@bubblebrain-ai/bubble 0.0.63 → 0.0.65

package/dist/anthropic-thinking.d.ts

@@ -0,0 +1,4 @@
+/** Claude thinking bound to both the model and the exact preceding conversation.
+ * https://platform.claude.com/docs/en/build-with-claude/preserved-thinking
+ */
+export declare function isClaudeWithBoundThinking(model?: string): boolean;

package/dist/anthropic-thinking.js

@@ -0,0 +1,11 @@
+/** Claude thinking bound to both the model and the exact preceding conversation.
+ * https://platform.claude.com/docs/en/build-with-claude/preserved-thinking
+ */
+export function isClaudeWithBoundThinking(model) {
+    const match = model?.match(/(?:^|:)claude-(opus|fable)-(\d+)(?:-(\d{1,2})(?=-|\[|$))?/i);
+    if (!match)
+        return false;
+    const major = Number(match[2]);
+    const minor = Number(match[3] ?? 0);
+    return major > 5 || (major === 5 && minor >= (match[1].toLowerCase() === "opus" ? 5 : 1));
+}

package/dist/approval/controller.d.ts

@@ -0,0 +1,71 @@
+import type { PermissionCheckResult, PermissionQuery, PermissionRuleSet } from "../permissions/types.js";
+import type { PermissionMode } from "../types.js";
+import type { ExternalHookController } from "../hooks/controller.js";
+import { type BashAllowlist } from "./session-cache.js";
+import type { ApprovalController, ApprovalDecision, ApprovalRequest } from "./types.js";
+export interface ApprovalControllerOptions {
+    /** Reads the live agent mode on each request so mode flips take effect immediately. */
+    getMode: () => PermissionMode;
+    /**
+     * UI handler attached by the TUI on mount. Returns the user's decision from
+     * an interactive dialog. When not attached (e.g. --print mode), the
+     * controller falls back to rejecting in safe modes.
+     */
+    handlerRef: {
+        current?: (req: ApprovalRequest) => Promise<ApprovalDecision>;
+    };
+    /** Session-scoped bash command prefix allowlist. Optional. */
+    bashAllowlist?: BashAllowlist;
+    /**
+     * Session-scoped grants for non-bash requests (MCP tools), keyed by
+     * sessionGrantKey. Optional; without it hosts cannot offer "this session".
+     */
+    sessionGrants?: Set<string>;
+    /** Working directory — used to anchor relative path rules. */
+    cwd: string;
+    /**
+     * Live view of configured allow/deny rules (from ~/.bubble/settings.json and
+     * project-level equivalents). Called on each request so edits via
+     * /permissions take effect immediately. Omit to disable rule-based gating.
+     */
+    getRuleSet?: () => PermissionRuleSet;
+    /** External lifecycle hooks may observe or reject pending permission requests. */
+    externalHooks?: ExternalHookController;
+    sessionId?: string;
+}
+/**
+ * Default ApprovalController. Decision tree:
+ *
+ *   deny rule match              → reject (applies even under bypassPermissions)
+ *   bypassPermissions            → auto-approve, no prompt
+ *   default + edit|write         → auto-approve (workspace paths only; a
+ *                                  path outside the workspace, or a protected
+ *                                  one — .git, agent permission settings —
+ *                                  falls through to the interactive prompt)
+ *   plan                         → reject with instructions to use exit_plan_mode
+ *   allow rule match             → auto-approve (never for protected paths)
+ *   session grant (bash prefix,
+ *     MCP tool)                  → auto-approve
+ *   bash / other                 → delegate to UI; if no UI, reject
+ *
+ * Deny rules sit at the top as a hard ceiling: bypassPermissions is a trust
+ * escalation, not a policy override. Users who want to permit a currently-
+ * denied action must edit their settings.json, not bypass checks at runtime.
+ */
+export declare class PermissionAwareApprovalController implements ApprovalController {
+    private readonly options;
+    constructor(options: ApprovalControllerOptions);
+    checkRules(query: PermissionQuery): PermissionCheckResult;
+    request(original: ApprovalRequest): Promise<ApprovalDecision>;
+    /**
+     * Facts the host needs to render the prompt correctly: whether a path is
+     * protected (never auto-approve it host-side either) and what scope a
+     * "this session" approval would cover.
+     */
+    private annotate;
+    private rememberForSession;
+    private requestToQuery;
+    private checkRequestRules;
+    private runPermissionRequestHook;
+    private runPermissionResultHook;
+}

