@guilz-dev/belay 0.2.0 → 0.4.0

package/dist/commands/harvest.js

@@ -0,0 +1,72 @@
+import { readFile, writeFile } from 'node:fs/promises';
+import path from 'node:path';
+import { loadConfigFile } from '../config-io.js';
+import { parseAuditNdjson } from '../core/audit-metrics.js';
+import { toAuditRecord } from '../core/audit-query.js';
+import { applyHarvestReview, buildHarvestReport, filterRecordsForHarvest, } from '../core/harvest.js';
+import { parseCorpusCases } from '../corpus/types.js';
+import { loadAuditRecords } from './audit.js';
+export async function harvestListProject(options = {}) {
+    const repoRoot = path.resolve(options.targetDir ?? process.cwd());
+    const config = await loadConfigFile(repoRoot);
+    const records = await loadAuditRecords(repoRoot);
+    return harvestReportFromRecords(records, {
+        since: options.since,
+        until: options.until,
+        allowPatterns: config.overrides.allow,
+    });
+}
+export function harvestReportFromRecords(records, options = {}) {
+    return buildHarvestReport(filterRecordsForHarvest(records, { since: options.since, until: options.until }), { allowPatterns: options.allowPatterns });
+}
+export function formatHarvestReport(report) {
+    const lines = [
+        `belay harvest (scope: ${report.scope} audit traces only)`,
+        `Schema: v${report.schemaVersion}`,
+        '',
+        `Benign candidates (${report.candidates.length}):`,
+    ];
+    if (report.candidates.length === 0) {
+        lines.push('- (none)');
+    }
+    else {
+        for (const candidate of report.candidates) {
+            lines.push(`- ${JSON.stringify(candidate.command)} [${candidate.sources.join(', ')}] asks=${candidate.askCount} approved=${candidate.approvedAfterDeny ? 'yes' : 'no'} fp=${candidate.fingerprint.slice(0, 12)}…`);
+        }
+    }
+    lines.push('', `Availability queue (${report.availabilityQueue.length}):`);
+    if (report.availabilityQueue.length === 0) {
+        lines.push('- (none)');
+    }
+    else {
+        for (const entry of report.availabilityQueue) {
+            lines.push(`- ${JSON.stringify(entry.command)} signal=${entry.availabilitySignal} asks=${entry.askCount} (${entry.reason})`);
+        }
+    }
+    lines.push('', 'Candidates are review-only signals — approve in audit does not auto-promote to corpus.', 'Time filters (--since/--until) keep paired deny/approval rows for round-trip detection.', 'Use: belay harvest apply --command "<text>" --outcome provably-benign|accepted-benign|reject');
+    return lines.join('\n');
+}
+export async function harvestApplyProject(options) {
+    const repoRoot = path.resolve(options.targetDir ?? process.cwd());
+    const corpusPath = path.resolve(repoRoot, options.corpusPath ?? path.join('corpus', 'shell-commands.json'));
+    const raw = await readFile(corpusPath, 'utf8');
+    const cases = parseCorpusCases(JSON.parse(raw));
+    const result = applyHarvestReview(cases, {
+        command: options.command,
+        outcome: options.outcome,
+        reason: options.reason,
+    });
+    if (result.applied) {
+        await writeFile(corpusPath, `${JSON.stringify(result.cases, null, 2)}\n`, 'utf8');
+    }
+    return {
+        ok: result.ok,
+        message: result.message,
+        corpusPath: path.relative(repoRoot, corpusPath) || corpusPath,
+    };
+}
+/** Parse audit ndjson for tests without full project layout. */
+export function harvestReportFromNdjson(raw) {
+    const records = parseAuditNdjson(raw).map((entry) => toAuditRecord(entry));
+    return harvestReportFromRecords(records);
+}

package/dist/commands/health-snapshot.d.ts

@@ -1,2 +1,8 @@
+import type { AdapterName } from '../adapters/layouts/types.js';
 import type { HealthSnapshot, HealthSnapshotOptions } from '../types.js';
+/** Lightweight floor check without judge doctor / sandbox probes. */
+export declare function isBelayFloorInstalled(options?: {
+    targetDir?: string;
+    adapter?: AdapterName;
+}): Promise<boolean>;
 export declare function collectHealthSnapshot(options?: HealthSnapshotOptions): Promise<HealthSnapshot>;

package/dist/commands/health-snapshot.js

@@ -48,6 +48,40 @@ async function managedHooksPresent(adapter, hooksPath, hooksDir, repoRoot) {
     }
     return managedEntries.every(({ definition }) => content.includes(definition.command));
 }
+/** Lightweight floor check without judge doctor / sandbox probes. */
+export async function isBelayFloorInstalled(options = {}) {
+    const repoRoot = path.resolve(options.targetDir ?? process.cwd());
+    const adapter = options.adapter ?? detectAdapterName(repoRoot);
+    const layout = getAdapterLayout(adapter);
+    const configPath = layout.configPath(repoRoot);
+    if (!existsSync(configPath)) {
+        return false;
+    }
+    let installScope = 'project';
+    try {
+        const layered = await loadLayeredConfig(repoRoot, adapter);
+        installScope = layered.config.installScope === 'global' ? 'global' : 'project';
+    }
+    catch {
+        return false;
+    }
+    const scopedPaths = resolveScopedPaths(layout, installScope, repoRoot);
+    const hooksPath = scopedPaths.hooksSettingsPath;
+    const hooksDir = scopedPaths.hooksDir;
+    const corePath = path.join(scopedPaths.runtimeDir, 'core.mjs');
+    const runtimePresent = existsSync(corePath);
+    const runnerPresent = existsSync(path.join(hooksDir, 'belay-runner')) ||
+        existsSync(path.join(hooksDir, 'belay-runner.cmd'));
+    if (!existsSync(hooksPath) || !runnerPresent || !runtimePresent) {
+        return false;
+    }
+    try {
+        return await managedHooksPresent(adapter, hooksPath, hooksDir, repoRoot);
+    }
+    catch {
+        return false;
+    }
+}
 export async function collectHealthSnapshot(options = {}) {
     const repoRoot = path.resolve(options.targetDir ?? process.cwd());
     const adapter = options.adapter ?? detectAdapterName(repoRoot);

package/dist/commands/judge.d.ts

@@ -0,0 +1,100 @@
+import type { BelayJudgeConfig } from '../core/config.js';
+export interface JudgeCommandOptions {
+    targetDir?: string;
+    json?: boolean;
+    subcommand?: 'status' | 'list' | 'use' | 'test' | 'bench' | 'consent';
+    liveProbe?: boolean;
+    providerId?: string;
+    model?: string;
+    endpoint?: string;
+    timeoutMs?: number;
+    acceptCloud?: boolean;
+    cloudConsentApprovalId?: string;
+    credentialMode?: 'project' | 'apiKey';
+    keyStdin?: boolean;
+    keyEnv?: string;
+}
+export declare function isInteractiveTTY(): boolean;
+export declare function judgeStatus(options?: JudgeCommandOptions): Promise<string | {
+    providerId: import("../core/config.js").JudgeProviderId | import("../core/config.js").DeprecatedJudgeProviderId | undefined;
+    provider: import("../core/config.js").JudgeProvider;
+    endpoint: string | null;
+    model: string;
+    modelResolved: string;
+    transport: import("../core/verdict/judge.js").Tier1JudgeTransport;
+    credential: import("../core/judge-api-key.js").ResolvedJudgeCredential;
+    cloudConsent: import("../core/config.js").JudgeCloudConsent | null;
+    cloudJudgeActive: boolean;
+}>;
+export declare function judgeList(options?: JudgeCommandOptions): string | {
+    id: import("../core/verdict/judge-catalog.js").JudgeProviderId;
