[codex] add user-scoped WebUI tool approvals

FEATURE_PARITY.md

@@ -339,7 +339,7 @@ Trace Commons issuer/TenantCtx note: the server-side `zmanian/tracedao-server` s
 | GSuite WASM tools | ✅ | 🚧 | Reborn bundles operation-level Google Drive/Docs/Sheets/Slides WASM packages with host-mediated HTTP egress, product-auth scoped bearer injection, and manifest-declared Google OAuth setup metadata; full live-recorded parity remains follow-up |
 | Hosted MCP extensions | ✅ | 🚧 | Reborn composes host-mediated MCP runtime, bundles the current Notion MCP supported tool set, wires Notion ProductAuth OAuth exchange/refresh, can use Reborn ProductAuth DCR OAuth setup through the host callback origin, and can activate hosted MCP packages with live `tools/list` schema discovery through host-staged product-auth credentials |
 | NEAR AI MCP extension | ✅ | 🚧 | Host-bundled Reborn MCP extension exposes `nearai.search` via host-mediated HTTP and `llm_nearai_api_key`; manifest-declared product-auth credentials can now be staged through the hosted MCP runtime/discovery bridge, while NEAR remains a static supported-tool adapter |
-| Tool policies (allow/deny) | ✅ | ✅ | |
+| Tool policies (allow/deny) | ✅ | ✅ | User-scoped WebUI settings can list tools, toggle global always-allow for eligible tools, and set per-tool always/ask/disabled overrides without operator privileges |
 | Exec approvals (`/approve`) | ✅ | ✅ | TUI approval overlay |
 | Tool inventory cache | ✅ | ❌ | Coalesced effective-tool inventory cache with channel-registry invalidation |
 | Pending exec approval `errorMessage` cleanup | ✅ | ❌ | Failed restart-interrupted approval-pending sessions instead of replaying stale ids |
@@ -741,7 +741,7 @@ Trace Commons issuer/TenantCtx note: the server-side `zmanian/tracedao-server` s
 | Sandbox env sanitization | ✅ | 🚧 | Shell tool scrubs env vars (secret detection); Reborn process sandbox rejects sensitive raw env values in plans and uses placeholders for brokered credentials, but production secure-capture and MITM transport wiring remain partial |
 | `OPENCLAW_*` env block | ✅ | ❌ | Untrusted workspace `.env` cannot inject OpenClaw runtime-control vars |
 | Workspace `.env` injection blocks | ✅ | ❌ | Block `CLOUDSDK_PYTHON`, ambient Homebrew, Windows system PATH vars, `MINIMAX_API_HOST`, `npm_execpath` |
-| Tool policies | ✅ | ✅ | |
+| Tool policies | ✅ | ✅ | User-scoped WebUI settings can list tools, toggle global always-allow for eligible tools, and set per-tool always/ask/disabled overrides without operator privileges |
 | Elevated mode | ✅ | ❌ | |
 | Safe bins allowlist | ✅ | ❌ | Hardened path trust; non-user-writable absolute helpers for CLI/ffmpeg/OpenSSL |
 | LD*/DYLD* validation | ✅ | ❌ | Block Mercurial/Rust/Make env redirects in host exec sanitization |

crates/ironclaw_approvals/Cargo.toml

@@ -9,6 +9,9 @@ ironclaw_authorization = { path = "../ironclaw_authorization" }
 ironclaw_events = { path = "../ironclaw_events" }
 ironclaw_host_api = { path = "../ironclaw_host_api" }
 ironclaw_run_state = { path = "../ironclaw_run_state" }
+async-trait = "0.1"
+chrono = { version = "0.4", features = ["serde"] }
+serde = { version = "1", features = ["derive"] }
 thiserror = "2"
 
 [dev-dependencies]

