taskwarden 0.2.0__tar.gz → 0.2.1__tar.gz

{taskwarden-0.2.0 → taskwarden-0.2.1}/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## 0.2.1 (2026-11-04)
+
+- An approved call is checked again before it runs, on what will really run: the gate (an
+  agent paused or a tool taken away while it waited gets `NOT_ALLOWED`, audited as
+  `no_longer_allowed`) and the tool's own `check`, on the owner's edits too (audited as
+  `precheck`). Before, only the tool's existence was checked at approval time.
+
 ## 0.2.0 (2026-11-04)
 
 New optional host hooks; a host without them behaves as in 0.1.0.

{taskwarden-0.2.0 → taskwarden-0.2.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: taskwarden
-Version: 0.2.0
+Version: 0.2.1
 Summary: A durable, owner-approved AI team for a business: agents as folders, tools by risk, owner approvals that survive restarts, on Postgres.
 Project-URL: Repository, https://github.com/dahoai/taskwarden
 Author: DAHO

{taskwarden-0.2.0 → taskwarden-0.2.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "taskwarden"
-version = "0.2.0"
+version = "0.2.1"
 description = "A durable, owner-approved AI team for a business: agents as folders, tools by risk, owner approvals that survive restarts, on Postgres."
 readme = "README.md"
 license = "Apache-2.0"

{taskwarden-0.2.0 → taskwarden-0.2.1}/taskwarden/__init__.py

@@ -6,4 +6,4 @@ call), decisions (the owner's approve / edit / decline), sweeper (background run
 columns), host (what the app supplies). See README.md.
 """
 
-__version__ = "0.2.0"
+__version__ = "0.2.1"

{taskwarden-0.2.0 → taskwarden-0.2.1}/taskwarden/decisions.py

@@ -11,6 +11,7 @@ from typing import Any, Optional
 
 from sqlalchemy import select, update
 
+from . import gate
 from .loop import MAYBE_SENT, pending_calls, tool_msg
 
 # What a parked call reads when the owner wrote in the chat instead of approving it.
@@ -19,6 +20,8 @@ REVISE_RESULT = ("Not done yet: the owner replied instead of approving: \"{chang
                  "something else, do that, and ask for this action again only if it still makes sense.")
 # A parked call whose tool no longer exists when the owner decides.
 GONE = "Not run: this action no longer exists. Say what you meant to do another way."
+# A parked call the agent may no longer make (paused, or the tool taken away while it waited).
+NOT_ALLOWED = "Not run: the owner approved it, but you may no longer do this. Say so in your report."
 # What the model reads before the result of a call the owner edited, so its report names
 # what really went out.
 EDITED = "The owner changed {fields} before approving, and it ran as changed. "
@@ -112,12 +115,27 @@ async def apply(host, db, organization_id: str, task: Any, decision: str, *,
         ctx, company = await host.context(db, organization_id)
         region = host.region(company)
         sent = set(task.contacted or [])
+        # Checked again now, on what will really run: the call may have waited days, and the
+        # owner's edits never went through the check made when it was parked.
+        agent = host.for_business(host.agent(task.agent_id), company.get("business_type"))
+        state = (await host.agent_states(db, organization_id)).get(agent.id, host.default_state())
     for call, run, changed in zip(calls, runs, changes):
         tool = host.tools.get(call["tool"])
         if tool is None:  # renamed or removed while it waited for the owner
             results.append(tool_msg(call.get("tool_call_id", ""), GONE))
             continue
         if run:
+            refusal, rule = None, None
+            if host.decide(agent, tool, state, self_started=False).outcome == gate.DENY:
+                refusal, rule = NOT_ALLOWED, "no_longer_allowed"
+            elif tool.check is not None:
+                refusal, rule = await host.precheck(tool, ctx, call.get("args") or {}), "precheck"
+            if refusal:
+                host.audit(db, organization_id=organization_id, agent_id=task.agent_id,
+                           tool=call["tool"], risk=tool.risk, decision="deny", rule=rule,
+                           task_id=task.id, actor="owner")
+                results.append(tool_msg(call.get("tool_call_id", ""), refusal))
+                continue
             key = host.sent_key(call["tool"], call.get("args") or {}, region)
             if key is not None:
                 # Saved before it runs, as in the loop: a crash mid-send must not lead to a

{taskwarden-0.2.0 → taskwarden-0.2.1}/tests/test_taskwarden.py

@@ -297,6 +297,36 @@ async def test_an_edited_approval_runs_as_edited_and_the_agent_is_told():
     assert json.loads(host.posted[-1]["body"])["calls"][0]["args"] == {"order_id": "A8"}
 
 
+async def _park_refund(host):
+    task, db = _task(), _db()
+    assert await loop.run_task(host, db, task, llm=(_llm(Msg(calls=[("refund", {"order_id": "A7"})])), "m")) == "waiting"
+    db.execute = AsyncMock(return_value=SimpleNamespace(scalar_one_or_none=lambda: task))
+    host.execute = AsyncMock(side_effect=AssertionError("must not run"))
+    host.audit = MagicMock()
+    return task, db
+
+
+async def test_an_approval_is_checked_again_on_the_args_the_owner_edited():
+    host = ShopHost()
+    host.tools["refund"] = replace(host.tools["refund"], check=AsyncMock())
+    host.precheck = AsyncMock(side_effect=lambda tool, ctx, args:
+                              "Order A8 was already refunded." if args["order_id"] == "A8" else None)
+    task, db = await _park_refund(host)
+    await decisions.apply(host, db, "shop1", task, "approve", edited_args={"c0": {"order_id": "A8"}})
+    assert {"role": "tool", "tool_call_id": "c0", "content": "Order A8 was already refunded."} in task.state
+    assert host.audit.call_args.kwargs["rule"] == "precheck"
+
+
+async def test_an_approval_for_an_agent_paused_while_it_waited_does_not_run():
+    host = ShopHost()
+    task, db = await _park_refund(host)
+    host.agent_states = AsyncMock(return_value={"lead": gate.AgentState(paused=True)})
+    await decisions.apply(host, db, "shop1", task, "approve")
+    assert {"role": "tool", "tool_call_id": "c0", "content": decisions.NOT_ALLOWED} in task.state
+    assert host.audit.call_args.kwargs["rule"] == "no_longer_allowed"
+    assert task.status == "queued"  # the agent reads why and reports
+
+
 # ── A long run sheds its old tool results before it is made to wrap up ──
 
 def test_old_results_are_cut_to_their_opening_and_the_latest_stay_whole():