package/dist/approval/controller.js

@@ -0,0 +1,286 @@
+import { checkPermission } from "../permissions/rule.js";
+import { truncateHookText } from "../hooks/index.js";
+import { bashSessionGrant } from "./session-cache.js";
+import { isProtectedWorkspacePath } from "./protected-paths.js";
+/**
+ * Default ApprovalController. Decision tree:
+ *
+ *   deny rule match              → reject (applies even under bypassPermissions)
+ *   bypassPermissions            → auto-approve, no prompt
+ *   default + edit|write         → auto-approve (workspace paths only; a
+ *                                  path outside the workspace, or a protected
+ *                                  one — .git, agent permission settings —
+ *                                  falls through to the interactive prompt)
+ *   plan                         → reject with instructions to use exit_plan_mode
+ *   allow rule match             → auto-approve (never for protected paths)
+ *   session grant (bash prefix,
+ *     MCP tool)                  → auto-approve
+ *   bash / other                 → delegate to UI; if no UI, reject
+ *
+ * Deny rules sit at the top as a hard ceiling: bypassPermissions is a trust
+ * escalation, not a policy override. Users who want to permit a currently-
+ * denied action must edit their settings.json, not bypass checks at runtime.
+ */
+export class PermissionAwareApprovalController {
+    options;
+    constructor(options) {
+        this.options = options;
+    }
+    checkRules(query) {
+        const ruleSet = this.options.getRuleSet?.();
+        if (!ruleSet)
+            return { decision: "ask" };
+        return checkPermission(ruleSet, query);
+    }
+    async request(original) {
+        const req = this.annotate(original);
+        const ruleResult = this.checkRequestRules(req);
+        const finalize = async (decision) => {
+            await this.runPermissionResultHook(req, decision);
+            return decision;
+        };
+        if (ruleResult.decision === "deny") {
+            return finalize({
+                action: "reject",
+                feedback: `Blocked by deny rule: ${ruleResult.rule?.source ?? "<unknown>"}`,
+            });
+        }
+        const mode = this.options.getMode();
+        const hookDecision = await this.runPermissionRequestHook(req, mode, ruleResult.decision);
+        if (hookDecision.action === "reject") {
+            return finalize(hookDecision);
+        }
+        if (mode === "bypassPermissions") {
+            return finalize({ action: "approve" });
+        }
+        const outsideWorkspace = (req.type === "edit" || req.type === "write") && req.outsideWorkspace === true;
+        const protectedPath = (req.type === "edit" || req.type === "write" || req.type === "patch") && req.protectedPath === true;
+        if (mode === "default" && !outsideWorkspace && !protectedPath
+            && (req.type === "edit" || req.type === "write" || req.type === "patch")) {
+            return finalize({ action: "approve" });
+        }
+        // Project profile trust is a user decision, not a destructive action:
+        // spawn_agent is legal in plan mode, so the gate prompts there too.
+        if (mode === "plan" && req.type !== "agent_profile") {
+            return finalize({
+                action: "reject",
+                feedback: "Plan mode is active. Do not call destructive tools directly — propose your changes via exit_plan_mode and wait for user approval.",
+            });
+        }
+        // A broad allow rule (`Edit`, `Write(**)`) must not silently cover a
+        // protected path; the user confirms those one at a time.
+        if (ruleResult.decision === "allow" && !protectedPath) {
+            return finalize({ action: "approve" });
+        }
+        // Session-scoped allowlist: previously-approved bash prefixes skip the prompt.
+        if (req.type === "bash" && this.options.bashAllowlist?.matches(req.command)) {
+            return finalize({ action: "approve" });
+        }
+        const grantKey = sessionGrantKey(req);
+        if (grantKey && this.options.sessionGrants?.has(grantKey)) {
+            return finalize({ action: "approve" });
+        }
+        const handler = this.options.handlerRef.current;
+        if (!handler) {
+            return finalize({
+                action: "reject",
+                feedback: "No interactive UI is available to approve this tool call.",
+            });
+        }
+        const decision = await handler(req);
+        if (decision.action === "approve" && decision.remember === "session") {
+            this.rememberForSession(req);
+        }
+        return finalize(decision);
+    }
+    /**
+     * Facts the host needs to render the prompt correctly: whether a path is
+     * protected (never auto-approve it host-side either) and what scope a
+     * "this session" approval would cover.
+     */
+    annotate(req) {
+        const cwd = this.options.cwd;
+        switch (req.type) {
+            case "edit":
+            case "write":
+                return isProtectedWorkspacePath(cwd, req.path) ? { ...req, protectedPath: true } : req;
+            case "patch": {
+                const paths = [...req.paths, ...req.files.map((file) => file.path)];
+                return paths.some((path) => isProtectedWorkspacePath(cwd, path)) ? { ...req, protectedPath: true } : req;
+            }
+            case "bash": {
+                const grant = this.options.bashAllowlist ? bashSessionGrant(req.command) : undefined;
+                return grant ? { ...req, sessionGrant: grant } : req;
+            }
+            case "external_tool":
+                return req.kind === "mcp" && this.options.sessionGrants && req.title.trim()
+                    ? { ...req, sessionGrant: req.title.trim() }
+                    : req;
+            default:
+                return req;
+        }
+    }
+    rememberForSession(req) {
+        if (req.type === "bash") {
+            if (req.sessionGrant)
+                this.options.bashAllowlist?.add(req.sessionGrant);
+            return;
+        }
+        const key = sessionGrantKey(req);
