@decidio/sdk 0.9.0 → 0.11.0

package/dist/cli.js

@@ -1,16 +1,16 @@
 #!/usr/bin/env node
 import { readFileSync, writeFileSync, existsSync, appendFileSync, chmodSync, rmSync, rmdirSync, openSync, writeSync, fsyncSync, closeSync, renameSync, mkdirSync, mkdtempSync, readdirSync, copyFileSync, statSync, lstatSync, fstatSync, readSync } from "node:fs";
 import { randomBytes, createHash } from "node:crypto";
-import { homedir, tmpdir } from "node:os";
+import { homedir, tmpdir, hostname } from "node:os";
 import { join as joinPath, resolve as resolvePath, sep as pathSep, basename, dirname, relative, isAbsolute } from "node:path";
 import { createServer } from "node:http";
 import { isIP } from "node:net";
-import { execFileSync, spawnSync } from "node:child_process";
+import { execFileSync, spawnSync, spawn } from "node:child_process";
 import { createInterface } from "node:readline";
 import { pathToFileURL as toFileUrl, fileURLToPath as fromFileUrl } from "node:url";
 import { realpathSync as realPath } from "node:fs";
 import { createRequire } from "node:module";
-import { generateKeypair, assertSafeTransport, redactUrl } from "./signing.js";
+import { generateKeypair, assertSafeTransport, redactUrl, signBoundProof } from "./signing.js";
 import { hardenFile } from "./resume.js";
 import { withApproval, DecidioRateLimitError, DecidioRejectedError, DecidioTimeoutError, DecidioHttpError, didFromPrivateKey, checkApproval, signConfirm, buildConfirmBody, readConfirmResponse, bindingMaterial, boundScope, idempotencyKey, decisionUrl, decisionIdProblem } from "./index.js";
 import { gateAuthorizeTwinAware, adapterRequest } from "./adapters/_gate.js";
@@ -76,6 +76,22 @@ if (!OFFLINE_CMD)
     }
 const DEFAULT_API = "https://decidio-api.onrender.com";
 let API = (process.env.DECIDIO_API_URL ?? DEFAULT_API).replace(/\/$/, "");
+const COMPUTER = "*";
+const EVERY_PROJECT = "every project";
+let CONNECTED_APPROVER = null;
+let CONNECTED_UNANSWERED = false;
+let CONNECTED_APP_URL = null;
+let CONNECTED_WORKSPACE = null;
+let GUARD_PAUSABLE = true;
+let connectNotice = null;
+let CREDS_FROM = SHELL_ENV.DECIDIO_API_TOKEN ? "shell" : process.env.DECIDIO_API_TOKEN ? ".env" : null;
+if (!OFFLINE_CMD && !["init", "quickstart", "login", "logout", "phone"].includes(ARGV_TAIL[0] ?? "") && !process.env.DECIDIO_API_TOKEN && !process.env.DECIDIO_AGENT_ID) {
+    const c = activeConnection(projectRoot(), API);
+    if (c) {
+        promoteConnection(c);
+        CREDS_FROM = "connection";
+    }
+}
 let DEMO = false;
 function enterDemo(url) { API = url; process.env.DECIDIO_API_URL = url; DEMO = true; }
 const pinWords = () => (DEMO ? "PINNED to this demo's own key" : "PINNED to your workspace issuer");
@@ -90,7 +106,7 @@ let hostAnnounced = false;
 async function api(path, init = {}, bearer, soft = false) {
     if (!hostAnnounced) {
         hostAnnounced = true;
-        err(`· decidio → ${API}${process.env.DECIDIO_API_URL ? "" : "  (default: the hosted sandbox — set DECIDIO_API_URL to point elsewhere)"}`);
+        err(`· decidio → ${API}${process.env.DECIDIO_API_URL ? "" : "  (default: the hosted sandbox — set DECIDIO_API_URL to point elsewhere)"}${APP_URL_OVERRIDDEN ? `  · links → ${APP_URL} (DECIDIO_APP_URL)` : ""}`);
     }
     const auth = bearer ?? TOKEN();
     if (auth && envUnreadable && !process.env.DECIDIO_API_URL) {
@@ -462,7 +478,24 @@ function block(n, title, rows, tone) {
     }
     log(f("└" + "─".repeat(width - 2) + "┘"));
 }
-const APP_URL = API.replace("decidio-api.onrender.com", "app.decidioai.com");
+const APP_URL_SHAPE = /^https?:\/\/[\x21-\x7e]+$/;
+const asciiTrim = (v) => v.replace(/^[ \t\r\n]+|[ \t\r\n]+$/g, "");
+export function appUrlFor(api, override = process.env.DECIDIO_APP_URL) {
+    const o = asciiTrim(override ?? "");
+    if (APP_URL_SHAPE.test(o))
+        return o.replace(/\/+$/, "");
+    const base = api.replace(/\/+$/, "");
+    const known = {
+        "https://decidio-api.onrender.com": "https://staging.decidioai.com",
+        "https://mcp-staging.decidioai.com": "https://staging.decidioai.com",
+        "https://mcp.decidioai.com": "https://app.decidioai.com",
+    };
+    return known[base] ?? base;
+}
+const APP_URL = appUrlFor(API);
+const APP_URL_OVERRIDDEN = APP_URL !== appUrlFor(API, "");
+if (asciiTrim(process.env.DECIDIO_APP_URL ?? "") && !APP_URL_SHAPE.test(asciiTrim(process.env.DECIDIO_APP_URL ?? "")))
+    console.error("⚠ ignoring DECIDIO_APP_URL: it must be a plain http(s) address (printable characters only)");
 let stdinReadAbandoned = false;
 let EXPLAIN = false;
 let currentRl = null;
@@ -2739,6 +2772,14 @@ function hookMatch(command, at, rules = [...HOOK_RULES, ...hookExtraRules()], de
         }
     return null;
 }
+function hookEditsGuard(command, at) {
+    try {
+        return !!hookMatch(command, at, HOOK_RULES.filter((r) => r.category === "decidio-guard"));
+    }
+    catch {
+        return true;
+    }
+}
 function hookSelfDecides(command, depth = 0) {
     const hit = hookSegments(command).some((s) => {
         const a = s.args.map((x) => x.replace(/^["']|["']$/g, ""));
@@ -3013,7 +3054,7 @@ function hookSubject(category, segs, cwdAbs, projectDir, at) {
     }
     return textOnly("text binds this category");
 }
-const hookIsOurs = (h) => typeof h?.command === "string" && /\bhook (pretool|posttool)\b/.test(h.command) && /decidio|cli\.(js|ts)/.test(h.command);
+const hookIsOurs = (h) => typeof h?.command === "string" && /\bhook (pretool|posttool|session|prompt)\b/.test(h.command) && /decidio|cli\.(js|ts)/.test(h.command);
 const hookSorted = (v) => Array.isArray(v) ? v.map(hookSorted) : v && typeof v === "object" ? Object.fromEntries(Object.keys(v).sort().map((k) => [k, hookSorted(v[k])])) : v;
 function hookOurHandlers(settings) {
     const out = [];
@@ -3263,11 +3304,11 @@ async function readHookStdin() {
 function hookConfig() {
     const token = process.env.DECIDIO_API_TOKEN;
     if (!token)
-        return { missing: "DECIDIO_API_TOKEN is not set - no agent token in this folder's .env or the environment" };
+        return { missing: "this project is not connected to Decidio (no connection, no agent token in this folder's .env or the environment)" };
     return {
         apiUrl: API, agentId: process.env.DECIDIO_AGENT_ID || defaultAgentId(), apiToken: token, sourceSystem: "claude-code",
         agentKey: process.env.DECIDIO_AGENT_KEY || undefined, agentDid: process.env.DECIDIO_AGENT_DID || undefined, workspaceId: process.env.DECIDIO_WORKSPACE_ID || undefined,
-        appUrl: process.env.DECIDIO_APP_URL || APP_URL,
+        appUrl: APP_URL,
     };
 }
 const hookStateDir = () => (process.env.CLAUDE_PLUGIN_DATA ? joinPath(process.env.CLAUDE_PLUGIN_DATA, "hooks") : joinPath(sessionDir(), "hooks"));
@@ -3373,8 +3414,91 @@ async function hookHold(cfg, decisionId, holdMs) {
     }
     return { status, lastError };
 }
-async function cmdHookPretool() {
-    const out = (o) => { process.stdout.write(JSON.stringify(o) + "\n"); return 0; };
+const ORGANISATION_KEEPS_ON = "Your organisation keeps Decidio on for every session.";
+const GUARD_PAUSE_HOURS = 12;
+export function guardWords(prompt) {
+    const m = typeof prompt === "string" ? /^\s*decidio\s+(pause|start)\s*[.!]?\s*$/i.exec(prompt) : null;
+    return m ? m[1].toLowerCase() : null;
+}
+const guardSessionKey = (material, session) => idempotencyKey(material, { purpose: "guard-pause", host: "claude-code", session });
+async function cmdHookPrompt() {
+    const block = (reason) => { process.stdout.write(JSON.stringify({ decision: "block", reason }) + "\n"); return 0; };
+    let action = null;
+    try {
+        const read = await readHookStdin();
+        if (!read.ok)
+            return 0;
+        const input = read.input;
+        action = guardWords(input.prompt);
+        if (!action)
+            return 0;
+        const not = action === "pause" ? "the guard stays on" : "nothing changed";
+        if (input.source !== "user")
+            return block(`Decidio: "decidio ${action}" works only on a prompt you type yourself - ${not}.`);
+        const session = typeof input.session_id === "string" ? input.session_id : "";
+        if (!session)
+            return block(`Decidio: this session has no id to pause the guard for - ${not}.`);
+        const cfg = hookConfig();
+        if ("missing" in cfg)
+            return block(`Decidio isn't connected on this computer, so there is no guard to ${action === "pause" ? "pause" : "resume"} here.`);
+        const material = bindingMaterial(cfg);
+        if (!material)
+            return block(`Decidio: this computer's credential can't key the pause - ${not}. Ask the person to run npx @decidio/sdk doctor.`);
+        assertSafeTransport(cfg.apiUrl, true);
+        const r = await fetch(cfg.apiUrl.replace(/\/$/, "") + "/agent/guard", { method: "POST", headers: { "content-type": "application/json", authorization: `Bearer ${cfg.apiToken}` },
+            body: JSON.stringify({ session: guardSessionKey(material, session), action }), signal: AbortSignal.timeout(10_000) });
+        const body = await r.json().catch(() => null);
+        if (r.status === 403 && body?.code === "ORGANISATION_KEEPS_ON") {
+            notePause(session, false);
+            return block(ORGANISATION_KEEPS_ON);
+        }
+        if (r.ok && body?.state === "paused") {
+            notePause(session, true);
+            return block(`Decidio guard paused for this session: destructive commands run without a person's approval - each one is recorded in your workspace's audit log - until you type "decidio start" (or for ${GUARD_PAUSE_HOURS} hours). Decidio still asks before a command edits Claude Code's settings to switch its check off.`);
+        }
+        if (r.ok && body?.state === "on") {
+            notePause(session, false);
+            return block(body.resumed ? "Decidio guard is back on for this session." : "Decidio guard is on for this session (it wasn't paused).");
+        }
+        return block(`Decidio couldn't ${action} the guard just now (${r.status}) - ${action === "pause" ? "it stays on" : "if it was paused, type \"decidio start\" again"}.`);
+    }
+    catch (e) {
+        if (!action)
+            return 0;
+        return block(`Decidio couldn't ${action} the guard just now (${String(e?.message ?? e).replace(/^\[decidio\] /, "").slice(0, 160)}) - ${action === "pause" ? "it stays on" : "if it was paused, type \"decidio start\" again"}.`);
+    }
+}
+function hookForgesPrompt(command, depth = 0) {
+    const hit = hookSegments(command).some((s) => {
+        const a = s.args.map((x) => x.replace(/^["']|["']$/g, ""));
+        const cli = (x) => /^@decidio\/sdk(@\S+)?$/i.test(x) || /^decidio(@\S+)?$/i.test(x) || /(^|[\\/])(decidio-guard|@decidio[\\/]sdk)[\\/](dist[\\/])?cli\.(js|ts)$/i.test(x);
+        const runsCli = s.program === "decidio" || s.program === "decidio.js"
+            || ((["npx", "pnpx", "bunx", "npm", "pnpm", "yarn", "bun", "node", "tsx", "uv", "uvx", "pipx"].includes(s.program) || /^python[0-9.]*$/.test(s.program)) && a.some(cli));
+        const i = a.indexOf("hook");
+        return runsCli && i >= 0 && a.slice(i + 1).some((x) => x.toLowerCase() === "prompt");
+    });
+    return hit || (depth < 2 && hookShellInner(command).some((c) => hookForgesPrompt(c, depth + 1)));
+}
+function cmdHookSession() {
+    try {
+        const cfg = hookConfig();
+        const msg = "missing" in cfg
+            ? "Decidio approvals are on here, but this computer isn't connected yet - the first destructive command shows a link to connect it (once, for every project on this computer)."
