@decidio/sdk 0.8.1 → 0.10.0

package/dist/cli.js

@@ -1,16 +1,16 @@
 #!/usr/bin/env node
-import { readFileSync, writeFileSync, existsSync, appendFileSync, chmodSync, rmSync, rmdirSync, openSync, writeSync, fsyncSync, closeSync, renameSync, mkdirSync, mkdtempSync, readdirSync, copyFileSync, statSync, lstatSync } from "node:fs";
+import { readFileSync, writeFileSync, existsSync, appendFileSync, chmodSync, rmSync, rmdirSync, openSync, writeSync, fsyncSync, closeSync, renameSync, mkdirSync, mkdtempSync, readdirSync, copyFileSync, statSync, lstatSync, fstatSync, readSync } from "node:fs";
 import { randomBytes, createHash } from "node:crypto";
-import { homedir, tmpdir } from "node:os";
-import { join as joinPath, resolve as resolvePath, sep as pathSep, basename, relative, isAbsolute } from "node:path";
+import { homedir, tmpdir, hostname } from "node:os";
+import { join as joinPath, resolve as resolvePath, sep as pathSep, basename, dirname, relative, isAbsolute } from "node:path";
 import { createServer } from "node:http";
 import { isIP } from "node:net";
-import { execFileSync, spawnSync } from "node:child_process";
+import { execFileSync, spawnSync, spawn } from "node:child_process";
 import { createInterface } from "node:readline";
 import { pathToFileURL as toFileUrl, fileURLToPath as fromFileUrl } from "node:url";
 import { realpathSync as realPath } from "node:fs";
 import { createRequire } from "node:module";
-import { generateKeypair, assertSafeTransport, redactUrl } from "./signing.js";
+import { generateKeypair, assertSafeTransport, redactUrl, signBoundProof } from "./signing.js";
 import { hardenFile } from "./resume.js";
 import { withApproval, DecidioRateLimitError, DecidioRejectedError, DecidioTimeoutError, DecidioHttpError, didFromPrivateKey, checkApproval, signConfirm, buildConfirmBody, readConfirmResponse, bindingMaterial, boundScope, idempotencyKey, decisionUrl, decisionIdProblem } from "./index.js";
 import { gateAuthorizeTwinAware, adapterRequest } from "./adapters/_gate.js";
@@ -76,6 +76,14 @@ if (!OFFLINE_CMD)
     }
 const DEFAULT_API = "https://decidio-api.onrender.com";
 let API = (process.env.DECIDIO_API_URL ?? DEFAULT_API).replace(/\/$/, "");
+let CREDS_FROM = SHELL_ENV.DECIDIO_API_TOKEN ? "shell" : process.env.DECIDIO_API_TOKEN ? ".env" : null;
+if (!OFFLINE_CMD && !["init", "quickstart", "login", "logout", "phone"].includes(ARGV_TAIL[0] ?? "") && !process.env.DECIDIO_API_TOKEN && !process.env.DECIDIO_AGENT_ID) {
+    const c = loadConnection(projectRoot(), API);
+    if (c) {
+        promoteConnection(c);
+        CREDS_FROM = "connection";
+    }
+}
 let DEMO = false;
 function enterDemo(url) { API = url; process.env.DECIDIO_API_URL = url; DEMO = true; }
 const pinWords = () => (DEMO ? "PINNED to this demo's own key" : "PINNED to your workspace issuer");
@@ -90,7 +98,7 @@ let hostAnnounced = false;
 async function api(path, init = {}, bearer, soft = false) {
     if (!hostAnnounced) {
         hostAnnounced = true;
-        err(`· decidio → ${API}${process.env.DECIDIO_API_URL ? "" : "  (default: the hosted sandbox — set DECIDIO_API_URL to point elsewhere)"}`);
+        err(`· decidio → ${API}${process.env.DECIDIO_API_URL ? "" : "  (default: the hosted sandbox — set DECIDIO_API_URL to point elsewhere)"}${APP_URL_OVERRIDDEN ? `  · links → ${APP_URL} (DECIDIO_APP_URL)` : ""}`);
     }
     const auth = bearer ?? TOKEN();
     if (auth && envUnreadable && !process.env.DECIDIO_API_URL) {
@@ -462,7 +470,24 @@ function block(n, title, rows, tone) {
     }
     log(f("└" + "─".repeat(width - 2) + "┘"));
 }
-const APP_URL = API.replace("decidio-api.onrender.com", "app.decidioai.com");
+const APP_URL_SHAPE = /^https?:\/\/[\x21-\x7e]+$/;
+const asciiTrim = (v) => v.replace(/^[ \t\r\n]+|[ \t\r\n]+$/g, "");
+export function appUrlFor(api, override = process.env.DECIDIO_APP_URL) {
+    const o = asciiTrim(override ?? "");
+    if (APP_URL_SHAPE.test(o))
+        return o.replace(/\/+$/, "");
+    const base = api.replace(/\/+$/, "");
+    const known = {
+        "https://decidio-api.onrender.com": "https://staging.decidioai.com",
+        "https://mcp-staging.decidioai.com": "https://staging.decidioai.com",
+        "https://mcp.decidioai.com": "https://app.decidioai.com",
+    };
+    return known[base] ?? base;
+}
+const APP_URL = appUrlFor(API);
+const APP_URL_OVERRIDDEN = APP_URL !== appUrlFor(API, "");
+if (asciiTrim(process.env.DECIDIO_APP_URL ?? "") && !APP_URL_SHAPE.test(asciiTrim(process.env.DECIDIO_APP_URL ?? "")))
+    console.error("⚠ ignoring DECIDIO_APP_URL: it must be a plain http(s) address (printable characters only)");
 let stdinReadAbandoned = false;
 let EXPLAIN = false;
 let currentRl = null;
@@ -835,11 +860,12 @@ async function firstRunFork(signedInAs = null) {
             return { kind: "stop", code: 1 };
     }
     log("");
-    log(`  What next?   ${dim("[1/2/3]")}`);
+    log(`  What next?   ${dim("[1/2/3/4]")}`);
     log(`    ${bold("1")}   the two-minute tour against your workspace         ${dim("npx @decidio/sdk quickstart")}`);
     log(`    ${bold("2")}   wire up your own agent now (register, token, .env)  ${dim("npx @decidio/sdk init <agentId>")}`);
     log(`    ${bold("3")}   sign out of this computer                           ${dim("npx @decidio/sdk logout")}`);
-    const b = await pick("1, 2 or 3", /^[123]$/);
+    log(`    ${bold("4")}   put Decidio on your phone (scan a QR here)          ${dim("npx @decidio/sdk phone")}`);
+    const b = await pick("1, 2, 3 or 4", /^[1234]$/);
     if (!b) {
         log(`  No answer — you are signed in; run any command above when you are ready.`);
         return { kind: "stop", code: 0 };
@@ -854,6 +880,11 @@ async function firstRunFork(signedInAs = null) {
         log("");
         return { kind: "logout" };
     }
+    if (b === "4") {
+        log(`  → running: npx @decidio/sdk phone`);
+        log("");
+        return { kind: "phone" };
+    }
     const here = readEnvFile();
     if (["DECIDIO_AGENT_KEY", "DECIDIO_API_TOKEN"].some((k) => (here[k] ?? "").trim()) && here.DECIDIO_AGENT_ID) {
         const tour = /^quickstart-/.test(here.DECIDIO_AGENT_ID);
@@ -888,8 +919,73 @@ async function cmdLogin(emailArg) {
         return 0;
     }
     const token = await loginFlow("Signing in", emailArg);
+    if (token)
+        log(dim(`  next: approve from your phone — npx @decidio/sdk phone`));
     return token ? 0 : 1;
 }
+const PHONE_MAX_QRS = 3;
+async function cmdPhone() {
+    if (!(process.stdin.isTTY && process.stdout.isTTY)) {
+        err(`✘ phone setup prints a one-time sign-in QR, so it runs only in an interactive terminal (never into a log or a pipe).`);
+        err(`  Run it in a terminal: npx @decidio/sdk phone`);
+        return 2;
+    }
+    const session = await acquireSession("Setting up your phone");
+    if (!session)
+        return 1;
+    const who = process.env.DECIDIO_SESSION_TOKEN ? null : loadSession()?.email ?? null;
+    log("");
+    log(`  Put Decidio on your phone?   ${dim("[y/n]")}`);
+    log(`    The QR signs that phone in${who ? ` as ${who}` : ""} - once, within 5 minutes. Whoever scans it first is signed in`);
+    log(`    as you, so don't show it on a shared screen or a projector.`);
+    const yes = (await ask("  › ")).trim().toLowerCase();
+    if (yes !== "y") {
+        log(`  Nothing was made. Run npx @decidio/sdk phone when you are ready.`);
+        return 0;
+    }
+    for (let n = 1; n <= PHONE_MAX_QRS; n++) {
+        const r = await api("/demo/session-link", { method: "POST", body: JSON.stringify({ setup: true }) }, session, true);
+        if (r.status === 404) {
+            log(`  ✘ QR phone setup is on the Decidio lab for now. On your company's Decidio, open ${APP_URL}/phone on the phone`);
+            log(`    and sign in with your company's sign-in (SSO).`);
+            return 1;
+        }
+        if (r.status === 401) {
+            log(`  ✘ this computer's sign-in is no longer valid - run npx @decidio/sdk logout, then npx @decidio/sdk phone again.`);
+            return 1;
+        }
+        const link = r.status >= 200 && r.status < 300 && typeof r.body?.link === "string" ? String(r.body.link) : null;
+        if (!link) {
+            log(`  ✘ no QR this time (${r.status})${r.body?.error ? ` — ${r.body.error}` : ""}. Nothing was signed in.`);
+            return 1;
+        }
+        const qr = typeof r.body?.qr === "string" ? String(r.body.qr) : null;
+        log("");
+        if (qr) {
+            log(`  Scan with the phone's camera ${dim("(one time · 5 minutes)")}:`);
+            for (const l of qr.split("\n"))
+                if (l.trim().length)
+                    log("    " + l);
+        }
+        else
+            log(`  Open this on the phone ${dim("(one time · 5 minutes - no QR came back this time)")}:`);
+        log(`    ${dim(link)}`);
+        log(`  ${bold("iPhone")}    the camera opens the Decidio app, signed in. No app yet? The page walks you through installing it,`);
+        log(`            then scan again.`);
+        log(`  ${bold("Android")}   opens in the phone's browser, signed in (phone alerts come with the app, iPhone only for now).`);
+        log("");
+        if (n === PHONE_MAX_QRS) {
+            log(`  That's ${PHONE_MAX_QRS} - run npx @decidio/sdk phone again for more.`);
+            return 0;
+        }
+        const next = (await ask(`  Enter = a fresh QR (this one stops working) · q = done: `)).trim().toLowerCase();
+        if (next !== "" || !sharedRlOpen || process.stdin.readableEnded || process.stdin.destroyed) {
+            log(`  Done.`);
+            return 0;
+        }
+    }
+    return 0;
+}
 const TRUTH_SESSION = "The session token itself stays valid until it expires (up to 30 days) — there is no server-side revocation yet";
 function cmdLogout() {
     if (endSession()) {
@@ -2370,14 +2466,198 @@ function hookSegments(command) {
                 while (tokens.length && tokens[0].startsWith("-"))
                     tokens.shift();
         }
-        const program = basename((tokens[0] ?? "").replace(/^["']|["']$/g, "")).toLowerCase();
-        return { program, args: tokens.slice(1), raw };
+        const bin = (tokens[0] ?? "").replace(/^["']|["']$/g, "");
+        return { program: basename(bin).toLowerCase(), bin, args: tokens.slice(1), raw };
     });
 }
-const hookFlag = (args, letters, longs = []) => args.some((a) => (/^-[A-Za-z]+$/.test(a) && [...letters].some((l) => a.slice(1).includes(l))) || longs.includes(a));
-const hookSub = (s, i = 0) => (s.args.filter((a) => !a.startsWith("-"))[i] ?? "").toLowerCase();
+const hookFlag = (args, letters, longs = []) => args.some((a) => (/^-[A-Za-z]+$/.test(a) && [...letters].some((l) => a.slice(1).includes(l))) || longs.includes(a.split("=")[0]));
+const HOOK_GIT_VALUED = ["-C", "-c", "--git-dir", "--work-tree", "--namespace", "--config-env"];
+function hookGitArgs(s) {
+    let i = 0;
+    while (i < s.args.length && s.args[i].startsWith("-"))
+        i += HOOK_GIT_VALUED.includes(s.args[i]) ? 2 : 1;
+    return s.args.slice(i);
+}
+function hookGitElsewhere(s, cwdAbs) {
+    for (let i = 0; i < s.args.length && s.args[i].startsWith("-"); i++) {
+        const f = s.args[i];
+        if (f === "-C") {
+            if (resolvePath(cwdAbs, (s.args[i + 1] ?? "").replace(/^["']|["']$/g, "")) !== resolvePath(cwdAbs))
+                return true;
+            i++;
+        }
+        else if (/^--(git-dir|work-tree)(=|$)/.test(f))
+            return true;
+        else if (HOOK_GIT_VALUED.includes(f))
+            i++;
+    }
+    return false;
+}
+const hookSub = (s, i = 0) => ((s.program === "git" ? hookGitArgs(s) : s.args).filter((a) => !a.startsWith("-"))[i] ?? "").toLowerCase();
 const HOOK_DB_CLIENTS = ["psql", "pgcli", "mysql", "mysqlsh", "mycli", "mariadb", "sqlite3", "sqlite", "litecli", "mongosh", "mongo", "redis-cli", "clickhouse-client", "clickhouse", "sqlcmd", "bq", "duckdb", "cqlsh", "snowsql", "usql", "dbmate", "goose", "flyway", "liquibase", "atlas", "alembic", "knex", "sequelize", "typeorm", "drizzle-kit", "supabase", "wrangler", "turso", "pscale"];
+const hookSqlStmt = (t) => /\bDROP\s+(TABLE|DATABASE|SCHEMA|INDEX|VIEW|USER|ROLE|EXTENSION)\b/i.test(t) || /\bTRUNCATE\s+(TABLE\s+)?\S/i.test(t) || /\bDELETE\s+FROM\s+\S/i.test(t);
+const hookUnq = (a) => a.replace(/^["']|["']$/g, "");
+const HOOK_INTERP = /^(python[0-9.]*|node|deno|bun|ruby|perl|php|tsx|ts-node)(\.exe)?$/;
+const hookInterp = (s) => HOOK_INTERP.test(s.program) || s.program === "npx" || (s.program === "uv" && s.args[0] === "run")
+    || s.program === "manage.py" || (s.program === "rails" && hookSub(s) === "runner");
+function hookUnwrap(s) {
+    let args;
+    if (s.program === "uv" && s.args[0] === "run")
+        args = s.args.slice(1);
+    else if (s.program === "npx")
+        args = s.args;
+    else
+        return s;
+    while (args.length && args[0].startsWith("-"))
+        args = args.slice(1);
+    if (!args.length)
+        return s;
+    const bin = hookUnq(args[0]);
+    return { program: basename(bin).toLowerCase(), bin, args: args.slice(1), raw: s.raw };
+}
+function hookInline(s0) {
+    const s = hookUnwrap(s0);
+    const django = s.program === "manage.py" || (/^python[0-9.]*(\.exe)?$/.test(s.program) && hookUnq(s.args.find((a) => !a.startsWith("-")) ?? "").endsWith("manage.py"));
+    if (django || (s.program === "rails" && hookSub(s) === "runner"))
+        return /<</.test(s.raw) || s.args.some((a) => ["-c", "--command", "-e", "-"].includes(a));
+    if (!HOOK_INTERP.test(s.program))
+        return false;
+    if (/<</.test(s.raw))
+        return true;
+    if (s.program.startsWith("deno") && s.args[0] === "eval")
+        return true;
+    for (const a of s.args) {
+        if (a === "-")
+            return true;
+        if (a === "-m" || /^-(V|h|-version|-help)$/.test(a))
+            return false;
+        if (/^-[A-Za-z]*[ce]$/.test(a) || a === "--eval" || a === "--command" || (/^(node|bun)/.test(s.program) && (a === "-p" || a === "--print")) || (s.program.startsWith("php") && a === "-r"))
+            return true;
+        if (!a.startsWith("-"))
+            return false;
+    }
+    return true;
+}
+function hookExpand(p, at) {
+    const t = hookUnq(p);
+    const m = t.match(/^(~|\$HOME|\$\{HOME\}|\$env:USERPROFILE|\$env:HOME|\$CLAUDE_PROJECT_DIR|\$\{CLAUDE_PROJECT_DIR\}|\$PWD|\$\{PWD\})(?=$|[\\/])/i);
+    const root = !m ? "" : /PROJECT/i.test(m[1]) ? at.projectDir : /PWD/i.test(m[1]) ? at.cwd : at.home;
+    const out = m ? root + t.slice(m[0].length) : t;
+    return /[$`]/.test(out) ? null : out;
+}
+function hookSegDirs(segs, at) {
+    let dir = at.cwd;
+    return segs.map((s) => {
+        const here = dir;
+        if (["cd", "pushd", "chdir", "set-location", "sl", "push-location"].includes(s.program)) {
+            const t = s.args.filter((a) => a !== "-P" && a !== "-L" && !/^-(Path|LiteralPath)$/i.test(a))[0];
+            const e = t === undefined ? at.home : t === "-" ? null : hookExpand(t, at);
+            dir = dir === null || e === null ? null : resolvePath(dir, e);
+        }
+        else if (s.program === "popd" || s.program === "pop-location")
+            dir = null;
+        return here;
+    });
+}
+const hookNorm = (p) => resolvePath(p).split(pathSep).join("/").toLowerCase().replace(/\/+$/, "");
+function hookGuardKind(abs, at) {
+    const real = (p) => { try {
+        return realPath(p);
+    }
+    catch {
+        return p;
+    } };
+    const paths = [...new Set([hookNorm(abs), hookNorm(joinPath(real(dirname(abs)), basename(abs)))])];
+    const homes = [...new Set([hookNorm(at.home), hookNorm(real(at.home))])], projects = [...new Set([hookNorm(at.projectDir), hookNorm(real(at.projectDir))])];
+    const settings = (p) => /\/\.claude\/settings[^/]*\.json$/.test(p);
+    for (const p of paths) {
+        for (const h of homes) {
+            if (settings(p) && p.slice(0, p.lastIndexOf("/")) === `${h}/.claude`)
+                return "user settings";
+            if (p.startsWith(`${h}/.claude/plugins/`) && p.slice(h.length + 17).includes("decidio"))
+                return "Decidio plugin";
+        }
+        if (settings(p) && projects.some((r) => p.startsWith(r + "/")))
+            return "project settings";
+    }
+    return null;
+}
+function hookGuardDir(abs, at) {
+    const d = hookNorm(abs), h = hookNorm(at.home);
+    return d === `${h}/.claude` || d === `${h}/.claude/plugins` || (basename(d) === ".claude" && d.startsWith(hookNorm(at.projectDir) + "/"));
+}
+function hookShowPath(abs, at) {
+    const inside = (root) => { const r = relative(root, abs); return r && !r.startsWith("..") && !isAbsolute(r) ? r.split(pathSep).join("/") : null; };
+    const p = inside(at.projectDir);
+    if (p !== null)
+        return p;
+    const h = inside(at.home);
+    if (h !== null)
+        return "~/" + h;
+    return abs.split(pathSep).join("/");
+}
+function hookPlainArgs(args) {
+    const out = [];
+    for (let i = 0; i < args.length; i++) {
+        const a = args[i];
+        if (/^(\d+|&)?(>>?|<)\|?$/.test(a)) {
+            i++;
+            continue;
+        }
+        if (/^(\d+|&)?[<>]/.test(a))
+            continue;
+        out.push(a);
+    }
+    return out;
+}
+function hookWriteTargets(s) {
+    const out = [...s.raw.matchAll(/(?:\d+|&)?>>?\|?\s*([^\s;&|<>()]+)/g)].map((m) => m[1]).filter((t) => !t.startsWith("&"));
+    const files = hookPlainArgs(s.args).filter((a) => !a.startsWith("-"));
+    const p = s.program;
+    if (["tee", "sponge", "rm", "unlink", "truncate", "rd", "rmdir", "set-content", "add-content", "out-file", "clear-content", "remove-item", "ri", "del", "erase", "new-item", "ni", "tee-object"].includes(p))
+        out.push(...files);
+    else if (p === "sed" && s.args.some((a) => /^-[A-Za-z]*i/.test(a) || /^--in-place(=|$)/.test(a)))
+        out.push(...files);
+    else if (["mv", "move", "move-item", "mi", "cp", "copy", "copy-item", "cpi"].includes(p)) {
+        const t = s.args.findIndex((a) => a === "-t" || a === "--target-directory");
+        const tdir = t >= 0 ? s.args[t + 1] : s.args.find((a) => a.startsWith("--target-directory="))?.slice(19);
+        const srcs = tdir !== undefined ? files.filter((f) => f !== tdir) : files.slice(0, -1);
+        const dest = tdir ?? files[files.length - 1];
+        if (dest !== undefined)
+            out.push(dest, ...srcs.map((f) => joinPath(hookUnq(dest), basename(hookUnq(f)))));
+        if (["mv", "move", "move-item", "mi"].includes(p))
+            out.push(...srcs);
+    }
+    else if (p === "dd")
+        out.push(...s.args.filter((a) => a.startsWith("of=")).map((a) => a.slice(3)));
+    return out;
+}
+function hookGuardHits(segs, at) {
+    const hits = [];
+    const dirs = hookSegDirs(segs, at);
+    segs.forEach((s, i) => {
+        for (const t of hookWriteTargets(s)) {
+            const e = hookExpand(t.replace(/\\/g, "/"), at);
+            const dir = dirs[i];
+            if (e !== null && (dir !== null || isAbsolute(e))) {
+                const abs = resolvePath(dir ?? at.cwd, e);
+                if (hookGuardKind(abs, at) || hookGuardDir(abs, at))
+                    hits.push({ key: `path:${abs}`, display: hookShowPath(abs, at) });
+            }
+            else if (/(^|[\\/])\.claude[\\/](settings[^\\/]*\.json|plugins[\\/].*decidio)/i.test(hookUnq(t))) {
+                hits.push({ key: `text:${t}`, display: hookUnq(t) });
+            }
+        }
+        if (s.program === "claude" && /^plugins?$/.test(s.args[0] ?? "") && s.args.some((a) => /^(disable|uninstall|remove|rm)$/.test(a)) && s.args.some((a) => /decidio/i.test(a)))
+            hits.push({ key: `plugin:${s.args.join(" ")}`, display: `claude ${s.args.join(" ")}` });
+        if (/decidio/i.test(s.raw) && s.args.some((a, k) => a === "hook" && s.args[k + 1] === "install") && s.args.some((a) => a === "--cli" || a.startsWith("--cli=")))
+            hits.push({ key: `install:${s.args.join(" ")}`, display: `hook install ${s.args.slice(s.args.indexOf("install") + 1).join(" ")}` });
+    });
+    return hits;
+}
 const HOOK_RULES = [
+    { category: "decidio-guard", summary: "turns off or changes Decidio's check on this agent: a shell write to .claude/settings*.json, ~/.claude/settings*.json or the Decidio plugin's files (>, >>, tee, sed -i, rm, mv, cp, truncate, Set-Content, Out-File, Remove-Item, Move-Item, Copy-Item), claude plugin disable|uninstall decidio, hook install --cli; a Write/Edit/MultiEdit that removes or alters a Decidio hook, sets disableAllHooks, turns the Decidio plugin off, touches its files or leaves invalid JSON",
+        matches: (segs, _cmd, at) => hookGuardHits(segs, at).length > 0 },
     { category: "delete-recursive", summary: "rm -r/-rf, find -delete / -exec rm, rmdir|rd|del /s, Remove-Item -Recurse, shred",
         matches: (segs) => segs.some((s) => (s.program === "rm" && hookFlag(s.args, "rR", ["--recursive"]))
             || (s.program === "find" && (s.args.includes("-delete") || s.args.some((a, i) => i > 0 && s.args[i - 1] === "-exec" && basename(a) === "rm")))
@@ -2394,10 +2674,10 @@ const HOOK_RULES = [
             || (hookSub(s) === "update-ref" && s.args.includes("-d"))
             || (hookSub(s) === "reflog" && hookSub(s, 1) === "expire")
             || (hookSub(s) === "gc" && s.args.some((a) => a.startsWith("--prune"))))) },
-    { category: "sql-destructive", summary: "DROP TABLE|DATABASE|SCHEMA|INDEX|VIEW|USER|ROLE, TRUNCATE, DELETE FROM - sent to a database client (psql, mysql, sqlite3, mongosh, sqlcmd, bq, ...); prisma migrate reset / db push --force-reset; rails db:drop|db:reset",
+    { category: "sql-destructive", summary: "DROP TABLE|DATABASE|SCHEMA|INDEX|VIEW|USER|ROLE, TRUNCATE, DELETE FROM - sent to a database client (psql, mysql, sqlite3, mongosh, sqlcmd, bq, ...) or run by a program (python, node, deno, bun, ruby, perl, php, tsx, ts-node, npx, uv run, manage.py, rails runner) - in its own arguments, or anywhere on the line when it reads code inline (-c, -e, --eval, -, a here-doc, a here-string piped in); prisma migrate reset / db push --force-reset; rails db:drop|db:reset",
         matches: (segs, cmd) => {
             const toDb = segs.some((s) => HOOK_DB_CLIENTS.includes(s.program) || /\bprisma\b/.test(s.raw) || /\.sql\b/.test(s.raw));
-            return (toDb && (/\bDROP\s+(TABLE|DATABASE|SCHEMA|INDEX|VIEW|USER|ROLE|EXTENSION)\b/i.test(cmd) || /\bTRUNCATE\s+(TABLE\s+)?\S/i.test(cmd) || /\bDELETE\s+FROM\s+\S/i.test(cmd)))
+            return ((toDb || segs.some(hookInline)) && hookSqlStmt(cmd)) || segs.some((s) => hookInterp(s) && hookSqlStmt(s.raw))
                 || segs.some((s) => (/\bprisma\b/.test(s.raw) && (/\bmigrate\s+reset\b/.test(s.raw) || /--force-reset\b/.test(s.raw)))
                     || (["rails", "rake"].includes(s.program) && /\bdb:(drop|reset|schema:load)\b/.test(s.raw)));
         } },
@@ -2471,11 +2751,207 @@ function hookExtraRules() {
         return { category: r.category, summary: typeof r.summary === "string" ? r.summary : `/${r.pattern}/${r.flags ?? ""}`, matches: (_s, cmd) => { re.lastIndex = 0; return re.test(cmd); } };
     });
 }
-function hookMatch(command) {
+function hookMatch(command, at, rules = [...HOOK_RULES, ...hookExtraRules()], depth = 0) {
     const segs = hookSegments(command);
-    for (const r of [...HOOK_RULES, ...hookExtraRules()])
-        if (r.matches(segs, command))
+    for (const r of rules)
+        if (r.matches(segs, command, at))
             return r;
+    if (depth < 2)
+        for (const inner of hookShellInner(command)) {
+            const r = hookMatch(inner, at, rules, depth + 1);
+            if (r)
+                return r;
+        }
+    return null;
+}
+function hookSelfDecides(command, depth = 0) {
+    const hit = hookSegments(command).some((s) => {
+        const a = s.args.map((x) => x.replace(/^["']|["']$/g, ""));
+        const cli = (x) => /^@decidio\/sdk(@\S+)?$/i.test(x) || /^decidio(@\S+)?$/i.test(x)
+            || /(^|[\\/])(decidio-guard|@decidio[\\/]sdk)[\\/](dist[\\/])?cli\.(js|ts)$/i.test(x);
+        const runsCli = s.program === "decidio" || s.program === "decidio.js"
+            || ((["npx", "pnpx", "bunx", "npm", "pnpm", "yarn", "bun", "node", "tsx", "uv", "uvx", "pipx"].includes(s.program) || /^python[0-9.]*$/.test(s.program)) && a.some(cli));
+        const i = a.indexOf("approvals");
+        return runsCli && i >= 0 && a.slice(i + 1).some((x) => /^(approve|reject)$/i.test(x));
+    });
+    return hit || (depth < 2 && hookShellInner(command).some((c) => hookSelfDecides(c, depth + 1)));
+}
+function hookShellInner(command) {
+    const out = [];
+    const re = /(?:^|[\s;&|(`])(?:bash|sh|zsh|dash|ksh|pwsh|powershell)(?:\.exe)?((?:\s+-[A-Za-z]+)*?)\s+(?:-[A-Za-z]*c|-Command|-command)\s+/g;
+    for (let m = re.exec(command); m; m = re.exec(command)) {
+        let i = m.index + m[0].length, arg = "";
+        const q = command[i];
+        if (q === "'") {
+            const end = command.indexOf("'", i + 1);
+            arg = command.slice(i + 1, end < 0 ? undefined : end);
+        }
+        else if (q === '"') {
+            for (i += 1; i < command.length && command[i] !== '"'; i++)
+                arg += command[i] === "\\" && (command[i + 1] === '"' || command[i + 1] === "\\") ? command[++i] : command[i];
+        }
+        else
+            arg = command.slice(i).split(/\s/, 1)[0] ?? "";
+        if (arg.trim())
+            out.push(arg);
+    }
+    return out;
+}
+const HOOK_FOLLOW_MAX = 256 * 1024;
+const HOOK_SHELLS = ["bash", "sh", "zsh", "dash", "ksh"];
+const HOOK_PROGRAM_EXT = /\.(py|js|mjs|cjs|ts|rb)$/i;
+function hookProjectFile(p, dir, at) {
+    try {
+        const e = hookExpand(p, at);
+        if (e === null)
+            return null;
+        const real = realPath(resolvePath(dir, e));
+        let root = at.projectDir;
+        try {
+            root = realPath(at.projectDir);
+        }
+        catch { }
+        const r = relative(root, real);
+        if (!r || r.startsWith("..") || isAbsolute(r))
+            return null;
+        const st = statSync(real);
+        if (!st.isFile() || st.size > HOOK_FOLLOW_MAX)
+            return null;
+        const buf = readFileSync(real);
+        if (buf.length > HOOK_FOLLOW_MAX || buf.subarray(0, 8192).includes(0))
+            return null;
+        return { rel: r.split(pathSep).join("/"), text: buf.toString("utf8"), sha: createHash("sha256").update(buf).digest("hex") };
+    }
+    catch {
+        return null;
+    }
+}
+const hookLines = (text) => {
+    const phys = text.split(/\r?\n/);
+    const out = [];
+    for (let i = 0; i < phys.length; i++) {
+        const n = i + 1;
+        let t = phys[i];
+        while (/\\$/.test(t) && i + 1 < phys.length)
+            t = t.slice(0, -1) + " " + phys[++i];
+        out.push({ n, t });
+    }
+    return out;
+};
+function hookScanShell(f, at, rules) {
+    const lines = hookLines(f.text).filter((l) => l.t.trim() && !/^\s*#/.test(l.t));
+    for (const l of lines) {
+        const r = hookMatch(l.t, at, rules);
+        if (r)
+            return { rule: r, rel: f.rel, line: l.n, text: l.t, sha: f.sha };
+    }
+    const r = hookMatch(lines.map((l) => l.t).join("\n"), at, rules);
+    if (!r)
+        return null;
+    const l = lines.find((x) => hookSqlStmt(x.t)) ?? lines[0];
+    return { rule: r, rel: f.rel, line: l.n, text: l.t, sha: f.sha };
+}
+function hookScanSql(f, rule) {
+    const lines = hookLines(f.text).filter((l) => l.t.trim() && !/^\s*--/.test(l.t));
+    const l = lines.find((x) => hookSqlStmt(x.t)) ?? (hookSqlStmt(lines.map((x) => x.t).join("\n")) ? lines.find((x) => /\b(DROP|TRUNCATE|DELETE)\b/i.test(x.t)) : undefined);
+    return l ? { rule, rel: f.rel, line: l.n, text: l.t, sha: f.sha } : null;
+}
+function hookScanProgram(f, rule) {
+    const l = hookLines(f.text).find((x) => /\bDROP\s+(TABLE|DATABASE|SCHEMA|INDEX|VIEW|USER|ROLE|EXTENSION)\b/i.test(x.t) || /\bTRUNCATE\s+(TABLE\s+)?["'`[]?[A-Za-z_]/.test(x.t) || /\btruncate\s+table\s+\S/i.test(x.t));
+    return l ? { rule, rel: f.rel, line: l.n, text: l.t, sha: f.sha } : null;
+}
+const HOOK_PM_OWN = new Set(["install", "i", "add", "remove", "rm", "uninstall", "un", "update", "up", "upgrade", "exec", "dlx", "create", "init", "publish", "pack", "link", "ln", "unlink", "why", "list", "ls", "outdated", "audit", "config", "info", "version", "help", "bin", "cache", "global", "set", "workspace", "workspaces", "dedupe", "import", "rebuild", "rb", "prune", "store", "patch", "plugin", "node", "env", "root", "fetch", "licenses", "login", "logout", "owner", "tag", "team", "unplug", "constraints", "explain", "npm", "dist-tag", "deploy", "setup", "doctor", "server"]);
+function hookPackageScript(s) {
+    const a = hookPlainArgs(s.args).filter((x) => !x.startsWith("-"));
+    if (s.program === "npm") {
+        if (["run", "run-script", "rum", "urn"].includes(a[0] ?? ""))
+            return a[1] ?? null;
+        return { test: "test", t: "test", tst: "test", start: "start", stop: "stop", restart: "restart" }[a[0] ?? ""] ?? null;
+    }
+    if (s.program === "bun")
+        return a[0] === "run" ? a[1] ?? null : null;
+    if (s.program === "pnpm" || s.program === "yarn")
+        return a[0] === "run" ? a[1] ?? null : a[0] && !HOOK_PM_OWN.has(a[0]) ? a[0] : null;
+    return null;
+}
+function hookProgramFile(s) {
+    const ext = /^python[0-9.]*(\.exe)?$/.test(s.program) ? /\.py$/i : /^(node|deno|bun|tsx|ts-node)(\.exe)?$/.test(s.program) ? /\.(js|mjs|cjs|ts)$/i : /^ruby(\.exe)?$/.test(s.program) ? /\.rb$/i : null;
+    if (!ext)
+        return null;
+    let a = hookPlainArgs(s.args);
+    if (/^(deno|bun)/.test(s.program) && a[0] === "run")
+        a = a.slice(1);
+    for (const x of a) {
+        if (x === "-" || x === "-m" || /^-[A-Za-z]*[ce]$/.test(x) || x === "--eval" || x === "-p" || x === "--print")
+            return null;
+        if (x.startsWith("-"))
+            continue;
+        return ext.test(hookUnq(x)) ? hookUnq(x) : null;
+    }
+    return null;
+}
+function hookFollow(segs, at) {
+    const rules = [...HOOK_RULES, ...hookExtraRules()];
+    const sql = HOOK_RULES.find((r) => r.category === "sql-destructive");
+    const dirs = hookSegDirs(segs, at);
+    for (let i = 0; i < segs.length; i++) {
+        const dir = dirs[i];
+        if (dir === null || dir === undefined)
+            continue;
+        const s = hookUnwrap(segs[i]);
+        const file = (p) => (p ? hookProjectFile(p, dir, at) : null);
+        const redirIn = s.raw.match(/(?:^|[^<])<(?![<(])\s*([^\s<>|&;()]+)/)?.[1];
+        let sh;
+        if (HOOK_SHELLS.includes(s.program)) {
+            const a = hookPlainArgs(s.args);
+            sh = a.some((x) => /^-[A-Za-z]*c[A-Za-z]*$/.test(x)) ? undefined : a.find((x) => !x.startsWith("-")) ?? redirIn;
+        }
+        else if (s.program === "source" || s.program === ".")
+            sh = hookPlainArgs(s.args)[0];
+        else if (/[\\/]/.test(s.bin) && !HOOK_PROGRAM_EXT.test(s.bin) && !/\.sql$/i.test(s.bin))
+            sh = s.bin;
+        if (sh !== undefined) {
+            const f = file(sh);
+            const hit = f && hookScanShell(f, at, rules);
+            if (hit)
+                return hit;
+            continue;
+        }
+        if (HOOK_DB_CLIENTS.includes(s.program)) {
+            const k = s.args.findIndex((x) => x === "-f" || x === "--file");
+            const sqlFile = (s.program === "psql" ? (k >= 0 ? s.args[k + 1] : s.args.find((x) => x.startsWith("--file="))?.slice(7)) : undefined)
+                ?? redirIn ?? (["sqlite3", "sqlite", "duckdb"].includes(s.program) ? s.raw.match(/\.read\s+["']?([^"'\s]+)/)?.[1] : undefined);
+            const f = file(sqlFile);
+            const hit = f && hookScanSql(f, sql);
+            if (hit)
+                return hit;
+            continue;
+        }
+        const script = hookPackageScript(s);
+        if (script) {
+            const f = file("package.json");
+            let body;
+            try {
+                body = f ? JSON.parse(f.text)?.scripts?.[script] : undefined;
+            }
+            catch {
+                body = undefined;
+            }
+            if (f && typeof body === "string") {
+                const r = hookMatch(body, at, rules);
+                if (r) {
+                    const n = f.text.split(/\r?\n/).findIndex((l) => l.replace(/\s+/g, "").includes(JSON.stringify(script) + ":"));
+                    return { rule: r, rel: f.rel, line: n + 1 || 1, text: body, sha: f.sha };
+                }
+                continue;
+            }
+        }
+        const prog = hookProgramFile(s) ?? (/[\\/]/.test(s.bin) && HOOK_PROGRAM_EXT.test(s.bin) ? s.bin : null);
+        const f = file(prog ?? undefined);
+        const hit = f && hookScanProgram(f, sql);
+        if (hit)
+            return hit;
+    }
     return null;
 }
 function hookRedact(command) {
@@ -2487,21 +2963,29 @@ function hookRedact(command) {
         .replace(/((?:-H|--header)\s+["']?(?:authorization|x-api-key|cookie)\s*:\s*)[^"']+/gi, "$1[REDACTED]")
         .replace(/\b(?:AKIA[0-9A-Z]{16}|ghp_[A-Za-z0-9]{20,}|github_pat_[A-Za-z0-9_]{20,}|sk-[A-Za-z0-9_-]{20,}|xox[baprs]-[A-Za-z0-9-]{10,}|sk_(?:live|test)_[A-Za-z0-9]{10,})\b/g, "[REDACTED]");
 }
-function hookSubject(category, segs, cwdAbs, projectDir) {
-    const textOnly = (why) => ({ fingerprint: null, display: `text-only (${why})` });
-    const relOrAbs = (p) => { const r = relative(projectDir, p); return r && !r.startsWith("..") && !isAbsolute(r) ? r.split(pathSep).join("/") : p; };
-    const nonFlags = (s) => s.args.filter((a) => !a.startsWith("-"));
-    const git = () => {
+const hookGitMemo = new Map();
+function hookGitRead(cwdAbs) {
+    const hit = hookGitMemo.get(cwdAbs);
+    if (hit)
+        return hit;
+    const run = (args) => {
         try {
-            const run = (args) => execFileSync("git", args, { cwd: cwdAbs, timeout: 3000, stdio: ["ignore", "pipe", "ignore"], encoding: "utf8" }).trim();
-            const head = run(["rev-parse", "HEAD"]);
-            const branch = run(["rev-parse", "--abbrev-ref", "HEAD"]);
-            return /^[0-9a-f]{40}$/.test(head) && branch ? { head, branch } : null;
+            return execFileSync("git", args, { cwd: cwdAbs, timeout: 3000, stdio: ["ignore", "pipe", "ignore"], encoding: "utf8" }).trim() || null;
         }
         catch {
             return null;
         }
     };
+    const head = run(["rev-parse", "HEAD"]);
+    const out = { head: head && /^[0-9a-f]{40}$/.test(head) ? head : null, branch: head ? run(["rev-parse", "--abbrev-ref", "HEAD"]) : null, origin: run(["remote", "get-url", "origin"]) };
+    hookGitMemo.set(cwdAbs, out);
+    return out;
+}
+function hookSubject(category, segs, cwdAbs, projectDir, at) {
+    const textOnly = (why) => ({ fingerprint: null, display: `text-only (${why})` });
+    const relOrAbs = (p) => { const r = relative(projectDir, p); return r && !r.startsWith("..") && !isAbsolute(r) ? r.split(pathSep).join("/") : p; };
+    const nonFlags = (s) => s.args.filter((a) => !a.startsWith("-"));
+    const git = () => { const g = hookGitRead(cwdAbs); return g.head && g.branch ? { head: g.head, branch: g.branch } : null; };
     const firstOf = (programs) => segs.findIndex((s) => programs.includes(s.program));
     const movedTree = (i) => segs.slice(0, i).some((s) => s.program === "cd" || s.program === "pushd");
     if (category === "git-rewrite" || category === "infra-apply") {
@@ -2510,11 +2994,13 @@ function hookSubject(category, segs, cwdAbs, projectDir) {
             return textOnly("no subject");
         if (movedTree(i))
             return textOnly("a cd on the same line moves the call to another directory");
+        if (category === "git-rewrite" && hookGitElsewhere(segs[i], cwdAbs))
+            return textOnly("git -C names another directory");
         const g = git();
         if (!g)
             return textOnly("not a git repository here");
         const seg = segs[i];
-        const args = nonFlags(seg);
+        const args = category === "git-rewrite" ? hookGitArgs(seg).filter((a) => !a.startsWith("-")) : nonFlags(seg);
         const extra = category === "git-rewrite" ? args.slice(1).join(" ") : [relOrAbs(cwdAbs), ...seg.args.filter((a) => /^(-var-file|--var-file|-plan|--plan)/.test(a) || /\.(tfplan|tfvars)$/.test(a))].join(" ");
         return { fingerprint: `${category}:${g.head}:${g.branch}:${extra}`, display: `HEAD ${g.head.slice(0, 7)} on ${g.branch}${extra ? ` · ${hookRedact(extra).slice(0, 120)}` : ""}` };
     }
@@ -2533,17 +3019,245 @@ function hookSubject(category, segs, cwdAbs, projectDir) {
     if (category === "sql-destructive") {
         const stIdx = segs.findIndex((s) => /\b(DROP|TRUNCATE|DELETE)\b/i.test(s.raw));
         const dbIdx = firstOf(HOOK_DB_CLIENTS);
-        const client = dbIdx >= 0 ? segs[dbIdx] : stIdx >= 0 ? segs[stIdx] : null;
+        const own = segs.findIndex((s) => hookInterp(s) && hookSqlStmt(s.raw));
+        const inIdx = dbIdx >= 0 ? -1 : own >= 0 ? own : segs.findIndex(hookInline);
+        const client = dbIdx >= 0 ? segs[dbIdx] : inIdx >= 0 ? segs[inIdx] : stIdx >= 0 ? segs[stIdx] : null;
         if (!client)
             return textOnly("no statement");
         const stmtSeg = stIdx >= 0 ? segs[stIdx] : client;
         const stmt = (stmtSeg.raw.match(/\b(DROP\s+\w+[^;'"]*|TRUNCATE[^;'"]*|DELETE\s+FROM[^;'"]*)/i)?.[1] ?? stmtSeg.raw).replace(/\s+/g, " ").trim();
         const stmtAt = client.args.findIndex((a) => /^["']?(DROP|TRUNCATE|DELETE)\b/i.test(a));
-        const target = (stmtAt >= 0 ? client.args.slice(0, stmtAt) : client.args).filter((a) => !a.startsWith("-")).join(" ");
+        const target = (stmtAt >= 0 ? client.args.slice(0, stmtAt) : client.args).filter((a) => !a.startsWith("-") && !/^["'@]+$/.test(a)).join(" ");
         return { fingerprint: `sql:${client.program}:${target}:${stmt.toUpperCase()}`, display: hookRedact(`${client.program}${target ? ` ${target}` : ""}: ${stmt}`).slice(0, 160) };
     }
+    if (category === "decidio-guard" && at) {
+        const hits = hookGuardHits(segs, at);
+        if (!hits.length)
+            return textOnly("no subject");
+        return { fingerprint: `guard:${[...new Set(hits.map((h) => h.key))].sort().join("\0")}`, display: hookRedact([...new Set(hits.map((h) => h.display))].join(", ")).slice(0, 160) };
+    }
     return textOnly("text binds this category");
 }
+const hookIsOurs = (h) => typeof h?.command === "string" && /\bhook (pretool|posttool)\b/.test(h.command) && /decidio|cli\.(js|ts)/.test(h.command);
+const hookSorted = (v) => Array.isArray(v) ? v.map(hookSorted) : v && typeof v === "object" ? Object.fromEntries(Object.keys(v).sort().map((k) => [k, hookSorted(v[k])])) : v;
+function hookOurHandlers(settings) {
+    const out = [];
+    const hooks = settings && typeof settings === "object" ? settings.hooks : undefined;
+    if (!hooks || typeof hooks !== "object" || Array.isArray(hooks))
+        return out;
+    for (const [event, list] of Object.entries(hooks))
+        if (Array.isArray(list))
+            for (const g of list)
+                if (g && typeof g === "object" && Array.isArray(g.hooks))
+                    for (const h of g.hooks)
+                        if (hookIsOurs(h)) {
+                            const matcher = typeof g.matcher === "string" ? g.matcher : "";
+                            out.push({ event, matcher, iff: typeof h.if === "string" ? h.if : "", key: `${event}\0${matcher}\0${JSON.stringify(hookSorted(h))}` });
+                        }
+    return out;
+}
+function hookFindEdit(text, from) {
+    if (text.includes(from))
+        return from;
+    const fold = (s) => s.replace(/[‘’]/g, "'").replace(/[“”]/g, '"');
+    const i = fold(text).indexOf(fold(from));
+    return i < 0 ? null : text.slice(i, i + from.length);
+}
+function hookFileGuard(tool, ti, at) {
+    const t = (ti && typeof ti === "object" ? ti : {});
+    if (typeof t.file_path !== "string" || !t.file_path)
+        return null;
+    const abs = resolvePath(at.cwd, t.file_path);
+    const kind = hookGuardKind(abs, at);
+    if (!kind)
+        return null;
+    const display = hookShowPath(abs, at);
+    const sha = (s) => createHash("sha256").update(s, "utf8").digest("hex");
+    let before = null, unreadable = false;
+    try {
+        before = existsSync(abs) ? readFileSync(abs, "utf8") : null;
+    }
+    catch {
+        unreadable = true;
+    }
+    let after;
+    if (tool === "Write") {
+        if (typeof t.content !== "string")
+            return null;
+        after = t.content;
+    }
+    else {
+        const edits = tool === "Edit" ? [t] : Array.isArray(t.edits) ? t.edits : null;
+        if (!edits || !edits.length)
+            return null;
+        if (unreadable)
+            return { abs, display, changes: ["the current file could not be read, so the change cannot be checked"], sha: sha(`unreadable\n${JSON.stringify(edits)}`) };
+        let text = before;
+        for (const raw of edits) {
+            const e = (raw && typeof raw === "object" ? raw : {});
+            const from = e.old_string, to = e.new_string;
+            if (typeof from !== "string" || typeof to !== "string")
+                return null;
+            if (text === null) {
+                if (from !== "")
+                    return null;
+                text = to;
+                continue;
+            }
+            if (from === "") {
+                text = text.trim() === "" ? to : to + text;
+                continue;
+            }
+            const found = hookFindEdit(text, from);
+            if (found === null)
+                return null;
+            text = e.replace_all === true ? text.split(found).join(to) : text.replace(found, () => to);
+        }
+        after = text ?? "";
+    }
+    const changes = [];
+    if (kind === "Decidio plugin")
+        changes.push("changes the Decidio plugin's own files");
+    else {
+        let parsed, valid = true;
+        try {
+            parsed = JSON.parse(after);
+        }
+        catch {
+            valid = false;
+        }
+        const obj = valid && !!parsed && typeof parsed === "object" && !Array.isArray(parsed);
+        if (!obj)
+            changes.push(valid ? "leaves the file something other than a JSON object" : "leaves the file invalid JSON");
+        let prev = {};
+        if (unreadable)
+            changes.push("the current file could not be read, so what it removes cannot be checked");
+        else if (before !== null) {
+            try {
+                prev = JSON.parse(before);
+            }
+            catch {
+                prev = {};
+            }
+        }
+        const now = obj ? parsed : {};
+        const nowHandlers = hookOurHandlers(now);
+        const kept = new Set(nowHandlers.map((h) => h.key)), slots = new Set(nowHandlers.map((h) => `${h.event}\0${h.matcher}\0${h.iff}`));
+        const lost = hookOurHandlers(prev).filter((h) => !kept.has(h.key));
+        const verb = (h) => slots.has(`${h.event}\0${h.matcher}\0${h.iff}`) ? "changes" : "removes";
+        if (lost.length === 1)
+            changes.push(`${verb(lost[0])} Decidio's ${lost[0].event} hook${lost[0].matcher ? ` (${lost[0].matcher}${lost[0].iff ? `, ${lost[0].iff}` : ""})` : ""}`);
+        else if (lost.length) {
+            const removed = lost.filter((h) => verb(h) === "removes").length;
+            changes.push(`${removed === lost.length ? "removes" : removed ? "removes or changes" : "changes"} ${lost.length} of Decidio's hooks (${[...new Set(lost.map((h) => h.event))].join(", ")})`);
+        }
+        if (now.disableAllHooks === true && prev?.disableAllHooks !== true)
+            changes.push("sets disableAllHooks");
+        const ep = (o) => (o && typeof o === "object" && o.enabledPlugins && typeof o.enabledPlugins === "object" && !Array.isArray(o.enabledPlugins) ? o.enabledPlugins : {});
+        const off = Object.keys({ ...ep(prev), ...ep(now) }).filter((k) => /decidio/i.test(k) && (ep(now)[k] === false || (ep(prev)[k] === true && ep(now)[k] !== true)));
+        if (off.length)
+            changes.push(`turns the Decidio plugin off (enabledPlugins ${off.join(", ")})`);
+    }
+    return changes.length ? { abs, display, changes, sha: sha(after) } : null;
+}
+const HOOK_MODES = ["default", "acceptEdits", "plan", "auto", "dontAsk", "bypassPermissions"];
+function hookRepoName(url) {
+    const u = url.trim();
+    let host, path;
+    const scheme = u.match(/^[a-z][a-z0-9+.-]*:\/\/(.*)$/i);
+    if (scheme) {
+        const rest = scheme[1];
+        const slash = rest.indexOf("/");
+        if (slash < 0)
+            return null;
+        const auth = rest.slice(0, slash);
+        host = auth.slice(auth.lastIndexOf("@") + 1).replace(/:\d*$/, "");
+        path = rest.slice(slash + 1);
+    }
+    else {
+        const scp = u.match(/^(?:[^@/]+@)?([^:/\\]+):(?!\/\/)(.+)$/);
+        if (!scp || /^[a-z]:[\\/]/i.test(u))
+            return null;
+        host = scp[1];
+        path = scp[2];
+    }
+    path = path.replace(/^\/+/, "").replace(/\/+$/, "").replace(/\.git$/i, "");
+    if (!host || !path)
+        return null;
+    host = host.toLowerCase();
+    return hookRedact(host === "github.com" ? path : `${host}/${path}`).slice(0, 200);
+}
+function hookCardGit(segs, at) {
+    if (segs?.some((s) => ["cd", "pushd", "popd", "chdir", "set-location", "sl", "push-location", "pop-location"].includes(s.program) || (s.program === "git" && hookGitElsewhere(s, at.cwd))))
+        return {};
+    const g = hookGitRead(at.cwd);
+    const repo = g.origin ? hookRepoName(g.origin) : null;
+    return { ...(repo ? { repo } : {}), ...(g.branch && g.branch !== "HEAD" ? { branch: hookRedact(g.branch).slice(0, 200) } : {}), ...(g.head ? { commit: g.head.slice(0, 7) } : {}) };
+}
+const HOOK_ASK_TAIL = 512 * 1024;
+function hookAsked(transcriptPath) {
+    if (process.env.DECIDIO_HOOK_SHARE_PROMPT === "0" || typeof transcriptPath !== "string" || !transcriptPath)
+        return null;
+    try {
+        let text;
+        const fd = openSync(transcriptPath, "r");
+        try {
+            const size = fstatSync(fd).size, start = Math.max(0, size - HOOK_ASK_TAIL);
+            const buf = Buffer.alloc(size - start);
+            let got = 0;
+            while (got < buf.length) {
+                const n = readSync(fd, buf, got, buf.length - got, start + got);
+                if (!n)
+                    break;
+                got += n;
+            }
+            text = buf.subarray(0, got).toString("utf8");
+            if (start > 0)
+                text = text.slice(text.indexOf("\n") + 1);
+        }
+        finally {
+            closeSync(fd);
+        }
+        const notPrompt = /^\s*<(task-notification|bash-input|bash-stdout|bash-stderr|local-command-stdout|local-command-stderr)>/;
+        const prompts = [];
