@guilz-dev/belay 0.1.0 → 0.1.1

package/README.md

@@ -8,10 +8,10 @@
 
 [Documentation (日本語)](./docs/README.ja.md)
 
-`@guilz-dev/belay` hooks into agent runtimes (Cursor, Claude Code) and inspects
-each shell command, subagent launch, and file mutation *before* it runs. Most
-actions pass through untouched. Only the irreversible-and-catastrophic ones are
-held back for one-shot human approval — and every decision is written to an
+`@guilz-dev/belay` hooks into agent runtimes (Cursor, Claude Code, Codex) and
+inspects each shell command, subagent launch, and file mutation *before* it runs.
+Most actions pass through untouched. Only the irreversible-and-catastrophic ones
+are held back for one-shot human approval — and every decision is written to an
 audit log.
 
 <p align="center">
@@ -21,6 +21,30 @@ audit log.
 > **0.0.x early release** — APIs and behavior may change. Cursor and Claude Code
 > are the supported adapters; Codex is experimental.
 
+## Supported agents
+
+Belay works across three coding agents. Each one runs the **same classifier**,
+wired in through that agent's native **hook** mechanism — no agent-specific
+policy to maintain.
+
+| Agent | Status | Hook config | belay config |
+|-------|--------|-------------|--------------|
+| **Cursor** | Supported | `.cursor/hooks.json` | `.cursor/belay.config.json` |
+| **Claude Code** | Supported | `.claude/settings.json` | `.claude/belay.config.json` |
+| **Codex** | Experimental | `.codex/config.toml` | `.codex/belay.config.json` |
+
+Pick the adapter at install time with `--adapter cursor|claude|codex` (or let
+`init-wizard` prompt). Hosts use different hook event names, but Belay registers
+the same runners (`belay-tool-gate`, `belay-before-submit`, `belay-audit`) at
+equivalent lifecycle points:
+
+| Role | belay hook | Cursor | Claude Code | Codex |
+|------|-----------|--------|-------------|-------|
+| Gate shell / tools / file mutations | `belay-tool-gate` | `beforeShellExecution`, `preToolUse` | `PreToolUse` | `PreToolUse` |
+| Gate subagent launches | `belay-tool-gate` | `subagentStart` | (via `PreToolUse`) | `SubagentStart` |
+| One-shot approvals | `belay-before-submit` | `beforeSubmitPrompt` | `UserPromptSubmit` | `UserPromptSubmit` |
+| Audit log | `belay-audit` | `postToolUse`, `stop`, `sessionEnd` | `PostToolUse` | `PostToolUse` |
+
 ## Why
 
 Static denylists don't work for agents. The same command (`rm`, `curl`, a
@@ -48,6 +72,7 @@ npx @guilz-dev/belay init-wizard
 
 # Or non-interactive
 npx @guilz-dev/belay init --adapter claude   # Claude Code
+npx @guilz-dev/belay init --adapter codex    # Codex (experimental)
 npx @guilz-dev/belay init                     # Cursor (default)
 ```
 
@@ -64,10 +89,10 @@ verdict and `overrides.allow` to whitelist commands you trust.
 
 ## How it works
 
-Belay registers hooks on the host runtime (`.cursor/hooks.json` or
-`.claude/settings.json`) and gates shell execution, subagent launches, and file
-mutations through one shared classifier. It always forms its own judgment — it
-does not trust an assessment supplied by the agent.
+Belay registers hooks on the host runtime (`.cursor/hooks.json`,
+`.claude/settings.json`, or `.codex/config.toml`) and gates shell execution,
+subagent launches, and file mutations through one shared classifier. It always
+forms its own judgment — it does not trust an assessment supplied by the agent.
 
 Every gated action gets one of three verdicts:
 
@@ -84,7 +109,8 @@ When an action is denied, approve the **next matching action once** by sending:
 ```
 
 Approvals are one-shot and expire after 15 minutes by default. Every decision is
-written to `.cursor/belay/audit.ndjson` (or `.claude/belay/audit.ndjson`).
+written to `.cursor/belay/audit.ndjson`, `.claude/belay/audit.ndjson`, or
+`.codex/belay/audit.ndjson` (depending on the adapter).
 
 In **audit mode** (`mode: "audit"`), would-be denials are recorded
 (`wouldBlock: true`) but execution still continues, and no approval IDs are
@@ -247,6 +273,14 @@ Belay state files are local runtime artifacts and should usually stay out of git
 .cursor/hooks/belay-*
 .cursor/skills/belay/
 .cursor/commands/belay-approve.md
+
+.claude/belay/
+.claude/belay.config.json
+.claude/hooks/belay-*
+
+.codex/belay/
+.codex/belay.config.json
+.codex/hooks/belay-*
 ```
 
 ## Library exports

package/dist/cli.js

@@ -16,9 +16,16 @@ import { loadConfigFile } from './config-io.js';
 import { initProject, upgradeProject } from './installer.js';
 import { egressEnv, egressStatus, formatEgressStatusReport, startEgressProxy, stopEgressProxy, } from './services/egress-service.js';
 import { formatSandboxStatusReport, sandboxStatus } from './services/sandbox-service.js';
+import { PACKAGE_VERSION } from './version.js';
 function parseArgs(argv) {
     const [command, ...rest] = argv;
     const options = {};
+    if (!command || command === '--help' || command === '-h') {
+        return { command: 'help', options };
+    }
+    if (command === '--version' || command === '-V') {
+        return { command: 'version', options };
+    }
     for (let index = 0; index < rest.length; index += 1) {
         const token = rest[index];
         if (token === '--with-skill') {
@@ -349,6 +356,10 @@ async function main() {
             printHelp();
             return;
         }
+        if (command === 'version') {
+            process.stdout.write(`${PACKAGE_VERSION}\n`);
+            return;
+        }
         if (command === 'init-wizard') {
             const { runInitWizard } = await import('./commands/init-wizard.js');
             const result = await runInitWizard({ targetDir: options.targetDir });

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const PACKAGE_VERSION = "0.0.1";
+export declare const PACKAGE_VERSION = "0.1.1";

package/dist/version.js

@@ -1 +1,2 @@
-export const PACKAGE_VERSION = '0.0.1';
+// Generated by scripts/sync-version.mjs — do not edit.
+export const PACKAGE_VERSION = '0.1.1';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@guilz-dev/belay",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Belay-style approval and audit gating for agent runtimes.",
   "type": "module",
   "license": "MIT",
@@ -48,7 +48,9 @@
     "agent-belay-logo.png"
   ],
   "scripts": {
-    "build": "rm -rf dist && tsc -p tsconfig.build.json && node scripts/build-runtime.mjs",
+    "build": "rm -rf dist && node scripts/sync-version.mjs && tsc -p tsconfig.build.json && node scripts/build-runtime.mjs",
+    "check:version": "node scripts/check-cli-version.mjs",
+    "prepublishOnly": "pnpm build && node scripts/check-cli-version.mjs",
     "lint": "biome check src package.json README.md CHANGELOG.md CONTRIBUTING.md SECURITY.md tsconfig.json tsconfig.build.json vitest.config.ts scripts docs",
     "typecheck": "tsc --noEmit",
     "test": "pnpm build && vitest run",

package/skills/belay/SKILL.md

@@ -2,16 +2,30 @@
 name: belay
 description: >-
   Guides approval when belay blocks a high-risk shell command, subagent launch,
-  or tool action. Use when an action is denied, blocked, or needs belay-approve, or when
-  installing or checking belay hook health in a repository.
+  or tool action across Cursor, Claude Code, and Codex. Use when an action is
+  denied, blocked, or needs belay-approve, or when installing or checking belay
+  hook health in a repository.
 disable-model-invocation: true
 ---
 
 # Belay
 
-Belay installs repo-local hooks that gate high-risk shell commands, tool actions, and
-subagent launches. Enforcement lives in hooks; this skill only explains the flow and
-routes you to the CLI. It does not classify commands itself.
+Belay is a safety gate for coding agents: it inspects each shell command,
+subagent launch, and file mutation *before* it runs, lets safe-and-local actions
+through, and holds back only the irreversible-and-catastrophic ones for one-shot
+human approval. Every decision is written to an audit log.
+
+It runs on **Cursor**, **Claude Code**, and **Codex (experimental)**, wiring the
+same classifier into each agent through its native hooks:
+
+| Agent | Hook config |
+| --- | --- |
+| Cursor | `.cursor/hooks.json` |
+| Claude Code | `.claude/settings.json` |
+| Codex | `.codex/config.toml` |
+
+Enforcement lives in those hooks; this skill only explains the flow and routes
+you to the CLI. It does not classify commands itself.
 
 ## Prerequisites