@iaforged/context-code 1.0.72 → 1.0.74

package/dist/src/hooks/toolPermission/handlers/interactiveHandler.js

@@ -0,0 +1,397 @@
+import { feature } from '../../../recovery/bunBundleShim.js';
+import { randomUUID } from 'crypto';
+import { logForDebugging } from '../../../utils/debug.js';
+import { getAllowedChannels } from '../../../bootstrap/state.js';
+import { getTerminalFocused } from '../../../ink/terminal-focus-state.js';
+import { CHANNEL_PERMISSION_REQUEST_METHOD, findChannelEntry, } from '../../../services/mcp/channelNotification.js';
+import { filterPermissionRelayClients, shortRequestId, truncateForPreview, } from '../../../services/mcp/channelPermissions.js';
+import { executeAsyncClassifierCheck } from '../../../tools/BashTool/bashPermissions.js';
+import { BASH_TOOL_NAME } from '../../../tools/BashTool/toolName.js';
+import { clearClassifierChecking, setClassifierApproval, setClassifierChecking, setYoloClassifierApproval, } from '../../../utils/classifierApprovals.js';
+import { errorMessage } from '../../../utils/errors.js';
+import { hasPermissionsToUseTool } from '../../../utils/permissions/permissions.js';
+import { createResolveOnce } from '../PermissionContext.js';
+/**
+ * Handles the interactive (main-agent) permission flow.
+ *
+ * Pushes a ToolUseConfirm entry to the confirm queue with callbacks:
+ * onAbort, onAllow, onReject, recheckPermission, onUserInteraction.
+ *
+ * Runs permission hooks and bash classifier checks asynchronously in the
+ * background, racing them against user interaction. Uses a resolve-once
+ * guard and `userInteracted` flag to prevent multiple resolutions.
+ *
+ * This function does NOT return a Promise -- it sets up callbacks that
+ * eventually call `resolve()` to resolve the outer promise owned by
+ * the caller.
+ */
+function handleInteractivePermission(params, resolve) {
+    const { ctx, description, result, awaitAutomatedChecksBeforeDialog, bridgeCallbacks, channelCallbacks, } = params;
+    const { resolve: resolveOnce, isResolved, claim } = createResolveOnce(resolve);
+    let userInteracted = false;
+    let checkmarkTransitionTimer;
+    // Hoisted so onDismissCheckmark (Esc during checkmark window) can also
+    // remove the abort listener — not just the timer callback.
+    let checkmarkAbortHandler;
+    const bridgeRequestId = bridgeCallbacks ? randomUUID() : undefined;
+    // Hoisted so local/hook/classifier wins can remove the pending channel
+    // entry. No "tell remote to dismiss" equivalent — the text sits in your
+    // phone, and a stale "yes abc123" after local-resolve falls through
+    // tryConsumeReply (entry gone) and gets enqueued as normal chat.
+    let channelUnsubscribe;
+    const permissionPromptStartTimeMs = Date.now();
+    const displayInput = result.updatedInput ?? ctx.input;
+    function clearClassifierIndicator() {
+        if (feature('BASH_CLASSIFIER')) {
+            ctx.updateQueueItem({ classifierCheckInProgress: false });
+        }
+    }
+    ctx.pushToQueue({
+        assistantMessage: ctx.assistantMessage,
+        tool: ctx.tool,
+        description,
+        input: displayInput,
+        toolUseContext: ctx.toolUseContext,
+        toolUseID: ctx.toolUseID,
+        permissionResult: result,
+        permissionPromptStartTimeMs,
+        ...(feature('BASH_CLASSIFIER')
+            ? {
+                classifierCheckInProgress: !!result.pendingClassifierCheck &&
+                    !awaitAutomatedChecksBeforeDialog,
+            }
+            : {}),
+        onUserInteraction() {
+            // Called when user starts interacting with the permission dialog
+            // (e.g., arrow keys, tab, typing feedback)
+            // Hide the classifier indicator since auto-approve is no longer possible
+            //
+            // Grace period: ignore interactions in the first 200ms to prevent
+            // accidental keypresses from canceling the classifier prematurely
+            const GRACE_PERIOD_MS = 200;
+            if (Date.now() - permissionPromptStartTimeMs < GRACE_PERIOD_MS) {
+                return;
+            }
+            userInteracted = true;
+            clearClassifierChecking(ctx.toolUseID);
+            clearClassifierIndicator();
+        },
+        onDismissCheckmark() {
+            if (checkmarkTransitionTimer) {
+                clearTimeout(checkmarkTransitionTimer);
+                checkmarkTransitionTimer = undefined;
