@guilz-dev/belay 0.6.0 → 0.8.0

package/dist/core/types.d.ts

@@ -3,6 +3,7 @@ import type { CapabilityGrantV1 } from './capability/grant.js';
 import type { PolicyDecision } from './capability/policy-types.js';
 import type { CapabilityRequestV1 } from './capability/request.js';
 import type { FsScopeAllowlistFile } from './capability/types.js';
+import type { EffectPlan, EffectPlanPolicyProjection } from './effect-ir/types.js';
 export type BelayMode = 'enforce' | 'audit';
 export type HookVerdict = 'allow' | 'allow_flagged' | 'deny_pending_approval';
 export type Reversibility = 'reversible' | 'recoverable_with_cost' | 'irreversible';
@@ -40,6 +41,9 @@ export interface ClassifyResult {
     axes?: VerdictAxes;
     capabilityRequests?: CapabilityRequestV1[];
     authorizationDecision?: PolicyDecision;
+    effectPlan?: EffectPlan;
+    effectPlanPolicyDecisions?: PolicyDecision[];
+    effectPlanProjection?: EffectPlanPolicyProjection;
     boundaryProfile?: string;
 }
 export type UnknownLocalEffectPolicy = 'allow_flagged' | 'deny';
@@ -58,7 +62,9 @@ export interface ConfidenceThresholds {
 }
 export interface ClassifierOptions {
     strictChains?: boolean;
+    /** @deprecated Accepted for API compatibility but ignored by shell EffectPlan authorization. */
     customExternalCommands?: string[];
+    /** @deprecated Accepted for API compatibility but ignored by shell EffectPlan authorization. */
     customAllowCommands?: string[];
     sensitivePaths?: string[];
     unknownLocalEffect?: UnknownLocalEffectPolicy;
@@ -116,8 +122,14 @@ export interface ApprovalRecord {
     capabilityRequests?: CapabilityRequestV1[];
     /** Approval state v3: hash of capabilityRequests for replay binding. */
     capabilityRequestHash?: string;
-    /** Approval state v3: minted grant after human approval. */
+    /** Approval state v3: hash of normalized EffectPlan for composite replay binding. */
+    effectPlanHash?: string;
+    /** Approval state v3: minted grant after human approval (legacy single grant; first of bundle). */
     grant?: CapabilityGrantV1;
+    /** Approval state v3: all grants for composite capability requests (atomic bundle). */
+    grants?: CapabilityGrantV1[];
+    /** Exact one-to-one grant bundle contract. Missing means legacy fingerprint authorization. */
+    grantBundleVersion?: 1;
 }
 export interface ApprovalStateFile {
     version: 1 | 2 | 3;

