feat(sessions): persist the answer half of every approval gate

Author: mmabrouk

api/oss/src/apis/fastapi/sessions/models.py

@@ -106,6 +106,7 @@ class SessionInteractionTransitionRequest(BaseModel):
     session_id: str
     token: str
     status: SessionInteractionStatus
+    resolution: Optional[Dict[str, Any]] = None
 
 
 class SessionInteractionCancelStaleRequest(BaseModel):

api/oss/src/apis/fastapi/sessions/router.py

@@ -645,6 +645,7 @@ async def transition_interaction(
                     session_id=body.session_id,
                     token=body.token,
                     status=body.status,
+                    resolution=body.resolution,
                 ),
             )
         except InteractionNotFound:

api/oss/src/core/sessions/interactions/dtos.py

@@ -68,6 +68,7 @@ class SessionInteractionTransition(BaseModel):
     session_id: str
     token: str
     status: SessionInteractionStatus
+    resolution: Optional[Dict[str, Any]] = None
 
 
 class SessionInteractionQuery(BaseModel):

api/oss/src/dbs/postgres/sessions/interactions/dao.py

@@ -2,7 +2,8 @@
 from typing import List, Optional
 from uuid import UUID
 
-from sqlalchemy import delete as sa_delete, func, select, update as sa_update
+from sqlalchemy import cast, delete as sa_delete, func, select, update as sa_update
+from sqlalchemy.dialects.postgresql import JSON, JSONB, array
 from sqlalchemy.exc import IntegrityError
 
 from oss.src.core.sessions.interactions.dtos import (
@@ -97,6 +98,24 @@ async def transition_interaction(
             # Only non-terminal interactions transition: pending (responded|resolved|
             # cancelled) and responded (resolved, when the runner consumes an API-plane
             # answer). resolved/cancelled are terminal.
+            transition_values = {
+                "status": transition.status.value,
+                "updated_at": datetime.now(timezone.utc),
+            }
+            if transition.resolution is not None:
+                # Preserve request/references while atomically adding the answer under the guard.
+                transition_values["data"] = cast(
+                    func.jsonb_set(
+                        func.coalesce(
+                            cast(SessionInteractionDBE.data, JSONB),
+                            cast({}, JSONB),
+                        ),
+                        array(["resolution"]),
+                        cast(transition.resolution, JSONB),
+                        True,
+                    ),
+                    JSON,
+                )
             stmt = (
                 sa_update(SessionInteractionDBE)
                 .where(
@@ -105,10 +124,7 @@ async def transition_interaction(
                     SessionInteractionDBE.token == transition.token,
                     SessionInteractionDBE.status.in_(("pending", "responded")),
                 )
-                .values(
-                    status=transition.status.value,
-                    updated_at=datetime.now(timezone.utc),
-                )
+                .values(**transition_values)
                 .returning(SessionInteractionDBE)
             )
             result = await session.execute(stmt)

api/oss/tests/pytest/unit/sessions/test_interactions_transition_update.py

@@ -0,0 +1,80 @@
+from uuid import uuid4
+
+from sqlalchemy.dialects import postgresql
+
+from oss.src.core.sessions.interactions.dtos import (
+    SessionInteractionStatus,
+    SessionInteractionTransition,
+)
+from oss.src.dbs.postgres.sessions.interactions.dao import SessionInteractionsDAO
+
+
+class _Result:
+    def scalar_one_or_none(self):
+        return None
+
+
+class _Session:
+    def __init__(self):
+        self.statement = None
+
+    async def execute(self, statement):
+        self.statement = statement
+        return _Result()
+
+    async def commit(self):
+        return None
+
+
+class _SessionContext:
+    def __init__(self, session):
+        self.session = session
+
+    async def __aenter__(self):
+        return self.session
+
+    async def __aexit__(self, exc_type, exc, traceback):
+        return False
+
+
+class _Engine:
+    def __init__(self, session):
+        self._session = session
+
+    def session(self):
+        return _SessionContext(self._session)
+
+
+async def _transition_statement(resolution=None):
+    session = _Session()
+    dao = SessionInteractionsDAO(engine=_Engine(session))
+    await dao.transition_interaction(
+        transition=SessionInteractionTransition(
+            project_id=uuid4(),
+            session_id="session-1",
+            token="token-1",
+            status=SessionInteractionStatus.resolved,
+            resolution=resolution,
+        )
+    )
+    return session.statement
+
+
+async def test_resolution_update_preserves_existing_data_with_jsonb_set():
+    resolution = {"verdict": "approved", "tool_call_id": "tool-1"}
+    statement = await _transition_statement(resolution)
+    compiled = statement.compile(dialect=postgresql.dialect())
+    set_clause = str(compiled).split(" WHERE ", maxsplit=1)[0]
+
+    assert "jsonb_set" in set_clause
+    assert "CAST(session_interactions.data AS JSONB)" in set_clause
+    assert resolution in compiled.params.values()
+
+
+async def test_transition_without_resolution_does_not_write_data():
+    statement = await _transition_statement()
+    set_clause = str(statement.compile(dialect=postgresql.dialect())).split(
+        " WHERE ", maxsplit=1
+    )[0]
+
+    assert "data=" not in set_clause

