@yagni-app/code-staging 0.3.0-staging.1071.1 → 0.3.0-staging.1073.1

package/dist/extension/config.d.ts

@@ -72,13 +72,23 @@ export interface FetchCatalogOptions {
     getToken: () => string | undefined;
     fetchImpl?: typeof fetch;
 }
+/** The startup catalog response from GET /api/yagni-code/models. */
+export interface CatalogResult {
+    models: ModelEntry[];
+    /**
+     * Per-workspace Guardian kill switch (yagni_code.guardian). Fail-safe:
+     * only an explicit `false` from the backend disables the Guardian — a
+     * missing field (older backend) reads as enabled.
+     */
+    guardianEnabled: boolean;
+}
 /**
  * Fetch the YAGNI model catalog at startup.
  *
  * @throws an actionable Error (mentioning `yagni login`) on any non-2xx
  * response so the launcher can surface a clear re-authentication prompt.
  */
-export declare function fetchCatalog(opts: FetchCatalogOptions): Promise<ModelEntry[]>;
+export declare function fetchCatalog(opts: FetchCatalogOptions): Promise<CatalogResult>;
 /** The startup company brief returned by GET /api/yagni-code/context. */
 export interface ContextBrief {
     brief: string;

package/dist/extension/config.js

@@ -85,7 +85,7 @@ export async function fetchCatalog(opts) {
         throw new Error(`Failed to fetch YAGNI model catalog (HTTP ${res.status}). Run \`yagni login\` to re-authenticate.`);
     }
     const data = (await res.json());
-    return data.models;
+    return { models: data.models, guardianEnabled: data.guardianEnabled !== false };
 }
 /** Shape-check for a caller label: mirrors the model proxy's own validation regex. */
 const CALLER_LABEL_RE = /^[a-z0-9][a-z0-9:_.-]{0,63}$/i;

package/dist/extension/execPolicy.d.ts

@@ -39,6 +39,14 @@ export interface PrefixRule {
     pattern: (string | string[])[];
     decision: ExecDecision;
     justification: string;
+    /**
+     * Escape hatch for allow rules whose command has a mutating flag: if any
+     * token AFTER the matched prefix equals one of these (or, for entries ending
+     * in "*", starts with the part before the star), the rule does NOT match and
+     * evaluation falls through to later rules (usually landing in the prompt
+     * band). Example: sed is read-only except with -i/--in-place.
+     */
+    unlessTokens?: string[];
     /** Positive test invocations (validated at load if present). */
     match?: string[][];
     /** Negative test invocations (validated at load if present). */

