@guilz-dev/belay 0.9.3 → 0.10.0

package/dist/commands/dogfood-check.js

@@ -0,0 +1,116 @@
+import path from 'node:path';
+import { getAdapterLayout } from '../adapters/layouts/index.js';
+import { detectAdapterName, loadConfigFile } from '../config-io.js';
+import { isGateRecord, parseTimestamp } from '../core/audit-query.js';
+import { summarizeAuditVisibility } from '../core/audit-summary.js';
+import { detectUndogfoodedLinkedWorktrees } from '../core/dogfood-environment.js';
+import { matchesAuditCohort, resolveActiveAuditCohort } from '../runtime-provenance.js';
+import { loadAuditRecords } from './audit.js';
+function isDogfoodMode(config) {
+    return config.mode === 'audit' && config.policy?.unknownLocalEffect === 'deny';
+}
+function baseResult(repoRoot, since) {
+    return {
+        ok: false,
+        repoRoot,
+        since,
+        gateEvents: 0,
+        auditModeDenyCount: 0,
+        hostDeniedAfterAllowCount: 0,
+        shellPreToolUseCount: 0,
+        mismatchedCohortCount: 0,
+        environmentSkewCount: 0,
+        failures: [],
+    };
+}
+export async function checkDogfoodProject(options) {
+    const repoRoot = path.resolve(options.targetDir ?? process.cwd());
+    const since = options.since;
+    const result = baseResult(repoRoot, since);
+    const sinceMs = parseTimestamp(since);
+    if (sinceMs === null) {
+        result.failures.push('invalid_since');
+        return result;
+    }
+    const adapter = options.adapter ?? detectAdapterName(repoRoot);
+    const config = await loadConfigFile(repoRoot, adapter);
+    const dogfoodActive = isDogfoodMode(config);
+    if (!dogfoodActive) {
+        result.failures.push('dogfood_inactive');
+    }
+    const records = await loadAuditRecords(repoRoot, adapter);
+    const invalidTimestampRecord = records.some((record) => parseTimestamp(record.timestamp) === null);
+    if (invalidTimestampRecord) {
+        result.failures.push('invalid_timestamp_record');
+    }
+    const inWindowRecords = records.filter((record) => {
+        const recordMs = parseTimestamp(record.timestamp);
+        return recordMs !== null && recordMs >= sinceMs;
+    });
+    const activeCohort = await resolveActiveAuditCohort(repoRoot, config);
+    const inWindowGateRecords = inWindowRecords.filter((record) => isGateRecord(record));
+    let cohortGateRecords = inWindowGateRecords;
+    let cohortScopedRecords = inWindowRecords;
+    if (activeCohort) {
+        cohortGateRecords = inWindowGateRecords.filter((record) => matchesAuditCohort(record, activeCohort));
+        const cohortEventRecords = new Set(cohortGateRecords);
+        cohortScopedRecords = inWindowRecords.filter((record) => !isGateRecord(record) || cohortEventRecords.has(record));
+        result.mismatchedCohortCount = inWindowGateRecords.length - cohortGateRecords.length;
+    }
+    else {
+        result.mismatchedCohortCount = inWindowGateRecords.length;
+        if (inWindowGateRecords.length > 0) {
+            result.failures.push('active_cohort_unavailable');
+        }
+    }
+    result.gateEvents = cohortGateRecords.length;
+    result.auditModeDenyCount = cohortGateRecords.filter((record) => record.mode === 'audit' && record.permission === 'deny').length;
+    result.shellPreToolUseCount = cohortGateRecords.filter((record) => record.kind === 'shell' && record.event === 'preToolUse').length;
+    result.hostDeniedAfterAllowCount =
+        summarizeAuditVisibility(cohortScopedRecords).hostDeniedAfterAllowCount;
+    if (result.gateEvents === 0) {
+        result.failures.push('no_gate_events_since_cutoff');
+    }
+    if (result.auditModeDenyCount > 0) {
+        result.failures.push('audit_mode_permission_deny');
+    }
+    if (result.hostDeniedAfterAllowCount > 0) {
+        result.failures.push('host_denied_after_allow');
+    }
+    if (result.shellPreToolUseCount > 0) {
+        result.failures.push('shell_event_recorded_as_preToolUse');
+    }
+    if (result.mismatchedCohortCount > 0) {
+        result.failures.push('mismatched_active_cohort');
+    }
+    if (dogfoodActive) {
+        const environmentWarnings = await detectUndogfoodedLinkedWorktrees({
+            repoRoot,
+            adapterName: adapter,
+            layout: getAdapterLayout(adapter),
+        });
+        result.environmentSkewCount = environmentWarnings.length;
+        if (result.environmentSkewCount > 0) {
+            result.failures.push('environment_skew');
+        }
+    }
+    result.ok = result.failures.length === 0;
+    return result;
+}
+export function formatDogfoodCheckResult(result) {
+    const lines = [
+        `dogfood check for ${result.repoRoot}`,
+        `since: ${result.since}`,
+        `gate events: ${result.gateEvents}`,
+        `audit-mode deny count: ${result.auditModeDenyCount}`,
+        `host denied-after-allow count: ${result.hostDeniedAfterAllowCount}`,
+        `shell preToolUse count: ${result.shellPreToolUseCount}`,
+        `mismatched active cohort count: ${result.mismatchedCohortCount}`,
+        `environment skew count: ${result.environmentSkewCount}`,
+        `status: ${result.ok ? 'ok' : 'fail'}`,
+    ];
+    if (!result.ok) {
+        lines.push(`failures: ${result.failures.join(', ')}`);
+    }
+    return `${lines.join('\n')}\n`;
+}

