@odingard/guardian-hook 0.1.0 → 0.1.1

package/README.md

@@ -16,7 +16,7 @@ There is no model in the decision: Guardian decides ALLOW / ASK / DENY determini
 | **ASK**       | The agent waits. You get the request on your phone or in the console. On approval the hook claims and redeems the capability, then the call runs. It is never auto-approved. |
 | **DENY**      | The agent is told no, with the reason. Nothing runs.                                                                                                                         |
 
-**Fail closed.** If Guardian can't be reached, the configuration is wrong, approval times out or redemption fails, the call is denied. The hook stops waiting after 9 minutes by default, under Claude Code's 600-second hook timeout, because a hook that times out does not block.
+**Fail closed.** If Guardian can't be reached, the configuration is wrong, approval times out or redemption fails, the call is denied. Each request stays open for 5 minutes (Guardian's limit), and the hook waits that long for an approval, under Claude Code's 600-second hook timeout, because a hook that times out does not block. An ASK not approved within 5 minutes expires; the call is denied and the agent can ask again.
 
 ## Tools the hook proposes
 

package/dist/index.js

@@ -179,7 +179,8 @@ async function decide(call, options) {
       connectionId: options.connectionId,
       toolName: call.toolName,
       arguments: call.arguments,
-      purpose: `${options.agentName}: ${call.summary}`
+      purpose: `${options.agentName}: ${call.summary}`,
+      ...options.requestTtlMs !== void 0 ? { ttlMs: options.requestTtlMs } : {}
     });
   } catch {
     return denied(call, "SERVICE_UNAVAILABLE");
@@ -255,7 +256,8 @@ async function decide(call, options) {
 
 // src/index.ts
 var DEFAULT_BASE_URL = "https://guardian-api.odingard.com";
-var MAX_WAIT_MS = 57e4;
+var REQUEST_TTL_MS = 3e5;
+var MAX_WAIT_MS = REQUEST_TTL_MS;
 function claudeCodeOutput(verdict) {
   return JSON.stringify({
     hookSpecificOutput: {
@@ -347,8 +349,10 @@ async function runHook(stdin, env, deps = {}) {
   if (!deps.client && !baseUrl.startsWith("https://")) {
     return failClosed("GUARDIAN_BASE_URL must be https. Nothing ran.");
   }
-  const requested = Number(env.GUARDIAN_HOOK_APPROVAL_TIMEOUT_MS ?? 54e4);
-  const approvalTimeoutMs = Number.isFinite(requested) ? Math.min(Math.max(requested, 0), MAX_WAIT_MS) : 54e4;
+  const requested = Number(
+    env.GUARDIAN_HOOK_APPROVAL_TIMEOUT_MS ?? MAX_WAIT_MS
+  );
+  const approvalTimeoutMs = Number.isFinite(requested) ? Math.min(Math.max(requested, 0), MAX_WAIT_MS) : MAX_WAIT_MS;
   const verdict = await decide(call, {
     client: deps.client ?? createGuardianClient({
       baseUrl,
@@ -358,6 +362,7 @@ async function runHook(stdin, env, deps = {}) {
     connectionId: connectionId ?? "",
     agentName: env.GUARDIAN_HOOK_AGENT_NAME?.trim() || "Claude Code",
     approvalTimeoutMs,
+    requestTtlMs: REQUEST_TTL_MS,
     pollIntervalMs: 2e3,
     ...deps.wait ? { wait: deps.wait } : {},
     ...deps.now ? { now: deps.now } : {},
@@ -405,6 +410,7 @@ if (invokedDirectly) {
 export {
   DEFAULT_BASE_URL,
   MAX_WAIT_MS,
+  REQUEST_TTL_MS,
   SETTINGS_SNIPPET,
   claudeCodeOutput,
   connectionFor,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@odingard/guardian-hook",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Guardian for coding agents: a Claude Code PreToolUse hook that sends shell commands, file writes and MCP calls to Guardian for a deterministic ALLOW/ASK/DENY decision. Deploys and destructive commands wait for a human approval on your phone; every allowed call carries a verifiable receipt.",
   "license": "Apache-2.0",
   "type": "module",
@@ -22,13 +22,13 @@
     "prepublishOnly": "npm run build && npm test"
   },
   "dependencies": {
-    "@odingard/guardian-sdk": "^0.3.0"
+    "@odingard/guardian-sdk": "^0.3.5"
   },
   "devDependencies": {
     "@types/node": "^22",
     "esbuild": "^0.28.2",
     "typescript": "^5.9.3",
-    "vitest": "^3.2.4"
+    "vitest": "^5.1.0"
   },
   "publishConfig": {
     "access": "public"