@guilz-dev/belay 0.3.0 → 0.4.0

package/dist/core/harvest.js

@@ -0,0 +1,276 @@
+import { computeRepeatedFingerprintAsks, isAvailabilityCausedAsk } from './audit-analysis.js';
+import { buildApprovalRoundTrips, filterAuditRecords, inferWouldBlock, isApprovalRecorded, isShellGateRecord, parseTimestamp, } from './audit-query.js';
+import { matchesCustomCommand } from './custom-command-match.js';
+export const HARVEST_REPORT_SCHEMA_VERSION = 1;
+const READ_STYLE_COMMAND_PATTERN = /^\s*(git\s+status|git\s+diff|git\s+log|git\s+show|ls\b|cat\b|head\b|tail\b|find\b|rg\b|grep\b|fd\b|bat\b|less\b|more\b|pwd\b|whoami\b|env\b|printenv\b|npm\s+(test|run\s+test)|pnpm\s+(test|run\s+test)|yarn\s+test)/;
+function shellRecords(records) {
+    return records.filter(isShellGateRecord);
+}
+function availabilitySignal(record) {
+    if (!isAvailabilityCausedAsk(record)) {
+        return null;
+    }
+    if (record.reason === 'missing_trusted_cwd') {
+        return 'missing_trusted_cwd';
+    }
+    const fallback = typeof record.judgeFallbackReason === 'string' ? record.judgeFallbackReason : '';
+    if (fallback.includes('timeout')) {
+        return 'judge_timeout';
+    }
+    return 'judge_fallback';
+}
+function commandFromRecord(record) {
+    return (record.summary ?? '').trim();
+}
+function hasReadStyleSignal(summary) {
+    return READ_STYLE_COMMAND_PATTERN.test(summary);
+}
+function upsertCandidate(map, params) {
+    const existing = map.get(params.fingerprint);
+    if (existing) {
+        if (!existing.sources.includes(params.source)) {
+            existing.sources.push(params.source);
+        }
+        existing.askCount = Math.max(existing.askCount, params.askCount ?? 1);
+        existing.approvedAfterDeny = existing.approvedAfterDeny || Boolean(params.approvedAfterDeny);
+        if (params.command) {
+            existing.command = params.command;
+        }
+        if (params.reason) {
+            existing.reason = params.reason;
+        }
+        return;
+    }
+    map.set(params.fingerprint, {
+        kind: 'shell',
+        command: params.command,
+        fingerprint: params.fingerprint,
+        reason: params.reason,
+        sources: [params.source],
+        askCount: params.askCount ?? 1,
+        approvedAfterDeny: Boolean(params.approvedAfterDeny),
+    });
+}
+export function extractAvailabilityQueue(records) {
+    const grouped = new Map();
+    for (const record of shellRecords(records)) {
+        if (!inferWouldBlock(record) || !record.fingerprint) {
+            continue;
+        }
+        const signal = availabilitySignal(record);
+        if (!signal) {
+            continue;
+        }
+        const fingerprint = record.fingerprint;
+        const existing = grouped.get(fingerprint);
+        if (existing) {
+            existing.askCount += 1;
+            existing.command = commandFromRecord(record) || existing.command;
+            existing.reason = record.reason ?? existing.reason;
+            continue;
+        }
+        grouped.set(fingerprint, {
+            kind: 'shell',
+            command: commandFromRecord(record),
+            fingerprint,
+            reason: record.reason ?? 'unknown',
+            availabilitySignal: signal,
+            ...(typeof record.judgeFallbackReason === 'string'
+                ? { judgeFallbackReason: record.judgeFallbackReason }
+                : {}),
+            askCount: 1,
+        });
+    }
+    return [...grouped.values()].sort((left, right) => right.askCount - left.askCount);
+}
+function recordsForShellRoundTrips(records) {
