@guilz-dev/belay 0.7.0 → 0.8.0

package/dist/core/shell-substitution.js

@@ -68,6 +68,67 @@ export function findCommandSubstitutions(command) {
     }
     return results;
 }
+export function findStructuralCommandSubstitutions(command) {
+    const results = [];
+    let index = 0;
+    let inSingle = false;
+    let inDouble = false;
+    let escaping = false;
+    while (index < command.length) {
+        const char = command[index];
+        if (escaping) {
+            escaping = false;
+            index += 1;
+            continue;
+        }
+        if (char === '\\' && !inSingle) {
+            escaping = true;
+            index += 1;
+            continue;
+        }
+        if (!inDouble && char === "'") {
+            inSingle = !inSingle;
+            index += 1;
+            continue;
+        }
+        if (!inSingle && char === '"') {
+            inDouble = !inDouble;
+            index += 1;
+            continue;
+        }
+        if (inSingle) {
+            index += 1;
+            continue;
+        }
+        if (char === '`') {
+            const end = findClosingBacktick(command, index + 1);
+            if (end === -1) {
+                break;
+            }
+            const inner = command.slice(index + 1, end).trim();
+            if (inner) {
+                results.push(inner);
+            }
+            index = end + 1;
+            continue;
+        }
+        if (char === '$' && command[index + 1] === '(') {
+            const closed = extractBalancedParenContent(command, index + 2);
+            if (!closed) {
+                index += 1;
+                continue;
+            }
+            const inner = closed.content.trim();
+            if (inner) {
+                results.push(inner);
+            }
+            index = closed.endIndex;
+            continue;
+        }
+        index += 1;
+    }
+    return results;
+}
 function findClosingBacktick(command, start) {
     let index = start;
     while (index < command.length) {

package/dist/core/standing-allow.d.ts

@@ -1,7 +1,7 @@
 import type { BelayConfigV4 } from './config.js';
 import type { GatedActionKind } from './gate-contract.js';
 import type { ClassifyResult } from './types.js';
-export type StandingAllowSource = 'provably-benign-corpus' | 'must-allow-catalog' | 'operator' | 'availability-reconfirmed';
+export type StandingAllowSource = 'operator' | 'availability-reconfirmed';
 export interface StandingAllowEntry {
     kind: GatedActionKind;
     fingerprint: string;
@@ -18,7 +18,6 @@ export interface StandingAllowFile {
 }
 export interface StandingAllowMatch {
     source: StandingAllowSource;
-    catalogCommand?: string;
     entryId?: string;
 }
 /** Default TTL for operator / availability-reconfirmed standing-allow entries. */

