@yagni-app/code-staging 1.0.5-staging.1238.1 → 1.0.5-staging.1240.1

package/dist/cli.js

@@ -516,6 +516,10 @@ export const HELP_TEXT = [
     "  yagni connect claude-code  Route Claude Code through the YAGNI model proxy",
     "                           (--project scopes to this repo; --off disconnects).",
     "  yagni connect codex      Route Codex CLI through the YAGNI model proxy.",
+    "  yagni mcp <subcommand>    Manage MCP servers: add, remove, list, get,",
+    "                           add-from-claude, and more — run `yagni mcp` for",
+    "                           details. OAuth servers authenticate via the",
+    "                           /mcp panel in a session.",
     "  yagni token              Output the active environment's API token (for helpers).",
     "  yagni use <name>         Switch the active environment (sticky).",
     "                           Presets: prod, local. Others need --base-url <url>.",
@@ -537,6 +541,7 @@ export const HELP_TEXT = [
     "  /mode plan|review|auto   Hold writes for planning, or confirm each change.",
     "  /todos                   Show the agent's live task list.",
     "  /cost                    Session usage and credit headroom.",
+    "  /mcp                     Manage MCP servers; authenticate OAuth servers.",
     "",
     "The active environment is sticky; `use` switches it (prod is the default).",
     "Set YAGNI_BASE_URL to override the base URL for a single run.",

package/dist/extension/index.js

@@ -386,12 +386,18 @@ export async function registerYagni(pi, deps = {}) {
     const guardianLogSink = (payload) => {
         const event = typeof payload.event === "string" ? payload.event : "guardian_event";
         const { event: _ignored, ...fields } = payload;
+        // `malformed` (repair failed — still really failing) and a failed
+        // telemetry POST are errors. `repaired: true` (the ladder salvaged the
+        // verdict) is a warn — it worked, but we keep counting it. Everything
+        // else is routine info.
+        const level = event === "guardian_event_post_failed" || payload.outcome === "malformed"
+            ? "error"
+            : payload.repaired === true && payload.outcome !== undefined
+                ? "warn"
+                : "info";
         logEvent({
             source: "guardian",
-            // `malformed` is a real failure (this is the "unclear verdict" bug the
-            // whole capture exists to diagnose) — an error, not routine info. The
-            // failed-telemetry event is already an error.
-            level: event === "guardian_event_post_failed" || payload.outcome === "malformed" ? "error" : "info",
+            level,
             event,
             sessionId: env.YAGNI_SESSION_ID ?? undefined,
             fields,
@@ -419,15 +425,20 @@ export async function registerYagni(pi, deps = {}) {
         guardianReview: (command, deps) => reviewCommand(command, { ...deps, modelTier: guardianTier }),
         onGuardianReview: (ev) => {
             guardianLogSink(ev);
-            // A malformed verdict is a real failure on our side that must reach
-            // Sentry for EVERY workspace (independent of the opt-in storage tier).
-            // Fire-and-forget to the dedicated telemetry endpoint; fail-soft, and
+            // A malformed verdict (repair FAILED — still really failing) is a real
+            // failure on our side that must reach Sentry for EVERY workspace
+            // (independent of the opt-in storage tier). A REPAIRED verdict (repair
+            // salvaged it) posts too, with outcome "malformed_repaired" so the
+            // backend can count salvage hits on their own Sentry issue. Both
+            // fire-and-forget to the dedicated telemetry endpoint; fail-soft, and
             // suppressed under test/eval so a CI run never phones prod.
-            if (ev.outcome === "malformed" && !evalMode && !runningUnderTest(env)) {
+            const isMalformed = ev.outcome === "malformed";
+            const isRepaired = ev.outcome !== "malformed" && ev.repaired === true;
+            if ((isMalformed || isRepaired) && !evalMode && !runningUnderTest(env)) {
                 void (async () => {
                     try {
                         const body = {
-                            outcome: ev.outcome,
+                            outcome: isRepaired ? "malformed_repaired" : ev.outcome,
                             ...(ev.rawOutput ? { rawOutput: ev.rawOutput } : {}),
                             ...(ev.durationMs !== undefined ? { durationMs: ev.durationMs } : {}),
                             ...(ev.tier ? { tier: ev.tier } : {}),

