@guilz-dev/belay 0.9.2 → 0.9.4

package/dist/core/approval-repo-lookup.d.ts

@@ -0,0 +1,16 @@
+import type { AdapterName } from '../adapters/layouts/types.js';
+export type ApprovalRepoLookupResult = {
+    status: 'found';
+    repoRoot: string;
+} | {
+    status: 'ambiguous';
+    repoRoots: string[];
+} | {
+    status: 'not_found';
+};
+export declare function findApprovalRepoRoots(params: {
+    approvalId: string;
+    candidateRepoRoots: string[];
+    adapter: AdapterName;
+}): Promise<ApprovalRepoLookupResult>;
+export declare function formatAmbiguousApprovalRepoMessage(repoRoots: string[]): string;

package/dist/core/approval-repo-lookup.js

@@ -0,0 +1,48 @@
+import { readFile } from 'node:fs/promises';
+import path from 'node:path';
+import { approvedApprovalsPath, loadConfigFile, pendingApprovalsPath } from '../config-io.js';
+async function approvalStateContainsId(filePath, approvalId) {
+    try {
+        const raw = await readFile(filePath, 'utf8');
+        const parsed = JSON.parse(raw);
+        return parsed.approvals?.some((entry) => entry.approvalId === approvalId) ?? false;
+    }
+    catch {
+        return false;
+    }
+}
+export async function findApprovalRepoRoots(params) {
+    const matches = [];
+    const seen = new Set();
+    for (const candidate of params.candidateRepoRoots) {
+        const repoRoot = path.resolve(candidate);
+        if (seen.has(repoRoot)) {
+            continue;
+        }
+        seen.add(repoRoot);
+        try {
+            const config = await loadConfigFile(repoRoot, params.adapter);
+            const pendingPath = pendingApprovalsPath(repoRoot, config);
+            const approvedPath = approvedApprovalsPath(repoRoot, config);
+            const hasPending = await approvalStateContainsId(pendingPath, params.approvalId);
+            const hasApproved = await approvalStateContainsId(approvedPath, params.approvalId);
+            if (hasPending || hasApproved) {
+                matches.push(repoRoot);
+            }
+        }
+        catch {
+            continue;
+        }
+    }
+    if (matches.length === 1) {
+        return { status: 'found', repoRoot: matches[0] };
+    }
+    if (matches.length > 1) {
+        return { status: 'ambiguous', repoRoots: matches };
+    }
+    return { status: 'not_found' };
+}
+export function formatAmbiguousApprovalRepoMessage(repoRoots) {
+    return ('Belay found the same approval ID in multiple repositories. ' +
+        `Open one workspace and retry: ${repoRoots.join(', ')}`);
+}

package/dist/core/audit-io.d.ts

@@ -1,3 +1,3 @@
 import type { BelayConfigV4 } from './config.js';
-export { AUDIT_SCHEMA_VERSION, appendAuditRecord, approvalCorrelationId, isValidAuditFingerprint, isValidAuditTimestamp, parseAuditNdjsonLine, serializeAuditRecordV3, } from './audit-serialize.js';
+export { AUDIT_SCHEMA_VERSION, appendAuditRecord, approvalCorrelationId, canonicalToolUseIdForCorrelation, isValidAuditFingerprint, isValidAuditTimestamp, parseAuditNdjsonLine, serializeAuditRecordV3, toolInvocationCorrelationId, } from './audit-serialize.js';
 export declare function appendCliAuditEvent(repoRoot: string, config: BelayConfigV4, event: Record<string, unknown>): Promise<void>;

package/dist/core/audit-io.js

@@ -2,7 +2,7 @@ import path from 'node:path';
 import { resolveActiveAuditCohort } from '../runtime-provenance.js';
 import { appendAuditRecord } from './audit-serialize.js';
 import { scrubOptionsFromConfig } from './config.js';
-export { AUDIT_SCHEMA_VERSION, appendAuditRecord, approvalCorrelationId, isValidAuditFingerprint, isValidAuditTimestamp, parseAuditNdjsonLine, serializeAuditRecordV3, } from './audit-serialize.js';
+export { AUDIT_SCHEMA_VERSION, appendAuditRecord, approvalCorrelationId, canonicalToolUseIdForCorrelation, isValidAuditFingerprint, isValidAuditTimestamp, parseAuditNdjsonLine, serializeAuditRecordV3, toolInvocationCorrelationId, } from './audit-serialize.js';
 export async function appendCliAuditEvent(repoRoot, config, event) {
     const auditPath = path.isAbsolute(config.audit.logPath)
         ? config.audit.logPath

