@guilz-dev/belay 0.3.0 → 0.4.0

package/dist/bundle/claude-runtime.mjs

@@ -196,6 +196,115 @@ function isCloudProviderId(providerId) {
   return JUDGE_CATALOG[normalized].isCloud;
 }
 
+// src/core/verdict/judge-runtime-config.ts
+var DEFAULT_JUDGE_SESSION_CONFIG = {
+  enabled: false,
+  maxTurns: 32,
+  maxAgeMs: 30 * 60 * 1e3,
+  maxIdleMs: 5 * 60 * 1e3,
+  maxPromptBytes: 64 * 1024,
+  providerAllowlist: ["cursor"],
+  connectTimeoutMs: 5e3,
+  evalTimeoutMs: null,
+  parseTimeoutMs: 2e3,
+  maxSessionsPerProvider: 1
+};
+var DEFAULT_JUDGE_SHADOW_CONFIG = {
+  enabled: false,
+  sampleRate: 0.01,
+  sampleRateMax: 0.05,
+  dailyRequestCap: 500,
+  mismatchRateThreshold: 0.02,
+  providerAllowlist: ["cursor"],
+  windowSize: 100
+};
+var DEFAULT_JUDGE_RUNTIME_CONFIG = {
+  session: { ...DEFAULT_JUDGE_SESSION_CONFIG },
+  shadow: { ...DEFAULT_JUDGE_SHADOW_CONFIG }
+};
+var CLI_PROVIDER_IDS = ["codex", "cursor", "claude"];
+function normalizeProviderAllowlist(value, fallback) {
+  if (!Array.isArray(value)) {
+    return [...fallback];
+  }
+  const allowed = value.map((entry) => String(entry).trim()).filter(
+    (entry) => CLI_PROVIDER_IDS.includes(entry)
+  );
+  return allowed.length > 0 ? [...new Set(allowed)] : [...fallback];
+}
+function normalizePositiveInt(value, fallback) {
+  return typeof value === "number" && Number.isFinite(value) && value > 0 ? Math.floor(value) : fallback;
+}
+function normalizeRate(value, fallback, max) {
+  if (typeof value !== "number" || !Number.isFinite(value) || value < 0) {
+    return fallback;
+  }
+  return Math.min(value, max);
+}
+function normalizeJudgeRuntimeConfig(runtime) {
+  const session = runtime?.session ?? {};
+  const shadow = runtime?.shadow ?? {};
+  return {
+    session: normalizeJudgeSessionConfig(session),
+    shadow: {
+      enabled: shadow.enabled === true,
+      sampleRate: normalizeRate(shadow.sampleRate, DEFAULT_JUDGE_SHADOW_CONFIG.sampleRate, 1),
+      sampleRateMax: normalizeRate(
+        shadow.sampleRateMax,
+        DEFAULT_JUDGE_SHADOW_CONFIG.sampleRateMax,
+        1
+      ),
+      dailyRequestCap: normalizePositiveInt(
+        shadow.dailyRequestCap,
+        DEFAULT_JUDGE_SHADOW_CONFIG.dailyRequestCap
+      ),
+      mismatchRateThreshold: normalizeRate(
+        shadow.mismatchRateThreshold,
+        DEFAULT_JUDGE_SHADOW_CONFIG.mismatchRateThreshold,
+        1
+      ),
+      providerAllowlist: normalizeProviderAllowlist(
+        shadow.providerAllowlist,
+        DEFAULT_JUDGE_SHADOW_CONFIG.providerAllowlist
+      ),
+      windowSize: normalizePositiveInt(shadow.windowSize, DEFAULT_JUDGE_SHADOW_CONFIG.windowSize)
+    }
+  };
+}
+function normalizeJudgeSessionConfig(session) {
+  const input = session ?? {};
+  return {
+    enabled: input.enabled === true,
+    maxTurns: normalizePositiveInt(input.maxTurns, DEFAULT_JUDGE_SESSION_CONFIG.maxTurns),
+    maxAgeMs: normalizePositiveInt(input.maxAgeMs, DEFAULT_JUDGE_SESSION_CONFIG.maxAgeMs),
+    maxIdleMs: normalizePositiveInt(input.maxIdleMs, DEFAULT_JUDGE_SESSION_CONFIG.maxIdleMs),
+    maxPromptBytes: normalizePositiveInt(
+      input.maxPromptBytes,
+      DEFAULT_JUDGE_SESSION_CONFIG.maxPromptBytes
+    ),
+    providerAllowlist: normalizeProviderAllowlist(
+      input.providerAllowlist,
+      DEFAULT_JUDGE_SESSION_CONFIG.providerAllowlist
+    ),
+    connectTimeoutMs: normalizePositiveInt(
+      input.connectTimeoutMs,
+      DEFAULT_JUDGE_SESSION_CONFIG.connectTimeoutMs
+    ),
+    evalTimeoutMs: typeof input.evalTimeoutMs === "number" && input.evalTimeoutMs > 0 ? Math.floor(input.evalTimeoutMs) : null,
+    parseTimeoutMs: normalizePositiveInt(
+      input.parseTimeoutMs,
+      DEFAULT_JUDGE_SESSION_CONFIG.parseTimeoutMs
+    ),
+    maxSessionsPerProvider: normalizePositiveInt(
+      input.maxSessionsPerProvider,
+      DEFAULT_JUDGE_SESSION_CONFIG.maxSessionsPerProvider
+    )
+  };
+}
+function resolveSessionEvalTimeoutMs(sessionConfig, judgeTimeoutMs) {
+  return sessionConfig.evalTimeoutMs ?? judgeTimeoutMs;
+}
+
 // src/core/audit-summary.ts
 var DEFAULT_SILENT_PASS_THRESHOLD = 0.5;
 
@@ -288,6 +397,15 @@ var DEFAULT_NOTIFICATIONS_V3 = {};
 var DEFAULT_APPROVAL_SIGNING_V3 = {
   required: false
 };
+var DEFAULT_APPROVAL_CONFIG = {
+  flow: "one_step",
+  autoReplayScopes: {
+    shell: true,
+    tool: false,
+    subagent: false
+  },
+  executionLeaseMs: 6e4
+};
 var DEFAULT_EGRESS_V3 = {
   enabled: false,
   listenHost: "127.0.0.1",
@@ -341,6 +459,7 @@ var DEFAULT_CONFIG_V4 = {
   controlPlane: { ...DEFAULT_CONTROL_PLANE_V3 },
   notifications: { ...DEFAULT_NOTIFICATIONS_V3 },
   approvalSigning: { ...DEFAULT_APPROVAL_SIGNING_V3 },
+  approval: { ...DEFAULT_APPROVAL_CONFIG },
   egress: { ...DEFAULT_EGRESS_V3 },
   sandbox: { ...DEFAULT_SANDBOX_V3 },
   audit: { ...DEFAULT_CONFIG_V2.audit },
@@ -380,6 +499,7 @@ function migrateV2ToV3(v2, rawOverrides) {
     controlPlane: { ...LEGACY_CONTROL_PLANE_V3 },
     notifications: { ...DEFAULT_NOTIFICATIONS_V3 },
     approvalSigning: { ...DEFAULT_APPROVAL_SIGNING_V3 },
+    approval: { ...DEFAULT_APPROVAL_CONFIG },
     egress: { ...DEFAULT_EGRESS_V3 },
     sandbox: { ...DEFAULT_SANDBOX_V3 },
     audit: v2.audit,
@@ -448,7 +568,8 @@ function normalizeJudgeConfig(judge) {
       endpoint: endpoint2,
       keepAlive: provider === "ollama" && typeof judge.keepAlive === "string" && judge.keepAlive.trim() ? judge.keepAlive.trim() : provider === "ollama" ? DEFAULT_JUDGE_LOCAL_OLLAMA.keepAlive : null,
       ...judge.cloudConsent ? { cloudConsent: judge.cloudConsent } : {},
-      ...judge.credential ? { credential: judge.credential } : {}
+      ...judge.credential ? { credential: judge.credential } : {},
+      runtime: normalizeJudgeRuntimeConfig(judge.runtime)
     };
   }
   let providerId = rawProviderId && normalizeLegacyProviderId(rawProviderId) ? normalizeLegacyProviderId(rawProviderId) : inferProviderIdFromConfig({ ...judge, provider });
@@ -493,6 +614,7 @@ function normalizeJudgeConfig(judge) {
       ...judge.credential.ref ? { ref: judge.credential.ref } : {}
     };
   }
+  normalized.runtime = normalizeJudgeRuntimeConfig(judge.runtime);
   return normalized;
 }
 function rejectTeamLayerJudgeSecrets(judge, source) {
@@ -541,6 +663,14 @@ function mergeV3FromRaw(base, raw) {
       ...base.approvalSigning,
       ...raw.approvalSigning ?? {}
     },
+    approval: {
+      ...base.approval,
+      ...raw.approval ?? {},
+      autoReplayScopes: {
+        ...base.approval.autoReplayScopes,
+        ...raw.approval?.autoReplayScopes ?? {}
+      }
+    },
     egress: {
       ...base.egress,
       ...raw.egress ?? {}
@@ -592,6 +722,14 @@ function normalizeV3Raw(raw) {
     approvalSigning: {
       required: raw.approvalSigning?.required === true
     },
+    approval: {
+      ...DEFAULT_APPROVAL_CONFIG,
+      ...raw.approval ?? {},
+      autoReplayScopes: {
+        ...DEFAULT_APPROVAL_CONFIG.autoReplayScopes,
+        ...raw.approval?.autoReplayScopes ?? {}
+      }
+    },
     egress: {
       ...DEFAULT_EGRESS_V3,
       ...raw.egress ?? {}
@@ -761,6 +899,15 @@ function normalizeConfig(config) {
     approvalSigning: {
       required: v4.approvalSigning?.required === true
     },
+    approval: {
+      flow: v4.approval?.flow === "two_step" ? "two_step" : DEFAULT_APPROVAL_CONFIG.flow,
+      autoReplayScopes: {
+        shell: v4.approval?.autoReplayScopes?.shell !== false,
+        tool: v4.approval?.autoReplayScopes?.tool === true,
+        subagent: v4.approval?.autoReplayScopes?.subagent === true
+      },
+      executionLeaseMs: typeof v4.approval?.executionLeaseMs === "number" && v4.approval.executionLeaseMs > 0 ? v4.approval.executionLeaseMs : DEFAULT_APPROVAL_CONFIG.executionLeaseMs
+    },
     egress: {
       enabled: v4.egress?.enabled === true,
       listenHost: normalizeEgressListenHost(
@@ -828,6 +975,14 @@ function mergeConfig(existing, defaults = DEFAULT_CONFIG_V4) {
       ...defaults.approvalSigning,
       ...migrated.approvalSigning
     },
+    approval: {
+      ...defaults.approval,
+      ...migrated.approval,
+      autoReplayScopes: {
+        ...defaults.approval.autoReplayScopes,
+        ...migrated.approval.autoReplayScopes
+      }
+    },
     egress: {
       ...defaults.egress,
       ...migrated.egress
@@ -945,12 +1100,216 @@ var claudeLayout = {
 
 // src/adapters/shared/gate-runtime.ts
 import { randomUUID as randomUUID2 } from "node:crypto";
-import { existsSync as existsSync6 } from "node:fs";
-import { mkdir as mkdir4, readFile as readFile3, writeFile as writeFile3 } from "node:fs/promises";
-import path20 from "node:path";
+import { existsSync as existsSync10 } from "node:fs";
+import { mkdir as mkdir6, readFile as readFile5, writeFile as writeFile5 } from "node:fs/promises";
+import path26 from "node:path";
+
+// src/core/approval-replay.ts
+import path5 from "node:path";
+
+// src/core/fingerprint.ts
+import { createHash } from "node:crypto";
+function canonicalStringify(value) {
+  if (value === null || typeof value !== "object") {
+    return JSON.stringify(value);
+  }
+  if (Array.isArray(value)) {
+    return `[${value.map((item) => canonicalStringify(item)).join(",")}]`;
+  }
+  const entries = Object.entries(value).sort(
+    ([left], [right]) => left.localeCompare(right)
+  );
+  return `{${entries.map(([key, child]) => `${JSON.stringify(key)}:${canonicalStringify(child)}`).join(",")}}`;
+}
+function hashValue(value) {
+  return createHash("sha256").update(value).digest("hex");
+}
+function subagentFingerprint(kind, scrubbed, repoRoot) {
+  return hashValue(`subagent:${kind}:${canonicalStringify(scrubbed)}:${repoRoot}`);
+}
+function toolFingerprint(toolName, scrubbed, repoRoot) {
+  return hashValue(`tool:${toolName}:${canonicalStringify(scrubbed)}:${repoRoot}`);
+}
+
+// src/core/approval-replay-cli.ts
+import { spawn } from "node:child_process";
+import path4 from "node:path";
+var DEFAULT_CLI_REPLAY_TIMEOUT_MS = 3e5;
+async function replayShellCommand(command, cwd, timeoutMs = DEFAULT_CLI_REPLAY_TIMEOUT_MS) {
+  const resolvedCwd = path4.resolve(cwd);
+  return new Promise((resolve, reject) => {
+    const child = spawn(command, {
+      cwd: resolvedCwd,
+      shell: true,
+      stdio: ["ignore", "pipe", "pipe"],
+      env: { ...process.env }
+    });
+    const stdout = [];
+    const stderr = [];
+    let timedOut = false;
+    const timer = setTimeout(() => {
+      timedOut = true;
+      child.kill("SIGTERM");
+    }, timeoutMs);
+    child.stdout?.on("data", (chunk) => stdout.push(Buffer.from(chunk)));
+    child.stderr?.on("data", (chunk) => stderr.push(Buffer.from(chunk)));
+    child.on("error", (error) => {
+      clearTimeout(timer);
+      reject(error);
+    });
+    child.on("close", (code) => {
+      clearTimeout(timer);
+      resolve({
+        exitCode: timedOut ? 124 : code ?? 1,
+        stdout: Buffer.concat(stdout).toString("utf8"),
+        stderr: Buffer.concat(stderr).toString("utf8"),
+        ...timedOut ? { timedOut: true } : {}
+      });
+    });
+  });
+}
+
+// src/core/approval-replay.ts
+var MAX_PAYLOAD_JSON_BYTES = 16384;
+function replayPayloadHash(kind, payload, repoRoot) {
+  if (!payload || Object.keys(payload).length === 0) {
+    return void 0;
+  }
+  const json = canonicalStringify(payload);
+  return hashValue(`payload:${kind}:${json}:${repoRoot}`);
+}
+var DEFAULT_REPLAY_CAPABILITIES = {
+  shell: true,
+  tool: false,
+  subagent: false
+};
+var ADAPTER_REPLAY_CAPABLE = {
+  cursor: { ...DEFAULT_REPLAY_CAPABILITIES },
+  claude: { ...DEFAULT_REPLAY_CAPABILITIES },
+  codex: { ...DEFAULT_REPLAY_CAPABILITIES }
+};
+function getExecutionLeaseMs(config) {
+  const ms = config.approval?.executionLeaseMs;
+  return typeof ms === "number" && ms > 0 ? ms : 6e4;
+}
+function approvalFlow(config) {
+  return config.approval?.flow === "two_step" ? "two_step" : "one_step";
+}
+function buildReplayEnvelopeFields(input) {
+  const fields = {};
+  const cmd = input.command ?? input.input ?? "";
+  if (cmd) {
+    fields.input = cmd;
+    fields.inputKind = input.inputKind ?? input.kind;
+  }
+  if (input.cwd) {
+    fields.cwd = path5.resolve(input.cwd);
+  }
+  if (input.toolName) {
+    fields.toolName = input.toolName;
+  }
+  if (input.payload && Object.keys(input.payload).length > 0) {
+    const json = canonicalStringify(input.payload);
+    if (Buffer.byteLength(json, "utf8") <= MAX_PAYLOAD_JSON_BYTES) {
+      fields.payloadJson = json;
+    }
+    fields.payloadHash = replayPayloadHash(input.kind, input.payload, input.repoRoot);
+  }
+  return fields;
+}
+function hasReplayEnvelope(approval) {
+  return Boolean(approval.cwd || approval.toolName || approval.payloadHash);
+}
+function validateReplayEnvelope(approval, action) {
+  if (!hasReplayEnvelope(approval)) {
+    return true;
+  }
+  if (approval.kind !== action.kind) {
+    return false;
+  }
+  if (approval.fingerprint !== action.fingerprint) {
+    return false;
+  }
+  if (approval.repoRoot !== action.repoRoot) {
+    return false;
+  }
+  if (approval.cwd && path5.resolve(approval.cwd) !== path5.resolve(action.cwd ?? "")) {
+    return false;
+  }
+  if (approval.toolName && approval.toolName !== action.toolName) {
+    return false;
+  }
+  if (approval.payloadHash) {
+    const hash = replayPayloadHash(action.kind, action.payload, action.repoRoot);
+    if (!hash || approval.payloadHash !== hash) {
+      return false;
+    }
+  }
+  return true;
+}
+function canAutoReplay(config, kind, adapter) {
+  if (config.approvalSigning?.required) {
+    return false;
+  }
+  if (approvalFlow(config) !== "one_step") {
+    return false;
+  }
+  if (kind !== "shell" && kind !== "tool" && kind !== "subagent") {
+    return false;
+  }
+  const scopes = config.approval?.autoReplayScopes;
+  if (kind === "shell" && scopes?.shell === false) {
+    return false;
+  }
+  if (kind === "tool" && scopes?.tool !== true) {
+    return false;
+  }
+  if (kind === "subagent" && scopes?.subagent !== true) {
+    return false;
+  }
+  if (adapter) {
+    return ADAPTER_REPLAY_CAPABLE[adapter][kind] === true;
+  }
+  return kind === "shell" && scopes?.shell !== false;
+}
+function buildRetryInstructionForConfig(config, tokenPrefix, approvalId) {
+  if (approvalFlow(config) === "one_step") {
+    return `To allow this action once, send ${tokenPrefix} ${approvalId}. After approval, retry the same action unchanged.`;
+  }
+  return `To allow the next matching action once, send ${tokenPrefix} ${approvalId} and then retry the original action unchanged.`;
+}
+function buildApprovalRecordedMessage(config, approval, adapter) {
+  if (!canAutoReplay(config, approval.kind, adapter)) {
+    return `Belay approval recorded for ${approval.approvalId}. Retry the original action once before it expires.`;
+  }
+  if (approval.kind === "shell" && approval.input) {
+    return `Belay approval recorded for ${approval.approvalId}. Retry this shell command unchanged: ${approval.input}`;
+  }
+  return `Belay approval recorded for ${approval.approvalId}. Retry the original action once before it expires.`;
+}
+function buildReplayHint(config, approval, adapter) {
+  if (approvalFlow(config) !== "one_step") {
+    return null;
+  }
+  const input = approval.input ?? approval.summary;
+  if (!input) {
+    return null;
+  }
+  const autoReplay = canAutoReplay(config, approval.kind, adapter);
+  return {
+    kind: approval.kind,
+    input,
+    cwd: approval.cwd,
+    toolName: approval.toolName,
+    fingerprint: approval.fingerprint,
+    approvalId: approval.approvalId,
+    autoReplay,
+    fallbackToTwoStep: !autoReplay
+  };
+}
 
 // src/core/approval.ts
-var APPROVAL_EXECUTION_LEASE_MS = 6e4;
+var APPROVAL_EXECUTION_LEASE_MS = DEFAULT_APPROVAL_CONFIG.executionLeaseMs;
 function nowIso() {
   return (/* @__PURE__ */ new Date()).toISOString();
 }
@@ -987,8 +1346,34 @@ function approvalCommandMatch(prompt, tokenPrefix) {
   }
   return null;
 }
-function buildRetryInstruction(tokenPrefix, approvalId) {
-  return `To allow the next matching action once, send ${tokenPrefix} ${approvalId} and then retry the original action unchanged.`;
+function createApprovalRecordWithEnvelope(params) {
+  const envelope = buildReplayEnvelopeFields({
+    kind: params.kind,
+    command: params.approvalInput?.input,
+    input: params.approvalInput?.input,
+    inputKind: params.approvalInput?.inputKind,
+    cwd: params.approvalInput?.cwd,
+    toolName: params.approvalInput?.toolName,
+    payload: params.approvalInput?.payload,
+    fingerprint: params.fingerprint,
+    repoRoot: params.repoRoot
+  });
+  return createApprovalRecord({
+    kind: params.kind,
+    fingerprint: params.fingerprint,
+    repoRoot: params.repoRoot,
+    reason: params.reason,
+    summary: params.summary,
+    approvalTtlMinutes: params.approvalTtlMinutes,
+    approvalId: params.approvalId,
+    input: envelope.input ?? params.approvalInput?.input,
+    inputKind: envelope.inputKind ?? params.approvalInput?.inputKind,
+    cwd: envelope.cwd,
+    toolName: envelope.toolName ?? params.approvalInput?.toolName,
+    payloadHash: envelope.payloadHash,
+    payloadJson: envelope.payloadJson,
+    scopeHint: params.scopeHint
+  });
 }
 function createApprovalRecord(params) {
   const createdAt = nowIso();
@@ -1007,221 +1392,515 @@ function createApprovalRecord(params) {
     record.input = params.input;
     record.inputKind = params.inputKind ?? params.kind;
   }
-  return record;
-}
-
-// src/core/approval-token.ts
-import { createHmac, randomBytes, timingSafeEqual } from "node:crypto";
-import { existsSync } from "node:fs";
-import { mkdir, readFile, writeFile } from "node:fs/promises";
-import path4 from "node:path";
-function base64UrlEncode(value) {
-  return Buffer.from(value, "utf8").toString("base64url");
-}
-function base64UrlDecode(value) {
-  return Buffer.from(value, "base64url").toString("utf8");
-}
-function approvalSigningKeyPath(controlPlaneDir = defaultControlPlaneDir()) {
-  return path4.join(controlPlaneDir, "approval-signing.key");
-}
-async function loadOrCreateApprovalSigningKey(controlPlaneDir = defaultControlPlaneDir()) {
-  const keyPath = approvalSigningKeyPath(controlPlaneDir);
-  if (existsSync(keyPath)) {
-    return readFile(keyPath);
+  if (params.cwd) {
+    record.cwd = params.cwd;
   }
-  await mkdir(controlPlaneDir, { recursive: true });
-  const key = randomBytes(32);
-  await writeFile(keyPath, key, { mode: 384 });
-  return key;
-}
-function signPayload(payload, key) {
-  const body = base64UrlEncode(JSON.stringify(payload));
-  const signature = createHmac("sha256", key).update(body).digest("base64url");
-  return `${body}.${signature}`;
-}
-async function issueApprovalToken(payload, controlPlaneDir = defaultControlPlaneDir()) {
-  const key = await loadOrCreateApprovalSigningKey(controlPlaneDir);
-  return signPayload(payload, key);
-}
-async function verifyApprovalToken(token, controlPlaneDir = defaultControlPlaneDir()) {
-  const [body, signature] = token.split(".");
-  if (!body || !signature) {
-    return null;
+  if (params.toolName) {
+    record.toolName = params.toolName;
   }
-  const keyPath = approvalSigningKeyPath(controlPlaneDir);
-  if (!existsSync(keyPath)) {
-    return null;
+  if (params.payloadHash) {
+    record.payloadHash = params.payloadHash;
   }
-  const key = await readFile(keyPath);
-  const expected = createHmac("sha256", key).update(body).digest("base64url");
-  const actualBuffer = Buffer.from(signature);
-  const expectedBuffer = Buffer.from(expected);
-  if (actualBuffer.length !== expectedBuffer.length || !timingSafeEqual(actualBuffer, expectedBuffer)) {
-    return null;
+  if (params.payloadJson) {
+    record.payloadJson = params.payloadJson;
   }
-  try {
-    const payload = JSON.parse(base64UrlDecode(body));
-    if (Date.parse(payload.expiresAt) <= Date.now()) {
-      return null;
-    }
-    return payload;
-  } catch {
-    return null;
+  if (params.scopeHint) {
+    record.scopeHint = params.scopeHint;
   }
+  return record;
 }
 
