rulewright 0.1.0__py3-none-any.whl

rulewright/guard/emit.py

@@ -0,0 +1,75 @@
+"""Add allow rules to a Claude Code settings file without disturbing anything else in it."""
+
+import difflib
+import json
+import os
+import tempfile
+from pathlib import Path
+from typing import Any
+
+from rulewright.guard.profile import Pattern
+
+
+class SettingsError(Exception):
+    """The settings file is not something we can safely edit."""
+
+
+def settings_path(repo: Path, local: bool = False) -> Path:
+    name = "settings.local.json" if local else "settings.json"
+    return repo / ".claude" / name
+
+
+def rule_for(pattern: Pattern) -> str:
+    return f"Bash({pattern.pattern}:*)"
+
+
+def load_settings(path: Path) -> dict[str, Any]:
+    if not path.exists():
+        return {}
+    try:
+        data = json.loads(path.read_text(encoding="utf-8"))
+    except (OSError, ValueError) as e:
+        msg = f"{path} is not valid JSON ({e}); fix it first, nothing was changed."
+        raise SettingsError(msg) from None
+    if not isinstance(data, dict):
+        raise SettingsError(f"{path} does not hold a JSON object; nothing was changed.")
+    perms = data.get("permissions", {})
+    allow = perms.get("allow", []) if isinstance(perms, dict) else None
+    if not isinstance(allow, list):
+        raise SettingsError(f"{path} has an unexpected `permissions.allow`; nothing was changed.")
+    return data
+
+
+def with_rules(settings: dict[str, Any], rules: list[str]) -> tuple[dict[str, Any], list[str]]:
+    """(new settings, the rules actually added). Existing rules and other keys are untouched."""
+    new = json.loads(json.dumps(settings))
+    perms = new.setdefault("permissions", {})
+    allow: list[Any] = perms.setdefault("allow", [])
+    added = [r for r in dict.fromkeys(rules) if r not in allow]
+    allow.extend(added)
+    return new, added
+
+
+def render(settings: dict[str, Any]) -> str:
+    return json.dumps(settings, indent=2, ensure_ascii=False) + "\n"
+
+
+def unified_diff(old: str, new: str, name: str) -> str:
+    return "".join(
+        difflib.unified_diff(
+            old.splitlines(keepends=True), new.splitlines(keepends=True),
+            fromfile=f"a/{name}", tofile=f"b/{name}",
+        )
+    )  # fmt: skip
+
+
+def write_atomic(path: Path, text: str) -> None:
+    path.parent.mkdir(parents=True, exist_ok=True)
+    fd, tmp = tempfile.mkstemp(dir=path.parent, prefix=path.name, suffix=".tmp")
+    try:
+        with os.fdopen(fd, "w", encoding="utf-8", newline="\n") as fh:
+            fh.write(text)
+        os.replace(tmp, path)
+    except BaseException:
+        Path(tmp).unlink(missing_ok=True)
+        raise