+    return records.filter((record) => isApprovalRecorded(record) ||
+        (isShellGateRecord(record) && inferWouldBlock(record) && !isAvailabilityCausedAsk(record)));
+}
+/** Pair deny/approval rows split by a time window so round-trip harvest still works. */
+function augmentHarvestRoundTripPairs(scoped, timeFiltered) {
+    if (timeFiltered.length === 0) {
+        return timeFiltered;
+    }
+    const included = new Set(timeFiltered);
+    const augmented = [...timeFiltered];
+    const approvalById = new Map();
+    const denyByApprovalId = new Map();
+    for (const record of scoped) {
+        if (!record.approvalId) {
+            continue;
+        }
+        if (isApprovalRecorded(record)) {
+            approvalById.set(record.approvalId, record);
+        }
+        else if (isShellGateRecord(record) && inferWouldBlock(record)) {
+            denyByApprovalId.set(record.approvalId, record);
+        }
+    }
+    for (const record of timeFiltered) {
+        if (!record.approvalId) {
+            continue;
+        }
+        if (isApprovalRecorded(record)) {
+            const deny = denyByApprovalId.get(record.approvalId);
+            if (deny && !included.has(deny)) {
+                included.add(deny);
+                augmented.push(deny);
+            }
+            continue;
+        }
+        if (isShellGateRecord(record)) {
+            const approval = approvalById.get(record.approvalId);
+            if (approval && !included.has(approval)) {
+                included.add(approval);
+                augmented.push(approval);
+            }
+        }
+    }
+    return augmented.sort((left, right) => {
+        const leftMs = parseTimestamp(left.timestamp) ?? 0;
+        const rightMs = parseTimestamp(right.timestamp) ?? 0;
+        return leftMs - rightMs;
+    });
+}
+/** Shell gate rows plus approval events — matches what `belay harvest list` needs. */
+export function filterRecordsForHarvest(records, options = {}) {
+    const scoped = records.filter((record) => isShellGateRecord(record) || isApprovalRecorded(record));
+    if (!options.since && !options.until) {
+        return scoped;
+    }
+    const timeFiltered = filterAuditRecords(scoped, {
+        since: options.since,
+        until: options.until,
+    });
+    return augmentHarvestRoundTripPairs(scoped, timeFiltered);
+}
+export function extractHarvestCandidates(records, options = {}) {
+    const shellOnly = shellRecords(records);
+    const classifierAsks = shellOnly.filter((record) => inferWouldBlock(record) && !isAvailabilityCausedAsk(record));
+    const map = new Map();
+    // `unknown` covers legacy shell rows missing `kind`.
+    const roundTrips = buildApprovalRoundTrips(recordsForShellRoundTrips(records)).filter((trip) => trip.kind === 'shell' || trip.kind === 'unknown');
+    for (const trip of roundTrips) {
+        if (!trip.fingerprint || !trip.approvalTimestamp) {
+            continue;
+        }
+        upsertCandidate(map, {
+            fingerprint: trip.fingerprint,
+            command: trip.summary,
+            reason: trip.reason,
+            source: 'deny_then_approve',
+            approvedAfterDeny: true,
+        });
+    }
+    for (const entry of computeRepeatedFingerprintAsks(classifierAsks, 2, 50)) {
+        upsertCandidate(map, {
+            fingerprint: entry.fingerprint,
+            command: entry.summary,
+            reason: entry.reason,
+            source: 'repeated_ask',
+            askCount: entry.askCount,
+        });
+    }
+    for (const record of classifierAsks) {
+        if (!record.fingerprint) {
+            continue;
+        }
+        const command = commandFromRecord(record);
+        if (!hasReadStyleSignal(command)) {
+            continue;
+        }
+        upsertCandidate(map, {
+            fingerprint: record.fingerprint,
+            command,
+            reason: record.reason ?? 'unknown',
+            source: 'read_style_signal',
+        });
+    }
+    // Current overrides.allow match on past would-blocks — not a changelog of new additions.
+    const allowPatterns = options.allowPatterns ?? [];
+    for (const record of classifierAsks) {
+        if (!record.fingerprint) {
+            continue;
+        }
+        const command = commandFromRecord(record);
+        if (!command) {
+            continue;
+        }
+        for (const pattern of allowPatterns) {
+            if (matchesCustomCommand(command, command, pattern)) {
+                upsertCandidate(map, {
+                    fingerprint: record.fingerprint,
+                    command,
+                    reason: record.reason ?? 'unknown',
+                    source: 'overrides_allow',
+                });
+                break;
+            }
+        }
+    }
+    return [...map.values()].sort((left, right) => {
+        if (right.askCount !== left.askCount) {
+            return right.askCount - left.askCount;
+        }
+        return left.command.localeCompare(right.command);
+    });
+}
+export function buildHarvestReport(records, options = {}) {
+    return {
+        schemaVersion: HARVEST_REPORT_SCHEMA_VERSION,
+        scope: 'shell',
+        candidates: extractHarvestCandidates(records, options),
+        availabilityQueue: extractAvailabilityQueue(records),
+    };
+}
+export function applyHarvestReview(cases, params) {
+    const command = params.command.trim();
+    if (!command) {
+        return { cases, applied: false, ok: false, message: 'Command must be non-empty.' };
+    }
+    if (params.outcome === 'reject') {
+        return {
+            cases,
+            applied: false,
+            ok: true,
+            message: `Reviewed and rejected candidate ${JSON.stringify(command)}.`,
+        };
+    }
+    const category = params.outcome;
+    const verdict = category === 'provably-benign' ? 'allow' : 'allow_flagged';
+    const reason = params.reason?.trim();
+    const duplicate = cases.find((entry) => entry.command === command);
+    if (duplicate) {
+        if (duplicate.category === category) {
+            return {
+                cases,
+                applied: false,
+                ok: false,
+                message: `Corpus already contains ${JSON.stringify(command)} as ${category}.`,
+            };
+        }
+        return {
+            cases,
+            applied: false,
+            ok: false,
+            message: `Corpus already contains ${JSON.stringify(command)} as ${duplicate.category}; resolve manually.`,
+        };
+    }
+    const nextCase = {
+        kind: 'shell',
+        category,
+        command,
+        verdict,
+        ...(reason ? { reason } : {}),
+    };
+    const followUp = category === 'provably-benign'
+        ? 'Next: run `pnpm corpus` and confirm hard gates pass before `pnpm build` refreshes the standing-allow catalog.'
+        : 'Next: run `pnpm corpus` to verify corpus evaluation (accepted-benign is soft-gated).';
+    return {
+        cases: [...cases, nextCase],
+        applied: true,
+        ok: true,
+        message: `Added ${JSON.stringify(command)} to corpus as ${category}. ${followUp}`,
+    };
+}

package/dist/core/index.d.ts

@@ -1,9 +1,14 @@
-export { APPROVAL_EXECUTION_LEASE_MS, approvalCommandMatch, buildRetryInstruction, compactApprovals, createApprovalRecord, isExecutionLeaseExpired, isExpired, mergeApprovalStates, nowIso, } from './approval.js';
+export { APPROVAL_EXECUTION_LEASE_MS, approvalCommandMatch, compactApprovals, createApprovalRecord, createApprovalRecordWithEnvelope, isExecutionLeaseExpired, isExpired, mergeApprovalStates, nowIso, } from './approval.js';
+export type { ApprovalReplayHint, ReplayActionContext, ReplayAdapterId, } from './approval-replay.js';
+/** @deprecated Use `buildRetryInstructionForConfig` */
+export { approvalFlow, buildApprovalRecordedMessage, buildReplayEnvelopeFields, buildReplayHint, buildRetryInstructionForConfig, buildRetryInstructionForConfig as buildRetryInstruction, canAutoReplay, getExecutionLeaseMs, replayShellCommand, validateReplayEnvelope, } from './approval-replay.js';
+export type { ApprovalStore } from './approval-service.js';
+export { consumeApprovedAfterCliReplay, createGateApprovalStore, gateApprovalStoreFromDeps, recordApproval, } from './approval-service.js';
 export type { AuditMetricsReport } from './audit-metrics.js';
 export { computeAuditMetrics, parseAuditNdjson } from './audit-metrics.js';
 export { classifySubagent } from './classify-subagent.js';
 export { classifyToolUse } from './classify-tool.js';
-export { approvedApprovalsFile, type BelayConfig, type BelayConfigV1, type BelayConfigV2, type BelayConfigV3, type BelayConfigV4, type BelayControlPlaneConfig, type BelayJudgeConfig, type BelayOverridesConfig, type BelayPolicyConfig, type BelayRedactionConfig, belayStateDir, classifierOptionsFromConfig, configuredControlPlaneDir, DEFAULT_CONFIG_V2, DEFAULT_CONFIG_V3, DEFAULT_CONFIG_V4, DEFAULT_JUDGE_CURSOR_COMPOSER, DEFAULT_JUDGE_LOCAL_OLLAMA, defaultControlPlaneDir, isConfigV4, isFreshConfigInput, LEGACY_POLICY_V3, mapLegacyClassifierToOverrides, mergeConfig, migrateConfig, migrateV2ToV3, normalizeConfig, normalizeJudgeConfig, pendingApprovalsFile, resolveControlPlaneDir, scrubOptionsFromConfig, } from './config.js';
+export { type ApprovalFlow, approvedApprovalsFile, type BelayApprovalAutoReplayScopes, type BelayApprovalConfig, type BelayConfig, type BelayConfigV1, type BelayConfigV2, type BelayConfigV3, type BelayConfigV4, type BelayControlPlaneConfig, type BelayJudgeConfig, type BelayOverridesConfig, type BelayPolicyConfig, type BelayRedactionConfig, belayStateDir, classifierOptionsFromConfig, configuredControlPlaneDir, DEFAULT_APPROVAL_CONFIG, DEFAULT_CONFIG_V2, DEFAULT_CONFIG_V3, DEFAULT_CONFIG_V4, DEFAULT_JUDGE_CURSOR_COMPOSER, DEFAULT_JUDGE_LOCAL_OLLAMA, defaultControlPlaneDir, isConfigV4, isFreshConfigInput, LEGACY_POLICY_V3, mapLegacyClassifierToOverrides, mergeConfig, migrateConfig, migrateV2ToV3, normalizeConfig, normalizeJudgeConfig, pendingApprovalsFile, resolveControlPlaneDir, scrubOptionsFromConfig, } from './config.js';
 export { matchesCustomCommand } from './custom-command-match.js';
 export { canonicalStringify, hashValue, shellFingerprint, subagentFingerprint, toolFingerprint, } from './fingerprint.js';
 export type { GatedAction, GatedActionKind, GatePermissionResponse, GateVerdict, } from './gate-contract.js';
@@ -11,9 +16,10 @@ export { classifyResultToGateVerdict, GATE_CONTRACT_VERSION, isGatedAction, unno
 export { classifyGatedAction, GateNormalizationError, gateEnabledForAction, normalizeGatedAction, } from './gate-engine.js';
 export { matchesSensitivePath } from './glob.js';
 export { canonicalPath, hasOutsideRepoPath, normalizeToken, pathWithinRoot, relativeWithinRepo, resolveMutationTarget, } from './path-utils.js';
+export { fingerprintReplayPayload, subagentFingerprintSource } from './replay-scrub.js';
 export { scrubString, scrubValue } from './scrub.js';
 export { findCommandSubstitutions, MAX_SUBSTITUTION_DEPTH } from './shell-substitution.js';
 export type { TransactionalDiffEvaluation, TransactionalExecutionResult, } from './transactional/index.js';
 export { isTransactionalEligible, runTransactionalExecution } from './transactional/index.js';
-export type { ApprovalRecord, ApprovalStateFile, Assessment, ClassifierOptions, ClassifyResult, HookVerdict, Reversibility, ScrubOptions, UnknownLocalEffectPolicy, } from './types.js';
+export type { ApprovalRecord, ApprovalScopeHint, ApprovalStateFile, Assessment, ClassifierOptions, ClassifyResult, HookVerdict, Reversibility, ScrubOptions, UnknownLocalEffectPolicy, } from './types.js';
 export { buildVerdictContext, classifyShell, verdict, verdictToClassifyResult, } from './verdict/index.js';

