@guilz-dev/belay 0.8.1 → 0.9.1

package/dist/core/transactional/git-worktree.js

@@ -159,6 +159,7 @@ export async function applyWorktreeChanges(worktreePath, repoRoot, changes, opti
         sourceRoot: worktreePath,
         targetRoot: repoRoot,
         changes: observed,
+        beforeMutation: options?.beforeMutation,
         afterApply: options?.afterApply,
     });
 }

package/dist/core/transactional/runner.js

@@ -1,18 +1,33 @@
 import { boundaryMountReadOnlyFromPrediction, runWithBoundaryRunnable, } from '../capability/boundary-run.js';
 import { hostIntegrationBoundaryContext } from '../capability/boundary-session.js';
 import { resolveGuestWorkdir } from '../capability/boundary-workspace-mount.js';
-import { discardPreparedRecoveryCheckpoint, listRecoveryCheckpoints, markRecoveryCheckpointApplied, markRecoveryCheckpointApplying, prepareRecoveryCheckpoint, reconcileRecoveryCheckpoint, } from '../recovery/checkpoint.js';
+import { canonicalPath, pathWithinRoot } from '../path-utils.js';
+import { discardPreparedRecoveryCheckpoint, listRecoveryCheckpoints, markRecoveryCheckpointApplied, markRecoveryCheckpointApplying, markRecoveryCheckpointNeedsManualRepair, prepareRecoveryCheckpoint, reconcileRecoveryCheckpoint, } from '../recovery/checkpoint.js';
 import { buildObservedChangesFromTransactional } from './apply-observed-changes.js';
 import { selectTransactionalBackend } from './backend-selector.js';
 import { evaluateTransactionalDiff } from './diff-evaluator.js';
 import { FileCheckpointDiagnosticError } from './file-tree.js';
 import { applyWorktreeChanges, resolveWorktreeCwd, TRANSACTIONAL_APPLY_ROLLBACK_FAILED, TRANSACTIONAL_APPLY_TOCTOU, } from './git-worktree.js';
 import { TRANSACTIONAL_ALREADY_APPLIED, TRANSACTIONAL_APPLY_FAILED, TRANSACTIONAL_OBSERVED_RISK, } from './reasons.js';
+const TRANSACTIONAL_RESOURCE_IDENTITY_CHANGED = 'transactional_resource_identity_changed';
+function errorChainIncludes(error, message) {
+    const seen = new Set();
+    let current = error;
+    while (current instanceof Error && !seen.has(current)) {
+        if (current.message === message)
+            return true;
+        seen.add(current);
+        current = current.cause;
+    }
+    return false;
+}
 export async function runTransactionalExecution(params) {
     const { predicted, repoRoot, stateDir, command, cwd, timeoutMs, diffContext } = params;
+    const recoveryStateDir = canonicalPath(stateDir);
+    const recoveryStateOutsideResource = !pathWithinRoot(repoRoot, recoveryStateDir);
     const backendContext = {
         repoRoot,
-        stateDir,
+        stateDir: recoveryStateDir,
         cwd,
         dirtyIgnoreRoots: params.dirtyIgnoreRoots,
         fileCheckpoint: params.fileCheckpoint,
@@ -32,11 +47,13 @@ export async function runTransactionalExecution(params) {
             skipReason: skipReason ?? 'transactional_execution_failed',
             predicted,
             result: predicted,
+            transactionalBackend: selection.probe.backend,
+            resourceKind: selection.probe.resourceKind,
         };
     }
     if (params.checkpoint?.enabled) {
         try {
-            await listRecoveryCheckpoints(stateDir, repoRoot);
+            await listRecoveryCheckpoints(recoveryStateDir, repoRoot);
         }
         catch (error) {
             return {
@@ -45,6 +62,8 @@ export async function runTransactionalExecution(params) {
                 skipReason: error instanceof Error ? error.message : 'recovery_checkpoint_reconcile_failed',
                 predicted,
                 result: predicted,
+                transactionalBackend: selection.probe.backend,
+                resourceKind: selection.probe.resourceKind,
             };
         }
     }
@@ -118,7 +137,7 @@ export async function runTransactionalExecution(params) {
             const observedChanges = await buildObservedChangesFromTransactional(snapshot.baselineRoot ?? repoRoot, snapshot.executionRoot, changes);
             const checkpoint = params.checkpoint?.enabled && changes.length > 0
                 ? await prepareRecoveryCheckpoint({
-                    stateDir,
+                    stateDir: recoveryStateDir,
                     repoRoot,
                     baselinePath: snapshot.baselineRoot ?? repoRoot,
                     worktreePath: snapshot.executionRoot,
@@ -127,18 +146,30 @@ export async function runTransactionalExecution(params) {
                     protectedRoots: diffContext.protectedRoots,
                     config: params.checkpoint,
                     backend: snapshot.backend,
+                    expectedResourceIdentity: snapshot.resourceIdentity,
                 })
