@guilz-dev/belay 0.3.0 → 0.4.0

package/dist/installer.js

@@ -11,6 +11,7 @@ import { appendCliAuditEvent } from './core/audit-io.js';
 import { isFreshConfigInput, mergeConfig, normalizeConfig, } from './core/config.js';
 import { runtimeIntegrityFiles, writeIntegrityManifest } from './core/integrity.js';
 import { hasValidCloudConsent, isCloudJudgeConfig, migrateImplicitLocalJudgeIfNeeded, resolveInitJudgeConfig, } from './core/judge-config.js';
+import { resolveJudgeTransport } from './core/judge-runtime-detection.js';
 import { bootstrapStateFiles, writeSkillArtifacts } from './installer/bootstrap.js';
 import { writeRuntimeArtifacts } from './installer/runtime-artifacts.js';
 import { applyInstallScope, resolveOperationScope } from './installer/scope-config.js';
@@ -154,7 +155,9 @@ async function applyInitJudgeConfig(repoRoot, adapterName, options, isFreshBefor
         };
     }
     const configWithJudge = normalizeConfig({ ...mergedConfig, version: 4, judge: finalJudge });
-    if (isCloudJudgeConfig(configWithJudge.judge) && !hasValidCloudConsent(configWithJudge.judge)) {
+    if (isCloudJudgeConfig(configWithJudge.judge) &&
+        resolveJudgeTransport(configWithJudge.judge) === 'http' &&
+        !hasValidCloudConsent(configWithJudge.judge)) {
         process.stderr.write('Warning: Cloud judge saved without recorded consent. Tier1 cloud judge will fail closed until consent is granted (belay judge consent + belay approve, or TTY --accept-cloud-judge).\n');
     }
     await writeConfigFile(repoRoot, configWithJudge, adapterName);

package/dist/judge-broker-daemon.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/judge-broker-daemon.js

@@ -0,0 +1,123 @@
+import { mkdir, readFile, unlink, writeFile } from 'node:fs/promises';
+import { createServer } from 'node:net';
+import path from 'node:path';
+import { cleanupJudgeBrokerArtifacts, JUDGE_BROKER_SESSION, judgeBrokerPaths, } from './core/verdict/judge-broker-service.js';
+import { runCliJsonWithTimeouts } from './core/verdict/judge-cli.js';
+import { DEFAULT_JUDGE_SESSION_CONFIG, normalizeJudgeSessionConfig, resolveSessionEvalTimeoutMs, } from './core/verdict/judge-runtime-config.js';
+import { JudgeSessionBroker, } from './core/verdict/judge-session-broker.js';
+async function loadBrokerSessionConfig(stateDir) {
+    const sessionConfigPath = path.join(stateDir, JUDGE_BROKER_SESSION);
+    try {
+        const raw = JSON.parse(await readFile(sessionConfigPath, 'utf8'));
+        return normalizeJudgeSessionConfig({ ...raw, enabled: true });
+    }
+    catch {
+        return normalizeJudgeSessionConfig({ ...DEFAULT_JUDGE_SESSION_CONFIG, enabled: true });
+    }
+}
+async function main() {
+    const repoRoot = process.env.BELAY_JUDGE_BROKER_REPO_ROOT;
+    const stateDir = process.env.BELAY_JUDGE_BROKER_STATE_DIR;
+    if (!repoRoot || !stateDir) {
+        process.stderr.write('BELAY_JUDGE_BROKER_REPO_ROOT and BELAY_JUDGE_BROKER_STATE_DIR are required.\n');
+        process.exitCode = 1;
+        return;
+    }
+    const paths = judgeBrokerPaths(stateDir);
+    await mkdir(stateDir, { recursive: true, mode: 0o700 });
+    const sessionConfig = await loadBrokerSessionConfig(stateDir);
+    const defaultEvalTimeoutMs = resolveSessionEvalTimeoutMs(sessionConfig, 25_000);
+    const broker = new JudgeSessionBroker({
+        config: sessionConfig,
+        runCommand: (invocation, timeoutMs) => runCliJsonWithTimeouts(invocation, { evalTimeoutMs: timeoutMs }),
+    });
+    let idleTimer = null;
+    let server;
+    const scheduleIdleShutdown = () => {
+        if (idleTimer) {
+            clearTimeout(idleTimer);
+        }
+        idleTimer = setTimeout(() => {
+            void shutdown('idle_timeout');
+        }, sessionConfig.maxIdleMs);
+    };
+    const shutdown = async (reason) => {
+        broker.stopAll('manual_stop');
+        server?.close();
+        await cleanupJudgeBrokerArtifacts(paths);
+        process.stderr.write(`judge broker stopped (${reason})\n`);
+        process.exit(0);
+    };
+    server = createServer((socket) => {
+        scheduleIdleShutdown();
+        let buffer = '';
+        socket.on('data', (chunk) => {
+            buffer += String(chunk);
+            const lines = buffer.split('\n');
+            buffer = lines.pop() ?? '';
+            for (const line of lines) {
+                if (!line.trim()) {
+                    continue;
+                }
+                void handleLine(line, socket, broker, defaultEvalTimeoutMs).catch((error) => {
+                    const id = safeMessageId(line);
+                    socket.write(`${JSON.stringify({
+                        type: 'error',
+                        id,
+                        error: error instanceof Error ? error.message : 'judge broker handler failed',
+                    })}\n`);
+                });
+            }
+        });
+    });
+    await unlink(paths.socketPath).catch(() => undefined);
+    await new Promise((resolve, reject) => {
+        server.once('error', reject);
+        server.listen(paths.socketPath, () => resolve());
+    });
+    const status = {
+        pid: process.pid,
+        repoRoot: path.resolve(repoRoot),
+        socketPath: paths.socketPath,
+        startedAt: new Date().toISOString(),
+    };
+    await writeFile(paths.statusPath, JSON.stringify(status), { encoding: 'utf8', mode: 0o600 });
+    await writeFile(paths.pidPath, String(process.pid), { encoding: 'utf8', mode: 0o600 });
+    process.on('SIGTERM', () => {
+        void shutdown('sigterm');
+    });
+    process.on('SIGINT', () => {
+        void shutdown('sigint');
+    });
+    scheduleIdleShutdown();
+    process.stdout.write(`judge broker listening on ${paths.socketPath} for ${repoRoot}\n`);
+}
+function safeMessageId(line) {
+    try {
+        const parsed = JSON.parse(line);
+        return parsed.id ?? 'unknown';
+    }
+    catch {
+        return 'unknown';
+    }
+}
+async function handleLine(line, socket, broker, defaultEvalTimeoutMs) {
+    const message = JSON.parse(line);
+    if (message.type === 'stop') {
+        socket.write(`${JSON.stringify({ type: 'stopped', id: message.id })}\n`);
+        broker.stopAll('manual_stop');
+        return;
+    }
+    if (message.type === 'invalidate' && typeof message.sessionKey === 'string') {
+        broker.invalidateSession(message.sessionKey, message.reason ?? 'parse_failure');
+        socket.write(`${JSON.stringify({ type: 'invalidated', id: message.id })}\n`);
+        return;
+    }
+    if (message.type !== 'evaluate' || !message.request) {
+        socket.write(`${JSON.stringify({ type: 'error', id: message.id, error: 'unsupported message' })}\n`);
+        return;
+    }
+    const result = await broker.evaluate(message.request, message.timeoutMs ?? defaultEvalTimeoutMs);
+    socket.write(`${JSON.stringify({ type: 'result', id: message.id, result })}\n`);
+}
+await main();

package/dist/services/sandbox-service.d.ts

@@ -24,6 +24,7 @@ export interface SandboxStatusReport {
 export declare function sandboxStatus(options?: SandboxServiceOptions): Promise<SandboxStatusReport>;
 export declare function createCapabilityApprovalStore(repoRoot: string, config: Awaited<ReturnType<typeof loadConfigFile>>): {
     allowlistPath: string;
+    trustedRootsPath: string;
     loadPending(): Promise<{
         filePath: string;
         state: import("../types.js").ApprovalStateFile;

package/dist/services/sandbox-service.js

@@ -2,6 +2,7 @@ import path from 'node:path';
 import { loadConfigFile, repoLocalStateDirFor } from '../config-io.js';
 import { fsScopeAllowlistPath, loadFsScopeAllowlist } from '../core/capability/allowlist.js';
 import { evaluateL1FullStatus, isCapabilityBrokerDemotionActive, } from '../core/capability/broker.js';
+import { trustedWorkspaceRootsPath } from '../core/capability/trusted-workspace-roots.js';
 import { configuredControlPlaneDir } from '../core/config.js';
 import { verifyControlPlaneIsolation } from '../core/control-plane-isolation.js';
 import { egressStatus } from './egress-service.js';
@@ -48,6 +49,7 @@ export function createCapabilityApprovalStore(repoRoot, config) {
     const repoLocalDir = repoLocalStateDirFor(repoRoot, config);
     return {
         allowlistPath: fsScopeAllowlistPath(config, repoLocalDir),
+        trustedRootsPath: trustedWorkspaceRootsPath(config, repoLocalDir),
         async loadPending() {
             const { loadApprovalState, pendingApprovalsPath } = await import('../config-io.js');
             const filePath = pendingApprovalsPath(repoRoot, config);

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const PACKAGE_VERSION = "0.3.0";
+export declare const PACKAGE_VERSION = "0.4.0";

package/dist/version.js

@@ -1,2 +1,2 @@
 // Generated by scripts/sync-version.mjs — do not edit.
-export const PACKAGE_VERSION = '0.3.0';
+export const PACKAGE_VERSION = '0.4.0';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@guilz-dev/belay",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "Belay-style approval and audit gating for agent runtimes.",
   "type": "module",
   "license": "MIT",
@@ -48,15 +48,19 @@
     "agent-belay-logo.png"
   ],
   "scripts": {
-    "build": "rm -rf dist && node scripts/sync-version.mjs && tsc -p tsconfig.build.json && node scripts/build-runtime.mjs",
+    "build": "rm -rf dist && node scripts/sync-version.mjs && tsc -p tsconfig.build.json && node scripts/generate-standing-allow-catalog.mjs && tsc -p tsconfig.build.json && node scripts/build-runtime.mjs",
     "check:version": "node scripts/check-cli-version.mjs",
+    "dogfood": "./scripts/dev-dogfood.sh",
+    "dev-refresh": "./scripts/dev-refresh.sh",
     "prepublishOnly": "pnpm build && node scripts/check-cli-version.mjs",
     "lint": "biome check src package.json README.md CHANGELOG.md CONTRIBUTING.md SECURITY.md tsconfig.json tsconfig.build.json vitest.config.ts scripts docs",
     "typecheck": "tsc --noEmit",
     "test": "pnpm build && vitest run",
     "test:structural": "pnpm build && vitest run src/__tests__/verdict/structural-suite.test.ts",
     "test:stable": "pnpm build && vitest run && vitest run && vitest run",
-    "corpus": "pnpm build && node scripts/corpus.mjs"
+    "corpus": "pnpm build && node scripts/corpus.mjs",
+    "probe:adversarial": "pnpm build && node scripts/adversarial-probe.mjs",
+    "corpus:ratchet": "pnpm build && node scripts/corpus-ratchet.mjs"
   },
   "devDependencies": {
     "@biomejs/biome": "2.4.15",

package/skills/belay/SKILL.md

@@ -38,7 +38,13 @@ setup (or `npx @guilz-dev/belay init` for non-interactive install). Run
 
 1. Read the approval ID in the deny message.
 2. Approve once with `/belay-approve <approval-id>` or `belay approve <approval-id>`.
-3. Retry the original action unchanged.
+3. Retry the original action unchanged (default `approval.flow` is `one_step` for shell — the
+   approval response includes a replay hint when auto-replay is enabled).
+
+For shell-only CLI replay after approval: `belay approve <approval-id> --replay`.
+
+To restore the legacy two-step UX (approve, then always retry manually), set
+`approval.flow` to `two_step` in `belay.config.json`.
 
 For why it was blocked, use `/belay why <command>` or `belay explain --command "<command>"`.
 For the latest pending ask, use `/belay explain` or `belay explain`.

package/skills/belay/belay-approve.md

@@ -5,3 +5,20 @@ belay approve <approval-id>
 ```
 
 Then retry the original action unchanged.
+
+With default `approval.flow: one_step`, shell approvals return a replay hint from editor
+hooks. Tool and subagent approvals still require a manual retry.
+
+To run a denied shell command from the CLI after approval (explicit opt-in; do not also retry via hooks):
+
+```bash
+belay approve <approval-id> --replay
+```
+
+Successful CLI replay consumes the one-shot grant. On failure, the approval stays active for one hook retry.
+
+Restore legacy two-step UX in `belay.config.json`:
+
+```json
+{ "approval": { "flow": "two_step" } }
+```