@guilz-dev/belay 0.9.4 → 0.10.1

package/dist/config-io.js

@@ -7,6 +7,7 @@ import { compactApprovals, isExpired, mergeApprovalStates } from './core/approva
 import { mutateApprovalStateWithRetry } from './core/capability/approval-state-mutation.js';
 import { approvedApprovalsFile, belayStateDir, configuredControlPlaneDir, mergeConfig, pendingApprovalsFile, stripForbiddenShellOverrideLists, } from './core/config.js';
 import { resolveLayeredConfig, teamConfigPath, } from './core/config-layers.js';
+import { trustRepoConfig } from './core/repo-config-trust.js';
 export function resolveAdapterName(config) {
     if (config.adapter === 'claude') {
         return 'claude';
@@ -221,6 +222,12 @@ export async function writeConfigFile(repoRoot, config, adapter = resolveAdapter
         await unlink(temporaryPath).catch(() => undefined);
     }
 }
+export async function writeTrustedConfigFile(repoRoot, config, adapter = resolveAdapterName(config)) {
+    await writeConfigFile(repoRoot, config, adapter);
+    const configPath = configPathFor(repoRoot, adapter);
+    const parsed = JSON.parse(await readFile(configPath, 'utf8'));
+    await trustRepoConfig(repoRoot, adapter, parsed);
+}
 export async function mergeAndWriteConfig(repoRoot, adapter = 'cursor') {
     const layout = getAdapterLayout(adapter);
     const configPath = layout.configPath(repoRoot);
@@ -229,7 +236,7 @@ export async function mergeAndWriteConfig(repoRoot, adapter = 'cursor') {
         existing = JSON.parse(await readFile(configPath, 'utf8'));
     }
     const merged = mergeConfig(existing, layout.defaultConfig(repoRoot));
-    await writeConfigFile(repoRoot, merged, adapter);
+    await writeTrustedConfigFile(repoRoot, merged, adapter);
     await ensureBelayStateDir(merged, repoRoot);
     if (merged.controlPlane.enabled) {
         await migrateRepoLocalApprovalsToControlPlane(repoRoot, merged);

package/dist/core/capability/index.d.ts

@@ -6,7 +6,7 @@ export { CAPABILITY_GRANT_VERSION, type CapabilityGrantV1, isGrantScopeTooBroad,
 export { checkGatedActionLimits, MAX_SHELL_COMMAND_BYTES, MAX_TOOL_PAYLOAD_BYTES, } from './limits.js';
 export { collectOutsideRepoPaths, collectOutsideRepoPathsFromToolPayload } from './paths.js';
 export { type CapabilityAuthorizationMetadata, type PolicyLegacyReasonHints, policyDecisionToLegacyReason, policyReasonToLegacyReason, singleCapabilityMetadata, } from './policy-bridge.js';
-export { buildFileMutationCapabilityRequest, buildShellCapabilityRequest, createTypeScriptPolicyEngine, evaluateFileMutationPolicy, evaluateShellPolicy, evaluateSubagentPolicy, type FileMutationCapabilityAnalysis, getDefaultPolicyEngine, policyDecisionRequiresAsk, type ShellCapabilityAnalysis, type SubagentCapabilityAnalysis, } from './policy-engine.js';
+export { buildFileMutationCapabilityRequest, buildShellCapabilityRequest, createTypeScriptPolicyEngine, evaluateFileMutationPolicy, evaluateFileReadPolicy, evaluateShellPolicy, evaluateSubagentPolicy, type FileMutationCapabilityAnalysis, type FileReadCapabilityAnalysis, getDefaultPolicyEngine, policyDecisionRequiresAsk, type ShellCapabilityAnalysis, type SubagentCapabilityAnalysis, } from './policy-engine.js';
 export type { AuthorizationContext, PolicyDecision, PolicyEngine, PolicyOutcome, } from './policy-types.js';
 export { FS_SCOPE_REASONS, shouldSkipBrokerApprovedOnce, shouldSkipBrokerApprovedRecord, } from './reasons.js';
 export { CAPABILITY_REQUEST_VERSION, type CapabilityAction, type CapabilityEvidence, type CapabilityEvidenceLevel, type CapabilityHookKind, type CapabilityPrincipal, type CapabilityRequestContext, type CapabilityRequestV1, type CapabilityResource, type GitRefScope, type NetworkMode, type NetworkPayload, type ProcessOperation, } from './request.js';

package/dist/core/capability/index.js

@@ -6,7 +6,7 @@ export { CAPABILITY_GRANT_VERSION, isGrantScopeTooBroad, } from './grant.js';
 export { checkGatedActionLimits, MAX_SHELL_COMMAND_BYTES, MAX_TOOL_PAYLOAD_BYTES, } from './limits.js';
 export { collectOutsideRepoPaths, collectOutsideRepoPathsFromToolPayload } from './paths.js';
 export { policyDecisionToLegacyReason, policyReasonToLegacyReason, singleCapabilityMetadata, } from './policy-bridge.js';
-export { buildFileMutationCapabilityRequest, buildShellCapabilityRequest, createTypeScriptPolicyEngine, evaluateFileMutationPolicy, evaluateShellPolicy, evaluateSubagentPolicy, getDefaultPolicyEngine, policyDecisionRequiresAsk, } from './policy-engine.js';
+export { buildFileMutationCapabilityRequest, buildShellCapabilityRequest, createTypeScriptPolicyEngine, evaluateFileMutationPolicy, evaluateFileReadPolicy, evaluateShellPolicy, evaluateSubagentPolicy, getDefaultPolicyEngine, policyDecisionRequiresAsk, } from './policy-engine.js';
 export { FS_SCOPE_REASONS, shouldSkipBrokerApprovedOnce, shouldSkipBrokerApprovedRecord, } from './reasons.js';
 export { CAPABILITY_REQUEST_VERSION, } from './request.js';
 export { addTrustedWorkspaceRoot, isBroadTrustedWorkspaceRoot, isHighStakesTrustedWorkspaceRoot, isPathWithinTrustedWorkspaceRoots, loadTrustedWorkspaceRoots, loadTrustedWorkspaceRootsSync, normalizeTrustedWorkspaceRootPath, saveTrustedWorkspaceRoots, trustedWorkspaceRootsPath, validateTrustedWorkspaceRootCandidate, } from './trusted-workspace-roots.js';

package/dist/core/capability/policy-engine.d.ts

@@ -105,3 +105,22 @@ export declare function evaluateFileMutationPolicy(analysis: FileMutationCapabil
     request: CapabilityRequestV1;
     decision: PolicyDecision;
 };
+export interface FileReadCapabilityAnalysis {
+    hookKind: CapabilityHookKind;
+    toolKind: string;
+    filePath: string;
+    resolvedPath: string;
+    repoRoot: string;
+    cwd: string;
+    inputFingerprint: string;
+    signals: string[];
+    locationLabel: 'repo_local' | 'outside_repo' | 'sensitive_path' | 'control_plane';
+    trustedWorkspaceRoots?: string[];
+    sensitivePaths?: string[];
+    adapter?: string;
+}
+export declare function buildFileReadCapabilityRequest(analysis: FileReadCapabilityAnalysis): CapabilityRequestV1;
+export declare function evaluateFileReadPolicy(analysis: FileReadCapabilityAnalysis, config: BelayConfigV4, auth?: PolicyAuthExtras): {
+    request: CapabilityRequestV1;
+    decision: PolicyDecision;
+};

package/dist/core/capability/policy-engine.js

@@ -866,3 +866,34 @@ export function evaluateFileMutationPolicy(analysis, config, auth) {
     const decision = getDefaultPolicyEngine().evaluate(request, buildAuthorizationContext(config, analysis.trustedWorkspaceRoots, enriched));
     return { request, decision };
 }
+export function buildFileReadCapabilityRequest(analysis) {
+    return {
+        version: CAPABILITY_REQUEST_VERSION,
+        principal: {
+            adapter: analysis.adapter,
+            repoRoot: analysis.repoRoot,
+            sessionHash: hashSession(`${analysis.repoRoot}:${analysis.cwd}`),
+        },
+        action: 'fs.read',
+        resource: { kind: 'path', path: analysis.resolvedPath },
+        context: {
+            cwd: analysis.cwd,
+            inputFingerprint: analysis.inputFingerprint,
+            hookKind: analysis.hookKind,
+            analysisBasis: [`tool:${analysis.toolKind}`, `location:${analysis.locationLabel}`, 'read'],
+        },
+        evidence: {
+            level: analysis.locationLabel === 'repo_local' ? 'certain' : 'possible',
+            signals: [...analysis.signals, 'effect.fs_read'],
+        },
+    };
+}
+export function evaluateFileReadPolicy(analysis, config, auth) {
+    const request = buildFileReadCapabilityRequest(analysis);
+    const enriched = enrichAuthWithMaterializedGrants(request, config, {
+        ...auth,
+        sensitivePaths: auth?.sensitivePaths ?? analysis.sensitivePaths,
+    });
+    const decision = getDefaultPolicyEngine().evaluate(request, buildAuthorizationContext(config, analysis.trustedWorkspaceRoots, enriched));
+    return { request, decision };
+}

package/dist/core/classify-tool.js

@@ -1,7 +1,7 @@
 import path from 'node:path';
 import { BOUNDARY_PROFILE_L3_L4_ONLY } from './capability/boundary-profile.js';
 import { policyReasonToLegacyReason } from './capability/policy-bridge.js';
-import { evaluateFileMutationPolicy, policyDecisionRequiresAsk, } from './capability/policy-engine.js';
+import { evaluateFileMutationPolicy, evaluateFileReadPolicy, policyDecisionRequiresAsk, } from './capability/policy-engine.js';
 import { canonicalStringify, toolFingerprint } from './fingerprint.js';
 import { matchesSensitivePath } from './glob.js';
 import { pathWithinRoot, resolveWorkspaceRootMatch } from './path-utils.js';
@@ -11,17 +11,44 @@ import { classifyShell, resolveClassifierTrustedCwd } from './verdict/adapter.js
 import { isGitPath } from './verdict/containment.js';
 import { mutationPrescanRequiresAsk } from './verdict/prescan.js';
 const DEFAULT_SENSITIVE_PATHS = ['.env', '.env.*', '**/credentials/**'];
-const FILE_WRITE_TOOL_NAMES = new Set(['write']);
-const FILE_EDIT_TOOL_NAMES = new Set([
-    'edit',
-    'multiedit',
-    'multi_edit',
-    'patch',
-    'strreplace',
-    'str_replace',
-]);
-const FILE_DELETE_TOOL_NAMES = new Set(['delete']);
-const APPLY_PATCH_TOOL_NAMES = new Set(['apply_patch', 'applypatch']);
+function toolInputRecord(payload) {
+    const toolInput = payload.tool_input;
+    if (!toolInput || typeof toolInput !== 'object' || Array.isArray(toolInput)) {
+        return null;
+    }
+    return toolInput;
+}
+function hasMutationFields(input) {
+    return (typeof input.contents === 'string' ||
+        typeof input.old_string === 'string' ||
+        typeof input.new_string === 'string' ||
+        typeof input.newContents === 'string');
+}
+function inferToolPayloadEffect(payload, toolName) {
+    if (extractShellCommand(payload)) {
+        return 'shell';
+    }
+    const input = toolInputRecord(payload);
+    if (!input) {
+        return 'indeterminate';
+    }
+    if (hasMutationFields(input)) {
+        return 'file_mutation';
+    }
+    if (extractPatch(payload)) {
+        return 'apply_patch';
+    }
+    if (typeof input.pattern === 'string' || typeof input.glob_pattern === 'string') {
+        return 'search_read';
+    }
+    if (typeof input.file_path === 'string') {
+        return 'file_read';
+    }
+    if (typeof input.path === 'string' || typeof input.target_file === 'string') {
+        return normalizedToolName(toolName) === 'delete' ? 'file_delete' : 'indeterminate';
+    }
+    return 'indeterminate';
+}
 function policyAuth(options) {
     if (!options.grants &&
         options.attestation === undefined &&
@@ -201,6 +228,283 @@ function classifyFileMutationWithPolicy(params) {
         boundaryProfile: params.options.boundaryProfile ?? BOUNDARY_PROFILE_L3_L4_ONLY,
     };
 }
+function classifyFileReadWithPolicy(params) {
+    const fingerprint = toolFingerprint(params.toolName, { path: params.filePath }, params.repoRoot);
+    const { request, decision } = evaluateFileReadPolicy({
+        hookKind: 'tool',
+        toolKind: params.toolKind,
+        filePath: params.filePath,
+        resolvedPath: params.resolvedPath,
+        repoRoot: params.repoRoot,
+        cwd: params.cwd,
+        inputFingerprint: fingerprint,
+        signals: params.signals,
+        locationLabel: params.locationLabel,
+        trustedWorkspaceRoots: params.options.trustedWorkspaceRoots,
+        sensitivePaths: params.options.sensitivePaths ?? params.config.classifier.sensitivePaths,
+    }, params.config, policyAuth(params.options));
+    if (policyDecisionRequiresAsk(decision)) {
+        return {
+            verdict: 'deny_pending_approval',
+            reason: policyReasonToLegacyReason(decision),
+            summary: params.filePath,
+            fingerprint,
+            assessment: {
+                reversibility: 'reversible',
+                external: params.locationLabel === 'outside_repo',
+                blastRadius: params.locationLabel === 'outside_repo'
+                    ? 'outside the repository'
+                    : 'sensitive repository file',
+                confidence: 0.85,
