@decidio/sdk 0.10.0 → 0.11.0

package/CHANGELOG.md

@@ -7,7 +7,55 @@ allowlist. Each entry names what changed, what a reader must do on upgrade, and
 
 ## Unreleased
 
-## 0.10.0 — connect a coding assistant in one tap
+## 0.11.0 — connect once, on in every project; no surprises; the connector connects a computer
+
+0.10.0 was never published (its tag was held for this release), so 0.11.0 is the first release with `connect`. It carries
+cycle connect-once's slice 1, 2a and 2b (founder 2026-10-29: one tag, after they merge).
+
+- **One connect per computer.** A connection now covers every repository on the computer, and `connect` switches the hook
+  on in your own `~/.claude/settings.json`, which every project reads. A repository connected the 0.10.0 way keeps its own
+  connection (read first). A cloud session and `--team` still use the repository's `.claude/settings.json`.
+- **The hook connects the computer itself.** A destructive command on a computer with no credential is refused with a link
+  and a short code (to Claude, and in a line to the person); once the workspace owner allows it, the next try finishes
+  connecting and asks for the approval in the same run. It never writes Claude Code's settings - in auto mode the assistant
+  may not, and a person put the hook there. Two hooks at once share one link. It connects only the Decidio your shell
+  names (or the default), never one a repository's `.env` names, and only over HTTPS; a project whose `.env` names an agent
+  with no token is refused by name rather than given the computer's connection. The run that connects tells the person which
+  workspace and who allowed it, even when the command then runs at once.
+- **The computer-wide hook is the pinned `npx -y @decidio/sdk@0.11.0` command**, so it works in every project; a project
+  install still writes `$CLAUDE_PROJECT_DIR` unescaped, so Claude Code expands it. The settings file is written whole, and
+  through a symlink.
+- **No surprises** (founder 2026-10-29: "the user is fully aware and not surprised"):
+  - `hook session`, a SessionStart hook: every session opens with one line - approvals are on here, what waits and for whom,
+    or that this computer isn't connected yet. Local only, never blocks;
+  - `connect` says what waits for approval and that everything else runs as before;
+  - a held command names who approves and where they see it;
+  - the plugin skill says what connecting does before doing it, and has the person run `! npx @decidio/sdk connect` when
+    auto mode refuses it.
+- **The plugin** (0.5.0) carries the SessionStart hook, and a marketplace file ready to publish - not published (founder:
+  nothing public until the listing is ready).
+- **The connector connects a computer** (slice 2a):
+  - `connect --ticket <ticket>` finishes the link the Decidio connector allowed (`connect_device` returns the ticket): the
+    poll carries this computer's own secret and the ticket, and only the credential is written;
+  - the hook names the connector's way first when a computer isn't connected (call `connect_device` with the code, run what
+    it returns), then the link and code; a link the connector allowed is kept while it waits for its ticket.
+- **Pause and resume** (slice 2b): `hook prompt`, a UserPromptSubmit hook that `hook install`, `connect` and the plugin add
+  behind a shell pre-filter, acts on the person's own typed "decidio pause" / "decidio start" (exact words, `source: user`
+  only) and keeps the words from the model. While paused a gated command runs with a line and no decision - asked of Decidio only
+  in a session paused on this computer; the settings guard (now run over the whole line, inside `sh -c` too, for the pause and
+  the shared file's notice alike) and the self-decide refusal stay on; an agent running `hook prompt` itself is refused. The
+  session line says how to pause, or that the organisation keeps the guard on.
+- **A shared file tells, then lets through** (slice 2a): `hook pretool --unconnected=tell`, which `connect` writes into a
+  shared file, refuses a computer with no credential once per session and command, then lets the same call pass with a line
+  to the person - never an `allow`, so Claude Code's own permission check still decides. No flag, a value it doesn't know,
+  or no session id holds, as before. `connect --team --hold-everyone` writes the holding hook instead.
+
+On upgrade: nothing to do; 0.10.0 repository connections keep working. Proved by: cli-smoke.ts (378 -> 400; slice 1: one connect for
+two repositories, the 0.10.0 file read first, the hook's own link - wait - collect-then-ask without touching settings, two
+hooks sharing a link, a refused link, the approver in holds, the session line, SessionStart installed; slice 2a: the
+connector's way, the ticket's usage, secret and ticket on the poll, tell once then a line, hold by default, --hold-everyone).
+
+## 0.10.0 — connect a coding assistant in one tap (not published; folded into 0.11.0)
 
 - **`npx @decidio/sdk connect`** (cycle connect). A coding assistant sets Decidio up for you: it runs `connect`, which prints a
   link and a short code (on a real terminal also a QR, and it opens the browser); the workspace owner opens the link signed in,
@@ -16,8 +64,8 @@ allowlist. Each entry names what changed, what a reader must do on upgrade, and
   ask-only credential - never a session - kept OUTSIDE the repository (the config dir, owner-only, keyed by the repository root
   and the Decidio), and the hooks switch on in `.claude/settings.local.json` (`--team`: the shared `.claude/settings.json`).
   No `.env`, nothing to paste, the word "agent" nowhere in the setup.
-- **In a cloud session the hooks go in `.claude/settings.json`.** A cloud session reads only the repository's own settings file,
-  never `.claude/settings.local.json` (Claude Code's docs), so that is where they work. connect leaves it uncommitted and says to ask
+- **In a cloud session the hooks go in `.claude/settings.json`.** A cloud session reads the repository's files, not your
+  computer's, and only the committed shared file reaches the next cloud machine, so that is where they go. connect leaves it uncommitted and says to ask
   the person before committing it (committed, every cloud session of the repository and every teammate's clone ask too). The
   credential is that cloud machine's: a fresh one refuses destructive commands until it connects again.
 - **The machine proves its key.** The start is signed with the machine's own key (the request-bound proof every signed

package/dist/cli.d.ts

@@ -18,6 +18,8 @@ export declare function defaultAgentId(dir?: string): string;
  *  distinct decision ids can never share a file (first-run review of 0.4.1: dots were STRIPPED, `a.b` and `ab`
  *  collided). `~` is outside the allowed set, so the escape is unambiguous. Exported for the smokes. */
 export declare function receiptFileName(id: string): string;
+/** Exactly what the person types to pause or resume the guard - nothing else is read. PURE. */
+export declare function guardWords(prompt: unknown): "pause" | "start" | null;
 /** Scoped packs (GitHub App design §2): a pack's scope in words - the organisation's, a unit's (its type, and its name when
  *  the server sent one: names that fail its person check are withheld there), or the reader's own. Null for an older server. */
 export declare function packScopeLabel(scope: any): string | null;

package/dist/cli.js

@@ -76,9 +76,17 @@ if (!OFFLINE_CMD)
     }
 const DEFAULT_API = "https://decidio-api.onrender.com";
 let API = (process.env.DECIDIO_API_URL ?? DEFAULT_API).replace(/\/$/, "");
+const COMPUTER = "*";
+const EVERY_PROJECT = "every project";
+let CONNECTED_APPROVER = null;
+let CONNECTED_UNANSWERED = false;
+let CONNECTED_APP_URL = null;
+let CONNECTED_WORKSPACE = null;
+let GUARD_PAUSABLE = true;
+let connectNotice = null;
 let CREDS_FROM = SHELL_ENV.DECIDIO_API_TOKEN ? "shell" : process.env.DECIDIO_API_TOKEN ? ".env" : null;
 if (!OFFLINE_CMD && !["init", "quickstart", "login", "logout", "phone"].includes(ARGV_TAIL[0] ?? "") && !process.env.DECIDIO_API_TOKEN && !process.env.DECIDIO_AGENT_ID) {
-    const c = loadConnection(projectRoot(), API);
+    const c = activeConnection(projectRoot(), API);
     if (c) {
         promoteConnection(c);
         CREDS_FROM = "connection";
@@ -2764,6 +2772,14 @@ function hookMatch(command, at, rules = [...HOOK_RULES, ...hookExtraRules()], de
         }
     return null;
 }
+function hookEditsGuard(command, at) {
+    try {
+        return !!hookMatch(command, at, HOOK_RULES.filter((r) => r.category === "decidio-guard"));
+    }
+    catch {
+        return true;
+    }
+}
 function hookSelfDecides(command, depth = 0) {
     const hit = hookSegments(command).some((s) => {
         const a = s.args.map((x) => x.replace(/^["']|["']$/g, ""));
@@ -3038,7 +3054,7 @@ function hookSubject(category, segs, cwdAbs, projectDir, at) {
     }
     return textOnly("text binds this category");
 }
-const hookIsOurs = (h) => typeof h?.command === "string" && /\bhook (pretool|posttool)\b/.test(h.command) && /decidio|cli\.(js|ts)/.test(h.command);
+const hookIsOurs = (h) => typeof h?.command === "string" && /\bhook (pretool|posttool|session|prompt)\b/.test(h.command) && /decidio|cli\.(js|ts)/.test(h.command);
 const hookSorted = (v) => Array.isArray(v) ? v.map(hookSorted) : v && typeof v === "object" ? Object.fromEntries(Object.keys(v).sort().map((k) => [k, hookSorted(v[k])])) : v;
 function hookOurHandlers(settings) {
     const out = [];
@@ -3398,8 +3414,91 @@ async function hookHold(cfg, decisionId, holdMs) {
     }
     return { status, lastError };
 }
-async function cmdHookPretool() {
-    const out = (o) => { process.stdout.write(JSON.stringify(o) + "\n"); return 0; };
+const ORGANISATION_KEEPS_ON = "Your organisation keeps Decidio on for every session.";
+const GUARD_PAUSE_HOURS = 12;
+export function guardWords(prompt) {
+    const m = typeof prompt === "string" ? /^\s*decidio\s+(pause|start)\s*[.!]?\s*$/i.exec(prompt) : null;
+    return m ? m[1].toLowerCase() : null;
+}
+const guardSessionKey = (material, session) => idempotencyKey(material, { purpose: "guard-pause", host: "claude-code", session });
+async function cmdHookPrompt() {
+    const block = (reason) => { process.stdout.write(JSON.stringify({ decision: "block", reason }) + "\n"); return 0; };
+    let action = null;
+    try {
+        const read = await readHookStdin();
+        if (!read.ok)
+            return 0;
+        const input = read.input;
+        action = guardWords(input.prompt);
+        if (!action)
+            return 0;
+        const not = action === "pause" ? "the guard stays on" : "nothing changed";
+        if (input.source !== "user")
+            return block(`Decidio: "decidio ${action}" works only on a prompt you type yourself - ${not}.`);
+        const session = typeof input.session_id === "string" ? input.session_id : "";
+        if (!session)
+            return block(`Decidio: this session has no id to pause the guard for - ${not}.`);
+        const cfg = hookConfig();
+        if ("missing" in cfg)
+            return block(`Decidio isn't connected on this computer, so there is no guard to ${action === "pause" ? "pause" : "resume"} here.`);
+        const material = bindingMaterial(cfg);
+        if (!material)
+            return block(`Decidio: this computer's credential can't key the pause - ${not}. Ask the person to run npx @decidio/sdk doctor.`);
+        assertSafeTransport(cfg.apiUrl, true);
+        const r = await fetch(cfg.apiUrl.replace(/\/$/, "") + "/agent/guard", { method: "POST", headers: { "content-type": "application/json", authorization: `Bearer ${cfg.apiToken}` },
+            body: JSON.stringify({ session: guardSessionKey(material, session), action }), signal: AbortSignal.timeout(10_000) });
+        const body = await r.json().catch(() => null);
+        if (r.status === 403 && body?.code === "ORGANISATION_KEEPS_ON") {
+            notePause(session, false);
+            return block(ORGANISATION_KEEPS_ON);
+        }
+        if (r.ok && body?.state === "paused") {
+            notePause(session, true);
+            return block(`Decidio guard paused for this session: destructive commands run without a person's approval - each one is recorded in your workspace's audit log - until you type "decidio start" (or for ${GUARD_PAUSE_HOURS} hours). Decidio still asks before a command edits Claude Code's settings to switch its check off.`);
+        }
+        if (r.ok && body?.state === "on") {
+            notePause(session, false);
+            return block(body.resumed ? "Decidio guard is back on for this session." : "Decidio guard is on for this session (it wasn't paused).");
+        }
+        return block(`Decidio couldn't ${action} the guard just now (${r.status}) - ${action === "pause" ? "it stays on" : "if it was paused, type \"decidio start\" again"}.`);
+    }
+    catch (e) {
+        if (!action)
+            return 0;
+        return block(`Decidio couldn't ${action} the guard just now (${String(e?.message ?? e).replace(/^\[decidio\] /, "").slice(0, 160)}) - ${action === "pause" ? "it stays on" : "if it was paused, type \"decidio start\" again"}.`);
+    }
+}
+function hookForgesPrompt(command, depth = 0) {
+    const hit = hookSegments(command).some((s) => {
+        const a = s.args.map((x) => x.replace(/^["']|["']$/g, ""));
+        const cli = (x) => /^@decidio\/sdk(@\S+)?$/i.test(x) || /^decidio(@\S+)?$/i.test(x) || /(^|[\\/])(decidio-guard|@decidio[\\/]sdk)[\\/](dist[\\/])?cli\.(js|ts)$/i.test(x);
+        const runsCli = s.program === "decidio" || s.program === "decidio.js"
+            || ((["npx", "pnpx", "bunx", "npm", "pnpm", "yarn", "bun", "node", "tsx", "uv", "uvx", "pipx"].includes(s.program) || /^python[0-9.]*$/.test(s.program)) && a.some(cli));
+        const i = a.indexOf("hook");
+        return runsCli && i >= 0 && a.slice(i + 1).some((x) => x.toLowerCase() === "prompt");
+    });
+    return hit || (depth < 2 && hookShellInner(command).some((c) => hookForgesPrompt(c, depth + 1)));
+}
+function cmdHookSession() {
+    try {
+        const cfg = hookConfig();
+        const msg = "missing" in cfg
+            ? "Decidio approvals are on here, but this computer isn't connected yet - the first destructive command shows a link to connect it (once, for every project on this computer)."
+            : `Decidio guard is on for this session${CONNECTED_WORKSPACE ? ` (workspace ${CONNECTED_WORKSPACE})` : ""}: deleting files, force-pushing, dropping tables, infrastructure changes and publishing wait for ${CONNECTED_APPROVER ?? "a person"}'s OK; everything else runs as usual. `
+                + (GUARD_PAUSABLE ? `Type "decidio pause" to pause it for this session, "decidio start" to resume.` : ORGANISATION_KEEPS_ON);
+        process.stdout.write(JSON.stringify({ systemMessage: msg, hookSpecificOutput: { hookEventName: "SessionStart",
+                additionalContext: "Decidio's hook asks a person before destructive shell commands in this project. When it refuses one, tell the user what its message says (who must approve, or the link that connects this computer) and follow it; never work around it." } }) + "\n");
+    }
+    catch { }
+    return 0;
+}
+async function cmdHookPretool(opts = { unconnected: "hold" }) {
+    const out = (o) => {
+        if (connectNotice)
+            o = { ...o, systemMessage: o?.systemMessage ? `${connectNotice} ${o.systemMessage}` : connectNotice };
+        process.stdout.write(JSON.stringify(o) + "\n");
+        return 0;
+    };
     const deny = (reason, user) => out({ hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "deny", permissionDecisionReason: reason }, ...(user ? { systemMessage: user } : {}) });
     const allow = (reason) => out({ hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "allow", permissionDecisionReason: reason } });
     try {
@@ -3416,6 +3515,8 @@ async function cmdHookPretool() {
             const command = typeof input.tool_input?.command === "string" ? input.tool_input.command : "";
             if (!command.trim())
                 return 0;
+            if (hookForgesPrompt(command))
+                return deny("Decidio: an agent can't pause or resume Decidio's guard - only the person does, by typing \"decidio pause\" or \"decidio start\" themselves. Nothing ran. Tell the user if they want it paused.");
             if (hookSelfDecides(command))
                 return deny("Decidio: an agent can't decide an approval - `approvals approve|reject` is the person's, and the person decides on their phone, the web app, Slack or Teams. Nothing ran. Tell the user which decision is waiting; never try another way to decide it.", "Decidio: the agent tried to decide an approval - refused");
             const segs = hookSegments(command);
@@ -3435,7 +3536,8 @@ async function cmdHookPretool() {
             const canonical = command.replace(/\s+/g, " ").trim();
             const base = hookSubject(rule.category, segs, cwdAbs, projectDir, at);
             const subject = followed ? { fingerprint: `${base.fingerprint ?? ""}\nfile:${followed.rel}:${followed.sha}`, display: followed.rel } : base;
-            g = { category: rule.category, isFile: false, text: canonical, binding: canonical + "\n" + (subject.fingerprint ?? ""), subject, identity: { command: canonical, subject: subject.fingerprint ?? "" }, segs,
+            const offSwitch = rule.category === "decidio-guard" || hookEditsGuard(command, at);
+            g = { category: rule.category, isFile: false, text: canonical, binding: canonical + "\n" + (subject.fingerprint ?? ""), subject, identity: { command: canonical, subject: subject.fingerprint ?? "" }, segs, offSwitch,
                 ...(followed ? { scriptLine: hookRedact(`${followed.rel}:${followed.line}: ${followed.text.replace(/\s+/g, " ").trim()}`).slice(0, 160) } : {}) };
         }
         else if (tool === "Write" || tool === "Edit" || tool === "MultiEdit") {
@@ -3443,7 +3545,7 @@ async function cmdHookPretool() {
             if (!fc)
                 return 0;
             const what = fc.changes.join("; ");
-            g = { category: "decidio-guard", isFile: true, text: `${tool} ${fc.display} — ${what}`, binding: `${tool}\n${fc.abs}\n${fc.sha}`, subject: { fingerprint: fc.sha, display: `${fc.display}: ${what}` }, identity: { path: fc.abs, after: fc.sha }, segs: null };
+            g = { category: "decidio-guard", isFile: true, text: `${tool} ${fc.display} — ${what}`, binding: `${tool}\n${fc.abs}\n${fc.sha}`, subject: { fingerprint: fc.sha, display: `${fc.display}: ${what}` }, identity: { path: fc.abs, after: fc.sha }, segs: null, offSwitch: true };
         }
         else
             return 0;
@@ -3451,7 +3553,21 @@ async function cmdHookPretool() {
             ? { noun: "edit", run: "make", ran: "Nothing was written.", anew: "If the user wants a different change to this file, that is a new request and may be asked." }
             : { noun: "command", run: "run", ran: "Nothing ran.", anew: "If the user changes what it would act on (a new commit, a different path), that is a new request and may be asked." };
         const short = hookShort(hookRedact(g.text.replace(/\s+/g, " ").trim()));
-        const cfg = hookConfig();
+        let cfg = hookConfig();
+        if ("missing" in cfg) {
+            const got = await hookProvision();
+            if (!got.ok) {
+                if (opts.unconnected === "tell" && !g.offSwitch) {
+                    const told = toldOnce(typeof input.session_id === "string" ? input.session_id : "", g.binding);
+                    if (told === "passed")
+                        return out({ systemMessage: `Decidio: "${short}" ran without Decidio's approval - this computer isn't connected, and this repository lets a computer that isn't connected through after one notice.` });
+                    if (told === "noted")
+                        return deny(`Decidio: "${short}" is a ${g.category} ${w.noun} that needs a person's approval - ${got.reason} ${w.ran} This repository lets a computer that isn't connected run it after this one notice: if you can't connect, tell the user it would run WITHOUT Decidio's approval, and retry the same ${w.noun} only if they want that.`, got.user);
+                }
+                return deny(`Decidio: "${short}" is a ${g.category} ${w.noun} that needs a person's approval - ${got.reason} ${w.ran}`, got.user);
+            }
+            cfg = hookConfig();
+        }
         if ("missing" in cfg)
             return deny(`Decidio: "${short}" is a ${g.category} ${w.noun} that needs a person's approval, but this project is not connected to Decidio yet. ${w.ran} Run \`npx @decidio/sdk connect\` in ${projectDir} and show the user the link it prints (they allow it on the web), then run \`npx @decidio/sdk connect --wait\`; once it says connected, retry the same ${w.noun}.`, `Decidio: this project is not connected - run npx @decidio/sdk connect`);
         const rel = relative(projectDir, cwdAbs);
@@ -3464,6 +3580,13 @@ async function cmdHookPretool() {
         catch (e) {
             return deny(`Decidio hook: this ${w.noun} cannot be bound to an approval (${e?.message ?? e}) - refusing to ${w.run} it. Ask the user to check ${projectDir}/.env with \`npx @decidio/sdk doctor\`.`);
         }
+        if (material && session && !g.offSwitch) {
+            const paused = existsSync(pauseNote(session)) ? await guardPausedNow(cfg, guardSessionKey(material, session), g.category) : "on";
+            if (paused === "on")
+                notePause(session, false);
+            if (paused === "paused")
+                return out({ systemMessage: `Decidio guard is paused for this session: "${short}" ran without a person's approval (recorded). Type "decidio start" to resume.` });
+        }
         if (!material)
             return deny(`Decidio hook: this ${w.noun} cannot be bound to an approval (no key material (DECIDIO_API_TOKEN, or DECIDIO_AGENT_KEY + DECIDIO_AGENT_DID)) - refusing to ${w.run} it. Ask the user to check ${projectDir}/.env with \`npx @decidio/sdk doctor\`.`);
         const committed = { command: hookRedact(g.text).slice(0, 400), cwd: cwdRel.slice(0, 200), category: g.category, host: "claude-code", tool, subject: hookRedact(g.subject.display).slice(0, 200), ...(g.scriptLine ? { scriptLine: g.scriptLine } : {}) };
@@ -3508,7 +3631,7 @@ async function cmdHookPretool() {
         if (auth.decision === "proceed") {
             writeHookState(input.tool_use_id, { v: 1, decisionId: auth.decisionId, receiptId: auth.receiptId ?? null, tool, category: g.category, at: new Date().toISOString() });
             err(`decidio hook: "${short}" is authorized by policy (decision ${auth.decisionId}${auth.receiptId ? `, receipt ${auth.receiptId}` : ""}, sealed) - no output, so Claude Code's own permission check still decides; this covers this one execution only.`);
-            return 0;
+            return connectNotice ? out({}) : 0;
         }
         const holdRaw = Number(process.env.DECIDIO_HOOK_HOLD_MS ?? "90000");
         const held = await hookHold(cfg, auth.decisionId, Number.isFinite(holdRaw) && holdRaw >= 0 ? Math.min(holdRaw, HOOK_HOLD_CAP_MS) : 90_000);
@@ -3516,7 +3639,7 @@ async function cmdHookPretool() {
         if (!st)
             return deny(`Decidio: "${short}" is routed for approval as decision ${auth.decisionId}, but its status could not be read (${held.lastError ?? "no answer"}). ${w.ran} When the gate is reachable, run \`npx @decidio/sdk hook wait ${auth.decisionId}\` and then retry EXACTLY the same ${w.noun}.`);
         if (st.state === "pending")
-            return deny(`Decidio: "${short}" needs a person's approval - decision ${auth.decisionId} is in their queue${where ? ` (${where})` : ""}. ${w.ran} To continue: run \`npx @decidio/sdk hook wait ${auth.decisionId}\` (it returns when they decide), then retry EXACTLY the same ${w.noun} - not a variant of it, and do not work around this gate.`, `Decidio: ${auth.decisionId} awaits approval${where ? ` - ${where}` : ""}`);
+            return deny(`Decidio: "${short}" needs a person's approval - decision ${auth.decisionId} is in ${CONNECTED_APPROVER ? `${CONNECTED_APPROVER}'s` : "their"} queue${where ? ` (${where})` : ""}; they see it on their phone, Slack, Teams or the web. ${w.ran} Tell the user it is waiting for ${CONNECTED_APPROVER ?? "the approver"}.${CONNECTED_UNANSWERED ? ` If nobody has said yet whether another person approves this computer's requests, tell the user: the workspace owner answers "Should another person approve this?" once on the Decidio Agents page${CONNECTED_APP_URL ? ` (${CONNECTED_APP_URL}/connect/agents#coding-assistants)` : ""}. A request made before the answer keeps it: its owner can't approve that one - another approver can, or ask again in a new session.` : ""} To continue: run \`npx @decidio/sdk hook wait ${auth.decisionId}\` (it returns when they decide), then retry EXACTLY the same ${w.noun} - not a variant of it, and do not work around this gate.`, `Decidio: waiting for ${CONNECTED_APPROVER ?? "a person"}'s approval (${auth.decisionId})${where ? ` - ${where}` : ""}. ${w.ran} Claude continues once it is approved.`);
         if (st.state === "rejected" || st.state === "blocked")
             return deny(`Decidio: "${short}" was ${st.state} (decision ${auth.decisionId}${st.reason ? `: ${st.reason}` : ""}) for this exact change (${hookRedact(g.subject.display)}). Do not retry it or a variant of it; tell the user. ${g.subject.fingerprint ? w.anew : ""}`.trim(), `Decidio: ${auth.decisionId} ${st.state}`);
         const chk = await checkApproval(cfg, auth.decisionId, request, { status: st });
@@ -3675,10 +3798,10 @@ function cmdHookRules() {
     log(`A policy that auto-approves a request gets no output from the hook, so Claude Code's own permission check still decides; only a person's approval of the exact call answers "allow".`);
     return 0;
 }
-function hookRunner() {
+function hookRunner(portable = false) {
     const q = (p) => `"${p.replace(/(["\\$`])/g, "\\$1")}"`;
     const entry = process.argv[1] ?? "";
-    if (!entry || /[\\/]_npx[\\/]/.test(entry))
+    if (portable || !entry || /[\\/]_npx[\\/]/.test(entry))
         return `npx -y @decidio/sdk@${VERSION}`;
     let real = entry;
     try {
@@ -3687,12 +3810,13 @@ function hookRunner() {
     catch { }
     const localRoot = resolvePath("node_modules") + pathSep;
     if (real.startsWith(localRoot))
-        real = "$CLAUDE_PROJECT_DIR/node_modules/" + real.slice(localRoot.length).split(pathSep).join("/");
+        return `node "$CLAUDE_PROJECT_DIR/node_modules/${real.slice(localRoot.length).split(pathSep).join("/").replace(/(["\\$`])/g, "\\$1")}"`;
     real = real.split(pathSep).join("/");
     if (/\.ts$/.test(real))
         return `npx tsx ${q(real)}`;
     return `node ${q(real)}`;
 }
+const hookPromptLine = (runner) => `cd "$CLAUDE_PROJECT_DIR" && IN=$(cat) && case "$IN" in *[Dd][Ee][Cc][Ii][Dd][Ii][Oo]*) printf '%s' "$IN" | ${runner} hook prompt;; esac`;
 const HOOK_FILE_TOOLS = ["Write", "Edit", "MultiEdit"];
 const HOOK_GUARD_PATHS = ["**/.claude/settings*.json", "~/.claude/settings*.json", "~/.claude/plugins/**"];
 async function cmdHookInstall(opts) {
@@ -3716,14 +3840,14 @@ async function cmdHookInstall(opts) {
         return 2;
     }
     const cliAt = opts.cli ? resolvePath(opts.cli).split(pathSep).join("/") : "";
-    const runner = opts.cli ? (/\.ts$/.test(opts.cli) ? `npx tsx "${cliAt}"` : `node "${cliAt}"`) : hookRunner();
+    const runner = opts.cli ? (/\.ts$/.test(opts.cli) ? `npx tsx "${cliAt}"` : `node "${cliAt}"`) : hookRunner(opts.portable === true);
     const hooks = (settings.hooks = settings.hooks && typeof settings.hooks === "object" && !Array.isArray(settings.hooks) ? settings.hooks : {});
     const place = (event, matcher, iff, command, extra) => {
         const list = Array.isArray(hooks[event]) ? hooks[event] : (hooks[event] = []);
         const want = { type: "command", ...(iff ? { if: iff } : {}), command, ...extra };
         let state = "added";
         for (const g of list) {
-            if (!g || typeof g !== "object" || g.matcher !== matcher || !Array.isArray(g.hooks))
+            if (!g || typeof g !== "object" || (g.matcher ?? "") !== matcher || !Array.isArray(g.hooks))