package/dist/commands/dogfood.d.ts

@@ -2,4 +2,5 @@ import { isDogfoodConfig, loadOperationalInsights } from '../operational-insight
 import type { DogfoodOptions, DogfoodResult } from '../types.js';
 export declare function dogfoodProject(options?: DogfoodOptions): Promise<DogfoodResult>;
 export declare function formatDogfoodResult(result: DogfoodResult): string;
+export { checkDogfoodProject, formatDogfoodCheckResult } from './dogfood-check.js';
 export { isDogfoodConfig, loadOperationalInsights };

package/dist/commands/dogfood.js

@@ -1,5 +1,5 @@
 import path from 'node:path';
-import { configPathFor, loadConfigFile, writeConfigFile } from '../config-io.js';
+import { configPathFor, loadConfigFile, writeTrustedConfigFile } from '../config-io.js';
 import { mergeConfig } from '../core/config.js';
 import { isDogfoodConfig, loadOperationalInsights } from '../operational-insights.js';
 import { metricsProject } from './metrics.js';
@@ -19,7 +19,7 @@ export async function dogfoodProject(options = {}) {
             unknownLocalEffect: 'deny',
         },
     });
-    await writeConfigFile(repoRoot, updated, adapter);
+    await writeTrustedConfigFile(repoRoot, updated, adapter);
     return {
         ok: true,
         repoRoot,
@@ -53,7 +53,7 @@ async function promoteDogfoodToEnforce(repoRoot, configPath, force, adapter = 'c
         ...existing,
         mode: 'enforce',
     });
-    await writeConfigFile(repoRoot, updated, adapter);
+    await writeTrustedConfigFile(repoRoot, updated, adapter);
     return {
         ok: true,
         repoRoot,
@@ -68,4 +68,5 @@ async function promoteDogfoodToEnforce(repoRoot, configPath, force, adapter = 'c
 export function formatDogfoodResult(result) {
     return `${result.message}\n`;
 }
+export { checkDogfoodProject, formatDogfoodCheckResult } from './dogfood-check.js';
 export { isDogfoodConfig, loadOperationalInsights };

