1package core
2
3import (
4 "encoding/json"
5 "strings"
6 "sync"
7)
8
9// ConfirmDecision is the outcome of a confirmation prompt for a
10// tool call. It answers two questions: should this call run, and
11// should future calls of this shape skip the prompt for the rest
12// of the session.
13type ConfirmDecision struct {
14 Allow bool
15 // Source identifies the authority: user, remembered, policy, or yolo.
16 Source string
17 // Reason is shown to the model as the tool error when
18 // Allow=false. Examples: "user declined", "user refused: rm -rf
19 // looks dangerous".
20 Reason string
21 // RememberTool, when true, auto-allows every future call of the
22 // same tool name for the rest of the session without prompting.
23 RememberTool bool
24 // RememberAll, when true, auto-allows every future call of any
25 // tool for the rest of the session without prompting.
26 // Effectively turns yolo back on for this session.
27 RememberAll bool
28}
29
30// Confirmer asks the user to approve or refuse a single tool call.
31// Implementations block until the user responds (or the agent's
32// context is cancelled, in which case they should return
33// Allow=false with a cancellation reason).
34//
35// preview is a short one-line summary of the args (the shell
36// command, the file path, the URL) that the TUI shows alongside
37// the tool name. It is intentionally short: no full tool outputs.
38type Confirmer interface {
39 Confirm(toolName string, preview string) ConfirmDecision
40}
41
42// ToolCallConfirmation contains the summary and optional side-effect-free
43// content shown while approving a specific tool call.
44type ToolCallConfirmation struct {
45 ID string
46 Name string
47 Summary string
48 Content string
49}
50
51// ToolCallConfirmer is optionally implemented by confirmation UIs that can
52// attach rich preview content to the matching live tool call.
53type ToolCallConfirmer interface {
54 ConfirmToolCall(call ToolCallConfirmation) ConfirmDecision
55}
56
57// ConfirmGate wraps a Confirmer with session-scoped memory for the
58// "allow, always" decisions. Once the user picks RememberTool on a
59// given tool name, the gate short-circuits subsequent calls of that
60// name. Once the user picks RememberAll, the gate short-circuits
61// everything for the rest of the session.
62//
63// Safe for concurrent use: the allow-lists are guarded by a mutex
64// because the agent can queue tool calls from different goroutines.
65type ConfirmGate struct {
66 inner Confirmer
67
68 mu sync.Mutex
69 allowAll bool
70 allowAllSource string
71 allowedTool map[string]bool
72}
73
74// NewConfirmGate returns a gate backed by inner. Inner can be nil;
75// in that case every not-yet-allowed tool call is refused with a
76// fixed reason (the gate is effectively a blocker until AllowAll /
77// SetConfirmer is called).
78func NewConfirmGate(inner Confirmer) *ConfirmGate {
79 return &ConfirmGate{
80 inner: inner,
81 allowedTool: map[string]bool{},
82 }
83}
84
85// Check is the BeforeToolExecute-style entry point. Returns
86// allowed, reason, modifiedArgs. modifiedArgs is always nil: the
87// gate never rewrites args; it only allows or denies.
88//
89// A nil ConfirmGate always allows (treat as yolo mode).
90func (g *ConfirmGate) Check(toolName, preview string) (bool, string, json.RawMessage) {
91 return g.CheckToolCall(ToolCallConfirmation{Name: toolName, Summary: preview})
92}
93
94// CheckToolCall behaves like Check and additionally gives rich confirmation
95// UIs the call ID and side-effect-free preview content.
96func (g *ConfirmGate) CheckToolCall(call ToolCallConfirmation) (bool, string, json.RawMessage) {
97 d := g.DecideToolCall(call)
98 return d.Allow, d.Reason, nil
99}
100
101// DecideToolCall preserves decision provenance for observational consumers.
