Both tools were registered with kind="read" in TOOL_DEFS, so
approval_for_tool() returned False and overrode the approval=True
set at the call site. The permission engine then classified them
as READ (requires_approval=False → RiskClass.READ), auto-allowing
them without ever prompting the user — even though both write to
disk (clone creates a new directory, pull fast-forwards an existing
repo) and their own descriptions say "Requires user approval".
The connector list API (tool_dicts) always reports
requires_approval=True, so the UI showed them as gated while the
runtime silently bypassed the gate — a mismatch that made the bug
invisible to users.
Reclassify both as kind="write" so the §36 kind→approval mapping
correctly gates them.
Imported from andrewyng/aisuite@1b4bbf303e
(contents of its platform/ directory, hoisted to the repo root).
Development history prior to this commit lives in that repository.
Co-authored-by: Devika <devikaverma11@gmail.com>
Rohit Prasad