Best possible solution:

Rebase onto current main, route pending/list and resolve/respond through the established approval-runtime authority path or a maintainer-approved requester-bound contract, fix CI, and add redacted live gateway proof.

Do we have a high-confidence way to reproduce the issue?

Yes, at source level. The PR head calls generic CLI RPC for list/resolve while current main gates broad approval visibility and resolution on admin or trusted approval-runtime authority; CI logs also show changed-line lint and test-type failures.

Is this the best way to solve the issue?

No. The CLI feature is useful, but the proposed implementation is the wrong authority layer unless maintainers explicitly choose and document requester-bound semantics.

Full review comments:

• [P1] Route approval commands through approval-runtime authority — src/cli/exec-approvals-cli.ts:659-695
  These commands call the generic CLI gateway helper, but requester-bound approvals are only broadly visible and resolvable for admin clients or clients marked as the trusted approval runtime. A normal CLI connection can therefore miss the pending approvals this recovery command is meant to handle; use the existing approval-runtime client or explicitly narrow the command contract.
  Confidence: 0.91
• [P2] Return from the invalid decision branch — src/cli/exec-approvals-cli.ts:268
normalizeApprovalDecisionInput is declared to return string, but the invalid branch only calls exitWithError(...); the current lint job flags this changed function as missing a return value. Return the never call so the branch satisfies the linter.
  Confidence: 0.97
• [P2] Widen the mocked gateway return type — src/cli/exec-approvals-cli.test.ts:226-236
  The new pending-approval test returns a bare array from callGatewayFromCli.mockResolvedValueOnce, but the mock's inferred return union does not include that shape, so check-test-types fails on this line. Widen the mock return type or use a typed mock helper before merge.
  Confidence: 0.96

Overall correctness: patch is incorrect
Overall confidence: 0.91

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 0c7bac34ae68.

Label justifications:

• P2: This is a bounded operator CLI improvement with limited blast radius, but it touches exec approval recovery and needs normal-priority maintainer/security review.
• merge-risk: 🚨 security-boundary: The PR changes how operators list and resolve exec approvals and currently uses a generic CLI RPC path rather than the trusted approval-runtime authority path.
• rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🧂 unranked krab and patch quality is 🧂 unranked krab.
• status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: The PR body provides focused unit-test output and explicitly says no live gateway list-and-resolve roundtrip was tested after the patch. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

PR surface:

Source +154, Tests +36, Docs +15. Total +205 across 3 files.

Security concerns:

• [high] Approval CLI uses the wrong authority path — src/cli/exec-approvals-cli.ts:659
pending and resolve use the generic CLI RPC helper, while current gateway visibility and resolve logic only grants broad requester-bound approval authority to admin clients or the local approval-runtime client. That can produce incorrect denial or invisibility at the exec approval boundary.
  Confidence: 0.9

What I checked:

• PR wires approval commands through generic CLI RPC: The PR adds pending and resolve actions that call callGatewayFromCli("exec.approval.list") and callGatewayFromCli("exec.approval.resolve"), so the new recovery path uses the generic CLI gateway caller. (src/cli/exec-approvals-cli.ts:659, 714c19cc05fb)
• Generic CLI RPC lacks approval-runtime authority: Current main's CLI gateway helper calls callGateway with CLI client name/mode and optional scopes, but does not send the local approval-runtime token used by trusted approval clients. (src/cli/gateway-rpc.runtime.ts:40, 0c7bac34ae68)
• Approval visibility is authority-gated: Current main only grants broad approval visibility to admin clients or clients with operator.approvals plus trusted internal.approvalRuntime; otherwise requester/reviewer bindings apply. (src/gateway/server-methods/approval-shared.ts:132, 0c7bac34ae68)
• Trusted approval-runtime client exists: createOperatorApprovalsGatewayClient connects as a backend gateway client with operator.approvals and sends the local approval-runtime token for eligible local gateways. (src/gateway/operator-approvals-client.ts:26, 0c7bac34ae68)
• Current main still lacks the requested CLI surface: Current main registers approvals get, set, and allowlist; it does not register pending/list/resolve/respond commands. (src/cli/exec-approvals-cli.ts:487, 0c7bac34ae68)
• CI changed-surface failures remain visible: Live check metadata shows check-lint and check-test-types failed for the PR head; logs show the missing return value and mocked gateway return type errors on changed lines. (714c19cc05fb)

Likely related people:

• steipete: Commit history shows the original exec approvals tooling and later approvals CLI/docs maintenance on the files this PR changes. (role: primary CLI approvals history contributor; confidence: high; commits: 3686bde783fd, 08ae0e6d2992; files: src/cli/exec-approvals-cli.ts, src/cli/exec-approvals-cli.test.ts, docs/cli/approvals.md)
• vincentkoc: Recent commits extracted shared visible approval list and resolve handling in the gateway approval backend that the new CLI should respect. (role: recent approval backend contributor; confidence: high; commits: 6464f8d1d924, 56eadf36d019, 5adc681238c6; files: src/gateway/server-methods/approval-shared.ts, src/gateway/server-methods/exec-approval.ts)
• fuller-stack-dev: Recent history repaired local approval resolution and affected the approval-runtime authority path implicated by this PR. (role: approval-runtime authority contributor; confidence: medium; commits: 13cfb77c10f9, 43acf3a4a243; files: src/gateway/operator-approvals-client.ts, src/gateway/server-methods/approval-shared.ts)
• joshavant: Recent merged work routes mobile exec approvals to reviewer devices, touching the same approval visibility and reviewer-bound semantics. (role: recent adjacent approval contributor; confidence: medium; commits: 5d1e649aeadf; files: src/gateway/server-methods/approval-shared.ts, src/gateway/server-methods/exec-approval.ts)

• 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
• 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
• 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
• 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
• 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
• 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
• 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.