@guilz-dev/belay 0.3.0 → 0.4.0

package/dist/core/verdict/judge-transport.js

@@ -0,0 +1,258 @@
+import { hashJudgeSessionRef } from './judge-audit.js';
+import { recordJudgeLatency } from './judge-baseline.js';
+import { evaluateViaJudgeBroker, invalidateJudgeSession } from './judge-broker-service.js';
+import { buildCliInvocation, CliRunError, parseCliJudgeOutput, runCliJsonWithTimeouts, } from './judge-cli.js';
+import { resolveCliVersionFingerprint } from './judge-cli-fingerprint.js';
+import { assertReadOnlyInvocationArgs, providerSupportsSession } from './judge-provider-matrix.js';
+import { resolveSessionEvalTimeoutMs } from './judge-runtime-config.js';
+import { buildJudgeSessionKey, exceedsPromptBudget, guardFailClosedFallbackReason, } from './judge-session-guard.js';
+import { isJudgeSessionKillSwitchActive, recordShadowComparison, shouldRunShadowComparison, triggerJudgeSessionKillSwitch, verdictsEquivalent, } from './judge-shadow.js';
+function isEvalTimeoutError(error) {
+    const message = error instanceof Error ? error.message : String(error);
+    return /timed out/i.test(message);
+}
+function classifyParseFailure(providerId, raw) {
+    const trimmed = raw.trim();
+    if (!trimmed) {
+        return 'non_json_response';
+    }
+    if (parseCliJudgeOutput(providerId, trimmed)) {
+        return 'parse_error';
+    }
+    try {
+        JSON.parse(trimmed);
+        return 'parse_error';
+    }
+    catch {
+        return 'non_json_response';
+    }
+}
+function spawnFallbackReason(providerId, error) {
+    if (error instanceof CliRunError) {
+        if (error.kind === 'timeout') {
+            return 'eval_timeout';
+        }
+        if (error.kind === 'exit_nonzero') {
+            return `${providerId}_cli_nonzero`;
+        }
+        if (error.kind === 'spawn_error') {
+            return `${providerId}_cli_spawn_error`;
+        }
+    }
+    if (isEvalTimeoutError(error)) {
+        return 'eval_timeout';
+    }
+    return `${providerId}_cli_unavailable`;
+}
+function parseWithBudget(providerId, raw) {
+    const started = Date.now();
+    const verdict = parseCliJudgeOutput(providerId, raw);
+    const parseMs = Date.now() - started;
+    recordJudgeLatency('tier1_parse', parseMs);
+    return { verdict, parseMs };
+}
+async function runSpawnTransport(request, runCommand) {
+    const { context, prompt } = request;
+    const sessionConfig = context.runtime.session;
+    const invocation = buildCliInvocation(context.providerId, prompt, context.model);
+    const readOnly = assertReadOnlyInvocationArgs(context.providerId, invocation.args);
+    if (!readOnly.ok) {
+        return {
+            raw: '',
+            verdict: null,
+            transport: 'spawn',
+            sessionUsed: false,
+            sessionReused: false,
+            fallbackReason: 'unsafe_option_rejected',
+            connectMs: 0,
+            evalMs: 0,
+            parseMs: 0,
+        };
+    }
+    const evalTimeoutMs = resolveSessionEvalTimeoutMs(sessionConfig, context.judgeTimeoutMs);
+    let raw = '';
+    let evalMs = 0;
+    const evalStarted = Date.now();
+    try {
+        raw = await runCommand(invocation, evalTimeoutMs);
+        evalMs = Date.now() - evalStarted;
+        recordJudgeLatency('tier1_spawn', evalMs);
+    }
+    catch (error) {
+        evalMs = Date.now() - evalStarted;
+        return {
+            raw: '',
+            verdict: null,
+            transport: 'spawn',
+            sessionUsed: false,
+            sessionReused: false,
+            fallbackReason: spawnFallbackReason(context.providerId, error),
+            connectMs: 0,
+            evalMs,
+            parseMs: 0,
+        };
+    }
+    const parsed = parseWithBudget(context.providerId, raw);
+    return {
+        raw,
+        verdict: parsed.verdict,
+        transport: 'spawn',
+        sessionUsed: false,
+        sessionReused: false,
+        fallbackReason: parsed.verdict ? undefined : classifyParseFailure(context.providerId, raw),
+        connectMs: 0,
+        evalMs,
+        parseMs: parsed.parseMs,
+    };
+}
+async function runSessionTransport(request, runCommand) {
+    const { context, prompt } = request;
+    const sessionConfig = context.runtime.session;
+    const connectStarted = Date.now();
+    if (!sessionConfig.enabled ||
+        !providerSupportsSession(context.providerId, sessionConfig.providerAllowlist) ||
+        (await isJudgeSessionKillSwitchActive(context.repoRoot, context.stateDir))) {
+        return runSpawnTransport(request, runCommand);
+    }
+    let cliVersion = 'unknown';
+    try {
+        cliVersion = await resolveCliVersionFingerprint(context.providerId, sessionConfig.connectTimeoutMs);
+    }
+    catch {
+        return {
+            ...(await runSpawnTransport(request, runCommand)),
+            fallbackReason: 'connect_timeout',
+            sessionUsed: false,
+            sessionReused: false,
+        };
+    }
+    const connectMs = Date.now() - connectStarted;
+    recordJudgeLatency('tier1_connect', connectMs);
+    const promptBytes = Buffer.byteLength(prompt, 'utf8');
+    if (exceedsPromptBudget(promptBytes, sessionConfig)) {
+        const spawnResult = await runSpawnTransport(request, runCommand);
+        return {
+            ...spawnResult,
+            sessionUsed: false,
+            sessionReused: false,
+            sessionResetReason: 'max_prompt_bytes_exceeded',
+            fallbackReason: 'guard_reset',
+        };
+    }
+    const keyParts = {
+        providerId: context.providerId,
+        model: context.model,
+        repoRoot: context.repoRoot,
+        judgeMode: context.judgeMode,
+        cliVersion,
+    };
+    const sessionKey = buildJudgeSessionKey(keyParts);
+    const sessionRefHash = hashJudgeSessionRef(sessionKey);
+    const invocation = buildCliInvocation(context.providerId, prompt, context.model);
+    const readOnly = assertReadOnlyInvocationArgs(context.providerId, invocation.args);
+    if (!readOnly.ok) {
+        return runSpawnTransport(request, runCommand);
+    }
+    const evalTimeoutMs = resolveSessionEvalTimeoutMs(sessionConfig, context.judgeTimeoutMs);
+    const evalStarted = Date.now();
+    let brokerResult;
+    try {
+        brokerResult = await evaluateViaJudgeBroker({
+            stateDir: context.stateDir,
+            repoRoot: context.repoRoot,
+            sessionConfig,
+            request: {
+                keyParts,
+                invocation,
+                promptBytes,
+            },
+            timeoutMs: evalTimeoutMs,
+            runCommand,
+        });
+    }
+    catch (error) {
+        const spawnResult = await runSpawnTransport(request, runCommand);
+        return {
+            ...spawnResult,
+            transport: 'session',
+            sessionUsed: true,
+            sessionReused: false,
+            fallbackReason: spawnFallbackReason(context.providerId, error),
+            sessionResetReason: 'cli_error',
+            sessionRefHash,
+        };
+    }
+    const evalMs = Date.now() - evalStarted;
+    recordJudgeLatency('tier1_session', evalMs);
+    recordJudgeLatency('tier1_eval', evalMs);
+    const parsed = parseWithBudget(context.providerId, brokerResult.raw);
+    if (!parsed.verdict) {
+        const parseReason = classifyParseFailure(context.providerId, brokerResult.raw);
+        await invalidateJudgeSession({
+            stateDir: context.stateDir,
+            repoRoot: context.repoRoot,
+            sessionConfig,
+            sessionKey,
+            reason: parseReason === 'non_json_response' ? 'non_json_response' : 'parse_failure',
+        });
+        const spawnResult = await runSpawnTransport(request, runCommand);
+        return {
+            ...spawnResult,
+            transport: 'session',
+            sessionUsed: true,
+            sessionReused: brokerResult.reused,
+            fallbackReason: guardFailClosedFallbackReason(parseReason === 'non_json_response' ? 'non_json_response' : 'parse_failure'),
+            sessionResetReason: parseReason === 'non_json_response' ? 'non_json_response' : 'parse_failure',
+            sessionRefHash,
+        };
+    }
+    return {
+        raw: brokerResult.raw,
+        verdict: parsed.verdict,
+        transport: 'session',
+        sessionUsed: true,
+        sessionReused: brokerResult.reused,
+        sessionResetReason: brokerResult.resetReason,
+        sessionRefHash,
+        connectMs,
+        evalMs,
+        parseMs: parsed.parseMs,
+    };
+}
+export async function evaluateWithJudgeTransport(request, options = {}) {
+    const runCommand = options.runCommand ??
+        ((invocation, timeoutMs) => runCliJsonWithTimeouts(invocation, { evalTimeoutMs: timeoutMs }));
+    const { context } = request;
+    const useSession = context.runtime.session.enabled &&
+        providerSupportsSession(context.providerId, context.runtime.session.providerAllowlist) &&
+        !(await isJudgeSessionKillSwitchActive(context.repoRoot, context.stateDir));
+    const primary = useSession
+        ? await runSessionTransport(request, runCommand)
+        : await runSpawnTransport(request, runCommand);
+    if (!shouldRunShadowComparison(context.repoRoot, context.providerId, context.runtime.shadow)) {
+        return primary;
+    }
+    const shadowSpawn = primary.transport === 'session' ? await runSpawnTransport(request, runCommand) : primary;
+    if (!primary.verdict || !shadowSpawn.verdict) {
+        return primary;
+    }
+    const shadow = recordShadowComparison(context.repoRoot, context.runtime.shadow, !verdictsEquivalent(primary.verdict, shadowSpawn.verdict));
+    if (shadow.killSwitchTriggered) {
+        await triggerJudgeSessionKillSwitch(context.repoRoot, context.stateDir);
+    }
+    return {
+        ...primary,
+        shadowCompared: shadow.compared,
+        shadowMismatch: shadow.mismatch,
+        shadowMismatchRateWindow: shadow.mismatchRateWindow,
+        killSwitchTriggered: shadow.killSwitchTriggered,
+        verdict: shadow.mismatch ? shadowSpawn.verdict : primary.verdict,
+        fallbackReason: shadow.mismatch ? 'shadow_forced_spawn' : primary.fallbackReason,
+        transport: shadow.mismatch ? 'spawn' : primary.transport,
+        sessionUsed: shadow.mismatch ? false : primary.sessionUsed,
+        sessionReused: shadow.mismatch ? false : primary.sessionReused,
+    };
+}
+export function buildTransportInvocation(providerId, prompt, model) {
+    return buildCliInvocation(providerId, prompt, model);
+}

package/dist/core/verdict/judge.d.ts

@@ -1,6 +1,6 @@
 import type { ScrubOptions } from '../types.js';
 import type { Tier1Judge, Tier1Verdict } from './types.js';
-export type Tier1JudgeTransport = 'http' | 'ollama-http' | 'codex-cli' | 'cursor-cli' | 'claude-cli' | 'unavailable';
+export type Tier1JudgeTransport = 'http' | 'ollama-http' | 'codex-cli' | 'cursor-cli' | 'claude-cli' | 'codex-cli-session' | 'cursor-cli-session' | 'claude-cli-session' | 'unavailable';
 export interface Tier1JudgeTrace {
     provider: 'openai-compatible' | 'ollama' | 'anthropic' | 'fallback';
     modelRequested: string;
@@ -9,6 +9,18 @@ export interface Tier1JudgeTrace {
     transport?: Tier1JudgeTransport;
     outboundRedacted?: boolean;
     fallbackReason?: string;
+    judgeSessionUsed?: boolean;
+    judgeSessionReused?: boolean;
+    judgeSessionRefHash?: string;
+    judgeSessionResetReason?: string;
+    judgeFallbackReason?: string;
+    judgeConnectMs?: number;
+    judgeEvalMs?: number;
+    judgeParseMs?: number;
+    judgeShadowCompared?: boolean;
+    judgeShadowMismatch?: boolean;
+    judgeShadowMismatchRateWindow?: number;
+    judgeKillSwitchTriggered?: boolean;
 }
 export interface TracedTier1Judge extends Tier1Judge {
     lastTrace?: Tier1JudgeTrace;
@@ -21,6 +33,7 @@ export interface MutationPrescanParams {
     cwd: string;
     repoRoot: string;
     trustedCwd: boolean;
+    trustedWorkspaceRoots?: string[];
     sensitivePaths: string[];
 }
 /** ADR-002 M3: structural prescan for sensitive / persistent mutation targets (shell redirects, etc.). */

package/dist/core/verdict/judge.js

@@ -1,5 +1,5 @@
 import { matchesSensitivePath } from '../glob.js';
-import { relativeWithinRepo, resolveMutationTarget } from '../path-utils.js';
+import { resolveMutationTarget, resolveWorkspaceRootMatch } from '../path-utils.js';
 import { resolveTrustedPath } from './containment.js';
 import { scrubOutboundForJudge } from './judge-outbound.js';
 import { isOutsideRepoSecretCredentialPath, isPersistentAgentPath } from './persistent-paths.js';
@@ -85,9 +85,9 @@ export function prescanMutationTargets(params) {
         if (!resolved) {
             continue;
         }
-        const relative = relativeWithinRepo(params.repoRoot, resolved);
-        if (relative !== null &&
-            matchesSensitivePath(relative.replaceAll('\\', '/'), params.sensitivePaths)) {
+        const workspaceMatch = resolveWorkspaceRootMatch(params.repoRoot, params.trustedWorkspaceRoots, resolved);
+        if (workspaceMatch !== null &&
+            matchesSensitivePath(workspaceMatch.relativePath.replaceAll('\\', '/'), params.sensitivePaths)) {
             return {
                 local_recoverable: false,
                 destroys_outside_repo: false,
@@ -95,7 +95,8 @@ export function prescanMutationTargets(params) {
                 reason: 'sensitive_path_mutation',
             };
         }
-        if (relative === null && isOutsideRepoSecretCredentialPath(resolved)) {
+        if ((workspaceMatch === null || workspaceMatch.kind === 'trusted') &&
+            isOutsideRepoSecretCredentialPath(resolved)) {
             return {
                 local_recoverable: false,
                 destroys_outside_repo: false,

package/dist/core/verdict/parser.js

@@ -160,7 +160,12 @@ export function splitTopLevelSegments(command) {
         }
     };
     for (const token of tokens) {
-        if (token === '&&' || token === '||' || token === ';' || token === '|' || token === '&') {
+        if (token === '&&' ||
+            token === '||' ||
+            token === ';' ||
+            token === '|' ||
+            token === '&' ||
+            token === '|&') {
             flush();
             continue;
         }

package/dist/core/verdict/types.d.ts

@@ -43,12 +43,25 @@ export interface JudgeTrace {
     latencyMs: number;
     outboundRedacted?: boolean;
     fallbackReason?: string;
+    judgeSessionUsed?: boolean;
+    judgeSessionReused?: boolean;
+    judgeSessionRefHash?: string;
+    judgeSessionResetReason?: string;
+    judgeFallbackReason?: string;
+    judgeConnectMs?: number;
+    judgeEvalMs?: number;
+    judgeParseMs?: number;
+    judgeShadowCompared?: boolean;
+    judgeShadowMismatch?: boolean;
+    judgeShadowMismatchRateWindow?: number;
+    judgeKillSwitchTriggered?: boolean;
 }
 export type VerdictMode = 'enforce' | 'audit';
 export interface VerdictContext {
     cwd: string;
     repoRoot: string;
     trustedCwd: boolean;
+    trustedWorkspaceRoots?: string[];
     sensitivePaths: string[];
     protectedArtifactRoots?: string[];
     customAllowCommands?: string[];

package/dist/core/verdict/verdict.js

@@ -1,5 +1,5 @@
 import { resolveMutationTarget } from '../path-utils.js';
-import { extractRedirectTargets, tokenizeShell } from '../shell-tokenizer.js';
+import { extractRedirectTargets, isFdDuplication, isRedirectOperator, tokenizeShell, } from '../shell-tokenizer.js';
 import { analyzePathTargets, cwdRelative, isDestructiveHighStakesMutation, resolveTrustedPath, touchesProtectedRoot, } from './containment.js';
 import { classifyEgressTool } from './egress-classify.js';
 import { verdictFingerprint } from './fingerprint.js';
@@ -196,7 +196,7 @@ function extractPathArgs(tokens) {
     const args = [...redirects];
     for (let index = 1; index < tokens.length; index += 1) {
         const token = tokens[index];
-        if (!token || token.startsWith('-') || token === '>' || token === '>>' || token === '<') {
+        if (!token || token.startsWith('-') || isRedirectOperator(token) || isFdDuplication(token)) {
             continue;
         }
         if (redirects.includes(token)) {
@@ -304,6 +304,7 @@ function tier0HighStakesRm(tokens, context) {
         cwd: context.cwd,
         repoRoot: context.repoRoot,
         trustedCwd: context.trustedCwd,
+        trustedWorkspaceRoots: context.trustedWorkspaceRoots,
         sensitivePaths: context.sensitivePaths,
         protectedArtifactRoots: context.protectedArtifactRoots,
     });
@@ -336,7 +337,7 @@ function tier0HighStakesRm(tokens, context) {
             const resolved = resolveTrustedPath(target, context.cwd, context.trustedCwd) ??
                 resolveMutationTarget(target, context.cwd);
             if (resolved &&
-                isDestructiveHighStakesMutation(head, resolved, context.repoRoot, context.sensitivePaths, context.protectedArtifactRoots)) {
+                isDestructiveHighStakesMutation(head, resolved, context.repoRoot, context.sensitivePaths, context.protectedArtifactRoots, context.trustedWorkspaceRoots)) {
                 destructiveHighStakes = true;
                 break;
             }
@@ -563,6 +564,7 @@ async function evaluateSegment(command, context, depth) {
         cwd: context.cwd,
         repoRoot: context.repoRoot,
         trustedCwd: context.trustedCwd,
+        trustedWorkspaceRoots: context.trustedWorkspaceRoots,
         sensitivePaths: context.sensitivePaths,
         protectedArtifactRoots: context.protectedArtifactRoots,
     });
@@ -612,7 +614,7 @@ async function evaluateSegment(command, context, depth) {
             const resolved = resolveTrustedPath(target, context.cwd, context.trustedCwd) ??
                 resolveMutationTarget(target, context.cwd);
             if (resolved &&
-                isDestructiveHighStakesMutation(segment.head, resolved, context.repoRoot, context.sensitivePaths, context.protectedArtifactRoots)) {
+                isDestructiveHighStakesMutation(segment.head, resolved, context.repoRoot, context.sensitivePaths, context.protectedArtifactRoots, context.trustedWorkspaceRoots)) {
                 destructiveHighStakes = true;
                 break;
             }
@@ -668,6 +670,7 @@ async function evaluateSegment(command, context, depth) {
             cwd: context.cwd,
             repoRoot: context.repoRoot,
             trustedCwd: context.trustedCwd,
+            trustedWorkspaceRoots: context.trustedWorkspaceRoots,
             sensitivePaths: context.sensitivePaths,
         })
         : null;

