Execute approved tool calls

crates/crank-registry/src/lib.rs

@@ -27,10 +27,10 @@ pub mod requests {
         CreateImportJobRequest, CreateInvitationRequest, CreateInvocationLogRequest,
         CreatePlatformApiKeyRequest, CreateSecretRequest, CreateVersionRequest,
         CreateWorkspaceRequest, CreateYamlImportJobRequest, DecideApprovalRequest,
-        FinishImportJobRequest, ListInvocationLogsQuery, PublishAgentRequest, PublishRequest,
-        RotateSecretRequest, SaveAgentBindingsRequest, SaveAuthProfileRequest,
-        SaveDescriptorMetadataRequest, SaveSampleMetadataRequest, SaveWorkspaceUpstreamRequest,
-        UpdateWorkspaceRequest, UsageQuery,
+        FinishApprovalRequest, FinishImportJobRequest, ListInvocationLogsQuery,
+        PublishAgentRequest, PublishRequest, RotateSecretRequest, SaveAgentBindingsRequest,
+        SaveAuthProfileRequest, SaveDescriptorMetadataRequest, SaveSampleMetadataRequest,
+        SaveWorkspaceUpstreamRequest, UpdateWorkspaceRequest, UsageQuery,
     };
 }
 
@@ -45,11 +45,11 @@ pub use model::{
     CreateImportJobRequest, CreateInvitationRequest, CreateInvocationLogRequest,
     CreatePlatformApiKeyRequest, CreateSecretRequest, CreateVersionRequest, CreateWorkspaceRequest,
     CreateYamlImportJobRequest, DecideApprovalRequest, DescriptorKind, DescriptorMetadata,
-    FinishImportJobRequest, ImportJob, ImportJobId, ImportJobKind, ImportJobStatus,
-    InvitationRecord, InvocationLogRecord, ListInvocationLogsQuery, MembershipRecord,
-    OperationAgentRef, OperationSampleMetadata, OperationSummary, OperationUsageSummary,
-    OperationVersionRecord, Page, PlatformApiKeyRecord, PublishAgentRequest, PublishRequest,
-    PublishedAgentTool, RegistryOperation, RotateSecretRequest, SampleKind,
+    FinishApprovalRequest, FinishImportJobRequest, ImportJob, ImportJobId, ImportJobKind,
+    ImportJobStatus, InvitationRecord, InvocationLogRecord, ListInvocationLogsQuery,
+    MembershipRecord, OperationAgentRef, OperationSampleMetadata, OperationSummary,
+    OperationUsageSummary, OperationVersionRecord, Page, PlatformApiKeyRecord, PublishAgentRequest,
+    PublishRequest, PublishedAgentTool, RegistryOperation, RotateSecretRequest, SampleKind,
     SaveAgentBindingsRequest, SaveAuthProfileRequest, SaveDescriptorMetadataRequest,
     SaveSampleMetadataRequest, SaveWorkspaceUpstreamRequest, SecretRecord, SecretVersionRecord,
     SessionRecord, UpdateWorkspaceRequest, UsageAgentBreakdown, UsageBucket,

crates/crank-registry/src/model.rs

@@ -536,6 +536,16 @@ pub struct DecideApprovalRequest<'a> {
     pub decision_note: Option<&'a str>,
 }
 
+#[derive(Clone, Debug)]
+pub struct FinishApprovalRequest<'a> {
+    pub workspace_id: &'a WorkspaceId,
+    pub agent_id: &'a AgentId,
+    pub approval_id: &'a ApprovalRequestId,
+    pub status: ApprovalRequestStatus,
+    pub response_payload: Option<Value>,
+    pub decision_note: Option<&'a str>,
+}
+
 #[derive(Clone, Debug, PartialEq)]
 pub struct CreateSecretRequest<'a> {
     pub secret: &'a Secret,

crates/crank-registry/src/postgres/approval.rs

@@ -187,6 +187,49 @@ impl PostgresRegistry {
 
         row.map(map_approval_request_row).transpose()
     }
+
+    pub async fn finish_approval_request(
+        &self,
+        request: FinishApprovalRequest<'_>,
+    ) -> Result<Option<ApprovalRequestRecord>, RegistryError> {
+        let row = sqlx::query(
+            "update approval_requests
+                set status = $1,
+                    response_payload_json = $2,
+                    decision_note = coalesce($3, decision_note)
+              where workspace_id = $4
+                and agent_id = $5
+                and id = $6
+                and status = 'approved'
+              returning
+                id,
+                workspace_id,
+                agent_id,
+                operation_id,
+                operation_version,
+                status,
+                risk_level,
+                confirmation_title,
+                confirmation_body,
+                request_payload_json,
+                response_payload_json,
+                created_at,
+                expires_at,
+                decided_at,
+                decided_by_key_id,
+                decision_note",
+        )
+        .bind(serialize_enum_text(&request.status, "approval_status")?)
+        .bind(request.response_payload.as_ref().map(Json))
+        .bind(request.decision_note)
+        .bind(request.workspace_id.as_str())
+        .bind(request.agent_id.as_str())
+        .bind(request.approval_id.as_str())
+        .fetch_optional(&self.pool)
+        .await?;
+
+        row.map(map_approval_request_row).transpose()
+    }
 }
 
