feat(vercel_ai): detect privileged tools without approval

vercel_ai/approvals.yaml

@@ -0,0 +1,51 @@
+policy:
+  id: vercel_ai_approvals
+  name: Vercel AI SDK tool approval gates
+  category: vercel_ai
+  description: >
+    Rules covering the human-in-the-loop approval gate the Vercel AI SDK
+    offers on sensitive tool calls. This policy inspects only the tool-level
+    needsApproval option, which defaults to false when omitted.
+
+rules:
+  - id: VAI-013
+    title: Privileged tool has no needsApproval gate
+    severity: high
+    confidence: 0.7
+    language: typescript
+    applies_to:
+      - vercel_ai_tool
+    scope: tool
+    match:
+      all:
+        - any:
+            - has_shell_call: true
+            - has_code_exec_call: true
+        - any:
+            - not:
+                tool_decorator_kwarg_present:
+                  - needsApproval
+            - tool_decorator_kwarg_value:
+                kwarg: needsApproval
+                value: "false"
+    explanation: >
+      This Vercel AI SDK tool shells out or executes dynamic code, but has no
+      needsApproval gate — the option is absent or
+      explicitly set to false. needsApproval is the Vercel AI SDK's
+      human-in-the-loop gate for sensitive tool calls, and its default is
+      false — so an un-gated privileged tool executes attacker-influenced
+      model output with no human checkpoint. Passing true or a per-call
+      approval function both count as a gate and do not fire. This complements
+      VAI-001 (subprocess) and VAI-002 (eval / new Function): those flag the
+      dangerous call; VAI-013 flags the missing approval gate around it. SDK 7
+      moved approval to toolApproval on generateText,
+      streamText, or ToolLoopAgent. This tool-scoped rule cannot verify that
+      separate setting, so a finding in SDK 7 code requires manual review.
+    fix: >
+      Pass needsApproval: true to the tool() or dynamicTool() options for
+      tools that execute commands or run code, and handle the resulting
+      approval requests in your agent loop. SDK 7+ uses
+      toolApproval on generateText, streamText, or ToolLoopAgent, but this rule
+      cannot yet verify that call or agent-level setting. If approval is
+      intentionally automated for a trusted tool, gate the agent with input
+      validation and document the decision.