@guilz-dev/belay 0.6.0 → 0.7.0

package/dist/core/types.d.ts

@@ -3,6 +3,7 @@ import type { CapabilityGrantV1 } from './capability/grant.js';
 import type { PolicyDecision } from './capability/policy-types.js';
 import type { CapabilityRequestV1 } from './capability/request.js';
 import type { FsScopeAllowlistFile } from './capability/types.js';
+import type { EffectPlan } from './effect-ir/types.js';
 export type BelayMode = 'enforce' | 'audit';
 export type HookVerdict = 'allow' | 'allow_flagged' | 'deny_pending_approval';
 export type Reversibility = 'reversible' | 'recoverable_with_cost' | 'irreversible';
@@ -40,6 +41,8 @@ export interface ClassifyResult {
     axes?: VerdictAxes;
     capabilityRequests?: CapabilityRequestV1[];
     authorizationDecision?: PolicyDecision;
+    effectPlan?: EffectPlan;
+    effectPlanPolicyDecisions?: PolicyDecision[];
     boundaryProfile?: string;
 }
 export type UnknownLocalEffectPolicy = 'allow_flagged' | 'deny';
@@ -116,8 +119,14 @@ export interface ApprovalRecord {
     capabilityRequests?: CapabilityRequestV1[];
     /** Approval state v3: hash of capabilityRequests for replay binding. */
     capabilityRequestHash?: string;
-    /** Approval state v3: minted grant after human approval. */
+    /** Approval state v3: hash of normalized EffectPlan for composite replay binding. */
+    effectPlanHash?: string;
+    /** Approval state v3: minted grant after human approval (legacy single grant; first of bundle). */
     grant?: CapabilityGrantV1;
+    /** Approval state v3: all grants for composite capability requests (atomic bundle). */
+    grants?: CapabilityGrantV1[];
+    /** Exact one-to-one grant bundle contract. Missing means legacy fingerprint authorization. */
+    grantBundleVersion?: 1;
 }
 export interface ApprovalStateFile {
     version: 1 | 2 | 3;

package/dist/core/verdict/adapter.js

@@ -1,4 +1,5 @@
 import { BOUNDARY_PROFILE_L3_L4_ONLY, resolveBoundaryProfile, } from '../capability/boundary-profile.js';
+import { effectPlanAuditFields } from '../effect-ir/audit.js';
 import { judgeTraceAuditFields } from './judge-audit.js';
 import { recordJudgeLatency } from './judge-baseline.js';
 import { verdict } from './verdict.js';
@@ -120,6 +121,8 @@ export function verdictToClassifyResult(result, config, options = {}) {
         },
         capabilityRequests: result.capabilityRequests,
         authorizationDecision: result.authorizationDecision,
+        effectPlan: result.effectPlan,
+        effectPlanPolicyDecisions: result.effectPlanPolicyDecisions,
         boundaryProfile: options.boundaryProfile ??
             (config
                 ? resolveBoundaryProfile({ config, attestation: options.attestation })
@@ -138,6 +141,11 @@ export function verdictAuditFields(result) {
         would: result.permission,
         by: 'verdict',
         signals: result.signals,
+        ...effectPlanAuditFields(result.effectPlan, {
+            capabilityRequests: result.capabilityRequests,
+            decisions: result.effectPlanPolicyDecisions,
+            authorizationDecision: result.authorizationDecision,
+        }),
         ...judgeTraceAuditFields(result.judgeTrace),
     };
 }

package/dist/core/verdict/launcher-resolve.js

@@ -34,17 +34,6 @@ const PNPM_BUILTIN_COMMANDS = new Set([
     'up',
     'why',
 ]);
-const PNPM_EXEC_LIKE_HEADS = new Set([
-    'vitest',
-    'vite',
-    'biome',
-    'eslint',
-    'jest',
-    'mocha',
-    'tsc',
-    'tsx',
-    'node',
-]);
 function readPackageJson(dir) {
     const packagePath = path.join(dir, 'package.json');
     if (!existsSync(packagePath)) {
@@ -232,12 +221,12 @@ export function resolveLauncherRecipe(params) {
         const resolution = resolveNpmRecipe(params.cwd, params.repoRoot, scriptName, forwardedArgs(tokens));
         if (tokens[0] === 'pnpm' &&
             tokens[1] &&
-            PNPM_EXEC_LIKE_HEADS.has(tokens[1]) &&
+            !PNPM_BUILTIN_COMMANDS.has(tokens[1]) &&
             resolution.reason === 'npm_script_undefined') {
             return {
                 recipes: [tokens.slice(1).join(' ')],
                 opaque: false,
-                reason: 'pnpm_exec_like',
+                reason: 'pnpm_exec_shorthand',
             };
         }
         return resolution;
@@ -252,13 +241,6 @@ export function resolveLauncherRecipe(params) {
             reason: 'pnpm_exec',
         };
     }
-    if (tokens[0] === 'pnpm' && tokens[1] && PNPM_EXEC_LIKE_HEADS.has(tokens[1])) {
-        return {
-            recipes: [tokens.slice(1).join(' ')],
-            opaque: false,
-            reason: 'pnpm_exec_like',
-        };
-    }
     return null;
 }
 const READ_ONLY_LAUNCHER_SUFFIXES = new Set(['--version', '-v', '--help', '-h']);

package/dist/core/verdict/shell-policy.d.ts

@@ -16,6 +16,7 @@ export interface SegmentShellPolicyInput {
 }
 export declare function evaluateSegmentShellPolicy(input: SegmentShellPolicyInput): {
     request: CapabilityRequestV1;
+    requests: CapabilityRequestV1[];
     decision: PolicyDecision;
 };
 /** Attach capability metadata without influencing the verdict (audit / shadow only). */

package/dist/core/verdict/shell-policy.js

@@ -34,7 +34,7 @@ export function evaluateSegmentShellPolicy(input) {
 export function shellPolicyMetadata(input) {
     const result = evaluateSegmentShellPolicy(input);
     return {
-        capabilityRequests: [result.request],
+        capabilityRequests: result.requests,
         authorizationDecision: result.decision,
     };
 }

package/dist/core/verdict/types.d.ts

@@ -1,6 +1,7 @@
 import type { PolicyDecision } from '../capability/policy-types.js';
 import type { CapabilityRequestV1 } from '../capability/request.js';
 import type { BelayConfigV4 } from '../config.js';
+import type { EffectPlan } from '../effect-ir/types.js';
 export type VerdictPermission = 'allow' | 'ask';
 export type VerdictLocation = 'repo_local' | 'repo_outside' | 'external' | 'mixed' | 'unknown';
 export type VerdictOpacity = 'transparent' | 'recursive' | 'opaque' | 'unparseable';
@@ -19,6 +20,8 @@ export interface VerdictResult {
     judgeTrace?: JudgeTrace;
     capabilityRequests?: CapabilityRequestV1[];
     authorizationDecision?: PolicyDecision;
+    effectPlan?: EffectPlan;
+    effectPlanPolicyDecisions?: PolicyDecision[];
 }
 export interface Tier1Verdict {
     /** true = undoable via git/fs snapshot or trivial local revert (ADR-002 local-recoverable). */
@@ -93,4 +96,6 @@ export interface InternalSegmentVerdict {
     judgeTrace?: JudgeTrace;
     capabilityRequests?: CapabilityRequestV1[];
     authorizationDecision?: PolicyDecision;
+    effectPlan?: EffectPlan;
+    effectPlanPolicyDecisions?: PolicyDecision[];
 }

