1package core
2
3import (
4 "encoding/json"
5 "strings"
6 "sync"
7)
8
9// ConfirmDecision is the outcome of a confirmation prompt for a
10// tool call. It answers two questions: should this call run, and
11// should future calls of this shape skip the prompt for the rest
12// of the session.
13type ConfirmDecision struct {
14 Allow bool
15 // Reason is shown to the model as the tool error when
16 // Allow=false. Examples: "user declined", "user refused: rm -rf
17 // looks dangerous".
18 Reason string
19 // RememberTool, when true, auto-allows every future call with the
20 // same confirmation key for the rest of the session without prompting.
21 // The key is the tool name unless the tool implements ConfirmationKeyer
22 // to expose a finer grant (for example one action of a multiplexed tool).
23 RememberTool bool
24 // RememberAll, when true, auto-allows every future call of any
25 // tool for the rest of the session without prompting.
26 // Effectively turns yolo back on for this session.
27 RememberAll bool
28}
29
30// Confirmer asks the user to approve or refuse a single tool call.
31// Implementations block until the user responds (or the agent's
32// context is cancelled, in which case they should return
33// Allow=false with a cancellation reason).
34//
35// preview is a short one-line summary of the args (the shell
36// command, the file path, the URL) that the TUI shows alongside
37// the tool name. It is intentionally short: no full tool outputs.
38type Confirmer interface {
39 Confirm(toolName string, preview string) ConfirmDecision
40}
41
42// ToolCallConfirmation contains the summary and optional side-effect-free
43// content shown while approving a specific tool call.
44type ToolCallConfirmation struct {
45 ID string
46 Name string
47 Summary string
48 Content string
49 // Origin routes a confirmation to its owning host view. It is opaque to
50 // the confirmation gate and never shown to the model.
51 Origin string
52 // Key is the session-scoped identity the gate remembers for "always
53 // allow". It lets one tool expose several confirmable actions
54 // ("subagent:status") without granting the others. Empty falls back to
55 // Name so every other tool keeps the per-name grant.
56 Key string
57}
58
59// ConfirmationKeyer is optionally implemented by tools whose confirmation
60// grant should be narrower than the tool name. The returned key is what the
61// ConfirmGate stores for "always allow".
62//
63// Implementations must fail closed: when the effective key cannot be derived
64// from args, return an empty string so the gate falls back to the tool name,
65// which never widens an existing grant.
66type ConfirmationKeyer interface {
67 ConfirmationKey(args json.RawMessage) string
68}
69
70// ConfirmationKey resolves the session grant identity for one tool call. A
71// tool that implements ConfirmationKeyer may report a finer key (for example
72// one action of a multiplexed tool); an empty key falls back to name, so an
73// undetermined key cannot widen the remembered grant beyond the tool name.
74func ConfirmationKey(tool Tool, name string, args json.RawMessage) string {
75 if keyer, ok := tool.(ConfirmationKeyer); ok {
76 if key := keyer.ConfirmationKey(args); key != "" {
77 return key
78 }
79 }
80 return name
81}
82
83// ToolCallConfirmer is optionally implemented by confirmation UIs that can
84// attach rich preview content to the matching live tool call.
85type ToolCallConfirmer interface {
86 ConfirmToolCall(call ToolCallConfirmation) ConfirmDecision
87}
88
89// ConfirmGate wraps a Confirmer with session-scoped memory for the
90// "allow, always" decisions. Once the user picks RememberTool on a
91// given confirmation key (the tool name, or a finer per-action key when
92// the tool implements ConfirmationKeyer), the gate short-circuits
93// subsequent calls with that key. Once the user picks RememberAll, the
94// gate short-circuits everything for the rest of the session.
95//
96// Safe for concurrent use: the allow-lists are guarded by a mutex
97// because the agent can queue tool calls from different goroutines.
98type ConfirmGate struct {
99 inner Confirmer
100
101 mu sync.Mutex
102 allowAll bool
103 allowedTool map[string]bool
104}
105
106// NewConfirmGate returns a gate backed by inner. Inner can be nil;
107// in that case every not-yet-allowed tool call is refused with a
108// fixed reason (the gate is effectively a blocker until AllowAll /
109// SetConfirmer is called).
110func NewConfirmGate(inner Confirmer) *ConfirmGate {
111 return &ConfirmGate{
112 inner: inner,
113 allowedTool: map[string]bool{},
114 }
115}
116
117// Check is the BeforeToolExecute-style entry point. Returns
118// allowed, reason, modifiedArgs. modifiedArgs is always nil: the
119// gate never rewrites args; it only allows or denies.
