@guilz-dev/belay 0.3.0 → 0.6.0

package/dist/core/gate-engine.js

@@ -1,4 +1,5 @@
 import { allPathsAllowlisted } from './capability/allowlist.js';
+import { checkGatedActionLimits } from './capability/limits.js';
 import { collectOutsideRepoPaths, collectOutsideRepoPathsFromToolPayload, } from './capability/paths.js';
 import { classifySubagent } from './classify-subagent.js';
 import { classifyToolUse } from './classify-tool.js';
@@ -167,28 +168,28 @@ function applyFsScopePeripheralPolicy(outsideRepoPaths, result, options) {
     return result;
 }
 function applySandboxOutsideBoundary(command, action, result, options) {
-    const outsideRepoPaths = collectOutsideRepoPaths(command, action.cwd, action.repoRoot);
+    const outsideRepoPaths = collectOutsideRepoPaths(command, action.cwd, action.repoRoot, options.trustedWorkspaceRoots);
     return applySandboxFsScopeBoundary(outsideRepoPaths, result, options, {
         redirect: command.includes('>'),
     });
 }
 function applyShellPeripheralPolicy(command, action, result, options) {
-    const outsideRepoPaths = collectOutsideRepoPaths(command, action.cwd, action.repoRoot);
+    const outsideRepoPaths = collectOutsideRepoPaths(command, action.cwd, action.repoRoot, options.trustedWorkspaceRoots);
     return applyFsScopePeripheralPolicy(outsideRepoPaths, result, options);
 }
-function outsideRepoPathsForToolAction(action) {
+function outsideRepoPathsForToolAction(action, options) {
     const payload = action.payload ?? {};
-    const paths = new Set(collectOutsideRepoPathsFromToolPayload(payload, action.cwd, action.repoRoot));
+    const paths = new Set(collectOutsideRepoPathsFromToolPayload(payload, action.cwd, action.repoRoot, options.trustedWorkspaceRoots));
     const command = shellCommandFromPayload(payload);
     if (command) {
-        for (const resolved of collectOutsideRepoPaths(command, action.cwd, action.repoRoot)) {
+        for (const resolved of collectOutsideRepoPaths(command, action.cwd, action.repoRoot, options.trustedWorkspaceRoots)) {
             paths.add(resolved);
         }
     }
     return [...paths];
 }
 function applyToolSandboxPolicies(action, result, options) {
-    const outsideRepoPaths = outsideRepoPathsForToolAction(action);
+    const outsideRepoPaths = outsideRepoPathsForToolAction(action, options);
     const command = shellCommandFromPayload(action.payload ?? {});
     let next = applySandboxFsScopeBoundary(outsideRepoPaths, result, options, {
         redirect: command.includes('>'),
@@ -197,6 +198,10 @@ function applyToolSandboxPolicies(action, result, options) {
     return next;
 }
 export async function classifyGatedAction(action, config, extraOptions = {}) {
+    const limitResult = checkGatedActionLimits(action);
+    if (limitResult) {
+        return limitResult;
+    }
     const options = { ...classifierOptionsFromConfig(config), ...extraOptions };
     if (action.kind === 'shell') {
         const command = action.command ?? shellCommandFromPayload(action.payload ?? {});
@@ -221,7 +226,7 @@ export async function classifyGatedAction(action, config, extraOptions = {}) {
         };
     }
     if (action.kind === 'subagent') {
-        return classifySubagent(action.payload ?? {}, action.repoRoot, options);
+        return classifySubagent(action.payload ?? {}, action.repoRoot, options, config);
     }
     let result = await classifyToolUse(action.payload ?? {}, action.repoRoot, action.cwd, config, options);
     result = applyToolSandboxPolicies(action, result, options);