package/dist/core/verdict/verdict.js

@@ -1,6 +1,9 @@
 import path from 'node:path';
 import { policyDecisionToLegacyReason } from '../capability/policy-bridge.js';
-import { policyDecisionRequiresAsk } from '../capability/policy-engine.js';
+import { combinePolicyDecisions, policyDecisionRequiresAsk } from '../capability/policy-engine.js';
+import { mergeEffectPlans } from '../effect-ir/normalize.js';
+import { isPackageExecLauncher } from '../effect-ir/package-exec.js';
+import { evaluatePackageExecSegment } from '../effect-ir/package-exec-eval.js';
 import { canonicalPath, resolveMutationTarget } from '../path-utils.js';
 import { extractRedirectTargets, isFdDuplication, isRedirectOperator, tokenizeShell, } from '../shell-tokenizer.js';
 import { analyzePathTargets, cwdRelative, isDestructiveHighStakesMutation, resolveTrustedPath, touchesProtectedRoot, } from './containment.js';
@@ -94,6 +97,12 @@ function mergeLocation(left, right) {
     return 'mixed';
 }
 function combineInternal(left, right) {
+    const policyDecisions = [
+        ...(left.effectPlanPolicyDecisions ??
+            (left.authorizationDecision ? [left.authorizationDecision] : [])),
+        ...(right.effectPlanPolicyDecisions ??
+            (right.authorizationDecision ? [right.authorizationDecision] : [])),
+    ];
     return {
         permission: worsePermission(left.permission, right.permission),
         location: mergeLocation(left.location, right.location),
@@ -122,11 +131,9 @@ function combineInternal(left, right) {
         signals: [...new Set([...left.signals, ...right.signals])],
         judgeTrace: right.judgeTrace ?? left.judgeTrace,
         capabilityRequests: [...(left.capabilityRequests ?? []), ...(right.capabilityRequests ?? [])],
-        authorizationDecision: worsePermission(left.permission, right.permission) === 'ask'
-            ? right.permission === 'ask'
-                ? (right.authorizationDecision ?? left.authorizationDecision)
-                : left.authorizationDecision
-            : (right.authorizationDecision ?? left.authorizationDecision),
+        authorizationDecision: policyDecisions.length > 0 ? combinePolicyDecisions(policyDecisions) : undefined,
+        effectPlan: mergeEffectPlans(left.effectPlan, right.effectPlan),
+        effectPlanPolicyDecisions: policyDecisions,
     };
 }
 function askVerdict(params) {
@@ -327,7 +334,7 @@ function tier0HighStakesRm(tokens, context) {
     return null;
 }
 function verdictFromOpacityPolicy(params) {
-    const { request, decision } = evaluateSegmentShellPolicy({
+    const { requests, decision } = evaluateSegmentShellPolicy({
         command: params.command,
         segmentHead: params.segmentHead,
         effect: params.effect,
@@ -343,7 +350,7 @@ function verdictFromOpacityPolicy(params) {
         effect: params.effect,
         confidence: 'deterministic',
         signals: [...params.signals, ...decision.signals],
-        capabilityRequests: [request],
+        capabilityRequests: requests,
         authorizationDecision: decision,
     };
     if (policyDecisionRequiresAsk(decision)) {
@@ -428,7 +435,7 @@ async function evaluateSegment(command, context, depth) {
     if (recursiveScript) {
         const prescan = prescanInterpreterCode(recursiveScript);
         if (prescan && tier1RequiresAsk(prescan)) {
-            const { request, decision } = evaluateSegmentShellPolicy({
+            const { requests, decision } = evaluateSegmentShellPolicy({
                 command: recursiveScript,
                 segmentHead: segment.head,
                 effect: 'unknown',
@@ -448,7 +455,7 @@ async function evaluateSegment(command, context, depth) {
                 confidence: 'deterministic',
                 reason: legacyReason,
                 signals: ['interpreter_secret_prescan', prescan.reason, ...decision.signals],
-                capabilityRequests: [request],
+                capabilityRequests: requests,
                 authorizationDecision: decision,
             });
         }
@@ -465,6 +472,14 @@ async function evaluateSegment(command, context, depth) {
             signals: [...innerVerdict.signals, 'recursive_wrapper'],
         };
     }
+    if (isPackageExecLauncher(peeled)) {
+        return evaluatePackageExecSegment({
+            command,
+            peeled,
+            context,
+            evaluateInner: (innerRecipe) => evaluateSegment(innerRecipe, context, depth + 1),
+        });
+    }
