@guilz-dev/belay 0.9.2 → 0.9.4

package/dist/adapters/cursor/hooks.js

@@ -1,10 +1,34 @@
+import { existsSync, realpathSync } from 'node:fs';
 import { getManagedHookEntries } from '../../defaults.js';
 function entryMatches(existing, expected) {
     return existing.command === expected.command && existing.matcher === expected.matcher;
 }
-function mergeHookEntry(current, expected, placement) {
+function legacyManagedEntries(platform, hooksDir, repoRoot) {
+    const entries = [
+        ...getManagedHookEntries(platform, hooksDir, repoRoot, 'legacy-relative'),
+        ...getManagedHookEntries(platform, hooksDir, repoRoot, 'legacy-absolute'),
+        ...getManagedHookEntries(platform, hooksDir, repoRoot, 'legacy-quoted-absolute'),
+        ...getManagedHookEntries(platform, hooksDir, repoRoot, 'legacy-bare-powershell-absolute'),
+    ];
+    if (existsSync(hooksDir)) {
+        const canonicalHooksDir = realpathSync(hooksDir);
+        if (canonicalHooksDir !== hooksDir) {
+            entries.push(...getManagedHookEntries(platform, canonicalHooksDir, repoRoot, 'legacy-absolute'));
+        }
+    }
+    return entries;
+}
+function variantsForDefinition(legacyEntries, event, definition) {
+    return [
+        definition,
+        ...legacyEntries
+            .filter((entry) => entry.event === event && entry.definition.matcher === definition.matcher)
+            .map((entry) => entry.definition),
+    ];
+}
+function mergeHookEntry(current, expected, managedVariants, placement) {
     const entries = Array.isArray(current) ? [...current] : [];
-    const filtered = entries.filter((entry) => !entryMatches(entry, expected));
+    const filtered = entries.filter((entry) => !managedVariants.some((variant) => entryMatches(entry, variant)));
     if (placement === 'prepend') {
         return [expected, ...filtered];
     }
@@ -20,24 +44,105 @@ export function managedShellPreToolUseEntry(platform, hooksDir, repoRoot) {
     return {
         command: referencePreToolUse.command,
         matcher: 'Shell',
+        failClosed: true,
     };
 }
 /** @deprecated Use {@link managedShellPreToolUseEntry}. */
 export const legacyManagedShellPreToolUseEntry = managedShellPreToolUseEntry;
+export function stripCursorHooksFile(current, platform, hooksDir, repoRoot) {
+    const next = {
+        version: current.version || 1,
+        hooks: { ...current.hooks },
+    };
+    const managedEntries = getManagedHookEntries(platform, hooksDir, repoRoot);
+    const legacyEntries = legacyManagedEntries(platform, hooksDir, repoRoot);
+    for (const { event, definition } of managedEntries) {
+        const entries = next.hooks[event];
+        if (!Array.isArray(entries)) {
+            continue;
+        }
+        const variants = variantsForDefinition(legacyEntries, event, definition);
+        next.hooks[event] = entries.filter((entry) => !variants.some((variant) => entryMatches(entry, variant)));
+        if (next.hooks[event].length === 0) {
+            delete next.hooks[event];
+        }
+    }
+    return stripLegacyManagedShellPreToolUseGates(next, platform, hooksDir, repoRoot);
+}
 export function mergeCursorHooksFile(current, platform, hooksDir, repoRoot) {
     const next = {
         version: current.version || 1,
         hooks: { ...current.hooks },
     };
     const managedEntries = getManagedHookEntries(platform, hooksDir, repoRoot);
+    const legacyEntries = legacyManagedEntries(platform, hooksDir, repoRoot);
     for (const { event, definition } of managedEntries) {
+        const variants = variantsForDefinition(legacyEntries, event, definition);
         next.hooks[event] = mergeHookEntry(next.hooks[event], {
             command: definition.command,
             matcher: definition.matcher,
-        }, definition.placement);
+            failClosed: definition.failClosed,
+        }, variants, definition.placement);
+    }
+    return stripLegacyManagedShellPreToolUseGates(next, platform, hooksDir, repoRoot);
+}
+export function legacyManagedShellPreToolUseVariants(platform, hooksDir, repoRoot) {
+    const shellEntry = managedShellPreToolUseEntry(platform, hooksDir, repoRoot);
+    const legacyEntries = legacyManagedEntries(platform, hooksDir, repoRoot);
+    const commands = new Set([shellEntry.command]);
+    for (const entry of legacyEntries) {
+        if (entry.event === 'preToolUse' && entry.definition.matcher === 'Write') {
+            commands.add(entry.definition.command);
+        }
+    }
+    return [...commands].map((command) => ({
+        command,
+        matcher: 'Shell',
+        failClosed: true,
+    }));
+}
+function stripLegacyManagedShellPreToolUseGates(hooks, platform, hooksDir, repoRoot) {
+    const variants = legacyManagedShellPreToolUseVariants(platform, hooksDir, repoRoot);
+    const preToolUse = hooks.hooks.preToolUse;
+    if (!Array.isArray(preToolUse) || variants.length === 0) {
+        return hooks;
+    }
+    const filtered = preToolUse.filter((entry) => !variants.some((variant) => entryMatches(entry, variant)));
+    if (filtered.length === preToolUse.length) {
+        return hooks;
+    }
+    const next = {
+        version: hooks.version || 1,
+        hooks: { ...hooks.hooks },
+    };
+    if (filtered.length === 0) {
+        delete next.hooks.preToolUse;
+    }
+    else {
+        next.hooks.preToolUse = filtered;
     }
     return next;
 }
+export function hasLegacyCursorDoubleShellGates(hooks, platform, hooksDir, repoRoot) {
+    const shellVariants = legacyManagedShellPreToolUseVariants(platform, hooksDir, repoRoot);
+    const preToolUse = hooks.hooks.preToolUse;
+    const beforeShell = hooks.hooks.beforeShellExecution;
+    if (!Array.isArray(preToolUse) || !Array.isArray(beforeShell)) {
+        return false;
+    }
+    const hasLegacyShellPreToolUse = preToolUse.some((entry) => shellVariants.some((variant) => entryMatches(entry, variant)));
+    if (!hasLegacyShellPreToolUse) {
+        return false;
+    }
+    const managedEntries = getManagedHookEntries(platform, hooksDir, repoRoot);
+    const shellManaged = managedEntries.find((entry) => entry.event === 'beforeShellExecution');
+    if (!shellManaged) {
+        return false;
+    }
+    const shellVariantsForBefore = variantsForDefinition(legacyManagedEntries(platform, hooksDir, repoRoot), 'beforeShellExecution', shellManaged.definition);
+    return beforeShell.some((entry) => shellVariantsForBefore.some((variant) => entryMatches(entry, variant)));
+}
+/** @deprecated Use {@link hasLegacyCursorDoubleShellGates}. */
 export function hasDuplicateCursorShellGates(hooks, platform, hooksDir, repoRoot) {
     const shellEntry = managedShellPreToolUseEntry(platform, hooksDir, repoRoot);
     const preToolUse = hooks.hooks.preToolUse;
@@ -47,3 +152,10 @@ export function hasDuplicateCursorShellGates(hooks, platform, hooksDir, repoRoot
     const shellMatches = preToolUse.filter((entry) => entryMatches(entry, shellEntry));
     return shellMatches.length > 1;
 }
+export function hasManagedCursorHookEntries(hooks, platform, hooksDir, repoRoot) {
+    const managedEntries = [
+        ...getManagedHookEntries(platform, hooksDir, repoRoot),
+        ...legacyManagedEntries(platform, hooksDir, repoRoot),
+    ];
+    return managedEntries.some(({ event, definition }) => hooks.hooks[event]?.some((entry) => entryMatches(entry, definition)));
+}

