tollgate-cli 0.2.1 → 0.2.3

package/README.md

@@ -34,6 +34,16 @@ Every other command runs untouched; the hook adds about 50 ms.
 | `.claude/settings.local.json` | No (added to `.gitignore`): your personal hook registration      |
 | `~/.config/tollgate/`         | Never in a repo: your token (file mode 0600) and the hook bundle |
 
+## What the hook can see through
+
+Agents rarely type the risky command itself. The hook looks at what a command really runs:
+
+- **Package scripts:** `pnpm db:deploy`, `npm run release`, `yarn deploy`, `bun run x` are looked up in the nearest `package.json` (with `pre`/`post` scripts and scripts that call other scripts), so the card shows _pnpm db:deploy → prisma migrate deploy_ with the migration SQL.
+- **Lists and wrappers:** every part of `a && b; c | d` is checked on its own, so `npm publish && echo --dry-run` is still a publish. Prefixes like `VAR=x`, `env`, `sudo`, `npx`, `pnpm exec`, `dotenv --` and literal `bash -c '…'`, `eval '…'`, `( … )` and `$( … )` are looked inside.
+- **Code nobody can read first:** `curl … | sh`, `base64 -d | sh`, `bash <(curl …)` and commands built from a variable (`eval "$CMD"`) are gated as _opaque_.
+
+Tollgate is not a shell parser and not a sandbox. It does **not** read Makefiles (`make deploy`), shell files (`./deploy.sh`), npm lifecycle scripts like `prepublishOnly`, or workspace scripts selected with `--filter`. It guards against an agent's mistakes, not against someone determined to get around it on their own machine.
+
 ## What leaves your machine
 
 Only for commands that match a preset: the command and working directory after **local redaction** (known token formats, `KEY=value` secrets, passwords in URLs, secret flags, and every value from your `.env*` files), Claude Code's one-line description of the command (shown to approvers as the agent's reason), your git branch, the last commit subject, and for migrations the newest migration's SQL (capped at 2 KB). The card shows how many values were hidden. The server redacts everything again.

package/dist/tollgate.mjs

@@ -5242,14 +5242,14 @@ var memo = {
     var _a3;
     (_a3 = inst._zod).deferred ?? (_a3.deferred = []);
     inst._zod.deferred.push(() => {
-      const base = inst._zod.parse;
+      const base2 = inst._zod.parse;
       const wrapped = (payload, ctx) => {
         if (ctx.direction !== "backward" && isBackEdge(ctx, payload.value))
           throw new $ZodCyclicError();
-        return base(payload, ctx);
+        return base2(payload, ctx);
       };
       inst._zod.parse = wrapped;
-      if (inst._zod.run === base)
+      if (inst._zod.run === base2)
         inst._zod.run = wrapped;
     });
   },
@@ -5261,15 +5261,15 @@ var memo = {
     let lastBucket;
     (_a3 = inst._zod).deferred ?? (_a3.deferred = []);
     inst._zod.deferred.push(() => {
-      const base = inst._zod.parse;
+      const base2 = inst._zod.parse;
       const wrapped = (payload, ctx) => {
         if (isRecursiveInst === void 0) {
           const walked = isRecursive(inst, /* @__PURE__ */ new Set(), false);
           if (walked === NONE) {
-            inst._zod.parse = base;
+            inst._zod.parse = base2;
             if (inst._zod.run === wrapped)
-              inst._zod.run = base;
-            return base(payload, ctx);
+              inst._zod.run = base2;
+            return base2(payload, ctx);
           }
           if (walked === PROVEN || rechecked)
             isRecursiveInst = true;
@@ -5278,7 +5278,7 @@ var memo = {
         }
         const input2 = payload.value;
         if (!isRef(input2))
-          return base(payload, ctx);
+          return base2(payload, ctx);
         let state = ctx[STATE];
         if (!state) {
           state = { buckets: /* @__PURE__ */ new WeakMap(), backEdges: void 0 };
@@ -5307,7 +5307,7 @@ var memo = {
         }
         handoff = bucket;
         const depth = open.length;
-        const result = base(payload, ctx);
+        const result = base2(payload, ctx);
         handoff = void 0;
         const entry = open.length > depth ? open.pop() : void 0;
         if (result instanceof Promise) {
@@ -5322,7 +5322,7 @@ var memo = {
         return result;
       };
       inst._zod.parse = wrapped;
-      if (inst._zod.run === base)
+      if (inst._zod.run === base2)
         inst._zod.run = wrapped;
     });
   }
@@ -13231,9 +13231,9 @@ function codePointLengthVar(doc, ctx, accessor, inDoubt) {
   doc.write(`const ${v} = typeof ${accessor} === "string" && ${inDoubt} ? ${cpLen}(${accessor}) : ${accessor}.length;`);
   return v;
 }
-function numericOperand(value, label) {
+function numericOperand(value, label2) {
   if (typeof value !== "number" || !Number.isFinite(value)) {
-    throw new ZodCompileUnsupportedError(`${label} bound of type ${typeof value}`);
+    throw new ZodCompileUnsupportedError(`${label2} bound of type ${typeof value}`);
   }
   return `${value}`;
 }
@@ -19727,6 +19727,337 @@ function date4(params) {
   return _coercedDate(ZodDate, params);
 }
 
+// ../../features/gates/shared/expand.ts
+var MAX_DEPTH = 4;
+var MAX_SEGMENTS = 64;
+var MAX_LABEL = 80;
+function scan(text, onChar) {
+  const state = { quote: null, depth: 0, backtick: false };
+  for (let i = 0; i < text.length; i++) {
+    const ch = text[i];
+    const skip = onChar(i, state);
+    if (typeof skip === "number") {
+      i = skip;
+      continue;
+    }
+    if (state.quote === "'") {
+      if (ch === "'") state.quote = null;
+      continue;
+    }
+    if (ch === "\\") {
+      i += 1;
+      continue;
+    }
+    if (state.quote === '"') {
+      if (ch === '"') state.quote = null;
+      else if (ch === "$" && text[i + 1] === "(") {
+        state.depth += 1;
+        i += 1;
+      } else if (ch === ")" && state.depth > 0) state.depth -= 1;
+      continue;
+    }
+    if (ch === "'" || ch === '"') state.quote = ch;
+    else if (ch === "`") state.backtick = !state.backtick;
+    else if (ch === "(") state.depth += 1;
+    else if (ch === ")" && state.depth > 0) state.depth -= 1;
+  }
+}
+var atTop = (s) => s.quote === null && s.depth === 0 && !s.backtick;
+function splitList(text) {
+  const parts = [];
+  let start = 0;
+  scan(text, (i, s) => {
+    if (!atTop(s)) return;
+    const ch = text[i];
+    const next = text[i + 1];
+    const prev = text[i - 1];
+    if (ch === "#" && (i === 0 || /\s/.test(prev))) {
+      parts.push(text.slice(start, i));
+      const end = text.indexOf("\n", i);
+      start = end === -1 ? text.length : end + 1;
+      return end === -1 ? text.length : end;
+    }
+    if (ch === ";" || ch === "\n") {
+      parts.push(text.slice(start, i));
+      start = i + 1;
+    } else if (ch === "&" && next === "&" || ch === "|" && next === "|") {
+      parts.push(text.slice(start, i));
+      start = i + 2;
+      return i + 1;
+    } else if (ch === "&" && prev !== ">" && prev !== "<" && prev !== "|" && next !== ">") {
+      parts.push(text.slice(start, i));
+      start = i + 1;
+    }
+  });
+  parts.push(text.slice(start));
+  return parts.map((part) => part.trim()).filter(Boolean);
+}
+function splitPipeline(text) {
+  const parts = [];
+  let start = 0;
+  scan(text, (i, s) => {
+    if (!atTop(s) || text[i] !== "|") return;
+    parts.push(text.slice(start, i));
+    const skipAmp = text[i + 1] === "&";
+    start = i + (skipAmp ? 2 : 1);
+    return skipAmp ? i + 1 : void 0;
+  });
+  parts.push(text.slice(start));
+  return parts.map((part) => part.trim()).filter(Boolean);
+}
+function shellWords(text) {
+  const words = [];
+  let current = "";
+  let inWord = false;
+  let quote = null;
+  let depth = 0;
+  let backtick = false;
+  for (let i = 0; i < text.length; i++) {
+    const ch = text[i];
+    if (quote === "'") {
+      if (ch === "'") quote = null;
+      else current += ch;
+      continue;
+    }
+    if (ch === "\\" && i + 1 < text.length) {
+      current += text[i + 1];
+      inWord = true;
+      i += 1;
+      continue;
+    }
+    if (quote === '"') {
+      if (ch === '"' && depth === 0) quote = null;
+      else {
+        if (ch === "$" && text[i + 1] === "(") depth += 1;
+        else if (ch === ")" && depth > 0) depth -= 1;
+        current += ch;
+      }
+      continue;
+    }
+    if (depth > 0 || backtick) {
+      if (ch === "(") depth += 1;
+      else if (ch === ")") depth -= 1;
+      else if (ch === "`") backtick = false;
+      current += ch;
+      continue;
+    }
+    if (/\s/.test(ch)) {
+      if (inWord) words.push(current);
+      current = "";
+      inWord = false;
+      continue;
+    }
+    inWord = true;
+    if (ch === "'" || ch === '"') quote = ch;
+    else if (ch === "$" && text[i + 1] === "(") {
+      depth = 1;
+      current += "$(";
+      i += 1;
+    } else if (ch === "`") {
+      backtick = true;
+      current += ch;
+    } else current += ch;
+  }
+  if (inWord) words.push(current);
+  return words;
+}
+var ASSIGNMENT = /^[A-Za-z_][A-Za-z0-9_]*=/;
+var base = (word) => word.slice(word.lastIndexOf("/") + 1);
+function skipFlags(words, withValue = /* @__PURE__ */ new Set()) {
+  let i = 0;
+  while (i < words.length && words[i].startsWith("-") && words[i] !== "--") {
+    i += withValue.has(words[i]) ? 2 : 1;
+  }
+  if (words[i] === "--") i += 1;
+  return words.slice(i);
+}
+var SUDO_VALUE = /* @__PURE__ */ new Set(["-u", "-g", "-C", "-D", "-h", "-p", "-r", "-t", "-U", "-T"]);
+var NPX_VALUE = /* @__PURE__ */ new Set(["-p", "--package", "-c", "--call"]);
+var ENV_VALUE = /* @__PURE__ */ new Set(["-u", "--unset", "-C", "--chdir", "-S", "--split-string"]);
+function stripPrefixes(input2) {
+  let words = input2;
+  for (let guard = 0; guard < 16 && words.length > 0; guard++) {
+    const first = base(words[0]);
+    const second = words[1];
+    let next = null;
+    if (ASSIGNMENT.test(words[0])) next = words.slice(1);
+    else if (first === "env") {
+      next = skipFlags(words.slice(1), ENV_VALUE);
+      while (next.length > 0 && ASSIGNMENT.test(next[0])) next = next.slice(1);
+    } else if (first === "sudo" || first === "doas") next = skipFlags(words.slice(1), SUDO_VALUE);
+    else if (["time", "nohup", "command", "exec", "builtin"].includes(first)) {
+      next = skipFlags(words.slice(1));
+    } else if (first === "nice") next = skipFlags(words.slice(1), /* @__PURE__ */ new Set(["-n"]));
+    else if (first === "npx" || first === "bunx") next = skipFlags(words.slice(1), NPX_VALUE);
+    else if (first === "pnpm" && (second === "exec" || second === "dlx")) {
+      next = skipFlags(words.slice(2));
+    } else if (first === "yarn" && (second === "dlx" || second === "exec")) {
+      next = skipFlags(words.slice(2));
+    } else if (first === "npm" && (second === "exec" || second === "x")) {
+      next = skipFlags(words.slice(2), NPX_VALUE);
+    } else if (first === "dotenv" || first === "dotenvx") {
+      const dash = words.indexOf("--");
+      next = dash === -1 ? skipFlags(words.slice(1), /* @__PURE__ */ new Set(["-e", "-f", "-v", "-c"])) : words.slice(dash + 1);
+      if (first === "dotenvx" && next[0] === "run")
+        next = skipFlags(next.slice(1), /* @__PURE__ */ new Set(["-f"]));
+    } else if (first === "cross-env") {
+      next = words.slice(1);
+      while (next.length > 0 && ASSIGNMENT.test(next[0])) next = next.slice(1);
+    }
+    if (next === null) break;
+    words = next;
+  }
+  return words;
+}
+var SHELLS = /* @__PURE__ */ new Set(["sh", "bash", "zsh", "dash", "ksh"]);
+function innerScript(words) {
+  if (words.length === 0) return null;
+  const first = base(words[0]);
+  if (SHELLS.has(first)) {
+    const flag = words.findIndex((word, i) => i > 0 && /^-[A-Za-z]*c[A-Za-z]*$/.test(word));
+    return flag !== -1 && words[flag + 1] !== void 0 ? words[flag + 1] : null;
+  }
+  if (first === "eval") return words.slice(1).join(" ") || null;
+  return null;
+}
+function substitutions(text) {
+  const found = [];
+  for (let i = 0; i < text.length; i++) {
+    if (text[i] === "'") {
+      const end = text.indexOf("'", i + 1);
+      if (end === -1) break;
+      i = end;
+      continue;
+    }
+    if (text[i] === "$" && text[i + 1] === "(" && text[i + 2] !== "(") {
+      let depth = 1;
+      let j = i + 2;
+      for (; j < text.length && depth > 0; j++) {
+        if (text[j] === "(") depth += 1;
+        else if (text[j] === ")") depth -= 1;
+      }
+      found.push(text.slice(i + 2, j - 1));
+      i = j - 1;
+    } else if (text[i] === "`") {
+      const end = text.indexOf("`", i + 1);
+      if (end === -1) break;
+      found.push(text.slice(i + 1, end));
+      i = end;
+    }
+  }
+  return found.filter((inner) => inner.trim());
+}
+var PNPM_BUILTINS = new Set(
+  "add i install update up upgrade remove rm uninstall un link ln unlink import rebuild rb prune fetch patch patch-commit exec dlx create publish pack audit list ls outdated why store root bin config c get set env init setup server deploy licenses doctor approve-builds ignored-builds self-update cat-file cat-index find-hash recursive multi m help".split(
+    " "
+  )
+);
+var YARN_BUILTINS = new Set(
+  "add install remove upgrade up publish init info why dlx exec workspace workspaces config cache link unlink pack version global import npm plugin set constraints dedupe explain node rebuild search stage unplug patch patch-commit login logout owner tag team audit autoclean check generate-lock-entry help licenses list outdated policies upgrade-interactive".split(
+    " "
+  )
+);
+var RUNNER_VALUE = /* @__PURE__ */ new Set([
+  "-C",
+  "--dir",
+  "--prefix",
+  "--filter",
+  "-F",
+  "-w",
+  "--workspace",
+  "--cwd"
+]);
+var NPM_LIFECYCLE = {
+  test: "test",
+  t: "test",
+  tst: "test",
+  start: "start",
+  stop: "stop",
+  restart: "restart"
+};
+function scriptName(words, scripts) {
+  if (words.length < 2) return null;
+  const tool = base(words[0]);
+  const rest = skipFlags(words.slice(1), RUNNER_VALUE);
+  const sub = rest[0];
+  if (!sub) return null;
+  const after = skipFlags(rest.slice(1), RUNNER_VALUE)[0] ?? null;
+  if (tool === "npm") {
+    if (["run", "run-script", "rum", "urn"].includes(sub)) return after;
+    return NPM_LIFECYCLE[sub] ?? null;
+  }
+  if (tool === "pnpm") {
+    if (sub === "run" || sub === "run-script") return after;
+    return PNPM_BUILTINS.has(sub) ? null : sub;
+  }
+  if (tool === "yarn") {
+    if (sub === "run") return after;
