@guilz-dev/belay 0.9.3 → 0.10.0

package/dist/core/egress-approval.js

@@ -1,8 +1,6 @@
 import { randomUUID } from 'node:crypto';
 import { compactApprovals, createApprovalRecord } from './approval.js';
-import { issueApprovalToken } from './approval-token.js';
 import { mutateApprovalStateWithRetry } from './capability/approval-state-mutation.js';
-import { configuredControlPlaneDir } from './config.js';
 import { addDomainToAllowlist, mutateEgressAllowlist } from './egress/allowlist.js';
 import { parseHostFromSummary } from './egress/fingerprint.js';
 import { notifyDeny } from './notify.js';
@@ -65,28 +63,12 @@ export async function notifyEgressDeny(params) {
     if (!params.config.notifications.webhookUrl && !params.config.notifications.commandHook) {
         return;
     }
-    let approvalToken;
-    if (params.config.approvalSigning.required) {
-        try {
-            approvalToken = await issueApprovalToken({
-                approvalId: params.approval.approvalId,
-                fingerprint: params.approval.fingerprint,
-                repoRoot: params.approval.repoRoot,
-                issuedAt: params.approval.createdAt,
-                expiresAt: params.approval.expiresAt,
-            }, configuredControlPlaneDir(params.config));
-        }
-        catch {
-            approvalToken = undefined;
-        }
-    }
     await notifyDeny(params.config.notifications, {
         approvalId: params.approval.approvalId,
         reason: params.policyResult.reason,
         summary: params.policyResult.summary,
         repoRoot: params.repoRoot,
         fingerprint: params.policyResult.fingerprint,
-        approvalToken,
     });
 }
 export async function recordEgressApproval(params) {

package/dist/core/glob.js

@@ -1,26 +1,42 @@
+import { escapeRegex } from './approval.js';
+function globPatternToRegexSource(pattern) {
+    let result = '';
+    let index = 0;
+    while (index < pattern.length) {
+        const char = pattern[index];
+        if (char === '*' && pattern[index + 1] === '*') {
+            index += 2;
+            if (pattern[index] === '/') {
+                result += '(?:.*/)?';
+                index += 1;
+            }
+            else {
+                result += '.*';
+            }
+            continue;
+        }
+        if (char === '*') {
+            result += '[^/]*';
+            index += 1;
+            continue;
+        }
+        result += escapeRegex(char);
+        index += 1;
+    }
+    return result;
+}
+function globPatternMatches(pattern, normalized, baseName) {
+    const regex = new RegExp(`^${globPatternToRegexSource(pattern)}$`);
+    return regex.test(normalized) || regex.test(baseName);
+}
 export function matchesSensitivePath(filePath, patterns) {
     const normalized = filePath.replaceAll('\\', '/');
     const segments = normalized.split('/');
     const baseName = segments.at(-1) ?? normalized;
     for (const pattern of patterns) {
         const normalizedPattern = pattern.replaceAll('\\', '/');
-        if (normalizedPattern.includes('**')) {
-            const parts = normalizedPattern.split('**').map((part) => part.replace(/^\/+|\/+$/g, ''));
-            const prefix = parts[0]?.replace(/\/+$/, '') ?? '';
-            const suffix = parts[1]?.replace(/^\/+/, '') ?? '';
-            if (prefix && !normalized.startsWith(prefix)) {
-                continue;
-            }
-            if (suffix && !normalized.includes(suffix)) {
-                continue;
-            }
-            if (prefix || suffix) {
-                return true;
-            }
-        }
         if (normalizedPattern.includes('*')) {
-            const regex = new RegExp(`^${normalizedPattern.replaceAll('.', '\\.').replaceAll('*', '.*')}$`);
-            if (regex.test(normalized) || regex.test(baseName)) {
+            if (globPatternMatches(normalizedPattern, normalized, baseName)) {
                 return true;
             }
             continue;

package/dist/core/integrity.d.ts

@@ -8,9 +8,9 @@ export interface IntegrityManifest {
 }
 export declare function sha256File(filePath: string): Promise<string>;
 export declare function integrityManifestPath(layout: AdapterLayout, repoRoot: string): string;
-export declare function runtimeIntegrityFiles(_layout: AdapterLayout, paths: ScopedPaths): string[];
+export declare function runtimeIntegrityFiles(layout: AdapterLayout, paths: ScopedPaths): string[];
 export declare function writeIntegrityManifest(repoRoot: string, layout: AdapterLayout, filePaths: string[]): Promise<void>;
-export declare function verifyIntegrityManifest(repoRoot: string, layout: AdapterLayout): Promise<{
+export declare function verifyIntegrityManifest(repoRoot: string, layout: AdapterLayout, requiredFilePaths?: string[]): Promise<{
     ok: boolean;
     mismatches: string[];
 }>;

package/dist/core/integrity.js

@@ -3,8 +3,24 @@ import { existsSync } from 'node:fs';
 import { mkdir, readFile, writeFile } from 'node:fs/promises';
 import path from 'node:path';
 import { getAdapterLayout } from '../adapters/layouts/index.js';
-import { resolveScopedPaths } from '../adapters/layouts/scope.js';
+import { isPathInside, resolveScopedPaths } from '../adapters/layouts/scope.js';
 import { resolveAdapterName } from '../config-io.js';
+const GLOBAL_INTEGRITY_PREFIX = '@global/';
+function portableRelativePath(from, to) {
+    return path.relative(from, to).split(path.sep).join('/');
+}
+function integrityManifestFileKey(repoRoot, layout, filePath) {
+    const absolutePath = path.resolve(filePath);
+    if (isPathInside(absolutePath, repoRoot)) {
+        return portableRelativePath(repoRoot, absolutePath);
+    }
+    const globalPaths = resolveScopedPaths(layout, 'global', repoRoot);
+    const globalAgentDir = path.dirname(globalPaths.hooksSettingsPath);
+    if (isPathInside(absolutePath, globalAgentDir)) {
+        return `${GLOBAL_INTEGRITY_PREFIX}${portableRelativePath(globalAgentDir, absolutePath)}`;
+    }
+    throw new Error(`Integrity file is outside the repository and global adapter root: ${filePath}`);
+}
 export async function sha256File(filePath) {
     const content = await readFile(filePath);
     return createHash('sha256').update(content).digest('hex');
@@ -12,11 +28,8 @@ export async function sha256File(filePath) {
 export function integrityManifestPath(layout, repoRoot) {
     return path.join(layout.repoLocalStateDir(repoRoot), 'integrity-manifest.json');
 }
-export function runtimeIntegrityFiles(_layout, paths) {
+export function runtimeIntegrityFiles(layout, paths) {
     const files = [paths.configPath];
-    if (paths.scope !== 'project') {
-        return files;
-    }
     const hooksDir = paths.hooksDir;
     const runtimeDir = paths.runtimeDir;
     return [
@@ -28,7 +41,9 @@ export function runtimeIntegrityFiles(_layout, paths) {
         path.join(hooksDir, 'belay-audit.mjs'),
         path.join(hooksDir, 'belay-runner'),
         path.join(hooksDir, 'belay-runner.cmd'),
+        ...(layout.name === 'cursor' ? [path.join(hooksDir, 'belay-runner.ps1')] : []),
         path.join(runtimeDir, 'core.mjs'),
