@intutic/gate 2.2.0 → 2.4.0

package/README.md

@@ -35,8 +35,9 @@ const guardedTools = wrapTools(myTools) // array or {name: tool} record
 ```
 
 On a refused call, the wrapped tool throws `IntuticGateRefusal` (message
-prefixed `[Intutic Governance] BLOCKED:`) BEFORE the real implementation
-runs — this package's throw-based refusal contract, the same one
+prefixed `[Intutic Governance] BLOCKED:`, or `IntuticGateHold`, prefixed
+`[Intutic Governance] HELD:`, for a call held for approval) BEFORE the real
+implementation runs — this package's throw-based refusal contract, the same one
 `services/sync-daemon/src/harness/gateBody.ts`'s emitted gates and
 `packages/mcp-proxy/src/policy.ts` use elsewhere in this repo's gate
 vocabulary.
@@ -45,16 +46,30 @@ vocabulary.
 
 | Export | From | What it is |
 |---|---|---|
-| `Gate`, `GateConfig` | `gate.ts` | The four-tier evaluator. `new Gate(cfg, client?)`, `await gate.guard(toolName, toolInput)`. |
+| `Gate`, `GateConfig` | `gate.ts` | The six-tier evaluator. `new Gate(cfg, client?)`, `await gate.guard(toolName, toolInput)`. |
 | `install(gate)`, `active()` | `gate.ts` | Process-wide default gate, so wrapped tools don't need the instance threaded through every call site. |
-| `IntuticGateRefusal`, `GateError`, `GateConnectionError` | `errors.ts` | Thrown on refusal. `.reason`, `.code`, `.incidentId` carry the structured verdict; `.message` carries the `[Intutic Governance] BLOCKED: ...` text. |
+| `IntuticGateRefusal`, `GateError`, `GateConnectionError` | `errors.ts` | Thrown on refusal. `.reason`, `.code` (a `GateRefusalCode`, listed in `GATE_REFUSAL_CODES`), `.incidentId` carry the structured verdict; `.message` carries the `[Intutic Governance] BLOCKED: ...` text. |
+| `IntuticGateHold` | `errors.ts` | The `IntuticGateRefusal` a hold rule throws (`code` `HELD`) after recording the hold for approval; `.holdId` names it. See `hold.ts`. |
 | `GateClient` | `client.ts` | Control-plane client (`hookGate`, `emit`, `GateClient.fromEnv(...)`). |
 | `wrapTool(fn \| tool, opts?)`, `wrapTools(list \| record, gate?)` | `wrapTools.ts` | Generic wrapping for a plain async function or an `{ execute, ... }`-shaped tool object. **This is the integration point for any JS framework without a dedicated adapter — LangChain.js included.** |
 | `intuticHeaders(opts?)` | `headers.ts` | Headers for a proxy-pointed HTTP/OpenAI-compatible client (`x-session-id`, `x-workspace-id`, `x-intutic-harness`). |
 | `loadSnapshot`, `evaluate`, `Snapshot`, `guardDisabledFromEnv` | `snapshot.ts` | Tier A1: reads `~/.intutic/hooks/policy-snapshot.rules`. |
 | `parseRules`, `firstMatch`, `fetchRules`, `SopRule` | `soprules.ts` | Tier A3: SOP-authored `WHERE`-clause rules. |
 | `checkCommand`, `checkImages`, `checkWrittenManifest`, `ImageVerdict` | `imagecheck.ts` | Tier A2: container-image provenance on deploy commands. |
+| `McpRegistryRecord`, `McpAllowlistRecord` | `mcpRegistryRecord.ts` | Tier M: the snapshot's MCP server registry and allowlist (`Snapshot.mcpRegistry`, `Snapshot.mcpAllowlist`), decided as the hook gates and the MCP proxy decide them; a byte-identical copy of `@intutic/shared-types`' module. |
 | `classify`, `isDeploy`, `isTest`, `touchesInfra` | `actions.ts` | Command classifier shared by A2's deploy trigger. |
+| `canonicalJson`, `holdKey`, `holdMessage` | `hold.ts` | The hold helpers: key-sorted JSON, the tool name and argument hash an approved hold is matched on, and the message a held call carries. |
+| `COMMAND_SIZE_LIMIT`, `ARGUMENTS_SIZE_LIMIT`, `GATE_DEADLINE_MS` | `limits.ts` | A command over 256 KiB or arguments over 1 MiB are refused with `COMMAND_TOO_LARGE` before any tier runs. `GATE_DEADLINE_MS` (9000) is how long the hook script `intuticSandboxBootstrap()` writes may evaluate, from process start, before it refuses with `GATE_DEADLINE`: one second under that hook entry's 10-second timeout, so a slow rule is refused rather than left to the harness. |
+
+The snapshot must carry the `#digest <hash>` line the sync daemon writes (the
+first 32 hex characters of the SHA-256 of its non-comment lines) and, when the
+gate is given a workspace id, that workspace's id. A file without the line, or
+one whose digest or workspace does not match, is not trusted: its rules are
+dropped, the SSO group policy still refuses, and every MCP call is refused with
+`POLICY_SNAPSHOT_UNVERIFIED`. A hand-written snapshot for a test needs the line
+too.
+
+Full reference: [Gate SDK](https://docs.intutic.ai/reference/gate-sdk).
 
 ### A note for sibling adapter phases
 
@@ -159,10 +174,11 @@ to match. Confirmed against `@ai-sdk/harness@1.0.75` and re-verified on
   `PreToolUse` hook + `.claude/settings.json` directly into the sandbox
   filesystem via `HarnessAgentSettings.sandboxConfig.onBootstrap` — the only
   way to put anything resembling the native Intutic gate inside the
-  microVM. Claude Code only; a strict subset of a laptop gate (no SOP tier,
-  review-hold, or event draining — those need a live control-plane
-  connection a bootstrap function can't have). Spread its output into
-  `sandboxConfig` alongside `recommendedHarnessSettings()`. See TD-417 and
+  microVM. Claude Code only; a strict subset of a laptop gate (no SOP tier
+  or event draining, and a hold rule refuses the call outright because no
+  approval can be requested — those need a live control-plane connection a
+  bootstrap function can't have). Spread its output into
+  `sandboxConfig` alongside `recommendedHarnessSettings()`. See
   `apps/docs/integrations/ai-sdk-harness.md` for what has and hasn't been
   live-verified.
 
@@ -206,7 +222,8 @@ arrives — a real, documented pre-execution veto ("Denied tools do not run.").
 `IntuticSessionConfirmer` answers those pauses with a `Gate.guard()` verdict,
 via polling, a webhook (`session.requires_action`), or a live stream. A tool
 configured `always_allow` never pauses and is therefore never seen by
-Intutic at all — see TD-425.
+Intutic at all — coverage is opt-in per tool, so configure `always_ask` on
+every tool you want gated.
 
 `agent.custom_tool_use` (your own tools) has no pause concept — it is gated
 at the point YOUR code executes it instead, via
@@ -215,7 +232,7 @@ at the point YOUR code executes it instead, via
 does not apply here). See `apps/docs/integrations/anthropic-managed-agents.md`
 for the full operator-facing version, including the self-hosted
 `EnvironmentWorker` coverage story and the Python-side custom-tool decorator
-ordering gotcha (TD-427).
+ordering gotcha.
 
 ## Subpath convention
 
@@ -227,7 +244,7 @@ Eight adapters exist today, one source file each: `@intutic/gate/dsh`
 `@intutic/gate/eve` (`src/eve.ts` — approval policies for eve's
 per-tool/per-connection `approval` surface, plus the observe-only
 `intuticAuditHooks()`; verified against a pinned `eve@0.71.0` install — a
-pre-1.0 Preview product, see its module doc and TD-410), `@intutic/gate/harness`
+pre-1.0 Preview product, see its module doc), `@intutic/gate/harness`
 (`src/harness.ts` — see above), `@intutic/gate/workflow` (`src/workflow.ts`
 — see above), and `@intutic/gate/managed-agents` (`src/managedAgents.ts` — see
 above). Later adapter phases follow the SAME convention (also
@@ -247,7 +264,7 @@ above). Later adapter phases follow the SAME convention (also
    ```
 4. Each adapter file imports from `./gate.js`, `./errors.js`, etc. (this
    package's core, already built) rather than re-implementing any tier —
-   the whole point of splitting core from adapters is that the four-tier
+   the whole point of splitting core from adapters is that the tiered
    evaluation logic lives in exactly one place.
