hugocasaandClaude Opus 5.5 a1bc9ec0c2 feat: tool approval and a question tool for ai agent steps (#11826) ...

* feat(ai-agent): built-in approval tool that parks the agent

An AI agent step can now be given a built-in "Request approval" tool. The model
calls `request_approval` with a message; the agent stores its conversation in
the new `ai_agent_checkpoint` table, releases its worker by parking its own
queue row like a workflow-as-code parent, and resumes with the answer (approved,
approver, comment) or a timeout once someone answers from the run page.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* fix(ai-agent): tie approval answers to their request and hold the turn

- A turn that asks for approval runs none of its other calls; they are refused
  so the model repeats them after the answer.
- The run page sends the request's call id. An answer naming another request is
  ignored and the agent parks again for the time left; `suspend` is zeroed when
  the answer is read, so answers sent while the agent runs are refused.
- The checkpoint is read whatever the current roster holds, the answer's
  outcome is written by position, and a cancel that beats the park completes
  the job as cancelled.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* fix(ai-agent): say why calls beside an invalid approval request were refused

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* fix(ai-agent): one approval form per request, none on a finished run

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* feat(ai-agent): answer approval requests from a flow's chat

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* fix(ai-agent): show chat approvals for agents that do not stream

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* feat(ai-agent): approval as a per-tool setting, built-in tool asks a question

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* fix(ai-agent): say when a nested agent leaves out tools that require approval

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* feat(ai-agent): show chat approvals and questions on the tool's own card

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* feat(ai-agent): question choices, and approval buttons shared with approval steps

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* feat(ai-agent): show a waiting agent as suspended, and refused calls as not run

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* fix(ai-agent): each added chat card shows its own call, answered marker keyed by job

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* test(ai-agent): approve and reject a held call through resume_suspended

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* feat(ai-agent): require approval in a tool settings tab, plain descriptions on built-in tool panes

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* fix(ai-agent): sentence case for the web search tool label

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* feat(ai-agent): built-in tool drawers explain themselves in the header subtitle

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* fix(ai-agent): clearer question tool subtitle

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* fix(ai-agent): badge the tool settings tab like run settings

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* chore(ai-agent): regenerate system prompts and MCP session files

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-26 19:22:45 +01:00

..

fixtures

fix(worker): render TEMP_SCRIPT_REFS placeholder in Python runner-group loader.py (#11915)

2026-10-21 13:29:55 +02:00

scripts

feat: add sandbox annotations, volume mounts, for AI sandbox starting with claude (#8058)

2026-03-05 06:19:51 +00:00

agent_workers.rs

perf: reduce shared worker debug polling frames (#11028)

2026-09-08 15:21:10 +02:00

ai_agent_approval.rs

feat: tool approval and a question tool for ai agent steps (#11826)

2026-10-26 19:22:45 +01:00

ai_agent_linked.rs

feat: let flow builder operators build AI agents (#11898)

2026-10-23 15:05:20 +02:00

ai_agent_nul.rs

fix: strip NUL from ai agent output and job args before jsonb writes (#11568)

2026-10-06 17:51:07 +02:00

ai_decision.rs

feat: stop offering deno for new scripts, ship it only on full images (#11648)

2026-10-09 19:15:08 +02:00

ai_sessions.rs

fix: encrypt ai session backups with aes-256-gcm (#11734)

2026-10-13 23:12:48 +02:00

ai_shared_artifacts.rs

feat(ai-sessions): share session artifacts with the workspace by link (#11115)

2026-09-14 22:46:26 +02:00

ai_shared_sessions.rs

feat: share AI sessions read-only by link, optionally public (#11799)

2026-10-15 18:51:11 +02:00

ai_tool_queue.rs

feat: dispatch ai agent tools through the worker queue (#11227)

2026-09-29 22:30:50 +02:00

app_access_mode_only.rs

fix: change an app's access mode under the deploy row lock (#11965)

2026-10-23 14:49:05 +02:00

app_anonymous_execution_mode.rs

fix: make on_behalf_of control permissions for scripts and flows (#10438)

2026-08-01 20:37:21 +02:00

app_ctx_inputs.rs

fix: fill app ctx inputs from the viewer's session, not the request (#11698)

