fix(awooop): persist approved ssh gateway blocks

apps/api/src/services/approval_execution.py

@@ -34,7 +34,7 @@ from src.core.config import settings
 from src.core.redis_client import get_redis
 from src.db.base import get_db_context
 from src.models.approval import ApprovalRequest
-from src.plugins.mcp.gateway import GatewayContext, McpGateway
+from src.plugins.mcp.gateway import GatewayContext, McpGateway, McpGatewayError
 from src.plugins.mcp.interfaces import MCPToolResult
 from src.services.approval_db import get_approval_service, get_timeline_service
 from src.services.executor import ExecutionResult, OperationType, get_executor
@@ -813,19 +813,33 @@ class ApprovalExecutionService:
             },
         }
         async with get_db_context(_SSH_GATEWAY_PROJECT_ID) as db:
-            return await McpGateway(db).call(
-                GatewayContext(
-                    project_id=_SSH_GATEWAY_PROJECT_ID,
-                    agent_id=_SSH_GATEWAY_AGENT_ID,
-                    tool_name=tool_name,
-                    run_id=run_id,
-                    trace_id=approval.incident_id or str(approval.id),
-                    is_shadow=False,
-                    environment={"env": "prod"},
-                    required_scope=required_scope,
-                ),
-                params_with_audit,
+            ctx = GatewayContext(
+                project_id=_SSH_GATEWAY_PROJECT_ID,
+                agent_id=_SSH_GATEWAY_AGENT_ID,
+                tool_name=tool_name,
+                run_id=run_id,
+                trace_id=approval.incident_id or str(approval.id),
+                is_shadow=False,
+                environment={"env": "prod"},
+                required_scope=required_scope,
             )
+            try:
+                return await McpGateway(db).call(ctx, params_with_audit)
+            except McpGatewayError as exc:
+                logger.warning(
+                    "mcp_gateway_approved_ssh_blocked",
+                    approval_id=str(approval.id),
+                    incident_id=approval.incident_id,
+                    tool=tool_name,
+                    gate=exc.gate,
+                    error_code=exc.error_code,
+                    error=str(exc),
+                )
+                return MCPToolResult(
+                    success=False,
+                    execution_id=f"blocked:{tool_name}:{run_id}",
+                    error=f"{exc.error_code}: {exc}",
+                )
 
     async def _push_execution_result_to_alert(
         self,