package/dist/core/index.js

@@ -1,14 +1,18 @@
-export { APPROVAL_EXECUTION_LEASE_MS, approvalCommandMatch, buildRetryInstruction, compactApprovals, createApprovalRecord, isExecutionLeaseExpired, isExpired, mergeApprovalStates, nowIso, } from './approval.js';
+export { APPROVAL_EXECUTION_LEASE_MS, approvalCommandMatch, compactApprovals, createApprovalRecord, createApprovalRecordWithEnvelope, isExecutionLeaseExpired, isExpired, mergeApprovalStates, nowIso, } from './approval.js';
+/** @deprecated Use `buildRetryInstructionForConfig` */
+export { approvalFlow, buildApprovalRecordedMessage, buildReplayEnvelopeFields, buildReplayHint, buildRetryInstructionForConfig, buildRetryInstructionForConfig as buildRetryInstruction, canAutoReplay, getExecutionLeaseMs, replayShellCommand, validateReplayEnvelope, } from './approval-replay.js';
+export { consumeApprovedAfterCliReplay, createGateApprovalStore, gateApprovalStoreFromDeps, recordApproval, } from './approval-service.js';
 export { computeAuditMetrics, parseAuditNdjson } from './audit-metrics.js';
 export { classifySubagent } from './classify-subagent.js';
 export { classifyToolUse } from './classify-tool.js';
-export { approvedApprovalsFile, belayStateDir, classifierOptionsFromConfig, configuredControlPlaneDir, DEFAULT_CONFIG_V2, DEFAULT_CONFIG_V3, DEFAULT_CONFIG_V4, DEFAULT_JUDGE_CURSOR_COMPOSER, DEFAULT_JUDGE_LOCAL_OLLAMA, defaultControlPlaneDir, isConfigV4, isFreshConfigInput, LEGACY_POLICY_V3, mapLegacyClassifierToOverrides, mergeConfig, migrateConfig, migrateV2ToV3, normalizeConfig, normalizeJudgeConfig, pendingApprovalsFile, resolveControlPlaneDir, scrubOptionsFromConfig, } from './config.js';
+export { approvedApprovalsFile, belayStateDir, classifierOptionsFromConfig, configuredControlPlaneDir, DEFAULT_APPROVAL_CONFIG, DEFAULT_CONFIG_V2, DEFAULT_CONFIG_V3, DEFAULT_CONFIG_V4, DEFAULT_JUDGE_CURSOR_COMPOSER, DEFAULT_JUDGE_LOCAL_OLLAMA, defaultControlPlaneDir, isConfigV4, isFreshConfigInput, LEGACY_POLICY_V3, mapLegacyClassifierToOverrides, mergeConfig, migrateConfig, migrateV2ToV3, normalizeConfig, normalizeJudgeConfig, pendingApprovalsFile, resolveControlPlaneDir, scrubOptionsFromConfig, } from './config.js';
 export { matchesCustomCommand } from './custom-command-match.js';
 export { canonicalStringify, hashValue, shellFingerprint, subagentFingerprint, toolFingerprint, } from './fingerprint.js';
 export { classifyResultToGateVerdict, GATE_CONTRACT_VERSION, isGatedAction, unnormalizedGateVerdict, } from './gate-contract.js';
 export { classifyGatedAction, GateNormalizationError, gateEnabledForAction, normalizeGatedAction, } from './gate-engine.js';
 export { matchesSensitivePath } from './glob.js';
 export { canonicalPath, hasOutsideRepoPath, normalizeToken, pathWithinRoot, relativeWithinRepo, resolveMutationTarget, } from './path-utils.js';
+export { fingerprintReplayPayload, subagentFingerprintSource } from './replay-scrub.js';
 export { scrubString, scrubValue } from './scrub.js';
 export { findCommandSubstitutions, MAX_SUBSTITUTION_DEPTH } from './shell-substitution.js';
 export { isTransactionalEligible, runTransactionalExecution } from './transactional/index.js';

package/dist/core/judge-doctor.d.ts

@@ -8,5 +8,8 @@ export interface JudgeDoctorResult {
 }
 export interface DiagnoseJudgeOptions {
     discoveryDeps?: JudgeModelDiscoveryDeps;
+    liveProbe?: boolean;
 }
 export declare function diagnoseJudge(config: BelayConfigV4, repoRoot?: string, options?: DiagnoseJudgeOptions): Promise<JudgeDoctorResult>;
+export declare function stopJudgeSessionBrokers(repoRoot: string, stateDir: string): Promise<number>;
+export declare function stopInProcessJudgeSessionBrokers(repoRoot?: string): number;

package/dist/core/judge-doctor.js

@@ -5,9 +5,13 @@ import { hasValidCloudConsent } from './judge-config.js';
 import { discoverJudgeModels, modelPresenceFromDiscovery, } from './judge-model-discovery.js';
 import { detectJudgeRuntimeCapabilities, resolveJudgeTransport } from './judge-runtime-detection.js';
 import { createOllamaJudge, createOpenAiCompatibleJudge } from './verdict/judge.js';
+import { stopJudgeBrokerDaemon } from './verdict/judge-broker-service.js';
 import { getJudgeProviderCapabilities, getJudgeProviderSpec, isRemovedProviderId, normalizeLegacyProviderId, } from './verdict/judge-catalog.js';
 import { createJudgeFromConfig, resolveJudgeModel } from './verdict/judge-factory.js';
+import { listRepoJudgeSessionBrokers, stopRepoJudgeSessionBroker, } from './verdict/judge-session-broker.js';
+import { clearJudgeSessionKillSwitch } from './verdict/judge-session-kill-switch.js';
 export async function diagnoseJudge(config, repoRoot = process.cwd(), options = {}) {
+    const shouldRunLiveProbe = options.liveProbe === true && !process.env.VITEST && !process.env.VITEST_WORKER_ID;
     const issues = [];
     const warnings = [];
     const notes = [];
@@ -119,6 +123,29 @@ export async function diagnoseJudge(config, repoRoot = process.cwd(), options =
         }
         else {
             notes.push(`Native CLI transport available: ${transport}`);
+            if (shouldRunLiveProbe) {
+                const smokeConfig = {
+                    ...config,
+                    judge: {
+                        ...judge,
+                        timeoutMs: Math.min(judge.timeoutMs, 5000),
+                    },
+                };
+                const smokeJudge = createJudgeFromConfig(smokeConfig, { repoRoot });
+                const smokeResult = await smokeJudge.evaluate({
+                    text: 'git status',
+                    context: { cwd: repoRoot, repoRoot },
+                });
+                const smokeFallback = smokeJudge.lastTrace?.judgeFallbackReason ??
+                    smokeJudge.lastTrace?.fallbackReason ??
+                    smokeResult.reason;
+                if (smokeJudge.lastTrace?.provider === 'fallback') {
+                    issues.push(`Native CLI transport smoke probe failed (${smokeFallback}). Tier1 will fail closed to ask.`);
+                }
+                else {
+                    notes.push('Native CLI transport smoke probe succeeded.');
+                }
+            }
         }
         return { issues, warnings, notes, modelCheck };
     }
@@ -171,5 +198,32 @@ export async function diagnoseJudge(config, repoRoot = process.cwd(), options =
     if (factoryJudge.lastTrace?.transport) {
         notes.push(`Factory transport: ${factoryJudge.lastTrace.transport}`);
     }
+    if (config.judge.runtime?.session.enabled) {
+        notes.push('Judge session transport: enabled');
+        const activeBrokers = listRepoJudgeSessionBrokers();
+        if (activeBrokers.includes(repoRoot)) {
+            notes.push(`Active session broker for repo: ${repoRoot}`);
+        }
+    }
+    else {
+        notes.push('Judge session transport: disabled (default)');
+    }
     return { issues, warnings, notes, modelCheck };
 }
+export async function stopJudgeSessionBrokers(repoRoot, stateDir) {
+    let stopped = 0;
+    stopped += stopRepoJudgeSessionBroker(repoRoot, 'manual_stop');
+    stopped += await stopJudgeBrokerDaemon(stateDir);
+    await clearJudgeSessionKillSwitch(stateDir);
+    return stopped;
+}
+export function stopInProcessJudgeSessionBrokers(repoRoot) {
+    if (repoRoot) {
+        return stopRepoJudgeSessionBroker(repoRoot, 'manual_stop');
+    }
+    let stopped = 0;
+    for (const root of listRepoJudgeSessionBrokers()) {
+        stopped += stopRepoJudgeSessionBroker(root, 'manual_stop');
+    }
+    return stopped;
+}

package/dist/core/path-utils.d.ts

@@ -7,6 +7,17 @@
 export declare function canonicalPath(targetPath: string): string;
 export declare function pathWithinRoot(root: string, targetPath: string): boolean;
 export declare function relativeWithinRepo(repoRoot: string, targetPath: string): string | null;
+export type WorkspaceRootMatch = {
+    kind: 'repo';
+    root: string;
+    relativePath: string;
+} | {
+    kind: 'trusted';
+    root: string;
+    relativePath: string;
+};
+export declare function resolveWorkspaceRootMatch(repoRoot: string, trustedRoots: string[] | undefined, targetPath: string): WorkspaceRootMatch | null;
 export declare function normalizeToken(token: string, repoRoot: string): string;
 export declare function resolveMutationTarget(token: string, cwd: string): string | null;
 export declare function hasOutsideRepoPath(tokens: string[], cwd: string, repoRoot: string): boolean;
+export declare function containingGitRoot(targetPath: string): string | null;

