@guilz-dev/belay 0.2.0 → 0.3.0

package/dist/commands/judge.js

@@ -0,0 +1,285 @@
+import path from 'node:path';
+import { stdin as input, stdout as output } from 'node:process';
+import { createInterface } from 'node:readline/promises';
+import { configPathFor, loadApprovalState, loadConfigFile, repoLocalStateDirFor, resolveAdapterName, writeConfigFile, } from '../config-io.js';
+import { appendCliAuditEvent } from '../core/audit-io.js';
+import { JUDGE_CLOUD_CONSENT_REASON } from '../core/capability/reasons.js';
+import { belayStateDir, normalizeJudgeConfig } from '../core/config.js';
+import { writeJudgeCredentialStore } from '../core/credential-store.js';
+import { refreshIntegrityIfPinned } from '../core/integrity.js';
+import { resolveJudgeCredential } from '../core/judge-api-key.js';
+import { ensurePendingJudgeCloudConsentApproval } from '../core/judge-cloud-consent.js';
+import { hasValidCloudConsent, isCloudJudgeConfig, resolveJudgeUsePatch, } from '../core/judge-config.js';
+import { diagnoseJudge } from '../core/judge-doctor.js';
+import { rejectDeprecatedJudgeModelAuto } from '../core/judge-model-policy.js';
+import { resolveJudgeTransport } from '../core/judge-runtime-detection.js';
+import { getJudgeProviderSpec, isJudgeProviderId, JUDGE_CATALOG, JUDGE_PROVIDER_IDS, normalizeLegacyProviderId, } from '../core/verdict/judge-catalog.js';
+import { resolveJudgeModel } from '../core/verdict/judge-factory.js';
+import { readKeyFromStdin } from './stdin-key.js';
+export function isInteractiveTTY() {
+    return Boolean(input.isTTY && output.isTTY);
+}
+async function confirmCloudConsent(endpoint) {
+    if (!isInteractiveTTY()) {
+        return false;
+    }
+    const rl = createInterface({ input, output });
+    try {
+        const answer = await rl.question(`Cloud judge sends redacted commands to ${endpoint}. Continue? [y/N] `);
+        return ['y', 'yes'].includes(answer.trim().toLowerCase());
+    }
+    finally {
+        rl.close();
+    }
+}
+async function hasApprovedCloudConsent(repoRoot, config, approvalId) {
+    const approved = await loadApprovalState(repoRoot, 'approved-approvals.json', config);
+    return approved.approvals.some((entry) => entry.approvalId === approvalId && entry.reason === 'judge_cloud_consent');
+}
+function formatJudgeDiff(before, after) {
+    const lines = ['Judge config changes:'];
+    const keys = new Set([...Object.keys(before), ...Object.keys(after)]);
+    for (const key of keys) {
+        const left = JSON.stringify(before[key]);
+        const right = JSON.stringify(after[key]);
+        if (left !== right) {
+            lines.push(`  ${String(key)}: ${left} -> ${right}`);
+        }
+    }
+    return lines.join('\n');
+}
+export async function judgeStatus(options = {}) {
+    const repoRoot = path.resolve(options.targetDir ?? process.cwd());
+    const config = await loadConfigFile(repoRoot);
+    const judge = config.judge;
+    const spec = judge.providerId ? getJudgeProviderSpec(judge.providerId) : null;
+    const repoLocalDir = repoLocalStateDirFor(repoRoot, config);
+    const credential = await resolveJudgeCredential({
+        judge,
+        catalogSpec: spec ?? undefined,
+        repoRoot,
+        repoLocalStateDir: repoLocalDir,
+        config,
+    });
+    const { resolved } = resolveJudgeModel(judge);
+    const transport = resolveJudgeTransport(judge);
+    const lines = [
+        `Judge providerId : ${judge.providerId ?? '(inferred)'}`,
+        `Judge driver     : ${judge.provider}`,
+        `Transport        : ${transport}`,
+        `Endpoint         : ${judge.endpoint ?? '(none)'}`,
+        `Model            : ${resolved} (requested: ${judge.model})`,
+        `Credential       : ${credential.mode} (${credential.sourceKind})${credential.source ? ` → ${credential.source}` : ''} ${credential.key ? '✓ set' : '✗ missing'}`,
+        `Cloud consent    : ${judge.cloudConsent?.accepted
+            ? `accepted ${judge.cloudConsent.at} by ${judge.cloudConsent.by}`
+            : 'not recorded'}`,
+        `Tier1 fallback   : ask (fail-closed) — judge unreachable would block, not allow`,
+    ];
+    if (options.json) {
+        return {
+            providerId: judge.providerId,
+            provider: judge.provider,
+            endpoint: judge.endpoint,
+            model: judge.model,
+            modelResolved: resolved,
+            transport,
+            credential,
+            cloudConsent: judge.cloudConsent ?? null,
+            cloudJudgeActive: isCloudJudgeConfig(judge) && hasValidCloudConsent(judge),
+        };
+    }
+    return lines.join('\n');
+}
+export function judgeList(options = {}) {
+    const entries = JUDGE_PROVIDER_IDS.map((id) => {
+        const spec = JUDGE_CATALOG[id];
+        return {
+            id,
+            driver: spec.driver,
+            cloud: spec.isCloud,
+            defaultEndpoint: spec.defaultEndpoint,
+            defaultModel: spec.defaultModel,
+            apiKeyEnvVars: spec.apiKeyEnvVars,
+        };
+    });
+    if (options.json) {
+        return entries;
+    }
+    return entries
+        .map((entry) => `${entry.id} (${entry.cloud ? 'cloud' : 'local'}) driver=${entry.driver} model=${entry.defaultModel} endpoint=${entry.defaultEndpoint ?? 'optional'}`)
+        .join('\n');
+}
+export async function judgeUse(options) {
+    const repoRoot = path.resolve(options.targetDir ?? process.cwd());
+    const config = await loadConfigFile(repoRoot);
+    const adapter = resolveAdapterName(config);
+    const providerId = options.providerId?.trim();
+    if (!providerId || !isJudgeProviderId(providerId)) {
+        throw new Error(`judge use requires provider-id: ${JUDGE_PROVIDER_IDS.join(', ')}`);
+    }
+    const before = { ...config.judge };
+    if (options.model !== undefined) {
+        rejectDeprecatedJudgeModelAuto(options.model);
+    }
+    if (options.keyStdin &&
+        options.credentialMode === 'apiKey' &&
+        options.acceptCloud &&
+        isInteractiveTTY()) {
+        throw new Error('Cannot combine --accept-cloud with --key-stdin in interactive mode. Use env for the API key, or record consent separately.');
+    }
+    let keyFromStdin;
+    if (options.keyStdin && options.credentialMode === 'apiKey') {
+        keyFromStdin = await readKeyFromStdin();
+        if (!keyFromStdin) {
+            throw new Error('--key-stdin requires a non-empty API key on stdin.');
+        }
+    }
+    let interactiveConsentApproved = false;
+    if (options.acceptCloud && isInteractiveTTY()) {
+        const spec = getJudgeProviderSpec(providerId);
+        const endpoint = options.endpoint?.trim() || spec?.defaultEndpoint || before.endpoint?.trim() || '';
+        if (endpoint) {
+            interactiveConsentApproved = await confirmCloudConsent(endpoint);
+        }
+    }
+    const cloudConsentApprovalId = options.cloudConsentApprovalId;
+    if (options.cloudConsentApprovalId) {
+        const ok = await hasApprovedCloudConsent(repoRoot, config, options.cloudConsentApprovalId);
+        if (!ok) {
+            throw new Error(`Approval ${options.cloudConsentApprovalId} is not an approved judge_cloud_consent.`);
+        }
+    }
+    else if (options.acceptCloud &&
+        !isInteractiveTTY() &&
+        getJudgeProviderSpec(providerId)?.isCloud) {
+        throw new Error('--accept-cloud has no effect in non-interactive mode. Use TTY confirmation or --cloud-consent-approval-id.');
+    }
+    const patch = resolveJudgeUsePatch(before, {
+        providerId,
+        model: options.model,
+        endpoint: options.endpoint,
+        timeoutMs: options.timeoutMs,
+        acceptCloud: options.acceptCloud,
+        cloudConsentApprovalId,
+        credentialMode: options.credentialMode,
+        keyEnv: options.keyEnv,
+        interactiveTTY: isInteractiveTTY(),
+        interactiveConsentApproved,
+    });
+    if (patch.errors.length > 0) {
+        throw new Error(patch.errors.join(' '));
+    }
+    if (keyFromStdin !== undefined) {
+        const stateDir = belayStateDir(config, repoLocalStateDirFor(repoRoot, config));
+        await writeJudgeCredentialStore(stateDir, keyFromStdin);
+    }
+    const after = normalizeJudgeConfig(patch.judge);
+    const updated = { ...config, judge: after };
+    await writeConfigFile(repoRoot, updated, adapter);
+    await refreshIntegrityIfPinned(repoRoot, updated);
+    await appendCliAuditEvent(repoRoot, updated, {
+        event: 'judge_provider_changed',
+        from: { providerId: before.providerId, provider: before.provider },
+        to: { providerId: after.providerId, provider: after.provider },
+        by: 'belay judge use',
+    });
+    if (after.cloudConsent?.accepted && !before.cloudConsent?.accepted) {
+        await appendCliAuditEvent(repoRoot, updated, {
+            event: 'judge_cloud_consent_recorded',
+            providerId: after.cloudConsent.providerId,
+            endpoint: after.cloudConsent.endpoint,
+            by: after.cloudConsent.by,
+        });
+    }
+    const spec = getJudgeProviderSpec(providerId);
+    const credential = await resolveJudgeCredential({
+        judge: after,
+        catalogSpec: spec ?? undefined,
+        repoRoot,
+        repoLocalStateDir: repoLocalStateDirFor(repoRoot, updated),
+        config: updated,
+    });
+    if (spec?.isCloud && !credential.key) {
+        patch.warnings.push(`API key not found for ${providerId}. Tier1 cloud judge will fail closed to ask.`);
+    }
+    const result = {
+        ok: true,
+        configPath: configPathFor(repoRoot, adapter),
+        diff: formatJudgeDiff(before, after),
+        warnings: patch.warnings,
+        judge: after,
+    };
+    if (options.json) {
+        return result;
+    }
+    const parts = [
+        result.diff,
+        ...result.warnings.map((w) => `Warning: ${w}`),
+        'Judge config updated.',
+    ];
+    return parts.join('\n');
+}
+export async function judgeRequestCloudConsent(options = {}) {
+    const repoRoot = path.resolve(options.targetDir ?? process.cwd());
+    const config = await loadConfigFile(repoRoot);
+    const providerId = options.providerId?.trim();
+    if (!providerId || !isJudgeProviderId(providerId)) {
+        throw new Error(`judge consent requires --provider-id: ${JUDGE_PROVIDER_IDS.join(', ')}`);
+    }
+    const canonicalProviderId = normalizeLegacyProviderId(providerId);
+    const spec = getJudgeProviderSpec(canonicalProviderId);
+    if (!spec?.isCloud) {
+        throw new Error(`judge consent applies only to cloud providers (${JUDGE_PROVIDER_IDS.filter((id) => JUDGE_CATALOG[id].isCloud).join(', ')}).`);
+    }
+    const endpoint = options.endpoint?.trim() || config.judge.endpoint?.trim() || spec.defaultEndpoint || '';
+    if (!endpoint) {
+        throw new Error(`${canonicalProviderId} requires --endpoint for cloud consent request.`);
+    }
+    const { approvalId, created } = await ensurePendingJudgeCloudConsentApproval({
+        repoRoot,
+        config,
+        providerId: canonicalProviderId,
+        endpoint,
+    });
+    const lines = [
+        `Cloud consent approval ${created ? 'created' : 'reused'}: ${approvalId}`,
+        `Approve: belay approve ${approvalId}`,
+        `Then: belay judge use ${canonicalProviderId} --endpoint ${endpoint} --cloud-consent-approval-id ${approvalId}`,
+    ];
+    if (options.json) {
+        return { approvalId, created, providerId, endpoint, reason: JUDGE_CLOUD_CONSENT_REASON };
+    }
+    return lines.join('\n');
+}
+export async function judgeTest(options = {}) {
+    const repoRoot = path.resolve(options.targetDir ?? process.cwd());
+    const config = await loadConfigFile(repoRoot);
+    const diagnosis = await diagnoseJudge(config, repoRoot);
+    const modelCheck = diagnosis.modelCheck;
+    if (options.json) {
+        return { ...diagnosis, modelCheck };
+    }
+    return [
+        `Model check: ${modelCheck?.status ?? 'unverified'}`,
+        `Model source: ${modelCheck?.source ?? 'unknown'}`,
+        ...diagnosis.notes.map((n) => `Note: ${n}`),
+        ...diagnosis.warnings.map((w) => `Warning: ${w}`),
+        ...diagnosis.issues.map((i) => `Issue: ${i}`),
+    ].join('\n');
+}
+export async function runJudgeCommand(options) {
+    switch (options.subcommand) {
+        case 'status':
+            return judgeStatus(options);
+        case 'list':
+            return judgeList(options);
+        case 'use':
+            return judgeUse(options);
+        case 'test':
+            return judgeTest(options);
+        case 'consent':
+            return judgeRequestCloudConsent(options);
+        default:
+            throw new Error('judge requires subcommand: status, list, use, test, or consent');
+    }
+}

package/dist/commands/status.js

@@ -39,9 +39,9 @@ export function formatStatusReport(report) {
         ...(health.additionalRiskSignals.length > 0
             ? [`Additional risk signals: ${health.additionalRiskSignals.join('; ')}`]
             : []),
-        ...(health.skillOnly
+        ...(!health.floorInstalled
             ? [
-                'Skill-only mode: yes — hooks are missing or incomplete. Run `npx @guilz-dev/belay init` to install the enforcement floor.',
+                'Enforcement floor missing or incomplete. Run `belay config` for interactive setup, or `npx @guilz-dev/belay init` for non-interactive install.',
             ]
             : []),
         `Approval state: ${report.approvalStateDir}`,

package/dist/commands/stdin-key.d.ts

@@ -0,0 +1 @@
+export declare function readKeyFromStdin(): Promise<string>;

package/dist/commands/stdin-key.js

@@ -0,0 +1,8 @@
+import { stdin as input } from 'node:process';
+export async function readKeyFromStdin() {
+    const chunks = [];
+    for await (const chunk of input) {
+        chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+    }
+    return Buffer.concat(chunks).toString('utf8').trim();
+}

package/dist/conformance/guarantee-table.js

@@ -86,10 +86,22 @@ export const GUARANTEE_SCENARIOS = {
             reason: 'external_effect',
         },
         {
+            // L1-full only: shell + tool paths use classifyGatedAction + brokerFsScope.
             id: 'l1f-deny-outside-repo',
             command: 'echo hi > ../../outside.txt',
             permission: 'deny',
             reason: 'outside_repo_redirect',
         },
+        {
+            id: 'l1f-deny-outside-repo-write',
+            kind: 'tool',
+            command: '',
+            toolPayload: {
+                tool_name: 'Write',
+                tool_input: { path: '../../outside.txt', contents: 'hi' },
+            },
+            permission: 'deny',
+            reason: 'outside_repo_mutation',
+        },
     ],
 };

package/dist/conformance/types.d.ts

@@ -3,4 +3,6 @@ export interface LayerConformanceScenario {
     command: string;
     permission: 'allow' | 'deny';
     reason?: string;
+    kind?: 'shell' | 'tool';
+    toolPayload?: Record<string, unknown>;
 }

package/dist/core/audit-io.d.ts

@@ -0,0 +1,2 @@
+import type { BelayConfigV4 } from './config.js';
+export declare function appendCliAuditEvent(repoRoot: string, config: BelayConfigV4, event: Record<string, unknown>): Promise<void>;

package/dist/core/audit-io.js

@@ -0,0 +1,14 @@
+import { appendFile, mkdir } from 'node:fs/promises';
+import path from 'node:path';
+export async function appendCliAuditEvent(repoRoot, config, event) {
+    const auditPath = path.isAbsolute(config.audit.logPath)
+        ? config.audit.logPath
+        : path.join(repoRoot, config.audit.logPath);
+    await mkdir(path.dirname(auditPath), { recursive: true });
+    const line = JSON.stringify({
+        ts: new Date().toISOString(),
+        source: 'belay-cli',
+        ...event,
+    });
+    await appendFile(auditPath, `${line}\n`, 'utf8');
+}

package/dist/core/capability/index.d.ts

@@ -1,5 +1,5 @@
 export { addPathToAllowlist, allPathsAllowlisted, fsScopeAllowlistPath, isPathAllowlisted, loadFsScopeAllowlist, loadFsScopeAllowlistSync, saveFsScopeAllowlist, } from './allowlist.js';
 export { evaluateL1FullStatus, hasSandboxRuntime, isCapabilityBrokerDemotionActive, isSandboxBrokerEnabled, } from './broker.js';
-export { collectOutsideRepoPaths } from './paths.js';
-export { FS_SCOPE_REASONS, shouldSkipBrokerApprovedOnce } from './reasons.js';
+export { collectOutsideRepoPaths, collectOutsideRepoPathsFromToolPayload } from './paths.js';
+export { FS_SCOPE_REASONS, shouldSkipBrokerApprovedOnce, shouldSkipBrokerApprovedRecord, } from './reasons.js';
 export type { CapabilityApprovalScope, FsScopeAllowlistEntry, FsScopeAllowlistFile, } from './types.js';

package/dist/core/capability/index.js

@@ -1,4 +1,4 @@
 export { addPathToAllowlist, allPathsAllowlisted, fsScopeAllowlistPath, isPathAllowlisted, loadFsScopeAllowlist, loadFsScopeAllowlistSync, saveFsScopeAllowlist, } from './allowlist.js';
 export { evaluateL1FullStatus, hasSandboxRuntime, isCapabilityBrokerDemotionActive, isSandboxBrokerEnabled, } from './broker.js';
-export { collectOutsideRepoPaths } from './paths.js';
-export { FS_SCOPE_REASONS, shouldSkipBrokerApprovedOnce } from './reasons.js';
+export { collectOutsideRepoPaths, collectOutsideRepoPathsFromToolPayload } from './paths.js';
+export { FS_SCOPE_REASONS, shouldSkipBrokerApprovedOnce, shouldSkipBrokerApprovedRecord, } from './reasons.js';

package/dist/core/capability/paths.d.ts

@@ -1 +1,2 @@
 export declare function collectOutsideRepoPaths(command: string, cwd: string, repoRoot: string): string[];
+export declare function collectOutsideRepoPathsFromToolPayload(payload: Record<string, unknown>, cwd: string, repoRoot: string): string[];