package/dist/core/harvest.d.ts

@@ -0,0 +1,53 @@
+import type { CorpusCase } from '../corpus/types.js';
+import type { AuditRecord } from './audit-types.js';
+export declare const HARVEST_REPORT_SCHEMA_VERSION = 1;
+export type HarvestCandidateSource = 'deny_then_approve' | 'repeated_ask' | 'read_style_signal' | 'overrides_allow';
+export type HarvestReviewOutcome = 'provably-benign' | 'accepted-benign' | 'reject';
+export interface HarvestCandidate {
+    kind: 'shell';
+    command: string;
+    fingerprint: string;
+    reason: string;
+    sources: HarvestCandidateSource[];
+    askCount: number;
+    approvedAfterDeny: boolean;
+}
+export type AvailabilitySignal = 'missing_trusted_cwd' | 'judge_timeout' | 'judge_fallback';
+export interface AvailabilityQueueItem {
+    kind: 'shell';
+    command: string;
+    fingerprint: string;
+    reason: string;
+    availabilitySignal: AvailabilitySignal;
+    judgeFallbackReason?: string;
+    askCount: number;
+}
+export interface HarvestReport {
+    schemaVersion: typeof HARVEST_REPORT_SCHEMA_VERSION;
+    /** Initial harvest scope — shell audit traces only. */
+    scope: 'shell';
+    candidates: HarvestCandidate[];
+    availabilityQueue: AvailabilityQueueItem[];
+}
+export declare function extractAvailabilityQueue(records: AuditRecord[]): AvailabilityQueueItem[];
+/** Shell gate rows plus approval events — matches what `belay harvest list` needs. */
+export declare function filterRecordsForHarvest(records: AuditRecord[], options?: {
+    since?: string;
+    until?: string;
+}): AuditRecord[];
+export declare function extractHarvestCandidates(records: AuditRecord[], options?: {
+    allowPatterns?: string[];
+}): HarvestCandidate[];
+export declare function buildHarvestReport(records: AuditRecord[], options?: {
+    allowPatterns?: string[];
+}): HarvestReport;
+export declare function applyHarvestReview(cases: CorpusCase[], params: {
+    command: string;
+    outcome: HarvestReviewOutcome;
+    reason?: string;
+}): {
+    cases: CorpusCase[];
+    applied: boolean;
+    ok: boolean;
+    message: string;
+};

