fix(permissions): request approval for external workspace paths

[luoye520ww]

Problem

Workspace-write rejected every mutation outside the selected workspace, even when the user explicitly approved that one operation. The original implementation fixed that by passing a broad allowExternalPaths flag into the tool context, which could let a tool write to a different external path during the same call.

Root cause

The approval result was represented as a boolean rather than as the exact canonical targets that were shown to the user.

Scope

This PR keeps the per-operation approval flow and makes the grant path-scoped. It does not change the persisted sandbox mode or grant command execution/network access.

Changes

• Detect all supported external file-mutation path arguments and normalize them to absolute paths.
• Pass only approvedExternalPaths for the approved invocation.
• Allow an external write only when its resolved lexical path exactly matches one of those targets (case-insensitive on Windows).
• Keep workspace boundaries, read-only mode, external-sandbox mode, and symlink checks fail-closed.
• Add regression coverage for sibling-path expansion and the full local tool-host path.

Safety

• Approval is single-call and is not persisted.
• A parent directory is never approved implicitly.
• Changing a tool argument to another external path requires another approval.
• The global danger-full-access mode remains the only mode that intentionally removes the workspace boundary.

Typecheck

npm.cmd --prefix kun run typecheck
npm.cmd run typecheck

Both passed locally.

Tests

npm.cmd --prefix kun test -- src/adapters/tool/sandbox-policy.test.ts src/adapters/tool/local-tool-host.test.ts src/adapters/tool/builtin-tool-utils.test.ts src/adapters/tool/builtin-tool-utils.symlink.test.ts
npm.cmd --prefix kun test -- tests/loop.test.ts tests/skill-tool-provider.test.ts
npm.cmd run lint -- --quiet
npm.cmd run build

Results: 4 files / 52 permission tests passed; 2 files / 96 Kun integration tests passed; lint and build passed.

Issue

Fixes #869

[XingYu-Zhong]

Thank you for the valuable direction in this PR. I am closing it in favor of #978.

The current branch is mergeable and its CI is green, but the external grant is still consumed by path-based writes, leaving approval-to-mutation parent-directory swaps and hard-link aliases outside the exact-path guarantee. The replacement was rebuilt from current develop: only write/edit opt in, grants are host-minted and single-call, external creation fails closed, existing single-link files are revalidated and mutated through the same file handle, and the path/symlink/junction/hard-link cases have focused plus full-suite coverage.

Please continue review on the replacement PR; the original problem analysis is credited there.