package/dist/commands/health-snapshot.js

@@ -51,16 +51,21 @@ async function managedHooksPresent(adapter, hooksPath, hooksDir, repoRoot) {
 /** Cursor modes confirmed not to apply host-level denial after Belay allows. */
 const CURSOR_APPROVAL_MODES_WITHOUT_HOST_DENIAL = new Set(['unrestricted']);
 export function cursorCliConfigPaths(homeDir, env) {
+    const candidates = [];
+    const addCandidate = (candidate) => {
+        if (!candidates.includes(candidate)) {
+            candidates.push(candidate);
+        }
+    };
     const cursorConfigDir = env.CURSOR_CONFIG_DIR?.trim();
     if (cursorConfigDir) {
-        return [path.join(cursorConfigDir, 'cli-config.json')];
+        addCandidate(path.join(cursorConfigDir, 'cli-config.json'));
     }
-    const candidates = [];
     const xdgConfigHome = env.XDG_CONFIG_HOME?.trim();
     if (xdgConfigHome) {
-        candidates.push(path.join(xdgConfigHome, 'cursor', 'cli-config.json'));
+        addCandidate(path.join(xdgConfigHome, 'cursor', 'cli-config.json'));
     }
-    candidates.push(path.join(homeDir, '.cursor', 'cli-config.json'));
+    addCandidate(path.join(homeDir, '.cursor', 'cli-config.json'));
     return candidates;
 }
 export function cursorApprovalModeRequiresHostDenialWarning(approvalMode) {

package/dist/commands/judge.js

@@ -1,7 +1,7 @@
 import path from 'node:path';
 import { stdin as input, stdout as output } from 'node:process';
 import { createInterface } from 'node:readline/promises';
-import { configPathFor, loadApprovalState, loadConfigFile, repoLocalStateDirFor, resolveAdapterName, writeConfigFile, } from '../config-io.js';
+import { configPathFor, loadApprovalState, loadConfigFile, repoLocalStateDirFor, resolveAdapterName, writeTrustedConfigFile, } from '../config-io.js';
 import { appendCliAuditEvent } from '../core/audit-io.js';
 import { JUDGE_CLOUD_CONSENT_REASON } from '../core/capability/reasons.js';
 import { belayStateDir, normalizeJudgeConfig } from '../core/config.js';
@@ -176,7 +176,7 @@ export async function judgeUse(options) {
     }
     const after = normalizeJudgeConfig(patch.judge);
     const updated = { ...config, judge: after };
-    await writeConfigFile(repoRoot, updated, adapter);
+    await writeTrustedConfigFile(repoRoot, updated, adapter);
     await refreshIntegrityIfPinned(repoRoot, updated);
     await appendCliAuditEvent(repoRoot, updated, {
         event: 'judge_provider_changed',

package/dist/commands/recovery-checkpoints.d.ts

@@ -86,7 +86,7 @@ export declare function recoveryCheckpointCommand(options: {
     state: import("../core/recovery/types.js").RecoveryCheckpointStateV1;
     manifestHash: string;
     receipt: import("../core/index.js").RecoveryReceiptV1 | undefined;
-    repoRoot?: undefined;
+    readonly repoRoot?: undefined;
     backend?: undefined;
     availableBackends?: undefined;
     backendCounts?: undefined;
@@ -118,7 +118,7 @@ export declare function recoveryCheckpointCommand(options: {
     paths: string[];
     auditRecorded: boolean;
     message: string;
-    repoRoot?: undefined;
+    readonly repoRoot?: undefined;
     backend?: undefined;
     availableBackends?: undefined;
     backendCounts?: undefined;
@@ -146,7 +146,7 @@ export declare function recoveryCheckpointCommand(options: {
     subcommand: string;
     verdict: string;
     checkpointId: string;
-    repoRoot?: undefined;
+    readonly repoRoot?: undefined;
     backend?: undefined;
     availableBackends?: undefined;
     backendCounts?: undefined;

