Tool denied

import { createServer } from "node:http";
import Cadenya from "@cadenya/cadenya";

// Reads CADENYA_API_KEY and CADENYA_WEBHOOK_SECRET from the environment.
const cadenya = new Cadenya();

createServer(async (req, res) => {
  if (req.method !== "POST" || req.url !== "/webhooks/cadenya") {
    res.writeHead(404).end();
    return;
  }

  const chunks = [];
  for await (const chunk of req) chunks.push(chunk);
  const payload = Buffer.concat(chunks).toString("utf8");

  let event;
  try {
    // Checks the signature and timestamp, then parses the envelope.
    event = await cadenya.webhooks.unwrap(payload, req.headers);
  } catch {
    res.writeHead(401).end("bad signature");
    return;
  }

  if (event.type === "objective_event.tool_denied") {
    const { objective, objectiveEvent } = event.data;
    if (objectiveEvent.data.type === "toolDenied") {
      const { toolCallId, memo } = objectiveEvent.data.toolDenied;
      console.log(objective.id, "denied", toolCallId, "because:", memo);
    }
  }

  // Answer quickly. Do slow work after the 2xx.
  res.writeHead(200).end();
}).listen(3000);

package main

import (
	"io"
	"log"
	"net/http"

	cadenya "go.cadenya.com/cadenya-go"
)

func main() {
	// Reads CADENYA_API_KEY and CADENYA_WEBHOOK_SECRET from the environment.
	client, err := cadenya.NewClient()
	if err != nil {
		log.Fatal(err)
	}

	http.HandleFunc("POST /webhooks/cadenya", func(w http.ResponseWriter, r *http.Request) {
		payload, err := io.ReadAll(r.Body)
		if err != nil {
			http.Error(w, "read failed", http.StatusBadRequest)
			return
		}

		// Checks the signature and timestamp, then parses the envelope.
		event, err := client.Webhooks().Unwrap(payload, r.Header)
		if err != nil {
			http.Error(w, "bad signature", http.StatusUnauthorized)
			return
		}

		if d := event.Data.ObjectiveEvent.Data.ToolDenied; d != nil {
			log.Printf("%s denied %s because: %s", event.Data.Objective.ID, d.ToolDenied.ToolCallID, d.ToolDenied.Memo)
		}

		// Answer quickly. Do slow work after the 2xx.
		w.WriteHeader(http.StatusOK)
	})

	log.Fatal(http.ListenAndServe(":3000", nil))
}

# gem install sinatra cadenya
require "sinatra"
require "cadenya"

# Reads CADENYA_API_KEY and CADENYA_WEBHOOK_SECRET from the environment.
client = Cadenya::Client.new

post "/webhooks/cadenya" do
  payload = request.body.read
  headers = {
    "webhook-id" => request.env["HTTP_WEBHOOK_ID"],
    "webhook-timestamp" => request.env["HTTP_WEBHOOK_TIMESTAMP"],
    "webhook-signature" => request.env["HTTP_WEBHOOK_SIGNATURE"]
  }

  begin
    # Checks the signature and timestamp, then parses the envelope.
    event = client.unwrap_webhook(payload, headers)
  rescue Cadenya::WebhookVerificationError
    halt 401, "bad signature"
  end

  if event.type == "objective_event.tool_denied"
    data = event.data.objective_event.data
    if data.is_a?(Cadenya::Types::ObjectiveEventData_ToolDenied)
      puts "#{event.data.objective.id} denied #{data.tool_denied.tool_call_id} because: #{data.tool_denied.memo}"
    end
  end

  # Answer quickly. Do slow work after the 2xx.
  status 200
end

# Point SECRET at the same whsec_ key your handler uses, or verification fails.
SECRET="whsec_V2ViaG9va3NBcmVGdW5Ub0RvY3VtZW50ISEhISEhISE="
URL="http://localhost:3000/webhooks/cadenya"

ID="wh_01HXKD2E5NQM3T9AYWCFGVF6Y6"
TS="$(date +%s)"
BODY="$(cat <<'JSON'
{
  "type": "objective_event.tool_denied",
  "timestamp": "2026-08-26T14:03:11Z",
  "data": {
    "agent": {
      "id": "agent_01HXKD2E5NQM3T9AYWCFMGWT9Y",
      "accountId": "account_01HXKD2E5NQM3T9AYWCFTJHJVF",
      "workspaceId": "workspace_01HXKD2E5NQM3T9AYWCF133E3Q",
      "name": "Support Triage",
      "externalId": "",
      "labels": {},
      "profileId": "profile_01HXKD2E5NQM3T9AYWCFS0AP08",
      "createdAt": "2026-08-01T09:00:00Z",
      "updatedAt": "2026-08-01T09:00:00Z"
    },
    "agentVariation": {
      "id": "agentvar_01HXKD2E5NQM3T9AYWCF32BSPP",
      "accountId": "account_01HXKD2E5NQM3T9AYWCFTJHJVF",
      "workspaceId": "workspace_01HXKD2E5NQM3T9AYWCF133E3Q",
      "name": "sonnet-strict-tools",
      "externalId": "",
      "labels": {},
      "profileId": "profile_01HXKD2E5NQM3T9AYWCFS0AP08",
      "createdAt": "2026-08-01T09:00:00Z",
      "updatedAt": "2026-08-01T09:00:00Z"
    },
    "objective": {
      "id": "obj_01HXKD2E5NQM3T9AYWCFQAZGFV",
      "accountId": "account_01HXKD2E5NQM3T9AYWCFTJHJVF",
      "workspaceId": "workspace_01HXKD2E5NQM3T9AYWCF133E3Q",
      "externalId": "ticket-4821",
      "labels": {
        "source": "zendesk"
      },
      "profileId": "profile_01HXKD2E5NQM3T9AYWCFS0AP08",
      "createdAt": "2026-08-26T14:03:11Z"
    },
    "objectiveEvent": {
      "metadata": {
        "id": "objevt_01HXKD2E5NQM3T9AYWCF8ZWBY0",
        "accountId": "account_01HXKD2E5NQM3T9AYWCFTJHJVF",
        "workspaceId": "workspace_01HXKD2E5NQM3T9AYWCF133E3Q",
        "externalId": "",
        "labels": {},
        "profileId": "profile_01HXKD2E5NQM3T9AYWCFS0AP08",
        "createdAt": "2026-08-26T14:03:11Z"
      },
      "contextWindowId": "objwin_01HXKD2E5NQM3T9AYWCFN7BSTR",
      "data": {
        "type": "toolDenied",
        "toolDenied": {
          "toolCallId": "toolcall_01HXKD2E5NQM3T9AYWCFTANFGV",
          "memo": "Do not issue refunds over $50 without a manager. Offer store credit instead."
        }
      }
    }
  }
}
JSON
)"

# Standard Webhooks: HMAC-SHA256 over "id.timestamp.body", keyed with the base64-decoded secret.
KEY_HEX="$(printf '%s' "${SECRET#whsec_}" | base64 -d | xxd -p -c 256)"
SIG="$(printf '%s.%s.%s' "$ID" "$TS" "$BODY" \
  | openssl dgst -sha256 -mac HMAC -macopt "hexkey:$KEY_HEX" -binary \
  | base64)"

curl -X POST "$URL" \
  -H "content-type: application/json" \
  -H "webhook-id: $ID" \
  -H "webhook-timestamp: $TS" \
  -H "webhook-signature: v1,$SIG" \
  --data-binary "$BODY"