@guilz-dev/belay 0.2.0 → 0.3.0

package/dist/cli.js

@@ -13,6 +13,7 @@ import { revokeApproval } from './commands/revoke.js';
 import { formatSimulateReport, simulateProject } from './commands/simulate.js';
 import { formatStatusReport, statusProject } from './commands/status.js';
 import { loadConfigFile } from './config-io.js';
+import { rejectDeprecatedJudgeModelAuto } from './core/judge-model-policy.js';
 import { initProject, upgradeProject } from './installer.js';
 import { egressEnv, egressStatus, formatEgressStatusReport, startEgressProxy, stopEgressProxy, } from './services/egress-service.js';
 import { formatSandboxStatusReport, sandboxStatus } from './services/sandbox-service.js';
@@ -64,6 +65,7 @@ function parseArgs(argv) {
             continue;
         }
         if (token === '--judge-profile') {
+            process.stderr.write('Warning: --judge-profile is deprecated; use belay config set judge.providerId <id> after init.\n');
             const next = rest[index + 1];
             if (!next || !['local-ollama', 'cursor', 'claude', 'codex'].includes(next)) {
                 throw new Error('--judge-profile requires local-ollama, cursor, claude, or codex.');
@@ -93,8 +95,9 @@ function parseArgs(argv) {
         if (token === '--judge-model') {
             const next = rest[index + 1];
             if (!next) {
-                throw new Error('--judge-model requires a model id or auto.');
+                throw new Error('--judge-model requires a model id.');
             }
+            rejectDeprecatedJudgeModelAuto(next);
             options.judgeModel = next;
             index += 1;
             continue;
@@ -103,6 +106,54 @@ function parseArgs(argv) {
             options.acceptCloudJudge = true;
             continue;
         }
+        if (token === '--migrate-judge-default') {
+            options.migrateJudgeDefault = true;
+            continue;
+        }
+        if (token === '--accept-cloud') {
+            options.acceptCloud = true;
+            continue;
+        }
+        if (token === '--cloud-consent-approval-id') {
+            const next = rest[index + 1];
+            if (!next) {
+                throw new Error('--cloud-consent-approval-id requires an approval id.');
+            }
+            options.cloudConsentApprovalId = next;
+            index += 1;
+            continue;
+        }
+        if (token === '--credential') {
+            const next = rest[index + 1];
+            if (!next || !['project', 'apiKey'].includes(next)) {
+                throw new Error('--credential requires project or apiKey.');
+            }
+            options.credentialMode = next;
+            index += 1;
+            continue;
+        }
+        if (token === '--key-stdin') {
+            options.keyStdin = true;
+            continue;
+        }
+        if (token === '--key-env') {
+            const next = rest[index + 1];
+            if (!next) {
+                throw new Error('--key-env requires an environment variable name.');
+            }
+            options.keyEnv = next;
+            index += 1;
+            continue;
+        }
+        if (token === '--timeout') {
+            const next = rest[index + 1];
+            if (!next) {
+                throw new Error('--timeout requires milliseconds.');
+            }
+            options.judgeTimeoutMs = Number(next);
+            index += 1;
+            continue;
+        }
         if (token === '--json') {
             options.json = true;
             continue;
@@ -316,6 +367,69 @@ function parseArgs(argv) {
             }
             throw new Error('sandbox requires subcommand: status');
         }
+        if (command === 'judge' && !options.judgeSubcommand) {
+            if (token === 'status' ||
+                token === 'list' ||
+                token === 'use' ||
+                token === 'test' ||
+                token === 'consent') {
+                options.judgeSubcommand = token;
+                continue;
+            }
+            throw new Error('judge requires subcommand: status, list, use, test, or consent');
+        }
+        if (command === 'config' && !options.configSubcommand) {
+            if (token === 'list' ||
+                token === 'get' ||
+                token === 'set' ||
+                token === 'unset' ||
+                token === 'credential' ||
+                token === 'judge') {
+                options.configSubcommand = token;
+                continue;
+            }
+            throw new Error('config requires subcommand: list, get, set, unset, credential, or judge');
+        }
+        if (command === 'config' &&
+            options.configSubcommand === 'credential' &&
+            !options.credentialAction) {
+            if (token === 'mode' || token === 'set' || token === 'clear') {
+                options.credentialAction = token;
+                continue;
+            }
+            throw new Error('config credential requires action: mode, set, or clear');
+        }
+        if (command === 'config' &&
+            options.configSubcommand === 'credential' &&
+            options.credentialAction === 'mode' &&
+            !options.credentialMode) {
+            if (token === 'project' || token === 'apiKey') {
+                options.credentialMode = token;
+                continue;
+            }
+            throw new Error('config credential mode requires project or apiKey');
+        }
+        if (command === 'config' &&
+            (options.configSubcommand === 'get' ||
+                options.configSubcommand === 'set' ||
+                options.configSubcommand === 'unset') &&
+            !options.configKey) {
+            options.configKey = token;
+            continue;
+        }
+        if (command === 'config' &&
+            options.configSubcommand === 'set' &&
+            options.configKey &&
+            !options.configValue) {
+            options.configValue = token;
+            continue;
+        }
+        if (command === 'judge' &&
+            (options.judgeSubcommand === 'use' || options.judgeSubcommand === 'consent') &&
+            !options.judgeUseProvider) {
+            options.judgeUseProvider = token;
+            continue;
+        }
         if ((command === 'revoke' || command === 'approve') && !options.approvalId) {
             options.approvalId = token;
             continue;
@@ -329,10 +443,18 @@ function printHelp() {
     process.stdout.write(`${c}
 