+            : `Decidio guard is on for this session${CONNECTED_WORKSPACE ? ` (workspace ${CONNECTED_WORKSPACE})` : ""}: deleting files, force-pushing, dropping tables, infrastructure changes and publishing wait for ${CONNECTED_APPROVER ?? "a person"}'s OK; everything else runs as usual. `
+                + (GUARD_PAUSABLE ? `Type "decidio pause" to pause it for this session, "decidio start" to resume.` : ORGANISATION_KEEPS_ON);
+        process.stdout.write(JSON.stringify({ systemMessage: msg, hookSpecificOutput: { hookEventName: "SessionStart",
+                additionalContext: "Decidio's hook asks a person before destructive shell commands in this project. When it refuses one, tell the user what its message says (who must approve, or the link that connects this computer) and follow it; never work around it." } }) + "\n");
+    }
+    catch { }
+    return 0;
+}
+async function cmdHookPretool(opts = { unconnected: "hold" }) {
+    const out = (o) => {
+        if (connectNotice)
+            o = { ...o, systemMessage: o?.systemMessage ? `${connectNotice} ${o.systemMessage}` : connectNotice };
+        process.stdout.write(JSON.stringify(o) + "\n");
+        return 0;
+    };
     const deny = (reason, user) => out({ hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "deny", permissionDecisionReason: reason }, ...(user ? { systemMessage: user } : {}) });
     const allow = (reason) => out({ hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "allow", permissionDecisionReason: reason } });
     try {
@@ -3391,6 +3515,8 @@ async function cmdHookPretool() {
             const command = typeof input.tool_input?.command === "string" ? input.tool_input.command : "";
             if (!command.trim())
                 return 0;
+            if (hookForgesPrompt(command))
+                return deny("Decidio: an agent can't pause or resume Decidio's guard - only the person does, by typing \"decidio pause\" or \"decidio start\" themselves. Nothing ran. Tell the user if they want it paused.");
             if (hookSelfDecides(command))
                 return deny("Decidio: an agent can't decide an approval - `approvals approve|reject` is the person's, and the person decides on their phone, the web app, Slack or Teams. Nothing ran. Tell the user which decision is waiting; never try another way to decide it.", "Decidio: the agent tried to decide an approval - refused");
             const segs = hookSegments(command);
@@ -3410,7 +3536,8 @@ async function cmdHookPretool() {
             const canonical = command.replace(/\s+/g, " ").trim();
             const base = hookSubject(rule.category, segs, cwdAbs, projectDir, at);
             const subject = followed ? { fingerprint: `${base.fingerprint ?? ""}\nfile:${followed.rel}:${followed.sha}`, display: followed.rel } : base;
-            g = { category: rule.category, isFile: false, text: canonical, binding: canonical + "\n" + (subject.fingerprint ?? ""), subject, identity: { command: canonical, subject: subject.fingerprint ?? "" }, segs,
+            const offSwitch = rule.category === "decidio-guard" || hookEditsGuard(command, at);
+            g = { category: rule.category, isFile: false, text: canonical, binding: canonical + "\n" + (subject.fingerprint ?? ""), subject, identity: { command: canonical, subject: subject.fingerprint ?? "" }, segs, offSwitch,
                 ...(followed ? { scriptLine: hookRedact(`${followed.rel}:${followed.line}: ${followed.text.replace(/\s+/g, " ").trim()}`).slice(0, 160) } : {}) };
         }
         else if (tool === "Write" || tool === "Edit" || tool === "MultiEdit") {
@@ -3418,7 +3545,7 @@ async function cmdHookPretool() {
             if (!fc)
                 return 0;
             const what = fc.changes.join("; ");
-            g = { category: "decidio-guard", isFile: true, text: `${tool} ${fc.display} — ${what}`, binding: `${tool}\n${fc.abs}\n${fc.sha}`, subject: { fingerprint: fc.sha, display: `${fc.display}: ${what}` }, identity: { path: fc.abs, after: fc.sha }, segs: null };
+            g = { category: "decidio-guard", isFile: true, text: `${tool} ${fc.display} — ${what}`, binding: `${tool}\n${fc.abs}\n${fc.sha}`, subject: { fingerprint: fc.sha, display: `${fc.display}: ${what}` }, identity: { path: fc.abs, after: fc.sha }, segs: null, offSwitch: true };
         }
         else
             return 0;
@@ -3426,9 +3553,23 @@ async function cmdHookPretool() {
             ? { noun: "edit", run: "make", ran: "Nothing was written.", anew: "If the user wants a different change to this file, that is a new request and may be asked." }
             : { noun: "command", run: "run", ran: "Nothing ran.", anew: "If the user changes what it would act on (a new commit, a different path), that is a new request and may be asked." };
         const short = hookShort(hookRedact(g.text.replace(/\s+/g, " ").trim()));
-        const cfg = hookConfig();
+        let cfg = hookConfig();
+        if ("missing" in cfg) {
+            const got = await hookProvision();
+            if (!got.ok) {
+                if (opts.unconnected === "tell" && !g.offSwitch) {
+                    const told = toldOnce(typeof input.session_id === "string" ? input.session_id : "", g.binding);
+                    if (told === "passed")
+                        return out({ systemMessage: `Decidio: "${short}" ran without Decidio's approval - this computer isn't connected, and this repository lets a computer that isn't connected through after one notice.` });
+                    if (told === "noted")
+                        return deny(`Decidio: "${short}" is a ${g.category} ${w.noun} that needs a person's approval - ${got.reason} ${w.ran} This repository lets a computer that isn't connected run it after this one notice: if you can't connect, tell the user it would run WITHOUT Decidio's approval, and retry the same ${w.noun} only if they want that.`, got.user);
+                }
+                return deny(`Decidio: "${short}" is a ${g.category} ${w.noun} that needs a person's approval - ${got.reason} ${w.ran}`, got.user);
+            }
+            cfg = hookConfig();
+        }
         if ("missing" in cfg)
-            return deny(`Decidio: "${short}" is a ${g.category} ${w.noun} that needs a person's approval, but this project has no Decidio agent credentials (${cfg.missing}). ${w.ran} Ask the user to run \`npx @decidio/sdk init\` in ${projectDir}, then retry the same ${w.noun}.`, `Decidio: no agent credentials in ${projectDir} - run npx @decidio/sdk init`);
+            return deny(`Decidio: "${short}" is a ${g.category} ${w.noun} that needs a person's approval, but this project is not connected to Decidio yet. ${w.ran} Run \`npx @decidio/sdk connect\` in ${projectDir} and show the user the link it prints (they allow it on the web), then run \`npx @decidio/sdk connect --wait\`; once it says connected, retry the same ${w.noun}.`, `Decidio: this project is not connected - run npx @decidio/sdk connect`);
         const rel = relative(projectDir, cwdAbs);
         const cwdRel = !rel ? "." : rel.startsWith("..") || isAbsolute(rel) ? cwdAbs : rel;
         const session = typeof input.session_id === "string" ? input.session_id : "";
@@ -3439,6 +3580,13 @@ async function cmdHookPretool() {
         catch (e) {
             return deny(`Decidio hook: this ${w.noun} cannot be bound to an approval (${e?.message ?? e}) - refusing to ${w.run} it. Ask the user to check ${projectDir}/.env with \`npx @decidio/sdk doctor\`.`);
         }
+        if (material && session && !g.offSwitch) {
+            const paused = existsSync(pauseNote(session)) ? await guardPausedNow(cfg, guardSessionKey(material, session), g.category) : "on";
+            if (paused === "on")
+                notePause(session, false);
+            if (paused === "paused")
+                return out({ systemMessage: `Decidio guard is paused for this session: "${short}" ran without a person's approval (recorded). Type "decidio start" to resume.` });
+        }
         if (!material)
             return deny(`Decidio hook: this ${w.noun} cannot be bound to an approval (no key material (DECIDIO_API_TOKEN, or DECIDIO_AGENT_KEY + DECIDIO_AGENT_DID)) - refusing to ${w.run} it. Ask the user to check ${projectDir}/.env with \`npx @decidio/sdk doctor\`.`);
         const committed = { command: hookRedact(g.text).slice(0, 400), cwd: cwdRel.slice(0, 200), category: g.category, host: "claude-code", tool, subject: hookRedact(g.subject.display).slice(0, 200), ...(g.scriptLine ? { scriptLine: g.scriptLine } : {}) };
@@ -3483,7 +3631,7 @@ async function cmdHookPretool() {
         if (auth.decision === "proceed") {
             writeHookState(input.tool_use_id, { v: 1, decisionId: auth.decisionId, receiptId: auth.receiptId ?? null, tool, category: g.category, at: new Date().toISOString() });
             err(`decidio hook: "${short}" is authorized by policy (decision ${auth.decisionId}${auth.receiptId ? `, receipt ${auth.receiptId}` : ""}, sealed) - no output, so Claude Code's own permission check still decides; this covers this one execution only.`);
-            return 0;
+            return connectNotice ? out({}) : 0;
         }
