1package core
2
3import (
4 "encoding/json"
5 "strings"
6 "sync"
7)
8
9// ConfirmDecision is the outcome of a confirmation prompt for a
10// tool call. It answers two questions: should this call run, and
11// should future calls of this shape skip the prompt for the rest
12// of the session.
13type ConfirmDecision struct {
14 Allow bool
15 // Reason is shown to the model as the tool error when
16 // Allow=false. Examples: "user declined", "user refused: rm -rf
17 // looks dangerous".
18 Reason string
19 // RememberTool, when true, auto-allows every future call of the
20 // same tool name for the rest of the session without prompting.
21 RememberTool bool
22 // RememberAll, when true, auto-allows every future call of any
23 // tool for the rest of the session without prompting.
24 // Effectively turns yolo back on for this session.
25 RememberAll bool
26}
27
28// Confirmer asks the user to approve or refuse a single tool call.
29// Implementations block until the user responds (or the agent's
30// context is cancelled, in which case they should return
31// Allow=false with a cancellation reason).
32//
33// preview is a short one-line summary of the args (the shell
34// command, the file path, the URL) that the TUI shows alongside
35// the tool name. It is intentionally short: no full tool outputs.
36type Confirmer interface {
37 Confirm(toolName string, preview string) ConfirmDecision
38}
39
40// ConfirmGate wraps a Confirmer with session-scoped memory for the
41// "allow, always" decisions. Once the user picks RememberTool on a
42// given tool name, the gate short-circuits subsequent calls of that
43// name. Once the user picks RememberAll, the gate short-circuits
44// everything for the rest of the session.
45//
46// Safe for concurrent use: the allow-lists are guarded by a mutex
47// because the agent can queue tool calls from different goroutines.
48type ConfirmGate struct {
49 inner Confirmer
50
51 mu sync.Mutex
52 allowAll bool
53 allowedTool map[string]bool
54}
55
56// NewConfirmGate returns a gate backed by inner. When inner is nil,
57// the gate operates in auto-refuse mode: every tool call is denied
58// with a fixed reason. That's what non-interactive modes (-p /
59// --json / rpc) use when --no-yolo is on, since they have no way
60// to prompt the user.
61func NewConfirmGate(inner Confirmer) *ConfirmGate {
62 return &ConfirmGate{
63 inner: inner,
64 allowedTool: map[string]bool{},
65 }
66}
67
68// Check is the BeforeToolExecute-style entry point. Returns
69// allowed, reason, modifiedArgs. modifiedArgs is always nil: the
70// gate never rewrites args; it only allows or denies.
71//
72// A nil ConfirmGate always allows (treat as yolo mode).
73func (g *ConfirmGate) Check(toolName, preview string) (bool, string, json.RawMessage) {
74 if g == nil {
75 return true, "", nil
76 }
77 g.mu.Lock()
78 if g.allowAll {
79 g.mu.Unlock()
80 return true, "", nil
81 }
82 if g.allowedTool[toolName] {
83 g.mu.Unlock()
84 return true, "", nil
85 }
86 g.mu.Unlock()
87
88 g.mu.Lock()
89 inner := g.inner
90 g.mu.Unlock()
91 if inner == nil {
92 return false, "tool call refused: --no-yolo is active and there is no interactive prompt in this mode; ask the user what to do instead", nil
93 }
94
95 decision := inner.Confirm(toolName, preview)
96
97 g.mu.Lock()
98 if decision.Allow {
99 if decision.RememberAll {
100 g.allowAll = true
101 }
102 if decision.RememberTool {
103 g.allowedTool[toolName] = true
104 }
105 }
106 g.mu.Unlock()
107
108 reason := strings.TrimSpace(decision.Reason)
109 if !decision.Allow && reason == "" {
110 reason = "tool call refused by user"
111 }
112 return decision.Allow, reason, nil
113}
114
115// Reset clears the session memory. Invoked when the user toggles
116// yolo mode back on via /yolo or closes the session.
117func (g *ConfirmGate) Reset() {
118 if g == nil {
119 return
120 }
121 g.mu.Lock()
122 g.allowAll = false
123 g.allowedTool = map[string]bool{}
124 g.mu.Unlock()
125}
126
127// AllowAll flips the gate into "always allow" for the rest of the
128// session. Used by /yolo on to turn confirmation off at runtime
129// without having to restart with the flag flipped.
130func (g *ConfirmGate) AllowAll() {
131 if g == nil {
132 return
133 }
134 g.mu.Lock()
135 g.allowAll = true
136 g.mu.Unlock()
137}
138
139// SetConfirmer replaces the inner Confirmer. Used by the cli to
140// hand the Interactive TUI to a gate that was constructed before
141// the TUI existed (a construction-order knot we unwind here).
142// Safe to call from any goroutine.
143func (g *ConfirmGate) SetConfirmer(c Confirmer) {
144 if g == nil {
145 return
146 }
147 g.mu.Lock()
148 g.inner = c
149 g.mu.Unlock()
150}
151
152// BuildPreview turns a tool call's JSON args into a short one-line
153// summary the TUI can show in the confirmation prompt. Prioritises
154// obvious human-readable fields (command, path, url) over raw JSON.
155// Returns at most maxLen characters.
156func BuildPreview(args json.RawMessage, maxLen int) string {
157 if maxLen <= 0 {
158 maxLen = 120
159 }
160 if len(args) == 0 {
161 return ""
162 }
163 var m map[string]any
164 if err := json.Unmarshal(args, &m); err != nil {
165 return truncatePreview(string(args), maxLen)
166 }
167 for _, k := range []string{"command", "path", "file_path", "url", "query", "name"} {
168 if v, ok := m[k].(string); ok && v != "" {
169 return truncatePreview(v, maxLen)
170 }
171 }
172 b, _ := json.Marshal(m)
173 return truncatePreview(string(b), maxLen)
174}
175
176func truncatePreview(s string, n int) string {
177 s = strings.TrimSpace(s)
178 if len(s) <= n {
179 return s
180 }
181 return s[:n-1] + "\u2026"
182}