@dudousxd/nestjs-agent 1.2.0 → 1.4.0

package/README.md

@@ -130,6 +130,36 @@ nobody is streaming (including one that has already finished). In-process caller
 authorized elsewhere use `AgentService.subscribe(runId)`; anything reachable from a request must go
 through `AgentService.subscribeAs(actor, runId)`.
 
+### Who approves an action, and for how long
+
+Every `action` tool call waits on the person chatting by default. `approvalPolicy` changes that per
+call:
+
+```ts
+AgentModule.forRoot({
+  // …
+  approvalPolicy: {
+    requirementFor: (tool, actor) =>
+      tool.name === 'issueRefund'
+        ? { required: true, approver: 'finance', ttlMs: 15 * 60_000 }
+        : { required: true, approver: 'requester' },
+    // Optional. Default: 'requester' = the thread's own actor, anything else = a role the decider holds.
+    // canDecide: (actor, { approver, requesterRef }) => gate.forUser(actor).allows('approve', approver),
+  },
+});
+```
+
+- `POST /agent/tool-call/approve` `{ toolCallId, remember?, via? }` and `…/reject` `{ toolCallId,
+  reason?, via? }` enforce the recorded approver (`403` otherwise) and refuse a request that has
+  lapsed (`410`). The decider is recorded as `executedByRef`, `via` as `decided_via` (`'web'` when
+  omitted; the console approvals port takes `decidedVia` too).
+- `remember: true` approves later calls of the same tool in the same thread without asking.
+- A `ttlMs` becomes the approval wait's timeout — `ctx.waitForSignal(…, { timeoutMs })` on the
+  durable runner, a timer inline. On expiry the call settles `expired`, the model is told nobody
+  approved it in time, and the stream carries `tool-output-denied` + `approval-settled`.
+- The tool-call row gains `approver`, `expires_at`, `remember` and `decided_via`; a reloaded thread
+  carries them as `StoredMessage.approvals`.
+
 ### A durable turn's model call and tools run in a worker
 
 Under `durable: true` the turn's model call and each of its tool executions are **dispatched steps**

package/dist/{agent-deps.factory-OjrLyAZo.d.cts → agent-deps.factory-CUyVPsa1.d.cts}

@@ -1,4 +1,4 @@
-import { ModelProvider, AgentStore, ToolRegistry, RolesPolicy, QuotaStore, TokenStreamSink, PromptBuilder, PromptContributor, ToolTransientRetrySetting, Retriever, AgentPricingStore, HistoryPolicy, InputProcessor, OutputProcessor, AgentIntake, SkillsConfig, MemoryConfig, ToolSpec, ToolHandler, ActorResolver, AgentHistoryWindow, SkillProvider, ScopeResolver, MemoryProvider, AgentRegistry } from '@dudousxd/nestjs-agent-core';
+import { ModelProvider, AgentStore, ToolRegistry, RolesPolicy, ApprovalPolicy, QuotaStore, TokenStreamSink, PromptBuilder, PromptContributor, ToolTransientRetrySetting, Retriever, AgentPricingStore, HistoryPolicy, InputProcessor, OutputProcessor, AgentIntake, SkillsConfig, MemoryConfig, ToolSpec, ToolHandler, ActorResolver, AgentHistoryWindow, SkillProvider, ScopeResolver, MemoryProvider, AgentRegistry } from '@dudousxd/nestjs-agent-core';
 import { StandardSchemaV1 } from '@standard-schema/spec';
 import { Provider, FactoryProvider, Type, CanActivate, ModuleMetadata, InjectionToken, OptionalFactoryDependency } from '@nestjs/common';
 
