@guilz-dev/belay 0.3.0 → 0.6.0

package/dist/cli.js

@@ -6,11 +6,15 @@ import { auditProject, formatAuditReport } from './commands/audit.js';
 import { doctorProject, formatDoctorReport } from './commands/doctor.js';
 import { dogfoodProject, formatDogfoodResult } from './commands/dogfood.js';
 import { explainCommand, formatExplainReport } from './commands/explain.js';
+import { formatHarvestReport, harvestApplyProject, harvestListProject } from './commands/harvest.js';
 import { formatMetricsReport, metricsProject } from './commands/metrics.js';
+import { formatQualityReport, qualityCheck } from './commands/quality.js';
 import { formatRecoverReport, recoverProject } from './commands/recover.js';
 import { formatReport, reportProject } from './commands/report.js';
 import { revokeApproval } from './commands/revoke.js';
+import { formatSessionStatusReport, sessionStartProject, sessionStatusProject, } from './commands/session.js';
 import { formatSimulateReport, simulateProject } from './commands/simulate.js';
+import { revokeStandingAllow } from './commands/standing-allow.js';
 import { formatStatusReport, statusProject } from './commands/status.js';
 import { loadConfigFile } from './config-io.js';
 import { rejectDeprecatedJudgeModelAuto } from './core/judge-model-policy.js';
@@ -154,6 +158,13 @@ function parseArgs(argv) {
             index += 1;
             continue;
         }
+        if (token === '--live-probe') {
+            if (command !== 'judge') {
+                throw new Error('--live-probe is only valid for judge test.');
+            }
+            options.judgeLiveProbe = true;
+            continue;
+        }
         if (token === '--json') {
             options.json = true;
             continue;
@@ -178,6 +189,24 @@ function parseArgs(argv) {
             index += 1;
             continue;
         }
+        if (token === '--outcome') {
+            const next = rest[index + 1];
+            if (!next || !['provably-benign', 'accepted-benign', 'reject'].includes(next)) {
+                throw new Error('--outcome requires provably-benign, accepted-benign, or reject.');
+            }
+            options.harvestOutcome = next;
+            index += 1;
+            continue;
+        }
+        if (token === '--corpus') {
+            const next = rest[index + 1];
+            if (!next) {
+                throw new Error('--corpus requires a path.');
+            }
+            options.corpusPath = next;
+            index += 1;
+            continue;
+        }
         if (token === '--kind') {
             const next = rest[index + 1];
             if (!next) {
@@ -252,11 +281,18 @@ function parseArgs(argv) {
             index += 1;
             continue;
         }
+        if (token === '--replay') {
+            if (command !== 'approve') {
+                throw new Error('--replay is only valid for approve.');
+            }
+            options.approveReplay = true;
+            continue;
+        }
         if (token === '--scope') {
             const next = rest[index + 1];
             if (command === 'approve') {
-                if (!next || !['once', 'domain', 'path'].includes(next)) {
-                    throw new Error('--scope requires once, domain, or path.');
+                if (!next || !['once', 'domain', 'path', 'workspace-root'].includes(next)) {
+                    throw new Error('--scope requires once, domain, path, or workspace-root.');
                 }
                 options.approveScope = next;
             }
@@ -315,6 +351,9 @@ function parseArgs(argv) {
             if (command === 'recover') {
                 options.recoverCommand = next;
             }
+            else if (command === 'harvest') {
+                options.harvestCommand = next;
+            }
             else {
                 options.explainCommand = next;
             }
@@ -343,7 +382,13 @@ function parseArgs(argv) {
             return { command: 'help', options };
         }
         if (token === '--') {
-            options.explainCommand = rest.slice(index + 1).join(' ');
+            const remainder = rest.slice(index + 1).join(' ');
+            if (command === 'session' && options.sessionSubcommand === 'start') {
+                options.sessionAgentCommand = remainder;
+            }
+            else {
+                options.explainCommand = remainder;
+            }
             break;
         }
         if (command === 'audit' && !options.auditSubcommand) {
@@ -367,16 +412,38 @@ function parseArgs(argv) {
             }
             throw new Error('sandbox requires subcommand: status');
         }
+        if (command === 'session' && !options.sessionSubcommand) {
+            if (token === 'start' || token === 'status') {
+                options.sessionSubcommand = token;
+                continue;
+            }
+            throw new Error('session requires subcommand: start or status');
+        }
+        if (command === 'standing-allow' && !options.standingAllowSubcommand) {
+            if (token === 'revoke') {
+                options.standingAllowSubcommand = token;
+                continue;
+            }
+            throw new Error('standing-allow requires subcommand: revoke');
+        }
+        if (command === 'harvest' && !options.harvestSubcommand) {
+            if (token === 'list' || token === 'apply') {
+                options.harvestSubcommand = token;
+                continue;
+            }
+            throw new Error('harvest requires subcommand: list or apply');
+        }
         if (command === 'judge' && !options.judgeSubcommand) {
             if (token === 'status' ||
                 token === 'list' ||
                 token === 'use' ||
                 token === 'test' ||
+                token === 'bench' ||
                 token === 'consent') {
                 options.judgeSubcommand = token;
                 continue;
             }
-            throw new Error('judge requires subcommand: status, list, use, test, or consent');
+            throw new Error('judge requires subcommand: status, list, use, test, bench, or consent');
         }
         if (command === 'config' && !options.configSubcommand) {
             if (token === 'list' ||
@@ -458,6 +525,7 @@ Usage:
   ${c} dogfood [--target <dir>] [--adapter cursor|claude|codex] [--enforce] [--force]
   ${c} doctor [--target <dir>] [--adapter cursor|claude|codex] [--json] [--fix] [--dry-run]
   ${c} metrics [--target <dir>] [--json]
+  ${c} quality [--target <dir>] [--corpus <path>] [--json]
   ${c} report [--target <dir>] [--since <iso>] [--until <iso>] [--limit <n>] [--json]
   ${c} recover [--target <dir>] [--since <iso>] [--fingerprint <fp>] [--command "<text>"] [--limit <n>] [--json]
     (--limit picks the Nth recover candidate after priority ranking: local_mutation first, then recency; 1 = highest priority, default 1)
@@ -467,11 +535,17 @@ Usage:
   ${c} explain [--target <dir>] [--cwd <dir>] [--kind shell|tool|subagent] [--tool <name>] [--payload-json <json>] [--command <text>] [--json] [-- <command>]
   ${c} egress <start|stop|status|env> [--target <dir>] [--json]
   ${c} sandbox status [--target <dir>] [--json]
-  ${c} judge <status|list|use|test|consent> [--target <dir>] [--json]
+  ${c} session <start|status> [--target <dir>] [--json]
+  ${c} session start [--target <dir>] [-- <agent command>]
+  ${c} judge <status|list|use|test|bench|consent> [--target <dir>] [--json]
+  ${c} judge test [--target <dir>] [--json] [--live-probe]
   ${c} judge use <ollama|codex|claude|cursor> [--model <id>] [--endpoint <url>] [--timeout <ms>] [--accept-cloud] [--cloud-consent-approval-id <id>] [--credential project|apiKey] [--key-stdin] [--key-env <NAME>]
   ${c} judge consent <ollama|codex|claude|cursor> [--endpoint <url>]
-  ${c} approve <approval-id> [--scope once|domain|path] [--path <path>] [--token <signed-token>] [--target <dir>]
+  ${c} approve <approval-id> [--replay] [--scope once|domain|path|workspace-root] [--path <path>] [--token <signed-token>] [--target <dir>]
   ${c} revoke <approval-id> [--target <dir>]
+  ${c} standing-allow revoke --fingerprint <fp> [--kind shell|tool|subagent] [--target <dir>]
+  ${c} harvest list [--target <dir>] [--since <iso>] [--until <iso>] [--json]
+  ${c} harvest apply --command "<text>" --outcome provably-benign|accepted-benign|reject [--reason <r>] [--corpus <path>] [--target <dir>]
 `);
 }
 async function main() {
@@ -545,6 +619,9 @@ async function main() {
             if (!options.judgeSubcommand) {
                 throw new Error('judge requires subcommand: status, list, use, or test');
             }
+            if (options.judgeLiveProbe && options.judgeSubcommand !== 'test') {
+                throw new Error('--live-probe is only valid for judge test.');
+            }
             const result = await runJudgeCommand({
                 targetDir: options.targetDir,
                 json: options.json,
@@ -558,6 +635,7 @@ async function main() {
                 credentialMode: options.credentialMode,
                 keyStdin: options.keyStdin,
                 keyEnv: options.keyEnv,
+                liveProbe: options.judgeLiveProbe,
             });
             if (options.json && typeof result === 'object') {
                 process.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
@@ -679,6 +757,21 @@ async function main() {
             }
             return;
         }
+        if (command === 'quality') {
+            const report = await qualityCheck({
+                targetDir: options.targetDir,
+                corpusDir: options.corpusPath,
+                json: options.json,
+            });
+            if (options.json) {
+                process.stdout.write(`${JSON.stringify(report, null, 2)}\n`);
+            }
+            else {
