@agent-native/core 0.149.1 → 0.149.2

package/corpus/templates/slides/shared/api.ts

@@ -137,7 +137,7 @@ function normalizeString(value: unknown, fallback: string): string {
 }
 
 function normalizeElementPath(value: unknown): number[] | undefined {
-  if (!Array.isArray(value)) return undefined;
+  if (!Array.isArray(value) || value.length === 0) return undefined;
   const path = value.filter(
     (part): part is number =>
       typeof part === "number" &&
@@ -155,6 +155,7 @@ function normalizeSlideAnimation(
   if (!isRecord(value)) return null;
 
   const elementPath = normalizeElementPath(value.elementPath);
+  if (value.elementPath !== undefined && !elementPath) return null;
   const rawElementIndex = value.elementIndex;
   const hasElementIndex =
     typeof rawElementIndex === "number" &&

package/corpus/templates/slides/shared/deck-title.ts

@@ -0,0 +1,135 @@
+const GENERATED_TITLE_PLACEHOLDERS = new Set([
+  "deck",
+  "date",
+  "image slide title",
+  "presentation title",
+  "section",
+  "section title",
+  "slide title",
+  "untitled",
+  "untitled deck",
+  "your name",
+]);
+
+/**
+ * Generated deck ids should never become user-facing titles. Keep this
+ * deliberately narrow so normal titles with spaces and punctuation remain
+ * valid, while catching opaque mixed-case tokens such as H3sVsnns-TEVUOpz9w.
+ */
+const OPAQUE_DECK_TITLE_PATTERN =
+  /^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)[A-Za-z0-9_-]{12,64}$/;
+
+export const DEFAULT_DECK_TITLE = "Untitled Deck";
+
+export function isOpaqueDeckTitle(value: unknown): value is string {
+  return (
+    typeof value === "string" && OPAQUE_DECK_TITLE_PATTERN.test(value.trim())
+  );
+}
+
+export function isGeneratedDeckTitle(value: unknown): value is string {
+  if (typeof value !== "string") return false;
+  const title = value.trim();
+  return (
+    GENERATED_TITLE_PLACEHOLDERS.has(title.toLowerCase()) ||
+    isOpaqueDeckTitle(title)
+  );
+}
+
+function decodeHtmlEntities(value: string): string {
+  const decodeCodePoint = (raw: string, radix: number): string => {
+    const codePoint = Number.parseInt(raw, radix);
+    return Number.isNaN(codePoint) || codePoint > 0x10ffff
+      ? ""
+      : String.fromCodePoint(codePoint);
+  };
+
+  return value
+    .replace(/ /gi, " ")
+    .replace(/&/gi, "&")
+    .replace(/&lt;/gi, "<")
+    .replace(/&gt;/gi, ">")
+    .replace(/&quot;/gi, '"')
+    .replace(/(?:&#39;|&apos;)/gi, "'")
+    .replace(/&#x([0-9a-f]+);?/gi, (_, hex: string) => decodeCodePoint(hex, 16))
+    .replace(/&#(\d+);?/g, (_, digits: string) => decodeCodePoint(digits, 10));
+}
+
+function plainText(value: string): string {
+  return decodeHtmlEntities(
+    value.replace(/<br\s*\/?>/gi, " ").replace(/<[^>]+>/g, " "),
+  )
+    .replace(/\s+/g, " ")
+    .trim();
+}
+
+function usableCandidate(value: string): string | null {
+  const candidate = plainText(value).replace(/^[•●▪‣\-\s]+/, "");
+  if (!candidate || candidate.length > 140) return null;
+  if (GENERATED_TITLE_PLACEHOLDERS.has(candidate.toLowerCase())) return null;
+  return candidate;
+}
+
+/**
+ * Recover a deck title from the largest title-like text in its first slide.
+ * This is intentionally HTML-string based because the action runs on the
+ * server without a browser DOM.
+ */
+export function deriveDeckTitleFromSlideContent(
+  content: unknown,
+): string | null {
+  if (typeof content !== "string" || !content.trim()) return null;
+
+  const candidates: Array<{ score: number; text: string }> = [];
+  const headingPattern = /<(h[1-6])\b[^>]*>([\s\S]*?)<\/\1>/gi;
+  for (const match of content.matchAll(headingPattern)) {
+    const text = usableCandidate(match[2] ?? "");
+    if (text) {
+      const level = Number.parseInt(match[1].slice(1), 10);
+      candidates.push({ score: 1000 - level * 10, text });
+    }
+  }
+
+  const styledTextPattern =
+    /<([a-z][\w:-]*)\b[^>]*\bstyle\s*=\s*(["'])([\s\S]*?)\2[^>]*>([\s\S]*?)<\/\1>/gi;
+  for (const match of content.matchAll(styledTextPattern)) {
+    const fontSize = Number.parseFloat(
+      match[3]?.match(/(?:^|;)\s*font-size\s*:\s*([\d.]+)px/i)?.[1] ?? "0",
+    );
+    if (fontSize < 28) continue;
+    const text = usableCandidate(match[4] ?? "");
+    if (text) candidates.push({ score: fontSize, text });
+  }
+
+  return candidates.sort((a, b) => b.score - a.score)[0]?.text ?? null;
+}
+
+/**
+ * Return a human-readable replacement only when the requested title is a
+ * generated placeholder or opaque id. A meaningful existing title wins when
+ * a stale full-payload save tries to replace it with a generated value.
+ */
+export function repairGeneratedDeckTitle(
+  requestedTitle: unknown,
+  firstSlideContent: unknown,
+  existingTitle?: unknown,
+): string | null {
+  if (!isGeneratedDeckTitle(requestedTitle)) return null;
+
+  return (
+    deriveDeckTitleFromSlideContent(firstSlideContent) ??
+    (typeof existingTitle === "string" &&
+    existingTitle.trim() &&
+    !isGeneratedDeckTitle(existingTitle)
+      ? existingTitle
+      : null)
+  );
+}
+
+export function assertHumanReadableDeckTitle(title: string): void {
+  if (isOpaqueDeckTitle(title)) {
+    throw new Error(
+      "Deck title must be a concise, human-readable title; generated ids are not valid titles.",
+    );
+  }
+}