+                signals: [...params.signals, ...decision.signals],
+            },
+            capabilityRequests: [request],
+            authorizationDecision: decision,
+            boundaryProfile: params.options.boundaryProfile ?? BOUNDARY_PROFILE_L3_L4_ONLY,
+        };
+    }
+    return {
+        verdict: 'allow',
+        reason: 'effect.fs_read',
+        summary: params.filePath,
+        fingerprint,
+        assessment: {
+            reversibility: 'reversible',
+            external: false,
+            blastRadius: 'tool scope',
+            confidence: 0.88,
+            signals: [...params.signals, ...decision.signals],
+        },
+        capabilityRequests: [request],
+        authorizationDecision: decision,
+        boundaryProfile: params.options.boundaryProfile ?? BOUNDARY_PROFILE_L3_L4_ONLY,
+    };
+}
+function classifyFilePathMutation(params) {
+    const { toolName, toolKind, filePath, repoRoot, cwd, config, options, sensitivePaths, protectedRoots, isDelete, } = params;
+    const signals = [];
+    const resolvedPath = path.isAbsolute(filePath) ? filePath : path.resolve(cwd, filePath);
+    const hitsProtectedRoot = protectedRoots.some((root) => pathWithinRoot(root, resolvedPath));
+    if (hitsProtectedRoot) {
+        signals.push('control_plane_path');
+        return classifyFileMutationWithPolicy({
+            toolName,
+            toolKind,
+            filePath,
+            resolvedPath,
+            repoRoot,
+            cwd,
+            config,
+            options,
+            signals,
+            isDelete,
+            locationLabel: 'control_plane',
+        });
+    }
+    const workspaceMatch = resolveWorkspaceRootMatch(repoRoot, options.trustedWorkspaceRoots, resolvedPath);
+    if (workspaceMatch === null) {
+        signals.push('outside_repo_path');
+        return classifyFileMutationWithPolicy({
+            toolName,
+            toolKind,
+            filePath,
+            resolvedPath,
+            repoRoot,
+            cwd,
+            config,
+            options,
+            signals,
+            isDelete,
+            locationLabel: 'outside_repo',
+        });
+    }
+    if (workspaceMatch.kind === 'trusted') {
+        signals.push('trusted_workspace_root');
+    }
+    const trustedCwd = resolveClassifierTrustedCwd(cwd, options);
+    const workspacePrescan = mutationPrescanRequiresAsk({
+        targets: [filePath],
+        cwd,
+        repoRoot,
+        trustedCwd,
+        trustedWorkspaceRoots: options.trustedWorkspaceRoots,
+        sensitivePaths,
+    });
+    if (workspacePrescan) {
+        return classifyFileMutationWithPolicy({
+            toolName,
+            toolKind,
+            filePath,
+            resolvedPath,
+            repoRoot,
+            cwd,
+            config,
+            options,
+            signals,
+            isDelete,
+            locationLabel: 'sensitive_path',
+        });
+    }
+    const relativePath = workspaceMatch.relativePath;
+    if (matchesSensitivePath(relativePath, sensitivePaths)) {
+        signals.push('sensitive_path');
+        return classifyFileMutationWithPolicy({
+            toolName,
+            toolKind,
+            filePath,
+            resolvedPath,
+            repoRoot,
+            cwd,
+            config,
+            options,
+            signals,
+            isDelete,
+            locationLabel: 'sensitive_path',
+        });
+    }
+    if (isDelete) {
+        if (isGitPath(resolvedPath, repoRoot)) {
+            signals.push('protected_artifact');
+            return classifyFileMutationWithPolicy({
+                toolName,
+                toolKind,
+                filePath,
+                resolvedPath,
+                repoRoot,
+                cwd,
+                config,
+                options,
+                signals,
+                isDelete: true,
+                locationLabel: 'sensitive_path',
+            });
+        }
+        signals.push('file_delete');
+        return classifyFileMutationWithPolicy({
+            toolName,
+            toolKind,
+            filePath,
+            resolvedPath,
+            repoRoot,
+            cwd,
+            config,
+            options,
+            signals,
+            isDelete: true,
+            locationLabel: 'repo_local',
+        });
+    }
+    signals.push('file_mutation');
+    return classifyFileMutationWithPolicy({
+        toolName,
+        toolKind,
+        filePath,
+        resolvedPath,
+        repoRoot,
+        cwd,
+        config,
+        options,
+        signals,
+        isDelete: false,
+        locationLabel: 'repo_local',
+    });
+}
+function classifyFilePathRead(params) {
+    const { toolName, toolKind, filePath, repoRoot, cwd, config, options, sensitivePaths, protectedRoots, } = params;
+    const signals = ['effect.fs_read'];
+    const resolvedPath = path.isAbsolute(filePath) ? filePath : path.resolve(cwd, filePath);
+    if (protectedRoots.some((root) => pathWithinRoot(root, resolvedPath))) {
+        signals.push('control_plane_path');
+        return classifyFileReadWithPolicy({
+            toolName,
+            toolKind,
+            filePath,
+            resolvedPath,
+            repoRoot,
+            cwd,
+            config,
+            options,
+            signals,
+            locationLabel: 'control_plane',
+        });
+    }
+    const workspaceMatch = resolveWorkspaceRootMatch(repoRoot, options.trustedWorkspaceRoots, resolvedPath);
+    if (workspaceMatch === null) {
+        signals.push('outside_repo_path');
+        return classifyFileReadWithPolicy({
+            toolName,
+            toolKind,
+            filePath,
+            resolvedPath,
+            repoRoot,
+            cwd,
+            config,
+            options,
+            signals,
+            locationLabel: 'outside_repo',
+        });
+    }
+    const relativePath = workspaceMatch.relativePath;
+    if (matchesSensitivePath(relativePath, sensitivePaths)) {
+        signals.push('sensitive_path');
+        return classifyFileReadWithPolicy({
+            toolName,
+            toolKind,
+            filePath,
+            resolvedPath,
+            repoRoot,
+            cwd,
+            config,
+            options,
+            signals,
+            locationLabel: 'sensitive_path',
+        });
+    }
+    return classifyFileReadWithPolicy({
+        toolName,
+        toolKind,
+        filePath,
+        resolvedPath,
+        repoRoot,
+        cwd,
+        config,
+        options,
+        signals,
+        locationLabel: 'repo_local',
+    });
+}
+function indeterminateToolResult(toolName, payload, repoRoot, options) {
+    const summary = canonicalStringify(scrubPayload(payload.tool_input ?? {}, options));
+    const fingerprint = toolFingerprint(toolName, fingerprintPayload(payload, options), repoRoot);
+    if (options.unknownLocalEffect === 'deny') {
+        return {
+            verdict: 'deny_pending_approval',
+            reason: 'indeterminate_tool_effect',
+            summary,
+            fingerprint,
+            assessment: {
+                reversibility: 'irreversible',
+                external: false,
+                blastRadius: 'unknown tool action',
+                confidence: 0.5,
+                signals: ['indeterminate_tool_effect'],
+            },
+        };
+    }
+    return {
+        verdict: 'allow_flagged',
+        reason: 'indeterminate_tool_effect',
+        summary,
+        fingerprint,
+        assessment: {
+            reversibility: 'recoverable_with_cost',
+            external: false,
+            blastRadius: 'tool scope',
+            confidence: 0.5,
+            signals: ['indeterminate_tool_effect'],
+        },
+    };
+}
 export async function classifyToolUse(payload, repoRoot, cwd, config, options = {}) {
     const toolName = String(payload.tool_name ?? '');
     const toolKind = normalizedToolName(toolName);
@@ -247,9 +551,8 @@ export async function classifyToolUse(payload, repoRoot, cwd, config, options =
             summary: command,
         };
     }
-    if (FILE_WRITE_TOOL_NAMES.has(toolKind) ||
-        FILE_EDIT_TOOL_NAMES.has(toolKind) ||
-        FILE_DELETE_TOOL_NAMES.has(toolKind)) {
+    const effect = inferToolPayloadEffect(payload, toolName);
+    if (effect === 'file_mutation' || effect === 'file_delete') {
         const filePath = extractFilePath(payload);
         if (!filePath) {
             if (options.unknownLocalEffect === 'deny') {
@@ -281,134 +584,20 @@ export async function classifyToolUse(payload, repoRoot, cwd, config, options =
                 },
             };
         }
-        const signals = [];
-        const resolvedPath = path.isAbsolute(filePath) ? filePath : path.resolve(cwd, filePath);
-        const hitsProtectedRoot = protectedRoots.some((root) => pathWithinRoot(root, resolvedPath));
-        if (hitsProtectedRoot) {
-            signals.push('control_plane_path');
-            return classifyFileMutationWithPolicy({
-                toolName,
-                toolKind,
-                filePath,
-                resolvedPath,
-                repoRoot,
-                cwd,
-                config,
-                options,
-                signals,
-                isDelete: FILE_DELETE_TOOL_NAMES.has(toolKind),
-                locationLabel: 'control_plane',
-            });
-        }
-        const workspaceMatch = resolveWorkspaceRootMatch(repoRoot, options.trustedWorkspaceRoots, resolvedPath);
-        if (workspaceMatch === null) {
-            signals.push('outside_repo_path');
-            return classifyFileMutationWithPolicy({
-                toolName,
-                toolKind,
-                filePath,
-                resolvedPath,
-                repoRoot,
-                cwd,
-                config,
-                options,
-                signals,
-                isDelete: FILE_DELETE_TOOL_NAMES.has(toolKind),
-                locationLabel: 'outside_repo',
-            });
-        }
-        if (workspaceMatch.kind === 'trusted') {
-            signals.push('trusted_workspace_root');
-        }
-        const trustedCwd = resolveClassifierTrustedCwd(cwd, options);
-        const workspacePrescan = mutationPrescanRequiresAsk({
-            targets: [filePath],
-            cwd,
-            repoRoot,
-            trustedCwd,
-            trustedWorkspaceRoots: options.trustedWorkspaceRoots,
-            sensitivePaths,
-        });
-        if (workspacePrescan) {
-            return classifyFileMutationWithPolicy({
-                toolName,
-                toolKind,
-                filePath,
-                resolvedPath,
-                repoRoot,
-                cwd,
-                config,
-                options,
-                signals,
-                isDelete: FILE_DELETE_TOOL_NAMES.has(toolKind),
-                locationLabel: 'sensitive_path',
-            });
-        }
-        const relativePath = workspaceMatch.relativePath;
-        if (matchesSensitivePath(relativePath, sensitivePaths)) {
-            signals.push('sensitive_path');
-            return classifyFileMutationWithPolicy({
-                toolName,
-                toolKind,
-                filePath,
-                resolvedPath,
-                repoRoot,
-                cwd,
-                config,
-                options,
-                signals,
-                isDelete: FILE_DELETE_TOOL_NAMES.has(toolKind),
-                locationLabel: 'sensitive_path',
-            });
-        }
-        if (FILE_DELETE_TOOL_NAMES.has(toolKind)) {
-            if (isGitPath(resolvedPath, repoRoot)) {
-                signals.push('protected_artifact');
-                return classifyFileMutationWithPolicy({
-                    toolName,
-                    toolKind,
-                    filePath,
-                    resolvedPath,
-                    repoRoot,
-                    cwd,
-                    config,
-                    options,
-                    signals,
-                    isDelete: true,
-                    locationLabel: 'sensitive_path',
-                });
-            }
-            signals.push('file_delete');
-            return classifyFileMutationWithPolicy({
-                toolName,
-                toolKind,
-                filePath,
-                resolvedPath,
-                repoRoot,
-                cwd,
-                config,
-                options,
-                signals,
-                isDelete: true,
-                locationLabel: 'repo_local',
-            });
-        }
-        signals.push('file_mutation');
-        return classifyFileMutationWithPolicy({
+        return classifyFilePathMutation({
             toolName,
             toolKind,
             filePath,
-            resolvedPath,
             repoRoot,
             cwd,
             config,
             options,
-            signals,
-            isDelete: false,
-            locationLabel: 'repo_local',
+            sensitivePaths,
+            protectedRoots,
+            isDelete: effect === 'file_delete',
         });
     }
-    if (APPLY_PATCH_TOOL_NAMES.has(toolKind)) {
+    if (effect === 'apply_patch') {
         const patch = extractPatch(payload);
         const targets = patch ? applyPatchTargets(patch) : [];
         if (targets.length === 0) {
@@ -445,7 +634,7 @@ export async function classifyToolUse(payload, repoRoot, cwd, config, options =
         for (const target of targets) {
             const result = await classifyToolUse({
                 tool_name: target.delete ? 'Delete' : 'Write',
-                tool_input: { path: target.path },
+                tool_input: target.delete ? { path: target.path } : { path: target.path, contents: ' ' },
             }, repoRoot, cwd, config, options);
             if (result.verdict === 'deny_pending_approval') {
                 return result;
@@ -466,17 +655,52 @@ export async function classifyToolUse(payload, repoRoot, cwd, config, options =
             },
         };
     }
-    return {
-        verdict: 'allow',
-        reason: 'unclassified_tool',
-        summary: canonicalStringify(scrubPayload(payload.tool_input ?? {}, options)),
-        fingerprint: toolFingerprint(toolName, fingerprintPayload(payload, options), repoRoot),
-        assessment: {
-            reversibility: 'reversible',
-            external: false,
-            blastRadius: 'tool scope',
-            confidence: 0.5,
-            signals: ['unclassified_tool'],
-        },
-    };
+    if (effect === 'file_read') {
+        const filePath = extractFilePath(payload);
+        if (!filePath) {
+            return indeterminateToolResult(toolName, payload, repoRoot, options);
+        }
+        return classifyFilePathRead({
+            toolName,
+            toolKind,
+            filePath,
+            repoRoot,
+            cwd,
+            config,
+            options,
+            sensitivePaths,
+            protectedRoots,
+        });
+    }
+    if (effect === 'search_read') {
+        return {
+            verdict: 'allow',
+            reason: 'effect.search_read',
+            summary: canonicalStringify(scrubPayload(payload.tool_input ?? {}, options)),
+            fingerprint: toolFingerprint(toolName, fingerprintPayload(payload, options), repoRoot),
+            assessment: {
+                reversibility: 'reversible',
+                external: false,
+                blastRadius: 'tool scope',
+                confidence: 0.88,
+                signals: ['effect.search_read'],
+            },
+        };
+    }
+    const filePath = extractFilePath(payload);
+    if (filePath) {
+        return classifyFilePathMutation({
+            toolName,
+            toolKind,
+            filePath,
+            repoRoot,
+            cwd,
+            config,
+            options,
+            sensitivePaths,
+            protectedRoots,
+            isDelete: toolKind === 'delete',
+        });
+    }
+    return indeterminateToolResult(toolName, payload, repoRoot, options);
 }