Struct PlanApprovalGate 

pub struct PlanApprovalGate {
    pub exploring_plan_mode: Arc<AtomicBool>,
    pub pending_plan: Arc<RwLock<Option<String>>>,
    /* private fields */
}

Shared state for the agent-driven plan mode approval flow.

A single Arc<PlanApprovalGate> is created in [AgentRuntimeBuilder::build] and shared between:

• EnterPlanModeTool — sets exploring_plan_mode
• ExitPlanModeTool — clears flag, emits event, awaits decision
• [AgentRuntime] — calls approve / reject
• RunCore — reads exploring_plan_mode to gate writes

Fields

exploring_plan_mode: Arc<AtomicBool>

true while the agent is in exploring (read-only plan) mode.

pending_plan: Arc<RwLock<Option<String>>>

The plan text currently pending review (set by ExitPlanModeTool).

Implementations

impl PlanApprovalGate

pub fn new() -> Self

Create a fresh gate (exploring mode off, no pending decision).

pub async fn wait_for_approval(&self) -> PlanApprovalResult

Block until the human reviewer sets a decision.

Reads the response without holding any lock across .await, preventing deadlocks. On return the stored response is cleared so the gate can be reused for the next exit_plan_mode call.

pub fn approve(&self)

Approve the pending plan. Called by TUI / HTTP on user confirmation.

Clears the pending plan text so stale re-injection after compaction cannot occur — the reinjector reads pending_plan which returns None after this call.

pub fn reject(&self, reason: impl Into<String>)

Reject the pending plan with a reason. Called by TUI / HTTP.

Clears the pending plan text so stale re-injection after compaction cannot occur.

pub fn pending_plan(&self) -> Option<String>

Return the currently-pending plan text, if any (set by begin_approval, cleared by approve or reject). Used by post-compact re-injection so the model retains the plan across compaction while it is still pending approval.

Returns None gracefully on a poisoned lock (invariant #5 — no unwrap in product code).

pub fn begin_approval(&self, plan_text: String)

Set the pending plan text and clear any stale approval/rejection from a previous cycle.

Must be called instead of writing pending_plan directly so that a ghost response left over from a duplicate concurrent HTTP request (TOCTOU race) cannot bypass the human-approval gate on the next round.

Trait Implementations

impl Debug for PlanApprovalGate

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for PlanApprovalGate

fn default() -> Self

Returns the “default value” for a type.