@dexto/core 1.6.0 → 1.6.2

package/dist/tools/tool-manager.js

@@ -26,6 +26,7 @@ let _ToolManager = class _ToolManager {
   agentEventBus;
   toolPolicies;
   toolExecutionContextFactory;
+  contributorContextFactory;
   // Hook support - set after construction to avoid circular dependencies
   hookManager;
   sessionManager;
@@ -102,6 +103,20 @@ let _ToolManager = class _ToolManager {
     }
     this.invalidateCache();
   }
+  addTools(tools) {
+    const added = [];
+    for (const tool of tools) {
+      if (this.agentTools.has(tool.id)) {
+        continue;
+      }
+      this.agentTools.set(tool.id, tool);
+      added.push(tool.id);
+    }
+    if (added.length > 0) {
+      this.invalidateCache();
+    }
+    return added;
+  }
   setToolExecutionContextFactory(factory) {
     this.toolExecutionContextFactory = factory;
   }
@@ -191,6 +206,37 @@ let _ToolManager = class _ToolManager {
     );
     this.logger.debug(`Auto-approve tools: ${normalized.join(", ")}`);
   }
+  /**
+   * Add session-level auto-approve tools.
+   * Merges into the existing list instead of replacing it.
+   *
+   * @param sessionId The session ID
+   * @param autoApproveTools Array of tool names to auto-approve (e.g., ['bash_exec', 'mcp--read_file'])
+   */
+  addSessionAutoApproveTools(sessionId, autoApproveTools) {
+    if (autoApproveTools.length === 0) {
+      return;
+    }
+    const normalized = autoApproveTools.map(
+      (pattern) => this.normalizeToolPolicyPattern(pattern)
+    );
+    const existing = this.sessionAutoApproveTools.get(sessionId) ?? [];
+    const merged = [...existing];
+    const seen = new Set(existing);
+    for (const toolName of normalized) {
+      if (seen.has(toolName)) {
+        continue;
+      }
+      merged.push(toolName);
+      seen.add(toolName);
+    }
+    const actuallyAdded = Math.max(0, merged.length - existing.length);
+    this.sessionAutoApproveTools.set(sessionId, merged);
+    this.logger.info(
+      `Session auto-approve tools updated for '${sessionId}': +${actuallyAdded} tools`
+    );
+    this.logger.debug(`Auto-approve tools: ${merged.join(", ")}`);
+  }
   /**
    * Set session-level auto-approve tools chosen by the user.
    */
@@ -384,16 +430,175 @@ let _ToolManager = class _ToolManager {
     });
   }
   // ==================== Pattern Approval Helpers ====================
+  getToolApprovalPatternKeyFn(toolName) {
+    const tool = this.agentTools.get(toolName);
+    return tool?.approval?.patternKey;
+  }
+  getToolSuggestApprovalPatternsFn(toolName) {
+    const tool = this.agentTools.get(toolName);
+    return tool?.approval?.suggestPatterns;
+  }
+  getToolApprovalOverrideFn(toolName) {
+    const tool = this.agentTools.get(toolName);
+    return tool?.approval?.override;
+  }
+  getToolApprovalOnGrantedFn(toolName) {
+    const tool = this.agentTools.get(toolName);
+    return tool?.approval?.onGranted;
+  }
+  getToolPreviewFn(toolName) {
+    const tool = this.agentTools.get(toolName);
+    return tool?.presentation?.preview;
+  }
+  getToolDescribeHeaderFn(toolName) {
+    const tool = this.agentTools.get(toolName);
+    return tool?.presentation?.describeHeader;
+  }
+  getToolDescribeArgsFn(toolName) {
+    const tool = this.agentTools.get(toolName);
+    return tool?.presentation?.describeArgs;
+  }
+  getToolDescribeResultFn(toolName) {
+    const tool = this.agentTools.get(toolName);
+    return tool?.presentation?.describeResult;
+  }
+  buildGenericToolPresentationSnapshot(toolName) {
+    const toTitleCase = (name) => name.replace(/[_-]+/g, " ").split(" ").filter(Boolean).map((part) => part.charAt(0).toUpperCase() + part.slice(1)).join(" ");
+    const isMcp = toolName.startsWith(_ToolManager.MCP_TOOL_PREFIX);
+    const fallbackTitle = (() => {
+      if (!isMcp) {
+        return toTitleCase(toolName);
+      }
