FluxyChat

AI Agents

Tool approval (HMAC)

Per-tool HMAC-signed approvals compatible with Vercel AI SDK 7 toolApproval patterns.

Tool approval with HMAC signatures

FluxyChat agents support human-in-the-loop (HITL) tool execution with HMAC-signed approval requests — the same mental model as Vercel AI SDK 7 toolApproval.

Per-tool approval map

import { resolveToolApproval, type ToolApprovalConfig } from "@fluxy-chat/agent";

const approval: ToolApprovalConfig = {
  searchWeb: "user-approval",
  deleteRecord: "denied",
  sendEmail: async (input) => {
    if (typeof input === "object" && input && "to" in input) return "approved";
    return "denied";
  },
};

const decision = await resolveToolApproval(approval, {
  id: "call_1",
  name: "searchWeb",
  input: { query: "weather" },
});
// decision.type === "user-approval"

HMAC signing

Approval payloads are signed so clients cannot forge approvals:

import {
  signApproval,
  verifyApprovalSignature,
  hashCanonical,
} from "@fluxy-chat/agent";

const secret = process.env.TOOL_APPROVAL_HMAC_SECRET!;

const signature = await signApproval({
  secret,
  approvalId: "apr_1",
  toolCallId: "call_1",
  toolName: "searchWeb",
  input: { query: "weather" },
});

const valid = await verifyApprovalSignature({
  secret,
  signature,
  approvalId: "apr_1",
  toolCallId: "call_1",
  toolName: "searchWeb",
  input: { query: "weather" },
});

Dashboard UI

The console chat embeds ToolApprovalPanel when HITL is enabled. Operators approve or deny pending tool calls for the active room.

Set NEXT_PUBLIC_DASHBOARD_LABS=1 and open a room with an agent that declares user-approval tools.

Worker API

MethodPathPurpose
GET/api/hitl/approvals/pendingList pending approvals for a room
POST/api/hitl/approvals/:id/respondApprove or deny with HMAC token

On this page