@guilz-dev/belay 0.9.2 → 0.9.3

package/dist/bundle/codex-runtime.mjs

@@ -824,6 +824,22 @@ import { createHash } from "node:crypto";
 function approvalCorrelationId(approvalId) {
   return createHash("sha256").update(approvalId).digest("hex").slice(0, 16);
 }
+function canonicalToolUseIdForCorrelation(toolUseId) {
+  const trimmed = toolUseId.trim();
+  if (trimmed.startsWith("tool_")) {
+    const remainder = trimmed.slice("tool_".length);
+    if (TOOL_USE_UUID_PATTERN.test(remainder)) {
+      return remainder.toLowerCase();
+    }
+  }
+  if (TOOL_USE_UUID_PATTERN.test(trimmed)) {
+    return trimmed.toLowerCase();
+  }
+  return trimmed;
+}
+function toolInvocationCorrelationId(toolUseId) {
+  return createHash("sha256").update(canonicalToolUseIdForCorrelation(toolUseId)).digest("hex").slice(0, 16);
+}
 function isValidApprovalCorrelationId(value) {
   return /^[a-f0-9]{16}$/.test(value);
 }
@@ -846,7 +862,16 @@ function isValidPreservedHashField(field, value) {
   return isValidAuditFingerprint(value);
 }
 function scrubAuditContainer(value, options) {
-  return scrubValue(value, {
+  const withoutRawToolIds = (input) => {
+    if (Array.isArray(input)) return input.map(withoutRawToolIds);
+    if (input && typeof input === "object") {
+      return Object.fromEntries(
+        Object.entries(input).filter(([key]) => key !== "tool_use_id").map(([key, child]) => [key, withoutRawToolIds(child)])
+      );
+    }
+    return input;
+  };
+  return scrubValue(withoutRawToolIds(value), {
     ...options,
     maskHighEntropyStrings: true
   });
@@ -865,7 +890,7 @@ function serializeAuditField(key, value, options) {
     if (key === "timestamp" && typeof value === "string" && isValidAuditTimestamp(value)) {
       return value;
     }
-    if (key === "approvalCorrelationId" && typeof value === "string" && isValidApprovalCorrelationId(value)) {
+    if ((key === "approvalCorrelationId" || key === "toolInvocationCorrelationId") && typeof value === "string" && isValidApprovalCorrelationId(value)) {
       return value;
     }
     if ((key === "runtimeVersion" || key === "runtimeBuildStamp" || key === "boundaryProfile") && typeof value === "string" && value.length > 0) {
@@ -917,7 +942,7 @@ function serializeAuditRecordV3(record, options) {
     serialized.approvalCorrelationId = record.approvalCorrelationId;
   }
   for (const [key, value] of Object.entries(record)) {
-    if (key === "timestamp" || key === "ts" || key === "approvalId" || key === "schemaVersion") {
+    if (key === "timestamp" || key === "ts" || key === "approvalId" || key === "tool_use_id" || key === "schemaVersion") {
       continue;
     }
     const next = serializeAuditField(key, value, options);
@@ -927,7 +952,7 @@ function serializeAuditRecordV3(record, options) {
   }
   return serialized;
 }
-var AUDIT_SCHEMA_VERSION, ISO8601_PATTERN, HEX64_PATTERN, SCRUB_PLACEHOLDERS, PRESERVED_HASH_FIELDS, PRESERVED_LITERAL_FIELDS, SCRUBBED_CONTAINER_FIELDS;
+var AUDIT_SCHEMA_VERSION, ISO8601_PATTERN, HEX64_PATTERN, SCRUB_PLACEHOLDERS, PRESERVED_HASH_FIELDS, PRESERVED_LITERAL_FIELDS, SCRUBBED_CONTAINER_FIELDS, TOOL_USE_UUID_PATTERN;
 var init_audit_serialize = __esm({
   "src/core/audit-serialize.ts"() {
     "use strict";
@@ -949,6 +974,7 @@ var init_audit_serialize = __esm({
     PRESERVED_LITERAL_FIELDS = /* @__PURE__ */ new Set([
       "timestamp",
       "approvalCorrelationId",
+      "toolInvocationCorrelationId",
       "runtimeVersion",
       "runtimeBuildStamp",
       "boundaryProfile",
@@ -969,6 +995,7 @@ var init_audit_serialize = __esm({
       "predictedAssessment",
       "observedAssessment"
     ]);
+    TOOL_USE_UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
   }
 });
 
@@ -2209,60 +2236,135 @@ function isRedirectOperator(token) {
 function isFdDuplication(token) {
   return FD_DUPLICATION_PATTERN.test(token);
 }
-function tokenizeShell(input) {
+function lexShell(input) {
   const tokens = [];
-  let buffer = "";
+  let value = "";
+  let wordStart = null;
+  let parts = [];
   let quote = null;
-  let escaping = false;
-  const flush = () => {
-    if (buffer.length > 0) {
-      tokens.push(buffer);
-      buffer = "";
+  let quoteStart = -1;
+  let quoteHadContent = false;
+  let complete = true;
+  const startWord = (index) => {
+    wordStart ??= index;
+  };
+  const append = (decoded, start, end, mode, hasExpansion) => {
+    startWord(start);
+    value += decoded;
+    const previous = parts.at(-1);
+    if (previous && previous.quote === mode && previous.hasExpansion === hasExpansion && previous.end === start) {
+      previous.value += decoded;
+      previous.raw += input.slice(start, end);
+      previous.end = end;
+      return;
     }
+    parts.push({
+      value: decoded,
+      raw: input.slice(start, end),
+      start,
+      end,
+      quote: mode,
+      hasExpansion
+    });
+  };
+  const flushWord = (end) => {
+    if (wordStart === null) return;
+    tokens.push({
+      kind: "word",
+      value,
+      raw: input.slice(wordStart, end),
+      start: wordStart,
+      end,
+      parts
+    });
+    value = "";
+    wordStart = null;
+    parts = [];
+  };
+  const pushOperator = (token, start, end) => {
+    tokens.push({ kind: "operator", value: token, raw: input.slice(start, end), start, end });
   };
   for (let index = 0; index < input.length; index += 1) {
-    const char = input[index];
-    if (escaping) {
-      buffer += char;
-      escaping = false;
-      continue;
-    }
-    if (char === "\\") {
-      escaping = true;
+    const char = input[index] ?? "";
+    if (quote === "single") {
+      if (char === "'") {
+        if (!quoteHadContent) append("", quoteStart, index + 1, "single", false);
+        quote = null;
+      } else {
+        append(char, index, index + 1, "single", false);
+        quoteHadContent = true;
+      }
       continue;
     }
-    if (quote) {
-      if (char === quote) {
+    if (quote === "double") {
+      if (char === '"') {
+        if (!quoteHadContent) append("", quoteStart, index + 1, "double", false);
         quote = null;
-      } else {
-        buffer += char;
+        continue;
+      }
+      if (char === "\\") {
+        const next = input[index + 1];
+        if (next === void 0) {
+          append("\\", index, index + 1, "double", false);
+          complete = false;
+          continue;
+        }
+        if (next === "$" || next === "`" || next === '"' || next === "\\" || next === "\n") {
+          append(next === "\n" ? "" : next, index, index + 2, "double", false);
+          quoteHadContent = true;
+          index += 1;
+          continue;
+        }
+        append("\\", index, index + 1, "double", false);
+        quoteHadContent = true;
+        continue;
       }
+      append(char, index, index + 1, "double", char === "$" || char === "`");
+      quoteHadContent = true;
       continue;
     }
-    if (char === '"' || char === "'") {
-      quote = char;
+    if (char === "'" || char === '"') {
+      startWord(index);
+      quote = char === "'" ? "single" : "double";
+      quoteStart = index;
+      quoteHadContent = false;
+      continue;
+    }
+    if (char === "\\") {
+      const next = input[index + 1];
+      if (next === void 0) {
+        append("\\", index, index + 1, "unquoted", false);
+        complete = false;
+        continue;
+      }
+      append(next, index, index + 2, "unquoted", false);
+      index += 1;
       continue;
     }
     const operator = readShellOperator(input, index);
     if (operator) {
-      flush();
-      tokens.push(operator.token);
+      flushWord(index);
+      pushOperator(operator.token, index, index + operator.length);
       index += operator.length - 1;
       continue;
     }
     if (char === "\n" || char === "\r") {
-      flush();
-      tokens.push(";");
+      flushWord(index);
+      pushOperator(";", index, index + 1);
       continue;
     }
     if (/\s/.test(char)) {
-      flush();
+      flushWord(index);
       continue;
     }
-    buffer += char;
+    append(char, index, index + 1, "unquoted", char === "$" || char === "`");
   }
-  flush();
-  return tokens;
+  if (quote !== null) complete = false;
+  flushWord(input.length);
+  return { tokens, complete };
+}
+function tokenizeShell(input) {
+  return lexShell(input).tokens.map((token) => token.value);
 }
 function commandKey(tokens) {
   const filtered = tokens.filter((token) => token !== "sudo");
@@ -3472,6 +3574,7 @@ var init_config_io = __esm({
 
 // src/adapters/codex/runtime-entry.ts
 init_codex();
+import path56 from "node:path";
 import process2 from "node:process";
 
 // src/adapters/shared/gate-runtime.ts
@@ -3480,7 +3583,7 @@ init_approval_replay();
 import { randomUUID as randomUUID6 } from "node:crypto";
 import { existsSync as existsSync16 } from "node:fs";
 import { mkdir as mkdir14, readFile as readFile15, writeFile as writeFile11 } from "node:fs/promises";
-import path52 from "node:path";
+import path54 from "node:path";
 
 // src/core/approval-service.ts
 init_config_io();
@@ -10867,6 +10970,24 @@ init_fingerprint2();
 
 // src/core/replay-scrub.ts
 init_scrub();
+function redactToolInvocationId(value, rawToolUseId) {
+  if (typeof value === "string") {
+    return rawToolUseId ? value.replaceAll(rawToolUseId, "<tool-use-id>") : value;
+  }
+  if (Array.isArray(value)) {
+    return value.map((item) => redactToolInvocationId(item, rawToolUseId));
+  }
+  if (value && typeof value === "object") {
+    const result = {};
+    for (const [key, child] of Object.entries(value)) {
+      if (key !== "tool_use_id") {
+        result[key] = redactToolInvocationId(child, rawToolUseId);
+      }
+    }
+    return result;
+  }
+  return value;
+}
 function subagentFingerprintSource(payload, scrubOptions) {
   const toolInput = payload.tool_input;
   if (toolInput && typeof toolInput === "object") {
@@ -10899,16 +11020,20 @@ function fingerprintReplayPayload(kind, payload, scrubOptions) {
   if (!payload) {
     return void 0;
   }
+  const replayPayload = redactToolInvocationId(
+    payload,
+    typeof payload.tool_use_id === "string" ? payload.tool_use_id : void 0
+  );
   if (kind === "tool") {
-    const toolInput = payload.tool_input;
+    const toolInput = replayPayload.tool_input;
     if (toolInput && typeof toolInput === "object") {
       return scrubValue(toolInput, scrubOptions);
     }
   }
   if (kind === "subagent") {
-    return subagentFingerprintSource(payload, scrubOptions);
+    return subagentFingerprintSource(replayPayload, scrubOptions);
   }
-  return scrubValue(payload, scrubOptions);
+  return scrubValue(replayPayload, scrubOptions);
 }
 
 // src/core/classify-subagent.ts
@@ -11000,7 +11125,7 @@ function classifySubagent(payload, repoRoot, options = {}, config) {
 }
 
 // src/core/classify-tool.ts
-import path40 from "node:path";
+import path42 from "node:path";
 init_fingerprint2();
 init_path_utils();
 init_scrub();
@@ -11123,10 +11248,346 @@ init_git_resource_identity();
 init_path_utils();
 init_shell_tokenizer();
 import { lstatSync as lstatSync2, realpathSync as realpathSync4 } from "node:fs";
-import path39 from "node:path";
+import path41 from "node:path";
 