                 continue;
             g.hooks = g.hooks.flatMap((h) => {
                 if (!hookIsOurs(h) || (typeof h.if === "string" ? h.if : undefined) !== iff)
@@ -3738,12 +3862,14 @@ async function cmdHookInstall(opts) {
         }
         hooks[event] = list.filter((g) => !(g && typeof g === "object" && Array.isArray(g.hooks) && g.hooks.length === 0));
         if (state === "added")
-            hooks[event].push({ matcher, hooks: [want] });
+            hooks[event].push(matcher ? { matcher, hooks: [want] } : { hooks: [want] });
         return state;
     };
-    const preLine = `cd "$CLAUDE_PROJECT_DIR" && ${runner} hook pretool`, postLine = `cd "$CLAUDE_PROJECT_DIR" && ${runner} hook posttool`;
+    const preLine = `cd "$CLAUDE_PROJECT_DIR" && ${runner} hook pretool${opts.unconnected === "tell" ? " --unconnected=tell" : ""}`, postLine = `cd "$CLAUDE_PROJECT_DIR" && ${runner} hook posttool`;
     const pre = place("PreToolUse", "Bash|PowerShell", undefined, preLine, { timeout: 150, onFailure: "block" });
     const post = place("PostToolUse", "Bash|PowerShell", undefined, postLine, { timeout: 30 });
+    place("SessionStart", "startup|resume", undefined, `cd "$CLAUDE_PROJECT_DIR" && ${runner} hook session`, { timeout: 15 });
+    place("UserPromptSubmit", "", undefined, hookPromptLine(runner), { timeout: 15 });
     const guard = { added: 0, updated: 0, kept: 0 };
     for (const t of HOOK_FILE_TOOLS)
         for (const p of HOOK_GUARD_PATHS) {
@@ -3751,7 +3877,9 @@ async function cmdHookInstall(opts) {
             guard[place("PostToolUse", t, `${t}(${p})`, postLine, { timeout: 30 })]++;
         }
     mkdirSync(dirname(settingsPath), { recursive: true });
-    writeFileSync(settingsPath, JSON.stringify(settings, null, 2) + "\n");
+    const target = realOrSame(settingsPath), tmpSettings = `${target}.decidio-${process.pid}.tmp`;
+    writeFileSync(tmpSettings, JSON.stringify(settings, null, 2) + "\n", { mode: existsSync(target) ? statSync(target).mode & 0o777 : 0o644 });
+    renameSync(tmpSettings, target);
     lastHookInstall = { settingsPath, pre, post };
     if (opts.quiet)
         return 0;
@@ -3795,7 +3923,7 @@ function projectRoot() {
     catch { }
     return realOrSame(SHELL_ENV.CLAUDE_PROJECT_DIR || process.cwd());
 }
-function connectionKey(root) { return createHash("sha256").update(`${API}\n${process.platform === "win32" ? root.toLowerCase() : root}`, "utf8").digest("hex").slice(0, 20); }
+function connectionKey(root) { return createHash("sha256").update(`${API}\n${root === COMPUTER ? "computer" : process.platform === "win32" ? root.toLowerCase() : root}`, "utf8").digest("hex").slice(0, 20); }
 function connectionFile(root) { return joinPath(connectDir(), `${connectionKey(root)}.json`); }
 function pendingConnectFile(root) { return joinPath(connectDir(), `${connectionKey(root)}.pending.json`); }
 function readJsonQuiet(f) {
@@ -3806,6 +3934,8 @@ function readJsonQuiet(f) {
         return null;
     }
 }
+function activeConnection(root, api) { return loadConnection(root, api) ?? loadConnection(COMPUTER, api); }
+const connectScope = (root) => (connectionRecord(root, API) ? root : COMPUTER);
 function loadConnection(root, api) {
     const c = connectionRecord(root, api);
     return c && !c.disconnected && c.token ? c : null;
@@ -3814,7 +3944,15 @@ function connectionRecord(root, api) {
     const c = readJsonQuiet(connectionFile(root));
     return c && c.v === 1 && c.api === api && c.root === root && typeof c.token === "string" && typeof c.agentId === "string" && typeof c.key === "string" && typeof c.did === "string" ? c : null;
 }
+function printableName(v) {
+    return typeof v === "string" ? v.replace(/[\u0000-\u001f\u007f-\u009f\u061c\u200b-\u200f\u2028-\u202e\u2060-\u2069\ufeff]/g, "").trim().slice(0, 60) || null : null;
+}
 function promoteConnection(c) {
+    CONNECTED_APPROVER = printableName(c.approver);
+    CONNECTED_UNANSWERED = c.answered === false;
+    CONNECTED_APP_URL = typeof c.appUrl === "string" && /^https?:\/\/[^\s"<>]+$/.test(c.appUrl) ? c.appUrl.replace(/\/+$/, "") : null;
+    CONNECTED_WORKSPACE = printableName(c.workspaceName);
+    GUARD_PAUSABLE = c.guardPausable !== false;
     process.env.DECIDIO_API_TOKEN = c.token;
     process.env.DECIDIO_AGENT_ID = c.agentId;
     process.env.DECIDIO_AGENT_DID = c.did;
@@ -3889,29 +4027,24 @@ function openInBrowser(url) {
 }
 const CONNECT_WAIT_S = () => { const n = Number(process.env.DECIDIO_CONNECT_WAIT_S ?? 90); return Number.isFinite(n) && n >= 1 && n <= 110 ? n : 90; };
 let lastHookInstall = null;
-async function startConnect(root, host) {
+let connectError = "";
+async function startConnect(root, host, quiet = false) {
+    const fail = (m) => { connectError = m; if (!quiet)
+        err(`✘ ${m}`); return null; };
     const prior = connectionRecord(root, API);
     const kp = prior && !inCloudSession() ? { did: prior.did, privateKeyBase64: prior.key } : generateKeypair();
     const cloud = inCloudSession();
-    const project = projectLabel(root).trim() || "project", machine = machineLabel(cloud).trim() || "machine";
+    const project = (root === COMPUTER ? EVERY_PROJECT : projectLabel(root)).trim() || "project", machine = machineLabel(cloud).trim() || "machine";
     const proof = signBoundProof(kp.privateKeyBase64, { agentId: "connect", did: kp.did, action: "connect.start", amount: 0, scope: [host, project, machine, cloud ? "cloud" : "local"].join("\n") });
     const r = await api("/connect/start", { method: "POST", body: JSON.stringify({ host, project, machine, did: kp.did, cloud, proof }) }, "", true);
-    if (r.status === 0) {
-        err(`✘ couldn't reach Decidio at ${API} - check your connection and run npx @decidio/sdk connect again.`);
-        return null;
-    }
-    if (r.status === 404 || r.status === 401) {
-        err(`✘ ${r.body?.message ?? "Connecting a coding assistant is available in the Decidio lab only."} (${API})`);
-        return null;
-    }
-    if (r.status === 429) {
-        err(`✘ ${r.body?.message ?? "Too many tries - wait a minute and try again."}`);
-        return null;
-    }
-    if (r.status !== 201 || typeof r.body?.pollSecret !== "string" || typeof r.body?.link !== "string") {
-        err(`✘ couldn't start a connection (${r.status}${r.body?.message ? `: ${r.body.message}` : ""}). Nothing was saved.`);
-        return null;
-    }
+    if (r.status === 0)
+        return fail(`couldn't reach Decidio at ${API} - check your connection and run npx @decidio/sdk connect again.`);
+    if (r.status === 404 || r.status === 401)
+        return fail(`${r.body?.message ?? "Connecting a coding assistant isn't switched on for this Decidio yet - it is on in the Decidio lab."} (${API})`);
+    if (r.status === 429)
+        return fail(`${r.body?.message ?? "Too many tries - wait a minute and try again."}`);
+    if (r.status !== 201 || typeof r.body?.pollSecret !== "string" || typeof r.body?.link !== "string")
+        return fail(`couldn't start a connection (${r.status}${r.body?.message ? `: ${r.body.message}` : ""}). Nothing was saved.`);
     const p = { v: 1, api: API, root, project, host, machine, cloud, did: kp.did, key: kp.privateKeyBase64, code: String(r.body.code), link: String(r.body.link),
         pollSecret: r.body.pollSecret, expiresAt: String(r.body.expiresAt), interval: Number(r.body.interval) || 2, startedAt: new Date().toISOString() };
     mkdirSync(connectDir(), { recursive: true });
@@ -3925,6 +4058,170 @@ function readPendingConnect(root) {
     const p = readJsonQuiet(pendingConnectFile(root));
     return p && p.v === 1 && p.api === API && p.root === root && typeof p.pollSecret === "string" ? p : null;
 }
+async function hookProvision() {
+    const scope = COMPUTER;
+    if (process.env.DECIDIO_AGENT_ID) {
+        const named = printableName(process.env.DECIDIO_AGENT_ID) ?? "(unprintable)";
+        return { ok: false, reason: `this project names the Decidio agent "${named}" (in its .env or the shell) but has no token for it. Ask the user to check it with npx @decidio/sdk doctor, or to remove DECIDIO_AGENT_ID to use this computer's connection.`, user: `Decidio: "${named}" has no token here` };
+    }
+    const own = (SHELL_ENV.DECIDIO_API_URL ?? DEFAULT_API).replace(/\/$/, "");
+    if (API !== own) {
+        const host = printableName(redactUrl(API)) ?? "(unprintable)";
+        return { ok: false, reason: `this project's .env points Decidio at ${host}; the hook won't connect this computer to a server a repository names. If the user trusts it, they run npx @decidio/sdk connect themselves.`, user: `Decidio: not connecting to ${host} (named by this project)` };
+    }
+    try {
+        assertSafeTransport(API, true);
+    }
+    catch (e) {
+        return { ok: false, reason: `${String(e?.message ?? e).replace(/^\[decidio\] /, "")} - the connection's secret would cross in clear.`, user: "Decidio: refusing a plaintext connection" };
+    }
+    const linkWords = (p, fresh) => {
+        const mins = minutesLeft(p.expiresAt) || 1;
+        return { ok: false,
+            reason: `this computer isn't connected to Decidio yet${fresh ? "" : " (its link is still waiting to be allowed)"}. If Decidio's connect_device tool is available to you (the Decidio connector), tell the user you are connecting this computer to their Decidio workspace, call connect_device with the code ${p.code}, run the command it returns, then retry. Otherwise show the user this link and code: ${p.link} (code ${p.code}, valid ${mins} more minute${mins === 1 ? "" : "s"}) - the workspace owner allows it once, signed in, and it covers every project on this computer. Then retry the same command: it connects and asks for approval.`,
