fix: 统一 Shell 审批开关语义

- 关闭 Shell 审批时移除命令级审批策略与强制审批元数据

- 补充适配器与运行时回归测试

easy-agents-agent-runtime/src/main/java/com/easyagents/agent/runtime/tool/operate/AgentOperateToolAdapter.java

@@ -119,7 +119,10 @@ public class AgentOperateToolAdapter {
                 toolkit.registerAgentTool(shellTool);
                 AgentToolSpec shellToolSpec = toolSpec(
                         spec, EXECUTE_SHELL_COMMAND_TOOL, "Execute shell command.", true);
+                if (shellToolSpec.isApprovalRequired()) {
+                    // 命令级审批策略服从 Agent 的 Shell 审批开关；关闭后仅保留安全校验。
                     shellToolSpec.setApprovalPolicy(shellTool::approvalEvaluation);
+                }
                 toolSpecs.add(shellToolSpec);
             }
             default -> throw new AgentRuntimeException("Unsupported agent operate tool type: " + type);
@@ -157,7 +160,7 @@ public class AgentOperateToolAdapter {
         toolSpec.setVisibility(AgentToolVisibility.VISIBLE);
         toolSpec.setApprovalRequired(approvalRequired);
         toolSpec.setApprovalRequest(approvalRequest(operateSpec, approvalRequired));
-        toolSpec.setMetadata(metadata(operateSpec));
+        toolSpec.setMetadata(metadata(operateSpec, approvalRequired));
         return toolSpec;
     }
 
@@ -173,11 +176,11 @@ public class AgentOperateToolAdapter {
         return defaultRequest;
     }
 
-    private Map<String, Object> metadata(AgentOperateToolSpec spec) {
+    private Map<String, Object> metadata(AgentOperateToolSpec spec, boolean approvalRequired) {
         Map<String, Object> metadata = new LinkedHashMap<>();
         metadata.put("operateTool", true);
         metadata.put("operateToolType", spec.getType().name());
-        if (spec.getType() == AgentOperateToolType.SHELL) {
+        if (spec.getType() == AgentOperateToolType.SHELL && approvalRequired) {
             metadata.put("forceApprovalCommands", List.of("rm"));
             metadata.put("forceApprovalCommandArgument", "command");
         }

easy-agents-agent-runtime/src/test/java/com/easyagents/agent/runtime/agentscope/AgentScopeStatefulRuntimeTest.java

@@ -282,13 +282,13 @@ public class AgentScopeStatefulRuntimeTest {
     }
 
     @Test
-    public void shouldForceApprovalForRemoveWhenShellApprovalIsDisabled() {
+    public void shouldBypassRemoveApprovalWhenShellApprovalIsDisabled() {
         AgentInitRequest request = initRequest();
         AgentOperateToolSpec shell = operateToolSpec(AgentOperateToolType.SHELL);
         shell.setApprovalRequired(false);
         request.getAgentDefinition().setOperateToolSpecs(List.of(shell));
         AgentScopeReActRuntime runtime = runtimeWithModel(List.of(ChatResponse.builder()
-                .id("forced-remove-message")
+                .id("remove-message")
                 .content(List.of(ToolUseBlock.builder()
                         .id("call-remove")
                         .name(AgentOperateToolAdapter.EXECUTE_SHELL_COMMAND_TOOL)
@@ -303,11 +303,11 @@ public class AgentScopeStatefulRuntimeTest {
                 .block(Duration.ofSeconds(5));
 
         Assert.assertNotNull(events);
-        Assert.assertTrue(events.stream()
-                .anyMatch(event -> event.getEventType() == AgentRuntimeEventType.TOOL_APPROVAL_REQUIRED));
-        Assert.assertTrue(events.stream()
-                .anyMatch(event -> event.getEventType() == AgentRuntimeEventType.SUSPENDED));
         Assert.assertFalse(events.stream()
+                .anyMatch(event -> event.getEventType() == AgentRuntimeEventType.TOOL_APPROVAL_REQUIRED));
+        Assert.assertFalse(events.stream()
+                .anyMatch(event -> event.getEventType() == AgentRuntimeEventType.SUSPENDED));
+        Assert.assertTrue(events.stream()
                 .anyMatch(event -> event.getEventType() == AgentRuntimeEventType.TOOL_RESULT));
     }
 

easy-agents-agent-runtime/src/test/java/com/easyagents/agent/runtime/tool/operate/AgentOperateToolAdapterTest.java

@@ -68,6 +68,21 @@ public class AgentOperateToolAdapterTest {
         Assert.assertFalse(toolSpecs.get(0).getMetadata().containsKey("baseDir"));
     }
 
+    @Test
+    public void shouldDisableAllShellApprovalPoliciesWithAgentSwitch() {
+        Toolkit toolkit = new Toolkit();
+        AgentOperateToolSpec spec = spec(AgentOperateToolType.SHELL);
+        spec.setApprovalRequired(false);
+
+        List<AgentToolSpec> toolSpecs = adapter.register(List.of(spec), toolkit);
+
+        Assert.assertEquals(1, toolSpecs.size());
+        Assert.assertFalse(toolSpecs.get(0).isApprovalRequired());
+        Assert.assertNull(toolSpecs.get(0).getApprovalPolicy());
+        Assert.assertFalse(toolSpecs.get(0).getMetadata().containsKey("forceApprovalCommands"));
+        Assert.assertFalse(toolSpecs.get(0).getMetadata().containsKey("forceApprovalCommandArgument"));
+    }
+
     @Test
     public void shouldRegisterPatchWithDefaultHitlDisabled() {
         Toolkit toolkit = new Toolkit();