+        if (key)
+            this.options.sessionGrants?.add(key);
+    }
+    requestToQuery(req) {
+        switch (req.type) {
+            case "bash":
+                return { tool: "Bash", command: req.command };
+            case "write":
+                return { tool: "Write", path: req.path, cwd: this.options.cwd };
+            case "edit":
+                return { tool: "Edit", path: req.path, cwd: this.options.cwd };
+            case "patch":
+                return { tool: "Edit", path: req.path, cwd: this.options.cwd };
+            case "lsp":
+                return { tool: "Lsp", path: req.path, cwd: this.options.cwd };
+            case "agent_profile":
+                return { tool: "AgentProfile" };
+            case "external_tool": {
+                const command = externalCommand(req.rawInput);
+                if (req.kind === "execute" && command !== undefined) {
+                    return { tool: "Bash", command };
+                }
+                const path = req.locations?.[0]?.path;
+                if ((req.kind === "edit" || req.kind === "delete" || req.kind === "move") && path) {
+                    return { tool: "Edit", path, cwd: this.options.cwd };
+                }
+                return { tool: req.title.trim() || req.kind.trim() || "ExternalTool" };
+            }
+        }
+    }
+    checkRequestRules(req) {
+        if (req.type !== "patch")
+            return this.checkRules(this.requestToQuery(req));
+        const perFile = req.files.map((file) => this.checkRules({
+            tool: file.kind === "add" ? "Write" : "Edit",
+            path: file.path,
+            cwd: this.options.cwd,
+        }));
+        const denied = perFile.find((result) => result.decision === "deny");
+        if (denied)
+            return denied;
+        if (perFile.length > 0 && perFile.every((result) => result.decision === "allow")) {
+            return { decision: "allow", rule: perFile[0].rule };
+        }
+        return { decision: "ask" };
+    }
+    async runPermissionRequestHook(req, mode, ruleDecision) {
+        const hooks = this.options.externalHooks;
+        if (!hooks)
+            return { action: "approve" };
+        try {
+            const result = await hooks.runEvent({
+                eventName: "PermissionRequest",
+                cwd: this.options.cwd,
+                sessionId: this.options.sessionId,
+                agentRole: "driver",
+                target: approvalTarget(req),
+                payload: {
+                    request: summarizeApprovalRequest(req),
+                    mode,
+                    ruleDecision,
+                },
+                fullPayload: { permissionRequest: req },
+            });
+            if (result.decision === "deny") {
+                return {
+                    action: "reject",
+                    feedback: result.reason ?? `Blocked by hook ${result.sourceHookId ?? "<unknown>"}.`,
+                };
+            }
+        }
+        catch {
+            // Hook failures are handled by the hook controller policy and must not
+            // crash approval handling.
+        }
+        return { action: "approve" };
+    }
+    async runPermissionResultHook(req, decision) {
+        const hooks = this.options.externalHooks;
+        if (!hooks)
+            return;
+        try {
+            await hooks.runEvent({
+                eventName: "PermissionResult",
+                cwd: this.options.cwd,
+                sessionId: this.options.sessionId,
+                agentRole: "driver",
+                target: approvalTarget(req),
+                payload: {
+                    request: summarizeApprovalRequest(req),
+                    decision: decision.action,
+                    feedback: decision.feedback ? truncateHookText(decision.feedback, 500) : undefined,
+                },
+                fullPayload: {
+                    permissionRequest: req,
+                    permissionDecision: decision,
+                },
+            });
+        }
+        catch {
+            // Observe-only.
+        }
+    }
+}
+function approvalTarget(req) {
+    switch (req.type) {
+        case "bash":
+            return "Bash";
+        case "write":
+            return "Write";
+        case "edit":
+        case "patch":
+            return "Edit";
+        case "lsp":
+            return "Lsp";
+        case "agent_profile":
+            return "AgentProfile";
+        case "external_tool":
+            return req.title.trim() || req.kind.trim() || "ExternalTool";
+    }
+}
+function summarizeApprovalRequest(req) {
+    switch (req.type) {
+        case "bash":
+            return { type: req.type, commandPreview: truncateHookText(req.command, 500), cwd: req.cwd };
+        case "write":
+            return { type: req.type, path: req.path, fileExists: req.fileExists, contentLength: req.content.length };
+        case "edit":
+            return { type: req.type, path: req.path, fileExists: req.fileExists, diffLength: req.diff.length };
+        case "patch":
+            return { type: req.type, path: req.path, paths: req.paths, files: req.files, diffLength: req.diff.length };
+        case "lsp":
+            return { type: req.type, path: req.path, operation: req.operation };
+        case "agent_profile":
+            return { type: req.type, name: req.name, path: req.path, contentHash: req.contentHash };
+        case "external_tool":
+            return {
+                type: req.type,
+                toolCallId: req.toolCallId,
+                title: req.title,
+                kind: req.kind,
+                locations: req.locations,
+                rawInput: req.rawInput,
+            };
+    }
+}
+function sessionGrantKey(req) {
+    if (req.type === "external_tool" && req.sessionGrant)
+        return `${req.kind}:${req.sessionGrant}`;
+    return undefined;
+}
+function externalCommand(rawInput) {
+    if (typeof rawInput !== "object" || rawInput === null || Array.isArray(rawInput))
+        return undefined;
+    const command = rawInput.command;
+    return typeof command === "string" ? command : undefined;
+}

