@guilz-dev/belay 0.9.4 → 0.10.1

package/dist/bundle/cursor-runtime.mjs

@@ -1847,7 +1847,7 @@ function normalizeConfig(config) {
     policy: {
       unknownLocalEffect: v4.policy?.unknownLocalEffect === "deny" ? "deny" : v4.policy?.unknownLocalEffect === "allow_flagged" ? "allow_flagged" : DEFAULT_POLICY_V3.unknownLocalEffect,
       unparseableShell: v4.policy?.unparseableShell === "deny" ? "deny" : v4.policy?.unparseableShell === "allow_flagged" ? "allow_flagged" : DEFAULT_POLICY_V3.unparseableShell,
-      codexUnmappedTool: v4.policy?.codexUnmappedTool === "allow" ? "allow" : "deny",
+      codexUnmappedTool: "allow",
       fenceWarnThreshold: typeof v4.policy?.fenceWarnThreshold === "number" && v4.policy.fenceWarnThreshold > 0 && v4.policy.fenceWarnThreshold <= 1 ? v4.policy.fenceWarnThreshold : DEFAULT_FENCE_WARN_THRESHOLD,
       confidenceThresholds: {
         allow: typeof v4.policy?.confidenceThresholds?.allow === "number" ? v4.policy.confidenceThresholds.allow : DEFAULT_CONFIDENCE_THRESHOLDS.allow,
@@ -2149,7 +2149,7 @@ var init_config = __esm({
     DEFAULT_POLICY_V3 = {
       unknownLocalEffect: "allow_flagged",
       unparseableShell: "deny",
-      codexUnmappedTool: "deny",
+      codexUnmappedTool: "allow",
       confidenceThresholds: { ...DEFAULT_CONFIDENCE_THRESHOLDS },
       modelAssist: { ...DEFAULT_MODEL_ASSIST },
       transactional: { ...DEFAULT_TRANSACTIONAL_V3 },
@@ -3510,9 +3510,125 @@ var init_config_layers = __esm({
   }
 });
 
-// src/config-io.ts
+// src/core/repo-config-trust.ts
 import { existsSync as existsSync2 } from "node:fs";
-import { chmod, mkdir as mkdir2, open as open2, readFile as readFile2, rename, unlink as unlink2, writeFile } from "node:fs/promises";
+import { chmod, mkdir as mkdir2, open as open2, readFile as readFile2, rename, unlink as unlink2 } from "node:fs/promises";
+import path11 from "node:path";
+function isObjectRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function hasOnlyExpectedKeys(value) {
+  const expected = /* @__PURE__ */ new Set([
+    "schemaVersion",
+    "repoRoot",
+    "adapter",
+    "repoConfigFingerprint",
+    "trustedAt"
+  ]);
+  const keys = Object.keys(value);
+  if (keys.length !== expected.size) {
+    return false;
+  }
+  return keys.every((key) => expected.has(key));
+}
+function isAdapterName(value) {
+  return value === "cursor" || value === "claude" || value === "codex";
+}
+function isIsoTimestamp(value) {
+  return Number.isFinite(Date.parse(value));
+}
+function parseStrictTrustRecord(value) {
+  if (!isObjectRecord(value) || !hasOnlyExpectedKeys(value)) {
+    return null;
+  }
+  if (value.schemaVersion !== 1) {
+    return null;
+  }
+  if (typeof value.repoRoot !== "string" || value.repoRoot.trim().length === 0) {
+    return null;
+  }
+  if (!isAdapterName(value.adapter)) {
+    return null;
+  }
+  if (typeof value.repoConfigFingerprint !== "string" || !/^[a-f0-9]{64}$/.test(value.repoConfigFingerprint)) {
+    return null;
+  }
+  if (typeof value.trustedAt !== "string" || !isIsoTimestamp(value.trustedAt)) {
+    return null;
+  }
+  return {
+    schemaVersion: 1,
+    repoRoot: value.repoRoot,
+    adapter: value.adapter,
+    repoConfigFingerprint: value.repoConfigFingerprint,
+    trustedAt: value.trustedAt
+  };
+}
+function repoConfigFingerprint(rawConfig) {
+  return hashValue(canonicalStringify(rawConfig));
+}
+function repoConfigTrustPath(repoRoot, adapter) {
+  const canonicalRepoRoot = canonicalPath(repoRoot);
+  const identity = hashValue(`${canonicalRepoRoot}\0${adapter}`);
+  return path11.join(defaultControlPlaneDir(), "config-trust", `${identity}.json`);
+}
+async function inspectRepoConfigTrust(repoRoot, adapter, rawConfig) {
+  const canonicalRepoRoot = canonicalPath(repoRoot);
+  const recordPath = repoConfigTrustPath(repoRoot, adapter);
+  if (!existsSync2(recordPath)) {
+    return { trusted: false, recordPath, reason: "missing" };
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(await readFile2(recordPath, "utf8"));
+  } catch {
+    return { trusted: false, recordPath, reason: "malformed" };
+  }
+  const record = parseStrictTrustRecord(parsed);
+  if (!record) {
+    return { trusted: false, recordPath, reason: "malformed" };
+  }
+  if (record.adapter !== adapter || canonicalPath(record.repoRoot) !== canonicalRepoRoot) {
+    return { trusted: false, recordPath, reason: "identity_mismatch" };
+  }
+  const fingerprint = repoConfigFingerprint(rawConfig);
+  if (record.repoConfigFingerprint !== fingerprint) {
+    return { trusted: false, recordPath, reason: "fingerprint_mismatch" };
+  }
+  return { trusted: true, recordPath, fingerprint };
+}
+function isRepoConfigTrustError(error) {
+  return error instanceof RepoConfigTrustError;
+}
+async function assertRepoConfigTrusted(repoRoot, adapter, rawConfig) {
+  const status = await inspectRepoConfigTrust(repoRoot, adapter, rawConfig);
+  if (status.trusted) {
+    return;
+  }
+  throw new RepoConfigTrustError(status);
+}
+var TRUST_MESSAGE, RepoConfigTrustError;
+var init_repo_config_trust = __esm({
+  "src/core/repo-config-trust.ts"() {
+    "use strict";
+    init_config();
+    init_fingerprint2();
+    init_path_utils();
+    TRUST_MESSAGE = "Repository config is not trusted. Review it, then run `belay config trust`.";
+    RepoConfigTrustError = class extends Error {
+      status;
+      constructor(status) {
+        super(TRUST_MESSAGE);
+        this.name = "RepoConfigTrustError";
+        this.status = status;
+      }
+    };
+  }
+});
+
+// src/config-io.ts
+import { existsSync as existsSync3 } from "node:fs";
+import { chmod as chmod2, mkdir as mkdir3, open as open3, readFile as readFile3, rename as rename2, unlink as unlink3, writeFile } from "node:fs/promises";
 function resolveAdapterName(config) {
   if (config.adapter === "claude") {
     return "claude";
@@ -3523,10 +3639,10 @@ function resolveAdapterName(config) {
   return "cursor";
 }
 function detectAdapterName(repoRoot) {
-  if (existsSync2(configPathFor(repoRoot, "claude"))) {
+  if (existsSync3(configPathFor(repoRoot, "claude"))) {
     return "claude";
   }
-  if (existsSync2(configPathFor(repoRoot, "codex"))) {
+  if (existsSync3(configPathFor(repoRoot, "codex"))) {
     return "codex";
   }
   return "cursor";
@@ -3547,20 +3663,20 @@ async function loadLayeredConfig(repoRoot, adapter = detectAdapterName(repoRoot)
   const layout = getAdapterLayout(adapter);
   const configPath = configPathFor(repoRoot, adapter);
   let repoConfig = {};
-  if (existsSync2(configPath)) {
-    repoConfig = JSON.parse(await readFile2(configPath, "utf8"));
+  if (existsSync3(configPath)) {
+    repoConfig = JSON.parse(await readFile3(configPath, "utf8"));
   }
   let teamConfig = null;
   const teamPath = teamConfigPath();
-  if (existsSync2(teamPath)) {
-    teamConfig = JSON.parse(await readFile2(teamPath, "utf8"));
+  if (existsSync3(teamPath)) {
+    teamConfig = JSON.parse(await readFile3(teamPath, "utf8"));
   }
   return resolveLayeredConfig({
     repoConfig,
     adapterDefaults: layout.defaultConfig(repoRoot),
     teamConfig,
     teamConfigPath: teamPath,
-    repoConfigPath: existsSync2(configPath) ? configPath : void 0
+    repoConfigPath: existsSync3(configPath) ? configPath : void 0
   });
 }
 async function loadConfigFile(repoRoot, adapter = detectAdapterName(repoRoot)) {
@@ -3575,21 +3691,22 @@ var init_config_io = __esm({
     init_approval_state_mutation();
     init_config();
     init_config_layers();
+    init_repo_config_trust();
   }
 });
 
 // src/adapters/cursor/runtime-entry.ts
 init_approval();
-import path65 from "node:path";
+import path67 from "node:path";
 import process2 from "node:process";
 
 // src/core/approval-repo-lookup.ts
 init_config_io();
-import { readFile as readFile3 } from "node:fs/promises";
-import path11 from "node:path";
+import { readFile as readFile4 } from "node:fs/promises";
+import path12 from "node:path";
 async function approvalStateContainsId(filePath, approvalId) {
   try {
-    const raw = await readFile3(filePath, "utf8");
+    const raw = await readFile4(filePath, "utf8");
     const parsed = JSON.parse(raw);
     return parsed.approvals?.some((entry) => entry.approvalId === approvalId) ?? false;
   } catch {
@@ -3600,7 +3717,7 @@ async function findApprovalRepoRoots(params) {
   const matches = [];
   const seen = /* @__PURE__ */ new Set();
   for (const candidate of params.candidateRepoRoots) {
-    const repoRoot = path11.resolve(candidate);
+    const repoRoot = path12.resolve(candidate);
     if (seen.has(repoRoot)) {
       continue;
     }
@@ -3632,15 +3749,16 @@ function formatAmbiguousApprovalRepoMessage(repoRoots) {
 
 // src/adapters/cursor/runtime-entry.ts
 init_config();
+init_repo_config_trust();
 init_cursor();
 
 // src/adapters/shared/gate-runtime.ts
 init_approval();
 init_approval_replay();
 import { randomUUID as randomUUID6 } from "node:crypto";
-import { existsSync as existsSync16 } from "node:fs";
-import { mkdir as mkdir14, readFile as readFile16, writeFile as writeFile11 } from "node:fs/promises";
-import path62 from "node:path";
+import { existsSync as existsSync17 } from "node:fs";
+import { mkdir as mkdir15, readFile as readFile17, writeFile as writeFile11 } from "node:fs/promises";
+import path64 from "node:path";
 
 // src/core/approval-service.ts
 init_config_io();
@@ -3650,47 +3768,35 @@ init_approval_replay();
 // src/core/approval-token.ts
 init_config();
 import { createHmac, randomBytes, timingSafeEqual } from "node:crypto";
-import { existsSync as existsSync3 } from "node:fs";
-import { mkdir as mkdir3, readFile as readFile4, writeFile as writeFile2 } from "node:fs/promises";
-import path12 from "node:path";
-function base64UrlEncode(value) {
-  return Buffer.from(value, "utf8").toString("base64url");
-}
+import { existsSync as existsSync4 } from "node:fs";
+import { mkdir as mkdir4, readFile as readFile5, writeFile as writeFile2 } from "node:fs/promises";
+import path13 from "node:path";
 function base64UrlDecode(value) {
   return Buffer.from(value, "base64url").toString("utf8");
 }
 function approvalSigningKeyPath(controlPlaneDir = defaultControlPlaneDir()) {
-  return path12.join(controlPlaneDir, "approval-signing.key");
+  return path13.join(controlPlaneDir, "approval-signing.key");
 }
 async function loadOrCreateApprovalSigningKey(controlPlaneDir = defaultControlPlaneDir()) {
   const keyPath = approvalSigningKeyPath(controlPlaneDir);
-  if (existsSync3(keyPath)) {
-    return readFile4(keyPath);
+  if (existsSync4(keyPath)) {
+    return readFile5(keyPath);
   }
-  await mkdir3(controlPlaneDir, { recursive: true });
+  await mkdir4(controlPlaneDir, { recursive: true });
   const key = randomBytes(32);
   await writeFile2(keyPath, key, { mode: 384 });
   return key;
 }
-function signPayload(payload, key) {
-  const body = base64UrlEncode(JSON.stringify(payload));
-  const signature = createHmac("sha256", key).update(body).digest("base64url");
-  return `${body}.${signature}`;
-}
-async function issueApprovalToken(payload, controlPlaneDir = defaultControlPlaneDir()) {
-  const key = await loadOrCreateApprovalSigningKey(controlPlaneDir);
-  return signPayload(payload, key);
-}
 async function verifyApprovalToken(token, controlPlaneDir = defaultControlPlaneDir()) {
   const [body, signature] = token.split(".");
   if (!body || !signature) {
     return null;
   }
   const keyPath = approvalSigningKeyPath(controlPlaneDir);
-  if (!existsSync3(keyPath)) {
+  if (!existsSync4(keyPath)) {
     return null;
   }
-  const key = await readFile4(keyPath);
+  const key = await readFile5(keyPath);
   const expected = createHmac("sha256", key).update(body).digest("base64url");
   const actualBuffer = Buffer.from(signature);
   const expectedBuffer = Buffer.from(expected);
@@ -3897,11 +4003,11 @@ init_approval_v3();
 
 // src/core/capability/boundary-attestation-sign.ts
 import { createHmac as createHmac2, timingSafeEqual as timingSafeEqual2 } from "node:crypto";
-import { access, readFile as readFile5 } from "node:fs/promises";
+import { access, readFile as readFile6 } from "node:fs/promises";
 init_fingerprint2();
 
 // src/core/capability/attestation.ts
-import path13 from "node:path";
+import path14 from "node:path";
 var BOUNDARY_ATTESTATION_VERSION = 1;
 var CONTAINED_EXECUTION_ATTESTATION_VERSION = 1;
 var KNOWN_DRIVERS = /* @__PURE__ */ new Set([
@@ -3969,7 +4075,7 @@ function validateContainedExecutionAttestation(value) {
   const record = value;
   const dockerSubstrate = record.dockerSubstrate;
   const dockerConfiguration = record.dockerConfiguration;
-  if (record.version !== CONTAINED_EXECUTION_ATTESTATION_VERSION || typeof record.imageId !== "string" || !/^sha256:[a-f0-9]{64}$/i.test(record.imageId) || typeof record.imageReference !== "string" || !record.imageReference || /[\0\n\r]/.test(record.imageReference) || record.networkNone !== true || record.isolatesWorkspaceMirror !== true || record.readOnlyRoot !== true || record.sanitizedEnvironment !== true || !isRecord(dockerSubstrate) || typeof dockerSubstrate.binaryPath !== "string" || !path13.isAbsolute(dockerSubstrate.binaryPath) || /[\0\n\r]/.test(dockerSubstrate.binaryPath) || typeof dockerSubstrate.binarySha256 !== "string" || !/^[a-f0-9]{64}$/.test(dockerSubstrate.binarySha256) || typeof dockerSubstrate.endpoint !== "string" || !dockerSubstrate.endpoint.startsWith("unix:///") || !path13.isAbsolute(dockerSubstrate.endpoint.slice("unix://".length)) || /[\0\n\r]/.test(dockerSubstrate.endpoint) || typeof dockerSubstrate.daemonId !== "string" || !dockerSubstrate.daemonId || /[\0\n\r]/.test(dockerSubstrate.daemonId) || !isRecord(dockerConfiguration) || typeof dockerConfiguration.executable !== "string" || !path13.isAbsolute(dockerConfiguration.executable) || /[\0\n\r]/.test(dockerConfiguration.executable) || typeof dockerConfiguration.host !== "string" || !dockerConfiguration.host.startsWith("unix:///") || !path13.isAbsolute(dockerConfiguration.host.slice("unix://".length)) || /[\0\n\r]/.test(dockerConfiguration.host) || typeof record.user !== "string" || !/^\d+:\d+$/.test(record.user) || record.entrypoint !== "/bin/sh" || record.capDropAll !== true || record.noNewPrivileges !== true || record.logDriver !== "none" || record.proxyEnvironment !== "neutralized-empty" || typeof record.probedAt !== "string" || typeof record.expiresAt !== "string") {
+  if (record.version !== CONTAINED_EXECUTION_ATTESTATION_VERSION || typeof record.imageId !== "string" || !/^sha256:[a-f0-9]{64}$/i.test(record.imageId) || typeof record.imageReference !== "string" || !record.imageReference || /[\0\n\r]/.test(record.imageReference) || record.networkNone !== true || record.isolatesWorkspaceMirror !== true || record.readOnlyRoot !== true || record.sanitizedEnvironment !== true || !isRecord(dockerSubstrate) || typeof dockerSubstrate.binaryPath !== "string" || !path14.isAbsolute(dockerSubstrate.binaryPath) || /[\0\n\r]/.test(dockerSubstrate.binaryPath) || typeof dockerSubstrate.binarySha256 !== "string" || !/^[a-f0-9]{64}$/.test(dockerSubstrate.binarySha256) || typeof dockerSubstrate.endpoint !== "string" || !dockerSubstrate.endpoint.startsWith("unix:///") || !path14.isAbsolute(dockerSubstrate.endpoint.slice("unix://".length)) || /[\0\n\r]/.test(dockerSubstrate.endpoint) || typeof dockerSubstrate.daemonId !== "string" || !dockerSubstrate.daemonId || /[\0\n\r]/.test(dockerSubstrate.daemonId) || !isRecord(dockerConfiguration) || typeof dockerConfiguration.executable !== "string" || !path14.isAbsolute(dockerConfiguration.executable) || /[\0\n\r]/.test(dockerConfiguration.executable) || typeof dockerConfiguration.host !== "string" || !dockerConfiguration.host.startsWith("unix:///") || !path14.isAbsolute(dockerConfiguration.host.slice("unix://".length)) || /[\0\n\r]/.test(dockerConfiguration.host) || typeof record.user !== "string" || !/^\d+:\d+$/.test(record.user) || record.entrypoint !== "/bin/sh" || record.capDropAll !== true || record.noNewPrivileges !== true || record.logDriver !== "none" || record.proxyEnvironment !== "neutralized-empty" || typeof record.probedAt !== "string" || typeof record.expiresAt !== "string") {
     return false;
   }
   const probedAt = Date.parse(record.probedAt);
@@ -4039,7 +4145,7 @@ async function verifySignedBoundaryAttestation(params) {
   return record.attestation;
 }
 async function readSignedAttestationFile(filePath) {
-  return JSON.parse(await readFile5(filePath, "utf8"));
+  return JSON.parse(await readFile6(filePath, "utf8"));
 }
 
 // src/core/capability/boundary-egress.ts
@@ -4208,13 +4314,13 @@ async function runWithBoundaryRunnable(target, params) {
 }
 
 // src/core/capability/boundary-session.ts
-import path24 from "node:path";
+import path25 from "node:path";
 
 // src/services/egress-service.ts
-import { existsSync as existsSync4, readFileSync as readFileSync2 } from "node:fs";
-import { mkdir as mkdir4, readFile as readFile6, unlink as unlink3, writeFile as writeFile3 } from "node:fs/promises";
+import { existsSync as existsSync5, readFileSync as readFileSync2 } from "node:fs";
+import { mkdir as mkdir5, readFile as readFile7, unlink as unlink4, writeFile as writeFile3 } from "node:fs/promises";
 import net from "node:net";
-import path14 from "node:path";
+import path15 from "node:path";
 init_config_io();
 init_config();
 
@@ -4227,16 +4333,16 @@ function egressStatePaths(repoRoot, config) {
   const stateDir = belayStateDir(config, repoLocalStateDirFor(repoRoot, config));
   return {
     stateDir,
-    pidPath: path14.join(stateDir, "egress-proxy.pid"),
-    statusPath: path14.join(stateDir, "egress-proxy.json")
+    pidPath: path15.join(stateDir, "egress-proxy.pid"),
+    statusPath: path15.join(stateDir, "egress-proxy.json")
   };
 }
 async function readStatusFile(statusPath) {
-  if (!existsSync4(statusPath)) {
+  if (!existsSync5(statusPath)) {
     return null;
   }
   try {
-    const raw = JSON.parse(await readFile6(statusPath, "utf8"));
+    const raw = JSON.parse(await readFile7(statusPath, "utf8"));
     if (typeof raw.pid !== "number") {
       return null;
     }
@@ -4254,9 +4360,9 @@ async function readStatusFile(statusPath) {
 async function isPortOpen(host, port) {
   return new Promise((resolve) => {
     const socket = net.createConnection({ host, port });
-    const finish = (open6) => {
+    const finish = (open7) => {
       socket.destroy();
-      resolve(open6);
+      resolve(open7);
     };
     socket.setTimeout(300);
     socket.on("connect", () => finish(true));
@@ -4267,7 +4373,7 @@ async function isPortOpen(host, port) {
 async function resolveLiveEgressStatus(repoRoot, config) {
   const { statusPath } = egressStatePaths(repoRoot, config);
   const statusCandidates = [statusPath];
-  const controlPlaneStatus = path14.join(configuredControlPlaneDir(config), "egress-proxy.json");
+  const controlPlaneStatus = path15.join(configuredControlPlaneDir(config), "egress-proxy.json");
   if (!statusCandidates.includes(controlPlaneStatus)) {
     statusCandidates.push(controlPlaneStatus);
   }
@@ -4293,7 +4399,7 @@ function isProcessAlive(pid) {
   }
 }
 async function egressStatus(options = {}) {
-  const repoRoot = path14.resolve(options.targetDir ?? process.cwd());
+  const repoRoot = path15.resolve(options.targetDir ?? process.cwd());
   const config = await loadConfigFile(repoRoot);
   const { status, host, port, portOccupied } = await resolveLiveEgressStatus(repoRoot, config);
   const ownedRunning = Boolean(status);
@@ -4324,7 +4430,7 @@ init_config();
 import { createHash as createHash8, randomUUID as randomUUID2 } from "node:crypto";
 import { createReadStream as createReadStream2 } from "node:fs";
 import { access as access2, constants as constants2, lstat as lstat4, mkdtemp as mkdtemp2, realpath as realpath2, rm as rm2 } from "node:fs/promises";
-import path19 from "node:path";
+import path20 from "node:path";
 init_fingerprint2();
 init_path_utils();
 
@@ -4503,7 +4609,7 @@ function runProcessWithBoundedOutput(file, args, options, timeoutMs, outputPolic
 }
 
 // src/core/contained-execution/docker-policy.ts
-import path15 from "node:path";
+import path16 from "node:path";
 
 // src/core/contained-execution/policy.ts
 var CONTAINED_EXECUTION_APPROVAL_FALLBACK_REASONS = [
@@ -4632,7 +4738,7 @@ var PROXY_ENV_NAMES = [
 var IMAGE_ID_PATTERN = /^sha256:[a-f0-9]{64}$/;
 var SAFE_CONTAINER_NAME = /^belay-contained-[0-9a-f-]{36}$/;
 function assertSafeDockerPath(value, code) {
-  if (!path15.isAbsolute(value) || /[\0\n\r,]/.test(value)) {
+  if (!path16.isAbsolute(value) || /[\0\n\r,]/.test(value)) {
     throw new ContainedExecutionFailureError(code);
   }
 }
@@ -4711,11 +4817,11 @@ init_path_utils();
 import { createHash as createHash7 } from "node:crypto";
 import { constants as fsConstants } from "node:fs";
 import {
-  chmod as chmod2,
+  chmod as chmod3,
   lstat as lstat3,
-  mkdir as mkdir5,
+  mkdir as mkdir6,
   mkdtemp,
-  open as open3,
+  open as open4,
   opendir,
   readlink as readlink2,
   realpath,
@@ -4723,41 +4829,41 @@ import {
   symlink
 } from "node:fs/promises";
 import os from "node:os";
-import path18 from "node:path";
+import path19 from "node:path";
 
 // src/core/transactional/file-tree.ts
 import { createHash as createHash6 } from "node:crypto";
 import { lstat as lstat2, readdir } from "node:fs/promises";
-import path17 from "node:path";
+import path18 from "node:path";
 
 // src/core/transactional/file-tree-path.ts
 init_path_utils();
-import path16 from "node:path";
+import path17 from "node:path";
 var FILE_CHECKPOINT_PATH_ESCAPE = "file_checkpoint_path_escape";
 function validateRelativePath(relativePath) {
   if (!relativePath || relativePath.includes("\0")) {
     throw new Error(FILE_CHECKPOINT_PATH_ESCAPE);
   }
-  if (path16.isAbsolute(relativePath)) {
+  if (path17.isAbsolute(relativePath)) {
     throw new Error(FILE_CHECKPOINT_PATH_ESCAPE);
   }
   if (isPathOutsideRoot(relativePath)) {
     throw new Error(FILE_CHECKPOINT_PATH_ESCAPE);
   }
-  const normalized = path16.normalize(relativePath);
-  if (normalized === ".." || normalized.startsWith(`..${path16.sep}`)) {
+  const normalized = path17.normalize(relativePath);
+  if (normalized === ".." || normalized.startsWith(`..${path17.sep}`)) {
     throw new Error(FILE_CHECKPOINT_PATH_ESCAPE);
   }
 }
 function joinRelativePath(root, relativePath) {
   validateRelativePath(relativePath);
-  return path16.join(canonicalPath(root), relativePath);
+  return path17.join(canonicalPath(root), relativePath);
 }
 function isRootGitMetadataPath(relativePath) {
-  return relativePath === ".git" || relativePath.startsWith(`.git${path16.sep}`);
+  return relativePath === ".git" || relativePath.startsWith(`.git${path17.sep}`);
 }
 function isNestedGitPath(relativePath) {
-  const segments = relativePath.split(path16.sep).filter(Boolean);
+  const segments = relativePath.split(path17.sep).filter(Boolean);
   if (segments.length === 0) {
     return false;
   }
@@ -4924,7 +5030,7 @@ async function readPresentNode(absolutePath, counters) {
 async function walkDirectory(resourceRoot, relativeDir, excludedRoots, counters, quotas, deadlineMs, entries) {
   assertWithinDeadline(deadlineMs);
   assertWithinQuotas(counters, quotas);
-  const absoluteDir = relativeDir ? joinRelativePath(resourceRoot, relativeDir) : path17.resolve(resourceRoot);
+  const absoluteDir = relativeDir ? joinRelativePath(resourceRoot, relativeDir) : path18.resolve(resourceRoot);
   const dirInfo = await lstat2(absoluteDir);
   if (!dirInfo.isDirectory()) {
     throw new Error(FILE_CHECKPOINT_UNSUPPORTED_NODE);
@@ -4950,7 +5056,7 @@ async function walkDirectory(resourceRoot, relativeDir, excludedRoots, counters,
   const names = await readdir(absoluteDir);
   for (const name of names) {
     assertWithinDeadline(deadlineMs);
-    const childRelative = relativeDir ? path17.join(relativeDir, name) : name;
+    const childRelative = relativeDir ? path18.join(relativeDir, name) : name;
     validateRelativePath(childRelative);
     if (isNestedGitPath(childRelative)) {
       throw new Error(FILE_CHECKPOINT_NESTED_REPOSITORY);
@@ -4958,7 +5064,7 @@ async function walkDirectory(resourceRoot, relativeDir, excludedRoots, counters,
     if (isExcludedTreePath(childRelative, excludedRoots, resourceRoot)) {
       continue;
     }
-    const childAbsolute = path17.join(absoluteDir, name);
+    const childAbsolute = path18.join(absoluteDir, name);
     const childInfo = await lstat2(childAbsolute);
     if (childInfo.isDirectory() && !childInfo.isSymbolicLink()) {
       await walkDirectory(
@@ -5069,16 +5175,16 @@ function validateContainedExecutionMirrorLease(handle, expected) {
   );
 }
 var productionDependencies = {
-  makeTempRoot: () => mkdtemp(path18.join(os.tmpdir(), "belay-contained-mirror-")),
+  makeTempRoot: () => mkdtemp(path19.join(os.tmpdir(), "belay-contained-mirror-")),
   removeRoot: (root) => rm(root, { recursive: true, force: true }),
   now: () => Date.now()
 };
 function isAtOrWithin(root, target) {
-  const relative = path18.relative(root, target);
-  return relative === "" || !path18.isAbsolute(relative) && relative !== ".." && !relative.startsWith(`..${path18.sep}`);
+  const relative = path19.relative(root, target);
+  return relative === "" || !path19.isAbsolute(relative) && relative !== ".." && !relative.startsWith(`..${path19.sep}`);
 }
 function isGitMetadataRelativePath(relativePath) {
-  return relativePath.split(path18.sep).some((segment) => segment.toLowerCase() === ".git");
+  return relativePath.split(path19.sep).some((segment) => segment.toLowerCase() === ".git");
 }
 function identityFromStats(stats) {
   return {
@@ -5160,7 +5266,7 @@ async function readStableFile(absolutePath, context) {
   if (before.nlink > 1n) {
     throw new Error(FILE_CHECKPOINT_HARDLINK_UNSUPPORTED);
   }
-  const source = await open3(absolutePath, safeReadFlags());
+  const source = await open4(absolutePath, safeReadFlags());
   try {
     const opened = await source.stat({ bigint: true });
     assertRegularSingleLinkBigInt(opened);
@@ -5215,7 +5321,7 @@ function addMetadataRoots(context, directoryPath) {
   }
 }
 function pathMatchesRoots(absolutePath, roots) {
-  const lexical = path18.resolve(absolutePath);
+  const lexical = path19.resolve(absolutePath);
   const canonical = canonicalPath(absolutePath);
   for (const root of roots) {
     if (isAtOrWithin(root, lexical) || isAtOrWithin(root, canonical)) {
@@ -5225,7 +5331,7 @@ function pathMatchesRoots(absolutePath, roots) {
   return false;
 }
 function pathLexicallyMatchesRoots(absolutePath, roots) {
-  const lexical = path18.resolve(absolutePath);
+  const lexical = path19.resolve(absolutePath);
   for (const root of roots) {
     if (isAtOrWithin(root, lexical)) {
       return true;
@@ -5246,11 +5352,11 @@ async function readSafeSymlink(absolutePath, context) {
   }
   const identity = identityFromStats(before);
   const target = await readlink2(absolutePath);
-  if (path18.isAbsolute(target)) {
+  if (path19.isAbsolute(target)) {
     throw new ContainedExecutionFailureError(CONTAINED_EXECUTION_UNSAFE_SYMLINK);
   }
-  const lexicalTarget = path18.resolve(path18.dirname(absolutePath), target);
-  if (!isAtOrWithin(context.sourceRoot, lexicalTarget) || isGitMetadataRelativePath(path18.relative(context.sourceRoot, lexicalTarget)) || pathMatchesRoots(lexicalTarget, context.protectedRoots) || pathMatchesRoots(lexicalTarget, context.metadataRoots)) {
+  const lexicalTarget = path19.resolve(path19.dirname(absolutePath), target);
+  if (!isAtOrWithin(context.sourceRoot, lexicalTarget) || isGitMetadataRelativePath(path19.relative(context.sourceRoot, lexicalTarget)) || pathMatchesRoots(lexicalTarget, context.protectedRoots) || pathMatchesRoots(lexicalTarget, context.metadataRoots)) {
     throw new ContainedExecutionFailureError(CONTAINED_EXECUTION_UNSAFE_SYMLINK);
   }
   let resolvedTarget;
@@ -5286,7 +5392,7 @@ async function walkDirectory2(relativeDirectory, entries, context) {
     throw new ContainedExecutionFailureError(CONTAINED_EXECUTION_SOURCE_CHANGED);
   }
   const directoryFlags = safeReadFlags() | (fsConstants.O_DIRECTORY ?? 0);
-  const directory = await open3(absoluteDirectory, directoryFlags);
+  const directory = await open4(absoluteDirectory, directoryFlags);
   try {
     const opened = await directory.stat({ bigint: true });
     if (!opened.isDirectory() || !identitiesEqual(beforeIdentity, identityFromStats(opened))) {
@@ -5295,7 +5401,7 @@ async function walkDirectory2(relativeDirectory, entries, context) {
     const entriesDirectory = await opendir(absoluteDirectory, { bufferSize: 32 });
     for await (const directoryEntry of entriesDirectory) {
       assertDeadline(context.deadlineMs, context.now);
-      const relativePath = relativeDirectory ? path18.join(relativeDirectory, directoryEntry.name) : directoryEntry.name;
+      const relativePath = relativeDirectory ? path19.join(relativeDirectory, directoryEntry.name) : directoryEntry.name;
       const absolutePath = joinRelativePath(context.sourceRoot, relativePath);
       const info = await lstat3(absolutePath);
       if (info.isSymbolicLink()) {
@@ -5379,7 +5485,7 @@ async function copyStableRegularFile(sourcePath, destinationPath, entry, context
   }
   assertEntryIdentity(entry, identityFromStats(before));
   await context.beforeCopyOpen?.(sourcePath);
-  const source = await open3(sourcePath, safeReadFlags());
+  const source = await open4(sourcePath, safeReadFlags());
   let destination;
   try {
     const opened = await source.stat({ bigint: true });
@@ -5389,8 +5495,8 @@ async function copyStableRegularFile(sourcePath, destinationPath, entry, context
     if (entry.node.kind !== "file") {
       throw new ContainedExecutionFailureError(CONTAINED_EXECUTION_SOURCE_CHANGED);
     }
-    await mkdir5(path18.dirname(destinationPath), { recursive: true, mode: 448 });
-    destination = await open3(
+    await mkdir6(path19.dirname(destinationPath), { recursive: true, mode: 448 });
+    destination = await open4(
       destinationPath,
       fsConstants.O_WRONLY | fsConstants.O_CREAT | fsConstants.O_EXCL,
       safePermissionMode(opened.mode)
@@ -5432,7 +5538,7 @@ async function copyStableRegularFile(sourcePath, destinationPath, entry, context
   if (entry.node.kind !== "file") {
     throw new ContainedExecutionFailureError(CONTAINED_EXECUTION_SOURCE_CHANGED);
   }
-  await chmod2(destinationPath, safePermissionMode(entry.node.mode));
+  await chmod3(destinationPath, safePermissionMode(entry.node.mode));
 }
 async function materializeSnapshot(sourceRoot, destinationRoot, snapshot, context) {
   const directoryEntries = [];
@@ -5441,7 +5547,7 @@ async function materializeSnapshot(sourceRoot, destinationRoot, snapshot, contex
     const sourcePath = joinRelativePath(sourceRoot, entry.relativePath);
     const destinationPath = joinRelativePath(destinationRoot, entry.relativePath);
     if (entry.node.kind === "directory") {
-      await mkdir5(destinationPath, { recursive: true, mode: 448 });
+      await mkdir6(destinationPath, { recursive: true, mode: 448 });
       directoryEntries.push(entry);
       continue;
     }
@@ -5453,7 +5559,7 @@ async function materializeSnapshot(sourceRoot, destinationRoot, snapshot, contex
       if (current !== entry.node.target) {
         throw new ContainedExecutionFailureError(CONTAINED_EXECUTION_SOURCE_CHANGED);
       }
-      await mkdir5(path18.dirname(destinationPath), { recursive: true, mode: 448 });
+      await mkdir6(path19.dirname(destinationPath), { recursive: true, mode: 448 });
       await symlink(entry.node.target, destinationPath);
       continue;
     }
@@ -5463,12 +5569,12 @@ async function materializeSnapshot(sourceRoot, destinationRoot, snapshot, contex
     if (entry.node.kind !== "directory") {
       throw new ContainedExecutionFailureError(CONTAINED_EXECUTION_SOURCE_CHANGED);
     }
-    await chmod2(
+    await chmod3(
       joinRelativePath(destinationRoot, entry.relativePath),
       safePermissionMode(entry.node.mode)
     );
   }
-  await chmod2(destinationRoot, 448);
+  await chmod3(destinationRoot, 448);
 }
 async function assertStableCopiedSnapshot(sourceRoot, destinationRoot, protectedRoots, limits, deadlineMs, now, before) {
   const [after, copied] = await Promise.all([
@@ -5513,7 +5619,7 @@ async function cleanupOwnedRoot(root, dependencies) {
 }
 async function prepareWithDependencies(options, dependencies) {
   validateOptions(options);
-  const guestWorkspacePath = path18.resolve(options.sourceRoot);
+  const guestWorkspacePath = path19.resolve(options.sourceRoot);
   const sourceRoot = canonicalPath(options.sourceRoot);
   const protectedRoots = options.controlPlaneRoots.map((root) => canonicalPath(root));
   if (pathMatchesRoots(sourceRoot, protectedRoots)) {
@@ -5521,7 +5627,7 @@ async function prepareWithDependencies(options, dependencies) {
   }
   const guestRoot = await dependencies.makeTempRoot();
   try {
-    await chmod2(guestRoot, 448);
+    await chmod3(guestRoot, 448);
     const deadlineMs = dependencies.now() + options.limits.prepareTimeoutMs;
     const before = await buildSafeMirrorSnapshot(
       sourceRoot,
@@ -5549,7 +5655,7 @@ async function prepareWithDependencies(options, dependencies) {
       dependencies.now,
       before
     );
-    await chmod2(guestRoot, 448);
+    await chmod3(guestRoot, 448);
     const lease = {
       sourceRoot,
       hostMirrorRoot: guestRoot,
@@ -5683,14 +5789,14 @@ async function digestFile(file) {
   return hash.digest("hex");
 }
 async function resolveConfiguredDockerSubstrate(params) {
-  if (!path19.isAbsolute(params.executable) || /[\0\n\r]/.test(params.executable)) {
+  if (!path20.isAbsolute(params.executable) || /[\0\n\r]/.test(params.executable)) {
     throw new ContainedDockerBoundaryUnavailableError("contained_execution_docker_binary_invalid");
   }
   if (!params.host.startsWith("unix:///") || /[\0\n\r]/.test(params.host)) {
     throw new ContainedDockerBoundaryUnavailableError("contained_execution_docker_host_invalid");
   }
   const configuredSocket = params.host.slice("unix://".length);
-  if (!path19.isAbsolute(configuredSocket)) {
+  if (!path20.isAbsolute(configuredSocket)) {
     throw new ContainedDockerBoundaryUnavailableError("contained_execution_docker_host_invalid");
   }
   let binaryPath;
@@ -5951,7 +6057,7 @@ async function validatedGuestCwd(params) {
   const requiredExclusions = [
     ...new Set([params.controlPlaneDir, ...params.protectedRoots].map(canonicalPath))
   ];
-  if (params.mirror.backend !== "file_copy" || params.mirror.guestWorkspacePath !== path19.resolve(params.repoRoot) || !path19.isAbsolute(params.guestCwd) || !pathWithinRoot(params.mirror.guestWorkspacePath, params.guestCwd))
+  if (params.mirror.backend !== "file_copy" || params.mirror.guestWorkspacePath !== path20.resolve(params.repoRoot) || !path20.isAbsolute(params.guestCwd) || !pathWithinRoot(params.mirror.guestWorkspacePath, params.guestCwd))
     throw new ContainedExecutionFailureError("contained_execution_invalid_cwd");
   const resolvedRoot = await realpath2(params.mirror.hostMirrorRoot);
   const protectedRoots = [canonicalPath(params.repoRoot), ...requiredExclusions];
@@ -5963,10 +6069,10 @@ async function validatedGuestCwd(params) {
     protectedRoots: requiredExclusions
   }))
     throw new ContainedExecutionFailureError("contained_execution_invalid_mirror_lease");
-  const relative = path19.relative(params.mirror.guestWorkspacePath, path19.resolve(params.guestCwd));
+  const relative = path20.relative(params.mirror.guestWorkspacePath, path20.resolve(params.guestCwd));
   let resolvedCwd;
   try {
-    resolvedCwd = await realpath2(path19.join(resolvedRoot, relative));
+    resolvedCwd = await realpath2(path20.join(resolvedRoot, relative));
   } catch {
     throw new ContainedExecutionFailureError("contained_execution_invalid_cwd");
   }
@@ -5974,7 +6080,7 @@ async function validatedGuestCwd(params) {
   if (!info.isDirectory() || !pathWithinRoot(resolvedRoot, resolvedCwd)) {
     throw new ContainedExecutionFailureError("contained_execution_invalid_cwd");
   }
-  return path19.join(params.mirror.guestWorkspacePath, path19.relative(resolvedRoot, resolvedCwd));
+  return path20.join(params.mirror.guestWorkspacePath, path20.relative(resolvedRoot, resolvedCwd));
 }
 function exactKeys(value, allowed) {
   const names = new Set(allowed);
@@ -6201,19 +6307,19 @@ async function executeContainedDocker(params) {
 init_path_utils();
 import { spawn as spawn3 } from "node:child_process";
 import os3 from "node:os";
-import path21 from "node:path";
+import path22 from "node:path";
 
 // src/core/transactional/apply-observed-changes.ts
-import { copyFile, lstat as lstat5, mkdir as mkdir6, mkdtemp as mkdtemp3, readlink as readlink3, rm as rm3, rmdir, symlink as symlink2 } from "node:fs/promises";
+import { copyFile, lstat as lstat5, mkdir as mkdir7, mkdtemp as mkdtemp3, readlink as readlink3, rm as rm3, rmdir, symlink as symlink2 } from "node:fs/promises";
 import os2 from "node:os";
-import path20 from "node:path";
+import path21 from "node:path";
 var TRANSACTIONAL_APPLY_TOCTOU = "transactional_apply_toctou";
 var TRANSACTIONAL_APPLY_CONFLICT = "transactional_apply_conflict";
 var TRANSACTIONAL_APPLY_ROLLBACK_FAILED = "transactional_apply_rollback_failed";
 async function chmodSafe(target, mode) {
   try {
-    const { chmod: chmod4 } = await import("node:fs/promises");
-    await chmod4(target, mode & 511);
+    const { chmod: chmod5 } = await import("node:fs/promises");
+    await chmod5(target, mode & 511);
   } catch {
   }
 }
@@ -6247,13 +6353,13 @@ async function copyPathPreservingType(source, target) {
     }
   }
   await removePathIfExists(target);
-  await mkdir6(path20.dirname(target), { recursive: true });
+  await mkdir7(path21.dirname(target), { recursive: true });
   if (info.isSymbolicLink()) {
     await symlink2(await readlink3(source), target);
     return;
   }
   if (info.isDirectory() && !info.isSymbolicLink()) {
-    await mkdir6(target, { recursive: true, mode: info.mode & 511 });
+    await mkdir7(target, { recursive: true, mode: info.mode & 511 });
     return;
   }
   if (!info.isFile()) {
@@ -6263,12 +6369,12 @@ async function copyPathPreservingType(source, target) {
   await chmodSafe(target, info.mode);
 }
 async function assertParentChainSafe(targetRoot, relativePath, plannedDirectories = /* @__PURE__ */ new Set()) {
-  const segments = relativePath.split(path20.sep).filter(Boolean);
+  const segments = relativePath.split(path21.sep).filter(Boolean);
   if (segments.length <= 1) {
     return;
   }
   for (let index = 1; index < segments.length; index++) {
-    const prefix = segments.slice(0, index).join(path20.sep);
+    const prefix = segments.slice(0, index).join(path21.sep);
     const absolute = joinRelativePath(targetRoot, prefix);
     let info;
     try {
@@ -6288,8 +6394,8 @@ async function assertParentChainSafe(targetRoot, relativePath, plannedDirectorie
   }
 }
 async function restorePathFromBackup(backupPath, target, rollbackRoot) {
-  const stagingRoot = await mkdtemp3(path20.join(rollbackRoot, "restore-"));
-  const staged = path20.join(stagingRoot, "node");
+  const stagingRoot = await mkdtemp3(path21.join(rollbackRoot, "restore-"));
+  const staged = path21.join(stagingRoot, "node");
   try {
     await copyPathPreservingType(backupPath, staged);
     await copyPathPreservingType(staged, target);
@@ -6373,7 +6479,7 @@ async function applySingleChange(sourceRoot, targetRoot, change) {
     if (change.before.kind !== "directory") {
       await removePathIfExists(target);
     }
-    await mkdir6(target, { recursive: true, mode: change.after.mode & 511 });
+    await mkdir7(target, { recursive: true, mode: change.after.mode & 511 });
     await chmodSafe(target, change.after.mode);
     return;
   }
@@ -6392,7 +6498,7 @@ async function applyObservedChanges(params) {
     await assertParentChainSafe(targetRoot, change.relativePath, plannedDirectories);
     await assertTargetMatches(targetRoot, change);
   }
-  const backupRoot = await mkdtemp3(path20.join(os2.tmpdir(), "belay-tx-rollback-"));
+  const backupRoot = await mkdtemp3(path21.join(os2.tmpdir(), "belay-tx-rollback-"));
   const rollbackActions = [];
   let mutationAttempted = false;
   let resourceIdentityChanged = false;
@@ -6411,12 +6517,12 @@ async function applyObservedChanges(params) {
         targetExists = false;
       }
       if (targetExists) {
-        const backupPath = path20.join(
+        const backupPath = path21.join(
           backupRoot,
           String(rollbackActions.length),
           change.relativePath
         );
-        await mkdir6(path20.dirname(backupPath), { recursive: true });
+        await mkdir7(path21.dirname(backupPath), { recursive: true });
         await copyPathPreservingType(target, backupPath);
         await assertParentChainSafe(targetRoot, change.relativePath);
         rollbackActions.push({
@@ -6515,7 +6621,7 @@ function isIgnoredDirtyPath(repoRoot, relativePath, ignoreRoots) {
   if (ignoreRoots.length === 0) {
     return false;
   }
-  const absolutePath = canonicalPath(path21.join(repoRoot, relativePath));
+  const absolutePath = canonicalPath(path22.join(repoRoot, relativePath));
   return ignoreRoots.some(
     (root) => pathWithinRoot(root, absolutePath) || root === absolutePath || pathWithinRoot(absolutePath, root)
   );
@@ -6553,7 +6659,7 @@ async function isDirtyWorktree(repoRoot, options) {
 }
 async function createGitWorktreeSnapshot(repoRoot, _stateDir) {
   const { mkdtemp: mkdtemp6, rm: rm10 } = await import("node:fs/promises");
-  const worktreePath = await mkdtemp6(path21.join(os3.tmpdir(), "belay-tx-"));
+  const worktreePath = await mkdtemp6(path22.join(os3.tmpdir(), "belay-tx-"));
   await execGit(repoRoot, ["worktree", "add", "--detach", worktreePath, "HEAD"]);
   return {
     worktreePath,
@@ -6572,14 +6678,14 @@ async function createGitWorktreeSnapshot(repoRoot, _stateDir) {
 }
 function resolveWorktreeCwd(repoRoot, worktreePath, cwd) {
   const resolvedCwd = canonicalPath(cwd);
-  const relative = path21.relative(canonicalPath(repoRoot), resolvedCwd);
-  if (isPathOutsideRoot(relative) || path21.isAbsolute(relative)) {
+  const relative = path22.relative(canonicalPath(repoRoot), resolvedCwd);
+  if (isPathOutsideRoot(relative) || path22.isAbsolute(relative)) {
     return worktreePath;
   }
   if (relative === "") {
     return worktreePath;
   }
-  return path21.join(worktreePath, relative);
+  return path22.join(worktreePath, relative);
 }
 function runShellCommand(command, cwd, timeoutMs) {
   return runProcessWithBoundedOutput(command, [], { cwd, shell: true, env: process.env }, timeoutMs);
@@ -6644,7 +6750,7 @@ import { spawn as spawn4 } from "node:child_process";
 import { randomUUID as randomUUID3 } from "node:crypto";
 