 Usage:
-  ${c} init [--target <dir>] [--adapter cursor|claude|codex] [--scope project|global] [--preset strict|standard|audit-first|l1-full-recommended] [--judge-profile local-ollama|cursor|claude|codex] [--judge-provider ollama|openai-compatible] [--judge-model <id|auto>] [--judge-endpoint <url>] [--accept-cloud-judge] [--with-skill] [--dogfood]
-  ${c} init-wizard [--target <dir>]
+  ${c} init [--target <dir>] [--adapter cursor|claude|codex] [--scope project|global] [--preset strict|standard|audit-first|l1-full-recommended] [--judge-profile local-ollama|cursor|claude|codex] [--judge-provider ollama|openai-compatible] [--judge-model <id>] [--judge-endpoint <url>] [--accept-cloud-judge] [--migrate-judge-default] [--with-skill] [--dogfood]
+  ${c} config [--target <dir>] [--json]
+  ${c} config list|get|set|unset|judge [--target <dir>] [--json]
+  ${c} config get <judge.path> [--target <dir>] [--json]
+  ${c} config set <judge.path> <value> [--target <dir>]
+  ${c} config unset <judge.path> [--target <dir>]
+  ${c} config credential mode <project|apiKey> [--target <dir>]
+  ${c} config credential set [--key-stdin] [--key-env <NAME>] [--target <dir>]
+  ${c} config credential clear [--target <dir>]
+  (--adapter selects host; fresh init picks matching judge providerId: cursor/claude/codex)
   (--dogfood runs after --preset and sets mode: audit, overriding preset enforce mode)
-  ${c} upgrade [--target <dir>] [--adapter cursor|claude|codex] [--scope project|global] [--with-skill]
+  ${c} upgrade [--target <dir>] [--adapter cursor|claude|codex] [--scope project|global] [--with-skill] [--migrate-judge-default]
   ${c} dogfood [--target <dir>] [--adapter cursor|claude|codex] [--enforce] [--force]
   ${c} doctor [--target <dir>] [--adapter cursor|claude|codex] [--json] [--fix] [--dry-run]
   ${c} metrics [--target <dir>] [--json]
@@ -345,6 +467,9 @@ Usage:
   ${c} explain [--target <dir>] [--cwd <dir>] [--kind shell|tool|subagent] [--tool <name>] [--payload-json <json>] [--command <text>] [--json] [-- <command>]
   ${c} egress <start|stop|status|env> [--target <dir>] [--json]
   ${c} sandbox status [--target <dir>] [--json]
+  ${c} judge <status|list|use|test|consent> [--target <dir>] [--json]
+  ${c} judge use <ollama|codex|claude|cursor> [--model <id>] [--endpoint <url>] [--timeout <ms>] [--accept-cloud] [--cloud-consent-approval-id <id>] [--credential project|apiKey] [--key-stdin] [--key-env <NAME>]
+  ${c} judge consent <ollama|codex|claude|cursor> [--endpoint <url>]
   ${c} approve <approval-id> [--scope once|domain|path] [--path <path>] [--token <signed-token>] [--target <dir>]
   ${c} revoke <approval-id> [--target <dir>]
 `);
@@ -360,10 +485,10 @@ async function main() {
             process.stdout.write(`${PACKAGE_VERSION}\n`);
             return;
         }
-        if (command === 'init-wizard') {
-            const { runInitWizard } = await import('./commands/init-wizard.js');
-            const result = await runInitWizard({ targetDir: options.targetDir });
-            process.stdout.write(`Initialized belay in ${result.repoRoot}${result.withSkill ? ' (with skill)' : ''}.\n`);
+        const DEPRECATED_COMMANDS = new Set(['init-wizard']);
+        if (DEPRECATED_COMMANDS.has(command)) {
+            process.stderr.write(`${command} is removed. Use \`belay config\` for interactive setup, or \`belay init\` for non-interactive install.\n`);
+            process.exitCode = 1;
             return;
         }
         if (command === 'init') {
@@ -379,6 +504,7 @@ async function main() {
                 judgeModel: options.judgeModel,
                 judgeEndpoint: options.judgeEndpoint,
                 acceptCloudJudge: options.acceptCloudJudge,
+                migrateJudgeDefault: options.migrateJudgeDefault,
             });
             const extras = [
                 `adapter=${result.adapter}`,
@@ -405,6 +531,7 @@ async function main() {
                 withSkill: options.withSkill,
                 adapter: options.adapter,
                 scope: options.installScope,
+                migrateJudgeDefault: options.migrateJudgeDefault,
             });
             const upgraded = await loadConfigFile(result.repoRoot, result.adapter);
             if (upgraded.policy.modelAssist.enabled) {
@@ -413,6 +540,69 @@ async function main() {
             process.stdout.write(`Upgraded belay (${result.adapter}) in ${result.repoRoot}.\n`);
             return;
         }
+        if (command === 'judge') {
+            const { runJudgeCommand } = await import('./commands/judge.js');
+            if (!options.judgeSubcommand) {
+                throw new Error('judge requires subcommand: status, list, use, or test');
+            }
+            const result = await runJudgeCommand({
+                targetDir: options.targetDir,
+                json: options.json,
+                subcommand: options.judgeSubcommand,
+                providerId: options.judgeUseProvider,
+                model: options.judgeModel,
+                endpoint: options.judgeEndpoint,
+                timeoutMs: options.judgeTimeoutMs,
+                acceptCloud: options.acceptCloud,
+                cloudConsentApprovalId: options.cloudConsentApprovalId,
+                credentialMode: options.credentialMode,
+                keyStdin: options.keyStdin,
+                keyEnv: options.keyEnv,
+            });
+            if (options.json && typeof result === 'object') {
+                process.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
+            }
+            else {
+                process.stdout.write(`${String(result)}\n`);
+            }
+            return;
+        }
+        if (command === 'config') {
+            if (options.configSubcommand === 'credential') {
+                if (!options.credentialAction) {
+                    throw new Error('config credential requires action: mode, set, or clear');
+                }
+                const { runBelayConfigCredential } = await import('./commands/config.js');
+                const result = await runBelayConfigCredential({
+                    targetDir: options.targetDir,
+                    action: options.credentialAction,
+                    mode: options.credentialMode,
+                    keyStdin: options.keyStdin,
+                    keyEnv: options.keyEnv,
+                });
+                process.stdout.write(`${String(result)}\n`);
+                return;
+            }
+            const { runBelayConfig } = await import('./commands/config.js');
+            const result = await runBelayConfig({
+                targetDir: options.targetDir,
+                subcommand: options.configSubcommand,
+                path: options.configKey,
+                value: options.configValue,
+                json: options.json,
+            });
+            if (options.json && typeof result === 'object') {
+                process.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
+            }
+            else if (typeof result === 'object' && result && 'repoRoot' in result) {
+                const initResult = result;
+                process.stdout.write(`Initialized belay in ${initResult.repoRoot}${initResult.withSkill ? ' (with skill)' : ''}.\n`);
+            }
+            else {
+                process.stdout.write(`${String(result)}\n`);
+            }
+            return;
+        }
         if (command === 'doctor') {
             const report = await doctorProject({
                 targetDir: options.targetDir,

package/dist/commands/approve.js

@@ -1,6 +1,7 @@
 import path from 'node:path';
 import { approvedApprovalsPath, loadApprovalState, loadConfigFile, pendingApprovalsPath, saveApprovalState, } from '../config-io.js';
 import { recordApproval } from '../core/approval-service.js';
+import { JUDGE_CLOUD_CONSENT_REASON } from '../core/capability/reasons.js';
 import { recordCapabilityApproval } from '../core/capability-approval.js';
 import { recordEgressApproval } from '../core/egress-approval.js';
 import { createEgressApprovalStore } from '../services/egress-service.js';
@@ -10,6 +11,16 @@ export async function approvePending(options) {
     const config = await loadConfigFile(repoRoot);
     const pending = await loadApprovalState(repoRoot, 'pending-approvals.json', config);
     const match = pending.approvals.find((approval) => approval.approvalId === options.approvalId);
+    if (match?.reason === JUDGE_CLOUD_CONSENT_REASON) {
+        const result = await recordCapabilityApproval({
+            approvalId: options.approvalId,
+            config,
+            token: options.token,
+            requireSignedToken: config.approvalSigning.required,
+            store: createCapabilityApprovalStore(repoRoot, config),
+        });
+        return { ok: result.ok, message: result.message };
+    }
     if (match?.kind === 'egress') {
         const result = await recordEgressApproval({
             approvalId: options.approvalId,

package/dist/commands/config.d.ts

@@ -0,0 +1,70 @@
+import { type JudgeProviderId } from '../core/verdict/judge-catalog.js';
+import type { AdapterName, InitOptions } from '../types.js';
+export declare const BELAY_CONFIG_SUBCOMMANDS: readonly ["list", "get", "set", "unset", "credential", "judge"];
+export type BelayConfigSubcommand = (typeof BELAY_CONFIG_SUBCOMMANDS)[number];
+export interface BelayConfigOptions {
+    targetDir?: string;
+    subcommand?: BelayConfigSubcommand;
+    path?: string;
+    value?: string;
+    json?: boolean;
+}
+export interface BelayConfigCredentialOptions {
+    targetDir?: string;
+    action: 'mode' | 'set' | 'clear';
+    mode?: 'project' | 'apiKey';
+    keyStdin?: boolean;
+    keyEnv?: string;
+}
+export interface ConfigWizardAnswers {
+    adapter: AdapterName;
+    scope: 'project' | 'global';
+    withSkill: boolean;
+    judgeProviderId: JudgeProviderId;
+    judgeCredentialMode?: 'project' | 'apiKey';
+    judgeEndpoint?: string;
+    acceptCloud: boolean;
+    dogfood: boolean;
+}
+export declare function parseAdapter(value: string | undefined): AdapterName;
+export declare function parseScope(value: string | undefined): 'project' | 'global';
+export declare function parseYesNo(value: string | undefined, defaultValue: boolean): boolean;
+export declare function parseJudgeProviderId(value: string | undefined, defaultId: JudgeProviderId | string): JudgeProviderId;
+export declare function buildInitOptionsFromConfigAnswers(answers: ConfigWizardAnswers, targetDir?: string): InitOptions;
+export declare function runBelayConfigCredential(options: BelayConfigCredentialOptions): Promise<string>;
+export interface BelayConfigInteractiveOptions {
+    targetDir?: string;
+    /** @internal test helper — canned readline answers in order */
+    prompts?: string[];
+    /** Suppress the interactive header when nested under runBelayConfigInteractive */
+    skipBanner?: boolean;
+}
+export declare function resolveBelayConfigInteractiveMode(repoRoot: string): Promise<'full' | 'judge-only'>;
+export declare function runBelayConfigFullInteractive(options?: BelayConfigInteractiveOptions): Promise<{
+    repoRoot: string;
+    withSkill: boolean;
+    dogfood: boolean;
+    adapter: AdapterName;
+}>;
+export declare function runBelayConfigJudgeOnlyInteractive(options?: BelayConfigInteractiveOptions): Promise<{
+    repoRoot: string;
+    adapter: AdapterName;
+}>;
+export declare function runBelayConfigInteractive(options?: BelayConfigInteractiveOptions): Promise<{
+    repoRoot: string;
+    adapter: AdapterName;
+}>;
+export declare function runBelayConfig(options?: BelayConfigOptions): Promise<string | Record<string, unknown> | {
+    providerId: import("../core/config.js").JudgeProviderId | import("../core/config.js").DeprecatedJudgeProviderId | undefined;
+    provider: import("../core/config.js").JudgeProvider;
+    endpoint: string | null;
+    model: string;
+    modelResolved: string;
+    transport: import("../core/verdict/judge.js").Tier1JudgeTransport;
+    credential: import("../core/judge-api-key.js").ResolvedJudgeCredential;
+    cloudConsent: import("../core/config.js").JudgeCloudConsent | null;
+    cloudJudgeActive: boolean;
+} | {
+    repoRoot: string;
+    adapter: AdapterName;
+}>;