@guilz-dev/belay 0.7.0 → 0.8.0

package/dist/core/effect-ir/types.d.ts

@@ -4,6 +4,13 @@ export declare const EFFECT_PLAN_VERSION: 1;
 export type EffectTag = 'fs.read' | 'fs.write' | 'process.exec' | 'network.connect' | 'network.acquire' | 'git.ref.write' | 'secret.read' | 'control_plane.write' | 'read_only' | 'indeterminate';
 export type LauncherPhase = 'invoke' | 'resolve' | 'acquire' | 'cache_read' | 'cache_write' | 'delegate';
 export type PackageExecLauncher = 'npx' | 'npm' | 'pnpm';
+export type EffectPlanDisposition = 'effects' | 'effect_free';
+export type AnalysisCompleteness = 'complete' | 'partial';
+export interface EffectPlanPolicyProjection {
+    permission: 'allow' | 'ask';
+    hookVerdict: 'allow' | 'allow_flagged' | 'deny_pending_approval';
+    reason: string;
+}
 export interface EffectEvidence {
     level: CapabilityEvidenceLevel;
     signals: readonly string[];
@@ -49,7 +56,7 @@ export interface EffectPlan {
     root: EffectNode;
     inputFingerprint: string;
     opacity: VerdictOpacity;
-    disposition: 'effects' | 'effect_free';
-    completeness: 'complete' | 'partial';
+    disposition: EffectPlanDisposition;
+    completeness: AnalysisCompleteness;
     signals: readonly string[];
 }

package/dist/core/gate-engine.js

@@ -5,9 +5,11 @@ import { classifySubagent } from './classify-subagent.js';
 import { classifyToolUse } from './classify-tool.js';
 import { classifierOptionsFromConfig } from './config.js';
 import { buildCapabilityEffectPlan } from './effect-ir/build.js';
+import { evaluateEffectPlanPolicy } from './effect-ir/policy.js';
+import { buildShellEffectPlan } from './effect-ir/shell-build.js';
 import { GATE_CONTRACT_VERSION } from './gate-contract.js';
 import { mergeAgentAssessment } from './judgment.js';
-import { classifyShell } from './verdict/adapter.js';
+import { buildVerdictContext, classifyShell } from './verdict/adapter.js';
 export class GateNormalizationError extends Error {
     reason = 'normalization_failed';
     constructor(message) {
@@ -168,16 +170,6 @@ function applyFsScopePeripheralPolicy(outsideRepoPaths, result, options) {
     }
     return result;
 }
-function applySandboxOutsideBoundary(command, action, result, options) {
-    const outsideRepoPaths = collectOutsideRepoPaths(command, action.cwd, action.repoRoot, options.trustedWorkspaceRoots);
-    return applySandboxFsScopeBoundary(outsideRepoPaths, result, options, {
-        redirect: command.includes('>'),
-    });
-}
-function applyShellPeripheralPolicy(command, action, result, options) {
-    const outsideRepoPaths = collectOutsideRepoPaths(command, action.cwd, action.repoRoot, options.trustedWorkspaceRoots);
-    return applyFsScopePeripheralPolicy(outsideRepoPaths, result, options);
-}
 function outsideRepoPathsForToolAction(action, options) {
     const payload = action.payload ?? {};
     const paths = new Set(collectOutsideRepoPathsFromToolPayload(payload, action.cwd, action.repoRoot, options.trustedWorkspaceRoots));
@@ -199,32 +191,28 @@ function applyToolSandboxPolicies(action, result, options) {
     return next;
 }
 export async function classifyGatedAction(action, config, extraOptions = {}) {
+    const options = { ...classifierOptionsFromConfig(config), ...extraOptions };
     const limitResult = checkGatedActionLimits(action);
     if (limitResult) {
+        if (action.kind === 'shell') {
+            return projectShellLimitResult(action, limitResult, config, options);
+        }
         return attachEffectPlan(action, limitResult);
     }
-    const options = { ...classifierOptionsFromConfig(config), ...extraOptions };
     if (action.kind === 'shell') {
         const command = action.command ?? shellCommandFromPayload(action.payload ?? {});
         if (!command) {
             throw new GateNormalizationError('Shell gated action requires a command.');
         }
-        let result = await classifyShell(command, action.cwd, action.repoRoot, config, options);
-        result = applySandboxOutsideBoundary(command, action, result, options);
-        result = applyShellPeripheralPolicy(command, action, result, options);
+        const result = await classifyShell(command, action.cwd, action.repoRoot, config, options);
         if (!action.agentAssessment) {
-            return attachEffectPlan(action, result);
+            return result;
         }
         const merged = mergeAgentAssessment(result.assessment, action.agentAssessment);
-        if (!merged.mismatch) {
-            return attachEffectPlan(action, { ...result, assessment: merged.assessment });
-        }
-        return attachEffectPlan(action, {
+        return {
             ...result,
-            verdict: 'deny_pending_approval',
-            reason: 'agent_assessment_mismatch',
             assessment: merged.assessment,
-        });
+        };
     }
     if (action.kind === 'subagent') {
         return attachEffectPlan(action, classifySubagent(action.payload ?? {}, action.repoRoot, options, config));
@@ -245,6 +233,58 @@ export async function classifyGatedAction(action, config, extraOptions = {}) {
         assessment: merged.assessment,
     });
 }
+function projectShellLimitResult(action, result, config, options) {
+    const summary = result.summary ?? 'oversized shell input';
+    const effectPlan = buildShellEffectPlan({
+        inputFingerprint: result.fingerprint,
+        segments: [
+            {
+                commandRedacted: summary,
+                segmentHead: 'input-limit',
+                requirements: [
+                    {
+                        tag: 'indeterminate',
+                        action: 'indeterminate',
+                        resource: { kind: 'unknown' },
+                        evidence: {
+                            level: 'indeterminate',
+                            signals: ['input_too_large', 'analysis_budget_exceeded'],
+                            basis: ['gate:input_limit'],
+                        },
+                        provenance: { segment: summary },
+                    },
+                ],
+                completeness: 'partial',
+                opacity: 'opaque',
+                signals: ['input_too_large', 'analysis_budget_exceeded'],
+            },
+        ],
+    });
+    const policy = evaluateEffectPlanPolicy(effectPlan, buildVerdictContext({
+        cwd: action.cwd,
+        repoRoot: action.repoRoot,
+        config,
+        options,
+    }));
+    return {
+        ...result,
+        verdict: policy.projection.hookVerdict,
+        axes: {
+            location: 'unknown',
+            opacity: effectPlan.opacity,
+            effect: 'unknown',
+            confidence: 'deterministic',
+            would: policy.projection.permission,
+            by: 'effect_plan',
+            signals: [...effectPlan.signals],
+        },
+        capabilityRequests: policy.capabilityRequests,
+        authorizationDecision: policy.authorizationDecision,
+        effectPlan,
+        effectPlanPolicyDecisions: policy.decisions,
+        effectPlanProjection: policy.projection,
+    };
+}
 function attachEffectPlan(action, result) {
     if (result.effectPlan) {
         return result;

package/dist/core/git-resource-identity.d.ts

@@ -0,0 +1,26 @@
+export interface GitResourceIdentity {
+    repositoryRoot: string;
+    gitDir: string;
+    commonDir: string;
+    gitEntryPath: string;
+}
+export type GitResourceIdentityInspection = {
+    status: 'resolved';
+    identity: GitResourceIdentity;
+} | {
+    status: 'absent';
+} | {
+    status: 'invalid';
+    boundaryPath: string;
+    metadataRoots: string[];
+};
+/**
+ * Inspects the Git boundary containing a path without executing Git or a shell.
+ * Malformed or unreadable metadata is distinct from an absent Git boundary.
+ */
+export declare function inspectGitResourceIdentity(targetPath: string): GitResourceIdentityInspection;
+/** Resolves only structurally valid Git metadata; otherwise returns null. */
+export declare function resolveGitResourceIdentity(targetPath: string): GitResourceIdentity | null;
+export declare function sameGitResourceIdentity(leftPath: string, rightPath: string): boolean;
+/** Protects control data for any proven repository and any malformed Git boundary. */
+export declare function isGitMetadataPath(targetPath: string, _repositoryPath?: string): boolean;

package/dist/core/git-resource-identity.js

@@ -0,0 +1,284 @@
+import { lstatSync, readFileSync, realpathSync, statSync } from 'node:fs';
+import path from 'node:path';
+function canonicalExistingPath(targetPath) {
+    try {
+        return realpathSync.native(targetPath);
+    }
+    catch {
+        return null;
+    }
+}
+function isDirectory(targetPath) {
+    try {
+        return statSync(targetPath).isDirectory();
+    }
+    catch {
+        return false;
+    }
+}
+function nearestExistingDirectory(targetPath) {
+    let current = path.resolve(targetPath);
+    while (true) {
+        try {
+            const stats = statSync(current);
+            const directory = stats.isDirectory() ? current : path.dirname(current);
+            const canonical = canonicalExistingPath(directory);
+            return canonical ? { status: 'resolved', directory: canonical } : { status: 'invalid' };
+        }
+        catch (error) {
+            const code = error.code;
+            if (code !== 'ENOENT' && code !== 'ENOTDIR') {
+                return { status: 'invalid' };
+            }
+        }
+        const parent = path.dirname(current);
+        if (parent === current) {
+            return { status: 'invalid' };
+        }
+        current = parent;
+    }
+}
+function readSingleMetadataLine(metadataPath) {
+    try {
+        const value = readFileSync(metadataPath, 'utf8').trim();
+        if (!value || value.includes('\0') || value.includes('\n') || value.includes('\r')) {
+            return null;
+        }
+        return value;
+    }
+    catch {
+        return null;
+    }
+}
+function pathEntryStatus(targetPath) {
+    try {
+        lstatSync(targetPath);
+        return 'present';
+    }
+    catch (error) {
+        if (error.code === 'ENOENT') {
+            return 'absent';
+        }
+        return 'unreadable';
+    }
+}
+function resolveMetadataDirectory(value, baseDirectory) {
+    const candidate = path.isAbsolute(value) ? value : path.resolve(baseDirectory, value);
+    if (!isDirectory(candidate)) {
+        return null;
+    }
+    return canonicalExistingPath(candidate);
+}
+function hasValidCommonDirStructure(commonDir) {
+    return (hasValidHead(commonDir) &&
+        hasValidGitConfig(commonDir) &&
+        isDirectory(path.join(commonDir, 'objects')) &&
+        isDirectory(path.join(commonDir, 'refs')));
+}
+function hasValidHead(gitDir) {
+    const head = readSingleMetadataLine(path.join(gitDir, 'HEAD'));
+    return head !== null && (/^ref:\s+refs\/\S+$/.test(head) || /^[0-9a-f]{40,64}$/i.test(head));
+}
+function hasValidGitConfig(gitDir) {