package/dist/core/audit-legacy-archive.js

@@ -1,43 +1,61 @@
-import { existsSync } from 'node:fs';
-import { open, rename } from 'node:fs/promises';
+import { createReadStream, existsSync } from 'node:fs';
+import { rename } from 'node:fs/promises';
 import path from 'node:path';
+import { createInterface } from 'node:readline';
 const LEGACY_PLACEHOLDER_PATTERNS = [
     /"(?:timestamp|ts)"\s*:\s*"<timestamp>"/,
     /"(?:fingerprint|commandFingerprint|effectIRHash|payloadHash|configFingerprint|runtimeArtifactHash|decisionConfigFingerprint|receiptHash)"\s*:\s*"<high-entropy>"/,
     /"approvalId"\s*:\s*"<approval-id>"/,
 ];
-const AUDIT_SCAN_CHUNK_BYTES = 64 * 1024;
-const AUDIT_SCAN_OVERLAP_CHARS = 256;
+const LEGACY_HIGH_ENTROPY_FIELDS = [
+    'fingerprint',
+    'commandFingerprint',
+    'effectIRHash',
+    'payloadHash',
+    'configFingerprint',
+    'runtimeArtifactHash',
+    'decisionConfigFingerprint',
+    'receiptHash',
+];
 export function auditLogHasLegacyScrubPlaceholders(sample) {
-    return LEGACY_PLACEHOLDER_PATTERNS.some((pattern) => pattern.test(sample));
+    for (const line of sample.split(/\r?\n/)) {
+        const trimmed = line.trim();
+        if (!trimmed) {
+            continue;
+        }
+        try {
+            const parsed = JSON.parse(trimmed);
+            if (parsed !== null && typeof parsed === 'object' && !Array.isArray(parsed)) {
+                if (auditRecordHasLegacyCorrelationPlaceholders(parsed)) {
+                    return true;
+                }
+                continue;
+            }
+        }
+        catch {
+            // Malformed legacy lines still need archival before a new runtime appends to the log.
+        }
+        if (LEGACY_PLACEHOLDER_PATTERNS.some((pattern) => pattern.test(trimmed))) {
+            return true;
+        }
+    }
+    return false;
 }
 export function auditRecordHasLegacyCorrelationPlaceholders(record) {
     return (record.timestamp === '<timestamp>' ||
-        record.fingerprint === '<high-entropy>' ||
+        record.ts === '<timestamp>' ||
+        LEGACY_HIGH_ENTROPY_FIELDS.some((field) => record[field] === '<high-entropy>') ||
         record.approvalId === '<approval-id>');
 }
 async function auditFileHasLegacyScrubPlaceholders(auditPath) {
-    const handle = await open(auditPath, 'r');
-    const buffer = Buffer.allocUnsafe(AUDIT_SCAN_CHUNK_BYTES);
-    let carry = '';
-    let position = 0;
-    try {
-        while (true) {
-            const { bytesRead } = await handle.read(buffer, 0, buffer.length, position);
-            if (bytesRead === 0) {
-                return false;
-            }
-            const sample = carry + buffer.toString('utf8', 0, bytesRead);
-            if (auditLogHasLegacyScrubPlaceholders(sample)) {
-                return true;
-            }
-            carry = sample.slice(-AUDIT_SCAN_OVERLAP_CHARS);
-            position += bytesRead;
+    const input = createReadStream(auditPath, { encoding: 'utf8' });
+    const lines = createInterface({ input, crlfDelay: Number.POSITIVE_INFINITY });
+    for await (const line of lines) {
+        if (auditLogHasLegacyScrubPlaceholders(line)) {
+            return true;
         }
     }
-    finally {
-        await handle.close();
-    }
+    return false;
 }
 export async function archiveLegacyAuditLogIfNeeded(repoRoot, config) {
     const auditPath = path.isAbsolute(config.audit.logPath)

package/dist/core/audit-query.d.ts

@@ -3,6 +3,7 @@ export declare function toAuditRecord(value: Record<string, unknown>): AuditReco
 export declare function parseTimestamp(value?: string): number | null;
 export declare function auditFingerprint(record: AuditRecord): string | undefined;
 export declare function auditApprovalCorrelationId(record: AuditRecord): string | undefined;
+export declare function auditToolInvocationCorrelationId(record: AuditRecord): string | undefined;
 export declare function isGateRecord(record: AuditRecord): boolean;
 export declare function isShellGateRecord(record: AuditRecord): boolean;
 export declare function isApprovalRecorded(record: AuditRecord): boolean;

package/dist/core/audit-query.js

@@ -27,6 +27,13 @@ export function auditApprovalCorrelationId(record) {
     }
     return undefined;
 }
+export function auditToolInvocationCorrelationId(record) {
+    if (typeof record.toolInvocationCorrelationId === 'string' &&
+        isValidApprovalCorrelationId(record.toolInvocationCorrelationId)) {
+        return record.toolInvocationCorrelationId;
+    }
+    return undefined;
+}
 export function isGateRecord(record) {
     return typeof record.event === 'string' && GATE_EVENTS.has(record.event);
 }

package/dist/core/audit-serialize.d.ts

@@ -1,6 +1,9 @@
 import type { ScrubOptions } from './types.js';
 export declare const AUDIT_SCHEMA_VERSION = 3;
 export declare function approvalCorrelationId(approvalId: string): string;
+/** Normalize Cursor host tool_use_id values before correlation hashing. */
+export declare function canonicalToolUseIdForCorrelation(toolUseId: string): string;
+export declare function toolInvocationCorrelationId(toolUseId: string): string;
 export declare function isValidApprovalCorrelationId(value: string): boolean;
 export declare function isValidAuditTimestamp(value: string): boolean;
 export declare function isValidAuditFingerprint(value: string): boolean;

package/dist/core/audit-serialize.js

@@ -19,6 +19,7 @@ const PRESERVED_HASH_FIELDS = new Set([
 const PRESERVED_LITERAL_FIELDS = new Set([
     'timestamp',
     'approvalCorrelationId',
+    'toolInvocationCorrelationId',
     'runtimeVersion',
     'runtimeBuildStamp',
     'boundaryProfile',
@@ -42,6 +43,27 @@ const SCRUBBED_CONTAINER_FIELDS = new Set([
 export function approvalCorrelationId(approvalId) {
     return createHash('sha256').update(approvalId).digest('hex').slice(0, 16);
 }
+const TOOL_USE_UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+/** Normalize Cursor host tool_use_id values before correlation hashing. */
+export function canonicalToolUseIdForCorrelation(toolUseId) {
+    const trimmed = toolUseId.trim();
+    if (trimmed.startsWith('tool_')) {
+        const remainder = trimmed.slice('tool_'.length);
+        if (TOOL_USE_UUID_PATTERN.test(remainder)) {
+            return remainder.toLowerCase();
+        }
+    }
+    if (TOOL_USE_UUID_PATTERN.test(trimmed)) {
+        return trimmed.toLowerCase();
+    }
+    return trimmed;
+}
+export function toolInvocationCorrelationId(toolUseId) {
+    return createHash('sha256')
+        .update(canonicalToolUseIdForCorrelation(toolUseId))
+        .digest('hex')
+        .slice(0, 16);
+}
 export function isValidApprovalCorrelationId(value) {
     return /^[a-f0-9]{16}$/.test(value);
 }
@@ -64,7 +86,17 @@ function isValidPreservedHashField(field, value) {
     return isValidAuditFingerprint(value);
 }
 function scrubAuditContainer(value, options) {
-    return scrubValue(value, {
+    const withoutRawToolIds = (input) => {
+        if (Array.isArray(input))
+            return input.map(withoutRawToolIds);
+        if (input && typeof input === 'object') {
+            return Object.fromEntries(Object.entries(input)
+                .filter(([key]) => key !== 'tool_use_id')
+                .map(([key, child]) => [key, withoutRawToolIds(child)]));
+        }
+        return input;
+    };
+    return scrubValue(withoutRawToolIds(value), {
         ...options,
         maskHighEntropyStrings: true,
     });
@@ -83,7 +115,7 @@ function serializeAuditField(key, value, options) {
         if (key === 'timestamp' && typeof value === 'string' && isValidAuditTimestamp(value)) {
             return value;
         }
-        if (key === 'approvalCorrelationId' &&
+        if ((key === 'approvalCorrelationId' || key === 'toolInvocationCorrelationId') &&
             typeof value === 'string' &&
             isValidApprovalCorrelationId(value)) {
             return value;
@@ -145,7 +177,11 @@ export function serializeAuditRecordV3(record, options) {
         serialized.approvalCorrelationId = record.approvalCorrelationId;
     }
     for (const [key, value] of Object.entries(record)) {
-        if (key === 'timestamp' || key === 'ts' || key === 'approvalId' || key === 'schemaVersion') {
+        if (key === 'timestamp' ||
+            key === 'ts' ||
+            key === 'approvalId' ||
+            key === 'tool_use_id' ||
+            key === 'schemaVersion') {
             continue;
         }
         const next = serializeAuditField(key, value, options);