package/dist/core/capability/paths.js

@@ -1,20 +1,88 @@
+import path from 'node:path';
 import { relativeWithinRepo, resolveMutationTarget } from '../path-utils.js';
 import { extractRedirectTargets, tokenizeShell } from '../shell-tokenizer.js';
+function applyPatchTargets(patch) {
+    const targets = [];
+    for (const line of patch.split('\n')) {
+        const match = line.match(/^\*\*\* (?:Add|Delete|Update) File: (.+)$/);
+        if (match?.[1]) {
+            targets.push(match[1]);
+            continue;
+        }
+        const moveMatch = line.match(/^\*\*\* Move to: (.+)$/);
+        if (moveMatch?.[1]) {
+            targets.push(moveMatch[1]);
+        }
+    }
+    return targets;
+}
+function extractToolFilePath(payload) {
+    const toolInput = payload.tool_input;
+    if (!toolInput || typeof toolInput !== 'object') {
+        return null;
+    }
+    const input = toolInput;
+    for (const key of ['path', 'file_path', 'target_file', 'filePath']) {
+        if (typeof input[key] === 'string') {
+            return input[key];
+        }
+    }
+    return null;
+}
+function extractToolPatch(payload) {
+    const toolInput = payload.tool_input;
+    if (!toolInput || typeof toolInput !== 'object') {
+        return null;
+    }
+    const input = toolInput;
+    for (const key of ['patch', 'input', 'text']) {
+        if (typeof input[key] === 'string' && input[key].trim()) {
+            return input[key];
+        }
+    }
+    return null;
+}
+function addOutsideRepoPath(paths, token, cwd, repoRoot) {
+    const resolved = resolveMutationTarget(token, cwd);
+    if (resolved && relativeWithinRepo(repoRoot, resolved) === null) {
+        paths.add(resolved);
+    }
+}
 export function collectOutsideRepoPaths(command, cwd, repoRoot) {
     const tokens = tokenizeShell(command);
     const redirects = extractRedirectTargets(tokens);
     const paths = new Set();
     for (const token of tokens.slice(1)) {
-        const resolved = resolveMutationTarget(token, cwd);
-        if (resolved && relativeWithinRepo(repoRoot, resolved) === null) {
-            paths.add(resolved);
-        }
+        addOutsideRepoPath(paths, token, cwd, repoRoot);
     }
     for (const redirect of redirects) {
-        const resolved = resolveMutationTarget(redirect, cwd);
-        if (resolved && relativeWithinRepo(repoRoot, resolved) === null) {
+        addOutsideRepoPath(paths, redirect, cwd, repoRoot);
+    }
+    return [...paths];
+}
+export function collectOutsideRepoPathsFromToolPayload(payload, cwd, repoRoot) {
+    const toolKind = String(payload.tool_name ?? '')
+        .trim()
+        .toLowerCase();
+    const paths = new Set();
+    const filePath = extractToolFilePath(payload);
+    if (filePath) {
+        const resolved = path.isAbsolute(filePath) ? filePath : path.resolve(cwd, filePath);
+        if (relativeWithinRepo(repoRoot, resolved) === null) {
             paths.add(resolved);
         }
+        return [...paths];
+    }
+    if (toolKind === 'apply_patch' || toolKind === 'applypatch') {
+        const patch = extractToolPatch(payload);
+        if (patch) {
+            for (const target of applyPatchTargets(patch)) {
+                const resolved = path.isAbsolute(target) ? target : path.resolve(cwd, target);
+                if (relativeWithinRepo(repoRoot, resolved) === null) {
+                    paths.add(resolved);
+                }
+            }
+        }
     }
     return [...paths];
 }

package/dist/core/capability/reasons.d.ts

@@ -1,2 +1,5 @@
 export declare const FS_SCOPE_REASONS: Set<string>;
+export declare const JUDGE_CLOUD_CONSENT_REASON: "judge_cloud_consent";
+export declare const CAPABILITY_APPROVAL_REASONS: Set<string>;
 export declare function shouldSkipBrokerApprovedOnce(brokerActive: boolean, reason: string): boolean;
+export declare function shouldSkipBrokerApprovedRecord(brokerActive: boolean, approvalReason: string | undefined): boolean;