                 : null;
             try {
                 if (checkpoint) {
-                    await markRecoveryCheckpointApplying(stateDir, checkpoint);
+                    await markRecoveryCheckpointApplying(recoveryStateDir, checkpoint);
                 }
                 let receipt;
+                const validateResourceIdentity = snapshot.validateResourceIdentity;
                 await applyWorktreeChanges(snapshot.executionRoot, repoRoot, changes, {
                     observedChanges,
+                    beforeMutation: validateResourceIdentity
+                        ? async () => {
+                            try {
+                                await validateResourceIdentity();
+                            }
+                            catch (error) {
+                                throw new Error(TRANSACTIONAL_RESOURCE_IDENTITY_CHANGED, { cause: error });
+                            }
+                        }
+                        : undefined,
                     afterApply: checkpoint
                         ? async () => {
-                            receipt = await markRecoveryCheckpointApplied(stateDir, checkpoint);
+                            receipt = await markRecoveryCheckpointApplied(recoveryStateDir, checkpoint);
                         }
                         : undefined,
                 });
@@ -169,14 +200,25 @@ export async function runTransactionalExecution(params) {
                 };
             }
             catch (error) {
+                const toctou = error instanceof Error && error.message === TRANSACTIONAL_APPLY_TOCTOU;
+                const rollbackFailed = error instanceof Error && error.message === TRANSACTIONAL_APPLY_ROLLBACK_FAILED;
+                const resourceIdentityChanged = errorChainIncludes(error, TRANSACTIONAL_RESOURCE_IDENTITY_CHANGED);
+                const recoveryStateUnavailable = !recoveryStateOutsideResource && (rollbackFailed || resourceIdentityChanged);
                 if (checkpoint) {
-                    const recoveryState = await reconcileRecoveryCheckpoint(stateDir, checkpoint.checkpointId);
-                    if (recoveryState === 'prepared') {
-                        await discardPreparedRecoveryCheckpoint(stateDir, checkpoint.checkpointId);
+                    if (recoveryStateUnavailable) {
+                        // The resource path may now resolve to attacker-controlled replacement bytes.
+                        // Leave the original artifact in applying state instead of touching that path.
+                    }
+                    else if (rollbackFailed) {
+                        await markRecoveryCheckpointNeedsManualRepair(recoveryStateDir, checkpoint.checkpointId, TRANSACTIONAL_APPLY_ROLLBACK_FAILED);
+                    }
+                    else {
+                        const recoveryState = await reconcileRecoveryCheckpoint(recoveryStateDir, checkpoint.checkpointId);
+                        if (recoveryState === 'prepared') {
+                            await discardPreparedRecoveryCheckpoint(recoveryStateDir, checkpoint.checkpointId);
+                        }
                     }
                 }
-                const toctou = error instanceof Error && error.message === TRANSACTIONAL_APPLY_TOCTOU;
-                const rollbackFailed = error instanceof Error && error.message === TRANSACTIONAL_APPLY_ROLLBACK_FAILED;
                 const result = {
                     ...predicted,
                     verdict: 'deny_pending_approval',
@@ -189,9 +231,10 @@ export async function runTransactionalExecution(params) {
                             ...observed.assessment.signals,
                             rollbackFailed
                                 ? 'transactional_apply_rollback_failed'
-                                : toctou
+                                : toctou || resourceIdentityChanged
                                     ? 'transactional_apply_toctou'
                                     : 'transactional_apply_failed',
+                            ...(recoveryStateUnavailable ? ['transactional_recovery_state_unavailable'] : []),
                         ],
                     },
                 };
@@ -245,7 +288,10 @@ export async function runTransactionalExecution(params) {
                     snapshotCopyStrategy: snapshot.copyStrategy,
                     snapshotPrepareMs: snapshot.snapshotPrepareMs,
                 }
-                : {}),
+                : {
+                    transactionalBackend: selection.probe.backend,
+                    resourceKind: selection.probe.resourceKind,
+                }),
         };
     }
     finally {

