Smith::Tools::SandboxApprover

Lets a confined shell command through the gate without asking.

This is the point of the sandbox rather than a shortcut past it: the gate exists because a shell command can do anything, and a command that cannot write outside the project or reach the paths you named as secret is no longer that kind of question. Asking anyway is how a user ends up leaving --yes on, which gives up the gate and everything else it protects.

Deliberately opt-in ([sandbox] auto_approve). Confinement is a technical fact; whether it is enough to skip the prompt is a judgement, and it is the user's.

Sits inside RuleApprover, exactly where PromptApprover sits, so the order of authority is unchanged: a deny rule refuses before this is ever consulted, an allow rule permits without it, and an ask rule reaches the inner approver rather than this one. Only an unruled command is decided here.