From ed7ba490b1faa02f53c93215a8f6f401167dbe79 Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Tue, 22 Sep 2026 03:24:32 +0000 Subject: [PATCH] fix(core): gate respond_agent_connection behind owner approval The respond_agent_connection builtin could flip a pending agent connection to approved without the target owner's YES/NO DM or authenticated API response. Treat it like other security-boundary builtins so the executor shows an approval card before the status change runs. Co-authored-by: cynarAI --- packages/core/src/action-approval.test.ts | 1 + packages/core/src/action-approval.ts | 3 +++ 2 files changed, 4 insertions(+) diff --git a/packages/core/src/action-approval.test.ts b/packages/core/src/action-approval.test.ts index 2060257..bc1674d 100644 --- a/packages/core/src/action-approval.test.ts +++ b/packages/core/src/action-approval.test.ts @@ -25,6 +25,7 @@ describe("toolRequiresApproval", () => { expect(toolRequiresApproval("delete_bot", false)).toBe(true); expect(toolRequiresApproval("archive_bot", false)).toBe(true); expect(toolRequiresApproval("cloud_agent_launch", false)).toBe(true); + expect(toolRequiresApproval("respond_agent_connection", false)).toBe(true); expect(toolRequiresApproval("create_space", false)).toBe(true); expect(toolRequiresExplicitApproval("create_space")).toBe(true); expect(toolRequiresExplicitApproval("archive_bot")).toBe(false); diff --git a/packages/core/src/action-approval.ts b/packages/core/src/action-approval.ts index 01f3e5e..5cf147f 100644 --- a/packages/core/src/action-approval.ts +++ b/packages/core/src/action-approval.ts @@ -32,6 +32,9 @@ const APPROVAL_REQUIRED_BUILTIN_TOOLS = new Set([ "cloud_agent_launch", "cloud_agent_reply", "cloud_agent_cancel", + // Owner-gated: approving a pending agent connection must not bypass the + // YES/NO DM or authenticated API path via an unattended model call. + "respond_agent_connection", ]); const EXPLICIT_APPROVAL_BUILTIN_TOOLS = new Set(["create_space"]);