@guilz-dev/belay 0.4.0 → 0.6.0

package/dist/core/transactional/runner.js

@@ -1,5 +1,7 @@
+import { boundaryMountReadOnlyFromPrediction, runWithBoundaryRunnable, } from '../capability/boundary-run.js';
+import { hostIntegrationBoundaryContext } from '../capability/boundary-session.js';
 import { evaluateTransactionalDiff } from './diff-evaluator.js';
-import { applyWorktreeChanges, collectWorktreeChanges, createGitWorktreeSnapshot, isDirtyWorktree, isGitWorktreeAvailable, resolveWorktreeCwd, runShellCommand, } from './git-worktree.js';
+import { applyWorktreeChanges, captureRepoFileHashes, collectWorktreeChanges, createGitWorktreeSnapshot, isDirtyWorktree, isGitWorktreeAvailable, resolveWorktreeCwd, TRANSACTIONAL_APPLY_TOCTOU, } from './git-worktree.js';
 import { TRANSACTIONAL_ALREADY_APPLIED, TRANSACTIONAL_APPLY_FAILED, TRANSACTIONAL_OBSERVED_RISK, } from './reasons.js';
 export async function runTransactionalExecution(params) {
     const { predicted, repoRoot, stateDir, command, cwd, timeoutMs, diffContext } = params;
@@ -12,7 +14,7 @@ export async function runTransactionalExecution(params) {
             result: predicted,
         };
     }
-    if (await isDirtyWorktree(repoRoot)) {
+    if (await isDirtyWorktree(repoRoot, { ignoreRoots: params.dirtyIgnoreRoots })) {
         return {
             ok: false,
             skipped: true,
@@ -25,7 +27,16 @@ export async function runTransactionalExecution(params) {
     try {
         snapshot = await createGitWorktreeSnapshot(repoRoot, stateDir);
         const execCwd = resolveWorktreeCwd(repoRoot, snapshot.worktreePath, cwd);
-        const shellResult = await runShellCommand(command, execCwd, timeoutMs);
+        const boundaryContext = params.boundaryContext ?? hostIntegrationBoundaryContext(params.repoRoot);
+        const shellResult = await runWithBoundaryRunnable(boundaryContext.driver, {
+            prepareContext: boundaryContext.prepareContext,
+            command,
+            cwd: execCwd,
+            timeoutMs,
+            runOptions: {
+                mountReadOnly: boundaryMountReadOnlyFromPrediction(predicted),
+            },
+        });
         if (shellResult.timedOut) {
             return {
                 ok: false,
@@ -52,10 +63,12 @@ export async function runTransactionalExecution(params) {
         const changes = await collectWorktreeChanges(snapshot.worktreePath);
         const observed = evaluateTransactionalDiff(changes, diffContext);
         if (observed.verdict === 'allow') {
+            const baseHashes = await captureRepoFileHashes(repoRoot, changes);
             try {
-                await applyWorktreeChanges(snapshot.worktreePath, repoRoot, changes);
+                await applyWorktreeChanges(snapshot.worktreePath, repoRoot, changes, { baseHashes });
             }
-            catch {
+            catch (error) {
+                const toctou = error instanceof Error && error.message === TRANSACTIONAL_APPLY_TOCTOU;
                 const result = {
                     ...predicted,
                     verdict: 'deny_pending_approval',
@@ -64,7 +77,10 @@ export async function runTransactionalExecution(params) {
                         ...observed.assessment,
                         reversibility: 'irreversible',
                         confidence: 1,
-                        signals: [...observed.assessment.signals, 'transactional_apply_failed'],
+                        signals: [
+                            ...observed.assessment.signals,
+                            toctou ? 'transactional_apply_toctou' : 'transactional_apply_failed',
+                        ],
                     },
                 };
                 return {

package/dist/core/transactional/types.d.ts

@@ -1,3 +1,4 @@
+import type { ResolvedBoundaryDriverContext } from '../capability/boundary-session.js';
 import type { Assessment, ClassifyResult, HookVerdict } from '../types.js';
 export type TransactionalFileChangeKind = 'added' | 'modified' | 'deleted';
 export interface TransactionalFileChange {
@@ -43,4 +44,7 @@ export interface TransactionalRunnerParams {
     timeoutMs: number;
     predicted: ClassifyResult;
     diffContext: TransactionalDiffContext;
+    boundaryContext?: ResolvedBoundaryDriverContext;
+    /** Repo-local Belay paths excluded from dirty-worktree gating (init artifacts). */
+    dirtyIgnoreRoots?: string[];
 }