package/dist/approval/danger.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Heuristic classifier for bash commands that deserve an extra user warning.
+ *
+ * Conservative by design: false negatives are fine (users are still prompted
+ * to approve), false positives are annoying (users get desensitised to the
+ * warning). We only flag patterns that are widely recognised as destructive
+ * or commonly abused by injected prompts.
+ */
+export interface DangerSignal {
+    pattern: string;
+    message: string;
+}
+export declare function classifyBashDanger(command: string): DangerSignal | null;

package/dist/approval/danger.js

@@ -0,0 +1,55 @@
+/**
+ * Heuristic classifier for bash commands that deserve an extra user warning.
+ *
+ * Conservative by design: false negatives are fine (users are still prompted
+ * to approve), false positives are annoying (users get desensitised to the
+ * warning). We only flag patterns that are widely recognised as destructive
+ * or commonly abused by injected prompts.
+ */
+export function classifyBashDanger(command) {
+    const normalized = command.trim();
+    if (!normalized)
+        return null;
+    // Piping an internet download into a shell — classic supply-chain foot-gun.
+    if (/\b(curl|wget|fetch)\b[^|]*\|\s*(bash|sh|zsh|fish)\b/i.test(normalized)) {
+        return {
+            pattern: "curl | sh",
+            message: "This command pipes a downloaded script directly into a shell.",
+        };
+    }
+    // Recursive force delete. Match `rm -rf`, `rm -fr`, `rm -Rf`, etc.
+    if (/\brm\s+(-[a-zA-Z]*[rR][a-zA-Z]*f|-[a-zA-Z]*f[a-zA-Z]*[rR])\b/.test(normalized)) {
+        return {
+            pattern: "rm -rf",
+            message: "This command recursively deletes files and directories.",
+        };
+    }
+    // Privilege escalation.
+    if (/\bsudo\b/.test(normalized)) {
+        return {
+            pattern: "sudo",
+            message: "This command runs with elevated privileges.",
+        };
+    }
+    // chmod 777 and friends.
+    if (/\bchmod\s+(-R\s+)?(0?777|a\+rwx|u\+rwx,g\+rwx,o\+rwx)\b/.test(normalized)) {
+        return {
+            pattern: "chmod 777",
+            message: "This command gives world-writable permissions.",
+        };
+    }
+    // Git force push / reset hard — potentially destructive on shared branches.
+    if (/\bgit\s+push\s+(-f\b|--force\b|--force-with-lease\b)/.test(normalized)) {
+        return {
+            pattern: "git push --force",
+            message: "This force-pushes and can overwrite the remote branch history.",
+        };
+    }
+    if (/\bgit\s+reset\s+--hard\b/.test(normalized)) {
+        return {
+            pattern: "git reset --hard",
+            message: "This discards uncommitted changes and rewrites the working tree.",
+        };
+    }
+    return null;
+}

