feat: run agent tools with host permissions

src/renderer/src/App.test.tsx

@@ -165,7 +165,6 @@ const api: DesktopApi = {
       continueBinaryPath: '',
       continueConfigPath: '',
       continueMode: 'chat',
-      runtimeSandboxMode: 'auto',
       subagentSmartRoutingEnabled: false,
       knowledgeEmbeddingEnabled: false,
       knowledgeEmbeddingBaseUrl:
@@ -216,7 +215,6 @@ const api: DesktopApi = {
         continueBinaryPath: input.continueBinaryPath,
         continueConfigPath: input.continueConfigPath,
         continueMode: input.continueMode,
-        runtimeSandboxMode: input.runtimeSandboxMode,
         subagentSmartRoutingEnabled:
           input.subagentSmartRoutingEnabled ?? false,
         knowledgeEmbeddingEnabled: input.knowledgeEmbeddingEnabled,

src/renderer/src/SettingsPanel.test.tsx

@@ -43,7 +43,6 @@ const runtimeSettings: RuntimeSettings = {
   continueBinaryPath: '',
   continueConfigPath: '',
   continueMode: 'chat',
-  runtimeSandboxMode: 'auto',
   subagentSmartRoutingEnabled: false,
   knowledgeEmbeddingEnabled: false,
   knowledgeEmbeddingBaseUrl:

src/renderer/src/SettingsPanel.tsx

@@ -169,9 +169,6 @@ function hydrateRuntimeSettings(
     continueBinaryPath: (value: string) => void
     continueConfigPath: (value: string) => void
     continueMode: (value: RuntimeSettings['continueMode']) => void
-    runtimeSandboxMode: (
-      value: RuntimeSettings['runtimeSandboxMode']
-    ) => void
     knowledgeEmbeddingEnabled: (value: boolean) => void
     knowledgeEmbeddingBaseUrl: (value: string) => void
     knowledgeEmbeddingModel: (value: string) => void
@@ -219,7 +216,6 @@ function hydrateRuntimeSettings(
   setters.continueBinaryPath(configured.continueBinaryPath)
   setters.continueConfigPath(configured.continueConfigPath)
   setters.continueMode(value.continueMode)
-  setters.runtimeSandboxMode(value.runtimeSandboxMode)
   setters.knowledgeEmbeddingEnabled(value.knowledgeEmbeddingEnabled)
   setters.knowledgeEmbeddingBaseUrl(value.knowledgeEmbeddingBaseUrl)
   setters.knowledgeEmbeddingModel(value.knowledgeEmbeddingModel)
@@ -486,10 +482,6 @@ export function SettingsPanel({
     useState<RuntimeSettingsInput['continueMode']>(
       defaultRuntimeSettings.continueMode
     )
-  const [runtimeSandboxMode, setRuntimeSandboxMode] =
-    useState<RuntimeSettingsInput['runtimeSandboxMode']>(
-      defaultRuntimeSettings.runtimeSandboxMode
-    )
   const [knowledgeEmbeddingEnabled, setKnowledgeEmbeddingEnabled] =
     useState<boolean>(defaultRuntimeSettings.knowledgeEmbeddingEnabled)
   const [knowledgeEmbeddingBaseUrl, setKnowledgeEmbeddingBaseUrl] =
@@ -580,7 +572,6 @@ export function SettingsPanel({
         continueBinaryPath: setContinueBinaryPath,
         continueConfigPath: setContinueConfigPath,
         continueMode: setContinueMode,
-        runtimeSandboxMode: setRuntimeSandboxMode,
         knowledgeEmbeddingEnabled: setKnowledgeEmbeddingEnabled,
         knowledgeEmbeddingBaseUrl: setKnowledgeEmbeddingBaseUrl,
         knowledgeEmbeddingModel: setKnowledgeEmbeddingModel,
@@ -814,7 +805,6 @@ export function SettingsPanel({
         continueBinaryPath,
         continueConfigPath,
         continueMode,
-        runtimeSandboxMode,
         knowledgeEmbeddingEnabled,
         knowledgeEmbeddingBaseUrl,
         knowledgeEmbeddingModel,
@@ -2739,32 +2729,6 @@ export function SettingsPanel({
           {activeTab === 'security' && (
             <>
           <div className="settings-section">
-            <label className="field">
-            <span>{t('security.sandbox.label')}</span>
-            <select
-              aria-label={t('security.sandbox.label')}
-              value={runtimeSandboxMode}
-              onChange={(event) =>
-                setRuntimeSandboxMode(
-                  event.target
-                    .value as RuntimeSettingsInput['runtimeSandboxMode']
-                )
-              }
-            >
-              <option value="auto">
-                {t('security.sandbox.options.auto')}
-              </option>
-              <option value="strict">
-                {t('security.sandbox.options.strict')}
-              </option>
-              <option value="off">
-                {t('security.sandbox.options.off')}
-              </option>
-            </select>
-            <small>
-              {t('security.sandbox.description')}
-            </small>
-            </label>
             <label className="field">
             <span>{t('security.toolPolicy.label')}</span>
             <select

src/renderer/src/i18n/locales/en-US/settings.ts

@@ -540,16 +540,6 @@ export const settings = {
     }
   },
   security: {
-    sandbox: {
-      label: 'Runtime OS sandbox',
-      options: {
-        auto: 'Automatic (prefer on Linux)',
-        strict: 'Strict (refuse to run when unavailable)',
-        off: 'Off'
-      },
-      description:
-        'Initial strict isolation supports the embedded OpenCode Runtime on Linux when bubblewrap is installed. External Runtimes and Continue are never incorrectly reported as sandboxed.'
-    },
     toolPolicy: {
       label: 'Direct model tool security policy',
       always: 'Automatically authorize enabled tools in Execute',

src/renderer/src/i18n/locales/zh-CN/settings.ts

@@ -490,16 +490,6 @@ export const settings = {
     }
   },
   security: {
-    sandbox: {
-      label: 'Runtime OS 沙箱',
-      options: {
-        auto: '自动（Linux 优先启用）',
-        strict: '严格（不可用时拒绝运行）',
-        off: '关闭'
-      },
-      description:
-        '首期严格隔离适用于安装 bubblewrap 的 Linux 嵌入式 OpenCode。外部 Runtime 与 Continue 不会被误标为已沙箱。'
-    },
     toolPolicy: {
       label: '直连模型工具安全策略',
       always: 'Execute 自动授权已启用的工具',