sayan-oai e38290846c Enforce environment-specific command policies (#38942) ...

## What changed

- Add an optional restrictive execution policy to `EnvironmentConfig` and merge it over the active command policy for shell execution and approval decisions.
- Reject environment policies that contain allow rules, so environment configuration can only tighten command access.
- Include the environment policy fingerprint in cached approval keys so policy changes require fresh session approvals.

## Testing

- Cover restrictions overriding saved prefix approvals, policy changes invalidating session approvals, and environment overlays remaining effective when model-specific prefix filtering is active.

GitOrigin-RevId: e94f877549ed5e0f577b8cb52f3c1872c58f029d

2026-08-17 04:37:50 +00:00

..

models

Retain attempted tool metadata across prompts (#36507)

2026-08-01 17:36:39 +00:00

prompts/base_instructions

chore(core) rm AskForApproval::OnFailure (#28418)

2026-06-23 12:13:54 -07:00

account.rs

Support Enterprise automation account plans (#36228)

2026-07-30 21:49:53 +00:00

agent_path.rs

chore: morpheus to path (#18353)

2026-04-20 10:32:20 +01:00

approvals.rs

Preserve plugin attribution across command approvals (#35029)

2026-07-23 23:13:59 +00:00

auth.rs

Support Enterprise automation account plans (#36228)

2026-07-30 21:49:53 +00:00

capabilities_tests.rs

Make selected plugin roots URI-native (#28918)

2026-06-23 22:51:19 +01:00

capabilities.rs

Make selected plugin roots URI-native (#28918)

2026-06-23 22:51:19 +01:00

config_types.rs

Add conservative restriction helpers for tool policies (#38183)

2026-08-12 12:53:07 +00:00

dynamic_tools.rs

Add audio output support to dynamic tools and code mode (#34080)

2026-07-18 23:22:13 +00:00

environment.rs

Enforce environment-specific command policies (#38942)

2026-08-17 04:37:50 +00:00

error_tests.rs

Enforce strict tool name collision errors (#37020)

2026-08-05 04:00:50 +00:00

error.rs

Surface misalignment policy violations as typed errors (#38682)

2026-08-15 01:34:33 +00:00

exec_output_tests.rs

extract models manager and related ownership from core (#16508)

2026-04-02 23:00:02 -07:00

exec_output.rs

extract models manager and related ownership from core (#16508)

2026-04-02 23:00:02 -07:00

items.rs

Expose MCP read-only hints in tool call items (#36055)

2026-07-30 01:37:41 +00:00

legacy_events.rs

Expose image generation usage-limit failures (#38024)

2026-08-11 15:40:52 +00:00

lib.rs

Move permission profile snapshots into the protocol (#38651)

2026-08-14 21:17:29 +00:00

local_media_tests.rs

Add durable user-message queue dispatch (#37204)

2026-08-06 03:11:42 +00:00

local_media.rs

Add durable user-message queue dispatch (#37204)

2026-08-06 03:11:42 +00:00

mcp_approval_meta.rs

Support MCP form input in full-access user threads (#37864)

2026-08-10 18:20:12 +00:00

mcp.rs

Support MCP form input in full-access user threads (#37864)

2026-08-10 18:20:12 +00:00

memory_citation.rs

feat: add memory citation to agent message (#14821)

2026-03-18 10:03:38 +00:00

models.rs

Move permission profile snapshots into the protocol (#38651)

2026-08-14 21:17:29 +00:00

network_policy.rs

extract models manager and related ownership from core (#16508)

2026-04-02 23:00:02 -07:00

num_format.rs

Remove unused Rust helpers (#34345)

2026-07-20 13:45:29 +00:00

openai_models.rs

Source multi-agent instructions from the model catalog (#38619)

2026-08-14 18:26:20 +00:00

parse_command.rs

[app-server] remove serde(skip_serializing_if = "Option::is_none") annotations (#5939)

2025-10-30 18:18:53 +00:00

permission_profile_snapshot.rs

Move permission profile snapshots into the protocol (#38651)

2026-08-14 21:17:29 +00:00

permissions.rs

Add an AbsolutePathBuf conversion for FileSystemPath (#38460)

2026-08-14 00:18:29 +00:00

plan_tool.rs

Plan mode: stream proposed plans, emit plan items, and render in TUI (#9786)

2026-01-30 18:59:30 +00:00

protocol.rs

Add MCP tool handler support to the hooks engine (#38705)

2026-08-15 05:53:54 +00:00

request_permissions.rs

Let permission hooks resolve strict auto-review requests (#32232)

2026-07-10 18:12:27 +00:00

request_user_input_tests.rs

Make user input blocking behavior explicit (#36410)

2026-08-01 00:38:10 +00:00

request_user_input.rs

Make user input blocking behavior explicit (#36410)

2026-08-01 00:38:10 +00:00

response_item_id_tests.rs

Require prefixes for outbound response item IDs (#32312)

2026-07-11 02:29:14 +00:00

response_item_id.rs

Require prefixes for outbound response item IDs (#32312)

2026-07-11 02:29:14 +00:00

review_format.rs

feat(core): emit canonical review mode items (#31473)

2026-07-08 09:59:50 -07:00

security_risk.rs

Keep the latest Guardian risk score during concurrent sampling (#38580)

2026-08-14 13:44:51 +00:00

session_id.rs

feat: add session_id (#20437)

2026-05-06 10:48:37 +02:00

shell_environment_tests.rs

Prevent Noise auth tokens from reaching child processes (#38941)

2026-08-17 04:17:45 +00:00

shell_environment.rs

Prevent Noise auth tokens from reaching child processes (#38941)

2026-08-17 04:17:45 +00:00

thread_id.rs

Distinguish rollout IDs from thread IDs (#38127)

2026-08-12 05:20:32 +00:00

tool_name.rs

Canonicalize default tools under the functions namespace (#37022)

2026-08-05 04:07:59 +00:00

turn_input.rs

Add interrupted turn recovery (#38303)

2026-08-13 03:27:19 +00:00

user_input.rs

Forward audio inputs to the Responses API (#33932)

2026-07-18 00:26:24 +00:00