Skip to content

feat(eve): authorize approval responders at runtime - #1346

Closed
benpankow wants to merge 1 commit into
ben/hitl-response-authorizer-apifrom
ben/hitl-authorizer-runtime
Closed

feat(eve): authorize approval responders at runtime#1346
benpankow wants to merge 1 commit into
ben/hitl-response-authorizer-apifrom
ben/hitl-authorizer-runtime

Conversation

@benpankow

@benpankow benpankow commented Jul 29, 2026

Copy link
Copy Markdown
Collaborator

Summary

Wires the response-authorizer API into durable approval handling:

  • stamps pending requests that require responder authorization
  • resolves current static and dynamic policy on every attempt
  • creates/deduplicates responder-bound candidates
  • applies a 10-second authorizer timeout and safe fail-closed feedback
  • commits candidate settlement before ordinary approval history/tool execution
  • lets authenticated Cancel settle without running the authorizer
  • starts candidate-scoped interactive authorization and resumes the same candidate after callback
  • retains pending requests when policy rejects, fails, or disappears after deployment

Validation

  • pnpm --filter eve exec vitest run --config vitest.unit.config.ts src/harness/input-requests.test.ts src/harness/tool-loop.test.ts src/execution/tool-auth.integration.test.ts
  • pnpm --filter eve typecheck

Stack

Depends on #1344.

@vercel

vercel Bot commented Jul 29, 2026

Copy link
Copy Markdown
Contributor

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
eve-docs Ready Ready Preview Jul 29, 2026 7:39pm
eve-docs-4759 Ready Ready Preview, v0 Jul 29, 2026 7:39pm

Signed-off-by: benpankow <ben.pankow@vercel.com>
const activeCandidate = getApprovalAuditState(input.session.state).activeCandidates.find(
(candidate) =>
candidate.status === "authorization-required" &&
getAuthorizationResult(candidate.candidateId) !== undefined,

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Interactive-authorization resume detection looks up getAuthorizationResult(candidateId) with the raw candidateId instead of the namespaced scope , so an approval parked for interactive sign-in never resumes and the approved tool never executes.

Fix on Vercel

@benpankow

Copy link
Copy Markdown
Collaborator Author

Superseded by the consolidated 7-PR implementation stack starting at #1368 (GitHub stack #1375).

@benpankow benpankow closed this Jul 29, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant