@guilz-dev/belay 0.9.1 → 0.9.3

package/dist/core/verdict/parser.js

@@ -2,11 +2,12 @@ import path from 'node:path';
 import { findCommandSubstitutions, findStructuralCommandSubstitutions, } from '../shell-substitution.js';
 import { commandKey, tokenizeShell } from '../shell-tokenizer.js';
 import { detectUnparseableShell } from '../shell-unparseable.js';
+import { decodeDockerComposeRunValues } from './docker-compose-run.js';
+import { decodeRecursiveInvocation, shellTokensFromValues, } from './recursive-invocation.js';
 const ENV_PREFIX_PATTERN = /^[A-Za-z_][A-Za-z0-9_]*=(?:'[^']*'|"[^"]*"|\S+)$/;
 const MAX_WRAPPER_PEEL_DEPTH = 32;
 const SHELL_INTERPRETERS = new Set(['bash', 'sh', 'zsh', 'dash', 'fish']);
 const CODE_INTERPRETERS = new Set(['python', 'python3', 'node', 'ruby', 'perl', 'osascript']);
-const SCRIPT_FLAGS = new Set(['-c', '-lc', '-e', '--eval']);
 const INTERPRETER_SCRIPT_EXTENSIONS = new Set([
     '.js',
     '.mjs',
@@ -30,10 +31,6 @@ export function peelTransparentWrappers(tokens) {
     let encounteredXargs = false;
     let peelDepth = 0;
     while (current.length > 0) {
-        if (peelDepth >= MAX_WRAPPER_PEEL_DEPTH) {
-            return { tokens: current, xargsStdinOpaque: false, encounteredXargs, opaque: true };
-        }
-        peelDepth += 1;
         while (current.length > 0 && ENV_PREFIX_PATTERN.test(current[0] ?? '')) {
             current.shift();
         }
@@ -43,6 +40,10 @@ export function peelTransparentWrappers(tokens) {
         const head = normalizeHead(current[0] ?? '');
         if (head === 'xargs') {
             encounteredXargs = true;
+            if (peelDepth >= MAX_WRAPPER_PEEL_DEPTH) {
+                return { tokens: current, xargsStdinOpaque: false, encounteredXargs, opaque: true };
+            }
+            peelDepth += 1;
             const wrapper = peelXargsWrapper(current);
             if (wrapper.kind === 'opaque') {
                 xargsStdinOpaque = current.length === 1;
@@ -60,6 +61,10 @@ export function peelTransparentWrappers(tokens) {
         if (!wrapper) {
             break;
         }
+        if (peelDepth >= MAX_WRAPPER_PEEL_DEPTH) {
+            return { tokens: current, xargsStdinOpaque: false, encounteredXargs, opaque: true };
+        }
+        peelDepth += 1;
         if (wrapper.kind === 'opaque') {
             return { tokens: current, xargsStdinOpaque: false, encounteredXargs, opaque: true };
         }
@@ -300,31 +305,23 @@ export function extractRecursiveScript(tokens) {
         return null;
     }
     const head = normalizeHead(filtered[0] ?? '');
-    const second = filtered[1] ?? '';
     if (head === 'eval') {
         const body = filtered.slice(1).join(' ').trim();
         return body || null;
     }
-    if (SHELL_INTERPRETERS.has(head) || CODE_INTERPRETERS.has(head)) {
-        const flagIndex = filtered.findIndex((token) => SCRIPT_FLAGS.has(token));
-        if (flagIndex !== -1) {
-            const body = filtered
-                .slice(flagIndex + 1)
-                .join(' ')
-                .replace(/^['"]|['"]$/g, '')
-                .trim();
-            return body || null;
-        }
-    }
-    if (head === 'bash' && (second === '-lc' || second === '-c')) {
-        const body = filtered
-            .slice(2)
-            .join(' ')
-            .replace(/^['"]|['"]$/g, '')
-            .trim();
-        return body || null;
-    }
-    return null;
+    const invocation = decodeRecursiveInvocation(shellTokensFromValues(filtered, { detectExpansion: false }));
+    return invocation.kind === 'static' ? invocation.script || null : null;
+}
+export function decodeRecursiveInvocationTokens(tokens) {
+    const values = tokens.map((token) => token.value);
+    const { tokens: filtered, opaque } = peelTransparentWrappers(values);
+    if (opaque)
+        return { kind: 'none' };
+    return decodeRecursiveInvocation(tokens.slice(values.length - filtered.length));
+}
+export function extractDockerComposeRunScript(tokens) {
+    const invocation = decodeDockerComposeRunValues(tokens);
+    return invocation.kind === 'recursive' ? invocation.script || null : null;
 }
 /**
  * True when a recursive script is evaluated from a command argument rather
@@ -340,8 +337,7 @@ export function isDynamicRecursiveEvaluation(tokens) {
     if (head === 'eval') {
         return true;
     }
-    return ((SHELL_INTERPRETERS.has(head) || CODE_INTERPRETERS.has(head)) &&
-        filtered.some((token) => SCRIPT_FLAGS.has(token)));
+    return decodeRecursiveInvocation(shellTokensFromValues(filtered)).kind !== 'none';
 }
 export function isCommandInspection(tokens) {
     return (normalizeHead(tokens[0] ?? '') === 'command' && peelCommandWrapper(tokens).kind === 'preserve');
@@ -358,8 +354,7 @@ export function isBareInterpreter(tokens) {
     if (!SHELL_INTERPRETERS.has(head) && !CODE_INTERPRETERS.has(head)) {
         return false;
     }
-    const hasScriptFlag = peeled.some((token) => SCRIPT_FLAGS.has(token));
-    if (hasScriptFlag) {
+    if (decodeRecursiveInvocation(shellTokensFromValues(peeled)).kind !== 'none') {
         return false;
     }
     const args = peeled.slice(1);

package/dist/core/verdict/recursive-invocation.d.ts

@@ -0,0 +1,20 @@
+import type { ShellToken } from '../shell-tokenizer.js';
+export type RecursiveInvocation = {
+    kind: 'static';
+    interpreter: string;
+    script: string;
+} | {
+    kind: 'dynamic';
+    interpreter: string;
+    signal: 'shell.script_expanded';
+} | {
+    kind: 'none';
+} | {
+    kind: 'indeterminate';
+    interpreter: string;
+    signal: 'shell.interpreter_argv_incomplete' | 'shell.interpreter_option_unknown';
+};
+export declare function decodeRecursiveInvocation(tokens: readonly ShellToken[]): RecursiveInvocation;
+export declare function shellTokensFromValues(values: readonly string[], options?: {
+    detectExpansion?: boolean;
+}): ShellToken[];

package/dist/core/verdict/recursive-invocation.js

@@ -0,0 +1,224 @@
+import path from 'node:path';
+const SHELL_INTERPRETERS = new Set(['bash', 'sh', 'zsh', 'dash', 'fish']);
+const PYTHON_INTERPRETERS = new Set(['python', 'python3']);
+const SHELL_SHORT_OPTIONS = new Set(['c', 'l', 'e', 'x', 'u']);
+const SHELL_NON_SCRIPT_SHORT_OPTIONS = new Set(['n']);
+const SHELL_TERMINAL_OPTIONS = new Map([
+    ['bash', new Set(['--help', '--version'])],
+    ['zsh', new Set(['--version'])],
+    ['fish', new Set(['-h', '--help', '-v', '--version'])],
+]);
+const SHELL_VALUE_OPTIONS = new Set(['-O', '+O', '--init-file', '--rcfile']);
+const NODE_TERMINAL_OPTIONS = new Set(['-h', '--help', '--help-all', '-v', '--version']);
+const NODE_FILE_OPTIONS = new Set(['-c', '--check']);
+const PYTHON_PROFILE = {
+    scriptOptions: new Set(['-c']),
+    terminalOptions: new Set(['-h', '--help', '-V', '-VV', '--version']),
+    terminalValueOptions: new Set(['-m']),
+    flagOptions: new Set([
+        '-b',
+        '-bb',
+        '-B',
+        '-d',
+        '-E',
+        '-I',
+        '-O',
+        '-OO',
+        '-P',
+        '-q',
+        '-s',
+        '-S',
+        '-u',
+        '-v',
+        '-x',
+    ]),
+    valueOptions: new Set(['-W', '-X']),
+    attachedValuePrefixes: ['-W', '-X'],
+};
+const RUBY_PROFILE = {
+    scriptOptions: new Set(['-e']),
+    terminalOptions: new Set(['-h', '--help', '-v', '--version', '--copyright']),
+    terminalValueOptions: new Set([]),
+    flagOptions: new Set(['-d', '--debug', '-w']),
+    valueOptions: new Set(['-I']),
+    attachedValuePrefixes: ['-I'],
+};
+const PERL_PROFILE = {
+    scriptOptions: new Set(['-e']),
+    terminalOptions: new Set(['-h', '--help', '-v', '--version']),
+    terminalValueOptions: new Set([]),
+    flagOptions: new Set([]),
+    valueOptions: new Set(['-I']),
+    attachedValuePrefixes: ['-I'],
+};
+const OSASCRIPT_PROFILE = {
+    scriptOptions: new Set(['-e']),
+    terminalOptions: new Set(['-h', '--help']),
+    terminalValueOptions: new Set([]),
+    flagOptions: new Set([]),
+    valueOptions: new Set(['-l']),
+    attachedValuePrefixes: [],
+};
+function normalizeInterpreter(value) {
+    return path.basename(value);
+}
+function scriptResult(interpreter, token) {
+    if (!token) {
+        return { kind: 'indeterminate', interpreter, signal: 'shell.interpreter_argv_incomplete' };
+    }
+    if (token.parts.some((part) => part.hasExpansion)) {
+        return { kind: 'dynamic', interpreter, signal: 'shell.script_expanded' };
+    }
+    return { kind: 'static', interpreter, script: token.value };
+}
+function decodeShell(words, interpreter) {
+    for (let index = 1; index < words.length; index += 1) {
+        const option = words[index]?.value ?? '';
+        if (option === '--')
+            return { kind: 'none' };
+        if (SHELL_TERMINAL_OPTIONS.get(interpreter)?.has(option))
+            return { kind: 'none' };
+        if (interpreter === 'bash' && SHELL_VALUE_OPTIONS.has(option)) {
+            const operand = words[index + 1]?.value;
+            if (!operand || operand.startsWith('-')) {
+                return { kind: 'indeterminate', interpreter, signal: 'shell.interpreter_option_unknown' };
+            }
+            index += 1;
+            continue;
+        }
+        if (!option.startsWith('-') || option === '-')
+            return { kind: 'none' };
+        const flags = [...option.slice(1)];
+        if (flags.length === 0) {
+            return { kind: 'indeterminate', interpreter, signal: 'shell.interpreter_option_unknown' };
+        }
+        if (flags.every((flag) => SHELL_SHORT_OPTIONS.has(flag))) {
+            if (!flags.includes('c'))
+                continue;
+            return scriptResult(interpreter, words[index + 1]);
+        }
+        if (flags.every((flag) => SHELL_SHORT_OPTIONS.has(flag) || SHELL_NON_SCRIPT_SHORT_OPTIONS.has(flag)) &&
+            flags.some((flag) => SHELL_NON_SCRIPT_SHORT_OPTIONS.has(flag))) {
+            return { kind: 'none' };
+        }
+        return { kind: 'indeterminate', interpreter, signal: 'shell.interpreter_option_unknown' };
+    }
+    return { kind: 'none' };
+}
+function decodeSeparated(words, interpreter, profile) {
+    for (let index = 1; index < words.length; index += 1) {
+        const option = words[index]?.value ?? '';
+        if (option === '--' || !option.startsWith('-') || option === '-')
+            return { kind: 'none' };
+        if (profile.scriptOptions.has(option)) {
+            return scriptResult(interpreter, words[index + 1]);
+        }
+        if (profile.terminalOptions.has(option))
+            return { kind: 'none' };
+        if (profile.terminalValueOptions.has(option)) {
+            const operand = words[index + 1]?.value;
+            if (!operand || operand.startsWith('-')) {
+                return { kind: 'indeterminate', interpreter, signal: 'shell.interpreter_option_unknown' };
+            }
+            return { kind: 'none' };
+        }
+        if (profile.flagOptions.has(option)) {
+            continue;
+        }
+        if (profile.valueOptions.has(option)) {
+            const operand = words[index + 1]?.value;
+            if (!operand || operand.startsWith('-')) {
+                return { kind: 'indeterminate', interpreter, signal: 'shell.interpreter_option_unknown' };
+            }
+            index += 1;
+            continue;
+        }
+        if (profile.attachedValuePrefixes.some((prefix) => option.startsWith(prefix) && option.length > prefix.length)) {
+            continue;
+        }
+        return { kind: 'indeterminate', interpreter, signal: 'shell.interpreter_option_unknown' };
