@guilz-dev/belay 0.2.0 → 0.4.0

package/dist/core/judge-doctor.js

@@ -1,124 +1,229 @@
+import { repoLocalStateDirFor } from '../config-io.js';
 import { normalizeJudgeProvider, scrubOptionsFromConfig } from './config.js';
-import { resolveJudgeApiKey } from './judge-api-key.js';
-import { assertJudgeEndpoint } from './judge-config.js';
+import { resolveJudgeCredential } from './judge-api-key.js';
+import { hasValidCloudConsent } from './judge-config.js';
+import { discoverJudgeModels, modelPresenceFromDiscovery, } from './judge-model-discovery.js';
+import { detectJudgeRuntimeCapabilities, resolveJudgeTransport } from './judge-runtime-detection.js';
 import { createOllamaJudge, createOpenAiCompatibleJudge } from './verdict/judge.js';
-import { loadPinnedJudgeModels, resolveCloudModel } from './verdict/judge-factory.js';
-export async function diagnoseJudge(config) {
+import { stopJudgeBrokerDaemon } from './verdict/judge-broker-service.js';
+import { getJudgeProviderCapabilities, getJudgeProviderSpec, isRemovedProviderId, normalizeLegacyProviderId, } from './verdict/judge-catalog.js';
+import { createJudgeFromConfig, resolveJudgeModel } from './verdict/judge-factory.js';
+import { listRepoJudgeSessionBrokers, stopRepoJudgeSessionBroker, } from './verdict/judge-session-broker.js';
+import { clearJudgeSessionKillSwitch } from './verdict/judge-session-kill-switch.js';
+export async function diagnoseJudge(config, repoRoot = process.cwd(), options = {}) {
+    const shouldRunLiveProbe = options.liveProbe === true && !process.env.VITEST && !process.env.VITEST_WORKER_ID;
     const issues = [];
     const warnings = [];
     const notes = [];
     const judge = config.judge;
     const provider = normalizeJudgeProvider(judge.provider);
-    notes.push(`Judge provider: ${provider}`);
+    const rawProviderId = judge.providerId ? String(judge.providerId) : undefined;
+    if (rawProviderId && isRemovedProviderId(rawProviderId)) {
+        notes.push(`Judge providerId: ${rawProviderId}`);
+        notes.push(`Judge driver: ${provider}`);
+        notes.push(`Judge model requested: ${judge.model}`);
+        issues.push(`judge.providerId "${rawProviderId}" was removed; run belay config set judge.providerId <ollama|codex|claude|cursor> to migrate.`);
+        return { issues, warnings, notes };
+    }
+    const providerId = judge.providerId && normalizeLegacyProviderId(judge.providerId)
+        ? normalizeLegacyProviderId(judge.providerId)
+        : provider === 'ollama'
+            ? 'ollama'
+            : provider === 'anthropic'
+                ? 'claude'
+                : 'codex';
+    const catalogSpec = getJudgeProviderSpec(providerId);
+    const capabilities = getJudgeProviderCapabilities(providerId);
+    const transport = resolveJudgeTransport(judge);
+    const runtime = detectJudgeRuntimeCapabilities(providerId);
+    notes.push(`Judge providerId: ${providerId}`);
+    notes.push(`Judge driver: ${provider}`);
     notes.push(`Judge model requested: ${judge.model}`);
+    notes.push(`Judge transport: ${transport}`);
     if (config.policy.modelAssist.enabled) {
         warnings.push('policy.modelAssist is enabled but is not wired to v2 Tier1. Use top-level judge instead.');
     }
-    if (provider === 'openai-compatible') {
+    if (capabilities?.requiresConsent && !hasValidCloudConsent(judge) && transport === 'http') {
+        issues.push('Cloud judge consent is not recorded. Tier1 cloud judge will fail closed until consent is granted.');
+    }
+    else if (judge.cloudConsent?.accepted) {
+        notes.push(`Cloud consent: accepted ${judge.cloudConsent.at} by ${judge.cloudConsent.by}`);
+    }
+    if (providerId !== 'ollama') {
         warnings.push('Cloud judge egress is enabled. Commands are redacted (R23) before send, but path structure and intent may still leave the repo.');
-        try {
-            assertJudgeEndpoint(judge);
-            notes.push(`OpenAI-compatible endpoint: ${judge.endpoint}`);
+    }
+    const repoLocalDir = repoLocalStateDirFor(repoRoot, config);
+    const keyInfo = await resolveJudgeCredential({
+        judge,
+        catalogSpec: catalogSpec ?? undefined,
+        repoRoot,
+        repoLocalStateDir: repoLocalDir,
+        config,
+    });
+    notes.push(`Credential: ${keyInfo.mode} (${keyInfo.sourceKind})`);
+    const resolved = resolveJudgeModel(judge);
+    notes.push(`Resolved model: ${resolved.resolved}`);
+    const endpoint = judge.endpoint ?? (providerId === 'ollama' ? 'http://127.0.0.1:11434' : null);
+    const discovery = await discoverJudgeModels({
+        providerId,
+        model: judge.model,
+        endpoint,
+    }, options.discoveryDeps);
+    const modelCheck = modelPresenceFromDiscovery(discovery, judge.model);
+    notes.push(`Model check: ${modelCheck.status} (source: ${modelCheck.source})`);
+    if (providerId === 'ollama') {
+        notes.push(`Ollama endpoint: ${endpoint}`);
+        if (discovery.modelIds.length === 0) {
+            issues.push(`Ollama endpoint unreachable or returned no models. Tier1 will fail closed.`);
         }
-        catch {
-            issues.push('openai-compatible judge requires judge.endpoint. No default cloud base URL is applied.');
-            return { issues, warnings, notes };
+        else {
+            const hasModel = modelCheck.status === 'found';