+    const configPath = path.join(gitDir, 'config');
+    try {
+        return (statSync(configPath).isFile() && /^\s*\[core\]\s*$/im.test(readFileSync(configPath, 'utf8')));
+    }
+    catch {
+        return false;
+    }
+}
+function looksLikeBareBoundary(candidate) {
+    const markers = [
+        pathEntryStatus(path.join(candidate, 'HEAD')),
+        pathEntryStatus(path.join(candidate, 'config')),
+        pathEntryStatus(path.join(candidate, 'objects')),
+        pathEntryStatus(path.join(candidate, 'refs')),
+    ];
+    return markers.filter((status) => status !== 'absent').length >= 2;
+}
+function invalidInspection(boundaryPath, metadataRoots) {
+    return {
+        status: 'invalid',
+        boundaryPath,
+        metadataRoots: [...new Set(metadataRoots.map((root) => path.resolve(root)))],
+    };
+}
+function resolveBareIdentity(repositoryRoot) {
+    if (!looksLikeBareBoundary(repositoryRoot)) {
+        return null;
+    }
+    if (!hasValidCommonDirStructure(repositoryRoot)) {
+        return invalidInspection(repositoryRoot, [repositoryRoot]);
+    }
+    return {
+        status: 'resolved',
+        identity: {
+            repositoryRoot,
+            gitDir: repositoryRoot,
+            commonDir: repositoryRoot,
+            gitEntryPath: repositoryRoot,
+        },
+    };
+}
+function resolveLinkedIdentity(repositoryRoot, gitEntryPath) {
+    const forwardMetadata = readSingleMetadataLine(gitEntryPath);
+    const match = forwardMetadata?.match(/^gitdir:\s*(.+)$/);
+    const gitDirValue = match?.[1]?.trim();
+    if (!gitDirValue) {
+        return invalidInspection(repositoryRoot, [gitEntryPath]);
+    }
+    const gitDir = resolveMetadataDirectory(gitDirValue, repositoryRoot);
+    if (!gitDir) {
+        return invalidInspection(repositoryRoot, [gitEntryPath]);
+    }
+    const commonDirValue = readSingleMetadataLine(path.join(gitDir, 'commondir'));
+    const commonDir = commonDirValue ? resolveMetadataDirectory(commonDirValue, gitDir) : null;
+    const backpointerValue = readSingleMetadataLine(path.join(gitDir, 'gitdir'));
+    const backpointer = backpointerValue
+        ? canonicalExistingPath(path.isAbsolute(backpointerValue)
+            ? backpointerValue
+            : path.resolve(gitDir, backpointerValue))
+        : null;
+    const canonicalGitEntry = canonicalExistingPath(gitEntryPath);
+    const expectedWorktreesRoot = commonDir ? path.join(commonDir, 'worktrees') : null;
+    const linkedStructureValid = hasValidHead(gitDir) &&
+        commonDir !== null &&
+        hasValidCommonDirStructure(commonDir) &&
+        expectedWorktreesRoot !== null &&
+        path.dirname(gitDir) === expectedWorktreesRoot &&
+        backpointer !== null &&
+        canonicalGitEntry !== null &&
+        backpointer === canonicalGitEntry;
+    if (!linkedStructureValid || !commonDir || !canonicalGitEntry) {
+        return invalidInspection(repositoryRoot, [
+            gitEntryPath,
+            gitDir,
+            ...(commonDir ? [commonDir] : []),
+        ]);
+    }
+    return {
+        status: 'resolved',
+        identity: {
+            repositoryRoot,
+            gitDir,
+            commonDir,
+            gitEntryPath: canonicalGitEntry,
+        },
+    };
+}
+function inspectWorktreeBoundary(repositoryRoot) {
+    const gitEntryPath = path.join(repositoryRoot, '.git');
+    const entryStatus = pathEntryStatus(gitEntryPath);
+    if (entryStatus === 'absent') {
+        return null;
+    }
+    if (entryStatus === 'unreadable') {
+        return invalidInspection(repositoryRoot, [gitEntryPath]);
+    }
+    try {
+        if (lstatSync(gitEntryPath).isSymbolicLink()) {
+            return invalidInspection(repositoryRoot, [gitEntryPath]);
+        }
+        const entryStats = statSync(gitEntryPath);