rulewright/guard/profile.py

@@ -0,0 +1,172 @@
+"""Turn the shell commands an agent ran into a minimal, safe permission allowlist.
+
+No LLM is involved and no command is executed. A pattern only reaches the "safe" tier by being
+one of our own curated prefixes (SAFE_PREFIXES), so text from a log can never become an allow
+rule on its own. Everything else that was run often is reported as "review" (a person decides)
+or "never" (too broad or too dangerous to offer at all).
+"""
+
+import re
+import shlex
+from collections import defaultdict
+from datetime import datetime
+from typing import Literal
+
+from pydantic import BaseModel
+
+from rulewright.ingest.sessions.base import ToolCall
+from rulewright.propose.redact import redact
+
+Tier = Literal["safe", "review", "never"]
+
+MIN_USES = 3
+# Tools whose commands are POSIX shell, i.e. what a `Bash(...)` rule matches. Codex's
+# `shell_command` is PowerShell on Windows, so it is left out and reported instead.
+BASH_TOOLS = {"Bash", "shell", "exec_command", "local_shell"}
+
+# Read-only, test, lint and build commands. Longest match wins; nothing here can delete,
+# publish, install or reach the network on its own.
+SAFE_PREFIXES: tuple[tuple[str, ...], ...] = (
+    ("pwd",), ("ls",), ("cd",), ("wc",),
+    ("git", "status"), ("git", "diff"), ("git", "log"), ("git", "show"),
+    ("git", "rev-parse"), ("git", "ls-files"), ("git", "blame"),
+    ("pytest",), ("python", "-m", "pytest"), ("uv", "run", "pytest"),
+    ("ruff", "check"), ("uv", "run", "ruff", "check"),
+    ("mypy",), ("uv", "run", "mypy"),
+    ("npm", "test"), ("npm", "run", "test"), ("npm", "run", "lint"),
+    ("npm", "run", "typecheck"), ("npm", "run", "build"),
+    ("pnpm", "test"), ("pnpm", "run", "test"), ("pnpm", "run", "lint"),
+    ("pnpm", "run", "typecheck"), ("pnpm", "run", "build"),
+    ("yarn", "test"), ("yarn", "lint"), ("yarn", "build"),
+    ("cargo", "test"), ("cargo", "check"), ("cargo", "clippy"), ("cargo", "build"),
+    ("go", "test"), ("go", "vet"), ("go", "build"),
+    ("make", "test"), ("make", "lint"),
+)  # fmt: skip
+
+# A rule for these would allow arbitrary code or arbitrary deletion, whatever follows.
+NEVER_PROGRAMS = {
+    "python", "python3", "py", "node", "deno", "bun", "ruby", "perl", "php", "bash", "sh", "zsh",
+    "pwsh", "powershell", "cmd", "npx", "uvx", "pipx", "eval", "exec", "xargs", "env", "find",
+    "awk", "sed", "rm", "rmdir", "sudo", "su", "chmod", "chown", "dd", "mkfs", "kill", "pkill",
+    "curl", "wget", "nc", "ncat", "ssh", "scp", "sftp", "ftp", "docker", "podman", "kubectl",
+    "terraform", "mv", "cp", "tee", "xdg-open", "open", "start",
+    # wrappers: allowing `timeout` would allow `timeout 5 rm -rf x`
+    "timeout", "nice", "nohup", "time", "command", "builtin", "stdbuf", "watch", "setsid", "doas",
+}  # fmt: skip
+NEVER_PAIRS = {
+    ("git", "push"), ("git", "reset"), ("git", "clean"), ("git", "checkout"), ("git", "rebase"),
+    ("git", "restore"), ("git", "stash"), ("git", "branch"), ("git", "config"), ("git", "remote"),
+    ("npm", "install"), ("npm", "publish"), ("npm", "exec"), ("pip", "install"),
+    ("uv", "run"), ("uv", "add"), ("uv", "publish"), ("gh", "api"), ("gh", "auth"),
+}  # fmt: skip
+
+# Programs whose first argument is a subcommand; for any other, an argument is a file or a value.
+SUBCOMMAND_PROGRAMS = {
+    "git", "npm", "pnpm", "yarn", "cargo", "go", "gh", "make", "uv", "pip", "pip3", "poetry",
+    "brew", "apt", "apt-get", "systemctl", "dotnet", "mvn", "gradle", "bundle", "rake",
+}  # fmt: skip
+# Redirects that cannot write anywhere: stderr into stdout, or output thrown away.
+_HARMLESS_REDIRECT = re.compile(r"\s\d?>&\d(?=\s|$)|\s\d?>>?\s*/dev/null(?=\s|$)")
+_OPERATORS = {";", "&&", "||", "|", "&", "|&"}
+_WORD = re.compile(r"^[A-Za-z][\w.+-]*$")
+
+
+class Pattern(BaseModel):
+    pattern: str  # e.g. "git status"; the rule is `Bash(git status:*)`
+    tier: Tier
