From 291072446de1c4617d621df2cfd6be36b4c5faf2 Mon Sep 17 00:00:00 2001
From: gsxdsm <gsxdsm@users.noreply.github.com>
Date: Wed, 3 Jun 2026 15:26:29 -0700
Subject: [PATCH] feat(workflows): enforce node autoApprove by bypassing the
 CLI approval pause
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The node "Auto-approve requests" toggle was captured but unused. The only
human-approval pause reachable from a custom node is the CLI first-run
trust-on-first-use gate (review-style nodes run as ephemeral readonly agents
with no permission gate), so autoApprove now bypasses that pause — a superset
of the CLI-specific cliSkipApproval flag. The inspector explains the effect
when the toggle is on.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .../app/components/WorkflowNodeEditor.tsx     |  5 +++++
 packages/engine/src/executor.ts               | 21 ++++++++++++-------
 2 files changed, 18 insertions(+), 8 deletions(-)

diff --git a/packages/dashboard/app/components/WorkflowNodeEditor.tsx b/packages/dashboard/app/components/WorkflowNodeEditor.tsx
index 4e4b13ba4c..c9c1cde39a 100644
--- a/packages/dashboard/app/components/WorkflowNodeEditor.tsx
+++ b/packages/dashboard/app/components/WorkflowNodeEditor.tsx
@@ -527,6 +527,11 @@ function InnerEditor({
                     />
                     <span>Auto-approve requests</span>
                   </label>
+                  {Boolean(selectedNode.data.config?.autoApprove) && (
+                    <p className="wf-inspector-note">
+                      Runs without pausing for approval — e.g. a CLI command executes on its first run without waiting for your sign-off.
+                    </p>
+                  )}
 
                   <label className="wf-field">
                     <span>Max retries</span>
diff --git a/packages/engine/src/executor.ts b/packages/engine/src/executor.ts
index b1b56c601a..dd33ebd54e 100644
--- a/packages/engine/src/executor.ts
+++ b/packages/engine/src/executor.ts
@@ -3503,16 +3503,21 @@ export class TaskExecutor {
       const rawCommand = rawCliCommand;
       if (rawCommand) {
         // Arbitrary command: gated by trust-on-first-use approval unless the
-        // node explicitly opts out (cliSkipApproval). The exact command string
-        // must otherwise have been approved by the user.
+        // node explicitly opts out. Two node flags bypass the pause:
+        //   - cliSkipApproval: CLI-specific "skip first-run approval".
+        //   - autoApprove:     the node's general "Auto-approve requests"
+        //     toggle. The only human-approval pause reachable from a custom
+        //     node is this CLI gate (review-style nodes run as ephemeral
+        //     readonly agents with no permission gate), so honoring it here is
+        //     what makes that toggle actually do something.
+        // The exact command string must otherwise have been approved by the user.
         //
-        // SECURITY: cliSkipApproval is an intentional project-owner-only escape
-        // hatch. It is only reachable by someone who can author/edit a workflow
+        // SECURITY: both flags are intentional project-owner-only escape hatches.
+        // They are only reachable by someone who can author/edit a workflow
         // definition for this project — the same trust boundary that already
-        // lets them add named scripts. It is NOT an untrusted-input surface.
-        // (Aligned with autoApprove, which is likewise gated by workflow
-        // authorship; neither is enforced at the IR-validation layer.)
-        const skipApproval = cfg.cliSkipApproval === true;
+        // lets them add named scripts. They are NOT untrusted-input surfaces,
+        // and neither is enforced at the IR-validation layer.
+        const skipApproval = cfg.cliSkipApproval === true || cfg.autoApprove === true;
         if (!skipApproval && !(await this.store.isWorkflowCliCommandApproved(rawCommand))) {
           return this.pauseForCliApproval(node, live, rawCommand);
         }