+      const actualToolName = toolName.substring(_ToolManager.MCP_TOOL_PREFIX.length);
+      const parts = actualToolName.split("--");
+      const toolPart = parts.length >= 2 ? parts.slice(1).join("--") : actualToolName;
+      return toTitleCase(toolPart);
+    })();
+    const snapshot = {
+      version: 1,
+      source: {
+        type: toolName.startsWith(_ToolManager.MCP_TOOL_PREFIX) ? "mcp" : "local"
+      },
+      header: {
+        title: fallbackTitle
+      }
+    };
+    if (snapshot.source?.type === "mcp") {
+      const actualToolName = toolName.substring(_ToolManager.MCP_TOOL_PREFIX.length);
+      const parts = actualToolName.split("--");
+      if (parts.length >= 2 && parts[0]) {
+        snapshot.source.mcpServerName = parts[0];
+      }
+    }
+    return snapshot;
+  }
+  getToolPresentationSnapshotForToolCallEvent(toolName, args, toolCallId, sessionId) {
+    const fallback = this.buildGenericToolPresentationSnapshot(toolName);
+    if (toolName.startsWith(_ToolManager.MCP_TOOL_PREFIX)) {
+      return fallback;
+    }
+    const describeHeader = this.getToolDescribeHeaderFn(toolName);
+    const describeArgs = this.getToolDescribeArgsFn(toolName);
+    if (!describeHeader && !describeArgs) {
+      return fallback;
+    }
+    try {
+      const validatedArgs = this.validateLocalToolArgs(toolName, args);
+      const context = this.buildToolExecutionContext({ sessionId, toolCallId });
+      const isPromiseLike = (value) => {
+        if (typeof value !== "object" || value === null) {
+          return false;
+        }
+        return typeof value.then === "function";
+      };
+      let nextSnapshot = fallback;
+      if (describeHeader) {
+        const header = describeHeader(validatedArgs, context);
+        if (!isPromiseLike(header) && header) {
+          nextSnapshot = {
+            ...nextSnapshot,
+            header: { ...nextSnapshot.header, ...header }
+          };
+        }
+      }
+      if (describeArgs) {
+        const argsPresentation = describeArgs(validatedArgs, context);
+        if (!isPromiseLike(argsPresentation) && argsPresentation) {
+          nextSnapshot = {
+            ...nextSnapshot,
+            args: argsPresentation
+          };
+        }
+      }
+      return nextSnapshot;
+    } catch (error) {
+      this.logger.debug(
+        `Tool presentation snapshot generation failed for '${toolName}': ${error instanceof Error ? error.message : String(error)}`
+      );
+      return fallback;
+    }
+  }
+  async getToolPresentationSnapshotForCall(toolName, args, toolCallId, sessionId) {
+    const fallback = this.buildGenericToolPresentationSnapshot(toolName);
+    if (toolName.startsWith(_ToolManager.MCP_TOOL_PREFIX)) {
+      return fallback;
+    }
+    const describeHeader = this.getToolDescribeHeaderFn(toolName);
+    const describeArgs = this.getToolDescribeArgsFn(toolName);
+    if (!describeHeader && !describeArgs) {
+      return fallback;
+    }
+    try {
+      const context = this.buildToolExecutionContext({ sessionId, toolCallId });
+      const describedHeader = describeHeader ? await Promise.resolve(describeHeader(args, context)) : null;
+      const describedArgs = describeArgs ? await Promise.resolve(describeArgs(args, context)) : null;
+      return {
+        ...fallback,
+        ...describedHeader ? { header: { ...fallback.header, ...describedHeader } } : {},
+        ...describedArgs ? { args: describedArgs } : {}
+      };
+    } catch (error) {
+      this.logger.debug(
+        `Tool presentation snapshot generation failed for '${toolName}': ${error instanceof Error ? error.message : String(error)}`
+      );
+      return fallback;
+    }
+  }
+  async augmentSnapshotWithResult(toolName, snapshot, result, args, toolCallId, sessionId) {
+    if (toolName.startsWith(_ToolManager.MCP_TOOL_PREFIX)) {
+      return snapshot;
+    }
