@intended-inc/claude-code-hook 0.1.1 → 0.2.0

package/README.md

@@ -26,11 +26,42 @@ authority layer — "no token, no action" before execution.
 |---|---|
 | Unconfigured (no `INTENDED_API_KEY` / `INTENDED_TENANT_ID`) | **allow** (fail-open — never bricks a repo) |
 | `200 APPROVED` | allow |
-| `202 ESCALATED` | **ask** the human |
+| `202 ESCALATED` | **wait** for the approver in Intended (see below) |
 | `403 DENIED` | **deny** (with reason) |
 | Unreachable, non-2xx (401/429/5xx/…), or unrecognized body | **deny** (fail-closed) — never falls through to allow |
 
-Config (env): `INTENDED_API_KEY`, `INTENDED_TENANT_ID`, `INTENDED_API_URL` (optional).
+## What happens on ESCALATE
+
+The hook waits for a human approver to decide in the Intended console, for up to
+`INTENDED_HOOK_ESCALATION_WAIT_SECONDS` (default `45`).
+
+- Approved in time: **allow**.
+- Rejected, or the approval request expired: **deny** with the reason.
+- Still undecided: **deny** (fail-closed) with a message giving the intent id: ask an
+  approver to approve it in the Intended console, then retry the same tool call. The
+  pending intent is saved in `~/.intended/pending.json`, keyed by a hash of the tool name
+  and arguments (bounded; expired entries are dropped). When Claude retries the same
+  tool call with the same arguments, the hook checks that intent instead of creating a
+  new escalation, and allows the call once it is approved.
+
+Set `INTENDED_HOOK_ON_PENDING=ask` to defer a still-undecided call to Claude Code's own
+permission prompt instead of denying it.
+
+A wait that fails with 401, 403 (the key needs the `intent:read` scope), 404, or an
+unrecognised response is a deny. Only an approval allows.
+
+Claude Code hooks time out after 60 seconds by default. To wait longer than about 55
+seconds, raise the hook's `timeout` (in seconds) above the wait:
+
+```json
+{ "type": "command", "command": "npx -y @intended-inc/claude-code-hook", "timeout": 300 }
+```
+
+and set `INTENDED_HOOK_ESCALATION_WAIT_SECONDS` below it (for example `280`).
+
+Config (env): `INTENDED_API_KEY`, `INTENDED_TENANT_ID`, `INTENDED_API_URL` (optional),
+`INTENDED_HOOK_ESCALATION_WAIT_SECONDS` (default `45`), `INTENDED_HOOK_ON_PENDING`
+(`deny` or `ask`, default `deny`).
 Attribution: actor = `claude-code:<tool>`. Last decision → `~/.intended/last-decision.json`.
 
 It's a CLI (the SDK is the library). Apache-2.0.

package/dist/bin.js

@@ -4,9 +4,145 @@
 var fs = require('fs');
 var os = require('os');
 var path = require('path');
+var crypto = require('crypto');
+
+var FINAL = /* @__PURE__ */ new Set(["ALLOW", "DENY", "EXPIRED"]);
+var MAX_POLL_SECONDS = 50;
+var MAX_BACKOFF_MS = 1e4;
+var MIN_REPOLL_MS = 1e3;
+var defaultSleep = (ms) => new Promise((r) => setTimeout(r, Math.max(0, ms)));
+function str(v) {
+  return typeof v === "string" && v.length > 0 ? v : null;
+}
+function base(intentId, status, reason) {
+  return {
+    intentId,
+    status,
+    reason,
+    token: null,
+    decidedBy: null,
+    decidedAt: null,
+    escalationId: null,
+    expiresAt: null,
+    receiptUrl: null
+  };
+}
+function parseBody(intentId, body, apiUrl) {
+  const status = body.status;
+  if (status !== "ALLOW" && status !== "DENY" && status !== "PENDING" && status !== "EXPIRED") return null;
+  const receipt = str(body.receiptUrl);
+  return {
+    intentId: str(body.intentId) ?? intentId,
+    status,
+    reason: str(body.reason) ?? `Decision: ${status}`,
+    token: status === "ALLOW" ? str(body.token) : null,
+    decidedBy: body.decidedBy && typeof body.decidedBy === "object" ? body.decidedBy : null,
+    decidedAt: str(body.decidedAt),
+    escalationId: str(body.escalationId),
+    expiresAt: str(body.expiresAt),
+    receiptUrl: receipt ? /^https?:\/\//.test(receipt) ? receipt : `${apiUrl}${receipt.startsWith("/") ? "" : "/"}${receipt}` : null
+  };
+}
+function retryAfterHeaderMs(res) {
+  const raw = res.headers?.get?.("retry-after");
+  const n = raw == null ? NaN : Number(raw);
+  return Number.isFinite(n) && n > 0 ? n * 1e3 : 0;
+}
+async function waitForDecision(intentId, opts) {
+  const apiUrl = (opts.apiUrl ?? "https://api.intended.so").replace(/\/$/, "");
+  const fetchImpl = opts.fetchImpl ?? fetch;
+  const now = opts.now ?? Date.now;
+  const sleep = opts.sleep ?? defaultSleep;
+  const deadline = now() + Math.max(0, opts.timeoutMs);
+  const headers = {
+    authorization: `Bearer ${opts.apiKey}`,
+    "x-tenant-id": opts.tenantId
+  };
+  let backoffMs = 1e3;
+  for (; ; ) {
+    const remaining = deadline - now();
+    const timeoutSec = remaining <= 0 ? 0 : Math.min(MAX_POLL_SECONDS, Math.ceil(remaining / 1e3));
+    const url = `${apiUrl}/v1/decisions/${encodeURIComponent(intentId)}/wait?timeout=${timeoutSec}&tenantId=${encodeURIComponent(opts.tenantId)}`;
+    const startedAt = now();
+    let res = null;
+    try {
+      res = await fetchImpl(url, {
+        headers,
+        // The server holds at most timeoutSec; give the network some slack beyond that.
+        signal: AbortSignal.timeout(timeoutSec * 1e3 + 15e3)
+      });
+    } catch {
+      res = null;
+    }
+    let transientWaitMs = 0;
+    if (res) {
+      if (res.status === 401) {
+        return { ...base(intentId, "ERROR", "The Intended API rejected the API key (401). The action is not approved."), error: "unauthorized" };
+      }
+      if (res.status === 403) {
+        return {
+          ...base(
+            intentId,
+            "ERROR",
+            "This API key cannot read decisions: it needs the intent:read scope. The action is not approved."
+          ),
+          error: "forbidden"
+        };
+      }
+      if (res.status === 404) {
+        return { ...base(intentId, "ERROR", `Intended has no decision for intent ${intentId}. The action is not approved.`), error: "not_found" };
+      }
+      if (res.status === 429 || res.status >= 500) {
+        transientWaitMs = Math.max(backoffMs, retryAfterHeaderMs(res));
+      } else {
+        const body = await res.json().catch(() => null);
+        const parsed = res.status === 200 && body ? parseBody(intentId, body, apiUrl) : null;
+        if (!parsed) {
+          return {
+            ...base(intentId, "ERROR", `Unrecognised decision response (HTTP ${res.status}). The action is not approved.`),
+            error: "bad_response"
+          };
+        }
+        if (FINAL.has(parsed.status)) return parsed;
+        if (now() >= deadline) return { ...parsed, timedOut: true };
+        const retryAfterMs = typeof body?.retryAfterMs === "number" && body.retryAfterMs > 0 ? body.retryAfterMs : 0;
+        const answeredFast = now() - startedAt < Math.min(timeoutSec * 1e3, MIN_REPOLL_MS) / 2;
+        const pause = retryAfterMs > 0 ? retryAfterMs : answeredFast ? MIN_REPOLL_MS : 0;
+        if (pause > 0) await sleep(Math.min(pause, Math.max(0, deadline - now())));
+        backoffMs = 1e3;
+        continue;
+      }
+    } else {
+      transientWaitMs = backoffMs;
+    }
+    if (now() >= deadline) {
+      return {
+        ...base(
+          intentId,
+          "PENDING",
+          "The Intended decision service could not be reached before the wait ended. The action is still not approved."