package/dist/core/harvest.js

@@ -0,0 +1,276 @@
+import { computeRepeatedFingerprintAsks, isAvailabilityCausedAsk } from './audit-analysis.js';
+import { buildApprovalRoundTrips, filterAuditRecords, inferWouldBlock, isApprovalRecorded, isShellGateRecord, parseTimestamp, } from './audit-query.js';
+import { matchesCustomCommand } from './custom-command-match.js';
+export const HARVEST_REPORT_SCHEMA_VERSION = 1;
+const READ_STYLE_COMMAND_PATTERN = /^\s*(git\s+status|git\s+diff|git\s+log|git\s+show|ls\b|cat\b|head\b|tail\b|find\b|rg\b|grep\b|fd\b|bat\b|less\b|more\b|pwd\b|whoami\b|env\b|printenv\b|npm\s+(test|run\s+test)|pnpm\s+(test|run\s+test)|yarn\s+test)/;
+function shellRecords(records) {
+    return records.filter(isShellGateRecord);
+}
+function availabilitySignal(record) {
+    if (!isAvailabilityCausedAsk(record)) {
+        return null;
+    }
+    if (record.reason === 'missing_trusted_cwd') {
+        return 'missing_trusted_cwd';
+    }
+    const fallback = typeof record.judgeFallbackReason === 'string' ? record.judgeFallbackReason : '';
+    if (fallback.includes('timeout')) {
+        return 'judge_timeout';
+    }
+    return 'judge_fallback';
+}
+function commandFromRecord(record) {
+    return (record.summary ?? '').trim();
+}
+function hasReadStyleSignal(summary) {
+    return READ_STYLE_COMMAND_PATTERN.test(summary);
+}
+function upsertCandidate(map, params) {
+    const existing = map.get(params.fingerprint);
+    if (existing) {
+        if (!existing.sources.includes(params.source)) {
+            existing.sources.push(params.source);
+        }
+        existing.askCount = Math.max(existing.askCount, params.askCount ?? 1);
+        existing.approvedAfterDeny = existing.approvedAfterDeny || Boolean(params.approvedAfterDeny);
+        if (params.command) {
+            existing.command = params.command;
+        }
+        if (params.reason) {
+            existing.reason = params.reason;
+        }
+        return;
+    }
+    map.set(params.fingerprint, {
+        kind: 'shell',
+        command: params.command,
+        fingerprint: params.fingerprint,
+        reason: params.reason,
+        sources: [params.source],
+        askCount: params.askCount ?? 1,
+        approvedAfterDeny: Boolean(params.approvedAfterDeny),
+    });
+}
+export function extractAvailabilityQueue(records) {
+    const grouped = new Map();
+    for (const record of shellRecords(records)) {
+        if (!inferWouldBlock(record) || !record.fingerprint) {
+            continue;
+        }
+        const signal = availabilitySignal(record);
+        if (!signal) {
+            continue;
+        }
+        const fingerprint = record.fingerprint;
+        const existing = grouped.get(fingerprint);
+        if (existing) {
+            existing.askCount += 1;
+            existing.command = commandFromRecord(record) || existing.command;
+            existing.reason = record.reason ?? existing.reason;
+            continue;
+        }
+        grouped.set(fingerprint, {
+            kind: 'shell',
+            command: commandFromRecord(record),
+            fingerprint,
+            reason: record.reason ?? 'unknown',
+            availabilitySignal: signal,
+            ...(typeof record.judgeFallbackReason === 'string'
+                ? { judgeFallbackReason: record.judgeFallbackReason }
+                : {}),
+            askCount: 1,
+        });
+    }
+    return [...grouped.values()].sort((left, right) => right.askCount - left.askCount);
+}
+function recordsForShellRoundTrips(records) {
+    return records.filter((record) => isApprovalRecorded(record) ||
+        (isShellGateRecord(record) && inferWouldBlock(record) && !isAvailabilityCausedAsk(record)));
+}
+/** Pair deny/approval rows split by a time window so round-trip harvest still works. */
+function augmentHarvestRoundTripPairs(scoped, timeFiltered) {
+    if (timeFiltered.length === 0) {
+        return timeFiltered;
+    }
+    const included = new Set(timeFiltered);
+    const augmented = [...timeFiltered];
+    const approvalById = new Map();
+    const denyByApprovalId = new Map();
+    for (const record of scoped) {
+        if (!record.approvalId) {
+            continue;
+        }
+        if (isApprovalRecorded(record)) {
+            approvalById.set(record.approvalId, record);
+        }
+        else if (isShellGateRecord(record) && inferWouldBlock(record)) {
+            denyByApprovalId.set(record.approvalId, record);
+        }
+    }
+    for (const record of timeFiltered) {
+        if (!record.approvalId) {
+            continue;
+        }
+        if (isApprovalRecorded(record)) {
+            const deny = denyByApprovalId.get(record.approvalId);
+            if (deny && !included.has(deny)) {
+                included.add(deny);
+                augmented.push(deny);
+            }
+            continue;
+        }
+        if (isShellGateRecord(record)) {
+            const approval = approvalById.get(record.approvalId);
+            if (approval && !included.has(approval)) {
+                included.add(approval);
+                augmented.push(approval);
+            }
+        }
+    }
+    return augmented.sort((left, right) => {
+        const leftMs = parseTimestamp(left.timestamp) ?? 0;
+        const rightMs = parseTimestamp(right.timestamp) ?? 0;
+        return leftMs - rightMs;