+    const describeResult = this.getToolDescribeResultFn(toolName);
+    if (!describeResult) {
+      return snapshot;
+    }
+    try {
+      const context = this.buildToolExecutionContext({ sessionId, toolCallId });
+      const resultPresentation = await Promise.resolve(describeResult(result, args, context));
+      if (!resultPresentation) {
+        return snapshot;
+      }
+      return {
+        ...snapshot,
+        result: resultPresentation
+      };
+    } catch (error) {
+      this.logger.debug(
+        `Tool result presentation snapshot generation failed for '${toolName}': ${error instanceof Error ? error.message : String(error)}`
+      );
+      return snapshot;
+    }
+  }
   getToolPatternKey(toolName, args) {
     if (toolName.startsWith(_ToolManager.MCP_TOOL_PREFIX)) {
       return null;
     }
-    const tool = this.agentTools.get(toolName);
-    if (!tool?.getApprovalPatternKey) {
+    const getPatternKey = this.getToolApprovalPatternKeyFn(toolName);
+    if (!getPatternKey) {
       return null;
     }
     try {
-      return tool.getApprovalPatternKey(args);
+      return getPatternKey(args);
     } catch (error) {
       this.logger.debug(
         `Pattern key generation failed for '${toolName}': ${error instanceof Error ? error.message : String(error)}`
@@ -405,12 +610,12 @@ let _ToolManager = class _ToolManager {
     if (toolName.startsWith(_ToolManager.MCP_TOOL_PREFIX)) {
       return void 0;
     }
-    const tool = this.agentTools.get(toolName);
-    if (!tool?.suggestApprovalPatterns) {
+    const suggestPatterns = this.getToolSuggestApprovalPatternsFn(toolName);
+    if (!suggestPatterns) {
       return void 0;
     }
     try {
-      const patterns = tool.suggestApprovalPatterns(args);
+      const patterns = suggestPatterns(args);
       return patterns.length > 0 ? patterns : void 0;
     } catch (error) {
       this.logger.debug(
@@ -436,8 +641,10 @@ let _ToolManager = class _ToolManager {
         if (request.sessionId !== sessionId) {
           return false;
         }
-        const metadata = request.metadata;
-        return metadata.toolName === toolName;
+        if (request.metadata.toolName !== toolName) {
+          return false;
+        }
+        return request.metadata.directoryAccess === void 0;
       },
       { rememberChoice: false }
       // Don't propagate remember choice to auto-approved requests
@@ -456,8 +663,7 @@ let _ToolManager = class _ToolManager {
     if (toolName.startsWith(_ToolManager.MCP_TOOL_PREFIX)) {
       return;
     }
-    const tool = this.agentTools.get(toolName);
-    const getPatternKey = tool?.getApprovalPatternKey;
+    const getPatternKey = this.getToolApprovalPatternKeyFn(toolName);
     if (!getPatternKey) {
       return;
     }
@@ -469,17 +675,20 @@ let _ToolManager = class _ToolManager {
         if (request.sessionId !== sessionId) {
           return false;
         }
-        const metadata = request.metadata;
-        if (metadata.toolName !== toolName) {
+        if (request.metadata.toolName !== toolName) {
           return false;
         }
-        const args = metadata.args;
+        if (request.metadata.directoryAccess !== void 0) {
+          return false;
+        }
+        const args = request.metadata.args;
         if (typeof args !== "object" || args === null) {
           return false;
         }
+        const argsRecord = args;
         let patternKey;
         try {
-          patternKey = getPatternKey(args);
+          patternKey = getPatternKey(argsRecord);
         } catch (error) {
           this.logger.debug(
             `Pattern key generation failed for '${toolName}': ${error instanceof Error ? error.message : String(error)}`
@@ -499,42 +708,68 @@ let _ToolManager = class _ToolManager {
     }
   }
   /**
-   * Auto-approve pending directory access requests that match a newly approved directory access request.
