@guilz-dev/belay 0.9.2 → 0.9.4

package/dist/core/glob.js

@@ -1,26 +1,42 @@
+import { escapeRegex } from './approval.js';
+function globPatternToRegexSource(pattern) {
+    let result = '';
+    let index = 0;
+    while (index < pattern.length) {
+        const char = pattern[index];
+        if (char === '*' && pattern[index + 1] === '*') {
+            index += 2;
+            if (pattern[index] === '/') {
+                result += '(?:.*/)?';
+                index += 1;
+            }
+            else {
+                result += '.*';
+            }
+            continue;
+        }
+        if (char === '*') {
+            result += '[^/]*';
+            index += 1;
+            continue;
+        }
+        result += escapeRegex(char);
+        index += 1;
+    }
+    return result;
+}
+function globPatternMatches(pattern, normalized, baseName) {
+    const regex = new RegExp(`^${globPatternToRegexSource(pattern)}$`);
+    return regex.test(normalized) || regex.test(baseName);
+}
 export function matchesSensitivePath(filePath, patterns) {
     const normalized = filePath.replaceAll('\\', '/');
     const segments = normalized.split('/');
     const baseName = segments.at(-1) ?? normalized;
     for (const pattern of patterns) {
         const normalizedPattern = pattern.replaceAll('\\', '/');
-        if (normalizedPattern.includes('**')) {
-            const parts = normalizedPattern.split('**').map((part) => part.replace(/^\/+|\/+$/g, ''));
-            const prefix = parts[0]?.replace(/\/+$/, '') ?? '';
-            const suffix = parts[1]?.replace(/^\/+/, '') ?? '';
-            if (prefix && !normalized.startsWith(prefix)) {
-                continue;
-            }
-            if (suffix && !normalized.includes(suffix)) {
-                continue;
-            }
-            if (prefix || suffix) {
-                return true;
-            }
-        }
         if (normalizedPattern.includes('*')) {
-            const regex = new RegExp(`^${normalizedPattern.replaceAll('.', '\\.').replaceAll('*', '.*')}$`);
-            if (regex.test(normalized) || regex.test(baseName)) {
+            if (globPatternMatches(normalizedPattern, normalized, baseName)) {
                 return true;
             }
             continue;

package/dist/core/integrity.d.ts

@@ -8,9 +8,9 @@ export interface IntegrityManifest {
 }
 export declare function sha256File(filePath: string): Promise<string>;
 export declare function integrityManifestPath(layout: AdapterLayout, repoRoot: string): string;
-export declare function runtimeIntegrityFiles(_layout: AdapterLayout, paths: ScopedPaths): string[];
+export declare function runtimeIntegrityFiles(layout: AdapterLayout, paths: ScopedPaths): string[];
 export declare function writeIntegrityManifest(repoRoot: string, layout: AdapterLayout, filePaths: string[]): Promise<void>;
-export declare function verifyIntegrityManifest(repoRoot: string, layout: AdapterLayout): Promise<{
+export declare function verifyIntegrityManifest(repoRoot: string, layout: AdapterLayout, requiredFilePaths?: string[]): Promise<{
     ok: boolean;
     mismatches: string[];
 }>;

