@yagni-app/code-staging 0.3.0-staging.1061.1 → 0.3.0-staging.1067.1

package/dist/extension/chipEditor.d.ts

@@ -48,21 +48,33 @@ export interface ImageAttachment {
  */
 export declare function unwrapBracketedPaste(data: string): string | null;
 /**
- * Recognize a pasted temp-image path written by a Ghostty-based terminal
- * (cmux, Ghostty). Those terminals name the file `clipboard-<ts>-<id>.<ext>`
- * in the system temp dir. We match strictly — clipboard- prefix, image
- * extension, real file, and genuine image magic bytes — so a path the user
- * typed by hand (e.g. /Users/me/photo.png) is never silently converted.
- * Returns the decoded image, or null when the pasted text is not one such path.
+ * Recognize a pasted payload that is entirely image-file paths and decode
+ * them. This covers Finder/desktop drag-drop and Ghostty/cmux's Cmd+V
+ * (which writes the clipboard image to a `clipboard-*.png` temp file and
+ * pastes its path) — Claude Code parity: dragging a screenshot in becomes
+ * `[Image #N]`, not a literal path.
+ *
+ * Guardrails against converting something the user meant as text: the WHOLE
+ * paste must be path tokens, every token must be an absolute path to a real
+ * file with an image extension AND genuine image magic bytes, and the
+ * conversion is visible — each image becomes a chip in the prompt, so nothing
+ * is ever attached silently. Returns null when the paste is not such a list
+ * (caller passes it through as ordinary text).
  */
-export declare function readPastedImagePath(pastedText: string): ClipboardImage | null;
+export declare function readPastedImagePaths(pastedText: string): ClipboardImage[] | null;
 /**
  * Read an image from the system clipboard without forking pi. Best-effort and
- * cross-platform: native module if present, else osascript/pngpaste (macOS),
+ * cross-platform using ONLY tools the OS ships with: osascript (macOS),
  * wl-paste (Wayland), xclip (X11), PowerShell (Windows/WSL). Returns null when
  * the clipboard holds no image (caller then pastes text instead).
  */
 export declare const defaultClipboardImageReader: ClipboardImageReader;
+/**
+ * Parse osascript's clipboard dump — `«data PNGf89504E47…»` — into raw bytes.
+ * The 4-char tag after `«data ` is the pasteboard flavor; the hex that follows
+ * is the image. Returns null when the output holds no such dump.
+ */
+export declare function parseOsascriptImageHex(out: string): Uint8Array | null;
 /**
  * A CustomEditor that turns clipboard image paste into numbered `[Image #N]`
  * chips. The image bytes live here, keyed by chip number; the editor text holds

package/dist/extension/chipEditor.js

@@ -64,58 +64,98 @@ const IMAGE_MAGIC = [
     [[0x47, 0x49, 0x46, 0x38], "image/gif"], // GIF8
     [[0x52, 0x49, 0x46, 0x46], "image/webp"], // RIFF (webp container)
 ];
+/** A text paste this long is prose, not a dragged file list — bail early. */
+const MAX_PASTED_PATHS = 20;
 /**
- * Recognize a pasted temp-image path written by a Ghostty-based terminal
- * (cmux, Ghostty). Those terminals name the file `clipboard-<ts>-<id>.<ext>`
- * in the system temp dir. We match strictly — clipboard- prefix, image
- * extension, real file, and genuine image magic bytes — so a path the user
- * typed by hand (e.g. /Users/me/photo.png) is never silently converted.
- * Returns the decoded image, or null when the pasted text is not one such path.
+ * Split a pasted payload into path tokens the way terminals produce them:
+ * Finder/desktop drag-drop inserts absolute paths with backslash-escaped
+ * spaces (POSIX) or quote-wrapped paths (Windows Terminal), multiple files
+ * separated by whitespace. Returns [] when the payload can't be a path list
+ * (e.g. an unbalanced quote from ordinary prose like "don't").
  */
-export function readPastedImagePath(pastedText) {
-    const trimmed = pastedText.trim();
-    if (trimmed.includes("\n") || trimmed.includes(" "))
-        return null; // one token only
-    // Validate the RAW input first: an attacker could smuggle the `clipboard-`
-    // prefix through backslash escapes (e.g. `\c\l\i\p\b\o\a\r\d-`), so we
-    // must confirm the un-escaped form is a well-formed tmp image path before any
-    // unescaping or path resolution. cmux tmp paths contain no escapable chars
-    // (no spaces/metacharacters), so a legitimate paste has NO backslashes at all.
-    // On Windows the backslash IS the path separator (and cmd/PowerShell do no
-    // backslash-escaping), so the escape-smuggling rejection applies only where
-    // a backslash could be an escape: POSIX shells.
+function splitPathTokens(text) {
     const isWindows = process.platform === "win32";
-    if (!isWindows && trimmed.includes("\\"))
-        return null; // escapes => not a plain cmux tmp path
-    const path = trimmed;
-    if (isWindows ? !isAbsolute(path) : !path.startsWith("/"))
-        return null;
-    const name = basename(path);
-    if (!name.startsWith("clipboard-"))
-        return null;
-    const ext = name.split(".").pop()?.toLowerCase() ?? "";
-    if (!(ext in IMAGE_EXT_MIME))
-        return null;
-    if (!existsSync(path))
-        return null;
-    let bytes;
-    try {
-        bytes = readFileSync(path);
-    }
-    catch {
-        return null;
+    const tokens = [];
+    let cur = "";
+    let quote = null;
+    for (let i = 0; i < text.length; i++) {
+        const ch = text[i];
+        if (quote) {
+            if (ch === quote)
+                quote = null;
+            else
+                cur += ch;
+            continue;
+        }
+        if (ch === '"' || ch === "'") {
+            quote = ch;
+            continue;
+        }
+        // POSIX shells escape spaces/metacharacters with a backslash; on Windows
+        // the backslash IS the path separator, so no unescaping there.
+        if (!isWindows && ch === "\\" && i + 1 < text.length) {
+            cur += text[++i];
+            continue;
+        }
+        if (ch === " " || ch === "\t" || ch === "\n" || ch === "\r") {
+            if (cur)
+                tokens.push(cur);
+            cur = "";
+            continue;
+        }
+        cur += ch;
     }
-    if (bytes.length === 0)
+    if (quote !== null)
+        return [];
+    if (cur)
+        tokens.push(cur);
+    return tokens;
+}
+/**
+ * Recognize a pasted payload that is entirely image-file paths and decode
+ * them. This covers Finder/desktop drag-drop and Ghostty/cmux's Cmd+V
+ * (which writes the clipboard image to a `clipboard-*.png` temp file and
+ * pastes its path) — Claude Code parity: dragging a screenshot in becomes
+ * `[Image #N]`, not a literal path.
+ *
+ * Guardrails against converting something the user meant as text: the WHOLE
+ * paste must be path tokens, every token must be an absolute path to a real
+ * file with an image extension AND genuine image magic bytes, and the
+ * conversion is visible — each image becomes a chip in the prompt, so nothing
+ * is ever attached silently. Returns null when the paste is not such a list
+ * (caller passes it through as ordinary text).
+ */
+export function readPastedImagePaths(pastedText) {
+    const tokens = splitPathTokens(pastedText.trim());
+    if (tokens.length === 0 || tokens.length > MAX_PASTED_PATHS)
         return null;
-    for (const [magic, mime] of IMAGE_MAGIC) {
-        if (magic.every((b, i) => bytes[i] === b))
-            return { bytes, mimeType: mime };
+    const isWindows = process.platform === "win32";
+    const images = [];
+    for (const path of tokens) {
+        if (isWindows ? !isAbsolute(path) : !path.startsWith("/"))
+            return null;
+        const ext = basename(path).split(".").pop()?.toLowerCase() ?? "";
+        if (!(ext in IMAGE_EXT_MIME))
+            return null;
+        if (!existsSync(path))
+            return null;
+        let bytes;
+        try {
+            bytes = readFileSync(path);
+        }
+        catch {
