@decidio/sdk 0.7.0 → 0.8.0

package/dist/cli.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
-import { readFileSync, writeFileSync, existsSync, appendFileSync, chmodSync, rmSync, openSync, writeSync, fsyncSync, closeSync, renameSync, mkdirSync, mkdtempSync, readdirSync, copyFileSync } from "node:fs";
-import { randomBytes } from "node:crypto";
+import { readFileSync, writeFileSync, existsSync, appendFileSync, chmodSync, rmSync, rmdirSync, openSync, writeSync, fsyncSync, closeSync, renameSync, mkdirSync, mkdtempSync, readdirSync, copyFileSync, statSync, lstatSync } from "node:fs";
+import { randomBytes, createHash } from "node:crypto";
 import { homedir, tmpdir } from "node:os";
-import { join as joinPath, resolve as resolvePath, sep as pathSep, basename } from "node:path";
+import { join as joinPath, resolve as resolvePath, sep as pathSep, basename, relative, isAbsolute } from "node:path";
 import { createServer } from "node:http";
 import { isIP } from "node:net";
 import { execFileSync, spawnSync } from "node:child_process";
@@ -12,7 +12,8 @@ import { realpathSync as realPath } from "node:fs";
 import { createRequire } from "node:module";
 import { generateKeypair, assertSafeTransport, redactUrl } from "./signing.js";
 import { hardenFile } from "./resume.js";
-import { withApproval, DecidioRateLimitError, DecidioRejectedError, DecidioTimeoutError, didFromPrivateKey } from "./index.js";
+import { withApproval, DecidioRateLimitError, DecidioRejectedError, DecidioTimeoutError, DecidioHttpError, didFromPrivateKey, checkApproval, signConfirm, buildConfirmBody, readConfirmResponse, bindingMaterial, boundScope, idempotencyKey, decisionUrl, decisionIdProblem } from "./index.js";
+import { gateAuthorizeTwinAware, adapterRequest } from "./adapters/_gate.js";
 import { verifyReceipt, runVerify, pinRequiredMessage, builtInAnchor, KNOWN_ISSUERS } from "@decidio/verify";
 import { startDemoGate } from "./demo-gate.js";
 const VERSION = (() => {
@@ -51,6 +52,10 @@ const OFFLINE_CMD = ["verify", "--version", "-v", "-V", "version", undefined].in
     || wantsHelp(ARGV_TAIL[0]) || wantsHelp(ARGV_TAIL[1]) || helpFlagAnywhere(ARGV_TAIL);
 if (!OFFLINE_CMD) {
     readEnvFile();
+    if (envUnreadable && ARGV_TAIL[0] === "hook" && ARGV_TAIL[1] === "pretool") {
+        process.stdout.write(JSON.stringify({ hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "deny", permissionDecisionReason: "Decidio hook: this project's .env exists but could not be read, so the agent's credentials are unknown - refusing this tool call (fail closed). Ask the user to fix the file's permissions." } }) + "\n");
+        process.exit(0);
+    }
     if (envUnreadable) {
         console.error(`✘ .env exists here but could not be read, so this command cannot know what is already configured in this directory.`);
         console.error(`  Treating it as empty would risk overwriting an agent key that cannot be recovered. Fix the file's permissions (or move it aside) and run the command again. Nothing was changed.`);
@@ -913,7 +918,9 @@ async function cmdInit(agentId, opts = {}) {
         return 1;
     }
     const { did: localDid, privateKeyBase64: localKey } = generateKeypair();
-    const registerBody = JSON.stringify({ agentId, did: localDid, ...(sourceSystem ? { sourceSystem } : {}) });
+    const soxEnv = (process.env.DECIDIO_SOX_RELEVANT ?? "").trim().toLowerCase();
+    const soxRelevant = soxEnv === "yes" || soxEnv === "true" ? true : soxEnv === "no" || soxEnv === "false" ? false : undefined;
+    const registerBody = JSON.stringify({ agentId, did: localDid, ...(sourceSystem ? { sourceSystem } : {}), ...(soxRelevant !== undefined ? { soxRelevant } : {}) });
     let envPrepared = false;
     const prepareEnvForWrite = () => {
         if (envPrepared)
@@ -959,6 +966,12 @@ async function cmdInit(agentId, opts = {}) {
         prepareEnvForWrite();
         upsertEnv({ DECIDIO_AGENT_ID: agentId, DECIDIO_AGENT_DID: did ?? localDid, DECIDIO_AGENT_KEY: localKey });
     }
+    else if (r.status === 400 && r.body?.code === "OWNER_REQUIRED") {
+        err(`✘ ${r.body?.message ?? "an agent needs a human owner"}`);
+        err(`  Sign in as a person so you own it: unset DECIDIO_API_TOKEN (the operator token names no one) and re-run init — it asks you to sign in.`);
+        err(`  Or have a workspace owner register it with an ownerUserId (POST /api/agents/register) or set one under Connect > Agents.`);
+        return 1;
+    }
     else {
         err(`✘ registration failed (${r.status}): ${JSON.stringify(r.body)}`);
         err(`  Fix the cause above and re-run — init is safe to repeat.`);
@@ -2344,6 +2357,1526 @@ function cmdDev(target, port) {
     }).listen(port, "127.0.0.1");
     return 0;
 }
+const HOOK_HOLD_CAP_MS = 120_000;
+function hookSegments(command) {
+    const WRAPPERS = new Set(["sudo", "doas", "env", "nohup", "time", "command", "exec", "builtin", "xargs", "nice", "ionice", "timeout", "stdbuf", "caffeinate"]);
+    return command.split(/\s*(?:\|\||&&|\||;|\r?\n)\s*/).map((raw) => raw.trim()).filter(Boolean).map((raw) => {
+        const tokens = raw.split(/\s+/).filter(Boolean);
+        while (tokens.length && (/^[A-Za-z_][A-Za-z0-9_]*=/.test(tokens[0]) || WRAPPERS.has(tokens[0].toLowerCase()))) {
+            const w = tokens.shift().toLowerCase();
+            if (w === "timeout" && tokens.length && /^\d/.test(tokens[0]))
+                tokens.shift();
+            if (WRAPPERS.has(w))
+                while (tokens.length && tokens[0].startsWith("-"))
+                    tokens.shift();
+        }
+        const program = basename((tokens[0] ?? "").replace(/^["']|["']$/g, "")).toLowerCase();
+        return { program, args: tokens.slice(1), raw };
+    });
+}
+const hookFlag = (args, letters, longs = []) => args.some((a) => (/^-[A-Za-z]+$/.test(a) && [...letters].some((l) => a.slice(1).includes(l))) || longs.includes(a));
+const hookSub = (s, i = 0) => (s.args.filter((a) => !a.startsWith("-"))[i] ?? "").toLowerCase();
+const HOOK_DB_CLIENTS = ["psql", "pgcli", "mysql", "mysqlsh", "mycli", "mariadb", "sqlite3", "sqlite", "litecli", "mongosh", "mongo", "redis-cli", "clickhouse-client", "clickhouse", "sqlcmd", "bq", "duckdb", "cqlsh", "snowsql", "usql", "dbmate", "goose", "flyway", "liquibase", "atlas", "alembic", "knex", "sequelize", "typeorm", "drizzle-kit", "supabase", "wrangler", "turso", "pscale"];
+const HOOK_RULES = [
+    { category: "delete-recursive", summary: "rm -r/-rf, find -delete / -exec rm, rmdir|rd|del /s, Remove-Item -Recurse, shred",
+        matches: (segs) => segs.some((s) => (s.program === "rm" && hookFlag(s.args, "rR", ["--recursive"]))
+            || (s.program === "find" && (s.args.includes("-delete") || s.args.some((a, i) => i > 0 && s.args[i - 1] === "-exec" && basename(a) === "rm")))
+            || ((s.program === "rmdir" || s.program === "rd" || s.program === "del") && s.args.some((a) => /^\/s$/i.test(a)))
+            || (s.program === "remove-item" && s.args.some((a) => /^-recurse$/i.test(a)))
+            || s.program === "shred") },
+    { category: "git-rewrite", summary: "git push --force|-f|+ref|:ref|--delete|--mirror|--prune, reset --hard, branch -D, clean -f|-x, stash drop|clear, filter-branch|filter-repo, update-ref -d, reflog expire, gc --prune",
+        matches: (segs) => segs.some((s) => s.program === "git" && ((hookSub(s) === "push" && (hookFlag(s.args, "fd", ["--force", "--force-with-lease", "--force-if-includes", "--delete", "--mirror", "--prune"]) || s.args.some((a) => /^\+\S/.test(a) || /^:\S/.test(a) || /^\S+:\s*$/.test(a))))
+            || (hookSub(s) === "reset" && s.args.includes("--hard"))
+            || (hookSub(s) === "branch" && (s.args.some((a) => /^-[a-zA-Z]*D/.test(a)) || (s.args.includes("--delete") && s.args.includes("--force"))))
+            || (hookSub(s) === "clean" && hookFlag(s.args, "fxX", ["--force"]))
+            || (hookSub(s) === "stash" && ["drop", "clear"].includes(hookSub(s, 1)))
+            || ["filter-branch", "filter-repo"].includes(hookSub(s))
+            || (hookSub(s) === "update-ref" && s.args.includes("-d"))
+            || (hookSub(s) === "reflog" && hookSub(s, 1) === "expire")
+            || (hookSub(s) === "gc" && s.args.some((a) => a.startsWith("--prune"))))) },
+    { category: "sql-destructive", summary: "DROP TABLE|DATABASE|SCHEMA|INDEX|VIEW|USER|ROLE, TRUNCATE, DELETE FROM - sent to a database client (psql, mysql, sqlite3, mongosh, sqlcmd, bq, ...); prisma migrate reset / db push --force-reset; rails db:drop|db:reset",
+        matches: (segs, cmd) => {
+            const toDb = segs.some((s) => HOOK_DB_CLIENTS.includes(s.program) || /\bprisma\b/.test(s.raw) || /\.sql\b/.test(s.raw));
+            return (toDb && (/\bDROP\s+(TABLE|DATABASE|SCHEMA|INDEX|VIEW|USER|ROLE|EXTENSION)\b/i.test(cmd) || /\bTRUNCATE\s+(TABLE\s+)?\S/i.test(cmd) || /\bDELETE\s+FROM\s+\S/i.test(cmd)))
+                || segs.some((s) => (/\bprisma\b/.test(s.raw) && (/\bmigrate\s+reset\b/.test(s.raw) || /--force-reset\b/.test(s.raw)))
+                    || (["rails", "rake"].includes(s.program) && /\bdb:(drop|reset|schema:load)\b/.test(s.raw)));
+        } },
+    { category: "infra-apply", summary: "terraform|tofu apply|destroy, pulumi up|destroy, cdk deploy|destroy, sam|serverless deploy|remove, kubectl delete|drain|replace|apply --prune, helm uninstall|rollback, aws|gcloud|az|doctl|fly|heroku|vercel … delete|terminate|destroy|purge|remove|rm|rb",
+        matches: (segs) => segs.some((s) => (["terraform", "tofu"].includes(s.program) && ["apply", "destroy"].includes(hookSub(s)))
+            || (s.program === "pulumi" && ["up", "destroy"].includes(hookSub(s)))
+            || (s.program === "cdk" && ["deploy", "destroy"].includes(hookSub(s)))
+            || (s.program === "sam" && ["deploy", "delete"].includes(hookSub(s)))
+            || (["serverless", "sls"].includes(s.program) && ["deploy", "remove"].includes(hookSub(s)))
+            || (s.program === "kubectl" && (["delete", "drain", "replace"].includes(hookSub(s)) || (hookSub(s) === "apply" && s.args.includes("--prune"))))
+            || (s.program === "helm" && ["uninstall", "delete", "rollback"].includes(hookSub(s)))
+            || (["aws", "gcloud", "az", "doctl", "fly", "flyctl", "heroku", "vercel", "oci", "ibmcloud"].includes(s.program)
+                && s.args.some((a) => /^(delete|terminate|destroy|purge|remove|deregister|rm|rb|apps:destroy|pg:reset)(-[a-z-]+)?$/i.test(a)))) },
+    { category: "containers", summary: "docker|podman rm|rmi|kill, system|volume|image|container|network prune|rm, compose down -v|--volumes|--rmi",
+        matches: (segs) => segs.some((s) => {
+            const compose = (s.program === "docker-compose" && hookSub(s) === "down") || (["docker", "podman"].includes(s.program) && hookSub(s) === "compose" && hookSub(s, 1) === "down");
+            return (["docker", "podman", "nerdctl"].includes(s.program) && (["rm", "rmi", "kill"].includes(hookSub(s))
+                || (["system", "volume", "image", "container", "network", "builder"].includes(hookSub(s)) && ["prune", "rm"].includes(hookSub(s, 1)))))
+                || (compose && (hookFlag(s.args, "v", ["--volumes"]) || s.args.some((a) => a.startsWith("--rmi"))));
+        }) },
+    { category: "publish", summary: "npm|pnpm|yarn|bun publish|unpublish|deprecate|dist-tag|owner, cargo publish|yank, gem push|yank, twine upload, poetry publish, dotnet|nuget push|delete, mvn|gradle deploy|publish, docker push, gh release create|delete|upload, gh repo delete|archive, gh api -X DELETE|PUT|PATCH",
+        matches: (segs) => segs.some((s) => (["npm", "pnpm", "yarn", "bun"].includes(s.program) && ["publish", "unpublish", "deprecate", "dist-tag", "owner"].includes(hookSub(s)))
+            || (s.program === "cargo" && ["publish", "yank"].includes(hookSub(s)))
+            || (s.program === "gem" && ["push", "yank"].includes(hookSub(s)))
+            || (s.program === "twine" && hookSub(s) === "upload") || (/^python[0-9.]*$/.test(s.program) && s.args[0] === "-m" && s.args[1] === "twine")
+            || (s.program === "poetry" && hookSub(s) === "publish")
+            || (s.program === "dotnet" && hookSub(s) === "nuget" && ["push", "delete"].includes(hookSub(s, 1))) || (s.program === "nuget" && ["push", "delete"].includes(hookSub(s)))
+            || (["mvn", "gradle", "gradlew"].includes(s.program) && s.args.some((a) => /^(deploy|publish|publishToMavenCentral|uploadArchives)$/.test(a)))
+            || (["docker", "podman"].includes(s.program) && hookSub(s) === "push")
+            || (s.program === "gh" && ((hookSub(s) === "release" && ["create", "delete", "upload"].includes(hookSub(s, 1)))
+                || (hookSub(s) === "repo" && ["delete", "archive"].includes(hookSub(s, 1)))
+                || (hookSub(s) === "api" && s.args.some((a, i) => /^(-X|--method)$/.test(a) && /^(DELETE|PUT|PATCH)$/i.test(s.args[i + 1] ?? "")))))) },
+    { category: "pipe-to-shell", summary: "curl|wget … | sh|bash|zsh|python|node, bash <(curl …), iex (irm …)",
+        matches: (segs, cmd) => segs.some((s, i) => i > 0
+            && ["sh", "bash", "zsh", "fish", "dash", "ksh", "node", "perl", "ruby", "pwsh", "powershell", "python", "python3"].includes(s.program)
+            && ["curl", "wget", "fetch", "http", "https", "invoke-webrequest", "iwr", "irm", "invoke-restmethod"].includes(segs[i - 1].program))
+            || /\b(sh|bash|zsh)\s+<\(\s*(curl|wget)\b/.test(cmd) || /\biex\b.*\b(irm|iwr|Invoke-RestMethod|Invoke-WebRequest|DownloadString)\b/i.test(cmd) },
+    { category: "system", summary: "mkfs, dd of=/dev/…, > /dev/sd…, shutdown|reboot|halt|poweroff, systemctl disable|mask, crontab -r, chmod|chown -R on /, iptables -F, diskutil erase…, format X:, Format-Volume, Clear-Disk, a fork bomb",
+        matches: (segs, cmd) => segs.some((s) => /^mkfs(\.|$)/.test(s.program) || (s.program === "dd" && s.args.some((a) => /^of=\/dev\//.test(a)))
+            || ["shutdown", "reboot", "halt", "poweroff"].includes(s.program) || (s.program === "systemctl" && ["disable", "mask"].includes(hookSub(s)))
+            || (s.program === "crontab" && s.args.includes("-r"))
+            || (["chmod", "chown"].includes(s.program) && hookFlag(s.args, "R", ["--recursive"]) && s.args.some((a) => /^\/\*?$/.test(a)))
+            || (s.program === "iptables" && (s.args.includes("-F") || s.args.includes("--flush")))
+            || (s.program === "diskutil" && /^erase/i.test(hookSub(s))) || (s.program === "format" && s.args.some((a) => /^[a-z]:$/i.test(a)))
+            || ["format-volume", "clear-disk", "initialize-disk"].includes(s.program))
+            || />\s*\/dev\/(sd|nvme|hd|disk|mmcblk)/.test(cmd) || /:\(\)\s*\{\s*:\s*\|\s*:\s*&\s*\}\s*;\s*:/.test(cmd) },
+];
+function hookExtraRules() {
+    const file = process.env.DECIDIO_HOOK_EXTRA_RULES;
+    if (!file)
+        return [];
+    let parsed;
+    try {
+        parsed = JSON.parse(readFileSync(file, "utf8"));
+    }
+    catch (e) {
+        throw new Error(`DECIDIO_HOOK_EXTRA_RULES (${file}) could not be read as JSON (${e?.message ?? e})`);
+    }
+    if (!Array.isArray(parsed))
+        throw new Error(`DECIDIO_HOOK_EXTRA_RULES (${file}) must be a JSON array of { category, pattern, flags?, summary? }`);
+    return parsed.map((r, i) => {
+        if (!r || typeof r.category !== "string" || !/^[a-z0-9-]{1,40}$/.test(r.category) || typeof r.pattern !== "string")
+            throw new Error(`DECIDIO_HOOK_EXTRA_RULES (${file}) entry ${i} needs a category ([a-z0-9-]) and a pattern`);
+        let re;
+        try {
+            re = new RegExp(r.pattern, typeof r.flags === "string" ? r.flags.replace(/[^gimsuy]/g, "") : "");
+        }
+        catch (e) {
+            throw new Error(`DECIDIO_HOOK_EXTRA_RULES (${file}) entry ${i}: ${e?.message ?? e}`);
+        }
+        return { category: r.category, summary: typeof r.summary === "string" ? r.summary : `/${r.pattern}/${r.flags ?? ""}`, matches: (_s, cmd) => { re.lastIndex = 0; return re.test(cmd); } };
+    });
+}
+function hookMatch(command) {
+    const segs = hookSegments(command);
+    for (const r of [...HOOK_RULES, ...hookExtraRules()])
+        if (r.matches(segs, command))
+            return r;
+    return null;
+}
+function hookRedact(command) {
+    return command
+        .replace(/(\b(?:bearer|basic)\s+)[A-Za-z0-9._~+/=-]{8,}/gi, "$1[REDACTED]")
+        .replace(/(\b[A-Za-z0-9_]*(?:token|password|passwd|pwd|secret|api[_-]?key|access[_-]?key|private[_-]?key|auth|credentials?)\s*[=:]\s*)(["']?)[^\s"';&|]+\2/gi, "$1$2[REDACTED]$2")
+        .replace(/(:\/\/[^/\s:@]+:)[^@\s/]+(@)/g, "$1[REDACTED]$2")
+        .replace(/((?:^|\s)(?:-u|--user|--password-stdin|-p)\s+["']?[^\s:"']+:)[^\s"']+/g, "$1[REDACTED]")
+        .replace(/((?:-H|--header)\s+["']?(?:authorization|x-api-key|cookie)\s*:\s*)[^"']+/gi, "$1[REDACTED]")
+        .replace(/\b(?:AKIA[0-9A-Z]{16}|ghp_[A-Za-z0-9]{20,}|github_pat_[A-Za-z0-9_]{20,}|sk-[A-Za-z0-9_-]{20,}|xox[baprs]-[A-Za-z0-9-]{10,}|sk_(?:live|test)_[A-Za-z0-9]{10,})\b/g, "[REDACTED]");
+}
+function hookSubject(category, segs, cwdAbs, projectDir) {
+    const textOnly = (why) => ({ fingerprint: null, display: `text-only (${why})` });
+    const relOrAbs = (p) => { const r = relative(projectDir, p); return r && !r.startsWith("..") && !isAbsolute(r) ? r.split(pathSep).join("/") : p; };
+    const nonFlags = (s) => s.args.filter((a) => !a.startsWith("-"));
+    const git = () => {
+        try {
+            const run = (args) => execFileSync("git", args, { cwd: cwdAbs, timeout: 3000, stdio: ["ignore", "pipe", "ignore"], encoding: "utf8" }).trim();
+            const head = run(["rev-parse", "HEAD"]);
+            const branch = run(["rev-parse", "--abbrev-ref", "HEAD"]);
+            return /^[0-9a-f]{40}$/.test(head) && branch ? { head, branch } : null;
+        }
+        catch {
+            return null;
+        }
+    };
+    const firstOf = (programs) => segs.findIndex((s) => programs.includes(s.program));
+    const movedTree = (i) => segs.slice(0, i).some((s) => s.program === "cd" || s.program === "pushd");
+    if (category === "git-rewrite" || category === "infra-apply") {
+        const i = category === "git-rewrite" ? firstOf(["git"]) : firstOf(["terraform", "tofu", "pulumi", "cdk", "sam", "serverless", "sls", "kubectl", "helm", "aws", "gcloud", "az", "doctl", "fly", "flyctl", "heroku", "vercel", "oci", "ibmcloud"]);
+        if (i < 0)
+            return textOnly("no subject");
+        if (movedTree(i))
+            return textOnly("a cd on the same line moves the call to another directory");
+        const g = git();
+        if (!g)
+            return textOnly("not a git repository here");
+        const seg = segs[i];
+        const args = nonFlags(seg);
+        const extra = category === "git-rewrite" ? args.slice(1).join(" ") : [relOrAbs(cwdAbs), ...seg.args.filter((a) => /^(-var-file|--var-file|-plan|--plan)/.test(a) || /\.(tfplan|tfvars)$/.test(a))].join(" ");
+        return { fingerprint: `${category}:${g.head}:${g.branch}:${extra}`, display: `HEAD ${g.head.slice(0, 7)} on ${g.branch}${extra ? ` · ${hookRedact(extra).slice(0, 120)}` : ""}` };
+    }
+    if (category === "delete-recursive") {
+        const i = firstOf(["rm", "find", "rmdir", "rd", "del", "remove-item", "shred"]);
+        if (i < 0)
+            return textOnly("no subject");
+        if (movedTree(i))
+            return textOnly("a cd on the same line moves the call to another directory");
+        const targets = nonFlags(segs[i]).filter((a) => !/^[{}();\\]+$/.test(a) && !(segs[i].program === "find" && /^(-|\{\})/.test(a))).map((a) => resolvePath(cwdAbs, a.replace(/^["']|["']$/g, "")));
+        if (!targets.length)
+            return textOnly("no path named");
+        const sorted = [...new Set(targets)].sort();
+        return { fingerprint: `paths:${sorted.join("\0")}`, display: hookRedact(sorted.map(relOrAbs).join(", ")).slice(0, 160) };
+    }
+    if (category === "sql-destructive") {
+        const stIdx = segs.findIndex((s) => /\b(DROP|TRUNCATE|DELETE)\b/i.test(s.raw));
+        const dbIdx = firstOf(HOOK_DB_CLIENTS);
+        const client = dbIdx >= 0 ? segs[dbIdx] : stIdx >= 0 ? segs[stIdx] : null;
+        if (!client)
+            return textOnly("no statement");
+        const stmtSeg = stIdx >= 0 ? segs[stIdx] : client;
+        const stmt = (stmtSeg.raw.match(/\b(DROP\s+\w+[^;'"]*|TRUNCATE[^;'"]*|DELETE\s+FROM[^;'"]*)/i)?.[1] ?? stmtSeg.raw).replace(/\s+/g, " ").trim();
+        const stmtAt = client.args.findIndex((a) => /^["']?(DROP|TRUNCATE|DELETE)\b/i.test(a));
+        const target = (stmtAt >= 0 ? client.args.slice(0, stmtAt) : client.args).filter((a) => !a.startsWith("-")).join(" ");
+        return { fingerprint: `sql:${client.program}:${target}:${stmt.toUpperCase()}`, display: hookRedact(`${client.program}${target ? ` ${target}` : ""}: ${stmt}`).slice(0, 160) };
+    }
+    return textOnly("text binds this category");
+}
+async function readHookStdin() {
+    if (process.stdin.isTTY)
+        return { ok: false, why: "no hook input on stdin - this command is run BY Claude Code with the tool call as JSON on stdin (set it up with: npx @decidio/sdk hook install)" };
+    let raw = "";
+    try {
+        process.stdin.setEncoding("utf8");
+        for await (const chunk of process.stdin) {
+            raw += chunk;
+            if (raw.length > 4_000_000)
+                break;
+        }
+    }
+    catch (e) {
+        return { ok: false, why: `stdin could not be read (${e?.message ?? e})` };
+    }
+    if (!raw.trim())
+        return { ok: false, why: "empty hook input on stdin" };
+    try {
+        const v = JSON.parse(raw);
+        if (!v || typeof v !== "object" || Array.isArray(v))
+            return { ok: false, why: "the hook input is not a JSON object" };
+        return { ok: true, input: v };
+    }
+    catch {
+        return { ok: false, why: "the hook input is not JSON" };
+    }
+}
+function hookConfig() {
+    const token = process.env.DECIDIO_API_TOKEN;
+    if (!token)
+        return { missing: "DECIDIO_API_TOKEN is not set - no agent token in this folder's .env or the environment" };
+    return {
+        apiUrl: API, agentId: process.env.DECIDIO_AGENT_ID || defaultAgentId(), apiToken: token, sourceSystem: "claude-code",
+        agentKey: process.env.DECIDIO_AGENT_KEY || undefined, agentDid: process.env.DECIDIO_AGENT_DID || undefined, workspaceId: process.env.DECIDIO_WORKSPACE_ID || undefined,
+        appUrl: process.env.DECIDIO_APP_URL || APP_URL,
+    };
+}
+const hookStateDir = () => (process.env.CLAUDE_PLUGIN_DATA ? joinPath(process.env.CLAUDE_PLUGIN_DATA, "hooks") : joinPath(sessionDir(), "hooks"));
+const hookStatePath = (toolUseId) => joinPath(hookStateDir(), toolUseId.replace(/[^A-Za-z0-9_.-]/g, "_").slice(0, 120) + ".json");
+function writeHookState(toolUseId, s) {
+    if (typeof toolUseId !== "string" || !toolUseId)
+        return;
+    try {
+        mkdirSync(hookStateDir(), { recursive: true });
+        writeFileSync(hookStatePath(toolUseId), JSON.stringify(s) + "\n");
+    }
+    catch (e) {
+        err(`decidio hook: could not keep the approval ${s.decisionId} for posttool (${e?.message ?? e}) - the execution will not be reported; the approval lapses on its own`);
+    }
+}
+const JUSTIFY_MAX = 500;
+const justifyPath = (decisionId) => joinPath(hookStateDir(), "justify-" + decisionId.replace(/[^A-Za-z0-9_.-]/g, "_").slice(0, 120) + ".json");
+function readJustification(decisionId) {
+    try {
+        const p = justifyPath(decisionId);
+        if (!existsSync(p))
+            return null;
+        if (statSync(p).mtimeMs < Date.now() - 24 * 3600_000) {
+            rmSync(p, { force: true });
+            return null;
+        }
+        const j = JSON.parse(readFileSync(p, "utf8"));
+        return typeof j?.justification === "string" && j.justification.trim() ? j.justification : null;
+    }
+    catch {
+        return null;
+    }
+}
+const clearJustification = (decisionId) => { try {
+    rmSync(justifyPath(decisionId), { force: true });
+}
+catch { } };
+function justificationProblem(text) {
+    if (!text.trim())
+        return "a justification cannot be empty";
+    if (text.length > JUSTIFY_MAX)
+        return `keep the justification to ${JUSTIFY_MAX} characters`;
+    if (/[\r\n]/.test(text))
+        return "a justification is one line";
+    return null;
+}
+function sweepHookState() {
+    try {
+        const dir = hookStateDir();
+        if (!existsSync(dir))
+            return;
+        const cutoff = Date.now() - 24 * 3600_000;
+        for (const f of readdirSync(dir)) {
+            const p = joinPath(dir, f);
+            try {
+                if (statSync(p).mtimeMs < cutoff)
+                    rmSync(p, { force: true });
+            }
+            catch { }
+        }
+    }
+    catch { }
+}
+const hookErr = (e) => e instanceof DecidioHttpError ? `HTTP ${e.status} from ${e.endpoint}` : String(e?.cause?.code ?? e?.message ?? e);
+const hookShort = (cmd) => (cmd.length > 120 ? cmd.slice(0, 117) + "..." : cmd);
+async function hookStatus(cfg, decisionId, waitSec) {
+    assertSafeTransport(cfg.apiUrl, true);
+    const path = `/agent/status/${encodeURIComponent(decisionId)}?wait=${waitSec}`;
+    const r = await fetch(cfg.apiUrl.replace(/\/$/, "") + path, { headers: { authorization: `Bearer ${cfg.apiToken}` }, signal: AbortSignal.timeout((waitSec + 20) * 1000) });
+    if (!r.ok)
+        throw new DecidioHttpError(r.status, path, await r.json().catch(() => undefined));
+    const body = await r.json();
+    if (!body || typeof body !== "object" || typeof body.state !== "string")
+        throw new Error("the gate answered a status this SDK does not understand");
+    return body;
+}
+async function hookHold(cfg, decisionId, holdMs) {
+    const deadline = Date.now() + holdMs;
+    let status = null, lastError = null;
+    const sleep = (ms) => new Promise((r) => setTimeout(r, Math.max(0, ms)));
+    for (;;) {
+        const left = deadline - Date.now();
+        if (left < 1000)
+            break;
+        const t0 = Date.now();
+        try {
+            status = await hookStatus(cfg, decisionId, Math.min(30, Math.floor(left / 1000)));
+            lastError = null;
+        }
+        catch (e) {
+            lastError = hookErr(e);
+            const transient = (e instanceof DecidioHttpError && (e.status >= 500 || e.status === 408 || e.status === 429))
+                || (!(e instanceof DecidioHttpError) && (e?.name === "AbortError" || e?.name === "TimeoutError" || typeof e?.cause?.code === "string" || /fetch failed/i.test(String(e?.message ?? ""))));
+            if (!transient)
+                break;
+            await sleep(Math.min(2000, deadline - Date.now()));
+            continue;
+        }
+        if (status.state !== "pending")
+            break;
+        if (Date.now() - t0 < 500)
+            await sleep(Math.min(1000, deadline - Date.now()));
+    }
+    return { status, lastError };
+}
+async function cmdHookPretool() {
+    const out = (o) => { process.stdout.write(JSON.stringify(o) + "\n"); return 0; };
+    const deny = (reason, user) => out({ hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "deny", permissionDecisionReason: reason }, ...(user ? { systemMessage: user } : {}) });
+    const allow = (reason) => out({ hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "allow", permissionDecisionReason: reason } });
+    try {
+        const read = await readHookStdin();
+        if (!read.ok)
+            return deny(`Decidio hook: ${read.why} - refusing this tool call (fail closed).`);
+        const input = read.input;
+        const tool = typeof input.tool_name === "string" ? input.tool_name : "";
+        const command = typeof input.tool_input?.command === "string" ? input.tool_input.command : "";
+        if (!["Bash", "PowerShell"].includes(tool) || !command.trim())
+            return 0;
+        let rule;
+        try {
+            rule = hookMatch(command);
+        }
+        catch (e) {
+            return deny(`Decidio hook: ${e?.message ?? e} - every command is refused until it is fixed.`);
+        }
+        if (!rule)
+            return 0;
+        const short = hookShort(hookRedact(command.replace(/\s+/g, " ").trim()));
+        const projectDir = resolvePath(process.env.CLAUDE_PROJECT_DIR || process.cwd());
+        const cfg = hookConfig();
+        if ("missing" in cfg)
+            return deny(`Decidio: "${short}" is a ${rule.category} command that needs a person's approval, but this project has no Decidio agent credentials (${cfg.missing}). Nothing ran. Ask the user to run \`npx @decidio/sdk init\` in ${projectDir}, then retry the same command.`, `Decidio: no agent credentials in ${projectDir} - run npx @decidio/sdk init`);
+        const canonical = command.replace(/\s+/g, " ").trim();
+        const cwdAbs = resolvePath(typeof input.cwd === "string" && input.cwd ? input.cwd : process.cwd());
+        const rel = relative(projectDir, cwdAbs);
+        const cwdRel = !rel ? "." : rel.startsWith("..") || isAbsolute(rel) ? cwdAbs : rel;
+        const session = typeof input.session_id === "string" ? input.session_id : "";
+        const subject = hookSubject(rule.category, hookSegments(command), cwdAbs, projectDir);
+        let material;
+        try {
+            material = bindingMaterial(cfg);
+        }
+        catch (e) {
+            return deny(`Decidio hook: this command cannot be bound to an approval (${e?.message ?? e}) - refusing to run it. Ask the user to check ${projectDir}/.env with \`npx @decidio/sdk doctor\`.`);
+        }
+        if (!material)
+            return deny(`Decidio hook: this command cannot be bound to an approval (no key material (DECIDIO_API_TOKEN, or DECIDIO_AGENT_KEY + DECIDIO_AGENT_DID)) - refusing to run it. Ask the user to check ${projectDir}/.env with \`npx @decidio/sdk doctor\`.`);
+        const ctx = { action: "shellExec", amount: 0, scope: boundScope(material, canonical + "\n" + (subject.fingerprint ?? "")),
+            context: { command: hookRedact(canonical).slice(0, 400), cwd: cwdRel.slice(0, 200), category: rule.category, host: "claude-code", tool, subject: hookRedact(subject.display).slice(0, 200) } };
+        const request = adapterRequest(ctx);
+        let key;
+        try {
+            key = idempotencyKey(material, { host: "claude-code", tool, command: canonical, cwd: cwdRel, session, subject: subject.fingerprint ?? "" });
+        }
+        catch (e) {
+            return deny(`Decidio hook: this command cannot be bound to an approval (${e?.message ?? e}) - refusing to run it. Ask the user to check ${projectDir}/.env with \`npx @decidio/sdk doctor\`.`);
+        }
+        let auth;
+        try {
+            let a = await gateAuthorizeTwinAware(cfg, ctx, { idempotencyKey: key });
+            if (a.decision === "duplicate") {
+                const twin = a.duplicateOf;
+                const label = twin.displayNumber ?? twin.decisionId;
+                const when = twin.refusedAt ? ` on ${String(twin.refusedAt).slice(0, 10)}` : "";
+                const why = twin.reason ? ` ("${twin.reason}")` : "";
+                const stored = readJustification(twin.decisionId);
+                if (!stored) {
+                    return deny(`Decidio: "${short}" looks like a duplicate of ${label}, which a person refused${when}${why}. Nothing ran. If this change is different, ask the user what changed, then run \`npx @decidio/sdk hook justify ${twin.decisionId} "<their words>"\` and retry EXACTLY the same command; the approver will see their justification beside the earlier refusal. A different commit or path is a new request on its own.`, `Decidio: ${label} was refused${when} - a justification is needed to ask again`);
+                }
+                a = await gateAuthorizeTwinAware(cfg, ctx, { idempotencyKey: key, justification: stored });
+                if (a.decision === "duplicate")
+                    return deny(`Decidio: "${short}" is still a duplicate of ${label} and the stored justification was not accepted (${a.duplicateOf.reason ?? "no reason given"}). Nothing ran.`);
+                clearJustification(twin.decisionId);
+            }
+            auth = a;
+        }
+        catch (e) {
+            return deny(`Decidio hook: the approval gate could not be asked about "${short}" (${hookErr(e)}) - refusing to run it (fail closed). Nothing ran. ${e instanceof DecidioRateLimitError ? "The workspace's governed-action allowance for this hour is used up; try later." : `Check the network and ${projectDir}/.env (\`npx @decidio/sdk doctor\`), then retry the same command.`}`);
+        }
+        const where = decisionUrl(cfg.appUrl, auth.decisionId);
+        if (auth.decision === "block")
+            return deny(`Decidio BLOCKED "${short}" by policy (decision ${auth.decisionId}${auth.reason ? `: ${auth.reason}` : ""}). Do not run it, or a variant of it; tell the user.`, `Decidio blocked ${auth.decisionId}`);
+        if (auth.decision === "proceed") {
+            writeHookState(input.tool_use_id, { v: 1, decisionId: auth.decisionId, receiptId: auth.receiptId ?? null, tool, category: rule.category, at: new Date().toISOString() });
+            return allow(`Decidio: "${short}" is authorized by policy (decision ${auth.decisionId}${auth.receiptId ? `, receipt ${auth.receiptId}` : ""}, sealed). This covers this one execution only.`);
+        }
+        const holdRaw = Number(process.env.DECIDIO_HOOK_HOLD_MS ?? "90000");
+        const held = await hookHold(cfg, auth.decisionId, Number.isFinite(holdRaw) && holdRaw >= 0 ? Math.min(holdRaw, HOOK_HOLD_CAP_MS) : 90_000);
+        const st = held.status;
+        if (!st)
+            return deny(`Decidio: "${short}" is routed for approval as decision ${auth.decisionId}, but its status could not be read (${held.lastError ?? "no answer"}). Nothing ran. When the gate is reachable, run \`npx @decidio/sdk hook wait ${auth.decisionId}\` and then retry EXACTLY the same command.`);
+        if (st.state === "pending")
+            return deny(`Decidio: "${short}" needs a person's approval - decision ${auth.decisionId} is in their queue${where ? ` (${where})` : ""}. Nothing ran. To continue: run \`npx @decidio/sdk hook wait ${auth.decisionId}\` (it returns when they decide), then retry EXACTLY the same command - not a variant of it, and do not work around this gate.`, `Decidio: ${auth.decisionId} awaits approval${where ? ` - ${where}` : ""}`);
+        if (st.state === "rejected" || st.state === "blocked")
+            return deny(`Decidio: "${short}" was ${st.state} (decision ${auth.decisionId}${st.reason ? `: ${st.reason}` : ""}) for this exact change (${hookRedact(subject.display)}). Do not retry it or a variant of it; tell the user. ${subject.fingerprint ? "If the user changes what it would act on (a new commit, a different path), that is a new request and may be asked." : ""}`.trim(), `Decidio: ${auth.decisionId} ${st.state}`);
+        const chk = await checkApproval(cfg, auth.decisionId, request, { status: st });
+        if (!chk.ok)
+            return deny(`Decidio: "${short}" is NOT cleared to run - ${chk.reason ?? chk.code} (decision ${auth.decisionId}). Nothing ran.${chk.code === "spent" || chk.code === "expired" ? " Retry the same command to ask for a fresh approval." : ""}`);
+        writeHookState(input.tool_use_id, { v: 1, decisionId: auth.decisionId, receiptId: st.receiptId ?? auth.receiptId ?? null, tool, category: rule.category, at: new Date().toISOString() });
+        return allow(`Decidio: "${short}" is approved (decision ${auth.decisionId}${st.receiptId ?? auth.receiptId ? `, receipt ${st.receiptId ?? auth.receiptId}` : ""}). This approval covers this one execution only; its record is sealed.`);
+    }
+    catch (e) {
+        return deny(`Decidio hook: unexpected failure (${e?.message ?? e}) - refusing this tool call (fail closed). Nothing ran.`);
+    }
+}
+async function cmdHookPosttool() {
+    try {
+        const read = await readHookStdin();
+        if (!read.ok) {
+            err(`decidio hook posttool: ${read.why}`);
+            return 0;
+        }
+        const id = typeof read.input.tool_use_id === "string" ? read.input.tool_use_id : "";
+        if (!id)
+            return 0;
+        const path = hookStatePath(id);
+        sweepHookState();
+        if (!existsSync(path))
+            return 0;
+        let s;
+        try {
+            s = JSON.parse(readFileSync(path, "utf8"));
+        }
+        catch {
+            rmSync(path, { force: true });
+            return 0;
+        }
+        rmSync(path, { force: true });
+        if (!s || s.v !== 1 || typeof s.decisionId !== "string")
+            return 0;
+        const cfg = hookConfig();
+        if ("missing" in cfg) {
+            err(`decidio hook posttool: ${cfg.missing} - the execution of ${s.decisionId} is not reported`);
+            return 0;
+        }
+        const resp = read.input.tool_response;
+        const interrupted = !!(resp && typeof resp === "object" && resp.interrupted);
+        const captured = { host: "claude-code", tool: s.tool, category: s.category, interrupted, ok: !interrupted };
+        const body = buildConfirmBody(cfg, s.decisionId, captured, signConfirm(s.decisionId, cfg), "wrapper");
+        assertSafeTransport(cfg.apiUrl, true);
+        const r = await fetch(cfg.apiUrl.replace(/\/$/, "") + "/agent/confirm", { method: "POST", headers: { "content-type": "application/json", authorization: `Bearer ${cfg.apiToken}` }, body: JSON.stringify(body), signal: AbortSignal.timeout(20_000) });
+        const parsed = await r.json().catch(() => null);
+        if (!r.ok) {
+            err(`decidio hook posttool: the execution of ${s.decisionId} could not be recorded (HTTP ${r.status}${parsed?.message ? `: ${parsed.message}` : ""}) - the approval is not marked spent; it lapses on its own`);
+            return 0;
+        }
+        const ev = readConfirmResponse(parsed, { signed: !!body.requesterIdentity, capturedResponse: captured });
+        const line = ev.reportRecorded
+            ? `Decidio recorded the execution of ${s.decisionId} (evidence tier ${ev.evidenceTier ?? "recorded"}); that approval is now spent - the next destructive command needs its own.`
+            : `Decidio did not record the execution of ${s.decisionId}: ${ev.diagnostic ?? "no report recorded"}.`;
+        err(`decidio hook: ${line}`);
+        process.stdout.write(JSON.stringify({ hookSpecificOutput: { hookEventName: "PostToolUse", additionalContext: line } }) + "\n");
+    }
+    catch (e) {
+        err(`decidio hook posttool: ${e?.message ?? e}`);
+    }
+    return 0;
+}
+async function cmdHookWait(id, timeoutSec) {
+    if (!id) {
+        err("✘ hook wait needs the decision id the hook named: npx @decidio/sdk hook wait <decision-id> [--timeout 600]");
+        return 2;
+    }
+    const problem = decisionIdProblem(id);
+    if (problem) {
+        err(`✘ "${id}" ${problem}`);
+        return 2;
+    }
+    const cfg = hookConfig();
+    if ("missing" in cfg) {
+        err(`✘ ${cfg.missing} - run \`npx @decidio/sdk init\` in this project first.`);
+        return 1;
+    }
+    const where = decisionUrl(cfg.appUrl, id);
+    err(`· decidio → ${API}`);
+    err(`· waiting for ${id}${where ? ` - approve at ${where}` : ""} (up to ${timeoutSec}s; Ctrl-C stops waiting, the request stays open)`);
+    const held = await hookHold(cfg, id, timeoutSec * 1000);
+    const st = held.status;
+    if (!st) {
+        err(`✘ could not read ${id}: ${held.lastError ?? "no answer"}`);
+        return 1;
+    }
+    log(st.state);
+    if (st.state === "pending") {
+        err(`· still pending after ${timeoutSec}s - run this again${where ? `, or approve at ${where}` : ""}.`);
+        return 1;
+    }
+    if (st.state === "rejected" || st.state === "blocked") {
+        err(`✘ ${id} was ${st.state}${st.reason ? `: ${st.reason}` : ""} - do not retry the command.`);
+        return 3;
+    }
