tollgate-cli 0.2.3 → 0.2.4

package/README.md

@@ -11,6 +11,13 @@ Your team approves before your coding agent does something you can't undo.
 
 Every other command runs untouched; the hook adds about 50 ms.
 
+It also gates what an agent could do instead of running the command:
+
+- **File edits** to Tollgate's own setup (`.claude/settings*.json`, `.tollgate.json`, the token), deploy and CI files (`.github/workflows/`, `.gitlab-ci.yml`, `vercel`/`netlify`/`fly`/`railway` config) and `.env` files. The card shows the change; `.env` values are hidden.
+- **MCP tools** whose names delete, deploy, publish, merge, refund, charge, transfer or run SQL (`mcp__github__merge_pull_request`, `mcp__supabase__execute_sql`).
+
+An approval covers that exact edit or call only. Custom presets take `"tool": "edit"` or `"tool": "mcp"`; edit patterns match `edit <path>` (`write <path>` for a new file), MCP patterns match `mcp__server__tool {json arguments}`.
+
 ## Set up
 
 1. In your team's Tollgate room, open **Settings › Repos › Link a repo** and copy the command it shows.
@@ -46,7 +53,7 @@ Tollgate is not a shell parser and not a sandbox. It does **not** read Makefiles
 
 ## What leaves your machine
 
-Only for commands that match a preset: the command and working directory after **local redaction** (known token formats, `KEY=value` secrets, passwords in URLs, secret flags, and every value from your `.env*` files), Claude Code's one-line description of the command (shown to approvers as the agent's reason), your git branch, the last commit subject, and for migrations the newest migration's SQL (capped at 2 KB). The card shows how many values were hidden. The server redacts everything again.
+Only for commands that match a preset: the command and working directory after **local redaction** (known token formats, `KEY=value` secrets, passwords in URLs, secret flags, and every value from your `.env*` files), Claude Code's one-line description of the command (shown to approvers as the agent's reason), your git branch, the last commit subject, and for migrations the newest migration's SQL (capped at 2 KB). For a gated edit, the path and the change (capped at 80 lines); for a gated MCP call, the tool name and its arguments, redacted the same way. The card shows how many values were hidden. The server redacts everything again.
 
 ## Commands
 
@@ -58,6 +65,8 @@ Only for commands that match a preset: the command and working directory after *
 | `unlink` | Forget this repo's token on this machine (revoke it in the web app) |
 | `hook`   | The hook itself; Claude Code calls it with JSON on stdin            |
 
+After upgrading from 0.2.3 or earlier, run `init` again: it re-registers the hook for file edits and MCP tools.
+
 ## Safety notes
 
 - **Fails closed.** If the server can't be reached, a risky command is blocked, with a message saying why.

package/dist/tollgate.mjs

@@ -7,7 +7,8 @@ var __export = (target, all) => {
 
 // src/main.ts
 import { appendFileSync, mkdirSync as mkdirSync3 } from "node:fs";
-import { join as join3, resolve } from "node:path";
+import { homedir as homedir2 } from "node:os";
+import { join as join3, resolve as resolve2 } from "node:path";
 import { parseArgs } from "node:util";
 
 // ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/classic/external.js
@@ -845,14 +846,14 @@ function promiseAllObject(promisesObj) {
 }
 function randomString(length = 10) {
   const chars = "abcdefghijklmnopqrstuvwxyz";
-  let str = "";
+  let str2 = "";
   for (let i = 0; i < length; i++) {
-    str += chars[Math.floor(Math.random() * chars.length)];
+    str2 += chars[Math.floor(Math.random() * chars.length)];
   }
-  return str;
+  return str2;
 }
-function esc(str) {
-  return JSON.stringify(str);
+function esc(str2) {
+  return JSON.stringify(str2);
 }
 function slugify(input2) {
   return input2.toLowerCase().trim().replace(/[^\w\s-]/g, "").replace(/[\s_-]+/g, "-").replace(/^-+|-+$/g, "");
@@ -966,8 +967,8 @@ var primitiveTypes = /* @__PURE__ */ new Set([
   "symbol",
   "undefined"
 ]);
-function escapeRegex(str) {
-  return str.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+function escapeRegex(str2) {
+  return str2.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 function clone(inst, def, params) {
   const cl = new inst._zod.constr(def ?? inst._zod.def);
@@ -1233,13 +1234,13 @@ function getSizableOrigin(input2) {
   return "unknown";
 }
 var highSurrogate = /[\uD800-\uDBFF]/;
-function codePointLength(str) {
-  const units = str.length;
-  if (!highSurrogate.test(str))
+function codePointLength(str2) {
+  const units = str2.length;
+  if (!highSurrogate.test(str2))
     return units;
   let count = units;
   for (let i = 0; i < units - 1; i++) {
-    if ((str.charCodeAt(i) & 64512) === 55296 && (str.charCodeAt(i + 1) & 64512) === 56320) {
+    if ((str2.charCodeAt(i) & 64512) === 55296 && (str2.charCodeAt(i + 1) & 64512) === 56320) {
       count--;
       i++;
     }
@@ -1750,14 +1751,14 @@ function toDotPath(_path) {
   return segs.join("");
 }
 function prettifyError(error62) {
-  const lines = [];
+  const lines2 = [];
   const issues = [...error62.issues].sort((a, b) => (a.path ?? []).length - (b.path ?? []).length);
   for (const issue2 of issues) {
-    lines.push(`\u2716 ${issue2.message}`);
+    lines2.push(`\u2716 ${issue2.message}`);
     if (issue2.path?.length)
-      lines.push(`  \u2192 at ${toDotPath(issue2.path)}`);
+      lines2.push(`  \u2192 at ${toDotPath(issue2.path)}`);
   }
-  return lines.join("\n");
+  return lines2.join("\n");
 }
 
 // ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/core/parse.js
@@ -2592,9 +2593,9 @@ var Doc = class {
       return;
     }
     const content = arg;
-    const lines = content.split("\n").filter((x) => x);
-    const minIndent = Math.min(...lines.map((x) => x.length - x.trimStart().length));
-    const dedented = lines.map((x) => x.slice(minIndent)).map((x) => " ".repeat(this.indent * 2) + x);
+    const lines2 = content.split("\n").filter((x) => x);
+    const minIndent = Math.min(...lines2.map((x) => x.length - x.trimStart().length));
+    const dedented = lines2.map((x) => x.slice(minIndent)).map((x) => " ".repeat(this.indent * 2) + x);
     for (const line of dedented) {
       this.content.push(line);
     }
@@ -5077,7 +5078,7 @@ var recursive = /* @__PURE__ */ new WeakMap();
 var NONE = 0;
 var ASSUMED = 1;
 var PROVEN = 2;
-function isRecursive(inst, stack, resolve2) {
+function isRecursive(inst, stack, resolve3) {
   const cached2 = recursive.get(inst);
   if (cached2 !== void 0)
     return cached2 ? PROVEN : NONE;
@@ -5087,7 +5088,7 @@ function isRecursive(inst, stack, resolve2) {
   let result = NONE;
   const check2 = (child) => {
     if (result !== PROVEN && child?._zod) {
-      const answer = isRecursive(child, stack, resolve2);
+      const answer = isRecursive(child, stack, resolve3);
       if (answer > result)
         result = answer;
     }
@@ -5098,7 +5099,7 @@ function isRecursive(inst, stack, resolve2) {
       const desc = Object.getOwnPropertyDescriptor(sh, key);
       if (spread && !desc.enumerable)
         continue;
-      const child = desc.get ? ASSUMED : desc.value?._zod ? isRecursive(desc.value, stack, resolve2) : NONE;
+      const child = desc.get ? ASSUMED : desc.value?._zod ? isRecursive(desc.value, stack, resolve3) : NONE;
       if (child > answer)
         answer = child;
     }
@@ -5162,7 +5163,7 @@ function isRecursive(inst, stack, resolve2) {
       break;
     // `$ZodLazy` caches its inner on the def, so a resolved edge is followed exactly
     case "lazy": {
-      const inner = def._cachedInner ?? (resolve2 ? inst._zod.innerType : void 0);
+      const inner = def._cachedInner ?? (resolve3 ? inst._zod.innerType : void 0);
       merge2(inner ? isRecursive(inner, stack, false) : ASSUMED);
       break;
     }
@@ -20059,7 +20060,15 @@ function expandCommand(command, options) {
 }
 
 // ../../features/gates/shared/presets.ts
+var GATE_TOOLS = ["bash", "edit", "mcp"];
+var TOOL_NOUN = {
+  bash: "command",
+  edit: "edit",
+  mcp: "tool call"
+};
 var presetSchema = external_exports.object({
+  // Defaults to "bash", so presets written before file and MCP gates keep their meaning.
+  tool: external_exports.enum(GATE_TOOLS).optional(),
   name: external_exports.string().regex(/^[a-z0-9][a-z0-9-]{0,39}$/).min(1),
   patterns: external_exports.array(external_exports.string().min(1).max(300)).min(1).max(20),
   // A match is skipped when any of these also matches (e.g. --dry-run changes nothing).
@@ -20161,6 +20170,52 @@ var DEFAULT_PRESETS = [
     env: "other",
     quorum: 1,
     outsideRepoOnly: true
+  },
+  // File edits are matched as "edit <path>" or "write <path>", the path relative to the repo
+  // (or ~/… outside it).
+  {
+    // An agent that may not run a command could otherwise switch the guard off: the hook's
+    // registration, the repo's presets, or this machine's Tollgate token.
+    name: "guard-config",
+    tool: "edit",
+    patterns: [
+      "(^|[\\s/])\\.claude/settings(\\.local)?\\.json$",
+      "(^|[\\s/])\\.tollgate\\.json$",
+      "(^|[\\s/])\\.config/tollgate/"
+    ],
+    env: "other",
+    quorum: 1
+  },
+  {
+    // Where a deploy is defined: a change here ships with the next push, gate or not.
+    name: "ci-config",
+    tool: "edit",
+    patterns: [
+      "(^|[\\s/])\\.github/workflows/",
+      "(^|[\\s/])\\.gitlab-ci\\.ya?ml$",
+      "(^|[\\s/])(vercel|netlify)\\.(json|toml)$",
+      "(^|[\\s/])(fly|railway)\\.(json|toml)$"
+    ],
+    quorum: 1,
+    prodQuorum: 2
+  },
+  {
+    name: "env-file",
+    tool: "edit",
+    patterns: ["(^|[\\s/])\\.env(\\.[^/\\s]+)?$"],
+    unless: ["\\.env\\.(example|sample|template|defaults)$"],
+    quorum: 1
+  },
+  {
+    // MCP calls are matched as "mcp__server__tool {json args}". Tool names that move money,
+    // ship, merge or destroy, whichever server they come from.
+    name: "mcp-risky",
+    tool: "mcp",
+    patterns: [
+      "^mcp__\\S+?__(\\S*_)?(delete|drop|destroy|deploy|publish|merge|refund|charge|payout|transfer|execute_sql|apply_migration)(_\\S*)?(\\s|$)"
+    ],
+    quorum: 1,
+    prodQuorum: 2
   }
 ];
 var PROD_RE = /(^|[\s=:/_-])(prod|production)($|[\s.:/_-])|--prod\b/i;
@@ -20208,15 +20263,22 @@ function rmTargetsOutsideRepo(command, cwd, repoRoot) {
   }
   return false;
 }
+function envOf(tool, text) {
+  if (tool === "edit") return detectEnv(text.replace(/\./g, "/"));
+  if (tool === "mcp") return detectEnv(text.replace(/["{},]/g, " "));
+  return detectEnv(text);
+}
 function matchPreset(presets, input2) {
+  const tool = input2.tool ?? "bash";
   for (const preset of presets) {
+    if ((preset.tool ?? "bash") !== tool) continue;
     const hit = preset.patterns.some((source) => compile2(source)?.test(input2.command) ?? false);
     if (!hit) continue;
     if (preset.unless?.some((source) => compile2(source)?.test(input2.command) ?? false)) continue;
     if (preset.outsideRepoOnly && !rmTargetsOutsideRepo(input2.command, input2.cwd, input2.repoRoot)) {
       continue;
     }
-    const env = preset.env ?? detectEnv(input2.command);
+    const env = preset.env ?? envOf(tool, input2.command);
     const quorum = env === "prod" ? Math.max(preset.quorum, preset.prodQuorum ?? 0) : preset.quorum;
     return { preset, env, quorum };
   }
@@ -20227,23 +20289,29 @@ function withDefaultPresets(presets) {
   const names = new Set(presets.map((preset) => preset.name));
   const merged = presets.map((preset) => {
     const builtIn = defaults.get(preset.name);
-    return builtIn ? { ...preset, patterns: [.../* @__PURE__ */ new Set([...preset.patterns, ...builtIn.patterns])] } : preset;
+    return builtIn ? {
+      ...preset,
+      tool: builtIn.tool,
+      patterns: [.../* @__PURE__ */ new Set([...preset.patterns, ...builtIn.patterns])]
+    } : preset;
   });
   return [...merged, ...DEFAULT_PRESETS.filter((preset) => !names.has(preset.name))];
 }
 var ENV_RANK = { prod: 2, staging: 1, other: 0 };
 function matchCommand(presets, input2) {
-  const pieces = [
+  const tool = input2.tool ?? "bash";
+  const pieces = tool === "bash" ? [
     { text: input2.command, via: [] },
     ...expandCommand(input2.command, { cwd: input2.cwd, readScripts: input2.readScripts }),
     ...input2.extra ?? []
-  ];
+  ] : [{ text: input2.command, via: [] }];
   let best = null;
   for (const piece of pieces) {
     const match = matchPreset(presets, {
       command: piece.text,
       cwd: input2.cwd,
-      repoRoot: input2.repoRoot
+      repoRoot: input2.repoRoot,
+      tool
     });
     if (!match) continue;
     const better = best === null || match.quorum > best.quorum || match.quorum === best.quorum && ENV_RANK[match.env] > ENV_RANK[best.env] || match.quorum === best.quorum && match.env === best.env && best.via.length === 0 && piece.via.length > 0 && best.preset.name === match.preset.name;
@@ -20504,6 +20572,8 @@ function commandHash(input2) {
 }
 var createGateSchema = external_exports.object({
   preset: external_exports.string().min(1).max(40),
+  // CLI 0.2.4+: what was stopped. Older hooks only send Bash commands.
+  tool: external_exports.enum(GATE_TOOLS).default("bash"),
   quorum: external_exports.number().int().min(1).max(9).optional(),
   env: external_exports.enum(["prod", "staging", "other"]).optional(),
   command: external_exports.string().min(1).max(4e3),
@@ -20611,36 +20681,115 @@ function truncate(text, maxChars) {
   return `${text.slice(0, Math.max(0, maxChars - 15))}\u2026 [truncated]`;
 }
 
+// src/tool-call.ts
+import { isAbsolute, relative, resolve, sep } from "node:path";
+var EDIT_TOOLS = /* @__PURE__ */ new Set(["Edit", "Write", "MultiEdit", "NotebookEdit"]);
+var MAX_DETAIL_LINES = 80;
+var str = (value) => typeof value === "string" ? value : "";
+function displayPath(file2, cwd, repoRoot, home) {
+  const absolute = resolve(cwd, file2);
+  const inside = (base2) => {
+    const rel = relative(base2, absolute);
+    return rel && !rel.startsWith("..") && !isAbsolute(rel) ? rel.split(sep).join("/") : null;
+  };
+  const inRepo = inside(repoRoot);
+  if (inRepo) return inRepo;
+  const inHome = inside(home);
+  return inHome ? `~/${inHome}` : absolute.split(sep).join("/");
+}
+function lines(prefix, text) {
+  return text === "" ? [] : text.split("\n").map((line) => `${prefix}${line}`);
+}
+function hideEnvValues(text) {
+  return text.replace(/^([+-] \s*(?:export\s+)?[A-Za-z_][A-Za-z0-9_.]*\s*=).*$/gm, "$1[REDACTED]");
+}
+function editDetail(toolName, input2) {
+  let out;
+  if (toolName === "Write") {
+    out = lines("+ ", str(input2.content));
+  } else if (toolName === "NotebookEdit") {
+    out = input2.edit_mode === "delete" ? ["(deletes a notebook cell)"] : lines("+ ", str(input2.new_source));
+  } else {
+    const edits = toolName === "MultiEdit" && Array.isArray(input2.edits) ? input2.edits : [input2];
+    out = edits.flatMap((edit, index) => [
+      ...index > 0 ? [""] : [],
+      ...lines("- ", str(edit.old_string)),
+      ...lines("+ ", str(edit.new_string)),
+      ...edit.replace_all === true ? ["(every occurrence in the file)"] : []
+    ]);
+  }
+  const shown = out.slice(0, MAX_DETAIL_LINES);
+  if (out.length > shown.length) shown.push(`\u2026 ${out.length - shown.length} more lines`);
+  return shown.join("\n");
+}
+function readToolCall(toolName, rawInput, where) {
+  const input2 = rawInput && typeof rawInput === "object" ? rawInput : {};
+  const hashSource = `${toolName}
+${JSON.stringify(input2)}`;
+  if (EDIT_TOOLS.has(toolName)) {
+    const file2 = str(input2.file_path) || str(input2.notebook_path);
+    if (!file2) return null;
+    const path = displayPath(file2, where.cwd, where.repoRoot, where.home);
+    const detail = editDetail(toolName, input2);
+    const isEnv = /(^|\/)\.env[^/]*$/.test(path);
+    return {
+      tool: "edit",
+      subject: `${toolName === "Write" ? "write" : "edit"} ${path}`,
+      hashSource,
+      detail: isEnv ? hideEnvValues(detail) : detail
+    };
+  }
+  if (toolName.startsWith("mcp__")) {
+    const args = JSON.stringify(input2);
+    return {
+      tool: "mcp",
+      subject: args === "{}" ? toolName : `${toolName} ${args}`,
+      hashSource,
+      detail: ""
+    };
+  }
+  return null;
+}
+
 // src/hook.ts
 var POLL_MS = 2e3;
 var PARK_MARGIN_SEC = 15;
-function denyMessages(gate) {
+function denyMessages(gate, tool = "bash") {
   const who = gate.decidedBy || "a teammate";
+  const noun = TOOL_NOUN[tool];
+  const question = tool === "bash" ? `${who} asked a question in TG-${gate.code} before deciding: "${gate.question}" Answer it specifically and honestly in the description of your next Bash call, then run the same command again so the team can decide. If the answer changes your plan, change the command too.` : `${who} asked a question in TG-${gate.code} before deciding: "${gate.question}" Answer it to the user, then make the same ${noun} again so the team can decide. If the answer changes your plan, change the ${noun} too.`;
   return {
-    denied: gate.question ? `${who} asked a question in TG-${gate.code} before deciding: "${gate.question}" Answer it specifically and honestly in the description of your next Bash call, then run the same command again so the team can decide. If the answer changes your plan, change the command too.` : `Denied by ${who} in TG-${gate.code}: ${gate.denyReason ?? "no reason given"}. Do not retry this command as is. Change your plan to address the reason, then propose the new command.`,
-    parked: `Parked as TG-${gate.code}: nobody on the team decided in time. Continue with other work that doesn't need this command. Retry the exact same command later; once the team approves TG-${gate.code} it passes immediately (${gate.url}).`,
+    denied: gate.question ? question : `Denied by ${who} in TG-${gate.code}: ${gate.denyReason ?? "no reason given"}. Do not retry this ${noun} as is. Change your plan to address the reason, then propose the new ${noun}.`,
+    parked: `Parked as TG-${gate.code}: nobody on the team decided in time. Continue with other work that doesn't need this ${noun}. Retry the exact same ${noun} later; once the team approves TG-${gate.code} it passes immediately (${gate.url}).`,
     expired: `TG-${gate.code} expired without approval. Ask the user whether to raise it again.`
   };
 }
-function notLinkedMessage() {
-  return "Tollgate blocked this command because this repo is not linked on this machine. Ask the user to run: npx tollgate-cli init";
+function notLinkedMessage(tool = "bash") {
+  return `Tollgate blocked this ${TOOL_NOUN[tool]} because this repo is not linked on this machine. Ask the user to run: npx tollgate-cli init`;
 }
-function failClosedMessage(server, error62) {
+function failClosedMessage(server, error62, tool = "bash") {
   const detail = error62 instanceof Error ? error62.message : String(error62);
-  return `Tollgate could not reach ${server} (${detail}), so this risky command was blocked to be safe. Tell the user; do not try to work around it.`;
+  return `Tollgate could not reach ${server} (${detail}), so this risky ${TOOL_NOUN[tool]} was blocked to be safe. Tell the user; do not try to work around it.`;
 }
 async function decide(input2, deps) {
-  if (input2.tool_name !== "Bash") return { kind: "none" };
-  const command = typeof input2.tool_input?.command === "string" ? input2.tool_input.command : "";
+  const toolName = input2.tool_name ?? "";
+  const isBash = toolName === "Bash";
+  if (!isBash && !EDIT_TOOLS.has(toolName) && !toolName.startsWith("mcp__")) {
+    return { kind: "none" };
+  }
+  const command = isBash && typeof input2.tool_input?.command === "string" ? input2.tool_input.command : "";
   const cwd = input2.cwd || process.cwd();
-  if (!command.trim()) return { kind: "none" };
+  if (isBash && !command.trim()) return { kind: "none" };
   const config2 = deps.loadConfig(cwd);
   if (!config2) return { kind: "none", note: "no .tollgate.json" };
+  const call = isBash ? { tool: "bash", subject: command, hashSource: command, detail: "" } : readToolCall(toolName, input2.tool_input, { cwd, repoRoot: config2.repoRoot, home: deps.home });
+  if (!call) return { kind: "none" };
   const match = matchCommand(withDefaultPresets(config2.presets), {
-    command,
+    command: call.subject,
     cwd,
     repoRoot: config2.repoRoot,
-    readScripts: deps.readScripts ? (dir) => deps.readScripts(dir, config2.repoRoot) : void 0
+    tool: call.tool,
+    readScripts: isBash && deps.readScripts ? (dir) => deps.readScripts(dir, config2.repoRoot) : void 0
   });
   if (!match) return { kind: "none" };
   if (deps.env.TOLLGATE_BYPASS === "1") {
@@ -20650,14 +20799,14 @@ async function decide(input2, deps) {
   if (config2.error) {
     return {
       kind: "deny",
-      reason: `Tollgate blocked this command because .tollgate.json is invalid (${config2.error}). Ask the user to fix it or run: npx tollgate-cli init`
+      reason: `Tollgate blocked this ${TOOL_NOUN[call.tool]} because .tollgate.json is invalid (${config2.error}). Ask the user to fix it or run: npx tollgate-cli init`
     };
   }
   const token = deps.loadToken(config2.repoRoot);
-  if (!token) return { kind: "deny", reason: notLinkedMessage() };
+  if (!token) return { kind: "deny", reason: notLinkedMessage(call.tool) };
   const started = deps.now();
   const deadline = started + Math.max(5, config2.hookTimeoutSec - PARK_MARGIN_SEC) * 1e3;
-  const cmdHash = commandHash({ repo: config2.repo, cwd, command });
+  const cmdHash = commandHash({ repo: config2.repo, cwd, command: call.hashSource });
   const api = deps.api(config2, token);
   try {
     const grant = await api.consumeGrant(cmdHash);
@@ -20665,19 +20814,24 @@ async function decide(input2, deps) {
       return grant.mode === "delegate" ? { kind: "allow", reason: "Approved earlier by the team (single-use grant)." } : { kind: "none", note: "grant redeemed" };
     }
     const secrets = deps.envSecrets(config2.repoRoot);
-    const redactedCommand = redact(command, secrets);
+    const redactedCommand = redact(call.subject, secrets);
     const redactedCwd = redact(cwd, secrets);
-    const context = redact(deps.context(`${command}
-${match.segment}`, config2.repoRoot), secrets);
+    const context = redact(
+      isBash ? deps.context(`${command}
+${match.segment}`, config2.repoRoot) : call.detail,
+      secrets
+    );
     const via = match.via.length > 0 ? {
       from: redact(match.via.join(" \u2192 "), secrets),
       runs: redact(match.segment, secrets)
     } : null;
     const branch = deps.gitBranch(config2.repoRoot);
-    const description = input2.tool_input?.description;
+    const description = isBash ? input2.tool_input?.description : void 0;
     const intent = typeof description === "string" && description.trim() ? redact(description.trim(), secrets) : null;
     let gate = await api.createGate({
       preset: match.preset.name,
+      // Only sent when it isn't a command, so servers from before file gates still accept it.
+      ...call.tool === "bash" ? {} : { tool: call.tool },
       quorum: match.quorum,
       env: match.env,
       command: truncate(redactedCommand.text, 4e3),
@@ -20698,18 +20852,19 @@ ${match.segment}`, config2.repoRoot), secrets);
       if (gate.status === "approved") {
         return gate.mode === "delegate" ? { kind: "allow", reason: `Approved by the team in TG-${gate.code}.` } : { kind: "none", note: `TG-${gate.code} approved` };
       }
-      if (gate.status === "denied") return { kind: "deny", reason: denyMessages(gate).denied };
-      if (gate.status === "expired") return { kind: "deny", reason: denyMessages(gate).expired };
-      if (gate.status === "parked") return { kind: "deny", reason: denyMessages(gate).parked };
+      const messages = denyMessages(gate, call.tool);
+      if (gate.status === "denied") return { kind: "deny", reason: messages.denied };
+      if (gate.status === "expired") return { kind: "deny", reason: messages.expired };
+      if (gate.status === "parked") return { kind: "deny", reason: messages.parked };
       if (deps.now() + POLL_MS >= deadline) {
         await api.park(gate.id).catch(() => void 0);
-        return { kind: "deny", reason: denyMessages(gate).parked };
+        return { kind: "deny", reason: messages.parked };
       }
       await deps.sleep(POLL_MS);
       gate = await api.getGate(gate.id).catch(() => gate);
     }
   } catch (error62) {
-    return { kind: "deny", reason: failClosedMessage(config2.server, error62) };
+    return { kind: "deny", reason: failClosedMessage(config2.server, error62, call.tool) };
   }
 }
 function renderDecision(decision) {
@@ -20727,6 +20882,7 @@ function renderDecision(decision) {
 import { copyFileSync, existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "node:fs";
 import { join as join2 } from "node:path";
 var SETTINGS_FILE = join2(".claude", "settings.local.json");
+var HOOK_MATCHER = "Bash|Edit|Write|MultiEdit|NotebookEdit|mcp__.*";
 function isTollgateHook(command) {
   return /tollgate/.test(command) && /\bhook\b/.test(command);
 }
@@ -20739,7 +20895,7 @@ function mergeHookSettings(existing, hookCommand, timeoutSec) {
   hooks.PreToolUse = [
     ...kept,
     {
-      matcher: "Bash",
+      matcher: HOOK_MATCHER,
       hooks: [
         {
           type: "command",
@@ -20805,7 +20961,7 @@ function writeRepoFiles(input2) {
 }
 
 // src/main.ts
-var HELP = `tollgate ${"0.2.3"}: your team approves risky agent commands before they run
+var HELP = `tollgate ${"0.2.4"}: your team approves risky agent commands before they run
 
 Usage:
   npx tollgate-cli init --token <tg_\u2026> [--server <url>] [--repo <owner/name>]
@@ -20824,6 +20980,7 @@ function hookDeps() {
     context: buildContext,
     readScripts,
     env: process.env,
+    home: homedir2(),
     now: () => Date.now(),
     sleep: (ms) => new Promise((done) => setTimeout(done, ms)),
     audit: (event, detail) => {
@@ -20890,7 +21047,7 @@ async function runInit(argv) {
       dir: { type: "string" }
     }
   });
-  const repoRoot = resolve(values.dir ?? process.cwd());
+  const repoRoot = resolve2(values.dir ?? process.cwd());
   const token = values.token ?? process.env.TOLLGATE_TOKEN;
   const server = (values.server ?? process.env.TOLLGATE_SERVER ?? "").replace(/\/+$/, "");
   if (!token || !server) {
@@ -20900,7 +21057,7 @@ async function runInit(argv) {
   }
   const who = await whoAmI(server, token);
   const repo = values.repo ?? who.repo.name ?? gitRepoName(repoRoot) ?? "repo";
-  const bundle = installBundle(resolve(process.argv[1] ?? ""), tollgateHome());
+  const bundle = installBundle(resolve2(process.argv[1] ?? ""), tollgateHome());
   const tokenFile2 = saveToken(repoRoot, { token, server, repo });
   const files = writeRepoFiles({ repoRoot, server, repo, hookCommand: hookCommandFor(bundle) });
   process.stdout.write(
@@ -20990,7 +21147,7 @@ async function main() {
       return runUnlink();
     case "--version":
     case "-v":
-      process.stdout.write(`${"0.2.3"}
+      process.stdout.write(`${"0.2.4"}
 `);
       return;
     default:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tollgate-cli",
-  "version": "0.2.3",
+  "version": "0.2.4",
   "description": "Your team approves risky Claude Code commands before they run.",
   "license": "MIT",
   "type": "module",