+            if (!hasModel) {
+                issues.push(`Ollama model "${judge.model}" is not present. Pull it before enforce mode.`);
+            }
+            else {
+                notes.push(`Ollama model "${judge.model}" is available.`);
+            }
         }
-        const keyInfo = resolveJudgeApiKey();
-        if (!keyInfo.key) {
-            issues.push('BELAY_JUDGE_API_KEY / OPENAI_API_KEY is not set. Tier1 cloud judge will fail closed to ask.');
+        const warm = createOllamaJudge({
+            model: judge.model,
+            baseUrl: endpoint ?? 'http://127.0.0.1:11434',
+            timeoutMs: Math.min(judge.timeoutMs, 5000),
+            fetchImpl: async () => new Response(JSON.stringify({
+                response: JSON.stringify({
+                    local_recoverable: true,
+                    destroys_outside_repo: false,
+                    destroys_history_or_secrets: false,
+                    reason: 'doctor_warm',
+                }),
+            }), { status: 200 }),
+        });
+        const warmResult = await warm.evaluate({
+            text: 'git status',
+            context: { cwd: process.cwd(), repoRoot: process.cwd() },
+        });
+        if (warmResult.reason === 'ollama_unavailable' || warmResult.reason === 'ollama_parse_error') {
+            issues.push(`Ollama warm call failed: ${warmResult.reason}`);
         }
         else {
-            notes.push(`API key source: ${keyInfo.source}`);
+            notes.push('Ollama warm call succeeded.');
         }
-        const pinnedModels = await loadPinnedJudgeModels();
-        const resolved = resolveCloudModel(judge.model, pinnedModels['openai-compatible']);
-        notes.push(`Resolved model: ${resolved.resolved}`);
-        if (keyInfo.key && judge.endpoint?.trim()) {
-            const traced = createOpenAiCompatibleJudge({
-                endpoint: judge.endpoint.trim(),
-                modelRequested: judge.model,
-                modelResolved: resolved.resolved,
-                timeoutMs: Math.min(judge.timeoutMs, 5000),
-                apiKey: keyInfo.key,
-                sensitivePaths: config.classifier.sensitivePaths,
-                scrubOptions: scrubOptionsFromConfig(config),
-                fetchImpl: async () => new Response(JSON.stringify({
-                    choices: [
-                        {
-                            message: {
-                                content: JSON.stringify({
-                                    external_change: false,
-                                    destroys_outside_repo: false,
-                                    destroys_history_or_secrets: false,
-                                    reason: 'doctor_dry_run',
-                                }),
-                            },
-                        },
-                    ],
-                }), { status: 200 }),
-            });
-            const dryRun = await traced.evaluate({
-                text: 'git status',
-                context: { cwd: process.cwd(), repoRoot: process.cwd() },
-            });
-            if (dryRun.reason.startsWith('openai_compatible_') ||
-                dryRun.reason === 'outbound_scrub_failed') {
-                issues.push(`OpenAI-compatible judge dry-run failed: ${dryRun.reason}`);
-            }
-            else {
-                notes.push('OpenAI-compatible judge dry-run succeeded.');
+        return { issues, warnings, notes, modelCheck };
+    }
+    if (transport === 'unavailable') {
+        issues.push('No judge transport is available (configure endpoint or install native CLI). Tier1 will fail closed to ask.');
+        return { issues, warnings, notes, modelCheck };
+    }
+    if (transport.endsWith('-cli')) {
+        if (!runtime.cliTransport) {
+            issues.push(`Native CLI transport (${transport}) is not available. Tier1 judge will fail closed to ask.`);
+        }
+        else if (!keyInfo.key && keyInfo.sourceKind !== 'host-session') {
+            issues.push('Judge API key is not set for the configured credential mode. Tier1 cloud judge will fail closed to ask.');
+        }
+        else {
+            notes.push(`Native CLI transport available: ${transport}`);
+            if (shouldRunLiveProbe) {
+                const smokeConfig = {
+                    ...config,
+                    judge: {
+                        ...judge,
+                        timeoutMs: Math.min(judge.timeoutMs, 5000),
+                    },
+                };
+                const smokeJudge = createJudgeFromConfig(smokeConfig, { repoRoot });
+                const smokeResult = await smokeJudge.evaluate({
+                    text: 'git status',
+                    context: { cwd: repoRoot, repoRoot },
+                });
+                const smokeFallback = smokeJudge.lastTrace?.judgeFallbackReason ??
+                    smokeJudge.lastTrace?.fallbackReason ??
+                    smokeResult.reason;
+                if (smokeJudge.lastTrace?.provider === 'fallback') {
+                    issues.push(`Native CLI transport smoke probe failed (${smokeFallback}). Tier1 will fail closed to ask.`);
+                }
+                else {
+                    notes.push('Native CLI transport smoke probe succeeded.');
+                }
             }
         }
-        return { issues, warnings, notes };
+        return { issues, warnings, notes, modelCheck };
+    }
+    if (judge.endpoint?.trim()) {
+        notes.push(`HTTP endpoint: ${judge.endpoint}`);
+    }
+    if (!keyInfo.key) {
+        issues.push('Judge API key is not set for the configured credential mode. Tier1 cloud judge will fail closed to ask.');
+    }
+    else {
+        notes.push(`Credential source: ${keyInfo.source ?? keyInfo.sourceKind}`);
     }
-    const endpoint = judge.endpoint ?? 'http://127.0.0.1:11434';
-    notes.push(`Ollama endpoint: ${endpoint}`);
-    try {
-        const response = await fetch(`${endpoint.replace(/\/$/, '')}/api/tags`, {
-            signal: AbortSignal.timeout(3000),
+    if (keyInfo.key && judge.endpoint?.trim() && hasValidCloudConsent(judge)) {
+        const traced = createOpenAiCompatibleJudge({
+            endpoint: judge.endpoint.trim(),
+            modelRequested: judge.model,
+            modelResolved: resolved.resolved,
+            timeoutMs: Math.min(judge.timeoutMs, 5000),
+            apiKey: keyInfo.key,
+            sensitivePaths: config.classifier.sensitivePaths,
+            scrubOptions: scrubOptionsFromConfig(config),
+            fetchImpl: async () => new Response(JSON.stringify({
+                choices: [
+                    {
+                        message: {
+                            content: JSON.stringify({
+                                local_recoverable: true,
+                                destroys_outside_repo: false,
+                                destroys_history_or_secrets: false,
+                                reason: 'doctor_dry_run',
+                            }),
+                        },
+                    },
+                ],
+            }), { status: 200 }),
+        });
+        const dryRun = await traced.evaluate({
+            text: 'git status',
+            context: { cwd: process.cwd(), repoRoot: process.cwd() },
         });
-        if (!response.ok) {
-            issues.push(`Ollama endpoint unreachable (HTTP ${response.status}). Tier1 will fail closed.`);
+        if (dryRun.reason.startsWith('openai_compatible_') ||
+            dryRun.reason === 'outbound_scrub_failed') {
+            issues.push(`HTTP judge dry-run failed: ${dryRun.reason}`);
         }
         else {
-            const tags = (await response.json());
-            const names = (tags.models ?? []).map((entry) => entry.name ?? '');
-            const hasModel = names.some((name) => name === judge.model || name.startsWith(`${judge.model}:`));
-            if (!hasModel) {
-                issues.push(`Ollama model "${judge.model}" is not present. Pull it before enforce mode.`);
-            }
-            else {
-                notes.push(`Ollama model "${judge.model}" is available.`);
-            }
+            notes.push('HTTP judge dry-run succeeded.');
         }
     }
-    catch (error) {
-        const detail = error instanceof Error ? error.message : 'connection failed';
-        issues.push(`Ollama endpoint unreachable (${detail}). Tier1 will fail closed.`);
+    const factoryJudge = createJudgeFromConfig(config, { repoRoot });
+    if (factoryJudge.lastTrace?.transport) {
+        notes.push(`Factory transport: ${factoryJudge.lastTrace.transport}`);
     }
-    const warm = createOllamaJudge({
-        model: judge.model,
-        baseUrl: endpoint,
-        timeoutMs: Math.min(judge.timeoutMs, 5000),
-        fetchImpl: async () => new Response(JSON.stringify({
-            response: JSON.stringify({
-                external_change: false,
-                destroys_outside_repo: false,
-                destroys_history_or_secrets: false,
-                reason: 'doctor_warm',
-            }),
-        }), { status: 200 }),
-    });
-    const warmResult = await warm.evaluate({
-        text: 'git status',
-        context: { cwd: process.cwd(), repoRoot: process.cwd() },
-    });
-    if (warmResult.reason === 'ollama_unavailable' || warmResult.reason === 'ollama_parse_error') {
-        issues.push(`Ollama warm call failed: ${warmResult.reason}`);
+    if (config.judge.runtime?.session.enabled) {
+        notes.push('Judge session transport: enabled');
+        const activeBrokers = listRepoJudgeSessionBrokers();
+        if (activeBrokers.includes(repoRoot)) {
+            notes.push(`Active session broker for repo: ${repoRoot}`);
+        }
     }
     else {
-        notes.push('Ollama warm call succeeded.');
+        notes.push('Judge session transport: disabled (default)');
+    }
+    return { issues, warnings, notes, modelCheck };
+}
+export async function stopJudgeSessionBrokers(repoRoot, stateDir) {
+    let stopped = 0;
+    stopped += stopRepoJudgeSessionBroker(repoRoot, 'manual_stop');
+    stopped += await stopJudgeBrokerDaemon(stateDir);
+    await clearJudgeSessionKillSwitch(stateDir);
+    return stopped;
+}
+export function stopInProcessJudgeSessionBrokers(repoRoot) {
+    if (repoRoot) {
+        return stopRepoJudgeSessionBroker(repoRoot, 'manual_stop');
+    }
+    let stopped = 0;
+    for (const root of listRepoJudgeSessionBrokers()) {
+        stopped += stopRepoJudgeSessionBroker(root, 'manual_stop');
     }
-    return { issues, warnings, notes };
+    return stopped;
 }