+                if (checkmarkAbortHandler) {
+                    ctx.toolUseContext.abortController.signal.removeEventListener('abort', checkmarkAbortHandler);
+                    checkmarkAbortHandler = undefined;
+                }
+                ctx.removeFromQueue();
+            }
+        },
+        onAbort() {
+            if (!claim())
+                return;
+            if (bridgeCallbacks && bridgeRequestId) {
+                bridgeCallbacks.sendResponse(bridgeRequestId, {
+                    behavior: 'deny',
+                    message: 'User aborted',
+                });
+                bridgeCallbacks.cancelRequest(bridgeRequestId);
+            }
+            channelUnsubscribe?.();
+            ctx.logCancelled();
+            ctx.logDecision({ decision: 'reject', source: { type: 'user_abort' } }, { permissionPromptStartTimeMs });
+            resolveOnce(ctx.cancelAndAbort(undefined, true));
+        },
+        async onAllow(updatedInput, permissionUpdates, feedback, contentBlocks) {
+            if (!claim())
+                return; // atomic check-and-mark before await
+            if (bridgeCallbacks && bridgeRequestId) {
+                bridgeCallbacks.sendResponse(bridgeRequestId, {
+                    behavior: 'allow',
+                    updatedInput,
+                    updatedPermissions: permissionUpdates,
+                });
+                bridgeCallbacks.cancelRequest(bridgeRequestId);
+            }
+            channelUnsubscribe?.();
+            resolveOnce(await ctx.handleUserAllow(updatedInput, permissionUpdates, feedback, permissionPromptStartTimeMs, contentBlocks, result.decisionReason));
+        },
+        onReject(feedback, contentBlocks) {
+            if (!claim())
+                return;
+            if (bridgeCallbacks && bridgeRequestId) {
+                bridgeCallbacks.sendResponse(bridgeRequestId, {
+                    behavior: 'deny',
+                    message: feedback ?? 'User denied permission',
+                });
+                bridgeCallbacks.cancelRequest(bridgeRequestId);
+            }
+            channelUnsubscribe?.();
+            ctx.logDecision({
+                decision: 'reject',
+                source: { type: 'user_reject', hasFeedback: !!feedback },
+            }, { permissionPromptStartTimeMs });
+            resolveOnce(ctx.cancelAndAbort(feedback, undefined, contentBlocks));
+        },
+        async recheckPermission() {
+            if (isResolved())
+                return;
+            const freshResult = await hasPermissionsToUseTool(ctx.tool, ctx.input, ctx.toolUseContext, ctx.assistantMessage, ctx.toolUseID);
+            if (freshResult.behavior === 'allow') {
+                // claim() (atomic check-and-mark), not isResolved() — the async
+                // hasPermissionsToUseTool call above opens a window where CCR
+                // could have responded in flight. Matches onAllow/onReject/hook
+                // paths. cancelRequest tells CCR to dismiss its prompt — without
+                // it, the web UI shows a stale prompt for a tool that's already
+                // executing (particularly visible when recheck is triggered by
+                // a CCR-initiated mode switch, the very case this callback exists
+                // for after useReplBridge started calling it).
+                if (!claim())
+                    return;
+                if (bridgeCallbacks && bridgeRequestId) {
+                    bridgeCallbacks.cancelRequest(bridgeRequestId);
+                }
+                channelUnsubscribe?.();
+                ctx.removeFromQueue();
+                ctx.logDecision({ decision: 'accept', source: 'config' });
+                resolveOnce(ctx.buildAllow(freshResult.updatedInput ?? ctx.input));
+            }
+        },
+    });
+    // Race 4: Bridge permission response from CCR (claude.ai)
+    // When the bridge is connected, send the permission request to CCR and
+    // subscribe for a response. Whichever side (CLI or CCR) responds first
+    // wins via claim().
+    //
+    // All tools are forwarded — CCR's generic allow/deny modal handles any
+    // tool, and can return `updatedInput` when it has a dedicated renderer
+    // (e.g. plan edit). Tools whose local dialog injects fields (ReviewArtifact
+    // `selected`, AskUserQuestion `answers`) tolerate the field being missing
+    // so generic remote approval degrades gracefully instead of throwing.
+    if (bridgeCallbacks && bridgeRequestId) {
+        bridgeCallbacks.sendRequest(bridgeRequestId, ctx.tool.name, displayInput, ctx.toolUseID, description, result.suggestions, result.blockedPath);
+        const signal = ctx.toolUseContext.abortController.signal;
+        const unsubscribe = bridgeCallbacks.onResponse(bridgeRequestId, response => {
+            if (!claim())
+                return; // Local user/hook/classifier already responded
+            signal.removeEventListener('abort', unsubscribe);
+            clearClassifierChecking(ctx.toolUseID);
+            clearClassifierIndicator();
+            ctx.removeFromQueue();
+            channelUnsubscribe?.();
+            if (response.behavior === 'allow') {
+                if (response.updatedPermissions?.length) {
+                    void ctx.persistPermissions(response.updatedPermissions);
+                }
+                ctx.logDecision({
+                    decision: 'accept',
+                    source: {
+                        type: 'user',
+                        permanent: !!response.updatedPermissions?.length,
+                    },
+                }, { permissionPromptStartTimeMs });
+                resolveOnce(ctx.buildAllow(response.updatedInput ?? displayInput));
+            }
+            else {
+                ctx.logDecision({
+                    decision: 'reject',
+                    source: {
+                        type: 'user_reject',
+                        hasFeedback: !!response.message,
+                    },
+                }, { permissionPromptStartTimeMs });
+                resolveOnce(ctx.cancelAndAbort(response.message));
+            }
+        });
+        signal.addEventListener('abort', unsubscribe, { once: true });
+    }
+    // Channel permission relay — races alongside the bridge block above. Send a
+    // permission prompt to every active channel (Telegram, iMessage, etc.) via
+    // its MCP send_message tool, then race the reply against local/bridge/hook/
+    // classifier. The inbound "yes abc123" is intercepted in the notification
+    // handler (useManageMCPConnections.ts) BEFORE enqueue, so it never reaches
+    // Claude as a conversation turn.
+    //
+    // Unlike the bridge block, this still guards on `requiresUserInteraction` —
+    // channel replies are pure yes/no with no `updatedInput` path. In practice
+    // the guard is dead code today: all three `requiresUserInteraction` tools
+    // (ExitPlanMode, AskUserQuestion, ReviewArtifact) return `isEnabled()===false`
+    // when channels are configured, so they never reach this handler.
+    //
+    // Fire-and-forget send: if callTool fails (channel down, tool missing),
+    // the subscription never fires and another racer wins. Graceful degradation
+    // — the local dialog is always there as the floor.
+    if ((feature('KAIROS') || feature('KAIROS_CHANNELS')) &&
+        channelCallbacks &&
+        !ctx.tool.requiresUserInteraction?.()) {
+        const channelRequestId = shortRequestId(ctx.toolUseID);
+        const allowedChannels = getAllowedChannels();
+        const channelClients = filterPermissionRelayClients(ctx.toolUseContext.getAppState().mcp.clients, name => findChannelEntry(name, allowedChannels) !== undefined);
+        if (channelClients.length > 0) {
+            // Outbound is structured too (Kenneth's symmetry ask) — server owns
+            // message formatting for its platform (Telegram markdown, iMessage
+            // rich text, Discord embed). CC sends the RAW parts; server composes.
+            // The old callTool('send_message', {text,content,message}) triple-key
+            // hack is gone — no more guessing which arg name each plugin takes.
+            const params = {
+                request_id: channelRequestId,
+                tool_name: ctx.tool.name,
+                description,
+                input_preview: truncateForPreview(displayInput),
+            };
+            for (const client of channelClients) {
+                if (client.type !== 'connected')
+                    continue; // refine for TS
+                void client.client
+                    .notification({
+                    method: CHANNEL_PERMISSION_REQUEST_METHOD,
+                    params,
+                })
+                    .catch(e => {
+                    logForDebugging(`Channel permission_request failed for ${client.name}: ${errorMessage(e)}`, { level: 'error' });
+                });
+            }
+            const channelSignal = ctx.toolUseContext.abortController.signal;
+            // Wrap so BOTH the map delete AND the abort-listener teardown happen
+            // at every call site. The 6 channelUnsubscribe?.() sites after local/
+            // hook/classifier wins previously only deleted the map entry — the
+            // dead closure stayed registered on the session-scoped abort signal
+            // until the session ended. Not a functional bug (Map.delete is
+            // idempotent), but it held the closure alive.
