Skip to content

Commit 013ba5d

Browse files
Guardiola31337Guardiola31337
committed
feat(agentkit): add World HITL approvals
1 parent 8859e89 commit 013ba5d

108 files changed

Lines changed: 11120 additions & 132 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/labeler.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -252,6 +252,10 @@
252252
- changed-files:
253253
- any-glob-to-any-file:
254254
- "extensions/copilot-proxy/**"
255+
"extensions: agentkit":
256+
- changed-files:
257+
- any-glob-to-any-file:
258+
- "extensions/agentkit/**"
255259
"extensions: diagnostics-otel":
256260
- changed-files:
257261
- any-glob-to-any-file:

‎apps/shared/OpenClawKit/Sources/OpenClawProtocol/GatewayModels.swift‎

Lines changed: 51 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -5629,71 +5629,79 @@ public struct ExecApprovalResolveParams: Codable, Sendable {
56295629
}
56305630

56315631
public struct PluginApprovalRequestParams: Codable, Sendable {
5632+
public let actions: [[String: AnyCodable]]?
5633+
public let alloweddecisions: [String]?
56325634
public let pluginid: String?
56335635
public let title: String
56345636
public let description: String
56355637
public let severity: String?
56365638
public let toolname: String?
56375639
public let toolcallid: String?
5638-
public let alloweddecisions: [String]?
56395640
public let agentid: String?
56405641
public let sessionkey: String?
56415642
public let turnsourcechannel: String?
56425643
public let turnsourceto: String?
56435644
public let turnsourceaccountid: String?
56445645
public let turnsourcethreadid: AnyCodable?
56455646
public let timeoutms: Int?
5647+
public let keeppendingwithoutroute: Bool?
56465648
public let twophase: Bool?
56475649

56485650
public init(
5651+
actions: [[String: AnyCodable]]?,
5652+
alloweddecisions: [String]?,
56495653
pluginid: String?,
56505654
title: String,
56515655
description: String,
56525656
severity: String?,
56535657
toolname: String?,
56545658
toolcallid: String?,
5655-
alloweddecisions: [String]?,
56565659
agentid: String?,
56575660
sessionkey: String?,
56585661
turnsourcechannel: String?,
56595662
turnsourceto: String?,
56605663
turnsourceaccountid: String?,
56615664
turnsourcethreadid: AnyCodable?,
56625665
timeoutms: Int?,
5666+
keeppendingwithoutroute: Bool?,
56635667
twophase: Bool?)
56645668
{
5669+
self.actions = actions
5670+
self.alloweddecisions = alloweddecisions
56655671
self.pluginid = pluginid
56665672
self.title = title
56675673
self.description = description
56685674
self.severity = severity
56695675
self.toolname = toolname
56705676
self.toolcallid = toolcallid
5671-
self.alloweddecisions = alloweddecisions
56725677
self.agentid = agentid
56735678
self.sessionkey = sessionkey
56745679
self.turnsourcechannel = turnsourcechannel
56755680
self.turnsourceto = turnsourceto
56765681
self.turnsourceaccountid = turnsourceaccountid
56775682
self.turnsourcethreadid = turnsourcethreadid
56785683
self.timeoutms = timeoutms
5684+
self.keeppendingwithoutroute = keeppendingwithoutroute
56795685
self.twophase = twophase
56805686
}
56815687

56825688
private enum CodingKeys: String, CodingKey {
5689+
case actions
5690+
case alloweddecisions = "allowedDecisions"
56835691
case pluginid = "pluginId"
56845692
case title
56855693
case description
56865694
case severity
56875695
case toolname = "toolName"
56885696
case toolcallid = "toolCallId"
5689-
case alloweddecisions = "allowedDecisions"
56905697
case agentid = "agentId"
56915698
case sessionkey = "sessionKey"
56925699
case turnsourcechannel = "turnSourceChannel"
56935700
case turnsourceto = "turnSourceTo"
56945701
case turnsourceaccountid = "turnSourceAccountId"
56955702
case turnsourcethreadid = "turnSourceThreadId"
56965703
case timeoutms = "timeoutMs"
5704+
case keeppendingwithoutroute = "keepPendingWithoutRoute"
56975705
case twophase = "twoPhase"
56985706
}
56995707
}
@@ -5716,6 +5724,28 @@ public struct PluginApprovalResolveParams: Codable, Sendable {
57165724
}
57175725
}
57185726

5727+
public struct PluginApprovalResolveVerifiedParams: Codable, Sendable {
5728+
public let id: String
5729+
public let decision: String
5730+
public let pluginid: String
5731+
5732+
public init(
5733+
id: String,
5734+
decision: String,
5735+
pluginid: String)
5736+
{
5737+
self.id = id
5738+
self.decision = decision
5739+
self.pluginid = pluginid
5740+
}
5741+
5742+
private enum CodingKeys: String, CodingKey {
5743+
case id
5744+
case decision
5745+
case pluginid = "pluginId"
5746+
}
5747+
}
5748+
57195749
public struct PluginControlUiDescriptor: Codable, Sendable {
57205750
public let id: String
57215751
public let pluginid: String
@@ -6226,21 +6256,37 @@ public struct ChatInjectParams: Codable, Sendable {
62266256
public let sessionkey: String
62276257
public let message: String
62286258
public let label: String?
6259+
public let idempotencykey: String?
6260+
public let command: Bool?
6261+
public let interactive: AnyCodable?
6262+
public let channeldata: AnyCodable?
62296263

62306264
public init(
62316265
sessionkey: String,
62326266
message: String,
6233-
label: String?)
6267+
label: String?,
6268+
idempotencykey: String?,
6269+
command: Bool?,
6270+
interactive: AnyCodable?,
6271+
channeldata: AnyCodable?)
62346272
{
62356273
self.sessionkey = sessionkey
62366274
self.message = message
62376275
self.label = label
6276+
self.idempotencykey = idempotencykey
6277+
self.command = command
6278+
self.interactive = interactive
6279+
self.channeldata = channeldata
62386280
}
62396281

62406282
private enum CodingKeys: String, CodingKey {
62416283
case sessionkey = "sessionKey"
62426284
case message
62436285
case label
6286+
case idempotencykey = "idempotencyKey"
6287+
case command
6288+
case interactive
6289+
case channeldata = "channelData"
62446290
}
62456291
}
62466292

‎docs/.generated/config-baseline.sha256‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
932d0df0d277aded125d4843a55f3acc2b90d39a5867d09d76bdf1a59d469e5f config-baseline.json
2-
fe5e2eecee8c354eac3e10b801c27c20a16f9432377a19fcb2849221e62c62bf config-baseline.core.json
1+
4ed8c72e16306fd2ef3b0e34a6184e446093773871553c2d86805695e78fcc01 config-baseline.json
2+
5ee4b339dc001e9c5736fd72f3f7f7d21658ef6a2856ed3e7c2fd7840e2f0147 config-baseline.core.json
33
2aa997d48549bd321a478485126a4bd5065ba47333a80e7eb07a0ef6ad75b0a6 config-baseline.channel.json
4-
1ab5b65a94d84f59bae5e6bbe310057fae0a645f2538ab00f1f37b7f8b371e6f config-baseline.plugin.json
4+
32bce6bed6d43c71ef30d59c2594bdfc0c21e61ec54e491ce1981ae5e3b23517 config-baseline.plugin.json

‎docs/.generated/plugin-sdk-api-baseline.sha256‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,2 @@
1-
228e53a4748d3e797b54fba1ac9069ef65b459ece5807e100e01f14c872e0610 plugin-sdk-api-baseline.json
2-
e675bb9b25b849f6a54eca75fcd343efc1258cb1f5e33cf3ec0a00aa7eaf4f05 plugin-sdk-api-baseline.jsonl
1+
f7670d23903e8fc7dcd2efc8e135842605abe2f229849adb03c1a8db2c25fac6 plugin-sdk-api-baseline.json
2+
6606d32d1cb976840fdbc52da5ffdc770878fb15e0cd5a548a37479e4268a3ca plugin-sdk-api-baseline.jsonl

‎docs/.i18n/glossary.zh-CN.json‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -643,6 +643,18 @@
643643
"source": "Google Meet Plugin",
644644
"target": "Google Meet 插件"
645645
},
646+
{
647+
"source": "AgentKit plugin",
648+
"target": "AgentKit 插件"
649+
},
650+
{
651+
"source": "Agentkit plugin",
652+
"target": "AgentKit 插件"
653+
},
654+
{
655+
"source": "agentkit",
656+
"target": "agentkit"
657+
},
646658
{
647659
"source": "Plugin SDK",
648660
"target": "插件 SDK"

‎docs/docs.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1203,6 +1203,7 @@
12031203
"pages": [
12041204
"plugins/codex-harness",
12051205
"plugins/codex-computer-use",
1206+
"plugins/agentkit",
12061207
"plugins/google-meet",
12071208
"plugins/webhooks",
12081209
"plugins/admin-http-rpc",

‎docs/gateway/protocol.md‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -454,7 +454,7 @@ enumeration of `src/gateway/server-methods/*.ts`.
454454
- `exec.approval.waitDecision` waits on one pending exec approval and returns the final decision (or `null` on timeout).
455455
- `exec.approvals.get` and `exec.approvals.set` manage gateway exec approval policy snapshots.
456456
- `exec.approvals.node.get` and `exec.approvals.node.set` manage node-local exec approval policy via node relay commands.
457-
- `plugin.approval.request`, `plugin.approval.list`, `plugin.approval.waitDecision`, and `plugin.approval.resolve` cover plugin-defined approval flows.
457+
- `plugin.approval.request`, `plugin.approval.list`, `plugin.approval.waitDecision`, and `plugin.approval.resolve` cover plugin-defined approval flows. `plugin.approval.resolveVerified` is an admin-scoped resolver for plugin-owned proof flows.
458458

459459
</Accordion>
460460

@@ -606,6 +606,10 @@ terminal summary, and sanitized error text.
606606

607607
- When an exec request needs approval, the gateway broadcasts `exec.approval.requested`.
608608
- Operator clients resolve by calling `exec.approval.resolve` (requires `operator.approvals` scope).
609+
- Plugin approvals may restrict generic allow decisions with `allowedDecisions`.
610+
Plugin-owned proof flows that verify outside the generic approval client can
611+
resolve through `plugin.approval.resolveVerified` with `operator.admin` scope
612+
after checking the proof.
609613
- For `host=node`, `exec.approval.request` must include `systemRunPlan` (canonical `argv`/`cwd`/`rawCommand`/session metadata). Requests missing `systemRunPlan` are rejected.
610614
- After approval, forwarded `node.invoke system.run` calls reuse that canonical
611615
`systemRunPlan` as the authoritative command/cwd/session context.

0 commit comments

Comments
 (0)