package/corpus/templates/tasks/app/components/tasks/TaskListRow.tsx

@@ -89,7 +89,10 @@ export function TaskListRow({
       onAnimationEnd={completion.handleRowAnimationEnd}
       dataAttributes={{ "data-task-id": item.id }}
       className={cn(
-        "will-change-[opacity,transform]",
+        // Scoped to the phases that actually animate. Applied unconditionally
+        // it promoted a layer for every row in the list and never retired any
+        // of them, for an animation that only runs while a row completes.
+        completionPhase !== "idle" && "will-change-[opacity,transform]",
         displayDone && completionPhase === "idle" && !selected && "opacity-60",
         completionPhase === "completing" &&
           hideAfterComplete &&

package/dist/agent/engine/ai-sdk-engine.js

@@ -138,7 +138,7 @@ function googleThinkingBudget(effort) {
     return -1;
 }
 /**
- * Map a reasoning effort level to Gemini 3.x thinkingLevel string.
+ * Map an effort level to Gemini 3.x thinkingLevel string.
  * Gemini 3 models (gemini-3.*) reject thinkingBudget and require thinkingLevel
  * with values 'low' | 'medium' | 'high'. Gemini 3.0 only supports 'low'/'high';
  * Gemini 3.1+ adds 'medium'. We always emit 'medium' for medium effort since it

