@guilz-dev/belay 0.9.2 → 0.9.4

package/dist/cli.js

@@ -17,9 +17,10 @@ import { formatSessionStatusReport, sessionStartProject, sessionStatusProject, }
 import { formatSimulateReport, simulateProject } from './commands/simulate.js';
 import { revokeStandingAllow } from './commands/standing-allow.js';
 import { formatStatusReport, statusProject } from './commands/status.js';
+import { formatWhereReport, whereProject } from './commands/where.js';
 import { loadConfigFile } from './config-io.js';
 import { rejectDeprecatedJudgeModelAuto } from './core/judge-model-policy.js';
-import { initProject, upgradeProject } from './installer.js';
+import { initProject, uninstallProject, upgradeProject } from './installer.js';
 import { egressEnv, egressStatus, formatEgressStatusReport, startEgressProxy, stopEgressProxy, } from './services/egress-service.js';
 import { formatSandboxStatusReport, sandboxStatus } from './services/sandbox-service.js';
 import { PACKAGE_VERSION } from './version.js';
@@ -297,14 +298,17 @@ function parseArgs(argv) {
                 }
                 options.approveScope = next;
             }
-            else if (command === 'init' || command === 'upgrade') {
+            else if (command === 'init' ||
+                command === 'upgrade' ||
+                command === 'uninstall' ||
+                command === 'where') {
                 if (!next || !['project', 'global'].includes(next)) {
                     throw new Error('--scope requires project or global.');
                 }
                 options.installScope = next;
             }
             else {
-                throw new Error('--scope is only valid for init, upgrade, or approve.');
+                throw new Error('--scope is only valid for init, upgrade, uninstall, where, or approve.');
             }
             index += 1;
             continue;
@@ -540,6 +544,8 @@ Usage:
   (--adapter selects host; fresh init picks matching judge providerId: cursor/claude/codex)
   (--dogfood runs after --preset and sets mode: audit, overriding preset enforce mode)
   ${c} upgrade [--target <dir>] [--adapter cursor|claude|codex] [--scope project|global] [--with-skill] [--migrate-judge-default]
+  ${c} uninstall [--target <dir>] [--adapter cursor] [--scope project|global]
+  ${c} where [--target <dir>] [--adapter cursor|claude|codex] [--scope project|global] [--json]
   ${c} dogfood [--target <dir>] [--adapter cursor|claude|codex] [--enforce] [--force]
   ${c} doctor [--target <dir>] [--adapter cursor|claude|codex] [--json] [--fix] [--dry-run]
   ${c} metrics [--target <dir>] [--json]
@@ -634,6 +640,30 @@ async function main() {
             process.stdout.write(`Upgraded belay (${result.adapter}) in ${result.repoRoot}.\n`);
             return;
         }
+        if (command === 'uninstall') {
+            const result = await uninstallProject({
+                targetDir: options.targetDir,
+                adapter: options.adapter,
+                scope: options.installScope,
+            });
+            process.stdout.write(`Removed belay hooks (${result.adapter}, scope=${result.scope}) from ${result.repoRoot}.\n`);
+            return;
+        }
+        if (command === 'where') {
+            const report = await whereProject({
+                targetDir: options.targetDir,
+                adapter: options.adapter,
+                scope: options.installScope,
+                json: options.json,
+            });
+            if (options.json) {
+                process.stdout.write(`${JSON.stringify(report, null, 2)}\n`);
+            }
+            else {
+                process.stdout.write(formatWhereReport(report));
+            }
+            return;
+        }
         if (command === 'judge') {
             const { runJudgeCommand } = await import('./commands/judge.js');
             if (!options.judgeSubcommand) {

package/dist/commands/doctor.js

@@ -1,9 +1,12 @@
-import { existsSync } from 'node:fs';
+import { execFile } from 'node:child_process';
+import { existsSync, realpathSync } from 'node:fs';
 import { readFile } from 'node:fs/promises';
 import path from 'node:path';
+import { promisify } from 'node:util';
 import { getClaudeManagedHookEntries } from '../adapters/claude/hooks.js';
-import { getCodexManagedHookEntries } from '../adapters/codex/hooks.js';
-import { hasDuplicateCursorShellGates } from '../adapters/cursor/hooks.js';
+import { codexHooksTomlIncludesCommand, getCodexManagedHookEntries, } from '../adapters/codex/hooks.js';
+import { hasCurrentCursorDispatcherGeneration } from '../adapters/cursor/dispatcher-generation.js';
+import { hasLegacyCursorDoubleShellGates, hasManagedCursorHookEntries, } from '../adapters/cursor/hooks.js';
 import { getAdapterLayout } from '../adapters/layouts/index.js';
 import { protectedArtifactRoots } from '../adapters/layouts/protected-paths.js';
 import { resolveScopedPaths } from '../adapters/layouts/scope.js';
@@ -15,7 +18,7 @@ import { detectFenceDrift, summarizeAuditVisibility } from '../core/audit-summar
 import { inspectBoundaryAttestationFile } from '../core/capability/boundary-attestation-sign.js';
 import { boundaryAttestationPath, boundarySessionStatus, } from '../core/capability/boundary-session.js';
 import { configuredControlPlaneDir, defaultControlPlaneDir, hasForbiddenShellOverrideLists, stripForbiddenShellOverrideLists, } from '../core/config.js';
-import { verifyIntegrityManifest } from '../core/integrity.js';
+import { runtimeIntegrityFiles, verifyIntegrityManifest } from '../core/integrity.js';
 import { diagnoseJudge, stopJudgeSessionBrokers } from '../core/judge-doctor.js';
 import { resolveJudgeTransport } from '../core/judge-runtime-detection.js';
 import { listRecoveryCheckpoints } from '../core/recovery/checkpoint.js';
@@ -33,6 +36,7 @@ import { PACKAGE_VERSION } from '../version.js';
 import { loadAuditRecords } from './audit.js';
 import { collectHealthSnapshot } from './health-snapshot.js';
 import { metricsProject } from './metrics.js';
+const execFileAsync = promisify(execFile);
 function resolveDoctorAdapter(options, configAdapter) {
     if (options.adapter) {
         return options.adapter;
@@ -42,6 +46,120 @@ function resolveDoctorAdapter(options, configAdapter) {
     }
     return 'cursor';
 }
+function hasCursorGlobalWorkspaceResolver(runtimeSource) {
+    // Cursor global hooks must derive workspace cwd from payload fields, not process cwd.
+    const hasScopedToolResolver = runtimeSource.includes('resolveCursorToolActionCwd') ||
+        runtimeSource.includes('includeToolInputCwd');
+    return (runtimeSource.includes('resolveCursorActionCwd') &&
+        hasScopedToolResolver &&
+        runtimeSource.includes('workspace_roots') &&
+        runtimeSource.includes('working_directory') &&
+        runtimeSource.includes('tool_input'));
+}
+const CURSOR_HOOK_SHIMS = [
+    'belay-before-submit.mjs',
+    'belay-shell-gate.mjs',
+    'belay-tool-gate.mjs',
+    'belay-audit.mjs',
+];
+function runnerFileName(adapterName, platform) {
+    if (platform !== 'win32') {
+        return 'belay-runner';
+    }
+    return adapterName === 'cursor' ? 'belay-runner.ps1' : 'belay-runner.cmd';
+}
+async function cursorOriginIssues(hooksDir, installScope, repoRoot) {
+    const canonicalRepoRoot = realpathSync(repoRoot);
+    const issues = [];
+    for (const fileName of CURSOR_HOOK_SHIMS) {
+        const shimPath = path.join(hooksDir, fileName);
+        if (!existsSync(shimPath)) {
+            continue;
+        }
+        let source;
+        try {
+            source = await readFile(shimPath, 'utf8');
+        }
+        catch (error) {
+            const detail = error instanceof Error ? error.message : String(error);
+            issues.push(`Unable to inspect Cursor hook shim for intended ${installScope} owner: ${shimPath}: ${detail}. Run belay upgrade --scope ${installScope}.`);
+            continue;
+        }
+        if (!source.includes("from '../belay/runtime/dispatcher.mjs'")) {
+            issues.push(`Cursor router generation mismatch for intended ${installScope} owner: ${shimPath}. Run belay upgrade --scope ${installScope}.`);
+            continue;
+        }
+        const originMatch = source.match(/origin:\s*(\{[^\n]+\})/);
+        let originMatches = false;
+        if (originMatch?.[1]) {
+            try {
+                const origin = JSON.parse(originMatch[1]);
+                originMatches =
+                    installScope === 'global'
+                        ? origin.scope === 'global'
+                        : origin.scope === 'project' &&
+                            typeof origin.repoRoot === 'string' &&
+                            realpathSync(origin.repoRoot) === canonicalRepoRoot;
+            }
+            catch {
+                originMatches = false;
+            }
+        }
+        if (!originMatches) {
+            issues.push(`Cursor hook origin mismatch for intended ${installScope} owner: ${shimPath}. Run belay upgrade --scope ${installScope}.`);
+        }
+    }
+    return issues;
+}
+async function listLinkedWorktreePaths(repoRoot) {
+    try {
+        const { stdout } = await execFileAsync('git', ['worktree', 'list', '--porcelain'], {
+            cwd: repoRoot,
+            encoding: 'utf8',
+        });
+        return stdout
+            .split(/\r?\n/)
+            .filter((line) => line.startsWith('worktree '))
+            .map((line) => line.slice('worktree '.length).trim())
+            .filter((entry) => entry.length > 0);
+    }
+    catch {
+        return [];
+    }
+}
+async function detectUndogfoodedLinkedWorktrees(params) {
+    const repoRootCanonical = realpathSync(params.repoRoot);
+    const worktrees = await listLinkedWorktreePaths(params.repoRoot);
+    const warnings = [];
+    for (const worktreePath of worktrees) {
+        let canonicalPath = worktreePath;
+        try {
+            canonicalPath = realpathSync(worktreePath);
+        }
+        catch {
+            // Keep the original path for warning output when the entry is stale.
+        }
+        if (canonicalPath === repoRootCanonical) {
+            continue;
+        }
+        const configPath = params.layout.configPath(worktreePath);
+        if (!existsSync(configPath)) {
+            warnings.push(`Dogfood is active here but ${path.basename(worktreePath)} has no belay.config.json (defaults to enforce). Run belay dogfood in each worktree you use with Cursor.`);
+            continue;
+        }
+        try {
+            const candidate = await loadLayeredConfig(worktreePath, params.adapterName);
+            const dogfoodEnabled = candidate.config.mode === 'audit' && candidate.config.policy.unknownLocalEffect === 'deny';
+            if (!dogfoodEnabled) {
+                warnings.push(`Dogfood is active here but ${path.basename(worktreePath)} is not in dogfood mode (mode=${candidate.config.mode}, unknownLocalEffect=${candidate.config.policy.unknownLocalEffect}). Run belay dogfood in each worktree you use with Cursor.`);
+            }
+        }
+        catch {
+            warnings.push(`Dogfood is active here but ${path.basename(worktreePath)} has an unreadable belay.config.json. Run belay doctor and belay dogfood in that worktree.`);
+        }
+    }
+    return warnings;
+}
 export async function doctorProject(options = {}) {
     const repoRoot = path.resolve(options.targetDir ?? process.cwd());
     const issues = [];
@@ -97,7 +215,9 @@ export async function doctorProject(options = {}) {
             hooksPath = scopedPaths.hooksSettingsPath;
             corePath = path.join(scopedPaths.runtimeDir, 'core.mjs');
             notes.push(installScope === 'global'
-                ? `Install scope: global (hooks/runtime at ${scopedPaths.hooksDir})`
+                ? adapterName === 'cursor'
+                    ? `Install scope: global (hooks/runtime at ${scopedPaths.hooksDir}). To remove global hooks: belay uninstall --scope global`
+                    : `Install scope: global (hooks/runtime at ${scopedPaths.hooksDir})`
                 : 'Install scope: project');
             notes.push(`Config mode: ${loadedConfig.mode}`);
             const dogfoodActive = loadedConfig.mode === 'audit' && loadedConfig.policy.unknownLocalEffect === 'deny';
@@ -133,9 +253,9 @@ export async function doctorProject(options = {}) {
             }
             if (loadedConfig.controlPlane.integrity === 'hash-pinned') {
                 notes.push('Integrity: hash-pinned (verify with belay upgrade after runtime changes).');
-                const integrity = await verifyIntegrityManifest(repoRoot, activeLayout);
+                const integrity = await verifyIntegrityManifest(repoRoot, activeLayout, runtimeIntegrityFiles(activeLayout, scopedPaths));
                 if (!integrity.ok) {
-                    issues.push(`Integrity verification failed: ${integrity.mismatches.slice(0, 3).join(', ')}`);
+                    issues.push(`Integrity verification failed: ${integrity.mismatches.join(', ')}`);
                 }
             }
         }
@@ -151,14 +271,16 @@ export async function doctorProject(options = {}) {
     const repoLocalDir = loadedConfig
         ? repoLocalStateDirFor(repoRoot, loadedConfig)
         : activeLayout.repoLocalStateDir(repoRoot);
-    const requiredPaths = [
-        path.join(hooksDir, 'belay-runner'),
-        path.join(hooksDir, 'belay-runner.cmd'),
+    const routingOwnerPaths = [
+        path.join(hooksDir, runnerFileName(adapterName, process.platform)),
         path.join(hooksDir, 'belay-before-submit.mjs'),
         path.join(hooksDir, 'belay-shell-gate.mjs'),
         path.join(hooksDir, 'belay-tool-gate.mjs'),
         path.join(hooksDir, 'belay-audit.mjs'),
+        ...(adapterName === 'cursor' ? [path.join(scopedPaths.runtimeDir, 'dispatcher.mjs')] : []),
         corePath,
+    ];
+    const operationalPaths = [
         loadedConfig
             ? pendingApprovalsPath(repoRoot, loadedConfig)
             : path.join(repoLocalDir, 'pending-approvals.json'),
@@ -167,9 +289,67 @@ export async function doctorProject(options = {}) {
             : path.join(repoLocalDir, 'approved-approvals.json'),
         path.join(repoRoot, loadedConfig?.audit.logPath ?? activeLayout.defaultAuditLogPath(repoRoot)),
     ];
+    const requiredPaths = [...routingOwnerPaths, ...operationalPaths];
     for (const requiredPath of requiredPaths) {
         if (!existsSync(requiredPath)) {
             issues.push(`Missing generated file: ${requiredPath}`);
+            if (adapterName === 'cursor' && routingOwnerPaths.includes(requiredPath)) {
+                issues.push(`Cursor intended ${installScope} owner is incomplete: missing ${requiredPath}. Run belay upgrade --scope ${installScope}.`);
+            }
+        }
+    }
+    if (adapterName === 'cursor') {
+        issues.push(...(await cursorOriginIssues(hooksDir, installScope, repoRoot)));
+        const dispatcherPath = path.join(scopedPaths.runtimeDir, 'dispatcher.mjs');
+        if (existsSync(dispatcherPath) &&
+            !hasCurrentCursorDispatcherGeneration(await readFile(dispatcherPath, 'utf8'))) {
+            issues.push(`Cursor router generation mismatch for intended ${installScope} owner dispatcher: ${dispatcherPath}. Run belay upgrade --scope ${installScope}.`);
+        }
+        if (installScope === 'project') {
+            const globalPaths = resolveScopedPaths(activeLayout, 'global', repoRoot);
+            if (existsSync(globalPaths.hooksSettingsPath)) {
+                try {
+                    const { loadHooksFile } = await import('../installer.js');
+                    const globalHooks = await loadHooksFile(globalPaths.hooksSettingsPath);
+                    if (hasManagedCursorHookEntries(globalHooks, process.platform, globalPaths.hooksDir, repoRoot)) {
+                        const globalOwnerFiles = [
+                            path.join(globalPaths.hooksDir, runnerFileName('cursor', process.platform)),
+                            path.join(globalPaths.runtimeDir, 'core.mjs'),
+                            path.join(globalPaths.runtimeDir, 'dispatcher.mjs'),
+                            ...CURSOR_HOOK_SHIMS.map((fileName) => path.join(globalPaths.hooksDir, fileName)),
+                        ];
+                        const globalOriginProblems = await cursorOriginIssues(globalPaths.hooksDir, 'global', repoRoot);
+                        issues.push(...globalOriginProblems);
+                        const globalProblems = [
+                            ...globalOwnerFiles.filter((filePath) => !existsSync(filePath)),
+                            ...globalOriginProblems,
+                        ];
+                        const globalDispatcherPath = path.join(globalPaths.runtimeDir, 'dispatcher.mjs');
+                        if (existsSync(globalDispatcherPath)) {
+                            try {
+                                if (!hasCurrentCursorDispatcherGeneration(await readFile(globalDispatcherPath, 'utf8'))) {
+                                    globalProblems.push(globalDispatcherPath);
+                                }
+                            }
+                            catch (error) {
+                                const detail = error instanceof Error ? error.message : String(error);
+                                issues.push(`Unable to inspect shadowed global Cursor dispatcher at ${globalDispatcherPath}: ${detail}.`);
+                                globalProblems.push(globalDispatcherPath);
+                            }
+                        }
+                        if (globalProblems.length > 0) {
+                            issues.push('Global Cursor installation cannot yield to the project owner. Run belay upgrade from this project to refresh the global router.');
+                        }
+                        else {
+                            notes.push('Healthy global Cursor install is shadowed by this project owner and will return neutral for this repository.');
+                        }
+                    }
+                }
+                catch (error) {
+                    const detail = error instanceof Error ? error.message : String(error);
+                    issues.push(`Unable to inspect shadowed global Cursor hooks at ${globalPaths.hooksSettingsPath}: ${detail}.`);
+                }
+            }
         }
     }
     let hooksOk = true;
@@ -184,15 +364,17 @@ export async function doctorProject(options = {}) {
             const hooksFile = await loadHooksFile(hooksPath);
             for (const { event, definition } of managedEntries) {
                 const entries = hooksFile.hooks[event] ?? [];
-                const present = entries.some((entry) => entry.command === definition.command && entry.matcher === definition.matcher);
-                if (!present) {
+                const matchingEntry = entries.find((entry) => entry.command === definition.command && entry.matcher === definition.matcher);
+                if (!matchingEntry || matchingEntry.failClosed !== true) {
                     hooksOk = false;
                     const matcherSuffix = definition.matcher ? ` (matcher: ${definition.matcher})` : '';
-                    issues.push(`Missing managed hook for ${event}: ${definition.command}${matcherSuffix}`);
+                    issues.push(matchingEntry
+                        ? `Managed Cursor hook for ${event} must set failClosed: true: ${definition.command}${matcherSuffix}`
+                        : `Missing managed hook for ${event}: ${definition.command}${matcherSuffix}`);
                 }
             }
-            if (hasDuplicateCursorShellGates(hooksFile, process.platform, hooksDir, repoRoot)) {
-                warnings.push('Duplicate Cursor Shell preToolUse gates detected. Run belay upgrade to dedupe managed hooks.');
+            if (hasLegacyCursorDoubleShellGates(hooksFile, process.platform, hooksDir, repoRoot)) {
+                warnings.push('Legacy Cursor Shell preToolUse gate detected alongside beforeShellExecution. Run belay upgrade to remove the managed Shell matcher.');
             }
         }
         else if (adapterName === 'codex') {
@@ -200,7 +382,7 @@ export async function doctorProject(options = {}) {
             // are present in the rendered TOML block.
             const toml = await readFile(hooksPath, 'utf8');
             for (const { event, definition } of managedEntries) {
-                if (!toml.includes(definition.command)) {
+                if (!codexHooksTomlIncludesCommand(toml, definition.command)) {
                     hooksOk = false;
                     issues.push(`Missing Codex managed hook for ${event}: ${definition.command}`);
                 }
@@ -248,6 +430,17 @@ export async function doctorProject(options = {}) {
         if (runtimeVersions.stamp?.startsWith(`${PACKAGE_VERSION}@`)) {
             notes.push(`Runtime version matches package (${PACKAGE_VERSION}).`);
         }
+        if (adapterName === 'cursor' && installScope === 'global') {
+            try {
+                const runtimeSource = await readFile(corePath, 'utf8');
+                if (!hasCursorGlobalWorkspaceResolver(runtimeSource)) {
+                    warnings.push('Global Cursor runtime appears to resolve hook context from hook process cwd. Per-repository belay.config.json can be bypassed (audit may act as enforce). Run belay upgrade --scope global from the latest package.');
+                }
+            }
+            catch {
+                warnings.push('Unable to inspect global Cursor runtime for workspace-cwd resolution. Run belay upgrade --scope global from the latest package.');
+            }
+        }
     }
     if (options.fix && loadedConfig) {
         if (hasForbiddenShellOverrideLists(loadedConfig)) {
@@ -323,6 +516,12 @@ export async function doctorProject(options = {}) {
         };
         if (dogfood.active) {
             notes.push(`Dogfood active cohort: ${dogfood.gateEvents} gate events, ${dogfood.wouldBlockCount} would-block (${(dogfood.wouldBlockRate * 100).toFixed(1)}%); ${dogfood.excludedGateEvents} historical/mismatched event(s) excluded.`);
+            notes.push(`Host denied after Belay allow (cohort): ${auditVisibility.hostDeniedAfterAllowCount}.`);
+            warnings.push(...(await detectUndogfoodedLinkedWorktrees({
+                repoRoot,
+                adapterName,
+                layout: activeLayout,
+            })));
             if (dogfood.readyForEnforce) {
                 notes.push('Dogfood metrics suggest enforce mode is ready (belay dogfood --enforce).');
             }

package/dist/commands/health-snapshot.d.ts

@@ -1,5 +1,8 @@
 import type { AdapterName } from '../adapters/layouts/types.js';
 import type { HealthSnapshot, HealthSnapshotOptions } from '../types.js';
+export declare function cursorCliConfigPaths(homeDir: string, env: Partial<Pick<NodeJS.ProcessEnv, 'CURSOR_CONFIG_DIR' | 'XDG_CONFIG_HOME'>>): string[];
+export declare function cursorApprovalModeRequiresHostDenialWarning(approvalMode: unknown): boolean;
+export declare function formatCursorApprovalModeLabel(approvalMode: unknown): string;
 /** Lightweight floor check without judge doctor / sandbox probes. */
 export declare function isBelayFloorInstalled(options?: {
     targetDir?: string;

package/dist/commands/health-snapshot.js

@@ -48,6 +48,58 @@ async function managedHooksPresent(adapter, hooksPath, hooksDir, repoRoot) {
     }
     return managedEntries.every(({ definition }) => content.includes(definition.command));
 }
+/** Cursor modes confirmed not to apply host-level denial after Belay allows. */
+const CURSOR_APPROVAL_MODES_WITHOUT_HOST_DENIAL = new Set(['unrestricted']);
+export function cursorCliConfigPaths(homeDir, env) {
+    const candidates = [];
+    const addCandidate = (candidate) => {
+        if (!candidates.includes(candidate)) {
+            candidates.push(candidate);
+        }
+    };
+    const cursorConfigDir = env.CURSOR_CONFIG_DIR?.trim();
+    if (cursorConfigDir) {
+        addCandidate(path.join(cursorConfigDir, 'cli-config.json'));
+    }
+    const xdgConfigHome = env.XDG_CONFIG_HOME?.trim();
+    if (xdgConfigHome) {
+        addCandidate(path.join(xdgConfigHome, 'cursor', 'cli-config.json'));
+    }
+    addCandidate(path.join(homeDir, '.cursor', 'cli-config.json'));
+    return candidates;
+}
+export function cursorApprovalModeRequiresHostDenialWarning(approvalMode) {
+    if (typeof approvalMode !== 'string' || !approvalMode.trim()) {
+        return true;
+    }
+    return !CURSOR_APPROVAL_MODES_WITHOUT_HOST_DENIAL.has(approvalMode);
+}
+export function formatCursorApprovalModeLabel(approvalMode) {
+    if (typeof approvalMode !== 'string' || !approvalMode.trim()) {
+        return 'default (prompts on each action)';
+    }
+    return approvalMode;
+}
+async function cursorRunModeRiskSignal(homeDir, belayMode, env) {
+    const configPath = cursorCliConfigPaths(homeDir, env).find((candidate) => existsSync(candidate));
+    if (!configPath) {
+        return null;
+    }
+    try {
+        const config = JSON.parse(await readFile(configPath, 'utf8'));
+        if (!cursorApprovalModeRequiresHostDenialWarning(config.approvalMode)) {
+            return null;
+        }
+        const approvalModeLabel = formatCursorApprovalModeLabel(config.approvalMode);
+        const auditGuidance = belayMode === 'audit'
+            ? ' Belay is in audit mode; keep the Cursor protection or approve the exact host prompt, and do not switch Cursor to unrestricted until Belay enforce mode and fail-closed hook health are verified.'
+            : ' If Belay is intended to be authoritative, verify fail-closed hook health before configuring Cursor unrestricted mode.';
+        return `Cursor approval mode is ${approvalModeLabel}; Cursor can deny shell actions after Belay allows them. Such a denial is a host-policy denial, not a Belay approval.${auditGuidance}`;
+    }
+    catch {
+        return null;
+    }
+}
 /** Lightweight floor check without judge doctor / sandbox probes. */
 export async function isBelayFloorInstalled(options = {}) {
     const repoRoot = path.resolve(options.targetDir ?? process.cwd());
@@ -125,6 +177,15 @@ export async function collectHealthSnapshot(options = {}) {
             if (layered.config.judge.provider === 'openai-compatible') {
                 additionalRiskSignals.push('cloud judge enabled: redacted command text may be sent to an external provider');
             }
+            if (adapter === 'cursor') {
+                const cursorRunModeRisk = await cursorRunModeRiskSignal(options.homeDir ?? os.homedir(), layered.config.mode, options.cursorConfigEnv ?? {
+                    CURSOR_CONFIG_DIR: process.env.CURSOR_CONFIG_DIR,
+                    XDG_CONFIG_HOME: process.env.XDG_CONFIG_HOME,
+                });
+                if (cursorRunModeRisk) {
+                    additionalRiskSignals.push(cursorRunModeRisk);
+                }
+            }
         }
         catch {
             configPresent = false;