package/dist/core/path-utils.js

@@ -1,5 +1,6 @@
-import { existsSync, realpathSync } from 'node:fs';
+import { existsSync, realpathSync, statSync } from 'node:fs';
 import path from 'node:path';
+import { isFdDuplication, isRedirectOperator } from './shell-tokenizer.js';
 /**
  * Resolve symlinks for the longest existing prefix of `targetPath`, then append
  * any non-existent suffix without further resolution. Keeps path comparisons
@@ -44,18 +45,38 @@ export function pathWithinRoot(root, targetPath) {
     }
     return !relativePath.startsWith('..') && !path.isAbsolute(relativePath);
 }
-export function relativeWithinRepo(repoRoot, targetPath) {
-    const resolvedRoot = canonicalPath(repoRoot);
+function relativeWithinRoot(root, targetPath, options = {}) {
+    const resolvedRoot = options.canonicalizeRoot === false ? path.resolve(root) : canonicalPath(root);
     const resolvedTarget = canonicalPath(targetPath);
     const relativePath = path.relative(resolvedRoot, resolvedTarget);
     if (relativePath === '') {
         return '.';
     }
-    if (relativePath.startsWith('..')) {
+    if (relativePath.startsWith('..') || path.isAbsolute(relativePath)) {
         return null;
     }
     return relativePath;
 }
+export function relativeWithinRepo(repoRoot, targetPath) {
+    return relativeWithinRoot(repoRoot, targetPath);
+}
+export function resolveWorkspaceRootMatch(repoRoot, trustedRoots = [], targetPath) {
+    const canonicalRepoRoot = canonicalPath(repoRoot);
+    const repoRelative = relativeWithinRoot(repoRoot, targetPath);
+    if (repoRelative !== null) {
+        return { kind: 'repo', root: canonicalRepoRoot, relativePath: repoRelative };
+    }
+    const normalizedTrustedRoots = [...new Set(trustedRoots.map((root) => path.resolve(root)))]
+        .filter((root) => root !== canonicalRepoRoot)
+        .sort((left, right) => right.length - left.length);
+    for (const root of normalizedTrustedRoots) {
+        const trustedRelative = relativeWithinRoot(root, targetPath, { canonicalizeRoot: false });
+        if (trustedRelative !== null) {
+            return { kind: 'trusted', root, relativePath: trustedRelative };
+        }
+    }
+    return null;
+}
 export function normalizeToken(token, repoRoot) {
     if (!path.isAbsolute(token)) {
         return token;
@@ -67,7 +88,14 @@ export function resolveMutationTarget(token, cwd) {
     if (!token || token === '--' || token.startsWith('-')) {
         return null;
     }
-    if (token === '2>' || token === '1>' || token === '&>' || token === '1>>' || token === '2>>') {
+    if (isRedirectOperator(token) ||
+        isFdDuplication(token) ||
+        token === '&&' ||
+        token === '||' ||
+        token === '|' ||
+        token === '|&' ||
+        token === ';' ||
+        token === '&') {
         return null;
     }
     if (path.isAbsolute(token)) {
@@ -102,6 +130,28 @@ export function hasOutsideRepoPath(tokens, cwd, repoRoot) {
         if (!resolved) {
             return false;
         }
-        return relativeWithinRepo(repoRoot, resolved) === null;
+        return resolveWorkspaceRootMatch(repoRoot, [], resolved) === null;
     });
 }
+export function containingGitRoot(targetPath) {
+    const resolved = canonicalPath(targetPath);
+    let current = resolved;
+    try {
+        if (!statSync(current).isDirectory()) {
+            current = path.dirname(current);
+        }
+    }
+    catch {
+        current = path.dirname(current);
+    }
+    while (true) {
+        if (existsSync(path.join(current, '.git'))) {
+            return current;
+        }
+        const parent = path.dirname(current);
+        if (parent === current) {
+            return null;
+        }
+        current = parent;
+    }
+}

package/dist/core/reclassify.d.ts

@@ -6,6 +6,8 @@ export interface ReclassifyDiff {
     event?: string;
     summary?: string;
     fingerprint?: string;
+    replayCwd?: string;
+    replayKind?: string;
     previousVerdict: string;
     previousReason: string;
     nextVerdict: string;
@@ -13,3 +15,4 @@ export interface ReclassifyDiff {
 }
 export declare function reclassifyAuditRecord(record: AuditRecord, config: BelayConfigV3, repoRoot: string): Promise<ClassifyResult | null>;
 export declare function diffReclassification(record: AuditRecord, config: BelayConfigV3, repoRoot: string): Promise<ReclassifyDiff | null>;
+export declare function countMissingActionSnapshots(records: AuditRecord[]): number;