package/dist/commands/recovery-checkpoints.js

@@ -5,7 +5,6 @@ import { protectedArtifactRoots } from '../adapters/layouts/protected-paths.js';
 import { ensureBelayStateDir, loadConfigFile } from '../config-io.js';
 import { compactApprovals, createApprovalRecordWithEnvelope } from '../core/approval.js';
 import { createGateApprovalStore } from '../core/approval-service.js';
-import { issueApprovalToken } from '../core/approval-token.js';
 import { appendCliAuditEvent } from '../core/audit-io.js';
 import { mutateApprovalStateWithRetry } from '../core/capability/approval-state-mutation.js';
 import { boundarySessionStatus } from '../core/capability/boundary-session.js';
@@ -253,20 +252,12 @@ export async function recoveryCheckpointCommand(options) {
         }
         const notificationConfigured = recoveryNotificationConfigured(config);
         if (notificationConfigured) {
-            const approvalToken = await issueApprovalToken({
-                approvalId: request.approvalId,
-                fingerprint: request.fingerprint,
-                repoRoot: request.repoRoot,
-                issuedAt: request.createdAt,
-                expiresAt: request.expiresAt,
-            }, configuredControlPlaneDir(config));
             await notifyDeny(config.notifications, {
                 approvalId: request.approvalId,
                 reason: request.reason,
                 summary: request.summary,
                 repoRoot: request.repoRoot,
                 fingerprint: request.fingerprint,
-                approvalToken,
             });
         }
         const auditRecorded = await appendRecoveryAudit(repoRoot, config, {
@@ -287,8 +278,8 @@ export async function recoveryCheckpointCommand(options) {
             paths: binding.paths,
             auditRecorded,
             message: notificationConfigured
-                ? `Signed out-of-band approval required for ${request.approvalId}. Use the token delivered through the configured notification channel, then run \`belay approve ${request.approvalId} --token <signed-token>\` and repeat this command.`
-                : `${recoveryNotificationSetupWarning()} Pending approval id: ${request.approvalId}.`,
+                ? `Signed approval required for ${request.approvalId}. Run \`belay approval-token ${request.approvalId}\` locally, then \`belay approve ${request.approvalId} --token <signed-token>\`, and repeat this command.`
+                : `${recoveryNotificationSetupWarning()} Pending approval id: ${request.approvalId}. Run \`belay approval-token ${request.approvalId}\` locally to retrieve the signed token.`,
         };
     }
     try {

package/dist/config-io.d.ts

@@ -17,6 +17,7 @@ export declare function migrateControlPlaneApprovalsToRepoLocal(repoRoot: string
 export declare function loadLayeredConfig(repoRoot: string, adapter?: AdapterName): Promise<LayeredConfigResult>;
 export declare function loadConfigFile(repoRoot: string, adapter?: AdapterName): Promise<BelayConfigV3>;
 export declare function writeConfigFile(repoRoot: string, config: BelayConfigV3, adapter?: AdapterName): Promise<void>;
+export declare function writeTrustedConfigFile(repoRoot: string, config: BelayConfigV3, adapter?: AdapterName): Promise<void>;
 export declare function mergeAndWriteConfig(repoRoot: string, adapter?: AdapterName): Promise<BelayConfigV3>;
 export declare function loadApprovalState(repoRoot: string, fileName: 'pending-approvals.json' | 'approved-approvals.json', config: BelayConfigV3): Promise<ApprovalStateFile>;
 export declare function saveApprovalState(repoRoot: string, fileName: 'pending-approvals.json' | 'approved-approvals.json', state: ApprovalStateFile, config: BelayConfigV3): Promise<void>;

