feat(settings): add a tool approval mode with an explicit off (YOLO) option (#6304)

* feat: add optional tool approval mode

Admin-configurable tool_approval_mode setting (ask/auto) for the
post-external-context tool approval gate.

- ask (default): existing approval flow, gate stays on
- auto: bypasses the approval gate for all runs - same effect as
  ODYSSEUS_TOOL_APPROVAL_GATE=0. Documented honestly in the settings
  row copy and in THREAT_MODEL.md, per review on #6304.
- value validated server-side ({ask, auto}, anything else -> 400)
- no new env var: the setting wires to the existing gate control
- tests: setting validation + _tool_approval_gate_bypassed behavior

* feat: surface deployment gate state on Tool approval row

Follow-up to StressTestor's re-review: when ODYSSEUS_TOOL_APPROVAL_GATE is
set to a falsy value, the Tool approval row still read 'Always ask' even though
the gate was off, misleading admins the other way.

GET /api/auth/settings now returns tool_approval_gate_env_disabled (derived
from TOOL_APPROVAL_GATE_ENABLED) for admins, and the settings row renders a
red notice naming the env var and explaining that the gate is off for every
run regardless of the stored setting. Non-admin/scrubbed responses do not
expose the deployment state. Test covers both env values and the scrub path.

* refactor: rename tool approval mode auto to off

The gate-off value is now "off" ("Off (YOLO)" in the UI) so the auto-approve name stays available for the future judged mode.

---------

Co-authored-by: Matej <matej@local>

src/agent_loop.py

@@ -14,12 +14,12 @@ import csv
 import difflib
 import html
 import json
+import logging
 import os
 import re
 import shlex
 import shutil
 import time
-import logging
 import hashlib
 from src.web_recovery import WebRecoveryBudget
 from itertools import count
@@ -16994,6 +16994,20 @@ def _detect_runaway_call(call_freq, threshold=15):
     sig = next((s for s, n in call_freq.items() if n >= threshold), None)
     return sig.split(":", 1)[0] if sig else None
 
+def _tool_approval_gate_bypassed(
+    exact_approval: Optional[ExactToolApproval] = None,
+) -> bool:
+    """Return whether the post-external-context tool approval gate is bypassed.
+
+    ``tool_approval_mode=off`` (admin setting, Settings → Agent Tools) bypasses
+    the gate on every run, the same effect as ``ODYSSEUS_TOOL_APPROVAL_GATE=0``.
+    A chat-session grant bypasses it only within the scope of its own task.
+    """
+    return (
+        get_setting("tool_approval_mode", "ask") == "off"
+        or bool(exact_approval and exact_approval.allow_remaining_actions)
+    )
+
 
 def _tool_result_signature(tool_result_records: list[dict]) -> str:
     """Return a bounded fingerprint of the observable result of a tool batch.
@@ -21437,9 +21451,7 @@ async def stream_agent_loop(
             )
             or messages_contain_external_untrusted_context(messages)
         ),
-        approval_gate_bypassed=bool(
-            exact_approval and exact_approval.allow_remaining_actions
-        ),
+        approval_gate_bypassed=_tool_approval_gate_bypassed(exact_approval),
         delegated_credential=bool(delegated_credential),
     )
     _has_tui_host_bridge = _tui_host_bridge_is_usable(client_runtime_context)