package/dist/agent/production-agent.d.ts

@@ -266,7 +266,7 @@ export interface ProductionAgentOptions {
     model?: string;
     /** App/template id used for org-scoped per-app model defaults. */
     appId?: string;
-    /** Default reasoning effort for requests that do not supply an override. */
+    /** Default effort for requests that do not supply an override. */
     reasoningEffort?: ReasoningEffort;
     /** Provider-specific options passed through to the engine */
     providerOptions?: EngineMessage extends never ? never : any;
@@ -632,8 +632,16 @@ export interface ExecuteAgentToolCallOptions {
     threadId?: string;
     turnId?: string;
     approvedToolCalls?: string[];
+    onApprovalRequired?: (binding: AgentApprovalBinding) => Promise<void>;
+    consumeApproval?: (binding: AgentApprovalBinding) => Promise<boolean>;
     send?: (event: AgentChatEvent) => void;
 }
+export interface AgentApprovalBinding {
+    toolName: string;
+    input: unknown;
+    callId: string;
+    approvalKey: string;
+}
 /**
  * Execute one externally-selected tool through the exact same guarded runtime
  * as a normal model-selected tool call. Realtime voice and other duplex
@@ -658,6 +666,11 @@ export declare function buildFirstRequestPayloadDetail(input: {
     availableToolCount: number;
 }): string;
 export declare function toolCallCacheKey(toolName: string, input: unknown): string;
+export declare function findApprovedStructuredToolCall(history: AgentChatStructuredMessage[] | undefined, approvedToolCalls: readonly string[] | undefined): {
+    name: string;
+    input: unknown;
+    callId: string;
+} | undefined;
 export declare function repeatedSourceSweepGuardMessage(opts: {
     toolName: string;
     priorCalls: number;
@@ -769,6 +782,13 @@ export declare function runAgentLoop(opts: {
      * `approval_required`. See `AgentChatRequest.approvedToolCalls`.
      */
     approvedToolCalls?: string[];
+    /**
+     * Server-side approval persistence hooks. The HTTP transport supplies these
+     * so client-supplied history is never the authorization source; direct loop
+     * callers may omit them when they own the surrounding approval boundary.
+     */
+    onApprovalRequired?: (binding: AgentApprovalBinding) => Promise<void>;
+    consumeApproval?: (binding: AgentApprovalBinding) => Promise<boolean>;
     /**
      * In-loop processor seam (see `processors.ts`). Each processor can observe
      * streamed chunks, observe model responses around tool execution, and