package/dist/core/types.d.ts

@@ -4,6 +4,17 @@ import type { PolicyDecision } from './capability/policy-types.js';
 import type { CapabilityRequestV1 } from './capability/request.js';
 import type { FsScopeAllowlistFile } from './capability/types.js';
 import type { EffectPlan, EffectPlanPolicyProjection } from './effect-ir/types.js';
+export interface MediatedExecutionResult {
+    exitCode: number | null;
+    signal: string | null;
+    timedOut: boolean;
+    stdout: string;
+    stderr: string;
+    stdoutTruncated: boolean;
+    stderrTruncated: boolean;
+    receiptHash: string;
+    workspaceChangesDiscarded: true;
+}
 export type BelayMode = 'enforce' | 'audit';
 export type HookVerdict = 'allow' | 'allow_flagged' | 'deny_pending_approval';
 export type Reversibility = 'reversible' | 'recoverable_with_cost' | 'irreversible';
@@ -45,6 +56,8 @@ export interface ClassifyResult {
     effectPlanPolicyDecisions?: PolicyDecision[];
     effectPlanProjection?: EffectPlanPolicyProjection;
     boundaryProfile?: string;
+    wouldMediate?: boolean;
+    mediatedExecution?: MediatedExecutionResult;
 }
 export type UnknownLocalEffectPolicy = 'allow_flagged' | 'deny';
 export type UnparseableShellPolicy = 'allow_flagged' | 'deny';

package/dist/core/verdict/egress-classify.js

@@ -47,6 +47,7 @@ const GH_READ_COMMANDS = new Set([
     'repo view',
     'run list',
     'run view',
+    'search code',
     'workflow list',
     'workflow view',
 ]);

package/dist/core/verdict/parser.d.ts

@@ -4,15 +4,25 @@ export interface ParsedSegment {
     head: string;
     key: string;
     normalized: string;
+    encounteredXargs: boolean;
 }
 export declare function normalizeHead(token: string): string;
 export declare function peelTransparentWrappers(tokens: string[]): {
     tokens: string[];
     xargsStdinOpaque: boolean;
+    encounteredXargs: boolean;
+    opaque: boolean;
 };
 export declare function isVariableIndirectHead(head: string): boolean;
 export declare function extractEvalBody(tokens: string[]): string | null;
 export declare function extractRecursiveScript(tokens: string[]): string | null;
+/**
+ * True when a recursive script is evaluated from a command argument rather
+ * than expanded from a static launcher recipe. Callers use this semantic fact
+ * to preserve fail-closed policy for dynamic evaluation.
+ */
+export declare function isDynamicRecursiveEvaluation(tokens: string[]): boolean;
+export declare function isCommandInspection(tokens: string[]): boolean;
 export declare function isBareInterpreter(tokens: string[]): boolean;
 export declare function splitTopLevelSegments(command: string): string[];
 export declare function splitStructuralShellSegments(command: string): string[];

