@guilz-dev/belay 0.2.0 → 0.4.0

package/dist/core/classify-tool.js

@@ -1,9 +1,11 @@
 import path from 'node:path';
 import { canonicalStringify, toolFingerprint } from './fingerprint.js';
 import { matchesSensitivePath } from './glob.js';
-import { pathWithinRoot, relativeWithinRepo } from './path-utils.js';
+import { pathWithinRoot, resolveWorkspaceRootMatch } from './path-utils.js';
 import { scrubValue } from './scrub.js';
-import { classifyShell } from './verdict/adapter.js';
+import { classifyShell, resolveClassifierTrustedCwd } from './verdict/adapter.js';
+import { mutationPrescanRequiresAsk, tier1RequiresAsk } from './verdict/judge.js';
+import { createJudgeFromConfig } from './verdict/judge-factory.js';
 const DEFAULT_SENSITIVE_PATHS = ['.env', '.env.*', '**/credentials/**'];
 const FILE_WRITE_TOOL_NAMES = new Set(['write']);
 const FILE_EDIT_TOOL_NAMES = new Set([
@@ -74,6 +76,75 @@ function applyPatchTargets(patch) {
 function normalizedToolName(toolName) {
     return toolName.trim().toLowerCase();
 }
+function resolveFileTier1Judge(config, options, repoRoot) {
+    return options.tier1Judge ?? createJudgeFromConfig(config, { repoRoot });
+}
+async function classifyFileMutationWithTier1(params) {
+    const judge = resolveFileTier1Judge(params.config, params.options, params.repoRoot);
+    const trustedCwd = resolveClassifierTrustedCwd(params.cwd, params.options);
+    const prescan = mutationPrescanRequiresAsk({
+        targets: [params.filePath],
+        cwd: params.cwd,
+        repoRoot: params.repoRoot,
+        trustedCwd,
+        trustedWorkspaceRoots: params.options.trustedWorkspaceRoots,
+        sensitivePaths: params.options.sensitivePaths ?? params.config.classifier.sensitivePaths,
+    });
+    if (prescan) {
+        return {
+            verdict: 'deny_pending_approval',
+            reason: 'tier1_catastrophic',
+            summary: params.filePath,
+            fingerprint: toolFingerprint(params.toolName, { path: params.filePath }, params.repoRoot),
+            assessment: {
+                reversibility: 'irreversible',
+                external: params.locationLabel === 'outside_repo',
+                blastRadius: params.locationLabel === 'outside_repo'
+                    ? 'outside the repository'
+                    : 'sensitive repository file',
+                confidence: 0.95,
+                signals: [...params.signals, 'tier1_catastrophic', prescan.reason],
+            },
+        };
+    }
+    const tier1Text = `file_mutation: ${params.toolKind} path=${params.resolvedPath} location=${params.locationLabel}`;
+    const tier1 = await judge.evaluate({
+        text: tier1Text,
+        context: { cwd: params.cwd, repoRoot: params.repoRoot },
+    });
+    const fingerprint = toolFingerprint(params.toolName, { path: params.filePath }, params.repoRoot);
+    if (tier1RequiresAsk(tier1)) {
+        return {
+            verdict: 'deny_pending_approval',
+            reason: 'tier1_catastrophic',
+            summary: params.filePath,
+            fingerprint,
+            assessment: {
+                reversibility: 'irreversible',
+                external: params.locationLabel === 'outside_repo',
+                blastRadius: params.locationLabel === 'outside_repo'
+                    ? 'outside the repository'
+                    : 'sensitive repository file',
+                confidence: 0.82,
+                signals: [...params.signals, 'tier1_catastrophic', tier1.reason],
+            },
+        };
+    }
+    const reason = params.isDelete ? 'file_delete' : 'file_mutation';
+    return {
+        verdict: 'allow_flagged',
+        reason,
+        summary: params.filePath,
+        fingerprint,
+        assessment: {
+            reversibility: 'recoverable_with_cost',
+            external: params.locationLabel === 'outside_repo',
+            blastRadius: params.locationLabel === 'outside_repo' ? 'outside the repository' : 'this repository',
+            confidence: 0.72,
+            signals: [...params.signals, 'tier1_restorable', tier1.reason],
+        },
+    };
+}
 export async function classifyToolUse(payload, repoRoot, cwd, config, options = {}) {
     const toolName = String(payload.tool_name ?? '');
     const toolKind = normalizedToolName(toolName);
@@ -173,38 +244,66 @@ export async function classifyToolUse(payload, repoRoot, cwd, config, options =
                 },
             };
         }
-        const relativePath = relativeWithinRepo(repoRoot, resolvedPath);
-        if (relativePath === null) {
+        const workspaceMatch = resolveWorkspaceRootMatch(repoRoot, options.trustedWorkspaceRoots, resolvedPath);
+        if (workspaceMatch === null) {
             signals.push('outside_repo_path');
-            return {
-                verdict: 'deny_pending_approval',
-                reason: 'outside_repo_file_mutation',
-                summary: filePath,
-                fingerprint: toolFingerprint(toolName, { path: filePath }, repoRoot),
-                assessment: {
-                    reversibility: 'irreversible',
-                    external: true,
-                    blastRadius: 'outside the repository',
-                    confidence: 0.9,
-                    signals,
-                },
-            };
+            return classifyFileMutationWithTier1({
+                toolName,
+                toolKind,
+                filePath,
+                resolvedPath,
+                repoRoot,
+                cwd,
+                config,
+                options,
+                signals,
+                isDelete: FILE_DELETE_TOOL_NAMES.has(toolKind),
+                locationLabel: 'outside_repo',
+            });
+        }
+        if (workspaceMatch.kind === 'trusted') {
+            signals.push('trusted_workspace_root');
         }
+        const trustedCwd = resolveClassifierTrustedCwd(cwd, options);
+        const workspacePrescan = mutationPrescanRequiresAsk({
+            targets: [filePath],
+            cwd,
+            repoRoot,
+            trustedCwd,
+            trustedWorkspaceRoots: options.trustedWorkspaceRoots,
+            sensitivePaths,
+        });
+        if (workspacePrescan) {
+            return classifyFileMutationWithTier1({
+                toolName,
+                toolKind,
+                filePath,
+                resolvedPath,
+                repoRoot,
+                cwd,
+                config,
+                options,
+                signals,
+                isDelete: FILE_DELETE_TOOL_NAMES.has(toolKind),
+                locationLabel: 'sensitive_path',
+            });
+        }
+        const relativePath = workspaceMatch.relativePath;
         if (matchesSensitivePath(relativePath, sensitivePaths)) {
             signals.push('sensitive_path');
-            return {
-                verdict: 'deny_pending_approval',
-                reason: 'sensitive_file_mutation',
-                summary: filePath,
-                fingerprint: toolFingerprint(toolName, { path: filePath }, repoRoot),
-                assessment: {
-                    reversibility: 'irreversible',
-                    external: false,
-                    blastRadius: 'sensitive repository file',
-                    confidence: 0.88,
-                    signals,
-                },
-            };
+            return classifyFileMutationWithTier1({
+                toolName,
+                toolKind,
+                filePath,
+                resolvedPath,
+                repoRoot,
+                cwd,
+                config,
+                options,
+                signals,
+                isDelete: FILE_DELETE_TOOL_NAMES.has(toolKind),
+                locationLabel: 'sensitive_path',
