@guilz-dev/belay 0.4.0 → 0.6.0

package/dist/core/classify-subagent.js

@@ -1,3 +1,6 @@
+import { BOUNDARY_PROFILE_L3_L4_ONLY } from './capability/boundary-profile.js';
+import { policyReasonToLegacyReason } from './capability/policy-bridge.js';
+import { evaluateSubagentPolicy, policyDecisionRequiresAsk } from './capability/policy-engine.js';
 import { canonicalStringify, subagentFingerprint } from './fingerprint.js';
 import { subagentFingerprintSource } from './replay-scrub.js';
 import { scrubValue } from './scrub.js';
@@ -25,7 +28,7 @@ function extractSubagentText(payload, options) {
 function fingerprintSource(payload, options) {
     return subagentFingerprintSource(payload, options.scrubOptions ?? {});
 }
-export function classifySubagent(payload, repoRoot, options = {}) {
+export function classifySubagent(payload, repoRoot, options = {}, config) {
     const kind = payload.tool_name === 'Task' ? 'Task' : String(payload.subagent_type ?? 'generalPurpose');
     const scrubbed = fingerprintSource(payload, options);
     const summary = extractSubagentText(payload, options);
@@ -35,6 +38,36 @@ export function classifySubagent(payload, repoRoot, options = {}) {
         const pattern = new RegExp(`\\b${term}\\b`, 'i');
         return pattern.test(lowered);
     });
+    const signals = hasExternalTerm ? ['subagent_external_intent_hint'] : ['subagent_default_review'];
+    const { request, decision } = evaluateSubagentPolicy({
+        subagentType: kind,
+        summary,
+        repoRoot,
+        cwd: repoRoot,
+        inputFingerprint: fingerprint,
+        signals,
+    }, config, {
+        grants: options.grants,
+        attestation: options.attestation,
+        egressProxyActive: options.egressProxyActive,
+    });
+    if (policyDecisionRequiresAsk(decision)) {
+        return {
+            verdict: 'deny_pending_approval',
+            reason: policyReasonToLegacyReason(decision),
+            summary,
+            fingerprint,
+            assessment: {
+                reversibility: 'recoverable_with_cost',
+                external: hasExternalTerm,
+                blastRadius: 'subagent task scope',
+                confidence: hasExternalTerm ? 0.7 : 0.67,
+                signals: [...signals, ...decision.signals],
+            },
+            capabilityRequests: [request],
+            authorizationDecision: decision,
+        };
+    }
     return {
         verdict: 'allow_flagged',
         reason: 'subagent_review',
@@ -45,7 +78,10 @@ export function classifySubagent(payload, repoRoot, options = {}) {
             external: false,
             blastRadius: 'subagent task scope',
             confidence: hasExternalTerm ? 0.7 : 0.67,
-            signals: hasExternalTerm ? ['subagent_external_intent_hint'] : ['subagent_default_review'],
+            signals,
         },
+        capabilityRequests: [request],
+        authorizationDecision: decision,
+        boundaryProfile: options.boundaryProfile ?? BOUNDARY_PROFILE_L3_L4_ONLY,
     };
 }

