🐛 fix: update the agentbuilder tools not always use humanIntervention by ONLY-yours · Pull Request #11696 · lobehub/lobehub

ONLY-yours · 2026-01-22T03:28:39Z

💻 Change Type

🔗 Related Issue

fix LOBE-3605

🔀 Description of Change

🧪 How to Test

Tested locally
Added/updated tests
No tests needed

📸 Screenshots / Videos

Before	After
...	...

📝 Additional Information

Summary by Sourcery

Bug Fixes:

Allow marketplace tool search and plugin installation tools to run without being hard-coded as always requiring human intervention in the manifest.

vercel · 2026-01-22T03:28:44Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Review	Updated (UTC)
lobehub	Building	Preview, Comment	Jan 22, 2026 3:28am

sourcery-ai · 2026-01-22T03:28:45Z

Reviewer's guide (collapsed on small PRs)

Reviewer's Guide

Removes the explicit humanIntervention: 'always' requirement from two Agent Builder marketplace-related tools so they can follow the default/higher-level human intervention policy instead of being hard‑coded to always require user approval.

Sequence diagram for AgentBuilder tool invocation and human intervention policy

sequenceDiagram
  actor User
  participant Agent
  participant ToolInvoker
  participant HumanInterventionPolicy

  User->>Agent: Request to search/install marketplace tools
  Agent->>ToolInvoker: invoke searchMarketTools or installPlugin
  ToolInvoker->>HumanInterventionPolicy: evaluateRequirement(toolId, context)
  alt human intervention required
    HumanInterventionPolicy-->>ToolInvoker: requireHumanApproval
    ToolInvoker-->>Agent: pendingUserApproval
    Agent->>User: Request approval (modal, prompt, etc.)
    User-->>Agent: Approve or reject
    Agent->>ToolInvoker: proceedWithDecision
    ToolInvoker-->>Agent: toolResult or rejected
  else human intervention not required
    HumanInterventionPolicy-->>ToolInvoker: noHumanApprovalNeeded
    ToolInvoker-->>Agent: toolResult
  end
  Agent-->>User: Present outcome

File-Level Changes

Change	Details	Files
Relax human intervention requirement for marketplace search and plugin install tools in the Agent Builder builtin tool manifest.	Remove the hard-coded `humanIntervention: 'always'` flag from the marketplace tool search action so it no longer always requires manual approval. Remove the hard-coded `humanIntervention: 'always'` flag from the plugin installation action so its approval behavior is controlled by the surrounding system defaults or policies.	`packages/builtin-tool-agent-builder/src/manifest.ts`

Tips and commands

Interacting with Sourcery

Trigger a new review: Comment @sourcery-ai review on the pull request.
Continue discussions: Reply directly to Sourcery's review comments.
Generate a GitHub issue from a review comment: Ask Sourcery to create an
issue from a review comment by replying to it. You can also reply to a
review comment with @sourcery-ai issue to create an issue from it.
Generate a pull request title: Write @sourcery-ai anywhere in the pull
request title to generate a title at any time. You can also comment
@sourcery-ai title on the pull request to (re-)generate the title at any time.
Generate a pull request summary: Write @sourcery-ai summary anywhere in
the pull request body to generate a PR summary at any time exactly where you
want it. You can also comment @sourcery-ai summary on the pull request to
(re-)generate the summary at any time.
Generate reviewer's guide: Comment @sourcery-ai guide on the pull
request to (re-)generate the reviewer's guide at any time.
Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
pull request to resolve all Sourcery comments. Useful if you've already
addressed all the comments and don't want to see them anymore.
Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
request to dismiss all existing Sourcery reviews. Especially useful if you
want to start fresh with a new review - don't forget to comment
@sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

Enable or disable review features such as the Sourcery-generated pull request
summary, the reviewer's guide, and others.
Change the review language.
Add, remove or edit custom review instructions.
Adjust other review settings.

