Blocks and Disputes

When the reviewer decides an agent action is problematic, it issues a block. The agent can dispute the block, and the reviewer can lift it. This page explains the three block types and the dispute mechanism.

Block types

Tool block

Issued during PreToolUse review. The tool is denied before it executes. The agent sees a block message explaining why the tool was rejected.

While tool-blocked, the agent can only use tools in the whitelisted list (if configured) and the message_adversary MCP tool. All other tool calls are denied until the block is resolved.

Write block

A specialized form of tool block for Edit and Write operations. The reviewer sees the proposed file change (the diff) and can reject it before it touches disk. The file is not modified.

Stop block

Issued when the agent tries to end its turn via the Stop hook. The reviewer determines the work isn't done and forces the agent to continue. The reviewer's feedback is injected into the agent's session explaining what still needs to be done.

Disputing a block

When the agent is blocked, it can call the message_adversary MCP tool to send a message directly into the reviewer's monitoring session. This is a conversation – the agent explains why it thinks the block is wrong, and the reviewer responds.

If the reviewer agrees, it issues a release determination. The client lifts the block and the agent resumes normal operation.

Agent → message_adversary("I need to run this shell command because...")
Frank → "Understood, releasing the block."
→ Block lifted, agent continues

The agent can send multiple messages – there's no limit on the dispute conversation. But the reviewer is adversarial by default; it won't release just because the agent asks nicely.

User intervention

You can also intervene directly:

/z unblock clears all active blocks for the session without disabling supervision. The reviewer keeps watching and can issue new blocks. Use this when message_adversary is unavailable (MCP glitch, lost session ID) and you need to clear the jam. Pass --all if the session ID is lost.

/z direct sends a high-priority directive to the reviewer that overrides its behavior. Use this to tell the reviewer to stand down on a specific issue.

/z ask sends a question without changing the reviewer's behavior – useful for understanding why a block was issued.

/z disable turns off monitoring entirely. Blocks are cleared and no new ones can be issued until you /z enable. Use as a last resort.

What stays available during a block

Even while blocked, the agent can always use:

• The message_adversary MCP tool (to dispute the block)
• Any tools in the whitelisted list (configured in your settings)
• /z slash commands (backed by the zwischen CLI, which is exempt from tool blocking)

Everything else is denied until the block is released.