fix(gateway): bind system.run approvals to exec approvals

src/cli/nodes-cli.coverage.test.ts

@@ -128,6 +128,7 @@ describe("nodes-cli coverage", () => {
       agentId: "main",
       approved: true,
       approvalDecision: "allow-once",
+      runId: expect.any(String),
     });
     expect(invoke?.params?.timeoutMs).toBe(5000);
   });
@@ -153,6 +154,7 @@ describe("nodes-cli coverage", () => {
       agentId: "main",
       approved: true,
       approvalDecision: "allow-once",
+      runId: expect.any(String),
     });
   });
 

src/cli/nodes-cli/register.invoke.ts

@@ -269,8 +269,11 @@ export function registerNodesInvokeCommands(nodes: Command) {
           }
 
           const requiresAsk = hostAsk === "always" || hostAsk === "on-miss";
+          let approvalId: string | null = null;
           if (requiresAsk) {
+            approvalId = crypto.randomUUID();
             const decisionResult = (await callGatewayCli("exec.approval.request", opts, {
+              id: approvalId,
               command: rawCommand ?? argv.join(" "),
               cwd: opts.cwd,
               host: "node",
@@ -330,6 +333,9 @@ export function registerNodesInvokeCommands(nodes: Command) {
           if (approvalDecision) {
             (invokeParams.params as Record<string, unknown>).approvalDecision = approvalDecision;
           }
+          if (approvedByAsk && approvalId) {
+            (invokeParams.params as Record<string, unknown>).runId = approvalId;
+          }
           if (invokeTimeout !== undefined) {
             invokeParams.timeoutMs = invokeTimeout;
           }