         const holdRaw = Number(process.env.DECIDIO_HOOK_HOLD_MS ?? "90000");
         const held = await hookHold(cfg, auth.decisionId, Number.isFinite(holdRaw) && holdRaw >= 0 ? Math.min(holdRaw, HOOK_HOLD_CAP_MS) : 90_000);
@@ -3491,7 +3639,7 @@ async function cmdHookPretool() {
         if (!st)
             return deny(`Decidio: "${short}" is routed for approval as decision ${auth.decisionId}, but its status could not be read (${held.lastError ?? "no answer"}). ${w.ran} When the gate is reachable, run \`npx @decidio/sdk hook wait ${auth.decisionId}\` and then retry EXACTLY the same ${w.noun}.`);
         if (st.state === "pending")
-            return deny(`Decidio: "${short}" needs a person's approval - decision ${auth.decisionId} is in their queue${where ? ` (${where})` : ""}. ${w.ran} To continue: run \`npx @decidio/sdk hook wait ${auth.decisionId}\` (it returns when they decide), then retry EXACTLY the same ${w.noun} - not a variant of it, and do not work around this gate.`, `Decidio: ${auth.decisionId} awaits approval${where ? ` - ${where}` : ""}`);
+            return deny(`Decidio: "${short}" needs a person's approval - decision ${auth.decisionId} is in ${CONNECTED_APPROVER ? `${CONNECTED_APPROVER}'s` : "their"} queue${where ? ` (${where})` : ""}; they see it on their phone, Slack, Teams or the web. ${w.ran} Tell the user it is waiting for ${CONNECTED_APPROVER ?? "the approver"}.${CONNECTED_UNANSWERED ? ` If nobody has said yet whether another person approves this computer's requests, tell the user: the workspace owner answers "Should another person approve this?" once on the Decidio Agents page${CONNECTED_APP_URL ? ` (${CONNECTED_APP_URL}/connect/agents#coding-assistants)` : ""}. A request made before the answer keeps it: its owner can't approve that one - another approver can, or ask again in a new session.` : ""} To continue: run \`npx @decidio/sdk hook wait ${auth.decisionId}\` (it returns when they decide), then retry EXACTLY the same ${w.noun} - not a variant of it, and do not work around this gate.`, `Decidio: waiting for ${CONNECTED_APPROVER ?? "a person"}'s approval (${auth.decisionId})${where ? ` - ${where}` : ""}. ${w.ran} Claude continues once it is approved.`);
         if (st.state === "rejected" || st.state === "blocked")
             return deny(`Decidio: "${short}" was ${st.state} (decision ${auth.decisionId}${st.reason ? `: ${st.reason}` : ""}) for this exact change (${hookRedact(g.subject.display)}). Do not retry it or a variant of it; tell the user. ${g.subject.fingerprint ? w.anew : ""}`.trim(), `Decidio: ${auth.decisionId} ${st.state}`);
         const chk = await checkApproval(cfg, auth.decisionId, request, { status: st });
@@ -3569,7 +3717,7 @@ async function cmdHookWait(id, timeoutSec) {
     }
     const cfg = hookConfig();
     if ("missing" in cfg) {
-        err(`✘ ${cfg.missing} - run \`npx @decidio/sdk init\` in this project first.`);
+        err(`✘ ${cfg.missing} - connect this project first: npx @decidio/sdk connect`);
         return 1;
     }
     const where = decisionUrl(cfg.appUrl, id);
@@ -3650,10 +3798,10 @@ function cmdHookRules() {
     log(`A policy that auto-approves a request gets no output from the hook, so Claude Code's own permission check still decides; only a person's approval of the exact call answers "allow".`);
     return 0;
 }
-function hookRunner() {
+function hookRunner(portable = false) {
     const q = (p) => `"${p.replace(/(["\\$`])/g, "\\$1")}"`;
     const entry = process.argv[1] ?? "";
-    if (!entry || /[\\/]_npx[\\/]/.test(entry))
+    if (portable || !entry || /[\\/]_npx[\\/]/.test(entry))
         return `npx -y @decidio/sdk@${VERSION}`;
     let real = entry;
     try {
@@ -3662,16 +3810,17 @@ function hookRunner() {
     catch { }
     const localRoot = resolvePath("node_modules") + pathSep;
     if (real.startsWith(localRoot))
-        real = "$CLAUDE_PROJECT_DIR/node_modules/" + real.slice(localRoot.length).split(pathSep).join("/");
+        return `node "$CLAUDE_PROJECT_DIR/node_modules/${real.slice(localRoot.length).split(pathSep).join("/").replace(/(["\\$`])/g, "\\$1")}"`;
     real = real.split(pathSep).join("/");
     if (/\.ts$/.test(real))
         return `npx tsx ${q(real)}`;
     return `node ${q(real)}`;
 }
+const hookPromptLine = (runner) => `cd "$CLAUDE_PROJECT_DIR" && IN=$(cat) && case "$IN" in *[Dd][Ee][Cc][Ii][Dd][Ii][Oo]*) printf '%s' "$IN" | ${runner} hook prompt;; esac`;
 const HOOK_FILE_TOOLS = ["Write", "Edit", "MultiEdit"];
 const HOOK_GUARD_PATHS = ["**/.claude/settings*.json", "~/.claude/settings*.json", "~/.claude/plugins/**"];
 async function cmdHookInstall(opts) {
-    const settingsPath = joinPath(".claude", opts.project ? "settings.json" : "settings.local.json");
+    const settingsPath = joinPath(opts.dir ?? ".", ".claude", opts.project ? "settings.json" : "settings.local.json");
     let settings = {};
     if (existsSync(settingsPath)) {
         try {
@@ -3691,14 +3840,14 @@ async function cmdHookInstall(opts) {
         return 2;
     }
     const cliAt = opts.cli ? resolvePath(opts.cli).split(pathSep).join("/") : "";
-    const runner = opts.cli ? (/\.ts$/.test(opts.cli) ? `npx tsx "${cliAt}"` : `node "${cliAt}"`) : hookRunner();
+    const runner = opts.cli ? (/\.ts$/.test(opts.cli) ? `npx tsx "${cliAt}"` : `node "${cliAt}"`) : hookRunner(opts.portable === true);
     const hooks = (settings.hooks = settings.hooks && typeof settings.hooks === "object" && !Array.isArray(settings.hooks) ? settings.hooks : {});
     const place = (event, matcher, iff, command, extra) => {
         const list = Array.isArray(hooks[event]) ? hooks[event] : (hooks[event] = []);
         const want = { type: "command", ...(iff ? { if: iff } : {}), command, ...extra };
         let state = "added";
         for (const g of list) {
-            if (!g || typeof g !== "object" || g.matcher !== matcher || !Array.isArray(g.hooks))
+            if (!g || typeof g !== "object" || (g.matcher ?? "") !== matcher || !Array.isArray(g.hooks))
                 continue;
             g.hooks = g.hooks.flatMap((h) => {
                 if (!hookIsOurs(h) || (typeof h.if === "string" ? h.if : undefined) !== iff)
@@ -3713,39 +3862,684 @@ async function cmdHookInstall(opts) {
         }
         hooks[event] = list.filter((g) => !(g && typeof g === "object" && Array.isArray(g.hooks) && g.hooks.length === 0));
         if (state === "added")
-            hooks[event].push({ matcher, hooks: [want] });
+            hooks[event].push(matcher ? { matcher, hooks: [want] } : { hooks: [want] });
         return state;
     };
-    const preLine = `cd "$CLAUDE_PROJECT_DIR" && ${runner} hook pretool`, postLine = `cd "$CLAUDE_PROJECT_DIR" && ${runner} hook posttool`;
+    const preLine = `cd "$CLAUDE_PROJECT_DIR" && ${runner} hook pretool${opts.unconnected === "tell" ? " --unconnected=tell" : ""}`, postLine = `cd "$CLAUDE_PROJECT_DIR" && ${runner} hook posttool`;
     const pre = place("PreToolUse", "Bash|PowerShell", undefined, preLine, { timeout: 150, onFailure: "block" });
     const post = place("PostToolUse", "Bash|PowerShell", undefined, postLine, { timeout: 30 });
+    place("SessionStart", "startup|resume", undefined, `cd "$CLAUDE_PROJECT_DIR" && ${runner} hook session`, { timeout: 15 });
+    place("UserPromptSubmit", "", undefined, hookPromptLine(runner), { timeout: 15 });
     const guard = { added: 0, updated: 0, kept: 0 };
     for (const t of HOOK_FILE_TOOLS)
         for (const p of HOOK_GUARD_PATHS) {
             guard[place("PreToolUse", t, `${t}(${p})`, preLine, { timeout: 150, onFailure: "block" })]++;
             guard[place("PostToolUse", t, `${t}(${p})`, postLine, { timeout: 30 })]++;
         }
-    mkdirSync(".claude", { recursive: true });
-    writeFileSync(settingsPath, JSON.stringify(settings, null, 2) + "\n");
+    mkdirSync(dirname(settingsPath), { recursive: true });
+    const target = realOrSame(settingsPath), tmpSettings = `${target}.decidio-${process.pid}.tmp`;
+    writeFileSync(tmpSettings, JSON.stringify(settings, null, 2) + "\n", { mode: existsSync(target) ? statSync(target).mode & 0o777 : 0o644 });
+    renameSync(tmpSettings, target);
+    lastHookInstall = { settingsPath, pre, post };
+    if (opts.quiet)
+        return 0;
     log(`✔ ${settingsPath.split(pathSep).join("/")}: PreToolUse hook ${pre}, PostToolUse hook ${post} (matcher Bash|PowerShell${opts.project ? "; this file is shared with everyone who clones the project" : "; this file is yours alone - Claude Code keeps it out of git"}).`);
     log(`✔ the guard on Claude Code's own settings - ${HOOK_FILE_TOOLS.join(", ")} on ${HOOK_GUARD_PATHS.join(", ")}, PreToolUse and PostToolUse: ${Object.entries(guard).filter(([, n]) => n).map(([k, n]) => `${n} ${k}`).join(", ")}.`);
     log(`  Runs: ${runner} hook pretool|posttool  - the pretool hook times out at 150 s and BLOCKS the call if it fails (fail closed).`);
     const env = readEnvFile();
     const token = process.env.DECIDIO_API_TOKEN || env.DECIDIO_API_TOKEN;
-    if (token)
+    if (token && CREDS_FROM === "connection")
+        log(`✔ credentials: this project's Decidio connection (${process.env.DECIDIO_AGENT_ID}) - kept outside the repository, owner-only.`);
+    else if (token)
