refactor(approvals): defer external action wiring

Guardiola31337 · Guardiola31337 · commit 66806d77dbb9 · 2026-07-25T20:19:39.000-07:00
diff --git a/src/infra/approval-view-model.test.ts b/src/infra/approval-view-model.test.ts
@@ -90,32 +90,6 @@ describe("buildPendingApprovalView", () => {
     ]);
   });
 
-  it("keeps external verification off generic native actions", () => {
-    const request: PluginApprovalRequest = {
-      id: "plugin:external-approval",
-      createdAtMs: 1,
-      expiresAtMs: 2,
-      request: {
-        title: "World verification",
-        description: "Verify personhood before continuing.",
-        pluginId: "agentkit",
-        externalResolution: {
-          label: "Verify with World",
-          decisions: ["allow-once", "allow-always"],
-        },
-      },
-    };
-
-    const view = buildPendingApprovalView(request);
-
-    expect(view.actions).toEqual([
-      expect.objectContaining({
-        command: "/approve plugin:external-approval deny",
-        action: expect.objectContaining({ type: "approval", decision: "deny" }),
-      }),
-    ]);
-  });
-
   it.each([
     { request: {} },
     { request: { command: "echo hi", title: "Ambiguous", description: "Ambiguous" } },
diff --git a/src/infra/plugin-approval-canonical-decisions.ts b/src/infra/plugin-approval-canonical-decisions.ts
@@ -5,11 +5,7 @@ import { resolvePluginApprovalRequestAllowedDecisions } from "./plugin-approvals
 /** Add the fail-closed deny verdict to the normalized plugin decision set. */
 export function resolveCanonicalPluginApprovalRequestAllowedDecisions(params?: {
   allowedDecisions?: readonly ExecApprovalDecision[] | readonly string[] | null;
-  externalResolution?: unknown;
 }): readonly ExecApprovalDecision[] {
-  if (params?.externalResolution) {
-    return ["deny"];
-  }
   const allowedDecisions = resolvePluginApprovalRequestAllowedDecisions(params);
   return allowedDecisions.includes("deny") ? allowedDecisions : [...allowedDecisions, "deny"];
 }
diff --git a/src/infra/plugin-approvals.test.ts b/src/infra/plugin-approvals.test.ts
@@ -1,9 +1,5 @@
 import { describe, expect, it } from "vitest";
-import {
-  buildPluginApprovalRequestMessage,
-  normalizePluginExternalResolution,
-  type PluginApprovalRequest,
-} from "./plugin-approvals.js";
+import { normalizePluginExternalResolution } from "./plugin-approvals.js";
 
 describe("plugin external approval presentation", () => {
   it("defaults external verification to allow-once", () => {
@@ -40,35 +36,4 @@ describe("plugin external approval presentation", () => {
       }),
     ).toThrow("external approval label");
   });
-
-  it("emits the accepted text fallback without a generic allow command", () => {
-    const request: PluginApprovalRequest = {
-      id: "plugin:external-1",
-      createdAtMs: 1_000,
-      expiresAtMs: 61_000,
-      request: {
-        title: "World verification",
-        description: "Verify personhood before continuing.",
-        pluginId: "agentkit",
-        toolName: "dangerous-tool",
-        agentId: "main",
-        externalResolution: {
-          label: "Verify with World",
-          decisions: ["allow-once", "allow-always"],
-        },
-      },
-    };
-
-    expect(buildPluginApprovalRequestMessage(request, 1_000)).toContain(
-      [
-        "Verify with World",
-        "Verify once: /approve plugin:external-1 external allow-once",
-        "Verify and trust for session: /approve plugin:external-1 external allow-always",
-        "Deny: /approve plugin:external-1 deny",
-      ].join("\n"),
-    );
-    expect(buildPluginApprovalRequestMessage(request, 1_000)).not.toContain(
-      "/approve plugin:external-1 allow-once",
-    );
-  });
 });
diff --git a/src/infra/plugin-approvals.ts b/src/infra/plugin-approvals.ts
@@ -176,18 +176,6 @@ export function buildPluginApprovalRequestMessage(
   lines.push(`ID: ${request.id}`);
   const expiresIn = Math.max(0, Math.round((request.expiresAtMs - nowMsValue) / 1000));
   lines.push(`Expires in: ${expiresIn}s`);
-  const externalResolution = normalizePluginExternalResolution(request.request.externalResolution);
-  if (externalResolution) {
-    lines.push(externalResolution.label);
-    if (externalResolution.decisions?.includes("allow-once")) {
-      lines.push(`Verify once: /approve ${request.id} external allow-once`);
-    }
-    if (externalResolution.decisions?.includes("allow-always")) {
-      lines.push(`Verify and trust for session: /approve ${request.id} external allow-always`);
-    }
-    lines.push(`Deny: /approve ${request.id} deny`);
-    return lines.join("\n");
-  }
   lines.push(
     `Reply with: /approve ${request.id} ${resolvePluginApprovalRequestAllowedDecisions(
       request.request,
