@yagni-app/code-staging 0.3.0-staging.1088.1 → 0.3.0-staging.1090.1

package/dist/extension/approvedPrefixes.d.ts

@@ -73,6 +73,17 @@ export declare function matchesGrant(command: string, grants: readonly ApprovedP
 export declare function validateGrant(command: string, policy: ExecPolicy, repoKey: string): ApprovedPrefixGrant | null;
 /** Human label for the remember option: "git push …". */
 export declare function describePrefix(pattern: string[]): string;
+/**
+ * Could {@link derivePrefix} ever have produced this pattern? The persisted
+ * file is plain JSON on disk, so a row that derivation could not have written
+ * (a banned interpreter/destruction/egress prefix, a bare multi-subcommand
+ * tool, a path-prefixed word, or an over-long pattern) is treated as
+ * tampered/corrupt and dropped at load time rather than honored (PR #1698
+ * review). This is defense in depth, not the trust boundary itself — the
+ * boundary is that grants only enter the live gate at startup or through the
+ * gate's own ask flow.
+ */
+export declare function isDerivablePattern(pattern: readonly string[]): boolean;
 export declare function rulesFilePath(homeOverride?: string | null): string;
 /**
  * Resolve the grant scope key for a session cwd: the git remote origin URL,

package/dist/extension/approvedPrefixes.js

@@ -179,6 +179,35 @@ export function validateGrant(command, policy, repoKey) {
 export function describePrefix(pattern) {
     return `${pattern.join(" ")} …`;
 }
+/**
+ * Could {@link derivePrefix} ever have produced this pattern? The persisted
+ * file is plain JSON on disk, so a row that derivation could not have written
+ * (a banned interpreter/destruction/egress prefix, a bare multi-subcommand
+ * tool, a path-prefixed word, or an over-long pattern) is treated as
+ * tampered/corrupt and dropped at load time rather than honored (PR #1698
+ * review). This is defense in depth, not the trust boundary itself — the
+ * boundary is that grants only enter the live gate at startup or through the
+ * gate's own ask flow.
+ */
+export function isDerivablePattern(pattern) {
+    if (pattern.length < 1 || pattern.length > 2)
+        return false;
+    const first = pattern[0];
+    if (first.includes("/") || first.startsWith("\\"))
+        return false;
+    if (BANNED_PREFIXES.has(first))
+        return false;
+    if (pattern.length === 2) {
+        const second = pattern[1];
+        if (!MULTI_SUBCOMMAND_TOOLS.has(first))
+            return false;
+        if (second.startsWith("-") || !SAFE_SUBCOMMAND_RE.test(second))
+            return false;
+        return true;
+    }
+    // Derivation never emits a bare multi-subcommand tool ("git" alone).
+    return !MULTI_SUBCOMMAND_TOOLS.has(first);
+}
 // --- I/O half ---
 export function rulesFilePath(homeOverride = null) {
     return join(codeStateHome(homeOverride), "rules.json");
@@ -220,6 +249,7 @@ export function loadGrants(homeOverride = null) {
         return parsed.grants.filter((g) => Array.isArray(g?.pattern) &&
             g.pattern.length > 0 &&
             g.pattern.every((t) => typeof t === "string") &&
+            isDerivablePattern(g.pattern) &&
             typeof g.repoKey === "string" &&
             typeof g.addedAt === "string" &&
             typeof g.cwd === "string");

package/dist/extension/guardian.d.ts

@@ -37,7 +37,7 @@ export interface GuardianVerdict {
     rationale: string;
 }
 export interface GuardianLimits {
-    /** Session cap on total Guardian reviews. */
+    /** Cap on Guardian reviews within the sliding window ({@link GUARDIAN_REVIEW_WINDOW_MS}). */
     maxReviews: number;
     /** Consecutive denials per turn before the circuit breaker trips. */
     maxConsecutiveDenials: number;
@@ -47,15 +47,25 @@ export interface GuardianLimits {
 export declare const DEFAULT_GUARDIAN_LIMITS: GuardianLimits;
 /**
  * Resolve Guardian limits from the environment. `YAGNI_GUARDIAN_MAX_REVIEWS`
- * overrides the session review cap; anything non-numeric or < 1 falls back to
- * the default (a bad value must never zero out the cap and lock the session).
+ * overrides the sliding-window review cap; anything non-numeric or < 1 falls
+ * back to the default (a bad value must never zero out the cap and lock the
+ * session).
  */
 export declare function resolveGuardianLimits(env?: Record<string, string | undefined>): GuardianLimits;
 /** The model tier the Guardian runs on. Configurable via YAGNI_GUARDIAN_TIER. */
 export declare const GUARDIAN_MODEL_TIER = "efficient";
 /** Read-only tools — the Guardian can read files for context but cannot write or execute. */
 export declare const GUARDIAN_TOOLS: string[];
+/**
+ * The review-cap window. `reviews` counts consults inside a SLIDING window
+ * rather than for the session's lifetime: a 24/7 session (a fleet operator's
+ * always-on terminal) must regain review capacity as old consults age out,
+ * not hard-block forever after the first N. The cap is a cost/runaway bound,
+ * not a safety bound — safety is the verdicts themselves.
+ */
+export declare const GUARDIAN_REVIEW_WINDOW_MS: number;
 export interface GuardianState {
+    /** Guardian consults within the last {@link GUARDIAN_REVIEW_WINDOW_MS}. */
     reviews: number;
     consecutiveDenials: number;
 }
@@ -64,7 +74,7 @@ export interface GuardianStateHandle {
     recordReview(outcome: GuardianOutcome): GuardianState;
     resetTurn(): void;
 }
-export declare function makeGuardianState(): GuardianStateHandle;
+export declare function makeGuardianState(now?: () => number): GuardianStateHandle;
 export interface CircuitBreakerResult {
     tripped: boolean;
     reason?: string;

package/dist/extension/guardian.js

@@ -35,8 +35,9 @@ export const DEFAULT_GUARDIAN_LIMITS = {
 };
 /**
  * Resolve Guardian limits from the environment. `YAGNI_GUARDIAN_MAX_REVIEWS`
- * overrides the session review cap; anything non-numeric or < 1 falls back to
- * the default (a bad value must never zero out the cap and lock the session).
+ * overrides the sliding-window review cap; anything non-numeric or < 1 falls
+ * back to the default (a bad value must never zero out the cap and lock the
+ * session).
  */
 export function resolveGuardianLimits(env = process.env) {
     const raw = env.YAGNI_GUARDIAN_MAX_REVIEWS?.trim();
@@ -48,25 +49,48 @@ export function resolveGuardianLimits(env = process.env) {
 export const GUARDIAN_MODEL_TIER = "efficient";
 /** Read-only tools — the Guardian can read files for context but cannot write or execute. */
 export const GUARDIAN_TOOLS = ["read"];
-export function makeGuardianState() {
-    const state = { reviews: 0, consecutiveDenials: 0 };
+// --- State ---
+/**
+ * The review-cap window. `reviews` counts consults inside a SLIDING window
+ * rather than for the session's lifetime: a 24/7 session (a fleet operator's
+ * always-on terminal) must regain review capacity as old consults age out,
+ * not hard-block forever after the first N. The cap is a cost/runaway bound,
+ * not a safety bound — safety is the verdicts themselves.
+ */
+export const GUARDIAN_REVIEW_WINDOW_MS = 60 * 60_000;
+export function makeGuardianState(now = Date.now) {
+    const reviewTimes = [];
+    let consecutiveDenials = 0;
+    const prune = () => {
+        const cutoff = now() - GUARDIAN_REVIEW_WINDOW_MS;
+        while (reviewTimes.length > 0 && reviewTimes[0] <= cutoff)
+            reviewTimes.shift();
+    };
+    const snapshot = () => ({
+        reviews: reviewTimes.length,
+        consecutiveDenials,
+    });
     return {
-        read: () => ({ ...state }),
+        read: () => {
+            prune();
+            return snapshot();
+        },
         recordReview(outcome) {
-            state.reviews += 1;
+            prune();
+            reviewTimes.push(now());
             if (outcome === "deny") {
-                state.consecutiveDenials += 1;
+                consecutiveDenials += 1;
             }
             else if (outcome === "allow") {
-                state.consecutiveDenials = 0;
+                consecutiveDenials = 0;
             }
             // "ask" leaves the denial streak UNCHANGED: it is neither a denial nor
             // an exoneration. If it reset the streak, deny/ask/deny/ask would never
             // trip the breaker (round-2 review blocker).
-            return { ...state };
+            return snapshot();
         },
         resetTurn() {
-            state.consecutiveDenials = 0;
+            consecutiveDenials = 0;
         },
     };
 }