         log(`✔ agent credentials: ${ENV_PATH} holds DECIDIO_API_TOKEN${(process.env.DECIDIO_AGENT_KEY || env.DECIDIO_AGENT_KEY) ? " and the agent's signing key" : ""} for "${process.env.DECIDIO_AGENT_ID || env.DECIDIO_AGENT_ID || defaultAgentId()}".`);
     else
-        log(`⚠ no agent credentials here (no DECIDIO_API_TOKEN in ${ENV_PATH}) - until there are, EVERY gated command is refused. Run: npx @decidio/sdk init ${defaultAgentId()}`);
+        log(`⚠ not connected yet - until this project is, EVERY gated command is refused. Run: npx @decidio/sdk connect  (or, for your own agent: npx @decidio/sdk init ${defaultAgentId()})`);
     log(`  Gated: ${HOOK_RULES.map((r) => r.category).join(", ")} (npx @decidio/sdk hook rules lists the patterns; DECIDIO_HOOK_EXTRA_RULES adds yours).`);
     log(`  Approver: anyone in your workspace with a role other than the agent's owner (the person who ran init) - on the phone app, the web app, Slack or Teams.`);
     log(`           Nobody yet? Invite one: npx @decidio/sdk hook install --approver <email>   (single-use link; share by WhatsApp, SMS or email)`);
     log(`  Flow: a gated command is held up to ${Math.min(Number(process.env.DECIDIO_HOOK_HOLD_MS ?? 90_000) || 90_000, HOOK_HOLD_CAP_MS) / 1000} s for the approver, then refused with its decision id; \`npx @decidio/sdk hook wait <id>\` returns when they decide,`);
     log(`        and the SAME command retried then runs - once. A lab workspace allows 30 governed actions an hour; a gated command spends two (ask, retry).`);
-    log(`  Reload: restart Claude Code, or run /hooks in it - hooks are read when a session starts.`);
+    log(`  Reload: none needed - Claude Code picks up the settings file by itself. If a gated command is not asked about, open /hooks once (or restart Claude Code).`);
     if (opts.approver !== undefined)
         return inviteApprover(opts.approver);
     return 0;
 }
+function connectHostLabel(h) { return h === "claude-code" ? "Claude Code" : h; }
+function connectDir() { return joinPath(sessionDir(), "connections"); }
+function realOrSame(p) { try {
+    return realPath(p);
+}
+catch {
+    return resolvePath(p);
+} }
+const sameDir = (a, b) => (process.platform === "win32" ? a.toLowerCase() === b.toLowerCase() : a === b);
+function projectRoot() {
+    try {
+        const r = spawnSync("git", ["rev-parse", "--show-toplevel"], { encoding: "utf8", timeout: 3000, stdio: ["ignore", "pipe", "ignore"], windowsHide: true });
+        const top = String(r.stdout ?? "").trim();
+        if (r.status === 0 && top)
+            return realOrSame(top);
+    }
+    catch { }
+    return realOrSame(SHELL_ENV.CLAUDE_PROJECT_DIR || process.cwd());
+}
+function connectionKey(root) { return createHash("sha256").update(`${API}\n${root === COMPUTER ? "computer" : process.platform === "win32" ? root.toLowerCase() : root}`, "utf8").digest("hex").slice(0, 20); }
+function connectionFile(root) { return joinPath(connectDir(), `${connectionKey(root)}.json`); }
+function pendingConnectFile(root) { return joinPath(connectDir(), `${connectionKey(root)}.pending.json`); }
+function readJsonQuiet(f) {
+    try {
+        return existsSync(f) ? JSON.parse(readFileSync(f, "utf8")) : null;
+    }
+    catch {
+        return null;
+    }
+}
+function activeConnection(root, api) { return loadConnection(root, api) ?? loadConnection(COMPUTER, api); }
+const connectScope = (root) => (connectionRecord(root, API) ? root : COMPUTER);
+function loadConnection(root, api) {
+    const c = connectionRecord(root, api);
+    return c && !c.disconnected && c.token ? c : null;
+}
+function connectionRecord(root, api) {
+    const c = readJsonQuiet(connectionFile(root));
+    return c && c.v === 1 && c.api === api && c.root === root && typeof c.token === "string" && typeof c.agentId === "string" && typeof c.key === "string" && typeof c.did === "string" ? c : null;
+}
+function printableName(v) {
+    return typeof v === "string" ? v.replace(/[\u0000-\u001f\u007f-\u009f\u061c\u200b-\u200f\u2028-\u202e\u2060-\u2069\ufeff]/g, "").trim().slice(0, 60) || null : null;
+}
+function promoteConnection(c) {
+    CONNECTED_APPROVER = printableName(c.approver);
+    CONNECTED_UNANSWERED = c.answered === false;
+    CONNECTED_APP_URL = typeof c.appUrl === "string" && /^https?:\/\/[^\s"<>]+$/.test(c.appUrl) ? c.appUrl.replace(/\/+$/, "") : null;
+    CONNECTED_WORKSPACE = printableName(c.workspaceName);
+    GUARD_PAUSABLE = c.guardPausable !== false;
+    process.env.DECIDIO_API_TOKEN = c.token;
+    process.env.DECIDIO_AGENT_ID = c.agentId;
+    process.env.DECIDIO_AGENT_DID = c.did;
+    process.env.DECIDIO_AGENT_KEY = c.key;
+    process.env.DECIDIO_WORKSPACE_ID = c.workspaceId;
+    process.env.DECIDIO_TOKEN_JTI = c.jti;
+    if (c.appUrl && process.env.DECIDIO_APP_URL === undefined)
+        process.env.DECIDIO_APP_URL = c.appUrl;
+}
+function inCloudSession() { return SHELL_ENV.CLAUDE_CODE_REMOTE === "true"; }
+function machineId() {
+    const f = joinPath(sessionDir(), "machine-id");
+    let cur = "";
+    try {
+        cur = existsSync(f) ? readFileSync(f, "utf8").trim() : "";
+    }
+    catch { }
+    if (/^[0-9a-f]{8,32}$/.test(cur))
+        return cur;
+    const id = randomBytes(8).toString("hex");
+    mkdirSync(sessionDir(), { recursive: true });
+    writeFileSync(f, id + "\n");
+    return id;
+}
+function machineLabel(cloud) {
+    if (cloud)
+        return `cloud-${machineId().slice(0, 4)}`;
+    const h = (() => { try {
+        return hostname();
+    }
+    catch {
+        return "";
+    } })().split(".")[0].toLowerCase().replace(/[^a-z0-9-]+/g, "-").replace(/^-+|-+$/g, "");
+    return (h || "machine").slice(0, 40);
+}
+function projectLabel(root) {
+    try {
+        const r = spawnSync("git", ["-C", root, "config", "--get", "remote.origin.url"], { encoding: "utf8", timeout: 3000, stdio: ["ignore", "pipe", "ignore"], windowsHide: true });
+        const m = String(r.stdout ?? "").trim().match(/([^/:\\]+?)(?:\.git)?\/?$/);
+        if (r.status === 0 && m?.[1])
+            return m[1].slice(0, 80);
+    }
+    catch { }
+    try {
+        const pj = JSON.parse(readFileSync(joinPath(root, "package.json"), "utf8"));
+        if (typeof pj?.name === "string" && pj.name)
+            return pj.name.replace(/^@[^/]+\//, "").slice(0, 80);
+    }
+    catch { }
+    return (basename(root) || "project").slice(0, 80);
+}
+function localDesktop() {
+    if (inCloudSession() || SHELL_ENV.CI || SHELL_ENV.SSH_CONNECTION || SHELL_ENV.SSH_TTY || SHELL_ENV.CODESPACES || SHELL_ENV.GITPOD_WORKSPACE_ID || SHELL_ENV.DECIDIO_NO_BROWSER)
+        return false;
+    if (process.platform === "darwin" || process.platform === "win32")
+        return true;
+    return !!(SHELL_ENV.DISPLAY || SHELL_ENV.WAYLAND_DISPLAY);
+}
+function openInBrowser(url) {
+    if (!/^https?:\/\/[^\s"'<>`]+$/.test(url))
+        return false;
+    try {
+        const [cmd, args] = process.platform === "darwin" ? ["open", [url]] : process.platform === "win32" ? ["rundll32", ["url.dll,FileProtocolHandler", url]] : ["xdg-open", [url]];
+        const child = spawn(cmd, args, { detached: true, stdio: "ignore", windowsHide: true });
+        child.on("error", () => { });
+        child.unref();
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+const CONNECT_WAIT_S = () => { const n = Number(process.env.DECIDIO_CONNECT_WAIT_S ?? 90); return Number.isFinite(n) && n >= 1 && n <= 110 ? n : 90; };
+let lastHookInstall = null;
+let connectError = "";
+async function startConnect(root, host, quiet = false) {
+    const fail = (m) => { connectError = m; if (!quiet)
+        err(`✘ ${m}`); return null; };
+    const prior = connectionRecord(root, API);
+    const kp = prior && !inCloudSession() ? { did: prior.did, privateKeyBase64: prior.key } : generateKeypair();
+    const cloud = inCloudSession();
+    const project = (root === COMPUTER ? EVERY_PROJECT : projectLabel(root)).trim() || "project", machine = machineLabel(cloud).trim() || "machine";
+    const proof = signBoundProof(kp.privateKeyBase64, { agentId: "connect", did: kp.did, action: "connect.start", amount: 0, scope: [host, project, machine, cloud ? "cloud" : "local"].join("\n") });
+    const r = await api("/connect/start", { method: "POST", body: JSON.stringify({ host, project, machine, did: kp.did, cloud, proof }) }, "", true);
+    if (r.status === 0)
+        return fail(`couldn't reach Decidio at ${API} - check your connection and run npx @decidio/sdk connect again.`);
+    if (r.status === 404 || r.status === 401)
+        return fail(`${r.body?.message ?? "Connecting a coding assistant isn't switched on for this Decidio yet - it is on in the Decidio lab."} (${API})`);
+    if (r.status === 429)
+        return fail(`${r.body?.message ?? "Too many tries - wait a minute and try again."}`);
+    if (r.status !== 201 || typeof r.body?.pollSecret !== "string" || typeof r.body?.link !== "string")
+        return fail(`couldn't start a connection (${r.status}${r.body?.message ? `: ${r.body.message}` : ""}). Nothing was saved.`);
+    const p = { v: 1, api: API, root, project, host, machine, cloud, did: kp.did, key: kp.privateKeyBase64, code: String(r.body.code), link: String(r.body.link),
+        pollSecret: r.body.pollSecret, expiresAt: String(r.body.expiresAt), interval: Number(r.body.interval) || 2, startedAt: new Date().toISOString() };
+    mkdirSync(connectDir(), { recursive: true });
+    writeSecretFile(pendingConnectFile(root), JSON.stringify(p) + "\n");
+    if (typeof r.body.qr === "string")
+        pendingQr = r.body.qr;
+    return p;
+}
+let pendingQr = null;
+function readPendingConnect(root) {
+    const p = readJsonQuiet(pendingConnectFile(root));
+    return p && p.v === 1 && p.api === API && p.root === root && typeof p.pollSecret === "string" ? p : null;
+}
+async function hookProvision() {
+    const scope = COMPUTER;
+    if (process.env.DECIDIO_AGENT_ID) {
+        const named = printableName(process.env.DECIDIO_AGENT_ID) ?? "(unprintable)";
+        return { ok: false, reason: `this project names the Decidio agent "${named}" (in its .env or the shell) but has no token for it. Ask the user to check it with npx @decidio/sdk doctor, or to remove DECIDIO_AGENT_ID to use this computer's connection.`, user: `Decidio: "${named}" has no token here` };
+    }
+    const own = (SHELL_ENV.DECIDIO_API_URL ?? DEFAULT_API).replace(/\/$/, "");
+    if (API !== own) {
+        const host = printableName(redactUrl(API)) ?? "(unprintable)";
+        return { ok: false, reason: `this project's .env points Decidio at ${host}; the hook won't connect this computer to a server a repository names. If the user trusts it, they run npx @decidio/sdk connect themselves.`, user: `Decidio: not connecting to ${host} (named by this project)` };
+    }
+    try {
+        assertSafeTransport(API, true);
+    }
+    catch (e) {
+        return { ok: false, reason: `${String(e?.message ?? e).replace(/^\[decidio\] /, "")} - the connection's secret would cross in clear.`, user: "Decidio: refusing a plaintext connection" };
+    }
+    const linkWords = (p, fresh) => {
+        const mins = minutesLeft(p.expiresAt) || 1;
+        return { ok: false,
+            reason: `this computer isn't connected to Decidio yet${fresh ? "" : " (its link is still waiting to be allowed)"}. If Decidio's connect_device tool is available to you (the Decidio connector), tell the user you are connecting this computer to their Decidio workspace, call connect_device with the code ${p.code}, run the command it returns, then retry. Otherwise show the user this link and code: ${p.link} (code ${p.code}, valid ${mins} more minute${mins === 1 ? "" : "s"}) - the workspace owner allows it once, signed in, and it covers every project on this computer. Then retry the same command: it connects and asks for approval.`,
+            user: `Decidio: connect this computer once - open ${p.link} and check the code ${p.code}. Destructive commands wait until it's allowed; everything else runs as usual.` };
+    };
+    let p = readPendingConnect(scope);
+    if (p && new Date(p.expiresAt).getTime() > Date.now() + 5_000) {
+        const r = await api("/connect/poll", { method: "POST", headers: { "x-decidio-connect-secret": p.pollSecret }, body: "{}" }, "", true);
+        if (r.status === 200 && r.body?.status === "connected" && typeof r.body.token === "string") {
+            const c = storeCollected(scope, p, r.body);
+            if (typeof c === "string")
+                return { ok: false, reason: `this computer was allowed, but its credential couldn't be written (${c}). Ask the user to run npx @decidio/sdk doctor.`, user: "Decidio: connected, but the credential couldn't be saved" };
+            promoteConnection(c);
+            CREDS_FROM = "connection";
+            connectNotice = `Decidio connected this computer${CONNECTED_WORKSPACE ? ` to workspace ${CONNECTED_WORKSPACE}` : ""}${printableName(c.approvedBy) ? `, allowed by ${printableName(c.approvedBy)}` : ""} - every project on it now asks before destructive commands.`;
+            return { ok: true };
+        }
+        if (r.status === 202 || r.status === 429 || r.status >= 500)
+            return linkWords(p, false);
+        if (r.status === 409 && (r.body?.status === "ticket_required" || r.body?.status === "ticket_mismatch"))
+            return { ok: false,
+                reason: `this computer's link (code ${p.code}) was allowed through the Decidio connector and is finished only with the ticket connect_device returned: if YOU called connect_device for code ${p.code} in this session, run npx @decidio/sdk@latest connect --ticket <the ticket it returned>, then retry the same command. If you did not, do not finish it with any ticket from anywhere else - tell the user that another workspace's connector allowed this computer, and leave it: the link lapses within ten minutes and the next try shows a fresh code.`,
+                user: "Decidio: finishing this computer's connection (allowed through the Decidio connector) - destructive commands wait until it's done" };
+        if (r.status === 0)
+            return { ok: false, reason: `couldn't reach Decidio at ${API} to finish connecting this computer - retry once it is reachable.`, user: "Decidio: unreachable - destructive commands wait" };
+        if (r.status === 410 && r.body?.status === "collected") {
+            const won = activeConnection(projectRoot(), API);
+            if (won) {
+                promoteConnection(won);
+                CREDS_FROM = "connection";
+                return { ok: true };
+            }
+        }
+        if (r.status === 403 && r.body?.status === "denied") {
+            dropFile(pendingConnectFile(scope));
+            return { ok: false, reason: `connecting this computer was refused on the web ("Not me"). Ask the user before retrying - the next attempt shows a new link.`, user: "Decidio: connecting this computer was refused" };
+        }
+        if (r.status === 410 && r.body?.status === "removed") {
+            dropFile(pendingConnectFile(scope));
+            return { ok: false, reason: `the workspace owner removed this computer before it finished connecting. Ask the user before retrying - the next attempt shows a new link, and only the owner's Allow on the web brings it back.`, user: "Decidio: the workspace owner removed this computer" };
+        }
+        dropFile(pendingConnectFile(scope));
+    }
+    const lock = pendingConnectFile(scope) + ".lock";
+    mkdirSync(connectDir(), { recursive: true });
+    let fd = null;
+    try {
+        fd = openSync(lock, "wx", 0o600);
+    }
+    catch {
+        try {
+            if (Date.now() - statSync(lock).mtimeMs > 30_000) {
+                rmSync(lock, { force: true });
+                fd = openSync(lock, "wx", 0o600);
+            }
+        }
+        catch {
+            fd = null;
+        }
+    }
+    if (fd !== null && (p = readPendingConnect(scope)) && new Date(p.expiresAt).getTime() > Date.now() + 5_000) {
+        try {
+            closeSync(fd);
+        }
+        catch { }
+        dropFile(lock);
+        return linkWords(p, false);
+    }
+    if (fd === null) {
+        for (let i = 0; i < 20 && !(p = readPendingConnect(scope)); i++)
+            await new Promise((res) => setTimeout(res, 250));
+        if (p)
+            return linkWords(p, false);
+        return { ok: false, reason: "another Decidio check on this computer is connecting it right now - retry the same command in a few seconds.", user: "Decidio: connecting this computer" };
+    }
+    try {
+        const started = await startConnect(scope, "claude-code", true);
+        if (!started)
+            return { ok: false, reason: `this computer isn't connected to Decidio, and a connection couldn't be started: ${connectError}`, user: "Decidio: this computer isn't connected" };
+        return linkWords(started, true);
+    }
+    finally {
+        try {
+            closeSync(fd);
+        }
+        catch { }
+        dropFile(lock);
+    }
+}
+function toldOnce(session, binding) {
+    if (!session)
+        return "hold";
+    const dir = joinPath(connectDir(), "told");
+    const f = joinPath(dir, createHash("sha256").update(`${API}\n${session}\n${binding}`).digest("hex").slice(0, 40));
+    try {
+        if (existsSync(f))
+            return "passed";
+        mkdirSync(dir, { recursive: true, mode: 0o700 });
+        const week = Date.now() - 7 * 86_400_000;
+        for (const old of readdirSync(dir)) {
+            try {
+                if (statSync(joinPath(dir, old)).mtimeMs < week)
+                    rmSync(joinPath(dir, old), { force: true });
+            }
+            catch { }
+        }
+        writeFileSync(f, "", { mode: 0o600, flag: "wx" });
+        return "noted";
+    }
+    catch {
+        return "hold";
+    }
+}
+async function guardPausedNow(cfg, sessionKey, category) {
+    try {
+        assertSafeTransport(cfg.apiUrl, true);
+        const r = await fetch(cfg.apiUrl.replace(/\/$/, "") + "/agent/guard/check", { method: "POST", headers: { "content-type": "application/json", authorization: `Bearer ${cfg.apiToken}` },
+            body: JSON.stringify({ session: sessionKey, category }), signal: AbortSignal.timeout(10_000) });
+        const body = await r.json().catch(() => null);
+        return r.ok && body?.paused === true ? "paused" : r.ok && body?.paused === false ? "on" : "unknown";
+    }
+    catch {
+        return "unknown";
+    }
+}
+function pauseNote(session) {
+    return joinPath(connectDir(), "paused", createHash("sha256").update(`${API}\n${session}`).digest("hex").slice(0, 40));
+}
+function notePause(session, paused) {
+    const f = pauseNote(session);
+    try {
+        if (!paused)
+            return dropFile(f);
+        const dir = dirname(f);
+        mkdirSync(dir, { recursive: true, mode: 0o700 });
+        for (const old of readdirSync(dir)) {
+            try {
+                if (statSync(joinPath(dir, old)).mtimeMs < Date.now() - GUARD_PAUSE_HOURS * 3_600_000)
+                    rmSync(joinPath(dir, old), { force: true });
+            }
+            catch { }
+        }
+        writeFileSync(f, "", { mode: 0o600 });
+    }
+    catch { }
+}
+function dropFile(f) { try {
+    rmSync(f, { force: true });
+}
+catch { } }
+const minutesLeft = (iso) => Math.max(0, Math.round((new Date(iso).getTime() - Date.now()) / 60_000));
+function showConnectLink(p, opened, tty) {
+    const title = `Connect ${connectHostLabel(p.host)} to Decidio`;
+    log(`${brand()}  ${bold(title)}`);
+    log(`  Open:  ${link(p.link)}`);
+    log(`  Code:  ${bold(p.code)}   ${dim("(the page shows the same code - only allow it if they match)")}`);
+    log(dim(`  ${p.project} · ${p.machine} · the link works for ${minutesLeft(p.expiresAt) || 1} more minute${minutesLeft(p.expiresAt) === 1 ? "" : "s"}${opened ? " · opened in your browser" : ""}`));
+    if (tty && pendingQr) {
+        log("");
+        for (const line of pendingQr.split("\n"))
+            if (line.trim())
+                log(`  ${line}`);
+        log(dim("  Scan with your phone's camera to allow it there."));
+    }
+}
+async function cmdConnect(opts) {
+    const host = (opts.host ?? "claude-code");
+    if (host !== "claude-code") {
+        err(`✘ connect knows Claude Code today (--host claude-code); "${opts.host}" is not supported yet.`);
+        return 2;
+    }
+    if (opts.ticket !== undefined && (opts.wait || opts.team || opts.force || opts.holdEveryone)) {
+        err("✘ --ticket finishes a link the Decidio connector allowed and takes no other option.");
+        return 2;
+    }
+    if (opts.holdEveryone && !opts.team && !inCloudSession()) {
+        err("✘ --hold-everyone is for the shared file (--team, or a cloud session): it keeps refusing a computer that isn't connected.");
+        return 2;
+    }
+    try {
+        assertSafeTransport(API, true);
+    }
+    catch (e) {
+        err(`✘ ${String(e?.message ?? e).replace(/^\[decidio\] /, "")}`);
+        return 1;
+    }
+    const root = projectRoot();
+    if (opts.ticket !== undefined)
+        return connectWithTicket(root, opts.ticket);
+    const tty = !!(process.stdin.isTTY && process.stdout.isTTY);
+    if (CREDS_FROM === "shell" || CREDS_FROM === ".env") {
+        log(`• this project already has Decidio credentials ${CREDS_FROM === "shell" ? "from your shell" : `in ${ENV_PATH}`} for "${process.env.DECIDIO_AGENT_ID ?? defaultAgentId()}" - the hook uses those, so connect leaves them alone.`);
+        log(dim(`  To use a connection instead, remove DECIDIO_API_TOKEN / DECIDIO_AGENT_ID from ${CREDS_FROM === "shell" ? "your shell" : ENV_PATH} and run npx @decidio/sdk connect again.`));
+        return finishConnect(root, null, opts, false);
+    }
+    const existing = activeConnection(root, API);
+    if (existing && !opts.force && new Date(existing.expiresAt).getTime() > Date.now())
+        return finishConnect(root, existing, opts, false);
+    const scope = connectScope(root);
+    if (opts.wait)
+        return waitConnect(root, scope, opts, false);
+    let p = readPendingConnect(scope);
+    if (!p || p.host !== host || new Date(p.expiresAt).getTime() <= Date.now() + 15_000)
+        p = await startConnect(scope, host);
+    if (!p)
+        return 1;
+    const opened = !opts.noBrowser && localDesktop() && openInBrowser(p.link);
+    showConnectLink(p, opened, tty);
+    if (tty) {
+        log("");
+        return waitConnect(root, scope, opts, true);
+    }
+    log("");
+    log(`Next: allow it at the link above, then run  ${bold("npx @decidio/sdk connect --wait")}  - it finishes by itself (nothing else to type).`);
+    log(dim("Assistants: show the person the link and the code above, then run npx @decidio/sdk connect --wait."));
+    return 0;
+}
+async function connectWithTicket(root, ticket) {
+    if (!/^[A-Za-z0-9_-]{32,128}$/.test(ticket)) {
+        err("✘ --ticket needs the ticket connect_device returned (letters, digits, - and _).");
+        return 2;
+    }
+    const scope = connectScope(root);
+    const p = readPendingConnect(scope);
+    if (!p || new Date(p.expiresAt).getTime() <= Date.now()) {
+        const c = activeConnection(root, API);
+        if (c) {
+            log(`✔ This computer is already connected to Decidio${printableName(c.workspaceName) ? ` - workspace ${printableName(c.workspaceName)}` : ""}. Retry the command.`);
+            return 0;
+        }
+        err("✘ this computer has no link waiting to be finished - retry the command Decidio refused (it shows a fresh code), then call connect_device with that code.");
+        return 1;
+    }
+    const r = await api("/connect/poll", { method: "POST", headers: { "x-decidio-connect-secret": p.pollSecret, "x-decidio-connect-ticket": ticket }, body: "{}" }, "", true);
+    if (r.status === 200 && r.body?.status === "connected" && typeof r.body.token === "string") {
+        const c = storeCollected(scope, p, r.body);
+        if (typeof c === "string") {
+            err(`✘ connected, but this computer's credential couldn't be written (${c}) - run npx @decidio/sdk doctor.`);
+            return 1;
+        }
+        const ws = printableName(c.workspaceName), approver = printableName(c.approver);
+        log(`✔ Connected this computer to Decidio${ws ? ` - workspace ${ws}` : ""}, through the Decidio connector.`);
+        log(`✔ Retry the command Decidio refused: it now asks ${approver ?? "the approver"} before it runs.`);
+        if (r.body.trust === "unconfirmed")
+            log(dim("  Until the workspace owner confirms this computer is theirs (Decidio sent them a notification), every destructive command it asks about goes to a person."));
+        else if (r.body.trust === "cloud")
+            log(dim("  This cloud machine always asks a person for its destructive commands."));
+        return 0;
+    }
+    if (r.status === 202) {
+        err(`✘ this computer's link (code ${p.code}) hasn't been allowed yet - call connect_device with that code first, then run this again with the ticket it returns.`);
+        return 3;
+    }
+    if (r.status === 409 && r.body?.status === "ticket_mismatch") {
+        err(`✘ that ticket is for another link - call connect_device with this computer's code (${p.code}) and use the ticket it returns.`);
+        return 3;
+    }
+    if (r.status === 403 && r.body?.status === "denied") {
+        dropFile(pendingConnectFile(scope));
+        err("✘ this computer's link was refused on the web (Not me). Nothing was saved.");
+        return 3;
+    }
+    if (r.status === 410 && r.body?.status === "removed") {
+        dropFile(pendingConnectFile(scope));
+        err("✘ the workspace owner removed this computer before it finished connecting. Nothing was saved - ask them before trying again.");
+        return 3;
+    }
+    if ((r.status === 404 || r.status === 410) && (r.body?.status === "expired" || r.body?.status === "collected")) {
+        const won = r.body.status === "collected" ? activeConnection(root, API) : null;
+        if (won) {
+            log("✔ This computer is connected (another run finished it first). Retry the command.");
+            return 0;
+        }
+        dropFile(pendingConnectFile(scope));
+        err("✘ this computer's link expired before it was finished - retry the command Decidio refused for a fresh code, then call connect_device again.");
+        return 3;
+    }
+    if (r.status === 0) {
+        err(`✘ couldn't reach Decidio at ${API} - check the connection and run this again (the ticket stays good for ten minutes).`);
+        return 1;
+    }
+    err(`✘ Decidio answered ${r.status}${r.body?.message ? `: ${String(r.body.message).slice(0, 200)}` : ""}`);
+    return 1;
+}
+function storeCollected(scope, p, body) {
+    const c = { v: 1, api: API, root: scope, project: p.project, host: p.host, machine: p.machine, cloud: p.cloud, agentId: String(body.agentId), did: p.did, key: p.key,
+        token: body.token, jti: String(body.jti), expiresAt: String(body.expiresAt), workspaceId: String(body.workspaceId), workspaceName: body.workspace?.name ?? null,
+        approver: body.approver?.name ?? null, approvedBy: body.approvedBy?.name ?? null, appUrl: typeof body.appUrl === "string" ? body.appUrl : null, connectedAt: new Date().toISOString(),
+        guardPausable: body.guardPausable !== false, ...(body.answered === false ? { answered: false } : {}) };
+    mkdirSync(connectDir(), { recursive: true });
+    try {
+        writeSecretFile(connectionFile(scope), JSON.stringify(c) + "\n");
+    }
+    catch (e) {
+        return String(e?.message ?? e);
+    }
+    dropFile(pendingConnectFile(scope));
+    return c;
+}
+async function waitConnect(root, scope, opts, interactive) {
+    const p = readPendingConnect(scope);
+    if (!p) {
+        const c = activeConnection(root, API);
+        if (c)
+            return finishConnect(root, c, opts, false);
+        err("✘ no connection is in progress for this project - start one: npx @decidio/sdk connect");
+        return 1;
+    }
+    const deadline = interactive ? new Date(p.expiresAt).getTime() + 5_000 : Math.min(new Date(p.expiresAt).getTime() + 5_000, Date.now() + CONNECT_WAIT_S() * 1000);
+    const spin = ["⠋", "⠙", "⠹", "⠸", "⠼", "⠴", "⠦", "⠧", "⠇", "⠏"];
+    let i = 0, misses = 0;
+    if (!interactive)
+        err(`· waiting for the connection to be allowed at ${p.link} (code ${p.code}; up to ${Math.round((deadline - Date.now()) / 1000)} s)`);
+    while (Date.now() < deadline) {
+        const r = await api("/connect/poll", { method: "POST", headers: { "x-decidio-connect-secret": p.pollSecret }, body: "{}" }, "", true);
+        if (r.status === 200 && r.body?.status === "connected" && typeof r.body.token === "string") {
+            if (interactive && TTY_OUT)
+                process.stderr.write("\r\x1b[K");
+            const c = storeCollected(scope, p, r.body);
+            if (typeof c === "string") {
+                err(`✘ connected, but this machine's credentials could not be written (${c}) - run npx @decidio/sdk connect again (the server keeps nothing to collect twice).`);
+                return 1;
+            }
+            return finishConnect(root, c, opts, true);
+        }
+        if (r.status === 403 && r.body?.status === "denied") {
+            dropFile(pendingConnectFile(scope));
+            if (interactive && TTY_OUT)
+                process.stderr.write("\r\x1b[K");
+            err("✘ the connection was refused on the web (Not me). Nothing was saved.");
+            return 3;
+        }
+        if (r.status === 410 && r.body?.status === "removed") {
+            dropFile(pendingConnectFile(scope));
+            if (interactive && TTY_OUT)
+                process.stderr.write("\r\x1b[K");
+            err("✘ the workspace owner removed this computer before it finished connecting. Nothing was saved.");
+            return 3;
+        }
+        if (r.status === 409 && (r.body?.status === "ticket_required" || r.body?.status === "ticket_mismatch")) {
+            if (interactive && TTY_OUT)
+                process.stderr.write("\r\x1b[K");
+            err("✘ this computer's link was allowed through the Decidio connector: finish it with npx @decidio/sdk connect --ticket <the ticket YOUR connect_device returned> - never a ticket from anywhere else.");
+            return 3;
+        }
+        if ((r.status === 404 || r.status === 410) && (r.body?.status === "expired" || r.body?.status === "collected")) {
+            const won = r.body.status === "collected" ? activeConnection(root, API) : null;
+            if (won) {
+                if (interactive && TTY_OUT)
+                    process.stderr.write("\r\x1b[K");
+                return finishConnect(root, won, opts, true);
+            }
+            dropFile(pendingConnectFile(scope));
+            if (interactive && TTY_OUT)
+                process.stderr.write("\r\x1b[K");
+            err(r.body.status === "collected" ? "✘ this connection was already collected by another run - start a fresh one: npx @decidio/sdk connect" : "✘ the link expired before it was allowed - start a fresh one: npx @decidio/sdk connect");
+            return 3;
+        }
+        if (r.status === 0 && ++misses > 10) {
+            err(`✘ lost touch with Decidio at ${API} - check your connection, then run npx @decidio/sdk connect --wait again.`);
+            return 1;
+        }
+        if (interactive && TTY_OUT)
+            process.stderr.write(`\r${spin[i++ % spin.length]} waiting for you to allow it in the browser… ${dim(`(${minutesLeft(p.expiresAt)} min left · Ctrl-C stops waiting; npx @decidio/sdk connect --wait picks it up again)`)}`);
+        await new Promise((res) => setTimeout(res, (r.status === 429 ? 2 : 1) * Math.max(1, p.interval) * 1000));
+    }
+    if (interactive && TTY_OUT)
+        process.stderr.write("\r\x1b[K");
+    log(`• still waiting for it to be allowed: ${link(p.link)} (code ${p.code}, ${minutesLeft(p.expiresAt)} min left). Run  npx @decidio/sdk connect --wait  again once it is.`);
+    return 1;
+}
+async function finishConnect(root, c, opts, fresh) {
+    if (c) {
+        promoteConnection(c);
+        CREDS_FROM = "connection";
+    }
+    const cloud = inCloudSession();
+    const shared = opts.team || cloud;
+    const everywhere = !shared && c?.root === COMPUTER;
+    const home = process.platform === "win32" ? (SHELL_ENV.USERPROFILE ?? homedir()) : (SHELL_ENV.HOME ?? homedir());
+    const plugin = !cloud && decidioPluginEnabled(root);
+    if (!plugin) {
+        const rc = await cmdHookInstall({ project: shared || everywhere, dir: everywhere ? home : root, quiet: true, portable: everywhere, ...(shared && !opts.holdEveryone ? { unconnected: "tell" } : {}) });
+        if (rc !== 0)
+            return rc;
+    }
+    const probe = await api("/agent/status/doctor-scope-probe", {}, process.env.DECIDIO_API_TOKEN, true);
+    const verified = probe.status === 404;
+    const settings = everywhere ? "~/.claude/settings.json" : lastHookInstall ? relative(root, lastHookInstall.settingsPath).split(pathSep).join("/") || lastHookInstall.settingsPath : ".claude/settings.json";
+    const hostName = connectHostLabel(c?.host ?? "claude-code");
+    const approverName = printableName(c?.approver);
+    if (c) {
+        const wsName = printableName(c.workspaceName), allowedBy = printableName(c.approvedBy);
+        log(`✔ ${fresh ? "Connected to Decidio" : "Already connected to Decidio"}${wsName ? ` - workspace ${wsName}` : ""}${fresh && allowedBy ? `, allowed by ${allowedBy}` : ""}`);
+        if (c.answered === false)
+            log(`• One question is still open for this computer: "Should another person approve this?" - the workspace owner answers it once on the Decidio Agents page${c.appUrl ? ` (${c.appUrl.replace(/\/+$/, "")}/connect/agents#coding-assistants)` : ""}. Until then its owner can't approve its destructive commands - another approver can, or they wait.`);
+        else
+            log(`✔ Approvals go to ${approverName ?? "its approver"} - on the phone app, Slack, Teams or the web`);
+    }
+    if (!verified) {
+        err(probe.status === 401 || probe.status === 403
+            ? `✘ Decidio refused this connection's token (${probe.status}) - it was revoked or has expired. Reconnect: npx @decidio/sdk connect --force`
+            : `⚠ couldn't check the token just now (${probe.status || "no answer"}) - the hooks are on; a gated command will say if anything is wrong.`);
+        if (probe.status === 401 || probe.status === 403)
+            return 1;
+    }
+    const changed = !plugin && lastHookInstall && (lastHookInstall.pre !== "kept" || lastHookInstall.post !== "kept");
+    log(plugin
+        ? `✔ ${hostName} asks before destructive commands in this project (the Decidio plugin's hooks)`
+        : `✔ ${hostName} asks before destructive commands in ${everywhere ? "every project on this computer" : "this project"} (${settings})`);
+    log(dim(`  What waits for a person's approval: deleting files (rm -rf), force-pushing, dropping tables, terraform and kubectl changes, publishing a package, curl | sh - and switching Decidio's own check off. Everything else runs as before.`));
+    if (changed)
+        log(dim(`  Claude Code picks the settings change up by itself - if a destructive command is not asked about, open /hooks once (or restart it).`));
+    if (c)
+        log(dim(`  Credentials: ${connectionFile(c.root)} (outside the repository, owner-only) · ${c.root === COMPUTER ? "every project on this computer" : "this project"} · until ${c.expiresAt.slice(0, 10)}${cloud ? ` · this cloud machine only - a fresh one connects again (the Decidio connector does it with no tap)${opts.holdEveryone ? ", and is refused destructive commands until it does" : ""}` : ""}`));
+    if (!plugin && !everywhere && (shared || process.platform === "win32") && !sameDir(realOrSame(process.cwd()), root))
+        log(dim(`  Claude Code reads ${settings} from the folder it starts in - start it at ${root}.`));
+    if (cloud && !opts.team)
+        log(`• A cloud session reads the repository's settings, not a computer's, so the hooks are in ${settings} - not committed. Ask the person before committing it: committed, every cloud session of this repository asks too, and so does every teammate's clone (a teammate connects with npx @decidio/sdk connect).`);
+    else if (shared)
+        log(`• Commit ${settings}: every clone then asks before destructive commands (a teammate connects with npx @decidio/sdk connect).`);
+    if (shared && !plugin)
+        log(dim(opts.holdEveryone
+            ? "  A computer that isn't connected is refused every destructive command until it connects (--hold-everyone)."
