peg
diff --git a/‎CHANGELOG.md‎
Lines changed: 30 additions & 0 deletions b/‎CHANGELOG.md‎
Lines changed: 30 additions & 0 deletions
diff --git a/‎README.md‎
Lines changed: 15 additions & 0 deletions b/‎README.md‎
Lines changed: 15 additions & 0 deletions
diff --git a/‎cmd/rampart/cli/cli_test.go‎
Lines changed: 13 additions & 4 deletions b/‎cmd/rampart/cli/cli_test.go‎
Lines changed: 13 additions & 4 deletions
diff --git a/‎cmd/rampart/cli/coverage_boost3_test.go‎
Lines changed: 11 additions & 3 deletions b/‎cmd/rampart/cli/coverage_boost3_test.go‎
Lines changed: 11 additions & 3 deletions
diff --git a/‎cmd/rampart/cli/hook.go‎
Lines changed: 107 additions & 8 deletions b/‎cmd/rampart/cli/hook.go‎
Lines changed: 107 additions & 8 deletions
@@ -7,6 +7,36 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.6.5] - 2026-02-27
+
+### Added
+
+- **`action: ask`** — Native Claude Code inline permission prompt (issue #122). Policy rules can now use `action: ask` to trigger Claude Code's built-in approval dialog instead of blocking execution. The user sees an inline prompt with the command details, explain mode (`ctrl+e`), and yes/no choice without leaving the session.
+- **Smart `require_approval` fallback** — When `rampart serve` is not running, `require_approval` rules automatically fall back to the native ask prompt instead of hanging indefinitely.
+- **Session state tracking** — `action: ask` decisions are persisted to `~/.rampart/session-state/` and correlated across PreToolUse/PostToolUse hook invocations for accurate approval tracking.
+- **`rampart uninstall`** — Cross-platform command to remove hooks, stop serve processes, and clean up PATH entries.
+- **`docs/guides/native-ask.md`** — User guide for `action: ask` with correct YAML syntax, use cases, and limitations.
+
+### Security
+
+- **Session state path traversal protection** — `validateSessionID` rejects session IDs containing path traversal characters.
+- **Removed hardcoded token** from `contrib/openclaw-shim.sh` (was committed as an example; now reads from `~/.rampart/token`).
+
+### Fixed
+
+- **Windows: Claude Code hooks use Git Bash path format** — Hooks were silently ignored because `C:\Users\trev\.rampart\bin\rampart.exe` backslash paths were mangled by Git Bash. `rampart setup claude-code` now writes `/c/Users/trev/.rampart/bin/rampart.exe` format.
+- **Hook stderr output caused silent allow** — Claude Code treats any hook stderr as a hook error and defaults to allow. Rampart no longer writes to stderr for ask decisions or session manager warnings.
+- **Session manager logs** — Downgraded from `Warn` to `Debug` to prevent unintended stderr output during hook execution.
+- **`rampart init` now creates policies when config already exists** — Previously skipped policy creation if `~/.rampart/config.yaml` was present.
+- **Graceful SSE shutdown** — `rampart serve` now closes SSE connections before exiting, fixing Ctrl+C hangs with "context deadline exceeded" errors.
+- **Windows shutdown file handle delay** — Added 200ms delay on Windows exit to give the OS time to release file handles before process termination.
+
+### Improved
+
+- **Wildcard hook matcher** — `rampart setup claude-code` now installs a `.*` matcher that intercepts ALL Claude Code tools (Bash, Read, Write, Edit, Fetch, Task, and future tools). Previously only specific tool names were hooked.
+- **Lint: misplaced `action` field detection** — `rampart policy lint` now detects when `action:` is written at the policy level (sibling of `name`, `match`, `rules`) instead of inside a `rules:` entry, and emits a helpful "did you mean to put this under `rules:`?" message.
+- **Windows installer upgrade detection** — Installer detects existing installations and offers to refresh Claude Code hooks with `--force`.
+
 ## [0.5.0] - 2026-02-24
 
 ### Added
 
@@ -336,6 +336,21 @@ Use `command_contains` for substring matching (case-insensitive, v0.4.4+):
 
 > `command_contains` uses substring matching (case-insensitive). `command_matches` uses glob patterns.
 
+Use `action: ask` to trigger Claude Code's native approval prompt:
+
+```yaml
+  - name: ask-before-sudo
+    match:
+      agent: ["claude-code"]
+      tool: ["exec"]
+    rules:
+      - action: ask
+        when:
+          command_contains:
+            - "sudo "
+        message: "This command needs your approval"
+```
+
 **Evaluation:** Deny always wins. Lower priority number = evaluated first. Four actions: `deny`, `require_approval`, `watch`, `allow`. (`log` is a deprecated alias for `watch` — update your policies if you use it.)
 
 ### Project-local policies
 
@@ -59,15 +59,24 @@ func TestInitCreatesFile(t *testing.T) {
 	assert.Equal(t, "1", parsed["version"])
 }
 
-func TestInitRefusesOverwrite(t *testing.T) {
+func TestInitSkipsExistingConfig(t *testing.T) {
 	dir := t.TempDir()
 	testSetHome(t, dir)
 	configPath := filepath.Join(dir, "rampart.yaml")
 	require.NoError(t, os.WriteFile(configPath, []byte("existing: true\n"), 0o644))
 
-	_, _, err := runCLI(t, "--config", configPath, "init")
-	require.Error(t, err)
-	assert.Contains(t, err.Error(), "already exists")
+	// Should succeed - creates policies even if config exists
+	stdout, _, err := runCLI(t, "--config", configPath, "init")
+	require.NoError(t, err)
+	assert.Contains(t, stdout, "config already exists")
+
+	// Config should be unchanged
+	data, _ := os.ReadFile(configPath)
+	assert.Contains(t, string(data), "existing: true")
+
+	// But policies should be created
+	policyPath := filepath.Join(dir, ".rampart", "policies", "standard.yaml")
+	assert.FileExists(t, policyPath)
 }
 
 func TestInitForceOverwrite(t *testing.T) {
 
@@ -16,14 +16,22 @@ import (
 
 func TestNewInitCmd_AlreadyExists(t *testing.T) {
 	dir := t.TempDir()
+	testSetHome(t, dir)
 	p := filepath.Join(dir, "rampart.yaml")
 	os.WriteFile(p, []byte("existing"), 0o644)
 
-	root := NewRootCmd(context.Background(), &bytes.Buffer{}, &bytes.Buffer{})
+	stdout := &bytes.Buffer{}
+	root := NewRootCmd(context.Background(), stdout, &bytes.Buffer{})
 	root.SetArgs([]string{"init", "--config", p})
 	err := root.Execute()
-	if err == nil {
-		t.Error("expected error for existing file without --force")
+	// Should succeed now - init creates policies even if config exists
+	if err != nil {
+		t.Errorf("expected no error, got %v", err)
+	}
+	// Config should be unchanged
+	data, _ := os.ReadFile(p)
+	if string(data) != "existing" {
+		t.Errorf("config was modified, expected 'existing' got %q", string(data))
 	}
 }
 
 
@@ -9,6 +9,7 @@ import (
 	"encoding/json"
 	"fmt"
 	"log/slog"
+	"net/http"
 	"os"
 	"os/exec"
 	"path/filepath"
@@ -18,6 +19,7 @@ import (
 
 	"github.com/peg/rampart/internal/audit"
 	"github.com/peg/rampart/internal/engine"
+	"github.com/peg/rampart/internal/session"
 	"github.com/spf13/cobra"
 )
 
@@ -89,6 +91,8 @@ type hookParseResult struct {
 	Response      string // non-empty for PostToolUse events
 	RunID         string // run ID derived from session_id (or env overrides)
 	HookEventName string // e.g. "PreToolUse", "PostToolUse", "PostToolUseFailure"
+	SessionID     string // raw session_id from Claude Code input (for session state)
+	ToolUseID     string // tool_use_id from Claude Code input (for ask correlation)
 }
 
 // gitContext holds the git repository context for the current working directory.
@@ -154,6 +158,39 @@ func gitRevParseTopLevel() (string, error) {
 	return strings.TrimSpace(string(out)), nil
 }
 
+// sessionStateDir returns the directory used for per-session state files.
+// The directory is ~/.rampart/session-state/ by default.
+func sessionStateDir() string {
+	home, err := os.UserHomeDir()
+	if err != nil {
+		return ""
+	}
+	return filepath.Join(home, ".rampart", "session-state")
+}
+
+// isServeRunning checks if rampart serve is actually running by hitting the healthz endpoint.
+// Returns true if serve responds within the timeout, false otherwise.
+// This is used for require_approval fallback: if serve isn't running, we fall back to
+// native ask prompts instead of hanging on a dashboard approval that will never come.
+func isServeRunning(serveURL string) bool {
+	ctx, cancel := context.WithTimeout(context.Background(), 150*time.Millisecond)
+	defer cancel()
+
+	healthURL := strings.TrimRight(serveURL, "/") + "/healthz"
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, healthURL, nil)
+	if err != nil {
+		return false
+	}
+
+	resp, err := http.DefaultClient.Do(req)
+	if err != nil {
+		return false
+	}
+	defer resp.Body.Close()
+
+	return resp.StatusCode == http.StatusOK
+}
+
 func newHookCmd(opts *rootOptions) *cobra.Command {
 	var auditDir string
 	var mode string
@@ -245,6 +282,14 @@ Cline setup: Use "rampart setup cline" to install hooks automatically.`,
 			}
 			logger := slog.New(slog.NewTextHandler(os.Stderr, &slog.HandlerOptions{Level: logLevel}))
 
+			// Cleanup stale session state files in the background (best-effort).
+			// This runs once per hook invocation; typically fires every few seconds
+			// during active sessions, which is sufficient to keep the directory clean.
+			go func() {
+				mgr := session.NewManager(sessionStateDir(), "", logger)
+				_ = mgr.Cleanup(24 * time.Hour)
+			}()
+
 			// Load policies
 			policyPath, cleanupPolicy, err := resolveWrapPolicyPath(opts.configPath)
 			if err != nil {
@@ -297,9 +342,9 @@ Cline setup: Use "rampart setup cline" to install hooks automatically.`,
 
 			switch format {
 			case "claude-code":
-				parsed, err = parseClaudeCodeInput(os.Stdin, logger)
+				parsed, err = parseClaudeCodeInput(cmd.InOrStdin(), logger)
 			case "cline":
-				parsed, err = parseClineInput(os.Stdin, logger)
+				parsed, err = parseClineInput(cmd.InOrStdin(), logger)
 			default:
 				// Should be unreachable — format is validated above.
 				// Explicit default prevents a nil parsed pointer reaching
@@ -445,6 +490,31 @@ Cline setup: Use "rampart setup cline" to install hooks automatically.`,
 				go sendNotification(config.Notify, call, decision, logger)
 			}
 
+			// PostToolUse: observe approval for any pending ask entries in session state.
+			// This fires when tool_response is present, indicating the user approved the ask.
+			// The observation is best-effort — errors are logged but do not block the hook.
+			if parsed.HookEventName == "PostToolUse" && parsed.ToolUseID != "" && parsed.SessionID != "" {
+				sessionMgr := session.NewManager(sessionStateDir(), parsed.SessionID, logger)
+				record, obsErr := sessionMgr.ObserveApproval(parsed.ToolUseID)
+				if obsErr != nil {
+					// Not found means this PostToolUse was not preceded by an ActionAsk —
+					// that is normal (most tool calls are allowed/denied, not asked).
+					logger.Debug("hook: PostToolUse observe approval (no pending ask or other issue)",
+						"session_id", parsed.SessionID,
+						"tool_use_id", parsed.ToolUseID,
+						"error", obsErr,
+					)
+				} else {
+					logger.Info("hook: observed approval for ask",
+						"session_id", parsed.SessionID,
+						"tool_use_id", parsed.ToolUseID,
+						"tool", record.Tool,
+						"pattern", record.Pattern,
+						"approval_count", record.ApprovalCount,
+					)
+				}
+			}
+
 			// Return decision
 			cmdStr := extractCommand(call)
 			if mode != "enforce" {
@@ -457,8 +527,30 @@ Cline setup: Use "rampart setup cline" to install hooks automatically.`,
 					return outputHookResult(cmd, format, hookBlock, true, decision.Message, cmdStr, decision.Suggestions...)
 				}
 				return outputHookResult(cmd, format, hookDeny, false, decision.Message, cmdStr, decision.Suggestions...)
+			case engine.ActionAsk:
+				// Write pending ask to session state so PostToolUse can correlate the outcome.
+				if parsed.SessionID != "" && parsed.ToolUseID != "" {
+					sessionMgr := session.NewManager(sessionStateDir(), parsed.SessionID, logger)
+					// Build a generalised pattern for the command (use command as-is for now;
+					// Phase 2 will add pattern generalisation via engine.GeneralizePattern).
+					cmdStr2 := extractCommand(call)
+					policyName := ""
+					if len(decision.MatchedPolicies) > 0 {
+						policyName = decision.MatchedPolicies[0]
+					}
+					if err := sessionMgr.RecordAsk(parsed.ToolUseID, call.Tool, cmdStr2, cmdStr2, policyName, decision.Message); err != nil {
+						// NOTE: Use Debug, not Warn. Claude Code treats ANY stderr as a hook error
+						// for ask decisions. RecordAsk is best-effort anyway.
+						logger.Debug("hook: failed to record ask in session state", "error", err)
+					}
+				}
+				// Emit native ask prompt (Claude Code shows the 4-button dialog).
+				return outputHookResult(cmd, format, hookAsk, false, decision.Message, cmdStr)
 			case engine.ActionRequireApproval:
-				if serveURL != "" {
+				// Check if serve is actually running. The token file persists after serve stops,
+				// so we can't rely on its presence. A quick health check confirms serve is up.
+				// If serve isn't running, fall back to native ask prompts.
+				if serveURL != "" && isServeRunning(serveURL) {
 					approvalClient := &hookApprovalClient{
 						serveURL:       strings.TrimRight(serveURL, "/"),
 						token:          serveToken,
@@ -471,6 +563,9 @@ Cline setup: Use "rampart setup cline" to install hooks automatically.`,
 					result := approvalClient.requestApprovalCtx(cmd.Context(), call.Tool, command, call.Agent, path, call.RunID, decision.Message, 5*time.Minute)
 					return outputHookResult(cmd, format, result, false, decision.Message, cmdStr)
 				}
+				// Serve not running — fall back to native ask prompt.
+				// This gives a better UX than blocking forever on a dashboard that isn't there.
+				logger.Debug("hook: serve not running, falling back to native ask for require_approval")
 				return outputHookResult(cmd, format, hookAsk, false, decision.Message, cmdStr)
 			default:
 				return outputHookResult(cmd, format, hookAllow, isPostToolUse, decision.Message, cmdStr)
@@ -509,6 +604,8 @@ func parseClaudeCodeInput(reader interface{ Read([]byte) (int, error) }, logger
 		Agent:         "claude-code",
 		RunID:         deriveRunID(input.SessionID),
 		HookEventName: input.HookEventName,
+		SessionID:     input.SessionID,
+		ToolUseID:     input.ToolUseID,
 	}
 
 	// Extract response text from PostToolUse tool_response.
@@ -608,7 +705,9 @@ func mapClaudeCodeTool(toolName string) string {
 		// displays it distinctly from exec/read/write.
 		return "agent"
 	default:
-		slog.Warn("hook: unmapped Claude Code tool name, defaulting to unknown", "tool_name", toolName)
+		// NOTE: Don't log here - this function is called before the logger is available,
+		// and any stderr output causes Claude Code to report "hook error".
+		// Unknown tools are handled gracefully by returning "unknown".
 		return "unknown"
 	}
 }
@@ -631,7 +730,7 @@ func mapClineTool(toolName string) string {
 	case "ask_followup_question", "attempt_completion", "new_task", "fetch_instructions", "plan_mode_respond":
 		return "interact"
 	default:
-		slog.Warn("hook: unmapped Cline tool name, defaulting to unknown", "tool_name", toolName)
+		// NOTE: Don't log here - any stderr output causes the agent to report "hook error".
 		return "unknown"
 	}
 }
@@ -655,9 +754,9 @@ func outputHookResult(cmd *cobra.Command, format string, decision hookDecisionTy
 	if decision == hookDeny || decision == hookBlock {
 		fmt.Fprint(os.Stderr, formatDenyMessage(command, reason, suggestions))
 	}
-	if decision == hookAsk {
-		fmt.Fprint(os.Stderr, formatApprovalRequiredMessage(command, reason))
-	}
+	// NOTE: Do NOT print to stderr for hookAsk — Claude Code interprets any
+	// stderr output as a hook error. The native prompt shows the reason via
+	// PermissionDecisionReason in the JSON response.
 	switch format {
 	case "cline":
 		// Cline has no "ask" — cancel on deny, block, and require_approval.