-   *
-   * This handles the case where parallel file operations request directory approval concurrently.
+   * Auto-approve pending tool approval requests that are now covered by a remembered directory.
+   * Called after a user selects "remember directory" for a directory-access prompt.
    */
-  autoApprovePendingDirectoryAccessRequests(options) {
+  autoApprovePendingDirectoryRequests(toolName, sessionId) {
     const count = this.approvalManager.autoApprovePendingRequests(
       (request) => {
-        if (request.type !== ApprovalType.DIRECTORY_ACCESS) {
+        if (request.type !== ApprovalType.TOOL_APPROVAL) {
           return false;
         }
-        if (request.sessionId !== options.sessionId) {
+        if (request.sessionId !== sessionId) {
           return false;
         }
-        const metadata = request.metadata;
-        if (typeof metadata?.parentDir !== "string" || metadata.parentDir !== options.parentDir) {
+        if (request.metadata.toolName !== toolName) {
           return false;
         }
-        if (options.rememberDirectory) {
-          return true;
-        }
-        if (typeof metadata?.operation !== "string" || typeof metadata?.toolName !== "string") {
+        const directoryAccess = request.metadata.directoryAccess;
+        if (!directoryAccess) {
           return false;
         }
-        return metadata.operation === options.operation && metadata.toolName === options.toolName;
+        return this.approvalManager.isDirectorySessionApproved(directoryAccess.parentDir);
       },
       { rememberDirectory: false }
     );
     if (count > 0) {
       this.logger.info(
-        `Auto-approved ${count} parallel request(s) for directory '${options.parentDir}' after directory access was approved`
+        'Auto-approved parallel request(s) after user selected "remember directory"',
+        { count, toolName }
       );
     }
   }
   getMcpManager() {
     return this.mcpManager;
   }
+  setContributorContextFactory(factory) {
+    this.contributorContextFactory = factory ?? void 0;
+  }
+  async buildContributorContext() {
+    const baseWorkspace = this.currentWorkspace ?? null;
+    const baseContext = {
+      mcpManager: this.mcpManager,
+      workspace: baseWorkspace
+    };
+    if (!this.contributorContextFactory) {
+      return baseContext;
+    }
+    try {
+      const overrides = await this.contributorContextFactory() ?? {};
+      const workspace = overrides.workspace !== void 0 ? overrides.workspace : baseWorkspace;
+      const environment = overrides.environment !== void 0 ? overrides.environment : baseContext.environment;
+      const mcpManager = overrides.mcpManager ?? baseContext.mcpManager;
+      return {
+        mcpManager,
+        workspace,
+        ...environment !== void 0 ? { environment } : {}
+      };
+    } catch (error) {
+      this.logger.warn(
+        `Failed to build contributor context: ${error instanceof Error ? error.message : String(error)}`
+      );
+      return baseContext;
+    }
+  }
   /**
    * Get all MCP tools (delegates to mcpManager.getAllTools())
    * This provides access to MCP tools while maintaining separation of concerns
@@ -554,7 +789,7 @@ let _ToolManager = class _ToolManager {
     };
     return this.toolExecutionContextFactory(baseContext);
   }
-  validateLocalToolArgsOrThrow(toolName, args) {
+  validateLocalToolArgs(toolName, args) {
     if (toolName.startsWith(_ToolManager.MCP_TOOL_PREFIX)) {
       return args;
