Function approvalRequired

packages/core/sdk/src/executor.ts:4187–4193

(
      annotations: ToolAnnotations | undefined,
      policy: EffectivePolicy,
    )

    // Read before pre-approval arg validation so the extra validation pass
    // only runs for calls that would otherwise burn a user approval.
    const approvalRequired = (
      annotations: ToolAnnotations | undefined,
      policy: EffectivePolicy,
    ): boolean => {
      if (policy.action === "approve") return false;
      return policy.action === "require_approval" || annotations?.requiresApproval === true;
    };

    const enforceApproval = (
      annotations: ToolAnnotations | undefined,