mycode-cli 0.6.0__tar.gz → 0.7.0__tar.gz

{mycode_cli-0.6.0 → mycode_cli-0.7.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mycode-cli
-Version: 0.6.0
+Version: 0.7.0
 Summary: Minimal coding agent CLI and web UI built on mycode-sdk.
 Project-URL: Homepage, https://github.com/legibet/mycode
 Project-URL: Repository, https://github.com/legibet/mycode
@@ -22,7 +22,7 @@ Classifier: Programming Language :: Python :: 3.13
 Classifier: Topic :: Software Development
 Requires-Python: >=3.12
 Requires-Dist: fastapi>=0.115.0
-Requires-Dist: mycode-sdk==0.6.0
+Requires-Dist: mycode-sdk==0.7.0
 Requires-Dist: prompt-toolkit>=3.0.52
 Requires-Dist: pyyaml>=6.0.0
 Requires-Dist: rich>=14.2.0

{mycode_cli-0.6.0 → mycode_cli-0.7.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "mycode-cli"
-version = "0.6.0"
+version = "0.7.0"
 description = "Minimal coding agent CLI and web UI built on mycode-sdk."
 requires-python = ">=3.12"
 license = "MIT"
@@ -26,7 +26,7 @@ classifiers = [
 ]
 keywords = ["agent", "cli", "llm", "coding-agent", "fastapi"]
 dependencies = [
-    "mycode-sdk==0.6.0",
+    "mycode-sdk==0.7.0",
     "fastapi>=0.115.0",
     "uvicorn[standard]>=0.32.0",
     "rich>=14.2.0",

{mycode_cli-0.6.0 → mycode_cli-0.7.0}/src/mycode_cli/config.py

@@ -8,7 +8,7 @@ import os
 import re
 from dataclasses import dataclass, field
 from pathlib import Path
-from typing import Any
+from typing import Any, Literal
 
 from mycode.models import resolve_model_metadata
 from mycode.providers import (
@@ -42,9 +42,14 @@ _API_KEY_ENV_REF_RE = re.compile(r"^\$\{([A-Za-z_][A-Za-z0-9_]*)\}$")
 # Full set of user-facing choices. "auto" means "do not send an explicit effort
 # to the provider" and is represented internally as `None` after normalization.
 REASONING_EFFORT_OPTIONS = ("auto", "none", "low", "medium", "high", "xhigh")
+PERMISSION_LEVEL_OPTIONS = ("readonly", "safe", "standard", "yolo")
+PERMISSION_MODE_OPTIONS = ("ask", "deny")
 _EFFORT_AUTO_ALIASES = frozenset({"", "auto", "default"})
 _EFFORT_OFF_ALIASES = frozenset({"off", "disabled"})
 
+PermissionLevel = Literal["readonly", "safe", "standard", "yolo"]
+PermissionMode = Literal["ask", "deny"]
+
 
 @dataclass(frozen=True)
 class ModelConfig:
@@ -66,6 +71,12 @@ class ProviderConfig:
     reasoning_effort: str | None = None
 
 
+@dataclass(frozen=True)
+class PermissionConfig:
+    level: PermissionLevel = "safe"
+    mode: PermissionMode = "ask"
+
+
 @dataclass(frozen=True)
 class Settings:
     providers: dict[str, ProviderConfig]
@@ -76,6 +87,7 @@ class Settings:
     workspace_root: str
     default_reasoning_effort: str | None = None
     compact_threshold: float | None = None
+    permission: PermissionConfig = field(default_factory=PermissionConfig)
     config_paths: list[str] = field(default_factory=list)
 
 
@@ -197,6 +209,39 @@ def normalize_reasoning_effort(value: Any) -> str | None:
     raise ValueError(f"unsupported reasoning_effort {value!r}; supported: {supported}")
 
 
+def normalize_permission_level(value: Any) -> PermissionLevel:
+    if not isinstance(value, str):
+        raise ValueError(f"permission level must be a string, got {type(value).__name__}")
+    level = value.strip().lower()
+    if level in PERMISSION_LEVEL_OPTIONS:
+        return level
+    supported = ", ".join(PERMISSION_LEVEL_OPTIONS)
+    raise ValueError(f"unsupported permission level {value!r}; supported: {supported}")
+
+
+def normalize_permission_mode(value: Any) -> PermissionMode:
+    if not isinstance(value, str):
+        raise ValueError(f"permission mode must be a string, got {type(value).__name__}")
+    mode = value.strip().lower()
+    if mode in PERMISSION_MODE_OPTIONS:
+        return mode
+    supported = ", ".join(PERMISSION_MODE_OPTIONS)
+    raise ValueError(f"unsupported permission mode {value!r}; supported: {supported}")
+
+
+def parse_permission(value: Any, current: PermissionConfig | None = None) -> PermissionConfig:
+    base = current or PermissionConfig()
+    if value is None:
+        return base
+    if isinstance(value, str):
+        return PermissionConfig(level=normalize_permission_level(value), mode=base.mode)
+    if isinstance(value, dict):
+        level = normalize_permission_level(value.get("level")) if "level" in value else base.level
+        mode = normalize_permission_mode(value.get("mode")) if "mode" in value else base.mode
+        return PermissionConfig(level=level, mode=mode)
+    raise ValueError(f"permission must be a string or object, got {type(value).__name__}")
+
+
 def _config_api_key_from_env_var(provider: ProviderConfig, *, require: bool = False) -> str | None:
     env_name = provider.api_key_env_var
     if not env_name:
@@ -267,6 +312,7 @@ def get_settings(cwd: str | None = None) -> Settings:
     default_model: str | None = None
     default_reasoning_effort: str | None = None
     compact_threshold: float | None = None
+    permission = PermissionConfig()
     config_paths: list[str] = []
 
     for path in _candidate_config_paths(resolved_cwd):
@@ -315,12 +361,16 @@ def get_settings(cwd: str | None = None) -> Settings:
                 if parsed_threshold is not None:
                     compact_threshold = parsed_threshold
 
+        if "permission" in data:
+            permission = parse_permission(data.get("permission"), permission)
+
     return Settings(
         providers=_build_providers(raw_providers),
         default_provider=default_provider,
         default_model=default_model,
         default_reasoning_effort=normalize_reasoning_effort(default_reasoning_effort),
         compact_threshold=compact_threshold,
+        permission=permission,
         port=int(os.environ.get("PORT", "8000")),
         cwd=resolved_cwd,
         workspace_root=str(workspace_root),

{mycode_cli-0.6.0 → mycode_cli-0.7.0}/src/mycode_cli/main.py

@@ -5,7 +5,7 @@ from __future__ import annotations
 import asyncio
 import os
 import sys
-from dataclasses import dataclass
+from dataclasses import dataclass, replace
 from typing import Annotated
 
 import typer
@@ -14,7 +14,15 @@ from mycode.agent import Agent
 from mycode.messages import ConversationMessage
 from mycode.session import SessionStore
 from mycode_cli import __version__
-from mycode_cli.config import ResolvedProvider, Settings, get_settings, resolve_provider, resolve_sessions_dir
+from mycode_cli.config import (
+    ResolvedProvider,
+    Settings,
+    get_settings,
+    parse_permission,
+    resolve_provider,
+    resolve_sessions_dir,
+)
+from mycode_cli.permissions import PERMISSION_DENIED_BY_USER_OUTPUT, PERMISSION_DENIED_OUTPUT
 
 from .runtime import ResolvedSession, build_agent, resolve_session
 from .tui.chat import TerminalChat
@@ -46,10 +54,10 @@ async def run_noninteractive(agent: Agent, message: str) -> int:
     async for event in agent.achat(message, on_persist=track):
         if event.type == "error":
             error_message = str(event.data.get("message") or "agent error")
-
-    if error_message:
-        print(error_message, file=sys.stderr)
-        return 1
+        elif event.type == "tool_done" and event.data.get("is_error"):
+            output = str(event.data.get("output") or "")
+            if output in {PERMISSION_DENIED_OUTPUT, PERMISSION_DENIED_BY_USER_OUTPUT}:
+                error_message = output
 
