@guilz-dev/belay 0.4.0 → 0.7.0

package/dist/core/verdict/git-classifier.js

@@ -0,0 +1,533 @@
+import path from 'node:path';
+import { extractRedirectTargets } from '../shell-tokenizer.js';
+const GIT_BRANCH_MUTATION_FLAGS = new Set([
+    '--copy',
+    '--create-reflog',
+    '--delete',
+    '--edit-description',
+    '--force',
+    '--move',
+    '--no-create-reflog',
+    '--no-track',
+    '--recurse-submodules',
+    '--set-upstream-to',
+    '--track',
+    '--unset-upstream',
+]);
+const GIT_BRANCH_LIST_FLAGS = new Set([
+    '--abbrev',
+    '--all',
+    '--column',
+    '--color',
+    '--contains',
+    '--format',
+    '--ignore-case',
+    '--list',
+    '--merged',
+    '--no-abbrev',
+    '--no-column',
+    '--no-color',
+    '--no-contains',
+    '--no-merged',
+    '--points-at',
+    '--remotes',
+    '--show-current',
+    '--sort',
+    '--verbose',
+]);
+const GIT_BRANCH_MUTATION_SHORT_FLAGS = new Set(['c', 'C', 'd', 'D', 'f', 'm', 'M', 't', 'u']);
+const GIT_BRANCH_LIST_SHORT_FLAGS = new Set(['a', 'i', 'l', 'r', 'v']);
+const READ_ONLY_SUBCOMMANDS = new Set([
+    'status',
+    'diff',
+    'log',
+    'show',
+    'rev-parse',
+    'describe',
+    'show-ref',
+    'reflog',
+    'ls-files',
+    'ls-tree',
+    'cat-file',
+    'verify-commit',
+    'whatchanged',
+    'shortlog',
+    'help',
+    'version',
+]);
+const READ_ONLY_COMPOUND_SUBCOMMANDS = new Set(['worktree list', 'stash list', 'stash show']);
+const LOCAL_MUTATION_SUBCOMMANDS = new Set([
+    'add',
+    'commit',
+    'mv',
+    'revert',
+    'merge',
+    'cherry-pick',
+    'am',
+    'apply',
+    'format-patch',
+]);
+const REMOTE_SUBCOMMANDS = new Set(['fetch', 'pull']);
+const LOCAL_MUTATION_COMPOUND_SUBCOMMANDS = new Set([
+    'worktree add',
+    'stash push',
+    'stash apply',
+    'stash pop',
+    'stash drop',
+    'stash branch',
+]);
+const FILE_OPERAND_SUBCOMMANDS = new Set([
+    'add',
+    'rm',
+    'mv',
+    'checkout',
+    'restore',
+    'clean',
+    'apply',
+    'cherry-pick',
+    'merge',
+    'show',
+    'diff',
+    'grep',
+    'ls-files',
+]);
+const COMPOUND_SUBCOMMAND_HEADS = new Set(['worktree', 'stash', 'tag']);
+/** Positional args before `--` are refs/revisions, not worktree paths. */
+const REF_ONLY_WITHOUT_TERMINATOR = new Set(['checkout', 'show', 'log']);
+function isGitExecutable(token) {
+    return path.basename(token) === 'git';
+}
+function takesValue(flag) {
+    return (flag === '-C' ||
+        flag === '-c' ||
+        flag === '--git-dir' ||
+        flag === '--work-tree' ||
+        flag === '--exec-path' ||
+        flag === '--paginate' ||
+        flag === '--config-env' ||
+        flag.startsWith('-C') ||
+        flag.startsWith('-c') ||
+        flag.startsWith('--git-dir=') ||
+        flag.startsWith('--work-tree='));
+}
+function peelGlobalOptions(tokens, baseCwd) {
+    let effectiveCwd = baseCwd;
+    let gitDir;
+    let workTree;
+    const rest = [];
+    let index = 1;
+    while (index < tokens.length) {
+        const token = tokens[index];
+        if (!token) {
+            index += 1;
+            continue;
+        }
+        if (token === '--') {
+            rest.push(...tokens.slice(index));
+            break;
+        }
+        if (token === '--no-pager' || token === '--no-replace-objects') {
+            index += 1;
+            continue;