package/dist/core/verdict/parser.js

@@ -3,17 +3,7 @@ import { findCommandSubstitutions, findStructuralCommandSubstitutions, } from '.
 import { commandKey, tokenizeShell } from '../shell-tokenizer.js';
 import { detectUnparseableShell } from '../shell-unparseable.js';
 const ENV_PREFIX_PATTERN = /^[A-Za-z_][A-Za-z0-9_]*=(?:'[^']*'|"[^"]*"|\S+)$/;
-const TRANSPARENT_WRAPPERS = new Set([
-    'sudo',
-    'env',
-    'nohup',
-    'time',
-    'nice',
-    'ionice',
-    'stdbuf',
-    'setsid',
-    'xargs',
-]);
+const MAX_WRAPPER_PEEL_DEPTH = 32;
 const SHELL_INTERPRETERS = new Set(['bash', 'sh', 'zsh', 'dash', 'fish']);
 const CODE_INTERPRETERS = new Set(['python', 'python3', 'node', 'ruby', 'perl', 'osascript']);
 const SCRIPT_FLAGS = new Set(['-c', '-lc', '-e', '--eval']);
@@ -37,7 +27,13 @@ export function normalizeHead(token) {
 export function peelTransparentWrappers(tokens) {
     let current = [...tokens];
     let xargsStdinOpaque = false;
+    let encounteredXargs = false;
+    let peelDepth = 0;
     while (current.length > 0) {
+        if (peelDepth >= MAX_WRAPPER_PEEL_DEPTH) {
+            return { tokens: current, xargsStdinOpaque: false, encounteredXargs, opaque: true };
+        }
+        peelDepth += 1;
         while (current.length > 0 && ENV_PREFIX_PATTERN.test(current[0] ?? '')) {
             current.shift();
         }
@@ -45,38 +41,247 @@ export function peelTransparentWrappers(tokens) {
             break;
         }
         const head = normalizeHead(current[0] ?? '');
-        if (!TRANSPARENT_WRAPPERS.has(head)) {
+        if (head === 'xargs') {
+            encounteredXargs = true;
+            const wrapper = peelXargsWrapper(current);
+            if (wrapper.kind === 'opaque') {
+                xargsStdinOpaque = current.length === 1;
+                return {
+                    tokens: xargsStdinOpaque ? [] : current,
+                    xargsStdinOpaque,
+                    encounteredXargs,
+                    opaque: true,
+                };
+            }
+            current = wrapper.tokens;
+            continue;
+        }
+        const wrapper = peelTransparentWrapper(head, current);
+        if (!wrapper) {
             break;
         }
-        if (head === 'xargs') {
-            let index = 1;
-            while (index < current.length && current[index]?.startsWith('-')) {
-                index += 1;
+        if (wrapper.kind === 'opaque') {
+            return { tokens: current, xargsStdinOpaque: false, encounteredXargs, opaque: true };
+        }
+        if (wrapper.kind === 'preserve') {
+            return { tokens: current, xargsStdinOpaque: false, encounteredXargs, opaque: false };
+        }
+        current = wrapper.tokens;
+    }
+    return { tokens: current, xargsStdinOpaque, encounteredXargs, opaque: false };
+}
+function peelTransparentWrapper(head, tokens) {
+    switch (head) {
+        case 'sudo':
+            return peelSudoWrapper(tokens);
+        case 'command':
+        case 'builtin':
+        case 'exec':
+            return peelShellInvocationWrapper(head, tokens);
+        case 'env':
+            return peelEnvWrapper(tokens);
+        case 'time':
+            return peelTimeWrapper(tokens);
+        case 'nice':
+            return peelNiceWrapper(tokens);
+        case 'ionice':
+        case 'stdbuf':
+        case 'setsid':
+        case 'nohup':
+            return peelNoOptionWrapper(tokens);
+        default:
+            return null;
+    }
+}
+function peelXargsWrapper(tokens) {
+    const option = tokens[1] ?? '';
+    if (!option) {
+        return { kind: 'opaque' };
+    }
+    if (option === '-I') {
+        return isWrapperOperand(tokens[2]) ? targetFrom(tokens, 3) : { kind: 'opaque' };
+    }
+    if (option.startsWith('-I') && option.length > 2) {
+        return targetFrom(tokens, 2);
+    }
+    if (option.startsWith('-')) {
+        return { kind: 'opaque' };
+    }
+    return { kind: 'peeled', tokens: tokens.slice(1) };
+}
+function peelEnvWrapper(tokens) {
+    let index = 1;
+    while (index < tokens.length) {
+        const token = tokens[index] ?? '';
+        if (token === '--') {
+            index += 1;
+            break;
+        }
+        if (ENV_PREFIX_PATTERN.test(token)) {
+            index += 1;
+            continue;
+        }
+        if (token === '-i' || token === '--ignore-environment') {
+            index += 1;
+            continue;
+        }