+        if (entryStats.isFile()) {
+            return resolveLinkedIdentity(repositoryRoot, gitEntryPath);
+        }
+        if (!entryStats.isDirectory()) {
+            return invalidInspection(repositoryRoot, [gitEntryPath]);
+        }
+    }
+    catch {
+        return invalidInspection(repositoryRoot, [gitEntryPath]);
+    }
+    const gitDir = canonicalExistingPath(gitEntryPath);
+    const canonicalGitEntry = canonicalExistingPath(gitEntryPath);
+    if (!gitDir || !canonicalGitEntry || !hasValidCommonDirStructure(gitDir)) {
+        return invalidInspection(repositoryRoot, [gitEntryPath]);
+    }
+    return {
+        status: 'resolved',
+        identity: {
+            repositoryRoot,
+            gitDir,
+            commonDir: gitDir,
+            gitEntryPath: canonicalGitEntry,
+        },
+    };
+}
+/**
+ * Inspects the Git boundary containing a path without executing Git or a shell.
+ * Malformed or unreadable metadata is distinct from an absent Git boundary.
+ */
+export function inspectGitResourceIdentity(targetPath) {
+    const nearest = nearestExistingDirectory(targetPath);
+    if (nearest.status === 'invalid') {
+        return invalidInspection(path.resolve(targetPath), [path.resolve(targetPath)]);
+    }
+    let current = nearest.directory;
+    while (true) {
+        const worktree = inspectWorktreeBoundary(current);
+        if (worktree) {
+            return worktree;
+        }
+        const bare = resolveBareIdentity(current);
+        if (bare) {
+            return bare;
+        }
+        const parent = path.dirname(current);
+        if (parent === current) {
+            return { status: 'absent' };
+        }
+        current = parent;
+    }
+}
+/** Resolves only structurally valid Git metadata; otherwise returns null. */
+export function resolveGitResourceIdentity(targetPath) {
+    const inspection = inspectGitResourceIdentity(targetPath);
+    return inspection.status === 'resolved' ? inspection.identity : null;
+}
+export function sameGitResourceIdentity(leftPath, rightPath) {
+    const left = resolveGitResourceIdentity(leftPath);
+    const right = resolveGitResourceIdentity(rightPath);
+    return left !== null && right !== null && left.commonDir === right.commonDir;
+}
+function canonicalTargetPath(targetPath) {
+    const resolved = path.resolve(targetPath);
+    let current = resolved;
+    const suffix = [];
+    while (true) {
+        const canonical = canonicalExistingPath(current);
+        if (canonical) {
+            return path.join(canonical, ...suffix);
+        }
+        const parent = path.dirname(current);
+        if (parent === current) {
+            return resolved;
+        }
+        suffix.unshift(path.basename(current));
+        current = parent;
+    }
+}
+function pathWithin(root, targetPath) {
+    const relative = path.relative(root, targetPath);
+    return (relative === '' ||
+        (!path.isAbsolute(relative) && relative !== '..' && !relative.startsWith(`..${path.sep}`)));
+}
+/** Protects control data for any proven repository and any malformed Git boundary. */
+export function isGitMetadataPath(targetPath, _repositoryPath) {
+    const inspection = inspectGitResourceIdentity(targetPath);
+    const target = canonicalTargetPath(targetPath);
+    if (inspection.status === 'invalid') {
+        return inspection.metadataRoots.some((root) => {
+            const canonicalRoot = canonicalTargetPath(root);
+            return target === canonicalRoot || pathWithin(canonicalRoot, target);
+        });
+    }
+    if (inspection.status !== 'resolved') {
+        return false;
+    }
+    const { identity } = inspection;
+    return (target === identity.gitEntryPath ||
+        pathWithin(identity.gitDir, target) ||
+        pathWithin(identity.commonDir, target));
+}