package/dist/core/reclassify.js

@@ -1,6 +1,7 @@
 import { getAdapter } from '../adapters/registry.js';
 import { repoShellClassifierOptions } from '../adapters/shared/gate-runtime.js';
 import { detectAdapterName } from '../config-io.js';
+import { hashReplayPayload, parseAuditActionSnapshot, parseAuditReplayContext, } from './audit-replay-context.js';
 import { GATE_EVENTS } from './audit-types.js';
 import { classifyGatedAction, normalizeGatedAction } from './gate-engine.js';
 function shellCommandFromSummary(summary) {
@@ -11,47 +12,68 @@ function classifierOptionsForRepo(config, repoRoot) {
     const adapter = getAdapter(config.adapter ?? detectAdapterName(repoRoot));
     return repoShellClassifierOptions(config, repoRoot, adapter.layout);
 }
+function trustedReplayContext(snapshot, replay) {
+    if (!replay) {
+        return null;
+    }
+    if (snapshot?.payloadHash &&
+        replay.payload &&
+        hashReplayPayload(replay.payload) !== snapshot.payloadHash) {
+        return { ...replay, payload: undefined };
+    }
+    return replay;
+}
 export async function reclassifyAuditRecord(record, config, repoRoot) {
     if (!record.event || !GATE_EVENTS.has(record.event)) {
         return null;
     }
-    const kind = record.kind === 'tool' || record.kind === 'subagent' ? record.kind : 'shell';
+    const snapshot = parseAuditActionSnapshot(record);
+    const replay = trustedReplayContext(snapshot, parseAuditReplayContext(record));
+    const kind = snapshot?.kind ??
+        replay?.kind ??
+        (record.kind === 'tool' || record.kind === 'subagent' ? record.kind : 'shell');
     const summary = record.summary ?? '';
+    const cwd = snapshot?.cwd ?? replay?.cwd ?? repoRoot;
     try {
         if (kind === 'shell') {
-            const command = shellCommandFromSummary(summary);
+            const command = snapshot?.normalizedAction ?? replay?.command ?? shellCommandFromSummary(summary);
             if (!command) {
                 return null;
             }
             const action = normalizeGatedAction({
                 kind: 'shell',
                 repoRoot,
-                cwd: repoRoot,
+                cwd,
                 command,
             });
             return await classifyGatedAction(action, config, classifierOptionsForRepo(config, repoRoot));
         }
         if (kind === 'subagent') {
+            const payload = replay?.payload ??
+                {
+                    tool_name: 'Task',
+                    tool_input: { description: summary },
+                };
             const action = normalizeGatedAction({
                 kind: 'subagent',
                 repoRoot,
-                cwd: repoRoot,
-                payload: {
-                    tool_name: 'Task',
-                    tool_input: { description: summary },
-                },
+                cwd,
+                payload,
             });
             return await classifyGatedAction(action, config, classifierOptionsForRepo(config, repoRoot));
         }
+        const toolName = snapshot?.toolName ?? replay?.toolName ?? 'Shell';
+        const payload = replay?.payload ??
+            {
+                tool_name: toolName,
+                tool_input: { command: snapshot?.normalizedAction ?? replay?.command ?? summary },
+            };
         const action = normalizeGatedAction({
             kind: 'tool',
             repoRoot,
-            cwd: repoRoot,
-            toolName: 'Shell',
-            payload: {
-                tool_name: 'Shell',
-                tool_input: { command: summary },
-            },
+            cwd,
+            toolName,
+            payload,
         });
         return await classifyGatedAction(action, config, classifierOptionsForRepo(config, repoRoot));
     }
@@ -69,14 +91,22 @@ export async function diffReclassification(record, config, repoRoot) {
     if (previousVerdict === next.verdict && previousReason === next.reason) {
         return null;
     }
+    const snapshot = parseAuditActionSnapshot(record);
+    const replay = parseAuditReplayContext(record);
     return {
         timestamp: record.timestamp,
         event: record.event,
         summary: record.summary,
         fingerprint: record.fingerprint,
+        ...(snapshot || replay
+            ? { replayCwd: snapshot?.cwd ?? replay?.cwd, replayKind: snapshot?.kind ?? replay?.kind }
+            : {}),
         previousVerdict,
         previousReason,
         nextVerdict: next.verdict,
         nextReason: next.reason,
     };
 }
+export function countMissingActionSnapshots(records) {
+    return records.filter((record) => record.event && GATE_EVENTS.has(record.event) && !parseAuditActionSnapshot(record)).length;
+}

package/dist/core/replay-scrub.d.ts

@@ -0,0 +1,9 @@
+import type { GatedActionKind } from './gate-contract.js';
+import type { ScrubOptions } from './types.js';
+/** Subagent fingerprint input — must match classify-subagent `fingerprintSource`. */
+export declare function subagentFingerprintSource(payload: Record<string, unknown>, scrubOptions: ScrubOptions): unknown;
+/**
+ * Scrubbed payload used for replay envelope hashing — aligned with classifier fingerprints.
+ * Tool: scrubbed `tool_input`. Subagent: description/prompt subset. Other: full payload.
+ */
+export declare function fingerprintReplayPayload(kind: GatedActionKind, payload: Record<string, unknown> | undefined, scrubOptions: ScrubOptions): Record<string, unknown> | undefined;