@guilz-dev/belay 0.10.0 → 0.10.1

package/dist/bundle/cursor-runtime.mjs

@@ -1847,7 +1847,7 @@ function normalizeConfig(config) {
     policy: {
       unknownLocalEffect: v4.policy?.unknownLocalEffect === "deny" ? "deny" : v4.policy?.unknownLocalEffect === "allow_flagged" ? "allow_flagged" : DEFAULT_POLICY_V3.unknownLocalEffect,
       unparseableShell: v4.policy?.unparseableShell === "deny" ? "deny" : v4.policy?.unparseableShell === "allow_flagged" ? "allow_flagged" : DEFAULT_POLICY_V3.unparseableShell,
-      codexUnmappedTool: v4.policy?.codexUnmappedTool === "allow" ? "allow" : "deny",
+      codexUnmappedTool: "allow",
       fenceWarnThreshold: typeof v4.policy?.fenceWarnThreshold === "number" && v4.policy.fenceWarnThreshold > 0 && v4.policy.fenceWarnThreshold <= 1 ? v4.policy.fenceWarnThreshold : DEFAULT_FENCE_WARN_THRESHOLD,
       confidenceThresholds: {
         allow: typeof v4.policy?.confidenceThresholds?.allow === "number" ? v4.policy.confidenceThresholds.allow : DEFAULT_CONFIDENCE_THRESHOLDS.allow,
@@ -2149,7 +2149,7 @@ var init_config = __esm({
     DEFAULT_POLICY_V3 = {
       unknownLocalEffect: "allow_flagged",
       unparseableShell: "deny",
-      codexUnmappedTool: "deny",
+      codexUnmappedTool: "allow",
       confidenceThresholds: { ...DEFAULT_CONFIDENCE_THRESHOLDS },
       modelAssist: { ...DEFAULT_MODEL_ASSIST },
       transactional: { ...DEFAULT_TRANSACTIONAL_V3 },
@@ -10874,6 +10874,40 @@ function evaluateFileMutationPolicy(analysis, config, auth) {
   );
   return { request, decision };
 }
+function buildFileReadCapabilityRequest(analysis) {
+  return {
+    version: CAPABILITY_REQUEST_VERSION,
+    principal: {
+      adapter: analysis.adapter,
+      repoRoot: analysis.repoRoot,
+      sessionHash: hashSession(`${analysis.repoRoot}:${analysis.cwd}`)
+    },
+    action: "fs.read",
+    resource: { kind: "path", path: analysis.resolvedPath },
+    context: {
+      cwd: analysis.cwd,
+      inputFingerprint: analysis.inputFingerprint,
+      hookKind: analysis.hookKind,
+      analysisBasis: [`tool:${analysis.toolKind}`, `location:${analysis.locationLabel}`, "read"]
+    },
+    evidence: {
+      level: analysis.locationLabel === "repo_local" ? "certain" : "possible",
+      signals: [...analysis.signals, "effect.fs_read"]
+    }
+  };
+}
+function evaluateFileReadPolicy(analysis, config, auth) {
+  const request = buildFileReadCapabilityRequest(analysis);
+  const enriched = enrichAuthWithMaterializedGrants(request, config, {
+    ...auth,
+    sensitivePaths: auth?.sensitivePaths ?? analysis.sensitivePaths
+  });
+  const decision = getDefaultPolicyEngine().evaluate(
+    request,
+    buildAuthorizationContext(config, analysis.trustedWorkspaceRoots, enriched)
+  );
+  return { request, decision };
+}
 
 // src/core/capability/reasons.ts
 var FS_SCOPE_REASONS = /* @__PURE__ */ new Set(["outside_repo_mutation", "outside_repo_redirect"]);
@@ -17144,17 +17178,41 @@ function verdictToClassifyResult(result, config, options = {}) {
 
 // src/core/classify-tool.ts
 var DEFAULT_SENSITIVE_PATHS = [".env", ".env.*", "**/credentials/**"];
-var FILE_WRITE_TOOL_NAMES = /* @__PURE__ */ new Set(["write"]);
-var FILE_EDIT_TOOL_NAMES = /* @__PURE__ */ new Set([
-  "edit",
-  "multiedit",
-  "multi_edit",
-  "patch",
-  "strreplace",
-  "str_replace"
-]);
-var FILE_DELETE_TOOL_NAMES = /* @__PURE__ */ new Set(["delete"]);
-var APPLY_PATCH_TOOL_NAMES = /* @__PURE__ */ new Set(["apply_patch", "applypatch"]);
+function toolInputRecord(payload) {
+  const toolInput = payload.tool_input;
+  if (!toolInput || typeof toolInput !== "object" || Array.isArray(toolInput)) {