+    });
+}
+/** Shell gate rows plus approval events — matches what `belay harvest list` needs. */
+export function filterRecordsForHarvest(records, options = {}) {
+    const scoped = records.filter((record) => isShellGateRecord(record) || isApprovalRecorded(record));
+    if (!options.since && !options.until) {
+        return scoped;
+    }
+    const timeFiltered = filterAuditRecords(scoped, {
+        since: options.since,
+        until: options.until,
+    });
+    return augmentHarvestRoundTripPairs(scoped, timeFiltered);
+}
+export function extractHarvestCandidates(records, options = {}) {
+    const shellOnly = shellRecords(records);
+    const classifierAsks = shellOnly.filter((record) => inferWouldBlock(record) && !isAvailabilityCausedAsk(record));
+    const map = new Map();
+    // `unknown` covers legacy shell rows missing `kind`.
+    const roundTrips = buildApprovalRoundTrips(recordsForShellRoundTrips(records)).filter((trip) => trip.kind === 'shell' || trip.kind === 'unknown');
+    for (const trip of roundTrips) {
+        if (!trip.fingerprint || !trip.approvalTimestamp) {
+            continue;
+        }
+        upsertCandidate(map, {
+            fingerprint: trip.fingerprint,
+            command: trip.summary,
+            reason: trip.reason,
+            source: 'deny_then_approve',
+            approvedAfterDeny: true,
+        });
+    }
+    for (const entry of computeRepeatedFingerprintAsks(classifierAsks, 2, 50)) {
+        upsertCandidate(map, {
+            fingerprint: entry.fingerprint,
+            command: entry.summary,
+            reason: entry.reason,
+            source: 'repeated_ask',
+            askCount: entry.askCount,
+        });
+    }
+    for (const record of classifierAsks) {
+        if (!record.fingerprint) {
+            continue;
+        }
+        const command = commandFromRecord(record);
+        if (!hasReadStyleSignal(command)) {
+            continue;
+        }
+        upsertCandidate(map, {
+            fingerprint: record.fingerprint,
+            command,
+            reason: record.reason ?? 'unknown',
+            source: 'read_style_signal',
+        });
+    }
+    // Current overrides.allow match on past would-blocks — not a changelog of new additions.
+    const allowPatterns = options.allowPatterns ?? [];
+    for (const record of classifierAsks) {
+        if (!record.fingerprint) {
+            continue;
+        }
+        const command = commandFromRecord(record);
+        if (!command) {
+            continue;
+        }
+        for (const pattern of allowPatterns) {
+            if (matchesCustomCommand(command, command, pattern)) {
+                upsertCandidate(map, {
+                    fingerprint: record.fingerprint,
+                    command,
+                    reason: record.reason ?? 'unknown',
+                    source: 'overrides_allow',
+                });
+                break;
+            }
+        }
+    }
+    return [...map.values()].sort((left, right) => {
+        if (right.askCount !== left.askCount) {
+            return right.askCount - left.askCount;
+        }
+        return left.command.localeCompare(right.command);
+    });
+}
+export function buildHarvestReport(records, options = {}) {
+    return {
+        schemaVersion: HARVEST_REPORT_SCHEMA_VERSION,
+        scope: 'shell',
+        candidates: extractHarvestCandidates(records, options),
+        availabilityQueue: extractAvailabilityQueue(records),
+    };
+}
+export function applyHarvestReview(cases, params) {
+    const command = params.command.trim();
+    if (!command) {
+        return { cases, applied: false, ok: false, message: 'Command must be non-empty.' };
+    }
+    if (params.outcome === 'reject') {
+        return {
+            cases,
+            applied: false,
+            ok: true,
+            message: `Reviewed and rejected candidate ${JSON.stringify(command)}.`,
+        };
+    }
+    const category = params.outcome;
+    const verdict = category === 'provably-benign' ? 'allow' : 'allow_flagged';
+    const reason = params.reason?.trim();
+    const duplicate = cases.find((entry) => entry.command === command);
+    if (duplicate) {
+        if (duplicate.category === category) {
+            return {
+                cases,
+                applied: false,
+                ok: false,
+                message: `Corpus already contains ${JSON.stringify(command)} as ${category}.`,
+            };
+        }
+        return {
+            cases,
+            applied: false,
+            ok: false,
+            message: `Corpus already contains ${JSON.stringify(command)} as ${duplicate.category}; resolve manually.`,
+        };
+    }
+    const nextCase = {
+        kind: 'shell',
+        category,
+        command,
+        verdict,
+        ...(reason ? { reason } : {}),
+    };
+    const followUp = category === 'provably-benign'
+        ? 'Next: run `pnpm corpus` and confirm hard gates pass before `pnpm build` refreshes the standing-allow catalog.'
+        : 'Next: run `pnpm corpus` to verify corpus evaluation (accepted-benign is soft-gated).';
+    return {
+        cases: [...cases, nextCase],
+        applied: true,
+        ok: true,
+        message: `Added ${JSON.stringify(command)} to corpus as ${category}. ${followUp}`,
+    };
+}

