@guilz-dev/belay 0.9.2 → 0.9.3

package/dist/cli.js

@@ -17,9 +17,10 @@ import { formatSessionStatusReport, sessionStartProject, sessionStatusProject, }
 import { formatSimulateReport, simulateProject } from './commands/simulate.js';
 import { revokeStandingAllow } from './commands/standing-allow.js';
 import { formatStatusReport, statusProject } from './commands/status.js';
+import { formatWhereReport, whereProject } from './commands/where.js';
 import { loadConfigFile } from './config-io.js';
 import { rejectDeprecatedJudgeModelAuto } from './core/judge-model-policy.js';
-import { initProject, upgradeProject } from './installer.js';
+import { initProject, uninstallProject, upgradeProject } from './installer.js';
 import { egressEnv, egressStatus, formatEgressStatusReport, startEgressProxy, stopEgressProxy, } from './services/egress-service.js';
 import { formatSandboxStatusReport, sandboxStatus } from './services/sandbox-service.js';
 import { PACKAGE_VERSION } from './version.js';
@@ -297,14 +298,17 @@ function parseArgs(argv) {
                 }
                 options.approveScope = next;
             }
-            else if (command === 'init' || command === 'upgrade') {
+            else if (command === 'init' ||
+                command === 'upgrade' ||
+                command === 'uninstall' ||
+                command === 'where') {
                 if (!next || !['project', 'global'].includes(next)) {
                     throw new Error('--scope requires project or global.');
                 }
                 options.installScope = next;
             }
             else {
-                throw new Error('--scope is only valid for init, upgrade, or approve.');
+                throw new Error('--scope is only valid for init, upgrade, uninstall, where, or approve.');
             }
             index += 1;
             continue;
@@ -540,6 +544,8 @@ Usage:
   (--adapter selects host; fresh init picks matching judge providerId: cursor/claude/codex)
   (--dogfood runs after --preset and sets mode: audit, overriding preset enforce mode)
   ${c} upgrade [--target <dir>] [--adapter cursor|claude|codex] [--scope project|global] [--with-skill] [--migrate-judge-default]
+  ${c} uninstall [--target <dir>] [--adapter cursor] [--scope project|global]
+  ${c} where [--target <dir>] [--adapter cursor|claude|codex] [--scope project|global] [--json]
   ${c} dogfood [--target <dir>] [--adapter cursor|claude|codex] [--enforce] [--force]
   ${c} doctor [--target <dir>] [--adapter cursor|claude|codex] [--json] [--fix] [--dry-run]
   ${c} metrics [--target <dir>] [--json]
@@ -634,6 +640,30 @@ async function main() {
             process.stdout.write(`Upgraded belay (${result.adapter}) in ${result.repoRoot}.\n`);
             return;
         }
+        if (command === 'uninstall') {
+            const result = await uninstallProject({
+                targetDir: options.targetDir,
+                adapter: options.adapter,
+                scope: options.installScope,
+            });
+            process.stdout.write(`Removed belay hooks (${result.adapter}, scope=${result.scope}) from ${result.repoRoot}.\n`);
+            return;
+        }
+        if (command === 'where') {
+            const report = await whereProject({
+                targetDir: options.targetDir,
+                adapter: options.adapter,
+                scope: options.installScope,
+                json: options.json,
+            });
+            if (options.json) {
+                process.stdout.write(`${JSON.stringify(report, null, 2)}\n`);
+            }
+            else {
+                process.stdout.write(formatWhereReport(report));
+            }
+            return;
+        }
         if (command === 'judge') {
             const { runJudgeCommand } = await import('./commands/judge.js');
             if (!options.judgeSubcommand) {

package/dist/commands/doctor.js

@@ -42,6 +42,16 @@ function resolveDoctorAdapter(options, configAdapter) {
     }
     return 'cursor';
 }
+function hasCursorGlobalWorkspaceResolver(runtimeSource) {
+    // Cursor global hooks must derive workspace cwd from payload fields, not process cwd.
+    const hasScopedToolResolver = runtimeSource.includes('resolveCursorToolActionCwd') ||
+        runtimeSource.includes('includeToolInputCwd');
+    return (runtimeSource.includes('resolveCursorActionCwd') &&
+        hasScopedToolResolver &&
+        runtimeSource.includes('workspace_roots') &&
+        runtimeSource.includes('working_directory') &&
+        runtimeSource.includes('tool_input'));
+}
 export async function doctorProject(options = {}) {
     const repoRoot = path.resolve(options.targetDir ?? process.cwd());
     const issues = [];
@@ -97,7 +107,9 @@ export async function doctorProject(options = {}) {
             hooksPath = scopedPaths.hooksSettingsPath;
             corePath = path.join(scopedPaths.runtimeDir, 'core.mjs');
             notes.push(installScope === 'global'
-                ? `Install scope: global (hooks/runtime at ${scopedPaths.hooksDir})`
+                ? adapterName === 'cursor'
+                    ? `Install scope: global (hooks/runtime at ${scopedPaths.hooksDir}). To remove global hooks: belay uninstall --scope global`
+                    : `Install scope: global (hooks/runtime at ${scopedPaths.hooksDir})`
                 : 'Install scope: project');
             notes.push(`Config mode: ${loadedConfig.mode}`);
             const dogfoodActive = loadedConfig.mode === 'audit' && loadedConfig.policy.unknownLocalEffect === 'deny';
@@ -248,6 +260,17 @@ export async function doctorProject(options = {}) {
         if (runtimeVersions.stamp?.startsWith(`${PACKAGE_VERSION}@`)) {
             notes.push(`Runtime version matches package (${PACKAGE_VERSION}).`);
         }
+        if (adapterName === 'cursor' && installScope === 'global') {
+            try {
+                const runtimeSource = await readFile(corePath, 'utf8');
+                if (!hasCursorGlobalWorkspaceResolver(runtimeSource)) {
+                    warnings.push('Global Cursor runtime appears to resolve hook context from hook process cwd. Per-repository belay.config.json can be bypassed (audit may act as enforce). Run belay upgrade --scope global from the latest package.');
+                }
+            }
+            catch {
+                warnings.push('Unable to inspect global Cursor runtime for workspace-cwd resolution. Run belay upgrade --scope global from the latest package.');
+            }
+        }
     }
     if (options.fix && loadedConfig) {
         if (hasForbiddenShellOverrideLists(loadedConfig)) {

package/dist/commands/health-snapshot.d.ts

@@ -1,5 +1,8 @@
 import type { AdapterName } from '../adapters/layouts/types.js';
 import type { HealthSnapshot, HealthSnapshotOptions } from '../types.js';
+export declare function cursorCliConfigPaths(homeDir: string, env: Partial<Pick<NodeJS.ProcessEnv, 'CURSOR_CONFIG_DIR' | 'XDG_CONFIG_HOME'>>): string[];
+export declare function cursorApprovalModeRequiresHostDenialWarning(approvalMode: unknown): boolean;
+export declare function formatCursorApprovalModeLabel(approvalMode: unknown): string;
 /** Lightweight floor check without judge doctor / sandbox probes. */
 export declare function isBelayFloorInstalled(options?: {
     targetDir?: string;

package/dist/commands/health-snapshot.js

@@ -48,6 +48,53 @@ async function managedHooksPresent(adapter, hooksPath, hooksDir, repoRoot) {
     }
     return managedEntries.every(({ definition }) => content.includes(definition.command));
 }
+/** Cursor modes confirmed not to apply host-level denial after Belay allows. */
+const CURSOR_APPROVAL_MODES_WITHOUT_HOST_DENIAL = new Set(['unrestricted']);
+export function cursorCliConfigPaths(homeDir, env) {
+    const cursorConfigDir = env.CURSOR_CONFIG_DIR?.trim();
+    if (cursorConfigDir) {
+        return [path.join(cursorConfigDir, 'cli-config.json')];
+    }
+    const candidates = [];
+    const xdgConfigHome = env.XDG_CONFIG_HOME?.trim();
+    if (xdgConfigHome) {
+        candidates.push(path.join(xdgConfigHome, 'cursor', 'cli-config.json'));
+    }
+    candidates.push(path.join(homeDir, '.cursor', 'cli-config.json'));
+    return candidates;
+}
+export function cursorApprovalModeRequiresHostDenialWarning(approvalMode) {
+    if (typeof approvalMode !== 'string' || !approvalMode.trim()) {
+        return true;
+    }
+    return !CURSOR_APPROVAL_MODES_WITHOUT_HOST_DENIAL.has(approvalMode);
+}
+export function formatCursorApprovalModeLabel(approvalMode) {
+    if (typeof approvalMode !== 'string' || !approvalMode.trim()) {
+        return 'default (prompts on each action)';
+    }
+    return approvalMode;
+}
+async function cursorRunModeRiskSignal(homeDir, belayMode, env) {
+    const configPath = cursorCliConfigPaths(homeDir, env).find((candidate) => existsSync(candidate));
+    if (!configPath) {
+        return null;
+    }
+    try {
+        const config = JSON.parse(await readFile(configPath, 'utf8'));
+        if (!cursorApprovalModeRequiresHostDenialWarning(config.approvalMode)) {
+            return null;
+        }
+        const approvalModeLabel = formatCursorApprovalModeLabel(config.approvalMode);
+        const auditGuidance = belayMode === 'audit'
+            ? ' Belay is in audit mode; keep the Cursor protection or approve the exact host prompt, and do not switch Cursor to unrestricted until Belay enforce mode and fail-closed hook health are verified.'
+            : ' If Belay is intended to be authoritative, verify fail-closed hook health before configuring Cursor unrestricted mode.';
+        return `Cursor approval mode is ${approvalModeLabel}; Cursor can deny shell actions after Belay allows them. Such a denial is a host-policy denial, not a Belay approval.${auditGuidance}`;
+    }
+    catch {
+        return null;
+    }
+}
 /** Lightweight floor check without judge doctor / sandbox probes. */
 export async function isBelayFloorInstalled(options = {}) {
     const repoRoot = path.resolve(options.targetDir ?? process.cwd());
@@ -125,6 +172,15 @@ export async function collectHealthSnapshot(options = {}) {
             if (layered.config.judge.provider === 'openai-compatible') {
                 additionalRiskSignals.push('cloud judge enabled: redacted command text may be sent to an external provider');
             }
+            if (adapter === 'cursor') {
+                const cursorRunModeRisk = await cursorRunModeRiskSignal(options.homeDir ?? os.homedir(), layered.config.mode, options.cursorConfigEnv ?? {
+                    CURSOR_CONFIG_DIR: process.env.CURSOR_CONFIG_DIR,
+                    XDG_CONFIG_HOME: process.env.XDG_CONFIG_HOME,
+                });
+                if (cursorRunModeRisk) {
+                    additionalRiskSignals.push(cursorRunModeRisk);
+                }
+            }
         }
         catch {
             configPresent = false;

package/dist/commands/report.js

@@ -26,6 +26,7 @@ export async function reportProject(options = {}) {
     };
 }
 export function formatReport(report) {
+    const recentHostDenials = report.recentHostDenials ?? [];
     const lines = [
         `belay report for ${report.repoRoot}`,
         `Audit log: ${report.auditLogPath}`,
@@ -34,6 +35,10 @@ export function formatReport(report) {
         ...formatAskBreakdown(report),
         `Flag (allow_flagged): ${report.flagCount}`,
         `Allow (silent pass): ${report.allowCount}`,
+        `Host denied after Belay allow: ${report.hostDeniedAfterAllowCount ?? 0}`,
+        ...(report.unrecognizedHostFailureCount && report.unrecognizedHostFailureCount > 0
+            ? [`Unrecognized host tool failures: ${report.unrecognizedHostFailureCount}`]
+            : []),
         `Silent-pass rate: ${(report.silentPassRate * 100).toFixed(1)}%`,
         '',
     ];
@@ -51,6 +56,15 @@ export function formatReport(report) {
         }
         lines.push('');
     }
+    if (recentHostDenials.length > 0) {
+        lines.push('Host denials after Belay allow:');
+        for (const denial of recentHostDenials) {
+            const when = denial.failureTimestamp ?? 'unknown-time';
+            const detail = denial.errorMessage ? ` — ${denial.errorMessage}` : '';
+            lines.push(`- [${when}] ${denial.summary}${detail}`);
+        }
+        lines.push('');
+    }
     if (report.recentAsks.length === 0) {
         lines.push('No recent asks in the selected period.');
     }

package/dist/commands/status.js

@@ -31,6 +31,7 @@ export async function statusProject(options = {}) {
     };
 }
 export function formatStatusReport(report) {
+    const recentHostDenials = report.visibility.recentHostDenials ?? [];
     const { health } = report;
     const lines = [
         `belay status for ${report.repoRoot}`,
@@ -64,6 +65,11 @@ export function formatStatusReport(report) {
         ...formatAskBreakdown(report.visibility, '  '),
         `  Flag (allow_flagged): ${report.visibility.flagCount}`,
         `  Allow (silent pass): ${report.visibility.allowCount}`,
+        `  Host denied after Belay allow: ${report.visibility.hostDeniedAfterAllowCount ?? 0}`,
+        ...(report.visibility.unrecognizedHostFailureCount &&
+            report.visibility.unrecognizedHostFailureCount > 0
+            ? [`  Unrecognized host tool failures: ${report.visibility.unrecognizedHostFailureCount}`]
+            : []),
         `  Silent-pass rate: ${(report.visibility.silentPassRate * 100).toFixed(1)}%`,
         '',
     ];
@@ -81,6 +87,15 @@ export function formatStatusReport(report) {
         }
         lines.push('');
     }
+    if (recentHostDenials.length > 0) {
+        lines.push('Host denials after Belay allow:');
+        for (const denial of recentHostDenials.slice(0, 5)) {
+            const when = denial.failureTimestamp ?? 'unknown-time';
+            const detail = denial.errorMessage ? ` — ${denial.errorMessage}` : '';
+            lines.push(`- [${when}] ${denial.summary}${detail}`);
+        }
+        lines.push('');
+    }
     if (report.visibility.recentAsks.length > 0) {
         lines.push('Recent asks:');
         for (const ask of report.visibility.recentAsks.slice(0, 5)) {

package/dist/commands/where.d.ts

@@ -0,0 +1,4 @@
+import type { WhereOptions, WhereReport } from '../types.js';
+export declare function resolveCliPackageRoot(): string;
+export declare function whereProject(options?: WhereOptions): Promise<WhereReport>;
+export declare function formatWhereReport(report: WhereReport): string;

package/dist/commands/where.js

@@ -0,0 +1,52 @@
+import { existsSync } from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { getAdapterLayout } from '../adapters/layouts/index.js';
+import { resolveScopedPaths } from '../adapters/layouts/scope.js';
+import { detectAdapterName } from '../config-io.js';
+import { resolveOperationScope } from '../installer/scope-config.js';
+export function resolveCliPackageRoot() {
+    return path.resolve(fileURLToPath(new URL('../..', import.meta.url)));
+}
+export async function whereProject(options = {}) {
+    const cwd = process.cwd();
+    const repoRoot = path.resolve(options.targetDir ?? cwd);
+    const adapter = options.adapter ?? detectAdapterName(repoRoot);
+    const scope = await resolveOperationScope(repoRoot, adapter, options);
+    const paths = resolveScopedPaths(getAdapterLayout(adapter), scope, repoRoot);
+    const configPresent = existsSync(paths.configPath);
+    return {
+        cwd,
+        repoRoot,
+        adapter,
+        installScope: scope,
+        configPresent,
+        cliExecutable: process.argv[1] ? path.resolve(process.argv[1]) : undefined,
+        cliPackageRoot: resolveCliPackageRoot(),
+        configPath: paths.configPath,
+        hooksSettingsPath: paths.hooksSettingsPath,
+        hooksDir: paths.hooksDir,
+        runtimeDir: paths.runtimeDir,
+        skillsDir: paths.skillsDir,
+        commandsDir: paths.commandsDir,
+    };
+}
+export function formatWhereReport(report) {
+    const lines = [
+        `cwd: ${report.cwd}`,
+        `target dir: ${report.repoRoot}`,
+        `adapter: ${report.adapter} (scope=${report.installScope})`,
+        `config present: ${report.configPresent ? 'yes' : 'no'}`,
+        `cli executable: ${report.cliExecutable ?? '(unknown)'}`,
+        `cli package: ${report.cliPackageRoot}`,
+        `config: ${report.configPath}`,
+        `hooks settings: ${report.hooksSettingsPath}`,
+        `hooks: ${report.hooksDir}`,
+        `runtime: ${report.runtimeDir}`,
+        `skills: ${report.skillsDir}`,
+    ];
+    if (report.commandsDir) {
+        lines.push(`commands: ${report.commandsDir}`);
+    }
+    return `${lines.join('\n')}\n`;
+}

package/dist/core/approval-repo-lookup.d.ts

@@ -0,0 +1,16 @@
+import type { AdapterName } from '../adapters/layouts/types.js';
+export type ApprovalRepoLookupResult = {
+    status: 'found';
+    repoRoot: string;
+} | {
+    status: 'ambiguous';
+    repoRoots: string[];
+} | {
+    status: 'not_found';
+};
+export declare function findApprovalRepoRoots(params: {
+    approvalId: string;
+    candidateRepoRoots: string[];
+    adapter: AdapterName;
+}): Promise<ApprovalRepoLookupResult>;
+export declare function formatAmbiguousApprovalRepoMessage(repoRoots: string[]): string;

package/dist/core/approval-repo-lookup.js

@@ -0,0 +1,48 @@
+import { readFile } from 'node:fs/promises';
+import path from 'node:path';
+import { approvedApprovalsPath, loadConfigFile, pendingApprovalsPath } from '../config-io.js';
+async function approvalStateContainsId(filePath, approvalId) {
+    try {
+        const raw = await readFile(filePath, 'utf8');
+        const parsed = JSON.parse(raw);
+        return parsed.approvals?.some((entry) => entry.approvalId === approvalId) ?? false;
+    }
+    catch {
+        return false;
+    }
+}
+export async function findApprovalRepoRoots(params) {
+    const matches = [];
+    const seen = new Set();
+    for (const candidate of params.candidateRepoRoots) {
+        const repoRoot = path.resolve(candidate);
+        if (seen.has(repoRoot)) {
+            continue;
+        }
+        seen.add(repoRoot);
+        try {
+            const config = await loadConfigFile(repoRoot, params.adapter);
+            const pendingPath = pendingApprovalsPath(repoRoot, config);
+            const approvedPath = approvedApprovalsPath(repoRoot, config);
+            const hasPending = await approvalStateContainsId(pendingPath, params.approvalId);
+            const hasApproved = await approvalStateContainsId(approvedPath, params.approvalId);
+            if (hasPending || hasApproved) {
+                matches.push(repoRoot);
+            }
+        }
+        catch {
+            continue;
+        }
+    }
+    if (matches.length === 1) {
+        return { status: 'found', repoRoot: matches[0] };
+    }
+    if (matches.length > 1) {
+        return { status: 'ambiguous', repoRoots: matches };
+    }
+    return { status: 'not_found' };
+}
+export function formatAmbiguousApprovalRepoMessage(repoRoots) {
+    return ('Belay found the same approval ID in multiple repositories. ' +
+        `Open one workspace and retry: ${repoRoots.join(', ')}`);
+}

package/dist/core/audit-io.d.ts

@@ -1,3 +1,3 @@
 import type { BelayConfigV4 } from './config.js';
-export { AUDIT_SCHEMA_VERSION, appendAuditRecord, approvalCorrelationId, isValidAuditFingerprint, isValidAuditTimestamp, parseAuditNdjsonLine, serializeAuditRecordV3, } from './audit-serialize.js';
+export { AUDIT_SCHEMA_VERSION, appendAuditRecord, approvalCorrelationId, canonicalToolUseIdForCorrelation, isValidAuditFingerprint, isValidAuditTimestamp, parseAuditNdjsonLine, serializeAuditRecordV3, toolInvocationCorrelationId, } from './audit-serialize.js';
 export declare function appendCliAuditEvent(repoRoot: string, config: BelayConfigV4, event: Record<string, unknown>): Promise<void>;

package/dist/core/audit-io.js

@@ -2,7 +2,7 @@ import path from 'node:path';
 import { resolveActiveAuditCohort } from '../runtime-provenance.js';
 import { appendAuditRecord } from './audit-serialize.js';
 import { scrubOptionsFromConfig } from './config.js';
-export { AUDIT_SCHEMA_VERSION, appendAuditRecord, approvalCorrelationId, isValidAuditFingerprint, isValidAuditTimestamp, parseAuditNdjsonLine, serializeAuditRecordV3, } from './audit-serialize.js';
+export { AUDIT_SCHEMA_VERSION, appendAuditRecord, approvalCorrelationId, canonicalToolUseIdForCorrelation, isValidAuditFingerprint, isValidAuditTimestamp, parseAuditNdjsonLine, serializeAuditRecordV3, toolInvocationCorrelationId, } from './audit-serialize.js';
 export async function appendCliAuditEvent(repoRoot, config, event) {
     const auditPath = path.isAbsolute(config.audit.logPath)
         ? config.audit.logPath

package/dist/core/audit-query.d.ts

@@ -3,6 +3,7 @@ export declare function toAuditRecord(value: Record<string, unknown>): AuditReco
 export declare function parseTimestamp(value?: string): number | null;
 export declare function auditFingerprint(record: AuditRecord): string | undefined;
 export declare function auditApprovalCorrelationId(record: AuditRecord): string | undefined;
+export declare function auditToolInvocationCorrelationId(record: AuditRecord): string | undefined;
 export declare function isGateRecord(record: AuditRecord): boolean;
 export declare function isShellGateRecord(record: AuditRecord): boolean;
 export declare function isApprovalRecorded(record: AuditRecord): boolean;

package/dist/core/audit-query.js

@@ -27,6 +27,13 @@ export function auditApprovalCorrelationId(record) {
     }
     return undefined;
 }
+export function auditToolInvocationCorrelationId(record) {
+    if (typeof record.toolInvocationCorrelationId === 'string' &&
+        isValidApprovalCorrelationId(record.toolInvocationCorrelationId)) {
+        return record.toolInvocationCorrelationId;
+    }
+    return undefined;
+}
 export function isGateRecord(record) {
     return typeof record.event === 'string' && GATE_EVENTS.has(record.event);
 }

package/dist/core/audit-serialize.d.ts

@@ -1,6 +1,9 @@
 import type { ScrubOptions } from './types.js';
 export declare const AUDIT_SCHEMA_VERSION = 3;
 export declare function approvalCorrelationId(approvalId: string): string;
+/** Normalize Cursor host tool_use_id values before correlation hashing. */
+export declare function canonicalToolUseIdForCorrelation(toolUseId: string): string;
+export declare function toolInvocationCorrelationId(toolUseId: string): string;
 export declare function isValidApprovalCorrelationId(value: string): boolean;
 export declare function isValidAuditTimestamp(value: string): boolean;
 export declare function isValidAuditFingerprint(value: string): boolean;

package/dist/core/audit-serialize.js

@@ -19,6 +19,7 @@ const PRESERVED_HASH_FIELDS = new Set([
 const PRESERVED_LITERAL_FIELDS = new Set([
     'timestamp',
     'approvalCorrelationId',
+    'toolInvocationCorrelationId',
     'runtimeVersion',
     'runtimeBuildStamp',
     'boundaryProfile',
@@ -42,6 +43,27 @@ const SCRUBBED_CONTAINER_FIELDS = new Set([
 export function approvalCorrelationId(approvalId) {
     return createHash('sha256').update(approvalId).digest('hex').slice(0, 16);
 }
+const TOOL_USE_UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+/** Normalize Cursor host tool_use_id values before correlation hashing. */
+export function canonicalToolUseIdForCorrelation(toolUseId) {
+    const trimmed = toolUseId.trim();
+    if (trimmed.startsWith('tool_')) {
+        const remainder = trimmed.slice('tool_'.length);
+        if (TOOL_USE_UUID_PATTERN.test(remainder)) {
+            return remainder.toLowerCase();
+        }
+    }
+    if (TOOL_USE_UUID_PATTERN.test(trimmed)) {
+        return trimmed.toLowerCase();
+    }
+    return trimmed;
+}
+export function toolInvocationCorrelationId(toolUseId) {
+    return createHash('sha256')
+        .update(canonicalToolUseIdForCorrelation(toolUseId))
+        .digest('hex')
+        .slice(0, 16);
+}
 export function isValidApprovalCorrelationId(value) {
     return /^[a-f0-9]{16}$/.test(value);
 }
@@ -64,7 +86,17 @@ function isValidPreservedHashField(field, value) {
     return isValidAuditFingerprint(value);
 }
 function scrubAuditContainer(value, options) {
-    return scrubValue(value, {
+    const withoutRawToolIds = (input) => {
+        if (Array.isArray(input))
+            return input.map(withoutRawToolIds);
+        if (input && typeof input === 'object') {
+            return Object.fromEntries(Object.entries(input)
+                .filter(([key]) => key !== 'tool_use_id')
+                .map(([key, child]) => [key, withoutRawToolIds(child)]));
+        }
+        return input;
+    };
+    return scrubValue(withoutRawToolIds(value), {
         ...options,
         maskHighEntropyStrings: true,
     });
@@ -83,7 +115,7 @@ function serializeAuditField(key, value, options) {
         if (key === 'timestamp' && typeof value === 'string' && isValidAuditTimestamp(value)) {
             return value;
         }
-        if (key === 'approvalCorrelationId' &&
+        if ((key === 'approvalCorrelationId' || key === 'toolInvocationCorrelationId') &&
             typeof value === 'string' &&
             isValidApprovalCorrelationId(value)) {
             return value;
@@ -145,7 +177,11 @@ export function serializeAuditRecordV3(record, options) {
         serialized.approvalCorrelationId = record.approvalCorrelationId;
     }
     for (const [key, value] of Object.entries(record)) {
-        if (key === 'timestamp' || key === 'ts' || key === 'approvalId' || key === 'schemaVersion') {
+        if (key === 'timestamp' ||
+            key === 'ts' ||
+            key === 'approvalId' ||
+            key === 'tool_use_id' ||
+            key === 'schemaVersion') {
             continue;
         }
         const next = serializeAuditField(key, value, options);

package/dist/core/audit-summary.d.ts

@@ -6,6 +6,12 @@ export interface RecentAskEntry {
     reason: string;
     tier: AuditTier;
 }
+export interface RecentHostDenialEntry {
+    gateTimestamp?: string;
+    failureTimestamp?: string;
+    summary: string;
+    errorMessage: string;
+}
 export interface AuditVisibilitySummary {
     gateEvents: number;
     askCount: number;
@@ -16,6 +22,9 @@ export interface AuditVisibilitySummary {
     allowCount: number;
     silentPassRate: number;
     recentAsks: RecentAskEntry[];
+    hostDeniedAfterAllowCount: number;
+    recentHostDenials: RecentHostDenialEntry[];
+    unrecognizedHostFailureCount: number;
 }
 export declare const DEFAULT_SILENT_PASS_THRESHOLD = 0.5;
 export declare const MIN_GATE_EVENTS_FOR_FENCE_DRIFT = 20;

package/dist/core/audit-summary.js

@@ -1,4 +1,4 @@
-import { filterAuditRecords, inferWouldBlock, isApprovalRecorded, isGateRecord, parseTimestamp, recordStringField, } from './audit-query.js';
+import { auditToolInvocationCorrelationId, filterAuditRecords, inferWouldBlock, isApprovalRecorded, isGateRecord, parseTimestamp, recordStringField, } from './audit-query.js';
 export const DEFAULT_SILENT_PASS_THRESHOLD = 0.5;
 export const MIN_GATE_EVENTS_FOR_FENCE_DRIFT = 20;
 function isTier0Reason(reason) {
@@ -38,6 +38,7 @@ function isGateEventRecord(record) {
 export function summarizeAuditVisibility(records, filter = {}, options = {}) {
     const filtered = filterAuditRecords(records, filter);
     const gateRecords = filtered.filter(isGateEventRecord);
+    const allGateRecords = records.filter(isGateEventRecord);
     const recentAskLimit = options.recentAskLimit ?? 10;
     let askCount = 0;
     let enforceAskCount = 0;
@@ -46,6 +47,23 @@ export function summarizeAuditVisibility(records, filter = {}, options = {}) {
     let flagCount = 0;
     let allowCount = 0;
     const recentAsks = [];
+    const allowedByInvocation = new Map();
+    const recentHostDenials = [];
+    let unrecognizedHostFailureCount = 0;
+    const matchedHostDenials = new Set();
+    for (const record of allGateRecords) {
+        const invocationId = auditToolInvocationCorrelationId(record);
+        if (invocationId && !inferWouldBlock(record) && record.permission === 'allow') {
+            const existing = allowedByInvocation.get(invocationId);
+            const recordMs = parseTimestamp(record.timestamp) ?? Number.NEGATIVE_INFINITY;
+            const existingMs = existing
+                ? (parseTimestamp(existing.timestamp) ?? Number.NEGATIVE_INFINITY)
+                : Number.NEGATIVE_INFINITY;
+            if (!existing || recordMs >= existingMs) {
+                allowedByInvocation.set(invocationId, record);
+            }
+        }
+    }
     for (const record of gateRecords) {
         if (inferWouldBlock(record)) {
             askCount += 1;
@@ -73,11 +91,47 @@ export function summarizeAuditVisibility(records, filter = {}, options = {}) {
             allowCount += 1;
         }
     }
+    for (const record of filtered) {
+        if (record.event !== 'postToolUseFailure') {
+            continue;
+        }
+        if (record.failureType !== 'permission_denied') {
+            unrecognizedHostFailureCount += 1;
+            continue;
+        }
+        const invocationId = auditToolInvocationCorrelationId(record);
+        const gate = invocationId ? allowedByInvocation.get(invocationId) : undefined;
+        if (!gate) {
+            continue;
+        }
+        const gateMs = parseTimestamp(gate.timestamp);
+        const failureMs = parseTimestamp(record.timestamp);
+        if (gateMs !== null && failureMs !== null && failureMs < gateMs) {
+            continue;
+        }
+        if (invocationId && matchedHostDenials.has(invocationId)) {
+            continue;
+        }
+        if (invocationId) {
+            matchedHostDenials.add(invocationId);
+        }
+        recentHostDenials.push({
+            gateTimestamp: gate.timestamp,
+            failureTimestamp: record.timestamp,
+            summary: typeof gate.summary === 'string' ? gate.summary : '',
+            errorMessage: typeof record.errorMessage === 'string' ? record.errorMessage : '',
+        });
+    }
     recentAsks.sort((left, right) => {
         const leftMs = parseTimestamp(left.timestamp) ?? 0;
         const rightMs = parseTimestamp(right.timestamp) ?? 0;
         return rightMs - leftMs;
     });
+    recentHostDenials.sort((left, right) => {
+        const leftMs = parseTimestamp(left.failureTimestamp) ?? 0;
+        const rightMs = parseTimestamp(right.failureTimestamp) ?? 0;
+        return rightMs - leftMs;
+    });
     const gateEvents = gateRecords.length;
     const silentPassRate = gateEvents > 0 ? (allowCount + flagCount) / gateEvents : 0;
     return {
@@ -90,6 +144,9 @@ export function summarizeAuditVisibility(records, filter = {}, options = {}) {
         allowCount,
         silentPassRate,
         recentAsks: recentAsks.slice(0, recentAskLimit),
+        hostDeniedAfterAllowCount: recentHostDenials.length,
+        recentHostDenials: recentHostDenials.slice(0, recentAskLimit),
+        unrecognizedHostFailureCount,
     };
 }
 export function detectFenceDrift(summary, options = {}) {

package/dist/core/audit-types.d.ts

@@ -12,6 +12,10 @@ export interface AuditRecord {
     fingerprint?: string;
     summary?: string;
     approvalId?: string;
+    toolInvocationCorrelationId?: string;
+    toolName?: string;
+    failureType?: string;
+    errorMessage?: string;
     wouldBlock?: boolean;
     judgeFallbackReason?: string;
     permission?: string;