+    driver: import("../core/config.js").JudgeProvider;
+    cloud: boolean;
+    defaultEndpoint: string | null;
+    defaultModel: string;
+    apiKeyEnvVars: string[];
+}[];
+export declare function judgeUse(options: JudgeCommandOptions): Promise<string | {
+    ok: boolean;
+    configPath: string;
+    diff: string;
+    warnings: string[];
+    judge: BelayJudgeConfig;
+}>;
+export declare function judgeRequestCloudConsent(options?: JudgeCommandOptions): Promise<string | {
+    approvalId: string;
+    created: boolean;
+    providerId: string;
+    endpoint: string;
+    reason: "judge_cloud_consent";
+}>;
+export declare function judgeTest(options?: JudgeCommandOptions): Promise<string | {
+    modelCheck: import("../core/judge-model-discovery.js").CheckJudgeModelPresenceResult | undefined;
+    issues: string[];
+    warnings: string[];
+    notes: string[];
+}>;
+export declare function judgeBench(options?: JudgeCommandOptions): Promise<string | {
+    slo: typeof import("../core/verdict/judge-runtime-config.js").JUDGE_LATENCY_SLO;
+    measured: Record<import("../core/verdict/judge-baseline.js").JudgeLatencyPhase, import("../core/verdict/judge-baseline.js").JudgeLatencyPercentiles>;
+    sessionMeetsTarget: boolean;
+}>;
+export declare function runJudgeCommand(options: JudgeCommandOptions): Promise<string | {
+    slo: typeof import("../core/verdict/judge-runtime-config.js").JUDGE_LATENCY_SLO;
+    measured: Record<import("../core/verdict/judge-baseline.js").JudgeLatencyPhase, import("../core/verdict/judge-baseline.js").JudgeLatencyPercentiles>;
+    sessionMeetsTarget: boolean;
+} | {
+    providerId: import("../core/config.js").JudgeProviderId | import("../core/config.js").DeprecatedJudgeProviderId | undefined;
+    provider: import("../core/config.js").JudgeProvider;
+    endpoint: string | null;
+    model: string;
+    modelResolved: string;
+    transport: import("../core/verdict/judge.js").Tier1JudgeTransport;
+    credential: import("../core/judge-api-key.js").ResolvedJudgeCredential;
+    cloudConsent: import("../core/config.js").JudgeCloudConsent | null;
+    cloudJudgeActive: boolean;
+} | {
+    id: import("../core/verdict/judge-catalog.js").JudgeProviderId;
+    driver: import("../core/config.js").JudgeProvider;
+    cloud: boolean;
+    defaultEndpoint: string | null;
+    defaultModel: string;
+    apiKeyEnvVars: string[];
+}[] | {
+    ok: boolean;
+    configPath: string;
+    diff: string;
+    warnings: string[];
+    judge: BelayJudgeConfig;
+} | {
+    approvalId: string;
+    created: boolean;
+    providerId: string;
+    endpoint: string;
+    reason: "judge_cloud_consent";
+} | {
+    modelCheck: import("../core/judge-model-discovery.js").CheckJudgeModelPresenceResult | undefined;
+    issues: string[];
+    warnings: string[];
+    notes: string[];
+}>;

package/dist/commands/judge.js

@@ -0,0 +1,304 @@
+import path from 'node:path';
+import { stdin as input, stdout as output } from 'node:process';
+import { createInterface } from 'node:readline/promises';
+import { configPathFor, loadApprovalState, loadConfigFile, repoLocalStateDirFor, resolveAdapterName, writeConfigFile, } from '../config-io.js';
+import { appendCliAuditEvent } from '../core/audit-io.js';
+import { JUDGE_CLOUD_CONSENT_REASON } from '../core/capability/reasons.js';
+import { belayStateDir, normalizeJudgeConfig } from '../core/config.js';
+import { writeJudgeCredentialStore } from '../core/credential-store.js';
+import { refreshIntegrityIfPinned } from '../core/integrity.js';
+import { resolveJudgeCredential } from '../core/judge-api-key.js';
+import { ensurePendingJudgeCloudConsentApproval } from '../core/judge-cloud-consent.js';
+import { hasValidCloudConsent, isCloudJudgeConfig, resolveJudgeUsePatch, } from '../core/judge-config.js';
+import { diagnoseJudge } from '../core/judge-doctor.js';
+import { rejectDeprecatedJudgeModelAuto } from '../core/judge-model-policy.js';
+import { resolveJudgeTransport } from '../core/judge-runtime-detection.js';
+import { getJudgeProviderSpec, isJudgeProviderId, JUDGE_CATALOG, JUDGE_PROVIDER_IDS, normalizeLegacyProviderId, } from '../core/verdict/judge-catalog.js';
+import { resolveJudgeModel } from '../core/verdict/judge-factory.js';
+import { readKeyFromStdin } from './stdin-key.js';
+export function isInteractiveTTY() {
+    return Boolean(input.isTTY && output.isTTY);
+}
+async function confirmCloudConsent(endpoint) {
+    if (!isInteractiveTTY()) {
+        return false;
+    }
+    const rl = createInterface({ input, output });
+    try {
+        const answer = await rl.question(`Cloud judge sends redacted commands to ${endpoint}. Continue? [y/N] `);
+        return ['y', 'yes'].includes(answer.trim().toLowerCase());
+    }
+    finally {
+        rl.close();
+    }
+}
+async function hasApprovedCloudConsent(repoRoot, config, approvalId) {
+    const approved = await loadApprovalState(repoRoot, 'approved-approvals.json', config);
+    return approved.approvals.some((entry) => entry.approvalId === approvalId && entry.reason === 'judge_cloud_consent');
+}
+function formatJudgeDiff(before, after) {
+    const lines = ['Judge config changes:'];
+    const keys = new Set([...Object.keys(before), ...Object.keys(after)]);
+    for (const key of keys) {
+        const left = JSON.stringify(before[key]);
+        const right = JSON.stringify(after[key]);
+        if (left !== right) {
+            lines.push(`  ${String(key)}: ${left} -> ${right}`);
+        }
+    }
+    return lines.join('\n');
+}
+export async function judgeStatus(options = {}) {
+    const repoRoot = path.resolve(options.targetDir ?? process.cwd());
+    const config = await loadConfigFile(repoRoot);
+    const judge = config.judge;
+    const spec = judge.providerId ? getJudgeProviderSpec(judge.providerId) : null;
+    const repoLocalDir = repoLocalStateDirFor(repoRoot, config);
+    const credential = await resolveJudgeCredential({
+        judge,
+        catalogSpec: spec ?? undefined,
+        repoRoot,
+        repoLocalStateDir: repoLocalDir,
+        config,
+    });
+    const { resolved } = resolveJudgeModel(judge);
+    const transport = resolveJudgeTransport(judge);
+    const lines = [
+        `Judge providerId : ${judge.providerId ?? '(inferred)'}`,
+        `Judge driver     : ${judge.provider}`,
+        `Transport        : ${transport}`,
+        `Endpoint         : ${judge.endpoint ?? '(none)'}`,
+        `Model            : ${resolved} (requested: ${judge.model})`,
+        `Credential       : ${credential.mode} (${credential.sourceKind})${credential.source ? ` → ${credential.source}` : ''} ${credential.key ? '✓ set' : '✗ missing'}`,
+        `Cloud consent    : ${judge.cloudConsent?.accepted
+            ? `accepted ${judge.cloudConsent.at} by ${judge.cloudConsent.by}`
+            : 'not recorded'}`,
+        `Tier1 fallback   : ask (fail-closed) — judge unreachable would block, not allow`,
+    ];
+    if (options.json) {
+        return {
+            providerId: judge.providerId,
+            provider: judge.provider,
+            endpoint: judge.endpoint,
+            model: judge.model,
+            modelResolved: resolved,
+            transport,
+            credential,
+            cloudConsent: judge.cloudConsent ?? null,
+            cloudJudgeActive: isCloudJudgeConfig(judge) && hasValidCloudConsent(judge),
+        };
+    }
+    return lines.join('\n');
+}
+export function judgeList(options = {}) {
+    const entries = JUDGE_PROVIDER_IDS.map((id) => {
+        const spec = JUDGE_CATALOG[id];
+        return {
+            id,
+            driver: spec.driver,
+            cloud: spec.isCloud,
+            defaultEndpoint: spec.defaultEndpoint,
+            defaultModel: spec.defaultModel,
+            apiKeyEnvVars: spec.apiKeyEnvVars,
+        };
+    });
+    if (options.json) {
+        return entries;
+    }
+    return entries
+        .map((entry) => `${entry.id} (${entry.cloud ? 'cloud' : 'local'}) driver=${entry.driver} model=${entry.defaultModel} endpoint=${entry.defaultEndpoint ?? 'optional'}`)
+        .join('\n');
+}
+export async function judgeUse(options) {
+    const repoRoot = path.resolve(options.targetDir ?? process.cwd());
+    const config = await loadConfigFile(repoRoot);
+    const adapter = resolveAdapterName(config);
+    const providerId = options.providerId?.trim();
+    if (!providerId || !isJudgeProviderId(providerId)) {
+        throw new Error(`judge use requires provider-id: ${JUDGE_PROVIDER_IDS.join(', ')}`);
+    }
+    const before = { ...config.judge };
+    if (options.model !== undefined) {
+        rejectDeprecatedJudgeModelAuto(options.model);
+    }
+    if (options.keyStdin &&
+        options.credentialMode === 'apiKey' &&
+        options.acceptCloud &&
+        isInteractiveTTY()) {
+        throw new Error('Cannot combine --accept-cloud with --key-stdin in interactive mode. Use env for the API key, or record consent separately.');
+    }
+    let keyFromStdin;
+    if (options.keyStdin && options.credentialMode === 'apiKey') {
+        keyFromStdin = await readKeyFromStdin();
+        if (!keyFromStdin) {
+            throw new Error('--key-stdin requires a non-empty API key on stdin.');
+        }
+    }
+    let interactiveConsentApproved = false;
+    if (options.acceptCloud && isInteractiveTTY()) {
+        const spec = getJudgeProviderSpec(providerId);
+        const endpoint = options.endpoint?.trim() || spec?.defaultEndpoint || before.endpoint?.trim() || '';
+        if (endpoint) {
+            interactiveConsentApproved = await confirmCloudConsent(endpoint);
+        }
+    }
+    const cloudConsentApprovalId = options.cloudConsentApprovalId;
+    if (options.cloudConsentApprovalId) {
+        const ok = await hasApprovedCloudConsent(repoRoot, config, options.cloudConsentApprovalId);
+        if (!ok) {
+            throw new Error(`Approval ${options.cloudConsentApprovalId} is not an approved judge_cloud_consent.`);
+        }
+    }
+    else if (options.acceptCloud &&
+        !isInteractiveTTY() &&
+        getJudgeProviderSpec(providerId)?.isCloud) {
+        throw new Error('--accept-cloud has no effect in non-interactive mode. Use TTY confirmation or --cloud-consent-approval-id.');
+    }
+    const patch = resolveJudgeUsePatch(before, {
+        providerId,
+        model: options.model,
+        endpoint: options.endpoint,
+        timeoutMs: options.timeoutMs,
+        acceptCloud: options.acceptCloud,
+        cloudConsentApprovalId,
+        credentialMode: options.credentialMode,
+        keyEnv: options.keyEnv,
+        interactiveTTY: isInteractiveTTY(),
+        interactiveConsentApproved,
+    });
+    if (patch.errors.length > 0) {
+        throw new Error(patch.errors.join(' '));
+    }
+    if (keyFromStdin !== undefined) {
+        const stateDir = belayStateDir(config, repoLocalStateDirFor(repoRoot, config));