package/dist/core/types.d.ts

@@ -1,3 +1,7 @@
+import type { BoundaryAttestation } from './capability/attestation.js';
+import type { CapabilityGrantV1 } from './capability/grant.js';
+import type { PolicyDecision } from './capability/policy-types.js';
+import type { CapabilityRequestV1 } from './capability/request.js';
 import type { FsScopeAllowlistFile } from './capability/types.js';
 export type BelayMode = 'enforce' | 'audit';
 export type HookVerdict = 'allow' | 'allow_flagged' | 'deny_pending_approval';
@@ -34,6 +38,9 @@ export interface ClassifyResult {
     normalizedCommand?: string;
     summary?: string;
     axes?: VerdictAxes;
+    capabilityRequests?: CapabilityRequestV1[];
+    authorizationDecision?: PolicyDecision;
+    boundaryProfile?: string;
 }
 export type UnknownLocalEffectPolicy = 'allow_flagged' | 'deny';
 export type UnparseableShellPolicy = 'allow_flagged' | 'deny';
@@ -68,10 +75,13 @@ export interface ClassifierOptions {
     brokerFsScope?: boolean;
     fsScopeAllowlist?: FsScopeAllowlistFile;
     trustedWorkspaceRoots?: string[];
-    /** Test override: inject Tier1 judge without changing config.judge. */
-    tier1Judge?: import('./verdict/types.js').Tier1Judge;
     /** When false, path resolution stays fail-closed (opaque cd chains). Default: Boolean(cwd). */
     trustedCwd?: boolean;
+    grants?: CapabilityGrantV1[];
+    attestation?: BoundaryAttestation | null;
+    boundaryProfile?: string;
+    /** True when egress proxy is running and bound to this repository. */
+    egressProxyActive?: boolean;
 }
 export interface ApprovalScopeHint {
     scope: 'workspace-root';
@@ -102,8 +112,16 @@ export interface ApprovalRecord {
     payloadJson?: string;
     /** Optional scope hint for structured capability approvals. */
     scopeHint?: ApprovalScopeHint;
+    /** Approval state v3: normalized capability requests at ask time. */
+    capabilityRequests?: CapabilityRequestV1[];
+    /** Approval state v3: hash of capabilityRequests for replay binding. */
+    capabilityRequestHash?: string;
+    /** Approval state v3: minted grant after human approval. */
+    grant?: CapabilityGrantV1;
 }
 export interface ApprovalStateFile {
-    version: 1 | 2;
+    version: 1 | 2 | 3;
+    /** Optimistic concurrency revision (v3). */
+    revision?: number;
     approvals: ApprovalRecord[];
 }

package/dist/core/verdict/adapter.d.ts

@@ -1,15 +1,14 @@
 import type { BelayConfigV4 } from '../config.js';
 import type { ClassifierOptions, ClassifyResult } from '../types.js';
-import type { Tier1Judge, VerdictContext, VerdictResult } from './types.js';
+import type { VerdictContext, VerdictResult } from './types.js';
 export declare function resolveClassifierTrustedCwd(cwd: string, options?: Pick<ClassifierOptions, 'trustedCwd'>, explicit?: boolean): boolean;
 export declare function buildVerdictContext(params: {
     cwd: string;
     repoRoot: string;
     config: BelayConfigV4;
     options?: ClassifierOptions;
-    judge?: Tier1Judge;
     trustedCwd?: boolean;
 }): VerdictContext;
-export declare function classifyShell(command: string, cwd: string, repoRoot: string, config: BelayConfigV4, options?: ClassifierOptions, judge?: Tier1Judge): Promise<ClassifyResult>;
-export declare function verdictToClassifyResult(result: VerdictResult): ClassifyResult;
+export declare function classifyShell(command: string, cwd: string, repoRoot: string, config: BelayConfigV4, options?: ClassifierOptions): Promise<ClassifyResult>;
+export declare function verdictToClassifyResult(result: VerdictResult, config?: BelayConfigV4, options?: ClassifierOptions): ClassifyResult;
 export declare function verdictAuditFields(result: VerdictResult): Record<string, unknown>;