     }
@@ -675,15 +910,22 @@ let _ToolManager = class _ToolManager {
   async executeTool(toolName, args, toolCallId, sessionId, abortSignal) {
     const { toolArgs: rawToolArgs, meta } = extractToolCallMeta(args);
     let toolArgs = rawToolArgs;
+    const callDescription = typeof meta.callDescription === "string" ? meta.callDescription : typeof rawToolArgs.description === "string" ? rawToolArgs.description : void 0;
     const backgroundTasksEnabled = isBackgroundTasksEnabled();
-    const toolDisplayName = this.agentTools.get(toolName)?.displayName;
     this.logger.debug(`\u{1F527} Tool execution requested: '${toolName}' (toolCallId: ${toolCallId})`);
     this.logger.debug(`Tool args: ${JSON.stringify(toolArgs, null, 2)}`);
     if (sessionId) {
+      const presentationSnapshot = this.getToolPresentationSnapshotForToolCallEvent(
+        toolName,
+        toolArgs,
+        toolCallId,
+        sessionId
+      );
       this.agentEventBus.emit("llm:tool-call", {
         toolName,
-        ...toolDisplayName !== void 0 && { toolDisplayName },
+        presentationSnapshot,
         args: toolArgs,
+        ...callDescription !== void 0 && { callDescription },
         callId: toolCallId,
         sessionId
       });
@@ -691,13 +933,14 @@ let _ToolManager = class _ToolManager {
     const {
       requireApproval,
       approvalStatus,
-      args: validatedToolArgs
+      args: validatedToolArgs,
+      presentationSnapshot: callSnapshot
     } = await this.handleToolApproval(
       toolName,
       toolArgs,
       toolCallId,
       sessionId,
-      meta.callDescription
+      callDescription
     );
     toolArgs = validatedToolArgs;
     this.logger.debug(`\u2705 Tool execution approved: ${toolName}`);
@@ -731,7 +974,7 @@ let _ToolManager = class _ToolManager {
       );
       toolArgs = modifiedPayload.args;
       try {
-        toolArgs = this.validateLocalToolArgsOrThrow(toolName, toolArgs);
+        toolArgs = this.validateLocalToolArgs(toolName, toolArgs);
       } catch (error) {
         this.logger.error(
           `Post-hook validation failed for tool '${toolName}': a beforeToolCall hook may have set invalid args`
@@ -854,9 +1097,17 @@ let _ToolManager = class _ToolManager {
         );
         result = modifiedPayload.result;
       }
+      const presentationSnapshot = await this.augmentSnapshotWithResult(
+        toolName,
+        callSnapshot,
+        result,
+        toolArgs,
+        toolCallId,
+        sessionId
+      );
       return {
         result,
-        ...toolDisplayName !== void 0 && { toolDisplayName },
+        ...presentationSnapshot !== void 0 && { presentationSnapshot },
         ...requireApproval && { requireApproval, approvalStatus }
       };
     } catch (error) {
@@ -981,124 +1232,113 @@ let _ToolManager = class _ToolManager {
     );
   }
   /**
-   * Check if a tool has a custom approval override and handle it.
-   * Tools can implement getApprovalOverride() to request specialized approval flows
-   * (e.g., directory access approval for file tools) instead of default tool confirmation.
-   *
-   * @param toolName Tool name
-   * @param args The tool arguments
-   * @param sessionId Optional session ID
-   * @returns { handled: true } if custom approval was processed, { handled: false } to continue normal flow
+   * Handle tool approval flow. Checks various precedence levels to determine
+   * if a tool should be auto-approved, denied, or requires manual approval.