+            : "  A computer that isn't connected is told once (with how to connect), then the same command runs without Decidio's approval. To keep refusing it until it connects: npx @decidio/sdk connect --team --hold-everyone"));
+    if (fresh && c?.answered !== false)
+        log(dim(`  Try it: ask ${hostName} to delete a scratch folder with rm -rf - the approval reaches ${approverName ?? "the approver"} on their phone.`));
+    return 0;
+}
+const DECIDIO_PLUGIN = "decidio-approvals";
+function decidioPluginEnabled(root) {
+    const home = process.platform === "win32" ? (SHELL_ENV.USERPROFILE ?? homedir()) : (SHELL_ENV.HOME ?? homedir());
+    for (const f of [joinPath(root, ".claude", "settings.local.json"), joinPath(root, ".claude", "settings.json"), joinPath(home, ".claude", "settings.json")]) {
+        const ep = readJsonQuiet(f)?.enabledPlugins;
+        if (!ep || typeof ep !== "object" || Array.isArray(ep))
+            continue;
+        const named = Object.entries(ep).find(([k]) => k.split("@")[0] === DECIDIO_PLUGIN);
+        if (named)
+            return named[1] === true;
+    }
+    return false;
+}
+async function cmdDisconnect() {
+    const root = projectRoot();
+    const scope = connectScope(root);
+    const c = loadConnection(scope, API);
+    dropFile(pendingConnectFile(scope));
+    const where = scope === COMPUTER ? "this computer" : "this project on this machine";
+    if (!c) {
+        log(`• ${where} isn't connected - nothing to do.`);
+        return 0;
+    }
+    try {
+        writeSecretFile(connectionFile(scope), JSON.stringify({ ...c, token: "", jti: "", disconnected: true }) + "\n");
+    }
+    catch (e) {
+        err(`✘ couldn't update ${connectionFile(scope)} (${e?.message ?? e}) - delete it by hand to disconnect.`);
+        return 1;
+    }
+    log(`✔ disconnected ${where} - its token is deleted.`);
+    log(`  Destructive commands are now refused${scope === COMPUTER ? " in every project here" : ""} until you connect again (the hooks stay on: switching Decidio off needs a person's approval).`);
+    log(dim(`  "${c.agentId}" stays listed in Decidio until its token expires (${c.expiresAt.slice(0, 10)}); to end it now, revoke it on the Agents page${c.appUrl ? `: ${c.appUrl.replace(/\/+$/, "")}/connect/agents` : ""}.`));
+    return 0;
+}
 async function inviteApprover(email) {
     if (!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email)) {
         err(`✘ --approver needs an email address (got "${email}")`);
@@ -4911,7 +5705,7 @@ async function cmdGithubInit(opts) {
             log(`  ${line}`);
     }
     const agentsRel = "AGENTS.md", agentsAbs = joinPath(root, agentsRel);
-    const appUrl = (process.env.DECIDIO_APP_URL || apiUrl.replace(/^https:\/\/(decidio-api\.onrender\.com|mcp\.decidioai\.com)$/, "https://app.decidioai.com")).replace(/\/$/, "");
+    const appUrl = appUrlFor(apiUrl);
     const section = agentsMdSection(appUrl);
     if (!plainRepoPath(root, agentsRel))
         err(`✘ ${agentsRel} is a symbolic link - nothing was written through it`);
@@ -5025,6 +5819,21 @@ APPROVALS AND RECEIPTS
                                        (never the receipt's own issuer field; --allow-unpinned: structural check only)
 
 CODING AGENTS (Claude Code)
+  npx @decidio/sdk connect             connect this computer's coding assistant once, for every project on it: prints a
+                                       link and a short code (a QR and the browser too, on a real terminal); the workspace
+                                       owner allows it on the web, then this computer gets an ask-only credential (kept
+                                       outside every repository) and the hooks below switch on in ~/.claude/settings.json.
+  npx @decidio/sdk connect --wait      finish a connect started by an assistant: returns once it is allowed, within 90 s
+                                       (exit 0 connected · 3 refused or expired · 1 still waiting, run it again)
+                                       --team: the shared .claude/settings.json every clone reads (a cloud session reads
+                                       the repository's files, not a computer's, so there it is always the shared one); a
+                                       computer that isn't connected is told once, then let through - --hold-everyone keeps
+                                       refusing it · --no-browser · --force: a fresh token for this computer
+  npx @decidio/sdk connect --ticket <t>
+                                       finish the link the Decidio connector allowed (its connect_device tool returns the
+                                       ticket): writes this computer's credential, nothing else
+  npx @decidio/sdk disconnect          delete this computer's connection (destructive commands are then refused until
+                                       you connect again; the hooks stay on)
   npx @decidio/sdk hook install [--project] [--approver <email>] [--cli <path>]
                                        a person approves Claude Code's destructive shell commands before they run
                                        (rm -rf, git push --force, DROP TABLE, terraform apply, kubectl delete,
@@ -5045,6 +5854,11 @@ CODING AGENTS (Claude Code)
                                        (90 s; at most 120 s) for the approver, then refused with its decision id; the SAME command
                                        retried after approval runs once - its execution is recorded and that
                                        approval is spent. No credentials, no gate, no answer = refused (fail closed).
+                                       --unconnected=tell (written into a shared file by connect): a computer with no
+                                       credential is refused once per session and command, then let through with a line.
+  npx @decidio/sdk hook prompt         the UserPromptSubmit hook: the person's own typed "decidio pause" / "decidio start"
+                                       pauses or resumes the guard for that session (never on an enterprise plan; every
+                                       pause and every command run under it is recorded); other prompts pass untouched.
 
 CONTEXT PACKS (Claude Code, Claude.ai, ChatGPT)
   npx @decidio/sdk context create <slug> --title "ACME application" --trigger "whenever we discuss the ACME application"
@@ -5129,7 +5943,8 @@ NOTES
   Exit codes: 0 success · 1 failure or honest no-op (e.g. replay refused) · 2 usage error ·
   3 quickstart stopped at the human moment (headless: routed, but nothing executed and no
   receipt written — pass --auto-approve-demo for a run that completes unattended), or
-  hook wait: the approver said no. hook pretool/posttool always exit 0 (their answer is the JSON).
+  hook wait: the approver said no, or connect --wait: the connection was refused or expired (1 there: still
+  waiting - run it again). hook pretool/posttool always exit 0 (their answer is the JSON).
   Errors, and usage shown on ERROR paths, go to stderr; stdout carries results only (safe to
   pipe). Asked-for help — including this bare invocation — IS a result, so it prints here.
   Docs: the README that shipped with this package — node_modules/@decidio/sdk/README.md
@@ -5271,13 +6086,15 @@ async function main(argv) {
         logout: { flags: [] },
         phone: { flags: [] },
         init: { flags: ["--unique", "--force"], valued: ["--expires-days"] },
+        connect: { flags: ["--wait", "--no-browser", "--team", "--force", "--hold-everyone"], valued: ["--host", "--ticket"] },
+        disconnect: { flags: [] },
         doctor: { flags: [] },
         approvals: { flags: ["--json", "--mine"], valued: ["--reason"] },
         receipt: { flags: ["--json"] },
         verify: { flags: ["--allow-unpinned"], valued: ["--issuer"] },
         tokens: { flags: ["--mine"] },
         dev: { flags: [], valued: ["--target", "--port"] },
-        hook: { flags: ["--project"], valued: ["--timeout", "--approver", "--cli"] },
+        hook: { flags: ["--project"], valued: ["--timeout", "--approver", "--cli", "--unconnected"] },
         github: { flags: ["--agents-md"], valued: ["--environment", "--justification", "--decision", "--workflow", "--api"] },
         deploys: { flags: ["--watch", "--json"], valued: ["--environment", "--repo", "--limit"] },
         controls: { flags: ["--json"] },
@@ -5320,7 +6137,7 @@ async function main(argv) {
                 return 2;
             }
         }
-        const MAX_POS = { login: 1, logout: 0, phone: 0, quickstart: 1, init: 1, doctor: 0, receipt: 1, tokens: 2, dev: 0, hook: 2, github: 1, decisions: 1 };
+        const MAX_POS = { login: 1, logout: 0, phone: 0, quickstart: 1, init: 1, connect: 0, disconnect: 0, doctor: 0, receipt: 1, tokens: 2, dev: 0, hook: 2, github: 1, decisions: 1 };
         const exemptTail = (cmd === "approvals" && (positionals[0] === "approve" || positionals[0] === "reject")) || (cmd === "hook" && positionals[0] === "justify") || cmd === "verify";
         if (!exemptTail && cmd === "approvals" && positionals.length > 0) {
             err(`✘ unknown approvals subcommand "${positionals[0]}" — use approve or reject (or no subcommand to list).`);
@@ -5478,11 +6295,14 @@ async function main(argv) {
             }
             return cmdContext(sub, pos.slice(1), { title: valuedOpt(argsIn, "--title"), trigger: valuedOpt(argsIn, "--trigger"), team: valuedOpt(argsIn, "--team"), unit: valuedOpt(argsIn, "--unit"), org: argsIn.includes("--org"), here: argsIn.includes("--here"), pack: valuedOpt(argsIn, "--pack"), chatgpt: argsIn.includes("--chatgpt"), json: argsIn.includes("--json") });
         }
+        case "connect": return cmdConnect({ wait: argsIn.includes("--wait"), host: valuedOpt(argsIn, "--host"), noBrowser: argsIn.includes("--no-browser"), team: argsIn.includes("--team"), force: argsIn.includes("--force"),
+            ticket: valuedOpt(argsIn, "--ticket"), holdEveryone: argsIn.includes("--hold-everyone") });
+        case "disconnect": return cmdDisconnect();
         case "hook": {
-            const VALUED = ["--timeout", "--approver", "--cli"];
+            const VALUED = ["--timeout", "--approver", "--cli", "--unconnected"];
             const pos = argsIn.filter((x, i) => !x.startsWith("-") && !VALUED.includes(argsIn[i - 1] ?? ""));
             const sub = pos[0];
-            const allowed = { pretool: [], posttool: [], wait: ["--timeout"], install: ["--project", "--approver", "--cli"], rules: [], justify: [] };
+            const allowed = { pretool: ["--unconnected"], posttool: [], session: [], prompt: [], wait: ["--timeout"], install: ["--project", "--approver", "--cli"], rules: [], justify: [] };
             const given = argsIn.filter((x) => x.startsWith("--")).map((x) => x.split("=")[0]);
             if (sub && allowed[sub]) {
                 const stray = given.find((f) => !allowed[sub].includes(f));
@@ -5492,8 +6312,10 @@ async function main(argv) {
                 }
             }
             switch (sub) {
-                case "pretool": return cmdHookPretool();
+                case "pretool": return cmdHookPretool({ unconnected: valuedOpt(argsIn, "--unconnected") === "tell" ? "tell" : "hold" });
                 case "posttool": return cmdHookPosttool();
+                case "session": return cmdHookSession();
+                case "prompt": return cmdHookPrompt();
                 case "wait": {
                     const t = valuedOpt(argsIn, "--timeout") ?? "600";
                     if (!/^\d+$/.test(t) || Number(t) < 1 || Number(t) > 86_400) {
@@ -5506,7 +6328,7 @@ async function main(argv) {
                 case "rules": return cmdHookRules();
                 case "justify": return cmdHookJustify(pos[1], pos.slice(2).join(" "));
                 default:
-                    err(`✘ hook needs a subcommand: install | wait <decision-id> | justify <decision-id> "<what changed>" | rules (pretool and posttool are run by Claude Code).\n\n${USAGE}`);
+                    err(`✘ hook needs a subcommand: install | wait <decision-id> | justify <decision-id> "<what changed>" | rules (pretool, posttool and session are run by Claude Code).\n\n${USAGE}`);
                     return 2;
             }
         }