-// src/core/approval-service.ts
-async function recordApproval(params) {
-  const { approvalId, config, store, token, requireSignedToken = false } = params;
-  const pending = await store.loadPending();
-  pending.state = compactApprovals(pending.state);
-  const index = pending.state.approvals.findIndex((approval2) => approval2.approvalId === approvalId);
-  if (index === -1) {
-    await store.writePending(pending.filePath, pending.state);
-    return { ok: false, message: "Belay approval not found or expired." };
-  }
-  const [approval] = pending.state.approvals.slice(index, index + 1);
-  if (requireSignedToken) {
-    if (!token) {
-      return { ok: false, message: "Signed approval token required for out-of-band approval." };
-    }
-    const controlPlaneDir = configuredControlPlaneDir(config);
-    const verified = await verifyApprovalToken(token, controlPlaneDir);
-    if (!verified || verified.approvalId !== approvalId) {
-      return { ok: false, message: "Invalid or expired signed approval token." };
-    }
-    if (verified.fingerprint !== approval.fingerprint || verified.repoRoot !== approval.repoRoot) {
-      return { ok: false, message: "Signed approval token does not match the pending approval." };
-    }
-  }
-  pending.state.approvals.splice(index, 1);
-  await store.writePending(pending.filePath, pending.state);
-  const approved = await store.loadApproved();
-  approved.state = compactApprovals(approved.state);
-  approved.state.approvals.push({
-    ...approval,
-    approvedAt: (/* @__PURE__ */ new Date()).toISOString()
-  });
-  await store.writeApproved(approved.filePath, approved.state);
-  return {
-    ok: true,
-    message: `Belay approval recorded for ${approvalId}. Retry the original action once before it expires.`,
-    approval
-  };
-}
-
-// src/core/capability/allowlist.ts
-import { existsSync as existsSync3, readFileSync } from "node:fs";
+// src/adapters/layouts/codex.ts
 import path6 from "node:path";
-
-// src/core/path-utils.ts
-import { existsSync as existsSync2, realpathSync } from "node:fs";
-import path5 from "node:path";
-function canonicalPath(targetPath) {
-  const resolved = path5.resolve(targetPath);
-  if (!resolved) {
-    return resolved;
-  }
-  const parsed = path5.parse(resolved);
-  let current = parsed.root;
-  const relativeParts = path5.relative(parsed.root || ".", resolved).split(path5.sep).filter(Boolean);
-  for (let i = 0; i < relativeParts.length; i++) {
-    const segment = relativeParts[i];
-    if (!segment) {
-      continue;
-    }
-    const candidate = current === "" ? segment : path5.join(current, segment);
-    if (!existsSync2(candidate)) {
-      return path5.join(candidate, ...relativeParts.slice(i + 1));
-    }
-    try {
-      current = realpathSync.native(candidate);
-    } catch {
-      return path5.join(candidate, ...relativeParts.slice(i + 1));
-    }
-  }
-  return current;
+function runnerCommand2(platform, repoRoot, hookName, ...args) {
+  const hooksDir = path6.join(path6.resolve(repoRoot), ".codex", "hooks");
+  return buildRunnerInvocation(platform, hooksDir, repoRoot, hookName, ...args);
 }
-function pathWithinRoot(root, targetPath) {
-  const resolvedRoot = canonicalPath(root);
-  const resolvedTarget = canonicalPath(targetPath);
-  const relativePath = path5.relative(resolvedRoot, resolvedTarget);
-  if (relativePath === "") {
-    return true;
+var codexLayout = {
+  name: "codex",
+  configPath(repoRoot) {
+    return path6.join(repoRoot, ".codex", "belay.config.json");
+  },
+  // Codex reads lifecycle hooks from `.codex/config.toml` (project layer).
+  hooksSettingsPath(repoRoot) {
+    return path6.join(repoRoot, ".codex", "config.toml");
+  },
+  hooksDir(repoRoot) {
+    return path6.join(repoRoot, ".codex", "hooks");
+  },
+  runtimeDir(repoRoot) {
+    return path6.join(repoRoot, ".codex", "belay", "runtime");
+  },
+  repoLocalStateDir(repoRoot) {
+    return path6.join(repoRoot, ".codex", "belay");
+  },
+  defaultAuditLogPath(_repoRoot) {
+    return path6.join(".codex", "belay", "audit.ndjson");
+  },
+  repoRootMarkers: [".git", ".codex"],
+  runnerCommand: runnerCommand2,
+  defaultConfig(repoRoot) {
+    return {
+      ...DEFAULT_CONFIG_V4,
+      adapter: "codex",
+      audit: {
+        ...DEFAULT_CONFIG_V4.audit,
+        logPath: codexLayout.defaultAuditLogPath(repoRoot)
+      }
+    };
   }
-  return !relativePath.startsWith("..") && !path5.isAbsolute(relativePath);
+};
+
+// src/adapters/layouts/cursor.ts
+import path7 from "node:path";
+function runnerCommand3(platform, repoRoot, hookName, ...args) {
+  const hooksDir = path7.join(path7.resolve(repoRoot), ".cursor", "hooks");
+  return buildRunnerInvocation(platform, hooksDir, repoRoot, hookName, ...args);
 }
-function relativeWithinRepo(repoRoot, targetPath) {
-  const resolvedRoot = canonicalPath(repoRoot);
-  const resolvedTarget = canonicalPath(targetPath);
-  const relativePath = path5.relative(resolvedRoot, resolvedTarget);
-  if (relativePath === "") {
-    return ".";
-  }
-  if (relativePath.startsWith("..")) {
-    return null;
+var cursorLayout = {
+  name: "cursor",
+  configPath(repoRoot) {
+    return path7.join(repoRoot, ".cursor", "belay.config.json");
+  },
+  hooksSettingsPath(repoRoot) {
+    return path7.join(repoRoot, ".cursor", "hooks.json");
+  },
+  hooksDir(repoRoot) {
+    return path7.join(repoRoot, ".cursor", "hooks");
+  },
+  runtimeDir(repoRoot) {
+    return path7.join(repoRoot, ".cursor", "belay", "runtime");
+  },
+  repoLocalStateDir(repoRoot) {
+    return path7.join(repoRoot, ".cursor", "belay");
+  },
+  defaultAuditLogPath(_repoRoot) {
+    return path7.join(".cursor", "belay", "audit.ndjson");
+  },
+  repoRootMarkers: [".git", ".cursor"],
+  runnerCommand: runnerCommand3,
+  defaultConfig(repoRoot) {
+    return {
+      ...DEFAULT_CONFIG_V4,
+      adapter: "cursor",
+      audit: {
+        ...DEFAULT_CONFIG_V4.audit,
+        logPath: cursorLayout.defaultAuditLogPath(repoRoot)
+      }
+    };
   }
-  return relativePath;
+};
+
+// src/adapters/layouts/index.ts
+var layouts = {
+  cursor: cursorLayout,
+  claude: claudeLayout,
+  codex: codexLayout
+};
+function getAdapterLayout(name = "cursor") {
+  return layouts[name];
 }
-function resolveMutationTarget(token, cwd) {
-  if (!token || token === "--" || token.startsWith("-")) {
-    return null;
-  }
-  if (token === "2>" || token === "1>" || token === "&>" || token === "1>>" || token === "2>>") {
-    return null;
-  }
-  if (path5.isAbsolute(token)) {
-    return canonicalPath(token);
-  }
-  if (token.startsWith("./") || token.startsWith("../")) {
-    return canonicalPath(path5.resolve(cwd, token));
-  }
-  if (!token.includes("/") && !token.includes("\\")) {
-    return canonicalPath(path5.resolve(cwd, token));
+
+// src/core/config-layers.ts
+import path8 from "node:path";
+
+// src/presets.ts
+var CONFIG_PRESETS = {
+  strict: {
+    mode: "enforce",
+    policy: {
+      ...DEFAULT_CONFIG_V3.policy,
+      unknownLocalEffect: "deny",
+      unparseableShell: "deny",
+      confidenceThresholds: { allow: 0.9, flag: 0.8 },
+      modelAssist: { enabled: false }
+    },
+    sandbox: { ...DEFAULT_CONFIG_V3.sandbox }
+  },
+  standard: {
+    mode: "enforce"
+  },
+  "audit-first": {
+    mode: "audit",
+    policy: {
+      ...DEFAULT_CONFIG_V3.policy,
+      unknownLocalEffect: "deny",
+      unparseableShell: "deny",
+      confidenceThresholds: { allow: 0.88, flag: 0.72 },
+      modelAssist: { enabled: false }
+    },
+    sandbox: { ...DEFAULT_CONFIG_V3.sandbox }
+  },
+  "l1-full-recommended": {
+    mode: "enforce",
+    policy: {
+      ...DEFAULT_CONFIG_V3.policy,
+      confidenceThresholds: { ...DEFAULT_CONFIG_V3.policy.confidenceThresholds },
+      modelAssist: { ...DEFAULT_CONFIG_V3.policy.modelAssist }
+    },
+    sandbox: {
+      enabled: true,
+      runtime: "container",
+      denyNetworkByDefault: true
+    },
+    egress: {
+      ...DEFAULT_CONFIG_V3.egress,
+      enabled: true,
+      demoteL3External: true
+    },
+    approvalSigning: {
+      required: true
+    },
+    controlPlane: {
+      ...DEFAULT_CONFIG_V3.controlPlane,
+      isolation: {
+        mode: "separate-user",
+        verifyAgentWritable: true
+      }
+    }
   }
-  return canonicalPath(path5.resolve(cwd, token));
+};
+function applyConfigPreset(preset, extra = {}) {
+  const base = CONFIG_PRESETS[preset] ?? CONFIG_PRESETS.standard;
+  return {
+    version: 3,
+    ...base,
+    ...extra,
+    policy: {
+      ...DEFAULT_CONFIG_V3.policy,
+      ...base.policy ?? {},
+      ...extra.policy
+    },
+    sandbox: {
+      ...DEFAULT_CONFIG_V3.sandbox,
+      ...base.sandbox ?? {},
+      ...extra.sandbox
+    },
+    egress: {
+      ...DEFAULT_CONFIG_V3.egress,
+      ...base.egress ?? {},
+      ...extra.egress
+    },
+    approvalSigning: {
+      ...DEFAULT_CONFIG_V3.approvalSigning,
+      ...base.approvalSigning ?? {},
+      ...extra.approvalSigning
+    },
+    controlPlane: {
+      ...DEFAULT_CONFIG_V3.controlPlane,
+      ...base.controlPlane ?? {},
+      ...extra.controlPlane,
+      isolation: {
+        ...DEFAULT_CONFIG_V3.controlPlane.isolation,
+        ...base.controlPlane?.isolation ?? {},
+        ...extra.controlPlane?.isolation ?? {}
+      }
+    }
+  };
 }
 
-// src/core/capability/allowlist.ts
-function fsScopeAllowlistPath(config, repoLocalStateDir) {
-  return path6.join(belayStateDir(config, repoLocalStateDir), "fs-scope-allowlist.json");
+// src/core/config-layers.ts
+function teamConfigPath(homedir = () => process.env.HOME ?? process.env.USERPROFILE ?? "") {
+  const xdg = process.env.XDG_CONFIG_HOME?.trim();
+  const base = xdg || path8.join(homedir(), ".config");
+  return path8.join(base, "agent-belay", "team.config.json");
 }
-function loadFsScopeAllowlistSync(filePath) {
-  if (!existsSync3(filePath)) {
-    return { version: 1, paths: [] };
+function applyProtectedLayer(config, builtin) {
+  const controlPlane = { ...config.controlPlane };
+  if (builtin.controlPlane.enabled && controlPlane.enabled === false) {
+    controlPlane.enabled = true;
+  }
+  if (builtin.controlPlane.integrity === "hash-pinned" && controlPlane.integrity === "none") {
+    controlPlane.integrity = "hash-pinned";
   }
-  const raw = JSON.parse(readFileSync(filePath, "utf8"));
   return {
-    version: 1,
-    paths: Array.isArray(raw.paths) ? raw.paths : []
+    ...config,
+    controlPlane
   };
 }
-function normalizeAllowlistPath(targetPath) {
-  return canonicalPath(targetPath);
+function asV3Layer(raw) {
+  if (!raw || typeof raw !== "object") {
+    return { version: 3 };
+  }
+  return { version: 3, ...raw };
 }
-function isPathAllowlisted(absolutePath, allowlist) {
-  const resolved = normalizeAllowlistPath(absolutePath);
-  return allowlist.paths.some((entry) => {
-    const scope = normalizeAllowlistPath(entry.path);
-    return resolved === scope || pathWithinRoot(scope, resolved);
-  });
+function mergeConfigLayer(base, layer) {
+  const merged = mergeConfig(layer, base);
+  if (!layer.policy) {
+    return { ...merged, policy: base.policy };
+  }
+  return merged;
 }
-function allPathsAllowlisted(absolutePaths, allowlist) {
-  return absolutePaths.length > 0 && absolutePaths.every((entry) => isPathAllowlisted(entry, allowlist));
+function resolveLayeredConfig(params) {
+  const provenance = [{ path: "(builtin)", source: "builtin" }];
+  let config = mergeConfig({}, params.adapterDefaults);
+  if (params.teamConfig) {
+    const teamFile = params.teamConfig;
+    const teamRaw = teamFile.preset ? applyConfigPreset(teamFile.preset, teamFile.config ?? {}) : teamFile.config ?? params.teamConfig;
+    rejectTeamLayerJudgeSecrets(
+      teamRaw.judge,
+      "team"
+    );
+    config = mergeConfigLayer(config, asV3Layer(teamRaw));
+    provenance.push({
+      path: params.teamConfigPath ?? teamConfigPath(),
+      source: "team"
+    });
+  }
+  config = mergeConfigLayer(config, asV3Layer(params.repoConfig));
+  if (params.repoConfigPath) {
+    provenance.push({ path: params.repoConfigPath, source: "repo" });
+  }
+  const protectedConfig = applyProtectedLayer(config, DEFAULT_CONFIG_V3);
+  if (JSON.stringify(protectedConfig) !== JSON.stringify(config)) {
+    provenance.push({ path: "(protected-layer)", source: "protected" });
+    config = protectedConfig;
+  }
+  return { config, provenance };
 }
 
-// src/core/capability/broker.ts
-function hasSandboxRuntime(config) {
-  return config.sandbox.enabled && config.sandbox.runtime !== "none";
+// src/config-io.ts
+function resolveAdapterName(config) {
+  if (config.adapter === "claude") {
+    return "claude";
+  }
+  if (config.adapter === "codex") {
+    return "codex";
+  }
+  return "cursor";
 }
-function isCapabilityBrokerDemotionActive(config) {
-  return hasSandboxRuntime(config);
+function repoLocalStateDirFor(repoRoot, config) {
+  return getAdapterLayout(resolveAdapterName(config)).repoLocalStateDir(repoRoot);
 }
 
-// src/core/capability/paths.ts
-import path7 from "node:path";
+// src/core/approval-token.ts
+import { createHmac, randomBytes, timingSafeEqual } from "node:crypto";
+import { existsSync } from "node:fs";
+import { mkdir, readFile, writeFile } from "node:fs/promises";
+import path9 from "node:path";
+function base64UrlEncode(value) {
+  return Buffer.from(value, "utf8").toString("base64url");
+}
+function base64UrlDecode(value) {
+  return Buffer.from(value, "base64url").toString("utf8");
+}
+function approvalSigningKeyPath(controlPlaneDir = defaultControlPlaneDir()) {
+  return path9.join(controlPlaneDir, "approval-signing.key");
+}
+async function loadOrCreateApprovalSigningKey(controlPlaneDir = defaultControlPlaneDir()) {
+  const keyPath = approvalSigningKeyPath(controlPlaneDir);
+  if (existsSync(keyPath)) {
+    return readFile(keyPath);
+  }
+  await mkdir(controlPlaneDir, { recursive: true });
+  const key = randomBytes(32);
+  await writeFile(keyPath, key, { mode: 384 });
+  return key;
+}
+function signPayload(payload, key) {
+  const body = base64UrlEncode(JSON.stringify(payload));
+  const signature = createHmac("sha256", key).update(body).digest("base64url");
+  return `${body}.${signature}`;
+}
+async function issueApprovalToken(payload, controlPlaneDir = defaultControlPlaneDir()) {
+  const key = await loadOrCreateApprovalSigningKey(controlPlaneDir);
+  return signPayload(payload, key);
+}
+async function verifyApprovalToken(token, controlPlaneDir = defaultControlPlaneDir()) {
+  const [body, signature] = token.split(".");
+  if (!body || !signature) {
+    return null;
+  }
+  const keyPath = approvalSigningKeyPath(controlPlaneDir);
+  if (!existsSync(keyPath)) {
+    return null;
+  }
+  const key = await readFile(keyPath);
+  const expected = createHmac("sha256", key).update(body).digest("base64url");
+  const actualBuffer = Buffer.from(signature);
+  const expectedBuffer = Buffer.from(expected);
+  if (actualBuffer.length !== expectedBuffer.length || !timingSafeEqual(actualBuffer, expectedBuffer)) {
+    return null;
+  }
+  try {
+    const payload = JSON.parse(base64UrlDecode(body));
+    if (Date.parse(payload.expiresAt) <= Date.now()) {
+      return null;
+    }
+    return payload;
+  } catch {
+    return null;
+  }
+}
+
+// src/core/approval-service.ts
+async function recordApproval(params) {
+  const { approvalId, config, store, token, requireSignedToken = false, adapter } = params;
+  const pending = await store.loadPending();
+  pending.state = compactApprovals(pending.state);
+  const index = pending.state.approvals.findIndex((approval2) => approval2.approvalId === approvalId);
+  if (index === -1) {
+    await store.writePending(pending.filePath, pending.state);
+    return { ok: false, message: "Belay approval not found or expired." };
+  }
+  const [approval] = pending.state.approvals.slice(index, index + 1);
+  if (requireSignedToken) {
+    if (!token) {
+      return { ok: false, message: "Signed approval token required for out-of-band approval." };
+    }
+    const controlPlaneDir = configuredControlPlaneDir(config);
+    const verified = await verifyApprovalToken(token, controlPlaneDir);
+    if (!verified || verified.approvalId !== approvalId) {
+      return { ok: false, message: "Invalid or expired signed approval token." };
+    }
+    if (verified.fingerprint !== approval.fingerprint || verified.repoRoot !== approval.repoRoot) {
+      return { ok: false, message: "Signed approval token does not match the pending approval." };
+    }
+  }
+  pending.state.approvals.splice(index, 1);
+  await store.writePending(pending.filePath, pending.state);
+  const approved = await store.loadApproved();
+  approved.state = compactApprovals(approved.state);
+  approved.state.approvals.push({
+    ...approval,
+    approvedAt: (/* @__PURE__ */ new Date()).toISOString()
+  });
+  await store.writeApproved(approved.filePath, approved.state);
+  return {
+    ok: true,
+    message: buildApprovalRecordedMessage(config, approval, adapter),
+    approval
+  };
+}
+async function consumeApprovedAfterCliReplay(params) {
+  const approved = await params.store.loadApproved();
+  approved.state = compactApprovals(approved.state);
+  const remaining = approved.state.approvals.filter(
+    (approval) => approval.approvalId !== params.approvalId
+  );
+  if (remaining.length === approved.state.approvals.length) {
+    return;
+  }
+  approved.state.approvals = remaining;
+  await params.store.writeApproved(approved.filePath, approved.state);
+}
+function gateApprovalStoreFromDeps(deps) {
+  return {
+    loadPending: () => deps.loadApprovals("pending-approvals.json"),
+    loadApproved: () => deps.loadApprovals("approved-approvals.json"),
+    writePending: (filePath, state) => deps.writeApprovals(filePath, state),
+    writeApproved: (filePath, state) => deps.writeApprovals(filePath, state)
+  };
+}
+
+// src/core/audit-replay-context.ts
+import { createHash as createHash2 } from "node:crypto";
+function hashReplayPayload(payload) {
+  return createHash2("sha256").update(JSON.stringify(payload)).digest("hex");
+}
+function buildAuditActionSnapshot(kind, result, replayAction) {
+  if (!replayAction?.cwd) {
+    return void 0;
+  }
+  const replayKind = replayAction.kind;
+  const resolvedKind = replayKind === "shell" || replayKind === "tool" || replayKind === "subagent" ? replayKind : kind;
+  const normalizedAction = result.normalizedCommand ?? replayAction.command ?? result.summary ?? "";
+  if (!normalizedAction.trim()) {
+    return void 0;
+  }
+  return {
+    schemaVersion: 1,
+    kind: resolvedKind,
+    cwd: replayAction.cwd,
+    normalizedAction,
+    ...replayAction.toolName ? { toolName: replayAction.toolName } : {},
+    ...replayAction.payload ? { payloadHash: hashReplayPayload(replayAction.payload) } : {}
+  };
+}
+function buildAuditReplayContext(kind, result, replayAction) {
+  if (!replayAction?.cwd) {
+    return void 0;
+  }
+  const replayKind = replayAction.kind;
+  const resolvedKind = replayKind === "shell" || replayKind === "tool" || replayKind === "subagent" ? replayKind : kind;
+  return {
+    cwd: replayAction.cwd,
+    kind: resolvedKind,
+    command: replayAction.command ?? result.normalizedCommand ?? result.summary,
+    ...replayAction.toolName ? { toolName: replayAction.toolName } : {},
+    ...replayAction.payload ? { payload: replayAction.payload } : {}
+  };
+}
+
+// src/core/capability/allowlist.ts
+import { existsSync as existsSync3, readFileSync } from "node:fs";
+import path11 from "node:path";
+
+// src/core/path-utils.ts
+import { existsSync as existsSync2, realpathSync, statSync } from "node:fs";
+import path10 from "node:path";
 
 // src/core/shell-tokenizer.ts
+var FD_DUPLICATION_PATTERN = /^\d+[<>]&(?:\d+|-)$/;
+var FD_REDIRECT_PATTERN = /^\d+(?:>>?|<)$/;
+function readDigits(input, index) {
+  let end = index;
+  while (end < input.length && /[0-9]/.test(input[end] ?? "")) {
+    end += 1;
+  }
+  return input.slice(index, end);
+}
+function readShellOperator(input, index) {
+  const char = input[index];
+  const next = input[index + 1] ?? "";
+  const digits = /[0-9]/.test(char) ? readDigits(input, index) : "";
+  const digitsLength = digits.length;
+  const afterDigits = digitsLength > 0 ? input[index + digitsLength] ?? "" : "";
+  const afterDigitsNext = digitsLength > 0 ? input[index + digitsLength + 1] ?? "" : "";
+  if (char === "&" && next === "&") {
+    return { token: "&&", length: 2 };
+  }
+  if (char === "|" && next === "|") {
+    return { token: "||", length: 2 };
+  }
+  if (char === "|" && next === "&") {
+    return { token: "|&", length: 2 };
+  }
+  if (char === "&" && next === ">") {
+    return { token: "&>", length: 2 };
+  }
+  if (digitsLength > 0 && (afterDigits === ">" || afterDigits === "<")) {
+    if (afterDigitsNext === "&") {
+      let end = index + digitsLength + 2;
+      while (end < input.length && /[0-9-]/.test(input[end] ?? "")) {
+        end += 1;
+      }
+      if (end > index + digitsLength + 2) {
+        return { token: input.slice(index, end), length: end - index };
+      }
+    }
+    if (afterDigits === ">" && afterDigitsNext === ">") {
+      return { token: `${digits}>>`, length: digitsLength + 2 };
+    }
+    return { token: `${digits}${afterDigits}`, length: digitsLength + 1 };
+  }
+  if (char === ">" && next === ">") {
+    return { token: ">>", length: 2 };
+  }
+  if (char === "&") {
+    return { token: "&", length: 1 };
+  }
+  if (char === "|" || char === ";" || char === ">" || char === "<") {
+    return { token: char, length: 1 };
+  }
+  return null;
+}
+function isRedirectOperator(token) {
+  return token === ">" || token === ">>" || token === "<" || token === "&>" || FD_REDIRECT_PATTERN.test(token);
+}
+function isFdDuplication(token) {
+  return FD_DUPLICATION_PATTERN.test(token);
+}
 function tokenizeShell(input) {
   const tokens = [];
   let buffer = "";
@@ -1235,7 +1914,6 @@ function tokenizeShell(input) {
   };
   for (let index = 0; index < input.length; index += 1) {
     const char = input[index];
-    const next = input[index + 1] ?? "";
     if (escaping) {
       buffer += char;
       escaping = false;
@@ -1257,27 +1935,11 @@ function tokenizeShell(input) {
       quote = char;
       continue;
     }
-    if (char === "&" && next === "&") {
-      flush();
-      tokens.push("&&");
-      index += 1;
-      continue;
-    }
-    if (char === "|" && next === "|") {
-      flush();
-      tokens.push("||");
-      index += 1;
-      continue;
-    }
-    if (char === ">" && next === ">") {
-      flush();
-      tokens.push(">>");
-      index += 1;
-      continue;
-    }
-    if (char === "|" || char === ";" || char === ">" || char === "<") {
+    const operator = readShellOperator(input, index);
+    if (operator) {
       flush();
-      tokens.push(char);
+      tokens.push(operator.token);
+      index += operator.length - 1;
       continue;
     }
     if (char === "\n" || char === "\r") {
@@ -1307,7 +1969,10 @@ function extractRedirectTargets(tokens) {
   const targets = [];
   for (let index = 0; index < tokens.length; index += 1) {
     const token = tokens[index];
-    if (token === ">" || token === ">>" || token === "<") {
+    if (isFdDuplication(token)) {
+      continue;
+    }
+    if (isRedirectOperator(token)) {
       const next = tokens[index + 1];
       if (next) {
         targets.push(next);
@@ -1317,73 +1982,215 @@ function extractRedirectTargets(tokens) {
   return targets;
 }
 
-// src/core/capability/paths.ts
-function applyPatchTargets(patch) {
-  const targets = [];
-  for (const line of patch.split("\n")) {
-    const match = line.match(/^\*\*\* (?:Add|Delete|Update) File: (.+)$/);
-    if (match?.[1]) {
-      targets.push(match[1]);
+// src/core/path-utils.ts
+function canonicalPath(targetPath) {
+  const resolved = path10.resolve(targetPath);
+  if (!resolved) {
+    return resolved;
+  }
+  const parsed = path10.parse(resolved);
+  let current = parsed.root;
+  const relativeParts = path10.relative(parsed.root || ".", resolved).split(path10.sep).filter(Boolean);
+  for (let i = 0; i < relativeParts.length; i++) {
+    const segment = relativeParts[i];
+    if (!segment) {
       continue;
     }
-    const moveMatch = line.match(/^\*\*\* Move to: (.+)$/);
-    if (moveMatch?.[1]) {
-      targets.push(moveMatch[1]);
+    const candidate = current === "" ? segment : path10.join(current, segment);
+    if (!existsSync2(candidate)) {
+      return path10.join(candidate, ...relativeParts.slice(i + 1));
+    }
+    try {
+      current = realpathSync.native(candidate);
+    } catch {
+      return path10.join(candidate, ...relativeParts.slice(i + 1));
     }
   }
-  return targets;
+  return current;
 }
-function extractToolFilePath(payload) {
-  const toolInput = payload.tool_input;
-  if (!toolInput || typeof toolInput !== "object") {
+function pathWithinRoot(root, targetPath) {
+  const resolvedRoot = canonicalPath(root);
+  const resolvedTarget = canonicalPath(targetPath);
+  const relativePath = path10.relative(resolvedRoot, resolvedTarget);
+  if (relativePath === "") {
+    return true;
+  }
+  return !relativePath.startsWith("..") && !path10.isAbsolute(relativePath);
+}
+function relativeWithinRoot(root, targetPath, options = {}) {
+  const resolvedRoot = options.canonicalizeRoot === false ? path10.resolve(root) : canonicalPath(root);
+  const resolvedTarget = canonicalPath(targetPath);
+  const relativePath = path10.relative(resolvedRoot, resolvedTarget);
+  if (relativePath === "") {
+    return ".";
+  }
+  if (relativePath.startsWith("..") || path10.isAbsolute(relativePath)) {
     return null;
   }
-  const input = toolInput;
-  for (const key of ["path", "file_path", "target_file", "filePath"]) {
-    if (typeof input[key] === "string") {
-      return input[key];
+  return relativePath;
+}
+function relativeWithinRepo(repoRoot, targetPath) {
+  return relativeWithinRoot(repoRoot, targetPath);
+}
+function resolveWorkspaceRootMatch(repoRoot, trustedRoots = [], targetPath) {
+  const canonicalRepoRoot = canonicalPath(repoRoot);
+  const repoRelative = relativeWithinRoot(repoRoot, targetPath);
+  if (repoRelative !== null) {
+    return { kind: "repo", root: canonicalRepoRoot, relativePath: repoRelative };
+  }
+  const normalizedTrustedRoots = [...new Set(trustedRoots.map((root) => path10.resolve(root)))].filter((root) => root !== canonicalRepoRoot).sort((left, right) => right.length - left.length);
+  for (const root of normalizedTrustedRoots) {
+    const trustedRelative = relativeWithinRoot(root, targetPath, { canonicalizeRoot: false });
+    if (trustedRelative !== null) {
+      return { kind: "trusted", root, relativePath: trustedRelative };
     }
   }
   return null;
 }
-function extractToolPatch(payload) {
-  const toolInput = payload.tool_input;
-  if (!toolInput || typeof toolInput !== "object") {
+function resolveMutationTarget(token, cwd) {
+  if (!token || token === "--" || token.startsWith("-")) {
     return null;
   }
-  const input = toolInput;
-  for (const key of ["patch", "input", "text"]) {
-    if (typeof input[key] === "string" && input[key].trim()) {
-      return input[key];
-    }
+  if (isRedirectOperator(token) || isFdDuplication(token) || token === "&&" || token === "||" || token === "|" || token === "|&" || token === ";" || token === "&") {
+    return null;
   }
-  return null;
+  if (path10.isAbsolute(token)) {
+    return canonicalPath(token);
+  }
+  if (token.startsWith("./") || token.startsWith("../")) {
+    return canonicalPath(path10.resolve(cwd, token));
+  }
+  if (!token.includes("/") && !token.includes("\\")) {
+    return canonicalPath(path10.resolve(cwd, token));
+  }
+  return canonicalPath(path10.resolve(cwd, token));
+}
+function containingGitRoot(targetPath) {
+  const resolved = canonicalPath(targetPath);
+  let current = resolved;
+  try {
+    if (!statSync(current).isDirectory()) {
+      current = path10.dirname(current);
+    }
+  } catch {
+    current = path10.dirname(current);
+  }
+  while (true) {
+    if (existsSync2(path10.join(current, ".git"))) {
+      return current;
+    }
+    const parent = path10.dirname(current);
+    if (parent === current) {
+      return null;
+    }
+    current = parent;
+  }
+}
+
+// src/core/capability/allowlist.ts
+function fsScopeAllowlistPath(config, repoLocalStateDir) {
+  return path11.join(belayStateDir(config, repoLocalStateDir), "fs-scope-allowlist.json");
+}
+function loadFsScopeAllowlistSync(filePath) {
+  if (!existsSync3(filePath)) {
+    return { version: 1, paths: [] };
+  }
+  const raw = JSON.parse(readFileSync(filePath, "utf8"));
+  return {
+    version: 1,
+    paths: Array.isArray(raw.paths) ? raw.paths : []
+  };
+}
+function normalizeAllowlistPath(targetPath) {
+  return canonicalPath(targetPath);
+}
+function isPathAllowlisted(absolutePath, allowlist) {
+  const resolved = normalizeAllowlistPath(absolutePath);
+  return allowlist.paths.some((entry) => {
+    const scope = normalizeAllowlistPath(entry.path);
+    return resolved === scope || pathWithinRoot(scope, resolved);
+  });
+}
+function allPathsAllowlisted(absolutePaths, allowlist) {
+  return absolutePaths.length > 0 && absolutePaths.every((entry) => isPathAllowlisted(entry, allowlist));
+}
+
+// src/core/capability/broker.ts
+function hasSandboxRuntime(config) {
+  return config.sandbox.enabled && config.sandbox.runtime !== "none";
+}
+function isCapabilityBrokerDemotionActive(config) {
+  return hasSandboxRuntime(config);
+}
+
+// src/core/capability/paths.ts
+import path12 from "node:path";
+function applyPatchTargets(patch) {
+  const targets = [];
+  for (const line of patch.split("\n")) {
+    const match = line.match(/^\*\*\* (?:Add|Delete|Update) File: (.+)$/);
+    if (match?.[1]) {
+      targets.push(match[1]);
+      continue;
+    }
+    const moveMatch = line.match(/^\*\*\* Move to: (.+)$/);
+    if (moveMatch?.[1]) {
+      targets.push(moveMatch[1]);
+    }
+  }
+  return targets;
+}
+function extractToolFilePath(payload) {
+  const toolInput = payload.tool_input;
+  if (!toolInput || typeof toolInput !== "object") {
+    return null;
+  }
+  const input = toolInput;
+  for (const key of ["path", "file_path", "target_file", "filePath"]) {
+    if (typeof input[key] === "string") {
+      return input[key];
+    }
+  }
+  return null;
+}
+function extractToolPatch(payload) {
+  const toolInput = payload.tool_input;
+  if (!toolInput || typeof toolInput !== "object") {
+    return null;
+  }
+  const input = toolInput;
+  for (const key of ["patch", "input", "text"]) {
+    if (typeof input[key] === "string" && input[key].trim()) {
+      return input[key];
+    }
+  }
+  return null;
 }
-function addOutsideRepoPath(paths, token, cwd, repoRoot) {
+function addOutsideRepoPath(paths, token, cwd, repoRoot, trustedWorkspaceRoots = []) {
   const resolved = resolveMutationTarget(token, cwd);
-  if (resolved && relativeWithinRepo(repoRoot, resolved) === null) {
+  if (resolved && resolveWorkspaceRootMatch(repoRoot, trustedWorkspaceRoots, resolved) === null) {
     paths.add(resolved);
   }
 }
-function collectOutsideRepoPaths(command, cwd, repoRoot) {
+function collectOutsideRepoPaths(command, cwd, repoRoot, trustedWorkspaceRoots = []) {
   const tokens = tokenizeShell(command);
   const redirects = extractRedirectTargets(tokens);
   const paths = /* @__PURE__ */ new Set();
   for (const token of tokens.slice(1)) {
-    addOutsideRepoPath(paths, token, cwd, repoRoot);
+    addOutsideRepoPath(paths, token, cwd, repoRoot, trustedWorkspaceRoots);
   }
   for (const redirect of redirects) {
-    addOutsideRepoPath(paths, redirect, cwd, repoRoot);
+    addOutsideRepoPath(paths, redirect, cwd, repoRoot, trustedWorkspaceRoots);
   }
   return [...paths];
 }
-function collectOutsideRepoPathsFromToolPayload(payload, cwd, repoRoot) {
+function collectOutsideRepoPathsFromToolPayload(payload, cwd, repoRoot, trustedWorkspaceRoots = []) {
   const toolKind = String(payload.tool_name ?? "").trim().toLowerCase();
   const paths = /* @__PURE__ */ new Set();
   const filePath = extractToolFilePath(payload);
   if (filePath) {
-    const resolved = path7.isAbsolute(filePath) ? filePath : path7.resolve(cwd, filePath);
-    if (relativeWithinRepo(repoRoot, resolved) === null) {
+    const resolved = path12.isAbsolute(filePath) ? filePath : path12.resolve(cwd, filePath);
+    if (resolveWorkspaceRootMatch(repoRoot, trustedWorkspaceRoots, resolved) === null) {
       paths.add(resolved);
     }
     return [...paths];
@@ -1392,8 +2199,8 @@ function collectOutsideRepoPathsFromToolPayload(payload, cwd, repoRoot) {
     const patch = extractToolPatch(payload);
     if (patch) {
       for (const target of applyPatchTargets(patch)) {
-        const resolved = path7.isAbsolute(target) ? target : path7.resolve(cwd, target);
-        if (relativeWithinRepo(repoRoot, resolved) === null) {
+        const resolved = path12.isAbsolute(target) ? target : path12.resolve(cwd, target);
+        if (resolveWorkspaceRootMatch(repoRoot, trustedWorkspaceRoots, resolved) === null) {
           paths.add(resolved);
         }
       }
@@ -1416,186 +2223,123 @@ function shouldSkipBrokerApprovedRecord(brokerActive, approvalReason) {
   return brokerActive && approvalReason !== void 0 && FS_SCOPE_REASONS.has(approvalReason);
 }
 
-// src/core/config-layers.ts
-import path8 from "node:path";
-
-// src/presets.ts
-var CONFIG_PRESETS = {
-  strict: {
-    mode: "enforce",
-    policy: {
-      ...DEFAULT_CONFIG_V3.policy,
-      unknownLocalEffect: "deny",
-      unparseableShell: "deny",
-      confidenceThresholds: { allow: 0.9, flag: 0.8 },
-      modelAssist: { enabled: false }
-    },
-    sandbox: { ...DEFAULT_CONFIG_V3.sandbox }
-  },
-  standard: {
-    mode: "enforce"
-  },
-  "audit-first": {
-    mode: "audit",
-    policy: {
-      ...DEFAULT_CONFIG_V3.policy,
-      unknownLocalEffect: "deny",
-      unparseableShell: "deny",
-      confidenceThresholds: { allow: 0.88, flag: 0.72 },
-      modelAssist: { enabled: false }
-    },
-    sandbox: { ...DEFAULT_CONFIG_V3.sandbox }
-  },
-  "l1-full-recommended": {
-    mode: "enforce",
-    policy: {
-      ...DEFAULT_CONFIG_V3.policy,
-      confidenceThresholds: { ...DEFAULT_CONFIG_V3.policy.confidenceThresholds },
-      modelAssist: { ...DEFAULT_CONFIG_V3.policy.modelAssist }
-    },
-    sandbox: {
-      enabled: true,
-      runtime: "container",
-      denyNetworkByDefault: true
-    },
-    egress: {
-      ...DEFAULT_CONFIG_V3.egress,
-      enabled: true,
-      demoteL3External: true
-    },
-    approvalSigning: {
-      required: true
-    },
-    controlPlane: {
-      ...DEFAULT_CONFIG_V3.controlPlane,
-      isolation: {
-        mode: "separate-user",
-        verifyAgentWritable: true
-      }
-    }
+// src/core/capability/trusted-workspace-roots.ts
+import { existsSync as existsSync4, readFileSync as readFileSync2, statSync as statSync2 } from "node:fs";
+import path13 from "node:path";
+function trustedWorkspaceRootsPath(config, repoLocalStateDir) {
+  return path13.join(belayStateDir(config, repoLocalStateDir), "trusted-workspace-roots.json");
+}
+function loadTrustedWorkspaceRootsSync(filePath) {
+  if (!existsSync4(filePath)) {
+    return { version: 1, roots: [] };
   }
-};
-function applyConfigPreset(preset, extra = {}) {
-  const base = CONFIG_PRESETS[preset] ?? CONFIG_PRESETS.standard;
-  return {
-    version: 3,
-    ...base,
-    ...extra,
-    policy: {
-      ...DEFAULT_CONFIG_V3.policy,
-      ...base.policy ?? {},
-      ...extra.policy
-    },
-    sandbox: {
-      ...DEFAULT_CONFIG_V3.sandbox,
-      ...base.sandbox ?? {},
-      ...extra.sandbox
-    },
-    egress: {
-      ...DEFAULT_CONFIG_V3.egress,
-      ...base.egress ?? {},
-      ...extra.egress
-    },
-    approvalSigning: {
-      ...DEFAULT_CONFIG_V3.approvalSigning,
-      ...base.approvalSigning ?? {},
-      ...extra.approvalSigning
-    },
-    controlPlane: {
-      ...DEFAULT_CONFIG_V3.controlPlane,
-      ...base.controlPlane ?? {},
-      ...extra.controlPlane,
-      isolation: {
-        ...DEFAULT_CONFIG_V3.controlPlane.isolation,
-        ...base.controlPlane?.isolation ?? {},
-        ...extra.controlPlane?.isolation ?? {}
-      }
-    }
-  };
+  const raw = JSON.parse(readFileSync2(filePath, "utf8"));
+  return { version: 1, roots: sanitizeTrustedWorkspaceRootEntries(raw.roots) };
 }
-
-// src/core/config-layers.ts
-function teamConfigPath(homedir = () => process.env.HOME ?? process.env.USERPROFILE ?? "") {
-  const xdg = process.env.XDG_CONFIG_HOME?.trim();
-  const base = xdg || path8.join(homedir(), ".config");
-  return path8.join(base, "agent-belay", "team.config.json");
+function normalizeTrustedWorkspaceRootPath(targetPath) {
+  return canonicalPath(targetPath);
 }
-function applyProtectedLayer(config, builtin) {
-  const controlPlane = { ...config.controlPlane };
-  if (builtin.controlPlane.enabled && controlPlane.enabled === false) {
-    controlPlane.enabled = true;
-  }
-  if (builtin.controlPlane.integrity === "hash-pinned" && controlPlane.integrity === "none") {
-    controlPlane.integrity = "hash-pinned";
+function sanitizeTrustedWorkspaceRootEntries(input) {
+  if (!Array.isArray(input)) {
+    return [];
   }
-  return {
-    ...config,
-    controlPlane
-  };
+  return input.flatMap((entry) => {
+    if (!entry || typeof entry !== "object") {
+      return [];
+    }
+    const record = entry;
+    if (typeof record.path !== "string" || !record.path.trim()) {
+      return [];
+    }
+    const approvedAt = typeof record.approvedAt === "string" ? record.approvedAt : (/* @__PURE__ */ new Date(0)).toISOString();
+    const approvalId = typeof record.approvalId === "string" ? record.approvalId : "unknown";
+    const source = record.source === "approval" ? "approval" : void 0;
+    return [
+      {
+        path: path13.resolve(record.path),
+        approvedAt,
+        approvalId,
+        ...source ? { source } : {}
+      }
+    ];
+  });
 }
-function asV3Layer(raw) {
-  if (!raw || typeof raw !== "object") {
-    return { version: 3 };
+var SYSTEM_HIGH_STAKES_PREFIXES = [
+  "/etc",
+  "/private/etc",
+  "/bin",
+  "/sbin",
+  "/usr",
+  "/opt",
+  "/System",
+  "/Library"
+];
+var HOME_HIGH_STAKES_SEGMENTS = [".ssh", ".gnupg", ".aws", ".kube", ".docker", ".config"];
+function isDirectoryPath(targetPath) {
+  try {
+    return statSync2(targetPath).isDirectory();
+  } catch {
+    return false;
   }
-  return { version: 3, ...raw };
 }
-function mergeConfigLayer(base, layer) {
-  const merged = mergeConfig(layer, base);
-  if (!layer.policy) {
-    return { ...merged, policy: base.policy };
+function isBroadTrustedWorkspaceRoot(targetPath) {
+  const home = process.env.HOME ?? process.env.USERPROFILE;
+  const root = normalizeTrustedWorkspaceRootPath(targetPath);
+  if (root === normalizeTrustedWorkspaceRootPath(path13.parse(root).root)) {
+    return true;
   }
-  return merged;
+  if (home && normalizeTrustedWorkspaceRootPath(home) === root) {
+    return true;
+  }
+  return false;
 }
-function resolveLayeredConfig(params) {
-  const provenance = [{ path: "(builtin)", source: "builtin" }];
-  let config = mergeConfig({}, params.adapterDefaults);
-  if (params.teamConfig) {
-    const teamFile = params.teamConfig;
-    const teamRaw = teamFile.preset ? applyConfigPreset(teamFile.preset, teamFile.config ?? {}) : teamFile.config ?? params.teamConfig;
-    rejectTeamLayerJudgeSecrets(
-      teamRaw.judge,
-      "team"
-    );
-    config = mergeConfigLayer(config, asV3Layer(teamRaw));
-    provenance.push({
-      path: params.teamConfigPath ?? teamConfigPath(),
-      source: "team"
-    });
+function isHighStakesTrustedWorkspaceRoot(targetPath) {
+  const normalized = normalizeTrustedWorkspaceRootPath(targetPath);
+  if (SYSTEM_HIGH_STAKES_PREFIXES.some(
+    (prefix) => normalized === normalizeTrustedWorkspaceRootPath(prefix) || pathWithinRoot(normalizeTrustedWorkspaceRootPath(prefix), normalized)
+  )) {
+    return true;
   }
-  config = mergeConfigLayer(config, asV3Layer(params.repoConfig));
-  if (params.repoConfigPath) {
-    provenance.push({ path: params.repoConfigPath, source: "repo" });
+  const home = process.env.HOME ?? process.env.USERPROFILE;
+  if (!home) {
+    return false;
   }
-  const protectedConfig = applyProtectedLayer(config, DEFAULT_CONFIG_V3);
-  if (JSON.stringify(protectedConfig) !== JSON.stringify(config)) {
-    provenance.push({ path: "(protected-layer)", source: "protected" });
-    config = protectedConfig;
+  const homeRoot = normalizeTrustedWorkspaceRootPath(home);
+  if (!pathWithinRoot(homeRoot, normalized)) {
+    return false;
   }
-  return { config, provenance };
+  return HOME_HIGH_STAKES_SEGMENTS.some(
+    (segment) => pathWithinRoot(path13.join(homeRoot, segment), normalized)
+  );
 }
-
-// src/core/fingerprint.ts
-import { createHash } from "node:crypto";
-function canonicalStringify(value) {
-  if (value === null || typeof value !== "object") {
-    return JSON.stringify(value);
+function validateTrustedWorkspaceRootCandidate(params) {
+  const normalizedPath = normalizeTrustedWorkspaceRootPath(params.candidatePath);
+  if (params.requireExistingDirectory !== false && !isDirectoryPath(normalizedPath)) {
+    return { ok: false, normalizedPath, reason: "not_directory" };
   }
-  if (Array.isArray(value)) {
-    return `[${value.map((item) => canonicalStringify(item)).join(",")}]`;
+  if (isBroadTrustedWorkspaceRoot(normalizedPath)) {
+    return { ok: false, normalizedPath, reason: "broad_root" };
   }
-  const entries = Object.entries(value).sort(
-    ([left], [right]) => left.localeCompare(right)
-  );
-  return `{${entries.map(([key, child]) => `${JSON.stringify(key)}:${canonicalStringify(child)}`).join(",")}}`;
-}
-function hashValue(value) {
-  return createHash("sha256").update(value).digest("hex");
-}
-function subagentFingerprint(kind, scrubbed, repoRoot) {
-  return hashValue(`subagent:${kind}:${canonicalStringify(scrubbed)}:${repoRoot}`);
-}
-function toolFingerprint(toolName, scrubbed, repoRoot) {
-  return hashValue(`tool:${toolName}:${canonicalStringify(scrubbed)}:${repoRoot}`);
+  if (isHighStakesTrustedWorkspaceRoot(normalizedPath)) {
+    return { ok: false, normalizedPath, reason: "high_stakes" };
+  }
+  if (resolveWorkspaceRootMatch(params.repoRoot, [], normalizedPath) !== null) {
+    return { ok: false, normalizedPath, reason: "inside_repo" };
+  }
+  if (params.requireNonGit !== false && containingGitRoot(normalizedPath)) {
+    return { ok: false, normalizedPath, reason: "inside_git_repo" };
+  }
+  const normalizedControlPlane = params.controlPlaneDir?.trim() ? normalizeTrustedWorkspaceRootPath(params.controlPlaneDir) : null;
+  if (normalizedControlPlane && (pathWithinRoot(normalizedControlPlane, normalizedPath) || pathWithinRoot(normalizedPath, normalizedControlPlane))) {
+    return { ok: false, normalizedPath, reason: "control_plane_overlap" };
+  }
+  if ((params.protectedRoots ?? []).some((root) => {
+    const normalizedRoot = normalizeTrustedWorkspaceRootPath(root);
+    return pathWithinRoot(normalizedRoot, normalizedPath) || pathWithinRoot(normalizedPath, normalizedRoot);
+  })) {
+    return { ok: false, normalizedPath, reason: "protected_root_overlap" };
+  }
+  return { ok: true, normalizedPath };
 }
 