     if (isRoutineLauncher(peeled)) {
         const resolution = resolveLauncherRecipe({
             tokens: peeled,
@@ -518,7 +533,7 @@ async function evaluateSegment(command, context, depth) {
     const semantics = analyzeShellCommandSemantics(peeled, segment, context.cwd);
     const pathContext = pathContextFromSemantics(context, semantics);
     if (semantics.requiresAsk) {
-        const { request, decision } = evaluateSegmentShellPolicy({
+        const { requests, decision } = evaluateSegmentShellPolicy({
             command,
             segmentHead: segment.head,
             effect: 'local_mutation',
@@ -535,13 +550,13 @@ async function evaluateSegment(command, context, depth) {
             confidence: 'deterministic',
             reason: semantics.requiresAsk.reason,
             signals: semantics.requiresAsk.signals,
-            capabilityRequests: [request],
+            capabilityRequests: requests,
             authorizationDecision: decision,
         });
     }
     const egressClass = semantics.egressClass ?? classifyEgressTool(segment.head, peeled);
     if (egressClass === 'destructive') {
-        const { request, decision } = evaluateSegmentShellPolicy({
+        const { requests, decision } = evaluateSegmentShellPolicy({
             command,
             segmentHead: segment.head,
             effect: 'remote_mutation',
@@ -559,13 +574,13 @@ async function evaluateSegment(command, context, depth) {
             confidence: 'deterministic',
             reason: 'tier0_external',
             signals: ['tier0_external', segment.head, ...decision.signals],
-            capabilityRequests: [request],
+            capabilityRequests: requests,
             authorizationDecision: decision,
         });
     }
     if (tier0ExternalMatch(semantics.normalizedKey ?? segment.key, segment.head, peeled, semantics.signals)) {
         const tier0Key = semantics.normalizedKey ?? segment.key;
-        const { request, decision } = evaluateSegmentShellPolicy({
+        const { requests, decision } = evaluateSegmentShellPolicy({
             command,
             segmentHead: segment.head,
             effect: 'remote_mutation',
@@ -582,7 +597,7 @@ async function evaluateSegment(command, context, depth) {
             confidence: 'deterministic',
             reason: 'tier0_external',
             signals: ['tier0_external', tier0Key, ...decision.signals],
-            capabilityRequests: [request],
+            capabilityRequests: requests,
             authorizationDecision: decision,
         });
     }
@@ -743,7 +758,7 @@ async function evaluateSegment(command, context, depth) {
         })
         : null;
     if (mutationPrescan) {
-        const { request, decision } = evaluateSegmentShellPolicy(buildPolicyInput({
+        const { requests, decision } = evaluateSegmentShellPolicy(buildPolicyInput({
             effect: 'local_mutation',
             location: pathAnalysis.location === 'unknown'
                 ? 'unknown'
@@ -766,7 +781,7 @@ async function evaluateSegment(command, context, depth) {
             confidence: 'deterministic',
             reason: legacyReason,
             signals: ['tier1_catastrophic', mutationPrescan.reason, ...decision.signals],
-            capabilityRequests: [request],
+            capabilityRequests: requests,
             authorizationDecision: decision,
         });
     }
@@ -777,12 +792,12 @@ async function evaluateSegment(command, context, depth) {
         (outsideMutation && effect !== 'read_only');
     let policyMetadata = {};
     if (needsPolicy) {
-        const { request, decision } = evaluateSegmentShellPolicy(buildPolicyInput({
+        const { requests, decision } = evaluateSegmentShellPolicy(buildPolicyInput({
             effect,
             location: pathAnalysis.location,
         }));
         policyMetadata = {
-            capabilityRequests: [request],
+            capabilityRequests: requests,
             authorizationDecision: decision,
         };
         if (policyDecisionRequiresAsk(decision)) {
@@ -908,6 +923,8 @@ function toVerdictResult(internal, command, context, fingerprintCwd = context.cw
         judgeTrace: internal.judgeTrace,
         capabilityRequests: internal.capabilityRequests,
         authorizationDecision: internal.authorizationDecision,
+        effectPlan: internal.effectPlan,
+        effectPlanPolicyDecisions: internal.effectPlanPolicyDecisions,
     };
 }
 export async function verdict(command, context) {

