tollgate-cli 0.2.1 → 0.2.4

package/README.md

@@ -11,6 +11,13 @@ Your team approves before your coding agent does something you can't undo.
 
 Every other command runs untouched; the hook adds about 50 ms.
 
+It also gates what an agent could do instead of running the command:
+
+- **File edits** to Tollgate's own setup (`.claude/settings*.json`, `.tollgate.json`, the token), deploy and CI files (`.github/workflows/`, `.gitlab-ci.yml`, `vercel`/`netlify`/`fly`/`railway` config) and `.env` files. The card shows the change; `.env` values are hidden.
+- **MCP tools** whose names delete, deploy, publish, merge, refund, charge, transfer or run SQL (`mcp__github__merge_pull_request`, `mcp__supabase__execute_sql`).
+
+An approval covers that exact edit or call only. Custom presets take `"tool": "edit"` or `"tool": "mcp"`; edit patterns match `edit <path>` (`write <path>` for a new file), MCP patterns match `mcp__server__tool {json arguments}`.
+
 ## Set up
 
 1. In your team's Tollgate room, open **Settings › Repos › Link a repo** and copy the command it shows.
@@ -34,9 +41,19 @@ Every other command runs untouched; the hook adds about 50 ms.
 | `.claude/settings.local.json` | No (added to `.gitignore`): your personal hook registration      |
 | `~/.config/tollgate/`         | Never in a repo: your token (file mode 0600) and the hook bundle |
 
+## What the hook can see through
+
+Agents rarely type the risky command itself. The hook looks at what a command really runs:
+
+- **Package scripts:** `pnpm db:deploy`, `npm run release`, `yarn deploy`, `bun run x` are looked up in the nearest `package.json` (with `pre`/`post` scripts and scripts that call other scripts), so the card shows _pnpm db:deploy → prisma migrate deploy_ with the migration SQL.
+- **Lists and wrappers:** every part of `a && b; c | d` is checked on its own, so `npm publish && echo --dry-run` is still a publish. Prefixes like `VAR=x`, `env`, `sudo`, `npx`, `pnpm exec`, `dotenv --` and literal `bash -c '…'`, `eval '…'`, `( … )` and `$( … )` are looked inside.
+- **Code nobody can read first:** `curl … | sh`, `base64 -d | sh`, `bash <(curl …)` and commands built from a variable (`eval "$CMD"`) are gated as _opaque_.
+
+Tollgate is not a shell parser and not a sandbox. It does **not** read Makefiles (`make deploy`), shell files (`./deploy.sh`), npm lifecycle scripts like `prepublishOnly`, or workspace scripts selected with `--filter`. It guards against an agent's mistakes, not against someone determined to get around it on their own machine.
+
 ## What leaves your machine
 
-Only for commands that match a preset: the command and working directory after **local redaction** (known token formats, `KEY=value` secrets, passwords in URLs, secret flags, and every value from your `.env*` files), Claude Code's one-line description of the command (shown to approvers as the agent's reason), your git branch, the last commit subject, and for migrations the newest migration's SQL (capped at 2 KB). The card shows how many values were hidden. The server redacts everything again.
+Only for commands that match a preset: the command and working directory after **local redaction** (known token formats, `KEY=value` secrets, passwords in URLs, secret flags, and every value from your `.env*` files), Claude Code's one-line description of the command (shown to approvers as the agent's reason), your git branch, the last commit subject, and for migrations the newest migration's SQL (capped at 2 KB). For a gated edit, the path and the change (capped at 80 lines); for a gated MCP call, the tool name and its arguments, redacted the same way. The card shows how many values were hidden. The server redacts everything again.
 
 ## Commands
 
@@ -48,6 +65,8 @@ Only for commands that match a preset: the command and working directory after *
 | `unlink` | Forget this repo's token on this machine (revoke it in the web app) |
 | `hook`   | The hook itself; Claude Code calls it with JSON on stdin            |
 
+After upgrading from 0.2.3 or earlier, run `init` again: it re-registers the hook for file edits and MCP tools.
+
 ## Safety notes
 
 - **Fails closed.** If the server can't be reached, a risky command is blocked, with a message saying why.

package/dist/tollgate.mjs

@@ -7,7 +7,8 @@ var __export = (target, all) => {
 
 // src/main.ts
 import { appendFileSync, mkdirSync as mkdirSync3 } from "node:fs";
-import { join as join3, resolve } from "node:path";
+import { homedir as homedir2 } from "node:os";
+import { join as join3, resolve as resolve2 } from "node:path";
 import { parseArgs } from "node:util";
 
 // ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/classic/external.js
@@ -845,14 +846,14 @@ function promiseAllObject(promisesObj) {
 }
 function randomString(length = 10) {
   const chars = "abcdefghijklmnopqrstuvwxyz";
-  let str = "";
+  let str2 = "";
   for (let i = 0; i < length; i++) {
-    str += chars[Math.floor(Math.random() * chars.length)];
+    str2 += chars[Math.floor(Math.random() * chars.length)];
   }
-  return str;
+  return str2;
 }
-function esc(str) {
-  return JSON.stringify(str);
+function esc(str2) {
+  return JSON.stringify(str2);
 }
 function slugify(input2) {
   return input2.toLowerCase().trim().replace(/[^\w\s-]/g, "").replace(/[\s_-]+/g, "-").replace(/^-+|-+$/g, "");
@@ -966,8 +967,8 @@ var primitiveTypes = /* @__PURE__ */ new Set([
   "symbol",
   "undefined"
 ]);
-function escapeRegex(str) {
-  return str.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+function escapeRegex(str2) {
+  return str2.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 function clone(inst, def, params) {
   const cl = new inst._zod.constr(def ?? inst._zod.def);
@@ -1233,13 +1234,13 @@ function getSizableOrigin(input2) {
   return "unknown";
 }
 var highSurrogate = /[\uD800-\uDBFF]/;
-function codePointLength(str) {
-  const units = str.length;
-  if (!highSurrogate.test(str))
+function codePointLength(str2) {
+  const units = str2.length;
+  if (!highSurrogate.test(str2))
     return units;
   let count = units;
   for (let i = 0; i < units - 1; i++) {
-    if ((str.charCodeAt(i) & 64512) === 55296 && (str.charCodeAt(i + 1) & 64512) === 56320) {
+    if ((str2.charCodeAt(i) & 64512) === 55296 && (str2.charCodeAt(i + 1) & 64512) === 56320) {
       count--;
       i++;
     }
@@ -1750,14 +1751,14 @@ function toDotPath(_path) {
   return segs.join("");
 }
 function prettifyError(error62) {
-  const lines = [];
+  const lines2 = [];
   const issues = [...error62.issues].sort((a, b) => (a.path ?? []).length - (b.path ?? []).length);
   for (const issue2 of issues) {
-    lines.push(`\u2716 ${issue2.message}`);
+    lines2.push(`\u2716 ${issue2.message}`);
     if (issue2.path?.length)
-      lines.push(`  \u2192 at ${toDotPath(issue2.path)}`);
+      lines2.push(`  \u2192 at ${toDotPath(issue2.path)}`);
   }
-  return lines.join("\n");
+  return lines2.join("\n");
 }
 
 // ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/core/parse.js
@@ -2592,9 +2593,9 @@ var Doc = class {
       return;
     }
     const content = arg;
-    const lines = content.split("\n").filter((x) => x);
-    const minIndent = Math.min(...lines.map((x) => x.length - x.trimStart().length));
-    const dedented = lines.map((x) => x.slice(minIndent)).map((x) => " ".repeat(this.indent * 2) + x);
+    const lines2 = content.split("\n").filter((x) => x);
+    const minIndent = Math.min(...lines2.map((x) => x.length - x.trimStart().length));
+    const dedented = lines2.map((x) => x.slice(minIndent)).map((x) => " ".repeat(this.indent * 2) + x);
     for (const line of dedented) {
       this.content.push(line);
     }
@@ -5077,7 +5078,7 @@ var recursive = /* @__PURE__ */ new WeakMap();
 var NONE = 0;
 var ASSUMED = 1;
 var PROVEN = 2;
-function isRecursive(inst, stack, resolve2) {
+function isRecursive(inst, stack, resolve3) {
   const cached2 = recursive.get(inst);
   if (cached2 !== void 0)
     return cached2 ? PROVEN : NONE;
@@ -5087,7 +5088,7 @@ function isRecursive(inst, stack, resolve2) {
   let result = NONE;
   const check2 = (child) => {
     if (result !== PROVEN && child?._zod) {
-      const answer = isRecursive(child, stack, resolve2);
+      const answer = isRecursive(child, stack, resolve3);
       if (answer > result)
         result = answer;
     }
@@ -5098,7 +5099,7 @@ function isRecursive(inst, stack, resolve2) {
       const desc = Object.getOwnPropertyDescriptor(sh, key);
       if (spread && !desc.enumerable)
         continue;
-      const child = desc.get ? ASSUMED : desc.value?._zod ? isRecursive(desc.value, stack, resolve2) : NONE;
+      const child = desc.get ? ASSUMED : desc.value?._zod ? isRecursive(desc.value, stack, resolve3) : NONE;
       if (child > answer)
         answer = child;
     }
@@ -5162,7 +5163,7 @@ function isRecursive(inst, stack, resolve2) {
       break;
     // `$ZodLazy` caches its inner on the def, so a resolved edge is followed exactly
     case "lazy": {
-      const inner = def._cachedInner ?? (resolve2 ? inst._zod.innerType : void 0);
+      const inner = def._cachedInner ?? (resolve3 ? inst._zod.innerType : void 0);
       merge2(inner ? isRecursive(inner, stack, false) : ASSUMED);
       break;
     }
@@ -5242,14 +5243,14 @@ var memo = {
     var _a3;
     (_a3 = inst._zod).deferred ?? (_a3.deferred = []);
     inst._zod.deferred.push(() => {
-      const base = inst._zod.parse;
+      const base2 = inst._zod.parse;
       const wrapped = (payload, ctx) => {
         if (ctx.direction !== "backward" && isBackEdge(ctx, payload.value))
           throw new $ZodCyclicError();
-        return base(payload, ctx);
+        return base2(payload, ctx);
       };
       inst._zod.parse = wrapped;
-      if (inst._zod.run === base)
+      if (inst._zod.run === base2)
         inst._zod.run = wrapped;
     });
   },
@@ -5261,15 +5262,15 @@ var memo = {
     let lastBucket;
     (_a3 = inst._zod).deferred ?? (_a3.deferred = []);
     inst._zod.deferred.push(() => {
-      const base = inst._zod.parse;
+      const base2 = inst._zod.parse;
       const wrapped = (payload, ctx) => {
         if (isRecursiveInst === void 0) {
           const walked = isRecursive(inst, /* @__PURE__ */ new Set(), false);
           if (walked === NONE) {
-            inst._zod.parse = base;
+            inst._zod.parse = base2;
             if (inst._zod.run === wrapped)
-              inst._zod.run = base;
-            return base(payload, ctx);
+              inst._zod.run = base2;
+            return base2(payload, ctx);
           }
           if (walked === PROVEN || rechecked)
             isRecursiveInst = true;
@@ -5278,7 +5279,7 @@ var memo = {
         }
         const input2 = payload.value;
         if (!isRef(input2))
-          return base(payload, ctx);
+          return base2(payload, ctx);
         let state = ctx[STATE];
         if (!state) {
           state = { buckets: /* @__PURE__ */ new WeakMap(), backEdges: void 0 };
@@ -5307,7 +5308,7 @@ var memo = {
         }
         handoff = bucket;
         const depth = open.length;
-        const result = base(payload, ctx);
+        const result = base2(payload, ctx);
         handoff = void 0;
         const entry = open.length > depth ? open.pop() : void 0;
         if (result instanceof Promise) {
@@ -5322,7 +5323,7 @@ var memo = {
         return result;
       };
       inst._zod.parse = wrapped;
-      if (inst._zod.run === base)
+      if (inst._zod.run === base2)
         inst._zod.run = wrapped;
     });
   }
@@ -13231,9 +13232,9 @@ function codePointLengthVar(doc, ctx, accessor, inDoubt) {
   doc.write(`const ${v} = typeof ${accessor} === "string" && ${inDoubt} ? ${cpLen}(${accessor}) : ${accessor}.length;`);
   return v;
 }
-function numericOperand(value, label) {
+function numericOperand(value, label2) {
   if (typeof value !== "number" || !Number.isFinite(value)) {
-    throw new ZodCompileUnsupportedError(`${label} bound of type ${typeof value}`);
+    throw new ZodCompileUnsupportedError(`${label2} bound of type ${typeof value}`);
   }
   return `${value}`;
 }
@@ -19727,8 +19728,347 @@ function date4(params) {
   return _coercedDate(ZodDate, params);
 }
 
+// ../../features/gates/shared/expand.ts
+var MAX_DEPTH = 4;
+var MAX_SEGMENTS = 64;
+var MAX_LABEL = 80;
+function scan(text, onChar) {
+  const state = { quote: null, depth: 0, backtick: false };
+  for (let i = 0; i < text.length; i++) {
+    const ch = text[i];
+    const skip = onChar(i, state);
+    if (typeof skip === "number") {
+      i = skip;
+      continue;
+    }
+    if (state.quote === "'") {
+      if (ch === "'") state.quote = null;
+      continue;
+    }
+    if (ch === "\\") {
+      i += 1;
+      continue;
+    }
+    if (state.quote === '"') {
+      if (ch === '"') state.quote = null;
+      else if (ch === "$" && text[i + 1] === "(") {
+        state.depth += 1;
+        i += 1;
+      } else if (ch === ")" && state.depth > 0) state.depth -= 1;
+      continue;
+    }
+    if (ch === "'" || ch === '"') state.quote = ch;
+    else if (ch === "`") state.backtick = !state.backtick;
+    else if (ch === "(") state.depth += 1;
+    else if (ch === ")" && state.depth > 0) state.depth -= 1;
+  }
+}
+var atTop = (s) => s.quote === null && s.depth === 0 && !s.backtick;
+function splitList(text) {
+  const parts = [];
+  let start = 0;
+  scan(text, (i, s) => {
+    if (!atTop(s)) return;
+    const ch = text[i];
+    const next = text[i + 1];
+    const prev = text[i - 1];
+    if (ch === "#" && (i === 0 || /\s/.test(prev))) {
+      parts.push(text.slice(start, i));
+      const end = text.indexOf("\n", i);
+      start = end === -1 ? text.length : end + 1;
+      return end === -1 ? text.length : end;
+    }
+    if (ch === ";" || ch === "\n") {
+      parts.push(text.slice(start, i));
+      start = i + 1;
+    } else if (ch === "&" && next === "&" || ch === "|" && next === "|") {
+      parts.push(text.slice(start, i));
+      start = i + 2;
+      return i + 1;
+    } else if (ch === "&" && prev !== ">" && prev !== "<" && prev !== "|" && next !== ">") {
+      parts.push(text.slice(start, i));
+      start = i + 1;
+    }
+  });
+  parts.push(text.slice(start));
+  return parts.map((part) => part.trim()).filter(Boolean);
+}
+function splitPipeline(text) {
+  const parts = [];
+  let start = 0;
+  scan(text, (i, s) => {
+    if (!atTop(s) || text[i] !== "|") return;
+    parts.push(text.slice(start, i));
+    const skipAmp = text[i + 1] === "&";
+    start = i + (skipAmp ? 2 : 1);
+    return skipAmp ? i + 1 : void 0;
+  });
+  parts.push(text.slice(start));
+  return parts.map((part) => part.trim()).filter(Boolean);
+}
+function shellWords(text) {
+  const words = [];
+  let current = "";
+  let inWord = false;
+  let quote = null;
+  let depth = 0;
+  let backtick = false;
+  for (let i = 0; i < text.length; i++) {
+    const ch = text[i];
+    if (quote === "'") {
+      if (ch === "'") quote = null;
+      else current += ch;
+      continue;
+    }
+    if (ch === "\\" && i + 1 < text.length) {
+      current += text[i + 1];
+      inWord = true;
+      i += 1;
+      continue;
+    }
+    if (quote === '"') {
+      if (ch === '"' && depth === 0) quote = null;
+      else {
+        if (ch === "$" && text[i + 1] === "(") depth += 1;
+        else if (ch === ")" && depth > 0) depth -= 1;
+        current += ch;
+      }
+      continue;
+    }
+    if (depth > 0 || backtick) {
+      if (ch === "(") depth += 1;
+      else if (ch === ")") depth -= 1;
+      else if (ch === "`") backtick = false;
+      current += ch;
+      continue;
+    }
+    if (/\s/.test(ch)) {
+      if (inWord) words.push(current);
+      current = "";
+      inWord = false;
+      continue;
+    }
+    inWord = true;
+    if (ch === "'" || ch === '"') quote = ch;
+    else if (ch === "$" && text[i + 1] === "(") {
+      depth = 1;
+      current += "$(";
+      i += 1;
+    } else if (ch === "`") {
+      backtick = true;
+      current += ch;
+    } else current += ch;
+  }
+  if (inWord) words.push(current);
+  return words;
+}
+var ASSIGNMENT = /^[A-Za-z_][A-Za-z0-9_]*=/;
+var base = (word) => word.slice(word.lastIndexOf("/") + 1);
+function skipFlags(words, withValue = /* @__PURE__ */ new Set()) {
+  let i = 0;
+  while (i < words.length && words[i].startsWith("-") && words[i] !== "--") {
+    i += withValue.has(words[i]) ? 2 : 1;
+  }
+  if (words[i] === "--") i += 1;
+  return words.slice(i);
+}
+var SUDO_VALUE = /* @__PURE__ */ new Set(["-u", "-g", "-C", "-D", "-h", "-p", "-r", "-t", "-U", "-T"]);
+var NPX_VALUE = /* @__PURE__ */ new Set(["-p", "--package", "-c", "--call"]);
+var ENV_VALUE = /* @__PURE__ */ new Set(["-u", "--unset", "-C", "--chdir", "-S", "--split-string"]);
+function stripPrefixes(input2) {
+  let words = input2;
+  for (let guard = 0; guard < 16 && words.length > 0; guard++) {
+    const first = base(words[0]);
+    const second = words[1];
+    let next = null;
+    if (ASSIGNMENT.test(words[0])) next = words.slice(1);
+    else if (first === "env") {
+      next = skipFlags(words.slice(1), ENV_VALUE);
+      while (next.length > 0 && ASSIGNMENT.test(next[0])) next = next.slice(1);
+    } else if (first === "sudo" || first === "doas") next = skipFlags(words.slice(1), SUDO_VALUE);
+    else if (["time", "nohup", "command", "exec", "builtin"].includes(first)) {
+      next = skipFlags(words.slice(1));
+    } else if (first === "nice") next = skipFlags(words.slice(1), /* @__PURE__ */ new Set(["-n"]));
+    else if (first === "npx" || first === "bunx") next = skipFlags(words.slice(1), NPX_VALUE);
+    else if (first === "pnpm" && (second === "exec" || second === "dlx")) {
+      next = skipFlags(words.slice(2));
+    } else if (first === "yarn" && (second === "dlx" || second === "exec")) {
+      next = skipFlags(words.slice(2));
+    } else if (first === "npm" && (second === "exec" || second === "x")) {
+      next = skipFlags(words.slice(2), NPX_VALUE);
+    } else if (first === "dotenv" || first === "dotenvx") {
+      const dash = words.indexOf("--");
+      next = dash === -1 ? skipFlags(words.slice(1), /* @__PURE__ */ new Set(["-e", "-f", "-v", "-c"])) : words.slice(dash + 1);
+      if (first === "dotenvx" && next[0] === "run")
+        next = skipFlags(next.slice(1), /* @__PURE__ */ new Set(["-f"]));
+    } else if (first === "cross-env") {
+      next = words.slice(1);
+      while (next.length > 0 && ASSIGNMENT.test(next[0])) next = next.slice(1);
+    }
+    if (next === null) break;
+    words = next;
+  }
+  return words;
+}
+var SHELLS = /* @__PURE__ */ new Set(["sh", "bash", "zsh", "dash", "ksh"]);
+function innerScript(words) {
+  if (words.length === 0) return null;
+  const first = base(words[0]);
+  if (SHELLS.has(first)) {
+    const flag = words.findIndex((word, i) => i > 0 && /^-[A-Za-z]*c[A-Za-z]*$/.test(word));
+    return flag !== -1 && words[flag + 1] !== void 0 ? words[flag + 1] : null;
+  }
+  if (first === "eval") return words.slice(1).join(" ") || null;
+  return null;
+}
+function substitutions(text) {
+  const found = [];
+  for (let i = 0; i < text.length; i++) {
+    if (text[i] === "'") {
+      const end = text.indexOf("'", i + 1);
+      if (end === -1) break;
+      i = end;
+      continue;
+    }
+    if (text[i] === "$" && text[i + 1] === "(" && text[i + 2] !== "(") {
+      let depth = 1;
+      let j = i + 2;
+      for (; j < text.length && depth > 0; j++) {
+        if (text[j] === "(") depth += 1;
+        else if (text[j] === ")") depth -= 1;
+      }
+      found.push(text.slice(i + 2, j - 1));
+      i = j - 1;
+    } else if (text[i] === "`") {
+      const end = text.indexOf("`", i + 1);
+      if (end === -1) break;
+      found.push(text.slice(i + 1, end));
+      i = end;
+    }
+  }
+  return found.filter((inner) => inner.trim());
+}
+var PNPM_BUILTINS = new Set(
+  "add i install update up upgrade remove rm uninstall un link ln unlink import rebuild rb prune fetch patch patch-commit exec dlx create publish pack audit list ls outdated why store root bin config c get set env init setup server deploy licenses doctor approve-builds ignored-builds self-update cat-file cat-index find-hash recursive multi m help".split(
+    " "
+  )
+);
+var YARN_BUILTINS = new Set(
+  "add install remove upgrade up publish init info why dlx exec workspace workspaces config cache link unlink pack version global import npm plugin set constraints dedupe explain node rebuild search stage unplug patch patch-commit login logout owner tag team audit autoclean check generate-lock-entry help licenses list outdated policies upgrade-interactive".split(
+    " "
+  )
+);
+var RUNNER_VALUE = /* @__PURE__ */ new Set([
+  "-C",
+  "--dir",
+  "--prefix",
+  "--filter",
+  "-F",
+  "-w",
+  "--workspace",
+  "--cwd"
+]);
+var NPM_LIFECYCLE = {
+  test: "test",
+  t: "test",
+  tst: "test",
+  start: "start",
+  stop: "stop",
+  restart: "restart"
+};
+function scriptName(words, scripts) {
+  if (words.length < 2) return null;
+  const tool = base(words[0]);
+  const rest = skipFlags(words.slice(1), RUNNER_VALUE);
+  const sub = rest[0];
+  if (!sub) return null;
+  const after = skipFlags(rest.slice(1), RUNNER_VALUE)[0] ?? null;
+  if (tool === "npm") {
+    if (["run", "run-script", "rum", "urn"].includes(sub)) return after;
+    return NPM_LIFECYCLE[sub] ?? null;
+  }
+  if (tool === "pnpm") {
+    if (sub === "run" || sub === "run-script") return after;
+    return PNPM_BUILTINS.has(sub) ? null : sub;
+  }
+  if (tool === "yarn") {
+    if (sub === "run") return after;
+    return YARN_BUILTINS.has(sub) ? null : sub;
+  }
+  if (tool === "bun") {
+    if (sub === "run") return after;
+    return scripts && sub in scripts ? sub : null;
+  }
+  return null;
+}
+function label(words) {
+  const text = words.join(" ");
+  return text.length > MAX_LABEL ? `${text.slice(0, MAX_LABEL - 1)}\u2026` : text;
+}
+function expandCommand(command, options) {
+  const maxDepth = options.maxDepth ?? MAX_DEPTH;
+  const maxSegments = options.maxSegments ?? MAX_SEGMENTS;
+  const segments = [];
+  let scripts;
+  const loadScripts = () => {
+    if (scripts === void 0) {
+      try {
+        scripts = options.readScripts?.(options.cwd) ?? null;
+      } catch {
+        scripts = null;
+      }
+    }
+    return scripts;
+  };
+  const visit2 = (text, via, depth, seen) => {
+    for (const pipeline of splitList(text)) {
+      if (segments.length >= maxSegments) return;
+      const group = /^\(([\s\S]*)\)$/.exec(pipeline) ?? /^\{([\s\S]*?);?\s*\}$/.exec(pipeline);
+      if (group) {
+        if (depth < maxDepth) visit2(group[1], via, depth + 1, seen);
+        continue;
+      }
+      const commands = splitPipeline(pipeline).map((part) => stripPrefixes(shellWords(part)));
+      const flat = commands.map((words) => words.join(" ")).filter(Boolean).join(" | ");
+      if (flat) segments.push({ text: flat, via });
+      if (depth >= maxDepth) continue;
+      for (const inner of substitutions(pipeline)) {
+        visit2(inner, [...via, "$(\u2026)"], depth + 1, seen);
+      }
+      for (const words of commands) {
+        const script = innerScript(words);
+        if (script) {
+          const wrapper = base(words[0]) === "eval" ? "eval" : `${base(words[0])} -c`;
+          visit2(script, [...via, wrapper], depth + 1, seen);
+        }
+        const name = scriptName(words, loadScripts() ?? null);
+        const all = loadScripts();
+        if (!name || !all || seen.has(name) || !(name in all)) continue;
+        const nextSeen = new Set(seen).add(name);
+        const from = [...via, label(words)];
+        for (const key of [`pre${name}`, name, `post${name}`]) {
+          const body = all[key];
+          if (typeof body === "string" && body.trim()) {
+            visit2(body.slice(0, 2e3), from, depth + 1, nextSeen);
+          }
+        }
+      }
+    }
+  };
+  visit2(command, [], 0, /* @__PURE__ */ new Set());
+  return segments;
+}
+
 // ../../features/gates/shared/presets.ts
+var GATE_TOOLS = ["bash", "edit", "mcp"];
+var TOOL_NOUN = {
+  bash: "command",
+  edit: "edit",
+  mcp: "tool call"
+};
 var presetSchema = external_exports.object({
+  // Defaults to "bash", so presets written before file and MCP gates keep their meaning.
+  tool: external_exports.enum(GATE_TOOLS).optional(),
   name: external_exports.string().regex(/^[a-z0-9][a-z0-9-]{0,39}$/).min(1),
   patterns: external_exports.array(external_exports.string().min(1).max(300)).min(1).max(20),
   // A match is skipped when any of these also matches (e.g. --dry-run changes nothing).
@@ -19786,7 +20126,8 @@ var DEFAULT_PRESETS = [
   {
     name: "publish",
     patterns: [
-      "\\b(npm|pnpm|yarn)\\s+publish\\b",
+      // Flags (and their values) may sit between the tool and "publish": pnpm --filter cli publish.
+      "\\b(npm|pnpm|yarn)\\b[^;&|\\n]*\\s+publish(\\s|$)",
       "\\bcargo\\s+publish\\b",
       "\\btwine\\s+upload\\b"
     ],
@@ -19797,8 +20138,8 @@ var DEFAULT_PRESETS = [
   {
     name: "infra",
     patterns: [
-      "\\bterraform\\s+(apply|destroy)\\b",
-      "\\bpulumi\\s+(up|destroy)\\b",
+      "\\bterraform\\b[^;&|\\n]*\\s+(apply|destroy)(\\s|$)",
+      "\\bpulumi\\b[^;&|\\n]*\\s+(up|destroy)(\\s|$)",
       "\\baws\\s+.*\\bdelete-[a-z-]+\\b",
       "\\baws\\s+s3\\s+(rm|rb)\\b",
       "\\bgcloud\\s+.*\\bdelete\\b"
@@ -19806,6 +20147,21 @@ var DEFAULT_PRESETS = [
     unless: [DRY_RUN],
     quorum: 2
   },
+  {
+    // Code Tollgate can't read before it runs: fetched from the network, decoded, or built
+    // from a variable at run time. A person should look before it runs.
+    name: "opaque",
+    patterns: [
+      "\\b(curl|wget)\\b[^|;&]*\\|\\s*(sudo(\\s+-\\S+)*\\s+)?(env\\s+)?(ba|z|da|k)?sh\\b",
+      "\\bbase64\\s+(-d|-D|--decode)\\b[^|;&]*\\|\\s*(sudo\\s+)?(ba|z|da|k)?sh\\b",
+      "\\b(ba|z|da|k)?sh\\s+<\\(",
+      "(^|[\\s;&|])(source|\\.)\\s+<\\(",
+      "(^|[\\s;&|])eval\\s+[\"']?[$`]",
+      "\\b(ba|z|da|k)?sh(\\s+-\\w+)*\\s+-\\w*c\\s+[\"']?[$`]"
+    ],
+    env: "other",
+    quorum: 1
+  },
   {
     name: "destructive-fs",
     patterns: [
@@ -19814,6 +20170,52 @@ var DEFAULT_PRESETS = [
     env: "other",
     quorum: 1,
     outsideRepoOnly: true
+  },
+  // File edits are matched as "edit <path>" or "write <path>", the path relative to the repo
+  // (or ~/… outside it).
+  {
+    // An agent that may not run a command could otherwise switch the guard off: the hook's
+    // registration, the repo's presets, or this machine's Tollgate token.
+    name: "guard-config",
+    tool: "edit",
+    patterns: [
+      "(^|[\\s/])\\.claude/settings(\\.local)?\\.json$",
+      "(^|[\\s/])\\.tollgate\\.json$",
+      "(^|[\\s/])\\.config/tollgate/"
+    ],
+    env: "other",
+    quorum: 1
+  },
+  {
+    // Where a deploy is defined: a change here ships with the next push, gate or not.
+    name: "ci-config",
+    tool: "edit",
+    patterns: [
+      "(^|[\\s/])\\.github/workflows/",
+      "(^|[\\s/])\\.gitlab-ci\\.ya?ml$",
+      "(^|[\\s/])(vercel|netlify)\\.(json|toml)$",
+      "(^|[\\s/])(fly|railway)\\.(json|toml)$"
+    ],
+    quorum: 1,
+    prodQuorum: 2
+  },
+  {
+    name: "env-file",
+    tool: "edit",
+    patterns: ["(^|[\\s/])\\.env(\\.[^/\\s]+)?$"],
+    unless: ["\\.env\\.(example|sample|template|defaults)$"],
+    quorum: 1
+  },
+  {
+    // MCP calls are matched as "mcp__server__tool {json args}". Tool names that move money,
+    // ship, merge or destroy, whichever server they come from.
+    name: "mcp-risky",
+    tool: "mcp",
+    patterns: [
+      "^mcp__\\S+?__(\\S*_)?(delete|drop|destroy|deploy|publish|merge|refund|charge|payout|transfer|execute_sql|apply_migration)(_\\S*)?(\\s|$)"
+    ],
+    quorum: 1,
+    prodQuorum: 2
   }
 ];
 var PROD_RE = /(^|[\s=:/_-])(prod|production)($|[\s.:/_-])|--prod\b/i;
@@ -19834,8 +20236,8 @@ function compile2(source) {
   }
   return regexCache.get(source) ?? null;
 }
-function resolvePath(base, target) {
-  const parts = (target.startsWith("/") ? target : `${base}/${target}`).split("/");
+function resolvePath(base2, target) {
+  const parts = (target.startsWith("/") ? target : `${base2}/${target}`).split("/");
   const out = [];
   for (const part of parts) {
     if (part === "" || part === ".") continue;
@@ -19861,20 +20263,62 @@ function rmTargetsOutsideRepo(command, cwd, repoRoot) {
   }
   return false;
 }
+function envOf(tool, text) {
+  if (tool === "edit") return detectEnv(text.replace(/\./g, "/"));
+  if (tool === "mcp") return detectEnv(text.replace(/["{},]/g, " "));
+  return detectEnv(text);
+}
 function matchPreset(presets, input2) {
+  const tool = input2.tool ?? "bash";
   for (const preset of presets) {
+    if ((preset.tool ?? "bash") !== tool) continue;
     const hit = preset.patterns.some((source) => compile2(source)?.test(input2.command) ?? false);
     if (!hit) continue;
     if (preset.unless?.some((source) => compile2(source)?.test(input2.command) ?? false)) continue;
     if (preset.outsideRepoOnly && !rmTargetsOutsideRepo(input2.command, input2.cwd, input2.repoRoot)) {
       continue;
     }
-    const env = preset.env ?? detectEnv(input2.command);
+    const env = preset.env ?? envOf(tool, input2.command);
     const quorum = env === "prod" ? Math.max(preset.quorum, preset.prodQuorum ?? 0) : preset.quorum;
     return { preset, env, quorum };
   }
   return null;
 }
+function withDefaultPresets(presets) {
+  const defaults = new Map(DEFAULT_PRESETS.map((preset) => [preset.name, preset]));
+  const names = new Set(presets.map((preset) => preset.name));
+  const merged = presets.map((preset) => {
+    const builtIn = defaults.get(preset.name);
+    return builtIn ? {
+      ...preset,
+      tool: builtIn.tool,
+      patterns: [.../* @__PURE__ */ new Set([...preset.patterns, ...builtIn.patterns])]
+    } : preset;
+  });
+  return [...merged, ...DEFAULT_PRESETS.filter((preset) => !names.has(preset.name))];
+}
+var ENV_RANK = { prod: 2, staging: 1, other: 0 };
+function matchCommand(presets, input2) {
+  const tool = input2.tool ?? "bash";
+  const pieces = tool === "bash" ? [
+    { text: input2.command, via: [] },
+    ...expandCommand(input2.command, { cwd: input2.cwd, readScripts: input2.readScripts }),
+    ...input2.extra ?? []
+  ] : [{ text: input2.command, via: [] }];
+  let best = null;
+  for (const piece of pieces) {
+    const match = matchPreset(presets, {
+      command: piece.text,
+      cwd: input2.cwd,
+      repoRoot: input2.repoRoot,
+      tool
+    });
+    if (!match) continue;
+    const better = best === null || match.quorum > best.quorum || match.quorum === best.quorum && ENV_RANK[match.env] > ENV_RANK[best.env] || match.quorum === best.quorum && match.env === best.env && best.via.length === 0 && piece.via.length > 0 && best.preset.name === match.preset.name;
+    if (better) best = { ...match, segment: piece.text, via: piece.via };
+  }
+  return best;
+}
 
 // src/api.ts
 var REQUEST_TIMEOUT_MS = 5e3;
@@ -19954,6 +20398,28 @@ function findRepoRoot(cwd) {
     dir = parent;
   }
 }
+function readScripts(cwd, repoRoot) {
+  let dir = cwd;
+  for (; ; ) {
+    const file2 = join(dir, "package.json");
+    if (existsSync(file2)) {
+      try {
+        const scripts = JSON.parse(readFileSync(file2, "utf8")).scripts;
+        if (!scripts || typeof scripts !== "object") return null;
+        return Object.fromEntries(
+          Object.entries(scripts).filter(
+            (entry) => typeof entry[1] === "string"
+          )
+        );
+      } catch {
+        return null;
+      }
+    }
+    const parent = dirname(dir);
+    if (dir === repoRoot || parent === dir || !dir.startsWith(repoRoot)) return null;
+    dir = parent;
+  }
+}
 function readConfigFile(repoRoot) {
   const raw = JSON.parse(readFileSync(join(repoRoot, CONFIG_FILE), "utf8"));
   return configSchema.parse(raw);
@@ -20106,6 +20572,8 @@ function commandHash(input2) {
 }
 var createGateSchema = external_exports.object({
   preset: external_exports.string().min(1).max(40),
+  // CLI 0.2.4+: what was stopped. Older hooks only send Bash commands.
+  tool: external_exports.enum(GATE_TOOLS).default("bash"),
   quorum: external_exports.number().int().min(1).max(9).optional(),
   env: external_exports.enum(["prod", "staging", "other"]).optional(),
   command: external_exports.string().min(1).max(4e3),
@@ -20116,9 +20584,16 @@ var createGateSchema = external_exports.object({
   context: external_exports.string().max(2048).default(""),
   // Claude Code's own one-line description of the Bash call ("Apply pending migrations").
   intent: external_exports.string().max(300).nullable().optional(),
+  // What a wrapper or package script really runs ("pnpm db:deploy" -> "prisma migrate deploy"),
+  // redacted by the hook. The server matches it again; it can only raise a gate, never lower it.
+  via: external_exports.array(
+    external_exports.object({ from: external_exports.string().min(1).max(300), runs: external_exports.string().min(1).max(1e3) }).strict()
+  ).max(5).optional(),
   redactions: external_exports.number().int().min(0).max(1e4).default(0),
   cmdHash: external_exports.string().regex(SHA256_RE),
-  sessionId: external_exports.string().max(200).optional()
+  sessionId: external_exports.string().max(200).optional(),
+  // How long this hook waits before parking the gate (CLI 0.2.3+), for the countdown.
+  waitSec: external_exports.number().int().min(5).max(600).optional()
 }).strict();
 var consumeGrantSchema = external_exports.object({ cmdHash: external_exports.string().regex(SHA256_RE) }).strict();
 
@@ -20206,32 +20681,116 @@ function truncate(text, maxChars) {
   return `${text.slice(0, Math.max(0, maxChars - 15))}\u2026 [truncated]`;
 }
 
+// src/tool-call.ts
+import { isAbsolute, relative, resolve, sep } from "node:path";
+var EDIT_TOOLS = /* @__PURE__ */ new Set(["Edit", "Write", "MultiEdit", "NotebookEdit"]);
+var MAX_DETAIL_LINES = 80;
+var str = (value) => typeof value === "string" ? value : "";
+function displayPath(file2, cwd, repoRoot, home) {
+  const absolute = resolve(cwd, file2);
+  const inside = (base2) => {
+    const rel = relative(base2, absolute);
+    return rel && !rel.startsWith("..") && !isAbsolute(rel) ? rel.split(sep).join("/") : null;
+  };
+  const inRepo = inside(repoRoot);
+  if (inRepo) return inRepo;
+  const inHome = inside(home);
+  return inHome ? `~/${inHome}` : absolute.split(sep).join("/");
+}
+function lines(prefix, text) {
+  return text === "" ? [] : text.split("\n").map((line) => `${prefix}${line}`);
+}
+function hideEnvValues(text) {
+  return text.replace(/^([+-] \s*(?:export\s+)?[A-Za-z_][A-Za-z0-9_.]*\s*=).*$/gm, "$1[REDACTED]");
+}
+function editDetail(toolName, input2) {
+  let out;
+  if (toolName === "Write") {
+    out = lines("+ ", str(input2.content));
+  } else if (toolName === "NotebookEdit") {
+    out = input2.edit_mode === "delete" ? ["(deletes a notebook cell)"] : lines("+ ", str(input2.new_source));
+  } else {
+    const edits = toolName === "MultiEdit" && Array.isArray(input2.edits) ? input2.edits : [input2];
+    out = edits.flatMap((edit, index) => [
+      ...index > 0 ? [""] : [],
+      ...lines("- ", str(edit.old_string)),
+      ...lines("+ ", str(edit.new_string)),
+      ...edit.replace_all === true ? ["(every occurrence in the file)"] : []
+    ]);
+  }
+  const shown = out.slice(0, MAX_DETAIL_LINES);
+  if (out.length > shown.length) shown.push(`\u2026 ${out.length - shown.length} more lines`);
+  return shown.join("\n");
+}
+function readToolCall(toolName, rawInput, where) {
+  const input2 = rawInput && typeof rawInput === "object" ? rawInput : {};
+  const hashSource = `${toolName}
+${JSON.stringify(input2)}`;
+  if (EDIT_TOOLS.has(toolName)) {
+    const file2 = str(input2.file_path) || str(input2.notebook_path);
+    if (!file2) return null;
+    const path = displayPath(file2, where.cwd, where.repoRoot, where.home);
+    const detail = editDetail(toolName, input2);
+    const isEnv = /(^|\/)\.env[^/]*$/.test(path);
+    return {
+      tool: "edit",
+      subject: `${toolName === "Write" ? "write" : "edit"} ${path}`,
+      hashSource,
+      detail: isEnv ? hideEnvValues(detail) : detail
+    };
+  }
+  if (toolName.startsWith("mcp__")) {
+    const args = JSON.stringify(input2);
+    return {
+      tool: "mcp",
+      subject: args === "{}" ? toolName : `${toolName} ${args}`,
+      hashSource,
+      detail: ""
+    };
+  }
+  return null;
+}
+
 // src/hook.ts
 var POLL_MS = 2e3;
 var PARK_MARGIN_SEC = 15;
-function denyMessages(gate) {
+function denyMessages(gate, tool = "bash") {
   const who = gate.decidedBy || "a teammate";
+  const noun = TOOL_NOUN[tool];
+  const question = tool === "bash" ? `${who} asked a question in TG-${gate.code} before deciding: "${gate.question}" Answer it specifically and honestly in the description of your next Bash call, then run the same command again so the team can decide. If the answer changes your plan, change the command too.` : `${who} asked a question in TG-${gate.code} before deciding: "${gate.question}" Answer it to the user, then make the same ${noun} again so the team can decide. If the answer changes your plan, change the ${noun} too.`;
   return {
-    denied: gate.question ? `${who} asked a question in TG-${gate.code} before deciding: "${gate.question}" Answer it specifically and honestly in the description of your next Bash call, then run the same command again so the team can decide. If the answer changes your plan, change the command too.` : `Denied by ${who} in TG-${gate.code}: ${gate.denyReason ?? "no reason given"}. Do not retry this command as is. Change your plan to address the reason, then propose the new command.`,
-    parked: `Parked as TG-${gate.code}: nobody on the team decided in time. Continue with other work that doesn't need this command. Retry the exact same command later; once the team approves TG-${gate.code} it passes immediately (${gate.url}).`,
+    denied: gate.question ? question : `Denied by ${who} in TG-${gate.code}: ${gate.denyReason ?? "no reason given"}. Do not retry this ${noun} as is. Change your plan to address the reason, then propose the new ${noun}.`,
+    parked: `Parked as TG-${gate.code}: nobody on the team decided in time. Continue with other work that doesn't need this ${noun}. Retry the exact same ${noun} later; once the team approves TG-${gate.code} it passes immediately (${gate.url}).`,
     expired: `TG-${gate.code} expired without approval. Ask the user whether to raise it again.`
   };
 }
-function notLinkedMessage() {
-  return "Tollgate blocked this command because this repo is not linked on this machine. Ask the user to run: npx tollgate-cli init";
+function notLinkedMessage(tool = "bash") {
+  return `Tollgate blocked this ${TOOL_NOUN[tool]} because this repo is not linked on this machine. Ask the user to run: npx tollgate-cli init`;
 }
-function failClosedMessage(server, error62) {
+function failClosedMessage(server, error62, tool = "bash") {
   const detail = error62 instanceof Error ? error62.message : String(error62);
-  return `Tollgate could not reach ${server} (${detail}), so this risky command was blocked to be safe. Tell the user; do not try to work around it.`;
+  return `Tollgate could not reach ${server} (${detail}), so this risky ${TOOL_NOUN[tool]} was blocked to be safe. Tell the user; do not try to work around it.`;
 }
 async function decide(input2, deps) {
-  if (input2.tool_name !== "Bash") return { kind: "none" };
-  const command = typeof input2.tool_input?.command === "string" ? input2.tool_input.command : "";
+  const toolName = input2.tool_name ?? "";
+  const isBash = toolName === "Bash";
+  if (!isBash && !EDIT_TOOLS.has(toolName) && !toolName.startsWith("mcp__")) {
+    return { kind: "none" };
+  }
+  const command = isBash && typeof input2.tool_input?.command === "string" ? input2.tool_input.command : "";
   const cwd = input2.cwd || process.cwd();
-  if (!command.trim()) return { kind: "none" };
+  if (isBash && !command.trim()) return { kind: "none" };
   const config2 = deps.loadConfig(cwd);
   if (!config2) return { kind: "none", note: "no .tollgate.json" };
-  const match = matchPreset(config2.presets, { command, cwd, repoRoot: config2.repoRoot });
+  const call = isBash ? { tool: "bash", subject: command, hashSource: command, detail: "" } : readToolCall(toolName, input2.tool_input, { cwd, repoRoot: config2.repoRoot, home: deps.home });
+  if (!call) return { kind: "none" };
+  const match = matchCommand(withDefaultPresets(config2.presets), {
+    command: call.subject,
+    cwd,
+    repoRoot: config2.repoRoot,
+    tool: call.tool,
+    readScripts: isBash && deps.readScripts ? (dir) => deps.readScripts(dir, config2.repoRoot) : void 0
+  });
   if (!match) return { kind: "none" };
   if (deps.env.TOLLGATE_BYPASS === "1") {
     deps.audit("bypass", { preset: match.preset.name, repo: config2.repo });
@@ -20240,14 +20799,14 @@ async function decide(input2, deps) {
   if (config2.error) {
     return {
       kind: "deny",
-      reason: `Tollgate blocked this command because .tollgate.json is invalid (${config2.error}). Ask the user to fix it or run: npx tollgate-cli init`
+      reason: `Tollgate blocked this ${TOOL_NOUN[call.tool]} because .tollgate.json is invalid (${config2.error}). Ask the user to fix it or run: npx tollgate-cli init`
     };
   }
   const token = deps.loadToken(config2.repoRoot);
-  if (!token) return { kind: "deny", reason: notLinkedMessage() };
+  if (!token) return { kind: "deny", reason: notLinkedMessage(call.tool) };
   const started = deps.now();
   const deadline = started + Math.max(5, config2.hookTimeoutSec - PARK_MARGIN_SEC) * 1e3;
-  const cmdHash = commandHash({ repo: config2.repo, cwd, command });
+  const cmdHash = commandHash({ repo: config2.repo, cwd, command: call.hashSource });
   const api = deps.api(config2, token);
   try {
     const grant = await api.consumeGrant(cmdHash);
@@ -20255,14 +20814,24 @@ async function decide(input2, deps) {
       return grant.mode === "delegate" ? { kind: "allow", reason: "Approved earlier by the team (single-use grant)." } : { kind: "none", note: "grant redeemed" };
     }
     const secrets = deps.envSecrets(config2.repoRoot);
-    const redactedCommand = redact(command, secrets);
+    const redactedCommand = redact(call.subject, secrets);
     const redactedCwd = redact(cwd, secrets);
-    const context = redact(deps.context(command, config2.repoRoot), secrets);
+    const context = redact(
+      isBash ? deps.context(`${command}
+${match.segment}`, config2.repoRoot) : call.detail,
+      secrets
+    );
+    const via = match.via.length > 0 ? {
+      from: redact(match.via.join(" \u2192 "), secrets),
+      runs: redact(match.segment, secrets)
+    } : null;
     const branch = deps.gitBranch(config2.repoRoot);
-    const description = input2.tool_input?.description;
+    const description = isBash ? input2.tool_input?.description : void 0;
     const intent = typeof description === "string" && description.trim() ? redact(description.trim(), secrets) : null;
     let gate = await api.createGate({
       preset: match.preset.name,
+      // Only sent when it isn't a command, so servers from before file gates still accept it.
+      ...call.tool === "bash" ? {} : { tool: call.tool },
       quorum: match.quorum,
       env: match.env,
       command: truncate(redactedCommand.text, 4e3),
@@ -20270,9 +20839,11 @@ async function decide(input2, deps) {
       branch: branch ? truncate(redact(branch, secrets).text, 200) : null,
       context: truncate(context.text, 2048),
       intent: intent ? truncate(intent.text, 300) : null,
-      redactions: redactedCommand.count + redactedCwd.count + context.count + (intent?.count ?? 0),
+      via: via ? [{ from: truncate(via.from.text, 300), runs: truncate(via.runs.text, 1e3) }] : void 0,
+      redactions: redactedCommand.count + redactedCwd.count + context.count + (intent?.count ?? 0) + (via ? via.from.count + via.runs.count : 0),
       cmdHash,
-      sessionId: input2.session_id
+      sessionId: input2.session_id,
+      waitSec: Math.round((deadline - started) / 1e3)
     });
     deps.progress(
       `Tollgate: waiting on your team \xB7 TG-${gate.code} (0/${gate.quorum}) \xB7 ${gate.url}`
@@ -20281,18 +20852,19 @@ async function decide(input2, deps) {
       if (gate.status === "approved") {
         return gate.mode === "delegate" ? { kind: "allow", reason: `Approved by the team in TG-${gate.code}.` } : { kind: "none", note: `TG-${gate.code} approved` };
       }
-      if (gate.status === "denied") return { kind: "deny", reason: denyMessages(gate).denied };
-      if (gate.status === "expired") return { kind: "deny", reason: denyMessages(gate).expired };
-      if (gate.status === "parked") return { kind: "deny", reason: denyMessages(gate).parked };
+      const messages = denyMessages(gate, call.tool);
+      if (gate.status === "denied") return { kind: "deny", reason: messages.denied };
+      if (gate.status === "expired") return { kind: "deny", reason: messages.expired };
+      if (gate.status === "parked") return { kind: "deny", reason: messages.parked };
       if (deps.now() + POLL_MS >= deadline) {
         await api.park(gate.id).catch(() => void 0);
-        return { kind: "deny", reason: denyMessages(gate).parked };
+        return { kind: "deny", reason: messages.parked };
       }
       await deps.sleep(POLL_MS);
       gate = await api.getGate(gate.id).catch(() => gate);
     }
   } catch (error62) {
-    return { kind: "deny", reason: failClosedMessage(config2.server, error62) };
+    return { kind: "deny", reason: failClosedMessage(config2.server, error62, call.tool) };
   }
 }
 function renderDecision(decision) {
@@ -20310,6 +20882,7 @@ function renderDecision(decision) {
 import { copyFileSync, existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "node:fs";
 import { join as join2 } from "node:path";
 var SETTINGS_FILE = join2(".claude", "settings.local.json");
+var HOOK_MATCHER = "Bash|Edit|Write|MultiEdit|NotebookEdit|mcp__.*";
 function isTollgateHook(command) {
   return /tollgate/.test(command) && /\bhook\b/.test(command);
 }
@@ -20322,7 +20895,7 @@ function mergeHookSettings(existing, hookCommand, timeoutSec) {
   hooks.PreToolUse = [
     ...kept,
     {
-      matcher: "Bash",
+      matcher: HOOK_MATCHER,
       hooks: [
         {
           type: "command",
@@ -20388,7 +20961,7 @@ function writeRepoFiles(input2) {
 }
 
 // src/main.ts
-var HELP = `tollgate ${"0.2.1"}: your team approves risky agent commands before they run
+var HELP = `tollgate ${"0.2.4"}: your team approves risky agent commands before they run
 
 Usage:
   npx tollgate-cli init --token <tg_\u2026> [--server <url>] [--repo <owner/name>]
@@ -20405,7 +20978,9 @@ function hookDeps() {
     envSecrets,
     gitBranch,
     context: buildContext,
+    readScripts,
     env: process.env,
+    home: homedir2(),
     now: () => Date.now(),
     sleep: (ms) => new Promise((done) => setTimeout(done, ms)),
     audit: (event, detail) => {
@@ -20472,7 +21047,7 @@ async function runInit(argv) {
       dir: { type: "string" }
     }
   });
-  const repoRoot = resolve(values.dir ?? process.cwd());
+  const repoRoot = resolve2(values.dir ?? process.cwd());
   const token = values.token ?? process.env.TOLLGATE_TOKEN;
   const server = (values.server ?? process.env.TOLLGATE_SERVER ?? "").replace(/\/+$/, "");
   if (!token || !server) {
@@ -20482,7 +21057,7 @@ async function runInit(argv) {
   }
   const who = await whoAmI(server, token);
   const repo = values.repo ?? who.repo.name ?? gitRepoName(repoRoot) ?? "repo";
-  const bundle = installBundle(resolve(process.argv[1] ?? ""), tollgateHome());
+  const bundle = installBundle(resolve2(process.argv[1] ?? ""), tollgateHome());
   const tokenFile2 = saveToken(repoRoot, { token, server, repo });
   const files = writeRepoFiles({ repoRoot, server, repo, hookCommand: hookCommandFor(bundle) });
   process.stdout.write(
@@ -20572,7 +21147,7 @@ async function main() {
       return runUnlink();
     case "--version":
     case "-v":
-      process.stdout.write(`${"0.2.1"}
+      process.stdout.write(`${"0.2.4"}
 `);
       return;
     default:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tollgate-cli",
-  "version": "0.2.1",
+  "version": "0.2.4",
   "description": "Your team approves risky Claude Code commands before they run.",
   "license": "MIT",
   "type": "module",