deepy-cli 0.2.23__tar.gz → 0.2.24__tar.gz

{deepy_cli-0.2.23 → deepy_cli-0.2.24}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: deepy-cli
-Version: 0.2.23
+Version: 0.2.24
 Summary: Deepy - Vibe coding for DeepSeek models in your terminal
 Keywords: deepseek,coding-agent,terminal,cli,agents
 Author: kirineko
@@ -327,10 +327,18 @@ compact_trigger_ratio = 0.8
 reserved_context_tokens = 50000
 compact_preserve_recent_messages = 2
 
+[audit]
+mode = "yolo" # normal, auto, or yolo
+
 [ui]
 theme = "dark" # dark or light
 ```
 
+Audit modes control side-effect approval. `normal` asks before managed text
+writes, shell commands, background task stops, and MCP tool calls. `auto`
+auto-approves managed text writes but still asks for commands and untrusted MCP
+tools. `yolo` preserves the high-autonomy default.
+
 Manual configuration commands:
 
 ```bash

{deepy_cli-0.2.23 → deepy_cli-0.2.24}/README.md

@@ -295,10 +295,18 @@ compact_trigger_ratio = 0.8
 reserved_context_tokens = 50000
 compact_preserve_recent_messages = 2
 
+[audit]
+mode = "yolo" # normal, auto, or yolo
+
 [ui]
 theme = "dark" # dark or light
 ```
 
+Audit modes control side-effect approval. `normal` asks before managed text
+writes, shell commands, background task stops, and MCP tool calls. `auto`
+auto-approves managed text writes but still asks for commands and untrusted MCP
+tools. `yolo` preserves the high-autonomy default.
+
 Manual configuration commands:
 
 ```bash

{deepy_cli-0.2.23 → deepy_cli-0.2.24}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "deepy-cli"
-version = "0.2.23"
+version = "0.2.24"
 description = "Deepy - Vibe coding for DeepSeek models in your terminal"
 readme = "README.md"
 authors = [

{deepy_cli-0.2.23 → deepy_cli-0.2.24}/src/deepy/__init__.py

@@ -1,6 +1,6 @@
 from __future__ import annotations
 
-__version__ = "0.2.23"
+__version__ = "0.2.24"
 
 
 def main() -> None:

deepy_cli-0.2.24/src/deepy/audit.py

@@ -0,0 +1,158 @@
+from __future__ import annotations
+
+from collections.abc import Callable, Mapping
+from dataclasses import dataclass, field
+from enum import StrEnum
+from typing import Any, Literal, cast
+
+
+class AuditMode(StrEnum):
+    NORMAL = "normal"
+    AUTO = "auto"
+    YOLO = "yolo"
+
+
+AUDIT_MODES = {mode.value for mode in AuditMode}
+DEFAULT_AUDIT_MODE = AuditMode.YOLO
+AuditAction = Literal["text_write", "command", "background_task_control", "mcp_tool"]
+ApprovalOutcome = Literal["approve", "reject"]
+
+
+def parse_audit_mode(value: object, *, default: AuditMode = DEFAULT_AUDIT_MODE) -> AuditMode:
+    if isinstance(value, AuditMode):
+        return value
+    if isinstance(value, str):
+        normalized = value.strip().lower()
+        if normalized in AUDIT_MODES:
+            return AuditMode(normalized)
+    return default
+
+
+def is_valid_audit_mode(value: str) -> bool:
+    return value in AUDIT_MODES
+
+
+def next_audit_mode(mode: AuditMode | str) -> AuditMode:
+    current = parse_audit_mode(mode)
+    order = (AuditMode.NORMAL, AuditMode.AUTO, AuditMode.YOLO)
+    index = order.index(current)
+    return order[(index + 1) % len(order)]
+
+
+@dataclass
+class AuditModeState:
+    mode: AuditMode = DEFAULT_AUDIT_MODE
+
+    @classmethod
+    def from_value(cls, value: object) -> "AuditModeState":
+        return cls(parse_audit_mode(value))
+
+    def set(self, value: AuditMode | str) -> AuditMode:
+        self.mode = parse_audit_mode(value, default=self.mode)
+        return self.mode
+
+    def cycle(self) -> AuditMode:
+        self.mode = next_audit_mode(self.mode)
+        return self.mode
+
+
+@dataclass(frozen=True)
+class McpSafeTool:
+    server: str
+    tool: str
+
+    @classmethod
+    def from_mapping(cls, value: Mapping[str, Any]) -> "McpSafeTool | None":
+        server = value.get("server")
+        tool = value.get("tool")
+        if not isinstance(server, str) or not server.strip():
+            return None
+        if not isinstance(tool, str) or not tool.strip():
+            return None
+        return cls(server=server.strip(), tool=tool.strip())
+
+
+@dataclass(frozen=True)
+class AuditConfig:
+    mode: AuditMode = DEFAULT_AUDIT_MODE
+    mcp_safe_tools: tuple[McpSafeTool, ...] = ()
+    invalid_mode: str | None = None
+
+    @classmethod
+    def from_mapping(cls, raw: Mapping[str, Any]) -> "AuditConfig":
+        raw_mode = raw.get("mode")
+        mode = parse_audit_mode(raw_mode)
+        invalid_mode = (
+            str(raw_mode)
+            if isinstance(raw_mode, str) and raw_mode.strip() and raw_mode.strip().lower() not in AUDIT_MODES
+            else None
+        )
+        safe_tools: list[McpSafeTool] = []
+        for item in _safe_tool_entries(raw.get("mcp_safe_tools")):
+            parsed = McpSafeTool.from_mapping(item)
+            if parsed is not None:
+                safe_tools.append(parsed)
+        return cls(mode=mode, mcp_safe_tools=tuple(safe_tools), invalid_mode=invalid_mode)
+
+    def is_mcp_tool_safe(self, server: str, tool: str) -> bool:
+        return any(entry.server == server and entry.tool == tool for entry in self.mcp_safe_tools)
+
+
+@dataclass
+class AuditPolicy:
+    mode_getter: Callable[[], AuditMode]
+    config: AuditConfig = field(default_factory=AuditConfig)
+
+    @classmethod
+    def from_mode(cls, mode: AuditMode | str, config: AuditConfig | None = None) -> "AuditPolicy":
+        parsed = parse_audit_mode(mode)
+        return cls(lambda: parsed, config=config or AuditConfig(mode=parsed))
+
+    def active_mode(self) -> AuditMode:
+        return parse_audit_mode(self.mode_getter())
+
+    def needs_approval(self, action: AuditAction) -> bool:
+        mode = self.active_mode()
+        if mode == AuditMode.YOLO:
+            return False
+        if mode == AuditMode.NORMAL:
+            return action in {"text_write", "command", "background_task_control", "mcp_tool"}
+        if mode == AuditMode.AUTO:
+            return action in {"command", "background_task_control", "mcp_tool"}
+        return True
+
+    def needs_mcp_approval(self, *, server: str, tool: str) -> bool:
+        mode = self.active_mode()
+        if mode == AuditMode.YOLO:
+            return False
+        if mode == AuditMode.AUTO and self.config.is_mcp_tool_safe(server, tool):
+            return False
+        return True
+
+
+@dataclass(frozen=True)
+class PendingApproval:
+    index: int
+    name: str
+    tool_name: str
+    arguments: str
+    agent_name: str = ""
+    action_kind: str = "tool"
+    server_name: str = ""
+
+
+@dataclass(frozen=True)
+class ApprovalDecision:
+    outcome: ApprovalOutcome
+    always: bool = False
+    rejection_message: str | None = None
+
+
+def _safe_tool_entries(value: object) -> list[Mapping[str, Any]]:
+    if not isinstance(value, list):
+        return []
+    entries: list[Mapping[str, Any]] = []
+    for item in value:
+        if isinstance(item, Mapping):
+            entries.append(cast(Mapping[str, Any], item))
+    return entries

{deepy_cli-0.2.23 → deepy_cli-0.2.24}/src/deepy/config/__init__.py

@@ -47,6 +47,7 @@ from .settings import (
     is_valid_ui_theme,
     is_valid_ui_view_mode,
     is_valid_reasoning_mode,
+    is_valid_config_audit_mode,
     load_settings,
     mask_secret,
     provider_info_for,
@@ -54,6 +55,7 @@ from .settings import (
     settings_to_toml_dict,
     thinking_modes_for_provider,
     update_config_model_settings,
+    update_config_audit_mode,
     update_config_input_suggestions_enabled,
     update_config_theme,
     update_config_view_mode,
@@ -109,6 +111,7 @@ __all__ = [
     "is_valid_ui_theme",
     "is_valid_ui_view_mode",
     "is_valid_reasoning_mode",
+    "is_valid_config_audit_mode",
     "load_settings",
     "mask_secret",
     "provider_info_for",
@@ -116,6 +119,7 @@ __all__ = [
     "settings_to_toml_dict",
     "thinking_modes_for_provider",
     "update_config_model_settings",
+    "update_config_audit_mode",
     "update_config_input_suggestions_enabled",
     "update_config_theme",
     "update_config_view_mode",

{deepy_cli-0.2.23 → deepy_cli-0.2.24}/src/deepy/config/settings.py

@@ -9,6 +9,8 @@ from typing import Any, Mapping, Self
 
 import tomli_w
 
+from deepy.audit import AuditConfig, AuditMode, DEFAULT_AUDIT_MODE, is_valid_audit_mode
+
 DEFAULT_MODEL = "deepseek-v4-pro"
 DEFAULT_BASE_URL = "https://api.deepseek.com"
 DEFAULT_CONTEXT_WINDOW_TOKENS = 1_048_576
@@ -595,6 +597,7 @@ class UiConfig:
 
 @dataclass(frozen=True)
 class Settings:
+    audit: AuditConfig = field(default_factory=AuditConfig)
     model: ModelConfig = field(default_factory=ModelConfig)
     context: ContextConfig = field(default_factory=ContextConfig)
     logging: LoggingConfig = field(default_factory=LoggingConfig)
@@ -613,6 +616,7 @@ class Settings:
         env: Mapping[str, str] | None = None,
     ) -> Self:
         return cls(
+            audit=AuditConfig.from_mapping(_as_mapping(raw.get("audit"))),
             model=ModelConfig.from_mapping(_as_mapping(raw.get("model")), env=env),
             context=ContextConfig.from_mapping(_as_mapping(raw.get("context"))),
             logging=LoggingConfig.from_mapping(_as_mapping(raw.get("logging"))),
@@ -646,6 +650,14 @@ def settings_to_toml_dict(settings: Settings, *, reveal_secret: bool = False) ->
     data.pop("path", None)
     if "ui" in data:
         data["ui"].pop("theme_configured", None)
+    if "audit" in data:
+        data["audit"].pop("invalid_mode", None)
+        if "mode" in data["audit"] and isinstance(settings.audit.mode, AuditMode):
+            data["audit"]["mode"] = settings.audit.mode.value
+        if "mcp_safe_tools" in data["audit"]:
+            data["audit"]["mcp_safe_tools"] = [
+                {"server": item.server, "tool": item.tool} for item in settings.audit.mcp_safe_tools
+            ]
     api_key = settings.model.api_key
     if api_key:
         data["model"]["api_key"] = api_key if reveal_secret else mask_secret(api_key)
@@ -661,6 +673,10 @@ def is_valid_ui_view_mode(value: str) -> bool:
     return value in UI_VIEW_MODES
 
 
+def is_valid_config_audit_mode(value: str) -> bool:
+    return is_valid_audit_mode(value)
+
+
 def is_supported_deepseek_model(value: str) -> bool:
     return value in SUPPORTED_DEEPSEEK_MODELS
 
@@ -734,6 +750,10 @@ def write_config(
             "thinking": thinking_enabled_for_mode(mode, provider),
             "reasoning_effort": reasoning_effort_for_mode(mode, provider),
         },
+        "audit": {
+            "mode": DEFAULT_AUDIT_MODE.value,
+            "mcp_safe_tools": [],
+        },
         "context": {
             "window_tokens": DEFAULT_CONTEXT_WINDOW_TOKENS,
             "compact_trigger_ratio": DEFAULT_COMPACT_TRIGGER_RATIO,
@@ -873,6 +893,20 @@ def update_config_view_mode(config_path: Path, view_mode: str) -> None:
     _write_private_toml(path, raw)
 
 
+def update_config_audit_mode(config_path: Path, audit_mode: str) -> None:
+    if not is_valid_config_audit_mode(audit_mode):
+        raise ValueError("Audit mode must be one of: normal, auto, yolo.")
+    path = config_path.expanduser()
+    if path.suffix == ".json":
+        raise ValueError("Deepy only supports TOML config files; JSON config is not supported.")
+    raw = _read_toml_mapping(path)
+    audit = raw.get("audit")
+    audit_map = dict(audit) if isinstance(audit, Mapping) else {}
+    audit_map["mode"] = audit_mode
+    raw["audit"] = audit_map
+    _write_private_toml(path, raw)
+
+
 def _read_toml_mapping(path: Path) -> dict[str, Any]:
     if not path.exists():
         return {}

