@guilz-dev/belay 0.2.0 → 0.4.0

package/dist/core/gate-engine.js

@@ -1,5 +1,5 @@
 import { allPathsAllowlisted } from './capability/allowlist.js';
-import { collectOutsideRepoPaths } from './capability/paths.js';
+import { collectOutsideRepoPaths, collectOutsideRepoPathsFromToolPayload, } from './capability/paths.js';
 import { classifySubagent } from './classify-subagent.js';
 import { classifyToolUse } from './classify-tool.js';
 import { classifierOptionsFromConfig } from './config.js';
@@ -92,17 +92,63 @@ export function normalizeGatedAction(params) {
         agentAssessment,
     };
 }
-function applyShellPeripheralPolicy(command, action, result, options) {
-    if (options.brokerFsScope &&
-        result.verdict === 'deny_pending_approval' &&
-        (result.reason === 'outside_repo_mutation' ||
-            result.reason === 'outside_repo_redirect' ||
-            result.reason === 'repo_outside_mutation' ||
-            result.axes?.location === 'repo_outside')) {
-        const outsideRepoPaths = collectOutsideRepoPaths(command, action.cwd, action.repoRoot);
-        if (outsideRepoPaths.length > 0 &&
-            options.fsScopeAllowlist &&
-            allPathsAllowlisted(outsideRepoPaths, options.fsScopeAllowlist)) {
+function applySandboxFsScopeBoundary(outsideRepoPaths, result, options, hints = {}) {
+    if (!options.brokerFsScope) {
+        return result;
+    }
+    if (outsideRepoPaths.length === 0) {
+        return result;
+    }
+    if (options.fsScopeAllowlist && allPathsAllowlisted(outsideRepoPaths, options.fsScopeAllowlist)) {
+        return result;
+    }
+    if (result.verdict === 'deny_pending_approval') {
+        return result;
+    }
+    const redirect = hints.redirect === true ||
+        result.reason === 'read_only' ||
+        result.assessment.signals.includes('read_only') ||
+        result.reason === 'outside_repo_redirect';
+    return {
+        ...result,
+        verdict: 'deny_pending_approval',
+        reason: redirect ? 'outside_repo_redirect' : 'outside_repo_mutation',
+        assessment: {
+            ...result.assessment,
+            external: true,
+            reversibility: 'irreversible',
+            signals: [...result.assessment.signals, 'sandbox_boundary_expected'],
+        },
+    };
+}
+function applyFsScopePeripheralPolicy(outsideRepoPaths, result, options) {
+    if (!options.brokerFsScope) {
+        return result;
+    }
+    if (outsideRepoPaths.length === 0) {
+        return result;
+    }
+    if (options.fsScopeAllowlist && allPathsAllowlisted(outsideRepoPaths, options.fsScopeAllowlist)) {
+        if (result.verdict === 'deny_pending_approval' &&
+            (result.reason === 'outside_repo_mutation' ||
+                result.reason === 'outside_repo_redirect' ||
+                result.reason === 'repo_outside_mutation' ||
+                result.axes?.location === 'repo_outside')) {
+            return {
+                ...result,
+                verdict: 'allow_flagged',
+                reason: 'capability_fs_hint',
+                assessment: {
+                    ...result.assessment,
+                    signals: [
+                        ...result.assessment.signals,
+                        'capability_fs_hint',
+                        'sandbox_boundary_expected',
+                    ],
+                },
+            };
+        }
+        if (result.verdict === 'allow' || result.verdict === 'allow_flagged') {
             return {
                 ...result,