+        await writeJudgeCredentialStore(stateDir, keyFromStdin);
+    }
+    const after = normalizeJudgeConfig(patch.judge);
+    const updated = { ...config, judge: after };
+    await writeConfigFile(repoRoot, updated, adapter);
+    await refreshIntegrityIfPinned(repoRoot, updated);
+    await appendCliAuditEvent(repoRoot, updated, {
+        event: 'judge_provider_changed',
+        from: { providerId: before.providerId, provider: before.provider },
+        to: { providerId: after.providerId, provider: after.provider },
+        by: 'belay judge use',
+    });
+    if (after.cloudConsent?.accepted && !before.cloudConsent?.accepted) {
+        await appendCliAuditEvent(repoRoot, updated, {
+            event: 'judge_cloud_consent_recorded',
+            providerId: after.cloudConsent.providerId,
+            endpoint: after.cloudConsent.endpoint,
+            by: after.cloudConsent.by,
+        });
+    }
+    const spec = getJudgeProviderSpec(providerId);
+    const credential = await resolveJudgeCredential({
+        judge: after,
+        catalogSpec: spec ?? undefined,
+        repoRoot,
+        repoLocalStateDir: repoLocalStateDirFor(repoRoot, updated),
+        config: updated,
+    });
+    if (spec?.isCloud && !credential.key) {
+        patch.warnings.push(`API key not found for ${providerId}. Tier1 cloud judge will fail closed to ask.`);
+    }
+    const result = {
+        ok: true,
+        configPath: configPathFor(repoRoot, adapter),
+        diff: formatJudgeDiff(before, after),
+        warnings: patch.warnings,
+        judge: after,
+    };
+    if (options.json) {
+        return result;
+    }
+    const parts = [
+        result.diff,
+        ...result.warnings.map((w) => `Warning: ${w}`),
+        'Judge config updated.',
+    ];
+    return parts.join('\n');
+}
+export async function judgeRequestCloudConsent(options = {}) {
+    const repoRoot = path.resolve(options.targetDir ?? process.cwd());
+    const config = await loadConfigFile(repoRoot);
+    const providerId = options.providerId?.trim();
+    if (!providerId || !isJudgeProviderId(providerId)) {
+        throw new Error(`judge consent requires --provider-id: ${JUDGE_PROVIDER_IDS.join(', ')}`);
+    }
+    const canonicalProviderId = normalizeLegacyProviderId(providerId);
+    const spec = getJudgeProviderSpec(canonicalProviderId);
+    if (!spec?.isCloud) {
+        throw new Error(`judge consent applies only to cloud providers (${JUDGE_PROVIDER_IDS.filter((id) => JUDGE_CATALOG[id].isCloud).join(', ')}).`);
+    }
+    const endpoint = options.endpoint?.trim() || config.judge.endpoint?.trim() || spec.defaultEndpoint || '';
+    if (!endpoint) {
+        throw new Error(`${canonicalProviderId} requires --endpoint for cloud consent request.`);
+    }
+    const { approvalId, created } = await ensurePendingJudgeCloudConsentApproval({
+        repoRoot,
+        config,
+        providerId: canonicalProviderId,
+        endpoint,
+    });
+    const lines = [
+        `Cloud consent approval ${created ? 'created' : 'reused'}: ${approvalId}`,
+        `Approve: belay approve ${approvalId}`,
+        `Then: belay judge use ${canonicalProviderId} --endpoint ${endpoint} --cloud-consent-approval-id ${approvalId}`,
+    ];
+    if (options.json) {
+        return { approvalId, created, providerId, endpoint, reason: JUDGE_CLOUD_CONSENT_REASON };
+    }
+    return lines.join('\n');
+}
+export async function judgeTest(options = {}) {
+    const repoRoot = path.resolve(options.targetDir ?? process.cwd());
+    const config = await loadConfigFile(repoRoot);
+    const diagnosis = await diagnoseJudge(config, repoRoot, {
