@cmodjs/core 1.6.0 → 2.0.1

package/src/runtime/lifecycle.ts

@@ -1,6 +1,6 @@
 import type { Args, EventResult, Frozen, HookBudget, PluginOptions, RenderElement, Timer } from 'claude-code'
 import type { Step } from '../installer.js'
-import { hooks, PreToolUse, type Allowed, type Disposable, type Hook, type HookInput, type HookListener, type HookOptions, type Imports, type Mod, type ModDefinition, type PaneHandle, type SettingsFile, type Toast } from '../mod.js'
+import type { Allowed, FileChange, Disposable, Imports, Mod, ModDefinition, PaneHandle, SettingsFile, SettingsFileChange, SettingsFileChangeListener, Toast } from '../mod.js'
 import type { Options, OptionValues } from '../options.js'
 import { changelogPage, consentPath, dataFolder, finishStepsMethod, isAtLeast, marketplaceOf, oldestCmodFor, openPageMethod, parseConsent, pendingStepsMethod, parseEvent, permissionWords, readRecord, readSteps, recordPath, scriptsSha256, settingsPagesMethod, storeFolder, updatesToTurnOn, type ReadFile, type RunnerEvent, type Steps } from '../records.js'
 import { homePrefix, ifMissing, relativePath } from '../utils/paths.js'
@@ -10,9 +10,10 @@ import { beforeDeadline } from './deadline.js'
 import { announcedOf, announcementMs, announcementOf } from './announce.js'
 import { bind } from './bound.js'
 import { serveConversations } from './conversations.js'
-import { answerCall, cmodPluginName, dependencyCalls, withBareRefusals } from './dependencies.js'
+import { answerCall, answeringOwnCalls, cmodPluginName, dependencyCalls, withBareRefusals } from './dependencies.js'
 import { keepEngine } from './engine.js'
-import { classicHook, heldDecisionHook, permissionEvents, preToolUseHook, userSkillHook, type HeldDecisions, type RoutedEvent } from './hooks.js'
+import { classicHook, permissionEvents, userSkillHook, type Hook, type HookListener, type RoutedEvent } from './hooks.js'
+import type { PermissionRoutes } from './permission-check.js'
 import { checkedAnswer, checkingGrants, checkSettings, checksAnswers, checkWrite, isCovered, itemOf, passedDown, programAddresses, type AnswerCheck, type Grants } from './grants.js'
 import { cmodError, lastLineOf, locatingPrograms, readLines, type Programs } from './programs.js'
 import { createModFiles, resolvedPath, type Places } from './metadata.js'
@@ -51,6 +52,7 @@ export type Lifecycle<State extends object> = {
   readonly toasts: readonly ShownToast[]
   start(claude: Claude, read: (claude: Claude) => Promise<Plugin>): Promise<void>
   route<N extends RoutedEvent>(event: N, e: Frozen<Args<N>>, next: RouterNext<N>): Promise<EventResult<N>>
+  raise(method: string, payload: Readonly<Record<string, unknown>>): Promise<unknown>
 }
 
 type ModRuntime = {
@@ -62,7 +64,7 @@ type ModRuntime = {
   readonly steps: Steps
   readonly granted: ReadonlySet<string>
   readonly refreshGrants: () => Promise<void>
-  readonly checksPermissions: () => boolean
+  readonly permissionRoutes: () => PermissionRoutes | undefined
   readonly options: PluginOptions
 }
 
@@ -70,6 +72,7 @@ type ActiveMod<State extends object, Declared extends Options> = {
   readonly mod: Mod<State, Declared>
   readonly added: readonly string[]
   readonly imports: Imports
+  readonly raise: (method: string, payload: Readonly<Record<string, unknown>>) => Promise<unknown>
 }
 
 
@@ -83,6 +86,8 @@ const cmodCheckMs = 1000
 
 const cmodWaitMs = 60_000
 
+const cmodSlowCheckMs = 10_000
+
 const startHoldMs = (10_000 satisfies HookBudget['ms']) - 1_000
 
 const dependencyCallMs = 30_000
@@ -151,7 +156,7 @@ async function cmodVersion(claude: Claude): Promise<string | undefined> {
 
 export function createLifecycle<State extends object, Declared extends Options = Options>(
   definition: ModDefinition<State, string, Declared>,
-  checksPermissions: () => boolean = () => true,
+  permissionRoutes: () => PermissionRoutes | undefined = () => undefined,
   options: PluginOptions = {},
   asksPerson = true,
 ): Lifecycle<State> {
@@ -164,6 +169,7 @@ export function createLifecycle<State extends object, Declared extends Options =
   let activation: Promise<void> | undefined
   let mod: Mod<State> | undefined
   let imports: Imports | undefined
+  let raise: ActiveMod<State, Declared>['raise'] | undefined
   let failure: unknown
   let pluginOptions = options
   const installer = createInstaller(definition.name, () => claude())
@@ -316,7 +322,7 @@ export function createLifecycle<State extends object, Declared extends Options =
   const activate = async (): Promise<void> => {
     if (runtime === undefined || plugin === undefined) return
     const activeRouter = createRouter()
-    const active = await createMod(definition, { ...runtime, router: activeRouter, dataFolder: dataFolder(plugin.store, plugin.name), store: plugin.store, steps: plugin.steps, granted, refreshGrants, checksPermissions, options: pluginOptions }).catch(async (error: unknown) => {
+    const active = await createMod(definition, { ...runtime, router: activeRouter, dataFolder: dataFolder(plugin.store, plugin.name), store: plugin.store, steps: plugin.steps, granted, refreshGrants, permissionRoutes, options: pluginOptions }).catch(async (error: unknown) => {
       if (error instanceof MissingOptions && (await askOptions(error))) return undefined
       fail(messageOf(error), error instanceof MissingOptions ? `Set ${error.keys.length === 1 ? 'it' : 'them'} in /config.` : undefined, begin)
       throw error
@@ -325,18 +331,25 @@ export function createLifecycle<State extends object, Declared extends Options =
     const { added } = active
     mod = active.mod
     imports = active.imports
+    raise = active.raise
     router = activeRouter
     phase = 'active'
     runtime.claude.ui.invalidate('ui.render')
     void runSteps(active.mod).catch((error: unknown) => toastFailure({ id: 'cmod:steps', message: 'Its installer stopped', error }))
     const missed = missedSessionStart
     missedSessionStart = undefined
-    const lateAnswer = missed === undefined ? {} : await activeRouter.dispatch('classic.SessionStart', missed, async () => ({})).catch((error: unknown) => {
+    const replay = (e: Frozen<Args<'classic.SessionStart'>>) => (definition.name === cmodPluginName ? activeRouter.dispatch('classic.SessionStart', e, async () => ({})) : checkedRoute('classic.SessionStart', e, async () => ({})))
+    const lateAnswer = missed === undefined ? {} : await replay(missed).catch((error: unknown) => {
       toastFailure({ id: 'classic.SessionStart', message: 'The SessionStart hook failed', error })
       return {}
     })
-    if (Object.keys(lateAnswer).length > 0) {
-      runtime.claude.ui.log(`${definition.name} started after Claude Code's SessionStart, so Claude Code did not read the answer of its SessionStart hooks.`, { to: 'debug' })
+    const { additionalContext, ...unread } = lateAnswer as { readonly additionalContext?: readonly string[] } & Record<string, unknown>
+    for (const text of additionalContext ?? []) {
+      const added = await runtime.claude.session.append({ message: { type: 'user', content: [{ type: 'text', text }] } })
+      if (added.deny !== undefined) runtime.claude.ui.log(`${definition.name}: Claude Code refused its SessionStart note: ${added.deny}`, { to: 'debug' })
+    }
+    if (Object.keys(unread).length > 0) {
+      runtime.claude.ui.log(`${definition.name} started after Claude Code's SessionStart, so Claude Code did not read ${Object.keys(unread).join(', ')} from its SessionStart hooks.`, { to: 'debug' })
     }
     const version = plugin.version ?? ''
     const announced = announcedOf(await runtime.claude.store.get(announcedKey))
@@ -418,27 +431,31 @@ export function createLifecycle<State extends object, Declared extends Options =
       timer.cancel()
       longWait.cancel()
     }
-    const timer = claude().clock.every(cmodCheckMs, () => {
-      check ??= cmodVersion(claude())
-        .then((version) => {
-          check = undefined
-          latest = version
-          if (!fits(version)) return
-          stop()
-          return install()
-        })
-        .catch((error: unknown) => {
-          stop()
-          report(error)
-        })
-    })
-    const longWait = claude().clock.after(cmodWaitMs, () =>
+    const poll = (ms: number) =>
+      claude().clock.every(ms, () => {
+        check ??= cmodVersion(claude())
+          .then((version) => {
+            check = undefined
+            latest = version
+            if (!fits(version)) return
+            stop()
+            return install()
+          })
+          .catch((error: unknown) => {
+            stop()
+            report(error)
+          })
+      })
+    let timer = poll(cmodCheckMs)
+    const longWait = claude().clock.after(cmodWaitMs, () => {
+      timer.cancel()
+      timer = poll(cmodSlowCheckMs)
       installing(
         latest === undefined
           ? "Still waiting for cmod to download cmod. See cmod's own line."
           : `PATH finds cmod ${latest}, and ${definition.name} needs cmod ${oldestCmodFor(plugin?.steps ?? {})} or later. Run npm i -g @cmodjs/cli, or put ~/.local/bin ahead of the old cmod on PATH.`,
-      ),
-    )
+      )
+    })
   }
 
   const bootstrap = async (root: string) => {
@@ -560,6 +577,11 @@ export function createLifecycle<State extends object, Declared extends Options =
     get toasts() {
       return runtime?.toaster.shown ?? []
     },
+    async raise(method, payload) {
+      if (raise === undefined || imports === undefined) throw new Error(`${definition.name} has not started, so ${method} has no listener yet.`)
+      bind(imports)
+      return raise(method, payload)
+    },
     async start(claudeCalls, read) {
       if (runtime !== undefined) return
       programs = locatingPrograms(claudeCalls)
@@ -586,7 +608,10 @@ export function createLifecycle<State extends object, Declared extends Options =
       const isCallToThisMod = event === 'cmod.call' && (e as Frozen<Args<'cmod.call'>>).to === definition.name
       if (event === 'cmod.call' && !isCallToThisMod) return next(e)
       await (event === 'classic.SessionStart' || isCallToThisMod ? holdUntilStarted() : whenActive())
-      if (event === 'classic.SessionStart' && phase !== 'active') missedSessionStart = e as Frozen<Args<'classic.SessionStart'>>
+      if (event === 'classic.SessionStart' && phase !== 'active') {
+        missedSessionStart = e as Frozen<Args<'classic.SessionStart'>>
+        return next(e)
+      }
       if (isCallToThisMod && phase !== 'active') {
         const isStopped = phase === 'declined' || phase === 'failed'
         return { deny: isStopped ? `${definition.name} is not set up. Its toast says why.` : `${definition.name} is installing. Try again when it's ready.` } as EventResult<N>
@@ -609,9 +634,8 @@ export function createLifecycle<State extends object, Declared extends Options =
 async function createMod<State extends object, Declared extends Options>(definition: ModDefinition<State, string, Declared>, runtime: ModRuntime): Promise<ActiveMod<State, Declared>> {
   const { router, toaster } = runtime
   const report = (failure: Failure) => void toaster.fail(failure)
-  const claude = withBareRefusals(checkingKeys(runtime.claude, toaster.toast, runtime.steps.keys ?? {}))
+  const claude = answeringOwnCalls(withBareRefusals(checkingKeys(runtime.claude, toaster.toast, runtime.steps.keys ?? {})), router)
   const added: string[] = []
-  const hooksAdded: Hook[] = []
   const announce = (feature: string) => {
     added.push(feature)
   }
@@ -680,7 +704,7 @@ async function createMod<State extends object, Declared extends Options>(definit
     }))
   const modState = createState<State>({ name: definition.name, initial: definition.state ?? {}, session, root, claude, report, changed: area.changed, forkParent })
   const modOptions = createOptions({ name: definition.name, declared: definition.options ?? {}, fromClaude: runtime.options, claude, report, changed: modState.changed })
-  const held: HeldDecisions | undefined = runtime.checksPermissions() ? new Map() : undefined
+  const hookOn = <H extends Hook>(hook: H, listener: HookListener<H>): Disposable => router.add(`classic.${hook}`, classicHook(hook, listener, report))
   const expand = (path: string) => (homePrefix.test(path) ? resolvedPath(path, places) : path)
   const settingsFile = (source: 'user' | 'project' | 'local'): SettingsFile => ({
     read: () => checked.settings.read({ source }),
@@ -689,8 +713,18 @@ async function createMod<State extends object, Declared extends Options>(definit
       await claude.cmod.call({ to: cmodPluginName, method: 'updateSettings', input: { mod: definition.name, source, project: modState.root, values } })
     },
   })
-  const client = createSessionsClient({ name: definition.name, claude: checked, report: (id, message, error) => report({ id, message, error }), isGranted: (permission) => flag(permission) })
+  const client = createSessionsClient({
+    name: definition.name,
+    claude: checked,
+    report: (id, message, error) => report({ id, message, error }),
+    isGranted: (permission) => flag(permission),
+    hookOn: (hook, listener) => hookOn(hook as Hook, listener as HookListener<Hook>),
+    routeOn: (event, hook) => router.add(event, hook as never),
+    permissionRoutes: runtime.permissionRoutes,
+  })
   let followed: Parameters<typeof client.follow>[0] | undefined
+  let isSetUp = false
+  const watches = new Set<{ readonly paths: readonly string[]; readonly listener: (change: FileChange) => unknown }>()
   const followFolders = (project: string, folder: string) => {
     if (followed === undefined) return
