@guilz-dev/belay 0.9.1 → 0.9.3

package/README.md

@@ -44,7 +44,7 @@ equivalent lifecycle points:
 | Gate shell / tools / file mutations | `belay-tool-gate` | `beforeShellExecution`, `preToolUse` | `PreToolUse` | `PreToolUse` |
 | Gate subagent launches | `belay-tool-gate` | `subagentStart` | (via `PreToolUse`) | `SubagentStart` |
 | One-shot approvals | `belay-before-submit` | `beforeSubmitPrompt` | `UserPromptSubmit` | `UserPromptSubmit` |
-| Audit log | `belay-audit` | `postToolUse`, `stop`, `sessionEnd` | `PostToolUse` | `PostToolUse` |
+| Audit log | `belay-audit` | `postToolUse`, `postToolUseFailure`, `stop`, `sessionEnd` | `PostToolUse` | `PostToolUse` |
 
 ## Why
 

package/dist/adapters/codex/runtime-entry.d.ts

@@ -1,3 +1,6 @@
+export declare function resolveCodexActionCwd(payload: Record<string, unknown>, fallbackCwd?: string, options?: {
+    includeToolInputCwd?: boolean;
+}): string;
 export declare function runBeforeSubmitPromptHook(): Promise<void>;
 export declare function runToolGateHook(eventName: string): Promise<void>;
 export declare function runShellGateHook(): Promise<void>;

package/dist/adapters/codex/runtime-entry.js

@@ -1,3 +1,4 @@
+import path from 'node:path';
 import process from 'node:process';
 import { codexLayout } from '../layouts/codex.js';
 import { appendObservedAudit, createDefaultGateRuntimeDeps, evaluateGatedAction, gateUnmappedToolVerdict, gateVerdictToCodexPreToolUseResponse, gateVerdictToCodexUserPromptResponse, processApprovalPrompt, resolveGateConfig, } from '../shared/gate-runtime.js';
@@ -21,6 +22,22 @@ async function readStdinJson() {
 function jsonResponse(value) {
     process.stdout.write(`${JSON.stringify(value)}\n`);
 }
+function nonEmptyPathString(value) {
+    return typeof value === 'string' && value.trim() ? value.trim() : undefined;
+}
+export function resolveCodexActionCwd(payload, fallbackCwd = process.cwd(), options = {}) {
+    const toolInput = payload.tool_input !== null && typeof payload.tool_input === 'object'
+        ? payload.tool_input
+        : undefined;
+    const nestedCwd = options.includeToolInputCwd
+        ? (nonEmptyPathString(toolInput?.working_directory) ?? nonEmptyPathString(toolInput?.cwd))
+        : undefined;
+    const payloadCwd = nonEmptyPathString(payload.cwd);
+    const workspaceRoot = Array.isArray(payload.workspace_roots)
+        ? payload.workspace_roots.map(nonEmptyPathString).find(Boolean)
+        : undefined;
+    return path.resolve(nestedCwd ?? payloadCwd ?? workspaceRoot ?? fallbackCwd);
+}
 async function loadRuntimeContext(cwd) {
     const repoRoot = findRepoRoot(cwd, codexLayout);
     const configPath = codexLayout.configPath(repoRoot);
@@ -137,7 +154,8 @@ export async function runBeforeSubmitPromptHook() {
     try {
         const payload = await readStdinJson();
         const prompt = String(payload.prompt ?? payload.user_message ?? '');
-        const ctx = await loadRuntimeContext(process.cwd());
+        const cwd = resolveCodexActionCwd(payload);
+        const ctx = await loadRuntimeContext(cwd);
         const deps = createDefaultGateRuntimeDeps();
         const result = await processApprovalPrompt(ctx, deps, prompt);
         jsonResponse(gateVerdictToCodexUserPromptResponse(result));
@@ -155,9 +173,10 @@ export async function runBeforeSubmitPromptHook() {
 export async function runToolGateHook(eventName) {
     try {
         const payload = await readStdinJson();
-        const cwd = process.cwd();
         const toolName = String(payload.tool_name ?? payload.toolName ?? '');
         const kind = resolveCodexGateKind(eventName, toolName);
+        const includeToolInputCwd = (eventName === 'PreToolUse' || eventName === 'preToolUse') && kind === 'shell';
+        const cwd = resolveCodexActionCwd(payload, process.cwd(), { includeToolInputCwd });
         const ctx = await loadRuntimeContext(cwd);
         const deps = createDefaultGateRuntimeDeps();
         if (!kind) {
@@ -201,7 +220,7 @@ export async function runShellGateHook() {
     try {
         const payload = await readStdinJson();
         const command = extractString(payload.tool_input, 'command') || String(payload.command ?? '');
-        const cwd = process.cwd();
+        const cwd = resolveCodexActionCwd(payload, process.cwd(), { includeToolInputCwd: true });
         const ctx = await loadRuntimeContext(cwd);
         const deps = createDefaultGateRuntimeDeps();
         const verdict = await evaluateGatedAction(ctx, deps, {
@@ -227,7 +246,11 @@ export async function runShellGateHook() {
 export async function runAuditHook(eventName) {
     try {
         const payload = await readStdinJson();
-        const ctx = await loadRuntimeContext(process.cwd());
+        const toolName = String(payload.tool_name ?? payload.toolName ?? '');
+        const kind = resolveCodexGateKind(eventName, toolName);
+        const includeToolInputCwd = (eventName === 'PreToolUse' || eventName === 'preToolUse') && kind === 'shell';
+        const cwd = resolveCodexActionCwd(payload, process.cwd(), { includeToolInputCwd });
+        const ctx = await loadRuntimeContext(cwd);
         const deps = createDefaultGateRuntimeDeps();
         await appendObservedAudit(ctx, deps, eventName, payload);
         jsonResponse({});

package/dist/adapters/cursor/cwd-resolution.d.ts

@@ -0,0 +1,10 @@
+export type CursorActionCwdSource = 'tool_input.working_directory' | 'cwd' | 'workspace_roots' | 'fallback';
+export interface CursorActionCwdResolution {
+    cwd: string;
+    source: CursorActionCwdSource;
+    fromPayload: boolean;
+}
+export declare function resolveCursorActionCwdDetails(payload: Record<string, unknown>, fallback?: string): CursorActionCwdResolution;
+export declare function isGlobalCursorHookRuntime(): boolean;
+export declare function isUnsafeGlobalHookFallback(resolution: CursorActionCwdResolution, globalRuntime?: boolean): boolean;
+export declare const GLOBAL_HOOK_WORKSPACE_MISSING_MESSAGE: string;

package/dist/adapters/cursor/cwd-resolution.js

@@ -0,0 +1,58 @@
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+function nonEmptyPathString(value) {
+    return typeof value === 'string' && value.trim() ? value.trim() : undefined;
+}
+export function resolveCursorActionCwdDetails(payload, fallback = process.cwd()) {
+    const toolInput = payload.tool_input;
+    const toolInputWorkingDirectory = toolInput !== null && typeof toolInput === 'object' && !Array.isArray(toolInput)
+        ? nonEmptyPathString(toolInput.working_directory)
+        : undefined;
+    const topLevelCwd = nonEmptyPathString(payload.cwd);
+    const workspaceRoot = Array.isArray(payload.workspace_roots)
+        ? payload.workspace_roots.map(nonEmptyPathString).find(Boolean)
+        : undefined;
+    if (toolInputWorkingDirectory) {
+        return {
+            cwd: path.resolve(toolInputWorkingDirectory),
+            source: 'tool_input.working_directory',
+            fromPayload: true,
+        };
+    }
+    if (topLevelCwd) {
+        return {
+            cwd: path.resolve(topLevelCwd),
+            source: 'cwd',
+            fromPayload: true,
+        };
+    }
+    if (workspaceRoot) {
+        return {
+            cwd: path.resolve(workspaceRoot),
+            source: 'workspace_roots',
+            fromPayload: true,
+        };
+    }
+    return {
+        cwd: path.resolve(fallback),
+        source: 'fallback',
+        fromPayload: false,
+    };
+}
+export function isGlobalCursorHookRuntime() {
+    try {
+        const runtimePath = path.resolve(fileURLToPath(import.meta.url));
+        const globalRuntimeDir = path.resolve(path.join(os.homedir(), '.cursor', 'belay', 'runtime'));
+        return (runtimePath === globalRuntimeDir || runtimePath.startsWith(`${globalRuntimeDir}${path.sep}`));
+    }
+    catch {
+        return false;
+    }
+}
+export function isUnsafeGlobalHookFallback(resolution, globalRuntime = isGlobalCursorHookRuntime()) {
+    return !resolution.fromPayload && globalRuntime;
+}
+export const GLOBAL_HOOK_WORKSPACE_MISSING_MESSAGE = 'belay could not determine the workspace for this action from the Cursor hook payload. ' +
+    'Open the target project workspace and retry, or run belay doctor. ' +
+    'To stop global hooks: belay uninstall --scope global';

