@yagni-app/code-staging 0.3.0-staging.1064.1 → 0.3.0-staging.1071.1

package/dist/extension/chipEditor.d.ts

@@ -48,21 +48,33 @@ export interface ImageAttachment {
  */
 export declare function unwrapBracketedPaste(data: string): string | null;
 /**
- * Recognize a pasted temp-image path written by a Ghostty-based terminal
- * (cmux, Ghostty). Those terminals name the file `clipboard-<ts>-<id>.<ext>`
- * in the system temp dir. We match strictly — clipboard- prefix, image
- * extension, real file, and genuine image magic bytes — so a path the user
- * typed by hand (e.g. /Users/me/photo.png) is never silently converted.
- * Returns the decoded image, or null when the pasted text is not one such path.
+ * Recognize a pasted payload that is entirely image-file paths and decode
+ * them. This covers Finder/desktop drag-drop and Ghostty/cmux's Cmd+V
+ * (which writes the clipboard image to a `clipboard-*.png` temp file and
+ * pastes its path) — Claude Code parity: dragging a screenshot in becomes
+ * `[Image #N]`, not a literal path.
+ *
+ * Guardrails against converting something the user meant as text: the WHOLE
+ * paste must be path tokens, every token must be an absolute path to a real
+ * file with an image extension AND genuine image magic bytes, and the
+ * conversion is visible — each image becomes a chip in the prompt, so nothing
+ * is ever attached silently. Returns null when the paste is not such a list
+ * (caller passes it through as ordinary text).
  */
-export declare function readPastedImagePath(pastedText: string): ClipboardImage | null;
+export declare function readPastedImagePaths(pastedText: string): ClipboardImage[] | null;
 /**
  * Read an image from the system clipboard without forking pi. Best-effort and
- * cross-platform: native module if present, else osascript/pngpaste (macOS),
+ * cross-platform using ONLY tools the OS ships with: osascript (macOS),
  * wl-paste (Wayland), xclip (X11), PowerShell (Windows/WSL). Returns null when
  * the clipboard holds no image (caller then pastes text instead).
  */
 export declare const defaultClipboardImageReader: ClipboardImageReader;
+/**
+ * Parse osascript's clipboard dump — `«data PNGf89504E47…»` — into raw bytes.
+ * The 4-char tag after `«data ` is the pasteboard flavor; the hex that follows
+ * is the image. Returns null when the output holds no such dump.
+ */
+export declare function parseOsascriptImageHex(out: string): Uint8Array | null;
 /**
  * A CustomEditor that turns clipboard image paste into numbered `[Image #N]`
  * chips. The image bytes live here, keyed by chip number; the editor text holds

package/dist/extension/chipEditor.js

@@ -64,58 +64,98 @@ const IMAGE_MAGIC = [
     [[0x47, 0x49, 0x46, 0x38], "image/gif"], // GIF8
     [[0x52, 0x49, 0x46, 0x46], "image/webp"], // RIFF (webp container)
 ];
+/** A text paste this long is prose, not a dragged file list — bail early. */
+const MAX_PASTED_PATHS = 20;
 /**
- * Recognize a pasted temp-image path written by a Ghostty-based terminal
- * (cmux, Ghostty). Those terminals name the file `clipboard-<ts>-<id>.<ext>`
- * in the system temp dir. We match strictly — clipboard- prefix, image
- * extension, real file, and genuine image magic bytes — so a path the user
- * typed by hand (e.g. /Users/me/photo.png) is never silently converted.
- * Returns the decoded image, or null when the pasted text is not one such path.
+ * Split a pasted payload into path tokens the way terminals produce them:
+ * Finder/desktop drag-drop inserts absolute paths with backslash-escaped
+ * spaces (POSIX) or quote-wrapped paths (Windows Terminal), multiple files
+ * separated by whitespace. Returns [] when the payload can't be a path list
+ * (e.g. an unbalanced quote from ordinary prose like "don't").
