[eric] approvals: persist tool policy on Always-approve (set_always_allow through the approval path)

backend/apps/agents/agent_manager.py

@@ -23,6 +23,7 @@ from backend.apps.tools_lib.tools_lib import (
     refresh_airtable_token,
     refresh_google_token,
     refresh_hubspot_token,
+    save_builtin_permissions,
     save_trusted_sensitive_paths,
 )
 from backend.config.paths import SESSIONS_DIR
@@ -788,6 +789,17 @@ class AgentManager:
                 except Exception:
                     logger.exception("Failed to persist trusted sensitive path")
 
+            # "Always approve" button: persist the tool's policy so it stops
+            # prompting. The guards above (sensitive/catastrophic) re-fire even
+            # on always_allow, so this can't disarm an rm -rf or a key-path write.
+            if decision.get("behavior") == "allow" and decision.get("set_always_allow"):
+                try:
+                    perms = load_builtin_permissions()
+                    perms[tool_name] = "always_allow"
+                    save_builtin_permissions(perms)
+                except Exception:
+                    logger.exception("Failed to persist always-allow for %s", tool_name)
+
             approval_latency_ms = int((datetime.now() - approval_req.created_at).total_seconds() * 1000)
             try:
                 # Append to the session's approval log so a reload

backend/apps/agents/agents.py

@@ -123,6 +123,7 @@ async def handle_approval(response: ApprovalResponse):
         "message": response.message,
         "updated_input": response.updated_input,
         "trust_pattern": response.trust_pattern,
+        "set_always_allow": response.set_always_allow,
     })
     return {"ok": True}
 

backend/apps/agents/core/models.py

@@ -42,6 +42,10 @@ class ApprovalResponse(BaseModel):
     # (from ApprovalRequest.sensitive_pattern) to disk so future writes
     # against the same pattern skip the modal.
     trust_pattern: bool = False
+    # "Always approve" button: persist this tool's policy to always_allow so
+    # the same tool stops prompting (the catastrophic/sensitive guards still
+    # fire, so this can't blanket-approve an rm -rf or a sensitive-path write).
+    set_always_allow: bool = False
 
 class Message(BaseModel):
     id: str = Field(default_factory=lambda: uuid4().hex)