@@ -8,6 +8,8 @@ interface AgentDeps {
     store: AgentStore;
     registry: ToolRegistry;
     rolesPolicy: RolesPolicy;
+    /** Who approves an action call, and for how long (from `forRoot({ approvalPolicy })`). Undefined → the requester, no expiry. */
+    approvalPolicy?: ApprovalPolicy;
     quota?: QuotaStore;
     sink: TokenStreamSink;
     /** Fallback accounting label; the provider's turn result overrides it when set. */
@@ -205,6 +207,13 @@ interface AgentModuleOptions {
     quotaLimitTokens?: number;
     /** Tool authorization gate. Defaults to role-in-`defaultRoles`. */
     rolesPolicy?: RolesPolicy;
+    /**
+     * Who has to approve an `action` tool call, and how long the request stays open. Defaults to the
+     * requester (the thread's own actor) with no expiry. A requirement naming another approver (a
+     * role) is enforced by `POST tool-call/approve|reject` through `canDecide` — by default, the
+     * deciding actor must hold that role. See `ApprovalPolicy`.
+     */
+    approvalPolicy?: ApprovalPolicy;
     /** Default roles a tool requires when its `roles` is omitted. Defaults to `['ADMIN']`. */
     defaultRoles?: string[];
     /**

package/dist/{agent-deps.factory-OjrLyAZo.d.ts → agent-deps.factory-CUyVPsa1.d.ts}

@@ -1,4 +1,4 @@
-import { ModelProvider, AgentStore, ToolRegistry, RolesPolicy, QuotaStore, TokenStreamSink, PromptBuilder, PromptContributor, ToolTransientRetrySetting, Retriever, AgentPricingStore, HistoryPolicy, InputProcessor, OutputProcessor, AgentIntake, SkillsConfig, MemoryConfig, ToolSpec, ToolHandler, ActorResolver, AgentHistoryWindow, SkillProvider, ScopeResolver, MemoryProvider, AgentRegistry } from '@dudousxd/nestjs-agent-core';
+import { ModelProvider, AgentStore, ToolRegistry, RolesPolicy, ApprovalPolicy, QuotaStore, TokenStreamSink, PromptBuilder, PromptContributor, ToolTransientRetrySetting, Retriever, AgentPricingStore, HistoryPolicy, InputProcessor, OutputProcessor, AgentIntake, SkillsConfig, MemoryConfig, ToolSpec, ToolHandler, ActorResolver, AgentHistoryWindow, SkillProvider, ScopeResolver, MemoryProvider, AgentRegistry } from '@dudousxd/nestjs-agent-core';
 import { StandardSchemaV1 } from '@standard-schema/spec';
 import { Provider, FactoryProvider, Type, CanActivate, ModuleMetadata, InjectionToken, OptionalFactoryDependency } from '@nestjs/common';
 
@@ -8,6 +8,8 @@ interface AgentDeps {
     store: AgentStore;
     registry: ToolRegistry;
     rolesPolicy: RolesPolicy;
+    /** Who approves an action call, and for how long (from `forRoot({ approvalPolicy })`). Undefined → the requester, no expiry. */
+    approvalPolicy?: ApprovalPolicy;
     quota?: QuotaStore;
     sink: TokenStreamSink;
     /** Fallback accounting label; the provider's turn result overrides it when set. */
@@ -205,6 +207,13 @@ interface AgentModuleOptions {
     quotaLimitTokens?: number;
     /** Tool authorization gate. Defaults to role-in-`defaultRoles`. */
     rolesPolicy?: RolesPolicy;
+    /**
+     * Who has to approve an `action` tool call, and how long the request stays open. Defaults to the
+     * requester (the thread's own actor) with no expiry. A requirement naming another approver (a
+     * role) is enforced by `POST tool-call/approve|reject` through `canDecide` — by default, the
+     * deciding actor must hold that role. See `ApprovalPolicy`.
+     */
+    approvalPolicy?: ApprovalPolicy;
     /** Default roles a tool requires when its `roles` is omitted. Defaults to `['ADMIN']`. */
     defaultRoles?: string[];
     /**

