Skip to content

fix(copilot): require approval for run_block and run_from_block - #9573

Merged
waleedlatif1 merged 1 commit into
stagingfrom
fix/run-block-approval-gate
Nov 2, 2026
Merged

waleedlatif1 merged 1 commit into
stagingfrom
fix/run-block-approval-gate

Conversation

@waleedlatif1

@waleedlatif1 waleedlatif1 commented Nov 2, 2026 •

Copy link
Copy Markdown
Collaborator

Summary

  • Flag run_block and run_from_block as requiresApproval in the generated tool catalog, so all four workflow run tools draw the approval card
  • The gate (toolCallNeedsApproval) is a pure catalog lookup; without the flag an agent steered into run_from_block ran everything downstream of its start block, or ran a Function block it had just added with edit_workflow, with no approval decision
  • Applied the exact two-line generator delta rather than a full mship-tools:generate, which would pull in unrelated in-flight catalog drift
  • New invariant test: every tool in WORKFLOW_TOOL_NAMES carries requiresApproval, so a re-sync that drops the flag fails CI
  • Source of truth fixed in simstudioai/mothership#899

Type of Change

  • Bug fix

Testing

  • New test fails on the pre-fix catalog (lists exactly run_block, run_from_block), passes after
  • permission.test.ts, router.test.ts, run-tool-execution.test.ts, copilot/confirm/route.test.ts, async-runs/repository.test.ts, run-workflow-result-budget.test.ts, request/handlers, tool-executor, copilot/tools suites: 269 + 38 passing
  • Existing "every gated tool renders an answerable row" invariant still passes (neither tool is hidden or internal)
  • bun run lint clean; type-check, check:audits, and the full suite left to CI

Checklist

  • Code follows project style guidelines
  • Self-reviewed my changes
  • Tests added/updated and passing (new tests pass the test-audit authoring gate)
  • No new warnings introduced
  • I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

Companion: simstudioai/mothership#899

All four workflow run tools reach the same executor, but the catalog only
gated run_workflow and run_workflow_until_block. The approval gate is a pure
catalog lookup, so an agent steered into run_from_block (which runs every
block downstream of its start) or run_block executed the workflow with no
approval card. Flag both siblings and assert every tool in
WORKFLOW_TOOL_NAMES carries requiresApproval.
@vercel

vercel Bot commented Nov 2, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment
Project Deployment Actions Updated
docs Skipped Skipped Nov 2, 2026 8:16pm UTC

Request Review

@cubic-dev-ai cubic-dev-ai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No issues found across 2 files

Confidence score: 5/5

  • Automated review surfaced no issues in the provided summaries.
  • No files require special attention.

Turn on auto-fix | Re-trigger cubic

@github-actions github-actions Bot added the requires-mothership-merge Has a companion PR on the mothership/copilot side — merge in lockstep label Nov 2, 2026
@github-actions

github-actions Bot commented Nov 2, 2026

Copy link
Copy Markdown

⚠️ Cross-repo companion check

One or more companion PRs aren't merged into staging yet. Merging this without them will leave copilot and sim out of sync — merge them in lockstep.

  • ❌ simstudioai/mothership#899 — OPEN, not merged (targets staging) — fix(catalog): require approval for run_block and run_from_block

@greptile-apps

greptile-apps Bot commented Nov 2, 2026 •

Copy link
Copy Markdown
Contributor

RetriggerView in GreptileConfidence Score: 5/5

[Medium impact] This PR appears safe to merge.

Summary

Adds approval prompts for run_block and run_from_block, matching the other workflow run tools.

  • Block-based workflow runs now wait for approval.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Workflow tool call] --> B{Approval needed?}
  B -->|No| E[Start execution]
  B -->|Yes| C[Show approval card]
  C --> D{User decision}
  D -->|Allow| E
  D -->|Skip or timeout| F[Finish without running]
Loading

Reviews (1) · Last reviewed commit: "fix(copilot): require approval for run_b..." · Reviewed by Greptile

@waleedlatif1
waleedlatif1 merged commit a041519 into staging Nov 2, 2026
73 checks passed
@waleedlatif1
waleedlatif1 deleted the fix/run-block-approval-gate branch November 2, 2026 23:26

This branch was previously deployed

1 inactive deployment
Preview — a6d782eb Deployed Nov 2, 2026 by vercel[bot]
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

requires-mothership-merge Has a companion PR on the mothership/copilot side — merge in lockstep

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant