@guilz-dev/belay 0.9.4 → 0.10.1

package/dist/bundle/claude-runtime.mjs

@@ -2155,7 +2155,7 @@ function normalizeConfig(config) {
     policy: {
       unknownLocalEffect: v4.policy?.unknownLocalEffect === "deny" ? "deny" : v4.policy?.unknownLocalEffect === "allow_flagged" ? "allow_flagged" : DEFAULT_POLICY_V3.unknownLocalEffect,
       unparseableShell: v4.policy?.unparseableShell === "deny" ? "deny" : v4.policy?.unparseableShell === "allow_flagged" ? "allow_flagged" : DEFAULT_POLICY_V3.unparseableShell,
-      codexUnmappedTool: v4.policy?.codexUnmappedTool === "allow" ? "allow" : "deny",
+      codexUnmappedTool: "allow",
       fenceWarnThreshold: typeof v4.policy?.fenceWarnThreshold === "number" && v4.policy.fenceWarnThreshold > 0 && v4.policy.fenceWarnThreshold <= 1 ? v4.policy.fenceWarnThreshold : DEFAULT_FENCE_WARN_THRESHOLD,
       confidenceThresholds: {
         allow: typeof v4.policy?.confidenceThresholds?.allow === "number" ? v4.policy.confidenceThresholds.allow : DEFAULT_CONFIDENCE_THRESHOLDS.allow,
@@ -2457,7 +2457,7 @@ var init_config = __esm({
     DEFAULT_POLICY_V3 = {
       unknownLocalEffect: "allow_flagged",
       unparseableShell: "deny",
-      codexUnmappedTool: "deny",
+      codexUnmappedTool: "allow",
       confidenceThresholds: { ...DEFAULT_CONFIDENCE_THRESHOLDS },
       modelAssist: { ...DEFAULT_MODEL_ASSIST },
       transactional: { ...DEFAULT_TRANSACTIONAL_V3 },
@@ -3510,9 +3510,122 @@ var init_config_layers = __esm({
   }
 });
 
-// src/config-io.ts
+// src/core/repo-config-trust.ts
 import { existsSync as existsSync3 } from "node:fs";
-import { chmod, mkdir as mkdir2, open as open2, readFile as readFile2, rename, unlink as unlink2, writeFile } from "node:fs/promises";
+import { chmod, mkdir as mkdir2, open as open2, readFile as readFile2, rename, unlink as unlink2 } from "node:fs/promises";
+import path12 from "node:path";
+function isObjectRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function hasOnlyExpectedKeys(value) {
+  const expected = /* @__PURE__ */ new Set([
+    "schemaVersion",
+    "repoRoot",
+    "adapter",
+    "repoConfigFingerprint",
+    "trustedAt"
+  ]);
+  const keys = Object.keys(value);
+  if (keys.length !== expected.size) {
+    return false;
+  }
+  return keys.every((key) => expected.has(key));
+}
+function isAdapterName(value) {
+  return value === "cursor" || value === "claude" || value === "codex";
+}
+function isIsoTimestamp(value) {
+  return Number.isFinite(Date.parse(value));
+}
+function parseStrictTrustRecord(value) {
+  if (!isObjectRecord(value) || !hasOnlyExpectedKeys(value)) {
+    return null;
+  }
+  if (value.schemaVersion !== 1) {
+    return null;
+  }
+  if (typeof value.repoRoot !== "string" || value.repoRoot.trim().length === 0) {
+    return null;
+  }
+  if (!isAdapterName(value.adapter)) {
+    return null;
+  }
+  if (typeof value.repoConfigFingerprint !== "string" || !/^[a-f0-9]{64}$/.test(value.repoConfigFingerprint)) {
+    return null;
+  }
+  if (typeof value.trustedAt !== "string" || !isIsoTimestamp(value.trustedAt)) {
+    return null;
+  }
+  return {
+    schemaVersion: 1,
+    repoRoot: value.repoRoot,
+    adapter: value.adapter,
+    repoConfigFingerprint: value.repoConfigFingerprint,
+    trustedAt: value.trustedAt
+  };
+}
+function repoConfigFingerprint(rawConfig) {
+  return hashValue(canonicalStringify(rawConfig));
+}
+function repoConfigTrustPath(repoRoot, adapter) {
+  const canonicalRepoRoot = canonicalPath(repoRoot);
+  const identity = hashValue(`${canonicalRepoRoot}\0${adapter}`);
+  return path12.join(defaultControlPlaneDir(), "config-trust", `${identity}.json`);
+}
+async function inspectRepoConfigTrust(repoRoot, adapter, rawConfig) {
+  const canonicalRepoRoot = canonicalPath(repoRoot);
+  const recordPath = repoConfigTrustPath(repoRoot, adapter);
+  if (!existsSync3(recordPath)) {
+    return { trusted: false, recordPath, reason: "missing" };
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(await readFile2(recordPath, "utf8"));
+  } catch {
+    return { trusted: false, recordPath, reason: "malformed" };
+  }
+  const record = parseStrictTrustRecord(parsed);
+  if (!record) {
+    return { trusted: false, recordPath, reason: "malformed" };
+  }
+  if (record.adapter !== adapter || canonicalPath(record.repoRoot) !== canonicalRepoRoot) {
+    return { trusted: false, recordPath, reason: "identity_mismatch" };
+  }
+  const fingerprint = repoConfigFingerprint(rawConfig);
+  if (record.repoConfigFingerprint !== fingerprint) {
+    return { trusted: false, recordPath, reason: "fingerprint_mismatch" };
+  }
+  return { trusted: true, recordPath, fingerprint };
+}
+async function assertRepoConfigTrusted(repoRoot, adapter, rawConfig) {
+  const status = await inspectRepoConfigTrust(repoRoot, adapter, rawConfig);
+  if (status.trusted) {
+    return;
+  }
+  throw new RepoConfigTrustError(status);
+}
+var TRUST_MESSAGE, RepoConfigTrustError;
+var init_repo_config_trust = __esm({
+  "src/core/repo-config-trust.ts"() {
+    "use strict";
+    init_config();
+    init_fingerprint2();
+    init_path_utils();
+    TRUST_MESSAGE = "Repository config is not trusted. Review it, then run `belay config trust`.";
+    RepoConfigTrustError = class extends Error {
+      status;
+      constructor(status) {
+        super(TRUST_MESSAGE);
+        this.name = "RepoConfigTrustError";
+        this.status = status;
+      }
+    };
+  }
+});
+
+// src/config-io.ts
+import { existsSync as existsSync4 } from "node:fs";
+import { chmod as chmod2, mkdir as mkdir3, open as open3, readFile as readFile3, rename as rename2, unlink as unlink3, writeFile } from "node:fs/promises";
 function resolveAdapterName(config) {
   if (config.adapter === "claude") {
     return "claude";
@@ -3523,10 +3636,10 @@ function resolveAdapterName(config) {
   return "cursor";
 }
 function detectAdapterName(repoRoot) {
-  if (existsSync3(configPathFor(repoRoot, "claude"))) {
+  if (existsSync4(configPathFor(repoRoot, "claude"))) {
     return "claude";
   }
-  if (existsSync3(configPathFor(repoRoot, "codex"))) {
+  if (existsSync4(configPathFor(repoRoot, "codex"))) {
     return "codex";
   }
   return "cursor";
@@ -3541,20 +3654,20 @@ async function loadLayeredConfig(repoRoot, adapter = detectAdapterName(repoRoot)
   const layout = getAdapterLayout(adapter);
   const configPath = configPathFor(repoRoot, adapter);
   let repoConfig = {};
-  if (existsSync3(configPath)) {
-    repoConfig = JSON.parse(await readFile2(configPath, "utf8"));
+  if (existsSync4(configPath)) {
+    repoConfig = JSON.parse(await readFile3(configPath, "utf8"));
   }
   let teamConfig = null;
   const teamPath = teamConfigPath();
-  if (existsSync3(teamPath)) {
-    teamConfig = JSON.parse(await readFile2(teamPath, "utf8"));
+  if (existsSync4(teamPath)) {
+    teamConfig = JSON.parse(await readFile3(teamPath, "utf8"));
   }
   return resolveLayeredConfig({
     repoConfig,
     adapterDefaults: layout.defaultConfig(repoRoot),
     teamConfig,
     teamConfigPath: teamPath,
-    repoConfigPath: existsSync3(configPath) ? configPath : void 0
+    repoConfigPath: existsSync4(configPath) ? configPath : void 0
   });
 }
 async function loadConfigFile(repoRoot, adapter = detectAdapterName(repoRoot)) {
@@ -3569,6 +3682,7 @@ var init_config_io = __esm({
     init_approval_state_mutation();
     init_config();
     init_config_layers();
+    init_repo_config_trust();
   }
 });
 
@@ -4230,9 +4344,9 @@ init_claude();
 init_approval();
 init_approval_replay();
 import { randomUUID as randomUUID6 } from "node:crypto";
-import { existsSync as existsSync16 } from "node:fs";
-import { mkdir as mkdir14, readFile as readFile15, writeFile as writeFile11 } from "node:fs/promises";
-import path61 from "node:path";
+import { existsSync as existsSync17 } from "node:fs";
+import { mkdir as mkdir15, readFile as readFile16, writeFile as writeFile11 } from "node:fs/promises";
+import path63 from "node:path";
 
 // src/core/approval-service.ts
 init_config_io();
@@ -4242,47 +4356,35 @@ init_approval_replay();
 // src/core/approval-token.ts
 init_config();
 import { createHmac, randomBytes, timingSafeEqual } from "node:crypto";
-import { existsSync as existsSync4 } from "node:fs";
-import { mkdir as mkdir3, readFile as readFile3, writeFile as writeFile2 } from "node:fs/promises";
-import path12 from "node:path";
-function base64UrlEncode(value) {
-  return Buffer.from(value, "utf8").toString("base64url");
-}
+import { existsSync as existsSync5 } from "node:fs";
+import { mkdir as mkdir4, readFile as readFile4, writeFile as writeFile2 } from "node:fs/promises";
+import path13 from "node:path";
 function base64UrlDecode(value) {
   return Buffer.from(value, "base64url").toString("utf8");
 }
 function approvalSigningKeyPath(controlPlaneDir = defaultControlPlaneDir()) {
-  return path12.join(controlPlaneDir, "approval-signing.key");
+  return path13.join(controlPlaneDir, "approval-signing.key");
 }
 async function loadOrCreateApprovalSigningKey(controlPlaneDir = defaultControlPlaneDir()) {
   const keyPath = approvalSigningKeyPath(controlPlaneDir);
-  if (existsSync4(keyPath)) {
-    return readFile3(keyPath);
+  if (existsSync5(keyPath)) {
+    return readFile4(keyPath);
   }
-  await mkdir3(controlPlaneDir, { recursive: true });
+  await mkdir4(controlPlaneDir, { recursive: true });
   const key = randomBytes(32);
   await writeFile2(keyPath, key, { mode: 384 });
   return key;
 }
-function signPayload(payload, key) {
-  const body = base64UrlEncode(JSON.stringify(payload));
-  const signature = createHmac("sha256", key).update(body).digest("base64url");
-  return `${body}.${signature}`;
-}
-async function issueApprovalToken(payload, controlPlaneDir = defaultControlPlaneDir()) {
-  const key = await loadOrCreateApprovalSigningKey(controlPlaneDir);
-  return signPayload(payload, key);
-}
 async function verifyApprovalToken(token, controlPlaneDir = defaultControlPlaneDir()) {
   const [body, signature] = token.split(".");
   if (!body || !signature) {
     return null;
   }
   const keyPath = approvalSigningKeyPath(controlPlaneDir);
-  if (!existsSync4(keyPath)) {
+  if (!existsSync5(keyPath)) {
     return null;
   }
-  const key = await readFile3(keyPath);
+  const key = await readFile4(keyPath);
   const expected = createHmac("sha256", key).update(body).digest("base64url");
   const actualBuffer = Buffer.from(signature);
   const expectedBuffer = Buffer.from(expected);
@@ -4489,11 +4591,11 @@ init_approval_v3();
 
 // src/core/capability/boundary-attestation-sign.ts
 import { createHmac as createHmac2, timingSafeEqual as timingSafeEqual2 } from "node:crypto";
-import { access, readFile as readFile4 } from "node:fs/promises";
+import { access, readFile as readFile5 } from "node:fs/promises";
 init_fingerprint2();
 
 // src/core/capability/attestation.ts
-import path13 from "node:path";
+import path14 from "node:path";
 var BOUNDARY_ATTESTATION_VERSION = 1;
 var CONTAINED_EXECUTION_ATTESTATION_VERSION = 1;
 var KNOWN_DRIVERS = /* @__PURE__ */ new Set([
@@ -4561,7 +4663,7 @@ function validateContainedExecutionAttestation(value) {
   const record = value;
   const dockerSubstrate = record.dockerSubstrate;
   const dockerConfiguration = record.dockerConfiguration;
-  if (record.version !== CONTAINED_EXECUTION_ATTESTATION_VERSION || typeof record.imageId !== "string" || !/^sha256:[a-f0-9]{64}$/i.test(record.imageId) || typeof record.imageReference !== "string" || !record.imageReference || /[\0\n\r]/.test(record.imageReference) || record.networkNone !== true || record.isolatesWorkspaceMirror !== true || record.readOnlyRoot !== true || record.sanitizedEnvironment !== true || !isRecord(dockerSubstrate) || typeof dockerSubstrate.binaryPath !== "string" || !path13.isAbsolute(dockerSubstrate.binaryPath) || /[\0\n\r]/.test(dockerSubstrate.binaryPath) || typeof dockerSubstrate.binarySha256 !== "string" || !/^[a-f0-9]{64}$/.test(dockerSubstrate.binarySha256) || typeof dockerSubstrate.endpoint !== "string" || !dockerSubstrate.endpoint.startsWith("unix:///") || !path13.isAbsolute(dockerSubstrate.endpoint.slice("unix://".length)) || /[\0\n\r]/.test(dockerSubstrate.endpoint) || typeof dockerSubstrate.daemonId !== "string" || !dockerSubstrate.daemonId || /[\0\n\r]/.test(dockerSubstrate.daemonId) || !isRecord(dockerConfiguration) || typeof dockerConfiguration.executable !== "string" || !path13.isAbsolute(dockerConfiguration.executable) || /[\0\n\r]/.test(dockerConfiguration.executable) || typeof dockerConfiguration.host !== "string" || !dockerConfiguration.host.startsWith("unix:///") || !path13.isAbsolute(dockerConfiguration.host.slice("unix://".length)) || /[\0\n\r]/.test(dockerConfiguration.host) || typeof record.user !== "string" || !/^\d+:\d+$/.test(record.user) || record.entrypoint !== "/bin/sh" || record.capDropAll !== true || record.noNewPrivileges !== true || record.logDriver !== "none" || record.proxyEnvironment !== "neutralized-empty" || typeof record.probedAt !== "string" || typeof record.expiresAt !== "string") {
+  if (record.version !== CONTAINED_EXECUTION_ATTESTATION_VERSION || typeof record.imageId !== "string" || !/^sha256:[a-f0-9]{64}$/i.test(record.imageId) || typeof record.imageReference !== "string" || !record.imageReference || /[\0\n\r]/.test(record.imageReference) || record.networkNone !== true || record.isolatesWorkspaceMirror !== true || record.readOnlyRoot !== true || record.sanitizedEnvironment !== true || !isRecord(dockerSubstrate) || typeof dockerSubstrate.binaryPath !== "string" || !path14.isAbsolute(dockerSubstrate.binaryPath) || /[\0\n\r]/.test(dockerSubstrate.binaryPath) || typeof dockerSubstrate.binarySha256 !== "string" || !/^[a-f0-9]{64}$/.test(dockerSubstrate.binarySha256) || typeof dockerSubstrate.endpoint !== "string" || !dockerSubstrate.endpoint.startsWith("unix:///") || !path14.isAbsolute(dockerSubstrate.endpoint.slice("unix://".length)) || /[\0\n\r]/.test(dockerSubstrate.endpoint) || typeof dockerSubstrate.daemonId !== "string" || !dockerSubstrate.daemonId || /[\0\n\r]/.test(dockerSubstrate.daemonId) || !isRecord(dockerConfiguration) || typeof dockerConfiguration.executable !== "string" || !path14.isAbsolute(dockerConfiguration.executable) || /[\0\n\r]/.test(dockerConfiguration.executable) || typeof dockerConfiguration.host !== "string" || !dockerConfiguration.host.startsWith("unix:///") || !path14.isAbsolute(dockerConfiguration.host.slice("unix://".length)) || /[\0\n\r]/.test(dockerConfiguration.host) || typeof record.user !== "string" || !/^\d+:\d+$/.test(record.user) || record.entrypoint !== "/bin/sh" || record.capDropAll !== true || record.noNewPrivileges !== true || record.logDriver !== "none" || record.proxyEnvironment !== "neutralized-empty" || typeof record.probedAt !== "string" || typeof record.expiresAt !== "string") {
     return false;
   }
   const probedAt = Date.parse(record.probedAt);
@@ -4631,7 +4733,7 @@ async function verifySignedBoundaryAttestation(params) {
   return record.attestation;
 }
 async function readSignedAttestationFile(filePath) {
-  return JSON.parse(await readFile4(filePath, "utf8"));
+  return JSON.parse(await readFile5(filePath, "utf8"));
 }
 
 // src/core/capability/boundary-egress.ts
@@ -4800,13 +4902,13 @@ async function runWithBoundaryRunnable(target, params) {
 }
 
 // src/core/capability/boundary-session.ts
-import path24 from "node:path";
+import path25 from "node:path";
 
 // src/services/egress-service.ts
-import { existsSync as existsSync5, readFileSync as readFileSync2 } from "node:fs";
-import { mkdir as mkdir4, readFile as readFile5, unlink as unlink3, writeFile as writeFile3 } from "node:fs/promises";
+import { existsSync as existsSync6, readFileSync as readFileSync2 } from "node:fs";
+import { mkdir as mkdir5, readFile as readFile6, unlink as unlink4, writeFile as writeFile3 } from "node:fs/promises";
 import net from "node:net";
-import path14 from "node:path";
+import path15 from "node:path";
 init_config_io();
 init_config();
 
@@ -4819,16 +4921,16 @@ function egressStatePaths(repoRoot, config) {
   const stateDir = belayStateDir(config, repoLocalStateDirFor(repoRoot, config));
   return {
     stateDir,
-    pidPath: path14.join(stateDir, "egress-proxy.pid"),
-    statusPath: path14.join(stateDir, "egress-proxy.json")
+    pidPath: path15.join(stateDir, "egress-proxy.pid"),
+    statusPath: path15.join(stateDir, "egress-proxy.json")
   };
 }
 async function readStatusFile(statusPath) {
-  if (!existsSync5(statusPath)) {
+  if (!existsSync6(statusPath)) {
     return null;
   }
   try {
-    const raw = JSON.parse(await readFile5(statusPath, "utf8"));
+    const raw = JSON.parse(await readFile6(statusPath, "utf8"));
     if (typeof raw.pid !== "number") {
       return null;
     }
@@ -4846,9 +4948,9 @@ async function readStatusFile(statusPath) {
 async function isPortOpen(host, port) {
   return new Promise((resolve) => {
     const socket = net.createConnection({ host, port });
-    const finish = (open6) => {
+    const finish = (open7) => {
       socket.destroy();
-      resolve(open6);
+      resolve(open7);
     };
     socket.setTimeout(300);
     socket.on("connect", () => finish(true));
@@ -4859,7 +4961,7 @@ async function isPortOpen(host, port) {
 async function resolveLiveEgressStatus(repoRoot, config) {
   const { statusPath } = egressStatePaths(repoRoot, config);
   const statusCandidates = [statusPath];
-  const controlPlaneStatus = path14.join(configuredControlPlaneDir(config), "egress-proxy.json");
+  const controlPlaneStatus = path15.join(configuredControlPlaneDir(config), "egress-proxy.json");
   if (!statusCandidates.includes(controlPlaneStatus)) {
     statusCandidates.push(controlPlaneStatus);
   }
@@ -4885,7 +4987,7 @@ function isProcessAlive(pid) {
   }
 }
 async function egressStatus(options = {}) {
-  const repoRoot = path14.resolve(options.targetDir ?? process.cwd());
+  const repoRoot = path15.resolve(options.targetDir ?? process.cwd());
   const config = await loadConfigFile(repoRoot);
   const { status, host, port, portOccupied } = await resolveLiveEgressStatus(repoRoot, config);
   const ownedRunning = Boolean(status);
@@ -4916,7 +5018,7 @@ init_config();
 import { createHash as createHash8, randomUUID as randomUUID2 } from "node:crypto";
 import { createReadStream as createReadStream2 } from "node:fs";
 import { access as access2, constants as constants2, lstat as lstat4, mkdtemp as mkdtemp2, realpath as realpath2, rm as rm2 } from "node:fs/promises";
-import path19 from "node:path";
+import path20 from "node:path";
 init_fingerprint2();
 init_path_utils();
 
@@ -5095,7 +5197,7 @@ function runProcessWithBoundedOutput(file, args, options, timeoutMs, outputPolic
 }
 
 // src/core/contained-execution/docker-policy.ts
-import path15 from "node:path";
+import path16 from "node:path";
 