package/dist/core/index.d.ts

@@ -1,9 +1,14 @@
-export { APPROVAL_EXECUTION_LEASE_MS, approvalCommandMatch, buildRetryInstruction, compactApprovals, createApprovalRecord, isExecutionLeaseExpired, isExpired, mergeApprovalStates, nowIso, } from './approval.js';
+export { APPROVAL_EXECUTION_LEASE_MS, approvalCommandMatch, compactApprovals, createApprovalRecord, createApprovalRecordWithEnvelope, isExecutionLeaseExpired, isExpired, mergeApprovalStates, nowIso, } from './approval.js';
+export type { ApprovalReplayHint, ReplayActionContext, ReplayAdapterId, } from './approval-replay.js';
+/** @deprecated Use `buildRetryInstructionForConfig` */
+export { approvalFlow, buildApprovalRecordedMessage, buildReplayEnvelopeFields, buildReplayHint, buildRetryInstructionForConfig, buildRetryInstructionForConfig as buildRetryInstruction, canAutoReplay, getExecutionLeaseMs, replayShellCommand, validateReplayEnvelope, } from './approval-replay.js';
+export type { ApprovalStore } from './approval-service.js';
+export { consumeApprovedAfterCliReplay, createGateApprovalStore, gateApprovalStoreFromDeps, recordApproval, } from './approval-service.js';
 export type { AuditMetricsReport } from './audit-metrics.js';
 export { computeAuditMetrics, parseAuditNdjson } from './audit-metrics.js';
 export { classifySubagent } from './classify-subagent.js';
 export { classifyToolUse } from './classify-tool.js';
-export { approvedApprovalsFile, type BelayConfig, type BelayConfigV1, type BelayConfigV2, type BelayConfigV3, type BelayConfigV4, type BelayControlPlaneConfig, type BelayJudgeConfig, type BelayOverridesConfig, type BelayPolicyConfig, type BelayRedactionConfig, belayStateDir, classifierOptionsFromConfig, configuredControlPlaneDir, DEFAULT_CONFIG_V2, DEFAULT_CONFIG_V3, DEFAULT_CONFIG_V4, DEFAULT_JUDGE_CURSOR_COMPOSER, DEFAULT_JUDGE_LOCAL_OLLAMA, defaultControlPlaneDir, isConfigV4, isFreshConfigInput, LEGACY_POLICY_V3, mapLegacyClassifierToOverrides, mergeConfig, migrateConfig, migrateV2ToV3, normalizeConfig, normalizeJudgeConfig, pendingApprovalsFile, resolveControlPlaneDir, scrubOptionsFromConfig, } from './config.js';
+export { type ApprovalFlow, approvedApprovalsFile, type BelayApprovalAutoReplayScopes, type BelayApprovalConfig, type BelayConfig, type BelayConfigV1, type BelayConfigV2, type BelayConfigV3, type BelayConfigV4, type BelayControlPlaneConfig, type BelayJudgeConfig, type BelayOverridesConfig, type BelayPolicyConfig, type BelayRedactionConfig, belayStateDir, classifierOptionsFromConfig, configuredControlPlaneDir, DEFAULT_APPROVAL_CONFIG, DEFAULT_CONFIG_V2, DEFAULT_CONFIG_V3, DEFAULT_CONFIG_V4, DEFAULT_JUDGE_CURSOR_COMPOSER, DEFAULT_JUDGE_LOCAL_OLLAMA, defaultControlPlaneDir, isConfigV4, isFreshConfigInput, LEGACY_POLICY_V3, mapLegacyClassifierToOverrides, mergeConfig, migrateConfig, migrateV2ToV3, normalizeConfig, normalizeJudgeConfig, pendingApprovalsFile, resolveControlPlaneDir, scrubOptionsFromConfig, } from './config.js';
 export { matchesCustomCommand } from './custom-command-match.js';
 export { canonicalStringify, hashValue, shellFingerprint, subagentFingerprint, toolFingerprint, } from './fingerprint.js';
 export type { GatedAction, GatedActionKind, GatePermissionResponse, GateVerdict, } from './gate-contract.js';
@@ -11,9 +16,10 @@ export { classifyResultToGateVerdict, GATE_CONTRACT_VERSION, isGatedAction, unno
 export { classifyGatedAction, GateNormalizationError, gateEnabledForAction, normalizeGatedAction, } from './gate-engine.js';
 export { matchesSensitivePath } from './glob.js';
 export { canonicalPath, hasOutsideRepoPath, normalizeToken, pathWithinRoot, relativeWithinRepo, resolveMutationTarget, } from './path-utils.js';
+export { fingerprintReplayPayload, subagentFingerprintSource } from './replay-scrub.js';
 export { scrubString, scrubValue } from './scrub.js';
 export { findCommandSubstitutions, MAX_SUBSTITUTION_DEPTH } from './shell-substitution.js';
 export type { TransactionalDiffEvaluation, TransactionalExecutionResult, } from './transactional/index.js';
 export { isTransactionalEligible, runTransactionalExecution } from './transactional/index.js';
-export type { ApprovalRecord, ApprovalStateFile, Assessment, ClassifierOptions, ClassifyResult, HookVerdict, Reversibility, ScrubOptions, UnknownLocalEffectPolicy, } from './types.js';
+export type { ApprovalRecord, ApprovalScopeHint, ApprovalStateFile, Assessment, ClassifierOptions, ClassifyResult, HookVerdict, Reversibility, ScrubOptions, UnknownLocalEffectPolicy, } from './types.js';
 export { buildVerdictContext, classifyShell, verdict, verdictToClassifyResult, } from './verdict/index.js';

package/dist/core/index.js

@@ -1,14 +1,18 @@
-export { APPROVAL_EXECUTION_LEASE_MS, approvalCommandMatch, buildRetryInstruction, compactApprovals, createApprovalRecord, isExecutionLeaseExpired, isExpired, mergeApprovalStates, nowIso, } from './approval.js';
+export { APPROVAL_EXECUTION_LEASE_MS, approvalCommandMatch, compactApprovals, createApprovalRecord, createApprovalRecordWithEnvelope, isExecutionLeaseExpired, isExpired, mergeApprovalStates, nowIso, } from './approval.js';
+/** @deprecated Use `buildRetryInstructionForConfig` */
+export { approvalFlow, buildApprovalRecordedMessage, buildReplayEnvelopeFields, buildReplayHint, buildRetryInstructionForConfig, buildRetryInstructionForConfig as buildRetryInstruction, canAutoReplay, getExecutionLeaseMs, replayShellCommand, validateReplayEnvelope, } from './approval-replay.js';
+export { consumeApprovedAfterCliReplay, createGateApprovalStore, gateApprovalStoreFromDeps, recordApproval, } from './approval-service.js';
 export { computeAuditMetrics, parseAuditNdjson } from './audit-metrics.js';
 export { classifySubagent } from './classify-subagent.js';
 export { classifyToolUse } from './classify-tool.js';
-export { approvedApprovalsFile, belayStateDir, classifierOptionsFromConfig, configuredControlPlaneDir, DEFAULT_CONFIG_V2, DEFAULT_CONFIG_V3, DEFAULT_CONFIG_V4, DEFAULT_JUDGE_CURSOR_COMPOSER, DEFAULT_JUDGE_LOCAL_OLLAMA, defaultControlPlaneDir, isConfigV4, isFreshConfigInput, LEGACY_POLICY_V3, mapLegacyClassifierToOverrides, mergeConfig, migrateConfig, migrateV2ToV3, normalizeConfig, normalizeJudgeConfig, pendingApprovalsFile, resolveControlPlaneDir, scrubOptionsFromConfig, } from './config.js';
+export { approvedApprovalsFile, belayStateDir, classifierOptionsFromConfig, configuredControlPlaneDir, DEFAULT_APPROVAL_CONFIG, DEFAULT_CONFIG_V2, DEFAULT_CONFIG_V3, DEFAULT_CONFIG_V4, DEFAULT_JUDGE_CURSOR_COMPOSER, DEFAULT_JUDGE_LOCAL_OLLAMA, defaultControlPlaneDir, isConfigV4, isFreshConfigInput, LEGACY_POLICY_V3, mapLegacyClassifierToOverrides, mergeConfig, migrateConfig, migrateV2ToV3, normalizeConfig, normalizeJudgeConfig, pendingApprovalsFile, resolveControlPlaneDir, scrubOptionsFromConfig, } from './config.js';
 export { matchesCustomCommand } from './custom-command-match.js';
 export { canonicalStringify, hashValue, shellFingerprint, subagentFingerprint, toolFingerprint, } from './fingerprint.js';
 export { classifyResultToGateVerdict, GATE_CONTRACT_VERSION, isGatedAction, unnormalizedGateVerdict, } from './gate-contract.js';
 export { classifyGatedAction, GateNormalizationError, gateEnabledForAction, normalizeGatedAction, } from './gate-engine.js';
 export { matchesSensitivePath } from './glob.js';
 export { canonicalPath, hasOutsideRepoPath, normalizeToken, pathWithinRoot, relativeWithinRepo, resolveMutationTarget, } from './path-utils.js';
+export { fingerprintReplayPayload, subagentFingerprintSource } from './replay-scrub.js';
 export { scrubString, scrubValue } from './scrub.js';
 export { findCommandSubstitutions, MAX_SUBSTITUTION_DEPTH } from './shell-substitution.js';
 export { isTransactionalEligible, runTransactionalExecution } from './transactional/index.js';