package/dist/core/classify-tool.js

@@ -1,11 +1,14 @@
 import path from 'node:path';
+import { BOUNDARY_PROFILE_L3_L4_ONLY } from './capability/boundary-profile.js';
+import { policyReasonToLegacyReason } from './capability/policy-bridge.js';
+import { evaluateFileMutationPolicy, policyDecisionRequiresAsk, } from './capability/policy-engine.js';
 import { canonicalStringify, toolFingerprint } from './fingerprint.js';
 import { matchesSensitivePath } from './glob.js';
 import { pathWithinRoot, resolveWorkspaceRootMatch } from './path-utils.js';
 import { scrubValue } from './scrub.js';
 import { classifyShell, resolveClassifierTrustedCwd } from './verdict/adapter.js';
-import { mutationPrescanRequiresAsk, tier1RequiresAsk } from './verdict/judge.js';
-import { createJudgeFromConfig } from './verdict/judge-factory.js';
+import { isGitPath } from './verdict/containment.js';
+import { mutationPrescanRequiresAsk } from './verdict/prescan.js';
 const DEFAULT_SENSITIVE_PATHS = ['.env', '.env.*', '**/credentials/**'];
 const FILE_WRITE_TOOL_NAMES = new Set(['write']);
 const FILE_EDIT_TOOL_NAMES = new Set([
@@ -18,6 +21,19 @@ const FILE_EDIT_TOOL_NAMES = new Set([
 ]);
 const FILE_DELETE_TOOL_NAMES = new Set(['delete']);
 const APPLY_PATCH_TOOL_NAMES = new Set(['apply_patch', 'applypatch']);
+function policyAuth(options) {
+    if (!options.grants &&
+        options.attestation === undefined &&
+        options.egressProxyActive === undefined) {
+        return undefined;
+    }
+    return {
+        grants: options.grants,
+        attestation: options.attestation,
+        egressProxyActive: options.egressProxyActive,
+        sensitivePaths: options.sensitivePaths,
+    };
+}
 function scrubPayload(value, options) {
     return scrubValue(value, options.scrubOptions);
 }
@@ -76,11 +92,7 @@ function applyPatchTargets(patch) {
 function normalizedToolName(toolName) {
     return toolName.trim().toLowerCase();
 }
-function resolveFileTier1Judge(config, options, repoRoot) {
-    return options.tier1Judge ?? createJudgeFromConfig(config, { repoRoot });
-}
-async function classifyFileMutationWithTier1(params) {
-    const judge = resolveFileTier1Judge(params.config, params.options, params.repoRoot);
+function classifyFileMutationWithPolicy(params) {
     const trustedCwd = resolveClassifierTrustedCwd(params.cwd, params.options);
     const prescan = mutationPrescanRequiresAsk({
         targets: [params.filePath],
@@ -91,11 +103,29 @@ async function classifyFileMutationWithTier1(params) {
         sensitivePaths: params.options.sensitivePaths ?? params.config.classifier.sensitivePaths,
     });
     if (prescan) {
+        const fingerprint = toolFingerprint(params.toolName, { path: params.filePath }, params.repoRoot);
+        const { request, decision } = evaluateFileMutationPolicy({
+            hookKind: 'tool',
+            toolKind: params.toolKind,
+            filePath: params.filePath,
+            resolvedPath: params.resolvedPath,
+            repoRoot: params.repoRoot,
+            cwd: params.cwd,
+            inputFingerprint: fingerprint,
+            signals: [...params.signals, 'tier1_catastrophic', prescan.reason],
+            isDelete: params.isDelete,
+            locationLabel: params.locationLabel,
+            trustedWorkspaceRoots: params.options.trustedWorkspaceRoots,
+            sensitivePaths: params.options.sensitivePaths ?? params.config.classifier.sensitivePaths,
+        }, params.config, policyAuth(params.options));
+        const legacyReason = policyDecisionRequiresAsk(decision)
+            ? policyReasonToLegacyReason(decision)
+            : 'tier1_catastrophic';
         return {
             verdict: 'deny_pending_approval',
-            reason: 'tier1_catastrophic',
+            reason: legacyReason,
             summary: params.filePath,
-            fingerprint: toolFingerprint(params.toolName, { path: params.filePath }, params.repoRoot),
+            fingerprint,
             assessment: {
                 reversibility: 'irreversible',
                 external: params.locationLabel === 'outside_repo',
@@ -103,20 +133,32 @@ async function classifyFileMutationWithTier1(params) {
                     ? 'outside the repository'
                     : 'sensitive repository file',
                 confidence: 0.95,
-                signals: [...params.signals, 'tier1_catastrophic', prescan.reason],
+                signals: [...params.signals, 'tier1_catastrophic', prescan.reason, ...decision.signals],
             },
+            capabilityRequests: [request],
+            authorizationDecision: decision,
+            boundaryProfile: params.options.boundaryProfile ?? BOUNDARY_PROFILE_L3_L4_ONLY,
         };
     }
-    const tier1Text = `file_mutation: ${params.toolKind} path=${params.resolvedPath} location=${params.locationLabel}`;
-    const tier1 = await judge.evaluate({
-        text: tier1Text,
-        context: { cwd: params.cwd, repoRoot: params.repoRoot },
-    });
     const fingerprint = toolFingerprint(params.toolName, { path: params.filePath }, params.repoRoot);
-    if (tier1RequiresAsk(tier1)) {
+    const { request, decision } = evaluateFileMutationPolicy({
+        hookKind: 'tool',
+        toolKind: params.toolKind,
+        filePath: params.filePath,
+        resolvedPath: params.resolvedPath,
+        repoRoot: params.repoRoot,
+        cwd: params.cwd,
+        inputFingerprint: fingerprint,
+        signals: params.signals,
+        isDelete: params.isDelete,
+        locationLabel: params.locationLabel,
+        trustedWorkspaceRoots: params.options.trustedWorkspaceRoots,
+        sensitivePaths: params.options.sensitivePaths ?? params.config.classifier.sensitivePaths,
+    }, params.config, policyAuth(params.options));
+    if (policyDecisionRequiresAsk(decision)) {
         return {
             verdict: 'deny_pending_approval',
-            reason: 'tier1_catastrophic',
+            reason: policyReasonToLegacyReason(decision),
             summary: params.filePath,
             fingerprint,
             assessment: {
@@ -125,9 +167,12 @@ async function classifyFileMutationWithTier1(params) {
                 blastRadius: params.locationLabel === 'outside_repo'
                     ? 'outside the repository'
                     : 'sensitive repository file',
-                confidence: 0.82,
-                signals: [...params.signals, 'tier1_catastrophic', tier1.reason],
+                confidence: 0.95,
+                signals: [...params.signals, ...decision.signals],
             },
+            capabilityRequests: [request],
+            authorizationDecision: decision,
+            boundaryProfile: params.options.boundaryProfile ?? BOUNDARY_PROFILE_L3_L4_ONLY,
         };
     }
     const reason = params.isDelete ? 'file_delete' : 'file_mutation';
@@ -141,8 +186,11 @@ async function classifyFileMutationWithTier1(params) {
             external: params.locationLabel === 'outside_repo',
             blastRadius: params.locationLabel === 'outside_repo' ? 'outside the repository' : 'this repository',
             confidence: 0.72,
-            signals: [...params.signals, 'tier1_restorable', tier1.reason],
+            signals: [...params.signals, ...decision.signals],
         },
+        capabilityRequests: [request],
+        authorizationDecision: decision,
+        boundaryProfile: params.options.boundaryProfile ?? BOUNDARY_PROFILE_L3_L4_ONLY,
     };
 }
 export async function classifyToolUse(payload, repoRoot, cwd, config, options = {}) {
@@ -230,24 +278,24 @@ export async function classifyToolUse(payload, repoRoot, cwd, config, options =
         const hitsProtectedRoot = protectedRoots.some((root) => pathWithinRoot(root, resolvedPath));
         if (hitsProtectedRoot) {
             signals.push('control_plane_path');
-            return {
-                verdict: 'deny_pending_approval',
-                reason: 'control_plane_mutation',
-                summary: filePath,
-                fingerprint: toolFingerprint(toolName, { path: filePath }, repoRoot),
-                assessment: {
-                    reversibility: 'irreversible',
-                    external: false,
-                    blastRadius: 'agent-belay control plane',
-                    confidence: 0.97,
-                    signals,
-                },
-            };
+            return classifyFileMutationWithPolicy({
+                toolName,
+                toolKind,
+                filePath,
+                resolvedPath,
+                repoRoot,
+                cwd,
+                config,
+                options,
+                signals,
+                isDelete: FILE_DELETE_TOOL_NAMES.has(toolKind),
+                locationLabel: 'control_plane',
+            });
         }
         const workspaceMatch = resolveWorkspaceRootMatch(repoRoot, options.trustedWorkspaceRoots, resolvedPath);
         if (workspaceMatch === null) {
             signals.push('outside_repo_path');
-            return classifyFileMutationWithTier1({
+            return classifyFileMutationWithPolicy({
                 toolName,
                 toolKind,
                 filePath,
@@ -274,7 +322,7 @@ export async function classifyToolUse(payload, repoRoot, cwd, config, options =
             sensitivePaths,
         });
         if (workspacePrescan) {
-            return classifyFileMutationWithTier1({
+            return classifyFileMutationWithPolicy({
                 toolName,
                 toolKind,
                 filePath,
@@ -291,7 +339,7 @@ export async function classifyToolUse(payload, repoRoot, cwd, config, options =
         const relativePath = workspaceMatch.relativePath;
         if (matchesSensitivePath(relativePath, sensitivePaths)) {
             signals.push('sensitive_path');
-            return classifyFileMutationWithTier1({
+            return classifyFileMutationWithPolicy({
                 toolName,
                 toolKind,
                 filePath,
@@ -306,35 +354,51 @@ export async function classifyToolUse(payload, repoRoot, cwd, config, options =
             });
         }
         if (FILE_DELETE_TOOL_NAMES.has(toolKind)) {
-            signals.push('file_delete');
-            return {
-                verdict: 'allow_flagged',
-                reason: 'file_delete',
-                summary: filePath,
-                fingerprint: toolFingerprint(toolName, { path: filePath }, repoRoot),
-                assessment: {
-                    reversibility: 'recoverable_with_cost',
-                    external: false,
-                    blastRadius: 'this repository',
-                    confidence: 0.7,
+            if (isGitPath(resolvedPath, repoRoot)) {
+                signals.push('protected_artifact');
+                return classifyFileMutationWithPolicy({
+                    toolName,
+                    toolKind,
+                    filePath,
+                    resolvedPath,
+                    repoRoot,
+                    cwd,
+                    config,
+                    options,
                     signals,
-                },
-            };
+                    isDelete: true,
+                    locationLabel: 'sensitive_path',
+                });
+            }
+            signals.push('file_delete');
+            return classifyFileMutationWithPolicy({
+                toolName,
+                toolKind,
+                filePath,
+                resolvedPath,
+                repoRoot,
+                cwd,
+                config,
+                options,
+                signals,
+                isDelete: true,
+                locationLabel: 'repo_local',
+            });
         }
         signals.push('file_mutation');
-        return {
-            verdict: 'allow_flagged',
-            reason: 'file_mutation',
-            summary: filePath,
-            fingerprint: toolFingerprint(toolName, { path: filePath }, repoRoot),
-            assessment: {
-                reversibility: 'recoverable_with_cost',
-                external: false,
-                blastRadius: 'this repository',
-                confidence: 0.68,
-                signals,
-            },
-        };
+        return classifyFileMutationWithPolicy({
+            toolName,
+            toolKind,
+            filePath,
+            resolvedPath,
+            repoRoot,
+            cwd,
+            config,
+            options,
+            signals,
+            isDelete: false,
+            locationLabel: 'repo_local',
+        });
     }
     if (APPLY_PATCH_TOOL_NAMES.has(toolKind)) {
         const patch = extractPatch(payload);

