feat(agent-applications): decide principal approvals via the ingress

packages/api-client/src/posthog-client.ts

@@ -4672,6 +4672,32 @@ export class PostHogAPIClient {
  });
  }
 
+ /**
+ * Decide a `principal`-type tool approval at the ingress, as the session
+ * principal. The ingress authenticates the preview token / passthrough bearer
+ * and enforces principal-match — this is the session owner clearing their own
+ * gated call, not the owner-console (Django) decision path. `agent`-type
+ * approvals are NOT decidable here; they go through `decideAgentApproval`.
+ */
+ async decideAgentApprovalViaIngress(
+ ingressBaseUrl: string,
+ approvalId: string,
+ body: DecideApprovalRequest,
+ previewToken?: string | null,
+ ): Promise<{ ok: boolean; state: string }> {
+ const url = new URL(
+ `${ingressBaseUrl.replace(/\/$/, "")}/approvals/${encodeURIComponent(approvalId)}/decide`,
+ );
+ const response = await this.api.fetcher.fetch({
+ method: "post",
+ url,
+ path: url.pathname,
+ parameters: previewTokenHeader(previewToken),
+ overrides: { body: JSON.stringify(body) },
+ });
+ return (await response.json()) as { ok: boolean; state: string };
+ }
+
  /** Return a client-tool result to an open session. */
  async sendAgentClientToolResult(
  ingressBaseUrl: string,

packages/core/src/agent-chat/agentChatService.ts

@@ -1,4 +1,5 @@
 import type { PostHogAPIClient } from "@posthog/api-client/posthog-client";
+import type { DecideApprovalRequest } from "@posthog/shared/agent-platform-types";
 import { injectable } from "inversify";
 import { agentChatStore } from "./agentChatStore";
 import type {
@@ -463,6 +464,29 @@ export class AgentChatService {
  }
  }
 
+ /**
+ * Decide a `principal`-type tool approval for this chat's session at the
+ * ingress, carrying the session's preview token so the ingress can
+ * principal-match. On approve the runner wakes, dispatches the tool, and the
+ * open `/listen` stream resumes the chat naturally — same as `/send`.
+ */
+ async decideApproval(
+ client: PostHogAPIClient,
+ session: AgentChatSession,
+ approvalId: string,
+ body: DecideApprovalRequest,
+ ): Promise<void> {
+ const rt = this.runtime(session);
+ await this.withPreviewToken(client, rt, session, (token) =>
+ client.decideAgentApprovalViaIngress(
+ session.ingressBaseUrl,
+ approvalId,
+ body,
+ token,
+ ),
+ );
+ }
+
  /**
  * Resolve an interactive client tool (set_secret) once the user submits its
  * form: post the outcome via `/send` (waking the parked session) and make sure

packages/shared/src/agent-platform-types.ts

@@ -417,6 +417,19 @@ export interface AgentFleetLiveSessionsResponse {
  results: AgentFleetLiveSessionSummary[];
 }
 
+/**
+ * Who clears a gated call. `principal` = the session's own principal decides at
+ * the ingress (generic identity match); `agent` = the owning team's admins
+ * decide in the console. Mirrors `ApprovalType` in agent-shared `spec.ts`.
+ */
+export type AgentApprovalType = "principal" | "agent";
+
+/** Resolved approval policy stamped on the request at queue time. */
+export interface AgentApproverScope {
+ type: AgentApprovalType;
+ allow_edit: boolean;
+}
+
 export interface AgentApprovalRequest {
  id: string;
  session_id: string;
@@ -429,7 +442,7 @@ export interface AgentApprovalRequest {
  proposed_args: Record<string, unknown>;
  decided_args: Record<string, unknown> | null;
  assistant_message: Record<string, unknown>;
- approver_scope: Record<string, unknown>;
+ approver_scope: AgentApproverScope;
  state: AgentApprovalRequestState;
  decision_by: string | null;
  decision_at: string | null;

packages/ui/src/features/agent-applications/agent-builder/AgentBuilderDock.tsx

@@ -272,6 +272,7 @@ export function AgentBuilderDock() {
  <AgentChatPendingApprovalCard
  idOrSlug={AGENT_BUILDER_SLUG}
  approval={pendingApproval}
+ decide={chat.decideApproval}
  />
  ) : null
  }

packages/ui/src/features/agent-applications/components/AgentChatPane.tsx

@@ -212,6 +212,7 @@ export function AgentChatPane({
  <AgentChatPendingApprovalCard
  idOrSlug={idOrSlug}
  approval={pendingApproval}
+ decide={chat.decideApproval}
  />
  ) : null
  }

packages/ui/src/features/agent-applications/components/AgentChatPendingApprovalCard.tsx

@@ -1,29 +1,68 @@
 import { ArrowSquareOutIcon, LockKeyIcon } from "@phosphor-icons/react";
 import { formatRelativeTimeShort } from "@posthog/shared";
-import type { AgentApprovalRequest } from "@posthog/shared/agent-platform-types";
+import type {
+ AgentApprovalRequest,
+ DecideApprovalRequest,
+} from "@posthog/shared/agent-platform-types";
 import { Badge } from "@posthog/ui/primitives/Badge";
+import { toast } from "@posthog/ui/primitives/toast";
 import { Flex, Text } from "@radix-ui/themes";
+import { useMutation, useQueryClient } from "@tanstack/react-query";
 import { Link } from "@tanstack/react-router";
-import { useDecideAgentApproval } from "../hooks/useDecideAgentApproval";
+import { useAuthStateValue } from "../../auth/store";
 import { approvalStateColor, approvalStateLabel } from "../utils/format";
 import { AgentApprovalDecisionForm } from "./AgentApprovalDecisionForm";
 import { ArgsSection } from "./AgentApprovalDetail";
 
 /**
  * Inline pending-approval card surfaced in the live chat preview / agent
  * builder dock. Renders between the conversation and the composer when the
- * agent has paused on an approval-gated tool call; deciding here reuses the
- * standard `useDecideAgentApproval` mutation, and the SSE follow-up resumes
- * the chat naturally.
+ * agent has paused on an approval-gated tool call.
+ *
+ * Decision routing follows the approval `type`:
+ * - `principal` (the default) — the person driving this chat IS the session
+ * principal, so they decide right here. The decision posts to the ingress
+ * via the chat session's `decide` (principal-match, not the owner console),
+ * and the open `/listen` stream resumes the chat on approve.
+ * - `agent` — an owner/admin must decide in the console; the card shows that
+ * and links to the Approvals view rather than offering buttons.
  */
 export function AgentChatPendingApprovalCard({
  idOrSlug,
  approval,
+ decide,
 }: {
  idOrSlug: string;
  approval: AgentApprovalRequest;
+ /** Chat-session decide (ingress, principal-match) from `useAgentChat`. */
+ decide: (approvalId: string, body: DecideApprovalRequest) => Promise<void>;
 }) {
- const decide = useDecideAgentApproval(idOrSlug);
+ const queryClient = useQueryClient();
+ const projectId = useAuthStateValue((state) => state.currentProjectId);
+ const isOwnerGate = approval.approver_scope?.type === "agent";
+
+ const mutation = useMutation<void, Error, DecideApprovalRequest>({
+ mutationFn: (body) => decide(approval.id, body),
+ onSuccess: (_data, body) => {
+ toast.success(body.decision === "approve" ? "Approved" : "Rejected", {
+ description:
+ body.decision === "approve"
+ ? "Dispatched to the agent."
+ : "The agent will see the rejection.",
+ });
+ // Clear the card now rather than waiting for the 2s poll; the server-side
+ // row has flipped and the stream resumes the chat on approve.
+ void queryClient.invalidateQueries({
+ queryKey: ["agent-applications", "approvals", projectId, idOrSlug],
+ });
+ },
+ onError: (err) => {
+ toast.error("Decision failed", {
+ description: err instanceof Error ? err.message : undefined,
+ });
+ },
+ });
+
  return (
  <div className="shrink-0 border-(--amber-6) border-t bg-(--amber-2) px-4 pt-3 pb-2">
  <Flex align="start" justify="between" gap="3" className="mb-2">
@@ -36,7 +75,7 @@ export function AgentChatPendingApprovalCard({
  <Badge color={approvalStateColor(approval.state)}>
  {approvalStateLabel(approval.state)}
  </Badge>
- <Text className="truncate font-medium text-[12.5px] text-gray-12 [font-family:var(--font-mono)]">
+ <Text className="truncate font-medium font-mono text-[12.5px] text-gray-12">
  {approval.tool_name}
  </Text>
  </Flex>
@@ -55,18 +94,25 @@ export function AgentChatPendingApprovalCard({
  </Link>
  </Flex>
  <ArgsSection label="Proposed arguments" args={approval.proposed_args} />
- <AgentApprovalDecisionForm
- approval={approval}
- busy={decide.isPending}
- error={
- decide.isError
- ? decide.error instanceof Error
- ? decide.error.message
- : "Decision failed"
- : null
- }
- onSubmit={(body) => decide.mutate({ approvalId: approval.id, body })}
- />
+ {isOwnerGate ? (
+ <Text className="text-[11.5px] text-gray-10">
+ This call needs an owner or admin to approve it in the console — open
+ it in Approvals above.
+ </Text>
+ ) : (
+ <AgentApprovalDecisionForm
+ approval={approval}
+ busy={mutation.isPending}
+ error={
+ mutation.isError
+ ? mutation.error instanceof Error
+ ? mutation.error.message
+ : "Decision failed"
+ : null
+ }
+ onSubmit={(body) => mutation.mutate(body)}
+ />
+ )}
  </div>
  );
 }

packages/ui/src/features/agent-applications/hooks/useAgentChat.ts

@@ -7,6 +7,7 @@ import {
  type ClientToolOutcome,
 } from "@posthog/core/agent-chat/identifiers";
 import { useService } from "@posthog/di/react";
+import type { DecideApprovalRequest } from "@posthog/shared/agent-platform-types";
 import { useAuthenticatedClient } from "@posthog/ui/features/auth/authClient";
 import { toast } from "@posthog/ui/primitives/toast";
 import { useCallback, useEffect, useMemo, useRef } from "react";
@@ -134,6 +135,17 @@ export function useAgentChat({
  [service, client, session, ingressBaseUrl],
  );
 
+ // Decide a `principal`-type tool approval for this chat at the ingress (the
+ // session owner clears their own gated call). The open stream resumes the
+ // chat on approve.
+ const decideApproval = useCallback(
+ (approvalId: string, body: DecideApprovalRequest): Promise<void> =>
+ ingressBaseUrl
+ ? service.decideApproval(client, session, approvalId, body)
+ : Promise.resolve(),
+ [service, client, session, ingressBaseUrl],
+ );
+
  const resolveInteractiveTool = useCallback(
  (
  callId: string,
@@ -165,6 +177,7 @@ export function useAgentChat({
  resume,
  newChat,
  resolveInteractiveTool,
+ decideApproval,
  };
 }