@decidio/sdk 0.10.0 → 0.12.0

package/dist/cli.js

@@ -76,9 +76,18 @@ if (!OFFLINE_CMD)
     }
 const DEFAULT_API = "https://decidio-api.onrender.com";
 let API = (process.env.DECIDIO_API_URL ?? DEFAULT_API).replace(/\/$/, "");
+const COMPUTER = "*";
+const EVERY_PROJECT = "every project";
+const GUARD_POLICY_RE = /^[A-Za-z0-9_-]{20,64}$/;
+let CONNECTED_APPROVER = null;
+let CONNECTED_UNANSWERED = false;
+let CONNECTED_APP_URL = null;
+let CONNECTED_WORKSPACE = null;
+let GUARD_PAUSABLE = true;
+let connectNotice = null;
 let CREDS_FROM = SHELL_ENV.DECIDIO_API_TOKEN ? "shell" : process.env.DECIDIO_API_TOKEN ? ".env" : null;
 if (!OFFLINE_CMD && !["init", "quickstart", "login", "logout", "phone"].includes(ARGV_TAIL[0] ?? "") && !process.env.DECIDIO_API_TOKEN && !process.env.DECIDIO_AGENT_ID) {
-    const c = loadConnection(projectRoot(), API);
+    const c = activeConnection(projectRoot(), API);
     if (c) {
         promoteConnection(c);
         CREDS_FROM = "connection";
@@ -2764,6 +2773,14 @@ function hookMatch(command, at, rules = [...HOOK_RULES, ...hookExtraRules()], de
         }
     return null;
 }
+function hookEditsGuard(command, at) {
+    try {
+        return !!hookMatch(command, at, HOOK_RULES.filter((r) => r.category === "decidio-guard"));
+    }
+    catch {
+        return true;
+    }
+}
 function hookSelfDecides(command, depth = 0) {
     const hit = hookSegments(command).some((s) => {
         const a = s.args.map((x) => x.replace(/^["']|["']$/g, ""));
@@ -3038,7 +3055,7 @@ function hookSubject(category, segs, cwdAbs, projectDir, at) {
     }
     return textOnly("text binds this category");
 }
-const hookIsOurs = (h) => typeof h?.command === "string" && /\bhook (pretool|posttool)\b/.test(h.command) && /decidio|cli\.(js|ts)/.test(h.command);
+const hookIsOurs = (h) => typeof h?.command === "string" && /\bhook (pretool|posttool|session|prompt)\b/.test(h.command) && /decidio|cli\.(js|ts)/.test(h.command);
 const hookSorted = (v) => Array.isArray(v) ? v.map(hookSorted) : v && typeof v === "object" ? Object.fromEntries(Object.keys(v).sort().map((k) => [k, hookSorted(v[k])])) : v;
 function hookOurHandlers(settings) {
     const out = [];
@@ -3398,8 +3415,104 @@ async function hookHold(cfg, decisionId, holdMs) {
     }
     return { status, lastError };
 }
-async function cmdHookPretool() {
-    const out = (o) => { process.stdout.write(JSON.stringify(o) + "\n"); return 0; };
+const ORGANISATION_KEEPS_ON = "Your organisation keeps Decidio on for every session.";
+const GUARD_PAUSE_HOURS = 12;
+export function guardWords(prompt) {
+    const m = typeof prompt === "string" ? /^\s*decidio\s+(pause|start)\s*[.!]?\s*$/i.exec(prompt) : null;
+    return m ? m[1].toLowerCase() : null;
+}
+const guardSessionKey = (material, session) => idempotencyKey(material, { purpose: "guard-pause", host: "claude-code", session });
+async function cmdHookPrompt() {
+    const block = (reason) => { process.stdout.write(JSON.stringify({ decision: "block", reason }) + "\n"); return 0; };
+    let action = null;
+    try {
+        const read = await readHookStdin();
+        if (!read.ok)
+            return 0;
+        const input = read.input;
+        action = guardWords(input.prompt);
+        if (!action)
+            return 0;
+        const not = action === "pause" ? "the guard stays on" : "nothing changed";
+        if (input.source !== "user")
+            return block(`Decidio: "decidio ${action}" works only on a prompt you type yourself - ${not}.`);
+        const session = typeof input.session_id === "string" ? input.session_id : "";
+        if (!session)
+            return block(`Decidio: this session has no id to pause the guard for - ${not}.`);
+        const cfg = hookConfig();
+        if ("missing" in cfg)
+            return block(`Decidio isn't connected on this computer, so there is no guard to ${action === "pause" ? "pause" : "resume"} here.`);
+        const material = bindingMaterial(cfg);
+        if (!material)
+            return block(`Decidio: this computer's credential can't key the pause - ${not}. Ask the person to run npx @decidio/sdk doctor.`);
+        assertSafeTransport(cfg.apiUrl, true);
+        const r = await fetch(cfg.apiUrl.replace(/\/$/, "") + "/agent/guard", { method: "POST", headers: { "content-type": "application/json", authorization: `Bearer ${cfg.apiToken}` },
+            body: JSON.stringify({ session: guardSessionKey(material, session), action }), signal: AbortSignal.timeout(10_000) });
+        const body = await r.json().catch(() => null);
+        if (r.status === 403 && body?.code === "ORGANISATION_KEEPS_ON") {
+            notePause(session, false);
+            rememberPausable(false);
+            return block(ORGANISATION_KEEPS_ON);
+        }
+        if (r.ok && body?.state === "paused") {
+            notePause(session, true);
+            rememberPausable(true);
+            return block(`Decidio guard paused for this session: destructive commands run without a person's approval - each one is recorded in your workspace's audit log - until you type "decidio start" (or for ${GUARD_PAUSE_HOURS} hours). Decidio still asks before a command edits Claude Code's settings to switch its check off.`);
+        }
+        if (r.ok && body?.state === "on") {
+            notePause(session, false);
+            return block(body.resumed ? "Decidio guard is back on for this session." : "Decidio guard is on for this session (it wasn't paused).");
+        }
+        return block(`Decidio couldn't ${action} the guard just now (${r.status}) - ${action === "pause" ? "it stays on" : "if it was paused, type \"decidio start\" again"}.`);
+    }
+    catch (e) {
+        if (!action)
+            return 0;
+        return block(`Decidio couldn't ${action} the guard just now (${String(e?.message ?? e).replace(/^\[decidio\] /, "").slice(0, 160)}) - ${action === "pause" ? "it stays on" : "if it was paused, type \"decidio start\" again"}.`);
+    }
+}
+function rememberPausable(pausable) {
+    if (CREDS_FROM !== "connection")
+        return;
+    const c = activeConnection(projectRoot(), API);
+    if (!c || (c.guardPausable !== false) === pausable)
+        return;
+    try {
+        writeSecretFile(connectionFile(c.root), JSON.stringify({ ...c, guardPausable: pausable }) + "\n");
+    }
+    catch { }
+}
+function hookForgesPrompt(command, depth = 0) {
+    const hit = hookSegments(command).some((s) => {
+        const a = s.args.map((x) => x.replace(/^["']|["']$/g, ""));
+        const cli = (x) => /^@decidio\/sdk(@\S+)?$/i.test(x) || /^decidio(@\S+)?$/i.test(x) || /(^|[\\/])(decidio-guard|@decidio[\\/]sdk)[\\/](dist[\\/])?cli\.(js|ts)$/i.test(x);
+        const runsCli = s.program === "decidio" || s.program === "decidio.js"
+            || ((["npx", "pnpx", "bunx", "npm", "pnpm", "yarn", "bun", "node", "tsx", "uv", "uvx", "pipx"].includes(s.program) || /^python[0-9.]*$/.test(s.program)) && a.some(cli));
+        const i = a.indexOf("hook");
+        return runsCli && i >= 0 && a.slice(i + 1).some((x) => x.toLowerCase() === "prompt");
+    });
+    return hit || (depth < 2 && hookShellInner(command).some((c) => hookForgesPrompt(c, depth + 1)));
+}
+function cmdHookSession() {
+    try {
+        const cfg = hookConfig();
+        const msg = "missing" in cfg
+            ? "Decidio approvals are on here, but this computer isn't connected yet - the first destructive command shows a link to connect it (once, for every project on this computer)."
