feat: add permission request UI for sensitive tool operations

[Gkrumbach07]

Summary

• Implements can_use_tool callback in the Claude SDK adapter to intercept sensitive tool operations (e.g., editing .mcp.json)
• Emits synthetic PermissionRequest tool calls through the AG-UI event stream, reusing the existing halt-interrupt-resume pattern from AskUserQuestion
• Adds a new PermissionRequestMessage frontend component with Allow/Deny buttons that surfaces permission requests in the session chat UI
• Tracks approved operations per-session so retries succeed automatically without re-prompting

Test plan

• Frontend build passes (npm run build — 0 errors, 0 warnings)
• Frontend type check passes (tsc --noEmit)
• All 615 frontend unit tests pass (npx vitest run)
• Manual test: create a session, ask Claude to edit a sensitive file, verify permission UI appears with Allow/Deny buttons
• Manual test: click Allow, verify Claude retries and the edit succeeds
• Manual test: click Deny, verify Claude receives the denial and adjusts its approach

🤖 Generated with Claude Code

Summary by CodeRabbit

• New Features

  • Permission request UI: users can Approve/Deny tool requests (description, timestamp, optional file/command) with pending/approved/denied states and submission controls.
  • Permission gating persists across runs so previously approved operations are honored.

• Refactor

  • Unified detection of whether a tool produced a result for consistent behavior.
  • Standardized tool-name handling and expanded human-in-the-loop detection to include permission requests.

[coderabbitai]

📝 Walkthrough

Walkthrough

Adds a permission-request human-in-the-loop flow: new PermissionRequest tool input and frontend UI, shared result-presence helper, and adapter/runtime plumbing that emits synthetic permission events, awaits user approval, and resumes or denies tool execution accordingly.

Changes

Cohort / File(s)	Summary
Frontend Permission UI components/frontend/src/components/session/permission-request.tsx, components/frontend/src/components/session/ask-user-question.tsx, components/frontend/src/components/ui/stream-message.tsx	Added PermissionRequestMessage component and integrated it into StreamMessage via normalized tool-name matching. Replaced local result-check in ask-user-question.tsx with shared hasToolResult usage.
Type Definitions components/frontend/src/types/agentic-session.ts	Added exported PermissionRequestInput type and exported hasToolResult(resultBlock?) helper for consistent result-presence checks.
Runtime Adapter (Claude) components/runners/ambient-runner/ag_ui_claude_sdk/adapter.py	Added permission-gating: _approved_operations set, set_permission_worker(), can_use_tool callback that injects synthetic PermissionRequest tool events to halt execution, handling of perm-prefixed tool-call lifecycle, and applying approvals on subsequent runs.
Bridge & Session Worker components/runners/ambient-runner/ambient_runner/bridges/claude/bridge.py, components/runners/ambient-runner/ambient_runner/bridges/claude/session.py	Bridge binds/unbinds the active worker on adapter before/after runs. SessionWorker exposes active_output_queue property for adapter event injection.
Agent Status Hook components/frontend/src/hooks/use-agent-status.ts	Generalized tool-name normalization and expanded waiting-input detection to include permission-request tools (predicate renamed to isHumanInTheLoopTool).

Sequence Diagram(s)

sequenceDiagram
    participant Claude as Claude SDK
    participant Adapter as ClaudeAgentAdapter
    participant WorkerQueue as SessionWorker Output Queue
    participant Frontend as Frontend UI
    participant User as User

    Claude->>Adapter: can_use_tool(tool_call)
    Adapter->>Adapter: compute permission_key
    alt key in _approved_operations
        Adapter->>Claude: allow tool usage
    else not approved
        Adapter->>WorkerQueue: inject synthetic PermissionRequest (ToolCallStart/Args/End)
        Adapter->>Claude: deny tool usage
        WorkerQueue->>Frontend: deliver PermissionRequest event
        Frontend->>Frontend: render PermissionRequestMessage
        Frontend->>User: display prompt (Allow/Deny)
        User->>Frontend: respond (approved/denied)
        Frontend->>WorkerQueue: submit JSON response (approved, key)
        WorkerQueue->>Adapter: deliver permission response
        Adapter->>Adapter: update _approved_operations if approved
        Adapter->>Claude: retry tool call (allow/deny)
    end
    Claude->>Claude: execute tool (if allowed)

Loading

---

Important

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

❌ Failed checks (1 error, 1 warning)

Check name	Status	Explanation	Resolution
Performance And Algorithmic Complexity	❌ Error	The _approved_operations set persists across runs without eviction, accumulating indefinitely as the adapter is intentionally cached and reused.	Implement LRU cache with fixed size (e.g., max 1000 entries), add TTL-based auto-eviction, or clear at session boundaries; document approval persistence scope.
Docstring Coverage	⚠️ Warning	Docstring coverage is 63.64% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	Title follows Conventional Commits format (feat: scope/description) and accurately describes the main change: adding a frontend UI component for permission requests on sensitive tool operations.
Security And Secret Handling	✅ Passed	Permission request implementation demonstrates secure security practices: JSON parsing safely wrapped in try/except, API credentials loaded from environment variables only, approval tracking uses stable keys preventing collisions, no injection/command/SQL/path traversal vulnerabilities, proper lock scoping with cleanup.
Kubernetes Resource Safety	✅ Passed	Kubernetes Resource Safety check is not applicable; PR modifies only application-level code (React/TypeScript frontend, Python adapter logic, session workers) with no K8s manifest changes.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/permission-request-ui

✨ Simplify code

• Create PR with simplified code
• Commit simplified code in branch feat/permission-request-ui

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@components/runners/ambient-runner/ag_ui_claude_sdk/adapter.py`:
- Around line 976-992: The conditional uses
message.tool_call_id.startswith(_PERM_TOOL_ID_PREFIX) without guarding against
tool_call_id being None, which can raise AttributeError for ToolCallEndEvent
instances missing tool_call_id; update the if condition in the block handling
ToolCallEndEvent to first verify message.tool_call_id is not None (or truthy)
before calling startswith, then proceed to call flush_pending_msg(), set
self._halted, self._halted_tool_call_id and halt_event_stream as currently
implemented when the guarded check passes.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 019bb7d7-c398-4f4e-a5ff-c25149531d0b

📥 Commits

Reviewing files that changed from the base of the PR and between bfcd54e and 0458999.

📒 Files selected for processing (5)

• components/frontend/src/components/session/ask-user-question.tsx
• components/frontend/src/components/session/permission-request.tsx
• components/frontend/src/hooks/use-agent-status.ts
• components/runners/ambient-runner/ag_ui_claude_sdk/adapter.py
• components/runners/ambient-runner/ambient_runner/bridges/claude/bridge.py

🚧 Files skipped from review as they are similar to previous changes (1)

• components/frontend/src/components/session/permission-request.tsx

[github-actions]

AI was unable to resolve issues after 3 attempts. Needs human attention.

[Gkrumbach07]

@ambient-code please fix

Performance And Algorithmic Complexity | ❌ Error | The _approved_operations set persists across runs without eviction, accumulating indefinitely as the adapter is intentionally cached and reused. | Implement LRU cache with fixed size (e.g., max 1000 entries), add TTL-based auto-eviction, or clear at session boundaries; document approval persistence scope.