improvement(copilot): refuse approval-gated tools on the in-band lane by waleedlatif1 · Pull Request #8044 · simstudioai/sim

waleedlatif1 · 2026-09-20T00:12:19Z

Summary

Copilot's tool-approval gate is scaffolding today — COPILOT_TOOL_PERMISSIONS_ENABLED is off by default, so nothing is gated on any lane. This changes no behavior while it stays off.
The gate is built only on the dispatch lane, which holds a call against a streaming context and a decision row, then deliberately declines to dispatch anything the mothership marks in-band. Those calls run via POST /api/copilot/tools/execute, which has neither a context nor a waiter — so enabling the flag would gate the foreground and leave background lanes ungated. A gate that looks enforced but is not is worse than no gate.
Adds toolRequiresApprovalLane next to toolCallNeedsApproval so the covered tool set is defined once, and refuses a gated tool at the in-band route before it runs.
Refuses rather than blocks: a background lane must never hang on a prompt with no row behind it. The mothership takes the checkpoint lane, where the gate lives.
The check deliberately ignores the stored auto-allow list. An auto-allowed tool sent to the checkpoint lane is admitted there without prompting anyone, so reading it here would add a database read to every in-band call to reach the same place by a longer route.
Records on the flag itself that the gate is a property of the lane, not only of the tool, since that doc comment is what gets read before enabling it.

Type of Change

Bug fix

Testing

New tests: the in-band route refuses a gated tool without executing it when permissions are enabled; an ungated tool still runs; a gated tool runs unchanged while permissions are disabled (pinning that this ships inert). Unit tests for toolRequiresApprovalLane across flag/catalog combinations.
Verified the refusal test fails when the guard is removed.
vitest run app/api/copilot lib/copilot — 2642 passed, 3 skipped
tsc --noEmit clean, bun run lint clean, check:audits 47/47, docs-manifest:check in sync, and the workflow's inline env-flag audit passes (env-flags.ts changed)

Checklist

Code follows project style guidelines
Self-reviewed my changes
Tests added/updated and passing
No new warnings introduced
I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

Copilot's approval gate is scaffolding today: COPILOT_TOOL_PERMISSIONS_ENABLED is off by default, so nothing is gated on any lane. It is built only on the dispatch lane, which holds a call against a streaming context and a decision row and then declines to dispatch anything the mothership marks in-band. Those calls run via POST /api/copilot/tools/execute, which has no context and no waiter, so turning the flag on would gate the foreground and leave background lanes ungated — a gate that looks enforced but is not. Add toolRequiresApprovalLane next to toolCallNeedsApproval so the covered tool set is defined once, and refuse a gated tool at the in-band route before it runs. Refuse rather than block: a background lane must never hang on a prompt with no row behind it. The check deliberately ignores the stored auto-allow list — an auto-allowed tool sent to the checkpoint lane is admitted there without prompting anyone, so reading it here would only add a database read to reach the same place. Inert while the flag is off, which is the state this ships in; a test pins that. Also record on the flag itself that the gate is a property of the lane, since that is what the next person reads before enabling it.

vercel · 2026-09-20T00:12:25Z

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
docs	Skipped		Sep 20, 2026 12:20am UTC

cubic-dev-ai

All reported issues were addressed across 5 files

_{Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic}

greptile-apps · 2026-09-20T00:15:57Z

Confidence Score: 5/5

The PR appears safe to merge; the prior import-side-effect issue is fixed and no new actionable failures remain.

Summary

This PR prevents approval-gated Copilot tools from executing through the in-band route when tool permissions are enabled.

