@guilz-dev/belay 0.1.1 → 0.3.0

package/dist/bundle/codex-runtime.mjs

@@ -1,35 +1,4 @@
 // agent-belay codex runtime bundle
-var __defProp = Object.defineProperty;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __esm = (fn, res) => function __init() {
-  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
-};
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-
-// src/core/judge-api-key.ts
-var judge_api_key_exports = {};
-__export(judge_api_key_exports, {
-  resolveJudgeApiKey: () => resolveJudgeApiKey
-});
-function resolveJudgeApiKey(env = process.env) {
-  const belay = env.BELAY_JUDGE_API_KEY?.trim();
-  if (belay) {
-    return { key: belay, source: "BELAY_JUDGE_API_KEY" };
-  }
-  const openai = env.OPENAI_API_KEY?.trim();
-  if (openai) {
-    return { key: openai, source: "OPENAI_API_KEY" };
-  }
-  return { key: null, source: null };
-}
-var init_judge_api_key = __esm({
-  "src/core/judge-api-key.ts"() {
-    "use strict";
-  }
-});
 
 // src/adapters/codex/runtime-entry.ts
 import process2 from "node:process";
@@ -40,12 +9,158 @@ import path3 from "node:path";
 // src/core/config.ts
 import path from "node:path";
 
+// src/core/judge-model-policy.ts
+var DEPRECATED_JUDGE_MODEL_AUTO = "auto";
+function isDeprecatedJudgeModelAuto(model) {
+  return model?.trim().toLowerCase() === DEPRECATED_JUDGE_MODEL_AUTO;
+}
+function rejectDeprecatedJudgeModelAuto(model) {
+  if (isDeprecatedJudgeModelAuto(model)) {
+    throw new Error(
+      'judge model "auto" is no longer accepted. Use a concrete model id from belay judge list or the provider catalog default.'
+    );
+  }
+}
+var warnedDeprecatedAuto = false;
+function warnDeprecatedJudgeModelAuto() {
+  if (warnedDeprecatedAuto) {
+    return;
+  }
+  warnedDeprecatedAuto = true;
+  process.stderr.write(
+    'Warning: judge.model "auto" is deprecated; normalized to the provider catalog default on load. Set a concrete model id with belay config set judge.model <id>.\n'
+  );
+}
+
+// src/core/verdict/judge-catalog.ts
+var LEGACY_PROVIDER_ID_ALIASES = {
+  local: "ollama",
+  openai: "codex"
+};
+var REMOVED_JUDGE_PROVIDER_IDS = ["openrouter", "custom"];
+function isRemovedProviderId(id) {
+  return REMOVED_JUDGE_PROVIDER_IDS.includes(id);
+}
+function warnRemovedProviderId(id) {
+  process.stderr.write(
+    `Warning: judge.providerId "${id}" was removed; migrate with belay config set judge.providerId <ollama|codex|claude|cursor>.
+`
+  );
+}
+var JUDGE_CATALOG = {
+  ollama: {
+    id: "ollama",
+    driver: "ollama",
+    defaultEndpoint: "http://localhost:11434",
+    defaultModel: "gemma4:e2b",
+    apiKeyEnvVars: [],
+    isCloud: false
+  },
+  codex: {
+    id: "codex",
+    driver: "openai-compatible",
+    defaultEndpoint: null,
+    defaultModel: "gpt-5.3-codex-high",
+    apiKeyEnvVars: ["OPENAI_API_KEY", "BELAY_JUDGE_API_KEY"],
+    isCloud: true
+  },
+  claude: {
+    id: "claude",
+    driver: "anthropic",
+    defaultEndpoint: null,
+    defaultModel: "claude-sonnet-4-6",
+    apiKeyEnvVars: ["ANTHROPIC_API_KEY", "BELAY_JUDGE_API_KEY"],
+    isCloud: true
+  },
+  cursor: {
+    id: "cursor",
+    driver: "openai-compatible",
+    defaultEndpoint: null,
+    defaultModel: "composer-2.5",
+    apiKeyEnvVars: ["CURSOR_API_KEY", "BELAY_JUDGE_API_KEY"],
+    isCloud: true
+  }
+};
+var JUDGE_PROVIDER_IDS = Object.keys(JUDGE_CATALOG);
+function normalizeLegacyProviderId(id) {
+  if (id in JUDGE_CATALOG) {
+    return id;
+  }
+  return LEGACY_PROVIDER_ID_ALIASES[id] ?? null;
+}
+function getJudgeProviderSpec(id) {
+  const normalized = normalizeLegacyProviderId(id);
+  if (!normalized) {
+    return null;
+  }
+  return JUDGE_CATALOG[normalized];
+}
+function inferProviderIdFromConfig(judge) {
+  if (judge.providerId) {
+    const normalized = normalizeLegacyProviderId(judge.providerId);
+    if (normalized) {
+      return normalized;
+    }
+  }
+  if (judge.provider === "ollama") {
+    return "ollama";
+  }
+  if (judge.provider === "anthropic") {
+    return "claude";
+  }
+  const endpoint = judge.endpoint?.trim().toLowerCase() ?? "";
+  if (endpoint.includes("openrouter.ai")) {
+    return "codex";
+  }
+  if (endpoint.includes("api.openai.com")) {
+    return "codex";
+  }
+  if (endpoint) {
+    return "codex";
+  }
+  if (judge.provider === "openai-compatible") {
+    const model = judge.model?.trim().toLowerCase() ?? "";
+    if (model.includes("composer")) {
+      return "cursor";
+    }
+  }
+  return "codex";
+}
+function resolveJudgeFromCatalog(input) {
+  const providerId = normalizeLegacyProviderId(String(input.providerId));
+  if (!providerId) {
+    throw new Error(`Unknown judge provider id: ${input.providerId}`);
+  }
+  const spec = JUDGE_CATALOG[providerId];
+  const model = input.model?.trim() || spec.defaultModel;
+  const endpoint = input.endpoint !== void 0 ? input.endpoint?.trim() || null : spec.defaultEndpoint;
+  return {
+    provider: spec.driver,
+    providerId: spec.id,
+    model,
+    endpoint,
+    timeoutMs: input.timeoutMs ?? (spec.isCloud ? 8e3 : 25e3),
+    keepAlive: spec.driver === "ollama" ? input.keepAlive ?? "30m" : null
+  };
+}
+function isCloudProviderId(providerId) {
+  if (!providerId) {
+    return false;
+  }
+  const normalized = normalizeLegacyProviderId(providerId);
+  if (!normalized) {
+    return false;
+  }
+  return JUDGE_CATALOG[normalized].isCloud;
+}
+
 // src/core/audit-summary.ts
 var DEFAULT_SILENT_PASS_THRESHOLD = 0.5;
 
 // src/core/config.ts
 var DEFAULT_JUDGE_LOCAL_OLLAMA = {
   provider: "ollama",
+  providerId: "ollama",
   model: "gemma4:e2b",
   endpoint: "http://localhost:11434",
   timeoutMs: 25e3,
@@ -53,7 +168,8 @@ var DEFAULT_JUDGE_LOCAL_OLLAMA = {
 };
 var DEFAULT_JUDGE_OPENAI_COMPATIBLE_TEMPLATE = {
   provider: "openai-compatible",
-  model: "auto",
+  providerId: "codex",
+  model: "gpt-5.3-codex-high",
   timeoutMs: 8e3,
   endpoint: null,
   keepAlive: null
@@ -86,7 +202,7 @@ var LEGACY_POLICY_V3 = {
   fenceWarnThreshold: DEFAULT_FENCE_WARN_THRESHOLD
 };
 var DEFAULT_POLICY_V3 = {
-  unknownLocalEffect: "deny",
+  unknownLocalEffect: "allow_flagged",
   unparseableShell: "deny",
   codexUnmappedTool: "deny",
   confidenceThresholds: { ...DEFAULT_CONFIDENCE_THRESHOLDS },
@@ -229,36 +345,125 @@ function migrateV2ToV3(v2, rawOverrides) {
   });
 }
 function normalizeJudgeProvider(provider) {
+  if (provider === "anthropic") {
+    return "anthropic";
+  }
   if (provider === "openai-compatible" || provider === "cursor") {
     return "openai-compatible";
   }
   return "ollama";
 }
+function defaultJudgeTemplateForProvider(provider) {
+  if (provider === "ollama") {
+    return DEFAULT_JUDGE_LOCAL_OLLAMA;
+  }
+  if (provider === "anthropic") {
+    return {
+      provider: "anthropic",
+      providerId: "claude",
+      model: "claude-sonnet-4-6",
+      timeoutMs: 8e3,
+      endpoint: null,
+      keepAlive: null
+    };
+  }
+  return DEFAULT_JUDGE_OPENAI_COMPATIBLE_TEMPLATE;
+}
 function synthesizeJudgeFromRaw(raw) {
   const judge = raw.judge;
   if (judge?.provider) {
-    const provider = normalizeJudgeProvider(judge.provider);
-    const base = provider === "openai-compatible" ? DEFAULT_JUDGE_OPENAI_COMPATIBLE_TEMPLATE : DEFAULT_JUDGE_LOCAL_OLLAMA;
+    const rawProvider = String(judge.provider);
+    const provider = normalizeJudgeProvider(rawProvider);
+    const base = defaultJudgeTemplateForProvider(provider);
+    const providerId = judge.providerId && normalizeLegacyProviderId(judge.providerId) ? normalizeLegacyProviderId(judge.providerId) : rawProvider === "cursor" ? "cursor" : void 0;
     return normalizeJudgeConfig({
       ...base,
       ...judge,
-      provider
+      provider,
+      ...providerId ? { providerId } : {}
     });
   }
   return { ...DEFAULT_JUDGE_LOCAL_OLLAMA };
 }
 function normalizeJudgeConfig(judge) {
   const provider = normalizeJudgeProvider(judge.provider);
-  const base = provider === "openai-compatible" ? DEFAULT_JUDGE_OPENAI_COMPATIBLE_TEMPLATE : DEFAULT_JUDGE_LOCAL_OLLAMA;
-  const model = typeof judge.model === "string" && judge.model.trim() ? judge.model.trim() : base.model;
+  const base = defaultJudgeTemplateForProvider(provider);
+  const rawProviderId = judge.providerId ? String(judge.providerId) : void 0;
+  if (rawProviderId && isRemovedProviderId(rawProviderId)) {
+    warnRemovedProviderId(rawProviderId);
+    let model2 = typeof judge.model === "string" && judge.model.trim() ? judge.model.trim() : base.model;
+    if (model2 === "auto") {
+      warnDeprecatedJudgeModelAuto();
+      model2 = base.model;
+    }
+    const timeoutMs2 = typeof judge.timeoutMs === "number" && judge.timeoutMs > 0 ? judge.timeoutMs : base.timeoutMs;
+    const endpoint2 = typeof judge.endpoint === "string" && judge.endpoint.trim() ? judge.endpoint.trim() : null;
+    return {
+      provider,
+      providerId: rawProviderId,
+      model: model2,
+      timeoutMs: timeoutMs2,
+      endpoint: endpoint2,
+      keepAlive: provider === "ollama" && typeof judge.keepAlive === "string" && judge.keepAlive.trim() ? judge.keepAlive.trim() : provider === "ollama" ? DEFAULT_JUDGE_LOCAL_OLLAMA.keepAlive : null,
+      ...judge.cloudConsent ? { cloudConsent: judge.cloudConsent } : {},
+      ...judge.credential ? { credential: judge.credential } : {}
+    };
+  }
+  let providerId = rawProviderId && normalizeLegacyProviderId(rawProviderId) ? normalizeLegacyProviderId(rawProviderId) : inferProviderIdFromConfig({ ...judge, provider });
+  const spec = getJudgeProviderSpec(providerId);
+  if (spec && spec.driver !== provider) {
+    providerId = inferProviderIdFromConfig({ ...judge, provider });
+  }
+  const catalogSpec = getJudgeProviderSpec(providerId);
+  let model = typeof judge.model === "string" && judge.model.trim() ? judge.model.trim() : base.model;
+  if (model === "auto" && catalogSpec?.defaultModel) {
+    warnDeprecatedJudgeModelAuto();
+    model = catalogSpec.defaultModel;
+  }
+  if (!model && catalogSpec?.defaultModel) {
+    model = catalogSpec.defaultModel;
+  }
   const timeoutMs = typeof judge.timeoutMs === "number" && judge.timeoutMs > 0 ? judge.timeoutMs : base.timeoutMs;
-  return {
+  let endpoint = typeof judge.endpoint === "string" && judge.endpoint.trim() ? judge.endpoint.trim() : null;
+  if (!endpoint && catalogSpec?.defaultEndpoint) {
+    endpoint = catalogSpec.defaultEndpoint;
+  }
+  const normalized = {
     provider,
+    providerId,
     model,
     timeoutMs,
-    endpoint: typeof judge.endpoint === "string" && judge.endpoint.trim() ? judge.endpoint.trim() : null,
+    endpoint,
     keepAlive: provider === "ollama" && typeof judge.keepAlive === "string" && judge.keepAlive.trim() ? judge.keepAlive.trim() : provider === "ollama" ? DEFAULT_JUDGE_LOCAL_OLLAMA.keepAlive : null
   };
+  if (judge.cloudConsent?.accepted) {
+    normalized.cloudConsent = {
+      accepted: true,
+      at: judge.cloudConsent.at,
+      providerId: judge.cloudConsent.providerId ?? providerId,
+      endpoint: judge.cloudConsent.endpoint,
+      by: judge.cloudConsent.by
+    };
+  }
+  if (judge.credential?.mode === "project" || judge.credential?.mode === "apiKey") {
+    normalized.credential = {
+      mode: judge.credential.mode,
+      ...judge.credential.ref ? { ref: judge.credential.ref } : {}
+    };
+  }
+  return normalized;
+}
+function rejectTeamLayerJudgeSecrets(judge, source) {
+  if (source !== "team" || !judge) {
+    return;
+  }
+  if (judge.credential?.mode === "apiKey") {
+    throw new Error("team config cannot set judge.credential.mode to apiKey.");
+  }
+  const raw = judge;
+  if (raw.credential && "key" in raw.credential && raw.credential.key) {
+    throw new Error("team config cannot contain inline judge credential keys.");
+  }
 }
 function hasV3Sections(raw) {
   return raw.policy !== void 0 || raw.overrides !== void 0 || raw.redaction !== void 0 || raw.controlPlane !== void 0;
@@ -700,20 +905,29 @@ var codexLayout = {
 // src/adapters/shared/gate-runtime.ts
 import { randomUUID as randomUUID2 } from "node:crypto";
 import { existsSync as existsSync6 } from "node:fs";
-import { mkdir as mkdir3, readFile as readFile2, writeFile as writeFile2 } from "node:fs/promises";
-import path16 from "node:path";
+import { mkdir as mkdir4, readFile as readFile3, writeFile as writeFile3 } from "node:fs/promises";
+import path20 from "node:path";
 
 // src/core/approval.ts
+var APPROVAL_EXECUTION_LEASE_MS = 6e4;
 function nowIso() {
   return (/* @__PURE__ */ new Date()).toISOString();
 }
 function isExpired(approval) {
   return Date.parse(approval.expiresAt) <= Date.now();
 }
+function isExecutionLeaseExpired(approval) {
+  if (!approval.executionLeaseExpiresAt) {
+    return false;
+  }
+  return Date.parse(approval.executionLeaseExpiresAt) <= Date.now();
+}
 function compactApprovals(state) {
   return {
     version: state.version,
-    approvals: state.approvals.filter((approval) => !isExpired(approval))
+    approvals: state.approvals.filter(
+      (approval) => !isExpired(approval) && !isExecutionLeaseExpired(approval)
+    )
   };
 }
 function escapeRegex(value) {
@@ -722,8 +936,15 @@ function escapeRegex(value) {
 }
 function approvalCommandMatch(prompt, tokenPrefix) {
   const escapedPrefix = escapeRegex(tokenPrefix);
-  const match = prompt.match(new RegExp(`^\\s*${escapedPrefix}\\s+(\\S+)\\s*$`, "i"));
-  return match?.[1] ?? null;
+  const linePattern = new RegExp(`^\\s*${escapedPrefix}\\s+(\\S+)\\s*$`, "i");
+  for (const line of prompt.split(/\r?\n/)) {
+    if (!line.trim()) {
+      continue;
+    }
+    const match = line.match(linePattern);
+    return match?.[1] ?? null;
+  }
+  return null;
 }
 function buildRetryInstruction(tokenPrefix, approvalId) {
   return `To allow the next matching action once, send ${tokenPrefix} ${approvalId} and then retry the original action unchanged.`;
@@ -956,6 +1177,9 @@ function isCapabilityBrokerDemotionActive(config) {
   return hasSandboxRuntime(config);
 }
 
+// src/core/capability/paths.ts
+import path7 from "node:path";
+
 // src/core/shell-tokenizer.ts
 function tokenizeShell(input) {
   const tokens = [];
@@ -1053,33 +1277,106 @@ function extractRedirectTargets(tokens) {
 }
 
 // src/core/capability/paths.ts
+function applyPatchTargets(patch) {
+  const targets = [];
+  for (const line of patch.split("\n")) {
+    const match = line.match(/^\*\*\* (?:Add|Delete|Update) File: (.+)$/);
+    if (match?.[1]) {
+      targets.push(match[1]);
+      continue;
+    }
+    const moveMatch = line.match(/^\*\*\* Move to: (.+)$/);
+    if (moveMatch?.[1]) {
+      targets.push(moveMatch[1]);
+    }
+  }
+  return targets;
+}
+function extractToolFilePath(payload) {
+  const toolInput = payload.tool_input;
+  if (!toolInput || typeof toolInput !== "object") {
+    return null;
+  }
+  const input = toolInput;
+  for (const key of ["path", "file_path", "target_file", "filePath"]) {
+    if (typeof input[key] === "string") {
+      return input[key];
+    }
+  }
+  return null;
+}
+function extractToolPatch(payload) {
+  const toolInput = payload.tool_input;
+  if (!toolInput || typeof toolInput !== "object") {
+    return null;
+  }
+  const input = toolInput;
+  for (const key of ["patch", "input", "text"]) {
+    if (typeof input[key] === "string" && input[key].trim()) {
+      return input[key];
+    }
+  }
+  return null;
+}
+function addOutsideRepoPath(paths, token, cwd, repoRoot) {
+  const resolved = resolveMutationTarget(token, cwd);
+  if (resolved && relativeWithinRepo(repoRoot, resolved) === null) {
+    paths.add(resolved);
+  }
+}
 function collectOutsideRepoPaths(command, cwd, repoRoot) {
   const tokens = tokenizeShell(command);
   const redirects = extractRedirectTargets(tokens);
   const paths = /* @__PURE__ */ new Set();
   for (const token of tokens.slice(1)) {
-    const resolved = resolveMutationTarget(token, cwd);
-    if (resolved && relativeWithinRepo(repoRoot, resolved) === null) {
-      paths.add(resolved);
-    }
+    addOutsideRepoPath(paths, token, cwd, repoRoot);
   }
   for (const redirect of redirects) {
-    const resolved = resolveMutationTarget(redirect, cwd);
-    if (resolved && relativeWithinRepo(repoRoot, resolved) === null) {
+    addOutsideRepoPath(paths, redirect, cwd, repoRoot);
+  }
+  return [...paths];
+}
+function collectOutsideRepoPathsFromToolPayload(payload, cwd, repoRoot) {
+  const toolKind = String(payload.tool_name ?? "").trim().toLowerCase();
+  const paths = /* @__PURE__ */ new Set();
+  const filePath = extractToolFilePath(payload);
+  if (filePath) {
+    const resolved = path7.isAbsolute(filePath) ? filePath : path7.resolve(cwd, filePath);
+    if (relativeWithinRepo(repoRoot, resolved) === null) {
       paths.add(resolved);
     }
+    return [...paths];
+  }
+  if (toolKind === "apply_patch" || toolKind === "applypatch") {
+    const patch = extractToolPatch(payload);
+    if (patch) {
+      for (const target of applyPatchTargets(patch)) {
+        const resolved = path7.isAbsolute(target) ? target : path7.resolve(cwd, target);
+        if (relativeWithinRepo(repoRoot, resolved) === null) {
+          paths.add(resolved);
+        }
+      }
+    }
   }
   return [...paths];
 }
 
 // src/core/capability/reasons.ts
 var FS_SCOPE_REASONS = /* @__PURE__ */ new Set(["outside_repo_mutation", "outside_repo_redirect"]);
+var JUDGE_CLOUD_CONSENT_REASON = "judge_cloud_consent";
+var CAPABILITY_APPROVAL_REASONS = /* @__PURE__ */ new Set([
+  ...FS_SCOPE_REASONS,
+  JUDGE_CLOUD_CONSENT_REASON
+]);
 function shouldSkipBrokerApprovedOnce(brokerActive, reason) {
   return brokerActive && FS_SCOPE_REASONS.has(reason);
 }
+function shouldSkipBrokerApprovedRecord(brokerActive, approvalReason) {
+  return brokerActive && approvalReason !== void 0 && FS_SCOPE_REASONS.has(approvalReason);
+}
 
 // src/core/config-layers.ts
-import path7 from "node:path";
+import path8 from "node:path";
 
 // src/presets.ts
 var CONFIG_PRESETS = {
@@ -1179,8 +1476,8 @@ function applyConfigPreset(preset, extra = {}) {
 // src/core/config-layers.ts
 function teamConfigPath(homedir = () => process.env.HOME ?? process.env.USERPROFILE ?? "") {
   const xdg = process.env.XDG_CONFIG_HOME?.trim();
-  const base = xdg || path7.join(homedir(), ".config");
-  return path7.join(base, "agent-belay", "team.config.json");
+  const base = xdg || path8.join(homedir(), ".config");
+  return path8.join(base, "agent-belay", "team.config.json");
 }
 function applyProtectedLayer(config, builtin) {
   const controlPlane = { ...config.controlPlane };
@@ -1214,6 +1511,10 @@ function resolveLayeredConfig(params) {
   if (params.teamConfig) {
     const teamFile = params.teamConfig;
     const teamRaw = teamFile.preset ? applyConfigPreset(teamFile.preset, teamFile.config ?? {}) : teamFile.config ?? params.teamConfig;
+    rejectTeamLayerJudgeSecrets(
+      teamRaw.judge,
+      "team"
+    );
     config = mergeConfigLayer(config, asV3Layer(teamRaw));
     provenance.push({
       path: params.teamConfigPath ?? teamConfigPath(),
@@ -1250,7 +1551,7 @@ function classifyResultToGateVerdict(params) {
     approvalId,
     user_message,
     agent_message,
-    v2: result.v2
+    axes: result.axes
   };
 }
 function unnormalizedGateVerdict(params) {
@@ -1459,7 +1760,7 @@ function classifySubagent(payload, repoRoot, options = {}) {
 }
 
 // src/core/classify-tool.ts
-import path12 from "node:path";
+import path16 from "node:path";
 
 // src/core/glob.ts
 function matchesSensitivePath(filePath, patterns) {
@@ -1504,7 +1805,7 @@ function matchesSensitivePath(filePath, patterns) {
   return false;
 }
 
-// src/core/v2/judge-audit.ts
+// src/core/verdict/judge-audit.ts
 function judgeTraceAuditFields(trace) {
   if (!trace) {
     return {};
@@ -1519,55 +1820,464 @@ function judgeTraceAuditFields(trace) {
   };
 }
 
-// src/core/v2/judge-outbound.ts
-var PATH_LIKE = /(?:^|[\s"'`=])(~\/[^\s"'`]+|\/[^\s"'`]+|\.\/[^\s"'`]+|\.\.\/[^\s"'`]+|[A-Za-z]:\\[^\s"'`]+)/g;
-var REDACTED_PLACEHOLDER = /^(?:<redacted>|\[REDACTED\]|<secret>|<high-entropy>|<approval-id>)$/i;
-var URL_CREDENTIALS_PATTERN2 = /\b[A-Za-z][A-Za-z0-9+.-]*:\/\/([^/\s:@]+):([^@\s/]+)@/gi;
-var GENERIC_AUTH_HEADER_PATTERN2 = /\b(?:Authorization|X-Api-Key|X-Auth-Token|Private-Token):\s*([^\s]+)/gi;
-function hasResidualBearerToken(text) {
-  for (const match of text.matchAll(/\bBearer\s+(\S+)/gi)) {
-    const token = match[1] ?? "";
-    if (!REDACTED_PLACEHOLDER.test(token)) {
-      return true;
-    }
+// src/adapters/layouts/claude.ts
+import path9 from "node:path";
+function runnerCommand2(platform, repoRoot, hookName, ...args) {
+  const hooksDir = path9.join(path9.resolve(repoRoot), ".claude", "hooks");
+  return buildRunnerInvocation(platform, hooksDir, repoRoot, hookName, ...args);
+}
+var claudeLayout = {
+  name: "claude",
+  configPath(repoRoot) {
+    return path9.join(repoRoot, ".claude", "belay.config.json");
+  },
+  hooksSettingsPath(repoRoot) {
+    return path9.join(repoRoot, ".claude", "settings.json");
+  },
+  hooksDir(repoRoot) {
+    return path9.join(repoRoot, ".claude", "hooks");
+  },
+  runtimeDir(repoRoot) {
+    return path9.join(repoRoot, ".claude", "belay", "runtime");
+  },
+  repoLocalStateDir(repoRoot) {
+    return path9.join(repoRoot, ".claude", "belay");
+  },
+  defaultAuditLogPath(_repoRoot) {
+    return path9.join(".claude", "belay", "audit.ndjson");
+  },
+  repoRootMarkers: [".git", ".claude"],
+  runnerCommand: runnerCommand2,
+  defaultConfig(repoRoot) {
+    return {
+      ...DEFAULT_CONFIG_V4,
+      adapter: "claude",
+      audit: {
+        ...DEFAULT_CONFIG_V4.audit,
+        logPath: claudeLayout.defaultAuditLogPath(repoRoot)
+      }
+    };
   }
-  return false;
+};
+
+// src/adapters/layouts/cursor.ts
+import path10 from "node:path";
+function runnerCommand3(platform, repoRoot, hookName, ...args) {
+  const hooksDir = path10.join(path10.resolve(repoRoot), ".cursor", "hooks");
+  return buildRunnerInvocation(platform, hooksDir, repoRoot, hookName, ...args);
 }
-function hasResidualApiKey(text) {
-  return /\bsk-(?![^\s]*<redacted>)[A-Za-z0-9_-]{4,}/i.test(text);
+var cursorLayout = {
+  name: "cursor",
+  configPath(repoRoot) {
+    return path10.join(repoRoot, ".cursor", "belay.config.json");
+  },
+  hooksSettingsPath(repoRoot) {
+    return path10.join(repoRoot, ".cursor", "hooks.json");
+  },
+  hooksDir(repoRoot) {
+    return path10.join(repoRoot, ".cursor", "hooks");
+  },
+  runtimeDir(repoRoot) {
+    return path10.join(repoRoot, ".cursor", "belay", "runtime");
+  },
+  repoLocalStateDir(repoRoot) {
+    return path10.join(repoRoot, ".cursor", "belay");
+  },
+  defaultAuditLogPath(_repoRoot) {
+    return path10.join(".cursor", "belay", "audit.ndjson");
+  },
+  repoRootMarkers: [".git", ".cursor"],
+  runnerCommand: runnerCommand3,
+  defaultConfig(repoRoot) {
+    return {
+      ...DEFAULT_CONFIG_V4,
+      adapter: "cursor",
+      audit: {
+        ...DEFAULT_CONFIG_V4.audit,
+        logPath: cursorLayout.defaultAuditLogPath(repoRoot)
+      }
+    };
+  }
+};
+
+// src/adapters/layouts/index.ts
+var layouts = {
+  cursor: cursorLayout,
+  claude: claudeLayout,
+  codex: codexLayout
+};
+function getAdapterLayout(name = "cursor") {
+  return layouts[name];
 }
-function hasResidualUrlCredentials(text) {
-  for (const match of text.matchAll(URL_CREDENTIALS_PATTERN2)) {
-    const username = (match[1] ?? "").replace(/^['"]|['"]$/g, "");
-    const password = (match[2] ?? "").replace(/^['"]|['"]$/g, "");
-    if (!REDACTED_PLACEHOLDER.test(username) || !REDACTED_PLACEHOLDER.test(password)) {
-      return true;
-    }
+
+// src/config-io.ts
+function resolveAdapterName(config) {
+  if (config.adapter === "claude") {
+    return "claude";
   }
-  return false;
+  if (config.adapter === "codex") {
+    return "codex";
+  }
+  return "cursor";
 }
-function hasResidualAuthHeader(text) {
-  for (const match of text.matchAll(GENERIC_AUTH_HEADER_PATTERN2)) {
-    const token = (match[1] ?? "").replace(/^['"]|['"]$/g, "");
-    if (!REDACTED_PLACEHOLDER.test(token)) {
+function repoLocalStateDirFor(repoRoot, config) {
+  return getAdapterLayout(resolveAdapterName(config)).repoLocalStateDir(repoRoot);
+}
+
+// src/core/credential-store.ts
+import { chmod, mkdir as mkdir2, readFile as readFile2, unlink, writeFile as writeFile2 } from "node:fs/promises";
+import path11 from "node:path";
+var STORE_FILENAME = "credentials.json";
+function credentialStorePath(stateDir) {
+  return path11.join(stateDir, STORE_FILENAME);
+}
+async function readJudgeCredentialStore(stateDir) {
+  const filePath = credentialStorePath(stateDir);
+  try {
+    const raw = await readFile2(filePath, "utf8");
+    const parsed = JSON.parse(raw);
+    const key = parsed.judge?.trim();
+    return key || null;
+  } catch {
+    return null;
+  }
+}
+function parseCredentialRef(ref) {
+  if (ref === "store:judge") {
+    return ref;
+  }
+  if (ref.startsWith("env:") && ref.length > 4) {
+    return ref;
+  }
+  return null;
+}
+
+// src/core/judge-runtime-detection.ts
+import { accessSync, constants } from "node:fs";
+import path12 from "node:path";
+var CLI_COMMANDS = {
+  codex: "codex",
+  cursor: "cursor-agent",
+  claude: "claude"
+};
+function isVitestRuntime(env) {
+  return Boolean(env.VITEST || env.VITEST_WORKER_ID);
+}
+function cliTransportForProvider(providerId) {
+  if (providerId === "ollama") {
+    return null;
+  }
+  return `${providerId}-cli`;
+}
+function commandOnPath(command, env) {
+  const pathValue = env.PATH ?? "";
+  for (const dir of pathValue.split(path12.delimiter).filter(Boolean)) {
+    const candidate = path12.join(dir, command);
+    try {
+      accessSync(candidate, constants.X_OK);
       return true;
+    } catch {
     }
   }
   return false;
 }
-function redactSensitivePathToken(token, sensitivePaths) {
-  const trimmed = token.replace(/^['"`]+|['"`]+$/g, "");
-  const normalized = trimmed.replaceAll("\\", "/");
-  if (!matchesSensitivePath(normalized, sensitivePaths)) {
-    return token;
+function detectJudgeRuntimeCapabilities(providerId, env = process.env) {
+  const normalized = normalizeLegacyProviderId(String(providerId));
+  if (!normalized || normalized === "ollama") {
+    return { http: false, cliTransport: null };
   }
-  const segments = normalized.split("/");
-  const basename = segments.at(-1) ?? normalized;
-  if (segments.length > 1) {
-    return token.replace(basename, "[REDACTED]");
+  if (env.BELAY_JUDGE_DISABLE_CLI_TRANSPORT === "1") {
+    return { http: true, cliTransport: null };
   }
-  return "[REDACTED]";
-}
+  if (isVitestRuntime(env)) {
+    return { http: false, cliTransport: cliTransportForProvider(normalized) };
+  }
+  const command = CLI_COMMANDS[normalized];
+  if (commandOnPath(command, env)) {
+    return { http: false, cliTransport: cliTransportForProvider(normalized) };
+  }
+  return { http: true, cliTransport: null };
+}
+
+// src/core/judge-api-key.ts
+function resolveFromEnvChain(env, catalogSpec) {
+  const belay = env.BELAY_JUDGE_API_KEY?.trim();
+  if (belay) {
+    return { key: belay, source: "BELAY_JUDGE_API_KEY" };
+  }
+  for (const name of catalogSpec?.apiKeyEnvVars ?? ["OPENAI_API_KEY", "BELAY_JUDGE_API_KEY"]) {
+    const value = env[name]?.trim();
+    if (value) {
+      return { key: value, source: name };
+    }
+  }
+  return { key: null, source: null };
+}
+function sourceKindForProjectMode(fromEnv, judge, catalogSpec) {
+  if (fromEnv.key) {
+    return "env";
+  }
+  const providerId = judge.providerId && normalizeLegacyProviderId(judge.providerId) ? normalizeLegacyProviderId(judge.providerId) : inferProviderIdFromConfig(judge);
+  const spec = catalogSpec ?? getJudgeProviderSpec(providerId);
+  if (spec?.isCloud && detectJudgeRuntimeCapabilities(providerId).cliTransport) {
+    return "host-session";
+  }
+  return "missing";
+}
+function sourceKindForApiKeyMode(key, source) {
+  if (!key) {
+    return "missing";
+  }
+  if (source?.startsWith("env:")) {
+    return "env";
+  }
+  return "store";
+}
+async function resolveJudgeCredential(params) {
+  const env = params.env ?? process.env;
+  const credential = params.judge.credential ?? { mode: "project" };
+  if (credential.mode === "apiKey") {
+    const ref = credential.ref ? parseCredentialRef(credential.ref) : "store:judge";
+    if (ref === "store:judge") {
+      const stateDir = belayStateDir(params.config, params.repoLocalStateDir);
+      const key = await readJudgeCredentialStore(stateDir);
+      return {
+        key,
+        source: key ? `${stateDir}/credentials.json` : null,
+        sourceKind: sourceKindForApiKeyMode(key, key ? `${stateDir}/credentials.json` : null),
+        mode: "apiKey"
+      };
+    }
+    if (ref?.startsWith("env:")) {
+      const envName = ref.slice(4);
+      const value = env[envName]?.trim() ?? null;
+      return {
+        key: value,
+        source: value ? `env:${envName}` : null,
+        sourceKind: sourceKindForApiKeyMode(value, value ? `env:${envName}` : null),
+        mode: "apiKey"
+      };
+    }
+    return { key: null, source: null, sourceKind: "missing", mode: "apiKey" };
+  }
+  const fromEnv = resolveFromEnvChain(env, params.catalogSpec);
+  return {
+    ...fromEnv,
+    sourceKind: sourceKindForProjectMode(fromEnv, params.judge, params.catalogSpec),
+    mode: "project"
+  };
+}
+
+// src/core/judge-config.ts
+var JUDGE_PROFILE_LOCAL_OLLAMA = resolveJudgeFromCatalog({
+  providerId: "ollama"
+});
+var JUDGE_PROFILE_CURSOR = resolveJudgeFromCatalog({
+  providerId: "cursor"
+});
+var JUDGE_PROFILE_CLAUDE = resolveJudgeFromCatalog({
+  providerId: "claude"
+});
+var JUDGE_PROFILE_CODEX = resolveJudgeFromCatalog({
+  providerId: "codex"
+});
+function isCloudJudgeConfig(judge) {
+  if (judge.providerId) {
+    return isCloudProviderId(judge.providerId);
+  }
+  return judge.provider === "openai-compatible" || judge.provider === "anthropic";
+}
+function hasValidCloudConsent(judge) {
+  if (!judge.cloudConsent?.accepted) {
+    return false;
+  }
+  if (!judge.endpoint?.trim()) {
+    return false;
+  }
+  const providerId = judge.providerId && normalizeLegacyProviderId(judge.providerId) ? normalizeLegacyProviderId(judge.providerId) : judge.provider === "ollama" ? "ollama" : "codex";
+  return judge.cloudConsent.endpoint === judge.endpoint.trim() && normalizeLegacyProviderId(judge.cloudConsent.providerId) === providerId;
+}
+
+// src/core/verdict/containment.ts
+import path13 from "node:path";
+
+// src/core/verdict/persistent-paths.ts
+function isPersistentAgentPath(resolvedPath) {
+  const normalized = resolvedPath.replaceAll("\\", "/");
+  return /\.ssh\/authorized_keys$/i.test(normalized) || /\/\.(zshrc|bashrc|bash_profile|profile)$/i.test(normalized) || /\/\.config\//i.test(normalized) || /\/crontab$/i.test(normalized) || /LaunchAgents\//i.test(normalized) || /\/Library\/LaunchDaemons\//i.test(normalized);
+}
+function isOutsideRepoSecretCredentialPath(resolvedPath) {
+  const normalized = resolvedPath.replaceAll("\\", "/");
+  return /\/\.env(?:\.[^/]+)?$/i.test(normalized) || /\/[^/]+\.pem$/i.test(normalized) || /\/\.ssh\/id_[^/]+$/i.test(normalized) || /\/\.aws\//i.test(normalized) || /\/\.npmrc$/i.test(normalized) || /\/\.git-credentials$/i.test(normalized) || /\/\.netrc$/i.test(normalized) || /\/\.kube\/config$/i.test(normalized) || /\/\.docker\/config\.json$/i.test(normalized) || /\/\.gnupg\//i.test(normalized) || /\/\.pypirc$/i.test(normalized);
+}
+
+// src/core/verdict/containment.ts
+function expandHome(token) {
+  if (token === "~" || token.startsWith("~/")) {
+    const home = process.env.HOME ?? process.env.USERPROFILE ?? "";
+    if (!home) {
+      return token;
+    }
+    return token === "~" ? home : path13.join(home, token.slice(2));
+  }
+  return token;
+}
+function resolveTrustedPath(token, trustedCwd, trusted) {
+  if (!token || token === "--" || token.startsWith("-")) {
+    return null;
+  }
+  if (!trusted || !trustedCwd) {
+    return null;
+  }
+  const expanded = expandHome(token);
+  if (path13.isAbsolute(expanded)) {
+    return canonicalPath(expanded);
+  }
+  return canonicalPath(path13.resolve(trustedCwd, expanded));
+}
+function locationForPath(resolvedPath, repoRoot) {
+  if (!resolvedPath) {
+    return "unknown";
+  }
+  if (pathWithinRoot(repoRoot, resolvedPath)) {
+    return "repo_local";
+  }
+  return "repo_outside";
+}
+function isGitPath(resolvedPath, repoRoot) {
+  const relative = relativeWithinRepo(repoRoot, resolvedPath);
+  if (!relative) {
+    return false;
+  }
+  const normalized = relative.replaceAll("\\", "/");
+  return normalized === ".git" || normalized.startsWith(".git/");
+}
+function isHighStakesPath(resolvedPath, repoRoot, sensitivePaths, protectedRoots = []) {
+  if (isGitPath(resolvedPath, repoRoot)) {
+    return true;
+  }
+  const relative = relativeWithinRepo(repoRoot, resolvedPath);
+  if (relative !== null && matchesSensitivePath(relative.replaceAll("\\", "/"), sensitivePaths)) {
+    return true;
+  }
+  if (relative === null && isOutsideRepoSecretCredentialPath(resolvedPath)) {
+    return true;
+  }
+  return protectedRoots.some((root) => pathWithinRoot(root, resolvedPath));
+}
+var DESTRUCTIVE_MUTATION_HEADS = /* @__PURE__ */ new Set([
+  "rm",
+  "shred",
+  "truncate",
+  "dd",
+  "chmod",
+  "chown",
+  "mv",
+  "cp"
+]);
+function isDestructiveMutationHead(head) {
+  return DESTRUCTIVE_MUTATION_HEADS.has(head);
+}
+function touchesProtectedRoot(resolvedPath, protectedRoots) {
+  return protectedRoots.some((root) => pathWithinRoot(root, resolvedPath) || root === resolvedPath);
+}
+function isDestructiveHighStakesMutation(head, resolvedPath, repoRoot, sensitivePaths, protectedRoots = []) {
+  if (touchesProtectedRoot(resolvedPath, protectedRoots)) {
+    return true;
+  }
+  if (!isDestructiveMutationHead(head)) {
+    return false;
+  }
+  return isHighStakesPath(resolvedPath, repoRoot, sensitivePaths, []);
+}
+function analyzePathTargets(params) {
+  const signals = [];
+  if (!params.trustedCwd || !params.cwd) {
+    return {
+      location: "unknown",
+      isHighStakes: false,
+      signals: ["missing_trusted_cwd"]
+    };
+  }
+  const locations = /* @__PURE__ */ new Set();
+  let isHighStakes = false;
+  for (const target of params.targets) {
+    const resolved = resolveTrustedPath(target, params.cwd, params.trustedCwd) ?? resolveMutationTarget(target, params.cwd);
+    const location2 = locationForPath(resolved, params.repoRoot);
+    locations.add(location2);
+    if (resolved && isHighStakesPath(
+      resolved,
+      params.repoRoot,
+      params.sensitivePaths,
+      params.protectedArtifactRoots
+    )) {
+      isHighStakes = true;
+      signals.push("high_stakes_path");
+    }
+  }
+  let location = "unknown";
+  if (locations.size === 0) {
+    location = "unknown";
+  } else if (locations.size === 1) {
+    location = [...locations][0] ?? "unknown";
+  } else {
+    location = "mixed";
+  }
+  return { location, isHighStakes, signals };
+}
+function cwdRelative(repoRoot, cwd) {
+  return relativeWithinRepo(repoRoot, cwd) ?? cwd;
+}
+
+// src/core/verdict/judge-outbound.ts
+var PATH_LIKE = /(?:^|[\s"'`=])(~\/[^\s"'`]+|\/[^\s"'`]+|\.\/[^\s"'`]+|\.\.\/[^\s"'`]+|[A-Za-z]:\\[^\s"'`]+)/g;
+var REDACTED_PLACEHOLDER = /^(?:<redacted>|\[REDACTED\]|<secret>|<high-entropy>|<approval-id>)$/i;
+var URL_CREDENTIALS_PATTERN2 = /\b[A-Za-z][A-Za-z0-9+.-]*:\/\/([^/\s:@]+):([^@\s/]+)@/gi;
+var GENERIC_AUTH_HEADER_PATTERN2 = /\b(?:Authorization|X-Api-Key|X-Auth-Token|Private-Token):\s*([^\s]+)/gi;
+function hasResidualBearerToken(text) {
+  for (const match of text.matchAll(/\bBearer\s+(\S+)/gi)) {
+    const token = match[1] ?? "";
+    if (!REDACTED_PLACEHOLDER.test(token)) {
+      return true;
+    }
+  }
+  return false;
+}
+function hasResidualApiKey(text) {
+  return /\bsk-(?![^\s]*<redacted>)[A-Za-z0-9_-]{4,}/i.test(text);
+}
+function hasResidualUrlCredentials(text) {
+  for (const match of text.matchAll(URL_CREDENTIALS_PATTERN2)) {
+    const username = (match[1] ?? "").replace(/^['"]|['"]$/g, "");
+    const password = (match[2] ?? "").replace(/^['"]|['"]$/g, "");
+    if (!REDACTED_PLACEHOLDER.test(username) || !REDACTED_PLACEHOLDER.test(password)) {
+      return true;
+    }
+  }
+  return false;
+}
+function hasResidualAuthHeader(text) {
+  for (const match of text.matchAll(GENERIC_AUTH_HEADER_PATTERN2)) {
+    const token = (match[1] ?? "").replace(/^['"]|['"]$/g, "");
+    if (!REDACTED_PLACEHOLDER.test(token)) {
+      return true;
+    }
+  }
+  return false;
+}
+function redactSensitivePathToken(token, sensitivePaths) {
+  const trimmed = token.replace(/^['"`]+|['"`]+$/g, "");
+  const normalized = trimmed.replaceAll("\\", "/");
+  if (!matchesSensitivePath(normalized, sensitivePaths)) {
+    return token;
+  }
+  const segments = normalized.split("/");
+  const basename = segments.at(-1) ?? normalized;
+  if (segments.length > 1) {
+    return token.replace(basename, "[REDACTED]");
+  }
+  return "[REDACTED]";
+}
 function scrubOutboundForJudge(text, options) {
   try {
     let scrubbed = scrubString(text, {
@@ -1588,37 +2298,57 @@ function scrubOutboundForJudge(text, options) {
   }
 }
 
-// src/core/v2/judge.ts
+// src/core/verdict/judge.ts
 var SECRET_PATTERNS = [/\.env\b/i, /\.pem\b/i, /id_rsa\b/i, /credentials/i, /secrets?\b/i];
 var DESTRUCTIVE_VERBS = /\b(rm|rmtree|unlink|delete|truncate|shred|destroy|drop)\b/i;
 var GIT_PATTERNS = /\.git\b/i;
-var TIER1_PROMPT = `Answer ONLY with JSON: {"external_change":boolean,"destroys_outside_repo":boolean,"destroys_history_or_secrets":boolean,"reason":string}
-Default all three booleans to true when unsure. reason should be a short snake_case label.
+var TIER1_PROMPT = `Answer ONLY with JSON: {"local_recoverable":boolean,"destroys_history_or_secrets":boolean,"reason":string}
+reason should be a short snake_case label.
+
+local_recoverable: true if a mistaken operation can be undone locally (git revert, fs snapshot, trivial manual revert).
+local_recoverable: false if remote/destructive (git push --force, aws s3 rm, secret send) OR persistent local harm (~/.ssh/authorized_keys, shell rc, crontab, ~/.config persistence).
+
+destroys_history_or_secrets: true if the operation deletes or corrupts git history (.git), overwrites secrets/credentials, or modifies persistent agent startup (shell rc, crontab, launchd, authorized_keys).
 
-external_change: CREATE/MODIFY/DELETE on database, network endpoint, cloud, remote git, registry, queue. READ/QUERY/GET is NOT a change.
-destroys_outside_repo: DELETE/OVERWRITE files OUTSIDE the current repository working tree.
-destroys_history_or_secrets: DELETE/OVERWRITE .git directory OR secret/credential files (.env, *.pem, id_rsa, credentials).
+Examples local_recoverable=true, destroys_history_or_secrets=false: IDE plan files under the user home, /tmp files, in-repo edits, READ/QUERY/GET.
+Examples local_recoverable=false OR destroys_history_or_secrets=true: remote mutations, credential paths, agent startup persistence, rm -rf .git.
+If genuinely ambiguous about recoverability or persistent harm, answer false.
 
 Command/code:
 `;
 function failClosedVerdict(reason) {
   return {
-    external_change: true,
+    local_recoverable: false,
     destroys_outside_repo: true,
     destroys_history_or_secrets: true,
+    external_change: true,
     reason
   };
 }
+function parseLocalRecoverable(parsed) {
+  if (typeof parsed.local_recoverable === "boolean") {
+    return parsed.local_recoverable;
+  }
+  if (typeof parsed.external_change === "boolean") {
+    return !parsed.external_change;
+  }
+  return null;
+}
+function buildTier1Prompt(text) {
+  return `${TIER1_PROMPT}${text}`;
+}
 function parseTier1Json(raw) {
   try {
     const parsed = JSON.parse(raw);
-    if (typeof parsed.external_change !== "boolean" || typeof parsed.destroys_outside_repo !== "boolean" || typeof parsed.destroys_history_or_secrets !== "boolean") {
+    const localRecoverable = parseLocalRecoverable(parsed);
+    if (localRecoverable === null) {
       return null;
     }
     return {
-      external_change: parsed.external_change !== false,
-      destroys_outside_repo: parsed.destroys_outside_repo !== false,
-      destroys_history_or_secrets: parsed.destroys_history_or_secrets !== false,
+      local_recoverable: localRecoverable,
+      destroys_outside_repo: typeof parsed.destroys_outside_repo === "boolean" ? parsed.destroys_outside_repo : false,
+      destroys_history_or_secrets: typeof parsed.destroys_history_or_secrets === "boolean" ? parsed.destroys_history_or_secrets : false,
+      external_change: parsed.external_change,
       reason: typeof parsed.reason === "string" ? parsed.reason : "tier1_llm"
     };
   } catch {
@@ -1632,7 +2362,7 @@ function prescanInterpreterCode(code) {
   const hitsDestructive = DESTRUCTIVE_VERBS.test(normalized);
   if ((hitsSecret || hitsGit) && hitsDestructive) {
     return {
-      external_change: false,
+      local_recoverable: true,
       destroys_outside_repo: false,
       destroys_history_or_secrets: true,
       reason: "prescan_destructive_secret"
@@ -1640,11 +2370,49 @@ function prescanInterpreterCode(code) {
   }
   return null;
 }
+function prescanMutationTargets(params) {
+  for (const target of params.targets) {
+    const resolved = resolveTrustedPath(target, params.cwd, params.trustedCwd) ?? resolveMutationTarget(target, params.cwd);
+    if (!resolved) {
+      continue;
+    }
+    const relative = relativeWithinRepo(params.repoRoot, resolved);
+    if (relative !== null && matchesSensitivePath(relative.replaceAll("\\", "/"), params.sensitivePaths)) {
+      return {
+        local_recoverable: false,
+        destroys_outside_repo: false,
+        destroys_history_or_secrets: true,
+        reason: "sensitive_path_mutation"
+      };
+    }
+    if (relative === null && isOutsideRepoSecretCredentialPath(resolved)) {
+      return {
+        local_recoverable: false,
+        destroys_outside_repo: false,
+        destroys_history_or_secrets: true,
+        reason: "outside_repo_secret_credential_path"
+      };
+    }
+    if (isPersistentAgentPath(resolved)) {
+      return {
+        local_recoverable: false,
+        destroys_outside_repo: false,
+        destroys_history_or_secrets: true,
+        reason: "persistent_agent_path"
+      };
+    }
+  }
+  return null;
+}
+function mutationPrescanRequiresAsk(params) {
+  const prescan = prescanMutationTargets(params);
+  return prescan && tier1RequiresAsk(prescan) ? prescan : null;
+}
 function createDeterministicJudgeStub() {
   return {
     evaluate() {
       return Promise.resolve({
-        external_change: false,
+        local_recoverable: true,
         destroys_outside_repo: false,
         destroys_history_or_secrets: false,
         reason: "deterministic_stub"
@@ -1776,8 +2544,7 @@ function createOpenAiCompatibleJudge(options) {
         };
         return failClosedVerdict("outbound_scrub_failed");
       }
-      const { resolveJudgeApiKey: resolveJudgeApiKey2 } = await Promise.resolve().then(() => (init_judge_api_key(), judge_api_key_exports));
-      const resolvedKey = resolveJudgeApiKey2();
+      const resolvedKey = options.resolveApiKey ? await options.resolveApiKey() : { key: options.apiKey ?? null, source: null };
       const apiKey = options.apiKey ?? resolvedKey.key;
       if (!apiKey) {
         judge.lastTrace = {
@@ -1841,43 +2608,385 @@ function createOpenAiCompatibleJudge(options) {
   return judge;
 }
 function tier1RequiresAsk(verdict2) {
-  return verdict2.external_change || verdict2.destroys_outside_repo || verdict2.destroys_history_or_secrets;
+  return !verdict2.local_recoverable || verdict2.destroys_history_or_secrets;
 }
 
-// src/core/v2/judge-factory.ts
-var FIXTURE_MODELS_URL = new URL("../../../fixtures/judge-models.json", import.meta.url);
-function resolveCloudModel(requested, pinned) {
-  if (requested === "auto") {
-    const envResolved = process.env.BELAY_JUDGE_MODEL_RESOLVED?.trim();
+// src/core/verdict/judge-cli.ts
+import { spawn } from "node:child_process";
+var CLI_BINARIES = {
+  codex: "codex",
+  cursor: "cursor-agent",
+  claude: "claude"
+};
+function failClosedVerdict2(reason) {
+  return {
+    local_recoverable: false,
+    destroys_outside_repo: true,
+    destroys_history_or_secrets: true,
+    external_change: true,
+    reason
+  };
+}
+function transportForProvider(providerId) {
+  return `${providerId}-cli`;
+}
+function traceProvider(providerId) {
+  if (providerId === "claude") {
+    return "anthropic";
+  }
+  return "openai-compatible";
+}
+function initialTrace(options) {
+  return {
+    provider: traceProvider(options.providerId),
+    modelRequested: options.modelRequested,
+    modelResolved: options.modelResolved,
+    latencyMs: 0,
+    transport: transportForProvider(options.providerId)
+  };
+}
+function buildCliInvocation(providerId, prompt, model) {
+  if (providerId === "codex") {
     return {
-      requested,
-      resolved: envResolved || pinned.autoResolved
+      binary: CLI_BINARIES[providerId],
+      args: [
+        "exec",
+        "--json",
+        "--skip-git-repo-check",
+        "--sandbox",
+        "read-only",
+        "--model",
+        model,
+        "-"
+      ],
+      stdin: prompt
     };
   }
-  return { requested, resolved: requested };
+  if (providerId === "cursor") {
+    return {
+      binary: CLI_BINARIES[providerId],
+      args: [
+        "--print",
+        "--output-format",
+        "json",
+        "--mode",
+        "ask",
+        "--sandbox",
+        "enabled",
+        "--trust",
+        "--model",
+        model,
+        prompt
+      ]
+    };
+  }
+  return {
+    binary: CLI_BINARIES[providerId],
+    args: [
+      "-p",
+      "--output-format",
+      "json",
+      "--permission-mode",
+      "plan",
+      "--tools",
+      "",
+      "--bare",
+      "--model",
+      model
+    ],
+    stdin: prompt
+  };
+}
+function tryParseJson(raw) {
+  try {
+    return JSON.parse(raw);
+  } catch {
+    return null;
+  }
+}
+function extractVerdictFromJsonValue(value) {
+  if (typeof value === "string") {
+    return parseTier1Json(value.trim());
+  }
+  if (Array.isArray(value)) {
+    for (let index = value.length - 1; index >= 0; index -= 1) {
+      const verdict2 = extractVerdictFromJsonValue(value[index]);
+      if (verdict2) {
+        return verdict2;
+      }
+    }
+    return null;
+  }
+  if (!value || typeof value !== "object") {
+    return null;
+  }
+  const record = value;
+  for (const key of ["result", "content", "text", "message", "output_text", "final"]) {
+    if (!(key in record)) {
+      continue;
+    }
+    const verdict2 = extractVerdictFromJsonValue(record[key]);
+    if (verdict2) {
+      return verdict2;
+    }
+  }
+  for (const candidate of Object.values(record).reverse()) {
+    const verdict2 = extractVerdictFromJsonValue(candidate);
+    if (verdict2) {
+      return verdict2;
+    }
+  }
+  return null;
+}
+function parseCliJsonLines(raw) {
+  const lines = raw.split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
+  for (let index = lines.length - 1; index >= 0; index -= 1) {
+    const parsed = tryParseJson(lines[index] ?? "");
+    if (!parsed) {
+      continue;
+    }
+    const verdict2 = extractVerdictFromJsonValue(parsed);
+    if (verdict2) {
+      return verdict2;
+    }
+  }
+  return null;
+}
+function parseCliJudgeOutput(providerId, raw) {
+  const direct = parseTier1Json(raw);
+  if (direct) {
+    return direct;
+  }
+  const parsed = tryParseJson(raw);
+  if (parsed) {
+    const envelopeVerdict = extractVerdictFromJsonValue(parsed);
+    if (envelopeVerdict) {
+      return envelopeVerdict;
+    }
+  }
+  if (providerId === "codex") {
+    return parseCliJsonLines(raw);
+  }
+  return parseCliJsonLines(raw);
+}
+async function runCliJson(invocation, timeoutMs) {
+  const { binary, args, stdin } = invocation;
+  return new Promise((resolve, reject) => {
+    const child = spawn(binary, args, {
+      stdio: ["pipe", "pipe", "pipe"]
+    });
+    let stdout = "";
+    let stderr = "";
+    const timer = setTimeout(() => {
+      child.kill("SIGTERM");
+      reject(new Error(`${binary} timed out`));
+    }, timeoutMs);
+    child.stdout.on("data", (chunk) => {
+      stdout += String(chunk);
+    });
+    child.stderr.on("data", (chunk) => {
+      stderr += String(chunk);
+    });
+    if (stdin !== void 0) {
+      child.stdin.write(stdin);
+    }
+    child.stdin.end();
+    child.on("error", (error) => {
+      clearTimeout(timer);
+      reject(error);
+    });
+    child.on("close", (code) => {
+      clearTimeout(timer);
+      if (code === 0 && stdout.trim()) {
+        resolve(stdout.trim());
+        return;
+      }
+      reject(new Error(stderr.trim() || `${binary} exited with code ${code ?? "unknown"}`));
+    });
+  });
+}
+function createCliJudge(options) {
+  const transport = transportForProvider(options.providerId);
+  const timeoutMs = options.timeoutMs ?? 25e3;
+  const providerId = options.providerId;
+  const runCommand = options.runCliCommand ?? runCliJson;
+  const judge = {
+    lastTrace: initialTrace(options),
+    async evaluate(input) {
+      const started = Date.now();
+      const prescan = input.innerCode ? prescanInterpreterCode(input.innerCode) : null;
+      if (prescan?.destroys_history_or_secrets) {
+        judge.lastTrace = {
+          provider: traceProvider(options.providerId),
+          modelRequested: options.modelRequested,
+          modelResolved: options.modelResolved,
+          latencyMs: Date.now() - started,
+          transport
+        };
+        return prescan;
+      }
+      const scrubbed = scrubOutboundForJudge(input.text, {
+        sensitivePaths: options.sensitivePaths,
+        scrubOptions: options.scrubOptions
+      });
+      if (!scrubbed.ok) {
+        judge.lastTrace = {
+          provider: "fallback",
+          modelRequested: options.modelRequested,
+          modelResolved: options.modelResolved,
+          latencyMs: Date.now() - started,
+          fallbackReason: scrubbed.reason
+        };
+        return failClosedVerdict2("outbound_scrub_failed");
+      }
+      const prompt = buildTier1Prompt(scrubbed.text);
+      try {
+        const raw = await runCommand(
+          buildCliInvocation(providerId, prompt, options.modelResolved),
+          timeoutMs
+        );
+        const parsed = parseCliJudgeOutput(providerId, raw);
+        if (!parsed) {
+          judge.lastTrace = {
+            provider: "fallback",
+            modelRequested: options.modelRequested,
+            modelResolved: options.modelResolved,
+            latencyMs: Date.now() - started,
+            fallbackReason: `${providerId}_cli_parse_error`
+          };
+          return failClosedVerdict2(`${providerId}_cli_parse_error`);
+        }
+        judge.lastTrace = {
+          provider: traceProvider(options.providerId),
+          modelRequested: options.modelRequested,
+          modelResolved: options.modelResolved,
+          latencyMs: Date.now() - started,
+          transport,
+          outboundRedacted: true
+        };
+        return parsed;
+      } catch {
+        judge.lastTrace = {
+          provider: "fallback",
+          modelRequested: options.modelRequested,
+          modelResolved: options.modelResolved,
+          latencyMs: Date.now() - started,
+          fallbackReason: `${providerId}_cli_unavailable`
+        };
+        return failClosedVerdict2(`${providerId}_cli_unavailable`);
+      }
+    }
+  };
+  return judge;
+}
+function createCodexCliJudge(options) {
+  return createCliJudge({ ...options, providerId: "codex" });
+}
+function createCursorCliJudge(options) {
+  return createCliJudge({ ...options, providerId: "cursor" });
+}
+function createClaudeCliJudge(options) {
+  return createCliJudge({ ...options, providerId: "claude" });
+}
+
+// src/core/verdict/judge-factory.ts
+var FIXTURE_MODELS_URL = new URL("../../../fixtures/judge-models.json", import.meta.url);
+function resolveJudgeModel(judge) {
+  rejectDeprecatedJudgeModelAuto(judge.model);
+  const requested = judge.model;
+  const envOverride = testJudgeModelOverride();
+  return { requested, resolved: envOverride || requested };
+}
+function testJudgeModelOverride() {
+  if (!process.env.VITEST && !process.env.VITEST_WORKER_ID) {
+    return void 0;
+  }
+  return process.env.BELAY_JUDGE_MODEL_RESOLVED?.trim() || void 0;
+}
+function providerIdFromJudge(judge) {
+  if (judge.providerId) {
+    const normalized = normalizeLegacyProviderId(judge.providerId);
+    if (normalized) {
+      return normalized;
+    }
+  }
+  return inferProviderIdFromConfig(judge);
+}
+function createCliJudgeForProvider(providerId, judgeConfig, config) {
+  const { resolved } = resolveJudgeModel(judgeConfig);
+  const options = {
+    modelRequested: judgeConfig.model,
+    modelResolved: resolved,
+    timeoutMs: judgeConfig.timeoutMs,
+    sensitivePaths: config.classifier.sensitivePaths,
+    scrubOptions: scrubOptionsFromConfig(config)
+  };
+  if (providerId === "codex") {
+    return createCodexCliJudge(options);
+  }
+  if (providerId === "cursor") {
+    return createCursorCliJudge(options);
+  }
+  return createClaudeCliJudge(options);
 }
 function createJudgeFromConfig(config, options = {}) {
+  if (process.env.BELAY_DETERMINISTIC_JUDGE === "1") {
+    return createDeterministicJudgeStub();
+  }
   const judgeConfig = config.judge;
+  if (judgeConfig.providerId && isRemovedProviderId(String(judgeConfig.providerId))) {
+    const { resolved: resolved2 } = resolveJudgeModel(judgeConfig);
+    return createFailClosedJudge({
+      reason: "judge_provider_removed",
+      fallbackReason: "provider_migration_required",
+      modelRequested: judgeConfig.model,
+      modelResolved: resolved2
+    });
+  }
   const provider = normalizeJudgeProvider(judgeConfig.provider);
+  const providerId = providerIdFromJudge(judgeConfig);
+  const catalogSpec = getJudgeProviderSpec(providerId);
+  const { resolved } = resolveJudgeModel(judgeConfig);
+  const runtime = detectJudgeRuntimeCapabilities(providerId);
   if (provider === "openai-compatible") {
     const endpoint = judgeConfig.endpoint?.trim();
+    if (!endpoint && runtime.cliTransport) {
+      if (providerId === "codex" || providerId === "cursor") {
+        return createCliJudgeForProvider(providerId, judgeConfig, config);
+      }
+    }
     if (!endpoint) {
       return createFailClosedJudge({
         reason: "openai_compatible_endpoint_missing",
         fallbackReason: "missing_endpoint",
         modelRequested: judgeConfig.model,
-        modelResolved: judgeConfig.model
+        modelResolved: resolved
       });
     }
-    const pinned = options.pinnedModels ?? { autoResolved: "composer-2.5" };
-    const { resolved } = resolveCloudModel(judgeConfig.model, pinned);
+    if (isCloudJudgeConfig(judgeConfig) && !hasValidCloudConsent(judgeConfig)) {
+      return createFailClosedJudge({
+        reason: "openai_compatible_consent_missing",
+        fallbackReason: "cloud_consent_missing",
+        modelRequested: judgeConfig.model,
+        modelResolved: resolved
+      });
+    }
+    const repoRoot = options.repoRoot ?? process.cwd();
+    const repoLocalStateDir = repoLocalStateDirFor(repoRoot, config);
     return createOpenAiCompatibleJudge({
       endpoint,
       modelRequested: judgeConfig.model,
       modelResolved: resolved,
       timeoutMs: judgeConfig.timeoutMs,
       sensitivePaths: config.classifier.sensitivePaths,
-      scrubOptions: scrubOptionsFromConfig(config)
+      scrubOptions: scrubOptionsFromConfig(config),
+      resolveApiKey: async () => resolveJudgeCredential({
+        judge: judgeConfig,
+        catalogSpec: catalogSpec ?? void 0,
+        repoRoot,
+        repoLocalStateDir,
+        config
+      })
     });
   }
   if (provider === "ollama") {
@@ -1888,105 +2997,32 @@ function createJudgeFromConfig(config, options = {}) {
       keepAlive: judgeConfig.keepAlive
     });
   }
-  return createDeterministicJudgeStub();
-}
-
-// src/core/v2/verdict.ts
-import path11 from "node:path";
-
-// src/core/v2/containment.ts
-import path8 from "node:path";
-function expandHome(token) {
-  if (token === "~" || token.startsWith("~/")) {
-    const home = process.env.HOME ?? process.env.USERPROFILE ?? "";
-    if (!home) {
-      return token;
-    }
-    return token === "~" ? home : path8.join(home, token.slice(2));
-  }
-  return token;
-}
-function resolveTrustedPath(token, trustedCwd, trusted) {
-  if (!token || token === "--" || token.startsWith("-")) {
-    return null;
-  }
-  if (!trusted || !trustedCwd) {
-    return null;
-  }
-  const expanded = expandHome(token);
-  if (path8.isAbsolute(expanded)) {
-    return canonicalPath(expanded);
-  }
-  return canonicalPath(path8.resolve(trustedCwd, expanded));
-}
-function locationForPath(resolvedPath, repoRoot) {
-  if (!resolvedPath) {
-    return "unknown";
-  }
-  if (pathWithinRoot(repoRoot, resolvedPath)) {
-    return "repo_local";
-  }
-  return "repo_outside";
-}
-function isGitPath(resolvedPath, repoRoot) {
-  const relative = relativeWithinRepo(repoRoot, resolvedPath);
-  if (!relative) {
-    return false;
-  }
-  const normalized = relative.replaceAll("\\", "/");
-  return normalized === ".git" || normalized.startsWith(".git/");
-}
-function isHighStakesPath(resolvedPath, repoRoot, sensitivePaths, protectedRoots = []) {
-  if (isGitPath(resolvedPath, repoRoot)) {
-    return true;
-  }
-  const relative = relativeWithinRepo(repoRoot, resolvedPath);
-  const checkPath = relative ?? resolvedPath;
-  if (matchesSensitivePath(checkPath.replaceAll("\\", "/"), sensitivePaths)) {
-    return true;
-  }
-  return protectedRoots.some((root) => pathWithinRoot(root, resolvedPath));
-}
-function analyzePathTargets(params) {
-  const signals = [];
-  if (!params.trustedCwd || !params.cwd) {
-    return {
-      location: "unknown",
-      isHighStakes: false,
-      signals: ["missing_trusted_cwd"]
-    };
-  }
-  const locations = /* @__PURE__ */ new Set();
-  let isHighStakes = false;
-  for (const target of params.targets) {
-    const resolved = resolveTrustedPath(target, params.cwd, params.trustedCwd) ?? resolveMutationTarget(target, params.cwd);
-    const location2 = locationForPath(resolved, params.repoRoot);
-    locations.add(location2);
-    if (resolved && isHighStakesPath(
-      resolved,
-      params.repoRoot,
-      params.sensitivePaths,
-      params.protectedArtifactRoots
-    )) {
-      isHighStakes = true;
-      signals.push("high_stakes_path");
+  if (provider === "anthropic") {
+    if (runtime.cliTransport) {
+      return createClaudeCliJudge({
+        modelRequested: judgeConfig.model,
+        modelResolved: resolved,
+        timeoutMs: judgeConfig.timeoutMs,
+        sensitivePaths: config.classifier.sensitivePaths,
+        scrubOptions: scrubOptionsFromConfig(config)
+      });
     }
+    return createFailClosedJudge({
+      reason: "anthropic_not_implemented",
+      fallbackReason: "anthropic_runtime_unavailable",
+      modelRequested: judgeConfig.model,
+      modelResolved: resolved
+    });
   }
-  let location = "unknown";
-  if (locations.size === 0) {
-    location = "unknown";
-  } else if (locations.size === 1) {
-    location = [...locations][0] ?? "unknown";
-  } else {
-    location = "mixed";
-  }
-  return { location, isHighStakes, signals };
-}
-function cwdRelative(repoRoot, cwd) {
-  return relativeWithinRepo(repoRoot, cwd) ?? cwd;
+  return createFailClosedJudge({
+    reason: "unsupported_judge_provider",
+    fallbackReason: "unsupported_provider",
+    modelRequested: judgeConfig.model,
+    modelResolved: resolved
+  });
 }
 
-// src/core/v2/egress-classify.ts
+// src/core/verdict/egress-classify.ts
 var EGRESS_TOOL_HEADS = /* @__PURE__ */ new Set([
   "aws",
   "curl",
@@ -2084,6 +3120,9 @@ function classifyAws(tokens) {
   if (/\bs3\s+rm\b/.test(joined)) {
     return "destructive";
   }
+  if (/\bs3\s+mb\b/.test(joined)) {
+    return "destructive";
+  }
   if (/\bs3\s+sync\b/.test(joined)) {
     return "destructive";
   }
@@ -2194,17 +3233,61 @@ function classifyNetlify(tokens) {
   return "ambiguous";
 }
 
-// src/core/v2/fingerprint.ts
+// src/core/verdict/fingerprint.ts
 function verdictFingerprint(cwdRelative2, commandRedacted) {
   return hashValue(`v2:${cwdRelative2}:${commandRedacted}`);
 }
 
-// src/core/v2/launcher-resolve.ts
+// src/core/verdict/launcher-resolve.ts
 import { existsSync as existsSync4, readFileSync as readFileSync2 } from "node:fs";
-import path9 from "node:path";
+import path14 from "node:path";
 var MAX_RESOLVE_DEPTH = 8;
+var PNPM_BUILTIN_COMMANDS = /* @__PURE__ */ new Set([
+  "add",
+  "audit",
+  "cache",
+  "config",
+  "deploy",
+  "dlx",
+  "exec",
+  "fetch",
+  "help",
+  "import",
+  "init",
+  "install",
+  "i",
+  "licenses",
+  "link",
+  "list",
+  "outdated",
+  "pack",
+  "patch",
+  "patch-commit",
+  "patch-remove",
+  "publish",
+  "prune",
+  "rebuild",
+  "remove",
+  "rm",
+  "store",
+  "unlink",
+  "update",
+  "up",
+  "why"
+]);
+var PNPM_EXEC_LIKE_HEADS = /* @__PURE__ */ new Set([
+  "vitest",
+  "vite",
+  "biome",
+  "eslint",
+  "jest",
+  "mocha",
+  "tsc",
+  "tsx",
+  "node"
+]);
 function readPackageJson(dir) {
-  const packagePath = path9.join(dir, "package.json");
+  const packagePath = path14.join(dir, "package.json");
   if (!existsSync4(packagePath)) {
     return null;
   }
@@ -2215,17 +3298,17 @@ function readPackageJson(dir) {
   }
 }
 function findPackageJson(startDir, stopDir) {
-  let current = path9.resolve(startDir);
-  const stop = path9.resolve(stopDir);
+  let current = path14.resolve(startDir);
+  const stop = path14.resolve(stopDir);
   while (true) {
-    const packagePath = path9.join(current, "package.json");
+    const packagePath = path14.join(current, "package.json");
     if (existsSync4(packagePath)) {
       return packagePath;
     }
-    if (current === stop || current === path9.dirname(current)) {
+    if (current === stop || current === path14.dirname(current)) {
       return existsSync4(packagePath) ? packagePath : null;
     }
-    const parent = path9.dirname(current);
+    const parent = path14.dirname(current);
     if (!parent.startsWith(stop) && parent !== current) {
     }
     if (parent === current) {
@@ -2257,6 +3340,12 @@ function npmScriptName(tokens) {
   if (launcher[0] === "pnpm" && launcher[1] === "run" && launcher[2]) {
     return launcher[2];
   }
+  if (launcher[0] === "pnpm" && launcher[1] === "test") {
+    return "test";
+  }
+  if (launcher[0] === "pnpm" && launcher[1] && !launcher[1].startsWith("-") && !PNPM_BUILTIN_COMMANDS.has(launcher[1])) {
+    return launcher[1];
+  }
   if (launcher[0] === "npm" && launcher[1] && launcher[1] !== "run" && launcher[1] !== "install") {
     return null;
   }
@@ -2276,7 +3365,7 @@ function resolveNpmRecipe(cwd, repoRoot, scriptName, extraArgs) {
     }
     return { recipes: [], opaque: true, reason: "package_json_missing" };
   }
-  const pkg = readPackageJson(path9.dirname(packagePath));
+  const pkg = readPackageJson(path14.dirname(packagePath));
   const scripts = pkg?.scripts;
   if (!scripts || typeof scripts !== "object") {
     return { recipes: [], opaque: true, reason: "package_scripts_missing" };
@@ -2341,20 +3430,20 @@ function parseMakefileRecipes(makefilePath) {
 function resolveMakeRecipe(cwd, repoRoot, target) {
   const candidates = ["Makefile", "makefile", "GNUmakefile"];
   let makefilePath = null;
-  let searchDir = path9.resolve(cwd);
-  const stop = path9.resolve(repoRoot);
+  let searchDir = path14.resolve(cwd);
+  const stop = path14.resolve(repoRoot);
   while (true) {
     for (const name of candidates) {
-      const candidate = path9.join(searchDir, name);
+      const candidate = path14.join(searchDir, name);
       if (existsSync4(candidate)) {
         makefilePath = candidate;
         break;
       }
     }
-    if (makefilePath || searchDir === stop || searchDir === path9.dirname(searchDir)) {
+    if (makefilePath || searchDir === stop || searchDir === path14.dirname(searchDir)) {
       break;
     }
-    searchDir = path9.dirname(searchDir);
+    searchDir = path14.dirname(searchDir);
   }
   if (!makefilePath) {
     return { recipes: [], opaque: true, reason: "unknown_local_effect" };
@@ -2378,11 +3467,31 @@ function resolveLauncherRecipe(params) {
   const tokens = params.tokens;
   const scriptName = npmScriptName(tokens);
   if (scriptName) {
-    return resolveNpmRecipe(params.cwd, params.repoRoot, scriptName, forwardedArgs(tokens));
+    const resolution = resolveNpmRecipe(
+      params.cwd,
+      params.repoRoot,
+      scriptName,
+      forwardedArgs(tokens)
+    );
+    if (tokens[0] === "pnpm" && tokens[1] && PNPM_EXEC_LIKE_HEADS.has(tokens[1]) && resolution.reason === "npm_script_undefined") {
+      return {
+        recipes: [tokens.slice(1).join(" ")],
+        opaque: false,
+        reason: "pnpm_exec_like"
+      };
+    }
+    return resolution;
   }
   if (tokens[0] === "make" && tokens[1] && !tokens[1].startsWith("-")) {
     return resolveMakeRecipe(params.cwd, params.repoRoot, tokens[1]);
   }
+  if (tokens[0] === "pnpm" && tokens[1] && PNPM_EXEC_LIKE_HEADS.has(tokens[1])) {
+    return {
+      recipes: [tokens.slice(1).join(" ")],
+      opaque: false,
+      reason: "pnpm_exec_like"
+    };
+  }
   return null;
 }
 function isRoutineLauncher(tokens) {
@@ -2398,7 +3507,7 @@ function matchesCustomCommand(normalizedCommand, key, pattern) {
   return normalizedCommand === trimmed || key === trimmed;
 }
 
-// src/core/v2/overrides.ts
+// src/core/verdict/overrides.ts
 function matchesCustomPatterns(command, segment, patterns) {
   if (!patterns || patterns.length === 0) {
     return false;
@@ -2437,8 +3546,8 @@ function askFromCustomExternal(opacity) {
   };
 }
 
-// src/core/v2/parser.ts
-import path10 from "node:path";
+// src/core/verdict/parser.ts
+import path15 from "node:path";
 
 // src/core/shell-substitution.ts
 function findCommandSubstitutions(command) {
@@ -2661,7 +3770,7 @@ function hasUnbalancedDollarParen(command) {
   return depth > 0;
 }
 
-// src/core/v2/parser.ts
+// src/core/verdict/parser.ts
 var ENV_PREFIX_PATTERN = /^[A-Za-z_][A-Za-z0-9_]*=(?:'[^']*'|"[^"]*"|\S+)$/;
 var TRANSPARENT_WRAPPERS = /* @__PURE__ */ new Set([
   "sudo",
@@ -2688,7 +3797,7 @@ var INTERPRETER_SCRIPT_EXTENSIONS = /* @__PURE__ */ new Set([
   ".sh"
 ]);
 function normalizeHead(token) {
-  const base = path10.basename(token);
+  const base = path15.basename(token);
   if (base && base !== "." && base !== "..") {
     return base;
   }
@@ -2793,7 +3902,7 @@ function isBareInterpreter(tokens) {
     return false;
   }
   const scriptArg = args.find((token) => !token.startsWith("-"));
-  if (scriptArg && INTERPRETER_SCRIPT_EXTENSIONS.has(path10.extname(scriptArg))) {
+  if (scriptArg && INTERPRETER_SCRIPT_EXTENSIONS.has(path15.extname(scriptArg))) {
     return false;
   }
   if (scriptArg) {
@@ -2861,7 +3970,7 @@ function redactCommand(command) {
   return command.replace(/Bearer\s+[A-Za-z0-9._~+/=-]+/gi, "Bearer [REDACTED]").replace(/sk-[A-Za-z0-9]{8,}/g, "sk-[REDACTED]").trim();
 }
 
-// src/core/v2/verdict.ts
+// src/core/verdict/verdict.ts
 var DEFAULT_MAX_DEPTH = 8;
 var TIER0_EXTERNAL_KEYS = /* @__PURE__ */ new Set([
   "git push",
@@ -2944,6 +4053,7 @@ var LOCAL_ROUTINE_HEADS = /* @__PURE__ */ new Set([
   "make",
   "cmake"
 ]);
+var BELAY_SELF_COMMANDS = /* @__PURE__ */ new Set(["approve", "revoke"]);
 var FIND_DANGEROUS_FLAGS = /* @__PURE__ */ new Set(["-delete", "-exec", "-execdir", "-ok", "-okdir"]);
 function isFindDangerous(tokens) {
   return tokens.some(
@@ -3091,8 +4201,36 @@ function tier0ExternalMatch(key, head, tokens) {
   }
   return false;
 }
-function tier0HighStakesRm(tokens, context) {
+function isBelayJudgeSelfCommand(tokens) {
+  return tokens[0] === "belay" && tokens[1] === "judge" && (tokens[2] === "use" || tokens[2] === "status" || tokens[2] === "list" || tokens[2] === "test" || tokens[2] === "consent");
+}
+function isBelayConfigSelfCommand(tokens) {
+  if (tokens[0] !== "belay" || tokens[1] !== "config") {
+    return false;
+  }
+  const sub = tokens[2];
+  if (!sub) {
+    return true;
+  }
+  if (sub === "list" || sub === "get" || sub === "judge") {
+    return true;
+  }
+  if (sub === "credential") {
+    return true;
+  }
+  if (sub === "set" || sub === "unset") {
+    const pathKey = tokens[3] ?? "";
+    return pathKey.startsWith("judge.");
+  }
+  return false;
+}
+function isBelaySelfCommand(tokens) {
   const head = tokens[0] ?? "";
+  const subcommand = tokens[1] ?? "";
+  return head === "belay" && (BELAY_SELF_COMMANDS.has(subcommand) || isBelayJudgeSelfCommand(tokens) || isBelayConfigSelfCommand(tokens));
+}
+function tier0HighStakesRm(tokens, context) {
+  const head = (tokens[0] ?? "").split("/").pop() ?? "";
   if (head !== "rm") {
     return null;
   }
@@ -3115,34 +4253,44 @@ function tier0HighStakesRm(tokens, context) {
       signals: ["missing_trusted_cwd", ...analysis.signals]
     });
   }
-  if (analysis.isHighStakes) {
-    return askVerdict({
-      location: analysis.location,
-      opacity: "transparent",
-      effect: "local_mutation",
-      confidence: "deterministic",
-      reason: "high_stakes_path",
-      signals: ["high_stakes_path", ...analysis.signals]
-    });
-  }
   for (const target of targets) {
-    if (target === "~" || target.startsWith("~/") || target.startsWith("/")) {
-      const resolved = path11.resolve(
-        target === "~" || target.startsWith("~/") ? process.env.HOME ?? "/" : context.cwd,
-        target
-      );
-      const relative = relativeWithinRepo(context.repoRoot, resolved);
-      if (relative === null) {
-        return askVerdict({
-          location: "repo_outside",
-          opacity: "transparent",
-          effect: "local_mutation",
-          confidence: "deterministic",
-          reason: "repo_outside_mutation",
-          signals: ["repo_outside_mutation"]
-        });
+    const normalized = target.replace(/^['"]|['"]$/g, "");
+    if (normalized === "~" || normalized === "$HOME" || normalized.startsWith("~/")) {
+      return askVerdict({
+        location: "repo_outside",
+        opacity: "transparent",
+        effect: "local_mutation",
+        confidence: "deterministic",
+        reason: "high_stakes_path",
+        signals: ["catastrophic_home_deletion", ...analysis.signals]
+      });
+    }
+  }
+  if (analysis.isHighStakes && analysis.signals.includes("high_stakes_path")) {
+    let destructiveHighStakes = false;
+    for (const target of targets) {
+      const resolved = resolveTrustedPath(target, context.cwd, context.trustedCwd) ?? resolveMutationTarget(target, context.cwd);
+      if (resolved && isDestructiveHighStakesMutation(
+        head,
+        resolved,
+        context.repoRoot,
+        context.sensitivePaths,
+        context.protectedArtifactRoots
+      )) {
+        destructiveHighStakes = true;
+        break;
       }
     }
+    if (destructiveHighStakes) {
+      return askVerdict({
+        location: analysis.location,
+        opacity: "transparent",
+        effect: "local_mutation",
+        confidence: "deterministic",
+        reason: "high_stakes_path",
+        signals: ["high_stakes_path", ...analysis.signals]
+      });
+    }
   }
   return null;
 }
@@ -3322,6 +4470,16 @@ async function evaluateSegment(command, context, depth) {
   if (rmVerdict) {
     return rmVerdict;
   }
+  if (isBelaySelfCommand(peeled)) {
+    return allowVerdict({
+      location: "unknown",
+      opacity: "transparent",
+      effect: "local_mutation",
+      confidence: "deterministic",
+      reason: "belay_control_plane_command",
+      signals: ["belay_control_plane_command", segment.head]
+    });
+  }
   let effect = "unknown";
   if (READ_ONLY_KEYS.has(segment.key) || READ_ONLY_KEYS.has(segment.head)) {
     effect = "read_only";
@@ -3331,6 +4489,9 @@ async function evaluateSegment(command, context, depth) {
     effect = "local_mutation";
   }
   const pathArgs = extractPathArgs(peeled);
+  if (extractRedirectTargets(peeled).length > 0 && effect === "read_only") {
+    effect = "local_mutation";
+  }
   const pathAnalysis = analyzePathTargets({
     targets: pathArgs,
     cwd: context.cwd,
@@ -3361,15 +4522,46 @@ async function evaluateSegment(command, context, depth) {
       });
     }
   }
-  if (pathAnalysis.isHighStakes) {
-    return askVerdict({
-      location: pathAnalysis.location,
-      opacity: "transparent",
-      effect: "local_mutation",
-      confidence: "deterministic",
-      reason: "high_stakes_path",
-      signals: pathAnalysis.signals
-    });
+  if ((effect === "local_mutation" || effect === "unknown") && context.protectedArtifactRoots && context.protectedArtifactRoots.length > 0) {
+    for (const target of pathArgs) {
+      const resolved = resolveTrustedPath(target, context.cwd, context.trustedCwd) ?? resolveMutationTarget(target, context.cwd);
+      if (resolved && touchesProtectedRoot(resolved, context.protectedArtifactRoots)) {
+        return askVerdict({
+          location: pathAnalysis.location,
+          opacity: "transparent",
+          effect: "local_mutation",
+          confidence: "deterministic",
+          reason: "high_stakes_path",
+          signals: ["high_stakes_path", "control_plane_path"]
+        });
+      }
+    }
+  }
+  if (effect === "local_mutation" || effect === "unknown") {
+    let destructiveHighStakes = false;
+    for (const target of pathArgs) {
+      const resolved = resolveTrustedPath(target, context.cwd, context.trustedCwd) ?? resolveMutationTarget(target, context.cwd);
+      if (resolved && isDestructiveHighStakesMutation(
+        segment.head,
+        resolved,
+        context.repoRoot,
+        context.sensitivePaths,
+        context.protectedArtifactRoots
+      )) {
+        destructiveHighStakes = true;
+        break;
+      }
+    }
+    if (destructiveHighStakes) {
+      return askVerdict({
+        location: pathAnalysis.location,
+        opacity: "transparent",
+        effect: "local_mutation",
+        confidence: "deterministic",
+        reason: "high_stakes_path",
+        signals: pathAnalysis.signals
+      });
+    }
   }
   if (segment.head === "find" && isFindDangerous(peeled)) {
     return askVerdict({
@@ -3381,15 +4573,14 @@ async function evaluateSegment(command, context, depth) {
       signals: ["find_dangerous_action"]
     });
   }
-  if (pathAnalysis.location === "repo_outside" || pathAnalysis.location === "mixed") {
-    const outsideEffect = effect === "read_only" ? "read_only" : effect === "unknown" ? "local_mutation" : effect;
-    return askVerdict({
+  if (effect === "read_only" && (pathAnalysis.location === "repo_outside" || pathAnalysis.location === "mixed")) {
+    return allowVerdict({
       location: pathAnalysis.location,
-      opacity: "transparent",
-      effect: outsideEffect,
+      opacity,
+      effect: "read_only",
       confidence: "deterministic",
-      reason: "repo_outside_mutation",
-      signals: ["repo_outside_mutation", ...pathAnalysis.signals]
+      reason: "read_only",
+      signals: ["read_only", ...pathAnalysis.signals]
     });
   }
   if (pathAnalysis.location === "unknown" && pathArgs.length > 0 && LOCAL_MUTATION_KEYS.has(segment.head)) {
@@ -3402,7 +4593,25 @@ async function evaluateSegment(command, context, depth) {
       signals: ["unknown_location_mutation"]
     });
   }
-  const needsTier1 = effect === "unknown" || TIER0_EXTERNAL_HEADS.has(segment.head) || egressClass === "ambiguous";
+  const outsideMutation = pathAnalysis.location === "repo_outside" || pathAnalysis.location === "mixed";
+  const mutationPrescan = (effect === "local_mutation" || effect === "unknown") && pathArgs.length > 0 ? mutationPrescanRequiresAsk({
+    targets: pathArgs,
+    cwd: context.cwd,
+    repoRoot: context.repoRoot,
+    trustedCwd: context.trustedCwd,
+    sensitivePaths: context.sensitivePaths
+  }) : null;
+  if (mutationPrescan) {
+    return askVerdict({
+      location: pathAnalysis.location === "unknown" ? "unknown" : pathAnalysis.location === "repo_outside" || pathAnalysis.location === "mixed" ? pathAnalysis.location : "repo_local",
+      opacity,
+      effect: "local_mutation",
+      confidence: "deterministic",
+      reason: "tier1_catastrophic",
+      signals: ["tier1_catastrophic", mutationPrescan.reason]
+    });
+  }
+  const needsTier1 = effect === "unknown" || TIER0_EXTERNAL_HEADS.has(segment.head) || egressClass === "ambiguous" || outsideMutation && effect !== "read_only";
   let tier1Trace;
   if (needsTier1) {
     const tier1Text = recursiveScript ?? command;
@@ -3414,9 +4623,9 @@ async function evaluateSegment(command, context, depth) {
     tier1Trace = context.judge.lastTrace;
     if (tier1RequiresAsk(tier1)) {
       return askVerdict({
-        location: pathAnalysis.location === "unknown" ? "unknown" : "repo_local",
+        location: pathAnalysis.location === "unknown" ? "unknown" : pathAnalysis.location === "repo_outside" || pathAnalysis.location === "mixed" ? pathAnalysis.location : "repo_local",
         opacity,
-        effect: tier1.external_change ? "remote_mutation" : effect,
+        effect: !tier1.local_recoverable ? "remote_mutation" : effect,
         confidence: "llm",
         reason: "tier1_catastrophic",
         signals: ["tier1_catastrophic", tier1.reason],
@@ -3424,6 +4633,19 @@ async function evaluateSegment(command, context, depth) {
       });
     }
   }
+  if (outsideMutation && effect !== "read_only") {
+    return withJudgeTrace(
+      allowVerdict({
+        location: pathAnalysis.location,
+        opacity,
+        effect: "local_mutation",
+        confidence: tier1Trace ? "llm" : "deterministic",
+        reason: "repo_outside_local_mutation",
+        signals: ["repo_outside_local_mutation", ...pathAnalysis.signals]
+      }),
+      tier1Trace
+    );
+  }
   if (pathAnalysis.location === "repo_local" && (effect === "read_only" || effect === "local_mutation") && opacity !== "opaque") {
     return withJudgeTrace(
       allowVerdict({
@@ -3542,7 +4764,13 @@ async function verdict(command, context) {
   );
 }
 
-// src/core/v2/adapter.ts
+// src/core/verdict/adapter.ts
+function resolveClassifierTrustedCwd(cwd, options, explicit) {
+  if (explicit !== void 0) {
+    return explicit;
+  }
+  return options?.trustedCwd ?? Boolean(cwd);
+}
 function buildVerdictContext(params) {
   const protectedArtifactRoots2 = [
     ...params.options?.protectedArtifactRoots ?? [],
@@ -3551,7 +4779,7 @@ function buildVerdictContext(params) {
   return {
     cwd: params.cwd,
     repoRoot: params.repoRoot,
-    trustedCwd: params.trustedCwd ?? Boolean(params.cwd),
+    trustedCwd: resolveClassifierTrustedCwd(params.cwd, params.options, params.trustedCwd),
     sensitivePaths: params.options?.sensitivePaths ?? params.config.classifier.sensitivePaths,
     protectedArtifactRoots: protectedArtifactRoots2.length > 0 ? [...new Set(protectedArtifactRoots2)] : void 0,
     customAllowCommands: params.options?.customAllowCommands ?? params.config.overrides.allow,
@@ -3589,6 +4817,12 @@ function mapLegacyReason(result) {
   if (result.reason === "repo_local_mutation") {
     return "local_mutation";
   }
+  if (result.reason === "tier1_not_restorable") {
+    return "tier1_catastrophic";
+  }
+  if (result.reason === "tier0_restorable" || result.reason === "tier1_restorable") {
+    return result.effect === "local_mutation" ? "local_mutation" : result.reason;
+  }
   return result.reason;
 }
 function verdictToClassifyResult(result) {
@@ -3609,13 +4843,13 @@ function verdictToClassifyResult(result) {
     assessment,
     normalizedCommand: result.commandRedacted,
     summary: result.commandRedacted,
-    v2: {
+    axes: {
       location: result.location,
       opacity: result.opacity,
       effect: result.effect,
       confidence: result.confidence,
       would: result.permission,
-      by: "v2",
+      by: "verdict",
       commandRedacted: result.commandRedacted,
       commandFingerprint: result.fingerprint,
       signals: result.signals,
@@ -3677,7 +4911,7 @@ function extractPatch(payload) {
   }
   return null;
 }
-function applyPatchTargets(patch) {
+function applyPatchTargets2(patch) {
   const targets = [];
   for (const line of patch.split("\n")) {
     const match = line.match(/^\*\*\* (Add|Delete|Update) File: (.+)$/);
@@ -3695,6 +4929,70 @@ function applyPatchTargets(patch) {
 function normalizedToolName(toolName) {
   return toolName.trim().toLowerCase();
 }
+function resolveFileTier1Judge(config, options, repoRoot) {
+  return options.tier1Judge ?? createJudgeFromConfig(config, { repoRoot });
+}
+async function classifyFileMutationWithTier1(params) {
+  const judge = resolveFileTier1Judge(params.config, params.options, params.repoRoot);
+  const trustedCwd = resolveClassifierTrustedCwd(params.cwd, params.options);
+  const prescan = mutationPrescanRequiresAsk({
+    targets: [params.filePath],
+    cwd: params.cwd,
+    repoRoot: params.repoRoot,
+    trustedCwd,
+    sensitivePaths: params.options.sensitivePaths ?? params.config.classifier.sensitivePaths
+  });
+  if (prescan) {
+    return {
+      verdict: "deny_pending_approval",
+      reason: "tier1_catastrophic",
+      summary: params.filePath,
+      fingerprint: toolFingerprint(params.toolName, { path: params.filePath }, params.repoRoot),
+      assessment: {
+        reversibility: "irreversible",
+        external: params.locationLabel === "outside_repo",
+        blastRadius: params.locationLabel === "outside_repo" ? "outside the repository" : "sensitive repository file",
+        confidence: 0.95,
+        signals: [...params.signals, "tier1_catastrophic", prescan.reason]
+      }
+    };
+  }
+  const tier1Text = `file_mutation: ${params.toolKind} path=${params.resolvedPath} location=${params.locationLabel}`;
+  const tier1 = await judge.evaluate({
+    text: tier1Text,
+    context: { cwd: params.cwd, repoRoot: params.repoRoot }
+  });
+  const fingerprint = toolFingerprint(params.toolName, { path: params.filePath }, params.repoRoot);
+  if (tier1RequiresAsk(tier1)) {
+    return {
+      verdict: "deny_pending_approval",
+      reason: "tier1_catastrophic",
+      summary: params.filePath,
+      fingerprint,
+      assessment: {
+        reversibility: "irreversible",
+        external: params.locationLabel === "outside_repo",
+        blastRadius: params.locationLabel === "outside_repo" ? "outside the repository" : "sensitive repository file",
+        confidence: 0.82,
+        signals: [...params.signals, "tier1_catastrophic", tier1.reason]
+      }
+    };
+  }
+  const reason = params.isDelete ? "file_delete" : "file_mutation";
+  return {
+    verdict: "allow_flagged",
+    reason,
+    summary: params.filePath,
+    fingerprint,
+    assessment: {
+      reversibility: "recoverable_with_cost",
+      external: params.locationLabel === "outside_repo",
+      blastRadius: params.locationLabel === "outside_repo" ? "outside the repository" : "this repository",
+      confidence: 0.72,
+      signals: [...params.signals, "tier1_restorable", tier1.reason]
+    }
+  };
+}
 async function classifyToolUse(payload, repoRoot, cwd, config, options = {}) {
   const toolName = String(payload.tool_name ?? "");
   const toolKind = normalizedToolName(toolName);
@@ -3790,7 +5088,7 @@ async function classifyToolUse(payload, repoRoot, cwd, config, options = {}) {
       };
     }
     const signals = [];
-    const resolvedPath = path12.isAbsolute(filePath) ? filePath : path12.resolve(cwd, filePath);
+    const resolvedPath = path16.isAbsolute(filePath) ? filePath : path16.resolve(cwd, filePath);
     const hitsProtectedRoot = protectedRoots.some((root) => pathWithinRoot(root, resolvedPath));
     if (hitsProtectedRoot) {
       signals.push("control_plane_path");
@@ -3811,35 +5109,35 @@ async function classifyToolUse(payload, repoRoot, cwd, config, options = {}) {
     const relativePath = relativeWithinRepo(repoRoot, resolvedPath);
     if (relativePath === null) {
       signals.push("outside_repo_path");
-      return {
-        verdict: "deny_pending_approval",
-        reason: "outside_repo_file_mutation",
-        summary: filePath,
-        fingerprint: toolFingerprint(toolName, { path: filePath }, repoRoot),
-        assessment: {
-          reversibility: "irreversible",
-          external: true,
-          blastRadius: "outside the repository",
-          confidence: 0.9,
-          signals
-        }
-      };
+      return classifyFileMutationWithTier1({
+        toolName,
+        toolKind,
+        filePath,
+        resolvedPath,
+        repoRoot,
+        cwd,
+        config,
+        options,
+        signals,
+        isDelete: FILE_DELETE_TOOL_NAMES.has(toolKind),
+        locationLabel: "outside_repo"
+      });
     }
     if (matchesSensitivePath(relativePath, sensitivePaths)) {
       signals.push("sensitive_path");
-      return {
-        verdict: "deny_pending_approval",
-        reason: "sensitive_file_mutation",
-        summary: filePath,
-        fingerprint: toolFingerprint(toolName, { path: filePath }, repoRoot),
-        assessment: {
-          reversibility: "irreversible",
-          external: false,
-          blastRadius: "sensitive repository file",
-          confidence: 0.88,
-          signals
-        }
-      };
+      return classifyFileMutationWithTier1({
+        toolName,
+        toolKind,
+        filePath,
+        resolvedPath,
+        repoRoot,
+        cwd,
+        config,
+        options,
+        signals,
+        isDelete: FILE_DELETE_TOOL_NAMES.has(toolKind),
+        locationLabel: "sensitive_path"
+      });
     }
     if (FILE_DELETE_TOOL_NAMES.has(toolKind)) {
       signals.push("file_delete");
@@ -3874,7 +5172,7 @@ async function classifyToolUse(payload, repoRoot, cwd, config, options = {}) {
   }
   if (APPLY_PATCH_TOOL_NAMES.has(toolKind)) {
     const patch = extractPatch(payload);
-    const targets = patch ? applyPatchTargets(patch) : [];
+    const targets = patch ? applyPatchTargets2(patch) : [];
     if (targets.length === 0) {
       if (options.unknownLocalEffect === "deny") {
         return {
@@ -4064,10 +5362,56 @@ function normalizeGatedAction(params) {
     agentAssessment
   };
 }
-function applyShellPeripheralPolicy(command, action, result, options) {
-  if (options.brokerFsScope && result.verdict === "deny_pending_approval" && (result.reason === "outside_repo_mutation" || result.reason === "outside_repo_redirect" || result.reason === "repo_outside_mutation" || result.v2?.location === "repo_outside")) {
-    const outsideRepoPaths = collectOutsideRepoPaths(command, action.cwd, action.repoRoot);
-    if (outsideRepoPaths.length > 0 && options.fsScopeAllowlist && allPathsAllowlisted(outsideRepoPaths, options.fsScopeAllowlist)) {
+function applySandboxFsScopeBoundary(outsideRepoPaths, result, options, hints = {}) {
+  if (!options.brokerFsScope) {
+    return result;
+  }
+  if (outsideRepoPaths.length === 0) {
+    return result;
+  }
+  if (options.fsScopeAllowlist && allPathsAllowlisted(outsideRepoPaths, options.fsScopeAllowlist)) {
+    return result;
+  }
+  if (result.verdict === "deny_pending_approval") {
+    return result;
+  }
+  const redirect = hints.redirect === true || result.reason === "read_only" || result.assessment.signals.includes("read_only") || result.reason === "outside_repo_redirect";
+  return {
+    ...result,
+    verdict: "deny_pending_approval",
+    reason: redirect ? "outside_repo_redirect" : "outside_repo_mutation",
+    assessment: {
+      ...result.assessment,
+      external: true,
+      reversibility: "irreversible",
+      signals: [...result.assessment.signals, "sandbox_boundary_expected"]
+    }
+  };
+}
+function applyFsScopePeripheralPolicy(outsideRepoPaths, result, options) {
+  if (!options.brokerFsScope) {
+    return result;
+  }
+  if (outsideRepoPaths.length === 0) {
+    return result;
+  }
+  if (options.fsScopeAllowlist && allPathsAllowlisted(outsideRepoPaths, options.fsScopeAllowlist)) {
+    if (result.verdict === "deny_pending_approval" && (result.reason === "outside_repo_mutation" || result.reason === "outside_repo_redirect" || result.reason === "repo_outside_mutation" || result.axes?.location === "repo_outside")) {
+      return {
+        ...result,
+        verdict: "allow_flagged",
+        reason: "capability_fs_hint",
+        assessment: {
+          ...result.assessment,
+          signals: [
+            ...result.assessment.signals,
+            "capability_fs_hint",
+            "sandbox_boundary_expected"
+          ]
+        }
+      };
+    }
+    if (result.verdict === "allow" || result.verdict === "allow_flagged") {
       return {
         ...result,
         verdict: "allow_flagged",
@@ -4085,6 +5429,38 @@ function applyShellPeripheralPolicy(command, action, result, options) {
   }
   return result;
 }
+function applySandboxOutsideBoundary(command, action, result, options) {
+  const outsideRepoPaths = collectOutsideRepoPaths(command, action.cwd, action.repoRoot);
+  return applySandboxFsScopeBoundary(outsideRepoPaths, result, options, {
+    redirect: command.includes(">")
+  });
+}
+function applyShellPeripheralPolicy(command, action, result, options) {
+  const outsideRepoPaths = collectOutsideRepoPaths(command, action.cwd, action.repoRoot);
+  return applyFsScopePeripheralPolicy(outsideRepoPaths, result, options);
+}
+function outsideRepoPathsForToolAction(action) {
+  const payload = action.payload ?? {};
+  const paths = new Set(
+    collectOutsideRepoPathsFromToolPayload(payload, action.cwd, action.repoRoot)
+  );
+  const command = shellCommandFromPayload(payload);
+  if (command) {
+    for (const resolved of collectOutsideRepoPaths(command, action.cwd, action.repoRoot)) {
+      paths.add(resolved);
+    }
+  }
+  return [...paths];
+}
+function applyToolSandboxPolicies(action, result, options) {
+  const outsideRepoPaths = outsideRepoPathsForToolAction(action);
+  const command = shellCommandFromPayload(action.payload ?? {});
+  let next = applySandboxFsScopeBoundary(outsideRepoPaths, result, options, {
+    redirect: command.includes(">")
+  });
+  next = applyFsScopePeripheralPolicy(outsideRepoPaths, next, options);
+  return next;
+}
 async function classifyGatedAction(action, config, extraOptions = {}) {
   const options = { ...classifierOptionsFromConfig(config), ...extraOptions };
   if (action.kind === "shell") {
@@ -4092,26 +5468,47 @@ async function classifyGatedAction(action, config, extraOptions = {}) {
     if (!command) {
       throw new GateNormalizationError("Shell gated action requires a command.");
     }
-    let result = await classifyShell(command, action.cwd, action.repoRoot, config, options);
-    result = applyShellPeripheralPolicy(command, action, result, options);
+    let result2 = await classifyShell(command, action.cwd, action.repoRoot, config, options);
+    result2 = applySandboxOutsideBoundary(command, action, result2, options);
+    result2 = applyShellPeripheralPolicy(command, action, result2, options);
     if (!action.agentAssessment) {
-      return result;
+      return result2;
     }
-    const merged = mergeAgentAssessment(result.assessment, action.agentAssessment);
-    if (!merged.mismatch) {
-      return { ...result, assessment: merged.assessment };
+    const merged2 = mergeAgentAssessment(result2.assessment, action.agentAssessment);
+    if (!merged2.mismatch) {
+      return { ...result2, assessment: merged2.assessment };
     }
     return {
-      ...result,
+      ...result2,
       verdict: "deny_pending_approval",
       reason: "agent_assessment_mismatch",
-      assessment: merged.assessment
+      assessment: merged2.assessment
     };
   }
   if (action.kind === "subagent") {
     return classifySubagent(action.payload ?? {}, action.repoRoot, options);
   }
-  return classifyToolUse(action.payload ?? {}, action.repoRoot, action.cwd, config, options);
+  let result = await classifyToolUse(
+    action.payload ?? {},
+    action.repoRoot,
+    action.cwd,
+    config,
+    options
+  );
+  result = applyToolSandboxPolicies(action, result, options);
+  if (!action.agentAssessment) {
+    return result;
+  }
+  const merged = mergeAgentAssessment(result.assessment, action.agentAssessment);
+  if (!merged.mismatch) {
+    return { ...result, assessment: merged.assessment };
+  }
+  return {
+    ...result,
+    verdict: "deny_pending_approval",
+    reason: "agent_assessment_mismatch",
+    assessment: merged.assessment
+  };
 }
 async function classifyGatedActionAsync(action, config, extraOptions = {}) {
   return classifyGatedAction(action, config, extraOptions);
@@ -4137,9 +5534,9 @@ function gateEnabledForAction(config, action) {
 }
 
