fix(code): avoid redundant Auto approval prompts

[Mason Daugherty (mdrxy)]

Supersedes #4946
Supersedes #4947

Auto mode no longer interrupts users when an action is already covered by their explicit ask_user selection or when the agent is performing the built-in conversation-compaction operation.

---

Previously, Auto mode could ask users to approve an action immediately after they selected it in an ask_user prompt. It could also pause autonomous work to approve compact_conversation, even though compaction is an internal maintenance operation without an externally consequential effect.

The two cases now follow separate trust rules:

• Server-created, same-turn receipts allow the authorization classifier to consider only the user's selected answer for the exact subsequent action. The receipt is bound to the LangGraph execution thread, the active turn, and the originating ask_user tool call, and is validated against the full checkpoint history so it survives conversation compaction. Only the latest ask_user exchange in the turn is admitted; model-authored questions, unselected choices, and prior answers are excluded. Invalid, stale, ambiguous, or overly broad consent continues through the normal approval path.
• The trusted built-in compact_conversation operation is deterministically allowed without classifier or human review. The exemption is guarded by exact tool-object identity, not by name, so a caller-supplied tool with the same name cannot exploit it. At most one trusted compaction call is allowed per action batch; duplicates are denied without classifier review, and that denial is preserved across all fallback paths.

Test plan

Targeted Auto-mode, ask_user, agent-wiring, and Textual-adapter tests:

uv run --group test pytest tests/unit_tests/test_ask_user_middleware.py \
  tests/unit_tests/test_auto_mode.py \
  tests/unit_tests/tui/test_textual_adapter.py::TestExecuteTaskTextualTurnMarkers \
  tests/unit_tests/test_agent.py::test_cli_context_schema_fields_mirror_typed_dict \
  tests/unit_tests/test_agent.py::TestCreateCliAgentInterpreterWiring \
  --disable-socket --allow-unix-socket --benchmark-disable -q

Result: 135 passed.

Full package unit tests:

make test

Result: 10617 passed, 4 skipped, 6 pre-existing failures in TestLangsmithSecretRedaction (env-dependent, fail on clean origin/main).

Lint, format, type check, and commands catalog:

make lint

Result: All checks passed.

A real LangGraph interrupt/resume test (test_real_agent_resume_forwards_ask_user_receipt_to_classifier) verifies the full path: ask_user interrupt → checkpoint resume → receipt minting with real execution_info.thread_id → classifier sees same_turn_user_answers → action executes without a second HITL prompt.

A compiled-graph identity test (test_compiled_agent_preserves_canonical_compaction_tool_identity) verifies the canonical CLICompactionMiddleware tool object survives create_deep_agent's middleware merge into the compiled ToolNode, and that AutoModeHITLMiddleware._trusted_compaction_tool references that same object.

The 6 TestLangsmithSecretRedaction failures are pre-existing and env-dependent (real LangSmith credentials in the local environment); they fail identically on clean origin/main and are unrelated to this change.

[open-swe]

✅ Open SWE Review: No issues found

Open SWE reviewed this PR and found no potential bugs to report.

Open in Web • View Open SWE trace