dashclaw 2.1.2 → 2.1.4

package/dashclaw.js

@@ -113,12 +113,34 @@ class DashClaw {
    */
   async waitForApproval(actionId, { timeout = 300000, interval = 5000 } = {}) {
     const startTime = Date.now();
+    let wasPending = false;
+
     while (Date.now() - startTime < timeout) {
       const { action } = await this._request(`/api/actions/${actionId}`, 'GET');
-      if (action.status === 'running' || action.status === 'completed') return action;
+      
+      if (action.status === 'pending_approval') {
+        wasPending = true;
+      }
+
+      // Explicitly unblocked by approval metadata
+      if (action.approved_by) return action;
+
+      // Denial cases
       if (action.status === 'failed' || action.status === 'cancelled') {
         throw new ApprovalDeniedError(action.error_message || 'Operator denied the action.', action.status);
       }
+
+      // Requirement 4: If an action leaves pending_approval without approval metadata, throw an error.
+      // This prevents "auto-approval" bugs where status is changed by non-approval paths.
+      if (wasPending && action.status !== 'pending_approval') {
+        throw new Error(`Action ${actionId} left pending_approval state without explicit approval metadata (Status: ${action.status})`);
+      }
+
+      // If allowed directly (never intercepted), return immediately
+      if (!wasPending && action.status === 'running') {
+        return { action };
+      }
+
       await new Promise(r => setTimeout(r, interval));
     }
     throw new Error(`Timed out waiting for approval of action ${actionId}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dashclaw",
-  "version": "2.1.2",
+  "version": "2.1.4",
   "description": "Minimal governance runtime for AI agents. Intercept, govern, and verify agent actions.",
   "type": "module",
   "publishConfig": {