chainlesschain 0.162.39 → 0.162.41

package/src/lib/update-notice.js

@@ -0,0 +1,154 @@
+/**
+ * Startup update notice — Claude-Code-style "new version available" line.
+ *
+ * Zero startup cost by design:
+ *  - the CLI entry only does ONE sync cache read (~/.chainlesschain/
+ *    update-check.json) and prints a single gray stderr line when the cached
+ *    latest version is newer than the running one (TTY only, never pollutes
+ *    piped/JSON output);
+ *  - when the cache is stale (>24h) it spawns a DETACHED, unref'd child that
+ *    refreshes the cache from the npm registry for the NEXT run — the current
+ *    invocation never waits on the network. The cache's checkedAt is touched
+ *    optimistically before spawning so concurrent invocations don't stampede.
+ *
+ * Disable with CC_UPDATE_NOTICE=0. `cc update` remains the full interactive
+ * checker (GitHub releases + assets); this is just the passive nudge.
+ */
+
+import fsDefault from "fs";
+import pathDefault from "path";
+import osDefault from "os";
+import { spawn as spawnDefault } from "child_process";
+import { fileURLToPath } from "url";
+import chalk from "chalk";
+import semver from "semver";
+import { VERSION } from "../constants.js";
+
+export const CACHE_TTL_MS = 24 * 60 * 60 * 1000;
+export const NPM_LATEST_URL = "https://registry.npmjs.org/chainlesschain/latest";
+
+export const _deps = {
+  fs: fsDefault,
+  path: pathDefault,
+  os: osDefault,
+  spawn: spawnDefault,
+};
+
+export function cachePath(deps = _deps) {
+  return deps.path.join(
+    deps.os.homedir() || "",
+    ".chainlesschain",
+    "update-check.json",
+  );
+}
+
+function readCache(deps) {
+  try {
+    return JSON.parse(deps.fs.readFileSync(cachePath(deps), "utf-8"));
+  } catch {
+    return null;
+  }
+}
+
+function writeCache(deps, cache) {
+  try {
+    const p = cachePath(deps);
+    deps.fs.mkdirSync(deps.path.dirname(p), { recursive: true });
+    deps.fs.writeFileSync(p, JSON.stringify(cache), "utf-8");
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Entry-point hook. Cheap and fail-open — never throws, never blocks.
+ *
+ * @returns {{ printed: boolean, spawned: boolean }}
+ */
+export function maybeNotifyUpdate(opts = {}) {
+  const deps = { ..._deps, ...(opts.deps || {}) };
+  const env = opts.env || process.env;
+  const now = opts.now ?? Date.now();
+  const isTTY = opts.isTTY ?? Boolean(process.stderr.isTTY);
+  const current = opts.currentVersion || VERSION;
+  const print =
+    opts.print || ((line) => process.stderr.write(chalk.gray(line) + "\n"));
+
+  const out = { printed: false, spawned: false };
+  try {
+    if (env.CC_UPDATE_NOTICE === "0") return out;
+
+    const cache = readCache(deps);
+
+    if (
+      isTTY &&
+      cache?.latest &&
+      semver.valid(cache.latest) &&
+      semver.valid(current) &&
+      semver.gt(cache.latest, current)
+    ) {
+      print(
+        `Update available: chainlesschain ${current} → ${cache.latest} (npm i -g chainlesschain · CC_UPDATE_NOTICE=0 to hide)`,
+      );
+      out.printed = true;
+    }
+
+    const stale = !cache?.checkedAt || now - cache.checkedAt > CACHE_TTL_MS;
+    if (stale) {
+      // Optimistic touch first: parallel `cc` invocations inside the stale
+      // window won't each spawn a refresher.
+      writeCache(deps, { ...(cache || {}), checkedAt: now });
+      const refresher = deps.path.join(
+        deps.path.dirname(fileURLToPath(import.meta.url)),
+        "update-notice-refresh.mjs",
+      );
+      const child = deps.spawn(
+        process.execPath,
+        [refresher, cachePath(deps)],
+        { detached: true, stdio: "ignore", windowsHide: true },
+      );
+      if (child && typeof child.unref === "function") child.unref();
+      out.spawned = true;
+    }
+  } catch {
+    /* fail-open: a broken cache or spawn must never affect the CLI */
+  }
+  return out;
+}
+
+/**
+ * One cache refresh (used by the detached child; exported for tests).
+ * npm registry only — light, unauthenticated, no GitHub rate-limit risk.
+ */
+export async function refreshCacheOnce({
+  cacheFile,
+  fetchImpl = fetch,
+  deps = _deps,
+  now = Date.now(),
+  timeoutMs = 10_000,
+} = {}) {
+  const ctrl = new AbortController();
+  const timer = setTimeout(() => ctrl.abort(), timeoutMs);
+  try {
+    const res = await fetchImpl(NPM_LATEST_URL, {
+      headers: { Accept: "application/json" },
+      signal: ctrl.signal,
+    });
+    if (!res.ok) throw new Error(`HTTP ${res.status}`);
+    const data = await res.json();
+    if (!data?.version) throw new Error("no version field");
+    const file = cacheFile || cachePath(deps);
+    deps.fs.mkdirSync(deps.path.dirname(file), { recursive: true });
+    deps.fs.writeFileSync(
+      file,
+      JSON.stringify({ checkedAt: now, latest: data.version }),
+      "utf-8",
+    );
+    return { ok: true, latest: data.version };
+  } catch (err) {
+    return { ok: false, error: err.message };
+  } finally {
+    clearTimeout(timer);
+  }
+}

package/src/repl/agent-repl.js

@@ -718,6 +718,18 @@ export async function startAgentRepl(options = {}) {
     } catch (_err) {
       // Non-critical
     }
+    // Resume recap (offline, extractive — no LLM): a quick "where were we"
+    // so the user doesn't have to scroll the old transcript.
+    try {
+      const { buildResumeRecap } = await import("../lib/repl-rewind.js");
+      const recap = buildResumeRecap(messages);
+      if (recap) {
+        logger.log(chalk.bold("Recap:"));
+        for (const line of recap) logger.log(chalk.gray(`  ${line}`));
+      }
+    } catch (_err) {
+      /* non-critical */
+    }
   }
 
   const getPrompt = () => {
@@ -737,6 +749,31 @@ export async function startAgentRepl(options = {}) {
   const { makeAtCompleter } = await import("../lib/repl-completer.js");
   const atCompleter = makeAtCompleter({
     cwd: process.cwd(),
+    // Keep in sync with the rl.on("line") handlers + /help below.
+    slashCommands: [
+      "/auto",
+      "/clear",
+      "/compact",
+      "/context",
+      "/cowork",
+      "/exit",
+      "/help",
+      "/mcp",
+      "/model",
+      "/output-style",
+      "/plan",
+      "/profile",
+      "/provider",
+      "/quit",
+      "/reindex",
+      "/rewind",
+      "/search",
+      "/session",
+      "/stats",
+      "/statusline",
+      "/sub-agents",
+      "/task",
+    ],
     getIdeOpenFiles: async () => {
       const exec = _adhocMcp?.externalToolExecutors?.mcp__ide__getOpenEditors;
       if (!exec || exec.kind !== "mcp" || !_adhocMcp?.mcpClient?.callTool) {
@@ -763,6 +800,53 @@ export async function startAgentRepl(options = {}) {
     completer: atCompleter,
   });
 
+  // Esc interrupt (Claude-Code parity): pressing Esc while a turn is in
+  // flight aborts the in-flight agentLoop through its existing AbortSignal
+  // seam (throwIfAborted at each iteration); partial conversation is kept.
+  // Idle Esc presses (no active turn) are ignored, and escape-prefixed key
+  // sequences (arrows etc.) never reach here as bare "escape".
+  let _turnAbort = null;
+  let _lastIdleEscAt = 0;
+  if (process.stdin.isTTY) {
+    process.stdin.on("keypress", (_str, key) => {
+      if (!key || key.name !== "escape" || key.meta) return;
+      if (_turnAbort) {
+        process.stdout.write(chalk.yellow("\n⎋ interrupting…\n"));
+        try {
+          _turnAbort.abort();
+        } catch {
+          /* already aborted */
+        }
+        _turnAbort = null;
+        return;
+      }
+      // Double-Esc while idle → rewind picker shortcut (Claude-Code parity);
+      // the actual rewind is `/rewind <n>` so stdin stays readline-owned.
+      const nowTs = Date.now();
+      if (nowTs - _lastIdleEscAt < 600) {
+        _lastIdleEscAt = 0;
+        import("../lib/repl-rewind.js")
+          .then(({ listUserTurns, renderTurnList }) => {
+            process.stdout.write(
+              chalk.bold("\nRewind — pick a user turn (newest first):\n"),
+            );
+            process.stdout.write(
+              `${renderTurnList(listUserTurns(messages))}\n`,
+            );
+            process.stdout.write(
+              chalk.gray(
+                "Run /rewind <n> to rewind the conversation (files: cc checkpoint restore).\n",
+              ),
+            );
+            prompt();
+          })
+          .catch(() => {});
+      } else {
+        _lastIdleEscAt = nowTs;
+      }
+    });
+  }
+
   logger.log(chalk.bold("\nChainlessChain Agent"));
   logger.log(
     chalk.gray(`Model: ${model}  Provider: ${provider}  CWD: ${process.cwd()}`),
@@ -847,13 +931,57 @@ export async function startAgentRepl(options = {}) {
 