                 verdict: 'allow_flagged',
@@ -120,6 +166,36 @@ function applyShellPeripheralPolicy(command, action, result, options) {
     }
     return result;
 }
+function applySandboxOutsideBoundary(command, action, result, options) {
+    const outsideRepoPaths = collectOutsideRepoPaths(command, action.cwd, action.repoRoot, options.trustedWorkspaceRoots);
+    return applySandboxFsScopeBoundary(outsideRepoPaths, result, options, {
+        redirect: command.includes('>'),
+    });
+}
+function applyShellPeripheralPolicy(command, action, result, options) {
+    const outsideRepoPaths = collectOutsideRepoPaths(command, action.cwd, action.repoRoot, options.trustedWorkspaceRoots);
+    return applyFsScopePeripheralPolicy(outsideRepoPaths, result, options);
+}
+function outsideRepoPathsForToolAction(action, options) {
+    const payload = action.payload ?? {};
+    const paths = new Set(collectOutsideRepoPathsFromToolPayload(payload, action.cwd, action.repoRoot, options.trustedWorkspaceRoots));
+    const command = shellCommandFromPayload(payload);
+    if (command) {
+        for (const resolved of collectOutsideRepoPaths(command, action.cwd, action.repoRoot, options.trustedWorkspaceRoots)) {
+            paths.add(resolved);
+        }
+    }
+    return [...paths];
+}
+function applyToolSandboxPolicies(action, result, options) {
+    const outsideRepoPaths = outsideRepoPathsForToolAction(action, options);
+    const command = shellCommandFromPayload(action.payload ?? {});
+    let next = applySandboxFsScopeBoundary(outsideRepoPaths, result, options, {
+        redirect: command.includes('>'),
+    });
+    next = applyFsScopePeripheralPolicy(outsideRepoPaths, next, options);
+    return next;
+}
 export async function classifyGatedAction(action, config, extraOptions = {}) {
     const options = { ...classifierOptionsFromConfig(config), ...extraOptions };
     if (action.kind === 'shell') {
@@ -128,6 +204,7 @@ export async function classifyGatedAction(action, config, extraOptions = {}) {
             throw new GateNormalizationError('Shell gated action requires a command.');
         }
         let result = await classifyShell(command, action.cwd, action.repoRoot, config, options);
+        result = applySandboxOutsideBoundary(command, action, result, options);
         result = applyShellPeripheralPolicy(command, action, result, options);
         if (!action.agentAssessment) {
             return result;
@@ -146,7 +223,21 @@ export async function classifyGatedAction(action, config, extraOptions = {}) {
     if (action.kind === 'subagent') {
         return classifySubagent(action.payload ?? {}, action.repoRoot, options);
     }
-    return classifyToolUse(action.payload ?? {}, action.repoRoot, action.cwd, config, options);
+    let result = await classifyToolUse(action.payload ?? {}, action.repoRoot, action.cwd, config, options);
+    result = applyToolSandboxPolicies(action, result, options);
+    if (!action.agentAssessment) {
+        return result;
+    }
+    const merged = mergeAgentAssessment(result.assessment, action.agentAssessment);
+    if (!merged.mismatch) {
+        return { ...result, assessment: merged.assessment };
+    }
+    return {
+        ...result,
+        verdict: 'deny_pending_approval',
+        reason: 'agent_assessment_mismatch',
+        assessment: merged.assessment,
+    };
 }
 export async function classifyGatedActionAsync(action, config, extraOptions = {}) {
     return classifyGatedAction(action, config, extraOptions);

package/dist/core/harvest.d.ts

@@ -0,0 +1,53 @@
+import type { CorpusCase } from '../corpus/types.js';
+import type { AuditRecord } from './audit-types.js';
+export declare const HARVEST_REPORT_SCHEMA_VERSION = 1;
+export type HarvestCandidateSource = 'deny_then_approve' | 'repeated_ask' | 'read_style_signal' | 'overrides_allow';
+export type HarvestReviewOutcome = 'provably-benign' | 'accepted-benign' | 'reject';
+export interface HarvestCandidate {
+    kind: 'shell';
+    command: string;
+    fingerprint: string;
+    reason: string;
+    sources: HarvestCandidateSource[];
+    askCount: number;
+    approvedAfterDeny: boolean;
+}
+export type AvailabilitySignal = 'missing_trusted_cwd' | 'judge_timeout' | 'judge_fallback';
+export interface AvailabilityQueueItem {
+    kind: 'shell';
+    command: string;
+    fingerprint: string;
+    reason: string;
+    availabilitySignal: AvailabilitySignal;
+    judgeFallbackReason?: string;
+    askCount: number;
+}
+export interface HarvestReport {
+    schemaVersion: typeof HARVEST_REPORT_SCHEMA_VERSION;
+    /** Initial harvest scope — shell audit traces only. */
+    scope: 'shell';
+    candidates: HarvestCandidate[];
+    availabilityQueue: AvailabilityQueueItem[];
+}
+export declare function extractAvailabilityQueue(records: AuditRecord[]): AvailabilityQueueItem[];
+/** Shell gate rows plus approval events — matches what `belay harvest list` needs. */
+export declare function filterRecordsForHarvest(records: AuditRecord[], options?: {
+    since?: string;
+    until?: string;
+}): AuditRecord[];
+export declare function extractHarvestCandidates(records: AuditRecord[], options?: {
+    allowPatterns?: string[];
+}): HarvestCandidate[];
+export declare function buildHarvestReport(records: AuditRecord[], options?: {
+    allowPatterns?: string[];
+}): HarvestReport;
+export declare function applyHarvestReview(cases: CorpusCase[], params: {
+    command: string;
+    outcome: HarvestReviewOutcome;
+    reason?: string;
+}): {
+    cases: CorpusCase[];
+    applied: boolean;
+    ok: boolean;
+    message: string;
+};