api/oss/tests/pytest/unit/sessions/test_transition_interaction_resolution.py

@@ -0,0 +1,77 @@
+from unittest.mock import AsyncMock, patch
+from uuid import uuid4
+
+from fastapi import FastAPI, Request
+
+from oss.src.apis.fastapi.sessions.models import SessionInteractionTransitionRequest
+from oss.src.apis.fastapi.sessions.router import InteractionsRouter
+from oss.src.core.sessions.interactions.dtos import (
+    SessionInteraction,
+    SessionInteractionData,
+    SessionInteractionKind,
+    SessionInteractionStatus,
+)
+
+
+def _make_authed_request(app: FastAPI, project_id, user_id) -> Request:
+    request = Request(
+        {
+            "type": "http",
+            "method": "POST",
+            "path": "/sessions/interactions/transition",
+            "headers": [],
+            "app": app,
+        }
+    )
+    request.state.project_id = project_id
+    request.state.user_id = user_id
+    return request
+
+
+async def test_transition_route_passes_resolution_to_the_domain_transition():
+    project_id = uuid4()
+    user_id = uuid4()
+    captured = []
+
+    class _InteractionsService:
+        async def transition_interaction(self, *, transition):
+            captured.append(transition)
+            return SessionInteraction(
+                project_id=transition.project_id,
+                session_id=transition.session_id,
+                token=transition.token,
+                kind=SessionInteractionKind.user_approval,
+                status=transition.status,
+                data=SessionInteractionData(resolution=transition.resolution),
+            )
+
+    router = InteractionsRouter(
+        interactions_service=_InteractionsService(),
+        workflows_service=AsyncMock(),
+        respond_task=AsyncMock(),
+    )
+    body = SessionInteractionTransitionRequest(
+        session_id="session-1",
+        token="approval-token",
+        status=SessionInteractionStatus.resolved,
+        resolution={"verdict": "denied", "tool_call_id": "tool-1"},
+    )
+
+    with patch(
+        "oss.src.apis.fastapi.sessions.router.check_action_access",
+        new_callable=AsyncMock,
+        return_value=True,
+    ):
+        response = await router.transition_interaction(
+            request=_make_authed_request(FastAPI(), project_id, user_id),
+            body=body,
+        )
+
+    assert len(captured) == 1
+    assert captured[0].resolution == {
+        "verdict": "denied",
+        "tool_call_id": "tool-1",
+    }
+    assert response.interaction is not None
+    assert response.interaction.data is not None
+    assert response.interaction.data.resolution == captured[0].resolution

api/oss/tests/pytest/unit/sessions/test_wp5_dao_fanout.py

@@ -22,8 +22,11 @@
 
 from oss.src.core.sessions.interactions.dtos import (
     SessionInteractionCreate,
+    SessionInteractionData,
     SessionInteractionKind,
     SessionInteractionQuery,
+    SessionInteractionStatus,
+    SessionInteractionTransition,
 )
 from oss.src.core.mounts.dtos import MountCreate
 import oss.src.models.db_models  # noqa: F401
@@ -143,6 +146,74 @@ def mounts_dao():
     return MountsDAO(engine=get_transactions_engine())
 