package/dist/core/judge-model-discovery.d.ts

@@ -0,0 +1,24 @@
+export interface DiscoverJudgeModelsInput {
+    providerId: string;
+    model: string;
+    endpoint: string | null;
+}
+export interface DiscoverJudgeModelsResult {
+    source: string;
+    modelIds: string[];
+}
+export interface CheckJudgeModelPresenceResult {
+    status: 'found' | 'missing' | 'unverified';
+    source: string;
+}
+export type JudgeModelDiscoveryRunCommand = (command: string, args: string[], timeoutMs: number) => Promise<string>;
+export interface JudgeModelDiscoveryDeps {
+    runCommand?: JudgeModelDiscoveryRunCommand;
+    fetch?: typeof fetch;
+    allowCliDiscovery?: boolean;
+}
+export declare function parseLineModelIds(raw: string): string[];
+export declare function parseJsonModelIds(raw: string): string[];
+export declare function discoverJudgeModels(input: DiscoverJudgeModelsInput, deps?: JudgeModelDiscoveryDeps): Promise<DiscoverJudgeModelsResult>;
+export declare function checkJudgeModelPresence(input: DiscoverJudgeModelsInput, deps?: JudgeModelDiscoveryDeps): Promise<CheckJudgeModelPresenceResult>;
+export declare function modelPresenceFromDiscovery(discovery: DiscoverJudgeModelsResult, model: string): CheckJudgeModelPresenceResult;