+    uses: int
+    sessions: int
+    failures: int
+    denied: int
+    last_used: datetime
+    example: str  # one redacted, shortened command
+
+
+class Profile(BaseModel):
+    commands_seen: int
+    skipped_other_shell: int  # PowerShell and the like: not matched by a Bash(...) rule
+    patterns: list[Pattern]
+
+    def tier(self, tier: Tier) -> list[Pattern]:
+        return [p for p in self.patterns if p.tier == tier]
+
+
+def split_command(command: str) -> list[list[str]] | None:
+    """Simple commands joined by &&, ||, ; or |. None when it cannot be judged safely:
+    unbalanced quotes, command substitution, redirects, here-documents, env assignments."""
+    if "$(" in command or "`" in command or "<(" in command or ">(" in command:
+        return None
+    command = _HARMLESS_REDIRECT.sub("", command)
+    try:
+        lexer = shlex.shlex(command, posix=True, punctuation_chars=True)
+        lexer.whitespace_split = True
+        tokens = list(lexer)
+    except ValueError:
+        return None
+    parts: list[list[str]] = [[]]
+    for tok in tokens:
+        if tok in _OPERATORS:
+            parts.append([])
+        elif set(tok) <= set("<>&|;()") and tok:
+            return None  # a redirect, subshell or odd operator
+        else:
+            parts[-1].append(tok)
+    parts = [p for p in parts if p]
+    if not parts or any("=" in p[0] and not p[0].startswith("-") for p in parts):
+        return None  # empty, or FOO=bar cmd: the environment changes what the command does
+    return parts
+
+
+def classify(tokens: list[str]) -> tuple[str, Tier]:
+    """(pattern, tier) for one simple command."""
+    best = max(
+        (p for p in SAFE_PREFIXES if tuple(tokens[: len(p)]) == p), key=len, default=None
+    )
+    if best is not None:
+        return " ".join(best), "safe"
+    program = tokens[0]
+    if "/" in program or "\\" in program or not _WORD.match(program):
+        return program, "never"  # a path or odd name: not something to allow by prefix
+    takes_sub = program in SUBCOMMAND_PROGRAMS and len(tokens) > 1 and _WORD.match(tokens[1])
+    sub = tokens[1] if takes_sub else ""
+    pattern = f"{program} {sub}".strip()
+    if program.lower() in NEVER_PROGRAMS or (program, sub) in NEVER_PAIRS:
+        return pattern, "never"
+    return pattern, "review"
+
+
+def build_profile(calls: list[ToolCall], min_uses: int = MIN_USES) -> Profile:
+    usable = [c for c in calls if c.tool in BASH_TOOLS]
+    seen: dict[tuple[str, Tier], list[tuple[ToolCall, str]]] = defaultdict(list)
+    for call in usable:
+        parts = split_command(call.command)
+        if parts is None:
+            continue
+        for tokens in parts:
+            pattern, tier = classify(tokens)
+            seen[(pattern, tier)].append((call, " ".join(tokens)))
+    patterns = []
+    for (pattern, tier), hits in seen.items():
+        if len(hits) < min_uses:
+            continue
+        calls_for = [c for c, _ in hits]
+        patterns.append(
+            Pattern(
+                pattern=pattern, tier=tier, uses=len(hits),
+                sessions=len({c.session_id for c in calls_for}),
+                failures=sum(c.failed for c in calls_for),
+                denied=sum(c.denied for c in calls_for),
+                last_used=max(c.ts for c in calls_for),
+                example=redact(hits[-1][1])[:100],
+            )
+        )  # fmt: skip
+    patterns.sort(key=lambda p: (-p.uses, p.pattern))
+    return Profile(
+        commands_seen=len(usable), skipped_other_shell=len(calls) - len(usable), patterns=patterns
+    )
+
+
+def allowable(profile: Profile, include_review: bool = False) -> list[Pattern]:
+    """Patterns that may be written: never one the person refused, never the 'never' tier."""
+    tiers: set[Tier] = {"safe", "review"} if include_review else {"safe"}
+    return [p for p in profile.patterns if p.tier in tiers and p.denied == 0]

