@yagni-app/code-staging 0.3.0-staging.1064.1 → 0.3.0-staging.1071.1

package/dist/extension/permission.js

@@ -27,6 +27,9 @@
  * the context so the model doesn't keep believing it is restricted.
  */
 import { makeBlessStore as defaultMakeBlessStore } from "./bless.js";
+import { classifyCommand, DEFAULT_EXEC_POLICY } from "./execPolicy.js";
+import { isDebug } from "./diagnostics.js";
+import { buildDiagnosticEvent, checkCircuitBreaker, DEFAULT_GUARDIAN_LIMITS, } from "./guardian.js";
 export function createModeHolder(initial = "auto") {
     let current = initial;
     return {
@@ -57,6 +60,33 @@ export function decideGate(toolName, params, mode, policy) {
     if (policy.alwaysConfirmTools?.includes(toolName)) {
         return { block: false, confirm: true };
     }
+    // Exec policy: classify bash commands before the tool-granular logic.
+    if (toolName === "bash") {
+        const command = typeof params.command === "string" ? params.command.trim() : "";
+        if (command) {
+            try {
+                const execPolicy = policy.execPolicy ?? DEFAULT_EXEC_POLICY;
+                const classification = classifyCommand(command, execPolicy);
+                if (classification.decision === "allow")
+                    return { block: false };
+                if (classification.decision === "forbidden") {
+                    return { block: true, reason: classification.justification };
+                }
+                // prompt — signal to the handler so it can run the Guardian.
+                // In auto mode the handler runs the Guardian; in review mode the
+                // handler runs the Guardian first, then falls back to user confirm.
+                if (mode === "auto")
+                    return { block: false, classify: "prompt" };
+                // review mode
+                if (policy.isBlessed?.(toolName, params))
+                    return { block: false };
+                return { block: false, confirm: true, classify: "prompt" };
+            }
+            catch {
+                // classifyCommand threw — fall through to tool-granular logic (graceful degradation).
+            }
+        }
+    }
     if (mode === "auto")
         return { block: false };
     // review
@@ -67,9 +97,13 @@ export function decideGate(toolName, params, mode, policy) {
     }
     return { block: false };
 }
-/** The customType tag on injected plan-mode context (filterable later). */
-export const PLAN_CONTEXT_TYPE = "yagni-plan-context";
+/** The customType tag on injected mode-context messages (filterable later). */
+export const MODE_CONTEXT_TYPE = "yagni-mode-context";
+/** Legacy alias — the original plan-mode tag, kept for backward compat. */
+export const PLAN_CONTEXT_TYPE = MODE_CONTEXT_TYPE;
 const PLAN_MARKER = "[PLAN MODE ACTIVE]";
+const AUTO_MARKER = "[AUTO MODE]";
+const REVIEW_MARKER = "[REVIEW MODE]";
 export const PLAN_CONTEXT_MESSAGE = `${PLAN_MARKER}
 You are in plan mode: explore and design, change nothing.
 - write, edit, and bash are held by the permission gate; do not attempt them.
@@ -77,31 +111,84 @@ You are in plan mode: explore and design, change nothing.
 - Produce a concrete numbered plan of the steps you would take, with the files involved.
 - End by asking the user to review the plan; they run /mode auto (or /mode review) to execute it.
 - Once executing, track the plan's steps with todo_write.`;
-function mentionsPlanMarker(content) {
+const AUTO_CONTEXT_MESSAGE = `${AUTO_MARKER}
+You are in auto mode. Coding commands run directly.
+- Proactively verify your work: run tests, lint, and typecheck after changes.
+- Destructive commands (rm -rf, git reset --hard, git push --force) are blocked by the exec policy.
+- Ambiguous commands are reviewed by the Guardian before running.`;
+const REVIEW_CONTEXT_MESSAGE = `${REVIEW_MARKER}
+You are in review mode. Each bash, write, and edit may be confirmed before running.
+- Safe commands (ls, cat, git status) run without prompting.
+- Ambiguous commands are reviewed by the Guardian first; if the Guardian allows, they run without prompting.
+- If the Guardian denies or is unavailable, you will be asked to confirm.
