@deepseek-harness-tui/dsh-tui 0.12.0 → 0.14.0

package/lib/types/backends/claude/options.js

@@ -0,0 +1,208 @@
+// Side-effect import: the canUseTool-shadow warning filter must be installed
+// before the first query() construction (this module is in that chain).
+import './sdk-warnings.js';
+export const OPTION_POLICY = {
+    abortController: 'set',
+    additionalDirectories: 'later', // `/add-dir`
+    projectConfigRoot: 'omit',
+    agent: 'omit',
+    agents: 'omit',
+    // The todo-panel family only: additive + pre-approved (below) — the SDK's
+    // auto-allow list also surfaces shouldDefer tools the native build keeps
+    // behind ToolSearch, so the panel works without per-call prompts.
+    allowedTools: 'set',
+    canUseTool: 'set',
+    continue: 'omit',
+    cwd: 'set',
+    disallowedTools: 'omit',
+    toolAliases: 'omit',
+    tools: 'set',
+    env: 'set',
+    executable: 'omit',
+    executableArgs: 'omit',
+    extraArgs: 'set', // only when the CLI lacks msg_lifecycle_v1 (replay-user-messages)
+    fallbackModel: 'omit',
+    enableFileCheckpointing: 'set',
+    toolConfig: 'omit',
+    forkSession: 'side', // the side query forks the conversation
+    betas: 'omit',
+    hooks: 'omit',
+    onElicitation: 'set', // MCP elicitation → the questionnaire (dialogs.ts)
+    onUserDialog: 'set', // the refusal-fallback dialog (dialogs.ts)
+    supportedDialogKinds: 'set', // exactly the kinds dialogs.ts renders
+    perTaskStopAffordance: 'set',
+    persistSession: 'side', // the side query writes no transcript
+    sessionStore: 'omit',
+    sessionStoreFlush: 'omit',
+    loadTimeoutMs: 'omit',
+    includeHookEvents: 'set',
+    includePartialMessages: 'set',
+    forwardSubagentText: 'set',
+    verbatimPrompts: 'omit',
+    thinking: 'omit',
+    effort: 'set', // the persisted `/effort` choice
+    maxThinkingTokens: 'omit',
+    maxTurns: 'side', // the side query: one turn
+    maxBudgetUsd: 'omit',
+    taskBudget: 'omit',
+    mcpServers: 'omit',
+    model: 'set', // the persisted `/model` choice
+    outputFormat: 'omit',
+    pathToClaudeCodeExecutable: 'set',
+    permissionMode: 'set',
+    planModeInstructions: 'omit',
+    allowDangerouslySkipPermissions: 'set', // the always-on bypass gate (buildQueryOptions)
+    permissionPromptToolName: 'omit',
+    permissionPrompts: 'omit',
+    plugins: 'omit',
+    pluginDelivery: 'omit',
+    promptSuggestions: 'omit',
+    agentProgressSummaries: 'omit',
+    resume: 'set', // /resume and the credential reconnect
+    sessionId: 'set',
+    resumeSessionAt: 'later',
+    resumeDropsTurn: 'later',
+    sandbox: 'omit',
+    settings: 'set', // the auth plan's flag layer, as a private file (flag-settings.ts)
+    managedSettings: 'omit',
+    settingSources: 'set',
+    skills: 'omit',
+    debug: 'omit',
+    debugFile: 'omit',
+    stderr: 'set',
+    strictMcpConfig: 'omit',
+    systemPrompt: 'set',
+    title: 'omit',
+    spawnClaudeCodeProcess: 'omit',
+};
+/** Every settings source, so CLAUDE.md, hooks, MCP and plugins load as in
+ *  the CLI (`project` is the one that brings CLAUDE.md). */
+export const SETTING_SOURCES = ['user', 'project', 'local'];
+/** The plan-tracking tools the todo panel renders (the Task* family
+ *  replaced TodoWrite in CLI 2.1.284). The preset defers them, so
+ *  `allowedTools` brings them in and pre-approves them; `tools` stays the
+ *  preset (an explicit list would replace the whole default set). */
+export const TODO_PANEL_TOOLS = ['TodoWrite', 'TaskCreate', 'TaskUpdate', 'TaskList', 'TaskGet'];
+/** Modes the start resolution accepts from settings. `bypassPermissions`
+ *  is never started from settings — only the env override below opts in. */
+const START_MODES = ['default', 'acceptEdits', 'plan', 'auto', 'dontAsk'];
+const ALL_MODES = [...START_MODES, 'bypassPermissions'];
+/** Modes the developer override may start in. `bypassPermissions` is the
+ *  one explicit bypass entry: the repo owner's own environment, never a
+ *  repo-committed settings file (settings-level bypass still downgrades
+ *  above, so a cloned repo cannot poison a session into it). Not `auto`
+ *  either (it depends on the model's classifier support). */
+const OVERRIDE_MODES = ['default', 'acceptEdits', 'plan', 'dontAsk', 'bypassPermissions'];
+const isPermissionMode = (value) => typeof value === 'string' && ALL_MODES.includes(value);
+/**
+ * The explicit start permission mode (never omitted: the CLI default may be
+ * `auto`). `DSH_TUI_CLAUDE_PERMISSION_MODE` is a developer override for live
+ * tests and the only way to start in `bypassPermissions`
+ * (docs/configuration.md). Next comes `pref`, the user's remembered
+ * `/permission` pick (`~/.dsh-tui/backends/claude/prefs.json`): it skips the
+ * settings cascade (no escalation filter, no downgrade notice) — except a
+ * remembered `bypassPermissions`, which is never carried into a new session
+ * (Claude Code itself wants an explicit flag on every start): it resolves as
+ * if nothing were remembered and says so (`bypassNotCarried`). An illegal
+ * persisted value reads as no choice. Otherwise the user's settings cascade
+ * after the CLI's own trust filter for escalating modes from repo-committed
+ * files; otherwise `default`.
+ *
+ * Starting elsewhere restricts nothing: the bypass gate rides along on every
+ * query (`buildQueryOptions`), so `/permission` may switch into
+ * `bypassPermissions` at any point of the session.
+ */
+export async function resolveStartPermissionMode(sdk, cwd, env = process.env, pref) {
+    const override = env.DSH_TUI_CLAUDE_PERMISSION_MODE;
+    if (override !== undefined && override !== '' && OVERRIDE_MODES.includes(override)) {
+        return { mode: override, source: 'env' };
+    }
+    const ignoredOverride = override === undefined || override === '' ? undefined : override;
+    const notes = {
+        ...(ignoredOverride === undefined ? {} : { ignoredOverride }),
+        ...(pref === 'bypassPermissions' ? { bypassNotCarried: true } : {}),
+    };
+    if (isPermissionMode(pref) && pref !== 'bypassPermissions')
+        return { mode: pref, source: 'pref', ...notes };
+    let configured;
+    try {
+        const resolved = await sdk.resolveSettings({ cwd, settingSources: SETTING_SOURCES });
+        const effective = sdk.filterEscalatingDefaultMode(resolved);
+        const permissions = typeof effective === 'object' && effective !== null ? effective.permissions : undefined;
+        configured = typeof permissions === 'object' && permissions !== null ? permissions.defaultMode : undefined;
+    }
+    catch {
+        configured = undefined;
+    }
+    if (!isPermissionMode(configured))
+        return { mode: 'default', source: 'default', ...notes };
+    if (!START_MODES.includes(configured))
+        return { mode: 'default', downgradedFrom: configured, source: 'settings', ...notes };
+    return { mode: configured, source: 'settings', ...notes };
+}
+/**
+ * The side query's options: a throwaway fork of the
+ * conversation (`resume` + `forkSession`, `persistSession:false` — no
+ * transcript written), no tools, one turn, the session's model, and the
+ * session's own system prompt, settings sources, environment, credential
+ * and route pin. Nothing can ask for permission (no tools; any request is
+ * refused).
+ */
+export function buildSideQueryOptions(input) {
+    return {
+        abortController: input.abortController,
+        cwd: input.cwd,
+        resume: input.resume,
+        forkSession: true,
+        persistSession: false,
+        tools: [],
+        maxTurns: 1,
+        systemPrompt: { type: 'preset', preset: 'claude_code' },
+        settingSources: SETTING_SOURCES,
+        includePartialMessages: true,
+        canUseTool: () => Promise.resolve({ behavior: 'deny', message: 'No tools are available to a side question' }),
+        env: input.env,
+        stderr: input.stderr,
+        ...(input.executable === undefined ? {} : { pathToClaudeCodeExecutable: input.executable }),
+        ...(input.model === undefined ? {} : { model: input.model }),
+        ...(input.settingsFile === undefined ? {} : { settings: input.settingsFile }),
+    };
+}
+/** Assemble the `query()` options of one session. */
+export function buildQueryOptions(input) {
+    return {
+        abortController: input.abortController,
+        cwd: input.cwd,
+        ...(input.resume === undefined ? { sessionId: input.sessionId } : { resume: input.resume }),
+        systemPrompt: { type: 'preset', preset: 'claude_code' },
+        settingSources: SETTING_SOURCES,
+        tools: { type: 'preset', preset: 'claude_code' },
+        // Additive + pre-approval only (see TODO_PANEL_TOOLS): the preset above
+        // stays the base set; this frees the todo-panel family from approval
+        // prompts and surfaces it where the native build defers it.
+        allowedTools: [...TODO_PANEL_TOOLS],
+        permissionMode: input.permissionMode,
+        // Always on. It becomes `--allow-dangerously-skip-permissions`, which
+        // only makes bypass reachable: a process started without it can never
+        // enter `bypassPermissions` later. It does not start in bypass; the
+        // session starts in `input.permissionMode`, and bypass is entered only by
+        // an explicit `setPermissionMode` from the /permission picker.
+        allowDangerouslySkipPermissions: true,
+        canUseTool: input.canUseTool,
+        ...(input.onElicitation === undefined ? {} : { onElicitation: input.onElicitation }),
+        // The SDK refuses declared kinds without the callback.
+        ...(input.onUserDialog === undefined ? {} : { onUserDialog: input.onUserDialog, supportedDialogKinds: [...(input.supportedDialogKinds ?? [])] }),
+        includePartialMessages: true,
+        forwardSubagentText: true,
+        perTaskStopAffordance: true,
+        enableFileCheckpointing: true,
+        includeHookEvents: false,
+        env: input.env,
+        stderr: input.stderr,
+        ...(input.executable === undefined ? {} : { pathToClaudeCodeExecutable: input.executable }),
+        ...(input.model === undefined ? {} : { model: input.model }),
+        ...(input.effort === undefined ? {} : { effort: input.effort }),
+        ...(input.settingsFile === undefined ? {} : { settings: input.settingsFile }),
+        ...(input.replayUserMessages ? { extraArgs: { 'replay-user-messages': null } } : {}),
+    };
+}

package/lib/types/backends/claude/permissions.d.ts

@@ -0,0 +1,83 @@
+/**
+ * The Claude permission bridge: the session's `canUseTool` callback. Every prompt parks here, keyed by the
+ * control request id, and surfaces to the channel as an Agent Domain event:
+ *
+ *  - an ordinary tool prompt → `permission.request` with backend-generated
+ *    options (allow once; allow always — only when the CLI suggests what to
+ *    remember and the prompt allows it — labelled by what it remembers;
+ *    reject, with an optional typed reason);
+ *  - `AskUserQuestion` → `question.request` (the questionnaire panel);
+ *  - `ExitPlanMode` → `question.request` presented as a plan review (approve
+ *    with auto-accepted edits / approve with manual approvals / keep
+ *    planning, with feedback).
+ *
+ * The user's answer comes back through `respond` / `respondQuestion` /
+ * `cancelQuestion` and becomes the `PermissionResult` the CLI expects.
+ *
+ * Deadlock rules (each covered by verify-claude-permissions):
+ *  1. the SDK's abort signal (interrupt, turn end, process exit, `close()`)
+ *     settles the prompt as withdrawn and closes the panel
+ *     (`permission.settled{cancelled}` / `question.settled`), whichever
+ *     delivery of the request it came with;
+ *  2. a user cancel only interrupts the CLI (the session's `cancel()`); the
+ *     abort that follows is rule 1 — this bridge never answers on its own;
+ *  3. a dismissed panel is a rejection (the panel's Esc);
+ *  4. dispose / switch denies every pending prompt (`settleAll`) before the
+ *     query closes;
+ *  5. parallel prompts all park; the shared store shows them FIFO, one at a
+ *     time (the CLI itself asks one at a time);
+ *  6. the callback never throws: a failure while building a prompt denies it.