package/dist/core/audit-summary.d.ts

@@ -6,6 +6,12 @@ export interface RecentAskEntry {
     reason: string;
     tier: AuditTier;
 }
+export interface RecentHostDenialEntry {
+    gateTimestamp?: string;
+    failureTimestamp?: string;
+    summary: string;
+    errorMessage: string;
+}
 export interface AuditVisibilitySummary {
     gateEvents: number;
     askCount: number;
@@ -16,6 +22,9 @@ export interface AuditVisibilitySummary {
     allowCount: number;
     silentPassRate: number;
     recentAsks: RecentAskEntry[];
+    hostDeniedAfterAllowCount: number;
+    recentHostDenials: RecentHostDenialEntry[];
+    unrecognizedHostFailureCount: number;
 }
 export declare const DEFAULT_SILENT_PASS_THRESHOLD = 0.5;
 export declare const MIN_GATE_EVENTS_FOR_FENCE_DRIFT = 20;

package/dist/core/audit-summary.js

@@ -1,4 +1,4 @@
-import { filterAuditRecords, inferWouldBlock, isApprovalRecorded, isGateRecord, parseTimestamp, recordStringField, } from './audit-query.js';
+import { auditToolInvocationCorrelationId, filterAuditRecords, inferWouldBlock, isApprovalRecorded, isGateRecord, parseTimestamp, recordStringField, } from './audit-query.js';
 export const DEFAULT_SILENT_PASS_THRESHOLD = 0.5;
 export const MIN_GATE_EVENTS_FOR_FENCE_DRIFT = 20;
 function isTier0Reason(reason) {
@@ -38,6 +38,7 @@ function isGateEventRecord(record) {
 export function summarizeAuditVisibility(records, filter = {}, options = {}) {
     const filtered = filterAuditRecords(records, filter);
     const gateRecords = filtered.filter(isGateEventRecord);
+    const allGateRecords = records.filter(isGateEventRecord);
     const recentAskLimit = options.recentAskLimit ?? 10;
     let askCount = 0;
     let enforceAskCount = 0;
@@ -46,6 +47,23 @@ export function summarizeAuditVisibility(records, filter = {}, options = {}) {
     let flagCount = 0;
     let allowCount = 0;
     const recentAsks = [];
+    const allowedByInvocation = new Map();
+    const recentHostDenials = [];
+    let unrecognizedHostFailureCount = 0;
+    const matchedHostDenials = new Set();
+    for (const record of allGateRecords) {
+        const invocationId = auditToolInvocationCorrelationId(record);
+        if (invocationId && !inferWouldBlock(record) && record.permission === 'allow') {
+            const existing = allowedByInvocation.get(invocationId);
+            const recordMs = parseTimestamp(record.timestamp) ?? Number.NEGATIVE_INFINITY;
+            const existingMs = existing
+                ? (parseTimestamp(existing.timestamp) ?? Number.NEGATIVE_INFINITY)
+                : Number.NEGATIVE_INFINITY;
+            if (!existing || recordMs >= existingMs) {
+                allowedByInvocation.set(invocationId, record);
+            }
+        }
+    }
     for (const record of gateRecords) {
         if (inferWouldBlock(record)) {
             askCount += 1;
@@ -73,11 +91,47 @@ export function summarizeAuditVisibility(records, filter = {}, options = {}) {
             allowCount += 1;
         }
     }
+    for (const record of filtered) {
+        if (record.event !== 'postToolUseFailure') {
+            continue;
+        }
+        if (record.failureType !== 'permission_denied') {
+            unrecognizedHostFailureCount += 1;
+            continue;
+        }
+        const invocationId = auditToolInvocationCorrelationId(record);
+        const gate = invocationId ? allowedByInvocation.get(invocationId) : undefined;
+        if (!gate) {
+            continue;
+        }
+        const gateMs = parseTimestamp(gate.timestamp);
+        const failureMs = parseTimestamp(record.timestamp);
+        if (gateMs !== null && failureMs !== null && failureMs < gateMs) {
+            continue;
+        }
+        if (invocationId && matchedHostDenials.has(invocationId)) {
+            continue;
+        }
+        if (invocationId) {
+            matchedHostDenials.add(invocationId);
+        }
+        recentHostDenials.push({
+            gateTimestamp: gate.timestamp,
+            failureTimestamp: record.timestamp,
+            summary: typeof gate.summary === 'string' ? gate.summary : '',
+            errorMessage: typeof record.errorMessage === 'string' ? record.errorMessage : '',
+        });
+    }
     recentAsks.sort((left, right) => {
         const leftMs = parseTimestamp(left.timestamp) ?? 0;
         const rightMs = parseTimestamp(right.timestamp) ?? 0;
         return rightMs - leftMs;
     });
+    recentHostDenials.sort((left, right) => {
+        const leftMs = parseTimestamp(left.failureTimestamp) ?? 0;
+        const rightMs = parseTimestamp(right.failureTimestamp) ?? 0;
+        return rightMs - leftMs;
+    });
     const gateEvents = gateRecords.length;
     const silentPassRate = gateEvents > 0 ? (allowCount + flagCount) / gateEvents : 0;
     return {
@@ -90,6 +144,9 @@ export function summarizeAuditVisibility(records, filter = {}, options = {}) {
         allowCount,
         silentPassRate,
         recentAsks: recentAsks.slice(0, recentAskLimit),
+        hostDeniedAfterAllowCount: recentHostDenials.length,
+        recentHostDenials: recentHostDenials.slice(0, recentAskLimit),
+        unrecognizedHostFailureCount,
     };
 }
 export function detectFenceDrift(summary, options = {}) {

package/dist/core/audit-types.d.ts

@@ -12,6 +12,10 @@ export interface AuditRecord {
     fingerprint?: string;
     summary?: string;
     approvalId?: string;
+    toolInvocationCorrelationId?: string;
+    toolName?: string;
+    failureType?: string;
+    errorMessage?: string;
     wouldBlock?: boolean;
     judgeFallbackReason?: string;
     permission?: string;

package/dist/core/classify-tool.js

@@ -5,6 +5,7 @@ import { evaluateFileMutationPolicy, policyDecisionRequiresAsk, } from './capabi
 import { canonicalStringify, toolFingerprint } from './fingerprint.js';
 import { matchesSensitivePath } from './glob.js';
 import { pathWithinRoot, resolveWorkspaceRootMatch } from './path-utils.js';
+import { fingerprintToolInputSource } from './replay-scrub.js';
 import { scrubValue } from './scrub.js';
 import { classifyShell, resolveClassifierTrustedCwd } from './verdict/adapter.js';
 import { isGitPath } from './verdict/containment.js';
@@ -37,6 +38,13 @@ function policyAuth(options) {
 function scrubPayload(value, options) {
     return scrubValue(value, options.scrubOptions);
 }
+function fingerprintPayload(payload, options) {
+    const toolInput = fingerprintToolInputSource(payload);
+    if (Object.keys(toolInput).length > 0) {
+        return toolInput;
+    }
+    return scrubPayload(payload.tool_input ?? {}, options);
+}
 function extractFilePath(payload) {
     const toolInput = payload.tool_input;
     if (!toolInput || typeof toolInput !== 'object') {
@@ -209,7 +217,7 @@ export async function classifyToolUse(payload, repoRoot, cwd, config, options =
                     verdict: 'deny_pending_approval',
                     reason: 'tool_shell_missing_command',
                     summary: canonicalStringify(scrubPayload(payload.tool_input ?? {}, options)),
-                    fingerprint: toolFingerprint(toolName, scrubPayload(payload.tool_input ?? {}, options), repoRoot),
+                    fingerprint: toolFingerprint(toolName, fingerprintPayload(payload, options), repoRoot),
                     assessment: {
                         reversibility: 'irreversible',
                         external: false,
@@ -223,7 +231,7 @@ export async function classifyToolUse(payload, repoRoot, cwd, config, options =
                 verdict: 'allow_flagged',
                 reason: 'tool_shell_missing_command',
                 summary: canonicalStringify(scrubPayload(payload.tool_input ?? {}, options)),
-                fingerprint: toolFingerprint(toolName, scrubPayload(payload.tool_input ?? {}, options), repoRoot),
+                fingerprint: toolFingerprint(toolName, fingerprintPayload(payload, options), repoRoot),
                 assessment: {
                     reversibility: 'recoverable_with_cost',
                     external: false,
@@ -249,7 +257,7 @@ export async function classifyToolUse(payload, repoRoot, cwd, config, options =
                     verdict: 'deny_pending_approval',
                     reason: 'file_mutation_missing_path',
                     summary: canonicalStringify(scrubPayload(payload.tool_input ?? {}, options)),
-                    fingerprint: toolFingerprint(toolName, scrubPayload(payload.tool_input ?? {}, options), repoRoot),
+                    fingerprint: toolFingerprint(toolName, fingerprintPayload(payload, options), repoRoot),
                     assessment: {
                         reversibility: 'irreversible',
                         external: false,
@@ -263,7 +271,7 @@ export async function classifyToolUse(payload, repoRoot, cwd, config, options =
                 verdict: 'allow_flagged',
                 reason: 'file_mutation_missing_path',
                 summary: canonicalStringify(scrubPayload(payload.tool_input ?? {}, options)),
-                fingerprint: toolFingerprint(toolName, scrubPayload(payload.tool_input ?? {}, options), repoRoot),
+                fingerprint: toolFingerprint(toolName, fingerprintPayload(payload, options), repoRoot),
                 assessment: {
                     reversibility: 'recoverable_with_cost',
                     external: false,
@@ -409,7 +417,7 @@ export async function classifyToolUse(payload, repoRoot, cwd, config, options =
                     verdict: 'deny_pending_approval',
                     reason: 'apply_patch_missing_path',
                     summary: canonicalStringify(scrubPayload(payload.tool_input ?? {}, options)),
-                    fingerprint: toolFingerprint(toolName, scrubPayload(payload.tool_input ?? {}, options), repoRoot),
+                    fingerprint: toolFingerprint(toolName, fingerprintPayload(payload, options), repoRoot),
                     assessment: {
                         reversibility: 'irreversible',
                         external: false,
@@ -423,7 +431,7 @@ export async function classifyToolUse(payload, repoRoot, cwd, config, options =
                 verdict: 'allow_flagged',
                 reason: 'apply_patch_missing_path',
                 summary: canonicalStringify(scrubPayload(payload.tool_input ?? {}, options)),
-                fingerprint: toolFingerprint(toolName, scrubPayload(payload.tool_input ?? {}, options), repoRoot),
+                fingerprint: toolFingerprint(toolName, fingerprintPayload(payload, options), repoRoot),
                 assessment: {
                     reversibility: 'recoverable_with_cost',
                     external: false,
@@ -448,7 +456,7 @@ export async function classifyToolUse(payload, repoRoot, cwd, config, options =
             verdict: 'allow_flagged',
             reason: sawDelete ? 'file_delete' : 'file_mutation',
             summary: targets.map((target) => target.path).join(', '),
-            fingerprint: toolFingerprint(toolName, scrubPayload(payload.tool_input ?? {}, options), repoRoot),
+            fingerprint: toolFingerprint(toolName, fingerprintPayload(payload, options), repoRoot),
             assessment: {
                 reversibility: 'recoverable_with_cost',
                 external: false,
@@ -462,7 +470,7 @@ export async function classifyToolUse(payload, repoRoot, cwd, config, options =
         verdict: 'allow',
         reason: 'unclassified_tool',
         summary: canonicalStringify(scrubPayload(payload.tool_input ?? {}, options)),
-        fingerprint: toolFingerprint(toolName, scrubPayload(payload.tool_input ?? {}, options), repoRoot),
+        fingerprint: toolFingerprint(toolName, fingerprintPayload(payload, options), repoRoot),
         assessment: {
             reversibility: 'reversible',
             external: false,

package/dist/core/effect-ir/argv-delegate.d.ts

@@ -0,0 +1,9 @@
+export interface ArgvDelegatePeelResult {
+    launcher: string;
+    innerTokens: string[];
+    opaque: boolean;
+    reason: string;
+    signals: string[];
+}
+export declare function innerRecipeFromArgvDelegate(peel: ArgvDelegatePeelResult): string | null;
+export declare function peelArgvDelegateArgv(tokens: string[]): ArgvDelegatePeelResult | null;

package/dist/core/effect-ir/argv-delegate.js

@@ -0,0 +1,42 @@
+export function innerRecipeFromArgvDelegate(peel) {
+    if (peel.opaque || peel.innerTokens.length === 0) {
+        return null;
+    }
+    return peel.innerTokens.join(' ');
+}
+export function peelArgvDelegateArgv(tokens) {
+    const launcher = tokens[0] ?? '';
+    if (!launcher || tokens.length < 2) {
+        return null;
+    }
+    const signals = ['process.argv_delegate'];
+    let index = 1;
+    while (index < tokens.length) {
+        const token = tokens[index] ?? '';
+        if (token === '--') {
+            index += 1;
+            break;
+        }
+        if (token.startsWith('-')) {
+            return {
+                launcher,
+                innerTokens: [],
+                opaque: true,
+                reason: 'argv_delegate_wrapper_options',
+                signals: [...signals, 'argv_delegate_wrapper_options'],
+            };
+        }
+        break;
+    }
+    const innerTokens = tokens.slice(index);
+    if (innerTokens.length === 0) {
+        return null;
+    }
+    return {
+        launcher,
+        innerTokens,
+        opaque: false,
+        reason: 'argv_delegate_peel',
+        signals,
+    };
+}

package/dist/core/effect-ir/shell-lower/argv-delegate-gate.d.ts

@@ -0,0 +1,3 @@
+import type { ShellEffectRequirement } from '../shell-build.js';
+export declare function shouldApplyArgvDelegate(head: string, innerTokens: string[], depth: number): boolean;
+export declare function isGrammarUnknownOnly(requirements: ShellEffectRequirement[], head: string): boolean;

package/dist/core/effect-ir/shell-lower/argv-delegate-gate.js

@@ -0,0 +1,40 @@
+import path from 'node:path';
+import { isEgressToolHead } from '../../verdict/egress-classify.js';
+const ARGV_DELEGATE_INNER_BLOCKLIST = new Set([
+    'sudo',
+    'env',
+    'command',
+    'builtin',
+    'exec',
+    'time',
+    'nice',
+    'nohup',
+    'stdbuf',
+    'setsid',
+    '(',
+]);
+export function shouldApplyArgvDelegate(head, innerTokens, depth) {
+    if (depth > 0 || isEgressToolHead(head) || head === 'bundle') {
+        return false;
+    }
+    if (ARGV_DELEGATE_INNER_BLOCKLIST.has(head)) {
+        return false;
+    }
+    const innerHead = path.basename(innerTokens[0] ?? '');
+    if (ARGV_DELEGATE_INNER_BLOCKLIST.has(innerHead)) {
+        return false;
+    }
+    return innerTokens.length >= 2;
+}
+export function isGrammarUnknownOnly(requirements, head) {
+    if (requirements.length !== 2) {
+        return false;
+    }
+    const [spawn, indeterminate] = requirements;
+    return (spawn.action === 'process.exec' &&
+        spawn.resource.kind === 'executable' &&
+        spawn.resource.command === head &&
+        spawn.resource.operation === 'spawn' &&
+        indeterminate.action === 'indeterminate' &&
+        indeterminate.evidence.signals.includes('process.grammar_unknown'));
+}

package/dist/core/effect-ir/shell-lower/augment.d.ts

@@ -0,0 +1,4 @@
+import type { ShellEffectRequirement } from '../shell-build.js';
+import type { LowerContext } from './context.js';
+export declare function addRedirectEffects(requirements: ShellEffectRequirement[], tokens: string[], env: Readonly<Record<string, string | undefined>>, context: LowerContext, segment: string): void;
+export declare function effectChangingEnvironmentSignals(head: string, env: Readonly<Record<string, string | undefined>>, changedNames: ReadonlySet<string>): string[];