fix(ui-tool): document unchecked shell escalation fields and cover diff-card pairs

packages/client/ui-tool/src/client/tool/models/raw-tool-call.ts

@@ -52,8 +52,7 @@ export function singleResultText(block: ToolResultNode): string | undefined {
 }
 
 /**
- * Validate the optional escalation pair shared by first-party shell and file
- * mutation tools.
+ * Validate the optional escalation pair of first-party file mutation tools.
  * @param args - parsed open-root Tool arguments.
  * @returns whether the declared escalation fields form a valid pair.
  */

packages/client/ui-tool/src/client/tool/models/terminal-card-model.ts

@@ -189,6 +189,9 @@ function shellCall(name: string, args: Record<string, unknown>): ShellCall | nul
   if (timeoutMs !== undefined && (typeof timeoutMs !== 'number' || !Number.isFinite(timeoutMs) || timeoutMs <= 0)) return null
   if (workdir !== undefined && typeof workdir !== 'string') return null
   if (background !== undefined && typeof background !== 'boolean') return null
+  // Escalation fields stay unchecked: their validity depends on the Session's
+  // sandbox mode, which only the Host knows, and a rejected call settles as an
+  // error result on the generic body.
   if (description === undefined) {
     // Standard dsh-tool-bash and dsh-tool-pwsh schemas require `description`;
     // persistent shell providers omit it. Their parameter roots stay open, so

packages/client/ui-tool/tests/diff-card.client.spec.tsx

@@ -154,6 +154,8 @@ describe('diffCardModel', () => {
     })
     expect(diffCardModel(running({ argsRaw: args({ sandbox_permissions: 7, justification: 'Need access' }) }))).toBeNull()
     expect(diffCardModel(running({ argsRaw: args({ sandbox_permissions: 'workspace-write' }) }))).toBeNull()
+    expect(diffCardModel(running({ argsRaw: args({ sandbox_permissions: 'workspace-write', justification: ' ' }) }))).toBeNull()
+    expect(diffCardModel(running({ argsRaw: args({ sandbox_permissions: 'workspace-write', justification: 'Need access' }) }))).not.toBeNull()
     expect(diffCardModel(running({ argsRaw: args({ extension: { version: 1 } }) }))).not.toBeNull()
   })
 })