   prompt();
 
-  rl.on("line", async (input) => {
+  // Steering (Claude-Code parity): typing while a turn is running QUEUES the
+  // line instead of racing a second concurrent turn; the queue drains FIFO
+  // when the current turn finishes.
+  let _processingLine = false;
+  const _pendingLines = [];
+  const handleLine = async (input) => {
     const trimmed = input.trim();
     if (!trimmed) {
       prompt();
       return;
     }
 
+    // `!` bash passthrough (Claude-Code parity): run the command right here —
+    // no LLM round-trip — and fold the output into the conversation context.
+    if (trimmed.startsWith("!") && trimmed.slice(1).trim()) {
+      try {
+        const { runBangCommand } = await import("../lib/repl-bang-memorize.js");
+        const res = runBangCommand(trimmed, { cwd: process.cwd() });
+        logger.log(chalk.gray(`$ ${res.cmd}`));
+        if (res.stdout) process.stdout.write(res.stdout.endsWith("\n") ? res.stdout : `${res.stdout}\n`);
+        if (res.stderr) process.stderr.write(chalk.red(res.stderr.endsWith("\n") ? res.stderr : `${res.stderr}\n`));
+        if (res.error) logger.error(`shell error: ${res.error.message}`);
+        logger.log(chalk.gray(`(exit ${res.exitCode})`));
+        messages.push(res.contextMessage);
+      } catch (err) {
+        logger.error(`! command failed: ${err.message}`);
+      }
+      prompt();
+      return;
+    }
+
+    // `#` quick-memorize (Claude-Code parity): append a note to the project
+    // cc.md (auto-loaded next session) and keep it active in this one.
+    if (trimmed.startsWith("#") && trimmed.slice(1).trim()) {
+      try {
+        const { appendMemoryNote } = await import("../lib/repl-bang-memorize.js");
+        const res = appendMemoryNote(trimmed, { cwd: process.cwd() });
+        messages.push({
+          role: "system",
+          content: `<memory-note source="${res.target}">${res.note}</memory-note>`,
+        });
+        logger.log(
+          chalk.green(`✔ remembered in ${res.target}${res.created ? " (created)" : ""}`),
+        );
+      } catch (err) {
+        logger.error(`# memorize failed: ${err.message}`);
+      }
+      prompt();
+      return;
+    }
+
     // Slash commands
     if (trimmed === "/exit" || trimmed === "/quit") {
       logger.log(chalk.gray("\nGoodbye!"));
@@ -863,6 +991,12 @@ export async function startAgentRepl(options = {}) {
 
     if (trimmed === "/help") {
       logger.log(chalk.bold("\nCommands:"));
+      logger.log(
+        `  ${chalk.cyan("! <cmd>")}     Run a shell command directly (output joins context)`,
+      );
+      logger.log(
+        `  ${chalk.cyan("# <note>")}    Remember a note in the project cc.md`,
+      );
       logger.log(`  ${chalk.cyan("/exit")}       Exit the agent`);
       logger.log(
         `  ${chalk.cyan("/model")}      Show/change model (/model <name>)`,
@@ -872,6 +1006,12 @@ export async function startAgentRepl(options = {}) {
       logger.log(
         `  ${chalk.cyan("/statusline")} Context-usage line on/off (/statusline [on|off])`,
       );
+      logger.log(
+        `  ${chalk.cyan("/context")}    Live context-window usage by role`,
+      );
+      logger.log(
+        `  ${chalk.cyan("/rewind")}     Rewind conversation to an earlier turn (double-Esc lists)`,
+      );
       logger.log(
         `  ${chalk.cyan("/compact")}    Smart compact (importance-based)`,
       );
@@ -1110,6 +1250,90 @@ export async function startAgentRepl(options = {}) {
       return;
     }
 