    */
-  async checkCustomApprovalOverride(toolName, args, toolCallId, sessionId) {
-    if (toolName.startsWith(_ToolManager.MCP_TOOL_PREFIX)) {
-      return { handled: false };
-    }
-    const tool = this.agentTools.get(toolName);
-    if (!tool?.getApprovalOverride) {
-      return { handled: false };
-    }
-    const context = this.buildToolExecutionContext({ sessionId, toolCallId });
-    const approvalRequest = await tool.getApprovalOverride(args, context);
-    if (!approvalRequest) {
-      return { handled: false };
-    }
-    this.logger.debug(
-      `Tool '${toolName}' requested custom approval: type=${approvalRequest.type}`
-    );
-    if (sessionId && !approvalRequest.sessionId) {
-      approvalRequest.sessionId = sessionId;
-    }
-    const response = await this.approvalManager.requestApproval(approvalRequest);
-    if (response.status === ApprovalStatus.APPROVED) {
-      if (tool.onApprovalGranted) {
-        tool.onApprovalGranted(response, context, approvalRequest);
-      }
-      if (approvalRequest.type === ApprovalType.DIRECTORY_ACCESS) {
-        const metadata = approvalRequest.metadata;
-        const parentDir = typeof metadata?.parentDir === "string" ? metadata.parentDir : null;
-        const operation = typeof metadata?.operation === "string" ? metadata.operation : null;
-        if (parentDir && operation) {
-          const data = response.data;
-          const rememberDirectory = data?.rememberDirectory ?? false;
-          this.autoApprovePendingDirectoryAccessRequests({
-            parentDir,
-            operation,
-            sessionId,
-            toolName,
-            rememberDirectory
-          });
-        }
-      }
+  async handleToolApproval(toolName, args, toolCallId, sessionId, callDescription) {
+    if (this.isInAlwaysDenyList(toolName)) {
       this.logger.info(
-        `Custom approval granted for '${toolName}', type=${approvalRequest.type}, session=${sessionId ?? "global"}`
+        `Tool '${toolName}' is in static deny list \u2013 blocking execution (session: ${sessionId ?? "global"})`
       );
-      return { handled: true };
+      throw ToolError.executionDenied(toolName, sessionId);
     }
-    this.logger.info(
-      `Custom approval denied for '${toolName}', type=${approvalRequest.type}, reason=${response.reason ?? "unknown"}`
+    const validatedArgs = this.validateLocalToolArgs(toolName, args);
+    const presentationSnapshot = await this.getToolPresentationSnapshotForCall(
+      toolName,
+      validatedArgs,
+      toolCallId,
+      sessionId
     );
-    if (approvalRequest.type === "directory_access") {
-      const metadata = approvalRequest.metadata;
-      throw ToolError.directoryAccessDenied(
-        metadata?.parentDir ?? "unknown directory",
-        sessionId
-      );
+    let directoryAccess;
+    let directoryAccessApprovalRequest;
+    if (!toolName.startsWith(_ToolManager.MCP_TOOL_PREFIX)) {
+      const getApprovalOverride = this.getToolApprovalOverrideFn(toolName);
+      if (getApprovalOverride) {
+        const context = this.buildToolExecutionContext({ sessionId, toolCallId });
+        const approvalRequest = await getApprovalOverride(validatedArgs, context);
+        if (approvalRequest) {
+          if (approvalRequest.type === ApprovalType.DIRECTORY_ACCESS) {
+            const metadata = approvalRequest.metadata;
+            if (typeof metadata !== "object" || metadata === null || typeof metadata.path !== "string" || typeof metadata.parentDir !== "string" || typeof metadata.operation !== "string" || typeof metadata.toolName !== "string") {
+              throw ToolError.configInvalid(
+                `Tool '${toolName}' returned invalid directory access metadata`
+              );
+            }
+            directoryAccess = metadata;
+            directoryAccessApprovalRequest = approvalRequest;
+          } else {
+            this.logger.debug(
+              `Tool '${toolName}' requested custom approval: type=${approvalRequest.type}`
+            );
+            if (sessionId && !approvalRequest.sessionId) {
+              approvalRequest.sessionId = sessionId;
+            }
+            const response = await this.approvalManager.requestApproval(approvalRequest);
+            if (response.status === ApprovalStatus.APPROVED) {
+              const onGranted = this.getToolApprovalOnGrantedFn(toolName);
+              if (onGranted) {
+                await Promise.resolve(
+                  onGranted(response, context, approvalRequest)
+                );
+              }
+              this.logger.info(
+                `Custom approval granted for '${toolName}', type=${approvalRequest.type}, session=${sessionId ?? "global"}`
+              );
+              return {
+                requireApproval: true,
+                approvalStatus: "approved",
+                args: validatedArgs,
+                presentationSnapshot
+              };
+            }
+            this.logger.info(
+              `Custom approval denied for '${toolName}', type=${approvalRequest.type}, reason=${response.reason ?? "unknown"}`
+            );
+            throw ToolError.executionDenied(toolName, sessionId);
+          }
+        }
+      }
     }
-    throw ToolError.executionDenied(toolName, sessionId);
-  }
-  /**
-   * Handle tool approval flow. Checks various precedence levels to determine
-   * if a tool should be auto-approved, denied, or requires manual approval.