package/dist/agent/production-agent.js

@@ -39,6 +39,7 @@ import { ProcessorChain, TripWire, toolCallsFromContent, } from "./processors.js
 import { startRun, subscribeToRun, getActiveRunForThread, getActiveRunForThreadAsync, getRun, abortRun, abortRunDurably, abortTurnDurably, tryClaimRunSlot, isHostedRuntime, resolveRunSoftTimeoutMs, resolveRunToolTimeoutCeilingMs, } from "./run-manager.js";
 import { writeLedgerEntry, readLedgerEntry, clearLedgerForThread, insertRun, insertRunEvent, isTurnAborted, markRunAborted, updateRunHeartbeat, updateRunStatusIfRunning, setRunError, setRunTerminalReason, claimBackgroundRun, readBackgroundRunClaim, recordRunDiagnostic, countRunsForTurn, RUN_DIAG_STAGE, UNCLAIMED_BACKGROUND_RUN_GRACE_MS, } from "./run-store.js";
 import { buildCurrentTimeUserContext } from "./runtime-context.js";
+import { consumeAgentToolApproval, createAgentToolApproval, } from "./tool-approval-store.js";
 import { findCompletedJournalEntry, } from "./tool-call-journal.js";
 import { redactSensitiveFields, sanitizeToolErrorText, sanitizeToolErrorValue, } from "./tool-error-redaction.js";
 import { describeToolResultImages, extractAgentImagesFromActionResult, } from "./tool-result-images.js";
@@ -688,7 +689,7 @@ const VISIBLE_RETRY_THRESHOLD_MS = 10_000;
  */
 const FOREGROUND_FIRST_MODEL_EVENT_TIMEOUT_MS = 25_000;
 // Raised from 1 -> 2 now that each retry actually adapts (raises the token
-// ceiling and steps reasoning effort down a tier) instead of re-issuing the
+// ceiling and steps effort down a tier) instead of re-issuing the
 // exact same doomed request twice.
 const EMPTY_FINAL_RESPONSE_RETRY_LIMIT = 2;
 const MAIN_CHAT_INTERNAL_CONTINUATION_LIMIT = 6;
@@ -2120,6 +2121,8 @@ export async function executeAgentToolCall(options) {
             threadId: options.threadId,
             turnId: options.turnId,
             approvedToolCalls: options.approvedToolCalls,
+            onApprovalRequired: options.onApprovalRequired,
+            consumeApproval: options.consumeApproval,
         });
     }
     catch (error) {
@@ -2307,6 +2310,51 @@ function stableStringify(value) {
 export function toolCallCacheKey(toolName, input) {
     return `${toolName}:${stableStringify(normalizeToolCallInputForHistory(input))}`;
 }
+export function findApprovedStructuredToolCall(history, approvedToolCalls) {
+    if (!Array.isArray(history) || !approvedToolCalls?.length)
+        return undefined;
+    const approved = new Set(approvedToolCalls);
+    const calls = new Map();
+    let match;
+    for (const message of history) {
+        if (message.role === "assistant") {
+            for (const part of message.content) {
+                if (part.type !== "tool-call")
+                    continue;
+                const callId = typeof part.id === "string"
+                    ? part.id
+                    : typeof part.toolCallId === "string"
+                        ? part.toolCallId
+                        : "";
+                const name = typeof part.name === "string"
+                    ? part.name
+                    : typeof part.toolName === "string"
+                        ? part.toolName
+                        : "";
+                if (!callId || !name)
+                    continue;
+                calls.set(callId, { name, input: part.input ?? part.args ?? {} });
+            }
+            continue;
+        }
+        for (const part of message.content) {
+            if (part.type !== "tool-result")
+                continue;
+            const call = calls.get(part.toolCallId);
+            if (!call || !approved.has(toolCallCacheKey(call.name, call.input))) {
+                continue;
+            }
+            const result = part.content.toLowerCase();
+            if (!result.includes("did not execute") &&
+                !result.includes("awaiting human approval") &&
+                !result.includes("waiting for your approval")) {
+                continue;
+            }
+            match = { ...call, callId: part.toolCallId };
+        }
+    }
+    return match;
+}
 const INTERRUPTED_TOOL_LEDGER_POLL_MS = process.env.NODE_ENV === "test" ? 0 : 2_000;
 async function waitForInterruptedToolLedgerEntry(opts) {
     const pollMs = INTERRUPTED_TOOL_LEDGER_POLL_MS;
@@ -3965,7 +4013,16 @@ export async function runAgentLoop(opts) {
             const approvalKey = toolCallCacheKey(toolCall.name, toolCall.input);
             // Consume a grant on its first exact match. A second identical call in
             // the same continuation must request its own human approval.
-            const wasApproved = approvedToolCallKeys.delete(approvalKey);
+            const approvalBinding = {
+                toolName: toolCall.name,
+                input: toolCall.input,
+                callId: toolCall.id,
+                approvalKey,
+            };
+            const requestedApproval = approvedToolCallKeys.delete(approvalKey);
+            const wasApproved = requestedApproval && opts.consumeApproval
+                ? await opts.consumeApproval(approvalBinding)
+                : requestedApproval;
             if (actionEntry.needsApproval && !wasApproved) {
                 let mustApprove = false;
                 try {
@@ -3989,6 +4046,7 @@ export async function runAgentLoop(opts) {
                     mustApprove = true;
                 }
                 if (mustApprove) {
+                    await opts.onApprovalRequired?.(approvalBinding);
                     send({
                         type: "tool_start",
                         id: toolCall.id,
