@guilz-dev/belay 0.2.0 → 0.4.0

package/dist/cli.js

@@ -6,13 +6,17 @@ import { auditProject, formatAuditReport } from './commands/audit.js';
 import { doctorProject, formatDoctorReport } from './commands/doctor.js';
 import { dogfoodProject, formatDogfoodResult } from './commands/dogfood.js';
 import { explainCommand, formatExplainReport } from './commands/explain.js';
+import { formatHarvestReport, harvestApplyProject, harvestListProject } from './commands/harvest.js';
 import { formatMetricsReport, metricsProject } from './commands/metrics.js';
+import { formatQualityReport, qualityCheck } from './commands/quality.js';
 import { formatRecoverReport, recoverProject } from './commands/recover.js';
 import { formatReport, reportProject } from './commands/report.js';
 import { revokeApproval } from './commands/revoke.js';
 import { formatSimulateReport, simulateProject } from './commands/simulate.js';
+import { revokeStandingAllow } from './commands/standing-allow.js';
 import { formatStatusReport, statusProject } from './commands/status.js';
 import { loadConfigFile } from './config-io.js';
+import { rejectDeprecatedJudgeModelAuto } from './core/judge-model-policy.js';
 import { initProject, upgradeProject } from './installer.js';
 import { egressEnv, egressStatus, formatEgressStatusReport, startEgressProxy, stopEgressProxy, } from './services/egress-service.js';
 import { formatSandboxStatusReport, sandboxStatus } from './services/sandbox-service.js';
@@ -64,6 +68,7 @@ function parseArgs(argv) {
             continue;
         }
         if (token === '--judge-profile') {
+            process.stderr.write('Warning: --judge-profile is deprecated; use belay config set judge.providerId <id> after init.\n');
             const next = rest[index + 1];
             if (!next || !['local-ollama', 'cursor', 'claude', 'codex'].includes(next)) {
                 throw new Error('--judge-profile requires local-ollama, cursor, claude, or codex.');
@@ -93,8 +98,9 @@ function parseArgs(argv) {
         if (token === '--judge-model') {
             const next = rest[index + 1];
             if (!next) {
-                throw new Error('--judge-model requires a model id or auto.');
+                throw new Error('--judge-model requires a model id.');
             }
+            rejectDeprecatedJudgeModelAuto(next);
             options.judgeModel = next;
             index += 1;
             continue;
@@ -103,6 +109,61 @@ function parseArgs(argv) {
             options.acceptCloudJudge = true;
             continue;
         }
+        if (token === '--migrate-judge-default') {
+            options.migrateJudgeDefault = true;
+            continue;
+        }
+        if (token === '--accept-cloud') {
+            options.acceptCloud = true;
+            continue;
+        }
+        if (token === '--cloud-consent-approval-id') {
+            const next = rest[index + 1];
+            if (!next) {
+                throw new Error('--cloud-consent-approval-id requires an approval id.');
+            }
+            options.cloudConsentApprovalId = next;
+            index += 1;
+            continue;
+        }
+        if (token === '--credential') {
+            const next = rest[index + 1];
+            if (!next || !['project', 'apiKey'].includes(next)) {
+                throw new Error('--credential requires project or apiKey.');
+            }
+            options.credentialMode = next;
+            index += 1;
+            continue;
+        }
+        if (token === '--key-stdin') {
+            options.keyStdin = true;
+            continue;
+        }
+        if (token === '--key-env') {
+            const next = rest[index + 1];
+            if (!next) {
+                throw new Error('--key-env requires an environment variable name.');
+            }
+            options.keyEnv = next;
+            index += 1;
+            continue;
+        }
+        if (token === '--timeout') {
+            const next = rest[index + 1];
+            if (!next) {
+                throw new Error('--timeout requires milliseconds.');
+            }
+            options.judgeTimeoutMs = Number(next);
+            index += 1;
+            continue;
+        }
+        if (token === '--live-probe') {
+            if (command !== 'judge') {
+                throw new Error('--live-probe is only valid for judge test.');
+            }
+            options.judgeLiveProbe = true;
+            continue;
+        }
         if (token === '--json') {
             options.json = true;
             continue;
@@ -127,6 +188,24 @@ function parseArgs(argv) {
             index += 1;
             continue;
         }
+        if (token === '--outcome') {
+            const next = rest[index + 1];
+            if (!next || !['provably-benign', 'accepted-benign', 'reject'].includes(next)) {
+                throw new Error('--outcome requires provably-benign, accepted-benign, or reject.');
+            }
+            options.harvestOutcome = next;
+            index += 1;
+            continue;
+        }
+        if (token === '--corpus') {
+            const next = rest[index + 1];
+            if (!next) {
+                throw new Error('--corpus requires a path.');
+            }
+            options.corpusPath = next;
+            index += 1;
+            continue;
+        }
         if (token === '--kind') {
             const next = rest[index + 1];
             if (!next) {
@@ -201,11 +280,18 @@ function parseArgs(argv) {
             index += 1;
             continue;
         }
+        if (token === '--replay') {
+            if (command !== 'approve') {
+                throw new Error('--replay is only valid for approve.');
+            }
+            options.approveReplay = true;
+            continue;
+        }
         if (token === '--scope') {
             const next = rest[index + 1];
             if (command === 'approve') {
-                if (!next || !['once', 'domain', 'path'].includes(next)) {
-                    throw new Error('--scope requires once, domain, or path.');
+                if (!next || !['once', 'domain', 'path', 'workspace-root'].includes(next)) {
+                    throw new Error('--scope requires once, domain, path, or workspace-root.');
                 }
                 options.approveScope = next;
             }
@@ -264,6 +350,9 @@ function parseArgs(argv) {
             if (command === 'recover') {
                 options.recoverCommand = next;
             }
+            else if (command === 'harvest') {
+                options.harvestCommand = next;
+            }
             else {
                 options.explainCommand = next;
             }
@@ -316,6 +405,84 @@ function parseArgs(argv) {
             }
             throw new Error('sandbox requires subcommand: status');
         }
+        if (command === 'standing-allow' && !options.standingAllowSubcommand) {
+            if (token === 'revoke') {
+                options.standingAllowSubcommand = token;
+                continue;
+            }
+            throw new Error('standing-allow requires subcommand: revoke');
+        }
+        if (command === 'harvest' && !options.harvestSubcommand) {
+            if (token === 'list' || token === 'apply') {
+                options.harvestSubcommand = token;
+                continue;
+            }
+            throw new Error('harvest requires subcommand: list or apply');
+        }
+        if (command === 'judge' && !options.judgeSubcommand) {
+            if (token === 'status' ||
+                token === 'list' ||
+                token === 'use' ||
+                token === 'test' ||
+                token === 'bench' ||
+                token === 'consent') {
+                options.judgeSubcommand = token;
+                continue;
+            }
+            throw new Error('judge requires subcommand: status, list, use, test, bench, or consent');
+        }
+        if (command === 'config' && !options.configSubcommand) {
+            if (token === 'list' ||
+                token === 'get' ||
+                token === 'set' ||
+                token === 'unset' ||
+                token === 'credential' ||
+                token === 'judge') {
+                options.configSubcommand = token;
+                continue;
+            }
+            throw new Error('config requires subcommand: list, get, set, unset, credential, or judge');
+        }
+        if (command === 'config' &&
+            options.configSubcommand === 'credential' &&
+            !options.credentialAction) {
+            if (token === 'mode' || token === 'set' || token === 'clear') {
+                options.credentialAction = token;
+                continue;
+            }
+            throw new Error('config credential requires action: mode, set, or clear');
+        }
+        if (command === 'config' &&
+            options.configSubcommand === 'credential' &&
+            options.credentialAction === 'mode' &&
+            !options.credentialMode) {
+            if (token === 'project' || token === 'apiKey') {
+                options.credentialMode = token;
+                continue;
+            }
+            throw new Error('config credential mode requires project or apiKey');
+        }
+        if (command === 'config' &&
+            (options.configSubcommand === 'get' ||
+                options.configSubcommand === 'set' ||
+                options.configSubcommand === 'unset') &&
+            !options.configKey) {
+            options.configKey = token;
+            continue;
+        }
+        if (command === 'config' &&
+            options.configSubcommand === 'set' &&
+            options.configKey &&
+            !options.configValue) {
+            options.configValue = token;
+            continue;
+        }
+        if (command === 'judge' &&
+            (options.judgeSubcommand === 'use' || options.judgeSubcommand === 'consent') &&
+            !options.judgeUseProvider) {
+            options.judgeUseProvider = token;
+            continue;
+        }
         if ((command === 'revoke' || command === 'approve') && !options.approvalId) {
             options.approvalId = token;
             continue;
@@ -329,13 +496,22 @@ function printHelp() {
     process.stdout.write(`${c}
 
 Usage:
-  ${c} init [--target <dir>] [--adapter cursor|claude|codex] [--scope project|global] [--preset strict|standard|audit-first|l1-full-recommended] [--judge-profile local-ollama|cursor|claude|codex] [--judge-provider ollama|openai-compatible] [--judge-model <id|auto>] [--judge-endpoint <url>] [--accept-cloud-judge] [--with-skill] [--dogfood]
-  ${c} init-wizard [--target <dir>]
+  ${c} init [--target <dir>] [--adapter cursor|claude|codex] [--scope project|global] [--preset strict|standard|audit-first|l1-full-recommended] [--judge-profile local-ollama|cursor|claude|codex] [--judge-provider ollama|openai-compatible] [--judge-model <id>] [--judge-endpoint <url>] [--accept-cloud-judge] [--migrate-judge-default] [--with-skill] [--dogfood]
+  ${c} config [--target <dir>] [--json]
+  ${c} config list|get|set|unset|judge [--target <dir>] [--json]
+  ${c} config get <judge.path> [--target <dir>] [--json]
+  ${c} config set <judge.path> <value> [--target <dir>]
+  ${c} config unset <judge.path> [--target <dir>]
+  ${c} config credential mode <project|apiKey> [--target <dir>]
+  ${c} config credential set [--key-stdin] [--key-env <NAME>] [--target <dir>]
+  ${c} config credential clear [--target <dir>]
+  (--adapter selects host; fresh init picks matching judge providerId: cursor/claude/codex)
   (--dogfood runs after --preset and sets mode: audit, overriding preset enforce mode)
-  ${c} upgrade [--target <dir>] [--adapter cursor|claude|codex] [--scope project|global] [--with-skill]
+  ${c} upgrade [--target <dir>] [--adapter cursor|claude|codex] [--scope project|global] [--with-skill] [--migrate-judge-default]
   ${c} dogfood [--target <dir>] [--adapter cursor|claude|codex] [--enforce] [--force]
   ${c} doctor [--target <dir>] [--adapter cursor|claude|codex] [--json] [--fix] [--dry-run]
   ${c} metrics [--target <dir>] [--json]
+  ${c} quality [--target <dir>] [--corpus <path>] [--json]
   ${c} report [--target <dir>] [--since <iso>] [--until <iso>] [--limit <n>] [--json]
   ${c} recover [--target <dir>] [--since <iso>] [--fingerprint <fp>] [--command "<text>"] [--limit <n>] [--json]
     (--limit picks the Nth recover candidate after priority ranking: local_mutation first, then recency; 1 = highest priority, default 1)
@@ -345,8 +521,15 @@ Usage:
   ${c} explain [--target <dir>] [--cwd <dir>] [--kind shell|tool|subagent] [--tool <name>] [--payload-json <json>] [--command <text>] [--json] [-- <command>]
   ${c} egress <start|stop|status|env> [--target <dir>] [--json]
   ${c} sandbox status [--target <dir>] [--json]
-  ${c} approve <approval-id> [--scope once|domain|path] [--path <path>] [--token <signed-token>] [--target <dir>]
+  ${c} judge <status|list|use|test|bench|consent> [--target <dir>] [--json]
+  ${c} judge test [--target <dir>] [--json] [--live-probe]
+  ${c} judge use <ollama|codex|claude|cursor> [--model <id>] [--endpoint <url>] [--timeout <ms>] [--accept-cloud] [--cloud-consent-approval-id <id>] [--credential project|apiKey] [--key-stdin] [--key-env <NAME>]
+  ${c} judge consent <ollama|codex|claude|cursor> [--endpoint <url>]
+  ${c} approve <approval-id> [--replay] [--scope once|domain|path|workspace-root] [--path <path>] [--token <signed-token>] [--target <dir>]
   ${c} revoke <approval-id> [--target <dir>]
+  ${c} standing-allow revoke --fingerprint <fp> [--kind shell|tool|subagent] [--target <dir>]
+  ${c} harvest list [--target <dir>] [--since <iso>] [--until <iso>] [--json]
+  ${c} harvest apply --command "<text>" --outcome provably-benign|accepted-benign|reject [--reason <r>] [--corpus <path>] [--target <dir>]