+ *
+ * Persistence of an allow-always choice is entirely the CLI's: the bridge
+ * hands back the CLI's own suggestions as `updatedPermissions` and never
+ * writes a settings file.
+ */
+import type { CanUseTool, PermissionUpdate } from '@anthropic-ai/claude-agent-sdk';
+import type { PermissionDecision, QuestionAnswers } from '../../agent/capabilities.js';
+import type { AgentEvent, PermissionRequestView } from '../../agent/events.js';
+import { type Rec } from './narrow.js';
+/** The model-facing refusal. */
+export declare const REJECT_MESSAGE = "User refused permission to run tool";
+/** The model-facing answer to a cancelled `AskUserQuestion`. */
+export declare const QUESTION_CANCEL_MESSAGE = "User cancelled the question";
+/** The model-facing answer to a plan sent back for more planning. */
+export declare const PLAN_KEEP_PLANNING_MESSAGE = "The user wants to keep planning and did not approve the plan";
+/** The model-facing answer to a dismissed plan review. */
+export declare const PLAN_DISMISSED_MESSAGE = "The user dismissed the plan review";
+/** What a withdrawn prompt resolves with (the CLI records its own refusal). */
+export declare const WITHDRAWN_MESSAGE = "The permission prompt was withdrawn";
+/** What a prompt still open at dispose resolves with. */
+export declare const CLOSED_MESSAGE = "The session closed before the user answered";
+export interface ClaudePermissionBridgeDeps {
+    /** The session cwd (paths in prompts display relative to it). */
+    readonly cwd: string;
+    /** Deliver events to the channel (buffered until it subscribes). */
+    emit(events: readonly AgentEvent[]): void;
+    debug(message: string): void;
+    /** The number of parked prompts changed (session status). */
+    onPendingChange?(count: number): void;
+    /** The session is closing: new prompts are refused at once. */
+    closing(): boolean;
+}
+/** One line naming what the tool would do. */
+export declare function promptCommand(toolName: string, input: Rec, cwd: string): string | undefined;
+/**
+ * The allow-always label: what the CLI's suggestions would remember, in the
+ * user's words. Undefined when no suggestion has a known shape (the generic
+ * label stands in).
+ */
+export declare function alwaysLabel(suggestions: readonly PermissionUpdate[], cwd: string): string | undefined;
+/** Create the bridge for one session. */
+export declare function createClaudePermissionBridge(deps: ClaudePermissionBridgeDeps): {
+    canUseTool: CanUseTool;
+    respond: (requestId: string, decision: PermissionDecision) => void;
+    respondQuestion: (requestId: string, answers: QuestionAnswers) => void;
+    cancelQuestion: (requestId: string) => void;
+    /** Every parked tool prompt, in park order. */
+    pendingViews(): readonly PermissionRequestView[];
+    readonly size: number;
+    /** Withdraw everything (dispose, switch, a forced turn close). */
+    settleAll(message?: string): void;
+};
+export type ClaudePermissionBridge = ReturnType<typeof createClaudePermissionBridge>;
+//# sourceMappingURL=permissions.d.ts.map

package/lib/types/backends/claude/permissions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.d.ts","sourceRoot":"","sources":["../../../../src/backends/claude/permissions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,OAAO,KAAK,EAAE,UAAU,EAAoB,gBAAgB,EAAE,MAAM,gCAAgC,CAAA;AACpG,OAAO,KAAK,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAA;AACtF,OAAO,KAAK,EAAE,UAAU,EAA2C,qBAAqB,EAAoB,MAAM,uBAAuB,CAAA;AAGzI,OAAO,EAAuB,KAAK,GAAG,EAAE,MAAM,aAAa,CAAA;AAE3D,gCAAgC;AAChC,eAAO,MAAM,cAAc,wCAAwC,CAAA;AACnE,gEAAgE;AAChE,eAAO,MAAM,uBAAuB,gCAAgC,CAAA;AACpE,qEAAqE;AACrE,eAAO,MAAM,0BAA0B,iEAAiE,CAAA;AACxG,0DAA0D;AAC1D,eAAO,MAAM,sBAAsB,uCAAuC,CAAA;AAC1E,+EAA+E;AAC/E,eAAO,MAAM,iBAAiB,wCAAwC,CAAA;AACtE,yDAAyD;AACzD,eAAO,MAAM,cAAc,gDAAgD,CAAA;AA4B3E,MAAM,WAAW,0BAA0B;IACzC,iEAAiE;IACjE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,oEAAoE;IACpE,IAAI,CAAC,MAAM,EAAE,SAAS,UAAU,EAAE,GAAG,IAAI,CAAA;IACzC,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IAC5B,6DAA6D;IAC7D,eAAe,CAAC,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACrC,+DAA+D;IAC/D,OAAO,IAAI,OAAO,CAAA;CACnB;AAED,8CAA8C;AAC9C,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CA2B3F;AAMD;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,WAAW,EAAE,SAAS,gBAAgB,EAAE,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAoBrG;AAuBD,yCAAyC;AACzC,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,0BAA0B;;yBAqJ/C,MAAM,YAAY,kBAAkB,KAAG,IAAI;iCAiCnC,MAAM,WAAW,eAAe,KAAG,IAAI;gCA0BxC,MAAM,KAAG,IAAI;IAW9C,+CAA+C;oBAC/B,SAAS,qBAAqB,EAAE;mBAGpC,MAAM;IAClB,kEAAkE;wBAC/C,MAAM,GAAoB,IAAI;EAIpD;AAED,MAAM,MAAM,sBAAsB,GAAG,UAAU,CAAC,OAAO,4BAA4B,CAAC,CAAA"}

package/lib/types/backends/claude/permissions.js

@@ -0,0 +1,331 @@
+import { t } from '../../i18n.js';
+import { displayPath } from './tools.js';
+import { errorText, rec, str } from './narrow.js';
+/** The model-facing refusal. */
+export const REJECT_MESSAGE = 'User refused permission to run tool';
+/** The model-facing answer to a cancelled `AskUserQuestion`. */
+export const QUESTION_CANCEL_MESSAGE = 'User cancelled the question';
+/** The model-facing answer to a plan sent back for more planning. */
+export const PLAN_KEEP_PLANNING_MESSAGE = 'The user wants to keep planning and did not approve the plan';
+/** The model-facing answer to a dismissed plan review. */
+export const PLAN_DISMISSED_MESSAGE = 'The user dismissed the plan review';
+/** What a withdrawn prompt resolves with (the CLI records its own refusal). */
+export const WITHDRAWN_MESSAGE = 'The permission prompt was withdrawn';
+/** What a prompt still open at dispose resolves with. */
+export const CLOSED_MESSAGE = 'The session closed before the user answered';
+/** One line naming what the tool would do. */
+export function promptCommand(toolName, input, cwd) {
+    const path = str(input.file_path) ?? str(input.notebook_path) ?? str(input.path);
+    switch (toolName) {
+        case 'Bash':
+        case 'PowerShell':
+            return str(input.command);
+        case 'Read':
+        case 'Write':
+        case 'Edit':
+        case 'MultiEdit':
+        case 'NotebookEdit':
+            return path === undefined ? undefined : displayPath(path, cwd);
+        case 'WebFetch':
+            return str(input.url);
+        case 'WebSearch':
+            return str(input.query);
+        case 'Glob':
+        case 'Grep': {
+            const pattern = str(input.pattern);
+            return pattern === undefined ? undefined : path === undefined ? pattern : `${pattern} · ${displayPath(path, cwd)}`;
+        }
+        default: {
+            const json = JSON.stringify(input);
+            if (json === undefined || json === '{}')
+                return undefined;
+            return json.length <= 300 ? json : `${json.slice(0, 300)}…`;
+        }
+    }
+}
+/** `Tool(content)` as a permission rule is written. */
+const ruleText = (rule) => rule.ruleContent === undefined || rule.ruleContent === '' ? rule.toolName : `${rule.toolName}(${rule.ruleContent})`;
+/**
+ * The allow-always label: what the CLI's suggestions would remember, in the
+ * user's words. Undefined when no suggestion has a known shape (the generic
+ * label stands in).