Getting Help

Contact our support team for questions or feedback.
Visit our documentation for detailed guides and information.
Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

gru-agent · 2026-01-22T03:28:51Z

TestGru Assignment

Summary

Link	CommitId	Status	Reason
Detail	`b758f59`	🚫 Skipped	No files need to be tested {"packages/builtin-tool-agent-builder/src/manifest.ts":"The code does not contain any functions or classes."}

History Assignment

Tip

You can @gru-agent and leave your feedback. TestGru will make adjustments based on your input

sourcery-ai

Hey - I've left some high level feedback:

The description for installPlugin still states that it ALWAYS REQUIRES user approval, but humanIntervention: 'always' was removed; consider updating either the manifest description or the configuration so behavior and docs remain aligned.
If the intent is to allow these tools to run without mandatory human intervention only in certain modes or contexts, consider making that conditional explicit instead of relying on the default behavior of omitting humanIntervention.

Prompt for AI Agents

Please address the comments from this code review:

## Overall Comments
- The description for `installPlugin` still states that it ALWAYS REQUIRES user approval, but `humanIntervention: 'always'` was removed; consider updating either the manifest description or the configuration so behavior and docs remain aligned.
- If the intent is to allow these tools to run without mandatory human intervention only in certain modes or contexts, consider making that conditional explicit instead of relying on the default behavior of omitting `humanIntervention`.

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

lobehubbot · 2026-01-22T03:30:21Z

❤️ Great PR @ONLY-yours ❤️

The growth of project is inseparable from user feedback and contribution, thanks for your contribution! If you are interesting with the lobehub developer community, please join our discord and then dm @arvinxx or @canisminor1990. They will invite you to our private developer channel. We are talking about the lobe-chat development or sharing ai newsletter around the world.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b758f59160

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-01-22T03:30:51Z

packages/builtin-tool-agent-builder/src/manifest.ts

    {
      description:
        'Install a plugin for the agent. This tool ALWAYS REQUIRES user approval before installation, even in auto-run mode. For MCP marketplace plugins, it will install and enable the plugin. For Klavis tools and LobehubSkill providers that need OAuth, it will initiate the connection flow and wait for user to complete authorization.',
-      humanIntervention: 'always',
      name: AgentBuilderApiName.installPlugin,
      parameters: {


Reinstate required approval for installPlugin

The installPlugin entry no longer declares a humanIntervention policy, so in the default “manual” mode GeneralChatAgent.checkInterventionNeeded falls back to InterventionChecker.shouldIntervene, which returns never when config is undefined; that makes the tool execute immediately and skips the approval UX. This contradicts the tool description (“ALWAYS REQUIRES user approval”) and means plugins can be installed without explicit user confirmation whenever the agent invokes this tool (e.g., marketplace installs), which is a security/regression risk.

Useful? React with 👍 / 👎.

## [Version 2.0.0-next.337](v2.0.0-next.336...v2.0.0-next.337) <sup>Released on **2026-01-22**</sup> #### 🐛 Bug Fixes - **misc**: Fix memory schema, update the agentbuilder tools not always use humanIntervention. <br/> <details> <summary><kbd>Improvements and Fixes</kbd></summary> #### What's fixed * **misc**: Fix memory schema, closes [#11645](#11645) ([3baf780](3baf780)) * **misc**: Update the agentbuilder tools not always use humanIntervention, closes [#11696](#11696) ([0d3017b](0d3017b)) </details> <div align="right"> [![](https://img.shields.io/badge/-BACK_TO_TOP-151515?style=flat-square)](#readme-top) </div>

lobehubbot · 2026-01-22T03:51:18Z

🎉 This PR is included in version 2.0.0-next.337 🎉

The release is available on:

Your semantic-release bot 📦🚀

## [Version 1.153.0](v1.152.0...v1.153.0) <sup>Released on **2026-01-23**</sup> #### ♻ Code Refactoring - **auth**: Remove NEXT_PUBLIC_AUTH_URL env variable. - **model-select**: Migrate FunctionCallingModelSelect to LobeSelect. - **ModelSwitchPanel**: Migrate from Popover to DropdownMenu with virtual scrolling. - **userMemories**: Removed un-used code. - **misc**: Improve memory data with experience and identity, move vercel-react-best-practices skills to .agents directory. #### ✨ Features - **database**: Added user memory activity. - **desktop**: Add legacy local database detection and migration guidance. - **misc**: Add platform-aware download client menu option, add server version check for desktop app, remove Clerk authentication code, skill setting page and skill store, support agent group unpublish agents, support client tasks mode, update the sandbox preinstall libs in sys role. #### 🐛 Bug Fixes - **copilot**: Pass correct scope when creating new session in PageEditor. - **desktop**: Gracefully handle missing update manifest 404 errors. - **model-runtime**: Filter unsupported image types (SVG) before sending to vision models. - **pdf**: Upgrade pdfjs-dist and react-pdf to v5.x. - **sidebar-drawer**: Fix drawer positioning and title style. - **misc**: Fix group broadcast trigger tool use, fix local system tools, fix memory schema, fix multi agent tasks issue, fix multi tasks no summary issue, fix scope issue, fix tool argument scape and improve multi task run, fixed the sandbox tools call when error should use right callback, improve e2e server and complete i18n resources, slove the agent group editor not focus in editdata area, slove the agents header switch agents the lobeAI not show problem, sloved the old removeSessionTopics not work, TypewriterEffect not refreshing on language change, updata cron job ui & fixed commnuity pagenation goto error, update the agentbuilder tools not always use humanIntervention. #### 💄 Styles - **misc**: Improve auto scroll and group profile, update og, update share style. <br/> <details> <summary><kbd>Improvements and Fixes</kbd></summary> #### Code refactoring * **auth**: Remove NEXT_PUBLIC_AUTH_URL env variable, closes [lobehub#11658](https://github.com/jaworldwideorg/OneJA-Bot/issues/11658) ([c0f9875](c0f9875)) * **model-select**: Migrate FunctionCallingModelSelect to LobeSelect, closes [lobehub#11664](https://github.com/jaworldwideorg/OneJA-Bot/issues/11664) ([ad51305](ad51305)) * **ModelSwitchPanel**: Migrate from Popover to DropdownMenu with virtual scrolling, closes [lobehub#11663](https://github.com/jaworldwideorg/OneJA-Bot/issues/11663) ([c9d9dff](c9d9dff)) * **userMemories**: Removed un-used code, closes [lobehub#11713](https://github.com/jaworldwideorg/OneJA-Bot/issues/11713) ([89750fc](89750fc)) * **misc**: Improve memory data with experience and identity, closes [lobehub#11717](https://github.com/jaworldwideorg/OneJA-Bot/issues/11717) ([bdb3eb4](bdb3eb4)) * **misc**: Move vercel-react-best-practices skills to .agents directory, closes [lobehub#11703](https://github.com/jaworldwideorg/OneJA-Bot/issues/11703) ([6df7731](6df7731)) #### What's improved * **database**: Added user memory activity, closes [lobehub#11680](https://github.com/jaworldwideorg/OneJA-Bot/issues/11680) ([0160fbd](0160fbd)) * **desktop**: Add legacy local database detection and migration guidance, closes [lobehub#11682](https://github.com/jaworldwideorg/OneJA-Bot/issues/11682) ([5664b84](5664b84)) * **misc**: Add platform-aware download client menu option, closes [lobehub#11676](https://github.com/jaworldwideorg/OneJA-Bot/issues/11676) ([55abddc](55abddc)) * **misc**: Add server version check for desktop app, closes [lobehub#11710](https://github.com/jaworldwideorg/OneJA-Bot/issues/11710) ([0cf2723](0cf2723)) * **misc**: Remove Clerk authentication code, closes [lobehub#11711](https://github.com/jaworldwideorg/OneJA-Bot/issues/11711) ([395595a](395595a)) * **misc**: Skill setting page and skill store, closes [lobehub#11665](https://github.com/jaworldwideorg/OneJA-Bot/issues/11665) ([d8c0c26](d8c0c26)) * **misc**: Support agent group unpublish agents, closes [lobehub#11687](https://github.com/jaworldwideorg/OneJA-Bot/issues/11687) ([4e060be](4e060be)) * **misc**: Support client tasks mode, closes [lobehub#11666](https://github.com/jaworldwideorg/OneJA-Bot/issues/11666) ([98cf57b](98cf57b)) * **misc**: Update the sandbox preinstall libs in sys role, closes [lobehub#11688](https://github.com/jaworldwideorg/OneJA-Bot/issues/11688) ([404c577](404c577)) #### What's fixed * **copilot**: Pass correct scope when creating new session in PageEditor, closes [lobehub#11714](https://github.com/jaworldwideorg/OneJA-Bot/issues/11714) ([0259270](0259270)) * **desktop**: Gracefully handle missing update manifest 404 errors, closes [lobehub#11625](https://github.com/jaworldwideorg/OneJA-Bot/issues/11625) ([13e95b9](13e95b9)) * **model-runtime**: Filter unsupported image types (SVG) before sending to vision models, closes [lobehub#11698](https://github.com/jaworldwideorg/OneJA-Bot/issues/11698) ([c0c99a7](c0c99a7)) * **pdf**: Upgrade pdfjs-dist and react-pdf to v5.x, closes [lobehub#11686](https://github.com/jaworldwideorg/OneJA-Bot/issues/11686) ([2b620df](2b620df)) * **sidebar-drawer**: Fix drawer positioning and title style, closes [lobehub#11655](https://github.com/jaworldwideorg/OneJA-Bot/issues/11655) ([cf5320e](cf5320e)) * **misc**: Fix group broadcast trigger tool use, closes [lobehub#11646](https://github.com/jaworldwideorg/OneJA-Bot/issues/11646) ([831a9b3](831a9b3)) * **misc**: Fix local system tools, closes [lobehub#11702](https://github.com/jaworldwideorg/OneJA-Bot/issues/11702) ([6548fc7](6548fc7)) * **misc**: Fix memory schema, closes [lobehub#11645](https://github.com/jaworldwideorg/OneJA-Bot/issues/11645) ([3baf780](3baf780)) * **misc**: Fix multi agent tasks issue, closes [lobehub#11672](https://github.com/jaworldwideorg/OneJA-Bot/issues/11672) ([9de773b](9de773b)) * **misc**: Fix multi tasks no summary issue, closes [lobehub#11685](https://github.com/jaworldwideorg/OneJA-Bot/issues/11685) ([26ce317](26ce317)) * **misc**: Fix scope issue, closes [lobehub#11719](https://github.com/jaworldwideorg/OneJA-Bot/issues/11719) ([17adde8](17adde8)) * **misc**: Fix tool argument scape and improve multi task run, closes [lobehub#11691](https://github.com/jaworldwideorg/OneJA-Bot/issues/11691) ([b13bb8a](b13bb8a)) * **misc**: Fixed the sandbox tools call when error should use right callback, closes [lobehub#11721](https://github.com/jaworldwideorg/OneJA-Bot/issues/11721) ([e8fce68](e8fce68)) * **misc**: Improve e2e server and complete i18n resources, closes [lobehub#11678](https://github.com/jaworldwideorg/OneJA-Bot/issues/11678) ([d450dd9](d450dd9)) * **misc**: Slove the agent group editor not focus in editdata area, closes [lobehub#11677](https://github.com/jaworldwideorg/OneJA-Bot/issues/11677) ([9ac84e6](9ac84e6)) * **misc**: Slove the agents header switch agents the lobeAI not show problem, closes [lobehub#11726](https://github.com/jaworldwideorg/OneJA-Bot/issues/11726) ([f45f508](f45f508)) * **misc**: Sloved the old removeSessionTopics not work, closes [lobehub#11671](https://github.com/jaworldwideorg/OneJA-Bot/issues/11671) ([06d41e5](06d41e5)) * **misc**: TypewriterEffect not refreshing on language change, closes [lobehub#11657](https://github.com/jaworldwideorg/OneJA-Bot/issues/11657) ([ba30f46](ba30f46)) * **misc**: Updata cron job ui & fixed commnuity pagenation goto error, closes [lobehub#11700](https://github.com/jaworldwideorg/OneJA-Bot/issues/11700) ([42ad2a0](42ad2a0)) * **misc**: Update the agentbuilder tools not always use humanIntervention, closes [lobehub#11696](https://github.com/jaworldwideorg/OneJA-Bot/issues/11696) ([0d3017b](0d3017b)) #### Styles * **misc**: Improve auto scroll and group profile, closes [lobehub#11725](https://github.com/jaworldwideorg/OneJA-Bot/issues/11725) ([550acc2](550acc2)) * **misc**: Update og, closes [lobehub#11709](https://github.com/jaworldwideorg/OneJA-Bot/issues/11709) ([01cf4e4](01cf4e4)) * **misc**: Update share style, closes [lobehub#11716](https://github.com/jaworldwideorg/OneJA-Bot/issues/11716) ([3c70dfa](3c70dfa)) </details> <div align="right"> [![](https://img.shields.io/badge/-BACK_TO_TOP-151515?style=flat-square)](#readme-top) </div>

