@guilz-dev/belay 0.6.0 → 0.8.0

package/dist/core/capability/approval-state-mutation.js

@@ -1,5 +1,6 @@
 import { constants } from 'node:fs';
-import { open, readFile, unlink } from 'node:fs/promises';
+import { mkdir, open, readFile, unlink } from 'node:fs/promises';
+import path from 'node:path';
 import { upgradeApprovalStateToV3 } from './approval-v3.js';
 const DEFAULT_RETRIES = 8;
 const LOCK_STALE_MS = 5 * 60_000;
@@ -31,6 +32,7 @@ async function isStaleApprovalLock(lockPath) {
     }
 }
 async function acquireApprovalStateLock(lockPath, maxRetries) {
+    await mkdir(path.dirname(lockPath), { recursive: true });
     for (let attempt = 0; attempt < maxRetries; attempt += 1) {
         try {
             const handle = await open(lockPath, constants.O_CREAT | constants.O_EXCL | constants.O_WRONLY);
@@ -53,14 +55,27 @@ async function acquireApprovalStateLock(lockPath, maxRetries) {
     }
     throw new Error(`Failed to acquire approval state lock: ${lockPath}`);
 }
+export async function withStateFileLock(filePath, operation, maxRetries = DEFAULT_RETRIES) {
+    const release = await acquireApprovalStateLock(`${filePath}.lock`, maxRetries);
+    try {
+        return await operation();
+    }
+    finally {
+        await release();
+    }
+}
 export async function mutateApprovalStateWithRetry(params) {
     const maxRetries = params.maxRetries ?? DEFAULT_RETRIES;
     for (let attempt = 0; attempt < maxRetries; attempt += 1) {
-        const loaded = await params.load();
-        const lockPath = `${loaded.filePath}.lock`;
+        const initial = await params.load();
+        const lockPath = `${initial.filePath}.lock`;
         let release = null;
         try {
             release = await acquireApprovalStateLock(lockPath, maxRetries);
+            const loaded = await params.load();
+            if (loaded.filePath !== initial.filePath) {
+                throw new Error('Approval state path changed while acquiring lock');
+            }
             const base = upgradeApprovalStateToV3(loaded.state);
             const revision = base.revision ?? 0;
             const outcome = params.mutate(base);
@@ -90,3 +105,61 @@ export async function mutateApprovalStateWithRetry(params) {
     }
     return null;
 }
+export async function mutatePendingAndApprovedWithRetry(params) {
+    const maxRetries = params.maxRetries ?? DEFAULT_RETRIES;
+    const [initialPending, initialApproved] = await Promise.all([
+        params.loadPending(),
+        params.loadApproved(),
+    ]);
+    const lockPaths = [`${initialPending.filePath}.lock`, `${initialApproved.filePath}.lock`].sort();
+    if (lockPaths[0] === lockPaths[1]) {
+        throw new Error('Pending and approved state must use different files');
+    }
+    const releases = [];
+    try {
+        for (const lockPath of lockPaths) {
+            releases.push(await acquireApprovalStateLock(lockPath, maxRetries));
+        }
+        const [pendingLoaded, approvedLoaded] = await Promise.all([
+            params.loadPending(),
+            params.loadApproved(),
+        ]);
+        if (pendingLoaded.filePath !== initialPending.filePath ||
+            approvedLoaded.filePath !== initialApproved.filePath) {
+            throw new Error('Approval state paths changed while acquiring locks');
+        }
+        const pending = upgradeApprovalStateToV3(pendingLoaded.state);
+        const approved = upgradeApprovalStateToV3(approvedLoaded.state);
+        const outcome = params.mutate(pending, approved);
+        if (!outcome) {
+            return null;
+        }
+        const nextApproved = {
+            ...outcome.approved,
+            version: 3,
+            revision: (approved.revision ?? 0) + 1,
+        };
+        const nextPending = {
+            ...outcome.pending,
+            version: 3,
+            revision: (pending.revision ?? 0) + 1,
+        };
+        // Claim first: interruption may require a fresh approval, but can never duplicate a grant.
+        await params.writePending(pendingLoaded.filePath, nextPending);
+        await params.writeApproved(approvedLoaded.filePath, nextApproved);
+        const [verifiedPending, verifiedApproved] = await Promise.all([
+            params.loadPending(),
+            params.loadApproved(),
+        ]);
+        if ((upgradeApprovalStateToV3(verifiedPending.state).revision ?? 0) !== nextPending.revision ||
+            (upgradeApprovalStateToV3(verifiedApproved.state).revision ?? 0) !== nextApproved.revision) {
+            return null;
+        }
+        return outcome.result;
+    }
+    finally {
+        for (const release of releases.reverse()) {
+            await release();
+        }
+    }
+}