package/dist/core/verdict/adapter.js

@@ -1,4 +1,5 @@
 import { BOUNDARY_PROFILE_L3_L4_ONLY, resolveBoundaryProfile, } from '../capability/boundary-profile.js';
+import { effectPlanAuditFields } from '../effect-ir/audit.js';
 import { judgeTraceAuditFields } from './judge-audit.js';
 import { recordJudgeLatency } from './judge-baseline.js';
 import { verdict } from './verdict.js';
@@ -21,8 +22,6 @@ export function buildVerdictContext(params) {
         trustedWorkspaceRoots: params.options?.trustedWorkspaceRoots ?? [],
         sensitivePaths: params.options?.sensitivePaths ?? params.config.classifier.sensitivePaths,
         protectedArtifactRoots: protectedArtifactRoots.length > 0 ? [...new Set(protectedArtifactRoots)] : undefined,
-        customAllowCommands: params.options?.customAllowCommands ?? params.config.overrides.allow,
-        customExternalCommands: params.options?.customExternalCommands ?? params.config.overrides.external,
         mode: params.config.mode,
         unknownLocalEffect: params.options?.unknownLocalEffect ?? params.config.policy.unknownLocalEffect,
         unparseableShell: params.options?.unparseableShell ?? params.config.policy.unparseableShell,
@@ -74,14 +73,15 @@ export function verdictToClassifyResult(result, config, options = {}) {
         result.location === 'repo_outside' ||
         result.effect === 'remote_mutation';
     const legacyReason = mapLegacyReason(result);
-    const hookVerdict = result.permission === 'ask'
-        ? 'deny_pending_approval'
-        : legacyReason === 'command_substitution' ||
-            legacyReason === 'unknown_local_effect' ||
-            legacyReason === 'unparseable_shell' ||
-            result.effect === 'local_mutation'
-            ? 'allow_flagged'
-            : 'allow';
+    const hookVerdict = result.effectPlanProjection?.hookVerdict ??
+        (result.permission === 'ask'
+            ? 'deny_pending_approval'
+            : legacyReason === 'command_substitution' ||
+                legacyReason === 'unknown_local_effect' ||
+                legacyReason === 'unparseable_shell' ||
+                result.effect === 'local_mutation'
+                ? 'allow_flagged'
+                : 'allow');
     const assessment = {
         reversibility: result.effect === 'read_only'
             ? 'reversible'
@@ -90,11 +90,11 @@ export function verdictToClassifyResult(result, config, options = {}) {
                 : 'irreversible',
         external,
         blastRadius: result.location,
-        confidence: result.confidence === 'deterministic'
-            ? 0.95
-            : result.confidence === 'llm'
-                ? 0.75
-                : hookVerdict === 'allow_flagged'
+        confidence: hookVerdict === 'allow_flagged'
+            ? 0.75
+            : result.confidence === 'deterministic'
+                ? 0.95
+                : result.confidence === 'llm'
                     ? 0.75
                     : 0.7,
         signals: result.signals,
@@ -120,6 +120,9 @@ export function verdictToClassifyResult(result, config, options = {}) {
         },
         capabilityRequests: result.capabilityRequests,
         authorizationDecision: result.authorizationDecision,
+        effectPlan: result.effectPlan,
+        effectPlanPolicyDecisions: result.effectPlanPolicyDecisions,
+        effectPlanProjection: result.effectPlanProjection,
         boundaryProfile: options.boundaryProfile ??
             (config
                 ? resolveBoundaryProfile({ config, attestation: options.attestation })
@@ -138,6 +141,11 @@ export function verdictAuditFields(result) {
         would: result.permission,
         by: 'verdict',
         signals: result.signals,
+        ...effectPlanAuditFields(result.effectPlan, {
+            capabilityRequests: result.capabilityRequests,
+            decisions: result.effectPlanPolicyDecisions,
+            authorizationDecision: result.authorizationDecision,
+        }),
         ...judgeTraceAuditFields(result.judgeTrace),
     };
 }

package/dist/core/verdict/containment.js

@@ -1,4 +1,5 @@
 import path from 'node:path';
+import { isGitMetadataPath } from '../git-resource-identity.js';
 import { matchesSensitivePath } from '../glob.js';
 import { canonicalPath, pathWithinRoot, relativeWithinRepo, resolveMutationTarget, resolveWorkspaceRootMatch, } from '../path-utils.js';
 import { isOutsideRepoSecretCredentialPath } from './persistent-paths.js';
@@ -36,6 +37,9 @@ export function locationForPath(resolvedPath, repoRoot, trustedWorkspaceRoots =
     return 'repo_outside';
 }
 export function isGitPath(resolvedPath, repoRoot) {
+    if (isGitMetadataPath(resolvedPath, repoRoot)) {
+        return true;
+    }
     const relative = relativeWithinRepo(repoRoot, resolvedPath);
     if (!relative) {
         return false;

package/dist/core/verdict/egress-classify.d.ts

@@ -2,6 +2,18 @@
  * Egress tool classification (SPEC v2.1.3 R33–R34).
  * destructive → ask | read → allow at egress layer | ambiguous → require_approval via PolicyEngine
  */
+import type { ShellEffectRequirement } from '../effect-ir/shell-build.js';
 export type EgressClassification = 'destructive' | 'read' | 'ambiguous';
+export interface DecodeEgressEffectsParams {
+    tokens: string[];
+    cwd: string;
+    segment: string;
+}
 export declare function isEgressToolHead(head: string): boolean;
 export declare function classifyEgressTool(head: string, tokens: string[]): EgressClassification | null;
+/**
+ * Decode curl/wget/gh grammar into typed effects. This API deliberately has no
+ * permission or verdict output; uncertainty is represented by indeterminate
+ * requirements alongside every effect that was still recoverable.
+ */
+export declare function decodeEgressEffects(params: DecodeEgressEffectsParams): ShellEffectRequirement[] | null;