@decidio/sdk 0.6.4 → 0.8.0

package/dist/cli.js

@@ -1,9 +1,10 @@
 #!/usr/bin/env node
-import { readFileSync, writeFileSync, existsSync, appendFileSync, chmodSync, rmSync, openSync, writeSync, fsyncSync, closeSync, renameSync, mkdirSync, mkdtempSync, readdirSync, copyFileSync } from "node:fs";
-import { randomBytes } from "node:crypto";
+import { readFileSync, writeFileSync, existsSync, appendFileSync, chmodSync, rmSync, rmdirSync, openSync, writeSync, fsyncSync, closeSync, renameSync, mkdirSync, mkdtempSync, readdirSync, copyFileSync, statSync, lstatSync } from "node:fs";
+import { randomBytes, createHash } from "node:crypto";
 import { homedir, tmpdir } from "node:os";
-import { join as joinPath, resolve as resolvePath, sep as pathSep, basename } from "node:path";
+import { join as joinPath, resolve as resolvePath, sep as pathSep, basename, relative, isAbsolute } from "node:path";
 import { createServer } from "node:http";
+import { isIP } from "node:net";
 import { execFileSync, spawnSync } from "node:child_process";
 import { createInterface } from "node:readline";
 import { pathToFileURL as toFileUrl, fileURLToPath as fromFileUrl } from "node:url";
@@ -11,8 +12,9 @@ import { realpathSync as realPath } from "node:fs";
 import { createRequire } from "node:module";
 import { generateKeypair, assertSafeTransport, redactUrl } from "./signing.js";
 import { hardenFile } from "./resume.js";
-import { withApproval, DecidioRateLimitError, DecidioRejectedError, DecidioTimeoutError, didFromPrivateKey } from "./index.js";
-import { verifyReceipt, runVerify, pinRequiredMessage } from "@decidio/verify";
+import { withApproval, DecidioRateLimitError, DecidioRejectedError, DecidioTimeoutError, DecidioHttpError, didFromPrivateKey, checkApproval, signConfirm, buildConfirmBody, readConfirmResponse, bindingMaterial, boundScope, idempotencyKey, decisionUrl, decisionIdProblem } from "./index.js";
+import { gateAuthorizeTwinAware, adapterRequest } from "./adapters/_gate.js";
+import { verifyReceipt, runVerify, pinRequiredMessage, builtInAnchor, KNOWN_ISSUERS } from "@decidio/verify";
 import { startDemoGate } from "./demo-gate.js";
 const VERSION = (() => {
     try {
@@ -50,6 +52,10 @@ const OFFLINE_CMD = ["verify", "--version", "-v", "-V", "version", undefined].in
     || wantsHelp(ARGV_TAIL[0]) || wantsHelp(ARGV_TAIL[1]) || helpFlagAnywhere(ARGV_TAIL);
 if (!OFFLINE_CMD) {
     readEnvFile();
+    if (envUnreadable && ARGV_TAIL[0] === "hook" && ARGV_TAIL[1] === "pretool") {
+        process.stdout.write(JSON.stringify({ hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "deny", permissionDecisionReason: "Decidio hook: this project's .env exists but could not be read, so the agent's credentials are unknown - refusing this tool call (fail closed). Ask the user to fix the file's permissions." } }) + "\n");
+        process.exit(0);
+    }
     if (envUnreadable) {
         console.error(`✘ .env exists here but could not be read, so this command cannot know what is already configured in this directory.`);
         console.error(`  Treating it as empty would risk overwriting an agent key that cannot be recovered. Fix the file's permissions (or move it aside) and run the command again. Nothing was changed.`);
@@ -63,16 +69,19 @@ if (!OFFLINE_CMD)
             console.error("⚠ ignoring DECIDIO_SESSION_TOKEN found in .env — session tokens belong in your shell or CI secret store, never on disk. Remove that line; export it in the shell instead.");
             continue;
         }
+        if (!k.startsWith("DECIDIO_"))
+            continue;
         if (process.env[k] === undefined)
             process.env[k] = v;
     }
-let API = (process.env.DECIDIO_API_URL ?? "https://decidio-api.onrender.com").replace(/\/$/, "");
+const DEFAULT_API = "https://decidio-api.onrender.com";
+let API = (process.env.DECIDIO_API_URL ?? DEFAULT_API).replace(/\/$/, "");
 let DEMO = false;
 function enterDemo(url) { API = url; process.env.DECIDIO_API_URL = url; DEMO = true; }
 const pinWords = () => (DEMO ? "PINNED to this demo's own key" : "PINNED to your workspace issuer");
 const issuerNote = () => (DEMO
     ? "· a key this demo generated for this run — real tours pin the host's published DID at https://decidio-api.onrender.com/api/did"
-    : `· your trust anchor — first seen over this signed-in connection; cross-check ${API}/api/did, then verify --issuer <did> <receipt.json>`);
+    : `· your trust anchor — named by this server over the signed-in connection, never read from the receipt; cross-check ${API}/api/did`);
 const TOKEN = () => process.env.DECIDIO_API_TOKEN;
 const ENV_PATH = ".env";
 const log = (...a) => console.log(...a);
@@ -509,14 +518,15 @@ if (process.env.DECIDIO_DEBUG_INPUT && process.stdin.isTTY) {
 }
 function terminalId() {
     for (const k of ["WT_SESSION", "VSCODE_IPC_HOOK_CLI", "TERM_SESSION_ID", "ITERM_SESSION_ID", "TMUX_PANE", "KONSOLE_DBUS_SESSION", "GNOME_TERMINAL_SCREEN", "WINDOWID"]) {
-        const v = process.env[k];
+        const v = SHELL_ENV[k];
         if (v)
             return `${k}=${v}`;
     }
     return "";
 }
 function sessionDir() {
-    const base = process.platform === "win32" ? (process.env.LOCALAPPDATA ?? joinPath(homedir(), "AppData", "Local")) : (process.env.XDG_CONFIG_HOME ?? joinPath(homedir(), ".config"));
+    const home = process.platform === "win32" ? (SHELL_ENV.USERPROFILE ?? homedir()) : (SHELL_ENV.HOME ?? homedir());
+    const base = process.platform === "win32" ? (SHELL_ENV.LOCALAPPDATA ?? joinPath(home, "AppData", "Local")) : (SHELL_ENV.XDG_CONFIG_HOME ?? joinPath(home, ".config"));
     return joinPath(base, "decidio");
 }
 const sessionFile = () => joinPath(sessionDir(), "session.json");
@@ -572,6 +582,140 @@ function endSession() {
         return false;
     }
 }
+const issuersFile = () => joinPath(sessionDir(), "issuers.json");
+const DID_KEY_SHAPE = /^did:key:z[1-9A-HJ-NP-Za-km-z]{40,60}$/;
+const STORE_HOST_LABELS = /^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*$/;
+export function issuerStoreKey(url) {
+    const raw = url.trim();
+    const low = raw.replace(/\/+$/, "").toLowerCase();
+    const m = /^([a-zA-Z][a-zA-Z0-9+.-]*):\/\/([^/?#]*)(?:[/?#]|$)/.exec(raw);
+    if (!m)
+        return low;
+    const scheme = m[1].toLowerCase();
+    if (scheme !== "http" && scheme !== "https")
+        return low;
+    let authority = m[2];
+    const at = authority.lastIndexOf("@");
+    if (at >= 0)
+        authority = authority.slice(at + 1);
+    let host, portStr = "";
+    if (authority.startsWith("[")) {
+        const rb = authority.indexOf("]");
+        if (rb < 0)
+            return low;
+        const inner = authority.slice(1, rb).toLowerCase();
+        const rest = authority.slice(rb + 1);
+        if (isIP(inner) !== 6)
+            return low;
+        if (rest !== "") {
+            if (!/^:\d+$/.test(rest))
+                return low;
+            portStr = rest.slice(1);
+        }
+        host = `[${inner}]`;
+    }
+    else {
+        const c = authority.lastIndexOf(":");
+        if (c >= 0) {
+            const p = authority.slice(c + 1);
+            if (!/^\d+$/.test(p))
+                return low;
+            portStr = p;
+            host = authority.slice(0, c).toLowerCase();
+        }
+        else
+            host = authority.toLowerCase();
+        if (!STORE_HOST_LABELS.test(host))
+            return low;
+    }
+    const port = portStr === "" ? null : Number(portStr);
+    const dflt = scheme === "https" ? 443 : 80;
+    return port !== null && port !== dflt ? `${scheme}://${host}:${port}` : `${scheme}://${host}`;
+}
+function readIssuerStore() {
+    const f = issuersFile();
+    if (!existsSync(f))
+        return {};
+    const rawText = readFileSync(f, "utf8");
+    const s = JSON.parse(rawText);
+    const vLiteral = /"v"\s*:\s*(-?\d+(?:\.\d+)?(?:[eE][-+]?\d+)?)/.exec(rawText)?.[1] ?? null;
+    const hosts = s?.v === 1 && vLiteral === "1" && s.hosts && typeof s.hosts === "object" && !Array.isArray(s.hosts) ? s.hosts : null;
+    if (!hosts)
+        throw new Error("not a v1 issuer store");
+    const out = {};
+    for (const [h, e] of Object.entries(hosts)) {
+        if (typeof e?.did !== "string" || !DID_KEY_SHAPE.test(e.did) || typeof e?.firstSeen !== "string")
+            throw new Error(`malformed entry for ${h}`);
+        const k = issuerStoreKey(h);
+        if (out[k] && out[k].did !== e.did)
+            throw new Error(`two entries for ${k} name different DIDs`);
+        out[k] ??= { did: e.did, firstSeen: e.firstSeen };
+    }
+    return out;
+}
+function rememberedIssuer(host = API) { return readIssuerStore()[issuerStoreKey(host)] ?? null; }
+const verifyHost = () => (SHELL_ENV.DECIDIO_API_URL ?? DEFAULT_API).replace(/\/$/, "");
+function warnIssuerChanged(known, seen, via) {
+    const key = issuerStoreKey(API);
+    err(`⚠ THE ISSUER DID OF ${key} HAS CHANGED — it was NOT adopted.`);
+    err(`    remembered (first seen ${known.firstSeen.slice(0, 10)}):  ${known.did}`);
+    err(`    ${via} now says:  ${seen}`);
+    err(`  Receipts from this host are still verified against the REMEMBERED DID. A new DID means a new signing key: a planned`);
+    err(`  rotation, another deployment behind the same address, or someone answering in its place. Confirm it with the host's`);
+    err(`  operator out of band before trusting it; to adopt it, remove the "${key}" entry from ${issuersFile()} and sign in again.`);
+}
+async function rememberHostIssuer() {
+    if (DEMO)
+        return;
+    let store;
+    try {
+        store = readIssuerStore();
+    }
+    catch (e) {
+        err(`⚠ the issuer DIDs this computer remembers (${issuersFile()}) could not be read (${e?.message ?? e}) — left as found, nothing new remembered. Repair the file or move it aside.`);
+        return;
+    }
+    const r = await api("/api/did", {}, "", true);
+    const did = typeof r.body?.did === "string" && DID_KEY_SHAPE.test(r.body.did) ? r.body.did : null;
+    if (!did) {
+        log(dim(`  (${API}/api/did did not answer with a DID (${r.status || "no response"}), so this host's issuer is not remembered yet — verify needs --issuer for its receipts until a later sign-in remembers it)`));
+        return;
+    }
+    const key = issuerStoreKey(API);
+    const known = store[key];
+    if (known?.did === did)
+        return;
+    if (known) {
+        warnIssuerChanged(known, did, `${API}/api/did`);
+        return;
+    }
+    store[key] = { did, firstSeen: new Date().toISOString() };
+    try {
+        mkdirSync(sessionDir(), { recursive: true });
+        writeSecretFile(issuersFile(), JSON.stringify({ v: 1, hosts: store }, null, 2) + "\n");
+    }
+    catch (e) {
+        err(`⚠ could not remember this host's issuer DID (${issuersFile()}: ${e?.message ?? e}) — verify will need --issuer for its receipts.`);
+        return;
+    }
+    log(`  ✔ remembered this host's issuer DID (from ${API}/api/did) — verify pins its receipts to it, no --issuer needed: ${did}`);
+}
+function hostAnchor(body) {
+    const named = typeof body?.expectedIssuer === "string" && DID_KEY_SHAPE.test(body.expectedIssuer) ? body.expectedIssuer : null;
+    if (DEMO)
+        return named;
+    let mem;
+    try {
+        mem = rememberedIssuer();
+    }
+    catch (e) {
+        err(`⚠ the issuer DIDs this computer remembers (${issuersFile()}) could not be read (${e?.message ?? e}) — no trust anchor until it is repaired or moved aside.`);
+        return null;
+    }
+    if (mem && named && mem.did !== named)
+        warnIssuerChanged(mem, named, "this server's verify response");
+    return mem?.did ?? named;
+}
 async function loginFlow(purpose, emailArg) {
     log(purpose === "Signing in" ? `Sign in once — kept on this computer for 30 days, or until this terminal closes, logout, or cleanup.` : `${purpose} needs your Decidio workspace sign-in — once: kept on this computer for 30 days, or until this terminal closes, logout, or cleanup.`);
     const email = emailArg ?? await ask("  email: ");
@@ -585,6 +729,7 @@ async function loginFlow(purpose, emailArg) {
         if (r.status >= 200 && r.status < 300 && r.body?.token) {
             const s = saveSession(String(r.body.token), email);
             log(`  ✔ signed in as ${email} until ${s.expiresAt.slice(0, 10)}${s.terminal ? "" : dim(" (no terminal id here: the sign-in ends on logout or cleanup, not on close)")}`);
+            await rememberHostIssuer();
             return s.token;
         }
         log(`  ✘ password sign-in failed (${r.status})${r.body?.error ? ` — ${r.body.error}` : ""}. No problem — the emailed link works for every account:`);
@@ -610,6 +755,7 @@ async function loginFlow(purpose, emailArg) {
         if (r.status >= 200 && r.status < 300 && r.body?.token) {
             const s = saveSession(String(r.body.token), email);
             log(`  ✔ signed in as ${email} until ${s.expiresAt.slice(0, 10)}${s.terminal ? "" : dim(" (no terminal id here: the sign-in ends on logout or cleanup, not on close)")}`);
+            await rememberHostIssuer();
             return s.token;
         }
         if (isLink) {
@@ -772,7 +918,9 @@ async function cmdInit(agentId, opts = {}) {
         return 1;
     }
     const { did: localDid, privateKeyBase64: localKey } = generateKeypair();
-    const registerBody = JSON.stringify({ agentId, did: localDid, ...(sourceSystem ? { sourceSystem } : {}) });
+    const soxEnv = (process.env.DECIDIO_SOX_RELEVANT ?? "").trim().toLowerCase();
+    const soxRelevant = soxEnv === "yes" || soxEnv === "true" ? true : soxEnv === "no" || soxEnv === "false" ? false : undefined;
+    const registerBody = JSON.stringify({ agentId, did: localDid, ...(sourceSystem ? { sourceSystem } : {}), ...(soxRelevant !== undefined ? { soxRelevant } : {}) });
     let envPrepared = false;
     const prepareEnvForWrite = () => {
         if (envPrepared)
@@ -818,6 +966,12 @@ async function cmdInit(agentId, opts = {}) {
         prepareEnvForWrite();
         upsertEnv({ DECIDIO_AGENT_ID: agentId, DECIDIO_AGENT_DID: did ?? localDid, DECIDIO_AGENT_KEY: localKey });
     }
+    else if (r.status === 400 && r.body?.code === "OWNER_REQUIRED") {
+        err(`✘ ${r.body?.message ?? "an agent needs a human owner"}`);
+        err(`  Sign in as a person so you own it: unset DECIDIO_API_TOKEN (the operator token names no one) and re-run init — it asks you to sign in.`);
+        err(`  Or have a workspace owner register it with an ownerUserId (POST /api/agents/register) or set one under Connect > Agents.`);
+        return 1;
+    }
     else {
         err(`✘ registration failed (${r.status}): ${JSON.stringify(r.body)}`);
         err(`  Fix the cause above and re-run — init is safe to repeat.`);
@@ -897,6 +1051,7 @@ async function cmdInit(agentId, opts = {}) {
     log(`✔ wrote ${ENV_PATH} (owner-only where the OS supports it) — every decidio command reads it from this directory (your script loads it with node --env-file=.env)`);
     if (privateKey)
         log(`  (the agent's private signing key is in there — for production, move it to your secret manager)`);
+    await rememberHostIssuer();
     log("");
     log("Next: protect one function and watch it route. Two steps:");
     log("");
@@ -1151,19 +1306,42 @@ async function cmdReceipt(id, jsonMode = false) {
     }
     const name = receiptFileName(id);
     const nextBytes = JSON.stringify(r.body.credential, null, 2) + "\n";
-    const wrote = writeReceiptFile(name, nextBytes, jsonMode ? err : log);
+    const issuer = hostAnchor(r.body);
+    const local = issuer ? verifyReceipt(r.body.credential, issuer) : null;
+    const serverInvalid = r.body?.valid === false;
+    const localInvalid = !!local && !local.valid;
+    const bad = serverInvalid || localInvalid;
+    const say = jsonMode ? err : log;
+    const wrote = writeReceiptFile(name, nextBytes, say);
     if (wrote === "conflict")
         return 1;
     if (wrote === "written")
-        (jsonMode ? err : log)(`✔ wrote ${name} (downloaded from your workspace — the download is online; VERIFYING it is offline)`);
+        say(bad ? `• wrote ${name} — kept for inspection only: it does NOT verify (below)` : `✔ wrote ${name} (downloaded from your workspace — the download is online; VERIFYING it is offline)`);
     const detail = await api(`/api/records/${encodeURIComponent(id)}`, {}, bearer);
     const conf = detail.body?.record?.confirmation;
-    const issuer = r.body?.issuer;
     const resolved = r.body?.resolved;
+    const badSaid = () => {
+        if (serverInvalid) {
+            err(`✘ the server's own check says this record does NOT verify: ${r.body?.reason ?? "no reason given"}`);
+            err(`  (signature ${r.body?.signatureValid === false ? "INVALID" : "valid"} · content bound ${r.body?.contentBound === false ? "NO" : "yes"} · matches the stored record ${r.body?.matchesRecord === false ? "NO" : "yes"} · stored payload ${r.body?.payloadMatches === false ? "ALTERED" : "intact"})`);
+        }
+        if (localInvalid)
+            err(`✘ this receipt does NOT verify against this Decidio's issuer DID (${issuer}): ${local.reason ?? "no reason given"}`);
+        err(`  Do not rely on ${name}. Report it to the operator of ${API} — a sealed record is immutable, so this is tampering, a defect, or an unannounced key change (see any warning above), never a normal state.`);
+    };
     if (jsonMode) {