package/dist/core/capability/reasons.js

@@ -1,4 +1,12 @@
 export const FS_SCOPE_REASONS = new Set(['outside_repo_mutation', 'outside_repo_redirect']);
+export const JUDGE_CLOUD_CONSENT_REASON = 'judge_cloud_consent';
+export const CAPABILITY_APPROVAL_REASONS = new Set([
+    ...FS_SCOPE_REASONS,
+    JUDGE_CLOUD_CONSENT_REASON,
+]);
 export function shouldSkipBrokerApprovedOnce(brokerActive, reason) {
     return brokerActive && FS_SCOPE_REASONS.has(reason);
 }
+export function shouldSkipBrokerApprovedRecord(brokerActive, approvalReason) {
+    return brokerActive && approvalReason !== undefined && FS_SCOPE_REASONS.has(approvalReason);
+}

package/dist/core/classify-tool.js

@@ -3,7 +3,9 @@ import { canonicalStringify, toolFingerprint } from './fingerprint.js';
 import { matchesSensitivePath } from './glob.js';
 import { pathWithinRoot, relativeWithinRepo } from './path-utils.js';
 import { scrubValue } from './scrub.js';
-import { classifyShell } from './verdict/adapter.js';
+import { classifyShell, resolveClassifierTrustedCwd } from './verdict/adapter.js';
+import { mutationPrescanRequiresAsk, tier1RequiresAsk } from './verdict/judge.js';
+import { createJudgeFromConfig } from './verdict/judge-factory.js';
 const DEFAULT_SENSITIVE_PATHS = ['.env', '.env.*', '**/credentials/**'];
 const FILE_WRITE_TOOL_NAMES = new Set(['write']);
 const FILE_EDIT_TOOL_NAMES = new Set([
@@ -74,6 +76,74 @@ function applyPatchTargets(patch) {
 function normalizedToolName(toolName) {
     return toolName.trim().toLowerCase();
 }
+function resolveFileTier1Judge(config, options, repoRoot) {
+    return options.tier1Judge ?? createJudgeFromConfig(config, { repoRoot });
+}
+async function classifyFileMutationWithTier1(params) {
+    const judge = resolveFileTier1Judge(params.config, params.options, params.repoRoot);
+    const trustedCwd = resolveClassifierTrustedCwd(params.cwd, params.options);
+    const prescan = mutationPrescanRequiresAsk({
+        targets: [params.filePath],
+        cwd: params.cwd,
+        repoRoot: params.repoRoot,
+        trustedCwd,
+        sensitivePaths: params.options.sensitivePaths ?? params.config.classifier.sensitivePaths,
+    });
+    if (prescan) {
+        return {
+            verdict: 'deny_pending_approval',
+            reason: 'tier1_catastrophic',
+            summary: params.filePath,
+            fingerprint: toolFingerprint(params.toolName, { path: params.filePath }, params.repoRoot),
+            assessment: {
+                reversibility: 'irreversible',
+                external: params.locationLabel === 'outside_repo',
+                blastRadius: params.locationLabel === 'outside_repo'
+                    ? 'outside the repository'
+                    : 'sensitive repository file',
+                confidence: 0.95,
+                signals: [...params.signals, 'tier1_catastrophic', prescan.reason],
+            },
+        };
+    }
+    const tier1Text = `file_mutation: ${params.toolKind} path=${params.resolvedPath} location=${params.locationLabel}`;
+    const tier1 = await judge.evaluate({
+        text: tier1Text,
+        context: { cwd: params.cwd, repoRoot: params.repoRoot },
+    });
+    const fingerprint = toolFingerprint(params.toolName, { path: params.filePath }, params.repoRoot);
+    if (tier1RequiresAsk(tier1)) {
+        return {
+            verdict: 'deny_pending_approval',
+            reason: 'tier1_catastrophic',
+            summary: params.filePath,
+            fingerprint,
+            assessment: {
+                reversibility: 'irreversible',
+                external: params.locationLabel === 'outside_repo',
+                blastRadius: params.locationLabel === 'outside_repo'
+                    ? 'outside the repository'
+                    : 'sensitive repository file',
+                confidence: 0.82,
+                signals: [...params.signals, 'tier1_catastrophic', tier1.reason],
+            },
+        };
+    }
+    const reason = params.isDelete ? 'file_delete' : 'file_mutation';
+    return {
