Repeated sandbox modes need no approval
重复沙箱模式无需审批
Models can repeat `sandbox_permissions: danger-full-access` while that mode is already effective. Rejecting the call prevents authorized work without preventing any permission increase.
English
Problem
Models can repeat sandbox_permissions: danger-full-access while that mode is already effective. Rejecting the call prevents authorized work without preventing any permission increase.
Decision
approveEscalation returns the effective mode immediately when the requested mode matches it. Argument pairing remains mandatory at the tool. Wider modes still require approval; narrower and unsupported targets still fail. This partially supersedes the non-widening rejection in the sandbox decision; its confinement and per-call approval decisions remain active.
Alternatives considered
Reject every non-widening request. This makes a redundant argument fatal even though it asks for no additional permission.
Ask for approval again. Existing permission is sufficient, so another prompt adds no authorization.
Consequences
Bash and filesystem tools accept repeated effective modes without an approval service or agent. Shared unit tests cover both advertised targets, both tool consumers execute the repeated mode, and the fs-same-mode ACP snapshot verifies an unrestricted write with no approval events and checks the resulting file.
中文
问题
模型可能在 danger-full-access 已生效时重复传入 sandbox_permissions: danger-full-access。拒绝该调用会阻止已获授权的工作，却没有阻止任何权限增加。
决策
当请求模式与生效模式相同时，approveEscalation 立即返回生效模式。工具仍要求参数成对出现。更宽模式仍需审批；更窄和不支持的目标仍然失败。这部分取代了沙箱决策中的非放宽请求拒绝规则；其约束与逐调用审批决策仍然有效。
考虑过的替代方案
拒绝所有非放宽请求。 即使没有请求额外权限，冗余参数也会导致调用失败。
再次请求审批。 现有权限已经足够，再次提示不会增加授权。
影响
Bash 和文件系统工具无需审批服务或 agent 即可接受重复生效模式。共享单元测试覆盖两个已公布目标，两个工具消费方均执行重复模式，fs-same-mode ACP 快照验证没有审批事件的无限制写入并检查生成文件。