package/dist/core/judge-doctor.d.ts

@@ -8,5 +8,8 @@ export interface JudgeDoctorResult {
 }
 export interface DiagnoseJudgeOptions {
     discoveryDeps?: JudgeModelDiscoveryDeps;
+    liveProbe?: boolean;
 }
 export declare function diagnoseJudge(config: BelayConfigV4, repoRoot?: string, options?: DiagnoseJudgeOptions): Promise<JudgeDoctorResult>;
+export declare function stopJudgeSessionBrokers(repoRoot: string, stateDir: string): Promise<number>;
+export declare function stopInProcessJudgeSessionBrokers(repoRoot?: string): number;

package/dist/core/judge-doctor.js

@@ -2,16 +2,30 @@ import { repoLocalStateDirFor } from '../config-io.js';
 import { normalizeJudgeProvider, scrubOptionsFromConfig } from './config.js';
 import { resolveJudgeCredential } from './judge-api-key.js';
 import { hasValidCloudConsent } from './judge-config.js';
+import { formatJudgeRecoveryHint, inferProviderIdFromFallbackReason, } from './judge-fallback-hints.js';
 import { discoverJudgeModels, modelPresenceFromDiscovery, } from './judge-model-discovery.js';
 import { detectJudgeRuntimeCapabilities, resolveJudgeTransport } from './judge-runtime-detection.js';
 import { createOllamaJudge, createOpenAiCompatibleJudge } from './verdict/judge.js';
+import { stopJudgeBrokerDaemon } from './verdict/judge-broker-service.js';
 import { getJudgeProviderCapabilities, getJudgeProviderSpec, isRemovedProviderId, normalizeLegacyProviderId, } from './verdict/judge-catalog.js';
 import { createJudgeFromConfig, resolveJudgeModel } from './verdict/judge-factory.js';
+import { resolveJudgeSmokeProbeTimeoutMs } from './verdict/judge-runtime-config.js';
+import { listRepoJudgeSessionBrokers, stopRepoJudgeSessionBroker, } from './verdict/judge-session-broker.js';
+import { clearJudgeSessionKillSwitch } from './verdict/judge-session-kill-switch.js';
+function judgeShadowAdvisory(warnings, message) {
+    warnings.push(`[judge shadow advisory] ${message}`);
+}
 export async function diagnoseJudge(config, repoRoot = process.cwd(), options = {}) {
+    const shouldRunLiveProbe = options.liveProbe === true && !process.env.VITEST && !process.env.VITEST_WORKER_ID;
     const issues = [];
     const warnings = [];
     const notes = [];
     const judge = config.judge;
+    const gateMode = judge.mode ?? 'shadow';
+    notes.push(`Judge gate mode: ${gateMode} (sync Tier1 removed from hook gate; judge is shadow/async only)`);
+    if (gateMode === 'off') {
+        notes.push('Judge shadow is disabled (judge.mode=off).');
+    }
     const provider = normalizeJudgeProvider(judge.provider);
     const rawProviderId = judge.providerId ? String(judge.providerId) : undefined;
     if (rawProviderId && isRemovedProviderId(rawProviderId)) {
@@ -32,15 +46,19 @@ export async function diagnoseJudge(config, repoRoot = process.cwd(), options =
     const capabilities = getJudgeProviderCapabilities(providerId);
     const transport = resolveJudgeTransport(judge);
     const runtime = detectJudgeRuntimeCapabilities(providerId);
+    const cursorAcpEnabled = transport === 'cursor-cli' &&
+        providerId === 'cursor' &&
+        config.judge.runtime?.session.enabled === true;
+    const effectiveTransport = cursorAcpEnabled ? 'cursor-acp' : transport;
     notes.push(`Judge providerId: ${providerId}`);
     notes.push(`Judge driver: ${provider}`);
     notes.push(`Judge model requested: ${judge.model}`);
-    notes.push(`Judge transport: ${transport}`);
+    notes.push(`Judge transport: ${effectiveTransport}`);
     if (config.policy.modelAssist.enabled) {
         warnings.push('policy.modelAssist is enabled but is not wired to v2 Tier1. Use top-level judge instead.');
     }
     if (capabilities?.requiresConsent && !hasValidCloudConsent(judge) && transport === 'http') {
-        issues.push('Cloud judge consent is not recorded. Tier1 cloud judge will fail closed until consent is granted.');
+        judgeShadowAdvisory(warnings, 'Cloud judge consent is not recorded. Shadow cloud judge will fail until consent is granted.');
     }
     else if (judge.cloudConsent?.accepted) {
         notes.push(`Cloud consent: accepted ${judge.cloudConsent.at} by ${judge.cloudConsent.by}`);
@@ -70,12 +88,12 @@ export async function diagnoseJudge(config, repoRoot = process.cwd(), options =
     if (providerId === 'ollama') {
         notes.push(`Ollama endpoint: ${endpoint}`);
         if (discovery.modelIds.length === 0) {
-            issues.push(`Ollama endpoint unreachable or returned no models. Tier1 will fail closed.`);
+            judgeShadowAdvisory(warnings, 'Ollama endpoint unreachable or returned no models. Shadow judge will not run.');
         }
         else {
             const hasModel = modelCheck.status === 'found';
             if (!hasModel) {
-                issues.push(`Ollama model "${judge.model}" is not present. Pull it before enforce mode.`);
+                judgeShadowAdvisory(warnings, `Ollama model "${judge.model}" is not present. Pull it before enabling shadow comparisons.`);
             }
             else {
                 notes.push(`Ollama model "${judge.model}" is available.`);
@@ -99,7 +117,7 @@ export async function diagnoseJudge(config, repoRoot = process.cwd(), options =
             context: { cwd: process.cwd(), repoRoot: process.cwd() },
         });
         if (warmResult.reason === 'ollama_unavailable' || warmResult.reason === 'ollama_parse_error') {
-            issues.push(`Ollama warm call failed: ${warmResult.reason}`);
+            judgeShadowAdvisory(warnings, `Ollama warm call failed: ${warmResult.reason}`);
         }
         else {
             notes.push('Ollama warm call succeeded.');
@@ -107,18 +125,52 @@ export async function diagnoseJudge(config, repoRoot = process.cwd(), options =
         return { issues, warnings, notes, modelCheck };
     }
     if (transport === 'unavailable') {
-        issues.push('No judge transport is available (configure endpoint or install native CLI). Tier1 will fail closed to ask.');
+        judgeShadowAdvisory(warnings, 'No judge transport is available (configure endpoint or install native CLI). Shadow judge will not run.');
