@guilz-dev/belay 0.9.2 → 0.9.3

package/dist/core/verdict/launcher-resolve.js

@@ -1,6 +1,6 @@
 import { existsSync, readFileSync } from 'node:fs';
 import path from 'node:path';
-import { expandMakeExpression, normalizeMakeRecipeLine, parseMakefileVariables, parsePhonyTargets, } from './makefile-expand.js';
+import { expandMakeExpression, normalizeMakeRecipeLine, parseMakefileVariables, } from './makefile-expand.js';
 const MAX_RESOLVE_DEPTH = 8;
 const PNPM_BUILTIN_COMMANDS = new Set([
     'add',
@@ -229,7 +229,6 @@ function resolveMakeRecipe(cwd, repoRoot, target, cliVars = {}) {
     }
     const makefileContent = readFileSync(makefilePath, 'utf8');
     const makefileVars = parseMakefileVariables(makefileContent);
-    const phonyTargets = parsePhonyTargets(makefileContent);
     const targets = parseMakefileRecipeContent(makefileContent);
     if (!targets.has(target)) {
         return { recipes: [], opaque: true, reason: 'make_target_undefined' };
@@ -237,42 +236,34 @@ function resolveMakeRecipe(cwd, repoRoot, target, cliVars = {}) {
     const recipeLines = [];
     const visiting = new Set();
     const visited = new Set();
-    let opaquePrerequisites = false;
+    let hasDynamicPrerequisite = false;
+    let hasUndefinedPrerequisite = false;
+    let hasDependencyCycle = false;
     const collect = (name) => {
         if (visited.has(name)) {
-            return true;
+            return;
         }
         if (visiting.has(name)) {
-            return false;
+            hasDependencyCycle = true;
+            return;
         }
         const entry = targets.get(name);
         if (!entry) {
-            return true;
+            if (!existsSync(path.resolve(path.dirname(makefilePath), name))) {
+                hasUndefinedPrerequisite = true;
+            }
+            return;
         }
         visiting.add(name);
-        opaquePrerequisites ||= entry.opaquePrerequisites;
+        hasDynamicPrerequisite ||= entry.opaquePrerequisites;
         for (const prerequisite of entry.prerequisites) {
-            if (targets.has(prerequisite) && !collect(prerequisite)) {
-                return false;
-            }
-        }
-        // When the requested target has its own recipes, treat those as the
-        // authorization authority. Skip .PHONY / `_`-prefixed prerequisite
-        // recipes (e.g. `_start_test_deps` docker-compose up) so setup-only
-        // side effects do not obscure the target's direct command.
-        const skipPhonyPrerequisiteRecipes = name !== target &&
-            (phonyTargets.has(name) || name.startsWith('_')) &&
-            (targets.get(target)?.recipes.length ?? 0) > 0;
-        if (!skipPhonyPrerequisiteRecipes) {
-            recipeLines.push(...entry.recipes);
+            collect(prerequisite);
         }
+        recipeLines.push(...entry.recipes);
         visiting.delete(name);
         visited.add(name);
-        return true;
     };
-    if (!collect(target)) {
-        return { recipes: recipeLines, opaque: true, reason: 'make_dependency_cycle' };
-    }
+    collect(target);
     const expandedRecipes = [];
     for (const line of recipeLines) {
         const normalized = normalizeMakeRecipeLine(line);
@@ -287,18 +278,24 @@ function resolveMakeRecipe(cwd, repoRoot, target, cliVars = {}) {
             return { recipes: expandedRecipes, opaque: true, reason: 'make_recipe_dynamic' };
         }
     }
-    if (opaquePrerequisites) {
+    if (hasDependencyCycle) {
+        return { recipes: expandedRecipes, opaque: true, reason: 'make_dependency_cycle' };
+    }
+    if (hasDynamicPrerequisite) {
         return { recipes: expandedRecipes, opaque: true, reason: 'make_prerequisite_dynamic' };
     }
+    if (hasUndefinedPrerequisite) {
+        return { recipes: expandedRecipes, opaque: true, reason: 'make_prerequisite_undefined' };
+    }
     return { recipes: expandedRecipes, opaque: false, reason: 'make_recipe_resolved' };
 }
 export function resolveLauncherRecipe(params) {
-    if (params.depth >= MAX_RESOLVE_DEPTH) {
-        return { recipes: [], opaque: true, reason: 'launcher_depth_exceeded' };
-    }
     const tokens = params.tokens;
     const scriptName = npmScriptName(tokens);
     if (scriptName) {
+        if (params.depth >= MAX_RESOLVE_DEPTH) {
+            return { recipes: [], opaque: true, reason: 'launcher_depth_exceeded' };
+        }
         const resolution = resolveNpmRecipe(params.cwd, params.repoRoot, scriptName, forwardedArgs(tokens));
         if (tokens[0] === 'pnpm' &&
             tokens[1] &&
@@ -313,6 +310,9 @@ export function resolveLauncherRecipe(params) {
         return resolution;
     }
     if (tokens[0] === 'make') {
+        if (params.depth >= MAX_RESOLVE_DEPTH) {
+            return { recipes: [], opaque: true, reason: 'launcher_depth_exceeded' };
+        }
         if (tokens.includes('-n') || tokens.includes('--dry-run')) {
             return null;
         }