+        }
+        if (token === '-C' || token === '--work-tree' || token === '--git-dir' || token === '-c') {
+            const value = tokens[index + 1];
+            if (token === '-C' && value) {
+                effectiveCwd = path.resolve(baseCwd, value);
+            }
+            else if (token === '--work-tree' && value) {
+                workTree = value;
+            }
+            else if (token === '--git-dir' && value) {
+                gitDir = value;
+            }
+            index += value ? 2 : 1;
+            continue;
+        }
+        if (token.startsWith('-C') && token.length > 2) {
+            effectiveCwd = path.resolve(baseCwd, token.slice(2));
+            index += 1;
+            continue;
+        }
+        if (token.startsWith('--work-tree=')) {
+            workTree = token.slice('--work-tree='.length);
+            index += 1;
+            continue;
+        }
+        if (token.startsWith('--git-dir=')) {
+            gitDir = token.slice('--git-dir='.length);
+            index += 1;
+            continue;
+        }
+        if (token.startsWith('-c') || token.startsWith('--config')) {
+            index += token.includes('=') ? 1 : tokens[index + 1] ? 2 : 1;
+            continue;
+        }
+        if (token.startsWith('-')) {
+            if (takesValue(token) && !token.includes('=')) {
+                index += 2;
+            }
+            else {
+                index += 1;
+            }
+            continue;
+        }
+        rest.push(...tokens.slice(index));
+        break;
+    }
+    return { rest, effectiveCwd, gitDir, workTree };
+}
+function resolveSubcommand(rest) {
+    const head = rest[0] ?? '';
+    const second = rest[1] ?? '';
+    if (COMPOUND_SUBCOMMAND_HEADS.has(head) && second && !second.startsWith('-')) {
+        return { subcommand: `${head} ${second}`, args: rest.slice(2) };
+    }
+    return { subcommand: head, args: rest.slice(1) };
+}
+export function normalizeGitInvocation(tokens, baseCwd) {
+    if (!isGitExecutable(tokens[0] ?? '')) {
+        return null;
+    }
+    const peeled = peelGlobalOptions(tokens, baseCwd);
+    const { subcommand, args } = resolveSubcommand(peeled.rest);
+    if (!subcommand) {
+        return null;
+    }
+    return {
+        subcommand,
+        args,
+        effectiveCwd: peeled.effectiveCwd !== baseCwd ? peeled.effectiveCwd : undefined,
+        gitDir: peeled.gitDir,
+        workTree: peeled.workTree,
+    };
+}
+function hasGitBranchLongFlag(tokens, flags) {
+    return tokens.some((token) => {
+        const [name] = token.split('=', 1);
+        return name ? flags.has(name) : false;
+    });
+}
+function hasGitBranchShortFlag(tokens, flags) {
+    return tokens.some((token) => {
+        if (!/^-[^-]+$/.test(token)) {
+            return false;
+        }
+        return [...token.slice(1)].some((flag) => flags.has(flag));
+    });
+}
+function gitBranchEffect(args) {
+    const optionTerminator = args.indexOf('--');
+    const optionArgs = optionTerminator >= 0 ? args.slice(0, optionTerminator) : args;
+    if (hasGitBranchLongFlag(optionArgs, GIT_BRANCH_MUTATION_FLAGS) ||
+        hasGitBranchShortFlag(optionArgs, GIT_BRANCH_MUTATION_SHORT_FLAGS)) {
+        return 'local_mutation';
+    }
+    if (hasGitBranchLongFlag(optionArgs, GIT_BRANCH_LIST_FLAGS) ||
+        hasGitBranchShortFlag(optionArgs, GIT_BRANCH_LIST_SHORT_FLAGS)) {
+        return 'read_only';
+    }
+    const positionalArgs = args.filter((token, index) => (optionTerminator >= 0 && index > optionTerminator) ||
+        (token !== '--' && !token.startsWith('-')));
+    return positionalArgs.length === 0 ? 'read_only' : 'local_mutation';
+}
+function hasFlag(args, ...flags) {
+    return args.some((token) => flags.includes(token) || flags.some((flag) => token.startsWith(`${flag}=`)));
+}
+function isDryRunClean(args) {
+    return hasFlag(args, '-n', '--dry-run', '--dry-run=');
+}
+function isHardReset(args) {
+    return hasFlag(args, '--hard');
+}
+function extractMessageSkippedIndices(args) {
+    const skipped = new Set();
+    for (let index = 0; index < args.length; index += 1) {
+        const token = args[index];
+        if (!token) {
+            continue;
+        }
+        if (token === '-m' || token === '--message' || token === '-F' || token === '--file') {
+            skipped.add(index);
+            if (args[index + 1]) {
+                skipped.add(index + 1);
+                index += 1;
+            }
+            continue;
+        }
+        if (token.startsWith('-m') && token.length > 2) {
+            skipped.add(index);
+        }
+        if (token.startsWith('--message=')) {
+            skipped.add(index);
+        }
+        if (token.startsWith('--set-upstream-to=')) {
+            skipped.add(index);
+        }
+        if (token === '--set-upstream-to' && args[index + 1]) {
+            skipped.add(index);
+            skipped.add(index + 1);
+            index += 1;
+        }
+    }
+    return skipped;
+}
+function looksLikeFileOperand(token) {
+    if (!token || token === '--' || token.startsWith('-')) {
+        return false;
+    }
+    if (token.includes('/') || token.includes('\\')) {
+        return true;
+    }
+    if (token.startsWith('.')) {
+        return true;
+    }
+    return token.includes('.');
+}
+function looksLikeDiffPathOperand(token) {
+    if (!looksLikeFileOperand(token)) {
+        return false;
+    }
+    if (token.startsWith('.') || path.isAbsolute(token)) {
+        return true;
+    }
+    return token.includes('.');
+}
+function resolveGitWorkTree(baseCwd, effectiveCwd, workTree, gitDir) {
+    const resolveBase = effectiveCwd ?? baseCwd;
+    if (workTree) {
+        return path.resolve(resolveBase, workTree);
+    }
+    if (gitDir) {
+        const resolvedGitDir = path.resolve(resolveBase, gitDir);
+        if (path.basename(resolvedGitDir) === '.git') {
+            return path.dirname(resolvedGitDir);
+        }
+    }
+    return undefined;
+}
+function extractGitFileOperands(subcommand, args) {
+    const baseSubcommand = subcommand.split(' ')[0] ?? subcommand;
+    if (!FILE_OPERAND_SUBCOMMANDS.has(baseSubcommand) &&
+        subcommand !== 'checkout' &&
+        subcommand !== 'restore') {
+        return [];
+    }
+    const redirects = extractRedirectTargets(['git', baseSubcommand, ...args]);
+    const skipped = extractMessageSkippedIndices(args);
+    const optionTerminator = args.indexOf('--');
+    const operands = [...redirects];
+    if (REF_ONLY_WITHOUT_TERMINATOR.has(subcommand) && optionTerminator < 0) {
+        return operands;
+    }
+    for (let index = 0; index < args.length; index += 1) {
+        if (skipped.has(index)) {