 // src/core/capability/boundary-grant-materialize.ts
-import path22 from "node:path";
+import path23 from "node:path";
 
 // src/core/glob.ts
 init_approval();
@@ -6804,7 +6910,7 @@ function grantMatchesRequest(grant, request) {
 var BOUNDARY_GRANT_TTL_MS = 15 * 6e4;
 var BOUNDARY_GRANT_ISSUER_CONTAINER = "boundary:container";
 function resolveCapabilityPath(targetPath, cwd) {
-  const joined = path22.isAbsolute(targetPath) ? targetPath : path22.join(cwd, targetPath);
+  const joined = path23.isAbsolute(targetPath) ? targetPath : path23.join(cwd, targetPath);
   return canonicalPath(joined);
 }
 function isPathWithinBoundaryMount(request) {
@@ -6879,7 +6985,7 @@ function materializeContainerBoundaryGrant(request, params) {
 
 // src/core/capability/boundary-workspace-mount.ts
 init_path_utils();
-import path23 from "node:path";
+import path24 from "node:path";
 var HOST_PATH_ENV_VARS = [
   "BELAY_EGRESS_REPO_ROOT",
   "BELAY_JUDGE_BROKER_REPO_ROOT",
@@ -6904,23 +7010,23 @@ function validateWorkspaceMount(mount) {
   if (mount.cwdRelative.includes("\0")) {
     throw new Error("boundary_workspace_mount_invalid_cwd");
   }
-  const normalizedRelative = path23.posix.normalize(mount.cwdRelative.replace(/\\/g, "/"));
+  const normalizedRelative = path24.posix.normalize(mount.cwdRelative.replace(/\\/g, "/"));
   if (normalizedRelative === ".." || normalizedRelative.startsWith("../")) {
     throw new Error("boundary_workspace_mount_invalid_cwd");
   }
-  if (path23.posix.isAbsolute(normalizedRelative)) {
+  if (path24.posix.isAbsolute(normalizedRelative)) {
     throw new Error("boundary_workspace_mount_invalid_cwd");
   }
 }
 function resolveGuestWorkdir(mount) {
   validateWorkspaceMount(mount);
   const guestTargetRoot = canonicalPath(mount.guestTargetRoot);
-  const normalizedRelative = path23.posix.normalize(mount.cwdRelative.replace(/\\/g, "/"));
+  const normalizedRelative = path24.posix.normalize(mount.cwdRelative.replace(/\\/g, "/"));
   if (normalizedRelative === "." || normalizedRelative === "") {
     return guestTargetRoot;
   }
   const segments = normalizedRelative.split("/").filter(Boolean);
-  return path23.posix.join(guestTargetRoot, ...segments);
+  return path24.posix.join(guestTargetRoot, ...segments);
 }
 function buildWorkspaceMountSpec(mount) {
   validateWorkspaceMount(mount);
@@ -7211,7 +7317,7 @@ function containedExecutionFresh(attestation, config, now = Date.now()) {
 }
 function boundaryAttestationPath(repoRoot, config) {
   const rel = config.capability?.attestationRelPath ?? ".belay/attestation.json";
-  return path24.isAbsolute(rel) ? rel : path24.join(repoRoot, rel);
+  return path25.isAbsolute(rel) ? rel : path25.join(repoRoot, rel);
 }
 async function loadBoundaryAttestation(filePath, expectedRepoRoot, controlPlaneDir) {
   try {
@@ -7316,7 +7422,7 @@ init_capability_request_hash();
 
 // src/core/capability/gate-policy-shadow.ts
 init_config();
-import path30 from "node:path";
+import path31 from "node:path";
 
 // src/core/effect-ir/audit.ts
 init_fingerprint2();
@@ -7410,8 +7516,8 @@ function evidenceRank(level) {
 }
 
 // src/core/effect-ir/package-exec.ts
-import { existsSync as existsSync5, realpathSync as realpathSync3, statSync as statSync2 } from "node:fs";
-import path25 from "node:path";
+import { existsSync as existsSync6, realpathSync as realpathSync3, statSync as statSync2 } from "node:fs";
+import path26 from "node:path";
 
 // src/core/network-endpoint.ts
 var SUPPORTED_URL_PROTOCOLS = /* @__PURE__ */ new Set(["http:", "https:", "ssh:", "git:"]);
@@ -7702,18 +7808,18 @@ function classifyPackageAcquisitionSpec(spec) {
   return { kind: "registry" };
 }
 function resolveLocalBin(binName, cwd, repoRoot) {
-  const base = path25.basename(binName);
+  const base = path26.basename(binName);
   if (!base || base === "." || base === "..") {
     return null;
   }
-  let current = path25.resolve(cwd);
-  const stop = path25.resolve(repoRoot);
+  let current = path26.resolve(cwd);
+  const stop = path26.resolve(repoRoot);
   if (!pathWithinRoot(stop, current)) {
     return null;
   }
   while (true) {
-    const candidate = path25.join(current, "node_modules", ".bin", base);
-    if (existsSync5(candidate)) {
+    const candidate = path26.join(current, "node_modules", ".bin", base);
+    if (existsSync6(candidate)) {
       try {
         const resolvedCandidate = realpathSync3.native(candidate);
         if (!pathWithinRoot(stop, resolvedCandidate) || !statSync2(resolvedCandidate).isFile()) {
@@ -7727,7 +7833,7 @@ function resolveLocalBin(binName, cwd, repoRoot) {
     if (current === stop) {
       break;
     }
-    const parent = path25.dirname(current);
+    const parent = path26.dirname(current);
     if (parent === current) {
       break;
     }
@@ -7922,7 +8028,7 @@ init_path_utils();
 
 // src/core/verdict/containment.ts
 init_git_resource_identity();
-import path26 from "node:path";
+import path27 from "node:path";
 init_path_utils();
 
 // src/core/verdict/persistent-paths.ts
@@ -7942,7 +8048,7 @@ function expandHome(token) {
     if (!home) {
       return token;
     }
-    return token === "~" ? home : path26.join(home, token.slice(2));
+    return token === "~" ? home : path27.join(home, token.slice(2));
   }
   return token;
 }
@@ -7954,10 +8060,10 @@ function resolveTrustedPath(token, trustedCwd, trusted) {
     return null;
   }
   const expanded = expandHome(token);
-  if (path26.isAbsolute(expanded)) {
+  if (path27.isAbsolute(expanded)) {
     return canonicalPath(expanded);
   }
-  return canonicalPath(path26.resolve(trustedCwd, expanded));
+  return canonicalPath(path27.resolve(trustedCwd, expanded));
 }
 function isGitPath(resolvedPath, repoRoot) {
   if (isGitMetadataPath(resolvedPath, repoRoot)) {
@@ -8074,20 +8180,20 @@ function parseTier1Json(raw) {
 init_judge_runtime_config();
 
 // src/core/verdict/judge-session-kill-switch.ts
-import { existsSync as existsSync6 } from "node:fs";
-import { mkdir as mkdir7, readFile as readFile7, unlink as unlink4, writeFile as writeFile4 } from "node:fs/promises";
-import path27 from "node:path";
+import { existsSync as existsSync7 } from "node:fs";
+import { mkdir as mkdir8, readFile as readFile8, unlink as unlink5, writeFile as writeFile4 } from "node:fs/promises";
+import path28 from "node:path";
 var JUDGE_SESSION_KILL_FILE = "judge-session-kill.json";
 function judgeSessionKillSwitchPath(stateDir) {
-  return path27.join(stateDir, JUDGE_SESSION_KILL_FILE);
+  return path28.join(stateDir, JUDGE_SESSION_KILL_FILE);
 }
 async function readJudgeSessionKillSwitch(stateDir) {
   const filePath = judgeSessionKillSwitchPath(stateDir);
-  if (!existsSync6(filePath)) {
+  if (!existsSync7(filePath)) {
     return null;
   }
   try {
-    const raw = JSON.parse(await readFile7(filePath, "utf8"));
+    const raw = JSON.parse(await readFile8(filePath, "utf8"));
     return raw.triggered === true ? raw : null;
   } catch {
     return null;
@@ -8098,7 +8204,7 @@ async function isJudgeSessionKillSwitchPersisted(stateDir) {
   return record?.triggered === true;
 }
 async function persistJudgeSessionKillSwitch(stateDir, reason = "shadow_mismatch") {
-  await mkdir7(stateDir, { recursive: true, mode: 448 });
+  await mkdir8(stateDir, { recursive: true, mode: 448 });
   const record = {
     triggered: true,
     at: (/* @__PURE__ */ new Date()).toISOString(),
@@ -8259,10 +8365,10 @@ function recordJudgeLatency(phase, latencyMs, at = Date.now()) {
 
 // src/core/verdict/judge-broker-service.ts
 import { spawn as spawn6 } from "node:child_process";
-import { existsSync as existsSync7 } from "node:fs";
-import { unlink as unlink5 } from "node:fs/promises";
+import { existsSync as existsSync8 } from "node:fs";
+import { unlink as unlink6 } from "node:fs/promises";
 import net2 from "node:net";
-import path28 from "node:path";
+import path29 from "node:path";
 import { fileURLToPath } from "node:url";
 
 // src/core/verdict/judge-cli.ts
@@ -8808,10 +8914,10 @@ var JUDGE_BROKER_SESSION = "judge-broker-session.json";
 function judgeBrokerPaths(stateDir) {
   return {
     stateDir,
-    socketPath: path28.join(stateDir, JUDGE_BROKER_SOCKET),
-    statusPath: path28.join(stateDir, JUDGE_BROKER_STATUS),
-    pidPath: path28.join(stateDir, JUDGE_BROKER_PID),
-    sessionConfigPath: path28.join(stateDir, JUDGE_BROKER_SESSION)
+    socketPath: path29.join(stateDir, JUDGE_BROKER_SOCKET),
+    statusPath: path29.join(stateDir, JUDGE_BROKER_STATUS),
+    pidPath: path29.join(stateDir, JUDGE_BROKER_PID),
+    sessionConfigPath: path29.join(stateDir, JUDGE_BROKER_SESSION)
   };
 }
 function daemonScriptPath() {
@@ -8829,12 +8935,12 @@ function useInProcessBroker(env = process.env) {
   return Boolean(env.VITEST || env.VITEST_WORKER_ID || env.BELAY_JUDGE_BROKER_IN_PROCESS === "1");
 }
 async function readBrokerStatus(statusPath) {
-  if (!existsSync7(statusPath)) {
+  if (!existsSync8(statusPath)) {
     return null;
   }
   try {
-    const { readFile: readFile17 } = await import("node:fs/promises");
-    const raw = JSON.parse(await readFile17(statusPath, "utf8"));
+    const { readFile: readFile18 } = await import("node:fs/promises");
+    const raw = JSON.parse(await readFile18(statusPath, "utf8"));
     if (typeof raw.pid !== "number" || typeof raw.socketPath !== "string") {
       return null;
     }
@@ -8844,13 +8950,13 @@ async function readBrokerStatus(statusPath) {
   }
 }
 async function readBrokerSessionConfig(sessionConfigPath) {
-  if (!existsSync7(sessionConfigPath)) {
+  if (!existsSync8(sessionConfigPath)) {
     return null;
   }
   try {
-    const { readFile: readFile17 } = await import("node:fs/promises");
+    const { readFile: readFile18 } = await import("node:fs/promises");
     const raw = JSON.parse(
-      await readFile17(sessionConfigPath, "utf8")
+      await readFile18(sessionConfigPath, "utf8")
     );
     return normalizeJudgeSessionConfig({ ...raw, enabled: true });
   } catch {
@@ -8941,7 +9047,7 @@ async function ensureJudgeBrokerDaemon(stateDir, repoRoot, sessionConfig) {
   const existingConfig = await readBrokerSessionConfig(paths.sessionConfigPath);
   const configChanged = existingConfig !== null && brokerSessionConfigPayload(existingConfig) !== nextConfigPayload;
   const status = await readBrokerStatus(paths.statusPath);
-  if (status && isProcessAlive2(status.pid) && existsSync7(paths.socketPath) && !configChanged) {
+  if (status && isProcessAlive2(status.pid) && existsSync8(paths.socketPath) && !configChanged) {
     await writeBrokerSessionConfig(paths, brokerSessionConfig);
     return paths;
   }
@@ -8963,7 +9069,7 @@ async function ensureJudgeBrokerDaemon(stateDir, repoRoot, sessionConfig) {
   child.unref();
   const deadline = Date.now() + sessionConfig.connectTimeoutMs;
   while (Date.now() < deadline) {
-    if (existsSync7(paths.socketPath)) {
+    if (existsSync8(paths.socketPath)) {
       const live = await readBrokerStatus(paths.statusPath);
       if (live && isProcessAlive2(live.pid)) {
         return paths;
@@ -8980,8 +9086,8 @@ async function cleanupJudgeBrokerArtifacts(paths) {
     paths.pidPath,
     paths.sessionConfigPath
   ]) {
-    if (existsSync7(artifact)) {
-      await unlink5(artifact).catch(() => void 0);
+    if (existsSync8(artifact)) {
+      await unlink6(artifact).catch(() => void 0);
     }
   }
 }
@@ -9477,9 +9583,9 @@ async function evaluateWithJudgeTransport(request, options = {}) {
 }
 
 // src/core/capability/gate-shadow-ratchet.ts
-import { existsSync as existsSync8 } from "node:fs";
-import { mkdir as mkdir8, readFile as readFile8, writeFile as writeFile5 } from "node:fs/promises";
-import path29 from "node:path";
+import { existsSync as existsSync9 } from "node:fs";
+import { mkdir as mkdir9, readFile as readFile9, writeFile as writeFile5 } from "node:fs/promises";
+import path30 from "node:path";
 var DEFAULT_STATE = {
   version: 1,
   policyJudgeComparisons: 0,
@@ -9488,15 +9594,15 @@ var DEFAULT_STATE = {
   updatedAt: (/* @__PURE__ */ new Date(0)).toISOString()
 };
 function ratchetPath(stateDir) {
-  return path29.join(stateDir, "gate-shadow-ratchet.json");
+  return path30.join(stateDir, "gate-shadow-ratchet.json");
 }
 async function loadState(stateDir) {
   const filePath = ratchetPath(stateDir);
-  if (!existsSync8(filePath)) {
+  if (!existsSync9(filePath)) {
     return { ...DEFAULT_STATE, updatedAt: (/* @__PURE__ */ new Date()).toISOString() };
   }
   try {
-    const raw = JSON.parse(await readFile8(filePath, "utf8"));
+    const raw = JSON.parse(await readFile9(filePath, "utf8"));
     return {
       ...DEFAULT_STATE,
       ...raw,
@@ -9507,7 +9613,7 @@ async function loadState(stateDir) {
   }
 }
 async function saveState(stateDir, state) {
-  await mkdir8(stateDir, { recursive: true, mode: 448 });
+  await mkdir9(stateDir, { recursive: true, mode: 448 });
   await writeFile5(
     ratchetPath(stateDir),
     `${JSON.stringify({ ...state, updatedAt: (/* @__PURE__ */ new Date()).toISOString() }, null, 2)}
@@ -9630,7 +9736,7 @@ function scheduleGateShadowAudit(params) {
 async function runGatePolicyShadowComparison(params) {
   const judge = params.config.judge;
   const runtime = normalizeJudgeRuntimeConfig(judge.runtime);
-  const stateDir = params.stateDir ?? belayStateDir(params.config, path30.join(params.repoRoot, ".belay"));
+  const stateDir = params.stateDir ?? belayStateDir(params.config, path31.join(params.repoRoot, ".belay"));
   const transport = await evaluateWithJudgeTransport(
     {
       prompt: buildTier1Prompt(params.command),
@@ -9920,15 +10026,15 @@ async function loadClassifierAuthorization(params) {
 }
 
 // src/core/capability/allowlist.ts
-import { existsSync as existsSync9, readFileSync as readFileSync3 } from "node:fs";
+import { existsSync as existsSync10, readFileSync as readFileSync3 } from "node:fs";
 init_config();
 init_path_utils();
-import path31 from "node:path";
+import path32 from "node:path";
 function fsScopeAllowlistPath(config, repoLocalStateDir) {
-  return path31.join(belayStateDir(config, repoLocalStateDir), "fs-scope-allowlist.json");
+  return path32.join(belayStateDir(config, repoLocalStateDir), "fs-scope-allowlist.json");
 }
 function loadFsScopeAllowlistSync(filePath) {
-  if (!existsSync9(filePath)) {
+  if (!existsSync10(filePath)) {
     return { version: 1, paths: [] };
   }
   const raw = JSON.parse(readFileSync3(filePath, "utf8"));
@@ -10020,7 +10126,7 @@ function checkGatedActionLimits(action) {
 // src/core/capability/paths.ts
 init_path_utils();
 init_shell_tokenizer();
-import path32 from "node:path";
+import path33 from "node:path";
 function applyPatchTargets(patch) {
   const targets = [];
   for (const line of patch.split("\n")) {
@@ -10085,7 +10191,7 @@ function collectOutsideRepoPathsFromToolPayload(payload, cwd, repoRoot, trustedW
   const paths = /* @__PURE__ */ new Set();
   const filePath = extractToolFilePath(payload);
   if (filePath) {
-    const resolved = path32.isAbsolute(filePath) ? filePath : path32.resolve(cwd, filePath);
+    const resolved = path33.isAbsolute(filePath) ? filePath : path33.resolve(cwd, filePath);
     if (resolveWorkspaceRootMatch(repoRoot, trustedWorkspaceRoots, resolved) === null) {
       paths.add(resolved);
     }
@@ -10095,7 +10201,7 @@ function collectOutsideRepoPathsFromToolPayload(payload, cwd, repoRoot, trustedW
     const patch = extractToolPatch(payload);
     if (patch) {
       for (const target of applyPatchTargets(patch)) {
-        const resolved = path32.isAbsolute(target) ? target : path32.resolve(cwd, target);
+        const resolved = path33.isAbsolute(target) ? target : path33.resolve(cwd, target);
         if (resolveWorkspaceRootMatch(repoRoot, trustedWorkspaceRoots, resolved) === null) {
           paths.add(resolved);
         }
@@ -10149,7 +10255,7 @@ function policyReasonToLegacyReason(decision) {
 // src/core/capability/policy-engine.ts
 init_git_resource_identity();
 import { createHash as createHash10 } from "node:crypto";
-import path33 from "node:path";
+import path34 from "node:path";
 init_path_utils();
 init_shell_tokenizer();
 init_grant();
@@ -10441,7 +10547,7 @@ function hashSession(value) {
   return createHash10("sha256").update(value).digest("hex").slice(0, 16);
 }
 function resolveCapabilityPath2(targetPath, cwd) {
-  const joined = path33.isAbsolute(targetPath) ? targetPath : path33.join(cwd, targetPath);
+  const joined = path34.isAbsolute(targetPath) ? targetPath : path34.join(cwd, targetPath);
   return canonicalPath(joined);
 }
 function actionForFileMutation(analysis) {
@@ -10520,7 +10626,7 @@ function isRepoLocalPackageExec(request) {
     return false;
   }
   const commandPath = canonicalPath(request.resource.command);
-  return path33.isAbsolute(commandPath) && pathWithinRoot(request.principal.repoRoot, commandPath);
+  return path34.isAbsolute(commandPath) && pathWithinRoot(request.principal.repoRoot, commandPath);
 }
 function isRepoLocalRoutineWrite(request, sensitivePaths) {
   if (!isRepoLocalShellLocation(request)) {
@@ -10768,6 +10874,40 @@ function evaluateFileMutationPolicy(analysis, config, auth) {
   );
   return { request, decision };
 }
+function buildFileReadCapabilityRequest(analysis) {
+  return {
+    version: CAPABILITY_REQUEST_VERSION,
+    principal: {
+      adapter: analysis.adapter,
+      repoRoot: analysis.repoRoot,
+      sessionHash: hashSession(`${analysis.repoRoot}:${analysis.cwd}`)
+    },
+    action: "fs.read",
+    resource: { kind: "path", path: analysis.resolvedPath },
+    context: {
+      cwd: analysis.cwd,
+      inputFingerprint: analysis.inputFingerprint,
+      hookKind: analysis.hookKind,
+      analysisBasis: [`tool:${analysis.toolKind}`, `location:${analysis.locationLabel}`, "read"]
+    },
+    evidence: {
+      level: analysis.locationLabel === "repo_local" ? "certain" : "possible",
+      signals: [...analysis.signals, "effect.fs_read"]
+    }
+  };
+}
+function evaluateFileReadPolicy(analysis, config, auth) {
+  const request = buildFileReadCapabilityRequest(analysis);
+  const enriched = enrichAuthWithMaterializedGrants(request, config, {
+    ...auth,
+    sensitivePaths: auth?.sensitivePaths ?? analysis.sensitivePaths
+  });
+  const decision = getDefaultPolicyEngine().evaluate(
+    request,
+    buildAuthorizationContext(config, analysis.trustedWorkspaceRoots, enriched)
+  );
+  return { request, decision };
+}
 
