[alexb-openrouter]

The risk in plain terms

• Who can trigger it: anyone who controls the model's output (prompt injection, or a malicious response server).
• What goes wrong: an app sets a stopWhen that is already true and allowFinalResponse: false, meaning "do not run any tools". If the model's first response contains one auto-executable tool call plus one call that needs approval, the agent runs the auto-executable tool once before it checks stopWhen.
• The approval-gated tool itself never ran. Only apps that rely on stopWhen this way are affected.

How this PR fixes it

On the first response, ModelResult now evaluates shouldStopExecution() before handleApprovalCheck() when allowFinalResponse === false, and passes the result in. When it is met, handleApprovalCheck() still saves the approval-gated calls as pending (status: 'awaiting_approval'), but it does not execute the auto-approved calls.

const skipAutoExecution =
  this.options.allowFinalResponse === false && (await this.shouldStopExecution());
if (await this.handleApprovalCheck(toolCalls, 0, currentResponse, skipAutoExecution)) return;

// in handleApprovalCheck
const unsentResults = skipAutoExecution
  ? executableNow.map((call) => createRejectedResult(call.id, call.name, 'Tool execution skipped: stop condition met'))
  : await this.executeAutoApproveTools(executableNow, turnContext);

What changed

• packages/agent/src/lib/model-result.ts: new optional skipAutoExecution param on handleApprovalCheck(); first-response call site checks stopWhen first.
• packages/agent/tests/unit/stop-when-before-approval.test.ts: new regression test.
• .changeset/stop-when-before-approval.md: patch changeset.

Decisions:

• The check only applies when allowFinalResponse is false. With the default (allowFinalResponse on), a stop triggered by stopWhen already runs the pending calls of the last response (through handleApprovalCheck()) before the final toolChoice: 'none' request. So with the default, running the auto sibling when the stop condition is met is existing behavior (the final-response path executes them so they have matching outputs), not a bypass. Gating it there would change the behavior only on the first response and make it inconsistent with later rounds.
• Skipped calls are saved as error results in unsentToolResults (not dropped). On resume, every function call in the paused response still gets a matching output, so the follow-up request stays valid.

Testing

• Regression test stopWhen is evaluated before the approval check on the first response > does not run an auto-executable sibling of an approval-gated call when stopWhen is already met: always-true stopWhen + allowFinalResponse: false + one auto-executable tool + one requireApproval sibling in the same response. Asserts the auto tool runs 0 times and the approval call is saved pending. Fails on main (expected "vi.fn()" to not be called at all, but actually been called 1 times), passes with this change.
• Locally in packages/agent: biome check src tests, pnpm run typecheck, pnpm run build and vitest --run --project unit (108 files, 1246 tests) all pass. Transport is mocked; no network calls.
• Not covered: the resume-after-approval path is unchanged by this PR and not separately tested here.

Existing-PR search: searched open and closed PRs from the last 90 days (stopWhen approval, shouldStopExecution, stop condition auto-approve, SEC-768) and read #131 and #133. Neither changes this ordering; both touch approval/batch validation in the same file, so a small textual rebase may be needed but there is no logic overlap.

Security hardening fix. Fixes SEC-768

Link to Devin session: https://openrouter.devinenterprise.com/sessions/c212b5ff3bbc45e2b63007752496eb03
Open in Devin Desktop: https://openrouter.devinenterprise.com/desktop/session/c212b5ff3bbc45e2b63007752496eb03?variant=devin
Requested by: @alexb-openrouter

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access that start with 'Devin'.

• Disable automatic comment, CI, and merge conflict monitoring

---