Always permissions for tools commands

[stanislavHamara]

Summary

• Adds a new "always allow this tool" option (T) to the tool confirmation dialog, allowing users to permanently approve specific tools or commands for the session
• For shell commands, creates granular permission patterns (e.g., shell:cmd=ls*) that auto-approve the specific command while still requiring confirmation for other commands
• Exposes the new approve-tool confirmation type via HTTP and ConnectRPC APIs

Details

When a tool requires confirmation, users now have 4 options:

• Y - approve this call once
• N - reject with optional reason
• T - always allow this tool/command for the session
• A - approve all tools (YOLO mode)

The T option intelligently builds permission patterns:

• For shell tool running ls -la: adds shell:cmd=ls* to session permissions
• For other tools like read_file: adds the tool name directly

These patterns leverage the existing permissions system and are persisted with the session.

API

The /resume endpoint now accepts a new confirmation type:

{
  "confirmation": "approve-tool",
  "tool_name": "shell:cmd=ls*"
}

[krissetto]

/review