package/dist/adapters/cursor/routing-layout.d.ts

@@ -0,0 +1,5 @@
+export declare function cursorRoutingConfigPath(repoRoot: string): string;
+export declare function cursorRoutingHooksDir(repoRoot: string): string;
+export declare function cursorRoutingHooksSettingsPath(repoRoot: string): string;
+export declare function cursorRoutingRuntimeDir(repoRoot: string): string;
+export declare function findCursorRoutingRepoRoot(startPath: string): string;

package/dist/adapters/cursor/routing-layout.js

@@ -0,0 +1,29 @@
+import { existsSync } from 'node:fs';
+import path from 'node:path';
+export function cursorRoutingConfigPath(repoRoot) {
+    return path.join(repoRoot, '.cursor', 'belay.config.json');
+}
+export function cursorRoutingHooksDir(repoRoot) {
+    return path.join(repoRoot, '.cursor', 'hooks');
+}
+export function cursorRoutingHooksSettingsPath(repoRoot) {
+    return path.join(repoRoot, '.cursor', 'hooks.json');
+}
+export function cursorRoutingRuntimeDir(repoRoot) {
+    return path.join(repoRoot, '.cursor', 'belay', 'runtime');
+}
+export function findCursorRoutingRepoRoot(startPath) {
+    const resolvedStart = path.resolve(startPath);
+    let current = resolvedStart;
+    while (true) {
+        if (existsSync(path.join(current, '.git')) ||
+            (existsSync(path.join(current, '.cursor')) && existsSync(cursorRoutingConfigPath(current)))) {
+            return current;
+        }
+        const parent = path.dirname(current);
+        if (parent === current) {
+            return resolvedStart;
+        }
+        current = parent;
+    }
+}

package/dist/adapters/cursor/runtime-entry.d.ts

@@ -1,4 +1,22 @@
+export declare function resolveCursorActionCwd(payload: Record<string, unknown>, fallback?: string): string;
+export declare function handleBeforeSubmitPromptHook(payload: Record<string, unknown>): Promise<{
+    replay?: import("../../core/approval-replay.js").ApprovalReplayHint | undefined;
+    user_message?: string | undefined;
+    continue: boolean;
+}>;
 export declare function runBeforeSubmitPromptHook(): Promise<void>;
+export declare function handleShellGateHook(payload: Record<string, unknown>): Promise<import("../../core/gate-contract.js").GatePermissionResponse | {
+    permission: string;
+    user_message: string;
+}>;
 export declare function runShellGateHook(): Promise<void>;
+export declare function handleToolGateHook(eventName: string, payload: Record<string, unknown>): Promise<import("../../core/gate-contract.js").GatePermissionResponse | {
+    permission: string;
+    user_message: string;
+} | {
+    permission: string;
+    user_message?: undefined;
+}>;
 export declare function runToolGateHook(eventName: string): Promise<void>;
+export declare function handleAuditHook(eventName: string, payload: Record<string, unknown>): Promise<{}>;
 export declare function runAuditHook(eventName: string): Promise<void>;

package/dist/adapters/cursor/runtime-entry.js

@@ -1,7 +1,12 @@
+import path from 'node:path';
 import process from 'node:process';
+import { approvalCommandMatch } from '../../core/approval.js';
+import { findApprovalRepoRoots, formatAmbiguousApprovalRepoMessage, } from '../../core/approval-repo-lookup.js';
+import { DEFAULT_CONFIG_V4 } from '../../core/config.js';
 import { cursorLayout } from '../layouts/cursor.js';
 import { appendObservedAudit, createDefaultGateRuntimeDeps, evaluateGatedAction, gateVerdictToCursorResponse, processApprovalPrompt, resolveGateConfig, } from '../shared/gate-runtime.js';
 import { findRepoRoot } from '../shared/repo-root.js';
+import { GLOBAL_HOOK_WORKSPACE_MISSING_MESSAGE, isUnsafeGlobalHookFallback, resolveCursorActionCwdDetails, } from './cwd-resolution.js';
 async function readStdinJson() {
     const chunks = [];
     for await (const chunk of process.stdin) {
@@ -21,6 +26,38 @@ async function readStdinJson() {
 function jsonResponse(value) {
     process.stdout.write(`${JSON.stringify(value)}\n`);
 }
+export function resolveCursorActionCwd(payload, fallback = process.cwd()) {
+    return resolveCursorActionCwdDetails(payload, fallback).cwd;
+}
+function resolveCursorToolActionCwdDetails(payload, fallback, eventName, toolName) {
+    if ((eventName === 'preToolUse' || eventName === 'PreToolUse') && toolName === 'Shell') {
+        return resolveCursorActionCwdDetails(payload, fallback);
+    }
+    const toolInput = payload.tool_input;
+    if (toolInput === null || typeof toolInput !== 'object' || Array.isArray(toolInput)) {
+        return resolveCursorActionCwdDetails(payload, fallback);
+    }
+    const { working_directory: _workingDirectory, ...withoutWorkingDirectory } = toolInput;
+    return resolveCursorActionCwdDetails({ ...payload, tool_input: withoutWorkingDirectory }, fallback);
+}
+function collectCandidateRepoRoots(payload, resolution) {
+    const roots = [];
+    const add = (value) => {
+        const resolved = path.resolve(value);
+        if (!roots.includes(resolved)) {
+            roots.push(resolved);
+        }
+    };
+    if (Array.isArray(payload.workspace_roots)) {
+        for (const root of payload.workspace_roots) {
+            if (typeof root === 'string' && root.trim()) {
+                add(root);
+            }
+        }
+    }
+    add(resolution.cwd);
+    return roots;
+}
 async function loadRuntimeContext(cwd) {
     const repoRoot = findRepoRoot(cwd, cursorLayout);
     const configPath = cursorLayout.configPath(repoRoot);
@@ -28,61 +65,119 @@ async function loadRuntimeContext(cwd) {
     const config = await resolveGateConfig({ layout: cursorLayout, repoRoot, configPath }, deps);
     return { layout: cursorLayout, repoRoot, config, configPath };
 }
+async function processApprovalPromptWithRepoFallback(ctx, deps, prompt, payload, resolution) {
+    const tokenPrefix = ctx.config.tokenPrefix || DEFAULT_CONFIG_V4.tokenPrefix;
+    const approvalId = approvalCommandMatch(prompt, tokenPrefix);
+    const result = await processApprovalPrompt(ctx, deps, prompt);
+    if (result.continue || !approvalId) {
+        return result;
+    }
+    const notFound = result.user_message?.includes('not found') ||
+        result.user_message?.includes('Belay approval not found');
+    if (!notFound) {
+        return result;
+    }
+    const candidates = collectCandidateRepoRoots(payload, resolution).filter((root) => root !== ctx.repoRoot);
+    if (candidates.length === 0) {
+        return result;
+    }
+    const lookup = await findApprovalRepoRoots({
+        approvalId,
+        candidateRepoRoots: candidates,
+        adapter: 'cursor',
+    });
+    if (lookup.status === 'ambiguous') {
+        return {
+            continue: false,
+            user_message: formatAmbiguousApprovalRepoMessage(lookup.repoRoots),
+        };
+    }
+    if (lookup.status !== 'found') {
+        return result;
+    }
+    const retryCtx = await loadRuntimeContext(lookup.repoRoot);
+    return processApprovalPrompt(retryCtx, deps, prompt);
+}
 function isSubagentEvent(payload, eventName) {
     return eventName === 'subagentStart' || payload.subagent_type !== undefined;
 }
 function isFileMutationTool(toolName) {
     return toolName === 'Write' || toolName === 'StrReplace' || toolName === 'Delete';
 }
-export async function runBeforeSubmitPromptHook() {
+export async function handleBeforeSubmitPromptHook(payload) {
     try {
-        const payload = await readStdinJson();
         const prompt = String(payload.prompt ?? '');
-        const ctx = await loadRuntimeContext(process.cwd());
+        const resolution = resolveCursorActionCwdDetails(payload);
+        if (isUnsafeGlobalHookFallback(resolution)) {
+            return {
+                continue: false,
+                user_message: GLOBAL_HOOK_WORKSPACE_MISSING_MESSAGE,
+            };
+        }
+        const ctx = await loadRuntimeContext(resolution.cwd);
         const deps = createDefaultGateRuntimeDeps();
-        const result = await processApprovalPrompt(ctx, deps, prompt);
-        jsonResponse({
+        const result = await processApprovalPromptWithRepoFallback(ctx, deps, prompt, payload, resolution);
+        return {
             continue: result.continue,
             ...(result.user_message ? { user_message: result.user_message } : {}),
             ...(result.replay ? { replay: result.replay } : {}),
-        });
+        };
     }
     catch {
-        jsonResponse({
+        return {
             continue: false,
             user_message: 'belay failed while processing approval state. Run belay doctor, then retry.',
-        });
+        };
     }
 }
-export async function runShellGateHook() {
+export async function runBeforeSubmitPromptHook() {
+    jsonResponse(await handleBeforeSubmitPromptHook(await readStdinJson()));
+}
+export async function handleShellGateHook(payload) {
     try {
-        const payload = await readStdinJson();
         const command = String(payload.command ?? '').trim();
-        const cwd = String(payload.cwd ?? process.cwd()).trim() || process.cwd();
+        const resolution = resolveCursorActionCwdDetails(payload);
+        if (isUnsafeGlobalHookFallback(resolution)) {
+            return {
+                permission: 'deny',
+                user_message: GLOBAL_HOOK_WORKSPACE_MISSING_MESSAGE,
+            };
+        }
+        const cwd = resolution.cwd;
         const ctx = await loadRuntimeContext(cwd);
         const deps = createDefaultGateRuntimeDeps();
         const verdict = await evaluateGatedAction(ctx, deps, {
             kind: 'shell',
             cwd,
             command,
+            payload,
             sourceEvent: 'beforeShellExecution',
         });
-        jsonResponse(gateVerdictToCursorResponse(verdict));
+        return gateVerdictToCursorResponse(verdict);
     }
     catch {
-        jsonResponse({
+        return {
             permission: 'deny',
             user_message: 'belay failed while classifying this shell command. Run belay doctor, then retry.',
-        });
+        };
     }
 }
-export async function runToolGateHook(eventName) {
+export async function runShellGateHook() {
+    jsonResponse(await handleShellGateHook(await readStdinJson()));
+}
+export async function handleToolGateHook(eventName, payload) {
     try {
-        const payload = await readStdinJson();
-        const cwd = process.cwd();
+        const toolName = String(payload.tool_name ?? '');
+        const resolution = resolveCursorToolActionCwdDetails(payload, process.cwd(), eventName, toolName);
+        if (isUnsafeGlobalHookFallback(resolution)) {
+            return {
+                permission: 'deny',
+                user_message: GLOBAL_HOOK_WORKSPACE_MISSING_MESSAGE,
+            };
+        }
+        const cwd = resolution.cwd;
         const ctx = await loadRuntimeContext(cwd);
         const deps = createDefaultGateRuntimeDeps();
-        const toolName = String(payload.tool_name ?? '');
         if (isSubagentEvent(payload, eventName)) {
             const verdict = await evaluateGatedAction(ctx, deps, {
                 kind: 'subagent',
@@ -90,8 +185,7 @@ export async function runToolGateHook(eventName) {
                 payload,
                 sourceEvent: eventName,
             });
-            jsonResponse(gateVerdictToCursorResponse(verdict));
-            return;
+            return gateVerdictToCursorResponse(verdict);
         }
         if (toolName === 'Shell') {
             const verdict = await evaluateGatedAction(ctx, deps, {
@@ -101,8 +195,7 @@ export async function runToolGateHook(eventName) {
                 toolName,
                 sourceEvent: eventName,
             });
-            jsonResponse(gateVerdictToCursorResponse(verdict));
-            return;
+            return gateVerdictToCursorResponse(verdict);
         }
         if (isFileMutationTool(toolName)) {
             const verdict = await evaluateGatedAction(ctx, deps, {
@@ -112,8 +205,7 @@ export async function runToolGateHook(eventName) {
                 toolName,
                 sourceEvent: eventName,
             });
-            jsonResponse(gateVerdictToCursorResponse(verdict));
-            return;
+            return gateVerdictToCursorResponse(verdict);
         }
         if (payload.tool_name === 'Task') {
             const verdict = await evaluateGatedAction(ctx, deps, {
@@ -122,28 +214,37 @@ export async function runToolGateHook(eventName) {
                 payload,
                 sourceEvent: eventName,
             });
-            jsonResponse(gateVerdictToCursorResponse(verdict));
-            return;
+            return gateVerdictToCursorResponse(verdict);
         }
-        jsonResponse({ permission: 'allow' });
+        return { permission: 'allow' };
     }
     catch {
-        jsonResponse({
+        return {
             permission: 'deny',
             user_message: 'belay failed while classifying this tool action. Run belay doctor, then retry.',
-        });
+        };
     }
 }
-export async function runAuditHook(eventName) {
+export async function runToolGateHook(eventName) {
+    jsonResponse(await handleToolGateHook(eventName, await readStdinJson()));
+}
+export async function handleAuditHook(eventName, payload) {
     try {
-        const payload = await readStdinJson();
-        const ctx = await loadRuntimeContext(process.cwd());
+        const toolName = String(payload.tool_name ?? '');
+        const resolution = resolveCursorToolActionCwdDetails(payload, process.cwd(), eventName, toolName);
+        if (isUnsafeGlobalHookFallback(resolution)) {
+            return {};
+        }
+        const ctx = await loadRuntimeContext(resolution.cwd);
         const deps = createDefaultGateRuntimeDeps();
         await appendObservedAudit(ctx, deps, eventName, payload);
-        jsonResponse({});
+        return {};
     }
     catch (error) {
         console.error('belay audit hook failed:', error instanceof Error ? error.message : String(error));
-        jsonResponse({});
+        return {};
     }
 }
+export async function runAuditHook(eventName) {
+    jsonResponse(await handleAuditHook(eventName, await readStdinJson()));
+}

