granttap-mcp 0.7.6 → 0.8.2

package/LICENSE

@@ -1,21 +1,86 @@
-MIT License
-
-Copyright (c) 2026 Serhii Ziborov
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+GrantTap Commercial Source License 1.0
+
+Copyright (c) 2026 Serhii Ziborov. All rights reserved.
+
+This license governs the source code and software distributed from the
+granttap-mcp repository and package (the "Software"), except for third-party
+components that identify their own license terms.
+
+1. Definitions
+
+"GrantTap" means Serhii Ziborov doing business as GrantTap.
+
+"Authorized Access" means an active paid GrantTap subscription, an official
+GrantTap trial, or a separate written commercial agreement with GrantTap.
+
+"Authorized User" means a person or legal entity covered by Authorized Access.
+
+2. Source inspection and contribution
+
+You may download, inspect, and make local modifications to the source solely to
+evaluate the Software, perform security review, or prepare a contribution to
+the official GrantTap repository. You may create a public fork solely for that
+contribution workflow if the fork retains this license and does not publish a
+release, binary, hosted service, or independently usable distribution.
+
+These rights do not permit production use, commercial use, or use to provide a
+service to another person.
+
+3. Authorized product use
+
+During Authorized Access, GrantTap grants the Authorized User a limited,
+non-exclusive, non-transferable, non-sublicensable license to install, execute,
+and internally modify the Software on devices the Authorized User owns or
+controls, solely to use the official GrantTap product and services.
+
+When Authorized Access ends, the Authorized User must stop using the Software
+except where a separate written agreement says otherwise.
+
+4. Restrictions
+
+Unless GrantTap gives prior written permission, you may not:
+
+- sell, sublicense, redistribute, or publish the Software or a derivative work;
+- offer the Software or a derivative work as a hosted or managed service;
+- use the Software to build or operate a competing product or service;
+- use the Software as a standalone general-purpose coding-agent runtime outside
+  the official GrantTap product;
+- bypass subscription, license, access-control, or entitlement checks;
+- remove or alter copyright, license, attribution, or proprietary notices; or
+- use GrantTap names or marks to imply endorsement of a modified distribution.
+
+5. Ownership
+
+The Software is licensed, not sold. GrantTap retains all right, title, and
+interest in the Software and its derivative works. No trademark, patent, or
+other rights are granted except the limited copyright rights stated here.
+
+6. Third-party components
+
+Third-party components remain governed by their respective licenses. Those
+licenses and notices are not replaced by this license. See
+THIRD_PARTY_NOTICES.md where distributed.
+
+7. Termination
+
+This license terminates automatically if you breach its terms. On termination,
+you must stop using and distributing the Software and delete copies that you
+are not legally required to retain. Sections 4 through 9 survive termination.
+
+8. Disclaimer of warranty
+
+THE SOFTWARE IS PROVIDED "AS IS" AND "AS AVAILABLE", WITHOUT WARRANTIES OF
+ANY KIND, EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY, FITNESS
+FOR A PARTICULAR PURPOSE, TITLE, AND NON-INFRINGEMENT.
+
+9. Limitation of liability
+
+TO THE MAXIMUM EXTENT PERMITTED BY LAW, GRANTTAP AND ITS CONTRIBUTORS WILL NOT
+BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, OR
+PUNITIVE DAMAGES, OR FOR LOSS OF DATA, PROFITS, REVENUE, OR BUSINESS, ARISING
+FROM OR RELATED TO THE SOFTWARE OR THIS LICENSE.
+
+10. Commercial terms
+
+Authorized Access, pricing, and separate commercial licenses are available
+through https://granttap.com.

package/README.md

@@ -2,7 +2,7 @@
 
 [![npm](https://img.shields.io/npm/v/granttap-mcp)](https://www.npmjs.com/package/granttap-mcp)
 [![CI](https://github.com/sergii-ziborov/granttap-mcp/actions/workflows/ci.yml/badge.svg)](https://github.com/sergii-ziborov/granttap-mcp/actions/workflows/ci.yml)
-[![MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
+[![License](https://img.shields.io/badge/license-GrantTap%20Commercial-7c3aed.svg)](LICENSE)
 
 GrantTap is a Personal live control center for local coding agents.
 
@@ -13,6 +13,10 @@ hooks, local adapters, and TypeScript wire schemas. Agents and provider
 credentials stay on your computer. Native iPhone and Apple Watch traffic is
 end-to-end encrypted.
 
+The source is public for inspection and contribution, but GrantTap MCP is
+proprietary paid software rather than open source. Production use requires an
+active GrantTap subscription or a separate commercial agreement.
+
 [Website](https://granttap.com) · [npm](https://www.npmjs.com/package/granttap-mcp) ·
 [Security model](SECURITY.md) ·
 [Relay source](https://github.com/sergii-ziborov/granttap-relay)
@@ -74,11 +78,34 @@ parity.
 A capsule carries facts, not files. A handoff from a checkout with uncommitted
 changes is refused — "This task has uncommitted changes. Commit or checkpoint
 them before moving the task." — instead of silently continuing the Task from
-committed state and leaving that work behind. The destination is refused just
+committed state and leaving that work behind. Asked to checkpoint from the
+phone, the source computer commits everything to `granttap/checkpoint/<task>`
+from a temporary index, so HEAD, the current branch, and the working tree stay
+exactly as the agent left them, and the capsule carries that commit. Nothing is
+pushed; the destination says so if the commit has not reached it.
+
+Claims do not wait for an agent to announce them. Every edit an agent makes is
+visible in its transcript, so the runtime derives an intent claim from each
+recent write — marked as seen rather than said, and expiring ten minutes after
+the writing stops. Overlap is judged twice: the same file is a conflict, and
+the same module is the warning that comes before it. A module is recognised
+from the path alone, so every computer and the phone reach the same answer,
+and the Task screen names who else is in this Task's files or modules while it
+can still be avoided. The destination is refused just
 as explicitly when the named commit is not on its computer, or when the
 capsule's own resource claims overlap another execution's; GrantTap never
 pushes or fetches on its own.
 
+A Project usually binds more than one repository, and a bound repository can
+say which of the others sit on the far side of its databases, topics, and APIs:
+commit a [`WEAVATRIX.md`](https://github.com/Weavatrix/weavatrix-md) next to the
+README and the runtime reads it — only the edges it states, nothing inferred —
+and publishes them with the Project. The Task screen then names another Task
+that is working on the other side of a contract this Task touches (the consumer
+of a topic it produces, the caller of an API it changes), and the scoped
+`granttap://mesh/{capability}` resource gives the agent the same `peers`,
+`otherSide`, and `neighbours` so it can coordinate before it commits.
+
 ### Grok Bot as a scoped Mesh participant
 
 Grok Bot is a persistent agent, not a coding-agent integration. The iPhone
@@ -97,6 +124,9 @@ history stays on the device.
 
 ## Install
 
+Installation and production use require Authorized Access under the
+[GrantTap Commercial Source License](LICENSE).
+
 ```bash
 npm install -g granttap-mcp
 granttap setup
@@ -107,10 +137,17 @@ hooks, installs the background helper, configures Cursor's persistent local
 OAuth service when Cursor is present, and starts phone pairing when run in an
 interactive terminal. It ends with one exact next action.
 
+Setup also declares the separately distributed GrantTap Engine, which Project
+Governance needs before it can report anything. The standard locations are
+searched, and `--engine <path>` points at one that lives elsewhere; the binary
+is checksummed here, because that checksum is the only thing verified before it
+is launched. Without an engine the rollout stays off and setup says so, rather
+than leaving "Governance not reported" on the phone as the only symptom.
+
 The normal CLI surface is intentionally small:
 
 ```text
-granttap setup
+granttap setup [--engine <path>]
 granttap status [--json]
 granttap connect [--relay <wss-url>]
 granttap reset [--yes]
@@ -162,11 +199,64 @@ The bounded encrypted protocol preserves:
 - visible activity, delivery state, context and token counters;
 - MCP, Skill, and CLI observations;
 - child-agent relationships;
-- per-capability outcome: `success`, `error`, `cancelled`, or `unknown`.
+- per-capability outcome: `success`, `error`, `cancelled`, or `unknown`;
+- what a call cost, where the machine can be observed while it ran.
 
 An optional bounded `errorClass` may describe an error category. Full tool
 error payloads are not copied into usage telemetry by default.
 
+### One computer, whatever the network calls it
+
+The Mesh keys a computer by an identity written down once, on first use, in
+`computer.json` in the config directory — the hostname it had then — and
+keeps it. A Mac renamed by the network it joins ("Mac.lan" at home,
+"Serhiis-MacBook-Pro.local" elsewhere) used to become a second computer with
+its own open executions and repository bindings; now every later hostname is
+remembered as a former name of the same machine, its leftover executions are
+closed and its bindings marked unavailable, and the current hostname stays
+what people see. `GRANTTAP_COMPUTER_ID` overrides the stored id.
+
+### Run journal and prompt-time context
+
+A message from the phone is answered by a fresh `claude -p --resume` of the
+same chat. Its turns land in the transcript, but a session holding that chat
+open never sees them — its context was built before they happened. The runtime
+therefore journals every delivery: what was asked (without the attachment
+note), what came back, which files were written, how many tool calls it took,
+and whether the run was cut off by the ten-minute delivery limit. The Task
+carries the same digest as `TASK_PROGRESS`, so the phone's timeline and the
+Mesh show it. A `UserPromptSubmit` hook, installed beside the approval hook by
+`granttap setup`, adds the unread journal to the next prompt of the live
+session together with the Mesh brief — the other live Tasks in the Project,
+who is in the same file or module, the other side of the repository, and any
+question still unanswered — and names the MCP resource
+`granttap://mesh/{capability}/map`, one page of markdown with the whole
+Project: Tasks, who edits which module, the other side of each repository,
+dependencies, and what just happened. Background runs themselves receive
+nothing from the hook; the journal is kept for the session a person is in.
+
+### Tool versions and updates from the phone
+
+The status also names each provider's command-line tool as it answers on this
+computer — its version, how it is kept current, and, for Claude Code, whether a
+newer copy already sits on the disk (the Claude desktop app keeps its own; the
+runtime uses the newest one it finds). A tool that lags the rest of the
+environment fails in ways the phone can only report, so the phone can ask this
+computer to update one: the phone names only the tool, and the command is the
+runtime's, fixed by how the tool was installed — `claude update`, `agent
+update`, `grok update`, the npm that owns the tool's prefix, or Homebrew. The
+runtime never downloads a tool itself; a tool installed by an installer script
+is left to a trusted terminal, with the command spelled out in the answer. The
+result — version before and after, the updater's own output — comes back as
+`tool.update.result`.
+
+Cost is reported as attributed rather than measured, because that is what it
+is. A call is read back from the transcript once it has finished, so it can
+never be measured directly: an MCP server outlives its calls and is sampled
+directly, while a built-in tool leaves nothing behind and is costed from the
+samples that fall inside its own start and end. A call with no sample near it
+reports nothing rather than a number borrowed from another moment.
+
 ## Local enforcement
 
 GrantTap can narrow later actions for an exact task only where a provider
@@ -184,6 +274,34 @@ The user-facing approval modes map to the existing runtime policy:
 
 Legacy custom levels remain compatible but are not part of the primary flow.
 
+## Project Governance
+
+Capabilities are decided per Project, not per task. A policy names an effect —
+`allow`, `ask`, or `deny` — for each kind (skills, MCP servers, shell and
+scripts, file writes, deploy, network), and may name one capability alone: one
+MCP server can be forbidden without forbidding every server. A named rule wins
+over its kind, and a global deny always wins over a Project.
+
+The phone authors the policy and hands it to every Project computer through the
+relay, which holds the encrypted packet until each computer reads its mailbox;
+a computer that was asleep receives it when it returns. Each computer applies
+the policy through the GrantTap Engine, acknowledges the revision it enforces,
+and reports coverage — enforced, observed only, unsupported, or unknown — per
+capability kind, so the phone shows what is actually in force rather than what
+was sent. Revision zero is a Project with no policy yet, and it is reported so
+the first policy can be written.
+
+Evaluation happens in the provider hook before the action runs, with a deadline
+long enough for a busy machine to answer. A missed answer falls back to the
+legacy GrantTap gate rather than to a silent allow, and content never crosses
+to the engine: it receives a capability fingerprint, not the command or file.
+
+A refusal is said where the action was. Each one is written down for its chat,
+and the timeline carries it as a status row naming the rule and the reason,
+beside the call it stopped. On the phone a rule is written where the need for
+it appears: touch and hold a tool on the Project page, or use the Governance
+menu on a tool's call history, to allow, ask, or deny it for the Project.
+
 ## Relay boundary
 
 Pairing and task keys are generated locally. The relay receives opaque routing
@@ -217,4 +335,12 @@ gate on macOS, and `npm publish` enforces the same gate through
 Do not publish from a dirty checkout or before the package allowlist, tests,
 typecheck, and release checks pass.
 
+## License
+
+GrantTap MCP is distributed under the proprietary
+[GrantTap Commercial Source License 1.0](LICENSE). Public source access does not
+grant open-source, redistribution, hosted-service, or competing-product rights.
+Third-party dependencies retain their own terms; see
+[THIRD_PARTY_NOTICES.md](THIRD_PARTY_NOTICES.md).
+
 GrantTap is not affiliated with Anthropic, OpenAI, Apple, Anysphere, or xAI.

package/THIRD_PARTY_NOTICES.md

@@ -0,0 +1,23 @@
+# Third-party notices
+
+GrantTap MCP is proprietary software distributed under the GrantTap Commercial
+Source License. Third-party components retain their own licenses; the GrantTap
+license does not replace or restrict those terms.
+
+The npm package declares, rather than vendors, these direct runtime
+dependencies. Their packages carry the applicable license texts:
+
+| Component | License |
+| --- | --- |
+| `@modelcontextprotocol/sdk` | MIT |
+| `express` | MIT |
+| `qrcode` | MIT |
+| `tsx` | MIT |
+| `tweetnacl` | The Unlicense |
+| `ws` | MIT |
+| `zod` | MIT |
+
+The unpublished Rust workspace also depends on separately licensed components,
+including `mcport` (MIT), `blazingly-json` (MIT), `serde` (MIT OR Apache-2.0), and
+BlindPlane crates (MIT OR Apache-2.0). Binary distributions must retain the
+complete license texts required by the exact dependency versions they contain.

package/apps/bridge/src/bin/claude-hook.ts

@@ -12,6 +12,7 @@
  * Fails closed: any error or timeout denies the tool call rather than letting it
  * through unattended — unless GrantTap auto-accept allows it locally.
  */
+import { recordProjectDecision } from "../policy/decision-log";
 import { claudeToRequest, decisionToClaudeOutput, type HookInput } from "../adapters";
 import { isUnanswered, requestApproval } from "../approval";
 import {
@@ -25,6 +26,10 @@ import {
 } from "../config";
 import { recordAttributedCall } from "../mesh/call-scope";
 import { classifyAction } from "../policy";
+import {
+  evaluateEffectiveAction,
+  legacyGrantTapFlowAllowed,
+} from "../policy/effective-action";
 import { protectedGrantTapAccess } from "../self-protection";
 
 async function readStdin(): Promise<string> {
@@ -35,31 +40,20 @@ async function readStdin(): Promise<string> {
 
 async function main(): Promise<void> {
   const raw = await readStdin();
-  let input: HookInput = {};
+  let input: HookInput;
   try {
     input = JSON.parse(raw) as HookInput;
   } catch {
-    process.stdout.write(
-      JSON.stringify({
-        hookSpecificOutput: {
-          hookEventName: "PreToolUse",
-          permissionDecision: "deny",
-          permissionDecisionReason: "GrantTap received invalid hook JSON",
-        },
-      }),
-    );
+    writePermission("deny", "GrantTap received invalid hook JSON");
     return;
   }
+  await handlePreToolUse(input);
+}
 
+async function handlePreToolUse(input: HookInput): Promise<void> {
   const protectedAccess = protectedGrantTapAccess(input.tool_name, input.tool_input);
   if (protectedAccess) {
-    process.stdout.write(JSON.stringify({
-      hookSpecificOutput: {
-        hookEventName: "PreToolUse",
-        permissionDecision: "deny",
-        permissionDecisionReason: protectedAccess.reason,
-      },
-    }));
+    writePermission("deny", protectedAccess.reason);
     return;
   }
 
@@ -80,43 +74,49 @@ async function main(): Promise<void> {
     input.tool_name,
     input.tool_input,
   );
-  if (blocked) {
-    process.stdout.write(
-      JSON.stringify({
-        hookSpecificOutput: {
-          hookEventName: "PreToolUse",
-          permissionDecision: "deny",
-          permissionDecisionReason: blocked.reason,
-        },
-      }),
-    );
+  const projectDecision = await evaluateEffectiveAction({
+    provider: "claude",
+    sessionId: input.session_id,
+    cwd: input.cwd,
+    toolName: input.tool_name,
+    toolInput: input.tool_input,
+    legacyDenyReason: blocked?.reason,
+  });
+  if (projectDecision.effect === "deny") {
+    // Say so where the action was, not only to the agent.
+    if (input.session_id) {
+      recordProjectDecision(input.session_id, {
+        at: Date.now(), toolName: input.tool_name ?? "tool", reason: projectDecision.reason,
+        ruleId: projectDecision.rule_id,
+      });
+    }
+    writePermission("deny", projectDecision.reason);
     return;
   }
+  const legacyFlow = legacyGrantTapFlowAllowed(projectDecision);
 
   // Claude already granted this chat unconditional tool access. GrantTap's
-  // explicit MCP/skill/CLI blocks above still win, but phone approval must not
-  // re-prompt a call Claude is intentionally running in bypass mode.
-  if (input.permission_mode === "bypassPermissions") return;
+  // Project ASK/DENY is a parent boundary, so bypass mode cannot weaken it.
+  if (legacyFlow && input.permission_mode === "bypassPermissions") return;
 
   // Gating paused, or this session is exempt → abstain (empty output = Claude
   // uses its normal permission flow, exactly as if GrantTap weren't installed).
-  if (isGatingSkipped(input.session_id)) return;
+  if (legacyFlow && isGatingSkipped(input.session_id)) return;
+  await continuePermissionFlow(input, legacyFlow);
+}
 
+async function continuePermissionFlow(input: HookInput, legacyFlow: boolean): Promise<void> {
   let cfg;
   try {
     cfg = loadConfig(machineConfigPath());
   } catch {
+    if (!legacyFlow) {
+      writePermission("deny", "Project policy requires GrantTap approval, but this computer is not paired");
+      return;
+    }
     // No pairing yet: don't block the user's normal workflow — defer to Claude's
     // own prompt by emitting "ask".
-    process.stdout.write(
-      JSON.stringify({
-        hookSpecificOutput: {
-          hookEventName: "PreToolUse",
-          permissionDecision: "ask",
-          permissionDecisionReason: "GrantTap not paired (run `npm run init`)",
-        },
-      }),
-    );
+    writePermission("ask", "GrantTap not paired (run `npm run init`)");
     return;
   }
 
@@ -125,21 +125,8 @@ async function main(): Promise<void> {
   // the user never finished setting up. Once paired, this is what keeps routine
   // work independent of whether the phone is awake, reachable, or even running.
   const req = claudeToRequest(input);
-  if (shouldAutoAcceptTool(input.session_id, req.tool, req.command)) {
-    const level = autoAcceptLevelFor(input.session_id);
-    const cls = classifyAction(req.tool, req.command);
-    process.stdout.write(
-      JSON.stringify(
-        decisionToClaudeOutput({
-          type: "approval.decision",
-          requestId: req.requestId,
-          decision: "allow",
-          decidedBy: "auto",
-          note: `GrantTap auto-accept (${level} / ${cls})`,
-          decidedAt: Date.now(),
-        }),
-      ),
-    );
+  if (legacyFlow && shouldAutoAcceptTool(input.session_id, req.tool, req.command)) {
+    writeAutoApproval(input, req);
     return;
   }
 
@@ -153,12 +140,38 @@ async function main(): Promise<void> {
   // Relay down or phone asleep ≠ phone said no: abstain so Claude's local flow
   // handles it (avoid flooding "решай локально" on every tool).
   if (isUnanswered(decision)) {
+    if (!legacyFlow) {
+      writePermission("deny", "Project approval was required but no decision was received");
+    }
     return;
   }
 
   process.stdout.write(JSON.stringify(decisionToClaudeOutput(decision)));
 }
 
+function writeAutoApproval(input: HookInput, req: ReturnType<typeof claudeToRequest>): void {
+  const level = autoAcceptLevelFor(input.session_id);
+  const cls = classifyAction(req.tool, req.command);
+  process.stdout.write(JSON.stringify(decisionToClaudeOutput({
+    type: "approval.decision",
+    requestId: req.requestId,
+    decision: "allow",
+    decidedBy: "auto",
+    note: `GrantTap auto-accept (${level} / ${cls})`,
+    decidedAt: Date.now(),
+  })));
+}
+
+function writePermission(decision: "deny" | "ask", reason: string): void {
+  process.stdout.write(JSON.stringify({
+    hookSpecificOutput: {
+      hookEventName: "PreToolUse",
+      permissionDecision: decision,
+      permissionDecisionReason: reason,
+    },
+  }));
+}
+
 main().catch((err) => {
   process.stdout.write(
     JSON.stringify({

