Pausing a run on a tool call until a human approves or client-side results arrive (nothing kept in memory)

[dylanmoz]

Some tools require human approval before they run, or require client-side information before they run.

As an example, for requiring approval:

1. The model calls a tool
2. The run stops before the tool executes. The pending call is persisted, and nothing is held in memory
3. The user approves, edits or denies it, maybe hours or days later
4. The run continues from that same tool call and the tool executes (or a denial result is written), and the agent loop continues.

For requiring client-side information for a tool result (WebMCP):

1. The model calls a tool
2. The run stops before the tool executes (because it has no execute function in its definition). The pending call is persisted, and nothing is held in memory
3. The client receives the tool, executes what's necessary, and sends back the tool output result
4. The run continues from that same tool call: the agent loop receives the tool result, and the agent loop continues.

It seems like something like this doesn't exist for Pi durable. There's some similar examples but they seem to wait in memory or return a terminated tool result.

Questions:

• Is there an existing solution I missed?
• Is support for something like this planned or in consideration?

Related:

• Contribution Proposal: Durable HITL tool-call interrupts #5901 but that was for pi, not pi durable
• As an example, Vercel's AI sdk has approval states for tool execution: https://ai-sdk.dev/docs/agents/tool-approvals. And for client-side tool output, if you don't define an execute for a tool, when that tool is called it stops the agent run, and the client can start the run again by providing the tool result (see getLocation tool here https://ai-sdk.dev/docs/ai-sdk-ui/chatbot-tool-usage)

[aashish254]

look for an approval or permissions mode in pi's config — most agents in this space have a setting like "ask before running tools" or per-tool allowlists.

the pattern you want: reads and searches run free, but shell/exec tools pause for your ok. check pi --help or the config docs for approval-related flags — thats where itll live if it exists.

if pi doesnt have it yet, file it as a feature request — human-in-the-loop gating on tool calls is standard in this category now, so its a reasonable ask.

[Val1-IT]

not a pi answer, more on the shape. whatever you persist for the pending call, also store a digest of the exact tool name + args and have the approval point at that digest. on resume you refuse if the call no longer matches, or if the state it was planned against has moved. then "approved" means "approved this exact call", not "approved something with this id".

for edits, i'd make the edit and the approval one act that produces a new version, rather than mutating the pending call in place. otherwise you can't tell later what the human actually saw.

[AltanS]

@dylanmoz Not in Pi Durable itself, but a phone client now covers the approval half. With @colliepwa/durable-sdk the tool raises the approval, ColliePWA shows the tool name and its arguments on a phone card, and one tap on Allow or Deny returns to the tool. The card is built from the call, not from the model's words, which is @Val1-IT's point about approving the exact call. The ask comes back under the same id after a restart; the hold itself waits in the agent process, not in storage. https://www.npmjs.com/package/@colliepwa/durable-sdk and https://github.com/AltanS/collie/blob/main/docs/durable-agents.md.