package/dist/core/integrity.js

@@ -3,8 +3,24 @@ import { existsSync } from 'node:fs';
 import { mkdir, readFile, writeFile } from 'node:fs/promises';
 import path from 'node:path';
 import { getAdapterLayout } from '../adapters/layouts/index.js';
-import { resolveScopedPaths } from '../adapters/layouts/scope.js';
+import { isPathInside, resolveScopedPaths } from '../adapters/layouts/scope.js';
 import { resolveAdapterName } from '../config-io.js';
+const GLOBAL_INTEGRITY_PREFIX = '@global/';
+function portableRelativePath(from, to) {
+    return path.relative(from, to).split(path.sep).join('/');
+}
+function integrityManifestFileKey(repoRoot, layout, filePath) {
+    const absolutePath = path.resolve(filePath);
+    if (isPathInside(absolutePath, repoRoot)) {
+        return portableRelativePath(repoRoot, absolutePath);
+    }
+    const globalPaths = resolveScopedPaths(layout, 'global', repoRoot);
+    const globalAgentDir = path.dirname(globalPaths.hooksSettingsPath);
+    if (isPathInside(absolutePath, globalAgentDir)) {
+        return `${GLOBAL_INTEGRITY_PREFIX}${portableRelativePath(globalAgentDir, absolutePath)}`;
+    }
+    throw new Error(`Integrity file is outside the repository and global adapter root: ${filePath}`);
+}
 export async function sha256File(filePath) {
     const content = await readFile(filePath);
     return createHash('sha256').update(content).digest('hex');
@@ -12,11 +28,8 @@ export async function sha256File(filePath) {
 export function integrityManifestPath(layout, repoRoot) {
     return path.join(layout.repoLocalStateDir(repoRoot), 'integrity-manifest.json');
 }
-export function runtimeIntegrityFiles(_layout, paths) {
+export function runtimeIntegrityFiles(layout, paths) {
     const files = [paths.configPath];
-    if (paths.scope !== 'project') {
-        return files;
-    }
     const hooksDir = paths.hooksDir;
     const runtimeDir = paths.runtimeDir;
     return [
@@ -28,7 +41,9 @@ export function runtimeIntegrityFiles(_layout, paths) {
         path.join(hooksDir, 'belay-audit.mjs'),
         path.join(hooksDir, 'belay-runner'),
         path.join(hooksDir, 'belay-runner.cmd'),
+        ...(layout.name === 'cursor' ? [path.join(hooksDir, 'belay-runner.ps1')] : []),
         path.join(runtimeDir, 'core.mjs'),
+        ...(layout.name === 'cursor' ? [path.join(runtimeDir, 'dispatcher.mjs')] : []),
     ];
 }
 export async function writeIntegrityManifest(repoRoot, layout, filePaths) {
@@ -37,8 +52,8 @@ export async function writeIntegrityManifest(repoRoot, layout, filePaths) {
         if (!existsSync(filePath)) {
             continue;
         }
-        const relativePath = path.relative(repoRoot, filePath);
-        files[relativePath] = await sha256File(filePath);
+        const manifestKey = integrityManifestFileKey(repoRoot, layout, filePath);
+        files[manifestKey] = await sha256File(filePath);
     }
     const manifest = {
         version: 1,
@@ -49,22 +64,47 @@ export async function writeIntegrityManifest(repoRoot, layout, filePaths) {
     await mkdir(path.dirname(manifestPath), { recursive: true });
     await writeFile(manifestPath, `${JSON.stringify(manifest, null, 2)}\n`, 'utf8');
 }
-export async function verifyIntegrityManifest(repoRoot, layout) {
+export async function verifyIntegrityManifest(repoRoot, layout, requiredFilePaths = []) {
     const manifestPath = integrityManifestPath(layout, repoRoot);
     if (!existsSync(manifestPath)) {
         return { ok: false, mismatches: ['missing integrity-manifest.json'] };
     }
     const manifest = JSON.parse(await readFile(manifestPath, 'utf8'));
     const mismatches = [];
-    for (const [relativePath, expectedHash] of Object.entries(manifest.files ?? {})) {
-        const absolutePath = path.join(repoRoot, relativePath);
+    const requiredPathsByKey = new Map(requiredFilePaths.map((requiredPath) => [
+        integrityManifestFileKey(repoRoot, layout, requiredPath),
+        path.resolve(requiredPath),
+    ]));
+    for (const requiredPath of requiredFilePaths) {
+        const requiredKey = integrityManifestFileKey(repoRoot, layout, requiredPath);
+        if (!Object.hasOwn(manifest.files ?? {}, requiredKey)) {
+            mismatches.push(`missing integrity pin ${requiredKey}`);
+        }
+    }
+    for (const [manifestKey, expectedHash] of Object.entries(manifest.files ?? {})) {
+        let absolutePath;
+        if (manifestKey.startsWith(GLOBAL_INTEGRITY_PREFIX)) {
+            const requiredPath = requiredPathsByKey.get(manifestKey);
+            if (!requiredPath) {
+                mismatches.push(`unrecognized global integrity pin ${manifestKey}`);
+                continue;
+            }
+            absolutePath = requiredPath;
+        }
+        else {
+            absolutePath = path.resolve(repoRoot, manifestKey);
+            if (!isPathInside(absolutePath, repoRoot)) {
+                mismatches.push(`integrity pin escapes repository ${manifestKey}`);
+                continue;
+            }
+        }
         if (!existsSync(absolutePath)) {
-            mismatches.push(`missing ${relativePath}`);
+            mismatches.push(`missing ${manifestKey}`);
             continue;
         }
         const actualHash = await sha256File(absolutePath);
         if (actualHash !== expectedHash) {
-            mismatches.push(`hash mismatch ${relativePath}`);
+            mismatches.push(`hash mismatch ${manifestKey}`);
         }
     }
     return { ok: mismatches.length === 0, mismatches };

package/dist/core/replay-scrub.d.ts

@@ -1,7 +1,10 @@
 import type { GatedActionKind } from './gate-contract.js';
 import type { ScrubOptions } from './types.js';
+export declare function redactToolInvocationId(value: unknown, rawToolUseId?: string): unknown;
 /** Subagent fingerprint input — must match classify-subagent `fingerprintSource`. */
 export declare function subagentFingerprintSource(payload: Record<string, unknown>, scrubOptions: ScrubOptions): unknown;
+/** Stable tool-input source for fingerprints — redacts volatile ids only, not secret values. */
+export declare function fingerprintToolInputSource(payload: Record<string, unknown>): Record<string, unknown>;
 /**
  * Scrubbed payload used for replay envelope hashing — aligned with classifier fingerprints.
  * Tool: scrubbed `tool_input`. Subagent: description/prompt subset. Other: full payload.

package/dist/core/replay-scrub.js

@@ -1,4 +1,22 @@
 import { scrubValue } from './scrub.js';
+export function redactToolInvocationId(value, rawToolUseId) {
+    if (typeof value === 'string') {
+        return rawToolUseId ? value.replaceAll(rawToolUseId, '<tool-use-id>') : value;
+    }
+    if (Array.isArray(value)) {
+        return value.map((item) => redactToolInvocationId(item, rawToolUseId));
+    }
+    if (value && typeof value === 'object') {
+        const result = {};
+        for (const [key, child] of Object.entries(value)) {
+            if (key !== 'tool_use_id') {
+                result[key] = redactToolInvocationId(child, rawToolUseId);
+            }
+        }
+        return result;
+    }
+    return value;
+}
 /** Subagent fingerprint input — must match classify-subagent `fingerprintSource`. */
 export function subagentFingerprintSource(payload, scrubOptions) {
     const toolInput = payload.tool_input;
@@ -22,6 +40,14 @@ export function subagentFingerprintSource(payload, scrubOptions) {
     }
     return scrubValue(payload, scrubOptions);
 }
+/** Stable tool-input source for fingerprints — redacts volatile ids only, not secret values. */
+export function fingerprintToolInputSource(payload) {
+    const toolInput = payload.tool_input;
+    if (!toolInput || typeof toolInput !== 'object') {
+        return {};
+    }
+    return redactToolInvocationId(toolInput, typeof payload.tool_use_id === 'string' ? payload.tool_use_id : undefined);
+}
 /**
  * Scrubbed payload used for replay envelope hashing — aligned with classifier fingerprints.
  * Tool: scrubbed `tool_input`. Subagent: description/prompt subset. Other: full payload.
@@ -30,14 +56,15 @@ export function fingerprintReplayPayload(kind, payload, scrubOptions) {
     if (!payload) {
         return undefined;
     }
+    const replayPayload = redactToolInvocationId(payload, typeof payload.tool_use_id === 'string' ? payload.tool_use_id : undefined);
     if (kind === 'tool') {
-        const toolInput = payload.tool_input;
+        const toolInput = replayPayload.tool_input;
         if (toolInput && typeof toolInput === 'object') {
             return scrubValue(toolInput, scrubOptions);
         }
     }
     if (kind === 'subagent') {
-        return subagentFingerprintSource(payload, scrubOptions);
+        return subagentFingerprintSource(replayPayload, scrubOptions);
     }
-    return scrubValue(payload, scrubOptions);
+    return scrubValue(replayPayload, scrubOptions);
 }

