@guilz-dev/belay 0.1.1 → 0.3.0

package/dist/core/classify-tool.js

@@ -3,7 +3,9 @@ import { canonicalStringify, toolFingerprint } from './fingerprint.js';
 import { matchesSensitivePath } from './glob.js';
 import { pathWithinRoot, relativeWithinRepo } from './path-utils.js';
 import { scrubValue } from './scrub.js';
-import { classifyShell } from './v2/adapter.js';
+import { classifyShell, resolveClassifierTrustedCwd } from './verdict/adapter.js';
+import { mutationPrescanRequiresAsk, tier1RequiresAsk } from './verdict/judge.js';
+import { createJudgeFromConfig } from './verdict/judge-factory.js';
 const DEFAULT_SENSITIVE_PATHS = ['.env', '.env.*', '**/credentials/**'];
 const FILE_WRITE_TOOL_NAMES = new Set(['write']);
 const FILE_EDIT_TOOL_NAMES = new Set([
@@ -74,6 +76,74 @@ function applyPatchTargets(patch) {
 function normalizedToolName(toolName) {
     return toolName.trim().toLowerCase();
 }
+function resolveFileTier1Judge(config, options, repoRoot) {
+    return options.tier1Judge ?? createJudgeFromConfig(config, { repoRoot });
+}
+async function classifyFileMutationWithTier1(params) {
+    const judge = resolveFileTier1Judge(params.config, params.options, params.repoRoot);
+    const trustedCwd = resolveClassifierTrustedCwd(params.cwd, params.options);
+    const prescan = mutationPrescanRequiresAsk({
+        targets: [params.filePath],
+        cwd: params.cwd,
+        repoRoot: params.repoRoot,
+        trustedCwd,
+        sensitivePaths: params.options.sensitivePaths ?? params.config.classifier.sensitivePaths,
+    });
+    if (prescan) {
+        return {
+            verdict: 'deny_pending_approval',
+            reason: 'tier1_catastrophic',
+            summary: params.filePath,
+            fingerprint: toolFingerprint(params.toolName, { path: params.filePath }, params.repoRoot),
+            assessment: {
+                reversibility: 'irreversible',
+                external: params.locationLabel === 'outside_repo',
+                blastRadius: params.locationLabel === 'outside_repo'
+                    ? 'outside the repository'
+                    : 'sensitive repository file',
+                confidence: 0.95,
+                signals: [...params.signals, 'tier1_catastrophic', prescan.reason],
+            },
+        };
+    }
+    const tier1Text = `file_mutation: ${params.toolKind} path=${params.resolvedPath} location=${params.locationLabel}`;
+    const tier1 = await judge.evaluate({
+        text: tier1Text,
+        context: { cwd: params.cwd, repoRoot: params.repoRoot },
+    });
+    const fingerprint = toolFingerprint(params.toolName, { path: params.filePath }, params.repoRoot);
+    if (tier1RequiresAsk(tier1)) {
+        return {
+            verdict: 'deny_pending_approval',
+            reason: 'tier1_catastrophic',
+            summary: params.filePath,
+            fingerprint,
+            assessment: {
+                reversibility: 'irreversible',
+                external: params.locationLabel === 'outside_repo',
+                blastRadius: params.locationLabel === 'outside_repo'
+                    ? 'outside the repository'
+                    : 'sensitive repository file',
+                confidence: 0.82,
+                signals: [...params.signals, 'tier1_catastrophic', tier1.reason],
+            },
+        };
+    }
+    const reason = params.isDelete ? 'file_delete' : 'file_mutation';
+    return {
+        verdict: 'allow_flagged',
+        reason,
+        summary: params.filePath,
+        fingerprint,
+        assessment: {
+            reversibility: 'recoverable_with_cost',
+            external: params.locationLabel === 'outside_repo',
+            blastRadius: params.locationLabel === 'outside_repo' ? 'outside the repository' : 'this repository',
+            confidence: 0.72,
+            signals: [...params.signals, 'tier1_restorable', tier1.reason],
+        },
+    };
+}
 export async function classifyToolUse(payload, repoRoot, cwd, config, options = {}) {
     const toolName = String(payload.tool_name ?? '');
     const toolKind = normalizedToolName(toolName);
@@ -176,35 +246,35 @@ export async function classifyToolUse(payload, repoRoot, cwd, config, options =
         const relativePath = relativeWithinRepo(repoRoot, resolvedPath);
         if (relativePath === null) {
             signals.push('outside_repo_path');
-            return {
-                verdict: 'deny_pending_approval',
-                reason: 'outside_repo_file_mutation',
-                summary: filePath,
-                fingerprint: toolFingerprint(toolName, { path: filePath }, repoRoot),
-                assessment: {
-                    reversibility: 'irreversible',
-                    external: true,
-                    blastRadius: 'outside the repository',
-                    confidence: 0.9,
-                    signals,
-                },
-            };
+            return classifyFileMutationWithTier1({
+                toolName,
+                toolKind,
+                filePath,
+                resolvedPath,
+                repoRoot,
+                cwd,
+                config,
+                options,
+                signals,
+                isDelete: FILE_DELETE_TOOL_NAMES.has(toolKind),
+                locationLabel: 'outside_repo',
+            });
         }
         if (matchesSensitivePath(relativePath, sensitivePaths)) {
             signals.push('sensitive_path');
-            return {
-                verdict: 'deny_pending_approval',
-                reason: 'sensitive_file_mutation',
-                summary: filePath,
-                fingerprint: toolFingerprint(toolName, { path: filePath }, repoRoot),
-                assessment: {
-                    reversibility: 'irreversible',
-                    external: false,
-                    blastRadius: 'sensitive repository file',
-                    confidence: 0.88,
-                    signals,
-                },
-            };
+            return classifyFileMutationWithTier1({
+                toolName,
+                toolKind,
+                filePath,
+                resolvedPath,
+                repoRoot,
+                cwd,
+                config,
+                options,
+                signals,
+                isDelete: FILE_DELETE_TOOL_NAMES.has(toolKind),
+                locationLabel: 'sensitive_path',
+            });
         }
         if (FILE_DELETE_TOOL_NAMES.has(toolKind)) {
             signals.push('file_delete');

package/dist/core/config-layers.js

@@ -1,6 +1,6 @@
 import path from 'node:path';
 import { applyConfigPreset } from '../presets.js';
-import { DEFAULT_CONFIG_V3, mergeConfig } from './config.js';
+import { DEFAULT_CONFIG_V3, mergeConfig, rejectTeamLayerJudgeSecrets } from './config.js';
 export function teamConfigPath(homedir = () => process.env.HOME ?? process.env.USERPROFILE ?? '') {
     const xdg = process.env.XDG_CONFIG_HOME?.trim();
     const base = xdg || path.join(homedir(), '.config');
@@ -40,6 +40,7 @@ export function resolveLayeredConfig(params) {
         const teamRaw = teamFile.preset
             ? applyConfigPreset(teamFile.preset, teamFile.config ?? {})
             : (teamFile.config ?? params.teamConfig);
+        rejectTeamLayerJudgeSecrets(teamRaw.judge, 'team');
         config = mergeConfigLayer(config, asV3Layer(teamRaw));
         provenance.push({
             path: params.teamConfigPath ?? teamConfigPath(),

package/dist/core/config.d.ts

@@ -76,13 +76,32 @@ export interface BelayRedactionConfig {
     maskKeyValueSecrets: boolean;
     maskHighEntropyStrings: boolean;
 }
-export type JudgeProvider = 'ollama' | 'openai-compatible';
+export type JudgeProvider = 'ollama' | 'openai-compatible' | 'anthropic';
+export type JudgeProviderId = 'ollama' | 'codex' | 'claude' | 'cursor';
+/** Read-only legacy ids; preserved on load with warning until `belay config` migrates. */
+export type DeprecatedJudgeProviderId = 'openrouter' | 'custom';
+export type JudgeCredentialMode = 'project' | 'apiKey';
+export type JudgeCredentialRef = `store:judge` | `env:${string}`;
+export interface JudgeCredentialConfig {
+    mode: JudgeCredentialMode;
+    ref?: JudgeCredentialRef;
+}
+export interface JudgeCloudConsent {
+    accepted: boolean;
+    at: string;
+    providerId: JudgeProviderId;
+    endpoint: string;
+    by: string;
+}
 export interface BelayJudgeConfig {
     provider: JudgeProvider;
+    providerId?: JudgeProviderId | DeprecatedJudgeProviderId;
     model: string;
     timeoutMs: number;
     endpoint: string | null;
     keepAlive: string | null;
+    cloudConsent?: JudgeCloudConsent;
+    credential?: JudgeCredentialConfig;
 }
 export declare const DEFAULT_JUDGE_LOCAL_OLLAMA: BelayJudgeConfig;
 export declare const DEFAULT_JUDGE_OPENAI_COMPATIBLE_TEMPLATE: BelayJudgeConfig;
@@ -155,7 +174,7 @@ export declare const DEFAULT_CONFIDENCE_THRESHOLDS: BelayConfidenceThresholds;
 export declare const DEFAULT_MODEL_ASSIST: BelayModelAssistConfig;
 export declare const DEFAULT_TRANSACTIONAL_V3: BelayTransactionalConfig;
 export declare const LEGACY_POLICY_V3: BelayPolicyConfig;
-/** Fresh v0.4+ install defaults (fail-closed). */
+/** Fresh install defaults: recoverable-first with opaque/unparseable fail-closed. */
 export declare const DEFAULT_POLICY_V3: BelayPolicyConfig;
 export declare const DEFAULT_OVERRIDES_V3: BelayOverridesConfig;
 export declare const DEFAULT_REDACTION_V3: BelayRedactionConfig;
@@ -180,8 +199,9 @@ export declare function isConfigV1(value: unknown): value is BelayConfigV1;
 export declare function isConfigV2(value: unknown): value is BelayConfigV2;
 export declare function isConfigV3(value: unknown): value is BelayConfigV4;
 export declare function isConfigV4(value: unknown): value is BelayConfigV4;
-export declare function normalizeJudgeProvider(provider: string | undefined): 'ollama' | 'openai-compatible';
+export declare function normalizeJudgeProvider(provider: string | undefined): 'ollama' | 'openai-compatible' | 'anthropic';
 export declare function normalizeJudgeConfig(judge: BelayJudgeConfig): BelayJudgeConfig;
+export declare function rejectTeamLayerJudgeSecrets(judge: Partial<BelayJudgeConfig> | undefined, source: 'team' | 'repo'): void;
 export declare function migrateV3ToV4(v3: BelayConfigV4, raw?: RawConfigInput): BelayConfigV4;
 type RawConfigInput = Partial<{
     version: number;

package/dist/core/config.js

@@ -1,6 +1,9 @@
 import path from 'node:path';
+import { warnDeprecatedJudgeModelAuto } from './judge-model-policy.js';
+import { getJudgeProviderSpec, inferProviderIdFromConfig, isRemovedProviderId, normalizeLegacyProviderId, warnRemovedProviderId, } from './verdict/judge-catalog.js';
 export const DEFAULT_JUDGE_LOCAL_OLLAMA = {
     provider: 'ollama',
+    providerId: 'ollama',
     model: 'gemma4:e2b',
     endpoint: 'http://localhost:11434',
     timeoutMs: 25000,
@@ -8,7 +11,8 @@ export const DEFAULT_JUDGE_LOCAL_OLLAMA = {
 };
 export const DEFAULT_JUDGE_OPENAI_COMPATIBLE_TEMPLATE = {
     provider: 'openai-compatible',
-    model: 'auto',
+    providerId: 'codex',
+    model: 'gpt-5.3-codex-high',
     timeoutMs: 8000,
     endpoint: null,
     keepAlive: null,
@@ -45,9 +49,9 @@ export const LEGACY_POLICY_V3 = {
     transactional: { ...DEFAULT_TRANSACTIONAL_V3 },
     fenceWarnThreshold: DEFAULT_FENCE_WARN_THRESHOLD,
 };
-/** Fresh v0.4+ install defaults (fail-closed). */
+/** Fresh install defaults: recoverable-first with opaque/unparseable fail-closed. */
 export const DEFAULT_POLICY_V3 = {
-    unknownLocalEffect: 'deny',
+    unknownLocalEffect: 'allow_flagged',
     unparseableShell: 'deny',
     codexUnmappedTool: 'deny',
     confidenceThresholds: { ...DEFAULT_CONFIDENCE_THRESHOLDS },
@@ -209,44 +213,139 @@ export function isConfigV4(value) {
     return typeof value === 'object' && value !== null && value.version === 4;
 }
 export function normalizeJudgeProvider(provider) {
+    if (provider === 'anthropic') {
+        return 'anthropic';
+    }
     if (provider === 'openai-compatible' || provider === 'cursor') {
         return 'openai-compatible';
     }
     return 'ollama';
 }
+function defaultJudgeTemplateForProvider(provider) {
+    if (provider === 'ollama') {
+        return DEFAULT_JUDGE_LOCAL_OLLAMA;
+    }
+    if (provider === 'anthropic') {
+        return {
+            provider: 'anthropic',
+            providerId: 'claude',
+            model: 'claude-sonnet-4-6',
+            timeoutMs: 8000,
+            endpoint: null,
+            keepAlive: null,
+        };
+    }
+    return DEFAULT_JUDGE_OPENAI_COMPATIBLE_TEMPLATE;
+}
 function synthesizeJudgeFromRaw(raw) {
     const judge = raw.judge;
     if (judge?.provider) {
-        const provider = normalizeJudgeProvider(judge.provider);
-        const base = provider === 'openai-compatible'
-            ? DEFAULT_JUDGE_OPENAI_COMPATIBLE_TEMPLATE
-            : DEFAULT_JUDGE_LOCAL_OLLAMA;
+        const rawProvider = String(judge.provider);
+        const provider = normalizeJudgeProvider(rawProvider);
+        const base = defaultJudgeTemplateForProvider(provider);
+        const providerId = judge.providerId && normalizeLegacyProviderId(judge.providerId)
+            ? normalizeLegacyProviderId(judge.providerId)
+            : rawProvider === 'cursor'
+                ? 'cursor'
+                : undefined;
         return normalizeJudgeConfig({
             ...base,
             ...judge,
             provider,
+            ...(providerId ? { providerId } : {}),
         });
     }
     return { ...DEFAULT_JUDGE_LOCAL_OLLAMA };
 }
 export function normalizeJudgeConfig(judge) {
     const provider = normalizeJudgeProvider(judge.provider);
-    const base = provider === 'openai-compatible'
-        ? DEFAULT_JUDGE_OPENAI_COMPATIBLE_TEMPLATE
-        : DEFAULT_JUDGE_LOCAL_OLLAMA;
-    const model = typeof judge.model === 'string' && judge.model.trim() ? judge.model.trim() : base.model;
+    const base = defaultJudgeTemplateForProvider(provider);
+    const rawProviderId = judge.providerId ? String(judge.providerId) : undefined;
+    if (rawProviderId && isRemovedProviderId(rawProviderId)) {
+        warnRemovedProviderId(rawProviderId);
