fix: enforce remote Ask at tool boundary

Managed SSH Ask previously required bubblewrap and applied a process-level filesystem sandbox, while Execute launched directly. Ask and Execute now share the same direct signed Runtime startup; Ask remains read-only through the Agent's existing tool permission mediation, which only permits native read requests and rejects other tool kinds. Release note: 远程 Ask 与 Execute 现在都可直接启动签名 Runtime，无需 Host 安装 bubblewrap；Ask 仍在工具权限层仅允许读取操作。
2026-09-03 16:23:14 +08:00
parent 987a08ad78
commit 6586192222
7 changed files with 71 additions and 367 deletions
@@ -271,7 +271,6 @@ export async function createProductionRuntimeProtocol(
          profileInput: {
            bundleDirectory: launch.bundle.bundleDirectory,
            workspaceDirectory: launch.workspace.workspaceDirectory,
-            scratchDirectory: launch.scratch,
            workMode: launch.workMode,
            ...(launch.modelBridge === undefined ||
            options.agentExecutablePath === undefined