+    return null;
+  }
+  return toolInput;
+}
+function hasMutationFields(input) {
+  return typeof input.contents === "string" || typeof input.old_string === "string" || typeof input.new_string === "string" || typeof input.newContents === "string";
+}
+function inferToolPayloadEffect(payload, toolName) {
+  if (extractShellCommand(payload)) {
+    return "shell";
+  }
+  const input = toolInputRecord(payload);
+  if (!input) {
+    return "indeterminate";
+  }
+  if (hasMutationFields(input)) {
+    return "file_mutation";
+  }
+  if (extractPatch(payload)) {
+    return "apply_patch";
+  }
+  if (typeof input.pattern === "string" || typeof input.glob_pattern === "string") {
+    return "search_read";
+  }
+  if (typeof input.file_path === "string") {
+    return "file_read";
+  }
+  if (typeof input.path === "string" || typeof input.target_file === "string") {
+    return normalizedToolName(toolName) === "delete" ? "file_delete" : "indeterminate";
+  }
+  return "indeterminate";
+}
 function policyAuth(options) {
   if (!options.grants && options.attestation === void 0 && options.egressProxyActive === void 0) {
     return void 0;
@@ -17334,6 +17392,314 @@ function classifyFileMutationWithPolicy(params) {
     boundaryProfile: params.options.boundaryProfile ?? BOUNDARY_PROFILE_L3_L4_ONLY
   };
 }
+function classifyFileReadWithPolicy(params) {
+  const fingerprint = toolFingerprint(params.toolName, { path: params.filePath }, params.repoRoot);
+  const { request, decision } = evaluateFileReadPolicy(
+    {
+      hookKind: "tool",
+      toolKind: params.toolKind,
+      filePath: params.filePath,
+      resolvedPath: params.resolvedPath,
+      repoRoot: params.repoRoot,
+      cwd: params.cwd,
+      inputFingerprint: fingerprint,
+      signals: params.signals,
+      locationLabel: params.locationLabel,
+      trustedWorkspaceRoots: params.options.trustedWorkspaceRoots,
+      sensitivePaths: params.options.sensitivePaths ?? params.config.classifier.sensitivePaths
+    },
+    params.config,
+    policyAuth(params.options)
+  );
+  if (policyDecisionRequiresAsk(decision)) {
+    return {
+      verdict: "deny_pending_approval",
+      reason: policyReasonToLegacyReason(decision),
+      summary: params.filePath,
+      fingerprint,
+      assessment: {
+        reversibility: "reversible",
+        external: params.locationLabel === "outside_repo",
+        blastRadius: params.locationLabel === "outside_repo" ? "outside the repository" : "sensitive repository file",
+        confidence: 0.85,
+        signals: [...params.signals, ...decision.signals]
+      },
+      capabilityRequests: [request],
+      authorizationDecision: decision,
+      boundaryProfile: params.options.boundaryProfile ?? BOUNDARY_PROFILE_L3_L4_ONLY
+    };
+  }
+  return {
+    verdict: "allow",
+    reason: "effect.fs_read",
+    summary: params.filePath,
+    fingerprint,
+    assessment: {
+      reversibility: "reversible",
+      external: false,
+      blastRadius: "tool scope",
+      confidence: 0.88,
+      signals: [...params.signals, ...decision.signals]
+    },
+    capabilityRequests: [request],
+    authorizationDecision: decision,
+    boundaryProfile: params.options.boundaryProfile ?? BOUNDARY_PROFILE_L3_L4_ONLY
+  };
+}
+function classifyFilePathMutation(params) {
+  const {
+    toolName,
+    toolKind,
+    filePath,
+    repoRoot,
+    cwd,
+    config,
+    options,
+    sensitivePaths,
+    protectedRoots,
+    isDelete
+  } = params;
+  const signals = [];
+  const resolvedPath = path51.isAbsolute(filePath) ? filePath : path51.resolve(cwd, filePath);
+  const hitsProtectedRoot = protectedRoots.some((root) => pathWithinRoot(root, resolvedPath));
+  if (hitsProtectedRoot) {
+    signals.push("control_plane_path");
+    return classifyFileMutationWithPolicy({
+      toolName,
+      toolKind,
+      filePath,
+      resolvedPath,
+      repoRoot,
+      cwd,
+      config,
+      options,
+      signals,
+      isDelete,
+      locationLabel: "control_plane"
+    });
+  }
+  const workspaceMatch = resolveWorkspaceRootMatch(
+    repoRoot,
+    options.trustedWorkspaceRoots,
+    resolvedPath
+  );
+  if (workspaceMatch === null) {
+    signals.push("outside_repo_path");
+    return classifyFileMutationWithPolicy({
+      toolName,
+      toolKind,
+      filePath,
+      resolvedPath,
+      repoRoot,
+      cwd,
+      config,
+      options,
+      signals,
+      isDelete,
+      locationLabel: "outside_repo"
+    });
+  }
+  if (workspaceMatch.kind === "trusted") {
+    signals.push("trusted_workspace_root");
+  }
+  const trustedCwd = resolveClassifierTrustedCwd(cwd, options);
+  const workspacePrescan = mutationPrescanRequiresAsk({
+    targets: [filePath],
+    cwd,
+    repoRoot,
+    trustedCwd,
+    trustedWorkspaceRoots: options.trustedWorkspaceRoots,
+    sensitivePaths
+  });
+  if (workspacePrescan) {
+    return classifyFileMutationWithPolicy({
+      toolName,
+      toolKind,
+      filePath,
+      resolvedPath,
+      repoRoot,
+      cwd,
+      config,
+      options,
+      signals,
+      isDelete,
+      locationLabel: "sensitive_path"
+    });
+  }
+  const relativePath = workspaceMatch.relativePath;
+  if (matchesSensitivePath(relativePath, sensitivePaths)) {
+    signals.push("sensitive_path");
+    return classifyFileMutationWithPolicy({
+      toolName,
+      toolKind,
+      filePath,
+      resolvedPath,
+      repoRoot,
+      cwd,
+      config,
+      options,
+      signals,
+      isDelete,
+      locationLabel: "sensitive_path"
+    });
+  }
+  if (isDelete) {
+    if (isGitPath(resolvedPath, repoRoot)) {
+      signals.push("protected_artifact");
+      return classifyFileMutationWithPolicy({
+        toolName,
+        toolKind,
+        filePath,
+        resolvedPath,
+        repoRoot,
+        cwd,
+        config,
+        options,
+        signals,
+        isDelete: true,
+        locationLabel: "sensitive_path"
+      });
+    }
+    signals.push("file_delete");
+    return classifyFileMutationWithPolicy({
+      toolName,
+      toolKind,
+      filePath,
+      resolvedPath,
+      repoRoot,
+      cwd,
+      config,
+      options,
+      signals,
+      isDelete: true,
+      locationLabel: "repo_local"
+    });
+  }
+  signals.push("file_mutation");
+  return classifyFileMutationWithPolicy({
+    toolName,
+    toolKind,
+    filePath,
+    resolvedPath,
+    repoRoot,
+    cwd,
+    config,
+    options,
+    signals,
+    isDelete: false,
+    locationLabel: "repo_local"
+  });
+}
+function classifyFilePathRead(params) {
+  const {
+    toolName,
+    toolKind,
+    filePath,
+    repoRoot,
+    cwd,
+    config,
+    options,
+    sensitivePaths,
+    protectedRoots
+  } = params;
+  const signals = ["effect.fs_read"];
+  const resolvedPath = path51.isAbsolute(filePath) ? filePath : path51.resolve(cwd, filePath);
+  if (protectedRoots.some((root) => pathWithinRoot(root, resolvedPath))) {
+    signals.push("control_plane_path");
+    return classifyFileReadWithPolicy({
+      toolName,
+      toolKind,
+      filePath,
+      resolvedPath,
+      repoRoot,
+      cwd,
+      config,
+      options,
+      signals,
+      locationLabel: "control_plane"
+    });
+  }
+  const workspaceMatch = resolveWorkspaceRootMatch(
+    repoRoot,
