fix(agent-client): attach role_ids_allowed_to_approve to approval requests [PRD-688]

[Scra3]

Problem

Approvals filed programmatically (MCP server executeAction, and the workflow executor) show up in Forest without an attached resource — the created approval is malformed.

Root cause

The Forest server's POST /api/action-approvals expects role_ids_allowed_to_approve in the payload — the browser engine always sends it (store.createRecord('action-approval', { …, roleIdsAllowedToApprove })). The agent-client already extracts roleIdsAllowedToApprove from the 403 CustomActionRequiresApprovalError (domains/action.ts toActionError) but discarded it instead of forwarding it to createApprovalRequest. The resulting payload was missing that field.

Fix

• ApprovalRequestPayload gains roleIdsAllowedToApprove?.
• makeCreateApprovalRequest sends role_ids_allowed_to_approve in the JSON:API attributes (alongside record_ids / collection_name / inputs), matching the browser-engine payload.
• Action.execute() forwards the value it already has from the mapped ActionRequiresApprovalError.

This is the only field that differed from the working browser-engine payload (verified against forestadmin action-approval model + custom-action service). record_ids was already correct (Collection.action serializes ids via serializeRecordId).

Notes

• Stacked on feat(workflow-executor): approval requests on Full AI / Automatic trigger actions [PRD-688] #1720 (the backend PRD-688 PR), which this depends on. Base will retarget to main once feat(workflow-executor): approval requests on Full AI / Automatic trigger actions [PRD-688] #1720 merges.
• Fixes both the MCP and workflow-executor approval paths (shared agent-client code).

Tests: agent-client (340) + mcp-server (547) pass; build + lint clean.

Refs PRD-688

🤖 Generated with Claude Code

Note

Attach role_ids_allowed_to_approve to approval request payloads in agent-client

Adds the optional roleIdsAllowedToApprove field to ApprovalRequestPayload in approval-request-creator.ts and maps it to role_ids_allowed_to_approve in the POST body sent to /api/action-approvals. The Action.execute method in action.ts now forwards this field when constructing the approval request.

^{Macroscope summarized afa0ce1.}

[linear-code]

PRD-688

[Scra3]

Closing: verified in the Forest server that it computes roleIdsAllowedToApprove itself on approval creation (action-approval-service.create → environmentRolePermissionStore.listRoleIdsForApproval, with a ?? fallback to the client value), and the create validator doesn't require the field. So sending it from the agent-client is unnecessary. The empty-Resource issue is unrelated (driven by record_ids).