fix(agent): enforce approval gate on allowFinalResponse path and normalize approval-predicate args

[lullu57]

TL;DR

Fixes two approval-gate gaps in the agent loop (only affects apps that use requireApproval). Closes #54.

1. allowFinalResponse skipped the approval check. When stopWhen halts the loop on a turn that still has pending tool calls and allowFinalResponse is enabled, those calls were executed via executeToolRound(...) directly — without the handleApprovalCheck/partitionToolCalls step the main loop runs before every other round. An approval-gated tool could therefore run unprompted on the final-response turn. This PR runs the normal approval check before executing those pending calls.
2. Approval predicate saw pre-normalization args. Function-form requireApproval predicates received the raw model-produced arguments, while execute() received the Zod-parsed input (defaults applied, values coerced). The predicate now sees the schema-normalized arguments, so the approval decision matches what the tool actually runs with.

Files

• Core: packages/agent/src/lib/model-result.ts, packages/agent/src/lib/conversation-state.ts
• Tests: packages/agent/tests/unit/allow-final-response.test.ts (adds the first approval-path coverage for this branch), packages/agent/tests/unit/conversation-state.test.ts
• .changeset/approval-gate-final-response.md (patch)

Risk / reviewer notes

• The normal approve/reject path and apps that don't use approval gates are unchanged.
• Local checks pass: pnpm run lint (Biome), pnpm run typecheck, pnpm run test (297/297). I could not run the sentrux structural-gate job locally; the change is small and stays within the lib/ layer, but please confirm that gate in CI.

Background and a fuller write-up are in #54.

[perry-the-pr-reviewer]

Perry's Review

Fixes two approval-gate gaps: executes the approval check before running pending tool calls on the allowFinalResponse path, and normalizes tool-call arguments via schema-parsing before evaluating function-form requireApproval predicates.

Verdict: 💬 Comments / questions

Details

Risk: 🟡 Medium — approval-gate behavioral change in agent loop; confined to callers using requireApproval, well-tested

CI: no checks reported on branch

Findings:

• No new findings since prior review (diff identical to d3569e7)
• 2 prior suggestions remain open (see existing review threads below)

Security: no concerns — categories 1–8 not touched; library-internal approval-predicate change

Test coverage: new tests cover allowFinalResponse approval path and schema-defaults normalization for tool-level predicates; callLevelCheck path for schema-normalized args is still untested (open thread)

Unresolved threads: 2 open Perry suggestion threads from prior review

Review metadata

Scope: incremental — 0 new lines since prior review (diff unchanged from d3569e7)
Review: tier=small · model=claude-sonnet-latest · score=1.5