Adds a dependency-light lane predicate beside the tool router.
Refuses gated in-band calls before tool execution while preserving current behavior when permissions are disabled.
Adds route and router coverage for gated, ungated, disabled-flag, and unknown-tool cases.
Moves the predicate away from the permission persistence module, resolving the previously reported unnecessary Pub/Sub initialization.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  Call[Copilot tool call] --> Lane{Execution lane}
  Lane -->|Dispatch/checkpoint| Gate[Approval gate with streaming context]
  Gate --> Decision{Approval required?}
  Decision -->|No or already allowed| Execute[Execute tool]
  Decision -->|Yes| Wait[Wait for user decision]
  Lane -->|In-band| Predicate{Permissions enabled and tool gated?}
  Predicate -->|No| Execute
  Predicate -->|Yes| Refuse[Refuse without execution]

_{Reviews (2) · Last reviewed commit: "improvement(copilot): move the approval-..."}

…l router Importing the dispatch gate module for a one-line predicate pulled the permission persistence layer in with it, whose module body opens a pub/sub channel — two Redis clients and a channel subscription — in every process that loads the in-band route. Move toolRequiresApprovalLane to tool-executor/router.ts, which imports only the catalog. The route already imported @/lib/copilot/tool-executor for ensureHandlersRegistered, so the guard now costs no new import edge at all. The dispatch gate keeps a pointer to it. Its flag-and-catalog behavior is covered in the router tests against the real flag and the real catalog; the route tests keep to what the route does with the answer.

waleedlatif1 · 2026-09-20T00:21:21Z

@greptile

waleedlatif1 · 2026-09-20T00:21:22Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-09-20T00:21:27Z

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

No issues found across 7 files

Confidence score: 5/5

Automated review surfaced no issues in the provided summaries.
No files require special attention.

_{Re-trigger cubic}

waleedlatif1 mentioned this pull request Sep 20, 2026

v0.8.48: search improvements, file versions #8008

Closed

cubic-dev-ai Bot reviewed Sep 20, 2026

View reviewed changes

Comment thread apps/sim/app/api/copilot/tools/execute/route.ts

Comment thread apps/sim/lib/copilot/request/tools/permission.ts Outdated

greptile-apps Bot reviewed Sep 20, 2026

View reviewed changes

Comment thread apps/sim/app/api/copilot/tools/execute/route.ts Outdated

vercel Bot temporarily deployed to Preview September 20, 2026 00:20 Inactive

cubic-dev-ai Bot reviewed Sep 20, 2026

View reviewed changes

waleedlatif1 merged commit 3868bf9 into staging Sep 20, 2026
34 checks passed

waleedlatif1 deleted the sec/copilot-inband-approval-guard branch September 20, 2026 00:41

waleedlatif1 mentioned this pull request Sep 21, 2026

v0.8.48: prewarm, tin pg extensions, knowledge search speedups, ui consolidation, keyword search speedups #8096

Merged

Navigation Menu

improvement(copilot): refuse approval-gated tools on the in-band lane - #8044

improvement(copilot): refuse approval-gated tools on the in-band lane#8044
waleedlatif1 merged 2 commits into
stagingfrom
sec/copilot-inband-approval-guard

waleedlatif1 commented Sep 20, 2026

Uh oh!

vercel Bot commented Sep 20, 2026 •

edited

Loading

Uh oh!

cubic-dev-ai Bot left a comment •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

greptile-apps Bot commented Sep 20, 2026 •

edited

Loading

Uh oh!

Uh oh!

waleedlatif1 commented Sep 20, 2026

Uh oh!

waleedlatif1 commented Sep 20, 2026

Uh oh!

cubic-dev-ai Bot commented Sep 20, 2026

Uh oh!

cubic-dev-ai Bot left a comment

Uh oh!

Uh oh!

This branch was previously deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

waleedlatif1 commented Sep 20, 2026

Summary

Type of Change

Testing

Checklist

Uh oh!

vercel Bot commented Sep 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

greptile-apps Bot commented Sep 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Confidence Score: 5/5

Summary

Uh oh!

Uh oh!

waleedlatif1 commented Sep 20, 2026

Uh oh!

waleedlatif1 commented Sep 20, 2026

Uh oh!

cubic-dev-ai Bot commented Sep 20, 2026

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

This branch was previously deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

vercel Bot commented Sep 20, 2026 •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading

greptile-apps Bot commented Sep 20, 2026 •

edited

Loading