         return { issues, warnings, notes, modelCheck };
     }
     if (transport.endsWith('-cli')) {
         if (!runtime.cliTransport) {
-            issues.push(`Native CLI transport (${transport}) is not available. Tier1 judge will fail closed to ask.`);
+            judgeShadowAdvisory(warnings, `Native CLI transport (${transport}) is not available. Shadow judge will not run.`);
         }
         else if (!keyInfo.key && keyInfo.sourceKind !== 'host-session') {
-            issues.push('Judge API key is not set for the configured credential mode. Tier1 cloud judge will fail closed to ask.');
+            judgeShadowAdvisory(warnings, 'Judge API key is not set for the configured credential mode. Shadow cloud judge will not run.');
         }
         else {
-            notes.push(`Native CLI transport available: ${transport}`);
+            notes.push(cursorAcpEnabled
+                ? 'Cursor ACP transport available.'
+                : `Native CLI transport available: ${transport}`);
+            if (cursorAcpEnabled) {
+                notes.push(`Cursor ACP session transport enabled (max ${config.judge.runtime?.session.maxTurns ?? 'unknown'} turns).`);
+            }
+            if (shouldRunLiveProbe) {
+                const smokeConfig = {
+                    ...config,
+                    judge: {
+                        ...judge,
+                        timeoutMs: resolveJudgeSmokeProbeTimeoutMs(judge.timeoutMs),
+                    },
+                };
+                const smokeJudge = createJudgeFromConfig(smokeConfig, { repoRoot });
+                const smokeResult = await smokeJudge.evaluate({
+                    text: 'git status',
+                    context: { cwd: repoRoot, repoRoot },
+                });
+                const smokeFallback = smokeJudge.lastTrace?.judgeFallbackReason ??
+                    smokeJudge.lastTrace?.fallbackReason ??
+                    smokeResult.reason;
+                if (smokeJudge.lastTrace?.provider === 'fallback') {
+                    const recoveryHint = formatJudgeRecoveryHint(inferProviderIdFromFallbackReason(smokeFallback, providerId), smokeFallback);
+                    const smokeLabel = cursorAcpEnabled ? 'Cursor ACP' : 'Native CLI transport';
+                    judgeShadowAdvisory(warnings, recoveryHint
+                        ? `${smokeLabel} smoke probe failed (${smokeFallback}). ${recoveryHint}`
+                        : `${smokeLabel} smoke probe failed (${smokeFallback}).`);
+                }
+                else {
+                    notes.push(cursorAcpEnabled
+                        ? 'Cursor ACP smoke probe succeeded.'
+                        : 'Native CLI transport smoke probe succeeded.');
+                }
+            }
         }
         return { issues, warnings, notes, modelCheck };
     }
@@ -126,7 +178,7 @@ export async function diagnoseJudge(config, repoRoot = process.cwd(), options =
         notes.push(`HTTP endpoint: ${judge.endpoint}`);
     }
     if (!keyInfo.key) {
-        issues.push('Judge API key is not set for the configured credential mode. Tier1 cloud judge will fail closed to ask.');
+        judgeShadowAdvisory(warnings, 'Judge API key is not set for the configured credential mode. Shadow cloud judge will not run.');
     }
     else {
         notes.push(`Credential source: ${keyInfo.source ?? keyInfo.sourceKind}`);
@@ -161,7 +213,7 @@ export async function diagnoseJudge(config, repoRoot = process.cwd(), options =
         });
         if (dryRun.reason.startsWith('openai_compatible_') ||
             dryRun.reason === 'outbound_scrub_failed') {
-            issues.push(`HTTP judge dry-run failed: ${dryRun.reason}`);
+            judgeShadowAdvisory(warnings, `HTTP judge dry-run failed: ${dryRun.reason}`);
         }
         else {
             notes.push('HTTP judge dry-run succeeded.');
@@ -171,5 +223,32 @@ export async function diagnoseJudge(config, repoRoot = process.cwd(), options =
     if (factoryJudge.lastTrace?.transport) {
         notes.push(`Factory transport: ${factoryJudge.lastTrace.transport}`);
     }
+    if (config.judge.runtime?.session.enabled) {
+        notes.push('Judge session transport: enabled');
+        const activeBrokers = listRepoJudgeSessionBrokers();
+        if (activeBrokers.includes(repoRoot)) {
+            notes.push(`Active session broker for repo: ${repoRoot}`);
+        }
+    }
+    else {
+        notes.push('Judge session transport: disabled (default)');
+    }
     return { issues, warnings, notes, modelCheck };
 }
+export async function stopJudgeSessionBrokers(repoRoot, stateDir) {
+    let stopped = 0;
+    stopped += stopRepoJudgeSessionBroker(repoRoot, 'manual_stop');
+    stopped += await stopJudgeBrokerDaemon(stateDir);
+    await clearJudgeSessionKillSwitch(stateDir);
+    return stopped;
+}
+export function stopInProcessJudgeSessionBrokers(repoRoot) {
+    if (repoRoot) {
+        return stopRepoJudgeSessionBroker(repoRoot, 'manual_stop');
+    }
+    let stopped = 0;
+    for (const root of listRepoJudgeSessionBrokers()) {
+        stopped += stopRepoJudgeSessionBroker(root, 'manual_stop');
+    }
+    return stopped;
+}

package/dist/core/judge-fallback-hints.d.ts

@@ -0,0 +1,13 @@
+import type { ClassifyResult } from './types.js';
+export declare function extractJudgeFallbackReason(result: Pick<ClassifyResult, 'axes' | 'assessment'>): string | undefined;
+export declare function isJudgeInfrastructureFailure(result: Pick<ClassifyResult, 'axes' | 'assessment' | 'reason'>): boolean;
+export declare function inferProviderIdFromFallbackReason(fallbackReason: string | undefined, fallbackProviderId?: string): string;
+export declare function formatJudgeRecoveryHint(providerId: string, fallbackReason?: string): string | null;
+export declare function formatJudgeInfrastructureDenyMessage(params: {
+    providerId: string;
+    fallbackReason?: string;
+    command?: string;
+}): {
+    user_message: string;
+    agent_message: string;
+};