feat(agent): sandbox conversation analysis

tests/routes/chatPermissionPolicy.test.ts

@@ -130,6 +130,36 @@ describe("permission approval policy", () => {
     });
   });
 
+  it("auto approves sandboxed shell and file access in a conversation workspace", async () => {
+    const root = await mkdtemp(join(tmpdir(), "permission-conversations-"));
+    const conversationRoot = join(root, "conversation-workspaces");
+    const workspaceRoot = join(conversationRoot, "conversation-test");
+    try {
+      await mkdir(workspaceRoot, { recursive: true });
+      expect(
+        resolvePermissionApproval("auto", "bash", {
+          workspaceRoot,
+          metadata: { command: "python3 analysis.py" },
+        }),
+      ).toMatchObject({ autoApprove: true, autoReject: false });
+      expect(
+        canAutoApprovePermission("edit", {
+          workspaceRoot,
+          metadata: { filePath: join(workspaceRoot, "result.json") },
+        }),
+      ).toBe(true);
+      expect(
+        canAutoApprovePermission("glob", {
+          workspaceRoot,
+          metadata: { path: workspaceRoot, pattern: "**/*.json" },
+          patterns: ["**/*.json"],
+        }),
+      ).toBe(true);
+    } finally {
+      await rm(root, { force: true, recursive: true });
+    }
+  });
+
   it.each([
     "rm -rf ./target",
     "rm  -rf ./target",
@@ -157,14 +187,14 @@ describe("permission approval policy", () => {
   });
 
   it.each(["rm tmp.txt", "rm -f tmp.txt", "rm -r tmp-dir", "echo 'rm -rf tmp'"])(
-    "keeps non-recursive or non-executed removal text available for confirmation: %s",
+    "allows non-force-recursive or non-executed removal text in always mode: %s",
     (command) => {
       expect(
         resolvePermissionApproval("always", "bash", {
           metadata: { command },
           patterns: [command],
         }),
-      ).toMatchObject({ autoApprove: false, autoReject: false });
+      ).toMatchObject({ autoApprove: true, autoReject: false });
     },
   );
 });