+        verdict: 'allow_flagged',
+        reason,
+        summary: params.filePath,
+        fingerprint,
+        assessment: {
+            reversibility: 'recoverable_with_cost',
+            external: params.locationLabel === 'outside_repo',
+            blastRadius: params.locationLabel === 'outside_repo' ? 'outside the repository' : 'this repository',
+            confidence: 0.72,
+            signals: [...params.signals, 'tier1_restorable', tier1.reason],
+        },
+    };
+}
 export async function classifyToolUse(payload, repoRoot, cwd, config, options = {}) {
     const toolName = String(payload.tool_name ?? '');
     const toolKind = normalizedToolName(toolName);
@@ -176,35 +246,35 @@ export async function classifyToolUse(payload, repoRoot, cwd, config, options =
         const relativePath = relativeWithinRepo(repoRoot, resolvedPath);
         if (relativePath === null) {
             signals.push('outside_repo_path');
-            return {
-                verdict: 'deny_pending_approval',
-                reason: 'outside_repo_file_mutation',
-                summary: filePath,
-                fingerprint: toolFingerprint(toolName, { path: filePath }, repoRoot),
-                assessment: {
-                    reversibility: 'irreversible',
-                    external: true,
-                    blastRadius: 'outside the repository',
-                    confidence: 0.9,
-                    signals,
-                },
-            };
+            return classifyFileMutationWithTier1({
+                toolName,
+                toolKind,
+                filePath,
+                resolvedPath,
+                repoRoot,
+                cwd,
+                config,
+                options,
+                signals,
+                isDelete: FILE_DELETE_TOOL_NAMES.has(toolKind),
+                locationLabel: 'outside_repo',
+            });
         }
         if (matchesSensitivePath(relativePath, sensitivePaths)) {
             signals.push('sensitive_path');
-            return {
-                verdict: 'deny_pending_approval',
-                reason: 'sensitive_file_mutation',
-                summary: filePath,
-                fingerprint: toolFingerprint(toolName, { path: filePath }, repoRoot),
-                assessment: {
-                    reversibility: 'irreversible',
-                    external: false,
-                    blastRadius: 'sensitive repository file',
-                    confidence: 0.88,
-                    signals,
-                },
-            };
+            return classifyFileMutationWithTier1({
+                toolName,
+                toolKind,
+                filePath,
+                resolvedPath,
+                repoRoot,
+                cwd,
+                config,
+                options,
+                signals,
+                isDelete: FILE_DELETE_TOOL_NAMES.has(toolKind),
+                locationLabel: 'sensitive_path',
+            });
         }
         if (FILE_DELETE_TOOL_NAMES.has(toolKind)) {
             signals.push('file_delete');

package/dist/core/config-layers.js

@@ -1,6 +1,6 @@
 import path from 'node:path';
 import { applyConfigPreset } from '../presets.js';
-import { DEFAULT_CONFIG_V3, mergeConfig } from './config.js';
+import { DEFAULT_CONFIG_V3, mergeConfig, rejectTeamLayerJudgeSecrets } from './config.js';
 export function teamConfigPath(homedir = () => process.env.HOME ?? process.env.USERPROFILE ?? '') {
     const xdg = process.env.XDG_CONFIG_HOME?.trim();
     const base = xdg || path.join(homedir(), '.config');
@@ -40,6 +40,7 @@ export function resolveLayeredConfig(params) {
         const teamRaw = teamFile.preset
             ? applyConfigPreset(teamFile.preset, teamFile.config ?? {})
             : (teamFile.config ?? params.teamConfig);
+        rejectTeamLayerJudgeSecrets(teamRaw.judge, 'team');
         config = mergeConfigLayer(config, asV3Layer(teamRaw));
         provenance.push({
             path: params.teamConfigPath ?? teamConfigPath(),