+        for (const line of text.split("\n")) {
+            if (!line.includes('"last-prompt"') && !line.includes('"external"'))
+                continue;
+            let o;
+            try {
+                o = JSON.parse(line);
+            }
+            catch {
+                continue;
+            }
+            if (o?.type === "last-prompt" && typeof o.lastPrompt === "string" && o.lastPrompt.trim()) {
+                if (!notPrompt.test(o.lastPrompt))
+                    prompts.push(o.lastPrompt);
+            }
+            else if (o?.type === "user" && o.userType === "external" && !o.isMeta && !o.isSidechain && !o.isCompactSummary && !o.isVisibleInTranscriptOnly) {
+                const c = o.message?.content;
+                const said = typeof c === "string" ? c : Array.isArray(c) ? c.filter((b) => b?.type === "text" && typeof b.text === "string").map((b) => b.text).join("\n") : "";
+                if (said.trim() && !notPrompt.test(said))
+                    prompts.push(said);
+            }
+        }
+        const asked = prompts[prompts.length - 1];
+        if (asked === undefined)
+            return null;
+        let before;
+        if (asked.length < 40)
+            for (let i = prompts.length - 2; i >= 0; i--)
+                if (prompts[i] !== asked) {
+                    before = prompts[i];
+                    break;
+                }
+        const cut = (s) => { const r = hookRedact(s); const c = r.slice(0, 1000); return /[\uD800-\uDBFF]$/.test(c) ? c.slice(0, -1) : c; };
+        return { asked: cut(asked), ...(before !== undefined ? { askedBefore: cut(before) } : {}), askedLength: asked.length };
+    }
+    catch {
+        return null;
+    }
+}
 async function readHookStdin() {
     if (process.stdin.isTTY)
         return { ok: false, why: "no hook input on stdin - this command is run BY Claude Code with the tool call as JSON on stdin (set it up with: npx @decidio/sdk hook install)" };
@@ -2574,11 +3288,11 @@ async function readHookStdin() {
 function hookConfig() {
     const token = process.env.DECIDIO_API_TOKEN;
     if (!token)
-        return { missing: "DECIDIO_API_TOKEN is not set - no agent token in this folder's .env or the environment" };
+        return { missing: "this project is not connected to Decidio (no connection, no agent token in this folder's .env or the environment)" };
     return {
         apiUrl: API, agentId: process.env.DECIDIO_AGENT_ID || defaultAgentId(), apiToken: token, sourceSystem: "claude-code",
         agentKey: process.env.DECIDIO_AGENT_KEY || undefined, agentDid: process.env.DECIDIO_AGENT_DID || undefined, workspaceId: process.env.DECIDIO_WORKSPACE_ID || undefined,
-        appUrl: process.env.DECIDIO_APP_URL || APP_URL,
+        appUrl: APP_URL,
     };
 }
 const hookStateDir = () => (process.env.CLAUDE_PLUGIN_DATA ? joinPath(process.env.CLAUDE_PLUGIN_DATA, "hooks") : joinPath(sessionDir(), "hooks"));
@@ -2694,51 +3408,81 @@ async function cmdHookPretool() {
             return deny(`Decidio hook: ${read.why} - refusing this tool call (fail closed).`);
         const input = read.input;
         const tool = typeof input.tool_name === "string" ? input.tool_name : "";
-        const command = typeof input.tool_input?.command === "string" ? input.tool_input.command : "";
-        if (!["Bash", "PowerShell"].includes(tool) || !command.trim())
-            return 0;
-        let rule;
-        try {
-            rule = hookMatch(command);
-        }
-        catch (e) {
-            return deny(`Decidio hook: ${e?.message ?? e} - every command is refused until it is fixed.`);
+        const projectDir = resolvePath(process.env.CLAUDE_PROJECT_DIR || process.cwd());
+        const cwdAbs = resolvePath(typeof input.cwd === "string" && input.cwd ? input.cwd : process.cwd());
+        const at = { cwd: cwdAbs, projectDir, home: homedir() };
+        let g;
+        if (tool === "Bash" || tool === "PowerShell") {
+            const command = typeof input.tool_input?.command === "string" ? input.tool_input.command : "";
+            if (!command.trim())
+                return 0;
+            if (hookSelfDecides(command))
+                return deny("Decidio: an agent can't decide an approval - `approvals approve|reject` is the person's, and the person decides on their phone, the web app, Slack or Teams. Nothing ran. Tell the user which decision is waiting; never try another way to decide it.", "Decidio: the agent tried to decide an approval - refused");
+            const segs = hookSegments(command);
+            let rule, followed = null;
+            try {
+                rule = hookMatch(command, at);
+                if (!rule) {
+                    followed = hookFollow(segs, at);
+                    rule = followed?.rule ?? null;
+                }
+            }
+            catch (e) {
+                return deny(`Decidio hook: ${e?.message ?? e} - every command is refused until it is fixed.`);
+            }
+            if (!rule)
+                return 0;
+            const canonical = command.replace(/\s+/g, " ").trim();
+            const base = hookSubject(rule.category, segs, cwdAbs, projectDir, at);
+            const subject = followed ? { fingerprint: `${base.fingerprint ?? ""}\nfile:${followed.rel}:${followed.sha}`, display: followed.rel } : base;
+            g = { category: rule.category, isFile: false, text: canonical, binding: canonical + "\n" + (subject.fingerprint ?? ""), subject, identity: { command: canonical, subject: subject.fingerprint ?? "" }, segs,
+                ...(followed ? { scriptLine: hookRedact(`${followed.rel}:${followed.line}: ${followed.text.replace(/\s+/g, " ").trim()}`).slice(0, 160) } : {}) };
+        }
+        else if (tool === "Write" || tool === "Edit" || tool === "MultiEdit") {
+            const fc = hookFileGuard(tool, input.tool_input, at);
+            if (!fc)
+                return 0;
+            const what = fc.changes.join("; ");
+            g = { category: "decidio-guard", isFile: true, text: `${tool} ${fc.display} — ${what}`, binding: `${tool}\n${fc.abs}\n${fc.sha}`, subject: { fingerprint: fc.sha, display: `${fc.display}: ${what}` }, identity: { path: fc.abs, after: fc.sha }, segs: null };
         }
-        if (!rule)
+        else
             return 0;
-        const short = hookShort(hookRedact(command.replace(/\s+/g, " ").trim()));
-        const projectDir = resolvePath(process.env.CLAUDE_PROJECT_DIR || process.cwd());
+        const w = g.isFile
+            ? { noun: "edit", run: "make", ran: "Nothing was written.", anew: "If the user wants a different change to this file, that is a new request and may be asked." }
+            : { noun: "command", run: "run", ran: "Nothing ran.", anew: "If the user changes what it would act on (a new commit, a different path), that is a new request and may be asked." };
+        const short = hookShort(hookRedact(g.text.replace(/\s+/g, " ").trim()));
         const cfg = hookConfig();
         if ("missing" in cfg)
-            return deny(`Decidio: "${short}" is a ${rule.category} command that needs a person's approval, but this project has no Decidio agent credentials (${cfg.missing}). Nothing ran. Ask the user to run \`npx @decidio/sdk init\` in ${projectDir}, then retry the same command.`, `Decidio: no agent credentials in ${projectDir} - run npx @decidio/sdk init`);
-        const canonical = command.replace(/\s+/g, " ").trim();
-        const cwdAbs = resolvePath(typeof input.cwd === "string" && input.cwd ? input.cwd : process.cwd());
+            return deny(`Decidio: "${short}" is a ${g.category} ${w.noun} that needs a person's approval, but this project is not connected to Decidio yet. ${w.ran} Run \`npx @decidio/sdk connect\` in ${projectDir} and show the user the link it prints (they allow it on the web), then run \`npx @decidio/sdk connect --wait\`; once it says connected, retry the same ${w.noun}.`, `Decidio: this project is not connected - run npx @decidio/sdk connect`);
         const rel = relative(projectDir, cwdAbs);
         const cwdRel = !rel ? "." : rel.startsWith("..") || isAbsolute(rel) ? cwdAbs : rel;
         const session = typeof input.session_id === "string" ? input.session_id : "";
-        const subject = hookSubject(rule.category, hookSegments(command), cwdAbs, projectDir);
         let material;
         try {
             material = bindingMaterial(cfg);
         }
         catch (e) {
-            return deny(`Decidio hook: this command cannot be bound to an approval (${e?.message ?? e}) - refusing to run it. Ask the user to check ${projectDir}/.env with \`npx @decidio/sdk doctor\`.`);
+            return deny(`Decidio hook: this ${w.noun} cannot be bound to an approval (${e?.message ?? e}) - refusing to ${w.run} it. Ask the user to check ${projectDir}/.env with \`npx @decidio/sdk doctor\`.`);
         }
         if (!material)
-            return deny(`Decidio hook: this command cannot be bound to an approval (no key material (DECIDIO_API_TOKEN, or DECIDIO_AGENT_KEY + DECIDIO_AGENT_DID)) - refusing to run it. Ask the user to check ${projectDir}/.env with \`npx @decidio/sdk doctor\`.`);
-        const ctx = { action: "shellExec", amount: 0, scope: boundScope(material, canonical + "\n" + (subject.fingerprint ?? "")),
-            context: { command: hookRedact(canonical).slice(0, 400), cwd: cwdRel.slice(0, 200), category: rule.category, host: "claude-code", tool, subject: hookRedact(subject.display).slice(0, 200) } };
-        const request = adapterRequest(ctx);
+            return deny(`Decidio hook: this ${w.noun} cannot be bound to an approval (no key material (DECIDIO_API_TOKEN, or DECIDIO_AGENT_KEY + DECIDIO_AGENT_DID)) - refusing to ${w.run} it. Ask the user to check ${projectDir}/.env with \`npx @decidio/sdk doctor\`.`);
+        const committed = { command: hookRedact(g.text).slice(0, 400), cwd: cwdRel.slice(0, 200), category: g.category, host: "claude-code", tool, subject: hookRedact(g.subject.display).slice(0, 200), ...(g.scriptLine ? { scriptLine: g.scriptLine } : {}) };
+        const card = {
+            ...(typeof input.permission_mode === "string" && HOOK_MODES.includes(input.permission_mode) ? { mode: input.permission_mode } : {}),
+            ...hookCardGit(g.segs, at), ...(hookAsked(input.transcript_path) ?? {}),
+        };
+        const ctx = { action: "shellExec", amount: 0, scope: boundScope(material, g.binding), context: { ...committed, ...card } };
+        const request = adapterRequest({ ...ctx, context: committed });
         let key;
         try {
-            key = idempotencyKey(material, { host: "claude-code", tool, command: canonical, cwd: cwdRel, session, subject: subject.fingerprint ?? "" });
+            key = idempotencyKey(material, { host: "claude-code", tool, ...(g.isFile ? {} : { cwd: cwdRel }), session, ...g.identity });
         }
         catch (e) {
-            return deny(`Decidio hook: this command cannot be bound to an approval (${e?.message ?? e}) - refusing to run it. Ask the user to check ${projectDir}/.env with \`npx @decidio/sdk doctor\`.`);
+            return deny(`Decidio hook: this ${w.noun} cannot be bound to an approval (${e?.message ?? e}) - refusing to ${w.run} it. Ask the user to check ${projectDir}/.env with \`npx @decidio/sdk doctor\`.`);
         }
         let auth;
         try {
-            let a = await gateAuthorizeTwinAware(cfg, ctx, { idempotencyKey: key });
+            let a = await gateAuthorizeTwinAware(cfg, ctx, { idempotencyKey: key, request });
             if (a.decision === "duplicate") {
                 const twin = a.duplicateOf;
                 const label = twin.displayNumber ?? twin.decisionId;
@@ -2746,38 +3490,39 @@ async function cmdHookPretool() {
                 const why = twin.reason ? ` ("${twin.reason}")` : "";
                 const stored = readJustification(twin.decisionId);
                 if (!stored) {
-                    return deny(`Decidio: "${short}" looks like a duplicate of ${label}, which a person refused${when}${why}. Nothing ran. If this change is different, ask the user what changed, then run \`npx @decidio/sdk hook justify ${twin.decisionId} "<their words>"\` and retry EXACTLY the same command; the approver will see their justification beside the earlier refusal. A different commit or path is a new request on its own.`, `Decidio: ${label} was refused${when} - a justification is needed to ask again`);
+                    return deny(`Decidio: "${short}" looks like a duplicate of ${label}, which a person refused${when}${why}. ${w.ran} If this change is different, ask the user what changed, then run \`npx @decidio/sdk hook justify ${twin.decisionId} "<their words>"\` and retry EXACTLY the same ${w.noun}; the approver will see their justification beside the earlier refusal. A different commit or path is a new request on its own.`, `Decidio: ${label} was refused${when} - a justification is needed to ask again`);
                 }
-                a = await gateAuthorizeTwinAware(cfg, ctx, { idempotencyKey: key, justification: stored });
+                a = await gateAuthorizeTwinAware(cfg, ctx, { idempotencyKey: key, request, justification: stored });
                 if (a.decision === "duplicate")
-                    return deny(`Decidio: "${short}" is still a duplicate of ${label} and the stored justification was not accepted (${a.duplicateOf.reason ?? "no reason given"}). Nothing ran.`);
+                    return deny(`Decidio: "${short}" is still a duplicate of ${label} and the stored justification was not accepted (${a.duplicateOf.reason ?? "no reason given"}). ${w.ran}`);
                 clearJustification(twin.decisionId);
             }
             auth = a;
         }
         catch (e) {
-            return deny(`Decidio hook: the approval gate could not be asked about "${short}" (${hookErr(e)}) - refusing to run it (fail closed). Nothing ran. ${e instanceof DecidioRateLimitError ? "The workspace's governed-action allowance for this hour is used up; try later." : `Check the network and ${projectDir}/.env (\`npx @decidio/sdk doctor\`), then retry the same command.`}`);
+            return deny(`Decidio hook: the approval gate could not be asked about "${short}" (${hookErr(e)}) - refusing to ${w.run} it (fail closed). ${w.ran} ${e instanceof DecidioRateLimitError ? "The workspace's governed-action allowance for this hour is used up; try later." : `Check the network and ${projectDir}/.env (\`npx @decidio/sdk doctor\`), then retry the same ${w.noun}.`}`);
         }
         const where = decisionUrl(cfg.appUrl, auth.decisionId);
         if (auth.decision === "block")
-            return deny(`Decidio BLOCKED "${short}" by policy (decision ${auth.decisionId}${auth.reason ? `: ${auth.reason}` : ""}). Do not run it, or a variant of it; tell the user.`, `Decidio blocked ${auth.decisionId}`);
+            return deny(`Decidio BLOCKED "${short}" by policy (decision ${auth.decisionId}${auth.reason ? `: ${auth.reason}` : ""}). Do not ${w.run} it, or a variant of it; tell the user.`, `Decidio blocked ${auth.decisionId}`);
         if (auth.decision === "proceed") {
-            writeHookState(input.tool_use_id, { v: 1, decisionId: auth.decisionId, receiptId: auth.receiptId ?? null, tool, category: rule.category, at: new Date().toISOString() });
-            return allow(`Decidio: "${short}" is authorized by policy (decision ${auth.decisionId}${auth.receiptId ? `, receipt ${auth.receiptId}` : ""}, sealed). This covers this one execution only.`);
+            writeHookState(input.tool_use_id, { v: 1, decisionId: auth.decisionId, receiptId: auth.receiptId ?? null, tool, category: g.category, at: new Date().toISOString() });
+            err(`decidio hook: "${short}" is authorized by policy (decision ${auth.decisionId}${auth.receiptId ? `, receipt ${auth.receiptId}` : ""}, sealed) - no output, so Claude Code's own permission check still decides; this covers this one execution only.`);
+            return 0;
         }
         const holdRaw = Number(process.env.DECIDIO_HOOK_HOLD_MS ?? "90000");
         const held = await hookHold(cfg, auth.decisionId, Number.isFinite(holdRaw) && holdRaw >= 0 ? Math.min(holdRaw, HOOK_HOLD_CAP_MS) : 90_000);
         const st = held.status;
         if (!st)
-            return deny(`Decidio: "${short}" is routed for approval as decision ${auth.decisionId}, but its status could not be read (${held.lastError ?? "no answer"}). Nothing ran. When the gate is reachable, run \`npx @decidio/sdk hook wait ${auth.decisionId}\` and then retry EXACTLY the same command.`);
+            return deny(`Decidio: "${short}" is routed for approval as decision ${auth.decisionId}, but its status could not be read (${held.lastError ?? "no answer"}). ${w.ran} When the gate is reachable, run \`npx @decidio/sdk hook wait ${auth.decisionId}\` and then retry EXACTLY the same ${w.noun}.`);
         if (st.state === "pending")
-            return deny(`Decidio: "${short}" needs a person's approval - decision ${auth.decisionId} is in their queue${where ? ` (${where})` : ""}. Nothing ran. To continue: run \`npx @decidio/sdk hook wait ${auth.decisionId}\` (it returns when they decide), then retry EXACTLY the same command - not a variant of it, and do not work around this gate.`, `Decidio: ${auth.decisionId} awaits approval${where ? ` - ${where}` : ""}`);
+            return deny(`Decidio: "${short}" needs a person's approval - decision ${auth.decisionId} is in their queue${where ? ` (${where})` : ""}. ${w.ran} To continue: run \`npx @decidio/sdk hook wait ${auth.decisionId}\` (it returns when they decide), then retry EXACTLY the same ${w.noun} - not a variant of it, and do not work around this gate.`, `Decidio: ${auth.decisionId} awaits approval${where ? ` - ${where}` : ""}`);
         if (st.state === "rejected" || st.state === "blocked")
-            return deny(`Decidio: "${short}" was ${st.state} (decision ${auth.decisionId}${st.reason ? `: ${st.reason}` : ""}) for this exact change (${hookRedact(subject.display)}). Do not retry it or a variant of it; tell the user. ${subject.fingerprint ? "If the user changes what it would act on (a new commit, a different path), that is a new request and may be asked." : ""}`.trim(), `Decidio: ${auth.decisionId} ${st.state}`);
+            return deny(`Decidio: "${short}" was ${st.state} (decision ${auth.decisionId}${st.reason ? `: ${st.reason}` : ""}) for this exact change (${hookRedact(g.subject.display)}). Do not retry it or a variant of it; tell the user. ${g.subject.fingerprint ? w.anew : ""}`.trim(), `Decidio: ${auth.decisionId} ${st.state}`);
         const chk = await checkApproval(cfg, auth.decisionId, request, { status: st });
         if (!chk.ok)
-            return deny(`Decidio: "${short}" is NOT cleared to run - ${chk.reason ?? chk.code} (decision ${auth.decisionId}). Nothing ran.${chk.code === "spent" || chk.code === "expired" ? " Retry the same command to ask for a fresh approval." : ""}`);
-        writeHookState(input.tool_use_id, { v: 1, decisionId: auth.decisionId, receiptId: st.receiptId ?? auth.receiptId ?? null, tool, category: rule.category, at: new Date().toISOString() });
+            return deny(`Decidio: "${short}" is NOT cleared to ${w.run} - ${chk.reason ?? chk.code} (decision ${auth.decisionId}). ${w.ran}${chk.code === "spent" || chk.code === "expired" ? ` Retry the same ${w.noun} to ask for a fresh approval.` : ""}`);
+        writeHookState(input.tool_use_id, { v: 1, decisionId: auth.decisionId, receiptId: st.receiptId ?? auth.receiptId ?? null, tool, category: g.category, at: new Date().toISOString() });
         return allow(`Decidio: "${short}" is approved (decision ${auth.decisionId}${st.receiptId ?? auth.receiptId ? `, receipt ${st.receiptId ?? auth.receiptId}` : ""}). This approval covers this one execution only; its record is sealed.`);
     }
     catch (e) {
@@ -2849,7 +3594,7 @@ async function cmdHookWait(id, timeoutSec) {
     }
     const cfg = hookConfig();
     if ("missing" in cfg) {
-        err(`✘ ${cfg.missing} - run \`npx @decidio/sdk init\` in this project first.`);
+        err(`✘ ${cfg.missing} - connect this project first: npx @decidio/sdk connect`);
         return 1;
     }
     const where = decisionUrl(cfg.appUrl, id);
@@ -2920,6 +3665,14 @@ function cmdHookRules() {
         log(`Add your own: DECIDIO_HOOK_EXTRA_RULES=<file.json> with [{ "category": "deploy", "pattern": "^make deploy\\\\b", "summary": "make deploy" }] - each a regex over the whole command.`);
     log(`The list is a client-side filter; your workspace's policy decides each request the hook sends. Hold: DECIDIO_HOOK_HOLD_MS (90000; capped at ${HOOK_HOLD_CAP_MS}, below the hook's 150 s timeout).`);
     log(`Each request is bound to its SUBJECT as well as its text: a push to the branch and commit it would push, a delete to the paths, a statement to its database - so a refusal means "not this", and a new commit or a different path is a new request.`);
+    log(`A file the command runs is followed ONE level - inside the project only (its real path: a symlink out of it is not followed), text, at most ${HOOK_FOLLOW_MAX / 1024} KB - and an edited file is a new request:`);
+    log(`  shell scripts      bash|sh|zsh|dash|ksh <f>, source <f>, . <f>, ./<f> - every line through the list above`);
+    log(`  SQL files          psql -f <f>, <database client> ... < <f>, sqlite3 <db> ".read <f>" - DROP, TRUNCATE, DELETE FROM`);
+    log(`  package.json       npm run <x>, npm test|start, pnpm [run] <x>, yarn [run] <x>, bun run <x> - the script's text through the list above`);
+    log(`  program files      python <f>.py, node|deno|bun|tsx|ts-node <f>.js|mjs|cjs|ts, ruby <f>.rb run directly - DROP and TRUNCATE only, never DELETE FROM`);
+    log(`  Not followed: a file outside the project or a symlink out of it, a file that calls another file, binaries, files over ${HOOK_FOLLOW_MAX / 1024} KB, SQL built at run time, library calls (drop_all, dropDatabase). The file never leaves this machine: the request carries the matched line.`);
+    log(`decidio-guard on Claude Code's Write, Edit and MultiEdit (.claude/settings*.json, ~/.claude/settings*.json, the Decidio plugin's files): asked only when the file after the change removes or alters a Decidio hook, sets disableAllHooks, turns the Decidio plugin off, touches the plugin's files or is not valid JSON - adding a permission or another hook is not asked. A SHELL write to those files is asked about even when it only adds a permission: its effect can't be computed.`);
+    log(`A policy that auto-approves a request gets no output from the hook, so Claude Code's own permission check still decides; only a person's approval of the exact call answers "allow".`);
     return 0;
 }
 function hookRunner() {
@@ -2940,8 +3693,10 @@ function hookRunner() {
         return `npx tsx ${q(real)}`;
     return `node ${q(real)}`;
 }
+const HOOK_FILE_TOOLS = ["Write", "Edit", "MultiEdit"];
+const HOOK_GUARD_PATHS = ["**/.claude/settings*.json", "~/.claude/settings*.json", "~/.claude/plugins/**"];
 async function cmdHookInstall(opts) {
-    const settingsPath = joinPath(".claude", opts.project ? "settings.json" : "settings.local.json");
+    const settingsPath = joinPath(opts.dir ?? ".", ".claude", opts.project ? "settings.json" : "settings.local.json");
     let settings = {};
     if (existsSync(settingsPath)) {
         try {
@@ -2963,40 +3718,412 @@ async function cmdHookInstall(opts) {
     const cliAt = opts.cli ? resolvePath(opts.cli).split(pathSep).join("/") : "";
     const runner = opts.cli ? (/\.ts$/.test(opts.cli) ? `npx tsx "${cliAt}"` : `node "${cliAt}"`) : hookRunner();
     const hooks = (settings.hooks = settings.hooks && typeof settings.hooks === "object" && !Array.isArray(settings.hooks) ? settings.hooks : {});
-    const place = (event, command, extra) => {
+    const place = (event, matcher, iff, command, extra) => {
         const list = Array.isArray(hooks[event]) ? hooks[event] : (hooks[event] = []);
-        const entry = { matcher: "Bash|PowerShell", hooks: [{ type: "command", command, ...extra }] };
-        const i = list.findIndex((e) => Array.isArray(e?.hooks) && e.hooks.some((h) => typeof h?.command === "string" && /\bhook (pretool|posttool)\b/.test(h.command) && /decidio|cli\.(js|ts)/.test(h.command)));
-        if (i >= 0) {
-            const same = JSON.stringify(list[i]) === JSON.stringify(entry);
-            list[i] = entry;
-            return same ? "kept" : "updated";
-        }
-        list.push(entry);
-        return "added";
+        const want = { type: "command", ...(iff ? { if: iff } : {}), command, ...extra };
+        let state = "added";
+        for (const g of list) {
+            if (!g || typeof g !== "object" || g.matcher !== matcher || !Array.isArray(g.hooks))
+                continue;
+            g.hooks = g.hooks.flatMap((h) => {
+                if (!hookIsOurs(h) || (typeof h.if === "string" ? h.if : undefined) !== iff)
+                    return [h];
+                if (state !== "added") {
+                    state = "updated";
+                    return [];
+                }
+                state = JSON.stringify(h) === JSON.stringify(want) ? "kept" : "updated";
+                return [want];
+            });
+        }
+        hooks[event] = list.filter((g) => !(g && typeof g === "object" && Array.isArray(g.hooks) && g.hooks.length === 0));
+        if (state === "added")
+            hooks[event].push({ matcher, hooks: [want] });
+        return state;
     };
-    const pre = place("PreToolUse", `cd "$CLAUDE_PROJECT_DIR" && ${runner} hook pretool`, { timeout: 150, onFailure: "block" });
-    const post = place("PostToolUse", `cd "$CLAUDE_PROJECT_DIR" && ${runner} hook posttool`, { timeout: 30 });
-    mkdirSync(".claude", { recursive: true });
+    const preLine = `cd "$CLAUDE_PROJECT_DIR" && ${runner} hook pretool`, postLine = `cd "$CLAUDE_PROJECT_DIR" && ${runner} hook posttool`;
+    const pre = place("PreToolUse", "Bash|PowerShell", undefined, preLine, { timeout: 150, onFailure: "block" });
+    const post = place("PostToolUse", "Bash|PowerShell", undefined, postLine, { timeout: 30 });
+    const guard = { added: 0, updated: 0, kept: 0 };
+    for (const t of HOOK_FILE_TOOLS)
+        for (const p of HOOK_GUARD_PATHS) {
+            guard[place("PreToolUse", t, `${t}(${p})`, preLine, { timeout: 150, onFailure: "block" })]++;
+            guard[place("PostToolUse", t, `${t}(${p})`, postLine, { timeout: 30 })]++;
+        }
+    mkdirSync(dirname(settingsPath), { recursive: true });
     writeFileSync(settingsPath, JSON.stringify(settings, null, 2) + "\n");
+    lastHookInstall = { settingsPath, pre, post };
+    if (opts.quiet)
+        return 0;
     log(`✔ ${settingsPath.split(pathSep).join("/")}: PreToolUse hook ${pre}, PostToolUse hook ${post} (matcher Bash|PowerShell${opts.project ? "; this file is shared with everyone who clones the project" : "; this file is yours alone - Claude Code keeps it out of git"}).`);
+    log(`✔ the guard on Claude Code's own settings - ${HOOK_FILE_TOOLS.join(", ")} on ${HOOK_GUARD_PATHS.join(", ")}, PreToolUse and PostToolUse: ${Object.entries(guard).filter(([, n]) => n).map(([k, n]) => `${n} ${k}`).join(", ")}.`);
     log(`  Runs: ${runner} hook pretool|posttool  - the pretool hook times out at 150 s and BLOCKS the call if it fails (fail closed).`);
     const env = readEnvFile();
     const token = process.env.DECIDIO_API_TOKEN || env.DECIDIO_API_TOKEN;
-    if (token)
+    if (token && CREDS_FROM === "connection")
+        log(`✔ credentials: this project's Decidio connection (${process.env.DECIDIO_AGENT_ID}) - kept outside the repository, owner-only.`);
+    else if (token)
         log(`✔ agent credentials: ${ENV_PATH} holds DECIDIO_API_TOKEN${(process.env.DECIDIO_AGENT_KEY || env.DECIDIO_AGENT_KEY) ? " and the agent's signing key" : ""} for "${process.env.DECIDIO_AGENT_ID || env.DECIDIO_AGENT_ID || defaultAgentId()}".`);
     else
-        log(`⚠ no agent credentials here (no DECIDIO_API_TOKEN in ${ENV_PATH}) - until there are, EVERY gated command is refused. Run: npx @decidio/sdk init ${defaultAgentId()}`);
+        log(`⚠ not connected yet - until this project is, EVERY gated command is refused. Run: npx @decidio/sdk connect  (or, for your own agent: npx @decidio/sdk init ${defaultAgentId()})`);
     log(`  Gated: ${HOOK_RULES.map((r) => r.category).join(", ")} (npx @decidio/sdk hook rules lists the patterns; DECIDIO_HOOK_EXTRA_RULES adds yours).`);
     log(`  Approver: anyone in your workspace with a role other than the agent's owner (the person who ran init) - on the phone app, the web app, Slack or Teams.`);
     log(`           Nobody yet? Invite one: npx @decidio/sdk hook install --approver <email>   (single-use link; share by WhatsApp, SMS or email)`);
     log(`  Flow: a gated command is held up to ${Math.min(Number(process.env.DECIDIO_HOOK_HOLD_MS ?? 90_000) || 90_000, HOOK_HOLD_CAP_MS) / 1000} s for the approver, then refused with its decision id; \`npx @decidio/sdk hook wait <id>\` returns when they decide,`);
     log(`        and the SAME command retried then runs - once. A lab workspace allows 30 governed actions an hour; a gated command spends two (ask, retry).`);
-    log(`  Reload: restart Claude Code, or run /hooks in it - hooks are read when a session starts.`);
+    log(`  Reload: none needed - Claude Code picks up the settings file by itself. If a gated command is not asked about, open /hooks once (or restart Claude Code).`);
     if (opts.approver !== undefined)
         return inviteApprover(opts.approver);
     return 0;
 }
+function connectHostLabel(h) { return h === "claude-code" ? "Claude Code" : h; }
+function connectDir() { return joinPath(sessionDir(), "connections"); }
+function realOrSame(p) { try {
+    return realPath(p);
+}
+catch {
+    return resolvePath(p);
+} }
+const sameDir = (a, b) => (process.platform === "win32" ? a.toLowerCase() === b.toLowerCase() : a === b);
+function projectRoot() {
+    try {
+        const r = spawnSync("git", ["rev-parse", "--show-toplevel"], { encoding: "utf8", timeout: 3000, stdio: ["ignore", "pipe", "ignore"], windowsHide: true });
+        const top = String(r.stdout ?? "").trim();
+        if (r.status === 0 && top)
+            return realOrSame(top);
+    }
+    catch { }
+    return realOrSame(SHELL_ENV.CLAUDE_PROJECT_DIR || process.cwd());
+}
+function connectionKey(root) { return createHash("sha256").update(`${API}\n${process.platform === "win32" ? root.toLowerCase() : root}`, "utf8").digest("hex").slice(0, 20); }
+function connectionFile(root) { return joinPath(connectDir(), `${connectionKey(root)}.json`); }
+function pendingConnectFile(root) { return joinPath(connectDir(), `${connectionKey(root)}.pending.json`); }
+function readJsonQuiet(f) {
+    try {
+        return existsSync(f) ? JSON.parse(readFileSync(f, "utf8")) : null;
+    }
+    catch {
+        return null;
+    }
+}
+function loadConnection(root, api) {
+    const c = connectionRecord(root, api);
+    return c && !c.disconnected && c.token ? c : null;
+}
+function connectionRecord(root, api) {
+    const c = readJsonQuiet(connectionFile(root));
+    return c && c.v === 1 && c.api === api && c.root === root && typeof c.token === "string" && typeof c.agentId === "string" && typeof c.key === "string" && typeof c.did === "string" ? c : null;
+}
+function promoteConnection(c) {
+    process.env.DECIDIO_API_TOKEN = c.token;
+    process.env.DECIDIO_AGENT_ID = c.agentId;
+    process.env.DECIDIO_AGENT_DID = c.did;
+    process.env.DECIDIO_AGENT_KEY = c.key;
+    process.env.DECIDIO_WORKSPACE_ID = c.workspaceId;
+    process.env.DECIDIO_TOKEN_JTI = c.jti;
+    if (c.appUrl && process.env.DECIDIO_APP_URL === undefined)
+        process.env.DECIDIO_APP_URL = c.appUrl;
+}
+function inCloudSession() { return SHELL_ENV.CLAUDE_CODE_REMOTE === "true"; }
+function machineId() {
+    const f = joinPath(sessionDir(), "machine-id");
+    let cur = "";
+    try {
+        cur = existsSync(f) ? readFileSync(f, "utf8").trim() : "";
+    }
+    catch { }
+    if (/^[0-9a-f]{8,32}$/.test(cur))
+        return cur;
+    const id = randomBytes(8).toString("hex");
+    mkdirSync(sessionDir(), { recursive: true });
+    writeFileSync(f, id + "\n");
+    return id;
+}
+function machineLabel(cloud) {
+    if (cloud)
+        return `cloud-${machineId().slice(0, 4)}`;
+    const h = (() => { try {
+        return hostname();
+    }
+    catch {
+        return "";
+    } })().split(".")[0].toLowerCase().replace(/[^a-z0-9-]+/g, "-").replace(/^-+|-+$/g, "");
+    return (h || "machine").slice(0, 40);
+}
+function projectLabel(root) {
+    try {
+        const r = spawnSync("git", ["-C", root, "config", "--get", "remote.origin.url"], { encoding: "utf8", timeout: 3000, stdio: ["ignore", "pipe", "ignore"], windowsHide: true });
+        const m = String(r.stdout ?? "").trim().match(/([^/:\\]+?)(?:\.git)?\/?$/);
+        if (r.status === 0 && m?.[1])
+            return m[1].slice(0, 80);
+    }
+    catch { }
+    try {
+        const pj = JSON.parse(readFileSync(joinPath(root, "package.json"), "utf8"));
+        if (typeof pj?.name === "string" && pj.name)
+            return pj.name.replace(/^@[^/]+\//, "").slice(0, 80);
+    }
+    catch { }
+    return (basename(root) || "project").slice(0, 80);
+}
+function localDesktop() {
+    if (inCloudSession() || SHELL_ENV.CI || SHELL_ENV.SSH_CONNECTION || SHELL_ENV.SSH_TTY || SHELL_ENV.CODESPACES || SHELL_ENV.GITPOD_WORKSPACE_ID || SHELL_ENV.DECIDIO_NO_BROWSER)
+        return false;
+    if (process.platform === "darwin" || process.platform === "win32")
+        return true;
+    return !!(SHELL_ENV.DISPLAY || SHELL_ENV.WAYLAND_DISPLAY);
+}
+function openInBrowser(url) {
+    if (!/^https?:\/\/[^\s"'<>`]+$/.test(url))
+        return false;
+    try {
+        const [cmd, args] = process.platform === "darwin" ? ["open", [url]] : process.platform === "win32" ? ["rundll32", ["url.dll,FileProtocolHandler", url]] : ["xdg-open", [url]];
+        const child = spawn(cmd, args, { detached: true, stdio: "ignore", windowsHide: true });
+        child.on("error", () => { });
+        child.unref();
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+const CONNECT_WAIT_S = () => { const n = Number(process.env.DECIDIO_CONNECT_WAIT_S ?? 90); return Number.isFinite(n) && n >= 1 && n <= 110 ? n : 90; };
+let lastHookInstall = null;
+async function startConnect(root, host) {
+    const prior = connectionRecord(root, API);
+    const kp = prior && !inCloudSession() ? { did: prior.did, privateKeyBase64: prior.key } : generateKeypair();
+    const cloud = inCloudSession();
+    const project = projectLabel(root).trim() || "project", machine = machineLabel(cloud).trim() || "machine";
+    const proof = signBoundProof(kp.privateKeyBase64, { agentId: "connect", did: kp.did, action: "connect.start", amount: 0, scope: [host, project, machine, cloud ? "cloud" : "local"].join("\n") });
+    const r = await api("/connect/start", { method: "POST", body: JSON.stringify({ host, project, machine, did: kp.did, cloud, proof }) }, "", true);
+    if (r.status === 0) {
+        err(`✘ couldn't reach Decidio at ${API} - check your connection and run npx @decidio/sdk connect again.`);
+        return null;
+    }
+    if (r.status === 404 || r.status === 401) {
+        err(`✘ ${r.body?.message ?? "Connecting a coding assistant is available in the Decidio lab only."} (${API})`);
+        return null;
+    }
+    if (r.status === 429) {
+        err(`✘ ${r.body?.message ?? "Too many tries - wait a minute and try again."}`);
+        return null;
+    }
+    if (r.status !== 201 || typeof r.body?.pollSecret !== "string" || typeof r.body?.link !== "string") {
+        err(`✘ couldn't start a connection (${r.status}${r.body?.message ? `: ${r.body.message}` : ""}). Nothing was saved.`);
+        return null;
+    }
+    const p = { v: 1, api: API, root, project, host, machine, cloud, did: kp.did, key: kp.privateKeyBase64, code: String(r.body.code), link: String(r.body.link),
+        pollSecret: r.body.pollSecret, expiresAt: String(r.body.expiresAt), interval: Number(r.body.interval) || 2, startedAt: new Date().toISOString() };
+    mkdirSync(connectDir(), { recursive: true });
+    writeSecretFile(pendingConnectFile(root), JSON.stringify(p) + "\n");
+    if (typeof r.body.qr === "string")
+        pendingQr = r.body.qr;
+    return p;
+}
+let pendingQr = null;
+function readPendingConnect(root) {
+    const p = readJsonQuiet(pendingConnectFile(root));
+    return p && p.v === 1 && p.api === API && p.root === root && typeof p.pollSecret === "string" ? p : null;
+}
+function dropFile(f) { try {
+    rmSync(f, { force: true });
+}
+catch { } }
+const minutesLeft = (iso) => Math.max(0, Math.round((new Date(iso).getTime() - Date.now()) / 60_000));
+function showConnectLink(p, opened, tty) {
+    const title = `Connect ${connectHostLabel(p.host)} to Decidio`;
+    log(`${brand()}  ${bold(title)}`);
+    log(`  Open:  ${link(p.link)}`);
+    log(`  Code:  ${bold(p.code)}   ${dim("(the page shows the same code - only allow it if they match)")}`);
+    log(dim(`  ${p.project} · ${p.machine} · the link works for ${minutesLeft(p.expiresAt) || 1} more minute${minutesLeft(p.expiresAt) === 1 ? "" : "s"}${opened ? " · opened in your browser" : ""}`));
+    if (tty && pendingQr) {
+        log("");
+        for (const line of pendingQr.split("\n"))
+            if (line.trim())
+                log(`  ${line}`);
+        log(dim("  Scan with your phone's camera to allow it there."));
+    }
+}
+async function cmdConnect(opts) {
+    const host = (opts.host ?? "claude-code");
+    if (host !== "claude-code") {
+        err(`✘ connect knows Claude Code today (--host claude-code); "${opts.host}" is not supported yet.`);
+        return 2;
+    }
+    try {
+        assertSafeTransport(API, true);
+    }
+    catch (e) {
+        err(`✘ ${String(e?.message ?? e).replace(/^\[decidio\] /, "")}`);
+        return 1;
+    }
+    const root = projectRoot();
+    const tty = !!(process.stdin.isTTY && process.stdout.isTTY);
+    if (CREDS_FROM === "shell" || CREDS_FROM === ".env") {
+        log(`• this project already has Decidio credentials ${CREDS_FROM === "shell" ? "from your shell" : `in ${ENV_PATH}`} for "${process.env.DECIDIO_AGENT_ID ?? defaultAgentId()}" - the hook uses those, so connect leaves them alone.`);
+        log(dim(`  To use a connection instead, remove DECIDIO_API_TOKEN / DECIDIO_AGENT_ID from ${CREDS_FROM === "shell" ? "your shell" : ENV_PATH} and run npx @decidio/sdk connect again.`));
+        return finishConnect(root, null, opts, false);
+    }
+    const existing = loadConnection(root, API);
+    if (existing && !opts.force && new Date(existing.expiresAt).getTime() > Date.now())
+        return finishConnect(root, existing, opts, false);
+    if (opts.wait)
+        return waitConnect(root, opts, false);
+    let p = readPendingConnect(root);
+    if (!p || p.host !== host || new Date(p.expiresAt).getTime() <= Date.now() + 15_000)
+        p = await startConnect(root, host);
+    if (!p)
+        return 1;
+    const opened = !opts.noBrowser && localDesktop() && openInBrowser(p.link);
+    showConnectLink(p, opened, tty);
+    if (tty) {
+        log("");
+        return waitConnect(root, opts, true);
+    }
+    log("");
+    log(`Next: allow it at the link above, then run  ${bold("npx @decidio/sdk connect --wait")}  - it finishes by itself (nothing else to type).`);
+    log(dim("Assistants: show the person the link and the code above, then run npx @decidio/sdk connect --wait."));
+    return 0;
+}
+async function waitConnect(root, opts, interactive) {
+    const p = readPendingConnect(root);
+    if (!p) {
+        const c = loadConnection(root, API);
+        if (c)
+            return finishConnect(root, c, opts, false);
+        err("✘ no connection is in progress for this project - start one: npx @decidio/sdk connect");
+        return 1;
+    }
+    const deadline = interactive ? new Date(p.expiresAt).getTime() + 5_000 : Math.min(new Date(p.expiresAt).getTime() + 5_000, Date.now() + CONNECT_WAIT_S() * 1000);
+    const spin = ["⠋", "⠙", "⠹", "⠸", "⠼", "⠴", "⠦", "⠧", "⠇", "⠏"];
+    let i = 0, misses = 0;
+    if (!interactive)
+        err(`· waiting for the connection to be allowed at ${p.link} (code ${p.code}; up to ${Math.round((deadline - Date.now()) / 1000)} s)`);
+    while (Date.now() < deadline) {
+        const r = await api("/connect/poll", { method: "POST", headers: { "x-decidio-connect-secret": p.pollSecret }, body: "{}" }, "", true);
+        if (r.status === 200 && r.body?.status === "connected" && typeof r.body.token === "string") {
+            if (interactive && TTY_OUT)
+                process.stderr.write("\r\x1b[K");
+            const c = { v: 1, api: API, root, project: p.project, host: p.host, machine: p.machine, cloud: p.cloud, agentId: String(r.body.agentId), did: p.did, key: p.key,
+                token: r.body.token, jti: String(r.body.jti), expiresAt: String(r.body.expiresAt), workspaceId: String(r.body.workspaceId), workspaceName: r.body.workspace?.name ?? null,
+                approver: r.body.approver?.name ?? null, approvedBy: r.body.approvedBy?.name ?? null, appUrl: typeof r.body.appUrl === "string" ? r.body.appUrl : null, connectedAt: new Date().toISOString() };
+            mkdirSync(connectDir(), { recursive: true });
+            try {
+                writeSecretFile(connectionFile(root), JSON.stringify(c) + "\n");
+            }
+            catch (e) {
+                err(`✘ connected, but this machine's credentials could not be written (${e?.message ?? e}) - run npx @decidio/sdk connect again (the server keeps nothing to collect twice).`);
+                return 1;
+            }
+            dropFile(pendingConnectFile(root));
+            return finishConnect(root, c, opts, true);
+        }
+        if (r.status === 403 && r.body?.status === "denied") {
+            dropFile(pendingConnectFile(root));
+            if (interactive && TTY_OUT)
+                process.stderr.write("\r\x1b[K");
+            err("✘ the connection was refused on the web (Not me). Nothing was saved.");
+            return 3;
+        }
+        if ((r.status === 404 || r.status === 410) && (r.body?.status === "expired" || r.body?.status === "collected")) {
+            dropFile(pendingConnectFile(root));
+            if (interactive && TTY_OUT)
+                process.stderr.write("\r\x1b[K");
+            err(r.body.status === "collected" ? "✘ this connection was already collected by another run - start a fresh one: npx @decidio/sdk connect" : "✘ the link expired before it was allowed - start a fresh one: npx @decidio/sdk connect");
+            return 3;
+        }
+        if (r.status === 0 && ++misses > 10) {
+            err(`✘ lost touch with Decidio at ${API} - check your connection, then run npx @decidio/sdk connect --wait again.`);
+            return 1;
+        }
+        if (interactive && TTY_OUT)
+            process.stderr.write(`\r${spin[i++ % spin.length]} waiting for you to allow it in the browser… ${dim(`(${minutesLeft(p.expiresAt)} min left · Ctrl-C stops waiting; npx @decidio/sdk connect --wait picks it up again)`)}`);
+        await new Promise((res) => setTimeout(res, (r.status === 429 ? 2 : 1) * Math.max(1, p.interval) * 1000));
+    }
+    if (interactive && TTY_OUT)
+        process.stderr.write("\r\x1b[K");
+    log(`• still waiting for it to be allowed: ${link(p.link)} (code ${p.code}, ${minutesLeft(p.expiresAt)} min left). Run  npx @decidio/sdk connect --wait  again once it is.`);
+    return 1;
+}
+async function finishConnect(root, c, opts, fresh) {
+    if (c) {
+        promoteConnection(c);
+        CREDS_FROM = "connection";
+    }
+    const cloud = inCloudSession();
+    const shared = opts.team || cloud;
+    const plugin = !cloud && decidioPluginEnabled(root);
+    if (!plugin) {
+        const rc = await cmdHookInstall({ project: shared, dir: root, quiet: true });
+        if (rc !== 0)
+            return rc;
+    }
+    const probe = await api("/agent/status/doctor-scope-probe", {}, process.env.DECIDIO_API_TOKEN, true);
+    const verified = probe.status === 404;
+    const settings = lastHookInstall ? relative(root, lastHookInstall.settingsPath).split(pathSep).join("/") || lastHookInstall.settingsPath : ".claude/settings.json";
+    const hostName = connectHostLabel(c?.host ?? "claude-code");
+    if (c) {
+        log(`✔ ${fresh ? "Connected to Decidio" : "Already connected to Decidio"}${c.workspaceName ? ` - workspace ${c.workspaceName}` : ""}${fresh && c.approvedBy ? `, allowed by ${c.approvedBy}` : ""}`);
+        log(`✔ Approvals go to ${c.approver ?? "the approver you picked"} - on the phone app, Slack, Teams or the web`);
+    }
+    if (!verified) {
+        err(probe.status === 401 || probe.status === 403
+            ? `✘ Decidio refused this connection's token (${probe.status}) - it was revoked or has expired. Reconnect: npx @decidio/sdk connect --force`
+            : `⚠ couldn't check the token just now (${probe.status || "no answer"}) - the hooks are on; a gated command will say if anything is wrong.`);
+        if (probe.status === 401 || probe.status === 403)
+            return 1;
+    }
+    const changed = !plugin && lastHookInstall && (lastHookInstall.pre !== "kept" || lastHookInstall.post !== "kept");
+    log(plugin
+        ? `✔ ${hostName} asks before destructive commands in this project (the Decidio plugin's hooks)`
+        : `✔ ${hostName} asks before destructive commands in this project (${settings})`);
+    if (changed)
+        log(dim(`  Claude Code picks the settings change up by itself - if a destructive command is not asked about, open /hooks once (or restart it).`));
+    if (c)
+        log(dim(`  Credentials: ${connectionFile(root)} (outside the repository, owner-only) · until ${c.expiresAt.slice(0, 10)}${cloud ? " · this cloud machine only - a fresh one refuses destructive commands until it connects again" : ""}`));
+    if (!plugin && (shared || process.platform === "win32") && !sameDir(realOrSame(process.cwd()), root))
+        log(dim(`  Claude Code reads ${settings} from the folder it starts in - start it at ${root}.`));
+    if (cloud && !opts.team)
+        log(`• A cloud session reads only the repository's ${settings}, so the hooks are there - not committed. Ask the person before committing it: committed, every cloud session of this repository asks too, and so does every teammate's clone (a teammate connects with npx @decidio/sdk connect).`);
+    else if (shared)
+        log(`• Commit ${settings}: every clone then asks before destructive commands (a teammate connects with npx @decidio/sdk connect).`);
+    if (fresh)
+        log(dim(`  Try it: ask ${hostName} to delete a scratch folder with rm -rf - the approval reaches ${c?.approver ?? "the approver"} on their phone.`));
+    return 0;
+}
+const DECIDIO_PLUGIN = "decidio-approvals";
+function decidioPluginEnabled(root) {
+    const home = process.platform === "win32" ? (SHELL_ENV.USERPROFILE ?? homedir()) : (SHELL_ENV.HOME ?? homedir());
+    for (const f of [joinPath(root, ".claude", "settings.local.json"), joinPath(root, ".claude", "settings.json"), joinPath(home, ".claude", "settings.json")]) {
+        const ep = readJsonQuiet(f)?.enabledPlugins;
+        if (!ep || typeof ep !== "object" || Array.isArray(ep))
+            continue;
+        const named = Object.entries(ep).find(([k]) => k.split("@")[0] === DECIDIO_PLUGIN);
+        if (named)
+            return named[1] === true;
+    }
+    return false;
+}
+async function cmdDisconnect() {
+    const root = projectRoot();
+    const c = loadConnection(root, API);
+    dropFile(pendingConnectFile(root));
+    if (!c) {
+        log("• this project isn't connected on this machine - nothing to do.");
+        return 0;
+    }
+    try {
+        writeSecretFile(connectionFile(root), JSON.stringify({ ...c, token: "", jti: "", disconnected: true }) + "\n");
+    }
+    catch (e) {
+        err(`✘ couldn't update ${connectionFile(root)} (${e?.message ?? e}) - delete it by hand to disconnect.`);
+        return 1;
+    }
