xdog-coding 2.1.2__tar.gz → 2.2.0__tar.gz

xdog_coding-2.2.0/PKG-INFO

@@ -0,0 +1,95 @@
+Metadata-Version: 2.5
+Name: xdog-coding
+Version: 2.2.0
+Summary: Interactive coding agent CLI
+Project-URL: Homepage, https://xdog.942295.xyz
+Project-URL: Repository, https://github.com/litterzhang/xdog
+Project-URL: Documentation, https://xdog.942295.xyz
+Project-URL: Issues, https://github.com/litterzhang/xdog/issues
+Author: HugeMan
+License-Expression: AGPL-3.0-or-later
+License-File: LICENSE
+License-File: LICENSE-EXCEPTION.md
+Classifier: Development Status :: 5 - Production/Stable
+Classifier: Intended Audience :: Developers
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: Software Development :: Libraries
+Classifier: Typing :: Typed
+Requires-Python: >=3.12
+Requires-Dist: click>=8.1.0
+Requires-Dist: pydantic>=2.0
+Requires-Dist: pyyaml>=6.0
+Requires-Dist: xdog-agent>=2.2.0
+Requires-Dist: xdog-ai[openai]>=2.2.0
+Requires-Dist: xdog-tui>=2.2.0
+Description-Content-Type: text/markdown
+
+# xdog-coding
+
+**Interactive coding-agent CLI.**
+
+A terminal coding agent with session management, built on
+[`xdog-agent`](https://pypi.org/project/xdog-agent/) and the
+[`xdog-tui`](https://pypi.org/project/xdog-tui/) rendering layer.
+
+```bash
+uv run xdog-coding
+```
+
+## Interactive terminal
+
+The interface uses native scrollback, one status row, and a shared multiline
+editor. Enter submits or queues; Shift/Alt+Enter inserts a newline. Ctrl+O opens
+recent tool/reasoning details: Left/Right chooses an entry and Page Up/Page Down
+scrolls. Escape closes autocomplete/details first, then cancels active work and
+restores queued text ahead of the current draft. Ctrl+Z suspends on POSIX.
+
+Permission prompts take priority. Up/Down chooses an action, Enter confirms,
+Escape denies that call, and Page Up/Page Down scrolls the command summary.
+The editor draft stays intact when panels open or the terminal resizes.
+See [terminal verification](../../docs/tui-pi-parity.md); remote coding and
+fullscreen application modes are excluded.
+
+## Tool permissions
+
+Potentially mutating tool calls are gated immediately before execution. By
+default, read-only filesystem operations and `current_time` run automatically;
+`bash`, filesystem writes/edits/deletes, and unknown extension tools ask first.
+
+```bash
+xdog-coding --permission-mode ask       # default: ask for dangerous calls
+xdog-coding --permission-mode ask-all   # ask before every tool
+xdog-coding --permission-mode allow-all # trusted unattended automation
+xdog-coding --permission-mode deny      # allow read-only calls only
+```
+
+Interactive approvals offer **Allow once**, **Allow for this session** (the exact
+same call only), and **Deny**. Non-interactive runs fail closed when no approver
+is available unless `allow-all` was explicitly selected.
+
+The same setting can be stored in `~/.config/xdog/coding/settings.json`:
+
+```json
+{"permission_mode": "ask"}
+```
+
+Permission prompts are an execution gate, not an OS sandbox: an approved shell
+command still has the permissions of the `xdog-coding` process.
+
+## Part of xdog
+
+This package is one piece of [xdog](https://github.com/litterzhang/xdog), a
+local-first toolkit for building, running and scheduling LLM workflows. The
+centrepiece is [`xdog-flow`](https://pypi.org/project/xdog-flow/) — a typed
+workflow format and compiler.
+
+Documentation: **https://xdog.942295.xyz**
+
+## Licence
+
+Copyright (c) 2026 HugeMan <942295.xyz>
+
+GNU Affero General Public License v3.0 or later — see
+[LICENSE](https://github.com/litterzhang/xdog/blob/main/LICENSE).