+                process.stdout.write(`${formatQualityReport(report)}\n`);
+            }
+            process.exitCode = report.ok ? 0 : 1;
+            return;
+        }
         if (command === 'report') {
             const report = await reportProject({
                 targetDir: options.targetDir,
@@ -695,6 +788,42 @@ async function main() {
             }
             return;
         }
+        if (command === 'harvest') {
+            if (options.harvestSubcommand === 'list') {
+                const report = await harvestListProject({
+                    targetDir: options.targetDir,
+                    since: options.since,
+                    until: options.until,
+                    json: options.json,
+                });
+                if (options.json) {
+                    process.stdout.write(`${JSON.stringify(report, null, 2)}\n`);
+                }
+                else {
+                    process.stdout.write(`${formatHarvestReport(report)}\n`);
+                }
+                return;
+            }
+            if (options.harvestSubcommand === 'apply') {
+                if (!options.harvestCommand) {
+                    throw new Error('harvest apply requires --command.');
+                }
+                if (!options.harvestOutcome) {
+                    throw new Error('harvest apply requires --outcome.');
+                }
+                const result = await harvestApplyProject({
+                    targetDir: options.targetDir,
+                    command: options.harvestCommand,
+                    outcome: options.harvestOutcome,
+                    reason: options.reason,
+                    corpusPath: options.corpusPath,
+                });
+                process.stdout.write(`${result.message}\n`);
+                process.exitCode = result.ok ? 0 : 1;
+                return;
+            }
+            throw new Error('harvest requires subcommand: list or apply');
+        }
         if (command === 'recover') {
             const report = await recoverProject({
                 targetDir: options.targetDir,
@@ -794,6 +923,32 @@ async function main() {
             process.exitCode = report.issues.length > 0 && report.sandboxEnabled ? 1 : 0;
             return;
         }
+        if (command === 'session') {
+            if (!options.sessionSubcommand) {
+                throw new Error('session requires subcommand: start or status');
+            }
+            if (options.sessionSubcommand === 'start') {
+                const result = await sessionStartProject({
+                    targetDir: options.targetDir,
+                    agentCommand: options.sessionAgentCommand,
+                });
+                process.stdout.write(`${result.message}\n`);
+                process.exitCode = result.ok ? 0 : 1;
+                return;
+            }
+            const report = await sessionStatusProject({
+                targetDir: options.targetDir,
+                json: options.json,
+            });
+            if (options.json) {
+                process.stdout.write(`${JSON.stringify(report, null, 2)}\n`);
+            }
+            else {
+                process.stdout.write(`${formatSessionStatusReport(report)}\n`);
+            }
+            process.exitCode = report.ok ? 0 : 1;
+            return;
+        }
         if (command === 'approve') {
             if (!options.approvalId) {
                 throw new Error('approve requires an approval ID.');
@@ -804,6 +959,7 @@ async function main() {
                 token: options.approvalToken,
                 scope: options.approveScope,
                 scopePath: options.approvePath,
+                replay: options.approveReplay,
             });
             process.stdout.write(`${result.message}\n`);
             process.exitCode = result.ok ? 0 : 1;
@@ -821,6 +977,24 @@ async function main() {
             process.exitCode = result.ok ? 0 : 1;
             return;
         }
+        if (command === 'standing-allow') {
+            if (options.standingAllowSubcommand === 'revoke') {
+                if (!options.fingerprint) {
+                    throw new Error('standing-allow revoke requires --fingerprint.');
+                }
+                const result = await revokeStandingAllow({
+                    targetDir: options.targetDir,
+                    fingerprint: options.fingerprint,
+                    kind: options.kind === 'tool' || options.kind === 'subagent' || options.kind === 'shell'
+                        ? options.kind
+                        : undefined,
+                });
+                process.stdout.write(`${result.message}\n`);
+                process.exitCode = result.ok ? 0 : 1;
+                return;
+            }
+            throw new Error('standing-allow requires subcommand: revoke');
+        }
         throw new Error(`Unknown command: ${command}`);
     }
     catch (error) {