 // src/core/scrub.ts
@@ -1683,6 +2427,51 @@ function scrubValue(value, options = DEFAULT_SCRUB_OPTIONS) {
   return value;
 }
 
+// src/core/replay-scrub.ts
+function subagentFingerprintSource(payload, scrubOptions) {
+  const toolInput = payload.tool_input;
+  if (toolInput && typeof toolInput === "object") {
+    const input = toolInput;
+    return scrubValue(
+      {
+        description: input.description ?? "",
+        prompt: input.prompt ?? ""
+      },
+      scrubOptions
+    );
+  }
+  const task = payload.task;
+  if (typeof task === "string") {
+    return scrubValue({ task }, scrubOptions);
+  }
+  if (task && typeof task === "object") {
+    const taskObj = task;
+    return scrubValue(
+      {
+        description: taskObj.description ?? "",
+        prompt: taskObj.prompt ?? ""
+      },
+      scrubOptions
+    );
+  }
+  return scrubValue(payload, scrubOptions);
+}
+function fingerprintReplayPayload(kind, payload, scrubOptions) {
+  if (!payload) {
+    return void 0;
+  }
+  if (kind === "tool") {
+    const toolInput = payload.tool_input;
+    if (toolInput && typeof toolInput === "object") {
+      return scrubValue(toolInput, scrubOptions);
+    }
+  }
+  if (kind === "subagent") {
+    return subagentFingerprintSource(payload, scrubOptions);
+  }
+  return scrubValue(payload, scrubOptions);
+}
+
 // src/core/classify-subagent.ts
 var EXTERNAL_TERMS = ["deploy", "production", "publish", "release", "ship", "notify", "email"];
 function extractSubagentText(payload, options) {
@@ -1706,32 +2495,7 @@ function extractSubagentText(payload, options) {
   return canonicalStringify(scrubValue(payload, options.scrubOptions));
 }
 function fingerprintSource(payload, options) {
-  const toolInput = payload.tool_input;
-  if (toolInput && typeof toolInput === "object") {
-    const input = toolInput;
-    return scrubValue(
-      {
-        description: input.description ?? "",
-        prompt: input.prompt ?? ""
-      },
-      options.scrubOptions
-    );
-  }
-  const task = payload.task;
-  if (typeof task === "string") {
-    return scrubValue({ task }, options.scrubOptions);
-  }
-  if (task && typeof task === "object") {
-    const taskObj = task;
-    return scrubValue(
-      {
-        description: taskObj.description ?? "",
-        prompt: taskObj.prompt ?? ""
-      },
-      options.scrubOptions
-    );
-  }
-  return scrubValue(payload, options.scrubOptions);
+  return subagentFingerprintSource(payload, options.scrubOptions ?? {});
 }
 function classifySubagent(payload, repoRoot, options = {}) {
   const kind = payload.tool_name === "Task" ? "Task" : String(payload.subagent_type ?? "generalPurpose");
@@ -1759,7 +2523,7 @@ function classifySubagent(payload, repoRoot, options = {}) {
 }
 
 // src/core/classify-tool.ts
-import path16 from "node:path";
+import path21 from "node:path";
 
 // src/core/glob.ts
 function matchesSensitivePath(filePath, patterns) {
@@ -1805,6 +2569,10 @@ function matchesSensitivePath(filePath, patterns) {
 }
 
 // src/core/verdict/judge-audit.ts
+import { createHash as createHash3 } from "node:crypto";
+function hashJudgeSessionRef(value) {
+  return createHash3("sha256").update(value).digest("hex").slice(0, 16);
+}
 function judgeTraceAuditFields(trace) {
   if (!trace) {
     return {};
@@ -1815,121 +2583,40 @@ function judgeTraceAuditFields(trace) {
     judgeModelResolved: trace.modelResolved,
     judgeLatencyMs: trace.latencyMs,
     ...trace.outboundRedacted !== void 0 ? { judgeOutboundRedacted: trace.outboundRedacted } : {},
-    ...trace.fallbackReason ? { judgeFallbackReason: trace.fallbackReason } : {}
+    ...trace.judgeFallbackReason ? { judgeFallbackReason: trace.judgeFallbackReason } : trace.fallbackReason ? { judgeFallbackReason: trace.fallbackReason } : {},
+    ...trace.judgeSessionUsed !== void 0 ? { judgeSessionUsed: trace.judgeSessionUsed } : {},
+    ...trace.judgeSessionReused !== void 0 ? { judgeSessionReused: trace.judgeSessionReused } : {},
+    ...trace.judgeSessionRefHash ? { judgeSessionRefHash: trace.judgeSessionRefHash } : {},
+    ...trace.judgeSessionResetReason ? { judgeSessionResetReason: trace.judgeSessionResetReason } : {},
+    ...trace.judgeConnectMs !== void 0 ? { judgeConnectMs: trace.judgeConnectMs } : {},
+    ...trace.judgeEvalMs !== void 0 ? { judgeEvalMs: trace.judgeEvalMs } : {},
+    ...trace.judgeParseMs !== void 0 ? { judgeParseMs: trace.judgeParseMs } : {},
+    ...trace.judgeShadowCompared !== void 0 ? { judgeShadowCompared: trace.judgeShadowCompared } : {},
+    ...trace.judgeShadowMismatch !== void 0 ? { judgeShadowMismatch: trace.judgeShadowMismatch } : {},
+    ...trace.judgeShadowMismatchRateWindow !== void 0 ? { judgeShadowMismatchRateWindow: trace.judgeShadowMismatchRateWindow } : {},
+    ...trace.judgeKillSwitchTriggered !== void 0 ? { judgeKillSwitchTriggered: trace.judgeKillSwitchTriggered } : {}
   };
 }
 
-// src/adapters/layouts/codex.ts
-import path9 from "node:path";
-function runnerCommand2(platform, repoRoot, hookName, ...args) {
-  const hooksDir = path9.join(path9.resolve(repoRoot), ".codex", "hooks");
-  return buildRunnerInvocation(platform, hooksDir, repoRoot, hookName, ...args);
-}
-var codexLayout = {
-  name: "codex",
-  configPath(repoRoot) {
-    return path9.join(repoRoot, ".codex", "belay.config.json");
-  },
-  // Codex reads lifecycle hooks from `.codex/config.toml` (project layer).
-  hooksSettingsPath(repoRoot) {
-    return path9.join(repoRoot, ".codex", "config.toml");
-  },
-  hooksDir(repoRoot) {
-    return path9.join(repoRoot, ".codex", "hooks");
-  },
-  runtimeDir(repoRoot) {
-    return path9.join(repoRoot, ".codex", "belay", "runtime");
-  },
-  repoLocalStateDir(repoRoot) {
-    return path9.join(repoRoot, ".codex", "belay");
-  },
-  defaultAuditLogPath(_repoRoot) {
-    return path9.join(".codex", "belay", "audit.ndjson");
-  },
-  repoRootMarkers: [".git", ".codex"],
-  runnerCommand: runnerCommand2,
-  defaultConfig(repoRoot) {
-    return {
-      ...DEFAULT_CONFIG_V4,
-      adapter: "codex",
-      audit: {
-        ...DEFAULT_CONFIG_V4.audit,
-        logPath: codexLayout.defaultAuditLogPath(repoRoot)
-      }
-    };
-  }
-};
-
-// src/adapters/layouts/cursor.ts
-import path10 from "node:path";
-function runnerCommand3(platform, repoRoot, hookName, ...args) {
-  const hooksDir = path10.join(path10.resolve(repoRoot), ".cursor", "hooks");
-  return buildRunnerInvocation(platform, hooksDir, repoRoot, hookName, ...args);
-}
-var cursorLayout = {
-  name: "cursor",
-  configPath(repoRoot) {
-    return path10.join(repoRoot, ".cursor", "belay.config.json");
-  },
-  hooksSettingsPath(repoRoot) {
-    return path10.join(repoRoot, ".cursor", "hooks.json");
-  },
-  hooksDir(repoRoot) {
-    return path10.join(repoRoot, ".cursor", "hooks");
-  },
-  runtimeDir(repoRoot) {
-    return path10.join(repoRoot, ".cursor", "belay", "runtime");
-  },
-  repoLocalStateDir(repoRoot) {
-    return path10.join(repoRoot, ".cursor", "belay");
-  },
-  defaultAuditLogPath(_repoRoot) {
-    return path10.join(".cursor", "belay", "audit.ndjson");
-  },
-  repoRootMarkers: [".git", ".cursor"],
-  runnerCommand: runnerCommand3,
-  defaultConfig(repoRoot) {
-    return {
-      ...DEFAULT_CONFIG_V4,
-      adapter: "cursor",
-      audit: {
-        ...DEFAULT_CONFIG_V4.audit,
-        logPath: cursorLayout.defaultAuditLogPath(repoRoot)
-      }
-    };
-  }
-};
-
-// src/adapters/layouts/index.ts
-var layouts = {
-  cursor: cursorLayout,
-  claude: claudeLayout,
-  codex: codexLayout
-};
-function getAdapterLayout(name = "cursor") {
-  return layouts[name];
-}
-
-// src/config-io.ts
-function resolveAdapterName(config) {
-  if (config.adapter === "claude") {
-    return "claude";
+// src/core/verdict/judge-baseline.ts
+var samples = [];
+var MAX_SAMPLES = 2e3;
+function recordJudgeLatency(phase, latencyMs, at = Date.now()) {
+  if (!Number.isFinite(latencyMs) || latencyMs < 0) {
+    return;
   }
-  if (config.adapter === "codex") {
-    return "codex";
+  samples.push({ phase, latencyMs, at });
+  if (samples.length > MAX_SAMPLES) {
+    samples.splice(0, samples.length - MAX_SAMPLES);
   }
-  return "cursor";
-}
-function repoLocalStateDirFor(repoRoot, config) {
-  return getAdapterLayout(resolveAdapterName(config)).repoLocalStateDir(repoRoot);
 }
 
 // src/core/credential-store.ts
 import { chmod, mkdir as mkdir2, readFile as readFile2, unlink, writeFile as writeFile2 } from "node:fs/promises";
-import path11 from "node:path";
+import path14 from "node:path";
 var STORE_FILENAME = "credentials.json";
 function credentialStorePath(stateDir) {
-  return path11.join(stateDir, STORE_FILENAME);
+  return path14.join(stateDir, STORE_FILENAME);
 }
 async function readJudgeCredentialStore(stateDir) {
   const filePath = credentialStorePath(stateDir);
@@ -1954,7 +2641,7 @@ function parseCredentialRef(ref) {
 
 // src/core/judge-runtime-detection.ts
 import { accessSync, constants } from "node:fs";
-import path12 from "node:path";
+import path15 from "node:path";
 var CLI_COMMANDS = {
   codex: "codex",
   cursor: "cursor-agent",
@@ -1971,8 +2658,8 @@ function cliTransportForProvider(providerId) {
 }
 function commandOnPath(command, env) {
   const pathValue = env.PATH ?? "";
-  for (const dir of pathValue.split(path12.delimiter).filter(Boolean)) {
-    const candidate = path12.join(dir, command);
+  for (const dir of pathValue.split(path15.delimiter).filter(Boolean)) {
+    const candidate = path15.join(dir, command);
     try {
       accessSync(candidate, constants.X_OK);
       return true;
@@ -2099,7 +2786,7 @@ function hasValidCloudConsent(judge) {
 }
 
 // src/core/verdict/containment.ts
-import path13 from "node:path";
+import path16 from "node:path";
 
