@guilz-dev/belay 0.2.0 → 0.4.0

package/dist/core/path-utils.js

@@ -1,5 +1,6 @@
-import { existsSync, realpathSync } from 'node:fs';
+import { existsSync, realpathSync, statSync } from 'node:fs';
 import path from 'node:path';
+import { isFdDuplication, isRedirectOperator } from './shell-tokenizer.js';
 /**
  * Resolve symlinks for the longest existing prefix of `targetPath`, then append
  * any non-existent suffix without further resolution. Keeps path comparisons
@@ -44,18 +45,38 @@ export function pathWithinRoot(root, targetPath) {
     }
     return !relativePath.startsWith('..') && !path.isAbsolute(relativePath);
 }
-export function relativeWithinRepo(repoRoot, targetPath) {
-    const resolvedRoot = canonicalPath(repoRoot);
+function relativeWithinRoot(root, targetPath, options = {}) {
+    const resolvedRoot = options.canonicalizeRoot === false ? path.resolve(root) : canonicalPath(root);
     const resolvedTarget = canonicalPath(targetPath);
     const relativePath = path.relative(resolvedRoot, resolvedTarget);
     if (relativePath === '') {
         return '.';
     }
-    if (relativePath.startsWith('..')) {
+    if (relativePath.startsWith('..') || path.isAbsolute(relativePath)) {
         return null;
     }
     return relativePath;
 }
+export function relativeWithinRepo(repoRoot, targetPath) {
+    return relativeWithinRoot(repoRoot, targetPath);
+}
+export function resolveWorkspaceRootMatch(repoRoot, trustedRoots = [], targetPath) {
+    const canonicalRepoRoot = canonicalPath(repoRoot);
+    const repoRelative = relativeWithinRoot(repoRoot, targetPath);
+    if (repoRelative !== null) {
+        return { kind: 'repo', root: canonicalRepoRoot, relativePath: repoRelative };
+    }
+    const normalizedTrustedRoots = [...new Set(trustedRoots.map((root) => path.resolve(root)))]
+        .filter((root) => root !== canonicalRepoRoot)
+        .sort((left, right) => right.length - left.length);
+    for (const root of normalizedTrustedRoots) {
+        const trustedRelative = relativeWithinRoot(root, targetPath, { canonicalizeRoot: false });
+        if (trustedRelative !== null) {
+            return { kind: 'trusted', root, relativePath: trustedRelative };
+        }
+    }
+    return null;
+}
 export function normalizeToken(token, repoRoot) {
     if (!path.isAbsolute(token)) {
         return token;
@@ -67,7 +88,14 @@ export function resolveMutationTarget(token, cwd) {
     if (!token || token === '--' || token.startsWith('-')) {
         return null;
     }
-    if (token === '2>' || token === '1>' || token === '&>' || token === '1>>' || token === '2>>') {
+    if (isRedirectOperator(token) ||
+        isFdDuplication(token) ||
+        token === '&&' ||
+        token === '||' ||
+        token === '|' ||
+        token === '|&' ||
+        token === ';' ||
+        token === '&') {
         return null;
     }
     if (path.isAbsolute(token)) {
@@ -102,6 +130,28 @@ export function hasOutsideRepoPath(tokens, cwd, repoRoot) {
         if (!resolved) {
             return false;
         }
-        return relativeWithinRepo(repoRoot, resolved) === null;
+        return resolveWorkspaceRootMatch(repoRoot, [], resolved) === null;
     });
 }
+export function containingGitRoot(targetPath) {
+    const resolved = canonicalPath(targetPath);
+    let current = resolved;
+    try {
+        if (!statSync(current).isDirectory()) {
+            current = path.dirname(current);
+        }
+    }
+    catch {
+        current = path.dirname(current);
+    }
+    while (true) {
+        if (existsSync(path.join(current, '.git'))) {
+            return current;
+        }
+        const parent = path.dirname(current);
+        if (parent === current) {
+            return null;
+        }
+        current = parent;
+    }
+}

package/dist/core/reclassify.d.ts

@@ -6,6 +6,8 @@ export interface ReclassifyDiff {
     event?: string;
     summary?: string;
     fingerprint?: string;
+    replayCwd?: string;
+    replayKind?: string;
     previousVerdict: string;
     previousReason: string;
     nextVerdict: string;
@@ -13,3 +15,4 @@ export interface ReclassifyDiff {
 }
 export declare function reclassifyAuditRecord(record: AuditRecord, config: BelayConfigV3, repoRoot: string): Promise<ClassifyResult | null>;
 export declare function diffReclassification(record: AuditRecord, config: BelayConfigV3, repoRoot: string): Promise<ReclassifyDiff | null>;
+export declare function countMissingActionSnapshots(records: AuditRecord[]): number;

package/dist/core/reclassify.js

@@ -1,6 +1,7 @@
 import { getAdapter } from '../adapters/registry.js';
 import { repoShellClassifierOptions } from '../adapters/shared/gate-runtime.js';
 import { detectAdapterName } from '../config-io.js';
+import { hashReplayPayload, parseAuditActionSnapshot, parseAuditReplayContext, } from './audit-replay-context.js';
 import { GATE_EVENTS } from './audit-types.js';
 import { classifyGatedAction, normalizeGatedAction } from './gate-engine.js';
 function shellCommandFromSummary(summary) {
@@ -11,47 +12,68 @@ function classifierOptionsForRepo(config, repoRoot) {
     const adapter = getAdapter(config.adapter ?? detectAdapterName(repoRoot));
     return repoShellClassifierOptions(config, repoRoot, adapter.layout);
 }
+function trustedReplayContext(snapshot, replay) {
+    if (!replay) {
+        return null;
+    }
+    if (snapshot?.payloadHash &&
+        replay.payload &&
+        hashReplayPayload(replay.payload) !== snapshot.payloadHash) {
+        return { ...replay, payload: undefined };
+    }
+    return replay;
+}
 export async function reclassifyAuditRecord(record, config, repoRoot) {
     if (!record.event || !GATE_EVENTS.has(record.event)) {
         return null;
     }
-    const kind = record.kind === 'tool' || record.kind === 'subagent' ? record.kind : 'shell';
+    const snapshot = parseAuditActionSnapshot(record);
+    const replay = trustedReplayContext(snapshot, parseAuditReplayContext(record));
+    const kind = snapshot?.kind ??
+        replay?.kind ??
+        (record.kind === 'tool' || record.kind === 'subagent' ? record.kind : 'shell');
     const summary = record.summary ?? '';
+    const cwd = snapshot?.cwd ?? replay?.cwd ?? repoRoot;
     try {
         if (kind === 'shell') {
-            const command = shellCommandFromSummary(summary);
+            const command = snapshot?.normalizedAction ?? replay?.command ?? shellCommandFromSummary(summary);
             if (!command) {
                 return null;
             }
             const action = normalizeGatedAction({
                 kind: 'shell',
                 repoRoot,
-                cwd: repoRoot,
+                cwd,
                 command,
             });
             return await classifyGatedAction(action, config, classifierOptionsForRepo(config, repoRoot));
         }
         if (kind === 'subagent') {
+            const payload = replay?.payload ??
+                {
+                    tool_name: 'Task',
+                    tool_input: { description: summary },
+                };
             const action = normalizeGatedAction({
                 kind: 'subagent',
                 repoRoot,
-                cwd: repoRoot,
-                payload: {
-                    tool_name: 'Task',
-                    tool_input: { description: summary },
-                },
+                cwd,
+                payload,
             });
             return await classifyGatedAction(action, config, classifierOptionsForRepo(config, repoRoot));
         }
+        const toolName = snapshot?.toolName ?? replay?.toolName ?? 'Shell';
+        const payload = replay?.payload ??
+            {
+                tool_name: toolName,
+                tool_input: { command: snapshot?.normalizedAction ?? replay?.command ?? summary },
+            };
         const action = normalizeGatedAction({
             kind: 'tool',
             repoRoot,
-            cwd: repoRoot,
-            toolName: 'Shell',
-            payload: {
-                tool_name: 'Shell',
-                tool_input: { command: summary },
-            },
+            cwd,
+            toolName,
+            payload,
         });
         return await classifyGatedAction(action, config, classifierOptionsForRepo(config, repoRoot));
     }
@@ -69,14 +91,22 @@ export async function diffReclassification(record, config, repoRoot) {
     if (previousVerdict === next.verdict && previousReason === next.reason) {
         return null;
     }
+    const snapshot = parseAuditActionSnapshot(record);
+    const replay = parseAuditReplayContext(record);
     return {
         timestamp: record.timestamp,
         event: record.event,
         summary: record.summary,
         fingerprint: record.fingerprint,
+        ...(snapshot || replay
+            ? { replayCwd: snapshot?.cwd ?? replay?.cwd, replayKind: snapshot?.kind ?? replay?.kind }
+            : {}),
         previousVerdict,
         previousReason,
         nextVerdict: next.verdict,
         nextReason: next.reason,
     };
 }
+export function countMissingActionSnapshots(records) {
+    return records.filter((record) => record.event && GATE_EVENTS.has(record.event) && !parseAuditActionSnapshot(record)).length;
+}