     followed = { ...followed, project, cwd: folder }
@@ -698,7 +732,16 @@ async function createMod<State extends object, Declared extends Options>(definit
   }
   const imports: Imports = {
     sessions: client.sessions,
-    settings: {
+    commands: {
+      list: async () => (await checked.command.list()).map(({ name, description, source, plugin }) => ({ name, description, source, ...(plugin === undefined ? {} : { plugin }) })),
+      run: async (command, args) => {
+        const { text, context } = await checked.command.run({ command, ...(args === undefined ? {} : { args }) })
+        return { ...(text === undefined ? {} : { text }), ...(context === undefined || context.length === 0 ? {} : { note: context.join('\n') }) }
+      },
+      beforeRun: (...args: unknown[]) => client.listen('beforeRun', args),
+      onRun: (...args: unknown[]) => client.listen('onRun', args),
+    },
+    config: {
       list: async () =>
         (await checked.config.list()).map(({ key, label, description, kind, value, options, provider, isLocked }) => ({
           key,
@@ -710,9 +753,21 @@ async function createMod<State extends object, Declared extends Options>(definit
           ...(options === undefined ? {} : { options }),
           ...(provider.plugin === 'engine' ? {} : { plugin: provider.plugin }),
         })),
+    },
+    settings: {
       user: settingsFile('user'),
       project: settingsFile('project'),
       local: settingsFile('local'),
+      beforeFileChange: (matcherOrListener: unknown, maybeListener?: SettingsFileChangeListener) => {
+        const listener = (maybeListener ?? matcherOrListener) as SettingsFileChangeListener
+        const matcher = maybeListener === undefined ? undefined : matcherOrListener
+        return hookOn('ConfigChange', async ({ source, file_path }) => {
+          const change: SettingsFileChange = { source: source === 'skills' ? 'skills' : (source.replace('_settings', '') as SettingsFileChange['source']), ...(file_path === undefined ? {} : { path: file_path }) }
+          if (matcher !== undefined && !matches(change, matcher)) return undefined
+          const refuse = (await listener(change))?.refuse
+          return typeof refuse === 'string' ? { block: refuse } : undefined
+        })
+      },
     },
     model: { complete: (completion, options) => checked.model.complete(completion, options) },
     fs: {
@@ -725,6 +780,20 @@ async function createMod<State extends object, Declared extends Options>(definit
         const { kind, size, mtimeMs, isLink, realPath } = await checked.fs.stat(expand(path), options)
         return { isFile: kind === 'file', isFolder: kind === 'dir', isLink, size, modifiedAt: mtimeMs, ...(realPath === undefined ? {} : { realPath }) }
       },
+      onChange({ path }, listener) {
+        if (isSetUp) throw new Error(`${definition.name}: fs.onChange works only in setup, because Claude Code reads the paths it watches when a session starts.`)
+        const paths = [path].flat().map((each) => resolvedPath(each, places))
+        const watch = { paths, listener }
+        watches.add(watch)
+        if (watches.size === 1) {
+          hookOn('SessionStart', () => ({ watchPaths: [...new Set([...watches].flatMap((each) => each.paths))] }))
+          hookOn('FileChanged', ({ file_path, event }) => {
+            for (const each of watches) if (each.paths.some((watched) => relativePath(watched, file_path) !== undefined)) void Promise.resolve(each.listener({ path: file_path, type: event })).catch((error: unknown) => report({ id: 'fs:onChange', message: 'The fs.onChange listener failed', error }))
+            return undefined
+          })
+        }
+        return { dispose: () => void watches.delete(watch) }
+      },
     },
     metadata: {
       read: (path) => files.read(path),
@@ -787,23 +856,10 @@ async function createMod<State extends object, Declared extends Options>(definit
       files: allowed('files'),
       config: allowed('config'),
     },
-    on(hook: Hook, matcherOrListener: unknown, listenerOrOptions?: unknown, maybeOptions?: HookOptions): Disposable {
-      const hasMatcher = typeof listenerOrOptions === 'function'
-      const listener = (hasMatcher ? listenerOrOptions : matcherOrListener) as HookListener<Hook>
-      const matcher = hasMatcher ? matcherOrListener : undefined
-      const options = (hasMatcher ? maybeOptions : listenerOrOptions) as HookOptions | undefined
