@guilz-dev/belay 0.9.4 → 0.10.0

package/dist/core/dogfood-environment.d.ts

@@ -0,0 +1,8 @@
+import type { getAdapterLayout } from '../adapters/layouts/index.js';
+import type { AdapterName } from '../types.js';
+export declare function listLinkedWorktreePaths(repoRoot: string): Promise<string[]>;
+export declare function detectUndogfoodedLinkedWorktrees(params: {
+    repoRoot: string;
+    adapterName: AdapterName;
+    layout: ReturnType<typeof getAdapterLayout>;
+}): Promise<string[]>;

package/dist/core/dogfood-environment.js

@@ -0,0 +1,55 @@
+import { execFile } from 'node:child_process';
+import { existsSync, realpathSync } from 'node:fs';
+import path from 'node:path';
+import { promisify } from 'node:util';
+import { loadLayeredConfig } from '../config-io.js';
+const execFileAsync = promisify(execFile);
+export async function listLinkedWorktreePaths(repoRoot) {
+    try {
+        const { stdout } = await execFileAsync('git', ['worktree', 'list', '--porcelain'], {
+            cwd: repoRoot,
+            encoding: 'utf8',
+        });
+        return stdout
+            .split(/\r?\n/)
+            .filter((line) => line.startsWith('worktree '))
+            .map((line) => line.slice('worktree '.length).trim())
+            .filter((entry) => entry.length > 0);
+    }
+    catch {
+        return [];
+    }
+}
+export async function detectUndogfoodedLinkedWorktrees(params) {
+    const repoRootCanonical = realpathSync(params.repoRoot);
+    const worktrees = await listLinkedWorktreePaths(params.repoRoot);
+    const warnings = [];
+    for (const worktreePath of worktrees) {
+        let canonicalPath = worktreePath;
+        try {
+            canonicalPath = realpathSync(worktreePath);
+        }
+        catch {
+            // Keep the original path for warning output when the entry is stale.
+        }
+        if (canonicalPath === repoRootCanonical) {
+            continue;
+        }
+        const configPath = params.layout.configPath(worktreePath);
+        if (!existsSync(configPath)) {
+            warnings.push(`Dogfood is active here but ${path.basename(worktreePath)} has no belay.config.json (defaults to enforce). Run belay dogfood in each worktree you use with Cursor.`);
+            continue;
+        }
+        try {
+            const candidate = await loadLayeredConfig(worktreePath, params.adapterName);
+            const dogfoodEnabled = candidate.config.mode === 'audit' && candidate.config.policy.unknownLocalEffect === 'deny';
+            if (!dogfoodEnabled) {
+                warnings.push(`Dogfood is active here but ${path.basename(worktreePath)} is not in dogfood mode (mode=${candidate.config.mode}, unknownLocalEffect=${candidate.config.policy.unknownLocalEffect}). Run belay dogfood in each worktree you use with Cursor.`);
+            }
+        }
+        catch {
+            warnings.push(`Dogfood is active here but ${path.basename(worktreePath)} has an unreadable belay.config.json. Run belay doctor and belay dogfood in that worktree.`);
+        }
+    }
+    return warnings;
+}

package/dist/core/effect-ir/shell-lower/decoders/belay.js

@@ -12,6 +12,13 @@ export function decodeBelay(args, repoRoot, segment) {
     const configJudgeMutation = section === 'config' &&
         ((['set', 'unset'].includes(operation ?? '') && key?.startsWith('judge.')) ||
             (operation === 'credential' && key === 'mode'));
+    const approvalAuthorityCommand = [
+        'approval-token',
+        'approve',
+        'revoke',
+        'standing-allow',
+    ].includes(section ?? '');
+    const configTrustMutation = section === 'config' && operation === 'trust';
     if (judgeCommand || configRead || configJudgeMutation) {
         return [
             processRequirement('belay', 'inspect', segment, [
@@ -20,6 +27,11 @@ export function decodeBelay(args, repoRoot, segment) {
             ]),
         ];
     }
+    if (approvalAuthorityCommand || configTrustMutation) {
+        return [
+            requirement('control_plane.write', 'control_plane.write', { kind: 'path', path: path.join(repoRoot, '.belay-control-plane') }, segment, [approvalAuthorityCommand ? 'belay.approval_authority' : 'belay.config_trust']),
+        ];
+    }
     if (section === 'config' && ['set', 'unset', 'credential'].includes(operation ?? '')) {
         return [
             requirement('control_plane.write', 'control_plane.write', { kind: 'path', path: path.join(repoRoot, '.belay-control-plane') }, segment, ['belay.config_non_judge_mutation']),

package/dist/core/egress-approval.js

@@ -1,8 +1,6 @@
 import { randomUUID } from 'node:crypto';
 import { compactApprovals, createApprovalRecord } from './approval.js';
-import { issueApprovalToken } from './approval-token.js';
 import { mutateApprovalStateWithRetry } from './capability/approval-state-mutation.js';
-import { configuredControlPlaneDir } from './config.js';
 import { addDomainToAllowlist, mutateEgressAllowlist } from './egress/allowlist.js';
 import { parseHostFromSummary } from './egress/fingerprint.js';
 import { notifyDeny } from './notify.js';
@@ -65,28 +63,12 @@ export async function notifyEgressDeny(params) {
     if (!params.config.notifications.webhookUrl && !params.config.notifications.commandHook) {
         return;
     }
-    let approvalToken;
-    if (params.config.approvalSigning.required) {
-        try {
-            approvalToken = await issueApprovalToken({
-                approvalId: params.approval.approvalId,
-                fingerprint: params.approval.fingerprint,
-                repoRoot: params.approval.repoRoot,
-                issuedAt: params.approval.createdAt,
-                expiresAt: params.approval.expiresAt,
-            }, configuredControlPlaneDir(params.config));
-        }
-        catch {
-            approvalToken = undefined;
-        }
-    }
     await notifyDeny(params.config.notifications, {
         approvalId: params.approval.approvalId,
         reason: params.policyResult.reason,
         summary: params.policyResult.summary,
         repoRoot: params.repoRoot,
         fingerprint: params.policyResult.fingerprint,
-        approvalToken,
     });
 }
 export async function recordEgressApproval(params) {

package/dist/core/notify.d.ts

@@ -8,6 +8,12 @@ export interface DenyNotificationEvent {
     summary: string;
     repoRoot: string;
     fingerprint: string;
-    approvalToken?: string;
 }
-export declare function notifyDeny(config: DenyNotificationConfig, event: DenyNotificationEvent): Promise<void>;
+export interface NotifyDependencies {
+    fetch: typeof globalThis.fetch;
+    execFile: (file: string, args: readonly string[], options: {
+        env: NodeJS.ProcessEnv;
+    }) => Promise<unknown>;
+}
+export declare function notificationConfigIssues(config: DenyNotificationConfig, repoRoot: string): string[];
+export declare function notifyDeny(config: DenyNotificationConfig, event: DenyNotificationEvent, deps?: NotifyDependencies): Promise<void>;