 // src/core/verdict/persistent-paths.ts
 function isPersistentAgentPath(resolvedPath) {
@@ -2118,7 +2805,7 @@ function expandHome(token) {
     if (!home) {
       return token;
     }
-    return token === "~" ? home : path13.join(home, token.slice(2));
+    return token === "~" ? home : path16.join(home, token.slice(2));
   }
   return token;
 }
@@ -2130,16 +2817,16 @@ function resolveTrustedPath(token, trustedCwd, trusted) {
     return null;
   }
   const expanded = expandHome(token);
-  if (path13.isAbsolute(expanded)) {
+  if (path16.isAbsolute(expanded)) {
     return canonicalPath(expanded);
   }
-  return canonicalPath(path13.resolve(trustedCwd, expanded));
+  return canonicalPath(path16.resolve(trustedCwd, expanded));
 }
-function locationForPath(resolvedPath, repoRoot) {
+function locationForPath(resolvedPath, repoRoot, trustedWorkspaceRoots = []) {
   if (!resolvedPath) {
     return "unknown";
   }
-  if (pathWithinRoot(repoRoot, resolvedPath)) {
+  if (resolveWorkspaceRootMatch(repoRoot, trustedWorkspaceRoots, resolvedPath)) {
     return "repo_local";
   }
   return "repo_outside";
@@ -2150,17 +2837,17 @@ function isGitPath(resolvedPath, repoRoot) {
     return false;
   }
   const normalized = relative.replaceAll("\\", "/");
-  return normalized === ".git" || normalized.startsWith(".git/");
+  return normalized === ".git" || normalized.startsWith(".git/") || normalized.endsWith("/.git") || normalized.includes("/.git/");
 }
-function isHighStakesPath(resolvedPath, repoRoot, sensitivePaths, protectedRoots = []) {
+function isHighStakesPath(resolvedPath, repoRoot, sensitivePaths, protectedRoots = [], trustedWorkspaceRoots = []) {
   if (isGitPath(resolvedPath, repoRoot)) {
     return true;
   }
-  const relative = relativeWithinRepo(repoRoot, resolvedPath);
-  if (relative !== null && matchesSensitivePath(relative.replaceAll("\\", "/"), sensitivePaths)) {
+  const workspaceMatch = resolveWorkspaceRootMatch(repoRoot, trustedWorkspaceRoots, resolvedPath);
+  if (workspaceMatch !== null && matchesSensitivePath(workspaceMatch.relativePath.replaceAll("\\", "/"), sensitivePaths)) {
     return true;
   }
-  if (relative === null && isOutsideRepoSecretCredentialPath(resolvedPath)) {
+  if ((workspaceMatch === null || workspaceMatch.kind === "trusted") && isOutsideRepoSecretCredentialPath(resolvedPath)) {
     return true;
   }
   return protectedRoots.some((root) => pathWithinRoot(root, resolvedPath));
@@ -2181,14 +2868,14 @@ function isDestructiveMutationHead(head) {
 function touchesProtectedRoot(resolvedPath, protectedRoots) {
   return protectedRoots.some((root) => pathWithinRoot(root, resolvedPath) || root === resolvedPath);
 }
-function isDestructiveHighStakesMutation(head, resolvedPath, repoRoot, sensitivePaths, protectedRoots = []) {
+function isDestructiveHighStakesMutation(head, resolvedPath, repoRoot, sensitivePaths, protectedRoots = [], trustedWorkspaceRoots = []) {
   if (touchesProtectedRoot(resolvedPath, protectedRoots)) {
     return true;
   }
   if (!isDestructiveMutationHead(head)) {
     return false;
   }
-  return isHighStakesPath(resolvedPath, repoRoot, sensitivePaths, []);
+  return isHighStakesPath(resolvedPath, repoRoot, sensitivePaths, [], trustedWorkspaceRoots);
 }
 function analyzePathTargets(params) {
   const signals = [];
@@ -2203,13 +2890,14 @@ function analyzePathTargets(params) {
   let isHighStakes = false;
   for (const target of params.targets) {
     const resolved = resolveTrustedPath(target, params.cwd, params.trustedCwd) ?? resolveMutationTarget(target, params.cwd);
-    const location2 = locationForPath(resolved, params.repoRoot);
+    const location2 = locationForPath(resolved, params.repoRoot, params.trustedWorkspaceRoots);
     locations.add(location2);
     if (resolved && isHighStakesPath(
       resolved,
       params.repoRoot,
       params.sensitivePaths,
-      params.protectedArtifactRoots
+      params.protectedArtifactRoots,
+      params.trustedWorkspaceRoots
     )) {
       isHighStakes = true;
       signals.push("high_stakes_path");
@@ -2376,8 +3064,12 @@ function prescanMutationTargets(params) {
     if (!resolved) {
       continue;
     }
-    const relative = relativeWithinRepo(params.repoRoot, resolved);
-    if (relative !== null && matchesSensitivePath(relative.replaceAll("\\", "/"), params.sensitivePaths)) {
+    const workspaceMatch = resolveWorkspaceRootMatch(
+      params.repoRoot,
+      params.trustedWorkspaceRoots,
+      resolved
+    );
+    if (workspaceMatch !== null && matchesSensitivePath(workspaceMatch.relativePath.replaceAll("\\", "/"), params.sensitivePaths)) {
       return {
         local_recoverable: false,
         destroys_outside_repo: false,
@@ -2385,7 +3077,7 @@ function prescanMutationTargets(params) {
         reason: "sensitive_path_mutation"
       };
     }
-    if (relative === null && isOutsideRepoSecretCredentialPath(resolved)) {
+    if ((workspaceMatch === null || workspaceMatch.kind === "trusted") && isOutsideRepoSecretCredentialPath(resolved)) {
       return {
         local_recoverable: false,
         destroys_outside_repo: false,
@@ -2605,19 +3297,1123 @@ function createOpenAiCompatibleJudge(options) {
       }
     }
   };
-  return judge;
-}
-function tier1RequiresAsk(verdict2) {
-  return !verdict2.local_recoverable || verdict2.destroys_history_or_secrets;
+  return judge;
+}
+function tier1RequiresAsk(verdict2) {
+  return !verdict2.local_recoverable || verdict2.destroys_history_or_secrets;
+}
+
+// src/core/verdict/judge-cli.ts
+import { spawn as spawn4 } from "node:child_process";
+
+// src/core/verdict/judge-session-guard.ts
+function buildJudgeSessionKey(parts) {
+  return [parts.providerId, parts.model, parts.repoRoot, parts.judgeMode, parts.cliVersion].join(
+    ":"
+  );
+}
+function evaluateSessionReuse(existing, requested, budget, config, now = Date.now(), incomingPromptBytes = 0) {
+  const sessionKey = buildJudgeSessionKey(requested);
+  if (!config.enabled) {
+    return { canReuse: false, resetReason: "session_disabled", sessionKey };
+  }
+  if (!config.providerAllowlist.includes(requested.providerId)) {
+    return { canReuse: false, resetReason: "provider_not_allowlisted", sessionKey };
+  }
+  if (!existing || !budget) {
+    return { canReuse: false, resetReason: "initial", sessionKey };
+  }
+  const existingKey = buildJudgeSessionKey(existing);
+  if (existingKey !== sessionKey) {
+    if (existing.providerId !== requested.providerId) {
+      return { canReuse: false, resetReason: "provider_mismatch", sessionKey };
+    }
+    if (existing.model !== requested.model) {
+      return { canReuse: false, resetReason: "model_mismatch", sessionKey };
+    }
+    if (existing.repoRoot !== requested.repoRoot) {
+      return { canReuse: false, resetReason: "repo_mismatch", sessionKey };
+    }
+    if (existing.judgeMode !== requested.judgeMode) {
+      return { canReuse: false, resetReason: "mode_mismatch", sessionKey };
+    }
+    if (existing.cliVersion !== requested.cliVersion) {
+      return { canReuse: false, resetReason: "cli_version_mismatch", sessionKey };
+    }
+    return { canReuse: false, resetReason: "provider_mismatch", sessionKey };
+  }
+  if (budget.turnCount >= config.maxTurns) {
+    return { canReuse: false, resetReason: "max_turns_exceeded", sessionKey };
+  }
+  if (now - budget.createdAtMs >= config.maxAgeMs) {
+    return { canReuse: false, resetReason: "max_age_exceeded", sessionKey };
+  }
+  if (now - budget.lastUsedAtMs >= config.maxIdleMs) {
+    return { canReuse: false, resetReason: "max_idle_exceeded", sessionKey };
+  }
+  if (budget.promptBytes + incomingPromptBytes > config.maxPromptBytes) {
+    return { canReuse: false, resetReason: "max_prompt_bytes_exceeded", sessionKey };
+  }
+  return { canReuse: true, sessionKey };
+}
+function exceedsPromptBudget(promptBytes, config, existingBudget = null) {
+  const total = (existingBudget?.promptBytes ?? 0) + promptBytes;
+  return total > config.maxPromptBytes;
+}
+function guardFailClosedFallbackReason(resetReason) {
+  switch (resetReason) {
+    case "parse_failure":
+      return "parse_error";
+    case "non_json_response":
+      return "non_json_response";
+    case "cli_error":
+      return "cli_error";
+    case "timeout":
+      return "timeout";
+    case "cli_version_mismatch":
+      return "version_mismatch";
+    case "kill_switch":
+      return "kill_switch";
+    case "session_disabled":
+      return "session_disabled";
+    case "provider_not_allowlisted":
+      return "provider_not_allowlisted";
+    case "max_prompt_bytes_exceeded":
+      return "guard_reset";
+    default:
+      return "guard_reset";
+  }
+}
+function transportFallbackToFailClosedReason(providerId, fallback) {
+  if (!fallback) {
+    return `${providerId}_cli_parse_error`;
+  }
+  if (fallback.endsWith("_cli_unavailable") || fallback.endsWith("_cli_parse_error")) {
+    return fallback;
+  }
+  switch (fallback) {
+    case "non_json_response":
+    case "parse_error":
+    case "parse_timeout":
+      return `${providerId}_cli_parse_error`;
+    default:
+      return `${providerId}_cli_unavailable`;
+  }
+}
+
+// src/core/verdict/judge-broker-service.ts
+import { spawn as spawn2 } from "node:child_process";
+import { existsSync as existsSync5 } from "node:fs";
+import { unlink as unlink2 } from "node:fs/promises";
+import net from "node:net";
+import path17 from "node:path";
+import { fileURLToPath } from "node:url";
+
+// src/core/verdict/judge-session-mutex.ts
+var AsyncMutex = class {
+  chain = Promise.resolve();
+  run(fn) {
+    const next = this.chain.then(fn);
+    this.chain = next.then(
+      () => void 0,
+      () => void 0
+    );
+    return next;
+  }
+};
+var MutexRegistry = class {
+  mutexes = /* @__PURE__ */ new Map();
+  forKey(key) {
+    const existing = this.mutexes.get(key);
+    if (existing) {
+      return existing;
+    }
+    const created = new AsyncMutex();
+    this.mutexes.set(key, created);
+    return created;
+  }
+  clear() {
+    this.mutexes.clear();
+  }
+};
+
+// src/core/verdict/judge-session-broker.ts
+var JudgeSessionBroker = class {
+  sessions = /* @__PURE__ */ new Map();
+  mutexes = new MutexRegistry();
+  options;
+  constructor(options) {
+    this.options = options;
+  }
+  listSessions() {
+    return [...this.sessions.values()];
+  }
+  invalidateSession(sessionKey, reason) {
+    const session = this.sessions.get(sessionKey);
+    if (session) {
+      session.lastResetReason = reason;
+      session.state = "idle";
+    }
+    this.sessions.delete(sessionKey);
+  }
+  stopAll(reason = "manual_stop") {
+    const count = this.sessions.size;
+    for (const session of this.sessions.values()) {
+      session.lastResetReason = reason;
+      session.state = "idle";
+    }
+    this.sessions.clear();
+    this.mutexes.clear();
+    return count;
+  }
+  async evaluate(request, timeoutMs) {
+    const sessionKey = buildJudgeSessionKey(request.keyParts);
+    return this.mutexes.forKey(sessionKey).run(() => this.evaluateExclusive(request, timeoutMs));
+  }
+  async evaluateExclusive(request, timeoutMs) {
+    const sessionKey = buildJudgeSessionKey(request.keyParts);
+    const providerId = request.keyParts.providerId;
+    const existing = this.sessions.get(sessionKey);
+    const reuseDecision = evaluateSessionReuse(
+      existing?.keyParts ?? null,
+      request.keyParts,
+      existing?.budget ?? null,
+      this.options.config,
+      Date.now(),
+      request.promptBytes
+    );
+    const resetReason = reuseDecision.canReuse ? void 0 : reuseDecision.resetReason;
+    let session = existing;
+    if (!reuseDecision.canReuse || !session) {
+      session = {
+        keyParts: request.keyParts,
+        budget: {
+          turnCount: 0,
+          createdAtMs: Date.now(),
+          lastUsedAtMs: Date.now(),
+          promptBytes: 0
+        },
+        state: "busy",
+        lastResetReason: resetReason ?? "initial"
+      };
+      this.enforceProviderSessionCap(providerId, sessionKey);
+      this.sessions.set(sessionKey, session);
+    } else {
+      session.state = "busy";
+      session.budget.lastUsedAtMs = Date.now();
+    }
+    const invocation = reuseDecision.canReuse && session.providerResumeId ? this.buildResumeInvocation(request.invocation, providerId, session.providerResumeId) : request.invocation;
+    const resumed = reuseDecision.canReuse && Boolean(session.providerResumeId);
+    try {
+      const raw = await this.options.runCommand(invocation, timeoutMs);
+      session.budget.turnCount += 1;
+      session.budget.promptBytes += request.promptBytes;
+      session.budget.lastUsedAtMs = Date.now();
+      session.state = "idle";
+      const extracted = this.options.extractResumeId?.(providerId, raw) ?? extractProviderResumeId(providerId, raw) ?? void 0;
+      if (extracted) {
+        session.providerResumeId = extracted;
+      }
+      return {
+        raw,
+        reused: resumed,
+        resetReason: session.lastResetReason,
+        providerResumeId: session.providerResumeId
+      };
+    } catch (error) {
+      session.state = "idle";
+      session.lastResetReason = "cli_error";
+      this.sessions.delete(sessionKey);
+      throw error;
+    }
+  }
+  enforceProviderSessionCap(providerId, keepKey) {
+    const cap = this.options.config.maxSessionsPerProvider;
+    const sameProvider = [...this.sessions.entries()].filter(
+      ([, record]) => record.keyParts.providerId === providerId
+    );
+    if (sameProvider.length < cap) {
+      return;
+    }
+    for (const [key] of sameProvider) {
+      if (key === keepKey) {
+        continue;
+      }
+      this.sessions.delete(key);
+      if (this.sessions.size < cap) {
+        break;
+      }
+    }
+  }
+  buildResumeInvocation(base, providerId, resumeId) {
+    if (providerId === "cursor") {
+      const args = [...base.args];
+      const modelIndex = args.indexOf("--model");
+      const model = modelIndex >= 0 ? args[modelIndex + 1] : void 0;
+      const prompt = args[args.length - 1];
+      return {
+        binary: base.binary,
+        args: [
+          "--print",
+          "--output-format",
+          "json",
+          "--mode",
+          "ask",
+          "--sandbox",
+          "enabled",
+          "--trust",
+          "--resume",
+          resumeId,
+          ...model ? ["--model", model] : [],
+          prompt
+        ]
+      };
+    }
+    if (providerId === "claude") {
+      return {
+        ...base,
+        args: [...base.args, "--continue", resumeId]
+      };
+    }
+    return base;
+  }
+};
+function extractProviderResumeId(providerId, raw) {
+  try {
+    const parsed = JSON.parse(raw);
+    const candidates = [
+      parsed.chat_id,
+      parsed.chatId,
+      parsed.session_id,
+      parsed.sessionId,
+      parsed.result?.chat_id,
+      parsed.result?.session_id
+    ];
+    for (const candidate of candidates) {
+      if (typeof candidate === "string" && candidate.trim()) {
+        return candidate.trim();
+      }
+    }
+  } catch {
+  }
+  if (providerId === "cursor") {
+    const match = raw.match(/"chat_id"\s*:\s*"([^"]+)"/);
+    if (match?.[1]) {
+      return match[1];
+    }
+  }
+  return null;
+}
+var repoBrokers = /* @__PURE__ */ new Map();
+function getRepoJudgeSessionBroker(repoRoot, options) {
+  const existing = repoBrokers.get(repoRoot);
+  if (existing) {
+    return existing;
+  }
+  const broker = new JudgeSessionBroker(options);
+  repoBrokers.set(repoRoot, broker);
+  return broker;
+}
+
+// src/core/verdict/judge-broker-service.ts
+var JUDGE_BROKER_SOCKET = "judge-broker.sock";
+var JUDGE_BROKER_STATUS = "judge-broker.json";
+var JUDGE_BROKER_PID = "judge-broker.pid";
+var JUDGE_BROKER_SESSION = "judge-broker-session.json";
+function judgeBrokerPaths(stateDir) {
+  return {
+    stateDir,
+    socketPath: path17.join(stateDir, JUDGE_BROKER_SOCKET),
+    statusPath: path17.join(stateDir, JUDGE_BROKER_STATUS),
+    pidPath: path17.join(stateDir, JUDGE_BROKER_PID),
+    sessionConfigPath: path17.join(stateDir, JUDGE_BROKER_SESSION)
+  };
+}
+function daemonScriptPath() {
+  return fileURLToPath(new URL("../../judge-broker-daemon.js", import.meta.url));
+}
+function isProcessAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function useInProcessBroker(env = process.env) {
+  return Boolean(env.VITEST || env.VITEST_WORKER_ID || env.BELAY_JUDGE_BROKER_IN_PROCESS === "1");
+}
+async function readBrokerStatus(statusPath) {
+  if (!existsSync5(statusPath)) {
+    return null;
+  }
+  try {
+    const { readFile: readFile6 } = await import("node:fs/promises");
+    const raw = JSON.parse(await readFile6(statusPath, "utf8"));
+    if (typeof raw.pid !== "number" || typeof raw.socketPath !== "string") {
+      return null;
+    }
+    return raw;
+  } catch {
+    return null;
+  }
+}
+async function readBrokerSessionConfig(sessionConfigPath) {
+  if (!existsSync5(sessionConfigPath)) {
+    return null;
+  }
+  try {
+    const { readFile: readFile6 } = await import("node:fs/promises");
+    const raw = JSON.parse(
+      await readFile6(sessionConfigPath, "utf8")
+    );
+    return normalizeJudgeSessionConfig({ ...raw, enabled: true });
+  } catch {
+    return null;
+  }
+}
+function brokerSessionConfigPayload(sessionConfig) {
+  return JSON.stringify(normalizeJudgeSessionConfig({ ...sessionConfig, enabled: true }));
+}
+async function writeBrokerSessionConfig(paths, sessionConfig) {
+  const { writeFile: writeFile6 } = await import("node:fs/promises");
+  await writeFile6(paths.sessionConfigPath, brokerSessionConfigPayload(sessionConfig), {
+    encoding: "utf8",
+    mode: 384
+  });
+}
+async function connectBrokerSocket(socketPath, timeoutMs) {
+  return new Promise((resolve, reject) => {
+    const socket = net.createConnection(socketPath);
+    const timer = setTimeout(() => {
+      socket.destroy();
+      reject(new Error("judge broker connect timed out"));
+    }, timeoutMs);
+    socket.once("connect", () => {
+      clearTimeout(timer);
+      resolve(socket);
+    });
+    socket.once("error", (error) => {
+      clearTimeout(timer);
+      reject(error);
+    });
+  });
+}
+async function rpcEvaluate(socketPath, request, timeoutMs, connectTimeoutMs) {
+  const socket = await connectBrokerSocket(socketPath, connectTimeoutMs);
+  const id = `${Date.now()}-${Math.random().toString(36).slice(2)}`;
+  const payload = JSON.stringify({
+    type: "evaluate",
+    id,
+    request,
+    timeoutMs
+  });
+  return new Promise((resolve, reject) => {
+    let buffer = "";
+    const timer = setTimeout(() => {
+      socket.destroy();
+      reject(new Error("judge broker evaluate timed out"));
+    }, timeoutMs + connectTimeoutMs);
+    const onData = (chunk) => {
+      buffer += String(chunk);
+      const lines = buffer.split("\n");
+      buffer = lines.pop() ?? "";
+      for (const line of lines) {
+        if (!line.trim()) {
+          continue;
+        }
+        try {
+          const message = JSON.parse(line);
+          if (message.id !== id) {
+            continue;
+          }
+          clearTimeout(timer);
+          socket.destroy();
+          if (message.type === "error") {
+            reject(new Error(message.error ?? "judge broker error"));
+            return;
+          }
+          if (message.result) {
+            resolve(message.result);
+          }
+        } catch {
+        }
+      }
+    };
+    socket.on("data", onData);
+    socket.on("error", (error) => {
+      clearTimeout(timer);
+      reject(error);
+    });
+    socket.write(`${payload}
+`);
+  });
+}
+async function ensureJudgeBrokerDaemon(stateDir, repoRoot, sessionConfig) {
+  const paths = judgeBrokerPaths(stateDir);
+  const brokerSessionConfig = normalizeJudgeSessionConfig({ ...sessionConfig, enabled: true });
+  const nextConfigPayload = brokerSessionConfigPayload(brokerSessionConfig);
+  const existingConfig = await readBrokerSessionConfig(paths.sessionConfigPath);
+  const configChanged = existingConfig !== null && brokerSessionConfigPayload(existingConfig) !== nextConfigPayload;
+  const status = await readBrokerStatus(paths.statusPath);
+  if (status && isProcessAlive(status.pid) && existsSync5(paths.socketPath) && !configChanged) {
+    await writeBrokerSessionConfig(paths, brokerSessionConfig);
+    return paths;
+  }
+  if (status?.pid && isProcessAlive(status.pid)) {
+    await stopJudgeBrokerDaemon(stateDir);
+  } else {
+    await cleanupJudgeBrokerArtifacts(paths);
+  }
+  await writeBrokerSessionConfig(paths, brokerSessionConfig);
+  const child = spawn2(process.execPath, [daemonScriptPath()], {
+    detached: true,
+    stdio: "ignore",
+    env: {
+      ...process.env,
+      BELAY_JUDGE_BROKER_REPO_ROOT: repoRoot,
+      BELAY_JUDGE_BROKER_STATE_DIR: stateDir
+    }
+  });
+  child.unref();
+  const deadline = Date.now() + sessionConfig.connectTimeoutMs;
+  while (Date.now() < deadline) {
+    if (existsSync5(paths.socketPath)) {
+      const live = await readBrokerStatus(paths.statusPath);
+      if (live && isProcessAlive(live.pid)) {
+        return paths;
+      }
+    }
+    await new Promise((resolve) => setTimeout(resolve, 25));
+  }
+  throw new Error("judge broker daemon failed to start");
+}
+async function cleanupJudgeBrokerArtifacts(paths) {
+  for (const artifact of [
+    paths.socketPath,
+    paths.statusPath,
+    paths.pidPath,
+    paths.sessionConfigPath
+  ]) {
+    if (existsSync5(artifact)) {
+      await unlink2(artifact).catch(() => void 0);
+    }
+  }
+}
+async function stopJudgeBrokerDaemon(stateDir) {
+  const paths = judgeBrokerPaths(stateDir);
+  const status = await readBrokerStatus(paths.statusPath);
+  if (status?.pid && isProcessAlive(status.pid)) {
+    try {
+      process.kill(status.pid, "SIGTERM");
+    } catch {
+    }
+  }
+  await cleanupJudgeBrokerArtifacts(paths);
+  return status?.pid ? 1 : 0;
+}
+async function evaluateViaJudgeBroker(options) {
+  const runCommand = options.runCommand ?? ((invocation, timeout) => runCliJsonWithTimeouts(invocation, { evalTimeoutMs: timeout }));
+  if (useInProcessBroker()) {
+    const broker = getRepoJudgeSessionBroker(options.repoRoot, {
+      config: options.sessionConfig,
+      runCommand
+    });
+    return broker.evaluate(options.request, options.timeoutMs);
+  }
+  const paths = await ensureJudgeBrokerDaemon(
+    options.stateDir,
+    options.repoRoot,
+    options.sessionConfig
+  );
+  return rpcEvaluate(
+    paths.socketPath,
+    options.request,
+    options.timeoutMs,
+    options.sessionConfig.connectTimeoutMs
+  );
+}
+async function rpcInvalidate(socketPath, sessionKey, reason, connectTimeoutMs) {
+  const socket = await connectBrokerSocket(socketPath, connectTimeoutMs);
+  const id = `${Date.now()}-${Math.random().toString(36).slice(2)}`;
+  const payload = JSON.stringify({ type: "invalidate", id, sessionKey, reason });
+  await new Promise((resolve, reject) => {
+    let buffer = "";
+    const timer = setTimeout(() => {
+      socket.destroy();
+      reject(new Error("judge broker invalidate timed out"));
+    }, connectTimeoutMs);
+    const onData = (chunk) => {
+      buffer += String(chunk);
+      const lines = buffer.split("\n");
+      buffer = lines.pop() ?? "";
+      for (const line of lines) {
+        if (!line.trim()) {
+          continue;
+        }
+        try {
+          const message = JSON.parse(line);
+          if (message.id !== id) {
+            continue;
+          }
+          clearTimeout(timer);
+          socket.destroy();
+          resolve();
+        } catch {
+        }
+      }
+    };
+    socket.on("data", onData);
+    socket.on("error", (error) => {
+      clearTimeout(timer);
+      reject(error);
+    });
+    socket.write(`${payload}
+`);
+  });
+}
+async function invalidateJudgeSession(options) {
+  if (useInProcessBroker()) {
+    const broker = getRepoJudgeSessionBroker(options.repoRoot, {
+      config: { ...options.sessionConfig, enabled: true },
+      runCommand: (invocation, timeout) => runCliJsonWithTimeouts(invocation, { evalTimeoutMs: timeout })
+    });
+    broker.invalidateSession(options.sessionKey, options.reason);
+    return;
+  }
+  const paths = await ensureJudgeBrokerDaemon(
+    options.stateDir,
+    options.repoRoot,
+    options.sessionConfig
+  );
+  await rpcInvalidate(
+    paths.socketPath,
+    options.sessionKey,
+    options.reason,
+    options.sessionConfig.connectTimeoutMs
+  );
+}
+
+// src/core/verdict/judge-cli-fingerprint.ts
+import { spawn as spawn3 } from "node:child_process";
+var CLI_BINARIES = {
+  codex: "codex",
+  cursor: "cursor-agent",
+  claude: "claude"
+};
+var fingerprintResolver = null;
+var fingerprintCache = /* @__PURE__ */ new Map();
+async function runVersionProbe(binary, timeoutMs) {
+  return new Promise((resolve, reject) => {
+    const child = spawn3(binary, ["--version"], { stdio: ["ignore", "pipe", "pipe"] });
+    let stdout = "";
+    let stderr = "";
+    const timer = setTimeout(() => {
+      child.kill("SIGTERM");
+      reject(new Error(`${binary} --version timed out`));
+    }, timeoutMs);
+    child.stdout.on("data", (chunk) => {
+      stdout += String(chunk);
+    });
+    child.stderr.on("data", (chunk) => {
+      stderr += String(chunk);
+    });
+    child.on("error", (error) => {
+      clearTimeout(timer);
+      reject(error);
+    });
+    child.on("close", (code) => {
+      clearTimeout(timer);
+      const output = (stdout || stderr).trim();
+      if (code === 0 && output) {
+        resolve(output.split(/\r?\n/)[0]?.trim() || output);
+        return;
+      }
+      reject(
+        new Error(stderr.trim() || `${binary} --version exited with code ${code ?? "unknown"}`)
+      );
+    });
+  });
+}
+async function resolveCliVersionFingerprint(providerId, timeoutMs = 3e3) {
+  const cacheKey = providerId;
+  const cached = fingerprintCache.get(cacheKey);
+  if (cached) {
+    return cached;
+  }
+  if (fingerprintResolver) {
+    const resolved = await fingerprintResolver(providerId);
+    fingerprintCache.set(cacheKey, resolved);
+    return resolved;
+  }
+  const binary = CLI_BINARIES[providerId];
+  const version = await runVersionProbe(binary, timeoutMs);
+  fingerprintCache.set(cacheKey, version);
+  return version;
+}
+
+// src/core/verdict/judge-provider-matrix.ts
+var JUDGE_PROVIDER_SESSION_MATRIX = {
+  cursor: {
+    providerId: "cursor",
+    supportsSession: true,
+    resumeFlag: "--resume",
+    createChatFlag: null,
+    readOnlyArgs: ["--mode", "ask", "--sandbox", "enabled", "--trust"],
+    rejectedUnsafeOptions: ["--force", "--yolo", "--dangerously-skip-permissions"],
+    failureModes: [
+      "parse_error",
+      "non_json_response",
+      "timeout",
+      "cli_nonzero_exit",
+      "io_error",
+      "version_mismatch"
+    ],
+    notes: "Pilot provider: ask mode + sandbox enabled; resume via --resume <chatId>."
+  },
+  codex: {
+    providerId: "codex",
+    supportsSession: false,
+    resumeFlag: null,
+    createChatFlag: null,
+    readOnlyArgs: ["--sandbox", "read-only"],
+    rejectedUnsafeOptions: ["--dangerously-bypass-approvals-and-sandbox"],
+    failureModes: ["unsupported_resume", "parse_error", "timeout"],
+    notes: "Session transport disabled by default; spawn read-only exec remains canonical."
+  },
+  claude: {
+    providerId: "claude",
+    supportsSession: false,
+    resumeFlag: "--continue",
+    createChatFlag: null,
+    readOnlyArgs: ["--permission-mode", "plan", "--tools", "", "--bare"],
+    rejectedUnsafeOptions: ["--dangerously-skip-permissions"],
+    failureModes: ["unsupported_resume", "parse_error", "timeout"],
+    notes: "Session transport gated behind allowlist after capability verification."
+  }
+};
+function providerSupportsSession(providerId, allowlist) {
+  const capability = JUDGE_PROVIDER_SESSION_MATRIX[providerId];
+  return capability.supportsSession && allowlist.includes(providerId);
+}
+function assertReadOnlyInvocationArgs(providerId, args) {
+  const capability = JUDGE_PROVIDER_SESSION_MATRIX[providerId];
+  for (const unsafe of capability.rejectedUnsafeOptions) {
+    if (args.includes(unsafe)) {
+      return { ok: false, reason: "unsafe_option_rejected" };
+    }
+  }
+  for (let index = 0; index < capability.readOnlyArgs.length; index += 2) {
+    const flag = capability.readOnlyArgs[index];
+    const value = capability.readOnlyArgs[index + 1];
+    if (!flag) {
+      continue;
+    }
+    const flagIndex = args.indexOf(flag);
+    if (flagIndex === -1) {
+      return { ok: false, reason: "unsafe_option_rejected" };
+    }
+    if (value !== void 0 && args[flagIndex + 1] !== value) {
+      return { ok: false, reason: "unsafe_option_rejected" };
+    }
+  }
+  return { ok: true };
+}
+
+// src/core/verdict/judge-session-kill-switch.ts
+import { existsSync as existsSync6 } from "node:fs";
+import { mkdir as mkdir3, readFile as readFile3, unlink as unlink3, writeFile as writeFile3 } from "node:fs/promises";
+import path18 from "node:path";
+var JUDGE_SESSION_KILL_FILE = "judge-session-kill.json";
+function judgeSessionKillSwitchPath(stateDir) {
+  return path18.join(stateDir, JUDGE_SESSION_KILL_FILE);
+}
+async function readJudgeSessionKillSwitch(stateDir) {
+  const filePath = judgeSessionKillSwitchPath(stateDir);
+  if (!existsSync6(filePath)) {
+    return null;
+  }
+  try {
+    const raw = JSON.parse(await readFile3(filePath, "utf8"));
+    return raw.triggered === true ? raw : null;
+  } catch {
+    return null;
+  }
+}
+async function isJudgeSessionKillSwitchPersisted(stateDir) {
+  const record = await readJudgeSessionKillSwitch(stateDir);
+  return record?.triggered === true;
+}
+async function persistJudgeSessionKillSwitch(stateDir, reason = "shadow_mismatch") {
+  await mkdir3(stateDir, { recursive: true, mode: 448 });
+  const record = {
+    triggered: true,
+    at: (/* @__PURE__ */ new Date()).toISOString(),
+    reason
+  };
+  await writeFile3(judgeSessionKillSwitchPath(stateDir), JSON.stringify(record), {
+    encoding: "utf8",
+    mode: 384
+  });
+}
+
+// src/core/verdict/judge-shadow.ts
+var shadowStates = /* @__PURE__ */ new Map();
+var clock = () => /* @__PURE__ */ new Date();
+var random = Math.random;
+function dailyKeyFor(date) {
+  return date.toISOString().slice(0, 10);
+}
+function getShadowState(repoRoot) {
+  const existing = shadowStates.get(repoRoot);
+  if (existing) {
+    const key = dailyKeyFor(clock());
+    if (existing.dailyKey !== key) {
+      existing.dailyCount = 0;
+      existing.dailyKey = key;
+    }
+    return existing;
+  }
+  const created = {
+    compared: 0,
+    mismatches: 0,
+    dailyCount: 0,
+    dailyKey: dailyKeyFor(clock()),
+    killSwitchTriggered: false,
+    mismatchWindow: []
+  };
+  shadowStates.set(repoRoot, created);
+  return created;
+}
+async function isJudgeSessionKillSwitchActive(repoRoot, stateDir) {
+  if (getShadowState(repoRoot).killSwitchTriggered) {
+    return true;
+  }
+  if (stateDir) {
+    return isJudgeSessionKillSwitchPersisted(stateDir);
+  }
+  return false;
+}
+async function triggerJudgeSessionKillSwitch(repoRoot, stateDir, reason = "shadow_mismatch") {
+  getShadowState(repoRoot).killSwitchTriggered = true;
+  if (stateDir) {
+    await persistJudgeSessionKillSwitch(stateDir, reason);
+  }
+}
+function shouldRunShadowComparison(repoRoot, providerId, config) {
+  if (!config.enabled) {
+    return false;
+  }
+  if (!config.providerAllowlist.includes(providerId)) {
+    return false;
+  }
+  const state = getShadowState(repoRoot);
+  if (state.killSwitchTriggered) {
+    return false;
+  }
+  if (state.dailyCount >= config.dailyRequestCap) {
+    return false;
+  }
+  const rate = Math.min(config.sampleRate, config.sampleRateMax);
+  return random() < rate;
+}
+function verdictsEquivalent(a, b) {
+  return a.local_recoverable === b.local_recoverable && a.destroys_history_or_secrets === b.destroys_history_or_secrets;
+}
+function recordShadowComparison(repoRoot, config, mismatch) {
+  const state = getShadowState(repoRoot);
+  state.compared += 1;
+  state.dailyCount += 1;
+  if (mismatch) {
+    state.mismatches += 1;
+  }
+  state.mismatchWindow.push(mismatch);
+  if (state.mismatchWindow.length > config.windowSize) {
+    state.mismatchWindow.shift();
+  }
+  const windowComparisons = state.mismatchWindow.length;
+  const windowMismatches = state.mismatchWindow.filter(Boolean).length;
+  const mismatchRateWindow = windowComparisons === 0 ? 0 : windowMismatches / windowComparisons;
+  if (windowComparisons >= Math.min(10, config.windowSize) && mismatchRateWindow > config.mismatchRateThreshold) {
+    state.killSwitchTriggered = true;
+  }
+  return {
+    compared: true,
+    mismatch,
+    mismatchRateWindow,
+    killSwitchTriggered: state.killSwitchTriggered
+  };
+}
+
+// src/core/verdict/judge-transport.ts
+function isEvalTimeoutError(error) {
+  const message = error instanceof Error ? error.message : String(error);
+  return /timed out/i.test(message);
+}
+function classifyParseFailure(providerId, raw) {
+  const trimmed = raw.trim();
+  if (!trimmed) {
+    return "non_json_response";
+  }
+  if (parseCliJudgeOutput(providerId, trimmed)) {
+    return "parse_error";
+  }
+  try {
+    JSON.parse(trimmed);
+    return "parse_error";
+  } catch {
+    return "non_json_response";
+  }
+}
+function spawnFallbackReason(providerId, error) {
+  if (error instanceof CliRunError) {
+    if (error.kind === "timeout") {
+      return "eval_timeout";
+    }
+    if (error.kind === "exit_nonzero") {
+      return `${providerId}_cli_nonzero`;
+    }
+    if (error.kind === "spawn_error") {
+      return `${providerId}_cli_spawn_error`;
+    }
+  }
+  if (isEvalTimeoutError(error)) {
+    return "eval_timeout";
+  }
+  return `${providerId}_cli_unavailable`;
+}
+function parseWithBudget(providerId, raw) {
+  const started = Date.now();
+  const verdict2 = parseCliJudgeOutput(providerId, raw);
+  const parseMs = Date.now() - started;
+  recordJudgeLatency("tier1_parse", parseMs);
+  return { verdict: verdict2, parseMs };
+}
+async function runSpawnTransport(request, runCommand) {
+  const { context, prompt } = request;
+  const sessionConfig = context.runtime.session;
+  const invocation = buildCliInvocation(context.providerId, prompt, context.model);
+  const readOnly = assertReadOnlyInvocationArgs(context.providerId, invocation.args);
+  if (!readOnly.ok) {
+    return {
+      raw: "",
+      verdict: null,
+      transport: "spawn",
+      sessionUsed: false,
+      sessionReused: false,
+      fallbackReason: "unsafe_option_rejected",
+      connectMs: 0,
+      evalMs: 0,
+      parseMs: 0
+    };
+  }
+  const evalTimeoutMs = resolveSessionEvalTimeoutMs(sessionConfig, context.judgeTimeoutMs);
+  let raw = "";
+  let evalMs = 0;
+  const evalStarted = Date.now();
+  try {
+    raw = await runCommand(invocation, evalTimeoutMs);
+    evalMs = Date.now() - evalStarted;
+    recordJudgeLatency("tier1_spawn", evalMs);
+  } catch (error) {
+    evalMs = Date.now() - evalStarted;
+    return {
+      raw: "",
+      verdict: null,
+      transport: "spawn",
+      sessionUsed: false,
+      sessionReused: false,
+      fallbackReason: spawnFallbackReason(context.providerId, error),
+      connectMs: 0,
+      evalMs,
+      parseMs: 0
+    };
+  }
+  const parsed = parseWithBudget(context.providerId, raw);
+  return {
+    raw,
+    verdict: parsed.verdict,
+    transport: "spawn",
+    sessionUsed: false,
+    sessionReused: false,
+    fallbackReason: parsed.verdict ? void 0 : classifyParseFailure(context.providerId, raw),
+    connectMs: 0,
+    evalMs,
+    parseMs: parsed.parseMs
+  };
+}
+async function runSessionTransport(request, runCommand) {
+  const { context, prompt } = request;
+  const sessionConfig = context.runtime.session;
+  const connectStarted = Date.now();
+  if (!sessionConfig.enabled || !providerSupportsSession(context.providerId, sessionConfig.providerAllowlist) || await isJudgeSessionKillSwitchActive(context.repoRoot, context.stateDir)) {
+    return runSpawnTransport(request, runCommand);
+  }
+  let cliVersion = "unknown";
+  try {
+    cliVersion = await resolveCliVersionFingerprint(
+      context.providerId,
+      sessionConfig.connectTimeoutMs
+    );
+  } catch {
+    return {
+      ...await runSpawnTransport(request, runCommand),
+      fallbackReason: "connect_timeout",
+      sessionUsed: false,
+      sessionReused: false
+    };
+  }
+  const connectMs = Date.now() - connectStarted;
+  recordJudgeLatency("tier1_connect", connectMs);
+  const promptBytes = Buffer.byteLength(prompt, "utf8");
+  if (exceedsPromptBudget(promptBytes, sessionConfig)) {
+    const spawnResult = await runSpawnTransport(request, runCommand);
+    return {
+      ...spawnResult,
+      sessionUsed: false,
+      sessionReused: false,
+      sessionResetReason: "max_prompt_bytes_exceeded",
+      fallbackReason: "guard_reset"
+    };
+  }
+  const keyParts = {
+    providerId: context.providerId,
+    model: context.model,
+    repoRoot: context.repoRoot,
+    judgeMode: context.judgeMode,
+    cliVersion
+  };
+  const sessionKey = buildJudgeSessionKey(keyParts);
+  const sessionRefHash = hashJudgeSessionRef(sessionKey);
+  const invocation = buildCliInvocation(context.providerId, prompt, context.model);
+  const readOnly = assertReadOnlyInvocationArgs(context.providerId, invocation.args);
+  if (!readOnly.ok) {
+    return runSpawnTransport(request, runCommand);
+  }
+  const evalTimeoutMs = resolveSessionEvalTimeoutMs(sessionConfig, context.judgeTimeoutMs);
+  const evalStarted = Date.now();
+  let brokerResult;
+  try {
+    brokerResult = await evaluateViaJudgeBroker({
+      stateDir: context.stateDir,
+      repoRoot: context.repoRoot,
+      sessionConfig,
+      request: {
+        keyParts,
+        invocation,
+        promptBytes
+      },
+      timeoutMs: evalTimeoutMs,
+      runCommand
+    });
+  } catch (error) {
+    const spawnResult = await runSpawnTransport(request, runCommand);
+    return {
+      ...spawnResult,
+      transport: "session",
+      sessionUsed: true,
+      sessionReused: false,
+      fallbackReason: spawnFallbackReason(context.providerId, error),
+      sessionResetReason: "cli_error",
+      sessionRefHash
+    };
+  }
+  const evalMs = Date.now() - evalStarted;
+  recordJudgeLatency("tier1_session", evalMs);
+  recordJudgeLatency("tier1_eval", evalMs);
+  const parsed = parseWithBudget(context.providerId, brokerResult.raw);
+  if (!parsed.verdict) {
+    const parseReason = classifyParseFailure(context.providerId, brokerResult.raw);
+    await invalidateJudgeSession({
+      stateDir: context.stateDir,
+      repoRoot: context.repoRoot,
+      sessionConfig,
+      sessionKey,
+      reason: parseReason === "non_json_response" ? "non_json_response" : "parse_failure"
+    });
+    const spawnResult = await runSpawnTransport(request, runCommand);
+    return {
+      ...spawnResult,
+      transport: "session",
+      sessionUsed: true,
+      sessionReused: brokerResult.reused,
+      fallbackReason: guardFailClosedFallbackReason(
+        parseReason === "non_json_response" ? "non_json_response" : "parse_failure"
+      ),
+      sessionResetReason: parseReason === "non_json_response" ? "non_json_response" : "parse_failure",
+      sessionRefHash
+    };
+  }
+  return {
+    raw: brokerResult.raw,
+    verdict: parsed.verdict,
+    transport: "session",
+    sessionUsed: true,
+    sessionReused: brokerResult.reused,
+    sessionResetReason: brokerResult.resetReason,
+    sessionRefHash,
+    connectMs,
+    evalMs,
+    parseMs: parsed.parseMs
+  };
+}
+async function evaluateWithJudgeTransport(request, options = {}) {
+  const runCommand = options.runCommand ?? ((invocation, timeoutMs) => runCliJsonWithTimeouts(invocation, { evalTimeoutMs: timeoutMs }));
+  const { context } = request;
+  const useSession = context.runtime.session.enabled && providerSupportsSession(context.providerId, context.runtime.session.providerAllowlist) && !await isJudgeSessionKillSwitchActive(context.repoRoot, context.stateDir);
+  const primary = useSession ? await runSessionTransport(request, runCommand) : await runSpawnTransport(request, runCommand);
+  if (!shouldRunShadowComparison(context.repoRoot, context.providerId, context.runtime.shadow)) {
+    return primary;
+  }
+  const shadowSpawn = primary.transport === "session" ? await runSpawnTransport(request, runCommand) : primary;
+  if (!primary.verdict || !shadowSpawn.verdict) {
+    return primary;
+  }
+  const shadow = recordShadowComparison(
+    context.repoRoot,
+    context.runtime.shadow,
+    !verdictsEquivalent(primary.verdict, shadowSpawn.verdict)
+  );
+  if (shadow.killSwitchTriggered) {
+    await triggerJudgeSessionKillSwitch(context.repoRoot, context.stateDir);
+  }
+  return {
+    ...primary,
+    shadowCompared: shadow.compared,
+    shadowMismatch: shadow.mismatch,
+    shadowMismatchRateWindow: shadow.mismatchRateWindow,
+    killSwitchTriggered: shadow.killSwitchTriggered,
+    verdict: shadow.mismatch ? shadowSpawn.verdict : primary.verdict,
+    fallbackReason: shadow.mismatch ? "shadow_forced_spawn" : primary.fallbackReason,
+    transport: shadow.mismatch ? "spawn" : primary.transport,
+    sessionUsed: shadow.mismatch ? false : primary.sessionUsed,
+    sessionReused: shadow.mismatch ? false : primary.sessionReused
+  };
 }
 
 // src/core/verdict/judge-cli.ts
-import { spawn } from "node:child_process";
-var CLI_BINARIES = {
+var CliRunError = class extends Error {
+  kind;
+  exitCode;
+  stderr;
+  stdout;
+  command;
+  constructor(kind, message, details = {}) {
+    super(message);
+    this.name = "CliRunError";
+    this.kind = kind;
+    this.exitCode = details.exitCode;
+    this.stderr = details.stderr;
+    this.stdout = details.stdout;
+    this.command = details.command;
+  }
+};
+var CLI_BINARIES2 = {
   codex: "codex",
   cursor: "cursor-agent",
   claude: "claude"
 };
+var FORCE_KILL_GRACE_MS = 250;
 function failClosedVerdict2(reason) {
   return {
     local_recoverable: false,
@@ -2648,7 +4444,7 @@ function initialTrace(options) {
 function buildCliInvocation(providerId, prompt, model) {
   if (providerId === "codex") {
     return {
-      binary: CLI_BINARIES[providerId],
+      binary: CLI_BINARIES2[providerId],
       args: [
         "exec",
         "--json",
@@ -2664,7 +4460,7 @@ function buildCliInvocation(providerId, prompt, model) {
   }
   if (providerId === "cursor") {
     return {
-      binary: CLI_BINARIES[providerId],
+      binary: CLI_BINARIES2[providerId],
       args: [
         "--print",
         "--output-format",
@@ -2681,7 +4477,7 @@ function buildCliInvocation(providerId, prompt, model) {
     };
   }
   return {
-    binary: CLI_BINARIES[providerId],
+    binary: CLI_BINARIES2[providerId],
     args: [
       "-p",
       "--output-format",
@@ -2770,17 +4566,64 @@ function parseCliJudgeOutput(providerId, raw) {
   return parseCliJsonLines(raw);
 }
 async function runCliJson(invocation, timeoutMs) {
+  return runCliJsonWithTimeouts(invocation, { evalTimeoutMs: timeoutMs });
+}
+async function runCliJsonWithTimeouts(invocation, budgets) {
   const { binary, args, stdin } = invocation;
+  const connectTimeoutMs = budgets.connectTimeoutMs ?? 0;
+  if (connectTimeoutMs > 0) {
+    await new Promise((resolve) => setTimeout(resolve, 0));
+  }
   return new Promise((resolve, reject) => {
-    const child = spawn(binary, args, {
+    const child = spawn4(binary, args, {
       stdio: ["pipe", "pipe", "pipe"]
     });
+    const command = [binary, ...args].join(" ");
     let stdout = "";
     let stderr = "";
-    const timer = setTimeout(() => {
-      child.kill("SIGTERM");
-      reject(new Error(`${binary} timed out`));
-    }, timeoutMs);
+    let settled = false;
+    let timer = null;
+    let forceKillTimer = null;
+    const cleanup = () => {
+      if (timer) {
+        clearTimeout(timer);
+      }
+      if (forceKillTimer) {
+        clearTimeout(forceKillTimer);
+      }
+    };
+    const rejectOnce = (error) => {
+      if (settled) return;
+      settled = true;
+      cleanup();
+      reject(error);
+    };
+    const resolveOnce = (value) => {
+      if (settled) return;
+      settled = true;
+      cleanup();
+      resolve(value);
+    };
+    timer = setTimeout(() => {
+      rejectOnce(
+        new CliRunError("timeout", `${binary} timed out`, {
+          stderr: stderr.trim() || void 0,
+          stdout: stdout.trim() || void 0,
+          command
+        })
+      );
+      try {
+        child.kill("SIGTERM");
+      } catch {
+        return;
+      }
+      forceKillTimer = setTimeout(() => {
+        try {
+          child.kill("SIGKILL");
+        } catch {
+        }
+      }, FORCE_KILL_GRACE_MS);
+    }, budgets.evalTimeoutMs);
     child.stdout.on("data", (chunk) => {
       stdout += String(chunk);
     });
@@ -2792,16 +4635,30 @@ async function runCliJson(invocation, timeoutMs) {
     }
     child.stdin.end();
     child.on("error", (error) => {
-      clearTimeout(timer);
-      reject(error);
+      rejectOnce(
+        new CliRunError("spawn_error", error instanceof Error ? error.message : String(error), {
+          command
+        })
+      );
     });
     child.on("close", (code) => {
-      clearTimeout(timer);
+      if (settled) return;
       if (code === 0 && stdout.trim()) {
-        resolve(stdout.trim());
+        resolveOnce(stdout.trim());
         return;
       }
-      reject(new Error(stderr.trim() || `${binary} exited with code ${code ?? "unknown"}`));
+      rejectOnce(
+        new CliRunError(
+          "exit_nonzero",
+          stderr.trim() || `${binary} exited with code ${code ?? "unknown"}`,
+          {
+            exitCode: typeof code === "number" ? code : void 0,
+            stderr: stderr.trim() || void 0,
+            stdout: stdout.trim() || void 0,
+            command
+          }
+        )
+      );
     });
   });
 }
@@ -2810,6 +4667,10 @@ function createCliJudge(options) {
   const timeoutMs = options.timeoutMs ?? 25e3;
   const providerId = options.providerId;
   const runCommand = options.runCliCommand ?? runCliJson;
+  const runtime = options.runtime ?? DEFAULT_JUDGE_RUNTIME_CONFIG;
+  const repoRoot = options.repoRoot ?? process.cwd();
+  const stateDir = options.stateDir ?? repoRoot;
+  const judgeMode = options.judgeMode ?? "enforce";
   const judge = {
     lastTrace: initialTrace(options),
     async evaluate(input) {
@@ -2841,37 +4702,74 @@ function createCliJudge(options) {
       }
       const prompt = buildTier1Prompt(scrubbed.text);
       try {
-        const raw = await runCommand(
-          buildCliInvocation(providerId, prompt, options.modelResolved),
-          timeoutMs
+        const transportResult = await evaluateWithJudgeTransport(
+          {
+            prompt,
+            context: {
+              providerId,
+              model: options.modelResolved,
+              repoRoot: input.context.repoRoot || repoRoot,
+              stateDir,
+              judgeMode,
+              runtime,
+              judgeTimeoutMs: timeoutMs
+            }
+          },
+          { runCommand }
         );
-        const parsed = parseCliJudgeOutput(providerId, raw);
-        if (!parsed) {
+        const traceTransport = transportResult.transport === "session" ? `${providerId}-cli-session` : transport;
+        if (!transportResult.verdict) {
+          const fallbackReason = transportResult.fallbackReason ?? `${providerId}_cli_parse_error`;
           judge.lastTrace = {
             provider: "fallback",
             modelRequested: options.modelRequested,
             modelResolved: options.modelResolved,
             latencyMs: Date.now() - started,
-            fallbackReason: `${providerId}_cli_parse_error`
+            fallbackReason,
+            judgeFallbackReason: fallbackReason,
+            judgeSessionUsed: transportResult.sessionUsed,
+            judgeSessionReused: transportResult.sessionReused,
+            judgeSessionRefHash: transportResult.sessionRefHash,
+            judgeSessionResetReason: transportResult.sessionResetReason,
+            judgeConnectMs: transportResult.connectMs,
+            judgeEvalMs: transportResult.evalMs,
+            judgeParseMs: transportResult.parseMs,
+            judgeShadowCompared: transportResult.shadowCompared,
+            judgeShadowMismatch: transportResult.shadowMismatch,
+            judgeShadowMismatchRateWindow: transportResult.shadowMismatchRateWindow,
+            judgeKillSwitchTriggered: transportResult.killSwitchTriggered
           };
-          return failClosedVerdict2(`${providerId}_cli_parse_error`);
+          return failClosedVerdict2(transportFallbackToFailClosedReason(providerId, fallbackReason));
         }
         judge.lastTrace = {
           provider: traceProvider(options.providerId),
           modelRequested: options.modelRequested,
           modelResolved: options.modelResolved,
           latencyMs: Date.now() - started,
-          transport,
-          outboundRedacted: true
+          transport: traceTransport,
+          outboundRedacted: true,
+          judgeSessionUsed: transportResult.sessionUsed,
+          judgeSessionReused: transportResult.sessionReused,
+          judgeSessionRefHash: transportResult.sessionRefHash,
+          judgeSessionResetReason: transportResult.sessionResetReason,
+          judgeFallbackReason: transportResult.fallbackReason,
+          judgeConnectMs: transportResult.connectMs,
+          judgeEvalMs: transportResult.evalMs,
+          judgeParseMs: transportResult.parseMs,
+          judgeShadowCompared: transportResult.shadowCompared,
+          judgeShadowMismatch: transportResult.shadowMismatch,
+          judgeShadowMismatchRateWindow: transportResult.shadowMismatchRateWindow,
+          judgeKillSwitchTriggered: transportResult.killSwitchTriggered
         };
-        return parsed;
+        return transportResult.verdict;
       } catch {
         judge.lastTrace = {
           provider: "fallback",
           modelRequested: options.modelRequested,
           modelResolved: options.modelResolved,
           latencyMs: Date.now() - started,
-          fallbackReason: `${providerId}_cli_unavailable`
+          fallbackReason: `${providerId}_cli_unavailable`,
+          judgeFallbackReason: `${providerId}_cli_unavailable`
         };
         return failClosedVerdict2(`${providerId}_cli_unavailable`);
       }
@@ -2912,14 +4810,19 @@ function providerIdFromJudge(judge) {
   }
   return inferProviderIdFromConfig(judge);
 }
-function createCliJudgeForProvider(providerId, judgeConfig, config) {
+function createCliJudgeForProvider(providerId, judgeConfig, config, repoRoot) {
+  const resolvedRepoRoot = repoRoot ?? process.cwd();
   const { resolved } = resolveJudgeModel(judgeConfig);
   const options = {
     modelRequested: judgeConfig.model,
     modelResolved: resolved,
     timeoutMs: judgeConfig.timeoutMs,
     sensitivePaths: config.classifier.sensitivePaths,
-    scrubOptions: scrubOptionsFromConfig(config)
+    scrubOptions: scrubOptionsFromConfig(config),
+    runtime: judgeConfig.runtime,
+    repoRoot: resolvedRepoRoot,
+    stateDir: belayStateDir(config, repoLocalStateDirFor(resolvedRepoRoot, config)),
+    judgeMode: config.mode
   };
   if (providerId === "codex") {
     return createCodexCliJudge(options);
@@ -2948,11 +4851,12 @@ function createJudgeFromConfig(config, options = {}) {
   const catalogSpec = getJudgeProviderSpec(providerId);
   const { resolved } = resolveJudgeModel(judgeConfig);
   const runtime = detectJudgeRuntimeCapabilities(providerId);
+  const repoRoot = options.repoRoot ?? process.cwd();
   if (provider === "openai-compatible") {
     const endpoint = judgeConfig.endpoint?.trim();
     if (!endpoint && runtime.cliTransport) {
       if (providerId === "codex" || providerId === "cursor") {
-        return createCliJudgeForProvider(providerId, judgeConfig, config);
+        return createCliJudgeForProvider(providerId, judgeConfig, config, repoRoot);
       }
     }
     if (!endpoint) {
@@ -2971,7 +4875,6 @@ function createJudgeFromConfig(config, options = {}) {
         modelResolved: resolved
       });
     }
-    const repoRoot = options.repoRoot ?? process.cwd();
     const repoLocalStateDir = repoLocalStateDirFor(repoRoot, config);
     return createOpenAiCompatibleJudge({
       endpoint,
@@ -3004,7 +4907,11 @@ function createJudgeFromConfig(config, options = {}) {
         modelResolved: resolved,
         timeoutMs: judgeConfig.timeoutMs,
         sensitivePaths: config.classifier.sensitivePaths,
-        scrubOptions: scrubOptionsFromConfig(config)
+        scrubOptions: scrubOptionsFromConfig(config),
+        runtime: judgeConfig.runtime,
+        repoRoot,
+        stateDir: belayStateDir(config, repoLocalStateDirFor(repoRoot, config)),
+        judgeMode: config.mode
       });
     }
     return createFailClosedJudge({
@@ -3239,8 +5146,8 @@ function verdictFingerprint(cwdRelative2, commandRedacted) {
 }
 
 // src/core/verdict/launcher-resolve.ts
-import { existsSync as existsSync4, readFileSync as readFileSync2 } from "node:fs";
-import path14 from "node:path";
+import { existsSync as existsSync7, readFileSync as readFileSync3 } from "node:fs";
+import path19 from "node:path";
 var MAX_RESOLVE_DEPTH = 8;
 var PNPM_BUILTIN_COMMANDS = /* @__PURE__ */ new Set([
   "add",
@@ -3287,28 +5194,28 @@ var PNPM_EXEC_LIKE_HEADS = /* @__PURE__ */ new Set([
   "node"
 ]);
 function readPackageJson(dir) {
-  const packagePath = path14.join(dir, "package.json");
-  if (!existsSync4(packagePath)) {
+  const packagePath = path19.join(dir, "package.json");
+  if (!existsSync7(packagePath)) {
     return null;
   }
   try {
-    return JSON.parse(readFileSync2(packagePath, "utf8"));
+    return JSON.parse(readFileSync3(packagePath, "utf8"));
   } catch {
     return null;
   }
 }
 function findPackageJson(startDir, stopDir) {
-  let current = path14.resolve(startDir);
-  const stop = path14.resolve(stopDir);
+  let current = path19.resolve(startDir);
+  const stop = path19.resolve(stopDir);
   while (true) {
-    const packagePath = path14.join(current, "package.json");
-    if (existsSync4(packagePath)) {
+    const packagePath = path19.join(current, "package.json");
+    if (existsSync7(packagePath)) {
       return packagePath;
     }
-    if (current === stop || current === path14.dirname(current)) {
-      return existsSync4(packagePath) ? packagePath : null;
+    if (current === stop || current === path19.dirname(current)) {
+      return existsSync7(packagePath) ? packagePath : null;
     }
-    const parent = path14.dirname(current);
+    const parent = path19.dirname(current);
     if (!parent.startsWith(stop) && parent !== current) {
     }
     if (parent === current) {
@@ -3365,7 +5272,7 @@ function resolveNpmRecipe(cwd, repoRoot, scriptName, extraArgs) {
     }
     return { recipes: [], opaque: true, reason: "package_json_missing" };
   }
-  const pkg = readPackageJson(path14.dirname(packagePath));
+  const pkg = readPackageJson(path19.dirname(packagePath));
   const scripts = pkg?.scripts;
   if (!scripts || typeof scripts !== "object") {
     return { recipes: [], opaque: true, reason: "package_scripts_missing" };
@@ -3389,7 +5296,7 @@ function resolveNpmRecipe(cwd, repoRoot, scriptName, extraArgs) {
 function parseMakefileRecipes(makefilePath) {
   const recipes = /* @__PURE__ */ new Map();
   try {
-    const content = readFileSync2(makefilePath, "utf8");
+    const content = readFileSync3(makefilePath, "utf8");
     const lines = content.split("\n");
     let currentTarget = null;
     let recipeLines = [];
@@ -3430,20 +5337,20 @@ function parseMakefileRecipes(makefilePath) {
 function resolveMakeRecipe(cwd, repoRoot, target) {
   const candidates = ["Makefile", "makefile", "GNUmakefile"];
   let makefilePath = null;
-  let searchDir = path14.resolve(cwd);
-  const stop = path14.resolve(repoRoot);
+  let searchDir = path19.resolve(cwd);
+  const stop = path19.resolve(repoRoot);
   while (true) {
     for (const name of candidates) {
-      const candidate = path14.join(searchDir, name);
-      if (existsSync4(candidate)) {
+      const candidate = path19.join(searchDir, name);
+      if (existsSync7(candidate)) {
         makefilePath = candidate;
         break;
       }
     }
-    if (makefilePath || searchDir === stop || searchDir === path14.dirname(searchDir)) {
+    if (makefilePath || searchDir === stop || searchDir === path19.dirname(searchDir)) {
       break;
     }
-    searchDir = path14.dirname(searchDir);
+    searchDir = path19.dirname(searchDir);
   }
   if (!makefilePath) {
     return { recipes: [], opaque: true, reason: "unknown_local_effect" };
@@ -3547,7 +5454,7 @@ function askFromCustomExternal(opacity) {
 }
 
 // src/core/verdict/parser.ts
-import path15 from "node:path";
+import path20 from "node:path";
 
 // src/core/shell-substitution.ts
 function findCommandSubstitutions(command) {
@@ -3797,7 +5704,7 @@ var INTERPRETER_SCRIPT_EXTENSIONS = /* @__PURE__ */ new Set([
   ".sh"
 ]);
 function normalizeHead(token) {
-  const base = path15.basename(token);
+  const base = path20.basename(token);
   if (base && base !== "." && base !== "..") {
     return base;
   }
@@ -3902,7 +5809,7 @@ function isBareInterpreter(tokens) {
     return false;
   }
   const scriptArg = args.find((token) => !token.startsWith("-"));
-  if (scriptArg && INTERPRETER_SCRIPT_EXTENSIONS.has(path15.extname(scriptArg))) {
+  if (scriptArg && INTERPRETER_SCRIPT_EXTENSIONS.has(path20.extname(scriptArg))) {
     return false;
   }
   if (scriptArg) {
@@ -3921,7 +5828,7 @@ function splitTopLevelSegments(command) {
     }
   };
   for (const token of tokens) {
-    if (token === "&&" || token === "||" || token === ";" || token === "|" || token === "&") {
+    if (token === "&&" || token === "||" || token === ";" || token === "|" || token === "&" || token === "|&") {
       flush();
       continue;
     }
@@ -4143,7 +6050,7 @@ function extractPathArgs(tokens) {
   const args = [...redirects];
   for (let index = 1; index < tokens.length; index += 1) {
     const token = tokens[index];
-    if (!token || token.startsWith("-") || token === ">" || token === ">>" || token === "<") {
+    if (!token || token.startsWith("-") || isRedirectOperator(token) || isFdDuplication(token)) {
       continue;
     }
     if (redirects.includes(token)) {
@@ -4240,6 +6147,7 @@ function tier0HighStakesRm(tokens, context) {
     cwd: context.cwd,
     repoRoot: context.repoRoot,
     trustedCwd: context.trustedCwd,
+    trustedWorkspaceRoots: context.trustedWorkspaceRoots,
     sensitivePaths: context.sensitivePaths,
     protectedArtifactRoots: context.protectedArtifactRoots
   });
@@ -4275,7 +6183,8 @@ function tier0HighStakesRm(tokens, context) {
         resolved,
         context.repoRoot,
         context.sensitivePaths,
-        context.protectedArtifactRoots
+        context.protectedArtifactRoots,
+        context.trustedWorkspaceRoots
       )) {
         destructiveHighStakes = true;
         break;
@@ -4497,6 +6406,7 @@ async function evaluateSegment(command, context, depth) {
     cwd: context.cwd,
     repoRoot: context.repoRoot,
     trustedCwd: context.trustedCwd,
+    trustedWorkspaceRoots: context.trustedWorkspaceRoots,
     sensitivePaths: context.sensitivePaths,
     protectedArtifactRoots: context.protectedArtifactRoots
   });
@@ -4546,7 +6456,8 @@ async function evaluateSegment(command, context, depth) {
         resolved,
         context.repoRoot,
         context.sensitivePaths,
-        context.protectedArtifactRoots
+        context.protectedArtifactRoots,
+        context.trustedWorkspaceRoots
       )) {
         destructiveHighStakes = true;
         break;
@@ -4599,6 +6510,7 @@ async function evaluateSegment(command, context, depth) {
     cwd: context.cwd,
     repoRoot: context.repoRoot,
     trustedCwd: context.trustedCwd,
+    trustedWorkspaceRoots: context.trustedWorkspaceRoots,
     sensitivePaths: context.sensitivePaths
   }) : null;
   if (mutationPrescan) {
@@ -4780,11 +6692,12 @@ function buildVerdictContext(params) {
     cwd: params.cwd,
     repoRoot: params.repoRoot,
     trustedCwd: resolveClassifierTrustedCwd(params.cwd, params.options, params.trustedCwd),
+    trustedWorkspaceRoots: params.options?.trustedWorkspaceRoots ?? [],
     sensitivePaths: params.options?.sensitivePaths ?? params.config.classifier.sensitivePaths,
     protectedArtifactRoots: protectedArtifactRoots2.length > 0 ? [...new Set(protectedArtifactRoots2)] : void 0,
     customAllowCommands: params.options?.customAllowCommands ?? params.config.overrides.allow,
     customExternalCommands: params.options?.customExternalCommands ?? params.config.overrides.external,
-    judge: params.judge ?? params.options?.tier1Judge ?? createJudgeFromConfig(params.config),
+    judge: params.judge ?? params.options?.tier1Judge ?? createJudgeFromConfig(params.config, { repoRoot: params.repoRoot }),
     mode: params.config.mode,
     unknownLocalEffect: params.options?.unknownLocalEffect ?? params.config.policy.unknownLocalEffect,
     unparseableShell: params.options?.unparseableShell ?? params.config.policy.unparseableShell
@@ -4792,7 +6705,12 @@ function buildVerdictContext(params) {
 }
 async function classifyShell(command, cwd, repoRoot, config, options = {}, judge) {
   const context = buildVerdictContext({ cwd, repoRoot, config, options, judge });
+  const started = Date.now();
   const result = await verdict(command, context);
+  const elapsed = Date.now() - started;
+  if (result.confidence !== "llm") {
+    recordJudgeLatency("tier0", elapsed);
+  }
   return verdictToClassifyResult(result);
 }
 function mapLegacyReason(result) {
@@ -4940,6 +6858,7 @@ async function classifyFileMutationWithTier1(params) {
     cwd: params.cwd,
     repoRoot: params.repoRoot,
     trustedCwd,
+    trustedWorkspaceRoots: params.options.trustedWorkspaceRoots,
     sensitivePaths: params.options.sensitivePaths ?? params.config.classifier.sensitivePaths
   });
   if (prescan) {
@@ -5088,7 +7007,7 @@ async function classifyToolUse(payload, repoRoot, cwd, config, options = {}) {
       };
     }
     const signals = [];
-    const resolvedPath = path16.isAbsolute(filePath) ? filePath : path16.resolve(cwd, filePath);
+    const resolvedPath = path21.isAbsolute(filePath) ? filePath : path21.resolve(cwd, filePath);
     const hitsProtectedRoot = protectedRoots.some((root) => pathWithinRoot(root, resolvedPath));
     if (hitsProtectedRoot) {
       signals.push("control_plane_path");
@@ -5106,8 +7025,12 @@ async function classifyToolUse(payload, repoRoot, cwd, config, options = {}) {
         }
       };
     }
-    const relativePath = relativeWithinRepo(repoRoot, resolvedPath);
-    if (relativePath === null) {
+    const workspaceMatch = resolveWorkspaceRootMatch(
+      repoRoot,
+      options.trustedWorkspaceRoots,
+      resolvedPath
+    );
+    if (workspaceMatch === null) {
       signals.push("outside_repo_path");
       return classifyFileMutationWithTier1({
         toolName,
@@ -5123,6 +7046,34 @@ async function classifyToolUse(payload, repoRoot, cwd, config, options = {}) {
         locationLabel: "outside_repo"
       });
     }
+    if (workspaceMatch.kind === "trusted") {
+      signals.push("trusted_workspace_root");
+    }
+    const trustedCwd = resolveClassifierTrustedCwd(cwd, options);
+    const workspacePrescan = mutationPrescanRequiresAsk({
+      targets: [filePath],
+      cwd,
+      repoRoot,
+      trustedCwd,
+      trustedWorkspaceRoots: options.trustedWorkspaceRoots,
+      sensitivePaths
+    });
+    if (workspacePrescan) {
+      return classifyFileMutationWithTier1({
+        toolName,
+        toolKind,
+        filePath,
+        resolvedPath,
+        repoRoot,
+        cwd,
+        config,
+        options,
+        signals,
+        isDelete: FILE_DELETE_TOOL_NAMES.has(toolKind),
+        locationLabel: "sensitive_path"
+      });
+    }
+    const relativePath = workspaceMatch.relativePath;
     if (matchesSensitivePath(relativePath, sensitivePaths)) {
       signals.push("sensitive_path");
       return classifyFileMutationWithTier1({
@@ -5430,30 +7381,50 @@ function applyFsScopePeripheralPolicy(outsideRepoPaths, result, options) {
   return result;
 }
 function applySandboxOutsideBoundary(command, action, result, options) {
-  const outsideRepoPaths = collectOutsideRepoPaths(command, action.cwd, action.repoRoot);
+  const outsideRepoPaths = collectOutsideRepoPaths(
+    command,
+    action.cwd,
+    action.repoRoot,
+    options.trustedWorkspaceRoots
+  );
   return applySandboxFsScopeBoundary(outsideRepoPaths, result, options, {
     redirect: command.includes(">")
   });
 }
 function applyShellPeripheralPolicy(command, action, result, options) {
-  const outsideRepoPaths = collectOutsideRepoPaths(command, action.cwd, action.repoRoot);
+  const outsideRepoPaths = collectOutsideRepoPaths(
+    command,
+    action.cwd,
+    action.repoRoot,
+    options.trustedWorkspaceRoots
+  );
   return applyFsScopePeripheralPolicy(outsideRepoPaths, result, options);
 }
-function outsideRepoPathsForToolAction(action) {
+function outsideRepoPathsForToolAction(action, options) {
   const payload = action.payload ?? {};
   const paths = new Set(
-    collectOutsideRepoPathsFromToolPayload(payload, action.cwd, action.repoRoot)
+    collectOutsideRepoPathsFromToolPayload(
+      payload,
+      action.cwd,
+      action.repoRoot,
+      options.trustedWorkspaceRoots
+    )
   );
   const command = shellCommandFromPayload(payload);
   if (command) {
-    for (const resolved of collectOutsideRepoPaths(command, action.cwd, action.repoRoot)) {
+    for (const resolved of collectOutsideRepoPaths(
+      command,
+      action.cwd,
+      action.repoRoot,
+      options.trustedWorkspaceRoots
+    )) {
       paths.add(resolved);
     }
   }
   return [...paths];
 }
 function applyToolSandboxPolicies(action, result, options) {
-  const outsideRepoPaths = outsideRepoPathsForToolAction(action);
+  const outsideRepoPaths = outsideRepoPathsForToolAction(action, options);
   const command = shellCommandFromPayload(action.payload ?? {});
   let next = applySandboxFsScopeBoundary(outsideRepoPaths, result, options, {
     redirect: command.includes(">")
@@ -5534,9 +7505,9 @@ function gateEnabledForAction(config, action) {
 }
 
 // src/core/transactional/diff-evaluator.ts
-import path17 from "node:path";
+import path22 from "node:path";
 function categorizeChange(change, ctx) {
-  const absolutePath = canonicalPath(path17.join(ctx.repoRoot, change.relativePath));
+  const absolutePath = canonicalPath(path22.join(ctx.repoRoot, change.relativePath));
   if (!pathWithinRoot(ctx.repoRoot, absolutePath)) {
     return "repo_outside";
   }
@@ -5656,15 +7627,15 @@ var TRANSACTIONAL_APPROVAL_BYPASS_REASONS = /* @__PURE__ */ new Set([
 ]);
 
 // src/core/transactional/git-worktree.ts
-import { spawn as spawn2 } from "node:child_process";
+import { spawn as spawn5 } from "node:child_process";
 import { randomUUID } from "node:crypto";
-import { existsSync as existsSync5 } from "node:fs";
-import { copyFile, mkdir as mkdir3, mkdtemp, rm } from "node:fs/promises";
+import { existsSync as existsSync8 } from "node:fs";
+import { copyFile, mkdir as mkdir4, mkdtemp, rm } from "node:fs/promises";
 import os from "node:os";
-import path18 from "node:path";
+import path23 from "node:path";
 function execGit(repoRoot, args) {
   return new Promise((resolve, reject) => {
-    const child = spawn2("git", ["-C", repoRoot, ...args], {
+    const child = spawn5("git", ["-C", repoRoot, ...args], {
       stdio: ["ignore", "pipe", "pipe"]
     });
     const stdout = [];
@@ -5702,8 +7673,8 @@ async function isDirtyWorktree(repoRoot) {
   }
 }
 async function createGitWorktreeSnapshot(repoRoot, stateDir) {
-  const worktreePath = path18.join(stateDir, `tx-${randomUUID().replaceAll("-", "")}`);
-  await mkdir3(stateDir, { recursive: true });
+  const worktreePath = path23.join(stateDir, `tx-${randomUUID().replaceAll("-", "")}`);
+  await mkdir4(stateDir, { recursive: true });
   await execGit(repoRoot, ["worktree", "add", "--detach", worktreePath, "HEAD"]);
   return {
     worktreePath,
@@ -5722,18 +7693,18 @@ async function createGitWorktreeSnapshot(repoRoot, stateDir) {
 }
 function resolveWorktreeCwd(repoRoot, worktreePath, cwd) {
   const resolvedCwd = canonicalPath(cwd);
-  const relative = path18.relative(canonicalPath(repoRoot), resolvedCwd);
-  if (relative.startsWith("..") || path18.isAbsolute(relative)) {
+  const relative = path23.relative(canonicalPath(repoRoot), resolvedCwd);
+  if (relative.startsWith("..") || path23.isAbsolute(relative)) {
     return worktreePath;
   }
   if (relative === "") {
     return worktreePath;
   }
-  return path18.join(worktreePath, relative);
+  return path23.join(worktreePath, relative);
 }
 function runShellCommand(command, cwd, timeoutMs) {
   return new Promise((resolve) => {
-    const child = spawn2(command, {
+    const child = spawn5(command, {
       cwd,
       shell: true,
       stdio: "ignore",
@@ -5799,7 +7770,7 @@ async function rollbackAppliedChanges(actions) {
   for (const action of [...actions].reverse()) {
     try {
       if (action.type === "restore") {
-        await mkdir3(path18.dirname(action.target), { recursive: true });
+        await mkdir4(path23.dirname(action.target), { recursive: true });
         await copyFile(action.backupPath, action.target);
       } else {
         await rm(action.target, { force: true });
@@ -5809,14 +7780,14 @@ async function rollbackAppliedChanges(actions) {
   }
 }
 async function applyWorktreeChanges(worktreePath, repoRoot, changes) {
-  const backupRoot = await mkdtemp(path18.join(os.tmpdir(), "belay-tx-rollback-"));
+  const backupRoot = await mkdtemp(path23.join(os.tmpdir(), "belay-tx-rollback-"));
   const rollbackActions = [];
   try {
     for (const change of changes) {
-      const target = path18.join(repoRoot, change.relativePath);
-      if (existsSync5(target)) {
-        const backupPath = path18.join(backupRoot, change.relativePath);
-        await mkdir3(path18.dirname(backupPath), { recursive: true });
+      const target = path23.join(repoRoot, change.relativePath);
+      if (existsSync8(target)) {
+        const backupPath = path23.join(backupRoot, change.relativePath);
+        await mkdir4(path23.dirname(backupPath), { recursive: true });
         await copyFile(target, backupPath);
         rollbackActions.push({ type: "restore", target, backupPath });
       } else if (change.kind !== "deleted") {
@@ -5826,8 +7797,8 @@ async function applyWorktreeChanges(worktreePath, repoRoot, changes) {
         await rm(target, { force: true });
         continue;
       }
-      const source = path18.join(worktreePath, change.relativePath);
-      await mkdir3(path18.dirname(target), { recursive: true });
+      const source = path23.join(worktreePath, change.relativePath);
+      await mkdir4(path23.dirname(target), { recursive: true });
       await copyFile(source, target);
     }
   } catch (error) {
@@ -5988,8 +7959,225 @@ async function notifyDeny(config, event) {
   }
 }
 
+// src/core/standing-allow.ts
+import { existsSync as existsSync9 } from "node:fs";
+import { mkdir as mkdir5, readFile as readFile4, writeFile as writeFile4 } from "node:fs/promises";
+import path24 from "node:path";
+
+// src/corpus/standing-allow-catalog.generated.ts
+var STANDING_ALLOW_CATALOG = {
+  version: 1,
+  shell: {
+    provablyBenign: [
+      {
+        command: "git status",
+        normalizedCommand: "git status",
+        runtimeKey: "37e6be21e63e6268ee6e4212ad811f6f48ab3c3c10ce1b971c1a90d92c753a2a"
+      },
+      {
+        command: "rg plan src",
+        normalizedCommand: "rg plan src",
+        runtimeKey: "68ae7a96158719235d9314da7b00a5f8b2f40668e5d4f7f02e91f22284140a68"
+      },
+      {
+        command: "ls -la",
+        normalizedCommand: "ls -la",
+        runtimeKey: "3a665991b52b5f18069889960b957ea37b087859c23e2c87b76ef8d2a1b338fe"
+      },
+      {
+        command: "find . -name '*.ts'",
+        normalizedCommand: "find . -name '*.ts'",
+        runtimeKey: "782298e3015fcb9c17bee2dad12a395a8859043481f93f0ca596499028bb8af2"
+      },
+      {
+        command: "curl https://example.com",
+        normalizedCommand: "curl https://example.com",
+        runtimeKey: "09fa1bf897aa68a2d0be02cff3b0cbfa44a28fa17c501e8a39f2081208785e55"
+      },
+      {
+        command: "wget https://example.com",
+        normalizedCommand: "wget https://example.com",
+        runtimeKey: "c408836b4bb4498b68b52e08a7c852757a19e156cae7579ffd5c98f13728cacb"
+      },
+      {
+        command: "ls\ncurl https://example.com",
+        normalizedCommand: "ls\ncurl https://example.com",
+        runtimeKey: "a895f27dda259649bbe0d27fcc04ab7076fadfcd4c2ea3ab55f557028b01b11f"
+      }
+    ],
+    mustAllow: [
+      {
+        command: "npm test",
+        normalizedCommand: "npm test",
+        runtimeKey: "1bcafcfef8e1b0138297885032c5e222c4aed19bdcde00e2539aa397fdc877cb"
+      },
+      {
+        command: "npm run build",
+        normalizedCommand: "npm run build",
+        runtimeKey: "3138d8a3e9afb60574e29d16c2967f70bb42475e02eadb261f5f2340f376c188"
+      },
+      {
+        command: "pnpm test",
+        normalizedCommand: "pnpm test",
+        runtimeKey: "eaecc988be421de36044932e32d4be807e45baccaa94c2d29d30a34204656551"
+      },
+      {
+        command: "pnpm build",
+        normalizedCommand: "pnpm build",
+        runtimeKey: "a1ec94b6b1f7f17ab0fe468e41c6dc59e04266d34772abcaa9538123601cb46d"
+      },
+      {
+        command: "pnpm vitest run src/example.test.ts",
+        normalizedCommand: "pnpm vitest run src/example.test.ts",
+        runtimeKey: "011e12e902154e7cf598f390fc08a50e885b34893deb97d242cf7470e23e617e"
+      },
+      {
+        command: "bash -lc 'git status'",
+        normalizedCommand: "bash -lc 'git status'",
+        runtimeKey: "dbcc63715f4a8cca2aff988470bb1d52a4841542af9c86776ff2414509508a1f"
+      },
+      {
+        command: "belay approve belay_deadbeef1234",
+        normalizedCommand: "belay approve belay_deadbeef1234",
+        runtimeKey: "bb3f0f1dac3d6c4ef79e17ef4e36f9430195596490bb736cdb8b25a5944d6f81"
+      }
+    ]
+  }
+};
+
+// src/core/standing-allow.ts
+var EMPTY_STANDING_ALLOW = {
+  version: 1,
+  entries: []
+};
+var DEFAULT_STANDING_ALLOW_TTL_MS = 30 * 24 * 60 * 60 * 1e3;
+var PROVABLY_BENIGN_COMMANDS = new Set(
+  STANDING_ALLOW_CATALOG.shell.provablyBenign.map((entry) => entry.normalizedCommand)
+);
+var MUST_ALLOW_COMMANDS = new Set(
+  STANDING_ALLOW_CATALOG.shell.mustAllow.map((entry) => entry.normalizedCommand)
+);
+var STANDING_ALLOW_BLOCKED_REASONS = /* @__PURE__ */ new Set([
+  "external_effect",
+  "tier1_catastrophic",
+  "protected_artifact",
+  "pipe_to_shell",
+  "command_substitution"
+]);
+function standingAllowFile(config, repoLocalStateDir) {
+  return `${belayStateDir(config, repoLocalStateDir)}/standing-allow.json`;
+}
+function isTier0StandingAllowBlocked(result) {
+  if (result.reason.startsWith("tier0_") || STANDING_ALLOW_BLOCKED_REASONS.has(result.reason)) {
+    return true;
+  }
+  const signals = result.assessment?.signals ?? [];
+  return signals.some((signal) => signal === "tier0_external" || signal === "tier1_catastrophic");
+}
+function isExpired2(iso, now = Date.now()) {
+  const parsed = Date.parse(iso);
+  return Number.isNaN(parsed) || parsed <= now;
+}
+function compactStandingAllow(state, now = Date.now()) {
+  return {
+    version: 1,
+    entries: state.entries.filter((entry) => !isExpired2(entry.expiresAt, now))
+  };
+}
+function sanitizeStandingAllowEntries(input) {
+  if (!Array.isArray(input)) {
+    return [];
+  }
+  return input.flatMap((entry) => {
+    if (!entry || typeof entry !== "object") {
+      return [];
+    }
+    const record = entry;
+    if (record.kind !== "shell" && record.kind !== "tool" && record.kind !== "subagent" || typeof record.fingerprint !== "string" || !record.fingerprint.trim() || typeof record.expiresAt !== "string" || typeof record.createdAt !== "string" || typeof record.reason !== "string") {
+      return [];
+    }
+    const source = record.source;
+    if (source !== "operator" && source !== "availability-reconfirmed") {
+      return [];
+    }
+    return [
+      {
+        kind: record.kind,
+        fingerprint: record.fingerprint,
+        source,
+        reason: record.reason,
+        createdAt: record.createdAt,
+        expiresAt: record.expiresAt,
+        ...typeof record.summary === "string" ? { summary: record.summary } : {},
+        ...typeof record.repoRoot === "string" ? { repoRoot: record.repoRoot } : {}
+      }
+    ];
+  });
+}
+async function loadStandingAllow(filePath) {
+  if (!existsSync9(filePath)) {
+    return { ...EMPTY_STANDING_ALLOW };
+  }
+  const raw = JSON.parse(await readFile4(filePath, "utf8"));
+  const rawCount = Array.isArray(raw.entries) ? raw.entries.length : 0;
+  const entries = sanitizeStandingAllowEntries(raw.entries);
+  const compacted = compactStandingAllow({ version: 1, entries });
+  if (rawCount !== compacted.entries.length || entries.length !== compacted.entries.length) {
+    await saveStandingAllow(filePath, compacted);
+  }
+  return compacted;
+}
+async function saveStandingAllow(filePath, state) {
+  await mkdir5(path24.dirname(filePath), { recursive: true });
+  const compacted = compactStandingAllow(state);
+  await writeFile4(filePath, `${JSON.stringify(compacted, null, 2)}
+`, "utf8");
+}
+function matchBundledCatalog(kind, normalizedCommand) {
+  if (kind !== "shell" || !normalizedCommand) {
+    return null;
+  }
+  if (PROVABLY_BENIGN_COMMANDS.has(normalizedCommand)) {
+    return { source: "provably-benign-corpus", catalogCommand: normalizedCommand };
+  }
+  if (MUST_ALLOW_COMMANDS.has(normalizedCommand)) {
+    return { source: "must-allow-catalog", catalogCommand: normalizedCommand };
+  }
+  return null;
+}
+function matchStateEntry(params) {
+  const now = params.now ?? Date.now();
+  const match = params.state.entries.find(
+    (entry) => entry.kind === params.kind && entry.fingerprint === params.fingerprint && !isExpired2(entry.expiresAt, now) && (entry.repoRoot === void 0 || entry.repoRoot === params.repoRoot)
+  );
+  if (!match) {
+    return null;
+  }
+  return { source: match.source, entryId: match.fingerprint };
+}
+function resolveStandingAllowMatch(params) {
+  if (params.result.verdict !== "deny_pending_approval") {
+    return null;
+  }
+  if (isTier0StandingAllowBlocked(params.result)) {
+    return null;
+  }
+  const normalizedCommand = params.result.normalizedCommand ?? params.result.summary ?? "";
+  const catalogMatch = matchBundledCatalog(params.kind, normalizedCommand);
+  if (catalogMatch) {
+    return catalogMatch;
+  }
+  return matchStateEntry({
+    kind: params.kind,
+    fingerprint: params.result.fingerprint,
+    repoRoot: params.repoRoot,
+    state: params.state,
+    now: params.now
+  });
+}
+
 // src/adapters/layouts/protected-paths.ts
-import path19 from "node:path";
+import path25 from "node:path";
 function protectedArtifactRoots(layout, repoRoot, controlPlaneDir) {
   const roots = [
     layout.configPath(repoRoot),
@@ -6001,7 +8189,7 @@ function protectedArtifactRoots(layout, repoRoot, controlPlaneDir) {
   if (controlPlaneDir) {
     roots.push(controlPlaneDir);
   }
-  return roots.map((entry) => path19.resolve(entry));
+  return roots.map((entry) => path25.resolve(entry));
 }
 