package/dist/adapters/cursor/hooks.d.ts

@@ -1,6 +1,8 @@
 import type { HookEntry, HooksFile } from '../../types.js';
-/** Legacy Belay-managed Shell preToolUse gate duplicated beforeShellExecution. */
-export declare function legacyManagedShellPreToolUseEntry(platform: NodeJS.Platform, hooksDir: string, repoRoot: string): HookEntry;
-export declare function removeLegacyManagedShellPreToolUse(hooks: HooksFile, platform: NodeJS.Platform, hooksDir: string, repoRoot: string): HooksFile;
+/** Managed Shell preToolUse gate for Cursor Agent Shell tool invocations. */
+export declare function managedShellPreToolUseEntry(platform: NodeJS.Platform, hooksDir: string, repoRoot: string): HookEntry;
+/** @deprecated Use {@link managedShellPreToolUseEntry}. */
+export declare const legacyManagedShellPreToolUseEntry: typeof managedShellPreToolUseEntry;
+export declare function stripCursorHooksFile(current: HooksFile, platform: NodeJS.Platform, hooksDir: string, repoRoot: string): HooksFile;
 export declare function mergeCursorHooksFile(current: HooksFile, platform: NodeJS.Platform, hooksDir: string, repoRoot: string): HooksFile;
 export declare function hasDuplicateCursorShellGates(hooks: HooksFile, platform: NodeJS.Platform, hooksDir: string, repoRoot: string): boolean;

package/dist/adapters/cursor/hooks.js

@@ -10,37 +10,45 @@ function mergeHookEntry(current, expected, placement) {
     }
     return [...filtered, expected];
 }
-/** Legacy Belay-managed Shell preToolUse gate duplicated beforeShellExecution. */
-export function legacyManagedShellPreToolUseEntry(platform, hooksDir, repoRoot) {
+/** Managed Shell preToolUse gate for Cursor Agent Shell tool invocations. */
+export function managedShellPreToolUseEntry(platform, hooksDir, repoRoot) {
     const managed = getManagedHookEntries(platform, hooksDir, repoRoot);
     const referencePreToolUse = managed.find((entry) => entry.event === 'preToolUse' && entry.definition.matcher === 'Write')?.definition;
     if (!referencePreToolUse) {
-        throw new Error('managed hook definitions missing for legacy Shell migration');
+        throw new Error('managed hook definitions missing for Shell preToolUse gate');
     }
     return {
         command: referencePreToolUse.command,
         matcher: 'Shell',
     };
 }
-export function removeLegacyManagedShellPreToolUse(hooks, platform, hooksDir, repoRoot) {
-    const legacy = legacyManagedShellPreToolUseEntry(platform, hooksDir, repoRoot);
-    const preToolUse = hooks.hooks.preToolUse;
-    if (!Array.isArray(preToolUse)) {
-        return hooks;
-    }
-    return {
-        ...hooks,
-        hooks: {
-            ...hooks.hooks,
-            preToolUse: preToolUse.filter((entry) => !entryMatches(entry, legacy)),
-        },
+/** @deprecated Use {@link managedShellPreToolUseEntry}. */
+export const legacyManagedShellPreToolUseEntry = managedShellPreToolUseEntry;
+export function stripCursorHooksFile(current, platform, hooksDir, repoRoot) {
+    const next = {
+        version: current.version || 1,
+        hooks: { ...current.hooks },
     };
+    const managedEntries = getManagedHookEntries(platform, hooksDir, repoRoot);
+    for (const { event, definition } of managedEntries) {
+        const entries = next.hooks[event];
+        if (!Array.isArray(entries)) {
+            continue;
+        }
+        next.hooks[event] = entries.filter((entry) => !entryMatches(entry, {
+            command: definition.command,
+            matcher: definition.matcher,
+        }));
+        if (next.hooks[event].length === 0) {
+            delete next.hooks[event];
+        }
+    }
+    return next;
 }
 export function mergeCursorHooksFile(current, platform, hooksDir, repoRoot) {
-    const withoutLegacyShell = removeLegacyManagedShellPreToolUse(current, platform, hooksDir, repoRoot);
     const next = {
-        version: withoutLegacyShell.version || 1,
-        hooks: { ...withoutLegacyShell.hooks },
+        version: current.version || 1,
+        hooks: { ...current.hooks },
     };
     const managedEntries = getManagedHookEntries(platform, hooksDir, repoRoot);
     for (const { event, definition } of managedEntries) {
@@ -52,10 +60,11 @@ export function mergeCursorHooksFile(current, platform, hooksDir, repoRoot) {
     return next;
 }
 export function hasDuplicateCursorShellGates(hooks, platform, hooksDir, repoRoot) {
-    const legacy = legacyManagedShellPreToolUseEntry(platform, hooksDir, repoRoot);
+    const shellEntry = managedShellPreToolUseEntry(platform, hooksDir, repoRoot);
     const preToolUse = hooks.hooks.preToolUse;
     if (!Array.isArray(preToolUse)) {
         return false;
     }
-    return preToolUse.some((entry) => entryMatches(entry, legacy));
+    const shellMatches = preToolUse.filter((entry) => entryMatches(entry, shellEntry));
+    return shellMatches.length > 1;
 }

