Q117: commands run in an allowlisted environment, and records and approvals say host isolation is advisory

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/main/database/migrations/088-host-access-note.ts

@@ -0,0 +1,11 @@
+// Pending file-access approvals made before the warning existed get it too; the text is frozen here as it was introduced.
+export const hostAccessNoteSchema = `
+  update approvals
+  set details = details || char(10) || char(10) || 'Approving lets this task run commands on this computer with your user''s file access: they can read and change files outside the workspace. Only their environment is cleaned of keys and your profile.'
+  where state = 'pending' and source_entity_type = 'task' and kind in ('task_risk', 'task_execution')
+    and source_entity_id in (select id from tasks where requires_filesystem = 1)
+    and details not like '%Approving lets this task run commands on this computer%';
+
+  insert into schema_migrations(version, name, applied_at)
+  values (88, 'host_access_note', datetime('now'));
+`;

src/main/database/schema.ts

@@ -86,6 +86,7 @@ import { connectorGrantLimitsSchema } from "./migrations/084-connector-grant-lim
 import { approvalSubjectSnapshotSchema } from "./migrations/085-approval-subject-snapshot";
 import { heldDeliverablesSchema } from "./migrations/086-held-deliverables";
 import { goalAuditorSchema } from "./migrations/087-goal-auditor";
+import { hostAccessNoteSchema } from "./migrations/088-host-access-note";
 
 interface Migration {
   version: number;
@@ -181,6 +182,7 @@ const MIGRATIONS: Migration[] = [
   { version: 85, name: "approval_subject_snapshot", sql: approvalSubjectSnapshotSchema },
   { version: 86, name: "held_deliverables", sql: heldDeliverablesSchema },
   { version: 87, name: "goal_auditor", sql: goalAuditorSchema },
+  { version: 88, name: "host_access_note", sql: hostAccessNoteSchema },
 ];
 
 const SCHEMA_VERSION = MIGRATIONS[MIGRATIONS.length - 1].version;