@dexto/core 1.7.2 → 1.8.1

package/dist/tools/tool-manager.cjs

@@ -66,23 +66,31 @@ __export(tool_manager_exports, {
   ToolManager: () => ToolManager
 });
 module.exports = __toCommonJS(tool_manager_exports);
+var import_node_util = require("node:util");
 var import_errors = require("./errors.js");
-var import_error_codes = require("./error-codes.js");
 var import_errors2 = require("../errors/index.js");
 var import_types2 = require("../logger/v2/types.js");
 var import_schema = require("../utils/schema.js");
 var import_types3 = require("../approval/types.js");
+var import_schemas = require("../approval/schemas.js");
+var import_session_tool_policy = require("./approval/session-tool-policy.js");
+var import_tool_presentation = require("./presentation/tool-presentation.js");
 var import_decorators = require("../telemetry/decorators.js");
+var import_types4 = require("../storage/tool-executions/types.js");
 var import_tool_call_metadata = require("./tool-call-metadata.js");
 var import_env = require("../utils/env.js");
 var _ToolManager_decorators, _init;
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
 _ToolManager_decorators = [(0, import_decorators.InstrumentClass)({
   prefix: "tool",
   excludeMethods: ["setHookSupport", "getApprovalManager", "getAllowedToolsProvider"]
 })];
 let _ToolManager = class _ToolManager {
-  constructor(mcpManager, approvalManager, allowedToolsProvider, approvalMode, agentEventBus, toolPolicies, tools, logger, sessionToolPreferencesStore) {
+  constructor(mcpManager, approvalManager, allowedToolsProvider, approvalMode, agentEventBus, toolPolicies, tools, logger, sessionToolPreferencesStore, toolExecutionStore) {
     this.sessionToolPreferencesStore = sessionToolPreferencesStore;
+    this.toolExecutionStore = toolExecutionStore;
     this.mcpManager = mcpManager;
     this.approvalManager = approvalManager;
     this.allowedToolsProvider = allowedToolsProvider;
@@ -90,6 +98,17 @@ let _ToolManager = class _ToolManager {
     this.agentEventBus = agentEventBus;
     this.toolPolicies = toolPolicies;
     this.logger = logger.createChild(import_types2.DextoLogComponent.TOOLS);
+    this.sessionToolPolicy = new import_session_tool_policy.SessionToolPolicy(
+      sessionToolPreferencesStore,
+      this.logger,
+      (pattern) => this.normalizeToolPolicyPattern(pattern)
+    );
+    this.toolPresentation = new import_tool_presentation.ToolPresentation(
+      (toolName) => this.agentTools.get(toolName),
+      (toolName, args) => this.validateLocalToolArgs(toolName, args),
+      (options) => this.buildToolExecutionContext(options),
+      this.logger
+    );
     this.setTools(tools);
     this.toolExecutionContextFactory = () => {
       throw import_errors.ToolError.configInvalid(
@@ -124,16 +143,8 @@ let _ToolManager = class _ToolManager {
   toolsCache = {};
   cacheValid = false;
   logger;
-  // Session-level auto-approve tools for skills
-  // When a skill with allowedTools is invoked, those tools are auto-approved (skip confirmation)
-  // This is ADDITIVE - other tools are NOT blocked, they just go through normal approval flow
-  sessionAutoApproveTools = /* @__PURE__ */ new Map();
-  // Session-level auto-approve tools set by users (UI)
-  sessionUserAutoApproveTools = /* @__PURE__ */ new Map();
-  sessionDisabledTools = /* @__PURE__ */ new Map();
-  restoredSessionPreferences = /* @__PURE__ */ new Set();
-  sessionPreferenceLocks = /* @__PURE__ */ new Map();
-  globalDisabledTools = [];
+  sessionToolPolicy;
+  toolPresentation;
   cleanupHandlers = /* @__PURE__ */ new Set();
   cleanupStarted = false;
   resolveLocalToolIdOrAlias(name) {
@@ -156,76 +167,14 @@ let _ToolManager = class _ToolManager {
     }
     return this.resolveLocalToolIdOrAlias(pattern) ?? pattern;
   }
-  async runWithSessionPreferenceLock(sessionId, fn) {
-    const previousLock = this.sessionPreferenceLocks.get(sessionId) ?? Promise.resolve();
-    const currentResult = previousLock.catch(() => {
-    }).then(() => fn());
-    const currentLock = currentResult.then(
-      () => void 0,
-      () => void 0
-    );
-    this.sessionPreferenceLocks.set(sessionId, currentLock);
-    try {
-      return await currentResult;
-    } finally {
-      if (this.sessionPreferenceLocks.get(sessionId) === currentLock) {
-        this.sessionPreferenceLocks.delete(sessionId);
-      }
-    }
-  }
-  applySessionToolPreferences(sessionId, preferences) {
-    if (preferences.userAutoApproveTools.length > 0) {
-      this.sessionUserAutoApproveTools.set(sessionId, [...preferences.userAutoApproveTools]);
-    } else {
-      this.sessionUserAutoApproveTools.delete(sessionId);
-    }
-    if (preferences.disabledTools.length > 0) {
-      this.sessionDisabledTools.set(sessionId, [...preferences.disabledTools]);
-    } else {
-      this.sessionDisabledTools.delete(sessionId);
-    }
-  }
-  getSessionToolPreferencesSnapshot(sessionId) {
-    return {
-      userAutoApproveTools: [...this.sessionUserAutoApproveTools.get(sessionId) ?? []],
-      disabledTools: [...this.sessionDisabledTools.get(sessionId) ?? []]
-    };
-  }
   async restoreSessionState(sessionId) {
-    if (this.restoredSessionPreferences.has(sessionId)) {
-      return;
-    }
-    await this.runWithSessionPreferenceLock(sessionId, async () => {
-      if (this.restoredSessionPreferences.has(sessionId)) {
-        return;
-      }
-      const preferences = await this.sessionToolPreferencesStore.load(sessionId);
-      this.applySessionToolPreferences(sessionId, preferences);
-      this.restoredSessionPreferences.add(sessionId);
-      this.logger.debug("Restored persisted session tool preferences", {
-        sessionId,
-        autoApproveCount: preferences.userAutoApproveTools.length,
-        disabledCount: preferences.disabledTools.length
-      });
-    });
+    await this.sessionToolPolicy.restoreSessionState(sessionId);
   }
   evictSessionState(sessionId) {
-    this.sessionAutoApproveTools.delete(sessionId);
-    this.sessionUserAutoApproveTools.delete(sessionId);
-    this.sessionDisabledTools.delete(sessionId);
-    this.restoredSessionPreferences.delete(sessionId);
+    this.sessionToolPolicy.evictSessionState(sessionId);
   }
   async deleteSessionState(sessionId) {
-    await this.runWithSessionPreferenceLock(sessionId, async () => {
-      this.evictSessionState(sessionId);
-      await this.sessionToolPreferencesStore.delete(sessionId);
-    });
-  }
-  async persistSessionToolPreferences(sessionId) {
-    await this.sessionToolPreferencesStore.save(
-      sessionId,
-      this.getSessionToolPreferencesSnapshot(sessionId)
-    );
+    await this.sessionToolPolicy.deleteSessionState(sessionId);
   }
   /**
    * Initialize the ToolManager and its components
@@ -328,25 +277,14 @@ let _ToolManager = class _ToolManager {
   // ============= SESSION AUTO-APPROVE TOOLS =============
   /**
    * Set session-level auto-approve tools.
-   * When set, these tools will skip confirmation prompts for this session.
+   * When set, these tools will skip approval prompts for this session.
    * This is ADDITIVE - other tools are NOT blocked, they just go through normal approval flow.
    *
    * @param sessionId The session ID
    * @param autoApproveTools Array of tool names to auto-approve (e.g., ['bash_exec', 'mcp--read_file'])
    */
   setSessionAutoApproveTools(sessionId, autoApproveTools) {
-    if (autoApproveTools.length === 0) {
-      this.clearSessionAutoApproveTools(sessionId);
-      return;
-    }
-    const normalized = autoApproveTools.map(
-      (pattern) => this.normalizeToolPolicyPattern(pattern)
-    );
-    this.sessionAutoApproveTools.set(sessionId, normalized);
-    this.logger.info(
-      `Session auto-approve tools set for '${sessionId}': ${autoApproveTools.length} tools`
-    );
-    this.logger.debug(`Auto-approve tools: ${normalized.join(", ")}`);
+    this.sessionToolPolicy.setSessionAutoApproveTools(sessionId, autoApproveTools);
   }
   /**
    * Add session-level auto-approve tools.
@@ -356,64 +294,19 @@ let _ToolManager = class _ToolManager {
    * @param autoApproveTools Array of tool names to auto-approve (e.g., ['bash_exec', 'mcp--read_file'])
    */
   addSessionAutoApproveTools(sessionId, autoApproveTools) {
-    if (autoApproveTools.length === 0) {
-      return;
-    }
-    const normalized = autoApproveTools.map(
-      (pattern) => this.normalizeToolPolicyPattern(pattern)
-    );
-    const existing = this.sessionAutoApproveTools.get(sessionId) ?? [];
-    const merged = [...existing];
-    const seen = new Set(existing);
-    for (const toolName of normalized) {
-      if (seen.has(toolName)) {
-        continue;
-      }
-      merged.push(toolName);
-      seen.add(toolName);
-    }
-    const actuallyAdded = Math.max(0, merged.length - existing.length);
-    this.sessionAutoApproveTools.set(sessionId, merged);
-    this.logger.info(
-      `Session auto-approve tools updated for '${sessionId}': +${actuallyAdded} tools`
-    );
-    this.logger.debug(`Auto-approve tools: ${merged.join(", ")}`);
+    this.sessionToolPolicy.addSessionAutoApproveTools(sessionId, autoApproveTools);
   }
   /**
    * Set session-level auto-approve tools chosen by the user.