     reply = ""
     if latest_assistant:
@@ -63,6 +71,12 @@ async def run_noninteractive(agent: Agent, message: str) -> int:
         sys.stdout.write(reply)
         if not reply.endswith("\n"):
             sys.stdout.write("\n")
+
+    if error_message:
+        if not reply:
+            print(error_message, file=sys.stderr)
+        return 1
+
     return 0
 
 
@@ -83,6 +97,7 @@ def _bootstrap(
     session: str | None,
     continue_last: bool,
     max_turns: int | None,
+    permission: str | None,
 ) -> _BootstrapContext:
     """Shared setup for the chat and run commands."""
 
@@ -92,9 +107,10 @@ def _bootstrap(
     cwd = os.path.abspath(os.getcwd())
     store = SessionStore(data_dir=resolve_sessions_dir())
     view = TerminalView()
-    settings = get_settings(cwd)
-
     try:
+        settings = get_settings(cwd)
+        if permission is not None:
+            settings = replace(settings, permission=parse_permission(permission, settings.permission))
         resolved_provider = resolve_provider(settings, provider_name=provider, model=model)
         resolved_session = asyncio.run(
             resolve_session(
@@ -136,6 +152,10 @@ def chat(
     provider: Annotated[str | None, typer.Option(help="Provider id or configured alias")] = None,
     model: Annotated[str | None, typer.Option(help="Model name (overrides default)")] = None,
     max_turns: Annotated[int | None, typer.Option(min=1, help="Limit agent loop turns")] = None,
+    permission: Annotated[
+        str | None,
+        typer.Option("--permission", help="Permission level: readonly, safe, standard, yolo"),
+    ] = None,
     session: Annotated[str | None, typer.Option(help="Resume a specific session id")] = None,
     continue_last: Annotated[bool, typer.Option("--continue", "-c", help="Resume the most recent session")] = False,
     version: Annotated[
@@ -146,7 +166,6 @@ def chat(
             callback=_show_version,
             help="Show version and exit.",
             is_eager=True,
-            is_flag=True,
         ),
     ] = False,
 ) -> None:
@@ -164,6 +183,7 @@ def chat(
         session=session,
         continue_last=continue_last,
         max_turns=max_turns,
+        permission=permission,
     )
 
     setup.view.print_header(
@@ -197,6 +217,10 @@ def run(
     provider: Annotated[str | None, typer.Option(help="Provider id or configured alias")] = None,
     model: Annotated[str | None, typer.Option(help="Model name (overrides default)")] = None,
     max_turns: Annotated[int | None, typer.Option(min=1, help="Limit agent loop turns")] = None,
+    permission: Annotated[
+        str | None,
+        typer.Option("--permission", help="Permission level: readonly, safe, standard, yolo"),
+    ] = None,
     session: Annotated[str | None, typer.Option(help="Resume a specific session id")] = None,
     continue_last: Annotated[bool, typer.Option("--continue", "-c", help="Resume the most recent session")] = False,
 ) -> None:
@@ -208,6 +232,7 @@ def run(
         session=session,
         continue_last=continue_last,
         max_turns=max_turns,
+        permission=permission,
     )
 
     code = asyncio.run(run_noninteractive(setup.agent, " ".join(message).strip()))