rulewright/ingest/git_history.py

@@ -0,0 +1,185 @@
+"""Turn `git log` into uniform commit events. No interpretation beyond agent attribution."""
+
+import re
+import subprocess
+from datetime import datetime
+from pathlib import Path
+
+from pydantic import BaseModel
+
+_AGENTS = "claude|codex|copilot|cursor|devin|aider|openhands|jules|gemini|sweep"
+_AGENT_TRAILER = re.compile(rf"^co-authored-by:.*\b({_AGENTS})\b", re.I | re.M)
+# A bot counts only when it names a coding agent: release and dependency bots are not agents.
+_AGENT_AUTHOR = re.compile(
+    rf"(?:{_AGENTS})[\w.+-]*\[bot\]|noreply@anthropic\.com|\+(?:copilot|claude)@users\.noreply",
+    re.I,
+)
+_REC = "\x1e"  # starts a commit record
+_FLD = "\x1f"  # separates header fields
+_END = "\x1d"  # ends the header; numstat and patch follow
+MAX_PATCH_CHARS = 20_000
+MAX_LINES_PER_FILE = 1000  # per direction; keeps huge generated files from dominating memory
+MAX_LINE_CHARS = 200
+# Never evidence of an agent mistake and often huge, so git does not even print them.
+_EXCLUDE = [
+    f":(exclude,glob)**/{pattern}"
+    for pattern in (
+        "package-lock.json", "pnpm-lock.yaml", "yarn.lock", "Cargo.lock", "uv.lock",
+        "poetry.lock", "Gemfile.lock", "composer.lock", "go.sum", "*.lock", "*.min.js",
+        "*.min.css", "*.snap", "*.svg", "*.map",
+    )
+]  # fmt: skip
+
+Range = tuple[int, int]  # inclusive line range
+
+
+class FileChange(BaseModel):
+    path: str
+    added: int
+    deleted: int
+    old_ranges: list[Range] = []  # lines removed or replaced, in the parent's numbering
+    new_ranges: list[Range] = []  # lines added or replaced, in this commit's numbering
+    added_lines: list[str] = []  # text of added lines (capped), untrusted
+    removed_lines: list[str] = []  # text of removed lines (capped), untrusted
+
+
+class Commit(BaseModel):
+    sha: str
+    parents: list[str]
+    author_name: str
+    author_email: str
+    ts: datetime
+    subject: str
+    body: str
+    files: list[FileChange]
+    is_agent: bool
+    patch: str = ""  # truncated unified diff, untrusted
+
+    @property
+    def added(self) -> int:
+        return sum(f.added for f in self.files)
+
+    @property
+    def deleted(self) -> int:
+        return sum(f.deleted for f in self.files)
+
+
+def is_agent_commit(author_name: str, author_email: str, body: str) -> bool:
+    author = f"{author_name} <{author_email}>"
+    return bool(_AGENT_TRAILER.search(body) or _AGENT_AUTHOR.search(author))
+
+
+def _git(repo: Path, *args: str) -> str:
+    return subprocess.run(
+        ["git", "-C", str(repo), *args],
+        check=True,
+        capture_output=True,
+        text=True,
+        encoding="utf-8",
+    ).stdout
+
+
+def read_commits(repo: Path, limit: int = 500) -> list[Commit]:
+    """Return up to `limit` recent commits, oldest first."""
+    fmt = _FLD.join(["%H", "%P", "%an", "%ae", "%aI", "%s", "%b"]) + _END
+    out = _git(
+        repo, "log", f"-n{limit}", "--no-renames", "--numstat", "-p", "-U0",
+        f"--format={_REC}{fmt}", "--", ".", *_EXCLUDE,
+    )  # fmt: skip
+    commits: list[Commit] = []
+    for rec in out.split(_REC)[1:]:
+        header, _, rest = rec.partition(_END)
+        sha, parents, name, email, ts, subject, body = header.split(_FLD)
+        body = body.strip()
+        stat, patch = _split_stat_patch(rest)
+        commits.append(
+            Commit(
+                sha=sha,
+                parents=parents.split(),
+                author_name=name,
+                author_email=email,
+                ts=datetime.fromisoformat(ts),
+                subject=subject,
+                body=body,
+                files=_parse_files(stat, patch),
+                is_agent=is_agent_commit(name, email, body),
+                patch=patch[:MAX_PATCH_CHARS],
+            )
+        )
+    commits.reverse()
+    return commits
+
+
+_NUMSTAT = re.compile(r"^(\d+|-)\t(\d+|-)\t(.+)$")
+_DIFF_HEADER = re.compile(r"^diff --git a/.+ b/(.+)$")
+_HUNK = re.compile(r"^@@ -(\d+)(?:,(\d+))? \+(\d+)(?:,(\d+))? @@")
+
+
+def _split_stat_patch(text: str) -> tuple[str, str]:
+    idx = text.find("diff --git ")
+    if idx == -1:
+        return text, ""
+    return text[:idx], text[idx:]
+
+
+def _span(start: str, length: str | None) -> Range | None:
+    n = 1 if length is None else int(length)
+    s = int(start)
+    return (s, s + n - 1) if n > 0 else None
+
+
+class _Hunks:
+    def __init__(self) -> None:
+        self.old: list[Range] = []
+        self.new: list[Range] = []
+        self.added: list[str] = []
+        self.removed: list[str] = []
+
+
+def _parse_hunks(patch: str) -> dict[str, _Hunks]:
+    hunks: dict[str, _Hunks] = {}
+    current: _Hunks | None = None
+    for line in patch.splitlines():
+        m = _DIFF_HEADER.match(line)
+        if m:
+            current = hunks[m.group(1)] = _Hunks()
+            continue
+        if current is None:
+            continue
+        h = _HUNK.match(line)
+        if h:
+            old = _span(h.group(1), h.group(2))
+            new = _span(h.group(3), h.group(4))
+            if old:
+                current.old.append(old)
+            if new:
+                current.new.append(new)
+        elif line.startswith("+") and not line.startswith("+++"):
+            if len(current.added) < MAX_LINES_PER_FILE:
+                current.added.append(line[1:].strip()[:MAX_LINE_CHARS])
+        elif line.startswith("-") and not line.startswith("---"):
+            if len(current.removed) < MAX_LINES_PER_FILE:
+                current.removed.append(line[1:].strip()[:MAX_LINE_CHARS])
+    return hunks
+
+
+def _parse_files(stat: str, patch: str) -> list[FileChange]:
+    hunks = _parse_hunks(patch)
+    changes = []
+    for line in stat.splitlines():
+        m = _NUMSTAT.match(line)
+        if m:
+            a, d, path = m.groups()
+            h = hunks.get(path) or _Hunks()
+            changes.append(
+                FileChange(
+                    path=path,
+                    added=0 if a == "-" else int(a),
+                    deleted=0 if d == "-" else int(d),
+                    old_ranges=h.old,
+                    new_ranges=h.new,
+                    added_lines=h.added,
+                    removed_lines=h.removed,
+                )
+            )
+    return changes