    */
   async setSessionUserAutoApproveTools(sessionId, autoApproveTools) {
-    await this.restoreSessionState(sessionId);
-    if (autoApproveTools.length === 0) {
-      await this.clearSessionUserAutoApproveTools(sessionId);
-      return;
-    }
-    const normalized = autoApproveTools.map(
-      (pattern) => this.normalizeToolPolicyPattern(pattern)
-    );
-    await this.runWithSessionPreferenceLock(sessionId, async () => {
-      this.sessionUserAutoApproveTools.set(sessionId, normalized);
-      await this.persistSessionToolPreferences(sessionId);
-    });
-    this.logger.info(
-      `Session user auto-approve tools set for '${sessionId}': ${autoApproveTools.length} tools`
-    );
-    this.logger.debug(`User auto-approve tools: ${normalized.join(", ")}`);
+    await this.sessionToolPolicy.setSessionUserAutoApproveTools(sessionId, autoApproveTools);
   }
   /**
    * Clear session-level auto-approve tools chosen by the user.
    */
   async clearSessionUserAutoApproveTools(sessionId) {
-    await this.restoreSessionState(sessionId);
-    let hadAutoApprove = false;
-    await this.runWithSessionPreferenceLock(sessionId, async () => {
-      hadAutoApprove = this.sessionUserAutoApproveTools.has(sessionId);
-      this.sessionUserAutoApproveTools.delete(sessionId);
-      await this.persistSessionToolPreferences(sessionId);
-    });
-    if (hadAutoApprove) {
-      this.logger.info(`Session user auto-approve tools cleared for '${sessionId}'`);
-    }
+    await this.sessionToolPolicy.clearSessionUserAutoApproveTools(sessionId);
   }
   /**
    * Clear session-level auto-approve tools.
@@ -422,49 +315,30 @@ let _ToolManager = class _ToolManager {
    * @param sessionId The session ID to clear auto-approve tools for
    */
   clearSessionAutoApproveTools(sessionId) {
-    const hadAutoApprove = this.sessionAutoApproveTools.has(sessionId);
-    this.sessionAutoApproveTools.delete(sessionId);
-    if (hadAutoApprove) {
-      this.logger.info(`Session auto-approve tools cleared for '${sessionId}'`);
-    }
+    this.sessionToolPolicy.clearSessionAutoApproveTools(sessionId);
   }
   hasSessionUserAutoApproveTools(sessionId) {
-    return this.sessionUserAutoApproveTools.has(sessionId);
+    return this.sessionToolPolicy.hasSessionUserAutoApproveTools(sessionId);
   }
   // ============= ENABLED/DISABLED TOOLS =============
   /**
    * Set global disabled tools (agent-level preferences).
    */
   setGlobalDisabledTools(toolNames) {
-    this.globalDisabledTools = [...toolNames];
-    this.logger.info("Global disabled tools updated", {
-      count: toolNames.length
-    });
+    this.sessionToolPolicy.setGlobalDisabledTools(toolNames);
     this.agentEventBus.emit("tools:enabled-updated", {
       scope: "global",
-      disabledTools: [...this.globalDisabledTools]
+      disabledTools: this.sessionToolPolicy.getGlobalDisabledTools()
     });
   }
   getGlobalDisabledTools() {
-    return [...this.globalDisabledTools];
+    return this.sessionToolPolicy.getGlobalDisabledTools();
   }
   /**
    * Set session-level disabled tools (overrides global list).
    */
   async setSessionDisabledTools(sessionId, toolNames) {
-    await this.restoreSessionState(sessionId);
-    if (toolNames.length === 0) {
-      await this.clearSessionDisabledTools(sessionId);
-      return;
-    }
-    await this.runWithSessionPreferenceLock(sessionId, async () => {
-      this.sessionDisabledTools.set(sessionId, [...toolNames]);
-      await this.persistSessionToolPreferences(sessionId);
-    });
-    this.logger.info("Session disabled tools updated", {
-      sessionId,
-      count: toolNames.length
-    });
+    await this.sessionToolPolicy.setSessionDisabledTools(sessionId, toolNames);
     this.agentEventBus.emit("tools:enabled-updated", {
       scope: "session",
       sessionId,
@@ -475,37 +349,19 @@ let _ToolManager = class _ToolManager {
    * Clear session-level disabled tools.
    */
   async clearSessionDisabledTools(sessionId) {
-    await this.restoreSessionState(sessionId);
-    let hadOverrides = false;
-    await this.runWithSessionPreferenceLock(sessionId, async () => {
-      hadOverrides = this.sessionDisabledTools.has(sessionId);
-      this.sessionDisabledTools.delete(sessionId);
-      await this.persistSessionToolPreferences(sessionId);
-    });
-    if (hadOverrides) {
-      this.logger.info("Session disabled tools cleared", { sessionId });
-    }
+    await this.sessionToolPolicy.clearSessionDisabledTools(sessionId);
   }
   /**
    * Get disabled tools for a session (session override wins).
    */
   getDisabledTools(sessionId) {
-    if (sessionId && this.sessionDisabledTools.has(sessionId)) {
-      return this.sessionDisabledTools.get(sessionId) ?? [];
-    }
-    return this.globalDisabledTools;
+    return this.sessionToolPolicy.getDisabledTools(sessionId);
   }
   /**
    * Filter a tool set based on disabled tools for a session.
    */
   filterToolsForSession(toolSet, sessionId) {
-    const disabled = new Set(this.getDisabledTools(sessionId));
-    if (disabled.size === 0) {
-      return toolSet;
-    }
-    return Object.fromEntries(
-      Object.entries(toolSet).filter(([toolName]) => !disabled.has(toolName))
-    );
+    return this.sessionToolPolicy.filterToolsForSession(toolSet, sessionId);
   }
   /**
    * Check if a session has auto-approve tools set.
@@ -514,7 +370,7 @@ let _ToolManager = class _ToolManager {
    * @returns true if the session has auto-approve tools
    */
   hasSessionAutoApproveTools(sessionId) {
-    return this.sessionAutoApproveTools.has(sessionId);
+    return this.sessionToolPolicy.hasSessionAutoApproveTools(sessionId);
   }
   /**
    * Get the auto-approve tools for a session (skill-provided list).
@@ -523,22 +379,19 @@ let _ToolManager = class _ToolManager {
    * @returns Array of auto-approve tool names, or undefined if none set
    */
   getSessionAutoApproveTools(sessionId) {
-    return this.sessionAutoApproveTools.get(sessionId);
+    return this.sessionToolPolicy.getSessionAutoApproveTools(sessionId);
   }
   /**
    * Get the user auto-approve tools for a session.
    */
   getSessionUserAutoApproveTools(sessionId) {
-    return this.sessionUserAutoApproveTools.get(sessionId);
+    return this.sessionToolPolicy.getSessionUserAutoApproveTools(sessionId);
   }
   /**
    * Combined auto-approve list for a session.
    */
   getCombinedSessionAutoApproveTools(sessionId) {
-    return [
-      ...this.sessionAutoApproveTools.get(sessionId) ?? [],
-      ...this.sessionUserAutoApproveTools.get(sessionId) ?? []
-    ];
+    return this.sessionToolPolicy.getCombinedSessionAutoApproveTools(sessionId);
   }
   /**
    * Check if a tool should be auto-approved for a session.
@@ -549,11 +402,7 @@ let _ToolManager = class _ToolManager {
    * @returns true if the tool should be auto-approved
    */
   isToolAutoApprovedForSession(sessionId, toolName) {
-    const autoApproveTools = this.getCombinedSessionAutoApproveTools(sessionId);
-    if (autoApproveTools.length === 0) {
-      return false;
-    }
-    return autoApproveTools.some((pattern) => this.matchesToolPolicy(toolName, pattern));
+    return this.sessionToolPolicy.isToolAutoApprovedForSession(sessionId, toolName);
   }
   /**
    * Invalidate the tools cache when tool sources change
@@ -631,149 +480,6 @@ let _ToolManager = class _ToolManager {
     const tool = this.agentTools.get(toolName);
     return tool?.approval?.onGranted;
   }
-  getToolPreviewFn(toolName) {
-    const tool = this.agentTools.get(toolName);
-    return tool?.presentation?.preview;
-  }
-  getToolDescribeHeaderFn(toolName) {
-    const tool = this.agentTools.get(toolName);
-    return tool?.presentation?.describeHeader;
-  }
-  getToolDescribeArgsFn(toolName) {
-    const tool = this.agentTools.get(toolName);
-    return tool?.presentation?.describeArgs;
-  }
-  getToolDescribeResultFn(toolName) {
-    const tool = this.agentTools.get(toolName);
-    return tool?.presentation?.describeResult;
-  }
-  buildGenericToolPresentationSnapshot(toolName) {
-    const toTitleCase = (name) => name.replace(/[_-]+/g, " ").split(" ").filter(Boolean).map((part) => part.charAt(0).toUpperCase() + part.slice(1)).join(" ");
-    const isMcp = toolName.startsWith(_ToolManager.MCP_TOOL_PREFIX);
-    const fallbackTitle = (() => {
-      if (!isMcp) {
-        return toTitleCase(toolName);
-      }
-      const actualToolName = toolName.substring(_ToolManager.MCP_TOOL_PREFIX.length);
-      const parts = actualToolName.split("--");
-      const toolPart = parts.length >= 2 ? parts.slice(1).join("--") : actualToolName;
-      return toTitleCase(toolPart);
-    })();
-    const snapshot = {
-      version: 1,
-      source: {
-        type: toolName.startsWith(_ToolManager.MCP_TOOL_PREFIX) ? "mcp" : "local"
-      },
-      header: {
-        title: fallbackTitle
-      }
-    };
-    if (snapshot.source?.type === "mcp") {
-      const actualToolName = toolName.substring(_ToolManager.MCP_TOOL_PREFIX.length);
-      const parts = actualToolName.split("--");
-      if (parts.length >= 2 && parts[0]) {
-        snapshot.source.mcpServerName = parts[0];
-      }
-    }
-    return snapshot;
-  }
-  getToolPresentationSnapshotForToolCallEvent(toolName, args, toolCallId, sessionId, runContext) {
-    const fallback = this.buildGenericToolPresentationSnapshot(toolName);
-    if (toolName.startsWith(_ToolManager.MCP_TOOL_PREFIX)) {
-      return fallback;
-    }
-    const describeHeader = this.getToolDescribeHeaderFn(toolName);
-    const describeArgs = this.getToolDescribeArgsFn(toolName);
-    if (!describeHeader && !describeArgs) {
-      return fallback;
-    }
-    try {
-      const validatedArgs = this.validateLocalToolArgs(toolName, args);