package/dist/core/capability/approval-v3.d.ts

@@ -2,14 +2,31 @@ import type { ApprovalRecord, ApprovalStateFile } from '../types.js';
 import type { CapabilityGrantV1 } from './grant.js';
 import type { CapabilityRequestV1 } from './request.js';
 export declare const APPROVAL_STATE_VERSION_V3: 3;
+export declare const EFFECT_PLAN_HASH_VERSION: "effect-plan:v1";
 export declare function normalizeApprovalStateVersion(state: ApprovalStateFile): ApprovalStateFile;
 export declare function upgradeApprovalStateToV3(state: ApprovalStateFile): ApprovalStateFile;
-export declare function attachCapabilityEnvelope(approval: ApprovalRecord, capabilityRequests?: CapabilityRequestV1[]): ApprovalRecord;
+export declare function attachCapabilityEnvelope(approval: ApprovalRecord, capabilityRequests?: CapabilityRequestV1[], effectPlanHash?: string): ApprovalRecord;
+/** Dual-read: expose legacy single grant as a one-element bundle without mutating storage. */
+export declare function normalizeApprovalGrants(approval: ApprovalRecord): ApprovalRecord;
+export declare function mintCapabilityGrantForRequest(params: {
+    approval: ApprovalRecord;
+    request: CapabilityRequestV1;
+    grantSuffix?: string;
+    issuer?: string;
+    maxUses?: number;
+}): CapabilityGrantV1;
+/** @deprecated Use mintCapabilityGrantBundle; returns first grant only for legacy callers. */
 export declare function mintCapabilityGrant(params: {
     approval: ApprovalRecord;
     capabilityRequests: CapabilityRequestV1[];
     issuer?: string;
     maxUses?: number;
 }): CapabilityGrantV1 | null;
+export declare function mintCapabilityGrantBundle(params: {
+    approval: ApprovalRecord;
+    capabilityRequests: CapabilityRequestV1[];
+    issuer?: string;
+    maxUses?: number;
+}): CapabilityGrantV1[];
 export declare function mintGrantForApprovedRecord(approval: ApprovalRecord): ApprovalRecord;
 export declare function newGrantId(): string;

package/dist/core/capability/approval-v3.js

@@ -2,6 +2,7 @@ import { randomUUID } from 'node:crypto';
 import { hashCapabilityRequests } from './capability-request-hash.js';
 import { CAPABILITY_GRANT_VERSION } from './grant.js';
 export const APPROVAL_STATE_VERSION_V3 = 3;
+export const EFFECT_PLAN_HASH_VERSION = 'effect-plan:v1';
 export function normalizeApprovalStateVersion(state) {
     const version = state.version === APPROVAL_STATE_VERSION_V3
         ? APPROVAL_STATE_VERSION_V3
@@ -26,29 +27,45 @@ export function upgradeApprovalStateToV3(state) {
         })),
     };
 }
-export function attachCapabilityEnvelope(approval, capabilityRequests) {
-    if (!capabilityRequests?.length) {
-        return approval;
+export function attachCapabilityEnvelope(approval, capabilityRequests, effectPlanHash) {
+    const withRequests = !capabilityRequests?.length
+        ? approval
+        : {
+            ...approval,
+            capabilityRequests,
+            capabilityRequestHash: hashCapabilityRequests(capabilityRequests),
+        };
+    if (!effectPlanHash) {
+        return withRequests;
     }
     return {
-        ...approval,
-        capabilityRequests,
-        capabilityRequestHash: hashCapabilityRequests(capabilityRequests),
+        ...withRequests,
+        effectPlanHash,
     };
 }
-export function mintCapabilityGrant(params) {
-    const request = params.capabilityRequests[0];
-    if (!request) {
-        return null;
+/** Dual-read: expose legacy single grant as a one-element bundle without mutating storage. */
+export function normalizeApprovalGrants(approval) {
+    if (approval.grants?.length) {
+        return approval;
     }
+    if (approval.grant) {
+        return { ...approval, grants: [approval.grant] };
+    }
+    return approval;
+}
+export function mintCapabilityGrantForRequest(params) {
     const expiresAt = params.approval.expiresAt;
+    const suffix = params.grantSuffix ?? '';
+    const grantId = suffix === '' || suffix === '0'
+        ? `grant_${params.approval.approvalId}${suffix === '0' && params.grantSuffix !== undefined ? '_0' : ''}`
+        : `grant_${params.approval.approvalId}_${suffix}`;
     return {
         version: CAPABILITY_GRANT_VERSION,
-        grantId: `grant_${params.approval.approvalId}`,
-        principal: request.principal,
-        action: request.action,
-        resource: request.resource,
-        inputFingerprint: request.context.inputFingerprint,
+        grantId,
+        principal: params.request.principal,
+        action: params.request.action,
+        resource: params.request.resource,
+        inputFingerprint: params.request.context.inputFingerprint,
         issuedAt: params.approval.approvedAt ?? new Date().toISOString(),
         expiresAt,
         maxUses: params.maxUses ?? 1,
@@ -56,18 +73,41 @@ export function mintCapabilityGrant(params) {
         issuer: params.issuer ?? 'belay-approval-v3',
     };
 }
+/** @deprecated Use mintCapabilityGrantBundle; returns first grant only for legacy callers. */
+export function mintCapabilityGrant(params) {
+    const bundle = mintCapabilityGrantBundle(params);
+    return bundle[0] ?? null;
+}
+export function mintCapabilityGrantBundle(params) {
+    if (!params.capabilityRequests.length) {
+        return [];
+    }
+    return params.capabilityRequests.map((request, index) => mintCapabilityGrantForRequest({
+        approval: params.approval,
+        request,
+        grantSuffix: params.capabilityRequests.length === 1 ? undefined : String(index),
+        issuer: params.issuer,
+        maxUses: params.maxUses,
+    }));
+}
 export function mintGrantForApprovedRecord(approval) {
-    if (approval.grant || !approval.capabilityRequests?.length) {
-        return approval;
+    const normalized = normalizeApprovalGrants(approval);
+    if ((normalized.grants?.length ?? 0) > 0 || !normalized.capabilityRequests?.length) {
+        return normalized;
     }
-    const grant = mintCapabilityGrant({
-        approval,
-        capabilityRequests: approval.capabilityRequests,
+    const grants = mintCapabilityGrantBundle({
+        approval: normalized,
+        capabilityRequests: normalized.capabilityRequests,
     });
-    if (!grant) {
-        return approval;
+    if (!grants.length) {
+        return normalized;
     }
-    return { ...approval, grant };
+    return {
+        ...normalized,
+        grants,
+        grant: grants[0],
+        grantBundleVersion: 1,
+    };
 }
 export function newGrantId() {
     return `grant_${randomUUID().replaceAll('-', '').slice(0, 16)}`;

package/dist/core/capability/attestation.d.ts

@@ -8,6 +8,9 @@ export interface BoundaryAttestation {
     deniesUngrantedEffects: boolean;
     materializesGrants: boolean;
     probeSignals: string[];
+    /** When true, the driver can mount an execution mirror at the original workspace path. */
+    isolatesWorkspaceMounts?: boolean;
 }
 export declare function validateBoundaryAttestation(value: unknown): value is BoundaryAttestation;
 export declare function isAttestationFresh(attestation: BoundaryAttestation, now?: number): boolean;
+export declare function attestsWorkspaceMountIsolation(attestation: BoundaryAttestation | null | undefined): boolean;