rulewright/ingest/reviews.py

@@ -0,0 +1 @@
+"""PR review comments via the GitHub API. Optional: needs a GitHub token. Phase 2, not started."""

rulewright/ingest/sessions/base.py

@@ -0,0 +1,47 @@
+"""Plugin interface for agent session-log readers."""
+
+from datetime import datetime
+from pathlib import Path
+from typing import Literal, Protocol
+
+from pydantic import BaseModel
+
+
+class SessionMessage(BaseModel):
+    """One human or agent text message. Text is untrusted data."""
+
+    session_id: str
+    uuid: str
+    role: Literal["user", "assistant"]
+    text: str
+    ts: datetime
+
+
+class SessionSource(Protocol):
+    """Reads the session logs one agent keeps for a repo. Add a new agent by adding a reader."""
+
+    name: str
+
+    def read(self, repo: Path) -> list[SessionMessage]:
+        """Messages for `repo`, ordered by time. Empty when the agent has no logs there."""
+        ...
+
+
+class ToolCall(BaseModel):
+    """One shell command an agent ran. The command is untrusted data and is never executed."""
+
+    session_id: str
+    agent: str  # which reader produced it, e.g. "claude_code"
+    tool: str  # "Bash" for Claude Code; the shell tool name for others
+    command: str
+    ts: datetime
+    failed: bool = False  # the tool reported an error
+    denied: bool = False  # the person refused it when asked
+
+
+class ToolCallSource(Protocol):
+    """Reads the commands one agent ran for a repo. Used by `guard`, not by `scan`."""
+
+    name: str
+
+    def read_calls(self, repo: Path) -> list[ToolCall]: ...