+    }
+    return { kind: 'none' };
+}
+function decodeNode(words, interpreter) {
+    const option = words[1]?.value ?? '';
+    if (option === '--' || !option.startsWith('-') || option === '-')
+        return { kind: 'none' };
+    if (option === '-e' || option === '--eval') {
+        return scriptResult(interpreter, words[2]);
+    }
+    if (option.startsWith('--eval=')) {
+        const script = option.slice('--eval='.length);
+        if (words[1]?.parts.some((part) => part.hasExpansion)) {
+            return { kind: 'dynamic', interpreter, signal: 'shell.script_expanded' };
+        }
+        return { kind: 'static', interpreter, script };
+    }
+    if (NODE_TERMINAL_OPTIONS.has(option))
+        return { kind: 'none' };
+    if (NODE_FILE_OPTIONS.has(option))
+        return { kind: 'none' };
+    return { kind: 'indeterminate', interpreter, signal: 'shell.interpreter_option_unknown' };
+}
+function decodeEval(words) {
+    const arguments_ = words.slice(1);
+    if (arguments_.length === 0)
+        return { kind: 'none' };
+    if (arguments_.some((word) => word.parts.some((part) => part.hasExpansion))) {
+        return { kind: 'dynamic', interpreter: 'eval', signal: 'shell.script_expanded' };
+    }
+    return {
+        kind: 'static',
+        interpreter: 'eval',
+        script: arguments_.map((word) => word.value).join(' '),
+    };
+}
+export function decodeRecursiveInvocation(tokens) {
+    if (tokens.some((token) => token.kind === 'operator'))
+        return { kind: 'none' };
+    const words = tokens.filter((token) => token.kind === 'word');
+    const interpreter = normalizeInterpreter(words[0]?.value ?? '');
+    if (!interpreter)
+        return { kind: 'none' };
+    if (interpreter === 'eval')
+        return decodeEval(words);
+    if (SHELL_INTERPRETERS.has(interpreter))
+        return decodeShell(words, interpreter);
+    if (PYTHON_INTERPRETERS.has(interpreter)) {
+        return decodeSeparated(words, interpreter, PYTHON_PROFILE);
+    }
+    if (interpreter === 'node')
+        return decodeNode(words, interpreter);
+    if (interpreter === 'ruby')
+        return decodeSeparated(words, interpreter, RUBY_PROFILE);
+    if (interpreter === 'perl')
+        return decodeSeparated(words, interpreter, PERL_PROFILE);
+    if (interpreter === 'osascript')
+        return decodeSeparated(words, interpreter, OSASCRIPT_PROFILE);
+    return { kind: 'none' };
+}
+export function shellTokensFromValues(values, options = {}) {
+    let offset = 0;
+    return values.map((value) => {
+        const start = offset;
+        const end = start + value.length;
+        offset = end + 1;
+        return {
+            kind: 'word',
+            value,
+            raw: value,
+            start,
+            end,
+            parts: [
+                {
+                    value,
+                    raw: value,
+                    start,
+                    end,
+                    quote: 'unquoted',
+                    hasExpansion: options.detectExpansion !== false && (value.includes('$') || value.includes('`')),
+                },
+            ],
+        };
+    });
+}

package/dist/corpus/benign-probe-cores.d.ts

@@ -3,4 +3,4 @@
  * These commands guard classifier availability in tests and never grant runtime authority.
  * @see src/__tests__/verdict/structural-suite.test.ts
  */
-export declare const BENIGN_PROBE_CORES: readonly ["npm test", "npm run build", "pnpm test", "pnpm build", "pnpm vitest run src/example.test.ts", "bash -lc 'git status'", "belay approve belay_deadbeef1234", "bundle -v", "ruby -v", "yarn --version", "make -n test", "bin/rails routes", "bundle exec rubocop --version"];
+export declare const BENIGN_PROBE_CORES: readonly ["npm test", "npm run build", "pnpm test", "pnpm build", "pnpm vitest run src/example.test.ts", "bash -lc 'git status'", "belay approve belay_deadbeef1234", "bundle -v", "ruby -v", "yarn --version", "make -n test", "bin/rails routes", "bundle exec rubocop --version", "bundle exec rubocop test/upgrade_script_contract_test.rb", "ruby -Itest test/upgrade_script_contract_test.rb"];

package/dist/corpus/benign-probe-cores.js

@@ -17,4 +17,6 @@ export const BENIGN_PROBE_CORES = [
     'make -n test',
     'bin/rails routes',
     'bundle exec rubocop --version',
+    'bundle exec rubocop test/upgrade_script_contract_test.rb',
+    'ruby -Itest test/upgrade_script_contract_test.rb',
 ];

package/dist/defaults.js

@@ -59,6 +59,15 @@ export function getManagedHookEntries(platform = process.platform, hooksDir, rep
                 matcher: 'Delete',
             },
         },
+        {
+            event: 'preToolUse',
+            definition: {
+                command: toolGate,
+                placement: 'prepend',
+                // Agent Shell tool (preToolUse) — distinct from terminal beforeShellExecution.
+                matcher: 'Shell',
+            },
+        },
         {
             event: 'subagentStart',
             definition: {
@@ -114,6 +123,13 @@ export function getManagedHookEntries(platform = process.platform, hooksDir, rep
                 placement: 'append',
             },
         },
+        {
+            event: 'postToolUseFailure',
+            definition: {
+                command: runnerCommand(platform, resolvedHooksDir, resolvedRepo, 'belay-audit', 'postToolUseFailure'),
+                placement: 'append',
+            },
+        },
         {
             event: 'stop',
             definition: {

package/dist/installer/scope-config.d.ts

@@ -1,8 +1,8 @@
 import { type ScopedPaths } from '../adapters/layouts/scope.js';
 import type { AdapterName } from '../adapters/layouts/types.js';
 import type { BelayConfigV4 } from '../core/config.js';
-import type { InitOptions, UpgradeOptions } from '../types.js';
+import type { InitOptions, UninstallOptions, UpgradeOptions } from '../types.js';
 export type OperationScope = 'project' | 'global';
-export declare function resolveOperationScope(repoRoot: string, adapter: AdapterName, options?: InitOptions | UpgradeOptions): Promise<OperationScope>;
+export declare function resolveOperationScope(repoRoot: string, adapter: AdapterName, options?: InitOptions | UpgradeOptions | UninstallOptions): Promise<OperationScope>;
 export declare function applyInstallScope(repoRoot: string, adapter: AdapterName, scope: OperationScope, config?: BelayConfigV4): Promise<BelayConfigV4>;
 export declare function pathsForOperation(adapter: AdapterName, scope: OperationScope, repoRoot: string): ScopedPaths;

package/dist/installer.d.ts

@@ -1,5 +1,5 @@
 import type { AdapterName } from './adapters/layouts/types.js';
-import type { HooksFile, InitOptions, UpgradeOptions } from './types.js';
+import type { HooksFile, InitOptions, UninstallOptions, UpgradeOptions } from './types.js';
 export type { InstallScope } from './adapters/layouts/scope.js';
 export declare function loadHooksFile(hooksPath: string): Promise<HooksFile>;
 export declare function mergeHooksFile(current: HooksFile, platform?: NodeJS.Platform, hooksDir?: string, repoRoot?: string): HooksFile;
@@ -10,6 +10,10 @@ export declare function initCursorProject(options?: InitOptions): Promise<{
 export declare function upgradeCursorProject(options?: UpgradeOptions): Promise<{
     repoRoot: string;
 }>;
+export declare function uninstallCursorProject(options?: UninstallOptions): Promise<{
+    repoRoot: string;
+    scope: 'project' | 'global';
+}>;
 export declare function initProject(options?: InitOptions): Promise<{
     repoRoot: string;
     withSkill: boolean;
@@ -20,3 +24,8 @@ export declare function upgradeProject(options?: UpgradeOptions): Promise<{
     repoRoot: string;
     adapter: AdapterName;
 }>;
+export declare function uninstallProject(options?: UninstallOptions): Promise<{
+    repoRoot: string;
+    adapter: AdapterName;
+    scope: 'project' | 'global';
+}>;

package/dist/installer.js

@@ -1,7 +1,7 @@
 import { existsSync } from 'node:fs';
-import { mkdir, readFile, writeFile } from 'node:fs/promises';
+import { mkdir, readFile, rm, writeFile } from 'node:fs/promises';
 import path from 'node:path';
-import { mergeCursorHooksFile } from './adapters/cursor/hooks.js';
+import { mergeCursorHooksFile, stripCursorHooksFile } from './adapters/cursor/hooks.js';
 import { cursorLayout } from './adapters/layouts/cursor.js';
 import { resolveScopedPaths } from './adapters/layouts/scope.js';
 import { getAdapter } from './adapters/registry.js';
@@ -94,6 +94,38 @@ export async function upgradeCursorProject(options = {}) {
     await archiveLegacyAuditLogIfNeeded(repoRoot, config);
     return { repoRoot };
 }
+const BELAY_HOOK_ARTIFACTS = [
+    'belay-before-submit.mjs',
+    'belay-shell-gate.mjs',
+    'belay-tool-gate.mjs',
+    'belay-audit.mjs',
+    'belay-runner',
+    'belay-runner.cmd',
+];
+async function removeBelayHookArtifacts(paths) {
+    for (const fileName of BELAY_HOOK_ARTIFACTS) {
+        await rm(path.join(paths.hooksDir, fileName), { force: true });
+    }
+    await rm(paths.runtimeDir, { recursive: true, force: true });
+    await rm(paths.skillsDir, { recursive: true, force: true });
+    if (paths.commandsDir) {
+        await rm(path.join(paths.commandsDir, 'belay.md'), { force: true });
+    }
+}
+export async function uninstallCursorProject(options = {}) {
+    const repoRoot = path.resolve(options.targetDir ?? process.cwd());
+    const scope = await resolveOperationScope(repoRoot, 'cursor', options);
+    const paths = resolveScopedPaths(cursorLayout, scope, repoRoot);
+    const hooksSettingsExisted = existsSync(paths.hooksSettingsPath);
+    const hooksFile = await loadHooksFile(paths.hooksSettingsPath);
+    const stripped = stripCursorHooksFile(hooksFile, process.platform, paths.hooksDir, repoRoot);
+    if (hooksSettingsExisted) {
+        await mkdir(path.dirname(paths.hooksSettingsPath), { recursive: true });
+        await writeFile(paths.hooksSettingsPath, `${JSON.stringify(stripped, null, 2)}\n`, 'utf8');
+    }
+    await removeBelayHookArtifacts(paths);
+    return { repoRoot, scope };
+}
 function resolveAdapterName(options, repoRoot) {
     if (options.adapter === 'claude') {
         return 'claude';
@@ -225,3 +257,12 @@ export async function upgradeProject(options = {}) {
     await refreshIntegrityManifest(repoRoot, adapterName);
     return { repoRoot, adapter: adapterName };
 }
+export async function uninstallProject(options = {}) {
+    const repoRoot = path.resolve(options.targetDir ?? process.cwd());
+    const adapterName = resolveAdapterName(options, repoRoot);
+    if (adapterName !== 'cursor') {
+        throw new Error(`belay uninstall is only supported for Cursor adapter today. Use --adapter cursor or uninstall hooks manually for ${adapterName}.`);
+    }
+    const result = await uninstallCursorProject({ ...options, targetDir: repoRoot });
+    return { repoRoot: result.repoRoot, adapter: adapterName, scope: result.scope };
+}