package/dist/core/verdict/parser.d.ts

@@ -1,3 +1,5 @@
+import { type ShellToken } from '../shell-tokenizer.js';
+import { type RecursiveInvocation } from './recursive-invocation.js';
 import type { VerdictOpacity } from './types.js';
 export interface ParsedSegment {
     tokens: string[];
@@ -16,6 +18,7 @@ export declare function peelTransparentWrappers(tokens: string[]): {
 export declare function isVariableIndirectHead(head: string): boolean;
 export declare function extractEvalBody(tokens: string[]): string | null;
 export declare function extractRecursiveScript(tokens: string[]): string | null;
+export declare function decodeRecursiveInvocationTokens(tokens: readonly ShellToken[]): RecursiveInvocation;
 export declare function extractDockerComposeRunScript(tokens: string[]): string | null;
 /**
  * True when a recursive script is evaluated from a command argument rather

package/dist/core/verdict/parser.js

@@ -2,11 +2,12 @@ import path from 'node:path';
 import { findCommandSubstitutions, findStructuralCommandSubstitutions, } from '../shell-substitution.js';
 import { commandKey, tokenizeShell } from '../shell-tokenizer.js';
 import { detectUnparseableShell } from '../shell-unparseable.js';
+import { decodeDockerComposeRunValues } from './docker-compose-run.js';
+import { decodeRecursiveInvocation, shellTokensFromValues, } from './recursive-invocation.js';
 const ENV_PREFIX_PATTERN = /^[A-Za-z_][A-Za-z0-9_]*=(?:'[^']*'|"[^"]*"|\S+)$/;
 const MAX_WRAPPER_PEEL_DEPTH = 32;
 const SHELL_INTERPRETERS = new Set(['bash', 'sh', 'zsh', 'dash', 'fish']);
 const CODE_INTERPRETERS = new Set(['python', 'python3', 'node', 'ruby', 'perl', 'osascript']);
-const SCRIPT_FLAGS = new Set(['-c', '-lc', '-e', '--eval']);
 const INTERPRETER_SCRIPT_EXTENSIONS = new Set([
     '.js',
     '.mjs',
@@ -30,10 +31,6 @@ export function peelTransparentWrappers(tokens) {
     let encounteredXargs = false;
     let peelDepth = 0;
     while (current.length > 0) {
-        if (peelDepth >= MAX_WRAPPER_PEEL_DEPTH) {
-            return { tokens: current, xargsStdinOpaque: false, encounteredXargs, opaque: true };
-        }
-        peelDepth += 1;
         while (current.length > 0 && ENV_PREFIX_PATTERN.test(current[0] ?? '')) {
             current.shift();
         }
@@ -43,6 +40,10 @@ export function peelTransparentWrappers(tokens) {
         const head = normalizeHead(current[0] ?? '');
         if (head === 'xargs') {
             encounteredXargs = true;
+            if (peelDepth >= MAX_WRAPPER_PEEL_DEPTH) {
+                return { tokens: current, xargsStdinOpaque: false, encounteredXargs, opaque: true };
+            }
+            peelDepth += 1;
             const wrapper = peelXargsWrapper(current);
             if (wrapper.kind === 'opaque') {
                 xargsStdinOpaque = current.length === 1;
@@ -60,6 +61,10 @@ export function peelTransparentWrappers(tokens) {
         if (!wrapper) {
             break;
         }
+        if (peelDepth >= MAX_WRAPPER_PEEL_DEPTH) {
+            return { tokens: current, xargsStdinOpaque: false, encounteredXargs, opaque: true };
+        }
+        peelDepth += 1;
         if (wrapper.kind === 'opaque') {
             return { tokens: current, xargsStdinOpaque: false, encounteredXargs, opaque: true };
         }
@@ -304,39 +309,19 @@ export function extractRecursiveScript(tokens) {
         const body = filtered.slice(1).join(' ').trim();
         return body || null;
     }
-    if (SHELL_INTERPRETERS.has(head) || CODE_INTERPRETERS.has(head)) {
-        const flagIndex = filtered.findIndex((token) => SCRIPT_FLAGS.has(token));
-        if (flagIndex !== -1) {
-            const body = filtered[flagIndex + 1] ?? '';
-            return body || null;
-        }
-    }
-    return null;
+    const invocation = decodeRecursiveInvocation(shellTokensFromValues(filtered, { detectExpansion: false }));
+    return invocation.kind === 'static' ? invocation.script || null : null;
+}
+export function decodeRecursiveInvocationTokens(tokens) {
+    const values = tokens.map((token) => token.value);
+    const { tokens: filtered, opaque } = peelTransparentWrappers(values);
+    if (opaque)
+        return { kind: 'none' };
+    return decodeRecursiveInvocation(tokens.slice(values.length - filtered.length));
 }
 export function extractDockerComposeRunScript(tokens) {
-    const head = normalizeHead(tokens[0] ?? '');
-    const usesCompose = head === 'docker-compose' || (head === 'docker' && (tokens[1] ?? '') === 'compose');
-    if (!usesCompose) {
-        return null;
-    }
-    if (!tokens.includes('run')) {
-        return null;
-    }
-    const runIndex = tokens.indexOf('run');
-    const tail = tokens.slice(runIndex + 1);
-    for (let index = 0; index < tail.length; index += 1) {
-        const shellHead = normalizeHead(tail[index] ?? '');
-        if (!SHELL_INTERPRETERS.has(shellHead)) {
-            continue;
-        }
-        const flag = tail[index + 1] ?? '';
-        if (flag !== '-lc' && flag !== '-c') {
-            continue;
-        }
-        const body = tail[index + 2] ?? '';
-        return body || null;
-    }
-    return null;
+    const invocation = decodeDockerComposeRunValues(tokens);
+    return invocation.kind === 'recursive' ? invocation.script || null : null;
 }
 /**
  * True when a recursive script is evaluated from a command argument rather
@@ -352,8 +337,7 @@ export function isDynamicRecursiveEvaluation(tokens) {
     if (head === 'eval') {
         return true;
     }
-    return ((SHELL_INTERPRETERS.has(head) || CODE_INTERPRETERS.has(head)) &&
-        filtered.some((token) => SCRIPT_FLAGS.has(token)));
+    return decodeRecursiveInvocation(shellTokensFromValues(filtered)).kind !== 'none';
 }
 export function isCommandInspection(tokens) {
     return (normalizeHead(tokens[0] ?? '') === 'command' && peelCommandWrapper(tokens).kind === 'preserve');
@@ -370,8 +354,7 @@ export function isBareInterpreter(tokens) {
     if (!SHELL_INTERPRETERS.has(head) && !CODE_INTERPRETERS.has(head)) {
         return false;
     }
-    const hasScriptFlag = peeled.some((token) => SCRIPT_FLAGS.has(token));
-    if (hasScriptFlag) {
+    if (decodeRecursiveInvocation(shellTokensFromValues(peeled)).kind !== 'none') {
         return false;
     }
     const args = peeled.slice(1);

package/dist/core/verdict/recursive-invocation.d.ts

@@ -0,0 +1,20 @@
+import type { ShellToken } from '../shell-tokenizer.js';
+export type RecursiveInvocation = {
+    kind: 'static';
+    interpreter: string;
+    script: string;
+} | {
+    kind: 'dynamic';
+    interpreter: string;
+    signal: 'shell.script_expanded';
+} | {
+    kind: 'none';
+} | {
+    kind: 'indeterminate';
+    interpreter: string;
+    signal: 'shell.interpreter_argv_incomplete' | 'shell.interpreter_option_unknown';
+};
+export declare function decodeRecursiveInvocation(tokens: readonly ShellToken[]): RecursiveInvocation;
+export declare function shellTokensFromValues(values: readonly string[], options?: {
+    detectExpansion?: boolean;
+}): ShellToken[];

package/dist/core/verdict/recursive-invocation.js

@@ -0,0 +1,224 @@
+import path from 'node:path';
+const SHELL_INTERPRETERS = new Set(['bash', 'sh', 'zsh', 'dash', 'fish']);
+const PYTHON_INTERPRETERS = new Set(['python', 'python3']);
+const SHELL_SHORT_OPTIONS = new Set(['c', 'l', 'e', 'x', 'u']);
+const SHELL_NON_SCRIPT_SHORT_OPTIONS = new Set(['n']);
+const SHELL_TERMINAL_OPTIONS = new Map([
+    ['bash', new Set(['--help', '--version'])],
+    ['zsh', new Set(['--version'])],
+    ['fish', new Set(['-h', '--help', '-v', '--version'])],
+]);
+const SHELL_VALUE_OPTIONS = new Set(['-O', '+O', '--init-file', '--rcfile']);
+const NODE_TERMINAL_OPTIONS = new Set(['-h', '--help', '--help-all', '-v', '--version']);
+const NODE_FILE_OPTIONS = new Set(['-c', '--check']);
+const PYTHON_PROFILE = {
+    scriptOptions: new Set(['-c']),
+    terminalOptions: new Set(['-h', '--help', '-V', '-VV', '--version']),
+    terminalValueOptions: new Set(['-m']),
+    flagOptions: new Set([
+        '-b',
+        '-bb',
+        '-B',
+        '-d',
+        '-E',
+        '-I',
+        '-O',
+        '-OO',
+        '-P',
+        '-q',
+        '-s',
+        '-S',
+        '-u',
+        '-v',
+        '-x',
+    ]),
+    valueOptions: new Set(['-W', '-X']),
+    attachedValuePrefixes: ['-W', '-X'],
+};
+const RUBY_PROFILE = {
+    scriptOptions: new Set(['-e']),
+    terminalOptions: new Set(['-h', '--help', '-v', '--version', '--copyright']),
+    terminalValueOptions: new Set([]),
+    flagOptions: new Set(['-d', '--debug', '-w']),
+    valueOptions: new Set(['-I']),
+    attachedValuePrefixes: ['-I'],
+};
+const PERL_PROFILE = {
+    scriptOptions: new Set(['-e']),
+    terminalOptions: new Set(['-h', '--help', '-v', '--version']),
+    terminalValueOptions: new Set([]),
+    flagOptions: new Set([]),
+    valueOptions: new Set(['-I']),
+    attachedValuePrefixes: ['-I'],
+};
+const OSASCRIPT_PROFILE = {
+    scriptOptions: new Set(['-e']),
+    terminalOptions: new Set(['-h', '--help']),
+    terminalValueOptions: new Set([]),
+    flagOptions: new Set([]),
+    valueOptions: new Set(['-l']),
+    attachedValuePrefixes: [],
+};
+function normalizeInterpreter(value) {
+    return path.basename(value);
+}
+function scriptResult(interpreter, token) {
+    if (!token) {
+        return { kind: 'indeterminate', interpreter, signal: 'shell.interpreter_argv_incomplete' };
+    }
+    if (token.parts.some((part) => part.hasExpansion)) {
+        return { kind: 'dynamic', interpreter, signal: 'shell.script_expanded' };
+    }
+    return { kind: 'static', interpreter, script: token.value };
+}
+function decodeShell(words, interpreter) {
+    for (let index = 1; index < words.length; index += 1) {
+        const option = words[index]?.value ?? '';
+        if (option === '--')
+            return { kind: 'none' };
+        if (SHELL_TERMINAL_OPTIONS.get(interpreter)?.has(option))
+            return { kind: 'none' };
+        if (interpreter === 'bash' && SHELL_VALUE_OPTIONS.has(option)) {
+            const operand = words[index + 1]?.value;
+            if (!operand || operand.startsWith('-')) {
+                return { kind: 'indeterminate', interpreter, signal: 'shell.interpreter_option_unknown' };
+            }
+            index += 1;
+            continue;
+        }
+        if (!option.startsWith('-') || option === '-')
+            return { kind: 'none' };
+        const flags = [...option.slice(1)];
+        if (flags.length === 0) {
+            return { kind: 'indeterminate', interpreter, signal: 'shell.interpreter_option_unknown' };
+        }
+        if (flags.every((flag) => SHELL_SHORT_OPTIONS.has(flag))) {
+            if (!flags.includes('c'))
+                continue;
+            return scriptResult(interpreter, words[index + 1]);
+        }
+        if (flags.every((flag) => SHELL_SHORT_OPTIONS.has(flag) || SHELL_NON_SCRIPT_SHORT_OPTIONS.has(flag)) &&
+            flags.some((flag) => SHELL_NON_SCRIPT_SHORT_OPTIONS.has(flag))) {
+            return { kind: 'none' };
+        }
+        return { kind: 'indeterminate', interpreter, signal: 'shell.interpreter_option_unknown' };
+    }
+    return { kind: 'none' };
+}
+function decodeSeparated(words, interpreter, profile) {
+    for (let index = 1; index < words.length; index += 1) {
+        const option = words[index]?.value ?? '';
+        if (option === '--' || !option.startsWith('-') || option === '-')
+            return { kind: 'none' };
+        if (profile.scriptOptions.has(option)) {
+            return scriptResult(interpreter, words[index + 1]);
+        }
+        if (profile.terminalOptions.has(option))
+            return { kind: 'none' };
+        if (profile.terminalValueOptions.has(option)) {
+            const operand = words[index + 1]?.value;
+            if (!operand || operand.startsWith('-')) {
+                return { kind: 'indeterminate', interpreter, signal: 'shell.interpreter_option_unknown' };
+            }
+            return { kind: 'none' };
+        }
+        if (profile.flagOptions.has(option)) {
+            continue;
+        }
+        if (profile.valueOptions.has(option)) {
+            const operand = words[index + 1]?.value;
+            if (!operand || operand.startsWith('-')) {
+                return { kind: 'indeterminate', interpreter, signal: 'shell.interpreter_option_unknown' };
+            }
+            index += 1;
+            continue;
+        }
+        if (profile.attachedValuePrefixes.some((prefix) => option.startsWith(prefix) && option.length > prefix.length)) {
+            continue;
+        }
+        return { kind: 'indeterminate', interpreter, signal: 'shell.interpreter_option_unknown' };
+    }
+    return { kind: 'none' };
+}
+function decodeNode(words, interpreter) {
+    const option = words[1]?.value ?? '';
+    if (option === '--' || !option.startsWith('-') || option === '-')
+        return { kind: 'none' };
+    if (option === '-e' || option === '--eval') {
+        return scriptResult(interpreter, words[2]);
+    }
+    if (option.startsWith('--eval=')) {
+        const script = option.slice('--eval='.length);
+        if (words[1]?.parts.some((part) => part.hasExpansion)) {
+            return { kind: 'dynamic', interpreter, signal: 'shell.script_expanded' };
+        }
+        return { kind: 'static', interpreter, script };
+    }
+    if (NODE_TERMINAL_OPTIONS.has(option))
+        return { kind: 'none' };
+    if (NODE_FILE_OPTIONS.has(option))
+        return { kind: 'none' };
+    return { kind: 'indeterminate', interpreter, signal: 'shell.interpreter_option_unknown' };
+}
+function decodeEval(words) {
+    const arguments_ = words.slice(1);
+    if (arguments_.length === 0)
+        return { kind: 'none' };
+    if (arguments_.some((word) => word.parts.some((part) => part.hasExpansion))) {
+        return { kind: 'dynamic', interpreter: 'eval', signal: 'shell.script_expanded' };
+    }
+    return {
+        kind: 'static',
+        interpreter: 'eval',
+        script: arguments_.map((word) => word.value).join(' '),
+    };
+}
+export function decodeRecursiveInvocation(tokens) {
+    if (tokens.some((token) => token.kind === 'operator'))
+        return { kind: 'none' };
+    const words = tokens.filter((token) => token.kind === 'word');
+    const interpreter = normalizeInterpreter(words[0]?.value ?? '');
+    if (!interpreter)
+        return { kind: 'none' };
+    if (interpreter === 'eval')
+        return decodeEval(words);
+    if (SHELL_INTERPRETERS.has(interpreter))
+        return decodeShell(words, interpreter);
+    if (PYTHON_INTERPRETERS.has(interpreter)) {
+        return decodeSeparated(words, interpreter, PYTHON_PROFILE);
+    }
+    if (interpreter === 'node')
+        return decodeNode(words, interpreter);
+    if (interpreter === 'ruby')
+        return decodeSeparated(words, interpreter, RUBY_PROFILE);
+    if (interpreter === 'perl')
+        return decodeSeparated(words, interpreter, PERL_PROFILE);
+    if (interpreter === 'osascript')
+        return decodeSeparated(words, interpreter, OSASCRIPT_PROFILE);
+    return { kind: 'none' };
+}
+export function shellTokensFromValues(values, options = {}) {
+    let offset = 0;
+    return values.map((value) => {
+        const start = offset;
+        const end = start + value.length;
+        offset = end + 1;
+        return {
+            kind: 'word',
+            value,
+            raw: value,
+            start,
+            end,
+            parts: [
+                {
+                    value,
+                    raw: value,
+                    start,
+                    end,
+                    quote: 'unquoted',
+                    hasExpansion: options.detectExpansion !== false && (value.includes('$') || value.includes('`')),
+                },
+            ],
+        };
+    });
+}

package/dist/defaults.js

@@ -123,6 +123,13 @@ export function getManagedHookEntries(platform = process.platform, hooksDir, rep
                 placement: 'append',
             },
         },
+        {
+            event: 'postToolUseFailure',
+            definition: {
+                command: runnerCommand(platform, resolvedHooksDir, resolvedRepo, 'belay-audit', 'postToolUseFailure'),
+                placement: 'append',
+            },
+        },
         {
             event: 'stop',
             definition: {

package/dist/installer/scope-config.d.ts

@@ -1,8 +1,8 @@
 import { type ScopedPaths } from '../adapters/layouts/scope.js';
 import type { AdapterName } from '../adapters/layouts/types.js';
 import type { BelayConfigV4 } from '../core/config.js';
-import type { InitOptions, UpgradeOptions } from '../types.js';
+import type { InitOptions, UninstallOptions, UpgradeOptions } from '../types.js';
 export type OperationScope = 'project' | 'global';
-export declare function resolveOperationScope(repoRoot: string, adapter: AdapterName, options?: InitOptions | UpgradeOptions): Promise<OperationScope>;
+export declare function resolveOperationScope(repoRoot: string, adapter: AdapterName, options?: InitOptions | UpgradeOptions | UninstallOptions): Promise<OperationScope>;
 export declare function applyInstallScope(repoRoot: string, adapter: AdapterName, scope: OperationScope, config?: BelayConfigV4): Promise<BelayConfigV4>;
 export declare function pathsForOperation(adapter: AdapterName, scope: OperationScope, repoRoot: string): ScopedPaths;