-   */
-  async handleToolApproval(toolName, args, toolCallId, sessionId, callDescription) {
-    const validatedArgs = this.validateLocalToolArgsOrThrow(toolName, args);
     const quickResult = await this.tryQuickApprovalResolution(
       toolName,
       validatedArgs,
-      toolCallId,
-      sessionId
+      sessionId,
+      directoryAccess
     );
     if (quickResult !== null) {
-      return { ...quickResult, args: validatedArgs };
+      return { ...quickResult, args: validatedArgs, presentationSnapshot };
     }
     const manualResult = await this.requestManualApproval(
       toolName,
       validatedArgs,
       toolCallId,
       sessionId,
-      callDescription
+      directoryAccess,
+      directoryAccessApprovalRequest,
+      callDescription,
+      presentationSnapshot
     );
-    return { ...manualResult, args: validatedArgs };
+    return { ...manualResult, args: validatedArgs, presentationSnapshot };
   }
   /**
    * Try to resolve tool approval quickly based on policies and cached permissions.
    * Returns null if manual approval is needed.
    *
    * Precedence order (highest to lowest):
-   * 1. Static deny list (security - always blocks)
-   * 2. Custom approval override (tool-specific approval flows)
-   * 3. Session auto-approve (skill allowed-tools)
-   * 4. Static allow list
-   * 5. Dynamic "remembered" allowed list
-   * 6. Tool approval patterns
-   * 7. Approval mode (auto-approve/auto-deny)
+   * 1. Directory access requirement (outside-root paths)
+   * 2. Session auto-approve (skill allowed-tools)
+   * 3. Static allow list
+   * 4. Dynamic "remembered" allowed list
+   * 5. Tool approval patterns
+   * 6. Approval mode (auto-approve/auto-deny)
    */
-  async tryQuickApprovalResolution(toolName, args, toolCallId, sessionId) {
-    if (this.isInAlwaysDenyList(toolName)) {
-      this.logger.info(
-        `Tool '${toolName}' is in static deny list \u2013 blocking execution (session: ${sessionId ?? "global"})`
-      );
-      throw ToolError.executionDenied(toolName, sessionId);
-    }
-    const customApprovalResult = await this.checkCustomApprovalOverride(
-      toolName,
-      args,
-      toolCallId,
-      sessionId
-    );
-    if (customApprovalResult.handled) {
-      return { requireApproval: true, approvalStatus: "approved" };
+  async tryQuickApprovalResolution(toolName, args, sessionId, directoryAccess) {
+    if (directoryAccess) {
+      if (this.approvalMode === "auto-approve") {
+        this.approvalManager.addApprovedDirectory(directoryAccess.parentDir, "once");
+        return { requireApproval: false };
+      }
+      return null;
     }
     if (sessionId && this.isToolAutoApprovedForSession(sessionId, toolName)) {
       this.logger.info(
@@ -1139,12 +1379,11 @@ let _ToolManager = class _ToolManager {
    * Request manual approval from the user for a tool execution.
    * Generates preview, sends approval request, and handles the response.