package/dist/core/replay-scrub.d.ts

@@ -0,0 +1,9 @@
+import type { GatedActionKind } from './gate-contract.js';
+import type { ScrubOptions } from './types.js';
+/** Subagent fingerprint input — must match classify-subagent `fingerprintSource`. */
+export declare function subagentFingerprintSource(payload: Record<string, unknown>, scrubOptions: ScrubOptions): unknown;
+/**
+ * Scrubbed payload used for replay envelope hashing — aligned with classifier fingerprints.
+ * Tool: scrubbed `tool_input`. Subagent: description/prompt subset. Other: full payload.
+ */
+export declare function fingerprintReplayPayload(kind: GatedActionKind, payload: Record<string, unknown> | undefined, scrubOptions: ScrubOptions): Record<string, unknown> | undefined;

package/dist/core/replay-scrub.js

@@ -0,0 +1,43 @@
+import { scrubValue } from './scrub.js';
+/** Subagent fingerprint input — must match classify-subagent `fingerprintSource`. */
+export function subagentFingerprintSource(payload, scrubOptions) {
+    const toolInput = payload.tool_input;
+    if (toolInput && typeof toolInput === 'object') {
+        const input = toolInput;
+        return scrubValue({
+            description: input.description ?? '',
+            prompt: input.prompt ?? '',
+        }, scrubOptions);
+    }
+    const task = payload.task;
+    if (typeof task === 'string') {
+        return scrubValue({ task }, scrubOptions);
+    }
+    if (task && typeof task === 'object') {
+        const taskObj = task;
+        return scrubValue({
+            description: taskObj.description ?? '',
+            prompt: taskObj.prompt ?? '',
+        }, scrubOptions);
+    }
+    return scrubValue(payload, scrubOptions);
+}
+/**
+ * Scrubbed payload used for replay envelope hashing — aligned with classifier fingerprints.
+ * Tool: scrubbed `tool_input`. Subagent: description/prompt subset. Other: full payload.
+ */
+export function fingerprintReplayPayload(kind, payload, scrubOptions) {
+    if (!payload) {
+        return undefined;
+    }
+    if (kind === 'tool') {
+        const toolInput = payload.tool_input;
+        if (toolInput && typeof toolInput === 'object') {
+            return scrubValue(toolInput, scrubOptions);
+        }
+    }
+    if (kind === 'subagent') {
+        return subagentFingerprintSource(payload, scrubOptions);
+    }
+    return scrubValue(payload, scrubOptions);
+}

package/dist/core/shell-tokenizer.d.ts

@@ -1,3 +1,5 @@
+export declare function isRedirectOperator(token: string): boolean;
+export declare function isFdDuplication(token: string): boolean;
 export declare function tokenizeShell(input: string): string[];
 export declare function normalizeShellCommand(command: string, repoRoot: string, normalizeToken: (t: string, r: string) => string): string;
 export declare function splitTopLevelSegments(tokens: string[]): string[][];