package/dist/approval/diff-hunks.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Parses unified-diff output (e.g. from `diff`'s `createTwoFilesPatch`) into
+ * discrete hunks so the TUI can render each one with its own header and fold
+ * gracefully when the total body exceeds the available line budget.
+ */
+export interface DiffHunk {
+    /** The `@@ -old,count +new,count @@ ...` line verbatim. */
+    header: string;
+    /** Body lines, each beginning with '+', '-', or ' '. No trailing newline. */
+    lines: string[];
+}
+export declare function parseDiffHunks(diff: string): DiffHunk[];

package/dist/approval/diff-hunks.js

@@ -0,0 +1,32 @@
+/**
+ * Parses unified-diff output (e.g. from `diff`'s `createTwoFilesPatch`) into
+ * discrete hunks so the TUI can render each one with its own header and fold
+ * gracefully when the total body exceeds the available line budget.
+ */
+export function parseDiffHunks(diff) {
+    const hunks = [];
+    const rawLines = diff.split("\n");
+    let current = null;
+    for (const line of rawLines) {
+        if (line.startsWith("===") ||
+            line.startsWith("Index:") ||
+            line.startsWith("---") ||
+            line.startsWith("+++")) {
+            continue;
+        }
+        if (line.startsWith("@@")) {
+            if (current)
+                hunks.push(current);
+            current = { header: line, lines: [] };
+            continue;
+        }
+        if (!current)
+            continue;
+        if (line.startsWith("\\ No newline"))
+            continue;
+        current.lines.push(line);
+    }
+    if (current)
+        hunks.push(current);
+    return hunks;
+}

package/dist/approval/protected-paths.d.ts

@@ -0,0 +1 @@
+export declare function isProtectedWorkspacePath(cwd: string, filePath: string): boolean;

package/dist/approval/protected-paths.js

@@ -0,0 +1,35 @@
+import { basename, dirname, isAbsolute, relative, resolve, sep } from "node:path";
+import { resolveThroughLinks } from "../tools/path-utils.js";
+/**
+ * Workspace files whose content grants capabilities beyond the edit itself.
+ * Default mode auto-approves ordinary workspace edits; these always ask,
+ * because writing them is a privilege escalation rather than a code change:
+ *
+ * - anything inside a `.git` directory — hooks and `core.hooksPath` /
+ *   `core.fsmonitor` in `.git/config` run arbitrary commands the next time
+ *   anyone runs git;
+ * - agent permission settings (`.bubble/settings*.json`, and Claude Code's
+ *   `.claude/settings*.json`) — an allow rule written there approves every
+ *   later command without a prompt.
+ */
+const PROTECTED_SETTINGS = [
+    { dir: ".bubble", files: new Set(["settings.json", "settings.local.json"]) },
+    { dir: ".claude", files: new Set(["settings.json", "settings.local.json"]) },
+];
+export function isProtectedWorkspacePath(cwd, filePath) {
+    const absolute = isAbsolute(filePath) ? resolve(filePath) : resolve(cwd, filePath);
+    // Also where the path really leads: `docs/hooks -> ../.git/hooks` must not
+    // turn a hook into an ordinary auto-approved edit.
+    return isProtected(cwd, absolute) || isProtected(resolveThroughLinks(cwd), resolveThroughLinks(absolute));
+}
+function isProtected(cwd, absolute) {
+    // Case-folded: on the default macOS (and Windows) filesystem `.GIT/config`
+    // is `.git/config`. On case-sensitive systems this only asks more often.
+    const rel = relative(resolve(cwd), absolute).toLowerCase();
+    const parts = rel.split(sep).filter(Boolean);
+    if (parts.includes(".git"))
+        return true;
+    const parent = basename(dirname(absolute)).toLowerCase();
+    const name = basename(absolute).toLowerCase();
+    return PROTECTED_SETTINGS.some((entry) => entry.dir === parent && entry.files.has(name));
+}