+            : `Decidio guard is on for this session${CONNECTED_WORKSPACE ? ` (workspace ${CONNECTED_WORKSPACE})` : ""}: deleting files, force-pushing, dropping tables, infrastructure changes and publishing wait for ${CONNECTED_APPROVER ?? "a person"}'s OK; everything else runs as usual. `
+                + (GUARD_PAUSABLE ? `Type "decidio pause" to pause it for this session, "decidio start" to resume.` : ORGANISATION_KEEPS_ON);
+        process.stdout.write(JSON.stringify({ systemMessage: msg, hookSpecificOutput: { hookEventName: "SessionStart",
+                additionalContext: "Decidio's hook asks a person before destructive shell commands in this project. When it refuses one, tell the user what its message says (who must approve, or the link that connects this computer) and follow it; never work around it." } }) + "\n");
+    }
+    catch { }
+    return 0;
+}
+async function cmdHookPretool(opts = { unconnected: "hold" }) {
+    const out = (o) => {
+        if (connectNotice)
+            o = { ...o, systemMessage: o?.systemMessage ? `${connectNotice} ${o.systemMessage}` : connectNotice };
+        process.stdout.write(JSON.stringify(o) + "\n");
+        return 0;
+    };
     const deny = (reason, user) => out({ hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "deny", permissionDecisionReason: reason }, ...(user ? { systemMessage: user } : {}) });
     const allow = (reason) => out({ hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "allow", permissionDecisionReason: reason } });
     try {
@@ -3416,6 +3529,8 @@ async function cmdHookPretool() {
             const command = typeof input.tool_input?.command === "string" ? input.tool_input.command : "";
             if (!command.trim())
                 return 0;
+            if (hookForgesPrompt(command))
+                return deny("Decidio: an agent can't pause or resume Decidio's guard - only the person does, by typing \"decidio pause\" or \"decidio start\" themselves. Nothing ran. Tell the user if they want it paused.");
             if (hookSelfDecides(command))
                 return deny("Decidio: an agent can't decide an approval - `approvals approve|reject` is the person's, and the person decides on their phone, the web app, Slack or Teams. Nothing ran. Tell the user which decision is waiting; never try another way to decide it.", "Decidio: the agent tried to decide an approval - refused");
             const segs = hookSegments(command);
@@ -3435,7 +3550,8 @@ async function cmdHookPretool() {
             const canonical = command.replace(/\s+/g, " ").trim();
             const base = hookSubject(rule.category, segs, cwdAbs, projectDir, at);
             const subject = followed ? { fingerprint: `${base.fingerprint ?? ""}\nfile:${followed.rel}:${followed.sha}`, display: followed.rel } : base;
-            g = { category: rule.category, isFile: false, text: canonical, binding: canonical + "\n" + (subject.fingerprint ?? ""), subject, identity: { command: canonical, subject: subject.fingerprint ?? "" }, segs,
+            const offSwitch = rule.category === "decidio-guard" || hookEditsGuard(command, at);
+            g = { category: rule.category, isFile: false, text: canonical, binding: canonical + "\n" + (subject.fingerprint ?? ""), subject, identity: { command: canonical, subject: subject.fingerprint ?? "" }, segs, offSwitch,
                 ...(followed ? { scriptLine: hookRedact(`${followed.rel}:${followed.line}: ${followed.text.replace(/\s+/g, " ").trim()}`).slice(0, 160) } : {}) };
         }
         else if (tool === "Write" || tool === "Edit" || tool === "MultiEdit") {
@@ -3443,7 +3559,7 @@ async function cmdHookPretool() {
             if (!fc)
                 return 0;
             const what = fc.changes.join("; ");
-            g = { category: "decidio-guard", isFile: true, text: `${tool} ${fc.display} — ${what}`, binding: `${tool}\n${fc.abs}\n${fc.sha}`, subject: { fingerprint: fc.sha, display: `${fc.display}: ${what}` }, identity: { path: fc.abs, after: fc.sha }, segs: null };
+            g = { category: "decidio-guard", isFile: true, text: `${tool} ${fc.display} — ${what}`, binding: `${tool}\n${fc.abs}\n${fc.sha}`, subject: { fingerprint: fc.sha, display: `${fc.display}: ${what}` }, identity: { path: fc.abs, after: fc.sha }, segs: null, offSwitch: true };
         }
         else
             return 0;
@@ -3451,7 +3567,24 @@ async function cmdHookPretool() {
             ? { noun: "edit", run: "make", ran: "Nothing was written.", anew: "If the user wants a different change to this file, that is a new request and may be asked." }
             : { noun: "command", run: "run", ran: "Nothing ran.", anew: "If the user changes what it would act on (a new commit, a different path), that is a new request and may be asked." };
         const short = hookShort(hookRedact(g.text.replace(/\s+/g, " ").trim()));
-        const cfg = hookConfig();
+        let cfg = hookConfig();
+        if ("missing" in cfg) {
+            const got = await hookProvision(opts.policy);
+            if (!got.ok) {
+                const held = got.hold === true || (opts.policy !== undefined && got.hold !== false);
+                if (opts.unconnected === "tell" && held && !g.offSwitch)
+                    return deny(`Decidio: "${short}" is a ${g.category} ${w.noun} that needs a person's approval - ${got.reason} ${w.ran} ${got.holdWhy ?? (got.hold === true ? "This team's Decidio holds a computer that isn't connected until it connects." : "This repository's Decidio line holds a computer that isn't connected unless Decidio confirms this team lets it through, and it couldn't confirm that here.")}`, got.user);
+                if (opts.unconnected === "tell" && !g.offSwitch) {
+                    const told = toldOnce(typeof input.session_id === "string" ? input.session_id : "", g.binding);
+                    if (told === "passed")
+                        return out({ systemMessage: `Decidio: "${short}" ran without Decidio's approval - this computer isn't connected, and this repository lets a computer that isn't connected through after one notice.` });
+                    if (told === "noted")
+                        return deny(`Decidio: "${short}" is a ${g.category} ${w.noun} that needs a person's approval - ${got.reason} ${w.ran} This repository lets a computer that isn't connected run it after this one notice: if you can't connect, tell the user it would run WITHOUT Decidio's approval, and retry the same ${w.noun} only if they want that.`, got.user);
+                }
+                return deny(`Decidio: "${short}" is a ${g.category} ${w.noun} that needs a person's approval - ${got.reason} ${w.ran}`, got.user);
+            }
+            cfg = hookConfig();
+        }
         if ("missing" in cfg)
             return deny(`Decidio: "${short}" is a ${g.category} ${w.noun} that needs a person's approval, but this project is not connected to Decidio yet. ${w.ran} Run \`npx @decidio/sdk connect\` in ${projectDir} and show the user the link it prints (they allow it on the web), then run \`npx @decidio/sdk connect --wait\`; once it says connected, retry the same ${w.noun}.`, `Decidio: this project is not connected - run npx @decidio/sdk connect`);
         const rel = relative(projectDir, cwdAbs);
@@ -3464,6 +3597,13 @@ async function cmdHookPretool() {
         catch (e) {
             return deny(`Decidio hook: this ${w.noun} cannot be bound to an approval (${e?.message ?? e}) - refusing to ${w.run} it. Ask the user to check ${projectDir}/.env with \`npx @decidio/sdk doctor\`.`);
         }
+        if (material && session && !g.offSwitch) {
+            const paused = existsSync(pauseNote(session)) ? await guardPausedNow(cfg, guardSessionKey(material, session), g.category) : "on";
+            if (paused === "on")
+                notePause(session, false);
+            if (paused === "paused")
+                return out({ systemMessage: `Decidio guard is paused for this session: "${short}" ran without a person's approval (recorded). Type "decidio start" to resume.` });
+        }
         if (!material)
             return deny(`Decidio hook: this ${w.noun} cannot be bound to an approval (no key material (DECIDIO_API_TOKEN, or DECIDIO_AGENT_KEY + DECIDIO_AGENT_DID)) - refusing to ${w.run} it. Ask the user to check ${projectDir}/.env with \`npx @decidio/sdk doctor\`.`);
         const committed = { command: hookRedact(g.text).slice(0, 400), cwd: cwdRel.slice(0, 200), category: g.category, host: "claude-code", tool, subject: hookRedact(g.subject.display).slice(0, 200), ...(g.scriptLine ? { scriptLine: g.scriptLine } : {}) };
@@ -3508,7 +3648,7 @@ async function cmdHookPretool() {
         if (auth.decision === "proceed") {
             writeHookState(input.tool_use_id, { v: 1, decisionId: auth.decisionId, receiptId: auth.receiptId ?? null, tool, category: g.category, at: new Date().toISOString() });
             err(`decidio hook: "${short}" is authorized by policy (decision ${auth.decisionId}${auth.receiptId ? `, receipt ${auth.receiptId}` : ""}, sealed) - no output, so Claude Code's own permission check still decides; this covers this one execution only.`);
-            return 0;
+            return connectNotice ? out({}) : 0;
         }
         const holdRaw = Number(process.env.DECIDIO_HOOK_HOLD_MS ?? "90000");
         const held = await hookHold(cfg, auth.decisionId, Number.isFinite(holdRaw) && holdRaw >= 0 ? Math.min(holdRaw, HOOK_HOLD_CAP_MS) : 90_000);
@@ -3516,7 +3656,7 @@ async function cmdHookPretool() {
         if (!st)
             return deny(`Decidio: "${short}" is routed for approval as decision ${auth.decisionId}, but its status could not be read (${held.lastError ?? "no answer"}). ${w.ran} When the gate is reachable, run \`npx @decidio/sdk hook wait ${auth.decisionId}\` and then retry EXACTLY the same ${w.noun}.`);
         if (st.state === "pending")
