@yagni-app/code-staging 0.3.1-staging.1107.1 → 0.3.1-staging.1110.1

package/dist/extension/execPolicy.js

@@ -612,6 +612,16 @@ function classifySegmentTokens(rawTokens, policy, opts) {
     }
     const { tokens: strippedTokens, stripped } = stripLeadingTokens(rawTokens);
     if (strippedTokens.length === 0) {
+        // env standalone: `env` or `env VAR=val` with no following command prints
+        // environment variables — a read-only operation. stripLeadingTokens removes
+        // `env` as a wrapper word, leaving empty tokens. Recognize this case instead
+        // of returning "empty command segment" (YAG-549).
+        if (!opts.forbiddenOnly && rawTokens.length > 0 && basenameToken(rawTokens[0]) === "env") {
+            const onlyEnvAndAssignments = rawTokens.every((t) => basenameToken(t) === "env" || ENV_ASSIGNMENT_RE.test(t));
+            if (onlyEnvAndAssignments) {
+                return { decision: "allow", justification: "print environment variables (read-only)" };
+            }
+        }
         return opts.forbiddenOnly
             ? { decision: "allow", justification: "no forbidden match" }
             : { decision: "prompt", justification: "empty command segment" };
@@ -894,6 +904,59 @@ export const DEFAULT_EXEC_POLICY = {
         { pattern: ["pnpm", "list"], decision: "allow", justification: "list installed packages" },
         { pattern: ["pnpm", "--version"], decision: "allow", justification: "check pnpm version" },
         { pattern: ["tsc", "--version"], decision: "allow", justification: "check typescript version" },
+        // --- allow: CLI tool reads (YAG-549, based on prod Guardian data) ---
+        // linear CLI — read subcommands; write subcommands (create/update/delete/start/pr/attach/comment) stay prompt
+        { pattern: ["linear", "issue", "comment", "list"], decision: "allow", justification: "list Linear issue comments (read-only)" },
+        {
+            pattern: ["linear", "issue"],
+            decision: "allow",
+            justification: "read Linear issue data",
+            unlessTokens: ["start", "create", "update", "delete", "pull-request", "pr", "attach", "comment"],
+        },
+        { pattern: ["linear", ["--help", "-h"]], decision: "allow", justification: "show Linear CLI help" },
+        { pattern: ["linear", ["--version", "-V"]], decision: "allow", justification: "show Linear CLI version" },
+        // gh api — REST GET (no params, no method override) and GraphQL queries (no mutation)
+        // gh api defaults to POST when -f/-F params are present, so params are disqualifying.
+        // GraphQL is always POST, but queries are reads; mutations/subscriptions are disqualifying.
+        {
+            pattern: ["gh", "api", "graphql"],
+            decision: "allow",
+            justification: "GraphQL query (read-only)",
+            unlessTokens: ["query=mutation*", "query=subscription*"],
+        },
+        {
+            pattern: ["gh", "api"],
+            decision: "allow",
+            justification: "GitHub API GET request (read-only)",
+            unlessTokens: ["--method", "-X", "-X*", "graphql", "POST", "PATCH", "DELETE", "PUT", "-f", "-F", "--raw-field", "--field"],
+        },
+        { pattern: ["gh", "release", ["list", "view"]], decision: "allow", justification: "read GitHub release data" },
+        { pattern: ["gh", "label", "list"], decision: "allow", justification: "list GitHub labels" },
+        { pattern: ["gh", "milestone", "list"], decision: "allow", justification: "list GitHub milestones" },
+        { pattern: ["gh", "auth", "status"], decision: "allow", justification: "show GitHub auth status" },
+        // git read-only subcommands
+        { pattern: ["git", "tag"], decision: "allow", justification: "list tags (read-only)" },
+        { pattern: ["git", "reflog"], decision: "allow", justification: "show reference log" },
+        { pattern: ["git", "ls-remote"], decision: "allow", justification: "list remote refs" },
+        { pattern: ["git", "cat-file"], decision: "allow", justification: "inspect git objects (read-only)" },
+        { pattern: ["git", "for-each-ref"], decision: "allow", justification: "enumerate refs (read-only)" },
+        { pattern: ["git", "rev-list"], decision: "allow", justification: "walk commit history (read-only)" },
+        { pattern: ["git", "show-ref"], decision: "allow", justification: "list all refs" },
+        { pattern: ["git", "name-rev"], decision: "allow", justification: "map commit to name (read-only)" },
+        { pattern: ["git", "merge-base"], decision: "allow", justification: "find common ancestor (read-only)" },
+        // package manager test/lint — routine dev-loop operations
+        { pattern: ["pnpm", "test"], decision: "allow", justification: "run tests (routine dev-loop operation)" },
+        { pattern: ["pnpm", "lint"], decision: "allow", justification: "run linter (routine dev-loop operation)" },
+        { pattern: ["npm", "test"], decision: "allow", justification: "run tests (routine dev-loop operation)" },
+        { pattern: ["npm", "run", "lint"], decision: "allow", justification: "run linter (routine dev-loop operation)" },
+        { pattern: ["npx", "tsc", "--noEmit"], decision: "allow", justification: "typecheck only (no file writes)" },
+        { pattern: ["npx", "tsx", "--test"], decision: "allow", justification: "run tests (routine dev-loop operation)" },
+        { pattern: ["npx", "vitest"], decision: "allow", justification: "run vitest tests (routine dev-loop operation)" },
+        { pattern: ["npx", "vitest", "run"], decision: "allow", justification: "run vitest tests (routine dev-loop operation)" },
+        { pattern: ["npx", "jest"], decision: "allow", justification: "run jest tests (routine dev-loop operation)" },
+        // misc read-only commands
+        { pattern: ["printenv"], decision: "allow", justification: "print environment variables (read-only)" },
+        { pattern: ["npm", ["view", "info"]], decision: "allow", justification: "read package metadata from registry" },
         // --- prompt: potentially destructive but context-dependent ---
         { pattern: ["rm"], decision: "prompt", justification: "file deletion — review the target" },
         { pattern: ["git", "commit"], decision: "prompt", justification: "creates a commit — confirm intent" },