xdog_coding-2.2.0/README.md

@@ -0,0 +1,67 @@
+# xdog-coding
+
+**Interactive coding-agent CLI.**
+
+A terminal coding agent with session management, built on
+[`xdog-agent`](https://pypi.org/project/xdog-agent/) and the
+[`xdog-tui`](https://pypi.org/project/xdog-tui/) rendering layer.
+
+```bash
+uv run xdog-coding
+```
+
+## Interactive terminal
+
+The interface uses native scrollback, one status row, and a shared multiline
+editor. Enter submits or queues; Shift/Alt+Enter inserts a newline. Ctrl+O opens
+recent tool/reasoning details: Left/Right chooses an entry and Page Up/Page Down
+scrolls. Escape closes autocomplete/details first, then cancels active work and
+restores queued text ahead of the current draft. Ctrl+Z suspends on POSIX.
+
+Permission prompts take priority. Up/Down chooses an action, Enter confirms,
+Escape denies that call, and Page Up/Page Down scrolls the command summary.
+The editor draft stays intact when panels open or the terminal resizes.
+See [terminal verification](../../docs/tui-pi-parity.md); remote coding and
+fullscreen application modes are excluded.
+
+## Tool permissions
+
+Potentially mutating tool calls are gated immediately before execution. By
+default, read-only filesystem operations and `current_time` run automatically;
+`bash`, filesystem writes/edits/deletes, and unknown extension tools ask first.
+
+```bash
+xdog-coding --permission-mode ask       # default: ask for dangerous calls
+xdog-coding --permission-mode ask-all   # ask before every tool
+xdog-coding --permission-mode allow-all # trusted unattended automation
+xdog-coding --permission-mode deny      # allow read-only calls only
+```
+
+Interactive approvals offer **Allow once**, **Allow for this session** (the exact
+same call only), and **Deny**. Non-interactive runs fail closed when no approver
+is available unless `allow-all` was explicitly selected.
+
+The same setting can be stored in `~/.config/xdog/coding/settings.json`:
+
+```json
+{"permission_mode": "ask"}
+```
+
+Permission prompts are an execution gate, not an OS sandbox: an approved shell
+command still has the permissions of the `xdog-coding` process.
+
+## Part of xdog
+
+This package is one piece of [xdog](https://github.com/litterzhang/xdog), a
+local-first toolkit for building, running and scheduling LLM workflows. The
+centrepiece is [`xdog-flow`](https://pypi.org/project/xdog-flow/) — a typed
+workflow format and compiler.
+
+Documentation: **https://xdog.942295.xyz**
+
+## Licence
+
+Copyright (c) 2026 HugeMan <942295.xyz>
+
+GNU Affero General Public License v3.0 or later — see
+[LICENSE](https://github.com/litterzhang/xdog/blob/main/LICENSE).

{xdog_coding-2.1.2 → xdog_coding-2.2.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "xdog-coding"
-version = "2.1.2"
+version = "2.2.0"
 description = "Interactive coding agent CLI"
 requires-python = ">=3.12"
 classifiers = [
@@ -21,9 +21,9 @@ readme = "README.md"
 license = "AGPL-3.0-or-later"
 license-files = ["LICENSE", "LICENSE-EXCEPTION.md"]
 dependencies = [
-    "xdog-ai>=2.1.2",
-    "xdog-agent>=2.1.2",
-    "xdog-tui>=2.1.2",
+    "xdog-ai[openai]>=2.2.0",
+    "xdog-agent>=2.2.0",
+    "xdog-tui>=2.2.0",
     "pyyaml>=6.0",
     "click>=8.1.0",
     "pydantic>=2.0",

{xdog_coding-2.1.2 → xdog_coding-2.2.0}/src/xdog/coding/cli/args.py

@@ -60,10 +60,16 @@ from xdog.coding.cli.session_picker import pick_session_command
 )
 @click.option(
     "--thinking-level",
-    type=click.Choice(["none", "normal", "deep", "ultrathink"]),
+    type=click.Choice(["off", "minimal", "low", "medium", "high", "xhigh"]),
     default=None,
     help="Thinking / reasoning level.",
 )
+@click.option(
+    "--permission-mode",
+    type=click.Choice(["ask", "ask-all", "allow-all", "deny"]),
+    default=None,
+    help="Tool permission policy.",
+)
 @click.option(
     "--list-models",
     is_flag=True,
@@ -99,6 +105,7 @@ def cli(
     working_dir: Path | None,
     config_path: Path | None,
     thinking_level: str | None,
+    permission_mode: str | None,
     list_models: bool,
     pick_session: bool,
     rpc: bool,
@@ -124,6 +131,8 @@ def cli(
         overrides["model"] = model
     if thinking_level is not None:
         overrides["thinking_level"] = thinking_level
+    if permission_mode is not None:
+        overrides["permission_mode"] = permission_mode
 
