1package core
2
3import (
4 "encoding/json"
5 "strings"
6 "sync"
7)
8
9// ConfirmDecision is the outcome of a confirmation prompt for a
10// tool call. It answers two questions: should this call run, and
11// should future calls of this shape skip the prompt for the rest
12// of the session.
13type ConfirmDecision struct {
14 Allow bool
15 // Reason is shown to the model as the tool error when
16 // Allow=false. Examples: "user declined", "user refused: rm -rf
17 // looks dangerous".
18 Reason string
19 // RememberTool, when true, auto-allows every future call of the
20 // same tool name for the rest of the session without prompting.
21 RememberTool bool
22 // RememberAll, when true, auto-allows every future call of any
23 // tool for the rest of the session without prompting.
24 // Effectively turns yolo back on for this session.
25 RememberAll bool
26}
27
28// Confirmer asks the user to approve or refuse a single tool call.
29// Implementations block until the user responds (or the agent's
30// context is cancelled, in which case they should return
31// Allow=false with a cancellation reason).
32//
33// preview is a short one-line summary of the args (the shell
34// command, the file path, the URL) that the TUI shows alongside
35// the tool name. It is intentionally short: no full tool outputs.
36type Confirmer interface {
37 Confirm(toolName string, preview string) ConfirmDecision
38}
39
40// ToolCallConfirmation contains the summary and optional side-effect-free
41// content shown while approving a specific tool call.
42type ToolCallConfirmation struct {
43 ID string
44 Name string
45 Summary string
46 Content string
47}
48
49// ToolCallConfirmer is optionally implemented by confirmation UIs that can
50// attach rich preview content to the matching live tool call.
51type ToolCallConfirmer interface {
52 ConfirmToolCall(call ToolCallConfirmation) ConfirmDecision
53}
54
55// ConfirmGate wraps a Confirmer with session-scoped memory for the
56// "allow, always" decisions. Once the user picks RememberTool on a
57// given tool name, the gate short-circuits subsequent calls of that
58// name. Once the user picks RememberAll, the gate short-circuits
59// everything for the rest of the session.
60//
61// Safe for concurrent use: the allow-lists are guarded by a mutex
62// because the agent can queue tool calls from different goroutines.
63type ConfirmGate struct {
64 inner Confirmer
65
66 mu sync.Mutex
67 allowAll bool
68 allowedTool map[string]bool
69}
70
71// NewConfirmGate returns a gate backed by inner. Inner can be nil;
72// in that case every not-yet-allowed tool call is refused with a
73// fixed reason (the gate is effectively a blocker until AllowAll /
74// SetConfirmer is called).
75func NewConfirmGate(inner Confirmer) *ConfirmGate {
76 return &ConfirmGate{
77 inner: inner,
78 allowedTool: map[string]bool{},
79 }
80}
81
82// Check is the BeforeToolExecute-style entry point. Returns
83// allowed, reason, modifiedArgs. modifiedArgs is always nil: the
84// gate never rewrites args; it only allows or denies.
85//
86// A nil ConfirmGate always allows (treat as yolo mode).
87func (g *ConfirmGate) Check(toolName, preview string) (bool, string, json.RawMessage) {
88 return g.CheckToolCall(ToolCallConfirmation{Name: toolName, Summary: preview})
89}
90
91// CheckToolCall behaves like Check and additionally gives rich confirmation
92// UIs the call ID and side-effect-free preview content.
93func (g *ConfirmGate) CheckToolCall(call ToolCallConfirmation) (bool, string, json.RawMessage) {
94 if g == nil {
95 return true, "", nil
96 }
97 g.mu.Lock()
98 if g.allowAll {
99 g.mu.Unlock()
100 return true, "", nil
101 }
102 if g.allowedTool[call.Name] {
103 g.mu.Unlock()
104 return true, "", nil
105 }
106 inner := g.inner
107 g.mu.Unlock()
108 if inner == nil {
109 return false, "tool call refused: --no-yolo is active and there is no interactive prompt in this mode; ask the user what to do instead", nil
110 }
111
112 var decision ConfirmDecision
113 if detailed, ok := inner.(ToolCallConfirmer); ok {
114 decision = detailed.ConfirmToolCall(call)
115 } else {
116 decision = inner.Confirm(call.Name, call.Summary)
117 }
118
119 g.mu.Lock()
120 if decision.Allow {
121 if decision.RememberAll {
122 g.allowAll = true
123 }
124 if decision.RememberTool {
125 g.allowedTool[call.Name] = true
126 }
127 }
128 g.mu.Unlock()
129
130 reason := strings.TrimSpace(decision.Reason)
131 if !decision.Allow && reason == "" {
132 reason = "tool call refused by user"
133 }
134 return decision.Allow, reason, nil
135}
136
137// Reset clears the session memory. Invoked when the user toggles
138// yolo mode back on via /yolo or closes the session.
139func (g *ConfirmGate) Reset() {
140 if g == nil {
141 return
142 }
143 g.mu.Lock()
144 g.allowAll = false
145 g.allowedTool = map[string]bool{}
146 g.mu.Unlock()
147}
148
149// AllowAll flips the gate into "always allow" for the rest of the
150// session. Used by /yolo on to turn confirmation off at runtime
151// without having to restart with the flag flipped.
152func (g *ConfirmGate) AllowAll() {
153 if g == nil {
154 return
155 }
156 g.mu.Lock()
157 g.allowAll = true
158 g.mu.Unlock()
159}
160
161// SetConfirmer replaces the inner Confirmer. Used by the cli to
162// hand the Interactive TUI to a gate that was constructed before
163// the TUI existed (a construction-order knot we unwind here).
164// Safe to call from any goroutine.
165func (g *ConfirmGate) SetConfirmer(c Confirmer) {
166 if g == nil {
167 return
168 }
169 g.mu.Lock()
170 g.inner = c
171 g.mu.Unlock()
172}
173
174// BuildPreview turns a tool call's JSON args into a short one-line
175// summary the TUI can show in the confirmation prompt. Prioritises
176// obvious human-readable fields (command, path, url) over raw JSON.
177// Returns at most maxLen characters.
178func BuildPreview(args json.RawMessage, maxLen int) string {
179 if maxLen <= 0 {
180 maxLen = 120
181 }
182 if len(args) == 0 {
183 return ""
184 }
185 var m map[string]any
186 if err := json.Unmarshal(args, &m); err != nil {
187 return truncatePreview(string(args), maxLen)
188 }
189 for _, k := range []string{"command", "path", "file_path", "url", "query", "name"} {
190 if v, ok := m[k].(string); ok && v != "" {
191 return truncatePreview(v, maxLen)
192 }
193 }
194 b, _ := json.Marshal(m)
195 return truncatePreview(string(b), maxLen)
196}
197
198func truncatePreview(s string, n int) string {
199 s = strings.TrimSpace(s)
200 if len(s) <= n {
201 return s
202 }
203 if n <= 3 {
204 return "..."[:n]
205 }
206 return s[:n-3] + "..."
207}