bug(web): The permission choice doesn't show if it's running on a subagent

[Zane-Zzx]

What version of HAPI is running?

0.16.6

What platform is your computer?

Darwin 24.6.0 arm64 arm

What issue are you seeing?

What steps can reproduce the bug?

Let the task running by a subagent (I'm not sure)

What is the expected behavior?

No response

Additional information

No response

[Zane-Zzx]

And can we add the choice "Always Allow" on the telegram's main chatting window?

[github-actions]

I checked the current codebase, and the UI state in your screenshot is consistent with a real bug path.

The orange permission required badge is driven only by whether session.agentState.requests is non-empty, but the actual approve/deny controls are only rendered inside tool cards. On top of that, the chat reducer intentionally skips rendering a standalone permission card when the pending request is older than the oldest loaded message in the current window. Since the web session initially loads only 50 messages, a long-running/subagent flow can end up showing permission required with no visible choice card.

I did not find a separate global approval UI fallback in the web app.

Relevant code:

• web/src/components/AssistantChat/StatusBar.tsx:48 - status bar shows permission required whenever agentState.requests has entries.
• web/src/components/ToolCard/ToolCard.tsx:317 - approval UI is tied to tool cards with pending permission state.
• web/src/components/ToolCard/PermissionFooter.tsx:109 - approve/deny buttons only render from the tool-card footer path.
• web/src/chat/reducer.ts:50 - standalone permission cards are skipped if the permission is older than the oldest loaded message.
• hub/src/web/routes/messages.ts:35 - session message API defaults to 50 messages.
• web/src/lib/message-window-store.ts:23 - web message window also requests pages of 50.
• cli/src/modules/common/permission/BasePermissionHandler.ts:129 - pending requests are stored in agentState.requests.
• cli/src/codex/codexRemoteLauncher.ts:179 - Codex permission requests are emitted as CodexPermission tool calls for the web UI.

Need more info:

• Does tapping Load older make the missing approval card appear?
• Was this a Codex session or a Claude session?
• If it was Codex, was the missing prompt a normal tool approval or a request_user_input question?

---

HAPI Bot

[Zane-Zzx]

No, tapping "Load older" doesn't make the missing approval card appear.
This is a Claude session