package/dist/config-io.js

@@ -7,6 +7,7 @@ import { compactApprovals, isExpired, mergeApprovalStates } from './core/approva
 import { mutateApprovalStateWithRetry } from './core/capability/approval-state-mutation.js';
 import { approvedApprovalsFile, belayStateDir, configuredControlPlaneDir, mergeConfig, pendingApprovalsFile, stripForbiddenShellOverrideLists, } from './core/config.js';
 import { resolveLayeredConfig, teamConfigPath, } from './core/config-layers.js';
+import { trustRepoConfig } from './core/repo-config-trust.js';
 export function resolveAdapterName(config) {
     if (config.adapter === 'claude') {
         return 'claude';
@@ -209,8 +210,23 @@ export async function loadConfigFile(repoRoot, adapter = detectAdapterName(repoR
 }
 export async function writeConfigFile(repoRoot, config, adapter = resolveAdapterName(config)) {
     const configPath = configPathFor(repoRoot, adapter);
-    await mkdir(path.dirname(configPath), { recursive: true });
-    await writeFile(configPath, `${JSON.stringify(stripForbiddenShellOverrideLists(config), null, 2)}\n`, 'utf8');
+    const directory = path.dirname(configPath);
+    const temporaryPath = path.join(directory, `.${path.basename(configPath)}.${process.pid}.${randomUUID()}.tmp`);
+    const content = `${JSON.stringify(stripForbiddenShellOverrideLists(config), null, 2)}\n`;
+    await mkdir(directory, { recursive: true });
+    try {
+        await writeFile(temporaryPath, content, { encoding: 'utf8', flag: 'wx' });
+        await rename(temporaryPath, configPath);
+    }
+    finally {
+        await unlink(temporaryPath).catch(() => undefined);
+    }
+}
+export async function writeTrustedConfigFile(repoRoot, config, adapter = resolveAdapterName(config)) {
+    await writeConfigFile(repoRoot, config, adapter);
+    const configPath = configPathFor(repoRoot, adapter);
+    const parsed = JSON.parse(await readFile(configPath, 'utf8'));
+    await trustRepoConfig(repoRoot, adapter, parsed);
 }
 export async function mergeAndWriteConfig(repoRoot, adapter = 'cursor') {
     const layout = getAdapterLayout(adapter);
@@ -220,7 +236,7 @@ export async function mergeAndWriteConfig(repoRoot, adapter = 'cursor') {
         existing = JSON.parse(await readFile(configPath, 'utf8'));
     }
     const merged = mergeConfig(existing, layout.defaultConfig(repoRoot));
-    await writeConfigFile(repoRoot, merged, adapter);
+    await writeTrustedConfigFile(repoRoot, merged, adapter);
     await ensureBelayStateDir(merged, repoRoot);
     if (merged.controlPlane.enabled) {
         await migrateRepoLocalApprovalsToControlPlane(repoRoot, merged);

package/dist/core/audit-legacy-archive.js

@@ -1,43 +1,61 @@
-import { existsSync } from 'node:fs';
-import { open, rename } from 'node:fs/promises';
+import { createReadStream, existsSync } from 'node:fs';
+import { rename } from 'node:fs/promises';
 import path from 'node:path';
+import { createInterface } from 'node:readline';
 const LEGACY_PLACEHOLDER_PATTERNS = [
     /"(?:timestamp|ts)"\s*:\s*"<timestamp>"/,