 // src/core/capability/reasons.ts
 var FS_SCOPE_REASONS = /* @__PURE__ */ new Set(["outside_repo_mutation", "outside_repo_redirect"]);
@@ -10784,15 +10924,15 @@ function shouldSkipBrokerApprovedRecord(brokerActive, approvalReason) {
 }
 
 // src/core/capability/trusted-workspace-roots.ts
-import { existsSync as existsSync10, readFileSync as readFileSync4, statSync as statSync3 } from "node:fs";
+import { existsSync as existsSync11, readFileSync as readFileSync4, statSync as statSync3 } from "node:fs";
 init_config();
 init_path_utils();
-import path34 from "node:path";
+import path35 from "node:path";
 function trustedWorkspaceRootsPath(config, repoLocalStateDir) {
-  return path34.join(belayStateDir(config, repoLocalStateDir), "trusted-workspace-roots.json");
+  return path35.join(belayStateDir(config, repoLocalStateDir), "trusted-workspace-roots.json");
 }
 function loadTrustedWorkspaceRootsSync(filePath) {
-  if (!existsSync10(filePath)) {
+  if (!existsSync11(filePath)) {
     return { version: 1, roots: [] };
   }
   const raw = JSON.parse(readFileSync4(filePath, "utf8"));
@@ -10818,7 +10958,7 @@ function sanitizeTrustedWorkspaceRootEntries(input) {
     const source = record.source === "approval" ? "approval" : void 0;
     return [
       {
-        path: path34.resolve(record.path),
+        path: path35.resolve(record.path),
         approvedAt,
         approvalId,
         ...source ? { source } : {}
@@ -10847,7 +10987,7 @@ function isDirectoryPath(targetPath) {
 function isBroadTrustedWorkspaceRoot(targetPath) {
   const home = process.env.HOME ?? process.env.USERPROFILE;
   const root = normalizeTrustedWorkspaceRootPath(targetPath);
-  if (root === normalizeTrustedWorkspaceRootPath(path34.parse(root).root)) {
+  if (root === normalizeTrustedWorkspaceRootPath(path35.parse(root).root)) {
     return true;
   }
   if (home && normalizeTrustedWorkspaceRootPath(home) === root) {
@@ -10871,7 +11011,7 @@ function isHighStakesTrustedWorkspaceRoot(targetPath) {
     return false;
   }
   return HOME_HIGH_STAKES_SEGMENTS.some(
-    (segment) => pathWithinRoot(path34.join(homeRoot, segment), normalized)
+    (segment) => pathWithinRoot(path35.join(homeRoot, segment), normalized)
   );
 }
 function validateTrustedWorkspaceRootCandidate(params) {
@@ -10908,7 +11048,7 @@ function validateTrustedWorkspaceRootCandidate(params) {
 init_config_layers();
 
 // src/core/contained-execution/eligibility.ts
-import path35 from "node:path";
+import path36 from "node:path";
 init_path_utils();
 var FORBIDDEN_SIGNALS = /* @__PURE__ */ new Set([
   "command_substitution",
@@ -10925,7 +11065,7 @@ var FORBIDDEN_SIGNALS = /* @__PURE__ */ new Set([
 ]);
 function isContainedUnknownExecutionEligible(config, action, result) {
   const contained = config.sandbox.containedExecution;
-  if (!contained?.enabled || !config.sandbox.enabled || config.sandbox.runtime !== "container" || action.kind !== "shell" || !path35.isAbsolute(action.repoRoot) || !hasResolvedRepoIdentity(action.repoRoot) || !config.gates.shell || result.reason !== "unknown_local_effect" || result.axes?.location !== "repo_local" || result.assessment.external) {
+  if (!contained?.enabled || !config.sandbox.enabled || config.sandbox.runtime !== "container" || action.kind !== "shell" || !path36.isAbsolute(action.repoRoot) || !hasResolvedRepoIdentity(action.repoRoot) || !config.gates.shell || result.reason !== "unknown_local_effect" || result.axes?.location !== "repo_local" || result.assessment.external) {
     return false;
   }
   const plan = result.effectPlan;
@@ -11205,7 +11345,7 @@ function classifySubagent(payload, repoRoot, options = {}, config) {
 }
 
 // src/core/classify-tool.ts
-import path50 from "node:path";
+import path51 from "node:path";
 init_fingerprint2();
 init_path_utils();
 init_scrub();
@@ -11325,13 +11465,13 @@ function worstEffectDecision(decisions) {
 
 // src/core/effect-ir/shell-lower.ts
 init_shell_tokenizer();
-import path49 from "node:path";
+import path50 from "node:path";
 
 // src/core/verdict/docker-compose-run.ts
-import path37 from "node:path";
+import path38 from "node:path";
 
 // src/core/verdict/recursive-invocation.ts
-import path36 from "node:path";
+import path37 from "node:path";
 var SHELL_INTERPRETERS = /* @__PURE__ */ new Set(["bash", "sh", "zsh", "dash", "fish"]);
 var PYTHON_INTERPRETERS = /* @__PURE__ */ new Set(["python", "python3"]);
 var SHELL_SHORT_OPTIONS = /* @__PURE__ */ new Set(["c", "l", "e", "x", "u"]);
@@ -11393,7 +11533,7 @@ var OSASCRIPT_PROFILE = {
   attachedValuePrefixes: []
 };
 function normalizeInterpreter(value) {
-  return path36.basename(value);
+  return path37.basename(value);
 }
 function scriptResult(interpreter, token) {
   if (!token) {
@@ -11623,7 +11763,7 @@ function parseOptions(words, start, options) {
 function decodeDockerComposeRun(tokens) {
   if (tokens.some((token) => token.kind === "operator")) return { kind: "none" };
   const words = tokens.filter((token) => token.kind === "word");
-  const head = path37.basename(words[0]?.value ?? "");
+  const head = path38.basename(words[0]?.value ?? "");
   let index;
   if (head === "docker-compose") {
     index = 1;
@@ -11664,7 +11804,7 @@ function decodeDockerComposeRun(tokens) {
 }
 
 // src/core/verdict/egress-classify.ts
-import path38 from "node:path";
+import path39 from "node:path";
 var EGRESS_TOOL_HEADS = /* @__PURE__ */ new Set([
   "aws",
   "curl",
@@ -11713,7 +11853,7 @@ function isEgressToolHead(head) {
   return EGRESS_TOOL_HEADS.has(head);
 }
 function decodeEgressEffects(params) {
-  const head = path38.basename(params.tokens[0] ?? "");
+  const head = path39.basename(params.tokens[0] ?? "");
   if (head !== "curl" && head !== "wget" && head !== "gh") {
     return null;
   }
@@ -11721,7 +11861,7 @@ function decodeEgressEffects(params) {
   const provenance = { segment: params.segment };
   const requirements = [];
   for (const file of decoded.files) {
-    const resolved = path38.resolve(params.cwd, expandHome2(file));
+    const resolved = path39.resolve(params.cwd, expandHome2(file));
     requirements.push(
       requirement("fs.read", "fs.read", { kind: "path", path: resolved }, params.segment, [
         "egress.explicit_file_read"
@@ -11743,7 +11883,7 @@ function decodeEgressEffects(params) {
     if (file === "-") {
       continue;
     }
-    const resolved = path38.resolve(params.cwd, expandHome2(file));
+    const resolved = path39.resolve(params.cwd, expandHome2(file));
     if (resolved === "/dev/null") {
       continue;
     }
@@ -12221,13 +12361,13 @@ function decodeSingleCurlWgetGrammar(head, tokens) {
   if (head === "wget" && !explicitOutput) {
     outputFiles.push(
       ...endpointOutputNames.map(
-        (name) => outputDirectory ? path38.join(outputDirectory, name) : name
+        (name) => outputDirectory ? path39.join(outputDirectory, name) : name
       )
     );
   } else if (head === "curl" && remoteNameOutput) {
     outputFiles.push(
       ...endpointOutputNames.map(
-        (name) => outputDirectory ? path38.join(outputDirectory, name) : name
+        (name) => outputDirectory ? path39.join(outputDirectory, name) : name
       )
     );
   }
@@ -12241,7 +12381,7 @@ function decodeSingleCurlWgetGrammar(head, tokens) {
     outputFiles: [
       ...new Set(
         outputFiles.map(
-          (file) => outputDirectory && directoryEligibleOutputs.has(file) && !path38.isAbsolute(file) ? path38.join(outputDirectory, file) : file
+          (file) => outputDirectory && directoryEligibleOutputs.has(file) && !path39.isAbsolute(file) ? path39.join(outputDirectory, file) : file
         )
       )
     ],
@@ -12256,7 +12396,7 @@ function remoteOutputName(spec) {
   } catch {
     pathname = spec.split(/[?#]/, 1)[0] ?? "";
   }
-  const name = path38.posix.basename(pathname);
+  const name = path39.posix.basename(pathname);
   return name && name !== "/" ? name : "index.html";
 }
 function decodeGhGrammar(tokens) {
@@ -12421,7 +12561,7 @@ function expandHome2(value) {
     return process.env.HOME ?? value;
   }
   if (value.startsWith("~/")) {
-    return path38.join(process.env.HOME ?? "~", value.slice(2));
+    return path39.join(process.env.HOME ?? "~", value.slice(2));
   }
   return value;
 }
@@ -12440,7 +12580,7 @@ function requirement(tag, action, resource, segment, signals) {
 }
 
 // src/core/verdict/git-classifier.ts
-import path39 from "node:path";
+import path40 from "node:path";
 init_shell_tokenizer();
 var GIT_BRANCH_MUTATION_FLAGS = /* @__PURE__ */ new Set([
   "--copy",
@@ -12536,7 +12676,7 @@ var FILE_OPERAND_SUBCOMMANDS = /* @__PURE__ */ new Set([
 var COMPOUND_SUBCOMMAND_HEADS = /* @__PURE__ */ new Set(["worktree", "stash", "tag"]);
 var REF_ONLY_WITHOUT_TERMINATOR = /* @__PURE__ */ new Set(["checkout", "show", "log"]);
 function isGitExecutable(token) {
-  return path39.basename(token) === "git";
+  return path40.basename(token) === "git";
 }
 function takesValue(flag) {
   return flag === "-C" || flag === "-c" || flag === "--git-dir" || flag === "--work-tree" || flag === "--exec-path" || flag === "--paginate" || flag === "--config-env" || flag.startsWith("-C") || flag.startsWith("-c") || flag.startsWith("--git-dir=") || flag.startsWith("--work-tree=");
@@ -12564,7 +12704,7 @@ function peelGlobalOptions(tokens, baseCwd) {
     if (token === "-C" || token === "--work-tree" || token === "--git-dir" || token === "-c") {
       const value = tokens[index + 1];
       if (token === "-C" && value) {
-        effectiveCwd = path39.resolve(baseCwd, value);
+        effectiveCwd = path40.resolve(baseCwd, value);
       } else if (token === "--work-tree" && value) {
         workTree = value;
       } else if (token === "--git-dir" && value) {
@@ -12574,7 +12714,7 @@ function peelGlobalOptions(tokens, baseCwd) {
       continue;
     }
     if (token.startsWith("-C") && token.length > 2) {
-      effectiveCwd = path39.resolve(baseCwd, token.slice(2));
+      effectiveCwd = path40.resolve(baseCwd, token.slice(2));
       index += 1;
       continue;
     }
@@ -12717,7 +12857,7 @@ function looksLikeDiffPathOperand(token) {
   if (!looksLikeFileOperand(token)) {
     return false;
   }
-  if (token.startsWith(".") || path39.isAbsolute(token)) {
+  if (token.startsWith(".") || path40.isAbsolute(token)) {
     return true;
   }
   return token.includes(".");
@@ -12725,12 +12865,12 @@ function looksLikeDiffPathOperand(token) {
 function resolveGitWorkTree(baseCwd, effectiveCwd, workTree, gitDir) {
   const resolveBase = effectiveCwd ?? baseCwd;
   if (workTree) {
-    return path39.resolve(resolveBase, workTree);
+    return path40.resolve(resolveBase, workTree);
   }
   if (gitDir) {
-    const resolvedGitDir = path39.resolve(resolveBase, gitDir);
-    if (path39.basename(resolvedGitDir) === ".git") {
-      return path39.dirname(resolvedGitDir);
+    const resolvedGitDir = path40.resolve(resolveBase, gitDir);
+    if (path40.basename(resolvedGitDir) === ".git") {
+      return path40.dirname(resolvedGitDir);
     }
   }
   return void 0;
@@ -12811,7 +12951,7 @@ function classifyGitCommand(tokens, baseCwd) {
   const { subcommand, args, effectiveCwd, gitDir, workTree } = normalized;
   const normalizedKey = `git ${subcommand}`;
   const gitWorkTree = resolveGitWorkTree(baseCwd, effectiveCwd, workTree, gitDir);
-  const effectiveGitDir = gitDir ? path39.resolve(effectiveCwd ?? baseCwd, gitDir) : void 0;
+  const effectiveGitDir = gitDir ? path40.resolve(effectiveCwd ?? baseCwd, gitDir) : void 0;
   const scopeTargets = [effectiveCwd, gitWorkTree, effectiveGitDir].filter(
     (target, index, targets) => Boolean(target) && targets.indexOf(target) === index
   );
@@ -12963,9 +13103,9 @@ function decodeGitEffects(params) {
     ...subcommand === "push" ? ["tier0_external"] : []
   ];
   const effectiveCwd = normalized.effectiveCwd ?? params.cwd;
-  const workTreeRoot = normalized.workTree ? path39.resolve(normalized.effectiveCwd ?? params.cwd, normalized.workTree) : normalized.effectiveCwd ?? params.repoRoot;
-  const gitRefRoot = normalized.gitDir ? path39.resolve(effectiveCwd, normalized.gitDir) : workTreeRoot;
-  const gitControlRoot = normalized.gitDir ? gitRefRoot : path39.join(gitRefRoot, ".git");
+  const workTreeRoot = normalized.workTree ? path40.resolve(normalized.effectiveCwd ?? params.cwd, normalized.workTree) : normalized.effectiveCwd ?? params.repoRoot;
+  const gitRefRoot = normalized.gitDir ? path40.resolve(effectiveCwd, normalized.gitDir) : workTreeRoot;
+  const gitControlRoot = normalized.gitDir ? gitRefRoot : path40.join(gitRefRoot, ".git");
   const requirements = [];
   if (subcommand === "fetch" || subcommand === "pull") {
     const positionals = gitRemotePositionals(args);
@@ -13124,7 +13264,7 @@ function decodeGitEffects(params) {
         gitRequirement(
           "control_plane.write",
           "control_plane.write",
-          { kind: "path", path: path39.join(gitControlRoot, "logs") },
+          { kind: "path", path: path40.join(gitControlRoot, "logs") },
           params.segment,
           [...signals, "git_history_destructive", "git.reflog.mutate"]
         )
@@ -13182,7 +13322,7 @@ function decodeGitEffects(params) {
         gitRequirement(
           "fs.read",
           "fs.read",
-          { kind: "path", path: path39.resolve(workTreeRoot, operand) },
+          { kind: "path", path: path40.resolve(workTreeRoot, operand) },
           params.segment,
           [...signals, "git.path.read"]
         )
@@ -13217,7 +13357,7 @@ function decodeGitEffects(params) {
         gitRequirement(
           "fs.write",
           "fs.write",
-          { kind: "path", path: path39.resolve(workTreeRoot, operand) },
+          { kind: "path", path: path40.resolve(workTreeRoot, operand) },
           params.segment,
           [...signals, "git.path.write"]
         )
@@ -13401,8 +13541,8 @@ function gitRequirement(tag, action, resource, segment, signals) {
 }
 
 // src/core/verdict/launcher-resolve.ts
-import { existsSync as existsSync11, readFileSync as readFileSync5 } from "node:fs";
-import path40 from "node:path";
+import { existsSync as existsSync12, readFileSync as readFileSync5 } from "node:fs";
+import path41 from "node:path";
 
 // src/core/verdict/makefile-expand.ts
 var MAX_EXPAND_DEPTH = 16;
@@ -13575,8 +13715,8 @@ var PNPM_BUILTIN_COMMANDS = /* @__PURE__ */ new Set([
   "why"
 ]);
 function readPackageJson(dir) {
-  const packagePath = path40.join(dir, "package.json");
-  if (!existsSync11(packagePath)) {
+  const packagePath = path41.join(dir, "package.json");
+  if (!existsSync12(packagePath)) {
     return null;
   }
   try {
@@ -13586,17 +13726,17 @@ function readPackageJson(dir) {
   }
 }
 function findPackageJson(startDir, stopDir) {
-  let current = path40.resolve(startDir);
-  const stop = path40.resolve(stopDir);
+  let current = path41.resolve(startDir);
+  const stop = path41.resolve(stopDir);
   while (true) {
-    const packagePath = path40.join(current, "package.json");
-    if (existsSync11(packagePath)) {
+    const packagePath = path41.join(current, "package.json");
+    if (existsSync12(packagePath)) {
       return packagePath;
     }
-    if (current === stop || current === path40.dirname(current)) {
-      return existsSync11(packagePath) ? packagePath : null;
+    if (current === stop || current === path41.dirname(current)) {
+      return existsSync12(packagePath) ? packagePath : null;
     }
-    const parent = path40.dirname(current);
+    const parent = path41.dirname(current);
     if (!parent.startsWith(stop) && parent !== current) {
     }
     if (parent === current) {
@@ -13653,7 +13793,7 @@ function resolveNpmRecipe(cwd, repoRoot, scriptName, extraArgs) {
     }
     return { recipes: [], opaque: true, reason: "package_json_missing" };
   }
-  const pkg = readPackageJson(path40.dirname(packagePath));
+  const pkg = readPackageJson(path41.dirname(packagePath));
   const scripts = pkg?.scripts;
   if (!scripts || typeof scripts !== "object") {
     return { recipes: [], opaque: true, reason: "package_scripts_missing" };
@@ -13744,20 +13884,20 @@ function parseMakefileRecipeContent(content) {
 function resolveMakeRecipe(cwd, repoRoot, target, cliVars = {}) {
   const candidates = ["Makefile", "makefile", "GNUmakefile"];
   let makefilePath = null;
-  let searchDir = path40.resolve(cwd);
-  const stop = path40.resolve(repoRoot);
+  let searchDir = path41.resolve(cwd);
+  const stop = path41.resolve(repoRoot);
   while (true) {
     for (const name of candidates) {
-      const candidate = path40.join(searchDir, name);
-      if (existsSync11(candidate)) {
+      const candidate = path41.join(searchDir, name);
+      if (existsSync12(candidate)) {
         makefilePath = candidate;
         break;
       }
     }
-    if (makefilePath || searchDir === stop || searchDir === path40.dirname(searchDir)) {
+    if (makefilePath || searchDir === stop || searchDir === path41.dirname(searchDir)) {
       break;
     }
-    searchDir = path40.dirname(searchDir);
+    searchDir = path41.dirname(searchDir);
   }
   if (!makefilePath) {
     return { recipes: [], opaque: true, reason: "unknown_local_effect" };
@@ -13784,7 +13924,7 @@ function resolveMakeRecipe(cwd, repoRoot, target, cliVars = {}) {
     }
     const entry = targets.get(name);
     if (!entry) {
-      if (!existsSync11(path40.resolve(path40.dirname(makefilePath), name))) {
+      if (!existsSync12(path41.resolve(path41.dirname(makefilePath), name))) {
         hasUndefinedPrerequisite = true;
       }
       return;
@@ -13883,7 +14023,7 @@ function resolveLauncherRecipe(params) {
 }
 
 // src/core/verdict/parser.ts
-import path41 from "node:path";
+import path42 from "node:path";
 
 // src/core/shell-substitution.ts
 function findStructuralCommandSubstitutions(command) {
@@ -14123,7 +14263,7 @@ var INTERPRETER_SCRIPT_EXTENSIONS = /* @__PURE__ */ new Set([
   ".sh"
 ]);
 function normalizeHead(token) {
-  const base = path41.basename(token);
+  const base = path42.basename(token);
   if (base && base !== "." && base !== "..") {
     return base;
   }
@@ -14433,7 +14573,7 @@ function isBareInterpreter(tokens) {
     return false;
   }
   const scriptArg = args.find((token) => !token.startsWith("-"));
-  if (scriptArg && INTERPRETER_SCRIPT_EXTENSIONS.has(path41.extname(scriptArg))) {
+  if (scriptArg && INTERPRETER_SCRIPT_EXTENSIONS.has(path42.extname(scriptArg))) {
     return false;
   }
   if (scriptArg) {
@@ -14673,7 +14813,7 @@ function mergeNodes(nodes) {
 }
 
 // src/core/effect-ir/shell-lower/argv-delegate-gate.ts
-import path42 from "node:path";
+import path43 from "node:path";
 var ARGV_DELEGATE_INNER_BLOCKLIST = /* @__PURE__ */ new Set([
   "sudo",
   "env",
@@ -14694,7 +14834,7 @@ function shouldApplyArgvDelegate(head, innerTokens, depth) {
   if (ARGV_DELEGATE_INNER_BLOCKLIST.has(head)) {
     return false;
   }
-  const innerHead = path42.basename(innerTokens[0] ?? "");
+  const innerHead = path43.basename(innerTokens[0] ?? "");
   if (ARGV_DELEGATE_INNER_BLOCKLIST.has(innerHead)) {
     return false;
   }
@@ -14801,7 +14941,7 @@ function withInnerProvenance(requirementValue, innerCommand, launcher, outerSegm
 