    */
-  async requestManualApproval(toolName, args, toolCallId, sessionId, callDescription) {
+  async requestManualApproval(toolName, args, toolCallId, sessionId, directoryAccess, directoryAccessApprovalRequest, callDescription, presentationSnapshot) {
     this.logger.info(
       `Tool approval requested for ${toolName}, sessionId: ${sessionId ?? "global"}`
     );
     try {
-      const toolDisplayName = this.agentTools.get(toolName)?.displayName;
       const displayPreview = await this.generateToolPreview(
         toolName,
         args,
@@ -1154,14 +1393,24 @@ let _ToolManager = class _ToolManager {
       const suggestedPatterns = this.getToolSuggestedPatterns(toolName, args);
       const response = await this.approvalManager.requestToolApproval({
         toolName,
-        ...toolDisplayName !== void 0 && { toolDisplayName },
+        ...presentationSnapshot !== void 0 && { presentationSnapshot },
         toolCallId,
         args,
         ...callDescription !== void 0 && { description: callDescription },
         ...sessionId !== void 0 && { sessionId },
         ...displayPreview !== void 0 && { displayPreview },
+        ...directoryAccess !== void 0 && { directoryAccess },
         ...suggestedPatterns !== void 0 && { suggestedPatterns }
       });
+      if (response.status === ApprovalStatus.APPROVED && directoryAccessApprovalRequest !== void 0) {
+        const onGranted = this.getToolApprovalOnGrantedFn(toolName);
+        if (onGranted) {
+          const context = this.buildToolExecutionContext({ sessionId, toolCallId });
+          await Promise.resolve(
+            onGranted(response, context, directoryAccessApprovalRequest)
+          );
+        }
+      }
       if (response.status === ApprovalStatus.APPROVED && response.data) {
         await this.handleRememberChoice(toolName, response, sessionId);
       }
@@ -1183,13 +1432,13 @@ let _ToolManager = class _ToolManager {
    * Generate a preview for the tool approval UI if the tool supports it.
    */
   async generateToolPreview(toolName, args, toolCallId, sessionId) {
-    const tool = this.agentTools.get(toolName);
-    if (!tool?.generatePreview) {
+    const previewFn = this.getToolPreviewFn(toolName);
+    if (!previewFn) {
       return void 0;
     }
     try {
       const context = this.buildToolExecutionContext({ sessionId, toolCallId });
-      const preview = await tool.generatePreview(args, context);
+      const preview = await previewFn(args, context);
       this.logger.debug(`Generated preview for ${toolName}`);
       return preview ?? void 0;
     } catch (previewError) {
@@ -1204,13 +1453,14 @@ let _ToolManager = class _ToolManager {
     }
   }
   /**
-   * Handle "remember choice" or "remember pattern" when user approves a tool.
+   * Handle "remember" actions when user approves a tool.
    */
   async handleRememberChoice(toolName, response, sessionId) {
     const data = response.data;
     if (!data) return;
     const rememberChoice = data.rememberChoice;
     const rememberPattern = data.rememberPattern;
+    const rememberDirectory = data.rememberDirectory;
     if (rememberChoice) {
       const allowSessionId = sessionId ?? response.sessionId;
       await this.allowedToolsProvider.allowTool(toolName, allowSessionId);
@@ -1218,10 +1468,13 @@ let _ToolManager = class _ToolManager {
         `Tool '${toolName}' added to allowed tools for session '${allowSessionId ?? "global"}' (remember choice selected)`
       );
       this.autoApprovePendingToolRequests(toolName, allowSessionId);
-    } else if (rememberPattern && this.agentTools.get(toolName)?.getApprovalPatternKey) {
+    } else if (rememberPattern && this.getToolApprovalPatternKeyFn(toolName)) {
       this.approvalManager.addPattern(toolName, rememberPattern);
       this.logger.info(`Pattern '${rememberPattern}' added for tool '${toolName}' approval`);
       this.autoApprovePendingPatternRequests(toolName, sessionId);
+    } else if (rememberDirectory) {
+      const allowSessionId = sessionId ?? response.sessionId;
+      this.autoApprovePendingDirectoryRequests(toolName, allowSessionId);
     }
   }
   /**