package/dist/commands/recovery-checkpoints.d.ts

@@ -86,7 +86,7 @@ export declare function recoveryCheckpointCommand(options: {
     state: import("../core/recovery/types.js").RecoveryCheckpointStateV1;
     manifestHash: string;
     receipt: import("../core/index.js").RecoveryReceiptV1 | undefined;
-    repoRoot?: undefined;
+    readonly repoRoot?: undefined;
     backend?: undefined;
     availableBackends?: undefined;
     backendCounts?: undefined;
@@ -118,7 +118,7 @@ export declare function recoveryCheckpointCommand(options: {
     paths: string[];
     auditRecorded: boolean;
     message: string;
-    repoRoot?: undefined;
+    readonly repoRoot?: undefined;
     backend?: undefined;
     availableBackends?: undefined;
     backendCounts?: undefined;
@@ -146,7 +146,7 @@ export declare function recoveryCheckpointCommand(options: {
     subcommand: string;
     verdict: string;
     checkpointId: string;
-    repoRoot?: undefined;
+    readonly repoRoot?: undefined;
     backend?: undefined;
     availableBackends?: undefined;
     backendCounts?: undefined;

package/dist/commands/report.js

@@ -26,6 +26,7 @@ export async function reportProject(options = {}) {
     };
 }
 export function formatReport(report) {
+    const recentHostDenials = report.recentHostDenials ?? [];
     const lines = [
         `belay report for ${report.repoRoot}`,
         `Audit log: ${report.auditLogPath}`,
@@ -34,6 +35,10 @@ export function formatReport(report) {
         ...formatAskBreakdown(report),
         `Flag (allow_flagged): ${report.flagCount}`,
         `Allow (silent pass): ${report.allowCount}`,
+        `Host denied after Belay allow: ${report.hostDeniedAfterAllowCount ?? 0}`,
+        ...(report.unrecognizedHostFailureCount && report.unrecognizedHostFailureCount > 0
+            ? [`Unrecognized host tool failures: ${report.unrecognizedHostFailureCount}`]
+            : []),
         `Silent-pass rate: ${(report.silentPassRate * 100).toFixed(1)}%`,
         '',
     ];
@@ -51,6 +56,15 @@ export function formatReport(report) {
         }
         lines.push('');
     }
+    if (recentHostDenials.length > 0) {
+        lines.push('Host denials after Belay allow:');
+        for (const denial of recentHostDenials) {
+            const when = denial.failureTimestamp ?? 'unknown-time';
+            const detail = denial.errorMessage ? ` — ${denial.errorMessage}` : '';
+            lines.push(`- [${when}] ${denial.summary}${detail}`);
+        }
+        lines.push('');
+    }
     if (report.recentAsks.length === 0) {
         lines.push('No recent asks in the selected period.');
     }

package/dist/commands/status.js

@@ -31,6 +31,7 @@ export async function statusProject(options = {}) {
     };
 }
 export function formatStatusReport(report) {
+    const recentHostDenials = report.visibility.recentHostDenials ?? [];
     const { health } = report;
     const lines = [
         `belay status for ${report.repoRoot}`,
@@ -64,6 +65,11 @@ export function formatStatusReport(report) {
         ...formatAskBreakdown(report.visibility, '  '),
         `  Flag (allow_flagged): ${report.visibility.flagCount}`,
         `  Allow (silent pass): ${report.visibility.allowCount}`,
+        `  Host denied after Belay allow: ${report.visibility.hostDeniedAfterAllowCount ?? 0}`,
+        ...(report.visibility.unrecognizedHostFailureCount &&
+            report.visibility.unrecognizedHostFailureCount > 0
+            ? [`  Unrecognized host tool failures: ${report.visibility.unrecognizedHostFailureCount}`]
+            : []),
         `  Silent-pass rate: ${(report.visibility.silentPassRate * 100).toFixed(1)}%`,
         '',
     ];
@@ -81,6 +87,15 @@ export function formatStatusReport(report) {
         }
         lines.push('');
     }
+    if (recentHostDenials.length > 0) {
+        lines.push('Host denials after Belay allow:');
+        for (const denial of recentHostDenials.slice(0, 5)) {
+            const when = denial.failureTimestamp ?? 'unknown-time';
+            const detail = denial.errorMessage ? ` — ${denial.errorMessage}` : '';
+            lines.push(`- [${when}] ${denial.summary}${detail}`);
+        }
+        lines.push('');
+    }
     if (report.visibility.recentAsks.length > 0) {
         lines.push('Recent asks:');
         for (const ask of report.visibility.recentAsks.slice(0, 5)) {

