1package core
2
3import (
4 "encoding/json"
5 "strings"
6 "sync"
7)
8
9// ConfirmDecision is the outcome of a confirmation prompt for a
10// tool call. It answers two questions: should this call run, and
11// should future calls of this shape skip the prompt for the rest
12// of the session.
13type ConfirmDecision struct {
14 Allow bool
15 // Reason is shown to the model as the tool error when
16 // Allow=false. Examples: "user declined", "user refused: rm -rf
17 // looks dangerous".
18 Reason string
19 // RememberTool, when true, auto-allows every future call of the
20 // same tool name for the rest of the session without prompting.
21 RememberTool bool
22 // RememberAll, when true, auto-allows every future call of any
23 // tool for the rest of the session without prompting.
24 // Effectively turns yolo back on for this session.
25 RememberAll bool
26}
27
28// Confirmer asks the user to approve or refuse a single tool call.
29// Implementations block until the user responds (or the agent's
30// context is cancelled, in which case they should return
31// Allow=false with a cancellation reason).
32//
33// preview is a short one-line summary of the args (the shell
34// command, the file path, the URL) that the TUI shows alongside
35// the tool name. It is intentionally short: no full tool outputs.
36type Confirmer interface {
37 Confirm(toolName string, preview string) ConfirmDecision
38}
39
40// ToolCallConfirmation contains the summary and optional side-effect-free
41// content shown while approving a specific tool call.
42type ToolCallConfirmation struct {
43 ID string
44 Name string
45 Summary string
46 Content string
47 // Origin routes a confirmation to its owning host view. It is opaque to
48 // the confirmation gate and never shown to the model.
49 Origin string
50}
51
52// ToolCallConfirmer is optionally implemented by confirmation UIs that can
53// attach rich preview content to the matching live tool call.
54type ToolCallConfirmer interface {
55 ConfirmToolCall(call ToolCallConfirmation) ConfirmDecision
56}
57
58// ConfirmGate wraps a Confirmer with session-scoped memory for the
59// "allow, always" decisions. Once the user picks RememberTool on a
60// given tool name, the gate short-circuits subsequent calls of that
61// name. Once the user picks RememberAll, the gate short-circuits
62// everything for the rest of the session.
63//
64// Safe for concurrent use: the allow-lists are guarded by a mutex
65// because the agent can queue tool calls from different goroutines.
66type ConfirmGate struct {
67 inner Confirmer
68
69 mu sync.Mutex
70 allowAll bool
71 allowedTool map[string]bool
72}
73
74// NewConfirmGate returns a gate backed by inner. Inner can be nil;
75// in that case every not-yet-allowed tool call is refused with a
76// fixed reason (the gate is effectively a blocker until AllowAll /
77// SetConfirmer is called).
78func NewConfirmGate(inner Confirmer) *ConfirmGate {
79 return &ConfirmGate{
80 inner: inner,
81 allowedTool: map[string]bool{},
82 }
83}
84
85// Check is the BeforeToolExecute-style entry point. Returns
86// allowed, reason, modifiedArgs. modifiedArgs is always nil: the
87// gate never rewrites args; it only allows or denies.
88//
89// A nil ConfirmGate always allows (treat as yolo mode).
90func (g *ConfirmGate) Check(toolName, preview string) (bool, string, json.RawMessage) {
91 return g.CheckToolCall(ToolCallConfirmation{Name: toolName, Summary: preview})
92}
93
94// CheckToolCall behaves like Check and additionally gives rich confirmation
95// UIs the call ID and side-effect-free preview content.
96func (g *ConfirmGate) CheckToolCall(call ToolCallConfirmation) (bool, string, json.RawMessage) {
97 if g == nil {
98 return true, "", nil
99 }
100 g.mu.Lock()
101 if g.allowAll {
102 g.mu.Unlock()
103 return true, "", nil
104 }
105 if g.allowedTool[call.Name] {
106 g.mu.Unlock()
107 return true, "", nil
108 }
109 inner := g.inner
110 g.mu.Unlock()
111 if inner == nil {
112 return false, "tool call refused: --no-yolo is active and there is no interactive prompt in this mode; ask the user what to do instead", nil
113 }
114
115 var decision ConfirmDecision
116 if detailed, ok := inner.(ToolCallConfirmer); ok {
117 decision = detailed.ConfirmToolCall(call)
118 } else {
119 decision = inner.Confirm(call.Name, call.Summary)
120 }
121
122 g.mu.Lock()
123 if decision.Allow {
124 if decision.RememberAll {
125 g.allowAll = true
126 }
127 if decision.RememberTool {
128 g.allowedTool[call.Name] = true
129 }
130 }
131 g.mu.Unlock()
132
133 reason := strings.TrimSpace(decision.Reason)
134 if !decision.Allow && reason == "" {
135 reason = "tool call refused by user"
136 }
137 return decision.Allow, reason, nil
138}
139
140// Reset clears the session memory. Invoked when the user toggles
141// yolo mode back on via /yolo or closes the session.
142func (g *ConfirmGate) Reset() {
143 if g == nil {
144 return
145 }
146 g.mu.Lock()
147 g.allowAll = false
148 g.allowedTool = map[string]bool{}
149 g.mu.Unlock()
150}
151
152// AllowAll flips the gate into "always allow" for the rest of the
153// session. Used by /yolo on to turn confirmation off at runtime
154// without having to restart with the flag flipped.
155func (g *ConfirmGate) AllowAll() {
156 if g == nil {
157 return
158 }
159 g.mu.Lock()
160 g.allowAll = true
161 g.mu.Unlock()
162}
163
164// SetConfirmer replaces the inner Confirmer. Used by the cli to
165// hand the Interactive TUI to a gate that was constructed before
166// the TUI existed (a construction-order knot we unwind here).
167// Safe to call from any goroutine.
168func (g *ConfirmGate) SetConfirmer(c Confirmer) {
169 if g == nil {
170 return
171 }
172 g.mu.Lock()
173 g.inner = c
174 g.mu.Unlock()
175}
176
177// BuildPreview turns a tool call's JSON args into a short one-line
178// summary the TUI can show in the confirmation prompt. Prioritises
179// obvious human-readable fields (command, path, url) over raw JSON.
180// Returns at most maxLen characters.
181func BuildPreview(args json.RawMessage, maxLen int) string {
182 if maxLen <= 0 {
183 maxLen = 120
184 }
185 if len(args) == 0 {
186 return ""
187 }
188 var m map[string]any
189 if err := json.Unmarshal(args, &m); err != nil {
190 return truncatePreview(string(args), maxLen)
191 }
192 for _, k := range []string{"command", "path", "file_path", "url", "query", "name"} {
193 if v, ok := m[k].(string); ok && v != "" {
194 return truncatePreview(v, maxLen)
195 }
196 }
197 b, _ := json.Marshal(m)
198 return truncatePreview(string(b), maxLen)
199}
200
201func truncatePreview(s string, n int) string {
202 s = strings.TrimSpace(s)
203 if len(s) <= n {
204 return s
205 }
206 if n <= 3 {
207 return "..."[:n]
208 }
209 return s[:n-3] + "..."
210}