nanoclaw

mirror of https://github.com/qwibitai/nanoclaw.git synced 2026-07-06 18:52:03 +08:00

Files

T

gavrielc b24bf2c6f7 feat(approvals): reject-with-reason on OneCLI credential cards

Extends the reject-with-reason capture flow (previously module-initiated
approvals only) to OneCLI credential cards. The OneCLI SDK decision wire
carries only 'approve' | 'deny', so a reason can never reach the gateway —
instead the gateway decision is HELD open while the admin types the reason,
the reason is dropped into the session workspace, and the agent-runner's
PostToolUse hook injects it into the failed tool call's context. The agent
sees one coherent event: its gateway call fails carrying the admin's reason.

- primitive.ts: action-keyed reason-reject finalizer registry so an action
  can override the default chat-message relay.
- reason-capture.ts: dispatch through the registry; resolve sessions via
  agent_group_id fallback (OneCLI rows carry no session_id).
- response-handler.ts: on "Reject with reason…" for a OneCLI card, hold the
  in-memory decision and arm reason capture instead of resolving.
- onecli-approvals.ts: third card option; heldForReason state; TTL timer
  keeps the awaiting_reason row alive as the safety valve; approval-resolved
  handler releases a still-held deny after any fallback finalizeReject.
- finalize.ts: describe OneCLI rejects to the agent as "credential request
  to <host>" instead of the internal action key.
- agent-runner claude.ts: PostToolUse/PostToolUseFailure hook consumes
  /workspace/onecli-rejection.json (failure-shaped results only, single-use,
  10-min freshness) and returns the reason as additionalContext.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-07-04 16:06:31 +03:00