+    if (trimmed === "/rewind" || trimmed.startsWith("/rewind ")) {
+      try {
+        const { listUserTurns, rewindToTurn, renderTurnList } = await import(
+          "../lib/repl-rewind.js"
+        );
+        const arg = trimmed.slice("/rewind".length).trim();
+        if (!arg) {
+          logger.log(
+            chalk.bold("\nRewind — pick a user turn (newest first):"),
+          );
+          logger.log(renderTurnList(listUserTurns(messages)));
+          logger.log(
+            chalk.gray(
+              "Usage: /rewind <n>  (conversation only — restore files with `cc checkpoint restore`)",
+            ),
+          );
+        } else {
+          const res = rewindToTurn(messages, arg);
+          if (!res) {
+            logger.error(`No such turn: ${arg} — run /rewind to list.`);
+          } else {
+            logger.log(
+              chalk.yellow(
+                `⎌ rewound — dropped ${res.removed} message(s); edit and resend below`,
+              ),
+            );
+            prompt();
+            if (res.text) rl.write(res.text);
+            return;
+          }
+        }
+      } catch (err) {
+        logger.error(`/rewind failed: ${err.message}`);
+      }
+      prompt();
+      return;
+    }
+
+    if (trimmed === "/context") {
+      // Live-session twin of `cc context` (Claude-Code /context parity):
+      // bucket the CURRENT in-memory conversation by role against the model
+      // window. Reuses the same categorizer + estimator as the archived view.
+      try {
+        const { categorizeContext } = await import("../commands/context.js");
+        const { estimateTokens } = await import(
+          "../harness/prompt-compressor.js"
+        );
+        const { buckets, counts, total } = categorizeContext(
+          messages,
+          estimateTokens,
+        );
+        const window = getContextWindow(model, provider) || 0;
+        logger.log(chalk.bold("\nContext usage (live session):"));
+        const rows = [
+          ["system", buckets.system, counts.system],
+          ["user", buckets.user, counts.user],
+          ["assistant", buckets.assistant, counts.assistant],
+          ["tool", buckets.tool, counts.tool],
+          ["tool_calls", buckets.toolCalls, null],
+        ];
+        for (const [label, tok, n] of rows) {
+          if (!tok) continue;
+          const share = total ? Math.round((tok / total) * 100) : 0;
+          logger.log(
+            `  ${label.padEnd(11)}${String(tok).padStart(9)} tok ${String(share).padStart(3)}%${
+              n != null ? chalk.gray(`  (${n} msgs)`) : ""
+            }`,
+          );
+        }
+        const pct = window ? Math.round((total / window) * 100) : null;
+        logger.log(
+          `  ${"total".padEnd(11)}${String(total).padStart(9)} tok${
+            window
+              ? `  ${pct}% of ${window} (${Math.max(0, window - total)} left)`
+              : ""
+          }`,
+        );
+      } catch (err) {
+        logger.error(`/context failed: ${err.message}`);
+      }
+      prompt();
+      return;
+    }
+
     if (trimmed === "/compact") {
       if (_compressor && messages.length > 3) {
         const { messages: compacted, stats } = await _compressor.compress(
@@ -2024,7 +2248,9 @@ export async function startAgentRepl(options = {}) {
       } catch (_e) {
         /* goal binding is best-effort — fall back to defaultPrepareCall */
       }
+      _turnAbort = new AbortController();
       const { content: response, usageEvents } = await agentLoop(messages, {
+        signal: _turnAbort.signal,
         provider,
         model: activeModel,
         thinking,
@@ -2051,6 +2277,7 @@ export async function startAgentRepl(options = {}) {
         externalToolDescriptors: _adhocMcp?.externalToolDescriptors,
         chatFn: _fallbackChatFn,
       });
+      _turnAbort = null;
 
       if (sessionId && usageEvents?.length) {
         for (const ue of usageEvents) {
@@ -2176,6 +2403,16 @@ export async function startAgentRepl(options = {}) {
         }
       }
     } catch (err) {
+      _turnAbort = null;
+      // Esc interrupt: an aborted turn is normal flow, not an error — the
+      // partial conversation stays usable and queued lines still drain.
+      if (err?.name === "AbortError" || /abort/i.test(err?.message || "")) {
+        logger.log(
+          chalk.yellow("⎋ turn interrupted — partial progress kept"),
+        );
+        prompt();
+        return;
+      }
       logger.error(`Error: ${err.message}`);
 
       // Record error for context injection
@@ -2199,6 +2436,31 @@ export async function startAgentRepl(options = {}) {
     }
 
     prompt();
+  };
+
+  rl.on("line", async (input) => {
+    if (_processingLine) {
+      if (input.trim()) {
+        _pendingLines.push(input);
+        logger.log(
+          chalk.gray(
+            `⏸ queued (${_pendingLines.length}) — runs after the current turn`,
+          ),
+        );
+      }
+      return;
+    }
+    _processingLine = true;
+    try {
+      await handleLine(input);
+      while (_pendingLines.length) {
+        const next = _pendingLines.shift();
+        logger.log(chalk.cyan(`▶ running queued input: ${next}`));
+        await handleLine(next);
+      }
+    } finally {
+      _processingLine = false;
+    }
   });
 
   rl.on("close", async () => {

package/src/runtime/agent-core.js

@@ -230,6 +230,25 @@ async function runSettingsPreToolUseHooks(name, args, context, cwd) {
     return { blocked: true, reason: outcome.reason, hook: outcome.hook };
   }
   if (outcome.decision === "ask") {
+    // File edits in an interactive session with an IDE bridge: route the ask
+    // through the editor's openDiff review (same machinery as settings ask —
+    // accepted means the IDE wrote the file, so the caller must skip
+    // execution; see tryIdeDiffApprovalForEdit).
+    const ide = await tryIdeDiffApprovalForEdit(name, args, context, cwd, {
+      rule: `hook:${outcome.hook}`,
+      source: "PreToolUse hook",
+    });
+    if (ide?.outcome === "accepted") {
+      return { blocked: false, ideApplied: ide.result };
+    }
+    if (ide?.outcome === "rejected") {
+      return {
+        blocked: true,
+        reason: ide.result.error,
+        hook: outcome.hook,
+        ideResult: ide.result,
+      };
+    }
     const confirm = context.permissionConfirm || context.shellConfirm || null;
     const ok =
       typeof confirm === "function"
@@ -603,6 +622,133 @@ export function buildSystemPrompt(cwd, opts = {}) {
 