+        liveProbe: options.liveProbe === true,
+    });
+    const modelCheck = diagnosis.modelCheck;
+    if (options.json) {
+        return { ...diagnosis, modelCheck };
+    }
+    return [
+        `Model check: ${modelCheck?.status ?? 'unverified'}`,
+        `Model source: ${modelCheck?.source ?? 'unknown'}`,
+        ...diagnosis.notes.map((n) => `Note: ${n}`),
+        ...diagnosis.warnings.map((w) => `Warning: ${w}`),
+        ...diagnosis.issues.map((i) => `Issue: ${i}`),
+    ].join('\n');
+}
+export async function judgeBench(options = {}) {
+    const { judgeLatencySloReport } = await import('../core/verdict/judge-baseline.js');
+    const report = judgeLatencySloReport();
+    if (options.json) {
+        return report;
+    }
+    const lines = [
+        `SLO target: Tier1 session p95 <= ${Math.round(report.slo.spawnBaselineP95Ms * (1 - report.slo.tier1P95ReductionTarget))}ms`,
+        `Tier0 p50/p95: ${report.measured.tier0.p50}/${report.measured.tier0.p95}ms (${report.measured.tier0.count} samples)`,
+        `Tier1 spawn p50/p95: ${report.measured.tier1_spawn.p50}/${report.measured.tier1_spawn.p95}ms (${report.measured.tier1_spawn.count} samples)`,
+        `Tier1 session p50/p95: ${report.measured.tier1_session.p50}/${report.measured.tier1_session.p95}ms (${report.measured.tier1_session.count} samples)`,
+        `Session meets target: ${report.sessionMeetsTarget ? 'yes' : 'no'}`,
+    ];
+    return lines.join('\n');
+}
+export async function runJudgeCommand(options) {
+    switch (options.subcommand) {
+        case 'status':
+            return judgeStatus(options);
+        case 'list':
+            return judgeList(options);
+        case 'use':
+            return judgeUse(options);
+        case 'test':
+            return judgeTest(options);
+        case 'bench':
+            return judgeBench(options);
+        case 'consent':
+            return judgeRequestCloudConsent(options);
+        default:
+            throw new Error('judge requires subcommand: status, list, use, test, bench, or consent');
+    }
+}

package/dist/commands/metrics.js

@@ -2,6 +2,12 @@ import { readFile } from 'node:fs/promises';
 import path from 'node:path';
 import { loadConfigFile } from '../config-io.js';
 import { computeAuditMetrics, parseAuditNdjson } from '../core/audit-metrics.js';
+function formatFingerprintPreview(fingerprint) {
+    if (fingerprint.length <= 12) {
+        return fingerprint;
+    }
+    return `${fingerprint.slice(0, 12)}…`;
+}
 export async function metricsProject(options = {}) {
     const repoRoot = path.resolve(options.targetDir ?? process.cwd());
     const config = await loadConfigFile(repoRoot);
@@ -26,6 +32,7 @@ export function formatMetricsReport(report) {
         `Schema: v${report.schemaVersion}`,
         `Gate events: ${report.gateEvents}`,
         `Would-block: ${report.wouldBlockCount} (${(report.wouldBlockRate * 100).toFixed(1)}%)`,
+        `Classifier-quality would-block: ${report.classifierWouldBlockCount} (${(report.classifierWouldBlockRate * 100).toFixed(1)}%)`,
         `Approvals recorded during audit: ${report.approvalRecordedCount}`,
     ];
     if (report.approvalLatency.count > 0) {
@@ -34,6 +41,31 @@ export function formatMetricsReport(report) {
     if (report.bypassAttemptCount > 0) {
         lines.push(`Bypass attempts detected: ${report.bypassAttemptCount}`);
     }
+    if (report.availabilityAsks.total > 0) {
+        lines.push('', 'Availability-caused asks (infrastructure, not classifier ground truth):');
+        lines.push(`- missing trusted cwd: ${report.availabilityAsks.missingTrustedCwd}`);