+        ),
+        timedOut: true
+      };
+    }
+    await sleep(Math.min(transientWaitMs, Math.max(0, deadline - now())));
+    backoffMs = Math.min(backoffMs * 2, MAX_BACKOFF_MS);
+  }
+}
+function canonicalJson(value) {
+  if (value === null || typeof value !== "object") return JSON.stringify(value) ?? "null";
+  if (Array.isArray(value)) return `[${value.map(canonicalJson).join(",")}]`;
+  const obj = value;
+  return `{${Object.keys(obj).sort().filter((k) => obj[k] !== void 0).map((k) => `${JSON.stringify(k)}:${canonicalJson(obj[k])}`).join(",")}}`;
+}
+function toolCallKey(toolName, args) {
+  return crypto.createHash("sha256").update(`${toolName}
+${canonicalJson(args ?? {})}`).digest("hex");
+}
 
 // src/evaluate.ts
 var AUTHORITY_STATUSES = /* @__PURE__ */ new Set([200, 202, 403]);
+var DEFAULT_ESCALATION_WAIT_SECONDS = 45;
 var MAX_DESCRIBED_KEYS = 20;
 var SAFE_KEY = /^[A-Za-z_][A-Za-z0-9_.-]{0,63}$/;
 function describeToolCall(name, args) {
@@ -17,8 +153,17 @@ function describeToolCall(name, args) {
   const list = [...named, ...unnamed > 0 ? [`+${unnamed} more`] : []].join(", ");
   return `Call tool "${name}" with args: ${list}`;
 }
+function escalationWaitMs(env) {
+  const raw = env.INTENDED_HOOK_ESCALATION_WAIT_SECONDS;
+  if (raw === void 0 || raw.trim() === "") return DEFAULT_ESCALATION_WAIT_SECONDS * 1e3;
+  const n = Number(raw);
+  return Number.isFinite(n) && n >= 0 ? Math.round(n * 1e3) : DEFAULT_ESCALATION_WAIT_SECONDS * 1e3;
+}
+function onPending(env) {
+  return env.INTENDED_HOOK_ON_PENDING?.trim().toLowerCase() === "ask" ? "ask" : "deny";
+}
 async function evaluateHookDecision(input) {
-  const { event, env } = input;
+  const { event, env, pendingStore } = input;
   const fetchImpl = input.fetchImpl ?? globalThis.fetch;
   const toolName = event.tool_name ?? "unknown";
   const args = { ...event.tool_input ?? {} };
@@ -26,6 +171,21 @@ async function evaluateHookDecision(input) {
   const tenantId = env.INTENDED_TENANT_ID;
   const apiUrl = (env.INTENDED_API_URL ?? "https://api.intended.so").replace(/\/$/, "");
   if (!apiKey || !tenantId) return { permissionDecision: "allow" };
+  const key = toolCallKey(toolName, args);
+  const wait = (intentId) => waitForDecision(intentId, {
+    apiUrl,
+    apiKey,
+    tenantId,
+    fetchImpl,
+    timeoutMs: escalationWaitMs(env),
+    now: input.now,
+    sleep: input.sleep
+  });
+  const pendingIntentId = safe(() => pendingStore?.get(key));
+  if (pendingIntentId) {
+    const outcome = await wait(pendingIntentId);
+    return settle(outcome, pendingIntentId, toolName, key, env, pendingStore);
+  }
   let res;
   try {
     res = await fetchImpl(`${apiUrl}/v1/agent-intent`, {
@@ -56,9 +216,117 @@ async function evaluateHookDecision(input) {
     tokenIssued: Boolean(data.authorityDecisionToken)
   };
   if (verdict === "APPROVED") return { permissionDecision: "allow", record };
-  if (verdict === "ESCALATED") return { permissionDecision: "ask", reason: `Intended: requires human approval \u2014 ${reason}`, record };
+  if (verdict === "ESCALATED") {
+    if (!data.intentId) {
+      return { permissionDecision: "deny", reason: "Intended: escalated without an intent id to wait on \u2014 fail-closed.", record };
+    }
+    const outcome = await wait(data.intentId);
+    return settle(outcome, data.intentId, toolName, key, env, pendingStore, reason);
+  }
   return { permissionDecision: "deny", reason: `Intended: denied \u2014 ${reason || "fail-closed (unrecognized decision)"}`, record };