-            return deny(`Decidio: "${short}" needs a person's approval - decision ${auth.decisionId} is in their queue${where ? ` (${where})` : ""}. ${w.ran} To continue: run \`npx @decidio/sdk hook wait ${auth.decisionId}\` (it returns when they decide), then retry EXACTLY the same ${w.noun} - not a variant of it, and do not work around this gate.`, `Decidio: ${auth.decisionId} awaits approval${where ? ` - ${where}` : ""}`);
+            return deny(`Decidio: "${short}" needs a person's approval - decision ${auth.decisionId} is in ${CONNECTED_APPROVER ? `${CONNECTED_APPROVER}'s` : "their"} queue${where ? ` (${where})` : ""}; they see it on their phone, Slack, Teams or the web. ${w.ran} Tell the user it is waiting for ${CONNECTED_APPROVER ?? "the approver"}.${CONNECTED_UNANSWERED ? ` If nobody has said yet whether another person approves this computer's requests, tell the user: the workspace owner answers "Should another person approve this?" once on the Decidio Agents page${CONNECTED_APP_URL ? ` (${CONNECTED_APP_URL}/connect/agents#coding-assistants)` : ""}. A request made before the answer keeps it: its owner can't approve that one - another approver can, or ask again in a new session.` : ""} To continue: run \`npx @decidio/sdk hook wait ${auth.decisionId}\` (it returns when they decide), then retry EXACTLY the same ${w.noun} - not a variant of it, and do not work around this gate.`, `Decidio: waiting for ${CONNECTED_APPROVER ?? "a person"}'s approval (${auth.decisionId})${where ? ` - ${where}` : ""}. ${w.ran} Claude continues once it is approved.`);
         if (st.state === "rejected" || st.state === "blocked")
             return deny(`Decidio: "${short}" was ${st.state} (decision ${auth.decisionId}${st.reason ? `: ${st.reason}` : ""}) for this exact change (${hookRedact(g.subject.display)}). Do not retry it or a variant of it; tell the user. ${g.subject.fingerprint ? w.anew : ""}`.trim(), `Decidio: ${auth.decisionId} ${st.state}`);
         const chk = await checkApproval(cfg, auth.decisionId, request, { status: st });
@@ -3675,10 +3815,10 @@ function cmdHookRules() {
     log(`A policy that auto-approves a request gets no output from the hook, so Claude Code's own permission check still decides; only a person's approval of the exact call answers "allow".`);
     return 0;
 }
-function hookRunner() {
+function hookRunner(portable = false) {
     const q = (p) => `"${p.replace(/(["\\$`])/g, "\\$1")}"`;
     const entry = process.argv[1] ?? "";
-    if (!entry || /[\\/]_npx[\\/]/.test(entry))
+    if (portable || !entry || /[\\/]_npx[\\/]/.test(entry))
         return `npx -y @decidio/sdk@${VERSION}`;
     let real = entry;
     try {
@@ -3687,14 +3827,62 @@ function hookRunner() {
     catch { }
     const localRoot = resolvePath("node_modules") + pathSep;
     if (real.startsWith(localRoot))
-        real = "$CLAUDE_PROJECT_DIR/node_modules/" + real.slice(localRoot.length).split(pathSep).join("/");
+        return `node "$CLAUDE_PROJECT_DIR/node_modules/${real.slice(localRoot.length).split(pathSep).join("/").replace(/(["\\$`])/g, "\\$1")}"`;
     real = real.split(pathSep).join("/");
     if (/\.ts$/.test(real))
         return `npx tsx ${q(real)}`;
     return `node ${q(real)}`;
 }
+const hookPromptLine = (runner) => `cd "$CLAUDE_PROJECT_DIR" && IN=$(cat) && case "$IN" in *[Dd][Ee][Cc][Ii][Dd][Ii][Oo]*) printf '%s' "$IN" | ${runner} hook prompt;; esac`;
 const HOOK_FILE_TOOLS = ["Write", "Edit", "MultiEdit"];
 const HOOK_GUARD_PATHS = ["**/.claude/settings*.json", "~/.claude/settings*.json", "~/.claude/plugins/**"];
+function decidioHookSet(runner, preLine, postLine) {
+    const set = [
+        { event: "PreToolUse", matcher: "Bash|PowerShell", command: preLine, extra: { timeout: 150, onFailure: "block" } },
+        { event: "PostToolUse", matcher: "Bash|PowerShell", command: postLine, extra: { timeout: 30 } },
+        { event: "SessionStart", matcher: "startup|resume", command: `cd "$CLAUDE_PROJECT_DIR" && ${runner} hook session`, extra: { timeout: 15 } },
+        { event: "UserPromptSubmit", matcher: "", command: hookPromptLine(runner), extra: { timeout: 15 } },
+    ];
+    for (const t of HOOK_FILE_TOOLS)
+        for (const p of HOOK_GUARD_PATHS) {
+            set.push({ event: "PreToolUse", matcher: t, iff: `${t}(${p})`, command: preLine, extra: { timeout: 150, onFailure: "block" } });
+            set.push({ event: "PostToolUse", matcher: t, iff: `${t}(${p})`, command: postLine, extra: { timeout: 30 } });
+        }
+    return set;
+}
+function decidioHooksJson(runner) {
+    const hooks = {};
+    for (const h of decidioHookSet(runner, `cd "$CLAUDE_PROJECT_DIR" && ${runner} hook pretool`, `cd "$CLAUDE_PROJECT_DIR" && ${runner} hook posttool`)) {
+        const handler = { type: "command", ...(h.iff ? { if: h.iff } : {}), command: h.command, ...h.extra };
+        (hooks[h.event] ??= []).push(h.matcher ? { matcher: h.matcher, hooks: [handler] } : { hooks: [handler] });
+    }
+    return hooks;
+}
+function cmdHookManagedSettings() {
+    process.stdout.write(JSON.stringify({ hooks: decidioHooksJson(`npx -y @decidio/sdk@${VERSION}`) }, null, 2) + "\n");
+    for (const line of [
+        "Decidio hooks for Claude Code's managed settings (stdout above). Merge the \"hooks\" block into your organisation's managed settings:",
+        "  macOS   /Library/Application Support/ClaudeCode/managed-settings.json  (or the MDM profile domain com.anthropic.claudecode)",
+        "  Linux   /etc/claude-code/managed-settings.json   (WSL too)",
+        "  Windows C:\\Program Files\\ClaudeCode\\managed-settings.json  (or HKLM\\SOFTWARE\\Policies\\ClaudeCode, value \"Settings\")",
+        "  or a drop-in file in managed-settings.d/ beside it.",
+        "What it does: managed hooks run beside people's own hooks and can't be removed from their settings; a user's or project's",
+        "  disableAllHooks doesn't reach them. Never set disableAllHooks in managed settings - it would turn these off too.",
+        "Watch out:",
+        "  - Server-managed settings (the Claude admin console) and MDM/registry policies outrank this file - by default the first source",
+        "    found wins and the rest are skipped. Put these hooks in the highest-ranked source you deploy (server-managed hooks show each",
+        "    person an approval dialog first), or set \"managedSourcesBehavior\": \"merge\" there (Claude Code 2.1.242+).",
+        "  - Claude Code cloud sessions (claude.ai/code) read neither this file nor an MDM profile - only server-managed settings reach them.",
+        "  - Every computer needs Node 18+ and the npm registry: the pretool hook blocks the call if it can't run (fail closed).",
+        "  - Each computer still connects once - the first destructive command shows a link the workspace owner allows; until then it waits.",
+        "  - A repository whose committed settings already carry Decidio's hook runs both (one request; test it once).",
+        "  - A local administrator can edit this file.",
+        "  - allowManagedHooksOnly: true would also stop people's own hooks - your choice; Decidio doesn't need it.",
+        `  - To update, redeploy with the new version (pinned here: @decidio/sdk@${VERSION}).`,
+    ])
+        err(line);
+    return 0;
+}
 async function cmdHookInstall(opts) {
     const settingsPath = joinPath(opts.dir ?? ".", ".claude", opts.project ? "settings.json" : "settings.local.json");
     let settings = {};
@@ -3716,14 +3904,14 @@ async function cmdHookInstall(opts) {
         return 2;
     }
     const cliAt = opts.cli ? resolvePath(opts.cli).split(pathSep).join("/") : "";
-    const runner = opts.cli ? (/\.ts$/.test(opts.cli) ? `npx tsx "${cliAt}"` : `node "${cliAt}"`) : hookRunner();
+    const runner = opts.cli ? (/\.ts$/.test(opts.cli) ? `npx tsx "${cliAt}"` : `node "${cliAt}"`) : hookRunner(opts.portable === true);
     const hooks = (settings.hooks = settings.hooks && typeof settings.hooks === "object" && !Array.isArray(settings.hooks) ? settings.hooks : {});
     const place = (event, matcher, iff, command, extra) => {
         const list = Array.isArray(hooks[event]) ? hooks[event] : (hooks[event] = []);
         const want = { type: "command", ...(iff ? { if: iff } : {}), command, ...extra };
         let state = "added";
         for (const g of list) {
-            if (!g || typeof g !== "object" || g.matcher !== matcher || !Array.isArray(g.hooks))
+            if (!g || typeof g !== "object" || (g.matcher ?? "") !== matcher || !Array.isArray(g.hooks))
                 continue;
             g.hooks = g.hooks.flatMap((h) => {
                 if (!hookIsOurs(h) || (typeof h.if === "string" ? h.if : undefined) !== iff)
@@ -3738,20 +3926,23 @@ async function cmdHookInstall(opts) {
         }
         hooks[event] = list.filter((g) => !(g && typeof g === "object" && Array.isArray(g.hooks) && g.hooks.length === 0));
         if (state === "added")
-            hooks[event].push({ matcher, hooks: [want] });
+            hooks[event].push(matcher ? { matcher, hooks: [want] } : { hooks: [want] });
         return state;
     };
-    const preLine = `cd "$CLAUDE_PROJECT_DIR" && ${runner} hook pretool`, postLine = `cd "$CLAUDE_PROJECT_DIR" && ${runner} hook posttool`;
+    const preLine = `cd "$CLAUDE_PROJECT_DIR" && ${runner} hook pretool${opts.unconnected === "tell" ? ` --unconnected=tell${opts.policy && GUARD_POLICY_RE.test(opts.policy) ? ` --policy=${opts.policy}` : ""}` : ""}`, postLine = `cd "$CLAUDE_PROJECT_DIR" && ${runner} hook posttool`;
+    const set = decidioHookSet(runner, preLine, postLine);
     const pre = place("PreToolUse", "Bash|PowerShell", undefined, preLine, { timeout: 150, onFailure: "block" });
     const post = place("PostToolUse", "Bash|PowerShell", undefined, postLine, { timeout: 30 });
     const guard = { added: 0, updated: 0, kept: 0 };
-    for (const t of HOOK_FILE_TOOLS)
-        for (const p of HOOK_GUARD_PATHS) {
-            guard[place("PreToolUse", t, `${t}(${p})`, preLine, { timeout: 150, onFailure: "block" })]++;