package/dist/core/standing-allow.js

@@ -1,7 +1,6 @@
 import { existsSync } from 'node:fs';
 import { mkdir, readFile, writeFile } from 'node:fs/promises';
 import path from 'node:path';
-import { STANDING_ALLOW_CATALOG } from '../corpus/standing-allow-catalog.generated.js';
 import { belayStateDir } from './config.js';
 const EMPTY_STANDING_ALLOW = {
     version: 1,
@@ -9,8 +8,6 @@ const EMPTY_STANDING_ALLOW = {
 };
 /** Default TTL for operator / availability-reconfirmed standing-allow entries. */
 export const DEFAULT_STANDING_ALLOW_TTL_MS = 30 * 24 * 60 * 60 * 1000;
-const PROVABLY_BENIGN_COMMANDS = new Set(STANDING_ALLOW_CATALOG.shell.provablyBenign.map((entry) => entry.normalizedCommand));
-const MUST_ALLOW_COMMANDS = new Set(STANDING_ALLOW_CATALOG.shell.mustAllow.map((entry) => entry.normalizedCommand));
 /** Reasons that must never be silenced via standing-allow (defense in depth with signal checks). */
 const STANDING_ALLOW_BLOCKED_REASONS = new Set([
     'external_effect',
@@ -95,18 +92,6 @@ export async function saveStandingAllow(filePath, state) {
     const compacted = compactStandingAllow(state);
     await writeFile(filePath, `${JSON.stringify(compacted, null, 2)}\n`, 'utf8');
 }
-function matchBundledCatalog(kind, normalizedCommand) {
-    if (kind !== 'shell' || !normalizedCommand) {
-        return null;
-    }
-    if (PROVABLY_BENIGN_COMMANDS.has(normalizedCommand)) {
-        return { source: 'provably-benign-corpus', catalogCommand: normalizedCommand };
-    }
-    if (MUST_ALLOW_COMMANDS.has(normalizedCommand)) {
-        return { source: 'must-allow-catalog', catalogCommand: normalizedCommand };
-    }
-    return null;
-}
 function matchStateEntry(params) {
     const now = params.now ?? Date.now();
     const match = params.state.entries.find((entry) => entry.kind === params.kind &&
@@ -119,17 +104,15 @@ function matchStateEntry(params) {
     return { source: match.source, entryId: match.fingerprint };
 }
 export function resolveStandingAllowMatch(params) {
+    if (params.kind === 'shell') {
+        return null;
+    }
     if (params.result.verdict !== 'deny_pending_approval') {
         return null;
     }
     if (isTier0StandingAllowBlocked(params.result)) {
         return null;
     }
-    const normalizedCommand = params.result.normalizedCommand ?? params.result.summary ?? '';
-    const catalogMatch = matchBundledCatalog(params.kind, normalizedCommand);
-    if (catalogMatch) {
-        return catalogMatch;
-    }
     return matchStateEntry({
         kind: params.kind,
         fingerprint: params.result.fingerprint,

package/dist/core/types.d.ts

@@ -3,7 +3,7 @@ import type { CapabilityGrantV1 } from './capability/grant.js';
 import type { PolicyDecision } from './capability/policy-types.js';
 import type { CapabilityRequestV1 } from './capability/request.js';
 import type { FsScopeAllowlistFile } from './capability/types.js';
-import type { EffectPlan } from './effect-ir/types.js';
+import type { EffectPlan, EffectPlanPolicyProjection } from './effect-ir/types.js';
 export type BelayMode = 'enforce' | 'audit';
 export type HookVerdict = 'allow' | 'allow_flagged' | 'deny_pending_approval';
 export type Reversibility = 'reversible' | 'recoverable_with_cost' | 'irreversible';
@@ -43,6 +43,7 @@ export interface ClassifyResult {
     authorizationDecision?: PolicyDecision;
     effectPlan?: EffectPlan;
     effectPlanPolicyDecisions?: PolicyDecision[];
+    effectPlanProjection?: EffectPlanPolicyProjection;
     boundaryProfile?: string;
 }
 export type UnknownLocalEffectPolicy = 'allow_flagged' | 'deny';
@@ -61,7 +62,9 @@ export interface ConfidenceThresholds {
 }
 export interface ClassifierOptions {
     strictChains?: boolean;
+    /** @deprecated Accepted for API compatibility but ignored by shell EffectPlan authorization. */
     customExternalCommands?: string[];
+    /** @deprecated Accepted for API compatibility but ignored by shell EffectPlan authorization. */
     customAllowCommands?: string[];
     sensitivePaths?: string[];
     unknownLocalEffect?: UnknownLocalEffectPolicy;