package/dist/core/judge-model-discovery.js

@@ -0,0 +1,168 @@
+import { spawn } from 'node:child_process';
+import { getJudgeProviderSpec, inferProviderIdFromConfig, normalizeLegacyProviderId, } from './verdict/judge-catalog.js';
+const MODEL_DISCOVERY_SOURCES = {
+    ollama: 'ollama-tags',
+    codex: 'codex-cli',
+    claude: 'anthropic-models',
+    cursor: 'cursor-agent',
+};
+function providerIdFromInput(providerId) {
+    const normalized = normalizeLegacyProviderId(providerId);
+    if (normalized) {
+        return normalized;
+    }
+    return inferProviderIdFromConfig({ providerId: providerId });
+}
+function defaultAllowCliDiscovery() {
+    if (process.env.BELAY_JUDGE_DISABLE_CLI_TRANSPORT === '1') {
+        return false;
+    }
+    return !process.env.VITEST && !process.env.VITEST_WORKER_ID;
+}
+function resolveDeps(deps) {
+    return {
+        runCommand: deps?.runCommand ?? runCommandCapture,
+        fetchImpl: deps?.fetch ?? fetch,
+        allowCliDiscovery: deps?.allowCliDiscovery ?? defaultAllowCliDiscovery(),
+    };
+}
+async function runCommandCapture(command, args, timeoutMs) {
+    return new Promise((resolve, reject) => {
+        const child = spawn(command, args, { stdio: ['ignore', 'pipe', 'pipe'] });
+        let stdout = '';
+        let stderr = '';
+        const timer = setTimeout(() => {
+            child.kill('SIGTERM');
+            reject(new Error(`${command} timed out`));
+        }, timeoutMs);
+        child.stdout.on('data', (chunk) => {
+            stdout += String(chunk);
+        });
+        child.stderr.on('data', (chunk) => {
+            stderr += String(chunk);
+        });
+        child.on('error', (error) => {
+            clearTimeout(timer);
+            reject(error);
+        });
+        child.on('close', (code) => {
+            clearTimeout(timer);
+            if (code === 0 && stdout.trim()) {
+                resolve(stdout.trim());
+                return;
+            }
+            reject(new Error(stderr.trim() || `${command} exited with code ${code ?? 'unknown'}`));
+        });
+    });
+}
+export function parseLineModelIds(raw) {
+    return raw
+        .split(/\r?\n/)
+        .map((line) => line.trim())
+        .filter(Boolean);
+}
+export function parseJsonModelIds(raw) {
+    try {
+        const parsed = JSON.parse(raw);
+        const entries = Array.isArray(parsed) ? parsed : (parsed.models ?? []);
+        return entries
+            .map((entry) => entry.id?.trim() || entry.name?.trim() || entry.slug?.trim())
+            .filter((id) => Boolean(id));
+    }
+    catch {
+        return parseLineModelIds(raw);
+    }
+}
+async function discoverCursorModels(runCommand) {
+    const raw = await runCommand('cursor-agent', ['--list-models'], 2000);
+    const fromJson = parseJsonModelIds(raw);
+    return fromJson.length > 0 ? fromJson : parseLineModelIds(raw);
+}
+async function discoverCodexModels(runCommand) {
+    const raw = await runCommand('codex', ['debug', 'models'], 2000);
+    const parsed = parseJsonModelIds(raw);
+    if (parsed.length > 0) {
+        return parsed;
+    }
+    return parseLineModelIds(raw).filter((line) => line !== 'visibility=list');
+}
+async function discoverClaudeModels(endpoint, fetchImpl) {
+    const apiKey = process.env.ANTHROPIC_API_KEY?.trim() || process.env.BELAY_JUDGE_API_KEY?.trim();
+    if (!apiKey) {
+        return [];
+    }
+    const base = (endpoint ?? 'https://api.anthropic.com').replace(/\/$/, '');
+    const response = await fetchImpl(`${base}/v1/models`, {
+        headers: {
+            'x-api-key': apiKey,
+            'anthropic-version': '2023-06-01',
+        },
+        signal: AbortSignal.timeout(5000),
+    });
+    if (!response.ok) {
+        return [];
+    }
+    const payload = (await response.json());
+    return (payload.data ?? [])
+        .map((entry) => entry.id?.trim())
+        .filter((id) => Boolean(id));
+}
+export async function discoverJudgeModels(input, deps) {
+    const { runCommand, fetchImpl, allowCliDiscovery } = resolveDeps(deps);
+    const providerId = providerIdFromInput(input.providerId);
+    const source = MODEL_DISCOVERY_SOURCES[providerId];
+    if (providerId === 'ollama' && input.endpoint) {
+        try {
+            const response = await fetchImpl(`${input.endpoint.replace(/\/$/, '')}/api/tags`, {
+                signal: AbortSignal.timeout(3000),
+            });
+            if (!response.ok) {
+                return { source, modelIds: [] };
+            }
+            const payload = (await response.json());
+            const modelIds = (payload.models ?? [])
+                .map((entry) => entry.name?.trim())
+                .filter((name) => Boolean(name));
+            return { source, modelIds };
+        }
+        catch {
+            return { source, modelIds: [] };
+        }
+    }
+    try {
+        if (!allowCliDiscovery) {
+            return { source, modelIds: [] };
+        }
+        if (providerId === 'cursor') {
+            return { source, modelIds: await discoverCursorModels(runCommand) };
+        }
+        if (providerId === 'codex') {
+            return { source, modelIds: await discoverCodexModels(runCommand) };
+        }
+        if (providerId === 'claude') {
+            return { source, modelIds: await discoverClaudeModels(input.endpoint, fetchImpl) };
+        }
+    }
+    catch {
+        return { source, modelIds: [] };
+    }
+    if (getJudgeProviderSpec(providerId)) {
+        return { source, modelIds: [] };
+    }
+    return { source, modelIds: [] };
+}
+export async function checkJudgeModelPresence(input, deps) {
+    const discovery = await discoverJudgeModels(input, deps);
+    return modelPresenceFromDiscovery(discovery, input.model);
+}
+export function modelPresenceFromDiscovery(discovery, model) {
+    if (discovery.modelIds.length === 0) {
+        return { status: 'unverified', source: discovery.source };
+    }
+    const requested = model.trim();
+    const found = discovery.modelIds.some((id) => id === requested || id.startsWith(`${requested}:`));
+    return {
+        status: found ? 'found' : 'missing',
+        source: discovery.source,
+    };
+}

