Render only what the wire proves.
Session identity, exact tool-call identity, and the live one-shot option ids.
Tool name, command, arguments, target path, effect, and risk level.
Apply a predeclared machine policy or show an explicit generic prompt that defaults to reject.
Do not decode meaning from an id prefix, label, model text, or stale cached call.
Choose the product mode honestly.
Select an option offered by the exact request. Missing policy or option cancels.
Say that details are unavailable. Preserve “Allow once”; never imply durable trust.
Join DSH-native tool events by Session plus exact call id, then redact for display.
Expire pending cards on result, cancellation, disposal, reconnect, and timeout. One server-side response wins; late or duplicated browser clicks cannot create a new grant.
Primary evidence.
Build the approval boundary, not just the card.
The complete guide includes TypeScript policy handling, a generic prompt, a rich-host correlation design, lifecycle races, Web security controls, and ten acceptance gates.
Read the complete guide