package/dist/commands/where.d.ts

@@ -0,0 +1,4 @@
+import type { WhereOptions, WhereReport } from '../types.js';
+export declare function resolveCliPackageRoot(): string;
+export declare function whereProject(options?: WhereOptions): Promise<WhereReport>;
+export declare function formatWhereReport(report: WhereReport): string;

package/dist/commands/where.js

@@ -0,0 +1,52 @@
+import { existsSync } from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { getAdapterLayout } from '../adapters/layouts/index.js';
+import { resolveScopedPaths } from '../adapters/layouts/scope.js';
+import { detectAdapterName } from '../config-io.js';
+import { resolveOperationScope } from '../installer/scope-config.js';
+export function resolveCliPackageRoot() {
+    return path.resolve(fileURLToPath(new URL('../..', import.meta.url)));
+}
+export async function whereProject(options = {}) {
+    const cwd = process.cwd();
+    const repoRoot = path.resolve(options.targetDir ?? cwd);
+    const adapter = options.adapter ?? detectAdapterName(repoRoot);
+    const scope = await resolveOperationScope(repoRoot, adapter, options);
+    const paths = resolveScopedPaths(getAdapterLayout(adapter), scope, repoRoot);
+    const configPresent = existsSync(paths.configPath);
+    return {
+        cwd,
+        repoRoot,
+        adapter,
+        installScope: scope,
+        configPresent,
+        cliExecutable: process.argv[1] ? path.resolve(process.argv[1]) : undefined,
+        cliPackageRoot: resolveCliPackageRoot(),
+        configPath: paths.configPath,
+        hooksSettingsPath: paths.hooksSettingsPath,
+        hooksDir: paths.hooksDir,
+        runtimeDir: paths.runtimeDir,
+        skillsDir: paths.skillsDir,
+        commandsDir: paths.commandsDir,
+    };
+}
+export function formatWhereReport(report) {
+    const lines = [
+        `cwd: ${report.cwd}`,
+        `target dir: ${report.repoRoot}`,
+        `adapter: ${report.adapter} (scope=${report.installScope})`,
+        `config present: ${report.configPresent ? 'yes' : 'no'}`,
+        `cli executable: ${report.cliExecutable ?? '(unknown)'}`,
+        `cli package: ${report.cliPackageRoot}`,
+        `config: ${report.configPath}`,
+        `hooks settings: ${report.hooksSettingsPath}`,
+        `hooks: ${report.hooksDir}`,
+        `runtime: ${report.runtimeDir}`,
+        `skills: ${report.skillsDir}`,
+    ];
+    if (report.commandsDir) {
+        lines.push(`commands: ${report.commandsDir}`);
+    }
+    return `${lines.join('\n')}\n`;
+}

package/dist/config-io.js

@@ -209,8 +209,17 @@ export async function loadConfigFile(repoRoot, adapter = detectAdapterName(repoR
 }
 export async function writeConfigFile(repoRoot, config, adapter = resolveAdapterName(config)) {
     const configPath = configPathFor(repoRoot, adapter);
-    await mkdir(path.dirname(configPath), { recursive: true });
-    await writeFile(configPath, `${JSON.stringify(stripForbiddenShellOverrideLists(config), null, 2)}\n`, 'utf8');
+    const directory = path.dirname(configPath);
+    const temporaryPath = path.join(directory, `.${path.basename(configPath)}.${process.pid}.${randomUUID()}.tmp`);
+    const content = `${JSON.stringify(stripForbiddenShellOverrideLists(config), null, 2)}\n`;
+    await mkdir(directory, { recursive: true });
+    try {
+        await writeFile(temporaryPath, content, { encoding: 'utf8', flag: 'wx' });
+        await rename(temporaryPath, configPath);
+    }
+    finally {
+        await unlink(temporaryPath).catch(() => undefined);
+    }
 }
 export async function mergeAndWriteConfig(repoRoot, adapter = 'cursor') {
     const layout = getAdapterLayout(adapter);