package/dist/commands/approve.d.ts

@@ -7,6 +7,7 @@ export interface ApproveOptions {
     token?: string;
     scope?: ApproveScope;
     scopePath?: string;
+    replay?: boolean;
 }
 export declare function approvePending(options: ApproveOptions): Promise<{
     ok: boolean;

package/dist/commands/approve.js

@@ -1,6 +1,7 @@
 import path from 'node:path';
-import { approvedApprovalsPath, loadApprovalState, loadConfigFile, pendingApprovalsPath, saveApprovalState, } from '../config-io.js';
-import { recordApproval } from '../core/approval-service.js';
+import { loadApprovalState, loadConfigFile } from '../config-io.js';
+import { canAutoReplay, getExecutionLeaseMs, replayShellCommand } from '../core/approval-replay.js';
+import { consumeApprovedAfterCliReplay, createGateApprovalStore, recordApproval, } from '../core/approval-service.js';
 import { JUDGE_CLOUD_CONSENT_REASON } from '../core/capability/reasons.js';
 import { recordCapabilityApproval } from '../core/capability-approval.js';
 import { recordEgressApproval } from '../core/egress-approval.js';
@@ -32,11 +33,11 @@ export async function approvePending(options) {
         });
         return { ok: result.ok, message: result.message };
     }
-    if (options.scope === 'path') {
+    if (options.scope === 'path' || options.scope === 'workspace-root') {
         const result = await recordCapabilityApproval({
             approvalId: options.approvalId,
             config,
-            scope: 'path',
+            scope: options.scope,
             scopePath: options.scopePath,
             token: options.token,
             requireSignedToken: config.approvalSigning.required,
@@ -44,33 +45,51 @@ export async function approvePending(options) {
         });
         return { ok: result.ok, message: result.message };
     }
+    const approvalStore = createGateApprovalStore(repoRoot, config);
     const result = await recordApproval({
         approvalId: options.approvalId,
         config,
         token: options.token,
         requireSignedToken: config.approvalSigning.required,
-        store: {
-            async loadPending() {
-                const filePath = pendingApprovalsPath(repoRoot, config);
-                return {
-                    filePath,
-                    state: await loadApprovalState(repoRoot, 'pending-approvals.json', config),
-                };
-            },
-            async loadApproved() {
-                const filePath = approvedApprovalsPath(repoRoot, config);
-                return {
-                    filePath,
-                    state: await loadApprovalState(repoRoot, 'approved-approvals.json', config),
-                };
-            },
-            async writePending(_filePath, state) {
-                await saveApprovalState(repoRoot, 'pending-approvals.json', state, config);
-            },
-            async writeApproved(_filePath, state) {
-                await saveApprovalState(repoRoot, 'approved-approvals.json', state, config);
-            },
-        },
+        store: approvalStore,
     });
+    if (!result.ok) {
+        return { ok: result.ok, message: result.message };
+    }
+    if (options.replay) {
+        const approval = result.approval;
+        if (!approval) {
+            return { ok: false, message: 'Approval recorded but replay envelope is missing.' };
+        }
+        if (!canAutoReplay(config, approval.kind)) {
+            return {
+                ok: false,
+                message: 'Replay is not enabled for this approval kind. Retry the original action manually or enable approval.autoReplayScopes.',
+            };
+        }
+        if (approval.kind !== 'shell' || !approval.input) {
+            return {
+                ok: false,
+                message: 'CLI replay is only supported for shell approvals. Retry the original tool or subagent action manually.',
+            };
+        }
+        const replayResult = await replayShellCommand(approval.input, approval.cwd ?? repoRoot, getExecutionLeaseMs(config));
+        const output = [replayResult.stdout, replayResult.stderr].filter(Boolean).join('\n').trim();
+        if (replayResult.exitCode === 0) {
+            await consumeApprovedAfterCliReplay({
+                approvalId: options.approvalId,
+                store: approvalStore,
+            });
+            return {
+                ok: true,
+                message: `Belay replay succeeded for ${options.approvalId}. Do not retry via hooks; the one-shot grant was consumed.${output ? `\n${output}` : ''}`,
+            };
+        }
+        const timeoutNote = replayResult.timedOut ? ' Replay timed out.' : '';
+        return {
+            ok: false,
+            message: `Belay replay failed for ${options.approvalId} (exit ${replayResult.exitCode}).${timeoutNote} Approval remains active for one hook retry.${output ? `\n${output}` : ''}`,
+        };
+    }
     return { ok: result.ok, message: result.message };
 }