 // src/core/contained-execution/policy.ts
 var CONTAINED_EXECUTION_APPROVAL_FALLBACK_REASONS = [
@@ -5224,7 +5326,7 @@ var PROXY_ENV_NAMES = [
 var IMAGE_ID_PATTERN = /^sha256:[a-f0-9]{64}$/;
 var SAFE_CONTAINER_NAME = /^belay-contained-[0-9a-f-]{36}$/;
 function assertSafeDockerPath(value, code) {
-  if (!path15.isAbsolute(value) || /[\0\n\r,]/.test(value)) {
+  if (!path16.isAbsolute(value) || /[\0\n\r,]/.test(value)) {
     throw new ContainedExecutionFailureError(code);
   }
 }
@@ -5303,11 +5405,11 @@ init_path_utils();
 import { createHash as createHash7 } from "node:crypto";
 import { constants as fsConstants } from "node:fs";
 import {
-  chmod as chmod2,
+  chmod as chmod3,
   lstat as lstat3,
-  mkdir as mkdir5,
+  mkdir as mkdir6,
   mkdtemp,
-  open as open3,
+  open as open4,
   opendir,
   readlink as readlink2,
   realpath,
@@ -5315,41 +5417,41 @@ import {
   symlink
 } from "node:fs/promises";
 import os from "node:os";
-import path18 from "node:path";
+import path19 from "node:path";
 
 // src/core/transactional/file-tree.ts
 import { createHash as createHash6 } from "node:crypto";
 import { lstat as lstat2, readdir } from "node:fs/promises";
-import path17 from "node:path";
+import path18 from "node:path";
 
 // src/core/transactional/file-tree-path.ts
 init_path_utils();
-import path16 from "node:path";
+import path17 from "node:path";
 var FILE_CHECKPOINT_PATH_ESCAPE = "file_checkpoint_path_escape";
 function validateRelativePath(relativePath) {
   if (!relativePath || relativePath.includes("\0")) {
     throw new Error(FILE_CHECKPOINT_PATH_ESCAPE);
   }
-  if (path16.isAbsolute(relativePath)) {
+  if (path17.isAbsolute(relativePath)) {
     throw new Error(FILE_CHECKPOINT_PATH_ESCAPE);
   }
   if (isPathOutsideRoot(relativePath)) {
     throw new Error(FILE_CHECKPOINT_PATH_ESCAPE);
   }
-  const normalized = path16.normalize(relativePath);
-  if (normalized === ".." || normalized.startsWith(`..${path16.sep}`)) {
+  const normalized = path17.normalize(relativePath);
+  if (normalized === ".." || normalized.startsWith(`..${path17.sep}`)) {
     throw new Error(FILE_CHECKPOINT_PATH_ESCAPE);
   }
 }
 function joinRelativePath(root, relativePath) {
   validateRelativePath(relativePath);
-  return path16.join(canonicalPath(root), relativePath);
+  return path17.join(canonicalPath(root), relativePath);
 }
 function isRootGitMetadataPath(relativePath) {
-  return relativePath === ".git" || relativePath.startsWith(`.git${path16.sep}`);
+  return relativePath === ".git" || relativePath.startsWith(`.git${path17.sep}`);
 }
 function isNestedGitPath(relativePath) {
-  const segments = relativePath.split(path16.sep).filter(Boolean);
+  const segments = relativePath.split(path17.sep).filter(Boolean);
   if (segments.length === 0) {
     return false;
   }
@@ -5516,7 +5618,7 @@ async function readPresentNode(absolutePath, counters) {
 async function walkDirectory(resourceRoot, relativeDir, excludedRoots, counters, quotas, deadlineMs, entries) {
   assertWithinDeadline(deadlineMs);
   assertWithinQuotas(counters, quotas);
-  const absoluteDir = relativeDir ? joinRelativePath(resourceRoot, relativeDir) : path17.resolve(resourceRoot);
+  const absoluteDir = relativeDir ? joinRelativePath(resourceRoot, relativeDir) : path18.resolve(resourceRoot);
   const dirInfo = await lstat2(absoluteDir);
   if (!dirInfo.isDirectory()) {
     throw new Error(FILE_CHECKPOINT_UNSUPPORTED_NODE);
@@ -5542,7 +5644,7 @@ async function walkDirectory(resourceRoot, relativeDir, excludedRoots, counters,
   const names = await readdir(absoluteDir);
   for (const name of names) {
     assertWithinDeadline(deadlineMs);
-    const childRelative = relativeDir ? path17.join(relativeDir, name) : name;
+    const childRelative = relativeDir ? path18.join(relativeDir, name) : name;
     validateRelativePath(childRelative);
     if (isNestedGitPath(childRelative)) {
       throw new Error(FILE_CHECKPOINT_NESTED_REPOSITORY);
@@ -5550,7 +5652,7 @@ async function walkDirectory(resourceRoot, relativeDir, excludedRoots, counters,
     if (isExcludedTreePath(childRelative, excludedRoots, resourceRoot)) {
       continue;
     }
-    const childAbsolute = path17.join(absoluteDir, name);
+    const childAbsolute = path18.join(absoluteDir, name);
     const childInfo = await lstat2(childAbsolute);
     if (childInfo.isDirectory() && !childInfo.isSymbolicLink()) {
       await walkDirectory(
@@ -5661,16 +5763,16 @@ function validateContainedExecutionMirrorLease(handle, expected) {
   );
 }
 var productionDependencies = {
-  makeTempRoot: () => mkdtemp(path18.join(os.tmpdir(), "belay-contained-mirror-")),
+  makeTempRoot: () => mkdtemp(path19.join(os.tmpdir(), "belay-contained-mirror-")),
   removeRoot: (root) => rm(root, { recursive: true, force: true }),
   now: () => Date.now()
 };
 function isAtOrWithin(root, target) {
-  const relative = path18.relative(root, target);
-  return relative === "" || !path18.isAbsolute(relative) && relative !== ".." && !relative.startsWith(`..${path18.sep}`);
+  const relative = path19.relative(root, target);
+  return relative === "" || !path19.isAbsolute(relative) && relative !== ".." && !relative.startsWith(`..${path19.sep}`);
 }
 function isGitMetadataRelativePath(relativePath) {
-  return relativePath.split(path18.sep).some((segment) => segment.toLowerCase() === ".git");
+  return relativePath.split(path19.sep).some((segment) => segment.toLowerCase() === ".git");
 }
 function identityFromStats(stats) {
   return {
@@ -5752,7 +5854,7 @@ async function readStableFile(absolutePath, context) {
   if (before.nlink > 1n) {
     throw new Error(FILE_CHECKPOINT_HARDLINK_UNSUPPORTED);
   }
-  const source = await open3(absolutePath, safeReadFlags());
+  const source = await open4(absolutePath, safeReadFlags());
   try {
     const opened = await source.stat({ bigint: true });
     assertRegularSingleLinkBigInt(opened);
@@ -5807,7 +5909,7 @@ function addMetadataRoots(context, directoryPath) {
   }
 }
 function pathMatchesRoots(absolutePath, roots) {
-  const lexical = path18.resolve(absolutePath);
+  const lexical = path19.resolve(absolutePath);
   const canonical = canonicalPath(absolutePath);
   for (const root of roots) {
     if (isAtOrWithin(root, lexical) || isAtOrWithin(root, canonical)) {
@@ -5817,7 +5919,7 @@ function pathMatchesRoots(absolutePath, roots) {
   return false;
 }
 function pathLexicallyMatchesRoots(absolutePath, roots) {
-  const lexical = path18.resolve(absolutePath);
+  const lexical = path19.resolve(absolutePath);
   for (const root of roots) {
     if (isAtOrWithin(root, lexical)) {
       return true;
@@ -5838,11 +5940,11 @@ async function readSafeSymlink(absolutePath, context) {
   }
   const identity = identityFromStats(before);
   const target = await readlink2(absolutePath);
-  if (path18.isAbsolute(target)) {
+  if (path19.isAbsolute(target)) {
     throw new ContainedExecutionFailureError(CONTAINED_EXECUTION_UNSAFE_SYMLINK);
   }
-  const lexicalTarget = path18.resolve(path18.dirname(absolutePath), target);
-  if (!isAtOrWithin(context.sourceRoot, lexicalTarget) || isGitMetadataRelativePath(path18.relative(context.sourceRoot, lexicalTarget)) || pathMatchesRoots(lexicalTarget, context.protectedRoots) || pathMatchesRoots(lexicalTarget, context.metadataRoots)) {
+  const lexicalTarget = path19.resolve(path19.dirname(absolutePath), target);
+  if (!isAtOrWithin(context.sourceRoot, lexicalTarget) || isGitMetadataRelativePath(path19.relative(context.sourceRoot, lexicalTarget)) || pathMatchesRoots(lexicalTarget, context.protectedRoots) || pathMatchesRoots(lexicalTarget, context.metadataRoots)) {
     throw new ContainedExecutionFailureError(CONTAINED_EXECUTION_UNSAFE_SYMLINK);
   }
   let resolvedTarget;
@@ -5878,7 +5980,7 @@ async function walkDirectory2(relativeDirectory, entries, context) {
     throw new ContainedExecutionFailureError(CONTAINED_EXECUTION_SOURCE_CHANGED);
   }
   const directoryFlags = safeReadFlags() | (fsConstants.O_DIRECTORY ?? 0);
-  const directory = await open3(absoluteDirectory, directoryFlags);
+  const directory = await open4(absoluteDirectory, directoryFlags);
   try {
     const opened = await directory.stat({ bigint: true });
     if (!opened.isDirectory() || !identitiesEqual(beforeIdentity, identityFromStats(opened))) {
@@ -5887,7 +5989,7 @@ async function walkDirectory2(relativeDirectory, entries, context) {
     const entriesDirectory = await opendir(absoluteDirectory, { bufferSize: 32 });
     for await (const directoryEntry of entriesDirectory) {
       assertDeadline(context.deadlineMs, context.now);
-      const relativePath = relativeDirectory ? path18.join(relativeDirectory, directoryEntry.name) : directoryEntry.name;
+      const relativePath = relativeDirectory ? path19.join(relativeDirectory, directoryEntry.name) : directoryEntry.name;
       const absolutePath = joinRelativePath(context.sourceRoot, relativePath);
       const info = await lstat3(absolutePath);
       if (info.isSymbolicLink()) {
@@ -5971,7 +6073,7 @@ async function copyStableRegularFile(sourcePath, destinationPath, entry, context
   }
   assertEntryIdentity(entry, identityFromStats(before));
   await context.beforeCopyOpen?.(sourcePath);
-  const source = await open3(sourcePath, safeReadFlags());
+  const source = await open4(sourcePath, safeReadFlags());
   let destination;
   try {
     const opened = await source.stat({ bigint: true });
@@ -5981,8 +6083,8 @@ async function copyStableRegularFile(sourcePath, destinationPath, entry, context
     if (entry.node.kind !== "file") {
       throw new ContainedExecutionFailureError(CONTAINED_EXECUTION_SOURCE_CHANGED);
     }
-    await mkdir5(path18.dirname(destinationPath), { recursive: true, mode: 448 });
-    destination = await open3(
+    await mkdir6(path19.dirname(destinationPath), { recursive: true, mode: 448 });
+    destination = await open4(
       destinationPath,
       fsConstants.O_WRONLY | fsConstants.O_CREAT | fsConstants.O_EXCL,
       safePermissionMode(opened.mode)
@@ -6024,7 +6126,7 @@ async function copyStableRegularFile(sourcePath, destinationPath, entry, context
   if (entry.node.kind !== "file") {
     throw new ContainedExecutionFailureError(CONTAINED_EXECUTION_SOURCE_CHANGED);
   }
-  await chmod2(destinationPath, safePermissionMode(entry.node.mode));
+  await chmod3(destinationPath, safePermissionMode(entry.node.mode));
 }
 async function materializeSnapshot(sourceRoot, destinationRoot, snapshot, context) {
   const directoryEntries = [];
@@ -6033,7 +6135,7 @@ async function materializeSnapshot(sourceRoot, destinationRoot, snapshot, contex
     const sourcePath = joinRelativePath(sourceRoot, entry.relativePath);
     const destinationPath = joinRelativePath(destinationRoot, entry.relativePath);
     if (entry.node.kind === "directory") {
-      await mkdir5(destinationPath, { recursive: true, mode: 448 });
+      await mkdir6(destinationPath, { recursive: true, mode: 448 });
       directoryEntries.push(entry);
       continue;
     }
@@ -6045,7 +6147,7 @@ async function materializeSnapshot(sourceRoot, destinationRoot, snapshot, contex
       if (current !== entry.node.target) {
         throw new ContainedExecutionFailureError(CONTAINED_EXECUTION_SOURCE_CHANGED);
       }
-      await mkdir5(path18.dirname(destinationPath), { recursive: true, mode: 448 });
+      await mkdir6(path19.dirname(destinationPath), { recursive: true, mode: 448 });
       await symlink(entry.node.target, destinationPath);
       continue;
     }
@@ -6055,12 +6157,12 @@ async function materializeSnapshot(sourceRoot, destinationRoot, snapshot, contex
     if (entry.node.kind !== "directory") {
       throw new ContainedExecutionFailureError(CONTAINED_EXECUTION_SOURCE_CHANGED);
     }
-    await chmod2(
+    await chmod3(
       joinRelativePath(destinationRoot, entry.relativePath),
       safePermissionMode(entry.node.mode)
     );
   }
-  await chmod2(destinationRoot, 448);
+  await chmod3(destinationRoot, 448);
 }
 async function assertStableCopiedSnapshot(sourceRoot, destinationRoot, protectedRoots, limits, deadlineMs, now, before) {
   const [after, copied] = await Promise.all([
@@ -6105,7 +6207,7 @@ async function cleanupOwnedRoot(root, dependencies) {
 }
 async function prepareWithDependencies(options, dependencies) {
   validateOptions(options);
-  const guestWorkspacePath = path18.resolve(options.sourceRoot);
+  const guestWorkspacePath = path19.resolve(options.sourceRoot);
   const sourceRoot = canonicalPath(options.sourceRoot);
   const protectedRoots = options.controlPlaneRoots.map((root) => canonicalPath(root));
   if (pathMatchesRoots(sourceRoot, protectedRoots)) {
@@ -6113,7 +6215,7 @@ async function prepareWithDependencies(options, dependencies) {
   }
   const guestRoot = await dependencies.makeTempRoot();
   try {
-    await chmod2(guestRoot, 448);
+    await chmod3(guestRoot, 448);
     const deadlineMs = dependencies.now() + options.limits.prepareTimeoutMs;
     const before = await buildSafeMirrorSnapshot(
       sourceRoot,
@@ -6141,7 +6243,7 @@ async function prepareWithDependencies(options, dependencies) {
       dependencies.now,
       before
     );
-    await chmod2(guestRoot, 448);
+    await chmod3(guestRoot, 448);
     const lease = {
       sourceRoot,
       hostMirrorRoot: guestRoot,
@@ -6275,14 +6377,14 @@ async function digestFile(file) {
   return hash.digest("hex");
 }
 async function resolveConfiguredDockerSubstrate(params) {
-  if (!path19.isAbsolute(params.executable) || /[\0\n\r]/.test(params.executable)) {
+  if (!path20.isAbsolute(params.executable) || /[\0\n\r]/.test(params.executable)) {
     throw new ContainedDockerBoundaryUnavailableError("contained_execution_docker_binary_invalid");
   }
   if (!params.host.startsWith("unix:///") || /[\0\n\r]/.test(params.host)) {
     throw new ContainedDockerBoundaryUnavailableError("contained_execution_docker_host_invalid");
   }
   const configuredSocket = params.host.slice("unix://".length);
-  if (!path19.isAbsolute(configuredSocket)) {
+  if (!path20.isAbsolute(configuredSocket)) {
     throw new ContainedDockerBoundaryUnavailableError("contained_execution_docker_host_invalid");
   }
   let binaryPath;
@@ -6543,7 +6645,7 @@ async function validatedGuestCwd(params) {
   const requiredExclusions = [
     ...new Set([params.controlPlaneDir, ...params.protectedRoots].map(canonicalPath))
   ];
-  if (params.mirror.backend !== "file_copy" || params.mirror.guestWorkspacePath !== path19.resolve(params.repoRoot) || !path19.isAbsolute(params.guestCwd) || !pathWithinRoot(params.mirror.guestWorkspacePath, params.guestCwd))
+  if (params.mirror.backend !== "file_copy" || params.mirror.guestWorkspacePath !== path20.resolve(params.repoRoot) || !path20.isAbsolute(params.guestCwd) || !pathWithinRoot(params.mirror.guestWorkspacePath, params.guestCwd))
     throw new ContainedExecutionFailureError("contained_execution_invalid_cwd");
   const resolvedRoot = await realpath2(params.mirror.hostMirrorRoot);
   const protectedRoots = [canonicalPath(params.repoRoot), ...requiredExclusions];
@@ -6555,10 +6657,10 @@ async function validatedGuestCwd(params) {
     protectedRoots: requiredExclusions
   }))
     throw new ContainedExecutionFailureError("contained_execution_invalid_mirror_lease");
-  const relative = path19.relative(params.mirror.guestWorkspacePath, path19.resolve(params.guestCwd));
+  const relative = path20.relative(params.mirror.guestWorkspacePath, path20.resolve(params.guestCwd));
   let resolvedCwd;
   try {
-    resolvedCwd = await realpath2(path19.join(resolvedRoot, relative));
+    resolvedCwd = await realpath2(path20.join(resolvedRoot, relative));
   } catch {
     throw new ContainedExecutionFailureError("contained_execution_invalid_cwd");
   }
@@ -6566,7 +6668,7 @@ async function validatedGuestCwd(params) {
   if (!info.isDirectory() || !pathWithinRoot(resolvedRoot, resolvedCwd)) {
     throw new ContainedExecutionFailureError("contained_execution_invalid_cwd");
   }
-  return path19.join(params.mirror.guestWorkspacePath, path19.relative(resolvedRoot, resolvedCwd));
+  return path20.join(params.mirror.guestWorkspacePath, path20.relative(resolvedRoot, resolvedCwd));
 }
 function exactKeys(value, allowed) {
   const names = new Set(allowed);
@@ -6793,19 +6895,19 @@ async function executeContainedDocker(params) {
 init_path_utils();
 import { spawn as spawn3 } from "node:child_process";
 import os3 from "node:os";
-import path21 from "node:path";
+import path22 from "node:path";
 
 // src/core/transactional/apply-observed-changes.ts
-import { copyFile, lstat as lstat5, mkdir as mkdir6, mkdtemp as mkdtemp3, readlink as readlink3, rm as rm3, rmdir, symlink as symlink2 } from "node:fs/promises";
+import { copyFile, lstat as lstat5, mkdir as mkdir7, mkdtemp as mkdtemp3, readlink as readlink3, rm as rm3, rmdir, symlink as symlink2 } from "node:fs/promises";
 import os2 from "node:os";
-import path20 from "node:path";
+import path21 from "node:path";
 var TRANSACTIONAL_APPLY_TOCTOU = "transactional_apply_toctou";
 var TRANSACTIONAL_APPLY_CONFLICT = "transactional_apply_conflict";
 var TRANSACTIONAL_APPLY_ROLLBACK_FAILED = "transactional_apply_rollback_failed";
 async function chmodSafe(target, mode) {
   try {
-    const { chmod: chmod4 } = await import("node:fs/promises");
-    await chmod4(target, mode & 511);
+    const { chmod: chmod5 } = await import("node:fs/promises");
+    await chmod5(target, mode & 511);
   } catch {
   }
 }
@@ -6839,13 +6941,13 @@ async function copyPathPreservingType(source, target) {
     }
   }
   await removePathIfExists(target);
-  await mkdir6(path20.dirname(target), { recursive: true });
+  await mkdir7(path21.dirname(target), { recursive: true });
   if (info.isSymbolicLink()) {
     await symlink2(await readlink3(source), target);
     return;
   }
   if (info.isDirectory() && !info.isSymbolicLink()) {
-    await mkdir6(target, { recursive: true, mode: info.mode & 511 });
+    await mkdir7(target, { recursive: true, mode: info.mode & 511 });
     return;
   }
   if (!info.isFile()) {
@@ -6855,12 +6957,12 @@ async function copyPathPreservingType(source, target) {
   await chmodSafe(target, info.mode);
 }
 async function assertParentChainSafe(targetRoot, relativePath, plannedDirectories = /* @__PURE__ */ new Set()) {
-  const segments = relativePath.split(path20.sep).filter(Boolean);
+  const segments = relativePath.split(path21.sep).filter(Boolean);
   if (segments.length <= 1) {
     return;
   }
   for (let index = 1; index < segments.length; index++) {
-    const prefix = segments.slice(0, index).join(path20.sep);
+    const prefix = segments.slice(0, index).join(path21.sep);
     const absolute = joinRelativePath(targetRoot, prefix);
     let info;
     try {
@@ -6880,8 +6982,8 @@ async function assertParentChainSafe(targetRoot, relativePath, plannedDirectorie
   }
 }
 async function restorePathFromBackup(backupPath, target, rollbackRoot) {
-  const stagingRoot = await mkdtemp3(path20.join(rollbackRoot, "restore-"));
-  const staged = path20.join(stagingRoot, "node");
+  const stagingRoot = await mkdtemp3(path21.join(rollbackRoot, "restore-"));
+  const staged = path21.join(stagingRoot, "node");
   try {
     await copyPathPreservingType(backupPath, staged);
     await copyPathPreservingType(staged, target);
@@ -6965,7 +7067,7 @@ async function applySingleChange(sourceRoot, targetRoot, change) {
     if (change.before.kind !== "directory") {
       await removePathIfExists(target);
     }
-    await mkdir6(target, { recursive: true, mode: change.after.mode & 511 });
+    await mkdir7(target, { recursive: true, mode: change.after.mode & 511 });
     await chmodSafe(target, change.after.mode);
     return;
   }
@@ -6984,7 +7086,7 @@ async function applyObservedChanges(params) {
     await assertParentChainSafe(targetRoot, change.relativePath, plannedDirectories);
     await assertTargetMatches(targetRoot, change);
   }
-  const backupRoot = await mkdtemp3(path20.join(os2.tmpdir(), "belay-tx-rollback-"));
+  const backupRoot = await mkdtemp3(path21.join(os2.tmpdir(), "belay-tx-rollback-"));
   const rollbackActions = [];
   let mutationAttempted = false;
   let resourceIdentityChanged = false;
@@ -7003,12 +7105,12 @@ async function applyObservedChanges(params) {
         targetExists = false;
       }
       if (targetExists) {
-        const backupPath = path20.join(
+        const backupPath = path21.join(
           backupRoot,
           String(rollbackActions.length),
           change.relativePath
         );
-        await mkdir6(path20.dirname(backupPath), { recursive: true });
+        await mkdir7(path21.dirname(backupPath), { recursive: true });
         await copyPathPreservingType(target, backupPath);
         await assertParentChainSafe(targetRoot, change.relativePath);
         rollbackActions.push({
@@ -7107,7 +7209,7 @@ function isIgnoredDirtyPath(repoRoot, relativePath, ignoreRoots) {
   if (ignoreRoots.length === 0) {
     return false;
   }
-  const absolutePath = canonicalPath(path21.join(repoRoot, relativePath));
+  const absolutePath = canonicalPath(path22.join(repoRoot, relativePath));
   return ignoreRoots.some(
     (root) => pathWithinRoot(root, absolutePath) || root === absolutePath || pathWithinRoot(absolutePath, root)
   );
@@ -7145,7 +7247,7 @@ async function isDirtyWorktree(repoRoot, options) {
 }
 async function createGitWorktreeSnapshot(repoRoot, _stateDir) {
   const { mkdtemp: mkdtemp6, rm: rm10 } = await import("node:fs/promises");
-  const worktreePath = await mkdtemp6(path21.join(os3.tmpdir(), "belay-tx-"));
+  const worktreePath = await mkdtemp6(path22.join(os3.tmpdir(), "belay-tx-"));
   await execGit(repoRoot, ["worktree", "add", "--detach", worktreePath, "HEAD"]);
   return {
     worktreePath,
@@ -7164,14 +7266,14 @@ async function createGitWorktreeSnapshot(repoRoot, _stateDir) {
 }
 function resolveWorktreeCwd(repoRoot, worktreePath, cwd) {
   const resolvedCwd = canonicalPath(cwd);
-  const relative = path21.relative(canonicalPath(repoRoot), resolvedCwd);
-  if (isPathOutsideRoot(relative) || path21.isAbsolute(relative)) {
+  const relative = path22.relative(canonicalPath(repoRoot), resolvedCwd);
+  if (isPathOutsideRoot(relative) || path22.isAbsolute(relative)) {
     return worktreePath;
   }
   if (relative === "") {
     return worktreePath;
   }
-  return path21.join(worktreePath, relative);
+  return path22.join(worktreePath, relative);
 }
 function runShellCommand(command, cwd, timeoutMs) {
   return runProcessWithBoundedOutput(command, [], { cwd, shell: true, env: process.env }, timeoutMs);
@@ -7236,7 +7338,7 @@ import { spawn as spawn4 } from "node:child_process";
 import { randomUUID as randomUUID3 } from "node:crypto";
 
