@yagni-app/code-staging 0.3.0-staging.1059.1 → 0.3.0-staging.1064.1

package/dist/extension/crashReport.js

@@ -125,8 +125,6 @@ export function makeCrashReporter(opts) {
             if (crashReportsDisabled(env))
                 return;
             const token = opts.getToken();
-            if (!token)
-                return;
             const sanitized = sanitizeCrashError(error, { env, repoRoot });
             const payload = {
                 client: isDesktopSurface() ? "desktop" : "cli",
@@ -148,7 +146,7 @@ export function makeCrashReporter(opts) {
                     method: "POST",
                     headers: {
                         "content-type": "application/json",
-                        authorization: `Bearer ${token}`,
+                        ...(token ? { authorization: `Bearer ${token}` } : {}),
                     },
                     body: JSON.stringify(payload),
                     signal: controller.signal,

package/dist/extension/footer.d.ts

@@ -39,6 +39,7 @@
  * — useful reference for what data to replicate and how to format it.
  */
 import type { ExtensionContext, ReadonlyFooterDataProvider, Theme } from "@earendil-works/pi-coding-agent";
+import type { ModeHolder, PermissionMode } from "./permission.js";
 export declare const BRANCH_MAX_WIDTH = 60;
 /**
  * Resolve the status bar's left pad from the launcher's `YAGNI_PAD_X` env so it
@@ -90,6 +91,8 @@ export declare function detectGitInfo(cwd: string, home: string | undefined): Gi
 export declare function renderFooterLines(input: {
     git: GitInfo;
     model: string;
+    /** Current permission mode; shown on line 2 to the left of the model as "<mode> mode". */
+    mode?: PermissionMode | null;
     usage: UsageTotals;
     contextPercent: number | null;
     statuses: string[];
@@ -99,7 +102,7 @@ export declare function renderFooterLines(input: {
  * and returns the component `setFooter` expects. Called from the
  * `session_start` handler in index.ts.
  */
-export declare function createYagniFooterFactory(ctx: ExtensionContext): (_tui: unknown, theme: Theme, footerData: ReadonlyFooterDataProvider) => {
+export declare function createYagniFooterFactory(ctx: ExtensionContext, modeHolder?: ModeHolder): (_tui: unknown, theme: Theme, footerData: ReadonlyFooterDataProvider) => {
     render(width: number): string[];
     invalidate(): void;
     dispose(): void;

package/dist/extension/footer.js

@@ -221,7 +221,7 @@ export function renderFooterLines(input, theme, width, padX = 0) {
             line1Parts.push(theme.fg("border", truncateEnd(input.git.branch, BRANCH_MAX_WIDTH)));
     }
     const line1 = pad + truncateToWidth(line1Parts.join(sep), contentWidth, dim("…"));
-    // Line 2: model · ↑in ↓out $cost · ctx%
+    // Line 2: [mode ·] model · ↑in ↓out $cost · ctx%
     const statParts = [];
     if (input.usage.input)
         statParts.push(`↑${formatTokens(input.usage.input)}`);
@@ -231,7 +231,10 @@ export function renderFooterLines(input, theme, width, padX = 0) {
         statParts.push(`$${input.usage.cost.toFixed(3)}`);
     const stats = statParts.join(" ");
     const percentText = input.contextPercent === null ? "?" : `${Math.round(input.contextPercent)}%`;
-    const line2Parts = [dim(input.model)];
+    const line2Parts = [];
+    if (input.mode)
+        line2Parts.push(dim(`${input.mode} mode`));
+    line2Parts.push(dim(input.model));
     if (stats)
         line2Parts.push(dim(stats));
     line2Parts.push(theme.fg(contextColor(input.contextPercent), percentText));
@@ -249,7 +252,7 @@ export function renderFooterLines(input, theme, width, padX = 0) {
  * and returns the component `setFooter` expects. Called from the
  * `session_start` handler in index.ts.
  */
-export function createYagniFooterFactory(ctx) {
+export function createYagniFooterFactory(ctx, modeHolder) {
     return (_tui, theme, footerData) => {
         // Recompute git/worktree info only when the branch actually changes. Optional-
         // chained: onBranchChange is typed on ReadonlyFooterDataProvider, but the runtime
@@ -273,6 +276,7 @@ export function createYagniFooterFactory(ctx) {
                 return renderFooterLines({
                     git: gitInfo(),
                     model: ctx.model?.id ?? "no-model",
+                    mode: modeHolder?.get() ?? null,
                     usage: collectUsage(ctx.sessionManager),
                     contextPercent: ctx.getContextUsage()?.percent ?? null,
                     statuses,