+        if (token === '-u' || token === '--unset') {
+            if (!isWrapperOperand(tokens[index + 1])) {
+                return { kind: 'opaque' };
             }
-            const rest = current.slice(index);
-            if (rest.length === 0) {
-                xargsStdinOpaque = true;
-                return { tokens: [], xargsStdinOpaque: true };
+            index += 2;
+            continue;
+        }
+        if (token.startsWith('--unset=') && token.length > '--unset='.length) {
+            index += 1;
+            continue;
+        }
+        if (token.startsWith('-')) {
+            return { kind: 'opaque' };
+        }
+        break;
+    }
+    return targetFrom(tokens, index);
+}
+function peelTimeWrapper(tokens) {
+    if (tokens[1] === '-p') {
+        return targetFrom(tokens, 2);
+    }
+    return targetFrom(tokens, 1);
+}
+function peelNiceWrapper(tokens) {
+    if (tokens[1] === '-n') {
+        return isNiceAdjustment(tokens[2]) ? targetFrom(tokens, 3) : { kind: 'opaque' };
+    }
+    return targetFrom(tokens, 1);
+}
+function peelNoOptionWrapper(tokens) {
+    return targetFrom(tokens, 1);
+}
+function targetFrom(tokens, index) {
+    return isWrapperOperand(tokens[index])
+        ? { kind: 'peeled', tokens: tokens.slice(index) }
+        : { kind: 'opaque' };
+}
+function isWrapperOperand(token) {
+    return Boolean(token && token !== '--' && !token.startsWith('-'));
+}
+function isNiceAdjustment(token) {
+    return Boolean(token && /^[+-]?\d+$/.test(token));
+}
+function peelSudoWrapper(tokens) {
+    let index = 1;
+    while (index < tokens.length) {
+        const token = tokens[index] ?? '';
+        if (token === '--') {
+            index += 1;
+            break;
+        }
+        if (!token.startsWith('-') || token === '-') {
+            break;
+        }
+        if (token === '-n' || token === '--non-interactive') {
+            index += 1;
+            continue;
+        }
+        if (token === '-u' || token === '-g' || token === '--user' || token === '--group') {
+            if (!tokens[index + 1] || tokens[index + 1] === '--') {
+                return { kind: 'opaque' };
             }
-            current = rest;
+            index += 2;
+            continue;
+        }
+        if ((token.startsWith('-u') || token.startsWith('-g')) && token.length > 2) {
+            index += 1;
+            continue;
+        }
+        if ((token.startsWith('--user=') || token.startsWith('--group=')) &&
+            token.slice(token.indexOf('=') + 1).length > 0) {
+            index += 1;
             continue;
         }
-        if (head === 'env') {
-            let index = 1;
-            while (index < current.length) {
-                const token = current[index] ?? '';
-                if (ENV_PREFIX_PATTERN.test(token) || token.startsWith('-')) {
-                    index += 1;
-                    continue;
-                }
-                break;
+        return { kind: 'opaque' };
+    }
+    return index < tokens.length
+        ? { kind: 'peeled', tokens: tokens.slice(index) }
+        : { kind: 'opaque' };
+}
+function peelShellInvocationWrapper(head, tokens) {
+    switch (head) {
+        case 'command':
+            return peelCommandWrapper(tokens);
+        case 'builtin':
+            return peelBuiltinWrapper(tokens);
+        case 'exec':
+            return peelExecWrapper(tokens);
+    }
+}
+function peelCommandWrapper(tokens) {
+    let index = 1;
+    let inspection = false;
+    while (index < tokens.length) {
+        const token = tokens[index] ?? '';
+        if (token === '--') {
+            index += 1;
+            break;
+        }
+        if (!token.startsWith('-') || token === '-') {
+            break;
+        }
+        const flags = token.slice(1);
+        if (!flags || ![...flags].every((flag) => flag === 'p' || flag === 'v' || flag === 'V')) {
+            return { kind: 'opaque' };
+        }
+        inspection ||= flags.includes('v') || flags.includes('V');
+        index += 1;
+    }
+    if (inspection) {
+        return { kind: 'preserve' };
+    }
+    return index < tokens.length
+        ? { kind: 'peeled', tokens: tokens.slice(index) }
+        : { kind: 'opaque' };
+}
+function peelBuiltinWrapper(tokens) {
+    const first = tokens[1];
+    if (first === '--') {
+        return tokens.length > 2 ? { kind: 'peeled', tokens: tokens.slice(2) } : { kind: 'opaque' };
+    }
+    if (!first || first.startsWith('-')) {
+        return { kind: 'opaque' };
+    }
+    return { kind: 'peeled', tokens: tokens.slice(1) };
+}
+function peelExecWrapper(tokens) {
+    let index = 1;
+    while (index < tokens.length) {
+        const token = tokens[index] ?? '';
+        if (token === '--') {
+            index += 1;
+            break;
+        }
+        if (!token.startsWith('-') || token === '-') {
+            break;
+        }
+        if (token === '-a') {
+            if (!tokens[index + 1]) {
+                return { kind: 'opaque' };
             }
-            current = current.slice(index);
+            index += 2;
+            continue;
+        }
+        if (token.startsWith('-a') && token.length > 2) {
+            index += 1;
             continue;
         }
-        current = current.slice(1);
+        if (![...token.slice(1)].every((flag) => flag === 'c' || flag === 'l')) {
+            return { kind: 'opaque' };
+        }
+        index += 1;
     }
-    return { tokens: current, xargsStdinOpaque };
+    return index < tokens.length
+        ? { kind: 'peeled', tokens: tokens.slice(index) }
+        : { kind: 'opaque' };
 }
 export function isVariableIndirectHead(head) {
     return head.startsWith('$');
@@ -90,11 +295,15 @@ export function extractEvalBody(tokens) {
     return body || null;
 }
 export function extractRecursiveScript(tokens) {
-    const filtered = tokens.filter((token) => token !== 'sudo');
+    const { tokens: filtered, opaque } = peelTransparentWrappers(tokens);
+    if (opaque) {
+        return null;
+    }
     const head = normalizeHead(filtered[0] ?? '');
     const second = filtered[1] ?? '';
     if (head === 'eval') {
-        return extractEvalBody(tokens);
+        const body = filtered.slice(1).join(' ').trim();
+        return body || null;
     }
     if (SHELL_INTERPRETERS.has(head) || CODE_INTERPRETERS.has(head)) {
         const flagIndex = filtered.findIndex((token) => SCRIPT_FLAGS.has(token));
@@ -117,9 +326,29 @@ export function extractRecursiveScript(tokens) {
     }
     return null;
 }
+/**
+ * True when a recursive script is evaluated from a command argument rather
+ * than expanded from a static launcher recipe. Callers use this semantic fact
+ * to preserve fail-closed policy for dynamic evaluation.
+ */
+export function isDynamicRecursiveEvaluation(tokens) {
+    const { tokens: filtered, opaque } = peelTransparentWrappers(tokens);
+    if (opaque) {
+        return false;
+    }
+    const head = normalizeHead(filtered[0] ?? '');
+    if (head === 'eval') {
+        return true;
+    }
+    return ((SHELL_INTERPRETERS.has(head) || CODE_INTERPRETERS.has(head)) &&
+        filtered.some((token) => SCRIPT_FLAGS.has(token)));
+}
+export function isCommandInspection(tokens) {
+    return (normalizeHead(tokens[0] ?? '') === 'command' && peelCommandWrapper(tokens).kind === 'preserve');
+}
 export function isBareInterpreter(tokens) {
-    const { tokens: peeled, xargsStdinOpaque } = peelTransparentWrappers(tokens);
-    if (xargsStdinOpaque) {
+    const { tokens: peeled, xargsStdinOpaque, opaque } = peelTransparentWrappers(tokens);
+    if (xargsStdinOpaque || opaque) {
         return true;
     }
     if (peeled.length === 0) {
@@ -267,7 +496,8 @@ export function splitStructuralShellSegments(command) {
 }
 export function parseSegment(command) {
     const tokens = tokenizeShell(command);
-    const { tokens: peeled } = peelTransparentWrappers(tokens);
+    const peeledWrapper = peelTransparentWrappers(tokens);
+    const { tokens: peeled } = peeledWrapper;
     const normalizedTokens = peeled.map((token) => normalizeHead(token));
     const key = commandKey(peeled.map((token, index) => (index === 0 ? normalizeHead(token) : token)));
     return {
@@ -275,6 +505,7 @@ export function parseSegment(command) {
         head: normalizeHead(peeled[0] ?? ''),
         key,
         normalized: normalizedTokens.join(' ').trim(),
+        encounteredXargs: peeledWrapper.encounteredXargs,
     };
 }
 export function segmentOpacity(command) {
@@ -282,8 +513,8 @@ export function segmentOpacity(command) {
         return 'unparseable';
     }
     const tokens = tokenizeShell(command);
-    const { xargsStdinOpaque } = peelTransparentWrappers(tokens);
-    if (xargsStdinOpaque) {
+    const { xargsStdinOpaque, opaque } = peelTransparentWrappers(tokens);
+    if (xargsStdinOpaque || opaque) {
         return 'opaque';
     }
     if (isBareInterpreter(tokens)) {

package/dist/core/verdict/shell-semantics.js

@@ -103,6 +103,18 @@ function filterRoutinePathTargets(head, targets) {
     }
     return targets.filter((target) => looksLikePathToken(target));
 }
+function tscDeclaresOutputPaths(args) {
+    for (let index = 0; index < args.length; index += 1) {
+        const arg = args[index] ?? '';
+        if (/^--(?:outDir|outFile)=/.test(arg)) {
+            return true;
+        }
+        if ((arg === '--outDir' || arg === '--outFile') && args[index + 1]) {
+            return true;
+        }
+    }
+    return false;
+}
 function extractFilePathOperands(tokens) {
     const redirects = extractRedirectTargets(tokens);
     const args = [...redirects];
@@ -197,6 +209,15 @@ export function analyzeShellCommandSemantics(tokens, segment, cwd) {
     if (head === 'rsync') {
         return classifyRsync(tokens);
     }
+    if (head === 'tsc' && tokens.includes('--noEmit') && !tscDeclaresOutputPaths(tokens.slice(1))) {
+        return {
+            effect: 'read_only',
+            pathTargets: [],
+            signals: ['tsc.typecheck'],
+            normalizedKey: segment.key,
+            isReadOnly: true,
+        };
+    }
     let effect = 'unknown';
     let pathTargets = extractFilePathOperands(tokens);
     pathTargets = filterRoutinePathTargets(head, pathTargets);

package/dist/corpus/adversarial-probe.d.ts

@@ -68,7 +68,7 @@ export declare function splitFixHoldout<T>(items: readonly T[], seed: number, ho
     holdout: T[];
 };
 export declare function generateProbeCases(seed: number, maxCases?: number): MutatedCase[];
-/** Benign must-allow cores × AUTO_LABEL mutators — FP over-stop probe (not for corpus auto-add). */
+/** Benign probe cores × AUTO_LABEL mutators — FP over-stop probe (not for corpus auto-add). */
 export declare function generateFpProbeCases(seed: number): MutatedCase[];
 /** Ratio for overfitting detection; null when holdout unavailable or fix-perfect but holdout not. */
 export declare function holdoutFixFnRateRatio(fixSetFnRate: number, holdoutFnRate: number | null): number | null;

package/dist/corpus/adversarial-probe.js

@@ -1,8 +1,8 @@
 import { mkdir, writeFile } from 'node:fs/promises';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { BENIGN_PROBE_CORES } from './benign-probe-cores.js';
 import { evaluateCommandBatch, evaluateFpCommandBatch } from './evaluate.js';
-import { MUST_ALLOW_SHELL_COMMANDS } from './must-allow-commands.js';
 import { AUTO_LABEL_MUTATORS, CATASTROPHIC_CORES, generateMutatedCases, } from './mutators.js';
 const MUST_ASK_VERDICT = 'deny_pending_approval';
 export function probeCaseKey(entry) {
@@ -47,9 +47,9 @@ export function generateProbeCases(seed, maxCases) {
     }
     return shuffled.slice(0, maxCases);
 }
-/** Benign must-allow cores × AUTO_LABEL mutators — FP over-stop probe (not for corpus auto-add). */
+/** Benign probe cores × AUTO_LABEL mutators — FP over-stop probe (not for corpus auto-add). */
 export function generateFpProbeCases(seed) {
-    const all = generateMutatedCases([...MUST_ALLOW_SHELL_COMMANDS], AUTO_LABEL_MUTATORS);
+    const all = generateMutatedCases([...BENIGN_PROBE_CORES], AUTO_LABEL_MUTATORS);
     return shuffleWithSeed(all, seed + 1000);
 }
 function fnRate(fnCount, total) {