feat(agent-core-v2): drop the dangerous command guard in auto permission mode

[sailist]

Related Issue

None — internal permission-behavior adjustment.

Problem

In auto (Never Ask) permission mode, the built-in dangerous-command guard denied two classes of Bash commands outright: commands confirmed dangerous (shutdown, rm -rf, dd of=/dev/...) and commands the static analyzer cannot fully analyze (parser failures, or non-literal names and arguments such as $CMD --force or env $FLAGS). Users who explicitly chose the fully unattended mode were still blocked by these denials.

What changed

• The dangerous-command-ask permission policy no longer evaluates anything in auto mode; the policy chain falls through to auto-mode-approve, so dangerous and unanalyzable commands both run without interruption.
• Always Ask and Ask When Needed modes are unchanged: dangerous and unanalyzable commands still ask for confirmation there, and [permission] dangerous_command_guard = false still disables that.
• User docs (EN/ZH) updated to match; existing policy tests updated in place (same case count).

Checklist

• I have read the CONTRIBUTING document.
• I have linked a related issue (external PRs: the issue must have a maintainer's /approve).
• I have added tests that prove my feature works.
• Ran gen-changesets skill, or this PR needs no changeset.
• Ran gen-docs skill, or this PR needs no doc update.

[changeset-bot]

🦋 Changeset detected

Latest commit: c52de99

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@moonshot-ai/kimi-code	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 67270a217e

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Continue scanning after an unanalyzable command

In auto mode, a command list such as $CMD --force; shutdown is now approved: analyzeSource returns immediately on the first command's unanalyzable verdict, this line abstains, and the next policy (auto-mode-approve) approves the entire Bash invocation without inspecting the known-dangerous shutdown. Preserve the unanalyzable verdict while scanning the remaining commands and prioritize any dangerous verdict before allowing the policy chain to continue.

Useful? React with 👍 / 👎.

[pkg-pr-new]

pnpm dlx https://pkg.pr.new/@moonshot-ai/kimi-code@c52de99

npx https://pkg.pr.new/@moonshot-ai/kimi-code@c52de99

commit: c52de99