mycode_cli-0.7.0/src/mycode_cli/permissions.py

@@ -0,0 +1,228 @@
+"""CLI permission policy built on SDK tool hooks."""
+
+from __future__ import annotations
+
+import shlex
+from collections.abc import Awaitable, Callable
+from dataclasses import dataclass
+from pathlib import Path
+from typing import Literal, NamedTuple
+
+from mycode import Hooks, ToolExecutionResult, ToolHookContext
+from mycode.tools import resolve_path
+from mycode_cli.config import PermissionConfig, PermissionLevel, Settings
+from mycode_cli.system_prompt import discover_skills
+
+PermissionTier = Literal["readonly", "safe", "standard", "yolo"]
+PermissionDecision = Literal["allow", "ask", "deny"]
+ToolReviewDecision = Literal["allow", "deny"]
+
+PERMISSION_DENIED_OUTPUT = "error: permission denied"
+PERMISSION_DENIED_BY_USER_OUTPUT = "error: permission denied by user"
+
+_LEVEL_RANK: dict[PermissionLevel, int] = {"readonly": 0, "safe": 1, "standard": 2, "yolo": 3}
+
+_SHELL_CONTROL_TOKENS = {
+    "&&", "||", ";", "|", "|&", "&",
+    ">", ">>", ">|", "&>", ">&",
+    "<", "<<", "<<<", "<&",
+}  # fmt: skip
+
+_DANGEROUS_PROGRAMS = {
+    "rm", "rmdir", "mv", "cp", "sudo", "chmod", "chown",
+    "kill", "pkill", "dd", "mkfs", "mount", "umount", "shutdown", "reboot",
+}  # fmt: skip
+_DANGEROUS_GIT_SUBCOMMANDS = {"reset", "clean", "checkout", "restore"}
+
+# awk/sed are excluded: both can write files and shell out, and statically
+# parsing their scripts isn't worth it.
+_READONLY_PROGRAMS = {
+    "pwd", "ls", "dir", "tree", "rg", "grep", "cat", "head", "tail",
+    "wc", "stat", "file", "du", "df", "which", "env", "printenv",
+    "date", "uname", "whoami", "id", "hostname", "ps", "uptime",
+    "realpath", "dirname", "basename",
+    "sort", "uniq", "cut", "tr",
+}  # fmt: skip
+_READONLY_GIT_SUBCOMMANDS = {"status", "diff", "log", "show", "rev-parse", "ls-files", "grep", "blame", "describe"}
+_READONLY_BRANCH_FLAGS = {"-a", "-r", "-v", "-vv", "--all", "--remotes", "--verbose", "--show-current"}
+
+# find flags that write files or execute commands.
+_FIND_DANGEROUS_FLAGS = {
+    "-delete", "-exec", "-execdir", "-ok", "-okdir",
+    "-fprint", "-fprint0", "-fprintf", "-fls",
+}  # fmt: skip
+
+
+class PermissionCheck(NamedTuple):
+    tier: PermissionTier
+    preview: str
+
+
+@dataclass(frozen=True)
+class ToolReviewRequest:
+    tool_call_id: str
+    tool_name: str
+    preview: str
+    permission: PermissionConfig
+
+
+ToolReviewCallback = Callable[[ToolReviewRequest], Awaitable[ToolReviewDecision]]
+
+
+def build_permission_hooks(
+    settings: Settings,
+    *,
+    review: ToolReviewCallback | None = None,
+    on_user_denied: Callable[[], None] | None = None,
+) -> Hooks:
+    hooks = Hooks()
+    workspace_root = Path(settings.workspace_root).resolve(strict=False)
+    skill_roots = [Path(s.path).parent.resolve(strict=False) for s in discover_skills(settings.cwd)]
+
+    @hooks.before_tool
+    async def check_permission(ctx: ToolHookContext) -> ToolExecutionResult | None:
+        check = classify_tool(ctx, cwd=settings.cwd, workspace_root=workspace_root, skill_roots=skill_roots)
+        decision = permission_decision(settings.permission, check.tier)
+        if decision == "allow":
+            return None
+
+        if decision == "ask" and review is not None:
+            review_decision = await review(
+                ToolReviewRequest(
+                    tool_call_id=ctx.tool_call_id,
+                    tool_name=ctx.tool_name,
+                    preview=check.preview,
+                    permission=settings.permission,
+                )
+            )
+            if review_decision == "allow":
+                return None
+            if on_user_denied is not None:
+                on_user_denied()
+            return ToolExecutionResult(output=PERMISSION_DENIED_BY_USER_OUTPUT, is_error=True)
+
+        return ToolExecutionResult(output=PERMISSION_DENIED_OUTPUT, is_error=True)
+
+    return hooks
+
+