-        log(JSON.stringify({ file: name, decisionId: id, evidenceTier: conf?.status ?? null, confirmed: !!conf?.confirmed, issuer: issuer ?? null, ...(resolved ? { resolved } : {}) }, null, 2));
+        const valid = bad ? false : local?.valid === true ? true : null;
+        log(JSON.stringify({ file: name, decisionId: id, evidenceTier: conf?.status ?? null, confirmed: !!conf?.confirmed, issuer: issuer ?? null, valid, ...(bad ? { reason: serverInvalid ? r.body?.reason ?? null : local?.reason ?? null } : {}), ...(resolved ? { resolved } : {}) }, null, 2));
+        if (bad) {
+            badSaid();
+            return 1;
+        }
         return 0;
     }
+    if (bad) {
+        badSaid();
+        return 1;
+    }
     if (conf?.status)
         log(`  Sealed credential: the authority decision (its confirmation field reads "pending" forever — immutable). Current record evidence tier: ${conf.status}${conf.confirmed ? " (confirmed)" : ""}.`);
     if (resolved && Object.keys(resolved).length && !process.stdout.isTTY) {
@@ -1176,19 +1354,37 @@ async function cmdReceipt(id, jsonMode = false) {
     }
     log(`  Verify it offline — no Decidio account or network needed (the verifier is built in):`);
     if (issuer) {
-        log(`  Record your workspace's issuer DID — copy this line, and pin it forever:`);
+        const vHost = verifyHost();
+        let plain = false, via = "";
+        try {
+            const mem = rememberedIssuer(vHost);
+            const claimed = String(r.body.credential?.issuer ?? "");
+            plain = (mem ? mem.did : KNOWN_ISSUERS.find((k) => k.did === claimed)?.did) === issuer;
+            via = mem ? "remembered on this computer" : "built into the verifier";
+        }
+        catch {
+            plain = false;
+        }
+        if (plain) {
+            log(`    npx @decidio/sdk verify ${name}`);
+            log(`  No --issuer needed here: it pins to this Decidio's issuer (${via}), which the server also named:`);
+        }
+        else {
+            log(`  Record your workspace's issuer DID — copy this line, and pin it forever:`);
+        }
         log(``);
         log(`${issuer}`);
         log(``);
         log(`  Cross-check it out of band — the same DID is published by this Decidio host at ${API}/api/did (public, no sign-in).`);
-        log(`  Then verify, pinned to it (the same DID, inline — copy from the line above, not this one,`);
-        log(`  which your terminal may wrap):`);
+        log(plain ? `  Anywhere else, pin it explicitly (copy the DID from the line above — this one may wrap):` : `  Then verify, pinned to it (the same DID, inline — copy from the line above, not this one, which your terminal may wrap):`);
         log(`    npx @decidio/sdk verify --issuer ${issuer} ${name}`);
-        log(`  The verifier refuses to run without --issuer: a pin is what makes VALID mean "issued by your`);
-        log(`  workspace"; --allow-unpinned runs a structural check only, and says so.`);
+        if (!plain && issuerStoreKey(vHost) !== issuerStoreKey(API))
+            log(`  (verify reads no .env, so a flagless run pins to the DID for ${vHost}, not ${API} - export DECIDIO_API_URL=${API} in your shell to verify this host's receipts without --issuer.)`);
+        else if (!plain)
+            log(`  Or sign in once (npx @decidio/sdk login): this computer then remembers the DID, and verify needs no --issuer.`);
     }
     else {
-        log(`  To also prove WHO issued it, pin your workspace's issuer DID (shown in your app's record verify panel):`);
+        log(`  To also prove WHO issued it, pin your Decidio's issuer DID — published at ${API}/api/did (public, no sign-in), never read off the receipt:`);
         log(`    npx @decidio/sdk verify --issuer <did:key:...> ${name}`);
     }
     return 0;
@@ -1237,7 +1433,7 @@ function cmdVerify(argsIn) {
         }
     }
     if (!files.length) {
-        err("usage: npx @decidio/sdk verify --issuer <did:key> <receipt.json> [more.json ...]   (or --allow-unpinned)");
+        err("usage: npx @decidio/sdk verify [--issuer <did:key>] <receipt.json> [more.json ...]   (or --allow-unpinned)");
         err("  Verifies Authority Receipts OFFLINE — signature, content binding, and (for several files) chain order.");
         return 2;
     }
@@ -1245,10 +1441,6 @@ function cmdVerify(argsIn) {
         err("✘ --allow-unpinned and --issuer together — an unpinned check and a pinned one are different questions; ask one.");
         return 2;
     }
-    if (expectedIssuer === undefined && !allowUnpinned) {
-        err(pinRequiredMessage("npx @decidio/sdk verify"));
-        return 2;
-    }
     const texts = new Map();
     for (const f of files) {
         try {
@@ -1259,7 +1451,34 @@ function cmdVerify(argsIn) {
             return 1;
         }
     }
-    const { ok, lines } = runVerify(files, expectedIssuer, (f) => texts.get(f));
+    const read = (f) => texts.get(f);
+    let anchor = expectedIssuer !== undefined ? "--issuer" : undefined;
+    if (expectedIssuer === undefined && !allowUnpinned) {
+        let mem;
+        try {
+            mem = rememberedIssuer(verifyHost());
+        }
+        catch (e) {
+            err(`✘ the issuer DIDs this computer remembers (${issuersFile()}) could not be read (${e?.message ?? e}) — refusing to fall back to another trust anchor.`);
+            err(`  Pass --issuer <did:key> for this run, or repair the file (or move it aside and sign in again). Nothing was verified.`);
+            return 2;
+        }
+        if (mem) {
+            expectedIssuer = mem.did;
+            anchor = `remembered for ${issuerStoreKey(verifyHost())} since ${mem.firstSeen.slice(0, 10)}`;
+        }
+        else {
+            const pick = builtInAnchor(files, read);
+            if ("refusal" in pick) {
+                err(pinRequiredMessage("npx @decidio/sdk verify", pick.refusal));
+                err(`  Nothing is remembered for ${issuerStoreKey(verifyHost())} on this computer: signing in once (npx @decidio/sdk login) remembers its DID, and then no --issuer is needed.`);
+                return 2;
+            }
+            expectedIssuer = pick.anchor.did;
+            anchor = `built in: ${pick.anchor.label}, ${pick.anchor.host}`;
+        }
+    }
+    const { ok, lines } = runVerify(files, expectedIssuer, read, anchor);
     for (const l of lines)
         log(l);
     return ok ? 0 : 1;
@@ -1705,12 +1924,13 @@ async function cmdQuickstartInner(opts = {}) {
                 const wrote = writeReceiptFile(fname, JSON.stringify(rec.body.credential, null, 2) + "\n");
                 if (wrote === "conflict")
                     return failTour(1);
-                const issuer = rec.body?.issuer;
+                const issuer = hostAnchor(rec.body) ?? undefined;
                 const v = verifyReceipt(rec.body.credential, issuer);
-                const kindLine = `${v.valid ? "✔ VALID" : "✘ INVALID"} — ${fname} (signature + content binding, offline${issuer ? ", " + pinWords() : ""}) · record kind: ${recordKindOf(rec.body.credential) ?? "?"}`;
-                if (!v.valid || !issuer) {
+                const serverInvalid = rec.body?.valid === false;
+                const kindLine = `${v.valid && !serverInvalid ? "✔ VALID" : "✘ INVALID"} — ${fname} (signature + content binding, offline${issuer ? ", " + pinWords() : ""}) · record kind: ${recordKindOf(rec.body.credential) ?? "?"}`;
+                if (!v.valid || !issuer || serverInvalid) {
                     log(`  ${kindLine}`);
-                    err(`  ✘ the denial's receipt did not verify PINNED (${!issuer ? "no issuer DID from the server" : v.reason ?? "no reason given"}) — the tour did not complete.`);
+                    err(`  ✘ the denial's receipt did not verify PINNED (${!issuer ? "no trust anchor: the server named no issuer and none is remembered for this host" : !v.valid ? v.reason ?? "no reason given" : `the server's own check says it does NOT verify: ${rec.body?.reason ?? "no reason given"}`}) — the tour did not complete.`);
                     return failTour(1);
                 }
                 block("④", "The record", [
@@ -1780,19 +2000,24 @@ async function cmdQuickstartInner(opts = {}) {
         const fname = receiptFileName(decisionId);
         if (writeReceiptFile(fname, JSON.stringify(rec.body.credential, null, 2) + "\n") === "conflict")
             return failTour(1);
-        const issuer = rec.body?.issuer;
+        const issuer = hostAnchor(rec.body) ?? undefined;
         const v = verifyReceipt(rec.body.credential, issuer);
-        const kindLine = `${v.valid ? "✔ VALID" : "✘ INVALID"} — ${fname} (signature + content binding, offline${issuer ? ", " + pinWords() : ""}) · record kind: ${recordKindOf(rec.body.credential) ?? "?"}`;
-        if (!v.valid || !issuer)
+        const serverInvalid = rec.body?.valid === false;
+        const kindLine = `${v.valid && !serverInvalid ? "✔ VALID" : "✘ INVALID"} — ${fname} (signature + content binding, offline${issuer ? ", " + pinWords() : ""}) · record kind: ${recordKindOf(rec.body.credential) ?? "?"}`;
+        if (!v.valid || !issuer || serverInvalid)
             log(`  ${kindLine}`);
         if (!v.valid) {
             err(`  ✘ the receipt did not verify (${v.reason ?? "no reason given"}) — the tour did not complete.`);
             return failTour(1);
         }
+        if (serverInvalid) {
+            err(`  ✘ the server's own check says this record does NOT verify (${rec.body?.reason ?? "no reason given"}) — the tour did not complete.`);
+            return failTour(1);
+        }
         if (!issuer) {
-            err(`  ⚠ the server did not return an issuer DID, so this check ran UNPINNED — it proves the`);
-            err(`    receipt is internally consistent, NOT who issued it (a self-signed forgery also passes).`);
-            err(`    Get your workspace's issuer DID from the app's record-verify panel, then re-check:`);
+            err(`  ⚠ the server named no issuer (expectedIssuer) and no DID is remembered for this host, so this check ran UNPINNED —`);
+            err(`    it proves the receipt is internally consistent, NOT who issued it (a self-signed forgery also passes).`);
+            err(`    Take your Decidio's issuer DID from ${API}/api/did (public, no sign-in) — never from the receipt — then re-check:`);
             err(`      npx @decidio/sdk verify --issuer <did:key:...> ${fname}`);
             err(`  ✘ the tour does not count an UNPINNED check as success.`);
             return failTour(1);
@@ -2132,174 +2357,1763 @@ function cmdDev(target, port) {
     }).listen(port, "127.0.0.1");
     return 0;
 }
-const USAGE = `✦ Decidio — the SDK command line
-
-  The wrapper IS the SDK: guard.protect(fn, describe) ships in this package (import { guard } from "@decidio/sdk").
-  This command line is the tour, the sign-in, and the token admin around it.
-
-  New here? See the whole thing work in about two minutes:
-
-      npx @decidio/sdk quickstart
-
-  With no sign-in on this computer it first asks ONE question - do you have an invite? - and, if you do,
-  what next: the tour, or wiring up your own agent. Every answer shows the command it stands for. The bare
-  npx @decidio/sdk on a terminal asks the same (skipping the invite question when you are signed in).
-
-  It gates a demo action, routes it to YOU for approval, executes on your yes, and hands you a
-  cryptographically verifiable receipt of the DECISION (execution evidence then accrues on the
-  hosted record — the receipt seals who authorized what, not what ran afterward). Guided and
-  explicit — this CLI never acts, signs you in, or writes files unless you ask it to.
-
-THE TOUR
-  npx @decidio/sdk quickstart          the guided two-minute tour: gate → approve → execute → proof
-                                       (interactive: y approves, n rejects - Enter is not an answer. Headless it stops
-                                       at the routed decision; --auto-approve-demo for CI, labeled
-                                       automated; ends with a keep-or-cleanup choice; --explain prints
-                                       the long narration of each step; --phone web makes the QR open
-                                       the phone web rendering even when the Decidio app is installed)
-  npx @decidio/sdk quickstart cleanup  revoke the tour's token + delete its local credentials (the inert
-                                       registration row and the permanent sealed record stay)
-                                       (and end the stored sign-in)
-  npx @decidio/sdk quickstart --auto-approve-demo   headless tour; cleans up after itself
-  npx @decidio/sdk quickstart --demo   the same tour against a LOCAL stand-in of the API — no account needed; the
-                                       web/phone door is a hosted demo page; the receipt is the one thing kept
-                                       (--keep-agent is refused here: nothing of the demo's can be kept)
-
-SIGN IN (once)
-  npx @decidio/sdk login [email]       sign in ONCE: the CLI emails you an 8-character code, you type it; the sign-in
-                                       is kept on this computer 30 days, or until this terminal closes, logout, or cleanup
-  npx @decidio/sdk logout              forget the stored sign-in on this computer (the token itself stays valid
-                                       until it expires — there is no server-side revocation yet)
-
-YOUR AGENT AND ITS TOKENS
-  npx @decidio/sdk init [agentId]      sign in, register the agent, mint its API token, write .env
-                                       (agentId defaults to this folder's name; any name works - it is how the
-                                       workspace shows the request and the key .env is written under)
-                                       --unique  append a random suffix (collision-proof samples)
-                                       --force   replace a different agent already in this .env
-                                                 (its .env is backed up first)
-                                       --expires-days N   agent-token lifetime (default 90)
-  npx @decidio/sdk doctor              check config, connectivity, and what your token can do
-  npx @decidio/sdk tokens list [--mine]   agent tokens with status (active/expired/REVOKED) by
-                                       jti — token values are never re-shown; the list is
-                                       workspace-wide, --mine narrows to this directory's agent
-  npx @decidio/sdk tokens revoke <jti> kill a token now instead of waiting out its lifetime
-
-APPROVALS AND RECEIPTS
-  npx @decidio/sdk approvals [--json] [--mine]   list pending agent approvals
-  npx @decidio/sdk approvals approve <id> [reason]
-  npx @decidio/sdk approvals reject <id> [reason]
-                                       the reason is FREE TEXT, sent exactly as typed. It seals
-                                       immutably; personal or sensitive values are tokenized at
-                                       rest, so the STORED text can differ (see: receipt <id>).
-                                       If it starts with a dash, put it after -- or use --reason:
-                                         ... approve <id> -- "-50% cut, per the board"
-                                         ... approve <id> --reason "-50% cut, per the board"
-  npx @decidio/sdk receipt <id> [--json]   download a sealed decision's Authority Receipt to a .json FILE; --json prints
-                                       a summary to stdout (file name, evidence, issuer, the identities you may see) -
-                                       the credential itself is the file
-  npx @decidio/sdk verify --issuer <did> <receipt.json> [more...]   verify receipts OFFLINE, pinned to your
-                                       workspace's issuer (--allow-unpinned: structural check only)
-
-DEVELOPMENT
-  npx @decidio/sdk dev [--target URL] [--port N]   local relay for the resume webhook
-  npx @decidio/sdk --version           print the CLI version
-
-NOTES
-  Every NETWORK command talks to the hosted sandbox (https://decidio-api.onrender.com) unless
-  DECIDIO_API_URL says otherwise; the target host is announced on stderr each run. "verify" is
-  fully offline — it touches no network and reads no .env.
-  Update check: network commands (and the bare command on a terminal) ask the public npm registry once a day
-  whether a newer version exists. If so,
-  an interactive run asks "Upgrade now? [y/n]" first (y upgrades the way you installed - global, or in the
-  project for a local install; under npx it prints the @latest form - and re-runs your command; n exits); a headless
-  run prints the notice and continues (DECIDIO_REQUIRE_LATEST=1 makes it exit). DECIDIO_NO_UPDATE_CHECK=1 skips
-  the check. Nothing is sent to Decidio; verify never checks.
-  Help: --help (or -h) after any command prints this page - one page for every command.
-  Exit codes: 0 success · 1 failure or honest no-op (e.g. replay refused) · 2 usage error ·
-  3 quickstart stopped at the human moment (headless: routed, but nothing executed and no
-  receipt written — pass --auto-approve-demo for a run that completes unattended).
-  Errors, and usage shown on ERROR paths, go to stderr; stdout carries results only (safe to
-  pipe). Asked-for help — including this bare invocation — IS a result, so it prints here.