package/dist/extension/mcp/auth.js

@@ -25,6 +25,7 @@ import { runningUnderTest } from "../crashReport.js";
 import { getStoredOAuthEntry, updateStoredOAuthEntry } from "./authStore.js";
 import { deleteStoredOAuthEntry as clearStoredOAuthEntry } from "./authStore.js";
 import { logMcpEvent, redactSensitiveUrlParams } from "./log.js";
+import { renderAuthErrorPage, renderAuthStateMismatchPage, renderAuthSuccessPage, } from "./callbackPage.js";
 /** Cancellation via an AbortSignal (Ctrl-C / Esc in the /mcp panel). */
 export class AuthenticationCancelledError extends Error {
     constructor(message = "OAuth cancelled") {
@@ -424,20 +425,23 @@ function waitForCode(port, expectedState, opts = {}) {
                 // The provider-controlled values are HTML-escaped: any local process
                 // can hit the loopback with a crafted ?error=<script> payload, and the
                 // page must never reflect it (same spot Claude Code sanitizes).
-                res.end(`<h1>Authentication Error</h1><p>${escapeHtml(error)}${errorDescription ? `: ${escapeHtml(errorDescription)}` : ""}</p><p>You can close this window.</p>`);
+                res.end(renderAuthErrorPage({
+                    error: escapeHtml(error),
+                    errorDescription: errorDescription ? escapeHtml(errorDescription) : undefined,
+                }));
                 finish(undefined);
                 return;
             }
             if (state !== expectedState) {
                 onEvent?.("oauth_callback_state_mismatch", {});
                 res.writeHead(400, { "Content-Type": "text/html" });
-                res.end("<h1>Authentication Error</h1><p>Invalid state parameter. Please try again.</p>");
+                res.end(renderAuthStateMismatchPage());
                 fail(new Error("OAuth state mismatch - possible CSRF attack"));
                 return;
             }
             onEvent?.("oauth_callback_code", {});
             res.writeHead(200, { "Content-Type": "text/html" });
-            res.end("<h1>Authentication Successful</h1><p>You can close this window and return to YAGNI Code.</p>");
+            res.end(renderAuthSuccessPage());
             finish(code);
         });
         server.on("error", () => {

package/dist/extension/mcp/callbackPage.d.ts

@@ -0,0 +1,31 @@
+/**
+ * The loopback OAuth callback page — the only surface a user ever sees served
+ * from the local `127.0.0.1:<port>/callback` listener. Rendered with the same
+ * Glass & Print language as the app: tinted blue field, floating glass card,
+ * one blue accent, three type voices (Instrument Sans interface / Newsreader
+ * authored / IBM Plex Mono fact).
+ *
+ * Self-contained: no external assets, fonts, or network calls — the page must
+ * render offline and never phone home. Tokens are inlined from
+ * packages/frontend/src/styles/tokens.css so this module can't drift a runtime
+ * dependency on the frontend build; token names are kept in comments so a
+ * re-derivation stays mechanical.
+ *
+ * `escapeHtml` is applied by the caller to every provider-controlled value
+ * before interpolation (a local process can hit the loopback with a crafted
+ * ?error=<script> payload — the page never reflects raw input).
+ */
+/** The success page shown after the provider redirects back with a code. */
+export declare function renderAuthSuccessPage(): string;
+/**
+ * The error page shown when the provider bounces the flow. `error` and
+ * `errorDescription` are provider-controlled and already HTML-escaped by the
+ * caller.
+ */
+export declare function renderAuthErrorPage(opts: {
+    error?: string;
+    errorDescription?: string;
+}): string;
+/** The state-mismatch page — a hard failure, shown before the flow aborts. */
+export declare function renderAuthStateMismatchPage(): string;
+//# sourceMappingURL=callbackPage.d.ts.map