+        ...(layout.name === 'cursor' ? [path.join(runtimeDir, 'dispatcher.mjs')] : []),
     ];
 }
 export async function writeIntegrityManifest(repoRoot, layout, filePaths) {
@@ -37,8 +52,8 @@ export async function writeIntegrityManifest(repoRoot, layout, filePaths) {
         if (!existsSync(filePath)) {
             continue;
         }
-        const relativePath = path.relative(repoRoot, filePath);
-        files[relativePath] = await sha256File(filePath);
+        const manifestKey = integrityManifestFileKey(repoRoot, layout, filePath);
+        files[manifestKey] = await sha256File(filePath);
     }
     const manifest = {
         version: 1,
@@ -49,22 +64,47 @@ export async function writeIntegrityManifest(repoRoot, layout, filePaths) {
     await mkdir(path.dirname(manifestPath), { recursive: true });
     await writeFile(manifestPath, `${JSON.stringify(manifest, null, 2)}\n`, 'utf8');
 }
-export async function verifyIntegrityManifest(repoRoot, layout) {
+export async function verifyIntegrityManifest(repoRoot, layout, requiredFilePaths = []) {
     const manifestPath = integrityManifestPath(layout, repoRoot);
     if (!existsSync(manifestPath)) {
         return { ok: false, mismatches: ['missing integrity-manifest.json'] };
     }
     const manifest = JSON.parse(await readFile(manifestPath, 'utf8'));
     const mismatches = [];
-    for (const [relativePath, expectedHash] of Object.entries(manifest.files ?? {})) {
-        const absolutePath = path.join(repoRoot, relativePath);
+    const requiredPathsByKey = new Map(requiredFilePaths.map((requiredPath) => [
+        integrityManifestFileKey(repoRoot, layout, requiredPath),
+        path.resolve(requiredPath),
+    ]));
+    for (const requiredPath of requiredFilePaths) {
+        const requiredKey = integrityManifestFileKey(repoRoot, layout, requiredPath);
+        if (!Object.hasOwn(manifest.files ?? {}, requiredKey)) {
+            mismatches.push(`missing integrity pin ${requiredKey}`);
+        }
+    }
+    for (const [manifestKey, expectedHash] of Object.entries(manifest.files ?? {})) {
+        let absolutePath;
+        if (manifestKey.startsWith(GLOBAL_INTEGRITY_PREFIX)) {
+            const requiredPath = requiredPathsByKey.get(manifestKey);
+            if (!requiredPath) {
+                mismatches.push(`unrecognized global integrity pin ${manifestKey}`);
+                continue;
+            }
+            absolutePath = requiredPath;
+        }
+        else {
+            absolutePath = path.resolve(repoRoot, manifestKey);
+            if (!isPathInside(absolutePath, repoRoot)) {
+                mismatches.push(`integrity pin escapes repository ${manifestKey}`);
+                continue;
+            }
+        }
         if (!existsSync(absolutePath)) {
-            mismatches.push(`missing ${relativePath}`);
+            mismatches.push(`missing ${manifestKey}`);
             continue;
         }
         const actualHash = await sha256File(absolutePath);
         if (actualHash !== expectedHash) {
-            mismatches.push(`hash mismatch ${relativePath}`);
+            mismatches.push(`hash mismatch ${manifestKey}`);
         }
     }
     return { ok: mismatches.length === 0, mismatches };

package/dist/core/notify.d.ts

@@ -8,6 +8,12 @@ export interface DenyNotificationEvent {
     summary: string;
     repoRoot: string;
     fingerprint: string;
-    approvalToken?: string;
 }
-export declare function notifyDeny(config: DenyNotificationConfig, event: DenyNotificationEvent): Promise<void>;
+export interface NotifyDependencies {
+    fetch: typeof globalThis.fetch;
+    execFile: (file: string, args: readonly string[], options: {
+        env: NodeJS.ProcessEnv;
+    }) => Promise<unknown>;
+}
+export declare function notificationConfigIssues(config: DenyNotificationConfig, repoRoot: string): string[];
+export declare function notifyDeny(config: DenyNotificationConfig, event: DenyNotificationEvent, deps?: NotifyDependencies): Promise<void>;

package/dist/core/notify.js

@@ -1,14 +1,69 @@
 import { execFile } from 'node:child_process';
+import path from 'node:path';
 import { promisify } from 'node:util';
+import { canonicalPath, pathWithinRoot } from './path-utils.js';
 const execFileAsync = promisify(execFile);
-export async function notifyDeny(config, event) {
-    const payload = JSON.stringify(event);
+const LOOPBACK_WEBHOOK_HOSTS = new Set(['localhost', '127.0.0.1', '::1']);
+function webhookConfigIssue(url) {
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        return `notifications.webhookUrl is invalid: ${url}`;
+    }
+    if (parsed.protocol === 'https:') {
+        return null;
+    }
+    const normalizedHostname = parsed.hostname.toLowerCase().replace(/^\[|\]$/g, '');
+    if (parsed.protocol === 'http:' && LOOPBACK_WEBHOOK_HOSTS.has(normalizedHostname)) {
+        return null;
+    }
+    return `notifications.webhookUrl must use https (http is allowed only for localhost, 127.0.0.1, or ::1): ${url}`;
+}
+function commandHookConfigIssue(commandHook, repoRoot) {
+    if (!path.isAbsolute(commandHook)) {
+        return `notifications.commandHook must be an absolute path: ${commandHook}`;
+    }
+    if (pathWithinRoot(canonicalPath(repoRoot), canonicalPath(commandHook))) {
+        return `notifications.commandHook must not be inside the repository: ${commandHook}`;
+    }
+    return null;
+}
+export function notificationConfigIssues(config, repoRoot) {
+    const issues = [];
     if (config.webhookUrl) {
+        const issue = webhookConfigIssue(config.webhookUrl);
+        if (issue) {
+            issues.push(issue);
+        }
+    }
+    if (config.commandHook) {
+        const issue = commandHookConfigIssue(config.commandHook, repoRoot);
+        if (issue) {
+            issues.push(issue);
+        }
+    }
+    return issues;
+}
+export async function notifyDeny(config, event, deps = {
+    fetch: globalThis.fetch.bind(globalThis),
+    execFile: (file, args, options) => execFileAsync(file, [...args], options),
+}) {
+    const payload = JSON.stringify({
+        approvalId: event.approvalId,
+        reason: event.reason,
+        summary: event.summary,
+        repoRoot: event.repoRoot,
+        fingerprint: event.fingerprint,
+    });
+    const webhookIssue = config.webhookUrl ? webhookConfigIssue(config.webhookUrl) : null;
+    if (config.webhookUrl && !webhookIssue) {
         try {
             const controller = new AbortController();
             const timeout = setTimeout(() => controller.abort(), 5000);
             try {
-                await fetch(config.webhookUrl, {
+                await deps.fetch(config.webhookUrl, {
                     method: 'POST',
                     headers: { 'content-type': 'application/json' },
                     body: payload,
@@ -23,17 +78,18 @@ export async function notifyDeny(config, event) {
             // best-effort notification
         }
     }
-    if (config.commandHook) {
+    const commandHookIssue = config.commandHook
+        ? commandHookConfigIssue(config.commandHook, event.repoRoot)
+        : null;
+    if (config.commandHook && !commandHookIssue) {
         try {
-            await execFileAsync(config.commandHook, [], {
+            await deps.execFile(config.commandHook, [], {
                 env: {
-                    ...process.env,
                     BELAY_APPROVAL_ID: event.approvalId,
                     BELAY_REASON: event.reason,
                     BELAY_SUMMARY: event.summary,
                     BELAY_REPO_ROOT: event.repoRoot,
                     BELAY_FINGERPRINT: event.fingerprint,
-                    BELAY_APPROVAL_TOKEN: event.approvalToken ?? '',
                 },
             });
         }

package/dist/core/recovery/operator-guidance.js

@@ -3,13 +3,13 @@ export function recoveryNotificationConfigured(config) {
 }
 export function recoveryApprovalSetupNotes() {
     return [
-        'Recovery restore flow: run `belay recover apply <checkpoint-id>`, approve with `belay approve <approval-id> --token <signed-token>`, then run the same apply command again.',
-        'Recovery restore always requires a signed out-of-band token, even when approvalSigning.required is false for general approvals.',
+        'Recovery restore flow: run `belay recover apply <checkpoint-id>`, retrieve the token locally with `belay approval-token <approval-id>`, approve with `belay approve <approval-id> --token <signed-token>`, then run the same apply command again.',
+        'Recovery restore always requires a signed local-control-plane token, even when approvalSigning.required is false for general approvals.',
     ];
 }
 export function recoveryNotificationSetupWarning() {
-    return ('Recovery checkpoint restore requires a signed out-of-band approval token, but no notification channel is configured. ' +
-        'Set notifications.webhookUrl or notifications.commandHook (e.g. via `belay config`) so `belay recover apply` can deliver the token.');
+    return ('No notification channel is configured, so recovery approval alerts are shown only by the local CLI. ' +
+        'Optionally set notifications.webhookUrl or notifications.commandHook (e.g. via `belay config`) to receive approval IDs out of band.');
 }
 export function formatRecoveryStateDiagnostic(state, detail) {
     switch (state) {

package/dist/core/replay-scrub.d.ts

@@ -3,6 +3,8 @@ import type { ScrubOptions } from './types.js';
 export declare function redactToolInvocationId(value: unknown, rawToolUseId?: string): unknown;
 /** Subagent fingerprint input — must match classify-subagent `fingerprintSource`. */
 export declare function subagentFingerprintSource(payload: Record<string, unknown>, scrubOptions: ScrubOptions): unknown;
+/** Stable tool-input source for fingerprints — redacts volatile ids only, not secret values. */
+export declare function fingerprintToolInputSource(payload: Record<string, unknown>): Record<string, unknown>;
 /**
  * Scrubbed payload used for replay envelope hashing — aligned with classifier fingerprints.
  * Tool: scrubbed `tool_input`. Subagent: description/prompt subset. Other: full payload.

package/dist/core/replay-scrub.js

@@ -40,6 +40,14 @@ export function subagentFingerprintSource(payload, scrubOptions) {
     }
     return scrubValue(payload, scrubOptions);
 }
+/** Stable tool-input source for fingerprints — redacts volatile ids only, not secret values. */
+export function fingerprintToolInputSource(payload) {
+    const toolInput = payload.tool_input;
+    if (!toolInput || typeof toolInput !== 'object') {
+        return {};
+    }
+    return redactToolInvocationId(toolInput, typeof payload.tool_use_id === 'string' ? payload.tool_use_id : undefined);
+}
 /**
  * Scrubbed payload used for replay envelope hashing — aligned with classifier fingerprints.
  * Tool: scrubbed `tool_input`. Subagent: description/prompt subset. Other: full payload.

package/dist/core/repo-config-trust.d.ts

@@ -0,0 +1,31 @@
+import type { AdapterName } from '../types.js';
+export interface RepoConfigTrustRecordV1 {
+    schemaVersion: 1;
+    repoRoot: string;
+    adapter: 'cursor' | 'claude' | 'codex';
+    repoConfigFingerprint: string;
+    trustedAt: string;
+}
+export type RepoConfigTrustStatus = {
+    trusted: true;
+    recordPath: string;
+    fingerprint: string;
+} | {
+    trusted: false;
+    recordPath: string;
+    reason: 'missing' | 'malformed' | 'identity_mismatch' | 'fingerprint_mismatch';
+};
+export declare function repoConfigFingerprint(rawConfig: unknown): string;
+export declare function repoConfigTrustPath(repoRoot: string, adapter: AdapterName): string;
+export declare function inspectRepoConfigTrust(repoRoot: string, adapter: AdapterName, rawConfig: unknown): Promise<RepoConfigTrustStatus>;
+export declare function trustRepoConfig(repoRoot: string, adapter: AdapterName, rawConfig: unknown): Promise<RepoConfigTrustRecordV1>;
+export declare class RepoConfigTrustError extends Error {
+    readonly status: Exclude<RepoConfigTrustStatus, {
+        trusted: true;
+    }>;
+    constructor(status: Exclude<RepoConfigTrustStatus, {
+        trusted: true;
+    }>);
+}
+export declare function isRepoConfigTrustError(error: unknown): error is RepoConfigTrustError;
+export declare function assertRepoConfigTrusted(repoRoot: string, adapter: AdapterName, rawConfig: unknown): Promise<void>;