+    err(`✔ ${id} ${st.state}${st.spent ? " - but already spent (an execution is recorded on it): the retry will ask again" : ""}${st.grantExpiresAt ? ` - valid until ${st.grantExpiresAt}` : ""}. Retry exactly the same command now.`);
+    return 0;
+}
+function cmdHookJustify(id, text) {
+    if (!id) {
+        err(`usage: npx @decidio/sdk hook justify <decisionId> "<what changed, in the user's words>"`);
+        return 2;
+    }
+    const idP = decisionIdProblem(id);
+    if (idP) {
+        err(`✘ ${idP}`);
+        return 2;
+    }
+    const tp = justificationProblem(text);
+    if (tp) {
+        err(`✘ ${tp}.`);
+        return 2;
+    }
+    try {
+        mkdirSync(hookStateDir(), { recursive: true });
+        writeFileSync(justifyPath(id), JSON.stringify({ v: 1, decisionId: id, justification: text.trim(), at: new Date().toISOString() }) + "\n");
+    }
+    catch (e) {
+        err(`✘ could not store the justification (${e?.message ?? e}).`);
+        return 1;
+    }
+    log(`✔ justification stored for ${id}. Retry EXACTLY the same command within a day: the request goes to the approver with these words beside the earlier refusal, and the justification is used once.`);
+    return 0;
+}
+function cmdHookRules() {
+    let extras = [];
+    try {
+        extras = hookExtraRules();
+    }
+    catch (e) {
+        err(`✘ ${e?.message ?? e} - while this stands, the hook refuses EVERY command.`);
+        return 1;
+    }
+    log(`Commands the Decidio hook gates (a person approves before they run; everything else runs as usual):`);
+    for (const r of HOOK_RULES)
+        log(`  ${r.category.padEnd(18)} ${r.summary}`);
+    if (extras.length) {
+        log(`From DECIDIO_HOOK_EXTRA_RULES (${process.env.DECIDIO_HOOK_EXTRA_RULES}):`);
+        for (const r of extras)
+            log(`  ${r.category.padEnd(18)} ${r.summary}`);
+    }
+    else
+        log(`Add your own: DECIDIO_HOOK_EXTRA_RULES=<file.json> with [{ "category": "deploy", "pattern": "^make deploy\\\\b", "summary": "make deploy" }] - each a regex over the whole command.`);
+    log(`The list is a client-side filter; your workspace's policy decides each request the hook sends. Hold: DECIDIO_HOOK_HOLD_MS (90000; capped at ${HOOK_HOLD_CAP_MS}, below the hook's 150 s timeout).`);
+    log(`Each request is bound to its SUBJECT as well as its text: a push to the branch and commit it would push, a delete to the paths, a statement to its database - so a refusal means "not this", and a new commit or a different path is a new request.`);
+    return 0;
+}
+function hookRunner() {
+    const q = (p) => `"${p.replace(/(["\\$`])/g, "\\$1")}"`;
+    const entry = process.argv[1] ?? "";
+    if (!entry || /[\\/]_npx[\\/]/.test(entry))
+        return `npx -y @decidio/sdk@${VERSION}`;
+    let real = entry;
+    try {
+        real = realPath(entry);
+    }
+    catch { }
+    const localRoot = resolvePath("node_modules") + pathSep;
+    if (real.startsWith(localRoot))
+        real = "$CLAUDE_PROJECT_DIR/node_modules/" + real.slice(localRoot.length).split(pathSep).join("/");
+    real = real.split(pathSep).join("/");
+    if (/\.ts$/.test(real))
+        return `npx tsx ${q(real)}`;
+    return `node ${q(real)}`;
+}
+async function cmdHookInstall(opts) {
+    const settingsPath = joinPath(".claude", opts.project ? "settings.json" : "settings.local.json");
+    let settings = {};
+    if (existsSync(settingsPath)) {
+        try {
+            settings = JSON.parse(readFileSync(settingsPath, "utf8"));
+        }
+        catch (e) {
+            err(`✘ ${settingsPath} exists but is not valid JSON (${e?.message ?? e}) - fix it first; nothing was written.`);
+            return 1;
+        }
+        if (!settings || typeof settings !== "object" || Array.isArray(settings)) {
+            err(`✘ ${settingsPath} is not a JSON object - nothing was written.`);
+            return 1;
+        }
+    }
+    if (opts.cli !== undefined && !opts.cli) {
+        err("✘ --cli needs the path of the CLI to run from the hook (e.g. --cli packages/decidio-guard/dist/cli.js)");
+        return 2;
+    }
+    const cliAt = opts.cli ? resolvePath(opts.cli).split(pathSep).join("/") : "";
+    const runner = opts.cli ? (/\.ts$/.test(opts.cli) ? `npx tsx "${cliAt}"` : `node "${cliAt}"`) : hookRunner();
+    const hooks = (settings.hooks = settings.hooks && typeof settings.hooks === "object" && !Array.isArray(settings.hooks) ? settings.hooks : {});
+    const place = (event, command, extra) => {
+        const list = Array.isArray(hooks[event]) ? hooks[event] : (hooks[event] = []);
+        const entry = { matcher: "Bash|PowerShell", hooks: [{ type: "command", command, ...extra }] };
+        const i = list.findIndex((e) => Array.isArray(e?.hooks) && e.hooks.some((h) => typeof h?.command === "string" && /\bhook (pretool|posttool)\b/.test(h.command) && /decidio|cli\.(js|ts)/.test(h.command)));
+        if (i >= 0) {
+            const same = JSON.stringify(list[i]) === JSON.stringify(entry);
+            list[i] = entry;
+            return same ? "kept" : "updated";
+        }
+        list.push(entry);
+        return "added";
+    };
+    const pre = place("PreToolUse", `cd "$CLAUDE_PROJECT_DIR" && ${runner} hook pretool`, { timeout: 150, onFailure: "block" });
+    const post = place("PostToolUse", `cd "$CLAUDE_PROJECT_DIR" && ${runner} hook posttool`, { timeout: 30 });
+    mkdirSync(".claude", { recursive: true });
+    writeFileSync(settingsPath, JSON.stringify(settings, null, 2) + "\n");
+    log(`✔ ${settingsPath.split(pathSep).join("/")}: PreToolUse hook ${pre}, PostToolUse hook ${post} (matcher Bash|PowerShell${opts.project ? "; this file is shared with everyone who clones the project" : "; this file is yours alone - Claude Code keeps it out of git"}).`);
+    log(`  Runs: ${runner} hook pretool|posttool  - the pretool hook times out at 150 s and BLOCKS the call if it fails (fail closed).`);
+    const env = readEnvFile();
+    const token = process.env.DECIDIO_API_TOKEN || env.DECIDIO_API_TOKEN;
+    if (token)
+        log(`✔ agent credentials: ${ENV_PATH} holds DECIDIO_API_TOKEN${(process.env.DECIDIO_AGENT_KEY || env.DECIDIO_AGENT_KEY) ? " and the agent's signing key" : ""} for "${process.env.DECIDIO_AGENT_ID || env.DECIDIO_AGENT_ID || defaultAgentId()}".`);
+    else
+        log(`⚠ no agent credentials here (no DECIDIO_API_TOKEN in ${ENV_PATH}) - until there are, EVERY gated command is refused. Run: npx @decidio/sdk init ${defaultAgentId()}`);
+    log(`  Gated: ${HOOK_RULES.map((r) => r.category).join(", ")} (npx @decidio/sdk hook rules lists the patterns; DECIDIO_HOOK_EXTRA_RULES adds yours).`);
+    log(`  Approver: anyone in your workspace with a role other than the agent's owner (the person who ran init) - on the phone app, the web app, Slack or Teams.`);
+    log(`           Nobody yet? Invite one: npx @decidio/sdk hook install --approver <email>   (single-use link; share by WhatsApp, SMS or email)`);
+    log(`  Flow: a gated command is held up to ${Math.min(Number(process.env.DECIDIO_HOOK_HOLD_MS ?? 90_000) || 90_000, HOOK_HOLD_CAP_MS) / 1000} s for the approver, then refused with its decision id; \`npx @decidio/sdk hook wait <id>\` returns when they decide,`);
+    log(`        and the SAME command retried then runs - once. A lab workspace allows 30 governed actions an hour; a gated command spends two (ask, retry).`);
+    log(`  Reload: restart Claude Code, or run /hooks in it - hooks are read when a session starts.`);
+    if (opts.approver !== undefined)
+        return inviteApprover(opts.approver);
+    return 0;
+}
+async function inviteApprover(email) {
+    if (!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email)) {
+        err(`✘ --approver needs an email address (got "${email}")`);
+        return 2;
+    }
+    const session = await acquireSession("Inviting an approver");
+    if (!session)
+        return 1;
+    const r = await api("/demo/invite", { method: "POST", body: JSON.stringify({}) }, session);
+    if (r.status !== 200 || typeof r.body?.link !== "string") {
+        err(`✘ could not create an invite (HTTP ${r.status}${r.body?.error ? `: ${r.body.error}` : ""}) - only the workspace owner can invite on a lab workspace; elsewhere add the approver in the app's Roles screen.`);
+        return 1;
+    }
+    const link = String(r.body.link);
+    const until = typeof r.body.expiresAt === "string" ? r.body.expiresAt.slice(0, 10) : "in 7 days";
+    const text = `I'm using Decidio to route my coding agent's risky commands to a person for approval - I'd like that person to be you. This link opens my workspace for you (single use, expires ${until}): ${link}`;
+    log(`✔ invite created (single use, expires ${until}). Send it to ${email} by whichever channel they read - these carry the invite, nothing else:`);
+    log(`  WhatsApp  https://wa.me/?text=${encodeURIComponent(text)}`);
+    log(`  SMS       sms:?&body=${encodeURIComponent(text)}`);
+    log(`  Email     mailto:${encodeURIComponent(email)}?subject=${encodeURIComponent("Approve my coding agent's risky commands")}&body=${encodeURIComponent(text)}`);
+    log(`  Link      ${link}`);
+    log(`  Opening it signs them into the web app (the phone build at the same address; the app stores can wait) as a recognized approver in your workspace.`);
+    return 0;
+}
+const PACK_SLUG_RE = /^[a-z0-9][a-z0-9-]{0,39}$/;
+const PACK_SKILL_PREFIX = "decidio-";
+const PACK_IGNORE_ENTRY = ".claude/skills/decidio-*/";
+const PACK_RULES_IGNORE_ENTRY = ".claude/rules/decidio-*.md";
+function claudeHome() {
+    return process.platform === "win32" ? (SHELL_ENV.USERPROFILE ?? homedir()) : (SHELL_ENV.HOME ?? homedir());
+}
+function ensurePackSkillsIgnored() {
+    try {
+        if (lstatSync(".gitignore").isSymbolicLink()) {
+            err(`· .gitignore is a symbolic link - add ${PACK_IGNORE_ENTRY} and ${PACK_RULES_IGNORE_ENTRY} to it yourself`);
+            return;
+        }
+    }
+    catch { }
+    const creating = !existsSync(".gitignore");
+    let existing = creating ? "" : readFileSync(".gitignore", "utf8");
+    for (const entry of [PACK_IGNORE_ENTRY, PACK_RULES_IGNORE_ENTRY]) {
+        if (existing.split(/\r?\n/).some((l) => l.trim() === entry))
+            continue;
+        appendFileSync(".gitignore", (existing && !existing.endsWith("\n") ? "\n" : "") + entry + "\n");
+        existing = readFileSync(".gitignore", "utf8");
+        log(`✔ ${creating && entry === PACK_IGNORE_ENTRY ? "wrote" : "added"} ${entry} to .gitignore (a pulled pack is yours to read, not the repository's to carry)`);
+    }
+}
+const yamlQuote = (s) => `"${s.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`;
+const mdCell = (s) => String(s ?? "").replace(/\|/g, "\\|").replace(/\s+/g, " ").trim();
+export function packScopeLabel(scope) {
+    if (!scope || typeof scope !== "object")
+        return null;
+    if (scope.kind === "org")
+        return "the organisation";
+    if (scope.kind === "personal")
+        return "yours";
+    if (scope.kind === "unit") {
+        const type = typeof scope.unitType === "string" && /^[a-z_]{1,20}$/.test(scope.unitType) ? (scope.unitType === "project" ? "program" : scope.unitType) : "unit";
+        const name = typeof scope.unitName === "string" && scope.unitName.trim() ? ` "${scope.unitName.replace(/["\r\n]/g, "'").slice(0, 80)}"` : "";
+        return `${type}${name}`;
+    }
+    return null;
+}
+export function hereQuery(cwd = process.cwd()) {
+    const cfg = joinPath(cwd, ".decidio.json");
+    try {
+        if (lstatSync(cfg).isSymbolicLink())
+            return { error: ".decidio.json is a symbolic link - replace it with the file itself (npx @decidio/sdk context bind --unit <id> writes it)" };
+    }
+    catch { }
+    if (existsSync(cfg)) {
+        let unit;
+        try {
+            unit = JSON.parse(readFileSync(cfg, "utf8"))?.unit;
+        }
+        catch {
+            return { error: ".decidio.json is not JSON - it holds {\"unit\": \"<unit id>\"} (npx @decidio/sdk context bind --unit <id> writes it)" };
+        }
+        if (typeof unit !== "string" || !/^[A-Za-z0-9_-]{1,64}$/.test(unit))
+            return { error: ".decidio.json's \"unit\" is not a unit id (npx @decidio/sdk context bind --unit <id> writes it)" };
+        return { unit };
+    }
+    let remote = "";
+    try {
+        remote = execFileSync("git", ["remote", "get-url", "origin"], { cwd, stdio: ["ignore", "pipe", "ignore"], encoding: "utf8", timeout: 5_000 }).trim();
+    }
+    catch {
+        return {};
+    }
+    const m = /^(?:git@github\.com:|ssh:\/\/git@github\.com\/|https:\/\/(?:[^@/]+@)?github\.com\/)([A-Za-z0-9][A-Za-z0-9-]{0,38})\/([A-Za-z0-9._-]{1,100}?)(?:\.git)?\/?$/.exec(remote);
+    return m ? { repo: `${m[1]}/${m[2]}` } : {};
+}
+export function plainProjectPath(parts) {
+    let p = ".claude";
+    for (const part of ["", ...parts]) {
+        if (part)
+            p = joinPath(p, part);
+        try {
+            if (lstatSync(p).isSymbolicLink())
+                return false;
+        }
+        catch { }
+    }
+    return true;
+}
+export function isPackFileOf(text, slug, kind) {
+    if (kind === "skill")
+        return text.startsWith(`---\nname: ${PACK_SKILL_PREFIX}${slug}\n`) && /\n# .*\(Decidio context pack\)\n/.test(text);
+    return /^# .*\(Decidio context pack - read first\)\n/.test(text);
+}
+function gitTracked(path) {
+    try {
