@yagni-app/code-staging 1.0.0-staging.1185.1 → 1.0.0-staging.1190.1

package/dist/extension/branding.d.ts

@@ -59,6 +59,19 @@ export declare const YAGNI_IDENTITY_DRIVER = "You are YAGNI Code, an autonomous
  * open with a `- ` bullet line, no emojis.
  */
 export declare const TICKET_IMAGE_RULE: string;
+/**
+ * GitHub operations recipe. A standing directive that teaches the
+ * model the one correct way to reply to inline PR review comments and how to
+ * pass multi-line bodies to `gh`/`git` without shell-quoting failures. It is
+ * GitHub-mechanics knowledge every session needs — the two failures it fixes
+ * (hoisting several inline replies into one top-level comment; a shell-
+ * quoting dance that mangles multi-line bodies) are universal, not
+ * workflow-specific.
+ *
+ * Content constraints (parity with {@link TICKET_IMAGE_RULE}): must not contain
+ * the standalone word "pi", must not open with a `- ` bullet line, no emojis.
+ */
+export declare const GITHUB_OPERATIONS: string;
 /**
  * The injected-reminder framing (YAG-574, Change A prerequisite). Claude Code
  * carries this exact sentence in every system prompt so its whole reminder

package/dist/extension/branding.js

@@ -95,6 +95,66 @@ export const TICKET_IMAGE_RULE = "When you read or fetch a ticket from any track
     "ticket whose images you have not actually looked at.";
 /** Stable header that starts the ticket-image rule section (idempotency anchor). */
 const TICKET_IMAGE_RULE_HEADER = "## Rule: always read a ticket's images";
+/**
+ * GitHub operations recipe. A standing directive that teaches the
+ * model the one correct way to reply to inline PR review comments and how to
+ * pass multi-line bodies to `gh`/`git` without shell-quoting failures. It is
+ * GitHub-mechanics knowledge every session needs — the two failures it fixes
+ * (hoisting several inline replies into one top-level comment; a shell-
+ * quoting dance that mangles multi-line bodies) are universal, not
+ * workflow-specific.
+ *
+ * Content constraints (parity with {@link TICKET_IMAGE_RULE}): must not contain
+ * the standalone word "pi", must not open with a `- ` bullet line, no emojis.
+ */
+export const GITHUB_OPERATIONS = "## GitHub Operations\n" +
+    "\n" +
+    "Use `gh` via bash for GitHub reads and writes (pull requests, issues, " +
+    "reviews, checks, releases). Given a GitHub URL, run `gh` to get the info.\n" +
+    "\n" +
+    "## Reply to inline review comments in-thread\n" +
+    "\n" +
+    "When a PR review leaves inline comments and you have addressed them, reply " +
+    "to each inline comment in its own thread, describing how it was handled. " +
+    "Do not hoist replies to several inline threads into a single top-level " +
+    "comment — each inline comment earns its own reply.\n" +
+    "\n" +
+    "Top-level comments are for matters with no inline anchor: an overall " +
+    "summary, a question about the change as a whole, or a review that produced " +
+    "no inline comments (for example, the only failure was on a CI run).\n" +
+    "\n" +
+    "## How to reply to an inline comment\n" +
+    "\n" +
+    "List inline comments on a PR:\n" +
+    "  gh api repos/{owner}/{repo}/pulls/{number}/comments\n" +
+    "\n" +
+    "Reply to a specific inline comment (write a multi-line reply to a file " +
+    "first, then pass the path — see Bodies below):\n" +
+    "  gh api repos/{owner}/{repo}/pulls/{number}/comments/{comment_id}/replies \\\n" +
+    "    -F body=@<path>\n" +
+    "\n" +
+    "This is the one reply path. Do not use `in_reply_to` on the comment-creation " +
+    "endpoint — it works only on top-level comments and does not nest.\n" +
+    "\n" +
+    "## Bodies: write to a file, pass the path\n" +
+    "\n" +
+    "Pass multi-line body text (PR description, comment, review reply, commit " +
+    "message) via a file, never inline it in the shell command. Inline forms " +
+    "(`--body \"$(cat <<'EOF' … EOF)\"`, bare `-f body='…'`) break on some " +
+    "platforms and on apostrophes/backticks/`$` in the body; a file has no " +
+    "quoting surface. Use the session scratchpad for the file.\n" +
+    "\n" +
+    "Write the body with the `write` tool, then:\n" +
+    "  gh pr create --title \"…\" --body-file <path>\n" +
+    "  gh pr comment <n> --body-file <path>\n" +
+    "  gh api repos/{owner}/{repo}/pulls/{number}/comments/{comment_id}/replies -F body=@<path>\n" +
+    "  git commit -F <path>\n" +
+    "\n" +
+    "For a short single-line body with no apostrophe, `-f body='…'` and " +
+    "`-m '…'` are fine; the file form is the default for anything " +
+    "multi-paragraph.";
+/** Stable header that starts the GitHub operations section (idempotency anchor). */
+const GITHUB_OPERATIONS_HEADER = "## GitHub Operations";
 /**
  * The injected-reminder framing (YAG-574, Change A prerequisite). Claude Code
  * carries this exact sentence in every system prompt so its whole reminder
@@ -249,6 +309,13 @@ export function brandSystemPrompt(original, opts = {}) {
     if (!s.includes(TICKET_IMAGE_RULE_HEADER)) {
         s = `${s}\n\n${TICKET_IMAGE_RULE_HEADER}\n${TICKET_IMAGE_RULE}`;
     }
+    // 5b2. GitHub operations — a standing directive added alongside
+    // the ticket-image rule (same placement, same idempotency shape). It is
+    // universal knowledge, not user policy, so it rides the branded prompt
+    // instead of the repository-rules section.
+    if (!s.includes(GITHUB_OPERATIONS_HEADER)) {
+        s = `${s}\n\n${GITHUB_OPERATIONS}`;
+    }
     // 5c. YAG-574: the injected-reminder framing (which makes the silent-turn
     // nudge legible) and the two communication lines (Change B). Appended after
     // everything user-provided but before the closing reminder, each guarded by

