feat: Add comprehensive tool approval system with configurable controls

[garland3]

Implements a complete tool approval system that allows users to control when and how LLM tool calls are executed, with support for argument editing, per-tool configuration, and auto-approval settings.

Key Features:

• Tool approval manager with configurable approval policies
• Inline toggle for auto-approve in tool approval messages
• User-level and tool-level auto-approval settings
• Argument editing with tracked changes and LLM context
• Global force approval override for all tools
• WebSocket-based approval flow with request/response handling
• Comprehensive test coverage for approval manager and config
• CodeQL data extensions for sanitizers

Backend Changes:

• Add ToolApprovalManager for centralized approval logic
• Update agent loops (ReAct, Think-Act, Act) to support approval flow
• Add approval endpoints and WebSocket message handlers
• Integrate approval checks into tools mode runner
• Add configuration management for tool approval settings

Frontend Changes:

• Add tool approval UI in chat area
• Implement approval dialog with argument editing
• Add user-level auto-approval toggle in settings
• Track argument changes and provide context to LLM

Documentation:

• Complete implementation guide
• E2E test scenarios
• System architecture documentation

Generated with Claude Code

To fully address the possibility of log confusion or ambiguity—even after stripping control characters—we should clearly delineate user input within log messages by wrapping it in a consistent delimiter (such as single quotes or square brackets). This ensures even tricky printable (but weird) Unicode, leading/trailing spaces, or empty strings, cannot create confusion with adjacent log message text. No changes are needed to the control-character stripping logic, but the log message itself should be changed to wrap sanitize_for_logging(tool_call_id) in quotes.

The only necessary edit is in backend/application/chat/approval_manager.py, at the log message on line 120, to update:

logger.info(f"Found pending request for {sanitize_for_logging(tool_call_id)}, setting response")

to

logger.info(f"Found pending request for '{sanitize_for_logging(tool_call_id)}', setting response")

This follows the best practice of marking user input and cannot break existing functionality.

The best way to fix this problem is to ensure that all user-controlled or potentially tainted values being logged are passed through an appropriate sanitization function prior to inclusion in the log message. In this codebase, the existing sanitize_for_logging function (imported from core.utils) should be used for consistency and effectiveness.

Specifically:

• In backend/application/chat/approval_manager.py, on line 124, the log entry that references approved should wrap approved in sanitize_for_logging, just as is done for tool_name.
• No changes are required to the rest of the logging/statements, given that similar fields already use sanitize_for_logging.
• No new imports or helpers are needed, as sanitize_for_logging is already present.

---