fix(confirmations): guarded-action handling across webchat and tui

src/gateway/handlers/agent.test.ts

@@ -235,6 +235,38 @@ describe('createAgentHandlers command fast-path', () => {
     expect(((sent[0] as GatewayEvent).data as { content: string }).content).toBe('agent response');
   });
 
+  it('handles /approvals command via fast-path when hook engine is available', async () => {
+    const sent: OutboundMessage[] = [];
+    const send = vi.fn((msg: OutboundMessage) => sent.push(msg));
+    const hookEngine = {
+      getPendingConfirmations: vi.fn(() => []),
+      resolveConfirmation: vi.fn(() => false),
+    };
+    const handlersWithHooks = createAgentHandlers({
+      sessionBridge: sessionBridge as unknown as AgentHandlerDeps['sessionBridge'],
+      laneQueue: new LaneQueue(),
+      sessionManager: sessionManager as unknown as AgentHandlerDeps['sessionManager'],
+      commandRegistry,
+      hookEngine: hookEngine as unknown as AgentHandlerDeps['hookEngine'],
+    });
+
+    const req: GatewayRequest = {
+      id: 11,
+      method: 'agent.send',
+      params: {
+        message: '/approvals',
+        connectionId: 'conn-1',
+        metadata: { isCommand: true, command: 'approvals' },
+      },
+    };
+
+    await handlersWithHooks['agent.send'](req, send);
+
+    expect(mockAgent.process).not.toHaveBeenCalled();
+    expect(hookEngine.getPendingConfirmations).toHaveBeenCalledWith({ sessionId: 'ws:conn-1' });
+    expect(((sent[0] as GatewayEvent).data as { content: string }).content).toContain('No pending approvals');
+  });
+
   it('emits user.action audit events for gateway requests', async () => {
     const sent: OutboundMessage[] = [];
     const send = vi.fn((msg: OutboundMessage) => sent.push(msg));

src/gateway/handlers/agent.ts

@@ -15,6 +15,7 @@ import type { Config, ModelConfig, ModelProvider } from '../../config/index.js';
 import { MODEL_PROVIDERS } from '../../config/index.js';
 import { createClientFromConfig } from '../../daemon/models.js';
 import { auditLogger } from '../../audit/index.js';
+import type { HookEngine } from '../../hooks/index.js';
 import { randomUUID } from 'crypto';
 
 export interface AgentHandlerDeps {
@@ -31,6 +32,7 @@ export interface AgentHandlerDeps {
   commandRegistry?: CommandRegistry;
   modelRouter?: ModelRouter;
   runtimeConfig?: Config;
+  hookEngine?: HookEngine;
 }
 
 function buildProviderConfigMap(config: Config): Partial<Record<ModelProvider, ModelConfig>> {
@@ -292,6 +294,92 @@ export function createAgentHandlers(deps: AgentHandlerDeps) {
                   }
                   return 'Session reset.';
                 },
+                getApprovals: () => {
+                  if (!deps.hookEngine) {
+                    return 'Approval gates are not enabled in this runtime.';
+                  }
+                  if (!sessionId) {
+                    return 'No pending approvals for this session.';
+                  }
+                  const pending = deps.hookEngine.getPendingConfirmations({ sessionId });
+                  if (pending.length === 0) {
+                    return 'No pending approvals for this session.';
+                  }
+                  const lines = ['Pending approvals:'];
+                  for (const item of pending) {
+                    const ageSec = Math.max(0, Math.round((Date.now() - item.createdAt.getTime()) / 1000));
+                    lines.push(`- ${item.id} | ${item.tool} | ${ageSec}s old`);
+                  }
+                  lines.push('');
+                  lines.push('Use `/approve <id>` or `/deny <id> <reason>` (id optional: latest is used).');
+                  return lines.join('\n');
+                },
+                approvePending: (inputRaw: string) => {
+                  if (!deps.hookEngine) {
+                    return 'Approval gates are not enabled in this runtime.';
+                  }
+                  if (!sessionId) {
+                    return 'Approve command is unavailable in this session.';
+                  }
+                  const pending = deps.hookEngine.getPendingConfirmations({ sessionId });
+                  if (pending.length === 0) {
+                    return 'No pending approvals for this session.';
+                  }
+
+                  const input = inputRaw.trim();
+                  const selected = input
+                    ? pending.find((item) => item.id === input)
+                    : pending[pending.length - 1];
+
+                  if (!selected) {
+                    return `Approval id not found in this session: ${input}`;
+                  }
+
+                  const resolved = deps.hookEngine.resolveConfirmation(selected.id, { approved: true });
+                  return resolved
+                    ? `Approved: ${selected.tool} (${selected.id})`
+                    : `Approval request is no longer pending: ${selected.id}`;
+                },
+                denyPending: (inputRaw: string) => {
+                  if (!deps.hookEngine) {
+                    return 'Approval gates are not enabled in this runtime.';
+                  }
+                  if (!sessionId) {
+                    return 'Deny command is unavailable in this session.';
+                  }
+                  const pending = deps.hookEngine.getPendingConfirmations({ sessionId });
+                  if (pending.length === 0) {
+                    return 'No pending approvals for this session.';
+                  }
+
+                  const input = inputRaw.trim();
+                  let targetId: string | undefined;
+                  let reason = 'Denied by user';
+
+                  if (input) {
+                    const [first, ...rest] = input.split(/\s+/);
+                    const matched = pending.find((item) => item.id === first);
+                    if (matched) {
+                      targetId = matched.id;
+                      reason = rest.join(' ').trim() || reason;
+                    } else {
+                      targetId = pending[pending.length - 1].id;
+                      reason = input;
+                    }
+                  } else {
+                    targetId = pending[pending.length - 1].id;
+                  }
+
+                  const selected = pending.find((item) => item.id === targetId);
+                  if (!selected) {
+                    return `Approval request is no longer pending: ${targetId}`;
+                  }
+
+                  const resolved = deps.hookEngine.resolveConfirmation(selected.id, { approved: false, reason });
+                  return resolved
+                    ? `Denied: ${selected.tool} (${selected.id}) — ${reason}`
+                    : `Approval request is no longer pending: ${selected.id}`;
+                },
 
                 getElevation: () => {
                   if (!sessionId || !deps.sessionManager) {