package/dist/core/harvest.js

@@ -0,0 +1,276 @@
+import { computeRepeatedFingerprintAsks, isAvailabilityCausedAsk } from './audit-analysis.js';
+import { buildApprovalRoundTrips, filterAuditRecords, inferWouldBlock, isApprovalRecorded, isShellGateRecord, parseTimestamp, } from './audit-query.js';
+import { matchesCustomCommand } from './custom-command-match.js';
+export const HARVEST_REPORT_SCHEMA_VERSION = 1;
+const READ_STYLE_COMMAND_PATTERN = /^\s*(git\s+status|git\s+diff|git\s+log|git\s+show|ls\b|cat\b|head\b|tail\b|find\b|rg\b|grep\b|fd\b|bat\b|less\b|more\b|pwd\b|whoami\b|env\b|printenv\b|npm\s+(test|run\s+test)|pnpm\s+(test|run\s+test)|yarn\s+test)/;
+function shellRecords(records) {
+    return records.filter(isShellGateRecord);
+}
+function availabilitySignal(record) {
+    if (!isAvailabilityCausedAsk(record)) {
+        return null;
+    }
+    if (record.reason === 'missing_trusted_cwd') {
+        return 'missing_trusted_cwd';
+    }
+    const fallback = typeof record.judgeFallbackReason === 'string' ? record.judgeFallbackReason : '';
+    if (fallback.includes('timeout')) {
+        return 'judge_timeout';
+    }
+    return 'judge_fallback';
+}
+function commandFromRecord(record) {
+    return (record.summary ?? '').trim();
+}
+function hasReadStyleSignal(summary) {
+    return READ_STYLE_COMMAND_PATTERN.test(summary);
+}
+function upsertCandidate(map, params) {
+    const existing = map.get(params.fingerprint);
+    if (existing) {
+        if (!existing.sources.includes(params.source)) {
+            existing.sources.push(params.source);
+        }
+        existing.askCount = Math.max(existing.askCount, params.askCount ?? 1);
+        existing.approvedAfterDeny = existing.approvedAfterDeny || Boolean(params.approvedAfterDeny);
+        if (params.command) {
+            existing.command = params.command;
+        }
+        if (params.reason) {
+            existing.reason = params.reason;
+        }
+        return;
+    }
+    map.set(params.fingerprint, {
+        kind: 'shell',
+        command: params.command,
+        fingerprint: params.fingerprint,
+        reason: params.reason,
+        sources: [params.source],
+        askCount: params.askCount ?? 1,
+        approvedAfterDeny: Boolean(params.approvedAfterDeny),
+    });
+}
+export function extractAvailabilityQueue(records) {
+    const grouped = new Map();
+    for (const record of shellRecords(records)) {
+        if (!inferWouldBlock(record) || !record.fingerprint) {
+            continue;
+        }
+        const signal = availabilitySignal(record);
+        if (!signal) {
+            continue;
+        }
+        const fingerprint = record.fingerprint;
+        const existing = grouped.get(fingerprint);
+        if (existing) {
+            existing.askCount += 1;
+            existing.command = commandFromRecord(record) || existing.command;
+            existing.reason = record.reason ?? existing.reason;
+            continue;
+        }
+        grouped.set(fingerprint, {
+            kind: 'shell',
+            command: commandFromRecord(record),
+            fingerprint,
+            reason: record.reason ?? 'unknown',
+            availabilitySignal: signal,
+            ...(typeof record.judgeFallbackReason === 'string'
+                ? { judgeFallbackReason: record.judgeFallbackReason }
+                : {}),
+            askCount: 1,
+        });
+    }
+    return [...grouped.values()].sort((left, right) => right.askCount - left.askCount);
+}
+function recordsForShellRoundTrips(records) {
+    return records.filter((record) => isApprovalRecorded(record) ||
+        (isShellGateRecord(record) && inferWouldBlock(record) && !isAvailabilityCausedAsk(record)));
+}
+/** Pair deny/approval rows split by a time window so round-trip harvest still works. */
+function augmentHarvestRoundTripPairs(scoped, timeFiltered) {
+    if (timeFiltered.length === 0) {
+        return timeFiltered;
+    }
+    const included = new Set(timeFiltered);
+    const augmented = [...timeFiltered];
+    const approvalById = new Map();
+    const denyByApprovalId = new Map();
+    for (const record of scoped) {
+        if (!record.approvalId) {
+            continue;
+        }
+        if (isApprovalRecorded(record)) {
+            approvalById.set(record.approvalId, record);
+        }
+        else if (isShellGateRecord(record) && inferWouldBlock(record)) {
+            denyByApprovalId.set(record.approvalId, record);
+        }
+    }
+    for (const record of timeFiltered) {
+        if (!record.approvalId) {
+            continue;
+        }
+        if (isApprovalRecorded(record)) {
+            const deny = denyByApprovalId.get(record.approvalId);
+            if (deny && !included.has(deny)) {
+                included.add(deny);
+                augmented.push(deny);
+            }
+            continue;
+        }
+        if (isShellGateRecord(record)) {
+            const approval = approvalById.get(record.approvalId);
+            if (approval && !included.has(approval)) {
+                included.add(approval);
+                augmented.push(approval);
+            }
+        }
+    }
+    return augmented.sort((left, right) => {
+        const leftMs = parseTimestamp(left.timestamp) ?? 0;
+        const rightMs = parseTimestamp(right.timestamp) ?? 0;
+        return leftMs - rightMs;