2026-10-12 16:47:59 +00:00

app_custom_path_cross_workspace.rs

fix: actionable error when a custom_path is taken by an app in another workspace (#9190)

2026-05-16 08:29:53 +00:00

app_guest_allowance.rs

feat: guest app execution mode, a role that takes no seat (#10929)

2026-09-04 22:47:28 +02:00

app_guest_cloud_hosted.rs

feat: make guest access unavailable on the shared cloud (#11040)

2026-09-09 11:19:49 +02:00

app_guest_execution_mode.rs

perf: skip the flow_env ancestor walk for sub-flows with nothing to inherit (#11349)

2026-09-25 10:30:43 +00:00

app_guest_jwt_allowance.rs

feat: guest JWT entry for embedded apps (#10954)

2026-09-05 10:23:37 +00:00

app_guest_jwt_entry.rs

feat: guest JWT entry for embedded apps (#10954)

2026-09-05 10:23:37 +00:00

app_preview_auth.rs

feat: configurable workspace roles with per-workspace overrides (#11821)

2026-10-21 15:51:54 +02:00

app_publisher_permit.rs

stop caching app permit refusals and expire grants after 60s (#11726)

2026-10-13 13:22:58 +00:00

app_run_mode_lock_strip.rs

chore: normalize NUL escapes in job args before name-based checks (#11989)

2026-10-23 16:41:05 -07:00

app_s3_onbehalf.rs

fix: make on_behalf_of control permissions for scripts and flows (#10438)

2026-08-01 20:37:21 +02:00

app_version_order.rs

feat: drafts follow their item through a move; behind means base ≠ head (#10577)

2026-09-18 20:54:23 +02:00

asset_trigger_dispatch.rs

feat: restricted job tokens per script and flow (#11484)

2026-10-03 09:33:44 +02:00

audit_rls.rs

fix: stop audit inserts from silently rolling back saves (#11938)

2026-10-22 17:15:05 +02:00

batch_rerun.rs

feat: resolve canceled jobs and re-run them in limited batches (#11797)

2026-10-15 18:19:23 +02:00

bun_jobs.rs

feat: restricted job tokens per script and flow (#11484)

2026-10-03 09:33:44 +02:00

caller_modules_strip.rs

chore: normalize NUL escapes in job args before name-based checks (#11989)

2026-10-23 16:41:05 -07:00

capture_cross_workspace.rs

fix: scope capture deletion to the workspace in the request path (#10795)

2026-08-22 10:01:25 +00:00

ci_tests.rs

feat: Db-backed user drafts (#9351)

2026-06-15 10:23:16 +02:00

datatable_fork_migrations.rs

test: point the fork migrations test's DATABASE_URL at its own database (#11759)

2026-10-14 10:51:10 +00:00

datatable_instance_pg_disabled.rs

feat: data table cards and a managed-first add wizard (#11419)

2026-09-29 20:26:23 +02:00

datatable_migration_add_down.rs

let a legacy migration whose comment reads like a scope get a down (#11765)

2026-10-14 11:47:21 +00:00

datatable_migrations_grants.rs

fix: surface the real postgres error when data table migrations fail (#10371)

2026-07-28 14:29:06 +02:00

debounce_e2e.rs

feat: stop offering deno for new scripts, ship it only on full images (#11648)

2026-10-09 19:15:08 +02:00

dedicated_workers.rs

fix(worker): render TEMP_SCRIPT_REFS placeholder in Python runner-group loader.py (#11915)

2026-10-21 13:29:55 +02:00

delete_after_secs.rs

feat: add scheduled job deletion with configurable retention period (#8753)

2026-04-08 04:15:28 +00:00

deleted_script_version.rs

fix: stop running deleted script versions from worker caches (#11456)

2026-10-01 13:37:00 +02:00

dependency_job_tag.rs

feat: restricted job tokens per script and flow (#11484)

2026-10-03 09:33:44 +02:00

dependency_map.rs

fix: change an app's access mode under the deploy row lock (#11965)

2026-10-23 14:49:05 +02:00

dev_workspace_tag_suffix.rs

[ee] feat: add a toggle to not isolate forks of non-dev workspaces (#11830)

2026-10-16 20:32:59 +02:00

drafts_delete_for_user.rs

feat: let workspace admins delete other users' drafts (#11644)

