@decidio/sdk 0.9.0 → 0.11.0

package/CHANGELOG.md

@@ -5,6 +5,89 @@ the gate, signing, receipts and the verifier - is conformance-locked between the
 first-run surfaces (the fork, `--demo`, the code sign-in) are TypeScript-first and named as such in the parity
 allowlist. Each entry names what changed, what a reader must do on upgrade, and what proved it.
 
+## Unreleased
+
+## 0.11.0 — connect once, on in every project; no surprises; the connector connects a computer
+
+0.10.0 was never published (its tag was held for this release), so 0.11.0 is the first release with `connect`. It carries
+cycle connect-once's slice 1, 2a and 2b (founder 2026-10-29: one tag, after they merge).
+
+- **One connect per computer.** A connection now covers every repository on the computer, and `connect` switches the hook
+  on in your own `~/.claude/settings.json`, which every project reads. A repository connected the 0.10.0 way keeps its own
+  connection (read first). A cloud session and `--team` still use the repository's `.claude/settings.json`.
+- **The hook connects the computer itself.** A destructive command on a computer with no credential is refused with a link
+  and a short code (to Claude, and in a line to the person); once the workspace owner allows it, the next try finishes
+  connecting and asks for the approval in the same run. It never writes Claude Code's settings - in auto mode the assistant
+  may not, and a person put the hook there. Two hooks at once share one link. It connects only the Decidio your shell
+  names (or the default), never one a repository's `.env` names, and only over HTTPS; a project whose `.env` names an agent
+  with no token is refused by name rather than given the computer's connection. The run that connects tells the person which
+  workspace and who allowed it, even when the command then runs at once.
+- **The computer-wide hook is the pinned `npx -y @decidio/sdk@0.11.0` command**, so it works in every project; a project
+  install still writes `$CLAUDE_PROJECT_DIR` unescaped, so Claude Code expands it. The settings file is written whole, and
+  through a symlink.
+- **No surprises** (founder 2026-10-29: "the user is fully aware and not surprised"):
+  - `hook session`, a SessionStart hook: every session opens with one line - approvals are on here, what waits and for whom,
+    or that this computer isn't connected yet. Local only, never blocks;
+  - `connect` says what waits for approval and that everything else runs as before;
+  - a held command names who approves and where they see it;
+  - the plugin skill says what connecting does before doing it, and has the person run `! npx @decidio/sdk connect` when
+    auto mode refuses it.
+- **The plugin** (0.5.0) carries the SessionStart hook, and a marketplace file ready to publish - not published (founder:
+  nothing public until the listing is ready).
+- **The connector connects a computer** (slice 2a):
+  - `connect --ticket <ticket>` finishes the link the Decidio connector allowed (`connect_device` returns the ticket): the
+    poll carries this computer's own secret and the ticket, and only the credential is written;
+  - the hook names the connector's way first when a computer isn't connected (call `connect_device` with the code, run what
+    it returns), then the link and code; a link the connector allowed is kept while it waits for its ticket.
+- **Pause and resume** (slice 2b): `hook prompt`, a UserPromptSubmit hook that `hook install`, `connect` and the plugin add
+  behind a shell pre-filter, acts on the person's own typed "decidio pause" / "decidio start" (exact words, `source: user`
+  only) and keeps the words from the model. While paused a gated command runs with a line and no decision - asked of Decidio only
+  in a session paused on this computer; the settings guard (now run over the whole line, inside `sh -c` too, for the pause and
+  the shared file's notice alike) and the self-decide refusal stay on; an agent running `hook prompt` itself is refused. The
+  session line says how to pause, or that the organisation keeps the guard on.
+- **A shared file tells, then lets through** (slice 2a): `hook pretool --unconnected=tell`, which `connect` writes into a
+  shared file, refuses a computer with no credential once per session and command, then lets the same call pass with a line
+  to the person - never an `allow`, so Claude Code's own permission check still decides. No flag, a value it doesn't know,
+  or no session id holds, as before. `connect --team --hold-everyone` writes the holding hook instead.
+
+On upgrade: nothing to do; 0.10.0 repository connections keep working. Proved by: cli-smoke.ts (378 -> 400; slice 1: one connect for
+two repositories, the 0.10.0 file read first, the hook's own link - wait - collect-then-ask without touching settings, two
+hooks sharing a link, a refused link, the approver in holds, the session line, SessionStart installed; slice 2a: the
+connector's way, the ticket's usage, secret and ticket on the poll, tell once then a line, hold by default, --hold-everyone).
+
+## 0.10.0 — connect a coding assistant in one tap (not published; folded into 0.11.0)
+
+- **`npx @decidio/sdk connect`** (cycle connect). A coding assistant sets Decidio up for you: it runs `connect`, which prints a
+  link and a short code (on a real terminal also a QR, and it opens the browser); the workspace owner opens the link signed in,
+  checks the code, picks who approves and taps Allow; `connect --wait` then returns by itself (exit 0 connected, 1 still
+  waiting - run it again, 3 refused or expired; within 90 s, under an assistant's 2-minute command limit). The machine gets an
+  ask-only credential - never a session - kept OUTSIDE the repository (the config dir, owner-only, keyed by the repository root
+  and the Decidio), and the hooks switch on in `.claude/settings.local.json` (`--team`: the shared `.claude/settings.json`).
+  No `.env`, nothing to paste, the word "agent" nowhere in the setup.
+- **In a cloud session the hooks go in `.claude/settings.json`.** A cloud session reads the repository's files, not your
+  computer's, and only the committed shared file reaches the next cloud machine, so that is where they go. connect leaves it uncommitted and says to ask
+  the person before committing it (committed, every cloud session of the repository and every teammate's clone ask too). The
+  credential is that cloud machine's: a fresh one refuses destructive commands until it connects again.
+- **The machine proves its key.** The start is signed with the machine's own key (the request-bound proof every signed
+  request carries, over the assistant, project, machine and cloud-or-local), so nobody can file a connect in another
+  machine's name; the server refuses a start without it. The connect checks the wire first (https, or a local address),
+  since the poll's answer carries the credential.
+- **Credentials, in order:** the shell, then the folder's `.env`, then this repository's connection - all or nothing, so a
+  project with an `init` `.env` keeps exactly that identity. `disconnect` deletes this machine's token (gated commands are then
+  refused until you connect again; the machine's key stays, so reconnecting reuses its agent).
+- **The hook's words** for an unconnected project now name `connect` and `connect --wait` (the plugin's skill says the same);
+  `hook install` with no credentials points at `connect` first.
+- **The links the command line prints follow the API's own web app** (launch plan L1c). Staging's API maps to
+  `staging.decidioai.com`, production's (`mcp.decidioai.com`) to `app.decidioai.com`, and any other origin to itself.
+  `DECIDIO_APP_URL` wins only as a plain `http(s)` address, and the host line names it.
+  - **Release condition:** publish only after `staging.decidioai.com` serves staging's web app (docs/Deployment_Runbook.md
+    A1). Tell testers to run `github init` again to refresh their AGENTS.md section.
+
+On upgrade: nothing to change - `init` projects keep their `.env`. The plugin pins 0.10.0. `connect` needs a Decidio that
+serves `/connect/*` (the lab, from cycle connect's deploy). Proved by: cli-smoke.ts (356 → 378 checks: connect, its signed
+start, wait, reconnect, disconnect, refused, expired, a cloud session, --team, beside the plugin, .env precedence, the hook
+through a connection).
+
 ## 0.9.0 — the coding-agent hook catches what agents type, protects itself, and tells the approver what was asked
 