{deepy_cli-0.2.23 → deepy_cli-0.2.24}/src/deepy/llm/agent.py

@@ -3,6 +3,7 @@ from __future__ import annotations
 from pathlib import Path
 from typing import TYPE_CHECKING, Any
 
+from deepy.audit import AuditPolicy
 from deepy.config import Settings
 from deepy.mcp import sdk_mcp_tool_name
 from deepy.prompts import build_system_prompt
@@ -28,6 +29,7 @@ def build_deepy_agent(
     mcp_servers: list[MCPServer] | None = None,
     preferred_mcp_web_search_tools: list[str] | None = None,
     emit_event: Any | None = None,
+    audit_policy: AuditPolicy | None = None,
 ):
     from agents import Agent
 
@@ -39,6 +41,7 @@ def build_deepy_agent(
             settings.model.name,
         ),
         preferred_mcp_web_search_tools=preferred_mcp_web_search_tools,
+        audit_policy=audit_policy,
     )
     subagent_tools = build_subagent_tools(
         settings,
@@ -52,6 +55,7 @@ def build_deepy_agent(
             settings.model.name,
         ),
         emit_event=emit_event,
+        audit_policy=audit_policy,
     )
     return Agent(
         name="Deepy",
@@ -89,6 +93,7 @@ def build_subagent_tools(
     preferred_mcp_web_search_tools: list[str],
     mimo_schema_compatibility: bool = False,
     emit_event: Any | None = None,
+    audit_policy: AuditPolicy | None = None,
 ) -> list[Any]:
     from agents import Agent
 
@@ -105,6 +110,7 @@ def build_subagent_tools(
                 mimo_schema_compatibility=mimo_schema_compatibility,
                 preferred_mcp_web_search_tools=preferred_mcp_web_search_tools,
                 include_tools=set(definition.tools),
+                audit_policy=audit_policy,
             ),
             mcp_servers=_search_mcp_servers_for_subagent(
                 definition,

{deepy_cli-0.2.23 → deepy_cli-0.2.24}/src/deepy/llm/runner.py

@@ -2,12 +2,14 @@ from __future__ import annotations
 
 import asyncio
 import contextlib
+import inspect
 import time
-from collections.abc import Callable
+from collections.abc import Awaitable, Callable
 from dataclasses import dataclass, field
 from pathlib import Path
-from typing import Any, Literal
+from typing import Any, Literal, cast
 