 // src/core/capability/boundary-grant-materialize.ts
-import path22 from "node:path";
+import path23 from "node:path";
 
 // src/core/glob.ts
 init_approval();
@@ -7396,7 +7498,7 @@ function grantMatchesRequest(grant, request) {
 var BOUNDARY_GRANT_TTL_MS = 15 * 6e4;
 var BOUNDARY_GRANT_ISSUER_CONTAINER = "boundary:container";
 function resolveCapabilityPath(targetPath, cwd) {
-  const joined = path22.isAbsolute(targetPath) ? targetPath : path22.join(cwd, targetPath);
+  const joined = path23.isAbsolute(targetPath) ? targetPath : path23.join(cwd, targetPath);
   return canonicalPath(joined);
 }
 function isPathWithinBoundaryMount(request) {
@@ -7471,7 +7573,7 @@ function materializeContainerBoundaryGrant(request, params) {
 
 // src/core/capability/boundary-workspace-mount.ts
 init_path_utils();
-import path23 from "node:path";
+import path24 from "node:path";
 var HOST_PATH_ENV_VARS = [
   "BELAY_EGRESS_REPO_ROOT",
   "BELAY_JUDGE_BROKER_REPO_ROOT",
@@ -7496,23 +7598,23 @@ function validateWorkspaceMount(mount) {
   if (mount.cwdRelative.includes("\0")) {
     throw new Error("boundary_workspace_mount_invalid_cwd");
   }
-  const normalizedRelative = path23.posix.normalize(mount.cwdRelative.replace(/\\/g, "/"));
+  const normalizedRelative = path24.posix.normalize(mount.cwdRelative.replace(/\\/g, "/"));
   if (normalizedRelative === ".." || normalizedRelative.startsWith("../")) {
     throw new Error("boundary_workspace_mount_invalid_cwd");
   }
-  if (path23.posix.isAbsolute(normalizedRelative)) {
+  if (path24.posix.isAbsolute(normalizedRelative)) {
     throw new Error("boundary_workspace_mount_invalid_cwd");
   }
 }
 function resolveGuestWorkdir(mount) {
   validateWorkspaceMount(mount);
   const guestTargetRoot = canonicalPath(mount.guestTargetRoot);
-  const normalizedRelative = path23.posix.normalize(mount.cwdRelative.replace(/\\/g, "/"));
+  const normalizedRelative = path24.posix.normalize(mount.cwdRelative.replace(/\\/g, "/"));
   if (normalizedRelative === "." || normalizedRelative === "") {
     return guestTargetRoot;
   }
   const segments = normalizedRelative.split("/").filter(Boolean);
-  return path23.posix.join(guestTargetRoot, ...segments);
+  return path24.posix.join(guestTargetRoot, ...segments);
 }
 function buildWorkspaceMountSpec(mount) {
   validateWorkspaceMount(mount);
@@ -7803,7 +7905,7 @@ function containedExecutionFresh(attestation, config, now = Date.now()) {
 }
 function boundaryAttestationPath(repoRoot, config) {
   const rel = config.capability?.attestationRelPath ?? ".belay/attestation.json";
-  return path24.isAbsolute(rel) ? rel : path24.join(repoRoot, rel);
+  return path25.isAbsolute(rel) ? rel : path25.join(repoRoot, rel);
 }
 async function loadBoundaryAttestation(filePath, expectedRepoRoot, controlPlaneDir) {
   try {
@@ -7908,7 +8010,7 @@ init_capability_request_hash();
 
 // src/core/capability/gate-policy-shadow.ts
 init_config();
-import path29 from "node:path";
+import path30 from "node:path";
 
 // src/core/verdict/judge-outbound.ts
 init_scrub();
@@ -7918,7 +8020,7 @@ init_path_utils();
 
 // src/core/verdict/containment.ts
 init_git_resource_identity();
-import path25 from "node:path";
+import path26 from "node:path";
 init_path_utils();
 
 // src/core/verdict/persistent-paths.ts
@@ -7938,7 +8040,7 @@ function expandHome(token) {
     if (!home) {
       return token;
     }
-    return token === "~" ? home : path25.join(home, token.slice(2));
+    return token === "~" ? home : path26.join(home, token.slice(2));
   }
   return token;
 }
@@ -7950,10 +8052,10 @@ function resolveTrustedPath(token, trustedCwd, trusted) {
     return null;
   }
   const expanded = expandHome(token);
-  if (path25.isAbsolute(expanded)) {
+  if (path26.isAbsolute(expanded)) {
     return canonicalPath(expanded);
   }
-  return canonicalPath(path25.resolve(trustedCwd, expanded));
+  return canonicalPath(path26.resolve(trustedCwd, expanded));
 }
 function isGitPath(resolvedPath, repoRoot) {
   if (isGitMetadataPath(resolvedPath, repoRoot)) {
@@ -8070,20 +8172,20 @@ function parseTier1Json(raw) {
 init_judge_runtime_config();
 
 // src/core/verdict/judge-session-kill-switch.ts
-import { existsSync as existsSync6 } from "node:fs";
-import { mkdir as mkdir7, readFile as readFile6, unlink as unlink4, writeFile as writeFile4 } from "node:fs/promises";
-import path26 from "node:path";
+import { existsSync as existsSync7 } from "node:fs";
+import { mkdir as mkdir8, readFile as readFile7, unlink as unlink5, writeFile as writeFile4 } from "node:fs/promises";
+import path27 from "node:path";
 var JUDGE_SESSION_KILL_FILE = "judge-session-kill.json";
 function judgeSessionKillSwitchPath(stateDir) {
-  return path26.join(stateDir, JUDGE_SESSION_KILL_FILE);
+  return path27.join(stateDir, JUDGE_SESSION_KILL_FILE);
 }
 async function readJudgeSessionKillSwitch(stateDir) {
   const filePath = judgeSessionKillSwitchPath(stateDir);
-  if (!existsSync6(filePath)) {
+  if (!existsSync7(filePath)) {
     return null;
   }
   try {
-    const raw = JSON.parse(await readFile6(filePath, "utf8"));
+    const raw = JSON.parse(await readFile7(filePath, "utf8"));
     return raw.triggered === true ? raw : null;
   } catch {
     return null;
@@ -8094,7 +8196,7 @@ async function isJudgeSessionKillSwitchPersisted(stateDir) {
   return record?.triggered === true;
 }
 async function persistJudgeSessionKillSwitch(stateDir, reason = "shadow_mismatch") {
-  await mkdir7(stateDir, { recursive: true, mode: 448 });
+  await mkdir8(stateDir, { recursive: true, mode: 448 });
   const record = {
     triggered: true,
     at: (/* @__PURE__ */ new Date()).toISOString(),
@@ -8255,10 +8357,10 @@ function recordJudgeLatency(phase, latencyMs, at = Date.now()) {
 
 // src/core/verdict/judge-broker-service.ts
 import { spawn as spawn6 } from "node:child_process";
-import { existsSync as existsSync7 } from "node:fs";
-import { unlink as unlink5 } from "node:fs/promises";
+import { existsSync as existsSync8 } from "node:fs";
+import { unlink as unlink6 } from "node:fs/promises";
 import net2 from "node:net";
-import path27 from "node:path";
+import path28 from "node:path";
 import { fileURLToPath } from "node:url";
 
 // src/core/verdict/judge-cli.ts
@@ -8804,10 +8906,10 @@ var JUDGE_BROKER_SESSION = "judge-broker-session.json";
 function judgeBrokerPaths(stateDir) {
   return {
     stateDir,
-    socketPath: path27.join(stateDir, JUDGE_BROKER_SOCKET),
-    statusPath: path27.join(stateDir, JUDGE_BROKER_STATUS),
-    pidPath: path27.join(stateDir, JUDGE_BROKER_PID),
-    sessionConfigPath: path27.join(stateDir, JUDGE_BROKER_SESSION)
+    socketPath: path28.join(stateDir, JUDGE_BROKER_SOCKET),
+    statusPath: path28.join(stateDir, JUDGE_BROKER_STATUS),
+    pidPath: path28.join(stateDir, JUDGE_BROKER_PID),
+    sessionConfigPath: path28.join(stateDir, JUDGE_BROKER_SESSION)
   };
 }
 function daemonScriptPath() {
@@ -8825,12 +8927,12 @@ function useInProcessBroker(env = process.env) {
   return Boolean(env.VITEST || env.VITEST_WORKER_ID || env.BELAY_JUDGE_BROKER_IN_PROCESS === "1");
 }
 async function readBrokerStatus(statusPath) {
-  if (!existsSync7(statusPath)) {
+  if (!existsSync8(statusPath)) {
     return null;
   }
   try {
-    const { readFile: readFile16 } = await import("node:fs/promises");
-    const raw = JSON.parse(await readFile16(statusPath, "utf8"));
+    const { readFile: readFile17 } = await import("node:fs/promises");
+    const raw = JSON.parse(await readFile17(statusPath, "utf8"));
     if (typeof raw.pid !== "number" || typeof raw.socketPath !== "string") {
       return null;
     }
@@ -8840,13 +8942,13 @@ async function readBrokerStatus(statusPath) {
   }
 }
 async function readBrokerSessionConfig(sessionConfigPath) {
-  if (!existsSync7(sessionConfigPath)) {
+  if (!existsSync8(sessionConfigPath)) {
     return null;
   }
   try {
-    const { readFile: readFile16 } = await import("node:fs/promises");
+    const { readFile: readFile17 } = await import("node:fs/promises");
     const raw = JSON.parse(
-      await readFile16(sessionConfigPath, "utf8")
+      await readFile17(sessionConfigPath, "utf8")
     );
     return normalizeJudgeSessionConfig({ ...raw, enabled: true });
   } catch {
@@ -8937,7 +9039,7 @@ async function ensureJudgeBrokerDaemon(stateDir, repoRoot, sessionConfig) {
   const existingConfig = await readBrokerSessionConfig(paths.sessionConfigPath);
   const configChanged = existingConfig !== null && brokerSessionConfigPayload(existingConfig) !== nextConfigPayload;
   const status = await readBrokerStatus(paths.statusPath);
-  if (status && isProcessAlive2(status.pid) && existsSync7(paths.socketPath) && !configChanged) {
+  if (status && isProcessAlive2(status.pid) && existsSync8(paths.socketPath) && !configChanged) {
     await writeBrokerSessionConfig(paths, brokerSessionConfig);
     return paths;
   }
@@ -8959,7 +9061,7 @@ async function ensureJudgeBrokerDaemon(stateDir, repoRoot, sessionConfig) {
   child.unref();
   const deadline = Date.now() + sessionConfig.connectTimeoutMs;
   while (Date.now() < deadline) {
-    if (existsSync7(paths.socketPath)) {
+    if (existsSync8(paths.socketPath)) {
       const live = await readBrokerStatus(paths.statusPath);
       if (live && isProcessAlive2(live.pid)) {
         return paths;
@@ -8976,8 +9078,8 @@ async function cleanupJudgeBrokerArtifacts(paths) {
     paths.pidPath,
     paths.sessionConfigPath
   ]) {
-    if (existsSync7(artifact)) {
-      await unlink5(artifact).catch(() => void 0);
+    if (existsSync8(artifact)) {
+      await unlink6(artifact).catch(() => void 0);
     }
   }
 }
@@ -9473,9 +9575,9 @@ async function evaluateWithJudgeTransport(request, options = {}) {
 }
 
 // src/core/capability/gate-shadow-ratchet.ts
-import { existsSync as existsSync8 } from "node:fs";
-import { mkdir as mkdir8, readFile as readFile7, writeFile as writeFile5 } from "node:fs/promises";
-import path28 from "node:path";
+import { existsSync as existsSync9 } from "node:fs";
+import { mkdir as mkdir9, readFile as readFile8, writeFile as writeFile5 } from "node:fs/promises";
+import path29 from "node:path";
 var DEFAULT_STATE = {
   version: 1,
   policyJudgeComparisons: 0,
@@ -9484,15 +9586,15 @@ var DEFAULT_STATE = {
   updatedAt: (/* @__PURE__ */ new Date(0)).toISOString()
 };
 function ratchetPath(stateDir) {
-  return path28.join(stateDir, "gate-shadow-ratchet.json");
+  return path29.join(stateDir, "gate-shadow-ratchet.json");
 }
 async function loadState(stateDir) {
   const filePath = ratchetPath(stateDir);
-  if (!existsSync8(filePath)) {
+  if (!existsSync9(filePath)) {
     return { ...DEFAULT_STATE, updatedAt: (/* @__PURE__ */ new Date()).toISOString() };
   }
   try {
-    const raw = JSON.parse(await readFile7(filePath, "utf8"));
+    const raw = JSON.parse(await readFile8(filePath, "utf8"));
     return {
       ...DEFAULT_STATE,
       ...raw,
@@ -9503,7 +9605,7 @@ async function loadState(stateDir) {
   }
 }
 async function saveState(stateDir, state) {
-  await mkdir8(stateDir, { recursive: true, mode: 448 });
+  await mkdir9(stateDir, { recursive: true, mode: 448 });
   await writeFile5(
     ratchetPath(stateDir),
     `${JSON.stringify({ ...state, updatedAt: (/* @__PURE__ */ new Date()).toISOString() }, null, 2)}
@@ -9626,7 +9728,7 @@ function scheduleGateShadowAudit(params) {
 async function runGatePolicyShadowComparison(params) {
   const judge = params.config.judge;
   const runtime = normalizeJudgeRuntimeConfig(judge.runtime);
-  const stateDir = params.stateDir ?? belayStateDir(params.config, path29.join(params.repoRoot, ".belay"));
+  const stateDir = params.stateDir ?? belayStateDir(params.config, path30.join(params.repoRoot, ".belay"));
   const transport = await evaluateWithJudgeTransport(
     {
       prompt: buildTier1Prompt(params.command),
@@ -9916,15 +10018,15 @@ async function loadClassifierAuthorization(params) {
 }
 
 // src/core/capability/allowlist.ts
-import { existsSync as existsSync9, readFileSync as readFileSync3 } from "node:fs";
+import { existsSync as existsSync10, readFileSync as readFileSync3 } from "node:fs";
 init_config();
 init_path_utils();
-import path30 from "node:path";
+import path31 from "node:path";
 function fsScopeAllowlistPath(config, repoLocalStateDir) {
-  return path30.join(belayStateDir(config, repoLocalStateDir), "fs-scope-allowlist.json");
+  return path31.join(belayStateDir(config, repoLocalStateDir), "fs-scope-allowlist.json");
 }
 function loadFsScopeAllowlistSync(filePath) {
-  if (!existsSync9(filePath)) {
+  if (!existsSync10(filePath)) {
     return { version: 1, paths: [] };
   }
   const raw = JSON.parse(readFileSync3(filePath, "utf8"));
@@ -10016,7 +10118,7 @@ function checkGatedActionLimits(action) {
 // src/core/capability/paths.ts
 init_path_utils();
 init_shell_tokenizer();
-import path31 from "node:path";
+import path32 from "node:path";
 function applyPatchTargets(patch) {
   const targets = [];
   for (const line of patch.split("\n")) {
@@ -10081,7 +10183,7 @@ function collectOutsideRepoPathsFromToolPayload(payload, cwd, repoRoot, trustedW
   const paths = /* @__PURE__ */ new Set();
   const filePath = extractToolFilePath(payload);
   if (filePath) {
-    const resolved = path31.isAbsolute(filePath) ? filePath : path31.resolve(cwd, filePath);
+    const resolved = path32.isAbsolute(filePath) ? filePath : path32.resolve(cwd, filePath);
     if (resolveWorkspaceRootMatch(repoRoot, trustedWorkspaceRoots, resolved) === null) {
       paths.add(resolved);
     }
@@ -10091,7 +10193,7 @@ function collectOutsideRepoPathsFromToolPayload(payload, cwd, repoRoot, trustedW
     const patch = extractToolPatch(payload);
     if (patch) {
       for (const target of applyPatchTargets(patch)) {
-        const resolved = path31.isAbsolute(target) ? target : path31.resolve(cwd, target);
+        const resolved = path32.isAbsolute(target) ? target : path32.resolve(cwd, target);
         if (resolveWorkspaceRootMatch(repoRoot, trustedWorkspaceRoots, resolved) === null) {
           paths.add(resolved);
         }
@@ -10145,7 +10247,7 @@ function policyReasonToLegacyReason(decision) {
 // src/core/capability/policy-engine.ts
 init_git_resource_identity();
 import { createHash as createHash10 } from "node:crypto";
-import path32 from "node:path";
+import path33 from "node:path";
 init_path_utils();
 init_shell_tokenizer();
 init_grant();
@@ -10437,7 +10539,7 @@ function hashSession(value) {
   return createHash10("sha256").update(value).digest("hex").slice(0, 16);
 }
 function resolveCapabilityPath2(targetPath, cwd) {
-  const joined = path32.isAbsolute(targetPath) ? targetPath : path32.join(cwd, targetPath);
+  const joined = path33.isAbsolute(targetPath) ? targetPath : path33.join(cwd, targetPath);
   return canonicalPath(joined);
 }
 function actionForFileMutation(analysis) {
@@ -10516,7 +10618,7 @@ function isRepoLocalPackageExec(request) {
     return false;
   }
   const commandPath = canonicalPath(request.resource.command);
-  return path32.isAbsolute(commandPath) && pathWithinRoot(request.principal.repoRoot, commandPath);
+  return path33.isAbsolute(commandPath) && pathWithinRoot(request.principal.repoRoot, commandPath);
 }
 function isRepoLocalRoutineWrite(request, sensitivePaths) {
   if (!isRepoLocalShellLocation(request)) {
@@ -10764,6 +10866,40 @@ function evaluateFileMutationPolicy(analysis, config, auth) {
   );
   return { request, decision };
 }
+function buildFileReadCapabilityRequest(analysis) {
+  return {
+    version: CAPABILITY_REQUEST_VERSION,
+    principal: {
+      adapter: analysis.adapter,
+      repoRoot: analysis.repoRoot,
+      sessionHash: hashSession(`${analysis.repoRoot}:${analysis.cwd}`)
+    },
+    action: "fs.read",
+    resource: { kind: "path", path: analysis.resolvedPath },
+    context: {
+      cwd: analysis.cwd,
+      inputFingerprint: analysis.inputFingerprint,
+      hookKind: analysis.hookKind,
+      analysisBasis: [`tool:${analysis.toolKind}`, `location:${analysis.locationLabel}`, "read"]
+    },
+    evidence: {
+      level: analysis.locationLabel === "repo_local" ? "certain" : "possible",
+      signals: [...analysis.signals, "effect.fs_read"]
+    }
+  };
+}
+function evaluateFileReadPolicy(analysis, config, auth) {
+  const request = buildFileReadCapabilityRequest(analysis);
+  const enriched = enrichAuthWithMaterializedGrants(request, config, {
+    ...auth,
+    sensitivePaths: auth?.sensitivePaths ?? analysis.sensitivePaths
+  });
+  const decision = getDefaultPolicyEngine().evaluate(
+    request,
+    buildAuthorizationContext(config, analysis.trustedWorkspaceRoots, enriched)
+  );
+  return { request, decision };
+}
 