package/dist/extension/mcp/callbackPage.js

@@ -0,0 +1,222 @@
+/**
+ * The loopback OAuth callback page — the only surface a user ever sees served
+ * from the local `127.0.0.1:<port>/callback` listener. Rendered with the same
+ * Glass & Print language as the app: tinted blue field, floating glass card,
+ * one blue accent, three type voices (Instrument Sans interface / Newsreader
+ * authored / IBM Plex Mono fact).
+ *
+ * Self-contained: no external assets, fonts, or network calls — the page must
+ * render offline and never phone home. Tokens are inlined from
+ * packages/frontend/src/styles/tokens.css so this module can't drift a runtime
+ * dependency on the frontend build; token names are kept in comments so a
+ * re-derivation stays mechanical.
+ *
+ * `escapeHtml` is applied by the caller to every provider-controlled value
+ * before interpolation (a local process can hit the loopback with a crafted
+ * ?error=<script> payload — the page never reflects raw input).
+ */
+const CSS = `
+  :root {
+    /* tokens.css — field, ink, accent, materials */
+    --field-base: #f4f6fc;
+    --field-tint-blue: #dfe8ff;
+    --field-tint-violet: #e8e4ff;
+    --field-tint-cyan: #e3f0f6;
+    --ink: #23252e;
+    --ink-strong: #181a22;
+    --text-secondary: #565b72;
+    --text-quiet: #8b90a5;
+    --text-label: #7b8098;
+    --accent: #2f56d3;
+    --accent-muted: rgba(47, 86, 211, 0.12);
+    --accent-border: rgba(47, 86, 211, 0.3);
+    --error: #b4452f;
+    --error-muted: rgba(180, 69, 47, 0.07);
+    --glass-bg: rgba(255, 255, 255, 0.55);
+    --glass-border: rgba(255, 255, 255, 0.85);
+    --glass-blur: 18px;
+    --radius-pane: 16px;
+    --shadow-staged: 0 1px 2px rgba(24, 34, 64, 0.07), 0 18px 40px -30px rgba(38, 52, 110, 0.35);
+    --shadow-staged-high: 0 1px 2px rgba(24, 34, 64, 0.08), 0 28px 60px -28px rgba(38, 52, 110, 0.42);
+    --body: "Instrument Sans Variable", "Instrument Sans", system-ui, sans-serif;
+    --prose: "Newsreader", ui-serif, Georgia, serif;
+    --mono: "IBM Plex Mono", ui-monospace, monospace;
+  }
+
+  * { box-sizing: border-box; }
+
+  html, body { height: 100%; }
+
+  body {
+    margin: 0;
+    min-height: 100%;
+    display: grid;
+    place-items: center;
+    padding: 24px;
+    font-family: var(--body);
+    color: var(--ink);
+    background:
+      radial-gradient(1200px 700px at 8% -5%, var(--field-tint-blue) 0, rgba(223, 232, 255, 0) 60%),
+      radial-gradient(900px 600px at 95% 0%, var(--field-tint-violet) 0, rgba(232, 228, 255, 0) 55%),
+      radial-gradient(900px 700px at 60% 100%, var(--field-tint-cyan) 0, rgba(227, 240, 246, 0) 60%),
+      var(--field-base);
+  }
+
+  .card {
+    width: 100%;
+    max-width: 400px;
+    text-align: center;
+    padding: 40px 32px 32px;
+    background: var(--glass-bg);
+    -webkit-backdrop-filter: blur(var(--glass-blur)) saturate(1.15);
+    backdrop-filter: blur(var(--glass-blur)) saturate(1.15);
+    border: 1px solid var(--glass-border);
+    border-radius: var(--radius-pane);
+    box-shadow: var(--shadow-staged-high);
+    animation: rise 420ms cubic-bezier(0.22, 1, 0.36, 1) both;
+  }
+
+  @keyframes rise {
+    from { opacity: 0; transform: translateY(8px); }
+    to { opacity: 1; transform: none; }
+  }
+
+  .wordmark {
+    font-family: var(--mono);
+    font-size: 10px;
+    font-weight: 600;
+    letter-spacing: 0.22em;
+    text-transform: uppercase;
+    color: var(--text-label);
+    margin: 0 0 28px;
+  }
+
+  .badge {
+    width: 52px;
+    height: 52px;
+    margin: 0 auto 20px;
+    display: grid;
+    place-items: center;
+    border-radius: 14px;
+    background: var(--accent-muted);
+    border: 1px solid var(--accent-border);
+    color: var(--accent);
+  }
+
+  .card--error .badge {
+    background: var(--error-muted);
+    border-color: rgba(180, 69, 47, 0.28);
+    color: var(--error);
+  }
+
+  h1 {
+    font-family: var(--prose);
+    font-size: 30px;
+    font-weight: 600;
+    line-height: 1.15;
+    letter-spacing: -0.01em;
+    color: var(--ink-strong);
+    margin: 0 0 10px;
+  }
+
+  .lede {
+    font-size: 14px;
+    line-height: 1.55;
+    color: var(--text-secondary);
+    margin: 0 0 24px;
+  }
+
+  .detail {
+    font-family: var(--mono);
+    font-size: 12px;
+    line-height: 1.5;
+    color: var(--error);
+    background: var(--error-muted);
+    border: 1px solid rgba(180, 69, 47, 0.2);
+    border-radius: 8px;
+    padding: 8px 10px;
+    margin: 0 0 24px;
+    word-break: break-word;
+  }
+
+  .divider {
+    height: 1px;
+    margin: 0 0 20px;
+    background: linear-gradient(90deg, transparent, var(--accent-border), transparent);
+  }
+
+  .hint {
+    font-size: 12.5px;
+    color: var(--text-quiet);
+    margin: 0;
+  }
+
+  @media (prefers-reduced-motion: reduce) {
+    .card { animation: none; }
+  }
+`;
+const CHECK_ICON = `<svg width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M20 6 9 17l-5-5"/></svg>`;
+const ERROR_ICON = `<svg width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.2" stroke-linecap="round" aria-hidden="true"><circle cx="12" cy="12" r="9"/><line x1="12" y1="8" x2="12" y2="13"/><line x1="12" y1="16.5" x2="12.01" y2="16.5"/></svg>`;
+function shell(opts) {
+    return `<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<meta name="color-scheme" content="light">
+<title>${opts.title} — YAGNI Code</title>
+<style>${CSS}</style>
+</head>
+<body>
+  <main class="card${opts.error ? " card--error" : ""}">
+    <p class="wordmark">YAGNI Code</p>
+    <div class="badge">${opts.error ? ERROR_ICON : CHECK_ICON}</div>
+    <h1>${opts.heading}</h1>
+    <p class="lede">${opts.lede}</p>
+    ${opts.detail ? `<p class="detail">${opts.detail}</p>` : ""}
+    <div class="divider"></div>
+    <p class="hint">${opts.hint}</p>
+  </main>
+</body>
+</html>`;
+}
+/** The success page shown after the provider redirects back with a code. */
+export function renderAuthSuccessPage() {
+    return shell({
+        title: "Connected",
+        heading: "Connected to YAGNI Code",
+        lede: "Your MCP server is authorized and ready to use.",
+        hint: "You can close this window and return to your session.",
+    });
+}
+/**
+ * The error page shown when the provider bounces the flow. `error` and
+ * `errorDescription` are provider-controlled and already HTML-escaped by the
+ * caller.
+ */
+export function renderAuthErrorPage(opts) {
+    const detail = opts.error
+        ? opts.errorDescription
+            ? `${opts.error}: ${opts.errorDescription}`
+            : opts.error
+        : undefined;
+    return shell({
+        title: "Connection failed",
+        error: true,
+        heading: "Authentication didn't complete",
+        lede: "The provider didn't finish the sign-in flow.",
+        detail,
+        hint: "You can close this window and try again from YAGNI Code.",
+    });
+}
+/** The state-mismatch page — a hard failure, shown before the flow aborts. */
+export function renderAuthStateMismatchPage() {
+    return shell({
+        title: "Connection failed",
+        error: true,
+        heading: "Authentication didn't complete",
+        lede: "The sign-in response didn't match the request, so it was rejected.",
+        hint: "You can close this window and try again from YAGNI Code.",
+    });
+}
+//# sourceMappingURL=callbackPage.js.map

package/dist/extension/permission/gate.js

@@ -577,6 +577,7 @@ export function registerPermissionGate(pi, deps = {}) {
                         void Promise.resolve(deps.onGuardianReview(buildDiagnosticEvent(outcome, {
                             durationMs,
                             tier: guardianTier,
+                            ...(reviewResult.repaired ? { repaired: true } : {}),
                             ...(rationale ? { rationale } : {}),
                             ...(rawOutput ? { rawOutput } : {}),
                             debug: isDebug(),
@@ -585,7 +586,11 @@ export function registerPermissionGate(pi, deps = {}) {
                     const verdict = reviewResult.verdict;
                     if (verdict?.outcome === "allow") {
                         guardianState.recordReview("allow");
-                        emitDiag("allow", verdict.rationale);
+                        // A repaired verdict is a REAL allow: it flows through the normal
+                        // path; the diag event carries `repaired` + the pre-repair shape so
+                        // telemetry can count salvage hits (the rawOutput is already
+                        // scrubbed + capped at the source).
+                        emitDiag("allow", verdict.rationale, reviewResult.repaired ? reviewResult.rawOutput : undefined);
                         emitGateEvent({
                             ...eventBase,
                             outcome: "allow",
@@ -599,7 +604,7 @@ export function registerPermissionGate(pi, deps = {}) {
                     if (verdict?.outcome === "deny") {
                         guardianState.recordReview("deny");
                         const rationale = verdict.rationale;
-                        emitDiag("deny", rationale);
+                        emitDiag("deny", rationale, reviewResult.repaired ? reviewResult.rawOutput : undefined);
                         emitGateEvent({
                             ...eventBase,
                             outcome: "deny",
@@ -624,7 +629,7 @@ export function registerPermissionGate(pi, deps = {}) {
                     }
                     if (verdict?.outcome === "ask") {
                         guardianState.recordReview("ask");
-                        emitDiag("ask", verdict.rationale);
+                        emitDiag("ask", verdict.rationale, reviewResult.repaired ? reviewResult.rawOutput : undefined);
                         if (!ctx?.hasUI) {
                             // Headless (includes every /go child stage): fail closed.
                             emitGateEvent({

package/dist/extension/permission/guardian.d.ts

@@ -99,6 +99,14 @@ export interface CircuitBreakerResult {
     reason?: string;
 }
 export declare function checkCircuitBreaker(state: GuardianState, limits: GuardianLimits): CircuitBreakerResult;
+export interface ParsedVerdict {
+    verdict: GuardianVerdict;
+    /** True when the strict parse failed and the lenient repair ladder salvaged it. */
+    repaired: boolean;
+}
+export declare function parseVerdictDetailed(raw: string): ParsedVerdict | null;
+/** Strict-shaped convenience wrapper: the verdict, or null. Callers that need
+ * the repaired signal use {@link parseVerdictDetailed}. */
 export declare function parseVerdict(raw: string): GuardianVerdict | null;
 export declare function formatGuardianSubtotal(state: GuardianState, limits: GuardianLimits): string;
 export type GuardianError = "timeout" | "malformed" | "network" | "empty" | "aborted";
@@ -106,11 +114,17 @@ export interface ReviewResult {
     verdict: GuardianVerdict | null;
     error?: GuardianError;
     cost: number;
+    /** True when the verdict came from the lenient repair ladder (strict parse
+     * failed first). The verdict is real and flows through the normal
+     * allow/ask/deny handling; this flag only marks it for telemetry. */
+    repaired?: boolean;
     /**
      * Scrubbed + capped copy of the model output when the verdict failed to
-     * parse (`error: "malformed"`). Present so the sink can capture the exact
-     * failure shape. Never contains the raw command unredacted: `scrubSecrets`
-     * removes secret-shaped values before this is stored.
+     * parse (`error: "malformed"`), or of the pre-repair extracted block when
+     * the repair ladder salvaged it (`repaired: true`). Present so the sink can
+     * capture the exact failure shape either way. Never contains the raw
+     * command unredacted: `scrubSecrets` removes secret-shaped values before
+     * this is stored.
      */
     rawOutput?: string;
 }
@@ -152,14 +166,18 @@ export interface GuardianDiagnosticEvent {
     outcome: GuardianOutcome | GuardianError;
     durationMs?: number;
     tier?: string;
+    /** True when the lenient repair ladder salvaged a broken verdict — the
+     * outcome is still the REAL verdict (allow/ask/deny); this flag marks it
+     * for telemetry so repair hit-rate is measurable. */
+    repaired?: true;
     /** Debug-only: command hash for correlation (never the raw command). */
     commandHash?: string;
     /** Debug-only: the Guardian's rationale. */
     rationale?: string;
     /**
      * Scrubbed + capped copy of the unparseable model output, present only for
-     * `outcome: "malformed"`. Always-on (NOT debug-gated): it is already
-     * `scrubSecrets`-redacted and size-capped at the source.
+     * `outcome: "malformed"` or `repaired: true`. Always-on (NOT debug-gated):
+     * it is already `scrubSecrets`-redacted and size-capped at the source.
      */
     rawOutput?: string;
 }
@@ -170,6 +188,7 @@ export interface GuardianDiagnosticEvent {
 export declare function buildDiagnosticEvent(outcome: GuardianOutcome | GuardianError, opts: {
     durationMs?: number;
     tier?: string;
+    repaired?: boolean;
     rationale?: string;
     commandHash?: string;
     rawOutput?: string;

package/dist/extension/permission/guardian.js

@@ -128,33 +128,158 @@ export function checkCircuitBreaker(state, limits) {
     }
     return { tripped: false };
 }
-// --- Verdict parsing (fail closed on malformed) ---
-export function parseVerdict(raw) {
+const VALID_RISK_LEVELS = ["low", "medium", "high", "critical"];
+/** Validate an already-parsed object into a verdict. The SINGLE validation
+ * gate: strict and repaired parses both end here, so the enum checks stay
+ * exactly as strict after repair as before. */
+function validateVerdictObject(parsed) {
+    if (!parsed)
+        return null;
+    const outcome = parsed.outcome;
+    if (outcome !== "allow" && outcome !== "ask" && outcome !== "deny")
+        return null;
+    const riskLevel = parsed.riskLevel;
+    return {
+        outcome,
+        riskLevel: typeof riskLevel === "string" && VALID_RISK_LEVELS.includes(riskLevel)
+            ? riskLevel
+            : "medium",
+        rationale: typeof parsed.rationale === "string" && parsed.rationale.trim().length > 0
+            ? parsed.rationale.trim()
+            : "No rationale provided.",
+    };
+}
+/** Extract the first {...} block (efficient-tier models may wrap JSON in
+ * markdown fences despite instructions to output raw JSON). */
+function extractJsonBlock(raw) {
+    const jsonMatch = raw.match(/\{[\s\S]*\}/);
+    return jsonMatch ? jsonMatch[0] : raw;
+}
+/**
+ * The lenient repair ladder — applied ONLY after a strict `JSON.parse` of the
+ * extracted block has already thrown. Each rung fixes one observed model
+ * failure shape and immediately retries the strict parse; the ladder runs in
+ * cheapest-first order and the content-synthesizing re-quote is always LAST.
+ * Every rung is end-anchored or last-occurrence-anchored and linear-time.
+ * Returns the repaired JSON string (parsable) or null if no rung fits.
+ *
+ * Observed shapes (captured live on deepseek-v4-flash, all previously "unclear
+ * verdict"): illegal backslash escapes (\d written literally), a doubled
+ * closing quote, and unescaped quotes inside the rationale. The trailing
+ * comma is the most common LLM JSON slip in the wild, not (yet) observed here.
+ *
+ * What the ladder deliberately does NOT fix (all fail closed):
+ * single quotes as structure (ambiguous with English apostrophes), glued
+ * multi-object output (never pick one verdict of two), raw newlines inside
+ * strings (indistinguishable from legal pretty-printed whitespace without
+ * parsing), a broken prefix before the rationale anchor, and truncations.
+ */
+function repairVerdictJson(s) {
+    // The ladder is SEQUENTIAL: each rung transforms the previous result and
+    // immediately retries the strict parse. Composing matters — a blob can
+    // carry more than one failure shape (an illegal backslash escape AND a
+    // trailing comma, say), and each rung alone would leave the other broken.
+    let cur = s;
+    // Rung 1 — illegal backslash escapes (\d, \w, \( … become \\d). Legal JSON
+    // escapes (" \\ \/ b f n r t and \uXXXX) are left untouched by the lookahead.
+    const escapedBackslashes = cur.replace(/\\(?!["\\\/bfnrtu])/g, "\\\\");
+    if (escapedBackslashes !== cur) {
+        try {
+            JSON.parse(escapedBackslashes);
+            return escapedBackslashes;
+        }
+        catch {
+            cur = escapedBackslashes;
+        }
+    }
+    // Rung 2 — doubled closing quote before }: anchored to END so a doubled
+    // quote mid-rationale is untouched (the re-quote rung handles that shape).
+    const collapsedQuote = cur.replace(/""(\s*\})$/, '"$1');