-            guard[place("PostToolUse", t, `${t}(${p})`, postLine, { timeout: 30 })]++;
-        }
+    for (const h of set.slice(2)) {
+        const st = place(h.event, h.matcher, h.iff, h.command, h.extra);
+        if (h.iff)
+            guard[st]++;
+    }
     mkdirSync(dirname(settingsPath), { recursive: true });
-    writeFileSync(settingsPath, JSON.stringify(settings, null, 2) + "\n");
+    const target = realOrSame(settingsPath), tmpSettings = `${target}.decidio-${process.pid}.tmp`;
+    writeFileSync(tmpSettings, JSON.stringify(settings, null, 2) + "\n", { mode: existsSync(target) ? statSync(target).mode & 0o777 : 0o644 });
+    renameSync(tmpSettings, target);
     lastHookInstall = { settingsPath, pre, post };
     if (opts.quiet)
         return 0;
@@ -3795,7 +3986,7 @@ function projectRoot() {
     catch { }
     return realOrSame(SHELL_ENV.CLAUDE_PROJECT_DIR || process.cwd());
 }
-function connectionKey(root) { return createHash("sha256").update(`${API}\n${process.platform === "win32" ? root.toLowerCase() : root}`, "utf8").digest("hex").slice(0, 20); }
+function connectionKey(root) { return createHash("sha256").update(`${API}\n${root === COMPUTER ? "computer" : process.platform === "win32" ? root.toLowerCase() : root}`, "utf8").digest("hex").slice(0, 20); }
 function connectionFile(root) { return joinPath(connectDir(), `${connectionKey(root)}.json`); }
 function pendingConnectFile(root) { return joinPath(connectDir(), `${connectionKey(root)}.pending.json`); }
 function readJsonQuiet(f) {
@@ -3806,6 +3997,8 @@ function readJsonQuiet(f) {
         return null;
     }
 }
+function activeConnection(root, api) { return loadConnection(root, api) ?? loadConnection(COMPUTER, api); }
+const connectScope = (root) => (connectionRecord(root, API) ? root : COMPUTER);
 function loadConnection(root, api) {
     const c = connectionRecord(root, api);
     return c && !c.disconnected && c.token ? c : null;
@@ -3814,7 +4007,15 @@ function connectionRecord(root, api) {
     const c = readJsonQuiet(connectionFile(root));
     return c && c.v === 1 && c.api === api && c.root === root && typeof c.token === "string" && typeof c.agentId === "string" && typeof c.key === "string" && typeof c.did === "string" ? c : null;
 }
+function printableName(v) {
+    return typeof v === "string" ? v.replace(/[\u0000-\u001f\u007f-\u009f\u061c\u200b-\u200f\u2028-\u202e\u2060-\u2069\ufeff]/g, "").trim().slice(0, 60) || null : null;
+}
 function promoteConnection(c) {
+    CONNECTED_APPROVER = printableName(c.approver);
+    CONNECTED_UNANSWERED = c.answered === false;
+    CONNECTED_APP_URL = typeof c.appUrl === "string" && /^https?:\/\/[^\s"<>]+$/.test(c.appUrl) ? c.appUrl.replace(/\/+$/, "") : null;
+    CONNECTED_WORKSPACE = printableName(c.workspaceName);
+    GUARD_PAUSABLE = c.guardPausable !== false;
     process.env.DECIDIO_API_TOKEN = c.token;
     process.env.DECIDIO_AGENT_ID = c.agentId;
     process.env.DECIDIO_AGENT_DID = c.did;
@@ -3889,31 +4090,46 @@ function openInBrowser(url) {
 }
 const CONNECT_WAIT_S = () => { const n = Number(process.env.DECIDIO_CONNECT_WAIT_S ?? 90); return Number.isFinite(n) && n >= 1 && n <= 110 ? n : 90; };
 let lastHookInstall = null;
-async function startConnect(root, host) {
+let connectError = "";
+function hostOf(url) {
+    try {
+        return new URL(url).host || "Decidio's API host";
+    }
+    catch {
+        return "Decidio's API host";
+    }
+}
+function cloudNetworkWords() {
+    const host = hostOf(API);
+    return `this is a Claude Code cloud session: its environment's network access must allow ${host}. Edit the environment and add ${host} under Network access → Allowed domains, keeping the package-manager defaults (on Team and Enterprise an Owner can set it once on a shared environment): https://code.claude.com/docs/en/cloud-environments#network-access`;
+}
+let connectFailure = "other";
+async function startConnect(root, host, quiet = false, policy) {
+    const fail = (m, kind = "other") => { connectError = m; connectFailure = kind; if (!quiet)
+        err(`✘ ${m}`); return null; };
     const prior = connectionRecord(root, API);
     const kp = prior && !inCloudSession() ? { did: prior.did, privateKeyBase64: prior.key } : generateKeypair();
     const cloud = inCloudSession();
-    const project = projectLabel(root).trim() || "project", machine = machineLabel(cloud).trim() || "machine";
+    const project = (root === COMPUTER ? EVERY_PROJECT : projectLabel(root)).trim() || "project", machine = machineLabel(cloud).trim() || "machine";
     const proof = signBoundProof(kp.privateKeyBase64, { agentId: "connect", did: kp.did, action: "connect.start", amount: 0, scope: [host, project, machine, cloud ? "cloud" : "local"].join("\n") });
-    const r = await api("/connect/start", { method: "POST", body: JSON.stringify({ host, project, machine, did: kp.did, cloud, proof }) }, "", true);
-    if (r.status === 0) {
-        err(`✘ couldn't reach Decidio at ${API} - check your connection and run npx @decidio/sdk connect again.`);
-        return null;
-    }
-    if (r.status === 404 || r.status === 401) {
-        err(`✘ ${r.body?.message ?? "Connecting a coding assistant is available in the Decidio lab only."} (${API})`);
-        return null;
-    }
-    if (r.status === 429) {
-        err(`✘ ${r.body?.message ?? "Too many tries - wait a minute and try again."}`);
-        return null;
-    }
-    if (r.status !== 201 || typeof r.body?.pollSecret !== "string" || typeof r.body?.link !== "string") {
-        err(`✘ couldn't start a connection (${r.status}${r.body?.message ? `: ${r.body.message}` : ""}). Nothing was saved.`);
-        return null;
-    }
+    const startBody = { host, project, machine, did: kp.did, cloud, proof };
+    let r = await api("/connect/start", { method: "POST", body: JSON.stringify(policy ? { ...startBody, policy } : startBody) }, "", true);
+    let asked = !!policy;
+    if (policy && r.status === 400 && r.body?.code === "VALIDATION") {
+        asked = false;
+        r = await api("/connect/start", { method: "POST", body: JSON.stringify(startBody) }, "", true);
+    }
+    if (r.status === 0)
+        return fail(`couldn't reach Decidio at ${API} - ${inCloudSession() ? cloudNetworkWords() : "check your connection and run npx @decidio/sdk connect again."}`, "unreachable");
+    if (r.status === 404 || r.status === 401)
+        return fail(`${r.body?.message ?? "Connecting a coding assistant isn't switched on for this Decidio yet - it is on in the Decidio lab."} (${API})`, "off");
+    if (r.status === 429)
+        return fail(`${r.body?.message ?? "Too many tries - wait a minute and try again."}`, "unreachable");
+    if (r.status !== 201 || typeof r.body?.pollSecret !== "string" || typeof r.body?.link !== "string")
+        return fail(`couldn't start a connection (${r.status}${r.body?.message ? `: ${r.body.message}` : ""}). Nothing was saved.`, r.status >= 500 ? "unreachable" : "other");
     const p = { v: 1, api: API, root, project, host, machine, cloud, did: kp.did, key: kp.privateKeyBase64, code: String(r.body.code), link: String(r.body.link),
-        pollSecret: r.body.pollSecret, expiresAt: String(r.body.expiresAt), interval: Number(r.body.interval) || 2, startedAt: new Date().toISOString() };
+        pollSecret: r.body.pollSecret, expiresAt: String(r.body.expiresAt), interval: Number(r.body.interval) || 2, startedAt: new Date().toISOString(),
+        ...(asked && policy && typeof r.body.hold === "boolean" ? { policy, hold: r.body.hold } : {}) };
     mkdirSync(connectDir(), { recursive: true });
     writeSecretFile(pendingConnectFile(root), JSON.stringify(p) + "\n");
     if (typeof r.body.qr === "string")
@@ -3925,6 +4141,172 @@ function readPendingConnect(root) {
     const p = readJsonQuiet(pendingConnectFile(root));
     return p && p.v === 1 && p.api === API && p.root === root && typeof p.pollSecret === "string" ? p : null;
 }
+async function hookProvision(policy) {
+    const scope = COMPUTER;
+    const UNCONFIRMED = "Decidio couldn't confirm whether this team lets a computer that isn't connected through, so it holds it until it connects.";
+    const holdOf = (p) => !policy ? {} : p && p.policy === policy && typeof p.hold === "boolean" ? { hold: p.hold } : { hold: true, holdWhy: UNCONFIRMED };
+    if (process.env.DECIDIO_AGENT_ID) {
+        const named = printableName(process.env.DECIDIO_AGENT_ID) ?? "(unprintable)";
+        return { ok: false, reason: `this project names the Decidio agent "${named}" (in its .env or the shell) but has no token for it. Ask the user to check it with npx @decidio/sdk doctor, or to remove DECIDIO_AGENT_ID to use this computer's connection.`, user: `Decidio: "${named}" has no token here` };
+    }
+    const own = (SHELL_ENV.DECIDIO_API_URL ?? DEFAULT_API).replace(/\/$/, "");
+    if (API !== own) {
+        const host = printableName(redactUrl(API)) ?? "(unprintable)";
+        return { ok: false, reason: `this project's .env points Decidio at ${host}; the hook won't connect this computer to a server a repository names. If the user trusts it, they run npx @decidio/sdk connect themselves.`, user: `Decidio: not connecting to ${host} (named by this project)` };
+    }
+    try {
+        assertSafeTransport(API, true);
+    }
+    catch (e) {
+        return { ok: false, reason: `${String(e?.message ?? e).replace(/^\[decidio\] /, "")} - the connection's secret would cross in clear.`, user: "Decidio: refusing a plaintext connection" };
+    }
+    const linkWords = (p, fresh) => {
+        const mins = minutesLeft(p.expiresAt) || 1;
+        return { ok: false, ...holdOf(p),