package/dist/corpus/adversarial-probe.d.ts

@@ -0,0 +1,86 @@
+import { type MutatedCase } from './mutators.js';
+declare const MUST_ASK_VERDICT: "deny_pending_approval";
+export declare function probeCaseKey(entry: {
+    core: string;
+    mutatorId: string;
+    command: string;
+}): string;
+export interface ProbePassedCase {
+    core: string;
+    mutatorId: string;
+    command: string;
+}
+export interface AdversarialProbeFailure {
+    core: string;
+    mutatorId: string;
+    command: string;
+    expected: typeof MUST_ASK_VERDICT;
+    actual: string;
+    reason: string;
+}
+export interface AdversarialProbeFpFailure {
+    core: string;
+    mutatorId: string;
+    command: string;
+    actual: string;
+    reason: string;
+}
+export interface AdversarialProbeReport {
+    iteration: number;
+    generatedAt: string;
+    seed: number;
+    batchId: string;
+    sourceCommands: string[];
+    selectedMutators: string[];
+    maxCases?: number;
+    holdoutRatio: number;
+    totalCases: number;
+    fixSetSize: number;
+    holdoutSetSize: number;
+    fixSetFnRate: number;
+    firstPassFnRate: number;
+    /** null when no FP probe cases were evaluated. */
+    firstPassFpRate: number | null;
+    fpProbeSize: number;
+    /** null when holdout set is empty, or fix set FN rate is 0 but holdout FN > 0. */
+    holdoutFnRate: number | null;
+    /** holdoutFnRate / fixSetFnRate; 1.0 when both are 0. null when holdout empty. */
+    holdoutFixFnRateRatio: number | null;
+    passedCases: ProbePassedCase[];
+    failures: AdversarialProbeFailure[];
+    fpFailures: AdversarialProbeFpFailure[];
+    /** Populated by fix sessions / CI integration; empty when probe-only. */
+    filesChanged: string[];
+}
+export interface AdversarialProbeOptions {
+    seed?: number;
+    holdoutRatio?: number;
+    maxCases?: number;
+    outputDir?: string;
+    repoRoot?: string;
+    iteration?: number;
+}
+/** Mulberry32 PRNG for reproducible shuffles. */
+export declare function createSeededRandom(seed: number): () => number;
+export declare function shuffleWithSeed<T>(items: readonly T[], seed: number): T[];
+export declare function splitFixHoldout<T>(items: readonly T[], seed: number, holdoutRatio?: number): {
+    fix: T[];
+    holdout: T[];
+};
+export declare function generateProbeCases(seed: number, maxCases?: number): MutatedCase[];
+/** Benign must-allow cores × AUTO_LABEL mutators — FP over-stop probe (not for corpus auto-add). */
+export declare function generateFpProbeCases(seed: number): MutatedCase[];
+/** Ratio for overfitting detection; null when holdout unavailable or fix-perfect but holdout not. */
+export declare function holdoutFixFnRateRatio(fixSetFnRate: number, holdoutFnRate: number | null): number | null;
+export declare function runAdversarialProbe(options?: AdversarialProbeOptions): Promise<AdversarialProbeReport>;
+export declare function defaultProbeOutputDir(): string;
+export declare function formatProbeSummary(report: AdversarialProbeReport): string;
+export declare function parseProbeCliArgs(argv: string[]): {
+    seed: number;
+    holdoutRatio: number;
+    maxCases?: number;
+    strict: boolean;
+    outputDir: string;
+};
+export declare function main(argv?: string[]): Promise<number>;
+export {};