package/dist/extension/permission.d.ts

@@ -184,7 +184,7 @@ export interface RegisterPermissionDeps {
 export declare const MODE_CONTEXT_TYPE = "yagni-mode-context";
 /** Legacy alias — the original plan-mode tag, kept for backward compat. */
 export declare const PLAN_CONTEXT_TYPE = "yagni-mode-context";
-export declare const PLAN_CONTEXT_MESSAGE = "[PLAN MODE ACTIVE]\nYou are in plan mode: explore and design, change nothing.\n- write, edit, and bash are held by the permission gate; do not attempt them.\n- Read, search, and ask_yagni freely to ground the plan in how this company works.\n- Produce a concrete numbered plan of the steps you would take, with the files involved.\n- End by asking the user to review the plan; they run /mode auto (or /mode review) to execute it.\n- Once executing, track the plan's steps with todo_write.";
+export declare const PLAN_CONTEXT_MESSAGE = "[PLAN MODE ACTIVE]\nYou are in plan mode: explore and design, change nothing.\n- Read-only bash commands (ls, grep, git status, gh pr view, etc.) run freely to help you explore.\n- Ambiguous bash commands are reviewed by the Guardian; if non-mutating they run, if potentially mutating you will be asked.\n- write, edit, file_ticket, and update_ticket_status are held by the permission gate; do not attempt them.\n- Read, search, and ask_yagni freely to ground the plan in how this company works.\n- Produce a concrete numbered plan of the steps you would take, with the files involved.\n- End by asking the user to review the plan; they run /mode auto (or /mode review) to execute it.\n- Once executing, track the plan's steps with todo_write.";
 /** Build the mode-awareness context message for the current permission mode. */
 export declare function buildModeContextMessage(mode: PermissionMode): string;
 /**