 }
+function settle(outcome, intentId, toolName, key, env, store, escalationReason = "") {
+  const record = {
+    tool: toolName,
+    verdict: outcome.status === "ALLOW" ? "APPROVED_AFTER_ESCALATION" : outcome.status === "PENDING" ? "ESCALATED" : outcome.status,
+    reason: outcome.reason || escalationReason,
+    intentId,
+    tokenIssued: Boolean(outcome.token)
+  };
+  if (outcome.status === "ALLOW") {
+    safe(() => store?.delete(key));
+    return { permissionDecision: "allow", record };
+  }
+  if (outcome.status === "PENDING") {
+    safe(() => store?.set(key, intentId, outcome.expiresAt));
+    const message = `Intended: awaiting human approval (intent ${intentId}). Ask an approver to approve it in the Intended console, then retry the same tool call; it will be allowed then.` + (outcome.timedOut && /could not be reached/.test(outcome.reason) ? ` (${outcome.reason})` : "");
+    return { permissionDecision: onPending(env), reason: message, record };
+  }
+  safe(() => store?.delete(key));
+  if (outcome.status === "EXPIRED") {
+    return {
+      permissionDecision: "deny",
+      reason: `Intended: denied \u2014 no approver decided before the approval request expired (intent ${intentId}).`,
+      record
+    };
+  }
+  if (outcome.status === "ERROR") {
+    return { permissionDecision: "deny", reason: `Intended: could not get the approval decision \u2014 ${outcome.reason}`, record };
+  }
+  return { permissionDecision: "deny", reason: `Intended: denied \u2014 ${outcome.reason}`, record };
+}
+function safe(fn) {
+  try {
+    return fn();
+  } catch {
+    return void 0;
+  }
+}
+var DEFAULT_TTL_MS = 24 * 60 * 60 * 1e3;
+var FilePendingStore = class {
+  constructor(path, maxEntries = 200, now = Date.now) {
+    this.path = path;
+    this.maxEntries = maxEntries;
+    this.now = now;
+  }
+  path;
+  maxEntries;
+  now;
+  get(key) {
+    const entries = this.load();
+    const e = entries[key];
+    if (!e) return void 0;
+    if (e.expiresAt <= this.now()) {
+      delete entries[key];
+      this.save(entries);
+      return void 0;
+    }
+    return e.intentId;
+  }
+  set(key, intentId, expiresAt) {
+    const entries = this.load();
+    const parsed = expiresAt ? Date.parse(expiresAt) : NaN;
+    entries[key] = {
+      intentId,
+      expiresAt: Number.isFinite(parsed) ? parsed : this.now() + DEFAULT_TTL_MS,
+      savedAt: this.now()
+    };
+    const keys = Object.keys(entries).sort((a, b) => entries[a].savedAt - entries[b].savedAt);
+    for (const k of keys.slice(0, Math.max(0, keys.length - this.maxEntries))) delete entries[k];
+    this.save(entries);
+  }
+  delete(key) {
+    const entries = this.load();
+    if (!(key in entries)) return;
+    delete entries[key];
+    this.save(entries);
+  }
+  /** Read the file and drop expired entries. */
+  load() {
+    let raw;
+    try {
+      raw = JSON.parse(fs.readFileSync(this.path, "utf8"));
+    } catch {
+      return {};
+    }
+    const out = {};
+    if (!raw || typeof raw !== "object") return out;
+    const t = this.now();
+    for (const [k, v] of Object.entries(raw)) {
+      const e = v;
+      if (e && typeof e.intentId === "string" && typeof e.expiresAt === "number" && typeof e.savedAt === "number" && e.expiresAt > t) {
+        out[k] = { intentId: e.intentId, expiresAt: e.expiresAt, savedAt: e.savedAt };
+      }
+    }
+    return out;
+  }
+  save(entries) {