120//
121// A nil ConfirmGate always allows (treat as yolo mode).
122func (g *ConfirmGate) Check(toolName, preview string) (bool, string, json.RawMessage) {
123 return g.CheckToolCall(ToolCallConfirmation{Name: toolName, Summary: preview})
124}
125
126// CheckToolCall behaves like Check and additionally gives rich confirmation
127// UIs the call ID and side-effect-free preview content.
128func (g *ConfirmGate) CheckToolCall(call ToolCallConfirmation) (bool, string, json.RawMessage) {
129 if g == nil {
130 return true, "", nil
131 }
132 g.mu.Lock()
133 if g.allowAll {
134 g.mu.Unlock()
135 return true, "", nil
136 }
137 if g.allowedTool[call.confirmationKey()] {
138 g.mu.Unlock()
139 return true, "", nil
140 }
141 inner := g.inner
142 g.mu.Unlock()
143 if inner == nil {
144 return false, "tool call refused: --no-yolo is active and there is no interactive prompt in this mode; ask the user what to do instead", nil
145 }
146
147 var decision ConfirmDecision
148 if detailed, ok := inner.(ToolCallConfirmer); ok {
149 decision = detailed.ConfirmToolCall(call)
150 } else {
151 decision = inner.Confirm(call.Name, call.Summary)
152 }
153
154 g.mu.Lock()
155 if decision.Allow {
156 if decision.RememberAll {
157 g.allowAll = true
158 }
159 if decision.RememberTool {
160 g.allowedTool[call.confirmationKey()] = true
161 }
162 }
163 g.mu.Unlock()
164
165 reason := strings.TrimSpace(decision.Reason)
166 if !decision.Allow && reason == "" {
167 reason = "tool call refused by user"
168 }
169 return decision.Allow, reason, nil
170}
171
172// confirmationKey is the grant identity for the call: an explicit action-aware
173// key when the caller supplied one, else the registered tool name.
174func (call ToolCallConfirmation) confirmationKey() string {
175 if call.Key != "" {
176 return call.Key
177 }
178 return call.Name
179}
180
181// Reset clears the session memory. Invoked when the user toggles
182// yolo mode back on via /yolo or closes the session.
183func (g *ConfirmGate) Reset() {
184 if g == nil {
185 return
186 }
187 g.mu.Lock()
188 g.allowAll = false
189 g.allowedTool = map[string]bool{}
190 g.mu.Unlock()
191}
192
193// AllowAll flips the gate into "always allow" for the rest of the
194// session. Used by /yolo on to turn confirmation off at runtime
195// without having to restart with the flag flipped.
196func (g *ConfirmGate) AllowAll() {
197 if g == nil {
198 return
199 }
200 g.mu.Lock()
201 g.allowAll = true
202 g.mu.Unlock()
203}
204
205// SetConfirmer replaces the inner Confirmer. Used by the cli to
206// hand the Interactive TUI to a gate that was constructed before
207// the TUI existed (a construction-order knot we unwind here).
208// Safe to call from any goroutine.
209func (g *ConfirmGate) SetConfirmer(c Confirmer) {
210 if g == nil {
211 return
212 }
213 g.mu.Lock()
214 g.inner = c
215 g.mu.Unlock()
216}
217
218// BuildPreview turns a tool call's JSON args into a short one-line
219// summary the TUI can show in the confirmation prompt. Prioritises
220// obvious human-readable fields (command, path, url) over raw JSON.
221// Returns at most maxLen characters.
222func BuildPreview(args json.RawMessage, maxLen int) string {
223 if maxLen <= 0 {
224 maxLen = 120
225 }
226 if len(args) == 0 {
227 return ""
228 }
229 var m map[string]any
230 if err := json.Unmarshal(args, &m); err != nil {
231 return truncatePreview(string(args), maxLen)
232 }
233 for _, k := range []string{"command", "path", "file_path", "url", "query", "name"} {
234 if v, ok := m[k].(string); ok && v != "" {
235 return truncatePreview(v, maxLen)
236 }
237 }
238 b, _ := json.Marshal(m)
239 return truncatePreview(string(b), maxLen)
240}
241
242func truncatePreview(s string, n int) string {
243 s = strings.TrimSpace(s)
244 if len(s) <= n {
245 return s
246 }
247 if n <= 3 {
248 return "..."[:n]
249 }
250 return s[:n-3] + "..."
251}