package/dist/installer.d.ts

@@ -1,5 +1,5 @@
 import type { AdapterName } from './adapters/layouts/types.js';
-import type { HooksFile, InitOptions, UpgradeOptions } from './types.js';
+import type { HooksFile, InitOptions, UninstallOptions, UpgradeOptions } from './types.js';
 export type { InstallScope } from './adapters/layouts/scope.js';
 export declare function loadHooksFile(hooksPath: string): Promise<HooksFile>;
 export declare function mergeHooksFile(current: HooksFile, platform?: NodeJS.Platform, hooksDir?: string, repoRoot?: string): HooksFile;
@@ -10,6 +10,10 @@ export declare function initCursorProject(options?: InitOptions): Promise<{
 export declare function upgradeCursorProject(options?: UpgradeOptions): Promise<{
     repoRoot: string;
 }>;
+export declare function uninstallCursorProject(options?: UninstallOptions): Promise<{
+    repoRoot: string;
+    scope: 'project' | 'global';
+}>;
 export declare function initProject(options?: InitOptions): Promise<{
     repoRoot: string;
     withSkill: boolean;
@@ -20,3 +24,8 @@ export declare function upgradeProject(options?: UpgradeOptions): Promise<{
     repoRoot: string;
     adapter: AdapterName;
 }>;
+export declare function uninstallProject(options?: UninstallOptions): Promise<{
+    repoRoot: string;
+    adapter: AdapterName;
+    scope: 'project' | 'global';
+}>;

package/dist/installer.js

@@ -1,7 +1,7 @@
 import { existsSync } from 'node:fs';
-import { mkdir, readFile, writeFile } from 'node:fs/promises';
+import { mkdir, readFile, rm, writeFile } from 'node:fs/promises';
 import path from 'node:path';
-import { mergeCursorHooksFile } from './adapters/cursor/hooks.js';
+import { mergeCursorHooksFile, stripCursorHooksFile } from './adapters/cursor/hooks.js';
 import { cursorLayout } from './adapters/layouts/cursor.js';
 import { resolveScopedPaths } from './adapters/layouts/scope.js';
 import { getAdapter } from './adapters/registry.js';
@@ -94,6 +94,38 @@ export async function upgradeCursorProject(options = {}) {
     await archiveLegacyAuditLogIfNeeded(repoRoot, config);
     return { repoRoot };
 }
+const BELAY_HOOK_ARTIFACTS = [
+    'belay-before-submit.mjs',
+    'belay-shell-gate.mjs',
+    'belay-tool-gate.mjs',
+    'belay-audit.mjs',
+    'belay-runner',
+    'belay-runner.cmd',
+];
+async function removeBelayHookArtifacts(paths) {
+    for (const fileName of BELAY_HOOK_ARTIFACTS) {
+        await rm(path.join(paths.hooksDir, fileName), { force: true });
+    }
+    await rm(paths.runtimeDir, { recursive: true, force: true });
+    await rm(paths.skillsDir, { recursive: true, force: true });
+    if (paths.commandsDir) {
+        await rm(path.join(paths.commandsDir, 'belay.md'), { force: true });
+    }
+}
+export async function uninstallCursorProject(options = {}) {
+    const repoRoot = path.resolve(options.targetDir ?? process.cwd());
+    const scope = await resolveOperationScope(repoRoot, 'cursor', options);
+    const paths = resolveScopedPaths(cursorLayout, scope, repoRoot);
+    const hooksSettingsExisted = existsSync(paths.hooksSettingsPath);
+    const hooksFile = await loadHooksFile(paths.hooksSettingsPath);
+    const stripped = stripCursorHooksFile(hooksFile, process.platform, paths.hooksDir, repoRoot);
+    if (hooksSettingsExisted) {
+        await mkdir(path.dirname(paths.hooksSettingsPath), { recursive: true });
+        await writeFile(paths.hooksSettingsPath, `${JSON.stringify(stripped, null, 2)}\n`, 'utf8');
+    }
+    await removeBelayHookArtifacts(paths);
+    return { repoRoot, scope };
+}
 function resolveAdapterName(options, repoRoot) {
     if (options.adapter === 'claude') {
         return 'claude';
@@ -225,3 +257,12 @@ export async function upgradeProject(options = {}) {
     await refreshIntegrityManifest(repoRoot, adapterName);
     return { repoRoot, adapter: adapterName };
 }
+export async function uninstallProject(options = {}) {
+    const repoRoot = path.resolve(options.targetDir ?? process.cwd());
+    const adapterName = resolveAdapterName(options, repoRoot);
+    if (adapterName !== 'cursor') {
+        throw new Error(`belay uninstall is only supported for Cursor adapter today. Use --adapter cursor or uninstall hooks manually for ${adapterName}.`);
+    }
+    const result = await uninstallCursorProject({ ...options, targetDir: repoRoot });
+    return { repoRoot: result.repoRoot, adapter: adapterName, scope: result.scope };
+}