 
+# ---------------------------------------------------------------------------
+# SessionInteractionsDAO transition resolution
+# ---------------------------------------------------------------------------
+
+
+async def test_interaction_transition_preserves_data_and_optionally_adds_resolution(
+    interactions_dao, project
+):
+    project_id = project["project_id"]
+    session_id = f"interaction-resolution-{uuid.uuid4().hex[:8]}"
+    request = {"tool": "bash", "args": {"command": "ls"}}
+
+    await interactions_dao.create_interaction(
+        project_id=project_id,
+        user_id=None,
+        interaction=SessionInteractionCreate(
+            project_id=project_id,
+            session_id=session_id,
+            token="approval-token",
+            kind=SessionInteractionKind.user_approval,
+            data=SessionInteractionData(request=request),
+        ),
+    )
+    transitioned = await interactions_dao.transition_interaction(
+        transition=SessionInteractionTransition(
+            project_id=project_id,
+            session_id=session_id,
+            token="approval-token",
+            status=SessionInteractionStatus.resolved,
+            resolution={"verdict": "approved", "tool_call_id": "tool-1"},
+        )
+    )
+
+    assert transitioned is not None
+    assert transitioned.status == SessionInteractionStatus.resolved
+    assert transitioned.data is not None
+    assert transitioned.data.request == request
+    assert transitioned.data.resolution == {
+        "verdict": "approved",
+        "tool_call_id": "tool-1",
+    }
+
+    await interactions_dao.create_interaction(
+        project_id=project_id,
+        user_id=None,
+        interaction=SessionInteractionCreate(
+            project_id=project_id,
+            session_id=session_id,
+            token="client-token",
+            kind=SessionInteractionKind.client_tool,
+            data=SessionInteractionData(request=request),
+        ),
+    )
+    transitioned_without_resolution = await interactions_dao.transition_interaction(
+        transition=SessionInteractionTransition(
+            project_id=project_id,
+            session_id=session_id,
+            token="client-token",
+            status=SessionInteractionStatus.resolved,
+        )
+    )
+
+    assert transitioned_without_resolution is not None
+    assert transitioned_without_resolution.data is not None
+    assert transitioned_without_resolution.data.request == request
+    assert transitioned_without_resolution.data.resolution is None
+
+
 # ---------------------------------------------------------------------------
 # SessionInteractionsDAO.delete_by_session_id — new hard delete
 # ---------------------------------------------------------------------------

sdks/python/agenta/sdk/agents/wire_models.py

@@ -378,7 +378,8 @@ class WireEvent(_WireModel):
     the forward-compatible event types the runner may add, which contradicts the "drop unknown"
     guarantee. The known ``type`` values are documented for readers, not enforced: ``message``,
     ``thought``, the ``message_*`` / ``reasoning_*`` lifecycle trios, ``tool_call``,
-    ``tool_result``, ``interaction_request``, ``data``, ``file``, ``usage``, ``error``, ``done``.
+    ``tool_result``, ``interaction_request``, ``interaction_response``, ``data``, ``file``,
+    ``usage``, ``error``, ``done``.
     """
 
     type: Optional[str] = None

services/runner/src/engines/sandbox_agent/acp-interactions.ts

@@ -69,7 +69,10 @@ export interface AttachPermissionResponderInput {
     kind: "user_approval" | "client_tool",
   ) => void;
   /** Called after a stored decision was successfully forwarded to the harness. */
-  onResolveInteraction?: (token: string) => void;
+  onResolveInteraction?: (
+    token: string,
+    verdict?: { approved: boolean; toolCallId: string },
+  ) => void;
   /**
    * Fires for EVERY parkable permission gate (a Claude ACP gate or a Pi ACP gate) that
    * resolves to pendingApproval. Keep-alive uses it to record every parked permission id /
@@ -223,9 +226,12 @@ export function attachPermissionResponder({
   };
 
   // Resolve the durable row this gate created, if it created one.
-  const resolveIfCreated = (id: string): void => {
+  const resolveIfCreated = (
+    id: string,
+    verdict?: { approved: boolean; toolCallId: string },
+  ): void => {
     if (!createdInteractionIds.delete(id)) return;
-    onResolveInteraction?.(id);
+    onResolveInteraction?.(id, verdict);
   };
 
   const replyPermission = async (
@@ -254,7 +260,10 @@ export function attachPermissionResponder({
       onPause?.();
       return;
     }
-    resolveIfCreated(id);
+    resolveIfCreated(id, {
+      approved: decision === "allow",
+      toolCallId: toolCallId ?? id,
+    });
   };
 
   const replyClientTool = async (