+            user: `Decidio: connect this computer once - open ${p.link} and check the code ${p.code}. Destructive commands wait until it's allowed; everything else runs as usual.` };
+    };
+    let p = readPendingConnect(scope);
+    if (p && new Date(p.expiresAt).getTime() > Date.now() + 5_000) {
+        const r = await api("/connect/poll", { method: "POST", headers: { "x-decidio-connect-secret": p.pollSecret }, body: "{}" }, "", true);
+        if (r.status === 200 && r.body?.status === "connected" && typeof r.body.token === "string") {
+            const c = storeCollected(scope, p, r.body);
+            if (typeof c === "string")
+                return { ok: false, reason: `this computer was allowed, but its credential couldn't be written (${c}). Ask the user to run npx @decidio/sdk doctor.`, user: "Decidio: connected, but the credential couldn't be saved" };
+            promoteConnection(c);
+            CREDS_FROM = "connection";
+            connectNotice = `Decidio connected this computer${CONNECTED_WORKSPACE ? ` to workspace ${CONNECTED_WORKSPACE}` : ""}${printableName(c.approvedBy) ? `, allowed by ${printableName(c.approvedBy)}` : ""} - every project on it now asks before destructive commands.`;
+            return { ok: true };
+        }
+        if (r.status === 202 || r.status === 429 || r.status >= 500)
+            return linkWords(p, false);
+        if (r.status === 409 && (r.body?.status === "ticket_required" || r.body?.status === "ticket_mismatch"))
+            return { ok: false,
+                reason: `this computer's link (code ${p.code}) was allowed through the Decidio connector and is finished only with the ticket connect_device returned: if YOU called connect_device for code ${p.code} in this session, run npx @decidio/sdk@latest connect --ticket <the ticket it returned>, then retry the same command. If you did not, do not finish it with any ticket from anywhere else - tell the user that another workspace's connector allowed this computer, and leave it: the link lapses within ten minutes and the next try shows a fresh code.`,
+                user: "Decidio: finishing this computer's connection (allowed through the Decidio connector) - destructive commands wait until it's done" };
+        if (r.status === 0)
+            return { ok: false, reason: `couldn't reach Decidio at ${API} to finish connecting this computer - retry once it is reachable.`, user: "Decidio: unreachable - destructive commands wait" };
+        if (r.status === 410 && r.body?.status === "collected") {
+            const won = activeConnection(projectRoot(), API);
+            if (won) {
+                promoteConnection(won);
+                CREDS_FROM = "connection";
+                return { ok: true };
+            }
+        }
+        if (r.status === 403 && r.body?.status === "denied") {
+            dropFile(pendingConnectFile(scope));
+            return { ok: false, reason: `connecting this computer was refused on the web ("Not me"). Ask the user before retrying - the next attempt shows a new link.`, user: "Decidio: connecting this computer was refused" };
+        }
+        if (r.status === 410 && r.body?.status === "removed") {
+            dropFile(pendingConnectFile(scope));
+            return { ok: false, reason: `the workspace owner removed this computer before it finished connecting. Ask the user before retrying - the next attempt shows a new link, and only the owner's Allow on the web brings it back.`, user: "Decidio: the workspace owner removed this computer" };
+        }
+        dropFile(pendingConnectFile(scope));
+    }
+    const lock = pendingConnectFile(scope) + ".lock";
+    mkdirSync(connectDir(), { recursive: true });
+    let fd = null;
+    try {
+        fd = openSync(lock, "wx", 0o600);
+    }
+    catch {
+        try {
+            if (Date.now() - statSync(lock).mtimeMs > 30_000) {
+                rmSync(lock, { force: true });
+                fd = openSync(lock, "wx", 0o600);
+            }
+        }
+        catch {
+            fd = null;
+        }
+    }
+    if (fd !== null && (p = readPendingConnect(scope)) && new Date(p.expiresAt).getTime() > Date.now() + 5_000) {
+        try {
+            closeSync(fd);
+        }
+        catch { }
+        dropFile(lock);
+        return linkWords(p, false);
+    }
+    if (fd === null) {
+        for (let i = 0; i < 20 && !(p = readPendingConnect(scope)); i++)
+            await new Promise((res) => setTimeout(res, 250));
+        if (p)
+            return linkWords(p, false);
+        return { ok: false, reason: "another Decidio check on this computer is connecting it right now - retry the same command in a few seconds.", user: "Decidio: connecting this computer" };
+    }
+    try {
+        const started = await startConnect(scope, "claude-code", true);
+        if (!started)
+            return { ok: false, reason: `this computer isn't connected to Decidio, and a connection couldn't be started: ${connectError}`, user: "Decidio: this computer isn't connected" };
+        return linkWords(started, true);
+    }
+    finally {
+        try {
+            closeSync(fd);
+        }
+        catch { }
+        dropFile(lock);
+    }
+}
+function toldOnce(session, binding) {
+    if (!session)
+        return "hold";
+    const dir = joinPath(connectDir(), "told");
+    const f = joinPath(dir, createHash("sha256").update(`${API}\n${session}\n${binding}`).digest("hex").slice(0, 40));
+    try {
+        if (existsSync(f))
+            return "passed";
+        mkdirSync(dir, { recursive: true, mode: 0o700 });
+        const week = Date.now() - 7 * 86_400_000;
+        for (const old of readdirSync(dir)) {
+            try {
+                if (statSync(joinPath(dir, old)).mtimeMs < week)
+                    rmSync(joinPath(dir, old), { force: true });
+            }
+            catch { }
+        }
+        writeFileSync(f, "", { mode: 0o600, flag: "wx" });
+        return "noted";
+    }
+    catch {
+        return "hold";
+    }
+}
+async function guardPausedNow(cfg, sessionKey, category) {
+    try {
+        assertSafeTransport(cfg.apiUrl, true);
+        const r = await fetch(cfg.apiUrl.replace(/\/$/, "") + "/agent/guard/check", { method: "POST", headers: { "content-type": "application/json", authorization: `Bearer ${cfg.apiToken}` },
+            body: JSON.stringify({ session: sessionKey, category }), signal: AbortSignal.timeout(10_000) });
+        const body = await r.json().catch(() => null);
+        return r.ok && body?.paused === true ? "paused" : r.ok && body?.paused === false ? "on" : "unknown";
+    }
+    catch {
+        return "unknown";
+    }
+}
+function pauseNote(session) {
+    return joinPath(connectDir(), "paused", createHash("sha256").update(`${API}\n${session}`).digest("hex").slice(0, 40));
+}
+function notePause(session, paused) {
+    const f = pauseNote(session);
+    try {
+        if (!paused)
+            return dropFile(f);
+        const dir = dirname(f);
+        mkdirSync(dir, { recursive: true, mode: 0o700 });
+        for (const old of readdirSync(dir)) {
+            try {
+                if (statSync(joinPath(dir, old)).mtimeMs < Date.now() - GUARD_PAUSE_HOURS * 3_600_000)
+                    rmSync(joinPath(dir, old), { force: true });
+            }
+            catch { }
+        }
+        writeFileSync(f, "", { mode: 0o600 });
+    }
+    catch { }
+}
 function dropFile(f) { try {
     rmSync(f, { force: true });
 }
@@ -3950,6 +4247,14 @@ async function cmdConnect(opts) {
         err(`✘ connect knows Claude Code today (--host claude-code); "${opts.host}" is not supported yet.`);
         return 2;
     }
+    if (opts.ticket !== undefined && (opts.wait || opts.team || opts.force || opts.holdEveryone)) {
+        err("✘ --ticket finishes a link the Decidio connector allowed and takes no other option.");
+        return 2;
+    }
+    if (opts.holdEveryone && !opts.team && !inCloudSession()) {
+        err("✘ --hold-everyone is for the shared file (--team, or a cloud session): it keeps refusing a computer that isn't connected.");
+        return 2;
+    }
     try {
         assertSafeTransport(API, true);
     }
@@ -3958,37 +4263,122 @@ async function cmdConnect(opts) {
         return 1;
     }
     const root = projectRoot();
+    if (opts.ticket !== undefined)
+        return connectWithTicket(root, opts.ticket);
     const tty = !!(process.stdin.isTTY && process.stdout.isTTY);
     if (CREDS_FROM === "shell" || CREDS_FROM === ".env") {
         log(`• this project already has Decidio credentials ${CREDS_FROM === "shell" ? "from your shell" : `in ${ENV_PATH}`} for "${process.env.DECIDIO_AGENT_ID ?? defaultAgentId()}" - the hook uses those, so connect leaves them alone.`);
         log(dim(`  To use a connection instead, remove DECIDIO_API_TOKEN / DECIDIO_AGENT_ID from ${CREDS_FROM === "shell" ? "your shell" : ENV_PATH} and run npx @decidio/sdk connect again.`));
         return finishConnect(root, null, opts, false);
     }
-    const existing = loadConnection(root, API);
+    const existing = activeConnection(root, API);
     if (existing && !opts.force && new Date(existing.expiresAt).getTime() > Date.now())
         return finishConnect(root, existing, opts, false);
