Summary

• Add a fresh one-shot sandbox_escape approval path for Windows bash sandbox fallback.
• Keep Windows sandbox helper failures fail-closed unless the user explicitly allows one unconfined rerun.
• Localize approval-facing copy for sandbox escape, plan-mode read-only trust, memory approvals, tool labels, and related CLI/TUI prompts.
• Add frontend mocks and regression tests for Chinese approval rendering and one-shot fresh approval actions.

Validation

• go test ./internal/tool/builtin ./internal/control ./internal/i18n ./internal/agent ./internal/sandbox ./internal/acp ./internal/cli
• GOOS=windows GOARCH=amd64 go test -c -o /tmp/reasonix-internal-sandbox-windows.test ./internal/sandbox
• GOOS=windows GOARCH=amd64 go test -c -o /tmp/reasonix-internal-tool-builtin-windows.test ./internal/tool/builtin
• pnpm --dir desktop/frontend exec tsx src/__tests__/approval-modal-file-reference.test.tsx
• pnpm --dir desktop/frontend exec tsc --noEmit -p tsconfig.test.json
• git diff --check

Cache

Cache-impact: low - Adds execution-time sandbox escape approvals and localized approval copy; tool schema/order, provider request serialization, and stable system prompt remain unchanged.
Cache-guard: Verified with focused approval and owning-package tests above; no prefix-cache guard was added because this path does not change provider-visible prefix bytes.

Notes

• Desktop React UI localizes fixed approval templates even when an older backend payload still carries the English template.
• Commands, paths, MCP server/tool names, and model-provided text remain unchanged.