fix: update the agentbuilder tools not always use humanIntervention

b758f59

dosubot bot added the size:XS This PR changes 0-9 lines, ignoring generated files. label Jan 22, 2026

dosubot bot added the 🐛 Bug label Jan 22, 2026

ONLY-yours merged commit 0d3017b into next Jan 22, 2026
31 of 34 checks passed

ONLY-yours deleted the fix/AutoApproveToInstallTools branch January 22, 2026 03:28

sourcery-ai bot reviewed Jan 22, 2026

View reviewed changes

chatgpt-codex-connector bot reviewed Jan 22, 2026

View reviewed changes

lobehubbot added the released on @next label Jan 22, 2026

vercel bot deployed to Preview January 22, 2026 05:13 View deployment

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

🐛 fix: update the agentbuilder tools not always use humanIntervention#11696

🐛 fix: update the agentbuilder tools not always use humanIntervention#11696
ONLY-yours merged 1 commit intonextfrom
fix/AutoApproveToInstallTools

ONLY-yours commented Jan 22, 2026 •

edited

Loading

Uh oh!

vercel bot commented Jan 22, 2026

Uh oh!

sourcery-ai bot commented Jan 22, 2026 •

edited

Loading

Reviewer's Guide

Sequence diagram for AgentBuilder tool invocation and human intervention policy

File-Level Changes

Interacting with Sourcery

Customizing Your Experience

Getting Help

Uh oh!

gru-agent bot commented Jan 22, 2026 •

edited

Loading

Uh oh!

Uh oh!

sourcery-ai bot left a comment

Uh oh!

lobehubbot commented Jan 22, 2026

Uh oh!

chatgpt-codex-connector bot left a comment

Uh oh!

chatgpt-codex-connector bot Jan 22, 2026

Uh oh!

lobehubbot commented Jan 22, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

ONLY-yours commented Jan 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

💻 Change Type

🔗 Related Issue

🔀 Description of Change

🧪 How to Test

📸 Screenshots / Videos

📝 Additional Information

Summary by Sourcery

Uh oh!

vercel bot commented Jan 22, 2026

Uh oh!

sourcery-ai bot commented Jan 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Reviewer's Guide

Sequence diagram for AgentBuilder tool invocation and human intervention policy

File-Level Changes

Interacting with Sourcery

Customizing Your Experience

Getting Help

Uh oh!

gru-agent bot commented Jan 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

TestGru Assignment

Summary

Uh oh!

Uh oh!

sourcery-ai bot left a comment

Choose a reason for hiding this comment

Uh oh!

lobehubbot commented Jan 22, 2026

Uh oh!

chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector bot Jan 22, 2026

Choose a reason for hiding this comment

Uh oh!

lobehubbot commented Jan 22, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

ONLY-yours commented Jan 22, 2026 •

edited

Loading

sourcery-ai bot commented Jan 22, 2026 •

edited

Loading

gru-agent bot commented Jan 22, 2026 •

edited

Loading