+    const scope = connectScope(root);
     if (opts.wait)
-        return waitConnect(root, opts, false);
-    let p = readPendingConnect(root);
+        return waitConnect(root, scope, opts, false);
+    let p = readPendingConnect(scope);
     if (!p || p.host !== host || new Date(p.expiresAt).getTime() <= Date.now() + 15_000)
-        p = await startConnect(root, host);
+        p = await startConnect(scope, host);
     if (!p)
         return 1;
     const opened = !opts.noBrowser && localDesktop() && openInBrowser(p.link);
     showConnectLink(p, opened, tty);
     if (tty) {
         log("");
-        return waitConnect(root, opts, true);
+        return waitConnect(root, scope, opts, true);
     }
     log("");
     log(`Next: allow it at the link above, then run  ${bold("npx @decidio/sdk connect --wait")}  - it finishes by itself (nothing else to type).`);
     log(dim("Assistants: show the person the link and the code above, then run npx @decidio/sdk connect --wait."));
     return 0;
 }
-async function waitConnect(root, opts, interactive) {
-    const p = readPendingConnect(root);
+async function connectWithTicket(root, ticket) {
+    if (!/^[A-Za-z0-9_-]{32,128}$/.test(ticket)) {
+        err("✘ --ticket needs the ticket connect_device returned (letters, digits, - and _).");
+        return 2;
+    }
+    const scope = connectScope(root);
+    const p = readPendingConnect(scope);
+    if (!p || new Date(p.expiresAt).getTime() <= Date.now()) {
+        const c = activeConnection(root, API);
+        if (c) {
+            log(`✔ This computer is already connected to Decidio${printableName(c.workspaceName) ? ` - workspace ${printableName(c.workspaceName)}` : ""}. Retry the command.`);
+            return 0;
+        }
+        err("✘ this computer has no link waiting to be finished - retry the command Decidio refused (it shows a fresh code), then call connect_device with that code.");
+        return 1;
+    }
+    const r = await api("/connect/poll", { method: "POST", headers: { "x-decidio-connect-secret": p.pollSecret, "x-decidio-connect-ticket": ticket }, body: "{}" }, "", true);
+    if (r.status === 200 && r.body?.status === "connected" && typeof r.body.token === "string") {
+        const c = storeCollected(scope, p, r.body);
+        if (typeof c === "string") {
+            err(`✘ connected, but this computer's credential couldn't be written (${c}) - run npx @decidio/sdk doctor.`);
+            return 1;
+        }
+        const ws = printableName(c.workspaceName), approver = printableName(c.approver);
+        log(`✔ Connected this computer to Decidio${ws ? ` - workspace ${ws}` : ""}, through the Decidio connector.`);
+        log(`✔ Retry the command Decidio refused: it now asks ${approver ?? "the approver"} before it runs.`);
+        if (r.body.trust === "unconfirmed")
+            log(dim("  Until the workspace owner confirms this computer is theirs (Decidio sent them a notification), every destructive command it asks about goes to a person."));
+        else if (r.body.trust === "cloud")
+            log(dim("  This cloud machine always asks a person for its destructive commands."));
+        return 0;
+    }
+    if (r.status === 202) {
+        err(`✘ this computer's link (code ${p.code}) hasn't been allowed yet - call connect_device with that code first, then run this again with the ticket it returns.`);
+        return 3;
+    }
+    if (r.status === 409 && r.body?.status === "ticket_mismatch") {
+        err(`✘ that ticket is for another link - call connect_device with this computer's code (${p.code}) and use the ticket it returns.`);
+        return 3;
+    }
+    if (r.status === 403 && r.body?.status === "denied") {
+        dropFile(pendingConnectFile(scope));
+        err("✘ this computer's link was refused on the web (Not me). Nothing was saved.");
+        return 3;
+    }
+    if (r.status === 410 && r.body?.status === "removed") {
+        dropFile(pendingConnectFile(scope));
+        err("✘ the workspace owner removed this computer before it finished connecting. Nothing was saved - ask them before trying again.");
+        return 3;
+    }
+    if ((r.status === 404 || r.status === 410) && (r.body?.status === "expired" || r.body?.status === "collected")) {
+        const won = r.body.status === "collected" ? activeConnection(root, API) : null;
+        if (won) {
+            log("✔ This computer is connected (another run finished it first). Retry the command.");
+            return 0;
+        }
+        dropFile(pendingConnectFile(scope));
+        err("✘ this computer's link expired before it was finished - retry the command Decidio refused for a fresh code, then call connect_device again.");
+        return 3;
+    }
+    if (r.status === 0) {
+        err(`✘ couldn't reach Decidio at ${API} - check the connection and run this again (the ticket stays good for ten minutes).`);
+        return 1;
+    }
+    err(`✘ Decidio answered ${r.status}${r.body?.message ? `: ${String(r.body.message).slice(0, 200)}` : ""}`);
+    return 1;
+}
+function storeCollected(scope, p, body) {
+    const c = { v: 1, api: API, root: scope, project: p.project, host: p.host, machine: p.machine, cloud: p.cloud, agentId: String(body.agentId), did: p.did, key: p.key,
+        token: body.token, jti: String(body.jti), expiresAt: String(body.expiresAt), workspaceId: String(body.workspaceId), workspaceName: body.workspace?.name ?? null,
+        approver: body.approver?.name ?? null, approvedBy: body.approvedBy?.name ?? null, appUrl: typeof body.appUrl === "string" ? body.appUrl : null, connectedAt: new Date().toISOString(),
+        guardPausable: body.guardPausable !== false, ...(body.answered === false ? { answered: false } : {}) };
+    mkdirSync(connectDir(), { recursive: true });
+    try {
+        writeSecretFile(connectionFile(scope), JSON.stringify(c) + "\n");
+    }
+    catch (e) {
+        return String(e?.message ?? e);
+    }
+    dropFile(pendingConnectFile(scope));
+    return c;
+}
+async function waitConnect(root, scope, opts, interactive) {
+    const p = readPendingConnect(scope);
     if (!p) {
-        const c = loadConnection(root, API);
+        const c = activeConnection(root, API);
         if (c)
             return finishConnect(root, c, opts, false);
         err("✘ no connection is in progress for this project - start one: npx @decidio/sdk connect");
@@ -4004,29 +4394,41 @@ async function waitConnect(root, opts, interactive) {
         if (r.status === 200 && r.body?.status === "connected" && typeof r.body.token === "string") {
             if (interactive && TTY_OUT)
                 process.stderr.write("\r\x1b[K");
-            const c = { v: 1, api: API, root, project: p.project, host: p.host, machine: p.machine, cloud: p.cloud, agentId: String(r.body.agentId), did: p.did, key: p.key,
-                token: r.body.token, jti: String(r.body.jti), expiresAt: String(r.body.expiresAt), workspaceId: String(r.body.workspaceId), workspaceName: r.body.workspace?.name ?? null,
-                approver: r.body.approver?.name ?? null, approvedBy: r.body.approvedBy?.name ?? null, appUrl: typeof r.body.appUrl === "string" ? r.body.appUrl : null, connectedAt: new Date().toISOString() };
-            mkdirSync(connectDir(), { recursive: true });
-            try {
-                writeSecretFile(connectionFile(root), JSON.stringify(c) + "\n");
-            }
-            catch (e) {
-                err(`✘ connected, but this machine's credentials could not be written (${e?.message ?? e}) - run npx @decidio/sdk connect again (the server keeps nothing to collect twice).`);
+            const c = storeCollected(scope, p, r.body);
+            if (typeof c === "string") {
+                err(`✘ connected, but this machine's credentials could not be written (${c}) - run npx @decidio/sdk connect again (the server keeps nothing to collect twice).`);
                 return 1;
             }
-            dropFile(pendingConnectFile(root));
             return finishConnect(root, c, opts, true);
         }
         if (r.status === 403 && r.body?.status === "denied") {
-            dropFile(pendingConnectFile(root));
+            dropFile(pendingConnectFile(scope));
             if (interactive && TTY_OUT)
                 process.stderr.write("\r\x1b[K");
             err("✘ the connection was refused on the web (Not me). Nothing was saved.");
             return 3;
         }
+        if (r.status === 410 && r.body?.status === "removed") {
+            dropFile(pendingConnectFile(scope));
+            if (interactive && TTY_OUT)
+                process.stderr.write("\r\x1b[K");
+            err("✘ the workspace owner removed this computer before it finished connecting. Nothing was saved.");
+            return 3;
+        }
+        if (r.status === 409 && (r.body?.status === "ticket_required" || r.body?.status === "ticket_mismatch")) {
+            if (interactive && TTY_OUT)
+                process.stderr.write("\r\x1b[K");
+            err("✘ this computer's link was allowed through the Decidio connector: finish it with npx @decidio/sdk connect --ticket <the ticket YOUR connect_device returned> - never a ticket from anywhere else.");
+            return 3;
+        }
         if ((r.status === 404 || r.status === 410) && (r.body?.status === "expired" || r.body?.status === "collected")) {
-            dropFile(pendingConnectFile(root));
