fix(approval): route check_execute_code_guard through the CLI fall-through too (salvage of #86270)

[kshitijk4poor]

Summary

execute_code now shows the CLI Dangerous Command panel instead of silently queuing an invisible pending_approval, in the one surface where the user is sitting there able to answer.

Root cause: e37a0321eb fixed the leaked-ask-mode-into-CLI case for _run_approval_gate and check_all_command_guards, but check_execute_code_guard — the whole-script gate, a separate function with its own copy of the same notify_cb is None short-circuit — never got the same treatment. Same leak, same missing fall-through.

Salvage of #86270 by @pierrenode (cherry-picked, authorship preserved), plus a follow-up commit closing three parity gaps found in review.

Changes

• tools/approval.py — check_execute_code_guard: when _should_fall_through_to_cli_approval() says yes, run the same hook-fire → prompt_dangerous_approval → hook-fire → choice-branch sequence the sibling guards use. Falls back to the existing pending_approval behaviour when no CLI callback is available. (@pierrenode)
• tools/approval.py — follow-up parity fixes (review findings):
  • timeout arm now appends the denial-breaker addendum, matching the same function's gateway arm and check_all_command_guards' CLI tail
  • human deny no longer calls _record_denial() — that tally counts guardian LLM DENY verdicts; neither sibling CLI tail advances it, so three deliberate user denials were escalating to breaker hard-stop text
• tests/tools/test_cli_approval_exec_ask_leak.py — 4 cases mirroring the existing check_all_command_guards pair (approve/deny/timeout/session-persistence) (@pierrenode), plus a platform-marker regression test and two breaker-parity guards; the shared fixture now clears the process-global _denial_tally so a leaked tally can't bleed the escalated addendum into unrelated assertions.

Validation

Side-by-side E2E through the real production caller (_execute_code_handler → check_execute_code_guard), real imports, isolated HERMES_HOME:

case	pre-fix main	this branch
CLI panel registered	panel never invoked, pending_approval	panel invoked, approved: true
tool entry point + deny	no denial wording	denied, no side-effect file written
secrets in script	(panel never shown)	panel shown, raw secret not leaked
headless, no CLI callback	pending_approval	pending_approval (unchanged)
gateway notify_cb present	gateway notified	gateway notified, CLI panel not hijacked

• Tests: tests/tools/test_cli_approval_exec_ask_leak.py 11 passed. Wider approval sweep (12 files) 18 failed, 201 passed; the identical 18 failures with identical names occur on pre-fix main (18 failed, 136 passed over the 4 files containing them) — zero new failures. Pre-existing causes are test-order pollution and /tmp symlink resolution, unrelated to this diff.
• Mutation-checked, four ways: reverting tools/approval.py to base fails exactly the 4 original guards; disabling the fall-through (if False:) fails all 7 execute_code guards while the 4 check_all_command_guards/import tests correctly still pass; re-adding _record_denial fails the parity guard; stripping the timeout addendum fails the addendum guard. Working tree checksum-verified restored after every probe.
• No regression to the desktop pending-approval replay (#38b9005b95 / #f703e70618): the TUI gateway sets HERMES_INTERACTIVE=1 process-wide, but _wire_callbacks() registers sudo/project/secret callbacks and never set_approval_callback — grep set_approval_callback tui_gateway/ is empty — so approval_callback is None there, the fall-through cannot fire, and submit_pending → replay is preserved. Confirmed by the gateway E2E case above.
• Reachability confirmed (not dead code): check_execute_code_guard runs on a tool-worker thread, and agent/tool_executor.py wraps every submit in propagate_context_to_thread, which copies the parent's thread-local approval callback (tools/thread_context.py). Also reachable from the ACP adapter and the slash worker.
• ruff check clean on both changed files (and clean on base for the same files — no new issues).

Notes

Two items deliberately left out of scope:

• No shared helper for the three CLI tails. Profiled side by side, only 4 of 10 behavioural axes match: check_all_command_guards loops a (key, desc, is_tirith) warnings list with tirith always→session downgrade and multi-key persistence; _run_approval_gate has no smart-deny gate, no breaker, no _reset_denials, no allow_permanent. A shared helper would need ~8 parameters to save ~30 lines while making all three paths harder to audit — a subset/superset target, not behaviour-equivalent duplication.
• always persisting the coarse execute_code key is broad (an unrelated later script then auto-approves), but the gateway arm of the same function already does exactly this and did so before this PR. The new branch is consistent with its own function's existing semantics; changing that breadth is a separate scoped change.

Closes #86270

---