-// src/core/verdict/egress-classify.ts
+// src/core/verdict/docker-compose-run.ts
+import path36 from "node:path";
+
+// src/core/verdict/recursive-invocation.ts
 import path35 from "node:path";
+var SHELL_INTERPRETERS = /* @__PURE__ */ new Set(["bash", "sh", "zsh", "dash", "fish"]);
+var PYTHON_INTERPRETERS = /* @__PURE__ */ new Set(["python", "python3"]);
+var SHELL_SHORT_OPTIONS = /* @__PURE__ */ new Set(["c", "l", "e", "x", "u"]);
+var SHELL_NON_SCRIPT_SHORT_OPTIONS = /* @__PURE__ */ new Set(["n"]);
+var SHELL_TERMINAL_OPTIONS = /* @__PURE__ */ new Map([
+  ["bash", /* @__PURE__ */ new Set(["--help", "--version"])],
+  ["zsh", /* @__PURE__ */ new Set(["--version"])],
+  ["fish", /* @__PURE__ */ new Set(["-h", "--help", "-v", "--version"])]
+]);
+var SHELL_VALUE_OPTIONS = /* @__PURE__ */ new Set(["-O", "+O", "--init-file", "--rcfile"]);
+var NODE_TERMINAL_OPTIONS = /* @__PURE__ */ new Set(["-h", "--help", "--help-all", "-v", "--version"]);
+var NODE_FILE_OPTIONS = /* @__PURE__ */ new Set(["-c", "--check"]);
+var PYTHON_PROFILE = {
+  scriptOptions: /* @__PURE__ */ new Set(["-c"]),
+  terminalOptions: /* @__PURE__ */ new Set(["-h", "--help", "-V", "-VV", "--version"]),
+  terminalValueOptions: /* @__PURE__ */ new Set(["-m"]),
+  flagOptions: /* @__PURE__ */ new Set([
+    "-b",
+    "-bb",
+    "-B",
+    "-d",
+    "-E",
+    "-I",
+    "-O",
+    "-OO",
+    "-P",
+    "-q",
+    "-s",
+    "-S",
+    "-u",
+    "-v",
+    "-x"
+  ]),
+  valueOptions: /* @__PURE__ */ new Set(["-W", "-X"]),
+  attachedValuePrefixes: ["-W", "-X"]
+};
+var RUBY_PROFILE = {
+  scriptOptions: /* @__PURE__ */ new Set(["-e"]),
+  terminalOptions: /* @__PURE__ */ new Set(["-h", "--help", "-v", "--version", "--copyright"]),
+  terminalValueOptions: /* @__PURE__ */ new Set([]),
+  flagOptions: /* @__PURE__ */ new Set(["-d", "--debug", "-w"]),
+  valueOptions: /* @__PURE__ */ new Set(["-I"]),
+  attachedValuePrefixes: ["-I"]
+};
+var PERL_PROFILE = {
+  scriptOptions: /* @__PURE__ */ new Set(["-e"]),
+  terminalOptions: /* @__PURE__ */ new Set(["-h", "--help", "-v", "--version"]),
+  terminalValueOptions: /* @__PURE__ */ new Set([]),
+  flagOptions: /* @__PURE__ */ new Set([]),
+  valueOptions: /* @__PURE__ */ new Set(["-I"]),
+  attachedValuePrefixes: ["-I"]
+};
+var OSASCRIPT_PROFILE = {
+  scriptOptions: /* @__PURE__ */ new Set(["-e"]),
+  terminalOptions: /* @__PURE__ */ new Set(["-h", "--help"]),
+  terminalValueOptions: /* @__PURE__ */ new Set([]),
+  flagOptions: /* @__PURE__ */ new Set([]),
+  valueOptions: /* @__PURE__ */ new Set(["-l"]),
+  attachedValuePrefixes: []
+};
+function normalizeInterpreter(value) {
+  return path35.basename(value);
+}
+function scriptResult(interpreter, token) {
+  if (!token) {
+    return { kind: "indeterminate", interpreter, signal: "shell.interpreter_argv_incomplete" };
+  }
+  if (token.parts.some((part) => part.hasExpansion)) {
+    return { kind: "dynamic", interpreter, signal: "shell.script_expanded" };
+  }
+  return { kind: "static", interpreter, script: token.value };
+}
+function decodeShell(words, interpreter) {
+  for (let index = 1; index < words.length; index += 1) {
+    const option = words[index]?.value ?? "";
+    if (option === "--") return { kind: "none" };
+    if (SHELL_TERMINAL_OPTIONS.get(interpreter)?.has(option)) return { kind: "none" };
+    if (interpreter === "bash" && SHELL_VALUE_OPTIONS.has(option)) {
+      const operand = words[index + 1]?.value;
+      if (!operand || operand.startsWith("-")) {
+        return { kind: "indeterminate", interpreter, signal: "shell.interpreter_option_unknown" };
+      }
+      index += 1;
+      continue;
+    }
+    if (!option.startsWith("-") || option === "-") return { kind: "none" };
+    const flags = [...option.slice(1)];
+    if (flags.length === 0) {
+      return { kind: "indeterminate", interpreter, signal: "shell.interpreter_option_unknown" };
+    }
+    if (flags.every((flag) => SHELL_SHORT_OPTIONS.has(flag))) {
+      if (!flags.includes("c")) continue;
+      return scriptResult(interpreter, words[index + 1]);
+    }
+    if (flags.every(
+      (flag) => SHELL_SHORT_OPTIONS.has(flag) || SHELL_NON_SCRIPT_SHORT_OPTIONS.has(flag)
+    ) && flags.some((flag) => SHELL_NON_SCRIPT_SHORT_OPTIONS.has(flag))) {
+      return { kind: "none" };
+    }
+    return { kind: "indeterminate", interpreter, signal: "shell.interpreter_option_unknown" };
+  }
+  return { kind: "none" };
+}
+function decodeSeparated(words, interpreter, profile) {
+  for (let index = 1; index < words.length; index += 1) {
+    const option = words[index]?.value ?? "";
+    if (option === "--" || !option.startsWith("-") || option === "-") return { kind: "none" };
+    if (profile.scriptOptions.has(option)) {
+      return scriptResult(interpreter, words[index + 1]);
+    }
+    if (profile.terminalOptions.has(option)) return { kind: "none" };
+    if (profile.terminalValueOptions.has(option)) {
+      const operand = words[index + 1]?.value;
+      if (!operand || operand.startsWith("-")) {
+        return { kind: "indeterminate", interpreter, signal: "shell.interpreter_option_unknown" };
+      }
+      return { kind: "none" };
+    }
+    if (profile.flagOptions.has(option)) {
+      continue;
+    }
+    if (profile.valueOptions.has(option)) {
+      const operand = words[index + 1]?.value;
+      if (!operand || operand.startsWith("-")) {
+        return { kind: "indeterminate", interpreter, signal: "shell.interpreter_option_unknown" };
+      }
+      index += 1;
+      continue;
+    }
+    if (profile.attachedValuePrefixes.some(
+      (prefix) => option.startsWith(prefix) && option.length > prefix.length
+    )) {
+      continue;
+    }
+    return { kind: "indeterminate", interpreter, signal: "shell.interpreter_option_unknown" };
+  }
+  return { kind: "none" };
+}
+function decodeNode(words, interpreter) {
+  const option = words[1]?.value ?? "";
+  if (option === "--" || !option.startsWith("-") || option === "-") return { kind: "none" };
+  if (option === "-e" || option === "--eval") {
+    return scriptResult(interpreter, words[2]);
+  }
+  if (option.startsWith("--eval=")) {
+    const script = option.slice("--eval=".length);
+    if (words[1]?.parts.some((part) => part.hasExpansion)) {
+      return { kind: "dynamic", interpreter, signal: "shell.script_expanded" };
+    }
+    return { kind: "static", interpreter, script };
+  }
+  if (NODE_TERMINAL_OPTIONS.has(option)) return { kind: "none" };
+  if (NODE_FILE_OPTIONS.has(option)) return { kind: "none" };
+  return { kind: "indeterminate", interpreter, signal: "shell.interpreter_option_unknown" };
+}
+function decodeEval(words) {
+  const arguments_ = words.slice(1);
+  if (arguments_.length === 0) return { kind: "none" };
+  if (arguments_.some((word) => word.parts.some((part) => part.hasExpansion))) {
+    return { kind: "dynamic", interpreter: "eval", signal: "shell.script_expanded" };
+  }
+  return {
+    kind: "static",
+    interpreter: "eval",
+    script: arguments_.map((word) => word.value).join(" ")
+  };
+}
+function decodeRecursiveInvocation(tokens) {
+  if (tokens.some((token) => token.kind === "operator")) return { kind: "none" };
+  const words = tokens.filter((token) => token.kind === "word");
+  const interpreter = normalizeInterpreter(words[0]?.value ?? "");
+  if (!interpreter) return { kind: "none" };
+  if (interpreter === "eval") return decodeEval(words);
+  if (SHELL_INTERPRETERS.has(interpreter)) return decodeShell(words, interpreter);
+  if (PYTHON_INTERPRETERS.has(interpreter)) {
+    return decodeSeparated(words, interpreter, PYTHON_PROFILE);
+  }
+  if (interpreter === "node") return decodeNode(words, interpreter);
+  if (interpreter === "ruby") return decodeSeparated(words, interpreter, RUBY_PROFILE);
+  if (interpreter === "perl") return decodeSeparated(words, interpreter, PERL_PROFILE);
+  if (interpreter === "osascript") return decodeSeparated(words, interpreter, OSASCRIPT_PROFILE);
+  return { kind: "none" };
+}
+function shellTokensFromValues(values, options = {}) {
+  let offset = 0;
+  return values.map((value) => {
+    const start = offset;
+    const end = start + value.length;
+    offset = end + 1;
+    return {
+      kind: "word",
+      value,
+      raw: value,
+      start,
+      end,
+      parts: [
+        {
+          value,
+          raw: value,
+          start,
+          end,
+          quote: "unquoted",
+          hasExpansion: options.detectExpansion !== false && (value.includes("$") || value.includes("`"))
+        }
+      ]
+    };
+  });
+}
+
+// src/core/verdict/docker-compose-run.ts
+var COMPOSE_GLOBAL_OPTIONS = /* @__PURE__ */ new Map([
+  ["--all-resources", 0],
+  ["--ansi", 1],
+  ["--compatibility", 0],
+  ["--dry-run", 0],
+  ["--env-file", 1],
+  ["-f", 1],
+  ["--file", 1],
+  ["--parallel", 1],
+  ["--profile", 1],
+  ["--progress", 1],
+  ["--project-directory", 1],
+  ["-p", 1],
+  ["--project-name", 1]
+]);
+var COMPOSE_RUN_OPTIONS = /* @__PURE__ */ new Map([
+  ["--build", 0],
+  ["--cap-add", 1],
+  ["--cap-drop", 1],
+  ["-d", 0],
+  ["--detach", 0],
+  ["--entrypoint", 1],
+  ["-e", 1],
+  ["--env", 1],
+  ["--env-from-file", 1],
+  ["-i", 0],
+  ["--interactive", 0],
+  ["-l", 1],
+  ["--label", 1],
+  ["--name", 1],
+  ["--no-deps", 0],
+  ["-T", 0],
+  ["--no-tty", 0],
+  ["-p", 1],
+  ["--publish", 1],
+  ["--pull", 1],
+  ["-q", 0],
+  ["--quiet", 0],
+  ["--quiet-build", 0],
+  ["--quiet-pull", 0],
+  ["--remove-orphans", 0],
+  ["--rm", 0],
+  ["-P", 0],
+  ["--service-ports", 0],
+  ["--use-aliases", 0],
+  ["-u", 1],
+  ["--user", 1],
+  ["-v", 1],
+  ["--volume", 1],
+  ["-w", 1],
+  ["--workdir", 1]
+]);
+function parseOptions(words, start, options) {
+  let index = start;
+  while (index < words.length) {
+    const value = words[index]?.value ?? "";
+    if (value === "--") return { kind: "ok", index: index + 1 };
+    if (!value.startsWith("-") || value === "-") return { kind: "ok", index };
+    const equalsIndex = value.indexOf("=");
+    const name = equalsIndex === -1 ? value : value.slice(0, equalsIndex);
+    const arity = options.get(name);
+    if (arity === void 0) return { kind: "indeterminate" };
+    if (equalsIndex !== -1) {
+      if (!value.startsWith("--") || arity !== 1 || equalsIndex === value.length - 1) {
+        return { kind: "indeterminate" };
+      }
+      index += 1;
+      continue;
+    }
+    if (arity === 1) {
+      if (!words[index + 1]) return { kind: "indeterminate" };
+      index += 2;
+      continue;
+    }
+    index += 1;
+  }
+  return { kind: "ok", index };
+}
+function decodeDockerComposeRun(tokens) {
+  if (tokens.some((token) => token.kind === "operator")) return { kind: "none" };
+  const words = tokens.filter((token) => token.kind === "word");
+  const head = path36.basename(words[0]?.value ?? "");
+  let index;
+  if (head === "docker-compose") {
+    index = 1;
+  } else if (head === "docker" && words[1]?.value === "compose") {
+    index = 2;
+  } else {
+    return { kind: "none" };
+  }
+  const globalOptions = parseOptions(words, index, COMPOSE_GLOBAL_OPTIONS);
+  if (globalOptions.kind === "indeterminate") {
+    return { kind: "indeterminate", signal: "shell.compose_argv_indeterminate" };
+  }
+  index = globalOptions.index;
+  if (words[index]?.value !== "run") return { kind: "none" };
+  const runOptions = parseOptions(words, index + 1, COMPOSE_RUN_OPTIONS);
+  if (runOptions.kind === "indeterminate") {
+    return { kind: "indeterminate", signal: "shell.compose_argv_indeterminate" };
+  }
+  index = runOptions.index;
+  const service = words[index]?.value;
+  if (!service) return { kind: "indeterminate", signal: "shell.compose_argv_indeterminate" };
+  const command = words.slice(index + 1);
+  if (command.length === 0) return { kind: "none" };
+  const recursive = decodeRecursiveInvocation(command);
+  if (recursive.kind === "static") {
+    return {
+      kind: "recursive",
+      service,
+      interpreter: recursive.interpreter,
+      script: recursive.script
+    };
+  }
+  if (recursive.kind === "dynamic") return { kind: "dynamic", service, signal: recursive.signal };
+  if (recursive.kind === "indeterminate") {
+    return { kind: "indeterminate", signal: "shell.compose_argv_indeterminate" };
+  }
+  return { kind: "none" };
+}
+
+// src/core/verdict/egress-classify.ts
+import path37 from "node:path";
 var CURL_EFFECT_NEUTRAL_FLAGS = /* @__PURE__ */ new Set([
   "-f",
   "-L",
@@ -11161,7 +11622,7 @@ var GH_READ_COMMANDS = /* @__PURE__ */ new Set([
   "workflow view"
 ]);
 function decodeEgressEffects(params) {
-  const head = path35.basename(params.tokens[0] ?? "");
+  const head = path37.basename(params.tokens[0] ?? "");
   if (head !== "curl" && head !== "wget" && head !== "gh") {
     return null;
   }
@@ -11169,7 +11630,7 @@ function decodeEgressEffects(params) {
   const provenance = { segment: params.segment };
   const requirements = [];
   for (const file of decoded.files) {
-    const resolved = path35.resolve(params.cwd, expandHome2(file));
+    const resolved = path37.resolve(params.cwd, expandHome2(file));
     requirements.push(
       requirement("fs.read", "fs.read", { kind: "path", path: resolved }, params.segment, [
         "egress.explicit_file_read"
@@ -11191,7 +11652,7 @@ function decodeEgressEffects(params) {
     if (file === "-") {
       continue;
     }
-    const resolved = path35.resolve(params.cwd, expandHome2(file));
+    const resolved = path37.resolve(params.cwd, expandHome2(file));
     if (resolved === "/dev/null") {
       continue;
     }
@@ -11669,13 +12130,13 @@ function decodeSingleCurlWgetGrammar(head, tokens) {
   if (head === "wget" && !explicitOutput) {
     outputFiles.push(
       ...endpointOutputNames.map(
-        (name) => outputDirectory ? path35.join(outputDirectory, name) : name
+        (name) => outputDirectory ? path37.join(outputDirectory, name) : name
       )
     );
   } else if (head === "curl" && remoteNameOutput) {
     outputFiles.push(
       ...endpointOutputNames.map(
-        (name) => outputDirectory ? path35.join(outputDirectory, name) : name
+        (name) => outputDirectory ? path37.join(outputDirectory, name) : name
       )
     );
   }
@@ -11689,7 +12150,7 @@ function decodeSingleCurlWgetGrammar(head, tokens) {
     outputFiles: [
       ...new Set(
         outputFiles.map(
-          (file) => outputDirectory && directoryEligibleOutputs.has(file) && !path35.isAbsolute(file) ? path35.join(outputDirectory, file) : file
+          (file) => outputDirectory && directoryEligibleOutputs.has(file) && !path37.isAbsolute(file) ? path37.join(outputDirectory, file) : file
         )
       )
     ],
@@ -11704,7 +12165,7 @@ function remoteOutputName(spec) {
   } catch {
     pathname = spec.split(/[?#]/, 1)[0] ?? "";
   }
-  const name = path35.posix.basename(pathname);
+  const name = path37.posix.basename(pathname);
   return name && name !== "/" ? name : "index.html";
 }
 function decodeGhGrammar(tokens) {
@@ -11869,7 +12330,7 @@ function expandHome2(value) {
     return process.env.HOME ?? value;
   }
   if (value.startsWith("~/")) {
-    return path35.join(process.env.HOME ?? "~", value.slice(2));
+    return path37.join(process.env.HOME ?? "~", value.slice(2));
   }
   return value;
 }
@@ -11888,7 +12349,7 @@ function requirement(tag, action, resource, segment, signals) {
 }
 
 // src/core/verdict/git-classifier.ts
-import path36 from "node:path";
+import path38 from "node:path";
 init_shell_tokenizer();
 var GIT_BRANCH_MUTATION_FLAGS = /* @__PURE__ */ new Set([
   "--copy",
@@ -11984,7 +12445,7 @@ var FILE_OPERAND_SUBCOMMANDS = /* @__PURE__ */ new Set([
 var COMPOUND_SUBCOMMAND_HEADS = /* @__PURE__ */ new Set(["worktree", "stash", "tag"]);
 var REF_ONLY_WITHOUT_TERMINATOR = /* @__PURE__ */ new Set(["checkout", "show", "log"]);
 function isGitExecutable(token) {
-  return path36.basename(token) === "git";
+  return path38.basename(token) === "git";
 }
 function takesValue(flag) {
   return flag === "-C" || flag === "-c" || flag === "--git-dir" || flag === "--work-tree" || flag === "--exec-path" || flag === "--paginate" || flag === "--config-env" || flag.startsWith("-C") || flag.startsWith("-c") || flag.startsWith("--git-dir=") || flag.startsWith("--work-tree=");
@@ -12012,7 +12473,7 @@ function peelGlobalOptions(tokens, baseCwd) {
     if (token === "-C" || token === "--work-tree" || token === "--git-dir" || token === "-c") {
       const value = tokens[index + 1];
       if (token === "-C" && value) {
-        effectiveCwd = path36.resolve(baseCwd, value);
+        effectiveCwd = path38.resolve(baseCwd, value);
       } else if (token === "--work-tree" && value) {
         workTree = value;
       } else if (token === "--git-dir" && value) {
@@ -12022,7 +12483,7 @@ function peelGlobalOptions(tokens, baseCwd) {
       continue;
     }
     if (token.startsWith("-C") && token.length > 2) {
-      effectiveCwd = path36.resolve(baseCwd, token.slice(2));
+      effectiveCwd = path38.resolve(baseCwd, token.slice(2));
       index += 1;
       continue;
     }
@@ -12165,7 +12626,7 @@ function looksLikeDiffPathOperand(token) {
   if (!looksLikeFileOperand(token)) {
     return false;
   }
-  if (token.startsWith(".") || path36.isAbsolute(token)) {
+  if (token.startsWith(".") || path38.isAbsolute(token)) {
     return true;
   }
   return token.includes(".");
@@ -12173,12 +12634,12 @@ function looksLikeDiffPathOperand(token) {
 function resolveGitWorkTree(baseCwd, effectiveCwd, workTree, gitDir) {
   const resolveBase = effectiveCwd ?? baseCwd;
   if (workTree) {
-    return path36.resolve(resolveBase, workTree);
+    return path38.resolve(resolveBase, workTree);
   }
   if (gitDir) {
-    const resolvedGitDir = path36.resolve(resolveBase, gitDir);
-    if (path36.basename(resolvedGitDir) === ".git") {
-      return path36.dirname(resolvedGitDir);
+    const resolvedGitDir = path38.resolve(resolveBase, gitDir);
+    if (path38.basename(resolvedGitDir) === ".git") {
+      return path38.dirname(resolvedGitDir);
     }
   }
   return void 0;
@@ -12259,7 +12720,7 @@ function classifyGitCommand(tokens, baseCwd) {
   const { subcommand, args, effectiveCwd, gitDir, workTree } = normalized;
   const normalizedKey = `git ${subcommand}`;
   const gitWorkTree = resolveGitWorkTree(baseCwd, effectiveCwd, workTree, gitDir);
-  const effectiveGitDir = gitDir ? path36.resolve(effectiveCwd ?? baseCwd, gitDir) : void 0;
+  const effectiveGitDir = gitDir ? path38.resolve(effectiveCwd ?? baseCwd, gitDir) : void 0;
   const scopeTargets = [effectiveCwd, gitWorkTree, effectiveGitDir].filter(
     (target, index, targets) => Boolean(target) && targets.indexOf(target) === index
   );
@@ -12411,9 +12872,9 @@ function decodeGitEffects(params) {
     ...subcommand === "push" ? ["tier0_external"] : []
   ];
   const effectiveCwd = normalized.effectiveCwd ?? params.cwd;
-  const workTreeRoot = normalized.workTree ? path36.resolve(normalized.effectiveCwd ?? params.cwd, normalized.workTree) : normalized.effectiveCwd ?? params.repoRoot;
-  const gitRefRoot = normalized.gitDir ? path36.resolve(effectiveCwd, normalized.gitDir) : workTreeRoot;
-  const gitControlRoot = normalized.gitDir ? gitRefRoot : path36.join(gitRefRoot, ".git");
+  const workTreeRoot = normalized.workTree ? path38.resolve(normalized.effectiveCwd ?? params.cwd, normalized.workTree) : normalized.effectiveCwd ?? params.repoRoot;
+  const gitRefRoot = normalized.gitDir ? path38.resolve(effectiveCwd, normalized.gitDir) : workTreeRoot;
+  const gitControlRoot = normalized.gitDir ? gitRefRoot : path38.join(gitRefRoot, ".git");
   const requirements = [];
   if (subcommand === "fetch" || subcommand === "pull") {
     const positionals = gitRemotePositionals(args);
@@ -12572,7 +13033,7 @@ function decodeGitEffects(params) {
         gitRequirement(
           "control_plane.write",
           "control_plane.write",
-          { kind: "path", path: path36.join(gitControlRoot, "logs") },
+          { kind: "path", path: path38.join(gitControlRoot, "logs") },
           params.segment,
           [...signals, "git_history_destructive", "git.reflog.mutate"]
         )
@@ -12630,7 +13091,7 @@ function decodeGitEffects(params) {
         gitRequirement(
           "fs.read",
           "fs.read",
-          { kind: "path", path: path36.resolve(workTreeRoot, operand) },
+          { kind: "path", path: path38.resolve(workTreeRoot, operand) },
           params.segment,
           [...signals, "git.path.read"]
         )
@@ -12665,7 +13126,7 @@ function decodeGitEffects(params) {
         gitRequirement(
           "fs.write",
           "fs.write",
-          { kind: "path", path: path36.resolve(workTreeRoot, operand) },
+          { kind: "path", path: path38.resolve(workTreeRoot, operand) },
           params.segment,
           [...signals, "git.path.write"]
         )
@@ -12850,7 +13311,7 @@ function gitRequirement(tag, action, resource, segment, signals) {
 
 // src/core/verdict/launcher-resolve.ts
 import { existsSync as existsSync11, readFileSync as readFileSync5 } from "node:fs";
-import path37 from "node:path";
+import path39 from "node:path";
 
 // src/core/verdict/makefile-expand.ts
 var MAX_EXPAND_DEPTH = 16;
@@ -12869,22 +13330,6 @@ function parseMakefileVariables(content) {
   }
   return variables;
 }
-function parsePhonyTargets(content) {
-  const phony = /* @__PURE__ */ new Set();
-  for (const line of content.split("\n")) {
-    const trimmed = line.trim();
-    const match = /^\.PHONY:\s*(.+)$/.exec(trimmed);
-    if (!match) {
-      continue;
-    }
-    for (const token of (match[1] ?? "").split(/\s+/)) {
-      if (token) {
-        phony.add(token);
-      }
-    }
-  }
-  return phony;
-}
 function normalizeMakeRecipeLine(line) {
   let normalized = line.trim();
   while (normalized.startsWith("@") || normalized.startsWith("-") || normalized.startsWith("+")) {
@@ -13039,7 +13484,7 @@ var PNPM_BUILTIN_COMMANDS = /* @__PURE__ */ new Set([
   "why"
 ]);
 function readPackageJson(dir) {
-  const packagePath = path37.join(dir, "package.json");
+  const packagePath = path39.join(dir, "package.json");
   if (!existsSync11(packagePath)) {
     return null;
   }
@@ -13050,17 +13495,17 @@ function readPackageJson(dir) {
   }
 }
 function findPackageJson(startDir, stopDir) {
-  let current = path37.resolve(startDir);
-  const stop = path37.resolve(stopDir);
+  let current = path39.resolve(startDir);
+  const stop = path39.resolve(stopDir);
   while (true) {
-    const packagePath = path37.join(current, "package.json");
+    const packagePath = path39.join(current, "package.json");
     if (existsSync11(packagePath)) {
       return packagePath;
     }
-    if (current === stop || current === path37.dirname(current)) {
+    if (current === stop || current === path39.dirname(current)) {
       return existsSync11(packagePath) ? packagePath : null;
     }
-    const parent = path37.dirname(current);
+    const parent = path39.dirname(current);
     if (!parent.startsWith(stop) && parent !== current) {
     }
     if (parent === current) {
@@ -13117,7 +13562,7 @@ function resolveNpmRecipe(cwd, repoRoot, scriptName, extraArgs) {
     }
     return { recipes: [], opaque: true, reason: "package_json_missing" };
   }
-  const pkg = readPackageJson(path37.dirname(packagePath));
+  const pkg = readPackageJson(path39.dirname(packagePath));
   const scripts = pkg?.scripts;
   if (!scripts || typeof scripts !== "object") {
     return { recipes: [], opaque: true, reason: "package_scripts_missing" };
@@ -13208,27 +13653,26 @@ function parseMakefileRecipeContent(content) {
 function resolveMakeRecipe(cwd, repoRoot, target, cliVars = {}) {
   const candidates = ["Makefile", "makefile", "GNUmakefile"];
   let makefilePath = null;
-  let searchDir = path37.resolve(cwd);
-  const stop = path37.resolve(repoRoot);
+  let searchDir = path39.resolve(cwd);
+  const stop = path39.resolve(repoRoot);
   while (true) {
     for (const name of candidates) {
-      const candidate = path37.join(searchDir, name);
+      const candidate = path39.join(searchDir, name);
       if (existsSync11(candidate)) {
         makefilePath = candidate;
         break;
       }
     }
-    if (makefilePath || searchDir === stop || searchDir === path37.dirname(searchDir)) {
+    if (makefilePath || searchDir === stop || searchDir === path39.dirname(searchDir)) {
       break;
     }
-    searchDir = path37.dirname(searchDir);
+    searchDir = path39.dirname(searchDir);
   }
   if (!makefilePath) {
     return { recipes: [], opaque: true, reason: "unknown_local_effect" };
   }
   const makefileContent = readFileSync5(makefilePath, "utf8");
   const makefileVars = parseMakefileVariables(makefileContent);
-  const phonyTargets = parsePhonyTargets(makefileContent);
   const targets = parseMakefileRecipeContent(makefileContent);
   if (!targets.has(target)) {
     return { recipes: [], opaque: true, reason: "make_target_undefined" };
@@ -13236,36 +13680,34 @@ function resolveMakeRecipe(cwd, repoRoot, target, cliVars = {}) {
   const recipeLines = [];
   const visiting = /* @__PURE__ */ new Set();
   const visited = /* @__PURE__ */ new Set();
-  let opaquePrerequisites = false;
+  let hasDynamicPrerequisite = false;
+  let hasUndefinedPrerequisite = false;
+  let hasDependencyCycle = false;
   const collect = (name) => {
     if (visited.has(name)) {
-      return true;
+      return;
     }
     if (visiting.has(name)) {
-      return false;
+      hasDependencyCycle = true;
+      return;
     }
     const entry = targets.get(name);
     if (!entry) {
-      return true;
+      if (!existsSync11(path39.resolve(path39.dirname(makefilePath), name))) {
+        hasUndefinedPrerequisite = true;
+      }
+      return;
     }
     visiting.add(name);
-    opaquePrerequisites ||= entry.opaquePrerequisites;
+    hasDynamicPrerequisite ||= entry.opaquePrerequisites;
     for (const prerequisite of entry.prerequisites) {
-      if (targets.has(prerequisite) && !collect(prerequisite)) {
-        return false;
-      }
-    }
-    const skipPhonyPrerequisiteRecipes = name !== target && (phonyTargets.has(name) || name.startsWith("_")) && (targets.get(target)?.recipes.length ?? 0) > 0;
-    if (!skipPhonyPrerequisiteRecipes) {
-      recipeLines.push(...entry.recipes);
+      collect(prerequisite);
     }
+    recipeLines.push(...entry.recipes);
     visiting.delete(name);
     visited.add(name);
-    return true;
   };
-  if (!collect(target)) {
-    return { recipes: recipeLines, opaque: true, reason: "make_dependency_cycle" };
-  }
+  collect(target);
   const expandedRecipes = [];
   for (const line of recipeLines) {
     const normalized = normalizeMakeRecipeLine(line);
@@ -13280,18 +13722,24 @@ function resolveMakeRecipe(cwd, repoRoot, target, cliVars = {}) {
       return { recipes: expandedRecipes, opaque: true, reason: "make_recipe_dynamic" };
     }
   }
-  if (opaquePrerequisites) {
+  if (hasDependencyCycle) {
+    return { recipes: expandedRecipes, opaque: true, reason: "make_dependency_cycle" };
+  }
+  if (hasDynamicPrerequisite) {
     return { recipes: expandedRecipes, opaque: true, reason: "make_prerequisite_dynamic" };
   }
+  if (hasUndefinedPrerequisite) {
+    return { recipes: expandedRecipes, opaque: true, reason: "make_prerequisite_undefined" };
+  }
   return { recipes: expandedRecipes, opaque: false, reason: "make_recipe_resolved" };
 }
 function resolveLauncherRecipe(params) {
-  if (params.depth >= MAX_RESOLVE_DEPTH) {
-    return { recipes: [], opaque: true, reason: "launcher_depth_exceeded" };
-  }
   const tokens = params.tokens;
   const scriptName = npmScriptName(tokens);
   if (scriptName) {
+    if (params.depth >= MAX_RESOLVE_DEPTH) {
+      return { recipes: [], opaque: true, reason: "launcher_depth_exceeded" };
+    }
     const resolution = resolveNpmRecipe(
       params.cwd,
       params.repoRoot,
@@ -13308,6 +13756,9 @@ function resolveLauncherRecipe(params) {
     return resolution;
   }
   if (tokens[0] === "make") {
+    if (params.depth >= MAX_RESOLVE_DEPTH) {
+      return { recipes: [], opaque: true, reason: "launcher_depth_exceeded" };
+    }
     if (tokens.includes("-n") || tokens.includes("--dry-run")) {
       return null;
     }
@@ -13341,7 +13792,7 @@ function resolveLauncherRecipe(params) {
 }
 
 // src/core/verdict/parser.ts
-import path38 from "node:path";
+import path40 from "node:path";
 
 // src/core/shell-substitution.ts
 function findStructuralCommandSubstitutions(command) {
@@ -13566,9 +14017,8 @@ function hasUnbalancedDollarParen(command) {
 // src/core/verdict/parser.ts
 var ENV_PREFIX_PATTERN = /^[A-Za-z_][A-Za-z0-9_]*=(?:'[^']*'|"[^"]*"|\S+)$/;
 var MAX_WRAPPER_PEEL_DEPTH = 32;
-var SHELL_INTERPRETERS = /* @__PURE__ */ new Set(["bash", "sh", "zsh", "dash", "fish"]);
+var SHELL_INTERPRETERS2 = /* @__PURE__ */ new Set(["bash", "sh", "zsh", "dash", "fish"]);
 var CODE_INTERPRETERS = /* @__PURE__ */ new Set(["python", "python3", "node", "ruby", "perl", "osascript"]);
-var SCRIPT_FLAGS = /* @__PURE__ */ new Set(["-c", "-lc", "-e", "--eval"]);
 var INTERPRETER_SCRIPT_EXTENSIONS = /* @__PURE__ */ new Set([
   ".js",
   ".mjs",
@@ -13580,7 +14030,7 @@ var INTERPRETER_SCRIPT_EXTENSIONS = /* @__PURE__ */ new Set([
   ".sh"
 ]);
 function normalizeHead(token) {
-  const base = path38.basename(token);
+  const base = path40.basename(token);
   if (base && base !== "." && base !== "..") {
     return base;
   }
@@ -13592,10 +14042,6 @@ function peelTransparentWrappers(tokens) {
   let encounteredXargs = false;
   let peelDepth = 0;
   while (current.length > 0) {
-    if (peelDepth >= MAX_WRAPPER_PEEL_DEPTH) {
-      return { tokens: current, xargsStdinOpaque: false, encounteredXargs, opaque: true };
-    }
-    peelDepth += 1;
     while (current.length > 0 && ENV_PREFIX_PATTERN.test(current[0] ?? "")) {
       current.shift();
     }
@@ -13605,6 +14051,10 @@ function peelTransparentWrappers(tokens) {
     const head = normalizeHead(current[0] ?? "");
     if (head === "xargs") {
       encounteredXargs = true;
+      if (peelDepth >= MAX_WRAPPER_PEEL_DEPTH) {
+        return { tokens: current, xargsStdinOpaque: false, encounteredXargs, opaque: true };
+      }
+      peelDepth += 1;
       const wrapper2 = peelXargsWrapper(current);
       if (wrapper2.kind === "opaque") {
         xargsStdinOpaque = current.length === 1;
@@ -13622,6 +14072,10 @@ function peelTransparentWrappers(tokens) {
     if (!wrapper) {
       break;
     }
+    if (peelDepth >= MAX_WRAPPER_PEEL_DEPTH) {
+      return { tokens: current, xargsStdinOpaque: false, encounteredXargs, opaque: true };
+    }
+    peelDepth += 1;
     if (wrapper.kind === "opaque") {
       return { tokens: current, xargsStdinOpaque: false, encounteredXargs, opaque: true };
     }
@@ -13849,50 +14303,16 @@ function extractRecursiveScript(tokens) {
     const body = filtered.slice(1).join(" ").trim();
     return body || null;
   }
-  if (SHELL_INTERPRETERS.has(head) || CODE_INTERPRETERS.has(head)) {
-    const flagIndex = filtered.findIndex((token) => SCRIPT_FLAGS.has(token));
-    if (flagIndex !== -1) {
-      const body = filtered[flagIndex + 1] ?? "";
-      return body || null;
-    }
-  }
-  return null;
-}
-function extractDockerComposeRunScript(tokens) {
-  const head = normalizeHead(tokens[0] ?? "");
-  const usesCompose = head === "docker-compose" || head === "docker" && (tokens[1] ?? "") === "compose";
-  if (!usesCompose) {
-    return null;
-  }
-  if (!tokens.includes("run")) {
-    return null;
-  }
-  const runIndex = tokens.indexOf("run");
-  const tail = tokens.slice(runIndex + 1);
-  for (let index = 0; index < tail.length; index += 1) {
-    const shellHead = normalizeHead(tail[index] ?? "");
-    if (!SHELL_INTERPRETERS.has(shellHead)) {
-      continue;
-    }
-    const flag = tail[index + 1] ?? "";
-    if (flag !== "-lc" && flag !== "-c") {
-      continue;
-    }
-    const body = tail[index + 2] ?? "";
-    return body || null;
-  }
-  return null;
+  const invocation = decodeRecursiveInvocation(
+    shellTokensFromValues(filtered, { detectExpansion: false })
+  );
+  return invocation.kind === "static" ? invocation.script || null : null;
 }
-function isDynamicRecursiveEvaluation(tokens) {
-  const { tokens: filtered, opaque } = peelTransparentWrappers(tokens);
-  if (opaque) {
-    return false;
-  }
-  const head = normalizeHead(filtered[0] ?? "");
-  if (head === "eval") {
-    return true;
-  }
-  return (SHELL_INTERPRETERS.has(head) || CODE_INTERPRETERS.has(head)) && filtered.some((token) => SCRIPT_FLAGS.has(token));
+function decodeRecursiveInvocationTokens(tokens) {
+  const values = tokens.map((token) => token.value);
+  const { tokens: filtered, opaque } = peelTransparentWrappers(values);
+  if (opaque) return { kind: "none" };
+  return decodeRecursiveInvocation(tokens.slice(values.length - filtered.length));
 }
 function isCommandInspection(tokens) {
   return normalizeHead(tokens[0] ?? "") === "command" && peelCommandWrapper(tokens).kind === "preserve";
@@ -13906,11 +14326,10 @@ function isBareInterpreter(tokens) {
     return false;
   }
   const head = normalizeHead(peeled[0] ?? "");
-  if (!SHELL_INTERPRETERS.has(head) && !CODE_INTERPRETERS.has(head)) {
+  if (!SHELL_INTERPRETERS2.has(head) && !CODE_INTERPRETERS.has(head)) {
     return false;
   }
-  const hasScriptFlag = peeled.some((token) => SCRIPT_FLAGS.has(token));
-  if (hasScriptFlag) {
+  if (decodeRecursiveInvocation(shellTokensFromValues(peeled)).kind !== "none") {
     return false;
   }
   const args = peeled.slice(1);
@@ -13921,7 +14340,7 @@ function isBareInterpreter(tokens) {
     return false;
   }
   const scriptArg = args.find((token) => !token.startsWith("-"));
-  if (scriptArg && INTERPRETER_SCRIPT_EXTENSIONS.has(path38.extname(scriptArg))) {
+  if (scriptArg && INTERPRETER_SCRIPT_EXTENSIONS.has(path40.extname(scriptArg))) {
     return false;
   }
   if (scriptArg) {
@@ -14213,11 +14632,11 @@ function lowerTopLevelSegments(command, context) {
 }
 function startsLocalPostgresService(command) {
   const tokens = tokenizeShell(command);
-  return path39.basename(tokens[0] ?? "") === "docker" && tokens[1] === "compose" && ["up", "start", "restart"].includes(tokens[2] ?? "") && tokens.includes("postgres");
+  return path41.basename(tokens[0] ?? "") === "docker" && tokens[1] === "compose" && ["up", "start", "restart"].includes(tokens[2] ?? "") && tokens.includes("postgres");
 }
 function resolveCdTransition(command, currentCwd) {
   const tokens = tokenizeShell(command);
-  if (path39.basename(tokens[0] ?? "") !== "cd") {
+  if (path41.basename(tokens[0] ?? "") !== "cd") {
     return null;
   }
   const target = tokens[1] ?? "~";
@@ -14238,7 +14657,8 @@ function joinNestedOpacity(outer, nested) {
 }
 function lowerSegment(command, context) {
   const commandRedacted = redactCommand(command);
-  const rawTokens = tokenizeShell(command);
+  const lexed = lexShell(command);
+  const rawTokens = lexed.tokens.map((token) => token.value);
   const environment = extractEnvironment(rawTokens, context.env);
   const env = environment.env;
   const parsed = parseSegment(command);
@@ -14246,10 +14666,23 @@ function lowerSegment(command, context) {
   const tokens = stripRedirects(
     parsedTokens.length === 0 && rawTokens.length > 0 && rawTokens.every((token) => ENV_PREFIX_PATTERN2.test(token)) ? rawTokens : parsedTokens
   ).map((token) => expandKnownVariables(token, env));
-  const head = path39.basename(tokens[0] ?? parsed.head);
+  const decoderTokens = alignStructuredTokens(
+    stripStructuredRedirects(lexed.tokens),
+    stripRedirects(parsedTokens)
+  );
+  const head = path41.basename(tokens[0] ?? parsed.head);
   let opacity = segmentOpacity(command);
   const signals = /* @__PURE__ */ new Set();
   const requirements = [];
+  if (!lexed.complete) {
+    requirements.push(
+      requirement2("indeterminate", "indeterminate", { kind: "unknown" }, commandRedacted, [
+        "shell.grammar_incomplete"
+      ])
+    );
+    signals.add("shell.grammar_incomplete");
+    opacity = joinEffectOpacity(opacity, "unparseable");
+  }
   addRedirectEffects(requirements, rawTokens, env, context, commandRedacted);
   addSubstitutionEffects(requirements, command, context, commandRedacted, signals);
   if (environment.malformed) {
@@ -14269,7 +14702,7 @@ function lowerSegment(command, context) {
     signals.add("shell.xargs_stdin_dynamic");
     opacity = joinEffectOpacity(opacity, "opaque");
   }
-  if (context.depth >= MAX_LOWER_DEPTH) {
+  if (context.depth > MAX_LOWER_DEPTH) {
     requirements.push(
       requirement2("indeterminate", "indeterminate", { kind: "unknown" }, commandRedacted, [
         "shell.lower_depth_exceeded"
@@ -14316,62 +14749,96 @@ function lowerSegment(command, context) {
     }
     return shellSegment(commandRedacted, head, requirements, opacity, signals);
   }
-  const recursiveScript = extractRecursiveScript(tokens);
-  if (recursiveScript && opacity !== "opaque" && opacity !== "unparseable") {
-    const dynamicEvaluation = isDynamicRecursiveEvaluation(tokens);
+  const recursive = decodeRecursiveInvocationTokens(decoderTokens);
+  if (recursive.kind === "static" && opacity !== "opaque" && opacity !== "unparseable") {
     requirements.push(
-      processRequirement(head || "sh", "spawn", commandRedacted, [
+      processRequirement(recursive.interpreter, "spawn", commandRedacted, [
         "shell.recursive_wrapper",
-        ...dynamicEvaluation ? ["dynamic_shell_evaluation"] : []
+        "dynamic_shell_evaluation"
       ])
     );
-    const nested = lowerTopLevelSegments(recursiveScript, {
-      ...context,
-      command: recursiveScript,
-      env,
-      depth: context.depth + 1
-    });
-    for (const nestedSegment of nested) {
-      requirements.push(
-        ...nestedSegment.requirements.map(
-          (entry) => withInnerProvenance(entry, recursiveScript, head, commandRedacted)
-        )
-      );
-      for (const signal of nestedSegment.signals) {
-        signals.add(signal);
+    if (recursive.script !== "") {
+      const nested = lowerTopLevelSegments(recursive.script, {
+        ...context,
+        command: recursive.script,
+        env,
+        depth: context.depth + 1
+      });
+      for (const nestedSegment of nested) {
+        requirements.push(
+          ...nestedSegment.requirements.map(
+            (entry) => withInnerProvenance(entry, recursive.script, head, commandRedacted)
+          )
+        );
+        for (const signal of nestedSegment.signals) signals.add(signal);
       }
     }
     signals.add("shell.recursive_wrapper");
-    if (dynamicEvaluation) {
-      signals.add("dynamic_shell_evaluation");
-    }
+    signals.add("dynamic_shell_evaluation");
     return shellSegment(commandRedacted, head, requirements, "recursive", signals);
   }
-  const dockerComposeScript = extractDockerComposeRunScript(tokens);
-  if (dockerComposeScript && opacity !== "opaque" && opacity !== "unparseable") {
+  if (recursive.kind === "dynamic" || recursive.kind === "indeterminate") {
+    const recursiveSignals = [
+      recursive.signal,
+      ...recursive.kind === "dynamic" ? ["dynamic_shell_evaluation"] : []
+    ];
+    requirements.push(
+      processRequirement(recursive.interpreter, "spawn", commandRedacted, recursiveSignals),
+      requirement2("indeterminate", "indeterminate", { kind: "unknown" }, commandRedacted, [
+        ...recursiveSignals
+      ])
+    );
+    for (const signal of recursiveSignals) signals.add(signal);
+    return shellSegment(
+      commandRedacted,
+      head,
+      requirements,
+      joinEffectOpacity(opacity, "opaque"),
+      signals
+    );
+  }
+  const compose = decodeDockerComposeRun(decoderTokens);
+  if (compose.kind === "recursive" && opacity !== "opaque" && opacity !== "unparseable") {
     requirements.push(
       processRequirement(head, "spawn", commandRedacted, ["process.docker_compose_run"])
     );
-    const nested = lowerTopLevelSegments(dockerComposeScript, {
-      ...context,
-      command: dockerComposeScript,
-      env,
-      depth: context.depth + 1
-    });
-    for (const nestedSegment of nested) {
-      requirements.push(
-        ...nestedSegment.requirements.map(
-          (entry) => withInnerProvenance(entry, dockerComposeScript, head, commandRedacted)
-        )
-      );
-      for (const signal of nestedSegment.signals) {
-        signals.add(signal);
+    if (compose.script !== "") {
+      const nested = lowerTopLevelSegments(compose.script, {
+        ...context,
+        command: compose.script,
+        env,
+        depth: context.depth + 1
+      });
+      for (const nestedSegment of nested) {
+        requirements.push(
+          ...nestedSegment.requirements.map(
+            (entry) => withInnerProvenance(entry, compose.script, head, commandRedacted)
+          )
+        );
+        for (const signal of nestedSegment.signals) signals.add(signal);
+        opacity = joinNestedOpacity(opacity, nestedSegment);
       }
-      opacity = joinNestedOpacity(opacity, nestedSegment);
     }
     signals.add("process.docker_compose_run");
     return shellSegment(commandRedacted, head, requirements, "recursive", signals);
   }
+  if (compose.kind === "dynamic" || compose.kind === "indeterminate") {
+    requirements.push(
+      processRequirement(head, "spawn", commandRedacted, ["process.docker_compose_run"]),
+      requirement2("indeterminate", "indeterminate", { kind: "unknown" }, commandRedacted, [
+        compose.signal
+      ])
+    );
+    signals.add("process.docker_compose_run");
+    signals.add(compose.signal);
+    return shellSegment(
+      commandRedacted,
+      head,
+      requirements,
+      joinEffectOpacity(opacity, "opaque"),
+      signals
+    );
+  }
   const launcher = resolveLauncherRecipe({
     tokens,
     cwd: context.cwd,
@@ -14583,7 +15050,7 @@ function isMetadataOnlyArgv(argv) {
   return argv.length > 0 && argv.every((token) => METADATA_ONLY_FLAGS.has(token));
 }
 function executableBaseName(head) {
-  return path39.basename(head);
+  return path41.basename(head);
 }
 var RAILS_READ_ONLY_SUBCOMMANDS = /* @__PURE__ */ new Set(["routes", "middleware", "stats", "about", "version"]);
 function railsReadOnlySubcommand(args) {
@@ -14594,7 +15061,7 @@ function railsReadOnlySubcommand(args) {
   return RAILS_READ_ONLY_SUBCOMMANDS.has(subcommand);
 }
 function isRubyTestScript(scriptPath) {
-  const base = path39.basename(scriptPath);
+  const base = path41.basename(scriptPath);
   return base.endsWith("_test.rb") || base.endsWith("_spec.rb");
 }
 function parseRubyTestInvocation(args) {
@@ -14779,7 +15246,7 @@ function decodeShellControlBuiltin(head, args) {
   }
   return null;
 }
-function decodeDockerComposeRun(head, args, segment) {
+function decodeDockerComposeRun2(head, args, segment) {
   let composeArgs = null;
   let command = head;
   if (head === "docker-compose") {
@@ -14873,7 +15340,7 @@ function decodeProcessOrFilesystem(params) {
         requirement2(
           "fs.read",
           "fs.read",
-          { kind: "path", path: path39.resolve(cwd, syntax) },
+          { kind: "path", path: path41.resolve(cwd, syntax) },
           segment,
           ["shell.syntax_source_read"]
         )
@@ -14897,7 +15364,7 @@ function decodeProcessOrFilesystem(params) {
       return decoded;
     }
   }
-  const dockerCompose = decodeDockerComposeRun(head, args, segment);
+  const dockerCompose = decodeDockerComposeRun2(head, args, segment);
   if (dockerCompose) {
     return dockerCompose;
   }
@@ -14923,7 +15390,7 @@ function decodeProcessOrFilesystem(params) {
     return [processRequirement(head, "inspect", segment, ["process.inspect.base64_stdin"])];
   }
   if (head === "node") {
-    return decodeNode(args, cwd, segment);
+    return decodeNode2(args, cwd, segment);
   }
   if (head === "vite" || head === "vite-node") {
     return [processRequirement(head, "spawn", segment, ["process.local_dev_spawn"])];
@@ -15013,7 +15480,7 @@ function decodeBelay(args, repoRoot, segment) {
       requirement2(
         "control_plane.write",
         "control_plane.write",
-        { kind: "path", path: path39.join(repoRoot, ".belay-control-plane") },
+        { kind: "path", path: path41.join(repoRoot, ".belay-control-plane") },
         segment,
         ["belay.config_non_judge_mutation"]
       )
@@ -15175,11 +15642,11 @@ function decodeRm(args, cwd, repoRoot, segment) {
 function canonicalRmOperand(targetPath, finalOperandIsSymlink) {
   try {
     if (finalOperandIsSymlink) {
-      return path39.join(realpathSync4.native(path39.dirname(targetPath)), path39.basename(targetPath));
+      return path41.join(realpathSync4.native(path41.dirname(targetPath)), path41.basename(targetPath));
     }
     return realpathSync4.native(targetPath);
   } catch {
-    return path39.resolve(targetPath);
+    return path41.resolve(targetPath);
   }
 }
 function isSymbolicLink(targetPath) {
@@ -15190,8 +15657,8 @@ function isSymbolicLink(targetPath) {
   }
 }
 function pathContains(ancestor, candidate) {
-  const relative = path39.relative(path39.resolve(ancestor), path39.resolve(candidate));
-  return relative === "" || !relative.startsWith("..") && !path39.isAbsolute(relative);
+  const relative = path41.relative(path41.resolve(ancestor), path41.resolve(candidate));
+  return relative === "" || !relative.startsWith("..") && !path41.isAbsolute(relative);
 }
 function decodeGo(args, segment) {
   if (["test", "list", "vet"].includes(args[0] ?? "")) {
@@ -15337,7 +15804,7 @@ function decodeSed(args, cwd, segment) {
   }
   return lowered;
 }
-function decodeNode(args, cwd, segment) {
+function decodeNode2(args, cwd, segment) {
   if (args.length > 0 && args.every((arg) => ["--help", "--version", "-h", "-v"].includes(arg))) {
     return [processRequirement("node", "inspect", segment, ["process.inspect.node_metadata"])];
   }
@@ -15603,15 +16070,36 @@ function stripRedirects(tokens) {
       stripped.push(token);
       continue;
     }
-    if (token.includes(">") || token.includes("<")) {
-      const inline = token.replace(/^\d*(?:>>?|<<?|<>|>\|)/, "");
-      if (!inline) {
-        index += 1;
-      }
+    index += 1;
+  }
+  return stripped;
+}
+function stripStructuredRedirects(tokens) {
+  const stripped = [];
+  for (let index = 0; index < tokens.length; index += 1) {
+    const token = tokens[index];
+    if (!token) continue;
+    if (isFdDuplication(token.value)) {
+      continue;
+    }
+    if (!isRedirectOperator(token.value)) {
+      stripped.push(token);
+      continue;
     }
+    index += 1;
   }
   return stripped;
 }
+function alignStructuredTokens(tokens, values) {
+  if (values.length === 0) return [];
+  for (let start = tokens.length - values.length; start >= 0; start -= 1) {
+    const candidate = tokens.slice(start);
+    if (candidate.length === values.length && candidate.every((token, index) => token.value === values[index])) {
+      return candidate;
+    }
+  }
+  return [];
+}
 function shellSegment(commandRedacted, segmentHead, requirements, opacity, signals) {
   const normalizedRequirements = requirements.flatMap((entry) => {
     const dynamicSignal = dynamicResourceSignal(entry.resource);
@@ -16011,9 +16499,9 @@ function resolvePathOperand(operand, cwd) {
     return process.env.HOME ?? operand;
   }
   if (operand.startsWith("~/")) {
-    return path39.join(process.env.HOME ?? "~", operand.slice(2));
+    return path41.join(process.env.HOME ?? "~", operand.slice(2));
   }
-  return path39.resolve(cwd, operand);
+  return path41.resolve(cwd, operand);
 }
 function isShellHead(head) {
   return head === "bash" || head === "sh" || head === "zsh" || head === "dash" || head === "fish";
@@ -16537,7 +17025,7 @@ async function classifyToolUse(payload, repoRoot, cwd, config, options = {}) {
       };
     }
     const signals = [];
-    const resolvedPath = path40.isAbsolute(filePath) ? filePath : path40.resolve(cwd, filePath);
+    const resolvedPath = path42.isAbsolute(filePath) ? filePath : path42.resolve(cwd, filePath);
     const hitsProtectedRoot = protectedRoots.some((root) => pathWithinRoot(root, resolvedPath));
     if (hitsProtectedRoot) {
       signals.push("control_plane_path");
@@ -17139,7 +17627,7 @@ function hashDecisionConfig(config) {
 init_fingerprint2();
 
 // src/version.ts
-var PACKAGE_VERSION = "0.9.2";
+var PACKAGE_VERSION = "0.9.3";
 
 // src/runtime-provenance.ts
 function resolveRuntimeArtifactHash(artifactHash) {
@@ -17214,7 +17702,7 @@ init_path_utils();
 import { randomUUID as randomUUID5 } from "node:crypto";
 import { existsSync as existsSync15 } from "node:fs";
 import { mkdir as mkdir11, readdir as readdir3, readFile as readFile12, rename as rename3, rm as rm6 } from "node:fs/promises";
-import path45 from "node:path";
+import path47 from "node:path";
 
 // src/core/recovery/artifact-store.ts
 init_fingerprint2();
@@ -17222,7 +17710,7 @@ init_path_utils();
 import { randomUUID as randomUUID4 } from "node:crypto";
 import { existsSync as existsSync13 } from "node:fs";
 import { lstat as lstat7, mkdir as mkdir10, open as open5, readdir as readdir2, readFile as readFile9, rename as rename2, rm as rm5, writeFile as writeFile7 } from "node:fs/promises";
-import path42 from "node:path";
+import path44 from "node:path";
 
 // src/core/recovery/snapshot-node.ts
 init_fingerprint2();
@@ -17242,25 +17730,25 @@ import {
   symlink as symlink3,
   writeFile as writeFile6
 } from "node:fs/promises";
-import path41 from "node:path";
+import path43 from "node:path";
 var RECOVERY_UNSUPPORTED_FILE_KIND = "recovery_unsupported_file_kind";
 function validRecoveryRelativePath(relativePath) {
-  if (!relativePath || relativePath.includes("\0") || path41.isAbsolute(relativePath)) return false;
-  const normalized = path41.normalize(relativePath);
-  return normalized !== "." && normalized !== ".." && !normalized.startsWith(`..${path41.sep}`);
+  if (!relativePath || relativePath.includes("\0") || path43.isAbsolute(relativePath)) return false;
+  const normalized = path43.normalize(relativePath);
+  return normalized !== "." && normalized !== ".." && !normalized.startsWith(`..${path43.sep}`);
 }
 async function assertRecoverySafeTarget(resourceRoot, relativePath) {
   if (!validRecoveryRelativePath(relativePath)) throw new Error("recovery_path_escape");
   const root = canonicalPath(resourceRoot);
-  const target = path41.resolve(root, relativePath);
-  const relative = path41.relative(root, target);
-  if (relative === ".." || relative.startsWith(`..${path41.sep}`) || path41.isAbsolute(relative)) {
+  const target = path43.resolve(root, relativePath);
+  const relative = path43.relative(root, target);
+  if (relative === ".." || relative.startsWith(`..${path43.sep}`) || path43.isAbsolute(relative)) {
     throw new Error("recovery_path_escape");
   }
   let current = root;
-  const parentParts = path41.relative(root, path41.dirname(target)).split(path41.sep).filter(Boolean);
+  const parentParts = path43.relative(root, path43.dirname(target)).split(path43.sep).filter(Boolean);
   for (const part of parentParts) {
-    current = path41.join(current, part);
+    current = path43.join(current, part);
     if (!existsSync12(current)) break;
     const info = await lstat6(current);
     if (info.isSymbolicLink()) throw new Error("recovery_symlink_escape");
@@ -17316,7 +17804,7 @@ async function captureRecoverySnapshot(filePath, options) {
   let blob;
   if (options?.blobDir) {
     await mkdir9(options.blobDir, { recursive: true, mode: 448 });
-    const blobPath = path41.join(options.blobDir, hash);
+    const blobPath = path43.join(options.blobDir, hash);
     if (!existsSync12(blobPath)) {
       await writeFile6(blobPath, content, { mode: 384 });
       await fsyncPath(blobPath);
@@ -17371,7 +17859,7 @@ async function validateRecoverySnapshot(params) {
   if (record.blob !== `blobs/${record.hash}`) throw new Error(params.corruptReason);
   let content;
   try {
-    content = await readFile8(path41.join(params.artifactDir, record.blob));
+    content = await readFile8(path43.join(params.artifactDir, record.blob));
   } catch {
     throw new Error(params.corruptReason);
   }
@@ -17399,13 +17887,13 @@ var RECOVERY_STATES = /* @__PURE__ */ new Set([
 ]);
 var STAGING_STALE_MS = 5 * 6e4;
 function checkpointsRoot(stateDir) {
-  return path42.join(stateDir, "recovery", "checkpoints");
+  return path44.join(stateDir, "recovery", "checkpoints");
 }
 function checkpointDir(stateDir, checkpointId) {
   if (!/^cp_[a-f0-9]{24}$/.test(checkpointId)) {
     throw new Error("invalid_recovery_checkpoint_id");
   }
-  return path42.join(checkpointsRoot(stateDir), checkpointId);
+  return path44.join(checkpointsRoot(stateDir), checkpointId);
 }
 async function fsyncPath2(filePath) {
   const handle = await open5(filePath, "r");
@@ -17416,13 +17904,13 @@ async function fsyncPath2(filePath) {
   }
 }
 async function atomicWriteJson(filePath, value) {
-  await mkdir10(path42.dirname(filePath), { recursive: true, mode: 448 });
+  await mkdir10(path44.dirname(filePath), { recursive: true, mode: 448 });
   const temporary = `${filePath}.tmp-${randomUUID4()}`;
   await writeFile7(temporary, `${JSON.stringify(value, null, 2)}
 `, { mode: 384 });
   await fsyncPath2(temporary);
   await rename2(temporary, filePath);
-  await fsyncPath2(path42.dirname(filePath));
+  await fsyncPath2(path44.dirname(filePath));
 }
 async function writeRecoveryState(artifactDir, state, manifestHash, detail) {
   const value = {
@@ -17432,13 +17920,13 @@ async function writeRecoveryState(artifactDir, state, manifestHash, detail) {
     manifestHash,
     ...detail ? { detail } : {}
   };
-  await atomicWriteJson(path42.join(artifactDir, "state.json"), value);
+  await atomicWriteJson(path44.join(artifactDir, "state.json"), value);
 }
 async function directorySize(root) {
   if (!existsSync13(root)) return 0;
   let total = 0;
   for (const entry of await readdir2(root, { withFileTypes: true })) {
-    const entryPath = path42.join(root, entry.name);
+    const entryPath = path44.join(root, entry.name);
     if (entry.isDirectory()) total += await directorySize(entryPath);
     else total += (await lstat7(entryPath)).size;
   }
@@ -17483,9 +17971,9 @@ async function readRecoveryArtifact(stateDir, checkpointId) {
   let rawManifest;
   let state;
   try {
-    rawManifest = JSON.parse(await readFile9(path42.join(artifactDir, "manifest.json"), "utf8"));
+    rawManifest = JSON.parse(await readFile9(path44.join(artifactDir, "manifest.json"), "utf8"));
     state = JSON.parse(
-      await readFile9(path42.join(artifactDir, "state.json"), "utf8")
+      await readFile9(path44.join(artifactDir, "state.json"), "utf8")
     );
   } catch {
     throw new Error(RECOVERY_CHECKPOINT_CORRUPT);
@@ -17501,10 +17989,10 @@ async function readRecoveryArtifact(stateDir, checkpointId) {
   }
   const entryPaths = /* @__PURE__ */ new Set();
   for (const entry of manifest.entries) {
-    if (!entry || typeof entry !== "object" || Array.isArray(entry) || Object.keys(entry).length !== 3 || !Object.keys(entry).every((key) => ["path", "before", "after"].includes(key)) || typeof entry.path !== "string" || !("before" in entry) || !("after" in entry) || !validRecoveryRelativePath(entry.path) || entryPaths.has(path42.normalize(entry.path))) {
+    if (!entry || typeof entry !== "object" || Array.isArray(entry) || Object.keys(entry).length !== 3 || !Object.keys(entry).every((key) => ["path", "before", "after"].includes(key)) || typeof entry.path !== "string" || !("before" in entry) || !("after" in entry) || !validRecoveryRelativePath(entry.path) || entryPaths.has(path44.normalize(entry.path))) {
       throw new Error(RECOVERY_CHECKPOINT_CORRUPT);
     }
-    entryPaths.add(path42.normalize(entry.path));
+    entryPaths.add(path44.normalize(entry.path));
     for (const [side, snapshot] of [
       ["before", entry.before],
       ["after", entry.after]
@@ -17518,7 +18006,7 @@ async function readRecoveryArtifact(stateDir, checkpointId) {
       });
     }
   }
-  const receiptPath = path42.join(artifactDir, "receipt.json");
+  const receiptPath = path44.join(artifactDir, "receipt.json");
   let receipt;
   if (["applied", "restoring", "restored", "conflict"].includes(state.state) || existsSync13(receiptPath)) {
     receipt = await readAndValidateRecoveryReceipt(artifactDir, manifest, manifestHash);
@@ -17528,7 +18016,7 @@ async function readRecoveryArtifact(stateDir, checkpointId) {
 async function readAndValidateRecoveryReceipt(artifactDir, manifest, manifestHash) {
   let rawReceipt;
   try {
-    rawReceipt = JSON.parse(await readFile9(path42.join(artifactDir, "receipt.json"), "utf8"));
+    rawReceipt = JSON.parse(await readFile9(path44.join(artifactDir, "receipt.json"), "utf8"));
   } catch {
     throw new Error(RECOVERY_CHECKPOINT_CORRUPT);
   }
@@ -17551,7 +18039,7 @@ async function readAndValidateRecoveryReceipt(artifactDir, manifest, manifestHas
   return receipt;
 }
 async function ensureRecoveryReceipt(artifactDir, manifest, manifestHash) {
-  const receiptPath = path42.join(artifactDir, "receipt.json");
+  const receiptPath = path44.join(artifactDir, "receipt.json");
   if (existsSync13(receiptPath)) {
     return readAndValidateRecoveryReceipt(artifactDir, manifest, manifestHash);
   }
@@ -17576,7 +18064,7 @@ async function artifactRepoRoot(stateDir, checkpointId) {
   const artifactDir = checkpointDir(stateDir, checkpointId);
   try {
     const manifest = JSON.parse(
-      await readFile9(path42.join(artifactDir, "manifest.json"), "utf8")
+      await readFile9(path44.join(artifactDir, "manifest.json"), "utf8")
     );
     if (typeof manifest.repoRoot === "string" && manifest.repoRoot) {
       return canonicalPath(manifest.repoRoot);
@@ -17584,7 +18072,7 @@ async function artifactRepoRoot(stateDir, checkpointId) {
   } catch {
   }
   try {
-    const owner = JSON.parse(await readFile9(path42.join(artifactDir, "owner.json"), "utf8"));
+    const owner = JSON.parse(await readFile9(path44.join(artifactDir, "owner.json"), "utf8"));
     return typeof owner.repoRoot === "string" && owner.repoRoot ? canonicalPath(owner.repoRoot) : null;
   } catch {
     return null;
@@ -17604,10 +18092,10 @@ async function cleanupOrphanedStaging(stateDir) {
   const now = Date.now();
   for (const entry of await readdir2(root, { withFileTypes: true })) {
     if (!entry.isDirectory() || !/^\.tmp-cp_[a-f0-9]{24}$/.test(entry.name)) continue;
-    const stagingPath = path42.join(root, entry.name);
+    const stagingPath = path44.join(root, entry.name);
     let stale = false;
     try {
-      const owner = JSON.parse(await readFile9(path42.join(stagingPath, "owner.json"), "utf8"));
+      const owner = JSON.parse(await readFile9(path44.join(stagingPath, "owner.json"), "utf8"));
       const pid = typeof owner.pid === "number" ? owner.pid : Number.NaN;
       const createdAt = typeof owner.createdAt === "string" ? Date.parse(owner.createdAt) : NaN;
       let alive = false;
@@ -17649,7 +18137,7 @@ async function markRecoveryCheckpointApplied(stateDir, checkpoint) {
 init_fingerprint2();
 import { existsSync as existsSync14 } from "node:fs";
 import { readFile as readFile10 } from "node:fs/promises";
-import path43 from "node:path";
+import path45 from "node:path";
 async function matchRecoverySide(resourceRoot, entries, side) {
   for (const entry of entries) {
     const target = await assertRecoverySafeTarget(resourceRoot, entry.path);
@@ -17664,7 +18152,7 @@ async function reconcileRecoveryCheckpoint(stateDir, checkpointId) {
   } catch {
     const artifactDir = checkpointDir(stateDir, checkpointId);
     if (existsSync14(artifactDir)) {
-      const manifestPath = path43.join(artifactDir, "manifest.json");
+      const manifestPath = path45.join(artifactDir, "manifest.json");
       const hash = existsSync14(manifestPath) ? hashValue(await readFile10(manifestPath, "utf8")) : "unavailable";
       await writeRecoveryState(artifactDir, "corrupt", hash, RECOVERY_CHECKPOINT_CORRUPT);
     }
@@ -17701,7 +18189,7 @@ async function reconcileRecoveryCheckpoint(stateDir, checkpointId) {
 // src/core/recovery/resource-identity.ts
 init_fingerprint2();
 import { lstat as lstat8, readFile as readFile11, realpath as realpath3 } from "node:fs/promises";
-import path44 from "node:path";
+import path46 from "node:path";
 async function currentRecoveryResourceIdentity(resourceRoot, resourceKind) {
   const resolvedRoot = await realpath3(resourceRoot);
   if (resourceKind === "directory") {
@@ -17709,13 +18197,13 @@ async function currentRecoveryResourceIdentity(resourceRoot, resourceKind) {
     if (!rootInfo.isDirectory()) throw new Error("recovery_repo_identity_unavailable");
     return hashValue(`${resolvedRoot}\0${rootInfo.dev}:${rootInfo.ino}:${rootInfo.birthtimeMs}`);
   }
-  const dotGit = path44.join(resolvedRoot, ".git");
+  const dotGit = path46.join(resolvedRoot, ".git");
   const gitInfo = await lstat8(dotGit);
   let gitMetadataPath = dotGit;
   if (gitInfo.isFile()) {
     const marker = (await readFile11(dotGit, "utf8")).trim();
     if (!marker.startsWith("gitdir:")) throw new Error("recovery_repo_identity_unavailable");
-    gitMetadataPath = path44.resolve(resolvedRoot, marker.slice("gitdir:".length).trim());
+    gitMetadataPath = path46.resolve(resolvedRoot, marker.slice("gitdir:".length).trim());
   } else if (!gitInfo.isDirectory()) {
     throw new Error("recovery_repo_identity_unavailable");
   }
@@ -17788,16 +18276,16 @@ async function prepareRecoveryCheckpoint(params) {
     throw new Error(RECOVERY_CHECKPOINT_QUOTA);
   }
   const checkpointId = `cp_${randomUUID5().replaceAll("-", "").slice(0, 24)}`;
-  const temporary = path45.join(checkpointsRoot(params.stateDir), `.tmp-${checkpointId}`);
+  const temporary = path47.join(checkpointsRoot(params.stateDir), `.tmp-${checkpointId}`);
   const finalDir = checkpointDir(params.stateDir, checkpointId);
   await mkdir11(temporary, { recursive: true, mode: 448 });
-  await atomicWriteJson(path45.join(temporary, "owner.json"), {
+  await atomicWriteJson(path47.join(temporary, "owner.json"), {
     version: 1,
     pid: process.pid,
     createdAt: (/* @__PURE__ */ new Date()).toISOString(),
     repoRoot: canonicalPath(params.repoRoot)
   });
-  await mkdir11(path45.join(temporary, "blobs"), { recursive: true, mode: 448 });
+  await mkdir11(path47.join(temporary, "blobs"), { recursive: true, mode: 448 });
   try {
     const entries = [];
     const protectedRoots = (params.protectedRoots ?? []).map(canonicalPath);
@@ -17806,8 +18294,8 @@ async function prepareRecoveryCheckpoint(params) {
     )) {
       const target = await assertRecoverySafeTarget(params.repoRoot, change.relativePath);
       if (protectedRoots.some((root) => {
-        const relative = path45.relative(root, target);
-        return relative === "" || relative !== ".." && !relative.startsWith(`..${path45.sep}`) && !path45.isAbsolute(relative);
+        const relative = path47.relative(root, target);
+        return relative === "" || relative !== ".." && !relative.startsWith(`..${path47.sep}`) && !path47.isAbsolute(relative);
       })) {
         throw new Error("recovery_protected_path");
       }
@@ -17819,7 +18307,7 @@ async function prepareRecoveryCheckpoint(params) {
       entries.push({
         path: change.relativePath,
         before: await captureRecoverySnapshot(baseline, {
-          blobDir: path45.join(temporary, "blobs")
+          blobDir: path47.join(temporary, "blobs")
         }),
         after: withoutRecoveryBlob(await captureRecoverySnapshot(source))
       });
@@ -17856,7 +18344,7 @@ async function prepareRecoveryCheckpoint(params) {
       entries
     };
     const manifestHash = hashValue(canonicalStringify(manifest));
-    await atomicWriteJson(path45.join(temporary, "manifest.json"), manifest);
+    await atomicWriteJson(path47.join(temporary, "manifest.json"), manifest);
     await writeRecoveryState(temporary, "prepared", manifestHash);
     await fsyncPath2(temporary);
     const projectedBytes = await recoveryCheckpointStorageBytes(params.stateDir, params.repoRoot);
@@ -17899,7 +18387,7 @@ async function listRecoveryCheckpoints(stateDir, repoRoot) {
       } catch {
         try {
           const raw = JSON.parse(
-            await readFile12(path45.join(checkpointDir(stateDir, id), "manifest.json"), "utf8")
+            await readFile12(path47.join(checkpointDir(stateDir, id), "manifest.json"), "utf8")
           );
           rootFromArtifact = typeof raw.repoRoot === "string" && raw.repoRoot ? raw.repoRoot : void 0;
         } catch {
@@ -17933,7 +18421,7 @@ async function listRecoveryCheckpoints(stateDir, repoRoot) {
     } catch {
       try {
         const manifest = JSON.parse(
-          await readFile12(path45.join(checkpointDir(stateDir, id), "manifest.json"), "utf8")
+          await readFile12(path47.join(checkpointDir(stateDir, id), "manifest.json"), "utf8")
         );
         if (manifest.checkpointId !== id || ![1, 2].includes(manifest.version)) continue;
         if (repoRoot && canonicalPath(manifest.repoRoot) !== canonicalPath(repoRoot)) continue;
@@ -17963,7 +18451,7 @@ async function recoveryCheckpointStorageBytes(stateDir, repoRoot) {
   let total = 0;
   for (const entry of await readdir3(root, { withFileTypes: true })) {
     if (!entry.isDirectory()) continue;
-    const entryPath = path45.join(root, entry.name);
+    const entryPath = path47.join(root, entry.name);
     if (/^cp_[a-f0-9]{24}$/.test(entry.name)) {
       if (await artifactRepoRoot(stateDir, entry.name) === expected) {
         total += await directorySize(entryPath);
@@ -17972,7 +18460,7 @@ async function recoveryCheckpointStorageBytes(stateDir, repoRoot) {
     }
     if (/^\.tmp-cp_[a-f0-9]{24}$/.test(entry.name)) {
       try {
-        const owner = JSON.parse(await readFile12(path45.join(entryPath, "owner.json"), "utf8"));
+        const owner = JSON.parse(await readFile12(path47.join(entryPath, "owner.json"), "utf8"));
         if (typeof owner.repoRoot === "string" && canonicalPath(owner.repoRoot) === expected) {
           total += await directorySize(entryPath);
         }
@@ -18016,14 +18504,14 @@ init_scrub();
 // src/core/transactional/file-checkpoint-backend.ts
 import { cp, lstat as lstat11, mkdir as mkdir13, mkdtemp as mkdtemp5, readdir as readdir6, rm as rm9, writeFile as writeFile10 } from "node:fs/promises";
 import os5 from "node:os";
-import path49 from "node:path";
+import path51 from "node:path";
 
 // src/core/transactional/file-checkpoint-git.ts
 init_path_utils();
 import { spawn as spawn8 } from "node:child_process";
 import { createHash as createHash13 } from "node:crypto";
 import { copyFile as copyFile3, lstat as lstat9, readdir as readdir4, readFile as readFile13 } from "node:fs/promises";
-import path46 from "node:path";
+import path48 from "node:path";
 var FILE_CHECKPOINT_GIT_METADATA_CHANGED = "file_checkpoint_git_metadata_changed";
 var FILE_CHECKPOINT_SOURCE_CHANGED = "file_checkpoint_source_changed";
 var FILE_CHECKPOINT_CWD_OUTSIDE_ROOT = "file_checkpoint_cwd_outside_root";
@@ -18057,7 +18545,7 @@ function rethrowStableFileCheckpointError(error) {
 }
 async function rootGitMetadataPresent(repoRoot) {
   try {
-    await lstat9(path46.join(repoRoot, ".git"));
+    await lstat9(path48.join(repoRoot, ".git"));
     return true;
   } catch {
     return false;
@@ -18106,10 +18594,10 @@ function execGit2(repoRoot, args) {
 }
 async function resolveGitPath(repoRoot, gitPath) {
   const trimmed = gitPath.trim();
-  if (path46.isAbsolute(trimmed)) {
+  if (path48.isAbsolute(trimmed)) {
     return trimmed;
   }
-  return path46.join(repoRoot, trimmed);
+  return path48.join(repoRoot, trimmed);
 }
 async function cloneBareWorktreeCopy(sourceRoot, destinationRoot) {
   await execGit2(sourceRoot, [
@@ -18151,7 +18639,7 @@ async function copyGitIndexState(sourceRoot, destinationRoot) {
     destinationRoot,
     await execGit2(destinationRoot, ["rev-parse", "--git-dir"])
   );
-  const destinationShared = path46.join(destinationGitDir, path46.basename(sourceShared));
+  const destinationShared = path48.join(destinationGitDir, path48.basename(sourceShared));
   try {
     await copyFile3(sourceShared, destinationShared);
   } catch (error) {
@@ -18160,7 +18648,7 @@ async function copyGitIndexState(sourceRoot, destinationRoot) {
 }
 async function readGitFile(gitDir, relativePath) {
   try {
-    return await readFile13(path46.join(gitDir, relativePath));
+    return await readFile13(path48.join(gitDir, relativePath));
   } catch {
     return null;
   }
@@ -18184,8 +18672,8 @@ async function hashResolvedGitPath(repoRoot, gitDir, gitPath, hash) {
       repoRoot,
       await execGit2(repoRoot, ["rev-parse", "--git-path", gitPath])
     );
-    const relative = path46.resolve(resolved).startsWith(path46.resolve(gitDir)) ? path46.relative(gitDir, resolved) : resolved;
-    const content = typeof relative === "string" && !relative.startsWith("..") && !path46.isAbsolute(relative) ? await readGitFile(gitDir, relative) : await readAbsoluteGitFile(resolved);
+    const relative = path48.resolve(resolved).startsWith(path48.resolve(gitDir)) ? path48.relative(gitDir, resolved) : resolved;
+    const content = typeof relative === "string" && !relative.startsWith("..") && !path48.isAbsolute(relative) ? await readGitFile(gitDir, relative) : await readAbsoluteGitFile(resolved);
     if (content !== null) {
       hashGitFileContent(hash, gitPath, content);
     }
@@ -18195,13 +18683,13 @@ async function hashResolvedGitPath(repoRoot, gitDir, gitPath, hash) {
 async function hashGitTree(gitDir, relativeDir, hash) {
   let names;
   try {
-    names = await readdir4(path46.join(gitDir, relativeDir));
+    names = await readdir4(path48.join(gitDir, relativeDir));
   } catch {
     return;
   }
   for (const name of names.sort()) {
-    const relativePath = relativeDir ? path46.join(relativeDir, name) : name;
-    const absolutePath = path46.join(gitDir, relativePath);
+    const relativePath = relativeDir ? path48.join(relativeDir, name) : name;
+    const absolutePath = path48.join(gitDir, relativePath);
     let childNames = null;
     try {
       childNames = await readdir4(absolutePath);
@@ -18223,7 +18711,7 @@ async function hashGitTree(gitDir, relativeDir, hash) {
 }
 async function computeGitMetadataFingerprint(repoRoot) {
   const gitDirRel = (await execGit2(repoRoot, ["rev-parse", "--git-dir"])).trim();
-  const gitDir = path46.isAbsolute(gitDirRel) ? gitDirRel : path46.join(repoRoot, gitDirRel);
+  const gitDir = path48.isAbsolute(gitDirRel) ? gitDirRel : path48.join(repoRoot, gitDirRel);
   const hash = createHash13("sha256");
   for (const file of [
     "HEAD",
@@ -18246,8 +18734,8 @@ async function computeGitMetadataFingerprint(repoRoot) {
     const sharedIndex = (await execGit2(repoRoot, ["rev-parse", "--shared-index-path"])).trim();
     if (sharedIndex) {
       const resolved = await resolveGitPath(repoRoot, sharedIndex);
-      const relative = path46.relative(gitDir, resolved);
-      const content = relative && !relative.startsWith("..") && !path46.isAbsolute(relative) ? await readGitFile(gitDir, relative) : await readAbsoluteGitFile(resolved);
+      const relative = path48.relative(gitDir, resolved);
+      const content = relative && !relative.startsWith("..") && !path48.isAbsolute(relative) ? await readGitFile(gitDir, relative) : await readAbsoluteGitFile(resolved);
       if (content !== null) {
         hashGitFileContent(hash, "shared-index", content);
       }
@@ -18258,7 +18746,7 @@ async function computeGitMetadataFingerprint(repoRoot) {
     await hashResolvedGitPath(repoRoot, gitDir, gitPath, hash);
   }
   try {
-    const rootGitPath = path46.join(repoRoot, ".git");
+    const rootGitPath = path48.join(repoRoot, ".git");
     const rootGitInfo = await lstat9(rootGitPath);
     if (rootGitInfo.isFile()) {
       const content = await readAbsoluteGitFile(rootGitPath);
@@ -18274,14 +18762,14 @@ async function computeGitMetadataFingerprint(repoRoot) {
 function resolveExecutionCwdRelative(resourceRoot, cwd) {
   const resolvedCwd = canonicalPath(cwd);
   const resourceCanonical = canonicalPath(resourceRoot);
-  const relative = path46.relative(resourceCanonical, resolvedCwd);
+  const relative = path48.relative(resourceCanonical, resolvedCwd);
   if (relative === "" || relative === ".") {
     return "";
   }
-  if (relative.startsWith("..") || path46.isAbsolute(relative)) {
+  if (relative.startsWith("..") || path48.isAbsolute(relative)) {
     throw new Error(FILE_CHECKPOINT_CWD_OUTSIDE_ROOT);
   }
-  return relative.split(path46.sep).join("/");
+  return relative.split(path48.sep).join("/");
 }
 
 // src/core/transactional/file-checkpoint-isolation.ts
@@ -18303,7 +18791,7 @@ function fileCheckpointIsolationReason(context) {
 
 // src/core/transactional/file-checkpoint-staging.ts
 import { readdir as readdir5, readFile as readFile14, rm as rm7, writeFile as writeFile8 } from "node:fs/promises";
-import path47 from "node:path";
+import path49 from "node:path";
 function isOwnerProcessAlive(pid) {
   try {
     process.kill(pid, 0);
@@ -18313,12 +18801,12 @@ function isOwnerProcessAlive(pid) {
   }
 }
 async function writeOwnerMarker(stagingRoot, marker) {
-  await writeFile8(path47.join(stagingRoot, "owner.json"), `${JSON.stringify(marker)}
+  await writeFile8(path49.join(stagingRoot, "owner.json"), `${JSON.stringify(marker)}
 `, "utf8");
 }
 async function readOwnerMarker(stagingRoot) {
   try {
-    const raw = await readFile14(path47.join(stagingRoot, "owner.json"), "utf8");
+    const raw = await readFile14(path49.join(stagingRoot, "owner.json"), "utf8");
     return JSON.parse(raw.trim());
   } catch {
     return null;
@@ -18336,7 +18824,7 @@ async function collectDeadOwnerStaging(parentDir) {
     if (!name.startsWith("belay-file-checkpoint-")) {
       continue;
     }
-    const stagingRoot = path47.join(parentDir, name);
+    const stagingRoot = path49.join(parentDir, name);
     const marker = await readOwnerMarker(stagingRoot);
     if (!marker) {
       dead.push(stagingRoot);
@@ -18368,7 +18856,7 @@ import {
   writeFile as writeFile9
 } from "node:fs/promises";
 import os4 from "node:os";
-import path48 from "node:path";
+import path50 from "node:path";
 var FILE_CHECKPOINT_COPY_FAILED = "file_checkpoint_copy_failed";
 async function chmodSafe2(target, mode) {
   try {
@@ -18378,7 +18866,7 @@ async function chmodSafe2(target, mode) {
   }
 }
 async function copyRegularFile(sourcePath, destinationPath, mode, strategy) {
-  await mkdir12(path48.dirname(destinationPath), { recursive: true });
+  await mkdir12(path50.dirname(destinationPath), { recursive: true });
   if (strategy === "clonefile" && fsConstants2.COPYFILE_FICLONE !== void 0) {
     try {
       await copyFile4(sourcePath, destinationPath, fsConstants2.COPYFILE_FICLONE);
@@ -18404,7 +18892,7 @@ async function copyNode(sourceRoot, destinationRoot, relativePath, strategy) {
     return strategy;
   }
   if (info.isSymbolicLink()) {
-    await mkdir12(path48.dirname(destinationPath), { recursive: true });
+    await mkdir12(path50.dirname(destinationPath), { recursive: true });
     await symlink4(await readlink5(sourcePath), destinationPath);
     return strategy;
   }
@@ -18460,9 +18948,9 @@ async function mapWithConcurrency(items, concurrency, worker) {
 async function probeFileCloneStrategy() {
   let tempDir = null;
   try {
-    tempDir = await mkdtemp4(path48.join(os4.tmpdir(), "belay-clone-probe-"));
-    const source = path48.join(tempDir, "source.txt");
-    const destination = path48.join(tempDir, "dest.txt");
+    tempDir = await mkdtemp4(path50.join(os4.tmpdir(), "belay-clone-probe-"));
+    const source = path50.join(tempDir, "source.txt");
+    const destination = path50.join(tempDir, "dest.txt");
     await writeFile9(source, "probe\n");
     if (fsConstants2.COPYFILE_FICLONE_FORCE !== void 0) {
       try {
@@ -18615,11 +19103,11 @@ async function protectedRootState(root) {
   return `directory:${node.hash}:${index.treeHash}`;
 }
 function executionProtectedRoot(resourceRoot, executionRoot, protectedRoot) {
-  const relative = path49.relative(path49.resolve(resourceRoot), path49.resolve(protectedRoot));
-  if (relative === "" || relative.startsWith("..") || path49.isAbsolute(relative)) {
+  const relative = path51.relative(path51.resolve(resourceRoot), path51.resolve(protectedRoot));
+  if (relative === "" || relative.startsWith("..") || path51.isAbsolute(relative)) {
     return null;
   }
-  return path49.join(executionRoot, relative);
+  return path51.join(executionRoot, relative);
 }
 async function captureProtectedRootStates(resourceRoot, executionRoot, protectedRoots) {
   const states = /* @__PURE__ */ new Map();
@@ -18644,15 +19132,15 @@ async function directoryByteSize(root, deadlineMs) {
   }
   let total = 0;
   for (const name of await readdir6(root)) {
-    total += await directoryByteSize(path49.join(root, name), deadlineMs);
+    total += await directoryByteSize(path51.join(root, name), deadlineMs);
   }
   return total;
 }
 async function copyGitMetadataDirectory(sourceRoot, destinationRoot) {
   const gitDirRel = (await execGit2(sourceRoot, ["rev-parse", "--git-dir"])).trim();
-  const sourceGitDir = path49.isAbsolute(gitDirRel) ? gitDirRel : path49.join(sourceRoot, gitDirRel);
-  const relativeGitDir = path49.relative(path49.resolve(sourceRoot), path49.resolve(sourceGitDir));
-  const destinationGitDir = relativeGitDir && !relativeGitDir.startsWith("..") ? path49.join(destinationRoot, relativeGitDir) : path49.join(destinationRoot, ".git");
+  const sourceGitDir = path51.isAbsolute(gitDirRel) ? gitDirRel : path51.join(sourceRoot, gitDirRel);
+  const relativeGitDir = path51.relative(path51.resolve(sourceRoot), path51.resolve(sourceGitDir));
+  const destinationGitDir = relativeGitDir && !relativeGitDir.startsWith("..") ? path51.join(destinationRoot, relativeGitDir) : path51.join(destinationRoot, ".git");
   await cp(sourceGitDir, destinationGitDir, { recursive: true, force: true });
 }
 async function prepareDirtyGitSnapshot(context) {
@@ -18661,7 +19149,7 @@ async function prepareDirtyGitSnapshot(context) {
   const quotas = context.fileCheckpoint;
   const deadlineMs = Date.now() + quotas.prepareTimeoutMs;
   await removeDeadOwnerStaging(os5.tmpdir());
-  const stagingRoot = await mkdtemp5(path49.join(os5.tmpdir(), "belay-file-checkpoint-"));
+  const stagingRoot = await mkdtemp5(path51.join(os5.tmpdir(), "belay-file-checkpoint-"));
   await writeOwnerMarker(stagingRoot, {
     version: 1,
     pid: process.pid,
@@ -18669,8 +19157,8 @@ async function prepareDirtyGitSnapshot(context) {
     resourceRoot: context.repoRoot,
     backend: "file_checkpoint"
   });
-  const baselineRoot = path49.join(stagingRoot, "baseline");
-  const executionRoot = path49.join(stagingRoot, "execution");
+  const baselineRoot = path51.join(stagingRoot, "baseline");
+  const executionRoot = path51.join(stagingRoot, "execution");
   try {
     resolveExecutionCwdRelative(context.repoRoot, context.cwd);
     const sourceGitMetadataFingerprint = await computeGitMetadataFingerprint(context.repoRoot);
@@ -18704,7 +19192,7 @@ async function prepareDirtyGitSnapshot(context) {
       throw new Error(FILE_CHECKPOINT_SOURCE_CHANGED);
     }
     await writeFile10(
-      path49.join(stagingRoot, "baseline-index.json"),
+      path51.join(stagingRoot, "baseline-index.json"),
       `${JSON.stringify(baselineIndex)}
 `,
       "utf8"
@@ -18754,7 +19242,7 @@ async function prepareNonGitSnapshot(context) {
   const quotas = context.fileCheckpoint;
   const deadlineMs = Date.now() + quotas.prepareTimeoutMs;
   await removeDeadOwnerStaging(os5.tmpdir());
-  const stagingRoot = await mkdtemp5(path49.join(os5.tmpdir(), "belay-file-checkpoint-"));
+  const stagingRoot = await mkdtemp5(path51.join(os5.tmpdir(), "belay-file-checkpoint-"));
   await writeOwnerMarker(stagingRoot, {
     version: 1,
     pid: process.pid,
@@ -18762,8 +19250,8 @@ async function prepareNonGitSnapshot(context) {
     resourceRoot: context.repoRoot,
     backend: "file_checkpoint"
   });
-  const baselineRoot = path49.join(stagingRoot, "baseline");
-  const executionRoot = path49.join(stagingRoot, "execution");
+  const baselineRoot = path51.join(stagingRoot, "baseline");
+  const executionRoot = path51.join(stagingRoot, "execution");
   try {
     resolveExecutionCwdRelative(context.repoRoot, context.cwd);
     const resourceIdentity = await currentRecoveryResourceIdentity(context.repoRoot, "directory");
@@ -18792,7 +19280,7 @@ async function prepareNonGitSnapshot(context) {
       throw new Error(FILE_CHECKPOINT_SOURCE_CHANGED);
     }
     await writeFile10(
-      path49.join(stagingRoot, "baseline-index.json"),
+      path51.join(stagingRoot, "baseline-index.json"),
       `${JSON.stringify(baselineIndex)}
 `,
       "utf8"
@@ -19145,10 +19633,10 @@ async function selectTransactionalBackend(context) {
 }
 
 // src/core/transactional/diff-evaluator.ts
-import path50 from "node:path";
+import path52 from "node:path";
 init_path_utils();
 function categorizeChange(change, ctx) {
-  const absolutePath = canonicalPath(path50.join(ctx.repoRoot, change.relativePath));
+  const absolutePath = canonicalPath(path52.join(ctx.repoRoot, change.relativePath));
   if (!pathWithinRoot(ctx.repoRoot, absolutePath)) {
     return "repo_outside";
   }
@@ -19742,7 +20230,7 @@ async function notifyDeny(config, event) {
 init_path_utils();
 
 // src/adapters/layouts/protected-paths.ts
-import path51 from "node:path";
+import path53 from "node:path";
 function protectedArtifactRoots(layout, repoRoot, controlPlaneDir) {
   const roots = [
     layout.configPath(repoRoot),
@@ -19754,7 +20242,7 @@ function protectedArtifactRoots(layout, repoRoot, controlPlaneDir) {
   if (controlPlaneDir) {
     roots.push(controlPlaneDir);
   }
-  return roots.map((entry) => path51.resolve(entry));
+  return roots.map((entry) => path53.resolve(entry));
 }
 
 // src/adapters/shared/gate-runtime.ts
@@ -19807,8 +20295,8 @@ function createDefaultGateRuntimeDeps() {
       return loadJsonFile(configPath, {});
     },
     async appendAudit(ctx, event) {
-      const auditPath = path52.join(ctx.repoRoot, ctx.config.audit.logPath);
-      await mkdir14(path52.dirname(auditPath), { recursive: true });
+      const auditPath = path54.join(ctx.repoRoot, ctx.config.audit.logPath);
+      await mkdir14(path54.dirname(auditPath), { recursive: true });
       const provenance = auditProvenance(ctx.config);
       const record = {
         timestamp: (/* @__PURE__ */ new Date()).toISOString(),
@@ -19841,7 +20329,7 @@ function createDefaultGateRuntimeDeps() {
       };
     },
     async writeApprovals(filePath, state) {
-      await mkdir14(path52.dirname(filePath), { recursive: true });
+      await mkdir14(path54.dirname(filePath), { recursive: true });
       await writeFile11(filePath, `${JSON.stringify(compactApprovals(state), null, 2)}
 `, "utf8");
     },
@@ -20003,7 +20491,7 @@ function deriveWorkspaceRootScopeHint(params) {
   if (!targetPath) {
     return void 0;
   }
-  const candidateRoot = canonicalPath(path52.dirname(targetPath));
+  const candidateRoot = canonicalPath(path54.dirname(targetPath));
   const validation = validateTrustedWorkspaceRootCandidate({
     candidatePath: candidateRoot,
     repoRoot: action.repoRoot,
@@ -20337,6 +20825,7 @@ async function evaluateGatedAction(ctx, deps, params) {
       event: resolveGateAuditEvent(sourceEvent, params.kind),
       sourceEvent,
       kind: params.kind,
+      ...typeof params.payload?.tool_use_id === "string" ? { toolInvocationCorrelationId: toolInvocationCorrelationId(params.payload.tool_use_id) } : {},
       fingerprint: verdict2.fingerprint,
       verdict: verdict2.verdict,
       reason: verdict2.reason,
@@ -20494,6 +20983,7 @@ async function evaluateGatedAction(ctx, deps, params) {
   const scrubbedPayload = fingerprintReplayPayload(params.kind, params.payload, scrubOpts);
   return gateDecisionToVerdict(ctx, deps, params.kind, result, {
     sourceEvent: params.sourceEvent,
+    toolInvocationCorrelationId: typeof params.payload?.tool_use_id === "string" ? toolInvocationCorrelationId(params.payload.tool_use_id) : void 0,
     predictedAssessment,
     observedAssessment: observedAssessment2,
     transactionalLayer,
@@ -20611,6 +21101,7 @@ async function gateDecisionToVerdict(ctx, deps, kind, result, auditExtras = {})
     event: auditEvent,
     sourceEvent,
     kind,
+    ...auditExtras.toolInvocationCorrelationId ? { toolInvocationCorrelationId: auditExtras.toolInvocationCorrelationId } : {},
     fingerprint: result.fingerprint,
     summary: result.normalizedCommand ?? result.summary ?? "",
     assessment: result.assessment,
@@ -21061,29 +21552,56 @@ function gateVerdictToCodexUserPromptResponse(verdict2) {
   };
 }
 async function appendObservedAudit(ctx, deps, eventName, payload) {
+  const rawToolUseId = typeof payload.tool_use_id === "string" ? payload.tool_use_id : void 0;
+  const summaryPayload = redactToolInvocationId(payload, rawToolUseId);
   await deps.appendAudit(ctx, {
     event: eventName,
     kind: "audit",
     verdict: "allow",
     reason: "observed",
-    summary: canonicalStringify(payload)
+    ...rawToolUseId ? { toolInvocationCorrelationId: toolInvocationCorrelationId(rawToolUseId) } : {},
+    ...typeof summaryPayload.tool_name === "string" ? { toolName: summaryPayload.tool_name } : {},
+    ...typeof summaryPayload.failure_type === "string" ? { failureType: summaryPayload.failure_type } : {},
+    ...typeof summaryPayload.error_message === "string" ? { errorMessage: summaryPayload.error_message } : {},
+    ...typeof payload.duration === "number" ? { durationMs: payload.duration } : {},
+    ...typeof payload.is_interrupt === "boolean" ? { isInterrupt: payload.is_interrupt } : {},
+    summary: canonicalStringify(summaryPayload)
   });
 }
 
 // src/adapters/shared/repo-root.ts
 import { existsSync as existsSync17 } from "node:fs";
-import path53 from "node:path";
+import path55 from "node:path";
+function belayConfigPath(current, adapterName) {
+  if (adapterName === "cursor") {
+    return path55.join(current, ".cursor", "belay.config.json");
+  }
+  if (adapterName === "claude") {
+    return path55.join(current, ".claude", "belay.config.json");
+  }
+  return path55.join(current, ".codex", "belay.config.json");
+}
+function markerMatches(current, marker, layout) {
+  const markerPath = path55.join(current, marker);
+  if (!existsSync17(markerPath)) {
+    return false;
+  }
+  if (marker === ".cursor" || marker === ".claude" || marker === ".codex") {
+    return existsSync17(belayConfigPath(current, layout.name));
+  }
+  return true;
+}
 function findRepoRoot(startPath, layout) {
-  let current = path53.resolve(startPath);
+  let current = path55.resolve(startPath);
   while (true) {
     for (const marker of layout.repoRootMarkers) {
-      if (existsSync17(path53.join(current, marker))) {
+      if (markerMatches(current, marker, layout)) {
         return current;
       }
     }
-    const parent = path53.dirname(current);
+    const parent = path55.dirname(current);
     if (parent === current) {
-      return path53.resolve(startPath);
+      return path55.resolve(startPath);
     }
     current = parent;
   }
@@ -21109,6 +21627,16 @@ function jsonResponse(value) {
   process2.stdout.write(`${JSON.stringify(value)}
 `);
 }
+function nonEmptyPathString(value) {
+  return typeof value === "string" && value.trim() ? value.trim() : void 0;
+}
+function resolveCodexActionCwd(payload, fallbackCwd = process2.cwd(), options = {}) {
+  const toolInput = payload.tool_input !== null && typeof payload.tool_input === "object" ? payload.tool_input : void 0;
+  const nestedCwd = options.includeToolInputCwd ? nonEmptyPathString(toolInput?.working_directory) ?? nonEmptyPathString(toolInput?.cwd) : void 0;
+  const payloadCwd = nonEmptyPathString(payload.cwd);
+  const workspaceRoot = Array.isArray(payload.workspace_roots) ? payload.workspace_roots.map(nonEmptyPathString).find(Boolean) : void 0;
+  return path56.resolve(nestedCwd ?? payloadCwd ?? workspaceRoot ?? fallbackCwd);
+}
 async function loadRuntimeContext(cwd) {
   const repoRoot = findRepoRoot(cwd, codexLayout);
   const configPath = codexLayout.configPath(repoRoot);
@@ -21201,7 +21729,8 @@ async function runBeforeSubmitPromptHook() {
   try {
     const payload = await readStdinJson();
     const prompt = String(payload.prompt ?? payload.user_message ?? "");
-    const ctx = await loadRuntimeContext(process2.cwd());
+    const cwd = resolveCodexActionCwd(payload);
+    const ctx = await loadRuntimeContext(cwd);
     const deps = createDefaultGateRuntimeDeps();
     const result = await processApprovalPrompt(ctx, deps, prompt);
     jsonResponse(gateVerdictToCodexUserPromptResponse(result));
@@ -21215,9 +21744,10 @@ async function runBeforeSubmitPromptHook() {
 async function runToolGateHook(eventName) {
   try {
     const payload = await readStdinJson();
-    const cwd = process2.cwd();
     const toolName = String(payload.tool_name ?? payload.toolName ?? "");
     const kind = resolveCodexGateKind(eventName, toolName);
+    const includeToolInputCwd = (eventName === "PreToolUse" || eventName === "preToolUse") && kind === "shell";
+    const cwd = resolveCodexActionCwd(payload, process2.cwd(), { includeToolInputCwd });
     const ctx = await loadRuntimeContext(cwd);
     const deps = createDefaultGateRuntimeDeps();
     if (!kind) {
@@ -21255,7 +21785,7 @@ async function runShellGateHook() {
   try {
     const payload = await readStdinJson();
     const command = extractString(payload.tool_input, "command") || String(payload.command ?? "");
-    const cwd = process2.cwd();
+    const cwd = resolveCodexActionCwd(payload, process2.cwd(), { includeToolInputCwd: true });
     const ctx = await loadRuntimeContext(cwd);
     const deps = createDefaultGateRuntimeDeps();
     const verdict2 = await evaluateGatedAction(ctx, deps, {
@@ -21280,7 +21810,11 @@ async function runShellGateHook() {
 async function runAuditHook(eventName) {
   try {
     const payload = await readStdinJson();
-    const ctx = await loadRuntimeContext(process2.cwd());
+    const toolName = String(payload.tool_name ?? payload.toolName ?? "");
+    const kind = resolveCodexGateKind(eventName, toolName);
+    const includeToolInputCwd = (eventName === "PreToolUse" || eventName === "preToolUse") && kind === "shell";
+    const cwd = resolveCodexActionCwd(payload, process2.cwd(), { includeToolInputCwd });
+    const ctx = await loadRuntimeContext(cwd);
     const deps = createDefaultGateRuntimeDeps();
     await appendObservedAudit(ctx, deps, eventName, payload);
     jsonResponse({});
@@ -21293,6 +21827,7 @@ async function runAuditHook(eventName) {
   }
 }
 export {
+  resolveCodexActionCwd,
   runAuditHook,
   runBeforeSubmitPromptHook,
   runShellGateHook,