+    fs.mkdirSync(path.dirname(this.path), { recursive: true });
+    const tmp = `${this.path}.${process.pid}.tmp`;
+    fs.writeFileSync(tmp, JSON.stringify(entries, null, 2), { mode: 384 });
+    fs.renameSync(tmp, this.path);
+  }
+};
 
 // src/bin.ts
 async function main() {
@@ -69,7 +337,8 @@ async function main() {
     process.exit(0);
     return;
   }
-  const decision = await evaluateHookDecision({ event, env: process.env });
+  const pendingStore = new FilePendingStore(path.join(os.homedir(), ".intended", "pending.json"));
+  const decision = await evaluateHookDecision({ event, env: process.env, pendingStore });
   if (decision.record) {
     try {
       const dir = path.join(os.homedir(), ".intended");

package/dist/bin.mjs

@@ -1,10 +1,146 @@
 #!/usr/bin/env node
-import { readFileSync, mkdirSync, writeFileSync } from 'fs';
+import { readFileSync, mkdirSync, writeFileSync, renameSync } from 'fs';
 import { homedir } from 'os';
-import { join } from 'path';
+import { join, dirname } from 'path';
+import { createHash } from 'crypto';
+
+var FINAL = /* @__PURE__ */ new Set(["ALLOW", "DENY", "EXPIRED"]);
+var MAX_POLL_SECONDS = 50;
+var MAX_BACKOFF_MS = 1e4;
+var MIN_REPOLL_MS = 1e3;
+var defaultSleep = (ms) => new Promise((r) => setTimeout(r, Math.max(0, ms)));
+function str(v) {
+  return typeof v === "string" && v.length > 0 ? v : null;
+}
+function base(intentId, status, reason) {
+  return {
+    intentId,
+    status,
+    reason,
+    token: null,
+    decidedBy: null,
+    decidedAt: null,
+    escalationId: null,
+    expiresAt: null,
+    receiptUrl: null
+  };
+}
+function parseBody(intentId, body, apiUrl) {
+  const status = body.status;
+  if (status !== "ALLOW" && status !== "DENY" && status !== "PENDING" && status !== "EXPIRED") return null;
+  const receipt = str(body.receiptUrl);
+  return {
+    intentId: str(body.intentId) ?? intentId,
+    status,
+    reason: str(body.reason) ?? `Decision: ${status}`,
+    token: status === "ALLOW" ? str(body.token) : null,
+    decidedBy: body.decidedBy && typeof body.decidedBy === "object" ? body.decidedBy : null,
+    decidedAt: str(body.decidedAt),
+    escalationId: str(body.escalationId),
+    expiresAt: str(body.expiresAt),
+    receiptUrl: receipt ? /^https?:\/\//.test(receipt) ? receipt : `${apiUrl}${receipt.startsWith("/") ? "" : "/"}${receipt}` : null
+  };
+}
+function retryAfterHeaderMs(res) {
+  const raw = res.headers?.get?.("retry-after");
+  const n = raw == null ? NaN : Number(raw);
+  return Number.isFinite(n) && n > 0 ? n * 1e3 : 0;
+}
+async function waitForDecision(intentId, opts) {
+  const apiUrl = (opts.apiUrl ?? "https://api.intended.so").replace(/\/$/, "");
+  const fetchImpl = opts.fetchImpl ?? fetch;
+  const now = opts.now ?? Date.now;
+  const sleep = opts.sleep ?? defaultSleep;
+  const deadline = now() + Math.max(0, opts.timeoutMs);
+  const headers = {
+    authorization: `Bearer ${opts.apiKey}`,
+    "x-tenant-id": opts.tenantId
+  };
+  let backoffMs = 1e3;
+  for (; ; ) {
+    const remaining = deadline - now();
+    const timeoutSec = remaining <= 0 ? 0 : Math.min(MAX_POLL_SECONDS, Math.ceil(remaining / 1e3));
+    const url = `${apiUrl}/v1/decisions/${encodeURIComponent(intentId)}/wait?timeout=${timeoutSec}&tenantId=${encodeURIComponent(opts.tenantId)}`;
+    const startedAt = now();
+    let res = null;
+    try {
+      res = await fetchImpl(url, {
+        headers,
+        // The server holds at most timeoutSec; give the network some slack beyond that.