+            reason: `this computer isn't connected to Decidio yet${fresh ? "" : " (its link is still waiting to be allowed)"}. If Decidio's connect_device tool is available to you (the Decidio connector), tell the user you are connecting this computer to their Decidio workspace, call connect_device with the code ${p.code}, run the command it returns, then retry. Otherwise show the user this link and code: ${p.link} (code ${p.code}, valid ${mins} more minute${mins === 1 ? "" : "s"}) - the workspace owner allows it once, signed in, and it covers every project on this computer. Then retry the same command: it connects and asks for approval.`,
+            user: `Decidio: connect this computer once - open ${p.link} and check the code ${p.code}. Destructive commands wait until it's allowed; everything else runs as usual.` };
+    };
+    let p = readPendingConnect(scope);
+    if (p && new Date(p.expiresAt).getTime() > Date.now() + 5_000) {
+        const r = await api("/connect/poll", { method: "POST", headers: { "x-decidio-connect-secret": p.pollSecret }, body: "{}" }, "", true);
+        if (r.status === 200 && r.body?.status === "connected" && typeof r.body.token === "string") {
+            const c = storeCollected(scope, p, r.body);
+            if (typeof c === "string")
+                return { ok: false, reason: `this computer was allowed, but its credential couldn't be written (${c}). Ask the user to run npx @decidio/sdk doctor.`, user: "Decidio: connected, but the credential couldn't be saved" };
+            promoteConnection(c);
+            CREDS_FROM = "connection";
+            connectNotice = `Decidio connected this computer${CONNECTED_WORKSPACE ? ` to workspace ${CONNECTED_WORKSPACE}` : ""}${printableName(c.approvedBy) ? `, allowed by ${printableName(c.approvedBy)}` : ""} - every project on it now asks before destructive commands.`;
+            return { ok: true };
+        }
+        if (r.status === 202 || r.status === 429 || r.status >= 500)
+            return linkWords(p, false);
+        if (r.status === 409 && (r.body?.status === "ticket_required" || r.body?.status === "ticket_mismatch"))
+            return { ok: false,
+                reason: `this computer's link (code ${p.code}) was allowed through the Decidio connector and is finished only with the ticket connect_device returned: if YOU called connect_device for code ${p.code} in this session, run npx @decidio/sdk@latest connect --ticket <the ticket it returned>, then retry the same command. If you did not, do not finish it with any ticket from anywhere else - tell the user that another workspace's connector allowed this computer, and leave it: the link lapses within ten minutes and the next try shows a fresh code.`,
+                user: "Decidio: finishing this computer's connection (allowed through the Decidio connector) - destructive commands wait until it's done" };
+        if (r.status === 0)
+            return { ok: false, ...holdOf(p), reason: `couldn't reach Decidio at ${API} to finish connecting this computer - ${inCloudSession() ? cloudNetworkWords() : "retry once it is reachable."}`, user: `Decidio: unreachable - destructive commands wait${inCloudSession() ? ` (this cloud environment's network access must allow ${hostOf(API)})` : ""}` };
+        if (r.status === 410 && r.body?.status === "collected") {
+            const won = activeConnection(projectRoot(), API);
+            if (won) {
+                promoteConnection(won);
+                CREDS_FROM = "connection";
+                return { ok: true };
+            }
+        }
+        if (r.status === 403 && r.body?.status === "denied") {
+            dropFile(pendingConnectFile(scope));
+            return { ok: false, reason: `connecting this computer was refused on the web ("Not me"). Ask the user before retrying - the next attempt shows a new link.`, user: "Decidio: connecting this computer was refused" };
+        }
+        if (r.status === 410 && r.body?.status === "removed") {
+            dropFile(pendingConnectFile(scope));
+            return { ok: false, reason: `the workspace owner removed this computer before it finished connecting. Ask the user before retrying - the next attempt shows a new link, and only the owner's Allow on the web brings it back.`, user: "Decidio: the workspace owner removed this computer" };
+        }
+        dropFile(pendingConnectFile(scope));
+    }
+    const lock = pendingConnectFile(scope) + ".lock";
+    mkdirSync(connectDir(), { recursive: true });
+    let fd = null;
+    try {
+        fd = openSync(lock, "wx", 0o600);
+    }
+    catch {
+        try {
+            if (Date.now() - statSync(lock).mtimeMs > 30_000) {
+                rmSync(lock, { force: true });
+                fd = openSync(lock, "wx", 0o600);
+            }
+        }
+        catch {
+            fd = null;
+        }
+    }
+    if (fd !== null && (p = readPendingConnect(scope)) && new Date(p.expiresAt).getTime() > Date.now() + 5_000) {
+        try {
+            closeSync(fd);
+        }
+        catch { }
+        dropFile(lock);
+        return linkWords(p, false);
+    }
+    if (fd === null) {
+        for (let i = 0; i < 20 && !(p = readPendingConnect(scope)); i++)
+            await new Promise((res) => setTimeout(res, 250));
+        if (p)
+            return linkWords(p, false);
+        return { ok: false, reason: "another Decidio check on this computer is connecting it right now - retry the same command in a few seconds.", user: "Decidio: connecting this computer" };
+    }
+    try {
+        const started = await startConnect(scope, "claude-code", true, policy);
+        if (!started)
+            return { ok: false, ...(!policy ? {} : connectFailure === "off" ? { hold: false } : { hold: true, holdWhy: UNCONFIRMED }), reason: `this computer isn't connected to Decidio, and a connection couldn't be started: ${connectError}`, user: `Decidio: this computer isn't connected${inCloudSession() && connectError.startsWith("couldn't reach Decidio") ? ` - this cloud environment's network access must allow ${hostOf(API)}` : ""}` };
+        return linkWords(started, true);
+    }
+    finally {
+        try {
+            closeSync(fd);
+        }
+        catch { }
+        dropFile(lock);
+    }
+}
+function toldOnce(session, binding) {
+    if (!session)
+        return "hold";
+    const dir = joinPath(connectDir(), "told");
+    const f = joinPath(dir, createHash("sha256").update(`${API}\n${session}\n${binding}`).digest("hex").slice(0, 40));
+    try {
+        if (existsSync(f))
+            return "passed";
+        mkdirSync(dir, { recursive: true, mode: 0o700 });
+        const week = Date.now() - 7 * 86_400_000;
+        for (const old of readdirSync(dir)) {
+            try {
+                if (statSync(joinPath(dir, old)).mtimeMs < week)
+                    rmSync(joinPath(dir, old), { force: true });
+            }
+            catch { }
+        }
+        writeFileSync(f, "", { mode: 0o600, flag: "wx" });
+        return "noted";
+    }
+    catch {
+        return "hold";
+    }
+}
+async function guardPausedNow(cfg, sessionKey, category) {
+    try {
+        assertSafeTransport(cfg.apiUrl, true);
+        const r = await fetch(cfg.apiUrl.replace(/\/$/, "") + "/agent/guard/check", { method: "POST", headers: { "content-type": "application/json", authorization: `Bearer ${cfg.apiToken}` },
+            body: JSON.stringify({ session: sessionKey, category }), signal: AbortSignal.timeout(10_000) });
+        const body = await r.json().catch(() => null);
+        return r.ok && body?.paused === true ? "paused" : r.ok && body?.paused === false ? "on" : "unknown";
+    }
+    catch {
+        return "unknown";
+    }
+}
+function pauseNote(session) {
+    return joinPath(connectDir(), "paused", createHash("sha256").update(`${API}\n${session}`).digest("hex").slice(0, 40));
+}
+function notePause(session, paused) {
+    const f = pauseNote(session);
+    try {
+        if (!paused)
+            return dropFile(f);
+        const dir = dirname(f);
+        mkdirSync(dir, { recursive: true, mode: 0o700 });
+        for (const old of readdirSync(dir)) {
+            try {
+                if (statSync(joinPath(dir, old)).mtimeMs < Date.now() - GUARD_PAUSE_HOURS * 3_600_000)
+                    rmSync(joinPath(dir, old), { force: true });
+            }
+            catch { }
+        }
+        writeFileSync(f, "", { mode: 0o600 });
+    }
+    catch { }
+}
 function dropFile(f) { try {
     rmSync(f, { force: true });
 }
@@ -3950,6 +4332,14 @@ async function cmdConnect(opts) {
         err(`✘ connect knows Claude Code today (--host claude-code); "${opts.host}" is not supported yet.`);
         return 2;
     }
+    if (opts.ticket !== undefined && (opts.wait || opts.team || opts.force || opts.holdEveryone)) {
+        err("✘ --ticket finishes a link the Decidio connector allowed and takes no other option.");
+        return 2;
+    }
+    if (opts.holdEveryone && !opts.team && !inCloudSession()) {
+        err("✘ --hold-everyone is for the shared file (--team, or a cloud session): it keeps refusing a computer that isn't connected.");
+        return 2;
+    }
     try {
         assertSafeTransport(API, true);
     }
@@ -3958,37 +4348,123 @@ async function cmdConnect(opts) {
         return 1;
     }
     const root = projectRoot();
+    if (opts.ticket !== undefined)
+        return connectWithTicket(root, opts.ticket);
     const tty = !!(process.stdin.isTTY && process.stdout.isTTY);
     if (CREDS_FROM === "shell" || CREDS_FROM === ".env") {
         log(`• this project already has Decidio credentials ${CREDS_FROM === "shell" ? "from your shell" : `in ${ENV_PATH}`} for "${process.env.DECIDIO_AGENT_ID ?? defaultAgentId()}" - the hook uses those, so connect leaves them alone.`);
         log(dim(`  To use a connection instead, remove DECIDIO_API_TOKEN / DECIDIO_AGENT_ID from ${CREDS_FROM === "shell" ? "your shell" : ENV_PATH} and run npx @decidio/sdk connect again.`));
         return finishConnect(root, null, opts, false);
     }
-    const existing = loadConnection(root, API);
+    const existing = activeConnection(root, API);
     if (existing && !opts.force && new Date(existing.expiresAt).getTime() > Date.now())