     /"(?:fingerprint|commandFingerprint|effectIRHash|payloadHash|configFingerprint|runtimeArtifactHash|decisionConfigFingerprint|receiptHash)"\s*:\s*"<high-entropy>"/,
     /"approvalId"\s*:\s*"<approval-id>"/,
 ];
-const AUDIT_SCAN_CHUNK_BYTES = 64 * 1024;
-const AUDIT_SCAN_OVERLAP_CHARS = 256;
+const LEGACY_HIGH_ENTROPY_FIELDS = [
+    'fingerprint',
+    'commandFingerprint',
+    'effectIRHash',
+    'payloadHash',
+    'configFingerprint',
+    'runtimeArtifactHash',
+    'decisionConfigFingerprint',
+    'receiptHash',
+];
 export function auditLogHasLegacyScrubPlaceholders(sample) {
-    return LEGACY_PLACEHOLDER_PATTERNS.some((pattern) => pattern.test(sample));
+    for (const line of sample.split(/\r?\n/)) {
+        const trimmed = line.trim();
+        if (!trimmed) {
+            continue;
+        }
+        try {
+            const parsed = JSON.parse(trimmed);
+            if (parsed !== null && typeof parsed === 'object' && !Array.isArray(parsed)) {
+                if (auditRecordHasLegacyCorrelationPlaceholders(parsed)) {
+                    return true;
+                }
+                continue;
+            }
+        }
+        catch {
+            // Malformed legacy lines still need archival before a new runtime appends to the log.
+        }
+        if (LEGACY_PLACEHOLDER_PATTERNS.some((pattern) => pattern.test(trimmed))) {
+            return true;
+        }
+    }
+    return false;
 }
 export function auditRecordHasLegacyCorrelationPlaceholders(record) {
     return (record.timestamp === '<timestamp>' ||
-        record.fingerprint === '<high-entropy>' ||
+        record.ts === '<timestamp>' ||
+        LEGACY_HIGH_ENTROPY_FIELDS.some((field) => record[field] === '<high-entropy>') ||
         record.approvalId === '<approval-id>');
 }
 async function auditFileHasLegacyScrubPlaceholders(auditPath) {
-    const handle = await open(auditPath, 'r');
-    const buffer = Buffer.allocUnsafe(AUDIT_SCAN_CHUNK_BYTES);
-    let carry = '';
-    let position = 0;
-    try {
-        while (true) {
-            const { bytesRead } = await handle.read(buffer, 0, buffer.length, position);
-            if (bytesRead === 0) {
-                return false;
-            }
-            const sample = carry + buffer.toString('utf8', 0, bytesRead);
-            if (auditLogHasLegacyScrubPlaceholders(sample)) {
-                return true;
-            }
-            carry = sample.slice(-AUDIT_SCAN_OVERLAP_CHARS);
-            position += bytesRead;
+    const input = createReadStream(auditPath, { encoding: 'utf8' });
+    const lines = createInterface({ input, crlfDelay: Number.POSITIVE_INFINITY });
+    for await (const line of lines) {
+        if (auditLogHasLegacyScrubPlaceholders(line)) {
+            return true;
         }
     }
-    finally {
-        await handle.close();
-    }
+    return false;
 }
 export async function archiveLegacyAuditLogIfNeeded(repoRoot, config) {
     const auditPath = path.isAbsolute(config.audit.logPath)

