{"record":{"id":"1a4eadf62ab5562a","repo":"nanocoai/nanoclaw","slug":"approval-pending","errorCode":"approval-pending","errorMessage":"Approval request sent to admin. You will be notified of the result.","messagePattern":"Approval request sent to admin\\. You will be notified of the result\\.","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"info","filePath":"src/cli/dispatch.ts","lineNumber":165,"sourceCode":"      return err(req.id, 'handler-error', 'Session not found.');\n    }\n    const agentGroup = await getAgentGroup(ctx.agentGroupId);\n    const agentName = agentGroup?.name ?? ctx.agentGroupId;\n\n    const argSummary = Object.entries(req.args)\n      .map(([k, v]) => `--${k} ${v}`)\n      .join(' ');\n\n    await requestApproval({\n      session,\n      agentName,\n      action: 'cli_command',\n      payload: { frame: { id: req.id, command: req.command, args: req.args }, callerContext: ctx },\n      title: `CLI: ${req.command}`,\n      question: `Agent \"${agentName}\" wants to run:\\n\\`ncl ${req.command}${argSummary ? ' ' + argSummary : ''}\\``,\n    });\n\n    return err(req.id, 'approval-pending', 'Approval request sent to admin. You will be notified of the result.');\n  }\n\n  let parsed: unknown;\n  try {\n    parsed = cmd.parseArgs(req.args);\n  } catch (e) {\n    return err(req.id, 'invalid-args', errMsg(e));\n  }\n\n  try {\n    let data = await cmd.handler(parsed, ctx);\n\n    // Post-handler group-scope enforcement. Applies only to the auto-generated\n    // `list` / `get` handlers (`cmd.generic`), which return raw DB rows carrying\n    // the resource's `scopeField`:\n    //   - `list` → drop rows that don't belong to the caller's agent group\n    //              (covers `groups list`, where the generic list handler ignores\n    //              the auto-filled `--id`)","sourceCodeStart":147,"sourceCodeEnd":183,"githubUrl":"https://github.com/nanocoai/nanoclaw/blob/294ef2aee85218b23ad30eda9dfe10e590b54a8c/src/cli/dispatch.ts#L147-L183","documentation":"Not a failure: the guard returned `hold`, the dispatcher created a pending approval via requestApproval (title `CLI: <command>`), and the agent gets `approval-pending`. The command did not run; a human must approve or deny, and on approve the request is replayed with the approval row as a grant.","triggerScenarios":"A group-scoped agent runs an approval-gated ncl verb (e.g. `groups update`, `groups config update --timezone`, self-mod-adjacent commands); any credentialed/privileged action whose guard policy is hold.","commonSituations":"Normal operation for privileged agent actions; agent retries the same command repeatedly and mints multiple pending cards; approver doesn't respond so the agent sees it 'hang' from its perspective.","solutions":["Wait for an approver (scoped admin → global admin → owner, per pickApprover) to action the card","Check `ncl approvals list` / the approver DM to see or resolve the pending request","Don't retry the command while a card is pending — it creates duplicate approvals","If the action shouldn't need approval, adjust the guard policy for that command"],"exampleFix":null,"handlingStrategy":"fallback","validationCode":"const pending = await runNcl('approvals list --json').catch(() => []);\nif (pending.some(a => a.payload?.frame?.command === myCommand)) {\n  return 'already awaiting approval';\n}","typeGuard":null,"tryCatchPattern":"Treat code === 'approval-pending' as a terminal-for-now outcome: stop, notify the user, and resume on the approval result message — never retry in a loop.","preventionTips":["Never auto-retry approval-gated commands; check `approvals list` first","Ensure at least one approver role exists (owner/admin) or cards go nowhere","Design agent prompts to inform the user a card was sent"],"tags":["cli","approval","pending","guard","ncl"],"backgroundTag":"action-awaiting-approval","analyzedSha":"294ef2aee85218b23ad30eda9dfe10e590b54a8c","analyzedAt":"2026-08-28T13:59:10.357Z","schemaVersion":2},"datasetVersion":"2026-08-28T16:17:29.566Z"}