         return finishConnect(root, existing, opts, false);
+    const scope = connectScope(root);
     if (opts.wait)
-        return waitConnect(root, opts, false);
-    let p = readPendingConnect(root);
+        return waitConnect(root, scope, opts, false);
+    let p = readPendingConnect(scope);
     if (!p || p.host !== host || new Date(p.expiresAt).getTime() <= Date.now() + 15_000)
-        p = await startConnect(root, host);
+        p = await startConnect(scope, host);
     if (!p)
         return 1;
     const opened = !opts.noBrowser && localDesktop() && openInBrowser(p.link);
     showConnectLink(p, opened, tty);
     if (tty) {
         log("");
-        return waitConnect(root, opts, true);
+        return waitConnect(root, scope, opts, true);
     }
     log("");
     log(`Next: allow it at the link above, then run  ${bold("npx @decidio/sdk connect --wait")}  - it finishes by itself (nothing else to type).`);
     log(dim("Assistants: show the person the link and the code above, then run npx @decidio/sdk connect --wait."));
     return 0;
 }
-async function waitConnect(root, opts, interactive) {
-    const p = readPendingConnect(root);
+async function connectWithTicket(root, ticket) {
+    if (!/^[A-Za-z0-9_-]{32,128}$/.test(ticket)) {
+        err("✘ --ticket needs the ticket connect_device returned (letters, digits, - and _).");
+        return 2;
+    }
+    const scope = connectScope(root);
+    const p = readPendingConnect(scope);
+    if (!p || new Date(p.expiresAt).getTime() <= Date.now()) {
+        const c = activeConnection(root, API);
+        if (c) {
+            log(`✔ This computer is already connected to Decidio${printableName(c.workspaceName) ? ` - workspace ${printableName(c.workspaceName)}` : ""}. Retry the command.`);
+            return 0;
+        }
+        err("✘ this computer has no link waiting to be finished - retry the command Decidio refused (it shows a fresh code), then call connect_device with that code.");
+        return 1;
+    }
+    const r = await api("/connect/poll", { method: "POST", headers: { "x-decidio-connect-secret": p.pollSecret, "x-decidio-connect-ticket": ticket }, body: "{}" }, "", true);
+    if (r.status === 200 && r.body?.status === "connected" && typeof r.body.token === "string") {
+        const c = storeCollected(scope, p, r.body);
+        if (typeof c === "string") {
+            err(`✘ connected, but this computer's credential couldn't be written (${c}) - run npx @decidio/sdk doctor.`);
+            return 1;
+        }
+        const ws = printableName(c.workspaceName), approver = printableName(c.approver);
+        log(`✔ Connected this computer to Decidio${ws ? ` - workspace ${ws}` : ""}, through the Decidio connector.`);
+        log(`✔ Retry the command Decidio refused: it now asks ${approver ?? "the approver"} before it runs.`);
+        if (r.body.trust === "unconfirmed")
+            log(dim("  Until the workspace owner confirms this computer is theirs (Decidio sent them a notification), every destructive command it asks about goes to a person."));
+        else if (r.body.trust === "cloud")
+            log(dim("  This cloud machine always asks a person for its destructive commands."));
+        return 0;
+    }
+    if (r.status === 202) {
+        err(`✘ this computer's link (code ${p.code}) hasn't been allowed yet - call connect_device with that code first, then run this again with the ticket it returns.`);
+        return 3;
+    }
+    if (r.status === 409 && r.body?.status === "ticket_mismatch") {
+        err(`✘ that ticket is for another link - call connect_device with this computer's code (${p.code}) and use the ticket it returns.`);
+        return 3;
+    }
+    if (r.status === 403 && r.body?.status === "denied") {
+        dropFile(pendingConnectFile(scope));
+        err("✘ this computer's link was refused on the web (Not me). Nothing was saved.");
+        return 3;
+    }
+    if (r.status === 410 && r.body?.status === "removed") {
+        dropFile(pendingConnectFile(scope));
+        err("✘ the workspace owner removed this computer before it finished connecting. Nothing was saved - ask them before trying again.");
+        return 3;
+    }
+    if ((r.status === 404 || r.status === 410) && (r.body?.status === "expired" || r.body?.status === "collected")) {
+        const won = r.body.status === "collected" ? activeConnection(root, API) : null;
+        if (won) {
+            log("✔ This computer is connected (another run finished it first). Retry the command.");
+            return 0;
+        }
+        dropFile(pendingConnectFile(scope));
+        err("✘ this computer's link expired before it was finished - retry the command Decidio refused for a fresh code, then call connect_device again.");
+        return 3;
+    }
+    if (r.status === 0) {
+        err(`✘ couldn't reach Decidio at ${API} - check the connection and run this again (the ticket stays good for ten minutes).`);
+        return 1;
+    }
+    err(`✘ Decidio answered ${r.status}${r.body?.message ? `: ${String(r.body.message).slice(0, 200)}` : ""}`);
+    return 1;
+}
+function storeCollected(scope, p, body) {
+    const c = { v: 1, api: API, root: scope, project: p.project, host: p.host, machine: p.machine, cloud: p.cloud, agentId: String(body.agentId), did: p.did, key: p.key,
+        token: body.token, jti: String(body.jti), expiresAt: String(body.expiresAt), workspaceId: String(body.workspaceId), workspaceName: body.workspace?.name ?? null,
+        approver: body.approver?.name ?? null, approvedBy: body.approvedBy?.name ?? null, appUrl: typeof body.appUrl === "string" ? body.appUrl : null, connectedAt: new Date().toISOString(),
+        guardPausable: body.guardPausable !== false, ...(body.answered === false ? { answered: false } : {}),
+        ...(typeof body.guardPolicyKey === "string" && GUARD_POLICY_RE.test(body.guardPolicyKey) ? { guardPolicyKey: body.guardPolicyKey } : {}) };
+    mkdirSync(connectDir(), { recursive: true });
+    try {
+        writeSecretFile(connectionFile(scope), JSON.stringify(c) + "\n");
+    }
+    catch (e) {
+        return String(e?.message ?? e);
+    }
+    dropFile(pendingConnectFile(scope));
+    return c;
+}
+async function waitConnect(root, scope, opts, interactive) {
+    const p = readPendingConnect(scope);
     if (!p) {
-        const c = loadConnection(root, API);
+        const c = activeConnection(root, API);
         if (c)
             return finishConnect(root, c, opts, false);
         err("✘ no connection is in progress for this project - start one: npx @decidio/sdk connect");
@@ -4004,29 +4480,41 @@ async function waitConnect(root, opts, interactive) {
         if (r.status === 200 && r.body?.status === "connected" && typeof r.body.token === "string") {
             if (interactive && TTY_OUT)
                 process.stderr.write("\r\x1b[K");
-            const c = { v: 1, api: API, root, project: p.project, host: p.host, machine: p.machine, cloud: p.cloud, agentId: String(r.body.agentId), did: p.did, key: p.key,
-                token: r.body.token, jti: String(r.body.jti), expiresAt: String(r.body.expiresAt), workspaceId: String(r.body.workspaceId), workspaceName: r.body.workspace?.name ?? null,
-                approver: r.body.approver?.name ?? null, approvedBy: r.body.approvedBy?.name ?? null, appUrl: typeof r.body.appUrl === "string" ? r.body.appUrl : null, connectedAt: new Date().toISOString() };
-            mkdirSync(connectDir(), { recursive: true });
-            try {
-                writeSecretFile(connectionFile(root), JSON.stringify(c) + "\n");
-            }
-            catch (e) {
-                err(`✘ connected, but this machine's credentials could not be written (${e?.message ?? e}) - run npx @decidio/sdk connect again (the server keeps nothing to collect twice).`);
+            const c = storeCollected(scope, p, r.body);
+            if (typeof c === "string") {
+                err(`✘ connected, but this machine's credentials could not be written (${c}) - run npx @decidio/sdk connect again (the server keeps nothing to collect twice).`);
                 return 1;
             }
-            dropFile(pendingConnectFile(root));
             return finishConnect(root, c, opts, true);
         }
         if (r.status === 403 && r.body?.status === "denied") {
-            dropFile(pendingConnectFile(root));
+            dropFile(pendingConnectFile(scope));
             if (interactive && TTY_OUT)
                 process.stderr.write("\r\x1b[K");
             err("✘ the connection was refused on the web (Not me). Nothing was saved.");
             return 3;
         }
+        if (r.status === 410 && r.body?.status === "removed") {
+            dropFile(pendingConnectFile(scope));
+            if (interactive && TTY_OUT)
+                process.stderr.write("\r\x1b[K");
+            err("✘ the workspace owner removed this computer before it finished connecting. Nothing was saved.");
+            return 3;
+        }
+        if (r.status === 409 && (r.body?.status === "ticket_required" || r.body?.status === "ticket_mismatch")) {
+            if (interactive && TTY_OUT)
+                process.stderr.write("\r\x1b[K");
+            err("✘ this computer's link was allowed through the Decidio connector: finish it with npx @decidio/sdk connect --ticket <the ticket YOUR connect_device returned> - never a ticket from anywhere else.");
+            return 3;
+        }
         if ((r.status === 404 || r.status === 410) && (r.body?.status === "expired" || r.body?.status === "collected")) {
-            dropFile(pendingConnectFile(root));
+            const won = r.body.status === "collected" ? activeConnection(root, API) : null;
+            if (won) {
+                if (interactive && TTY_OUT)
+                    process.stderr.write("\r\x1b[K");
+                return finishConnect(root, won, opts, true);
+            }
+            dropFile(pendingConnectFile(scope));
             if (interactive && TTY_OUT)