+def permission_decision(permission: PermissionConfig, tier: PermissionTier) -> PermissionDecision:
+    if permission.level == "yolo":
+        return "allow"
+    if tier != "yolo" and _LEVEL_RANK[tier] <= _LEVEL_RANK[permission.level]:
+        return "allow"
+    return permission.mode
+
+
+def classify_tool(
+    ctx: ToolHookContext,
+    *,
+    cwd: str,
+    workspace_root: Path,
+    skill_roots: list[Path],
+) -> PermissionCheck:
+    name = ctx.tool_name.lower()
+
+    if name == "bash":
+        command = str(ctx.tool_input.get("command") or "").strip()
+        return PermissionCheck(_classify_bash(command), command)
+
+    if name in {"read", "write", "edit"}:
+        raw = str(ctx.tool_input.get("path") or "")
+        path = Path(resolve_path(raw, cwd=cwd)).resolve(strict=False)
+        preview = raw or str(path)
+        if name == "read" and any(path.is_relative_to(root) for root in skill_roots):
+            return PermissionCheck("readonly", preview)
+        if not path.is_relative_to(workspace_root):
+            return PermissionCheck("yolo", preview)
+        return PermissionCheck("readonly" if name == "read" else "safe", preview)
+
+    return PermissionCheck("yolo", ctx.tool_name)
+
+
+def _classify_bash(command: str) -> PermissionTier:
+    if not command:
+        return "yolo"
+    # Newlines and shell expansion bypass static analysis; treat as compound.
+    if "\n" in command or "\r" in command or "$(" in command or "`" in command:
+        return "yolo"
+    try:
+        lexer = shlex.shlex(command, posix=True, punctuation_chars=True)
+        lexer.whitespace_split = True
+        tokens = list(lexer)
+        words = shlex.split(command, posix=True)
+    except ValueError:
+        return "yolo"
+    if not words or any(t in _SHELL_CONTROL_TOKENS for t in tokens):
+        return "yolo"
+
+    program = Path(words[0]).name
+    if _is_dangerous(program, words):
+        return "yolo"
+    if _is_readonly(program, words):
+        return "readonly"
+    return "standard"
+
+
+def _is_dangerous(program: str, words: list[str]) -> bool:
+    if program in _DANGEROUS_PROGRAMS:
+        return True
+    if program == "sed" and any(w == "-i" or w.startswith("-i") for w in words[1:]):
+        return True
+    if program == "find" and any(w in _FIND_DANGEROUS_FLAGS for w in words[1:]):
+        return True
+    if program != "git":
+        return False
+    sub = _git_subcommand(words)
+    if sub in _DANGEROUS_GIT_SUBCOMMANDS:
+        return True
+    return sub == "push" and any(w in {"-f", "--force", "--force-with-lease"} for w in words[2:])
+
+
+def _is_readonly(program: str, words: list[str]) -> bool:
+    if len(words) == 2 and words[1] in {"--version", "-v", "version"}:
+        return True
+    if program in _READONLY_PROGRAMS:
+        return True
+    if program == "find":
+        return True
+    if program == "command" and words[1:2] == ["-v"] and len(words) >= 3:
+        return True
+    if program == "type" and len(words) >= 2:
+        return True
+    if program != "git":
+        return False
+    sub = _git_subcommand(words)
+    if sub in _READONLY_GIT_SUBCOMMANDS:
+        return True
+    if sub == "remote":
+        return not any(w in {"add", "remove", "rm", "rename", "set-url"} for w in words[2:])
+    if sub == "branch":
+        return all(w in _READONLY_BRANCH_FLAGS for w in words[2:])
+    return False
+
+
+def _git_subcommand(words: list[str]) -> str | None:
+    i = 1
+    while i < len(words):
+        w = words[i]
+        if w in {"-C", "-c", "--git-dir", "--work-tree"}:
+            i += 2
+            continue
+        if w.startswith("-"):
+            i += 1
+            continue
+        return w
+    return None
+
+
+__all__ = [
+    "PERMISSION_DENIED_BY_USER_OUTPUT",
+    "PERMISSION_DENIED_OUTPUT",
+    "ToolReviewCallback",
+    "ToolReviewDecision",
+    "ToolReviewRequest",
+    "build_permission_hooks",
+    "classify_tool",
+    "permission_decision",
+]

