Struct PermissionRequestShell 

pub struct PermissionRequestShell {

    pub can_offer_session_approval: bool,
    pub commands: Vec<PermissionRequestShellCommand>,
    pub command_segments: Option<Vec<PermissionRequestShellCommandSegment>>,
    pub full_command_text: String,
    pub has_write_file_redirection: bool,
    pub intention: String,
    pub kind: PermissionRequestShellKind,
    pub managed_approval_required: Option<bool>,
    pub possible_paths: Vec<String>,
    pub possible_urls: Vec<PermissionRequestShellPossibleUrl>,
    pub request_sandbox_bypass: Option<bool>,
    pub request_sandbox_bypass_reason: Option<String>,
    pub request_sandbox_permissive: Option<bool>,
    pub resolved_paths: Option<HashMap<String, String>>,
    pub resolved_working_directory: Option<String>,
    pub tool_call_id: Option<String>,
    pub warning: Option<String>,
}

Shell command permission request

Fields

can_offer_session_approval: bool

Whether the UI can offer session-wide approval for this command pattern

commands: Vec<PermissionRequestShellCommand>

Parsed command identifiers found in the command text

command_segments: Option<Vec<PermissionRequestShellCommandSegment>>

Parsed command segments, including arguments, used for managed policy matching

full_command_text: String

The complete shell command text to be executed

has_write_file_redirection: bool

Whether the command includes a file write redirection (e.g., > or >>)

intention: String

Human-readable description of what the command intends to do

kind: PermissionRequestShellKind

Permission kind discriminator

managed_approval_required: Option<bool>

Whether managed policy requires a human response and forbids host auto-approval

possible_paths: Vec<String>

File paths that may be read or written by the command

possible_urls: Vec<PermissionRequestShellPossibleUrl>

URLs that may be accessed by the command

request_sandbox_bypass: Option<bool>

True when the tool is asking to run this command outside the sandbox, either because the command detaches and cannot be sandboxed at all, or because a sandboxed run looked blocked (host opted in via sandbox.allowBypass). The model cannot ask for this; only the tool raises it. This is a request, not a grant: the command runs unsandboxed only if the user approves this permission request. Hosts should highlight the elevated risk in the approval UI.

request_sandbox_bypass_reason: Option<String>

What the tool tells the user about the bypass on offer: which policy rule blocked the call, or why it cannot be sandboxed. Only meaningful when requestSandboxBypass is true.

request_sandbox_permissive: Option<bool>

True when the requested escalation is a permissive retry rather than a full bypass: the command re-runs inside the sandbox with its file and process restrictions recording instead of blocking, while the network policy stays enforced. Always accompanied by requestSandboxBypass, so hosts that do not recognize this field still treat the request as the escalation it is. Hosts that do recognize it must not describe the command as running outside the sandbox, which would overstate the privilege being granted.

resolved_paths: Option<HashMap<String, String>>

Runtime-resolved canonical object each possiblePaths entry names, keyed by the requested spelling, used for authorization identity checks. Internal and experimental; clients should continue to display possiblePaths.

Experimental. This type is part of an experimental wire-protocol surface and may change or be removed in future SDK or CLI releases.

resolved_working_directory: Option<String>

Runtime-resolved canonical working directory the command runs in, used for authorization identity checks. Internal and experimental; clients should not display it.

Experimental. This type is part of an experimental wire-protocol surface and may change or be removed in future SDK or CLI releases.

tool_call_id: Option<String>

Tool call ID that triggered this permission request

warning: Option<String>

Optional warning message about risks of running this command

Trait Implementations

impl Clone for PermissionRequestShell

fn clone(&self) -> PermissionRequestShell

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for PermissionRequestShell

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for PermissionRequestShell

fn default() -> PermissionRequestShell

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for PermissionRequestShell

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for PermissionRequestShell

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.