package/dist/core/notify.js

@@ -1,14 +1,69 @@
 import { execFile } from 'node:child_process';
+import path from 'node:path';
 import { promisify } from 'node:util';
+import { canonicalPath, pathWithinRoot } from './path-utils.js';
 const execFileAsync = promisify(execFile);
-export async function notifyDeny(config, event) {
-    const payload = JSON.stringify(event);
+const LOOPBACK_WEBHOOK_HOSTS = new Set(['localhost', '127.0.0.1', '::1']);
+function webhookConfigIssue(url) {
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        return `notifications.webhookUrl is invalid: ${url}`;
+    }
+    if (parsed.protocol === 'https:') {
+        return null;
+    }
+    const normalizedHostname = parsed.hostname.toLowerCase().replace(/^\[|\]$/g, '');
+    if (parsed.protocol === 'http:' && LOOPBACK_WEBHOOK_HOSTS.has(normalizedHostname)) {
+        return null;
+    }
+    return `notifications.webhookUrl must use https (http is allowed only for localhost, 127.0.0.1, or ::1): ${url}`;
+}
+function commandHookConfigIssue(commandHook, repoRoot) {
+    if (!path.isAbsolute(commandHook)) {
+        return `notifications.commandHook must be an absolute path: ${commandHook}`;
+    }
+    if (pathWithinRoot(canonicalPath(repoRoot), canonicalPath(commandHook))) {
+        return `notifications.commandHook must not be inside the repository: ${commandHook}`;
+    }
+    return null;
+}
+export function notificationConfigIssues(config, repoRoot) {
+    const issues = [];
     if (config.webhookUrl) {
+        const issue = webhookConfigIssue(config.webhookUrl);
+        if (issue) {
+            issues.push(issue);
+        }
+    }
+    if (config.commandHook) {
+        const issue = commandHookConfigIssue(config.commandHook, repoRoot);
+        if (issue) {
+            issues.push(issue);
+        }
+    }
+    return issues;
+}
+export async function notifyDeny(config, event, deps = {
+    fetch: globalThis.fetch.bind(globalThis),
+    execFile: (file, args, options) => execFileAsync(file, [...args], options),
+}) {
+    const payload = JSON.stringify({
+        approvalId: event.approvalId,
+        reason: event.reason,
+        summary: event.summary,
+        repoRoot: event.repoRoot,
+        fingerprint: event.fingerprint,
+    });
+    const webhookIssue = config.webhookUrl ? webhookConfigIssue(config.webhookUrl) : null;
+    if (config.webhookUrl && !webhookIssue) {
         try {
             const controller = new AbortController();
             const timeout = setTimeout(() => controller.abort(), 5000);
             try {
-                await fetch(config.webhookUrl, {
+                await deps.fetch(config.webhookUrl, {
                     method: 'POST',
                     headers: { 'content-type': 'application/json' },
                     body: payload,
@@ -23,17 +78,18 @@ export async function notifyDeny(config, event) {
             // best-effort notification
         }
     }
-    if (config.commandHook) {
+    const commandHookIssue = config.commandHook
+        ? commandHookConfigIssue(config.commandHook, event.repoRoot)
+        : null;
+    if (config.commandHook && !commandHookIssue) {
         try {
-            await execFileAsync(config.commandHook, [], {
+            await deps.execFile(config.commandHook, [], {
                 env: {
-                    ...process.env,
                     BELAY_APPROVAL_ID: event.approvalId,
                     BELAY_REASON: event.reason,
                     BELAY_SUMMARY: event.summary,
                     BELAY_REPO_ROOT: event.repoRoot,
                     BELAY_FINGERPRINT: event.fingerprint,
-                    BELAY_APPROVAL_TOKEN: event.approvalToken ?? '',
                 },
             });
         }

package/dist/core/recovery/operator-guidance.js

@@ -3,13 +3,13 @@ export function recoveryNotificationConfigured(config) {
 }
 export function recoveryApprovalSetupNotes() {
     return [
-        'Recovery restore flow: run `belay recover apply <checkpoint-id>`, approve with `belay approve <approval-id> --token <signed-token>`, then run the same apply command again.',
-        'Recovery restore always requires a signed out-of-band token, even when approvalSigning.required is false for general approvals.',
+        'Recovery restore flow: run `belay recover apply <checkpoint-id>`, retrieve the token locally with `belay approval-token <approval-id>`, approve with `belay approve <approval-id> --token <signed-token>`, then run the same apply command again.',
+        'Recovery restore always requires a signed local-control-plane token, even when approvalSigning.required is false for general approvals.',
     ];
 }
 export function recoveryNotificationSetupWarning() {
-    return ('Recovery checkpoint restore requires a signed out-of-band approval token, but no notification channel is configured. ' +
-        'Set notifications.webhookUrl or notifications.commandHook (e.g. via `belay config`) so `belay recover apply` can deliver the token.');
+    return ('No notification channel is configured, so recovery approval alerts are shown only by the local CLI. ' +
+        'Optionally set notifications.webhookUrl or notifications.commandHook (e.g. via `belay config`) to receive approval IDs out of band.');
 }
 export function formatRecoveryStateDiagnostic(state, detail) {
     switch (state) {

package/dist/core/repo-config-trust.d.ts

@@ -0,0 +1,31 @@
+import type { AdapterName } from '../types.js';
+export interface RepoConfigTrustRecordV1 {
+    schemaVersion: 1;
+    repoRoot: string;
+    adapter: 'cursor' | 'claude' | 'codex';
+    repoConfigFingerprint: string;
+    trustedAt: string;
+}
+export type RepoConfigTrustStatus = {
+    trusted: true;
+    recordPath: string;
+    fingerprint: string;
+} | {
+    trusted: false;
+    recordPath: string;
+    reason: 'missing' | 'malformed' | 'identity_mismatch' | 'fingerprint_mismatch';
+};
+export declare function repoConfigFingerprint(rawConfig: unknown): string;
+export declare function repoConfigTrustPath(repoRoot: string, adapter: AdapterName): string;
+export declare function inspectRepoConfigTrust(repoRoot: string, adapter: AdapterName, rawConfig: unknown): Promise<RepoConfigTrustStatus>;
+export declare function trustRepoConfig(repoRoot: string, adapter: AdapterName, rawConfig: unknown): Promise<RepoConfigTrustRecordV1>;
+export declare class RepoConfigTrustError extends Error {
+    readonly status: Exclude<RepoConfigTrustStatus, {
+        trusted: true;
+    }>;
+    constructor(status: Exclude<RepoConfigTrustStatus, {
+        trusted: true;
+    }>);
+}
+export declare function isRepoConfigTrustError(error: unknown): error is RepoConfigTrustError;
+export declare function assertRepoConfigTrusted(repoRoot: string, adapter: AdapterName, rawConfig: unknown): Promise<void>;

package/dist/core/repo-config-trust.js

@@ -0,0 +1,152 @@
+import { randomUUID } from 'node:crypto';
+import { existsSync } from 'node:fs';
+import { chmod, mkdir, open, readFile, rename, unlink } from 'node:fs/promises';
+import path from 'node:path';
+import { defaultControlPlaneDir } from './config.js';
+import { canonicalStringify, hashValue } from './fingerprint.js';
+import { canonicalPath } from './path-utils.js';
+const TRUST_MESSAGE = 'Repository config is not trusted. Review it, then run `belay config trust`.';
+function isObjectRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function hasOnlyExpectedKeys(value) {
+    const expected = new Set([
+        'schemaVersion',
+        'repoRoot',
+        'adapter',
+        'repoConfigFingerprint',
+        'trustedAt',
+    ]);
+    const keys = Object.keys(value);
+    if (keys.length !== expected.size) {
+        return false;
+    }
+    return keys.every((key) => expected.has(key));
+}
+function isAdapterName(value) {
+    return value === 'cursor' || value === 'claude' || value === 'codex';
+}
+function isIsoTimestamp(value) {
+    return Number.isFinite(Date.parse(value));
+}
+function parseStrictTrustRecord(value) {
+    if (!isObjectRecord(value) || !hasOnlyExpectedKeys(value)) {
+        return null;
+    }
+    if (value.schemaVersion !== 1) {
+        return null;
+    }
+    if (typeof value.repoRoot !== 'string' || value.repoRoot.trim().length === 0) {
+        return null;
+    }
+    if (!isAdapterName(value.adapter)) {
+        return null;
+    }
+    if (typeof value.repoConfigFingerprint !== 'string' ||
+        !/^[a-f0-9]{64}$/.test(value.repoConfigFingerprint)) {
+        return null;
+    }
+    if (typeof value.trustedAt !== 'string' || !isIsoTimestamp(value.trustedAt)) {
+        return null;
+    }
+    return {
+        schemaVersion: 1,
+        repoRoot: value.repoRoot,
+        adapter: value.adapter,
+        repoConfigFingerprint: value.repoConfigFingerprint,
+        trustedAt: value.trustedAt,
+    };
+}
+export function repoConfigFingerprint(rawConfig) {
+    return hashValue(canonicalStringify(rawConfig));
+}
+export function repoConfigTrustPath(repoRoot, adapter) {
+    const canonicalRepoRoot = canonicalPath(repoRoot);
+    const identity = hashValue(`${canonicalRepoRoot}\u0000${adapter}`);
+    return path.join(defaultControlPlaneDir(), 'config-trust', `${identity}.json`);
+}
+async function writeTrustRecordAtomically(recordPath, record) {
+    const directory = path.dirname(recordPath);
+    await mkdir(directory, { recursive: true, mode: 0o700 });
+    await chmod(directory, 0o700).catch(() => undefined);
+    const tempPath = path.join(directory, `.${path.basename(recordPath)}.${process.pid}.${randomUUID()}.tmp`);
+    let handle = null;
+    try {
+        handle = await open(tempPath, 'wx', 0o600);
+        await handle.writeFile(`${JSON.stringify(record, null, 2)}\n`, 'utf8');
+        await handle.sync();
+        await handle.close();
+        handle = null;
+        await rename(tempPath, recordPath);
+        await chmod(recordPath, 0o600);
+        const directoryHandle = await open(directory, 'r');
+        try {
+            await directoryHandle.sync().catch(() => undefined);
+        }
+        finally {
+            await directoryHandle.close();
+        }
+    }
+    finally {
+        if (handle) {
+            await handle.close().catch(() => undefined);
+        }
+        await unlink(tempPath).catch(() => undefined);
+    }
+}
+export async function inspectRepoConfigTrust(repoRoot, adapter, rawConfig) {
+    const canonicalRepoRoot = canonicalPath(repoRoot);
+    const recordPath = repoConfigTrustPath(repoRoot, adapter);
+    if (!existsSync(recordPath)) {
+        return { trusted: false, recordPath, reason: 'missing' };
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(await readFile(recordPath, 'utf8'));
+    }
+    catch {
+        return { trusted: false, recordPath, reason: 'malformed' };
+    }
+    const record = parseStrictTrustRecord(parsed);
+    if (!record) {
+        return { trusted: false, recordPath, reason: 'malformed' };
+    }
+    if (record.adapter !== adapter || canonicalPath(record.repoRoot) !== canonicalRepoRoot) {
+        return { trusted: false, recordPath, reason: 'identity_mismatch' };
+    }
+    const fingerprint = repoConfigFingerprint(rawConfig);
+    if (record.repoConfigFingerprint !== fingerprint) {
+        return { trusted: false, recordPath, reason: 'fingerprint_mismatch' };
+    }
+    return { trusted: true, recordPath, fingerprint };
+}
+export async function trustRepoConfig(repoRoot, adapter, rawConfig) {
+    const recordPath = repoConfigTrustPath(repoRoot, adapter);
+    const record = {
+        schemaVersion: 1,
+        repoRoot: canonicalPath(repoRoot),
+        adapter,
+        repoConfigFingerprint: repoConfigFingerprint(rawConfig),
+        trustedAt: new Date().toISOString(),
+    };
+    await writeTrustRecordAtomically(recordPath, record);
+    return record;
+}
+export class RepoConfigTrustError extends Error {
+    status;
+    constructor(status) {
+        super(TRUST_MESSAGE);
+        this.name = 'RepoConfigTrustError';
+        this.status = status;
+    }
+}
+export function isRepoConfigTrustError(error) {
+    return error instanceof RepoConfigTrustError;
+}
+export async function assertRepoConfigTrusted(repoRoot, adapter, rawConfig) {
+    const status = await inspectRepoConfigTrust(repoRoot, adapter, rawConfig);
+    if (status.trusted) {
+        return;
+    }
+    throw new RepoConfigTrustError(status);
+}

package/dist/corpus/benign-probe-cores.d.ts

@@ -3,4 +3,4 @@
  * These commands guard classifier availability in tests and never grant runtime authority.
  * @see src/__tests__/verdict/structural-suite.test.ts
  */
-export declare const BENIGN_PROBE_CORES: readonly ["npm test", "npm run build", "pnpm test", "pnpm build", "pnpm vitest run src/example.test.ts", "bash -lc 'git status'", "belay approve belay_deadbeef1234", "bundle -v", "ruby -v", "yarn --version", "make -n test", "bin/rails routes", "bundle exec rubocop --version", "bundle exec rubocop test/upgrade_script_contract_test.rb", "ruby -Itest test/upgrade_script_contract_test.rb"];
+export declare const BENIGN_PROBE_CORES: readonly ["npm test", "npm run build", "pnpm test", "pnpm build", "pnpm vitest run src/example.test.ts", "bash -lc 'git status'", "bundle -v", "ruby -v", "yarn --version", "make -n test", "bin/rails routes", "bundle exec rubocop --version", "bundle exec rubocop test/upgrade_script_contract_test.rb", "ruby -Itest test/upgrade_script_contract_test.rb"];