-      if (!hooks.includes(hook)) throw new Error(`${definition.name}: mod.on takes one of Claude Code's hooks, such as PreToolUse, not ${String(hook)}.`)
-      const matched: HookListener<Hook> = matcher === undefined ? listener : (input) => (matches(input, matcher) ? listener(input) : undefined)
-      const bounded = options?.timeoutMs === undefined ? matched : timedHook(hook, matched, checkedMs(definition.name, `the ${hook} hook's timeoutMs`, options.timeoutMs), claude, toaster.toast)
-      if (!hooksAdded.includes(hook)) hooksAdded.push(hook)
-      if (hook === PreToolUse) return router.add('tool.call', preToolUseHook(definition.name, bounded as HookListener<typeof PreToolUse>, claude, agents, held))
-      const classic: Exclude<Hook, typeof PreToolUse> = hook
-      return router.add(`classic.${classic}`, classicHook(definition.name, classic, bounded as HookListener<typeof classic>, claude, agents, report))
-    },
     every: (ms, listener) => timer(ms, 'every', claude.clock.every, listener),
     after: (ms, listener) => timer(ms, 'after', claude.clock.after, listener),
     use: (job) => job({ mod, announce, reserveName }),
-    log: (text) => claude.ui.log(`${definition.name}: ${text}`, { to: 'debug' }),
+    log: (text, options) => claude.ui.log(`${definition.name}: ${text}`, { to: options?.to ?? 'debug' }),
     ui: { ...area.ui, notice: (callId, text) => claude.ui.notice(callId, text) },
     settings: settingsPages,
     dependencies: dependencyCalls(claude, (call, task) => beforeDeadline(claude, { ms: dependencyCallMs }, call, task)),
@@ -829,8 +885,8 @@ async function createMod<State extends object, Declared extends Options>(definit
       loadedCwd = nextCwd
       if (!hasMovedRoot) area.changed()
       if (nextCwd === oldCwd) return
-      const moved: HookInput<'CwdChanged'> = { session_id: await claude.session.id(), cwd: nextCwd, hook_event_name: 'CwdChanged', old_cwd: oldCwd, new_cwd: nextCwd }
-      await router.dispatch('classic.CwdChanged', moved as Frozen<Args<'classic.CwdChanged'>>, async () => ({}))
+      const moved = { session_id: await claude.session.id(), cwd: nextCwd, hook_event_name: 'CwdChanged', old_cwd: oldCwd, new_cwd: nextCwd }
+      await router.dispatch('classic.CwdChanged', moved as unknown as Frozen<Args<'classic.CwdChanged'>>, async () => ({}))
     } catch (error) {
       report({ id: 'cmod:follow', message: `Keeps the state of ${modState.root} until the next prompt or folder move`, error })
     }
@@ -883,8 +939,8 @@ async function createMod<State extends object, Declared extends Options>(definit
     if (e.to !== definition.name) return next(e)
     const call = e as typeof e & { readonly caller?: string }
     if (e.method === conversationMethods.changed && call.caller === cmodPluginName) {
-      if (!flag('conversation')) return { value: null }
       const { session: changedSession, change, isInProject } = e.input as { readonly session: string; readonly change: SessionChange; readonly isInProject?: boolean }
+      if (changedSession !== client.sessions.current.id && !flag('conversation')) return { value: null }
       client.changed(changedSession, change, isInProject !== false)
       return { value: null }
     }
@@ -915,20 +971,19 @@ async function createMod<State extends object, Declared extends Options>(definit
   if (missing.length > 0) throw new MissingOptions(missing, missing.map((key) => definition.options?.[key]?.title ?? key))
   await failsAs('the details of its session did not load', () => followCurrent(undefined))
   await failsAs('its setup function threw', () => definition.setup(mod))
+  isSetUp = true
   const permissionHooks = permissionEvents.filter((event) => router.has(event))
-  if (permissionHooks.length > 0 && !runtime.checksPermissions()) {
+  if (permissionHooks.length > 0 && runtime.permissionRoutes() === undefined) {
     throw new Error(`it decides permissions on ${listed(permissionHooks)}, so hooks/register.ts must call registerPermissionCheck(addHook) after registerMod`)
   }
-  if (held !== undefined && hooksAdded.includes(PreToolUse)) router.add('tool.check', heldDecisionHook(held))
   await failsAs('its open panes did not load', () => area.restorePanes())
-  if (hooksAdded.length > 0) added.push(`${hooksAdded.length === 1 ? 'a hook' : 'hooks'} on ${listed(hooksAdded)}`)
-  return { mod, added, imports }
+  return { mod, added, imports, raise: client.raise }
 }
 
 function checkingKeys(claude: Claude, toast: Toast, keys: Readonly<Record<string, string>>): Claude {
   const bound = Object.entries(keys)
   if (bound.length === 0) return claude
-  const register: Claude['command']['register'] = (command) => {
+  const addCommand: Claude['command']['register'] = (command) => {
     for (const [key, commandName] of bound) {
       if (commandName === command.name && command.immediate !== true) {
         toast.warning(`${key} runs /${command.name}, which waits for Claude's turn to end`, { id: `key:${key}`, description: `It adds a row to the conversation. Give /${command.name} immediate: true.`, duration: Infinity })
@@ -936,7 +991,7 @@ function checkingKeys(claude: Claude, toast: Toast, keys: Readonly<Record<string
     }
     return claude.command.register(command)
   }
-  return { ...claude, command: { ...claude.command, register } }
+  return { ...claude, command: { ...claude.command, register: addCommand } }
 }
 
 const longestTimerMs = 2_147_483_647
@@ -946,28 +1001,6 @@ function checkedMs(name: string, subject: string, ms: number): number {
   return ms
 }
 
-function timedHook<H extends Hook>(event: H, hook: HookListener<H>, ms: number, claude: Claude, toast: Toast): HookListener<H> {
-  return (input) =>
-    new Promise((resolve, reject) => {
-      const timer = claude.clock.after(ms, () => {
-        toast.warning(`The ${event} hook passed its ${ms / 1000} s timeout`, { id: `timeout:${event}` })
-        resolve(undefined)
-      })
-      Promise.resolve()
-        .then(() => hook(input))
-        .then(
-          (answer) => {
-            timer.cancel()
-            resolve(answer)
-          },
-          (error: unknown) => {
-            timer.cancel()
-            reject(error)
-          },
-        )
-    })
-}
-
 async function failsAs(subject: string, step: () => unknown): Promise<void> {
   try {
     await step()