+    });
+}
+/** Shell gate rows plus approval events — matches what `belay harvest list` needs. */
+export function filterRecordsForHarvest(records, options = {}) {
+    const scoped = records.filter((record) => isShellGateRecord(record) || isApprovalRecorded(record));
+    if (!options.since && !options.until) {
+        return scoped;
+    }
+    const timeFiltered = filterAuditRecords(scoped, {
+        since: options.since,
+        until: options.until,
+    });
+    return augmentHarvestRoundTripPairs(scoped, timeFiltered);
+}
+export function extractHarvestCandidates(records, options = {}) {
+    const shellOnly = shellRecords(records);
+    const classifierAsks = shellOnly.filter((record) => inferWouldBlock(record) && !isAvailabilityCausedAsk(record));
+    const map = new Map();
+    // `unknown` covers legacy shell rows missing `kind`.
+    const roundTrips = buildApprovalRoundTrips(recordsForShellRoundTrips(records)).filter((trip) => trip.kind === 'shell' || trip.kind === 'unknown');
+    for (const trip of roundTrips) {
+        if (!trip.fingerprint || !trip.approvalTimestamp) {
+            continue;
+        }
+        upsertCandidate(map, {
+            fingerprint: trip.fingerprint,
+            command: trip.summary,
+            reason: trip.reason,
+            source: 'deny_then_approve',
+            approvedAfterDeny: true,
+        });
+    }
+    for (const entry of computeRepeatedFingerprintAsks(classifierAsks, 2, 50)) {
+        upsertCandidate(map, {
+            fingerprint: entry.fingerprint,
+            command: entry.summary,
+            reason: entry.reason,
+            source: 'repeated_ask',
+            askCount: entry.askCount,
+        });
+    }
+    for (const record of classifierAsks) {
+        if (!record.fingerprint) {
+            continue;
+        }
+        const command = commandFromRecord(record);
+        if (!hasReadStyleSignal(command)) {
+            continue;
+        }
+        upsertCandidate(map, {
+            fingerprint: record.fingerprint,
+            command,
+            reason: record.reason ?? 'unknown',
+            source: 'read_style_signal',
+        });
+    }
+    // Current overrides.allow match on past would-blocks — not a changelog of new additions.
+    const allowPatterns = options.allowPatterns ?? [];
+    for (const record of classifierAsks) {
+        if (!record.fingerprint) {
+            continue;
+        }
+        const command = commandFromRecord(record);
+        if (!command) {
+            continue;
+        }
+        for (const pattern of allowPatterns) {
+            if (matchesCustomCommand(command, command, pattern)) {
+                upsertCandidate(map, {
+                    fingerprint: record.fingerprint,
+                    command,
+                    reason: record.reason ?? 'unknown',
+                    source: 'overrides_allow',
+                });
+                break;
+            }
+        }
+    }
+    return [...map.values()].sort((left, right) => {
+        if (right.askCount !== left.askCount) {
+            return right.askCount - left.askCount;
+        }
+        return left.command.localeCompare(right.command);
+    });
+}
+export function buildHarvestReport(records, options = {}) {
+    return {
+        schemaVersion: HARVEST_REPORT_SCHEMA_VERSION,
+        scope: 'shell',
+        candidates: extractHarvestCandidates(records, options),
+        availabilityQueue: extractAvailabilityQueue(records),
+    };
+}
+export function applyHarvestReview(cases, params) {
+    const command = params.command.trim();
+    if (!command) {
+        return { cases, applied: false, ok: false, message: 'Command must be non-empty.' };
+    }
+    if (params.outcome === 'reject') {
+        return {
+            cases,
+            applied: false,
+            ok: true,
+            message: `Reviewed and rejected candidate ${JSON.stringify(command)}.`,
+        };
+    }
+    const category = params.outcome;
+    const verdict = category === 'provably-benign' ? 'allow' : 'allow_flagged';
+    const reason = params.reason?.trim();
+    const duplicate = cases.find((entry) => entry.command === command);
+    if (duplicate) {
+        if (duplicate.category === category) {
+            return {
+                cases,
+                applied: false,
+                ok: false,
+                message: `Corpus already contains ${JSON.stringify(command)} as ${category}.`,
+            };
+        }
+        return {
+            cases,
+            applied: false,
+            ok: false,
+            message: `Corpus already contains ${JSON.stringify(command)} as ${duplicate.category}; resolve manually.`,
+        };
+    }
+    const nextCase = {
+        kind: 'shell',
+        category,
+        command,
+        verdict,
+        ...(reason ? { reason } : {}),
+    };
+    const followUp = category === 'provably-benign'
+        ? 'Next: run `pnpm corpus` and confirm hard gates pass before `pnpm build` refreshes the standing-allow catalog.'
+        : 'Next: run `pnpm corpus` to verify corpus evaluation (accepted-benign is soft-gated).';
+    return {
+        cases: [...cases, nextCase],
+        applied: true,
+        ok: true,
+        message: `Added ${JSON.stringify(command)} to corpus as ${category}. ${followUp}`,
+    };
+}