package/dist/adapters/layouts/scope.d.ts

@@ -11,8 +11,13 @@ export interface ScopedPaths {
     skillsDir: string;
     commandsDir?: string;
 }
+export declare function resolveTrustedWindowsPowerShellPath(systemRoot?: string | undefined): string;
 export declare function isPathInside(child: string, parent: string): boolean;
 export declare function buildRunnerInvocation(platform: NodeJS.Platform, hooksDir: string, repoRoot: string, hookScript: string, ...args: string[]): string;
+export declare function buildAbsoluteRunnerInvocation(platform: NodeJS.Platform, hooksDir: string, hookScript: string, ...args: string[]): string;
+export declare function buildLegacyBarePowerShellRunnerInvocation(platform: NodeJS.Platform, hooksDir: string, hookScript: string, ...args: string[]): string;
+export declare function buildLegacyQuotedAbsoluteRunnerInvocation(platform: NodeJS.Platform, hooksDir: string, hookScript: string, ...args: string[]): string;
+export declare function buildLegacyAbsoluteRunnerInvocation(platform: NodeJS.Platform, hooksDir: string, hookScript: string, ...args: string[]): string;
 export declare function resolveScopedPaths(layout: AdapterLayout, scope: InstallScope, repoRoot: string): ScopedPaths;
 export declare function resolveInstallScope(options: {
     scope?: InstallScope;