package/dist/core/config.d.ts

@@ -1,6 +1,6 @@
-import type { ClassifierOptions, ControlPlaneIntegrity, ScrubOptions, UnknownLocalEffectPolicy, UnparseableShellPolicy } from './types.js';
+import type { BoundaryDriverId } from './capability/attestation.js';
+import type { BelayMode, ClassifierOptions, ControlPlaneIntegrity, ScrubOptions, UnknownLocalEffectPolicy, UnparseableShellPolicy } from './types.js';
 import { type BelayJudgeRuntimeConfig } from './verdict/judge-runtime-config.js';
-export type BelayMode = 'enforce' | 'audit';
 export type { UnknownLocalEffectPolicy };
 export interface BelayConfigV1 {
     version: 1;
@@ -94,7 +94,10 @@ export interface JudgeCloudConsent {
     endpoint: string;
     by: string;
 }
+export type BelayJudgeMode = 'shadow' | 'off';
 export interface BelayJudgeConfig {
+    /** Gate uses PolicyEngine; judge runs async shadow/compare only. */
+    mode?: BelayJudgeMode;
     provider: JudgeProvider;
     providerId?: JudgeProviderId | DeprecatedJudgeProviderId;
     model: string;
@@ -157,8 +160,14 @@ export interface BelayEgressConfig {
     /** When true with egress enabled, L3 external command lists become hints only. */
     demoteL3External: boolean;
 }
+export interface BelayCapabilityConfig {
+    grantsEnabled?: boolean;
+    boundaryDriver?: BoundaryDriverId;
+    attestationRelPath?: string;
+}
+export declare const DEFAULT_CAPABILITY_V5: BelayCapabilityConfig;
 export interface BelayConfigV4 {
-    version: 4;
+    version: 4 | 5;
     adapter?: 'cursor' | 'claude' | 'codex';
     /** Where hooks/runtime/skill artifacts are installed. Defaults to project. */
     installScope?: 'project' | 'global';
@@ -178,6 +187,7 @@ export interface BelayConfigV4 {
     sandbox: BelaySandboxConfig;
     audit: BelayConfigV2['audit'];
     judge: BelayJudgeConfig;
+    capability?: BelayCapabilityConfig;
 }
 /** @deprecated Use BelayConfigV4 */
 export type BelayConfigV3 = BelayConfigV4;
@@ -239,6 +249,7 @@ type RawConfigInput = Partial<{
     sandbox: Partial<BelaySandboxConfig>;
     audit: Partial<BelayConfigV2['audit']>;
     installScope: 'project' | 'global';
+    capability: Partial<BelayCapabilityConfig>;
 }>;
 export declare function migrateConfig(loaded: unknown): BelayConfigV4;
 export declare function normalizeConfigV2(config: BelayConfigV2): BelayConfigV2;

package/dist/core/config.js

@@ -3,6 +3,7 @@ import { warnDeprecatedJudgeModelAuto } from './judge-model-policy.js';
 import { getJudgeProviderSpec, inferProviderIdFromConfig, isRemovedProviderId, normalizeLegacyProviderId, warnRemovedProviderId, } from './verdict/judge-catalog.js';
 import { normalizeJudgeRuntimeConfig, } from './verdict/judge-runtime-config.js';
 export const DEFAULT_JUDGE_LOCAL_OLLAMA = {
+    mode: 'shadow',
     provider: 'ollama',
     providerId: 'ollama',
     model: 'gemma4:e2b',
@@ -11,6 +12,7 @@ export const DEFAULT_JUDGE_LOCAL_OLLAMA = {
     keepAlive: '30m',
 };
 export const DEFAULT_JUDGE_OPENAI_COMPATIBLE_TEMPLATE = {
+    mode: 'shadow',
     provider: 'openai-compatible',
     providerId: 'codex',
     model: 'gpt-5.3-codex-high',
@@ -20,6 +22,23 @@ export const DEFAULT_JUDGE_OPENAI_COMPATIBLE_TEMPLATE = {
 };
 /** @deprecated Use DEFAULT_JUDGE_OPENAI_COMPATIBLE_TEMPLATE */
 export const DEFAULT_JUDGE_CURSOR_COMPOSER = DEFAULT_JUDGE_OPENAI_COMPATIBLE_TEMPLATE;
+export const DEFAULT_CAPABILITY_V5 = {
+    grantsEnabled: true,
+    boundaryDriver: 'host-integration',
+    attestationRelPath: '.belay/attestation.json',
+};
+function normalizeCapabilityConfig(capability) {
+    if (!capability) {
+        return undefined;
+    }
+    return {
+        ...DEFAULT_CAPABILITY_V5,
+        ...capability,
+        grantsEnabled: capability.grantsEnabled !== false,
+        boundaryDriver: capability.boundaryDriver ?? DEFAULT_CAPABILITY_V5.boundaryDriver,
+        attestationRelPath: capability.attestationRelPath ?? DEFAULT_CAPABILITY_V5.attestationRelPath,
+    };
+}
 /** Pre-v0.4 defaults preserved when migrating existing v1/v2/v3 configs. */
 import { DEFAULT_SILENT_PASS_THRESHOLD } from './audit-summary.js';
 /** @deprecated Use DEFAULT_SILENT_PASS_THRESHOLD from audit-summary.js */
@@ -222,7 +241,8 @@ export function isConfigV3(value) {
     return version === 3 || version === 4;
 }
 export function isConfigV4(value) {
-    return typeof value === 'object' && value !== null && value.version === 4;
+    const version = typeof value === 'object' && value !== null ? value.version : null;
+    return version === 4 || version === 5;
 }
 export function normalizeJudgeProvider(provider) {
     if (provider === 'anthropic') {
@@ -239,6 +259,7 @@ function defaultJudgeTemplateForProvider(provider) {
     }
     if (provider === 'anthropic') {
         return {
+            mode: 'shadow',
             provider: 'anthropic',
             providerId: 'claude',
             model: 'claude-sonnet-4-6',
@@ -283,6 +304,7 @@ export function normalizeJudgeConfig(judge) {
         const timeoutMs = typeof judge.timeoutMs === 'number' && judge.timeoutMs > 0 ? judge.timeoutMs : base.timeoutMs;
         const endpoint = typeof judge.endpoint === 'string' && judge.endpoint.trim() ? judge.endpoint.trim() : null;
         return {
+            mode: judge.mode === 'off' ? 'off' : 'shadow',
             provider,
             providerId: rawProviderId,
             model,
@@ -320,6 +342,7 @@ export function normalizeJudgeConfig(judge) {
         endpoint = catalogSpec.defaultEndpoint;
     }
     const normalized = {
+        mode: judge.mode === 'off' ? 'off' : 'shadow',
         provider,
         providerId,
         model,
@@ -490,6 +513,19 @@ function normalizeV3Raw(raw) {
         },
     });
 }
+function normalizeV5Raw(raw) {
+    const base = normalizeV3Raw({ ...raw, version: 4 });
+    return {
+        ...base,
+        version: 5,
+        capability: {
+            grantsEnabled: raw.capability?.grantsEnabled !== false,
+            boundaryDriver: raw.capability?.boundaryDriver ?? 'host-integration',
+            attestationRelPath: raw.capability?.attestationRelPath ?? '.belay/attestation.json',
+            ...(raw.capability ?? {}),
+        },
+    };
+}
 export function migrateConfig(loaded) {
     if (typeof loaded !== 'object' || loaded === null) {
         return { ...DEFAULT_CONFIG_V4 };
@@ -498,6 +534,9 @@ export function migrateConfig(loaded) {
     if (raw.version === 4) {
         return normalizeV3Raw(raw);
     }
+    if (raw.version === 5) {
+        return normalizeV5Raw(raw);
+    }
     if (raw.version === 3 || (raw.version === undefined && hasV3Sections(raw))) {
         return normalizeV3Raw(raw);
     }
@@ -576,8 +615,9 @@ export function normalizeConfig(config) {
         return normalizeConfigV2(config);
     }
     const v4 = config;
-    return {
-        version: 4,
+    const version = v4.version === 5 ? 5 : 4;
+    const normalized = {
+        version,
         ...(v4.installScope === 'global' || v4.installScope === 'project'
             ? { installScope: v4.installScope }
             : {}),
@@ -743,6 +783,10 @@ export function normalizeConfig(config) {
         },
         judge: normalizeJudgeConfig(v4.judge ?? DEFAULT_JUDGE_LOCAL_OLLAMA),
     };
+    if (version === 5 || v4.capability) {
+        normalized.capability = normalizeCapabilityConfig(v4.capability ?? DEFAULT_CAPABILITY_V5);
+    }
+    return normalized;
 }
 export function isFreshConfigInput(loaded) {
     if (loaded === null || loaded === undefined) {
@@ -814,6 +858,15 @@ export function mergeConfig(existing, defaults = DEFAULT_CONFIG_V4) {
             ...migrated.audit,
         },
         ...(migrated.installScope ? { installScope: migrated.installScope } : {}),
+        ...(migrated.version === 5 || migrated.capability
+            ? {
+                version: migrated.version === 5 ? 5 : 4,
+                capability: normalizeCapabilityConfig({
+                    ...DEFAULT_CAPABILITY_V5,
+                    ...migrated.capability,
+                }),
+            }
+            : {}),
     });
 }
 export function scrubOptionsFromConfig(config) {

package/dist/core/gate-contract.d.ts

@@ -29,6 +29,9 @@ export interface GateVerdict extends GatePermissionResponse {
     wouldBlock: boolean;
     mode: 'enforce' | 'audit';
     axes?: ClassifyResult['axes'];
+    capabilityRequests?: ClassifyResult['capabilityRequests'];
+    authorizationDecision?: ClassifyResult['authorizationDecision'];
+    boundaryProfile?: string;
 }
 export declare function isGatedAction(value: unknown): value is GatedAction;
 export declare function classifyResultToGateVerdict(params: {

package/dist/core/gate-contract.js

@@ -26,6 +26,9 @@ export function classifyResultToGateVerdict(params) {
         user_message,
         agent_message,
         axes: result.axes,
+        capabilityRequests: result.capabilityRequests,
+        authorizationDecision: result.authorizationDecision,
+        boundaryProfile: result.boundaryProfile,
     };
 }
 export function unnormalizedGateVerdict(params) {

package/dist/core/gate-engine.js

@@ -1,4 +1,5 @@
 import { allPathsAllowlisted } from './capability/allowlist.js';
+import { checkGatedActionLimits } from './capability/limits.js';
 import { collectOutsideRepoPaths, collectOutsideRepoPathsFromToolPayload, } from './capability/paths.js';
 import { classifySubagent } from './classify-subagent.js';
 import { classifyToolUse } from './classify-tool.js';
@@ -197,6 +198,10 @@ function applyToolSandboxPolicies(action, result, options) {
     return next;
 }
 export async function classifyGatedAction(action, config, extraOptions = {}) {
+    const limitResult = checkGatedActionLimits(action);
+    if (limitResult) {
+        return limitResult;
+    }
     const options = { ...classifierOptionsFromConfig(config), ...extraOptions };
     if (action.kind === 'shell') {
         const command = action.command ?? shellCommandFromPayload(action.payload ?? {});
@@ -221,7 +226,7 @@ export async function classifyGatedAction(action, config, extraOptions = {}) {
         };
     }
     if (action.kind === 'subagent') {
-        return classifySubagent(action.payload ?? {}, action.repoRoot, options);
+        return classifySubagent(action.payload ?? {}, action.repoRoot, options, config);
     }
     let result = await classifyToolUse(action.payload ?? {}, action.repoRoot, action.cwd, config, options);
     result = applyToolSandboxPolicies(action, result, options);