Bug: Changing approval policy while escalation is pending leaves agent stuck working

[bennyen]

Summary

When a user changes the approval policy from "ask" to "never" while an agent has a pending sandbox escalation approval request, the agent remains stuck in the "working" state indefinitely. The pending approval request is never resolved, the tool result never returns, and the turn never closes. The UI continues to show the agent as "working" with no indication anything is wrong.

Reproduction

1. Session with approval/policy: ask, agent calls edit with sandbox_permissions + justification
2. UI shows approval prompt; agent shows awaiting approval -> working
3. User changes permission preset (e.g. /permission danger-full-access) or approval policy to "never"
4. Pending approval prompt disappears, but agent remains "working" indefinitely
5. Only way to recover: send a new user message (starts new turn, original tool call never resolved)

Root cause

ApprovalService.setPolicy() in packages/interaction/user-approval/src/index.ts appends the policy change and injects a user message, but does NOT abort in-flight approval/request() promises that are already executing inside decide(). Those promises sit on an await in the escalate -> request -> decide chain, waiting for the waterfall/answerer to resolve.

decide() already handles signal abort at line ~187 (if (signal?.aborted) return "cancelled"), but setPolicy() never calls signal.abort().

Fix (1 line)

  setPolicy(agent: Agent, policy: ApprovalPolicy): void {
    const previous = this.effectivePolicy(agent.session)
    if (previous === policy) return
    setApprovalPolicy(agent.session, policy)
+   // Abort any in-flight approval request so the pending tool call
+   // resolves as cancelled and the agents turn can close.
+   agent.signal?.abort()
    agent.inject(createUserMessage({
      content: [{
        type: text,
        text: `The approval policy changed from ${previous} to ${policy} (changed by the user).`,
      }],
      source: { kind: plugin, plugin: user-approval },
    }))
  }

The existing signal path in decide() does the rest: signal.aborted -> cancelled -> audit pair closes -> tool result propagates -> turn closes -> UI updates to idle.