package/dist/core/shell-substitution.js

@@ -16,7 +16,7 @@ export function findCommandSubstitutions(command) {
             index += 1;
             continue;
         }
-        if (char === '\\' && (inSingle || inDouble)) {
+        if (char === '\\' && inDouble) {
             escaping = true;
             index += 1;
             continue;
@@ -156,7 +156,7 @@ function extractBalancedParenContent(command, start) {
             index += 1;
             continue;
         }
-        if (char === '\\' && (inSingle || inDouble)) {
+        if (char === '\\' && inDouble) {
             escaping = true;
             index += 1;
             continue;

package/dist/core/shell-tokenizer.d.ts

@@ -1,5 +1,33 @@
 export declare function isRedirectOperator(token: string): boolean;
 export declare function isFdDuplication(token: string): boolean;
+export type ShellQuoteMode = 'unquoted' | 'single' | 'double';
+export interface ShellWordPart {
+    value: string;
+    raw: string;
+    start: number;
+    end: number;
+    quote: ShellQuoteMode;
+    hasExpansion: boolean;
+}
+export type ShellToken = {
+    kind: 'word';
+    value: string;
+    raw: string;
+    start: number;
+    end: number;
+    parts: ShellWordPart[];
+} | {
+    kind: 'operator';
+    value: string;
+    raw: string;
+    start: number;
+    end: number;
+};
+export interface ShellLexResult {
+    tokens: ShellToken[];
+    complete: boolean;
+}
+export declare function lexShell(input: string): ShellLexResult;
 export declare function tokenizeShell(input: string): string[];
 export declare function normalizeShellCommand(command: string, repoRoot: string, normalizeToken: (t: string, r: string) => string): string;
 export declare function splitTopLevelSegments(tokens: string[]): string[][];

package/dist/core/shell-tokenizer.js

@@ -67,61 +67,143 @@ export function isRedirectOperator(token) {
 export function isFdDuplication(token) {
     return FD_DUPLICATION_PATTERN.test(token);
 }
-export function tokenizeShell(input) {
+export function lexShell(input) {
     const tokens = [];
-    let buffer = '';
+    let value = '';
+    let wordStart = null;
+    let parts = [];
     let quote = null;
-    let escaping = false;
-    const flush = () => {
-        if (buffer.length > 0) {
-            tokens.push(buffer);
-            buffer = '';
+    let quoteStart = -1;
+    let quoteHadContent = false;
+    let complete = true;
+    const startWord = (index) => {
+        wordStart ??= index;
+    };
+    const append = (decoded, start, end, mode, hasExpansion) => {
+        startWord(start);
+        value += decoded;
+        const previous = parts.at(-1);
+        if (previous &&
+            previous.quote === mode &&
+            previous.hasExpansion === hasExpansion &&
+            previous.end === start) {
+            previous.value += decoded;
+            previous.raw += input.slice(start, end);
+            previous.end = end;
+            return;
         }
+        parts.push({
+            value: decoded,
+            raw: input.slice(start, end),
+            start,
+            end,
+            quote: mode,
+            hasExpansion,
+        });
+    };
+    const flushWord = (end) => {
+        if (wordStart === null)
+            return;
+        tokens.push({
+            kind: 'word',
+            value,
+            raw: input.slice(wordStart, end),
+            start: wordStart,
+            end,
+            parts,
+        });
+        value = '';
+        wordStart = null;
+        parts = [];
+    };
+    const pushOperator = (token, start, end) => {
+        tokens.push({ kind: 'operator', value: token, raw: input.slice(start, end), start, end });
     };
     for (let index = 0; index < input.length; index += 1) {