package/dist/core/shell-tokenizer.js

@@ -1,4 +1,72 @@
 const ENV_PREFIX_PATTERN = /^[A-Za-z_][A-Za-z0-9_]*=(?:'[^']*'|"[^"]*"|\S+)$/;
+const FD_DUPLICATION_PATTERN = /^\d+[<>]&(?:\d+|-)$/;
+const FD_REDIRECT_PATTERN = /^\d+(?:>>?|<)$/;
+function readDigits(input, index) {
+    let end = index;
+    while (end < input.length && /[0-9]/.test(input[end] ?? '')) {
+        end += 1;
+    }
+    return input.slice(index, end);
+}
+// This tokenizer only recognizes FD redirects when the digit run is immediately
+// followed by `>` or `<` (for example `2>&1`, `3>file`, `12>>log`, `3<file`,
+// `3<&1`). It does not try to recover bash's full word-boundary rules for cases
+// like `foo12>>bar` or `foo12<bar`.
+function readShellOperator(input, index) {
+    const char = input[index];
+    const next = input[index + 1] ?? '';
+    const digits = /[0-9]/.test(char) ? readDigits(input, index) : '';
+    const digitsLength = digits.length;
+    const afterDigits = digitsLength > 0 ? (input[index + digitsLength] ?? '') : '';
+    const afterDigitsNext = digitsLength > 0 ? (input[index + digitsLength + 1] ?? '') : '';
+    if (char === '&' && next === '&') {
+        return { token: '&&', length: 2 };
+    }
+    if (char === '|' && next === '|') {
+        return { token: '||', length: 2 };
+    }
+    if (char === '|' && next === '&') {
+        return { token: '|&', length: 2 };
+    }
+    if (char === '&' && next === '>') {
+        return { token: '&>', length: 2 };
+    }
+    if (digitsLength > 0 && (afterDigits === '>' || afterDigits === '<')) {
+        if (afterDigitsNext === '&') {
+            let end = index + digitsLength + 2;
+            while (end < input.length && /[0-9-]/.test(input[end] ?? '')) {
+                end += 1;
+            }
+            if (end > index + digitsLength + 2) {
+                return { token: input.slice(index, end), length: end - index };
+            }
+        }
+        if (afterDigits === '>' && afterDigitsNext === '>') {
+            return { token: `${digits}>>`, length: digitsLength + 2 };
+        }
+        return { token: `${digits}${afterDigits}`, length: digitsLength + 1 };
+    }
+    if (char === '>' && next === '>') {
+        return { token: '>>', length: 2 };
+    }
+    if (char === '&') {
+        return { token: '&', length: 1 };
+    }
+    if (char === '|' || char === ';' || char === '>' || char === '<') {
+        return { token: char, length: 1 };
+    }
+    return null;
+}
+export function isRedirectOperator(token) {
+    return (token === '>' ||
+        token === '>>' ||
+        token === '<' ||
+        token === '&>' ||
+        FD_REDIRECT_PATTERN.test(token));
+}
+export function isFdDuplication(token) {
+    return FD_DUPLICATION_PATTERN.test(token);
+}
 export function tokenizeShell(input) {
     const tokens = [];
     let buffer = '';
@@ -12,7 +80,6 @@ export function tokenizeShell(input) {
     };
     for (let index = 0; index < input.length; index += 1) {
         const char = input[index];
-        const next = input[index + 1] ?? '';
         if (escaping) {
             buffer += char;
             escaping = false;
@@ -35,27 +102,11 @@ export function tokenizeShell(input) {
             quote = char;
             continue;
         }
-        if (char === '&' && next === '&') {
-            flush();
-            tokens.push('&&');
-            index += 1;
-            continue;
-        }
-        if (char === '|' && next === '|') {
-            flush();
-            tokens.push('||');
-            index += 1;
-            continue;
-        }
-        if (char === '>' && next === '>') {
+        const operator = readShellOperator(input, index);
+        if (operator) {
             flush();
-            tokens.push('>>');
-            index += 1;
-            continue;
-        }
-        if (char === '|' || char === ';' || char === '>' || char === '<') {
-            flush();
-            tokens.push(char);
+            tokens.push(operator.token);
+            index += operator.length - 1;
             continue;
         }
         if (char === '\n' || char === '\r') {
@@ -84,7 +135,12 @@ export function splitTopLevelSegments(tokens) {
     const segments = [];
     let current = [];
     for (const token of tokens) {
-        if (token === '&&' || token === '||' || token === ';' || token === '|') {
+        if (token === '&&' ||
+            token === '||' ||
+            token === ';' ||
+            token === '|' ||
+            token === '&' ||
+            token === '|&') {
             if (current.length > 0) {
                 segments.push(current);
             }
@@ -118,7 +174,10 @@ export function extractRedirectTargets(tokens) {
     const targets = [];
     for (let index = 0; index < tokens.length; index += 1) {
         const token = tokens[index];
-        if (token === '>' || token === '>>' || token === '<') {
+        if (isFdDuplication(token)) {
+            continue;
+        }
+        if (isRedirectOperator(token)) {
             const next = tokens[index + 1];
             if (next) {
                 targets.push(next);

