[P0.22] Check delegated-engine tool approvals against is_dangerous_command

[frankbria]

Filed by the SaaS launch review. Priority P0.22 — severity critical, category security.

Problem

The project added a PreToolUse guard for claude-code precisely because GitHub Issues import (#565) turns externally-authored issue bodies into task prompts. The same prompts are fed unguarded to the other engines: CodexAdapter defaults to approval_policy='auto' with sandbox_mode=None and _handle_approval approves every tool call without inspecting parameters; OpenCode and Kilocode's --auto attach no equivalent guard. The raised floor against injected destructive commands exists for exactly one of four delegated engines. Bringing codex and opencode into launch scope brings their unguarded execution paths into launch scope with them.

Evidence

• codeframe/core/adapters/codex.py:348
• codeframe/core/adapters/codex.py:52
• codeframe/core/adapters/claude_code_guard.py:5

Acceptance criteria

• Approval handling runs tool-call command parameters through codeframe.core.dangerous_commands.is_dangerous_command and rejects on match
• A restrictive sandbox_mode is the default for the codex engine
• Test: a tool-call payload containing a destructive command is rejected, not auto-approved
• OpenCode/Kilocode wire their native permission mechanism - a docs-only disclosure is no longer sufficient now that these engines are advertised as working at launch

Dependencies

• blocked by [P0.19] Invoke opencode run and require file changes for the OpenCode engine #913 (P0.19)
• blocked by [P0.20] Rewrite the Codex adapter against the real app-server protocol #914 (P0.20)

---

Atomic by construction: one developer, one focused session.