@guilz-dev/belay 0.2.0 → 0.4.0

package/dist/commands/config.js

@@ -0,0 +1,577 @@
+import path from 'node:path';
+import { stdin as input, stdout as output } from 'node:process';
+import readline from 'node:readline/promises';
+import { loadConfigFile, repoLocalStateDirFor, resolveAdapterName, writeConfigFile, } from '../config-io.js';
+import { appendCliAuditEvent } from '../core/audit-io.js';
+import { belayStateDir, normalizeJudgeConfig } from '../core/config.js';
+import { clearJudgeCredentialStore, writeJudgeCredentialStore } from '../core/credential-store.js';
+import { refreshIntegrityIfPinned } from '../core/integrity.js';
+import { defaultJudgeProviderForAdapter, hasValidCloudConsent, isCloudJudgeConfig, resolveJudgeUsePatch, } from '../core/judge-config.js';
+import { rejectDeprecatedJudgeModelAuto } from '../core/judge-model-policy.js';
+import { resolveJudgeTransport } from '../core/judge-runtime-detection.js';
+import { isJudgeProviderId, JUDGE_PROVIDER_IDS, normalizeLegacyProviderId, } from '../core/verdict/judge-catalog.js';
+import { initProject } from '../installer.js';
+import { isBelayFloorInstalled } from './health-snapshot.js';
+import { judgeStatus } from './judge.js';
+import { readKeyFromStdin } from './stdin-key.js';
+import { confirmPrompt, intro, isInteractiveTTY, selectPrompt } from './tui.js';
+export const BELAY_CONFIG_SUBCOMMANDS = [
+    'list',
+    'get',
+    'set',
+    'unset',
+    'credential',
+    'judge',
+];
+const JUDGE_CONFIG_PATHS = [
+    'judge.providerId',
+    'judge.provider',
+    'judge.model',
+    'judge.endpoint',
+    'judge.timeoutMs',
+    'judge.credential.mode',
+    'judge.credential.ref',
+];
+export function parseAdapter(value) {
+    const normalized = (value?.trim() || 'cursor').toLowerCase();
+    if (normalized === 'claude' || normalized === 'codex' || normalized === 'cursor') {
+        return normalized;
+    }
+    throw new Error(`Unknown adapter: ${value ?? '(empty)'}`);
+}
+export function parseScope(value) {
+    const normalized = (value?.trim() || 'project').toLowerCase();
+    if (normalized === 'global' || normalized === 'project') {
+        return normalized;
+    }
+    throw new Error(`Unknown scope: ${value ?? '(empty)'}`);
+}
+export function parseYesNo(value, defaultValue) {
+    const normalized = (value?.trim() || (defaultValue ? 'y' : 'n')).toLowerCase();
+    if (['y', 'yes', 'true', '1'].includes(normalized)) {
+        return true;
+    }
+    if (['n', 'no', 'false', '0'].includes(normalized)) {
+        return false;
+    }
+    return defaultValue;
+}
+export function parseJudgeProviderId(value, defaultId) {
+    const normalized = (value?.trim() || defaultId).toLowerCase();
+    const canonical = normalizeLegacyProviderId(normalized);
+    if (canonical) {
+        return canonical;
+    }
+    throw new Error(`Unknown judge provider: ${value ?? '(empty)'}`);
+}
+export function buildInitOptionsFromConfigAnswers(answers, targetDir) {
+    return {
+        targetDir,
+        adapter: answers.adapter,
+        scope: answers.scope,
+        withSkill: answers.withSkill,
+        judgeProviderId: answers.judgeProviderId,
+        judgeEndpoint: answers.judgeEndpoint,
+        judgeCredentialMode: answers.judgeCredentialMode,
+        acceptCloudJudge: answers.acceptCloud,
+        dogfood: answers.dogfood,
+    };
+}
+function assertJudgeConfigPath(pathKey) {
+    if (!pathKey?.startsWith('judge.')) {
+        throw new Error(`belay config only supports judge.* paths (got ${pathKey ?? '(empty)'}).`);
+    }
+    return pathKey;
+}
+function getJudgeField(judge, pathKey) {
+    if (pathKey === 'judge.providerId')
+        return judge.providerId ?? null;
+    if (pathKey === 'judge.provider')
+        return judge.provider;
+    if (pathKey === 'judge.model')
+        return judge.model;
+    if (pathKey === 'judge.endpoint')
+        return judge.endpoint ?? null;
+    if (pathKey === 'judge.timeoutMs')
+        return judge.timeoutMs;
+    if (pathKey === 'judge.credential.mode')
+        return judge.credential?.mode ?? null;
+    if (pathKey === 'judge.credential.ref')
+        return judge.credential?.ref ?? null;
+    throw new Error(`Unknown judge config path: ${pathKey}`);
+}
+function listJudgeFields(judge) {
+    const entries = {};
+    for (const key of JUDGE_CONFIG_PATHS) {
+        entries[key] = getJudgeField(judge, key);
+    }
+    return entries;
+}
+function warnCloudConsentIfNeeded(judge) {
+    if (isCloudJudgeConfig(judge) &&
+        resolveJudgeTransport(judge) === 'http' &&
+        !hasValidCloudConsent(judge)) {
+        process.stderr.write('Warning: Cloud judge saved without recorded consent. Tier1 cloud judge will fail closed until consent is granted (belay judge consent + belay approve, or TTY --accept-cloud-judge).\n');
+    }
+}
+async function persistJudge(repoRoot, config, judge, adapter) {
+    const updated = { ...config, judge: normalizeJudgeConfig(judge) };
+    await writeConfigFile(repoRoot, updated, adapter);
+    await refreshIntegrityIfPinned(repoRoot, updated);
+    return updated;
+}
+async function applyJudgeSet(repoRoot, config, pathKey, rawValue) {
+    const adapter = resolveAdapterName(config);
+    const value = rawValue.trim();
+    if (pathKey === 'judge.providerId') {
+        if (!isJudgeProviderId(value)) {
+            throw new Error(`Unknown judge provider id: ${value}`);
+        }
+        const patch = resolveJudgeUsePatch(config.judge, { providerId: value });
+        if (patch.errors.length > 0) {
+            throw new Error(patch.errors.join(' '));
+        }
+        const updated = await persistJudge(repoRoot, config, patch.judge, adapter);
+        warnCloudConsentIfNeeded(updated.judge);
+        return updated.judge;
+    }
+    if (pathKey === 'judge.model') {
+        rejectDeprecatedJudgeModelAuto(value);
+        const judge = normalizeJudgeConfig({ ...config.judge, model: value });
+        await persistJudge(repoRoot, config, judge, adapter);
+        return judge;
+    }
+    if (pathKey === 'judge.endpoint') {
+        const endpoint = value === 'null' || value === '' ? null : value;
+        const judge = normalizeJudgeConfig({ ...config.judge, endpoint });
+        await persistJudge(repoRoot, config, judge, adapter);
+        return judge;
+    }
+    if (pathKey === 'judge.timeoutMs') {
+        const timeoutMs = Number(value);
+        if (!Number.isFinite(timeoutMs) || timeoutMs <= 0) {
+            throw new Error('judge.timeoutMs must be a positive number.');
+        }
+        const judge = normalizeJudgeConfig({ ...config.judge, timeoutMs });
+        await persistJudge(repoRoot, config, judge, adapter);
+        return judge;
+    }
+    if (pathKey === 'judge.provider') {
+        throw new Error('judge.provider is derived from providerId; use judge.providerId instead.');
+    }
+    if (pathKey === 'judge.credential.mode') {
+        if (value !== 'project' && value !== 'apiKey') {
+            throw new Error('judge.credential.mode must be project or apiKey.');
+        }
+        const judge = normalizeJudgeConfig({
+            ...config.judge,
+            credential: value === 'project' ? { mode: 'project' } : { mode: 'apiKey', ref: 'store:judge' },
+        });
+        await persistJudge(repoRoot, config, judge, adapter);
+        return judge;
+    }
+    if (pathKey === 'judge.credential.ref') {
+        if (value !== 'store:judge' && !value.startsWith('env:')) {
+            throw new Error('judge.credential.ref must be store:judge or env:NAME.');
+        }
+        const judge = normalizeJudgeConfig({
+            ...config.judge,
+            credential: { mode: 'apiKey', ref: value },
+        });
+        await persistJudge(repoRoot, config, judge, adapter);
+        return judge;
+    }
+    throw new Error(`Unknown judge config path: ${pathKey}`);
+}
+async function applyJudgeUnset(repoRoot, config, pathKey) {
+    const adapter = resolveAdapterName(config);
+    if (pathKey === 'judge.endpoint') {
+        const judge = normalizeJudgeConfig({ ...config.judge, endpoint: null });
+        await persistJudge(repoRoot, config, judge, adapter);
+        return judge;
+    }
+    if (pathKey === 'judge.credential.ref') {
+        const judge = normalizeJudgeConfig({
+            ...config.judge,
+            credential: config.judge.credential?.mode === 'apiKey' ? { mode: 'apiKey' } : undefined,
+        });
+        await persistJudge(repoRoot, config, judge, adapter);
+        return judge;
+    }
+    throw new Error(`Cannot unset ${pathKey}; only judge.endpoint and judge.credential.ref are unsettable.`);
+}
+async function appendConfigAudit(repoRoot, config, event) {
+    const adapter = resolveAdapterName(config);
+    const updated = await loadConfigFile(repoRoot, adapter);
+    await appendCliAuditEvent(repoRoot, updated, event);
+}
+export async function runBelayConfigCredential(options) {
+    const repoRoot = path.resolve(options.targetDir ?? process.cwd());
+    const config = await loadConfigFile(repoRoot);
+    const adapter = resolveAdapterName(config);
+    if (options.action === 'mode') {
+        if (options.mode !== 'project' && options.mode !== 'apiKey') {
+            throw new Error('credential mode requires project or apiKey.');
+        }
+        const judge = options.mode === 'project'
+            ? normalizeJudgeConfig({ ...config.judge, credential: { mode: 'project' } })
+            : normalizeJudgeConfig({
+                ...config.judge,
+                credential: options.keyEnv
+                    ? { mode: 'apiKey', ref: `env:${options.keyEnv}` }
+                    : { mode: 'apiKey', ref: 'store:judge' },
+            });
+        await persistJudge(repoRoot, config, judge, adapter);
+        await appendConfigAudit(repoRoot, config, {
+            event: 'judge_config_credential',
+            action: 'mode',
+            mode: options.mode,
+            by: 'belay config credential mode',
+        });
+        return options.mode === 'project'
+            ? 'Credential mode set to project.'
+            : 'Credential mode set to apiKey.';
+    }
+    if (options.action === 'set') {
+        let key;
+        if (options.keyStdin) {
+            key = await readKeyFromStdin();
+            if (!key) {
+                throw new Error('--key-stdin requires a non-empty API key on stdin.');
+            }
+        }
+        if (options.keyEnv) {
+            const judge = normalizeJudgeConfig({
+                ...config.judge,
+                credential: { mode: 'apiKey', ref: `env:${options.keyEnv}` },
+            });
+            await persistJudge(repoRoot, config, judge, adapter);
+            await appendConfigAudit(repoRoot, config, {
+                event: 'judge_config_credential',
+                action: 'set',
+                ref: `env:${options.keyEnv}`,
+                by: 'belay config credential set',
+            });
+            return `Credential ref set to env:${options.keyEnv}.`;
+        }
+        if (!key) {
+            throw new Error('credential set requires --key-stdin or --key-env.');
+        }
+        const stateDir = belayStateDir(config, repoLocalStateDirFor(repoRoot, config));
+        await writeJudgeCredentialStore(stateDir, key);
+        const judge = normalizeJudgeConfig({
+            ...config.judge,
+            credential: { mode: 'apiKey', ref: 'store:judge' },
+        });
+        await persistJudge(repoRoot, config, judge, adapter);
+        await appendConfigAudit(repoRoot, config, {
+            event: 'judge_config_credential',
+            action: 'set',
+            ref: 'store:judge',
+            by: 'belay config credential set',
+        });
+        return 'API key stored in belay credential store.';
+    }
+    if (options.action === 'clear') {
+        const stateDir = belayStateDir(config, repoLocalStateDirFor(repoRoot, config));
+        await clearJudgeCredentialStore(stateDir);
+        const judge = normalizeJudgeConfig({
+            ...config.judge,
+            credential: config.judge.credential?.mode === 'project' ? { mode: 'project' } : undefined,
+        });
+        await persistJudge(repoRoot, config, judge, adapter);
+        await appendConfigAudit(repoRoot, config, {
+            event: 'judge_config_credential',
+            action: 'clear',
+            by: 'belay config credential clear',
+        });
+        return 'Stored API key cleared.';
+    }
+    throw new Error('credential requires action: mode, set, or clear.');
+}
+function formatSelectPrompt(options) {
+    const values = options.choices.map((choice) => choice.value).join(' | ');
+    return `${options.message} [${values}] (${options.defaultValue}): `;
+}
+function formatConfirmPrompt(message, defaultValue) {
+    return `${message} [y | n] (${defaultValue ? 'y' : 'n'}): `;
+}
+function parseSelectAnswer(raw, options) {
+    const normalized = raw.trim().toLowerCase();
+    if (!normalized) {
+        return options.defaultValue;
+    }
+    const found = options.choices.find((choice) => {
+        if (choice.value.toLowerCase() === normalized) {
+            return true;
+        }
+        return choice.label?.trim().toLowerCase() === normalized;
+    });
+    if (!found) {
+        throw new Error(`Invalid choice for ${options.message}: ${raw}`);
+    }
+    return found.value;
+}
+async function askTextLazy(message) {
+    const rl = readline.createInterface({ input, output });
+    try {
+        return (await rl.question(message)).trimEnd();
+    }
+    finally {
+        rl.close();
+    }
+}
+function createTestPrompter(prompts) {
+    let index = 0;
+    const nextPrompt = (message) => {
+        if (index >= prompts.length) {
+            throw new Error(`unexpected config prompt: ${message}`);
+        }
+        return prompts[index++];
+    };
+    return {
+        askText: async (message) => nextPrompt(message),
+        askSelect: async (options, parseRaw) => {
+            const raw = nextPrompt(formatSelectPrompt(options));
+            return parseRaw ? parseRaw(raw, options) : parseSelectAnswer(raw, options);
+        },
+        askConfirm: async (message, defaultValue) => parseYesNo(nextPrompt(formatConfirmPrompt(message, defaultValue)), defaultValue),
+    };
+}
+function createReadlinePrompter() {
+    return {
+        askText: askTextLazy,
+        askSelect: async (options, parseRaw) => {
+            const raw = await askTextLazy(formatSelectPrompt(options));
+            return parseRaw ? parseRaw(raw, options) : parseSelectAnswer(raw, options);
+        },
+        askConfirm: async (message, defaultValue) => parseYesNo(await askTextLazy(formatConfirmPrompt(message, defaultValue)), defaultValue),
+    };
+}
+function createTuiPrompter() {
+    return {
+        askText: askTextLazy,
+        askSelect: selectPrompt,
+        askConfirm: confirmPrompt,
+    };
+}
+async function withConfigWizardPrompter(options, fn) {
+    if (options.prompts) {
+        return fn(createTestPrompter(options.prompts));
+    }
+    if (isInteractiveTTY()) {
+        return fn(createTuiPrompter());
+    }
+    return fn(createReadlinePrompter());
+}
+function writeConfigWizardBanner(options, title) {
+    if (options.skipBanner) {
+        return;
+    }
+    if (isInteractiveTTY()) {
+        intro(title);
+        return;
+    }
+    output.write(`${title}\n`);
+}
+async function collectCloudJudgeWizardAnswers(prompter, judgeProviderId) {
+    if (judgeProviderId === 'ollama') {
+        return { acceptCloud: false };
+    }
+    const judgeCredentialMode = (await prompter.askConfirm('Use project env for credentials?', true))
+        ? 'project'
+        : 'apiKey';
+    const optionalEndpoint = (await prompter.askText('Judge endpoint URL (optional): ')).trim();
+    const judgeEndpoint = optionalEndpoint || undefined;
+    if (judgeCredentialMode === 'apiKey') {
+        const key = await prompter.askText('Paste API key (hidden input not available in all shells): ');
+        if (key.trim()) {
+            process.env.BELAY_CONFIG_WIZARD_JUDGE_KEY = key.trim();
+        }
+    }
+    let acceptCloud = false;
+    if (judgeEndpoint) {
+        acceptCloud = await prompter.askConfirm('Accept cloud judge egress (redacted commands leave the repo)?', false);
+    }
+    return { judgeCredentialMode, judgeEndpoint, acceptCloud };
+}
+export async function resolveBelayConfigInteractiveMode(repoRoot) {
+    try {
+        return (await isBelayFloorInstalled({ targetDir: repoRoot })) ? 'judge-only' : 'full';
+    }
+    catch {
+        return 'full';
+    }
+}
+async function runBelayConfigFullWithWizard(prompter, options) {
+    writeConfigWizardBanner(options, 'belay config');
+    const adapter = await prompter.askSelect({
+        message: 'Adapter',
+        defaultValue: 'cursor',
+        choices: [{ value: 'cursor' }, { value: 'claude' }, { value: 'codex' }],
+    });
+    const scope = await prompter.askSelect({
+        message: 'Install scope',
+        defaultValue: 'project',
+        choices: [{ value: 'project' }, { value: 'global' }],
+    });
+    const withSkill = await prompter.askConfirm('Install SKILL.md and slash commands?', true);
+    const defaultJudgeProviderId = defaultJudgeProviderForAdapter(adapter);
+    const judgeProviderId = await prompter.askSelect({
+        message: 'Judge provider',
+        defaultValue: defaultJudgeProviderId,
+        choices: JUDGE_PROVIDER_IDS.map((providerId) => ({ value: providerId })),
+    }, (raw, selectOptions) => parseJudgeProviderId(raw, selectOptions.defaultValue));
+    const { judgeCredentialMode, judgeEndpoint, acceptCloud } = await collectCloudJudgeWizardAnswers(prompter, judgeProviderId);
+    const initOptions = buildInitOptionsFromConfigAnswers({
+        adapter,
+        scope,
+        withSkill,
+        judgeProviderId,
+        judgeCredentialMode,
+        judgeEndpoint,
+        acceptCloud,
+        dogfood: false,
+    }, options.targetDir);
+    const result = await initProject(initOptions);
+    if (process.env.BELAY_CONFIG_WIZARD_JUDGE_KEY && judgeCredentialMode === 'apiKey') {
+        const config = await loadConfigFile(result.repoRoot, result.adapter);
+        const stateDir = belayStateDir(config, repoLocalStateDirFor(result.repoRoot, config));
+        await writeJudgeCredentialStore(stateDir, process.env.BELAY_CONFIG_WIZARD_JUDGE_KEY);
+        delete process.env.BELAY_CONFIG_WIZARD_JUDGE_KEY;
+    }
+    return result;
+}
+async function runBelayConfigJudgeOnlyWithWizard(prompter, options, repoRoot, config, adapter) {
+    writeConfigWizardBanner(options, 'belay config (judge only)');
+    const defaultJudgeProviderId = defaultJudgeProviderForAdapter(adapter);
+    const judgeProviderId = await prompter.askSelect({
+        message: 'Judge provider',
+        defaultValue: defaultJudgeProviderId,
+        choices: JUDGE_PROVIDER_IDS.map((providerId) => ({ value: providerId })),
+    }, (raw, selectOptions) => parseJudgeProviderId(raw, selectOptions.defaultValue));
+    const { judgeCredentialMode, judgeEndpoint, acceptCloud } = await collectCloudJudgeWizardAnswers(prompter, judgeProviderId);
+    const patch = resolveJudgeUsePatch(config.judge, {
+        providerId: judgeProviderId,
+        endpoint: judgeEndpoint,
+        credentialMode: judgeCredentialMode,
+        acceptCloud: acceptCloud && Boolean(judgeEndpoint),
+        // `prompts` is a scripted stand-in for interactive responses in tests.
+        interactiveTTY: isInteractiveTTY() || Boolean(options.prompts),
+        interactiveConsentApproved: acceptCloud && Boolean(judgeEndpoint),
+    });
+    if (patch.errors.length > 0) {
+        throw new Error(patch.errors.join(' '));
+    }
+    for (const warning of patch.warnings) {
+        process.stderr.write(`Warning: ${warning}\n`);
+    }
+    const updated = await persistJudge(repoRoot, config, patch.judge, adapter);
+    warnCloudConsentIfNeeded(updated.judge);
+    if (process.env.BELAY_CONFIG_WIZARD_JUDGE_KEY && judgeCredentialMode === 'apiKey') {
+        const stateDir = belayStateDir(updated, repoLocalStateDirFor(repoRoot, updated));
+        await writeJudgeCredentialStore(stateDir, process.env.BELAY_CONFIG_WIZARD_JUDGE_KEY);
+        delete process.env.BELAY_CONFIG_WIZARD_JUDGE_KEY;
+    }
+    await appendConfigAudit(repoRoot, updated, {
+        event: 'judge_config_interactive',
+        providerId: updated.judge.providerId,
+        credentialMode: updated.judge.credential?.mode ?? null,
+        by: 'belay config interactive (judge only)',
+    });
+    return { repoRoot, adapter };
+}
+export async function runBelayConfigFullInteractive(options = {}) {
+    return withConfigWizardPrompter(options, (prompter) => runBelayConfigFullWithWizard(prompter, options));
+}
+export async function runBelayConfigJudgeOnlyInteractive(options = {}) {
+    const repoRoot = path.resolve(options.targetDir ?? process.cwd());
+    const config = await loadConfigFile(repoRoot);
+    const adapter = resolveAdapterName(config);
+    return withConfigWizardPrompter(options, (prompter) => runBelayConfigJudgeOnlyWithWizard(prompter, options, repoRoot, config, adapter));
+}
+export async function runBelayConfigInteractive(options = {}) {
+    const repoRoot = path.resolve(options.targetDir ?? process.cwd());
+    const mode = await resolveBelayConfigInteractiveMode(repoRoot);
+    if (mode === 'judge-only') {
+        if (options.prompts) {
+            const judgeOnly = parseYesNo(options.prompts[0] ?? '', true);
+            const remainingPrompts = options.prompts.slice(1);
+            if (judgeOnly) {
+                return runBelayConfigJudgeOnlyInteractive({
+                    ...options,
+                    prompts: remainingPrompts,
+                    skipBanner: true,
+                });
+            }
+            return runBelayConfigFullInteractive({
+                ...options,
+                prompts: remainingPrompts,
+                skipBanner: true,
+            });
+        }
+        return withConfigWizardPrompter(options, async (prompter) => {
+            writeConfigWizardBanner(options, 'belay config');
+            const judgeOnly = await prompter.askConfirm('Configure judge only?', true);
+            if (!judgeOnly) {
+                return runBelayConfigFullWithWizard(prompter, { ...options, skipBanner: true });
+            }
+            const config = await loadConfigFile(repoRoot);
+            const adapter = resolveAdapterName(config);
+            return runBelayConfigJudgeOnlyWithWizard(prompter, { ...options, skipBanner: true }, repoRoot, config, adapter);
+        });
+    }
+    return runBelayConfigFullInteractive(options);
+}
+export async function runBelayConfig(options = {}) {
+    if (!options.subcommand) {
+        return runBelayConfigInteractive({ targetDir: options.targetDir });
+    }
+    const repoRoot = path.resolve(options.targetDir ?? process.cwd());
+    const config = await loadConfigFile(repoRoot);
+    if (options.subcommand === 'list') {
+        const entries = listJudgeFields(config.judge);
+        if (options.json) {
+            return entries;
+        }
+        return Object.entries(entries)
+            .map(([key, value]) => `${key}: ${value === null ? '(null)' : String(value)}`)
+            .join('\n');
+    }
+    if (options.subcommand === 'get') {
+        const pathKey = assertJudgeConfigPath(options.path);
+        const value = getJudgeField(config.judge, pathKey);
+        if (options.json) {
+            return { path: pathKey, value };
+        }
+        return value === null ? '(null)' : String(value);
+    }
+    if (options.subcommand === 'set') {
+        const pathKey = assertJudgeConfigPath(options.path);
+        if (options.value === undefined) {
+            throw new Error('belay config set requires <path> <value>.');
+        }
+        await applyJudgeSet(repoRoot, config, pathKey, options.value);
+        await appendConfigAudit(repoRoot, config, {
+            event: 'judge_config_set',
+            path: pathKey,
+            value: options.value,
+            by: 'belay config set',
+        });
+        return `Set ${pathKey} = ${options.value}`;
+    }
+    if (options.subcommand === 'unset') {
+        const pathKey = assertJudgeConfigPath(options.path);
+        await applyJudgeUnset(repoRoot, config, pathKey);
+        await appendConfigAudit(repoRoot, config, {
+            event: 'judge_config_unset',
+            path: pathKey,
+            by: 'belay config unset',
+        });
+        return `Unset ${pathKey}`;
+    }
+    if (options.subcommand === 'judge') {
+        return judgeStatus({ targetDir: repoRoot, json: options.json });
+    }
+    throw new Error(`Unknown config subcommand: ${options.subcommand}`);
+}

package/dist/commands/doctor.js

@@ -10,7 +10,7 @@ import { approvedApprovalsPath, belayStateDir, detectAdapterName, loadLayeredCon
 import { detectFenceDrift, summarizeAuditVisibility } from '../core/audit-summary.js';
 import { defaultControlPlaneDir } from '../core/config.js';
 import { verifyIntegrityManifest } from '../core/integrity.js';
-import { diagnoseJudge } from '../core/judge-doctor.js';
+import { diagnoseJudge, stopJudgeSessionBrokers } from '../core/judge-doctor.js';
 import { getManagedHookEntries } from '../defaults.js';
 import { resolveNodeBinary } from '../node-resolution.js';
 import { egressStatus } from '../services/egress-service.js';
@@ -56,6 +56,7 @@ export async function doctorProject(options = {}) {
     let corePath = path.join(activeLayout.runtimeDir(repoRoot), 'core.mjs');
     if (!existsSync(configPath)) {
         issues.push(`Missing config: ${configPath}`);
+        notes.push('No belay config found. Run `belay config` for interactive setup, or `belay init` for non-interactive install.');
     }
     else {
         try {
@@ -238,6 +239,16 @@ export async function doctorProject(options = {}) {
         else {
             notes.push('No orphan approval cleanup actions were needed.');
         }
+        const judgeStateDir = belayStateDir(loadedConfig, repoLocalDir);
+        if (options.dryRun !== true) {
+            const stoppedBrokers = await stopJudgeSessionBrokers(repoRoot, judgeStateDir);
+            if (stoppedBrokers > 0) {
+                notes.push(`Stopped judge session broker artifacts for ${repoRoot}.`);
+            }
+        }
+        else {
+            notes.push('Dry run: would stop judge session broker and clear kill switch if present.');
+        }
     }
     let dogfood = null;
     if (loadedConfig) {
@@ -310,7 +321,7 @@ export async function doctorProject(options = {}) {
     }
     if (health.skillOnly) {
         warnings.push('Skill-only install detected: belay SKILL.md is present but hook floor is missing or incomplete. ' +
-            'This is advisory only — enforcement requires hooks. Run `npx @guilz-dev/belay init` (or `belay init-wizard`) ' +
+            'This is advisory only — enforcement requires hooks. Run `belay config` (or `belay init`) ' +
             'then `belay doctor` to verify the floor.');
         notes.push(`Skill path: ${health.skillPath}`);
     }

package/dist/commands/explain.js

@@ -11,11 +11,16 @@ export async function explainCommand(options) {
             const latest = [...pending.approvals].sort((left, right) => Date.parse(right.createdAt) - Date.parse(left.createdAt))[0];
             const inputKind = latest.inputKind ??
                 (latest.kind === 'egress' || latest.kind === 'capability' ? 'shell' : latest.kind);
+            const payload = latest.payloadJson !== undefined
+                ? JSON.parse(latest.payloadJson)
+                : undefined;
             const classified = await classifyForReport({
                 targetDir: repoRoot,
-                cwd: options.cwd,
+                cwd: latest.cwd ?? options.cwd,
                 kind: inputKind,
                 command: latest.input ?? latest.summary,
+                toolName: latest.toolName,
+                payload,
             });
             return {
                 repoRoot: classified.repoRoot,

package/dist/commands/harvest.d.ts

@@ -0,0 +1,29 @@
+import type { AuditRecord } from '../core/audit-types.js';
+import { type HarvestReport, type HarvestReviewOutcome } from '../core/harvest.js';
+export interface HarvestListOptions {
+    targetDir?: string;
+    since?: string;
+    until?: string;
+    json?: boolean;
+}
+export interface HarvestApplyOptions {
+    targetDir?: string;
+    command: string;
+    outcome: HarvestReviewOutcome;
+    reason?: string;
+    corpusPath?: string;
+}
+export declare function harvestListProject(options?: HarvestListOptions): Promise<HarvestReport>;
+export declare function harvestReportFromRecords(records: AuditRecord[], options?: {
+    since?: string;
+    until?: string;
+    allowPatterns?: string[];
+}): HarvestReport;
+export declare function formatHarvestReport(report: HarvestReport): string;
+export declare function harvestApplyProject(options: HarvestApplyOptions): Promise<{
+    ok: boolean;
+    message: string;
+    corpusPath: string;
+}>;
+/** Parse audit ndjson for tests without full project layout. */
+export declare function harvestReportFromNdjson(raw: string): HarvestReport;