+            const mapUnsub = channelCallbacks.onResponse(channelRequestId, response => {
+                if (!claim())
+                    return; // Another racer won
+                channelUnsubscribe?.(); // both: map delete + listener remove
+                clearClassifierChecking(ctx.toolUseID);
+                clearClassifierIndicator();
+                ctx.removeFromQueue();
+                // Bridge is the other remote — tell it we're done.
+                if (bridgeCallbacks && bridgeRequestId) {
+                    bridgeCallbacks.cancelRequest(bridgeRequestId);
+                }
+                if (response.behavior === 'allow') {
+                    ctx.logDecision({
+                        decision: 'accept',
+                        source: { type: 'user', permanent: false },
+                    }, { permissionPromptStartTimeMs });
+                    resolveOnce(ctx.buildAllow(displayInput));
+                }
+                else {
+                    ctx.logDecision({
+                        decision: 'reject',
+                        source: { type: 'user_reject', hasFeedback: false },
+                    }, { permissionPromptStartTimeMs });
+                    resolveOnce(ctx.cancelAndAbort(`Denied via channel ${response.fromServer}`));
+                }
+            });
+            channelUnsubscribe = () => {
+                mapUnsub();
+                channelSignal.removeEventListener('abort', channelUnsubscribe);
+            };
+            channelSignal.addEventListener('abort', channelUnsubscribe, {
+                once: true,
+            });
+        }
+    }
+    // Skip hooks if they were already awaited in the coordinator branch above
+    if (!awaitAutomatedChecksBeforeDialog) {
+        // Execute PermissionRequest hooks asynchronously
+        // If hook returns a decision before user responds, apply it
+        void (async () => {
+            if (isResolved())
+                return;
+            const currentAppState = ctx.toolUseContext.getAppState();
+            const hookDecision = await ctx.runHooks(currentAppState.toolPermissionContext.mode, result.suggestions, result.updatedInput, permissionPromptStartTimeMs);
+            if (!hookDecision || !claim())
+                return;
+            if (bridgeCallbacks && bridgeRequestId) {
+                bridgeCallbacks.cancelRequest(bridgeRequestId);
+            }
+            channelUnsubscribe?.();
+            ctx.removeFromQueue();
+            resolveOnce(hookDecision);
+        })();
+    }
+    // Execute bash classifier check asynchronously (if applicable)
+    if (feature('BASH_CLASSIFIER') &&
+        result.pendingClassifierCheck &&
+        ctx.tool.name === BASH_TOOL_NAME &&
+        !awaitAutomatedChecksBeforeDialog) {
+        // UI indicator for "classifier running" — set here (not in
+        // toolExecution.ts) so commands that auto-allow via prefix rules
+        // don't flash the indicator for a split second before allow returns.
+        setClassifierChecking(ctx.toolUseID);
+        void executeAsyncClassifierCheck(result.pendingClassifierCheck, ctx.toolUseContext.abortController.signal, ctx.toolUseContext.options.isNonInteractiveSession, {
+            shouldContinue: () => !isResolved() && !userInteracted,
+            onComplete: () => {
+                clearClassifierChecking(ctx.toolUseID);
+                clearClassifierIndicator();
+            },
+            onAllow: decisionReason => {
+                if (!claim())
+                    return;
+                if (bridgeCallbacks && bridgeRequestId) {
+                    bridgeCallbacks.cancelRequest(bridgeRequestId);
+                }
+                channelUnsubscribe?.();
+                clearClassifierChecking(ctx.toolUseID);
+                const matchedRule = decisionReason.type === 'classifier'
+                    ? (decisionReason.reason.match(/^Allowed by prompt rule: "(.+)"$/)?.[1] ?? decisionReason.reason)
+                    : undefined;
+                // Show auto-approved transition with dimmed options
+                if (feature('TRANSCRIPT_CLASSIFIER')) {
+                    ctx.updateQueueItem({
+                        classifierCheckInProgress: false,
+                        classifierAutoApproved: true,
+                        classifierMatchedRule: matchedRule,
+                    });
+                }
+                if (feature('TRANSCRIPT_CLASSIFIER') &&
+                    decisionReason.type === 'classifier') {
+                    if (decisionReason.classifier === 'auto-mode') {
+                        setYoloClassifierApproval(ctx.toolUseID, decisionReason.reason);
+                    }
+                    else if (matchedRule) {
+                        setClassifierApproval(ctx.toolUseID, matchedRule);
+                    }
+                }
+                ctx.logDecision({ decision: 'accept', source: { type: 'classifier' } }, { permissionPromptStartTimeMs });
+                resolveOnce(ctx.buildAllow(ctx.input, { decisionReason }));
+                // Keep checkmark visible, then remove dialog.