2026-10-09 16:31:07 +02:00

drafts_move_mirror.rs

feat: drafts follow their item through a move; behind means base ≠ head (#10577)

2026-09-18 20:54:23 +02:00

drafts_move_taken.rs

feat: drafts follow their item through a move; behind means base ≠ head (#10577)

2026-09-18 20:54:23 +02:00

drafts_nul.rs

feat: drafts follow their item through a move; behind means base ≠ head (#10577)

2026-09-18 20:54:23 +02:00

drafts_save_follows_move.rs

feat: drafts follow their item through a move; behind means base ≠ head (#10577)

2026-09-18 20:54:23 +02:00

end_user_email.rs

test: fix backend integration tests broken since #11777 (#11791)

2026-10-15 16:23:12 +02:00

flow_conversation_running_turn.rs

feat: agents run on behalf of their deployer (#11430)

2026-10-15 19:31:21 +02:00

flow_engine_parity.rs

feat: stop offering deno for new scripts, ship it only on full images (#11648)

2026-10-09 19:15:08 +02:00

flow_step_completion_ping.rs

fix: complete a canceled flow whose worker died between two steps (#11366)

2026-09-26 14:40:01 +02:00

folder_default_permissioned_as.rs

fix: keep script and flow deploys off a second pool connection (#11843)

2026-10-17 08:29:57 +00:00

fork_deployment_requests.rs

feat: add deploy restriction rule and fork review requests (#8804)

2026-04-13 17:10:37 +00:00

freshness_watchdog.rs

feat(pipelines): asset freshness — fresh/stale badge (CE) + watchdog (EE) (#9909)

2026-07-04 06:23:44 +02:00

git_sync_autopull_identity.rs

fix: run unstamped git auto-pulls as a superadmin when no admin (#11973)

2026-10-23 15:37:40 +02:00

git_sync_autopull_recovery.rs

fix: clear a stale git auto-pull failure and show the status time (#11100)

2026-09-12 08:55:35 +02:00

git_sync_fork_credential.rs

fix: walk the whole fork ancestry for app installations and fork conflicts (#11151)

2026-09-16 10:45:34 +02:00

inline_preview_auth.rs

feat: configurable workspace roles with per-workspace overrides (#11821)

2026-10-21 15:51:54 +02:00

instance_config.rs

feat: route dev workspace and fork jobs to their own worker groups (#11811)

2026-10-16 18:47:41 +02:00

job_payload.rs

feat: stop offering deno for new scripts, ship it only on full images (#11648)

2026-10-09 19:15:08 +02:00

job_provenance.rs

feat: add trigger, tag, run-as and digest claims to job OIDC tokens (#11481)

2026-10-02 19:02:17 +02:00

job_s3_viewer_data_access.rs

feat: read data as the job's identity, viewer is opt-in per runnable (#11744)

2026-10-14 00:05:52 +02:00

job_token_log_masking.rs

fix: register the job token with the sensitive log masking system (#10943)

2026-09-18 15:15:02 +02:00

job_token_scopes.rs

fix: emit a single email claim in job OIDC tokens (#11804)

2026-10-16 09:24:51 +02:00

jobs_cross_site_get.rs

fix: refuse cross-site GET requests that run Hub scripts (#11054)

2026-09-10 13:14:37 +00:00

jobs_read_auth.rs

feat: add a jobs:run:dependencies token scope for lock generation (#11643)

2026-10-09 19:13:48 +02:00

list_jobs.rs

feat: restricted job tokens per script and flow (#11484)

2026-10-03 09:33:44 +02:00

list_scripts_parent_hash.rs

fix: make the listScripts parent_hash filter valid SQL (#10752)

2026-08-18 18:22:03 +02:00

mcp_header_var_refs.rs

fix: hold mcp token references to resource reference scopes (#11803)

2026-10-16 17:28:29 +02:00

mcp_resource_authz.rs

fix: resolve variables in the url and headers of an mcp resource (#11680)

2026-10-13 13:52:55 +00:00

mcp_token_exfil.rs

feat: let the global AI chat call connected MCP servers as the user (#10656)

2026-08-14 18:51:19 +02:00

nativets_dedicated.rs

feat(nativets): bound fetch on a peer that never answers (#11026)

2026-09-08 16:46:12 +02:00

nativets_jobs.rs

fix(jobs): sanitize NUL in completed job result before jsonb insert (#10274)

