Allow build drivers to request sandbox escape

[jonathanKingston]

Closes #786

Summary

• classify host-dependent build operations as ambiguous instead of fully contained
• let the existing expects_sandbox_block approval path work for xcodebuild, Gradle, Swift, and Cargo builds
• retain hard-external precedence and keep non-build compiler queries sandbox-contained

Validation

• npm run check
• npm run build

---

Note

Medium Risk
Changes shell permission classification for common build commands; misclassification could over-prompt or under-restrict, but scope is narrow and hard-external precedence is preserved in tests.

Overview
Host-dependent toolchain builds (xcodebuild, gradle, and swift/cargo build-style subcommands) are now classified as ambiguous instead of fully sandbox-contained, because they often need host caches (~/.gradle, ~/.cargo, ~/Library) or system build services even when argv looks workspace-local.

On macOS these still auto-run inside seatbelt first; agents can use the existing expects_sandbox_block path to request up-front approval to run outside the sandbox (same pattern as gh pr create). Hard-external signals (e.g. curl alongside xcodebuild) stay external; version/metadata-only invocations like swift --version remain sandbox.

^{Reviewed by Cursor Bugbot for commit b77fff4. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

E2E screenshot updates

Refreshed (4)

Clearly-different shots re-rendered by the CI e2e run and committed:

• panel-position-bottom.png —
• panel-position-side.png —
• settings-ssh-workspace.png —
• ssh-projects-pane-after-enable.png —

Ignored as render noise (7)

These re-rendered below the variance threshold (font hinting / anti-alias wobble) and were not committed. To accept them anyway, add the update-screenshots label or commit the rendered PNGs by hand:

• markdown-table-wrap-message.png — 30 px (0.0031%)
• markdown-table-wrap.png — 30 px (0.0031%)
• portrait-panel-controls-chrome.png — 57 px (0.0059%)
• portrait-panel-controls-footer-row.png — 57 px (0.0696%)
• portrait-panel-controls-settings-seam.png — 4 px (0.0062%)
• portrait-panel-controls-with-panel.png — 515 px (0.0536%)
• settings-usage-plan-limits.png — 521 px (0.0543%)

These PNGs live under tests/e2e/screenshots/ for human visual review; CI asserts DOM structure, not pixel diffs.

[github-actions]

Merge conflict needs a human

main advanced and screenshot conflicts were resolved automatically, but the merge updates these workflow files, which CI's token isn't scoped to push. Merge or rebase main by hand (or grant the SCREENSHOTS_PAT the workflow scope to let CI resolve these automatically):

• .github/workflows/ci.yml

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_b77e1df8-1e4f-4fa2-ad9a-a26b093362b4)

[cursor]

Stale comment

Not approving: Cursor Bugbot skipped (usage limit reached) and CI precheck failed on npm audit. Human review is needed before merge; no reviewers were assigned.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_c72aec6c-de53-4daf-9d1c-46530115baa7)

[cursor]

Not approving: Cursor Bugbot skipped (usage limit reached), so automated review did not complete. Human review is needed before merge; assigned AutomatedTester as reviewer.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}