mweinbach6/9/2026, 6:45:04 PM

- denied.ts: add docker-daemon / npm EACCES / sudo-terminal markers to the
  non-sandbox failure list so ordinary permission errors no longer trigger a
  spurious "retry with full access?" escalation prompt.
- webFetch: document the JSDOM security invariant (no runScripts/resources) so
  nobody enables script execution or subresource loading on untrusted HTML.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Parent055a0cf