{mycode_cli-0.6.0 → mycode_cli-0.7.0}/src/mycode_cli/runtime.py

@@ -16,6 +16,7 @@ from mycode.providers import (
 from mycode.session import SessionStore
 from mycode.tools import DEFAULT_TOOL_SPECS
 from mycode_cli.config import ModelConfig, ResolvedProvider, Settings, provider_has_api_key
+from mycode_cli.permissions import ToolReviewCallback, build_permission_hooks
 from mycode_cli.system_prompt import build_system_prompt
 
 
@@ -51,6 +52,7 @@ def build_agent(
     session_id: str,
     max_turns: int | None = None,
     reasoning_effort: str | None = None,
+    review: ToolReviewCallback | None = None,
 ) -> Agent:
     """Build an agent from the resolved provider, honoring model config overrides.
 
@@ -59,7 +61,7 @@ def build_agent(
     """
 
     model_config = model_config_for(settings, resolved_provider)
-    return Agent(
+    agent = Agent(
         model=resolved_provider.model,
         provider=resolved_provider.provider,
         cwd=cwd,
@@ -78,6 +80,8 @@ def build_agent(
         system=build_system_prompt(cwd, settings),
         tools=DEFAULT_TOOL_SPECS,
     )
+    agent.hooks = build_permission_hooks(settings, review=review, on_user_denied=agent.cancel)
+    return agent
 
 
 def model_config_for(settings: Settings, resolved: ResolvedProvider) -> ModelConfig | None:
@@ -113,6 +117,7 @@ def clone_agent(agent: Agent, *, store: SessionStore, session_id: str) -> Agent:
         supports_pdf_input=agent.supports_pdf_input,
         system=agent.system,
         tools=DEFAULT_TOOL_SPECS,
+        hooks=agent.hooks,
     )
 
 

{mycode_cli-0.6.0 → mycode_cli-0.7.0}/src/mycode_cli/server/routers/chat.py

@@ -30,10 +30,11 @@ from mycode_cli.config import (
     resolve_provider,
     resolve_provider_choices,
 )
+from mycode_cli.permissions import ToolReviewDecision, ToolReviewRequest
 from mycode_cli.runtime import build_agent, model_config_for
 from mycode_cli.server.deps import RunManagerDep, StoreDep
-from mycode_cli.server.run_manager import ActiveRunError, RunState
-from mycode_cli.server.schemas import ChatRequest, StreamEvent
+from mycode_cli.server.run_manager import ActiveRunError, RunManager, RunState
+from mycode_cli.server.schemas import ChatRequest, DecideRequest, StreamEvent
 
 router = APIRouter()
 
@@ -224,6 +225,7 @@ async def chat(chat: ChatRequest, store: StoreDep, runs: RunManagerDep):
         resolved_provider=resolved,
         session_id=session_id,
         reasoning_effort=reasoning_effort,
+        review=_make_review(runs, session_id),
     )
 
     try:
@@ -264,6 +266,28 @@ async def cancel_run(run_id: str, runs: RunManagerDep):
     return {"status": "ok", "run": run}
 
 
+@router.post("/runs/{run_id}/decide")
+async def decide_run(run_id: str, body: DecideRequest, runs: RunManagerDep):
+    resolved = await runs.resolve_decision(run_id, body.request_id, body.decision)
+    if not resolved:
+        raise HTTPException(status_code=404, detail="permission request not found")
+    return {"status": "ok"}
+
+
+def _make_review(runs: RunManager, session_id: str):
+    """Bridge before_tool review waits to SSE events on the active run."""
+
+    async def review(request: ToolReviewRequest) -> ToolReviewDecision:
+        return await runs.request_decision(
+            session_id=session_id,
+            tool_call_id=request.tool_call_id,
+            tool_name=request.tool_name,
+            preview=request.preview,
+        )
+
+    return review
+
+
 @router.get("/config")
 async def get_config(cwd: str | None = None):
     resolved_cwd = os.path.abspath(cwd or os.getcwd())

{mycode_cli-0.6.0 → mycode_cli-0.7.0}/src/mycode_cli/server/run_manager.py

@@ -12,6 +12,7 @@ from uuid import uuid4
 
 from mycode.agent import Event
 from mycode.messages import ConversationMessage
+from mycode_cli.permissions import ToolReviewDecision
 
 RunStatus = Literal["running", "completed", "failed", "cancelled"]
 FINISHED_RUN_TTL_SECONDS = 300
@@ -47,6 +48,7 @@ class RunState:
     task: asyncio.Task[None] | None = None
     finished_at: float | None = None
     condition: asyncio.Condition = field(default_factory=asyncio.Condition)
+    pending_decisions: dict[str, asyncio.Future[ToolReviewDecision]] = field(default_factory=dict)
 
     def info(self) -> dict[str, Any]:
         """Return the public run payload."""
@@ -125,12 +127,82 @@ class RunManager:
         if not state:
             return None
         state.agent.cancel()
+        for fut in state.pending_decisions.values():
+            if not fut.done():
+                fut.cancel()
         return state.info()
 
     async def has_active_run(self, session_id: str) -> bool:
         async with self._lock:
             return session_id in self._active_by_session
 
+    async def request_decision(
+        self,
+        *,
+        session_id: str,
+        tool_call_id: str,
+        tool_name: str,
+        preview: str,
+    ) -> ToolReviewDecision:
+        """Emit permission_request, await the user's decision, then emit permission_resolved."""
+
+        async with self._lock:
+            state = self._active_by_session.get(session_id)
+        if state is None:
+            raise RuntimeError(f"no active run for session {session_id!r}")
+
+        loop = asyncio.get_running_loop()
+        request_id = uuid4().hex
+        future: asyncio.Future[ToolReviewDecision] = loop.create_future()
+        state.pending_decisions[request_id] = future
+
+        await self._append_event(
+            state,
+            Event(
+                "permission_request",
+                {
+                    "request_id": request_id,
+                    "tool_use_id": tool_call_id,
+                    "tool_name": tool_name,
+                    "preview": preview,
+                },
+            ),
+        )
+
+        decision: ToolReviewDecision = "deny"
+        try:
+            decision = await future
+            return decision
+        except asyncio.CancelledError:
+            # Treat cancellation as deny so the agent loop unwinds via its own cancel check.
+            return decision
+        finally:
+            state.pending_decisions.pop(request_id, None)
+            await self._append_event(
+                state,
+                Event(
+                    "permission_resolved",
+                    {"request_id": request_id, "decision": decision},
+                ),
+            )
+
+    async def resolve_decision(
+        self,
+        run_id: str,
+        request_id: str,
+        decision: ToolReviewDecision,
+    ) -> bool:
+        """Resolve a pending permission_request future. Returns whether resolved."""
+
+        state = await self.get_run(run_id)
+        if state is None:
+            return False
+        future = state.pending_decisions.get(request_id)
+        if future is None or future.done():
+            return False
+        future.set_result(decision)
+        return True
+
     async def _run(self, state: RunState) -> None:
         """Run the agent and store streamed events."""
 
@@ -163,6 +235,9 @@ class RunManager:
             state.condition.notify_all()
 
     async def _finish_run(self, state: RunState, *, status: RunStatus, error: str | None = None) -> None:
+        for fut in state.pending_decisions.values():
+            if not fut.done():
+                fut.cancel()
         async with state.condition:
             state.status = status
             state.error = error