-  Docs: the README that shipped with this package — node_modules/@decidio/sdk/README.md
-  (quickstart, durable resume, workers, adapters).`;
-const GATED_CMDS = new Set(["quickstart", "init", "login", "doctor", "approvals", "receipt", "tokens"]);
-function semverNewer(a, b) {
-    const pa = a.split(".").map((x) => parseInt(x, 10)), pb = b.split(".").map((x) => parseInt(x, 10));
-    if (pa.length < 3 || pb.length < 3 || pa.some((x) => Number.isNaN(x)) || pb.some((x) => Number.isNaN(x)))
-        return false;
-    for (let i = 0; i < 3; i++)
-        if (pa[i] !== pb[i])
-            return pa[i] > pb[i];
-    return false;
+const HOOK_HOLD_CAP_MS = 120_000;
+function hookSegments(command) {
+    const WRAPPERS = new Set(["sudo", "doas", "env", "nohup", "time", "command", "exec", "builtin", "xargs", "nice", "ionice", "timeout", "stdbuf", "caffeinate"]);
+    return command.split(/\s*(?:\|\||&&|\||;|\r?\n)\s*/).map((raw) => raw.trim()).filter(Boolean).map((raw) => {
+        const tokens = raw.split(/\s+/).filter(Boolean);
+        while (tokens.length && (/^[A-Za-z_][A-Za-z0-9_]*=/.test(tokens[0]) || WRAPPERS.has(tokens[0].toLowerCase()))) {
+            const w = tokens.shift().toLowerCase();
+            if (w === "timeout" && tokens.length && /^\d/.test(tokens[0]))
+                tokens.shift();
+            if (WRAPPERS.has(w))
+                while (tokens.length && tokens[0].startsWith("-"))
+                    tokens.shift();
+        }
+        const program = basename((tokens[0] ?? "").replace(/^["']|["']$/g, "")).toLowerCase();
+        return { program, args: tokens.slice(1), raw };
+    });
 }
-async function latestPublished() {
-    const cache = joinPath(sessionDir(), "update-check.json");
+const hookFlag = (args, letters, longs = []) => args.some((a) => (/^-[A-Za-z]+$/.test(a) && [...letters].some((l) => a.slice(1).includes(l))) || longs.includes(a));
+const hookSub = (s, i = 0) => (s.args.filter((a) => !a.startsWith("-"))[i] ?? "").toLowerCase();
+const HOOK_DB_CLIENTS = ["psql", "pgcli", "mysql", "mysqlsh", "mycli", "mariadb", "sqlite3", "sqlite", "litecli", "mongosh", "mongo", "redis-cli", "clickhouse-client", "clickhouse", "sqlcmd", "bq", "duckdb", "cqlsh", "snowsql", "usql", "dbmate", "goose", "flyway", "liquibase", "atlas", "alembic", "knex", "sequelize", "typeorm", "drizzle-kit", "supabase", "wrangler", "turso", "pscale"];
+const HOOK_RULES = [
+    { category: "delete-recursive", summary: "rm -r/-rf, find -delete / -exec rm, rmdir|rd|del /s, Remove-Item -Recurse, shred",
+        matches: (segs) => segs.some((s) => (s.program === "rm" && hookFlag(s.args, "rR", ["--recursive"]))
+            || (s.program === "find" && (s.args.includes("-delete") || s.args.some((a, i) => i > 0 && s.args[i - 1] === "-exec" && basename(a) === "rm")))
+            || ((s.program === "rmdir" || s.program === "rd" || s.program === "del") && s.args.some((a) => /^\/s$/i.test(a)))
+            || (s.program === "remove-item" && s.args.some((a) => /^-recurse$/i.test(a)))
+            || s.program === "shred") },
+    { category: "git-rewrite", summary: "git push --force|-f|+ref|:ref|--delete|--mirror|--prune, reset --hard, branch -D, clean -f|-x, stash drop|clear, filter-branch|filter-repo, update-ref -d, reflog expire, gc --prune",
+        matches: (segs) => segs.some((s) => s.program === "git" && ((hookSub(s) === "push" && (hookFlag(s.args, "fd", ["--force", "--force-with-lease", "--force-if-includes", "--delete", "--mirror", "--prune"]) || s.args.some((a) => /^\+\S/.test(a) || /^:\S/.test(a) || /^\S+:\s*$/.test(a))))
+            || (hookSub(s) === "reset" && s.args.includes("--hard"))
+            || (hookSub(s) === "branch" && (s.args.some((a) => /^-[a-zA-Z]*D/.test(a)) || (s.args.includes("--delete") && s.args.includes("--force"))))
+            || (hookSub(s) === "clean" && hookFlag(s.args, "fxX", ["--force"]))
+            || (hookSub(s) === "stash" && ["drop", "clear"].includes(hookSub(s, 1)))
+            || ["filter-branch", "filter-repo"].includes(hookSub(s))
+            || (hookSub(s) === "update-ref" && s.args.includes("-d"))
+            || (hookSub(s) === "reflog" && hookSub(s, 1) === "expire")
+            || (hookSub(s) === "gc" && s.args.some((a) => a.startsWith("--prune"))))) },
+    { category: "sql-destructive", summary: "DROP TABLE|DATABASE|SCHEMA|INDEX|VIEW|USER|ROLE, TRUNCATE, DELETE FROM - sent to a database client (psql, mysql, sqlite3, mongosh, sqlcmd, bq, ...); prisma migrate reset / db push --force-reset; rails db:drop|db:reset",
+        matches: (segs, cmd) => {
+            const toDb = segs.some((s) => HOOK_DB_CLIENTS.includes(s.program) || /\bprisma\b/.test(s.raw) || /\.sql\b/.test(s.raw));
+            return (toDb && (/\bDROP\s+(TABLE|DATABASE|SCHEMA|INDEX|VIEW|USER|ROLE|EXTENSION)\b/i.test(cmd) || /\bTRUNCATE\s+(TABLE\s+)?\S/i.test(cmd) || /\bDELETE\s+FROM\s+\S/i.test(cmd)))
+                || segs.some((s) => (/\bprisma\b/.test(s.raw) && (/\bmigrate\s+reset\b/.test(s.raw) || /--force-reset\b/.test(s.raw)))
+                    || (["rails", "rake"].includes(s.program) && /\bdb:(drop|reset|schema:load)\b/.test(s.raw)));
+        } },
+    { category: "infra-apply", summary: "terraform|tofu apply|destroy, pulumi up|destroy, cdk deploy|destroy, sam|serverless deploy|remove, kubectl delete|drain|replace|apply --prune, helm uninstall|rollback, aws|gcloud|az|doctl|fly|heroku|vercel … delete|terminate|destroy|purge|remove|rm|rb",
+        matches: (segs) => segs.some((s) => (["terraform", "tofu"].includes(s.program) && ["apply", "destroy"].includes(hookSub(s)))
+            || (s.program === "pulumi" && ["up", "destroy"].includes(hookSub(s)))
+            || (s.program === "cdk" && ["deploy", "destroy"].includes(hookSub(s)))
+            || (s.program === "sam" && ["deploy", "delete"].includes(hookSub(s)))
+            || (["serverless", "sls"].includes(s.program) && ["deploy", "remove"].includes(hookSub(s)))
+            || (s.program === "kubectl" && (["delete", "drain", "replace"].includes(hookSub(s)) || (hookSub(s) === "apply" && s.args.includes("--prune"))))
+            || (s.program === "helm" && ["uninstall", "delete", "rollback"].includes(hookSub(s)))
+            || (["aws", "gcloud", "az", "doctl", "fly", "flyctl", "heroku", "vercel", "oci", "ibmcloud"].includes(s.program)
+                && s.args.some((a) => /^(delete|terminate|destroy|purge|remove|deregister|rm|rb|apps:destroy|pg:reset)(-[a-z-]+)?$/i.test(a)))) },
+    { category: "containers", summary: "docker|podman rm|rmi|kill, system|volume|image|container|network prune|rm, compose down -v|--volumes|--rmi",
+        matches: (segs) => segs.some((s) => {
+            const compose = (s.program === "docker-compose" && hookSub(s) === "down") || (["docker", "podman"].includes(s.program) && hookSub(s) === "compose" && hookSub(s, 1) === "down");
+            return (["docker", "podman", "nerdctl"].includes(s.program) && (["rm", "rmi", "kill"].includes(hookSub(s))
+                || (["system", "volume", "image", "container", "network", "builder"].includes(hookSub(s)) && ["prune", "rm"].includes(hookSub(s, 1)))))
+                || (compose && (hookFlag(s.args, "v", ["--volumes"]) || s.args.some((a) => a.startsWith("--rmi"))));
+        }) },
+    { category: "publish", summary: "npm|pnpm|yarn|bun publish|unpublish|deprecate|dist-tag|owner, cargo publish|yank, gem push|yank, twine upload, poetry publish, dotnet|nuget push|delete, mvn|gradle deploy|publish, docker push, gh release create|delete|upload, gh repo delete|archive, gh api -X DELETE|PUT|PATCH",
+        matches: (segs) => segs.some((s) => (["npm", "pnpm", "yarn", "bun"].includes(s.program) && ["publish", "unpublish", "deprecate", "dist-tag", "owner"].includes(hookSub(s)))
+            || (s.program === "cargo" && ["publish", "yank"].includes(hookSub(s)))
+            || (s.program === "gem" && ["push", "yank"].includes(hookSub(s)))
+            || (s.program === "twine" && hookSub(s) === "upload") || (/^python[0-9.]*$/.test(s.program) && s.args[0] === "-m" && s.args[1] === "twine")
+            || (s.program === "poetry" && hookSub(s) === "publish")
+            || (s.program === "dotnet" && hookSub(s) === "nuget" && ["push", "delete"].includes(hookSub(s, 1))) || (s.program === "nuget" && ["push", "delete"].includes(hookSub(s)))
+            || (["mvn", "gradle", "gradlew"].includes(s.program) && s.args.some((a) => /^(deploy|publish|publishToMavenCentral|uploadArchives)$/.test(a)))
+            || (["docker", "podman"].includes(s.program) && hookSub(s) === "push")
+            || (s.program === "gh" && ((hookSub(s) === "release" && ["create", "delete", "upload"].includes(hookSub(s, 1)))
+                || (hookSub(s) === "repo" && ["delete", "archive"].includes(hookSub(s, 1)))
+                || (hookSub(s) === "api" && s.args.some((a, i) => /^(-X|--method)$/.test(a) && /^(DELETE|PUT|PATCH)$/i.test(s.args[i + 1] ?? "")))))) },
+    { category: "pipe-to-shell", summary: "curl|wget … | sh|bash|zsh|python|node, bash <(curl …), iex (irm …)",
+        matches: (segs, cmd) => segs.some((s, i) => i > 0
+            && ["sh", "bash", "zsh", "fish", "dash", "ksh", "node", "perl", "ruby", "pwsh", "powershell", "python", "python3"].includes(s.program)
+            && ["curl", "wget", "fetch", "http", "https", "invoke-webrequest", "iwr", "irm", "invoke-restmethod"].includes(segs[i - 1].program))
+            || /\b(sh|bash|zsh)\s+<\(\s*(curl|wget)\b/.test(cmd) || /\biex\b.*\b(irm|iwr|Invoke-RestMethod|Invoke-WebRequest|DownloadString)\b/i.test(cmd) },
+    { category: "system", summary: "mkfs, dd of=/dev/…, > /dev/sd…, shutdown|reboot|halt|poweroff, systemctl disable|mask, crontab -r, chmod|chown -R on /, iptables -F, diskutil erase…, format X:, Format-Volume, Clear-Disk, a fork bomb",
+        matches: (segs, cmd) => segs.some((s) => /^mkfs(\.|$)/.test(s.program) || (s.program === "dd" && s.args.some((a) => /^of=\/dev\//.test(a)))
+            || ["shutdown", "reboot", "halt", "poweroff"].includes(s.program) || (s.program === "systemctl" && ["disable", "mask"].includes(hookSub(s)))
+            || (s.program === "crontab" && s.args.includes("-r"))
+            || (["chmod", "chown"].includes(s.program) && hookFlag(s.args, "R", ["--recursive"]) && s.args.some((a) => /^\/\*?$/.test(a)))
+            || (s.program === "iptables" && (s.args.includes("-F") || s.args.includes("--flush")))
+            || (s.program === "diskutil" && /^erase/i.test(hookSub(s))) || (s.program === "format" && s.args.some((a) => /^[a-z]:$/i.test(a)))
+            || ["format-volume", "clear-disk", "initialize-disk"].includes(s.program))
+            || />\s*\/dev\/(sd|nvme|hd|disk|mmcblk)/.test(cmd) || /:\(\)\s*\{\s*:\s*\|\s*:\s*&\s*\}\s*;\s*:/.test(cmd) },
+];
+function hookExtraRules() {
+    const file = process.env.DECIDIO_HOOK_EXTRA_RULES;
+    if (!file)
+        return [];
+    let parsed;
     try {
-        const c = JSON.parse(readFileSync(cache, "utf8"));
-        if (c && typeof c.latest === "string" && Date.now() - Number(c.checkedAt) < 24 * 3600 * 1000)
-            return c.latest;
+        parsed = JSON.parse(readFileSync(file, "utf8"));
     }
-    catch { }
-    const reg = (SHELL_ENV.DECIDIO_UPDATE_REGISTRY ?? "https://registry.npmjs.org").replace(/\/+$/, "");
-    try {
-        const ctl = new AbortController();
-        const t = setTimeout(() => ctl.abort(), 2000);
-        const r = await fetch(`${reg}/@decidio%2fsdk/latest`, { signal: ctl.signal });
-        clearTimeout(t);
-        if (!r.ok)
+    catch (e) {
+        throw new Error(`DECIDIO_HOOK_EXTRA_RULES (${file}) could not be read as JSON (${e?.message ?? e})`);
+    }
+    if (!Array.isArray(parsed))
+        throw new Error(`DECIDIO_HOOK_EXTRA_RULES (${file}) must be a JSON array of { category, pattern, flags?, summary? }`);
+    return parsed.map((r, i) => {
+        if (!r || typeof r.category !== "string" || !/^[a-z0-9-]{1,40}$/.test(r.category) || typeof r.pattern !== "string")
+            throw new Error(`DECIDIO_HOOK_EXTRA_RULES (${file}) entry ${i} needs a category ([a-z0-9-]) and a pattern`);
+        let re;
+        try {
+            re = new RegExp(r.pattern, typeof r.flags === "string" ? r.flags.replace(/[^gimsuy]/g, "") : "");
+        }
+        catch (e) {
+            throw new Error(`DECIDIO_HOOK_EXTRA_RULES (${file}) entry ${i}: ${e?.message ?? e}`);
+        }
+        return { category: r.category, summary: typeof r.summary === "string" ? r.summary : `/${r.pattern}/${r.flags ?? ""}`, matches: (_s, cmd) => { re.lastIndex = 0; return re.test(cmd); } };
+    });
+}
+function hookMatch(command) {
+    const segs = hookSegments(command);
+    for (const r of [...HOOK_RULES, ...hookExtraRules()])
+        if (r.matches(segs, command))
+            return r;
+    return null;
+}
+function hookRedact(command) {
+    return command
+        .replace(/(\b(?:bearer|basic)\s+)[A-Za-z0-9._~+/=-]{8,}/gi, "$1[REDACTED]")
+        .replace(/(\b[A-Za-z0-9_]*(?:token|password|passwd|pwd|secret|api[_-]?key|access[_-]?key|private[_-]?key|auth|credentials?)\s*[=:]\s*)(["']?)[^\s"';&|]+\2/gi, "$1$2[REDACTED]$2")
+        .replace(/(:\/\/[^/\s:@]+:)[^@\s/]+(@)/g, "$1[REDACTED]$2")
+        .replace(/((?:^|\s)(?:-u|--user|--password-stdin|-p)\s+["']?[^\s:"']+:)[^\s"']+/g, "$1[REDACTED]")
+        .replace(/((?:-H|--header)\s+["']?(?:authorization|x-api-key|cookie)\s*:\s*)[^"']+/gi, "$1[REDACTED]")
+        .replace(/\b(?:AKIA[0-9A-Z]{16}|ghp_[A-Za-z0-9]{20,}|github_pat_[A-Za-z0-9_]{20,}|sk-[A-Za-z0-9_-]{20,}|xox[baprs]-[A-Za-z0-9-]{10,}|sk_(?:live|test)_[A-Za-z0-9]{10,})\b/g, "[REDACTED]");
+}
+function hookSubject(category, segs, cwdAbs, projectDir) {
+    const textOnly = (why) => ({ fingerprint: null, display: `text-only (${why})` });
+    const relOrAbs = (p) => { const r = relative(projectDir, p); return r && !r.startsWith("..") && !isAbsolute(r) ? r.split(pathSep).join("/") : p; };
+    const nonFlags = (s) => s.args.filter((a) => !a.startsWith("-"));
+    const git = () => {
+        try {
+            const run = (args) => execFileSync("git", args, { cwd: cwdAbs, timeout: 3000, stdio: ["ignore", "pipe", "ignore"], encoding: "utf8" }).trim();
+            const head = run(["rev-parse", "HEAD"]);
+            const branch = run(["rev-parse", "--abbrev-ref", "HEAD"]);
+            return /^[0-9a-f]{40}$/.test(head) && branch ? { head, branch } : null;
+        }
+        catch {
             return null;
-        const body = await r.json();
-        const latest = typeof body?.version === "string" && /^\d+\.\d+\.\d+$/.test(body.version) ? body.version : null;
-        if (latest) {
-            try {
-                mkdirSync(sessionDir(), { recursive: true });
-                writeFileSync(cache, JSON.stringify({ checkedAt: Date.now(), latest }));
-            }
-            catch { }
         }
-        return latest;
+    };
+    const firstOf = (programs) => segs.findIndex((s) => programs.includes(s.program));
+    const movedTree = (i) => segs.slice(0, i).some((s) => s.program === "cd" || s.program === "pushd");
+    if (category === "git-rewrite" || category === "infra-apply") {
+        const i = category === "git-rewrite" ? firstOf(["git"]) : firstOf(["terraform", "tofu", "pulumi", "cdk", "sam", "serverless", "sls", "kubectl", "helm", "aws", "gcloud", "az", "doctl", "fly", "flyctl", "heroku", "vercel", "oci", "ibmcloud"]);
+        if (i < 0)
+            return textOnly("no subject");
+        if (movedTree(i))
+            return textOnly("a cd on the same line moves the call to another directory");
+        const g = git();
+        if (!g)
+            return textOnly("not a git repository here");
+        const seg = segs[i];
+        const args = nonFlags(seg);
+        const extra = category === "git-rewrite" ? args.slice(1).join(" ") : [relOrAbs(cwdAbs), ...seg.args.filter((a) => /^(-var-file|--var-file|-plan|--plan)/.test(a) || /\.(tfplan|tfvars)$/.test(a))].join(" ");
+        return { fingerprint: `${category}:${g.head}:${g.branch}:${extra}`, display: `HEAD ${g.head.slice(0, 7)} on ${g.branch}${extra ? ` · ${hookRedact(extra).slice(0, 120)}` : ""}` };
+    }
+    if (category === "delete-recursive") {
+        const i = firstOf(["rm", "find", "rmdir", "rd", "del", "remove-item", "shred"]);
+        if (i < 0)
+            return textOnly("no subject");
+        if (movedTree(i))
+            return textOnly("a cd on the same line moves the call to another directory");
+        const targets = nonFlags(segs[i]).filter((a) => !/^[{}();\\]+$/.test(a) && !(segs[i].program === "find" && /^(-|\{\})/.test(a))).map((a) => resolvePath(cwdAbs, a.replace(/^["']|["']$/g, "")));
+        if (!targets.length)
+            return textOnly("no path named");
+        const sorted = [...new Set(targets)].sort();
+        return { fingerprint: `paths:${sorted.join("\0")}`, display: hookRedact(sorted.map(relOrAbs).join(", ")).slice(0, 160) };
+    }
+    if (category === "sql-destructive") {
+        const stIdx = segs.findIndex((s) => /\b(DROP|TRUNCATE|DELETE)\b/i.test(s.raw));
+        const dbIdx = firstOf(HOOK_DB_CLIENTS);
+        const client = dbIdx >= 0 ? segs[dbIdx] : stIdx >= 0 ? segs[stIdx] : null;
+        if (!client)
+            return textOnly("no statement");
+        const stmtSeg = stIdx >= 0 ? segs[stIdx] : client;
+        const stmt = (stmtSeg.raw.match(/\b(DROP\s+\w+[^;'"]*|TRUNCATE[^;'"]*|DELETE\s+FROM[^;'"]*)/i)?.[1] ?? stmtSeg.raw).replace(/\s+/g, " ").trim();
+        const stmtAt = client.args.findIndex((a) => /^["']?(DROP|TRUNCATE|DELETE)\b/i.test(a));
+        const target = (stmtAt >= 0 ? client.args.slice(0, stmtAt) : client.args).filter((a) => !a.startsWith("-")).join(" ");
+        return { fingerprint: `sql:${client.program}:${target}:${stmt.toUpperCase()}`, display: hookRedact(`${client.program}${target ? ` ${target}` : ""}: ${stmt}`).slice(0, 160) };
+    }
+    return textOnly("text binds this category");
+}
+async function readHookStdin() {
+    if (process.stdin.isTTY)
+        return { ok: false, why: "no hook input on stdin - this command is run BY Claude Code with the tool call as JSON on stdin (set it up with: npx @decidio/sdk hook install)" };
+    let raw = "";
+    try {
+        process.stdin.setEncoding("utf8");
+        for await (const chunk of process.stdin) {
+            raw += chunk;
+            if (raw.length > 4_000_000)
+                break;
+        }
+    }
+    catch (e) {
+        return { ok: false, why: `stdin could not be read (${e?.message ?? e})` };
+    }
+    if (!raw.trim())
+        return { ok: false, why: "empty hook input on stdin" };
+    try {
+        const v = JSON.parse(raw);
+        if (!v || typeof v !== "object" || Array.isArray(v))
+            return { ok: false, why: "the hook input is not a JSON object" };
+        return { ok: true, input: v };
     }
     catch {
-        return null;
+        return { ok: false, why: "the hook input is not JSON" };
     }
 }
-async function updateGate(cmd, argv) {
-    const gatedHere = cmd ? GATED_CMDS.has(cmd) : !!(process.stdin.isTTY && process.stdout.isTTY);
-    if (!gatedHere || SHELL_ENV.DECIDIO_NO_UPDATE_CHECK || SHELL_ENV.DECIDIO_UPDATE_REEXEC || VERSION === "unknown" || VERSION.includes("-"))
-        return null;
-    const latest = await latestPublished();
-    if (!latest || !semverNewer(latest, VERSION))