package/dist/adapters/layouts/scope.js

@@ -1,6 +1,50 @@
+import { existsSync, realpathSync } from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import { isPathOutsideRoot } from '../../core/path-utils.js';
+function canonicalizePotentialPath(inputPath) {
+    const unresolvedSegments = [];
+    let existingAncestor = path.resolve(inputPath);
+    while (!existsSync(existingAncestor)) {
+        const parent = path.dirname(existingAncestor);
+        if (parent === existingAncestor) {
+            break;
+        }
+        unresolvedSegments.unshift(path.basename(existingAncestor));
+        existingAncestor = parent;
+    }
+    return existsSync(existingAncestor)
+        ? path.join(realpathSync(existingAncestor), ...unresolvedSegments)
+        : path.resolve(inputPath);
+}
+function quotePowerShellLiteral(value) {
+    return `'${value.replaceAll("'", "''")}'`;
+}
+export function resolveTrustedWindowsPowerShellPath(systemRoot = process.env.SystemRoot || process.env.WINDIR) {
+    if (!systemRoot || !path.win32.isAbsolute(systemRoot)) {
+        throw new Error('A trusted Windows system root must be an absolute drive path.');
+    }
+    const hasControlCharacter = [...systemRoot].some((character) => character.charCodeAt(0) < 32);
+    if (systemRoot !== systemRoot.trim() || hasControlCharacter || /[%!?*"&|<>^]/.test(systemRoot)) {
+        throw new Error('The trusted Windows system root contains unsafe path or cmd.exe expansion characters.');
+    }
+    if (systemRoot.slice(2).includes(':')) {
+        throw new Error('The trusted Windows system root contains an invalid drive path.');
+    }
+    const normalizedRoot = path.win32.normalize(systemRoot);
+    if (!/^[A-Za-z]:\\$/.test(path.win32.parse(normalizedRoot).root)) {
+        throw new Error('A trusted Windows system root must be an absolute drive path.');
+    }
+    return path.win32.join(normalizedRoot, 'System32', 'WindowsPowerShell', 'v1.0', 'powershell.exe');
+}
+function buildEncodedPowerShellRunnerInvocation(executable, runnerPath, hookScript, args) {
+    const encodedCommand = Buffer.from([
+        '&',
+        quotePowerShellLiteral(runnerPath),
+        ...[hookScript, ...args].map(quotePowerShellLiteral),
+    ].join(' '), 'utf16le').toString('base64');
+    return `${executable} -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand ${encodedCommand}`;
+}
 function agentHomeDir(adapter) {
     const home = os.homedir();
     if (adapter === 'cursor') {
@@ -38,6 +82,33 @@ export function buildRunnerInvocation(platform, hooksDir, repoRoot, hookScript,
         : runnerAbs;
     return [runnerRef, hookScript, ...args].join(' ');
 }
+export function buildAbsoluteRunnerInvocation(platform, hooksDir, hookScript, ...args) {
+    const runnerFile = platform === 'win32' ? 'belay-runner.ps1' : 'belay-runner';
+    const canonicalHooksDir = canonicalizePotentialPath(hooksDir);
+    const runnerPath = path.join(canonicalHooksDir, runnerFile);
+    if (platform === 'win32') {
+        const powerShellPath = resolveTrustedWindowsPowerShellPath();
+        return buildEncodedPowerShellRunnerInvocation(`"${powerShellPath}"`, runnerPath, hookScript, args);
+    }
+    return [`'${runnerPath.replaceAll("'", "'\\''")}'`, hookScript, ...args].join(' ');
+}
+export function buildLegacyBarePowerShellRunnerInvocation(platform, hooksDir, hookScript, ...args) {
+    if (platform !== 'win32') {
+        return buildAbsoluteRunnerInvocation(platform, hooksDir, hookScript, ...args);
+    }
+    const runnerPath = path.join(canonicalizePotentialPath(hooksDir), 'belay-runner.ps1');
+    return buildEncodedPowerShellRunnerInvocation('powershell.exe', runnerPath, hookScript, args);
+}
+export function buildLegacyQuotedAbsoluteRunnerInvocation(platform, hooksDir, hookScript, ...args) {
+    const runnerFile = platform === 'win32' ? 'belay-runner.cmd' : 'belay-runner';
+    const runnerPath = path.join(canonicalizePotentialPath(hooksDir), runnerFile);
+    const quotedRunnerPath = platform === 'win32' ? `"${runnerPath}"` : `'${runnerPath.replaceAll("'", "'\\''")}'`;
+    return [quotedRunnerPath, hookScript, ...args].join(' ');
+}
+export function buildLegacyAbsoluteRunnerInvocation(platform, hooksDir, hookScript, ...args) {
+    const runnerFile = platform === 'win32' ? 'belay-runner.cmd' : 'belay-runner';
+    return [path.resolve(hooksDir, runnerFile), hookScript, ...args].join(' ');
+}
 export function resolveScopedPaths(layout, scope, repoRoot) {
     const resolvedRepo = path.resolve(repoRoot);
     const adapter = layout.name;