 
 No stub files are checked in for future adapters; the `exports` map above

package/dist/actions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"actions.d.ts","sourceRoot":"","sources":["../src/actions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,eAAO,MAAM,aAAa,YAAY,CAAA;AAEtC,0DAA0D;AAC1D,eAAO,MAAM,eAAe,EAAE,SAAS,MAAM,EAe5C,CAAA;AAED,yEAAyE;AACzE,eAAO,MAAM,gBAAgB,EAAE,SAAS,MAAM,EAS7C,CAAA;AAED,mCAAmC;AACnC,eAAO,MAAM,gBAAgB,EAAE,SAAS,MAAM,EAO7C,CAAA;AAED,sCAAsC;AACtC,eAAO,MAAM,aAAa,EAAE,SAAS,MAAM,EAqB1C,CAAA;AAED,0DAA0D;AAC1D,eAAO,MAAM,kBAAkB,EAAE,SAAS,MAAM,EAO/C,CAAA;AAED,yCAAyC;AACzC,eAAO,MAAM,iBAAiB,EAAE,SAAS,MAAM,EAO9C,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,EAAE,SAAS,MAAM,EAclD,CAAA;AAED,qEAAqE;AACrE,eAAO,MAAM,kBAAkB,EAAE,SAAS,MAAM,EAO/C,CAAA;AAED,0DAA0D;AAC1D,eAAO,MAAM,WAAW,EAAE,SAAS,MAAM,EAUxC,CAAA;AAED,kDAAkD;AAClD,eAAO,MAAM,UAAU,EAAE,SAAS,MAAM,EAAqD,CAAA;AAE7F,kDAAkD;AAClD,eAAO,MAAM,WAAW,EAAE,SAAS,MAAM,EAAmE,CAAA;AAE5G;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,EAAE,SAAS,MAAM,EASjD,CAAA;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAUnD;AAED,wBAAgB,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAEjF;AAED;;;;GAIG;AACH,wBAAgB,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAGtE;AAED;;;;;;GAMG;AACH,wBAAgB,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,GAAG,MAAM,EAAE,CAoBvE;AAED,0EAA0E;AAC1E,wBAAgB,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,GAAG,OAAO,CAEtE;AAED,wBAAgB,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,GAAG,OAAO,CAEpE;AAED,0DAA0D;AAC1D,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAErE"}
+{"version":3,"file":"actions.d.ts","sourceRoot":"","sources":["../src/actions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAIH,eAAO,MAAM,aAAa,YAAY,CAAA;AAEtC,0DAA0D;AAC1D,eAAO,MAAM,eAAe,EAAE,SAAS,MAAM,EAe5C,CAAA;AAED,yEAAyE;AACzE,eAAO,MAAM,gBAAgB,EAAE,SAAS,MAAM,EAS7C,CAAA;AAED,mCAAmC;AACnC,eAAO,MAAM,gBAAgB,EAAE,SAAS,MAAM,EAO7C,CAAA;AAED,sCAAsC;AACtC,eAAO,MAAM,aAAa,EAAE,SAAS,MAAM,EAqB1C,CAAA;AAED,0DAA0D;AAC1D,eAAO,MAAM,kBAAkB,EAAE,SAAS,MAAM,EAO/C,CAAA;AAED,yCAAyC;AACzC,eAAO,MAAM,iBAAiB,EAAE,SAAS,MAAM,EAS9C,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,EAAE,SAAS,MAAM,EAclD,CAAA;AAED,qEAAqE;AACrE,eAAO,MAAM,kBAAkB,EAAE,SAAS,MAAM,EAO/C,CAAA;AAED,0DAA0D;AAC1D,eAAO,MAAM,WAAW,EAAE,SAAS,MAAM,EAYxC,CAAA;AAED,kDAAkD;AAClD,eAAO,MAAM,UAAU,EAAE,SAAS,MAAM,EAAqD,CAAA;AAE7F,kDAAkD;AAClD,eAAO,MAAM,WAAW,EAAE,SAAS,MAAM,EAAmE,CAAA;AAE5G;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,EAAE,SAAS,MAAM,EASjD,CAAA;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAUnD;AAUD,wBAAgB,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAEjF;AAED;;;;GAIG;AACH,wBAAgB,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAGtE;AAED;;;;;;GAMG;AACH,wBAAgB,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,GAAG,MAAM,EAAE,CAsBvE;AAED,0EAA0E;AAC1E,wBAAgB,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,GAAG,OAAO,CAEtE;AAED,wBAAgB,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,GAAG,OAAO,CAEpE;AAED,0DAA0D;AAC1D,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAErE"}

package/dist/actions.js

@@ -17,6 +17,7 @@
  * Note the trailing spaces in `'update '`, `'truncate '` and `'curl -d '` —
  * they are load-bearing and must survive editing.
  */
+import { hasPhrase, phraseText } from './phrases.js';
 export const ACTION_PREFIX = 'action:';
 /** Commands that put code or artefacts somewhere real. */
 export const DEPLOY_PATTERNS = [
@@ -93,6 +94,8 @@ export const DB_WRITE_PATTERNS = [
     'update ',
     'delete from',
     'drop table',
+    'drop database',
+    'drop schema',
     'truncate ',
     'alter table',
 ];
@@ -134,6 +137,8 @@ export const SHELL_TOOLS = [
     'runcommand',
     // Cline / Roo Code's shell tool (kept in step with the Rust SHELL_TOOLS).
     'execute_command',
+    // Gemini CLI's shell tool.
+    'run_shell_command',
     'terminal',
     'execute',
     'exec',
@@ -181,6 +186,13 @@ export function flattenInput(value) {
     // Numbers, booleans and null/undefined contribute nothing.
     return '';
 }
+/**
+ * Does `words` contain any of `patterns`, whatever separates each phrase's
+ * words? A one-word pattern is a plain substring (see phrases.ts).
+ */
+function matchesPhrase(words, patterns) {
+    return patterns.some((p) => hasPhrase(words, p));
+}
 export function matchesAny(haystack, patterns) {
     return patterns.some((p) => haystack.includes(p));
 }
@@ -203,16 +215,18 @@ export function toolIs(name, group) {
 export function classify(toolName, toolInput) {
     const args = flattenInput(toolInput);
     const actions = [];
+    // Cut into words once, for every phrase list below (see phrases.ts).
+    const words = phraseText(args);
     if (toolIs(toolName, SHELL_TOOLS)) {
         // Tests first: `make test && git push` is both, and the ordering rule
         // needs the test to be seen as having happened before the deploy.
-        if (matchesAny(args, TEST_PATTERNS))
+        if (matchesPhrase(words, TEST_PATTERNS))
             actions.push('run_tests');
-        if (matchesAny(args, DEPLOY_PATTERNS))
+        if (matchesPhrase(words, DEPLOY_PATTERNS))
             actions.push('deploy');
-        if (matchesAny(args, PUBLISH_PATTERNS))
+        if (matchesPhrase(words, PUBLISH_PATTERNS))
             actions.push('publish');
-        if (matchesAny(args, RELEASE_PATTERNS))
+        if (matchesPhrase(words, RELEASE_PATTERNS))
             actions.push('release');
         // Source before sink, so that (secret_read -> http_post) can still fire
         // on a single command that does both.
@@ -220,9 +234,9 @@ export function classify(toolName, toolInput) {
             actions.push('secret_read');
         if (matchesAny(args, PII_PATH_FRAGMENTS))
             actions.push('pii_export');
-        if (matchesAny(args, HTTP_POST_PATTERNS))
+        if (matchesPhrase(words, HTTP_POST_PATTERNS))
             actions.push('http_post');
-        if (matchesAny(args, DB_WRITE_PATTERNS))
+        if (matchesPhrase(words, DB_WRITE_PATTERNS))
             actions.push('db_write');
     }
     return actions.map((a) => ACTION_PREFIX + a);

package/dist/actions.js.map

@@ -1 +1 @@
-{"version":3,"file":"actions.js","sourceRoot":"","sources":["../src/actions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,MAAM,CAAC,MAAM,aAAa,GAAG,SAAS,CAAA;AAEtC,0DAA0D;AAC1D,MAAM,CAAC,MAAM,eAAe,GAAsB;IAChD,UAAU;IACV,eAAe;IACf,iBAAiB;IACjB,cAAc;IACd,cAAc;IACd,iBAAiB;IACjB,aAAa;IACb,mBAAmB;IACnB,YAAY;IACZ,eAAe;IACf,mBAAmB;IACnB,YAAY;IACZ,aAAa;IACb,WAAW;CACZ,CAAA;AAED,yEAAyE;AACzE,MAAM,CAAC,MAAM,gBAAgB,GAAsB;IACjD,aAAa;IACb,cAAc;IACd,cAAc;IACd,eAAe;IACf,cAAc;IACd,gBAAgB;IAChB,UAAU;IACV,sBAAsB;CACvB,CAAA;AAED,mCAAmC;AACnC,MAAM,CAAC,MAAM,gBAAgB,GAAsB;IACjD,mBAAmB;IACnB,SAAS;IACT,aAAa;IACb,eAAe;IACf,oBAAoB;IACpB,kBAAkB;CACnB,CAAA;AAED,sCAAsC;AACtC,MAAM,CAAC,MAAM,aAAa,GAAsB;IAC9C,UAAU;IACV,cAAc;IACd,WAAW;IACX,eAAe;IACf,WAAW;IACX,YAAY;IACZ,SAAS;IACT,QAAQ;IACR,kBAAkB;IAClB,QAAQ;IACR,MAAM;IACN,OAAO;IACP,OAAO;IACP,SAAS;IACT,WAAW;IACX,aAAa;IACb,UAAU;IACV,aAAa;IACb,YAAY;IACZ,KAAK;CACN,CAAA;AAED,0DAA0D;AAC1D,MAAM,CAAC,MAAM,kBAAkB,GAAsB;IACnD,cAAc;IACd,qBAAqB;IACrB,UAAU;IACV,aAAa;IACb,aAAa;IACb,WAAW;CACZ,CAAA;AAED,yCAAyC;AACzC,MAAM,CAAC,MAAM,iBAAiB,GAAsB;IAClD,aAAa;IACb,SAAS;IACT,aAAa;IACb,YAAY;IACZ,WAAW;IACX,aAAa;CACd,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAsB;IACtD,MAAM;IACN,aAAa;IACb,QAAQ;IACR,YAAY;IACZ,MAAM;IACN,MAAM;IACN,MAAM;IACN,UAAU;IACV,QAAQ;IACR,OAAO;IACP,OAAO;IACP,YAAY;IACZ,iBAAiB;CAClB,CAAA;AAED,qEAAqE;AACrE,MAAM,CAAC,MAAM,kBAAkB,GAAsB;IACnD,UAAU;IACV,WAAW;IACX,KAAK;IACL,UAAU;IACV,MAAM;IACN,SAAS;CACV,CAAA;AAED,0DAA0D;AAC1D,MAAM,CAAC,MAAM,WAAW,GAAsB;IAC5C,MAAM;IACN,OAAO;IACP,aAAa;IACb,YAAY;IACZ,0EAA0E;IAC1E,iBAAiB;IACjB,UAAU;IACV,SAAS;IACT,MAAM;CACP,CAAA;AAED,kDAAkD;AAClD,MAAM,CAAC,MAAM,UAAU,GAAsB,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,CAAC,CAAA;AAE7F,kDAAkD;AAClD,MAAM,CAAC,MAAM,WAAW,GAAsB,CAAC,UAAU,EAAE,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,YAAY,CAAC,CAAA;AAE5G;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAsB;IACrD,WAAW;IACX,KAAK;IACL,MAAM;IACN,aAAa;IACb,OAAO;IACP,YAAY;IACZ,gBAAgB;IAChB,UAAU;CACX,CAAA;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,YAAY,CAAC,KAAc;IACzC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC,WAAW,EAAE,CAAA;IACzD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IACjF,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,OAAO,MAAM,CAAC,MAAM,CAAC,KAAgC,CAAC;aACnD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;aACjC,IAAI,CAAC,EAAE,CAAC,CAAA;IACb,CAAC;IACD,2DAA2D;IAC3D,OAAO,EAAE,CAAA;AACX,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,QAAgB,EAAE,QAA2B;IACtE,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAA;AACnD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,MAAM,CAAC,IAAY,EAAE,KAAwB;IAC3D,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAA;IAChC,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAA;AAC5D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,QAAQ,CAAC,QAAgB,EAAE,SAAkB;IAC3D,MAAM,IAAI,GAAG,YAAY,CAAC,SAAS,CAAC,CAAA;IACpC,MAAM,OAAO,GAAa,EAAE,CAAA;IAE5B,IAAI,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,CAAC;QAClC,sEAAsE;QACtE,kEAAkE;QAClE,IAAI,UAAU,CAAC,IAAI,EAAE,aAAa,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;QAC9D,IAAI,UAAU,CAAC,IAAI,EAAE,eAAe,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QAC7D,IAAI,UAAU,CAAC,IAAI,EAAE,gBAAgB,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QAC/D,IAAI,UAAU,CAAC,IAAI,EAAE,gBAAgB,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QAC/D,wEAAwE;QACxE,sCAAsC;QACtC,IAAI,UAAU,CAAC,IAAI,EAAE,qBAAqB,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;QACxE,IAAI,UAAU,CAAC,IAAI,EAAE,kBAAkB,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;QACpE,IAAI,UAAU,CAAC,IAAI,EAAE,kBAAkB,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;QACnE,IAAI,UAAU,CAAC,IAAI,EAAE,iBAAiB,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IACnE,CAAC;IAED,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,GAAG,CAAC,CAAC,CAAA;AAC9C,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,QAAQ,CAAC,QAAgB,EAAE,SAAkB;IAC3D,OAAO,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,aAAa,GAAG,QAAQ,CAAC,CAAA;AACzE,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,QAAgB,EAAE,SAAkB;IACzD,OAAO,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,aAAa,GAAG,WAAW,CAAC,CAAA;AAC5E,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,YAAY,CAAC,IAA+B;IAC1D,OAAO,UAAU,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,oBAAoB,CAAC,CAAA;AACrE,CAAC"}
+{"version":3,"file":"actions.js","sourceRoot":"","sources":["../src/actions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,SAAS,EAAE,UAAU,EAAmB,MAAM,cAAc,CAAA;AAErE,MAAM,CAAC,MAAM,aAAa,GAAG,SAAS,CAAA;AAEtC,0DAA0D;AAC1D,MAAM,CAAC,MAAM,eAAe,GAAsB;IAChD,UAAU;IACV,eAAe;IACf,iBAAiB;IACjB,cAAc;IACd,cAAc;IACd,iBAAiB;IACjB,aAAa;IACb,mBAAmB;IACnB,YAAY;IACZ,eAAe;IACf,mBAAmB;IACnB,YAAY;IACZ,aAAa;IACb,WAAW;CACZ,CAAA;AAED,yEAAyE;AACzE,MAAM,CAAC,MAAM,gBAAgB,GAAsB;IACjD,aAAa;IACb,cAAc;IACd,cAAc;IACd,eAAe;IACf,cAAc;IACd,gBAAgB;IAChB,UAAU;IACV,sBAAsB;CACvB,CAAA;AAED,mCAAmC;AACnC,MAAM,CAAC,MAAM,gBAAgB,GAAsB;IACjD,mBAAmB;IACnB,SAAS;IACT,aAAa;IACb,eAAe;IACf,oBAAoB;IACpB,kBAAkB;CACnB,CAAA;AAED,sCAAsC;AACtC,MAAM,CAAC,MAAM,aAAa,GAAsB;IAC9C,UAAU;IACV,cAAc;IACd,WAAW;IACX,eAAe;IACf,WAAW;IACX,YAAY;IACZ,SAAS;IACT,QAAQ;IACR,kBAAkB;IAClB,QAAQ;IACR,MAAM;IACN,OAAO;IACP,OAAO;IACP,SAAS;IACT,WAAW;IACX,aAAa;IACb,UAAU;IACV,aAAa;IACb,YAAY;IACZ,KAAK;