-        return null;
-    const entry = process.argv[1] ?? "";
-    const underNpx = /[\\/]_npx[\\/]/.test(entry);
-    const localRoot = (() => {
-        const m = /^(.*?)[\\/]node_modules[\\/]@decidio[\\/]sdk[\\/]/.exec(entry);
-        if (!m)
+function hookConfig() {
+    const token = process.env.DECIDIO_API_TOKEN;
+    if (!token)
+        return { missing: "DECIDIO_API_TOKEN is not set - no agent token in this folder's .env or the environment" };
+    return {
+        apiUrl: API, agentId: process.env.DECIDIO_AGENT_ID || defaultAgentId(), apiToken: token, sourceSystem: "claude-code",
+        agentKey: process.env.DECIDIO_AGENT_KEY || undefined, agentDid: process.env.DECIDIO_AGENT_DID || undefined, workspaceId: process.env.DECIDIO_WORKSPACE_ID || undefined,
+        appUrl: process.env.DECIDIO_APP_URL || APP_URL,
+    };
+}
+const hookStateDir = () => (process.env.CLAUDE_PLUGIN_DATA ? joinPath(process.env.CLAUDE_PLUGIN_DATA, "hooks") : joinPath(sessionDir(), "hooks"));
+const hookStatePath = (toolUseId) => joinPath(hookStateDir(), toolUseId.replace(/[^A-Za-z0-9_.-]/g, "_").slice(0, 120) + ".json");
+function writeHookState(toolUseId, s) {
+    if (typeof toolUseId !== "string" || !toolUseId)
+        return;
+    try {
+        mkdirSync(hookStateDir(), { recursive: true });
+        writeFileSync(hookStatePath(toolUseId), JSON.stringify(s) + "\n");
+    }
+    catch (e) {
+        err(`decidio hook: could not keep the approval ${s.decisionId} for posttool (${e?.message ?? e}) - the execution will not be reported; the approval lapses on its own`);
+    }
+}
+const JUSTIFY_MAX = 500;
+const justifyPath = (decisionId) => joinPath(hookStateDir(), "justify-" + decisionId.replace(/[^A-Za-z0-9_.-]/g, "_").slice(0, 120) + ".json");
+function readJustification(decisionId) {
+    try {
+        const p = justifyPath(decisionId);
+        if (!existsSync(p))
+            return null;
+        if (statSync(p).mtimeMs < Date.now() - 24 * 3600_000) {
+            rmSync(p, { force: true });
             return null;
-        const norm = (s) => (process.platform === "win32" ? s.toLowerCase() : s);
-        const root = resolvePath(m[1]);
-        const cwd = norm(process.cwd());
-        return cwd === norm(root) || cwd.startsWith(norm(root) + pathSep) ? root : null;
-    })();
-    const viaAlias = /[\\/]decidio$/.test(argv[1] ?? "");
-    const pkgName = viaAlias ? "decidio" : "@decidio/sdk";
-    const upgradeCmd = underNpx ? `npx ${pkgName}@latest ${argv.slice(2).join(" ")}` : localRoot ? `npm i ${pkgName}@latest` : `npm i -g ${pkgName}@latest`;
-    const notice = `${latest} is available (you have ${VERSION}).`;
-    if (!(process.stdin.isTTY && process.stdout.isTTY)) {
-        err(`⚠ ${notice} Upgrade: ${upgradeCmd}`);
-        if (SHELL_ENV.DECIDIO_REQUIRE_LATEST) {
-            err(`✘ DECIDIO_REQUIRE_LATEST is set — not running a stale version.`);
-            return 1;
         }
-        return null;
+        const j = JSON.parse(readFileSync(p, "utf8"));
+        return typeof j?.justification === "string" && j.justification.trim() ? j.justification : null;
     }
-    const a = (await ask(`${notice} Upgrade now? [y/n]: `)).toLowerCase();
-    if (a !== "y" && a !== "yes") {
-        err(`✘ not upgraded — run this when ready: ${upgradeCmd}`);
-        return 1;
+    catch {
+        return null;
     }
-    if (underNpx) {
+}
+const clearJustification = (decisionId) => { try {
+    rmSync(justifyPath(decisionId), { force: true });
+}
+catch { } };
+function justificationProblem(text) {
+    if (!text.trim())
+        return "a justification cannot be empty";
+    if (text.length > JUSTIFY_MAX)
+        return `keep the justification to ${JUSTIFY_MAX} characters`;
+    if (/[\r\n]/.test(text))
+        return "a justification is one line";
+    return null;
+}
+function sweepHookState() {
+    try {
+        const dir = hookStateDir();
+        if (!existsSync(dir))
+            return;
+        const cutoff = Date.now() - 24 * 3600_000;
+        for (const f of readdirSync(dir)) {
+            const p = joinPath(dir, f);
+            try {
+                if (statSync(p).mtimeMs < cutoff)
+                    rmSync(p, { force: true });
+            }
+            catch { }
+        }
+    }
+    catch { }
+}
+const hookErr = (e) => e instanceof DecidioHttpError ? `HTTP ${e.status} from ${e.endpoint}` : String(e?.cause?.code ?? e?.message ?? e);
+const hookShort = (cmd) => (cmd.length > 120 ? cmd.slice(0, 117) + "..." : cmd);
+async function hookStatus(cfg, decisionId, waitSec) {
+    assertSafeTransport(cfg.apiUrl, true);
+    const path = `/agent/status/${encodeURIComponent(decisionId)}?wait=${waitSec}`;
+    const r = await fetch(cfg.apiUrl.replace(/\/$/, "") + path, { headers: { authorization: `Bearer ${cfg.apiToken}` }, signal: AbortSignal.timeout((waitSec + 20) * 1000) });
+    if (!r.ok)
+        throw new DecidioHttpError(r.status, path, await r.json().catch(() => undefined));
+    const body = await r.json();
+    if (!body || typeof body !== "object" || typeof body.state !== "string")
+        throw new Error("the gate answered a status this SDK does not understand");
+    return body;
+}
+async function hookHold(cfg, decisionId, holdMs) {
+    const deadline = Date.now() + holdMs;
+    let status = null, lastError = null;
+    const sleep = (ms) => new Promise((r) => setTimeout(r, Math.max(0, ms)));
+    for (;;) {
+        const left = deadline - Date.now();
+        if (left < 1000)
+            break;
+        const t0 = Date.now();
+        try {
+            status = await hookStatus(cfg, decisionId, Math.min(30, Math.floor(left / 1000)));
+            lastError = null;
+        }
+        catch (e) {
+            lastError = hookErr(e);
+            const transient = (e instanceof DecidioHttpError && (e.status >= 500 || e.status === 408 || e.status === 429))
+                || (!(e instanceof DecidioHttpError) && (e?.name === "AbortError" || e?.name === "TimeoutError" || typeof e?.cause?.code === "string" || /fetch failed/i.test(String(e?.message ?? ""))));
+            if (!transient)
+                break;
+            await sleep(Math.min(2000, deadline - Date.now()));
+            continue;
+        }
+        if (status.state !== "pending")
+            break;
+        if (Date.now() - t0 < 500)
+            await sleep(Math.min(1000, deadline - Date.now()));
+    }
+    return { status, lastError };
+}
+async function cmdHookPretool() {
+    const out = (o) => { process.stdout.write(JSON.stringify(o) + "\n"); return 0; };
+    const deny = (reason, user) => out({ hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "deny", permissionDecisionReason: reason }, ...(user ? { systemMessage: user } : {}) });
+    const allow = (reason) => out({ hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "allow", permissionDecisionReason: reason } });
+    try {
+        const read = await readHookStdin();
+        if (!read.ok)
+            return deny(`Decidio hook: ${read.why} - refusing this tool call (fail closed).`);
+        const input = read.input;
+        const tool = typeof input.tool_name === "string" ? input.tool_name : "";
+        const command = typeof input.tool_input?.command === "string" ? input.tool_input.command : "";
+        if (!["Bash", "PowerShell"].includes(tool) || !command.trim())
+            return 0;
+        let rule;
+        try {
+            rule = hookMatch(command);
+        }
+        catch (e) {
+            return deny(`Decidio hook: ${e?.message ?? e} - every command is refused until it is fixed.`);
+        }
+        if (!rule)
+            return 0;
+        const short = hookShort(hookRedact(command.replace(/\s+/g, " ").trim()));
+        const projectDir = resolvePath(process.env.CLAUDE_PROJECT_DIR || process.cwd());
+        const cfg = hookConfig();
+        if ("missing" in cfg)
+            return deny(`Decidio: "${short}" is a ${rule.category} command that needs a person's approval, but this project has no Decidio agent credentials (${cfg.missing}). Nothing ran. Ask the user to run \`npx @decidio/sdk init\` in ${projectDir}, then retry the same command.`, `Decidio: no agent credentials in ${projectDir} - run npx @decidio/sdk init`);
+        const canonical = command.replace(/\s+/g, " ").trim();
+        const cwdAbs = resolvePath(typeof input.cwd === "string" && input.cwd ? input.cwd : process.cwd());
+        const rel = relative(projectDir, cwdAbs);
+        const cwdRel = !rel ? "." : rel.startsWith("..") || isAbsolute(rel) ? cwdAbs : rel;
+        const session = typeof input.session_id === "string" ? input.session_id : "";
+        const subject = hookSubject(rule.category, hookSegments(command), cwdAbs, projectDir);
+        let material;
+        try {
+            material = bindingMaterial(cfg);
+        }
+        catch (e) {
+            return deny(`Decidio hook: this command cannot be bound to an approval (${e?.message ?? e}) - refusing to run it. Ask the user to check ${projectDir}/.env with \`npx @decidio/sdk doctor\`.`);
+        }
+        if (!material)
+            return deny(`Decidio hook: this command cannot be bound to an approval (no key material (DECIDIO_API_TOKEN, or DECIDIO_AGENT_KEY + DECIDIO_AGENT_DID)) - refusing to run it. Ask the user to check ${projectDir}/.env with \`npx @decidio/sdk doctor\`.`);
+        const ctx = { action: "shellExec", amount: 0, scope: boundScope(material, canonical + "\n" + (subject.fingerprint ?? "")),
+            context: { command: hookRedact(canonical).slice(0, 400), cwd: cwdRel.slice(0, 200), category: rule.category, host: "claude-code", tool, subject: hookRedact(subject.display).slice(0, 200) } };
+        const request = adapterRequest(ctx);
+        let key;
+        try {
+            key = idempotencyKey(material, { host: "claude-code", tool, command: canonical, cwd: cwdRel, session, subject: subject.fingerprint ?? "" });
+        }
+        catch (e) {
+            return deny(`Decidio hook: this command cannot be bound to an approval (${e?.message ?? e}) - refusing to run it. Ask the user to check ${projectDir}/.env with \`npx @decidio/sdk doctor\`.`);
+        }
+        let auth;
+        try {
+            let a = await gateAuthorizeTwinAware(cfg, ctx, { idempotencyKey: key });
+            if (a.decision === "duplicate") {
+                const twin = a.duplicateOf;
+                const label = twin.displayNumber ?? twin.decisionId;
+                const when = twin.refusedAt ? ` on ${String(twin.refusedAt).slice(0, 10)}` : "";
+                const why = twin.reason ? ` ("${twin.reason}")` : "";
+                const stored = readJustification(twin.decisionId);
+                if (!stored) {
+                    return deny(`Decidio: "${short}" looks like a duplicate of ${label}, which a person refused${when}${why}. Nothing ran. If this change is different, ask the user what changed, then run \`npx @decidio/sdk hook justify ${twin.decisionId} "<their words>"\` and retry EXACTLY the same command; the approver will see their justification beside the earlier refusal. A different commit or path is a new request on its own.`, `Decidio: ${label} was refused${when} - a justification is needed to ask again`);
+                }
+                a = await gateAuthorizeTwinAware(cfg, ctx, { idempotencyKey: key, justification: stored });
+                if (a.decision === "duplicate")
+                    return deny(`Decidio: "${short}" is still a duplicate of ${label} and the stored justification was not accepted (${a.duplicateOf.reason ?? "no reason given"}). Nothing ran.`);
+                clearJustification(twin.decisionId);
+            }
+            auth = a;
+        }
+        catch (e) {
+            return deny(`Decidio hook: the approval gate could not be asked about "${short}" (${hookErr(e)}) - refusing to run it (fail closed). Nothing ran. ${e instanceof DecidioRateLimitError ? "The workspace's governed-action allowance for this hour is used up; try later." : `Check the network and ${projectDir}/.env (\`npx @decidio/sdk doctor\`), then retry the same command.`}`);
+        }
+        const where = decisionUrl(cfg.appUrl, auth.decisionId);
+        if (auth.decision === "block")
+            return deny(`Decidio BLOCKED "${short}" by policy (decision ${auth.decisionId}${auth.reason ? `: ${auth.reason}` : ""}). Do not run it, or a variant of it; tell the user.`, `Decidio blocked ${auth.decisionId}`);
+        if (auth.decision === "proceed") {
+            writeHookState(input.tool_use_id, { v: 1, decisionId: auth.decisionId, receiptId: auth.receiptId ?? null, tool, category: rule.category, at: new Date().toISOString() });
+            return allow(`Decidio: "${short}" is authorized by policy (decision ${auth.decisionId}${auth.receiptId ? `, receipt ${auth.receiptId}` : ""}, sealed). This covers this one execution only.`);
+        }
+        const holdRaw = Number(process.env.DECIDIO_HOOK_HOLD_MS ?? "90000");
+        const held = await hookHold(cfg, auth.decisionId, Number.isFinite(holdRaw) && holdRaw >= 0 ? Math.min(holdRaw, HOOK_HOLD_CAP_MS) : 90_000);
+        const st = held.status;
+        if (!st)
+            return deny(`Decidio: "${short}" is routed for approval as decision ${auth.decisionId}, but its status could not be read (${held.lastError ?? "no answer"}). Nothing ran. When the gate is reachable, run \`npx @decidio/sdk hook wait ${auth.decisionId}\` and then retry EXACTLY the same command.`);
+        if (st.state === "pending")
+            return deny(`Decidio: "${short}" needs a person's approval - decision ${auth.decisionId} is in their queue${where ? ` (${where})` : ""}. Nothing ran. To continue: run \`npx @decidio/sdk hook wait ${auth.decisionId}\` (it returns when they decide), then retry EXACTLY the same command - not a variant of it, and do not work around this gate.`, `Decidio: ${auth.decisionId} awaits approval${where ? ` - ${where}` : ""}`);
+        if (st.state === "rejected" || st.state === "blocked")
+            return deny(`Decidio: "${short}" was ${st.state} (decision ${auth.decisionId}${st.reason ? `: ${st.reason}` : ""}) for this exact change (${hookRedact(subject.display)}). Do not retry it or a variant of it; tell the user. ${subject.fingerprint ? "If the user changes what it would act on (a new commit, a different path), that is a new request and may be asked." : ""}`.trim(), `Decidio: ${auth.decisionId} ${st.state}`);
+        const chk = await checkApproval(cfg, auth.decisionId, request, { status: st });
+        if (!chk.ok)
+            return deny(`Decidio: "${short}" is NOT cleared to run - ${chk.reason ?? chk.code} (decision ${auth.decisionId}). Nothing ran.${chk.code === "spent" || chk.code === "expired" ? " Retry the same command to ask for a fresh approval." : ""}`);
+        writeHookState(input.tool_use_id, { v: 1, decisionId: auth.decisionId, receiptId: st.receiptId ?? auth.receiptId ?? null, tool, category: rule.category, at: new Date().toISOString() });
+        return allow(`Decidio: "${short}" is approved (decision ${auth.decisionId}${st.receiptId ?? auth.receiptId ? `, receipt ${st.receiptId ?? auth.receiptId}` : ""}). This approval covers this one execution only; its record is sealed.`);
+    }
+    catch (e) {
+        return deny(`Decidio hook: unexpected failure (${e?.message ?? e}) - refusing this tool call (fail closed). Nothing ran.`);
+    }
+}
+async function cmdHookPosttool() {
+    try {
+        const read = await readHookStdin();
+        if (!read.ok) {
+            err(`decidio hook posttool: ${read.why}`);
+            return 0;
+        }
+        const id = typeof read.input.tool_use_id === "string" ? read.input.tool_use_id : "";
+        if (!id)
+            return 0;
+        const path = hookStatePath(id);
+        sweepHookState();
+        if (!existsSync(path))
+            return 0;
+        let s;
+        try {
+            s = JSON.parse(readFileSync(path, "utf8"));
+        }
+        catch {
+            rmSync(path, { force: true });
+            return 0;
+        }
+        rmSync(path, { force: true });
+        if (!s || s.v !== 1 || typeof s.decisionId !== "string")
+            return 0;
+        const cfg = hookConfig();
+        if ("missing" in cfg) {
+            err(`decidio hook posttool: ${cfg.missing} - the execution of ${s.decisionId} is not reported`);
+            return 0;
+        }
+        const resp = read.input.tool_response;
+        const interrupted = !!(resp && typeof resp === "object" && resp.interrupted);
+        const captured = { host: "claude-code", tool: s.tool, category: s.category, interrupted, ok: !interrupted };
+        const body = buildConfirmBody(cfg, s.decisionId, captured, signConfirm(s.decisionId, cfg), "wrapper");
+        assertSafeTransport(cfg.apiUrl, true);
+        const r = await fetch(cfg.apiUrl.replace(/\/$/, "") + "/agent/confirm", { method: "POST", headers: { "content-type": "application/json", authorization: `Bearer ${cfg.apiToken}` }, body: JSON.stringify(body), signal: AbortSignal.timeout(20_000) });
+        const parsed = await r.json().catch(() => null);
+        if (!r.ok) {
+            err(`decidio hook posttool: the execution of ${s.decisionId} could not be recorded (HTTP ${r.status}${parsed?.message ? `: ${parsed.message}` : ""}) - the approval is not marked spent; it lapses on its own`);
+            return 0;
+        }
+        const ev = readConfirmResponse(parsed, { signed: !!body.requesterIdentity, capturedResponse: captured });
+        const line = ev.reportRecorded
+            ? `Decidio recorded the execution of ${s.decisionId} (evidence tier ${ev.evidenceTier ?? "recorded"}); that approval is now spent - the next destructive command needs its own.`
+            : `Decidio did not record the execution of ${s.decisionId}: ${ev.diagnostic ?? "no report recorded"}.`;
+        err(`decidio hook: ${line}`);
+        process.stdout.write(JSON.stringify({ hookSpecificOutput: { hookEventName: "PostToolUse", additionalContext: line } }) + "\n");
+    }
+    catch (e) {
+        err(`decidio hook posttool: ${e?.message ?? e}`);
+    }
+    return 0;
+}
+async function cmdHookWait(id, timeoutSec) {
+    if (!id) {
+        err("✘ hook wait needs the decision id the hook named: npx @decidio/sdk hook wait <decision-id> [--timeout 600]");
+        return 2;
+    }
+    const problem = decisionIdProblem(id);
+    if (problem) {
+        err(`✘ "${id}" ${problem}`);
+        return 2;
+    }
+    const cfg = hookConfig();
+    if ("missing" in cfg) {
+        err(`✘ ${cfg.missing} - run \`npx @decidio/sdk init\` in this project first.`);
+        return 1;
+    }
+    const where = decisionUrl(cfg.appUrl, id);
+    err(`· decidio → ${API}`);
+    err(`· waiting for ${id}${where ? ` - approve at ${where}` : ""} (up to ${timeoutSec}s; Ctrl-C stops waiting, the request stays open)`);
+    const held = await hookHold(cfg, id, timeoutSec * 1000);
+    const st = held.status;
+    if (!st) {
+        err(`✘ could not read ${id}: ${held.lastError ?? "no answer"}`);
+        return 1;
+    }
+    log(st.state);
+    if (st.state === "pending") {
+        err(`· still pending after ${timeoutSec}s - run this again${where ? `, or approve at ${where}` : ""}.`);
+        return 1;
+    }
+    if (st.state === "rejected" || st.state === "blocked") {