package/dist/core/standing-allow.d.ts

@@ -0,0 +1,50 @@
+import type { BelayConfigV4 } from './config.js';
+import type { GatedActionKind } from './gate-contract.js';
+import type { ClassifyResult } from './types.js';
+export type StandingAllowSource = 'provably-benign-corpus' | 'must-allow-catalog' | 'operator' | 'availability-reconfirmed';
+export interface StandingAllowEntry {
+    kind: GatedActionKind;
+    fingerprint: string;
+    source: StandingAllowSource;
+    reason: string;
+    summary?: string;
+    createdAt: string;
+    expiresAt: string;
+    repoRoot?: string;
+}
+export interface StandingAllowFile {
+    version: 1;
+    entries: StandingAllowEntry[];
+}
+export interface StandingAllowMatch {
+    source: StandingAllowSource;
+    catalogCommand?: string;
+    entryId?: string;
+}
+/** Default TTL for operator / availability-reconfirmed standing-allow entries. */
+export declare const DEFAULT_STANDING_ALLOW_TTL_MS: number;
+export declare function standingAllowFile(config: BelayConfigV4, repoLocalStateDir: string): string;
+export declare function isTier0StandingAllowBlocked(result: ClassifyResult): boolean;
+export declare function compactStandingAllow(state: StandingAllowFile, now?: number): StandingAllowFile;
+export declare function loadStandingAllow(filePath: string): Promise<StandingAllowFile>;
+export declare function saveStandingAllow(filePath: string, state: StandingAllowFile): Promise<void>;
+export declare function resolveStandingAllowMatch(params: {
+    kind: GatedActionKind;
+    result: ClassifyResult;
+    repoRoot: string;
+    state: StandingAllowFile;
+    now?: number;
+}): StandingAllowMatch | null;
+export declare function addStandingAllowEntry(state: StandingAllowFile, entry: Omit<StandingAllowEntry, 'createdAt' | 'expiresAt'> & {
+    createdAt?: string;
+    expiresAt?: string;
+    ttlMs?: number;
+}): StandingAllowFile;
+export declare function revokeStandingAllowEntry(state: StandingAllowFile, params: {
+    kind: GatedActionKind;
+    fingerprint: string;
+    repoRoot?: string;
+}): {
+    state: StandingAllowFile;
+    removed: boolean;
+};