package/dist/core/harvest.d.ts

@@ -1,7 +1,7 @@
 import type { CorpusCase } from '../corpus/types.js';
 import type { AuditRecord } from './audit-types.js';
 export declare const HARVEST_REPORT_SCHEMA_VERSION = 1;
-export type HarvestCandidateSource = 'deny_then_approve' | 'repeated_ask' | 'read_style_signal' | 'overrides_allow';
+export type HarvestCandidateSource = 'deny_then_approve' | 'repeated_ask' | 'read_style_signal';
 export type HarvestReviewOutcome = 'provably-benign' | 'accepted-benign' | 'reject';
 export interface HarvestCandidate {
     kind: 'shell';
@@ -35,12 +35,8 @@ export declare function filterRecordsForHarvest(records: AuditRecord[], options?
     since?: string;
     until?: string;
 }): AuditRecord[];
-export declare function extractHarvestCandidates(records: AuditRecord[], options?: {
-    allowPatterns?: string[];
-}): HarvestCandidate[];
-export declare function buildHarvestReport(records: AuditRecord[], options?: {
-    allowPatterns?: string[];
-}): HarvestReport;
+export declare function extractHarvestCandidates(records: AuditRecord[]): HarvestCandidate[];
+export declare function buildHarvestReport(records: AuditRecord[]): HarvestReport;
 export declare function applyHarvestReview(cases: CorpusCase[], params: {
     command: string;
     outcome: HarvestReviewOutcome;

