[Improve] Move Auto tool approvals to Nightly Experiments

.changeset/nightly-auto-approvals.md

@@ -0,0 +1,7 @@
+---
+'@roomote/web': patch
+---
+
+<!-- audience: internal-nightly -->
+
+Move Auto tool approvals to Nightly Experiments and keep saved customer opt-ins disabled.

apps/web/src/components/settings/IntegrationToolAutoApprovalsNightlySetting.tsx

@@ -0,0 +1,32 @@
+'use client';
+
+import { ShieldQuestion, Switch } from '@/components/system';
+import { useDeploymentExperiment } from '@/hooks/useDeploymentExperiments';
+
+import { Section } from './Section';
+
+export function IntegrationToolAutoApprovalsNightlySetting() {
+  const { enabled, isLoading, isUpdating, setEnabled } =
+    useDeploymentExperiment(
+      'integrationToolAutoApprovals',
+      'Failed to update Auto tool approvals.',
+    );
+
+  return (
+    <Section icon={ShieldQuestion} title="Auto tool approvals">
+      <div className="flex gap-3">
+        <Switch
+          aria-label="Toggle Auto tool approvals"
+          checked={enabled}
+          disabled={isLoading || isUpdating}
+          onCheckedChange={setEnabled}
+        />
+        <p className="text-sm text-muted-foreground">
+          Expose the Auto-approval decisions card in Settings → Agent Guidance.
+          Jev is required for Auto to make decisions, and saved per-tool choices
+          continue to take priority.
+        </p>
+      </div>
+    </Section>
+  );
+}

apps/web/src/components/settings/pages/NightlyExperimentsPage.tsx

@@ -5,6 +5,7 @@ import {
   ExperimentSettingsControls,
   getExperimentSettingIds,
 } from '@/components/settings/experiment-settings-controls';
+import { IntegrationToolAutoApprovalsNightlySetting } from '@/components/settings/IntegrationToolAutoApprovalsNightlySetting';
 import { EmptyState, Moon, RetryableLoadError } from '@/components/system';
 import { useDeploymentExperiments } from '@/hooks/useDeploymentExperiments';
 
@@ -38,7 +39,11 @@ export function NightlyExperimentsPage() {
           description="There are no internal nightly controls available on this deployment."
         />
       ) : (
-        <ExperimentSettingsControls audience="internal-nightly" />
+        <>
+          {/* Auto's runtime-aware switch belongs only on this gated page. */}
+          <IntegrationToolAutoApprovalsNightlySetting />
+          <ExperimentSettingsControls audience="internal-nightly" />
+        </>
       )}
     </SettingsShell>
   );

apps/web/src/hooks/useDeploymentExperiments.ts

@@ -100,6 +100,12 @@ export function useDeploymentExperiments(
           queryKey: trpc.nightlyExperiments.dizzyEnabled.queryKey(),
         });
       }
+      if (isNightly && variables.id === 'integrationToolAutoApprovals') {
+        void queryClient.invalidateQueries({
+          queryKey:
+            trpc.nightlyExperiments.integrationToolAutoApprovalsEnabled.queryKey(),
+        });
+      }
     },
   };
 

apps/web/src/hooks/useIntegrationToolAutoApprovalsExperiment.ts

@@ -1,14 +1,28 @@
 'use client';
 
-import { useDeploymentExperiment } from './useDeploymentExperiments';
+import { useQuery } from '@tanstack/react-query';
+
+import { useAuthorizedUser } from '@/hooks/useUser';
+import { useTRPC } from '@/trpc/client';
 
 /**
- * Auto tool approvals are experimental; per-tool approvals are not. While
- * this is off, a tool nobody has made a choice about simply runs.
+ * Auto tool approvals are an internal nightly experiment; per-tool approvals
+ * are not. The runtime value is readable by members only on opted-in internal
+ * deployments, so ordinary deployments never query the admin-only settings
+ * procedure.
  */
 export function useIntegrationToolAutoApprovalsExperiment() {
-  return useDeploymentExperiment(
-    'integrationToolAutoApprovals',
-    'Failed to update Auto tool approvals.',
+  const { nightlyExperimentsEnabled } = useAuthorizedUser();
+  const trpc = useTRPC();
+  const query = useQuery(
+    trpc.nightlyExperiments.integrationToolAutoApprovalsEnabled.queryOptions(
+      undefined,
+      { enabled: nightlyExperimentsEnabled === true },
+    ),
   );
+
+  return {
+    enabled: nightlyExperimentsEnabled === true && query.data === true,
+    isLoading: nightlyExperimentsEnabled === true && query.isPending,
+  };
 }

apps/web/src/trpc/commands/deployment-experiments/index.ts

@@ -65,6 +65,21 @@ export async function getDizzyExperimentEnabledCommand(
   return (await getDeploymentExperiments()).dizzy;
 }
 
+/**
+ * Auto is deployment-wide runtime behavior, so signed-in users on an
+ * explicitly opted-in internal deployment may read its enabled state. Only
+ * admins can manage the switch or see the other nightly experiment values.
+ */
+export async function getIntegrationToolAutoApprovalsEnabledCommand(
+  auth: UserAuthSuccess,
+): Promise<boolean> {
+  if (auth.nightlyExperimentsEnabled !== true) {
+    throw new Error('Unauthorized');
+  }
+
+  return (await getDeploymentExperiments()).integrationToolAutoApprovals;
+}
+
 export async function setNightlyExperimentCommand(
   auth: UserAuthSuccess,
   input: { id: DeploymentExperimentId; enabled: boolean },