package/dist/core/index.d.ts

@@ -1,9 +1,14 @@
-export { APPROVAL_EXECUTION_LEASE_MS, approvalCommandMatch, buildRetryInstruction, compactApprovals, createApprovalRecord, isExecutionLeaseExpired, isExpired, mergeApprovalStates, nowIso, } from './approval.js';
+export { APPROVAL_EXECUTION_LEASE_MS, approvalCommandMatch, compactApprovals, createApprovalRecord, createApprovalRecordWithEnvelope, isExecutionLeaseExpired, isExpired, mergeApprovalStates, nowIso, } from './approval.js';
+export type { ApprovalReplayHint, ReplayActionContext, ReplayAdapterId, } from './approval-replay.js';
+/** @deprecated Use `buildRetryInstructionForConfig` */
+export { approvalFlow, buildApprovalRecordedMessage, buildReplayEnvelopeFields, buildReplayHint, buildRetryInstructionForConfig, buildRetryInstructionForConfig as buildRetryInstruction, canAutoReplay, getExecutionLeaseMs, replayShellCommand, validateReplayEnvelope, } from './approval-replay.js';
+export type { ApprovalStore } from './approval-service.js';
+export { consumeApprovedAfterCliReplay, createGateApprovalStore, gateApprovalStoreFromDeps, recordApproval, } from './approval-service.js';
 export type { AuditMetricsReport } from './audit-metrics.js';
 export { computeAuditMetrics, parseAuditNdjson } from './audit-metrics.js';
 export { classifySubagent } from './classify-subagent.js';
 export { classifyToolUse } from './classify-tool.js';
-export { approvedApprovalsFile, type BelayConfig, type BelayConfigV1, type BelayConfigV2, type BelayConfigV3, type BelayConfigV4, type BelayControlPlaneConfig, type BelayJudgeConfig, type BelayOverridesConfig, type BelayPolicyConfig, type BelayRedactionConfig, belayStateDir, classifierOptionsFromConfig, configuredControlPlaneDir, DEFAULT_CONFIG_V2, DEFAULT_CONFIG_V3, DEFAULT_CONFIG_V4, DEFAULT_JUDGE_CURSOR_COMPOSER, DEFAULT_JUDGE_LOCAL_OLLAMA, defaultControlPlaneDir, isConfigV4, isFreshConfigInput, LEGACY_POLICY_V3, mapLegacyClassifierToOverrides, mergeConfig, migrateConfig, migrateV2ToV3, normalizeConfig, normalizeJudgeConfig, pendingApprovalsFile, resolveControlPlaneDir, scrubOptionsFromConfig, } from './config.js';
+export { type ApprovalFlow, approvedApprovalsFile, type BelayApprovalAutoReplayScopes, type BelayApprovalConfig, type BelayConfig, type BelayConfigV1, type BelayConfigV2, type BelayConfigV3, type BelayConfigV4, type BelayControlPlaneConfig, type BelayJudgeConfig, type BelayOverridesConfig, type BelayPolicyConfig, type BelayRedactionConfig, belayStateDir, classifierOptionsFromConfig, configuredControlPlaneDir, DEFAULT_APPROVAL_CONFIG, DEFAULT_CONFIG_V2, DEFAULT_CONFIG_V3, DEFAULT_CONFIG_V4, DEFAULT_JUDGE_CURSOR_COMPOSER, DEFAULT_JUDGE_LOCAL_OLLAMA, defaultControlPlaneDir, isConfigV4, isFreshConfigInput, LEGACY_POLICY_V3, mapLegacyClassifierToOverrides, mergeConfig, migrateConfig, migrateV2ToV3, normalizeConfig, normalizeJudgeConfig, pendingApprovalsFile, resolveControlPlaneDir, scrubOptionsFromConfig, } from './config.js';
 export { matchesCustomCommand } from './custom-command-match.js';
 export { canonicalStringify, hashValue, shellFingerprint, subagentFingerprint, toolFingerprint, } from './fingerprint.js';
 export type { GatedAction, GatedActionKind, GatePermissionResponse, GateVerdict, } from './gate-contract.js';
@@ -11,9 +16,10 @@ export { classifyResultToGateVerdict, GATE_CONTRACT_VERSION, isGatedAction, unno
 export { classifyGatedAction, GateNormalizationError, gateEnabledForAction, normalizeGatedAction, } from './gate-engine.js';
 export { matchesSensitivePath } from './glob.js';
 export { canonicalPath, hasOutsideRepoPath, normalizeToken, pathWithinRoot, relativeWithinRepo, resolveMutationTarget, } from './path-utils.js';
+export { fingerprintReplayPayload, subagentFingerprintSource } from './replay-scrub.js';
 export { scrubString, scrubValue } from './scrub.js';
 export { findCommandSubstitutions, MAX_SUBSTITUTION_DEPTH } from './shell-substitution.js';
 export type { TransactionalDiffEvaluation, TransactionalExecutionResult, } from './transactional/index.js';
 export { isTransactionalEligible, runTransactionalExecution } from './transactional/index.js';
-export type { ApprovalRecord, ApprovalStateFile, Assessment, ClassifierOptions, ClassifyResult, HookVerdict, Reversibility, ScrubOptions, UnknownLocalEffectPolicy, } from './types.js';
+export type { ApprovalRecord, ApprovalScopeHint, ApprovalStateFile, Assessment, ClassifierOptions, ClassifyResult, HookVerdict, Reversibility, ScrubOptions, UnknownLocalEffectPolicy, } from './types.js';
 export { buildVerdictContext, classifyShell, verdict, verdictToClassifyResult, } from './verdict/index.js';