+            continue;
+        }
+        const token = args[index];
+        if (!token || token.startsWith('-') || token === '--') {
+            continue;
+        }
+        if (optionTerminator >= 0 && index < optionTerminator) {
+            continue;
+        }
+        if (subcommand === 'branch' ||
+            subcommand === 'push' ||
+            subcommand === 'fetch' ||
+            subcommand === 'pull') {
+            continue;
+        }
+        if (baseSubcommand === 'diff' && optionTerminator < 0) {
+            if (looksLikeDiffPathOperand(token)) {
+                operands.push(token);
+            }
+            continue;
+        }
+        if (looksLikeFileOperand(token) || baseSubcommand === 'add' || baseSubcommand === 'rm') {
+            operands.push(token);
+        }
+    }
+    return operands;
+}
+function classifyDestructiveGit(subcommand, args) {
+    if (subcommand === 'reset' && isHardReset(args)) {
+        return {
+            reason: 'git_history_destructive',
+            signals: ['git_history_destructive', 'git.reset.hard'],
+        };
+    }
+    if (subcommand === 'clean' && !isDryRunClean(args)) {
+        return { reason: 'git_history_destructive', signals: ['git_history_destructive', 'git.clean'] };
+    }
+    if (subcommand === 'stash clear') {
+        return {
+            reason: 'git_history_destructive',
+            signals: ['git_history_destructive', 'git.stash.clear'],
+        };
+    }
+    if (subcommand === 'worktree remove' && hasFlag(args, '--force')) {
+        return {
+            reason: 'git_history_destructive',
+            signals: ['git_history_destructive', 'git.worktree.remove.force'],
+        };
+    }
+    if (subcommand === 'restore' && hasFlag(args, '--worktree', '-W')) {
+        return {
+            reason: 'git_history_destructive',
+            signals: ['git_history_destructive', 'git.restore.worktree'],
+        };
+    }
+    return null;
+}
+export function isGitReadOnlyInvocation(tokens, baseCwd) {
+    const semantics = classifyGitCommand(tokens, baseCwd);
+    return semantics?.isReadOnly === true;
+}
+export function classifyGitCommand(tokens, baseCwd) {
+    const normalized = normalizeGitInvocation(tokens, baseCwd);
+    if (!normalized) {
+        return null;
+    }
+    const { subcommand, args, effectiveCwd, gitDir, workTree } = normalized;
+    const normalizedKey = `git ${subcommand}`;
+    const gitWorkTree = resolveGitWorkTree(baseCwd, effectiveCwd, workTree, gitDir);
+    const effectiveGitDir = gitDir ? path.resolve(effectiveCwd ?? baseCwd, gitDir) : undefined;
+    const scopeTargets = [effectiveCwd, gitWorkTree, effectiveGitDir].filter((target, index, targets) => Boolean(target) && targets.indexOf(target) === index);
+    const pathTargets = extractGitFileOperands(subcommand, args);
+    const signals = [`git.${subcommand.replaceAll(' ', '.')}`];
+    const destructive = classifyDestructiveGit(subcommand, args);
+    if (destructive) {
+        return {
+            effect: 'local_mutation',
+            pathTargets,
+            scopeTargets,
+            signals: [...signals, ...destructive.signals],
+            requiresAsk: destructive,
+            effectiveCwd,
+            gitWorkTree,
+            normalizedKey,
+            isReadOnly: false,
+        };
+    }
+    if (subcommand === 'push') {
+        return {
+            effect: 'remote_mutation',
+            pathTargets,
+            scopeTargets,
+            signals: [...signals, 'git.push'],
+            effectiveCwd,
+            gitWorkTree,
+            normalizedKey,
+            isReadOnly: false,
+        };
+    }
+    if (REMOTE_SUBCOMMANDS.has(subcommand)) {
+        return {
+            effect: 'remote_mutation',
+            pathTargets: [],
+            scopeTargets,
+            signals: [...signals, 'git.remote'],
+            egressClass: 'ambiguous',
+            effectiveCwd,
+            gitWorkTree,
+            normalizedKey,
+            isReadOnly: false,
+        };
+    }
+    if (subcommand === 'branch') {
+        const effect = gitBranchEffect(args);
+        return {
+            effect,
+            pathTargets: [],
+            scopeTargets,
+            signals,
+            effectiveCwd,
+            gitWorkTree,
+            normalizedKey,
+            isReadOnly: effect === 'read_only',
+        };
+    }
+    if (subcommand === 'checkout') {
+        return {
+            effect: 'local_mutation',
+            pathTargets,
+            scopeTargets,
+            signals,
+            effectiveCwd,
+            gitWorkTree,
+            normalizedKey,
+            isReadOnly: false,
+        };
+    }
+    if (subcommand === 'clean' && isDryRunClean(args)) {
+        return {
+            effect: 'read_only',
+            pathTargets: [],
+            scopeTargets,
+            signals,
+            effectiveCwd,
+            gitWorkTree,
+            normalizedKey,
+            isReadOnly: true,
+        };
+    }
+    if (subcommand === 'reset' && !isHardReset(args)) {
+        return {
+            effect: 'local_mutation',
+            pathTargets: [],
+            scopeTargets,
+            signals,
+            effectiveCwd,
+            gitWorkTree,
+            normalizedKey,
+            isReadOnly: false,
+        };
+    }
+    if (subcommand === 'tag' && hasFlag(args, '--list', '-l')) {
+        return {
+            effect: 'read_only',
+            pathTargets: [],
+            scopeTargets,
+            signals,
+            effectiveCwd,
+            gitWorkTree,
+            normalizedKey,
+            isReadOnly: true,
+        };
+    }
+    if (READ_ONLY_SUBCOMMANDS.has(subcommand) || READ_ONLY_COMPOUND_SUBCOMMANDS.has(subcommand)) {
+        return {
+            effect: 'read_only',
+            pathTargets: subcommand === 'show' || subcommand === 'diff' ? pathTargets : [],
+            scopeTargets,
+            signals,
+            effectiveCwd,
+            gitWorkTree,
+            normalizedKey,
+            isReadOnly: true,
+        };
+    }
+    if (LOCAL_MUTATION_SUBCOMMANDS.has(subcommand) ||
+        LOCAL_MUTATION_COMPOUND_SUBCOMMANDS.has(subcommand)) {
+        return {
+            effect: 'local_mutation',
+            pathTargets: subcommand === 'commit' ? [] : pathTargets,
+            scopeTargets,
+            signals,
+            effectiveCwd,
+            gitWorkTree,
+            normalizedKey,
+            isReadOnly: false,
+        };
+    }
+    return {
+        effect: 'unknown',
+        pathTargets,
+        scopeTargets,
+        signals,
+        effectiveCwd,
+        gitWorkTree,
+        normalizedKey,
+        isReadOnly: false,
+    };
+}

package/dist/core/verdict/judge-audit.js

@@ -11,6 +11,7 @@ export function judgeTraceAuditFields(trace) {
         judgeModelRequested: trace.modelRequested,
         judgeModelResolved: trace.modelResolved,
         judgeLatencyMs: trace.latencyMs,
+        ...(trace.transport ? { judgeTransport: trace.transport } : {}),
         ...(trace.outboundRedacted !== undefined
             ? { judgeOutboundRedacted: trace.outboundRedacted }
             : {}),

package/dist/core/verdict/judge-baseline.d.ts

@@ -1,5 +1,5 @@
 import { JUDGE_LATENCY_SLO } from './judge-runtime-config.js';
-export type JudgeLatencyPhase = 'tier0' | 'tier1_spawn' | 'tier1_session' | 'tier1_connect' | 'tier1_eval' | 'tier1_parse';
+export type JudgeLatencyPhase = 'tier0' | 'gate' | 'tier1_spawn' | 'tier1_session' | 'tier1_connect' | 'tier1_eval' | 'tier1_parse';
 export interface JudgeLatencySample {
     phase: JudgeLatencyPhase;
     latencyMs: number;

package/dist/core/verdict/judge-baseline.js

@@ -34,6 +34,7 @@ export function judgeLatencyPercentiles(phase) {
 export function judgeLatencySloReport() {
     const measured = {
         tier0: judgeLatencyPercentiles('tier0'),
+        gate: judgeLatencyPercentiles('gate'),
         tier1_spawn: judgeLatencyPercentiles('tier1_spawn'),
         tier1_session: judgeLatencyPercentiles('tier1_session'),
         tier1_connect: judgeLatencyPercentiles('tier1_connect'),

package/dist/core/verdict/judge-broker-service.js

@@ -204,6 +204,18 @@ export async function stopJudgeBrokerDaemon(stateDir) {
         catch {
             // already stopped
         }
+        const deadline = Date.now() + 1_000;
+        while (isProcessAlive(status.pid) && Date.now() < deadline) {
+            await new Promise((resolve) => setTimeout(resolve, 25));
+        }
+        if (isProcessAlive(status.pid)) {
+            try {
+                process.kill(status.pid, 'SIGKILL');
+            }
+            catch {
+                // already stopped
+            }
+        }
     }
     await cleanupJudgeBrokerArtifacts(paths);
     return status?.pid ? 1 : 0;

package/dist/core/verdict/judge-catalog.js

@@ -102,6 +102,7 @@ export function resolveJudgeFromCatalog(input) {
     const model = input.model?.trim() || spec.defaultModel;
     const endpoint = input.endpoint !== undefined ? input.endpoint?.trim() || null : spec.defaultEndpoint;
     return {
+        mode: 'shadow',
         provider: spec.driver,
         providerId: spec.id,
         model,

package/dist/core/verdict/judge-cli-fingerprint.d.ts

@@ -2,4 +2,5 @@ import type { JudgeProviderId } from './judge-catalog.js';
 export type CliFingerprintResolver = (providerId: Exclude<JudgeProviderId, 'ollama'>) => Promise<string>;
 export declare function setCliFingerprintResolverForTests(resolver: CliFingerprintResolver | null): void;
 export declare function resolveCliVersionFingerprint(providerId: Exclude<JudgeProviderId, 'ollama'>, timeoutMs?: number): Promise<string>;
+export declare function resolveJudgeSessionFingerprint(providerId: Exclude<JudgeProviderId, 'ollama'>, timeoutMs?: number): Promise<string>;
 export declare function resetCliFingerprintCache(): void;

package/dist/core/verdict/judge-cli-fingerprint.js

@@ -56,6 +56,12 @@ export async function resolveCliVersionFingerprint(providerId, timeoutMs = 3_000
     fingerprintCache.set(cacheKey, version);
     return version;
 }
+export async function resolveJudgeSessionFingerprint(providerId, timeoutMs = 3_000) {
+    if (providerId === 'cursor' && !fingerprintResolver) {
+        return 'cursor-acp-v1';
+    }
+    return resolveCliVersionFingerprint(providerId, timeoutMs);
+}
 export function resetCliFingerprintCache() {
     fingerprintCache.clear();
 }

package/dist/core/verdict/judge-cli.js

@@ -326,9 +326,11 @@ function createCliJudge(options) {
                         judgeTimeoutMs: timeoutMs,
                     },
                 }, { runCommand });
-                const traceTransport = transportResult.transport === 'session'
-                    ? `${providerId}-cli-session`
-                    : transport;
+                const traceTransport = transportResult.transport === 'acp'
+                    ? 'cursor-acp'
+                    : transportResult.transport === 'session'
+                        ? `${providerId}-cli-session`
+                        : transport;
                 if (!transportResult.verdict) {
                     const fallbackReason = transportResult.fallbackReason ??
                         `${providerId}_cli_parse_error`;