+ */
+export function alwaysLabel(suggestions, cwd) {
+    const parts = suggestions.flatMap((suggestion) => {
+        switch (suggestion.type) {
+            case 'addRules': {
+                if (suggestion.behavior !== 'allow' || suggestion.rules.length === 0)
+                    return [];
+                const rules = suggestion.rules.map(ruleText).join(', ');
+                const key = suggestion.destination === 'session' || suggestion.destination === 'cliArg'
+                    ? 'claude-always-rules-session'
+                    : suggestion.destination === 'userSettings' ? 'claude-always-rules-user' : 'claude-always-rules-project';
+                return [t(key, { rules })];
+            }
+            case 'setMode':
+                return [suggestion.mode === 'acceptEdits' ? t('claude-always-accept-edits') : t('claude-always-mode', { mode: suggestion.mode })];
+            case 'addDirectories':
+                return suggestion.directories.length === 0 ? [] : [t('claude-always-directories', { dirs: suggestion.directories.map(dir => displayPath(dir, cwd)).join(', ') })];
+            default:
+                return [];
+        }
+    });
+    return parts.length === 0 ? undefined : parts.join('; ');
+}
+/** The structured questions of an `AskUserQuestion` input (none = unreadable). */
+function questionsOf(input) {
+    const list = Array.isArray(input.questions) ? input.questions : [];
+    return list.flatMap((raw) => {
+        const item = rec(raw);
+        const question = str(item?.question);
+        if (item === undefined || question === undefined || question.trim() === '')
+            return [];
+        const options = (Array.isArray(item.options) ? item.options : []).flatMap(option => {
+            const value = rec(option);
+            const label = str(value?.label);
+            return label === undefined || label === '' ? [] : [{ label, ...(str(value?.description) === undefined ? {} : { description: str(value?.description) }) }];
+        });
+        return [{
+                question,
+                ...(str(item.header) === undefined ? {} : { header: str(item.header) }),
+                options,
+                ...(item.multiSelect === true ? { multiSelect: true } : {}),
+            }];
+    });
+}
+/** Create the bridge for one session. */
+export function createClaudePermissionBridge(deps) {
+    const pending = new Map();
+    const changed = () => {
+        try {
+            deps.onPendingChange?.(pending.size);
+        }
+        catch (error) {
+            deps.debug(`claude: pending-change listener failed (${errorText(error)})`);
+        }
+    };
+    /** Settle one prompt: resolve its callbacks, tell the channel, once. */
+    const settle = (entry, result, outcome) => {
+        if (pending.get(entry.requestId) !== entry)
+            return;
+        pending.delete(entry.requestId);
+        for (const detach of entry.detachers.splice(0))
+            detach();
+        for (const resolve of entry.resolvers.splice(0))
+            resolve(result);
+        deps.emit([entry.kind === 'permission'
+                ? { type: 'permission.settled', requestId: entry.requestId, outcome }
+                : { type: 'question.settled', requestId: entry.requestId }]);
+        changed();
+    };
+    const deny = (entry, message, extra = {}) => ({
+        behavior: 'deny',
+        message,
+        toolUseID: entry.toolUseID,
+        ...(extra.interrupt === true ? { interrupt: true } : {}),
+        ...(extra.classify === false ? {} : { decisionClassification: 'user_reject' }),
+    });
+    const allow = (entry, input, updatedPermissions, permanent = false) => ({
+        behavior: 'allow',
+        updatedInput: input,
+        ...(updatedPermissions === undefined ? {} : { updatedPermissions }),
+        toolUseID: entry.toolUseID,
+        ...(permanent ? { decisionClassification: 'user_permanent' } : {}),
+    });
+    const canUseTool = (toolName, input, options) => new Promise(resolve => {
+        try {
+            const requestId = options.requestId;
+            if (deps.closing()) {
+                resolve(deny(options, CLOSED_MESSAGE));
+                return;
+            }
+            // Any delivered signal aborting cancels the shared prompt (rule 1);
+            // every listener is detached on settle.
+            const onAbort = () => {
+                const entry = pending.get(requestId);
+                if (entry !== undefined)
+                    settle(entry, deny(entry, WITHDRAWN_MESSAGE, { classify: false }), 'cancelled');
+            };
+            const listen = (signal) => {
+                signal.addEventListener('abort', onAbort, { once: true });
+                return () => { signal.removeEventListener('abort', onAbort); };
+            };
+            // The SDK may redeliver a request (reinitialize after a transport
+            // gap): the second callback waits for the same answer, and its signal
+            // counts like the first's (already aborted, or aborted later, it
+            // withdraws the whole group).