 // ─── Tool execution ──────────────────────────────────────────────────────
 
+/** The file-mutating tools whose `ask` can be reviewed as an IDE diff. */
+const IDE_DIFF_EDIT_TOOLS = new Set([
+  "write_file",
+  "edit_file",
+  "edit_file_hashed",
+]);
+
+/**
+ * Compute the content an edit tool WOULD write, without writing it — the
+ * left/right sides for an IDE diff review. Mirrors the corresponding
+ * executeToolInner cases exactly (write_file / edit_file / edit_file_hashed,
+ * the latter via the same pure replaceByHash). Returns
+ * `{ filePath, newContent, originalText|null }` or null when the edit cannot
+ * be computed (missing file, anchor/old_string miss, bad args) — the caller
+ * then falls back to the normal confirmation path so the tool can produce its
+ * own diagnostics.
+ */
+export function computeProposedEdit(name, args = {}, cwd = process.cwd()) {
+  try {
+    if (!args.path) return null;
+    const filePath = path.resolve(cwd, args.path);
+    if (name === "write_file") {
+      if (typeof args.content !== "string") return null;
+      const originalText = fs.existsSync(filePath)
+        ? fs.readFileSync(filePath, "utf8")
+        : "";
+      return { filePath, newContent: args.content, originalText };
+    }
+    if (name === "edit_file") {
+      if (!fs.existsSync(filePath)) return null;
+      const content = fs.readFileSync(filePath, "utf8");
+      if (
+        typeof args.old_string !== "string" ||
+        !content.includes(args.old_string)
+      ) {
+        return null;
+      }
+      return {
+        filePath,
+        newContent: content.replace(args.old_string, args.new_string),
+        originalText: content,
+      };
+    }
+    if (name === "edit_file_hashed") {
+      if (!fs.existsSync(filePath)) return null;
+      if (!args.anchor_hash || typeof args.new_line !== "string") return null;
+      const original = fs.readFileSync(filePath, "utf8");
+      const result = replaceByHash(original, {
+        anchorHash: args.anchor_hash,
+        expectedLine: args.expected_line,
+        newLine: args.new_line,
+      });
+      if (!result.success) return null;
+      return { filePath, newContent: result.content, originalText: original };
+    }
+  } catch {
+    // unreadable file etc. → no proposal, normal path handles it
+  }
+  return null;
+}
+
+/**
+ * Shared IDE-diff approval routing for an `ask` decision about a file edit
+ * (used by BOTH the settings-rules ask and the PreToolUse-hook ask). Returns
+ *   { outcome:"accepted", result }  — the IDE wrote the file; the caller MUST
+ *                                     return `result` and skip execution
+ *   { outcome:"rejected", result }  — deny with `result`, file untouched
+ *   null                            — not applicable (non-edit tool, headless,
+ *                                     no IDE, disabled, no proposal, IDE died)
+ *                                     → caller falls back to its own confirm.
+ */
+async function tryIdeDiffApprovalForEdit(
+  name,
+  args,
+  context,
+  cwd,
+  { rule, source } = {},
+) {
+  if (!IDE_DIFF_EDIT_TOOLS.has(name)) return null;
+  if (typeof context.permissionConfirm !== "function") return null; // interactive only
+  if (!context.mcpClient || !context.externalToolExecutors) return null;
+  try {
+    const { ideDiffApprovalEnabled, hasIdeOpenDiff, requestIdeDiffApproval } =
+      await import("../lib/ide-context.js");
+    const mcpLike = {
+      mcpClient: context.mcpClient,
+      externalToolExecutors: context.externalToolExecutors,
+    };
+    if (!ideDiffApprovalEnabled() || !hasIdeOpenDiff(mcpLike)) return null;
+    const proposal = computeProposedEdit(name, args, cwd);
+    if (!proposal) return null;
+    const verdict = await requestIdeDiffApproval(mcpLike, {
+      path: proposal.filePath,
+      modifiedText: proposal.newContent,
+      originalText: proposal.originalText,
+      title: `cc agent: ${name} ${path.basename(proposal.filePath)}`,
+    });
+    if (verdict?.outcome === "accepted") {
+      return {
+        outcome: "accepted",
+        result: {
+          success: true,
+          path: proposal.filePath,
+          appliedVia: "ide-diff",
+          ...(verdict.finalText != null &&
+          verdict.finalText !== proposal.newContent
+            ? { userEdited: true }
+            : {}),
+          policy: { decision: "allow", rule, via: "ide-diff" },
+        },
+      };
+    }
+    if (verdict?.outcome === "rejected") {
+      return {
+        outcome: "rejected",
+        result: {
+          error: `[Permission] "${name}" was rejected in the IDE diff review (${source}: ${rule}).`,
+          policy: { decision: "deny", rule, via: "ide-diff" },
+        },
+      };
+    }
+  } catch (_err) {
+    // diff-approval routing is best-effort — fall back to the normal confirm
+  }
+  return null;
+}
+
 /**
  * Execute a single tool call with plan-mode filtering and hook pipeline.
  *
@@ -719,6 +865,17 @@ export async function executeTool(name, args, context = {}) {
   // 3 + 4. settings ask / allow (only reached when neither layer denied)
   let ruleAllowed = false;
   if (settingsVerdict.decision === "ask") {
+    // IDE-native diff approval (Claude-Code parity): for file edits in an
+    // interactive session with an IDE bridge connected, review the edit in
+    // the editor instead of a terminal y/N. Accepted = the IDE wrote the
+    // file → return the synthetic result and SKIP execution; rejected =
+    // deny; null = fall through to the normal confirm below. Shared with the
+    // PreToolUse-hook ask path (tryIdeDiffApprovalForEdit).
+    const ide = await tryIdeDiffApprovalForEdit(name, args, context, cwd, {
+      rule: settingsVerdict.rule,
+      source: "settings rule",
+    });
+    if (ide) return ide.result;
     const confirm = context.permissionConfirm || context.shellConfirm || null;
     const ok =
       typeof confirm === "function"
@@ -792,7 +949,12 @@ export async function executeTool(name, args, context = {}) {
   }
   if (context.settingsHooks) {
     const pre = await runSettingsPreToolUseHooks(name, args, context, cwd);
+    // A hook `ask` resolved by the IDE diff review: accepted → the IDE
+    // already wrote the file, return the synthetic result and skip the tool;
+    // rejected → the ide-diff deny shape (via:"ide-diff", not via:"hook").
+    if (pre.ideApplied) return pre.ideApplied;
     if (pre.blocked) {
+      if (pre.ideResult) return pre.ideResult;
       return {
         error: `[Hook] PreToolUse blocked "${name}"${pre.reason ? ": " + pre.reason : ""}`,
         policy: { decision: "block", via: "hook", hook: pre.hook || null },