package/dist/core/capability/attestation.js

@@ -30,6 +30,10 @@ export function validateBoundaryAttestation(value) {
         !record.probeSignals.every((s) => typeof s === 'string')) {
         return false;
     }
+    if (record.isolatesWorkspaceMounts !== undefined &&
+        typeof record.isolatesWorkspaceMounts !== 'boolean') {
+        return false;
+    }
     if (record.driver === 'host-integration' && record.materializesGrants) {
         return false;
     }
@@ -53,3 +57,6 @@ export function isAttestationFresh(attestation, now = Date.now()) {
     }
     return attestation.deniesUngrantedEffects;
 }
+export function attestsWorkspaceMountIsolation(attestation) {
+    return attestation?.isolatesWorkspaceMounts === true;
+}

package/dist/core/capability/boundary-driver-container.d.ts

@@ -1,5 +1,17 @@
 import type { BoundaryDriver } from './boundary-driver.js';
+import { type BoundaryRunOptions } from './boundary-run.js';
 export declare function isDockerAvailable(): Promise<boolean>;
+export interface ContainerRunParams {
+    image: string;
+    command: string;
+    cwd: string;
+    proxyEnv: Record<string, string>;
+    mountReadOnly: boolean;
+    repoRoot?: string;
+    runOptions?: BoundaryRunOptions;
+    containerName?: string;
+}
+export declare function buildContainerRunArgs(params: ContainerRunParams): string[];
 export declare function createContainerBoundaryDriver(options?: {
     image?: string;
     egressProxyEnv?: Record<string, string>;