 - **Wider matching, from real agent runs.** `sql-destructive` counts a statement sent through an interpreter or runner

package/README.md

@@ -75,8 +75,8 @@ npx @decidio/sdk init --unique my-agent   # --unique appends a random suffix: co
 Every network command talks to the hosted sandbox by default (`verify` is offline) and announces its target host on
 stderr each run — set `DECIDIO_API_URL` (env or `.env`) to point at another Decidio instead.
 
-`init` signs you into your workspace (email + password, or the 8-character code the CLI emails you —
-type it where you asked), generates the agent's Ed25519 keypair **locally** (only the public `did:key`
+`init` signs you into your workspace (the 8-character code the CLI emails you — type it where you asked —
+or, for an account made before sign-up became passwordless, its email + password), generates the agent's Ed25519 keypair **locally** (only the public `did:key`
 is sent), registers the agent, mints its **floor-limited API token** (limited to the agent runtime — request authorization, poll status, report signed confirmation; it cannot administer the workspace or approve anything — and your workspace session never touches the agent's disk), and writes `.env`.
 Every later command that talks to Decidio reads `.env` from this directory automatically (`verify` is
 offline and never does). Re-running init for an

package/dist/cli.d.ts

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+export declare function appUrlFor(api: string, override?: string | undefined): string;
 export type ApprovalAnswer = "approve" | "reject" | "again";
 export declare function approvalAnswer(answer: unknown): ApprovalAnswer;
 /** The issuer store's key for a Decidio address: its origin (scheme + lowercased host + non-default port), computed by a
@@ -17,6 +18,8 @@ export declare function defaultAgentId(dir?: string): string;
  *  distinct decision ids can never share a file (first-run review of 0.4.1: dots were STRIPPED, `a.b` and `ab`
  *  collided). `~` is outside the allowed set, so the escape is unambiguous. Exported for the smokes. */
 export declare function receiptFileName(id: string): string;
+/** Exactly what the person types to pause or resume the guard - nothing else is read. PURE. */
+export declare function guardWords(prompt: unknown): "pause" | "start" | null;
 /** Scoped packs (GitHub App design §2): a pack's scope in words - the organisation's, a unit's (its type, and its name when
  *  the server sent one: names that fail its person check are withheld there), or the reader's own. Null for an older server. */
 export declare function packScopeLabel(scope: any): string | null;