+    log(`✔ disconnected this project on this machine - its token is deleted.`);
+    log(`  Destructive commands are now refused until you connect again (the hooks stay on: switching Decidio off needs a person's approval).`);
+    log(dim(`  "${c.agentId}" stays listed in Decidio until its token expires (${c.expiresAt.slice(0, 10)}); to end it now, revoke it on the Agents page${c.appUrl ? `: ${c.appUrl.replace(/\/+$/, "")}/connect/agents` : ""}.`));
+    return 0;
+}
 async function inviteApprover(email) {
     if (!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email)) {
         err(`✘ --approver needs an email address (got "${email}")`);
@@ -3683,6 +4810,303 @@ async function cmdGithubRequest(environment, justification) {
     err(`✘ Decidio refused the request (${r.status}${b.code ? ` ${b.code}` : ""}): ${String(b.error ?? "no reason given")}`);
     return 1;
 }
+const DEPLOY_MARK = { deployed: "✔", refused: "✘", blocked: "✘", stopped: "✘", failed: "✘", checks_failed: "✘", checks_unreadable: "✘", superseded: "·", expired: "·", silent: "·" };
+export function deployLines(r) {
+    const mark = DEPLOY_MARK[r.state] ?? "…";
+    const when = (r.deployedAt ?? r.requestedAt).slice(0, 16).replace("T", " ");
+    const head = `${mark} ${(r.dNumber ?? r.decisionId.slice(-6)).padEnd(8)} ${r.environment.padEnd(12)} ${r.sha.slice(0, 7)} ${r.ref ? `(${r.ref}) ` : ""}${r.line}  ${when} UTC`;
+    const out = [head];
+    if (r.checks && r.state !== "deployed")
+        out.push(`    ${r.checks}`);
+    if (r.range)
+        out.push(r.range.fromSha ? `    changed since ${r.range.fromSha.slice(0, 7)}${r.range.compareUrl ? `: ${r.range.compareUrl}` : ""} (rollback target: ${r.range.fromSha.slice(0, 7)})` : "    the first deploy through Decidio for this environment");
+    return out;
+}
+export function deployChanges(before, after) {
+    const was = new Map(before.map((r) => [r.decisionId, r]));
+    const out = [];
+    for (const r of [...after].reverse()) {
+        const p = was.get(r.decisionId);
+        const name = `${r.dNumber ?? r.decisionId.slice(-6)} ${r.environment} ${r.sha.slice(0, 7)}`;
+        if (!p)
+            out.push(`+ ${name}: ${r.line}`);
+        else if (p.line !== r.line)
+            out.push(`→ ${name}: ${p.line} → ${r.line}`);
+    }
+    return out;
+}
+async function cmdDeploys(ref, o) {
+    if (ref && !/^(D[·.-]?\d{4,}|c[a-z0-9]{20,40})$/i.test(ref)) {
+        err(`✘ "${ref}" is not a deploy's record id (D·0042) or decision id.`);
+        return 2;
+    }
+    if (o.repo && !/^[\w.-]+\/[\w.-]+$/.test(o.repo)) {
+        err(`✘ --repo takes owner/name.`);
+        return 2;
+    }
+    if (o.limit && !/^\d{1,2}$/.test(o.limit)) {
+        err(`✘ --limit takes a number from 1 to 50.`);
+        return 2;
+    }
+    if (ref && (o.watch || o.environment || o.repo || o.limit)) {
+        err(`✘ one deploy (${ref}) takes no --watch, --environment, --repo or --limit - refusing to ignore a flag you meant to matter.`);
+        return 2;
+    }
+    if (o.watch && o.json) {
+        err(`✘ --watch and --json do not go together (--json is a single read, for a script).`);
+        return 2;
+    }
+    const qs = new URLSearchParams();
+    if (o.environment)
+        qs.set("environment", o.environment);
+    if (o.repo)
+        qs.set("repository", o.repo);
+    if (o.limit)
+        qs.set("limit", o.limit);
+    const path = ref ? `/api/github/deploys/${encodeURIComponent(ref)}` : `/api/github/deploys${qs.size ? `?${qs}` : ""}`;
+    let bearer;
+    let r = await api(path);
+    if (r.status === 401 || r.status === 403) {
+        const session = await acquireSession("Reading deploys");
+        if (!session)
+            return 1;
+        bearer = session;
+        r = await api(path, {}, bearer);
+    }
+    if (r.status === 404) {
+        err(`✘ ${ref ? `no deploy "${ref}" you can read in this workspace` : "GitHub deploy approvals are not set up here"}.`);
+        return 1;
+    }
+    if (r.status !== 200) {
+        err(`✘ could not read deploys (${r.status}): ${String(r.body?.error ?? "no reason given")}`);
+        return 1;
+    }
+    if (ref) {
+        const d = r.body?.deploy;
+        if (o.json) {
+            log(JSON.stringify(d, null, 2));
+            return 0;
+        }
+        for (const l of deployLines(d))
+            log(l);
+        const s = d?.shipping;
+        if (s) {
+            log("");
+            if (s.line)
+                log(`  ${s.line}`);
+            for (const p of s.pulls ?? [])
+                log(`  #${p.number} ${s.redacted ? "pull request" : p.title}${p.author ? ` - ${p.author}` : ""} · ${p.approvedBy?.length ? `approved by ${p.approvedBy.join(", ")}` : p.approvals ? `approved on GitHub (${p.approvals})` : "no approving review on GitHub"}${p.risky?.length ? ` · ${p.risky.join(", ")}` : ""}`);
+            if (s.redacted)
+                log(dim("  titles and names are shown to the people on this request"));
+            if (s.directPushes)
+                log(`  ${s.directPushes} direct push${s.directPushes === 1 ? "" : "es"} with no pull request - files not read`);
+        }
+        log(dim(`  ${link(d.recordUrl)}${d.runUrl ? `  ·  run: ${link(d.runUrl)}` : ""}`));
+        return 0;
+    }
+    let rows = Array.isArray(r.body?.deploys) ? r.body.deploys : [];
+    if (o.json) {
+        log(JSON.stringify(rows, null, 2));
+        return 0;
+    }
+    if (!rows.length)
+        log("No deploy requests you can read yet.");
+    for (const row of rows)
+        for (const l of deployLines(row))
+            log(l);
+    if (!o.watch)
+        return 0;
+    log(dim("\nWatching for changes every 10 s - Ctrl+C to stop."));
+    for (;;) {
+        await new Promise((res) => setTimeout(res, 10_000));
+        const next = await api(path, {}, bearer, true);
+        if (next.status !== 200 || !Array.isArray(next.body?.deploys))
+            continue;
+        for (const l of deployChanges(rows, next.body.deploys))
+            log(`${new Date().toISOString().slice(11, 19)} ${l}`);
+        rows = next.body.deploys;
+    }
+}
+export function parseWhen(s, now = new Date()) {
+    if (!s)
+        return null;
+    if (s === "now")
+        return now;
+    const m = /^(\d{1,4})([mhd])$/.exec(s);
+    if (m)
+        return new Date(now.getTime() + Number(m[1]) * (m[2] === "m" ? 60_000 : m[2] === "h" ? 3_600_000 : 86_400_000));
+    return /^\d{4}-\d{2}-\d{2}/.test(s) && !Number.isNaN(Date.parse(s)) ? new Date(s) : null;
+}
+export function controlsLines(b) {
+    const t = (iso) => (iso ? iso.slice(0, 16).replace("T", " ") + " UTC" : "until lifted");
+    const out = [];
+    for (const h of b.halts ?? [])
+        out.push(`${h.inForce ? "■" : "□"} ${h.kind.padEnd(6)} ${h.id}  ${h.scope.join(", ")}  ${h.inForce ? "in force" : `from ${t(h.startsAt)}`} - ${t(h.endsAt)}  (${h.reasonWords ?? h.reason})`);
+    for (const g of b.grants ?? [])
+        out.push(`${g.state === "active" ? "▲" : "△"} grant  ${g.id}  ${g.scope.join(", ")}  ${g.state === "active" ? `active until ${t(g.endsAt)}` : `asked for (${g.minutes} min) - ${g.dNumber ?? g.decisionId}`}`);
+    if (!out.length)
+        out.push("No halts, freezes or firefighter grants in force or scheduled.");
+    return out;
+}
+async function sessionCall(purpose, path, init = {}) {
+    let r = await api(path, init);
+    if (r.status === 401 || (r.status === 403 && r.body?.code === "SIGN_IN")) {
+        const session = await acquireSession(purpose);
+        if (!session)
+            return null;
+        r = await api(path, init, session);
+    }
+    return r;
+}
+const scopeOf = (v) => (v ? v.split(",").map((s) => s.trim()).filter(Boolean) : null);
+async function cmdControls(json) {
+    const r = await sessionCall("Reading controls", "/api/controls");
+    if (!r)
+        return 1;
+    if (r.status !== 200) {
+        err(`✘ could not read controls (${r.status}): ${String(r.body?.error ?? "no reason given")}`);
+        return 1;
+    }
+    if (json) {
+        log(JSON.stringify(r.body, null, 2));
+        return 0;
+    }
+    for (const l of controlsLines(r.body))
+        log(l);
+    return 0;
+}
+async function cmdHalt(kind, o) {
+    const scope = scopeOf(o.scope);
+    if (!scope) {
+        err(`✘ ${kind} needs --scope (owner/repo, owner/repo:environment, agent:<id>, deploys or *; comma-separated).`);
+        return 2;
+    }
+    if (!o.reason) {
+        err(`✘ ${kind} needs --reason (incident, release_freeze, maintenance, security, audit or other).`);
+        return 2;
+    }
+    const now = new Date();
+    const from = kind === "freeze" ? parseWhen(o.from ?? "now", now) : null, until = parseWhen(o.until, now);
+    if ((kind === "freeze" && (!from || !until)) || (o.until && !until)) {
+        err(`✘ --from and --until take an ISO date, now, or a duration like 30m, 2h or 1d${kind === "freeze" ? " (a freeze needs both)" : ""}.`);
+        return 2;
+    }
+    const r = await sessionCall(`Setting a ${kind}`, "/api/controls/halts", { method: "POST", body: JSON.stringify({ kind, scope, reason: o.reason, startsAt: from?.toISOString() ?? null, endsAt: until?.toISOString() ?? null }) });
+    if (!r)
+        return 1;
+    if (r.status !== 201) {
+        err(`✘ ${kind} not set (${r.status}): ${String(r.body?.error ?? "no reason given")}`);
+        return 1;
+    }
+    log(`✔ ${kind} ${r.body.id} set: ${scope.join(", ")} - ${kind === "freeze" ? `from ${r.body.startsAt} ` : "now "}${r.body.endsAt ? `until ${r.body.endsAt}` : "until lifted"}. Lift it with: npx @decidio/sdk lift ${r.body.id}`);
+    return 0;
+}
+async function cmdLift(id) {
+    if (!id || !/^[a-z0-9]{10,40}$/.test(id)) {
+        err("✘ lift takes a halt's or freeze's id (npx @decidio/sdk controls lists them).");
+        return 2;
+    }
+    const r = await sessionCall("Lifting a halt", `/api/controls/halts/${encodeURIComponent(id)}/lift`, { method: "POST", body: "{}" });
+    if (!r)
+        return 1;
+    if (r.status !== 200) {
+        err(`✘ not lifted (${r.status}): ${String(r.body?.error ?? "no reason given")}`);
+        return 1;
+    }
+    log(r.body.lifted ? `✔ ${id} lifted.` : `• ${id} was already lifted or over - nothing changed.`);
+    return 0;
+}
+async function cmdFirefighter(sub, id, o) {
+    if (sub === "end") {
+        if (!id || !/^[a-z0-9]{10,40}$/.test(id)) {
+            err("✘ firefighter end takes the grant's id.");
+            return 2;
+        }
+        const r = await sessionCall("Ending a firefighter grant", `/api/firefighter/${encodeURIComponent(id)}/end`, { method: "POST", body: "{}" });
+        if (!r)
+            return 1;
+        if (r.status !== 200) {
+            err(`✘ not ended (${r.status}): ${String(r.body?.error ?? "no reason given")}`);
+            return 1;
+        }
+        log(r.body.ended ? `✔ grant ${id} ended - its close-out review follows.` : `• grant ${id} was not active - nothing changed.`);
+        return 0;
+    }
+    if (sub) {
+        err(`✘ firefighter takes --scope --minutes --reason, or: firefighter end <id>.`);
+        return 2;
+    }
+    const scope = scopeOf(o.scope), minutes = o.minutes && /^\d{1,3}$/.test(o.minutes) ? Number(o.minutes) : null;
+    if (!scope || !minutes || !o.reason) {
+        err("✘ firefighter needs --scope (systems), --minutes (15 to 240) and --reason (what is on fire).");
+        return 2;
+    }
+    const r = await sessionCall("Asking for a firefighter grant", "/api/firefighter", { method: "POST", body: JSON.stringify({ scope, minutes, reason: o.reason }) });
+    if (!r)
+        return 1;
+    if (r.status !== 201) {
+        err(`✘ not asked (${r.status}): ${String(r.body?.error ?? "no reason given")}`);
+        return 1;
+    }
+    log(`✔ firefighter grant asked for (${r.body.displayNumber ?? r.body.decisionId}): the executive role approves it - never you. Once approved it is active for ${minutes} minutes.`);
+    log(dim(`  ${link(r.body.url)}`));
+    return 0;
+}
+function originIs(repo) {
+    try {
+        const url = execFileSync("git", ["remote", "get-url", "origin"], { stdio: ["ignore", "pipe", "ignore"], encoding: "utf8", timeout: 5_000 }).trim().toLowerCase().replace(/\.git$/, "");
+        return url.endsWith(`/${repo.toLowerCase()}`) || url.endsWith(`:${repo.toLowerCase()}`);
+    }
+    catch {
+        return false;
+    }
+}
+async function cmdRollback(o) {
+    if (!o.repo || !/^[\w.-]+\/[\w.-]+$/.test(o.repo) || !o.environment || !/^[A-Za-z0-9._-]{1,64}$/.test(o.environment)) {
+        err("✘ rollback needs --repo owner/name and --environment <name>.");
+        return 2;
+    }
+    const q = `repository=${encodeURIComponent(o.repo)}&environment=${encodeURIComponent(o.environment)}`;
+    const t = await sessionCall("Asking for a rollback", `/api/github/rollback?${q}`);
+    if (!t)
+        return 1;
+    if (t.status !== 200) {
+        err(`✘ no rollback (${t.status}): ${String(t.body?.error ?? "no reason given")}`);
+        return 1;
+    }
+    const sha = String(t.body.sha), branch = String(t.body.branch);
+    if (!/^[0-9a-f]{40}$/.test(sha) || !/^decidio-rollback\/[A-Za-z0-9._-]+$/.test(branch)) {
+        err("✘ the server's rollback target is not one this CLI can push.");
+        return 1;
+    }
+    if (!o.noPush) {
+        if (!originIs(o.repo)) {
+            err(`✘ run this inside a checkout of ${o.repo}, or push the branch yourself and add --no-push:\n    ${t.body.push}`);
+            return 1;
+        }
+        const git = (args) => spawnSync("git", args, { stdio: ["ignore", "inherit", "inherit"], timeout: 120_000 });
+        if (spawnSync("git", ["cat-file", "-e", `${sha}^{commit}`], { stdio: "ignore", timeout: 10_000 }).status !== 0)
+            git(["fetch", "--quiet", "origin"]);
+        const pushed = git(["push", "origin", `${sha}:refs/heads/${branch}`]);
+        if (pushed.status !== 0) {
+            err(`✘ git could not push ${branch} - nothing was asked. Push it yourself, then: npx @decidio/sdk rollback --repo ${o.repo} --environment ${o.environment} --no-push`);
+            return 1;
+        }
+        log(dim(`  pushed ${branch} at ${sha.slice(0, 7)}`));
+    }
+    const r = await sessionCall("Asking for a rollback", "/api/github/rollback", { method: "POST", body: JSON.stringify({ repository: o.repo, environment: o.environment }) });
+    if (!r)
+        return 1;
+    if (r.status !== 201) {
+        err(`✘ no rollback (${r.status}): ${String(r.body?.error ?? "no reason given")}`);
+        return 1;
+    }
+    log(r.body.verdict === "proceed" ? `✔ rolling ${o.environment} back to ${sha.slice(0, 7)} under your firefighter grant (${r.body.displayNumber}).`
+        : r.body.verdict === "block" ? `✘ the rollback was blocked (${r.body.displayNumber}) - a halt or a policy stops it.`
+            : `✔ rollback of ${o.environment} to ${sha.slice(0, 7)} asked for (${r.body.displayNumber}) - it deploys from ${branch} once a teammate approves.`);
+    log(dim(`  ${link(r.body.url)}`));
+    return r.body.verdict === "block" ? 1 : 0;
+}
 async function cmdGithubVerify(decisionArg) {
     const decision = (decisionArg ?? process.env.DECIDIO_DECISION ?? "").trim();
     if (!GH_DECISION_RE.test(decision)) {
@@ -3718,7 +5142,7 @@ function plainRepoPath(root, rel) {
     }
     return true;
 }
-export const DECIDIO_ACTION = "OmniTwin/decidio-actions@c4506075600edef9576db821c4de756c300c15fe # v1.0.1";
+export const DECIDIO_ACTION = "OmniTwin/decidio-actions@f0b43fcb8f8ac5e15d9ad43679e333ffa7038ae2 # v1.3.1";
 export const CHECKOUT_ACTION = "actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0";
 export function githubRequestWorkflow(api, environment, branch = "main", deployWorkflow = ".github/workflows/deploy.yml") {
     return `# Written by npx @decidio/sdk github init. Asks a teammate to approve each deploy; Decidio starts the deploy workflow once
@@ -3763,13 +5187,16 @@ export function githubDeployWorkflow(api, environment) {
 # approval (once, for this commit and environment) before anything deploys. Restrict who may run it to the Decidio app in the