+        signal: AbortSignal.timeout(timeoutSec * 1e3 + 15e3)
+      });
+    } catch {
+      res = null;
+    }
+    let transientWaitMs = 0;
+    if (res) {
+      if (res.status === 401) {
+        return { ...base(intentId, "ERROR", "The Intended API rejected the API key (401). The action is not approved."), error: "unauthorized" };
+      }
+      if (res.status === 403) {
+        return {
+          ...base(
+            intentId,
+            "ERROR",
+            "This API key cannot read decisions: it needs the intent:read scope. The action is not approved."
+          ),
+          error: "forbidden"
+        };
+      }
+      if (res.status === 404) {
+        return { ...base(intentId, "ERROR", `Intended has no decision for intent ${intentId}. The action is not approved.`), error: "not_found" };
+      }
+      if (res.status === 429 || res.status >= 500) {
+        transientWaitMs = Math.max(backoffMs, retryAfterHeaderMs(res));
+      } else {
+        const body = await res.json().catch(() => null);
+        const parsed = res.status === 200 && body ? parseBody(intentId, body, apiUrl) : null;
+        if (!parsed) {
+          return {
+            ...base(intentId, "ERROR", `Unrecognised decision response (HTTP ${res.status}). The action is not approved.`),
+            error: "bad_response"
+          };
+        }
+        if (FINAL.has(parsed.status)) return parsed;
+        if (now() >= deadline) return { ...parsed, timedOut: true };
+        const retryAfterMs = typeof body?.retryAfterMs === "number" && body.retryAfterMs > 0 ? body.retryAfterMs : 0;
+        const answeredFast = now() - startedAt < Math.min(timeoutSec * 1e3, MIN_REPOLL_MS) / 2;
+        const pause = retryAfterMs > 0 ? retryAfterMs : answeredFast ? MIN_REPOLL_MS : 0;
+        if (pause > 0) await sleep(Math.min(pause, Math.max(0, deadline - now())));
+        backoffMs = 1e3;
+        continue;
+      }
+    } else {
+      transientWaitMs = backoffMs;
+    }
+    if (now() >= deadline) {
+      return {
+        ...base(
+          intentId,
+          "PENDING",
+          "The Intended decision service could not be reached before the wait ended. The action is still not approved."