2026-07-23 10:39:38 +02:00

nativets_stress.rs

feat: restricted job tokens per script and flow (#11484)

2026-10-03 09:33:44 +02:00

object_storage_test_ssrf.rs

fix: apply object-storage test SSRF validation to all non-super-admins (#10933)

2026-09-02 22:29:01 +02:00

on_behalf_of.rs

fix: make on_behalf_of control permissions for scripts and flows (#10438)

2026-08-01 20:37:21 +02:00

operator_db_sync.rs

fix: add secretKeyRef support for jwt_secret and rsa_keys (#8698)

2026-04-03 18:17:27 +00:00

otel.rs

feat: export worker cpu, memory and occupancy metrics (#11629)

2026-10-08 22:17:44 +02:00

path_autocomplete_scope.rs

fix: list only the paths the caller can read in path autocomplete (#11388)

2026-09-28 17:55:16 +02:00

perpetual_cancel_race.rs

fix: keep a cancel that lands after a worker last read its queue row (#11246)

2026-09-22 11:03:30 +00:00

perpetual_deploy_restart.rs

feat: restart perpetual runs on the version a deploy makes runnable (#11200)

2026-09-29 18:03:43 +02:00

pool_hold_and_wait.rs

fix: stop holding a pool connection while waiting for another (#11902)

2026-10-20 19:11:46 +02:00

postgres_trigger_scope.rs

feat: guest JWT entry for embedded apps (#10954)

2026-09-05 10:23:37 +00:00

preserve_on_behalf_of.rs

refactor: make the app policy's principal the authority for its identity (#10440)

2026-09-12 09:10:15 +02:00

preview_native_tag.rs

feat: restricted job tokens per script and flow (#11484)

2026-10-03 09:33:44 +02:00

preview_restart_source_access.rs

fix: refuse flow preview restarts from runs the caller cannot read (#11407)

2026-09-29 14:46:51 +02:00

protection_rules.rs

fix the protection rules race and the Windows nsjail profile test (#11835)

2026-10-16 23:34:40 +02:00

push_pool_connections.rs

fix: write a push's runnable settings before it opens its transaction (#11897)

2026-10-20 18:31:38 +02:00

python_jobs.rs

fix: python results with a KeyError-raising __getattr__ fail the job (#11517)

2026-10-05 08:20:52 +02:00

raw_app_missing_css.rs

fix: raw apps with no stylesheet were permanently un-deployable (#10364)

2026-07-27 22:32:57 +02:00

raw_apps_list_scope.rs

fix: enforce token path scopes on GET /raw_apps/list (#11284)

2026-09-22 08:13:58 +00:00

relock_noop.rs

fix: relock apps in place so imported script changes reach them (#11789)

2026-10-15 16:27:41 +02:00

relock_skip.rs

fix: deploy a relocked script version only when its lock changed (#10966)

2026-09-04 01:01:36 +02:00

reserved_control_args.rs

chore: normalize NUL escapes in job args before name-based checks (#11989)

2026-10-23 16:41:05 -07:00

resource_versioning.rs

feat: version resource values with history, diff and restore (#10596)

2026-08-10 21:32:18 +02:00

restart_at_step_api.rs

feat: stop offering deno for new scripts, ship it only on full images (#11648)

2026-10-09 19:15:08 +02:00

restart_flow_version_scope.rs

feat: restricted job tokens per script and flow (#11484)

2026-10-03 09:33:44 +02:00

retry.rs

feat: stop offering deno for new scripts, ship it only on full images (#11648)

2026-10-09 19:15:08 +02:00

run_lineage_auth.rs

fix: only let a job's own token claim run lineage (#11367)

2026-09-27 14:09:59 +00:00

runnables_list_pagination.rs

fix: home search matches each term instead of the whole query verbatim (#10663)

2026-08-12 21:10:56 +02:00

runnables_owner_counts.rs

feat: show per-owner runnable counts in the homepage tree (WIN-2253) (#10351)

2026-07-27 14:57:54 +02:00

s3_proxy_headers.rs

fix: serve s3 proxy objects with nosniff and a sandbox csp (#11731)

2026-10-13 15:52:25 +00:00

schedule_fork_conflict.rs

fix: walk the whole fork ancestry for app installations and fork conflicts (#11151)

