feat(talon): add tool approval env override - #4349
Merged
Merged
Conversation
github-actions
Bot
added
feature
John Kennedy (jkennedyvz)
marked this pull request as ready for review
June 27, 2026 23:56
![open-swe[bot]](https://avatars.githubusercontent.com/in/1395372?s=60&v=4){kind=small}
Rafid S (rx5ad)
approved these changes
Jun 28, 2026
John Kennedy (jkennedyvz)
enabled auto-merge (squash)
June 28, 2026 22:13
This was referenced Jun 28, 2026
John Kennedy (jkennedyvz)
pushed a commit
that referenced
this pull request
Jun 30, 2026
> [!CAUTION] > Merging this PR will automatically publish to **PyPI** and create a **GitHub release**. For the full release process, see [`.github/RELEASING.md`](https://github.com/langchain-ai/deepagents/blob/main/.github/RELEASING.md). --- _Everything below this line will be the GitHub release body._ --- ## [0.0.2](deepagents-talon==0.0.1...deepagents-talon==0.0.2) (2026-06-30) ### Features * **talon:** `DEEPAGENTS_TALON_RECURSION_LIMIT` env var ([#4354](#4354)) ([82d1eac](82d1eac)) * **talon:** add reaction approval routing ([#4345](#4345)) ([3fe8c0c](3fe8c0c)) * **talon:** add Telegram channel adapter, CLI wiring, and offset persistence ([#4097](#4097)) ([7c87cec](7c87cec)) * **talon:** add tool approval env override ([#4349](#4349)) ([d26481d](d26481d)) * **talon:** audit reaction approval attempts ([#4348](#4348)) ([d7895c4](d7895c4)) * **talon:** ingest Telegram approval reactions ([#4346](#4346)) ([437af0b](437af0b)) ### Bug Fixes * **talon:** default workspace to current directory ([#4099](#4099)) ([5e337ae](5e337ae)) --- _Everything above this line will be the GitHub release body._ --- > [!NOTE] > A **New Contributors** section is appended to the GitHub release notes automatically at publish time (see [Release Pipeline](https://github.com/langchain-ai/deepagents/blob/main/.github/RELEASING.md#release-pipeline), step 2). --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Marcelo5444
pushed a commit
to Marcelo5444/deepagents
that referenced
this pull request
Jul 30, 2026
Stacked on langchain-ai#4345. Adds `DEEPAGENTS_TALON_INTERRUPT_ON_TOOLS` so Talon operators can force channel approval for named tools at runtime without changing Fleet exports. The overlay is additive with imported Fleet `interrupt_on` config and is also applied on the non-Fleet MCP runtime path. The env value is parsed as a comma-separated list, trims surrounding whitespace, ignores empty entries, and maps each listed tool to the default `True` interrupt configuration. Fleet reloads reapply the same overlay. ## When this is useful Some tools are safe to run autonomously in one deployment but risky in another (e.g. `bash`, `execute`, `github_create_pr`). Rather than re-exporting a Fleet agent or editing `interrupt_on` in code every time the risk profile changes, an operator can flip a single env var at deploy/runtime to force those tools through Talon's channel approval flow. The override is additive, so Fleet-provided approvals keep working and the env list just layers extra guarded tools on top. This also covers the non-Fleet (local/MCP) runtime path, which previously had no equivalent knob. ## Example Force `bash` and `github_create_pr` to require channel approval: ```bash DEEPAGENTS_TALON_INTERRUPT_ON_TOOLS=bash,execute,github_create_pr ``` Whitespace and empty entries are tolerated, so `" bash, execute, , github_create_pr "` parses to the same three tools. When the agent then calls `bash`, Talon posts an approval prompt in the channel: ``` 🤖 Tool approval required. 1. bash(command="rm -rf /tmp/build") React 👍 to approve or 👎 to reject. ``` Because this PR stacks on langchain-ai#4345, the operator can approve/deny by reacting with 👍/👎 on that exact prompt (scoped to provider, conversation, prompt message id, and sender) — or by typing `approve`/`deny` as before. With `fleet_tool` already configured via Fleet, the merged `interrupt_on` becomes `{"fleet_tool": True, "bash": True, "execute": True, "github_create_pr": True}`, and Fleet reloads reapply the same overlay so the gate survives credential refreshes. Tests cover the parser, Fleet merge behavior, Fleet reload components, non-Fleet runtime wiring, empty env behavior, and graph construction. --------- Co-authored-by: Deep Agent <agent@deepagents.dev>