+        err(`✘ ${id} was ${st.state}${st.reason ? `: ${st.reason}` : ""} - do not retry the command.`);
+        return 3;
+    }
+    err(`✔ ${id} ${st.state}${st.spent ? " - but already spent (an execution is recorded on it): the retry will ask again" : ""}${st.grantExpiresAt ? ` - valid until ${st.grantExpiresAt}` : ""}. Retry exactly the same command now.`);
+    return 0;
+}
+function cmdHookJustify(id, text) {
+    if (!id) {
+        err(`usage: npx @decidio/sdk hook justify <decisionId> "<what changed, in the user's words>"`);
+        return 2;
+    }
+    const idP = decisionIdProblem(id);
+    if (idP) {
+        err(`✘ ${idP}`);
+        return 2;
+    }
+    const tp = justificationProblem(text);
+    if (tp) {
+        err(`✘ ${tp}.`);
+        return 2;
+    }
+    try {
+        mkdirSync(hookStateDir(), { recursive: true });
+        writeFileSync(justifyPath(id), JSON.stringify({ v: 1, decisionId: id, justification: text.trim(), at: new Date().toISOString() }) + "\n");
+    }
+    catch (e) {
+        err(`✘ could not store the justification (${e?.message ?? e}).`);
+        return 1;
+    }
+    log(`✔ justification stored for ${id}. Retry EXACTLY the same command within a day: the request goes to the approver with these words beside the earlier refusal, and the justification is used once.`);
+    return 0;
+}
+function cmdHookRules() {
+    let extras = [];
+    try {
+        extras = hookExtraRules();
+    }
+    catch (e) {
+        err(`✘ ${e?.message ?? e} - while this stands, the hook refuses EVERY command.`);
+        return 1;
+    }
+    log(`Commands the Decidio hook gates (a person approves before they run; everything else runs as usual):`);
+    for (const r of HOOK_RULES)
+        log(`  ${r.category.padEnd(18)} ${r.summary}`);
+    if (extras.length) {
+        log(`From DECIDIO_HOOK_EXTRA_RULES (${process.env.DECIDIO_HOOK_EXTRA_RULES}):`);
+        for (const r of extras)
+            log(`  ${r.category.padEnd(18)} ${r.summary}`);
+    }
+    else
+        log(`Add your own: DECIDIO_HOOK_EXTRA_RULES=<file.json> with [{ "category": "deploy", "pattern": "^make deploy\\\\b", "summary": "make deploy" }] - each a regex over the whole command.`);
+    log(`The list is a client-side filter; your workspace's policy decides each request the hook sends. Hold: DECIDIO_HOOK_HOLD_MS (90000; capped at ${HOOK_HOLD_CAP_MS}, below the hook's 150 s timeout).`);
+    log(`Each request is bound to its SUBJECT as well as its text: a push to the branch and commit it would push, a delete to the paths, a statement to its database - so a refusal means "not this", and a new commit or a different path is a new request.`);
+    return 0;
+}
+function hookRunner() {
+    const q = (p) => `"${p.replace(/(["\\$`])/g, "\\$1")}"`;
+    const entry = process.argv[1] ?? "";
+    if (!entry || /[\\/]_npx[\\/]/.test(entry))
+        return `npx -y @decidio/sdk@${VERSION}`;
+    let real = entry;
+    try {
+        real = realPath(entry);
+    }
+    catch { }
+    const localRoot = resolvePath("node_modules") + pathSep;
+    if (real.startsWith(localRoot))
+        real = "$CLAUDE_PROJECT_DIR/node_modules/" + real.slice(localRoot.length).split(pathSep).join("/");
+    real = real.split(pathSep).join("/");
+    if (/\.ts$/.test(real))
+        return `npx tsx ${q(real)}`;
+    return `node ${q(real)}`;
+}
+async function cmdHookInstall(opts) {
+    const settingsPath = joinPath(".claude", opts.project ? "settings.json" : "settings.local.json");
+    let settings = {};
+    if (existsSync(settingsPath)) {
+        try {
+            settings = JSON.parse(readFileSync(settingsPath, "utf8"));
+        }
+        catch (e) {
+            err(`✘ ${settingsPath} exists but is not valid JSON (${e?.message ?? e}) - fix it first; nothing was written.`);
+            return 1;
+        }
+        if (!settings || typeof settings !== "object" || Array.isArray(settings)) {
+            err(`✘ ${settingsPath} is not a JSON object - nothing was written.`);
+            return 1;
+        }
+    }
+    if (opts.cli !== undefined && !opts.cli) {
+        err("✘ --cli needs the path of the CLI to run from the hook (e.g. --cli packages/decidio-guard/dist/cli.js)");
+        return 2;
+    }
+    const cliAt = opts.cli ? resolvePath(opts.cli).split(pathSep).join("/") : "";
+    const runner = opts.cli ? (/\.ts$/.test(opts.cli) ? `npx tsx "${cliAt}"` : `node "${cliAt}"`) : hookRunner();
+    const hooks = (settings.hooks = settings.hooks && typeof settings.hooks === "object" && !Array.isArray(settings.hooks) ? settings.hooks : {});
+    const place = (event, command, extra) => {
+        const list = Array.isArray(hooks[event]) ? hooks[event] : (hooks[event] = []);
+        const entry = { matcher: "Bash|PowerShell", hooks: [{ type: "command", command, ...extra }] };
+        const i = list.findIndex((e) => Array.isArray(e?.hooks) && e.hooks.some((h) => typeof h?.command === "string" && /\bhook (pretool|posttool)\b/.test(h.command) && /decidio|cli\.(js|ts)/.test(h.command)));
+        if (i >= 0) {
+            const same = JSON.stringify(list[i]) === JSON.stringify(entry);
+            list[i] = entry;
+            return same ? "kept" : "updated";
+        }
+        list.push(entry);
+        return "added";
+    };
+    const pre = place("PreToolUse", `cd "$CLAUDE_PROJECT_DIR" && ${runner} hook pretool`, { timeout: 150, onFailure: "block" });
+    const post = place("PostToolUse", `cd "$CLAUDE_PROJECT_DIR" && ${runner} hook posttool`, { timeout: 30 });
+    mkdirSync(".claude", { recursive: true });
+    writeFileSync(settingsPath, JSON.stringify(settings, null, 2) + "\n");
+    log(`✔ ${settingsPath.split(pathSep).join("/")}: PreToolUse hook ${pre}, PostToolUse hook ${post} (matcher Bash|PowerShell${opts.project ? "; this file is shared with everyone who clones the project" : "; this file is yours alone - Claude Code keeps it out of git"}).`);
+    log(`  Runs: ${runner} hook pretool|posttool  - the pretool hook times out at 150 s and BLOCKS the call if it fails (fail closed).`);
+    const env = readEnvFile();
+    const token = process.env.DECIDIO_API_TOKEN || env.DECIDIO_API_TOKEN;
+    if (token)
+        log(`✔ agent credentials: ${ENV_PATH} holds DECIDIO_API_TOKEN${(process.env.DECIDIO_AGENT_KEY || env.DECIDIO_AGENT_KEY) ? " and the agent's signing key" : ""} for "${process.env.DECIDIO_AGENT_ID || env.DECIDIO_AGENT_ID || defaultAgentId()}".`);
+    else
+        log(`⚠ no agent credentials here (no DECIDIO_API_TOKEN in ${ENV_PATH}) - until there are, EVERY gated command is refused. Run: npx @decidio/sdk init ${defaultAgentId()}`);
+    log(`  Gated: ${HOOK_RULES.map((r) => r.category).join(", ")} (npx @decidio/sdk hook rules lists the patterns; DECIDIO_HOOK_EXTRA_RULES adds yours).`);
+    log(`  Approver: anyone in your workspace with a role other than the agent's owner (the person who ran init) - on the phone app, the web app, Slack or Teams.`);
+    log(`           Nobody yet? Invite one: npx @decidio/sdk hook install --approver <email>   (single-use link; share by WhatsApp, SMS or email)`);
+    log(`  Flow: a gated command is held up to ${Math.min(Number(process.env.DECIDIO_HOOK_HOLD_MS ?? 90_000) || 90_000, HOOK_HOLD_CAP_MS) / 1000} s for the approver, then refused with its decision id; \`npx @decidio/sdk hook wait <id>\` returns when they decide,`);
+    log(`        and the SAME command retried then runs - once. A lab workspace allows 30 governed actions an hour; a gated command spends two (ask, retry).`);
+    log(`  Reload: restart Claude Code, or run /hooks in it - hooks are read when a session starts.`);
+    if (opts.approver !== undefined)
+        return inviteApprover(opts.approver);
+    return 0;
+}
+async function inviteApprover(email) {
+    if (!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email)) {
+        err(`✘ --approver needs an email address (got "${email}")`);
+        return 2;
+    }
+    const session = await acquireSession("Inviting an approver");
+    if (!session)
+        return 1;
+    const r = await api("/demo/invite", { method: "POST", body: JSON.stringify({}) }, session);
+    if (r.status !== 200 || typeof r.body?.link !== "string") {
+        err(`✘ could not create an invite (HTTP ${r.status}${r.body?.error ? `: ${r.body.error}` : ""}) - only the workspace owner can invite on a lab workspace; elsewhere add the approver in the app's Roles screen.`);
+        return 1;
+    }
+    const link = String(r.body.link);
+    const until = typeof r.body.expiresAt === "string" ? r.body.expiresAt.slice(0, 10) : "in 7 days";
+    const text = `I'm using Decidio to route my coding agent's risky commands to a person for approval - I'd like that person to be you. This link opens my workspace for you (single use, expires ${until}): ${link}`;
+    log(`✔ invite created (single use, expires ${until}). Send it to ${email} by whichever channel they read - these carry the invite, nothing else:`);
+    log(`  WhatsApp  https://wa.me/?text=${encodeURIComponent(text)}`);
+    log(`  SMS       sms:?&body=${encodeURIComponent(text)}`);
+    log(`  Email     mailto:${encodeURIComponent(email)}?subject=${encodeURIComponent("Approve my coding agent's risky commands")}&body=${encodeURIComponent(text)}`);
+    log(`  Link      ${link}`);
+    log(`  Opening it signs them into the web app (the phone build at the same address; the app stores can wait) as a recognized approver in your workspace.`);
+    return 0;
+}
+const PACK_SLUG_RE = /^[a-z0-9][a-z0-9-]{0,39}$/;
+const PACK_SKILL_PREFIX = "decidio-";
+const PACK_IGNORE_ENTRY = ".claude/skills/decidio-*/";
+const PACK_RULES_IGNORE_ENTRY = ".claude/rules/decidio-*.md";
+function claudeHome() {
+    return process.platform === "win32" ? (SHELL_ENV.USERPROFILE ?? homedir()) : (SHELL_ENV.HOME ?? homedir());
+}
+function ensurePackSkillsIgnored() {
+    try {
+        if (lstatSync(".gitignore").isSymbolicLink()) {
+            err(`· .gitignore is a symbolic link - add ${PACK_IGNORE_ENTRY} and ${PACK_RULES_IGNORE_ENTRY} to it yourself`);
+            return;
+        }
+    }
+    catch { }
+    const creating = !existsSync(".gitignore");
+    let existing = creating ? "" : readFileSync(".gitignore", "utf8");
+    for (const entry of [PACK_IGNORE_ENTRY, PACK_RULES_IGNORE_ENTRY]) {
+        if (existing.split(/\r?\n/).some((l) => l.trim() === entry))
+            continue;
+        appendFileSync(".gitignore", (existing && !existing.endsWith("\n") ? "\n" : "") + entry + "\n");
+        existing = readFileSync(".gitignore", "utf8");
+        log(`✔ ${creating && entry === PACK_IGNORE_ENTRY ? "wrote" : "added"} ${entry} to .gitignore (a pulled pack is yours to read, not the repository's to carry)`);
+    }
+}
+const yamlQuote = (s) => `"${s.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`;
+const mdCell = (s) => String(s ?? "").replace(/\|/g, "\\|").replace(/\s+/g, " ").trim();
+export function packScopeLabel(scope) {
+    if (!scope || typeof scope !== "object")
+        return null;
+    if (scope.kind === "org")
+        return "the organisation";
+    if (scope.kind === "personal")
+        return "yours";
+    if (scope.kind === "unit") {
+        const type = typeof scope.unitType === "string" && /^[a-z_]{1,20}$/.test(scope.unitType) ? (scope.unitType === "project" ? "program" : scope.unitType) : "unit";
+        const name = typeof scope.unitName === "string" && scope.unitName.trim() ? ` "${scope.unitName.replace(/["\r\n]/g, "'").slice(0, 80)}"` : "";
+        return `${type}${name}`;
+    }
+    return null;
+}
+export function hereQuery(cwd = process.cwd()) {
+    const cfg = joinPath(cwd, ".decidio.json");
+    try {
+        if (lstatSync(cfg).isSymbolicLink())
+            return { error: ".decidio.json is a symbolic link - replace it with the file itself (npx @decidio/sdk context bind --unit <id> writes it)" };
+    }
+    catch { }
+    if (existsSync(cfg)) {
+        let unit;
+        try {
+            unit = JSON.parse(readFileSync(cfg, "utf8"))?.unit;
+        }
+        catch {
+            return { error: ".decidio.json is not JSON - it holds {\"unit\": \"<unit id>\"} (npx @decidio/sdk context bind --unit <id> writes it)" };
+        }
+        if (typeof unit !== "string" || !/^[A-Za-z0-9_-]{1,64}$/.test(unit))
+            return { error: ".decidio.json's \"unit\" is not a unit id (npx @decidio/sdk context bind --unit <id> writes it)" };
+        return { unit };
+    }
+    let remote = "";
+    try {
+        remote = execFileSync("git", ["remote", "get-url", "origin"], { cwd, stdio: ["ignore", "pipe", "ignore"], encoding: "utf8", timeout: 5_000 }).trim();
+    }
+    catch {
+        return {};
+    }
+    const m = /^(?:git@github\.com:|ssh:\/\/git@github\.com\/|https:\/\/(?:[^@/]+@)?github\.com\/)([A-Za-z0-9][A-Za-z0-9-]{0,38})\/([A-Za-z0-9._-]{1,100}?)(?:\.git)?\/?$/.exec(remote);
+    return m ? { repo: `${m[1]}/${m[2]}` } : {};
+}
+export function plainProjectPath(parts) {
+    let p = ".claude";
+    for (const part of ["", ...parts]) {
+        if (part)
+            p = joinPath(p, part);
+        try {
+            if (lstatSync(p).isSymbolicLink())
+                return false;
+        }
+        catch { }
+    }
+    return true;
+}
+export function isPackFileOf(text, slug, kind) {
+    if (kind === "skill")
+        return text.startsWith(`---\nname: ${PACK_SKILL_PREFIX}${slug}\n`) && /\n# .*\(Decidio context pack\)\n/.test(text);
+    return /^# .*\(Decidio context pack - read first\)\n/.test(text);
+}
+function gitTracked(path) {
+    try {
+        execFileSync("git", ["ls-files", "--error-unmatch", "--", path], { stdio: "ignore", timeout: 5_000 });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+export function packSkillMarkdown(idx) {
+    const name = PACK_SKILL_PREFIX + String(idx.slug);
+    const rows = Array.isArray(idx.rows) ? idx.rows : [];
+    const description = `Use when the user's words match "${String(idx.trigger).replace(/"/g, "'")}" - the Decidio context pack "${String(idx.title).replace(/"/g, "'")}": the sealed decisions in force on the subject, by record id.`;
+    const table = rows.length
+        ? ["| Record | Title | Type | Status | Lifecycle | Decided | Link |", "| --- | --- | --- | --- | --- | --- | --- |",
+            ...rows.map((r) => `| ${mdCell(r.recordId)} | ${mdCell(r.title)} | ${mdCell(r.type)} | ${mdCell(r.status)} | ${mdCell(r.lifecycle?.state)}${r.lifecycle?.inEffect === false ? " (not in effect)" : ""} | ${mdCell(String(r.decidedAt ?? "").slice(0, 10))} | ${mdCell(r.url)} |`)].join("\n")
+        : "_No entries you can read yet._";
+    const omitted = Number(idx.omitted ?? 0);
+    return [
+        "---", `name: ${name}`, `description: ${yamlQuote(description)}`, "---", "",
+        `# ${String(idx.title)} (Decidio context pack)`, "",
+        ...(packScopeLabel(idx.scope) ? [`**Scope:** ${packScopeLabel(idx.scope)}`, ""] : []),
+        `**When to use:** ${String(idx.trigger)}`, "",
+        "These are sealed Decidio decisions the pack's owner curated for this subject. Treat them as the record of what was decided and cite them by record id. Role tokens such as [COUNTERPARTY_1] are protective placeholders: never guess or restate what they stand for. To read one in full, call Decidio's `get_decision` with its record id (the Decidio connector) or open its link; `get_context_pack` returns this list live. When a decision's lifecycle is not \"in_effect\", say so before relying on it.", "",
+        table, "",
+        `_Pulled ${String(idx.asOf)} · pack hash ${String(idx.hash)} · ${rows.length} ${rows.length === 1 ? "entry" : "entries"} shown${omitted ? `, ${omitted} you cannot read omitted` : ""}. Refresh with \`npx @decidio/sdk context pull\`._`, "",
+    ].join("\n");
+}
+export function packRulesMarkdown(idx) {
+    const rows = Array.isArray(idx.rows) ? idx.rows : [];
+    const table = rows.length
+        ? ["| Record | Title | Type | Status | Lifecycle | Decided | Link |", "| --- | --- | --- | --- | --- | --- | --- |",
+            ...rows.map((r) => `| ${mdCell(r.recordId)} | ${mdCell(r.title)} | ${mdCell(r.type)} | ${mdCell(r.status)} | ${mdCell(r.lifecycle?.state)}${r.lifecycle?.inEffect === false ? " (not in effect)" : ""} | ${mdCell(String(r.decidedAt ?? "").slice(0, 10))} | ${mdCell(r.url)} |`)].join("\n")
+        : "_No entries you can read yet._";
+    const omitted = Number(idx.omitted ?? 0);
+    return [
+        `# ${String(idx.title)} (Decidio context pack - read first)`, "",
+        ...(packScopeLabel(idx.scope) ? [`**Scope:** ${packScopeLabel(idx.scope)}`, ""] : []),
+        `**Read this on every question in this project.** The pack's owner says it applies "${String(idx.trigger).replace(/"/g, "'")}".`, "",
+        "These are sealed Decidio decisions the pack's owner curated as standing context: the record of what was decided. Cite them by record id. Role tokens such as [COUNTERPARTY_1] are protective placeholders: never guess or restate what they stand for; for the full record open the link, or call get_decision on the Decidio connector. The other Decidio packs (the skills pulled beside this file) build on this one.", "",
+        table, "",
+        `_Pulled ${String(idx.asOf)} · pack hash ${String(idx.hash)} · ${rows.length} ${rows.length === 1 ? "entry" : "entries"} shown${omitted ? `, ${omitted} you cannot read omitted` : ""}. Refresh with \`npx @decidio/sdk context pull\`._`, "",
+    ].join("\n");
+}
+function packChatgptBlock(idx) {
+    const rows = Array.isArray(idx.rows) ? idx.rows : [];
+    return [
+        `## Decidio context pack: ${String(idx.title)}${idx.always ? " - READ FIRST, on every question" : ""}`,
+        `When to use: ${idx.always ? "always - read this before the other packs; the owner says " : ""}"${String(idx.trigger).replace(/"/g, "'")}"`,
+        "These are sealed decisions, by record id; cite them, never guess what a role token like [COUNTERPARTY_1] stands for. For the full record call get_context_pack / get_decision on the Decidio connector, or open the link.",
+        ...rows.map((r) => `- ${mdCell(r.recordId)} · ${mdCell(r.title)} · ${mdCell(r.type)} · ${mdCell(r.lifecycle?.state)} · ${mdCell(r.url)}`),
+        `(pulled ${String(idx.asOf)}, hash ${String(idx.hash)}${Number(idx.omitted ?? 0) ? `, ${idx.omitted} you cannot read omitted` : ""})`,
+    ].join("\n");
+}
+async function cmdContext(sub, pos, flags) {
+    const usage = () => { err(`usage: npx @decidio/sdk context list | create <slug> --title "…" --trigger "…" [--unit <unitId> | --org] | add <slug> <record…> | remove <slug> <record…> | trigger <slug> "<phrase>" | always <slug> on|off | delete <slug> | bind --unit <unitId> | pull [--here] [--pack <slug>] [--chatgpt]`); return 2; };
+    const slug = pos[0];
+    if (!sub)
+        return usage();
+    if (["create", "add", "remove", "trigger", "always", "delete"].includes(sub)) {
+        if (!slug)
+            return usage();
+        if (!PACK_SLUG_RE.test(slug)) {
+            err(`✘ a pack slug is 1-40 lower-case letters, digits or dashes, starting with a letter or digit (got "${slug}").`);
+            return 2;
+        }
+    }
+    if (sub === "create" && (!flags.title || !flags.trigger)) {
+        err(`✘ create needs --title "…" and --trigger "…" (the trigger is the user's own words for WHEN a model should use the pack, e.g. "whenever we discuss the ACME application").`);