+            const existing = pending.get(requestId);
+            if (existing !== undefined) {
+                existing.resolvers.push(resolve);
+                if (options.signal.aborted) {
+                    settle(existing, deny(existing, WITHDRAWN_MESSAGE, { classify: false }), 'cancelled');
+                    return;
+                }
+                existing.detachers.push(listen(options.signal));
+                return;
+            }
+            if (options.signal.aborted) {
+                resolve(deny(options, WITHDRAWN_MESSAGE, { classify: false }));
+                return;
+            }
+            const suggestions = options.suggestions ?? [];
+            const kind = toolName === 'AskUserQuestion' ? 'question' : toolName === 'ExitPlanMode' ? 'plan' : 'permission';
+            const base = { requestId, toolUseID: options.toolUseID, input, suggestions, resolvers: [resolve], detachers: [] };
+            let entry;
+            let event;
+            if (kind === 'question') {
+                const questions = questionsOf(input);
+                if (questions.length === 0) {
+                    resolve(deny(options, t('claude-question-unreadable'), { classify: false }));
+                    return;
+                }
+                entry = { ...base, kind, questions };
+                event = {
+                    type: 'question.request',
+                    request: { requestId, callId: options.toolUseID, ...(options.agentID === undefined ? {} : { agentId: options.agentID }), questions },
+                };
+            }
+            else if (kind === 'plan') {
+                const plan = { accept: t('claude-plan-accept-edits'), manual: t('claude-plan-manual'), keep: t('claude-plan-keep') };
+                const detail = str(input.plan);
+                const questions = [{
+                        question: t('claude-plan-review-question'),
+                        header: t('claude-plan-review-header'),
+                        ...(detail === undefined ? {} : { detail }),
+                        options: [
+                            { label: plan.accept, description: t('claude-plan-accept-edits-desc') },
+                            { label: plan.manual, description: t('claude-plan-manual-desc') },
+                            { label: plan.keep, description: t('claude-plan-keep-desc') },
+                        ],
+                        intent: { kind: 'plan-review', approve: plan.accept, approveAlso: [plan.manual], decline: plan.keep },
+                    }];
+                entry = { ...base, kind, questions, plan };
+                event = { type: 'question.request', request: { requestId, callId: options.toolUseID, ...(options.agentID === undefined ? {} : { agentId: options.agentID }), questions } };
+            }
+            else {
+                const alwaysAllowed = suggestions.length > 0 && options.suppressAlwaysAllowRule !== true && options.matchedAskRule === undefined;
+                const label = alwaysAllowed ? alwaysLabel(suggestions, deps.cwd) : undefined;
+                const choices = [
+                    { id: 'allow-once', kind: 'allow-once' },
+                    ...(alwaysAllowed ? [{ id: 'allow-always', kind: 'allow-always', ...(label === undefined ? {} : { label }) }] : []),
+                    { id: 'reject', kind: 'reject' },
+                ];
+                const command = promptCommand(toolName, input, deps.cwd);
+                const view = {
+                    requestId,
+                    toolName,
+                    callId: options.toolUseID,
+                    input,
+                    options: choices,
+                    feedback: true,
+                    ...(options.displayName === undefined ? {} : { displayName: options.displayName }),
+                    ...(options.title === undefined ? {} : { title: options.title }),
+                    ...(options.description === undefined ? {} : { description: options.description }),
+                    ...(options.decisionReason === undefined ? {} : { reason: options.decisionReason }),
+                    ...(command === undefined ? {} : { command }),
+                    ...(options.blockedPath === undefined ? {} : { blockedPath: displayPath(options.blockedPath, deps.cwd) }),
+                    ...(options.agentID === undefined ? {} : { agentId: options.agentID }),
+                    ...(options.defaultToNo === true ? { defaultToNo: true } : {}),
+                    ...(options.suppressAlwaysAllowRule === true ? { suppressAlwaysAllow: true } : {}),
+                    ...(options.matchedAskRule === undefined ? {} : { matchedAskRule: { ...options.matchedAskRule } }),
+                    ...(options.mcpServer === undefined ? {} : { mcpServer: { ...options.mcpServer } }),
+                };
+                entry = { ...base, kind, view };
+                event = { type: 'permission.request', request: view };
+            }
+            pending.set(requestId, entry);
+            entry.detachers.push(listen(options.signal));
+            deps.emit([event]);
+            changed();
+        }
+        catch (error) {
+            // Rule 6: a prompt this bridge cannot present is refused, never a hang.