package/dist/core/verdict/adapter.js

@@ -1,6 +1,6 @@
+import { BOUNDARY_PROFILE_L3_L4_ONLY, resolveBoundaryProfile, } from '../capability/boundary-profile.js';
 import { judgeTraceAuditFields } from './judge-audit.js';
 import { recordJudgeLatency } from './judge-baseline.js';
-import { createJudgeFromConfig } from './judge-factory.js';
 import { verdict } from './verdict.js';
 export function resolveClassifierTrustedCwd(cwd, options, explicit) {
     if (explicit !== undefined) {
@@ -16,29 +16,27 @@ export function buildVerdictContext(params) {
     return {
         cwd: params.cwd,
         repoRoot: params.repoRoot,
+        config: params.config,
         trustedCwd: resolveClassifierTrustedCwd(params.cwd, params.options, params.trustedCwd),
         trustedWorkspaceRoots: params.options?.trustedWorkspaceRoots ?? [],
         sensitivePaths: params.options?.sensitivePaths ?? params.config.classifier.sensitivePaths,
         protectedArtifactRoots: protectedArtifactRoots.length > 0 ? [...new Set(protectedArtifactRoots)] : undefined,
         customAllowCommands: params.options?.customAllowCommands ?? params.config.overrides.allow,
         customExternalCommands: params.options?.customExternalCommands ?? params.config.overrides.external,
-        judge: params.judge ??
-            params.options?.tier1Judge ??
-            createJudgeFromConfig(params.config, { repoRoot: params.repoRoot }),
         mode: params.config.mode,
         unknownLocalEffect: params.options?.unknownLocalEffect ?? params.config.policy.unknownLocalEffect,
         unparseableShell: params.options?.unparseableShell ?? params.config.policy.unparseableShell,
+        grants: params.options?.grants,
+        attestation: params.options?.attestation,
+        egressProxyActive: params.options?.egressProxyActive,
     };
 }
-export async function classifyShell(command, cwd, repoRoot, config, options = {}, judge) {
-    const context = buildVerdictContext({ cwd, repoRoot, config, options, judge });
+export async function classifyShell(command, cwd, repoRoot, config, options = {}) {
+    const context = buildVerdictContext({ cwd, repoRoot, config, options });
     const started = Date.now();
     const result = await verdict(command, context);
-    const elapsed = Date.now() - started;
-    if (result.confidence !== 'llm') {
-        recordJudgeLatency('tier0', elapsed);
-    }
-    return verdictToClassifyResult(result);
+    recordJudgeLatency('gate', Date.now() - started);
+    return verdictToClassifyResult(result, config, options);
 }
 function mapLegacyReason(result) {
     if (result.reason === 'repo_outside_mutation') {
@@ -71,7 +69,7 @@ function mapLegacyReason(result) {
     }
     return result.reason;
 }
-export function verdictToClassifyResult(result) {
+export function verdictToClassifyResult(result, config, options = {}) {
     const external = result.location === 'external' ||
         result.location === 'repo_outside' ||
         result.effect === 'remote_mutation';
@@ -120,6 +118,12 @@ export function verdictToClassifyResult(result) {
             signals: result.signals,
             ...judgeTraceAuditFields(result.judgeTrace),
         },
+        capabilityRequests: result.capabilityRequests,
+        authorizationDecision: result.authorizationDecision,
+        boundaryProfile: options.boundaryProfile ??
+            (config
+                ? resolveBoundaryProfile({ config, attestation: options.attestation })
+                : BOUNDARY_PROFILE_L3_L4_ONLY),
     };
 }
 export function verdictAuditFields(result) {