package/dist/core/classify-tool.js

@@ -5,6 +5,7 @@ import { evaluateFileMutationPolicy, policyDecisionRequiresAsk, } from './capabi
 import { canonicalStringify, toolFingerprint } from './fingerprint.js';
 import { matchesSensitivePath } from './glob.js';
 import { pathWithinRoot, resolveWorkspaceRootMatch } from './path-utils.js';
+import { fingerprintToolInputSource } from './replay-scrub.js';
 import { scrubValue } from './scrub.js';
 import { classifyShell, resolveClassifierTrustedCwd } from './verdict/adapter.js';
 import { isGitPath } from './verdict/containment.js';
@@ -37,6 +38,13 @@ function policyAuth(options) {
 function scrubPayload(value, options) {
     return scrubValue(value, options.scrubOptions);
 }
+function fingerprintPayload(payload, options) {
+    const toolInput = fingerprintToolInputSource(payload);
+    if (Object.keys(toolInput).length > 0) {
+        return toolInput;
+    }
+    return scrubPayload(payload.tool_input ?? {}, options);
+}
 function extractFilePath(payload) {
     const toolInput = payload.tool_input;
     if (!toolInput || typeof toolInput !== 'object') {
@@ -209,7 +217,7 @@ export async function classifyToolUse(payload, repoRoot, cwd, config, options =
                     verdict: 'deny_pending_approval',
                     reason: 'tool_shell_missing_command',
                     summary: canonicalStringify(scrubPayload(payload.tool_input ?? {}, options)),
-                    fingerprint: toolFingerprint(toolName, scrubPayload(payload.tool_input ?? {}, options), repoRoot),
+                    fingerprint: toolFingerprint(toolName, fingerprintPayload(payload, options), repoRoot),
                     assessment: {
                         reversibility: 'irreversible',
                         external: false,
@@ -223,7 +231,7 @@ export async function classifyToolUse(payload, repoRoot, cwd, config, options =
                 verdict: 'allow_flagged',
                 reason: 'tool_shell_missing_command',
                 summary: canonicalStringify(scrubPayload(payload.tool_input ?? {}, options)),
-                fingerprint: toolFingerprint(toolName, scrubPayload(payload.tool_input ?? {}, options), repoRoot),
+                fingerprint: toolFingerprint(toolName, fingerprintPayload(payload, options), repoRoot),
                 assessment: {
                     reversibility: 'recoverable_with_cost',
                     external: false,
@@ -249,7 +257,7 @@ export async function classifyToolUse(payload, repoRoot, cwd, config, options =
                     verdict: 'deny_pending_approval',
                     reason: 'file_mutation_missing_path',
                     summary: canonicalStringify(scrubPayload(payload.tool_input ?? {}, options)),
-                    fingerprint: toolFingerprint(toolName, scrubPayload(payload.tool_input ?? {}, options), repoRoot),
+                    fingerprint: toolFingerprint(toolName, fingerprintPayload(payload, options), repoRoot),
                     assessment: {
                         reversibility: 'irreversible',
                         external: false,
@@ -263,7 +271,7 @@ export async function classifyToolUse(payload, repoRoot, cwd, config, options =
                 verdict: 'allow_flagged',
                 reason: 'file_mutation_missing_path',
                 summary: canonicalStringify(scrubPayload(payload.tool_input ?? {}, options)),
-                fingerprint: toolFingerprint(toolName, scrubPayload(payload.tool_input ?? {}, options), repoRoot),
+                fingerprint: toolFingerprint(toolName, fingerprintPayload(payload, options), repoRoot),
                 assessment: {
                     reversibility: 'recoverable_with_cost',
                     external: false,
@@ -409,7 +417,7 @@ export async function classifyToolUse(payload, repoRoot, cwd, config, options =
                     verdict: 'deny_pending_approval',
                     reason: 'apply_patch_missing_path',
                     summary: canonicalStringify(scrubPayload(payload.tool_input ?? {}, options)),
-                    fingerprint: toolFingerprint(toolName, scrubPayload(payload.tool_input ?? {}, options), repoRoot),
+                    fingerprint: toolFingerprint(toolName, fingerprintPayload(payload, options), repoRoot),
                     assessment: {
                         reversibility: 'irreversible',
                         external: false,
@@ -423,7 +431,7 @@ export async function classifyToolUse(payload, repoRoot, cwd, config, options =
                 verdict: 'allow_flagged',
                 reason: 'apply_patch_missing_path',
                 summary: canonicalStringify(scrubPayload(payload.tool_input ?? {}, options)),
-                fingerprint: toolFingerprint(toolName, scrubPayload(payload.tool_input ?? {}, options), repoRoot),
+                fingerprint: toolFingerprint(toolName, fingerprintPayload(payload, options), repoRoot),
                 assessment: {
                     reversibility: 'recoverable_with_cost',
                     external: false,
@@ -448,7 +456,7 @@ export async function classifyToolUse(payload, repoRoot, cwd, config, options =
             verdict: 'allow_flagged',
             reason: sawDelete ? 'file_delete' : 'file_mutation',
             summary: targets.map((target) => target.path).join(', '),
-            fingerprint: toolFingerprint(toolName, scrubPayload(payload.tool_input ?? {}, options), repoRoot),
+            fingerprint: toolFingerprint(toolName, fingerprintPayload(payload, options), repoRoot),
             assessment: {
                 reversibility: 'recoverable_with_cost',
                 external: false,
@@ -462,7 +470,7 @@ export async function classifyToolUse(payload, repoRoot, cwd, config, options =
         verdict: 'allow',
         reason: 'unclassified_tool',
         summary: canonicalStringify(scrubPayload(payload.tool_input ?? {}, options)),
-        fingerprint: toolFingerprint(toolName, scrubPayload(payload.tool_input ?? {}, options), repoRoot),
+        fingerprint: toolFingerprint(toolName, fingerprintPayload(payload, options), repoRoot),
         assessment: {
             reversibility: 'reversible',
             external: false,

package/dist/core/dogfood-environment.d.ts

@@ -0,0 +1,8 @@
+import type { getAdapterLayout } from '../adapters/layouts/index.js';
+import type { AdapterName } from '../types.js';
+export declare function listLinkedWorktreePaths(repoRoot: string): Promise<string[]>;
+export declare function detectUndogfoodedLinkedWorktrees(params: {
+    repoRoot: string;
+    adapterName: AdapterName;
+    layout: ReturnType<typeof getAdapterLayout>;
+}): Promise<string[]>;