package/dist/commands/classify-for-report.js

@@ -36,7 +36,7 @@ export async function classifyForReport(params) {
         if (!params.command && !params.payload) {
             throw new Error('classify-for-report requires command or payload for subagent classification.');
         }
-        result = classifySubagent(payload, repoRoot, classifierOptions);
+        result = classifySubagent(payload, repoRoot, classifierOptions, config);
         input = params.command ?? JSON.stringify(payload);
     }
     else if (kind === 'tool') {

package/dist/commands/config.d.ts

@@ -1,5 +1,6 @@
 import { type JudgeProviderId } from '../core/verdict/judge-catalog.js';
 import type { AdapterName, InitOptions } from '../types.js';
+import { type SelectOptions } from './tui.js';
 export declare const BELAY_CONFIG_SUBCOMMANDS: readonly ["list", "get", "set", "unset", "credential", "judge"];
 export type BelayConfigSubcommand = (typeof BELAY_CONFIG_SUBCOMMANDS)[number];
 export interface BelayConfigOptions {
@@ -39,6 +40,13 @@ export interface BelayConfigInteractiveOptions {
     /** Suppress the interactive header when nested under runBelayConfigInteractive */
     skipBanner?: boolean;
 }
+export declare const JUDGE_CREDENTIAL_MODE_PROMPT = "Judge API key source";
+export declare const JUDGE_CREDENTIAL_STORE_KEY_PROMPT = "Paste API key to store locally (visible input; prefer belay config credential set --key-stdin): ";
+export declare const JUDGE_TRANSPORT_MODE_PROMPT = "How should Belay reach the judge?";
+export declare const JUDGE_HTTP_ENDPOINT_PROMPT = "Judge HTTP API URL:";
+export type JudgeTransportWizardMode = 'cli' | 'http';
+export declare function buildJudgeTransportSelectOptions(judgeProviderId: JudgeProviderId): SelectOptions<JudgeTransportWizardMode>;
+export declare function buildJudgeCredentialModeSelectOptions(judgeProviderId: JudgeProviderId): SelectOptions<'project' | 'apiKey'>;
 export declare function resolveBelayConfigInteractiveMode(repoRoot: string): Promise<'full' | 'judge-only'>;
 export declare function runBelayConfigFullInteractive(options?: BelayConfigInteractiveOptions): Promise<{
     repoRoot: string;