  */
-export function readPastedImagePath(pastedText) {
-    const trimmed = pastedText.trim();
-    if (trimmed.includes("\n") || trimmed.includes(" "))
-        return null; // one token only
-    // Validate the RAW input first: an attacker could smuggle the `clipboard-`
-    // prefix through backslash escapes (e.g. `\c\l\i\p\b\o\a\r\d-`), so we
-    // must confirm the un-escaped form is a well-formed tmp image path before any
-    // unescaping or path resolution. cmux tmp paths contain no escapable chars
-    // (no spaces/metacharacters), so a legitimate paste has NO backslashes at all.
-    // On Windows the backslash IS the path separator (and cmd/PowerShell do no
-    // backslash-escaping), so the escape-smuggling rejection applies only where
-    // a backslash could be an escape: POSIX shells.
+function splitPathTokens(text) {
     const isWindows = process.platform === "win32";
-    if (!isWindows && trimmed.includes("\\"))
-        return null; // escapes => not a plain cmux tmp path
-    const path = trimmed;
-    if (isWindows ? !isAbsolute(path) : !path.startsWith("/"))
-        return null;
-    const name = basename(path);
-    if (!name.startsWith("clipboard-"))
-        return null;
-    const ext = name.split(".").pop()?.toLowerCase() ?? "";
-    if (!(ext in IMAGE_EXT_MIME))
-        return null;
-    if (!existsSync(path))
-        return null;
-    let bytes;
-    try {
-        bytes = readFileSync(path);
-    }
-    catch {
-        return null;
+    const tokens = [];
+    let cur = "";
+    let quote = null;
+    for (let i = 0; i < text.length; i++) {
+        const ch = text[i];
+        if (quote) {
+            if (ch === quote)
+                quote = null;
+            else
+                cur += ch;
+            continue;
+        }
+        if (ch === '"' || ch === "'") {
+            quote = ch;
+            continue;
+        }
+        // POSIX shells escape spaces/metacharacters with a backslash; on Windows
+        // the backslash IS the path separator, so no unescaping there.
+        if (!isWindows && ch === "\\" && i + 1 < text.length) {
+            cur += text[++i];
+            continue;
+        }
+        if (ch === " " || ch === "\t" || ch === "\n" || ch === "\r") {
+            if (cur)
+                tokens.push(cur);
+            cur = "";
+            continue;
+        }
+        cur += ch;
     }
-    if (bytes.length === 0)
+    if (quote !== null)
+        return [];
+    if (cur)
+        tokens.push(cur);
+    return tokens;
+}
+/**
+ * Recognize a pasted payload that is entirely image-file paths and decode
+ * them. This covers Finder/desktop drag-drop and Ghostty/cmux's Cmd+V
+ * (which writes the clipboard image to a `clipboard-*.png` temp file and
+ * pastes its path) — Claude Code parity: dragging a screenshot in becomes
+ * `[Image #N]`, not a literal path.
+ *
+ * Guardrails against converting something the user meant as text: the WHOLE
+ * paste must be path tokens, every token must be an absolute path to a real
+ * file with an image extension AND genuine image magic bytes, and the
+ * conversion is visible — each image becomes a chip in the prompt, so nothing
+ * is ever attached silently. Returns null when the paste is not such a list
+ * (caller passes it through as ordinary text).
+ */
+export function readPastedImagePaths(pastedText) {
+    const tokens = splitPathTokens(pastedText.trim());
+    if (tokens.length === 0 || tokens.length > MAX_PASTED_PATHS)
         return null;
-    for (const [magic, mime] of IMAGE_MAGIC) {
-        if (magic.every((b, i) => bytes[i] === b))
-            return { bytes, mimeType: mime };
+    const isWindows = process.platform === "win32";
+    const images = [];
+    for (const path of tokens) {
+        if (isWindows ? !isAbsolute(path) : !path.startsWith("/"))
+            return null;
+        const ext = basename(path).split(".").pop()?.toLowerCase() ?? "";
+        if (!(ext in IMAGE_EXT_MIME))
+            return null;
+        if (!existsSync(path))
+            return null;
+        let bytes;
+        try {
+            bytes = readFileSync(path);
+        }
+        catch {
+            return null;
+        }
+        const magic = IMAGE_MAGIC.find(([m]) => m.every((b, i) => bytes[i] === b));
+        if (!magic)
+            return null;
+        images.push({ bytes, mimeType: magic[1] });
     }
-    return null;
+    return images;
 }
 /**
  * Read an image from the system clipboard without forking pi. Best-effort and
- * cross-platform: native module if present, else osascript/pngpaste (macOS),
+ * cross-platform using ONLY tools the OS ships with: osascript (macOS),
  * wl-paste (Wayland), xclip (X11), PowerShell (Windows/WSL). Returns null when
  * the clipboard holds no image (caller then pastes text instead).
  */
@@ -145,7 +185,45 @@ function runBase64(command, args, timeoutMs = 3000) {
     return out.length > 0 ? out : null;
 }
 function readMacClipboardImage() {
-    // pngpaste writes the clipboard image to a PNG file (cleanest on macOS).
+    return readMacClipboardViaOsascript() ?? readMacClipboardViaPngpaste();
+}
+/**
+ * Parse osascript's clipboard dump — `«data PNGf89504E47…»` — into raw bytes.
+ * The 4-char tag after `«data ` is the pasteboard flavor; the hex that follows
+ * is the image. Returns null when the output holds no such dump.
+ */
+export function parseOsascriptImageHex(out) {
+    const m = /«data \w{4}((?:[0-9A-Fa-f]{2})+)»/.exec(out);
+    if (!m)
+        return null;
+    const bytes = Buffer.from(m[1], "hex");
+    return bytes.length > 0 ? bytes : null;
+}
+function readMacClipboardViaOsascript() {
+    // AppleScript ships with macOS, so this route needs no install (it is how
+    // Claude Code reads clipboard images too). Screenshots and browser
+    // "Copy image" put a PNG flavor on the pasteboard; try JPEG second.
+    for (const [cls, mime] of [
+        ["PNGf", "image/png"],
+        ["JPEG", "image/jpeg"],
+    ]) {
+        const res = spawnSync("osascript", ["-e", `the clipboard as «class ${cls}»`], {
+            timeout: 5000,
+            maxBuffer: 256 * 1024 * 1024, // the hex dump doubles the image size
+        });
+        if (res.error || res.status !== 0)
+            continue;
+        const out = Buffer.isBuffer(res.stdout) ? res.stdout.toString("utf8") : String(res.stdout ?? "");
+        const bytes = parseOsascriptImageHex(out);
+        if (bytes)
+            return { bytes, mimeType: mime };
+    }
+    return null;
+}
+function readMacClipboardViaPngpaste() {
+    // Optional fallback for pasteboard flavors osascript can't coerce to
+    // PNG/JPEG (e.g. TIFF-only sources) — pngpaste converts anything to PNG.
+    // Nice when installed, never required.
     const dest = join(tmpdir(), `yagni-clip-${randomUUID()}.png`);
     try {
         const res = spawnSync("pngpaste", [dest], { timeout: 3000 });
@@ -222,27 +300,31 @@ export class ChipEditor extends CustomEditor {
      * Kitty-protocol terminals that genuinely deliver the Cmd modifier.
      */
     handleInput(data) {
-        // Cmd+V on Ghostty-based terminals (cmux, Ghostty): the terminal writes the
-        // clipboard image to a temp file and pastes its PATH as bracketed text, so
-        // the payload arrives here as "\x1b[200~<path>\x1b[201~" (pi's Terminal
-        // re-wraps it). handlePaste is private and consumed inside super.handleInput,
-        // so we strip the markers here and convert a bare image path to a chip.
+        // Pasted image PATHS arrive as bracketed text ("\x1b[200~<paths>\x1b[201~",
+        // pi's Terminal re-wraps every paste): Finder/desktop drag-drop inserts the
+        // file's path, and Ghostty-based terminals (cmux, Ghostty) write a Cmd+V'd
+        // clipboard image to a temp file and paste ITS path. handlePaste is private
+        // and consumed inside super.handleInput, so we strip the markers here and
+        // convert an all-image-paths payload into chips.
         const unwrapped = unwrapBracketedPaste(data);
         if (unwrapped !== null) {
-            const image = readPastedImagePath(unwrapped);
+            const images = readPastedImagePaths(unwrapped);
             logImagePaste({
                 event: "paste_path",
-                outcome: image ? "ok" : "passthrough",
-                mimeType: image?.mimeType,
-                bytes: image?.bytes.length,
-                file: image ? unwrapped : undefined,
-                detail: image ? undefined : `not a lone image path: ${unwrapped.slice(0, 60)}`,
+                outcome: images ? "ok" : "passthrough",
+                imageCount: images?.length,
+                bytes: images?.reduce((sum, i) => sum + i.bytes.length, 0),
+                detail: images ? undefined : `not an image path list: ${unwrapped.slice(0, 60)}`,
             });
-            if (image) {
-                this.dropChip(image.bytes, image.mimeType);
+            if (images) {
+                images.forEach((image, i) => {
+                    if (i > 0)
+                        this.insertTextAtCursor(" ");
+                    this.dropChip(image.bytes, image.mimeType);
+                });
                 return;
             }
-            // Not a lone image path — re-wrap and let pi handle the paste normally.
+            // Not a list of image paths — re-wrap and let pi handle the paste normally.
             super.handleInput(data);
             return;
         }

package/dist/extension/execPolicy.d.ts

@@ -0,0 +1,73 @@
+/**
+ * Exec policy engine — classifies bash commands via prefix rules + lightweight
+ * shell tokenization (YAG-504).
+ *
+ * Pure: no I/O, no network, no model. Loads at startup and classifies
+ * synchronously. The curated default set auto-allows read-only commands
+ * (ls, cat, rg, git status/log/diff), forbids destructive ones (rm -rf,
+ * git reset --hard, git push --force, pipe-to-shell), and prompts for the
+ * ambiguous middle band (npm install, git commit, curl, …).
+ *
+ * The `prompt` band is what the Guardian arbitrates — see guardian.ts.
+ *
+ * Tokenization is a lightweight inline parser — not shell-quote — because the
+ * extension is bundled into @yagni-app/code's dist (a file copy, not a real
+ * bundler), and external dependencies aren't resolvable from the bundled path.
+ * We only need: split on whitespace (respecting single/double quotes), detect
+ * control operators (|, &&, ||, ;), and flag shell constructs ($(...),
+ * backticks, redirects) that we can't statically analyze.
+ */
+export type TokenEntry = string | {
+    op: "pipe" | "and" | "or" | "semi" | "redirect" | "substitution";
+};
+/**
+ * Parse a shell command string into tokens and control operators.
+ *
+ * Handles:
+ * - Single and double quoted strings (preserves spaces inside)
+ * - Control operators: |, &&, ||, ;
+ * - Shell constructs we flag as unanalyzable: $(), backticks, >, <
+ *
+ * Does NOT handle: variable expansion, glob patterns, heredocs, nested
+ * subshells beyond the first level. Commands using those are classified
+ * as "prompt" (let the Guardian review).
+ */
+export declare function shellParse(command: string): TokenEntry[];
+export type ExecDecision = "allow" | "prompt" | "forbidden";
+export interface PrefixRule {
+    /** Ordered tokens; a string[] element means alternatives (any match). */
+    pattern: (string | string[])[];
+    decision: ExecDecision;
+    justification: string;
+    /** Positive test invocations (validated at load if present). */
+    match?: string[][];
+    /** Negative test invocations (validated at load if present). */
+    notMatch?: string[][];
+}
+export interface ExecPolicy {
+    rules: PrefixRule[];
+}
+export interface ExecClassification {
+    decision: ExecDecision;
+    justification: string;
+    matchedRule?: PrefixRule;
+}
+/**
+ * Parse a command string into tokens using our lightweight tokenizer. Returns
+ * string tokens only (control operators and constructs are filtered out —
+ * detected separately).
+ */
+export declare function tokenize(command: string): string[];
+/**
+ * Classify a full bash command string against the exec policy.
+ *
+ * Compound commands (pipes, &&, ||, ;) are split into segments and each is
+ * classified independently. The strictest decision wins (forbidden > prompt >
+ * allow). Commands with shell constructs we can't parse (command substitution,
+ * redirects beyond pipe) are classified as prompt. Pipe-to-shell is always
+ * forbidden.
+ */
+export declare function classifyCommand(command: string, policy: ExecPolicy): ExecClassification;
+/** Curated default rules — the shipped safety floor. */
+export declare const DEFAULT_EXEC_POLICY: ExecPolicy;
+//# sourceMappingURL=execPolicy.d.ts.map