+                // 3s if terminal is focused (user can see it), 1s if not.
+                // User can dismiss early with Esc via onDismissCheckmark.
+                const signal = ctx.toolUseContext.abortController.signal;
+                checkmarkAbortHandler = () => {
+                    if (checkmarkTransitionTimer) {
+                        clearTimeout(checkmarkTransitionTimer);
+                        checkmarkTransitionTimer = undefined;
+                        // Sibling Bash error can fire this (StreamingToolExecutor
+                        // cascades via siblingAbortController) — must drop the
+                        // cosmetic ✓ dialog or it blocks the next queued item.
+                        ctx.removeFromQueue();
+                    }
+                };
+                const checkmarkMs = getTerminalFocused() ? 3000 : 1000;
+                checkmarkTransitionTimer = setTimeout(() => {
+                    checkmarkTransitionTimer = undefined;
+                    if (checkmarkAbortHandler) {
+                        signal.removeEventListener('abort', checkmarkAbortHandler);
+                        checkmarkAbortHandler = undefined;
+                    }
+                    ctx.removeFromQueue();
+                }, checkmarkMs);
+                signal.addEventListener('abort', checkmarkAbortHandler, {
+                    once: true,
+                });
+            },
+        }).catch(error => {
+            // Log classifier API errors for debugging but don't propagate them as interruptions
+            // These errors can be network failures, rate limits, or model issues - not user cancellations
+            logForDebugging(`Async classifier check failed: ${errorMessage(error)}`, {
+                level: 'error',
+            });
+        });
+    }
+}
+// --
+export { handleInteractivePermission };

package/dist/src/hooks/toolPermission/handlers/swarmWorkerHandler.js

@@ -0,0 +1,108 @@
+import { feature } from '../../../recovery/bunBundleShim.js';
+import { isAgentSwarmsEnabled } from '../../../utils/agentSwarmsEnabled.js';
+import { toError } from '../../../utils/errors.js';
+import { logError } from '../../../utils/log.js';
+import { createPermissionRequest, isSwarmWorker, sendPermissionRequestViaMailbox, } from '../../../utils/swarm/permissionSync.js';
+import { registerPermissionCallback } from '../../useSwarmPermissionPoller.js';
+import { createResolveOnce } from '../PermissionContext.js';
+/**
+ * Handles the swarm worker permission flow.
+ *
+ * When running as a swarm worker:
+ * 1. Tries classifier auto-approval for bash commands
+ * 2. Forwards the permission request to the leader via mailbox
+ * 3. Registers callbacks for when the leader responds
+ * 4. Sets the pending indicator while waiting
+ *
+ * Returns a PermissionDecision if the classifier auto-approves,
+ * or a Promise that resolves when the leader responds.
+ * Returns null if swarms are not enabled or this is not a swarm worker,
+ * so the caller can fall through to interactive handling.
+ */
+async function handleSwarmWorkerPermission(params) {
+    if (!isAgentSwarmsEnabled() || !isSwarmWorker()) {
+        return null;
+    }
+    const { ctx, description, updatedInput, suggestions } = params;
+    // For bash commands, try classifier auto-approval before forwarding to
+    // the leader. Agents await the classifier result (rather than racing it
+    // against user interaction like the main agent).
