tollgate-cli 0.1.0 → 0.2.0

package/README.md

@@ -6,7 +6,7 @@ Your team approves before your coding agent does something you can't undo.
 
 - **Approved:** the command continues, through Claude Code's normal permission check (Guard mode, the default).
 - **Denied with a reason:** the agent receives the reason as its next instruction and revises its plan.
-- **Nobody answers in time:** the gate is **parked**. The agent moves on, and once a teammate approves, the exact same command passes on retry (single use, 24 h).
+- **Nobody answers in time:** the gate is **parked** and approvers who haven't voted get a reminder (and one more an hour later). The agent moves on, and once a teammate approves, the exact same command passes on retry (single use, 24 h).
 
 Every other command runs untouched; the hook adds about 50 ms.
 
@@ -35,7 +35,7 @@ Every other command runs untouched; the hook adds about 50 ms.
 
 ## What leaves your machine
 
-Only for commands that match a preset: the command and working directory after **local redaction** (known token formats, `KEY=value` secrets, passwords in URLs, secret flags, and every value from your `.env*` files), your git branch, the last commit subject, and for migrations the newest migration's SQL (capped at 2 KB). The card shows how many values were hidden. The server redacts everything again.
+Only for commands that match a preset: the command and working directory after **local redaction** (known token formats, `KEY=value` secrets, passwords in URLs, secret flags, and every value from your `.env*` files), Claude Code's one-line description of the command (shown to approvers as the agent's reason), your git branch, the last commit subject, and for migrations the newest migration's SQL (capped at 2 KB). The card shows how many values were hidden. The server redacts everything again.
 
 ## Commands
 

package/dist/tollgate.mjs

@@ -20114,6 +20114,8 @@ var createGateSchema = external_exports.object({
   // redacted by the hook
   branch: external_exports.string().max(200).nullable().optional(),
   context: external_exports.string().max(2048).default(""),
+  // Claude Code's own one-line description of the Bash call ("Apply pending migrations").
+  intent: external_exports.string().max(300).nullable().optional(),
   redactions: external_exports.number().int().min(0).max(1e4).default(0),
   cmdHash: external_exports.string().regex(SHA256_RE),
   sessionId: external_exports.string().max(200).optional()
@@ -20153,11 +20155,12 @@ var RULES = [
     re: /\b(Bearer|Basic)\s+[A-Za-z0-9._~+/-]{8,}=*/g,
     replace: (_m, scheme) => `${scheme} ${REDACTED}`
   },
-  // FOO_TOKEN=..., export DB_PASSWORD="...", etc. Non-secret names (NODE_ENV=prod) stay.
+  // FOO_TOKEN=..., export DB_PASSWORD="...", bare PASSWORD=..., etc. Non-secret names
+  // (NODE_ENV=prod) stay.
   // DATABASE_URL=... is left to url-credentials on purpose: approvers need to see the host.
   {
     name: "secret-assignment",
-    re: /\b([A-Za-z_][A-Za-z0-9_]*(?:KEY|TOKEN|SECRET|PASSWORD|PASSWD|PWD|CREDENTIALS?|AUTH)[A-Za-z0-9_]*)=("[^"]*"|'[^']*'|[^\s;&|]+)/gi,
+    re: /\b((?:[A-Za-z_][A-Za-z0-9_]*)?(?:KEY|TOKEN|SECRET|PASSWORD|PASSWD|PWD|CREDENTIALS?|AUTH)[A-Za-z0-9_]*)=("[^"]*"|'[^']*'|[^\s;&|]+)/gi,
     replace: (_m, name) => `${name}=${REDACTED}`
   },
   {
@@ -20256,6 +20259,8 @@ async function decide(input2, deps) {
     const redactedCwd = redact(cwd, secrets);
     const context = redact(deps.context(command, config2.repoRoot), secrets);
     const branch = deps.gitBranch(config2.repoRoot);
+    const description = input2.tool_input?.description;
+    const intent = typeof description === "string" && description.trim() ? redact(description.trim(), secrets) : null;
     let gate = await api.createGate({
       preset: match.preset.name,
       quorum: match.quorum,
@@ -20264,7 +20269,8 @@ async function decide(input2, deps) {
       cwd: truncate(redactedCwd.text, 500),
       branch: branch ? truncate(redact(branch, secrets).text, 200) : null,
       context: truncate(context.text, 2048),
-      redactions: redactedCommand.count + redactedCwd.count + context.count,
+      intent: intent ? truncate(intent.text, 300) : null,
+      redactions: redactedCommand.count + redactedCwd.count + context.count + (intent?.count ?? 0),
       cmdHash,
       sessionId: input2.session_id
     });
@@ -20382,7 +20388,7 @@ function writeRepoFiles(input2) {
 }
 
 // src/main.ts
-var HELP = `tollgate ${"0.1.0"}: your team approves risky agent commands before they run
+var HELP = `tollgate ${"0.2.0"}: your team approves risky agent commands before they run
 
 Usage:
   npx tollgate-cli init --token <tg_\u2026> [--server <url>] [--repo <owner/name>]
@@ -20566,7 +20572,7 @@ async function main() {
       return runUnlink();
     case "--version":
     case "-v":
-      process.stdout.write(`${"0.1.0"}
+      process.stdout.write(`${"0.2.0"}
 `);
       return;
     default:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tollgate-cli",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "Your team approves risky Claude Code commands before they run.",
   "license": "MIT",
   "type": "module",