2026-09-16 10:45:34 +02:00

script_auto_kind_failure.rs

feat: Db-backed user drafts (#9351)

2026-06-15 10:23:16 +02:00

script_auto_parent_archived.rs

fix: chain redeploys onto a retired path's version history (#11029)

2026-09-08 17:44:22 +02:00

script_modules.rs

fix: keep pinned import versions of imported scripts in bun lockfiles (#11082)

2026-09-11 08:48:02 +00:00

script_rename_clears_assets.rs

fix: clear old path asset usage when renaming a script (#9979)

2026-07-07 14:23:31 +02:00

script_schema_inference.rs

feat: infer a script's schema when a deploy (e.g. MCP) sends none (#11339)

2026-09-25 10:00:49 +00:00

session_workspace_status.rs

feat: delete a browser's copy of an AI session past its workspace retention (#11156)

2026-09-16 09:57:43 +02:00

sign_s3_objects_authz.rs

feat: configurable expiry for presigned s3 public url signatures (#10835)

2026-08-26 00:47:24 +02:00

suspend_resume.rs

feat: stop offering deno for new scripts, ship it only on full images (#11648)

2026-10-09 19:15:08 +02:00

suspended_pull_index.rs

perf: index the suspended-job resume test instead of filtering it (#10863)

2026-08-27 00:39:03 +02:00

trigger_listener_queries.rs

feat: guest JWT entry for embedded apps (#10954)

2026-09-05 10:23:37 +00:00

untrusted_interpolation.rs

[ee] fix: stop handlers, apps and agents resolving untrusted refs (#11893)

2026-10-21 10:19:20 +02:00

v2_job_delete_orphans.rs

fix: scope delete_jobs side-table deletes to the request workspace (#11836)

2026-10-17 09:32:01 +02:00

variable_expiration.rs

feat: run a workspace handler when a variable's value expires (#10837)

2026-10-23 18:12:55 +02:00

volume_tests.rs

perf: reduce shared worker debug polling frames (#11028)

2026-09-08 15:21:10 +02:00

wac_approval_resume.rs

feat: bind WAC approval urls to a named wait_for_approval step (#10317)

2026-07-25 11:41:48 +02:00

wac_approval_urls.rs

fix: scope flow resume to its workspace and minting to the job's run (#11392)

2026-09-28 18:31:44 +02:00

wac_child_completion_wakes_parent.rs

fix: wake a WAC parent from every path that completes its child (#11119)

2026-09-14 18:51:21 +00:00

wac_suspend_started_at.rs

fix: store a WAC parent's first start and wall duration (#11625)

2026-10-08 18:05:37 +02:00

wm_token_confinement.rs

fix: let Teams handlers post with job tokens again (#11792)

2026-10-15 16:41:21 +02:00

worker_group_pause.rs

feat: pause a worker group without stopping its workers (#11596)

2026-10-07 17:28:29 +00:00

worker_ping_ip.rs

feat: let a job see that its worker is draining (#11612)

2026-10-08 12:56:33 +02:00

worker.rs

test: drain pg arg and custom type cases on one worker (#11849)

2026-10-17 22:14:32 +02:00

workspace_dependencies.rs

test: stop backend tests waiting out real time they do not need (#11851)

2026-10-17 22:11:29 +02:00

workspace_encryption_key_scope.rs

fix: require an unscoped token to reach the workspace encryption key (#10798)

2026-08-22 09:55:44 +00:00

workspace_export.rs

feat: run a workspace handler when a variable's value expires (#10837)

2026-10-23 18:12:55 +02:00

workspace_fairness.rs

fix: stop audit inserts from silently rolling back saves (#11938)

2026-10-22 17:15:05 +02:00

workspace_handlers.rs

test: fix error handler test flake and merge handler test binaries (#11850)

2026-10-17 22:04:45 +02:00

workspace_storage_by_name.rs

fix: name the requested storage when a workspace storage lookup finds nothing (#10803)

2026-08-22 09:50:30 +00:00

ws_specific.rs

fix: stop a resource delete from taking variables it does not own (#11102)

2026-09-12 10:02:52 +02:00

zombie_flow_recovery.rs

feat: stop offering deno for new scripts, ship it only on full images (#11648)

2026-10-09 19:15:08 +02:00