package/dist/core/judge-model-policy.d.ts

@@ -0,0 +1,5 @@
+export declare function isDeprecatedJudgeModelAuto(model: string | undefined): boolean;
+export declare function rejectDeprecatedJudgeModelAuto(model: string | undefined): void;
+export declare function warnDeprecatedJudgeModelAuto(): void;
+/** @internal test helper */
+export declare function resetDeprecatedJudgeModelAutoWarningForTests(): void;

package/dist/core/judge-model-policy.js

@@ -0,0 +1,21 @@
+const DEPRECATED_JUDGE_MODEL_AUTO = 'auto';
+export function isDeprecatedJudgeModelAuto(model) {
+    return model?.trim().toLowerCase() === DEPRECATED_JUDGE_MODEL_AUTO;
+}
+export function rejectDeprecatedJudgeModelAuto(model) {
+    if (isDeprecatedJudgeModelAuto(model)) {
+        throw new Error('judge model "auto" is no longer accepted. Use a concrete model id from belay judge list or the provider catalog default.');
+    }
+}
+let warnedDeprecatedAuto = false;
+export function warnDeprecatedJudgeModelAuto() {
+    if (warnedDeprecatedAuto) {
+        return;
+    }
+    warnedDeprecatedAuto = true;
+    process.stderr.write('Warning: judge.model "auto" is deprecated; normalized to the provider catalog default on load. Set a concrete model id with belay config set judge.model <id>.\n');
+}
+/** @internal test helper */
+export function resetDeprecatedJudgeModelAutoWarningForTests() {
+    warnedDeprecatedAuto = false;
+}