package/dist/core/verdict/cursor-acp-client.d.ts

@@ -0,0 +1,67 @@
+import { type ChildProcessWithoutNullStreams, type SpawnOptionsWithoutStdio } from 'node:child_process';
+import type { CliJudgeRunCommand } from './judge-cli.js';
+interface AcpSessionResponse {
+    sessionId: string;
+    models?: {
+        currentModelId?: string;
+        availableModels?: Array<{
+            modelId?: string;
+        }>;
+    };
+    configOptions?: Array<{
+        id?: string;
+        currentValue?: string;
+        options?: Array<{
+            value?: string;
+        }>;
+    }>;
+}
+export type CursorAcpSpawn = (binary: string, args: string[], options: SpawnOptionsWithoutStdio & {
+    stdio: ['pipe', 'pipe', 'pipe'];
+}) => ChildProcessWithoutNullStreams;
+export type CursorAcpErrorKind = 'connect_timeout' | 'eval_timeout' | 'process_exit' | 'protocol_error';
+export declare class CursorAcpError extends Error {
+    readonly kind: CursorAcpErrorKind;
+    constructor(kind: CursorAcpErrorKind, message: string);
+}
+export interface CursorAcpJudgeRunnerOptions {
+    cwd: string;
+    connectTimeoutMs: number;
+    binary?: string;
+    spawnProcess?: CursorAcpSpawn;
+}
+export declare function resolveCursorAcpModelId(requested: string, session: AcpSessionResponse): string;
+export declare class CursorAcpJudgeRunner {
+    private readonly options;
+    private readonly binary;
+    private readonly spawnProcess;
+    private child;
+    private startPromise;
+    private connected;
+    private nextId;
+    private stdoutBuffer;
+    private stderrTail;
+    private readonly pending;
+    private readonly messageBuffers;
+    private activeSessionId;
+    constructor(options: CursorAcpJudgeRunnerOptions);
+    get sessionId(): string | null;
+    readonly run: CliJudgeRunCommand;
+    private evaluate;
+    stop(): Promise<void>;
+    private ensureConnected;
+    private start;
+    private createSession;
+    private request;
+    private notify;
+    private handleStdout;
+    private handleMessage;
+    private respond;
+    private respondError;
+    private handleProcessExit;
+    private rejectPending;
+    private withStderr;
+    private terminateChild;
+    private signalAndWait;
+}
+export {};