 `);
 }
 async function main() {
@@ -360,10 +543,10 @@ async function main() {
             process.stdout.write(`${PACKAGE_VERSION}\n`);
             return;
         }
-        if (command === 'init-wizard') {
-            const { runInitWizard } = await import('./commands/init-wizard.js');
-            const result = await runInitWizard({ targetDir: options.targetDir });
-            process.stdout.write(`Initialized belay in ${result.repoRoot}${result.withSkill ? ' (with skill)' : ''}.\n`);
+        const DEPRECATED_COMMANDS = new Set(['init-wizard']);
+        if (DEPRECATED_COMMANDS.has(command)) {
+            process.stderr.write(`${command} is removed. Use \`belay config\` for interactive setup, or \`belay init\` for non-interactive install.\n`);
+            process.exitCode = 1;
             return;
         }
         if (command === 'init') {
@@ -379,6 +562,7 @@ async function main() {
                 judgeModel: options.judgeModel,
                 judgeEndpoint: options.judgeEndpoint,
                 acceptCloudJudge: options.acceptCloudJudge,
+                migrateJudgeDefault: options.migrateJudgeDefault,
             });
             const extras = [
                 `adapter=${result.adapter}`,
@@ -405,6 +589,7 @@ async function main() {
                 withSkill: options.withSkill,
                 adapter: options.adapter,
                 scope: options.installScope,
+                migrateJudgeDefault: options.migrateJudgeDefault,
             });
             const upgraded = await loadConfigFile(result.repoRoot, result.adapter);
             if (upgraded.policy.modelAssist.enabled) {
@@ -413,6 +598,73 @@ async function main() {
             process.stdout.write(`Upgraded belay (${result.adapter}) in ${result.repoRoot}.\n`);
             return;
         }
+        if (command === 'judge') {
+            const { runJudgeCommand } = await import('./commands/judge.js');
+            if (!options.judgeSubcommand) {
+                throw new Error('judge requires subcommand: status, list, use, or test');
+            }
+            if (options.judgeLiveProbe && options.judgeSubcommand !== 'test') {
+                throw new Error('--live-probe is only valid for judge test.');
+            }
+            const result = await runJudgeCommand({
+                targetDir: options.targetDir,
+                json: options.json,
+                subcommand: options.judgeSubcommand,
+                providerId: options.judgeUseProvider,
+                model: options.judgeModel,
+                endpoint: options.judgeEndpoint,
+                timeoutMs: options.judgeTimeoutMs,
+                acceptCloud: options.acceptCloud,
+                cloudConsentApprovalId: options.cloudConsentApprovalId,
+                credentialMode: options.credentialMode,
+                keyStdin: options.keyStdin,
+                keyEnv: options.keyEnv,
+                liveProbe: options.judgeLiveProbe,
+            });
+            if (options.json && typeof result === 'object') {
+                process.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
+            }
+            else {
+                process.stdout.write(`${String(result)}\n`);
+            }
+            return;
+        }
+        if (command === 'config') {
+            if (options.configSubcommand === 'credential') {
+                if (!options.credentialAction) {
+                    throw new Error('config credential requires action: mode, set, or clear');
+                }
+                const { runBelayConfigCredential } = await import('./commands/config.js');
+                const result = await runBelayConfigCredential({
+                    targetDir: options.targetDir,
+                    action: options.credentialAction,
+                    mode: options.credentialMode,
+                    keyStdin: options.keyStdin,
+                    keyEnv: options.keyEnv,
+                });
+                process.stdout.write(`${String(result)}\n`);
+                return;
+            }
+            const { runBelayConfig } = await import('./commands/config.js');
+            const result = await runBelayConfig({
+                targetDir: options.targetDir,
+                subcommand: options.configSubcommand,
+                path: options.configKey,
+                value: options.configValue,
+                json: options.json,
+            });
+            if (options.json && typeof result === 'object') {
+                process.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
+            }
+            else if (typeof result === 'object' && result && 'repoRoot' in result) {
+                const initResult = result;
+                process.stdout.write(`Initialized belay in ${initResult.repoRoot}${initResult.withSkill ? ' (with skill)' : ''}.\n`);
+            }
+            else {
+                process.stdout.write(`${String(result)}\n`);
+            }
+            return;
+        }
         if (command === 'doctor') {
             const report = await doctorProject({
                 targetDir: options.targetDir,
@@ -489,6 +741,21 @@ async function main() {
             }
             return;
         }
+        if (command === 'quality') {
+            const report = await qualityCheck({
+                targetDir: options.targetDir,
+                corpusDir: options.corpusPath,
+                json: options.json,
+            });
+            if (options.json) {
+                process.stdout.write(`${JSON.stringify(report, null, 2)}\n`);
+            }
+            else {
+                process.stdout.write(`${formatQualityReport(report)}\n`);
+            }
+            process.exitCode = report.ok ? 0 : 1;
+            return;
+        }
         if (command === 'report') {
             const report = await reportProject({
                 targetDir: options.targetDir,
@@ -505,6 +772,42 @@ async function main() {
             }
             return;
         }
+        if (command === 'harvest') {
+            if (options.harvestSubcommand === 'list') {
+                const report = await harvestListProject({
+                    targetDir: options.targetDir,
+                    since: options.since,
+                    until: options.until,
+                    json: options.json,
+                });
+                if (options.json) {
+                    process.stdout.write(`${JSON.stringify(report, null, 2)}\n`);
+                }
+                else {
+                    process.stdout.write(`${formatHarvestReport(report)}\n`);
+                }
+                return;
+            }
+            if (options.harvestSubcommand === 'apply') {
+                if (!options.harvestCommand) {
+                    throw new Error('harvest apply requires --command.');
+                }
+                if (!options.harvestOutcome) {
+                    throw new Error('harvest apply requires --outcome.');
+                }
+                const result = await harvestApplyProject({
+                    targetDir: options.targetDir,
+                    command: options.harvestCommand,
+                    outcome: options.harvestOutcome,
+                    reason: options.reason,
+                    corpusPath: options.corpusPath,
+                });
+                process.stdout.write(`${result.message}\n`);
+                process.exitCode = result.ok ? 0 : 1;
+                return;
+            }
+            throw new Error('harvest requires subcommand: list or apply');
+        }
         if (command === 'recover') {
             const report = await recoverProject({
                 targetDir: options.targetDir,
@@ -614,6 +917,7 @@ async function main() {
                 token: options.approvalToken,
                 scope: options.approveScope,
                 scopePath: options.approvePath,
+                replay: options.approveReplay,
             });
             process.stdout.write(`${result.message}\n`);
             process.exitCode = result.ok ? 0 : 1;
@@ -631,6 +935,24 @@ async function main() {
             process.exitCode = result.ok ? 0 : 1;
             return;
         }
+        if (command === 'standing-allow') {
+            if (options.standingAllowSubcommand === 'revoke') {
+                if (!options.fingerprint) {
+                    throw new Error('standing-allow revoke requires --fingerprint.');
+                }
+                const result = await revokeStandingAllow({
+                    targetDir: options.targetDir,
+                    fingerprint: options.fingerprint,
+                    kind: options.kind === 'tool' || options.kind === 'subagent' || options.kind === 'shell'
+                        ? options.kind
+                        : undefined,
+                });
+                process.stdout.write(`${result.message}\n`);
+                process.exitCode = result.ok ? 0 : 1;
+                return;
+            }
+            throw new Error('standing-allow requires subcommand: revoke');
+        }
         throw new Error(`Unknown command: ${command}`);
     }