     # Defer to the main entry-point for actual execution
     from xdog.coding.main import run_agent

{xdog_coding-2.1.2 → xdog_coding-2.2.0}/src/xdog/coding/cli/config_selector.py

@@ -57,10 +57,19 @@ def config_selector(config_path: Path | None = None) -> GlobalConfig:
         cfg = cfg.model_copy(update={"default_model": new_model})
 
     # Thinking level
-    new_thinking = input(f"Thinking level [{cfg.thinking_level}] (off/normal/high): ").strip()
+    new_thinking = input(
+        f"Thinking level [{cfg.thinking_level}] (off/minimal/low/medium/high/xhigh): "
+    ).strip()
     if new_thinking:
         cfg = cfg.model_copy(update={"thinking_level": new_thinking})
 
+    # Tool permissions
+    new_permissions = input(
+        f"Permission mode [{cfg.permission_mode}] (ask/ask-all/allow-all/deny): "
+    ).strip()
+    if new_permissions:
+        cfg = cfg.model_copy(update={"permission_mode": new_permissions})
+
     # Custom instructions
     if cfg.custom_instructions:
         print(f"\nCurrent custom instructions: {cfg.custom_instructions[:80]}...")

{xdog_coding-2.1.2 → xdog_coding-2.2.0}/src/xdog/coding/config.py

@@ -172,6 +172,7 @@ class GlobalConfig(BaseModel):
 
     default_model: str = ""
     thinking_level: str = "normal"
+    permission_mode: str = "ask"
     extensions: list[str] = Field(default_factory=list)
     allowed_tools: list[str] = Field(default_factory=list)
     custom_instructions: str = ""
@@ -207,6 +208,7 @@ class ProjectConfig(BaseModel):
 
     model: str | None = None
     thinking_level: str | None = None
+    permission_mode: str | None = None
     allowed_tools: list[str] = Field(default_factory=list)
     custom_instructions: str = ""
     extensions: list[str] = Field(default_factory=list)
@@ -233,6 +235,7 @@ class RuntimeConfig:
 
     model: str
     thinking_level: str
+    permission_mode: str
     allowed_tools: tuple[str, ...]
     custom_instructions: str
     extensions: tuple[str, ...]
@@ -253,6 +256,11 @@ class RuntimeConfig:
         pcfg = project_cfg or ProjectConfig()
         model = ov.get("model") or pcfg.model or global_cfg.default_model
         thinking = ov.get("thinking_level") or pcfg.thinking_level or global_cfg.thinking_level
+        permission_mode = (
+            ov.get("permission_mode")
+            or pcfg.permission_mode
+            or global_cfg.permission_mode
+        )
 
         merged_tools = list(global_cfg.allowed_tools) + list(pcfg.allowed_tools)
         merged_ext = list(global_cfg.extensions) + list(pcfg.extensions)
@@ -266,6 +274,7 @@ class RuntimeConfig:
         return cls(
             model=model,
             thinking_level=thinking,
+            permission_mode=permission_mode,
             allowed_tools=tuple(merged_tools),
             custom_instructions="\n\n".join(instructions_parts),
             extensions=tuple(merged_ext),

{xdog_coding-2.1.2 → xdog_coding-2.2.0}/src/xdog/coding/core/agent_session.py

@@ -24,6 +24,7 @@ from xdog.ai.types import (
 from xdog.coding.core.defaults import COMPACTION_THRESHOLD_RATIO, MAX_CONTEXT_TOKENS
 from xdog.coding.core.event_bus import EventBus, get_event_bus
 from xdog.coding.core.messages import dicts_to_messages, messages_to_dicts
+from xdog.coding.core.permissions import PermissionManager
 from xdog.coding.core.session_manager import SessionData, SessionManager
 from xdog.coding.core.settings_manager import SettingsManager
 from xdog.coding.core.system_prompt import build_system_prompt
@@ -47,6 +48,9 @@ class AgentSession:
     tool_registry: Any  # kept for backward compat, may be None
     bash: Any  # kept for backward compat, may be None
     working_dir: Path
+    context_window: int = MAX_CONTEXT_TOKENS
+    max_prompt_tokens: int = 0
+    permissions: PermissionManager = field(default_factory=PermissionManager)
     event_bus: EventBus = field(default_factory=get_event_bus)
     _unsubscribe: Any = field(default=None, init=False, repr=False)
     #: Slugs of skills whose instructions are currently in the system prompt.
@@ -59,6 +63,9 @@ class AgentSession:
         if self.session_data.settings:
             self.settings.load_session_settings(self.session_data.settings)
 
+        # Sessions constructed outside the SDK still receive enforcement.
+        self.agent.set_before_tool_call(self.permissions.before_tool_call)
+
         # Subscribe to agent events for persistence and event bus forwarding
         self._unsubscribe = self.agent.subscribe(self._on_agent_event)
 
@@ -80,6 +87,11 @@ class AgentSession:
     def is_streaming(self) -> bool:
         return self.agent.state.is_streaming
 
+    @property
+    def context_limit(self) -> int:
+        """Prompt limit used for compaction; falls back to the model window."""
+        return self.max_prompt_tokens or self.context_window or MAX_CONTEXT_TOKENS
+
     # -- Public API --
 
     @property
@@ -176,17 +188,35 @@ class AgentSession:
         """Cancel the current agent turn."""
         self.agent.abort()
 
+    def cancel(self) -> None:
+        """Cancel active work and discard agent-level queued messages."""
+        self.agent.clear_all_queues()
+        self.permissions.deny_all()
+        self.agent.abort()
+
     # -- Model / thinking --
 
     def set_model(self, model: str) -> None:
-        """Switch the active model."""
+        """Switch the active model and refresh its provider-reported limits."""
         self.agent.set_model(model)
+        try:
+            import xdog.ai as ai
+
+            model_info = ai.provider("copilot").model(model)
+            if model_info is not None:
+                self.context_window = model_info.context_window or MAX_CONTEXT_TOKENS
+                self.max_prompt_tokens = model_info.max_prompt_tokens
+        except Exception:
+            logger.debug("could not refresh model limits for %s", model, exc_info=True)
+        self.settings.set_session_model(model)
         self._persist()
 
     def set_thinking_level(self, level: ThinkingLevel | None) -> None:
-        """Switch the thinking/reasoning level."""
+        """Switch and persist the thinking/reasoning level."""
         from dataclasses import replace
+
         self.agent.set_options(replace(self.agent.options, thinking=level))
+        self.settings.set_session_thinking(level or "off")
         self._persist()
 
     # -- Compaction --
@@ -222,7 +252,7 @@ class AgentSession:
                 char_count += 200
 
         estimated_tokens = char_count / 4
-        threshold = MAX_CONTEXT_TOKENS * COMPACTION_THRESHOLD_RATIO
+        threshold = self.context_limit * COMPACTION_THRESHOLD_RATIO
 
         if estimated_tokens > threshold:
             await self._run_compaction()
@@ -257,6 +287,7 @@ class AgentSession:
             return False
 
         self.session_data = loaded
+        self.permissions.clear_session_rules()
         restored_messages = list(self.session_data.messages)
         self.agent.replace_messages(restored_messages)
 
@@ -335,6 +366,7 @@ class AgentSession:
             RuntimeConfig(
                 model=self.agent.state.model or "unknown",
                 thinking_level=str(self.agent.options.thinking or "normal"),
+                permission_mode=self.permissions.mode,
                 allowed_tools=tuple(t.name for t in self.agent.state.tools),
                 custom_instructions=self.settings.custom_instructions,
                 extensions=(),
@@ -372,6 +404,7 @@ class AgentSession:
 
     def dispose(self) -> None:
         """Clean up resources."""
+        self.permissions.close()
         if self._unsubscribe:
             self._unsubscribe()
             self._unsubscribe = None

xdog_coding-2.2.0/src/xdog/coding/core/permissions.py

@@ -0,0 +1,275 @@
+"""Runtime permission policy and approval broker for coding-agent tools."""
+
+from __future__ import annotations
+
+import asyncio
+import json
+import re
+import threading
+import uuid
+from collections.abc import Callable, Mapping
+from dataclasses import dataclass
+from typing import Any, Literal, cast
+
+from xdog.agent import BeforeToolCallContext, BeforeToolCallResult
+
+PermissionMode = Literal["ask", "ask-all", "allow-all", "deny"]
+PermissionDecision = Literal["allow_once", "allow_session", "deny"]
+PermissionRequestHandler = Callable[["PermissionRequest"], None]
+
+_PERMISSION_MODES: tuple[PermissionMode, ...] = ("ask", "ask-all", "allow-all", "deny")
+_ALLOW_DECISIONS = ("allow_once", "allow_session")
+_READ_ONLY_FS_ACTIONS = frozenset({"read", "ls", "grep", "find"})
+_SECRET_KEY = re.compile(r"(?:password|passwd|secret|token|authorization|api[_-]?key|credential)", re.I)
+_MAX_DISPLAY_STRING = 2_000
+
+
+@dataclass(frozen=True, slots=True)
+class PermissionRequest:
+    """A tool call waiting for a decision from a user-facing approver."""
+
+    id: str
+    tool_name: str
+    arguments: dict[str, Any]
+    summary: str
+
+
+@dataclass(slots=True)
+class _PendingApproval:
+    loop: asyncio.AbstractEventLoop
+    future: asyncio.Future[PermissionDecision]
+    rule_key: str
+
+
+def normalize_permission_mode(raw: object) -> PermissionMode:
+    """Return a valid mode, failing closed for malformed configuration."""
+    if isinstance(raw, str) and raw in _PERMISSION_MODES:
+        return raw
+    return "deny"
+
+
+def tool_call_requires_approval(
+    mode: PermissionMode,
+    tool_name: str,
+    arguments: Mapping[str, Any],
+) -> bool:
+    """Classify whether a call needs an external decision under *mode*."""
+    if mode == "allow-all":
+        return False
+    if mode == "ask-all":
+        return True
+
+    # `deny` shares the safe read-only allowlist with `ask`; everything else is
+    # blocked without prompting.
+    if tool_name == "current_time":
+        return False
+    if tool_name == "filesystem":
+        action = arguments.get("action")
+        return not isinstance(action, str) or action not in _READ_ONLY_FS_ACTIONS
+    return True
+
+
+def _redact(value: Any, *, key: str = "") -> Any:
+    if key and _SECRET_KEY.search(key):
+        return "<redacted>"
+    if isinstance(value, Mapping):
+        return {str(k): _redact(v, key=str(k)) for k, v in value.items()}
+    if isinstance(value, (list, tuple)):
+        return [_redact(item) for item in value]
+    if isinstance(value, str) and len(value) > _MAX_DISPLAY_STRING:
+        omitted = len(value) - _MAX_DISPLAY_STRING
+        return f"{value[:_MAX_DISPLAY_STRING]}… <{omitted} chars omitted>"
+    return value
+
+
+def _request_arguments(tool_name: str, arguments: Mapping[str, Any]) -> dict[str, Any]:
+    """Return redacted, bounded arguments suitable for terminals and RPC."""
+    displayed = cast(dict[str, Any], _redact(dict(arguments)))
+    if tool_name == "filesystem":
+        content = arguments.get("content")
+        if isinstance(content, str):
+            displayed["content"] = f"<{len(content)} characters>"
+    return displayed
+
+
+def _summary(tool_name: str, arguments: Mapping[str, Any]) -> str:
+    if tool_name == "bash":
+        command = str(arguments.get("command", "")).strip()
+        if len(command) > 500:
+            command = command[:500] + "…"
+        return f"Run shell command:\n{command}" if command else "Run a shell command"
+    if tool_name == "filesystem":
+        action = str(arguments.get("action", "unknown"))
+        path = str(arguments.get("path", ""))
+        if action == "write":
+            size = len(str(arguments.get("content", "")))
+            return f"Write {size} characters to {path or '(unknown path)'}"
+        if action == "edit":
+            return f"Edit {path or '(unknown path)'}"
+        if action == "delete":
+            return f"Delete {path or '(unknown path)'}"
+        return f"Filesystem {action}: {path}".rstrip()
+    try:
+        rendered = json.dumps(_redact(dict(arguments)), ensure_ascii=False, sort_keys=True)
+    except (TypeError, ValueError):
+        rendered = repr(arguments)
+    return f"Run {tool_name}: {rendered}"
+
+
+def _rule_key(tool_name: str, arguments: Mapping[str, Any]) -> str:
+    """Build a conservative exact-call session rule key."""
+    try:
+        encoded = json.dumps(dict(arguments), ensure_ascii=False, sort_keys=True, default=repr)
+    except (TypeError, ValueError):
+        encoded = repr(sorted((str(k), repr(v)) for k, v in arguments.items()))
+    return f"{tool_name}\0{encoded}"
+
+
+class PermissionManager:
+    """Enforce tool policy and bridge async tool calls to a UI approver.
+
+    The hook runs in the agent's asyncio loop, which is a background thread in
+    interactive mode. Request handlers may run on that thread, but decisions may
+    be submitted from any thread; :meth:`resolve` schedules completion on the
+    future's owning event loop.
+    """
+
+    def __init__(self, mode: object = "ask") -> None:
+        self._mode = normalize_permission_mode(mode)
+        self._handler: PermissionRequestHandler | None = None
+        self._pending: dict[str, _PendingApproval] = {}
+        self._session_rules: set[str] = set()
+        self._lock = threading.RLock()
+        self._closed = False
+
+    @property
+    def mode(self) -> PermissionMode:
+        return self._mode
+
+    @property
+    def has_approver(self) -> bool:
+        with self._lock:
+            return self._handler is not None and not self._closed
+
+    def set_mode(self, mode: object) -> None:
+        self._mode = normalize_permission_mode(mode)
+
+    def set_request_handler(self, handler: PermissionRequestHandler | None) -> None:
+        with self._lock:
+            self._handler = handler
+
+    def clear_session_rules(self) -> None:
+        with self._lock:
+            self._session_rules.clear()
+
+    async def before_tool_call(
+        self,
+        ctx: BeforeToolCallContext,
+        cancel: asyncio.Event | None = None,
+    ) -> BeforeToolCallResult | None:
+        """Agent hook that permits, waits for approval, or blocks a tool call."""
+        args = dict(ctx.args) if isinstance(ctx.args, Mapping) else {}
+        tool_name = ctx.tool_call.name
+
+        if not tool_call_requires_approval(self._mode, tool_name, args):
+            return None
+
+        rule_key = _rule_key(tool_name, args)
+        with self._lock:
+            if rule_key in self._session_rules:
+                return None
+            handler = self._handler
+            closed = self._closed
+
+        if self._mode == "deny":
+            return BeforeToolCallResult(
+                block=True,
+                reason="Tool call denied by permission policy",
+            )
+        if closed or handler is None:
+            return BeforeToolCallResult(
+                block=True,
+                reason="Tool call requires approval, but no permission approver is available",
+            )
+
+        request = PermissionRequest(
+            id=uuid.uuid4().hex,
+            tool_name=tool_name,
+            arguments=_request_arguments(tool_name, args),
+            summary=_summary(tool_name, args),
+        )
+        loop = asyncio.get_running_loop()
+        future: asyncio.Future[PermissionDecision] = loop.create_future()
+        pending = _PendingApproval(loop=loop, future=future, rule_key=rule_key)
+        with self._lock:
+            if self._closed:
+                return BeforeToolCallResult(block=True, reason="Permission manager is closed")
+            self._pending[request.id] = pending
+
+        cancel_task: asyncio.Task[PermissionDecision] | None = None
+        try:
+            handler(request)
+            if cancel is not None:
+                async def _wait_for_cancel() -> PermissionDecision:
+                    await cancel.wait()
+                    return "deny"
+
+                cancel_task = asyncio.create_task(_wait_for_cancel())
+                waiters: set[asyncio.Future[PermissionDecision]] = {future, cancel_task}
+                done, _ = await asyncio.wait(
+                    waiters,
+                    return_when=asyncio.FIRST_COMPLETED,
+                )
+                if cancel_task in done and future not in done:
+                    return BeforeToolCallResult(
+                        block=True,
+                        reason="Tool approval was cancelled",
+                    )
+            decision = await future
+        except Exception as exc:
+            return BeforeToolCallResult(
+                block=True,
+                reason=f"Could not obtain tool approval: {exc}",
+            )
+        finally:
+            if cancel_task is not None and not cancel_task.done():
+                cancel_task.cancel()
+            with self._lock:
+                self._pending.pop(request.id, None)
+
+        if decision == "allow_session":
+            with self._lock:
+                self._session_rules.add(rule_key)
+        if decision in _ALLOW_DECISIONS:
+            return None
+        return BeforeToolCallResult(block=True, reason="User denied this tool call")
+
+    def resolve(self, request_id: str, decision: PermissionDecision) -> bool:
+        """Resolve a pending request from any thread. Return False if unknown."""
+        if decision not in ("allow_once", "allow_session", "deny"):
+            return False
+        with self._lock:
+            pending = self._pending.get(request_id)
+        if pending is None:
+            return False
+
+        def _set_result() -> None:
+            if not pending.future.done():
+                pending.future.set_result(decision)
+
+        pending.loop.call_soon_threadsafe(_set_result)
+        return True
+
+    def deny_all(self) -> None:
+        """Deny every pending request without closing the manager."""
+        with self._lock:
+            request_ids = list(self._pending)
+        for request_id in request_ids:
+            self.resolve(request_id, "deny")
+
+    def close(self) -> None:
+        """Fail all pending requests and reject future interactive approvals."""
+        with self._lock:
+            self._closed = True
+            self._handler = None
+        self.deny_all()