package/dist/types.d.ts

@@ -138,6 +138,17 @@ export interface StatusReport {
     dogfood: DogfoodStatus;
     health: HealthSnapshot;
     visibility: AuditVisibilityReport;
+    fileCheckpoint: {
+        enabled: boolean;
+        allowNonGit: boolean;
+        transactionalEnabled: boolean;
+        durableCheckpointEnabled: boolean;
+        maxFiles: number;
+        maxSourceBytes: number;
+        maxWorkspaceBytes: number;
+        prepareTimeoutMs: number;
+        copyConcurrency: number;
+    };
 }
 export interface ReportOptions {
     targetDir?: string;

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const PACKAGE_VERSION = "0.6.0";
+export declare const PACKAGE_VERSION = "0.7.0";

package/dist/version.js

@@ -1,2 +1,2 @@
 // Generated by scripts/sync-version.mjs — do not edit.
-export const PACKAGE_VERSION = '0.6.0';
+export const PACKAGE_VERSION = '0.7.0';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@guilz-dev/belay",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "description": "Belay-style approval and audit gating for agent runtimes.",
   "type": "module",
   "license": "MIT",

package/skills/belay/SKILL.md

@@ -37,9 +37,14 @@ setup (or `npx @guilz-dev/belay init` for non-interactive install). Run
 ## When belay blocks an action
 
 1. Read the approval ID in the deny message.
-2. Approve once with `/belay-approve <approval-id>` or `belay approve <approval-id>`.
-3. Retry the original action unchanged (default `approval.flow` is `one_step` for shell — the
-   approval response includes a replay hint when auto-replay is enabled).
+2. In the editor, approve once with `/belay-approve <approval-id>`.
+3. With default `approval.flow: one_step`, editor approval atomically claims the one-shot grant and
+   replays the exact denied shell action through the configured boundary driver. No follow-up prompt
+   is required. Failed or timed-out replay requires fresh approval. Tool and subagent actions still
+   require retrying the original action unchanged.
+
+An instruction may follow the approval line in the same prompt. Belay runs the approved shell action
+first and continues the remaining prompt only after replay succeeds.
 
 For shell-only CLI replay after approval: `belay approve <approval-id> --replay`.
 

package/skills/belay/belay-approve.md

@@ -1,21 +1,24 @@
 Run after belay denies a high-risk action and returns an approval ID.
 
-```bash
-belay approve <approval-id>
+```text
+/belay-approve <approval-id>
 ```
 
-Then retry the original action unchanged.
+With default `approval.flow: one_step`, the editor hook atomically claims the one-shot grant and
+immediately replays the exact denied shell action through the configured boundary driver. No
+follow-up prompt is required. Failed or timed-out replay requires fresh approval. Tool and subagent
+approvals still require a manual retry of the original action unchanged.
 
-With default `approval.flow: one_step`, shell approvals return a replay hint from editor
-hooks. Tool and subagent approvals still require a manual retry.
+An instruction may follow the approval line in the same prompt. Belay runs the approved shell action
+first and continues the remaining prompt only after replay succeeds.
 
-To run a denied shell command from the CLI after approval (explicit opt-in; do not also retry via hooks):
+For CLI approval, replay remains explicit:
 
 ```bash
 belay approve <approval-id> --replay
 ```
 
-Successful CLI replay consumes the one-shot grant. On failure, the approval stays active for one hook retry.
+CLI replay claims the one-shot grant before execution. Failure or timeout requires fresh approval.
 
 Restore legacy two-step UX in `belay.config.json`: