Add destructive confirmation and import guidance

crates/crank-community-mcp/src/app.rs

@@ -98,6 +98,12 @@ struct ResolvedToolCall {
     tool: PublishedAgentTool,
 }
 
+struct ToolCallExecution {
+    tool: PublishedAgentTool,
+    arguments: Value,
+    confirmation_token: Option<String>,
+}
+
 #[derive(Clone, Debug, Deserialize)]
 struct AgentRoutePath {
     workspace_slug: String,
@@ -381,11 +387,12 @@ async fn mcp_post(
                 }
             };
 
-            let arguments = if tool_call_params.arguments.is_null() {
+            let mut arguments = if tool_call_params.arguments.is_null() {
                 json!({})
             } else {
                 tool_call_params.arguments
             };
+            let confirmation_token = take_confirmation_token(&mut arguments);
 
             match state
                 .catalog
@@ -402,6 +409,7 @@ async fn mcp_post(
                             &credential,
                             resolved,
                             arguments,
+                            confirmation_token,
                             &transport_request_id,
                         )
                         .await
@@ -457,6 +465,7 @@ async fn handle_tool_call(
     credential: &VerifiedMachineCredential,
     resolved: ResolvedToolCall,
     arguments: Value,
+    confirmation_token: Option<String>,
     transport_request_id: &str,
 ) -> Response {
     if !credential_allows_security_level(credential, resolved.tool.operation.security_level) {
@@ -483,8 +492,11 @@ async fn handle_tool_call(
         session,
         message,
         response_mode,
-        resolved.tool,
-        arguments,
+        ToolCallExecution {
+            tool: resolved.tool,
+            arguments,
+            confirmation_token,
+        },
         transport_request_id,
     )
     .await
@@ -583,12 +595,13 @@ async fn handle_base_tool_call(
     session: &SessionState,
     message: &Value,
     response_mode: ResponseMode,
-    tool: PublishedAgentTool,
-    arguments: Value,
+    execution: ToolCallExecution,
     transport_request_id: &str,
 ) -> Response {
+    let tool = execution.tool;
+    let arguments = execution.arguments;
     let operation = runtime_operation(&tool);
-    let runtime_request_context = RuntimeRequestContext::from_request_id(transport_request_id)
+    let mut runtime_request_context = RuntimeRequestContext::from_request_id(transport_request_id)
         .with_response_cache_scope(
             tool.workspace_id.as_str().to_owned(),
             tool.agent_id.as_str().to_owned(),
@@ -598,6 +611,9 @@ async fn handle_base_tool_call(
             Some(tool.agent_id.clone()),
             InvocationSource::AgentToolCall,
         );
+    if let Some(token) = execution.confirmation_token {
+        runtime_request_context = runtime_request_context.with_confirmation_token(token);
+    }
     let request_preview = build_request_preview(&state.runtime, &operation, &arguments);
     let started_at = Instant::now();
     let resolved_auth =
@@ -1151,6 +1167,16 @@ fn internal_jsonrpc_error(message: &Value, error: impl std::fmt::Display) -> Res
     )
 }
 
+fn take_confirmation_token(arguments: &mut Value) -> Option<String> {
+    let Value::Object(object) = arguments else {
+        return None;
+    };
+    object
+        .remove("_crank_confirmation_token")
+        .and_then(|value| value.as_str().map(str::to_owned))
+        .filter(|value| !value.trim().is_empty())
+}
+
 fn build_request_preview(
     runtime: &RuntimeExecutor,
     operation: &RuntimeOperation,