comfy-agent-permissions skill will be wrong once cloud#13715 removes the 20s approval refresh loop #1020

Summary

cloud#13715 ("the running agent is the only writer of its permission state") removes the local agent's 20-second refreshApprovals loop and the Refresh() methods on both permission stores. After it merges, a comfy agent allow run while the agent is running is never picked up, and the agent's next write of permissions.json / egress-allow.json overwrites it.

comfy_cli/skills/comfy-agent-permissions/SKILL.md still describes the old behaviour and still makes the CLI the primary approval route:

• A running agent applies it within about 20 seconds; until then the folder or host is still refused, so wait for the approval to land (retry once after the pause, not in a loop) before continuing.

• Point to a panel button only when you know this panel has one; otherwise the command is the way.

• The description: frontmatter also names comfy agent allow --approve as how the user approves.

So once cloud#13715 lands, the skill instructs a user to run a command that silently does nothing while the agent is running — and whose apparent effect is then erased.

What the skill should say instead

Per the cloud PR's own docs, after the change:

• Approvals for a running agent go through the agent API (/agent/permissions, /agent/permissions/{id}/approve|deny, served by ComfyUI under /api/agent) or the in-chat permission card.
• comfy agent allow / deny edit the JSON files directly, so they take effect only while no agent is running (they are applied at the next start).
• Drop the "applies within about 20 seconds" wait-and-retry guidance.

Sequencing

This must land with or just after cloud#13715, not before — the currently shipping agent still has the refresh loop, so changing the skill early would make it wrong for today's release.

Context

Raised while reviewing the cloud PR's open review threads; two reviewers independently flagged the cross-repo half (cloud-code-bot, High; chatgpt-codex-connector, P1). The in-repo half of that finding is already fixed on the cloud PR's current revision; this skill is the part that cannot be fixed there.

Task Decomposition

Trivial: this is a documentation-only edit to one skill file, so no decomposition is needed. Acceptance: the skill no longer tells the user to wait ~20s for a running agent to pick up comfy agent allow, names the agent API / in-chat card as the route for a running agent, and states that the CLI commands apply only when no agent is running.