+    options.trustedWorkspaceRoots,
+    resolvedPath
+  );
+  if (workspaceMatch === null) {
+    signals.push("outside_repo_path");
+    return classifyFileReadWithPolicy({
+      toolName,
+      toolKind,
+      filePath,
+      resolvedPath,
+      repoRoot,
+      cwd,
+      config,
+      options,
+      signals,
+      locationLabel: "outside_repo"
+    });
+  }
+  const relativePath = workspaceMatch.relativePath;
+  if (matchesSensitivePath(relativePath, sensitivePaths)) {
+    signals.push("sensitive_path");
+    return classifyFileReadWithPolicy({
+      toolName,
+      toolKind,
+      filePath,
+      resolvedPath,
+      repoRoot,
+      cwd,
+      config,
+      options,
+      signals,
+      locationLabel: "sensitive_path"
+    });
+  }
+  return classifyFileReadWithPolicy({
+    toolName,
+    toolKind,
+    filePath,
+    resolvedPath,
+    repoRoot,
+    cwd,
+    config,
+    options,
+    signals,
+    locationLabel: "repo_local"
+  });
+}
+function indeterminateToolResult(toolName, payload, repoRoot, options) {
+  const summary = canonicalStringify(scrubPayload(payload.tool_input ?? {}, options));
+  const fingerprint = toolFingerprint(toolName, fingerprintPayload(payload, options), repoRoot);
+  if (options.unknownLocalEffect === "deny") {
+    return {
+      verdict: "deny_pending_approval",
+      reason: "indeterminate_tool_effect",
+      summary,
+      fingerprint,
+      assessment: {
+        reversibility: "irreversible",
+        external: false,
+        blastRadius: "unknown tool action",
+        confidence: 0.5,
+        signals: ["indeterminate_tool_effect"]
+      }
+    };
+  }
+  return {
+    verdict: "allow_flagged",
+    reason: "indeterminate_tool_effect",
+    summary,
+    fingerprint,
+    assessment: {
+      reversibility: "recoverable_with_cost",
+      external: false,
+      blastRadius: "tool scope",
+      confidence: 0.5,
+      signals: ["indeterminate_tool_effect"]
+    }
+  };
+}
 async function classifyToolUse(payload, repoRoot, cwd, config, options = {}) {
   const toolName = String(payload.tool_name ?? "");
   const toolKind = normalizedToolName(toolName);
@@ -17380,9 +17746,10 @@ async function classifyToolUse(payload, repoRoot, cwd, config, options = {}) {
       summary: command
     };
   }
-  if (FILE_WRITE_TOOL_NAMES.has(toolKind) || FILE_EDIT_TOOL_NAMES.has(toolKind) || FILE_DELETE_TOOL_NAMES.has(toolKind)) {
-    const filePath = extractFilePath(payload);
-    if (!filePath) {
+  const effect = inferToolPayloadEffect(payload, toolName);
+  if (effect === "file_mutation" || effect === "file_delete") {
+    const filePath2 = extractFilePath(payload);
+    if (!filePath2) {
       if (options.unknownLocalEffect === "deny") {
         return {
           verdict: "deny_pending_approval",
@@ -17412,138 +17779,20 @@ async function classifyToolUse(payload, repoRoot, cwd, config, options = {}) {
         }
       };
     }
-    const signals = [];
-    const resolvedPath = path51.isAbsolute(filePath) ? filePath : path51.resolve(cwd, filePath);
-    const hitsProtectedRoot = protectedRoots.some((root) => pathWithinRoot(root, resolvedPath));
-    if (hitsProtectedRoot) {
-      signals.push("control_plane_path");
-      return classifyFileMutationWithPolicy({
-        toolName,
-        toolKind,
-        filePath,
-        resolvedPath,
-        repoRoot,
-        cwd,
-        config,
-        options,
-        signals,
-        isDelete: FILE_DELETE_TOOL_NAMES.has(toolKind),
-        locationLabel: "control_plane"
-      });
-    }
-    const workspaceMatch = resolveWorkspaceRootMatch(
-      repoRoot,
-      options.trustedWorkspaceRoots,
-      resolvedPath
-    );
-    if (workspaceMatch === null) {
-      signals.push("outside_repo_path");
-      return classifyFileMutationWithPolicy({
-        toolName,
-        toolKind,
-        filePath,
-        resolvedPath,
-        repoRoot,
-        cwd,
-        config,
-        options,
-        signals,
-        isDelete: FILE_DELETE_TOOL_NAMES.has(toolKind),
-        locationLabel: "outside_repo"
-      });
-    }
-    if (workspaceMatch.kind === "trusted") {
-      signals.push("trusted_workspace_root");
-    }
-    const trustedCwd = resolveClassifierTrustedCwd(cwd, options);
-    const workspacePrescan = mutationPrescanRequiresAsk({
-      targets: [filePath],
-      cwd,
-      repoRoot,
-      trustedCwd,
-      trustedWorkspaceRoots: options.trustedWorkspaceRoots,
-      sensitivePaths
-    });
-    if (workspacePrescan) {
-      return classifyFileMutationWithPolicy({
-        toolName,
-        toolKind,
-        filePath,
-        resolvedPath,
-        repoRoot,
-        cwd,
-        config,
-        options,
-        signals,
-        isDelete: FILE_DELETE_TOOL_NAMES.has(toolKind),
-        locationLabel: "sensitive_path"
-      });
-    }
-    const relativePath = workspaceMatch.relativePath;
-    if (matchesSensitivePath(relativePath, sensitivePaths)) {
-      signals.push("sensitive_path");
-      return classifyFileMutationWithPolicy({
-        toolName,
-        toolKind,
-        filePath,
-        resolvedPath,
-        repoRoot,
-        cwd,
-        config,
-        options,
-        signals,
-        isDelete: FILE_DELETE_TOOL_NAMES.has(toolKind),
-        locationLabel: "sensitive_path"
-      });
-    }
-    if (FILE_DELETE_TOOL_NAMES.has(toolKind)) {
-      if (isGitPath(resolvedPath, repoRoot)) {
-        signals.push("protected_artifact");
-        return classifyFileMutationWithPolicy({
-          toolName,
-          toolKind,
-          filePath,
-          resolvedPath,
-          repoRoot,
-          cwd,
-          config,
-          options,
-          signals,
-          isDelete: true,
-          locationLabel: "sensitive_path"
-        });
-      }
-      signals.push("file_delete");
-      return classifyFileMutationWithPolicy({
-        toolName,
-        toolKind,
-        filePath,
-        resolvedPath,
-        repoRoot,
-        cwd,
-        config,
-        options,
-        signals,
-        isDelete: true,
-        locationLabel: "repo_local"
-      });
-    }
-    signals.push("file_mutation");
-    return classifyFileMutationWithPolicy({
+    return classifyFilePathMutation({
       toolName,
       toolKind,
-      filePath,
-      resolvedPath,
+      filePath: filePath2,
       repoRoot,
       cwd,
       config,
       options,
-      signals,
-      isDelete: false,
-      locationLabel: "repo_local"
+      sensitivePaths,
+      protectedRoots,
+      isDelete: effect === "file_delete"
     });
   }
-  if (APPLY_PATCH_TOOL_NAMES.has(toolKind)) {
+  if (effect === "apply_patch") {
     const patch = extractPatch(payload);
     const targets = patch ? applyPatchTargets2(patch) : [];
     if (targets.length === 0) {
@@ -17581,7 +17830,7 @@ async function classifyToolUse(payload, repoRoot, cwd, config, options = {}) {
       const result = await classifyToolUse(
         {
           tool_name: target.delete ? "Delete" : "Write",
-          tool_input: { path: target.path }
+          tool_input: target.delete ? { path: target.path } : { path: target.path, contents: " " }
         },
         repoRoot,
         cwd,
@@ -17607,19 +17856,54 @@ async function classifyToolUse(payload, repoRoot, cwd, config, options = {}) {
