fix(harness): make research tools resilient by default

[Ishaan Gangwani (ishaan1124)]

Summary

• add Ask for approval, Approve for me, and Full access to the composer Research tools menu; new local projects default to trusted Full access
• normalize WebFetch destinations, repair Explore network authority, support transactional multi-file patches, and resolve the default Python runtime
• make image limits provider-aware and accept valid manual-run provenance; update generated SDK and security docs

Verification

• backend focused harness: 204 passed
• frontend access/settings: 27 passed
• agent permission regression: 39 passed
• monorepo typecheck and Prettier: passed
• docs build/sync and generated SDK determinism: passed

Paid actions and exact remote/environment plans remain non-bypassable. Relocated project roots remain fail-closed.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
openscience	Ready	Preview	Aug 15, 2026 5:55am