From 9cd70b3c84b56b038cf3317cebb01c879c68e9fd Mon Sep 17 00:00:00 2001 From: exelchapo Date: Sat, 23 May 2026 01:05:07 +0800 Subject: [PATCH] fix: add high_cost_execution to APPROVAL_ENFORCED_ACTION_CLASSES spark verify --deep is classified as high_cost_execution (medium risk, requires approval) but the enforcement gate in should_enforce_approval() only checks APPROVAL_ENFORCED_ACTION_CLASSES, which was missing high_cost_execution. This meant deep verification ran without any approval prompt despite the classifier marking it. Add high_cost_execution to the enforcement set so that spark verify --deep is actually blocked until the user confirms. Bug: classifier tags high_cost_execution, but enforcement skips it --- src/spark_cli/cli.py | 1 + 1 file changed, 1 insertion(+) diff --git a/src/spark_cli/cli.py b/src/spark_cli/cli.py index 03fd6494..2d505684 100644 --- a/src/spark_cli/cli.py +++ b/src/spark_cli/cli.py @@ -10822,6 +10822,7 @@ def cmd_sandbox(args: argparse.Namespace) -> int: "external_publish", "git_history_mutation", "identity_access_mutation", + "high_cost_execution", "network_exfiltration", "remote_code_execution", "container_privilege_escalation",