-        const char = input[index];
-        if (escaping) {
-            buffer += char;
-            escaping = false;
-            continue;
-        }
-        if (char === '\\') {
-            escaping = true;
+        const char = input[index] ?? '';
+        if (quote === 'single') {
+            if (char === "'") {
+                if (!quoteHadContent)
+                    append('', quoteStart, index + 1, 'single', false);
+                quote = null;
+            }
+            else {
+                append(char, index, index + 1, 'single', false);
+                quoteHadContent = true;
+            }
             continue;
         }
-        if (quote) {
-            if (char === quote) {
+        if (quote === 'double') {
+            if (char === '"') {
+                if (!quoteHadContent)
+                    append('', quoteStart, index + 1, 'double', false);
                 quote = null;
+                continue;
             }
-            else {
-                buffer += char;
+            if (char === '\\') {
+                const next = input[index + 1];
+                if (next === undefined) {
+                    append('\\', index, index + 1, 'double', false);
+                    complete = false;
+                    continue;
+                }
+                if (next === '$' || next === '`' || next === '"' || next === '\\' || next === '\n') {
+                    append(next === '\n' ? '' : next, index, index + 2, 'double', false);
+                    quoteHadContent = true;
+                    index += 1;
+                    continue;
+                }
+                append('\\', index, index + 1, 'double', false);
+                quoteHadContent = true;
+                continue;
             }
+            append(char, index, index + 1, 'double', char === '$' || char === '`');
+            quoteHadContent = true;
             continue;
         }
-        if (char === '"' || char === "'") {
-            quote = char;
+        if (char === "'" || char === '"') {
+            startWord(index);
+            quote = char === "'" ? 'single' : 'double';
+            quoteStart = index;
+            quoteHadContent = false;
+            continue;
+        }
+        if (char === '\\') {
+            const next = input[index + 1];
+            if (next === undefined) {
+                append('\\', index, index + 1, 'unquoted', false);
+                complete = false;
+                continue;
+            }
+            append(next, index, index + 2, 'unquoted', false);
+            index += 1;
             continue;
         }
         const operator = readShellOperator(input, index);
         if (operator) {
-            flush();
-            tokens.push(operator.token);
+            flushWord(index);
+            pushOperator(operator.token, index, index + operator.length);
             index += operator.length - 1;
             continue;
         }
         if (char === '\n' || char === '\r') {
-            flush();
-            tokens.push(';');
+            flushWord(index);
+            pushOperator(';', index, index + 1);
             continue;
         }
         if (/\s/.test(char)) {
-            flush();
+            flushWord(index);
             continue;
         }
-        buffer += char;
+        append(char, index, index + 1, 'unquoted', char === '$' || char === '`');
     }
-    flush();
-    return tokens;
+    if (quote !== null)
+        complete = false;
+    flushWord(input.length);
+    return { tokens, complete };
+}
+export function tokenizeShell(input) {
+    return lexShell(input).tokens.map((token) => token.value);
 }
 export function normalizeShellCommand(command, repoRoot, normalizeToken) {
     const tokens = tokenizeShell(command);