+        let model = typeof judge.model === 'string' && judge.model.trim() ? judge.model.trim() : base.model;
+        if (model === 'auto') {
+            warnDeprecatedJudgeModelAuto();
+            model = base.model;
+        }
+        const timeoutMs = typeof judge.timeoutMs === 'number' && judge.timeoutMs > 0 ? judge.timeoutMs : base.timeoutMs;
+        const endpoint = typeof judge.endpoint === 'string' && judge.endpoint.trim() ? judge.endpoint.trim() : null;
+        return {
+            provider,
+            providerId: rawProviderId,
+            model,
+            timeoutMs,
+            endpoint,
+            keepAlive: provider === 'ollama' && typeof judge.keepAlive === 'string' && judge.keepAlive.trim()
+                ? judge.keepAlive.trim()
+                : provider === 'ollama'
+                    ? DEFAULT_JUDGE_LOCAL_OLLAMA.keepAlive
+                    : null,
+            ...(judge.cloudConsent ? { cloudConsent: judge.cloudConsent } : {}),
+            ...(judge.credential ? { credential: judge.credential } : {}),
+        };
+    }
+    let providerId = rawProviderId && normalizeLegacyProviderId(rawProviderId)
+        ? normalizeLegacyProviderId(rawProviderId)
+        : inferProviderIdFromConfig({ ...judge, provider });
+    const spec = getJudgeProviderSpec(providerId);
+    if (spec && spec.driver !== provider) {
+        providerId = inferProviderIdFromConfig({ ...judge, provider });
+    }
+    const catalogSpec = getJudgeProviderSpec(providerId);
+    let model = typeof judge.model === 'string' && judge.model.trim() ? judge.model.trim() : base.model;
+    if (model === 'auto' && catalogSpec?.defaultModel) {
+        warnDeprecatedJudgeModelAuto();
+        model = catalogSpec.defaultModel;
+    }
+    if (!model && catalogSpec?.defaultModel) {
+        model = catalogSpec.defaultModel;
+    }
     const timeoutMs = typeof judge.timeoutMs === 'number' && judge.timeoutMs > 0 ? judge.timeoutMs : base.timeoutMs;
-    return {
+    let endpoint = typeof judge.endpoint === 'string' && judge.endpoint.trim() ? judge.endpoint.trim() : null;
+    if (!endpoint && catalogSpec?.defaultEndpoint) {
+        endpoint = catalogSpec.defaultEndpoint;
+    }
+    const normalized = {
         provider,
+        providerId,
         model,
         timeoutMs,
-        endpoint: typeof judge.endpoint === 'string' && judge.endpoint.trim() ? judge.endpoint.trim() : null,
+        endpoint,
         keepAlive: provider === 'ollama' && typeof judge.keepAlive === 'string' && judge.keepAlive.trim()
             ? judge.keepAlive.trim()
             : provider === 'ollama'
                 ? DEFAULT_JUDGE_LOCAL_OLLAMA.keepAlive
                 : null,
     };
+    if (judge.cloudConsent?.accepted) {
+        normalized.cloudConsent = {
+            accepted: true,
+            at: judge.cloudConsent.at,
+            providerId: judge.cloudConsent.providerId ?? providerId,
+            endpoint: judge.cloudConsent.endpoint,
+            by: judge.cloudConsent.by,
+        };
+    }
+    if (judge.credential?.mode === 'project' || judge.credential?.mode === 'apiKey') {
+        normalized.credential = {
+            mode: judge.credential.mode,
+            ...(judge.credential.ref ? { ref: judge.credential.ref } : {}),
+        };
+    }
+    return normalized;
+}
+export function rejectTeamLayerJudgeSecrets(judge, source) {
+    if (source !== 'team' || !judge) {
+        return;
+    }
+    if (judge.credential?.mode === 'apiKey') {
+        throw new Error('team config cannot set judge.credential.mode to apiKey.');
+    }
+    const raw = judge;
+    if (raw.credential && 'key' in raw.credential && raw.credential.key) {
+        throw new Error('team config cannot contain inline judge credential keys.');
+    }
 }
 export function migrateV3ToV4(v3, raw) {
     return normalizeConfig({

package/dist/core/credential-store.d.ts

@@ -0,0 +1,11 @@
+export interface JudgeCredentialStoreFile {
+    version: 1;
+    judge?: string;
+}
+export declare function credentialStorePath(stateDir: string): string;
+export declare function writeJudgeCredentialStore(stateDir: string, apiKey: string): Promise<string>;
+export declare function clearJudgeCredentialStore(stateDir: string): Promise<void>;
+export declare function readJudgeCredentialStore(stateDir: string): Promise<string | null>;
+export declare function judgeCredentialStoreExists(stateDir: string): Promise<boolean>;
+export type CredentialRef = `store:judge` | `env:${string}`;
+export declare function parseCredentialRef(ref: string): CredentialRef | null;

package/dist/core/credential-store.js

@@ -0,0 +1,60 @@
+import { chmod, mkdir, readFile, unlink, writeFile } from 'node:fs/promises';
+import path from 'node:path';
+const STORE_FILENAME = 'credentials.json';
+export function credentialStorePath(stateDir) {
+    return path.join(stateDir, STORE_FILENAME);
+}
+export async function writeJudgeCredentialStore(stateDir, apiKey) {
+    await mkdir(stateDir, { recursive: true, mode: 0o700 });
+    const filePath = credentialStorePath(stateDir);
+    const payload = {
+        version: 1,
+        judge: apiKey.trim(),
+    };
+    await writeFile(filePath, `${JSON.stringify(payload, null, 2)}\n`, {
+        encoding: 'utf8',
+        mode: 0o600,
+    });
+    await chmod(filePath, 0o600);
+    return filePath;
+}
+export async function clearJudgeCredentialStore(stateDir) {
+    try {
+        await unlink(credentialStorePath(stateDir));
+    }
+    catch (error) {
+        if (error.code !== 'ENOENT') {
+            throw error;
+        }
+    }
+}
+export async function readJudgeCredentialStore(stateDir) {
+    const filePath = credentialStorePath(stateDir);
+    try {
+        const raw = await readFile(filePath, 'utf8');
+        const parsed = JSON.parse(raw);
+        const key = parsed.judge?.trim();
+        return key || null;
+    }
+    catch {
+        return null;
+    }
+}
+export async function judgeCredentialStoreExists(stateDir) {
+    try {
+        await readFile(credentialStorePath(stateDir), 'utf8');
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+export function parseCredentialRef(ref) {
+    if (ref === 'store:judge') {
+        return ref;
+    }
+    if (ref.startsWith('env:') && ref.length > 4) {
+        return ref;
+    }
+    return null;
+}

package/dist/core/gate-contract.d.ts

@@ -28,7 +28,7 @@ export interface GateVerdict extends GatePermissionResponse {
     approvalId?: string;
     wouldBlock: boolean;
     mode: 'enforce' | 'audit';
-    v2?: ClassifyResult['v2'];
+    axes?: ClassifyResult['axes'];
 }
 export declare function isGatedAction(value: unknown): value is GatedAction;
 export declare function classifyResultToGateVerdict(params: {

package/dist/core/gate-contract.js

@@ -25,7 +25,7 @@ export function classifyResultToGateVerdict(params) {
         approvalId,
         user_message,
         agent_message,
-        v2: result.v2,
+        axes: result.axes,
     };
 }
 export function unnormalizedGateVerdict(params) {