package/dist/durable/index.cjs

@@ -304,7 +304,21 @@ var AgentRunWorkflow = class _AgentRunWorkflow {
       runId: ctx.runId,
       // A child forwards into the top-level sink but must not end/fail it (the top-level run owns it).
       openSink: /* @__PURE__ */ __name(async () => input.sinkRunId !== void 0 ? childSinkWriter(await deps.sink.open(sinkRunId)) : deps.sink.open(ctx.runId), "openSink"),
-      awaitApproval: /* @__PURE__ */ __name((call) => ctx.waitForSignal(`tool:${ctx.runId}:${call.id}`), "awaitApproval"),
+      // A policy's time to live becomes the signal wait's own timeout: the runtime journals the
+      // deadline on the first call (a position of its own, reached only for a call the journal says
+      // has a ttl) and wakes the run when it passes. The lapse comes back as a Decision rather than a
+      // throw, so the loop settles the call `expired` on its ordinary rejection checkpoint.
+      awaitApproval: /* @__PURE__ */ __name((call, _toolCtx, opts) => opts?.timeoutMs === void 0 ? ctx.waitForSignal(`tool:${ctx.runId}:${call.id}`) : ctx.waitForSignal(`tool:${ctx.runId}:${call.id}`, {
+        timeoutMs: opts.timeoutMs
+      }).catch((error) => {
+        if (isSignalTimeout(error)) {
+          return {
+            approved: false,
+            expired: true
+          };
+        }
+        throw error;
+      }), "awaitApproval"),
       // The same wait, on the same signal key, carrying a typed answer instead of a yes/no — so a
       // question set and an approval reach a parked run through one path, and the HTTP surface that
       // settles either one is the same `POST /agent/tool-call/*` family.
@@ -478,6 +492,10 @@ AgentRunWorkflow = _ts_decorate2([
     typeof RunGateway === "undefined" ? Object : RunGateway
   ])
 ], AgentRunWorkflow);
+function isSignalTimeout(error) {
+  return error instanceof Error && error.name === "SignalTimeoutError";
+}
+__name(isSignalTimeout, "isSignalTimeout");
 