+        execFileSync("git", ["ls-files", "--error-unmatch", "--", path], { stdio: "ignore", timeout: 5_000 });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+export function packSkillMarkdown(idx) {
+    const name = PACK_SKILL_PREFIX + String(idx.slug);
+    const rows = Array.isArray(idx.rows) ? idx.rows : [];
+    const description = `Use when the user's words match "${String(idx.trigger).replace(/"/g, "'")}" - the Decidio context pack "${String(idx.title).replace(/"/g, "'")}": the sealed decisions in force on the subject, by record id.`;
+    const table = rows.length
+        ? ["| Record | Title | Type | Status | Lifecycle | Decided | Link |", "| --- | --- | --- | --- | --- | --- | --- |",
+            ...rows.map((r) => `| ${mdCell(r.recordId)} | ${mdCell(r.title)} | ${mdCell(r.type)} | ${mdCell(r.status)} | ${mdCell(r.lifecycle?.state)}${r.lifecycle?.inEffect === false ? " (not in effect)" : ""} | ${mdCell(String(r.decidedAt ?? "").slice(0, 10))} | ${mdCell(r.url)} |`)].join("\n")
+        : "_No entries you can read yet._";
+    const omitted = Number(idx.omitted ?? 0);
+    return [
+        "---", `name: ${name}`, `description: ${yamlQuote(description)}`, "---", "",
+        `# ${String(idx.title)} (Decidio context pack)`, "",
+        ...(packScopeLabel(idx.scope) ? [`**Scope:** ${packScopeLabel(idx.scope)}`, ""] : []),
+        `**When to use:** ${String(idx.trigger)}`, "",
+        "These are sealed Decidio decisions the pack's owner curated for this subject. Treat them as the record of what was decided and cite them by record id. Role tokens such as [COUNTERPARTY_1] are protective placeholders: never guess or restate what they stand for. To read one in full, call Decidio's `get_decision` with its record id (the Decidio connector) or open its link; `get_context_pack` returns this list live. When a decision's lifecycle is not \"in_effect\", say so before relying on it.", "",
+        table, "",
+        `_Pulled ${String(idx.asOf)} · pack hash ${String(idx.hash)} · ${rows.length} ${rows.length === 1 ? "entry" : "entries"} shown${omitted ? `, ${omitted} you cannot read omitted` : ""}. Refresh with \`npx @decidio/sdk context pull\`._`, "",
+    ].join("\n");
+}
+export function packRulesMarkdown(idx) {
+    const rows = Array.isArray(idx.rows) ? idx.rows : [];
+    const table = rows.length
+        ? ["| Record | Title | Type | Status | Lifecycle | Decided | Link |", "| --- | --- | --- | --- | --- | --- | --- |",
+            ...rows.map((r) => `| ${mdCell(r.recordId)} | ${mdCell(r.title)} | ${mdCell(r.type)} | ${mdCell(r.status)} | ${mdCell(r.lifecycle?.state)}${r.lifecycle?.inEffect === false ? " (not in effect)" : ""} | ${mdCell(String(r.decidedAt ?? "").slice(0, 10))} | ${mdCell(r.url)} |`)].join("\n")
+        : "_No entries you can read yet._";
+    const omitted = Number(idx.omitted ?? 0);
+    return [
+        `# ${String(idx.title)} (Decidio context pack - read first)`, "",
+        ...(packScopeLabel(idx.scope) ? [`**Scope:** ${packScopeLabel(idx.scope)}`, ""] : []),
+        `**Read this on every question in this project.** The pack's owner says it applies "${String(idx.trigger).replace(/"/g, "'")}".`, "",
+        "These are sealed Decidio decisions the pack's owner curated as standing context: the record of what was decided. Cite them by record id. Role tokens such as [COUNTERPARTY_1] are protective placeholders: never guess or restate what they stand for; for the full record open the link, or call get_decision on the Decidio connector. The other Decidio packs (the skills pulled beside this file) build on this one.", "",
+        table, "",
+        `_Pulled ${String(idx.asOf)} · pack hash ${String(idx.hash)} · ${rows.length} ${rows.length === 1 ? "entry" : "entries"} shown${omitted ? `, ${omitted} you cannot read omitted` : ""}. Refresh with \`npx @decidio/sdk context pull\`._`, "",
+    ].join("\n");
+}
+function packChatgptBlock(idx) {
+    const rows = Array.isArray(idx.rows) ? idx.rows : [];
+    return [
+        `## Decidio context pack: ${String(idx.title)}${idx.always ? " - READ FIRST, on every question" : ""}`,
+        `When to use: ${idx.always ? "always - read this before the other packs; the owner says " : ""}"${String(idx.trigger).replace(/"/g, "'")}"`,
+        "These are sealed decisions, by record id; cite them, never guess what a role token like [COUNTERPARTY_1] stands for. For the full record call get_context_pack / get_decision on the Decidio connector, or open the link.",
+        ...rows.map((r) => `- ${mdCell(r.recordId)} · ${mdCell(r.title)} · ${mdCell(r.type)} · ${mdCell(r.lifecycle?.state)} · ${mdCell(r.url)}`),
+        `(pulled ${String(idx.asOf)}, hash ${String(idx.hash)}${Number(idx.omitted ?? 0) ? `, ${idx.omitted} you cannot read omitted` : ""})`,
+    ].join("\n");
+}
+async function cmdContext(sub, pos, flags) {
+    const usage = () => { err(`usage: npx @decidio/sdk context list | create <slug> --title "…" --trigger "…" [--unit <unitId> | --org] | add <slug> <record…> | remove <slug> <record…> | trigger <slug> "<phrase>" | always <slug> on|off | delete <slug> | bind --unit <unitId> | pull [--here] [--pack <slug>] [--chatgpt]`); return 2; };
+    const slug = pos[0];
+    if (!sub)
+        return usage();
+    if (["create", "add", "remove", "trigger", "always", "delete"].includes(sub)) {
+        if (!slug)
+            return usage();
+        if (!PACK_SLUG_RE.test(slug)) {
+            err(`✘ a pack slug is 1-40 lower-case letters, digits or dashes, starting with a letter or digit (got "${slug}").`);
+            return 2;
+        }
+    }
+    if (sub === "create" && (!flags.title || !flags.trigger)) {
+        err(`✘ create needs --title "…" and --trigger "…" (the trigger is the user's own words for WHEN a model should use the pack, e.g. "whenever we discuss the ACME application").`);
+        return 2;
+    }
+    if ((sub === "add" || sub === "remove") && pos.length < 2) {
+        err(`✘ ${sub} needs at least one record (a D·number or decision id) after the slug.`);
+        return 2;
+    }
+    if (sub === "trigger" && !pos[1]) {
+        err(`✘ trigger needs the phrase: npx @decidio/sdk context trigger ${slug} "whenever we discuss …"`);
+        return 2;
+    }
+    if (sub === "always" && !["on", "off"].includes(pos[1] ?? "")) {
+        err(`✘ always takes on or off: npx @decidio/sdk context always ${slug} on   (read on every question, as a Claude Code rules file) · off (fires on its trigger only)`);
+        return 2;
+    }
+    if (sub === "pull" && flags.pack && !PACK_SLUG_RE.test(flags.pack)) {
+        err(`✘ --pack names a pack by its slug (got "${flags.pack}").`);
+        return 2;
+    }
+    const unitFlag = flags.unit ?? flags.team;
+    if (sub === "create" && ((flags.unit && flags.team) || (unitFlag && flags.org))) {
+        err(`✘ create takes one scope: --unit <unitId> (or --team), or --org - not both.`);
+        return 2;
+    }
+    if (unitFlag !== undefined && !/^[A-Za-z0-9_-]{1,64}$/.test(unitFlag)) {
+        err(`✘ --unit names a unit by its id (got "${unitFlag}").`);
+        return 2;
+    }
+    if (sub === "bind" && !flags.unit) {
+        err(`✘ bind needs --unit <unitId>: it writes .decidio.json here, so \`context pull --here\` pulls that unit's packs.`);
+        return 2;
+    }
+    if (!["list", "create", "add", "remove", "trigger", "always", "delete", "pull", "bind"].includes(sub))
+        return usage();
+    const session = await acquireSession("Context packs");
+    if (!session)
+        return 1;
+    const call = async (method, path, body) => api(path, { method, ...(body !== undefined ? { body: JSON.stringify(body) } : {}) }, session);
+    const refused = (r) => {
+        const words = r.body && typeof r.body === "object" && typeof r.body.error === "string" ? r.body.error : `HTTP ${r.status}`;
+        err(`✘ ${words}${r.body?.code ? ` (${r.body.code})` : ""}`);
+        return 1;
+    };
+    const showPack = (p) => log(`  ${p.slug}  ${packScopeLabel(p.scope) ?? (p.audience === "team" ? `team ${p.teamUnitId ?? ""}`.trim() : p.audience === "org" ? "the organisation" : "personal")}  ${p.entries} ${p.entries === 1 ? "entry" : "entries"}  "${p.title}"${p.always ? "  · read on every question" : ""}\n    when: ${p.trigger}`);
+    if (sub === "list") {
+        const r = await call("GET", "/api/context-packs");
+        if (r.status !== 200)
+            return refused(r);
+        const packs = Array.isArray(r.body?.packs) ? r.body.packs : [];
+        if (flags.json) {
+            log(JSON.stringify({ packs }, null, 2));
+            return 0;
+        }
+        if (!packs.length) {
+            log(`No context packs yet. Create one: npx @decidio/sdk context create <slug> --title "…" --trigger "whenever we discuss …"`);
+            return 0;
+        }
+        log(`${packs.length} context pack${packs.length === 1 ? "" : "s"}:`);
+        packs.forEach(showPack);
+        return 0;
+    }
+    if (sub === "create") {
+        const r = await call("POST", "/api/context-packs", { slug, title: flags.title, trigger: flags.trigger, ...(unitFlag ? { audience: "team", teamUnitId: unitFlag } : flags.org ? { audience: "org" } : { audience: "personal" }) });
+        if (r.status !== 201)
+            return refused(r);
+        if (flags.json) {
+            log(JSON.stringify(r.body, null, 2));
+            return 0;
+        }
+        log(`✔ created pack ${slug}`);
+        showPack(r.body.pack);
+        log(`  Its title and trigger are shared with the model IN CLEAR, every turn${flags.team ? ", and with everyone in the unit" : ""} - that is how the model knows when to use it. Keep people's names out of them; decisions inside stay tokenized.`);
+        log(`  Add decisions: npx @decidio/sdk context add ${slug} D·0412 D·0418   then: npx @decidio/sdk context pull`);
+        return 0;
+    }
+    if (sub === "add" || sub === "remove") {
+        const r = await call(sub === "add" ? "POST" : "DELETE", `/api/context-packs/${slug}/entries`, { ids: pos.slice(1) });
+        if (r.status !== 200)
+            return refused(r);
+        if (flags.json) {
+            log(JSON.stringify(r.body, null, 2));
+            return 0;
+        }
+        if (sub === "add")
+            log(`✔ ${r.body.added?.length ?? 0} added to ${slug} (${r.body.pack?.entries ?? "?"} entries now)${(r.body.added?.length ?? 0) < pos.length - 1 ? " - the rest were already in it" : ""}`);
+        else
+            log(`✔ ${r.body.removed ?? 0} removed from ${slug} (${r.body.pack?.entries ?? "?"} entries now)`);
+        return 0;
+    }
+    if (sub === "trigger") {
+        const r = await call("PATCH", `/api/context-packs/${slug}`, { trigger: pos.slice(1).join(" ") });
+        if (r.status !== 200)
+            return refused(r);
+        if (flags.json) {
+            log(JSON.stringify(r.body, null, 2));
+            return 0;
+        }
+        log(`✔ ${slug} now fires: ${r.body.pack?.trigger}`);
+        log(`  Re-pull to update the skill files: npx @decidio/sdk context pull`);
+        return 0;
+    }
+    if (sub === "always") {
+        const on = pos[1] === "on";
+        const r = await call("PATCH", `/api/context-packs/${slug}`, { always: on });
+        if (r.status !== 200)
+            return refused(r);
+        if (flags.json) {
+            log(JSON.stringify(r.body, null, 2));
+            return 0;
+        }
+        if (on) {
+            log(`✔ ${slug} is now read on every question: pull writes it as a Claude Code rules file (.claude/rules/${PACK_SKILL_PREFIX}${slug}.md, loaded whole at launch), not a skill. Keep it short - it is in context every turn.`);
+        }
+        else
+            log(`✔ ${slug} now fires on its trigger only (pull writes it back as a skill and removes the rules file)`);
+        log(`  Re-pull to update the files: npx @decidio/sdk context pull`);
+        return 0;
+    }
+    if (sub === "delete") {
+        const r = await call("DELETE", `/api/context-packs/${slug}`);
+        if (r.status !== 200)
+            return refused(r);
+        log(`✔ deleted pack ${slug} (its pulled skill files stay until you remove them: .claude/skills/${PACK_SKILL_PREFIX}${slug}/ here or in ${joinPath(claudeHome(), ".claude", "skills")}; an always-pack's .claude/rules/${PACK_SKILL_PREFIX}${slug}.md likewise)`);
+        return 0;
+    }
+    if (sub === "bind") {
+        const r = await call("GET", `/api/context-packs/here?unit=${encodeURIComponent(flags.unit)}`);
+        if (r.status !== 200)
+            return refused(r);
+        const tmpCfg = `.decidio.json.${process.pid}.tmp`;
+        writeFileSync(tmpCfg, JSON.stringify({ unit: flags.unit }, null, 2) + "\n", { flag: "wx" });
+        renameSync(tmpCfg, ".decidio.json");
+        const chain = Array.isArray(r.body?.scope?.chain) ? r.body.scope.chain : [];
+        log(`✔ wrote .decidio.json: this folder is ${chain.length ? chain.map((u) => packScopeLabel({ kind: "unit", unitType: u.type, unitName: u.name })).join(" → ") : `unit ${flags.unit}`}`);
+        log(`  Commit it so the team shares the scope; then: npx @decidio/sdk context pull --here`);
+        return 0;
+    }
+    let hereScope = null;
+    let r;
+    if (flags.here) {
+        const q = hereQuery();
+        if (q.error) {
+            err(`✘ ${q.error}`);
+            return 1;
+        }
