@decidio/sdk 0.8.0 → 0.8.1

package/dist/cli.d.ts

@@ -52,11 +52,11 @@ export declare const AGENTS_MD_START = "<!-- decidio:start -->";
 export declare const AGENTS_MD_END = "<!-- decidio:end -->";
 /** Decidio's public GitHub Action (github.com/OmniTwin/decidio-actions): one action, step request or verify. It fetches the job's own
  *  OIDC token (audience "decidio") - no repository secret - and fails the job in plain words when Decidio refuses. Pinned to the
- *  v1.0.0 COMMIT, never a tag (invariant-guard 2026-10-20): the verify step enforces the approval in a production job with
+ *  v1.0.1 COMMIT, never a tag (invariant-guard 2026-10-20): the verify step enforces the approval in a production job with
  *  id-token: write, so a moved tag must not change it. Bump both pins together, with the release. */
-export declare const DECIDIO_ACTION = "OmniTwin/decidio-actions@e40ba8e75a223f2475038d38a16df5a5885afde4 # v1.0.0";
+export declare const DECIDIO_ACTION = "OmniTwin/decidio-actions@c4506075600edef9576db821c4de756c300c15fe # v1.0.1";
 export declare const CHECKOUT_ACTION = "actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0";
-export declare function githubRequestWorkflow(api: string, environment: string, branch?: string): string;
+export declare function githubRequestWorkflow(api: string, environment: string, branch?: string, deployWorkflow?: string): string;
 /** The verify step and the checkout of the approved commit: the first steps of any deploy job Decidio starts. */
 export declare function githubVerifySteps(api: string): string;
 export declare function githubDeployWorkflow(api: string, environment: string): string;

package/dist/cli.js

@@ -3667,6 +3667,10 @@ async function cmdGithubRequest(environment, justification) {
             log("  An approval request for this commit was already open - that one stands.");
         return 0;
     }
+    if (r.status === 200 && b.decision === "connected") {
+        log(`✔ connected: Decidio heard this repository ask for ${environment}. This check asked for nothing; the next push asks a teammate.`);
+        return 0;
+    }
     if (r.status === 200 && b.decision === "duplicate") {
         err(`✘ ${String(b.error ?? "a person refused this commit before")}`);
         err(`  To ask again, say what changed: npx @decidio/sdk github request --environment ${environment} --justification "<what changed>"`);
@@ -3714,15 +3718,20 @@ function plainRepoPath(root, rel) {
     }
     return true;
 }
-export const DECIDIO_ACTION = "OmniTwin/decidio-actions@e40ba8e75a223f2475038d38a16df5a5885afde4 # v1.0.0";
+export const DECIDIO_ACTION = "OmniTwin/decidio-actions@c4506075600edef9576db821c4de756c300c15fe # v1.0.1";
 export const CHECKOUT_ACTION = "actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0";
-export function githubRequestWorkflow(api, environment, branch = "main") {
+export function githubRequestWorkflow(api, environment, branch = "main", deployWorkflow = ".github/workflows/deploy.yml") {
     return `# Written by npx @decidio/sdk github init. Asks a teammate to approve each deploy; Decidio starts the deploy workflow once
-# approved. No repository secret: the job's own OIDC token is the credential.
+# approved. No repository secret: the job's own OIDC token is the credential. A push that changes only the two Decidio workflow
+# files asks for nothing; a run started by hand (or by Decidio's Check the connection) is a connection check that asks for nothing.
 name: Ask Decidio to deploy
 on:
   push:
     branches: [${branch}]
+    paths-ignore:
+      - .github/workflows/decidio-request.yml
+      - ${deployWorkflow}
+  workflow_dispatch:
 permissions:
   id-token: write
   contents: read
@@ -3843,7 +3852,7 @@ async function cmdGithubInit(opts) {
     };
     const said = (rel, w, what) => w === "written" ? log(`✔ wrote ${rel} - ${what}`) : w === "kept" ? log(`· ${rel} already exists - kept as it is`) : err(`✘ ${rel}: a symbolic link is on its path - nothing was written through it`);
     const reqRel = ".github/workflows/decidio-request.yml";
-    said(reqRel, write(reqRel, githubRequestWorkflow(apiUrl, environment, branch)), `asks for approval on every push to ${branch} (edit the trigger to suit)`);
+    said(reqRel, write(reqRel, githubRequestWorkflow(apiUrl, environment, branch, workflow)), `asks for approval on every push to ${branch} (edit the trigger to suit)`);
     const dep = write(workflow, githubDeployWorkflow(apiUrl, environment));
     said(workflow, dep, "the deploy Decidio starts once approved (replace ./deploy.sh with your deploy)");
     if (dep === "kept") {
@@ -3874,7 +3883,9 @@ async function cmdGithubInit(opts) {
     log(`  1. In Decidio: Connect → GitHub approvals → bind this repository with ${workflow} and the environment ${environment}.`);
     log(`  2. In the repository's settings: restrict who may run ${workflow} to the Decidio app (workflow execution protections),`);
     log(`     so a deploy runs only when Decidio starts it.`);
-    log(`  3. Commit the workflows and push: the first push to ${branch} asks a teammate.`);
+    log(`  3. Commit the workflows and push - that push asks for nothing (it changes only these files).`);
+    log(`  4. Check the connection: Check the connection in Decidio, or gh workflow run decidio-request.yml - it asks for nothing.`);
+    log(`     Your next push to ${branch} asks a teammate.`);
     return 0;
 }
 const USAGE = `✦ Decidio — the SDK command line
@@ -4004,7 +4015,7 @@ GITHUB DEPLOY APPROVALS (the Decidio GitHub App)
                                        in a repository's checkout: writes the workflow that asks for approval
                                        (.github/workflows/decidio-request.yml) and the deploy workflow when there is none
                                        (an existing one is never changed: init prints the steps to add), both using
-                                       Decidio's GitHub Action pinned to its v1.0.0 commit; adds a link to Decidio for agents to AGENTS.md (--agents-md creates it) -
+                                       Decidio's GitHub Action pinned to its v1.0.1 commit; adds a link to Decidio for agents to AGENTS.md (--agents-md creates it) -
                                        never a decision's text
   npx @decidio/sdk github request --environment <name> [--justification "<what changed>"]
                                        inside a GitHub Actions job (permissions id-token: write): ask a teammate to approve

package/openapi.yaml

@@ -5,7 +5,7 @@
 openapi: 3.1.0
 info:
   title: Decidio Agent Gate
-  version: 0.8.0   # tracks the SDK release - checked by packages/conformance/manifests.mjs
+  version: 0.8.1   # tracks the SDK release - checked by packages/conformance/manifests.mjs
   description: >
     Authorize an AI-agent action (proceed | route | block), confirm the captured outcome, and
     receive the signed resume webhook when a routed action is decided. Every outcome seals a

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decidio/sdk",
-  "version": "0.8.0",
+  "version": "0.8.1",
   "description": "One-line approval gate for AI-agent actions. Wrap a risky tool call with guard.protect(); Decidio's policy engine decides proceed | route | block, a human approves routed actions, and every outcome is sealed as a verifiable Authority Receipt.",
   "license": "Apache-2.0",
   "type": "module",
@@ -84,7 +84,7 @@
     "prepublishOnly": "npm run typecheck && npm run build && node ../publish-boundary/check.mjs --only @decidio/sdk"
   },
   "dependencies": {
-    "@decidio/verify": "0.8.0"
+    "@decidio/verify": "0.8.1"
   },
   "author": "OmniTwin Technologies Inc.",
   "bugs": {