package/dist/extension/permission.js

@@ -56,6 +56,42 @@ export const DEFAULT_PERMISSION_POLICY = {
  */
 export function decideGate(toolName, params, mode, policy) {
     if (mode === "plan") {
+        // Non-bash tools in planBlockTools are held outright — they are
+        // inherently mutating (write, edit, file_ticket, update_ticket_status).
+        // Bash is the exploration tool: run it through the exec policy so
+        // read-only commands (git status, ls, grep, gh pr view) work, and
+        // prompt-band commands are routed to the Guardian. The gate handler
+        // ensures Guardian-unavailable/capped/disabled states fail closed.
+        if (toolName === "bash") {
+            const command = typeof params.command === "string" ? params.command.trim() : "";
+            if (command) {
+                try {
+                    const execPolicy = policy.execPolicy ?? DEFAULT_EXEC_POLICY;
+                    const classification = classifyCommand(command, execPolicy);
+                    if (classification.decision === "allow")
+                        return { block: false };
+                    if (classification.decision === "forbidden") {
+                        return {
+                            block: true,
+                            reason: `${classification.justification}. Do not attempt the same outcome via a workaround or indirect execution — use a materially safer alternative, or ask the user.`,
+                        };
+                    }
+                    // prompt — Guardian reviews. The gate handler runs the Guardian
+                    // and handles allow/ask/deny. Grants and cache are skipped in
+                    // plan mode (they can cover writes). Guardian unavailable/capped/
+                    // disabled → block (fail closed).
+                    return { block: false, classify: "prompt", classifyJustification: classification.justification };
+                }
+                catch {
+                    // classifyCommand threw — fail closed in plan mode.
+                    return {
+                        block: true,
+                        reason: `plan mode: could not classify this bash command and it is held. Switch to /mode auto to apply changes.`,
+                    };
+                }
+            }
+            return { block: false };
+        }
         if (policy.planBlockTools.includes(toolName)) {
             return {
                 block: true,
@@ -122,7 +158,9 @@ const AUTO_MARKER = "[AUTO MODE]";
 const REVIEW_MARKER = "[REVIEW MODE]";
 export const PLAN_CONTEXT_MESSAGE = `${PLAN_MARKER}
 You are in plan mode: explore and design, change nothing.
-- write, edit, and bash are held by the permission gate; do not attempt them.
+- Read-only bash commands (ls, grep, git status, gh pr view, etc.) run freely to help you explore.
+- Ambiguous bash commands are reviewed by the Guardian; if non-mutating they run, if potentially mutating you will be asked.
+- write, edit, file_ticket, and update_ticket_status are held by the permission gate; do not attempt them.
 - Read, search, and ask_yagni freely to ground the plan in how this company works.
 - Produce a concrete numbered plan of the steps you would take, with the files involved.
 - End by asking the user to review the plan; they run /mode auto (or /mode review) to execute it.
@@ -414,7 +452,9 @@ export function registerPermissionGate(pi, deps = {}) {
                     }
                 }
                 // 2. Session exact-command approval cache (ticket 4.5).
-                if (command && approvedCommands.has(cacheKey(cwd, command))) {
+                // Skipped in plan mode: a cached approval can cover a write command,
+                // and plan mode's contract is no mutations without Guardian review.
+                if (modeAtEntry !== "plan" && command && approvedCommands.has(cacheKey(cwd, command))) {
                     emitGateEvent({ ...eventBase, outcome: "cached_allow", consulted: false });
                     return {};
                 }
@@ -423,13 +463,13 @@ export function registerPermissionGate(pi, deps = {}) {
                 if (guardianAvailable && guardianState.read().reviews >= limits.maxReviews) {
                     // Sliding-window consult cap (capacity recovers as old reviews age
                     // out — a long-lived session is never bricked). Review mode falls
-                    // through to its ordinary confirm (no LLM cost); auto blocks.
-                    if (modeAtEntry === "auto") {
+                    // through to its ordinary confirm (no LLM cost); auto and plan block.
+                    if (modeAtEntry === "auto" || modeAtEntry === "plan") {
                         if (ctx?.hasUI)
                             ctx.ui.notify(`Guardian review cap reached (${limits.maxReviews} in the last hour).`, "warning");
                         return { block: true, reason: `Guardian review cap reached (${limits.maxReviews} in the last hour). Capacity recovers as older reviews age out; switch to /mode review to approve manually, or retry this step later.` };
                     }
-                    // fall through to decision.confirm below
+                    // review mode: fall through to decision.confirm below
                 }
                 else if (guardianAvailable) {
                     // Circuit breaker (pre-consult). With a UI, escalate to ONE ask per
@@ -675,6 +715,14 @@ export function registerPermissionGate(pi, deps = {}) {
                     // approval cache were already consulted above.
                     return {};
                 }
+                else if (modeAtEntry === "plan") {
+                    // Guardian disabled or not wired in plan mode: fail closed. Without
+                    // the Guardian to verify the command is non-mutating, the plan-mode
+                    // contract (no changes) cannot be upheld. The user can switch to
+                    // /mode auto or /mode review to proceed.
+                    emitGateEvent({ ...eventBase, outcome: "breaker_blocked", consulted: false });
+                    return { block: true, reason: "Guardian unavailable in plan mode. Switch to /mode auto to run commands, or /mode review to approve manually." };
+                }
                 // review mode with Guardian disabled/capped: fall through to confirm.
             }
             if (decision.confirm) {

package/dist/extension/pipeline/invocation.d.ts

@@ -3,9 +3,17 @@
  * `buildLaunch` (no spawn, no fs).
  *
  * `buildStageInvocation` produces the per-stage pi PASSTHROUGH argv exactly as
- * the subagent example assembles it (runSingleAgent L294-330):
+ * the subagent example assembles it (runSingleAgent L294-330), with an added
+ * honesty preamble delivered as the FIRST `--append-system-prompt` so the
+ * anti-fabrication rule appears before the persona body in the child's
+ * assembled system prompt:
  *   --mode json -p --no-session --model <tier> --tools <csv>
- *   --append-system-prompt <file> 'Task: <rendered>'
+ *   --append-system-prompt <honesty> --append-system-prompt <file> 'Task: <rendered>'
+ *
+ * Pi concatenates multiple `--append-system-prompt` values with `\n\n` in
+ * array order, so the child sees: [pi base] + [honesty] + [persona] +
+ * [project_context]. The preamble is placed first so open-weight models
+ * encounter the anti-fabrication rule before their role identity.
  *
  * `groundedChildArgv` prepends the grounding pi-args the yagni-code launcher
  * would otherwise add (`-e <self> --provider yagni`) because v1 spawns pi
@@ -17,6 +25,20 @@
  * chain's `step.task.replace(/{previous}/g, …)`.
  */
 import type { PipelineStage, ReviewLens } from "./types.js";
+/**
+ * Anti-fabrication preamble injected as the first `--append-system-prompt` on
+ * every child pi process (both /go stages and subagent tool calls). The
+ * driver-only `ENGINEERING_PRACTICE_SECTION` never reaches children (it's a
+ * launcher flag, and children build their own argv); this preamble ensures
+ * the honesty rule is present in every child regardless.
+ *
+ * Content constraints (same as the enrichment section — the branding scrub's
+ * `scrubOutsideProjectContext` replaces whole-word \bpi\b and the
+ * `PI_DOCS_BLOCK_RE` regex consumes consecutive `- ` bullet lines that follow
+ * a docs header): must not contain the standalone word "pi", must not open
+ * with a `- ` bullet line, no emojis.
+ */
+export declare const CHILD_HONESTY_PREAMBLE: string;
 /** Fill {ticket}/{previous}; an absent var renders as empty string. */
 export declare function renderTemplate(tmpl: string, vars: {
     ticket?: string;

package/dist/extension/pipeline/invocation.js

@@ -3,9 +3,17 @@
  * `buildLaunch` (no spawn, no fs).
  *
  * `buildStageInvocation` produces the per-stage pi PASSTHROUGH argv exactly as
- * the subagent example assembles it (runSingleAgent L294-330):
+ * the subagent example assembles it (runSingleAgent L294-330), with an added
+ * honesty preamble delivered as the FIRST `--append-system-prompt` so the
+ * anti-fabrication rule appears before the persona body in the child's
+ * assembled system prompt:
  *   --mode json -p --no-session --model <tier> --tools <csv>
- *   --append-system-prompt <file> 'Task: <rendered>'
+ *   --append-system-prompt <honesty> --append-system-prompt <file> 'Task: <rendered>'
+ *
+ * Pi concatenates multiple `--append-system-prompt` values with `\n\n` in
+ * array order, so the child sees: [pi base] + [honesty] + [persona] +
+ * [project_context]. The preamble is placed first so open-weight models
+ * encounter the anti-fabrication rule before their role identity.
  *
  * `groundedChildArgv` prepends the grounding pi-args the yagni-code launcher
  * would otherwise add (`-e <self> --provider yagni`) because v1 spawns pi
@@ -16,6 +24,24 @@
  * `renderTemplate` does the {ticket}/{previous} substitution, mirroring the
  * chain's `step.task.replace(/{previous}/g, …)`.
  */
+/**
+ * Anti-fabrication preamble injected as the first `--append-system-prompt` on
+ * every child pi process (both /go stages and subagent tool calls). The
+ * driver-only `ENGINEERING_PRACTICE_SECTION` never reaches children (it's a
+ * launcher flag, and children build their own argv); this preamble ensures
+ * the honesty rule is present in every child regardless.
+ *
+ * Content constraints (same as the enrichment section — the branding scrub's
+ * `scrubOutsideProjectContext` replaces whole-word \bpi\b and the
+ * `PI_DOCS_BLOCK_RE` regex consumes consecutive `- ` bullet lines that follow
+ * a docs header): must not contain the standalone word "pi", must not open
+ * with a `- ` bullet line, no emojis.
+ */
+export const CHILD_HONESTY_PREAMBLE = "Never fabricate file paths, file contents, function signatures, enum values, or code. " +
+    "If you cannot find something, say so explicitly — an honest \"not found\" is more valuable " +
+    "than a plausible-sounding invention. Every file path you cite must be a path you actually " +
+    "read with a tool. If you are uncertain whether something exists, say you are uncertain " +
+    "rather than presenting a guess as a finding.";
 /** Fill {ticket}/{previous}; an absent var renders as empty string. */
 export function renderTemplate(tmpl, vars) {
     return tmpl
@@ -41,6 +67,8 @@ export function buildStageInvocation(stage, ctx) {
         "--tools",
         stage.tools.join(","),
         "--append-system-prompt",
+        CHILD_HONESTY_PREAMBLE,
+        "--append-system-prompt",
         ctx.promptFilePath,
         `Task: ${task}`,
     ];