package/dist/core/capability/boundary-driver-container.js

@@ -1,9 +1,33 @@
 import { spawn } from 'node:child_process';
+import { randomUUID } from 'node:crypto';
 import { canonicalPath } from '../path-utils.js';
+import { runProcessWithBoundedOutput } from '../process-runner.js';
 import { dockerEnvArgs, dockerNetworkArgs, ensureBelayContainerNetwork } from './boundary-egress.js';
 import { materializeContainerBoundaryGrant } from './boundary-grant-materialize.js';
+import { BoundaryCleanupError, } from './boundary-run.js';
+import { buildWorkspaceMountSpec, resolveGuestWorkdir, workspaceMountEnvArgs, } from './boundary-workspace-mount.js';
 const ATTESTATION_TTL_MS = 15 * 60_000;
 const DEFAULT_IMAGE = 'alpine:3.20';
+const CONTAINER_CLEANUP_TIMEOUT_MS = 10_000;
+const CONTAINER_INSPECT_TIMEOUT_MS = 2_000;
+const CONTAINER_ABSENCE_ATTEMPTS = 10;
+const CONTAINER_ABSENCE_RETRY_MS = 100;
+function containerDoesNotExist(result) {
+    return /no such container/i.test(`${result.stderr ?? ''}\n${result.stdout ?? ''}`);
+}
+async function confirmContainerAbsent(containerName) {
+    for (let attempt = 0; attempt < CONTAINER_ABSENCE_ATTEMPTS; attempt += 1) {
+        const inspection = await runProcessWithBoundedOutput('docker', ['inspect', '--type', 'container', containerName], {}, CONTAINER_INSPECT_TIMEOUT_MS);
+        if (!inspection.timedOut && inspection.exitCode !== 0 && containerDoesNotExist(inspection)) {
+            return true;
+        }
+        if (inspection.timedOut || (inspection.exitCode !== 0 && !containerDoesNotExist(inspection))) {
+            return false;
+        }
+        await new Promise((resolve) => setTimeout(resolve, CONTAINER_ABSENCE_RETRY_MS));
+    }
+    return false;
+}
 export async function isDockerAvailable() {
     return new Promise((resolve) => {
         const child = spawn('docker', ['info'], { stdio: 'ignore' });
@@ -13,7 +37,12 @@ export async function isDockerAvailable() {
 }
 function containerAttestation(proxyEnv) {
     const probedAt = new Date().toISOString();
-    const signals = ['docker', 'container-driver', 'repo-mount-ro-default'];
+    const signals = [
+        'docker',
+        'container-driver',
+        'repo-mount-ro-default',
+        'workspace-mount-isolation',
+    ];
     if (Object.keys(proxyEnv).length > 0) {
         signals.push('egress-proxy-chokepoint');
     }
@@ -25,9 +54,12 @@ function containerAttestation(proxyEnv) {
         driver: 'container',
         probedAt,
         expiresAt: new Date(Date.now() + ATTESTATION_TTL_MS).toISOString(),
-        deniesUngrantedEffects: true,
-        materializesGrants: true,
-        probeSignals: signals,
+        // Mount and network classes are isolated, but exact grants are not yet
+        // passed to and enforced by the process runner.
+        deniesUngrantedEffects: false,
+        materializesGrants: false,
+        isolatesWorkspaceMounts: true,
+        probeSignals: [...signals, 'exact-grant-enforcement-unavailable'],
     };
 }
 function runDockerProbe(image) {
@@ -39,45 +71,80 @@ function runDockerProbe(image) {
         child.on('close', (code) => resolve(code === 0));
     });
 }
-function runInContainer(image, command, cwd, timeoutMs, proxyEnv, mountReadOnly, repoRoot) {
-    const mount = canonicalPath(cwd);
-    const mountSpec = mountReadOnly ? `${mount}:${mount}:ro` : `${mount}:${mount}`;
-    const proxyActive = Object.keys(proxyEnv).length > 0;
-    const networkArgs = dockerNetworkArgs(proxyActive, repoRoot);
-    const args = [
+export function buildContainerRunArgs(params) {
+    const proxyActive = Object.keys(params.proxyEnv).length > 0;
+    const networkArgs = dockerNetworkArgs(proxyActive, params.repoRoot);
+    const containerNameArgs = params.containerName ? ['--name', params.containerName] : [];
+    const workspaceMount = params.runOptions?.workspaceMount;
+    if (workspaceMount) {
+        if (!params.repoRoot) {
+            throw new Error('boundary_workspace_mount_missing_resource_root');
+        }
+        if (canonicalPath(workspaceMount.guestTargetRoot) !== canonicalPath(params.repoRoot)) {
+            throw new Error('boundary_workspace_mount_target_mismatch');
+        }
+        const workdir = resolveGuestWorkdir(workspaceMount);
+        if (canonicalPath(params.cwd) !== workdir) {
+            throw new Error('boundary_workspace_mount_cwd_mismatch');
+        }
+        return [
+            'run',
+            '--rm',
+            ...containerNameArgs,
+            ...networkArgs,
+            '--mount',
+            buildWorkspaceMountSpec(workspaceMount),
+            '-w',
+            workdir,
+            ...workspaceMountEnvArgs(workspaceMount),
+            ...dockerEnvArgs(params.proxyEnv),
+            params.image,
+            'sh',
+            '-c',
+            params.command,
+        ];
+    }
+    const mount = canonicalPath(params.cwd);
+    const mountSpec = params.mountReadOnly ? `${mount}:${mount}:ro` : `${mount}:${mount}`;
+    return [
         'run',
         '--rm',
+        ...containerNameArgs,
         ...networkArgs,
         '-v',
         mountSpec,
         '-w',
         mount,
-        ...dockerEnvArgs(proxyEnv),
-        image,
+        ...dockerEnvArgs(params.proxyEnv),
+        params.image,
         'sh',
         '-c',
-        command,
+        params.command,
     ];
-    return new Promise((resolve) => {
-        const child = spawn('docker', args, { stdio: 'ignore' });
-        let timedOut = false;
-        const timer = setTimeout(() => {
-            timedOut = true;
-            child.kill('SIGTERM');
-        }, timeoutMs);
-        child.on('error', () => {
-            clearTimeout(timer);
-            resolve({ exitCode: 1, signal: null, timedOut });
-        });
-        child.on('close', (exitCode, signal) => {
-            clearTimeout(timer);
-            resolve({
-                exitCode,
-                signal: signal ? String(signal) : null,
-                timedOut,
-            });
-        });
+}
+async function runInContainer(image, command, cwd, timeoutMs, proxyEnv, mountReadOnly, repoRoot, runOptions) {
+    const containerName = `belay-run-${randomUUID()}`;
+    const args = buildContainerRunArgs({
+        image,
+        command,
+        cwd,
+        proxyEnv,
+        mountReadOnly,
+        repoRoot,
+        runOptions,
+        containerName,
     });
+    const result = await runProcessWithBoundedOutput('docker', args, {}, timeoutMs);
+    if (result.timedOut) {
+        const cleanup = await runProcessWithBoundedOutput('docker', ['rm', '-f', containerName], {}, CONTAINER_CLEANUP_TIMEOUT_MS);
+        const cleanupFailed = cleanup.timedOut || cleanup.exitCode !== 0;
+        const absent = containerDoesNotExist(cleanup) ||
+            (cleanupFailed && (await confirmContainerAbsent(containerName)));
+        if (cleanupFailed && !absent) {
+            throw new BoundaryCleanupError('container', containerName);
+        }
+    }
+    return result;
 }
 export function createContainerBoundaryDriver(options = {}) {
     const image = options.image ?? DEFAULT_IMAGE;
@@ -102,12 +169,12 @@ export function createContainerBoundaryDriver(options = {}) {
             }
         },
         async run(command, cwd, timeoutMs, options) {
-            const mountReadOnly = options?.mountReadOnly !== false;
+            const mountReadOnly = options?.mountReadOnly !== false && !options?.workspaceMount;
             const proxyActive = Object.keys(proxyEnv).length > 0;
             if (proxyActive && repoRoot && !preparedNetwork) {
                 await ensureBelayContainerNetwork(repoRoot);
             }
-            return runInContainer(image, command, cwd, timeoutMs, proxyEnv, mountReadOnly, repoRoot);
+            return runInContainer(image, command, cwd, timeoutMs, proxyEnv, mountReadOnly, repoRoot, options);
         },
         materializeGrant(request, context) {
             return materializeContainerBoundaryGrant(request, {