package/dist/adapters/cursor/runtime-entry.d.ts

@@ -1,3 +1,4 @@
+export declare function resolveCursorActionCwd(payload: Record<string, unknown>, fallback?: string): string;
 export declare function runBeforeSubmitPromptHook(): Promise<void>;
 export declare function runShellGateHook(): Promise<void>;
 export declare function runToolGateHook(eventName: string): Promise<void>;

package/dist/adapters/cursor/runtime-entry.js

@@ -1,7 +1,12 @@
+import path from 'node:path';
 import process from 'node:process';
+import { approvalCommandMatch } from '../../core/approval.js';
+import { findApprovalRepoRoots, formatAmbiguousApprovalRepoMessage, } from '../../core/approval-repo-lookup.js';
+import { DEFAULT_CONFIG_V4 } from '../../core/config.js';
 import { cursorLayout } from '../layouts/cursor.js';
 import { appendObservedAudit, createDefaultGateRuntimeDeps, evaluateGatedAction, gateVerdictToCursorResponse, processApprovalPrompt, resolveGateConfig, } from '../shared/gate-runtime.js';
 import { findRepoRoot } from '../shared/repo-root.js';
+import { GLOBAL_HOOK_WORKSPACE_MISSING_MESSAGE, isUnsafeGlobalHookFallback, resolveCursorActionCwdDetails, } from './cwd-resolution.js';
 async function readStdinJson() {
     const chunks = [];
     for await (const chunk of process.stdin) {
@@ -21,6 +26,38 @@ async function readStdinJson() {
 function jsonResponse(value) {
     process.stdout.write(`${JSON.stringify(value)}\n`);
 }
+export function resolveCursorActionCwd(payload, fallback = process.cwd()) {
+    return resolveCursorActionCwdDetails(payload, fallback).cwd;
+}
+function resolveCursorToolActionCwdDetails(payload, fallback, eventName, toolName) {
+    if ((eventName === 'preToolUse' || eventName === 'PreToolUse') && toolName === 'Shell') {
+        return resolveCursorActionCwdDetails(payload, fallback);
+    }
+    const toolInput = payload.tool_input;
+    if (toolInput === null || typeof toolInput !== 'object' || Array.isArray(toolInput)) {
+        return resolveCursorActionCwdDetails(payload, fallback);
+    }
+    const { working_directory: _workingDirectory, ...withoutWorkingDirectory } = toolInput;
+    return resolveCursorActionCwdDetails({ ...payload, tool_input: withoutWorkingDirectory }, fallback);
+}
+function collectCandidateRepoRoots(payload, resolution) {
+    const roots = [];
+    const add = (value) => {
+        const resolved = path.resolve(value);
+        if (!roots.includes(resolved)) {
+            roots.push(resolved);
+        }
+    };
+    if (Array.isArray(payload.workspace_roots)) {
+        for (const root of payload.workspace_roots) {
+            if (typeof root === 'string' && root.trim()) {
+                add(root);
+            }
+        }
+    }
+    add(resolution.cwd);
+    return roots;
+}
 async function loadRuntimeContext(cwd) {
     const repoRoot = findRepoRoot(cwd, cursorLayout);
     const configPath = cursorLayout.configPath(repoRoot);
@@ -28,6 +65,39 @@ async function loadRuntimeContext(cwd) {
     const config = await resolveGateConfig({ layout: cursorLayout, repoRoot, configPath }, deps);
     return { layout: cursorLayout, repoRoot, config, configPath };
 }
+async function processApprovalPromptWithRepoFallback(ctx, deps, prompt, payload, resolution) {
+    const tokenPrefix = ctx.config.tokenPrefix || DEFAULT_CONFIG_V4.tokenPrefix;
+    const approvalId = approvalCommandMatch(prompt, tokenPrefix);
+    const result = await processApprovalPrompt(ctx, deps, prompt);
+    if (result.continue || !approvalId) {
+        return result;
+    }
+    const notFound = result.user_message?.includes('not found') ||
+        result.user_message?.includes('Belay approval not found');
+    if (!notFound) {
+        return result;
+    }
+    const candidates = collectCandidateRepoRoots(payload, resolution).filter((root) => root !== ctx.repoRoot);
+    if (candidates.length === 0) {
+        return result;
+    }
+    const lookup = await findApprovalRepoRoots({
+        approvalId,
+        candidateRepoRoots: candidates,
+        adapter: 'cursor',
+    });
+    if (lookup.status === 'ambiguous') {
+        return {
+            continue: false,