package/dist/core/index.js

@@ -1,14 +1,18 @@
-export { APPROVAL_EXECUTION_LEASE_MS, approvalCommandMatch, buildRetryInstruction, compactApprovals, createApprovalRecord, isExecutionLeaseExpired, isExpired, mergeApprovalStates, nowIso, } from './approval.js';
+export { APPROVAL_EXECUTION_LEASE_MS, approvalCommandMatch, compactApprovals, createApprovalRecord, createApprovalRecordWithEnvelope, isExecutionLeaseExpired, isExpired, mergeApprovalStates, nowIso, } from './approval.js';
+/** @deprecated Use `buildRetryInstructionForConfig` */
+export { approvalFlow, buildApprovalRecordedMessage, buildReplayEnvelopeFields, buildReplayHint, buildRetryInstructionForConfig, buildRetryInstructionForConfig as buildRetryInstruction, canAutoReplay, getExecutionLeaseMs, replayShellCommand, validateReplayEnvelope, } from './approval-replay.js';
+export { consumeApprovedAfterCliReplay, createGateApprovalStore, gateApprovalStoreFromDeps, recordApproval, } from './approval-service.js';
 export { computeAuditMetrics, parseAuditNdjson } from './audit-metrics.js';
 export { classifySubagent } from './classify-subagent.js';
 export { classifyToolUse } from './classify-tool.js';
-export { approvedApprovalsFile, belayStateDir, classifierOptionsFromConfig, configuredControlPlaneDir, DEFAULT_CONFIG_V2, DEFAULT_CONFIG_V3, DEFAULT_CONFIG_V4, DEFAULT_JUDGE_CURSOR_COMPOSER, DEFAULT_JUDGE_LOCAL_OLLAMA, defaultControlPlaneDir, isConfigV4, isFreshConfigInput, LEGACY_POLICY_V3, mapLegacyClassifierToOverrides, mergeConfig, migrateConfig, migrateV2ToV3, normalizeConfig, normalizeJudgeConfig, pendingApprovalsFile, resolveControlPlaneDir, scrubOptionsFromConfig, } from './config.js';
+export { approvedApprovalsFile, belayStateDir, classifierOptionsFromConfig, configuredControlPlaneDir, DEFAULT_APPROVAL_CONFIG, DEFAULT_CONFIG_V2, DEFAULT_CONFIG_V3, DEFAULT_CONFIG_V4, DEFAULT_JUDGE_CURSOR_COMPOSER, DEFAULT_JUDGE_LOCAL_OLLAMA, defaultControlPlaneDir, isConfigV4, isFreshConfigInput, LEGACY_POLICY_V3, mapLegacyClassifierToOverrides, mergeConfig, migrateConfig, migrateV2ToV3, normalizeConfig, normalizeJudgeConfig, pendingApprovalsFile, resolveControlPlaneDir, scrubOptionsFromConfig, } from './config.js';
 export { matchesCustomCommand } from './custom-command-match.js';
 export { canonicalStringify, hashValue, shellFingerprint, subagentFingerprint, toolFingerprint, } from './fingerprint.js';
 export { classifyResultToGateVerdict, GATE_CONTRACT_VERSION, isGatedAction, unnormalizedGateVerdict, } from './gate-contract.js';
 export { classifyGatedAction, GateNormalizationError, gateEnabledForAction, normalizeGatedAction, } from './gate-engine.js';
 export { matchesSensitivePath } from './glob.js';
 export { canonicalPath, hasOutsideRepoPath, normalizeToken, pathWithinRoot, relativeWithinRepo, resolveMutationTarget, } from './path-utils.js';
+export { fingerprintReplayPayload, subagentFingerprintSource } from './replay-scrub.js';
 export { scrubString, scrubValue } from './scrub.js';
 export { findCommandSubstitutions, MAX_SUBSTITUTION_DEPTH } from './shell-substitution.js';
 export { isTransactionalEligible, runTransactionalExecution } from './transactional/index.js';