+            const won = r.body.status === "collected" ? activeConnection(root, API) : null;
+            if (won) {
+                if (interactive && TTY_OUT)
+                    process.stderr.write("\r\x1b[K");
+                return finishConnect(root, won, opts, true);
+            }
+            dropFile(pendingConnectFile(scope));
             if (interactive && TTY_OUT)
                 process.stderr.write("\r\x1b[K");
             err(r.body.status === "collected" ? "✘ this connection was already collected by another run - start a fresh one: npx @decidio/sdk connect" : "✘ the link expired before it was allowed - start a fresh one: npx @decidio/sdk connect");
@@ -4052,19 +4454,26 @@ async function finishConnect(root, c, opts, fresh) {
     }
     const cloud = inCloudSession();
     const shared = opts.team || cloud;
+    const everywhere = !shared && c?.root === COMPUTER;
+    const home = process.platform === "win32" ? (SHELL_ENV.USERPROFILE ?? homedir()) : (SHELL_ENV.HOME ?? homedir());
     const plugin = !cloud && decidioPluginEnabled(root);
     if (!plugin) {
-        const rc = await cmdHookInstall({ project: shared, dir: root, quiet: true });
+        const rc = await cmdHookInstall({ project: shared || everywhere, dir: everywhere ? home : root, quiet: true, portable: everywhere, ...(shared && !opts.holdEveryone ? { unconnected: "tell" } : {}) });
         if (rc !== 0)
             return rc;
     }
     const probe = await api("/agent/status/doctor-scope-probe", {}, process.env.DECIDIO_API_TOKEN, true);
     const verified = probe.status === 404;
-    const settings = lastHookInstall ? relative(root, lastHookInstall.settingsPath).split(pathSep).join("/") || lastHookInstall.settingsPath : ".claude/settings.json";
+    const settings = everywhere ? "~/.claude/settings.json" : lastHookInstall ? relative(root, lastHookInstall.settingsPath).split(pathSep).join("/") || lastHookInstall.settingsPath : ".claude/settings.json";
     const hostName = connectHostLabel(c?.host ?? "claude-code");
+    const approverName = printableName(c?.approver);
     if (c) {
-        log(`✔ ${fresh ? "Connected to Decidio" : "Already connected to Decidio"}${c.workspaceName ? ` - workspace ${c.workspaceName}` : ""}${fresh && c.approvedBy ? `, allowed by ${c.approvedBy}` : ""}`);
-        log(`✔ Approvals go to ${c.approver ?? "the approver you picked"} - on the phone app, Slack, Teams or the web`);
+        const wsName = printableName(c.workspaceName), allowedBy = printableName(c.approvedBy);
+        log(`✔ ${fresh ? "Connected to Decidio" : "Already connected to Decidio"}${wsName ? ` - workspace ${wsName}` : ""}${fresh && allowedBy ? `, allowed by ${allowedBy}` : ""}`);
+        if (c.answered === false)
+            log(`• One question is still open for this computer: "Should another person approve this?" - the workspace owner answers it once on the Decidio Agents page${c.appUrl ? ` (${c.appUrl.replace(/\/+$/, "")}/connect/agents#coding-assistants)` : ""}. Until then its owner can't approve its destructive commands - another approver can, or they wait.`);
+        else
+            log(`✔ Approvals go to ${approverName ?? "its approver"} - on the phone app, Slack, Teams or the web`);
     }
     if (!verified) {
         err(probe.status === 401 || probe.status === 403
@@ -4076,19 +4485,24 @@ async function finishConnect(root, c, opts, fresh) {
     const changed = !plugin && lastHookInstall && (lastHookInstall.pre !== "kept" || lastHookInstall.post !== "kept");
     log(plugin
         ? `✔ ${hostName} asks before destructive commands in this project (the Decidio plugin's hooks)`
-        : `✔ ${hostName} asks before destructive commands in this project (${settings})`);
+        : `✔ ${hostName} asks before destructive commands in ${everywhere ? "every project on this computer" : "this project"} (${settings})`);
+    log(dim(`  What waits for a person's approval: deleting files (rm -rf), force-pushing, dropping tables, terraform and kubectl changes, publishing a package, curl | sh - and switching Decidio's own check off. Everything else runs as before.`));
     if (changed)
         log(dim(`  Claude Code picks the settings change up by itself - if a destructive command is not asked about, open /hooks once (or restart it).`));
     if (c)
-        log(dim(`  Credentials: ${connectionFile(root)} (outside the repository, owner-only) · until ${c.expiresAt.slice(0, 10)}${cloud ? " · this cloud machine only - a fresh one refuses destructive commands until it connects again" : ""}`));
-    if (!plugin && (shared || process.platform === "win32") && !sameDir(realOrSame(process.cwd()), root))
+        log(dim(`  Credentials: ${connectionFile(c.root)} (outside the repository, owner-only) · ${c.root === COMPUTER ? "every project on this computer" : "this project"} · until ${c.expiresAt.slice(0, 10)}${cloud ? ` · this cloud machine only - a fresh one connects again (the Decidio connector does it with no tap)${opts.holdEveryone ? ", and is refused destructive commands until it does" : ""}` : ""}`));
+    if (!plugin && !everywhere && (shared || process.platform === "win32") && !sameDir(realOrSame(process.cwd()), root))
         log(dim(`  Claude Code reads ${settings} from the folder it starts in - start it at ${root}.`));
     if (cloud && !opts.team)
-        log(`• A cloud session reads only the repository's ${settings}, so the hooks are there - not committed. Ask the person before committing it: committed, every cloud session of this repository asks too, and so does every teammate's clone (a teammate connects with npx @decidio/sdk connect).`);
+        log(`• A cloud session reads the repository's settings, not a computer's, so the hooks are in ${settings} - not committed. Ask the person before committing it: committed, every cloud session of this repository asks too, and so does every teammate's clone (a teammate connects with npx @decidio/sdk connect).`);
     else if (shared)
         log(`• Commit ${settings}: every clone then asks before destructive commands (a teammate connects with npx @decidio/sdk connect).`);
-    if (fresh)
-        log(dim(`  Try it: ask ${hostName} to delete a scratch folder with rm -rf - the approval reaches ${c?.approver ?? "the approver"} on their phone.`));
+    if (shared && !plugin)
+        log(dim(opts.holdEveryone
+            ? "  A computer that isn't connected is refused every destructive command until it connects (--hold-everyone)."
+            : "  A computer that isn't connected is told once (with how to connect), then the same command runs without Decidio's approval. To keep refusing it until it connects: npx @decidio/sdk connect --team --hold-everyone"));
+    if (fresh && c?.answered !== false)
+        log(dim(`  Try it: ask ${hostName} to delete a scratch folder with rm -rf - the approval reaches ${approverName ?? "the approver"} on their phone.`));
     return 0;
 }
 const DECIDIO_PLUGIN = "decidio-approvals";
@@ -4106,21 +4520,23 @@ function decidioPluginEnabled(root) {
 }
 async function cmdDisconnect() {
     const root = projectRoot();
-    const c = loadConnection(root, API);
-    dropFile(pendingConnectFile(root));
+    const scope = connectScope(root);
+    const c = loadConnection(scope, API);
+    dropFile(pendingConnectFile(scope));
+    const where = scope === COMPUTER ? "this computer" : "this project on this machine";
     if (!c) {
-        log("• this project isn't connected on this machine - nothing to do.");
+        log(`• ${where} isn't connected - nothing to do.`);
         return 0;
     }
     try {
-        writeSecretFile(connectionFile(root), JSON.stringify({ ...c, token: "", jti: "", disconnected: true }) + "\n");
+        writeSecretFile(connectionFile(scope), JSON.stringify({ ...c, token: "", jti: "", disconnected: true }) + "\n");
     }
     catch (e) {
-        err(`✘ couldn't update ${connectionFile(root)} (${e?.message ?? e}) - delete it by hand to disconnect.`);
+        err(`✘ couldn't update ${connectionFile(scope)} (${e?.message ?? e}) - delete it by hand to disconnect.`);
         return 1;
     }
-    log(`✔ disconnected this project on this machine - its token is deleted.`);
-    log(`  Destructive commands are now refused until you connect again (the hooks stay on: switching Decidio off needs a person's approval).`);
+    log(`✔ disconnected ${where} - its token is deleted.`);
+    log(`  Destructive commands are now refused${scope === COMPUTER ? " in every project here" : ""} until you connect again (the hooks stay on: switching Decidio off needs a person's approval).`);
     log(dim(`  "${c.agentId}" stays listed in Decidio until its token expires (${c.expiresAt.slice(0, 10)}); to end it now, revoke it on the Agents page${c.appUrl ? `: ${c.appUrl.replace(/\/+$/, "")}/connect/agents` : ""}.`));
     return 0;
 }
@@ -5403,17 +5819,21 @@ APPROVALS AND RECEIPTS
                                        (never the receipt's own issuer field; --allow-unpinned: structural check only)
 
 CODING AGENTS (Claude Code)
-  npx @decidio/sdk connect             connect this project's coding assistant in one tap: prints a link and a short
-                                       code (a QR and the browser too, on a real terminal); the workspace owner allows
-                                       it on the web, then this machine gets an ask-only credential (kept outside the
-                                       repository) and the hooks below switch on. Your assistant can run it for you.
+  npx @decidio/sdk connect             connect this computer's coding assistant once, for every project on it: prints a
+                                       link and a short code (a QR and the browser too, on a real terminal); the workspace
+                                       owner allows it on the web, then this computer gets an ask-only credential (kept
+                                       outside every repository) and the hooks below switch on in ~/.claude/settings.json.
   npx @decidio/sdk connect --wait      finish a connect started by an assistant: returns once it is allowed, within 90 s
                                        (exit 0 connected · 3 refused or expired · 1 still waiting, run it again)
-                                       --team: the shared .claude/settings.json every clone reads (default: yours
-                                       alone; a cloud session reads only the shared file, so there it is always that
-                                       one) · --no-browser · --force: a fresh token for this machine
-  npx @decidio/sdk disconnect          delete this machine's connection for this project (destructive commands are then
-                                       refused until you connect again; the hooks stay on)
+                                       --team: the shared .claude/settings.json every clone reads (a cloud session reads
+                                       the repository's files, not a computer's, so there it is always the shared one); a
+                                       computer that isn't connected is told once, then let through - --hold-everyone keeps
+                                       refusing it · --no-browser · --force: a fresh token for this computer
+  npx @decidio/sdk connect --ticket <t>
+                                       finish the link the Decidio connector allowed (its connect_device tool returns the
+                                       ticket): writes this computer's credential, nothing else
+  npx @decidio/sdk disconnect          delete this computer's connection (destructive commands are then refused until
+                                       you connect again; the hooks stay on)
   npx @decidio/sdk hook install [--project] [--approver <email>] [--cli <path>]
                                        a person approves Claude Code's destructive shell commands before they run
                                        (rm -rf, git push --force, DROP TABLE, terraform apply, kubectl delete,
@@ -5434,6 +5854,11 @@ CODING AGENTS (Claude Code)
                                        (90 s; at most 120 s) for the approver, then refused with its decision id; the SAME command
                                        retried after approval runs once - its execution is recorded and that
                                        approval is spent. No credentials, no gate, no answer = refused (fail closed).
+                                       --unconnected=tell (written into a shared file by connect): a computer with no
+                                       credential is refused once per session and command, then let through with a line.
+  npx @decidio/sdk hook prompt         the UserPromptSubmit hook: the person's own typed "decidio pause" / "decidio start"
+                                       pauses or resumes the guard for that session (never on an enterprise plan; every
+                                       pause and every command run under it is recorded); other prompts pass untouched.
 
 CONTEXT PACKS (Claude Code, Claude.ai, ChatGPT)
   npx @decidio/sdk context create <slug> --title "ACME application" --trigger "whenever we discuss the ACME application"
@@ -5661,7 +6086,7 @@ async function main(argv) {
         logout: { flags: [] },
         phone: { flags: [] },
         init: { flags: ["--unique", "--force"], valued: ["--expires-days"] },
-        connect: { flags: ["--wait", "--no-browser", "--team", "--force"], valued: ["--host"] },
+        connect: { flags: ["--wait", "--no-browser", "--team", "--force", "--hold-everyone"], valued: ["--host", "--ticket"] },
         disconnect: { flags: [] },
         doctor: { flags: [] },
         approvals: { flags: ["--json", "--mine"], valued: ["--reason"] },
@@ -5669,7 +6094,7 @@ async function main(argv) {
         verify: { flags: ["--allow-unpinned"], valued: ["--issuer"] },
         tokens: { flags: ["--mine"] },
         dev: { flags: [], valued: ["--target", "--port"] },
-        hook: { flags: ["--project"], valued: ["--timeout", "--approver", "--cli"] },
+        hook: { flags: ["--project"], valued: ["--timeout", "--approver", "--cli", "--unconnected"] },
         github: { flags: ["--agents-md"], valued: ["--environment", "--justification", "--decision", "--workflow", "--api"] },
         deploys: { flags: ["--watch", "--json"], valued: ["--environment", "--repo", "--limit"] },
         controls: { flags: ["--json"] },
@@ -5870,13 +6295,14 @@ async function main(argv) {
             }
             return cmdContext(sub, pos.slice(1), { title: valuedOpt(argsIn, "--title"), trigger: valuedOpt(argsIn, "--trigger"), team: valuedOpt(argsIn, "--team"), unit: valuedOpt(argsIn, "--unit"), org: argsIn.includes("--org"), here: argsIn.includes("--here"), pack: valuedOpt(argsIn, "--pack"), chatgpt: argsIn.includes("--chatgpt"), json: argsIn.includes("--json") });
         }
-        case "connect": return cmdConnect({ wait: argsIn.includes("--wait"), host: valuedOpt(argsIn, "--host"), noBrowser: argsIn.includes("--no-browser"), team: argsIn.includes("--team"), force: argsIn.includes("--force") });
+        case "connect": return cmdConnect({ wait: argsIn.includes("--wait"), host: valuedOpt(argsIn, "--host"), noBrowser: argsIn.includes("--no-browser"), team: argsIn.includes("--team"), force: argsIn.includes("--force"),
+            ticket: valuedOpt(argsIn, "--ticket"), holdEveryone: argsIn.includes("--hold-everyone") });
         case "disconnect": return cmdDisconnect();
         case "hook": {
-            const VALUED = ["--timeout", "--approver", "--cli"];
+            const VALUED = ["--timeout", "--approver", "--cli", "--unconnected"];
             const pos = argsIn.filter((x, i) => !x.startsWith("-") && !VALUED.includes(argsIn[i - 1] ?? ""));
             const sub = pos[0];
-            const allowed = { pretool: [], posttool: [], wait: ["--timeout"], install: ["--project", "--approver", "--cli"], rules: [], justify: [] };
+            const allowed = { pretool: ["--unconnected"], posttool: [], session: [], prompt: [], wait: ["--timeout"], install: ["--project", "--approver", "--cli"], rules: [], justify: [] };
             const given = argsIn.filter((x) => x.startsWith("--")).map((x) => x.split("=")[0]);
             if (sub && allowed[sub]) {
                 const stray = given.find((f) => !allowed[sub].includes(f));
@@ -5886,8 +6312,10 @@ async function main(argv) {
                 }
             }
             switch (sub) {
-                case "pretool": return cmdHookPretool();
+                case "pretool": return cmdHookPretool({ unconnected: valuedOpt(argsIn, "--unconnected") === "tell" ? "tell" : "hold" });
                 case "posttool": return cmdHookPosttool();
+                case "session": return cmdHookSession();
+                case "prompt": return cmdHookPrompt();
                 case "wait": {
                     const t = valuedOpt(argsIn, "--timeout") ?? "600";
                     if (!/^\d+$/.test(t) || Number(t) < 1 || Number(t) > 86_400) {
@@ -5900,7 +6328,7 @@ async function main(argv) {
                 case "rules": return cmdHookRules();
                 case "justify": return cmdHookJustify(pos[1], pos.slice(2).join(" "));
                 default:
-                    err(`✘ hook needs a subcommand: install | wait <decision-id> | justify <decision-id> "<what changed>" | rules (pretool and posttool are run by Claude Code).\n\n${USAGE}`);
+                    err(`✘ hook needs a subcommand: install | wait <decision-id> | justify <decision-id> "<what changed>" | rules (pretool, posttool and session are run by Claude Code).\n\n${USAGE}`);
                     return 2;
             }
         }

package/openapi.yaml

@@ -5,7 +5,7 @@
 openapi: 3.1.0
 info:
   title: Decidio Agent Gate
-  version: 0.10.0   # tracks the SDK release - checked by packages/conformance/manifests.mjs
+  version: 0.11.0   # tracks the SDK release - checked by packages/conformance/manifests.mjs
   description: >
     Authorize an AI-agent action (proceed | route | block), confirm the captured outcome, and
     receive the signed resume webhook when a routed action is decided. Every outcome seals a

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decidio/sdk",
-  "version": "0.10.0",
+  "version": "0.11.0",
   "description": "One-line approval gate for AI-agent actions. Wrap a risky tool call with guard.protect(); Decidio's policy engine decides proceed | route | block, a human approves routed actions, and every outcome is sealed as a verifiable Authority Receipt.",
   "license": "Apache-2.0",
   "type": "module",
@@ -84,7 +84,7 @@
     "prepublishOnly": "npm run typecheck && npm run build && node ../publish-boundary/check.mjs --only @decidio/sdk"
   },
   "dependencies": {
-    "@decidio/verify": "0.10.0"
+    "@decidio/verify": "0.11.0"
   },
   "author": "OmniTwin Technologies Inc.",
   "bugs": {