                 process.stderr.write("\r\x1b[K");
             err(r.body.status === "collected" ? "✘ this connection was already collected by another run - start a fresh one: npx @decidio/sdk connect" : "✘ the link expired before it was allowed - start a fresh one: npx @decidio/sdk connect");
@@ -4052,19 +4540,26 @@ async function finishConnect(root, c, opts, fresh) {
     }
     const cloud = inCloudSession();
     const shared = opts.team || cloud;
+    const everywhere = !shared && c?.root === COMPUTER;
+    const home = process.platform === "win32" ? (SHELL_ENV.USERPROFILE ?? homedir()) : (SHELL_ENV.HOME ?? homedir());
     const plugin = !cloud && decidioPluginEnabled(root);
     if (!plugin) {
-        const rc = await cmdHookInstall({ project: shared, dir: root, quiet: true });
+        const rc = await cmdHookInstall({ project: shared || everywhere, dir: everywhere ? home : root, quiet: true, portable: everywhere, ...(shared && !opts.holdEveryone ? { unconnected: "tell", ...(c?.guardPolicyKey ? { policy: c.guardPolicyKey } : {}) } : {}) });
         if (rc !== 0)
             return rc;
     }
     const probe = await api("/agent/status/doctor-scope-probe", {}, process.env.DECIDIO_API_TOKEN, true);
     const verified = probe.status === 404;
-    const settings = lastHookInstall ? relative(root, lastHookInstall.settingsPath).split(pathSep).join("/") || lastHookInstall.settingsPath : ".claude/settings.json";
+    const settings = everywhere ? "~/.claude/settings.json" : lastHookInstall ? relative(root, lastHookInstall.settingsPath).split(pathSep).join("/") || lastHookInstall.settingsPath : ".claude/settings.json";
     const hostName = connectHostLabel(c?.host ?? "claude-code");
+    const approverName = printableName(c?.approver);
     if (c) {
-        log(`✔ ${fresh ? "Connected to Decidio" : "Already connected to Decidio"}${c.workspaceName ? ` - workspace ${c.workspaceName}` : ""}${fresh && c.approvedBy ? `, allowed by ${c.approvedBy}` : ""}`);
-        log(`✔ Approvals go to ${c.approver ?? "the approver you picked"} - on the phone app, Slack, Teams or the web`);
+        const wsName = printableName(c.workspaceName), allowedBy = printableName(c.approvedBy);
+        log(`✔ ${fresh ? "Connected to Decidio" : "Already connected to Decidio"}${wsName ? ` - workspace ${wsName}` : ""}${fresh && allowedBy ? `, allowed by ${allowedBy}` : ""}`);
+        if (c.answered === false)
+            log(`• One question is still open for this computer: "Should another person approve this?" - the workspace owner answers it once on the Decidio Agents page${c.appUrl ? ` (${c.appUrl.replace(/\/+$/, "")}/connect/agents#coding-assistants)` : ""}. Until then its owner can't approve its destructive commands - another approver can, or they wait.`);
+        else
+            log(`✔ Approvals go to ${approverName ?? "its approver"} - on the phone app, Slack, Teams or the web`);
     }
     if (!verified) {
         err(probe.status === 401 || probe.status === 403
@@ -4076,19 +4571,29 @@ async function finishConnect(root, c, opts, fresh) {
     const changed = !plugin && lastHookInstall && (lastHookInstall.pre !== "kept" || lastHookInstall.post !== "kept");
     log(plugin
         ? `✔ ${hostName} asks before destructive commands in this project (the Decidio plugin's hooks)`
-        : `✔ ${hostName} asks before destructive commands in this project (${settings})`);
+        : `✔ ${hostName} asks before destructive commands in ${everywhere ? "every project on this computer" : "this project"} (${settings})`);
+    log(dim(`  What waits for a person's approval: deleting files (rm -rf), force-pushing, dropping tables, terraform and kubectl changes, publishing a package, curl | sh - and switching Decidio's own check off. Everything else runs as before.`));
     if (changed)
         log(dim(`  Claude Code picks the settings change up by itself - if a destructive command is not asked about, open /hooks once (or restart it).`));
     if (c)
-        log(dim(`  Credentials: ${connectionFile(root)} (outside the repository, owner-only) · until ${c.expiresAt.slice(0, 10)}${cloud ? " · this cloud machine only - a fresh one refuses destructive commands until it connects again" : ""}`));
-    if (!plugin && (shared || process.platform === "win32") && !sameDir(realOrSame(process.cwd()), root))
+        log(dim(`  Credentials: ${connectionFile(c.root)} (outside the repository, owner-only) · ${c.root === COMPUTER ? "every project on this computer" : "this project"} · until ${c.expiresAt.slice(0, 10)}${cloud ? ` · this cloud machine only - a fresh one connects again (the Decidio connector does it with no tap)${opts.holdEveryone ? ", and is refused destructive commands until it does" : ""}` : ""}`));
+    if (!plugin && !everywhere && (shared || process.platform === "win32") && !sameDir(realOrSame(process.cwd()), root))
         log(dim(`  Claude Code reads ${settings} from the folder it starts in - start it at ${root}.`));
     if (cloud && !opts.team)
-        log(`• A cloud session reads only the repository's ${settings}, so the hooks are there - not committed. Ask the person before committing it: committed, every cloud session of this repository asks too, and so does every teammate's clone (a teammate connects with npx @decidio/sdk connect).`);
+        log(`• A cloud session reads the repository's settings, not a computer's, so the hooks are in ${settings} - not committed. Ask the person before committing it: committed, every cloud session of this repository asks too, and so does every teammate's clone (a teammate connects with npx @decidio/sdk connect).`);
     else if (shared)
         log(`• Commit ${settings}: every clone then asks before destructive commands (a teammate connects with npx @decidio/sdk connect).`);
-    if (fresh)
-        log(dim(`  Try it: ask ${hostName} to delete a scratch folder with rm -rf - the approval reaches ${c?.approver ?? "the approver"} on their phone.`));
+    const keyed = !!c?.guardPolicyKey && GUARD_POLICY_RE.test(c.guardPolicyKey);
+    if (shared && !plugin)
+        log(dim(opts.holdEveryone
+            ? "  A computer that isn't connected is refused every destructive command until it connects (--hold-everyone)."
+            : `  A computer that isn't connected is told once (with how to connect), then the same command runs without Decidio's approval${keyed ? " - unless the workspace owner holds computers that aren't connected (the Agents page)" : ""}. To keep refusing it until it connects: npx @decidio/sdk connect --team --hold-everyone`));
+    if (shared && !plugin && !opts.holdEveryone && !keyed)
+        log(`⚠ This file's Decidio line carries no team key, so the workspace owner's "Hold computers that aren't connected" won't reach this repository. ${c
+            ? "This computer's connection was made before that switch existed: run npx @decidio/sdk connect --team --force (the workspace owner allows it once more), then commit the file."
+            : "These credentials come from the shell or .env: run npx @decidio/sdk connect --team from a computer connected with npx @decidio/sdk connect, then commit the file."}`);
+    if (fresh && c?.answered !== false)
+        log(dim(`  Try it: ask ${hostName} to delete a scratch folder with rm -rf - the approval reaches ${approverName ?? "the approver"} on their phone.`));
     return 0;
 }
 const DECIDIO_PLUGIN = "decidio-approvals";
@@ -4106,21 +4611,23 @@ function decidioPluginEnabled(root) {
 }
 async function cmdDisconnect() {
     const root = projectRoot();
-    const c = loadConnection(root, API);
-    dropFile(pendingConnectFile(root));
+    const scope = connectScope(root);
+    const c = loadConnection(scope, API);
+    dropFile(pendingConnectFile(scope));
+    const where = scope === COMPUTER ? "this computer" : "this project on this machine";
     if (!c) {
-        log("• this project isn't connected on this machine - nothing to do.");
+        log(`• ${where} isn't connected - nothing to do.`);
         return 0;
     }
     try {
-        writeSecretFile(connectionFile(root), JSON.stringify({ ...c, token: "", jti: "", disconnected: true }) + "\n");
+        writeSecretFile(connectionFile(scope), JSON.stringify({ ...c, token: "", jti: "", disconnected: true }) + "\n");
     }
     catch (e) {
-        err(`✘ couldn't update ${connectionFile(root)} (${e?.message ?? e}) - delete it by hand to disconnect.`);
+        err(`✘ couldn't update ${connectionFile(scope)} (${e?.message ?? e}) - delete it by hand to disconnect.`);
         return 1;
     }
-    log(`✔ disconnected this project on this machine - its token is deleted.`);
-    log(`  Destructive commands are now refused until you connect again (the hooks stay on: switching Decidio off needs a person's approval).`);
+    log(`✔ disconnected ${where} - its token is deleted.`);
+    log(`  Destructive commands are now refused${scope === COMPUTER ? " in every project here" : ""} until you connect again (the hooks stay on: switching Decidio off needs a person's approval).`);
     log(dim(`  "${c.agentId}" stays listed in Decidio until its token expires (${c.expiresAt.slice(0, 10)}); to end it now, revoke it on the Agents page${c.appUrl ? `: ${c.appUrl.replace(/\/+$/, "")}/connect/agents` : ""}.`));
     return 0;
 }
@@ -5403,17 +5910,21 @@ APPROVALS AND RECEIPTS
                                        (never the receipt's own issuer field; --allow-unpinned: structural check only)
 
 CODING AGENTS (Claude Code)
-  npx @decidio/sdk connect             connect this project's coding assistant in one tap: prints a link and a short
-                                       code (a QR and the browser too, on a real terminal); the workspace owner allows
-                                       it on the web, then this machine gets an ask-only credential (kept outside the
-                                       repository) and the hooks below switch on. Your assistant can run it for you.