     catch (error) {

package/dist/commands/approve.d.ts

@@ -7,6 +7,7 @@ export interface ApproveOptions {
     token?: string;
     scope?: ApproveScope;
     scopePath?: string;
+    replay?: boolean;
 }
 export declare function approvePending(options: ApproveOptions): Promise<{
     ok: boolean;

package/dist/commands/approve.js

@@ -1,6 +1,8 @@
 import path from 'node:path';
-import { approvedApprovalsPath, loadApprovalState, loadConfigFile, pendingApprovalsPath, saveApprovalState, } from '../config-io.js';
-import { recordApproval } from '../core/approval-service.js';
+import { loadApprovalState, loadConfigFile } from '../config-io.js';
+import { canAutoReplay, getExecutionLeaseMs, replayShellCommand } from '../core/approval-replay.js';
+import { consumeApprovedAfterCliReplay, createGateApprovalStore, recordApproval, } from '../core/approval-service.js';
+import { JUDGE_CLOUD_CONSENT_REASON } from '../core/capability/reasons.js';
 import { recordCapabilityApproval } from '../core/capability-approval.js';
 import { recordEgressApproval } from '../core/egress-approval.js';
 import { createEgressApprovalStore } from '../services/egress-service.js';
@@ -10,6 +12,16 @@ export async function approvePending(options) {
     const config = await loadConfigFile(repoRoot);
     const pending = await loadApprovalState(repoRoot, 'pending-approvals.json', config);
     const match = pending.approvals.find((approval) => approval.approvalId === options.approvalId);
+    if (match?.reason === JUDGE_CLOUD_CONSENT_REASON) {
+        const result = await recordCapabilityApproval({
+            approvalId: options.approvalId,
+            config,
+            token: options.token,
+            requireSignedToken: config.approvalSigning.required,
+            store: createCapabilityApprovalStore(repoRoot, config),
+        });
+        return { ok: result.ok, message: result.message };
+    }
     if (match?.kind === 'egress') {
         const result = await recordEgressApproval({
             approvalId: options.approvalId,
@@ -21,11 +33,11 @@ export async function approvePending(options) {
         });
         return { ok: result.ok, message: result.message };
     }
-    if (options.scope === 'path') {
+    if (options.scope === 'path' || options.scope === 'workspace-root') {
         const result = await recordCapabilityApproval({
             approvalId: options.approvalId,
             config,
-            scope: 'path',
+            scope: options.scope,
             scopePath: options.scopePath,
             token: options.token,
             requireSignedToken: config.approvalSigning.required,
@@ -33,33 +45,51 @@ export async function approvePending(options) {
         });
         return { ok: result.ok, message: result.message };
     }
+    const approvalStore = createGateApprovalStore(repoRoot, config);
     const result = await recordApproval({
         approvalId: options.approvalId,
         config,
         token: options.token,
         requireSignedToken: config.approvalSigning.required,
-        store: {
-            async loadPending() {
-                const filePath = pendingApprovalsPath(repoRoot, config);
-                return {
-                    filePath,
-                    state: await loadApprovalState(repoRoot, 'pending-approvals.json', config),
-                };
-            },
-            async loadApproved() {
-                const filePath = approvedApprovalsPath(repoRoot, config);
-                return {
-                    filePath,
-                    state: await loadApprovalState(repoRoot, 'approved-approvals.json', config),
-                };
-            },
-            async writePending(_filePath, state) {
-                await saveApprovalState(repoRoot, 'pending-approvals.json', state, config);
-            },
-            async writeApproved(_filePath, state) {
-                await saveApprovalState(repoRoot, 'approved-approvals.json', state, config);
-            },
-        },
+        store: approvalStore,
     });
+    if (!result.ok) {
+        return { ok: result.ok, message: result.message };
+    }
+    if (options.replay) {
+        const approval = result.approval;
+        if (!approval) {
+            return { ok: false, message: 'Approval recorded but replay envelope is missing.' };
+        }
+        if (!canAutoReplay(config, approval.kind)) {
+            return {
+                ok: false,
+                message: 'Replay is not enabled for this approval kind. Retry the original action manually or enable approval.autoReplayScopes.',
+            };
+        }
