fix(agent-core): mark auto-approved plan exits as not user-reviewed - #1638
Conversation
In auto permission mode ExitPlanMode is approved without user involvement, but its result read "## Approved Plan:" exactly like a genuine user approval and the transcript showed a green "Approved" chip. The model treated that as a signal to start executing, even when the user had asked it to stop after planning. - Emit an "auto-approved, not user-reviewed" result with a note that execution follows the user's original instructions (v1 + v2). - Extend the auto-mode reminder: plan approvals are automatic and are not a user signal to proceed (v1 + v2). - Render an "Auto-approved" warning-toned chip in the TUI, keeping backward compatibility with the old result marker. - Document the Auto mode plan-exit behavior in interaction guides.
🦋 Changeset detectedLatest commit: 9f7f873 The changes in this PR will be included in the next version bump. This PR includes changesets to release 5 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 48575657ae
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
# Conflicts: # packages/agent-core-v2/test/tool/tool.test.ts
commit: |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 6b2e96f7bc
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…sion mode Address review feedback on the auto-approved plan exit change: - Branch the direct-execution output on the permission mode in both engines: only auto mode yields the "auto-approved, not user-reviewed" result and telemetry outcome. In manual / yolo modes the direct path means a configured or session allow/ask rule let the call through — an explicit user decision that keeps the user-approved output, the Approved transcript chip, and the approved outcome. - Move the v2 rationale out of the method body into the file header, per the agent-core-v2 comment convention. - Drop the absolute "only Auto mode" wording from the interaction guides (en/zh).
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 9f7f873d4e
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| } | ||
| const pathMatch = PLAN_SAVED_TO_RE.exec(output); | ||
| const path = pathMatch?.[1]?.trim(); | ||
| if (output.includes(AUTO_APPROVED_PLAN_MARKER)) { |
There was a problem hiding this comment.
When a genuinely user-approved plan body itself contains the heading ## Plan (auto-approved, not user-reviewed):, this whole-output includes check classifies the result as auto_approved; extractApprovedPlan also chooses that inner marker and drops everything before it from the rendered plan. In that scenario the transcript shows an Auto-approved chip even though the user approved the plan, so parse the wrapper marker position relative to ## Approved Plan: (or otherwise anchor it to the core-emitted header) instead of searching arbitrary plan content.
Useful? React with 👍 / 👎.
1 participant
Related Issue
None — this came from user feedback; the problem is explained below.
Problem
In auto permission mode, exiting plan mode is approved automatically without any user interaction. However, the
ExitPlanModetool result read## Approved Plan:— byte-identical to a genuine user approval in manual/yolo modes — and the transcript rendered a green "Approved" chip. The model read that as "the user approved, proceed" and started executing the plan even when the user had explicitly asked it to stop and summarize after planning, forcing the user to interrupt.What changed
agent-coreandagent-core-v2): the auto-approved path (the review-ask policy passes the call through in auto mode) now returns## Plan (auto-approved, not user-reviewed):plus a note that the user has NOT approved the plan and that whether to execute follows the user's original instructions. The user-reviewed path in manual/yolo modes is unchanged.ExitPlanModeis approved automatically without user review and that an auto-approved plan is not a signal from the user to start executing.Checklist
gen-changesetsskill, or this PR needs no changeset.gen-docsskill, or this PR needs no doc update.