package/dist/core/capability/boundary-driver.js

@@ -11,6 +11,7 @@ function hostIntegrationAttestation(driver) {
         expiresAt: new Date(Date.now() + ATTESTATION_TTL_MS).toISOString(),
         deniesUngrantedEffects: false,
         materializesGrants: false,
+        isolatesWorkspaceMounts: false,
         probeSignals: ['host-integration', 'l3-policy-only'],
     };
 }

package/dist/core/capability/boundary-grant-materialize.d.ts

@@ -11,3 +11,4 @@ export interface MaterializeBoundaryGrantParams {
     sensitivePaths?: string[];
 }
 export declare function materializeContainerBoundaryGrant(request: CapabilityRequestV1, params: MaterializeBoundaryGrantParams): CapabilityGrantV1 | null;
+export declare function materializeContainerBoundaryGrants(requests: readonly CapabilityRequestV1[], params: MaterializeBoundaryGrantParams): CapabilityGrantV1[];

package/dist/core/capability/boundary-grant-materialize.js

@@ -76,3 +76,18 @@ export function materializeContainerBoundaryGrant(request, params) {
     }
     return null;
 }
+export function materializeContainerBoundaryGrants(requests, params) {
+    const grants = [];
+    let existing = [...(params.existingGrants ?? [])];
+    for (const request of requests) {
+        const materialized = materializeContainerBoundaryGrant(request, {
+            ...params,
+            existingGrants: existing,
+        });
+        if (materialized) {
+            grants.push(materialized);
+            existing = [...existing, materialized];
+        }
+    }
+    return grants;
+}

package/dist/core/capability/boundary-run.d.ts

@@ -1,8 +1,33 @@
 import type { ShellRunResult } from '../transactional/git-worktree.js';
 import type { ClassifyResult } from '../types.js';
+export interface BoundaryCleanupFailure {
+    code: 'BOUNDARY_CLEANUP_UNCONFIRMED';
+    resourceKind: 'container';
+    resourceId: string;
+    executionStarted: true;
+    cleanupConfirmed: false;
+}
+export declare class BoundaryCleanupError extends Error implements BoundaryCleanupFailure {
+    readonly resourceKind: 'container';
+    readonly resourceId: string;
+    readonly code: "BOUNDARY_CLEANUP_UNCONFIRMED";
+    readonly executionStarted: true;
+    readonly cleanupConfirmed: false;
+    constructor(resourceKind: 'container', resourceId: string);
+}
+export declare function isBoundaryCleanupError(value: unknown): value is BoundaryCleanupFailure;
+export declare function safeBoundaryCleanupResourceId(value: unknown): string | undefined;
+export interface BoundaryWorkspaceMount {
+    hostSourceRoot: string;
+    guestTargetRoot: string;
+    cwdRelative: string;
+    writable: boolean;
+    hideHostSourcePath: boolean;
+}
 export interface BoundaryRunOptions {
     /** When true, container driver mounts the working directory read-only. */
     mountReadOnly?: boolean;
+    workspaceMount?: BoundaryWorkspaceMount;
 }
 export interface BoundaryPrepareContext {
     repoRoot?: string;

package/dist/core/capability/boundary-run.js

@@ -1,17 +1,45 @@
+const SAFE_CONTAINER_RESOURCE_ID = /^belay-run-[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
+export class BoundaryCleanupError extends Error {
+    resourceKind;
+    resourceId;
+    code = 'BOUNDARY_CLEANUP_UNCONFIRMED';
+    executionStarted = true;
+    cleanupConfirmed = false;
+    constructor(resourceKind, resourceId) {
+        super('Boundary cleanup could not be confirmed');
+        this.resourceKind = resourceKind;
+        this.resourceId = resourceId;
+        this.name = 'BoundaryCleanupError';
+    }
+}
+export function isBoundaryCleanupError(value) {
+    if (!value || typeof value !== 'object') {
+        return false;
+    }
+    const candidate = value;
+    return (candidate.code === 'BOUNDARY_CLEANUP_UNCONFIRMED' &&
+        candidate.resourceKind === 'container' &&
+        typeof candidate.resourceId === 'string' &&
+        candidate.executionStarted === true &&
+        candidate.cleanupConfirmed === false);
+}
+export function safeBoundaryCleanupResourceId(value) {
+    if (!isBoundaryCleanupError(value) || !SAFE_CONTAINER_RESOURCE_ID.test(value.resourceId)) {
+        return undefined;
+    }
+    return value.resourceId;
+}
 export function boundaryMountReadOnlyFromPrediction(predicted) {
     const effect = predicted.axes?.effect;
     if (effect === 'local_mutation' || effect === 'remote_mutation') {
         return false;
     }
-    const action = predicted.capabilityRequests?.[0]?.action;
-    if (action === 'fs.write' || action === 'git.ref.write' || action === 'control_plane.write') {
-        return false;
-    }
-    if (action === 'fs.read') {
-        return true;
-    }
-    if (action === 'network.connect' || action === 'process.exec' || action === 'indeterminate') {
-        return true;
+    for (const request of predicted.capabilityRequests ?? []) {
+        if (request.action === 'fs.write' ||
+            request.action === 'git.ref.write' ||
+            request.action === 'control_plane.write') {
+            return false;
+        }
     }
     return true;
 }

package/dist/core/capability/boundary-session.d.ts

@@ -12,6 +12,9 @@ export interface ResolvedBoundaryDriverContext {
     proxyActive: boolean;
     proxyEnv: Record<string, string>;
     prepareContext: BoundaryPrepareContext;
+    attestationPath: string;
+    attestation: BoundaryAttestation | null;
+    attestationFresh: boolean;
 }
 export declare function boundaryAttestationPath(repoRoot: string, config: BelayConfigV4): string;
 export declare function loadBoundaryAttestation(filePath: string, expectedRepoRoot?: string, controlPlaneDir?: string): Promise<BoundaryAttestation | null>;
@@ -53,5 +56,6 @@ export declare function runBoundaryAgentCommand(params: {
     command: string;
     cwd?: string;
     timeoutMs?: number;
+    runOptions?: BoundaryRunOptions;
 }): Promise<Awaited<ReturnType<BoundaryDriver['run']>>>;
 export { dockerNetworkArgs };