+  npx @decidio/sdk connect             connect this computer's coding assistant once, for every project on it: prints a
+                                       link and a short code (a QR and the browser too, on a real terminal); the workspace
+                                       owner allows it on the web, then this computer gets an ask-only credential (kept
+                                       outside every repository) and the hooks below switch on in ~/.claude/settings.json.
   npx @decidio/sdk connect --wait      finish a connect started by an assistant: returns once it is allowed, within 90 s
                                        (exit 0 connected · 3 refused or expired · 1 still waiting, run it again)
-                                       --team: the shared .claude/settings.json every clone reads (default: yours
-                                       alone; a cloud session reads only the shared file, so there it is always that
-                                       one) · --no-browser · --force: a fresh token for this machine
-  npx @decidio/sdk disconnect          delete this machine's connection for this project (destructive commands are then
-                                       refused until you connect again; the hooks stay on)
+                                       --team: the shared .claude/settings.json every clone reads (a cloud session reads
+                                       the repository's files, not a computer's, so there it is always the shared one); a
+                                       computer that isn't connected is told once, then let through - --hold-everyone keeps
+                                       refusing it · --no-browser · --force: a fresh token for this computer
+  npx @decidio/sdk connect --ticket <t>
+                                       finish the link the Decidio connector allowed (its connect_device tool returns the
+                                       ticket): writes this computer's credential, nothing else
+  npx @decidio/sdk disconnect          delete this computer's connection (destructive commands are then refused until
+                                       you connect again; the hooks stay on)
   npx @decidio/sdk hook install [--project] [--approver <email>] [--cli <path>]
                                        a person approves Claude Code's destructive shell commands before they run
                                        (rm -rf, git push --force, DROP TABLE, terraform apply, kubectl delete,
@@ -5429,11 +5940,20 @@ CODING AGENTS (Claude Code)
                                        refused: store the user's one-line reason it is different, then retry the same
                                        command - the request reaches the approver with that reason beside the refusal
   npx @decidio/sdk hook rules          the command patterns the hook gates (DECIDIO_HOOK_EXTRA_RULES adds yours)
+  npx @decidio/sdk hook managed-settings  the Decidio hooks for Claude Code's managed settings (an Enterprise admin deploys
+                                       them to every developer's computer) - the JSON on stdout, where it goes and what it
+                                       does and doesn't guarantee on stderr; writes nothing
   npx @decidio/sdk hook pretool|posttool   the hooks themselves: run by Claude Code with the tool call as JSON on
                                        stdin, never by hand. A gated command is held up to DECIDIO_HOOK_HOLD_MS
                                        (90 s; at most 120 s) for the approver, then refused with its decision id; the SAME command
                                        retried after approval runs once - its execution is recorded and that
                                        approval is spent. No credentials, no gate, no answer = refused (fail closed).
+                                       --unconnected=tell (written into a shared file by connect): a computer with no
+                                       credential is refused once per session and command, then let through with a line.
+  npx @decidio/sdk hook prompt         the UserPromptSubmit hook: the person's own typed "decidio pause" / "decidio start"
+                                       pauses or resumes the guard for that session (not where the workspace keeps the
+                                       guard on - Enterprise by default; every pause and every command run under it is
+                                       recorded); other prompts pass untouched.
 
 CONTEXT PACKS (Claude Code, Claude.ai, ChatGPT)
   npx @decidio/sdk context create <slug> --title "ACME application" --trigger "whenever we discuss the ACME application"
@@ -5661,7 +6181,7 @@ async function main(argv) {
         logout: { flags: [] },
         phone: { flags: [] },
         init: { flags: ["--unique", "--force"], valued: ["--expires-days"] },
-        connect: { flags: ["--wait", "--no-browser", "--team", "--force"], valued: ["--host"] },
+        connect: { flags: ["--wait", "--no-browser", "--team", "--force", "--hold-everyone"], valued: ["--host", "--ticket"] },
         disconnect: { flags: [] },
         doctor: { flags: [] },
         approvals: { flags: ["--json", "--mine"], valued: ["--reason"] },
@@ -5669,7 +6189,7 @@ async function main(argv) {
         verify: { flags: ["--allow-unpinned"], valued: ["--issuer"] },
         tokens: { flags: ["--mine"] },
         dev: { flags: [], valued: ["--target", "--port"] },
-        hook: { flags: ["--project"], valued: ["--timeout", "--approver", "--cli"] },
+        hook: { flags: ["--project"], valued: ["--timeout", "--approver", "--cli", "--unconnected", "--policy"] },
         github: { flags: ["--agents-md"], valued: ["--environment", "--justification", "--decision", "--workflow", "--api"] },
         deploys: { flags: ["--watch", "--json"], valued: ["--environment", "--repo", "--limit"] },
         controls: { flags: ["--json"] },
@@ -5870,13 +6390,14 @@ async function main(argv) {
             }
             return cmdContext(sub, pos.slice(1), { title: valuedOpt(argsIn, "--title"), trigger: valuedOpt(argsIn, "--trigger"), team: valuedOpt(argsIn, "--team"), unit: valuedOpt(argsIn, "--unit"), org: argsIn.includes("--org"), here: argsIn.includes("--here"), pack: valuedOpt(argsIn, "--pack"), chatgpt: argsIn.includes("--chatgpt"), json: argsIn.includes("--json") });
         }
-        case "connect": return cmdConnect({ wait: argsIn.includes("--wait"), host: valuedOpt(argsIn, "--host"), noBrowser: argsIn.includes("--no-browser"), team: argsIn.includes("--team"), force: argsIn.includes("--force") });
+        case "connect": return cmdConnect({ wait: argsIn.includes("--wait"), host: valuedOpt(argsIn, "--host"), noBrowser: argsIn.includes("--no-browser"), team: argsIn.includes("--team"), force: argsIn.includes("--force"),
+            ticket: valuedOpt(argsIn, "--ticket"), holdEveryone: argsIn.includes("--hold-everyone") });
         case "disconnect": return cmdDisconnect();
         case "hook": {
-            const VALUED = ["--timeout", "--approver", "--cli"];
+            const VALUED = ["--timeout", "--approver", "--cli", "--unconnected", "--policy"];
             const pos = argsIn.filter((x, i) => !x.startsWith("-") && !VALUED.includes(argsIn[i - 1] ?? ""));
             const sub = pos[0];
-            const allowed = { pretool: [], posttool: [], wait: ["--timeout"], install: ["--project", "--approver", "--cli"], rules: [], justify: [] };
+            const allowed = { pretool: ["--unconnected", "--policy"], posttool: [], session: [], prompt: [], wait: ["--timeout"], install: ["--project", "--approver", "--cli"], rules: [], justify: [], "managed-settings": [] };
             const given = argsIn.filter((x) => x.startsWith("--")).map((x) => x.split("=")[0]);
             if (sub && allowed[sub]) {
                 const stray = given.find((f) => !allowed[sub].includes(f));
@@ -5886,8 +6407,13 @@ async function main(argv) {
                 }
             }
             switch (sub) {
-                case "pretool": return cmdHookPretool();
+                case "pretool": {
+                    const pol = valuedOpt(argsIn, "--policy");
+                    return cmdHookPretool({ unconnected: valuedOpt(argsIn, "--unconnected") === "tell" ? "tell" : "hold", ...(pol && GUARD_POLICY_RE.test(pol) ? { policy: pol } : {}) });
+                }
                 case "posttool": return cmdHookPosttool();
+                case "session": return cmdHookSession();
+                case "prompt": return cmdHookPrompt();
                 case "wait": {
                     const t = valuedOpt(argsIn, "--timeout") ?? "600";
                     if (!/^\d+$/.test(t) || Number(t) < 1 || Number(t) > 86_400) {
@@ -5899,8 +6425,9 @@ async function main(argv) {
                 case "install": return cmdHookInstall({ project: argsIn.includes("--project"), approver: valuedOpt(argsIn, "--approver"), cli: valuedOpt(argsIn, "--cli") });
                 case "rules": return cmdHookRules();
                 case "justify": return cmdHookJustify(pos[1], pos.slice(2).join(" "));
+                case "managed-settings": return cmdHookManagedSettings();
                 default:
-                    err(`✘ hook needs a subcommand: install | wait <decision-id> | justify <decision-id> "<what changed>" | rules (pretool and posttool are run by Claude Code).\n\n${USAGE}`);
+                    err(`✘ hook needs a subcommand: install | wait <decision-id> | justify <decision-id> "<what changed>" | rules | managed-settings (pretool, posttool and session are run by Claude Code).\n\n${USAGE}`);
                     return 2;
             }
         }