fabro-sh-0530[bot] b15d8b8476 feat: Add approve/deny run controls to MCP and CLI (#400) ... ## Summary Exposes the existing `POST /api/v1/runs/{id}/approve` and `POST /api/v1/runs/{id}/deny` REST endpoints through the `fabro_run_interact` MCP tool and two new top-level CLI commands (`fabro approve`, `fabro deny`). Workflow agents are explicitly blocked from using these actions — approval remains a human/user operation. ## What changed **Client & tool backend** (`fabro-client`, `fabro-tool`): Added `approve_run` and `deny_run` to `Client` and the `FabroToolBackend` trait, implemented in `ClientBackend`. `deny_run` passes a `DenyRunRequest` body; absent, blank, or whitespace-only reasons are normalised to `None`. **`fabro_run_interact` MCP tool**: Added `Approve` and `Deny` variants to `RunInteractAction` / `ValidatedInteractAction`, and an optional `reason` parameter (only valid for `deny`; validated and trimmed on input). Both actions return `{ "summary": … }` using the existing shape. The tool description is updated to list the new actions. **Workflow-agent guard** (`fabro-workflow`): Before dispatching `fabro_run_interact`, the handler checks `validated.action.requires_user()`. If the action is `approve` or `deny`, it returns an immediate `ToolError` without ever reaching the backend, keeping the guard explicit and independent of server auth. **CLI** (`fabro-cli`): Extracted the archive/unarchive batch loop into a shared `run_resolved_run_batch` helper in `commands/runs/mod.rs`, then implemented `approval.rs` using the same helper. Both commands follow the same batch contract as archive: attempt all runs, collect per-run errors, exit non-zero if any fail, and emit `{ "approved"/"denied": […], "errors": […] }` in JSON mode. **Server auth regression** (`fabro-server`): Extended `run_tools_worker_cannot_call_user_only_non_mcp_routes` to cover `POST /runs/{id}/deny` alongside the existing `approve` and `timeline` checks. **Docs** (`mcp.mdx`, `cli.mdx`): Updated the `fabro_run_interact` table entry and added approve/deny examples, plus reference sections for the two new CLI commands. ### Plan Summary - Add `approve_run` / `deny_run` to `Client` and `FabroToolBackend` - Extend `fabro_run_interact` with `approve`, `deny`, and optional `reason` - Block workflow-agent self-approval with an early `ToolError` - Refactor archive batch loop into shared `run_resolved_run_batch` helper - Add `fabro approve` and `fabro deny` CLI commands reusing that helper - Add integration tests for CLI commands, MCP tool, and server auth guard ### Fabro Details <details> <summary>Ran 9 stages in 63m 57s for $42.33</summary> | Stage | Duration | Cost | Retries | |---|---|---|---| | start | 0s | – | 0 | | toolchain | 1s | – | 0 | | preflight_compile | 2m 6s | – | 0 | | preflight_lint | 2m 17s | – | 0 | | implement | 28m 16s | $32.57 | 0 | | simplify_opus | 10m 59s | $4.24 | 0 | | simplify_gpt | 6m 13s | $3.96 | 0 | | verify | 10m 51s | – | 0 | | fixup | 2m 29s | $1.55 | 0 | | **Total** | **63m 57s** | **$42.33** | **0** | </details> <details> <summary>Ran <code>ImplementPlan.fabro</code> (11 nodes and 14 edges)</summary> ```dot digraph ImplementPlan { graph [ goal="Implement and simplify", model_stylesheet=" * { model: claude-opus-4-7; } " ] rankdir=LR start [shape=Mdiamond, label="Start"] exit [shape=Msquare, label="Exit"] toolchain [label="Toolchain", shape=parallelogram, script="command -v cargo >/dev/null || { curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y && sudo ln -sf $HOME/.cargo/bin/* /usr/local/bin/; }; cargo --version 2>&1", max_retries=0] preflight_compile [label="Preflight Compile", shape=parallelogram, script="cargo check -q --workspace 2>&1", max_retries=0] preflight_lint [label="Preflight Lint", shape=parallelogram, script="cargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings 2>&1", max_retries=0] fix_lints [label="Fix Lints", prompt="The preflight lint step failed. Read the build output from context and fix all clippy lint warnings.", max_visits=3] implement [label="Implement", prompt="Read the plan file referenced in the goal and implement every step. Make all the code changes described in the plan. Use red/green TDD.", model="gpt-55", reasoning_effort="xhigh"] simplify_opus [label="Simplify (Opus)", prompt="@prompts/simplify.md"] simplify_gpt [label="Simplify (GPT-55)", prompt="@prompts/simplify.md", model="gpt-55"] verify [label="Verify", shape=parallelogram, script="git fetch origin main 2>&1 && git merge --no-edit --no-stat origin/main 2>&1 && cargo +nightly-2026-04-14 fmt --all 2>&1 && cargo dev docs refresh 2>&1 && cargo +nightly-2026-04-14 fmt --check --all 2>&1 && { command -v rg >/dev/null 2>&1 || { echo 'rg is required for verify'; exit 127; }; } && ! rg -n 'AuthMode::Disabled|RunAuthMethod|RunSubjectProvenance|\bActorRef\b|\bActorKind\b|AuthenticatedSubject|AuthenticatedService|AuthorizeRunScoped|AuthorizeRunBlob|AuthorizeStageArtifact|AuthorizeCommandLog|auth_method\s*==\s*\"disabled\"' lib/crates apps lib/packages docs/public/api-reference/fabro-api.yaml 2>&1 && cargo +nightly-2026-04-14 clippy --workspace --all-targets -- -D warnings 2>&1 && cargo nextest run --workspace --status-level slow --profile ci 2>&1 && cargo dev docs check 2>&1 && bun install --frozen-lockfile 2>&1 && (cd apps/fabro-web && bun run typecheck) 2>&1 && (cd apps/fabro-web && bun run test) 2>&1 && (cd lib/packages/fabro-api-client && bun run typecheck) 2>&1 && cargo dev build -- -p fabro-cli --release 2>&1", goal_gate=true, retry_target="fixup"] fixup [label="Fixup", prompt="The verify step failed. Read the build output from context and fix all format, clippy, Rust test, docs, TypeScript typecheck/test, and build failures.", max_visits=3] start -> toolchain toolchain -> preflight_compile [condition="outcome=succeeded"] toolchain -> exit preflight_compile -> preflight_lint [condition="outcome=succeeded"] preflight_compile -> exit preflight_lint -> implement [condition="outcome=succeeded"] preflight_lint -> fix_lints fix_lints -> preflight_lint implement -> simplify_opus -> simplify_gpt -> verify verify -> exit [condition="outcome=succeeded"] verify -> fixup fixup -> verify } ``` </details> ⚒️ Generated with [Fabro](https://fabro.sh) --------- Co-authored-by: Fabro <noreply@fabro.sh>		2026-05-25 15:49:57 -04:00
..
src	feat: Add approve/deny run controls to MCP and CLI (#400)	2026-05-25 15:49:57 -04:00
Cargo.toml	Stage-based pairing API and fabro_run_pair MCP tool (#344)	2026-05-21 21:57:55 -04:00