+            deps.debug(`claude: permission prompt failed (${errorText(error)})`);
+            resolve(deny(options, REJECT_MESSAGE, { classify: false }));
+        }
+    });
+    /** The user decided a tool prompt. */
+    const respond = (requestId, decision) => {
+        const entry = pending.get(requestId);
+        if (entry === undefined)
+            return;
+        if (entry.kind !== 'permission') {
+            deps.debug(`claude: ${requestId} is a ${entry.kind} prompt, not a permission`);
+            return;
+        }
+        const offered = (kind) => entry.view?.options.some(option => option.kind === kind) ?? false;
+        switch (decision.kind) {
+            case 'allow-once':
+                settle(entry, allow(entry, entry.input), 'allow-once');
+                return;
+            case 'allow-always':
+                // Fail closed: an allow-always the prompt never offered is a refusal.
+                if (!offered('allow-always')) {
+                    settle(entry, deny(entry, REJECT_MESSAGE), 'rejected');
+                    return;
+                }
+                settle(entry, allow(entry, entry.input, [...entry.suggestions], true), 'allow-always');
+                return;
+            case 'reject': {
+                const reason = decision.message?.trim() ?? '';
+                settle(entry, deny(entry, reason === '' ? REJECT_MESSAGE : `${REJECT_MESSAGE}. The user said: ${reason}`), 'rejected');
+                return;
+            }
+            default: {
+                const unknown = decision;
+                void unknown;
+            }
+        }
+    };
+    /** The user answered a question (or a plan review). */
+    const respondQuestion = (requestId, answers) => {
+        const entry = pending.get(requestId);
+        if (entry === undefined || entry.questions === undefined)
+            return;
+        if (entry.kind === 'plan' && entry.plan !== undefined) {
+            const answer = answers.answers[0];
+            const pick = answer?.selected[0];
+            const feedback = answer?.custom?.trim() ?? '';
+            if ((pick === entry.plan.accept || pick === entry.plan.manual) && feedback === '') {
+                const mode = pick === entry.plan.accept ? 'acceptEdits' : 'default';
+                settle(entry, allow(entry, entry.input, [{ type: 'setMode', mode, destination: 'session' }]), 'allow-once');
+                return;
+            }
+            settle(entry, deny(entry, feedback === '' ? PLAN_KEEP_PLANNING_MESSAGE : `${PLAN_KEEP_PLANNING_MESSAGE}. The user said: ${feedback}`, { interrupt: true }), 'rejected');
+            return;
+        }
+        const map = {};
+        entry.questions.forEach((question, index) => {
+            const answer = answers.answers[index];
+            if (answer === undefined)
+                return;
+            const parts = [...answer.selected, ...(answer.custom === undefined || answer.custom.trim() === '' ? [] : [answer.custom.trim()])];
+            if (parts.length > 0)
+                map[question.question] = parts.join(', ');
+        });
+        settle(entry, allow(entry, { ...entry.input, answers: map }), 'allow-once');
+    };
+    /** The user dismissed a question (or a plan review). */
+    const cancelQuestion = (requestId) => {
+        const entry = pending.get(requestId);
+        if (entry === undefined || entry.kind === 'permission')
+            return;
+        settle(entry, deny(entry, entry.kind === 'plan' ? PLAN_DISMISSED_MESSAGE : QUESTION_CANCEL_MESSAGE, { interrupt: true }), 'rejected');
+    };
+    return {
+        canUseTool,
+        respond,
+        respondQuestion,
+        cancelQuestion,
+        /** Every parked tool prompt, in park order. */
+        pendingViews() {
+            return [...pending.values()].flatMap(entry => entry.view === undefined ? [] : [entry.view]);
+        },
+        get size() { return pending.size; },
+        /** Withdraw everything (dispose, switch, a forced turn close). */
+        settleAll(message = CLOSED_MESSAGE) {
+            for (const entry of [...pending.values()])
+                settle(entry, deny(entry, message, { classify: false }), 'cancelled');
+        },
+    };
+}