+        return 2;
+    }
+    if ((sub === "add" || sub === "remove") && pos.length < 2) {
+        err(`✘ ${sub} needs at least one record (a D·number or decision id) after the slug.`);
+        return 2;
+    }
+    if (sub === "trigger" && !pos[1]) {
+        err(`✘ trigger needs the phrase: npx @decidio/sdk context trigger ${slug} "whenever we discuss …"`);
+        return 2;
+    }
+    if (sub === "always" && !["on", "off"].includes(pos[1] ?? "")) {
+        err(`✘ always takes on or off: npx @decidio/sdk context always ${slug} on   (read on every question, as a Claude Code rules file) · off (fires on its trigger only)`);
+        return 2;
+    }
+    if (sub === "pull" && flags.pack && !PACK_SLUG_RE.test(flags.pack)) {
+        err(`✘ --pack names a pack by its slug (got "${flags.pack}").`);
+        return 2;
+    }
+    const unitFlag = flags.unit ?? flags.team;
+    if (sub === "create" && ((flags.unit && flags.team) || (unitFlag && flags.org))) {
+        err(`✘ create takes one scope: --unit <unitId> (or --team), or --org - not both.`);
+        return 2;
+    }
+    if (unitFlag !== undefined && !/^[A-Za-z0-9_-]{1,64}$/.test(unitFlag)) {
+        err(`✘ --unit names a unit by its id (got "${unitFlag}").`);
+        return 2;
+    }
+    if (sub === "bind" && !flags.unit) {
+        err(`✘ bind needs --unit <unitId>: it writes .decidio.json here, so \`context pull --here\` pulls that unit's packs.`);
+        return 2;
+    }
+    if (!["list", "create", "add", "remove", "trigger", "always", "delete", "pull", "bind"].includes(sub))
+        return usage();
+    const session = await acquireSession("Context packs");
+    if (!session)
+        return 1;
+    const call = async (method, path, body) => api(path, { method, ...(body !== undefined ? { body: JSON.stringify(body) } : {}) }, session);
+    const refused = (r) => {
+        const words = r.body && typeof r.body === "object" && typeof r.body.error === "string" ? r.body.error : `HTTP ${r.status}`;
+        err(`✘ ${words}${r.body?.code ? ` (${r.body.code})` : ""}`);
+        return 1;
+    };
+    const showPack = (p) => log(`  ${p.slug}  ${packScopeLabel(p.scope) ?? (p.audience === "team" ? `team ${p.teamUnitId ?? ""}`.trim() : p.audience === "org" ? "the organisation" : "personal")}  ${p.entries} ${p.entries === 1 ? "entry" : "entries"}  "${p.title}"${p.always ? "  · read on every question" : ""}\n    when: ${p.trigger}`);
+    if (sub === "list") {
+        const r = await call("GET", "/api/context-packs");
+        if (r.status !== 200)
+            return refused(r);
+        const packs = Array.isArray(r.body?.packs) ? r.body.packs : [];
+        if (flags.json) {
+            log(JSON.stringify({ packs }, null, 2));
+            return 0;
+        }
+        if (!packs.length) {
+            log(`No context packs yet. Create one: npx @decidio/sdk context create <slug> --title "…" --trigger "whenever we discuss …"`);
+            return 0;
+        }
+        log(`${packs.length} context pack${packs.length === 1 ? "" : "s"}:`);
+        packs.forEach(showPack);
+        return 0;
+    }
+    if (sub === "create") {
+        const r = await call("POST", "/api/context-packs", { slug, title: flags.title, trigger: flags.trigger, ...(unitFlag ? { audience: "team", teamUnitId: unitFlag } : flags.org ? { audience: "org" } : { audience: "personal" }) });
+        if (r.status !== 201)
+            return refused(r);
+        if (flags.json) {
+            log(JSON.stringify(r.body, null, 2));
+            return 0;
+        }
+        log(`✔ created pack ${slug}`);
+        showPack(r.body.pack);
+        log(`  Its title and trigger are shared with the model IN CLEAR, every turn${flags.team ? ", and with everyone in the unit" : ""} - that is how the model knows when to use it. Keep people's names out of them; decisions inside stay tokenized.`);
+        log(`  Add decisions: npx @decidio/sdk context add ${slug} D·0412 D·0418   then: npx @decidio/sdk context pull`);
+        return 0;
+    }
+    if (sub === "add" || sub === "remove") {
+        const r = await call(sub === "add" ? "POST" : "DELETE", `/api/context-packs/${slug}/entries`, { ids: pos.slice(1) });
+        if (r.status !== 200)
+            return refused(r);
+        if (flags.json) {
+            log(JSON.stringify(r.body, null, 2));
+            return 0;
+        }
+        if (sub === "add")
+            log(`✔ ${r.body.added?.length ?? 0} added to ${slug} (${r.body.pack?.entries ?? "?"} entries now)${(r.body.added?.length ?? 0) < pos.length - 1 ? " - the rest were already in it" : ""}`);
+        else
+            log(`✔ ${r.body.removed ?? 0} removed from ${slug} (${r.body.pack?.entries ?? "?"} entries now)`);
+        return 0;
+    }
+    if (sub === "trigger") {
+        const r = await call("PATCH", `/api/context-packs/${slug}`, { trigger: pos.slice(1).join(" ") });
+        if (r.status !== 200)
+            return refused(r);
+        if (flags.json) {
+            log(JSON.stringify(r.body, null, 2));
+            return 0;
+        }
+        log(`✔ ${slug} now fires: ${r.body.pack?.trigger}`);
+        log(`  Re-pull to update the skill files: npx @decidio/sdk context pull`);
+        return 0;
+    }
+    if (sub === "always") {
+        const on = pos[1] === "on";
+        const r = await call("PATCH", `/api/context-packs/${slug}`, { always: on });
+        if (r.status !== 200)
+            return refused(r);
+        if (flags.json) {
+            log(JSON.stringify(r.body, null, 2));
+            return 0;
+        }
+        if (on) {
+            log(`✔ ${slug} is now read on every question: pull writes it as a Claude Code rules file (.claude/rules/${PACK_SKILL_PREFIX}${slug}.md, loaded whole at launch), not a skill. Keep it short - it is in context every turn.`);
+        }
+        else
+            log(`✔ ${slug} now fires on its trigger only (pull writes it back as a skill and removes the rules file)`);
+        log(`  Re-pull to update the files: npx @decidio/sdk context pull`);
+        return 0;
+    }
+    if (sub === "delete") {
+        const r = await call("DELETE", `/api/context-packs/${slug}`);
+        if (r.status !== 200)
+            return refused(r);
+        log(`✔ deleted pack ${slug} (its pulled skill files stay until you remove them: .claude/skills/${PACK_SKILL_PREFIX}${slug}/ here or in ${joinPath(claudeHome(), ".claude", "skills")}; an always-pack's .claude/rules/${PACK_SKILL_PREFIX}${slug}.md likewise)`);
+        return 0;
+    }
+    if (sub === "bind") {
+        const r = await call("GET", `/api/context-packs/here?unit=${encodeURIComponent(flags.unit)}`);
+        if (r.status !== 200)
+            return refused(r);
+        const tmpCfg = `.decidio.json.${process.pid}.tmp`;
+        writeFileSync(tmpCfg, JSON.stringify({ unit: flags.unit }, null, 2) + "\n", { flag: "wx" });
+        renameSync(tmpCfg, ".decidio.json");
+        const chain = Array.isArray(r.body?.scope?.chain) ? r.body.scope.chain : [];
+        log(`✔ wrote .decidio.json: this folder is ${chain.length ? chain.map((u) => packScopeLabel({ kind: "unit", unitType: u.type, unitName: u.name })).join(" → ") : `unit ${flags.unit}`}`);
+        log(`  Commit it so the team shares the scope; then: npx @decidio/sdk context pull --here`);
+        return 0;
+    }
+    let hereScope = null;
+    let r;
+    if (flags.here) {
+        const q = hereQuery();
+        if (q.error) {
+            err(`✘ ${q.error}`);
+            return 1;
+        }
+        r = await call("GET", `/api/context-packs/here${q.unit ? `?unit=${encodeURIComponent(q.unit)}` : q.repo ? `?repo=${encodeURIComponent(q.repo)}` : ""}`);
+        if (r.status !== 200)
+            return refused(r);
+        hereScope = r.body?.scope ?? null;
+    }
+    else {
+        r = await call("GET", "/api/context-packs");
+        if (r.status !== 200)
+            return refused(r);
+    }
+    let packs = Array.isArray(r.body?.packs) ? r.body.packs : [];
+    if (flags.pack) {
+        packs = packs.filter((p) => p.slug === flags.pack);
+        if (!packs.length) {
+            err(`✘ no context pack of yours is called "${flags.pack}" (npx @decidio/sdk context list shows them).`);
+            return 1;
+        }
+    }
+    if (!packs.length && !flags.here) {
+        log(`No context packs to pull. Create one: npx @decidio/sdk context create <slug> --title "…" --trigger "whenever we discuss …"`);
+        return 0;
+    }
+    packs = [...packs.filter((p) => p?.always === true), ...packs.filter((p) => p?.always !== true)];
+    const written = [];
+    let wroteProject = false;
+    for (const p of packs) {
+        if (typeof p?.slug !== "string" || !PACK_SLUG_RE.test(p.slug)) {
+            err(`✘ refusing a pack whose slug is not a slug (${JSON.stringify(String(p?.slug)).slice(0, 60)}) - nothing written for it.`);
+            continue;
+        }
+        const ix = await call("GET", `/api/context-packs/${p.slug}/index`);
+        if (ix.status !== 200)
+            return refused(ix);
+        const idx = ix.body;
+        const always = p.always === true;
+        idx.scope = p.scope ?? null;
+        if (flags.chatgpt) {
+            log(packChatgptBlock({ ...idx, always }));
+            log("");
+            continue;
+        }
+        const project = p.audience === "team" || p.audience === "org";
+        if (project && (!plainProjectPath(["skills", PACK_SKILL_PREFIX + p.slug, "SKILL.md"]) || !plainProjectPath(["rules", PACK_SKILL_PREFIX + p.slug + ".md"]))) {
+            err(`✘ refusing to write pack ${p.slug}: a path under .claude is a symbolic link - nothing written for it.`);
+            continue;
+        }
+        const base = project ? ".claude" : joinPath(claudeHome(), ".claude");
+        const dir = joinPath(base, "skills", PACK_SKILL_PREFIX + p.slug);
+        const rules = joinPath(base, "rules", PACK_SKILL_PREFIX + p.slug + ".md");
+        let path;
+        if (always) {
+            mkdirSync(joinPath(base, "rules"), { recursive: true });
+            writeFileSync(rules, packRulesMarkdown({ ...idx, always }));
+            rmSync(joinPath(dir, "SKILL.md"), { force: true });
+            try {
+                rmdirSync(dir);
+            }
+            catch { }
+            path = rules;
+        }
+        else {
+            mkdirSync(dir, { recursive: true });
+            writeFileSync(joinPath(dir, "SKILL.md"), packSkillMarkdown(idx));
+            rmSync(rules, { force: true });
+            path = joinPath(dir, "SKILL.md");
+        }
+        if (project)
+            wroteProject = true;
+        written.push({ slug: p.slug, path, rows: Array.isArray(idx.rows) ? idx.rows.length : 0, omitted: Number(idx.omitted ?? 0), hash: String(idx.hash), always });
+    }
+    if (flags.chatgpt) {
+        err(`· paste each block above into the ChatGPT Project's instructions (or wherever that host keeps standing context); the Decidio connector's get_context_pack returns the same list live.`);
+        return 0;
+    }
+    if (wroteProject)
+        ensurePackSkillsIgnored();
+    const removed = [];
+    if (flags.here && !flags.pack) {
+        const keep = new Set(written.map((w) => w.slug));
+        const skillsDir = joinPath(".claude", "skills"), rulesDir = joinPath(".claude", "rules");
+        const readText = (path) => { try {
+            return readFileSync(path, "utf8");
+        }
+        catch {
+            return "";
+        } };
+        if (existsSync(skillsDir) && plainProjectPath(["skills"]))
+            for (const d of readdirSync(skillsDir)) {
+                const slugOf = d.startsWith(PACK_SKILL_PREFIX) ? d.slice(PACK_SKILL_PREFIX.length) : "";
+                const file = joinPath(skillsDir, d, "SKILL.md");
+                if (!PACK_SLUG_RE.test(slugOf) || keep.has(slugOf) || !plainProjectPath(["skills", d, "SKILL.md"]) || !existsSync(file))
+                    continue;
+                if (!isPackFileOf(readText(file), slugOf, "skill") || gitTracked(file))
+                    continue;
+                rmSync(file, { force: true });
+                try {
+                    rmdirSync(joinPath(skillsDir, d));
+                }
+                catch { }
+                removed.push(slugOf);
+            }
+        if (existsSync(rulesDir) && plainProjectPath(["rules"]))
+            for (const f of readdirSync(rulesDir)) {
+                const m = /^decidio-([a-z0-9][a-z0-9-]{0,39})\.md$/.exec(f);
+                const file = joinPath(rulesDir, f);
+                if (!m || keep.has(m[1]) || !plainProjectPath(["rules", f]) || !isPackFileOf(readText(file), m[1], "rules") || gitTracked(file))
+                    continue;
+                rmSync(file, { force: true });
+                if (!removed.includes(m[1]))
+                    removed.push(m[1]);
+            }
+    }
+    if (flags.json) {
+        log(JSON.stringify({ written, ...(flags.here ? { scope: hereScope, removed } : {}) }, null, 2));
+        return 0;
+    }
+    if (flags.here) {
+        const chain = Array.isArray(hereScope?.chain) ? hereScope.chain : [];
+        const where = chain.length ? chain.map((u) => packScopeLabel({ kind: "unit", unitType: u.type, unitName: u.name })).join(" → ") : hereScope?.source === "repo" ? "a repository in no unit of Decidio" : "no unit";
+        log(`Here: the organisation → ${where}${!chain.length ? " (the organisation's packs and your own)" : ""}`);
+        if (!written.length)
+            log(`No context packs apply here.`);
+    }
+    for (const w of written)
+        log(`✔ ${w.path.split(pathSep).join("/")}  (${w.rows} ${w.rows === 1 ? "entry" : "entries"}${w.omitted ? `, ${w.omitted} you cannot read omitted` : ""}; hash ${w.hash}${w.always ? "; read on every question" : ""})`);
+    if (removed.length)
+        log(`✔ removed ${removed.length} pack file${removed.length === 1 ? "" : "s"} that ${removed.length === 1 ? "does" : "do"} not apply here: ${removed.join(", ")}`);
+    log(`  Claude Code loads each pack's trigger line every turn and the list only when the trigger applies${written.some((w) => w.always) ? "; an always-pack (.claude/rules) is loaded whole at launch" : ""}. Re-run after curating.`);
+    return 0;
+}
+const ADR_TAKE = new Set(["accepted", "approved", "adopted", "decided"]);
+export function parseAdr(text) {
+    let body = text.replace(/\r\n/g, "\n");
+    let status = null;
+    const fm = /^---\n([\s\S]*?)\n---\n/.exec(body);
+    if (fm) {
+        const st = /^status:\s*["']?([A-Za-z]+)/im.exec(fm[1]);
+        if (st)
+            status = st[1].toLowerCase();
+        body = body.slice(fm[0].length);
+    }
+    const titleLine = /^#\s+(.+)$/m.exec(body);
+    if (!titleLine)
+        return null;
+    const title = titleLine[1].replace(/^(?:ADR[-\s]?)?\d+[:.\-)]?\s*/i, "").replace(/[*_`]/g, "").trim().slice(0, 200);
+    if (!title)
+        return null;
+    const sections = new Map();
+    const parts = body.split(/^##\s+/m).slice(1);
+    for (const part of parts) {
+        const nl = part.indexOf("\n");
+        const head = (nl < 0 ? part : part.slice(0, nl)).trim().toLowerCase();
+        sections.set(head, (nl < 0 ? "" : part.slice(nl + 1)).trim());
+    }
+    const pick = (...names) => { for (const [h, v] of sections)
+        if (names.some((n) => h === n || h.startsWith(n)))
+            return v; return ""; };
+    if (!status) {
+        const inline = /^\s*\**status\**\s*:\s*\**\s*([A-Za-z]+)/im.exec(body);
+        const sec = pick("status").split("\n").map((l) => l.replace(/[*_`\-]/g, "").trim()).find(Boolean);
+        status = (inline?.[1] ?? sec?.split(/\s+/)[0] ?? "").toLowerCase() || null;
+    }
+    const clean = (t, max) => t.replace(/\n{3,}/g, "\n\n").trim().slice(0, max);
+    const consequences = pick("consequences");
+    const context = pick("context and problem statement", "context");
+    const rationale = clean([context, consequences ? `Consequences: ${consequences}` : ""].filter(Boolean).join("\n\n"), 4000);
+    const decided = clean(pick("decision outcome", "decision"), 4000);
+    const alternatives = pick("considered options", "options considered", "alternatives", "options").split("\n")
+        .map((l) => /^\s*(?:[-*+]|\d+\.)\s+(.+)$/.exec(l)?.[1]?.replace(/[*_`]/g, "").trim() ?? "").filter(Boolean).slice(0, 30).map((x) => x.slice(0, 1000));
+    return { title, status, decided, rationale, alternatives };
+}
+async function cmdDecisionsImport(dir, dryRun) {
+    if (!dir) {
+        err("✘ import needs --adr <folder of ADR markdown files>, e.g. --adr docs/adr");
+        return 2;
+    }
+    const abs = resolvePath(dir);
+    let files;
+    try {
+        files = readdirSync(abs).filter((f) => /\.md$/i.test(f) && !/^(readme|index|template)/i.test(f)).sort().slice(0, 200);
+    }
+    catch {
+        err(`✘ ${dir} is not a folder this command can read.`);
+        return 1;
+    }
+    let repoKey = "";
+    try {
+        repoKey = execFileSync("git", ["remote", "get-url", "origin"], { cwd: abs, timeout: 3000, stdio: ["ignore", "pipe", "ignore"], encoding: "utf8" }).trim();
+    }
+    catch {
+        repoKey = "";
+    }
+    let root = abs;
+    try {
+        root = execFileSync("git", ["rev-parse", "--show-toplevel"], { cwd: abs, timeout: 3000, stdio: ["ignore", "pipe", "ignore"], encoding: "utf8" }).trim() || abs;
+    }
+    catch {
+        root = abs;
+    }
+    const take = [], skipped = [];
+    for (const f of files) {
+        const p = joinPath(abs, f);
+        try {
+            if (lstatSync(p).isSymbolicLink() || statSync(p).size > 200_000) {
+                skipped.push(`${f} (not a plain file under 200 KB)`);
+                continue;
+            }
+        }
+        catch {
+            continue;
+        }
+        const adr = parseAdr(readFileSync(p, "utf8"));
+        if (!adr) {
+            skipped.push(`${f} (no "# title")`);
+            continue;
+        }
+        if (adr.status && !ADR_TAKE.has(adr.status)) {
+            skipped.push(`${f} (${adr.status})`);
+            continue;
+        }
+        if (!adr.decided && !adr.rationale) {
+            skipped.push(`${f} (no decision or context section)`);
+            continue;
+        }
+        const rel = relative(root, p).split(pathSep).join("/");
+        take.push({ file: f, adr, key: `adr:${createHash("sha256").update(`${repoKey || root}\u0000${rel}`).digest("hex").slice(0, 16)}` });
+    }
+    if (dryRun) {
+        for (const t of take)
+            log(`would import ${t.file}: "${t.adr.title}"${t.adr.alternatives.length ? ` (${t.adr.alternatives.length} options considered)` : ""}`);
+        for (const s of skipped)
+            log(`would skip ${s}`);
+        log(`${take.length} to import as drafts, ${skipped.length} skipped. Nothing was sent.`);
+        return 0;
+    }
+    if (!take.length) {
+        log(`Nothing to import (${skipped.length} skipped${skipped.length ? `: ${skipped.slice(0, 5).join("; ")}` : ""}).`);
+        return 0;
+    }
+    const session = await acquireSession("Importing decision records");
+    if (!session)
+        return 1;
+    const call = async (method, path, body) => api(path, { method, ...(body !== undefined ? { body: JSON.stringify(body) } : {}) }, session);
+    const me = await call("GET", "/api/me");
