1package core
2
3import (
4 "encoding/json"
5 "strings"
6 "sync"
7)
8
9// ConfirmDecision is the outcome of a confirmation prompt for a
10// tool call. It answers two questions: should this call run, and
11// should future calls of this shape skip the prompt for the rest
12// of the session.
13type ConfirmDecision struct {
14 Allow bool
15 // Reason is shown to the model as the tool error when
16 // Allow=false. Examples: "user declined", "user refused: rm -rf
17 // looks dangerous".
18 Reason string
19 // RememberTool, when true, auto-allows every future call of the
20 // same tool name for the rest of the session without prompting.
21 RememberTool bool
22 // RememberAll, when true, auto-allows every future call of any
23 // tool for the rest of the session without prompting.
24 // Effectively turns yolo back on for this session.
25 RememberAll bool
26}
27
28// Confirmer asks the user to approve or refuse a single tool call.
29// Implementations block until the user responds (or the agent's
30// context is cancelled, in which case they should return
31// Allow=false with a cancellation reason).
32//
33// preview is a short one-line summary of the args (the shell
34// command, the file path, the URL) that the TUI shows alongside
35// the tool name. It is intentionally short: no full tool outputs.
36type Confirmer interface {
37 Confirm(toolName string, preview string) ConfirmDecision
38}
39
40// ConfirmGate wraps a Confirmer with session-scoped memory for the
41// "allow, always" decisions. Once the user picks RememberTool on a
42// given tool name, the gate short-circuits subsequent calls of that
43// name. Once the user picks RememberAll, the gate short-circuits
44// everything for the rest of the session.
45//
46// Safe for concurrent use: the allow-lists are guarded by a mutex
47// because the agent can queue tool calls from different goroutines.
48type ConfirmGate struct {
49 inner Confirmer
50
51 mu sync.Mutex
52 allowAll bool
53 allowedTool map[string]bool
54}
55
56// NewConfirmGate returns a gate backed by inner. Inner can be nil;
57// in that case every not-yet-allowed tool call is refused with a
58// fixed reason (the gate is effectively a blocker until AllowAll /
59// SetConfirmer is called).
60func NewConfirmGate(inner Confirmer) *ConfirmGate {
61 return &ConfirmGate{
62 inner: inner,
63 allowedTool: map[string]bool{},
64 }
65}
66
67// Check is the BeforeToolExecute-style entry point. Returns
68// allowed, reason, modifiedArgs. modifiedArgs is always nil: the
69// gate never rewrites args; it only allows or denies.
70//
71// A nil ConfirmGate always allows (treat as yolo mode).
72func (g *ConfirmGate) Check(toolName, preview string) (bool, string, json.RawMessage) {
73 if g == nil {
74 return true, "", nil
75 }
76 g.mu.Lock()
77 if g.allowAll {
78 g.mu.Unlock()
79 return true, "", nil
80 }
81 if g.allowedTool[toolName] {
82 g.mu.Unlock()
83 return true, "", nil
84 }
85 g.mu.Unlock()
86
87 g.mu.Lock()
88 inner := g.inner
89 g.mu.Unlock()
90 if inner == nil {
91 return false, "tool call refused: --no-yolo is active and there is no interactive prompt in this mode; ask the user what to do instead", nil
92 }
93
94 decision := inner.Confirm(toolName, preview)
95
96 g.mu.Lock()
97 if decision.Allow {
98 if decision.RememberAll {
99 g.allowAll = true
100 }
101 if decision.RememberTool {
102 g.allowedTool[toolName] = true
103 }
104 }
105 g.mu.Unlock()
106
107 reason := strings.TrimSpace(decision.Reason)
108 if !decision.Allow && reason == "" {
109 reason = "tool call refused by user"
110 }
111 return decision.Allow, reason, nil
112}
113
114// Reset clears the session memory. Invoked when the user toggles
115// yolo mode back on via /yolo or closes the session.
116func (g *ConfirmGate) Reset() {
117 if g == nil {
118 return
119 }
120 g.mu.Lock()
121 g.allowAll = false
122 g.allowedTool = map[string]bool{}
123 g.mu.Unlock()
124}
125
126// AllowAll flips the gate into "always allow" for the rest of the
127// session. Used by /yolo on to turn confirmation off at runtime
128// without having to restart with the flag flipped.
129func (g *ConfirmGate) AllowAll() {
130 if g == nil {
131 return
132 }
133 g.mu.Lock()
134 g.allowAll = true
135 g.mu.Unlock()
136}
137
138// SetConfirmer replaces the inner Confirmer. Used by the cli to
139// hand the Interactive TUI to a gate that was constructed before
140// the TUI existed (a construction-order knot we unwind here).
141// Safe to call from any goroutine.
142func (g *ConfirmGate) SetConfirmer(c Confirmer) {
143 if g == nil {
144 return
145 }
146 g.mu.Lock()
147 g.inner = c
148 g.mu.Unlock()
149}
150
151// BuildPreview turns a tool call's JSON args into a short one-line
152// summary the TUI can show in the confirmation prompt. Prioritises
153// obvious human-readable fields (command, path, url) over raw JSON.
154// Returns at most maxLen characters.
155func BuildPreview(args json.RawMessage, maxLen int) string {
156 if maxLen <= 0 {
157 maxLen = 120
158 }
159 if len(args) == 0 {
160 return ""
161 }
162 var m map[string]any
163 if err := json.Unmarshal(args, &m); err != nil {
164 return truncatePreview(string(args), maxLen)
165 }
166 for _, k := range []string{"command", "path", "file_path", "url", "query", "name"} {
167 if v, ok := m[k].(string); ok && v != "" {
168 return truncatePreview(v, maxLen)
169 }
170 }
171 b, _ := json.Marshal(m)
172 return truncatePreview(string(b), maxLen)
173}
174
175func truncatePreview(s string, n int) string {
176 s = strings.TrimSpace(s)
177 if len(s) <= n {
178 return s
179 }
180 if n <= 3 {
181 return "..."[:n]
182 }
183 return s[:n-3] + "..."
184}