fix(approval): keep approve-allow one-shot for pending requests

Route /approve-allow through a runtime-only pending-request path so it does not
persist approval policy changes for normal tools.

This preserves always_ask semantics for Telegram inline HITL approvals while
keeping /approve and /approve-request + /approve-confirm as the persistent
approval flows. Update docs and regression assertions accordingly.
This commit is contained in:
argenis de la rosa
2026-03-01 13:00:48 -05:00
committed by Argenis
parent c5d84ebc59
commit fa2f902259
4 changed files with 52 additions and 5 deletions
+2
View File
@@ -56,6 +56,8 @@ Telegram/Discord sender-scoped model routing:
Supervised tool approvals (all non-CLI channels):
- `/approve-request <tool-name>` — create a pending approval request
- `/approve-confirm <request-id>` — confirm pending request (same sender + same chat/channel only)
- `/approve-allow <request-id>` — approve the current pending runtime execution request once (no policy persistence)
- `/approve-deny <request-id>` — deny the current pending runtime execution request
- `/approve-pending` — list pending requests for your current sender+chat/channel scope
- `/approve <tool-name>` — direct one-step approve + persist (`autonomy.auto_approve`, compatibility path)
- `/unapprove <tool-name>` — revoke and remove persisted approval