+    const userId = typeof me.body?.userId === "string" ? me.body.userId : null;
+    if (!userId) {
+        err("✘ sign in as yourself first (npx @decidio/sdk login) - an imported draft is owned by the person who imports it.");
+        return 1;
+    }
+    let made = 0, again = 0, failed = 0;
+    for (const t of take) {
+        const c = await call("POST", "/api/decisions", { type: "deliberation", title: t.adr.title, ownerId: userId, draft: true, sourceSystem: "adr", sourceExternalId: t.key, tags: ["adr"] });
+        if (c.status === 409 && c.body?.code === "ALREADY_IMPORTED") {
+            again++;
+            log(`· ${t.file}: imported before - kept as it is`);
+            continue;
+        }
+        const id = typeof c.body?.id === "string" ? c.body.id : null;
+        if (c.status !== 201 || !id) {
+            failed++;
+            err(`✘ ${t.file}: ${c.body?.message ?? c.body?.error ?? `HTTP ${c.status}`}`);
+            continue;
+        }
+        const body = {};
+        if (t.adr.decided)
+            body.decided = t.adr.decided;
+        if (t.adr.rationale)
+            body.rationale = t.adr.rationale;
+        if (t.adr.alternatives.length)
+            body.alternatives = t.adr.alternatives;
+        const w = await call("POST", `/api/decisions/${encodeURIComponent(id)}/complete`, body);
+        if (w.status >= 300) {
+            failed++;
+            err(`✘ ${t.file}: the draft was made but its text was not saved (${w.body?.message ?? `HTTP ${w.status}`}) - open it in Decidio`);
+            continue;
+        }
+        made++;
+        log(`✔ ${t.file} → a draft: "${t.adr.title}"`);
+    }
+    log(`${made} imported as drafts, ${again} imported before, ${failed} failed, ${skipped.length} skipped. Review and seal them in Decidio (the Queue): only sealed decisions are cited.`);
+    return failed ? 1 : 0;
+}
+const GH_ENV_RE = /^[A-Za-z0-9._-]{1,64}$/;
+const GH_DECISION_RE = /^[A-Za-z0-9_-]{8,64}$/;
+const GH_WORKFLOW_RE = /^\.github\/workflows\/[A-Za-z0-9._-]{1,100}\.ya?ml$/;
+const GH_JUSTIFICATION_MAX = 280;
+export const AGENTS_MD_START = "<!-- decidio:start -->";
+export const AGENTS_MD_END = "<!-- decidio:end -->";
+async function actionsOidcToken() {
+    const url = process.env.ACTIONS_ID_TOKEN_REQUEST_URL, tok = process.env.ACTIONS_ID_TOKEN_REQUEST_TOKEN;
+    if (!url || !tok) {
+        err("✘ no GitHub OIDC token here: run this inside a GitHub Actions job whose workflow sets `permissions: id-token: write`.");
+        return null;
+    }
+    const aud = (process.env.DECIDIO_GITHUB_OIDC_AUDIENCE ?? "decidio").trim() || "decidio";
+    let u;
+    try {
+        u = new URL(url);
+    }
+    catch {
+        err("✘ ACTIONS_ID_TOKEN_REQUEST_URL is not a URL - nothing was sent.");
+        return null;
+    }
+    if (u.protocol !== "https:" && !(u.protocol === "http:" && (u.hostname === "127.0.0.1" || u.hostname === "localhost"))) {
+        err("✘ GitHub's token service must be https - nothing was sent.");
+        return null;
+    }
+    u.searchParams.set("audience", aud);
+    try {
+        const r = await fetch(u, { headers: { authorization: `bearer ${tok}`, accept: "application/json" } });
+        const j = await r.json().catch(() => null);
+        if (!r.ok || typeof j?.value !== "string" || !j.value) {
+            err(`✘ GitHub did not issue an OIDC token (${r.status}) - nothing was sent to Decidio.`);
+            return null;
+        }
+        return j.value;
+    }
+    catch (e) {
+        err(`✘ could not reach GitHub's token service (${e?.cause?.code ?? e?.message ?? "network error"}) - nothing was sent to Decidio.`);
+        return null;
+    }
+}
+async function cmdGithubRequest(environment, justification) {
+    if (!environment || !GH_ENV_RE.test(environment)) {
+        err("✘ request needs --environment <name>: one of the environments the repository was bound with (letters, digits, . _ -).");
+        return 2;
+    }
+    if (justification !== undefined && (!justification.trim() || justification.length > GH_JUSTIFICATION_MAX || /[\r\n]/.test(justification))) {
+        err(`✘ --justification is one line of up to ${GH_JUSTIFICATION_MAX} characters.`);
+        return 2;
+    }
+    const token = await actionsOidcToken();
+    if (!token)
+        return 1;
+    const r = await api("/api/github/runs/request", { method: "POST", headers: { "x-decidio-client": `sdk/${VERSION}` }, body: JSON.stringify({ environment, ...(justification ? { justification: justification.trim() } : {}) }) }, token);
+    const b = (r.body && typeof r.body === "object" ? r.body : {});
+    const ref = `${b.displayNumber ?? b.decisionId ?? ""}${b.url ? ` ${b.url}` : ""}`.trim();
+    if (r.status === 200 && (b.decision === "route" || b.decision === "proceed")) {
+        log(b.decision === "proceed"
+            ? `✔ ${environment}: no approval needed - Decidio starts the deploy (${ref})`
+            : `✔ asked: a teammate approves ${environment} in Decidio, then Decidio starts the deploy. This job is done (${ref})`);
+        if (b.existing)
+            log("  An approval request for this commit was already open - that one stands.");
+        return 0;
+    }
+    if (r.status === 200 && b.decision === "duplicate") {
+        err(`✘ ${String(b.error ?? "a person refused this commit before")}`);
+        err(`  To ask again, say what changed: npx @decidio/sdk github request --environment ${environment} --justification "<what changed>"`);
+        return 1;
+    }
+    if (r.status === 200 && b.decision === "block") {
+        err(`✘ the workspace's policy blocks this deploy (${ref}).`);
+        return 1;
+    }
+    err(`✘ Decidio refused the request (${r.status}${b.code ? ` ${b.code}` : ""}): ${String(b.error ?? "no reason given")}`);
+    return 1;
+}
+async function cmdGithubVerify(decisionArg) {
+    const decision = (decisionArg ?? process.env.DECIDIO_DECISION ?? "").trim();
+    if (!GH_DECISION_RE.test(decision)) {
+        err("✘ verify needs the decision id Decidio dispatched: set DECIDIO_DECISION to ${{ inputs.decidio }} (or pass --decision). Do not deploy.");
+        return 2;
+    }
+    const token = await actionsOidcToken();
+    if (!token) {
+        err("  Do not deploy.");
+        return 1;
+    }
+    const r = await api("/api/github/runs/verify", { method: "POST", headers: { "x-decidio-client": `sdk/${VERSION}` }, body: JSON.stringify({ decision }) }, token);
+    const b = (r.body && typeof r.body === "object" ? r.body : {});
+    if (r.status === 200 && b.ok === true && typeof b.sha === "string" && /^[0-9a-f]{40}$/.test(b.sha)) {
+        const out = process.env.GITHUB_OUTPUT;
+        if (out)
+            appendFileSync(out, `sha=${b.sha}\ndecision=${decision}\n`);
+        log(`✔ approved: deploy ${b.sha.slice(0, 12)} to ${String(b.environment ?? "")} (${b.displayNumber ?? decision}). This approval is now used.`);
+        return 0;
+    }
+    err(`✘ not approved - do not deploy (${r.status}${b.code ? ` ${b.code}` : ""}): ${String(b.error ?? "no reason given")}`);
+    return 1;
+}
+function plainRepoPath(root, rel) {
+    let p = root;
+    for (const part of rel.split("/")) {
+        p = joinPath(p, part);
+        try {
+            if (lstatSync(p).isSymbolicLink())
+                return false;
+        }
+        catch { }
+    }
+    return true;
+}
+export const DECIDIO_ACTION = "OmniTwin/decidio-actions@e40ba8e75a223f2475038d38a16df5a5885afde4 # v1.0.0";
+export const CHECKOUT_ACTION = "actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0";
+export function githubRequestWorkflow(api, environment, branch = "main") {
+    return `# Written by npx @decidio/sdk github init. Asks a teammate to approve each deploy; Decidio starts the deploy workflow once
+# approved. No repository secret: the job's own OIDC token is the credential.
+name: Ask Decidio to deploy
+on:
+  push:
+    branches: [${branch}]
+permissions:
+  id-token: write
+  contents: read
+jobs:
+  ask:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: ${DECIDIO_ACTION}
+        with:
+          step: request
+          environment: ${environment}
+          api-url: ${api}
+`;
+}
+export function githubVerifySteps(api) {
+    return `      - id: decidio
+        uses: ${DECIDIO_ACTION}
+        with:
+          step: verify
+          decision: \${{ inputs.decidio }}
+          api-url: ${api}
+      - uses: ${CHECKOUT_ACTION}
+        with:
+          ref: \${{ steps.decidio.outputs.sha }}
+`;
+}
+export function githubDeployWorkflow(api, environment) {
+    return `# Written by npx @decidio/sdk github init. Decidio starts this workflow once the deploy is approved; its first step proves the
+# approval (once, for this commit and environment) before anything deploys. Restrict who may run it to the Decidio app in the
+# repository's workflow execution protections.
+name: Deploy
+run-name: Decidio \${{ inputs.decidio }}
+on:
+  workflow_dispatch:
+    inputs:
+      decidio:
+        description: Set by Decidio
+        required: true
+permissions:
+  id-token: write
+  contents: read
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    environment: ${environment}
+    steps:
+${githubVerifySteps(api)}      - name: Deploy
+        run: ./deploy.sh   # your deploy command
+`;
+}
+export function agentsMdSection(appUrl) {
+    return `${AGENTS_MD_START}
+## Decisions (Decidio)
+
+This repository's sealed decisions live in Decidio (${appUrl}); sign in to read the ones you may see. An agent connected to
+Decidio's MCP server calls \`check_plan\` with its plan before acting: it answers which decisions the plan would contradict.
+Nothing of a decision is kept in this file.
+${AGENTS_MD_END}
+`;
+}
+export function withAgentsMdSection(text, section) {
+    const m = new RegExp(`${AGENTS_MD_START}\\r?\\n## Decisions \\(Decidio\\)\\r?\\n`).exec(text);
+    const a = m ? m.index : -1, b = m ? text.indexOf(AGENTS_MD_END, a + m[0].length) : -1;
+    if (a >= 0 && b > a)
+        return text.slice(0, a) + section.trimEnd() + text.slice(b + AGENTS_MD_END.length);
+    return `${text}${text && !text.endsWith("\n") ? "\n" : ""}${text ? "\n" : ""}${section}`;
+}
+async function cmdGithubInit(opts) {
+    const environment = opts.environment ?? "production", workflow = opts.workflow ?? ".github/workflows/deploy.yml";
+    if (!GH_ENV_RE.test(environment)) {
+        err("✘ --environment is the environment the deploy job declares (letters, digits, . _ -).");
+        return 2;
+    }
+    if (!GH_WORKFLOW_RE.test(workflow)) {
+        err("✘ --workflow is the deploy workflow's path, .github/workflows/<name>.yml");
+        return 2;
+    }
+    const apiUrl = (opts.api ?? process.env.DECIDIO_API_URL ?? DEFAULT_API).replace(/\/$/, "");
+    try {
+        assertSafeTransport(apiUrl, true);
+    }
+    catch (e) {
+        err(`✘ ${String(e?.message ?? e).replace(/^\[decidio\] /, "")}`);
+        return 2;
+    }
+    if (!/^https?:\/\/[A-Za-z0-9.-]+(?::\d+)?$/.test(apiUrl)) {
+        err("✘ --api is the Decidio API's origin, e.g. https://decidio-api.onrender.com");
+        return 2;
+    }
+    let root;
+    try {
+        root = execFileSync("git", ["rev-parse", "--show-toplevel"], { timeout: 3000, stdio: ["ignore", "pipe", "ignore"], encoding: "utf8" }).trim();
+    }
+    catch {
+        err("✘ run this inside the repository's checkout (git could not find its root).");
+        return 1;
+    }
+    if (!root) {
+        err("✘ run this inside the repository's checkout (git could not find its root).");
+        return 1;
+    }
+    let branch = "main";
+    try {
+        const head = execFileSync("git", ["symbolic-ref", "--short", "refs/remotes/origin/HEAD"], { cwd: root, timeout: 3000, stdio: ["ignore", "pipe", "ignore"], encoding: "utf8" }).trim().replace(/^origin\//, "");
+        if (/^[A-Za-z0-9._\/-]{1,100}$/.test(head) && !head.includes(".."))
+            branch = head;
+    }
+    catch { }
+    const write = (rel, text) => {
+        if (!plainRepoPath(root, rel))
+            return "refused";
+        const abs = joinPath(root, rel);
+        if (existsSync(abs))
+            return "kept";
+        mkdirSync(joinPath(abs, ".."), { recursive: true });
+        writeFileSync(abs, text, { flag: "wx" });
+        return "written";
+    };
+    const said = (rel, w, what) => w === "written" ? log(`✔ wrote ${rel} - ${what}`) : w === "kept" ? log(`· ${rel} already exists - kept as it is`) : err(`✘ ${rel}: a symbolic link is on its path - nothing was written through it`);
+    const reqRel = ".github/workflows/decidio-request.yml";
+    said(reqRel, write(reqRel, githubRequestWorkflow(apiUrl, environment, branch)), `asks for approval on every push to ${branch} (edit the trigger to suit)`);
+    const dep = write(workflow, githubDeployWorkflow(apiUrl, environment));
+    said(workflow, dep, "the deploy Decidio starts once approved (replace ./deploy.sh with your deploy)");
+    if (dep === "kept") {
+        log(`  Your deploy workflow must: run on workflow_dispatch with an input named decidio; set permissions id-token: write;`);
+        log(`  declare environment: ${environment}; and make these its FIRST steps (they check out the approved commit):`);
+        for (const line of githubVerifySteps(apiUrl).trimEnd().split("\n"))
+            log(`  ${line}`);
+    }
+    const agentsRel = "AGENTS.md", agentsAbs = joinPath(root, agentsRel);
+    const appUrl = (process.env.DECIDIO_APP_URL || apiUrl.replace(/^https:\/\/(decidio-api\.onrender\.com|mcp\.decidioai\.com)$/, "https://app.decidioai.com")).replace(/\/$/, "");
+    const section = agentsMdSection(appUrl);
+    if (!plainRepoPath(root, agentsRel))
+        err(`✘ ${agentsRel} is a symbolic link - nothing was written through it`);
+    else if (existsSync(agentsAbs) || opts.agentsMd) {
+        const before = existsSync(agentsAbs) ? readFileSync(agentsAbs, "utf8") : "";
+        const after = withAgentsMdSection(before, section);
+        if (after !== before) {
+            writeFileSync(agentsAbs, after);
+            log(`✔ ${agentsRel}: a link to Decidio for agents (no decision text)`);
+        }
+        else
+            log(`· ${agentsRel} already links to Decidio`);
+    }
+    else
+        log(`· no AGENTS.md here - add --agents-md to create one with a link to Decidio for agents (no decision text)`);
+    log("");
+    log("Next:");
+    log(`  1. In Decidio: Connect → GitHub approvals → bind this repository with ${workflow} and the environment ${environment}.`);
+    log(`  2. In the repository's settings: restrict who may run ${workflow} to the Decidio app (workflow execution protections),`);
+    log(`     so a deploy runs only when Decidio starts it.`);
+    log(`  3. Commit the workflows and push: the first push to ${branch} asks a teammate.`);
+    return 0;
+}
+const USAGE = `✦ Decidio — the SDK command line
+
+  The wrapper IS the SDK: guard.protect(fn, describe) ships in this package (import { guard } from "@decidio/sdk").
+  This command line is the tour, the sign-in, and the token admin around it.
+
+  New here? See the whole thing work in about two minutes:
+
+      npx @decidio/sdk quickstart
+
+  With no sign-in on this computer it first asks ONE question - do you have an invite? - and, if you do,
+  what next: the tour, or wiring up your own agent. Every answer shows the command it stands for. The bare
+  npx @decidio/sdk on a terminal asks the same (skipping the invite question when you are signed in).
+
+  It gates a demo action, routes it to YOU for approval, executes on your yes, and hands you a
+  cryptographically verifiable receipt of the DECISION (execution evidence then accrues on the
+  hosted record — the receipt seals who authorized what, not what ran afterward). Guided and
+  explicit — this CLI never acts, signs you in, or writes files unless you ask it to.
+
+THE TOUR
+  npx @decidio/sdk quickstart          the guided two-minute tour: gate → approve → execute → proof
+                                       (interactive: y approves, n rejects - Enter is not an answer. Headless it stops
+                                       at the routed decision; --auto-approve-demo for CI, labeled
+                                       automated; ends with a keep-or-cleanup choice; --explain prints
+                                       the long narration of each step; --phone web makes the QR open
+                                       the phone web rendering even when the Decidio app is installed)
+  npx @decidio/sdk quickstart cleanup  revoke the tour's token + delete its local credentials (the inert
+                                       registration row and the permanent sealed record stay)
+                                       (and end the stored sign-in)
+  npx @decidio/sdk quickstart --auto-approve-demo   headless tour; cleans up after itself
+  npx @decidio/sdk quickstart --demo   the same tour against a LOCAL stand-in of the API — no account needed; the
+                                       web/phone door is a hosted demo page; the receipt is the one thing kept
+                                       (--keep-agent is refused here: nothing of the demo's can be kept)
+
+SIGN IN (once)
+  npx @decidio/sdk login [email]       sign in ONCE: the CLI emails you an 8-character code, you type it; the sign-in
+                                       is kept on this computer 30 days, or until this terminal closes, logout, or cleanup
+  npx @decidio/sdk logout              forget the stored sign-in on this computer (the token itself stays valid
+                                       until it expires — there is no server-side revocation yet)
+
+YOUR AGENT AND ITS TOKENS
+  npx @decidio/sdk init [agentId]      sign in, register the agent, mint its API token, write .env
+                                       (agentId defaults to this folder's name; any name works - it is how the
+                                       workspace shows the request and the key .env is written under)
+                                       --unique  append a random suffix (collision-proof samples)
+                                       --force   replace a different agent already in this .env
+                                                 (its .env is backed up first)
+                                       --expires-days N   agent-token lifetime (default 90)
+  npx @decidio/sdk doctor              check config, connectivity, and what your token can do
+  npx @decidio/sdk tokens list [--mine]   agent tokens with status (active/expired/REVOKED) by
+                                       jti — token values are never re-shown; the list is
+                                       workspace-wide, --mine narrows to this directory's agent
+  npx @decidio/sdk tokens revoke <jti> kill a token now instead of waiting out its lifetime
+
+APPROVALS AND RECEIPTS
+  npx @decidio/sdk approvals [--json] [--mine]   list pending agent approvals
+  npx @decidio/sdk approvals approve <id> [reason]
+  npx @decidio/sdk approvals reject <id> [reason]
+                                       the reason is FREE TEXT, sent exactly as typed. It seals
+                                       immutably; personal or sensitive values are tokenized at
+                                       rest, so the STORED text can differ (see: receipt <id>).