package/dist/core/standing-allow.js

@@ -0,0 +1,175 @@
+import { existsSync } from 'node:fs';
+import { mkdir, readFile, writeFile } from 'node:fs/promises';
+import path from 'node:path';
+import { STANDING_ALLOW_CATALOG } from '../corpus/standing-allow-catalog.generated.js';
+import { belayStateDir } from './config.js';
+const EMPTY_STANDING_ALLOW = {
+    version: 1,
+    entries: [],
+};
+/** Default TTL for operator / availability-reconfirmed standing-allow entries. */
+export const DEFAULT_STANDING_ALLOW_TTL_MS = 30 * 24 * 60 * 60 * 1000;
+const PROVABLY_BENIGN_COMMANDS = new Set(STANDING_ALLOW_CATALOG.shell.provablyBenign.map((entry) => entry.normalizedCommand));
+const MUST_ALLOW_COMMANDS = new Set(STANDING_ALLOW_CATALOG.shell.mustAllow.map((entry) => entry.normalizedCommand));
+/** Reasons that must never be silenced via standing-allow (defense in depth with signal checks). */
+const STANDING_ALLOW_BLOCKED_REASONS = new Set([
+    'external_effect',
+    'tier1_catastrophic',
+    'protected_artifact',
+    'pipe_to_shell',
+    'command_substitution',
+]);
+export function standingAllowFile(config, repoLocalStateDir) {
+    return `${belayStateDir(config, repoLocalStateDir)}/standing-allow.json`;
+}
+export function isTier0StandingAllowBlocked(result) {
+    if (result.reason.startsWith('tier0_') || STANDING_ALLOW_BLOCKED_REASONS.has(result.reason)) {
+        return true;
+    }
+    const signals = result.assessment?.signals ?? [];
+    return signals.some((signal) => signal === 'tier0_external' || signal === 'tier1_catastrophic');
+}
+function isExpired(iso, now = Date.now()) {
+    const parsed = Date.parse(iso);
+    return Number.isNaN(parsed) || parsed <= now;
+}
+export function compactStandingAllow(state, now = Date.now()) {
+    return {
+        version: 1,
+        entries: state.entries.filter((entry) => !isExpired(entry.expiresAt, now)),
+    };
+}
+function sanitizeStandingAllowEntries(input) {
+    if (!Array.isArray(input)) {
+        return [];
+    }
+    return input.flatMap((entry) => {
+        if (!entry || typeof entry !== 'object') {
+            return [];
+        }
+        const record = entry;
+        if ((record.kind !== 'shell' && record.kind !== 'tool' && record.kind !== 'subagent') ||
+            typeof record.fingerprint !== 'string' ||
+            !record.fingerprint.trim() ||
+            typeof record.expiresAt !== 'string' ||
+            typeof record.createdAt !== 'string' ||
+            typeof record.reason !== 'string') {
+            return [];
+        }
+        const source = record.source;
+        if (source !== 'operator' && source !== 'availability-reconfirmed') {
+            return [];
+        }
+        return [
+            {
+                kind: record.kind,
+                fingerprint: record.fingerprint,
+                source,
+                reason: record.reason,
+                createdAt: record.createdAt,
+                expiresAt: record.expiresAt,
+                ...(typeof record.summary === 'string' ? { summary: record.summary } : {}),
+                ...(typeof record.repoRoot === 'string' ? { repoRoot: record.repoRoot } : {}),
+            },
+        ];
+    });
+}
+export async function loadStandingAllow(filePath) {
+    if (!existsSync(filePath)) {
+        return { ...EMPTY_STANDING_ALLOW };
+    }
+    const raw = JSON.parse(await readFile(filePath, 'utf8'));
+    const rawCount = Array.isArray(raw.entries) ? raw.entries.length : 0;
+    const entries = sanitizeStandingAllowEntries(raw.entries);
+    const compacted = compactStandingAllow({ version: 1, entries });
+    if (rawCount !== compacted.entries.length || entries.length !== compacted.entries.length) {
+        await saveStandingAllow(filePath, compacted);
+    }
+    return compacted;
+}
+export async function saveStandingAllow(filePath, state) {
+    await mkdir(path.dirname(filePath), { recursive: true });
+    const compacted = compactStandingAllow(state);
+    await writeFile(filePath, `${JSON.stringify(compacted, null, 2)}\n`, 'utf8');
+}
+function matchBundledCatalog(kind, normalizedCommand) {
+    if (kind !== 'shell' || !normalizedCommand) {
+        return null;
+    }
+    if (PROVABLY_BENIGN_COMMANDS.has(normalizedCommand)) {
+        return { source: 'provably-benign-corpus', catalogCommand: normalizedCommand };
+    }
+    if (MUST_ALLOW_COMMANDS.has(normalizedCommand)) {
+        return { source: 'must-allow-catalog', catalogCommand: normalizedCommand };
+    }
+    return null;
+}
+function matchStateEntry(params) {
+    const now = params.now ?? Date.now();
+    const match = params.state.entries.find((entry) => entry.kind === params.kind &&
+        entry.fingerprint === params.fingerprint &&
+        !isExpired(entry.expiresAt, now) &&
+        (entry.repoRoot === undefined || entry.repoRoot === params.repoRoot));
+    if (!match) {
+        return null;
+    }
+    return { source: match.source, entryId: match.fingerprint };
+}
+export function resolveStandingAllowMatch(params) {
+    if (params.result.verdict !== 'deny_pending_approval') {
+        return null;
+    }
+    if (isTier0StandingAllowBlocked(params.result)) {
+        return null;
+    }
+    const normalizedCommand = params.result.normalizedCommand ?? params.result.summary ?? '';
+    const catalogMatch = matchBundledCatalog(params.kind, normalizedCommand);
+    if (catalogMatch) {
+        return catalogMatch;
+    }
+    return matchStateEntry({
+        kind: params.kind,
+        fingerprint: params.result.fingerprint,
+        repoRoot: params.repoRoot,
+        state: params.state,
+        now: params.now,
+    });
+}
+export function addStandingAllowEntry(state, entry) {
+    const createdAt = entry.createdAt ?? new Date().toISOString();
+    const ttlMs = entry.ttlMs ?? DEFAULT_STANDING_ALLOW_TTL_MS;
+    const expiresAt = entry.expiresAt ?? new Date(Date.parse(createdAt) + ttlMs).toISOString();
+    const next = {
+        kind: entry.kind,
+        fingerprint: entry.fingerprint,
+        source: entry.source,
+        reason: entry.reason,
+        createdAt,
+        expiresAt,
+        ...(entry.summary ? { summary: entry.summary } : {}),
+        ...(entry.repoRoot ? { repoRoot: entry.repoRoot } : {}),
+    };
+    const filtered = state.entries.filter((existing) => !(existing.kind === next.kind &&
+        existing.fingerprint === next.fingerprint &&
+        existing.repoRoot === next.repoRoot));
+    return compactStandingAllow({
+        version: 1,
+        entries: [...filtered, next],
+    });
+}
+export function revokeStandingAllowEntry(state, params) {
+    const before = state.entries.length;
+    const entries = state.entries.filter((entry) => {
+        if (entry.kind !== params.kind || entry.fingerprint !== params.fingerprint) {
+            return true;
+        }
+        if (params.repoRoot && entry.repoRoot && entry.repoRoot !== params.repoRoot) {
+            return true;
+        }
+        return false;
+    });
+    return {
+        state: { version: 1, entries },
+        removed: entries.length < before,
+    };
+}

package/dist/core/transactional/diff-evaluator.js

@@ -24,21 +24,6 @@ function observedAssessment(evaluation) {
     if (evaluation.deletedCount > 0) {
         signals.push('observed_deletions');
     }
-    if (evaluation.categories.includes('repo_outside') ||
-        evaluation.categories.includes('control_plane') ||
-        evaluation.categories.includes('sensitive_path')) {
-        return {
-            reversibility: 'irreversible',
-            external: evaluation.categories.includes('repo_outside'),
-            blastRadius: evaluation.categories.includes('control_plane')
-                ? 'agent-belay control plane'
-                : evaluation.categories.includes('repo_outside')
-                    ? 'outside the repository'
-                    : 'sensitive path',
-            confidence: 1,
-            signals,
-        };
-    }
     if (evaluation.categories.includes('large_deletion')) {
         return {
             reversibility: 'irreversible',
@@ -66,10 +51,7 @@ export function evaluateTransactionalDiff(changes, ctx) {
         categories.add('large_deletion');
     }
     const categoryList = [...categories];
-    const dangerous = categoryList.includes('repo_outside') ||
-        categoryList.includes('control_plane') ||
-        categoryList.includes('sensitive_path') ||
-        categoryList.includes('large_deletion');
+    const dangerous = categoryList.includes('large_deletion');
     const base = {
         categories: categoryList,
         changes,