package/src/runtime/permission-check.ts

@@ -0,0 +1,47 @@
+import type { Disposable } from '../mod.js'
+import type { HookFields } from './hooks.js'
+import { defined, processPayloadOf, recordOf, type HookOn, type RouteOn, type ToolCheck } from './sessions.js'
+
+export type PermissionUse = {
+  readonly raise: (method: string, payload: HookFields) => Promise<HookFields | undefined>
+  readonly hookOn: HookOn
+  readonly routeOn: RouteOn
+  readonly current: () => { readonly id: string; readonly cwd: string }
+}
+
+export type PermissionRoutes = (method: string, use: PermissionUse) => Disposable
+
+type Verdict = { readonly decision: 'allow' | 'ask' | 'deny'; readonly reason?: string; readonly rule?: string }
+
+const verdictName = (decision: Verdict['decision']) => (decision === 'deny' ? 'refuse' : decision)
+
+export const permissionRoutes: PermissionRoutes = (method, { raise, hookOn, routeOn, current }) => {
+  const isBefore = method.startsWith('before')
+  if (method.endsWith('PermissionCheck')) {
+    return routeOn('tool.check', async (e: ToolCheck, next) => {
+      const below = (await next(e)) as Verdict
+      const { id, cwd } = current()
+      const payload = { session: id, cwd, ...defined({ task: e.agentId, callId: e.tool_use_id, reason: below.reason, rule: below.rule, ceiling: e.ceiling === undefined ? undefined : verdictName(e.ceiling) }), name: e.tool, input: recordOf(e.input), decision: verdictName(below.decision) }
+      if (!isBefore) {
+        void raise(method, payload)
+        return below
+      }
+      const answer = await raise(method, payload)
+      if (answer === undefined || below.decision === 'deny') return below
+      if (typeof answer['refuse'] === 'string') return { decision: 'deny', reason: answer['refuse'] }
+      if (typeof answer['ask'] === 'string') return { decision: 'ask', reason: answer['ask'] }
+      return answer['allow'] === true ? { decision: 'allow' } : below
+    })
+  }
+  return hookOn('PermissionRequest', async (input) => {
+    const payload = processPayloadOf('PermissionRequest', input)
+    if (!isBefore) {
+      void raise(method, payload)
+      return undefined
+    }
+    const answer = await raise(method, payload)
+    if (answer === undefined) return undefined
+    if (typeof answer['refuse'] === 'string') return { decision: defined({ behavior: 'deny', message: answer['refuse'], interrupt: answer['interrupt'] }) }
+    return answer['allow'] === true ? { decision: defined({ behavior: 'allow', updatedInput: answer['input'], updatedPermissions: answer['updates'] }) } : undefined
+  })
+}