+                                       If it starts with a dash, put it after -- or use --reason:
+                                         ... approve <id> -- "-50% cut, per the board"
+                                         ... approve <id> --reason "-50% cut, per the board"
+  npx @decidio/sdk receipt <id> [--json]   download a sealed decision's Authority Receipt to a .json FILE; --json prints
+                                       a summary to stdout (file name, evidence, issuer, the identities you may see) -
+                                       the credential itself is the file
+  npx @decidio/sdk verify [--issuer <did>] <receipt.json> [more...]   verify receipts OFFLINE, pinned to a trust
+                                       anchor it prints first: --issuer if given, else the DID this computer remembered
+                                       for your Decidio when you signed in, else the built-in hosted-service issuer
+                                       (never the receipt's own issuer field; --allow-unpinned: structural check only)
+
+CODING AGENTS (Claude Code)
+  npx @decidio/sdk hook install [--project] [--approver <email>] [--cli <path>]
+                                       a person approves Claude Code's destructive shell commands before they run
+                                       (rm -rf, git push --force, DROP TABLE, terraform apply, kubectl delete,
+                                       npm publish, curl | sh, ...): writes the PreToolUse/PostToolUse hooks into
+                                       .claude/settings.local.json (--project: the shared .claude/settings.json;
+                                       --cli: run that CLI file from the hook instead of this one). --approver
+                                       mints a single-use invite and prints WhatsApp / SMS / email share links.
+  npx @decidio/sdk hook wait <decision-id> [--timeout 600]
+                                       wait for the approver's decision the hook named, then retry the command
+                                       (exit 0 approved · 3 rejected or blocked · 1 still pending)
+  npx @decidio/sdk hook justify <decision-id> "<what changed>"
+                                       when the hook says a command looks like a duplicate of a request a person already
+                                       refused: store the user's one-line reason it is different, then retry the same
+                                       command - the request reaches the approver with that reason beside the refusal
+  npx @decidio/sdk hook rules          the command patterns the hook gates (DECIDIO_HOOK_EXTRA_RULES adds yours)
+  npx @decidio/sdk hook pretool|posttool   the hooks themselves: run by Claude Code with the tool call as JSON on
+                                       stdin, never by hand. A gated command is held up to DECIDIO_HOOK_HOLD_MS
+                                       (90 s; at most 120 s) for the approver, then refused with its decision id; the SAME command
+                                       retried after approval runs once - its execution is recorded and that
+                                       approval is spent. No credentials, no gate, no answer = refused (fail closed).
+
+CONTEXT PACKS (Claude Code, Claude.ai, ChatGPT)
+  npx @decidio/sdk context create <slug> --title "ACME application" --trigger "whenever we discuss the ACME application"
+                                       a pack: YOUR curated list of sealed decisions and the words that tell a model when
+                                       to use it. The title and trigger are shared with the model IN CLEAR, every turn
+                                       (that is how it matches); the decisions inside stay tokenized. --team <unitId>
+                                       makes it the unit's: readable by its people, its words shared with all of them,
+                                       holding only decisions the whole unit may read
+  npx @decidio/sdk context add <slug> D·0412 D·0418     add sealed decisions (D·numbers or ids) · remove takes them out
+  npx @decidio/sdk context trigger <slug> "<phrase>"   change when it fires · delete <slug> · list [--json]
+  npx @decidio/sdk context always <slug> on|off        a FOUNDATION pack (how we work, the architecture): read on every
+                                       question, whatever the trigger - up to two per workspace, 20 records each, so the
+                                       other packs can build on it without repeating it. Pulled as a Claude Code rules
+                                       file (.claude/rules/decidio-<slug>.md, loaded whole at launch); the connector's
+                                       list_packs inlines it for ChatGPT and Claude.ai.
+  npx @decidio/sdk context pull [--here] [--pack <slug>] [--chatgpt]
+  npx @decidio/sdk context bind --unit <unitId>     (this folder's unit, in .decidio.json: --here pulls its packs)
+                                       write each pack as a Claude Code skill: a team pack to .claude/skills/decidio-<slug>/
+                                       (git-ignored - each reader pulls their own), a personal one to ~/.claude/skills/.
+                                       The trigger is the skill's one-line description; the decisions load only when it
+                                       applies. --chatgpt prints paste-ready blocks instead (a ChatGPT Project's
+                                       instructions), always-packs first; the connector returns the same lists live.
+
+DECISIONS FROM A REPOSITORY
+  npx @decidio/sdk decisions import --adr <folder> [--dry-run]
+                                       each ACCEPTED architecture decision record (MADR or Nygard markdown) becomes a DRAFT
+                                       decision you review and seal in Decidio - never sealed here; proposed, rejected,
+                                       superseded and deprecated ones are listed, not imported; a re-run finds earlier
+                                       imports (keyed by repository and path); --dry-run sends nothing
+
+GITHUB DEPLOY APPROVALS (the Decidio GitHub App)
+  npx @decidio/sdk github init [--environment production] [--workflow .github/workflows/deploy.yml] [--api <origin>] [--agents-md]
+                                       in a repository's checkout: writes the workflow that asks for approval
+                                       (.github/workflows/decidio-request.yml) and the deploy workflow when there is none
+                                       (an existing one is never changed: init prints the steps to add), both using
+                                       Decidio's GitHub Action pinned to its v1.0.0 commit; adds a link to Decidio for agents to AGENTS.md (--agents-md creates it) -
+                                       never a decision's text
+  npx @decidio/sdk github request --environment <name> [--justification "<what changed>"]
+                                       inside a GitHub Actions job (permissions id-token: write): ask a teammate to approve
+                                       deploying this commit; the job ends at once - Decidio starts the deploy when approved
+  npx @decidio/sdk github verify [--decision <id>]   the deploy job's first step: proves the approval once for this run,
+                                       commit and environment, and writes sha= to $GITHUB_OUTPUT; anything else exits 1 -
+                                       do not deploy (DECIDIO_DECISION carries the decidio input)
+
+DEVELOPMENT
+  npx @decidio/sdk dev [--target URL] [--port N]   local relay for the resume webhook
+  npx @decidio/sdk --version           print the CLI version
+
+NOTES
+  Every NETWORK command talks to the hosted sandbox (https://decidio-api.onrender.com) unless
+  DECIDIO_API_URL says otherwise; the target host is announced on stderr each run. "verify" is
+  fully offline — it touches no network and reads no .env (only the issuer DIDs remembered at sign-in).
+  Update check: network commands (and the bare command on a terminal) ask the public npm registry once a day
+  whether a newer version exists. If so,
+  an interactive run asks "Upgrade now? [y/n]" first (y upgrades the way you installed - global, or in the
+  project for a local install; under npx it prints the @latest form - and re-runs your command; n exits); a headless
+  run prints the notice and continues (DECIDIO_REQUIRE_LATEST=1 makes it exit). DECIDIO_NO_UPDATE_CHECK=1 skips
+  the check. Nothing is sent to Decidio; verify never checks.
+  Help: --help (or -h) after any command prints this page - one page for every command.
+  Exit codes: 0 success · 1 failure or honest no-op (e.g. replay refused) · 2 usage error ·
+  3 quickstart stopped at the human moment (headless: routed, but nothing executed and no
+  receipt written — pass --auto-approve-demo for a run that completes unattended), or
+  hook wait: the approver said no. hook pretool/posttool always exit 0 (their answer is the JSON).
+  Errors, and usage shown on ERROR paths, go to stderr; stdout carries results only (safe to
+  pipe). Asked-for help — including this bare invocation — IS a result, so it prints here.
+  Docs: the README that shipped with this package — node_modules/@decidio/sdk/README.md
+  (quickstart, durable resume, workers, adapters).`;
+const GATED_CMDS = new Set(["quickstart", "init", "login", "doctor", "approvals", "receipt", "tokens", "context"]);
+function semverNewer(a, b) {
+    const parse = (s) => (/^\d+\.\d+\.\d+$/.test(s) ? s.split(".").map((x) => parseInt(x, 10)) : null);
+    const pa = parse(a), pb = parse(b);
+    if (!pa || !pb)
+        return false;
+    for (let i = 0; i < 3; i++)
+        if (pa[i] !== pb[i])
+            return pa[i] > pb[i];
+    return false;
+}
+async function latestPublished() {
+    const cache = joinPath(sessionDir(), "update-check.json");
+    try {
+        const c = JSON.parse(readFileSync(cache, "utf8"));
+        if (c && typeof c.latest === "string" && /^\d+\.\d+\.\d+$/.test(c.latest) && Date.now() - Number(c.checkedAt) < 24 * 3600 * 1000)
+            return c.latest;
+    }
+    catch { }
+    const reg = (SHELL_ENV.DECIDIO_UPDATE_REGISTRY ?? "https://registry.npmjs.org").replace(/\/+$/, "");
+    try {
+        const ctl = new AbortController();
+        const t = setTimeout(() => ctl.abort(), 2000);
+        const r = await fetch(`${reg}/@decidio%2fsdk/latest`, { signal: ctl.signal });
+        clearTimeout(t);
+        if (!r.ok)
+            return null;
+        const body = await r.json();
+        const latest = typeof body?.version === "string" && /^\d+\.\d+\.\d+$/.test(body.version) ? body.version : null;
+        if (latest) {
+            try {
+                mkdirSync(sessionDir(), { recursive: true });
+                writeFileSync(cache, JSON.stringify({ checkedAt: Date.now(), latest }));
+            }
+            catch { }
+        }
+        return latest;
+    }
+    catch {
+        return null;
+    }
+}
+async function updateGate(cmd, argv) {
+    const gatedHere = cmd ? GATED_CMDS.has(cmd) : !!(process.stdin.isTTY && process.stdout.isTTY);
+    if (!gatedHere || SHELL_ENV.DECIDIO_NO_UPDATE_CHECK || SHELL_ENV.DECIDIO_UPDATE_REEXEC || VERSION === "unknown" || VERSION.includes("-"))
+        return null;
+    const latest = await latestPublished();
+    if (!latest || !semverNewer(latest, VERSION))
+        return null;
+    const entry = process.argv[1] ?? "";
+    const underNpx = /[\\/]_npx[\\/]/.test(entry);
+    const localRoot = (() => {
+        const m = /^(.*?)[\\/]node_modules[\\/]@decidio[\\/]sdk[\\/]/.exec(entry);
+        if (!m)
+            return null;
+        const norm = (s) => (process.platform === "win32" ? s.toLowerCase() : s);
+        const root = resolvePath(m[1]);
+        const cwd = norm(process.cwd());
+        return cwd === norm(root) || cwd.startsWith(norm(root) + pathSep) ? root : null;
+    })();
+    const viaAlias = /[\\/]decidio$/.test(argv[1] ?? "");
+    const pkgName = viaAlias ? "decidio" : "@decidio/sdk";
+    const upgradeCmd = underNpx ? `npx ${pkgName}@latest ${argv.slice(2).join(" ")}` : localRoot ? `npm i ${pkgName}@latest` : `npm i -g ${pkgName}@latest`;
+    const notice = `${latest} is available (you have ${VERSION}).`;
+    if (!(process.stdin.isTTY && process.stdout.isTTY)) {
+        err(`⚠ ${notice} Upgrade: ${upgradeCmd}`);
+        if (SHELL_ENV.DECIDIO_REQUIRE_LATEST) {
+            err(`✘ DECIDIO_REQUIRE_LATEST is set — not running a stale version.`);
+            return 1;
+        }
+        return null;
+    }
+    const a = (await ask(`${notice} Upgrade now? [y/n]: `)).toLowerCase();
+    if (a !== "y" && a !== "yes") {
+        err(`✘ not upgraded — run this when ready: ${upgradeCmd}`);
+        return 1;
+    }
+    if (underNpx) {
         err(`  Under npx there is nothing installed to upgrade — re-run as: ${upgradeCmd}`);
         return 1;
     }
@@ -2362,6 +4176,9 @@ async function main(argv) {
         verify: { flags: ["--allow-unpinned"], valued: ["--issuer"] },
         tokens: { flags: ["--mine"] },
         dev: { flags: [], valued: ["--target", "--port"] },
+        hook: { flags: ["--project"], valued: ["--timeout", "--approver", "--cli"] },
+        github: { flags: ["--agents-md"], valued: ["--environment", "--justification", "--decision", "--workflow", "--api"] },
+        decisions: { flags: ["--dry-run"], valued: ["--adr"] },
     };
     const spec = KNOWN[cmd];
     if (spec) {
@@ -2395,8 +4212,8 @@ async function main(argv) {
                 return 2;
             }
         }
-        const MAX_POS = { login: 1, logout: 0, quickstart: 1, init: 1, doctor: 0, receipt: 1, tokens: 2, dev: 0 };
-        const exemptTail = (cmd === "approvals" && (positionals[0] === "approve" || positionals[0] === "reject")) || cmd === "verify";
+        const MAX_POS = { login: 1, logout: 0, quickstart: 1, init: 1, doctor: 0, receipt: 1, tokens: 2, dev: 0, hook: 2, github: 1, decisions: 1 };
+        const exemptTail = (cmd === "approvals" && (positionals[0] === "approve" || positionals[0] === "reject")) || (cmd === "hook" && positionals[0] === "justify") || cmd === "verify";
         if (!exemptTail && cmd === "approvals" && positionals.length > 0) {
             err(`✘ unknown approvals subcommand "${positionals[0]}" — use approve or reject (or no subcommand to list).`);
             return 2;
@@ -2537,6 +4354,83 @@ async function main(argv) {
             }
             return cmdDev(target, Number(portRaw));
         }
+        case "context": {
+            const VALUED = ["--title", "--trigger", "--team", "--unit", "--pack"];
+            const pos = argsIn.filter((x, i) => !x.startsWith("-") && !VALUED.includes(argsIn[i - 1] ?? ""));
+            const sub = pos[0];
+            const allowed = { list: ["--json"], create: ["--title", "--trigger", "--team", "--unit", "--org", "--json"], add: ["--json"], remove: ["--json"], trigger: ["--json"], always: ["--json"], delete: [], bind: ["--unit"], pull: ["--pack", "--here", "--chatgpt", "--json"] };
+            const given = argsIn.filter((x) => x.startsWith("--")).map((x) => x.split("=")[0]);
+            if (sub && allowed[sub]) {
+                const stray = given.find((f) => !allowed[sub].includes(f));
+                if (stray) {
+                    err(`✘ unknown option "${stray}" for \`context ${sub}\` — refusing to guess (a flag you meant to matter must never be silently ignored).`);
+                    return 2;
+                }
+            }
+            return cmdContext(sub, pos.slice(1), { title: valuedOpt(argsIn, "--title"), trigger: valuedOpt(argsIn, "--trigger"), team: valuedOpt(argsIn, "--team"), unit: valuedOpt(argsIn, "--unit"), org: argsIn.includes("--org"), here: argsIn.includes("--here"), pack: valuedOpt(argsIn, "--pack"), chatgpt: argsIn.includes("--chatgpt"), json: argsIn.includes("--json") });
+        }
+        case "hook": {
+            const VALUED = ["--timeout", "--approver", "--cli"];
+            const pos = argsIn.filter((x, i) => !x.startsWith("-") && !VALUED.includes(argsIn[i - 1] ?? ""));
+            const sub = pos[0];
+            const allowed = { pretool: [], posttool: [], wait: ["--timeout"], install: ["--project", "--approver", "--cli"], rules: [], justify: [] };
+            const given = argsIn.filter((x) => x.startsWith("--")).map((x) => x.split("=")[0]);
+            if (sub && allowed[sub]) {
+                const stray = given.find((f) => !allowed[sub].includes(f));
+                if (stray) {
+                    err(`✘ unknown option "${stray}" for \`hook ${sub}\` — refusing to guess (a flag you meant to matter must never be silently ignored).`);
+                    return 2;
+                }
+            }
+            switch (sub) {
+                case "pretool": return cmdHookPretool();
+                case "posttool": return cmdHookPosttool();
+                case "wait": {
+                    const t = valuedOpt(argsIn, "--timeout") ?? "600";
+                    if (!/^\d+$/.test(t) || Number(t) < 1 || Number(t) > 86_400) {
+                        err(`✘ --timeout needs a whole number of seconds from 1 to 86400 (got "${t}").`);
+                        return 2;
+                    }
+                    return cmdHookWait(pos[1], Number(t));
+                }
+                case "install": return cmdHookInstall({ project: argsIn.includes("--project"), approver: valuedOpt(argsIn, "--approver"), cli: valuedOpt(argsIn, "--cli") });
+                case "rules": return cmdHookRules();
+                case "justify": return cmdHookJustify(pos[1], pos.slice(2).join(" "));
+                default:
+                    err(`✘ hook needs a subcommand: install | wait <decision-id> | justify <decision-id> "<what changed>" | rules (pretool and posttool are run by Claude Code).\n\n${USAGE}`);
+                    return 2;
+            }
+        }
+        case "decisions": {
+            const sub = argsIn.find((x, i) => !x.startsWith("-") && argsIn[i - 1] !== "--adr");
+            if (sub !== "import") {
+                err(`✘ decisions needs a subcommand: import --adr <folder> [--dry-run].\n\n${USAGE}`);
+                return 2;
+            }
+            return cmdDecisionsImport(valuedOpt(argsIn, "--adr"), argsIn.includes("--dry-run"));
+        }
+        case "github": {
+            const VALUED = ["--environment", "--justification", "--decision", "--workflow", "--api"];
+            const pos = argsIn.filter((x, i) => !x.startsWith("-") && !VALUED.includes(argsIn[i - 1] ?? ""));
+            const sub = pos[0];
+            const allowed = { request: ["--environment", "--justification"], verify: ["--decision"], init: ["--environment", "--workflow", "--api", "--agents-md"] };
+            const given = argsIn.filter((x) => x.startsWith("--")).map((x) => x.split("=")[0]);
+            if (sub && allowed[sub]) {
+                const stray = given.find((f) => !allowed[sub].includes(f));
+                if (stray) {
+                    err(`✘ unknown option "${stray}" for \`github ${sub}\` — refusing to guess (a flag you meant to matter must never be silently ignored).`);
+                    return 2;
+                }
+            }
+            switch (sub) {
+                case "request": return cmdGithubRequest(valuedOpt(argsIn, "--environment"), valuedOpt(argsIn, "--justification"));
+                case "verify": return cmdGithubVerify(valuedOpt(argsIn, "--decision"));
+                case "init": return cmdGithubInit({ environment: valuedOpt(argsIn, "--environment"), workflow: valuedOpt(argsIn, "--workflow"), api: valuedOpt(argsIn, "--api"), agentsMd: argsIn.includes("--agents-md") });
+                default:
+                    err(`✘ github needs a subcommand: init | request --environment <name> | verify.\n\n${USAGE}`);
+                    return 2;
+            }
+        }
         default:
             if (cmd.startsWith("-"))
                 err(`✘ unknown command "${cmd}" — flags go AFTER the command (e.g. npx @decidio/sdk approvals ${cmd}).\n\n${USAGE}`);
@@ -2568,4 +4462,11 @@ if (invokedAsProgram)
             await new Promise((r) => process.stderr.write("", () => r()));
             process.exit(code);
         }
-    }).catch((e) => { console.error(`✘ unexpected error: ${e?.message ?? e}`); process.exit(1); });
+    }).catch((e) => {
+        if (ARGV_TAIL[0] === "hook" && ARGV_TAIL[1] === "pretool") {
+            process.stdout.write(JSON.stringify({ hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "deny", permissionDecisionReason: `Decidio hook: unexpected failure (${e?.message ?? e}) - refusing this tool call (fail closed). Nothing ran.` } }) + "\n");
+            process.exit(0);
+        }
+        console.error(`✘ unexpected error: ${e?.message ?? e}`);
+        process.exit(1);
+    });