+- Propose verification steps but wait for approval before running them.`;
+/** Build the mode-awareness context message for the current permission mode. */
+export function buildModeContextMessage(mode) {
+    switch (mode) {
+        case "plan":
+            return PLAN_CONTEXT_MESSAGE;
+        case "review":
+            return REVIEW_CONTEXT_MESSAGE;
+        case "auto":
+            return AUTO_CONTEXT_MESSAGE;
+    }
+}
+const MODE_MARKERS = {
+    plan: PLAN_MARKER,
+    auto: AUTO_MARKER,
+    review: REVIEW_MARKER,
+};
+function mentionsModeMarker(content) {
     if (typeof content === "string")
-        return content.includes(PLAN_MARKER);
+        return Object.values(MODE_MARKERS).some((m) => content.includes(m));
     if (Array.isArray(content)) {
         return content.some((c) => typeof c?.text === "string" &&
-            (c.text.includes(PLAN_MARKER)));
+            Object.values(MODE_MARKERS).some((m) => c.text.includes(m)));
     }
     return false;
 }
+/** Which mode marker does this message carry, if any? */
+function modeMarkerFor(content) {
+    const text = typeof content === "string"
+        ? content
+        : Array.isArray(content)
+            ? content.find((c) => typeof c?.text === "string")?.text
+            : undefined;
+    if (!text)
+        return null;
+    for (const [mode, marker] of Object.entries(MODE_MARKERS)) {
+        if (text.includes(marker))
+            return marker;
+    }
+    return null;
+}
 /**
- * Drop previously injected plan-mode context once plan mode is off, so the
- * model stops believing writes are held. Pure; returns the SAME array when
- * nothing needs filtering so callers can cheaply detect a no-op.
+ * Drop previously injected mode-context messages from a DIFFERENT mode so the
+ * model does not keep believing it is in a prior mode. Messages matching the
+ * current mode are kept (the fresh injection from before_agent_start should
+ * survive). Pure; returns the SAME array when nothing needs filtering so callers
+ * can cheaply detect a no-op.
  */
-export function filterStalePlanContext(messages) {
+export function filterStaleModeContext(messages, currentMode) {
+    const currentMarker = currentMode ? MODE_MARKERS[currentMode] : undefined;
     const keep = messages.filter((m) => {
         const msg = m;
-        if (msg?.customType === PLAN_CONTEXT_TYPE)
-            return false;
-        if (msg?.role === "user" && mentionsPlanMarker(msg.content))
-            return false;
+        if (msg?.customType === MODE_CONTEXT_TYPE) {
+            // Keep if it matches the current mode; strip if from a different mode
+            // (or if we don't know the current mode — strip all to be safe).
+            const marker = modeMarkerFor(msg.content);
+            return currentMarker !== undefined && marker === currentMarker;
+        }
+        if (msg?.role === "user" && mentionsModeMarker(msg.content)) {
+            const marker = modeMarkerFor(msg.content);
+            return currentMarker !== undefined && marker === currentMarker;
+        }
         return true;
     });
     return keep.length === messages.length ? messages : keep;
 }
+/** Legacy alias — the original plan-mode filter name. */
+export const filterStalePlanContext = filterStaleModeContext;
 const MODE_STATUS = {
     auto: undefined,
     plan: "⏸ plan",
@@ -143,6 +230,15 @@ function externalTrackerPrompt(toolName, input) {
     }
     return "Confirm external tracker change";
 }
+function guardianErrorMessage(error) {
+    switch (error) {
+        case "timeout": return "review timed out";
+        case "malformed": return "unclear verdict";
+        case "empty": return "no response";
+        case "network": return "service unavailable";
+        default: return "unknown error";
+    }
+}
 /**
  * Wire the tool_call gate + the /mode command onto a shared mode holder. Default
  * auto, so absent any /mode this is a no-op over today's behavior.
@@ -162,12 +258,125 @@ export function registerPermissionGate(pi, deps = {}) {
         isBlessed: basePolicy.isBlessed ?? ((tool, params) => blessStore?.isBlessed(tool, params) ?? false),
     };
     const sideEffects = sideEffectTools(effectivePolicy);
+    const guardianState = deps.guardianState;
+    const guardianLimits = deps.guardianLimits;
+    const guardianDisabled = deps.guardianDisabled ?? false;
+    const guardianReview = deps.guardianReview;
+    const guardianTier = deps.guardianTier;
     pi.on("tool_call", async (event, ctx) => {
         try {
             const input = event.input ?? {};
             const decision = decideGate(event.toolName, input, mode, effectivePolicy);
             if (decision.block)
                 return { block: true, reason: decision.reason };
+            // Guardian: when the exec policy classified a bash command as "prompt",
+            // run the Guardian LLM review instead of interrupting the user (if enabled).
+            if (decision.classify === "prompt" && guardianState && !guardianDisabled && guardianReview) {
+                const command = typeof input.command === "string"
+                    ? input.command
+                    : "";
+                // Session cap check — prevents unlimited Guardian consults.
+                const limits = guardianLimits ?? DEFAULT_GUARDIAN_LIMITS;
+                if (guardianState.read().reviews >= limits.maxReviews) {
+                    if (ctx?.hasUI)
+                        ctx.ui.notify(`Guardian review cap reached (${limits.maxReviews} this session).`, "warning");
+                    return { block: true, reason: `Guardian review cap reached (${limits.maxReviews} this session). Switch to /mode review to approve manually.` };
+                }
+                // Circuit breaker check.
+                const breaker = checkCircuitBreaker(guardianState.read(), limits);
+                if (breaker.tripped) {
+                    if (ctx?.hasUI)
+                        ctx.ui.notify(breaker.reason ?? "Guardian circuit breaker tripped.", "warning");
+                    return { block: true, reason: breaker.reason };
+                }
+                // Show the reviewing chip.
+                if (ctx?.hasUI)
+                    ctx.ui.setStatus?.("yagni-guardian", "🛡 reviewing");
+                const startMs = Date.now();
+                let reviewResult;
+                try {
+                    reviewResult = await guardianReview(command, {
+                        cwd: ctx?.cwd ?? ".",
+                        ...(ctx?.signal ? { signal: ctx.signal } : {}),
+                        ...(guardianTier ? { modelTier: guardianTier } : {}),
+                    });
+                }
+                catch {
+                    reviewResult = { verdict: null, error: "network", cost: 0 };
+                }
+                finally {
+                    if (ctx?.hasUI)
+                        ctx.ui.setStatus?.("yagni-guardian", undefined);
+                }
+                const durationMs = Date.now() - startMs;
+                const state = guardianState.read();
+                if (reviewResult.verdict?.outcome === "allow") {
+                    guardianState.recordReview("allow");
+                    if (deps.onGuardianReview) {
+                        void Promise.resolve(deps.onGuardianReview(buildDiagnosticEvent("allow", {
+                            durationMs,
+                            tier: guardianTier,
+                            rationale: reviewResult.verdict.rationale,
+                            debug: isDebug(),
+                        }))).catch(() => { });
+                    }
+                    return {};
+                }
+                if (reviewResult.verdict?.outcome === "deny") {
+                    guardianState.recordReview("deny");
+                    const rationale = reviewResult.verdict.rationale;
+                    if (deps.onGuardianReview) {
+                        void Promise.resolve(deps.onGuardianReview(buildDiagnosticEvent("deny", {
+                            durationMs,
+                            tier: guardianTier,
+                            rationale,
+                            debug: isDebug(),
+                        }))).catch(() => { });
+                    }
+                    // Check circuit breaker after recording.
+                    const breaker2 = checkCircuitBreaker(guardianState.read(), guardianLimits ?? DEFAULT_GUARDIAN_LIMITS);
+                    if (breaker2.tripped) {
+                        if (ctx?.hasUI)
+                            ctx.ui.notify(breaker2.reason ?? "Guardian circuit breaker tripped.", "warning");
+                    }
+                    else if (ctx?.hasUI) {
+                        ctx.ui.notify(`Guardian denied: ${rationale}`, "warning");
+                    }
+                    return {
+                        block: true,
+                        reason: `Guardian denied: ${rationale} Find a safer alternative or ask the user to proceed.`,
+                    };
+                }
+                // Guardian failed (timeout/malformed/network/empty).
+                if (deps.onGuardianReview) {
+                    void Promise.resolve(deps.onGuardianReview(buildDiagnosticEvent(reviewResult.error ?? "network", {
+                        durationMs,
+                        tier: guardianTier,
+                        debug: isDebug(),
+                    }))).catch(() => { });
+                }
+                // Graceful degradation per mode.