package/dist/corpus/benign-probe-cores.js

@@ -10,7 +10,6 @@ export const BENIGN_PROBE_CORES = [
     'pnpm build',
     'pnpm vitest run src/example.test.ts',
     "bash -lc 'git status'",
-    'belay approve belay_deadbeef1234',
     'bundle -v',
     'ruby -v',
     'yarn --version',

package/dist/defaults.js

@@ -44,31 +44,6 @@ export function getManagedHookEntries(platform = process.platform, hooksDir, rep
             definition: {
                 command: toolGate,
                 placement: 'prepend',
-                matcher: 'Task',
-            },
-        },
-        {
-            event: 'preToolUse',
-            definition: {
-                command: toolGate,
-                placement: 'prepend',
-                matcher: 'Write',
-            },
-        },
-        {
-            event: 'preToolUse',
-            definition: {
-                command: toolGate,
-                placement: 'prepend',
-                matcher: 'StrReplace',
-            },
-        },
-        {
-            event: 'preToolUse',
-            definition: {
-                command: toolGate,
-                placement: 'prepend',
-                matcher: 'Delete',
             },
         },
         {

package/dist/installer/scope-config.js

@@ -1,7 +1,7 @@
 import { existsSync } from 'node:fs';
 import { getAdapterLayout } from '../adapters/layouts/index.js';
 import { resolveInstallScope, resolveScopedPaths, } from '../adapters/layouts/scope.js';
-import { loadConfigFile, writeConfigFile } from '../config-io.js';
+import { loadConfigFile, writeTrustedConfigFile } from '../config-io.js';
 export async function resolveOperationScope(repoRoot, adapter, options = {}) {
     const layout = getAdapterLayout(adapter);
     let persisted;
@@ -17,7 +17,7 @@ export async function applyInstallScope(repoRoot, adapter, scope, config) {
         return current;
     }
     const updated = { ...current, installScope: scope };
-    await writeConfigFile(repoRoot, updated, adapter);
+    await writeTrustedConfigFile(repoRoot, updated, adapter);
     return updated;
 }
 export function pathsForOperation(adapter, scope, repoRoot) {

package/dist/installer.js

@@ -6,7 +6,7 @@ import { cursorLayout } from './adapters/layouts/cursor.js';
 import { resolveScopedPaths } from './adapters/layouts/scope.js';
 import { getAdapter } from './adapters/registry.js';
 import { dogfoodProject } from './commands/dogfood.js';
-import { detectAdapterName, loadConfigFile, mergeAndWriteConfig, writeConfigFile, } from './config-io.js';
+import { detectAdapterName, loadConfigFile, mergeAndWriteConfig, writeTrustedConfigFile, } from './config-io.js';
 import { appendCliAuditEvent } from './core/audit-io.js';
 import { archiveLegacyAuditLogIfNeeded } from './core/audit-legacy-archive.js';
 import { isFreshConfigInput, mergeConfig, normalizeConfig, } from './core/config.js';
@@ -230,7 +230,7 @@ async function applyInitJudgeConfig(repoRoot, adapterName, options, isFreshBefor
         !hasValidCloudConsent(configWithJudge.judge)) {
         process.stderr.write('Warning: Cloud judge saved without recorded consent. Tier1 cloud judge will fail closed until consent is granted (belay judge consent + belay approve, or TTY --accept-cloud-judge).\n');
     }
-    await writeConfigFile(repoRoot, configWithJudge, adapterName);
+    await writeTrustedConfigFile(repoRoot, configWithJudge, adapterName);
     if (migrated) {
         await auditJudgeMigrationIfNeeded(repoRoot, adapterName, mergedConfig.judge, finalJudge, options.migrateJudgeDefault ? 'belay init --migrate-judge-default' : 'belay init');
     }
@@ -263,7 +263,7 @@ export async function initProject(options = {}) {
         const existing = await loadConfigFile(repoRoot, adapterName);
         const presetConfig = mergeConfig(applyConfigPreset(options.preset));
         const merged = mergeConfig(presetConfig, existing);
-        await writeConfigFile(repoRoot, merged, adapterName);
+        await writeTrustedConfigFile(repoRoot, merged, adapterName);
     }
     if (options.dogfood === true) {
         await dogfoodProject({ targetDir: repoRoot, adapter: adapterName });
@@ -285,7 +285,7 @@ export async function upgradeProject(options = {}) {
         const migrated = migrateImplicitLocalJudgeIfNeeded(mergedConfig.judge, adapterName);
         if (migrated) {
             const configWithJudge = normalizeConfig({ ...mergedConfig, version: 4, judge: migrated });
-            await writeConfigFile(repoRoot, configWithJudge, adapterName);
+            await writeTrustedConfigFile(repoRoot, configWithJudge, adapterName);
             await auditJudgeMigrationIfNeeded(repoRoot, adapterName, mergedConfig.judge, migrated, 'belay upgrade --migrate-judge-default');
         }
     }