CACN,CAAA;AAED,0DAA0D;AAC1D,MAAM,CAAC,MAAM,kBAAkB,GAAsB;IACnD,cAAc;IACd,qBAAqB;IACrB,UAAU;IACV,aAAa;IACb,aAAa;IACb,WAAW;CACZ,CAAA;AAED,yCAAyC;AACzC,MAAM,CAAC,MAAM,iBAAiB,GAAsB;IAClD,aAAa;IACb,SAAS;IACT,aAAa;IACb,YAAY;IACZ,eAAe;IACf,aAAa;IACb,WAAW;IACX,aAAa;CACd,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAsB;IACtD,MAAM;IACN,aAAa;IACb,QAAQ;IACR,YAAY;IACZ,MAAM;IACN,MAAM;IACN,MAAM;IACN,UAAU;IACV,QAAQ;IACR,OAAO;IACP,OAAO;IACP,YAAY;IACZ,iBAAiB;CAClB,CAAA;AAED,qEAAqE;AACrE,MAAM,CAAC,MAAM,kBAAkB,GAAsB;IACnD,UAAU;IACV,WAAW;IACX,KAAK;IACL,UAAU;IACV,MAAM;IACN,SAAS;CACV,CAAA;AAED,0DAA0D;AAC1D,MAAM,CAAC,MAAM,WAAW,GAAsB;IAC5C,MAAM;IACN,OAAO;IACP,aAAa;IACb,YAAY;IACZ,0EAA0E;IAC1E,iBAAiB;IACjB,2BAA2B;IAC3B,mBAAmB;IACnB,UAAU;IACV,SAAS;IACT,MAAM;CACP,CAAA;AAED,kDAAkD;AAClD,MAAM,CAAC,MAAM,UAAU,GAAsB,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,CAAC,CAAA;AAE7F,kDAAkD;AAClD,MAAM,CAAC,MAAM,WAAW,GAAsB,CAAC,UAAU,EAAE,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,YAAY,CAAC,CAAA;AAE5G;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAsB;IACrD,WAAW;IACX,KAAK;IACL,MAAM;IACN,aAAa;IACb,OAAO;IACP,YAAY;IACZ,gBAAgB;IAChB,UAAU;CACX,CAAA;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,YAAY,CAAC,KAAc;IACzC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC,WAAW,EAAE,CAAA;IACzD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IACjF,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,OAAO,MAAM,CAAC,MAAM,CAAC,KAAgC,CAAC;aACnD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;aACjC,IAAI,CAAC,EAAE,CAAC,CAAA;IACb,CAAC;IACD,2DAA2D;IAC3D,OAAO,EAAE,CAAA;AACX,CAAC;AAED;;;GAGG;AACH,SAAS,aAAa,CAAC,KAAiB,EAAE,QAA2B;IACnE,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAA;AAClD,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,QAAgB,EAAE,QAA2B;IACtE,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAA;AACnD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,MAAM,CAAC,IAAY,EAAE,KAAwB;IAC3D,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAA;IAChC,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAA;AAC5D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,QAAQ,CAAC,QAAgB,EAAE,SAAkB;IAC3D,MAAM,IAAI,GAAG,YAAY,CAAC,SAAS,CAAC,CAAA;IACpC,MAAM,OAAO,GAAa,EAAE,CAAA;IAC5B,qEAAqE;IACrE,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,CAAA;IAE9B,IAAI,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,CAAC;QAClC,sEAAsE;QACtE,kEAAkE;QAClE,IAAI,aAAa,CAAC,KAAK,EAAE,aAAa,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;QAClE,IAAI,aAAa,CAAC,KAAK,EAAE,eAAe,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACjE,IAAI,aAAa,CAAC,KAAK,EAAE,gBAAgB,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QACnE,IAAI,aAAa,CAAC,KAAK,EAAE,gBAAgB,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QACnE,wEAAwE;QACxE,sCAAsC;QACtC,IAAI,UAAU,CAAC,IAAI,EAAE,qBAAqB,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;QACxE,IAAI,UAAU,CAAC,IAAI,EAAE,kBAAkB,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;QACpE,IAAI,aAAa,CAAC,KAAK,EAAE,kBAAkB,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;QACvE,IAAI,aAAa,CAAC,KAAK,EAAE,iBAAiB,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IACvE,CAAC;IAED,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,GAAG,CAAC,CAAC,CAAA;AAC9C,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,QAAQ,CAAC,QAAgB,EAAE,SAAkB;IAC3D,OAAO,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,aAAa,GAAG,QAAQ,CAAC,CAAA;AACzE,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,QAAgB,EAAE,SAAkB;IACzD,OAAO,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,aAAa,GAAG,WAAW,CAAC,CAAA;AAC5E,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,YAAY,CAAC,IAA+B;IAC1D,OAAO,UAAU,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,oBAAoB,CAAC,CAAA;AACrE,CAAC"}

package/dist/client.d.ts

@@ -5,8 +5,10 @@
  *
  * Endpoints used:
  *
- *   POST /api/v1/hook-gate       synchronous allow/deny  -> {allowed, reason, incidentId?}
+ *   POST /api/v1/hook-gate       synchronous allow/deny  -> {allowed, reason, incidentId?, code?}
  *   POST /api/v1/hook-events     batched telemetry       -> creates governance_incidents rows
+ *   POST /api/v1/decisions       record a hold           -> joins the review queue (hold.ts)
+ *   GET  /api/v1/decisions/approved-bypasses             -> approvals that let a held call through
  *
  * Two behaviours that must not be "improved":
  *
@@ -25,6 +27,8 @@ export interface GateResponse {
     allowed: boolean;
     reason: string;
     incidentId?: string | undefined;
+    /** The refusal code the hook gate names, when it names one (the MCP registry's). */
+    code?: string | undefined;
     /** False when the call failed and `failClosed` decided the verdict. */
     reached: boolean;
 }
@@ -59,6 +63,7 @@ export declare class GateClient {
     readonly timeoutMs: number;
     constructor(opts?: GateClientOptions);
     private post;
+    private request;
     /**
      * Synchronous allow/deny for one tool call.
      *
@@ -79,6 +84,19 @@ export declare class GateClient {
      * description embeds the reason verbatim.
      */
     emit(event: string, toolName: string, reason?: string, toolInput?: unknown, incidentId?: string, filePath?: string): Promise<boolean>;
+    /**
+     * Records one hold in the review queue (`POST /api/v1/decisions`), the way
+     * the hook gates' records reach it. Never throws; `false` when the control
+     * plane did not accept it, so the refusal can say there is nothing to
+     * approve yet.
+     */
+    recordHold(hold: Record<string, unknown>): Promise<boolean>;
+    /**
+     * The workspace's approved bypasses (`GET /api/v1/decisions/approved-bypasses`),
+     * or `null` when they cannot be read. Never throws: a hold that cannot be
+     * checked for an approval stays held.
+     */
+    approvedBypasses(): Promise<unknown[] | null>;
     /**
      * Build a client from the environment, falling back to CLI credentials.