+            });
         }
         if (FILE_DELETE_TOOL_NAMES.has(toolKind)) {
             signals.push('file_delete');

package/dist/core/config-layers.js

@@ -1,6 +1,6 @@
 import path from 'node:path';
 import { applyConfigPreset } from '../presets.js';
-import { DEFAULT_CONFIG_V3, mergeConfig } from './config.js';
+import { DEFAULT_CONFIG_V3, mergeConfig, rejectTeamLayerJudgeSecrets } from './config.js';
 export function teamConfigPath(homedir = () => process.env.HOME ?? process.env.USERPROFILE ?? '') {
     const xdg = process.env.XDG_CONFIG_HOME?.trim();
     const base = xdg || path.join(homedir(), '.config');
@@ -40,6 +40,7 @@ export function resolveLayeredConfig(params) {
         const teamRaw = teamFile.preset
             ? applyConfigPreset(teamFile.preset, teamFile.config ?? {})
             : (teamFile.config ?? params.teamConfig);
+        rejectTeamLayerJudgeSecrets(teamRaw.judge, 'team');
         config = mergeConfigLayer(config, asV3Layer(teamRaw));
         provenance.push({
             path: params.teamConfigPath ?? teamConfigPath(),

package/dist/core/config.d.ts

@@ -1,4 +1,5 @@
 import type { ClassifierOptions, ControlPlaneIntegrity, ScrubOptions, UnknownLocalEffectPolicy, UnparseableShellPolicy } from './types.js';
+import { type BelayJudgeRuntimeConfig } from './verdict/judge-runtime-config.js';
 export type BelayMode = 'enforce' | 'audit';
 export type { UnknownLocalEffectPolicy };
 export interface BelayConfigV1 {
@@ -76,13 +77,33 @@ export interface BelayRedactionConfig {
     maskKeyValueSecrets: boolean;
     maskHighEntropyStrings: boolean;
 }
-export type JudgeProvider = 'ollama' | 'openai-compatible';
+export type JudgeProvider = 'ollama' | 'openai-compatible' | 'anthropic';
+export type JudgeProviderId = 'ollama' | 'codex' | 'claude' | 'cursor';
+/** Read-only legacy ids; preserved on load with warning until `belay config` migrates. */
+export type DeprecatedJudgeProviderId = 'openrouter' | 'custom';
+export type JudgeCredentialMode = 'project' | 'apiKey';
+export type JudgeCredentialRef = `store:judge` | `env:${string}`;
+export interface JudgeCredentialConfig {
+    mode: JudgeCredentialMode;
+    ref?: JudgeCredentialRef;
+}
+export interface JudgeCloudConsent {
+    accepted: boolean;
+    at: string;
+    providerId: JudgeProviderId;
+    endpoint: string;
+    by: string;
+}
 export interface BelayJudgeConfig {
     provider: JudgeProvider;
+    providerId?: JudgeProviderId | DeprecatedJudgeProviderId;
     model: string;
     timeoutMs: number;
     endpoint: string | null;
     keepAlive: string | null;
+    cloudConsent?: JudgeCloudConsent;
+    credential?: JudgeCredentialConfig;
+    runtime?: BelayJudgeRuntimeConfig;
 }
 export declare const DEFAULT_JUDGE_LOCAL_OLLAMA: BelayJudgeConfig;
 export declare const DEFAULT_JUDGE_OPENAI_COMPATIBLE_TEMPLATE: BelayJudgeConfig;
@@ -118,6 +139,17 @@ export interface BelayApprovalSigningConfig {
     /** When true, out-of-band approvals must present a signed token. */
     required: boolean;
 }
+export type ApprovalFlow = 'one_step' | 'two_step';
+export interface BelayApprovalAutoReplayScopes {
+    shell: boolean;
+    tool: boolean;
+    subagent: boolean;
+}
+export interface BelayApprovalConfig {
+    flow: ApprovalFlow;
+    autoReplayScopes: BelayApprovalAutoReplayScopes;
+    executionLeaseMs: number;
+}
 export interface BelayEgressConfig {
     enabled: boolean;
     listenHost: string;
@@ -141,6 +173,7 @@ export interface BelayConfigV4 {
     controlPlane: BelayControlPlaneConfig;
     notifications: BelayNotificationsConfig;
     approvalSigning: BelayApprovalSigningConfig;
+    approval: BelayApprovalConfig;
     egress: BelayEgressConfig;
     sandbox: BelaySandboxConfig;
     audit: BelayConfigV2['audit'];
@@ -165,6 +198,7 @@ export declare const DEFAULT_CONTROL_PLANE_V3: BelayControlPlaneConfig;