package/dist/types.d.ts

@@ -238,6 +238,8 @@ export interface DogfoodOptions {
     targetDir?: string;
     enforce?: boolean;
     force?: boolean;
+    check?: boolean;
+    since?: string;
     adapter?: AdapterName;
 }
 export interface DogfoodResult {
@@ -248,6 +250,23 @@ export interface DogfoodResult {
     mode: string;
     unknownLocalEffect: string;
 }
+export interface DogfoodCheckOptions {
+    targetDir?: string;
+    adapter?: AdapterName;
+    since: string;
+}
+export interface DogfoodCheckResult {
+    ok: boolean;
+    repoRoot: string;
+    since: string;
+    gateEvents: number;
+    auditModeDenyCount: number;
+    hostDeniedAfterAllowCount: number;
+    shellPreToolUseCount: number;
+    mismatchedCohortCount: number;
+    environmentSkewCount: number;
+    failures: string[];
+}
 export type ExplainKind = 'shell' | 'tool' | 'subagent';
 export interface ExplainReport {
     repoRoot: string;

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const PACKAGE_VERSION = "0.9.4";
+export declare const PACKAGE_VERSION = "0.10.0";

package/dist/version.js

@@ -1,2 +1,2 @@
 // Generated by scripts/sync-version.mjs — do not edit.
-export const PACKAGE_VERSION = '0.9.4';
+export const PACKAGE_VERSION = '0.10.0';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@guilz-dev/belay",
-  "version": "0.9.4",
+  "version": "0.10.0",
   "description": "Belay-style approval and audit gating for agent runtimes.",
   "type": "module",
   "license": "MIT",
@@ -56,10 +56,14 @@
     "lint": "biome check src package.json README.md CHANGELOG.md CONTRIBUTING.md SECURITY.md tsconfig.json tsconfig.build.json vitest.config.ts scripts docs",
     "typecheck": "tsc --noEmit",
     "test": "pnpm build && vitest run",
+    "test:run": "vitest run",
     "test:structural": "pnpm build && vitest run src/__tests__/verdict/structural-suite.test.ts",
+    "test:structural:run": "vitest run src/__tests__/verdict/structural-suite.test.ts",
     "test:docker": "pnpm build && vitest run --config vitest.live.config.ts src/__tests__/capability/boundary-container-isolation.test.ts src/__tests__/capability/boundary-container-workspace-mount.test.ts src/__tests__/capability/boundary-driver-container.test.ts src/__tests__/contained-execution-docker.integration.test.ts",
     "test:llm": "pnpm build && vitest run --config vitest.live.config.ts src/__tests__/verdict/llm/judge-accuracy.test.ts",
     "test:stable": "pnpm build && vitest run && vitest run && vitest run",
+    "test:stable:run": "vitest run && vitest run && vitest run",
+    "test:macos": "vitest run src/__tests__/native-seatbelt-boundary-probe.test.ts src/__tests__/git-resource-identity.test.ts src/__tests__/installer-scope.test.ts src/__tests__/cursor-hook-precedence.integration.test.ts src/__tests__/cursor-hooks.test.ts",
     "corpus": "pnpm build && node scripts/corpus.mjs",
     "probe:adversarial": "pnpm build && node scripts/adversarial-probe.mjs",
     "probe:cursor-shell-rewrite": "node scripts/cursor-shell-rewrite-probe.mjs",