package/dist/core/harvest.js

@@ -1,6 +1,5 @@
 import { computeRepeatedFingerprintAsks, isAvailabilityCausedAsk } from './audit-analysis.js';
 import { buildApprovalRoundTrips, filterAuditRecords, inferWouldBlock, isApprovalRecorded, isShellGateRecord, parseTimestamp, } from './audit-query.js';
-import { matchesCustomCommand } from './custom-command-match.js';
 export const HARVEST_REPORT_SCHEMA_VERSION = 1;
 const READ_STYLE_COMMAND_PATTERN = /^\s*(git\s+status|git\s+diff|git\s+log|git\s+show|ls\b|cat\b|head\b|tail\b|find\b|rg\b|grep\b|fd\b|bat\b|less\b|more\b|pwd\b|whoami\b|env\b|printenv\b|npm\s+(test|run\s+test)|pnpm\s+(test|run\s+test)|yarn\s+test)/;
 function shellRecords(records) {
@@ -145,7 +144,7 @@ export function filterRecordsForHarvest(records, options = {}) {
     });
     return augmentHarvestRoundTripPairs(scoped, timeFiltered);
 }
-export function extractHarvestCandidates(records, options = {}) {
+export function extractHarvestCandidates(records) {
     const shellOnly = shellRecords(records);
     const classifierAsks = shellOnly.filter((record) => inferWouldBlock(record) && !isAvailabilityCausedAsk(record));
     const map = new Map();
@@ -187,28 +186,6 @@ export function extractHarvestCandidates(records, options = {}) {
             source: 'read_style_signal',
         });
     }
-    // Current overrides.allow match on past would-blocks — not a changelog of new additions.
-    const allowPatterns = options.allowPatterns ?? [];
-    for (const record of classifierAsks) {
-        if (!record.fingerprint) {
-            continue;
-        }
-        const command = commandFromRecord(record);
-        if (!command) {
-            continue;
-        }
-        for (const pattern of allowPatterns) {
-            if (matchesCustomCommand(command, command, pattern)) {
-                upsertCandidate(map, {
-                    fingerprint: record.fingerprint,
-                    command,
-                    reason: record.reason ?? 'unknown',
-                    source: 'overrides_allow',
-                });
-                break;
-            }
-        }
-    }
     return [...map.values()].sort((left, right) => {
         if (right.askCount !== left.askCount) {
             return right.askCount - left.askCount;
@@ -216,11 +193,11 @@ export function extractHarvestCandidates(records, options = {}) {
         return left.command.localeCompare(right.command);
     });
 }
-export function buildHarvestReport(records, options = {}) {
+export function buildHarvestReport(records) {
     return {
         schemaVersion: HARVEST_REPORT_SCHEMA_VERSION,
         scope: 'shell',
-        candidates: extractHarvestCandidates(records, options),
+        candidates: extractHarvestCandidates(records),
         availabilityQueue: extractAvailabilityQueue(records),
     };
 }
@@ -265,7 +242,7 @@ export function applyHarvestReview(cases, params) {
         ...(reason ? { reason } : {}),
     };
     const followUp = category === 'provably-benign'
-        ? 'Next: run `pnpm corpus` and confirm hard gates pass before `pnpm build` refreshes the standing-allow catalog.'
+        ? 'Next: run `pnpm corpus` and confirm the CI-only hard gates pass. Corpus labels never grant runtime shell authority.'
         : 'Next: run `pnpm corpus` to verify corpus evaluation (accepted-benign is soft-gated).';
     return {
         cases: [...cases, nextCase],

package/dist/core/index.d.ts

@@ -14,6 +14,8 @@ export { canonicalStringify, hashValue, shellFingerprint, subagentFingerprint, t
 export type { GatedAction, GatedActionKind, GatePermissionResponse, GateVerdict, } from './gate-contract.js';
 export { classifyResultToGateVerdict, GATE_CONTRACT_VERSION, isGatedAction, unnormalizedGateVerdict, } from './gate-contract.js';
 export { classifyGatedAction, GateNormalizationError, gateEnabledForAction, normalizeGatedAction, } from './gate-engine.js';
+export type { GitResourceIdentity, GitResourceIdentityInspection, } from './git-resource-identity.js';
+export { inspectGitResourceIdentity, isGitMetadataPath, resolveGitResourceIdentity, sameGitResourceIdentity, } from './git-resource-identity.js';
 export { matchesSensitivePath } from './glob.js';
 export { canonicalPath, hasOutsideRepoPath, normalizeToken, pathWithinRoot, relativeWithinRepo, resolveMutationTarget, } from './path-utils.js';
 export type { RecoveryBackend, RecoveryCheckpointEntry, RecoveryCheckpointEntryV1, RecoveryCheckpointEntryV2, RecoveryCheckpointManifest, RecoveryCheckpointManifestV1, RecoveryCheckpointManifestV2, RecoveryCheckpointState, RecoveryCheckpointSummary, RecoveryFileSnapshotV1, RecoveryFileSnapshotV2, RecoveryProofV1, RecoveryReceiptV1, } from './recovery/index.js';

package/dist/core/index.js

@@ -10,6 +10,7 @@ export { matchesCustomCommand } from './custom-command-match.js';
 export { canonicalStringify, hashValue, shellFingerprint, subagentFingerprint, toolFingerprint, } from './fingerprint.js';
 export { classifyResultToGateVerdict, GATE_CONTRACT_VERSION, isGatedAction, unnormalizedGateVerdict, } from './gate-contract.js';
 export { classifyGatedAction, GateNormalizationError, gateEnabledForAction, normalizeGatedAction, } from './gate-engine.js';
+export { inspectGitResourceIdentity, isGitMetadataPath, resolveGitResourceIdentity, sameGitResourceIdentity, } from './git-resource-identity.js';
 export { matchesSensitivePath } from './glob.js';
 export { canonicalPath, hasOutsideRepoPath, normalizeToken, pathWithinRoot, relativeWithinRepo, resolveMutationTarget, } from './path-utils.js';
 export { listRecoveryCheckpoints, RECOVERY_CHECKPOINT_CORRUPT, RECOVERY_CHECKPOINT_QUOTA, RECOVERY_RESTORE_CONFLICT, recoveryCheckpointStorageBytes, recoveryRestoreBinding, restoreRecoveryCheckpoint, showRecoveryCheckpoint, } from './recovery/index.js';