+        ),
+        timedOut: true
+      };
+    }
+    await sleep(Math.min(transientWaitMs, Math.max(0, deadline - now())));
+    backoffMs = Math.min(backoffMs * 2, MAX_BACKOFF_MS);
+  }
+}
+function canonicalJson(value) {
+  if (value === null || typeof value !== "object") return JSON.stringify(value) ?? "null";
+  if (Array.isArray(value)) return `[${value.map(canonicalJson).join(",")}]`;
+  const obj = value;
+  return `{${Object.keys(obj).sort().filter((k) => obj[k] !== void 0).map((k) => `${JSON.stringify(k)}:${canonicalJson(obj[k])}`).join(",")}}`;
+}
+function toolCallKey(toolName, args) {
+  return createHash("sha256").update(`${toolName}
+${canonicalJson(args ?? {})}`).digest("hex");
+}
 
 // src/evaluate.ts
 var AUTHORITY_STATUSES = /* @__PURE__ */ new Set([200, 202, 403]);
+var DEFAULT_ESCALATION_WAIT_SECONDS = 45;
 var MAX_DESCRIBED_KEYS = 20;
 var SAFE_KEY = /^[A-Za-z_][A-Za-z0-9_.-]{0,63}$/;
 function describeToolCall(name, args) {
@@ -15,8 +151,17 @@ function describeToolCall(name, args) {
   const list = [...named, ...unnamed > 0 ? [`+${unnamed} more`] : []].join(", ");
   return `Call tool "${name}" with args: ${list}`;
 }
+function escalationWaitMs(env) {
+  const raw = env.INTENDED_HOOK_ESCALATION_WAIT_SECONDS;
+  if (raw === void 0 || raw.trim() === "") return DEFAULT_ESCALATION_WAIT_SECONDS * 1e3;
+  const n = Number(raw);
+  return Number.isFinite(n) && n >= 0 ? Math.round(n * 1e3) : DEFAULT_ESCALATION_WAIT_SECONDS * 1e3;
+}
+function onPending(env) {
+  return env.INTENDED_HOOK_ON_PENDING?.trim().toLowerCase() === "ask" ? "ask" : "deny";
+}
 async function evaluateHookDecision(input) {
-  const { event, env } = input;
+  const { event, env, pendingStore } = input;
   const fetchImpl = input.fetchImpl ?? globalThis.fetch;
   const toolName = event.tool_name ?? "unknown";
   const args = { ...event.tool_input ?? {} };
@@ -24,6 +169,21 @@ async function evaluateHookDecision(input) {
   const tenantId = env.INTENDED_TENANT_ID;
   const apiUrl = (env.INTENDED_API_URL ?? "https://api.intended.so").replace(/\/$/, "");
   if (!apiKey || !tenantId) return { permissionDecision: "allow" };
+  const key = toolCallKey(toolName, args);
+  const wait = (intentId) => waitForDecision(intentId, {
+    apiUrl,
+    apiKey,
+    tenantId,
+    fetchImpl,
+    timeoutMs: escalationWaitMs(env),
+    now: input.now,
+    sleep: input.sleep
+  });
+  const pendingIntentId = safe(() => pendingStore?.get(key));
+  if (pendingIntentId) {
+    const outcome = await wait(pendingIntentId);
+    return settle(outcome, pendingIntentId, toolName, key, env, pendingStore);
+  }
   let res;
   try {
     res = await fetchImpl(`${apiUrl}/v1/agent-intent`, {
@@ -54,9 +214,117 @@ async function evaluateHookDecision(input) {
     tokenIssued: Boolean(data.authorityDecisionToken)
   };
   if (verdict === "APPROVED") return { permissionDecision: "allow", record };
-  if (verdict === "ESCALATED") return { permissionDecision: "ask", reason: `Intended: requires human approval \u2014 ${reason}`, record };
+  if (verdict === "ESCALATED") {
+    if (!data.intentId) {
+      return { permissionDecision: "deny", reason: "Intended: escalated without an intent id to wait on \u2014 fail-closed.", record };
+    }
+    const outcome = await wait(data.intentId);
+    return settle(outcome, data.intentId, toolName, key, env, pendingStore, reason);
+  }
   return { permissionDecision: "deny", reason: `Intended: denied \u2014 ${reason || "fail-closed (unrecognized decision)"}`, record };
 }
+function settle(outcome, intentId, toolName, key, env, store, escalationReason = "") {
+  const record = {
+    tool: toolName,
+    verdict: outcome.status === "ALLOW" ? "APPROVED_AFTER_ESCALATION" : outcome.status === "PENDING" ? "ESCALATED" : outcome.status,
+    reason: outcome.reason || escalationReason,
+    intentId,
+    tokenIssued: Boolean(outcome.token)
+  };
+  if (outcome.status === "ALLOW") {
+    safe(() => store?.delete(key));
+    return { permissionDecision: "allow", record };
+  }
+  if (outcome.status === "PENDING") {
+    safe(() => store?.set(key, intentId, outcome.expiresAt));
+    const message = `Intended: awaiting human approval (intent ${intentId}). Ask an approver to approve it in the Intended console, then retry the same tool call; it will be allowed then.` + (outcome.timedOut && /could not be reached/.test(outcome.reason) ? ` (${outcome.reason})` : "");
+    return { permissionDecision: onPending(env), reason: message, record };
+  }
+  safe(() => store?.delete(key));
+  if (outcome.status === "EXPIRED") {
+    return {
+      permissionDecision: "deny",
+      reason: `Intended: denied \u2014 no approver decided before the approval request expired (intent ${intentId}).`,
+      record
+    };
+  }
+  if (outcome.status === "ERROR") {
+    return { permissionDecision: "deny", reason: `Intended: could not get the approval decision \u2014 ${outcome.reason}`, record };
+  }
+  return { permissionDecision: "deny", reason: `Intended: denied \u2014 ${outcome.reason}`, record };
+}
+function safe(fn) {
+  try {
+    return fn();
+  } catch {
+    return void 0;
+  }
+}
+var DEFAULT_TTL_MS = 24 * 60 * 60 * 1e3;
+var FilePendingStore = class {
+  constructor(path, maxEntries = 200, now = Date.now) {
+    this.path = path;
+    this.maxEntries = maxEntries;
+    this.now = now;
+  }
+  path;
+  maxEntries;
+  now;
+  get(key) {
+    const entries = this.load();
+    const e = entries[key];
+    if (!e) return void 0;
+    if (e.expiresAt <= this.now()) {
+      delete entries[key];
+      this.save(entries);
+      return void 0;
+    }
+    return e.intentId;
+  }
+  set(key, intentId, expiresAt) {
+    const entries = this.load();
+    const parsed = expiresAt ? Date.parse(expiresAt) : NaN;
+    entries[key] = {
+      intentId,
+      expiresAt: Number.isFinite(parsed) ? parsed : this.now() + DEFAULT_TTL_MS,
+      savedAt: this.now()
+    };
+    const keys = Object.keys(entries).sort((a, b) => entries[a].savedAt - entries[b].savedAt);
+    for (const k of keys.slice(0, Math.max(0, keys.length - this.maxEntries))) delete entries[k];
+    this.save(entries);
+  }
+  delete(key) {
+    const entries = this.load();
+    if (!(key in entries)) return;
+    delete entries[key];
+    this.save(entries);
+  }
+  /** Read the file and drop expired entries. */
+  load() {
+    let raw;
+    try {
+      raw = JSON.parse(readFileSync(this.path, "utf8"));
+    } catch {
+      return {};
+    }
+    const out = {};
+    if (!raw || typeof raw !== "object") return out;
+    const t = this.now();
+    for (const [k, v] of Object.entries(raw)) {
+      const e = v;
+      if (e && typeof e.intentId === "string" && typeof e.expiresAt === "number" && typeof e.savedAt === "number" && e.expiresAt > t) {
+        out[k] = { intentId: e.intentId, expiresAt: e.expiresAt, savedAt: e.savedAt };
+      }
+    }
+    return out;
+  }
+  save(entries) {
+    mkdirSync(dirname(this.path), { recursive: true });
+    const tmp = `${this.path}.${process.pid}.tmp`;
+    writeFileSync(tmp, JSON.stringify(entries, null, 2), { mode: 384 });
+    renameSync(tmp, this.path);
+  }
+};
 
 // src/bin.ts
 async function main() {
@@ -67,7 +335,8 @@ async function main() {
     process.exit(0);
     return;
   }
-  const decision = await evaluateHookDecision({ event, env: process.env });
+  const pendingStore = new FilePendingStore(join(homedir(), ".intended", "pending.json"));
+  const decision = await evaluateHookDecision({ event, env: process.env, pendingStore });
   if (decision.record) {
     try {
       const dir = join(homedir(), ".intended");