fix(app): reply to subagent permission prompts#28651
Open
MingyooLee wants to merge 7 commits into
Open
Conversation
Use the request-scoped permission reply endpoint for manual and auto-responded app permission prompts, and clear confirmed prompts from local sync state. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
Add Playwright coverage for a parent composer replying to a child session permission prompt through the request-scoped endpoint, and assert the deprecated session-scoped endpoint is not used. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
Contributor
|
The following comment was made by an LLM, it may be inaccurate: Found related PR:
The current PR explicitly states it "Supersedes/complements #26905", so this is an intended follow-up rather than a duplicate. |
6 tasks
…ssion-reply # Conflicts: # packages/app/e2e/utils/mock-server.ts
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Issue for this PR
Fixes #26907
Related to #27436
Supersedes/complements #26905
This PR intentionally does not address TUI-specific Enter/mouse interaction issues such as #27302, #27875, or #7966. Those use the TUI prompt code path and should be handled separately.
Type of change
What does this PR do?
Web/Desktop app permission prompts for nested subagent sessions could get stuck or reply through the deprecated session-scoped permission response path. This is especially visible when a child session asks for permission but the parent session composer renders the prompt.
User-visible impact: the prompt can appear normally and the user can click
Allow onceorAllow always, but the pending tool call may not unblock. From the user perspective, the approval button was clicked but the assistant remains stuck waiting for permission, so the Web/Desktop session cannot continue. This makes the Web/Desktop flow difficult to recover from: the user has already approved the prompt, but the assistant remains blocked with no clear next action.This PR updates the app permission flow to use the request-scoped reply endpoint consistently:
permission.reply({ requestID, reply })Relationship to #26905
#26905 fixes the stale UI portion by clearing the local permission cache after a successful response, but it still uses the deprecated
permission.respond/ session-scoped response path.This PR builds on that fix by also switching both manual and auto-responded app permissions to the canonical request-scoped
permission.replyendpoint, and by adding regression coverage for a nested child-session permission rendered in the parent composer.How did you verify your code works?
bun typecheckfrompackages/appPLAYWRIGHT_SERVER_PORT=4097 PLAYWRIGHT_PORT=4445 bun run test:e2e:local -- e2e/smoke/session-permission.spec.tsfrompackages/appbun test --preload ./happydom.ts ./src/context/global-sync/event-reducer.test.tsfrompackages/appbunx oxlint packages/app/src/context/permission.tsx packages/app/src/pages/session/composer/session-composer-state.ts packages/app/e2e/utils/mock-server.ts packages/app/e2e/smoke/session-permission.spec.tsbun turbo typecheckScreenshots / recordings
No visual change. The E2E test verifies that clicking
Allow onceon a nested subagent permission prompt sendsPOST /permission/{requestID}/reply, does not call the deprecated/session/{sessionID}/permissions/{permissionID}endpoint, and removes the prompt from the composer.Checklist