 // src/core/effect-ir/shell-lower/tokens.ts
 init_shell_tokenizer();
-import path43 from "node:path";
+import path44 from "node:path";
 var ENV_PREFIX_PATTERN2 = /^([A-Za-z_][A-Za-z0-9_]*)=(.*)$/;
 var LOOPBACK_HOSTS2 = /* @__PURE__ */ new Set(["127.0.0.1", "localhost", "::1", "0:0:0:0:0:0:0:1"]);
 var METADATA_ONLY_FLAGS = /* @__PURE__ */ new Set(["--version", "-v", "-V", "--help", "-h"]);
@@ -14945,9 +15085,9 @@ function resolvePathOperand(operand, cwd) {
     return process.env.HOME ?? operand;
   }
   if (operand.startsWith("~/")) {
-    return path43.join(process.env.HOME ?? "~", operand.slice(2));
+    return path44.join(process.env.HOME ?? "~", operand.slice(2));
   }
-  return path43.resolve(cwd, operand);
+  return path44.resolve(cwd, operand);
 }
 function isOptionToken(value) {
   return value.startsWith("-") || value.startsWith("+");
@@ -14959,7 +15099,7 @@ function pipeToShell(command) {
   return /(?:^|[|;&]\s*)(?:bash|sh|zsh|dash|fish)(?:\s|$)/.test(command) && /\|/.test(command);
 }
 function executableBaseName(head) {
-  return path43.basename(head);
+  return path44.basename(head);
 }
 function isMetadataOnlyArgv(argv) {
   return argv.length > 0 && argv.every((token) => METADATA_ONLY_FLAGS.has(token));
@@ -15078,15 +15218,22 @@ function effectChangingEnvironmentSignals(head, env, changedNames) {
 }
 
 // src/core/effect-ir/shell-lower/decode-process.ts
-import path47 from "node:path";
+import path48 from "node:path";
 
 // src/core/effect-ir/shell-lower/decoders/belay.ts
-import path44 from "node:path";
+import path45 from "node:path";
 function decodeBelay(args, repoRoot, segment) {
   const [section, operation, key] = args;
   const judgeCommand = section === "judge" && operation !== void 0 && ["consent", "list", "status", "test", "use"].includes(operation);
   const configRead = section === "config" && (operation === void 0 || operation === "list" || operation === "get" && key?.startsWith("judge."));
   const configJudgeMutation = section === "config" && (["set", "unset"].includes(operation ?? "") && key?.startsWith("judge.") || operation === "credential" && key === "mode");
+  const approvalAuthorityCommand = [
+    "approval-token",
+    "approve",
+    "revoke",
+    "standing-allow"
+  ].includes(section ?? "");
+  const configTrustMutation = section === "config" && operation === "trust";
   if (judgeCommand || configRead || configJudgeMutation) {
     return [
       processRequirement("belay", "inspect", segment, [
@@ -15095,12 +15242,23 @@ function decodeBelay(args, repoRoot, segment) {
       ])
     ];
   }
+  if (approvalAuthorityCommand || configTrustMutation) {
+    return [
+      requirement2(
+        "control_plane.write",
+        "control_plane.write",
+        { kind: "path", path: path45.join(repoRoot, ".belay-control-plane") },
+        segment,
+        [approvalAuthorityCommand ? "belay.approval_authority" : "belay.config_trust"]
+      )
+    ];
+  }
   if (section === "config" && ["set", "unset", "credential"].includes(operation ?? "")) {
     return [
       requirement2(
         "control_plane.write",
         "control_plane.write",
-        { kind: "path", path: path44.join(repoRoot, ".belay-control-plane") },
+        { kind: "path", path: path45.join(repoRoot, ".belay-control-plane") },
         segment,
         ["belay.config_non_judge_mutation"]
       )
@@ -15341,7 +15499,7 @@ function validDockerInfo(args) {
 // src/core/effect-ir/shell-lower/decoders/filesystem.ts
 init_git_resource_identity();
 import { lstatSync as lstatSync2, realpathSync as realpathSync4 } from "node:fs";
-import path45 from "node:path";
+import path46 from "node:path";
 function decodeCopyMove(head, args, cwd, segment) {
   const requirements = [processRequirement(head, "spawn", segment, ["process.filesystem_mutation"])];
   const operands = [];
@@ -15469,11 +15627,11 @@ function decodeRm(args, cwd, repoRoot, segment) {
 function canonicalRmOperand(targetPath, finalOperandIsSymlink) {
   try {
     if (finalOperandIsSymlink) {
-      return path45.join(realpathSync4.native(path45.dirname(targetPath)), path45.basename(targetPath));
+      return path46.join(realpathSync4.native(path46.dirname(targetPath)), path46.basename(targetPath));
     }
     return realpathSync4.native(targetPath);
   } catch {
-    return path45.resolve(targetPath);
+    return path46.resolve(targetPath);
   }
 }
 function isSymbolicLink(targetPath) {
@@ -15484,8 +15642,8 @@ function isSymbolicLink(targetPath) {
   }
 }
 function pathContains(ancestor, candidate) {
-  const relative = path45.relative(path45.resolve(ancestor), path45.resolve(candidate));
-  return relative === "" || !relative.startsWith("..") && !path45.isAbsolute(relative);
+  const relative = path46.relative(path46.resolve(ancestor), path46.resolve(candidate));
+  return relative === "" || !relative.startsWith("..") && !path46.isAbsolute(relative);
 }
 function filesystemReadOperands(head, args) {
   switch (head) {
@@ -15625,7 +15783,7 @@ function decodePrisma(args, env, repoRoot, segment) {
 
 // src/core/effect-ir/shell-lower/decoders/ruby.ts
 init_path_utils();
-import path46 from "node:path";
+import path47 from "node:path";
 var RAILS_READ_ONLY_SUBCOMMANDS = /* @__PURE__ */ new Set(["routes", "middleware", "stats", "about", "version"]);
 function railsReadOnlySubcommand(args) {
   const subcommand = args[0];
@@ -15635,7 +15793,7 @@ function railsReadOnlySubcommand(args) {
   return RAILS_READ_ONLY_SUBCOMMANDS.has(subcommand);
 }
 function isRubyTestScript(scriptPath) {
-  const base = path46.basename(scriptPath);
+  const base = path47.basename(scriptPath);
   return base.endsWith("_test.rb") || base.endsWith("_spec.rb");
 }
 function parseRubyTestInvocation(args) {
@@ -16049,7 +16207,7 @@ function decodeProcessOrFilesystem(params) {
         requirement2(
           "fs.read",
           "fs.read",
-          { kind: "path", path: path47.resolve(cwd, syntax) },
+          { kind: "path", path: path48.resolve(cwd, syntax) },
           segment,
           ["shell.syntax_source_read"]
         )
@@ -16255,7 +16413,7 @@ function packageExecInnerIsMetadata(peel) {
 
 // src/core/effect-ir/shell-lower/segment.ts
 init_shell_tokenizer();
-import path48 from "node:path";
+import path49 from "node:path";
 var DYNAMIC_SHELL_VALUE_PATTERN = /(?:\$\(|`|\$(?:\d+|[@*#?$!-]|\{[^}]*\}|[A-Za-z_][A-Za-z0-9_]*))/;
 var SHELL_GLOB_PATTERN = /[*?[]/;
 function requiresKnownCwd(requirementValue) {
@@ -16270,11 +16428,11 @@ function joinNestedOpacity(outer, nested) {
 }
 function startsLocalPostgresService(command) {
   const tokens = tokenizeShell(command);
-  return path48.basename(tokens[0] ?? "") === "docker" && tokens[1] === "compose" && ["up", "start", "restart"].includes(tokens[2] ?? "") && tokens.includes("postgres");
+  return path49.basename(tokens[0] ?? "") === "docker" && tokens[1] === "compose" && ["up", "start", "restart"].includes(tokens[2] ?? "") && tokens.includes("postgres");
 }
 function resolveCdTransition(command, currentCwd) {
   const tokens = tokenizeShell(command);
-  if (path48.basename(tokens[0] ?? "") !== "cd") {
+  if (path49.basename(tokens[0] ?? "") !== "cd") {
     return null;
   }
   const target = tokens[1] ?? "~";
@@ -16437,7 +16595,7 @@ function lowerSegment(command, context) {
     stripStructuredRedirects(lexed.tokens),
     stripRedirects(parsedTokens)
   );
-  const head = path49.basename(tokens[0] ?? parsed.head);
+  const head = path50.basename(tokens[0] ?? parsed.head);
   let opacity = segmentOpacity(command);
   const signals = /* @__PURE__ */ new Set();
   const requirements = [];
@@ -17020,17 +17178,41 @@ function verdictToClassifyResult(result, config, options = {}) {
 
 // src/core/classify-tool.ts
 var DEFAULT_SENSITIVE_PATHS = [".env", ".env.*", "**/credentials/**"];
-var FILE_WRITE_TOOL_NAMES = /* @__PURE__ */ new Set(["write"]);
-var FILE_EDIT_TOOL_NAMES = /* @__PURE__ */ new Set([
-  "edit",
-  "multiedit",
-  "multi_edit",
-  "patch",
-  "strreplace",
-  "str_replace"
-]);
-var FILE_DELETE_TOOL_NAMES = /* @__PURE__ */ new Set(["delete"]);
-var APPLY_PATCH_TOOL_NAMES = /* @__PURE__ */ new Set(["apply_patch", "applypatch"]);
+function toolInputRecord(payload) {
+  const toolInput = payload.tool_input;
+  if (!toolInput || typeof toolInput !== "object" || Array.isArray(toolInput)) {
+    return null;
+  }
+  return toolInput;
+}
+function hasMutationFields(input) {
+  return typeof input.contents === "string" || typeof input.old_string === "string" || typeof input.new_string === "string" || typeof input.newContents === "string";
+}
+function inferToolPayloadEffect(payload, toolName) {
+  if (extractShellCommand(payload)) {
+    return "shell";
+  }
+  const input = toolInputRecord(payload);
+  if (!input) {
+    return "indeterminate";
+  }
+  if (hasMutationFields(input)) {
+    return "file_mutation";
+  }
+  if (extractPatch(payload)) {
+    return "apply_patch";
+  }
+  if (typeof input.pattern === "string" || typeof input.glob_pattern === "string") {
+    return "search_read";
+  }
+  if (typeof input.file_path === "string") {
+    return "file_read";
+  }
+  if (typeof input.path === "string" || typeof input.target_file === "string") {
+    return normalizedToolName(toolName) === "delete" ? "file_delete" : "indeterminate";
+  }
+  return "indeterminate";
+}
 function policyAuth(options) {
   if (!options.grants && options.attestation === void 0 && options.egressProxyActive === void 0) {
     return void 0;
@@ -17210,56 +17392,365 @@ function classifyFileMutationWithPolicy(params) {
     boundaryProfile: params.options.boundaryProfile ?? BOUNDARY_PROFILE_L3_L4_ONLY
   };
 }
-async function classifyToolUse(payload, repoRoot, cwd, config, options = {}) {
-  const toolName = String(payload.tool_name ?? "");
-  const toolKind = normalizedToolName(toolName);
-  const sensitivePaths = [...DEFAULT_SENSITIVE_PATHS, ...options.sensitivePaths ?? []];
-  const protectedRoots = [
-    ...options.protectedArtifactRoots ?? [],
-    ...options.controlPlaneDir ? [options.controlPlaneDir] : []
-  ];
-  if (toolKind === "shell") {
-    const command = extractShellCommand(payload);
-    if (!command) {
-      if (options.unknownLocalEffect === "deny") {
-        return {
-          verdict: "deny_pending_approval",
-          reason: "tool_shell_missing_command",
-          summary: canonicalStringify(scrubPayload(payload.tool_input ?? {}, options)),
-          fingerprint: toolFingerprint(toolName, fingerprintPayload(payload, options), repoRoot),
-          assessment: {
-            reversibility: "irreversible",
-            external: false,
-            blastRadius: "tool shell",
-            confidence: 0.85,
-            signals: ["missing_command"]
-          }
-        };
-      }
-      return {
-        verdict: "allow_flagged",
-        reason: "tool_shell_missing_command",
-        summary: canonicalStringify(scrubPayload(payload.tool_input ?? {}, options)),
-        fingerprint: toolFingerprint(toolName, fingerprintPayload(payload, options), repoRoot),
-        assessment: {
-          reversibility: "recoverable_with_cost",
-          external: false,
-          blastRadius: "tool shell",
-          confidence: 0.5,
-          signals: ["missing_command"]
-        }
-      };
-    }
-    const shellResult = await classifyShell(command, cwd, repoRoot, config, options);
-    return {
-      ...shellResult,
-      summary: command
-    };
-  }
-  if (FILE_WRITE_TOOL_NAMES.has(toolKind) || FILE_EDIT_TOOL_NAMES.has(toolKind) || FILE_DELETE_TOOL_NAMES.has(toolKind)) {
-    const filePath = extractFilePath(payload);
-    if (!filePath) {
-      if (options.unknownLocalEffect === "deny") {
+function classifyFileReadWithPolicy(params) {
+  const fingerprint = toolFingerprint(params.toolName, { path: params.filePath }, params.repoRoot);
+  const { request, decision } = evaluateFileReadPolicy(
+    {
+      hookKind: "tool",
+      toolKind: params.toolKind,
+      filePath: params.filePath,
+      resolvedPath: params.resolvedPath,
+      repoRoot: params.repoRoot,
+      cwd: params.cwd,
+      inputFingerprint: fingerprint,
+      signals: params.signals,
+      locationLabel: params.locationLabel,
+      trustedWorkspaceRoots: params.options.trustedWorkspaceRoots,
+      sensitivePaths: params.options.sensitivePaths ?? params.config.classifier.sensitivePaths
+    },
+    params.config,
+    policyAuth(params.options)
+  );
+  if (policyDecisionRequiresAsk(decision)) {
+    return {
+      verdict: "deny_pending_approval",
+      reason: policyReasonToLegacyReason(decision),
+      summary: params.filePath,
+      fingerprint,
+      assessment: {
+        reversibility: "reversible",
+        external: params.locationLabel === "outside_repo",
+        blastRadius: params.locationLabel === "outside_repo" ? "outside the repository" : "sensitive repository file",
+        confidence: 0.85,
+        signals: [...params.signals, ...decision.signals]
+      },
+      capabilityRequests: [request],
+      authorizationDecision: decision,
+      boundaryProfile: params.options.boundaryProfile ?? BOUNDARY_PROFILE_L3_L4_ONLY
+    };
+  }
+  return {
+    verdict: "allow",
+    reason: "effect.fs_read",
+    summary: params.filePath,
+    fingerprint,
+    assessment: {
+      reversibility: "reversible",
+      external: false,
+      blastRadius: "tool scope",
+      confidence: 0.88,
+      signals: [...params.signals, ...decision.signals]
+    },
+    capabilityRequests: [request],
+    authorizationDecision: decision,
+    boundaryProfile: params.options.boundaryProfile ?? BOUNDARY_PROFILE_L3_L4_ONLY
+  };
+}
+function classifyFilePathMutation(params) {
+  const {
+    toolName,
+    toolKind,
+    filePath,
+    repoRoot,
+    cwd,
+    config,
+    options,
+    sensitivePaths,
+    protectedRoots,
+    isDelete
+  } = params;
+  const signals = [];
+  const resolvedPath = path51.isAbsolute(filePath) ? filePath : path51.resolve(cwd, filePath);
+  const hitsProtectedRoot = protectedRoots.some((root) => pathWithinRoot(root, resolvedPath));
+  if (hitsProtectedRoot) {
+    signals.push("control_plane_path");
+    return classifyFileMutationWithPolicy({
+      toolName,
+      toolKind,
+      filePath,
+      resolvedPath,
+      repoRoot,
+      cwd,
+      config,
+      options,
+      signals,
+      isDelete,
+      locationLabel: "control_plane"
+    });
+  }
+  const workspaceMatch = resolveWorkspaceRootMatch(
+    repoRoot,
+    options.trustedWorkspaceRoots,
+    resolvedPath
+  );
+  if (workspaceMatch === null) {
+    signals.push("outside_repo_path");
+    return classifyFileMutationWithPolicy({
+      toolName,
+      toolKind,
+      filePath,
+      resolvedPath,
+      repoRoot,
+      cwd,
+      config,
+      options,
+      signals,
+      isDelete,
+      locationLabel: "outside_repo"
+    });
+  }
+  if (workspaceMatch.kind === "trusted") {
+    signals.push("trusted_workspace_root");
+  }
+  const trustedCwd = resolveClassifierTrustedCwd(cwd, options);
+  const workspacePrescan = mutationPrescanRequiresAsk({
+    targets: [filePath],
+    cwd,
+    repoRoot,
+    trustedCwd,
+    trustedWorkspaceRoots: options.trustedWorkspaceRoots,
+    sensitivePaths
+  });
+  if (workspacePrescan) {
+    return classifyFileMutationWithPolicy({
+      toolName,
+      toolKind,
+      filePath,
+      resolvedPath,
+      repoRoot,
+      cwd,
+      config,
+      options,
+      signals,
+      isDelete,
+      locationLabel: "sensitive_path"
+    });
+  }
+  const relativePath = workspaceMatch.relativePath;
+  if (matchesSensitivePath(relativePath, sensitivePaths)) {
+    signals.push("sensitive_path");
+    return classifyFileMutationWithPolicy({
+      toolName,
+      toolKind,
+      filePath,
+      resolvedPath,
+      repoRoot,
+      cwd,
+      config,
+      options,
+      signals,
+      isDelete,
+      locationLabel: "sensitive_path"
+    });
+  }
+  if (isDelete) {
+    if (isGitPath(resolvedPath, repoRoot)) {
+      signals.push("protected_artifact");
+      return classifyFileMutationWithPolicy({
+        toolName,
+        toolKind,
+        filePath,
+        resolvedPath,
+        repoRoot,
+        cwd,
+        config,
+        options,
+        signals,
+        isDelete: true,
+        locationLabel: "sensitive_path"
+      });
+    }
+    signals.push("file_delete");
+    return classifyFileMutationWithPolicy({
+      toolName,
+      toolKind,
+      filePath,
+      resolvedPath,
+      repoRoot,
+      cwd,
+      config,
+      options,
+      signals,
+      isDelete: true,
+      locationLabel: "repo_local"
+    });
+  }
+  signals.push("file_mutation");
+  return classifyFileMutationWithPolicy({
+    toolName,
+    toolKind,
+    filePath,
+    resolvedPath,
+    repoRoot,
+    cwd,
+    config,
+    options,
+    signals,
+    isDelete: false,
+    locationLabel: "repo_local"
+  });
+}
+function classifyFilePathRead(params) {
+  const {
+    toolName,
+    toolKind,
+    filePath,
+    repoRoot,
+    cwd,
+    config,
+    options,
+    sensitivePaths,
+    protectedRoots
+  } = params;
+  const signals = ["effect.fs_read"];
+  const resolvedPath = path51.isAbsolute(filePath) ? filePath : path51.resolve(cwd, filePath);
+  if (protectedRoots.some((root) => pathWithinRoot(root, resolvedPath))) {
+    signals.push("control_plane_path");
+    return classifyFileReadWithPolicy({
+      toolName,
+      toolKind,
+      filePath,
+      resolvedPath,
+      repoRoot,
+      cwd,
+      config,
+      options,
+      signals,
+      locationLabel: "control_plane"
+    });
+  }
+  const workspaceMatch = resolveWorkspaceRootMatch(
+    repoRoot,
+    options.trustedWorkspaceRoots,
+    resolvedPath
+  );
+  if (workspaceMatch === null) {
+    signals.push("outside_repo_path");
+    return classifyFileReadWithPolicy({
+      toolName,
+      toolKind,
+      filePath,
+      resolvedPath,
+      repoRoot,
+      cwd,
+      config,
+      options,
+      signals,
+      locationLabel: "outside_repo"
+    });
+  }
+  const relativePath = workspaceMatch.relativePath;
+  if (matchesSensitivePath(relativePath, sensitivePaths)) {
+    signals.push("sensitive_path");
+    return classifyFileReadWithPolicy({
+      toolName,
+      toolKind,
+      filePath,
+      resolvedPath,
+      repoRoot,
+      cwd,
+      config,
+      options,
+      signals,
+      locationLabel: "sensitive_path"
+    });
+  }
+  return classifyFileReadWithPolicy({
+    toolName,
+    toolKind,
+    filePath,
+    resolvedPath,
+    repoRoot,
+    cwd,
+    config,
+    options,
+    signals,
+    locationLabel: "repo_local"
+  });
+}
+function indeterminateToolResult(toolName, payload, repoRoot, options) {
+  const summary = canonicalStringify(scrubPayload(payload.tool_input ?? {}, options));
+  const fingerprint = toolFingerprint(toolName, fingerprintPayload(payload, options), repoRoot);
+  if (options.unknownLocalEffect === "deny") {
+    return {
+      verdict: "deny_pending_approval",
+      reason: "indeterminate_tool_effect",
+      summary,
+      fingerprint,
+      assessment: {
+        reversibility: "irreversible",
+        external: false,
+        blastRadius: "unknown tool action",
+        confidence: 0.5,
+        signals: ["indeterminate_tool_effect"]
+      }
+    };
+  }
+  return {
+    verdict: "allow_flagged",
+    reason: "indeterminate_tool_effect",
+    summary,
+    fingerprint,
+    assessment: {
+      reversibility: "recoverable_with_cost",
+      external: false,
+      blastRadius: "tool scope",
+      confidence: 0.5,
+      signals: ["indeterminate_tool_effect"]
+    }
+  };
+}
+async function classifyToolUse(payload, repoRoot, cwd, config, options = {}) {
+  const toolName = String(payload.tool_name ?? "");
+  const toolKind = normalizedToolName(toolName);
+  const sensitivePaths = [...DEFAULT_SENSITIVE_PATHS, ...options.sensitivePaths ?? []];
+  const protectedRoots = [
+    ...options.protectedArtifactRoots ?? [],
+    ...options.controlPlaneDir ? [options.controlPlaneDir] : []
+  ];
+  if (toolKind === "shell") {
+    const command = extractShellCommand(payload);
+    if (!command) {
+      if (options.unknownLocalEffect === "deny") {
+        return {
+          verdict: "deny_pending_approval",
+          reason: "tool_shell_missing_command",
+          summary: canonicalStringify(scrubPayload(payload.tool_input ?? {}, options)),
+          fingerprint: toolFingerprint(toolName, fingerprintPayload(payload, options), repoRoot),
+          assessment: {
+            reversibility: "irreversible",
+            external: false,
+            blastRadius: "tool shell",
+            confidence: 0.85,
+            signals: ["missing_command"]
+          }
+        };
+      }
+      return {
+        verdict: "allow_flagged",
+        reason: "tool_shell_missing_command",
+        summary: canonicalStringify(scrubPayload(payload.tool_input ?? {}, options)),
+        fingerprint: toolFingerprint(toolName, fingerprintPayload(payload, options), repoRoot),
+        assessment: {
+          reversibility: "recoverable_with_cost",
+          external: false,
+          blastRadius: "tool shell",
+          confidence: 0.5,
+          signals: ["missing_command"]
+        }
+      };
+    }
+    const shellResult = await classifyShell(command, cwd, repoRoot, config, options);
+    return {
+      ...shellResult,
+      summary: command
+    };
+  }
+  const effect = inferToolPayloadEffect(payload, toolName);
+  if (effect === "file_mutation" || effect === "file_delete") {
+    const filePath2 = extractFilePath(payload);
+    if (!filePath2) {
+      if (options.unknownLocalEffect === "deny") {
         return {
           verdict: "deny_pending_approval",
           reason: "file_mutation_missing_path",
@@ -17288,138 +17779,20 @@ async function classifyToolUse(payload, repoRoot, cwd, config, options = {}) {
         }
       };
     }
-    const signals = [];
-    const resolvedPath = path50.isAbsolute(filePath) ? filePath : path50.resolve(cwd, filePath);
-    const hitsProtectedRoot = protectedRoots.some((root) => pathWithinRoot(root, resolvedPath));
-    if (hitsProtectedRoot) {
-      signals.push("control_plane_path");
-      return classifyFileMutationWithPolicy({
-        toolName,
-        toolKind,
-        filePath,
-        resolvedPath,
-        repoRoot,
-        cwd,
-        config,
-        options,
-        signals,
-        isDelete: FILE_DELETE_TOOL_NAMES.has(toolKind),
-        locationLabel: "control_plane"
-      });
-    }
-    const workspaceMatch = resolveWorkspaceRootMatch(
-      repoRoot,
-      options.trustedWorkspaceRoots,
-      resolvedPath
-    );
-    if (workspaceMatch === null) {
-      signals.push("outside_repo_path");
-      return classifyFileMutationWithPolicy({
-        toolName,
-        toolKind,
-        filePath,
-        resolvedPath,
-        repoRoot,
-        cwd,
-        config,
-        options,
-        signals,
-        isDelete: FILE_DELETE_TOOL_NAMES.has(toolKind),
-        locationLabel: "outside_repo"
-      });
-    }
-    if (workspaceMatch.kind === "trusted") {
-      signals.push("trusted_workspace_root");
-    }
-    const trustedCwd = resolveClassifierTrustedCwd(cwd, options);
-    const workspacePrescan = mutationPrescanRequiresAsk({
-      targets: [filePath],
-      cwd,
-      repoRoot,
-      trustedCwd,
-      trustedWorkspaceRoots: options.trustedWorkspaceRoots,
-      sensitivePaths
-    });
-    if (workspacePrescan) {
-      return classifyFileMutationWithPolicy({
-        toolName,
-        toolKind,
-        filePath,
-        resolvedPath,
-        repoRoot,
-        cwd,
-        config,
-        options,
-        signals,
-        isDelete: FILE_DELETE_TOOL_NAMES.has(toolKind),
-        locationLabel: "sensitive_path"
-      });
-    }
-    const relativePath = workspaceMatch.relativePath;
-    if (matchesSensitivePath(relativePath, sensitivePaths)) {
-      signals.push("sensitive_path");
-      return classifyFileMutationWithPolicy({
-        toolName,
-        toolKind,
-        filePath,
-        resolvedPath,
-        repoRoot,
-        cwd,
-        config,
-        options,
-        signals,
-        isDelete: FILE_DELETE_TOOL_NAMES.has(toolKind),
-        locationLabel: "sensitive_path"
-      });
-    }
-    if (FILE_DELETE_TOOL_NAMES.has(toolKind)) {
-      if (isGitPath(resolvedPath, repoRoot)) {
-        signals.push("protected_artifact");
-        return classifyFileMutationWithPolicy({
-          toolName,
-          toolKind,
-          filePath,
-          resolvedPath,
-          repoRoot,
-          cwd,
-          config,
-          options,
-          signals,
-          isDelete: true,
-          locationLabel: "sensitive_path"
-        });
-      }
-      signals.push("file_delete");
-      return classifyFileMutationWithPolicy({
-        toolName,
-        toolKind,
-        filePath,
-        resolvedPath,
-        repoRoot,
-        cwd,
-        config,
-        options,
-        signals,
-        isDelete: true,
-        locationLabel: "repo_local"
-      });
-    }
-    signals.push("file_mutation");
-    return classifyFileMutationWithPolicy({
+    return classifyFilePathMutation({
       toolName,
       toolKind,
-      filePath,
-      resolvedPath,
+      filePath: filePath2,
       repoRoot,
       cwd,
       config,
       options,
-      signals,
-      isDelete: false,
-      locationLabel: "repo_local"
+      sensitivePaths,
+      protectedRoots,
+      isDelete: effect === "file_delete"
     });
   }
-  if (APPLY_PATCH_TOOL_NAMES.has(toolKind)) {
+  if (effect === "apply_patch") {
     const patch = extractPatch(payload);
     const targets = patch ? applyPatchTargets2(patch) : [];
     if (targets.length === 0) {
@@ -17457,7 +17830,7 @@ async function classifyToolUse(payload, repoRoot, cwd, config, options = {}) {
       const result = await classifyToolUse(
         {
           tool_name: target.delete ? "Delete" : "Write",
-          tool_input: { path: target.path }
+          tool_input: target.delete ? { path: target.path } : { path: target.path, contents: " " }
         },
         repoRoot,
         cwd,
@@ -17483,19 +17856,54 @@ async function classifyToolUse(payload, repoRoot, cwd, config, options = {}) {
       }
     };
   }
-  return {
-    verdict: "allow",
-    reason: "unclassified_tool",
-    summary: canonicalStringify(scrubPayload(payload.tool_input ?? {}, options)),
-    fingerprint: toolFingerprint(toolName, fingerprintPayload(payload, options), repoRoot),
-    assessment: {
-      reversibility: "reversible",
-      external: false,
-      blastRadius: "tool scope",
-      confidence: 0.5,
-      signals: ["unclassified_tool"]
+  if (effect === "file_read") {
+    const filePath2 = extractFilePath(payload);
+    if (!filePath2) {
+      return indeterminateToolResult(toolName, payload, repoRoot, options);
     }
-  };
+    return classifyFilePathRead({
+      toolName,
+      toolKind,
+      filePath: filePath2,
+      repoRoot,
+      cwd,
+      config,
+      options,
+      sensitivePaths,
+      protectedRoots
+    });
+  }
+  if (effect === "search_read") {
+    return {
+      verdict: "allow",
+      reason: "effect.search_read",
+      summary: canonicalStringify(scrubPayload(payload.tool_input ?? {}, options)),
+      fingerprint: toolFingerprint(toolName, fingerprintPayload(payload, options), repoRoot),
+      assessment: {
+        reversibility: "reversible",
+        external: false,
+        blastRadius: "tool scope",
+        confidence: 0.88,
+        signals: ["effect.search_read"]
+      }
+    };
+  }
+  const filePath = extractFilePath(payload);
+  if (filePath) {
+    return classifyFilePathMutation({
+      toolName,
+      toolKind,
+      filePath,
+      repoRoot,
+      cwd,
+      config,
+      options,
+      sensitivePaths,
+      protectedRoots,
+      isDelete: toolKind === "delete"
+    });
+  }
+  return indeterminateToolResult(toolName, payload, repoRoot, options);
 }
 