      *

package/dist/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAyBH,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,OAAO,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;IACd,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAC/B,uEAAuE;IACvE,OAAO,EAAE,OAAO,CAAA;CACjB;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,UAAU,CAAC,EAAE,OAAO,CAAA;IACpB,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED;;;;;;;GAOG;AACH,qBAAa,UAAU;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAA;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;gBAEd,IAAI,GAAE,iBAAsB;YAa1B,IAAI;IAsBlB;;;;;;;;;;;OAWG;IACG,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,GAAG,OAAO,CAAC,YAAY,CAAC;IAoC3E;;;;;OAKG;IACG,IAAI,CACR,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,EAChB,MAAM,SAAK,EACX,SAAS,CAAC,EAAE,OAAO,EACnB,UAAU,CAAC,EAAE,MAAM,EACnB,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,OAAO,CAAC;IAsBnB;;;;;OAKG;IACH,MAAM,CAAC,OAAO,CAAC,IAAI,GAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,OAAO,CAAA;KAAO,GAAG,UAAU;CAoCtG"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AA4BH,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,OAAO,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;IACd,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAC/B,oFAAoF;IACpF,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACzB,uEAAuE;IACvE,OAAO,EAAE,OAAO,CAAA;CACjB;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,UAAU,CAAC,EAAE,OAAO,CAAA;IACpB,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED;;;;;;;GAOG;AACH,qBAAa,UAAU;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAA;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;gBAEd,IAAI,GAAE,iBAAsB;YAa1B,IAAI;YAIJ,OAAO;IA2BrB;;;;;;;;;;;OAWG;IACG,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,GAAG,OAAO,CAAC,YAAY,CAAC;IAqC3E;;;;;OAKG;IACG,IAAI,CACR,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,EAChB,MAAM,SAAK,EACX,SAAS,CAAC,EAAE,OAAO,EACnB,UAAU,CAAC,EAAE,MAAM,EACnB,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,OAAO,CAAC;IA4BnB;;;;;OAKG;IACG,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;IASjE;;;;OAIG;IACG,gBAAgB,IAAI,OAAO,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC;IASnD;;;;;OAKG;IACH,MAAM,CAAC,OAAO,CAAC,IAAI,GAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,OAAO,CAAA;KAAO,GAAG,UAAU;CAoCtG"}

package/dist/client.js

@@ -5,8 +5,10 @@
  *
  * Endpoints used:
  *
- *   POST /api/v1/hook-gate       synchronous allow/deny  -> {allowed, reason, incidentId?}
+ *   POST /api/v1/hook-gate       synchronous allow/deny  -> {allowed, reason, incidentId?, code?}
  *   POST /api/v1/hook-events     batched telemetry       -> creates governance_incidents rows
+ *   POST /api/v1/decisions       record a hold           -> joins the review queue (hold.ts)
+ *   GET  /api/v1/decisions/approved-bypasses             -> approvals that let a held call through
  *
  * Two behaviours that must not be "improved":
  *
@@ -21,6 +23,7 @@
  *   * `emit` NEVER throws. Telemetry that can break a run is worse than no
  *     telemetry.
  */
+import { randomBytes } from 'node:crypto';
 import { readFileSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { join } from 'node:path';
@@ -40,6 +43,8 @@ const VALID_EVENTS = new Set([
     'snapshot_stale',
     'snapshot_invalid',
     'snapshot_empty',
+    'tool_held',
+    'hold_approved_bypass_used',
 ]);
 /**
  * Control-plane client for the pre-execution gate.
@@ -67,17 +72,20 @@ export class GateClient {
         this.timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
     }
     async post(path, body, timeoutMs) {
+        return this.request('POST', path, body, timeoutMs);
+    }
+    async request(method, path, body, timeoutMs) {
         const controller = new AbortController();
         const timer = setTimeout(() => controller.abort(), timeoutMs);
         try {
             const res = await fetch(this.baseUrl + path, {
-                method: 'POST',
+                method,
                 headers: {
-                    'Content-Type': 'application/json',
+                    ...(body === undefined ? {} : { 'Content-Type': 'application/json' }),
                     Authorization: `Bearer ${this.apiKey}`,
                     'X-Workspace-Id': this.workspaceId,
                 },
-                body: JSON.stringify(body),
+                ...(body === undefined ? {} : { body: JSON.stringify(body) }),
                 signal: controller.signal,
             });
             if (!res.ok)
@@ -114,6 +122,7 @@ export class GateClient {
                 allowed: Boolean(d.allowed ?? true),
                 reason: String(d.reason ?? ''),
                 incidentId: typeof d.incidentId === 'string' ? d.incidentId : undefined,
+                code: typeof d.code === 'string' ? d.code : undefined,
                 reached: true,
             };
         }
@@ -149,7 +158,13 @@ export class GateClient {
             workspaceId: this.workspaceId,
             sessionId: this.sessionId,
             harnessType: this.harness,
+            // No daemon reports an SDK gate, so the control plane expects one from
+            // its own events: one that keeps reporting and stops is a silent gate.
+            gateSource: 'sdk',
             timestamp: new Date().toISOString(),
+            // The event's id, made once: if this post is ever repeated, the control
+            // plane processes the event once.
+            eventId: randomBytes(16).toString('hex'),
         };
         if (toolInput !== undefined)
             ev.toolInput = toolInput;
@@ -165,6 +180,35 @@ export class GateClient {
             return false;
         }
     }
+    /**
+     * Records one hold in the review queue (`POST /api/v1/decisions`), the way
+     * the hook gates' records reach it. Never throws; `false` when the control
+     * plane did not accept it, so the refusal can say there is nothing to
+     * approve yet.
+     */
+    async recordHold(hold) {
+        try {
+            const d = await this.post('/api/v1/decisions', { holds: [hold] }, this.timeoutMs);
+            return d.accepted === 1;
+        }
+        catch {
+            return false;
+        }
+    }
+    /**
+     * The workspace's approved bypasses (`GET /api/v1/decisions/approved-bypasses`),
+     * or `null` when they cannot be read. Never throws: a hold that cannot be
+     * checked for an approval stays held.
+     */
+    async approvedBypasses() {
+        try {
+            const d = await this.request('GET', '/api/v1/decisions/approved-bypasses', undefined, this.timeoutMs);
+            return Array.isArray(d.bypasses) ? d.bypasses : null;
+        }
+        catch {
+            return null;
+        }
+    }
     /**
      * Build a client from the environment, falling back to CLI credentials.
      *

package/dist/client.js.map

@@ -1 +1 @@
-{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AACtC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAEhC,MAAM,kBAAkB,GAAG,KAAK,CAAA;AAChC,MAAM,gBAAgB,GAAG,KAAK,CAAA;AAC9B,MAAM,UAAU,GAAG,GAAG,CAAA,CAAC,2DAA2D;AAElF,8EAA8E;AAC9E,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC;IAC3B,cAAc;IACd,cAAc;IACd,cAAc;IACd,kBAAkB;IAClB,eAAe;IACf,gBAAgB;IAChB,iBAAiB;IACjB,iBAAiB;IACjB,gBAAgB;IAChB,kBAAkB;IAClB,gBAAgB;CACjB,CAAC,CAAA;AAwBF;;;;;;;GAOG;AACH,MAAM,OAAO,UAAU;IACZ,OAAO,CAAQ;IACf,MAAM,CAAQ;IACd,WAAW,CAAQ;IACnB,SAAS,CAAQ;IACjB,OAAO,CAAQ;IACf,UAAU,CAAS;IACnB,SAAS,CAAQ;IAE1B,YAAY,OAA0B,EAAE;QACtC,IAAI,CAAC,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,yBAAyB,IAAI,wBAAwB,CAAC,CAAC,OAAO,CACxG,KAAK,EACL,EAAE,CACH,CAAA;QACD,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,EAAE,CAAA;QAC/B,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,EAAE,CAAA;QACzC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,EAAE,CAAA;QACrC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,SAAS,CAAA;QACxC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,IAAI,CAAA;QACzC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,kBAAkB,CAAA;IACvD,CAAC;IAEO,KAAK,CAAC,IAAI,CAAC,IAAY,EAAE,IAAa,EAAE,SAAiB;QAC/D,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAA;QACxC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAA;QAC7D,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,GAAG,IAAI,EAAE;gBAC3C,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,aAAa,EAAE,UAAU,IAAI,CAAC,MAAM,EAAE;oBACtC,gBAAgB,EAAE,IAAI,CAAC,WAAW;iBACnC;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;gBAC1B,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CAAC,CAAA;YACF,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,GAAG,CAAC,MAAM,SAAS,IAAI,EAAE,CAAC,CAAA;YAC/D,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;YAC7B,OAAO,IAAI,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAA6B,CAAC,CAAC,CAAC,EAAE,CAAA;QAClE,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAA;QACrB,CAAC;IACH,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,QAAQ,CAAC,QAAgB,EAAE,SAAkB;QACjD,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,CACvB,mBAAmB,EACnB;gBACE,QAAQ;gBACR,SAAS;gBACT,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,WAAW,EAAE,IAAI,CAAC,OAAO;aAC1B,EACD,IAAI,CAAC,SAAS,CACf,CAAA;YACD,OAAO;gBACL,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,IAAI,IAAI,CAAC;gBACnC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC;gBAC9B,UAAU,EAAE,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;gBACvE,OAAO,EAAE,IAAI;aACd,CAAA;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAA;YAClE,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;gBACpB,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,0BAA0B,IAAI,sCAAsC;oBAC5E,OAAO,EAAE,KAAK;iBACf,CAAA;YACH,CAAC;YACD,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,MAAM,EAAE,0BAA0B,IAAI,qCAAqC;gBAC3E,OAAO,EAAE,KAAK;aACf,CAAA;QACH,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,IAAI,CACR,KAAa,EACb,QAAgB,EAChB,MAAM,GAAG,EAAE,EACX,SAAmB,EACnB,UAAmB,EACnB,QAAiB;QAEjB,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAA;QAC1C,MAAM,EAAE,GAA4B;YAClC,KAAK;YACL,QAAQ;YACR,MAAM,EAAE,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC;YAC3C,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,WAAW,EAAE,IAAI,CAAC,OAAO;YACzB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAA;QACD,IAAI,SAAS,KAAK,SAAS;YAAE,EAAE,CAAC,SAAS,GAAG,SAAS,CAAA;QACrD,IAAI,UAAU;YAAE,EAAE,CAAC,UAAU,GAAG,UAAU,CAAA;QAC1C,IAAI,QAAQ;YAAE,EAAE,CAAC,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;QAClD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,IAAI,CAAC,qBAAqB,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,gBAAgB,CAAC,CAAA;YAC1E,OAAO,IAAI,CAAA;QACb,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,OAAO,CAAC,OAAuE,EAAE;QACtF,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,IAAI,wBAAwB,CAAA;QAC9E,IAAI,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,EAAE,CAAA;QAC3C,IAAI,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,EAAE,CAAA;QAE/C,IAAI,CAAC,GAAG,IAAI,CAAC,EAAE,EAAE,CAAC;YAChB,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,kBAAkB,CAAC,CAAA;gBAChE,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAA4B,CAAA;gBAChF,GAAG,GAAG,GAAG,IAAI,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAA;gBACnC,EAAE,GAAG,EAAE,IAAI,MAAM,CAAC,CAAC,CAAC,WAAW,IAAI,EAAE,CAAC,CAAA;YACxC,CAAC;YAAC,MAAM,CAAC;gBACP,iEAAiE;YACnE,CAAC;QACH,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,EAAE,CAAA;QACnE,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,qEAAqE;YACrE,oEAAoE;YACpE,MAAM,IAAI,KAAK,CACb,kFAAkF;gBAChF,gFAAgF;gBAChF,oBAAoB,CACvB,CAAA;QACH,CAAC;QAED,OAAO,IAAI,UAAU,CAAC;YACpB,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,GAAG;YACX,WAAW,EAAE,EAAE;YACf,SAAS,EAAE,IAAI;YACf,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,SAAS;YAClC,UAAU,EAAE,IAAI,CAAC,UAAU,IAAI,IAAI;SACpC,CAAC,CAAA;IACJ,CAAC;CACF"}
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AACtC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAEhC,MAAM,kBAAkB,GAAG,KAAK,CAAA;AAChC,MAAM,gBAAgB,GAAG,KAAK,CAAA;AAC9B,MAAM,UAAU,GAAG,GAAG,CAAA,CAAC,2DAA2D;AAElF,8EAA8E;AAC9E,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC;IAC3B,cAAc;IACd,cAAc;IACd,cAAc;IACd,kBAAkB;IAClB,eAAe;IACf,gBAAgB;IAChB,iBAAiB;IACjB,iBAAiB;IACjB,gBAAgB;IAChB,kBAAkB;IAClB,gBAAgB;IAChB,WAAW;IACX,2BAA2B;CAC5B,CAAC,CAAA;AA0BF;;;;;;;GAOG;AACH,MAAM,OAAO,UAAU;IACZ,OAAO,CAAQ;IACf,MAAM,CAAQ;IACd,WAAW,CAAQ;IACnB,SAAS,CAAQ;IACjB,OAAO,CAAQ;IACf,UAAU,CAAS;IACnB,SAAS,CAAQ;IAE1B,YAAY,OAA0B,EAAE;QACtC,IAAI,CAAC,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,yBAAyB,IAAI,wBAAwB,CAAC,CAAC,OAAO,CACxG,KAAK,EACL,EAAE,CACH,CAAA;QACD,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,EAAE,CAAA;QAC/B,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,EAAE,CAAA;QACzC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,EAAE,CAAA;QACrC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,SAAS,CAAA;QACxC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,IAAI,CAAA;QACzC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,kBAAkB,CAAA;IACvD,CAAC;IAEO,KAAK,CAAC,IAAI,CAAC,IAAY,EAAE,IAAa,EAAE,SAAiB;QAC/D,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC,CAAA;IACpD,CAAC;IAEO,KAAK,CAAC,OAAO,CACnB,MAAsB,EACtB,IAAY,EACZ,IAAa,EACb,SAAiB;QAEjB,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAA;QACxC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAA;QAC7D,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,GAAG,IAAI,EAAE;gBAC3C,MAAM;gBACN,OAAO,EAAE;oBACP,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC;oBACrE,aAAa,EAAE,UAAU,IAAI,CAAC,MAAM,EAAE;oBACtC,gBAAgB,EAAE,IAAI,CAAC,WAAW;iBACnC;gBACD,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC7D,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CAAC,CAAA;YACF,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,GAAG,CAAC,MAAM,SAAS,IAAI,EAAE,CAAC,CAAA;YAC/D,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;YAC7B,OAAO,IAAI,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAA6B,CAAC,CAAC,CAAC,EAAE,CAAA;QAClE,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAA;QACrB,CAAC;IACH,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,QAAQ,CAAC,QAAgB,EAAE,SAAkB;QACjD,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,CACvB,mBAAmB,EACnB;gBACE,QAAQ;gBACR,SAAS;gBACT,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,WAAW,EAAE,IAAI,CAAC,OAAO;aAC1B,EACD,IAAI,CAAC,SAAS,CACf,CAAA;YACD,OAAO;gBACL,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,IAAI,IAAI,CAAC;gBACnC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC;gBAC9B,UAAU,EAAE,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;gBACvE,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;gBACrD,OAAO,EAAE,IAAI;aACd,CAAA;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAA;YAClE,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;gBACpB,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,0BAA0B,IAAI,sCAAsC;oBAC5E,OAAO,EAAE,KAAK;iBACf,CAAA;YACH,CAAC;YACD,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,MAAM,EAAE,0BAA0B,IAAI,qCAAqC;gBAC3E,OAAO,EAAE,KAAK;aACf,CAAA;QACH,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,IAAI,CACR,KAAa,EACb,QAAgB,EAChB,MAAM,GAAG,EAAE,EACX,SAAmB,EACnB,UAAmB,EACnB,QAAiB;QAEjB,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAA;QAC1C,MAAM,EAAE,GAA4B;YAClC,KAAK;YACL,QAAQ;YACR,MAAM,EAAE,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC;YAC3C,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,WAAW,EAAE,IAAI,CAAC,OAAO;YACzB,uEAAuE;YACvE,uEAAuE;YACvE,UAAU,EAAE,KAAK;YACjB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,wEAAwE;YACxE,kCAAkC;YAClC,OAAO,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;SACzC,CAAA;QACD,IAAI,SAAS,KAAK,SAAS;YAAE,EAAE,CAAC,SAAS,GAAG,SAAS,CAAA;QACrD,IAAI,UAAU;YAAE,EAAE,CAAC,UAAU,GAAG,UAAU,CAAA;QAC1C,IAAI,QAAQ;YAAE,EAAE,CAAC,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;QAClD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,IAAI,CAAC,qBAAqB,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,gBAAgB,CAAC,CAAA;YAC1E,OAAO,IAAI,CAAA;QACb,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,UAAU,CAAC,IAA6B;QAC5C,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,EAAE,KAAK,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAA;YACjF,OAAO,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAA;QACzB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,gBAAgB;QACpB,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,qCAAqC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,CAAA;YACrG,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAA;QACtD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,OAAO,CAAC,OAAuE,EAAE;QACtF,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,IAAI,wBAAwB,CAAA;QAC9E,IAAI,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,EAAE,CAAA;QAC3C,IAAI,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,EAAE,CAAA;QAE/C,IAAI,CAAC,GAAG,IAAI,CAAC,EAAE,EAAE,CAAC;YAChB,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,kBAAkB,CAAC,CAAA;gBAChE,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAA4B,CAAA;gBAChF,GAAG,GAAG,GAAG,IAAI,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAA;gBACnC,EAAE,GAAG,EAAE,IAAI,MAAM,CAAC,CAAC,CAAC,WAAW,IAAI,EAAE,CAAC,CAAA;YACxC,CAAC;YAAC,MAAM,CAAC;gBACP,iEAAiE;YACnE,CAAC;QACH,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,EAAE,CAAA;QACnE,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,qEAAqE;YACrE,oEAAoE;YACpE,MAAM,IAAI,KAAK,CACb,kFAAkF;gBAChF,gFAAgF;gBAChF,oBAAoB,CACvB,CAAA;QACH,CAAC;QAED,OAAO,IAAI,UAAU,CAAC;YACpB,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,GAAG;YACX,WAAW,EAAE,EAAE;YACf,SAAS,EAAE,IAAI;YACf,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,SAAS;YAClC,UAAU,EAAE,IAAI,CAAC,UAAU,IAAI,IAAI;SACpC,CAAC,CAAA;IACJ,CAAC;CACF"}

package/dist/dsh.d.ts

@@ -42,7 +42,7 @@
  *     `{kind:'cancel'}` exists); this listener never produces those, but a
  *     later listener's `next()` result may be one, so the type below says so.
  *
- * ## Re-verified against dsh 0.2.0-rc.2 (2026-10-03, TD-370)
+ * ## Re-verified against dsh 0.2.0-rc.2 (2026-10-03)
  *
  * Read from `@deepseek-ai/dsh-tools@0.2.0-rc.2`'s shipped `lib/index.js`, not
  * only its types: the registry runs the `tools/pre-execute` waterfall with

package/dist/dsh.js

@@ -42,7 +42,7 @@
  *     `{kind:'cancel'}` exists); this listener never produces those, but a
  *     later listener's `next()` result may be one, so the type below says so.
  *
- * ## Re-verified against dsh 0.2.0-rc.2 (2026-10-03, TD-370)
+ * ## Re-verified against dsh 0.2.0-rc.2 (2026-10-03)
  *
  * Read from `@deepseek-ai/dsh-tools@0.2.0-rc.2`'s shipped `lib/index.js`, not
  * only its types: the registry runs the `tools/pre-execute` waterfall with

package/dist/errors.d.ts

@@ -25,6 +25,14 @@ export declare class GateError extends Error {
 export declare class GateConnectionError extends GateError {
     constructor(message: string);
 }
+/**
+ * Every `code` an {@link IntuticGateRefusal} can carry: the tier that refused,
+ * or for the image-integrity tier the specific failure. Held to
+ * `packages/shared-types/fixtures/refusal-codes.json` (`gate`) by a test, as
+ * the Python gate's list and the gate SDK reference are.
+ */
+export declare const GATE_REFUSAL_CODES: readonly ["SSO_GROUP", "SNAPSHOT", "HELD", "SERVER_BLOCKED", "SERVER_HELD", "SERVER_NOT_APPROVED", "TOOL_DISABLED", "SERVER_NOT_ALLOWED", "POLICY_SNAPSHOT_UNVERIFIED", "SOP_RULE", "HOOK_GATE", "COMMAND_TOO_LARGE", "E_UNPINNED_LATEST", "E_UNPINNED_TAG", "E_UNKNOWN_REGISTRY", "E_UNKNOWN_IMAGE", "E_DIGEST_MISMATCH", "E_MANIFEST_UNPARSEABLE", "WORKFLOW_SANDBOX", "NO_GATE"];
+export type GateRefusalCode = (typeof GATE_REFUSAL_CODES)[number];
 /**
  * Raised when a tool call must not run.
  *
@@ -34,8 +42,23 @@ export declare class GateConnectionError extends GateError {
  */
 export declare class IntuticGateRefusal extends GateError {
     readonly reason: string;
-    readonly code: string;
+    readonly code: GateRefusalCode;
     readonly incidentId: string | undefined;
-    constructor(reason: string, code: string, incidentId?: string);
+    constructor(reason: string, code: GateRefusalCode, incidentId?: string);
+}
+/**
+ * Raised when a hold rule stopped the call to ask a person first (`code`
+ * `HELD`). A subclass, so a caller that stops on every refusal stops on this
+ * too; one that tells the user about holds catches it first.
+ *
+ * `holdId` names the hold in the review queue, and is `undefined` when the
+ * hold could not be recorded (no control plane to record it in), in which
+ * case there is nothing to approve yet. `.message` starts
+ * `[Intutic Governance] HELD:`, as the hook gates print a hold, and says who
+ * can approve it and when a retry passes. See hold.ts.
+ */
+export declare class IntuticGateHold extends IntuticGateRefusal {
+    readonly holdId: string | undefined;
+    constructor(reason: string, holdId: string | undefined);
 }
 //# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,sDAAsD;AACtD,qBAAa,SAAU,SAAQ,KAAK;gBACtB,OAAO,EAAE,MAAM;CAI5B;AAED,kEAAkE;AAClE,qBAAa,mBAAoB,SAAQ,SAAS;gBACpC,OAAO,EAAE,MAAM;CAI5B;AAED;;;;;;GAMG;AACH,qBAAa,kBAAmB,SAAQ,SAAS;IAC/C,SAAgB,MAAM,EAAE,MAAM,CAAA;IAC9B,SAAgB,IAAI,EAAE,MAAM,CAAA;IAC5B,SAAgB,UAAU,EAAE,MAAM,GAAG,SAAS,CAAA;gBAElC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM;CAO9D"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,sDAAsD;AACtD,qBAAa,SAAU,SAAQ,KAAK;gBACtB,OAAO,EAAE,MAAM;CAI5B;AAED,kEAAkE;AAClE,qBAAa,mBAAoB,SAAQ,SAAS;gBACpC,OAAO,EAAE,MAAM;CAI5B;AAED;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,qXA0BrB,CAAA;AAEV,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,CAAC,CAAA;AAEjE;;;;;;GAMG;AACH,qBAAa,kBAAmB,SAAQ,SAAS;IAC/C,SAAgB,MAAM,EAAE,MAAM,CAAA;IAC9B,SAAgB,IAAI,EAAE,eAAe,CAAA;IACrC,SAAgB,UAAU,EAAE,MAAM,GAAG,SAAS,CAAA;gBAElC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE,UAAU,CAAC,EAAE,MAAM;CAOvE;AAED;;;;;;;;;;GAUG;AACH,qBAAa,eAAgB,SAAQ,kBAAkB;IACrD,SAAgB,MAAM,EAAE,MAAM,GAAG,SAAS,CAAA;gBAE9B,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,SAAS;CAMvD"}

package/dist/errors.js

@@ -31,6 +31,39 @@ export class GateConnectionError extends GateError {
         this.name = 'GateConnectionError';
     }
 }
+/**
+ * Every `code` an {@link IntuticGateRefusal} can carry: the tier that refused,
+ * or for the image-integrity tier the specific failure. Held to
+ * `packages/shared-types/fixtures/refusal-codes.json` (`gate`) by a test, as
+ * the Python gate's list and the gate SDK reference are.
+ */
+export const GATE_REFUSAL_CODES = [
+    'SSO_GROUP',
+    'SNAPSHOT',
+    'HELD',
+    // The MCP server registry and allowlist, from the policy snapshot or the
+    // control plane's hook gate.
+    'SERVER_BLOCKED',
+    'SERVER_HELD',
+    'SERVER_NOT_APPROVED',
+    'TOOL_DISABLED',
+    'SERVER_NOT_ALLOWED',
+    // Any MCP call on a policy snapshot that failed its integrity check.
+    'POLICY_SNAPSHOT_UNVERIFIED',
+    'SOP_RULE',
+    'HOOK_GATE',
+    // The call is too large to evaluate (limits.ts), before any tier runs.
+    'COMMAND_TOO_LARGE',
+    'E_UNPINNED_LATEST',
+    'E_UNPINNED_TAG',
+    'E_UNKNOWN_REGISTRY',
+    'E_UNKNOWN_IMAGE',
+    'E_DIGEST_MISMATCH',
+    'E_MANIFEST_UNPARSEABLE',
+    // The Workflow DevKit adapter (workflow.ts), before any tier runs.
+    'WORKFLOW_SANDBOX',
+    'NO_GATE',
+];
 /**
  * Raised when a tool call must not run.