Marcelo5444
pushed a commit
to Marcelo5444/deepagents
that referenced
this pull request
Jul 30, 2026
> [!CAUTION] > Merging this PR will automatically publish to **PyPI** and create a **GitHub release**. For the full release process, see [`.github/RELEASING.md`](https://github.com/langchain-ai/deepagents/blob/main/.github/RELEASING.md). --- _Everything below this line will be the GitHub release body._ --- ## [0.0.2](langchain-ai/deepagents@deepagents-talon==0.0.1...deepagents-talon==0.0.2) (2026-06-30) ### Features * **talon:** `DEEPAGENTS_TALON_RECURSION_LIMIT` env var ([langchain-ai#4354](langchain-ai#4354)) ([82d1eac](langchain-ai@82d1eac)) * **talon:** add reaction approval routing ([langchain-ai#4345](langchain-ai#4345)) ([3fe8c0c](langchain-ai@3fe8c0c)) * **talon:** add Telegram channel adapter, CLI wiring, and offset persistence ([langchain-ai#4097](langchain-ai#4097)) ([7c87cec](langchain-ai@7c87cec)) * **talon:** add tool approval env override ([langchain-ai#4349](langchain-ai#4349)) ([d26481d](langchain-ai@d26481d)) * **talon:** audit reaction approval attempts ([langchain-ai#4348](langchain-ai#4348)) ([d7895c4](langchain-ai@d7895c4)) * **talon:** ingest Telegram approval reactions ([langchain-ai#4346](langchain-ai#4346)) ([437af0b](langchain-ai@437af0b)) ### Bug Fixes * **talon:** default workspace to current directory ([langchain-ai#4099](langchain-ai#4099)) ([5e337ae](langchain-ai@5e337ae)) --- _Everything above this line will be the GitHub release body._ --- > [!NOTE] > A **New Contributors** section is appended to the GitHub release notes automatically at publish time (see [Release Pipeline](https://github.com/langchain-ai/deepagents/blob/main/.github/RELEASING.md#release-pipeline), step 2). --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stacked on #4345.
Adds
DEEPAGENTS_TALON_INTERRUPT_ON_TOOLSso Talon operators can force channel approval for named tools at runtime without changing Fleet exports. The overlay is additive with imported Fleetinterrupt_onconfig and is also applied on the non-Fleet MCP runtime path.The env value is parsed as a comma-separated list, trims surrounding whitespace, ignores empty entries, and maps each listed tool to the default
Trueinterrupt configuration. Fleet reloads reapply the same overlay.When this is useful
Some tools are safe to run autonomously in one deployment but risky in another (e.g.
bash,execute,github_create_pr). Rather than re-exporting a Fleet agent or editinginterrupt_onin code every time the risk profile changes, an operator can flip a single env var at deploy/runtime to force those tools through Talon's channel approval flow. The override is additive, so Fleet-provided approvals keep working and the env list just layers extra guarded tools on top. This also covers the non-Fleet (local/MCP) runtime path, which previously had no equivalent knob.Example
Force
bashandgithub_create_prto require channel approval:Whitespace and empty entries are tolerated, so
" bash, execute, , github_create_pr "parses to the same three tools. When the agent then callsbash, Talon posts an approval prompt in the channel:Because this PR stacks on #4345, the operator can approve/deny by reacting with 👍/👎 on that exact prompt (scoped to provider, conversation, prompt message id, and sender) — or by typing
approve/denyas before. Withfleet_toolalready configured via Fleet, the mergedinterrupt_onbecomes{"fleet_tool": True, "bash": True, "execute": True, "github_create_pr": True}, and Fleet reloads reapply the same overlay so the gate survives credential refreshes.Tests cover the parser, Fleet merge behavior, Fleet reload components, non-Fleet runtime wiring, empty env behavior, and graph construction.