package/dist/core/verdict/adapter.js

@@ -22,8 +22,6 @@ export function buildVerdictContext(params) {
         trustedWorkspaceRoots: params.options?.trustedWorkspaceRoots ?? [],
         sensitivePaths: params.options?.sensitivePaths ?? params.config.classifier.sensitivePaths,
         protectedArtifactRoots: protectedArtifactRoots.length > 0 ? [...new Set(protectedArtifactRoots)] : undefined,
-        customAllowCommands: params.options?.customAllowCommands ?? params.config.overrides.allow,
-        customExternalCommands: params.options?.customExternalCommands ?? params.config.overrides.external,
         mode: params.config.mode,
         unknownLocalEffect: params.options?.unknownLocalEffect ?? params.config.policy.unknownLocalEffect,
         unparseableShell: params.options?.unparseableShell ?? params.config.policy.unparseableShell,
@@ -75,14 +73,15 @@ export function verdictToClassifyResult(result, config, options = {}) {
         result.location === 'repo_outside' ||
         result.effect === 'remote_mutation';
     const legacyReason = mapLegacyReason(result);
-    const hookVerdict = result.permission === 'ask'
-        ? 'deny_pending_approval'
-        : legacyReason === 'command_substitution' ||
-            legacyReason === 'unknown_local_effect' ||
-            legacyReason === 'unparseable_shell' ||
-            result.effect === 'local_mutation'
-            ? 'allow_flagged'
-            : 'allow';
+    const hookVerdict = result.effectPlanProjection?.hookVerdict ??
+        (result.permission === 'ask'
+            ? 'deny_pending_approval'
+            : legacyReason === 'command_substitution' ||
+                legacyReason === 'unknown_local_effect' ||
+                legacyReason === 'unparseable_shell' ||
+                result.effect === 'local_mutation'
+                ? 'allow_flagged'
+                : 'allow');
     const assessment = {
         reversibility: result.effect === 'read_only'
             ? 'reversible'
@@ -91,11 +90,11 @@ export function verdictToClassifyResult(result, config, options = {}) {
                 : 'irreversible',
         external,
         blastRadius: result.location,
-        confidence: result.confidence === 'deterministic'
-            ? 0.95
-            : result.confidence === 'llm'
-                ? 0.75
-                : hookVerdict === 'allow_flagged'
+        confidence: hookVerdict === 'allow_flagged'
+            ? 0.75
+            : result.confidence === 'deterministic'
+                ? 0.95
+                : result.confidence === 'llm'
                     ? 0.75
                     : 0.7,
         signals: result.signals,
@@ -123,6 +122,7 @@ export function verdictToClassifyResult(result, config, options = {}) {
         authorizationDecision: result.authorizationDecision,
         effectPlan: result.effectPlan,
         effectPlanPolicyDecisions: result.effectPlanPolicyDecisions,
+        effectPlanProjection: result.effectPlanProjection,
         boundaryProfile: options.boundaryProfile ??
             (config
                 ? resolveBoundaryProfile({ config, attestation: options.attestation })

package/dist/core/verdict/containment.js

@@ -1,4 +1,5 @@
 import path from 'node:path';
+import { isGitMetadataPath } from '../git-resource-identity.js';
 import { matchesSensitivePath } from '../glob.js';
 import { canonicalPath, pathWithinRoot, relativeWithinRepo, resolveMutationTarget, resolveWorkspaceRootMatch, } from '../path-utils.js';
 import { isOutsideRepoSecretCredentialPath } from './persistent-paths.js';
@@ -36,6 +37,9 @@ export function locationForPath(resolvedPath, repoRoot, trustedWorkspaceRoots =
     return 'repo_outside';
 }
 export function isGitPath(resolvedPath, repoRoot) {
+    if (isGitMetadataPath(resolvedPath, repoRoot)) {
+        return true;
+    }
     const relative = relativeWithinRepo(repoRoot, resolvedPath);
     if (!relative) {
         return false;

package/dist/core/verdict/egress-classify.d.ts

@@ -2,6 +2,18 @@
  * Egress tool classification (SPEC v2.1.3 R33–R34).
  * destructive → ask | read → allow at egress layer | ambiguous → require_approval via PolicyEngine
  */
+import type { ShellEffectRequirement } from '../effect-ir/shell-build.js';
 export type EgressClassification = 'destructive' | 'read' | 'ambiguous';
+export interface DecodeEgressEffectsParams {
+    tokens: string[];
+    cwd: string;
+    segment: string;
+}
 export declare function isEgressToolHead(head: string): boolean;
 export declare function classifyEgressTool(head: string, tokens: string[]): EgressClassification | null;
+/**
+ * Decode curl/wget/gh grammar into typed effects. This API deliberately has no
+ * permission or verdict output; uncertainty is represented by indeterminate
+ * requirements alongside every effect that was still recoverable.
+ */
+export declare function decodeEgressEffects(params: DecodeEgressEffectsParams): ShellEffectRequirement[] | null;