package/dist/core/verdict/judge-provider-matrix.js

@@ -14,7 +14,7 @@ export const JUDGE_PROVIDER_SESSION_MATRIX = {
             'io_error',
             'version_mismatch',
         ],
-        notes: 'Pilot provider: ask mode + sandbox enabled; resume via --resume <chatId>.',
+        notes: 'Pilot provider: persistent ACP in ask mode; bounded conversation reuse is broker-controlled.',
     },
     codex: {
         providerId: 'codex',

package/dist/core/verdict/judge-runtime-config.d.ts

@@ -40,3 +40,5 @@ export declare const DEFAULT_JUDGE_RUNTIME_CONFIG: BelayJudgeRuntimeConfig;
 export declare function normalizeJudgeRuntimeConfig(runtime: Partial<BelayJudgeRuntimeConfig> | undefined): BelayJudgeRuntimeConfig;
 export declare function normalizeJudgeSessionConfig(session: Partial<BelayJudgeSessionConfig> | undefined): BelayJudgeSessionConfig;
 export declare function resolveSessionEvalTimeoutMs(sessionConfig: BelayJudgeSessionConfig, judgeTimeoutMs: number): number;
+/** Live CLI smoke probes use the configured judge timeout without an artificial cap. */
+export declare function resolveJudgeSmokeProbeTimeoutMs(judgeTimeoutMs: number): number;

package/dist/core/verdict/judge-runtime-config.js

@@ -9,11 +9,11 @@ export const JUDGE_LATENCY_SLO = {
     sessionMaxP95Ms: 15_000,
 };
 export const DEFAULT_JUDGE_SESSION_CONFIG = {
-    enabled: false,
-    maxTurns: 32,
-    maxAgeMs: 30 * 60 * 1000,
-    maxIdleMs: 5 * 60 * 1000,
-    maxPromptBytes: 64 * 1024,
+    enabled: true,
+    maxTurns: 8,
+    maxAgeMs: 10 * 60 * 1000,
+    maxIdleMs: 2 * 60 * 1000,
+    maxPromptBytes: 32 * 1024,
     providerAllowlist: ['cursor'],
     connectTimeoutMs: 5_000,
     evalTimeoutMs: null,
@@ -73,7 +73,7 @@ export function normalizeJudgeRuntimeConfig(runtime) {
 export function normalizeJudgeSessionConfig(session) {
     const input = session ?? {};
     return {
-        enabled: input.enabled === true,
+        enabled: typeof input.enabled === 'boolean' ? input.enabled : DEFAULT_JUDGE_SESSION_CONFIG.enabled,
         maxTurns: normalizePositiveInt(input.maxTurns, DEFAULT_JUDGE_SESSION_CONFIG.maxTurns),
         maxAgeMs: normalizePositiveInt(input.maxAgeMs, DEFAULT_JUDGE_SESSION_CONFIG.maxAgeMs),
         maxIdleMs: normalizePositiveInt(input.maxIdleMs, DEFAULT_JUDGE_SESSION_CONFIG.maxIdleMs),
@@ -90,3 +90,7 @@ export function normalizeJudgeSessionConfig(session) {
 export function resolveSessionEvalTimeoutMs(sessionConfig, judgeTimeoutMs) {
     return sessionConfig.evalTimeoutMs ?? judgeTimeoutMs;
 }
+/** Live CLI smoke probes use the configured judge timeout without an artificial cap. */
+export function resolveJudgeSmokeProbeTimeoutMs(judgeTimeoutMs) {
+    return judgeTimeoutMs;
+}

package/dist/core/verdict/judge-session-broker.d.ts

@@ -29,7 +29,7 @@ export interface JudgeSessionBrokerOptions {
 }
 export declare class JudgeSessionBroker {
     private readonly sessions;
-    private readonly mutexes;
+    private readonly providerMutexes;
     private readonly options;
     constructor(options: JudgeSessionBrokerOptions);
     listSessions(): BrokerSessionRecord[];