package/apps/bridge/src/bin/claude-prompt-hook.ts

@@ -0,0 +1,40 @@
+#!/usr/bin/env -S npx tsx
+/**
+ * Claude Code UserPromptSubmit hook entry point.
+ *
+ * Registered in ~/.claude/settings.json so that when a person submits a
+ * prompt, this program adds what the chat could not know by itself: the
+ * background runs that answered phone messages in it, and the Mesh brief for
+ * its Task. It never blocks a prompt — anything wrong, and it adds nothing.
+ *
+ *   Reads:  UserPromptSubmit JSON on stdin ({ session_id, prompt, cwd, ... })
+ *   Writes: { hookSpecificOutput: { hookEventName, additionalContext } } on stdout
+ */
+import { promptContext } from "../mesh/prompt-context";
+
+async function readStdin(): Promise<string> {
+  const chunks: Buffer[] = [];
+  for await (const chunk of process.stdin) chunks.push(chunk as Buffer);
+  return Buffer.concat(chunks).toString("utf8");
+}
+
+async function main(): Promise<void> {
+  // A background run answering the phone is itself a prompt submission; it is
+  // not the live session the journal is kept for.
+  if (process.env.GRANTTAP_DELIVERY) return;
+  const raw = await readStdin();
+  let input: { session_id?: unknown };
+  try {
+    input = JSON.parse(raw) as { session_id?: unknown };
+  } catch {
+    return;
+  }
+  const sessionId = typeof input.session_id === "string" ? input.session_id.trim() : "";
+  const text = promptContext(sessionId);
+  if (!text) return;
+  process.stdout.write(JSON.stringify({
+    hookSpecificOutput: { hookEventName: "UserPromptSubmit", additionalContext: text },
+  }));
+}
+
+main().catch(() => undefined).finally(() => process.exit(0));

package/apps/bridge/src/bin/codex-hook.ts

@@ -25,6 +25,7 @@ import {
 } from "../config";
 import { recordAttributedCall } from "../mesh/call-scope";
 import { classifyAction } from "../policy";
+import { consumeCodexProjectAsk } from "../policy/codex-project-ask";
 import { protectedGrantTapAccess } from "../self-protection";
 
 async function readStdin(): Promise<string> {
@@ -77,9 +78,15 @@ async function main(): Promise<void> {
     process.stdout.write(denyOutput(blocked.reason));
     return;
   }
+  const projectAsk = consumeCodexProjectAsk({
+    sessionId: input.session_id,
+    toolUseId: input.tool_use_id,
+    toolName: input.tool_name,
+    toolInput: input.tool_input,
+  });
 
   // Gating paused or this session exempt → stay silent (Codex uses its own flow).
-  if (isGatingSkipped(input.session_id)) return;
+  if (!projectAsk && isGatingSkipped(input.session_id)) return;
 
   let cfg;
   try {
@@ -91,7 +98,7 @@ async function main(): Promise<void> {
 
   // Local policy, evaluated after pairing is confirmed — see claude-hook.
   const req = codexToRequest(input);
-  if (shouldAutoAcceptTool(input.session_id, req.tool, req.command)) {
+  if (!projectAsk && shouldAutoAcceptTool(input.session_id, req.tool, req.command)) {
     const level = autoAcceptLevelFor(input.session_id);
     const cls = classifyAction(req.tool, req.command);
     process.stdout.write(
@@ -116,9 +123,14 @@ async function main(): Promise<void> {
   );
   const decision = await requestApproval(cfg, req, { timeoutMs });
 
-  // Relay down or phone never answered: stay silent — an empty hook result
-  // sends Codex back to its own approval flow, so desk work keeps going.
-  if (isUnanswered(decision)) return;
+  // Routine relay failure stays in Codex's native flow. A Project ASK cannot
+  // fall through to provider approval because that would weaken the parent rule.
+  if (isUnanswered(decision)) {
+    if (projectAsk) {
+      process.stdout.write(denyOutput("Project approval was required but no decision was received"));
+    }
+    return;
+  }
 
   process.stdout.write(JSON.stringify(decisionToCodexOutput(decision)));
 }