+        if (approval.kind !== 'shell' || !approval.input) {
+            return {
+                ok: false,
+                message: 'CLI replay is only supported for shell approvals. Retry the original tool or subagent action manually.',
+            };
+        }
+        const replayResult = await replayShellCommand(approval.input, approval.cwd ?? repoRoot, getExecutionLeaseMs(config));
+        const output = [replayResult.stdout, replayResult.stderr].filter(Boolean).join('\n').trim();
+        if (replayResult.exitCode === 0) {
+            await consumeApprovedAfterCliReplay({
+                approvalId: options.approvalId,
+                store: approvalStore,
+            });
+            return {
+                ok: true,
+                message: `Belay replay succeeded for ${options.approvalId}. Do not retry via hooks; the one-shot grant was consumed.${output ? `\n${output}` : ''}`,
+            };
+        }
+        const timeoutNote = replayResult.timedOut ? ' Replay timed out.' : '';
+        return {
+            ok: false,
+            message: `Belay replay failed for ${options.approvalId} (exit ${replayResult.exitCode}).${timeoutNote} Approval remains active for one hook retry.${output ? `\n${output}` : ''}`,
+        };
+    }
     return { ok: result.ok, message: result.message };
 }

package/dist/commands/config.d.ts

@@ -0,0 +1,70 @@
+import { type JudgeProviderId } from '../core/verdict/judge-catalog.js';
+import type { AdapterName, InitOptions } from '../types.js';
+export declare const BELAY_CONFIG_SUBCOMMANDS: readonly ["list", "get", "set", "unset", "credential", "judge"];
+export type BelayConfigSubcommand = (typeof BELAY_CONFIG_SUBCOMMANDS)[number];
+export interface BelayConfigOptions {
+    targetDir?: string;
+    subcommand?: BelayConfigSubcommand;
+    path?: string;
+    value?: string;
+    json?: boolean;
+}
+export interface BelayConfigCredentialOptions {
+    targetDir?: string;
+    action: 'mode' | 'set' | 'clear';
+    mode?: 'project' | 'apiKey';
+    keyStdin?: boolean;
+    keyEnv?: string;
+}
+export interface ConfigWizardAnswers {
+    adapter: AdapterName;
+    scope: 'project' | 'global';
+    withSkill: boolean;
+    judgeProviderId: JudgeProviderId;
+    judgeCredentialMode?: 'project' | 'apiKey';
+    judgeEndpoint?: string;
+    acceptCloud: boolean;
+    dogfood: boolean;
+}
+export declare function parseAdapter(value: string | undefined): AdapterName;
+export declare function parseScope(value: string | undefined): 'project' | 'global';
+export declare function parseYesNo(value: string | undefined, defaultValue: boolean): boolean;
+export declare function parseJudgeProviderId(value: string | undefined, defaultId: JudgeProviderId | string): JudgeProviderId;
+export declare function buildInitOptionsFromConfigAnswers(answers: ConfigWizardAnswers, targetDir?: string): InitOptions;
+export declare function runBelayConfigCredential(options: BelayConfigCredentialOptions): Promise<string>;
+export interface BelayConfigInteractiveOptions {
+    targetDir?: string;
+    /** @internal test helper — canned readline answers in order */
+    prompts?: string[];
+    /** Suppress the interactive header when nested under runBelayConfigInteractive */
+    skipBanner?: boolean;
+}
+export declare function resolveBelayConfigInteractiveMode(repoRoot: string): Promise<'full' | 'judge-only'>;
+export declare function runBelayConfigFullInteractive(options?: BelayConfigInteractiveOptions): Promise<{
+    repoRoot: string;
+    withSkill: boolean;
+    dogfood: boolean;
+    adapter: AdapterName;
+}>;
+export declare function runBelayConfigJudgeOnlyInteractive(options?: BelayConfigInteractiveOptions): Promise<{
+    repoRoot: string;
+    adapter: AdapterName;
+}>;
+export declare function runBelayConfigInteractive(options?: BelayConfigInteractiveOptions): Promise<{
+    repoRoot: string;
+    adapter: AdapterName;
+}>;
+export declare function runBelayConfig(options?: BelayConfigOptions): Promise<string | Record<string, unknown> | {
+    providerId: import("../core/config.js").JudgeProviderId | import("../core/config.js").DeprecatedJudgeProviderId | undefined;
+    provider: import("../core/config.js").JudgeProvider;
+    endpoint: string | null;
+    model: string;
+    modelResolved: string;
+    transport: import("../core/verdict/judge.js").Tier1JudgeTransport;
+    credential: import("../core/judge-api-key.js").ResolvedJudgeCredential;
+    cloudConsent: import("../core/config.js").JudgeCloudConsent | null;
+    cloudJudgeActive: boolean;
+} | {
+    repoRoot: string;
+    adapter: AdapterName;
+}>;