fix(approval): restore session approval tier for tirith-flagged prompts (salvage #67312) - #68664
Merged
Conversation
Adds an allow_session flag to the gateway approval payload so adapters can render the session tier independently of the permanent tier. Matrix gains a session reaction (🌀) and a reaction legend; pure-tirith prompts now offer once/session/deny instead of collapsing to once/deny. Salvaged from PR #67312, adapted to the allow_permanent semantics that landed in #68597 (Always offered when any dangerous-pattern warning is persistable; pure-tirith prompts stay session-max).
Widen the allow_session tier from Matrix to every adapter the gateway notifies: Telegram, Discord, Slack, Feishu, and Teams gate their Session button on it; WhatsApp Cloud and qqbot accept the kwarg (no session tier in their button sets). Also thread allow_session through the plugin- escalation gate, the execute_code guard payload, and the plain-text fallback so every notify path carries the same capability flags.
Contributor
૮ >ﻌ< ა ci reviewrunning on 8904dd1 looks good to me! |
alt-glitch
added
type/bug
…and gateway payload Update the Matrix reaction-seeding contract to the four-reaction default (once/session/always/deny), add tirith-tier (session without always) and no-session-tier cases, and assert allow_session=True in the tirith gateway payload.
This was referenced Jul 21, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Pure-tirith approval prompts regain the Session tier on every messaging platform, and Matrix gains a dedicated session reaction (🌀) — salvaged from @faikwo's #67312 onto current main.
Before #68597,
allow_permanent=False(any tirith finding) collapsed platform button sets to Once/Deny-adjacent shapes even though the persistence layer fully supports session-scoped approval of tirith keys. #68597 fixed the Always tier for mixed prompts; this PR adds the missing Session dimension @faikwo identified: a separateallow_sessioncapability flag so adapters render the session tier independently of the permanent tier.Changes
tools/approval.py:allow_sessionadded to all three gateway notify payloads (dangerous-command guard, plugin-escalation gate, execute_code guard) —Trueexcept for Smart-DENY owner overridesgateway/run.py: forwardsallow_sessiontosend_exec_approvaland the plain-text fallbackplugins/platforms/matrix/adapter.py(@faikwo): 🌀 session reaction, reaction legend in the prompt, three-tier reaction seeding (once/session/always/deny)allow_session; WhatsApp Cloud + qqbot accept the kwarg (no session tier in their button sets)test_command_guards.pyValidation
Targeted tests: 472 passed across matrix/telegram/slack/feishu/discord approval suites +
test_approval.py,test_command_guards.py,test_execute_code_approval_cluster.py. Live E2E: gateway payload carries both flags; Matrix reaction map resolves 🌀 → session.Salvage of #67312 — @faikwo's commit is cherry-picked with authorship preserved; the cross-platform widening (Telegram/Discord/Slack/Feishu/Teams/WhatsApp/qqbot + the two extra payload sites) is a follow-up commit on top.
Infographic