102func (g *ConfirmGate) DecideToolCall(call ToolCallConfirmation) ConfirmDecision {
103 if g == nil {
104 return ConfirmDecision{Allow: true, Source: "yolo"}
105 }
106 g.mu.Lock()
107 if g.allowAll {
108 source := g.allowAllSource
109 g.mu.Unlock()
110 return ConfirmDecision{Allow: true, Source: source}
111 }
112 if g.allowedTool[call.Name] {
113 g.mu.Unlock()
114 return ConfirmDecision{Allow: true, Source: "remembered"}
115 }
116 inner := g.inner
117 g.mu.Unlock()
118 if inner == nil {
119 return ConfirmDecision{Source: "policy", Reason: "tool call refused: --no-yolo is active and there is no interactive prompt in this mode; ask the user what to do instead"}
120 }
121
122 var decision ConfirmDecision
123 if detailed, ok := inner.(ToolCallConfirmer); ok {
124 decision = detailed.ConfirmToolCall(call)
125 } else {
126 decision = inner.Confirm(call.Name, call.Summary)
127 }
128
129 g.mu.Lock()
130 if decision.Allow {
131 if decision.RememberAll {
132 g.allowAll = true
133 g.allowAllSource = "remembered"
134 }
135 if decision.RememberTool {
136 g.allowedTool[call.Name] = true
137 }
138 }
139 g.mu.Unlock()
140
141 reason := strings.TrimSpace(decision.Reason)
142 if !decision.Allow && reason == "" {
143 reason = "tool call refused by user"
144 }
145 decision.Reason = reason
146 decision.Source = "user"
147 return decision
148}
149
150// Reset clears the session memory. Invoked when the user toggles
151// yolo mode back on via /yolo or closes the session.
152func (g *ConfirmGate) Reset() {
153 if g == nil {
154 return
155 }
156 g.mu.Lock()
157 g.allowAll = false
158 g.allowedTool = map[string]bool{}
159 g.mu.Unlock()
160}
161
162// AllowAll flips the gate into "always allow" for the rest of the
163// session. Used by /yolo on to turn confirmation off at runtime
164// without having to restart with the flag flipped.
165func (g *ConfirmGate) AllowAll() {
166 if g == nil {
167 return
168 }
169 g.mu.Lock()
170 g.allowAll = true
171 g.allowAllSource = "yolo"
172 g.mu.Unlock()
173}
174
175// SetConfirmer replaces the inner Confirmer. Used by the cli to
176// hand the Interactive TUI to a gate that was constructed before
177// the TUI existed (a construction-order knot we unwind here).
178// Safe to call from any goroutine.
179func (g *ConfirmGate) SetConfirmer(c Confirmer) {
180 if g == nil {
181 return
182 }
183 g.mu.Lock()
184 g.inner = c
185 g.mu.Unlock()
186}
187
188// BuildPreview turns a tool call's JSON args into a short one-line
189// summary the TUI can show in the confirmation prompt. Prioritises
190// obvious human-readable fields (command, path, url) over raw JSON.
191// Returns at most maxLen characters.
192func BuildPreview(args json.RawMessage, maxLen int) string {
193 if maxLen <= 0 {
194 maxLen = 120
195 }
196 if len(args) == 0 {
197 return ""
198 }
199 var m map[string]any
200 if err := json.Unmarshal(args, &m); err != nil {
201 return truncatePreview(string(args), maxLen)
202 }
203 for _, k := range []string{"command", "path", "file_path", "url", "query", "name"} {
204 if v, ok := m[k].(string); ok && v != "" {
205 return truncatePreview(v, maxLen)
206 }
207 }
208 b, _ := json.Marshal(m)
209 return truncatePreview(string(b), maxLen)
210}
211
212func truncatePreview(s string, n int) string {
213 s = strings.TrimSpace(s)
214 if len(s) <= n {
215 return s
216 }
217 if n <= 3 {
218 return "..."[:n]
219 }
220 return s[:n-3] + "..."
221}