host process execution uses normal OS permissions. Verify non-admin users cannot retain or request Full Access.

5. Reload and switch sessions. Verify each thread restores its persisted mode and pending approvals do not cross session or run boundaries.

Current restacked-head validation passes 176 focused tests, Python compilation, and git diff --check.

Not yet validated: live Docker/native execution, running-app approval interaction, session reload/resume, desktop/mobile layout, or multi-worker one-use consumption.

The authority-control placement and running-app evidence remain unresolved, so this PR is opening as a draft.

Visual / UI changes — REQUIRED if you touched anything that renders

This changes agent-mode controls and approval rendering. Running-app visual evidence is required before marking the PR ready for review.

• Screenshot or short clip — missing; capture the authority control, exact-approval prompt, and Full Access warning. Include mobile evidence if the control remains in the composer.
• Style match — not yet verified in the running app.
• No new component patterns — maintainer direction is still needed on whether this belongs in the composer or an existing overflow/settings/slash-command surface.
• I am not an LLM agent submitting a bulk PR. This is a focused, user-directed security slice, not automated or mass submission.

Screenshots / clips

Pending running-app desktop/mobile capture after the authority-control placement is finalized.

[github-actions]

⚠️ PR description is complete; validation evidence is still outstanding

Changed-file classification: UI-sensitive.

Author-reported runtime / visual state

• App/runtime validation is not author-attested. Check the run box only after running it, or check the explicit not-run box and describe the gap.
• The screenshot/clip checkbox is not checked for this UI-sensitive change.
• The Screenshots / clips section does not contain an actual attachment or link.

Checkboxes are author attestations. GitHub Actions results remain the execution evidence for CI; this check does not prove that a local command ran.

---

This comment updates automatically when the description or changed files change.