 # repository's workflow execution protections.
 name: Deploy
-run-name: Decidio \${{ inputs.decidio }}
+run-name: \${{ inputs.title || format('Decidio {0}', inputs.decidio) }}
 on:
   workflow_dispatch:
     inputs:
       decidio:
         description: Set by Decidio
         required: true
+      title:
+        description: Set by Decidio (the run's name - its record, environment and commit)
+        required: false
 permissions:
   id-token: write
   contents: read
@@ -3862,7 +5289,7 @@ async function cmdGithubInit(opts) {
             log(`  ${line}`);
     }
     const agentsRel = "AGENTS.md", agentsAbs = joinPath(root, agentsRel);
-    const appUrl = (process.env.DECIDIO_APP_URL || apiUrl.replace(/^https:\/\/(decidio-api\.onrender\.com|mcp\.decidioai\.com)$/, "https://app.decidioai.com")).replace(/\/$/, "");
+    const appUrl = appUrlFor(apiUrl);
     const section = agentsMdSection(appUrl);
     if (!plainRepoPath(root, agentsRel))
         err(`✘ ${agentsRel} is a symbolic link - nothing was written through it`);
@@ -3886,6 +5313,16 @@ async function cmdGithubInit(opts) {
     log(`  3. Commit the workflows and push - that push asks for nothing (it changes only these files).`);
     log(`  4. Check the connection: Check the connection in Decidio, or gh workflow run decidio-request.yml - it asks for nothing.`);
     log(`     Your next push to ${branch} asks a teammate.`);
+    const sameBox = apiUrl === API.replace(/\/$/, "");
+    log(`  5. Approve from your phone: ${sameBox ? "" : `DECIDIO_API_URL=${apiUrl} `}npx @decidio/sdk phone   ${dim("(a QR in your terminal signs it in - the Decidio lab)")}`);
+    if (sameBox && process.stdin.isTTY && process.stdout.isTTY) {
+        log("");
+        log(`  Set up your phone to approve now?   ${dim("[y/n]")}`);
+        if ((await ask("  › ")).trim().toLowerCase() === "y") {
+            log("");
+            await cmdPhone();
+        }
+    }
     return 0;
 }
 const USAGE = `✦ Decidio — the SDK command line
@@ -3927,6 +5364,12 @@ SIGN IN (once)
   npx @decidio/sdk logout              forget the stored sign-in on this computer (the token itself stays valid
                                        until it expires — there is no server-side revocation yet)
 
+YOUR PHONE
+  npx @decidio/sdk phone               put Decidio on your phone: sign in (once), then - only on your y - a QR in this
+                                       terminal signs the phone in (one time, 5 minutes). iPhone: the app opens, or the page
+                                       walks you through installing it; Android: the phone's browser. Enter = a fresh QR.
+                                       Terminal only; the Decidio lab for now (on your company's Decidio: SSO on the phone)
+
 YOUR AGENT AND ITS TOKENS
   npx @decidio/sdk init [agentId]      sign in, register the agent, mint its API token, write .env
                                        (agentId defaults to this folder's name; any name works - it is how the
@@ -3960,6 +5403,17 @@ APPROVALS AND RECEIPTS
                                        (never the receipt's own issuer field; --allow-unpinned: structural check only)
 
 CODING AGENTS (Claude Code)
+  npx @decidio/sdk connect             connect this project's coding assistant in one tap: prints a link and a short
+                                       code (a QR and the browser too, on a real terminal); the workspace owner allows
+                                       it on the web, then this machine gets an ask-only credential (kept outside the
+                                       repository) and the hooks below switch on. Your assistant can run it for you.
+  npx @decidio/sdk connect --wait      finish a connect started by an assistant: returns once it is allowed, within 90 s
+                                       (exit 0 connected · 3 refused or expired · 1 still waiting, run it again)
+                                       --team: the shared .claude/settings.json every clone reads (default: yours
+                                       alone; a cloud session reads only the shared file, so there it is always that
+                                       one) · --no-browser · --force: a fresh token for this machine
+  npx @decidio/sdk disconnect          delete this machine's connection for this project (destructive commands are then
+                                       refused until you connect again; the hooks stay on)
   npx @decidio/sdk hook install [--project] [--approver <email>] [--cli <path>]
                                        a person approves Claude Code's destructive shell commands before they run
                                        (rm -rf, git push --force, DROP TABLE, terraform apply, kubectl delete,
@@ -4015,7 +5469,7 @@ GITHUB DEPLOY APPROVALS (the Decidio GitHub App)
                                        in a repository's checkout: writes the workflow that asks for approval
                                        (.github/workflows/decidio-request.yml) and the deploy workflow when there is none
                                        (an existing one is never changed: init prints the steps to add), both using
-                                       Decidio's GitHub Action pinned to its v1.0.1 commit; adds a link to Decidio for agents to AGENTS.md (--agents-md creates it) -
+                                       Decidio's GitHub Action pinned to its v1.3.1 commit; adds a link to Decidio for agents to AGENTS.md (--agents-md creates it) -
                                        never a decision's text
   npx @decidio/sdk github request --environment <name> [--justification "<what changed>"]
                                        inside a GitHub Actions job (permissions id-token: write): ask a teammate to approve
@@ -4024,6 +5478,28 @@ GITHUB DEPLOY APPROVALS (the Decidio GitHub App)
                                        commit and environment, and writes sha= to $GITHUB_OUTPUT; anything else exits 1 -
                                        do not deploy (DECIDIO_DECISION carries the decidio input)
 
+  npx @decidio/sdk deploys [D·0042] [--environment <name>] [--repo <owner/name>] [--limit N] [--watch] [--json]
+                                       what's deployed where: the recent deploy requests you may read, each with the words its
+                                       commit shows on GitHub; a deployed one names the previous deployed commit and a compare
+                                       link - what that deploy changed, and the rollback target; one deploy (its D-number) adds
+                                       the pull requests it shipped and who approved them; --watch follows changes
+
+EMERGENCY CONTROLS
+  npx @decidio/sdk controls [--json]    the halts, freezes and firefighter grants in force or scheduled
+  npx @decidio/sdk halt --scope <systems> --reason <incident|release_freeze|maintenance|security|audit|other> [--until 2h|ISO]
+                                       stop everything in scope now (owner/repo, owner/repo:environment, agent:<id>, deploys, *)
+                                       - the workspace owner or the executive role only; until lifted unless --until
+  npx @decidio/sdk freeze --scope <systems> --reason <...> --from now|ISO --until 2d|ISO
+                                       a change freeze for a window (a halt scheduled ahead)
+  npx @decidio/sdk lift <id>           lift a halt or end a freeze now
+  npx @decidio/sdk firefighter --scope <systems> --minutes <15-240> --reason "<what is on fire>"
+                                       ask for break-glass authority: the executive role approves it (never you); while active,
+                                       your own requests to those systems go ahead and are reviewed when it ends
+  npx @decidio/sdk firefighter end <id>   end your grant early
+  npx @decidio/sdk rollback --repo <owner/name> --environment <name> [--no-push]
+                                       ask to deploy the environment's previous approved commit (approved like any deploy):
+                                       run it in a checkout - your git pushes a branch at that commit, the deploy runs there
+
 DEVELOPMENT
   npx @decidio/sdk dev [--target URL] [--port N]   local relay for the resume webhook
   npx @decidio/sdk --version           print the CLI version
@@ -4042,7 +5518,8 @@ NOTES
   Exit codes: 0 success · 1 failure or honest no-op (e.g. replay refused) · 2 usage error ·
   3 quickstart stopped at the human moment (headless: routed, but nothing executed and no
   receipt written — pass --auto-approve-demo for a run that completes unattended), or
-  hook wait: the approver said no. hook pretool/posttool always exit 0 (their answer is the JSON).
+  hook wait: the approver said no, or connect --wait: the connection was refused or expired (1 there: still
+  waiting - run it again). hook pretool/posttool always exit 0 (their answer is the JSON).
   Errors, and usage shown on ERROR paths, go to stderr; stdout carries results only (safe to
   pipe). Asked-for help — including this bare invocation — IS a result, so it prints here.
   Docs: the README that shipped with this package — node_modules/@decidio/sdk/README.md
@@ -4159,6 +5636,8 @@ async function main(argv) {
             return pick.code;
         if (pick.kind === "logout")
             return cmdLogout();
+        if (pick.kind === "phone")
+            return cmdPhone();
         if (pick.kind === "init")
             return cmdInit(pick.agentId, {});
         return cmdQuickstart({ demo: pick.kind === "demo" });
@@ -4180,7 +5659,10 @@ async function main(argv) {
         quickstart: { flags: ["--explain", "--auto-approve-demo", "--keep-agent", "--demo"], valued: ["--phone"] },
         login: { flags: [] },
         logout: { flags: [] },
+        phone: { flags: [] },
         init: { flags: ["--unique", "--force"], valued: ["--expires-days"] },
+        connect: { flags: ["--wait", "--no-browser", "--team", "--force"], valued: ["--host"] },
+        disconnect: { flags: [] },
         doctor: { flags: [] },
         approvals: { flags: ["--json", "--mine"], valued: ["--reason"] },
         receipt: { flags: ["--json"] },
@@ -4189,6 +5671,13 @@ async function main(argv) {
         dev: { flags: [], valued: ["--target", "--port"] },
         hook: { flags: ["--project"], valued: ["--timeout", "--approver", "--cli"] },
         github: { flags: ["--agents-md"], valued: ["--environment", "--justification", "--decision", "--workflow", "--api"] },
+        deploys: { flags: ["--watch", "--json"], valued: ["--environment", "--repo", "--limit"] },
+        controls: { flags: ["--json"] },
+        halt: { flags: [], valued: ["--scope", "--reason", "--until"] },
+        freeze: { flags: [], valued: ["--scope", "--reason", "--from", "--until"] },
+        lift: { flags: [] },
+        firefighter: { flags: [], valued: ["--scope", "--minutes", "--reason"] },
+        rollback: { flags: ["--no-push"], valued: ["--repo", "--environment"] },
         decisions: { flags: ["--dry-run"], valued: ["--adr"] },
     };
     const spec = KNOWN[cmd];
@@ -4223,7 +5712,7 @@ async function main(argv) {
                 return 2;
             }
         }
-        const MAX_POS = { login: 1, logout: 0, quickstart: 1, init: 1, doctor: 0, receipt: 1, tokens: 2, dev: 0, hook: 2, github: 1, decisions: 1 };
+        const MAX_POS = { login: 1, logout: 0, phone: 0, quickstart: 1, init: 1, connect: 0, disconnect: 0, doctor: 0, receipt: 1, tokens: 2, dev: 0, hook: 2, github: 1, decisions: 1 };
         const exemptTail = (cmd === "approvals" && (positionals[0] === "approve" || positionals[0] === "reject")) || (cmd === "hook" && positionals[0] === "justify") || cmd === "verify";
         if (!exemptTail && cmd === "approvals" && positionals.length > 0) {
             err(`✘ unknown approvals subcommand "${positionals[0]}" — use approve or reject (or no subcommand to list).`);
@@ -4248,6 +5737,7 @@ async function main(argv) {
     switch (cmd) {
         case "login": return cmdLogin(argsIn.find((x) => !x.startsWith("-")));
         case "logout": return cmdLogout();
+        case "phone": return cmdPhone();
         case "quickstart": {
             if (argsIn.includes("cleanup")) {
                 const envFile = existsSync(".env.quickstart") ? ".env.quickstart"
@@ -4380,6 +5870,8 @@ async function main(argv) {
             }
             return cmdContext(sub, pos.slice(1), { title: valuedOpt(argsIn, "--title"), trigger: valuedOpt(argsIn, "--trigger"), team: valuedOpt(argsIn, "--team"), unit: valuedOpt(argsIn, "--unit"), org: argsIn.includes("--org"), here: argsIn.includes("--here"), pack: valuedOpt(argsIn, "--pack"), chatgpt: argsIn.includes("--chatgpt"), json: argsIn.includes("--json") });
         }
+        case "connect": return cmdConnect({ wait: argsIn.includes("--wait"), host: valuedOpt(argsIn, "--host"), noBrowser: argsIn.includes("--no-browser"), team: argsIn.includes("--team"), force: argsIn.includes("--force") });
+        case "disconnect": return cmdDisconnect();
         case "hook": {
             const VALUED = ["--timeout", "--approver", "--cli"];
             const pos = argsIn.filter((x, i) => !x.startsWith("-") && !VALUED.includes(argsIn[i - 1] ?? ""));
@@ -4412,6 +5904,31 @@ async function main(argv) {
                     return 2;
             }
         }
+        case "deploys": {
+            const VALUED = ["--environment", "--repo", "--limit"];
+            const pos = argsIn.filter((x, i) => !x.startsWith("-") && !VALUED.includes(argsIn[i - 1] ?? ""));
+            if (pos.length > 1) {
+                err(`✘ deploys takes at most one deploy id.\n\n${USAGE}`);
+                return 2;
+            }
+            return cmdDeploys(pos[0], { environment: valuedOpt(argsIn, "--environment"), repo: valuedOpt(argsIn, "--repo"), limit: valuedOpt(argsIn, "--limit"), watch: argsIn.includes("--watch"), json: argsIn.includes("--json") });
+        }
+        case "controls": return cmdControls(argsIn.includes("--json"));
+        case "halt":
+        case "freeze": {
+            if (argsIn.some((x, i) => !x.startsWith("-") && !["--scope", "--reason", "--until", "--from"].includes(argsIn[i - 1] ?? ""))) {
+                err(`✘ ${cmd} takes only flags.\n\n${USAGE}`);
+                return 2;
+            }
+            return cmdHalt(cmd, { scope: valuedOpt(argsIn, "--scope"), reason: valuedOpt(argsIn, "--reason"), from: valuedOpt(argsIn, "--from"), until: valuedOpt(argsIn, "--until") });
+        }
+        case "lift": return cmdLift(argsIn.find((x) => !x.startsWith("-")));
+        case "firefighter": {
+            const VALUED = ["--scope", "--minutes", "--reason"];
+            const pos = argsIn.filter((x, i) => !x.startsWith("-") && !VALUED.includes(argsIn[i - 1] ?? ""));
+            return cmdFirefighter(pos[0], pos[1], { scope: valuedOpt(argsIn, "--scope"), minutes: valuedOpt(argsIn, "--minutes"), reason: valuedOpt(argsIn, "--reason") });
+        }
+        case "rollback": return cmdRollback({ repo: valuedOpt(argsIn, "--repo"), environment: valuedOpt(argsIn, "--environment"), noPush: argsIn.includes("--no-push") });
         case "decisions": {
             const sub = argsIn.find((x, i) => !x.startsWith("-") && argsIn[i - 1] !== "--adr");
             if (sub !== "import") {