+            user_message: formatAmbiguousApprovalRepoMessage(lookup.repoRoots),
+        };
+    }
+    if (lookup.status !== 'found') {
+        return result;
+    }
+    const retryCtx = await loadRuntimeContext(lookup.repoRoot);
+    return processApprovalPrompt(retryCtx, deps, prompt);
+}
 function isSubagentEvent(payload, eventName) {
     return eventName === 'subagentStart' || payload.subagent_type !== undefined;
 }
@@ -38,9 +108,17 @@ export async function runBeforeSubmitPromptHook() {
     try {
         const payload = await readStdinJson();
         const prompt = String(payload.prompt ?? '');
-        const ctx = await loadRuntimeContext(process.cwd());
+        const resolution = resolveCursorActionCwdDetails(payload);
+        if (isUnsafeGlobalHookFallback(resolution)) {
+            jsonResponse({
+                continue: false,
+                user_message: GLOBAL_HOOK_WORKSPACE_MISSING_MESSAGE,
+            });
+            return;
+        }
+        const ctx = await loadRuntimeContext(resolution.cwd);
         const deps = createDefaultGateRuntimeDeps();
-        const result = await processApprovalPrompt(ctx, deps, prompt);
+        const result = await processApprovalPromptWithRepoFallback(ctx, deps, prompt, payload, resolution);
         jsonResponse({
             continue: result.continue,
             ...(result.user_message ? { user_message: result.user_message } : {}),
@@ -58,13 +136,22 @@ export async function runShellGateHook() {
     try {
         const payload = await readStdinJson();
         const command = String(payload.command ?? '').trim();
-        const cwd = String(payload.cwd ?? process.cwd()).trim() || process.cwd();
+        const resolution = resolveCursorActionCwdDetails(payload);
+        if (isUnsafeGlobalHookFallback(resolution)) {
+            jsonResponse({
+                permission: 'deny',
+                user_message: GLOBAL_HOOK_WORKSPACE_MISSING_MESSAGE,
+            });
+            return;
+        }
+        const cwd = resolution.cwd;
         const ctx = await loadRuntimeContext(cwd);
         const deps = createDefaultGateRuntimeDeps();
         const verdict = await evaluateGatedAction(ctx, deps, {
             kind: 'shell',
             cwd,
             command,
+            payload,
             sourceEvent: 'beforeShellExecution',
         });
         jsonResponse(gateVerdictToCursorResponse(verdict));
@@ -79,10 +166,18 @@ export async function runShellGateHook() {
 export async function runToolGateHook(eventName) {
     try {
         const payload = await readStdinJson();
-        const cwd = process.cwd();
+        const toolName = String(payload.tool_name ?? '');
+        const resolution = resolveCursorToolActionCwdDetails(payload, process.cwd(), eventName, toolName);
+        if (isUnsafeGlobalHookFallback(resolution)) {
+            jsonResponse({
+                permission: 'deny',
+                user_message: GLOBAL_HOOK_WORKSPACE_MISSING_MESSAGE,
+            });
+            return;
+        }
+        const cwd = resolution.cwd;
         const ctx = await loadRuntimeContext(cwd);
         const deps = createDefaultGateRuntimeDeps();
-        const toolName = String(payload.tool_name ?? '');
         if (isSubagentEvent(payload, eventName)) {
             const verdict = await evaluateGatedAction(ctx, deps, {
                 kind: 'subagent',
@@ -137,7 +232,13 @@ export async function runToolGateHook(eventName) {
 export async function runAuditHook(eventName) {
     try {
         const payload = await readStdinJson();
-        const ctx = await loadRuntimeContext(process.cwd());
+        const toolName = String(payload.tool_name ?? '');
+        const resolution = resolveCursorToolActionCwdDetails(payload, process.cwd(), eventName, toolName);
+        if (isUnsafeGlobalHookFallback(resolution)) {
+            jsonResponse({});
+            return;
+        }
+        const ctx = await loadRuntimeContext(resolution.cwd);
         const deps = createDefaultGateRuntimeDeps();
         await appendObservedAudit(ctx, deps, eventName, payload);
         jsonResponse({});