 // src/core/capability/reasons.ts
 var FS_SCOPE_REASONS = /* @__PURE__ */ new Set(["outside_repo_mutation", "outside_repo_redirect"]);
@@ -10780,15 +10916,15 @@ function shouldSkipBrokerApprovedRecord(brokerActive, approvalReason) {
 }
 
 // src/core/capability/trusted-workspace-roots.ts
-import { existsSync as existsSync10, readFileSync as readFileSync4, statSync as statSync3 } from "node:fs";
+import { existsSync as existsSync11, readFileSync as readFileSync4, statSync as statSync3 } from "node:fs";
 init_config();
 init_path_utils();
-import path33 from "node:path";
+import path34 from "node:path";
 function trustedWorkspaceRootsPath(config, repoLocalStateDir) {
-  return path33.join(belayStateDir(config, repoLocalStateDir), "trusted-workspace-roots.json");
+  return path34.join(belayStateDir(config, repoLocalStateDir), "trusted-workspace-roots.json");
 }
 function loadTrustedWorkspaceRootsSync(filePath) {
-  if (!existsSync10(filePath)) {
+  if (!existsSync11(filePath)) {
     return { version: 1, roots: [] };
   }
   const raw = JSON.parse(readFileSync4(filePath, "utf8"));
@@ -10814,7 +10950,7 @@ function sanitizeTrustedWorkspaceRootEntries(input) {
     const source = record.source === "approval" ? "approval" : void 0;
     return [
       {
-        path: path33.resolve(record.path),
+        path: path34.resolve(record.path),
         approvedAt,
         approvalId,
         ...source ? { source } : {}
@@ -10843,7 +10979,7 @@ function isDirectoryPath(targetPath) {
 function isBroadTrustedWorkspaceRoot(targetPath) {
   const home = process.env.HOME ?? process.env.USERPROFILE;
   const root = normalizeTrustedWorkspaceRootPath(targetPath);
-  if (root === normalizeTrustedWorkspaceRootPath(path33.parse(root).root)) {
+  if (root === normalizeTrustedWorkspaceRootPath(path34.parse(root).root)) {
     return true;
   }
   if (home && normalizeTrustedWorkspaceRootPath(home) === root) {
@@ -10867,7 +11003,7 @@ function isHighStakesTrustedWorkspaceRoot(targetPath) {
     return false;
   }
   return HOME_HIGH_STAKES_SEGMENTS.some(
-    (segment) => pathWithinRoot(path33.join(homeRoot, segment), normalized)
+    (segment) => pathWithinRoot(path34.join(homeRoot, segment), normalized)
   );
 }
 function validateTrustedWorkspaceRootCandidate(params) {
@@ -10904,7 +11040,7 @@ function validateTrustedWorkspaceRootCandidate(params) {
 init_config_layers();
 
 // src/core/contained-execution/eligibility.ts
-import path34 from "node:path";
+import path35 from "node:path";
 init_path_utils();
 var FORBIDDEN_SIGNALS = /* @__PURE__ */ new Set([
   "command_substitution",
@@ -10921,7 +11057,7 @@ var FORBIDDEN_SIGNALS = /* @__PURE__ */ new Set([
 ]);
 function isContainedUnknownExecutionEligible(config, action, result) {
   const contained = config.sandbox.containedExecution;
-  if (!contained?.enabled || !config.sandbox.enabled || config.sandbox.runtime !== "container" || action.kind !== "shell" || !path34.isAbsolute(action.repoRoot) || !hasResolvedRepoIdentity(action.repoRoot) || !config.gates.shell || result.reason !== "unknown_local_effect" || result.axes?.location !== "repo_local" || result.assessment.external) {
+  if (!contained?.enabled || !config.sandbox.enabled || config.sandbox.runtime !== "container" || action.kind !== "shell" || !path35.isAbsolute(action.repoRoot) || !hasResolvedRepoIdentity(action.repoRoot) || !config.gates.shell || result.reason !== "unknown_local_effect" || result.axes?.location !== "repo_local" || result.assessment.external) {
     return false;
   }
   const plan = result.effectPlan;
@@ -11152,7 +11288,7 @@ function classifySubagent(payload, repoRoot, options = {}, config) {
 }
 
 // src/core/classify-tool.ts
-import path49 from "node:path";
+import path50 from "node:path";
 init_fingerprint2();
 init_path_utils();
 init_scrub();
@@ -11272,13 +11408,13 @@ function worstEffectDecision(decisions) {
 
 // src/core/effect-ir/shell-lower.ts
 init_shell_tokenizer();
-import path48 from "node:path";
+import path49 from "node:path";
 
 // src/core/verdict/docker-compose-run.ts
-import path36 from "node:path";
+import path37 from "node:path";
 
 // src/core/verdict/recursive-invocation.ts
-import path35 from "node:path";
+import path36 from "node:path";
 var SHELL_INTERPRETERS = /* @__PURE__ */ new Set(["bash", "sh", "zsh", "dash", "fish"]);
 var PYTHON_INTERPRETERS = /* @__PURE__ */ new Set(["python", "python3"]);
 var SHELL_SHORT_OPTIONS = /* @__PURE__ */ new Set(["c", "l", "e", "x", "u"]);
@@ -11340,7 +11476,7 @@ var OSASCRIPT_PROFILE = {
   attachedValuePrefixes: []
 };
 function normalizeInterpreter(value) {
-  return path35.basename(value);
+  return path36.basename(value);
 }
 function scriptResult(interpreter, token) {
   if (!token) {
@@ -11570,7 +11706,7 @@ function parseOptions(words, start, options) {
 function decodeDockerComposeRun(tokens) {
   if (tokens.some((token) => token.kind === "operator")) return { kind: "none" };
   const words = tokens.filter((token) => token.kind === "word");
-  const head = path36.basename(words[0]?.value ?? "");
+  const head = path37.basename(words[0]?.value ?? "");
   let index;
   if (head === "docker-compose") {
     index = 1;
@@ -11611,7 +11747,7 @@ function decodeDockerComposeRun(tokens) {
 }
 
 // src/core/verdict/egress-classify.ts
-import path37 from "node:path";
+import path38 from "node:path";
 var EGRESS_TOOL_HEADS = /* @__PURE__ */ new Set([
   "aws",
   "curl",
@@ -11660,7 +11796,7 @@ function isEgressToolHead(head) {
   return EGRESS_TOOL_HEADS.has(head);
 }
 function decodeEgressEffects(params) {
-  const head = path37.basename(params.tokens[0] ?? "");
+  const head = path38.basename(params.tokens[0] ?? "");
   if (head !== "curl" && head !== "wget" && head !== "gh") {
     return null;
   }
@@ -11668,7 +11804,7 @@ function decodeEgressEffects(params) {
   const provenance = { segment: params.segment };
   const requirements = [];
   for (const file of decoded.files) {
-    const resolved = path37.resolve(params.cwd, expandHome2(file));
+    const resolved = path38.resolve(params.cwd, expandHome2(file));
     requirements.push(
       requirement("fs.read", "fs.read", { kind: "path", path: resolved }, params.segment, [
         "egress.explicit_file_read"
@@ -11690,7 +11826,7 @@ function decodeEgressEffects(params) {
     if (file === "-") {
       continue;
     }
-    const resolved = path37.resolve(params.cwd, expandHome2(file));
+    const resolved = path38.resolve(params.cwd, expandHome2(file));
     if (resolved === "/dev/null") {
       continue;
     }
@@ -12168,13 +12304,13 @@ function decodeSingleCurlWgetGrammar(head, tokens) {
   if (head === "wget" && !explicitOutput) {
     outputFiles.push(
       ...endpointOutputNames.map(
-        (name) => outputDirectory ? path37.join(outputDirectory, name) : name
+        (name) => outputDirectory ? path38.join(outputDirectory, name) : name
       )
     );
   } else if (head === "curl" && remoteNameOutput) {
     outputFiles.push(
       ...endpointOutputNames.map(
-        (name) => outputDirectory ? path37.join(outputDirectory, name) : name
+        (name) => outputDirectory ? path38.join(outputDirectory, name) : name
       )
     );
   }
@@ -12188,7 +12324,7 @@ function decodeSingleCurlWgetGrammar(head, tokens) {
     outputFiles: [
       ...new Set(
         outputFiles.map(
-          (file) => outputDirectory && directoryEligibleOutputs.has(file) && !path37.isAbsolute(file) ? path37.join(outputDirectory, file) : file
+          (file) => outputDirectory && directoryEligibleOutputs.has(file) && !path38.isAbsolute(file) ? path38.join(outputDirectory, file) : file
         )
       )
     ],
@@ -12203,7 +12339,7 @@ function remoteOutputName(spec) {
   } catch {
     pathname = spec.split(/[?#]/, 1)[0] ?? "";
   }
-  const name = path37.posix.basename(pathname);
+  const name = path38.posix.basename(pathname);
   return name && name !== "/" ? name : "index.html";
 }
 function decodeGhGrammar(tokens) {
@@ -12368,7 +12504,7 @@ function expandHome2(value) {
     return process.env.HOME ?? value;
   }
   if (value.startsWith("~/")) {
-    return path37.join(process.env.HOME ?? "~", value.slice(2));
+    return path38.join(process.env.HOME ?? "~", value.slice(2));
   }
   return value;
 }
@@ -12387,7 +12523,7 @@ function requirement(tag, action, resource, segment, signals) {
 }
 
 // src/core/verdict/git-classifier.ts
-import path38 from "node:path";
+import path39 from "node:path";
 init_shell_tokenizer();
 var GIT_BRANCH_MUTATION_FLAGS = /* @__PURE__ */ new Set([
   "--copy",
@@ -12483,7 +12619,7 @@ var FILE_OPERAND_SUBCOMMANDS = /* @__PURE__ */ new Set([
 var COMPOUND_SUBCOMMAND_HEADS = /* @__PURE__ */ new Set(["worktree", "stash", "tag"]);
 var REF_ONLY_WITHOUT_TERMINATOR = /* @__PURE__ */ new Set(["checkout", "show", "log"]);
 function isGitExecutable(token) {
-  return path38.basename(token) === "git";
+  return path39.basename(token) === "git";
 }
 function takesValue(flag) {
   return flag === "-C" || flag === "-c" || flag === "--git-dir" || flag === "--work-tree" || flag === "--exec-path" || flag === "--paginate" || flag === "--config-env" || flag.startsWith("-C") || flag.startsWith("-c") || flag.startsWith("--git-dir=") || flag.startsWith("--work-tree=");
@@ -12511,7 +12647,7 @@ function peelGlobalOptions(tokens, baseCwd) {
     if (token === "-C" || token === "--work-tree" || token === "--git-dir" || token === "-c") {
       const value = tokens[index + 1];
       if (token === "-C" && value) {
-        effectiveCwd = path38.resolve(baseCwd, value);
+        effectiveCwd = path39.resolve(baseCwd, value);
       } else if (token === "--work-tree" && value) {
         workTree = value;
       } else if (token === "--git-dir" && value) {
@@ -12521,7 +12657,7 @@ function peelGlobalOptions(tokens, baseCwd) {
       continue;
     }
     if (token.startsWith("-C") && token.length > 2) {
-      effectiveCwd = path38.resolve(baseCwd, token.slice(2));
+      effectiveCwd = path39.resolve(baseCwd, token.slice(2));
       index += 1;
       continue;
     }
@@ -12664,7 +12800,7 @@ function looksLikeDiffPathOperand(token) {
   if (!looksLikeFileOperand(token)) {
     return false;
   }
-  if (token.startsWith(".") || path38.isAbsolute(token)) {
+  if (token.startsWith(".") || path39.isAbsolute(token)) {
     return true;
   }
   return token.includes(".");
@@ -12672,12 +12808,12 @@ function looksLikeDiffPathOperand(token) {
 function resolveGitWorkTree(baseCwd, effectiveCwd, workTree, gitDir) {
   const resolveBase = effectiveCwd ?? baseCwd;
   if (workTree) {
-    return path38.resolve(resolveBase, workTree);
+    return path39.resolve(resolveBase, workTree);
   }
   if (gitDir) {
-    const resolvedGitDir = path38.resolve(resolveBase, gitDir);
-    if (path38.basename(resolvedGitDir) === ".git") {
-      return path38.dirname(resolvedGitDir);
+    const resolvedGitDir = path39.resolve(resolveBase, gitDir);
+    if (path39.basename(resolvedGitDir) === ".git") {
+      return path39.dirname(resolvedGitDir);
     }
   }
   return void 0;
@@ -12758,7 +12894,7 @@ function classifyGitCommand(tokens, baseCwd) {
   const { subcommand, args, effectiveCwd, gitDir, workTree } = normalized;
   const normalizedKey = `git ${subcommand}`;
   const gitWorkTree = resolveGitWorkTree(baseCwd, effectiveCwd, workTree, gitDir);
-  const effectiveGitDir = gitDir ? path38.resolve(effectiveCwd ?? baseCwd, gitDir) : void 0;
+  const effectiveGitDir = gitDir ? path39.resolve(effectiveCwd ?? baseCwd, gitDir) : void 0;
   const scopeTargets = [effectiveCwd, gitWorkTree, effectiveGitDir].filter(
     (target, index, targets) => Boolean(target) && targets.indexOf(target) === index
   );
@@ -12910,9 +13046,9 @@ function decodeGitEffects(params) {
     ...subcommand === "push" ? ["tier0_external"] : []
   ];
   const effectiveCwd = normalized.effectiveCwd ?? params.cwd;
-  const workTreeRoot = normalized.workTree ? path38.resolve(normalized.effectiveCwd ?? params.cwd, normalized.workTree) : normalized.effectiveCwd ?? params.repoRoot;
-  const gitRefRoot = normalized.gitDir ? path38.resolve(effectiveCwd, normalized.gitDir) : workTreeRoot;
-  const gitControlRoot = normalized.gitDir ? gitRefRoot : path38.join(gitRefRoot, ".git");
+  const workTreeRoot = normalized.workTree ? path39.resolve(normalized.effectiveCwd ?? params.cwd, normalized.workTree) : normalized.effectiveCwd ?? params.repoRoot;
+  const gitRefRoot = normalized.gitDir ? path39.resolve(effectiveCwd, normalized.gitDir) : workTreeRoot;
+  const gitControlRoot = normalized.gitDir ? gitRefRoot : path39.join(gitRefRoot, ".git");
   const requirements = [];
   if (subcommand === "fetch" || subcommand === "pull") {
     const positionals = gitRemotePositionals(args);
@@ -13071,7 +13207,7 @@ function decodeGitEffects(params) {
         gitRequirement(
           "control_plane.write",
           "control_plane.write",
-          { kind: "path", path: path38.join(gitControlRoot, "logs") },
+          { kind: "path", path: path39.join(gitControlRoot, "logs") },
           params.segment,
           [...signals, "git_history_destructive", "git.reflog.mutate"]
         )
@@ -13129,7 +13265,7 @@ function decodeGitEffects(params) {
         gitRequirement(
           "fs.read",
           "fs.read",
-          { kind: "path", path: path38.resolve(workTreeRoot, operand) },
+          { kind: "path", path: path39.resolve(workTreeRoot, operand) },
           params.segment,
           [...signals, "git.path.read"]
         )
@@ -13164,7 +13300,7 @@ function decodeGitEffects(params) {
         gitRequirement(
           "fs.write",
           "fs.write",
-          { kind: "path", path: path38.resolve(workTreeRoot, operand) },
+          { kind: "path", path: path39.resolve(workTreeRoot, operand) },
           params.segment,
           [...signals, "git.path.write"]
         )
@@ -13348,8 +13484,8 @@ function gitRequirement(tag, action, resource, segment, signals) {
 }
 
 // src/core/verdict/launcher-resolve.ts
-import { existsSync as existsSync11, readFileSync as readFileSync5 } from "node:fs";
-import path39 from "node:path";
+import { existsSync as existsSync12, readFileSync as readFileSync5 } from "node:fs";
+import path40 from "node:path";
 
 // src/core/verdict/makefile-expand.ts
 var MAX_EXPAND_DEPTH = 16;
@@ -13522,8 +13658,8 @@ var PNPM_BUILTIN_COMMANDS = /* @__PURE__ */ new Set([
   "why"
 ]);
 function readPackageJson(dir) {
-  const packagePath = path39.join(dir, "package.json");
-  if (!existsSync11(packagePath)) {
+  const packagePath = path40.join(dir, "package.json");
+  if (!existsSync12(packagePath)) {
     return null;
   }
   try {
@@ -13533,17 +13669,17 @@ function readPackageJson(dir) {
   }
 }
 function findPackageJson(startDir, stopDir) {
-  let current = path39.resolve(startDir);
-  const stop = path39.resolve(stopDir);
+  let current = path40.resolve(startDir);
+  const stop = path40.resolve(stopDir);
   while (true) {
-    const packagePath = path39.join(current, "package.json");
-    if (existsSync11(packagePath)) {
+    const packagePath = path40.join(current, "package.json");
+    if (existsSync12(packagePath)) {
       return packagePath;
     }
-    if (current === stop || current === path39.dirname(current)) {
-      return existsSync11(packagePath) ? packagePath : null;
+    if (current === stop || current === path40.dirname(current)) {
+      return existsSync12(packagePath) ? packagePath : null;
     }
-    const parent = path39.dirname(current);
+    const parent = path40.dirname(current);
     if (!parent.startsWith(stop) && parent !== current) {
     }
     if (parent === current) {
@@ -13600,7 +13736,7 @@ function resolveNpmRecipe(cwd, repoRoot, scriptName, extraArgs) {
     }
     return { recipes: [], opaque: true, reason: "package_json_missing" };
   }
-  const pkg = readPackageJson(path39.dirname(packagePath));
+  const pkg = readPackageJson(path40.dirname(packagePath));
   const scripts = pkg?.scripts;
   if (!scripts || typeof scripts !== "object") {
     return { recipes: [], opaque: true, reason: "package_scripts_missing" };
@@ -13691,20 +13827,20 @@ function parseMakefileRecipeContent(content) {
 function resolveMakeRecipe(cwd, repoRoot, target, cliVars = {}) {
   const candidates = ["Makefile", "makefile", "GNUmakefile"];
   let makefilePath = null;
-  let searchDir = path39.resolve(cwd);
-  const stop = path39.resolve(repoRoot);
+  let searchDir = path40.resolve(cwd);
+  const stop = path40.resolve(repoRoot);
   while (true) {
     for (const name of candidates) {
-      const candidate = path39.join(searchDir, name);
-      if (existsSync11(candidate)) {
+      const candidate = path40.join(searchDir, name);
+      if (existsSync12(candidate)) {
         makefilePath = candidate;
         break;
       }
     }
-    if (makefilePath || searchDir === stop || searchDir === path39.dirname(searchDir)) {
+    if (makefilePath || searchDir === stop || searchDir === path40.dirname(searchDir)) {
       break;
     }
-    searchDir = path39.dirname(searchDir);
+    searchDir = path40.dirname(searchDir);
   }
   if (!makefilePath) {
     return { recipes: [], opaque: true, reason: "unknown_local_effect" };
@@ -13731,7 +13867,7 @@ function resolveMakeRecipe(cwd, repoRoot, target, cliVars = {}) {
     }
     const entry = targets.get(name);
     if (!entry) {
-      if (!existsSync11(path39.resolve(path39.dirname(makefilePath), name))) {
+      if (!existsSync12(path40.resolve(path40.dirname(makefilePath), name))) {
         hasUndefinedPrerequisite = true;
       }
       return;
@@ -13830,7 +13966,7 @@ function resolveLauncherRecipe(params) {
 }
 
 // src/core/verdict/parser.ts
-import path40 from "node:path";
+import path41 from "node:path";
 
 // src/core/shell-substitution.ts
 function findStructuralCommandSubstitutions(command) {
@@ -14070,7 +14206,7 @@ var INTERPRETER_SCRIPT_EXTENSIONS = /* @__PURE__ */ new Set([
   ".sh"
 ]);
 function normalizeHead(token) {
-  const base = path40.basename(token);
+  const base = path41.basename(token);
   if (base && base !== "." && base !== "..") {
     return base;
   }
@@ -14380,7 +14516,7 @@ function isBareInterpreter(tokens) {
     return false;
   }
   const scriptArg = args.find((token) => !token.startsWith("-"));
-  if (scriptArg && INTERPRETER_SCRIPT_EXTENSIONS.has(path40.extname(scriptArg))) {
+  if (scriptArg && INTERPRETER_SCRIPT_EXTENSIONS.has(path41.extname(scriptArg))) {
     return false;
   }
   if (scriptArg) {
@@ -14620,7 +14756,7 @@ function mergeNodes(nodes) {
 }
 
 // src/core/effect-ir/shell-lower/argv-delegate-gate.ts
-import path41 from "node:path";
+import path42 from "node:path";
 var ARGV_DELEGATE_INNER_BLOCKLIST = /* @__PURE__ */ new Set([
   "sudo",
   "env",
@@ -14641,7 +14777,7 @@ function shouldApplyArgvDelegate(head, innerTokens, depth) {
   if (ARGV_DELEGATE_INNER_BLOCKLIST.has(head)) {
     return false;
   }
-  const innerHead = path41.basename(innerTokens[0] ?? "");
+  const innerHead = path42.basename(innerTokens[0] ?? "");
   if (ARGV_DELEGATE_INNER_BLOCKLIST.has(innerHead)) {
     return false;
   }
@@ -14748,7 +14884,7 @@ function withInnerProvenance(requirementValue, innerCommand, launcher, outerSegm
 
 // src/core/effect-ir/shell-lower/tokens.ts
 init_shell_tokenizer();
-import path42 from "node:path";
+import path43 from "node:path";
 var ENV_PREFIX_PATTERN2 = /^([A-Za-z_][A-Za-z0-9_]*)=(.*)$/;
 var LOOPBACK_HOSTS2 = /* @__PURE__ */ new Set(["127.0.0.1", "localhost", "::1", "0:0:0:0:0:0:0:1"]);
 var METADATA_ONLY_FLAGS = /* @__PURE__ */ new Set(["--version", "-v", "-V", "--help", "-h"]);
@@ -14892,9 +15028,9 @@ function resolvePathOperand(operand, cwd) {
     return process.env.HOME ?? operand;
   }
   if (operand.startsWith("~/")) {
-    return path42.join(process.env.HOME ?? "~", operand.slice(2));
+    return path43.join(process.env.HOME ?? "~", operand.slice(2));
   }
-  return path42.resolve(cwd, operand);
+  return path43.resolve(cwd, operand);
 }
 function isOptionToken(value) {
   return value.startsWith("-") || value.startsWith("+");
@@ -14906,7 +15042,7 @@ function pipeToShell(command) {
   return /(?:^|[|;&]\s*)(?:bash|sh|zsh|dash|fish)(?:\s|$)/.test(command) && /\|/.test(command);
 }
 function executableBaseName(head) {
-  return path42.basename(head);
+  return path43.basename(head);
 }
 function isMetadataOnlyArgv(argv) {
   return argv.length > 0 && argv.every((token) => METADATA_ONLY_FLAGS.has(token));
@@ -15025,15 +15161,22 @@ function effectChangingEnvironmentSignals(head, env, changedNames) {
 }
 
 // src/core/effect-ir/shell-lower/decode-process.ts
-import path46 from "node:path";
+import path47 from "node:path";
 
 // src/core/effect-ir/shell-lower/decoders/belay.ts
-import path43 from "node:path";
+import path44 from "node:path";
 function decodeBelay(args, repoRoot, segment) {
   const [section, operation, key] = args;
   const judgeCommand = section === "judge" && operation !== void 0 && ["consent", "list", "status", "test", "use"].includes(operation);
   const configRead = section === "config" && (operation === void 0 || operation === "list" || operation === "get" && key?.startsWith("judge."));
   const configJudgeMutation = section === "config" && (["set", "unset"].includes(operation ?? "") && key?.startsWith("judge.") || operation === "credential" && key === "mode");
+  const approvalAuthorityCommand = [
+    "approval-token",
+    "approve",
+    "revoke",
+    "standing-allow"
+  ].includes(section ?? "");
+  const configTrustMutation = section === "config" && operation === "trust";
   if (judgeCommand || configRead || configJudgeMutation) {
     return [
       processRequirement("belay", "inspect", segment, [
@@ -15042,12 +15185,23 @@ function decodeBelay(args, repoRoot, segment) {
       ])
     ];
   }
+  if (approvalAuthorityCommand || configTrustMutation) {
+    return [
+      requirement2(
+        "control_plane.write",
+        "control_plane.write",
+        { kind: "path", path: path44.join(repoRoot, ".belay-control-plane") },
+        segment,
+        [approvalAuthorityCommand ? "belay.approval_authority" : "belay.config_trust"]
+      )
+    ];
+  }
   if (section === "config" && ["set", "unset", "credential"].includes(operation ?? "")) {
     return [
       requirement2(
         "control_plane.write",
         "control_plane.write",
-        { kind: "path", path: path43.join(repoRoot, ".belay-control-plane") },
+        { kind: "path", path: path44.join(repoRoot, ".belay-control-plane") },
         segment,
         ["belay.config_non_judge_mutation"]
       )
@@ -15288,7 +15442,7 @@ function validDockerInfo(args) {
 // src/core/effect-ir/shell-lower/decoders/filesystem.ts
 init_git_resource_identity();
 import { lstatSync as lstatSync2, realpathSync as realpathSync4 } from "node:fs";
-import path44 from "node:path";
+import path45 from "node:path";
 function decodeCopyMove(head, args, cwd, segment) {
   const requirements = [processRequirement(head, "spawn", segment, ["process.filesystem_mutation"])];
   const operands = [];
@@ -15416,11 +15570,11 @@ function decodeRm(args, cwd, repoRoot, segment) {
 function canonicalRmOperand(targetPath, finalOperandIsSymlink) {
   try {
     if (finalOperandIsSymlink) {
-      return path44.join(realpathSync4.native(path44.dirname(targetPath)), path44.basename(targetPath));
+      return path45.join(realpathSync4.native(path45.dirname(targetPath)), path45.basename(targetPath));
     }
     return realpathSync4.native(targetPath);
   } catch {
-    return path44.resolve(targetPath);
+    return path45.resolve(targetPath);
   }
 }
 function isSymbolicLink(targetPath) {
@@ -15431,8 +15585,8 @@ function isSymbolicLink(targetPath) {
   }
 }
 function pathContains(ancestor, candidate) {
-  const relative = path44.relative(path44.resolve(ancestor), path44.resolve(candidate));
-  return relative === "" || !relative.startsWith("..") && !path44.isAbsolute(relative);
+  const relative = path45.relative(path45.resolve(ancestor), path45.resolve(candidate));
+  return relative === "" || !relative.startsWith("..") && !path45.isAbsolute(relative);
 }
 function filesystemReadOperands(head, args) {
   switch (head) {
@@ -15572,7 +15726,7 @@ function decodePrisma(args, env, repoRoot, segment) {
 
 // src/core/effect-ir/shell-lower/decoders/ruby.ts
 init_path_utils();
-import path45 from "node:path";
+import path46 from "node:path";
 var RAILS_READ_ONLY_SUBCOMMANDS = /* @__PURE__ */ new Set(["routes", "middleware", "stats", "about", "version"]);
 function railsReadOnlySubcommand(args) {
   const subcommand = args[0];
@@ -15582,7 +15736,7 @@ function railsReadOnlySubcommand(args) {
   return RAILS_READ_ONLY_SUBCOMMANDS.has(subcommand);
 }
 function isRubyTestScript(scriptPath) {
-  const base = path45.basename(scriptPath);
+  const base = path46.basename(scriptPath);
   return base.endsWith("_test.rb") || base.endsWith("_spec.rb");
 }
 function parseRubyTestInvocation(args) {
@@ -15996,7 +16150,7 @@ function decodeProcessOrFilesystem(params) {
         requirement2(
           "fs.read",
           "fs.read",
-          { kind: "path", path: path46.resolve(cwd, syntax) },
+          { kind: "path", path: path47.resolve(cwd, syntax) },
           segment,
           ["shell.syntax_source_read"]
         )
@@ -16202,7 +16356,7 @@ function packageExecInnerIsMetadata(peel) {
 
 // src/core/effect-ir/shell-lower/segment.ts
 init_shell_tokenizer();
-import path47 from "node:path";
+import path48 from "node:path";
 var DYNAMIC_SHELL_VALUE_PATTERN = /(?:\$\(|`|\$(?:\d+|[@*#?$!-]|\{[^}]*\}|[A-Za-z_][A-Za-z0-9_]*))/;
 var SHELL_GLOB_PATTERN = /[*?[]/;
 function requiresKnownCwd(requirementValue) {
@@ -16217,11 +16371,11 @@ function joinNestedOpacity(outer, nested) {
 }
 function startsLocalPostgresService(command) {
   const tokens = tokenizeShell(command);
-  return path47.basename(tokens[0] ?? "") === "docker" && tokens[1] === "compose" && ["up", "start", "restart"].includes(tokens[2] ?? "") && tokens.includes("postgres");
+  return path48.basename(tokens[0] ?? "") === "docker" && tokens[1] === "compose" && ["up", "start", "restart"].includes(tokens[2] ?? "") && tokens.includes("postgres");
 }
 function resolveCdTransition(command, currentCwd) {
   const tokens = tokenizeShell(command);
-  if (path47.basename(tokens[0] ?? "") !== "cd") {
+  if (path48.basename(tokens[0] ?? "") !== "cd") {
     return null;
   }
   const target = tokens[1] ?? "~";
@@ -16384,7 +16538,7 @@ function lowerSegment(command, context) {
     stripStructuredRedirects(lexed.tokens),
     stripRedirects(parsedTokens)
   );
-  const head = path48.basename(tokens[0] ?? parsed.head);
+  const head = path49.basename(tokens[0] ?? parsed.head);
   let opacity = segmentOpacity(command);
   const signals = /* @__PURE__ */ new Set();
   const requirements = [];
@@ -16967,17 +17121,41 @@ function verdictToClassifyResult(result, config, options = {}) {
 
 // src/core/classify-tool.ts
 var DEFAULT_SENSITIVE_PATHS = [".env", ".env.*", "**/credentials/**"];
-var FILE_WRITE_TOOL_NAMES = /* @__PURE__ */ new Set(["write"]);
-var FILE_EDIT_TOOL_NAMES = /* @__PURE__ */ new Set([
-  "edit",
-  "multiedit",
-  "multi_edit",
-  "patch",
-  "strreplace",
-  "str_replace"
-]);
-var FILE_DELETE_TOOL_NAMES = /* @__PURE__ */ new Set(["delete"]);
-var APPLY_PATCH_TOOL_NAMES = /* @__PURE__ */ new Set(["apply_patch", "applypatch"]);
+function toolInputRecord(payload) {
+  const toolInput = payload.tool_input;
+  if (!toolInput || typeof toolInput !== "object" || Array.isArray(toolInput)) {
+    return null;
+  }
+  return toolInput;
+}
+function hasMutationFields(input) {
+  return typeof input.contents === "string" || typeof input.old_string === "string" || typeof input.new_string === "string" || typeof input.newContents === "string";
+}
+function inferToolPayloadEffect(payload, toolName) {
+  if (extractShellCommand(payload)) {
+    return "shell";
+  }
+  const input = toolInputRecord(payload);
+  if (!input) {
+    return "indeterminate";
+  }
+  if (hasMutationFields(input)) {
+    return "file_mutation";
+  }
+  if (extractPatch(payload)) {
+    return "apply_patch";
+  }
+  if (typeof input.pattern === "string" || typeof input.glob_pattern === "string") {
+    return "search_read";
+  }
+  if (typeof input.file_path === "string") {
+    return "file_read";
+  }
+  if (typeof input.path === "string" || typeof input.target_file === "string") {
+    return normalizedToolName(toolName) === "delete" ? "file_delete" : "indeterminate";
+  }
+  return "indeterminate";
+}
 function policyAuth(options) {
   if (!options.grants && options.attestation === void 0 && options.egressProxyActive === void 0) {
     return void 0;
@@ -17157,186 +17335,160 @@ function classifyFileMutationWithPolicy(params) {
     boundaryProfile: params.options.boundaryProfile ?? BOUNDARY_PROFILE_L3_L4_ONLY
   };
 }
-async function classifyToolUse(payload, repoRoot, cwd, config, options = {}) {
-  const toolName = String(payload.tool_name ?? "");
-  const toolKind = normalizedToolName(toolName);
-  const sensitivePaths = [...DEFAULT_SENSITIVE_PATHS, ...options.sensitivePaths ?? []];
-  const protectedRoots = [
-    ...options.protectedArtifactRoots ?? [],
-    ...options.controlPlaneDir ? [options.controlPlaneDir] : []
-  ];
-  if (toolKind === "shell") {
-    const command = extractShellCommand(payload);
-    if (!command) {
-      if (options.unknownLocalEffect === "deny") {
-        return {
-          verdict: "deny_pending_approval",
-          reason: "tool_shell_missing_command",
-          summary: canonicalStringify(scrubPayload(payload.tool_input ?? {}, options)),
-          fingerprint: toolFingerprint(toolName, fingerprintPayload(payload, options), repoRoot),
-          assessment: {
-            reversibility: "irreversible",
-            external: false,
-            blastRadius: "tool shell",
-            confidence: 0.85,
-            signals: ["missing_command"]
-          }
-        };
-      }
-      return {
-        verdict: "allow_flagged",
-        reason: "tool_shell_missing_command",
-        summary: canonicalStringify(scrubPayload(payload.tool_input ?? {}, options)),
-        fingerprint: toolFingerprint(toolName, fingerprintPayload(payload, options), repoRoot),
-        assessment: {
-          reversibility: "recoverable_with_cost",
-          external: false,
-          blastRadius: "tool shell",
-          confidence: 0.5,
-          signals: ["missing_command"]
-        }
-      };
-    }
-    const shellResult = await classifyShell(command, cwd, repoRoot, config, options);
-    return {
-      ...shellResult,
-      summary: command
-    };
-  }
-  if (FILE_WRITE_TOOL_NAMES.has(toolKind) || FILE_EDIT_TOOL_NAMES.has(toolKind) || FILE_DELETE_TOOL_NAMES.has(toolKind)) {
-    const filePath = extractFilePath(payload);
-    if (!filePath) {
-      if (options.unknownLocalEffect === "deny") {
-        return {
-          verdict: "deny_pending_approval",
-          reason: "file_mutation_missing_path",
-          summary: canonicalStringify(scrubPayload(payload.tool_input ?? {}, options)),
-          fingerprint: toolFingerprint(toolName, fingerprintPayload(payload, options), repoRoot),
-          assessment: {
-            reversibility: "irreversible",
-            external: false,
-            blastRadius: "file mutation",
-            confidence: 0.85,
-            signals: ["missing_path"]
-          }
-        };
-      }
-      return {
-        verdict: "allow_flagged",
-        reason: "file_mutation_missing_path",
-        summary: canonicalStringify(scrubPayload(payload.tool_input ?? {}, options)),
-        fingerprint: toolFingerprint(toolName, fingerprintPayload(payload, options), repoRoot),
-        assessment: {
-          reversibility: "recoverable_with_cost",
-          external: false,
-          blastRadius: "file mutation",
-          confidence: 0.55,
-          signals: ["missing_path"]
-        }
-      };
-    }
-    const signals = [];
-    const resolvedPath = path49.isAbsolute(filePath) ? filePath : path49.resolve(cwd, filePath);
-    const hitsProtectedRoot = protectedRoots.some((root) => pathWithinRoot(root, resolvedPath));
-    if (hitsProtectedRoot) {
-      signals.push("control_plane_path");
-      return classifyFileMutationWithPolicy({
-        toolName,
-        toolKind,
-        filePath,
-        resolvedPath,
-        repoRoot,
-        cwd,
-        config,
-        options,
-        signals,
-        isDelete: FILE_DELETE_TOOL_NAMES.has(toolKind),
-        locationLabel: "control_plane"
-      });
-    }
-    const workspaceMatch = resolveWorkspaceRootMatch(
+function classifyFileReadWithPolicy(params) {
+  const fingerprint = toolFingerprint(params.toolName, { path: params.filePath }, params.repoRoot);
+  const { request, decision } = evaluateFileReadPolicy(
+    {
+      hookKind: "tool",
+      toolKind: params.toolKind,
+      filePath: params.filePath,
+      resolvedPath: params.resolvedPath,
+      repoRoot: params.repoRoot,
+      cwd: params.cwd,
+      inputFingerprint: fingerprint,
+      signals: params.signals,
+      locationLabel: params.locationLabel,
+      trustedWorkspaceRoots: params.options.trustedWorkspaceRoots,
+      sensitivePaths: params.options.sensitivePaths ?? params.config.classifier.sensitivePaths
+    },
+    params.config,
+    policyAuth(params.options)
+  );
+  if (policyDecisionRequiresAsk(decision)) {
+    return {
+      verdict: "deny_pending_approval",
+      reason: policyReasonToLegacyReason(decision),
+      summary: params.filePath,
+      fingerprint,
+      assessment: {
+        reversibility: "reversible",
+        external: params.locationLabel === "outside_repo",
+        blastRadius: params.locationLabel === "outside_repo" ? "outside the repository" : "sensitive repository file",
+        confidence: 0.85,
+        signals: [...params.signals, ...decision.signals]
+      },
+      capabilityRequests: [request],
+      authorizationDecision: decision,
+      boundaryProfile: params.options.boundaryProfile ?? BOUNDARY_PROFILE_L3_L4_ONLY
+    };
+  }
+  return {
+    verdict: "allow",
+    reason: "effect.fs_read",
+    summary: params.filePath,
+    fingerprint,
+    assessment: {
+      reversibility: "reversible",
+      external: false,
+      blastRadius: "tool scope",
+      confidence: 0.88,
+      signals: [...params.signals, ...decision.signals]
+    },
+    capabilityRequests: [request],
+    authorizationDecision: decision,
+    boundaryProfile: params.options.boundaryProfile ?? BOUNDARY_PROFILE_L3_L4_ONLY
+  };
+}
+function classifyFilePathMutation(params) {
+  const {
+    toolName,
+    toolKind,
+    filePath,
+    repoRoot,
+    cwd,
+    config,
+    options,
+    sensitivePaths,
+    protectedRoots,
+    isDelete
+  } = params;
+  const signals = [];
+  const resolvedPath = path50.isAbsolute(filePath) ? filePath : path50.resolve(cwd, filePath);
+  const hitsProtectedRoot = protectedRoots.some((root) => pathWithinRoot(root, resolvedPath));
+  if (hitsProtectedRoot) {
+    signals.push("control_plane_path");
+    return classifyFileMutationWithPolicy({
+      toolName,
+      toolKind,
+      filePath,
+      resolvedPath,
+      repoRoot,
+      cwd,
+      config,
+      options,
+      signals,
+      isDelete,
+      locationLabel: "control_plane"
+    });
+  }
+  const workspaceMatch = resolveWorkspaceRootMatch(
+    repoRoot,
+    options.trustedWorkspaceRoots,
+    resolvedPath
+  );
+  if (workspaceMatch === null) {
+    signals.push("outside_repo_path");
+    return classifyFileMutationWithPolicy({
+      toolName,
+      toolKind,
+      filePath,
+      resolvedPath,
       repoRoot,
-      options.trustedWorkspaceRoots,
-      resolvedPath
-    );
-    if (workspaceMatch === null) {
-      signals.push("outside_repo_path");
-      return classifyFileMutationWithPolicy({
-        toolName,
-        toolKind,
-        filePath,
-        resolvedPath,
-        repoRoot,
-        cwd,
-        config,
-        options,
-        signals,
-        isDelete: FILE_DELETE_TOOL_NAMES.has(toolKind),
-        locationLabel: "outside_repo"
-      });
-    }
-    if (workspaceMatch.kind === "trusted") {
-      signals.push("trusted_workspace_root");
-    }
-    const trustedCwd = resolveClassifierTrustedCwd(cwd, options);
-    const workspacePrescan = mutationPrescanRequiresAsk({
-      targets: [filePath],
       cwd,
+      config,
+      options,
+      signals,
+      isDelete,
+      locationLabel: "outside_repo"
+    });
+  }
+  if (workspaceMatch.kind === "trusted") {
+    signals.push("trusted_workspace_root");
+  }
+  const trustedCwd = resolveClassifierTrustedCwd(cwd, options);
+  const workspacePrescan = mutationPrescanRequiresAsk({
+    targets: [filePath],
+    cwd,
+    repoRoot,
+    trustedCwd,
+    trustedWorkspaceRoots: options.trustedWorkspaceRoots,
+    sensitivePaths
+  });
+  if (workspacePrescan) {
+    return classifyFileMutationWithPolicy({
+      toolName,
+      toolKind,
+      filePath,
+      resolvedPath,
       repoRoot,
-      trustedCwd,
-      trustedWorkspaceRoots: options.trustedWorkspaceRoots,
-      sensitivePaths
+      cwd,
+      config,
+      options,
+      signals,
+      isDelete,
+      locationLabel: "sensitive_path"
     });
-    if (workspacePrescan) {
-      return classifyFileMutationWithPolicy({
-        toolName,
-        toolKind,
-        filePath,
-        resolvedPath,
-        repoRoot,
-        cwd,
-        config,
-        options,
-        signals,
-        isDelete: FILE_DELETE_TOOL_NAMES.has(toolKind),
-        locationLabel: "sensitive_path"
-      });
-    }
-    const relativePath = workspaceMatch.relativePath;
-    if (matchesSensitivePath(relativePath, sensitivePaths)) {
-      signals.push("sensitive_path");
-      return classifyFileMutationWithPolicy({
-        toolName,
-        toolKind,
-        filePath,
-        resolvedPath,
-        repoRoot,
-        cwd,
-        config,
-        options,
-        signals,
-        isDelete: FILE_DELETE_TOOL_NAMES.has(toolKind),
-        locationLabel: "sensitive_path"
-      });
-    }
-    if (FILE_DELETE_TOOL_NAMES.has(toolKind)) {
-      if (isGitPath(resolvedPath, repoRoot)) {
-        signals.push("protected_artifact");
-        return classifyFileMutationWithPolicy({
-          toolName,
-          toolKind,
-          filePath,
-          resolvedPath,
-          repoRoot,
-          cwd,
-          config,
-          options,
-          signals,
-          isDelete: true,
-          locationLabel: "sensitive_path"
-        });
-      }
-      signals.push("file_delete");
+  }
+  const relativePath = workspaceMatch.relativePath;
+  if (matchesSensitivePath(relativePath, sensitivePaths)) {
+    signals.push("sensitive_path");
+    return classifyFileMutationWithPolicy({
+      toolName,
+      toolKind,
+      filePath,
+      resolvedPath,
+      repoRoot,
+      cwd,
+      config,
+      options,
+      signals,
+      isDelete,
+      locationLabel: "sensitive_path"
+    });
+  }
+  if (isDelete) {
+    if (isGitPath(resolvedPath, repoRoot)) {
+      signals.push("protected_artifact");
       return classifyFileMutationWithPolicy({
         toolName,
         toolKind,
@@ -17348,10 +17500,10 @@ async function classifyToolUse(payload, repoRoot, cwd, config, options = {}) {
         options,
         signals,
         isDelete: true,
-        locationLabel: "repo_local"
+        locationLabel: "sensitive_path"
       });
     }
-    signals.push("file_mutation");
+    signals.push("file_delete");
     return classifyFileMutationWithPolicy({
       toolName,
       toolKind,
@@ -17362,11 +17514,228 @@ async function classifyToolUse(payload, repoRoot, cwd, config, options = {}) {
       config,
       options,
       signals,
-      isDelete: false,
+      isDelete: true,
       locationLabel: "repo_local"
     });
   }
-  if (APPLY_PATCH_TOOL_NAMES.has(toolKind)) {
+  signals.push("file_mutation");
+  return classifyFileMutationWithPolicy({
+    toolName,
+    toolKind,
+    filePath,
+    resolvedPath,
+    repoRoot,
+    cwd,
+    config,
+    options,
+    signals,
+    isDelete: false,
+    locationLabel: "repo_local"
+  });
+}
+function classifyFilePathRead(params) {
+  const {
+    toolName,
+    toolKind,
+    filePath,
+    repoRoot,
+    cwd,
+    config,
+    options,
+    sensitivePaths,
+    protectedRoots
+  } = params;
+  const signals = ["effect.fs_read"];
+  const resolvedPath = path50.isAbsolute(filePath) ? filePath : path50.resolve(cwd, filePath);
+  if (protectedRoots.some((root) => pathWithinRoot(root, resolvedPath))) {
+    signals.push("control_plane_path");
+    return classifyFileReadWithPolicy({
+      toolName,
+      toolKind,
+      filePath,
+      resolvedPath,
+      repoRoot,
+      cwd,
+      config,
+      options,
+      signals,
+      locationLabel: "control_plane"
+    });
+  }
+  const workspaceMatch = resolveWorkspaceRootMatch(
+    repoRoot,
+    options.trustedWorkspaceRoots,
+    resolvedPath
+  );
+  if (workspaceMatch === null) {
+    signals.push("outside_repo_path");
+    return classifyFileReadWithPolicy({
+      toolName,
+      toolKind,
+      filePath,
+      resolvedPath,
+      repoRoot,
+      cwd,
+      config,
+      options,
+      signals,
+      locationLabel: "outside_repo"
+    });
+  }
+  const relativePath = workspaceMatch.relativePath;
+  if (matchesSensitivePath(relativePath, sensitivePaths)) {
+    signals.push("sensitive_path");
+    return classifyFileReadWithPolicy({
+      toolName,
+      toolKind,
+      filePath,
+      resolvedPath,
+      repoRoot,
+      cwd,
+      config,
+      options,
+      signals,
+      locationLabel: "sensitive_path"
+    });
+  }
+  return classifyFileReadWithPolicy({
+    toolName,
+    toolKind,
+    filePath,
+    resolvedPath,
+    repoRoot,
+    cwd,
+    config,
+    options,
+    signals,
+    locationLabel: "repo_local"
+  });
+}
+function indeterminateToolResult(toolName, payload, repoRoot, options) {
+  const summary = canonicalStringify(scrubPayload(payload.tool_input ?? {}, options));
+  const fingerprint = toolFingerprint(toolName, fingerprintPayload(payload, options), repoRoot);
+  if (options.unknownLocalEffect === "deny") {
+    return {
+      verdict: "deny_pending_approval",
+      reason: "indeterminate_tool_effect",
+      summary,
+      fingerprint,
+      assessment: {
+        reversibility: "irreversible",
+        external: false,
+        blastRadius: "unknown tool action",
+        confidence: 0.5,
+        signals: ["indeterminate_tool_effect"]
+      }
+    };
+  }
+  return {
+    verdict: "allow_flagged",
+    reason: "indeterminate_tool_effect",
+    summary,
+    fingerprint,
+    assessment: {
+      reversibility: "recoverable_with_cost",
+      external: false,
+      blastRadius: "tool scope",
+      confidence: 0.5,
+      signals: ["indeterminate_tool_effect"]
+    }
+  };
+}
+async function classifyToolUse(payload, repoRoot, cwd, config, options = {}) {
+  const toolName = String(payload.tool_name ?? "");
+  const toolKind = normalizedToolName(toolName);
+  const sensitivePaths = [...DEFAULT_SENSITIVE_PATHS, ...options.sensitivePaths ?? []];
+  const protectedRoots = [
+    ...options.protectedArtifactRoots ?? [],
+    ...options.controlPlaneDir ? [options.controlPlaneDir] : []
+  ];
+  if (toolKind === "shell") {
+    const command = extractShellCommand(payload);
+    if (!command) {
+      if (options.unknownLocalEffect === "deny") {
+        return {
+          verdict: "deny_pending_approval",
+          reason: "tool_shell_missing_command",
+          summary: canonicalStringify(scrubPayload(payload.tool_input ?? {}, options)),
+          fingerprint: toolFingerprint(toolName, fingerprintPayload(payload, options), repoRoot),
+          assessment: {
+            reversibility: "irreversible",
+            external: false,
+            blastRadius: "tool shell",
+            confidence: 0.85,
+            signals: ["missing_command"]
+          }
+        };
+      }
+      return {
+        verdict: "allow_flagged",
+        reason: "tool_shell_missing_command",
+        summary: canonicalStringify(scrubPayload(payload.tool_input ?? {}, options)),
+        fingerprint: toolFingerprint(toolName, fingerprintPayload(payload, options), repoRoot),
+        assessment: {
+          reversibility: "recoverable_with_cost",
+          external: false,
+          blastRadius: "tool shell",
+          confidence: 0.5,
+          signals: ["missing_command"]
+        }
+      };
+    }
+    const shellResult = await classifyShell(command, cwd, repoRoot, config, options);
+    return {
+      ...shellResult,
+      summary: command
+    };
+  }
+  const effect = inferToolPayloadEffect(payload, toolName);
+  if (effect === "file_mutation" || effect === "file_delete") {
+    const filePath2 = extractFilePath(payload);
+    if (!filePath2) {
+      if (options.unknownLocalEffect === "deny") {
+        return {
+          verdict: "deny_pending_approval",
+          reason: "file_mutation_missing_path",
+          summary: canonicalStringify(scrubPayload(payload.tool_input ?? {}, options)),
+          fingerprint: toolFingerprint(toolName, fingerprintPayload(payload, options), repoRoot),
+          assessment: {
+            reversibility: "irreversible",
+            external: false,
+            blastRadius: "file mutation",
+            confidence: 0.85,
+            signals: ["missing_path"]
+          }
+        };
+      }
+      return {
+        verdict: "allow_flagged",
+        reason: "file_mutation_missing_path",
+        summary: canonicalStringify(scrubPayload(payload.tool_input ?? {}, options)),
+        fingerprint: toolFingerprint(toolName, fingerprintPayload(payload, options), repoRoot),
+        assessment: {
+          reversibility: "recoverable_with_cost",
+          external: false,
+          blastRadius: "file mutation",
+          confidence: 0.55,
+          signals: ["missing_path"]
+        }
+      };
+    }
+    return classifyFilePathMutation({
+      toolName,
+      toolKind,
+      filePath: filePath2,
+      repoRoot,
+      cwd,
+      config,
+      options,
+      sensitivePaths,
+      protectedRoots,
+      isDelete: effect === "file_delete"
+    });
+  }
+  if (effect === "apply_patch") {
     const patch = extractPatch(payload);
     const targets = patch ? applyPatchTargets2(patch) : [];
     if (targets.length === 0) {
@@ -17404,7 +17773,7 @@ async function classifyToolUse(payload, repoRoot, cwd, config, options = {}) {
       const result = await classifyToolUse(
         {
           tool_name: target.delete ? "Delete" : "Write",
-          tool_input: { path: target.path }
+          tool_input: target.delete ? { path: target.path } : { path: target.path, contents: " " }
         },
         repoRoot,
         cwd,
@@ -17430,19 +17799,54 @@ async function classifyToolUse(payload, repoRoot, cwd, config, options = {}) {
       }
     };
   }
-  return {
-    verdict: "allow",
-    reason: "unclassified_tool",
-    summary: canonicalStringify(scrubPayload(payload.tool_input ?? {}, options)),
-    fingerprint: toolFingerprint(toolName, fingerprintPayload(payload, options), repoRoot),
-    assessment: {
-      reversibility: "reversible",
-      external: false,
-      blastRadius: "tool scope",
-      confidence: 0.5,
-      signals: ["unclassified_tool"]
+  if (effect === "file_read") {
+    const filePath2 = extractFilePath(payload);
+    if (!filePath2) {
+      return indeterminateToolResult(toolName, payload, repoRoot, options);
     }
-  };
+    return classifyFilePathRead({
+      toolName,
+      toolKind,
+      filePath: filePath2,
+      repoRoot,
+      cwd,
+      config,
+      options,
+      sensitivePaths,
+      protectedRoots
+    });
+  }
+  if (effect === "search_read") {
+    return {
+      verdict: "allow",
+      reason: "effect.search_read",
+      summary: canonicalStringify(scrubPayload(payload.tool_input ?? {}, options)),
+      fingerprint: toolFingerprint(toolName, fingerprintPayload(payload, options), repoRoot),
+      assessment: {
+        reversibility: "reversible",
+        external: false,
+        blastRadius: "tool scope",
+        confidence: 0.88,
+        signals: ["effect.search_read"]
+      }
+    };
+  }
+  const filePath = extractFilePath(payload);
+  if (filePath) {
+    return classifyFilePathMutation({
+      toolName,
+      toolKind,
+      filePath,
+      repoRoot,
+      cwd,
+      config,
+      options,
+      sensitivePaths,
+      protectedRoots,
+      isDelete: toolKind === "delete"
+    });
+  }
+  return indeterminateToolResult(toolName, payload, repoRoot, options);
 }
 
 // src/core/gate-engine.ts
@@ -17777,15 +18181,8 @@ function gateEnabledForAction(config, action) {
   if (action.kind === "subagent") {
     return config.gates.subagent;
   }
-  const toolName = action.toolName ?? String(action.payload?.tool_name ?? "");
-  if (toolName === "Shell") {
-    return config.gates.toolShell;
-  }
-  if (toolName === "Write" || toolName === "StrReplace" || toolName === "Delete") {
-    return config.gates.fileMutation;
-  }
-  if (toolName === "Task") {
-    return config.gates.subagent;
+  if (action.kind === "tool") {
+    return config.gates.fileMutation || config.gates.toolShell;
   }
   return true;
 }
@@ -17822,7 +18219,7 @@ function hashDecisionConfig(config) {
 init_fingerprint2();
 
 // src/version.ts
-var PACKAGE_VERSION = "0.9.4";
+var PACKAGE_VERSION = "0.10.1";
 
 // src/runtime-provenance.ts
 function resolveRuntimeArtifactHash(artifactHash) {
@@ -17895,56 +18292,56 @@ function capabilityRequestsBlockRecovery(requests) {
 init_fingerprint2();
 init_path_utils();
 import { randomUUID as randomUUID5 } from "node:crypto";
-import { existsSync as existsSync15 } from "node:fs";
-import { mkdir as mkdir11, readdir as readdir3, readFile as readFile12, rename as rename3, rm as rm6 } from "node:fs/promises";
-import path54 from "node:path";
+import { existsSync as existsSync16 } from "node:fs";
+import { mkdir as mkdir12, readdir as readdir3, readFile as readFile13, rename as rename4, rm as rm6 } from "node:fs/promises";
+import path55 from "node:path";
 
 // src/core/recovery/artifact-store.ts
 init_fingerprint2();
 init_path_utils();
 import { randomUUID as randomUUID4 } from "node:crypto";
-import { existsSync as existsSync13 } from "node:fs";
-import { lstat as lstat7, mkdir as mkdir10, open as open5, readdir as readdir2, readFile as readFile9, rename as rename2, rm as rm5, writeFile as writeFile7 } from "node:fs/promises";
-import path51 from "node:path";
+import { existsSync as existsSync14 } from "node:fs";
+import { lstat as lstat7, mkdir as mkdir11, open as open6, readdir as readdir2, readFile as readFile10, rename as rename3, rm as rm5, writeFile as writeFile7 } from "node:fs/promises";
+import path52 from "node:path";
 
 // src/core/recovery/snapshot-node.ts
 init_fingerprint2();
 init_path_utils();
 import { createHash as createHash12 } from "node:crypto";
-import { existsSync as existsSync12 } from "node:fs";
+import { existsSync as existsSync13 } from "node:fs";
 import {
-  chmod as chmod3,
+  chmod as chmod4,
   copyFile as copyFile2,
   lstat as lstat6,
-  mkdir as mkdir9,
-  open as open4,
-  readFile as readFile8,
+  mkdir as mkdir10,
+  open as open5,
+  readFile as readFile9,
   readlink as readlink4,
   rm as rm4,
   rmdir as rmdir2,
   symlink as symlink3,
   writeFile as writeFile6
 } from "node:fs/promises";
-import path50 from "node:path";
+import path51 from "node:path";
 var RECOVERY_UNSUPPORTED_FILE_KIND = "recovery_unsupported_file_kind";
 function validRecoveryRelativePath(relativePath) {
-  if (!relativePath || relativePath.includes("\0") || path50.isAbsolute(relativePath)) return false;
-  const normalized = path50.normalize(relativePath);
-  return normalized !== "." && normalized !== ".." && !normalized.startsWith(`..${path50.sep}`);
+  if (!relativePath || relativePath.includes("\0") || path51.isAbsolute(relativePath)) return false;
+  const normalized = path51.normalize(relativePath);
+  return normalized !== "." && normalized !== ".." && !normalized.startsWith(`..${path51.sep}`);
 }
 async function assertRecoverySafeTarget(resourceRoot, relativePath) {
   if (!validRecoveryRelativePath(relativePath)) throw new Error("recovery_path_escape");
   const root = canonicalPath(resourceRoot);
-  const target = path50.resolve(root, relativePath);
-  const relative = path50.relative(root, target);
-  if (relative === ".." || relative.startsWith(`..${path50.sep}`) || path50.isAbsolute(relative)) {
+  const target = path51.resolve(root, relativePath);
+  const relative = path51.relative(root, target);
+  if (relative === ".." || relative.startsWith(`..${path51.sep}`) || path51.isAbsolute(relative)) {
     throw new Error("recovery_path_escape");
   }
   let current = root;
-  const parentParts = path50.relative(root, path50.dirname(target)).split(path50.sep).filter(Boolean);
+  const parentParts = path51.relative(root, path51.dirname(target)).split(path51.sep).filter(Boolean);
   for (const part of parentParts) {
-    current = path50.join(current, part);
-    if (!existsSync12(current)) break;
+    current = path51.join(current, part);
+    if (!existsSync13(current)) break;
     const info = await lstat6(current);
     if (info.isSymbolicLink()) throw new Error("recovery_symlink_escape");
     if (!info.isDirectory()) break;
@@ -17952,7 +18349,7 @@ async function assertRecoverySafeTarget(resourceRoot, relativePath) {
   return target;
 }
 async function fsyncPath(filePath) {
-  const handle = await open4(filePath, "r");
+  const handle = await open5(filePath, "r");
   try {
     await handle.sync();
   } finally {
@@ -17994,13 +18391,13 @@ async function captureRecoverySnapshot(filePath, options) {
     return { kind: "directory", mode, hash: recoveryDirectoryHash(mode) };
   }
   if (!info.isFile()) throw new Error(RECOVERY_UNSUPPORTED_FILE_KIND);
-  const content = await readFile8(filePath);
+  const content = await readFile9(filePath);
   const hash = createHash12("sha256").update(content).digest("hex");
   let blob;
   if (options?.blobDir) {
-    await mkdir9(options.blobDir, { recursive: true, mode: 448 });
-    const blobPath = path50.join(options.blobDir, hash);
-    if (!existsSync12(blobPath)) {
+    await mkdir10(options.blobDir, { recursive: true, mode: 448 });
+    const blobPath = path51.join(options.blobDir, hash);
+    if (!existsSync13(blobPath)) {
       await writeFile6(blobPath, content, { mode: 384 });
       await fsyncPath(blobPath);
     }
@@ -18054,7 +18451,7 @@ async function validateRecoverySnapshot(params) {
   if (record.blob !== `blobs/${record.hash}`) throw new Error(params.corruptReason);
   let content;
   try {
-    content = await readFile8(path50.join(params.artifactDir, record.blob));
+    content = await readFile9(path51.join(params.artifactDir, record.blob));
   } catch {
     throw new Error(params.corruptReason);
   }
@@ -18082,16 +18479,16 @@ var RECOVERY_STATES = /* @__PURE__ */ new Set([
 ]);
 var STAGING_STALE_MS = 5 * 6e4;
 function checkpointsRoot(stateDir) {
-  return path51.join(stateDir, "recovery", "checkpoints");
+  return path52.join(stateDir, "recovery", "checkpoints");
 }
 function checkpointDir(stateDir, checkpointId) {
   if (!/^cp_[a-f0-9]{24}$/.test(checkpointId)) {
     throw new Error("invalid_recovery_checkpoint_id");
   }
-  return path51.join(checkpointsRoot(stateDir), checkpointId);
+  return path52.join(checkpointsRoot(stateDir), checkpointId);
 }
 async function fsyncPath2(filePath) {
-  const handle = await open5(filePath, "r");
+  const handle = await open6(filePath, "r");
   try {
     await handle.sync();
   } finally {
@@ -18099,13 +18496,13 @@ async function fsyncPath2(filePath) {
   }
 }
 async function atomicWriteJson(filePath, value) {
-  await mkdir10(path51.dirname(filePath), { recursive: true, mode: 448 });
+  await mkdir11(path52.dirname(filePath), { recursive: true, mode: 448 });
   const temporary = `${filePath}.tmp-${randomUUID4()}`;
   await writeFile7(temporary, `${JSON.stringify(value, null, 2)}
 `, { mode: 384 });
   await fsyncPath2(temporary);
-  await rename2(temporary, filePath);
-  await fsyncPath2(path51.dirname(filePath));
+  await rename3(temporary, filePath);
+  await fsyncPath2(path52.dirname(filePath));
 }
 async function writeRecoveryState(artifactDir, state, manifestHash, detail) {
   const value = {
@@ -18115,13 +18512,13 @@ async function writeRecoveryState(artifactDir, state, manifestHash, detail) {
     manifestHash,
     ...detail ? { detail } : {}
   };
-  await atomicWriteJson(path51.join(artifactDir, "state.json"), value);
+  await atomicWriteJson(path52.join(artifactDir, "state.json"), value);
 }
 async function directorySize(root) {
-  if (!existsSync13(root)) return 0;
+  if (!existsSync14(root)) return 0;
   let total = 0;
   for (const entry of await readdir2(root, { withFileTypes: true })) {
-    const entryPath = path51.join(root, entry.name);
+    const entryPath = path52.join(root, entry.name);
     if (entry.isDirectory()) total += await directorySize(entryPath);
     else total += (await lstat7(entryPath)).size;
   }
@@ -18166,9 +18563,9 @@ async function readRecoveryArtifact(stateDir, checkpointId) {
   let rawManifest;
   let state;
   try {
-    rawManifest = JSON.parse(await readFile9(path51.join(artifactDir, "manifest.json"), "utf8"));
+    rawManifest = JSON.parse(await readFile10(path52.join(artifactDir, "manifest.json"), "utf8"));
     state = JSON.parse(
-      await readFile9(path51.join(artifactDir, "state.json"), "utf8")
+      await readFile10(path52.join(artifactDir, "state.json"), "utf8")
     );
   } catch {
     throw new Error(RECOVERY_CHECKPOINT_CORRUPT);
@@ -18184,10 +18581,10 @@ async function readRecoveryArtifact(stateDir, checkpointId) {
   }
   const entryPaths = /* @__PURE__ */ new Set();
   for (const entry of manifest.entries) {
-    if (!entry || typeof entry !== "object" || Array.isArray(entry) || Object.keys(entry).length !== 3 || !Object.keys(entry).every((key) => ["path", "before", "after"].includes(key)) || typeof entry.path !== "string" || !("before" in entry) || !("after" in entry) || !validRecoveryRelativePath(entry.path) || entryPaths.has(path51.normalize(entry.path))) {
+    if (!entry || typeof entry !== "object" || Array.isArray(entry) || Object.keys(entry).length !== 3 || !Object.keys(entry).every((key) => ["path", "before", "after"].includes(key)) || typeof entry.path !== "string" || !("before" in entry) || !("after" in entry) || !validRecoveryRelativePath(entry.path) || entryPaths.has(path52.normalize(entry.path))) {
       throw new Error(RECOVERY_CHECKPOINT_CORRUPT);
     }
-    entryPaths.add(path51.normalize(entry.path));
+    entryPaths.add(path52.normalize(entry.path));
     for (const [side, snapshot] of [
       ["before", entry.before],
       ["after", entry.after]
@@ -18201,9 +18598,9 @@ async function readRecoveryArtifact(stateDir, checkpointId) {
       });
     }
   }
-  const receiptPath = path51.join(artifactDir, "receipt.json");
+  const receiptPath = path52.join(artifactDir, "receipt.json");
   let receipt;
-  if (["applied", "restoring", "restored", "conflict"].includes(state.state) || existsSync13(receiptPath)) {
+  if (["applied", "restoring", "restored", "conflict"].includes(state.state) || existsSync14(receiptPath)) {
     receipt = await readAndValidateRecoveryReceipt(artifactDir, manifest, manifestHash);
   }
   return { artifactDir, manifest, state, manifestHash, ...receipt ? { receipt } : {} };
@@ -18211,7 +18608,7 @@ async function readRecoveryArtifact(stateDir, checkpointId) {
 async function readAndValidateRecoveryReceipt(artifactDir, manifest, manifestHash) {
   let rawReceipt;
   try {
-    rawReceipt = JSON.parse(await readFile9(path51.join(artifactDir, "receipt.json"), "utf8"));
+    rawReceipt = JSON.parse(await readFile10(path52.join(artifactDir, "receipt.json"), "utf8"));
   } catch {
     throw new Error(RECOVERY_CHECKPOINT_CORRUPT);
   }
@@ -18234,8 +18631,8 @@ async function readAndValidateRecoveryReceipt(artifactDir, manifest, manifestHas
   return receipt;
 }
 async function ensureRecoveryReceipt(artifactDir, manifest, manifestHash) {
-  const receiptPath = path51.join(artifactDir, "receipt.json");
-  if (existsSync13(receiptPath)) {
+  const receiptPath = path52.join(artifactDir, "receipt.json");
+  if (existsSync14(receiptPath)) {
     return readAndValidateRecoveryReceipt(artifactDir, manifest, manifestHash);
   }
   const receipt = {
@@ -18252,14 +18649,14 @@ async function ensureRecoveryReceipt(artifactDir, manifest, manifestHash) {
 }
 async function checkpointIds(stateDir) {
   const root = checkpointsRoot(stateDir);
-  if (!existsSync13(root)) return [];
+  if (!existsSync14(root)) return [];
   return (await readdir2(root, { withFileTypes: true })).filter((entry) => entry.isDirectory() && /^cp_[a-f0-9]{24}$/.test(entry.name)).map((entry) => entry.name);
 }
 async function artifactRepoRoot(stateDir, checkpointId) {
   const artifactDir = checkpointDir(stateDir, checkpointId);
   try {
     const manifest = JSON.parse(
-      await readFile9(path51.join(artifactDir, "manifest.json"), "utf8")
+      await readFile10(path52.join(artifactDir, "manifest.json"), "utf8")
     );
     if (typeof manifest.repoRoot === "string" && manifest.repoRoot) {
       return canonicalPath(manifest.repoRoot);
@@ -18267,7 +18664,7 @@ async function artifactRepoRoot(stateDir, checkpointId) {
   } catch {
   }
   try {
-    const owner = JSON.parse(await readFile9(path51.join(artifactDir, "owner.json"), "utf8"));
+    const owner = JSON.parse(await readFile10(path52.join(artifactDir, "owner.json"), "utf8"));
     return typeof owner.repoRoot === "string" && owner.repoRoot ? canonicalPath(owner.repoRoot) : null;
   } catch {
     return null;
@@ -18283,14 +18680,14 @@ async function checkpointIdsForRepo(stateDir, repoRoot) {
 }
 async function cleanupOrphanedStaging(stateDir) {
   const root = checkpointsRoot(stateDir);
-  if (!existsSync13(root)) return;
+  if (!existsSync14(root)) return;
   const now = Date.now();
   for (const entry of await readdir2(root, { withFileTypes: true })) {
     if (!entry.isDirectory() || !/^\.tmp-cp_[a-f0-9]{24}$/.test(entry.name)) continue;
-    const stagingPath = path51.join(root, entry.name);
+    const stagingPath = path52.join(root, entry.name);
     let stale = false;
     try {
-      const owner = JSON.parse(await readFile9(path51.join(stagingPath, "owner.json"), "utf8"));
+      const owner = JSON.parse(await readFile10(path52.join(stagingPath, "owner.json"), "utf8"));
       const pid = typeof owner.pid === "number" ? owner.pid : Number.NaN;
       const createdAt = typeof owner.createdAt === "string" ? Date.parse(owner.createdAt) : NaN;
       let alive = false;
@@ -18330,9 +18727,9 @@ async function markRecoveryCheckpointApplied(stateDir, checkpoint) {
 
 // src/core/recovery/reconcile.ts
 init_fingerprint2();
-import { existsSync as existsSync14 } from "node:fs";
-import { readFile as readFile10 } from "node:fs/promises";
-import path52 from "node:path";
+import { existsSync as existsSync15 } from "node:fs";
+import { readFile as readFile11 } from "node:fs/promises";
+import path53 from "node:path";
 async function matchRecoverySide(resourceRoot, entries, side) {
   for (const entry of entries) {
     const target = await assertRecoverySafeTarget(resourceRoot, entry.path);
@@ -18346,9 +18743,9 @@ async function reconcileRecoveryCheckpoint(stateDir, checkpointId) {
     loaded = await readRecoveryArtifact(stateDir, checkpointId);
   } catch {
     const artifactDir = checkpointDir(stateDir, checkpointId);
-    if (existsSync14(artifactDir)) {
-      const manifestPath = path52.join(artifactDir, "manifest.json");
-      const hash = existsSync14(manifestPath) ? hashValue(await readFile10(manifestPath, "utf8")) : "unavailable";
+    if (existsSync15(artifactDir)) {
+      const manifestPath = path53.join(artifactDir, "manifest.json");
+      const hash = existsSync15(manifestPath) ? hashValue(await readFile11(manifestPath, "utf8")) : "unavailable";
       await writeRecoveryState(artifactDir, "corrupt", hash, RECOVERY_CHECKPOINT_CORRUPT);
     }
     return "corrupt";
@@ -18383,8 +18780,8 @@ async function reconcileRecoveryCheckpoint(stateDir, checkpointId) {
 
 // src/core/recovery/resource-identity.ts
 init_fingerprint2();
-import { lstat as lstat8, readFile as readFile11, realpath as realpath3 } from "node:fs/promises";
-import path53 from "node:path";
+import { lstat as lstat8, readFile as readFile12, realpath as realpath3 } from "node:fs/promises";
+import path54 from "node:path";
 async function currentRecoveryResourceIdentity(resourceRoot, resourceKind) {
   const resolvedRoot = await realpath3(resourceRoot);
   if (resourceKind === "directory") {
@@ -18392,13 +18789,13 @@ async function currentRecoveryResourceIdentity(resourceRoot, resourceKind) {
     if (!rootInfo.isDirectory()) throw new Error("recovery_repo_identity_unavailable");
     return hashValue(`${resolvedRoot}\0${rootInfo.dev}:${rootInfo.ino}:${rootInfo.birthtimeMs}`);
   }
-  const dotGit = path53.join(resolvedRoot, ".git");
+  const dotGit = path54.join(resolvedRoot, ".git");
   const gitInfo = await lstat8(dotGit);
   let gitMetadataPath = dotGit;
   if (gitInfo.isFile()) {
-    const marker = (await readFile11(dotGit, "utf8")).trim();
+    const marker = (await readFile12(dotGit, "utf8")).trim();
     if (!marker.startsWith("gitdir:")) throw new Error("recovery_repo_identity_unavailable");
-    gitMetadataPath = path53.resolve(resolvedRoot, marker.slice("gitdir:".length).trim());
+    gitMetadataPath = path54.resolve(resolvedRoot, marker.slice("gitdir:".length).trim());
   } else if (!gitInfo.isDirectory()) {
     throw new Error("recovery_repo_identity_unavailable");
   }
@@ -18463,7 +18860,7 @@ async function garbageCollect(stateDir, config, repoRoot) {
 async function prepareRecoveryCheckpoint(params) {
   const backend = params.backend ?? "git_worktree";
   const resourceKind = await resolveRecoveryResourceKind(backend, params.repoRoot);
-  await mkdir11(checkpointsRoot(params.stateDir), { recursive: true, mode: 448 });
+  await mkdir12(checkpointsRoot(params.stateDir), { recursive: true, mode: 448 });
   await cleanupOrphanedStaging(params.stateDir);
   await garbageCollect(params.stateDir, params.config, params.repoRoot);
   const existing = await checkpointIdsForRepo(params.stateDir, params.repoRoot);
@@ -18471,16 +18868,16 @@ async function prepareRecoveryCheckpoint(params) {
     throw new Error(RECOVERY_CHECKPOINT_QUOTA);
   }
   const checkpointId = `cp_${randomUUID5().replaceAll("-", "").slice(0, 24)}`;
-  const temporary = path54.join(checkpointsRoot(params.stateDir), `.tmp-${checkpointId}`);
+  const temporary = path55.join(checkpointsRoot(params.stateDir), `.tmp-${checkpointId}`);
   const finalDir = checkpointDir(params.stateDir, checkpointId);
-  await mkdir11(temporary, { recursive: true, mode: 448 });
-  await atomicWriteJson(path54.join(temporary, "owner.json"), {
+  await mkdir12(temporary, { recursive: true, mode: 448 });
+  await atomicWriteJson(path55.join(temporary, "owner.json"), {
     version: 1,
     pid: process.pid,
     createdAt: (/* @__PURE__ */ new Date()).toISOString(),
     repoRoot: canonicalPath(params.repoRoot)
   });
-  await mkdir11(path54.join(temporary, "blobs"), { recursive: true, mode: 448 });
+  await mkdir12(path55.join(temporary, "blobs"), { recursive: true, mode: 448 });
   try {
     const entries = [];
     const protectedRoots = (params.protectedRoots ?? []).map(canonicalPath);
@@ -18489,8 +18886,8 @@ async function prepareRecoveryCheckpoint(params) {
     )) {
       const target = await assertRecoverySafeTarget(params.repoRoot, change.relativePath);
       if (protectedRoots.some((root) => {
-        const relative = path54.relative(root, target);
-        return relative === "" || relative !== ".." && !relative.startsWith(`..${path54.sep}`) && !path54.isAbsolute(relative);
+        const relative = path55.relative(root, target);
+        return relative === "" || relative !== ".." && !relative.startsWith(`..${path55.sep}`) && !path55.isAbsolute(relative);
       })) {
         throw new Error("recovery_protected_path");
       }
@@ -18502,7 +18899,7 @@ async function prepareRecoveryCheckpoint(params) {
       entries.push({
         path: change.relativePath,
         before: await captureRecoverySnapshot(baseline, {
-          blobDir: path54.join(temporary, "blobs")
+          blobDir: path55.join(temporary, "blobs")
         }),
         after: withoutRecoveryBlob(await captureRecoverySnapshot(source))
       });
@@ -18539,12 +18936,12 @@ async function prepareRecoveryCheckpoint(params) {
       entries
     };
     const manifestHash = hashValue(canonicalStringify(manifest));
-    await atomicWriteJson(path54.join(temporary, "manifest.json"), manifest);
+    await atomicWriteJson(path55.join(temporary, "manifest.json"), manifest);
     await writeRecoveryState(temporary, "prepared", manifestHash);
     await fsyncPath2(temporary);
     const projectedBytes = await recoveryCheckpointStorageBytes(params.stateDir, params.repoRoot);
     if (projectedBytes > params.config.maxBytes) throw new Error(RECOVERY_CHECKPOINT_QUOTA);
-    await rename3(temporary, finalDir);
+    await rename4(temporary, finalDir);
     await fsyncPath2(checkpointsRoot(params.stateDir));
     return {
       checkpointId,
@@ -18582,7 +18979,7 @@ async function listRecoveryCheckpoints(stateDir, repoRoot) {
       } catch {
         try {
           const raw = JSON.parse(
-            await readFile12(path54.join(checkpointDir(stateDir, id), "manifest.json"), "utf8")
+            await readFile13(path55.join(checkpointDir(stateDir, id), "manifest.json"), "utf8")
           );
           rootFromArtifact = typeof raw.repoRoot === "string" && raw.repoRoot ? raw.repoRoot : void 0;
         } catch {
@@ -18616,7 +19013,7 @@ async function listRecoveryCheckpoints(stateDir, repoRoot) {
     } catch {
       try {
         const manifest = JSON.parse(
-          await readFile12(path54.join(checkpointDir(stateDir, id), "manifest.json"), "utf8")
+          await readFile13(path55.join(checkpointDir(stateDir, id), "manifest.json"), "utf8")
         );
         if (manifest.checkpointId !== id || ![1, 2].includes(manifest.version)) continue;
         if (repoRoot && canonicalPath(manifest.repoRoot) !== canonicalPath(repoRoot)) continue;
@@ -18641,12 +19038,12 @@ async function listRecoveryCheckpoints(stateDir, repoRoot) {
 async function recoveryCheckpointStorageBytes(stateDir, repoRoot) {
   const root = checkpointsRoot(stateDir);
   if (!repoRoot) return directorySize(root);
-  if (!existsSync15(root)) return 0;
+  if (!existsSync16(root)) return 0;
   const expected = canonicalPath(repoRoot);
   let total = 0;
   for (const entry of await readdir3(root, { withFileTypes: true })) {
     if (!entry.isDirectory()) continue;
-    const entryPath = path54.join(root, entry.name);
+    const entryPath = path55.join(root, entry.name);
     if (/^cp_[a-f0-9]{24}$/.test(entry.name)) {
       if (await artifactRepoRoot(stateDir, entry.name) === expected) {
         total += await directorySize(entryPath);
@@ -18655,7 +19052,7 @@ async function recoveryCheckpointStorageBytes(stateDir, repoRoot) {
     }
     if (/^\.tmp-cp_[a-f0-9]{24}$/.test(entry.name)) {
       try {
-        const owner = JSON.parse(await readFile12(path54.join(entryPath, "owner.json"), "utf8"));
+        const owner = JSON.parse(await readFile13(path55.join(entryPath, "owner.json"), "utf8"));
         if (typeof owner.repoRoot === "string" && canonicalPath(owner.repoRoot) === expected) {
           total += await directorySize(entryPath);
         }
@@ -18697,16 +19094,16 @@ function recoveryFailClosedResult(predicted, reason, signals = []) {
 init_scrub();
 
 // src/core/transactional/file-checkpoint-backend.ts
-import { cp, lstat as lstat11, mkdir as mkdir13, mkdtemp as mkdtemp5, readdir as readdir6, rm as rm9, writeFile as writeFile10 } from "node:fs/promises";
+import { cp, lstat as lstat11, mkdir as mkdir14, mkdtemp as mkdtemp5, readdir as readdir6, rm as rm9, writeFile as writeFile10 } from "node:fs/promises";
 import os5 from "node:os";
-import path58 from "node:path";
+import path59 from "node:path";
 
 // src/core/transactional/file-checkpoint-git.ts
 init_path_utils();
 import { spawn as spawn8 } from "node:child_process";
 import { createHash as createHash13 } from "node:crypto";
-import { copyFile as copyFile3, lstat as lstat9, readdir as readdir4, readFile as readFile13 } from "node:fs/promises";
-import path55 from "node:path";
+import { copyFile as copyFile3, lstat as lstat9, readdir as readdir4, readFile as readFile14 } from "node:fs/promises";
+import path56 from "node:path";
 var FILE_CHECKPOINT_GIT_METADATA_CHANGED = "file_checkpoint_git_metadata_changed";
 var FILE_CHECKPOINT_SOURCE_CHANGED = "file_checkpoint_source_changed";
 var FILE_CHECKPOINT_CWD_OUTSIDE_ROOT = "file_checkpoint_cwd_outside_root";
@@ -18740,7 +19137,7 @@ function rethrowStableFileCheckpointError(error) {
 }
 async function rootGitMetadataPresent(repoRoot) {
   try {
-    await lstat9(path55.join(repoRoot, ".git"));
+    await lstat9(path56.join(repoRoot, ".git"));
     return true;
   } catch {
     return false;
@@ -18789,10 +19186,10 @@ function execGit2(repoRoot, args) {
 }
 async function resolveGitPath(repoRoot, gitPath) {
   const trimmed = gitPath.trim();
-  if (path55.isAbsolute(trimmed)) {
+  if (path56.isAbsolute(trimmed)) {
     return trimmed;
   }
-  return path55.join(repoRoot, trimmed);
+  return path56.join(repoRoot, trimmed);
 }
 async function cloneBareWorktreeCopy(sourceRoot, destinationRoot) {
   await execGit2(sourceRoot, [
@@ -18834,7 +19231,7 @@ async function copyGitIndexState(sourceRoot, destinationRoot) {
     destinationRoot,
     await execGit2(destinationRoot, ["rev-parse", "--git-dir"])
   );
-  const destinationShared = path55.join(destinationGitDir, path55.basename(sourceShared));
+  const destinationShared = path56.join(destinationGitDir, path56.basename(sourceShared));
   try {
     await copyFile3(sourceShared, destinationShared);
   } catch (error) {
@@ -18843,14 +19240,14 @@ async function copyGitIndexState(sourceRoot, destinationRoot) {
 }
 async function readGitFile(gitDir, relativePath) {
   try {
-    return await readFile13(path55.join(gitDir, relativePath));
+    return await readFile14(path56.join(gitDir, relativePath));
   } catch {
     return null;
   }
 }
 async function readAbsoluteGitFile(absolutePath) {
   try {
-    return await readFile13(absolutePath);
+    return await readFile14(absolutePath);
   } catch {
     return null;
   }
@@ -18867,8 +19264,8 @@ async function hashResolvedGitPath(repoRoot, gitDir, gitPath, hash) {
       repoRoot,
       await execGit2(repoRoot, ["rev-parse", "--git-path", gitPath])
     );
-    const relative = path55.resolve(resolved).startsWith(path55.resolve(gitDir)) ? path55.relative(gitDir, resolved) : resolved;
-    const content = typeof relative === "string" && !relative.startsWith("..") && !path55.isAbsolute(relative) ? await readGitFile(gitDir, relative) : await readAbsoluteGitFile(resolved);
+    const relative = path56.resolve(resolved).startsWith(path56.resolve(gitDir)) ? path56.relative(gitDir, resolved) : resolved;
+    const content = typeof relative === "string" && !relative.startsWith("..") && !path56.isAbsolute(relative) ? await readGitFile(gitDir, relative) : await readAbsoluteGitFile(resolved);
     if (content !== null) {
       hashGitFileContent(hash, gitPath, content);
     }
@@ -18878,13 +19275,13 @@ async function hashResolvedGitPath(repoRoot, gitDir, gitPath, hash) {
 async function hashGitTree(gitDir, relativeDir, hash) {
   let names;
   try {
-    names = await readdir4(path55.join(gitDir, relativeDir));
+    names = await readdir4(path56.join(gitDir, relativeDir));
   } catch {
     return;
   }
   for (const name of names.sort()) {
-    const relativePath = relativeDir ? path55.join(relativeDir, name) : name;
-    const absolutePath = path55.join(gitDir, relativePath);
+    const relativePath = relativeDir ? path56.join(relativeDir, name) : name;
+    const absolutePath = path56.join(gitDir, relativePath);
     let childNames = null;
     try {
       childNames = await readdir4(absolutePath);
@@ -18906,7 +19303,7 @@ async function hashGitTree(gitDir, relativeDir, hash) {
 }
 async function computeGitMetadataFingerprint(repoRoot) {
   const gitDirRel = (await execGit2(repoRoot, ["rev-parse", "--git-dir"])).trim();
-  const gitDir = path55.isAbsolute(gitDirRel) ? gitDirRel : path55.join(repoRoot, gitDirRel);
+  const gitDir = path56.isAbsolute(gitDirRel) ? gitDirRel : path56.join(repoRoot, gitDirRel);
   const hash = createHash13("sha256");
   for (const file of [
     "HEAD",
@@ -18929,8 +19326,8 @@ async function computeGitMetadataFingerprint(repoRoot) {
     const sharedIndex = (await execGit2(repoRoot, ["rev-parse", "--shared-index-path"])).trim();
     if (sharedIndex) {
       const resolved = await resolveGitPath(repoRoot, sharedIndex);
-      const relative = path55.relative(gitDir, resolved);
-      const content = relative && !relative.startsWith("..") && !path55.isAbsolute(relative) ? await readGitFile(gitDir, relative) : await readAbsoluteGitFile(resolved);
+      const relative = path56.relative(gitDir, resolved);
+      const content = relative && !relative.startsWith("..") && !path56.isAbsolute(relative) ? await readGitFile(gitDir, relative) : await readAbsoluteGitFile(resolved);
       if (content !== null) {
         hashGitFileContent(hash, "shared-index", content);
       }
@@ -18941,7 +19338,7 @@ async function computeGitMetadataFingerprint(repoRoot) {
     await hashResolvedGitPath(repoRoot, gitDir, gitPath, hash);
   }
   try {
-    const rootGitPath = path55.join(repoRoot, ".git");
+    const rootGitPath = path56.join(repoRoot, ".git");
     const rootGitInfo = await lstat9(rootGitPath);
     if (rootGitInfo.isFile()) {
       const content = await readAbsoluteGitFile(rootGitPath);
@@ -18957,14 +19354,14 @@ async function computeGitMetadataFingerprint(repoRoot) {
 function resolveExecutionCwdRelative(resourceRoot, cwd) {
   const resolvedCwd = canonicalPath(cwd);
   const resourceCanonical = canonicalPath(resourceRoot);
-  const relative = path55.relative(resourceCanonical, resolvedCwd);
+  const relative = path56.relative(resourceCanonical, resolvedCwd);
   if (relative === "" || relative === ".") {
     return "";
   }
-  if (relative.startsWith("..") || path55.isAbsolute(relative)) {
+  if (relative.startsWith("..") || path56.isAbsolute(relative)) {
     throw new Error(FILE_CHECKPOINT_CWD_OUTSIDE_ROOT);
   }
-  return relative.split(path55.sep).join("/");
+  return relative.split(path56.sep).join("/");
 }
 
 // src/core/transactional/file-checkpoint-isolation.ts
@@ -18985,8 +19382,8 @@ function fileCheckpointIsolationReason(context) {
 }
 
 // src/core/transactional/file-checkpoint-staging.ts
-import { readdir as readdir5, readFile as readFile14, rm as rm7, writeFile as writeFile8 } from "node:fs/promises";
-import path56 from "node:path";
+import { readdir as readdir5, readFile as readFile15, rm as rm7, writeFile as writeFile8 } from "node:fs/promises";
+import path57 from "node:path";
 function isOwnerProcessAlive(pid) {
   try {
     process.kill(pid, 0);
@@ -18996,12 +19393,12 @@ function isOwnerProcessAlive(pid) {
   }
 }
 async function writeOwnerMarker(stagingRoot, marker) {
-  await writeFile8(path56.join(stagingRoot, "owner.json"), `${JSON.stringify(marker)}
+  await writeFile8(path57.join(stagingRoot, "owner.json"), `${JSON.stringify(marker)}
 `, "utf8");
 }
 async function readOwnerMarker(stagingRoot) {
   try {
-    const raw = await readFile14(path56.join(stagingRoot, "owner.json"), "utf8");
+    const raw = await readFile15(path57.join(stagingRoot, "owner.json"), "utf8");
     return JSON.parse(raw.trim());
   } catch {
     return null;
@@ -19019,7 +19416,7 @@ async function collectDeadOwnerStaging(parentDir) {
     if (!name.startsWith("belay-file-checkpoint-")) {
       continue;
     }
-    const stagingRoot = path56.join(parentDir, name);
+    const stagingRoot = path57.join(parentDir, name);
     const marker = await readOwnerMarker(stagingRoot);
     if (!marker) {
       dead.push(stagingRoot);
@@ -19042,7 +19439,7 @@ import { constants as fsConstants2 } from "node:fs";
 import {
   copyFile as copyFile4,
   lstat as lstat10,
-  mkdir as mkdir12,
+  mkdir as mkdir13,
   mkdtemp as mkdtemp4,
   readlink as readlink5,
   rm as rm8,
@@ -19051,17 +19448,17 @@ import {
   writeFile as writeFile9
 } from "node:fs/promises";
 import os4 from "node:os";
-import path57 from "node:path";
+import path58 from "node:path";
 var FILE_CHECKPOINT_COPY_FAILED = "file_checkpoint_copy_failed";
 async function chmodSafe2(target, mode) {
   try {
-    const { chmod: chmod4 } = await import("node:fs/promises");
-    await chmod4(target, mode & 511);
+    const { chmod: chmod5 } = await import("node:fs/promises");
+    await chmod5(target, mode & 511);
   } catch {
   }
 }
 async function copyRegularFile(sourcePath, destinationPath, mode, strategy) {
-  await mkdir12(path57.dirname(destinationPath), { recursive: true });
+  await mkdir13(path58.dirname(destinationPath), { recursive: true });
   if (strategy === "clonefile" && fsConstants2.COPYFILE_FICLONE !== void 0) {
     try {
       await copyFile4(sourcePath, destinationPath, fsConstants2.COPYFILE_FICLONE);
@@ -19083,11 +19480,11 @@ async function copyNode(sourceRoot, destinationRoot, relativePath, strategy) {
   const info = await lstat10(sourcePath);
   await rm8(destinationPath, { force: true, recursive: false });
   if (info.isDirectory() && !info.isSymbolicLink()) {
-    await mkdir12(destinationPath, { recursive: true, mode: info.mode & 511 });
+    await mkdir13(destinationPath, { recursive: true, mode: info.mode & 511 });
     return strategy;
   }
   if (info.isSymbolicLink()) {
-    await mkdir12(path57.dirname(destinationPath), { recursive: true });
+    await mkdir13(path58.dirname(destinationPath), { recursive: true });
     await symlink4(await readlink5(sourcePath), destinationPath);
     return strategy;
   }
@@ -19143,9 +19540,9 @@ async function mapWithConcurrency(items, concurrency, worker) {
 async function probeFileCloneStrategy() {
   let tempDir = null;
   try {
-    tempDir = await mkdtemp4(path57.join(os4.tmpdir(), "belay-clone-probe-"));
-    const source = path57.join(tempDir, "source.txt");
-    const destination = path57.join(tempDir, "dest.txt");
+    tempDir = await mkdtemp4(path58.join(os4.tmpdir(), "belay-clone-probe-"));
+    const source = path58.join(tempDir, "source.txt");
+    const destination = path58.join(tempDir, "dest.txt");
     await writeFile9(source, "probe\n");
     if (fsConstants2.COPYFILE_FICLONE_FORCE !== void 0) {
       try {
@@ -19298,11 +19695,11 @@ async function protectedRootState(root) {
   return `directory:${node.hash}:${index.treeHash}`;
 }
 function executionProtectedRoot(resourceRoot, executionRoot, protectedRoot) {
-  const relative = path58.relative(path58.resolve(resourceRoot), path58.resolve(protectedRoot));
-  if (relative === "" || relative.startsWith("..") || path58.isAbsolute(relative)) {
+  const relative = path59.relative(path59.resolve(resourceRoot), path59.resolve(protectedRoot));
+  if (relative === "" || relative.startsWith("..") || path59.isAbsolute(relative)) {
     return null;
   }
-  return path58.join(executionRoot, relative);
+  return path59.join(executionRoot, relative);
 }
 async function captureProtectedRootStates(resourceRoot, executionRoot, protectedRoots) {
   const states = /* @__PURE__ */ new Map();
@@ -19327,15 +19724,15 @@ async function directoryByteSize(root, deadlineMs) {
   }
   let total = 0;
   for (const name of await readdir6(root)) {
-    total += await directoryByteSize(path58.join(root, name), deadlineMs);
+    total += await directoryByteSize(path59.join(root, name), deadlineMs);
   }
   return total;
 }
 async function copyGitMetadataDirectory(sourceRoot, destinationRoot) {
   const gitDirRel = (await execGit2(sourceRoot, ["rev-parse", "--git-dir"])).trim();
-  const sourceGitDir = path58.isAbsolute(gitDirRel) ? gitDirRel : path58.join(sourceRoot, gitDirRel);
-  const relativeGitDir = path58.relative(path58.resolve(sourceRoot), path58.resolve(sourceGitDir));
-  const destinationGitDir = relativeGitDir && !relativeGitDir.startsWith("..") ? path58.join(destinationRoot, relativeGitDir) : path58.join(destinationRoot, ".git");
+  const sourceGitDir = path59.isAbsolute(gitDirRel) ? gitDirRel : path59.join(sourceRoot, gitDirRel);
+  const relativeGitDir = path59.relative(path59.resolve(sourceRoot), path59.resolve(sourceGitDir));
+  const destinationGitDir = relativeGitDir && !relativeGitDir.startsWith("..") ? path59.join(destinationRoot, relativeGitDir) : path59.join(destinationRoot, ".git");
   await cp(sourceGitDir, destinationGitDir, { recursive: true, force: true });
 }
 async function prepareDirtyGitSnapshot(context) {
@@ -19344,7 +19741,7 @@ async function prepareDirtyGitSnapshot(context) {
   const quotas = context.fileCheckpoint;
   const deadlineMs = Date.now() + quotas.prepareTimeoutMs;
   await removeDeadOwnerStaging(os5.tmpdir());
-  const stagingRoot = await mkdtemp5(path58.join(os5.tmpdir(), "belay-file-checkpoint-"));
+  const stagingRoot = await mkdtemp5(path59.join(os5.tmpdir(), "belay-file-checkpoint-"));
   await writeOwnerMarker(stagingRoot, {
     version: 1,
     pid: process.pid,
@@ -19352,8 +19749,8 @@ async function prepareDirtyGitSnapshot(context) {
     resourceRoot: context.repoRoot,
     backend: "file_checkpoint"
   });
-  const baselineRoot = path58.join(stagingRoot, "baseline");
-  const executionRoot = path58.join(stagingRoot, "execution");
+  const baselineRoot = path59.join(stagingRoot, "baseline");
+  const executionRoot = path59.join(stagingRoot, "execution");
   try {
     resolveExecutionCwdRelative(context.repoRoot, context.cwd);
     const sourceGitMetadataFingerprint = await computeGitMetadataFingerprint(context.repoRoot);
@@ -19387,7 +19784,7 @@ async function prepareDirtyGitSnapshot(context) {
       throw new Error(FILE_CHECKPOINT_SOURCE_CHANGED);
     }
     await writeFile10(
-      path58.join(stagingRoot, "baseline-index.json"),
+      path59.join(stagingRoot, "baseline-index.json"),
       `${JSON.stringify(baselineIndex)}
 `,
       "utf8"
@@ -19437,7 +19834,7 @@ async function prepareNonGitSnapshot(context) {
   const quotas = context.fileCheckpoint;
   const deadlineMs = Date.now() + quotas.prepareTimeoutMs;
   await removeDeadOwnerStaging(os5.tmpdir());
-  const stagingRoot = await mkdtemp5(path58.join(os5.tmpdir(), "belay-file-checkpoint-"));
+  const stagingRoot = await mkdtemp5(path59.join(os5.tmpdir(), "belay-file-checkpoint-"));
   await writeOwnerMarker(stagingRoot, {
     version: 1,
     pid: process.pid,
@@ -19445,8 +19842,8 @@ async function prepareNonGitSnapshot(context) {
     resourceRoot: context.repoRoot,
     backend: "file_checkpoint"
   });
-  const baselineRoot = path58.join(stagingRoot, "baseline");
-  const executionRoot = path58.join(stagingRoot, "execution");
+  const baselineRoot = path59.join(stagingRoot, "baseline");
+  const executionRoot = path59.join(stagingRoot, "execution");
   try {
     resolveExecutionCwdRelative(context.repoRoot, context.cwd);
     const resourceIdentity = await currentRecoveryResourceIdentity(context.repoRoot, "directory");
@@ -19455,7 +19852,7 @@ async function prepareNonGitSnapshot(context) {
       quotas,
       deadlineMs
     });
-    await mkdir13(baselineRoot, { recursive: true });
+    await mkdir14(baselineRoot, { recursive: true });
     const baselineIndex = await buildFileTreeIndex({
       resourceRoot: baselineRoot,
       excludedRoots,
@@ -19475,7 +19872,7 @@ async function prepareNonGitSnapshot(context) {
       throw new Error(FILE_CHECKPOINT_SOURCE_CHANGED);
     }
     await writeFile10(
-      path58.join(stagingRoot, "baseline-index.json"),
+      path59.join(stagingRoot, "baseline-index.json"),
       `${JSON.stringify(baselineIndex)}
 `,
       "utf8"
@@ -19485,7 +19882,7 @@ async function prepareNonGitSnapshot(context) {
       quotas,
       deadlineMs
     });
-    await mkdir13(executionRoot, { recursive: true });
+    await mkdir14(executionRoot, { recursive: true });
     const finalSourceIndex = await buildFileTreeIndex({
       resourceRoot: context.repoRoot,
       excludedRoots,
@@ -19828,10 +20225,10 @@ async function selectTransactionalBackend(context) {
 }
 
 // src/core/transactional/diff-evaluator.ts
-import path59 from "node:path";
+import path60 from "node:path";
 init_path_utils();
 function categorizeChange(change, ctx) {
-  const absolutePath = canonicalPath(path59.join(ctx.repoRoot, change.relativePath));
+  const absolutePath = canonicalPath(path60.join(ctx.repoRoot, change.relativePath));
   if (!pathWithinRoot(ctx.repoRoot, absolutePath)) {
     return "repo_outside";
   }
@@ -20381,17 +20778,55 @@ function formatJudgeInfrastructureDenyMessage(params) {
 }
 
 // src/core/notify.ts
+init_path_utils();
 import { execFile } from "node:child_process";
+import path61 from "node:path";
 import { promisify } from "node:util";
 var execFileAsync = promisify(execFile);
-async function notifyDeny(config, event) {
-  const payload = JSON.stringify(event);
-  if (config.webhookUrl) {
+var LOOPBACK_WEBHOOK_HOSTS = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "::1"]);
+function webhookConfigIssue(url) {
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    return `notifications.webhookUrl is invalid: ${url}`;
+  }
+  if (parsed.protocol === "https:") {
+    return null;
+  }
+  const normalizedHostname = parsed.hostname.toLowerCase().replace(/^\[|\]$/g, "");
+  if (parsed.protocol === "http:" && LOOPBACK_WEBHOOK_HOSTS.has(normalizedHostname)) {
+    return null;
+  }
+  return `notifications.webhookUrl must use https (http is allowed only for localhost, 127.0.0.1, or ::1): ${url}`;
+}
+function commandHookConfigIssue(commandHook, repoRoot) {
+  if (!path61.isAbsolute(commandHook)) {
+    return `notifications.commandHook must be an absolute path: ${commandHook}`;
+  }
+  if (pathWithinRoot(canonicalPath(repoRoot), canonicalPath(commandHook))) {
+    return `notifications.commandHook must not be inside the repository: ${commandHook}`;
+  }
+  return null;
+}
+async function notifyDeny(config, event, deps = {
+  fetch: globalThis.fetch.bind(globalThis),
+  execFile: (file, args, options) => execFileAsync(file, [...args], options)
+}) {
+  const payload = JSON.stringify({
+    approvalId: event.approvalId,
+    reason: event.reason,
+    summary: event.summary,
+    repoRoot: event.repoRoot,
+    fingerprint: event.fingerprint
+  });
+  const webhookIssue = config.webhookUrl ? webhookConfigIssue(config.webhookUrl) : null;
+  if (config.webhookUrl && !webhookIssue) {
     try {
       const controller = new AbortController();
       const timeout = setTimeout(() => controller.abort(), 5e3);
       try {
-        await fetch(config.webhookUrl, {
+        await deps.fetch(config.webhookUrl, {
           method: "POST",
           headers: { "content-type": "application/json" },
           body: payload,
@@ -20403,17 +20838,16 @@ async function notifyDeny(config, event) {
     } catch {
     }
   }
-  if (config.commandHook) {
+  const commandHookIssue = config.commandHook ? commandHookConfigIssue(config.commandHook, event.repoRoot) : null;
+  if (config.commandHook && !commandHookIssue) {
     try {
-      await execFileAsync(config.commandHook, [], {
+      await deps.execFile(config.commandHook, [], {
         env: {
-          ...process.env,
           BELAY_APPROVAL_ID: event.approvalId,
           BELAY_REASON: event.reason,
           BELAY_SUMMARY: event.summary,
           BELAY_REPO_ROOT: event.repoRoot,
-          BELAY_FINGERPRINT: event.fingerprint,
-          BELAY_APPROVAL_TOKEN: event.approvalToken ?? ""
+          BELAY_FINGERPRINT: event.fingerprint
         }
       });
     } catch {
@@ -20423,9 +20857,10 @@ async function notifyDeny(config, event) {
 
 // src/adapters/shared/gate-runtime.ts
 init_path_utils();
+init_repo_config_trust();
 
 // src/adapters/layouts/protected-paths.ts
-import path60 from "node:path";
+import path62 from "node:path";
 function protectedArtifactRoots(layout, repoRoot, controlPlaneDir) {
   const roots = [
     layout.configPath(repoRoot),
@@ -20437,7 +20872,7 @@ function protectedArtifactRoots(layout, repoRoot, controlPlaneDir) {
   if (controlPlaneDir) {
     roots.push(controlPlaneDir);
   }
-  return roots.map((entry) => path60.resolve(entry));
+  return roots.map((entry) => path62.resolve(entry));
 }
 
 // src/adapters/shared/gate-runtime.ts
@@ -20478,7 +20913,7 @@ async function appendReplayAuditSafely(ctx, deps, event) {
 }
 async function loadJsonFile(filePath, fallback) {
   try {
-    const raw = await readFile15(filePath, "utf8");
+    const raw = await readFile16(filePath, "utf8");
     return JSON.parse(raw);
   } catch {
     return fallback;
@@ -20487,11 +20922,18 @@ async function loadJsonFile(filePath, fallback) {
 function createDefaultGateRuntimeDeps() {
   return {
     async readConfig(configPath) {
-      return loadJsonFile(configPath, {});
+      try {
+        return JSON.parse(await readFile16(configPath, "utf8"));
+      } catch (error) {
+        if (error.code === "ENOENT") {
+          return {};
+        }
+        throw error;
+      }
     },
     async appendAudit(ctx, event) {
-      const auditPath = path61.join(ctx.repoRoot, ctx.config.audit.logPath);
-      await mkdir14(path61.dirname(auditPath), { recursive: true });
+      const auditPath = path63.join(ctx.repoRoot, ctx.config.audit.logPath);
+      await mkdir15(path63.dirname(auditPath), { recursive: true });
       const provenance = auditProvenance(ctx.config);
       const record = {
         timestamp: (/* @__PURE__ */ new Date()).toISOString(),
@@ -20524,7 +20966,7 @@ function createDefaultGateRuntimeDeps() {
       };
     },
     async writeApprovals(filePath, state) {
-      await mkdir14(path61.dirname(filePath), { recursive: true });
+      await mkdir15(path63.dirname(filePath), { recursive: true });
       await writeFile11(filePath, `${JSON.stringify(compactApprovals(state), null, 2)}
 `, "utf8");
     },
@@ -20545,10 +20987,11 @@ function createDefaultGateRuntimeDeps() {
 }
 async function resolveGateConfig(ctx, deps) {
   const loaded = await deps.readConfig(ctx.configPath);
+  await assertRepoConfigTrusted(ctx.repoRoot, ctx.layout.name, loaded);
   let teamConfig = null;
   const teamPath = teamConfigPath();
-  if (existsSync16(teamPath)) {
-    teamConfig = JSON.parse(await readFile15(teamPath, "utf8"));
+  if (existsSync17(teamPath)) {
+    teamConfig = JSON.parse(await readFile16(teamPath, "utf8"));
   }
   return resolveLayeredConfig({
     repoConfig: loaded,
@@ -20686,7 +21129,7 @@ function deriveWorkspaceRootScopeHint(params) {
   if (!targetPath) {
     return void 0;
   }
-  const candidateRoot = canonicalPath(path61.dirname(targetPath));
+  const candidateRoot = canonicalPath(path63.dirname(targetPath));
   const validation = validateTrustedWorkspaceRootCandidate({
     candidatePath: candidateRoot,
     repoRoot: action.repoRoot,
@@ -21262,7 +21705,7 @@ async function gateDecisionToVerdict(ctx, deps, kind, result, auditExtras = {})
     event: auditEvent,
     sourceEvent,
     kind,
-    repoLabel: path61.basename(ctx.repoRoot),
+    repoLabel: path63.basename(ctx.repoRoot),
     ...auditExtras.toolInvocationCorrelationId ? { toolInvocationCorrelationId: auditExtras.toolInvocationCorrelationId } : {},
     fingerprint: result.fingerprint,
     summary: result.normalizedCommand ?? result.summary ?? "",
@@ -21294,21 +21737,6 @@ async function gateDecisionToVerdict(ctx, deps, kind, result, auditExtras = {})
     if (created) {
       await recordGateApprovalAsk(stateDir, result.reason, false);
     }
-    let approvalToken;
-    try {
-      approvalToken = await issueApprovalToken(
-        {
-          approvalId: approval.approvalId,
-          fingerprint: approval.fingerprint,
-          repoRoot: approval.repoRoot,
-          issuedAt: approval.createdAt,
-          expiresAt: approval.expiresAt
-        },
-        configuredControlPlaneDir(ctx.config)
-      );
-    } catch {
-      approvalToken = void 0;
-    }
     const denialReason = failure?.reason ?? result.reason;
     if (ctx.config.notifications.webhookUrl || ctx.config.notifications.commandHook) {
       await notifyDeny(ctx.config.notifications, {
@@ -21316,8 +21744,7 @@ async function gateDecisionToVerdict(ctx, deps, kind, result, auditExtras = {})
         reason: denialReason,
         summary: result.normalizedCommand ?? result.summary ?? "",
         repoRoot: ctx.repoRoot,
-        fingerprint: result.fingerprint,
-        approvalToken
+        fingerprint: result.fingerprint
       });
     }
     const failureAuditFields = typeof failure?.auditFields === "function" ? failure.auditFields(approval) : failure?.auditFields;
@@ -21728,38 +22155,38 @@ async function appendObservedAudit(ctx, deps, eventName, payload) {
 }
 
 // src/adapters/shared/repo-root.ts
-import { existsSync as existsSync17 } from "node:fs";
-import path62 from "node:path";
+import { existsSync as existsSync18 } from "node:fs";
+import path64 from "node:path";
 function belayConfigPath(current, adapterName) {
   if (adapterName === "cursor") {
-    return path62.join(current, ".cursor", "belay.config.json");
+    return path64.join(current, ".cursor", "belay.config.json");
   }
   if (adapterName === "claude") {
-    return path62.join(current, ".claude", "belay.config.json");
+    return path64.join(current, ".claude", "belay.config.json");
   }
-  return path62.join(current, ".codex", "belay.config.json");
+  return path64.join(current, ".codex", "belay.config.json");
 }
 function markerMatches(current, marker, layout) {
-  const markerPath = path62.join(current, marker);
-  if (!existsSync17(markerPath)) {
+  const markerPath = path64.join(current, marker);
+  if (!existsSync18(markerPath)) {
     return false;
   }
   if (marker === ".cursor" || marker === ".claude" || marker === ".codex") {
-    return existsSync17(belayConfigPath(current, layout.name));
+    return existsSync18(belayConfigPath(current, layout.name));
   }
   return true;
 }
 function findRepoRoot(startPath, layout) {
-  let current = path62.resolve(startPath);
+  let current = path64.resolve(startPath);
   while (true) {
     for (const marker of layout.repoRootMarkers) {
       if (markerMatches(current, marker, layout)) {
         return current;
       }
     }
-    const parent = path62.dirname(current);
+    const parent = path64.dirname(current);
     if (parent === current) {
-      return path62.resolve(startPath);
+      return path64.resolve(startPath);
     }
     current = parent;
   }
@@ -21957,25 +22384,12 @@ async function runToolGateHook(_eventName) {
       return;
     }
     if (!mappedKind) {
-      const verdict3 = claudeFallbackToolVerdict({
-        toolName,
-        payload,
-        repoRoot: ctx.repoRoot,
-        reason: "unmapped_tool",
-        mode: ctx.config.mode,
-        userMessage: "belay does not recognize this tool action. Run belay doctor, then retry.",
-        agentMessage: "Belay denied this action because the tool could not be normalized."
-      });
-      await deps.appendAudit(ctx, {
-        event: "preToolUse",
+      const verdict3 = await evaluateGatedAction(ctx, deps, {
         kind: "tool",
-        verdict: "deny_pending_approval",
-        reason: "unmapped_tool",
-        mode: ctx.config.mode,
-        wouldBlock: true,
-        permission: "deny",
-        summary: toolName,
-        ...effectPlanAuditFields(verdict3.effectPlan)
+        cwd,
+        payload,
+        toolName,
+        sourceEvent: "PreToolUse"
       });
       jsonResponse(gateVerdictToClaudePreToolUseResponse(verdict3));
       return;