end: add approval policy schema - #807
heerambavi1998 wants to merge 3 commits into
Conversation
🦋 Changeset detectedLatest commit: b981228 The changes in this PR will be included in the next version bump. This PR includes changesets to release 4 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
| "UserToolApprovalPolicyStreamEvent": { | ||
| "allOf": [ | ||
| { | ||
| "$ref": "#/components/schemas/UserToolApprovalPolicyEvent" | ||
| }, | ||
| { | ||
| "properties": { | ||
| "created_at": { | ||
| "description": "ISO 8601 event timestamp.", | ||
| "type": "string" | ||
| }, | ||
| "id": { |
| .object({ | ||
| server: z.string().min(1, 'server is required').describe('MCP server name the tool belongs to.'), | ||
| tool_name: z.string().min(1, 'tool_name is required').describe('Tool name this policy applies to.'), | ||
| action: z.discriminatedUnion('type', [ToolApprovalPolicyAllowSessionSchema]), |
There was a problem hiding this comment.
Single-variant action union
Low Severity
The action field is a one-member discriminatedUnion on type. That emits a single-variant oneOf instead of a flat object alias, which new wire schemas avoid until a second action variant exists.
Triggered by project rule: @truefoundry/trueforge review rules
Reviewed by Cursor Bugbot for commit f2e3aa5. Configure here.
f2e3aa5 to
b981228
Compare
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.
There are 2 total unresolved issues (including 1 from previous review).
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit b981228. Configure here.
| "@truefoundry/trueforge-sdk": patch | ||
| --- | ||
|
|
||
| Regenerate SDK from updated OpenAPI spec. |
There was a problem hiding this comment.
SDK changeset without SDK regen
Low Severity
This changeset bumps @truefoundry/trueforge-sdk for an OpenAPI regen that is not in the PR. The new send-event schema is not wired to a route, and neither openapi.json nor the SDK were regenerated, so merge would publish an empty SDK patch.
Triggered by project rule: TrueForge review rules
Reviewed by Cursor Bugbot for commit b981228. Configure here.
2 participants
Summary
add approval policy event schema.
Changes
How was this tested?
NA
Checklist
pnpm build,pnpm test,pnpm typecheck,pnpm lint:ci, andpnpm format:checkpass locallypackages/trueforge-sdk,python/trueforge_sdk,.github/fern/openapi/openapi.json,docs/openapi.json) — fork PRs omit SDK regen; maintainers regenerate after merge.env.exampleupdated if configuration or behavior changedNote
Low Risk
Schema and OpenAPI-only additions with no harness runtime behavior in this PR; approval-related wire format is extended but not executed here.
Overview
Introduces a send-only client inbound event
user.tool_approval_policyfor sticky tool-approval rules, alongside existing per-calluser.tool_approval/user.tool_responseon session send (POST …/sessions/{id}/events).The payload is a list of
(server, tool_name)entries whose action isallow_session, with an optional ISOexpire_atfor time-bounded session allows. It follows the same pattern as other HITL resume messages: validated on send, not added to the durableAgentOutputEventstream.Session send OpenAPI expands the inbound item union to accept the new type (OpenAPI name
SendTurnEventItem), with docs updated to distinguish tip HITL vs sticky policies. Publictrueforge-coreexports include the new schema and types. Changesets note a follow-up SDK regen from the updated OpenAPI spec.Reviewed by Cursor Bugbot for commit b981228. Bugbot is set up for automated code reviews on this repo. Configure here.