 // src/durable/durable-agent-runner.ts
 var import_node_crypto = require("crypto");
@@ -908,6 +926,9 @@ var AgentDepsFactory2 = class {
       store: this.store,
       sink: this.sink,
       rolesPolicy: this.rolesPolicy,
+      ...this.options.approvalPolicy !== void 0 ? {
+        approvalPolicy: this.options.approvalPolicy
+      } : {},
       registry: this.registry,
       promptContributors: this.promptContributors,
       systemPrompt: definition?.systemPrompt ?? "You are a helpful assistant.",
@@ -1191,18 +1212,35 @@ var AgentService = class {
     await this.assertOwnsActiveStream(actor, runId);
     return this.subscribe(runId);
   }
-  async approve(actor, toolCallId2) {
-    await this.assertOwnsToolCall(actor, toolCallId2);
+  /**
+  * Approve a parked action call as `actor`. Who may is the call's recorded approver's business
+  * (see {@link assertMayDecide}); `remember` approves later calls of the same tool in the same
+  * thread, and `via` names the surface the decision came through (`'web'`, `'slack'`, …) — both
+  * persisted with the call.
+  */
+  async approve(actor, toolCallId2, opts = {}) {
+    await this.assertMayDecide(actor, toolCallId2);
     return this.signalToolCall(toolCallId2, {
-      approved: true
+      approved: true,
+      executedByRef: actor.id,
+      ...opts.remember === true ? {
+        remember: true
+      } : {},
+      ...opts.via !== void 0 ? {
+        decidedVia: opts.via
+      } : {}
     });
   }
-  async reject(actor, toolCallId2, reason) {
-    await this.assertOwnsToolCall(actor, toolCallId2);
+  async reject(actor, toolCallId2, reason, opts = {}) {
+    await this.assertMayDecide(actor, toolCallId2);
     return this.signalToolCall(toolCallId2, {
       approved: false,
+      executedByRef: actor.id,
       ...reason !== void 0 ? {
         reason
+      } : {},
+      ...opts.via !== void 0 ? {
+        decidedVia: opts.via
       } : {}
     });
   }
@@ -1214,6 +1252,7 @@ var AgentService = class {
   */
   async answer(actor, toolCallId2, answers2 = {}) {
     await this.assertOwnsToolCall(actor, toolCallId2);
+    await this.assertAnswersFit(toolCallId2, answers2);
     const reply = {
       answers: answers2,
       answeredByRef: actor.id
@@ -1243,6 +1282,7 @@ var AgentService = class {
   * not the thread's own actor).
   */
   async signalToolCall(toolCallId2, reply) {
+    await this.assertNotExpired(toolCallId2);
     const runId = await this.resolveRunForToolCall(toolCallId2);
     return this.runner.signal(runId, toolCallId2, reply);
   }
@@ -1481,6 +1521,68 @@ var AgentService = class {
     }
   }
   /**
+  * Check a reply against the questions it answers before it is signalled: every submitted value a
+  * question's own rules accept (a typed input's type, bounds and pattern; a pick from the offered
+  * options), and every `required` question answered — by the reply, or by the defaults an omitted
+  * question falls back to. A reply the loop would have to drop parts of is refused here instead, so
+  * the person who typed it hears why. Needs the store to hand back the call's recorded questions;
+  * without that seam the loop's own filtering is the only check.
+  */
+  async assertAnswersFit(toolCallId2, answers2) {
+    if (this.store.toolCallInput === void 0) {
+      return;
+    }
+    const questions = (0, import_nestjs_agent_core8.readElicitationQuestions)(await this.store.toolCallInput(toolCallId2));
+    for (const question of questions) {
+      const submitted = Object.hasOwn(answers2, question.id) ? answers2[question.id] : void 0;
+      const problem = (0, import_nestjs_agent_core8.validateElicitationAnswer)(question, submitted ?? question.defaults ?? []);
+      if (problem !== null) {
+        throw new import_common6.BadRequestException(`answers["${question.id}"] ${problem}`);
+      }
+    }
+  }
+  /**
+  * Authorization seam for approve/reject. The call's recorded approver decides who may settle it:
+  * the requester (the default, and every call recorded before approvers existed) is the thread's
+  * own actor — the ownership check this always was; any other approver goes through the policy's
+  * `canDecide`, which by default asks whether the actor holds that role.
+  */
+  async assertMayDecide(actor, toolCallId2) {
+    const approval = await this.store.toolCallApproval?.(toolCallId2);
+    const approver = approval?.approver ?? import_nestjs_agent_core8.REQUESTER_APPROVER;
+    if (approver === import_nestjs_agent_core8.REQUESTER_APPROVER) {
+      return this.assertOwnsToolCall(actor, toolCallId2);
+    }
+    const requesterRef = await this.store.ownerOfToolCall(toolCallId2);
+    if (requesterRef === null) {
+      throw new import_common6.NotFoundException(`tool call ${toolCallId2} not found`);
+    }
+    const allowed = await (0, import_nestjs_agent_core8.mayDecideApproval)(this.deps.forAgent().approvalPolicy, actor, {
+      toolCallId: toolCallId2,
+      approver,
+      requesterRef
+    });
+    if (!allowed) {
+      throw new import_common6.ForbiddenException(`this approval is for ${approver}`);
+    }
+  }
+  /**
+  * Refuse a decision on a request that has already lapsed — recorded `expired`, or past its
+  * `expiresAt` with the run's own timer about to fire. Signalling it anyway would race the timeout:
+  * a durable runtime buffers a signal nobody is waiting on, and a late approval must not be what a
+  * later replay of the run reads back.
+  */
+  async assertNotExpired(toolCallId2) {
+    const approval = await this.store.toolCallApproval?.(toolCallId2);
+    if (approval === null || approval === void 0) {
+      return;
+    }
+    const lapsed = approval.status === "expired" || approval.status === "pending_approval" && approval.expiresAt !== null && Date.parse(approval.expiresAt) <= Date.now();
+    if (lapsed) {
+      throw new import_common6.GoneException(`the approval request for tool call ${toolCallId2} has expired`);
+    }
+  }
+  /**
   * Resolve the run awaiting `toolCallId`. Derived server-side from the tool call alone — the client
   * never knows or supplies a runId, and that run is the sub-agent's own child run when the pending
   * call belongs to a delegated agent. The store answers from the CALL'S OWN `runId` where it has
@@ -1558,6 +1660,12 @@ var AgentApprovalPortAdapter = class {
       approved: true,
       ...opts?.executedByRef !== void 0 ? {
         executedByRef: opts.executedByRef
+      } : {},
+      ...opts?.remember === true ? {
+        remember: true
+      } : {},
+      ...opts?.decidedVia !== void 0 ? {
+        decidedVia: opts.decidedVia
       } : {}
     });
   }
@@ -1569,6 +1677,9 @@ var AgentApprovalPortAdapter = class {
       } : {},
       ...opts?.reason !== void 0 ? {
         reason: opts.reason
+      } : {},
+      ...opts?.decidedVia !== void 0 ? {
+        decidedVia: opts.decidedVia
       } : {}
     });
   }
@@ -2488,6 +2599,8 @@ var MAX_ANSWERED_QUESTIONS = 100;
 var MAX_VALUES_PER_QUESTION = 100;
 var MAX_ANSWER_VALUE_LENGTH = 4096;
 var MAX_REJECT_REASON_LENGTH = 4096;
+var MAX_VIA_LENGTH = 64;
+var DEFAULT_VIA = "web";
 function toolCallId(claimed) {
   if (typeof claimed !== "string" || claimed.length === 0) {
     throw new import_common15.BadRequestException("toolCallId must be a non-empty string");
@@ -2508,6 +2621,26 @@ function rejectReason(claimed) {
   return claimed;
 }
 __name(rejectReason, "rejectReason");
+function remember(claimed) {
+  if (claimed === void 0) {
+    return false;
+  }
+  if (typeof claimed !== "boolean") {
+    throw new import_common15.BadRequestException("remember must be a boolean");
+  }
+  return claimed;
+}
+__name(remember, "remember");
+function via(claimed) {
+  if (claimed === void 0) {
+    return DEFAULT_VIA;
+  }
+  if (typeof claimed !== "string" || claimed.length === 0 || claimed.length > MAX_VIA_LENGTH) {
+    throw new import_common15.BadRequestException(`via must be a string of 1-${MAX_VIA_LENGTH} characters`);
+  }
+  return claimed;
+}
+__name(via, "via");
 function answers(claimed) {
   if (claimed === void 0) {
     return void 0;
@@ -2552,14 +2685,19 @@ var ToolCallController = class {
   }
   async approve(req, body) {
     const actor = await this.actorResolver.resolve(req);
-    await this.agent.approve(actor, toolCallId(body.toolCallId));
+    await this.agent.approve(actor, toolCallId(body.toolCallId), {
