fix(exec-approval): treat expiresAtMs=-1 as non-expiring

src/agent/tools/exec-approval-types.ts

@@ -32,7 +32,7 @@ export interface ExecApprovalRequest {
   riskLevel: "safe" | "needs-review" | "dangerous";
   /** Reasons for the risk assessment */
   riskReasons: string[];
-  /** When this approval expires (ms since epoch) */
+  /** When this approval expires (ms since epoch). -1 means no timeout. */
   expiresAtMs: number;
 }
 

src/hub/exec-approval-manager.test.ts

@@ -88,6 +88,27 @@ describe("ExecApprovalManager", () => {
     expect(result.decision).toBe("deny");
   });
 
+  it("keeps approval pending indefinitely when timeoutMs is -1", async () => {
+    const promise = manager.requestApproval({
+      agentId: "agent-1",
+      command: "cmd",
+      riskLevel: "needs-review",
+      riskReasons: [],
+      timeoutMs: -1,
+    });
+
+    const request = sendToClient.mock.calls[0]![1];
+    expect(request.expiresAtMs).toBe(-1);
+
+    vi.advanceTimersByTime(60_000);
+    expect(manager.pendingCount).toBe(1);
+
+    manager.resolveApproval(request.approvalId, "allow-once");
+    const result = await promise;
+    expect(result.approved).toBe(true);
+    expect(result.decision).toBe("allow-once");
+  });
+
   it("honors askFallback full on timeout", async () => {
     const promise = manager.requestApproval({
       agentId: "agent-1",