 export declare const DEFAULT_SANDBOX_V3: BelaySandboxConfig;
 export declare const DEFAULT_NOTIFICATIONS_V3: BelayNotificationsConfig;
 export declare const DEFAULT_APPROVAL_SIGNING_V3: BelayApprovalSigningConfig;
+export declare const DEFAULT_APPROVAL_CONFIG: BelayApprovalConfig;
 export declare const DEFAULT_EGRESS_V3: BelayEgressConfig;
 export declare function normalizeEgressListenHost(host: string): string;
 export declare const DEFAULT_CONFIG_V2: BelayConfigV2;
@@ -180,8 +214,9 @@ export declare function isConfigV1(value: unknown): value is BelayConfigV1;
 export declare function isConfigV2(value: unknown): value is BelayConfigV2;
 export declare function isConfigV3(value: unknown): value is BelayConfigV4;
 export declare function isConfigV4(value: unknown): value is BelayConfigV4;
-export declare function normalizeJudgeProvider(provider: string | undefined): 'ollama' | 'openai-compatible';
+export declare function normalizeJudgeProvider(provider: string | undefined): 'ollama' | 'openai-compatible' | 'anthropic';
 export declare function normalizeJudgeConfig(judge: BelayJudgeConfig): BelayJudgeConfig;
+export declare function rejectTeamLayerJudgeSecrets(judge: Partial<BelayJudgeConfig> | undefined, source: 'team' | 'repo'): void;
 export declare function migrateV3ToV4(v3: BelayConfigV4, raw?: RawConfigInput): BelayConfigV4;
 type RawConfigInput = Partial<{
     version: number;
@@ -197,6 +232,9 @@ type RawConfigInput = Partial<{
     controlPlane: Partial<BelayControlPlaneConfig>;
     notifications: Partial<BelayNotificationsConfig>;
     approvalSigning: Partial<BelayApprovalSigningConfig>;
+    approval: Partial<BelayApprovalConfig> & {
+        autoReplayScopes?: Partial<BelayApprovalAutoReplayScopes>;
+    };
     egress: Partial<BelayEgressConfig>;
     sandbox: Partial<BelaySandboxConfig>;
     audit: Partial<BelayConfigV2['audit']>;

package/dist/core/config.js

@@ -1,6 +1,10 @@
 import path from 'node:path';
+import { warnDeprecatedJudgeModelAuto } from './judge-model-policy.js';
+import { getJudgeProviderSpec, inferProviderIdFromConfig, isRemovedProviderId, normalizeLegacyProviderId, warnRemovedProviderId, } from './verdict/judge-catalog.js';
+import { normalizeJudgeRuntimeConfig, } from './verdict/judge-runtime-config.js';
 export const DEFAULT_JUDGE_LOCAL_OLLAMA = {
     provider: 'ollama',
+    providerId: 'ollama',
     model: 'gemma4:e2b',
     endpoint: 'http://localhost:11434',
     timeoutMs: 25000,
@@ -8,7 +12,8 @@ export const DEFAULT_JUDGE_LOCAL_OLLAMA = {
 };
 export const DEFAULT_JUDGE_OPENAI_COMPATIBLE_TEMPLATE = {
     provider: 'openai-compatible',
-    model: 'auto',
+    providerId: 'codex',
+    model: 'gpt-5.3-codex-high',
     timeoutMs: 8000,
     endpoint: null,
     keepAlive: null,
@@ -91,6 +96,15 @@ export const DEFAULT_NOTIFICATIONS_V3 = {};
 export const DEFAULT_APPROVAL_SIGNING_V3 = {
     required: false,
 };
+export const DEFAULT_APPROVAL_CONFIG = {
+    flow: 'one_step',
+    autoReplayScopes: {
+        shell: true,
+        tool: false,
+        subagent: false,
+    },
+    executionLeaseMs: 60_000,
+};
 export const DEFAULT_EGRESS_V3 = {
     enabled: false,
     listenHost: '127.0.0.1',
@@ -144,6 +158,7 @@ export const DEFAULT_CONFIG_V4 = {
     controlPlane: { ...DEFAULT_CONTROL_PLANE_V3 },
     notifications: { ...DEFAULT_NOTIFICATIONS_V3 },
     approvalSigning: { ...DEFAULT_APPROVAL_SIGNING_V3 },
+    approval: { ...DEFAULT_APPROVAL_CONFIG },
     egress: { ...DEFAULT_EGRESS_V3 },
     sandbox: { ...DEFAULT_SANDBOX_V3 },
     audit: { ...DEFAULT_CONFIG_V2.audit },
@@ -186,6 +201,7 @@ export function migrateV2ToV3(v2, rawOverrides) {
         controlPlane: { ...LEGACY_CONTROL_PLANE_V3 },
         notifications: { ...DEFAULT_NOTIFICATIONS_V3 },
         approvalSigning: { ...DEFAULT_APPROVAL_SIGNING_V3 },
+        approval: { ...DEFAULT_APPROVAL_CONFIG },
         egress: { ...DEFAULT_EGRESS_V3 },
         sandbox: { ...DEFAULT_SANDBOX_V3 },
         audit: v2.audit,
@@ -209,44 +225,141 @@ export function isConfigV4(value) {
     return typeof value === 'object' && value !== null && value.version === 4;
 }
 export function normalizeJudgeProvider(provider) {
+    if (provider === 'anthropic') {
+        return 'anthropic';
+    }
     if (provider === 'openai-compatible' || provider === 'cursor') {
         return 'openai-compatible';
     }
     return 'ollama';
 }
+function defaultJudgeTemplateForProvider(provider) {
+    if (provider === 'ollama') {
+        return DEFAULT_JUDGE_LOCAL_OLLAMA;
+    }
+    if (provider === 'anthropic') {
+        return {
+            provider: 'anthropic',
+            providerId: 'claude',
+            model: 'claude-sonnet-4-6',
+            timeoutMs: 8000,
+            endpoint: null,
+            keepAlive: null,
+        };
+    }
+    return DEFAULT_JUDGE_OPENAI_COMPATIBLE_TEMPLATE;
+}
 function synthesizeJudgeFromRaw(raw) {
     const judge = raw.judge;
     if (judge?.provider) {
-        const provider = normalizeJudgeProvider(judge.provider);
-        const base = provider === 'openai-compatible'
-            ? DEFAULT_JUDGE_OPENAI_COMPATIBLE_TEMPLATE
-            : DEFAULT_JUDGE_LOCAL_OLLAMA;
+        const rawProvider = String(judge.provider);
+        const provider = normalizeJudgeProvider(rawProvider);
+        const base = defaultJudgeTemplateForProvider(provider);
+        const providerId = judge.providerId && normalizeLegacyProviderId(judge.providerId)
+            ? normalizeLegacyProviderId(judge.providerId)
+            : rawProvider === 'cursor'
+                ? 'cursor'
+                : undefined;
         return normalizeJudgeConfig({
             ...base,
             ...judge,
             provider,
+            ...(providerId ? { providerId } : {}),
         });
     }
     return { ...DEFAULT_JUDGE_LOCAL_OLLAMA };
 }
 export function normalizeJudgeConfig(judge) {
     const provider = normalizeJudgeProvider(judge.provider);
-    const base = provider === 'openai-compatible'
-        ? DEFAULT_JUDGE_OPENAI_COMPATIBLE_TEMPLATE
-        : DEFAULT_JUDGE_LOCAL_OLLAMA;
-    const model = typeof judge.model === 'string' && judge.model.trim() ? judge.model.trim() : base.model;
+    const base = defaultJudgeTemplateForProvider(provider);
+    const rawProviderId = judge.providerId ? String(judge.providerId) : undefined;
+    if (rawProviderId && isRemovedProviderId(rawProviderId)) {
+        warnRemovedProviderId(rawProviderId);
+        let model = typeof judge.model === 'string' && judge.model.trim() ? judge.model.trim() : base.model;
+        if (model === 'auto') {
+            warnDeprecatedJudgeModelAuto();
+            model = base.model;
+        }
+        const timeoutMs = typeof judge.timeoutMs === 'number' && judge.timeoutMs > 0 ? judge.timeoutMs : base.timeoutMs;
+        const endpoint = typeof judge.endpoint === 'string' && judge.endpoint.trim() ? judge.endpoint.trim() : null;
+        return {
+            provider,
+            providerId: rawProviderId,
+            model,
+            timeoutMs,
+            endpoint,
+            keepAlive: provider === 'ollama' && typeof judge.keepAlive === 'string' && judge.keepAlive.trim()
+                ? judge.keepAlive.trim()
+                : provider === 'ollama'
+                    ? DEFAULT_JUDGE_LOCAL_OLLAMA.keepAlive
+                    : null,
+            ...(judge.cloudConsent ? { cloudConsent: judge.cloudConsent } : {}),
+            ...(judge.credential ? { credential: judge.credential } : {}),
+            runtime: normalizeJudgeRuntimeConfig(judge.runtime),
+        };
+    }
+    let providerId = rawProviderId && normalizeLegacyProviderId(rawProviderId)
+        ? normalizeLegacyProviderId(rawProviderId)
+        : inferProviderIdFromConfig({ ...judge, provider });
+    const spec = getJudgeProviderSpec(providerId);
+    if (spec && spec.driver !== provider) {
+        providerId = inferProviderIdFromConfig({ ...judge, provider });
+    }
+    const catalogSpec = getJudgeProviderSpec(providerId);
+    let model = typeof judge.model === 'string' && judge.model.trim() ? judge.model.trim() : base.model;
+    if (model === 'auto' && catalogSpec?.defaultModel) {
+        warnDeprecatedJudgeModelAuto();
+        model = catalogSpec.defaultModel;
+    }
+    if (!model && catalogSpec?.defaultModel) {
+        model = catalogSpec.defaultModel;
+    }
     const timeoutMs = typeof judge.timeoutMs === 'number' && judge.timeoutMs > 0 ? judge.timeoutMs : base.timeoutMs;
-    return {
+    let endpoint = typeof judge.endpoint === 'string' && judge.endpoint.trim() ? judge.endpoint.trim() : null;
+    if (!endpoint && catalogSpec?.defaultEndpoint) {
+        endpoint = catalogSpec.defaultEndpoint;
+    }
+    const normalized = {
         provider,
+        providerId,
         model,
         timeoutMs,
-        endpoint: typeof judge.endpoint === 'string' && judge.endpoint.trim() ? judge.endpoint.trim() : null,
+        endpoint,
         keepAlive: provider === 'ollama' && typeof judge.keepAlive === 'string' && judge.keepAlive.trim()
             ? judge.keepAlive.trim()
             : provider === 'ollama'
                 ? DEFAULT_JUDGE_LOCAL_OLLAMA.keepAlive
                 : null,
     };
+    if (judge.cloudConsent?.accepted) {
+        normalized.cloudConsent = {
+            accepted: true,
+            at: judge.cloudConsent.at,
+            providerId: judge.cloudConsent.providerId ?? providerId,
+            endpoint: judge.cloudConsent.endpoint,
+            by: judge.cloudConsent.by,
+        };
+    }
+    if (judge.credential?.mode === 'project' || judge.credential?.mode === 'apiKey') {
+        normalized.credential = {
+            mode: judge.credential.mode,
+            ...(judge.credential.ref ? { ref: judge.credential.ref } : {}),
+        };
+    }
+    normalized.runtime = normalizeJudgeRuntimeConfig(judge.runtime);
+    return normalized;
+}
+export function rejectTeamLayerJudgeSecrets(judge, source) {
+    if (source !== 'team' || !judge) {
+        return;
+    }
+    if (judge.credential?.mode === 'apiKey') {
+        throw new Error('team config cannot set judge.credential.mode to apiKey.');
+    }
+    const raw = judge;
+    if (raw.credential && 'key' in raw.credential && raw.credential.key) {
+        throw new Error('team config cannot contain inline judge credential keys.');
+    }
 }
 export function migrateV3ToV4(v3, raw) {
     return normalizeConfig({
@@ -296,6 +409,14 @@ function mergeV3FromRaw(base, raw) {
             ...base.approvalSigning,
             ...(raw.approvalSigning ?? {}),
         },
+        approval: {
+            ...base.approval,
+            ...(raw.approval ?? {}),
+            autoReplayScopes: {
+                ...base.approval.autoReplayScopes,
+                ...(raw.approval?.autoReplayScopes ?? {}),
+            },
+        },
         egress: {
             ...base.egress,
             ...(raw.egress ?? {}),
@@ -347,6 +468,14 @@ function normalizeV3Raw(raw) {
         approvalSigning: {
             required: raw.approvalSigning?.required === true,
         },
+        approval: {
+            ...DEFAULT_APPROVAL_CONFIG,
+            ...(raw.approval ?? {}),
+            autoReplayScopes: {
+                ...DEFAULT_APPROVAL_CONFIG.autoReplayScopes,
+                ...(raw.approval?.autoReplayScopes ?? {}),
+            },
+        },
         egress: {
             ...DEFAULT_EGRESS_V3,
             ...(raw.egress ?? {}),
@@ -577,6 +706,17 @@ export function normalizeConfig(config) {
         approvalSigning: {
             required: v4.approvalSigning?.required === true,
         },
+        approval: {
+            flow: v4.approval?.flow === 'two_step' ? 'two_step' : DEFAULT_APPROVAL_CONFIG.flow,
+            autoReplayScopes: {
+                shell: v4.approval?.autoReplayScopes?.shell !== false,
+                tool: v4.approval?.autoReplayScopes?.tool === true,
+                subagent: v4.approval?.autoReplayScopes?.subagent === true,
+            },
+            executionLeaseMs: typeof v4.approval?.executionLeaseMs === 'number' && v4.approval.executionLeaseMs > 0
+                ? v4.approval.executionLeaseMs
+                : DEFAULT_APPROVAL_CONFIG.executionLeaseMs,
+        },
         egress: {
             enabled: v4.egress?.enabled === true,
             listenHost: normalizeEgressListenHost(typeof v4.egress?.listenHost === 'string' && v4.egress.listenHost.trim()
@@ -653,6 +793,14 @@ export function mergeConfig(existing, defaults = DEFAULT_CONFIG_V4) {
             ...defaults.approvalSigning,
             ...migrated.approvalSigning,
         },
+        approval: {
+            ...defaults.approval,
+            ...migrated.approval,
+            autoReplayScopes: {
+                ...defaults.approval.autoReplayScopes,
+                ...migrated.approval.autoReplayScopes,
+            },
+        },
         egress: {
             ...defaults.egress,
             ...migrated.egress,

package/dist/core/credential-store.d.ts

@@ -0,0 +1,11 @@
+export interface JudgeCredentialStoreFile {
+    version: 1;
+    judge?: string;
+}
+export declare function credentialStorePath(stateDir: string): string;
+export declare function writeJudgeCredentialStore(stateDir: string, apiKey: string): Promise<string>;
+export declare function clearJudgeCredentialStore(stateDir: string): Promise<void>;
+export declare function readJudgeCredentialStore(stateDir: string): Promise<string | null>;
+export declare function judgeCredentialStoreExists(stateDir: string): Promise<boolean>;
+export type CredentialRef = `store:judge` | `env:${string}`;
+export declare function parseCredentialRef(ref: string): CredentialRef | null;

package/dist/core/credential-store.js

@@ -0,0 +1,60 @@
+import { chmod, mkdir, readFile, unlink, writeFile } from 'node:fs/promises';
+import path from 'node:path';
+const STORE_FILENAME = 'credentials.json';
+export function credentialStorePath(stateDir) {
+    return path.join(stateDir, STORE_FILENAME);
+}
+export async function writeJudgeCredentialStore(stateDir, apiKey) {
+    await mkdir(stateDir, { recursive: true, mode: 0o700 });
+    const filePath = credentialStorePath(stateDir);
+    const payload = {
+        version: 1,
+        judge: apiKey.trim(),
+    };
+    await writeFile(filePath, `${JSON.stringify(payload, null, 2)}\n`, {
+        encoding: 'utf8',
+        mode: 0o600,
+    });
+    await chmod(filePath, 0o600);
+    return filePath;
+}
+export async function clearJudgeCredentialStore(stateDir) {
+    try {
+        await unlink(credentialStorePath(stateDir));
+    }
+    catch (error) {
+        if (error.code !== 'ENOENT') {
+            throw error;
+        }
+    }
+}
+export async function readJudgeCredentialStore(stateDir) {
+    const filePath = credentialStorePath(stateDir);
+    try {
+        const raw = await readFile(filePath, 'utf8');
+        const parsed = JSON.parse(raw);
+        const key = parsed.judge?.trim();
+        return key || null;
+    }
+    catch {
+        return null;
+    }
+}
+export async function judgeCredentialStoreExists(stateDir) {
+    try {
+        await readFile(credentialStorePath(stateDir), 'utf8');
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+export function parseCredentialRef(ref) {
+    if (ref === 'store:judge') {
+        return ref;
+    }
+    if (ref.startsWith('env:') && ref.length > 4) {
+        return ref;
+    }
+    return null;
+}