 // src/adapters/shared/gate-runtime.ts
@@ -6009,9 +8197,18 @@ var EMPTY_APPROVALS = {
   version: 1,
   approvals: []
 };
+function adapterIdFromContext(ctx) {
+  if (ctx.config.adapter === "cursor" || ctx.config.adapter === "claude" || ctx.config.adapter === "codex") {
+    return ctx.config.adapter;
+  }
+  if (ctx.layout.name === "cursor" || ctx.layout.name === "claude" || ctx.layout.name === "codex") {
+    return ctx.layout.name;
+  }
+  return void 0;
+}
 async function loadJsonFile(filePath, fallback) {
   try {
-    const raw = await readFile3(filePath, "utf8");
+    const raw = await readFile5(filePath, "utf8");
     return JSON.parse(raw);
   } catch {
     return fallback;
@@ -6023,14 +8220,14 @@ function createDefaultGateRuntimeDeps() {
       return loadJsonFile(configPath, {});
     },
     async appendAudit(ctx, event) {
-      const auditPath = path20.join(ctx.repoRoot, ctx.config.audit.logPath);
-      await mkdir4(path20.dirname(auditPath), { recursive: true });
+      const auditPath = path26.join(ctx.repoRoot, ctx.config.audit.logPath);
+      await mkdir6(path26.dirname(auditPath), { recursive: true });
       const record = { timestamp: (/* @__PURE__ */ new Date()).toISOString(), ...event };
       if (!ctx.config.audit.includeAssessment) {
         delete record.assessment;
       }
       const scrubbed = scrubValue(record, scrubOptionsFromConfig(ctx.config));
-      await writeFile3(auditPath, `${JSON.stringify(scrubbed)}
+      await writeFile5(auditPath, `${JSON.stringify(scrubbed)}
 `, {
         encoding: "utf8",
         flag: "a"
@@ -6049,8 +8246,8 @@ function createDefaultGateRuntimeDeps() {
       };
     },
     async writeApprovals(filePath, state) {
-      await mkdir4(path20.dirname(filePath), { recursive: true });
-      await writeFile3(filePath, `${JSON.stringify(compactApprovals(state), null, 2)}
+      await mkdir6(path26.dirname(filePath), { recursive: true });
+      await writeFile5(filePath, `${JSON.stringify(compactApprovals(state), null, 2)}
 `, "utf8");
     }
   };
@@ -6059,8 +8256,8 @@ async function resolveGateConfig(ctx, deps) {
   const loaded = await deps.readConfig(ctx.configPath);
   let teamConfig = null;
   const teamPath = teamConfigPath();
-  if (existsSync6(teamPath)) {
-    teamConfig = JSON.parse(await readFile3(teamPath, "utf8"));
+  if (existsSync10(teamPath)) {
+    teamConfig = JSON.parse(await readFile5(teamPath, "utf8"));
   }
   return resolveLayeredConfig({
     repoConfig: loaded,
@@ -6082,9 +8279,13 @@ function repoShellClassifierOptions(config, repoRoot, layout, extras = {}) {
 function runtimeClassifierOptions(ctx, config) {
   const repoLocalStateDir = ctx.layout.repoLocalStateDir(ctx.repoRoot);
   const brokerFsScope = isCapabilityBrokerDemotionActive(config);
+  const trustedRoots = loadTrustedWorkspaceRootsSync(
+    trustedWorkspaceRootsPath(config, repoLocalStateDir)
+  );
   return repoShellClassifierOptions(config, ctx.repoRoot, ctx.layout, {
     brokerFsScope,
-    fsScopeAllowlist: brokerFsScope ? loadFsScopeAllowlistSync(fsScopeAllowlistPath(config, repoLocalStateDir)) : void 0
+    fsScopeAllowlist: brokerFsScope ? loadFsScopeAllowlistSync(fsScopeAllowlistPath(config, repoLocalStateDir)) : void 0,
+    trustedWorkspaceRoots: trustedRoots.roots.map((entry) => entry.path)
   });
 }
 function gateAuditEventName(kind) {
@@ -6096,7 +8297,7 @@ function gateAuditEventName(kind) {
   }
   return "subagentGate";
 }
-async function ensurePendingApproval(ctx, deps, kind, result, approvalInput) {
+async function ensurePendingApproval(ctx, deps, kind, result, approvalInput, scopeHint) {
   const pending = await deps.loadApprovals(ctx, "pending-approvals.json");
   pending.state = compactApprovals(pending.state);
   const existing = pending.state.approvals.find(
@@ -6106,7 +8307,7 @@ async function ensurePendingApproval(ctx, deps, kind, result, approvalInput) {
     await deps.writeApprovals(pending.filePath, pending.state);
     return existing;
   }
-  const approval = createApprovalRecord({
+  const approval = createApprovalRecordWithEnvelope({
     kind,
     fingerprint: result.fingerprint,
     repoRoot: ctx.repoRoot,
@@ -6114,14 +8315,83 @@ async function ensurePendingApproval(ctx, deps, kind, result, approvalInput) {
     summary: result.normalizedCommand ?? result.summary ?? "",
     approvalTtlMinutes: ctx.config.approvalTtlMinutes,
     approvalId: `belay_${randomUUID2().replaceAll("-", "").slice(0, 12)}`,
-    input: approvalInput?.input,
-    inputKind: approvalInput?.inputKind
+    approvalInput,
+    scopeHint
   });
   pending.state.version = 2;
   pending.state.approvals.push(approval);
   await deps.writeApprovals(pending.filePath, pending.state);
   return approval;
 }
+function extractShellCommandFromPayload(payload) {
+  const toolInput = payload.tool_input;
+  if (!toolInput || typeof toolInput !== "object") {
+    return "";
+  }
+  const input = toolInput;
+  return typeof input.command === "string" ? input.command : "";
+}
+function deriveWorkspaceRootScopeHint(params) {
+  if (params.result.reason !== "outside_repo_mutation" && params.result.reason !== "outside_repo_redirect") {
+    return void 0;
+  }
+  const action = params.replayAction;
+  if (!action?.cwd) {
+    return void 0;
+  }
+  const outsidePaths = /* @__PURE__ */ new Set();
+  if (action.kind === "shell" && action.command) {
+    for (const resolved of collectOutsideRepoPaths(
+      action.command,
+      action.cwd,
+      action.repoRoot,
+      params.options.trustedWorkspaceRoots
+    )) {
+      outsidePaths.add(resolved);
+    }
+  } else if (action.kind === "tool") {
+    const toolPayload = params.payloadForScopeHint ?? action.payload ?? {};
+    for (const resolved of collectOutsideRepoPathsFromToolPayload(
+      toolPayload,
+      action.cwd,
+      action.repoRoot,
+      params.options.trustedWorkspaceRoots
+    )) {
+      outsidePaths.add(resolved);
+    }
+    const command = extractShellCommandFromPayload(toolPayload);
+    if (command) {
+      for (const resolved of collectOutsideRepoPaths(
+        command,
+        action.cwd,
+        action.repoRoot,
+        params.options.trustedWorkspaceRoots
+      )) {
+        outsidePaths.add(resolved);
+      }
+    }
+  }
+  if (outsidePaths.size !== 1) {
+    return void 0;
+  }
+  const targetPath = [...outsidePaths][0];
+  if (!targetPath) {
+    return void 0;
+  }
+  const candidateRoot = canonicalPath(path26.dirname(targetPath));
+  const validation = validateTrustedWorkspaceRootCandidate({
+    candidatePath: candidateRoot,
+    repoRoot: action.repoRoot,
+    controlPlaneDir: params.options.controlPlaneDir ?? void 0,
+    protectedRoots: params.options.protectedArtifactRoots ?? [],
+    requireExistingDirectory: true,
+    requireNonGit: true
+  });
+  if (!validation.ok) {
+    return void 0;
+  }
+  return { scope: "workspace-root", path: validation.normalizedPath };
+}
 async function consumeApprovedApproval(ctx, deps, kind, fingerprint) {
   const approved = await deps.loadApprovals(ctx, "approved-approvals.json");
   approved.state = compactApprovals(approved.state);
@@ -6139,7 +8409,7 @@ async function consumeApprovedApproval(ctx, deps, kind, fingerprint) {
   }
   approved.state.approvals[index] = {
     ...approval,
-    executionLeaseExpiresAt: new Date(Date.now() + APPROVAL_EXECUTION_LEASE_MS).toISOString()
+    executionLeaseExpiresAt: new Date(Date.now() + getExecutionLeaseMs(ctx.config)).toISOString()
   };
   await deps.writeApprovals(approved.filePath, approved.state);
   return approval;
@@ -6205,7 +8475,7 @@ async function evaluateGatedAction(ctx, deps, params) {
       command: params.command,
       cwd: params.cwd,
       repoRoot: ctx.repoRoot,
-      stateDir: path20.join(ctx.layout.repoLocalStateDir(ctx.repoRoot), "transactional"),
+      stateDir: path26.join(ctx.layout.repoLocalStateDir(ctx.repoRoot), "transactional"),
       timeoutMs: transactional.timeoutMs,
       predicted,
       diffContext: {
@@ -6233,20 +8503,39 @@ async function evaluateGatedAction(ctx, deps, params) {
       };
     }
   }
+  const scrubOpts = scrubOptionsFromConfig(ctx.config);
+  const scrubbedPayload = fingerprintReplayPayload(params.kind, params.payload, scrubOpts);
   return gateDecisionToVerdict(ctx, deps, params.kind, result, {
     predictedAssessment,
     observedAssessment: observedAssessment2,
     transactionalLayer,
     approvalInput: params.kind === "shell" ? {
       input: params.command ?? result.normalizedCommand ?? result.summary ?? "",
-      inputKind: "shell"
+      inputKind: "shell",
+      cwd: params.cwd
     } : {
-      input: params.command ?? result.normalizedCommand ?? result.summary ?? canonicalStringify(params.payload ?? {}),
-      inputKind: params.kind
-    }
+      input: params.command ?? result.normalizedCommand ?? result.summary ?? canonicalStringify(scrubbedPayload ?? {}),
+      inputKind: params.kind,
+      cwd: params.cwd,
+      toolName: params.toolName,
+      payload: scrubbedPayload
+    },
+    replayAction: {
+      kind: params.kind,
+      cwd: params.cwd,
+      toolName: params.toolName,
+      command: params.command,
+      payload: scrubbedPayload,
+      fingerprint: result.fingerprint,
+      repoRoot: ctx.repoRoot
+    },
+    classifierOptions,
+    scopeHintPayload: params.payload
   });
 }
 async function gateDecisionToVerdict(ctx, deps, kind, result, auditExtras = {}) {
+  const replayContext = buildAuditReplayContext(kind, result, auditExtras.replayAction);
+  const actionSnapshot = buildAuditActionSnapshot(kind, result, auditExtras.replayAction);
   const gateBase = {
     event: gateAuditEventName(kind),
     kind,
@@ -6258,7 +8547,9 @@ async function gateDecisionToVerdict(ctx, deps, kind, result, auditExtras = {})
     mode: ctx.config.mode,
     schemaVersion: result.axes ? 2 : 1,
     ...result.axes ?? {},
-    ...auditExtras.transactionalLayer
+    ...auditExtras.transactionalLayer,
+    ...replayContext ? { replayContext } : {},
+    ...actionSnapshot ? { actionSnapshot } : {}
   };
   if (result.reason === TRANSACTIONAL_ALREADY_APPLIED) {
     const userMessage = "Belay executed this command safely in an isolated git worktree. Observed-safe file changes are already applied; do not retry the same command.";
@@ -6279,6 +8570,36 @@ async function gateDecisionToVerdict(ctx, deps, kind, result, auditExtras = {})
       agent_message: agentMessage
     });
   }
+  if (result.verdict === "deny_pending_approval" && ctx.config.mode === "enforce" && !TRANSACTIONAL_APPROVAL_BYPASS_REASONS.has(result.reason)) {
+    const standingAllowPath = standingAllowFile(
+      ctx.config,
+      ctx.layout.repoLocalStateDir(ctx.repoRoot)
+    );
+    const standingState = await loadStandingAllow(standingAllowPath);
+    const standingMatch = resolveStandingAllowMatch({
+      kind,
+      result,
+      repoRoot: ctx.repoRoot,
+      state: standingState
+    });
+    if (standingMatch) {
+      await deps.appendAudit(ctx, {
+        ...gateBase,
+        verdict: "allow",
+        reason: "standing_allow",
+        standingAllowSource: standingMatch.source,
+        ...standingMatch.catalogCommand ? { standingAllowCatalogCommand: standingMatch.catalogCommand } : {},
+        wouldBlock: false,
+        permission: "allow"
+      });
+      return classifyResultToGateVerdict({
+        result: { ...result, verdict: "allow", reason: "standing_allow" },
+        mode: ctx.config.mode,
+        permission: "allow",
+        wouldBlock: false
+      });
+    }
+  }
   const brokerActive = isCapabilityBrokerDemotionActive(ctx.config);
   let approved = null;
   if (!TRANSACTIONAL_APPROVAL_BYPASS_REASONS.has(result.reason) && !shouldSkipBrokerApprovedOnce(brokerActive, result.reason)) {
@@ -6288,6 +8609,29 @@ async function gateDecisionToVerdict(ctx, deps, kind, result, auditExtras = {})
       (entry) => entry.kind === kind && entry.fingerprint === result.fingerprint && entry.repoRoot === ctx.repoRoot
     );
     if (!shouldSkipBrokerApprovedRecord(brokerActive, matchedApproval?.reason)) {
+      if (matchedApproval && auditExtras.replayAction && !validateReplayEnvelope(matchedApproval, auditExtras.replayAction)) {
+        await deps.appendAudit(ctx, {
+          ...gateBase,
+          verdict: "deny_pending_approval",
+          reason: "approval_replay_mismatch",
+          approvalId: matchedApproval.approvalId,
+          wouldBlock: true,
+          permission: "deny"
+        });
+        return classifyResultToGateVerdict({
+          result: {
+            ...result,
+            verdict: "deny_pending_approval",
+            reason: "approval_replay_mismatch"
+          },
+          mode: ctx.config.mode,
+          permission: "deny",
+          wouldBlock: true,
+          approvalId: matchedApproval.approvalId,
+          user_message: "Belay denied this action because it does not match the approved replay envelope. Re-approve the exact action or run belay explain.",
+          agent_message: "Belay denied this action because cwd, tool, or payload changed after approval."
+        });
+      }
       approved = await consumeApprovedApproval(ctx, deps, kind, result.fingerprint);
     }
   }
@@ -6338,7 +8682,19 @@ async function gateDecisionToVerdict(ctx, deps, kind, result, auditExtras = {})
       wouldBlock: true
     });
   }
-  const approval = await ensurePendingApproval(ctx, deps, kind, result, auditExtras.approvalInput);
+  const approval = await ensurePendingApproval(
+    ctx,
+    deps,
+    kind,
+    result,
+    auditExtras.approvalInput,
+    deriveWorkspaceRootScopeHint({
+      result,
+      replayAction: auditExtras.replayAction,
+      payloadForScopeHint: auditExtras.scopeHintPayload,
+      options: auditExtras.classifierOptions ?? {}
+    })
+  );
   let approvalToken;
   try {
     approvalToken = await issueApprovalToken(
@@ -6378,7 +8734,7 @@ async function gateDecisionToVerdict(ctx, deps, kind, result, auditExtras = {})
     permission: "deny",
     wouldBlock: true,
     approvalId: approval.approvalId,
-    user_message: `Belay blocked this high-risk action. Approval ID: ${approval.approvalId}. ${buildRetryInstruction(ctx.config.tokenPrefix, approval.approvalId)} For details, run belay explain or /belay why.`,
+    user_message: `Belay blocked this high-risk action. Approval ID: ${approval.approvalId}. ${buildRetryInstructionForConfig(ctx.config, ctx.config.tokenPrefix, approval.approvalId)} For details, run belay explain or /belay why.`,
     agent_message: `Belay denied this action as ${result.reason}. Wait for approval, then retry the exact same action once.`
   });
 }
@@ -6387,6 +8743,7 @@ async function processApprovalPrompt(ctx, deps, prompt) {
   if (!approvalId) {
     return { continue: true };
   }
+  const adapter = adapterIdFromContext(ctx);
   if (ctx.config.approvalSigning.required) {
     const message = `Signed approval token required for ${approvalId}. Editor prompt approval is disabled in this configuration. Use belay approve --approval-id ${approvalId} --token <signed-token>.`;
     await deps.appendAudit(ctx, {
@@ -6406,12 +8763,11 @@ async function processApprovalPrompt(ctx, deps, prompt) {
     approvalId,
     config: ctx.config,
     requireSignedToken: ctx.config.approvalSigning.required,
-    store: {
-      loadPending: () => deps.loadApprovals(ctx, "pending-approvals.json"),
-      loadApproved: () => deps.loadApprovals(ctx, "approved-approvals.json"),
-      writePending: (filePath, state) => deps.writeApprovals(filePath, state),
-      writeApproved: (filePath, state) => deps.writeApprovals(filePath, state)
-    }
+    adapter,
+    store: gateApprovalStoreFromDeps({
+      loadApprovals: (fileName) => deps.loadApprovals(ctx, fileName),
+      writeApprovals: (filePath, state) => deps.writeApprovals(filePath, state)
+    })
   });
   await deps.appendAudit(ctx, {
     event: "approval",
@@ -6427,9 +8783,91 @@ async function processApprovalPrompt(ctx, deps, prompt) {
       user_message: recorded.message
     };
   }
+  const replay = recorded.approval ? buildReplayHint(ctx.config, recorded.approval, adapter) : null;
+  const shouldFallbackReplay = adapter === "cursor" && replay?.kind === "shell" && replay.autoReplay === true && Boolean(recorded.approval?.input) && (!process.env.VITEST || process.env.BELAY_TEST_APPROVAL_REPLAY === "1");
+  if (shouldFallbackReplay && recorded.approval) {
+    const approvalStore = gateApprovalStoreFromDeps({
+      loadApprovals: (fileName) => deps.loadApprovals(ctx, fileName),
+      writeApprovals: (filePath, state) => deps.writeApprovals(filePath, state)
+    });
+    let replayResult;
+    try {
+      replayResult = await replayShellCommand(
+        recorded.approval.input ?? "",
+        recorded.approval.cwd ?? ctx.repoRoot,
+        getExecutionLeaseMs(ctx.config)
+      );
+    } catch (error) {
+      const detail = error instanceof Error ? error.message : String(error);
+      await deps.appendAudit(ctx, {
+        event: "approval",
+        kind: "approval",
+        verdict: "allow",
+        approvalId,
+        reason: "approval_replay_error",
+        summary: recorded.approval.input ?? recorded.approval.summary ?? prompt
+      });
+      return {
+        continue: false,
+        user_message: `Belay approval recorded for ${approvalId}, but one-step shell replay could not start (${detail}). Approval remains active for one hook retry.`
+      };
+    }
+    const output = [replayResult.stdout, replayResult.stderr].filter(Boolean).join("\n").trim();
+    if (replayResult.exitCode === 0) {
+      try {
+        await consumeApprovedAfterCliReplay({
+          approvalId,
+          store: approvalStore
+        });
+      } catch (error) {
+        const detail = error instanceof Error ? error.message : String(error);
+        await deps.appendAudit(ctx, {
+          event: "approval",
+          kind: "approval",
+          verdict: "allow",
+          approvalId,
+          reason: "approval_replay_consume_error",
+          summary: recorded.approval.input ?? recorded.approval.summary ?? prompt
+        });
+        return {
+          continue: false,
+          user_message: `Belay approval recorded for ${approvalId}, and one-step shell replay succeeded, but approval finalization failed (${detail}). Approval remains active for one hook retry.` + (output ? `
+${output}` : "")
+        };
+      }
+      await deps.appendAudit(ctx, {
+        event: "approval",
+        kind: "approval",
+        verdict: "allow",
+        approvalId,
+        reason: "approval_replay_succeeded",
+        summary: recorded.approval.input ?? recorded.approval.summary ?? prompt
+      });
+      return {
+        continue: false,
+        user_message: `Belay approval recorded for ${approvalId}. One-step shell replay succeeded; no manual retry required.` + (output ? `
+${output}` : "")
+      };
+    }
+    await deps.appendAudit(ctx, {
+      event: "approval",
+      kind: "approval",
+      verdict: "allow",
+      approvalId,
+      reason: "approval_replay_failed",
+      summary: recorded.approval.input ?? recorded.approval.summary ?? prompt
+    });
+    const timeoutNote = replayResult.timedOut ? " Replay timed out." : "";
+    return {
+      continue: false,
+      user_message: `Belay approval recorded for ${approvalId}, but one-step shell replay failed (exit ${replayResult.exitCode}).${timeoutNote} Approval remains active for one hook retry.` + (output ? `
+${output}` : "")
+    };
+  }
   return {
     continue: false,
-    user_message: recorded.message
+    user_message: recorded.message,
+    ...replay ? { replay } : {}
   };
 }
 function gateVerdictToClaudePreToolUseResponse(verdict2) {
@@ -6452,7 +8890,8 @@ function gateVerdictToClaudeUserPromptResponse(verdict2) {
     hookSpecificOutput: {
       hookEventName: "UserPromptSubmit",
       continue: false,
-      user_message: verdict2.user_message
+      user_message: verdict2.user_message,
+      ...verdict2.replay ? { replay: verdict2.replay } : {}
     }
   };
 }
@@ -6467,19 +8906,19 @@ async function appendObservedAudit(ctx, deps, eventName, payload) {
 }
 
 // src/adapters/shared/repo-root.ts
-import { existsSync as existsSync7 } from "node:fs";
-import path21 from "node:path";
+import { existsSync as existsSync11 } from "node:fs";
+import path27 from "node:path";
 function findRepoRoot(startPath, layout) {
-  let current = path21.resolve(startPath);
+  let current = path27.resolve(startPath);
   while (true) {
     for (const marker of layout.repoRootMarkers) {
-      if (existsSync7(path21.join(current, marker))) {
+      if (existsSync11(path27.join(current, marker))) {
         return current;
       }
     }
-    const parent = path21.dirname(current);
+    const parent = path27.dirname(current);
     if (parent === current) {
-      return path21.resolve(startPath);
+      return path27.resolve(startPath);
     }
     current = parent;
   }