package/dist/core/judge-runtime-detection.d.ts

@@ -0,0 +1,9 @@
+import type { BelayJudgeConfig } from './config.js';
+import type { Tier1JudgeTransport } from './verdict/judge.js';
+import { type JudgeProviderId } from './verdict/judge-catalog.js';
+export interface JudgeRuntimeCapabilities {
+    http: boolean;
+    cliTransport: Tier1JudgeTransport | null;
+}
+export declare function detectJudgeRuntimeCapabilities(providerId: JudgeProviderId | string, env?: NodeJS.ProcessEnv): JudgeRuntimeCapabilities;
+export declare function resolveJudgeTransport(judge: Pick<BelayJudgeConfig, 'providerId' | 'provider' | 'model' | 'endpoint'>, env?: NodeJS.ProcessEnv): Tier1JudgeTransport;

package/dist/core/judge-runtime-detection.js

@@ -0,0 +1,68 @@
+import { accessSync, constants } from 'node:fs';
+import path from 'node:path';
+import { inferProviderIdFromConfig, normalizeLegacyProviderId, } from './verdict/judge-catalog.js';
+const CLI_COMMANDS = {
+    codex: 'codex',
+    cursor: 'cursor-agent',
+    claude: 'claude',
+};
+function isVitestRuntime(env) {
+    return Boolean(env.VITEST || env.VITEST_WORKER_ID);
+}
+function cliTransportForProvider(providerId) {
+    if (providerId === 'ollama') {
+        return null;
+    }
+    return `${providerId}-cli`;
+}
+function commandOnPath(command, env) {
+    const pathValue = env.PATH ?? '';
+    for (const dir of pathValue.split(path.delimiter).filter(Boolean)) {
+        const candidate = path.join(dir, command);
+        try {
+            accessSync(candidate, constants.X_OK);
+            return true;
+        }
+        catch {
+            // try next PATH entry
+        }
+    }
+    return false;
+}
+function providerIdFromJudge(judge) {
+    if (judge.providerId && normalizeLegacyProviderId(judge.providerId)) {
+        return normalizeLegacyProviderId(judge.providerId);
+    }
+    return inferProviderIdFromConfig(judge);
+}
+export function detectJudgeRuntimeCapabilities(providerId, env = process.env) {
+    const normalized = normalizeLegacyProviderId(String(providerId));
+    if (!normalized || normalized === 'ollama') {
+        return { http: false, cliTransport: null };
+    }
+    if (env.BELAY_JUDGE_DISABLE_CLI_TRANSPORT === '1') {
+        return { http: true, cliTransport: null };
+    }
+    if (isVitestRuntime(env)) {
+        return { http: false, cliTransport: cliTransportForProvider(normalized) };
+    }
+    const command = CLI_COMMANDS[normalized];
+    if (commandOnPath(command, env)) {
+        return { http: false, cliTransport: cliTransportForProvider(normalized) };
+    }
+    return { http: true, cliTransport: null };
+}
+export function resolveJudgeTransport(judge, env = process.env) {
+    const providerId = providerIdFromJudge(judge);
+    if (providerId === 'ollama') {
+        return 'ollama-http';
+    }
+    if (judge.endpoint?.trim()) {
+        return 'http';
+    }
+    const caps = detectJudgeRuntimeCapabilities(providerId, env);
+    if (caps.cliTransport) {
+        return caps.cliTransport;
+    }
+    return 'unavailable';
+}

package/dist/core/path-utils.d.ts

@@ -7,6 +7,17 @@
 export declare function canonicalPath(targetPath: string): string;
 export declare function pathWithinRoot(root: string, targetPath: string): boolean;
 export declare function relativeWithinRepo(repoRoot: string, targetPath: string): string | null;
+export type WorkspaceRootMatch = {
+    kind: 'repo';
+    root: string;
+    relativePath: string;
+} | {
+    kind: 'trusted';
+    root: string;
+    relativePath: string;
+};
+export declare function resolveWorkspaceRootMatch(repoRoot: string, trustedRoots: string[] | undefined, targetPath: string): WorkspaceRootMatch | null;
 export declare function normalizeToken(token: string, repoRoot: string): string;
 export declare function resolveMutationTarget(token: string, cwd: string): string | null;
 export declare function hasOutsideRepoPath(tokens: string[], cwd: string, repoRoot: string): boolean;
+export declare function containingGitRoot(targetPath: string): string | null;