Skip to content

permissionDecisionReason from PreToolUse hooks not forwarded to can_use_tool callback #816

@Pajk

Description

@Pajk

Summary

When a PreToolUse hook returns permissionDecision: "ask" with a permissionDecisionReason, the CLI invokes the SDK's can_use_tool callback — but the reason string is not included in the wire message and is therefore inaccessible to SDK consumers.

Current wire type (SDKControlPermissionRequest)

class SDKControlPermissionRequest(TypedDict):
    subtype: Literal["can_use_tool"]
    tool_name: str
    input: dict[str, Any]
    permission_suggestions: list[Any] | None
    blocked_path: str | None
    tool_use_id: str
    agent_id: NotRequired[str]
    # ← no permissionDecisionReason

ToolPermissionContext (passed to can_use_tool) similarly has no hook-related field — only signal, suggestions, tool_use_id, and agent_id.

The only occurrence of permissionDecisionReason in the package is in PreToolUseHookSpecificOutput — an outbound hook response type, not an inbound callback field.

Use case

We have a Slack bot that uses the Agent SDK and surfaces permission requests as interactive messages. When a hook detects a dangerous command (e.g. rm -rf) and sets a warning reason, we want to display that reason to the user in the permission prompt — but it's inaccessible because the CLI doesn't forward it.

Requested change

  1. Include the hook's permissionDecisionReason in the can_use_tool control message the CLI sends to the SDK
  2. Add an optional field (e.g. hook_decision_reason: str | None) to SDKControlPermissionRequest
  3. Expose it on ToolPermissionContext so SDK consumers can surface it in custom permission UIs

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions