@decidio/sdk 0.8.1 → 0.10.0

package/CHANGELOG.md

@@ -5,6 +5,82 @@ the gate, signing, receipts and the verifier - is conformance-locked between the
 first-run surfaces (the fork, `--demo`, the code sign-in) are TypeScript-first and named as such in the parity
 allowlist. Each entry names what changed, what a reader must do on upgrade, and what proved it.
 
+## Unreleased
+
+## 0.10.0 — connect a coding assistant in one tap
+
+- **`npx @decidio/sdk connect`** (cycle connect). A coding assistant sets Decidio up for you: it runs `connect`, which prints a
+  link and a short code (on a real terminal also a QR, and it opens the browser); the workspace owner opens the link signed in,
+  checks the code, picks who approves and taps Allow; `connect --wait` then returns by itself (exit 0 connected, 1 still
+  waiting - run it again, 3 refused or expired; within 90 s, under an assistant's 2-minute command limit). The machine gets an
+  ask-only credential - never a session - kept OUTSIDE the repository (the config dir, owner-only, keyed by the repository root
+  and the Decidio), and the hooks switch on in `.claude/settings.local.json` (`--team`: the shared `.claude/settings.json`).
+  No `.env`, nothing to paste, the word "agent" nowhere in the setup.
+- **In a cloud session the hooks go in `.claude/settings.json`.** A cloud session reads only the repository's own settings file,
+  never `.claude/settings.local.json` (Claude Code's docs), so that is where they work. connect leaves it uncommitted and says to ask
+  the person before committing it (committed, every cloud session of the repository and every teammate's clone ask too). The
+  credential is that cloud machine's: a fresh one refuses destructive commands until it connects again.
+- **The machine proves its key.** The start is signed with the machine's own key (the request-bound proof every signed
+  request carries, over the assistant, project, machine and cloud-or-local), so nobody can file a connect in another
+  machine's name; the server refuses a start without it. The connect checks the wire first (https, or a local address),
+  since the poll's answer carries the credential.
+- **Credentials, in order:** the shell, then the folder's `.env`, then this repository's connection - all or nothing, so a
+  project with an `init` `.env` keeps exactly that identity. `disconnect` deletes this machine's token (gated commands are then
+  refused until you connect again; the machine's key stays, so reconnecting reuses its agent).
+- **The hook's words** for an unconnected project now name `connect` and `connect --wait` (the plugin's skill says the same);
+  `hook install` with no credentials points at `connect` first.
+- **The links the command line prints follow the API's own web app** (launch plan L1c). Staging's API maps to
+  `staging.decidioai.com`, production's (`mcp.decidioai.com`) to `app.decidioai.com`, and any other origin to itself.
+  `DECIDIO_APP_URL` wins only as a plain `http(s)` address, and the host line names it.
+  - **Release condition:** publish only after `staging.decidioai.com` serves staging's web app (docs/Deployment_Runbook.md
+    A1). Tell testers to run `github init` again to refresh their AGENTS.md section.
+
+On upgrade: nothing to change - `init` projects keep their `.env`. The plugin pins 0.10.0. `connect` needs a Decidio that
+serves `/connect/*` (the lab, from cycle connect's deploy). Proved by: cli-smoke.ts (356 → 378 checks: connect, its signed
+start, wait, reconnect, disconnect, refused, expired, a cloud session, --team, beside the plugin, .env precedence, the hook
+through a connection).
+
+## 0.9.0 — the coding-agent hook catches what agents type, protects itself, and tells the approver what was asked
+
+- **Wider matching, from real agent runs.** `sql-destructive` counts a statement sent through an interpreter or runner
+  (`python3 db.py "drop table x"`, `python3 -c`, `node -e`, a here-doc), checked per segment so a commit message that
+  says "drop table" is not gated; options are read by name before `=` (`--force-with-lease=<ref>`); git's `-C`/`-c` are
+  skipped; a command handed to a shell (`bash -c`, `sh -c`, `pwsh -Command`) is matched inside, two shells deep; a file
+  the command runs is followed one level inside the project (shell scripts, SQL files, `package.json` scripts, DROP or
+  TRUNCATE in a program file run directly) - the request carries the matched line as `scriptLine` and the file's sha256
+  in its keyed scope, never the file.
+- **`decidio-guard`.** Write, Edit and MultiEdit to `.claude/settings*.json`, `~/.claude/settings*.json` or the Decidio
+  plugin's files are gated when the file after the change drops or alters a Decidio hook, sets `disableAllHooks`, turns
+  the plugin off, or is not valid JSON (adding a permission or another hook is not); shell writes to those files,
+  `claude plugin disable|uninstall` naming Decidio and `hook install --cli` are gated whatever they write. The request
+  binds tool + path + the after-file's sha256. `hook install` writes PreToolUse and PostToolUse handlers for the three
+  tools, one `if` per path (Claude Code's `if` holds one rule and is tool-specific), and keys its merge on event +
+  matcher + `if`: a re-run keeps each handler once and upgrades an 0.8 install in place.
+- **A policy `proceed` prints nothing** (exit 0; the state is kept, so posttool still records the execution). Claude Code
+  records a hook `allow` as the hook's decision in place of its own permission check; a company rule that something
+  needs no person now leaves that check in place. A person's approval of the exact call still prints `allow`.
+- **Card context.** The request context gains `mode`, `repo`, `branch`, `commit` and the user's prompt (`asked`, and
+  `askedBefore` when the last prompt is under 40 characters; each through the redaction, at most 1,000 characters;
+  `askedLength`), read from the transcript's tail only for a gated call. `DECIDIO_HOOK_SHARE_PROMPT=0` leaves the prompt
+  out. The request commitment no longer covers these (they change between the ask and the retry), so a retry after the
+  user typed "continue" matches its approval instead of a 409.
+- **An agent running `approvals approve|reject`** (with the person's stored sign-in, which the agent's shell inherits) is
+  denied by the hook itself in its usual spellings (`npx`, `decidio`, the installed or cached `cli.js`, `python -m decidio`,
+  `uvx`, inside `bash -c`, an option before the subcommand); listing, `hook wait` and `receipt` are untouched. A shell
+  check is not a complete close (the Backlog names the server-side one).
+- The prompt reader skips transcript entries that are not the user's words (a background task's notification, bash-mode
+  input and output, a local command's output, a compaction summary); a slash command the user typed counts. The settings
+  guard finds an Edit's string the way Claude Code's Edit does - verbatim, else with curly and straight quotes alike - and
+  an empty `old_string` on an empty or whitespace-only file as the whole new file.
+- File-tool denials say "edit" and "Nothing was written."; shell denials are unchanged.
+
+On upgrade: re-run `npx @decidio/sdk@0.9.0 hook install` (or update the plugin once it pins 0.9.0). A gate older than
+this release stores the new context keys as ordinary details. Proved by: `cli-smoke.ts` (336 → 355 checks; the gated table 42 → 89
+commands, verbatim from the lab's runs; the noise table 24 → 46; the guard's effect, binding, posttool spend and install;
+a mock gate that 409s a reused key with another commitment, where a retry after the prompt changed is ALLOWED; mutation
+runs of each change), and 15 real Claude Code sessions against a loopback gate (every gated case stopped; a policy
+approval left Claude's classifier deciding).
+
 ## 0.7.0 — approvals bind to the exact request they approved; receipts pin to a real trust anchor
 
 - **The receipt trust anchor is built in — nobody pastes an issuer DID, and nothing pins to a receipt's own

package/README.md

@@ -75,8 +75,8 @@ npx @decidio/sdk init --unique my-agent   # --unique appends a random suffix: co
 Every network command talks to the hosted sandbox by default (`verify` is offline) and announces its target host on
 stderr each run — set `DECIDIO_API_URL` (env or `.env`) to point at another Decidio instead.
 
-`init` signs you into your workspace (email + password, or the 8-character code the CLI emails you —
-type it where you asked), generates the agent's Ed25519 keypair **locally** (only the public `did:key`
+`init` signs you into your workspace (the 8-character code the CLI emails you — type it where you asked —
+or, for an account made before sign-up became passwordless, its email + password), generates the agent's Ed25519 keypair **locally** (only the public `did:key`
 is sent), registers the agent, mints its **floor-limited API token** (limited to the agent runtime — request authorization, poll status, report signed confirmation; it cannot administer the workspace or approve anything — and your workspace session never touches the agent's disk), and writes `.env`.
 Every later command that talks to Decidio reads `.env` from this directory automatically (`verify` is
 offline and never does). Re-running init for an
@@ -727,7 +727,7 @@ that fits every other confirm error.
     `quickstart cleanup` works later too.
 - `init [agentId] [--unique] [--force] [--expires-days N]` — sign in, register, mint the agent token, write `.env` (+ `.gitignore` entries). Refuses to overwrite a *different* agent's key in this directory; `--force` backs the old `.env` up first.
 - `doctor` — config, connectivity, and what your current token can do
-- `approvals [--mine] [--json]` / `approvals approve|reject <id> [reason]` — the human side, from your terminal (the list is workspace-wide; `--mine` narrows it to this directory's agent)
+- `approvals [--mine] [--json]` / `approvals approve|reject <id> [reason]` — the human side, from your terminal (the list is workspace-wide; `--mine` narrows it to this directory's agent). Run by a coding agent behind the hook, `approve|reject` is refused: a person decides, not the agent
 - `receipt <id> [--json]` — download a sealed decision's Authority Receipt to a `.json` file (`--json`: stdout is the JSON result only; the identities your access covers print only on a terminal, or in the JSON)
 - `verify [--issuer <did>] <file>...` — verify receipts offline (the canonical verifier; the standalone `@decidio/verify` package is the same implementation, for auditors who want zero Decidio dependency — the sdk depends on the verifier released alongside it, at the same version). Unknown flags are refused, never ignored. It pins to the trust anchor it prints first: `--issuer`, else the DID remembered for your Decidio at sign-in, else the built-in hosted-service issuer — never the receipt's own `issuer` field. Fully offline AND fully decoupled: it touches no network and reads no `.env` (only the issuer DIDs remembered in your profile) — a receipt verifies identically from any directory.
 - `tokens list [--mine]` / `tokens revoke <jti>` — see and kill agent tokens (values are never re-shown; the jti is the revocation handle). Each row carries its status — `active`, `expired`, or `REVOKED <date>` — so the list confirms the revocations it performs; re-revoking is an honest no-op (exit 1). The list is workspace-wide (a shared workspace shows every member's agents); `--mine` narrows to this directory's agent
@@ -738,6 +738,7 @@ that fits every other confirm error.
 - `quickstart --phone web` — the QR at the human step opens the phone web rendering even when the Decidio app is installed (by default it opens the app when there is one).
 - `login [email]` / `logout` — sign in ONCE (the CLI emails you an 8-character code; you type it) and forget that sign-in on this computer (the session token itself stays valid until it expires (up to 30 days) — there is no server-side revocation yet). The session is stored in your user profile, owner-only, bound to the terminal window that created it, for 30 days; `DECIDIO_SESSION_TOKEN` in the environment outranks it (headless shells).
 - `dev [--target URL] [--port N]` — local relay for the resume webhook (operator setups)
+- `hook install [--project] [--approver <email>]` / `hook rules` / `hook wait <id>` / `hook justify <id> "<why>"` — the Claude Code hook (0.8.0; widened in 0.9.0). `install` writes PreToolUse/PostToolUse hooks into `.claude/settings.local.json` (`--project`: `settings.json`): the shell calls, plus Write/Edit/MultiEdit on Claude Code's own settings and the Decidio plugin (the `decidio-guard` category: a change that takes Decidio's check away needs a person). The pretool hook fails closed (`onFailure: block`, a hold capped under its 150 s timeout). `hook rules` lists what is gated, including the files a command runs that are followed one level. For a gated call the hook sends Decidio the command (secrets redacted), its directory, category, subject and any matched script line; the permission mode; the repository, branch and commit; and the user's last prompt in the session (with the one before it when the last is under 40 characters; at most 1,000 characters each, secrets redacted) - shown to people allowed to read the request, never on Slack or Teams. `DECIDIO_HOOK_SHARE_PROMPT=0` leaves the prompt out. A policy's auto-approval prints nothing, so Claude Code's own permission check still decides; a person's approval of the exact call allows it once.
 
 The CLI's stream contract: **stdout carries results only** (safe to pipe — `--json` output is
 pure JSON); errors, usage shown on *error* paths, and the per-run target-host announcement go

package/dist/cli.d.ts

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+export declare function appUrlFor(api: string, override?: string | undefined): string;
 export type ApprovalAnswer = "approve" | "reject" | "again";
 export declare function approvalAnswer(answer: unknown): ApprovalAnswer;
 /** The issuer store's key for a Decidio address: its origin (scheme + lowercased host + non-default port), computed by a
@@ -50,11 +51,42 @@ export type ParsedAdr = {
 export declare function parseAdr(text: string): ParsedAdr | null;
 export declare const AGENTS_MD_START = "<!-- decidio:start -->";
 export declare const AGENTS_MD_END = "<!-- decidio:end -->";
+export type DeployRowView = {
+    decisionId: string;
+    dNumber: string | null;
+    repository: string;
+    environment: string;
+    sha: string;
+    ref: string;
+    state: string;
+    line: string;
+    checks: string | null;
+    requestedAt: string;
+    deployedAt: string | null;
+    runUrl: string | null;
+    recordUrl: string;
+    range: {
+        fromSha: string | null;
+        toSha: string;
+        compareUrl: string | null;
+    } | null;
+};
+/** PURE: one deploy as one line (plus its range line once deployed). */
+export declare function deployLines(r: DeployRowView): string[];
+/** PURE: what changed between two reads of the list (--watch) - a new deploy, or a deploy whose words moved. */
+export declare function deployChanges(before: DeployRowView[], after: DeployRowView[]): string[];
+/** PURE: a moment from the command line - an ISO date, "now", or a duration from now ("30m", "2h", "1d"). null: not one. */
+export declare function parseWhen(s: string | undefined, now?: Date): Date | null;
+/** PURE: the controls list, one line each. */
+export declare function controlsLines(b: {
+    halts?: any[];
+    grants?: any[];
+}): string[];
 /** Decidio's public GitHub Action (github.com/OmniTwin/decidio-actions): one action, step request or verify. It fetches the job's own
  *  OIDC token (audience "decidio") - no repository secret - and fails the job in plain words when Decidio refuses. Pinned to the
- *  v1.0.1 COMMIT, never a tag (invariant-guard 2026-10-20): the verify step enforces the approval in a production job with
+ *  v1.3.1 COMMIT, never a tag (invariant-guard 2026-10-20): the verify step enforces the approval in a production job with
  *  id-token: write, so a moved tag must not change it. Bump both pins together, with the release. */
-export declare const DECIDIO_ACTION = "OmniTwin/decidio-actions@c4506075600edef9576db821c4de756c300c15fe # v1.0.1";
+export declare const DECIDIO_ACTION = "OmniTwin/decidio-actions@f0b43fcb8f8ac5e15d9ad43679e333ffa7038ae2 # v1.3.1";
 export declare const CHECKOUT_ACTION = "actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0";
 export declare function githubRequestWorkflow(api: string, environment: string, branch?: string, deployWorkflow?: string): string;
 /** The verify step and the checkout of the approved commit: the first steps of any deploy job Decidio starts. */