Approve or rewrite tool inputs with a callback

Use can_use_tool to decide separately for reads, writes, and commands, and redirect writes to a safe directory.

Goal

Require application policy checks before agent tool requests are allowed to run.

Register an async callback with ClaudeAgentOptions(can_use_tool=callback, permission_mode="default"). [perm]
Return PermissionResultAllow() or PermissionResultDeny(message=...) based on tool_name and input_data; a write can be redirected with Allow carrying updated_input. [perm]
Test allow, deny, and rewrite branches with read-only or temporary paths; ensure callback logs are redacted. [perm]

Assert denied operations did not run, rewritten file_path equals the safe target, and allowed actions stay in scope.

If the callback is not invoked, inspect permission_mode and existing auto-approval settings; do not log raw inputs.

Authorize only the test directory; do not hard-code sensitive paths or log confidential inputs.

The example’s prefix check is not full path canonicalization; production policy must also address symlinks and traversal.

These values describe the upstream repository, not popularity or likes for an individual skill or playbook.

No metrics snapshot is available yet.

License: MIT