+from deepy.audit import ApprovalDecision, AuditMode, AuditModeState, AuditPolicy, PendingApproval, parse_audit_mode
 from deepy.config import Settings, load_settings
 from deepy.sessions import DeepySession
 from deepy.skills import find_skill
@@ -65,6 +67,12 @@ async def run_prompt_once(
     background_tasks: BackgroundTaskManager | None = None,
     should_interrupt: Callable[[], bool] | None = None,
     cancel_mode: Literal["immediate", "after_turn"] = "immediate",
+    audit_mode: AuditMode | str | AuditModeState | None = None,
+    approval_resolver: Callable[
+        [list[PendingApproval]],
+        list[ApprovalDecision] | Awaitable[list[ApprovalDecision]],
+    ]
+    | None = None,
 ) -> RunSummary:
     from agents import RunConfig, Runner
     from agents.exceptions import MaxTurnsExceeded, ModelBehaviorError
@@ -73,6 +81,10 @@ async def run_prompt_once(
     root = (project_root or Path.cwd()).resolve()
     resolved_settings = settings or load_settings()
     resolved_provider = provider or build_provider_bundle(resolved_settings)
+    audit_state = audit_mode if isinstance(audit_mode, AuditModeState) else AuditModeState(
+        parse_audit_mode(audit_mode, default=resolved_settings.audit.mode)
+    )
+    audit_policy = AuditPolicy(lambda: audit_state.mode, resolved_settings.audit)
     session = DeepySession.open(root, session_id) if session_id else DeepySession.create(root)
     initial_todos, _ = normalize_todo_items(session.todo_state())
     runtime = ToolRuntime(
@@ -84,7 +96,11 @@ async def run_prompt_once(
     )
     created_mcp_runtime: DeepyMcpRuntime | None = None
     if mcp_runtime is None:
-        created_mcp_runtime = DeepyMcpRuntime(resolved_settings, project_root=root)
+        created_mcp_runtime = DeepyMcpRuntime(
+            resolved_settings,
+            project_root=root,
+            audit_policy=audit_policy,
+        )
         mcp_runtime = created_mcp_runtime
         await mcp_runtime.connect()
     loaded_skills = _resolve_loaded_skills(root, prompt, skill_names)
@@ -97,6 +113,7 @@ async def run_prompt_once(
         mcp_servers=mcp_runtime.active_servers,
         preferred_mcp_web_search_tools=mcp_runtime.preferred_web_search_tools,
         emit_event=emit_event,
+        audit_policy=audit_policy,
     )
     prefix_snapshot = build_cache_prefix_snapshot(
         resolved_settings,
@@ -158,49 +175,74 @@ async def run_prompt_once(
     prefix_token: Any | None = None
     try:
         prefix_token = set_current_cache_prefix_snapshot(prefix_snapshot)
-        result = Runner.run_streamed(
-            agent,
-            input=prompt,
-            max_turns=max_turns,
-            run_config=run_config,
-            session=session,  # ty: ignore[invalid-argument-type] - DeepySession matches the SDK Session protocol at runtime.
-        )
-        if should_interrupt is not None:
-            interrupt_task = asyncio.create_task(
-                _watch_stream_interrupt(
-                    result,
-                    should_interrupt=should_interrupt,
-                    cancel_mode=cancel_mode,
-                )
+        run_input: Any = prompt
+        while True:
+            result = Runner.run_streamed(
+                agent,
+                input=run_input,
+                max_turns=max_turns,
+                run_config=run_config,
+                session=session,  # ty: ignore[invalid-argument-type] - DeepySession matches the SDK Session protocol at runtime.
             )
-        async for event in result.stream_events():
-            if should_interrupt is not None and should_interrupt():
-                _cancel_stream_result(result, mode=cancel_mode)
-                interrupted = True
-                break
-            normalized = normalize_stream_event(event)
-            if normalized is None:
-                continue
-            if normalized.kind == "usage":
-                usage = merge_usage(usage, normalize_usage(normalized.payload.get("usage")))
-            if emit_event is not None:
-                emit_event(normalized)
-            if normalized.kind == "tool_output":
-                questions = _pending_questions_from_tool_output(normalized.text)
-                if questions:
-                    pending_questions = questions
-                    waiting_for_user = True
-                    _cancel_stream_result(result, mode="after_turn")
+            if should_interrupt is not None:
+                interrupt_task = asyncio.create_task(
+                    _watch_stream_interrupt(
+                        result,
+                        should_interrupt=should_interrupt,
+                        cancel_mode=cancel_mode,
+                    )
+                )
+            async for event in result.stream_events():
+                if should_interrupt is not None and should_interrupt():
+                    _cancel_stream_result(result, mode=cancel_mode)
+                    interrupted = True
                     break
-            if normalized.kind != "text_delta" or not normalized.text:
-                continue
-            chunks.append(normalized.text)
-            if emit is not None:
-                emit(normalized.text)
-            if should_interrupt is not None and should_interrupt():
-                _cancel_stream_result(result, mode=cancel_mode)
-                interrupted = True
+                normalized = normalize_stream_event(event)
+                if normalized is None:
+                    continue
+                if normalized.kind == "usage":
+                    usage = merge_usage(usage, normalize_usage(normalized.payload.get("usage")))
+                if emit_event is not None:
+                    emit_event(normalized)
+                if normalized.kind == "tool_output":
+                    questions = _pending_questions_from_tool_output(normalized.text)
+                    if questions:
+                        pending_questions = questions
+                        waiting_for_user = True
+                        _cancel_stream_result(result, mode="after_turn")
+                        break
+                if normalized.kind != "text_delta" or not normalized.text:
+                    continue
+                chunks.append(normalized.text)
+                if emit is not None:
+                    emit(normalized.text)
+                if should_interrupt is not None and should_interrupt():
+                    _cancel_stream_result(result, mode=cancel_mode)
+                    interrupted = True
+                    break
+            interrupted = interrupted or await _finish_interrupt_task(interrupt_task)
+            interrupt_task = None
+            if interrupted or waiting_for_user:
                 break
+            interruptions = list(getattr(result, "interruptions", []) or [])
+            if not interruptions:
+                break
+            state = result.to_state()
+            decisions = await _approval_decisions(
+                interruptions,
+                approval_resolver=approval_resolver,
+            )
+            for interruption, decision in zip(interruptions, decisions, strict=False):
+                if decision.outcome == "approve":
+                    state.approve(interruption, always_approve=decision.always)
+                else:
+                    state.reject(
+                        interruption,
+                        always_reject=decision.always,
+                        rejection_message=decision.rejection_message
+                        or "Tool execution was rejected by the user audit approval decision.",
+                    )
+            run_input = state
         if prefix_token is not None:
             reset_current_cache_prefix_snapshot(prefix_token)
             prefix_token = None
@@ -375,6 +417,123 @@ async def _cleanup_created_mcp(mcp_runtime: DeepyMcpRuntime | None) -> None:
         await mcp_runtime.cleanup()
 