package/dist/extension/permission/execPolicy.js

@@ -727,12 +727,59 @@ function isPipeToShell(command) {
  * backticks, including inside double quotes). Matches FORBIDDEN rules only —
  * can upgrade the classification, never relax it.
  */
+const QUOTED_HEREDOC_OPEN = /^cat[ \t]+<<[ \t]*(?:'([^']+)'|"([^"]+)"|\\([A-Za-z_][A-Za-z0-9_]*))[ \t]*\r?\n/;
+/**
+ * Recognize the `cat <<'QUOTED' … QUOTED` idiom inside a command substitution.
+ *
+ * This is the one way to pass multi-line body content to `gh`/`git` as a
+ * literal string: the quoted delimiter (`<<'EOF'`, `<<"EOF"`, or `<<\EOF`)
+ * makes the heredoc body literal — no `$`/backtick expansion — and `cat` merely
+ * prints it. A body like `rm -rf /tmp/test-db` inside such a heredoc is PROSE,
+ * not a command; sweeping it for forbidden rules is a false positive.
+ *
+ * Returns true ONLY for the exact safe shape: the whole substitution is `cat`
+ * with no arguments, followed by a heredoc whose delimiter is quoted and whose
+ * terminator is the delimiter on its own final line. Any deviation (unquoted
+ * delimiter, extra args to `cat`, a second command after the terminator)
+ * returns false and falls through to the ordinary danger scan. Safety does not
+ * hinge on this exemption: the outer command (the `gh pr create`, the `rm`) is
+ * still classified on its own merits, heredoc or not.
+ */
+function isLiteralQuotedCatHeredoc(inner) {
+    const text = inner.trim();
+    const m = QUOTED_HEREDOC_OPEN.exec(text);
+    if (!m)
+        return false;
+    const delim = m[1] ?? m[2] ?? m[3];
+    const bodyStart = m[0].length;
+    const lines = text.slice(bodyStart).split(/\r?\n/);
+    if (lines.length === 0)
+        return false;
+    // The final line must be the bare delimiter (the closing `)` is already
+    // stripped by extractSubstitutions).
+    if (lines[lines.length - 1].trim() !== delim)
+        return false;
+    // No line BEFORE the terminator may equal the delimiter: in real bash, a
+    // delimiter line terminates the heredoc there, turning everything after it
+    // into an executed command (e.g. a body with a bare `EOF` line followed by
+    // `rm -rf /x` would run the `rm`). Reject that shape and fall to the scan.
+    for (const line of lines.slice(0, -1)) {
+        if (line.trim() === delim)
+            return false;
+    }
+    return true;
+}
 function dangerScanSubstitutions(command, policy, depth) {
     if (depth > MAX_SCAN_DEPTH)
         return null;
     for (const inner of extractSubstitutions(command)) {
         if (inner.trim().length === 0)
             continue;
+        // Quoted-heredoc cat: the body is literal data, not an executable
+        // command — skipping it avoids false "forbidden" hits on prose that happens
+        // to contain a forbidden-looking token. The outer command still classifies.
+        if (isLiteralQuotedCatHeredoc(inner))
+            continue;
         if (isPipeToShell(inner)) {
             return {
                 decision: "forbidden",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yagni-app/code-staging",
-  "version": "1.0.0-staging.1185.1",
+  "version": "1.0.0-staging.1190.1",
   "description": "YAGNI Code: a terminal coding agent that already knows your company. One YAGNI login routes the model and grounds the agent in your team's context.",
   "license": "SEE LICENSE IN LICENSE.md",
   "author": "YAGNI, Inc. <jack@yagni.app> (https://yagni.app)",
@@ -41,5 +41,5 @@
     "turndown": "^7.2.4",
     "typebox": "^1.3.15"
   },
-  "yagniSourceSha": "970cc138faff85585c7d21243aeb553937df2a40"
+  "yagniSourceSha": "482fa38ca9aa9105673fd305e6e252305aaa1ed5"
 }