package/dist/core/dogfood-environment.js

@@ -0,0 +1,55 @@
+import { execFile } from 'node:child_process';
+import { existsSync, realpathSync } from 'node:fs';
+import path from 'node:path';
+import { promisify } from 'node:util';
+import { loadLayeredConfig } from '../config-io.js';
+const execFileAsync = promisify(execFile);
+export async function listLinkedWorktreePaths(repoRoot) {
+    try {
+        const { stdout } = await execFileAsync('git', ['worktree', 'list', '--porcelain'], {
+            cwd: repoRoot,
+            encoding: 'utf8',
+        });
+        return stdout
+            .split(/\r?\n/)
+            .filter((line) => line.startsWith('worktree '))
+            .map((line) => line.slice('worktree '.length).trim())
+            .filter((entry) => entry.length > 0);
+    }
+    catch {
+        return [];
+    }
+}
+export async function detectUndogfoodedLinkedWorktrees(params) {
+    const repoRootCanonical = realpathSync(params.repoRoot);
+    const worktrees = await listLinkedWorktreePaths(params.repoRoot);
+    const warnings = [];
+    for (const worktreePath of worktrees) {
+        let canonicalPath = worktreePath;
+        try {
+            canonicalPath = realpathSync(worktreePath);
+        }
+        catch {
+            // Keep the original path for warning output when the entry is stale.
+        }
+        if (canonicalPath === repoRootCanonical) {
+            continue;
+        }
+        const configPath = params.layout.configPath(worktreePath);
+        if (!existsSync(configPath)) {
+            warnings.push(`Dogfood is active here but ${path.basename(worktreePath)} has no belay.config.json (defaults to enforce). Run belay dogfood in each worktree you use with Cursor.`);
+            continue;
+        }
+        try {
+            const candidate = await loadLayeredConfig(worktreePath, params.adapterName);
+            const dogfoodEnabled = candidate.config.mode === 'audit' && candidate.config.policy.unknownLocalEffect === 'deny';
+            if (!dogfoodEnabled) {
+                warnings.push(`Dogfood is active here but ${path.basename(worktreePath)} is not in dogfood mode (mode=${candidate.config.mode}, unknownLocalEffect=${candidate.config.policy.unknownLocalEffect}). Run belay dogfood in each worktree you use with Cursor.`);
+            }
+        }
+        catch {
+            warnings.push(`Dogfood is active here but ${path.basename(worktreePath)} has an unreadable belay.config.json. Run belay doctor and belay dogfood in that worktree.`);
+        }
+    }
+    return warnings;
+}

package/dist/core/effect-ir/argv-delegate.d.ts

@@ -0,0 +1,9 @@
+export interface ArgvDelegatePeelResult {
+    launcher: string;
+    innerTokens: string[];
+    opaque: boolean;
+    reason: string;
+    signals: string[];
+}
+export declare function innerRecipeFromArgvDelegate(peel: ArgvDelegatePeelResult): string | null;
+export declare function peelArgvDelegateArgv(tokens: string[]): ArgvDelegatePeelResult | null;

package/dist/core/effect-ir/argv-delegate.js

@@ -0,0 +1,42 @@
+export function innerRecipeFromArgvDelegate(peel) {
+    if (peel.opaque || peel.innerTokens.length === 0) {
+        return null;
+    }
+    return peel.innerTokens.join(' ');
+}
+export function peelArgvDelegateArgv(tokens) {
+    const launcher = tokens[0] ?? '';
+    if (!launcher || tokens.length < 2) {
+        return null;
+    }
+    const signals = ['process.argv_delegate'];
+    let index = 1;
+    while (index < tokens.length) {
+        const token = tokens[index] ?? '';
+        if (token === '--') {
+            index += 1;
+            break;
+        }
+        if (token.startsWith('-')) {
+            return {
+                launcher,
+                innerTokens: [],
+                opaque: true,
+                reason: 'argv_delegate_wrapper_options',
+                signals: [...signals, 'argv_delegate_wrapper_options'],
+            };
+        }
+        break;
+    }
+    const innerTokens = tokens.slice(index);
+    if (innerTokens.length === 0) {
+        return null;
+    }
+    return {
+        launcher,
+        innerTokens,
+        opaque: false,
+        reason: 'argv_delegate_peel',
+        signals,
+    };
+}

package/dist/core/effect-ir/shell-lower/argv-delegate-gate.d.ts

@@ -0,0 +1,3 @@
+import type { ShellEffectRequirement } from '../shell-build.js';
+export declare function shouldApplyArgvDelegate(head: string, innerTokens: string[], depth: number): boolean;
+export declare function isGrammarUnknownOnly(requirements: ShellEffectRequirement[], head: string): boolean;