package/dist/adapters/shared/gate-runtime.js

@@ -7,7 +7,7 @@ import { buildReplayHint, buildRetryInstructionForConfig, canAutoReplay, getExec
 import { claimApprovedForReplay, gateApprovalStoreFromDeps, recordApproval, } from '../../core/approval-service.js';
 import { issueApprovalToken } from '../../core/approval-token.js';
 import { buildAuditActionSnapshot, buildAuditReplayContext, } from '../../core/audit-replay-context.js';
-import { approvalCorrelationId, serializeAuditRecordV3 } from '../../core/audit-serialize.js';
+import { approvalCorrelationId, serializeAuditRecordV3, toolInvocationCorrelationId, } from '../../core/audit-serialize.js';
 import { boundedUtf8Tail } from '../../core/bounded-output.js';
 import { mutateApprovalStateWithRetry } from '../../core/capability/approval-state-mutation.js';
 import { APPROVAL_STATE_VERSION_V3 } from '../../core/capability/approval-v3.js';
@@ -36,7 +36,7 @@ import { extractJudgeFallbackReason, formatJudgeInfrastructureDenyMessage, infer
 import { notifyDeny } from '../../core/notify.js';
 import { canonicalPath } from '../../core/path-utils.js';
 import { recoveryFailClosedResult, recoveryFailReasonFromSkip, } from '../../core/recovery/fail-closed.js';
-import { fingerprintReplayPayload } from '../../core/replay-scrub.js';
+import { fingerprintReplayPayload, redactToolInvocationId } from '../../core/replay-scrub.js';
 import { FILE_CHECKPOINT_ISOLATION_UNAVAILABLE, isTransactionalEligible, runTransactionalExecution, TRANSACTIONAL_ALREADY_APPLIED, TRANSACTIONAL_APPROVAL_BYPASS_REASONS, } from '../../core/transactional/index.js';
 import { buildAuditProvenanceFields } from '../../runtime-provenance.js';
 import { egressStatus } from '../../services/egress-service.js';
@@ -616,6 +616,9 @@ export async function evaluateGatedAction(ctx, deps, params) {
             event: resolveGateAuditEvent(sourceEvent, params.kind),
             sourceEvent,
             kind: params.kind,
+            ...(typeof params.payload?.tool_use_id === 'string'
+                ? { toolInvocationCorrelationId: toolInvocationCorrelationId(params.payload.tool_use_id) }
+                : {}),
             fingerprint: verdict.fingerprint,
             verdict: verdict.verdict,
             reason: verdict.reason,
@@ -779,6 +782,9 @@ export async function evaluateGatedAction(ctx, deps, params) {
     const scrubbedPayload = fingerprintReplayPayload(params.kind, params.payload, scrubOpts);
     return gateDecisionToVerdict(ctx, deps, params.kind, result, {
         sourceEvent: params.sourceEvent,
+        toolInvocationCorrelationId: typeof params.payload?.tool_use_id === 'string'
+            ? toolInvocationCorrelationId(params.payload.tool_use_id)
+            : undefined,
         predictedAssessment,
         observedAssessment,
         transactionalLayer,
@@ -904,6 +910,10 @@ async function gateDecisionToVerdict(ctx, deps, kind, result, auditExtras = {})
         event: auditEvent,
         sourceEvent,
         kind,
+        repoLabel: path.basename(ctx.repoRoot),
+        ...(auditExtras.toolInvocationCorrelationId
+            ? { toolInvocationCorrelationId: auditExtras.toolInvocationCorrelationId }
+            : {}),
         fingerprint: result.fingerprint,
         summary: result.normalizedCommand ?? result.summary ?? '',
         assessment: result.assessment,
@@ -1398,12 +1408,26 @@ export function gateVerdictToCodexUserPromptResponse(verdict) {
     };
 }
 export async function appendObservedAudit(ctx, deps, eventName, payload) {
+    const rawToolUseId = typeof payload.tool_use_id === 'string' ? payload.tool_use_id : undefined;
+    const summaryPayload = redactToolInvocationId(payload, rawToolUseId);
     await deps.appendAudit(ctx, {
         event: eventName,
         kind: 'audit',
         verdict: 'allow',
         reason: 'observed',
-        summary: canonicalStringify(payload),
+        ...(rawToolUseId
+            ? { toolInvocationCorrelationId: toolInvocationCorrelationId(rawToolUseId) }
+            : {}),
+        ...(typeof summaryPayload.tool_name === 'string' ? { toolName: summaryPayload.tool_name } : {}),
+        ...(typeof summaryPayload.failure_type === 'string'
+            ? { failureType: summaryPayload.failure_type }
+            : {}),
+        ...(typeof summaryPayload.error_message === 'string'
+            ? { errorMessage: summaryPayload.error_message }
+            : {}),
+        ...(typeof payload.duration === 'number' ? { durationMs: payload.duration } : {}),
+        ...(typeof payload.is_interrupt === 'boolean' ? { isInterrupt: payload.is_interrupt } : {}),
+        summary: canonicalStringify(summaryPayload),
     });
 }
 export { GateNormalizationError };