@guilz-dev/belay 0.10.0 → 0.10.1

package/dist/adapters/claude/runtime-entry.js

@@ -209,25 +209,12 @@ export async function runToolGateHook(_eventName) {
             return;
         }
         if (!mappedKind) {
-            const verdict = claudeFallbackToolVerdict({
-                toolName,
-                payload,
-                repoRoot: ctx.repoRoot,
-                reason: 'unmapped_tool',
-                mode: ctx.config.mode,
-                userMessage: 'belay does not recognize this tool action. Run belay doctor, then retry.',
-                agentMessage: 'Belay denied this action because the tool could not be normalized.',
-            });
-            await deps.appendAudit(ctx, {
-                event: 'preToolUse',
+            const verdict = await evaluateGatedAction(ctx, deps, {
                 kind: 'tool',
-                verdict: 'deny_pending_approval',
-                reason: 'unmapped_tool',
-                mode: ctx.config.mode,
-                wouldBlock: true,
-                permission: 'deny',
-                summary: toolName,
-                ...effectPlanAuditFields(verdict.effectPlan),
+                cwd,
+                payload,
+                toolName,
+                sourceEvent: 'PreToolUse',
             });
             jsonResponse(gateVerdictToClaudePreToolUseResponse(verdict));
             return;

package/dist/adapters/codex/runtime-entry.js

@@ -1,7 +1,7 @@
 import path from 'node:path';
 import process from 'node:process';
 import { codexLayout } from '../layouts/codex.js';
-import { appendObservedAudit, createDefaultGateRuntimeDeps, evaluateGatedAction, gateUnmappedToolVerdict, gateVerdictToCodexPreToolUseResponse, gateVerdictToCodexUserPromptResponse, processApprovalPrompt, resolveGateConfig, } from '../shared/gate-runtime.js';
+import { appendObservedAudit, createDefaultGateRuntimeDeps, evaluateGatedAction, gateVerdictToCodexPreToolUseResponse, gateVerdictToCodexUserPromptResponse, processApprovalPrompt, resolveGateConfig, } from '../shared/gate-runtime.js';
 import { findRepoRoot } from '../shared/repo-root.js';
 async function readStdinJson() {
     const chunks = [];
@@ -169,7 +169,7 @@ export async function runBeforeSubmitPromptHook() {
 }
 // Codex routes all PreToolUse through this unified handler (matcher ".*"), since the exact
 // shell tool name is not yet confirmed. SubagentStart is also routed to this handler.
-// Unmapped tools/events ask with pending approval (R39) to avoid silent bypass without hard block.
+// Unmapped tools use the shared effect-based classifier (no tool-name denylist).
 export async function runToolGateHook(eventName) {
     try {
         const payload = await readStdinJson();
@@ -180,15 +180,14 @@ export async function runToolGateHook(eventName) {
         const ctx = await loadRuntimeContext(cwd);
         const deps = createDefaultGateRuntimeDeps();
         if (!kind) {
-            // Unmapped Codex tool. Policy-driven: default 'deny' asks with pending approval (R39).
-            // 'allow' is the opt-out — pass the tool but record it to audit for vocabulary learning.
-            const policy = ctx.config.policy?.codexUnmappedTool ?? 'deny';
-            if (policy === 'allow') {
-                await appendObservedAudit(ctx, deps, eventName, payload);
-                jsonResponse({});
-                return;
-            }
-            const verdict = await gateUnmappedToolVerdict(ctx, deps, toolName, payload);
+            const normalizedPayload = normalizeCodexToolPayload('tool', payload);
+            const verdict = await evaluateGatedAction(ctx, deps, {
+                kind: 'tool',
+                cwd,
+                payload: normalizedPayload,
+                toolName,
+                sourceEvent: eventName,
+            });
             jsonResponse(gateVerdictToCodexPreToolUseResponse(verdict));
             return;
         }

package/dist/adapters/cursor/hook-router.d.ts

@@ -14,6 +14,7 @@ export type CursorHookRoute = {
     decision: 'fail_closed';
     message: string;
 };
+export declare const CURSOR_GLOBAL_SENTINEL_BLOCK_MESSAGE = "belay project hook owner is unavailable; the global sentinel blocked this action.";
 export interface RouteCursorHookParams {
     origin: CursorHookOrigin;
     kind: CursorHookKind;

package/dist/adapters/cursor/hook-router.js

@@ -3,6 +3,7 @@ import path from 'node:path';
 import { resolveCursorActionCwdDetails } from './cwd-resolution.js';
 import { isTrustedCursorRoutingConfig } from './routing-config-trust.js';
 import { cursorRoutingConfigPath, cursorRoutingHooksDir, cursorRoutingHooksSettingsPath, cursorRoutingRuntimeDir, findCursorRoutingRepoRoot, } from './routing-layout.js';
+export const CURSOR_GLOBAL_SENTINEL_BLOCK_MESSAGE = 'belay project hook owner is unavailable; the global sentinel blocked this action.';
 function canonicalExistingPath(value) {
     if (!existsSync(value)) {
         return undefined;
@@ -162,6 +163,11 @@ function hasMatchingProjectShim(repoRoot, kind) {
     return (source.includes("from '../belay/runtime/dispatcher.mjs'") &&
         source.includes(`origin: ${JSON.stringify({ scope: 'project', repoRoot })}`));
 }
+function hasProjectOwnerInstallation(repoRoot) {
+    const hooksDir = cursorRoutingHooksDir(repoRoot);
+    return Boolean(selectedRunnerPath(hooksDir) &&
+        isRegularFile(path.join(cursorRoutingRuntimeDir(repoRoot), 'dispatcher.mjs')));
+}
 function hasCallableProjectOwner(repoRoot, params) {
     const hooksDir = cursorRoutingHooksDir(repoRoot);
     const runnerPath = selectedRunnerPath(hooksDir);
@@ -205,6 +211,10 @@ function selectedActionPath(payload) {
     }
     return undefined;
 }
+function hasRoutingRootMarker(dir) {
+    return (existsSync(path.join(dir, '.git')) ||
+        (existsSync(path.join(dir, '.cursor')) && existsSync(cursorRoutingConfigPath(dir))));
+}
 function readInstallScope(repoRoot) {
     const configPath = cursorRoutingConfigPath(repoRoot);
     let source;
@@ -220,7 +230,13 @@ function readInstallScope(repoRoot) {
             typeof parsed === 'object' &&
             !Array.isArray(parsed) &&
             parsed.installScope === 'global') {
-            return isTrustedCursorRoutingConfig(repoRoot, parsed) ? 'global' : 'project';
+            if (isTrustedCursorRoutingConfig(repoRoot, parsed)) {
+                return 'global';
+            }
+            // Untrusted global scope still routes through the global owner when no project
+            // installation exists. Otherwise a global-only workspace is blocked by the sentinel
+            // even though ADR-008 assigns ownership to the User/global installation.
+            return hasProjectOwnerInstallation(repoRoot) ? 'project' : 'global';
         }
     }
     catch {
@@ -240,10 +256,17 @@ export function routeCursorHook(params) {
     if (!canonicalCwd) {
         return { decision: 'fail_closed', message: 'belay could not determine the workspace.' };
     }
-    const repoRoot = canonicalExistingPath(findCursorRoutingRepoRoot(canonicalCwd));
+    const discoveredRepoRoot = findCursorRoutingRepoRoot(canonicalCwd);
+    const repoRoot = canonicalExistingPath(discoveredRepoRoot);
     if (!repoRoot) {
         return { decision: 'neutral' };
     }
+    // If repository discovery fell back to the action directory without finding a marker,
+    // keep the global source neutral instead of treating an unreadable/non-repo directory
+    // as a broken project owner.
+    if (repoRoot === canonicalCwd && !hasRoutingRootMarker(repoRoot)) {
+        return { decision: 'neutral' };
+    }
     const installScope = readInstallScope(repoRoot);
     if (installScope === 'missing') {
         return { decision: 'neutral' };
@@ -263,7 +286,7 @@ export function routeCursorHook(params) {
             ? { decision: 'neutral' }
             : {
                 decision: 'fail_closed',
-                message: 'belay project hook owner is unavailable; the global sentinel blocked this action.',
+                message: `${CURSOR_GLOBAL_SENTINEL_BLOCK_MESSAGE} Run belay doctor from this repository to diagnose hook routing.`,
             };
     }
     const complete = callableProjectOwner && isRegularFile(path.join(cursorRoutingRuntimeDir(repoRoot), 'core.mjs'));

package/dist/adapters/cursor/hook-routing-health.d.ts

@@ -0,0 +1 @@
+export declare function cursorHookRoutingIssues(repoRoot: string): string[];

package/dist/adapters/cursor/hook-routing-health.js

@@ -0,0 +1,53 @@
+import { existsSync, readFileSync, realpathSync } from 'node:fs';
+import { CURSOR_GLOBAL_SENTINEL_BLOCK_MESSAGE, routeCursorHook, } from './hook-router.js';
+import { cursorRoutingConfigPath } from './routing-layout.js';
+const SENTINEL_KINDS = ['before-submit', 'shell-gate'];
+function canonicalRepoRoot(repoRoot) {
+    try {
+        return realpathSync(repoRoot);
+    }
+    catch {
+        return repoRoot;
+    }
+}
+function configuredInstallScope(repoRoot) {
+    let parsed;
+    try {
+        parsed = JSON.parse(readFileSync(cursorRoutingConfigPath(repoRoot), 'utf8'));
+    }
+    catch {
+        return undefined;
+    }
+    if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed)) {
+        return undefined;
+    }
+    return parsed.installScope === 'global' ? 'global' : 'project';
+}
+function upgradeCommand(repoRoot, installScope) {
+    return `belay upgrade --scope ${installScope} --target ${JSON.stringify(repoRoot)}`;
+}
+export function cursorHookRoutingIssues(repoRoot) {
+    if (!existsSync(cursorRoutingConfigPath(repoRoot))) {
+        return [];
+    }
+    const canonicalRoot = canonicalRepoRoot(repoRoot);
+    const payload = { cwd: canonicalRoot, workspace_roots: [canonicalRoot] };
+    const installScope = configuredInstallScope(repoRoot) ?? 'project';
+    const issues = [];
+    for (const kind of SENTINEL_KINDS) {
+        const route = routeCursorHook({
+            origin: { scope: 'global' },
+            kind,
+            payload,
+        });
+        if (route.decision !== 'fail_closed') {
+            continue;
+        }
+        if (route.message.includes(CURSOR_GLOBAL_SENTINEL_BLOCK_MESSAGE)) {
+            issues.push(`Global Cursor sentinel would block ${kind} in this workspace. Run ${upgradeCommand(repoRoot, installScope)}; if the config was edited manually, also run belay config trust --target ${JSON.stringify(repoRoot)}.`);
+            continue;
+        }
+        issues.push(`Global Cursor sentinel would block ${kind}: ${route.message}`);
+    }
+    return issues;
+}

package/dist/adapters/shared/gate-runtime.d.ts

@@ -48,8 +48,6 @@ export declare function evaluateGatedAction(ctx: GateRuntimeContext, deps: GateR
     toolName?: string;
     sourceEvent?: string;
 }): Promise<GateVerdict>;
-/** R39: unmapped Codex tools ask via pending approval — not hard deny without approval path. */
-export declare function gateUnmappedToolVerdict(ctx: GateRuntimeContext, deps: GateRuntimeDeps, toolName: string, payload: Record<string, unknown>): Promise<GateVerdict>;
 export declare function processApprovalPrompt(ctx: GateRuntimeContext, deps: GateRuntimeDeps, prompt: string): Promise<ApprovalPromptResult>;
 export declare function gateVerdictToCursorResponse(verdict: GateVerdict): GatePermissionResponse;
 export declare function gateVerdictToClaudePreToolUseResponse(verdict: GateVerdict): Record<string, unknown>;

package/dist/adapters/shared/gate-runtime.js

@@ -30,7 +30,7 @@ import { effectPlanAuditFields, hashEffectPlan } from '../../core/effect-ir/audi
 import { buildCapabilityEffectPlan } from '../../core/effect-ir/build.js';
 import { classifyResultToGateVerdict, unnormalizedGateVerdict, } from '../../core/gate-contract.js';
 import { classifyGatedActionAsync, extractAgentAssessment, GateNormalizationError, gateEnabledForAction, normalizeGatedAction, } from '../../core/gate-engine.js';
-import { approvalCommandMatch, approvedApprovalsFile, belayStateDir, canonicalStringify, classifierOptionsFromConfig, configuredControlPlaneDir, hashValue, pendingApprovalsFile, resolveControlPlaneDir, scrubOptionsFromConfig, scrubString, scrubValue, toolFingerprint, } from '../../core/index.js';
+import { approvalCommandMatch, approvedApprovalsFile, belayStateDir, canonicalStringify, classifierOptionsFromConfig, configuredControlPlaneDir, hashValue, pendingApprovalsFile, resolveControlPlaneDir, scrubOptionsFromConfig, scrubString, scrubValue, } from '../../core/index.js';
 import { extractJudgeFallbackReason, formatJudgeInfrastructureDenyMessage, inferProviderIdFromFallbackReason, isJudgeInfrastructureFailure, } from '../../core/judge-fallback-hints.js';
 import { notifyDeny } from '../../core/notify.js';
 import { canonicalPath } from '../../core/path-utils.js';
@@ -684,23 +684,7 @@ export async function evaluateGatedAction(ctx, deps, params) {
         ...authorization,
         egressProxyActive,
     };
-    let predicted = await classifyGatedActionAsync(action, ctx.config, enrichedClassifierOptions);
-    if (action.kind === 'tool' &&
-        predicted.reason === 'unclassified_tool' &&
-        (ctx.config.policy.codexUnmappedTool ?? 'deny') === 'deny') {
-        predicted = {
-            ...predicted,
-            verdict: 'deny_pending_approval',
-            reason: 'unmapped_tool',
-            assessment: {
-                reversibility: 'irreversible',
-                external: false,
-                blastRadius: 'unknown tool action',
-                confidence: 0.5,
-                signals: ['unmapped_tool'],
-            },
-        };
-    }
+    const predicted = await classifyGatedActionAsync(action, ctx.config, enrichedClassifierOptions);
     if (action.kind === 'shell' &&
         action.command &&
         isContainedUnknownExecutionEligible(ctx.config, action, predicted)) {
@@ -842,41 +826,6 @@ export async function evaluateGatedAction(ctx, deps, params) {
         scopeHintPayload: params.payload,
     });
 }
-/** R39: unmapped Codex tools ask via pending approval — not hard deny without approval path. */
-export async function gateUnmappedToolVerdict(ctx, deps, toolName, payload) {
-    const scrubOpts = scrubOptionsFromConfig(ctx.config);
-    const replayPayload = fingerprintReplayPayload('tool', payload, scrubOpts) ?? {};
-    const result = {
-        verdict: 'deny_pending_approval',
-        reason: 'unmapped_tool',
-        summary: toolName,
-        fingerprint: toolFingerprint(toolName, replayPayload, ctx.repoRoot),
-        assessment: {
-            reversibility: 'irreversible',
-            external: false,
-            blastRadius: 'unknown Codex tool action',
-            confidence: 0.5,
-            signals: ['unmapped_tool'],
-        },
-    };
-    return gateDecisionToVerdict(ctx, deps, 'tool', result, {
-        approvalInput: {
-            input: toolName,
-            inputKind: 'tool',
-            cwd: ctx.repoRoot,
-            toolName,
-            payload: replayPayload,
-        },
-        replayAction: {
-            kind: 'tool',
-            cwd: ctx.repoRoot,
-            toolName,
-            payload: replayPayload,
-            fingerprint: result.fingerprint,
-            repoRoot: ctx.repoRoot,
-        },
-    });
-}
 async function consumeCapabilityGrantIfUsed(ctx, deps, result) {
     if (result.reason !== 'capability_grant' &&
         result.authorizationDecision?.matchedRule !== 'grant.exact') {