fix: apply profile auto-approve to agentctl instances (#1358)

apps/backend/internal/agent/runtime/lifecycle/manager_execution.go

@@ -401,25 +401,44 @@ func (m *Manager) createExecution(ctx context.Context, taskID string, info *Work
 	// session/load then looks under the wrong SDK root → -32002 Resource not
 	// found.
 	env := map[string]string{}
-	m.mergeAgentProfileEnv(ctx, info.AgentProfileID, env)
+	var profileInfo *AgentProfileInfo
+	if info.AgentProfileID != "" && m.profileResolver != nil {
+		resolvedProfile, err := m.profileResolver.ResolveProfile(ctx, info.AgentProfileID)
+		if err != nil {
+			m.logger.Warn("failed to resolve profile for workspace execution",
+				zap.String("agent_profile_id", info.AgentProfileID),
+				zap.Error(err))
+		} else {
+			profileInfo = resolvedProfile
+		}
+	}
+	m.mergeAgentProfileEnvFromInfo(ctx, profileInfo, env)
+	autoApprove := false
+	var autoApproveOverride *bool
+	if profileInfo != nil {
+		autoApprove = profileInfo.AutoApprove
+		autoApproveOverride = boolPtr(profileInfo.AutoApprove)
+	}
 	if len(env) == 0 {
 		env = nil
 	}
 
 	req := &ExecutorCreateRequest{
-		InstanceID:          executionID,
-		TaskID:              taskID,
-		SessionID:           info.SessionID,
-		TaskEnvironmentID:   info.TaskEnvironmentID,
-		AgentProfileID:      info.AgentProfileID,
-		WorkspacePath:       info.WorkspacePath,
-		Protocol:            string(agentConfig.Runtime().Protocol),
-		Env:                 env,
-		AgentConfig:         agentConfig,
-		Metadata:            info.Metadata,
-		PreviousExecutionID: info.AgentExecutionID,
-		AuthToken:           m.revealRuntimeSecret(ctx, info.Metadata, MetadataKeyAuthTokenSecret),
-		BootstrapNonce:      m.revealRuntimeSecret(ctx, info.Metadata, MetadataKeyBootstrapNonceSecret),
+		InstanceID:                     executionID,
+		TaskID:                         taskID,
+		SessionID:                      info.SessionID,
+		TaskEnvironmentID:              info.TaskEnvironmentID,
+		AgentProfileID:                 info.AgentProfileID,
+		WorkspacePath:                  info.WorkspacePath,
+		Protocol:                       string(agentConfig.Runtime().Protocol),
+		Env:                            env,
+		AutoApprovePermissions:         autoApprove,
+		AutoApprovePermissionsOverride: autoApproveOverride,
+		AgentConfig:                    agentConfig,
+		Metadata:                       info.Metadata,
+		PreviousExecutionID:            info.AgentExecutionID,
+		AuthToken:                      m.revealRuntimeSecret(ctx, info.Metadata, MetadataKeyAuthTokenSecret),
+		BootstrapNonce:                 m.revealRuntimeSecret(ctx, info.Metadata, MetadataKeyBootstrapNonceSecret),
 	}
 
 	runtimeInstance, err := rt.CreateInstance(ctx, req)