package/dist/core/repo-config-trust.js

@@ -0,0 +1,152 @@
+import { randomUUID } from 'node:crypto';
+import { existsSync } from 'node:fs';
+import { chmod, mkdir, open, readFile, rename, unlink } from 'node:fs/promises';
+import path from 'node:path';
+import { defaultControlPlaneDir } from './config.js';
+import { canonicalStringify, hashValue } from './fingerprint.js';
+import { canonicalPath } from './path-utils.js';
+const TRUST_MESSAGE = 'Repository config is not trusted. Review it, then run `belay config trust`.';
+function isObjectRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function hasOnlyExpectedKeys(value) {
+    const expected = new Set([
+        'schemaVersion',
+        'repoRoot',
+        'adapter',
+        'repoConfigFingerprint',
+        'trustedAt',
+    ]);
+    const keys = Object.keys(value);
+    if (keys.length !== expected.size) {
+        return false;
+    }
+    return keys.every((key) => expected.has(key));
+}
+function isAdapterName(value) {
+    return value === 'cursor' || value === 'claude' || value === 'codex';
+}
+function isIsoTimestamp(value) {
+    return Number.isFinite(Date.parse(value));
+}
+function parseStrictTrustRecord(value) {
+    if (!isObjectRecord(value) || !hasOnlyExpectedKeys(value)) {
+        return null;
+    }
+    if (value.schemaVersion !== 1) {
+        return null;
+    }
+    if (typeof value.repoRoot !== 'string' || value.repoRoot.trim().length === 0) {
+        return null;
+    }
+    if (!isAdapterName(value.adapter)) {
+        return null;
+    }
+    if (typeof value.repoConfigFingerprint !== 'string' ||
+        !/^[a-f0-9]{64}$/.test(value.repoConfigFingerprint)) {
+        return null;
+    }
+    if (typeof value.trustedAt !== 'string' || !isIsoTimestamp(value.trustedAt)) {
+        return null;
+    }
+    return {
+        schemaVersion: 1,
+        repoRoot: value.repoRoot,
+        adapter: value.adapter,
+        repoConfigFingerprint: value.repoConfigFingerprint,
+        trustedAt: value.trustedAt,
+    };
+}
+export function repoConfigFingerprint(rawConfig) {
+    return hashValue(canonicalStringify(rawConfig));
+}
+export function repoConfigTrustPath(repoRoot, adapter) {
+    const canonicalRepoRoot = canonicalPath(repoRoot);
+    const identity = hashValue(`${canonicalRepoRoot}\u0000${adapter}`);
+    return path.join(defaultControlPlaneDir(), 'config-trust', `${identity}.json`);
+}
+async function writeTrustRecordAtomically(recordPath, record) {
+    const directory = path.dirname(recordPath);
+    await mkdir(directory, { recursive: true, mode: 0o700 });
+    await chmod(directory, 0o700).catch(() => undefined);
+    const tempPath = path.join(directory, `.${path.basename(recordPath)}.${process.pid}.${randomUUID()}.tmp`);
+    let handle = null;
+    try {
+        handle = await open(tempPath, 'wx', 0o600);
+        await handle.writeFile(`${JSON.stringify(record, null, 2)}\n`, 'utf8');
+        await handle.sync();
+        await handle.close();
+        handle = null;
+        await rename(tempPath, recordPath);
+        await chmod(recordPath, 0o600);
+        const directoryHandle = await open(directory, 'r');
+        try {
+            await directoryHandle.sync().catch(() => undefined);
+        }
+        finally {
+            await directoryHandle.close();
+        }
+    }
+    finally {
+        if (handle) {
+            await handle.close().catch(() => undefined);
+        }
+        await unlink(tempPath).catch(() => undefined);
+    }
+}
+export async function inspectRepoConfigTrust(repoRoot, adapter, rawConfig) {
+    const canonicalRepoRoot = canonicalPath(repoRoot);
+    const recordPath = repoConfigTrustPath(repoRoot, adapter);
+    if (!existsSync(recordPath)) {
+        return { trusted: false, recordPath, reason: 'missing' };
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(await readFile(recordPath, 'utf8'));
+    }
+    catch {
+        return { trusted: false, recordPath, reason: 'malformed' };
+    }
+    const record = parseStrictTrustRecord(parsed);
+    if (!record) {
+        return { trusted: false, recordPath, reason: 'malformed' };
+    }
+    if (record.adapter !== adapter || canonicalPath(record.repoRoot) !== canonicalRepoRoot) {
+        return { trusted: false, recordPath, reason: 'identity_mismatch' };
+    }
+    const fingerprint = repoConfigFingerprint(rawConfig);
+    if (record.repoConfigFingerprint !== fingerprint) {
+        return { trusted: false, recordPath, reason: 'fingerprint_mismatch' };
+    }
+    return { trusted: true, recordPath, fingerprint };
+}
+export async function trustRepoConfig(repoRoot, adapter, rawConfig) {
+    const recordPath = repoConfigTrustPath(repoRoot, adapter);
+    const record = {
+        schemaVersion: 1,
+        repoRoot: canonicalPath(repoRoot),
+        adapter,
+        repoConfigFingerprint: repoConfigFingerprint(rawConfig),
+        trustedAt: new Date().toISOString(),
+    };
+    await writeTrustRecordAtomically(recordPath, record);
+    return record;
+}
+export class RepoConfigTrustError extends Error {
+    status;
+    constructor(status) {
+        super(TRUST_MESSAGE);
+        this.name = 'RepoConfigTrustError';
+        this.status = status;
+    }
+}
+export function isRepoConfigTrustError(error) {
+    return error instanceof RepoConfigTrustError;
+}
+export async function assertRepoConfigTrusted(repoRoot, adapter, rawConfig) {
+    const status = await inspectRepoConfigTrust(repoRoot, adapter, rawConfig);
+    if (status.trusted) {
+        return;
+    }
+    throw new RepoConfigTrustError(status);
+}