package/dist/extension/index.js

@@ -268,7 +268,9 @@ export async function registerYagni(pi, deps = {}) {
         catch { /* logging must never break the session */ }
     };
     // YAG-510: persisted "don't ask again" grants, per-repo keyed. Loaded once
-    // at startup (grants added by other concurrent sessions appear next launch).
+    // at startup (grants added by other concurrent sessions appear next launch —
+    // the startup load is the trust boundary; live reload was reviewed and
+    // rejected as a same-session self-authorization path, PR #1698).
     const sessionGrants = evalMode ? [] : loadGrants();
     const GUARDIAN_EVENT_TIMEOUT_MS = 5_000;
     registerPermissionGate(pi, {

package/dist/extension/permission.js

@@ -279,6 +279,11 @@ export function registerPermissionGate(pi, deps = {}) {
     const guardianTier = deps.guardianTier;
     // --- YAG-510 gate state ---
     // Grants: in-memory list seeded from deps, appended on "don't ask again".
+    // Deliberately NOT live-reloaded from disk: auto mode can write files, so a
+    // mid-session re-read of rules.json would let the agent (or a prompt
+    // injection) author its own grants and self-authorize within the same
+    // session. New grants from concurrent sessions apply at next launch — the
+    // startup load is the trust boundary (PR #1698 review).
     const grants = [...(deps.grants ?? [])];
     // Keyed by cwd: a session can change working directory (cd, /go worktrees),
     // and a repoKey memoized from the first cwd would let repo-A grants match
@@ -410,12 +415,13 @@ export function registerPermissionGate(pi, deps = {}) {
                 const guardianAvailable = Boolean(guardianState && !guardianDisabled && guardianReview);
                 const limits = guardianLimits ?? DEFAULT_GUARDIAN_LIMITS;
                 if (guardianAvailable && guardianState.read().reviews >= limits.maxReviews) {
-                    // Session consult cap. Review mode falls through to its ordinary
-                    // confirm (no LLM cost); auto blocks.
+                    // Sliding-window consult cap (capacity recovers as old reviews age
+                    // out — a long-lived session is never bricked). Review mode falls
+                    // through to its ordinary confirm (no LLM cost); auto blocks.
                     if (modeAtEntry === "auto") {
                         if (ctx?.hasUI)
-                            ctx.ui.notify(`Guardian review cap reached (${limits.maxReviews} this session).`, "warning");
-                        return { block: true, reason: `Guardian review cap reached (${limits.maxReviews} this session). Switch to /mode review to approve manually.` };
+                            ctx.ui.notify(`Guardian review cap reached (${limits.maxReviews} in the last hour).`, "warning");
+                        return { block: true, reason: `Guardian review cap reached (${limits.maxReviews} in the last hour). Capacity recovers as older reviews age out; switch to /mode review to approve manually, or retry this step later.` };
                     }
                     // fall through to decision.confirm below
                 }

package/dist/extension/pipeline/goCommand.js

@@ -77,7 +77,7 @@ import { registerGoStatusCommands } from "./goStatusCommands.js";
 import { runPipeline as defaultRunPipeline } from "./orchestrator.js";
 import { composeAbortSignal } from "./resilience.js";
 import { planResume } from "./resume.js";
-import { activeRunCount, beginRun, classifyRunLiveness, findActiveRunByTicket, isRunInFlight, isTerminalStatus, lastJournalTs, loadRegistryRows, MAX_CONCURRENT_RUNS, settleRun, trackRunAbort, trackRunPromise, worktreesDir, } from "./runRegistry.js";
+import { activeRunCount, beginRun, classifyRunLiveness, findActiveRunByTicket, isRunInFlight, isTerminalStatus, lastJournalTs, loadRegistryRows, resolveMaxConcurrentRuns, settleRun, trackRunAbort, trackRunPromise, worktreesDir, } from "./runRegistry.js";
 import { makeRunSession as defaultMakeRunSession } from "./runSession.js";
 import { recordSessionRun } from "../sessionRuns.js";
 import { resolveTicketBrief as defaultResolveTicketBrief } from "./ticketResolution.js";
@@ -460,13 +460,15 @@ export function registerGoCommand(pi, deps = {}) {
                 return;
             }
             // In-flight guards: the same ticket never runs twice at once in this
-            // process, and at most MAX_CONCURRENT_RUNS runs are in flight.
+            // process, and at most resolveMaxConcurrentRuns() runs are in flight
+            // (default 3; fleet operators raise it via YAGNI_MAX_CONCURRENT_RUNS).
             if (findActiveRunByTicket(ticket)) {
                 notify(`/go ${ticket} is already running - see /go-status.`, "warning");
                 return;
             }
-            if (activeRunCount() >= MAX_CONCURRENT_RUNS) {
-                notify(`${MAX_CONCURRENT_RUNS} /go runs are already in flight; wait for one to finish (see /go-status).`, "warning");
+            const maxConcurrentRuns = resolveMaxConcurrentRuns();
+            if (activeRunCount() >= maxConcurrentRuns) {
+                notify(`${maxConcurrentRuns} /go runs are already in flight; wait for one to finish (see /go-status) or raise YAGNI_MAX_CONCURRENT_RUNS.`, "warning");
                 return;
             }
             // --- Run tree resolution: worktree by default; --here = legacy in-place.

package/dist/extension/pipeline/runRegistry.d.ts

@@ -22,8 +22,16 @@
  * candidate).
  */
 import type { CheckpointRecord, StopReason } from "./types.js";
-/** Bound on simultaneously in-flight /go runs in one process (spec §3b). */
+/** Default bound on simultaneously in-flight /go runs in one process (spec §3b). */
 export declare const MAX_CONCURRENT_RUNS = 3;
+/** Hard ceiling for the env override — a typo must not launch hundreds of runs. */
+export declare const MAX_CONCURRENT_RUNS_CEILING = 32;
+/**
+ * Resolve the in-flight /go cap from the environment. `YAGNI_MAX_CONCURRENT_RUNS`
+ * raises (or lowers) the default for fleet-scale operators; non-numeric or < 1
+ * falls back to the default, and anything above the ceiling clamps to it.
+ */
+export declare function resolveMaxConcurrentRuns(env?: Record<string, string | undefined>): number;
 /**
  * A non-terminal row whose journal has been quiet this long is treated as
  * INTERRUPTED (its process died) rather than still running elsewhere. Sits

package/dist/extension/pipeline/runRegistry.js

@@ -24,8 +24,22 @@
 import { appendFileSync, mkdirSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import { codeStateHome } from "../stateHome.js";
-/** Bound on simultaneously in-flight /go runs in one process (spec §3b). */
+/** Default bound on simultaneously in-flight /go runs in one process (spec §3b). */
 export const MAX_CONCURRENT_RUNS = 3;
+/** Hard ceiling for the env override — a typo must not launch hundreds of runs. */
+export const MAX_CONCURRENT_RUNS_CEILING = 32;
+/**
+ * Resolve the in-flight /go cap from the environment. `YAGNI_MAX_CONCURRENT_RUNS`
+ * raises (or lowers) the default for fleet-scale operators; non-numeric or < 1
+ * falls back to the default, and anything above the ceiling clamps to it.
+ */
+export function resolveMaxConcurrentRuns(env = process.env) {
+    const raw = env.YAGNI_MAX_CONCURRENT_RUNS?.trim();
+    const parsed = raw ? Number.parseInt(raw, 10) : NaN;
+    if (!Number.isFinite(parsed) || parsed < 1)
+        return MAX_CONCURRENT_RUNS;
+    return Math.min(parsed, MAX_CONCURRENT_RUNS_CEILING);
+}
 /**
  * A non-terminal row whose journal has been quiet this long is treated as
  * INTERRUPTED (its process died) rather than still running elsewhere. Sits
@@ -106,6 +120,13 @@ const active = new Map();
 export function _resetRunRegistryForTest() {
     active.clear();
 }
+// NOTE on growth: the mirror is append-only and grows without bound on a
+// long-lived install. In-place compaction was reviewed and REMOVED (PR #1698):
+// a fold+rewrite without cross-process exclusion can permanently erase another
+// process's terminal settle (nothing ever re-appends a final row), which would
+// resurrect a finished run as "interrupted" and invite duplicate worktree
+// adoption. Compaction needs an inter-process lock + unique temp files —
+// tracked separately; until then, growth is the safe failure mode.
 /** Fail-soft append of one full row to the mirror (self-heals a torn previous write). */
 function appendRow(row) {
     try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yagni-app/code-staging",
-  "version": "0.3.0-staging.1088.1",
+  "version": "0.3.0-staging.1090.1",
   "description": "YAGNI Code: a terminal coding agent that already knows your company. One YAGNI login routes the model and grounds the agent in your team's context.",
   "license": "SEE LICENSE IN LICENSE.md",
   "author": "YAGNI, Inc. <jack@yagni.app> (https://yagni.app)",
@@ -38,5 +38,5 @@
     "@earendil-works/pi-tui": "0.84.1",
     "typebox": "^1.3.11"
   },
-  "yagniSourceSha": "eebceee1a0d1673dd4b2755942aa027a89f18611"
+  "yagniSourceSha": "79e1523affbd694ad96a236da6aefe33000497d8"
 }