approve-blocked

1import type { EngineInterface, Register } from 'claude-code'
2
3import { classifierBlock } from './blocked'
4
5const MAX_SHOWN = 600
6
7/** Puts `! <command>` in an empty prompt box and tells the model to hand the command to the user. */
8async function handOff($: EngineInterface, command: string, why: string) {
9  // Fill only an empty prompt box: replacing would throw away what the user was typing.
10  const isFilled = (await $.prompt.read()).text.trim() === '' && (await $.prompt.fill({ text: `! ${command}`, mode: 'replace' })).isFilled
11  $.ui.toast(isFilled ? 'approve-blocked: press Enter in your prompt box to run the command' : 'approve-blocked: run the command yourself with !')
12  return {
13    deny:
14      `approve-blocked: ${why}, so it was handed to the user` +
15      (isFilled ? ' (placed in their prompt box as a `!` command)' : '') +
16      '. Do not retry or work around it. End your turn now with no further tool calls, and show the user ' +
17      'this exact line to run, in a code block, `!` included:\n\n' +
18      `! ${command}\n\n` +
19      'Its output lands in this conversation when they run it.',
20  }
21}
22
23export const register: Register = on => {
24  // Commands the user approved after a block, while their retry runs, so tool.check can let them past the classifier.
25  const approved = new Set<string>()
26
27  on('tool.call', { tool: 'Bash' }, async ($, e, next) => {
28    const result = await next(e)
29    const reason = classifierBlock(result)
30    if (reason === undefined) return result
31
32    // Another guard (prod-guard) already had the user approve this call: don't ask twice.
33    if ((await $.tool.check({ tool: 'Bash', input: { command: e.command } })).decision === 'allow') {
34      return handOff($, e.command, `auto mode blocked it although the user had approved it (${reason})`)
35    }
36
37    const shown = e.command.length > MAX_SHOWN ? `${e.command.slice(0, MAX_SHOWN)}…` : e.command
38    const answer = await $.ui.ask(`Auto mode blocked this command (${reason}). Run it anyway?\n\n${shown}`, {
39      header: 'Blocked',
40      options: ['Run', "Don't run"],
41    })
42    if (answer !== 'Run') {
43      return {
44        deny:
45          `approve-blocked: auto mode blocked the command and the user chose not to run it${answer === "Don't run" ? '' : `: ${answer}`}. ` +
46          'Do not ask them to run it themselves with `!`; go on without it, or ask what to do instead.',
47      }
48    }
49    approved.add(e.command)
50    try {
51      const retry = await next(e)
52      const again = classifierBlock(retry)
53      return again === undefined ? retry : await handOff($, e.command, `auto mode blocked it again after the user chose Run (${again})`)
54    } finally {
55      approved.delete(e.command)
56    }
57  }).catch(($, e, next) =>
58    next.called ? next(e) : { deny: 'approve-blocked: the hook failed; the command did not run.' },
59  )
60
61  on('tool.check', { tool: 'Bash' }, async ($, e, next) => {
62    const verdict = await next(e)
63    const command = (e.input as { command?: string }).command ?? ''
64    // Only the classifier's question is answered for the user: a settings deny rule still stands.
65    return approved.has(command) && verdict.decision === 'ask'
66      ? { decision: 'allow', reason: 'approve-blocked: approved by the user after an auto-mode block' }
67      : verdict
68  })
69}
70

1import type { ToolCallResult } from 'claude-code'
2
3const CLASSIFIER_BLOCK = /denied by the Claude Code auto mode classifier/
4
5/** The classifier's reason when a call's result is an auto-mode block, else undefined. */
6export function classifierBlock(result: ToolCallResult): string | undefined {
7  const text = result.deny ?? (result.isError === true ? result.text : undefined)
8  if (text === undefined || !CLASSIFIER_BLOCK.test(text)) return undefined
9  return /Reason: (.+?)\. If you have/s.exec(text)?.[1] ?? 'no reason given'
10}
11