 // src/core/transactional/diff-evaluator.ts
-import path13 from "node:path";
+import path17 from "node:path";
 function categorizeChange(change, ctx) {
-  const absolutePath = canonicalPath(path13.join(ctx.repoRoot, change.relativePath));
+  const absolutePath = canonicalPath(path17.join(ctx.repoRoot, change.relativePath));
   if (!pathWithinRoot(ctx.repoRoot, absolutePath)) {
     return "repo_outside";
   }
@@ -4161,15 +5558,6 @@ function observedAssessment(evaluation) {
   if (evaluation.deletedCount > 0) {
     signals.push("observed_deletions");
   }
-  if (evaluation.categories.includes("repo_outside") || evaluation.categories.includes("control_plane") || evaluation.categories.includes("sensitive_path")) {
-    return {
-      reversibility: "irreversible",
-      external: evaluation.categories.includes("repo_outside"),
-      blastRadius: evaluation.categories.includes("control_plane") ? "agent-belay control plane" : evaluation.categories.includes("repo_outside") ? "outside the repository" : "sensitive path",
-      confidence: 1,
-      signals
-    };
-  }
   if (evaluation.categories.includes("large_deletion")) {
     return {
       reversibility: "irreversible",
@@ -4197,7 +5585,7 @@ function evaluateTransactionalDiff(changes, ctx) {
     categories.add("large_deletion");
   }
   const categoryList = [...categories];
-  const dangerous = categoryList.includes("repo_outside") || categoryList.includes("control_plane") || categoryList.includes("sensitive_path") || categoryList.includes("large_deletion");
+  const dangerous = categoryList.includes("large_deletion");
   const base = {
     categories: categoryList,
     changes,
@@ -4268,15 +5656,15 @@ var TRANSACTIONAL_APPROVAL_BYPASS_REASONS = /* @__PURE__ */ new Set([
 ]);
 
 // src/core/transactional/git-worktree.ts
-import { spawn } from "node:child_process";
+import { spawn as spawn2 } from "node:child_process";
 import { randomUUID } from "node:crypto";
 import { existsSync as existsSync5 } from "node:fs";
-import { copyFile, mkdir as mkdir2, mkdtemp, rm } from "node:fs/promises";
+import { copyFile, mkdir as mkdir3, mkdtemp, rm } from "node:fs/promises";
 import os from "node:os";
-import path14 from "node:path";
+import path18 from "node:path";
 function execGit(repoRoot, args) {
   return new Promise((resolve, reject) => {
-    const child = spawn("git", ["-C", repoRoot, ...args], {
+    const child = spawn2("git", ["-C", repoRoot, ...args], {
       stdio: ["ignore", "pipe", "pipe"]
     });
     const stdout = [];
@@ -4314,8 +5702,8 @@ async function isDirtyWorktree(repoRoot) {
   }
 }
 async function createGitWorktreeSnapshot(repoRoot, stateDir) {
-  const worktreePath = path14.join(stateDir, `tx-${randomUUID().replaceAll("-", "")}`);
-  await mkdir2(stateDir, { recursive: true });
+  const worktreePath = path18.join(stateDir, `tx-${randomUUID().replaceAll("-", "")}`);
+  await mkdir3(stateDir, { recursive: true });
   await execGit(repoRoot, ["worktree", "add", "--detach", worktreePath, "HEAD"]);
   return {
     worktreePath,
@@ -4334,18 +5722,18 @@ async function createGitWorktreeSnapshot(repoRoot, stateDir) {
 }
 function resolveWorktreeCwd(repoRoot, worktreePath, cwd) {
   const resolvedCwd = canonicalPath(cwd);
-  const relative = path14.relative(canonicalPath(repoRoot), resolvedCwd);
-  if (relative.startsWith("..") || path14.isAbsolute(relative)) {
+  const relative = path18.relative(canonicalPath(repoRoot), resolvedCwd);
+  if (relative.startsWith("..") || path18.isAbsolute(relative)) {
     return worktreePath;
   }
   if (relative === "") {
     return worktreePath;
   }
-  return path14.join(worktreePath, relative);
+  return path18.join(worktreePath, relative);
 }
 function runShellCommand(command, cwd, timeoutMs) {
   return new Promise((resolve) => {
-    const child = spawn(command, {
+    const child = spawn2(command, {
       cwd,
       shell: true,
       stdio: "ignore",
@@ -4411,7 +5799,7 @@ async function rollbackAppliedChanges(actions) {
   for (const action of [...actions].reverse()) {
     try {
       if (action.type === "restore") {
-        await mkdir2(path14.dirname(action.target), { recursive: true });
+        await mkdir3(path18.dirname(action.target), { recursive: true });
         await copyFile(action.backupPath, action.target);
       } else {
         await rm(action.target, { force: true });
@@ -4421,14 +5809,14 @@ async function rollbackAppliedChanges(actions) {
   }
 }
 async function applyWorktreeChanges(worktreePath, repoRoot, changes) {
-  const backupRoot = await mkdtemp(path14.join(os.tmpdir(), "belay-tx-rollback-"));
+  const backupRoot = await mkdtemp(path18.join(os.tmpdir(), "belay-tx-rollback-"));
   const rollbackActions = [];
   try {
     for (const change of changes) {
-      const target = path14.join(repoRoot, change.relativePath);
+      const target = path18.join(repoRoot, change.relativePath);
       if (existsSync5(target)) {
-        const backupPath = path14.join(backupRoot, change.relativePath);
-        await mkdir2(path14.dirname(backupPath), { recursive: true });
+        const backupPath = path18.join(backupRoot, change.relativePath);
+        await mkdir3(path18.dirname(backupPath), { recursive: true });
         await copyFile(target, backupPath);
         rollbackActions.push({ type: "restore", target, backupPath });
       } else if (change.kind !== "deleted") {
@@ -4438,8 +5826,8 @@ async function applyWorktreeChanges(worktreePath, repoRoot, changes) {
         await rm(target, { force: true });
         continue;
       }
-      const source = path14.join(worktreePath, change.relativePath);
-      await mkdir2(path14.dirname(target), { recursive: true });
+      const source = path18.join(worktreePath, change.relativePath);
+      await mkdir3(path18.dirname(target), { recursive: true });
       await copyFile(source, target);
     }
   } catch (error) {
@@ -4601,7 +5989,7 @@ async function notifyDeny(config, event) {
 }
 
 // src/adapters/layouts/protected-paths.ts
-import path15 from "node:path";
+import path19 from "node:path";
 function protectedArtifactRoots(layout, repoRoot, controlPlaneDir) {
   const roots = [
     layout.configPath(repoRoot),
@@ -4613,7 +6001,7 @@ function protectedArtifactRoots(layout, repoRoot, controlPlaneDir) {
   if (controlPlaneDir) {
     roots.push(controlPlaneDir);
   }
-  return roots.map((entry) => path15.resolve(entry));
+  return roots.map((entry) => path19.resolve(entry));
 }
 
 // src/adapters/shared/gate-runtime.ts
@@ -4623,7 +6011,7 @@ var EMPTY_APPROVALS = {
 };
 async function loadJsonFile(filePath, fallback) {
   try {
-    const raw = await readFile2(filePath, "utf8");
+    const raw = await readFile3(filePath, "utf8");
     return JSON.parse(raw);
   } catch {
     return fallback;
@@ -4635,14 +6023,14 @@ function createDefaultGateRuntimeDeps() {
       return loadJsonFile(configPath, {});
     },
     async appendAudit(ctx, event) {
-      const auditPath = path16.join(ctx.repoRoot, ctx.config.audit.logPath);
-      await mkdir3(path16.dirname(auditPath), { recursive: true });
+      const auditPath = path20.join(ctx.repoRoot, ctx.config.audit.logPath);
+      await mkdir4(path20.dirname(auditPath), { recursive: true });
       const record = { timestamp: (/* @__PURE__ */ new Date()).toISOString(), ...event };
       if (!ctx.config.audit.includeAssessment) {
         delete record.assessment;
       }
       const scrubbed = scrubValue(record, scrubOptionsFromConfig(ctx.config));
-      await writeFile2(auditPath, `${JSON.stringify(scrubbed)}
+      await writeFile3(auditPath, `${JSON.stringify(scrubbed)}
 `, {
         encoding: "utf8",
         flag: "a"
@@ -4661,8 +6049,8 @@ function createDefaultGateRuntimeDeps() {
       };
     },
     async writeApprovals(filePath, state) {
-      await mkdir3(path16.dirname(filePath), { recursive: true });
-      await writeFile2(filePath, `${JSON.stringify(compactApprovals(state), null, 2)}
+      await mkdir4(path20.dirname(filePath), { recursive: true });
+      await writeFile3(filePath, `${JSON.stringify(compactApprovals(state), null, 2)}
 `, "utf8");
     }
   };
@@ -4672,7 +6060,7 @@ async function resolveGateConfig(ctx, deps) {
   let teamConfig = null;
   const teamPath = teamConfigPath();
   if (existsSync6(teamPath)) {
-    teamConfig = JSON.parse(await readFile2(teamPath, "utf8"));
+    teamConfig = JSON.parse(await readFile3(teamPath, "utf8"));
   }
   return resolveLayeredConfig({
     repoConfig: loaded,
@@ -4744,7 +6132,15 @@ async function consumeApprovedApproval(ctx, deps, kind, fingerprint) {
     await deps.writeApprovals(approved.filePath, approved.state);
     return null;
   }
-  const [approval] = approved.state.approvals.splice(index, 1);
+  const approval = approved.state.approvals[index];
+  if (approval.executionLeaseExpiresAt) {
+    await deps.writeApprovals(approved.filePath, approved.state);
+    return approval;
+  }
+  approved.state.approvals[index] = {
+    ...approval,
+    executionLeaseExpiresAt: new Date(Date.now() + APPROVAL_EXECUTION_LEASE_MS).toISOString()
+  };
   await deps.writeApprovals(approved.filePath, approved.state);
   return approval;
 }
@@ -4809,7 +6205,7 @@ async function evaluateGatedAction(ctx, deps, params) {
       command: params.command,
       cwd: params.cwd,
       repoRoot: ctx.repoRoot,
-      stateDir: path16.join(ctx.layout.repoLocalStateDir(ctx.repoRoot), "transactional"),
+      stateDir: path20.join(ctx.layout.repoLocalStateDir(ctx.repoRoot), "transactional"),
       timeoutMs: transactional.timeoutMs,
       predicted,
       diffContext: {
@@ -4882,8 +6278,8 @@ async function gateDecisionToVerdict(ctx, deps, kind, result, auditExtras = {})
     predictedAssessment: auditExtras.predictedAssessment,
     observedAssessment: auditExtras.observedAssessment,
     mode: ctx.config.mode,
-    schemaVersion: result.v2 ? 2 : 1,
-    ...result.v2 ?? {},
+    schemaVersion: result.axes ? 2 : 1,
+    ...result.axes ?? {},
     ...auditExtras.transactionalLayer
   };
   if (result.reason === TRANSACTIONAL_ALREADY_APPLIED) {
@@ -4906,7 +6302,17 @@ async function gateDecisionToVerdict(ctx, deps, kind, result, auditExtras = {})
     });
   }
   const brokerActive = isCapabilityBrokerDemotionActive(ctx.config);
-  const approved = TRANSACTIONAL_APPROVAL_BYPASS_REASONS.has(result.reason) || shouldSkipBrokerApprovedOnce(brokerActive, result.reason) ? null : await consumeApprovedApproval(ctx, deps, kind, result.fingerprint);
+  let approved = null;
+  if (!TRANSACTIONAL_APPROVAL_BYPASS_REASONS.has(result.reason) && !shouldSkipBrokerApprovedOnce(brokerActive, result.reason)) {
+    const approvedState = await deps.loadApprovals(ctx, "approved-approvals.json");
+    approvedState.state = compactApprovals(approvedState.state);
+    const matchedApproval = approvedState.state.approvals.find(
+      (entry) => entry.kind === kind && entry.fingerprint === result.fingerprint && entry.repoRoot === ctx.repoRoot
+    );
+    if (!shouldSkipBrokerApprovedRecord(brokerActive, matchedApproval?.reason)) {
+      approved = await consumeApprovedApproval(ctx, deps, kind, result.fingerprint);
+    }
+  }
   if (approved) {
     await deps.appendAudit(ctx, {
       ...gateBase,
@@ -5084,18 +6490,18 @@ async function appendObservedAudit(ctx, deps, eventName, payload) {
 
 // src/adapters/shared/repo-root.ts
 import { existsSync as existsSync7 } from "node:fs";
-import path17 from "node:path";
+import path21 from "node:path";
 function findRepoRoot(startPath, layout) {
-  let current = path17.resolve(startPath);
+  let current = path21.resolve(startPath);
   while (true) {
     for (const marker of layout.repoRootMarkers) {
-      if (existsSync7(path17.join(current, marker))) {
+      if (existsSync7(path21.join(current, marker))) {
         return current;
       }
     }
-    const parent = path17.dirname(current);
+    const parent = path21.dirname(current);
     if (parent === current) {
-      return path17.resolve(startPath);
+      return path21.resolve(startPath);
     }
     current = parent;
   }