fix:disable-agent-sandbox-at-runtime

scripts/subagent-app-regression.cjs

@@ -105,7 +105,7 @@ if (!process.versions.electron) {
           assert.ok(!names.includes('write_file'), 'read-only child never receives write tools')
           return sse(res, model, { name: 'read_file', args: { path: 'fixture.txt' } })
         }
-        assert.ok(write ? model.includes('approval') ? serialized.includes('拒绝') || serialized.includes('未批准') : serialized.includes('已写入')
+        assert.ok(write ? serialized.includes('已写入')
           : serialized.includes('PROJECT_FIXTURE_CONTENT'), 'actual child tool result returns to model')
         return sse(res, model, undefined, marker)
       }
@@ -281,25 +281,12 @@ if (!process.versions.electron) {
     await until(() => read('!document.querySelector(".conversation-member-detail")', liveWindow), 'close member detail')
     check('UI: closing member detail leaves the completed parent conversation intact', await read('document.body.textContent.includes("CONTROL_PARENT_COMPLETE")', liveWindow))
     liveWindow.destroy()
-    phase = 'default-permission-approval'
+    phase = 'legacy-sandbox-mode-inert'
     const approval = await start('agent-approval', 'default-sandbox')
-    const pending = await until(async () => {
-      const message = (await invoke('session', 'messages', approval.session.id)).at(-1)
-      return message.interactions?.find(item => item.kind === 'approval' && item.status === 'pending')
-    }, 'child write approval')
-    check('APP: child write approval appears under the parent run with the child name', pending.runId === approval.run.runId && pending.title.includes('文件分析 A'))
-    await invoke('chat', 'respond', approval.run.runId, pending.id, { kind: 'approval', optionId: 'reject-once' })
     const approvedMessage = await finish(approval.session)
-    check('APP: refusing child approval prevents the write and returns control', approvedMessage.status === 'done'
-      && !await fs.stat(path.join(workspaceRoot, 'approval.txt')).then(() => true, () => false))
-    phase = 'cancel-pending-approval'
-    const approvalCancel = await start('agent-approval-cancel', 'default-sandbox')
-    await until(async () => (await invoke('session', 'messages', approvalCancel.session.id)).at(-1).interactions?.some(item => item.status === 'pending'), 'approval to cancel')
-    await invoke('agents', 'update', { teamManagement: false })
-    const approvalCancelledMessage = await finish(approvalCancel.session)
-    check('APP: disabling during child approval cancels the prompt without hanging the parent', approvalCancelledMessage.status === 'done'
-      && approvalCancelledMessage.interactions.every(item => item.status !== 'pending')
-      && approvalCancelledMessage.parts.some(part => part.type === 'subagent' && part.agent.status === 'cancelled'))
+    check('APP: legacy default-sandbox value is inert; child write lands on the host without an approval prompt',
+      approvedMessage.status === 'done' && (approvedMessage.interactions ?? []).every(item => item.status !== 'pending')
+      && await fs.readFile(path.join(workspaceRoot, 'approval.txt'), 'utf8') === 'WRITTEN_BY_CHILD_A')
     phase = 'native-followup'
     await invoke('agents', 'update', { teamManagement: true })
     const followup = await start('agent-followup')