package/dist/core/gate-engine.js

@@ -1,11 +1,11 @@
 import { allPathsAllowlisted } from './capability/allowlist.js';
-import { collectOutsideRepoPaths } from './capability/paths.js';
+import { collectOutsideRepoPaths, collectOutsideRepoPathsFromToolPayload, } from './capability/paths.js';
 import { classifySubagent } from './classify-subagent.js';
 import { classifyToolUse } from './classify-tool.js';
 import { classifierOptionsFromConfig } from './config.js';
 import { GATE_CONTRACT_VERSION } from './gate-contract.js';
 import { mergeAgentAssessment } from './judgment.js';
-import { classifyShell } from './v2/adapter.js';
+import { classifyShell } from './verdict/adapter.js';
 export class GateNormalizationError extends Error {
     reason = 'normalization_failed';
     constructor(message) {
@@ -92,17 +92,63 @@ export function normalizeGatedAction(params) {
         agentAssessment,
     };
 }
-function applyShellPeripheralPolicy(command, action, result, options) {
-    if (options.brokerFsScope &&
-        result.verdict === 'deny_pending_approval' &&
-        (result.reason === 'outside_repo_mutation' ||
-            result.reason === 'outside_repo_redirect' ||
-            result.reason === 'repo_outside_mutation' ||
-            result.v2?.location === 'repo_outside')) {
-        const outsideRepoPaths = collectOutsideRepoPaths(command, action.cwd, action.repoRoot);
-        if (outsideRepoPaths.length > 0 &&
-            options.fsScopeAllowlist &&
-            allPathsAllowlisted(outsideRepoPaths, options.fsScopeAllowlist)) {
+function applySandboxFsScopeBoundary(outsideRepoPaths, result, options, hints = {}) {
+    if (!options.brokerFsScope) {
+        return result;
+    }
+    if (outsideRepoPaths.length === 0) {
+        return result;
+    }
+    if (options.fsScopeAllowlist && allPathsAllowlisted(outsideRepoPaths, options.fsScopeAllowlist)) {
+        return result;
+    }
+    if (result.verdict === 'deny_pending_approval') {
+        return result;
+    }
+    const redirect = hints.redirect === true ||
+        result.reason === 'read_only' ||
+        result.assessment.signals.includes('read_only') ||
+        result.reason === 'outside_repo_redirect';
+    return {
+        ...result,
+        verdict: 'deny_pending_approval',
+        reason: redirect ? 'outside_repo_redirect' : 'outside_repo_mutation',
+        assessment: {
+            ...result.assessment,
+            external: true,
+            reversibility: 'irreversible',
+            signals: [...result.assessment.signals, 'sandbox_boundary_expected'],
+        },
+    };
+}
+function applyFsScopePeripheralPolicy(outsideRepoPaths, result, options) {
+    if (!options.brokerFsScope) {
+        return result;
+    }
+    if (outsideRepoPaths.length === 0) {
+        return result;
+    }
+    if (options.fsScopeAllowlist && allPathsAllowlisted(outsideRepoPaths, options.fsScopeAllowlist)) {
+        if (result.verdict === 'deny_pending_approval' &&
+            (result.reason === 'outside_repo_mutation' ||
+                result.reason === 'outside_repo_redirect' ||
+                result.reason === 'repo_outside_mutation' ||
+                result.axes?.location === 'repo_outside')) {
+            return {
+                ...result,
+                verdict: 'allow_flagged',
+                reason: 'capability_fs_hint',
+                assessment: {
+                    ...result.assessment,
+                    signals: [
+                        ...result.assessment.signals,
+                        'capability_fs_hint',
+                        'sandbox_boundary_expected',