rulewright/ingest/sessions/claude_code.py

@@ -0,0 +1,138 @@
+"""Claude Code transcript reader.
+
+Transcripts live in ~/.claude/projects/<project-slug>/<session-id>.jsonl, one JSON object per
+line. The slug is the project path with every non-alphanumeric character replaced by "-".
+Records of type "user" and "assistant" carry `message.content` as a string or a list of blocks;
+only "text" blocks are kept (tool calls and tool results are skipped). Unknown or malformed
+lines are skipped so a format change degrades to fewer messages, not a crash.
+"""
+
+import json
+import re
+from datetime import datetime
+from pathlib import Path
+from typing import Any
+
+from rulewright.ingest.sessions.base import SessionMessage, ToolCall
+
+
+def project_slug(repo: Path) -> str:
+    return re.sub(r"[^A-Za-z0-9]", "-", str(repo.resolve()))
+
+
+DENIED_MARKERS = ("doesn't want to proceed", "was rejected", "user rejected")
+
+
+def _result_text(content: Any) -> str:
+    return content if isinstance(content, str) else _text_of(content)
+
+
+def _text_of(content: Any) -> str:
+    if isinstance(content, str):
+        return content
+    if isinstance(content, list):
+        parts = [
+            b.get("text", "") for b in content if isinstance(b, dict) and b.get("type") == "text"
+        ]
+        return "\n".join(p for p in parts if isinstance(p, str))
+    return ""
+
+
+class ClaudeCodeSource:
+    name = "claude_code"
+
+    def __init__(self, projects_dir: Path | None = None) -> None:
+        self.projects_dir = projects_dir or Path.home() / ".claude" / "projects"
+
+    def find_dir(self, repo: Path) -> Path | None:
+        slug = project_slug(repo).lower()  # drive letter case differs between tools on Windows
+        if not self.projects_dir.is_dir():
+            return None
+        for d in self.projects_dir.iterdir():
+            if d.is_dir() and d.name.lower() == slug:
+                return d
+        return None
+
+    def read(self, repo: Path) -> list[SessionMessage]:
+        d = self.find_dir(repo)
+        if d is None:
+            return []
+        messages: list[SessionMessage] = []
+        for path in sorted(d.glob("*.jsonl")):
+            messages.extend(self._read_file(path))
+        messages.sort(key=lambda m: m.ts)
+        return messages
+
+    def _read_file(self, path: Path) -> list[SessionMessage]:
+        out: list[SessionMessage] = []
+        with path.open(encoding="utf-8", errors="replace") as fh:
+            for line in fh:
+                msg = self._parse(line, path.stem)
+                if msg is not None:
+                    out.append(msg)
+        return out
+
+    @staticmethod
+    def _parse(line: str, default_session: str) -> SessionMessage | None:
+        try:
+            rec = json.loads(line)
+            if rec.get("type") not in ("user", "assistant") or rec.get("isSidechain"):
+                return None
+            if rec.get("isMeta"):
+                return None
+            text = _text_of(rec["message"].get("content")).strip()
+            if not text:
+                return None
+            return SessionMessage(
+                session_id=rec.get("sessionId", default_session),
+                uuid=rec["uuid"],
+                role=rec["type"],
+                text=text,
+                ts=datetime.fromisoformat(rec["timestamp"].replace("Z", "+00:00")),
+            )
+        except (ValueError, KeyError, TypeError, AttributeError):
+            return None
+
+    def read_calls(self, repo: Path) -> list[ToolCall]:
+        """Bash commands with whether each failed or was refused (matched by tool_use_id)."""
+        d = self.find_dir(repo)
+        if d is None:
+            return []
+        calls: list[ToolCall] = []
+        for path in sorted(d.glob("*.jsonl")):
+            calls.extend(self._calls_in(path))
+        calls.sort(key=lambda c: c.ts)
+        return calls
+
+    @staticmethod
+    def _calls_in(path: Path) -> list[ToolCall]:
+        pending: dict[str, ToolCall] = {}
+        with path.open(encoding="utf-8", errors="replace") as fh:
+            for line in fh:
+                try:
+                    rec = json.loads(line)
+                    content = rec["message"]["content"]
+                    if rec.get("isSidechain") or not isinstance(content, list):
+                        continue
+                    when = datetime.fromisoformat(rec["timestamp"].replace("Z", "+00:00"))
+                    session = rec.get("sessionId", path.stem)
+                except (ValueError, KeyError, TypeError, AttributeError):
+                    continue
+                for block in content:
+                    if not isinstance(block, dict):
+                        continue
+                    kind = block.get("type")
+                    if kind == "tool_use" and block.get("name") == "Bash":
+                        command = (block.get("input") or {}).get("command")
+                        if isinstance(command, str) and isinstance(block.get("id"), str):
+                            pending[block["id"]] = ToolCall(
+                                session_id=session, agent="claude_code", tool="Bash",
+                                command=command, ts=when,
+                            )  # fmt: skip
+                    elif kind == "tool_result" and block.get("tool_use_id") in pending:
+                        call = pending[block["tool_use_id"]]
+                        if block.get("is_error"):
+                            text = _result_text(block.get("content")).lower()
+                            call.denied = any(m in text for m in DENIED_MARKERS)
+                            call.failed = not call.denied
+        return list(pending.values())