+        r = await call("GET", `/api/context-packs/here${q.unit ? `?unit=${encodeURIComponent(q.unit)}` : q.repo ? `?repo=${encodeURIComponent(q.repo)}` : ""}`);
+        if (r.status !== 200)
+            return refused(r);
+        hereScope = r.body?.scope ?? null;
+    }
+    else {
+        r = await call("GET", "/api/context-packs");
+        if (r.status !== 200)
+            return refused(r);
+    }
+    let packs = Array.isArray(r.body?.packs) ? r.body.packs : [];
+    if (flags.pack) {
+        packs = packs.filter((p) => p.slug === flags.pack);
+        if (!packs.length) {
+            err(`✘ no context pack of yours is called "${flags.pack}" (npx @decidio/sdk context list shows them).`);
+            return 1;
+        }
+    }
+    if (!packs.length && !flags.here) {
+        log(`No context packs to pull. Create one: npx @decidio/sdk context create <slug> --title "…" --trigger "whenever we discuss …"`);
+        return 0;
+    }
+    packs = [...packs.filter((p) => p?.always === true), ...packs.filter((p) => p?.always !== true)];
+    const written = [];
+    let wroteProject = false;
+    for (const p of packs) {
+        if (typeof p?.slug !== "string" || !PACK_SLUG_RE.test(p.slug)) {
+            err(`✘ refusing a pack whose slug is not a slug (${JSON.stringify(String(p?.slug)).slice(0, 60)}) - nothing written for it.`);
+            continue;
+        }
+        const ix = await call("GET", `/api/context-packs/${p.slug}/index`);
+        if (ix.status !== 200)
+            return refused(ix);
+        const idx = ix.body;
+        const always = p.always === true;
+        idx.scope = p.scope ?? null;
+        if (flags.chatgpt) {
+            log(packChatgptBlock({ ...idx, always }));
+            log("");
+            continue;
+        }
+        const project = p.audience === "team" || p.audience === "org";
+        if (project && (!plainProjectPath(["skills", PACK_SKILL_PREFIX + p.slug, "SKILL.md"]) || !plainProjectPath(["rules", PACK_SKILL_PREFIX + p.slug + ".md"]))) {
+            err(`✘ refusing to write pack ${p.slug}: a path under .claude is a symbolic link - nothing written for it.`);
+            continue;
+        }
+        const base = project ? ".claude" : joinPath(claudeHome(), ".claude");
+        const dir = joinPath(base, "skills", PACK_SKILL_PREFIX + p.slug);
+        const rules = joinPath(base, "rules", PACK_SKILL_PREFIX + p.slug + ".md");
+        let path;
+        if (always) {
+            mkdirSync(joinPath(base, "rules"), { recursive: true });
+            writeFileSync(rules, packRulesMarkdown({ ...idx, always }));
+            rmSync(joinPath(dir, "SKILL.md"), { force: true });
+            try {
+                rmdirSync(dir);
+            }
+            catch { }
+            path = rules;
+        }
+        else {
+            mkdirSync(dir, { recursive: true });
+            writeFileSync(joinPath(dir, "SKILL.md"), packSkillMarkdown(idx));
+            rmSync(rules, { force: true });
+            path = joinPath(dir, "SKILL.md");
+        }
+        if (project)
+            wroteProject = true;
+        written.push({ slug: p.slug, path, rows: Array.isArray(idx.rows) ? idx.rows.length : 0, omitted: Number(idx.omitted ?? 0), hash: String(idx.hash), always });
+    }
+    if (flags.chatgpt) {
+        err(`· paste each block above into the ChatGPT Project's instructions (or wherever that host keeps standing context); the Decidio connector's get_context_pack returns the same list live.`);
+        return 0;
+    }
+    if (wroteProject)
+        ensurePackSkillsIgnored();
+    const removed = [];
+    if (flags.here && !flags.pack) {
+        const keep = new Set(written.map((w) => w.slug));
+        const skillsDir = joinPath(".claude", "skills"), rulesDir = joinPath(".claude", "rules");
+        const readText = (path) => { try {
+            return readFileSync(path, "utf8");
+        }
+        catch {
+            return "";
+        } };
+        if (existsSync(skillsDir) && plainProjectPath(["skills"]))
+            for (const d of readdirSync(skillsDir)) {
+                const slugOf = d.startsWith(PACK_SKILL_PREFIX) ? d.slice(PACK_SKILL_PREFIX.length) : "";
+                const file = joinPath(skillsDir, d, "SKILL.md");
+                if (!PACK_SLUG_RE.test(slugOf) || keep.has(slugOf) || !plainProjectPath(["skills", d, "SKILL.md"]) || !existsSync(file))
+                    continue;
+                if (!isPackFileOf(readText(file), slugOf, "skill") || gitTracked(file))
+                    continue;
+                rmSync(file, { force: true });
+                try {
+                    rmdirSync(joinPath(skillsDir, d));
+                }
+                catch { }
+                removed.push(slugOf);
+            }
+        if (existsSync(rulesDir) && plainProjectPath(["rules"]))
+            for (const f of readdirSync(rulesDir)) {
+                const m = /^decidio-([a-z0-9][a-z0-9-]{0,39})\.md$/.exec(f);
+                const file = joinPath(rulesDir, f);
+                if (!m || keep.has(m[1]) || !plainProjectPath(["rules", f]) || !isPackFileOf(readText(file), m[1], "rules") || gitTracked(file))
+                    continue;
+                rmSync(file, { force: true });
+                if (!removed.includes(m[1]))
+                    removed.push(m[1]);
+            }
+    }
+    if (flags.json) {
+        log(JSON.stringify({ written, ...(flags.here ? { scope: hereScope, removed } : {}) }, null, 2));
+        return 0;
+    }
+    if (flags.here) {
+        const chain = Array.isArray(hereScope?.chain) ? hereScope.chain : [];
+        const where = chain.length ? chain.map((u) => packScopeLabel({ kind: "unit", unitType: u.type, unitName: u.name })).join(" → ") : hereScope?.source === "repo" ? "a repository in no unit of Decidio" : "no unit";
+        log(`Here: the organisation → ${where}${!chain.length ? " (the organisation's packs and your own)" : ""}`);
+        if (!written.length)
+            log(`No context packs apply here.`);
+    }
+    for (const w of written)
+        log(`✔ ${w.path.split(pathSep).join("/")}  (${w.rows} ${w.rows === 1 ? "entry" : "entries"}${w.omitted ? `, ${w.omitted} you cannot read omitted` : ""}; hash ${w.hash}${w.always ? "; read on every question" : ""})`);
+    if (removed.length)
+        log(`✔ removed ${removed.length} pack file${removed.length === 1 ? "" : "s"} that ${removed.length === 1 ? "does" : "do"} not apply here: ${removed.join(", ")}`);
+    log(`  Claude Code loads each pack's trigger line every turn and the list only when the trigger applies${written.some((w) => w.always) ? "; an always-pack (.claude/rules) is loaded whole at launch" : ""}. Re-run after curating.`);
+    return 0;
+}
+const ADR_TAKE = new Set(["accepted", "approved", "adopted", "decided"]);
+export function parseAdr(text) {
+    let body = text.replace(/\r\n/g, "\n");
+    let status = null;
+    const fm = /^---\n([\s\S]*?)\n---\n/.exec(body);
+    if (fm) {
+        const st = /^status:\s*["']?([A-Za-z]+)/im.exec(fm[1]);
+        if (st)
+            status = st[1].toLowerCase();
+        body = body.slice(fm[0].length);
+    }
+    const titleLine = /^#\s+(.+)$/m.exec(body);
+    if (!titleLine)
+        return null;
+    const title = titleLine[1].replace(/^(?:ADR[-\s]?)?\d+[:.\-)]?\s*/i, "").replace(/[*_`]/g, "").trim().slice(0, 200);
+    if (!title)
+        return null;
+    const sections = new Map();
+    const parts = body.split(/^##\s+/m).slice(1);
+    for (const part of parts) {
+        const nl = part.indexOf("\n");
+        const head = (nl < 0 ? part : part.slice(0, nl)).trim().toLowerCase();
+        sections.set(head, (nl < 0 ? "" : part.slice(nl + 1)).trim());
+    }
+    const pick = (...names) => { for (const [h, v] of sections)
+        if (names.some((n) => h === n || h.startsWith(n)))
+            return v; return ""; };
+    if (!status) {
+        const inline = /^\s*\**status\**\s*:\s*\**\s*([A-Za-z]+)/im.exec(body);
+        const sec = pick("status").split("\n").map((l) => l.replace(/[*_`\-]/g, "").trim()).find(Boolean);
+        status = (inline?.[1] ?? sec?.split(/\s+/)[0] ?? "").toLowerCase() || null;
+    }
+    const clean = (t, max) => t.replace(/\n{3,}/g, "\n\n").trim().slice(0, max);
+    const consequences = pick("consequences");
+    const context = pick("context and problem statement", "context");
+    const rationale = clean([context, consequences ? `Consequences: ${consequences}` : ""].filter(Boolean).join("\n\n"), 4000);
+    const decided = clean(pick("decision outcome", "decision"), 4000);
+    const alternatives = pick("considered options", "options considered", "alternatives", "options").split("\n")
+        .map((l) => /^\s*(?:[-*+]|\d+\.)\s+(.+)$/.exec(l)?.[1]?.replace(/[*_`]/g, "").trim() ?? "").filter(Boolean).slice(0, 30).map((x) => x.slice(0, 1000));
+    return { title, status, decided, rationale, alternatives };
+}
+async function cmdDecisionsImport(dir, dryRun) {
+    if (!dir) {
+        err("✘ import needs --adr <folder of ADR markdown files>, e.g. --adr docs/adr");
+        return 2;
+    }
+    const abs = resolvePath(dir);
+    let files;
+    try {
+        files = readdirSync(abs).filter((f) => /\.md$/i.test(f) && !/^(readme|index|template)/i.test(f)).sort().slice(0, 200);
+    }
+    catch {
+        err(`✘ ${dir} is not a folder this command can read.`);
+        return 1;
+    }
+    let repoKey = "";
+    try {
+        repoKey = execFileSync("git", ["remote", "get-url", "origin"], { cwd: abs, timeout: 3000, stdio: ["ignore", "pipe", "ignore"], encoding: "utf8" }).trim();
+    }
+    catch {
+        repoKey = "";
+    }
+    let root = abs;
+    try {
+        root = execFileSync("git", ["rev-parse", "--show-toplevel"], { cwd: abs, timeout: 3000, stdio: ["ignore", "pipe", "ignore"], encoding: "utf8" }).trim() || abs;
+    }
+    catch {
+        root = abs;
+    }
+    const take = [], skipped = [];
+    for (const f of files) {
+        const p = joinPath(abs, f);
+        try {
+            if (lstatSync(p).isSymbolicLink() || statSync(p).size > 200_000) {
+                skipped.push(`${f} (not a plain file under 200 KB)`);
+                continue;
+            }
+        }
+        catch {
+            continue;
+        }
+        const adr = parseAdr(readFileSync(p, "utf8"));
+        if (!adr) {
+            skipped.push(`${f} (no "# title")`);
+            continue;
+        }
+        if (adr.status && !ADR_TAKE.has(adr.status)) {
+            skipped.push(`${f} (${adr.status})`);
+            continue;
+        }
+        if (!adr.decided && !adr.rationale) {
+            skipped.push(`${f} (no decision or context section)`);
+            continue;
+        }
+        const rel = relative(root, p).split(pathSep).join("/");
+        take.push({ file: f, adr, key: `adr:${createHash("sha256").update(`${repoKey || root}\u0000${rel}`).digest("hex").slice(0, 16)}` });
+    }
+    if (dryRun) {
+        for (const t of take)
+            log(`would import ${t.file}: "${t.adr.title}"${t.adr.alternatives.length ? ` (${t.adr.alternatives.length} options considered)` : ""}`);
+        for (const s of skipped)
+            log(`would skip ${s}`);
+        log(`${take.length} to import as drafts, ${skipped.length} skipped. Nothing was sent.`);
+        return 0;
+    }
+    if (!take.length) {
+        log(`Nothing to import (${skipped.length} skipped${skipped.length ? `: ${skipped.slice(0, 5).join("; ")}` : ""}).`);
+        return 0;
+    }
+    const session = await acquireSession("Importing decision records");
+    if (!session)
+        return 1;
+    const call = async (method, path, body) => api(path, { method, ...(body !== undefined ? { body: JSON.stringify(body) } : {}) }, session);
+    const me = await call("GET", "/api/me");
+    const userId = typeof me.body?.userId === "string" ? me.body.userId : null;
+    if (!userId) {
+        err("✘ sign in as yourself first (npx @decidio/sdk login) - an imported draft is owned by the person who imports it.");
+        return 1;
+    }
+    let made = 0, again = 0, failed = 0;
+    for (const t of take) {
+        const c = await call("POST", "/api/decisions", { type: "deliberation", title: t.adr.title, ownerId: userId, draft: true, sourceSystem: "adr", sourceExternalId: t.key, tags: ["adr"] });
+        if (c.status === 409 && c.body?.code === "ALREADY_IMPORTED") {
+            again++;
+            log(`· ${t.file}: imported before - kept as it is`);
+            continue;
+        }
+        const id = typeof c.body?.id === "string" ? c.body.id : null;
+        if (c.status !== 201 || !id) {
+            failed++;
+            err(`✘ ${t.file}: ${c.body?.message ?? c.body?.error ?? `HTTP ${c.status}`}`);
+            continue;
+        }
+        const body = {};
+        if (t.adr.decided)
+            body.decided = t.adr.decided;
+        if (t.adr.rationale)
+            body.rationale = t.adr.rationale;
+        if (t.adr.alternatives.length)
+            body.alternatives = t.adr.alternatives;
+        const w = await call("POST", `/api/decisions/${encodeURIComponent(id)}/complete`, body);
+        if (w.status >= 300) {
+            failed++;
+            err(`✘ ${t.file}: the draft was made but its text was not saved (${w.body?.message ?? `HTTP ${w.status}`}) - open it in Decidio`);
+            continue;
+        }
+        made++;
+        log(`✔ ${t.file} → a draft: "${t.adr.title}"`);
+    }
+    log(`${made} imported as drafts, ${again} imported before, ${failed} failed, ${skipped.length} skipped. Review and seal them in Decidio (the Queue): only sealed decisions are cited.`);
+    return failed ? 1 : 0;
+}
+const GH_ENV_RE = /^[A-Za-z0-9._-]{1,64}$/;
+const GH_DECISION_RE = /^[A-Za-z0-9_-]{8,64}$/;
+const GH_WORKFLOW_RE = /^\.github\/workflows\/[A-Za-z0-9._-]{1,100}\.ya?ml$/;
+const GH_JUSTIFICATION_MAX = 280;
+export const AGENTS_MD_START = "<!-- decidio:start -->";
+export const AGENTS_MD_END = "<!-- decidio:end -->";
+async function actionsOidcToken() {
+    const url = process.env.ACTIONS_ID_TOKEN_REQUEST_URL, tok = process.env.ACTIONS_ID_TOKEN_REQUEST_TOKEN;
+    if (!url || !tok) {
+        err("✘ no GitHub OIDC token here: run this inside a GitHub Actions job whose workflow sets `permissions: id-token: write`.");
+        return null;
+    }
+    const aud = (process.env.DECIDIO_GITHUB_OIDC_AUDIENCE ?? "decidio").trim() || "decidio";
+    let u;
+    try {
+        u = new URL(url);
+    }
+    catch {
+        err("✘ ACTIONS_ID_TOKEN_REQUEST_URL is not a URL - nothing was sent.");
+        return null;
+    }
+    if (u.protocol !== "https:" && !(u.protocol === "http:" && (u.hostname === "127.0.0.1" || u.hostname === "localhost"))) {
+        err("✘ GitHub's token service must be https - nothing was sent.");
+        return null;
+    }
+    u.searchParams.set("audience", aud);
+    try {
+        const r = await fetch(u, { headers: { authorization: `bearer ${tok}`, accept: "application/json" } });
+        const j = await r.json().catch(() => null);
+        if (!r.ok || typeof j?.value !== "string" || !j.value) {
+            err(`✘ GitHub did not issue an OIDC token (${r.status}) - nothing was sent to Decidio.`);
+            return null;
+        }
+        return j.value;
+    }
+    catch (e) {
+        err(`✘ could not reach GitHub's token service (${e?.cause?.code ?? e?.message ?? "network error"}) - nothing was sent to Decidio.`);
+        return null;
+    }
+}
+async function cmdGithubRequest(environment, justification) {
+    if (!environment || !GH_ENV_RE.test(environment)) {
+        err("✘ request needs --environment <name>: one of the environments the repository was bound with (letters, digits, . _ -).");
+        return 2;
+    }
+    if (justification !== undefined && (!justification.trim() || justification.length > GH_JUSTIFICATION_MAX || /[\r\n]/.test(justification))) {
+        err(`✘ --justification is one line of up to ${GH_JUSTIFICATION_MAX} characters.`);
+        return 2;
+    }
+    const token = await actionsOidcToken();
+    if (!token)
+        return 1;
+    const r = await api("/api/github/runs/request", { method: "POST", headers: { "x-decidio-client": `sdk/${VERSION}` }, body: JSON.stringify({ environment, ...(justification ? { justification: justification.trim() } : {}) }) }, token);
+    const b = (r.body && typeof r.body === "object" ? r.body : {});
+    const ref = `${b.displayNumber ?? b.decisionId ?? ""}${b.url ? ` ${b.url}` : ""}`.trim();
+    if (r.status === 200 && (b.decision === "route" || b.decision === "proceed")) {
+        log(b.decision === "proceed"
+            ? `✔ ${environment}: no approval needed - Decidio starts the deploy (${ref})`
+            : `✔ asked: a teammate approves ${environment} in Decidio, then Decidio starts the deploy. This job is done (${ref})`);
+        if (b.existing)
+            log("  An approval request for this commit was already open - that one stands.");
+        return 0;
+    }
+    if (r.status === 200 && b.decision === "duplicate") {
+        err(`✘ ${String(b.error ?? "a person refused this commit before")}`);
+        err(`  To ask again, say what changed: npx @decidio/sdk github request --environment ${environment} --justification "<what changed>"`);
+        return 1;
+    }
+    if (r.status === 200 && b.decision === "block") {
+        err(`✘ the workspace's policy blocks this deploy (${ref}).`);
+        return 1;
+    }
+    err(`✘ Decidio refused the request (${r.status}${b.code ? ` ${b.code}` : ""}): ${String(b.error ?? "no reason given")}`);
+    return 1;
+}
+async function cmdGithubVerify(decisionArg) {
+    const decision = (decisionArg ?? process.env.DECIDIO_DECISION ?? "").trim();
+    if (!GH_DECISION_RE.test(decision)) {
+        err("✘ verify needs the decision id Decidio dispatched: set DECIDIO_DECISION to ${{ inputs.decidio }} (or pass --decision). Do not deploy.");
+        return 2;
+    }
+    const token = await actionsOidcToken();
+    if (!token) {
+        err("  Do not deploy.");
+        return 1;
+    }
+    const r = await api("/api/github/runs/verify", { method: "POST", headers: { "x-decidio-client": `sdk/${VERSION}` }, body: JSON.stringify({ decision }) }, token);
+    const b = (r.body && typeof r.body === "object" ? r.body : {});
+    if (r.status === 200 && b.ok === true && typeof b.sha === "string" && /^[0-9a-f]{40}$/.test(b.sha)) {
+        const out = process.env.GITHUB_OUTPUT;
+        if (out)
+            appendFileSync(out, `sha=${b.sha}\ndecision=${decision}\n`);
+        log(`✔ approved: deploy ${b.sha.slice(0, 12)} to ${String(b.environment ?? "")} (${b.displayNumber ?? decision}). This approval is now used.`);
+        return 0;
+    }
+    err(`✘ not approved - do not deploy (${r.status}${b.code ? ` ${b.code}` : ""}): ${String(b.error ?? "no reason given")}`);
+    return 1;
+}
+function plainRepoPath(root, rel) {
+    let p = root;
+    for (const part of rel.split("/")) {
+        p = joinPath(p, part);
+        try {
+            if (lstatSync(p).isSymbolicLink())
+                return false;
+        }
+        catch { }
+    }
+    return true;
+}
+export const DECIDIO_ACTION = "OmniTwin/decidio-actions@e40ba8e75a223f2475038d38a16df5a5885afde4 # v1.0.0";
+export const CHECKOUT_ACTION = "actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0";
+export function githubRequestWorkflow(api, environment, branch = "main") {
+    return `# Written by npx @decidio/sdk github init. Asks a teammate to approve each deploy; Decidio starts the deploy workflow once
+# approved. No repository secret: the job's own OIDC token is the credential.
+name: Ask Decidio to deploy
+on:
+  push:
+    branches: [${branch}]
+permissions:
+  id-token: write
+  contents: read
+jobs:
+  ask:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: ${DECIDIO_ACTION}
+        with:
+          step: request
+          environment: ${environment}
+          api-url: ${api}
+`;
+}
+export function githubVerifySteps(api) {
+    return `      - id: decidio
+        uses: ${DECIDIO_ACTION}
+        with:
+          step: verify
+          decision: \${{ inputs.decidio }}
+          api-url: ${api}
+      - uses: ${CHECKOUT_ACTION}
+        with:
+          ref: \${{ steps.decidio.outputs.sha }}
+`;
+}
+export function githubDeployWorkflow(api, environment) {
+    return `# Written by npx @decidio/sdk github init. Decidio starts this workflow once the deploy is approved; its first step proves the
+# approval (once, for this commit and environment) before anything deploys. Restrict who may run it to the Decidio app in the
+# repository's workflow execution protections.
+name: Deploy
+run-name: Decidio \${{ inputs.decidio }}
+on:
+  workflow_dispatch:
+    inputs:
+      decidio:
+        description: Set by Decidio
+        required: true
+permissions:
+  id-token: write
+  contents: read
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    environment: ${environment}
+    steps:
+${githubVerifySteps(api)}      - name: Deploy
+        run: ./deploy.sh   # your deploy command
+`;
+}
+export function agentsMdSection(appUrl) {
+    return `${AGENTS_MD_START}
+## Decisions (Decidio)
+
+This repository's sealed decisions live in Decidio (${appUrl}); sign in to read the ones you may see. An agent connected to
+Decidio's MCP server calls \`check_plan\` with its plan before acting: it answers which decisions the plan would contradict.
+Nothing of a decision is kept in this file.
+${AGENTS_MD_END}
+`;
+}
+export function withAgentsMdSection(text, section) {
+    const m = new RegExp(`${AGENTS_MD_START}\\r?\\n## Decisions \\(Decidio\\)\\r?\\n`).exec(text);
+    const a = m ? m.index : -1, b = m ? text.indexOf(AGENTS_MD_END, a + m[0].length) : -1;
+    if (a >= 0 && b > a)
+        return text.slice(0, a) + section.trimEnd() + text.slice(b + AGENTS_MD_END.length);
+    return `${text}${text && !text.endsWith("\n") ? "\n" : ""}${text ? "\n" : ""}${section}`;
+}
+async function cmdGithubInit(opts) {
+    const environment = opts.environment ?? "production", workflow = opts.workflow ?? ".github/workflows/deploy.yml";
+    if (!GH_ENV_RE.test(environment)) {
+        err("✘ --environment is the environment the deploy job declares (letters, digits, . _ -).");
+        return 2;
+    }
+    if (!GH_WORKFLOW_RE.test(workflow)) {
+        err("✘ --workflow is the deploy workflow's path, .github/workflows/<name>.yml");
+        return 2;
+    }
+    const apiUrl = (opts.api ?? process.env.DECIDIO_API_URL ?? DEFAULT_API).replace(/\/$/, "");
+    try {
+        assertSafeTransport(apiUrl, true);
+    }
+    catch (e) {
+        err(`✘ ${String(e?.message ?? e).replace(/^\[decidio\] /, "")}`);
+        return 2;
+    }
+    if (!/^https?:\/\/[A-Za-z0-9.-]+(?::\d+)?$/.test(apiUrl)) {
+        err("✘ --api is the Decidio API's origin, e.g. https://decidio-api.onrender.com");
+        return 2;
+    }
+    let root;
+    try {
+        root = execFileSync("git", ["rev-parse", "--show-toplevel"], { timeout: 3000, stdio: ["ignore", "pipe", "ignore"], encoding: "utf8" }).trim();
+    }
+    catch {
+        err("✘ run this inside the repository's checkout (git could not find its root).");
+        return 1;
+    }
+    if (!root) {
+        err("✘ run this inside the repository's checkout (git could not find its root).");
+        return 1;
+    }
+    let branch = "main";
+    try {
+        const head = execFileSync("git", ["symbolic-ref", "--short", "refs/remotes/origin/HEAD"], { cwd: root, timeout: 3000, stdio: ["ignore", "pipe", "ignore"], encoding: "utf8" }).trim().replace(/^origin\//, "");
+        if (/^[A-Za-z0-9._\/-]{1,100}$/.test(head) && !head.includes(".."))
+            branch = head;
+    }
+    catch { }
+    const write = (rel, text) => {
+        if (!plainRepoPath(root, rel))
+            return "refused";
+        const abs = joinPath(root, rel);
+        if (existsSync(abs))
+            return "kept";
+        mkdirSync(joinPath(abs, ".."), { recursive: true });
+        writeFileSync(abs, text, { flag: "wx" });
+        return "written";
+    };
+    const said = (rel, w, what) => w === "written" ? log(`✔ wrote ${rel} - ${what}`) : w === "kept" ? log(`· ${rel} already exists - kept as it is`) : err(`✘ ${rel}: a symbolic link is on its path - nothing was written through it`);
+    const reqRel = ".github/workflows/decidio-request.yml";
+    said(reqRel, write(reqRel, githubRequestWorkflow(apiUrl, environment, branch)), `asks for approval on every push to ${branch} (edit the trigger to suit)`);
+    const dep = write(workflow, githubDeployWorkflow(apiUrl, environment));
+    said(workflow, dep, "the deploy Decidio starts once approved (replace ./deploy.sh with your deploy)");
+    if (dep === "kept") {
+        log(`  Your deploy workflow must: run on workflow_dispatch with an input named decidio; set permissions id-token: write;`);
+        log(`  declare environment: ${environment}; and make these its FIRST steps (they check out the approved commit):`);
+        for (const line of githubVerifySteps(apiUrl).trimEnd().split("\n"))
+            log(`  ${line}`);
+    }
+    const agentsRel = "AGENTS.md", agentsAbs = joinPath(root, agentsRel);
+    const appUrl = (process.env.DECIDIO_APP_URL || apiUrl.replace(/^https:\/\/(decidio-api\.onrender\.com|mcp\.decidioai\.com)$/, "https://app.decidioai.com")).replace(/\/$/, "");
+    const section = agentsMdSection(appUrl);
+    if (!plainRepoPath(root, agentsRel))
+        err(`✘ ${agentsRel} is a symbolic link - nothing was written through it`);
+    else if (existsSync(agentsAbs) || opts.agentsMd) {
+        const before = existsSync(agentsAbs) ? readFileSync(agentsAbs, "utf8") : "";
+        const after = withAgentsMdSection(before, section);
+        if (after !== before) {
+            writeFileSync(agentsAbs, after);
+            log(`✔ ${agentsRel}: a link to Decidio for agents (no decision text)`);
+        }
+        else
+            log(`· ${agentsRel} already links to Decidio`);
+    }
+    else
+        log(`· no AGENTS.md here - add --agents-md to create one with a link to Decidio for agents (no decision text)`);
+    log("");
+    log("Next:");
+    log(`  1. In Decidio: Connect → GitHub approvals → bind this repository with ${workflow} and the environment ${environment}.`);
+    log(`  2. In the repository's settings: restrict who may run ${workflow} to the Decidio app (workflow execution protections),`);
+    log(`     so a deploy runs only when Decidio starts it.`);
+    log(`  3. Commit the workflows and push: the first push to ${branch} asks a teammate.`);
+    return 0;
+}
 const USAGE = `✦ Decidio — the SDK command line
 
   The wrapper IS the SDK: guard.protect(fn, describe) ships in this package (import { guard } from "@decidio/sdk").
@@ -2415,6 +3948,71 @@ APPROVALS AND RECEIPTS
                                        for your Decidio when you signed in, else the built-in hosted-service issuer
                                        (never the receipt's own issuer field; --allow-unpinned: structural check only)
 
+CODING AGENTS (Claude Code)
+  npx @decidio/sdk hook install [--project] [--approver <email>] [--cli <path>]
+                                       a person approves Claude Code's destructive shell commands before they run
+                                       (rm -rf, git push --force, DROP TABLE, terraform apply, kubectl delete,
+                                       npm publish, curl | sh, ...): writes the PreToolUse/PostToolUse hooks into
+                                       .claude/settings.local.json (--project: the shared .claude/settings.json;
+                                       --cli: run that CLI file from the hook instead of this one). --approver
+                                       mints a single-use invite and prints WhatsApp / SMS / email share links.
+  npx @decidio/sdk hook wait <decision-id> [--timeout 600]
+                                       wait for the approver's decision the hook named, then retry the command
+                                       (exit 0 approved · 3 rejected or blocked · 1 still pending)
+  npx @decidio/sdk hook justify <decision-id> "<what changed>"
+                                       when the hook says a command looks like a duplicate of a request a person already
+                                       refused: store the user's one-line reason it is different, then retry the same
+                                       command - the request reaches the approver with that reason beside the refusal
+  npx @decidio/sdk hook rules          the command patterns the hook gates (DECIDIO_HOOK_EXTRA_RULES adds yours)
+  npx @decidio/sdk hook pretool|posttool   the hooks themselves: run by Claude Code with the tool call as JSON on
+                                       stdin, never by hand. A gated command is held up to DECIDIO_HOOK_HOLD_MS
+                                       (90 s; at most 120 s) for the approver, then refused with its decision id; the SAME command
+                                       retried after approval runs once - its execution is recorded and that
+                                       approval is spent. No credentials, no gate, no answer = refused (fail closed).
+
+CONTEXT PACKS (Claude Code, Claude.ai, ChatGPT)
+  npx @decidio/sdk context create <slug> --title "ACME application" --trigger "whenever we discuss the ACME application"
+                                       a pack: YOUR curated list of sealed decisions and the words that tell a model when
+                                       to use it. The title and trigger are shared with the model IN CLEAR, every turn
+                                       (that is how it matches); the decisions inside stay tokenized. --team <unitId>
+                                       makes it the unit's: readable by its people, its words shared with all of them,
+                                       holding only decisions the whole unit may read
+  npx @decidio/sdk context add <slug> D·0412 D·0418     add sealed decisions (D·numbers or ids) · remove takes them out
+  npx @decidio/sdk context trigger <slug> "<phrase>"   change when it fires · delete <slug> · list [--json]
+  npx @decidio/sdk context always <slug> on|off        a FOUNDATION pack (how we work, the architecture): read on every
+                                       question, whatever the trigger - up to two per workspace, 20 records each, so the
+                                       other packs can build on it without repeating it. Pulled as a Claude Code rules
+                                       file (.claude/rules/decidio-<slug>.md, loaded whole at launch); the connector's
+                                       list_packs inlines it for ChatGPT and Claude.ai.
+  npx @decidio/sdk context pull [--here] [--pack <slug>] [--chatgpt]
+  npx @decidio/sdk context bind --unit <unitId>     (this folder's unit, in .decidio.json: --here pulls its packs)
+                                       write each pack as a Claude Code skill: a team pack to .claude/skills/decidio-<slug>/
+                                       (git-ignored - each reader pulls their own), a personal one to ~/.claude/skills/.
+                                       The trigger is the skill's one-line description; the decisions load only when it
+                                       applies. --chatgpt prints paste-ready blocks instead (a ChatGPT Project's
+                                       instructions), always-packs first; the connector returns the same lists live.
+
+DECISIONS FROM A REPOSITORY
+  npx @decidio/sdk decisions import --adr <folder> [--dry-run]
+                                       each ACCEPTED architecture decision record (MADR or Nygard markdown) becomes a DRAFT
+                                       decision you review and seal in Decidio - never sealed here; proposed, rejected,
+                                       superseded and deprecated ones are listed, not imported; a re-run finds earlier
+                                       imports (keyed by repository and path); --dry-run sends nothing
+
+GITHUB DEPLOY APPROVALS (the Decidio GitHub App)
+  npx @decidio/sdk github init [--environment production] [--workflow .github/workflows/deploy.yml] [--api <origin>] [--agents-md]
+                                       in a repository's checkout: writes the workflow that asks for approval
+                                       (.github/workflows/decidio-request.yml) and the deploy workflow when there is none
+                                       (an existing one is never changed: init prints the steps to add), both using
+                                       Decidio's GitHub Action pinned to its v1.0.0 commit; adds a link to Decidio for agents to AGENTS.md (--agents-md creates it) -
+                                       never a decision's text
+  npx @decidio/sdk github request --environment <name> [--justification "<what changed>"]
+                                       inside a GitHub Actions job (permissions id-token: write): ask a teammate to approve
+                                       deploying this commit; the job ends at once - Decidio starts the deploy when approved
+  npx @decidio/sdk github verify [--decision <id>]   the deploy job's first step: proves the approval once for this run,
+                                       commit and environment, and writes sha= to $GITHUB_OUTPUT; anything else exits 1 -
+                                       do not deploy (DECIDIO_DECISION carries the decidio input)
+
 DEVELOPMENT
   npx @decidio/sdk dev [--target URL] [--port N]   local relay for the resume webhook
   npx @decidio/sdk --version           print the CLI version
@@ -2432,12 +4030,13 @@ NOTES
   Help: --help (or -h) after any command prints this page - one page for every command.
   Exit codes: 0 success · 1 failure or honest no-op (e.g. replay refused) · 2 usage error ·
   3 quickstart stopped at the human moment (headless: routed, but nothing executed and no
-  receipt written — pass --auto-approve-demo for a run that completes unattended).
+  receipt written — pass --auto-approve-demo for a run that completes unattended), or
+  hook wait: the approver said no. hook pretool/posttool always exit 0 (their answer is the JSON).
   Errors, and usage shown on ERROR paths, go to stderr; stdout carries results only (safe to
   pipe). Asked-for help — including this bare invocation — IS a result, so it prints here.
   Docs: the README that shipped with this package — node_modules/@decidio/sdk/README.md
   (quickstart, durable resume, workers, adapters).`;
-const GATED_CMDS = new Set(["quickstart", "init", "login", "doctor", "approvals", "receipt", "tokens"]);
+const GATED_CMDS = new Set(["quickstart", "init", "login", "doctor", "approvals", "receipt", "tokens", "context"]);
 function semverNewer(a, b) {
     const parse = (s) => (/^\d+\.\d+\.\d+$/.test(s) ? s.split(".").map((x) => parseInt(x, 10)) : null);
     const pa = parse(a), pb = parse(b);
@@ -2577,6 +4176,9 @@ async function main(argv) {
         verify: { flags: ["--allow-unpinned"], valued: ["--issuer"] },
         tokens: { flags: ["--mine"] },
         dev: { flags: [], valued: ["--target", "--port"] },
+        hook: { flags: ["--project"], valued: ["--timeout", "--approver", "--cli"] },
+        github: { flags: ["--agents-md"], valued: ["--environment", "--justification", "--decision", "--workflow", "--api"] },
+        decisions: { flags: ["--dry-run"], valued: ["--adr"] },
     };
     const spec = KNOWN[cmd];
     if (spec) {
@@ -2610,8 +4212,8 @@ async function main(argv) {
                 return 2;
             }
         }
-        const MAX_POS = { login: 1, logout: 0, quickstart: 1, init: 1, doctor: 0, receipt: 1, tokens: 2, dev: 0 };
-        const exemptTail = (cmd === "approvals" && (positionals[0] === "approve" || positionals[0] === "reject")) || cmd === "verify";
+        const MAX_POS = { login: 1, logout: 0, quickstart: 1, init: 1, doctor: 0, receipt: 1, tokens: 2, dev: 0, hook: 2, github: 1, decisions: 1 };
+        const exemptTail = (cmd === "approvals" && (positionals[0] === "approve" || positionals[0] === "reject")) || (cmd === "hook" && positionals[0] === "justify") || cmd === "verify";
         if (!exemptTail && cmd === "approvals" && positionals.length > 0) {
             err(`✘ unknown approvals subcommand "${positionals[0]}" — use approve or reject (or no subcommand to list).`);
             return 2;
@@ -2752,6 +4354,83 @@ async function main(argv) {
             }
             return cmdDev(target, Number(portRaw));
         }
+        case "context": {
+            const VALUED = ["--title", "--trigger", "--team", "--unit", "--pack"];
+            const pos = argsIn.filter((x, i) => !x.startsWith("-") && !VALUED.includes(argsIn[i - 1] ?? ""));
+            const sub = pos[0];
+            const allowed = { list: ["--json"], create: ["--title", "--trigger", "--team", "--unit", "--org", "--json"], add: ["--json"], remove: ["--json"], trigger: ["--json"], always: ["--json"], delete: [], bind: ["--unit"], pull: ["--pack", "--here", "--chatgpt", "--json"] };
+            const given = argsIn.filter((x) => x.startsWith("--")).map((x) => x.split("=")[0]);
+            if (sub && allowed[sub]) {
+                const stray = given.find((f) => !allowed[sub].includes(f));
+                if (stray) {
+                    err(`✘ unknown option "${stray}" for \`context ${sub}\` — refusing to guess (a flag you meant to matter must never be silently ignored).`);
+                    return 2;
+                }
+            }
+            return cmdContext(sub, pos.slice(1), { title: valuedOpt(argsIn, "--title"), trigger: valuedOpt(argsIn, "--trigger"), team: valuedOpt(argsIn, "--team"), unit: valuedOpt(argsIn, "--unit"), org: argsIn.includes("--org"), here: argsIn.includes("--here"), pack: valuedOpt(argsIn, "--pack"), chatgpt: argsIn.includes("--chatgpt"), json: argsIn.includes("--json") });
+        }
+        case "hook": {
+            const VALUED = ["--timeout", "--approver", "--cli"];
+            const pos = argsIn.filter((x, i) => !x.startsWith("-") && !VALUED.includes(argsIn[i - 1] ?? ""));
+            const sub = pos[0];
+            const allowed = { pretool: [], posttool: [], wait: ["--timeout"], install: ["--project", "--approver", "--cli"], rules: [], justify: [] };
+            const given = argsIn.filter((x) => x.startsWith("--")).map((x) => x.split("=")[0]);
+            if (sub && allowed[sub]) {
+                const stray = given.find((f) => !allowed[sub].includes(f));
+                if (stray) {
+                    err(`✘ unknown option "${stray}" for \`hook ${sub}\` — refusing to guess (a flag you meant to matter must never be silently ignored).`);
+                    return 2;
+                }
+            }
+            switch (sub) {
+                case "pretool": return cmdHookPretool();
+                case "posttool": return cmdHookPosttool();
+                case "wait": {
+                    const t = valuedOpt(argsIn, "--timeout") ?? "600";
+                    if (!/^\d+$/.test(t) || Number(t) < 1 || Number(t) > 86_400) {
+                        err(`✘ --timeout needs a whole number of seconds from 1 to 86400 (got "${t}").`);
+                        return 2;
+                    }
+                    return cmdHookWait(pos[1], Number(t));
+                }
+                case "install": return cmdHookInstall({ project: argsIn.includes("--project"), approver: valuedOpt(argsIn, "--approver"), cli: valuedOpt(argsIn, "--cli") });
+                case "rules": return cmdHookRules();
+                case "justify": return cmdHookJustify(pos[1], pos.slice(2).join(" "));
+                default:
+                    err(`✘ hook needs a subcommand: install | wait <decision-id> | justify <decision-id> "<what changed>" | rules (pretool and posttool are run by Claude Code).\n\n${USAGE}`);
+                    return 2;
+            }
+        }
+        case "decisions": {
+            const sub = argsIn.find((x, i) => !x.startsWith("-") && argsIn[i - 1] !== "--adr");
+            if (sub !== "import") {
+                err(`✘ decisions needs a subcommand: import --adr <folder> [--dry-run].\n\n${USAGE}`);
+                return 2;
+            }
+            return cmdDecisionsImport(valuedOpt(argsIn, "--adr"), argsIn.includes("--dry-run"));
+        }
+        case "github": {
+            const VALUED = ["--environment", "--justification", "--decision", "--workflow", "--api"];
+            const pos = argsIn.filter((x, i) => !x.startsWith("-") && !VALUED.includes(argsIn[i - 1] ?? ""));
+            const sub = pos[0];
+            const allowed = { request: ["--environment", "--justification"], verify: ["--decision"], init: ["--environment", "--workflow", "--api", "--agents-md"] };
+            const given = argsIn.filter((x) => x.startsWith("--")).map((x) => x.split("=")[0]);
+            if (sub && allowed[sub]) {
+                const stray = given.find((f) => !allowed[sub].includes(f));
+                if (stray) {
+                    err(`✘ unknown option "${stray}" for \`github ${sub}\` — refusing to guess (a flag you meant to matter must never be silently ignored).`);
+                    return 2;
+                }
+            }
+            switch (sub) {
+                case "request": return cmdGithubRequest(valuedOpt(argsIn, "--environment"), valuedOpt(argsIn, "--justification"));
+                case "verify": return cmdGithubVerify(valuedOpt(argsIn, "--decision"));
+                case "init": return cmdGithubInit({ environment: valuedOpt(argsIn, "--environment"), workflow: valuedOpt(argsIn, "--workflow"), api: valuedOpt(argsIn, "--api"), agentsMd: argsIn.includes("--agents-md") });
+                default:
+                    err(`✘ github needs a subcommand: init | request --environment <name> | verify.\n\n${USAGE}`);
+                    return 2;
+            }
+        }
         default:
             if (cmd.startsWith("-"))
                 err(`✘ unknown command "${cmd}" — flags go AFTER the command (e.g. npx @decidio/sdk approvals ${cmd}).\n\n${USAGE}`);
@@ -2783,4 +4462,11 @@ if (invokedAsProgram)
             await new Promise((r) => process.stderr.write("", () => r()));
             process.exit(code);
         }
-    }).catch((e) => { console.error(`✘ unexpected error: ${e?.message ?? e}`); process.exit(1); });
+    }).catch((e) => {
+        if (ARGV_TAIL[0] === "hook" && ARGV_TAIL[1] === "pretool") {
+            process.stdout.write(JSON.stringify({ hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "deny", permissionDecisionReason: `Decidio hook: unexpected failure (${e?.message ?? e}) - refusing this tool call (fail closed). Nothing ran.` } }) + "\n");
+            process.exit(0);
+        }
+        console.error(`✘ unexpected error: ${e?.message ?? e}`);
+        process.exit(1);
+    });