Review the call before you act

Classify the call you are about to run

tool-approval looks at one proposed call. The sample deletes a local build directory. The review choice is clear or caution. A second question asks whether the effect is hard to undo.

Clear means the call looks like a read of ordinary project files. It is not permission to run the tool. The engine never executes it.

{
  "pattern": "tool-approval",
  "state": "Tool: shell. Arguments: rm -rf ./dist. The command deletes the local build directory."
}

Record the chain if the task has several checks

Start a session with the intent, pass that session id on each run, then complete it with a status and a short outcome. Grouping calls makes the chain visible. It does not by itself reduce cost.

Closed sessions cannot be extended. The session has to belong to the same connection.