package/dist/approval/session-cache.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Session-scoped set of bash commands the user approved "for this session".
+ * Not persisted to disk.
+ *
+ * Exact match only (after trimming), like Kimi Code's session approvals: a
+ * remembered command never vouches for a different one, so no shell parsing
+ * is involved and a compound line cannot smuggle an extra command past it.
+ * Broader, prefix-style grants belong in allow rules (`Bash(npm test:*)`),
+ * which are matched per simple command.
+ */
+export declare class BashAllowlist {
+    private commands;
+    add(command: string): void;
+    remove(command: string): boolean;
+    clear(): void;
+    matches(command: string): boolean;
+    list(): string[];
+    size(): number;
+}
+/** What a "this session" approval of `command` remembers: the command itself. */
+export declare function bashSessionGrant(command: string): string | undefined;

package/dist/approval/session-cache.js

@@ -0,0 +1,38 @@
+/**
+ * Session-scoped set of bash commands the user approved "for this session".
+ * Not persisted to disk.
+ *
+ * Exact match only (after trimming), like Kimi Code's session approvals: a
+ * remembered command never vouches for a different one, so no shell parsing
+ * is involved and a compound line cannot smuggle an extra command past it.
+ * Broader, prefix-style grants belong in allow rules (`Bash(npm test:*)`),
+ * which are matched per simple command.
+ */
+export class BashAllowlist {
+    commands = new Set();
+    add(command) {
+        const cleaned = command.trim();
+        if (!cleaned)
+            return;
+        this.commands.add(cleaned);
+    }
+    remove(command) {
+        return this.commands.delete(command.trim());
+    }
+    clear() {
+        this.commands.clear();
+    }
+    matches(command) {
+        return this.commands.has(command.trim());
+    }
+    list() {
+        return [...this.commands].sort();
+    }
+    size() {
+        return this.commands.size;
+    }
+}
+/** What a "this session" approval of `command` remembers: the command itself. */
+export function bashSessionGrant(command) {
+    return command.trim() || undefined;
+}

package/dist/approval/tool-helper.d.ts

@@ -0,0 +1,14 @@
+import type { ToolResult } from "../types.js";
+import type { ApprovalController, ApprovalDecision, ApprovalRequest } from "./types.js";
+/**
+ * Runs a tool action through the approval controller. Returns either the
+ * decision (on approve) or a pre-built rejection ToolResult (on reject or
+ * no controller available to the tool).
+ */
+export declare function gateToolAction(approval: ApprovalController | undefined, req: ApprovalRequest): Promise<{
+    approved: true;
+    decision: ApprovalDecision;
+} | {
+    approved: false;
+    result: ToolResult;
+}>;

package/dist/approval/tool-helper.js

@@ -0,0 +1,47 @@
+/**
+ * Runs a tool action through the approval controller. Returns either the
+ * decision (on approve) or a pre-built rejection ToolResult (on reject or
+ * no controller available to the tool).
+ */
+export async function gateToolAction(approval, req) {
+    if (!approval) {
+        return { approved: true, decision: { action: "approve" } };
+    }
+    const decision = await approval.request(req);
+    if (decision.action === "approve") {
+        return { approved: true, decision };
+    }
+    const feedback = decision.feedback?.trim();
+    const label = approvalRequestLabel(req);
+    const message = feedback
+        ? `${label} was rejected by the user. User feedback: ${feedback}`
+        : `${label} was rejected by the user.`;
+    return {
+        approved: false,
+        result: {
+            content: message,
+            isError: true,
+            // Surfaces the rejection reason in subagent tool notes (which prefer
+            // metadata.reason over the truncated first content line).
+            metadata: { kind: "security", reason: feedback || message },
+        },
+    };
+}
+function approvalRequestLabel(req) {
+    switch (req.type) {
+        case "edit":
+            return `Edit to ${req.path}`;
+        case "write":
+            return `${req.fileExists ? "Overwrite" : "Write"} to ${req.path}`;
+        case "patch":
+            return `Patch to ${req.path}`;
+        case "bash":
+            return `Bash command \`${req.command}\``;
+        case "lsp":
+            return `LSP ${req.operation} on ${req.path}`;
+        case "agent_profile":
+            return `Project agent profile "${req.name}"`;
+        case "external_tool":
+            return `External tool "${req.title}"`;
+    }
+}