+            return null;
+        }
+        const magic = IMAGE_MAGIC.find(([m]) => m.every((b, i) => bytes[i] === b));
+        if (!magic)
+            return null;
+        images.push({ bytes, mimeType: magic[1] });
     }
-    return null;
+    return images;
 }
 /**
  * Read an image from the system clipboard without forking pi. Best-effort and
- * cross-platform: native module if present, else osascript/pngpaste (macOS),
+ * cross-platform using ONLY tools the OS ships with: osascript (macOS),
  * wl-paste (Wayland), xclip (X11), PowerShell (Windows/WSL). Returns null when
  * the clipboard holds no image (caller then pastes text instead).
  */
@@ -145,7 +185,45 @@ function runBase64(command, args, timeoutMs = 3000) {
     return out.length > 0 ? out : null;
 }
 function readMacClipboardImage() {
-    // pngpaste writes the clipboard image to a PNG file (cleanest on macOS).
+    return readMacClipboardViaOsascript() ?? readMacClipboardViaPngpaste();
+}
+/**
+ * Parse osascript's clipboard dump — `«data PNGf89504E47…»` — into raw bytes.
+ * The 4-char tag after `«data ` is the pasteboard flavor; the hex that follows
+ * is the image. Returns null when the output holds no such dump.
+ */
+export function parseOsascriptImageHex(out) {
+    const m = /«data \w{4}((?:[0-9A-Fa-f]{2})+)»/.exec(out);
+    if (!m)
+        return null;
+    const bytes = Buffer.from(m[1], "hex");
+    return bytes.length > 0 ? bytes : null;
+}
+function readMacClipboardViaOsascript() {
+    // AppleScript ships with macOS, so this route needs no install (it is how
+    // Claude Code reads clipboard images too). Screenshots and browser
+    // "Copy image" put a PNG flavor on the pasteboard; try JPEG second.
+    for (const [cls, mime] of [
+        ["PNGf", "image/png"],
+        ["JPEG", "image/jpeg"],
+    ]) {
+        const res = spawnSync("osascript", ["-e", `the clipboard as «class ${cls}»`], {
+            timeout: 5000,
+            maxBuffer: 256 * 1024 * 1024, // the hex dump doubles the image size
+        });
+        if (res.error || res.status !== 0)
+            continue;
+        const out = Buffer.isBuffer(res.stdout) ? res.stdout.toString("utf8") : String(res.stdout ?? "");
+        const bytes = parseOsascriptImageHex(out);
+        if (bytes)
+            return { bytes, mimeType: mime };
+    }
+    return null;
+}
+function readMacClipboardViaPngpaste() {
+    // Optional fallback for pasteboard flavors osascript can't coerce to
+    // PNG/JPEG (e.g. TIFF-only sources) — pngpaste converts anything to PNG.
+    // Nice when installed, never required.
     const dest = join(tmpdir(), `yagni-clip-${randomUUID()}.png`);
     try {
         const res = spawnSync("pngpaste", [dest], { timeout: 3000 });
@@ -222,27 +300,31 @@ export class ChipEditor extends CustomEditor {
      * Kitty-protocol terminals that genuinely deliver the Cmd modifier.
      */
     handleInput(data) {
-        // Cmd+V on Ghostty-based terminals (cmux, Ghostty): the terminal writes the
-        // clipboard image to a temp file and pastes its PATH as bracketed text, so
-        // the payload arrives here as "\x1b[200~<path>\x1b[201~" (pi's Terminal
-        // re-wraps it). handlePaste is private and consumed inside super.handleInput,
-        // so we strip the markers here and convert a bare image path to a chip.
+        // Pasted image PATHS arrive as bracketed text ("\x1b[200~<paths>\x1b[201~",
+        // pi's Terminal re-wraps every paste): Finder/desktop drag-drop inserts the
+        // file's path, and Ghostty-based terminals (cmux, Ghostty) write a Cmd+V'd
+        // clipboard image to a temp file and paste ITS path. handlePaste is private
+        // and consumed inside super.handleInput, so we strip the markers here and
+        // convert an all-image-paths payload into chips.
         const unwrapped = unwrapBracketedPaste(data);
         if (unwrapped !== null) {
-            const image = readPastedImagePath(unwrapped);
+            const images = readPastedImagePaths(unwrapped);
             logImagePaste({
                 event: "paste_path",
-                outcome: image ? "ok" : "passthrough",
-                mimeType: image?.mimeType,
-                bytes: image?.bytes.length,
-                file: image ? unwrapped : undefined,
-                detail: image ? undefined : `not a lone image path: ${unwrapped.slice(0, 60)}`,
+                outcome: images ? "ok" : "passthrough",
+                imageCount: images?.length,
+                bytes: images?.reduce((sum, i) => sum + i.bytes.length, 0),
+                detail: images ? undefined : `not an image path list: ${unwrapped.slice(0, 60)}`,
             });
-            if (image) {
-                this.dropChip(image.bytes, image.mimeType);
+            if (images) {
+                images.forEach((image, i) => {
+                    if (i > 0)
+                        this.insertTextAtCursor(" ");
+                    this.dropChip(image.bytes, image.mimeType);
+                });
                 return;
             }
-            // Not a lone image path — re-wrap and let pi handle the paste normally.
+            // Not a list of image paths — re-wrap and let pi handle the paste normally.
             super.handleInput(data);
             return;
         }

package/dist/extension/crashReport.js

@@ -125,8 +125,6 @@ export function makeCrashReporter(opts) {
             if (crashReportsDisabled(env))
                 return;
             const token = opts.getToken();
-            if (!token)
-                return;
             const sanitized = sanitizeCrashError(error, { env, repoRoot });
             const payload = {
                 client: isDesktopSurface() ? "desktop" : "cli",
@@ -148,7 +146,7 @@ export function makeCrashReporter(opts) {
                     method: "POST",
                     headers: {
                         "content-type": "application/json",
-                        authorization: `Bearer ${token}`,
+                        ...(token ? { authorization: `Bearer ${token}` } : {}),
                     },
                     body: JSON.stringify(payload),
                     signal: controller.signal,

package/dist/extension/index.d.ts

@@ -63,6 +63,12 @@ export interface RegisterYagniDeps {
     tokenProvider?: TokenProvider;
     /** The spool flush (R4 write half), injectable so tests never touch disk. */
     flushSpool?: (opts: SpoolClientOpts) => Promise<FlushOutcome>;
+    /**
+     * Non-fatal auth-event reporter (YAG-500 Fix E). Defaults to
+     * `makeCrashReporter` gated on `!evalMode`; inject a spy in tests to assert
+     * the report is fired with `context: "auth-failure"` and the refresh outcome.
+     */
+    authReporter?: (error: unknown, context?: string) => Promise<void>;
     env?: NodeJS.ProcessEnv;
 }
 /**

package/dist/extension/index.js

@@ -30,7 +30,7 @@ import { registerDecisionCommands } from "./decisions.js";
 import { makeDecisionCapture } from "./decisionCapture.js";
 import { registerAmbientRecall } from "./recall.js";
 import { resilientFetch } from "./resilientFetch.js";
-import { installUncaughtExceptionMonitor } from "./crashReport.js";
+import { installUncaughtExceptionMonitor, makeCrashReporter } from "./crashReport.js";
 import { flushSpool as defaultFlushSpool } from "./spool.js";
 import { makeAuthedFetch, makeTokenProvider } from "./tokenProvider.js";
 import { attributionHeaders, fetchCatalog as defaultFetchCatalog, fetchContextBrief as defaultFetchContextBrief, getToken, getTokenExpiresAt as defaultGetTokenExpiresAt, getWorkspaceId as defaultGetWorkspaceId, isDriverCaller, resolveBaseUrl, tokenExpiryNotice, } from "./config.js";
@@ -113,6 +113,19 @@ export async function registerYagni(pi, deps = {}) {
     if (!evalMode) {
         installUncaughtExceptionMonitor({ baseUrl, getToken: getTokenFn, env: deps.env });
     }
+    // YAG-500 Fix E: non-fatal auth-event reporter for 401s on the model path.
+    // Reuses the crash endpoint (/api/yagni-code/crash) with a distinct context
+    // so auth failures are visible in Sentry/backend logs. Gated on !evalMode
+    // like every other external side effect; injectable for tests.
+    const authReporter = deps.authReporter ??
+        (!evalMode
+            ? makeCrashReporter({ baseUrl, getToken: getTokenFn, fetchImpl: deps.fetchImpl, env: deps.env })
+            : async () => { });
+    // YAG-500 Fix A+C: the model-path 401 recovery outcome, set by the
+    // message_end handler so it can produce the right user-facing message. The
+    // after_provider_response event does NOT fire on a 401 (the OpenAI SDK throws
+    // before onResponse is reached), so message_end is the only seam.
+    let lastAuthRecovery = null;
     const fullCatalog = await fetchCatalog({ baseUrl, getToken: getTokenFn, fetchImpl: authedFetch });
     // Lock the interactive session to the `advanced` tier only. The backend
     // catalog returns all tiers, but only `advanced` is registered with the
@@ -435,7 +448,7 @@ export async function registerYagni(pi, deps = {}) {
     // renders. The message text deliberately matches neither pi's overflow nor
     // retryable-error patterns: a deterministic empty response should not burn
     // auto-retries or trigger compaction — the user decides what to do next.
-    pi.on("message_end", (event, ctx) => {
+    pi.on("message_end", async (event, ctx) => {
         const msg = event.message;
         if (msg.role !== "assistant")
             return;
@@ -450,6 +463,71 @@ export async function registerYagni(pi, deps = {}) {
         // post-replacement message, and dropping the marker would defeat the very
         // recovery this error exists to trigger.
         if (msg.stopReason === "error" && msg.errorMessage) {
+            // YAG-500: a 401 from the model proxy means the session token expired
+            // (or was revoked). Unlike tool 401s (handled by makeAuthedFetch), the
+            // model completion path has no 401-retry seam — pi's retryProviderRequest
+            // treats 401 as non-retryable, and after_provider_response never fires
+            // (the SDK throws before onResponse is reached). So message_end is the
+            // only place to detect it and trigger recovery. The regex matches
+            // "yagni login" (the backend's auth-error message) but NOT
+            // "request_too_large" (YAG-460's overflow marker).
+            const isAuthError = /yagni login/i.test(msg.errorMessage)
+                && !/request_too_large|context_too_large/i.test(msg.errorMessage);
+            if (isAuthError) {
+                lastAuthRecovery = null;
+                let rotated = false;
+                try {
+                    rotated = await tokenProvider.refresh();
+                }
+                catch {
+                    rotated = false;
+                }
+                lastAuthRecovery = rotated ? "refreshed" : "failed";
+                const explanation = rotated
+                    ? "Your session token expired but was refreshed automatically. Re-send your prompt to continue."
+                    : "Your session token expired and could not be refreshed. Run `yagni login`, then re-send your prompt. If the issue persists, restart YAGNI Code.";
+                if (ctx.hasUI) {
+                    try {
+                        ctx.ui.notify(explanation, rotated ? "info" : "error");
+                    }
+                    catch {
+                        // Surfacing the problem must never break the session itself.
+                    }
+                }
+                // YAG-500 Fix E: fire a non-fatal crash report so auth failures are
+                // visible in Sentry/backend logs. Reuses the crash endpoint with a
+                // distinct context. Fire-and-forget, fail-soft. The crash endpoint is
+                // now public (no token required), so the report lands even when the
+                // session token is expired and refresh failed — the most critical
+                // failure signal is no longer silently dropped.
+                void authReporter(new Error(`auth_401 on model path; refresh=${rotated ? "succeeded" : "failed"}`), "auth-failure").catch(() => { });
+                // YAG-500 Fix F: local diagnostics log under YAGNI_DEBUG.
+                if (isDebug(env)) {
+                    try {
+                        const logPath = join(codeStateHome(null, env), "logs", "auth-events.log");
+                        mkdirSync(dirname(logPath), { recursive: true });
+                        appendFileSync(logPath, JSON.stringify({
+                            ts: new Date().toISOString(),
+                            status: 401,
+                            refresh: rotated ? "succeeded" : "failed",
+                        }) + "\n", "utf8");
+                    }
+                    catch {
+                        // A diagnostic must never break the session.
+                    }
+                }
+                return { message: { ...msg, errorMessage: explanation } };
+            }
+            // YAG-460: the backend proxy answers an oversized conversation with an
+            // OpenAI-format 413 whose type is `request_too_large`. pi's own overflow
+            // detection matches that marker and runs full recovery — compact, then
+            // auto-retry the failed turn — so this branch must NOT call ctx.compact()
+            // (it would race the built-in recovery and lose the retry). Its only job
+            // is UX: replace the raw `413: {"error":{...}}` JSON with a readable
+            // message and tell the user what is happening. The rewritten text KEEPS
+            // the `request_too_large` marker verbatim: pi's _checkCompaction reads the
+            // post-replacement message, and dropping the marker would defeat the very
+            // recovery this error exists to trigger.
             const isContextTooLarge = /request_too_large|context_too_large/i.test(msg.errorMessage);
             if (!isContextTooLarge)
                 return;

package/dist/extension/tokenProvider.js

@@ -130,7 +130,7 @@ export function makeTokenProvider(deps) {
             });
         }, delay);
     }
-    function applyRotation(rotation) {
+    function applyRotation(rotation, skipPersist = false) {
         token = rotation.token;
         if (rotation.expiresAt)
             expiresAt = rotation.expiresAt;
@@ -139,13 +139,45 @@ export function makeTokenProvider(deps) {
         env.YAGNI_TOKEN = rotation.token;
         if (rotation.expiresAt)
             env.YAGNI_TOKEN_EXPIRES_AT = rotation.expiresAt;
+        if (!skipPersist) {
+            try {
+                persistProfile(rotation);
+            }
+            catch {
+                /* fail-soft */
+            }
+        }
+        armProactiveTimer();
+    }
+    /**
+     * Read the token from the launcher's profile file on disk. Used as a fallback
+     * when the server-side refresh fails (the old token is also invalid for
+     * /auth/refresh): an external `yagni login` writes a fresh token to the same
+     * file, so re-reading it can recover a session that the server refresh cannot.
+     * Returns null when the file is missing, unreadable, or carries the same token
+     * already in memory.
+     */
+    function readTokenFromDisk() {
+        const profilePath = env.YAGNI_PROFILE_PATH?.trim();
+        if (!profilePath)
+            return null;
         try {
-            persistProfile(rotation);
+            const parsed = JSON.parse(readFileSync(profilePath, "utf8"));
+            if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+                return null;
+            const obj = parsed;
+            const diskToken = typeof obj.token === "string" ? obj.token : undefined;
+            if (!diskToken || diskToken === token)
+                return null;
+            return {
+                token: diskToken,
+                expiresAt: typeof obj.expiresAt === "string" ? obj.expiresAt : undefined,
+                workspaceId: typeof obj.workspaceId === "string" ? obj.workspaceId : undefined,
+            };
         }
         catch {
-            /* fail-soft */
+            return null;
         }
-        armProactiveTimer();
     }
     async function doRefresh() {
         const current = token;
@@ -161,8 +193,17 @@ export function makeTokenProvider(deps) {
                 body: "{}",
                 signal: AbortSignal.timeout(REFRESH_REQUEST_TIMEOUT_MS),
             });
-            if (!res.ok)
+            if (!res.ok) {
+                // Server refresh failed (the old token is also invalid for /auth/refresh).
+                // Fall back to the profile file on disk: an external `yagni login` may
+                // have written a fresh token there that this running session hasn't seen.
+                const disk = readTokenFromDisk();
+                if (disk) {
+                    applyRotation(disk, true);
+                    return true;
+                }
                 return false;
+            }
             const data = (await res.json());
             if (!data || typeof data.token !== "string" || data.token.length === 0)
                 return false;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yagni-app/code-staging",
-  "version": "0.3.0-staging.1061.1",
+  "version": "0.3.0-staging.1067.1",
   "description": "YAGNI Code: a terminal coding agent that already knows your company. One YAGNI login routes the model and grounds the agent in your team's context.",
   "license": "SEE LICENSE IN LICENSE.md",
   "author": "YAGNI, Inc. <jack@yagni.app> (https://yagni.app)",
@@ -38,5 +38,5 @@
     "@earendil-works/pi-tui": "0.84.1",
     "typebox": "^1.3.11"
   },
-  "yagniSourceSha": "44711af698e076c2e718fdd813f4e8ab4b875a0a"
+  "yagniSourceSha": "30603566bf16560437d0729158a147e177426f01"
 }