Summary

• Add allowlist checking to the node host path before deciding whether to prompt for approval
• Fix regression from fix(exec): derive agentId from sessionKey for allowlist lookup #1417 where null was passed instead of undefined for optional params

Problem

The node host path was always prompting for approval when ask=on-miss, even when the command was already in the allowlist. The gateway host path correctly checks the allowlist first, but the node host path was missing this check.

Additionally, #1417 accidentally reverted the fix from #1414 by passing null instead of undefined for resolvedPath and sessionKey in the approval request params. TypeBox Type.Optional(Type.String()) rejects null.

Solution

1. Added allowlist check to node host path mirroring gateway behavior:

   • Analyze command with analyzeShellCommand()
   • Check each segment against matchAllowlist() and isSafeBinUsage()
   • Only prompt if allowlist is not satisfied

2. Fixed null → undefined for optional params in both node and gateway host paths

Test plan

• Added 4 unit tests for allowlist satisfaction logic (exact match, wildcard, negative, safeBins fallback)
• All existing tests pass
• Manual testing via Discord trigger

🤖 Generated with Claude Code