package/dist/types.d.ts

@@ -1,7 +1,7 @@
 export type { BelayConfig, BelayConfigV1, BelayConfigV2, BelayConfigV3, BelayControlPlaneConfig, BelayEgressConfig, BelayOverridesConfig, BelayPolicyConfig, BelayRedactionConfig, BelaySandboxConfig, BelayTransactionalConfig, UnknownLocalEffectPolicy, } from './core/config.js';
 export type { ApprovalRecord, ApprovalStateFile, Assessment, BelayMode, ClassifyResult, HookVerdict, } from './core/types.js';
 import type { InstallScope } from './adapters/layouts/scope.js';
-import type { RecentAskEntry } from './core/audit-summary.js';
+import type { RecentAskEntry, RecentHostDenialEntry } from './core/audit-summary.js';
 import type { BelayEgressConfig, BelayOverridesConfig, BelayPolicyConfig, BelaySandboxConfig } from './core/config.js';
 import type { ApprovalRecord, ClassifyResult } from './core/types.js';
 export interface HookEntry {
@@ -42,6 +42,32 @@ export interface UpgradeOptions {
     /** Opt-in: migrate implicit factory-default ollama judge to host default provider. */
     migrateJudgeDefault?: boolean;
 }
+export interface UninstallOptions {
+    targetDir?: string;
+    adapter?: AdapterName;
+    scope?: InstallScope;
+}
+export interface WhereOptions {
+    targetDir?: string;
+    adapter?: AdapterName;
+    scope?: InstallScope;
+    json?: boolean;
+}
+export interface WhereReport {
+    cwd: string;
+    repoRoot: string;
+    adapter: AdapterName;
+    installScope: 'project' | 'global';
+    configPresent: boolean;
+    cliExecutable?: string;
+    cliPackageRoot: string;
+    configPath: string;
+    hooksSettingsPath: string;
+    hooksDir: string;
+    runtimeDir: string;
+    skillsDir: string;
+    commandsDir?: string;
+}
 export interface DoctorOptions {
     targetDir?: string;
     fix?: boolean;
@@ -88,6 +114,10 @@ export interface StatusOptions {
 export interface HealthSnapshotOptions {
     targetDir?: string;
     adapter?: AdapterName;
+    /** Override the host home directory when inspecting adapter-level execution settings. */
+    homeDir?: string;
+    /** Override Cursor config-path environment variables for deterministic host inspection. */
+    cursorConfigEnv?: Partial<Pick<NodeJS.ProcessEnv, 'CURSOR_CONFIG_DIR' | 'XDG_CONFIG_HOME'>>;
 }
 export interface HealthSnapshot {
     repoRoot: string;
@@ -172,6 +202,9 @@ export interface AuditVisibilityReport {
     allowCount: number;
     silentPassRate: number;
     recentAsks: RecentAskEntry[];
+    hostDeniedAfterAllowCount?: number;
+    recentHostDenials?: RecentHostDenialEntry[];
+    unrecognizedHostFailureCount?: number;
     warnings: string[];
     notes: string[];
 }

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const PACKAGE_VERSION = "0.9.2";
+export declare const PACKAGE_VERSION = "0.9.3";