package/dist/core/path-utils.js

@@ -1,5 +1,6 @@
-import { existsSync, realpathSync, statSync } from 'node:fs';
+import { existsSync, realpathSync } from 'node:fs';
 import path from 'node:path';
+import { inspectGitResourceIdentity } from './git-resource-identity.js';
 import { isFdDuplication, isRedirectOperator } from './shell-tokenizer.js';
 /**
  * Resolve symlinks for the longest existing prefix of `targetPath`, then append
@@ -65,9 +66,42 @@ export function relativeWithinRepo(repoRoot, targetPath) {
 }
 export function resolveWorkspaceRootMatch(repoRoot, trustedRoots = [], targetPath) {
     const canonicalRepoRoot = canonicalPath(repoRoot);
-    const repoRelative = relativeWithinRoot(repoRoot, targetPath);
-    if (repoRelative !== null) {
-        return { kind: 'repo', root: canonicalRepoRoot, relativePath: repoRelative };
+    const repoInspection = inspectGitResourceIdentity(repoRoot);
+    const targetInspection = inspectGitResourceIdentity(targetPath);
+    if (repoInspection.status === 'resolved') {
+        if (targetInspection.status === 'resolved') {
+            if (repoInspection.identity.commonDir === targetInspection.identity.commonDir) {
+                const relativePath = relativeWithinRoot(targetInspection.identity.repositoryRoot, targetPath);
+                if (relativePath !== null) {
+                    return {
+                        kind: 'repo',
+                        root: targetInspection.identity.repositoryRoot,
+                        relativePath,
+                    };
+                }
+            }
+            return null;
+        }
+        if (targetInspection.status === 'invalid') {
+            return null;
+        }
+        if (relativeWithinRoot(repoRoot, targetPath) !== null) {
+            return null;
+        }
+    }
+    else if (repoInspection.status === 'invalid') {
+        if (relativeWithinRoot(repoRoot, targetPath) !== null || targetInspection.status !== 'absent') {
+            return null;
+        }
+    }
+    else if (targetInspection.status === 'absent') {
+        const repoRelative = relativeWithinRoot(repoRoot, targetPath);
+        if (repoRelative !== null) {
+            return { kind: 'repo', root: canonicalRepoRoot, relativePath: repoRelative };
+        }
+    }
+    else {
+        return null;
     }
     const normalizedTrustedRoots = [...new Set(trustedRoots.map((root) => path.resolve(root)))]
         .filter((root) => root !== canonicalRepoRoot)
@@ -137,24 +171,9 @@ export function hasOutsideRepoPath(tokens, cwd, repoRoot) {
     });
 }
 export function containingGitRoot(targetPath) {
-    const resolved = canonicalPath(targetPath);
-    let current = resolved;
-    try {
-        if (!statSync(current).isDirectory()) {
-            current = path.dirname(current);
-        }
-    }
-    catch {
-        current = path.dirname(current);
-    }
-    while (true) {
-        if (existsSync(path.join(current, '.git'))) {
-            return current;
-        }
-        const parent = path.dirname(current);
-        if (parent === current) {
-            return null;
-        }
-        current = parent;
+    const inspection = inspectGitResourceIdentity(targetPath);
+    if (inspection.status === 'resolved') {
+        return inspection.identity.repositoryRoot;
     }
+    return inspection.status === 'invalid' ? inspection.boundaryPath : null;
 }

package/dist/core/shell-substitution.d.ts

@@ -4,3 +4,4 @@ export { MAX_SUBSTITUTION_DEPTH };
  * Finds inner commands for $(...) and backtick substitution, respecting escapes and nesting.
  */
 export declare function findCommandSubstitutions(command: string): string[];
+export declare function findStructuralCommandSubstitutions(command: string): string[];