package/dist/core/verdict/cursor-acp-client.js

@@ -0,0 +1,345 @@
+import { spawn, } from 'node:child_process';
+export class CursorAcpError extends Error {
+    kind;
+    constructor(kind, message) {
+        super(message);
+        this.kind = kind;
+        this.name = 'CursorAcpError';
+    }
+}
+const STDERR_TAIL_LIMIT = 2_048;
+const TERMINATE_GRACE_MS = 250;
+function invocationValue(invocation, flag) {
+    const index = invocation.args.indexOf(flag);
+    return index >= 0 ? invocation.args[index + 1] : undefined;
+}
+function promptFromInvocation(invocation) {
+    if (invocation.stdin !== undefined) {
+        return invocation.stdin;
+    }
+    return invocation.args[invocation.args.length - 1] ?? '';
+}
+function modelIdsFromSession(session) {
+    const fromModels = session.models?.availableModels
+        ?.map((entry) => entry.modelId)
+        .filter((value) => Boolean(value));
+    if (fromModels?.length) {
+        return fromModels;
+    }
+    const modelOption = session.configOptions?.find((option) => option.id === 'model');
+    return (modelOption?.options
+        ?.map((entry) => entry.value)
+        .filter((value) => Boolean(value)) ?? []);
+}
+export function resolveCursorAcpModelId(requested, session) {
+    const available = modelIdsFromSession(session);
+    if (available.includes(requested)) {
+        return requested;
+    }
+    const parameterized = available.find((modelId) => modelId.startsWith(`${requested}[`));
+    return parameterized ?? requested;
+}
+export class CursorAcpJudgeRunner {
+    options;
+    binary;
+    spawnProcess;
+    child = null;
+    startPromise = null;
+    connected = false;
+    nextId = 0;
+    stdoutBuffer = '';
+    stderrTail = '';
+    pending = new Map();
+    messageBuffers = new Map();
+    activeSessionId = null;
+    constructor(options) {
+        this.options = options;
+        this.binary = options.binary ?? 'cursor-agent';
+        this.spawnProcess = options.spawnProcess ?? spawn;
+    }
+    get sessionId() {
+        return this.activeSessionId;
+    }
+    run = async (invocation, timeoutMs) => {
+        if (invocation.binary !== this.binary && invocation.binary !== 'cursor-agent') {
+            throw new CursorAcpError('protocol_error', `Cursor ACP runner cannot execute ${invocation.binary}`);
+        }
+        let totalTimer = null;
+        try {
+            const evaluation = this.evaluate(invocation, timeoutMs);
+            const totalTimeout = new Promise((_resolve, reject) => {
+                totalTimer = setTimeout(() => {
+                    reject(new CursorAcpError('eval_timeout', 'Cursor ACP evaluation timed out'));
+                }, timeoutMs);
+            });
+            return await Promise.race([evaluation, totalTimeout]);
+        }
+        catch (error) {
+            if (error instanceof CursorAcpError && error.kind === 'eval_timeout') {
+                this.notify('session/cancel', { sessionId: this.activeSessionId });
+            }
+            await this.stop();
+            throw error;
+        }
+        finally {
+            if (totalTimer) {
+                clearTimeout(totalTimer);
+            }
+        }
+    };
+    async evaluate(invocation, timeoutMs) {
+        await this.ensureConnected();
+        const requestedResumeId = invocationValue(invocation, '--resume');
+        const model = invocationValue(invocation, '--model') ?? 'composer-2.5';
+        const canReuse = Boolean(requestedResumeId) && requestedResumeId === this.activeSessionId;
+        if (!canReuse) {
+            await this.createSession(model);
+        }
+        const sessionId = this.activeSessionId;
+        if (!sessionId) {
+            throw new CursorAcpError('protocol_error', 'Cursor ACP session was not created');
+        }
+        this.messageBuffers.set(sessionId, '');
+        try {
+            await this.request('session/prompt', {
+                sessionId,
+                prompt: [{ type: 'text', text: promptFromInvocation(invocation) }],
+            }, timeoutMs, 'eval_timeout');
+            const raw = this.messageBuffers.get(sessionId)?.trim() ?? '';
+            if (!raw) {
+                throw new CursorAcpError('protocol_error', 'Cursor ACP returned no agent message');
+            }
+            return raw;
+        }
+        finally {
+            this.messageBuffers.delete(sessionId);
+        }
+    }
+    async stop() {
+        const child = this.child;
+        this.child = null;
+        this.connected = false;
+        this.startPromise = null;
+        this.activeSessionId = null;
+        this.stdoutBuffer = '';
+        this.messageBuffers.clear();
+        this.rejectPending(new CursorAcpError('process_exit', this.withStderr('Cursor ACP process stopped')));
+        if (child && child.exitCode === null) {
+            await this.terminateChild(child);
+        }
+    }
+    async ensureConnected() {
+        if (this.connected && this.child) {
+            return;
+        }
+        if (!this.startPromise) {
+            this.startPromise = this.start().finally(() => {
+                this.startPromise = null;
+            });
+        }
+        await this.startPromise;
+    }
+    async start() {
+        this.stderrTail = '';
+        const child = this.spawnProcess(this.binary, ['acp'], {
+            cwd: this.options.cwd,
+            stdio: ['pipe', 'pipe', 'pipe'],
+        });
+        this.child = child;
+        child.stdout.on('data', (chunk) => this.handleStdout(String(chunk)));
+        child.stderr.on('data', (chunk) => {
+            this.stderrTail = `${this.stderrTail}${String(chunk)}`.slice(-STDERR_TAIL_LIMIT);
+        });
+        child.once('error', (error) => {
+            this.handleProcessExit(new CursorAcpError('process_exit', this.withStderr(error.message)), child);
+        });
+        child.once('close', (code) => {
+            this.handleProcessExit(new CursorAcpError('process_exit', this.withStderr(`Cursor ACP exited with code ${code ?? 'unknown'}`)), child);
+        });
+        try {
+            await this.request('initialize', {
+                protocolVersion: 1,
+                clientCapabilities: {
+                    fs: { readTextFile: false, writeTextFile: false },
+                    terminal: false,
+                },
+                clientInfo: {
+                    name: 'belay-judge',
+                    title: 'Belay Judge',
+                    version: '1',
+                },
+            }, this.options.connectTimeoutMs, 'connect_timeout');
+            await this.request('authenticate', { methodId: 'cursor_login' }, this.options.connectTimeoutMs, 'connect_timeout');
+            this.connected = true;
+        }
+        catch (error) {
+            await this.stop();