  *
@@ -50,4 +83,24 @@ export class IntuticGateRefusal extends GateError {
         this.incidentId = incidentId;
     }
 }
+/**
+ * Raised when a hold rule stopped the call to ask a person first (`code`
+ * `HELD`). A subclass, so a caller that stops on every refusal stops on this
+ * too; one that tells the user about holds catches it first.
+ *
+ * `holdId` names the hold in the review queue, and is `undefined` when the
+ * hold could not be recorded (no control plane to record it in), in which
+ * case there is nothing to approve yet. `.message` starts
+ * `[Intutic Governance] HELD:`, as the hook gates print a hold, and says who
+ * can approve it and when a retry passes. See hold.ts.
+ */
+export class IntuticGateHold extends IntuticGateRefusal {
+    holdId;
+    constructor(reason, holdId) {
+        super(reason, 'HELD');
+        this.name = 'IntuticGateHold';
+        this.message = `[Intutic Governance] HELD: ${reason}`;
+        this.holdId = holdId;
+    }
+}
 //# sourceMappingURL=errors.js.map

package/dist/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,sDAAsD;AACtD,MAAM,OAAO,SAAU,SAAQ,KAAK;IAClC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,WAAW,CAAA;IACzB,CAAC;CACF;AAED,kEAAkE;AAClE,MAAM,OAAO,mBAAoB,SAAQ,SAAS;IAChD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAA;IACnC,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,OAAO,kBAAmB,SAAQ,SAAS;IAC/B,MAAM,CAAQ;IACd,IAAI,CAAQ;IACZ,UAAU,CAAoB;IAE9C,YAAY,MAAc,EAAE,IAAY,EAAE,UAAmB;QAC3D,KAAK,CAAC,iCAAiC,MAAM,EAAE,CAAC,CAAA;QAChD,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAA;QAChC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;QACpB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;QAChB,IAAI,CAAC,UAAU,GAAG,UAAU,CAAA;IAC9B,CAAC;CACF"}
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,sDAAsD;AACtD,MAAM,OAAO,SAAU,SAAQ,KAAK;IAClC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,WAAW,CAAA;IACzB,CAAC;CACF;AAED,kEAAkE;AAClE,MAAM,OAAO,mBAAoB,SAAQ,SAAS;IAChD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAA;IACnC,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,WAAW;IACX,UAAU;IACV,MAAM;IACN,yEAAyE;IACzE,6BAA6B;IAC7B,gBAAgB;IAChB,aAAa;IACb,qBAAqB;IACrB,eAAe;IACf,oBAAoB;IACpB,qEAAqE;IACrE,4BAA4B;IAC5B,UAAU;IACV,WAAW;IACX,uEAAuE;IACvE,mBAAmB;IACnB,mBAAmB;IACnB,gBAAgB;IAChB,oBAAoB;IACpB,iBAAiB;IACjB,mBAAmB;IACnB,wBAAwB;IACxB,mEAAmE;IACnE,kBAAkB;IAClB,SAAS;CACD,CAAA;AAIV;;;;;;GAMG;AACH,MAAM,OAAO,kBAAmB,SAAQ,SAAS;IAC/B,MAAM,CAAQ;IACd,IAAI,CAAiB;IACrB,UAAU,CAAoB;IAE9C,YAAY,MAAc,EAAE,IAAqB,EAAE,UAAmB;QACpE,KAAK,CAAC,iCAAiC,MAAM,EAAE,CAAC,CAAA;QAChD,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAA;QAChC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;QACpB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;QAChB,IAAI,CAAC,UAAU,GAAG,UAAU,CAAA;IAC9B,CAAC;CACF;AAED;;;;;;;;;;GAUG;AACH,MAAM,OAAO,eAAgB,SAAQ,kBAAkB;IACrC,MAAM,CAAoB;IAE1C,YAAY,MAAc,EAAE,MAA0B;QACpD,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;QACrB,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAA;QAC7B,IAAI,CAAC,OAAO,GAAG,8BAA8B,MAAM,EAAE,CAAA;QACrD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;IACtB,CAAC;CACF"}

package/dist/eve.d.ts

@@ -11,8 +11,9 @@
  * with `instructions.md`, `agent/tools/*.ts`, `agent/connections/*.ts`,
  * `agent/hooks/*.ts`, ...) that eve builds by walking the tree. It is a
  * pre-1.0 PREVIEW product (integrated at 0.39.1, re-verified at 0.71.0; very active) —
- * see docs/TECH_DEBT.md TD-410 for the churn shield this adapter carries,
- * the same posture the dsh integration established.
+ * this adapter carries a churn shield (structural copies of eve's types,
+ * re-checked against the real ones on every eve upgrade), the same posture
+ * the dsh integration established.
  *
  * ## The veto mechanism — CONFIRMED against a real install, not assumed
  *
@@ -94,7 +95,7 @@
  * `requestId`/`responderPrincipalId`/`turnId`/`stepIndex` but NOT the tool
  * name or input.
  *
- * TD-411 half 2, revisited: `intuticApproval()` and `intuticAuditHooks()` are
+ * Recovering the tool name: `intuticApproval()` and `intuticAuditHooks()` are
  * both plain functions exported from this one module and cannot be assumed to
  * run in the same process at settlement time — eve's own docs state a parked
  * approval survives a process restart verbatim ("the process can restart and
@@ -124,11 +125,10 @@
  * name too WHEN this cache is still warm (same-process, or a short-lived
  * pause). When it is not — a genuinely long-parked, cross-restart approval —
  * settlement still falls back to the synthetic {@link EVE_APPROVAL_TOOL_NAME},
- * exactly the pre-existing behaviour, never worse. See TD-411 for the full
- * reasoning and what a persistent (non-memory) correlation store would take
- * to close that residual gap.
+ * exactly the pre-existing behaviour, never worse. Closing that residual gap
+ * would take a persistent (non-memory) correlation store.
  *
- * TD-498: a live `eve start` run showed that `approval.candidate`/
+ * A live `eve start` run showed that `approval.candidate`/
  * `approval.settled` fire ONLY for the `approval: { request, response }`
  * form. The bare form this adapter documents (`approval: intuticApproval()`)
  * settles through a fourth hookable event, `input.resolved` (`HookEventMap`,
@@ -147,7 +147,7 @@
  * `VERCEL_OIDC_TOKEN` credentials — confirmed in `docs/agent-config.md` and
  * `docs/getting-started.mdx`). The AI Gateway wire protocol is NOT something
  * the Intutic proxy parses, so gateway-routed egress is ungoverned by the
- * proxy — full stop, and TD-412 tracks it. The governable path is eve's
+ * proxy — full stop. The governable path is eve's
  * other documented option: passing a provider-authored `LanguageModel`
  * (`createOpenAI(...)` etc.) to `defineAgent({ model })`, where the
  * `withIntuticProxy()` helper — implemented once in `vercel.ts` and
@@ -340,7 +340,7 @@ export interface EveApprovalSettledEvent {
  * read from the shipped zod schema, not just its `.d.ts`) — narrowed to the
  * fields this module reads. Unlike {@link EveApprovalCandidateEvent} /
  * {@link EveApprovalSettledEvent}, this DOES carry the real tool name
- * (`action.toolName`) alongside `requestId`, in the same object. See TD-411.
+ * (`action.toolName`) alongside `requestId`, in the same object.
  */
 export interface EveInputRequest {
     readonly requestId: string;
@@ -390,7 +390,7 @@ export interface EveInputResolution {
  *  human-input requests. It is how a BARE approval policy
  *  (`approval: intuticApproval(...)`) settles: eve emits `approval.candidate`/
  *  `approval.settled` only for the `{ request, response }` form (observed on
- *  a live `eve start` server, TD-498). */
+ *  a live `eve start` server). */
 export interface EveInputResolvedEvent {
     readonly type: 'input.resolved';
     readonly data: {
@@ -451,7 +451,7 @@ export interface IntuticAuditHooksOptions {
  * - `input.requested`, one `kind: 'tool-approval'` request → `tool_flagged`,
  *   under the REAL tool name (`request.action.toolName`) — a genuinely new
  *   signal this adapter did not emit before: a call is now pending human
- *   approval. See the module doc (TD-411) for why this event, not a
+ *   approval. See the module doc for why this event, not a
  *   process-memory map, is what closes "no tool identity" here.
  * - `approval.settled` `outcome: 'approved'` → `tool_allowed` — a human
  *   explicitly approved the parked call.