+                    ],
+                },
+            };
+        }
+        if (result.verdict === 'allow' || result.verdict === 'allow_flagged') {
             return {
                 ...result,
                 verdict: 'allow_flagged',
@@ -120,6 +166,36 @@ function applyShellPeripheralPolicy(command, action, result, options) {
     }
     return result;
 }
+function applySandboxOutsideBoundary(command, action, result, options) {
+    const outsideRepoPaths = collectOutsideRepoPaths(command, action.cwd, action.repoRoot);
+    return applySandboxFsScopeBoundary(outsideRepoPaths, result, options, {
+        redirect: command.includes('>'),
+    });
+}
+function applyShellPeripheralPolicy(command, action, result, options) {
+    const outsideRepoPaths = collectOutsideRepoPaths(command, action.cwd, action.repoRoot);
+    return applyFsScopePeripheralPolicy(outsideRepoPaths, result, options);
+}
+function outsideRepoPathsForToolAction(action) {
+    const payload = action.payload ?? {};
+    const paths = new Set(collectOutsideRepoPathsFromToolPayload(payload, action.cwd, action.repoRoot));
+    const command = shellCommandFromPayload(payload);
+    if (command) {
+        for (const resolved of collectOutsideRepoPaths(command, action.cwd, action.repoRoot)) {
+            paths.add(resolved);
+        }
+    }
+    return [...paths];
+}
+function applyToolSandboxPolicies(action, result, options) {
+    const outsideRepoPaths = outsideRepoPathsForToolAction(action);
+    const command = shellCommandFromPayload(action.payload ?? {});
+    let next = applySandboxFsScopeBoundary(outsideRepoPaths, result, options, {
+        redirect: command.includes('>'),
+    });
+    next = applyFsScopePeripheralPolicy(outsideRepoPaths, next, options);
+    return next;
+}
 export async function classifyGatedAction(action, config, extraOptions = {}) {
     const options = { ...classifierOptionsFromConfig(config), ...extraOptions };
     if (action.kind === 'shell') {
@@ -128,6 +204,7 @@ export async function classifyGatedAction(action, config, extraOptions = {}) {
             throw new GateNormalizationError('Shell gated action requires a command.');
         }
         let result = await classifyShell(command, action.cwd, action.repoRoot, config, options);
+        result = applySandboxOutsideBoundary(command, action, result, options);
         result = applyShellPeripheralPolicy(command, action, result, options);
         if (!action.agentAssessment) {
             return result;
@@ -146,7 +223,21 @@ export async function classifyGatedAction(action, config, extraOptions = {}) {
     if (action.kind === 'subagent') {
         return classifySubagent(action.payload ?? {}, action.repoRoot, options);
     }
-    return classifyToolUse(action.payload ?? {}, action.repoRoot, action.cwd, config, options);
+    let result = await classifyToolUse(action.payload ?? {}, action.repoRoot, action.cwd, config, options);
+    result = applyToolSandboxPolicies(action, result, options);
+    if (!action.agentAssessment) {
+        return result;
+    }
+    const merged = mergeAgentAssessment(result.assessment, action.agentAssessment);
+    if (!merged.mismatch) {
+        return { ...result, assessment: merged.assessment };
+    }
+    return {
+        ...result,
+        verdict: 'deny_pending_approval',
+        reason: 'agent_assessment_mismatch',
+        assessment: merged.assessment,
+    };
 }
 export async function classifyGatedActionAsync(action, config, extraOptions = {}) {
     return classifyGatedAction(action, config, extraOptions);