package/dist/adapters/shared/gate-runtime.js

@@ -7,7 +7,7 @@ import { buildReplayHint, buildRetryInstructionForConfig, canAutoReplay, getExec
 import { claimApprovedForReplay, gateApprovalStoreFromDeps, recordApproval, } from '../../core/approval-service.js';
 import { issueApprovalToken } from '../../core/approval-token.js';
 import { buildAuditActionSnapshot, buildAuditReplayContext, } from '../../core/audit-replay-context.js';
-import { approvalCorrelationId, serializeAuditRecordV3 } from '../../core/audit-serialize.js';
+import { approvalCorrelationId, serializeAuditRecordV3, toolInvocationCorrelationId, } from '../../core/audit-serialize.js';
 import { boundedUtf8Tail } from '../../core/bounded-output.js';
 import { mutateApprovalStateWithRetry } from '../../core/capability/approval-state-mutation.js';
 import { APPROVAL_STATE_VERSION_V3 } from '../../core/capability/approval-v3.js';
@@ -36,7 +36,7 @@ import { extractJudgeFallbackReason, formatJudgeInfrastructureDenyMessage, infer
 import { notifyDeny } from '../../core/notify.js';
 import { canonicalPath } from '../../core/path-utils.js';
 import { recoveryFailClosedResult, recoveryFailReasonFromSkip, } from '../../core/recovery/fail-closed.js';
-import { fingerprintReplayPayload } from '../../core/replay-scrub.js';
+import { fingerprintReplayPayload, redactToolInvocationId } from '../../core/replay-scrub.js';
 import { FILE_CHECKPOINT_ISOLATION_UNAVAILABLE, isTransactionalEligible, runTransactionalExecution, TRANSACTIONAL_ALREADY_APPLIED, TRANSACTIONAL_APPROVAL_BYPASS_REASONS, } from '../../core/transactional/index.js';
 import { buildAuditProvenanceFields } from '../../runtime-provenance.js';
 import { egressStatus } from '../../services/egress-service.js';
@@ -616,6 +616,9 @@ export async function evaluateGatedAction(ctx, deps, params) {
             event: resolveGateAuditEvent(sourceEvent, params.kind),
             sourceEvent,
             kind: params.kind,
+            ...(typeof params.payload?.tool_use_id === 'string'
+                ? { toolInvocationCorrelationId: toolInvocationCorrelationId(params.payload.tool_use_id) }
+                : {}),
             fingerprint: verdict.fingerprint,
             verdict: verdict.verdict,
             reason: verdict.reason,
@@ -779,6 +782,9 @@ export async function evaluateGatedAction(ctx, deps, params) {
     const scrubbedPayload = fingerprintReplayPayload(params.kind, params.payload, scrubOpts);
     return gateDecisionToVerdict(ctx, deps, params.kind, result, {
         sourceEvent: params.sourceEvent,
+        toolInvocationCorrelationId: typeof params.payload?.tool_use_id === 'string'
+            ? toolInvocationCorrelationId(params.payload.tool_use_id)
+            : undefined,
         predictedAssessment,
         observedAssessment,
         transactionalLayer,
@@ -904,6 +910,9 @@ async function gateDecisionToVerdict(ctx, deps, kind, result, auditExtras = {})