package/dist/types.d.ts

@@ -1,7 +1,7 @@
 export type { BelayConfig, BelayConfigV1, BelayConfigV2, BelayConfigV3, BelayControlPlaneConfig, BelayEgressConfig, BelayOverridesConfig, BelayPolicyConfig, BelayRedactionConfig, BelaySandboxConfig, BelayTransactionalConfig, UnknownLocalEffectPolicy, } from './core/config.js';
 export type { ApprovalRecord, ApprovalStateFile, Assessment, BelayMode, ClassifyResult, HookVerdict, } from './core/types.js';
 import type { InstallScope } from './adapters/layouts/scope.js';
-import type { RecentAskEntry } from './core/audit-summary.js';
+import type { RecentAskEntry, RecentHostDenialEntry } from './core/audit-summary.js';
 import type { BelayEgressConfig, BelayOverridesConfig, BelayPolicyConfig, BelaySandboxConfig } from './core/config.js';
 import type { ApprovalRecord, ClassifyResult } from './core/types.js';
 export interface HookEntry {
@@ -42,6 +42,32 @@ export interface UpgradeOptions {
     /** Opt-in: migrate implicit factory-default ollama judge to host default provider. */
     migrateJudgeDefault?: boolean;
 }
+export interface UninstallOptions {
+    targetDir?: string;
+    adapter?: AdapterName;
+    scope?: InstallScope;
+}
+export interface WhereOptions {
+    targetDir?: string;
+    adapter?: AdapterName;
+    scope?: InstallScope;
+    json?: boolean;
+}
+export interface WhereReport {
+    cwd: string;
+    repoRoot: string;
+    adapter: AdapterName;
+    installScope: 'project' | 'global';
+    configPresent: boolean;
+    cliExecutable?: string;
+    cliPackageRoot: string;
+    configPath: string;
+    hooksSettingsPath: string;
+    hooksDir: string;
+    runtimeDir: string;
+    skillsDir: string;
+    commandsDir?: string;
+}
 export interface DoctorOptions {
     targetDir?: string;
     fix?: boolean;
@@ -88,6 +114,10 @@ export interface StatusOptions {
 export interface HealthSnapshotOptions {
     targetDir?: string;
     adapter?: AdapterName;
+    /** Override the host home directory when inspecting adapter-level execution settings. */
+    homeDir?: string;
+    /** Override Cursor config-path environment variables for deterministic host inspection. */
+    cursorConfigEnv?: Partial<Pick<NodeJS.ProcessEnv, 'CURSOR_CONFIG_DIR' | 'XDG_CONFIG_HOME'>>;
 }
 export interface HealthSnapshot {
     repoRoot: string;
@@ -172,6 +202,9 @@ export interface AuditVisibilityReport {
     allowCount: number;
     silentPassRate: number;
     recentAsks: RecentAskEntry[];
+    hostDeniedAfterAllowCount?: number;
+    recentHostDenials?: RecentHostDenialEntry[];
+    unrecognizedHostFailureCount?: number;
     warnings: string[];
     notes: string[];
 }

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const PACKAGE_VERSION = "0.9.1";
+export declare const PACKAGE_VERSION = "0.9.3";

package/dist/version.js

@@ -1,2 +1,2 @@
 // Generated by scripts/sync-version.mjs — do not edit.
-export const PACKAGE_VERSION = '0.9.1';
+export const PACKAGE_VERSION = '0.9.3';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@guilz-dev/belay",
-  "version": "0.9.1",
+  "version": "0.9.3",
   "description": "Belay-style approval and audit gating for agent runtimes.",
   "type": "module",
   "license": "MIT",
@@ -57,10 +57,13 @@
     "typecheck": "tsc --noEmit",
     "test": "pnpm build && vitest run",
     "test:structural": "pnpm build && vitest run src/__tests__/verdict/structural-suite.test.ts",
-    "test:docker": "pnpm build && vitest run src/__tests__/capability/boundary-container-isolation.test.ts src/__tests__/capability/boundary-driver-container.test.ts",
+    "test:docker": "pnpm build && vitest run --config vitest.live.config.ts src/__tests__/capability/boundary-container-isolation.test.ts src/__tests__/capability/boundary-container-workspace-mount.test.ts src/__tests__/capability/boundary-driver-container.test.ts src/__tests__/contained-execution-docker.integration.test.ts",
+    "test:llm": "pnpm build && vitest run --config vitest.live.config.ts src/__tests__/verdict/llm/judge-accuracy.test.ts",
     "test:stable": "pnpm build && vitest run && vitest run && vitest run",
     "corpus": "pnpm build && node scripts/corpus.mjs",
     "probe:adversarial": "pnpm build && node scripts/adversarial-probe.mjs",
+    "probe:cursor-shell-rewrite": "node scripts/cursor-shell-rewrite-probe.mjs",
+    "probe:native-seatbelt-boundary": "node scripts/native-seatbelt-boundary-probe.mjs --live",
     "probe:coverage": "pnpm build && node scripts/coverage-probe.mjs",
     "probe:coverage:repeat": "pnpm build && node scripts/coverage-probe.mjs --repeat 3",
     "corpus:ratchet": "pnpm build && node scripts/corpus-ratchet.mjs"

package/skills/belay/SKILL.md

@@ -54,6 +54,11 @@ To restore the legacy two-step UX (approve, then always retry manually), set
 For why it was blocked, use `/belay why <command>` or `belay explain --command "<command>"`.
 For the latest pending ask, use `/belay explain` or `belay explain`.
 
+If `belay status` or `belay report` shows `Host denied after Belay allow`, the denial came from
+the editor/agent host after Belay returned allow. There is no Belay approval ID to approve. Keep
+host protection in Belay audit mode and approve only the exact host prompt when execution is
+intended.
+
 **Do not use command allowlists** (`overrides.allow`) or legacy standing-allow records
 (shell, tool, or subagent) to fix blocks; none of them change runtime authorization.
 Improve EffectPlan semantics, approve once with `/belay-approve`, or use an exact

package/skills/belay/belay-report.md

@@ -1,7 +1,10 @@
-Show audit visibility: ask/flag/allow counts, silent-pass rate, and recent asks.
+Show audit visibility: ask/flag/allow counts, silent-pass rate, recent asks, and host
+`permission_denied` failures correlated to a preceding Belay allow.
 
 ```bash
 belay report
 ```
 
 For full install health plus audit summary, use `belay status`.
+
+`Host denied after Belay allow` is host-policy telemetry, not a pending Belay approval.