 
+async def _approval_decisions(
+    interruptions: list[Any],
+    *,
+    approval_resolver: Callable[
+        [list[PendingApproval]],
+        list[ApprovalDecision] | Awaitable[list[ApprovalDecision]],
+    ]
+    | None,
+) -> list[ApprovalDecision]:
+    pending = [_pending_approval_from_interruption(index, item) for index, item in enumerate(interruptions)]
+    if approval_resolver is None:
+        return [
+            ApprovalDecision(
+                outcome="reject",
+                rejection_message="Tool execution requires audit approval, but no approval UI is available.",
+            )
+            for _ in pending
+        ]
+    resolved = approval_resolver(pending)
+    if inspect.isawaitable(resolved):
+        resolved = await resolved
+    decisions = list(cast(list[ApprovalDecision], resolved))
+    if len(decisions) < len(pending):
+        decisions = [
+            *decisions,
+            *[
+                ApprovalDecision(
+                    outcome="reject",
+                    rejection_message="Tool execution was rejected because no audit decision was provided.",
+                )
+                for _ in range(len(pending) - len(decisions))
+            ],
+        ]
+    return decisions[: len(pending)]
+
+
+def _pending_approval_from_interruption(index: int, item: Any) -> PendingApproval:
+    raw_item = getattr(item, "raw_item", None)
+    tool_name = _approval_tool_name(item, raw_item)
+    arguments = _approval_arguments(item, raw_item)
+    agent = getattr(item, "agent", None)
+    agent_name = str(getattr(agent, "name", "") or "")
+    server_name = _approval_server_name(raw_item, tool_name)
+    return PendingApproval(
+        index=index,
+        name=str(getattr(item, "name", "") or tool_name or "tool"),
+        tool_name=tool_name,
+        arguments=arguments,
+        agent_name=agent_name,
+        action_kind="mcp_tool" if server_name else _approval_action_kind(tool_name),
+        server_name=server_name,
+    )
+
+
+def _approval_tool_name(item: Any, raw_item: Any) -> str:
+    for value in (
+        getattr(item, "tool_name", None),
+        getattr(item, "name", None),
+        getattr(raw_item, "name", None),
+    ):
+        if isinstance(value, str) and value:
+            return value
+    if isinstance(raw_item, dict):
+        value = raw_item.get("name")
+        if isinstance(value, str):
+            return value
+        function = raw_item.get("function")
+        if isinstance(function, dict) and isinstance(function.get("name"), str):
+            return function["name"]
+    return ""
+
+
+def _approval_arguments(item: Any, raw_item: Any) -> str:
+    for value in (getattr(item, "arguments", None), getattr(raw_item, "arguments", None)):
+        if isinstance(value, str):
+            return value
+    if isinstance(raw_item, dict):
+        value = raw_item.get("arguments")
+        if isinstance(value, str):
+            return value
+        function = raw_item.get("function")
+        if isinstance(function, dict) and isinstance(function.get("arguments"), str):
+            return function["arguments"]
+        arguments = raw_item.get("arguments_json") or raw_item.get("input")
+        if arguments is not None:
+            return json_utils.dumps(arguments)
+    arguments = getattr(raw_item, "arguments_json", None)
+    if arguments is not None:
+        return json_utils.dumps(arguments)
+    return ""
+
+
+def _approval_server_name(raw_item: Any, tool_name: str) -> str:
+    for attr in ("server_label", "server_name"):
+        value = getattr(raw_item, attr, None)
+        if isinstance(value, str) and value:
+            return value
+    if isinstance(raw_item, dict):
+        for key in ("server_label", "server_name"):
+            value = raw_item.get(key)
+            if isinstance(value, str) and value:
+                return value
+    if "__" in tool_name:
+        return tool_name.split("__", 1)[0]
+    return ""
+
+
+def _approval_action_kind(tool_name: str) -> str:
+    if tool_name in {"Write", "Update"}:
+        return "text_write"
+    if tool_name == "shell":
+        return "command"
+    if tool_name == "task_stop":
+        return "background_task_control"
+    return "tool"
+
+
 def _resolve_loaded_skills(
     root: Path,
     prompt: str,