 // src/core/gate-engine.ts
@@ -17830,15 +18238,8 @@ function gateEnabledForAction(config, action) {
   if (action.kind === "subagent") {
     return config.gates.subagent;
   }
-  const toolName = action.toolName ?? String(action.payload?.tool_name ?? "");
-  if (toolName === "Shell") {
-    return config.gates.toolShell;
-  }
-  if (toolName === "Write" || toolName === "StrReplace" || toolName === "Delete") {
-    return config.gates.fileMutation;
-  }
-  if (toolName === "Task") {
-    return config.gates.subagent;
+  if (action.kind === "tool") {
+    return config.gates.fileMutation || config.gates.toolShell;
   }
   return true;
 }
@@ -17875,7 +18276,7 @@ function hashDecisionConfig(config) {
 init_fingerprint2();
 
 // src/version.ts
-var PACKAGE_VERSION = "0.9.4";
+var PACKAGE_VERSION = "0.10.1";
 
 // src/runtime-provenance.ts
 function resolveRuntimeArtifactHash(artifactHash) {
@@ -17948,56 +18349,56 @@ function capabilityRequestsBlockRecovery(requests) {
 init_fingerprint2();
 init_path_utils();
 import { randomUUID as randomUUID5 } from "node:crypto";
-import { existsSync as existsSync15 } from "node:fs";
-import { mkdir as mkdir11, readdir as readdir3, readFile as readFile13, rename as rename3, rm as rm6 } from "node:fs/promises";
-import path55 from "node:path";
+import { existsSync as existsSync16 } from "node:fs";
+import { mkdir as mkdir12, readdir as readdir3, readFile as readFile14, rename as rename4, rm as rm6 } from "node:fs/promises";
+import path56 from "node:path";
 
 // src/core/recovery/artifact-store.ts
 init_fingerprint2();
 init_path_utils();
 import { randomUUID as randomUUID4 } from "node:crypto";
-import { existsSync as existsSync13 } from "node:fs";
-import { lstat as lstat7, mkdir as mkdir10, open as open5, readdir as readdir2, readFile as readFile10, rename as rename2, rm as rm5, writeFile as writeFile7 } from "node:fs/promises";
-import path52 from "node:path";
+import { existsSync as existsSync14 } from "node:fs";
+import { lstat as lstat7, mkdir as mkdir11, open as open6, readdir as readdir2, readFile as readFile11, rename as rename3, rm as rm5, writeFile as writeFile7 } from "node:fs/promises";
+import path53 from "node:path";
 
 // src/core/recovery/snapshot-node.ts
 init_fingerprint2();
 init_path_utils();
 import { createHash as createHash12 } from "node:crypto";
-import { existsSync as existsSync12 } from "node:fs";
+import { existsSync as existsSync13 } from "node:fs";
 import {
-  chmod as chmod3,
+  chmod as chmod4,
   copyFile as copyFile2,
   lstat as lstat6,
-  mkdir as mkdir9,
-  open as open4,
-  readFile as readFile9,
+  mkdir as mkdir10,
+  open as open5,
+  readFile as readFile10,
   readlink as readlink4,
   rm as rm4,
   rmdir as rmdir2,
   symlink as symlink3,
   writeFile as writeFile6
 } from "node:fs/promises";
-import path51 from "node:path";
+import path52 from "node:path";
 var RECOVERY_UNSUPPORTED_FILE_KIND = "recovery_unsupported_file_kind";
 function validRecoveryRelativePath(relativePath) {
-  if (!relativePath || relativePath.includes("\0") || path51.isAbsolute(relativePath)) return false;
-  const normalized = path51.normalize(relativePath);
-  return normalized !== "." && normalized !== ".." && !normalized.startsWith(`..${path51.sep}`);
+  if (!relativePath || relativePath.includes("\0") || path52.isAbsolute(relativePath)) return false;
+  const normalized = path52.normalize(relativePath);
+  return normalized !== "." && normalized !== ".." && !normalized.startsWith(`..${path52.sep}`);
 }
 async function assertRecoverySafeTarget(resourceRoot, relativePath) {
   if (!validRecoveryRelativePath(relativePath)) throw new Error("recovery_path_escape");
   const root = canonicalPath(resourceRoot);
-  const target = path51.resolve(root, relativePath);
-  const relative = path51.relative(root, target);
-  if (relative === ".." || relative.startsWith(`..${path51.sep}`) || path51.isAbsolute(relative)) {
+  const target = path52.resolve(root, relativePath);
+  const relative = path52.relative(root, target);
+  if (relative === ".." || relative.startsWith(`..${path52.sep}`) || path52.isAbsolute(relative)) {
     throw new Error("recovery_path_escape");
   }
   let current = root;
-  const parentParts = path51.relative(root, path51.dirname(target)).split(path51.sep).filter(Boolean);
+  const parentParts = path52.relative(root, path52.dirname(target)).split(path52.sep).filter(Boolean);
   for (const part of parentParts) {
-    current = path51.join(current, part);
-    if (!existsSync12(current)) break;
+    current = path52.join(current, part);
+    if (!existsSync13(current)) break;
     const info = await lstat6(current);
     if (info.isSymbolicLink()) throw new Error("recovery_symlink_escape");
     if (!info.isDirectory()) break;
@@ -18005,7 +18406,7 @@ async function assertRecoverySafeTarget(resourceRoot, relativePath) {
   return target;
 }
 async function fsyncPath(filePath) {
-  const handle = await open4(filePath, "r");
+  const handle = await open5(filePath, "r");
   try {
     await handle.sync();
   } finally {
@@ -18047,13 +18448,13 @@ async function captureRecoverySnapshot(filePath, options) {
     return { kind: "directory", mode, hash: recoveryDirectoryHash(mode) };
   }
   if (!info.isFile()) throw new Error(RECOVERY_UNSUPPORTED_FILE_KIND);
-  const content = await readFile9(filePath);
+  const content = await readFile10(filePath);
   const hash = createHash12("sha256").update(content).digest("hex");
   let blob;
   if (options?.blobDir) {
-    await mkdir9(options.blobDir, { recursive: true, mode: 448 });
-    const blobPath = path51.join(options.blobDir, hash);
-    if (!existsSync12(blobPath)) {
+    await mkdir10(options.blobDir, { recursive: true, mode: 448 });
+    const blobPath = path52.join(options.blobDir, hash);
+    if (!existsSync13(blobPath)) {
       await writeFile6(blobPath, content, { mode: 384 });
       await fsyncPath(blobPath);
     }
@@ -18107,7 +18508,7 @@ async function validateRecoverySnapshot(params) {
   if (record.blob !== `blobs/${record.hash}`) throw new Error(params.corruptReason);
   let content;
   try {
-    content = await readFile9(path51.join(params.artifactDir, record.blob));
+    content = await readFile10(path52.join(params.artifactDir, record.blob));
   } catch {
     throw new Error(params.corruptReason);
   }
@@ -18135,16 +18536,16 @@ var RECOVERY_STATES = /* @__PURE__ */ new Set([
 ]);
 var STAGING_STALE_MS = 5 * 6e4;
 function checkpointsRoot(stateDir) {
-  return path52.join(stateDir, "recovery", "checkpoints");
+  return path53.join(stateDir, "recovery", "checkpoints");
 }
 function checkpointDir(stateDir, checkpointId) {
   if (!/^cp_[a-f0-9]{24}$/.test(checkpointId)) {
     throw new Error("invalid_recovery_checkpoint_id");
   }
-  return path52.join(checkpointsRoot(stateDir), checkpointId);
+  return path53.join(checkpointsRoot(stateDir), checkpointId);
 }
 async function fsyncPath2(filePath) {
-  const handle = await open5(filePath, "r");
+  const handle = await open6(filePath, "r");
   try {
     await handle.sync();
   } finally {
@@ -18152,13 +18553,13 @@ async function fsyncPath2(filePath) {
   }
 }
 async function atomicWriteJson(filePath, value) {
-  await mkdir10(path52.dirname(filePath), { recursive: true, mode: 448 });
+  await mkdir11(path53.dirname(filePath), { recursive: true, mode: 448 });
   const temporary = `${filePath}.tmp-${randomUUID4()}`;
   await writeFile7(temporary, `${JSON.stringify(value, null, 2)}
 `, { mode: 384 });
   await fsyncPath2(temporary);
-  await rename2(temporary, filePath);
-  await fsyncPath2(path52.dirname(filePath));
+  await rename3(temporary, filePath);
+  await fsyncPath2(path53.dirname(filePath));
 }
 async function writeRecoveryState(artifactDir, state, manifestHash, detail) {
   const value = {
@@ -18168,13 +18569,13 @@ async function writeRecoveryState(artifactDir, state, manifestHash, detail) {
     manifestHash,
     ...detail ? { detail } : {}
   };
-  await atomicWriteJson(path52.join(artifactDir, "state.json"), value);
+  await atomicWriteJson(path53.join(artifactDir, "state.json"), value);
 }
 async function directorySize(root) {
-  if (!existsSync13(root)) return 0;
+  if (!existsSync14(root)) return 0;
   let total = 0;
   for (const entry of await readdir2(root, { withFileTypes: true })) {
-    const entryPath = path52.join(root, entry.name);
+    const entryPath = path53.join(root, entry.name);
     if (entry.isDirectory()) total += await directorySize(entryPath);
     else total += (await lstat7(entryPath)).size;
   }
@@ -18219,9 +18620,9 @@ async function readRecoveryArtifact(stateDir, checkpointId) {
   let rawManifest;
   let state;
   try {
-    rawManifest = JSON.parse(await readFile10(path52.join(artifactDir, "manifest.json"), "utf8"));
+    rawManifest = JSON.parse(await readFile11(path53.join(artifactDir, "manifest.json"), "utf8"));
     state = JSON.parse(
-      await readFile10(path52.join(artifactDir, "state.json"), "utf8")
+      await readFile11(path53.join(artifactDir, "state.json"), "utf8")
     );
   } catch {
     throw new Error(RECOVERY_CHECKPOINT_CORRUPT);
@@ -18237,10 +18638,10 @@ async function readRecoveryArtifact(stateDir, checkpointId) {
   }
   const entryPaths = /* @__PURE__ */ new Set();
   for (const entry of manifest.entries) {
-    if (!entry || typeof entry !== "object" || Array.isArray(entry) || Object.keys(entry).length !== 3 || !Object.keys(entry).every((key) => ["path", "before", "after"].includes(key)) || typeof entry.path !== "string" || !("before" in entry) || !("after" in entry) || !validRecoveryRelativePath(entry.path) || entryPaths.has(path52.normalize(entry.path))) {
+    if (!entry || typeof entry !== "object" || Array.isArray(entry) || Object.keys(entry).length !== 3 || !Object.keys(entry).every((key) => ["path", "before", "after"].includes(key)) || typeof entry.path !== "string" || !("before" in entry) || !("after" in entry) || !validRecoveryRelativePath(entry.path) || entryPaths.has(path53.normalize(entry.path))) {
       throw new Error(RECOVERY_CHECKPOINT_CORRUPT);
     }
-    entryPaths.add(path52.normalize(entry.path));
+    entryPaths.add(path53.normalize(entry.path));
     for (const [side, snapshot] of [
       ["before", entry.before],
       ["after", entry.after]
@@ -18254,9 +18655,9 @@ async function readRecoveryArtifact(stateDir, checkpointId) {
       });
     }
   }
-  const receiptPath = path52.join(artifactDir, "receipt.json");
+  const receiptPath = path53.join(artifactDir, "receipt.json");
   let receipt;
-  if (["applied", "restoring", "restored", "conflict"].includes(state.state) || existsSync13(receiptPath)) {
+  if (["applied", "restoring", "restored", "conflict"].includes(state.state) || existsSync14(receiptPath)) {
     receipt = await readAndValidateRecoveryReceipt(artifactDir, manifest, manifestHash);
   }
   return { artifactDir, manifest, state, manifestHash, ...receipt ? { receipt } : {} };
@@ -18264,7 +18665,7 @@ async function readRecoveryArtifact(stateDir, checkpointId) {
 async function readAndValidateRecoveryReceipt(artifactDir, manifest, manifestHash) {
   let rawReceipt;
   try {
-    rawReceipt = JSON.parse(await readFile10(path52.join(artifactDir, "receipt.json"), "utf8"));
+    rawReceipt = JSON.parse(await readFile11(path53.join(artifactDir, "receipt.json"), "utf8"));
   } catch {
     throw new Error(RECOVERY_CHECKPOINT_CORRUPT);
   }
@@ -18287,8 +18688,8 @@ async function readAndValidateRecoveryReceipt(artifactDir, manifest, manifestHas
   return receipt;
 }
 async function ensureRecoveryReceipt(artifactDir, manifest, manifestHash) {
-  const receiptPath = path52.join(artifactDir, "receipt.json");
-  if (existsSync13(receiptPath)) {
+  const receiptPath = path53.join(artifactDir, "receipt.json");
+  if (existsSync14(receiptPath)) {
     return readAndValidateRecoveryReceipt(artifactDir, manifest, manifestHash);
   }
   const receipt = {
@@ -18305,14 +18706,14 @@ async function ensureRecoveryReceipt(artifactDir, manifest, manifestHash) {
 }
 async function checkpointIds(stateDir) {
   const root = checkpointsRoot(stateDir);
-  if (!existsSync13(root)) return [];
+  if (!existsSync14(root)) return [];
   return (await readdir2(root, { withFileTypes: true })).filter((entry) => entry.isDirectory() && /^cp_[a-f0-9]{24}$/.test(entry.name)).map((entry) => entry.name);
 }
 async function artifactRepoRoot(stateDir, checkpointId) {
   const artifactDir = checkpointDir(stateDir, checkpointId);
   try {
     const manifest = JSON.parse(
-      await readFile10(path52.join(artifactDir, "manifest.json"), "utf8")
+      await readFile11(path53.join(artifactDir, "manifest.json"), "utf8")
     );
     if (typeof manifest.repoRoot === "string" && manifest.repoRoot) {
       return canonicalPath(manifest.repoRoot);
@@ -18320,7 +18721,7 @@ async function artifactRepoRoot(stateDir, checkpointId) {
   } catch {
   }
   try {
-    const owner = JSON.parse(await readFile10(path52.join(artifactDir, "owner.json"), "utf8"));
+    const owner = JSON.parse(await readFile11(path53.join(artifactDir, "owner.json"), "utf8"));
     return typeof owner.repoRoot === "string" && owner.repoRoot ? canonicalPath(owner.repoRoot) : null;
   } catch {
     return null;
@@ -18336,14 +18737,14 @@ async function checkpointIdsForRepo(stateDir, repoRoot) {
 }
 async function cleanupOrphanedStaging(stateDir) {
   const root = checkpointsRoot(stateDir);
-  if (!existsSync13(root)) return;
+  if (!existsSync14(root)) return;
   const now = Date.now();
   for (const entry of await readdir2(root, { withFileTypes: true })) {
     if (!entry.isDirectory() || !/^\.tmp-cp_[a-f0-9]{24}$/.test(entry.name)) continue;
-    const stagingPath = path52.join(root, entry.name);
+    const stagingPath = path53.join(root, entry.name);
     let stale = false;
     try {
-      const owner = JSON.parse(await readFile10(path52.join(stagingPath, "owner.json"), "utf8"));
+      const owner = JSON.parse(await readFile11(path53.join(stagingPath, "owner.json"), "utf8"));
       const pid = typeof owner.pid === "number" ? owner.pid : Number.NaN;
       const createdAt = typeof owner.createdAt === "string" ? Date.parse(owner.createdAt) : NaN;
       let alive = false;
@@ -18383,9 +18784,9 @@ async function markRecoveryCheckpointApplied(stateDir, checkpoint) {
 
 // src/core/recovery/reconcile.ts
 init_fingerprint2();
-import { existsSync as existsSync14 } from "node:fs";
-import { readFile as readFile11 } from "node:fs/promises";
-import path53 from "node:path";
+import { existsSync as existsSync15 } from "node:fs";
+import { readFile as readFile12 } from "node:fs/promises";
+import path54 from "node:path";
 async function matchRecoverySide(resourceRoot, entries, side) {
   for (const entry of entries) {
     const target = await assertRecoverySafeTarget(resourceRoot, entry.path);
@@ -18399,9 +18800,9 @@ async function reconcileRecoveryCheckpoint(stateDir, checkpointId) {
     loaded = await readRecoveryArtifact(stateDir, checkpointId);
   } catch {
     const artifactDir = checkpointDir(stateDir, checkpointId);
-    if (existsSync14(artifactDir)) {
-      const manifestPath = path53.join(artifactDir, "manifest.json");
-      const hash = existsSync14(manifestPath) ? hashValue(await readFile11(manifestPath, "utf8")) : "unavailable";
+    if (existsSync15(artifactDir)) {
+      const manifestPath = path54.join(artifactDir, "manifest.json");
+      const hash = existsSync15(manifestPath) ? hashValue(await readFile12(manifestPath, "utf8")) : "unavailable";
       await writeRecoveryState(artifactDir, "corrupt", hash, RECOVERY_CHECKPOINT_CORRUPT);
     }
     return "corrupt";
@@ -18436,8 +18837,8 @@ async function reconcileRecoveryCheckpoint(stateDir, checkpointId) {
 
 // src/core/recovery/resource-identity.ts
 init_fingerprint2();
-import { lstat as lstat8, readFile as readFile12, realpath as realpath3 } from "node:fs/promises";
-import path54 from "node:path";
+import { lstat as lstat8, readFile as readFile13, realpath as realpath3 } from "node:fs/promises";
+import path55 from "node:path";
 async function currentRecoveryResourceIdentity(resourceRoot, resourceKind) {
   const resolvedRoot = await realpath3(resourceRoot);
   if (resourceKind === "directory") {
@@ -18445,13 +18846,13 @@ async function currentRecoveryResourceIdentity(resourceRoot, resourceKind) {
     if (!rootInfo.isDirectory()) throw new Error("recovery_repo_identity_unavailable");
     return hashValue(`${resolvedRoot}\0${rootInfo.dev}:${rootInfo.ino}:${rootInfo.birthtimeMs}`);
   }
-  const dotGit = path54.join(resolvedRoot, ".git");
+  const dotGit = path55.join(resolvedRoot, ".git");
   const gitInfo = await lstat8(dotGit);
   let gitMetadataPath = dotGit;
   if (gitInfo.isFile()) {
-    const marker = (await readFile12(dotGit, "utf8")).trim();
+    const marker = (await readFile13(dotGit, "utf8")).trim();
     if (!marker.startsWith("gitdir:")) throw new Error("recovery_repo_identity_unavailable");
-    gitMetadataPath = path54.resolve(resolvedRoot, marker.slice("gitdir:".length).trim());
+    gitMetadataPath = path55.resolve(resolvedRoot, marker.slice("gitdir:".length).trim());
   } else if (!gitInfo.isDirectory()) {
     throw new Error("recovery_repo_identity_unavailable");
   }
@@ -18516,7 +18917,7 @@ async function garbageCollect(stateDir, config, repoRoot) {
 async function prepareRecoveryCheckpoint(params) {
   const backend = params.backend ?? "git_worktree";
   const resourceKind = await resolveRecoveryResourceKind(backend, params.repoRoot);
-  await mkdir11(checkpointsRoot(params.stateDir), { recursive: true, mode: 448 });
+  await mkdir12(checkpointsRoot(params.stateDir), { recursive: true, mode: 448 });
   await cleanupOrphanedStaging(params.stateDir);
   await garbageCollect(params.stateDir, params.config, params.repoRoot);
   const existing = await checkpointIdsForRepo(params.stateDir, params.repoRoot);
@@ -18524,16 +18925,16 @@ async function prepareRecoveryCheckpoint(params) {
     throw new Error(RECOVERY_CHECKPOINT_QUOTA);
   }
   const checkpointId = `cp_${randomUUID5().replaceAll("-", "").slice(0, 24)}`;
-  const temporary = path55.join(checkpointsRoot(params.stateDir), `.tmp-${checkpointId}`);
+  const temporary = path56.join(checkpointsRoot(params.stateDir), `.tmp-${checkpointId}`);
   const finalDir = checkpointDir(params.stateDir, checkpointId);
-  await mkdir11(temporary, { recursive: true, mode: 448 });
-  await atomicWriteJson(path55.join(temporary, "owner.json"), {
+  await mkdir12(temporary, { recursive: true, mode: 448 });
+  await atomicWriteJson(path56.join(temporary, "owner.json"), {
     version: 1,
     pid: process.pid,
     createdAt: (/* @__PURE__ */ new Date()).toISOString(),
     repoRoot: canonicalPath(params.repoRoot)
   });
-  await mkdir11(path55.join(temporary, "blobs"), { recursive: true, mode: 448 });
+  await mkdir12(path56.join(temporary, "blobs"), { recursive: true, mode: 448 });
   try {
     const entries = [];
     const protectedRoots = (params.protectedRoots ?? []).map(canonicalPath);
@@ -18542,8 +18943,8 @@ async function prepareRecoveryCheckpoint(params) {
     )) {
       const target = await assertRecoverySafeTarget(params.repoRoot, change.relativePath);
       if (protectedRoots.some((root) => {
-        const relative = path55.relative(root, target);
-        return relative === "" || relative !== ".." && !relative.startsWith(`..${path55.sep}`) && !path55.isAbsolute(relative);
+        const relative = path56.relative(root, target);
+        return relative === "" || relative !== ".." && !relative.startsWith(`..${path56.sep}`) && !path56.isAbsolute(relative);
       })) {
         throw new Error("recovery_protected_path");
       }
@@ -18555,7 +18956,7 @@ async function prepareRecoveryCheckpoint(params) {
       entries.push({
         path: change.relativePath,
         before: await captureRecoverySnapshot(baseline, {
-          blobDir: path55.join(temporary, "blobs")
+          blobDir: path56.join(temporary, "blobs")
         }),
         after: withoutRecoveryBlob(await captureRecoverySnapshot(source))
       });
@@ -18592,12 +18993,12 @@ async function prepareRecoveryCheckpoint(params) {
       entries
     };
     const manifestHash = hashValue(canonicalStringify(manifest));
-    await atomicWriteJson(path55.join(temporary, "manifest.json"), manifest);
+    await atomicWriteJson(path56.join(temporary, "manifest.json"), manifest);
     await writeRecoveryState(temporary, "prepared", manifestHash);
     await fsyncPath2(temporary);
     const projectedBytes = await recoveryCheckpointStorageBytes(params.stateDir, params.repoRoot);
     if (projectedBytes > params.config.maxBytes) throw new Error(RECOVERY_CHECKPOINT_QUOTA);
-    await rename3(temporary, finalDir);
+    await rename4(temporary, finalDir);
     await fsyncPath2(checkpointsRoot(params.stateDir));
     return {
       checkpointId,
@@ -18635,7 +19036,7 @@ async function listRecoveryCheckpoints(stateDir, repoRoot) {
       } catch {
         try {
           const raw = JSON.parse(
-            await readFile13(path55.join(checkpointDir(stateDir, id), "manifest.json"), "utf8")
+            await readFile14(path56.join(checkpointDir(stateDir, id), "manifest.json"), "utf8")
           );
           rootFromArtifact = typeof raw.repoRoot === "string" && raw.repoRoot ? raw.repoRoot : void 0;
         } catch {
@@ -18669,7 +19070,7 @@ async function listRecoveryCheckpoints(stateDir, repoRoot) {
     } catch {
       try {
         const manifest = JSON.parse(
-          await readFile13(path55.join(checkpointDir(stateDir, id), "manifest.json"), "utf8")
+          await readFile14(path56.join(checkpointDir(stateDir, id), "manifest.json"), "utf8")
         );
         if (manifest.checkpointId !== id || ![1, 2].includes(manifest.version)) continue;
         if (repoRoot && canonicalPath(manifest.repoRoot) !== canonicalPath(repoRoot)) continue;
@@ -18694,12 +19095,12 @@ async function listRecoveryCheckpoints(stateDir, repoRoot) {
 async function recoveryCheckpointStorageBytes(stateDir, repoRoot) {
   const root = checkpointsRoot(stateDir);
   if (!repoRoot) return directorySize(root);
-  if (!existsSync15(root)) return 0;
+  if (!existsSync16(root)) return 0;
   const expected = canonicalPath(repoRoot);
   let total = 0;
   for (const entry of await readdir3(root, { withFileTypes: true })) {
     if (!entry.isDirectory()) continue;
-    const entryPath = path55.join(root, entry.name);
+    const entryPath = path56.join(root, entry.name);
     if (/^cp_[a-f0-9]{24}$/.test(entry.name)) {
       if (await artifactRepoRoot(stateDir, entry.name) === expected) {
         total += await directorySize(entryPath);
@@ -18708,7 +19109,7 @@ async function recoveryCheckpointStorageBytes(stateDir, repoRoot) {
     }
     if (/^\.tmp-cp_[a-f0-9]{24}$/.test(entry.name)) {
       try {
-        const owner = JSON.parse(await readFile13(path55.join(entryPath, "owner.json"), "utf8"));
+        const owner = JSON.parse(await readFile14(path56.join(entryPath, "owner.json"), "utf8"));
         if (typeof owner.repoRoot === "string" && canonicalPath(owner.repoRoot) === expected) {
           total += await directorySize(entryPath);
         }
@@ -18750,16 +19151,16 @@ function recoveryFailClosedResult(predicted, reason, signals = []) {
 init_scrub();
 
 // src/core/transactional/file-checkpoint-backend.ts
-import { cp, lstat as lstat11, mkdir as mkdir13, mkdtemp as mkdtemp5, readdir as readdir6, rm as rm9, writeFile as writeFile10 } from "node:fs/promises";
+import { cp, lstat as lstat11, mkdir as mkdir14, mkdtemp as mkdtemp5, readdir as readdir6, rm as rm9, writeFile as writeFile10 } from "node:fs/promises";
 import os5 from "node:os";
-import path59 from "node:path";
+import path60 from "node:path";
 
 // src/core/transactional/file-checkpoint-git.ts
 init_path_utils();
 import { spawn as spawn8 } from "node:child_process";
 import { createHash as createHash13 } from "node:crypto";
-import { copyFile as copyFile3, lstat as lstat9, readdir as readdir4, readFile as readFile14 } from "node:fs/promises";
-import path56 from "node:path";
+import { copyFile as copyFile3, lstat as lstat9, readdir as readdir4, readFile as readFile15 } from "node:fs/promises";
+import path57 from "node:path";
 var FILE_CHECKPOINT_GIT_METADATA_CHANGED = "file_checkpoint_git_metadata_changed";
 var FILE_CHECKPOINT_SOURCE_CHANGED = "file_checkpoint_source_changed";
 var FILE_CHECKPOINT_CWD_OUTSIDE_ROOT = "file_checkpoint_cwd_outside_root";
@@ -18793,7 +19194,7 @@ function rethrowStableFileCheckpointError(error) {
 }
 async function rootGitMetadataPresent(repoRoot) {
   try {
-    await lstat9(path56.join(repoRoot, ".git"));
+    await lstat9(path57.join(repoRoot, ".git"));
     return true;
   } catch {
     return false;
@@ -18842,10 +19243,10 @@ function execGit2(repoRoot, args) {
 }
 async function resolveGitPath(repoRoot, gitPath) {
   const trimmed = gitPath.trim();
-  if (path56.isAbsolute(trimmed)) {
+  if (path57.isAbsolute(trimmed)) {
     return trimmed;
   }
-  return path56.join(repoRoot, trimmed);
+  return path57.join(repoRoot, trimmed);
 }
 async function cloneBareWorktreeCopy(sourceRoot, destinationRoot) {
   await execGit2(sourceRoot, [
@@ -18887,7 +19288,7 @@ async function copyGitIndexState(sourceRoot, destinationRoot) {
     destinationRoot,
     await execGit2(destinationRoot, ["rev-parse", "--git-dir"])
   );
-  const destinationShared = path56.join(destinationGitDir, path56.basename(sourceShared));
+  const destinationShared = path57.join(destinationGitDir, path57.basename(sourceShared));
   try {
     await copyFile3(sourceShared, destinationShared);
   } catch (error) {
@@ -18896,14 +19297,14 @@ async function copyGitIndexState(sourceRoot, destinationRoot) {
 }
 async function readGitFile(gitDir, relativePath) {
   try {
-    return await readFile14(path56.join(gitDir, relativePath));
+    return await readFile15(path57.join(gitDir, relativePath));
   } catch {
     return null;
   }
 }
 async function readAbsoluteGitFile(absolutePath) {
   try {
-    return await readFile14(absolutePath);
+    return await readFile15(absolutePath);
   } catch {
     return null;
   }
@@ -18920,8 +19321,8 @@ async function hashResolvedGitPath(repoRoot, gitDir, gitPath, hash) {
       repoRoot,
       await execGit2(repoRoot, ["rev-parse", "--git-path", gitPath])
     );
-    const relative = path56.resolve(resolved).startsWith(path56.resolve(gitDir)) ? path56.relative(gitDir, resolved) : resolved;
-    const content = typeof relative === "string" && !relative.startsWith("..") && !path56.isAbsolute(relative) ? await readGitFile(gitDir, relative) : await readAbsoluteGitFile(resolved);
+    const relative = path57.resolve(resolved).startsWith(path57.resolve(gitDir)) ? path57.relative(gitDir, resolved) : resolved;
+    const content = typeof relative === "string" && !relative.startsWith("..") && !path57.isAbsolute(relative) ? await readGitFile(gitDir, relative) : await readAbsoluteGitFile(resolved);
     if (content !== null) {
       hashGitFileContent(hash, gitPath, content);
     }
@@ -18931,13 +19332,13 @@ async function hashResolvedGitPath(repoRoot, gitDir, gitPath, hash) {
 async function hashGitTree(gitDir, relativeDir, hash) {
   let names;
   try {
-    names = await readdir4(path56.join(gitDir, relativeDir));
+    names = await readdir4(path57.join(gitDir, relativeDir));
   } catch {
     return;
   }
   for (const name of names.sort()) {
-    const relativePath = relativeDir ? path56.join(relativeDir, name) : name;
-    const absolutePath = path56.join(gitDir, relativePath);
+    const relativePath = relativeDir ? path57.join(relativeDir, name) : name;
+    const absolutePath = path57.join(gitDir, relativePath);
     let childNames = null;
     try {
       childNames = await readdir4(absolutePath);
@@ -18959,7 +19360,7 @@ async function hashGitTree(gitDir, relativeDir, hash) {
 }
 async function computeGitMetadataFingerprint(repoRoot) {
   const gitDirRel = (await execGit2(repoRoot, ["rev-parse", "--git-dir"])).trim();
-  const gitDir = path56.isAbsolute(gitDirRel) ? gitDirRel : path56.join(repoRoot, gitDirRel);
+  const gitDir = path57.isAbsolute(gitDirRel) ? gitDirRel : path57.join(repoRoot, gitDirRel);
   const hash = createHash13("sha256");
   for (const file of [
     "HEAD",
@@ -18982,8 +19383,8 @@ async function computeGitMetadataFingerprint(repoRoot) {
     const sharedIndex = (await execGit2(repoRoot, ["rev-parse", "--shared-index-path"])).trim();
     if (sharedIndex) {
       const resolved = await resolveGitPath(repoRoot, sharedIndex);
-      const relative = path56.relative(gitDir, resolved);
-      const content = relative && !relative.startsWith("..") && !path56.isAbsolute(relative) ? await readGitFile(gitDir, relative) : await readAbsoluteGitFile(resolved);
+      const relative = path57.relative(gitDir, resolved);
+      const content = relative && !relative.startsWith("..") && !path57.isAbsolute(relative) ? await readGitFile(gitDir, relative) : await readAbsoluteGitFile(resolved);
       if (content !== null) {
         hashGitFileContent(hash, "shared-index", content);
       }
@@ -18994,7 +19395,7 @@ async function computeGitMetadataFingerprint(repoRoot) {
     await hashResolvedGitPath(repoRoot, gitDir, gitPath, hash);
   }
   try {
-    const rootGitPath = path56.join(repoRoot, ".git");
+    const rootGitPath = path57.join(repoRoot, ".git");
     const rootGitInfo = await lstat9(rootGitPath);
     if (rootGitInfo.isFile()) {
       const content = await readAbsoluteGitFile(rootGitPath);
@@ -19010,14 +19411,14 @@ async function computeGitMetadataFingerprint(repoRoot) {
 function resolveExecutionCwdRelative(resourceRoot, cwd) {
   const resolvedCwd = canonicalPath(cwd);
   const resourceCanonical = canonicalPath(resourceRoot);
-  const relative = path56.relative(resourceCanonical, resolvedCwd);
+  const relative = path57.relative(resourceCanonical, resolvedCwd);
   if (relative === "" || relative === ".") {
     return "";
   }
-  if (relative.startsWith("..") || path56.isAbsolute(relative)) {
+  if (relative.startsWith("..") || path57.isAbsolute(relative)) {
     throw new Error(FILE_CHECKPOINT_CWD_OUTSIDE_ROOT);
   }
-  return relative.split(path56.sep).join("/");
+  return relative.split(path57.sep).join("/");
 }
 
 // src/core/transactional/file-checkpoint-isolation.ts
@@ -19038,8 +19439,8 @@ function fileCheckpointIsolationReason(context) {
 }
 
 // src/core/transactional/file-checkpoint-staging.ts
-import { readdir as readdir5, readFile as readFile15, rm as rm7, writeFile as writeFile8 } from "node:fs/promises";
-import path57 from "node:path";
+import { readdir as readdir5, readFile as readFile16, rm as rm7, writeFile as writeFile8 } from "node:fs/promises";
+import path58 from "node:path";
 function isOwnerProcessAlive(pid) {
   try {
     process.kill(pid, 0);
@@ -19049,12 +19450,12 @@ function isOwnerProcessAlive(pid) {
   }
 }
 async function writeOwnerMarker(stagingRoot, marker) {
-  await writeFile8(path57.join(stagingRoot, "owner.json"), `${JSON.stringify(marker)}
+  await writeFile8(path58.join(stagingRoot, "owner.json"), `${JSON.stringify(marker)}
 `, "utf8");
 }
 async function readOwnerMarker(stagingRoot) {
   try {
-    const raw = await readFile15(path57.join(stagingRoot, "owner.json"), "utf8");
+    const raw = await readFile16(path58.join(stagingRoot, "owner.json"), "utf8");
     return JSON.parse(raw.trim());
   } catch {
     return null;
@@ -19072,7 +19473,7 @@ async function collectDeadOwnerStaging(parentDir) {
     if (!name.startsWith("belay-file-checkpoint-")) {
       continue;
     }
-    const stagingRoot = path57.join(parentDir, name);
+    const stagingRoot = path58.join(parentDir, name);
     const marker = await readOwnerMarker(stagingRoot);
     if (!marker) {
       dead.push(stagingRoot);
@@ -19095,7 +19496,7 @@ import { constants as fsConstants2 } from "node:fs";
 import {
   copyFile as copyFile4,
   lstat as lstat10,
-  mkdir as mkdir12,
+  mkdir as mkdir13,
   mkdtemp as mkdtemp4,
   readlink as readlink5,
   rm as rm8,
@@ -19104,17 +19505,17 @@ import {
   writeFile as writeFile9
 } from "node:fs/promises";
 import os4 from "node:os";
-import path58 from "node:path";
+import path59 from "node:path";
 var FILE_CHECKPOINT_COPY_FAILED = "file_checkpoint_copy_failed";
 async function chmodSafe2(target, mode) {
   try {
-    const { chmod: chmod4 } = await import("node:fs/promises");
-    await chmod4(target, mode & 511);
+    const { chmod: chmod5 } = await import("node:fs/promises");
+    await chmod5(target, mode & 511);
   } catch {
   }
 }
 async function copyRegularFile(sourcePath, destinationPath, mode, strategy) {
-  await mkdir12(path58.dirname(destinationPath), { recursive: true });
+  await mkdir13(path59.dirname(destinationPath), { recursive: true });
   if (strategy === "clonefile" && fsConstants2.COPYFILE_FICLONE !== void 0) {
     try {
       await copyFile4(sourcePath, destinationPath, fsConstants2.COPYFILE_FICLONE);
@@ -19136,11 +19537,11 @@ async function copyNode(sourceRoot, destinationRoot, relativePath, strategy) {
   const info = await lstat10(sourcePath);
   await rm8(destinationPath, { force: true, recursive: false });
   if (info.isDirectory() && !info.isSymbolicLink()) {
-    await mkdir12(destinationPath, { recursive: true, mode: info.mode & 511 });
+    await mkdir13(destinationPath, { recursive: true, mode: info.mode & 511 });
     return strategy;
   }
   if (info.isSymbolicLink()) {
-    await mkdir12(path58.dirname(destinationPath), { recursive: true });
+    await mkdir13(path59.dirname(destinationPath), { recursive: true });
     await symlink4(await readlink5(sourcePath), destinationPath);
     return strategy;
   }
@@ -19196,9 +19597,9 @@ async function mapWithConcurrency(items, concurrency, worker) {
 async function probeFileCloneStrategy() {
   let tempDir = null;
   try {
-    tempDir = await mkdtemp4(path58.join(os4.tmpdir(), "belay-clone-probe-"));
-    const source = path58.join(tempDir, "source.txt");
-    const destination = path58.join(tempDir, "dest.txt");
+    tempDir = await mkdtemp4(path59.join(os4.tmpdir(), "belay-clone-probe-"));
+    const source = path59.join(tempDir, "source.txt");
+    const destination = path59.join(tempDir, "dest.txt");
     await writeFile9(source, "probe\n");
     if (fsConstants2.COPYFILE_FICLONE_FORCE !== void 0) {
       try {
@@ -19351,11 +19752,11 @@ async function protectedRootState(root) {
   return `directory:${node.hash}:${index.treeHash}`;
 }
 function executionProtectedRoot(resourceRoot, executionRoot, protectedRoot) {
-  const relative = path59.relative(path59.resolve(resourceRoot), path59.resolve(protectedRoot));
-  if (relative === "" || relative.startsWith("..") || path59.isAbsolute(relative)) {
+  const relative = path60.relative(path60.resolve(resourceRoot), path60.resolve(protectedRoot));
+  if (relative === "" || relative.startsWith("..") || path60.isAbsolute(relative)) {
     return null;
   }
-  return path59.join(executionRoot, relative);
+  return path60.join(executionRoot, relative);
 }
 async function captureProtectedRootStates(resourceRoot, executionRoot, protectedRoots) {
   const states = /* @__PURE__ */ new Map();
@@ -19380,15 +19781,15 @@ async function directoryByteSize(root, deadlineMs) {
   }
   let total = 0;
   for (const name of await readdir6(root)) {
-    total += await directoryByteSize(path59.join(root, name), deadlineMs);
+    total += await directoryByteSize(path60.join(root, name), deadlineMs);
   }
   return total;
 }
 async function copyGitMetadataDirectory(sourceRoot, destinationRoot) {
   const gitDirRel = (await execGit2(sourceRoot, ["rev-parse", "--git-dir"])).trim();
-  const sourceGitDir = path59.isAbsolute(gitDirRel) ? gitDirRel : path59.join(sourceRoot, gitDirRel);
-  const relativeGitDir = path59.relative(path59.resolve(sourceRoot), path59.resolve(sourceGitDir));
-  const destinationGitDir = relativeGitDir && !relativeGitDir.startsWith("..") ? path59.join(destinationRoot, relativeGitDir) : path59.join(destinationRoot, ".git");
+  const sourceGitDir = path60.isAbsolute(gitDirRel) ? gitDirRel : path60.join(sourceRoot, gitDirRel);
+  const relativeGitDir = path60.relative(path60.resolve(sourceRoot), path60.resolve(sourceGitDir));
+  const destinationGitDir = relativeGitDir && !relativeGitDir.startsWith("..") ? path60.join(destinationRoot, relativeGitDir) : path60.join(destinationRoot, ".git");
   await cp(sourceGitDir, destinationGitDir, { recursive: true, force: true });
 }
 async function prepareDirtyGitSnapshot(context) {
@@ -19397,7 +19798,7 @@ async function prepareDirtyGitSnapshot(context) {
   const quotas = context.fileCheckpoint;
   const deadlineMs = Date.now() + quotas.prepareTimeoutMs;
   await removeDeadOwnerStaging(os5.tmpdir());
-  const stagingRoot = await mkdtemp5(path59.join(os5.tmpdir(), "belay-file-checkpoint-"));
+  const stagingRoot = await mkdtemp5(path60.join(os5.tmpdir(), "belay-file-checkpoint-"));
   await writeOwnerMarker(stagingRoot, {
     version: 1,
     pid: process.pid,
@@ -19405,8 +19806,8 @@ async function prepareDirtyGitSnapshot(context) {
     resourceRoot: context.repoRoot,
     backend: "file_checkpoint"
   });
-  const baselineRoot = path59.join(stagingRoot, "baseline");
-  const executionRoot = path59.join(stagingRoot, "execution");
+  const baselineRoot = path60.join(stagingRoot, "baseline");
+  const executionRoot = path60.join(stagingRoot, "execution");
   try {
     resolveExecutionCwdRelative(context.repoRoot, context.cwd);
     const sourceGitMetadataFingerprint = await computeGitMetadataFingerprint(context.repoRoot);
@@ -19440,7 +19841,7 @@ async function prepareDirtyGitSnapshot(context) {
       throw new Error(FILE_CHECKPOINT_SOURCE_CHANGED);
     }
     await writeFile10(
-      path59.join(stagingRoot, "baseline-index.json"),
+      path60.join(stagingRoot, "baseline-index.json"),
       `${JSON.stringify(baselineIndex)}
 `,
       "utf8"
@@ -19490,7 +19891,7 @@ async function prepareNonGitSnapshot(context) {
   const quotas = context.fileCheckpoint;
   const deadlineMs = Date.now() + quotas.prepareTimeoutMs;
   await removeDeadOwnerStaging(os5.tmpdir());
-  const stagingRoot = await mkdtemp5(path59.join(os5.tmpdir(), "belay-file-checkpoint-"));
+  const stagingRoot = await mkdtemp5(path60.join(os5.tmpdir(), "belay-file-checkpoint-"));
   await writeOwnerMarker(stagingRoot, {
     version: 1,
     pid: process.pid,
@@ -19498,8 +19899,8 @@ async function prepareNonGitSnapshot(context) {
     resourceRoot: context.repoRoot,
     backend: "file_checkpoint"
   });
-  const baselineRoot = path59.join(stagingRoot, "baseline");
-  const executionRoot = path59.join(stagingRoot, "execution");
+  const baselineRoot = path60.join(stagingRoot, "baseline");
+  const executionRoot = path60.join(stagingRoot, "execution");
   try {
     resolveExecutionCwdRelative(context.repoRoot, context.cwd);
     const resourceIdentity = await currentRecoveryResourceIdentity(context.repoRoot, "directory");
@@ -19508,7 +19909,7 @@ async function prepareNonGitSnapshot(context) {
       quotas,
       deadlineMs
     });
-    await mkdir13(baselineRoot, { recursive: true });
+    await mkdir14(baselineRoot, { recursive: true });
     const baselineIndex = await buildFileTreeIndex({
       resourceRoot: baselineRoot,
       excludedRoots,
@@ -19528,7 +19929,7 @@ async function prepareNonGitSnapshot(context) {
       throw new Error(FILE_CHECKPOINT_SOURCE_CHANGED);
     }
     await writeFile10(
-      path59.join(stagingRoot, "baseline-index.json"),
+      path60.join(stagingRoot, "baseline-index.json"),
       `${JSON.stringify(baselineIndex)}
 `,
       "utf8"
@@ -19538,7 +19939,7 @@ async function prepareNonGitSnapshot(context) {
       quotas,
       deadlineMs
     });
-    await mkdir13(executionRoot, { recursive: true });
+    await mkdir14(executionRoot, { recursive: true });
     const finalSourceIndex = await buildFileTreeIndex({
       resourceRoot: context.repoRoot,
       excludedRoots,
@@ -19881,10 +20282,10 @@ async function selectTransactionalBackend(context) {
 }
 
 // src/core/transactional/diff-evaluator.ts
-import path60 from "node:path";
+import path61 from "node:path";
 init_path_utils();
 function categorizeChange(change, ctx) {
-  const absolutePath = canonicalPath(path60.join(ctx.repoRoot, change.relativePath));
+  const absolutePath = canonicalPath(path61.join(ctx.repoRoot, change.relativePath));
   if (!pathWithinRoot(ctx.repoRoot, absolutePath)) {
     return "repo_outside";
   }
@@ -20434,17 +20835,55 @@ function formatJudgeInfrastructureDenyMessage(params) {
 }
 
 // src/core/notify.ts
+init_path_utils();
 import { execFile } from "node:child_process";
+import path62 from "node:path";
 import { promisify } from "node:util";
 var execFileAsync = promisify(execFile);
-async function notifyDeny(config, event) {
-  const payload = JSON.stringify(event);
-  if (config.webhookUrl) {
+var LOOPBACK_WEBHOOK_HOSTS = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "::1"]);
+function webhookConfigIssue(url) {
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    return `notifications.webhookUrl is invalid: ${url}`;
+  }
+  if (parsed.protocol === "https:") {
+    return null;
+  }
+  const normalizedHostname = parsed.hostname.toLowerCase().replace(/^\[|\]$/g, "");
+  if (parsed.protocol === "http:" && LOOPBACK_WEBHOOK_HOSTS.has(normalizedHostname)) {
+    return null;
+  }
+  return `notifications.webhookUrl must use https (http is allowed only for localhost, 127.0.0.1, or ::1): ${url}`;
+}
+function commandHookConfigIssue(commandHook, repoRoot) {
+  if (!path62.isAbsolute(commandHook)) {
+    return `notifications.commandHook must be an absolute path: ${commandHook}`;
+  }
+  if (pathWithinRoot(canonicalPath(repoRoot), canonicalPath(commandHook))) {
+    return `notifications.commandHook must not be inside the repository: ${commandHook}`;
+  }
+  return null;
+}
+async function notifyDeny(config, event, deps = {
+  fetch: globalThis.fetch.bind(globalThis),
+  execFile: (file, args, options) => execFileAsync(file, [...args], options)
+}) {
+  const payload = JSON.stringify({
+    approvalId: event.approvalId,
+    reason: event.reason,
+    summary: event.summary,
+    repoRoot: event.repoRoot,
+    fingerprint: event.fingerprint
+  });
+  const webhookIssue = config.webhookUrl ? webhookConfigIssue(config.webhookUrl) : null;
+  if (config.webhookUrl && !webhookIssue) {
     try {
       const controller = new AbortController();
       const timeout = setTimeout(() => controller.abort(), 5e3);
       try {
-        await fetch(config.webhookUrl, {
+        await deps.fetch(config.webhookUrl, {
           method: "POST",
           headers: { "content-type": "application/json" },
           body: payload,
@@ -20456,17 +20895,16 @@ async function notifyDeny(config, event) {
     } catch {
     }
   }
-  if (config.commandHook) {
+  const commandHookIssue = config.commandHook ? commandHookConfigIssue(config.commandHook, event.repoRoot) : null;
+  if (config.commandHook && !commandHookIssue) {
     try {
-      await execFileAsync(config.commandHook, [], {
+      await deps.execFile(config.commandHook, [], {
         env: {
-          ...process.env,
           BELAY_APPROVAL_ID: event.approvalId,
           BELAY_REASON: event.reason,
           BELAY_SUMMARY: event.summary,
           BELAY_REPO_ROOT: event.repoRoot,
-          BELAY_FINGERPRINT: event.fingerprint,
-          BELAY_APPROVAL_TOKEN: event.approvalToken ?? ""
+          BELAY_FINGERPRINT: event.fingerprint
         }
       });
     } catch {
@@ -20476,9 +20914,10 @@ async function notifyDeny(config, event) {
 
 // src/adapters/shared/gate-runtime.ts
 init_path_utils();
+init_repo_config_trust();
 
 // src/adapters/layouts/protected-paths.ts
-import path61 from "node:path";
+import path63 from "node:path";
 function protectedArtifactRoots(layout, repoRoot, controlPlaneDir) {
   const roots = [
     layout.configPath(repoRoot),
@@ -20490,7 +20929,7 @@ function protectedArtifactRoots(layout, repoRoot, controlPlaneDir) {
   if (controlPlaneDir) {
     roots.push(controlPlaneDir);
   }
-  return roots.map((entry) => path61.resolve(entry));
+  return roots.map((entry) => path63.resolve(entry));
 }
 
 // src/adapters/shared/gate-runtime.ts
@@ -20531,7 +20970,7 @@ async function appendReplayAuditSafely(ctx, deps, event) {
 }
 async function loadJsonFile(filePath, fallback) {
   try {
-    const raw = await readFile16(filePath, "utf8");
+    const raw = await readFile17(filePath, "utf8");
     return JSON.parse(raw);
   } catch {
     return fallback;
@@ -20540,11 +20979,18 @@ async function loadJsonFile(filePath, fallback) {
 function createDefaultGateRuntimeDeps() {
   return {
     async readConfig(configPath) {
-      return loadJsonFile(configPath, {});
+      try {
+        return JSON.parse(await readFile17(configPath, "utf8"));
+      } catch (error) {
+        if (error.code === "ENOENT") {
+          return {};
+        }
+        throw error;
+      }
     },
     async appendAudit(ctx, event) {
-      const auditPath = path62.join(ctx.repoRoot, ctx.config.audit.logPath);
-      await mkdir14(path62.dirname(auditPath), { recursive: true });
+      const auditPath = path64.join(ctx.repoRoot, ctx.config.audit.logPath);
+      await mkdir15(path64.dirname(auditPath), { recursive: true });
       const provenance = auditProvenance(ctx.config);
       const record = {
         timestamp: (/* @__PURE__ */ new Date()).toISOString(),
@@ -20577,7 +21023,7 @@ function createDefaultGateRuntimeDeps() {
       };
     },
     async writeApprovals(filePath, state) {
-      await mkdir14(path62.dirname(filePath), { recursive: true });
+      await mkdir15(path64.dirname(filePath), { recursive: true });
       await writeFile11(filePath, `${JSON.stringify(compactApprovals(state), null, 2)}
 `, "utf8");
     },
@@ -20598,10 +21044,11 @@ function createDefaultGateRuntimeDeps() {
 }
 async function resolveGateConfig(ctx, deps) {
   const loaded = await deps.readConfig(ctx.configPath);
+  await assertRepoConfigTrusted(ctx.repoRoot, ctx.layout.name, loaded);
   let teamConfig = null;
   const teamPath = teamConfigPath();
-  if (existsSync16(teamPath)) {
-    teamConfig = JSON.parse(await readFile16(teamPath, "utf8"));
+  if (existsSync17(teamPath)) {
+    teamConfig = JSON.parse(await readFile17(teamPath, "utf8"));
   }
   return resolveLayeredConfig({
     repoConfig: loaded,
@@ -20739,7 +21186,7 @@ function deriveWorkspaceRootScopeHint(params) {
   if (!targetPath) {
     return void 0;
   }
-  const candidateRoot = canonicalPath(path62.dirname(targetPath));
+  const candidateRoot = canonicalPath(path64.dirname(targetPath));
   const validation = validateTrustedWorkspaceRootCandidate({
     candidatePath: candidateRoot,
     repoRoot: action.repoRoot,
@@ -21315,7 +21762,7 @@ async function gateDecisionToVerdict(ctx, deps, kind, result, auditExtras = {})
     event: auditEvent,
     sourceEvent,
     kind,
-    repoLabel: path62.basename(ctx.repoRoot),
+    repoLabel: path64.basename(ctx.repoRoot),
     ...auditExtras.toolInvocationCorrelationId ? { toolInvocationCorrelationId: auditExtras.toolInvocationCorrelationId } : {},
     fingerprint: result.fingerprint,
     summary: result.normalizedCommand ?? result.summary ?? "",
@@ -21347,21 +21794,6 @@ async function gateDecisionToVerdict(ctx, deps, kind, result, auditExtras = {})
     if (created) {
       await recordGateApprovalAsk(stateDir, result.reason, false);
     }
-    let approvalToken;
-    try {
-      approvalToken = await issueApprovalToken(
-        {
-          approvalId: approval.approvalId,
-          fingerprint: approval.fingerprint,
-          repoRoot: approval.repoRoot,
-          issuedAt: approval.createdAt,
-          expiresAt: approval.expiresAt
-        },
-        configuredControlPlaneDir(ctx.config)
-      );
-    } catch {
-      approvalToken = void 0;
-    }
     const denialReason = failure?.reason ?? result.reason;
     if (ctx.config.notifications.webhookUrl || ctx.config.notifications.commandHook) {
       await notifyDeny(ctx.config.notifications, {
@@ -21369,8 +21801,7 @@ async function gateDecisionToVerdict(ctx, deps, kind, result, auditExtras = {})
         reason: denialReason,
         summary: result.normalizedCommand ?? result.summary ?? "",
         repoRoot: ctx.repoRoot,
-        fingerprint: result.fingerprint,
-        approvalToken
+        fingerprint: result.fingerprint
       });
     }
     const failureAuditFields = typeof failure?.auditFields === "function" ? failure.auditFields(approval) : failure?.auditFields;
@@ -21762,38 +22193,38 @@ async function appendObservedAudit(ctx, deps, eventName, payload) {
 }
 
 // src/adapters/shared/repo-root.ts
-import { existsSync as existsSync17 } from "node:fs";
-import path63 from "node:path";
+import { existsSync as existsSync18 } from "node:fs";
+import path65 from "node:path";
 function belayConfigPath(current, adapterName) {
   if (adapterName === "cursor") {
-    return path63.join(current, ".cursor", "belay.config.json");
+    return path65.join(current, ".cursor", "belay.config.json");
   }
   if (adapterName === "claude") {
-    return path63.join(current, ".claude", "belay.config.json");
+    return path65.join(current, ".claude", "belay.config.json");
   }
-  return path63.join(current, ".codex", "belay.config.json");
+  return path65.join(current, ".codex", "belay.config.json");
 }
 function markerMatches(current, marker, layout) {
-  const markerPath = path63.join(current, marker);
-  if (!existsSync17(markerPath)) {
+  const markerPath = path65.join(current, marker);
+  if (!existsSync18(markerPath)) {
     return false;
   }
   if (marker === ".cursor" || marker === ".claude" || marker === ".codex") {
-    return existsSync17(belayConfigPath(current, layout.name));
+    return existsSync18(belayConfigPath(current, layout.name));
   }
   return true;
 }
 function findRepoRoot(startPath, layout) {
-  let current = path63.resolve(startPath);
+  let current = path65.resolve(startPath);
   while (true) {
     for (const marker of layout.repoRootMarkers) {
       if (markerMatches(current, marker, layout)) {
         return current;
       }
     }
-    const parent = path63.dirname(current);
+    const parent = path65.dirname(current);
     if (parent === current) {
-      return path63.resolve(startPath);
+      return path65.resolve(startPath);
     }
     current = parent;
   }
@@ -21801,7 +22232,7 @@ function findRepoRoot(startPath, layout) {
 
 // src/adapters/cursor/cwd-resolution.ts
 import os6 from "node:os";
-import path64 from "node:path";
+import path66 from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 function nonEmptyPathString(value) {
   return typeof value === "string" && value.trim() ? value.trim() : void 0;
@@ -21813,36 +22244,36 @@ function resolveCursorActionCwdDetails(payload, fallback = process.cwd()) {
   const workspaceRoot = Array.isArray(payload.workspace_roots) ? payload.workspace_roots.map(nonEmptyPathString).find(Boolean) : void 0;
   if (toolInputWorkingDirectory) {
     return {
-      cwd: path64.resolve(toolInputWorkingDirectory),
+      cwd: path66.resolve(toolInputWorkingDirectory),
       source: "tool_input.working_directory",
       fromPayload: true
     };
   }
   if (topLevelCwd) {
     return {
-      cwd: path64.resolve(topLevelCwd),
+      cwd: path66.resolve(topLevelCwd),
       source: "cwd",
       fromPayload: true
     };
   }
   if (workspaceRoot) {
     return {
-      cwd: path64.resolve(workspaceRoot),
+      cwd: path66.resolve(workspaceRoot),
       source: "workspace_roots",
       fromPayload: true
     };
   }
   return {
-    cwd: path64.resolve(fallback),
+    cwd: path66.resolve(fallback),
     source: "fallback",
     fromPayload: false
   };
 }
 function isGlobalCursorHookRuntime() {
   try {
-    const runtimePath = path64.resolve(fileURLToPath2(import.meta.url));
-    const globalRuntimeDir = path64.resolve(path64.join(os6.homedir(), ".cursor", "belay", "runtime"));
-    return runtimePath === globalRuntimeDir || runtimePath.startsWith(`${globalRuntimeDir}${path64.sep}`);
+    const runtimePath = path66.resolve(fileURLToPath2(import.meta.url));
+    const globalRuntimeDir = path66.resolve(path66.join(os6.homedir(), ".cursor", "belay", "runtime"));
+    return runtimePath === globalRuntimeDir || runtimePath.startsWith(`${globalRuntimeDir}${path66.sep}`);
   } catch {
     return false;
   }
@@ -21892,7 +22323,7 @@ function resolveCursorToolActionCwdDetails(payload, fallback, eventName, toolNam
 function collectCandidateRepoRoots(payload, resolution) {
   const roots = [];
   const add = (value) => {
-    const resolved = path65.resolve(value);
+    const resolved = path67.resolve(value);
     if (!roots.includes(resolved)) {
       roots.push(resolved);
     }
@@ -21954,6 +22385,9 @@ function isSubagentEvent(payload, eventName) {
 function isFileMutationTool(toolName) {
   return toolName === "Write" || toolName === "StrReplace" || toolName === "Delete";
 }
+function isCursorPreToolUseEvent(eventName) {
+  return eventName === "preToolUse" || eventName === "PreToolUse";
+}
 async function handleBeforeSubmitPromptHook(payload) {
   try {
     const prompt = String(payload.prompt ?? "");
@@ -21978,7 +22412,13 @@ async function handleBeforeSubmitPromptHook(payload) {
       ...result.user_message ? { user_message: result.user_message } : {},
       ...result.replay ? { replay: result.replay } : {}
     };
-  } catch {
+  } catch (error) {
+    if (isRepoConfigTrustError(error)) {
+      return {
+        continue: false,
+        user_message: error.message
+      };
+    }
     return {
       continue: false,
       user_message: "belay failed while processing approval state. Run belay doctor, then retry."
@@ -22009,7 +22449,13 @@ async function handleShellGateHook(payload) {
       sourceEvent: "beforeShellExecution"
     });
     return gateVerdictToCursorResponse(verdict2);
-  } catch {
+  } catch (error) {
+    if (isRepoConfigTrustError(error)) {
+      return {
+        permission: "deny",
+        user_message: error.message
+      };
+    }
     return {
       permission: "deny",
       user_message: "belay failed while classifying this shell command. Run belay doctor, then retry."
@@ -22022,6 +22468,9 @@ async function runShellGateHook() {
 async function handleToolGateHook(eventName, payload) {
   try {
     const toolName = String(payload.tool_name ?? "");
+    if (isCursorPreToolUseEvent(eventName) && toolName === "Shell") {
+      return { permission: "allow" };
+    }
     const resolution = resolveCursorToolActionCwdDetails(
       payload,
       process2.cwd(),
@@ -22046,9 +22495,9 @@ async function handleToolGateHook(eventName, payload) {
       });
       return gateVerdictToCursorResponse(verdict2);
     }
-    if (toolName === "Shell") {
+    if (isFileMutationTool(toolName)) {
       const verdict2 = await evaluateGatedAction(ctx, deps, {
-        kind: "shell",
+        kind: "tool",
         cwd,
         payload,
         toolName,
@@ -22056,27 +22505,33 @@ async function handleToolGateHook(eventName, payload) {
       });
       return gateVerdictToCursorResponse(verdict2);
     }
-    if (isFileMutationTool(toolName)) {
+    if (payload.tool_name === "Task") {
       const verdict2 = await evaluateGatedAction(ctx, deps, {
-        kind: "tool",
+        kind: "subagent",
         cwd,
         payload,
-        toolName,
         sourceEvent: eventName
       });
       return gateVerdictToCursorResponse(verdict2);
     }
-    if (payload.tool_name === "Task") {
+    if (isCursorPreToolUseEvent(eventName)) {
       const verdict2 = await evaluateGatedAction(ctx, deps, {
-        kind: "subagent",
+        kind: "tool",
         cwd,
         payload,
+        toolName,
         sourceEvent: eventName
       });
       return gateVerdictToCursorResponse(verdict2);
     }
     return { permission: "allow" };
-  } catch {
+  } catch (error) {
+    if (isRepoConfigTrustError(error)) {
+      return {
+        permission: "deny",
+        user_message: error.message
+      };
+    }
     return {
       permission: "deny",
       user_message: "belay failed while classifying this tool action. Run belay doctor, then retry."