granttap-mcp 0.7.1 → 0.8.1

package/LICENSE

@@ -1,21 +1,86 @@
-MIT License
-
-Copyright (c) 2026 Serhii Ziborov
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+GrantTap Commercial Source License 1.0
+
+Copyright (c) 2026 Serhii Ziborov. All rights reserved.
+
+This license governs the source code and software distributed from the
+granttap-mcp repository and package (the "Software"), except for third-party
+components that identify their own license terms.
+
+1. Definitions
+
+"GrantTap" means Serhii Ziborov doing business as GrantTap.
+
+"Authorized Access" means an active paid GrantTap subscription, an official
+GrantTap trial, or a separate written commercial agreement with GrantTap.
+
+"Authorized User" means a person or legal entity covered by Authorized Access.
+
+2. Source inspection and contribution
+
+You may download, inspect, and make local modifications to the source solely to
+evaluate the Software, perform security review, or prepare a contribution to
+the official GrantTap repository. You may create a public fork solely for that
+contribution workflow if the fork retains this license and does not publish a
+release, binary, hosted service, or independently usable distribution.
+
+These rights do not permit production use, commercial use, or use to provide a
+service to another person.
+
+3. Authorized product use
+
+During Authorized Access, GrantTap grants the Authorized User a limited,
+non-exclusive, non-transferable, non-sublicensable license to install, execute,
+and internally modify the Software on devices the Authorized User owns or
+controls, solely to use the official GrantTap product and services.
+
+When Authorized Access ends, the Authorized User must stop using the Software
+except where a separate written agreement says otherwise.
+
+4. Restrictions
+
+Unless GrantTap gives prior written permission, you may not:
+
+- sell, sublicense, redistribute, or publish the Software or a derivative work;
+- offer the Software or a derivative work as a hosted or managed service;
+- use the Software to build or operate a competing product or service;
+- use the Software as a standalone general-purpose coding-agent runtime outside
+  the official GrantTap product;
+- bypass subscription, license, access-control, or entitlement checks;
+- remove or alter copyright, license, attribution, or proprietary notices; or
+- use GrantTap names or marks to imply endorsement of a modified distribution.
+
+5. Ownership
+
+The Software is licensed, not sold. GrantTap retains all right, title, and
+interest in the Software and its derivative works. No trademark, patent, or
+other rights are granted except the limited copyright rights stated here.
+
+6. Third-party components
+
+Third-party components remain governed by their respective licenses. Those
+licenses and notices are not replaced by this license. See
+THIRD_PARTY_NOTICES.md where distributed.
+
+7. Termination
+
+This license terminates automatically if you breach its terms. On termination,
+you must stop using and distributing the Software and delete copies that you
+are not legally required to retain. Sections 4 through 9 survive termination.
+
+8. Disclaimer of warranty
+
+THE SOFTWARE IS PROVIDED "AS IS" AND "AS AVAILABLE", WITHOUT WARRANTIES OF
+ANY KIND, EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY, FITNESS
+FOR A PARTICULAR PURPOSE, TITLE, AND NON-INFRINGEMENT.
+
+9. Limitation of liability
+
+TO THE MAXIMUM EXTENT PERMITTED BY LAW, GRANTTAP AND ITS CONTRIBUTORS WILL NOT
+BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, OR
+PUNITIVE DAMAGES, OR FOR LOSS OF DATA, PROFITS, REVENUE, OR BUSINESS, ARISING
+FROM OR RELATED TO THE SOFTWARE OR THIS LICENSE.
+
+10. Commercial terms
+
+Authorized Access, pricing, and separate commercial licenses are available
+through https://granttap.com.

package/README.md

@@ -2,7 +2,7 @@
 
 [![npm](https://img.shields.io/npm/v/granttap-mcp)](https://www.npmjs.com/package/granttap-mcp)
 [![CI](https://github.com/sergii-ziborov/granttap-mcp/actions/workflows/ci.yml/badge.svg)](https://github.com/sergii-ziborov/granttap-mcp/actions/workflows/ci.yml)
-[![MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
+[![License](https://img.shields.io/badge/license-GrantTap%20Commercial-7c3aed.svg)](LICENSE)
 
 GrantTap is a Personal live control center for local coding agents.
 
@@ -13,6 +13,10 @@ hooks, local adapters, and TypeScript wire schemas. Agents and provider
 credentials stay on your computer. Native iPhone and Apple Watch traffic is
 end-to-end encrypted.
 
+The source is public for inspection and contribution, but GrantTap MCP is
+proprietary paid software rather than open source. Production use requires an
+active GrantTap subscription or a separate commercial agreement.
+
 [Website](https://granttap.com) · [npm](https://www.npmjs.com/package/granttap-mcp) ·
 [Security model](SECURITY.md) ·
 [Relay source](https://github.com/sergii-ziborov/granttap-relay)
@@ -51,12 +55,11 @@ Mesh resource. Full transcripts and hidden reasoning are never mesh payloads.
 Claims have TTLs; a colliding claim is rejected before it is recorded so agents
 can choose different work or contact the owner before escalating to Needs You.
 
-Both directions are scoped to the calling execution. The provider hook already
-runs inside the agent's own session and sees the exact call, so GrantTap
-attributes every `notify` to the session that really made it and publishes the
-event only for that execution — a model that learned another session's id
-cannot act in its name. `granttap://mesh/current` therefore carries no Project
-data: an attributed call returns this execution's opaque
+For Claude Code, Codex, and Cursor, the provider hook runs inside the agent's
+own session and sees the exact call. GrantTap attributes every `notify` to the
+session that really made it and publishes the event only for that execution —
+a model that learned another session's id cannot act in its name.
+`granttap://mesh/current` therefore carries no Project data: an attributed call returns this execution's opaque
 `granttap://mesh/<capability>` URI, and only that URI serves its Project, Task,
 owners, claims, dependencies, and relevant events. Ownership transfer stays out
 of the tool surface entirely: `HANDOFF_ACCEPTED` and `HANDOFF_REJECTED` are
@@ -66,8 +69,11 @@ The first executable handoff path is Claude Code ↔ Codex across linked
 computers. GrantTap builds a bounded Task Capsule from explicit task/git facts,
 requires local phone authorization, creates a separate target branch/worktree,
 starts the target execution, and returns a receipt bound to the exact capsule.
-Cursor and Grok Build use the same provider-neutral schema and discovery model;
-unsupported remote-start paths fail closed instead of claiming parity.
+Cursor uses the same provider-neutral schema and trusted caller attribution.
+Grok Build remains Experimental and observable where available, but does not
+yet expose a trusted caller hook, so agent-authored scoped Mesh events are not
+offered for it. Unsupported remote-start paths fail closed instead of claiming
+parity.
 
 A capsule carries facts, not files. A handoff from a checkout with uncommitted
 changes is refused — "This task has uncommitted changes. Commit or checkpoint
@@ -95,6 +101,9 @@ history stays on the device.
 
 ## Install
 
+Installation and production use require Authorized Access under the
+[GrantTap Commercial Source License](LICENSE).
+
 ```bash
 npm install -g granttap-mcp
 granttap setup
@@ -105,10 +114,17 @@ hooks, installs the background helper, configures Cursor's persistent local
 OAuth service when Cursor is present, and starts phone pairing when run in an
 interactive terminal. It ends with one exact next action.
 
+Setup also declares the separately distributed GrantTap Engine, which Project
+Governance needs before it can report anything. The standard locations are
+searched, and `--engine <path>` points at one that lives elsewhere; the binary
+is checksummed here, because that checksum is the only thing verified before it
+is launched. Without an engine the rollout stays off and setup says so, rather
+than leaving "Governance not reported" on the phone as the only symptom.
+
 The normal CLI surface is intentionally small:
 
 ```text
-granttap setup
+granttap setup [--engine <path>]
 granttap status [--json]
 granttap connect [--relay <wss-url>]
 granttap reset [--yes]
@@ -160,11 +176,19 @@ The bounded encrypted protocol preserves:
 - visible activity, delivery state, context and token counters;
 - MCP, Skill, and CLI observations;
 - child-agent relationships;
-- per-capability outcome: `success`, `error`, `cancelled`, or `unknown`.
+- per-capability outcome: `success`, `error`, `cancelled`, or `unknown`;
+- what a call cost, where the machine can be observed while it ran.
 
 An optional bounded `errorClass` may describe an error category. Full tool
 error payloads are not copied into usage telemetry by default.
 
+Cost is reported as attributed rather than measured, because that is what it
+is. A call is read back from the transcript once it has finished, so it can
+never be measured directly: an MCP server outlives its calls and is sampled
+directly, while a built-in tool leaves nothing behind and is costed from the
+samples that fall inside its own start and end. A call with no sample near it
+reports nothing rather than a number borrowed from another moment.
+
 ## Local enforcement
 
 GrantTap can narrow later actions for an exact task only where a provider
@@ -215,4 +239,12 @@ gate on macOS, and `npm publish` enforces the same gate through
 Do not publish from a dirty checkout or before the package allowlist, tests,
 typecheck, and release checks pass.
 
+## License
+
+GrantTap MCP is distributed under the proprietary
+[GrantTap Commercial Source License 1.0](LICENSE). Public source access does not
+grant open-source, redistribution, hosted-service, or competing-product rights.
+Third-party dependencies retain their own terms; see
+[THIRD_PARTY_NOTICES.md](THIRD_PARTY_NOTICES.md).
+
 GrantTap is not affiliated with Anthropic, OpenAI, Apple, Anysphere, or xAI.

package/SECURITY.md

@@ -20,6 +20,24 @@ credential used for authenticated WebSocket and APNs registration.
 Provider credentials remain in each provider's own local authentication flow.
 GrantTap does not send them to the relay.
 
+Installed Claude Code, Codex, and Cursor hooks deny direct agent tool calls
+that name GrantTap's local pairing, key, or policy files, including calls that
+would otherwise be auto-accepted or run in provider bypass mode. The denial
+covers the config directory itself, any glob over it, and every file not on a
+short access-mode list, so a file added later is protected the day it appears.
+Only helper logs and bounded runtime diagnostics are agent-readable, and they
+remain read-only. Raw Mesh state and hook-attribution records are never exposed
+to agent tools; `workspaces/` and `worktrees/` remain normal editable agent
+workspace. The guard denies only what it positively recognised as a path into
+that directory, and a fault inside the guard itself is printed and allowed
+through instead of blocking every tool call on the machine: an outage of every
+agent is a worse failure than the file it was watching. This is
+best-effort self-protection, not an operating-system security boundary: a
+process running as the same macOS user can use an unobserved tool, shell
+obfuscation, or direct filesystem access outside those hooks. Protect the user
+account and disk; use a trusted terminal for intentional maintenance. Moving
+remaining local secret material into Keychain is the stronger future boundary.
+
 ## Cryptographic boundary
 
 - Every computer pairing is generated locally with unique Curve25519 keys.
@@ -67,6 +85,10 @@ acceptance includes a SHA-256 receipt over a canonical capsule and the source,
 target, Task identity, and acceptance time. Stale claims expire, replayed event
 IDs are ignored, and destination routing is explicit.
 
+Repository remotes included in Project snapshots are reduced to lowercase
+host/path form. Userinfo, passwords or tokens, query strings, fragments, and
+local-path remotes are never persisted as `baseRemote`.
+
 ## Runtime controls
 
 Provider hooks enforce policy on the computer. Global provider deny always
@@ -87,5 +109,16 @@ expiry, actor, Project scope, and operation, and a revoked or disabled endpoint
 fails closed. Invite creation, actor enablement, Project scope, and revocation
 stay in the iPhone UI and the trusted CLI, never in a model-callable tool.
 
+## Local helper installation
+
+The background helper is a user LaunchAgent, and `launchctl bootstrap` replaces
+whatever job already holds that label. GrantTap therefore refuses to load a
+LaunchAgent whose plist lives under the operating system's temporary directory:
+a test, probe, or agent run with a temporary `HOME` must never evict the
+installed helper and leave launchd restarting a program whose files were already
+cleaned up. Only `GRANTTAP_TEST_FAKE_LAUNCHCTL=1`, which states that `launchctl`
+on `PATH` is a stub, lifts that refusal.
+
+
 Relay vulnerabilities should be reported through the
 [GrantTap relay advisory form](https://github.com/sergii-ziborov/granttap-relay/security/advisories/new).