package/dist/extension/execPolicy.js

@@ -243,6 +243,17 @@ function matchRule(tokens, rule) {
                 return false;
         }
     }
+    if (rule.unlessTokens) {
+        for (const tok of tokens.slice(rule.pattern.length)) {
+            for (const unless of rule.unlessTokens) {
+                const matches = unless.endsWith("*")
+                    ? tok.startsWith(unless.slice(0, -1))
+                    : tok === unless;
+                if (matches)
+                    return false;
+            }
+        }
+    }
     return true;
 }
 /** Classify a single command segment (no shell constructs). */
@@ -340,11 +351,43 @@ export const DEFAULT_EXEC_POLICY = {
         { pattern: ["true"], decision: "allow", justification: "no-op success" },
         { pattern: ["false"], decision: "allow", justification: "no-op failure" },
         { pattern: ["test"], decision: "allow", justification: "test condition" },
-        { pattern: ["find", ".", "-name"], decision: "allow", justification: "search for files by name" },
-        { pattern: ["find", ".", "-type"], decision: "allow", justification: "search for files by type" },
+        {
+            pattern: ["find"],
+            decision: "allow",
+            justification: "search for files (read-only without -delete/-exec)",
+            unlessTokens: ["-delete", "-exec", "-execdir", "-ok", "-okdir", "-fprint*", "-fls"],
+        },
         { pattern: ["grep"], decision: "allow", justification: "search text" },
         { pattern: ["rg"], decision: "allow", justification: "search text (ripgrep)" },
         { pattern: ["ag"], decision: "allow", justification: "search text (silver searcher)" },
+        { pattern: ["cd"], decision: "allow", justification: "change directory (scoped to this bash invocation)" },
+        {
+            pattern: ["sed"],
+            decision: "allow",
+            justification: "stream-edit text to stdout (read-only without -i)",
+            unlessTokens: ["-i*", "--in-place*"],
+        },
+        { pattern: ["awk"], decision: "allow", justification: "text processing to stdout" },
+        { pattern: ["sort"], decision: "allow", justification: "sort lines" },
+        { pattern: ["uniq"], decision: "allow", justification: "filter duplicate lines" },
+        { pattern: ["cut"], decision: "allow", justification: "extract columns" },
+        { pattern: ["tr"], decision: "allow", justification: "translate characters" },
+        { pattern: ["diff"], decision: "allow", justification: "compare files" },
+        { pattern: ["nl"], decision: "allow", justification: "number lines" },
+        { pattern: ["jq"], decision: "allow", justification: "filter JSON to stdout" },
+        { pattern: ["stat"], decision: "allow", justification: "show file metadata" },
+        { pattern: ["file"], decision: "allow", justification: "identify file type" },
+        { pattern: ["basename"], decision: "allow", justification: "strip directory from path" },
+        { pattern: ["dirname"], decision: "allow", justification: "extract directory from path" },
+        { pattern: ["realpath"], decision: "allow", justification: "resolve a path" },
+        { pattern: ["readlink"], decision: "allow", justification: "resolve a symlink" },
+        { pattern: ["tree"], decision: "allow", justification: "list directory tree" },
+        { pattern: ["du"], decision: "allow", justification: "show disk usage" },
+        { pattern: ["df"], decision: "allow", justification: "show filesystem usage" },
+        { pattern: ["date"], decision: "allow", justification: "show date/time" },
+        { pattern: ["printf"], decision: "allow", justification: "print formatted text" },
+        { pattern: ["whoami"], decision: "allow", justification: "show current user" },
+        { pattern: ["uname"], decision: "allow", justification: "show system info" },
         { pattern: ["git", "status"], decision: "allow", justification: "show working tree status" },
         { pattern: ["git", "log"], decision: "allow", justification: "show commit log" },
         { pattern: ["git", "diff"], decision: "allow", justification: "show changes" },
@@ -353,6 +396,17 @@ export const DEFAULT_EXEC_POLICY = {
         { pattern: ["git", "remote"], decision: "allow", justification: "list remotes" },
         { pattern: ["git", "rev-parse"], decision: "allow", justification: "resolve git refs" },
         { pattern: ["git", "worktree", "list"], decision: "allow", justification: "list worktrees" },
+        { pattern: ["git", "blame"], decision: "allow", justification: "show line authorship" },
+        { pattern: ["git", "grep"], decision: "allow", justification: "search tracked files" },
+        { pattern: ["git", "ls-files"], decision: "allow", justification: "list tracked files" },
+        { pattern: ["git", "describe"], decision: "allow", justification: "describe a commit" },
+        { pattern: ["git", "shortlog"], decision: "allow", justification: "summarize commit log" },
+        { pattern: ["git", "stash", "list"], decision: "allow", justification: "list stashes" },
+        { pattern: ["gh", "pr", ["view", "list", "diff", "checks", "status"]], decision: "allow", justification: "read pull request data" },
+        { pattern: ["gh", "issue", ["view", "list", "status"]], decision: "allow", justification: "read issue data" },
+        { pattern: ["gh", "run", ["view", "list"]], decision: "allow", justification: "read workflow run data" },
+        { pattern: ["gh", "repo", "view"], decision: "allow", justification: "read repository data" },
+        { pattern: ["gh", "search"], decision: "allow", justification: "search GitHub" },
         { pattern: ["node", "--version"], decision: "allow", justification: "check node version" },
         { pattern: ["node", "-v"], decision: "allow", justification: "check node version" },
         { pattern: ["npm", "ls"], decision: "allow", justification: "list installed packages" },

package/dist/extension/guardian.d.ts

@@ -37,6 +37,12 @@ export interface GuardianLimits {
     timeoutMs: number;
 }
 export declare const DEFAULT_GUARDIAN_LIMITS: GuardianLimits;
+/**
+ * Resolve Guardian limits from the environment. `YAGNI_GUARDIAN_MAX_REVIEWS`
+ * overrides the session review cap; anything non-numeric or < 1 falls back to
+ * the default (a bad value must never zero out the cap and lock the session).
+ */
+export declare function resolveGuardianLimits(env?: Record<string, string | undefined>): GuardianLimits;
 /** The model tier the Guardian runs on. Configurable via YAGNI_GUARDIAN_TIER. */
 export declare const GUARDIAN_MODEL_TIER = "efficient";
 /** Read-only tools — the Guardian can read files for context but cannot write or execute. */

package/dist/extension/guardian.js

@@ -25,6 +25,17 @@ export const DEFAULT_GUARDIAN_LIMITS = {
     maxConsecutiveDenials: 3,
     timeoutMs: 15_000,
 };
+/**
+ * Resolve Guardian limits from the environment. `YAGNI_GUARDIAN_MAX_REVIEWS`
+ * overrides the session review cap; anything non-numeric or < 1 falls back to
+ * the default (a bad value must never zero out the cap and lock the session).
+ */
+export function resolveGuardianLimits(env = process.env) {
+    const raw = env.YAGNI_GUARDIAN_MAX_REVIEWS?.trim();
+    const parsed = raw ? Number.parseInt(raw, 10) : NaN;
+    const maxReviews = Number.isFinite(parsed) && parsed >= 1 ? parsed : DEFAULT_GUARDIAN_LIMITS.maxReviews;
+    return { ...DEFAULT_GUARDIAN_LIMITS, maxReviews };
+}
 /** The model tier the Guardian runs on. Configurable via YAGNI_GUARDIAN_TIER. */
 export const GUARDIAN_MODEL_TIER = "efficient";
 /** Read-only tools — the Guardian can read files for context but cannot write or execute. */

package/dist/extension/index.d.ts

@@ -4,7 +4,7 @@ import { runInitPass as defaultRunInitPass } from "./initPass.js";
 import { fetchMcpServers as defaultFetchMcpServers } from "./mcpTools.js";
 import { type FlushOutcome, type SpoolClientOpts } from "./spool.js";
 import { type TokenProvider } from "./tokenProvider.js";
-import { type ContextBrief, type ModelEntry } from "./config.js";
+import { type CatalogResult, type ContextBrief } from "./config.js";
 /**
  * YAGNI Code extension entry point.
  *
@@ -31,7 +31,7 @@ export interface RegisterYagniDeps {
         baseUrl: string;
         getToken: () => string | undefined;
         fetchImpl?: typeof fetch;
-    }) => Promise<ModelEntry[]>;
+    }) => Promise<CatalogResult>;
     fetchContextBrief?: (opts: {
         baseUrl: string;
         getToken: () => string | undefined;
@@ -106,7 +106,7 @@ export { makeAskYagniTool } from "./askYagniTool.js";
 export { makeFileTicketTool, makeUpdateTicketStatusTool } from "./ticketTools.js";
 export { makeAskAdvisorTool, registerAdviseCommand } from "./askAdvisorTool.js";
 export { ADVISOR_TIER, DEFAULT_ADVISOR_LIMITS, decideConsult, formatAdvisorSubtotal, makeAdvisorState, } from "./advisor.js";
-export { DEFAULT_GUARDIAN_LIMITS, GUARDIAN_MODEL_TIER, formatGuardianSubtotal, makeGuardianState, reviewCommand, } from "./guardian.js";
+export { DEFAULT_GUARDIAN_LIMITS, GUARDIAN_MODEL_TIER, formatGuardianSubtotal, makeGuardianState, resolveGuardianLimits, reviewCommand, } from "./guardian.js";
 export type { GuardianOutcome, GuardianVerdict, GuardianState, GuardianStateHandle, GuardianLimits, ReviewResult, ReviewCommandDeps, } from "./guardian.js";
 export type { Citation, MakeAskYagniToolOptions } from "./askYagniTool.js";
 export { makeReviewBusinessMatchTool } from "./reviewTool.js";
@@ -124,7 +124,7 @@ export type { RunInitPassDeps, InitPassOutcome, RunTeamSetupDeps, TeamSetupOutco
 export { isInitDone, markInitDone, initDoneMarkerFile, _setInitDoneHomeForTest } from "./initDone.js";
 export { brandSystemPrompt, YAGNI_IDENTITY, YAGNI_IDENTITY_DRIVER, BRAND_NAME } from "./branding.js";
 export { attributionHeaders, isDriverCaller, fetchCatalog, getToken, getWorkspaceId, resolveBaseUrl, sanitizeCallerSegment, } from "./config.js";
-export type { FetchCatalogOptions, ModelEntry } from "./config.js";
+export type { CatalogResult, FetchCatalogOptions, ModelEntry } from "./config.js";
 export { buildYagniProvider } from "./provider.js";
 export { registerGoCommand } from "./pipeline/goCommand.js";
 export type { RegisterGoDeps } from "./pipeline/goCommand.js";

package/dist/extension/index.js

@@ -2,7 +2,7 @@ import { appendFileSync, mkdirSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { Text } from "@earendil-works/pi-tui";
 import { DEFAULT_ADVISOR_LIMITS, formatAdvisorSubtotal, makeAdvisorState } from "./advisor.js";
-import { DEFAULT_GUARDIAN_LIMITS, formatGuardianSubtotal, GUARDIAN_MODEL_TIER, makeGuardianState, reviewCommand } from "./guardian.js";
+import { formatGuardianSubtotal, GUARDIAN_MODEL_TIER, makeGuardianState, resolveGuardianLimits, reviewCommand } from "./guardian.js";
 import { makeAskAdvisorTool, registerAdviseCommand } from "./askAdvisorTool.js";
 import { makeAskYagniTool } from "./askYagniTool.js";
 import { makeFileTicketTool, makeUpdateTicketStatusTool } from "./ticketTools.js";
@@ -127,7 +127,7 @@ export async function registerYagni(pi, deps = {}) {
     // after_provider_response event does NOT fire on a 401 (the OpenAI SDK throws
     // before onResponse is reached), so message_end is the only seam.
     let lastAuthRecovery = null;
-    const fullCatalog = await fetchCatalog({ baseUrl, getToken: getTokenFn, fetchImpl: authedFetch });
+    const { models: fullCatalog, guardianEnabled: workspaceGuardianEnabled } = await fetchCatalog({ baseUrl, getToken: getTokenFn, fetchImpl: authedFetch });
     // Lock the interactive session to the `advanced` tier only. The backend
     // catalog returns all tiers, but only `advanced` is registered with the
     // `yagni` provider, so /model and Ctrl+P show a single entry. Child
@@ -236,12 +236,19 @@ export async function registerYagni(pi, deps = {}) {
     // holds them, review mode confirms them.
     const modeHolder = createModeHolder();
     const guardianState = makeGuardianState();
-    const guardianDisabled = env.YAGNI_DISABLE_GUARDIAN === "1" || env.YAGNI_DISABLE_GUARDIAN === "true";
+    // Disabled by the local env override OR the workspace kill switch
+    // (yagni_code.guardian, read from the catalog response at launch). The env
+    // var wins for a single developer's debugging; the flag turns it off for
+    // every session in the workspace.
+    const guardianDisabled = env.YAGNI_DISABLE_GUARDIAN === "1" ||
+        env.YAGNI_DISABLE_GUARDIAN === "true" ||
+        !workspaceGuardianEnabled;
     const guardianTier = env.YAGNI_GUARDIAN_TIER ?? GUARDIAN_MODEL_TIER;
+    const guardianLimits = resolveGuardianLimits(env);
     registerPermissionGate(pi, {
         modeHolder,
         guardianState,
-        guardianLimits: DEFAULT_GUARDIAN_LIMITS,
+        guardianLimits,
         guardianTier,
         guardianDisabled,
         guardianReview: (command, deps) => reviewCommand(command, { ...deps, modelTier: guardianTier }),
@@ -292,7 +299,7 @@ export async function registerYagni(pi, deps = {}) {
         // spend as an ordinary caller row.
         advisorSubtotal: () => {
             const advisor = formatAdvisorSubtotal(advisorState.read(), DEFAULT_ADVISOR_LIMITS);
-            const guardian = formatGuardianSubtotal(guardianState.read(), DEFAULT_GUARDIAN_LIMITS);
+            const guardian = formatGuardianSubtotal(guardianState.read(), guardianLimits);
             return [advisor, guardian].filter(Boolean).join(" ");
         },
         fetchHeadroom: async (signal) => {
@@ -674,7 +681,7 @@ export { makeAskYagniTool } from "./askYagniTool.js";
 export { makeFileTicketTool, makeUpdateTicketStatusTool } from "./ticketTools.js";
 export { makeAskAdvisorTool, registerAdviseCommand } from "./askAdvisorTool.js";
 export { ADVISOR_TIER, DEFAULT_ADVISOR_LIMITS, decideConsult, formatAdvisorSubtotal, makeAdvisorState, } from "./advisor.js";
-export { DEFAULT_GUARDIAN_LIMITS, GUARDIAN_MODEL_TIER, formatGuardianSubtotal, makeGuardianState, reviewCommand, } from "./guardian.js";
+export { DEFAULT_GUARDIAN_LIMITS, GUARDIAN_MODEL_TIER, formatGuardianSubtotal, makeGuardianState, resolveGuardianLimits, reviewCommand, } from "./guardian.js";
 export { makeReviewBusinessMatchTool } from "./reviewTool.js";
 export { makeRecordEngineeringContextTool } from "./recordContextTool.js";
 export { makeRecordDecisionTool } from "./recordDecisionTool.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yagni-app/code-staging",
-  "version": "0.3.0-staging.1071.1",
+  "version": "0.3.0-staging.1073.1",
   "description": "YAGNI Code: a terminal coding agent that already knows your company. One YAGNI login routes the model and grounds the agent in your team's context.",
   "license": "SEE LICENSE IN LICENSE.md",
   "author": "YAGNI, Inc. <jack@yagni.app> (https://yagni.app)",
@@ -38,5 +38,5 @@
     "@earendil-works/pi-tui": "0.84.1",
     "typebox": "^1.3.11"
   },
-  "yagniSourceSha": "9a7610bc34b0cbed0b665ea246880ea23470db78"
+  "yagniSourceSha": "4f5ad5c10b5601f93f1802ae9cf541a4670f7963"
 }