How to require human approval before a Node.js AI agent creates a GitHub issue

Preflight AI — Thu, 01 Oct 2026 20:22:30 +0000

An AI agent proposes a GitHub issue. A human approves it. What happens if the title changes before execution, or the same approved request is submitted twice?

Preflight Action Gate is a downloadable local kit for Node.js agents that need a separate human approval step before creating GitHub issues. It binds approval to the exact repository, title and body, rejects changed intent and blocks repeat execution.

Start with the free local evaluation. No account or card is needed for the default trial.

Run the trial

Install Node.js 22 or newer if you do not already have it.
Download and extract the evaluation ZIP.
Open a terminal in the extracted folder and run:

node scripts/buyer-demo.js

The command calls a real local Preflight server with synthetic actions. It creates no external GitHub issue and needs no npm install, GitHub token, database or AI key.

A successful run ends with:

Successful use: 13 checks passed

The checks include rejection of unauthorized calls, enforcement of BLOCK and REVIEW, separation of agent and reviewer roles, rejection of changed intent and repeat execution, persisted execution state and verification of the signed local audit chain. These are local checks, not production certification.

Try a separate human approval

In one terminal, start the local server:

node scripts/local-kit.js

In another terminal, in the same extracted folder, propose an issue:

node examples/self-service-issue.js propose

A separate reviewer inspects the returned request ID. Replace REQUEST_ID with the actual value:

node scripts/local-review.js REQUEST_ID

Inspection alone does not approve the request. After checking the exact repository, title and body, the reviewer explicitly confirms the displayed intent hash. Replace both placeholders:

node scripts/local-review.js REQUEST_ID --approve EXACT_INTENT_HASH

Then run the dry-run execution:

node examples/self-service-issue.js execute

Run the execution command again to check replay rejection. The default workflow above does not write to GitHub.

Connecting your Node.js agent

The archive includes a reusable SDK, an issue example and local reviewer commands. The local API uses separate agent and reviewer credentials with these routes:

POST /simulate proposes the action for a decision.
POST /approve records approval for the exact stored intent.
POST /execute attempts the approved action.

Only GitHub issue creation is included as a supplied live connector. Optional live mode requires a repository-scoped GitHub credential held by the trusted server and an exact repository allowlist. Follow the live GitHub guide inside the archive; keep write credentials out of the agent process.

An owner-guided direct-token test created a real GitHub issue and rejected a repeated execution. An independent customer's setup has not yet been validated.

What you get for $49

Buy the internal-use license on Gumroad: $49 once. Applicable checkout taxes may be added.

The download includes the local software kit, SDK, examples, setup guides and a license for ongoing internal use of the purchased version by one organization, within the supplied single-host Node.js/GitHub issue workflow.

The free evaluation and paid edition use the same runtime. The evaluation license permits local testing; payment grants ongoing internal-use rights. There is no hidden feature unlock. This is proprietary software, not an open-source framework.

Hosting, custom integration, a production SLA and future updates are not included. Read the license and product description before buying. The intellectual property remains with its owner.

Limits to check before using it

An agent with independent GitHub write credentials or access to operator secrets can bypass the gate. Separate OS permissions are necessary; this kit does not provide that isolation for you.

Local state and audit writes are separate, and GitHub is not part of an atomic transaction. A timeout may mean an issue already exists. Uncertain outcomes need reconciliation, not automatic retries. There is no exactly-once guarantee.

The signed local audit trail depends on protecting its signing key. It is not independent external custody or certified compliance evidence.

This kit is not a general prompt-injection defense, MCP firewall or approval layer for arbitrary tools. If your framework's existing approval controls already cover your needs, use them.