+        lines.push(`- judge timeout: ${report.availabilityAsks.judgeTimeout}`);
+        lines.push(`- other judge fallback: ${report.availabilityAsks.judgeFallback}`);
+        lines.push(`- total: ${report.availabilityAsks.total}`);
+    }
+    if (report.repeatedFingerprintAsks.length > 0) {
+        lines.push('', 'Repeated fingerprint asks (repeat friction):');
+        for (const entry of report.repeatedFingerprintAsks) {
+            lines.push(`- [${entry.reason}] x${entry.askCount} ${formatFingerprintPreview(entry.fingerprint)}: ${entry.summary}`);
+        }
+    }
+    if (Object.keys(report.wouldBlockByReason).length > 0) {
+        lines.push('', 'Would-block by reason:');
+        for (const [reason, count] of Object.entries(report.wouldBlockByReason).sort((a, b) => b[1] - a[1])) {
+            lines.push(`- ${reason}: ${count}`);
+        }
+    }
+    if (report.approvalRatioByReason.length > 0) {
+        lines.push('', 'Approval ratio by reason (candidate signal, not ground truth):');
+        for (const entry of report.approvalRatioByReason.slice(0, 10)) {
+            lines.push(`- ${entry.reason}: ${(entry.approvalRate * 100).toFixed(0)}% approved after deny (${entry.approvedAfterDenyCount}/${entry.wouldBlockCount})`);
+        }
+    }
     if (Object.keys(report.byVerdict).length > 0) {
         lines.push('', 'By verdict:');
         for (const [verdict, count] of Object.entries(report.byVerdict).sort((a, b) => b[1] - a[1])) {
@@ -61,13 +93,13 @@ export function formatMetricsReport(report) {
         }
     }
     if (report.noisyRuleCandidates.length > 0) {
-        lines.push('', 'Noisy rule candidates:');
+        lines.push('', 'Noisy rule candidates (high-signal subset of approval ratios; ≥50% approved after deny):');
         for (const rule of report.noisyRuleCandidates) {
             lines.push(`- ${rule.reason}: ${(rule.approvalRate * 100).toFixed(0)}% approved after deny (${rule.approvedCount}/${rule.denyCount})`);
         }
     }
     if (Object.keys(report.byReason).length > 0) {
-        lines.push('', 'By reason:');
+        lines.push('', 'All gate events by reason:');
         for (const [reason, count] of Object.entries(report.byReason).sort((a, b) => b[1] - a[1])) {
             lines.push(`- ${reason}: ${count}`);
         }

package/dist/commands/quality.d.ts

@@ -0,0 +1,38 @@
+import type { CorpusCategory, CorpusProvenanceCounts } from '../corpus/types.js';
+export declare const QUALITY_REPORT_SCHEMA_VERSION = 1;
+export interface QualityReport {
+    schemaVersion: typeof QUALITY_REPORT_SCHEMA_VERSION;
+    ok: boolean;
+    corpus: {
+        path: string;
+        passesHardGates: boolean;
+        totalCases: number;
+        categoryCounts: Record<CorpusCategory, number>;
+        provenanceCounts: CorpusProvenanceCounts;
+        mustAskMisses: number;
+        provablyBenignBlocks: number;
+        acceptedBenignMismatches: number;
+        accuracy: number;
+    };
+    audit: {
+        logPath: string;
+        gateEvents: number;
+        classifierWouldBlockRate: number;
+        availabilityAsks: number;
+        readyForEnforce: boolean;
+        repeatedFingerprintPatterns: number;
+    };
+    harvest: {
+        scope: 'shell';
+        benignCandidates: number;
+        availabilityQueue: number;
+    };
+    notes: string[];
+}
+export interface QualityOptions {
+    targetDir?: string;
+    corpusDir?: string;
+    json?: boolean;
+}
+export declare function qualityCheck(options?: QualityOptions): Promise<QualityReport>;
+export declare function formatQualityReport(report: QualityReport): string;