         event: auditEvent,
         sourceEvent,
         kind,
+        ...(auditExtras.toolInvocationCorrelationId
+            ? { toolInvocationCorrelationId: auditExtras.toolInvocationCorrelationId }
+            : {}),
         fingerprint: result.fingerprint,
         summary: result.normalizedCommand ?? result.summary ?? '',
         assessment: result.assessment,
@@ -1398,12 +1407,26 @@ export function gateVerdictToCodexUserPromptResponse(verdict) {
     };
 }
 export async function appendObservedAudit(ctx, deps, eventName, payload) {
+    const rawToolUseId = typeof payload.tool_use_id === 'string' ? payload.tool_use_id : undefined;
+    const summaryPayload = redactToolInvocationId(payload, rawToolUseId);
     await deps.appendAudit(ctx, {
         event: eventName,
         kind: 'audit',
         verdict: 'allow',
         reason: 'observed',
-        summary: canonicalStringify(payload),
+        ...(rawToolUseId
+            ? { toolInvocationCorrelationId: toolInvocationCorrelationId(rawToolUseId) }
+            : {}),
+        ...(typeof summaryPayload.tool_name === 'string' ? { toolName: summaryPayload.tool_name } : {}),
+        ...(typeof summaryPayload.failure_type === 'string'
+            ? { failureType: summaryPayload.failure_type }
+            : {}),
+        ...(typeof summaryPayload.error_message === 'string'
+            ? { errorMessage: summaryPayload.error_message }
+            : {}),
+        ...(typeof payload.duration === 'number' ? { durationMs: payload.duration } : {}),
+        ...(typeof payload.is_interrupt === 'boolean' ? { isInterrupt: payload.is_interrupt } : {}),
+        summary: canonicalStringify(summaryPayload),
     });
 }
 export { GateNormalizationError };

package/dist/adapters/shared/repo-root.js

@@ -1,10 +1,29 @@
 import { existsSync } from 'node:fs';
 import path from 'node:path';
+function belayConfigPath(current, adapterName) {
+    if (adapterName === 'cursor') {
+        return path.join(current, '.cursor', 'belay.config.json');
+    }
+    if (adapterName === 'claude') {
+        return path.join(current, '.claude', 'belay.config.json');
+    }
+    return path.join(current, '.codex', 'belay.config.json');
+}
+function markerMatches(current, marker, layout) {
+    const markerPath = path.join(current, marker);
+    if (!existsSync(markerPath)) {
+        return false;
+    }
+    if (marker === '.cursor' || marker === '.claude' || marker === '.codex') {
+        return existsSync(belayConfigPath(current, layout.name));
+    }
+    return true;
+}
 export function findRepoRoot(startPath, layout) {
     let current = path.resolve(startPath);
     while (true) {
         for (const marker of layout.repoRootMarkers) {
-            if (existsSync(path.join(current, marker))) {
+            if (markerMatches(current, marker, layout)) {
                 return current;
             }
         }