@yagni-app/code-staging 0.3.1-staging.1108.1 → 0.3.2-staging.1112.1

package/dist/extension/execPolicy.js

@@ -612,6 +612,16 @@ function classifySegmentTokens(rawTokens, policy, opts) {
     }
     const { tokens: strippedTokens, stripped } = stripLeadingTokens(rawTokens);
     if (strippedTokens.length === 0) {
+        // env standalone: `env` or `env VAR=val` with no following command prints
+        // environment variables — a read-only operation. stripLeadingTokens removes
+        // `env` as a wrapper word, leaving empty tokens. Recognize this case instead
+        // of returning "empty command segment" (YAG-549).
+        if (!opts.forbiddenOnly && rawTokens.length > 0 && basenameToken(rawTokens[0]) === "env") {
+            const onlyEnvAndAssignments = rawTokens.every((t) => basenameToken(t) === "env" || ENV_ASSIGNMENT_RE.test(t));
+            if (onlyEnvAndAssignments) {
+                return { decision: "allow", justification: "print environment variables (read-only)" };
+            }
+        }
         return opts.forbiddenOnly
             ? { decision: "allow", justification: "no forbidden match" }
             : { decision: "prompt", justification: "empty command segment" };
@@ -894,6 +904,59 @@ export const DEFAULT_EXEC_POLICY = {
         { pattern: ["pnpm", "list"], decision: "allow", justification: "list installed packages" },
         { pattern: ["pnpm", "--version"], decision: "allow", justification: "check pnpm version" },
         { pattern: ["tsc", "--version"], decision: "allow", justification: "check typescript version" },
+        // --- allow: CLI tool reads (YAG-549, based on prod Guardian data) ---
+        // linear CLI — read subcommands; write subcommands (create/update/delete/start/pr/attach/comment) stay prompt
+        { pattern: ["linear", "issue", "comment", "list"], decision: "allow", justification: "list Linear issue comments (read-only)" },
+        {
+            pattern: ["linear", "issue"],
+            decision: "allow",
+            justification: "read Linear issue data",
+            unlessTokens: ["start", "create", "update", "delete", "pull-request", "pr", "attach", "comment"],
+        },
+        { pattern: ["linear", ["--help", "-h"]], decision: "allow", justification: "show Linear CLI help" },
+        { pattern: ["linear", ["--version", "-V"]], decision: "allow", justification: "show Linear CLI version" },
+        // gh api — REST GET (no params, no method override) and GraphQL queries (no mutation)
+        // gh api defaults to POST when -f/-F params are present, so params are disqualifying.
+        // GraphQL is always POST, but queries are reads; mutations/subscriptions are disqualifying.
+        {
+            pattern: ["gh", "api", "graphql"],
+            decision: "allow",
+            justification: "GraphQL query (read-only)",
+            unlessTokens: ["query=mutation*", "query=subscription*"],
+        },
+        {
+            pattern: ["gh", "api"],
+            decision: "allow",
+            justification: "GitHub API GET request (read-only)",
+            unlessTokens: ["--method", "-X", "-X*", "graphql", "POST", "PATCH", "DELETE", "PUT", "-f", "-F", "--raw-field", "--field"],
+        },
+        { pattern: ["gh", "release", ["list", "view"]], decision: "allow", justification: "read GitHub release data" },
+        { pattern: ["gh", "label", "list"], decision: "allow", justification: "list GitHub labels" },
+        { pattern: ["gh", "milestone", "list"], decision: "allow", justification: "list GitHub milestones" },
+        { pattern: ["gh", "auth", "status"], decision: "allow", justification: "show GitHub auth status" },
+        // git read-only subcommands
+        { pattern: ["git", "tag"], decision: "allow", justification: "list tags (read-only)" },
+        { pattern: ["git", "reflog"], decision: "allow", justification: "show reference log" },
+        { pattern: ["git", "ls-remote"], decision: "allow", justification: "list remote refs" },
+        { pattern: ["git", "cat-file"], decision: "allow", justification: "inspect git objects (read-only)" },
+        { pattern: ["git", "for-each-ref"], decision: "allow", justification: "enumerate refs (read-only)" },
+        { pattern: ["git", "rev-list"], decision: "allow", justification: "walk commit history (read-only)" },
+        { pattern: ["git", "show-ref"], decision: "allow", justification: "list all refs" },
+        { pattern: ["git", "name-rev"], decision: "allow", justification: "map commit to name (read-only)" },
+        { pattern: ["git", "merge-base"], decision: "allow", justification: "find common ancestor (read-only)" },
+        // package manager test/lint — routine dev-loop operations
+        { pattern: ["pnpm", "test"], decision: "allow", justification: "run tests (routine dev-loop operation)" },
+        { pattern: ["pnpm", "lint"], decision: "allow", justification: "run linter (routine dev-loop operation)" },
+        { pattern: ["npm", "test"], decision: "allow", justification: "run tests (routine dev-loop operation)" },
+        { pattern: ["npm", "run", "lint"], decision: "allow", justification: "run linter (routine dev-loop operation)" },
+        { pattern: ["npx", "tsc", "--noEmit"], decision: "allow", justification: "typecheck only (no file writes)" },
+        { pattern: ["npx", "tsx", "--test"], decision: "allow", justification: "run tests (routine dev-loop operation)" },
+        { pattern: ["npx", "vitest"], decision: "allow", justification: "run vitest tests (routine dev-loop operation)" },
+        { pattern: ["npx", "vitest", "run"], decision: "allow", justification: "run vitest tests (routine dev-loop operation)" },
+        { pattern: ["npx", "jest"], decision: "allow", justification: "run jest tests (routine dev-loop operation)" },
+        // misc read-only commands
+        { pattern: ["printenv"], decision: "allow", justification: "print environment variables (read-only)" },
+        { pattern: ["npm", ["view", "info"]], decision: "allow", justification: "read package metadata from registry" },
         // --- prompt: potentially destructive but context-dependent ---
         { pattern: ["rm"], decision: "prompt", justification: "file deletion — review the target" },
         { pattern: ["git", "commit"], decision: "prompt", justification: "creates a commit — confirm intent" },

package/dist/extension/permission.d.ts

@@ -184,7 +184,7 @@ export interface RegisterPermissionDeps {
 export declare const MODE_CONTEXT_TYPE = "yagni-mode-context";
 /** Legacy alias — the original plan-mode tag, kept for backward compat. */
 export declare const PLAN_CONTEXT_TYPE = "yagni-mode-context";
-export declare const PLAN_CONTEXT_MESSAGE = "[PLAN MODE ACTIVE]\nYou are in plan mode: explore and design, change nothing.\n- write, edit, and bash are held by the permission gate; do not attempt them.\n- Read, search, and ask_yagni freely to ground the plan in how this company works.\n- Produce a concrete numbered plan of the steps you would take, with the files involved.\n- End by asking the user to review the plan; they run /mode auto (or /mode review) to execute it.\n- Once executing, track the plan's steps with todo_write.";
+export declare const PLAN_CONTEXT_MESSAGE = "[PLAN MODE ACTIVE]\nYou are in plan mode: explore and design, change nothing.\n- Read-only bash commands (ls, grep, git status, gh pr view, etc.) run freely to help you explore.\n- Ambiguous bash commands are reviewed by the Guardian; if non-mutating they run, if potentially mutating you will be asked.\n- write, edit, file_ticket, and update_ticket_status are held by the permission gate; do not attempt them.\n- Read, search, and ask_yagni freely to ground the plan in how this company works.\n- Produce a concrete numbered plan of the steps you would take, with the files involved.\n- End by asking the user to review the plan; they run /mode auto (or /mode review) to execute it.\n- Once executing, track the plan's steps with todo_write.";
 /** Build the mode-awareness context message for the current permission mode. */
 export declare function buildModeContextMessage(mode: PermissionMode): string;
 /**

package/dist/extension/permission.js

@@ -56,6 +56,42 @@ export const DEFAULT_PERMISSION_POLICY = {
  */
 export function decideGate(toolName, params, mode, policy) {
     if (mode === "plan") {
+        // Non-bash tools in planBlockTools are held outright — they are
+        // inherently mutating (write, edit, file_ticket, update_ticket_status).
+        // Bash is the exploration tool: run it through the exec policy so
+        // read-only commands (git status, ls, grep, gh pr view) work, and
+        // prompt-band commands are routed to the Guardian. The gate handler
+        // ensures Guardian-unavailable/capped/disabled states fail closed.
+        if (toolName === "bash") {
+            const command = typeof params.command === "string" ? params.command.trim() : "";
+            if (command) {
+                try {
+                    const execPolicy = policy.execPolicy ?? DEFAULT_EXEC_POLICY;
+                    const classification = classifyCommand(command, execPolicy);
+                    if (classification.decision === "allow")
+                        return { block: false };
+                    if (classification.decision === "forbidden") {
+                        return {
+                            block: true,
+                            reason: `${classification.justification}. Do not attempt the same outcome via a workaround or indirect execution — use a materially safer alternative, or ask the user.`,
+                        };
+                    }
+                    // prompt — Guardian reviews. The gate handler runs the Guardian
+                    // and handles allow/ask/deny. Grants and cache are skipped in
+                    // plan mode (they can cover writes). Guardian unavailable/capped/
+                    // disabled → block (fail closed).
+                    return { block: false, classify: "prompt", classifyJustification: classification.justification };
+                }
+                catch {
+                    // classifyCommand threw — fail closed in plan mode.
+                    return {
+                        block: true,
+                        reason: `plan mode: could not classify this bash command and it is held. Switch to /mode auto to apply changes.`,
+                    };
+                }
+            }
+            return { block: false };
+        }
         if (policy.planBlockTools.includes(toolName)) {
             return {
                 block: true,
@@ -122,7 +158,9 @@ const AUTO_MARKER = "[AUTO MODE]";
 const REVIEW_MARKER = "[REVIEW MODE]";
 export const PLAN_CONTEXT_MESSAGE = `${PLAN_MARKER}
 You are in plan mode: explore and design, change nothing.
-- write, edit, and bash are held by the permission gate; do not attempt them.
+- Read-only bash commands (ls, grep, git status, gh pr view, etc.) run freely to help you explore.
+- Ambiguous bash commands are reviewed by the Guardian; if non-mutating they run, if potentially mutating you will be asked.
+- write, edit, file_ticket, and update_ticket_status are held by the permission gate; do not attempt them.
 - Read, search, and ask_yagni freely to ground the plan in how this company works.
 - Produce a concrete numbered plan of the steps you would take, with the files involved.
 - End by asking the user to review the plan; they run /mode auto (or /mode review) to execute it.
@@ -414,7 +452,9 @@ export function registerPermissionGate(pi, deps = {}) {
                     }
                 }
                 // 2. Session exact-command approval cache (ticket 4.5).
-                if (command && approvedCommands.has(cacheKey(cwd, command))) {
+                // Skipped in plan mode: a cached approval can cover a write command,
+                // and plan mode's contract is no mutations without Guardian review.
+                if (modeAtEntry !== "plan" && command && approvedCommands.has(cacheKey(cwd, command))) {
                     emitGateEvent({ ...eventBase, outcome: "cached_allow", consulted: false });
                     return {};
                 }
@@ -423,13 +463,13 @@ export function registerPermissionGate(pi, deps = {}) {
                 if (guardianAvailable && guardianState.read().reviews >= limits.maxReviews) {
                     // Sliding-window consult cap (capacity recovers as old reviews age
                     // out — a long-lived session is never bricked). Review mode falls
-                    // through to its ordinary confirm (no LLM cost); auto blocks.
-                    if (modeAtEntry === "auto") {
+                    // through to its ordinary confirm (no LLM cost); auto and plan block.
+                    if (modeAtEntry === "auto" || modeAtEntry === "plan") {
                         if (ctx?.hasUI)
                             ctx.ui.notify(`Guardian review cap reached (${limits.maxReviews} in the last hour).`, "warning");
                         return { block: true, reason: `Guardian review cap reached (${limits.maxReviews} in the last hour). Capacity recovers as older reviews age out; switch to /mode review to approve manually, or retry this step later.` };
                     }
-                    // fall through to decision.confirm below
+                    // review mode: fall through to decision.confirm below
                 }
                 else if (guardianAvailable) {
                     // Circuit breaker (pre-consult). With a UI, escalate to ONE ask per
@@ -675,6 +715,14 @@ export function registerPermissionGate(pi, deps = {}) {
                     // approval cache were already consulted above.
                     return {};
                 }
+                else if (modeAtEntry === "plan") {
+                    // Guardian disabled or not wired in plan mode: fail closed. Without
+                    // the Guardian to verify the command is non-mutating, the plan-mode
+                    // contract (no changes) cannot be upheld. The user can switch to
+                    // /mode auto or /mode review to proceed.
+                    emitGateEvent({ ...eventBase, outcome: "breaker_blocked", consulted: false });
+                    return { block: true, reason: "Guardian unavailable in plan mode. Switch to /mode auto to run commands, or /mode review to approve manually." };
+                }
                 // review mode with Guardian disabled/capped: fall through to confirm.
             }
             if (decision.confirm) {

package/dist/extension/pipeline/personas.js

@@ -107,7 +107,7 @@ Risk taxonomy:
 Outcome rules:
 - "deny" is reserved for actions you are VERY CONFIDENT are very dangerous: irreversible destruction, exfiltration of sensitive data, credential probing, production-impacting security weakening. If you are not sure it is that bad, do not deny.
 - "allow" when you are confident the action is safe: read-only, routine dev-loop, or clearly scoped and reversible.
-- "ask" for everything in between — the action might be fine but a human should decide. This is the correct outcome whenever your confidence is middling; prefer ask over deny for anything short of the very-dangerous bar, and prefer allow over ask for routine work (do not hedge routine commands into ask).
+- "ask" for actions where a specific, concrete risk makes you unsure — the action has a plausible path to harm that you cannot rule out by reading the command. Do not ask just because a command "might" do something; ask when you can name the specific thing you are worried about. If you cannot articulate a concrete risk, allow. Prefer allow over ask: routine dev-loop operations, local file writes within a project, and standard git operations (add, commit, fetch) are safe — the agent is already operating in the user's repository with their consent.
 
 Rationale rules:
 - For "ask", the rationale MUST be a specific question addressed to the user, naming the concrete effect that made you unsure — e.g. "This pushes 3 commits to the shared main branch — do you want to publish them now?". You may be told why the static policy routed the command to you; your rationale must ADD information beyond that policy text, not restate it.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yagni-app/code-staging",
-  "version": "0.3.1-staging.1108.1",
+  "version": "0.3.2-staging.1112.1",
   "description": "YAGNI Code: a terminal coding agent that already knows your company. One YAGNI login routes the model and grounds the agent in your team's context.",
   "license": "SEE LICENSE IN LICENSE.md",
   "author": "YAGNI, Inc. <jack@yagni.app> (https://yagni.app)",
@@ -39,5 +39,5 @@
     "smol-toml": "^1.8.0",
     "typebox": "^1.3.11"
   },
-  "yagniSourceSha": "4244ba837c0cfc0ad410d02e34df6ad82e32a848"
+  "yagniSourceSha": "792a9033a5199d4129ba1a53605b23881956e4ce"
 }