-      const context = this.buildToolExecutionContext({ sessionId, toolCallId, runContext });
-      const isPromiseLike = (value) => {
-        if (typeof value !== "object" || value === null) {
-          return false;
-        }
-        return typeof value.then === "function";
-      };
-      let nextSnapshot = fallback;
-      if (describeHeader) {
-        const header = describeHeader(validatedArgs, context);
-        if (!isPromiseLike(header) && header) {
-          nextSnapshot = {
-            ...nextSnapshot,
-            header: { ...nextSnapshot.header, ...header }
-          };
-        }
-      }
-      if (describeArgs) {
-        const argsPresentation = describeArgs(validatedArgs, context);
-        if (!isPromiseLike(argsPresentation) && argsPresentation) {
-          nextSnapshot = {
-            ...nextSnapshot,
-            args: argsPresentation
-          };
-        }
-      }
-      return nextSnapshot;
-    } catch (error) {
-      this.logger.debug(
-        `Tool presentation snapshot generation failed for '${toolName}': ${error instanceof Error ? error.message : String(error)}`
-      );
-      return fallback;
-    }
-  }
-  async getToolPresentationSnapshotForCall(toolName, args, toolCallId, sessionId, runContext) {
-    const fallback = this.buildGenericToolPresentationSnapshot(toolName);
-    if (toolName.startsWith(_ToolManager.MCP_TOOL_PREFIX)) {
-      return fallback;
-    }
-    const describeHeader = this.getToolDescribeHeaderFn(toolName);
-    const describeArgs = this.getToolDescribeArgsFn(toolName);
-    if (!describeHeader && !describeArgs) {
-      return fallback;
-    }
-    try {
-      const context = this.buildToolExecutionContext({ sessionId, toolCallId, runContext });
-      const describedHeader = describeHeader ? await Promise.resolve(describeHeader(args, context)) : null;
-      const describedArgs = describeArgs ? await Promise.resolve(describeArgs(args, context)) : null;
-      return {
-        ...fallback,
-        ...describedHeader ? { header: { ...fallback.header, ...describedHeader } } : {},
-        ...describedArgs ? { args: describedArgs } : {}
-      };
-    } catch (error) {
-      this.logger.debug(
-        `Tool presentation snapshot generation failed for '${toolName}': ${error instanceof Error ? error.message : String(error)}`
-      );
-      return fallback;
-    }
-  }
-  async augmentSnapshotWithResult(toolName, snapshot, result, args, toolCallId, sessionId, runContext) {
-    if (toolName.startsWith(_ToolManager.MCP_TOOL_PREFIX)) {
-      return snapshot;
-    }
-    const describeResult = this.getToolDescribeResultFn(toolName);
-    if (!describeResult) {
-      return snapshot;
-    }
-    try {
-      const context = this.buildToolExecutionContext({ sessionId, toolCallId, runContext });
-      const resultPresentation = await Promise.resolve(describeResult(result, args, context));
-      if (!resultPresentation) {
-        return snapshot;
-      }
-      return {
-        ...snapshot,
-        result: resultPresentation
-      };
-    } catch (error) {
-      this.logger.debug(
-        `Tool result presentation snapshot generation failed for '${toolName}': ${error instanceof Error ? error.message : String(error)}`
-      );
-      return snapshot;
-    }
-  }
   getToolPatternKey(toolName, args) {
     if (toolName.startsWith(_ToolManager.MCP_TOOL_PREFIX)) {
       return null;
@@ -866,14 +572,9 @@ let _ToolManager = class _ToolManager {
         if (request.metadata.directoryAccess !== void 0) {
           return false;
         }
-        const args = request.metadata.args;
-        if (typeof args !== "object" || args === null) {
-          return false;
-        }
-        const argsRecord = args;
         let patternKey;
         try {
-          patternKey = getPatternKey(argsRecord);
+          patternKey = getPatternKey(request.metadata.args);
         } catch (error) {
           this.logger.debug(
             `Pattern key generation failed for '${toolName}': ${error instanceof Error ? error.message : String(error)}`
@@ -1002,22 +703,52 @@ let _ToolManager = class _ToolManager {
     };
     return this.toolExecutionContextFactory(baseContext);
   }
-  resolveToolExecutionInvocation(invocationOrSessionId, legacyAbortSignal) {
-    if (typeof invocationOrSessionId === "string") {
-      return {
-        sessionId: invocationOrSessionId,
-        abortSignal: legacyAbortSignal,
-        hostRuntime: void 0
-      };
+  resolveToolExecutionInvocation(invocation) {
+    if (typeof invocation !== "object" && invocation !== void 0) {
+      throw new TypeError("Tool execution invocation must be an object");
+    }
+    const options = invocation ?? {};
+    const sessionId = options.runContext?.sessionId ?? options.sessionId;
+    return { ...options, sessionId, hostRuntime: options.runContext?.hostRuntime };
+  }
+  resolveToolExecutionIdentity(invocation, toolCallId) {
+    if (invocation.executionIdentity !== void 0) {
+      return invocation.executionIdentity;
+    }
+    const ids = invocation.runContext?.hostRuntime?.ids;
+    if (!ids) {
+      return void 0;
+    }
+    const runId = ids.runId;
+    const turnId = ids.turnId;
+    const modelStepId = ids.modelStepId;
+    if (runId === void 0 || turnId === void 0 || modelStepId === void 0) {
+      return void 0;
     }
-    const invocation = invocationOrSessionId ?? {};
-    const sessionId = invocation.runContext?.sessionId ?? invocation.sessionId;
     return {
-      ...invocation,
-      ...invocation.abortSignal === void 0 && legacyAbortSignal !== void 0 ? { abortSignal: legacyAbortSignal } : {},
-      sessionId,
-      hostRuntime: invocation.runContext?.hostRuntime
+      runId,
+      turnId,
+      modelStepId,
+      toolCallId
+    };
+  }
+  assertToolExecutionRecordMatches(input) {
+    const expected = {
+      identity: input.identity,
+      toolName: input.toolName,
+      input: input.toolInput
+    };
+    const actual = {
+      identity: input.record.identity,
+      toolName: input.record.toolName,
+      input: input.record.input
     };
+    if (!(0, import_node_util.isDeepStrictEqual)(actual, expected)) {
+      throw import_errors.ToolError.executionFailed(
+        input.toolName,
+        "Tool execution record does not match the current tool call"
+      );
+    }
   }
   validateLocalToolArgs(toolName, args) {
     if (toolName.startsWith(_ToolManager.MCP_TOOL_PREFIX)) {
@@ -1147,205 +878,782 @@ let _ToolManager = class _ToolManager {
     this.cacheValid = true;
     return this.toolsCache;
   }
-  /**
-   * Execute a tool by routing based on prefix:
-   * - MCP tools: `mcp--...`
-   * - Local tools: `Tool.id`
-   *
-   * @param toolName Tool name (e.g., "edit_file", "mcp--filesystem--read_file")
-   * @param args The arguments for the tool
-   * @param toolCallId The unique tool call ID for tracking (from LLM or generated for direct calls)
-   * @param invocationOrSessionId Optional execution-scoped context for this tool call,
-   * or the legacy positional sessionId
-   * @param legacyAbortSignal Optional legacy positional abort signal
-   */
-  async executeTool(toolName, args, toolCallId, invocationOrSessionId, legacyAbortSignal) {
-    const { sessionId, abortSignal, runContext, hostRuntime } = this.resolveToolExecutionInvocation(invocationOrSessionId, legacyAbortSignal);
-    const { toolArgs: rawToolArgs, meta } = (0, import_tool_call_metadata.extractToolCallMeta)(args);
+  async prepareToolCall(input) {
+    const sessionId = input.runContext?.sessionId ?? input.sessionId;
+    const source = await this.resolveExecutableToolSource(input.toolName);
+    if (source === "unknown") {
+      return this.createPreparedToolError(
+        "unknown-tool",
+        input.toolName,
+        `Tool '${input.toolName}' not found`
+      );
+    }
+    if (!isRecord(input.input)) {
+      return this.createPreparedToolError(
+        "invalid-input",
+        input.toolName,
+        "Invalid arguments: expected an object"
+      );
+    }
+    const { toolArgs: rawToolArgs, meta } = (0, import_tool_call_metadata.extractToolCallMeta)(input.input);
     const eventMeta = Object.keys(meta).length > 0 ? meta : void 0;
-    let toolArgs = rawToolArgs;
     const callDescription = typeof meta.callDescription === "string" ? meta.callDescription : typeof rawToolArgs.description === "string" ? rawToolArgs.description : void 0;
-    const backgroundTasksEnabled = (0, import_env.isBackgroundTasksEnabled)();
-    this.logger.debug(`\u{1F527} Tool execution requested: '${toolName}' (toolCallId: ${toolCallId})`);
-    this.logger.debug(`Tool args: ${JSON.stringify(toolArgs, null, 2)}`);
-    if (sessionId) {
-      const presentationSnapshot = this.getToolPresentationSnapshotForToolCallEvent(
-        toolName,
-        toolArgs,
-        toolCallId,
-        sessionId,
-        runContext
+    let validatedArgs;
+    try {
+      validatedArgs = this.validateLocalToolArgs(input.toolName, rawToolArgs);
+    } catch (error) {
+      return this.createPreparedToolError(
+        "invalid-input",
+        input.toolName,
+        error instanceof Error ? error.message : String(error)
       );
-      this.agentEventBus.emit("llm:tool-call", {
-        toolName,
-        presentationSnapshot,
-        args: toolArgs,
-        ...eventMeta !== void 0 ? { meta: eventMeta } : {},
-        ...callDescription !== void 0 && { callDescription },
-        callId: toolCallId,
-        sessionId,
-        ...hostRuntime !== void 0 && { hostRuntime }
-      });
     }
-    const {
-      requireApproval,
-      approvalStatus,
-      args: validatedToolArgs,
-      presentationSnapshot: callSnapshot
-    } = await this.handleToolApproval(
-      toolName,
-      toolArgs,
-      toolCallId,