+      remember: remember(body.remember),
+      via: via(body.via)
+    });
     return {
       ok: true
     };
   }
   async reject(req, body) {
     const actor = await this.actorResolver.resolve(req);
-    await this.agent.reject(actor, toolCallId(body.toolCallId), rejectReason(body.reason));
+    await this.agent.reject(actor, toolCallId(body.toolCallId), rejectReason(body.reason), {
+      via: via(body.via)
+    });
     return {
       ok: true
     };
@@ -2625,7 +2763,7 @@ _ts_decorate15([
   _ts_metadata14("design:type", Function),
   _ts_metadata14("design:paramtypes", [
     typeof Request === "undefined" ? Object : Request,
-    typeof ApproveBody === "undefined" ? Object : ApproveBody
+    Object
   ]),
   _ts_metadata14("design:returntype", Promise)
 ], ToolCallController.prototype, "skip", null);
@@ -3370,6 +3508,36 @@ var InlineAgentRunner = class _InlineAgentRunner {
   * shape it is delivering — the loop asked for one and only ever gets what the caller sent. A
   * cancel settles the wait too, by rejecting it.
   */
+  /**
+  * {@link park} for an approval, bounded by the policy's time to live when it has one: the timer
+  * settles the wait as `expired` — the same Decision the durable runner builds from its signal
+  * timeout — and a decision that arrives first disarms it.
+  */
+  parkApproval(runId, toolCallId2, timeoutMs) {
+    const waiting = this.park(runId, toolCallId2);
+    if (timeoutMs === void 0) {
+      return waiting;
+    }
+    const key = `${runId}:${toolCallId2}`;
+    let timer;
+    const lapse = new Promise((resolve) => {
+      timer = setTimeout(() => {
+        const entry = this.pending.get(key);
+        if (entry !== void 0) {
+          this.pending.delete(key);
+          resolve({
+            approved: false,
+            expired: true
+          });
+        }
+      }, timeoutMs);
+      timer.unref?.();
+    });
+    return Promise.race([
+      waiting,
+      lapse
+    ]).finally(() => clearTimeout(timer));
+  }
   park(runId, toolCallId2) {
     return new Promise((resolve, reject) => {
       this.pending.set(`${runId}:${toolCallId2}`, {
@@ -3383,7 +3551,7 @@ var InlineAgentRunner = class _InlineAgentRunner {
     return {
       runId,
       openSink: /* @__PURE__ */ __name(() => deps.sink.open(runId), "openSink"),
-      awaitApproval: /* @__PURE__ */ __name((call) => this.park(runId, call.id), "awaitApproval"),
+      awaitApproval: /* @__PURE__ */ __name((call, _ctx, opts) => this.parkApproval(runId, call.id, opts?.timeoutMs), "awaitApproval"),
       awaitAnswers: /* @__PURE__ */ __name((request) => this.park(runId, request.id), "awaitAnswers"),
       step: /* @__PURE__ */ __name((_name, fn) => fn(), "step"),
       parallel: import_nestjs_agent_core22.settleAll,
@@ -3434,7 +3602,7 @@ var InlineAgentRunner = class _InlineAgentRunner {
     const hooks = {
       runId,
       openSink: /* @__PURE__ */ __name(() => deps.sink.open(runId), "openSink"),
-      awaitApproval: /* @__PURE__ */ __name((call) => this.park(runId, call.id), "awaitApproval"),
+      awaitApproval: /* @__PURE__ */ __name((call, _ctx, opts) => this.parkApproval(runId, call.id, opts?.timeoutMs), "awaitApproval"),
       awaitAnswers: /* @__PURE__ */ __name((request) => this.park(runId, request.id), "awaitAnswers"),
       step: /* @__PURE__ */ __name((_name, fn) => fn(), "step"),
       parallel: import_nestjs_agent_core22.settleAll,
@@ -3538,7 +3706,7 @@ var InlineAgentRunner = class _InlineAgentRunner {
       runId,
       // Forward into the top-level stream; the top-level run owns end/fail on that shared sink.
       openSink: /* @__PURE__ */ __name(async () => childSinkWriter(await deps.sink.open(sinkRunId)), "openSink"),
-      awaitApproval: /* @__PURE__ */ __name((call) => this.park(runId, call.id), "awaitApproval"),
+      awaitApproval: /* @__PURE__ */ __name((call, _ctx, opts) => this.parkApproval(runId, call.id, opts?.timeoutMs), "awaitApproval"),
       awaitAnswers: /* @__PURE__ */ __name((request) => this.park(runId, request.id), "awaitAnswers"),
       step: /* @__PURE__ */ __name((_name, fn) => fn(), "step"),
       parallel: import_nestjs_agent_core22.settleAll,