package/dist/core/shell-substitution.js

@@ -16,7 +16,7 @@ export function findCommandSubstitutions(command) {
             index += 1;
             continue;
         }
-        if (char === '\\' && (inSingle || inDouble)) {
+        if (char === '\\' && inDouble) {
             escaping = true;
             index += 1;
             continue;
@@ -156,7 +156,7 @@ function extractBalancedParenContent(command, start) {
             index += 1;
             continue;
         }
-        if (char === '\\' && (inSingle || inDouble)) {
+        if (char === '\\' && inDouble) {
             escaping = true;
             index += 1;
             continue;

package/dist/core/shell-unparseable.js

@@ -42,7 +42,9 @@ function hasUnclosedQuote(command) {
             continue;
         }
         if (char === '\\') {
-            escaping = true;
+            if (quote !== "'") {
+                escaping = true;
+            }
             continue;
         }
         if (quote) {

package/dist/corpus/benign-probe-cores.d.ts

@@ -3,4 +3,4 @@
  * These commands guard classifier availability in tests and never grant runtime authority.
  * @see src/__tests__/verdict/structural-suite.test.ts
  */
-export declare const BENIGN_PROBE_CORES: readonly ["npm test", "npm run build", "pnpm test", "pnpm build", "pnpm vitest run src/example.test.ts", "bash -lc 'git status'", "belay approve belay_deadbeef1234", "bundle -v", "ruby -v", "yarn --version", "make -n test", "bin/rails routes", "bundle exec rubocop --version", "bundle exec rubocop test/upgrade_script_contract_test.rb", "ruby -Itest test/upgrade_script_contract_test.rb"];
+export declare const BENIGN_PROBE_CORES: readonly ["npm test", "npm run build", "pnpm test", "pnpm build", "pnpm vitest run src/example.test.ts", "bash -lc 'git status'", "bundle -v", "ruby -v", "yarn --version", "make -n test", "bin/rails routes", "bundle exec rubocop --version", "bundle exec rubocop test/upgrade_script_contract_test.rb", "ruby -Itest test/upgrade_script_contract_test.rb"];

package/dist/corpus/benign-probe-cores.js

@@ -10,7 +10,6 @@ export const BENIGN_PROBE_CORES = [
     'pnpm build',
     'pnpm vitest run src/example.test.ts',
     "bash -lc 'git status'",
-    'belay approve belay_deadbeef1234',
     'bundle -v',
     'ruby -v',
     'yarn --version',

package/dist/defaults.d.ts

@@ -5,13 +5,17 @@ export type ManagedHookDefinition = {
     command: string;
     placement: 'prepend' | 'append';
     matcher?: string;
+    failClosed?: boolean;
 };
-export declare function getManagedHookEntries(platform?: NodeJS.Platform, hooksDir?: string, repoRoot?: string): Array<{
+export type CursorManagedHookDefinition = ManagedHookDefinition & {
+    failClosed: true;
+};
+export declare function getManagedHookEntries(platform?: NodeJS.Platform, hooksDir?: string, repoRoot?: string, runnerPathMode?: 'absolute' | 'legacy-relative' | 'legacy-absolute' | 'legacy-quoted-absolute' | 'legacy-bare-powershell-absolute'): Array<{
     event: string;
-    definition: ManagedHookDefinition;
+    definition: CursorManagedHookDefinition;
 }>;
 /** @deprecated Use getManagedHookEntries instead. */
-export declare function getManagedHookEvents(platform?: NodeJS.Platform): Record<string, ManagedHookDefinition>;
+export declare function getManagedHookEvents(platform?: NodeJS.Platform): Record<string, CursorManagedHookDefinition>;
 export declare const EMPTY_APPROVALS: {
     readonly version: 1;
     readonly approvals: readonly [];