+            throw error;
+        }
+    }
+    async createSession(model) {
+        const previous = this.activeSessionId;
+        this.activeSessionId = null;
+        if (previous) {
+            await this.request('session/close', { sessionId: previous }, Math.min(this.options.connectTimeoutMs, 1_000), 'connect_timeout').catch(() => undefined);
+        }
+        const session = (await this.request('session/new', { cwd: this.options.cwd, mcpServers: [] }, this.options.connectTimeoutMs, 'connect_timeout'));
+        if (!session?.sessionId) {
+            throw new CursorAcpError('protocol_error', 'Cursor ACP session/new omitted sessionId');
+        }
+        this.activeSessionId = session.sessionId;
+        await this.request('session/set_config_option', { sessionId: session.sessionId, configId: 'mode', value: 'ask' }, this.options.connectTimeoutMs, 'connect_timeout');
+        await this.request('session/set_config_option', {
+            sessionId: session.sessionId,
+            configId: 'model',
+            value: resolveCursorAcpModelId(model, session),
+        }, this.options.connectTimeoutMs, 'connect_timeout');
+    }
+    request(method, params, timeoutMs, timeoutKind) {
+        const child = this.child;
+        if (!child?.stdin.writable) {
+            return Promise.reject(new CursorAcpError('process_exit', this.withStderr('Cursor ACP stdin is unavailable')));
+        }
+        const id = ++this.nextId;
+        return new Promise((resolve, reject) => {
+            const timer = setTimeout(() => {
+                this.pending.delete(id);
+                reject(new CursorAcpError(timeoutKind, `Cursor ACP ${method} timed out`));
+            }, timeoutMs);
+            this.pending.set(id, { method, resolve, reject, timer });
+            child.stdin.write(`${JSON.stringify({ jsonrpc: '2.0', id, method, params })}\n`);
+        });
+    }
+    notify(method, params) {
+        if (!this.child?.stdin.writable) {
+            return;
+        }
+        this.child.stdin.write(`${JSON.stringify({ jsonrpc: '2.0', method, params })}\n`);
+    }
+    handleStdout(chunk) {
+        this.stdoutBuffer += chunk;
+        const lines = this.stdoutBuffer.split('\n');
+        this.stdoutBuffer = lines.pop() ?? '';
+        for (const line of lines) {
+            if (!line.trim()) {
+                continue;
+            }
+            try {
+                this.handleMessage(JSON.parse(line));
+            }
+            catch {
+                const child = this.child;
+                this.handleProcessExit(new CursorAcpError('protocol_error', 'Cursor ACP emitted invalid JSON-RPC'), child);
+                if (child?.exitCode === null) {
+                    void this.terminateChild(child);
+                }
+            }
+        }
+    }
+    handleMessage(message) {
+        if (message.id !== undefined && !message.method) {
+            const pending = this.pending.get(message.id);
+            if (!pending) {
+                return;
+            }
+            clearTimeout(pending.timer);
+            this.pending.delete(message.id);
+            if (message.error !== undefined) {
+                pending.reject(new CursorAcpError('protocol_error', `Cursor ACP ${pending.method} failed: ${JSON.stringify(message.error)}`));
+            }
+            else {
+                pending.resolve(message.result);
+            }
+            return;
+        }
+        if (message.method === 'session/update') {
+            const sessionId = message.params?.sessionId;
+            const update = message.params?.update;
+            if (typeof sessionId !== 'string' || !update || typeof update !== 'object') {
+                return;
+            }
+            const record = update;
+            const content = record.content;
+            if (record.sessionUpdate === 'agent_message_chunk' &&
+                content &&
+                typeof content === 'object' &&
+                typeof content.text === 'string') {
+                const text = content.text;
+                this.messageBuffers.set(sessionId, `${this.messageBuffers.get(sessionId) ?? ''}${text}`);
+            }
+            return;
+        }
+        if (message.id !== undefined && message.method === 'session/request_permission') {
+            this.respond(message.id, { outcome: { outcome: 'cancelled' } });
+            return;
+        }
+        if (message.id !== undefined && message.method) {
+            this.respondError(message.id, -32601, 'Belay Judge does not expose client tools');
+        }
+    }
+    respond(id, result) {
+        this.child?.stdin.write(`${JSON.stringify({ jsonrpc: '2.0', id, result })}\n`);
+    }
+    respondError(id, code, message) {
+        this.child?.stdin.write(`${JSON.stringify({ jsonrpc: '2.0', id, error: { code, message } })}\n`);
+    }
+    handleProcessExit(error, exitedChild = this.child) {
+        if (exitedChild && this.child !== exitedChild) {
+            return;
+        }
+        this.child = null;
+        this.connected = false;
+        this.activeSessionId = null;
+        this.messageBuffers.clear();
+        this.rejectPending(error);
+    }
+    rejectPending(error) {
+        for (const pending of this.pending.values()) {
+            clearTimeout(pending.timer);
+            pending.reject(error);
+        }
+        this.pending.clear();
+    }
+    withStderr(message) {
+        const stderr = this.stderrTail.trim();
+        return stderr ? `${message}: ${stderr}` : message;
+    }
+    async terminateChild(child) {
+        if (child.exitCode !== null) {
+            return;
+        }
+        if (await this.signalAndWait(child, 'SIGTERM')) {
+            return;
+        }
+        await this.signalAndWait(child, 'SIGKILL');
+    }
+    signalAndWait(child, signal) {
+        if (child.exitCode !== null) {
+            return Promise.resolve(true);
+        }
+        return new Promise((resolve) => {
+            let settled = false;
+            const finish = (exited) => {
+                if (settled)
+                    return;
+                settled = true;
+                clearTimeout(timer);
+                child.off('close', onExit);
+                child.off('error', onExit);
+                resolve(exited);
+            };
+            const onExit = () => finish(true);
+            const timer = setTimeout(() => finish(child.exitCode !== null), TERMINATE_GRACE_MS);
+            child.once('close', onExit);
+            child.once('error', onExit);
+            try {
+                if (!child.kill(signal)) {
+                    finish(child.exitCode !== null);
+                }
+            }
+            catch {
+                finish(child.exitCode !== null);
+            }
+        });
+    }
+}

package/dist/core/verdict/egress-classify.d.ts

@@ -1,6 +1,6 @@
 /**
- * Tier0 egress tool classification (SPEC v2.1.3 R33–R34).
- * destructive → Tier0 ask | read → Tier0 allow | ambiguous → Tier1 (fail-closed)
+ * Egress tool classification (SPEC v2.1.3 R33–R34).
+ * destructive → ask | read → allow at egress layer | ambiguous → require_approval via PolicyEngine
  */
 export type EgressClassification = 'destructive' | 'read' | 'ambiguous';
 export declare function isEgressToolHead(head: string): boolean;

package/dist/core/verdict/egress-classify.js

@@ -1,6 +1,6 @@
 /**
- * Tier0 egress tool classification (SPEC v2.1.3 R33–R34).
- * destructive → Tier0 ask | read → Tier0 allow | ambiguous → Tier1 (fail-closed)
+ * Egress tool classification (SPEC v2.1.3 R33–R34).
+ * destructive → ask | read → allow at egress layer | ambiguous → require_approval via PolicyEngine
  */
 const EGRESS_TOOL_HEADS = new Set([
     'aws',

package/dist/core/verdict/git-classifier.d.ts

@@ -0,0 +1,26 @@
+import type { VerdictEffect } from './types.js';
+export interface NormalizedGitInvocation {
+    subcommand: string;
+    args: string[];
+    effectiveCwd?: string;
+    gitDir?: string;
+    workTree?: string;
+}
+export interface GitCommandSemantics {
+    effect: VerdictEffect;
+    pathTargets: string[];
+    scopeTargets: string[];
+    signals: string[];
+    egressClass?: 'read' | 'destructive' | 'ambiguous';
+    requiresAsk?: {
+        reason: string;
+        signals: string[];
+    };
+    effectiveCwd?: string;
+    gitWorkTree?: string;
+    normalizedKey: string;
+    isReadOnly: boolean;
+}
+export declare function normalizeGitInvocation(tokens: string[], baseCwd: string): NormalizedGitInvocation | null;
+export declare function isGitReadOnlyInvocation(tokens: string[], baseCwd: string): boolean;
+export declare function classifyGitCommand(tokens: string[], baseCwd: string): GitCommandSemantics | null;