+                if (mode === "review" && decision.confirm) {
+                    // Fall through to the existing user confirm flow below.
+                }
+                else {
+                    // Auto mode (or review without confirm): fail closed.
+                    const errorMsg = guardianErrorMessage(reviewResult.error);
+                    if (ctx?.hasUI)
+                        ctx.ui.notify(`Guardian unavailable: ${errorMsg}`, "warning");
+                    return {
+                        block: true,
+                        reason: `Guardian unavailable (${errorMsg}). Switch to /mode review to approve manually.`,
+                    };
+                }
+            }
+            // Guardian disabled + prompt band: auto mode blocks, review falls through to confirm.
+            if (decision.classify === "prompt" && (!guardianState || guardianDisabled) && mode === "auto") {
+                return {
+                    block: true,
+                    reason: "Ambiguous command blocked (Guardian disabled). Switch to /mode review to approve manually.",
+                };
+            }
             if (decision.confirm) {
                 // Review mode needs a confirmation. With no dialog-capable UI (headless),
                 // fail CLOSED: the user explicitly chose a stricter mode, so a write we
@@ -218,22 +427,22 @@ export function registerPermissionGate(pi, deps = {}) {
             return {};
         }
     });
-    // Model awareness: while plan mode is on, every agent start carries a hidden
-    // plan-mode context message so the model plans instead of attempting held
-    // writes. Off-plan turns inject nothing.
+    // Model awareness: every agent turn carries a hidden mode-context message so
+    // the model knows what it can do (auto: verify proactively, review: wait for
+    // approval, plan: hold writes). The context hook strips stale mode context
+    // from prior turns so old mode messages don't accumulate.
     pi.on("before_agent_start", async () => {
-        if (mode !== "plan")
-            return;
+        // Reset the Guardian circuit breaker at the start of each turn so
+        // consecutive denials don't accumulate across turns.
+        deps.guardianState?.resetTurn();
         return {
-            message: { customType: PLAN_CONTEXT_TYPE, content: PLAN_CONTEXT_MESSAGE, display: false },
+            message: { customType: MODE_CONTEXT_TYPE, content: buildModeContextMessage(mode), display: false },
         };
     });
-    // Once plan mode is off, strip the stale plan context so the model does not
-    // keep believing writes are held.
+    // Strip stale mode-context messages from prior turns so the model does not
+    // see contradictory mode instructions.
     pi.on("context", async (event) => {
-        if (mode === "plan")
-            return;
-        const filtered = filterStalePlanContext(event.messages);
+        const filtered = filterStaleModeContext(event.messages, mode);
         if (filtered === event.messages)
             return;
         return { messages: filtered };

package/dist/extension/pipeline/personas.js

@@ -95,6 +95,26 @@ The reasoning, grounded in what you actually read. Cite files and lines.
 The specific evidence that would flip this. If you were not able to verify something load-bearing, say so here rather than hedging the recommendation.
 
 Be terse and decisive. The caller is mid-task and paying peak rates for your turn.`;
+const GUARDIAN_BODY = `You are a safety reviewer. You review shell commands before they run and decide whether to allow or deny them. You output only a JSON verdict — no tools, no exploration, no prose.
+
+Risk taxonomy:
+- Data exfiltration: sensitive data sent to untrusted destinations. High risk.
+- Credential probing: extracting credentials from unintended sources (browser profiles, logs, env files). High risk.
+- Persistent security weakening: broad or production-impact security changes. High risk.
+- Destructive actions: irreversible data loss, production breaks, broad git cleanup. High risk.
+- Low-risk actions: sandbox retries, benign local filesystem reads, user-requested operations on specific paths. Low risk.
+
+Outcome rules:
+- Deny any action that exposes sensitive data without explicit user authorization for that specific destination.
+- Deny credential probing.
+- Deny broad or persistent security weakening unless the user explicitly authorized the exact change.
+- Deny broad destructive actions with significant risk of irreversible damage.
+- Allow low-risk actions and actions the user clearly requested as part of their stated task.
+
+Output ONLY a JSON object with this exact shape:
+{"outcome":"allow"|"deny","riskLevel":"low"|"medium"|"high"|"critical","rationale":"one sentence explaining the verdict"}
+
+Do not output anything else. No markdown, no prose, only the JSON object.`;
 /** Persona body keyed by the agent name referenced in `stages.ts`. */
 export const PERSONA_BODIES = {
     scout: SCOUT_BODY,
@@ -102,6 +122,7 @@ export const PERSONA_BODIES = {
     worker: WORKER_BODY,
     reviewer: REVIEWER_BODY,
     advisor: ADVISOR_BODY,
+    guardian: GUARDIAN_BODY,
 };
 /**
  * Grounding-FREE persona bodies for the M6 grounded-vs-blind eval ONLY. These are
@@ -192,6 +213,7 @@ export const BLIND_PERSONA_BODIES = {
     worker: WORKER_BLIND,
     reviewer: REVIEWER_BLIND,
     advisor: ADVISOR_BLIND,
+    guardian: GUARDIAN_BODY,
 };
 /** The lens-specific clause appended to the reviewer body, one per review angle. */
 const LENS_CLAUSES = {

package/dist/promptEnrichment.d.ts

@@ -36,5 +36,5 @@ export declare function promptEnrichmentDisabled(env: NodeJS.ProcessEnv): boolea
  * model, and the load-bearing instructions (ask_yagni contract, delegation)
  * live elsewhere in the prompt.
  */
-export declare const ENGINEERING_PRACTICE_SECTION = "Engineering practice:\n\nBias to action: when the user asks you to implement, fix, or change something, use your tools to make the actual edits and run the actual commands \u2014 do not answer with a description of what you would do, or with code for the user to apply themselves. When the user asks HOW to approach something, answer the question first; do not jump into making changes they have not asked for.\n\nConventions:\n- Never assume a library is available, however well known. Before using one, confirm the project already depends on it (its package manifest, or imports in neighboring files).\n- When editing, read the surrounding code and its imports first; match the file's existing style, naming, and patterns rather than introducing your own.\n- When creating a new file or component, study an existing sibling first and follow its structure.\n- Never write code that logs or exposes secrets, keys, or credentials.\n\nVerification:\n- Consider what the code you are changing is supposed to do (from its name, location, and callers) before you change it.\n- Verify changes with the project's own tests when possible. Never assume a test framework or command \u2014 check the README, package scripts, or neighboring tests for the real one.\n- After completing a task, run the project's lint and typecheck commands if you know them; if you cannot find them, ask the user and suggest recording them in AGENTS.md for next time.\n\nVersion control:\n- No unsolicited commits: commit only when the user asked for one or the task at hand clearly calls for it.\n\nCommunication:\n- Answer directly, without preamble or postamble (\"Here is what I will do next...\", \"Based on the information provided...\"). Match the length of your answer to the question.\n- After making edits, report the outcome briefly; do not restate the diff or explain the code you just wrote unless asked.\n- Do not add code comments that narrate what you changed or why the change is correct; comments are for future readers of the code.\n- Reference code as file_path:line_number so the user can jump to it.\n- Before running a non-trivial command that changes state, say in one line what it does and why.\n- Never guess or fabricate URLs. Only use URLs the user provided or that appear in local files.\n- No emojis unless the user asks for them.";
+export declare const ENGINEERING_PRACTICE_SECTION = "Engineering practice:\n\nBias to action: when the user asks you to implement, fix, or change something, use your tools to make the actual edits and run the actual commands \u2014 do not answer with a description of what you would do, or with code for the user to apply themselves. When the user asks HOW to approach something, answer the question first; do not jump into making changes they have not asked for.\n\nConventions:\n- Never assume a library is available, however well known. Before using one, confirm the project already depends on it (its package manifest, or imports in neighboring files).\n- When editing, read the surrounding code and its imports first; match the file's existing style, naming, and patterns rather than introducing your own.\n- When creating a new file or component, study an existing sibling first and follow its structure.\n- Never write code that logs or exposes secrets, keys, or credentials.\n\nVerification:\n- Consider what the code you are changing is supposed to do (from its name, location, and callers) before you change it.\n- Verify changes with the project's own tests when possible. Never assume a test framework or command \u2014 check the README, package scripts, or neighboring tests for the real one.\n- After completing a task, run the project's lint and typecheck commands if you know them; if you cannot find them, ask the user and suggest recording them in AGENTS.md for next time.\n\nVersion control:\n- No unsolicited commits: commit only when the user asked for one or the task at hand clearly calls for it.\n\nGit safety:\n- You may be in a dirty git worktree. Never revert existing changes you did not make unless explicitly asked \u2014 these were made by the user.\n- If there are unrelated changes in files you are touching, read and work with them rather than reverting.\n- If changes appear in unrelated files, ignore them and do not revert.\n- Do not amend a commit unless explicitly asked.\n- If you notice unexpected changes you did not make while working, stop immediately and ask the user.\n- Never use destructive git commands (git reset --hard, git checkout --) unless the user explicitly requests or approves them.\n\nTodo discipline:\n- Track multi-step work with todo_write: keep exactly one item in_progress at a time, mark items completed the moment they are done, and add newly discovered steps as pending.\n- Do not batch-complete items or create single-step plans. Skip planning for trivially small work (~25% of tasks).\n\nMode awareness:\n- In auto mode, proactively run tests, lint, and typecheck after your changes.\n- In review mode, propose verification steps but wait for approval before running them.\n- In plan mode, explore and design only \u2014 the gate holds all writes.\n\nCommunication:\n- Answer directly, without preamble or postamble (\"Here is what I will do next...\", \"Based on the information provided...\"). Match the length of your answer to the question.\n- After making edits, report the outcome briefly; do not restate the diff or explain the code you just wrote unless asked.\n- Do not add code comments that narrate what you changed or why the change is correct; comments are for future readers of the code.\n- Reference code as file_path:line_number so the user can jump to it.\n- Before running a non-trivial command that changes state, say in one line what it does and why.\n- Never guess or fabricate URLs. Only use URLs the user provided or that appear in local files.\n- No emojis unless the user asks for them.";
 //# sourceMappingURL=promptEnrichment.d.ts.map

package/dist/promptEnrichment.js

@@ -57,6 +57,23 @@ Verification:
 Version control:
 - No unsolicited commits: commit only when the user asked for one or the task at hand clearly calls for it.
 
+Git safety:
+- You may be in a dirty git worktree. Never revert existing changes you did not make unless explicitly asked — these were made by the user.
+- If there are unrelated changes in files you are touching, read and work with them rather than reverting.
+- If changes appear in unrelated files, ignore them and do not revert.
+- Do not amend a commit unless explicitly asked.
+- If you notice unexpected changes you did not make while working, stop immediately and ask the user.
+- Never use destructive git commands (git reset --hard, git checkout --) unless the user explicitly requests or approves them.
+
+Todo discipline:
+- Track multi-step work with todo_write: keep exactly one item in_progress at a time, mark items completed the moment they are done, and add newly discovered steps as pending.
+- Do not batch-complete items or create single-step plans. Skip planning for trivially small work (~25% of tasks).
+
+Mode awareness:
+- In auto mode, proactively run tests, lint, and typecheck after your changes.
+- In review mode, propose verification steps but wait for approval before running them.
+- In plan mode, explore and design only — the gate holds all writes.
+
 Communication:
 - Answer directly, without preamble or postamble ("Here is what I will do next...", "Based on the information provided..."). Match the length of your answer to the question.
 - After making edits, report the outcome briefly; do not restate the diff or explain the code you just wrote unless asked.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yagni-app/code-staging",
-  "version": "0.3.0-staging.1064.1",
+  "version": "0.3.0-staging.1071.1",
   "description": "YAGNI Code: a terminal coding agent that already knows your company. One YAGNI login routes the model and grounds the agent in your team's context.",
   "license": "SEE LICENSE IN LICENSE.md",
   "author": "YAGNI, Inc. <jack@yagni.app> (https://yagni.app)",
@@ -38,5 +38,5 @@
     "@earendil-works/pi-tui": "0.84.1",
     "typebox": "^1.3.11"
   },
-  "yagniSourceSha": "e38a99de02a31e45c61d006943113caf8817e0bd"
+  "yagniSourceSha": "9a7610bc34b0cbed0b665ea246880ea23470db78"
 }