Add tool_call_approval_source server capability

Dylan Bernardirequested to merge
db/tool-call-approval-source-capability into master

What does this MR do and why?

Follow-up to Add approval source to Duo Workflow tool call a... (!247456 - merged), which added the DuoWorkflowToolCallApprovalSource enum and the optional approvalSource argument to the Duo Workflow tool call approvals mutation in 19.3.

This MR makes Rails unconditionally advertise a new tool_call_approval_source server capability from both capability assembly sites, covering all three serving paths:

  • compute_server_capabilities in ee/lib/api/ai/duo_workflows/workflows.rb, which serves the REST direct_access endpoint and the Workhorse agent platform config endpoint.
  • Ai::FlowsMetadataService, which serves the GraphQL aiFlowsMetadata query.

Clients use the capability to select the approvalSource variant of the mutation document instead of checking instance versions. The first consumer is feat: add approvalSource to tool call approvals (gitlab-org/editor-extensions/gitlab-lsp!3803 - merged). Capabilities remain the single source of truth for feature negotiation: instances earlier than 19.3 never advertise the capability, which gives clients an exact boundary signal with zero client-side version logic.

Advertising unconditionally is correct because the capability describes schema support (the enum exists on 19.3 and later regardless of any setting), and it is only consulted when tool_call_approval is also present, so the existing tool approval session setting still governs whether approval persistence happens at all.

No feature flag and no migration: the capability is truthful metadata about the instance schema, not a rollout switch.

References

How to set up and validate locally

  1. On a GDK with Duo Agent Platform enabled, call the REST endpoint:

    curl --request POST --header "PRIVATE-TOKEN: $TOKEN" \
  "http://gdk.test:3000/api/v4/ai/duo_workflows/direct_access" \
  --data "project_id=$PROJECT_ID"

    The server_capabilities array includes tool_call_approval_source.

  2. Run the GraphQL query:

    query { aiFlowsMetadata { capabilities { name metadata } } }

    The result includes { "name": "tool_call_approval_source", "metadata": null }.

  3. The Workhorse agent platform config path uses the same helper with an empty DWS list; see the ServerCapabilities assertions in ee/spec/requests/api/ai/duo_workflows/workflows_spec.rb.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Merge request reports