@sjawhar/pi-legion-envoy 1.23.1 → 1.24.1

package/dist/legion.js

@@ -30665,6 +30665,30 @@ function createLegionDaemonClient(baseUrl, fetchFn = fetch, recovery) {
       throw new LegionDaemonApiError("POST", path, response.status, responseBody);
     return schema.parse(JSON.parse(responseBody));
   };
+  const recoveries = new Map;
+  const secretAfterRefusal = async (active, sessionId, refusedSecret) => {
+    let record = recoveries.get(sessionId);
+    if (record === undefined) {
+      record = {};
+      recoveries.set(sessionId, record);
+    }
+    if (record.latestSecret !== undefined && record.latestSecret !== refusedSecret) {
+      return record.latestSecret;
+    }
+    if (record.inFlight === undefined) {
+      const current = record;
+      const inFlight = postOnce(WORKER_SESSION_PATH, { sessionId, recoveryToken: active.recoveryToken(sessionId) }, LegionDaemonApi.WorkerSession.response).then((recovered) => {
+        active.onRecovered?.(sessionId, recovered);
+        current.latestSecret = recovered.secret;
+        return recovered;
+      }).finally(() => {
+        if (current.inFlight === inFlight)
+          current.inFlight = undefined;
+      });
+      record.inFlight = inFlight;
+    }
+    return (await record.inFlight).secret;
+  };
   const post = async (path, body, schema) => {
     try {
       return await postOnce(path, body, schema);
@@ -30673,12 +30697,8 @@ function createLegionDaemonClient(baseUrl, fetchFn = fetch, recovery) {
       if (path === WORKER_SESSION_PATH || recovery === undefined || capability === undefined || !isInvalidSessionSecret(error)) {
         throw error;
       }
-      const recovered = await postOnce(WORKER_SESSION_PATH, {
-        sessionId: capability.sessionId,
-        recoveryToken: recovery.recoveryToken(capability.sessionId)
-      }, LegionDaemonApi.WorkerSession.response);
-      recovery.onRecovered?.(capability.sessionId, recovered);
-      return await postOnce(path, { ...body, secret: recovered.secret }, schema);
+      const secret = await secretAfterRefusal(recovery, capability.sessionId, capability.secret);
+      return await postOnce(path, { ...body, secret }, schema);
     }
   };
   const get = async (path, schema) => {
@@ -34715,6 +34735,112 @@ function isSingleLegionCommand(command) {
     return false;
   return trimmed.split(/\s+/, 1)[0] === "legion";
 }
+var JJ_LOG_REWRITE_WORDS = ["undo", "abandon"];
+var JJ_OP_WORDS = ["op", "operation"];
+var JJ_OP_LOG_REWRITE_WORDS = ["restore", "revert"];
+var JJ_MENTION = /\bjj\b/;
+var JJ_LOG_REWRITE_MENTION = /\b(?:undo|abandon)\b|\b(?:op|operation)\b\W+(?:restore|revert)\b/;
+function jjLogRewriteMention(text) {
+  if (!JJ_MENTION.test(text))
+    return;
+  const match = JJ_LOG_REWRITE_MENTION.exec(text);
+  return match === null ? undefined : match[0].replace(/\W+/g, " ");
+}
+function splitShellCommands(command) {
+  const commands = [];
+  let words = [];
+  let text = "";
+  let inWord = false;
+  let quote;
+  const endWord = () => {
+    if (inWord)
+      words.push(text);
+    text = "";
+    inWord = false;
+  };
+  const endCommand = () => {
+    endWord();
+    if (words.length > 0)
+      commands.push(words);
+    words = [];
+  };
+  for (let i = 0;i < command.length; i += 1) {
+    const char = command.charAt(i);
+    if (quote !== undefined) {
+      if (char === quote)
+        quote = undefined;
+      else if (quote === '"' && char === "\\" && command.charAt(i + 1) === `
+`)
+        i += 1;
+      else if (quote === '"' && char === "\\" && i + 1 < command.length) {
+        i += 1;
+        text += command.charAt(i);
+      } else
+        text += char;
+      continue;
+    }
+    if (char === '"' || char === "'") {
+      quote = char;
+      inWord = true;
+    } else if (char === "\\") {
+      if (command.charAt(i + 1) === `
+`)
+        i += 1;
+      else if (i + 1 < command.length) {
+        i += 1;
+        text += command.charAt(i);
+        inWord = true;
+      }
+    } else if (char === " " || char === "\t" || char === "<" || char === ">") {
+      endWord();
+    } else if (char === "&" && (command.charAt(i - 1) === ">" || command.charAt(i - 1) === "<" || command.charAt(i + 1) === ">")) {
+      endWord();
+    } else if (";&|\n()`".includes(char)) {
+      endCommand();
+    } else {
+      text += char;
+      inWord = true;
+    }
+  }
+  if (quote !== undefined)
+    return;
+  endCommand();
+  return commands;
+}
+function jjLogRewriteInvocation(command) {
+  const commands = splitShellCommands(command);
+  if (commands === undefined) {
+    return jjLogRewriteMention(command) === undefined ? undefined : command.trim();
+  }
+  for (const words of commands) {
+    const mentioned = words.find((word) => jjLogRewriteMention(word) !== undefined);
+    if (mentioned !== undefined)
+      return mentioned;
+    const jj = words.findIndex((word) => word === "jj" || word.endsWith("/jj"));
+    if (jj === -1)
+      continue;
+    const args = words.slice(jj + 1);
+    const rewritesLog = args.some((arg) => JJ_LOG_REWRITE_WORDS.includes(arg)) || args.some((arg) => JJ_OP_WORDS.includes(arg)) && args.some((arg) => JJ_OP_LOG_REWRITE_WORDS.includes(arg));
+    if (rewritesLog)
+      return words.slice(jj).join(" ");
+  }
+  return;
+}
+function jjLogRewriteAttempt(toolCall) {
+  const { toolName, input } = toolCall;
+  if (toolName === "bash") {
+    return typeof input.command === "string" ? jjLogRewriteInvocation(input.command) : undefined;
+  }
+  let text;
+  if (toolName === "eval" && typeof input.code === "string")
+    text = input.code;
+  else if (toolName === "hub") {
+    text = [input.application, ...Array.isArray(input.args) ? input.args : [], input.text].filter((part) => typeof part === "string").join(" ");
+  } else
+    return;
+  const mention = jjLogRewriteMention(text);
+  return mention === undefined ? undefined : `${toolName}: jj ${mention}`;
+}
 var LEGION_LOADED_MARKER = Symbol.for("legion.pi-envoy.legion-loaded");
 var CODE_MUTATION_TOOLS = ["edit", "write", "apply_patch"];
 var MERGER_BLOCKED_TOOLS = [...CODE_MUTATION_TOOLS, "task"];
@@ -34738,8 +34864,10 @@ function legionExtension(pi) {
     subagentSession ??= isSubagentSession(context);
     return subagentSession;
   };
+  let phaseWorkerPane;
+  let daemonClient;
   const roleDaemon = () => {
-    return createLegionDaemonClient(requiredEnvironment(process.env, "LEGION_DAEMON_URL"), fetch, {
+    daemonClient ??= createLegionDaemonClient(requiredEnvironment(process.env, "LEGION_DAEMON_URL"), fetch, {
       recoveryToken: (sessionId) => {
         if (capability !== undefined && sessionId === capability.sessionID) {
           return requiredSecret(process.env, "LEGION_BOOT_TOKEN");
@@ -34756,6 +34884,7 @@ function legionExtension(pi) {
         capability = { ...capability, secret: recovered.secret };
       }
     });
+    return daemonClient;
   };
   const rerunReadyAfterRegain = async (endpoint, role, reason, call) => {
     try {
@@ -35009,6 +35138,16 @@ function legionExtension(pi) {
       toolCallId: toolCall.toolCallId,
       toolName: toolCall.toolName
     });
+    phaseWorkerPane ??= classifySession(process.env).kind === "phase-worker";
+    if (phaseWorkerPane) {
+      const jjAttempt = jjLogRewriteAttempt(toolCall);
+      if (jjAttempt !== undefined) {
+        return {
+          block: true,
+          reason: `refused \`${jjAttempt}\`: jj undo, jj abandon, and jj op restore/revert/abandon/undo ` + "rewrite the jj operation log, which every Legion issue workspace shares (each is a jj " + "workspace of one clone), so they rewrite other trees' commits too. Recover forward with " + "a new commit or `jj restore <paths>` of files; anything else, stop and send the owning " + 'architect the `jj -R "$LEGION_WORKSPACE" log` evidence.'
+        };
+      }
+    }
     if (await checkSubagentSession(context))
       return;
     const sessionID = context.sessionManager.getSessionId();

package/dist/skills/legion-worker/SKILL.md

@@ -120,10 +120,21 @@ transcript, the committed file wins: it is the copy that survived.
 - **Before pushing, check ancestry:** `jj -R "$LEGION_WORKSPACE" log -r 'ancestors(@, 5)'`
   — verify only your issue's commits are in the chain, not unrelated work.
 
-**Shared operation safety:** Never run `jj op restore` in a Legion workspace. It rewrites
-the shared operation log. If a mistake reaches that point, stop and send the owning
-architect the `jj -R "$LEGION_WORKSPACE" log` evidence; recover only through the approved,
-path-scoped workflow.
+**Shared operation safety:** Every Legion issue workspace is a `jj workspace` of one shared
+clone, so they all share one operation log: `jj undo`, `jj abandon`, and
+`jj op restore|revert|abandon|undo` rewrite it for every tree at once (on 2026-09-12 one
+worker's `jj undo` rewrote nine of another tree's commits). The extension refuses them in every
+phase-worker pane before they run — a `bash` command in any position of a pipeline or `&&`
+chain, with or without `-R`, judged on the whole argument list; `eval` code; and a `hub`
+process start — from your own tool calls and from any `task` subagent you spawn (it runs in
+your pane, against the same log), and a `bash` command whose quoted text merely mentions `jj`
+with one of those words (a heredoc, an echo, a commit message) is refused too: write such text
+with the `write` tool or say "operation-log rollback" instead. `jj restore <paths>`,
+`jj op log`, and `jj op show` stay allowed. Recover forward only: a new commit
+(`jj -R "$LEGION_WORKSPACE" new`) or `jj -R "$LEGION_WORKSPACE" restore <paths>` of files.
+Anything else, stop and send the owning architect the `jj -R "$LEGION_WORKSPACE" log`
+evidence; the architect decides, and an operator performs any operation-log restore with every
+other tree paused.
 
 ## Phase work
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sjawhar/pi-legion-envoy",
-  "version": "1.23.1",
+  "version": "1.24.1",
   "type": "module",
   "omp": {
     "extensions": [