crates/ironclaw_approvals/src/auto_approve.rs

@@ -0,0 +1,107 @@
+use std::{collections::HashMap, sync::RwLock};
+
+use async_trait::async_trait;
+use chrono::Utc;
+use ironclaw_host_api::{Principal, ResourceScope, TenantId, Timestamp, UserId};
+use serde::{Deserialize, Serialize};
+
+use crate::ToolPermissionStoreError;
+
+#[derive(Debug, Clone, PartialEq, Eq, Hash, Serialize, Deserialize)]
+pub struct AutoApproveSettingKey {
+    pub tenant_id: TenantId,
+    pub user_id: UserId,
+}
+
+impl AutoApproveSettingKey {
+    pub fn from_resource_scope(scope: &ResourceScope) -> Self {
+        Self {
+            tenant_id: scope.tenant_id.clone(),
+            user_id: scope.user_id.clone(),
+        }
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct AutoApproveSettingRecord {
+    pub key: AutoApproveSettingKey,
+    pub enabled: bool,
+    pub updated_by: Principal,
+    pub created_at: Timestamp,
+    pub updated_at: Timestamp,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct AutoApproveSettingInput {
+    pub scope: ResourceScope,
+    pub enabled: bool,
+    pub updated_by: Principal,
+}
+
+#[async_trait]
+pub trait AutoApproveSettingStore: Send + Sync {
+    async fn set(
+        &self,
+        input: AutoApproveSettingInput,
+    ) -> Result<AutoApproveSettingRecord, ToolPermissionStoreError>;
+
+    async fn get(
+        &self,
+        key: &AutoApproveSettingKey,
+    ) -> Result<Option<AutoApproveSettingRecord>, ToolPermissionStoreError>;
+
+    async fn is_enabled(&self, scope: &ResourceScope) -> Result<bool, ToolPermissionStoreError> {
+        let key = AutoApproveSettingKey::from_resource_scope(scope);
+        Ok(self.get(&key).await?.is_some_and(|record| record.enabled))
+    }
+}
+
+#[derive(Debug, Default)]
+pub struct InMemoryAutoApproveSettingStore {
+    settings: RwLock<HashMap<AutoApproveSettingKey, AutoApproveSettingRecord>>,
+}
+
+impl InMemoryAutoApproveSettingStore {
+    pub fn new() -> Self {
+        Self::default()
+    }
+}
+
+#[async_trait]
+impl AutoApproveSettingStore for InMemoryAutoApproveSettingStore {
+    async fn set(
+        &self,
+        input: AutoApproveSettingInput,
+    ) -> Result<AutoApproveSettingRecord, ToolPermissionStoreError> {
+        let key = AutoApproveSettingKey::from_resource_scope(&input.scope);
+        let mut settings = self
+            .settings
+            .write()
+            .unwrap_or_else(|poisoned| poisoned.into_inner());
+        let now = Utc::now();
+        let created_at = settings
+            .get(&key)
+            .map_or(now, |existing| existing.created_at);
+        let record = AutoApproveSettingRecord {
+            key: key.clone(),
+            enabled: input.enabled,
+            updated_by: input.updated_by,
+            created_at,
+            updated_at: now,
+        };
+        settings.insert(key, record.clone());
+        Ok(record)
+    }
+
+    async fn get(
+        &self,
+        key: &AutoApproveSettingKey,
+    ) -> Result<Option<AutoApproveSettingRecord>, ToolPermissionStoreError> {
+        Ok(self
+            .settings
+            .read()
+            .unwrap_or_else(|poisoned| poisoned.into_inner())
+            .get(key)
+            .cloned())
+    }
+}

crates/ironclaw_approvals/src/lib.rs

@@ -14,6 +14,26 @@ use ironclaw_host_api::{
 use ironclaw_run_state::{ApprovalRecord, ApprovalRequestStore, ApprovalStatus, RunStateError};
 use thiserror::Error;
 
+mod auto_approve;
+mod persistent_policy;
+mod tool_permission;
+
+pub use auto_approve::{
+    AutoApproveSettingInput, AutoApproveSettingKey, AutoApproveSettingRecord,
+    AutoApproveSettingStore, InMemoryAutoApproveSettingStore,
+};
+pub use persistent_policy::{
+    InMemoryPersistentApprovalPolicyStore, PersistentApprovalAction, PersistentApprovalPolicy,
+    PersistentApprovalPolicyError, PersistentApprovalPolicyInput, PersistentApprovalPolicyKey,
+    PersistentApprovalPolicyStore, PersistentApprovalScope,
+    permission_mode_allows_persistent_approval, persistent_approval_grant_issuer,
+};
+pub use tool_permission::{
+    InMemoryToolPermissionOverrideStore, ToolPermissionOverride, ToolPermissionOverrideInput,
+    ToolPermissionOverrideKey, ToolPermissionOverrideRecord, ToolPermissionOverrideStore,
+    ToolPermissionState, ToolPermissionStoreError,
+};
+
 pub struct ApprovalResolver<'a, A, L>
 where
     A: ApprovalRequestStore + ?Sized,