@@ -6433,6 +6491,12 @@ export function createProductionAgentHandler(options) {
             ...historyMessages,
             { role: "user", content: userContent },
         ];
+        const requestedApprovedToolCalls = Array.isArray(body.approvedToolCalls) && body.approvedToolCalls.length > 0
+            ? body.approvedToolCalls
+                .filter((key) => typeof key === "string")
+                .slice(0, 200)
+            : undefined;
+        const exactApprovedToolCall = findApprovedStructuredToolCall(structuredHistory, requestedApprovedToolCalls);
         const firstRequestPayloadDetail = buildFirstRequestPayloadDetail({
             isFirstRequest: history.length === 0,
             systemPrompt: requestSystemPrompt,
@@ -6486,6 +6550,38 @@ export function createProductionAgentHandler(options) {
             : typeof requestTurnId === "string" && requestTurnId.trim()
                 ? requestTurnId.trim()
                 : runId;
+        const approvalStoreBinding = (binding) => {
+            if (!ownerEmail) {
+                throw new Error("Cannot create or consume an approval without an authenticated owner");
+            }
+            return {
+                ownerEmail,
+                orgId: getRequestOrgId() ?? null,
+                threadId: effectiveThreadId,
+                turnId: effectiveTurnId,
+                toolName: binding.toolName,
+                callId: binding.callId,
+                approvalKey: binding.approvalKey,
+            };
+        };
+        const approvalHooks = {
+            onApprovalRequired: async (binding) => {
+                await createAgentToolApproval(approvalStoreBinding(binding));
+            },
+            consumeApproval: async (binding) => {
+                if (!ownerEmail)
+                    return false;
+                return consumeAgentToolApproval(approvalStoreBinding(binding));
+            },
+        };
+        const exactApprovedToolEntry = exactApprovedToolCall
+            ? requestActions[exactApprovedToolCall.name]
+            : undefined;
+        const approvedToolCallsForExecution = exactApprovedToolCall && exactApprovedToolEntry?.needsApproval
+            ? [
+                toolCallCacheKey(exactApprovedToolCall.name, exactApprovedToolCall.input),
+            ]
+            : undefined;
         if (isBackgroundWorker &&
             (await isTurnAborted(effectiveThreadId, effectiveTurnId))) {
             await markRunAborted(runId, "user").catch(() => { });
@@ -7236,15 +7332,13 @@ export function createProductionAgentHandler(options) {
                     ? { threadId: effectiveThreadId, turnId: effectiveTurnId }
                     : {}),
                 // Human-in-the-loop approval grants for this turn (sanitized — the
-                // request is untrusted; accept only a bounded list of string keys).
-                ...(Array.isArray(body.approvedToolCalls) &&
-                    body.approvedToolCalls.length
-                    ? {
-                        approvedToolCalls: body.approvedToolCalls
-                            .filter((k) => typeof k === "string")
-                            .slice(0, 200),
-                    }
+                // request is untrusted; only the exact structured call is passed to
+                // the loop, where the durable grant is consumed atomically.
+                ...(approvedToolCallsForExecution
+                    ? { approvedToolCalls: approvedToolCallsForExecution }
                     : {}),
+                onApprovalRequired: approvalHooks.onApprovalRequired,
+                consumeApproval: approvalHooks.consumeApproval,
                 // A worker PROVEN to be running inside the real 15-min Netlify
                 // `-background` function (`runsInBackgroundFunction`) has minutes of
                 // budget left on THIS invocation. Let it catch a recoverable
@@ -7269,6 +7363,31 @@ export function createProductionAgentHandler(options) {
             send({ type: "activity", label: "Contacting model" });
             let instrumented = false;
             try {
+                if (exactApprovedToolCall &&
+                    approvedToolCallsForExecution &&
+                    requestActions[exactApprovedToolCall.name]) {
+                    send({
+                        type: "activity",
+                        label: `Running approved ${exactApprovedToolCall.name} action`,
+                        tool: exactApprovedToolCall.name,
+                    });
+                    await executeAgentToolCall({
+                        actions: requestActions,
+                        name: exactApprovedToolCall.name,
+                        input: exactApprovedToolCall.input,
+                        callId: exactApprovedToolCall.callId,
+                        signal: agentLoopOpts.signal,
+                        ownerEmail,
+                        orgId: getRequestOrgId() ?? null,
+                        threadId: effectiveThreadId,
+                        turnId: effectiveTurnId,
+                        approvedToolCalls: approvedToolCallsForExecution,
+                        onApprovalRequired: approvalHooks.onApprovalRequired,
+                        consumeApproval: approvalHooks.consumeApproval,
+                        send,
+                    });
+                    return;
+                }
                 try {
                     const { getObservabilityConfig, instrumentAgentLoop } = await import("../observability/traces.js");
                     const obsConfig = await getObservabilityConfig();