 fn map_approval_request_row(row: PgRow) -> Result<ApprovalRequestRecord, RegistryError> {

crates/crank-registry/src/postgres/mod.rs

@@ -35,16 +35,17 @@ use crate::{
         CreateImportJobRequest, CreateInvitationRequest, CreateInvocationLogRequest,
         CreatePlatformApiKeyRequest, CreateSecretRequest, CreateVersionRequest,
         CreateWorkspaceRequest, CreateYamlImportJobRequest, DecideApprovalRequest,
-        DescriptorMetadata, FinishImportJobRequest, ImportJob, ImportJobId, InvitationRecord,
-        InvocationLogRecord, ListInvocationLogsQuery, MembershipRecord, OperationAgentRef,
-        OperationSampleMetadata, OperationSummary, OperationUsageSummary, OperationVersionRecord,
-        PlatformApiKeyRecord, PublishAgentRequest, PublishRequest, PublishedAgentTool,
-        RegistryOperation, RotateSecretRequest, SaveAgentBindingsRequest, SaveAuthProfileRequest,
-        SaveDescriptorMetadataRequest, SaveSampleMetadataRequest, SaveWorkspaceUpstreamRequest,
-        SecretRecord, SecretVersionRecord, SessionRecord, UpdateWorkspaceRequest,
-        UsageAgentBreakdown, UsageOperationBreakdown, UsageQuery, UsageRollupRecord, UsageSummary,
-        UsageTimelinePoint, WorkspaceMembershipRecord, WorkspaceRecord, WorkspaceUpstream,
-        YamlImportJob, YamlImportJobCompletion, YamlImportJobId, YamlImportJobStatus,
+        DescriptorMetadata, FinishApprovalRequest, FinishImportJobRequest, ImportJob, ImportJobId,
+        InvitationRecord, InvocationLogRecord, ListInvocationLogsQuery, MembershipRecord,
+        OperationAgentRef, OperationSampleMetadata, OperationSummary, OperationUsageSummary,
+        OperationVersionRecord, PlatformApiKeyRecord, PublishAgentRequest, PublishRequest,
+        PublishedAgentTool, RegistryOperation, RotateSecretRequest, SaveAgentBindingsRequest,
+        SaveAuthProfileRequest, SaveDescriptorMetadataRequest, SaveSampleMetadataRequest,
+        SaveWorkspaceUpstreamRequest, SecretRecord, SecretVersionRecord, SessionRecord,
+        UpdateWorkspaceRequest, UsageAgentBreakdown, UsageOperationBreakdown, UsageQuery,
+        UsageRollupRecord, UsageSummary, UsageTimelinePoint, WorkspaceMembershipRecord,
+        WorkspaceRecord, WorkspaceUpstream, YamlImportJob, YamlImportJobCompletion,
+        YamlImportJobId, YamlImportJobStatus,
     },
 };
 

crates/crank-registry/tests/integration/workspace_access.rs

@@ -23,10 +23,11 @@ use crank_registry::{
     CreateAgentRequest, CreateApprovalRequest, CreateInvocationLogRequest,
     CreatePlatformApiKeyRequest, CreateVersionRequest, CreateWorkspaceRequest,
     CreateYamlImportJobRequest, DecideApprovalRequest, DescriptorKind, DescriptorMetadata,
-    OperationSampleMetadata, PlatformApiKeyRecord, PostgresRegistry, PublishAgentRequest,
-    PublishRequest, RegistryError, RegistryOperation, SampleKind, SaveAuthProfileRequest,
-    SaveDescriptorMetadataRequest, SaveSampleMetadataRequest, UpdateWorkspaceRequest,
-    WorkspaceRecord, YamlImportJobCompletion, YamlImportJobId, YamlImportJobStatus,
+    FinishApprovalRequest, OperationSampleMetadata, PlatformApiKeyRecord, PostgresRegistry,
+    PublishAgentRequest, PublishRequest, RegistryError, RegistryOperation, SampleKind,
+    SaveAuthProfileRequest, SaveDescriptorMetadataRequest, SaveSampleMetadataRequest,
+    UpdateWorkspaceRequest, WorkspaceRecord, YamlImportJobCompletion, YamlImportJobId,
+    YamlImportJobStatus,
 };
 
 fn test_workspace_id() -> WorkspaceId {
@@ -555,6 +556,25 @@ async fn manages_approval_request_lifecycle() {
         Some(json!({"approve": "yes"}))
     );
 
+    let completed = registry
+        .finish_approval_request(FinishApprovalRequest {
+            workspace_id: &workspace_id,
+            agent_id: &agent.id,
+            approval_id: &approval.id,
+            status: ApprovalRequestStatus::Completed,
+            response_payload: Some(json!({"id": "lead_123"})),
+            decision_note: None,
+        })
+        .await
+        .unwrap()
+        .unwrap();
+
+    assert_eq!(completed.approval.status, ApprovalRequestStatus::Completed);
+    assert_eq!(
+        completed.approval.response_payload,
+        Some(json!({"id": "lead_123"}))
+    );
+
     let pending_after_decision = registry
         .list_pending_approval_requests_for_agent(&workspace_id, &agent.id)
         .await