package/dist/core/index.d.ts

@@ -1,4 +1,4 @@
-export { approvalCommandMatch, buildRetryInstruction, compactApprovals, createApprovalRecord, isExpired, mergeApprovalStates, nowIso, } from './approval.js';
+export { APPROVAL_EXECUTION_LEASE_MS, approvalCommandMatch, buildRetryInstruction, compactApprovals, createApprovalRecord, isExecutionLeaseExpired, isExpired, mergeApprovalStates, nowIso, } from './approval.js';
 export type { AuditMetricsReport } from './audit-metrics.js';
 export { computeAuditMetrics, parseAuditNdjson } from './audit-metrics.js';
 export { classifySubagent } from './classify-subagent.js';
@@ -16,4 +16,4 @@ export { findCommandSubstitutions, MAX_SUBSTITUTION_DEPTH } from './shell-substi
 export type { TransactionalDiffEvaluation, TransactionalExecutionResult, } from './transactional/index.js';
 export { isTransactionalEligible, runTransactionalExecution } from './transactional/index.js';
 export type { ApprovalRecord, ApprovalStateFile, Assessment, ClassifierOptions, ClassifyResult, HookVerdict, Reversibility, ScrubOptions, UnknownLocalEffectPolicy, } from './types.js';
-export { buildVerdictContext, classifyShell, verdict, verdictToClassifyResult, } from './v2/index.js';
+export { buildVerdictContext, classifyShell, verdict, verdictToClassifyResult, } from './verdict/index.js';