package/dist/extension/index.d.ts

@@ -63,6 +63,12 @@ export interface RegisterYagniDeps {
     tokenProvider?: TokenProvider;
     /** The spool flush (R4 write half), injectable so tests never touch disk. */
     flushSpool?: (opts: SpoolClientOpts) => Promise<FlushOutcome>;
+    /**
+     * Non-fatal auth-event reporter (YAG-500 Fix E). Defaults to
+     * `makeCrashReporter` gated on `!evalMode`; inject a spy in tests to assert
+     * the report is fired with `context: "auth-failure"` and the refresh outcome.
+     */
+    authReporter?: (error: unknown, context?: string) => Promise<void>;
     env?: NodeJS.ProcessEnv;
 }
 /**

package/dist/extension/index.js

@@ -23,14 +23,14 @@ import { isInitDone as defaultIsInitDone, markInitDone as defaultMarkInitDone }
 import { fetchMcpServers as defaultFetchMcpServers, registerMcpCommand, registerMcpTools, } from "./mcpTools.js";
 import { registerGoCommand } from "./pipeline/goCommand.js";
 import { registerGoCompareCommand } from "./pipeline/goCompareCommand.js";
-import { DEFAULT_PERMISSION_POLICY, registerPermissionGate } from "./permission.js";
+import { DEFAULT_PERMISSION_POLICY, createModeHolder, registerPermissionGate } from "./permission.js";
 import { registerSubagents } from "./subagents.js";
 import { registerTodos } from "./todos.js";
 import { registerDecisionCommands } from "./decisions.js";
 import { makeDecisionCapture } from "./decisionCapture.js";
 import { registerAmbientRecall } from "./recall.js";
 import { resilientFetch } from "./resilientFetch.js";
-import { installUncaughtExceptionMonitor } from "./crashReport.js";
+import { installUncaughtExceptionMonitor, makeCrashReporter } from "./crashReport.js";
 import { flushSpool as defaultFlushSpool } from "./spool.js";
 import { makeAuthedFetch, makeTokenProvider } from "./tokenProvider.js";
 import { attributionHeaders, fetchCatalog as defaultFetchCatalog, fetchContextBrief as defaultFetchContextBrief, getToken, getTokenExpiresAt as defaultGetTokenExpiresAt, getWorkspaceId as defaultGetWorkspaceId, isDriverCaller, resolveBaseUrl, tokenExpiryNotice, } from "./config.js";
@@ -113,6 +113,19 @@ export async function registerYagni(pi, deps = {}) {
     if (!evalMode) {
         installUncaughtExceptionMonitor({ baseUrl, getToken: getTokenFn, env: deps.env });
     }
+    // YAG-500 Fix E: non-fatal auth-event reporter for 401s on the model path.
+    // Reuses the crash endpoint (/api/yagni-code/crash) with a distinct context
+    // so auth failures are visible in Sentry/backend logs. Gated on !evalMode
+    // like every other external side effect; injectable for tests.
+    const authReporter = deps.authReporter ??
+        (!evalMode
+            ? makeCrashReporter({ baseUrl, getToken: getTokenFn, fetchImpl: deps.fetchImpl, env: deps.env })
+            : async () => { });
+    // YAG-500 Fix A+C: the model-path 401 recovery outcome, set by the
+    // message_end handler so it can produce the right user-facing message. The
+    // after_provider_response event does NOT fire on a 401 (the OpenAI SDK throws
+    // before onResponse is reached), so message_end is the only seam.
+    let lastAuthRecovery = null;
     const fullCatalog = await fetchCatalog({ baseUrl, getToken: getTokenFn, fetchImpl: authedFetch });
     // Lock the interactive session to the `advanced` tier only. The backend
     // catalog returns all tiers, but only `advanced` is registered with the
@@ -220,7 +233,9 @@ export async function registerYagni(pi, deps = {}) {
     // drafts a decision on "don't ask again". Default auto, so still additive.
     // Mutating MCP tools join write/edit/bash in the gate policy: plan mode
     // holds them, review mode confirms them.
+    const modeHolder = createModeHolder();
     registerPermissionGate(pi, {
+        modeHolder,
         ...(mcpMutatingTools.length > 0
             ? {
                 policy: {
@@ -433,7 +448,7 @@ export async function registerYagni(pi, deps = {}) {
     // renders. The message text deliberately matches neither pi's overflow nor
     // retryable-error patterns: a deterministic empty response should not burn
     // auto-retries or trigger compaction — the user decides what to do next.
-    pi.on("message_end", (event, ctx) => {
+    pi.on("message_end", async (event, ctx) => {
         const msg = event.message;
         if (msg.role !== "assistant")
             return;
@@ -448,6 +463,71 @@ export async function registerYagni(pi, deps = {}) {
         // post-replacement message, and dropping the marker would defeat the very
         // recovery this error exists to trigger.
         if (msg.stopReason === "error" && msg.errorMessage) {
+            // YAG-500: a 401 from the model proxy means the session token expired
+            // (or was revoked). Unlike tool 401s (handled by makeAuthedFetch), the
+            // model completion path has no 401-retry seam — pi's retryProviderRequest
+            // treats 401 as non-retryable, and after_provider_response never fires
+            // (the SDK throws before onResponse is reached). So message_end is the
+            // only place to detect it and trigger recovery. The regex matches
+            // "yagni login" (the backend's auth-error message) but NOT
+            // "request_too_large" (YAG-460's overflow marker).
+            const isAuthError = /yagni login/i.test(msg.errorMessage)
+                && !/request_too_large|context_too_large/i.test(msg.errorMessage);
+            if (isAuthError) {
+                lastAuthRecovery = null;
+                let rotated = false;
+                try {
+                    rotated = await tokenProvider.refresh();
+                }
+                catch {
+                    rotated = false;
+                }
+                lastAuthRecovery = rotated ? "refreshed" : "failed";
+                const explanation = rotated
+                    ? "Your session token expired but was refreshed automatically. Re-send your prompt to continue."
+                    : "Your session token expired and could not be refreshed. Run `yagni login`, then re-send your prompt. If the issue persists, restart YAGNI Code.";
+                if (ctx.hasUI) {
+                    try {
+                        ctx.ui.notify(explanation, rotated ? "info" : "error");
+                    }
+                    catch {
+                        // Surfacing the problem must never break the session itself.
+                    }
+                }
+                // YAG-500 Fix E: fire a non-fatal crash report so auth failures are
+                // visible in Sentry/backend logs. Reuses the crash endpoint with a
+                // distinct context. Fire-and-forget, fail-soft. The crash endpoint is
+                // now public (no token required), so the report lands even when the
+                // session token is expired and refresh failed — the most critical
+                // failure signal is no longer silently dropped.
+                void authReporter(new Error(`auth_401 on model path; refresh=${rotated ? "succeeded" : "failed"}`), "auth-failure").catch(() => { });
+                // YAG-500 Fix F: local diagnostics log under YAGNI_DEBUG.
+                if (isDebug(env)) {
+                    try {
+                        const logPath = join(codeStateHome(null, env), "logs", "auth-events.log");
+                        mkdirSync(dirname(logPath), { recursive: true });
+                        appendFileSync(logPath, JSON.stringify({
+                            ts: new Date().toISOString(),
+                            status: 401,
+                            refresh: rotated ? "succeeded" : "failed",
+                        }) + "\n", "utf8");
+                    }
+                    catch {
+                        // A diagnostic must never break the session.
+                    }
+                }
+                return { message: { ...msg, errorMessage: explanation } };
+            }
+            // YAG-460: the backend proxy answers an oversized conversation with an
+            // OpenAI-format 413 whose type is `request_too_large`. pi's own overflow
+            // detection matches that marker and runs full recovery — compact, then
+            // auto-retry the failed turn — so this branch must NOT call ctx.compact()
+            // (it would race the built-in recovery and lose the retry). Its only job
+            // is UX: replace the raw `413: {"error":{...}}` JSON with a readable
+            // message and tell the user what is happening. The rewritten text KEEPS
+            // the `request_too_large` marker verbatim: pi's _checkCompaction reads the
+            // post-replacement message, and dropping the marker would defeat the very
+            // recovery this error exists to trigger.
             const isContextTooLarge = /request_too_large|context_too_large/i.test(msg.errorMessage);
             if (!isContextTooLarge)
                 return;
@@ -504,7 +584,7 @@ export async function registerYagni(pi, deps = {}) {
             // context % on line 2, and extension statuses (brand, todos, mode) on
             // line 3. The factory captures ctx so the footer can read session data
             // (token stats, context usage) that isn't on the footerData provider.
-            ctx.ui?.setFooter?.((tui, theme, footerData) => createYagniFooterFactory(ctx)(tui, theme, footerData));
+            ctx.ui?.setFooter?.((tui, theme, footerData) => createYagniFooterFactory(ctx, modeHolder)(tui, theme, footerData));
         }
         // Best-effort, once at session start: if the token is at or near expiry, say
         // so via a single notice so a long session does not silently start 401-ing

package/dist/extension/permission.d.ts

@@ -29,6 +29,17 @@
 import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
 import { type BlessStore } from "./bless.js";
 export type PermissionMode = "auto" | "plan" | "review";
+/**
+ * A shared, mutable holder for the current permission mode. Both
+ * `registerPermissionGate` (which writes on /mode) and the footer factory
+ * (which reads on every render) hold a reference, so mode changes appear
+ * immediately in the footer's line 2.
+ */
+export interface ModeHolder {
+    get(): PermissionMode;
+    set(m: PermissionMode): void;
+}
+export declare function createModeHolder(initial?: PermissionMode): ModeHolder;
 /** Which tools each tier acts on, plus the optional grounding-bless predicate. */
 export interface PermissionPolicy {
     /** Tools blocked outright in plan mode (write/exec). */
@@ -76,6 +87,8 @@ export interface RegisterPermissionDeps {
      * never blocks the approved tool call.
      */
     onBlessRemember?: (ctx: ExtensionContext, info: BlessRememberInfo) => void | Promise<void>;
+    /** Shared holder so the footer can read the live mode on every render. */
+    modeHolder?: ModeHolder;
 }
 /** The customType tag on injected plan-mode context (filterable later). */
 export declare const PLAN_CONTEXT_TYPE = "yagni-plan-context";

package/dist/extension/permission.js

@@ -27,6 +27,13 @@
  * the context so the model doesn't keep believing it is restricted.
  */
 import { makeBlessStore as defaultMakeBlessStore } from "./bless.js";
+export function createModeHolder(initial = "auto") {
+    let current = initial;
+    return {
+        get: () => current,
+        set: (m) => { current = m; },
+    };
+}
 export const DEFAULT_PERMISSION_POLICY = {
     planBlockTools: ["write", "edit", "bash", "file_ticket", "update_ticket_status"],
     reviewConfirmTools: ["write", "edit", "bash", "file_ticket", "update_ticket_status"],
@@ -232,6 +239,7 @@ export function registerPermissionGate(pi, deps = {}) {
         return { messages: filtered };
     });
     const paintMode = (ctx) => {
+        deps.modeHolder?.set(mode);
         try {
             if (ctx.hasUI)
                 ctx.ui.setStatus?.("yagni-mode", MODE_STATUS[mode]);

package/dist/extension/tokenProvider.js

@@ -130,7 +130,7 @@ export function makeTokenProvider(deps) {
             });
         }, delay);
     }
-    function applyRotation(rotation) {
+    function applyRotation(rotation, skipPersist = false) {
         token = rotation.token;
         if (rotation.expiresAt)
             expiresAt = rotation.expiresAt;
@@ -139,13 +139,45 @@ export function makeTokenProvider(deps) {
         env.YAGNI_TOKEN = rotation.token;
         if (rotation.expiresAt)
             env.YAGNI_TOKEN_EXPIRES_AT = rotation.expiresAt;
+        if (!skipPersist) {
+            try {
+                persistProfile(rotation);
+            }
+            catch {
+                /* fail-soft */
+            }
+        }
+        armProactiveTimer();
+    }
+    /**
+     * Read the token from the launcher's profile file on disk. Used as a fallback
+     * when the server-side refresh fails (the old token is also invalid for
+     * /auth/refresh): an external `yagni login` writes a fresh token to the same
+     * file, so re-reading it can recover a session that the server refresh cannot.
+     * Returns null when the file is missing, unreadable, or carries the same token
+     * already in memory.
+     */
+    function readTokenFromDisk() {
+        const profilePath = env.YAGNI_PROFILE_PATH?.trim();
+        if (!profilePath)
+            return null;
         try {
-            persistProfile(rotation);
+            const parsed = JSON.parse(readFileSync(profilePath, "utf8"));
+            if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+                return null;
+            const obj = parsed;
+            const diskToken = typeof obj.token === "string" ? obj.token : undefined;
+            if (!diskToken || diskToken === token)
+                return null;
+            return {
+                token: diskToken,
+                expiresAt: typeof obj.expiresAt === "string" ? obj.expiresAt : undefined,
+                workspaceId: typeof obj.workspaceId === "string" ? obj.workspaceId : undefined,
+            };
         }
         catch {
-            /* fail-soft */
+            return null;
         }
-        armProactiveTimer();
     }
     async function doRefresh() {
         const current = token;
@@ -161,8 +193,17 @@ export function makeTokenProvider(deps) {
                 body: "{}",
                 signal: AbortSignal.timeout(REFRESH_REQUEST_TIMEOUT_MS),
             });
-            if (!res.ok)
+            if (!res.ok) {
+                // Server refresh failed (the old token is also invalid for /auth/refresh).
+                // Fall back to the profile file on disk: an external `yagni login` may
+                // have written a fresh token there that this running session hasn't seen.
+                const disk = readTokenFromDisk();
+                if (disk) {
+                    applyRotation(disk, true);
+                    return true;
+                }
                 return false;
+            }
             const data = (await res.json());
             if (!data || typeof data.token !== "string" || data.token.length === 0)
                 return false;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yagni-app/code-staging",
-  "version": "0.3.0-staging.1059.1",
+  "version": "0.3.0-staging.1064.1",
   "description": "YAGNI Code: a terminal coding agent that already knows your company. One YAGNI login routes the model and grounds the agent in your team's context.",
   "license": "SEE LICENSE IN LICENSE.md",
   "author": "YAGNI, Inc. <jack@yagni.app> (https://yagni.app)",
@@ -38,5 +38,5 @@
     "@earendil-works/pi-tui": "0.84.1",
     "typebox": "^1.3.11"
   },
-  "yagniSourceSha": "5ccc70e2a48d1bc9b937a412ff26897522c23eee"
+  "yagniSourceSha": "e38a99de02a31e45c61d006943113caf8817e0bd"
 }