package/dist/extension/pipeline/personas.js

@@ -107,7 +107,7 @@ Risk taxonomy:
 Outcome rules:
 - "deny" is reserved for actions you are VERY CONFIDENT are very dangerous: irreversible destruction, exfiltration of sensitive data, credential probing, production-impacting security weakening. If you are not sure it is that bad, do not deny.
 - "allow" when you are confident the action is safe: read-only, routine dev-loop, or clearly scoped and reversible.
-- "ask" for everything in between — the action might be fine but a human should decide. This is the correct outcome whenever your confidence is middling; prefer ask over deny for anything short of the very-dangerous bar, and prefer allow over ask for routine work (do not hedge routine commands into ask).
+- "ask" for actions where a specific, concrete risk makes you unsure — the action has a plausible path to harm that you cannot rule out by reading the command. Do not ask just because a command "might" do something; ask when you can name the specific thing you are worried about. If you cannot articulate a concrete risk, allow. Prefer allow over ask: routine dev-loop operations, local file writes within a project, and standard git operations (add, commit, fetch) are safe — the agent is already operating in the user's repository with their consent.
 
 Rationale rules:
 - For "ask", the rationale MUST be a specific question addressed to the user, naming the concrete effect that made you unsure — e.g. "This pushes 3 commits to the shared main branch — do you want to publish them now?". You may be told why the static policy routed the command to you; your rationale must ADD information beyond that policy text, not restate it.

package/dist/extension/subagents.js

@@ -72,6 +72,8 @@ const GENERAL_BODY = `You are a capable software-engineering subagent with a fre
 
 You are grounded in how THIS company works: call ask_yagni before inferring a convention, an ownership rule, or anything organization-specific.
 
+Never fabricate file paths, contents, or findings. If you cannot find something, say so.
+
 Your final message is your report back to the driving agent, which has NOT seen what you read or did. Make it compressed and complete: what you did, what you found, exact file paths and key excerpts, and anything the driver must know before continuing.`;
 const GENERAL_AGENT = {
     name: GENERAL_AGENT_NAME,
@@ -87,6 +89,11 @@ not write code and you do not run commands; you read and report.
 You are grounded in how THIS company works: call ask_yagni before inferring a
 convention, an ownership rule, or anything organization-specific.
 
+Never fabricate file paths, contents, or code. Every path you cite must be
+one you actually read with a tool. If you cannot find something, say "not
+found" — a plausible-sounding invention is worse than no answer because the
+driving agent trusts your report.
+
 Your final message is your report back to the driving agent, which has NOT
 seen what you read. Make it compressed and complete: exact file paths, the
 key excerpts, and a one-paragraph map of how the pieces relate. Say what you
@@ -112,6 +119,9 @@ your final message instead of guessing.
 You are grounded in how THIS company works: call ask_yagni before inferring a
 convention, an ownership rule, or anything organization-specific.
 
+Never fabricate file paths or results. Report what you actually did and what
+you actually found.
+
 Your final message is your report back to the driving agent, which has NOT
 seen what you did. List every file you touched, what changed in each, the
 commands you ran with their outcomes, and anything you deliberately left
@@ -141,6 +151,9 @@ verifiers.
 You are grounded in how THIS company works: call ask_yagni before inferring
 a convention, an ownership rule, or anything organization-specific.
 
+Never fabricate file paths or findings. If you could not verify something,
+say exactly what you tried and why you could not.
+
 Your final message is your verdict back to the driving agent, which has NOT
 seen what you read. Format:
 ## Verdict

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yagni-app/code-staging",
-  "version": "0.3.1-staging.1107.1",
+  "version": "0.3.1-staging.1110.1",
   "description": "YAGNI Code: a terminal coding agent that already knows your company. One YAGNI login routes the model and grounds the agent in your team's context.",
   "license": "SEE LICENSE IN LICENSE.md",
   "author": "YAGNI, Inc. <jack@yagni.app> (https://yagni.app)",
@@ -39,5 +39,5 @@
     "smol-toml": "^1.8.0",
     "typebox": "^1.3.11"
   },
-  "yagniSourceSha": "7029b03b5a6d5eac5c16a0a25670cc64ea989f82"
+  "yagniSourceSha": "95876e9f6b0c4a81a474224dcf37cf6939df7f6d"
 }