package/dist/core/integrity.d.ts

@@ -1,5 +1,6 @@
 import type { ScopedPaths } from '../adapters/layouts/scope.js';
 import type { AdapterLayout } from '../adapters/layouts/types.js';
+import type { BelayConfigV4 } from './config.js';
 export interface IntegrityManifest {
     version: 1;
     generatedAt: string;
@@ -13,3 +14,4 @@ export declare function verifyIntegrityManifest(repoRoot: string, layout: Adapte
     ok: boolean;
     mismatches: string[];
 }>;
+export declare function refreshIntegrityIfPinned(repoRoot: string, config: BelayConfigV4): Promise<void>;

package/dist/core/integrity.js

@@ -2,6 +2,9 @@ import { createHash } from 'node:crypto';
 import { existsSync } from 'node:fs';
 import { mkdir, readFile, writeFile } from 'node:fs/promises';
 import path from 'node:path';
+import { getAdapterLayout } from '../adapters/layouts/index.js';
+import { resolveScopedPaths } from '../adapters/layouts/scope.js';
+import { resolveAdapterName } from '../config-io.js';
 export async function sha256File(filePath) {
     const content = await readFile(filePath);
     return createHash('sha256').update(content).digest('hex');
@@ -66,3 +69,13 @@ export async function verifyIntegrityManifest(repoRoot, layout) {
     }
     return { ok: mismatches.length === 0, mismatches };
 }
+export async function refreshIntegrityIfPinned(repoRoot, config) {
+    if (config.controlPlane.integrity !== 'hash-pinned') {
+        return;
+    }
+    const adapter = resolveAdapterName(config);
+    const layout = getAdapterLayout(adapter);
+    const installScope = config.installScope === 'global' ? 'global' : 'project';
+    const scoped = resolveScopedPaths(layout, installScope, repoRoot);
+    await writeIntegrityManifest(repoRoot, layout, runtimeIntegrityFiles(layout, scoped));
+}

package/dist/core/judge-api-key.d.ts

@@ -1,4 +1,23 @@
+import type { BelayJudgeConfig } from './config.js';
+import { belayStateDir } from './config.js';
+import { type JudgeProviderSpec } from './verdict/judge-catalog.js';
+export type JudgeCredentialSourceKind = 'env' | 'store' | 'host-session' | 'missing';
+export interface ResolvedJudgeCredential {
+    key: string | null;
+    source: string | null;
+    sourceKind: JudgeCredentialSourceKind;
+    mode: 'project' | 'apiKey';
+}
+/** @deprecated Use resolveJudgeCredential */
 export declare function resolveJudgeApiKey(env?: NodeJS.ProcessEnv): {
     key: string | null;
     source: 'BELAY_JUDGE_API_KEY' | 'OPENAI_API_KEY' | null;
 };
+export declare function resolveJudgeCredential(params: {
+    judge: BelayJudgeConfig;
+    catalogSpec?: JudgeProviderSpec;
+    repoRoot: string;
+    repoLocalStateDir: string;
+    config: Parameters<typeof belayStateDir>[0];
+    env?: NodeJS.ProcessEnv;
+}): Promise<ResolvedJudgeCredential>;