+    return YARN_BUILTINS.has(sub) ? null : sub;
+  }
+  if (tool === "bun") {
+    if (sub === "run") return after;
+    return scripts && sub in scripts ? sub : null;
+  }
+  return null;
+}
+function label(words) {
+  const text = words.join(" ");
+  return text.length > MAX_LABEL ? `${text.slice(0, MAX_LABEL - 1)}\u2026` : text;
+}
+function expandCommand(command, options) {
+  const maxDepth = options.maxDepth ?? MAX_DEPTH;
+  const maxSegments = options.maxSegments ?? MAX_SEGMENTS;
+  const segments = [];
+  let scripts;
+  const loadScripts = () => {
+    if (scripts === void 0) {
+      try {
+        scripts = options.readScripts?.(options.cwd) ?? null;
+      } catch {
+        scripts = null;
+      }
+    }
+    return scripts;
+  };
+  const visit2 = (text, via, depth, seen) => {
+    for (const pipeline of splitList(text)) {
+      if (segments.length >= maxSegments) return;
+      const group = /^\(([\s\S]*)\)$/.exec(pipeline) ?? /^\{([\s\S]*?);?\s*\}$/.exec(pipeline);
+      if (group) {
+        if (depth < maxDepth) visit2(group[1], via, depth + 1, seen);
+        continue;
+      }
+      const commands = splitPipeline(pipeline).map((part) => stripPrefixes(shellWords(part)));
+      const flat = commands.map((words) => words.join(" ")).filter(Boolean).join(" | ");
+      if (flat) segments.push({ text: flat, via });
+      if (depth >= maxDepth) continue;
+      for (const inner of substitutions(pipeline)) {
+        visit2(inner, [...via, "$(\u2026)"], depth + 1, seen);
+      }
+      for (const words of commands) {
+        const script = innerScript(words);
+        if (script) {
+          const wrapper = base(words[0]) === "eval" ? "eval" : `${base(words[0])} -c`;
+          visit2(script, [...via, wrapper], depth + 1, seen);
+        }
+        const name = scriptName(words, loadScripts() ?? null);
+        const all = loadScripts();
+        if (!name || !all || seen.has(name) || !(name in all)) continue;
+        const nextSeen = new Set(seen).add(name);
+        const from = [...via, label(words)];
+        for (const key of [`pre${name}`, name, `post${name}`]) {
+          const body = all[key];
+          if (typeof body === "string" && body.trim()) {
+            visit2(body.slice(0, 2e3), from, depth + 1, nextSeen);
+          }
+        }
+      }
+    }
+  };
+  visit2(command, [], 0, /* @__PURE__ */ new Set());
+  return segments;
+}
+
 // ../../features/gates/shared/presets.ts
 var presetSchema = external_exports.object({
   name: external_exports.string().regex(/^[a-z0-9][a-z0-9-]{0,39}$/).min(1),
@@ -19786,7 +20117,8 @@ var DEFAULT_PRESETS = [
   {
     name: "publish",
     patterns: [
-      "\\b(npm|pnpm|yarn)\\s+publish\\b",
+      // Flags (and their values) may sit between the tool and "publish": pnpm --filter cli publish.
+      "\\b(npm|pnpm|yarn)\\b[^;&|\\n]*\\s+publish(\\s|$)",
       "\\bcargo\\s+publish\\b",
       "\\btwine\\s+upload\\b"
     ],
@@ -19797,8 +20129,8 @@ var DEFAULT_PRESETS = [
   {
     name: "infra",
     patterns: [
-      "\\bterraform\\s+(apply|destroy)\\b",
-      "\\bpulumi\\s+(up|destroy)\\b",
+      "\\bterraform\\b[^;&|\\n]*\\s+(apply|destroy)(\\s|$)",
+      "\\bpulumi\\b[^;&|\\n]*\\s+(up|destroy)(\\s|$)",
       "\\baws\\s+.*\\bdelete-[a-z-]+\\b",
       "\\baws\\s+s3\\s+(rm|rb)\\b",
       "\\bgcloud\\s+.*\\bdelete\\b"
@@ -19806,6 +20138,21 @@ var DEFAULT_PRESETS = [
     unless: [DRY_RUN],
     quorum: 2
   },
+  {
+    // Code Tollgate can't read before it runs: fetched from the network, decoded, or built
+    // from a variable at run time. A person should look before it runs.
+    name: "opaque",
+    patterns: [
+      "\\b(curl|wget)\\b[^|;&]*\\|\\s*(sudo(\\s+-\\S+)*\\s+)?(env\\s+)?(ba|z|da|k)?sh\\b",
+      "\\bbase64\\s+(-d|-D|--decode)\\b[^|;&]*\\|\\s*(sudo\\s+)?(ba|z|da|k)?sh\\b",
+      "\\b(ba|z|da|k)?sh\\s+<\\(",
+      "(^|[\\s;&|])(source|\\.)\\s+<\\(",
+      "(^|[\\s;&|])eval\\s+[\"']?[$`]",
+      "\\b(ba|z|da|k)?sh(\\s+-\\w+)*\\s+-\\w*c\\s+[\"']?[$`]"
+    ],
+    env: "other",
+    quorum: 1
+  },
   {
     name: "destructive-fs",
     patterns: [
@@ -19834,8 +20181,8 @@ function compile2(source) {
   }
   return regexCache.get(source) ?? null;
 }
-function resolvePath(base, target) {
-  const parts = (target.startsWith("/") ? target : `${base}/${target}`).split("/");
+function resolvePath(base2, target) {
+  const parts = (target.startsWith("/") ? target : `${base2}/${target}`).split("/");
   const out = [];
   for (const part of parts) {
     if (part === "" || part === ".") continue;
@@ -19875,6 +20222,35 @@ function matchPreset(presets, input2) {
   }
   return null;
 }
+function withDefaultPresets(presets) {
+  const defaults = new Map(DEFAULT_PRESETS.map((preset) => [preset.name, preset]));
+  const names = new Set(presets.map((preset) => preset.name));
+  const merged = presets.map((preset) => {
+    const builtIn = defaults.get(preset.name);
+    return builtIn ? { ...preset, patterns: [.../* @__PURE__ */ new Set([...preset.patterns, ...builtIn.patterns])] } : preset;
+  });
+  return [...merged, ...DEFAULT_PRESETS.filter((preset) => !names.has(preset.name))];
+}
+var ENV_RANK = { prod: 2, staging: 1, other: 0 };
+function matchCommand(presets, input2) {
+  const pieces = [
+    { text: input2.command, via: [] },
+    ...expandCommand(input2.command, { cwd: input2.cwd, readScripts: input2.readScripts }),
+    ...input2.extra ?? []
+  ];
+  let best = null;
+  for (const piece of pieces) {
+    const match = matchPreset(presets, {
+      command: piece.text,
+      cwd: input2.cwd,
+      repoRoot: input2.repoRoot
+    });
+    if (!match) continue;
+    const better = best === null || match.quorum > best.quorum || match.quorum === best.quorum && ENV_RANK[match.env] > ENV_RANK[best.env] || match.quorum === best.quorum && match.env === best.env && best.via.length === 0 && piece.via.length > 0 && best.preset.name === match.preset.name;
+    if (better) best = { ...match, segment: piece.text, via: piece.via };
+  }
+  return best;
+}
 
 // src/api.ts
 var REQUEST_TIMEOUT_MS = 5e3;
@@ -19954,6 +20330,28 @@ function findRepoRoot(cwd) {
     dir = parent;
   }
 }
+function readScripts(cwd, repoRoot) {
+  let dir = cwd;
+  for (; ; ) {
+    const file2 = join(dir, "package.json");
+    if (existsSync(file2)) {
+      try {
+        const scripts = JSON.parse(readFileSync(file2, "utf8")).scripts;
+        if (!scripts || typeof scripts !== "object") return null;
+        return Object.fromEntries(
+          Object.entries(scripts).filter(
+            (entry) => typeof entry[1] === "string"
+          )
+        );
+      } catch {
+        return null;
+      }
+    }
+    const parent = dirname(dir);
+    if (dir === repoRoot || parent === dir || !dir.startsWith(repoRoot)) return null;
+    dir = parent;
+  }
+}
 function readConfigFile(repoRoot) {
   const raw = JSON.parse(readFileSync(join(repoRoot, CONFIG_FILE), "utf8"));
   return configSchema.parse(raw);
@@ -20116,9 +20514,16 @@ var createGateSchema = external_exports.object({
   context: external_exports.string().max(2048).default(""),
   // Claude Code's own one-line description of the Bash call ("Apply pending migrations").
   intent: external_exports.string().max(300).nullable().optional(),
+  // What a wrapper or package script really runs ("pnpm db:deploy" -> "prisma migrate deploy"),
+  // redacted by the hook. The server matches it again; it can only raise a gate, never lower it.
+  via: external_exports.array(
+    external_exports.object({ from: external_exports.string().min(1).max(300), runs: external_exports.string().min(1).max(1e3) }).strict()
+  ).max(5).optional(),
   redactions: external_exports.number().int().min(0).max(1e4).default(0),
   cmdHash: external_exports.string().regex(SHA256_RE),
-  sessionId: external_exports.string().max(200).optional()
+  sessionId: external_exports.string().max(200).optional(),
+  // How long this hook waits before parking the gate (CLI 0.2.3+), for the countdown.
+  waitSec: external_exports.number().int().min(5).max(600).optional()
 }).strict();
 var consumeGrantSchema = external_exports.object({ cmdHash: external_exports.string().regex(SHA256_RE) }).strict();
 
@@ -20231,7 +20636,12 @@ async function decide(input2, deps) {
   if (!command.trim()) return { kind: "none" };
   const config2 = deps.loadConfig(cwd);
   if (!config2) return { kind: "none", note: "no .tollgate.json" };
-  const match = matchPreset(config2.presets, { command, cwd, repoRoot: config2.repoRoot });
+  const match = matchCommand(withDefaultPresets(config2.presets), {
+    command,
+    cwd,
+    repoRoot: config2.repoRoot,
+    readScripts: deps.readScripts ? (dir) => deps.readScripts(dir, config2.repoRoot) : void 0
+  });
   if (!match) return { kind: "none" };
   if (deps.env.TOLLGATE_BYPASS === "1") {
     deps.audit("bypass", { preset: match.preset.name, repo: config2.repo });
@@ -20257,7 +20667,12 @@ async function decide(input2, deps) {
     const secrets = deps.envSecrets(config2.repoRoot);
     const redactedCommand = redact(command, secrets);
     const redactedCwd = redact(cwd, secrets);
-    const context = redact(deps.context(command, config2.repoRoot), secrets);
+    const context = redact(deps.context(`${command}
+${match.segment}`, config2.repoRoot), secrets);
+    const via = match.via.length > 0 ? {
+      from: redact(match.via.join(" \u2192 "), secrets),
+      runs: redact(match.segment, secrets)
+    } : null;
     const branch = deps.gitBranch(config2.repoRoot);
     const description = input2.tool_input?.description;
     const intent = typeof description === "string" && description.trim() ? redact(description.trim(), secrets) : null;
@@ -20270,9 +20685,11 @@ async function decide(input2, deps) {
       branch: branch ? truncate(redact(branch, secrets).text, 200) : null,
       context: truncate(context.text, 2048),
       intent: intent ? truncate(intent.text, 300) : null,
-      redactions: redactedCommand.count + redactedCwd.count + context.count + (intent?.count ?? 0),
+      via: via ? [{ from: truncate(via.from.text, 300), runs: truncate(via.runs.text, 1e3) }] : void 0,
+      redactions: redactedCommand.count + redactedCwd.count + context.count + (intent?.count ?? 0) + (via ? via.from.count + via.runs.count : 0),
       cmdHash,
-      sessionId: input2.session_id
+      sessionId: input2.session_id,
+      waitSec: Math.round((deadline - started) / 1e3)
     });
     deps.progress(
       `Tollgate: waiting on your team \xB7 TG-${gate.code} (0/${gate.quorum}) \xB7 ${gate.url}`
@@ -20388,7 +20805,7 @@ function writeRepoFiles(input2) {
 }
 
 // src/main.ts
-var HELP = `tollgate ${"0.2.1"}: your team approves risky agent commands before they run
+var HELP = `tollgate ${"0.2.3"}: your team approves risky agent commands before they run
 
 Usage:
   npx tollgate-cli init --token <tg_\u2026> [--server <url>] [--repo <owner/name>]
@@ -20405,6 +20822,7 @@ function hookDeps() {
     envSecrets,
     gitBranch,
     context: buildContext,
+    readScripts,
     env: process.env,
     now: () => Date.now(),
     sleep: (ms) => new Promise((done) => setTimeout(done, ms)),
@@ -20572,7 +20990,7 @@ async function main() {
       return runUnlink();
     case "--version":
     case "-v":
-      process.stdout.write(`${"0.2.1"}
+      process.stdout.write(`${"0.2.3"}
 `);
       return;
     default:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tollgate-cli",
-  "version": "0.2.1",
+  "version": "0.2.3",
   "description": "Your team approves risky Claude Code commands before they run.",
   "license": "MIT",
   "type": "module",