package/THIRD_PARTY_NOTICES.md

@@ -0,0 +1,23 @@
+# Third-party notices
+
+GrantTap MCP is proprietary software distributed under the GrantTap Commercial
+Source License. Third-party components retain their own licenses; the GrantTap
+license does not replace or restrict those terms.
+
+The npm package declares, rather than vendors, these direct runtime
+dependencies. Their packages carry the applicable license texts:
+
+| Component | License |
+| --- | --- |
+| `@modelcontextprotocol/sdk` | MIT |
+| `express` | MIT |
+| `qrcode` | MIT |
+| `tsx` | MIT |
+| `tweetnacl` | The Unlicense |
+| `ws` | MIT |
+| `zod` | MIT |
+
+The unpublished Rust workspace also depends on separately licensed components,
+including `mcport` (MIT), `blazingly-json` (MIT), `serde` (MIT OR Apache-2.0), and
+BlindPlane crates (MIT OR Apache-2.0). Binary distributions must retain the
+complete license texts required by the exact dependency versions they contain.

package/apps/bridge/src/bin/claude-hook.ts

@@ -25,6 +25,11 @@ import {
 } from "../config";
 import { recordAttributedCall } from "../mesh/call-scope";
 import { classifyAction } from "../policy";
+import {
+  evaluateEffectiveAction,
+  legacyGrantTapFlowAllowed,
+} from "../policy/effective-action";
+import { protectedGrantTapAccess } from "../self-protection";
 
 async function readStdin(): Promise<string> {
   const chunks: Buffer[] = [];
@@ -34,19 +39,20 @@ async function readStdin(): Promise<string> {
 
 async function main(): Promise<void> {
   const raw = await readStdin();
-  let input: HookInput = {};
+  let input: HookInput;
   try {
     input = JSON.parse(raw) as HookInput;
   } catch {
-    process.stdout.write(
-      JSON.stringify({
-        hookSpecificOutput: {
-          hookEventName: "PreToolUse",
-          permissionDecision: "deny",
-          permissionDecisionReason: "GrantTap received invalid hook JSON",
-        },
-      }),
-    );
+    writePermission("deny", "GrantTap received invalid hook JSON");
+    return;
+  }
+  await handlePreToolUse(input);
+}
+
+async function handlePreToolUse(input: HookInput): Promise<void> {
+  const protectedAccess = protectedGrantTapAccess(input.tool_name, input.tool_input);
+  if (protectedAccess) {
+    writePermission("deny", protectedAccess.reason);
     return;
   }
 
@@ -67,43 +73,42 @@ async function main(): Promise<void> {
     input.tool_name,
     input.tool_input,
   );
-  if (blocked) {
-    process.stdout.write(
-      JSON.stringify({
-        hookSpecificOutput: {
-          hookEventName: "PreToolUse",
-          permissionDecision: "deny",
-          permissionDecisionReason: blocked.reason,
-        },
-      }),
-    );
+  const projectDecision = await evaluateEffectiveAction({
+    provider: "claude",
+    sessionId: input.session_id,
+    cwd: input.cwd,
+    toolName: input.tool_name,
+    toolInput: input.tool_input,
+    legacyDenyReason: blocked?.reason,
+  });
+  if (projectDecision.effect === "deny") {
+    writePermission("deny", projectDecision.reason);
     return;
   }
+  const legacyFlow = legacyGrantTapFlowAllowed(projectDecision);
 
   // Claude already granted this chat unconditional tool access. GrantTap's
-  // explicit MCP/skill/CLI blocks above still win, but phone approval must not
-  // re-prompt a call Claude is intentionally running in bypass mode.
-  if (input.permission_mode === "bypassPermissions") return;
+  // Project ASK/DENY is a parent boundary, so bypass mode cannot weaken it.
+  if (legacyFlow && input.permission_mode === "bypassPermissions") return;
 
   // Gating paused, or this session is exempt → abstain (empty output = Claude
   // uses its normal permission flow, exactly as if GrantTap weren't installed).
-  if (isGatingSkipped(input.session_id)) return;
+  if (legacyFlow && isGatingSkipped(input.session_id)) return;
+  await continuePermissionFlow(input, legacyFlow);
+}
 
+async function continuePermissionFlow(input: HookInput, legacyFlow: boolean): Promise<void> {
   let cfg;
   try {
     cfg = loadConfig(machineConfigPath());
   } catch {
+    if (!legacyFlow) {
+      writePermission("deny", "Project policy requires GrantTap approval, but this computer is not paired");
+      return;
+    }
     // No pairing yet: don't block the user's normal workflow — defer to Claude's
     // own prompt by emitting "ask".
-    process.stdout.write(
-      JSON.stringify({
-        hookSpecificOutput: {
-          hookEventName: "PreToolUse",
-          permissionDecision: "ask",
-          permissionDecisionReason: "GrantTap not paired (run `npm run init`)",
-        },
-      }),
-    );
+    writePermission("ask", "GrantTap not paired (run `npm run init`)");
     return;
   }
 
@@ -112,21 +117,8 @@ async function main(): Promise<void> {
   // the user never finished setting up. Once paired, this is what keeps routine
   // work independent of whether the phone is awake, reachable, or even running.
   const req = claudeToRequest(input);
-  if (shouldAutoAcceptTool(input.session_id, req.tool, req.command)) {
-    const level = autoAcceptLevelFor(input.session_id);
-    const cls = classifyAction(req.tool, req.command);
-    process.stdout.write(
-      JSON.stringify(
-        decisionToClaudeOutput({
-          type: "approval.decision",
-          requestId: req.requestId,
-          decision: "allow",
-          decidedBy: "auto",
-          note: `GrantTap auto-accept (${level} / ${cls})`,
-          decidedAt: Date.now(),
-        }),
-      ),
-    );
+  if (legacyFlow && shouldAutoAcceptTool(input.session_id, req.tool, req.command)) {
+    writeAutoApproval(input, req);
     return;
   }
 
@@ -140,12 +132,38 @@ async function main(): Promise<void> {
   // Relay down or phone asleep ≠ phone said no: abstain so Claude's local flow
   // handles it (avoid flooding "решай локально" on every tool).
   if (isUnanswered(decision)) {
+    if (!legacyFlow) {
+      writePermission("deny", "Project approval was required but no decision was received");
+    }
     return;
   }
 
   process.stdout.write(JSON.stringify(decisionToClaudeOutput(decision)));
 }
 
+function writeAutoApproval(input: HookInput, req: ReturnType<typeof claudeToRequest>): void {
+  const level = autoAcceptLevelFor(input.session_id);
+  const cls = classifyAction(req.tool, req.command);
+  process.stdout.write(JSON.stringify(decisionToClaudeOutput({
+    type: "approval.decision",
+    requestId: req.requestId,
+    decision: "allow",
+    decidedBy: "auto",
+    note: `GrantTap auto-accept (${level} / ${cls})`,
+    decidedAt: Date.now(),
+  })));
+}
+
+function writePermission(decision: "deny" | "ask", reason: string): void {
+  process.stdout.write(JSON.stringify({
+    hookSpecificOutput: {
+      hookEventName: "PreToolUse",
+      permissionDecision: decision,
+      permissionDecisionReason: reason,
+    },
+  }));
+}
+
 main().catch((err) => {
   process.stdout.write(
     JSON.stringify({

package/apps/bridge/src/bin/codex-hook.ts

@@ -25,6 +25,8 @@ import {
 } from "../config";
 import { recordAttributedCall } from "../mesh/call-scope";
 import { classifyAction } from "../policy";
+import { consumeCodexProjectAsk } from "../policy/codex-project-ask";
+import { protectedGrantTapAccess } from "../self-protection";
 
 async function readStdin(): Promise<string> {
   const chunks: Buffer[] = [];
@@ -51,6 +53,12 @@ async function main(): Promise<void> {
     return;
   }
 
+  const protectedAccess = protectedGrantTapAccess(input.tool_name, input.tool_input);
+  if (protectedAccess) {
+    process.stdout.write(denyOutput(protectedAccess.reason));
+    return;
+  }
+
   if (!isProviderEnabled("codex")) return;
 
   // See claude-hook.ts: the MCP server trusts this attribution, never the model.
@@ -70,9 +78,15 @@ async function main(): Promise<void> {
     process.stdout.write(denyOutput(blocked.reason));
     return;
   }
+  const projectAsk = consumeCodexProjectAsk({
+    sessionId: input.session_id,
+    toolUseId: input.tool_use_id,
+    toolName: input.tool_name,
+    toolInput: input.tool_input,
+  });
 
   // Gating paused or this session exempt → stay silent (Codex uses its own flow).
-  if (isGatingSkipped(input.session_id)) return;
+  if (!projectAsk && isGatingSkipped(input.session_id)) return;
 
   let cfg;
   try {
@@ -84,7 +98,7 @@ async function main(): Promise<void> {
 
   // Local policy, evaluated after pairing is confirmed — see claude-hook.
   const req = codexToRequest(input);
-  if (shouldAutoAcceptTool(input.session_id, req.tool, req.command)) {
+  if (!projectAsk && shouldAutoAcceptTool(input.session_id, req.tool, req.command)) {
     const level = autoAcceptLevelFor(input.session_id);
     const cls = classifyAction(req.tool, req.command);
     process.stdout.write(
@@ -109,9 +123,14 @@ async function main(): Promise<void> {
   );
   const decision = await requestApproval(cfg, req, { timeoutMs });
 
-  // Relay down or phone never answered: stay silent — an empty hook result
-  // sends Codex back to its own approval flow, so desk work keeps going.
-  if (isUnanswered(decision)) return;
+  // Routine relay failure stays in Codex's native flow. A Project ASK cannot
+  // fall through to provider approval because that would weaken the parent rule.
+  if (isUnanswered(decision)) {
+    if (projectAsk) {
+      process.stdout.write(denyOutput("Project approval was required but no decision was received"));
+    }
+    return;
+  }
 
   process.stdout.write(JSON.stringify(decisionToCodexOutput(decision)));
 }

package/apps/bridge/src/bin/codex-policy-hook.ts

@@ -1,7 +1,10 @@
 #!/usr/bin/env -S npx tsx
-/** Deny-only Codex PreToolUse policy for exact per-chat capability switches. */
+/** Codex PreToolUse: deterministic deny or one-shot Project ASK handoff. */
 import type { HookInput } from "../adapters";
 import { blockedSessionCapability, isProviderEnabled } from "../config";
+import { recordCodexProjectAsk } from "../policy/codex-project-ask";
+import { evaluateEffectiveAction } from "../policy/effective-action";
+import { protectedGrantTapAccess } from "../self-protection";
 
 async function readStdin(): Promise<string> {
   const chunks: Buffer[] = [];
@@ -10,24 +13,53 @@ async function readStdin(): Promise<string> {
 }
 
 async function main(): Promise<void> {
-  if (!isProviderEnabled("codex")) return;
   let input: HookInput;
   try {
     input = JSON.parse(await readStdin()) as HookInput;
   } catch {
     return;
   }
+  const protectedAccess = protectedGrantTapAccess(input.tool_name, input.tool_input);
+  if (protectedAccess) {
+    deny(protectedAccess.reason);
+    return;
+  }
+  if (!isProviderEnabled("codex")) return;
   const blocked = blockedSessionCapability(
     input.session_id,
     input.tool_name,
     input.tool_input,
   );
-  if (!blocked) return;
+  const decision = await evaluateEffectiveAction({
+    provider: "codex",
+    sessionId: input.session_id,
+    cwd: input.cwd,
+    toolName: input.tool_name,
+    toolInput: input.tool_input,
+    legacyDenyReason: blocked?.reason,
+  });
+  if (decision.effect === "deny") {
+    deny(decision.reason);
+    return;
+  }
+  if (decision.effect !== "ask") return;
+  const recorded = recordCodexProjectAsk({
+    sessionId: input.session_id,
+    toolUseId: input.tool_use_id,
+    toolName: input.tool_name,
+    toolInput: input.tool_input,
+  }, decision.reason);
+  if (!recorded) {
+    deny("Project approval could not be bound to this exact Codex call");
+  }
+}
+
+function deny(reason: string): void {
   process.stdout.write(JSON.stringify({
     hookSpecificOutput: {
       hookEventName: "PreToolUse",
       permissionDecision: "deny",
-      permissionDecisionReason: blocked.reason,
+      permissionDecisionReason: reason,
     },
   }));
 }