+    const presentationSnapshot = await this.toolPresentation.snapshotForCall({
+      toolName: input.toolName,
+      args: validatedArgs,
+      toolCallId: input.toolCallId,
+      ...sessionId !== void 0 ? { sessionId } : {},
+      ...input.runContext !== void 0 ? { runContext: input.runContext } : {}
+    });
+    const call = {
+      input: validatedArgs,
+      presentationSnapshot,
+      source,
+      toolCallId: input.toolCallId,
+      toolName: input.toolName,
+      ...callDescription !== void 0 ? { callDescription } : {},
+      ...eventMeta !== void 0 ? { meta: eventMeta } : {}
+    };
+    const overrideRequest = await this.getToolApprovalOverrideRequest(
+      input.toolName,
+      validatedArgs,
+      input.toolCallId,
       sessionId,
-      runContext,
-      callDescription
-    );
-    toolArgs = validatedToolArgs;
-    this.logger.debug(`\u2705 Tool execution approved: ${toolName}`);
-    this.logger.info(
-      `\u{1F527} Tool execution started for ${toolName}, sessionId: ${sessionId ?? "global"}`
+      input.runContext
     );
-    if (sessionId) {
-      this.agentEventBus.emit("tool:running", {
-        toolName,
-        toolCallId,
+    if (overrideRequest) {
+      if (!overrideRequest.directoryAccess) {
+        return {
+          kind: "approval-required",
+          call,
+          onGrantedRequestDetails: overrideRequest.onGrantedRequestDetails,
+          requestDetails: overrideRequest.requestDetails
+        };
+      }
+      const quickResult2 = await this.classifyQuickApprovalRequirement(
+        input.toolName,
+        validatedArgs,
         sessionId,
-        ...hostRuntime !== void 0 && { hostRuntime }
+        overrideRequest.directoryAccess
+      );
+      if (quickResult2 === "ready") {
+        return { kind: "ready", call };
+      }
+      const displayPreview2 = await this.toolPresentation.preview({
+        toolName: input.toolName,
+        args: validatedArgs,
+        toolCallId: input.toolCallId,
+        ...sessionId !== void 0 ? { sessionId } : {},
+        ...input.runContext !== void 0 ? { runContext: input.runContext } : {}
       });
+      const suggestedPatterns2 = this.getToolSuggestedPatterns(input.toolName, validatedArgs);
+      return {
+        kind: "approval-required",
+        call,
+        onGrantedRequestDetails: overrideRequest.onGrantedRequestDetails,
+        requestDetails: {
+          ...overrideRequest.requestDetails,
+          metadata: {
+            ...overrideRequest.requestDetails.metadata,
+            presentationSnapshot,
+            ...callDescription !== void 0 ? { description: callDescription } : {},
+            ...displayPreview2 !== void 0 ? { displayPreview: displayPreview2 } : {},
+            ...suggestedPatterns2 !== void 0 ? { suggestedPatterns: suggestedPatterns2 } : {}
+          }
+        }
+      };
     }
-    const startTime = Date.now();
-    if (this.hookManager && this.sessionManager && this.stateManager) {
-      const beforePayload = {
-        toolName,
-        args: toolArgs,
-        ...sessionId !== void 0 && { sessionId }
+    const quickResult = await this.classifyQuickApprovalRequirement(
+      input.toolName,
+      validatedArgs,
+      sessionId
+    );
+    if (quickResult === "ready") {
+      return { kind: "ready", call };
+    }
+    const displayPreview = await this.toolPresentation.preview({
+      toolName: input.toolName,
+      args: validatedArgs,
+      toolCallId: input.toolCallId,
+      ...sessionId !== void 0 ? { sessionId } : {},
+      ...input.runContext !== void 0 ? { runContext: input.runContext } : {}
+    });
+    const suggestedPatterns = this.getToolSuggestedPatterns(input.toolName, validatedArgs);
+    const hostRuntime = input.runContext?.hostRuntime;
+    const requestDetails = {
+      type: import_types3.ApprovalType.TOOL_APPROVAL,
+      ...sessionId !== void 0 ? { sessionId } : {},
+      ...hostRuntime !== void 0 ? { hostRuntime } : {},
+      metadata: {
+        toolName: input.toolName,
+        presentationSnapshot,
+        toolCallId: input.toolCallId,
+        args: validatedArgs,
+        ...callDescription !== void 0 ? { description: callDescription } : {},
+        ...displayPreview !== void 0 ? { displayPreview } : {},
+        ...suggestedPatterns !== void 0 ? { suggestedPatterns } : {}
+      }
+    };
+    return {
+      kind: "approval-required",
+      call,
+      onGrantedRequestDetails: requestDetails,
+      requestDetails
+    };
+  }
+  async recordApprovalRequest(prepared, identity) {
+    this.assertOnGrantedRequestMatchesPreparedCall(prepared);
+    const request = await this.approvalManager.recordApprovalRequest(prepared.requestDetails, {
+      ...identity,
+      toolCallId: prepared.call.toolCallId
+    });
+    this.assertRecordedApprovalMatchesPreparedCall(prepared, request);
+    return { prepared, request };
+  }
+  async applyApprovalDecision(recorded, decision, runContext) {
+    if (decision.approvalId !== recorded.request.approvalId) {
+      throw import_errors.ToolError.executionFailed(
+        recorded.prepared.call.toolName,
+        "Approval decision does not match the recorded approval request"
+      );
+    }
+    this.assertOnGrantedRequestMatchesPreparedCall(recorded.prepared);
+    this.assertRecordedApprovalMatchesPreparedCall(recorded.prepared, recorded.request);
+    const record = await this.approvalManager.recordApprovalResponseRecord(
+      decision,
+      recorded.request
+    );
+    if (record.response.status !== import_types3.ApprovalStatus.APPROVED) {
+      return {
+        kind: "terminal",
+        modelVisibleResult: this.createApprovalTerminalResult(
+          recorded.prepared.call,
+          record.response
+        ),
+        response: record.response
       };
-      const modifiedPayload = await this.hookManager.executeHooks(
-        "beforeToolCall",
-        beforePayload,
-        {
-          sessionManager: this.sessionManager,
-          mcpManager: this.mcpManager,
-          toolManager: this,
-          stateManager: this.stateManager,
-          ...runContext !== void 0 && { runContext },
-          ...sessionId !== void 0 && { sessionId }
+    }
+    await this.applyApprovalGrantedEffects(recorded.prepared, record.response, runContext);
+    return {
+      kind: "ready",
+      call: {
+        ...recorded.prepared.call,
+        approval: {
+          requireApproval: true,
+          approvalStatus: "approved"
         }
+      },
+      response: record.response
+    };
+  }
+  async requestApprovalDecision(recorded) {
+    return this.approvalManager.requestApprovalDecision(recorded.request);
+  }
+  assertRecordedApprovalMatchesPreparedCall(prepared, request) {
+    const expected = {
+      type: prepared.requestDetails.type,
+      sessionId: prepared.requestDetails.sessionId,
+      hostRuntime: prepared.requestDetails.hostRuntime,
+      metadata: prepared.requestDetails.metadata
+    };
+    const actual = {
+      type: request.type,
+      sessionId: request.sessionId,
+      hostRuntime: request.hostRuntime,
+      metadata: request.metadata
+    };
+    if (!(0, import_node_util.isDeepStrictEqual)(actual, expected)) {
+      throw import_errors.ToolError.executionFailed(
+        prepared.call.toolName,
+        "Recorded approval request does not match the prepared tool call"
       );
-      toolArgs = modifiedPayload.args;
-      try {
-        toolArgs = this.validateLocalToolArgs(toolName, toolArgs);
-      } catch (error) {
-        this.logger.error(
-          `Post-hook validation failed for tool '${toolName}': a beforeToolCall hook may have set invalid args`
-        );
-        throw error;
-      }
     }
-    try {
-      let result;
-      const registerBackgroundTask = (promise, description) => {
-        const fallbackId = `task-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
-        return {
-          result: {
-            taskId: toolCallId ?? fallbackId,
-            status: "running",
-            description
-          },
-          promise
-        };
+  }
+  assertOnGrantedRequestMatchesPreparedCall(prepared) {
+    const approvalDetails = prepared.requestDetails;
+    const grantedDetails = prepared.onGrantedRequestDetails;
+    const directoryAccess = approvalDetails.type === import_types3.ApprovalType.TOOL_APPROVAL && "directoryAccess" in approvalDetails.metadata ? import_schemas.DirectoryAccessMetadataSchema.parse(approvalDetails.metadata.directoryAccess) : void 0;
+    if (directoryAccess !== void 0) {
+      const expected = {
+        type: import_types3.ApprovalType.DIRECTORY_ACCESS,
+        sessionId: approvalDetails.sessionId,
+        hostRuntime: approvalDetails.hostRuntime,
+        metadata: directoryAccess
       };
-      if (toolName.startsWith(_ToolManager.MCP_TOOL_PREFIX)) {
-        this.logger.debug(`\u{1F527} Detected MCP tool: '${toolName}'`);
-        const actualToolName = toolName.substring(_ToolManager.MCP_TOOL_PREFIX.length);
-        if (actualToolName.length === 0) {
-          throw import_errors.ToolError.invalidName(toolName, "tool name cannot be empty after prefix");
-        }
-        this.logger.debug(`\u{1F3AF} MCP routing: '${toolName}' -> '${actualToolName}'`);
-        const runInBackground = backgroundTasksEnabled && meta.runInBackground === true && sessionId !== void 0;
-        const executeMcpTool = () => runContext === void 0 ? this.mcpManager.executeTool(actualToolName, toolArgs, sessionId) : this.mcpManager.executeTool(
-          actualToolName,
-          toolArgs,
-          sessionId,
-          runContext
+      const actual = {
+        type: grantedDetails.type,
+        sessionId: grantedDetails.sessionId,
+        hostRuntime: grantedDetails.hostRuntime,
+        metadata: grantedDetails.metadata
+      };
+      if (!(0, import_node_util.isDeepStrictEqual)(actual, expected)) {
+        throw import_errors.ToolError.executionFailed(
+          prepared.call.toolName,
+          "Approval granted-effects request does not match the prepared tool call"
         );
-        if (meta.runInBackground === true && !backgroundTasksEnabled) {
-          this.logger.debug(
-            "Background tool execution disabled; running synchronously instead.",
-            { toolName }
-          );
-        }
-        if (runInBackground) {
-          const backgroundSessionId = sessionId;
-          const { result: backgroundResult, promise } = registerBackgroundTask(
-            executeMcpTool(),
-            `MCP tool ${actualToolName}`
-          );
-          this.agentEventBus.emit("tool:background", {
-            toolName,
-            toolCallId: backgroundResult.taskId,
-            sessionId: backgroundSessionId,
-            description: backgroundResult.description,
-            promise,
-            ...hostRuntime !== void 0 && { hostRuntime },
-            ...meta.timeoutMs !== void 0 && { timeoutMs: meta.timeoutMs },
-            ...meta.notifyOnComplete !== void 0 && {
-              notifyOnComplete: meta.notifyOnComplete
-            }
-          });
-          result = backgroundResult;
-        } else {
-          result = await executeMcpTool();
-        }
-      } else {
-        const runInBackground = backgroundTasksEnabled && meta.runInBackground === true && sessionId !== void 0;
-        if (meta.runInBackground === true && !backgroundTasksEnabled) {
-          this.logger.debug(
-            "Background tool execution disabled; running synchronously instead.",
-            { toolName }
-          );
-        }
-        if (runInBackground) {
-          const backgroundSessionId = sessionId;
-          const { result: backgroundResult, promise } = registerBackgroundTask(
-            this.executeLocalTool(toolName, toolArgs, {
-              sessionId: backgroundSessionId,
-              abortSignal,
-              toolCallId,
+      }
+      return;
+    }
+    if (!(0, import_node_util.isDeepStrictEqual)(grantedDetails, approvalDetails)) {
+      throw import_errors.ToolError.executionFailed(
+        prepared.call.toolName,
+        "Approval granted-effects request does not match the prepared tool call"
+      );
+    }
+  }
+  async applyApprovalGrantedEffects(prepared, response, runContext) {
+    const requestDetails = prepared.onGrantedRequestDetails;
+    const approvalRequestDetails = prepared.requestDetails;
+    const sessionId = approvalRequestDetails.sessionId;
+    const onGranted = this.getToolApprovalOnGrantedFn(prepared.call.toolName);
+    if (onGranted) {
+      const context = this.buildToolExecutionContext({
+        sessionId,
+        toolCallId: prepared.call.toolCallId,
+        runContext
+      });
+      await Promise.resolve(onGranted(response, context, requestDetails));
+    }
+    if (approvalRequestDetails.type === import_types3.ApprovalType.TOOL_APPROVAL && response.data) {
+      await this.handleRememberChoice(
+        prepared.call.toolName,
+        {
+          data: import_schemas.ToolApprovalResponseDataSchema.parse(response.data),
+          ...response.sessionId !== void 0 ? { sessionId: response.sessionId } : {}
+        },
+        sessionId
+      );
+    }
+  }
+  createApprovalTerminalResult(call, response) {
+    return {
+      result: {
+        error: this.formatApprovalTerminalMessage(call.toolName, response)
+      },
+      presentationSnapshot: call.presentationSnapshot,
+      ...call.meta !== void 0 ? { meta: call.meta } : {},
+      requireApproval: true,
+      approvalStatus: "rejected"
+    };
+  }
+  formatApprovalTerminalMessage(toolName, response) {
+    if (response.status === import_types3.ApprovalStatus.CANCELLED && response.reason === import_types3.DenialReason.TIMEOUT) {
+      return `Tool '${toolName}' was not executed because approval timed out${response.timeoutMs !== void 0 ? ` after ${response.timeoutMs}ms` : ""}.`;
+    }
+    const outcome = response.status === import_types3.ApprovalStatus.DENIED ? "approval was denied" : "approval was cancelled";
+    return `Tool '${toolName}' was not executed because ${outcome}${response.message ? `: ${response.message}` : ""}.`;
+  }
+  async resolveExecutableToolSource(toolName) {
+    if (this.agentTools.has(toolName)) {
+      return "local";
+    }
+    if (toolName.startsWith(_ToolManager.MCP_TOOL_PREFIX) && toolName.length > _ToolManager.MCP_TOOL_PREFIX.length) {
+      return "mcp";
+    }
+    return "unknown";
+  }
+  createPreparedToolError(kind, toolName, error) {
+    return {
+      kind: "terminal",
+      reason: kind,
+      modelVisibleResult: {
+        result: { error },
+        presentationSnapshot: this.toolPresentation.buildGenericSnapshot(toolName)
+      }
+    };
+  }
+  createPreparedToolTerminal(reason, toolName, call) {
+    return {
+      kind: "terminal",
+      reason,
+      call,
+      modelVisibleResult: {
+        result: {
+          error: `Tool '${toolName}' was not executed because policy denied it.`
+        },
+        presentationSnapshot: call.presentationSnapshot,
+        ...call.meta !== void 0 ? { meta: call.meta } : {}
+      }
+    };
+  }
+  async getToolApprovalOverrideRequest(toolName, args, toolCallId, sessionId, runContext) {
+    if (toolName.startsWith(_ToolManager.MCP_TOOL_PREFIX)) {
+      return null;
+    }
+    const getApprovalOverride = this.getToolApprovalOverrideFn(toolName);
+    if (!getApprovalOverride) {
+      return null;
+    }
+    const context = this.buildToolExecutionContext({ sessionId, toolCallId, runContext });
+    const approvalRequest = await getApprovalOverride(args, context);
+    if (!approvalRequest) {
+      return null;
+    }
+    const requestDetails = {
+      ...approvalRequest,
+      ...sessionId && !approvalRequest.sessionId ? { sessionId } : {},
+      ...runContext?.hostRuntime !== void 0 && approvalRequest.hostRuntime === void 0 ? { hostRuntime: runContext.hostRuntime } : {}
+    };
+    if (requestDetails.type !== import_types3.ApprovalType.DIRECTORY_ACCESS) {
+      return { requestDetails, onGrantedRequestDetails: requestDetails };
+    }
+    const parseResult = import_schemas.DirectoryAccessMetadataSchema.safeParse(requestDetails.metadata);
+    if (!parseResult.success) {
+      throw import_errors.ToolError.configInvalid(
+        `Tool '${toolName}' returned invalid directory access metadata`
+      );
+    }
+    const directoryAccess = parseResult.data;
+    return {
+      directoryAccess,
+      onGrantedRequestDetails: requestDetails,
+      requestDetails: {
+        type: import_types3.ApprovalType.TOOL_APPROVAL,
+        ...requestDetails.sessionId !== void 0 ? { sessionId: requestDetails.sessionId } : {},
+        ...requestDetails.hostRuntime !== void 0 ? { hostRuntime: requestDetails.hostRuntime } : {},
+        metadata: {
+          toolName,
+          toolCallId,
+          args,
+          directoryAccess
+        }
+      }
+    };
+  }
+  async classifyQuickApprovalRequirement(toolName, args, sessionId, directoryAccess) {
+    if (directoryAccess) {
+      return this.approvalMode === "auto-approve" ? "ready" : "approval-required";
+    }
+    if (sessionId && this.isToolAutoApprovedForSession(sessionId, toolName)) {
+      return "ready";
+    }
+    if (this.isInAlwaysAllowList(toolName)) {
+      return "ready";
+    }
+    if (await this.allowedToolsProvider.isToolAllowed(toolName, sessionId)) {
+      return "ready";
+    }
+    const patternKey = this.getToolPatternKey(toolName, args);
+    if (patternKey && this.approvalManager.matchesPattern(toolName, patternKey, sessionId)) {
+      return "ready";
+    }
+    if (this.approvalMode === "auto-approve") {
+      return "ready";
+    }
+    return "approval-required";
+  }
+  async executeTool(toolName, args, toolCallId, invocation) {
+    const { sessionId, runContext, hostRuntime } = this.resolveToolExecutionInvocation(invocation);
+    this.logger.debug(`\u{1F527} Tool execution requested: '${toolName}' (toolCallId: ${toolCallId})`);
+    this.logger.debug(`Tool args: ${JSON.stringify(args, null, 2)}`);
+    if (toolName === _ToolManager.MCP_TOOL_PREFIX) {
+      throw import_errors.ToolError.invalidName(toolName, "tool name cannot be empty after prefix");
+    }
+    const prepared = await this.prepareToolCall({
+      toolName,
+      input: args,
+      toolCallId,
+      ...sessionId !== void 0 ? { sessionId } : {},
+      ...runContext !== void 0 ? { runContext } : {}
+    });
+    if (prepared.kind === "terminal") {
+      this.throwPreparedTerminalResult(toolName, prepared, sessionId);
+    }
+    this.emitPreparedToolCallEvent(prepared.call, sessionId, runContext, hostRuntime);
+    const replayed = await this.replayExistingDirectToolExecution(prepared.call, invocation);
+    if (replayed !== void 0) {
+      return replayed;
+    }
+    if (prepared.kind === "ready") {
+      return this.executePreparedToolCall(prepared.call, invocation, { throwOnError: true });
+    }
+    let applied;
+    try {
+      const recorded = await this.recordApprovalRequest(
+        prepared,
+        this.resolveDirectApprovalIdentity(invocation, toolCallId)
+      );
+      const response = await this.requestApprovalDecision(recorded);
+      applied = await this.applyApprovalDecision(
+        recorded,
+        {
+          approvalId: response.approvalId,
+          status: response.status,
+          ...response.reason !== void 0 ? { reason: response.reason } : {},
+          ...response.message !== void 0 ? { message: response.message } : {},
+          ...response.data !== void 0 ? { data: response.data } : {}
+        },
+        runContext
+      );
+    } catch (error) {
+      await this.recordDirectToolExecutionFailure(prepared.call, invocation, error);
+      throw error;
+    }
+    if (applied.kind === "terminal") {
+      try {
+        this.handleApprovalDenied(toolName, applied.response, sessionId);
+      } catch (error) {
+        await this.recordDirectToolExecutionFailure(prepared.call, invocation, error);
+        throw error;
+      }
+    }
+    return this.executePreparedToolCall(applied.call, invocation, { throwOnError: true });
+  }
+  emitPreparedToolCallEvent(call, sessionId, runContext, hostRuntime) {
+    if (!sessionId) {
+      return;
+    }
+    this.agentEventBus.emit("llm:tool-call", {
+      toolName: call.toolName,
+      presentationSnapshot: this.toolPresentation.snapshotForToolCallEvent({
+        toolName: call.toolName,
+        args: call.input,
+        toolCallId: call.toolCallId,
+        sessionId,
+        ...runContext !== void 0 ? { runContext } : {}
+      }),
+      args: call.input,
+      ...call.meta !== void 0 ? { meta: call.meta } : {},
+      ...call.callDescription !== void 0 ? { callDescription: call.callDescription } : {},
+      callId: call.toolCallId,
+      sessionId,
+      ...hostRuntime !== void 0 && { hostRuntime }
+    });
+  }
+  async replayExistingDirectToolExecution(call, invocation) {
+    const { sessionId } = this.resolveToolExecutionInvocation(invocation);
+    if ((0, import_env.isBackgroundTasksEnabled)() && call.meta?.runInBackground === true && sessionId !== void 0) {
+      return void 0;
+    }
+    const identity = this.resolveToolExecutionIdentity(invocation ?? {}, call.toolCallId);
+    if (identity === void 0) {
+      return void 0;
+    }
+    const executionId = (0, import_types4.createToolExecutionId)(identity);
+    const record = await this.toolExecutionStore.get({ executionId });
+    if (record === void 0) {
+      return void 0;
+    }
+    this.assertToolExecutionRecordMatches({
+      record,
+      identity,
+      toolName: call.toolName,
+      toolInput: call.input
+    });
+    if (record.status === "completed") {
+      this.logger.info("Replaying completed direct tool execution result", {
+        executionId,
+        toolName: call.toolName
+      });
+      return (0, import_types4.completedToolExecutionToResult)(record);
+    }
+    if (record.status === "failed") {
+      throw import_errors.ToolError.executionFailed(
+        call.toolName,
+        `Tool execution already failed: ${executionId}`
+      );
+    }
+    throw import_errors.ToolError.executionFailed(
+      call.toolName,
+      `Tool execution already ${record.status}: ${executionId}`
+    );
+  }
+  async recordDirectToolExecutionFailure(call, invocation, error) {
+    const identity = this.resolveToolExecutionIdentity(invocation ?? {}, call.toolCallId);
+    if (identity === void 0) {
+      return;
+    }
+    const executionId = (0, import_types4.createToolExecutionId)(identity);
+    const started = await this.toolExecutionStore.start({
+      record: {
+        executionId,
+        identity,
+        input: call.input,
+        toolName: call.toolName,
+        status: "running",
+        startedAt: /* @__PURE__ */ new Date(),
+        updatedAt: /* @__PURE__ */ new Date()
+      }
+    });
+    if (started.status === "existing") {
+      this.assertToolExecutionRecordMatches({
+        record: started.record,
+        identity,
+        toolName: call.toolName,
+        toolInput: call.input
+      });
+      if (started.record.status !== "running") {
+        return;
+      }
+    }
+    await this.toolExecutionStore.fail({
+      executionId,
+      completedAt: /* @__PURE__ */ new Date(),
+      error: error instanceof Error ? error.message : String(error)
+    });
+  }
+  resolveDirectApprovalIdentity(invocation, toolCallId) {
+    const executionIdentity = this.resolveToolExecutionIdentity(invocation ?? {}, toolCallId);
+    if (executionIdentity !== void 0) {
+      return {
+        runId: executionIdentity.runId,
+        turnId: executionIdentity.turnId,
+        modelStepId: executionIdentity.modelStepId
+      };
+    }
+    const ids = invocation?.runContext?.hostRuntime?.ids;
+    const runId = ids?.runId;
+    const turnId = ids?.turnId;
+    const modelStepId = ids?.modelStepId;
+    if (runId !== void 0 && turnId !== void 0 && modelStepId !== void 0) {
+      return { runId, turnId, modelStepId };
+    }
+    return {
+      runId: invocation?.sessionId ?? invocation?.runContext?.sessionId ?? "direct",
+      turnId: "direct",
+      modelStepId: "direct"
+    };
+  }
+  throwPreparedTerminalResult(toolName, prepared, sessionId) {
+    if (prepared.reason === "unknown-tool") {
+      throw import_errors.ToolError.notFound(toolName);
+    }
+    if (prepared.reason === "denied") {
+      throw import_errors.ToolError.executionDenied(toolName, sessionId);
+    }
+    if (prepared.reason === "invalid-input") {
+      throw import_errors.ToolError.validationFailed(
+        toolName,
+        this.getPreparedTerminalMessage(prepared.modelVisibleResult)
+      );
+    }
+    throw import_errors.ToolError.executionFailed(
+      toolName,
+      this.getPreparedTerminalMessage(prepared.modelVisibleResult),
+      sessionId
+    );
+  }
+  getPreparedTerminalMessage(result) {
+    const output = result.result;
+    if (isRecord(output) && typeof output.error === "string") {
+      return output.error;
+    }
+    return "Tool call could not be prepared for execution";
+  }
+  async executePreparedToolCall(call, invocation, options) {
+    const { sessionId, abortSignal, runContext, hostRuntime } = this.resolveToolExecutionInvocation(invocation);
+    const durableIdentity = this.resolveToolExecutionIdentity(
+      invocation ?? {},
+      call.toolCallId
+    );
+    const backgroundTasksEnabled = (0, import_env.isBackgroundTasksEnabled)();
+    const willRunInBackground = backgroundTasksEnabled && call.meta?.runInBackground === true && sessionId !== void 0;
+    const executionIdentity = willRunInBackground ? void 0 : durableIdentity;
+    const executionId = executionIdentity === void 0 ? void 0 : (0, import_types4.createToolExecutionId)(executionIdentity);
+    let toolArgs = call.input;
+    this.logger.debug(
+      `\u{1F527} Prepared tool execution requested: '${call.toolName}' (toolCallId: ${call.toolCallId})`
+    );
+    if (executionIdentity !== void 0 && executionId !== void 0) {
+      const started = await this.toolExecutionStore.start({
+        record: {
+          executionId,
+          identity: executionIdentity,
+          input: call.input,
+          toolName: call.toolName,
+          status: "running",
+          startedAt: /* @__PURE__ */ new Date(),
+          updatedAt: /* @__PURE__ */ new Date()
+        }
+      });
+      if (started.status === "existing") {
+        this.assertToolExecutionRecordMatches({
+          record: started.record,
+          identity: executionIdentity,
+          toolName: call.toolName,
+          toolInput: call.input
+        });
+        if (started.record.status === "completed") {
+          this.logger.info("Replaying completed prepared tool execution result", {
+            executionId,
+            toolName: call.toolName
+          });
+          return (0, import_types4.completedToolExecutionToResult)(started.record);
+        }
+        if (started.record.status === "failed") {
+          this.logger.info("Replaying failed prepared tool execution result", {
+            executionId,
+            toolName: call.toolName
+          });
+          if (options?.throwOnError === true) {
+            throw import_errors.ToolError.executionFailed(
+              call.toolName,
+              `Tool execution already failed: ${executionId}`
+            );
+          }
+          return this.createFailedPreparedToolResult(call, started.record.error);
+        }
+        throw import_errors.ToolError.executionFailed(
+          call.toolName,
+          `Tool execution already ${started.record.status}: ${executionId}`
+        );
+      }
+    }
+    const startTime = Date.now();
+    try {
+      this.logger.info(
+        `\u{1F527} Prepared tool execution started for ${call.toolName}, sessionId: ${sessionId ?? "global"}`
+      );
+      if (sessionId) {
+        this.agentEventBus.emit("tool:running", {
+          toolName: call.toolName,
+          toolCallId: call.toolCallId,
+          sessionId,
+          ...hostRuntime !== void 0 && { hostRuntime }
+        });
+      }
+      if (this.hookManager && this.sessionManager && this.stateManager) {
+        const beforePayload = {
+          toolName: call.toolName,
+          args: toolArgs,
+          ...sessionId !== void 0 && { sessionId }
+        };
+        const modifiedPayload = await this.hookManager.executeHooks(
+          "beforeToolCall",
+          beforePayload,
+          {
+            sessionManager: this.sessionManager,
+            mcpManager: this.mcpManager,
+            toolManager: this,
+            stateManager: this.stateManager,
+            ...runContext !== void 0 && { runContext },
+            ...sessionId !== void 0 && { sessionId }
+          }
+        );
+        toolArgs = modifiedPayload.args;
+        try {
+          toolArgs = this.validateLocalToolArgs(call.toolName, toolArgs);
+        } catch (error) {
+          this.logger.error(
+            `Post-hook validation failed for tool '${call.toolName}': a beforeToolCall hook may have set invalid args`
+          );
+          throw error;
+        }
+      }
+      let result;
+      const registerBackgroundTask = (promise, description) => {
+        return {
+          result: {
+            taskId: call.toolCallId,
+            status: "running",
+            description
+          },
+          promise
+        };
+      };
+      if (call.source === "mcp") {
+        const actualToolName = call.toolName.substring(_ToolManager.MCP_TOOL_PREFIX.length);
+        if (actualToolName.length === 0) {
+          throw import_errors.ToolError.invalidName(
+            call.toolName,
+            "tool name cannot be empty after prefix"
+          );
+        }
+        const executeMcpTool = () => runContext === void 0 ? this.mcpManager.executeTool(actualToolName, toolArgs, sessionId) : this.mcpManager.executeTool(
+          actualToolName,
+          toolArgs,
+          sessionId,
+          runContext
+        );
+        if (call.meta?.runInBackground === true && !backgroundTasksEnabled) {
+          this.logger.debug(
+            "Background tool execution disabled; running synchronously instead.",
+            { toolName: call.toolName }
+          );
+        }
+        if (willRunInBackground) {
+          const backgroundSessionId = sessionId;
+          const { result: backgroundResult, promise } = registerBackgroundTask(
+            executeMcpTool(),
+            `MCP tool ${actualToolName}`
+          );
+          this.agentEventBus.emit("tool:background", {
+            toolName: call.toolName,
+            toolCallId: backgroundResult.taskId,
+            sessionId: backgroundSessionId,
+            description: backgroundResult.description,
+            promise,
+            ...hostRuntime !== void 0 && { hostRuntime },
+            ...call.meta?.timeoutMs !== void 0 && {
+              timeoutMs: call.meta.timeoutMs
+            },
+            ...call.meta?.notifyOnComplete !== void 0 && {
+              notifyOnComplete: call.meta.notifyOnComplete
+            }
+          });
+          result = backgroundResult;
+        } else {
+          result = await executeMcpTool();
+        }
+      } else {
+        if (call.meta?.runInBackground === true && !backgroundTasksEnabled) {
+          this.logger.debug(
+            "Background tool execution disabled; running synchronously instead.",
+            { toolName: call.toolName }
+          );
+        }
+        if (willRunInBackground) {
+          const backgroundSessionId = sessionId;
+          const { result: backgroundResult, promise } = registerBackgroundTask(
+            this.executeLocalTool(call.toolName, toolArgs, {
+              sessionId: backgroundSessionId,
+              abortSignal,
+              toolCallId: call.toolCallId,
               runContext
             }),
-            `Tool ${toolName}`
+            `Tool ${call.toolName}`
           );
           this.agentEventBus.emit("tool:background", {
-            toolName,
+            toolName: call.toolName,
             toolCallId: backgroundResult.taskId,
             sessionId: backgroundSessionId,
             description: backgroundResult.description,
             promise,
             ...hostRuntime !== void 0 && { hostRuntime },
-            ...meta.timeoutMs !== void 0 && { timeoutMs: meta.timeoutMs },
-            ...meta.notifyOnComplete !== void 0 && {
-              notifyOnComplete: meta.notifyOnComplete
+            ...call.meta?.timeoutMs !== void 0 && {
+              timeoutMs: call.meta.timeoutMs
+            },
+            ...call.meta?.notifyOnComplete !== void 0 && {
+              notifyOnComplete: call.meta.notifyOnComplete
             }
           });
           result = backgroundResult;
         } else {
-          result = await this.executeLocalTool(toolName, toolArgs, {
+          result = await this.executeLocalTool(call.toolName, toolArgs, {
             sessionId,
             abortSignal,
-            toolCallId,
+            toolCallId: call.toolCallId,
             runContext
           });
         }
       }
       const duration = Date.now() - startTime;
-      this.logger.debug(`\u{1F3AF} Tool execution completed in ${duration}ms: '${toolName}'`);
-      this.logger.info(
-        `\u2705 Tool execution completed successfully for ${toolName} in ${duration}ms, sessionId: ${sessionId ?? "global"}`
+      this.logger.debug(
+        `\u{1F3AF} Prepared tool execution completed in ${duration}ms: '${call.toolName}'`
       );
       if (this.hookManager && this.sessionManager && this.stateManager) {
         const afterPayload = {
-          toolName,
+          toolName: call.toolName,
           result,
           success: true,
           ...sessionId !== void 0 && { sessionId }
@@ -1364,29 +1672,45 @@ let _ToolManager = class _ToolManager {
         );
         result = modifiedPayload.result;
       }
-      const presentationSnapshot = await this.augmentSnapshotWithResult(
-        toolName,
-        callSnapshot,
+      const presentationSnapshot = await this.toolPresentation.augmentWithResult({
+        toolName: call.toolName,
+        snapshot: call.presentationSnapshot,
         result,
-        toolArgs,
-        toolCallId,
-        sessionId,
-        runContext
-      );
-      return {
+        args: toolArgs,
+        toolCallId: call.toolCallId,
+        ...sessionId !== void 0 ? { sessionId } : {},
+        ...runContext !== void 0 ? { runContext } : {}
+      });
+      const executionResult = {
         result,
         ...presentationSnapshot !== void 0 && { presentationSnapshot },
-        ...eventMeta !== void 0 ? { meta: eventMeta } : {},
-        ...requireApproval && { requireApproval, approvalStatus }
+        ...call.meta !== void 0 ? { meta: call.meta } : {},
+        ...call.approval !== void 0 ? call.approval : {}
       };
+      if (executionId !== void 0) {
+        await this.toolExecutionStore.complete({
+          executionId,
+          completedAt: /* @__PURE__ */ new Date(),
+          result: executionResult
+        });
+      }
+      return executionResult;
     } catch (error) {
       const duration = Date.now() - startTime;
       this.logger.error(
-        `\u274C Tool execution failed for ${toolName} after ${duration}ms, sessionId: ${sessionId ?? "global"}: ${error instanceof Error ? error.message : String(error)}`
+        `\u274C Prepared tool execution failed for ${call.toolName} after ${duration}ms, sessionId: ${sessionId ?? "global"}: ${error instanceof Error ? error.message : String(error)}`
       );
+      const message = error instanceof Error ? error.message : String(error);
+      if (executionId !== void 0) {
+        await this.toolExecutionStore.fail({
+          executionId,
+          completedAt: /* @__PURE__ */ new Date(),
+          error: message
+        });
+      }
       if (this.hookManager && this.sessionManager && this.stateManager) {
         const afterPayload = {
-          toolName,
+          toolName: call.toolName,
           result: error instanceof Error ? error.message : String(error),
           success: false,
           ...sessionId !== void 0 && { sessionId }
@@ -1400,9 +1724,20 @@ let _ToolManager = class _ToolManager {
           ...sessionId !== void 0 && { sessionId }
         });
       }
-      throw error;
+      if (options?.throwOnError === true) {
+        throw error;
+      }
+      return this.createFailedPreparedToolResult(call, message);
     }
   }
+  createFailedPreparedToolResult(call, error) {
+    return {
+      result: { error },
+      presentationSnapshot: call.presentationSnapshot,
+      ...call.meta !== void 0 ? { meta: call.meta } : {},
+      ...call.approval !== void 0 ? call.approval : {}
+    };
+  }
   /**
    * Check if a tool exists.
    */
@@ -1448,45 +1783,6 @@ let _ToolManager = class _ToolManager {
     }
     return "unknown";
   }
-  /**
-   * Check if a tool matches a policy pattern
-   * Supports both exact matching and suffix matching for MCP tools with server prefixes
-   *
-   * Examples:
-   * - Policy "mcp--read_file" matches "mcp--read_file" (exact)
-   * - Policy "mcp--read_file" matches "mcp--filesystem--read_file" (suffix)
-   * - Policy "read_file" matches "read_file" (local tool exact only)
-   *
-   * @param toolName The fully qualified tool name (e.g., "mcp--filesystem--read_file")
-   * @param policyPattern The policy pattern to match against (e.g., "mcp--read_file")
-   * @returns true if the tool matches the policy pattern
-   */
-  matchesToolPolicy(toolName, policyPattern) {
-    if (toolName === policyPattern) {
-      return true;
-    }
-    if (policyPattern.startsWith(_ToolManager.MCP_TOOL_PREFIX)) {
-      const baseName = policyPattern.substring(_ToolManager.MCP_TOOL_PREFIX.length);
-      if (toolName.endsWith(`--${baseName}`) && toolName.startsWith(_ToolManager.MCP_TOOL_PREFIX)) {
-        return true;
-      }
-    }
-    return false;
-  }
-  /**
-   * Check if a tool is in the static alwaysDeny list
-   * Supports both exact and suffix matching (e.g., "mcp--read_file" matches "mcp--server--read_file")
-   * @param toolName The fully qualified tool name to check
-   * @returns true if the tool is in the deny list
-   */
-  isInAlwaysDenyList(toolName) {
-    if (!this.toolPolicies?.alwaysDeny) {
-      return false;
-    }
-    return this.toolPolicies.alwaysDeny.some(
-      (pattern) => this.matchesToolPolicy(toolName, pattern)
-    );
-  }
   /**
    * Check if a tool is in the static alwaysAllow list
    * Supports both exact and suffix matching (e.g., "mcp--read_file" matches "mcp--server--read_file")
@@ -1498,250 +1794,9 @@ let _ToolManager = class _ToolManager {
       return false;
     }
     return this.toolPolicies.alwaysAllow.some(
-      (pattern) => this.matchesToolPolicy(toolName, pattern)
+      (pattern) => (0, import_session_tool_policy.matchesToolPolicyPattern)(toolName, pattern)
     );
   }
-  /**
-   * Handle tool approval flow. Checks various precedence levels to determine
-   * if a tool should be auto-approved, denied, or requires manual approval.
-   */
-  async handleToolApproval(toolName, args, toolCallId, sessionId, runContext, callDescription) {
-    if (this.isInAlwaysDenyList(toolName)) {
-      this.logger.info(
-        `Tool '${toolName}' is in static deny list \u2013 blocking execution (session: ${sessionId ?? "global"})`
-      );
-      throw import_errors.ToolError.executionDenied(toolName, sessionId);
-    }
-    const validatedArgs = this.validateLocalToolArgs(toolName, args);
-    const presentationSnapshot = await this.getToolPresentationSnapshotForCall(
-      toolName,
-      validatedArgs,
-      toolCallId,
-      sessionId,
-      runContext
-    );
-    let directoryAccess;
-    let directoryAccessApprovalRequest;
-    if (!toolName.startsWith(_ToolManager.MCP_TOOL_PREFIX)) {
-      const getApprovalOverride = this.getToolApprovalOverrideFn(toolName);
-      if (getApprovalOverride) {
-        const context = this.buildToolExecutionContext({
-          sessionId,
-          toolCallId,
-          runContext
-        });
-        const approvalRequest = await getApprovalOverride(validatedArgs, context);
-        if (approvalRequest) {
-          if (approvalRequest.type === import_types3.ApprovalType.DIRECTORY_ACCESS) {
-            const metadata = approvalRequest.metadata;
-            if (typeof metadata !== "object" || metadata === null || typeof metadata.path !== "string" || typeof metadata.parentDir !== "string" || typeof metadata.operation !== "string" || typeof metadata.toolName !== "string") {
-              throw import_errors.ToolError.configInvalid(
-                `Tool '${toolName}' returned invalid directory access metadata`
-              );
-            }
-            directoryAccess = metadata;
-            directoryAccessApprovalRequest = approvalRequest;
-          } else {
-            this.logger.debug(
-              `Tool '${toolName}' requested custom approval: type=${approvalRequest.type}`
-            );
-            if (sessionId && !approvalRequest.sessionId) {
-              approvalRequest.sessionId = sessionId;
-            }
-            if (runContext?.hostRuntime !== void 0 && approvalRequest.hostRuntime === void 0) {
-              approvalRequest.hostRuntime = runContext.hostRuntime;
-            }
-            const response = await this.approvalManager.requestApproval(approvalRequest);
-            if (response.status === import_types3.ApprovalStatus.APPROVED) {
-              const onGranted = this.getToolApprovalOnGrantedFn(toolName);
-              if (onGranted) {
-                await Promise.resolve(
-                  onGranted(response, context, approvalRequest)
-                );
-              }
-              this.logger.info(
-                `Custom approval granted for '${toolName}', type=${approvalRequest.type}, session=${sessionId ?? "global"}`
-              );
-              return {
-                requireApproval: true,
-                approvalStatus: "approved",
-                args: validatedArgs,
-                presentationSnapshot
-              };
-            }
-            this.logger.info(
-              `Custom approval denied for '${toolName}', type=${approvalRequest.type}, reason=${response.reason ?? "unknown"}`
-            );
-            throw import_errors.ToolError.executionDenied(toolName, sessionId);
-          }
-        }
-      }
-    }
-    const quickResult = await this.tryQuickApprovalResolution(
-      toolName,
-      validatedArgs,
-      sessionId,
-      directoryAccess
-    );
-    if (quickResult !== null) {
-      return { ...quickResult, args: validatedArgs, presentationSnapshot };
-    }
-    const manualResult = await this.requestManualApproval(
-      toolName,
-      validatedArgs,
-      toolCallId,
-      sessionId,
-      runContext,
-      directoryAccess,
-      directoryAccessApprovalRequest,
-      callDescription,
-      presentationSnapshot
-    );
-    return { ...manualResult, args: validatedArgs, presentationSnapshot };
-  }
-  /**
-   * Try to resolve tool approval quickly based on policies and cached permissions.
-   * Returns null if manual approval is needed.
-   *
-   * Precedence order (highest to lowest):
-   * 1. Directory access requirement (outside-root paths)
-   * 2. Session auto-approve (skill allowed-tools)
-   * 3. Static allow list
-   * 4. Dynamic "remembered" allowed list
-   * 5. Tool approval patterns
-   * 6. Approval mode (auto-approve/auto-deny)
-   */
-  async tryQuickApprovalResolution(toolName, args, sessionId, directoryAccess) {
-    if (directoryAccess) {
-      if (this.approvalMode === "auto-approve") {
-        await this.approvalManager.addApprovedDirectory(
-          directoryAccess.parentDir,
-          "once",
-          sessionId
-        );
-        return { requireApproval: false };
-      }
-      return null;
-    }
-    if (sessionId && this.isToolAutoApprovedForSession(sessionId, toolName)) {
-      this.logger.info(
-        `Tool '${toolName}' is in session's auto-approve list \u2013 skipping confirmation (session: ${sessionId})`
-      );
-      return { requireApproval: false };
-    }
-    if (this.isInAlwaysAllowList(toolName)) {
-      this.logger.info(
-        `Tool '${toolName}' is in static allow list \u2013 skipping confirmation (session: ${sessionId ?? "global"})`
-      );
-      return { requireApproval: false };
-    }
-    if (await this.allowedToolsProvider.isToolAllowed(toolName, sessionId)) {
-      this.logger.info(
-        `Tool '${toolName}' already allowed for session '${sessionId ?? "global"}' \u2013 skipping confirmation.`
-      );
-      return { requireApproval: false };
-    }
-    const patternKey = this.getToolPatternKey(toolName, args);
-    if (patternKey && this.approvalManager.matchesPattern(toolName, patternKey, sessionId)) {
-      this.logger.info(
-        `Tool '${toolName}' matched approved pattern key '${patternKey}' \u2013 skipping confirmation.`
-      );
-      return { requireApproval: false };
-    }
-    if (this.approvalMode === "auto-approve") {
-      this.logger.debug(`\u{1F7E2} Auto-approving tool execution: ${toolName}`);
-      return { requireApproval: false };
-    }
-    if (this.approvalMode === "auto-deny") {
-      this.logger.debug(`\u{1F6AB} Auto-denying tool execution: ${toolName}`);
-      throw import_errors.ToolError.executionDenied(toolName, sessionId);
-    }
-    return null;
-  }
-  /**
-   * Request manual approval from the user for a tool execution.
-   * Generates preview, sends approval request, and handles the response.
-   */
-  async requestManualApproval(toolName, args, toolCallId, sessionId, runContext, directoryAccess, directoryAccessApprovalRequest, callDescription, presentationSnapshot) {
-    this.logger.info(
-      `Tool approval requested for ${toolName}, sessionId: ${sessionId ?? "global"}`
-    );
-    try {
-      const displayPreview = await this.generateToolPreview(
-        toolName,
-        args,
-        toolCallId,
-        sessionId,
-        runContext
-      );
-      const hostRuntime = runContext?.hostRuntime ?? directoryAccessApprovalRequest?.hostRuntime;
-      const suggestedPatterns = this.getToolSuggestedPatterns(toolName, args);
-      const response = await this.approvalManager.requestToolApproval({
-        toolName,
-        ...presentationSnapshot !== void 0 && { presentationSnapshot },
-        toolCallId,
-        args,
-        ...callDescription !== void 0 && { description: callDescription },
-        ...sessionId !== void 0 && { sessionId },
-        ...hostRuntime !== void 0 && { hostRuntime },
-        ...displayPreview !== void 0 && { displayPreview },
-        ...directoryAccess !== void 0 && { directoryAccess },
-        ...suggestedPatterns !== void 0 && { suggestedPatterns }
-      });
-      if (response.status === import_types3.ApprovalStatus.APPROVED && directoryAccessApprovalRequest !== void 0) {
-        const onGranted = this.getToolApprovalOnGrantedFn(toolName);
-        if (onGranted) {
-          const context = this.buildToolExecutionContext({
-            sessionId,
-            toolCallId,
-            runContext
-          });
-          await Promise.resolve(
-            onGranted(response, context, directoryAccessApprovalRequest)
-          );
-        }
-      }
-      if (response.status === import_types3.ApprovalStatus.APPROVED && response.data) {
-        await this.handleRememberChoice(toolName, response, sessionId);
-      }
-      if (response.status !== import_types3.ApprovalStatus.APPROVED) {
-        this.handleApprovalDenied(toolName, response, sessionId);
-      }
-      this.logger.info(
-        `Tool approval approved for ${toolName}, sessionId: ${sessionId ?? "global"}`
-      );
-      return { requireApproval: true, approvalStatus: "approved" };
-    } catch (error) {
-      this.logger.error(
-        `Tool approval error for ${toolName}: ${error instanceof Error ? error.message : String(error)}`
-      );
-      throw error;
-    }
-  }
-  /**
-   * Generate a preview for the tool approval UI if the tool supports it.
-   */
-  async generateToolPreview(toolName, args, toolCallId, sessionId, runContext) {
-    const previewFn = this.getToolPreviewFn(toolName);
-    if (!previewFn) {
-      return void 0;
-    }
-    try {
-      const context = this.buildToolExecutionContext({ sessionId, toolCallId, runContext });
-      const preview = await previewFn(args, context);
-      this.logger.debug(`Generated preview for ${toolName}`);
-      return preview ?? void 0;
-    } catch (previewError) {
-      if (previewError instanceof import_errors2.DextoRuntimeError && previewError.code === import_error_codes.ToolErrorCode.VALIDATION_FAILED) {
-        this.logger.debug(`Validation failed for ${toolName}: ${previewError.message}`);
-        throw previewError;
-      }
-      this.logger.debug(
-        `Preview generation failed for ${toolName}: ${previewError instanceof Error ? previewError.message : String(previewError)}`
-      );
-      return void 0;
-    }
-  }
   /**
    * Handle "remember" actions when user approves a tool.
    */
@@ -1773,12 +1828,12 @@ let _ToolManager = class _ToolManager {
   handleApprovalDenied(toolName, response, sessionId) {
     if (response.status === import_types3.ApprovalStatus.CANCELLED && response.reason === import_types3.DenialReason.TIMEOUT) {
       this.logger.info(
-        `Tool confirmation timed out for ${toolName}, sessionId: ${sessionId ?? "global"}`
+        `Tool approval timed out for ${toolName}, sessionId: ${sessionId ?? "global"}`
       );
       throw import_errors.ToolError.executionTimeout(toolName, response.timeoutMs ?? 0, sessionId);
     }
     this.logger.info(
-      `Tool confirmation denied for ${toolName}, sessionId: ${sessionId ?? "global"}, reason: ${response.reason ?? "unknown"}`
+      `Tool approval denied for ${toolName}, sessionId: ${sessionId ?? "global"}, reason: ${response.reason ?? "unknown"}`
     );
     throw import_errors.ToolError.executionDenied(toolName, sessionId, response.message);
   }
@@ -1791,24 +1846,6 @@ let _ToolManager = class _ToolManager {
     this.invalidateCache();
     this.logger.debug("ToolManager refreshed (including MCP server capabilities)");
   }
-  /**
-   * Get list of pending confirmation requests
-   */
-  getPendingConfirmations() {
-    return this.approvalManager.getPendingApprovals();
-  }
-  /**
-   * Cancel a pending confirmation request
-   */
-  cancelConfirmation(approvalId) {
-    this.approvalManager.cancelApproval(approvalId);
-  }
-  /**
-   * Cancel all pending confirmation requests
-   */
-  cancelAllConfirmations() {
-    this.approvalManager.cancelAllApprovals();
-  }
 };
 _init = __decoratorStart(null);
 _ToolManager = __decorateElement(_init, 0, "ToolManager", _ToolManager_decorators, _ToolManager);