package/dist/agent/tool-approval-store.d.ts

@@ -0,0 +1,18 @@
+export interface AgentToolApprovalBinding {
+    ownerEmail: string;
+    orgId?: string | null;
+    threadId?: string | null;
+    turnId?: string | null;
+    toolName: string;
+    callId: string;
+    approvalKey: string;
+    expiresAt?: number;
+}
+export declare function hashAgentToolApprovalKey(approvalKey: string): string;
+export declare function createAgentToolApproval(binding: AgentToolApprovalBinding): Promise<void>;
+/**
+ * Atomically consume the server-created approval for one exact tool call.
+ * Client history and approval keys are only lookup input; the pending row is
+ * the authorization boundary and cannot be manufactured by the client.
+ */
+export declare function consumeAgentToolApproval(binding: AgentToolApprovalBinding): Promise<boolean>;

package/dist/agent/tool-approval-store.js

@@ -0,0 +1,122 @@
+import { createHash, randomUUID } from "node:crypto";
+import { getDbExec, intType, isPostgres, retryOnDdlRace, } from "../db/client.js";
+import { ensureIndexExists, ensureTableExists } from "../db/ddl-guard.js";
+const APPROVAL_TTL_MS = 15 * 60_000;
+const APPROVAL_CLEANUP_AGE_MS = 24 * 60 * 60_000;
+let initPromise;
+async function ensureAgentToolApprovalTable() {
+    if (!initPromise) {
+        initPromise = (async () => {
+            const createSql = `CREATE TABLE IF NOT EXISTS agent_tool_approvals (
+  id TEXT PRIMARY KEY,
+  owner_email TEXT NOT NULL,
+  org_id TEXT,
+  thread_id TEXT,
+  turn_id TEXT,
+  tool_name TEXT NOT NULL,
+  call_id TEXT NOT NULL,
+  approval_key_hash TEXT NOT NULL,
+  status TEXT NOT NULL,
+  expires_at ${intType()} NOT NULL,
+  consumed_at ${intType()},
+  created_at ${intType()} NOT NULL,
+  updated_at ${intType()} NOT NULL
+)`;
+            const indexSql = `CREATE INDEX IF NOT EXISTS idx_agent_tool_approvals_binding
+        ON agent_tool_approvals(owner_email, org_id, thread_id, tool_name, call_id, status)`;
+            if (isPostgres()) {
+                await ensureTableExists("agent_tool_approvals", createSql);
+                await ensureIndexExists("idx_agent_tool_approvals_binding", indexSql);
+                return;
+            }
+            const client = getDbExec();
+            await retryOnDdlRace(() => client.execute(createSql));
+            await retryOnDdlRace(() => client.execute(indexSql));
+        })().catch((error) => {
+            initPromise = undefined;
+            throw error;
+        });
+    }
+    return initPromise;
+}
+export function hashAgentToolApprovalKey(approvalKey) {
+    return createHash("sha256").update(approvalKey).digest("hex");
+}
+export async function createAgentToolApproval(binding) {
+    await ensureAgentToolApprovalTable();
+    const now = Date.now();
+    const expiresAt = binding.expiresAt ?? now + APPROVAL_TTL_MS;
+    await getDbExec().execute({
+        sql: `INSERT INTO agent_tool_approvals
+      (id, owner_email, org_id, thread_id, turn_id, tool_name, call_id,
+       approval_key_hash, status, expires_at, consumed_at, created_at, updated_at)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, 'pending', ?, NULL, ?, ?)`,
+        args: [
+            `agent-tool-approval-${randomUUID()}`,
+            binding.ownerEmail,
+            binding.orgId ?? null,
+            binding.threadId ?? null,
+            binding.turnId ?? null,
+            binding.toolName,
+            binding.callId,
+            hashAgentToolApprovalKey(binding.approvalKey),
+            expiresAt,
+            now,
+            now,
+        ],
+    });
+    // Cleanup is hygiene only. Expired rows remain unusable because consume uses
+    // an atomic status and expiry predicate, so cleanup failures must not affect
+    // the approval that was just recorded.
+    try {
+        await getDbExec().execute({
+            sql: `DELETE FROM agent_tool_approvals
+        WHERE expires_at < ? AND status <> 'pending'`,
+            args: [now - APPROVAL_CLEANUP_AGE_MS],
+        });
+    }
+    catch (error) {
+        console.warn("[agent] Could not clean expired tool approval records", error);
+    }
+}
+/**
+ * Atomically consume the server-created approval for one exact tool call.
+ * Client history and approval keys are only lookup input; the pending row is
+ * the authorization boundary and cannot be manufactured by the client.
+ */
+export async function consumeAgentToolApproval(binding) {
+    await ensureAgentToolApprovalTable();
+    const now = Date.now();
+    const result = await getDbExec().execute({
+        sql: `UPDATE agent_tool_approvals
+      SET status = 'consumed', consumed_at = ?, updated_at = ?
+      WHERE id = (
+        SELECT id FROM agent_tool_approvals
+        WHERE owner_email = ?
+          AND ((org_id IS NULL AND CAST(? AS TEXT) IS NULL) OR org_id = ?)
+          AND ((thread_id IS NULL AND CAST(? AS TEXT) IS NULL) OR thread_id = ?)
+          AND tool_name = ?
+          AND call_id = ?
+          AND approval_key_hash = ?
+          AND status = 'pending'
+          AND expires_at > ?
+        ORDER BY created_at DESC
+        LIMIT 1
+      )
+      AND status = 'pending'`,
+        args: [
+            now,
+            now,
+            binding.ownerEmail,
+            binding.orgId ?? null,
+            binding.orgId ?? null,
+            binding.threadId ?? null,
+            binding.threadId ?? null,
+            binding.toolName,
+            binding.callId,
+            hashAgentToolApprovalKey(binding.approvalKey),
+            now,
+        ],
+    });
+    return result.rowsAffected === 1;
+}

package/dist/agent/types.d.ts

@@ -189,7 +189,7 @@ export interface AgentChatRequest {
     model?: string;
     /** Per-request engine override (sent alongside model for cross-provider switches). */
     engine?: string;
-    /** Per-request reasoning effort override (ephemeral, from the composer picker). */
+    /** Per-request effort override (ephemeral, from the composer picker). */
     effort?: ReasoningEffort;
     /** Usage-tracking label for this call (e.g. "chat", "summarize"). Default: "chat". */
     usageLabel?: string;

package/dist/cli/code-agent-executor.js

@@ -471,7 +471,14 @@ async function executeClaudeCliRun(options) {
     });
     try {
         const result = await runClaudeCodeParticipant({
-            role: options.permissionMode === "full-auto" ? "driver" : "watchdog",
+            // Claude's driver uses acceptEdits, which is the closest available
+            // mapping for auto-edit and full-auto. Keep ask-before-edit on the
+            // read-only watchdog path because this non-interactive runner has no
+            // approval channel to honor an edit prompt safely.
+            role: options.permissionMode === "auto-edit" ||
+                options.permissionMode === "full-auto"
+                ? "driver"
+                : "watchdog",
             prompt: buildClaudeCliPrompt(options.run, options.prompt),
             cwd,
             model,
@@ -604,7 +611,9 @@ async function executeClaudeCliRun(options) {
 }
 function buildClaudeCliPrompt(run, prompt) {
     const permissionMode = run.permissionMode ?? "full-auto";
-    const mode = permissionMode === "full-auto" ? "Auto" : "Plan";
+    const mode = permissionMode === "auto-edit" || permissionMode === "full-auto"
+        ? "Auto"
+        : "Plan";
     const modeInstruction = mode === "Plan"
         ? "Inspect and explain only. Do not edit files or run mutating commands."
         : "Edit and verify as needed. Do not create, switch, reset, rebase, or stash git branches.";