       }
     };
   }
-  return {
-    verdict: "allow",
-    reason: "unclassified_tool",
-    summary: canonicalStringify(scrubPayload(payload.tool_input ?? {}, options)),
-    fingerprint: toolFingerprint(toolName, fingerprintPayload(payload, options), repoRoot),
-    assessment: {
-      reversibility: "reversible",
-      external: false,
-      blastRadius: "tool scope",
-      confidence: 0.5,
-      signals: ["unclassified_tool"]
+  if (effect === "file_read") {
+    const filePath2 = extractFilePath(payload);
+    if (!filePath2) {
+      return indeterminateToolResult(toolName, payload, repoRoot, options);
     }
-  };
+    return classifyFilePathRead({
+      toolName,
+      toolKind,
+      filePath: filePath2,
+      repoRoot,
+      cwd,
+      config,
+      options,
+      sensitivePaths,
+      protectedRoots
+    });
+  }
+  if (effect === "search_read") {
+    return {
+      verdict: "allow",
+      reason: "effect.search_read",
+      summary: canonicalStringify(scrubPayload(payload.tool_input ?? {}, options)),
+      fingerprint: toolFingerprint(toolName, fingerprintPayload(payload, options), repoRoot),
+      assessment: {
+        reversibility: "reversible",
+        external: false,
+        blastRadius: "tool scope",
+        confidence: 0.88,
+        signals: ["effect.search_read"]
+      }
+    };
+  }
+  const filePath = extractFilePath(payload);
+  if (filePath) {
+    return classifyFilePathMutation({
+      toolName,
+      toolKind,
+      filePath,
+      repoRoot,
+      cwd,
+      config,
+      options,
+      sensitivePaths,
+      protectedRoots,
+      isDelete: toolKind === "delete"
+    });
+  }
+  return indeterminateToolResult(toolName, payload, repoRoot, options);
 }
 
 // src/core/gate-engine.ts
@@ -17954,15 +18238,8 @@ function gateEnabledForAction(config, action) {
   if (action.kind === "subagent") {
     return config.gates.subagent;
   }
-  const toolName = action.toolName ?? String(action.payload?.tool_name ?? "");
-  if (toolName === "Shell") {
-    return config.gates.toolShell;
-  }
-  if (toolName === "Write" || toolName === "StrReplace" || toolName === "Delete") {
-    return config.gates.fileMutation;
-  }
-  if (toolName === "Task") {
-    return config.gates.subagent;
+  if (action.kind === "tool") {
+    return config.gates.fileMutation || config.gates.toolShell;
   }
   return true;
 }
@@ -17999,7 +18276,7 @@ function hashDecisionConfig(config) {
 init_fingerprint2();
 
 // src/version.ts
-var PACKAGE_VERSION = "0.10.0";
+var PACKAGE_VERSION = "0.10.1";
 
 // src/runtime-provenance.ts
 function resolveRuntimeArtifactHash(artifactHash) {
@@ -21300,21 +21577,7 @@ async function evaluateGatedAction(ctx, deps, params) {
     ...authorization,
     egressProxyActive
   };
-  let predicted = await classifyGatedActionAsync(action, ctx.config, enrichedClassifierOptions);
-  if (action.kind === "tool" && predicted.reason === "unclassified_tool" && (ctx.config.policy.codexUnmappedTool ?? "deny") === "deny") {
-    predicted = {
-      ...predicted,
-      verdict: "deny_pending_approval",
-      reason: "unmapped_tool",
-      assessment: {
-        reversibility: "irreversible",
-        external: false,
-        blastRadius: "unknown tool action",
-        confidence: 0.5,
-        signals: ["unmapped_tool"]
-      }
-    };
-  }
+  const predicted = await classifyGatedActionAsync(action, ctx.config, enrichedClassifierOptions);
   if (action.kind === "shell" && action.command && isContainedUnknownExecutionEligible(ctx.config, action, predicted)) {
     const mediated = await mediateContainedUnknownExecution({
       ctx,