+    const classifierResult = feature('BASH_CLASSIFIER')
+        ? await ctx.tryClassifier?.(params.pendingClassifierCheck, updatedInput)
+        : null;
+    if (classifierResult) {
+        return classifierResult;
+    }
+    // Forward permission request to the leader via mailbox
+    try {
+        const clearPendingRequest = () => ctx.toolUseContext.setAppState(prev => ({
+            ...prev,
+            pendingWorkerRequest: null,
+        }));
+        const decision = await new Promise(resolve => {
+            const { resolve: resolveOnce, claim } = createResolveOnce(resolve);
+            // Create the permission request
+            const request = createPermissionRequest({
+                toolName: ctx.tool.name,
+                toolUseId: ctx.toolUseID,
+                input: ctx.input,
+                description,
+                permissionSuggestions: suggestions,
+            });
+            // Register callback BEFORE sending the request to avoid race condition
+            // where leader responds before callback is registered
+            registerPermissionCallback({
+                requestId: request.id,
+                toolUseId: ctx.toolUseID,
+                async onAllow(allowedInput, permissionUpdates, feedback, contentBlocks) {
+                    if (!claim())
+                        return; // atomic check-and-mark before await
+                    clearPendingRequest();
+                    // Merge the updated input with the original input
+                    const finalInput = allowedInput && Object.keys(allowedInput).length > 0
+                        ? allowedInput
+                        : ctx.input;
+                    resolveOnce(await ctx.handleUserAllow(finalInput, permissionUpdates, feedback, undefined, contentBlocks));
+                },
+                onReject(feedback, contentBlocks) {
+                    if (!claim())
+                        return;
+                    clearPendingRequest();
+                    ctx.logDecision({
+                        decision: 'reject',
+                        source: { type: 'user_reject', hasFeedback: !!feedback },
+                    });
+                    resolveOnce(ctx.cancelAndAbort(feedback, undefined, contentBlocks));
+                },
+            });
+            // Now that callback is registered, send the request to the leader
+            void sendPermissionRequestViaMailbox(request);
+            // Show visual indicator that we're waiting for leader approval
+            ctx.toolUseContext.setAppState(prev => ({
+                ...prev,
+                pendingWorkerRequest: {
+                    toolName: ctx.tool.name,
+                    toolUseId: ctx.toolUseID,
+                    description,
+                },
+            }));
+            // If the abort signal fires while waiting for the leader response,
+            // resolve the promise with a cancel decision so it does not hang.
+            ctx.toolUseContext.abortController.signal.addEventListener('abort', () => {
+                if (!claim())
+                    return;
+                clearPendingRequest();
+                ctx.logCancelled();
+                resolveOnce(ctx.cancelAndAbort(undefined, true));
+            }, { once: true });
+        });
+        return decision;
+    }
+    catch (error) {
+        // If swarm permission submission fails, fall back to local handling
+        logError(toError(error));
+        // Continue to local UI handling below
+        return null;
+    }
+}
+export { handleSwarmWorkerPermission };

package/dist/src/hooks/toolPermission/permissionLogging.js

@@ -0,0 +1,145 @@
+import { feature } from '../../recovery/bunBundleShim.js';
+// Centralized analytics/telemetry logging for tool permission decisions.
+// All permission approve/reject events flow through logPermissionDecision(),
+// which fans out to Statsig analytics, OTel telemetry, and code-edit metrics.
+import { logEvent, } from '../../services/analytics/index.js';
+import { sanitizeToolNameForAnalytics } from '../../services/analytics/metadata.js';
+import { getCodeEditToolDecisionCounter } from '../../bootstrap/state.js';
+import { getLanguageName } from '../../utils/cliHighlight.js';
+import { SandboxManager } from '../../utils/sandbox/sandbox-adapter.js';
+import { logOTelEvent } from '../../utils/telemetry/events.js';
+const CODE_EDITING_TOOLS = ['Edit', 'Write', 'NotebookEdit'];
+function isCodeEditingTool(toolName) {
+    return CODE_EDITING_TOOLS.includes(toolName);
+}
+// Builds OTel counter attributes for code editing tools, enriching with
+// language when the tool's target file path can be extracted from input
+async function buildCodeEditToolAttributes(tool, input, decision, source) {
+    // Derive language from file path if the tool exposes one (e.g., Edit, Write)
+    let language;
+    if (tool.getPath && input) {
+        const parseResult = tool.inputSchema.safeParse(input);
+        if (parseResult.success) {