package/dist/core/shell-unparseable.js

@@ -42,7 +42,9 @@ function hasUnclosedQuote(command) {
             continue;
         }
         if (char === '\\') {
-            escaping = true;
+            if (quote !== "'") {
+                escaping = true;
+            }
             continue;
         }
         if (quote) {

package/dist/core/verdict/docker-compose-run.d.ts

@@ -0,0 +1,18 @@
+import type { ShellToken } from '../shell-tokenizer.js';
+export type DockerComposeRunInvocation = {
+    kind: 'recursive';
+    service: string;
+    interpreter: string;
+    script: string;
+} | {
+    kind: 'dynamic';
+    service: string;
+    signal: string;
+} | {
+    kind: 'none';
+} | {
+    kind: 'indeterminate';
+    signal: 'shell.compose_argv_indeterminate';
+};
+export declare function decodeDockerComposeRun(tokens: readonly ShellToken[]): DockerComposeRunInvocation;
+export declare function decodeDockerComposeRunValues(values: readonly string[]): DockerComposeRunInvocation;

package/dist/core/verdict/docker-compose-run.js

@@ -0,0 +1,136 @@
+import path from 'node:path';
+import { decodeRecursiveInvocation, shellTokensFromValues } from './recursive-invocation.js';
+const COMPOSE_GLOBAL_OPTIONS = new Map([
+    ['--all-resources', 0],
+    ['--ansi', 1],
+    ['--compatibility', 0],
+    ['--dry-run', 0],
+    ['--env-file', 1],
+    ['-f', 1],
+    ['--file', 1],
+    ['--parallel', 1],
+    ['--profile', 1],
+    ['--progress', 1],
+    ['--project-directory', 1],
+    ['-p', 1],
+    ['--project-name', 1],
+]);
+const COMPOSE_RUN_OPTIONS = new Map([
+    ['--build', 0],
+    ['--cap-add', 1],
+    ['--cap-drop', 1],
+    ['-d', 0],
+    ['--detach', 0],
+    ['--entrypoint', 1],
+    ['-e', 1],
+    ['--env', 1],
+    ['--env-from-file', 1],
+    ['-i', 0],
+    ['--interactive', 0],
+    ['-l', 1],
+    ['--label', 1],
+    ['--name', 1],
+    ['--no-deps', 0],
+    ['-T', 0],
+    ['--no-tty', 0],
+    ['-p', 1],
+    ['--publish', 1],
+    ['--pull', 1],
+    ['-q', 0],
+    ['--quiet', 0],
+    ['--quiet-build', 0],
+    ['--quiet-pull', 0],
+    ['--remove-orphans', 0],
+    ['--rm', 0],
+    ['-P', 0],
+    ['--service-ports', 0],
+    ['--use-aliases', 0],
+    ['-u', 1],
+    ['--user', 1],
+    ['-v', 1],
+    ['--volume', 1],
+    ['-w', 1],
+    ['--workdir', 1],
+]);
+function parseOptions(words, start, options) {
+    let index = start;
+    while (index < words.length) {
+        const value = words[index]?.value ?? '';
+        if (value === '--')
+            return { kind: 'ok', index: index + 1 };
+        if (!value.startsWith('-') || value === '-')
+            return { kind: 'ok', index };
+        const equalsIndex = value.indexOf('=');
+        const name = equalsIndex === -1 ? value : value.slice(0, equalsIndex);
+        const arity = options.get(name);
+        if (arity === undefined)
+            return { kind: 'indeterminate' };
+        if (equalsIndex !== -1) {
+            if (!value.startsWith('--') || arity !== 1 || equalsIndex === value.length - 1) {
+                return { kind: 'indeterminate' };
+            }
+            index += 1;
+            continue;
+        }
+        if (arity === 1) {
+            if (!words[index + 1])
+                return { kind: 'indeterminate' };
+            index += 2;
+            continue;
+        }
+        index += 1;
+    }
+    return { kind: 'ok', index };
+}
+export function decodeDockerComposeRun(tokens) {
+    if (tokens.some((token) => token.kind === 'operator'))
+        return { kind: 'none' };
+    const words = tokens.filter((token) => token.kind === 'word');
+    const head = path.basename(words[0]?.value ?? '');
+    let index;
+    if (head === 'docker-compose') {
+        index = 1;
+    }
+    else if (head === 'docker' && words[1]?.value === 'compose') {
+        index = 2;
+    }
+    else {
+        return { kind: 'none' };
+    }
+    const globalOptions = parseOptions(words, index, COMPOSE_GLOBAL_OPTIONS);
+    if (globalOptions.kind === 'indeterminate') {
+        return { kind: 'indeterminate', signal: 'shell.compose_argv_indeterminate' };
+    }
+    index = globalOptions.index;
+    if (words[index]?.value !== 'run')
+        return { kind: 'none' };
+    const runOptions = parseOptions(words, index + 1, COMPOSE_RUN_OPTIONS);
+    if (runOptions.kind === 'indeterminate') {
+        return { kind: 'indeterminate', signal: 'shell.compose_argv_indeterminate' };
+    }
+    index = runOptions.index;
+    const service = words[index]?.value;
+    if (!service)
+        return { kind: 'indeterminate', signal: 'shell.compose_argv_indeterminate' };
+    const command = words.slice(index + 1);
+    if (command.length === 0)
+        return { kind: 'none' };
+    const recursive = decodeRecursiveInvocation(command);
+    if (recursive.kind === 'static') {
+        return {
+            kind: 'recursive',
+            service,
+            interpreter: recursive.interpreter,
+            script: recursive.script,
+        };
+    }
+    if (recursive.kind === 'dynamic')
+        return { kind: 'dynamic', service, signal: recursive.signal };
+    if (recursive.kind === 'indeterminate') {
+        return { kind: 'indeterminate', signal: 'shell.compose_argv_indeterminate' };
+    }
+    return { kind: 'none' };
+}
+export function decodeDockerComposeRunValues(values) {
+    return decodeDockerComposeRun(shellTokensFromValues(values, { detectExpansion: false }));
+}