+            const filePath = tool.getPath(parseResult.data);
+            if (filePath) {
+                language = await getLanguageName(filePath);
+            }
+        }
+    }
+    return {
+        decision,
+        source,
+        tool_name: tool.name,
+        ...(language && { language }),
+    };
+}
+// Flattens structured source into a string label for analytics/OTel events
+function sourceToString(source) {
+    if ((feature('BASH_CLASSIFIER') || feature('TRANSCRIPT_CLASSIFIER')) &&
+        source.type === 'classifier') {
+        return 'classifier';
+    }
+    switch (source.type) {
+        case 'hook':
+            return 'hook';
+        case 'user':
+            return source.permanent ? 'user_permanent' : 'user_temporary';
+        case 'user_abort':
+            return 'user_abort';
+        case 'user_reject':
+            return 'user_reject';
+        default:
+            return 'unknown';
+    }
+}
+function baseMetadata(messageId, toolName, waitMs) {
+    return {
+        messageID: messageId,
+        toolName: sanitizeToolNameForAnalytics(toolName),
+        sandboxEnabled: SandboxManager.isSandboxingEnabled(),
+        // Only include wait time when the user was actually prompted (not auto-approved)
+        ...(waitMs !== undefined && { waiting_for_user_permission_ms: waitMs }),
+    };
+}
+// Emits a distinct analytics event name per approval source for funnel analysis
+function logApprovalEvent(tool, messageId, source, waitMs) {
+    if (source === 'config') {
+        // Auto-approved by allowlist in settings -- no user wait time
+        logEvent('tengu_tool_use_granted_in_config', baseMetadata(messageId, tool.name, undefined));
+        return;
+    }
+    if ((feature('BASH_CLASSIFIER') || feature('TRANSCRIPT_CLASSIFIER')) &&
+        source.type === 'classifier') {
+        logEvent('tengu_tool_use_granted_by_classifier', baseMetadata(messageId, tool.name, waitMs));
+        return;
+    }
+    switch (source.type) {
+        case 'user':
+            logEvent(source.permanent
+                ? 'tengu_tool_use_granted_in_prompt_permanent'
+                : 'tengu_tool_use_granted_in_prompt_temporary', baseMetadata(messageId, tool.name, waitMs));
+            break;
+        case 'hook':
+            logEvent('tengu_tool_use_granted_by_permission_hook', {
+                ...baseMetadata(messageId, tool.name, waitMs),
+                permanent: source.permanent ?? false,
+            });
+            break;
+        default:
+            break;
+    }
+}
+// Rejections share a single event name, differentiated by metadata fields
+function logRejectionEvent(tool, messageId, source, waitMs) {
+    if (source === 'config') {
+        // Denied by denylist in settings
+        logEvent('tengu_tool_use_denied_in_config', baseMetadata(messageId, tool.name, undefined));
+        return;
+    }
+    logEvent('tengu_tool_use_rejected_in_prompt', {
+        ...baseMetadata(messageId, tool.name, waitMs),
+        // Distinguish hook rejections from user rejections via separate fields
+        ...(source.type === 'hook'
+            ? { isHook: true }
+            : {
+                hasFeedback: source.type === 'user_reject' ? source.hasFeedback : false,
+            }),
+    });
+}
+// Single entry point for all permission decision logging. Called by permission
+// handlers after every approve/reject. Fans out to: analytics events, OTel
+// telemetry, code-edit OTel counters, and toolUseContext decision storage.
+function logPermissionDecision(ctx, args, permissionPromptStartTimeMs) {
+    const { tool, input, toolUseContext, messageId, toolUseID } = ctx;
+    const { decision, source } = args;
+    const waiting_for_user_permission_ms = permissionPromptStartTimeMs !== undefined
+        ? Date.now() - permissionPromptStartTimeMs
+        : undefined;
+    // Log the analytics event
+    if (args.decision === 'accept') {
+        logApprovalEvent(tool, messageId, args.source, waiting_for_user_permission_ms);
+    }
+    else {
+        logRejectionEvent(tool, messageId, args.source, waiting_for_user_permission_ms);
+    }
+    const sourceString = source === 'config' ? 'config' : sourceToString(source);
+    // Track code editing tool metrics
+    if (isCodeEditingTool(tool.name)) {
+        void buildCodeEditToolAttributes(tool, input, decision, sourceString).then(attributes => getCodeEditToolDecisionCounter()?.add(1, attributes));
+    }
+    // Persist decision on the context so downstream code can inspect what happened
+    if (!toolUseContext.toolDecisions) {
+        toolUseContext.toolDecisions = new Map();
+    }
+    toolUseContext.toolDecisions.set(toolUseID, {
+        source: sourceString,
+        decision,
+        timestamp: Date.now(),
+    });
+    void logOTelEvent('tool_decision', {
+        decision,
+        source: sourceString,
+        tool_name: sanitizeToolNameForAnalytics(tool.name),
+    });
+}
+export { isCodeEditingTool, buildCodeEditToolAttributes, logPermissionDecision };