+    if (collapsedQuote !== cur) {
+        try {
+            JSON.parse(collapsedQuote);
+            return collapsedQuote;
+        }
+        catch {
+            cur = collapsedQuote;
+        }
+    }
+    // Rung 3 — trailing comma before }: anchored to END so a comma inside a
+    // rationale value ("a, b") can never be stripped.
+    const strippedComma = cur.replace(/,(\s*\})$/, '$1');
+    if (strippedComma !== cur) {
+        try {
+            JSON.parse(strippedComma);
+            return strippedComma;
+        }
+        catch {
+            cur = strippedComma;
+        }
+    }
+    // Rung 4 (last resort, the only rung that synthesizes content) — re-quote
+    // the trailing rationale value. Applies only when the shape is
+    // {…"rationale":"<rest-to-end>}: the prefix before the anchor must carry no
+    // closing brace (rules out prose and glued multi-object output — an earlier
+    // sibling object always leaves a } behind), and the extracted rationale text
+    // must carry no braces either (rules out a glued TAIL). Every " and \ in the
+    // tail is escaped in ONE pass so whatever the model wrote inside the
+    // rationale becomes literal text. Anchor ambiguity resolves to the LAST
+    // "rationale":" occurrence; single pass, no loops.
+    const anchor = cur.lastIndexOf('"rationale":"');
+    if (anchor !== -1) {
+        const prefix = cur.slice(0, anchor);
+        const tail = cur.slice(anchor + '"rationale":"'.length);
+        // The tail must be the trailing value closing the object: non-empty
+        // content, an optional-whitespace + } at the very end.
+        const tailMatch = tail.match(/^(.+?)(\s*\})$/);
+        if (tailMatch && !prefix.includes("}")) {
+            const rawRationale = tailMatch[1].replace(/"+$/, "");
+            if (rawRationale.length > 0 &&
+                !rawRationale.includes("{") &&
+                !rawRationale.includes("}")) {
+                const reQuoted = prefix +
+                    '"rationale":"' +
+                    rawRationale.replace(/["\\]/g, "\\$&") +
+                    '"}';
+                try {
+                    JSON.parse(reQuoted);
+                    return reQuoted;
+                }
+                catch {
+                    /* fail closed */
+                }
+            }
+        }
+    }
+    return null;
+}
+export function parseVerdictDetailed(raw) {
+    const jsonStr = extractJsonBlock(raw);
     try {
-        // Efficient-tier models may wrap JSON in markdown fences despite
-        // instructions to output raw JSON. Extract the first {...} block.
-        const jsonMatch = raw.match(/\{[\s\S]*\}/);
-        const jsonStr = jsonMatch ? jsonMatch[0] : raw;
         const parsed = JSON.parse(jsonStr);
-        const outcome = parsed?.outcome;
-        if (outcome !== "allow" && outcome !== "ask" && outcome !== "deny")
-            return null;
-        const riskLevel = parsed.riskLevel;
-        const validLevels = ["low", "medium", "high", "critical"];
-        return {
-            outcome,
-            riskLevel: typeof riskLevel === "string" && validLevels.includes(riskLevel)
-                ? riskLevel
-                : "medium",
-            rationale: typeof parsed.rationale === "string" && parsed.rationale.trim().length > 0
-                ? parsed.rationale.trim()
-                : "No rationale provided.",
-        };
+        const verdict = validateVerdictObject(parsed);
+        return verdict ? { verdict, repaired: false } : null;
     }
     catch {
-        return null;
+        // Strict parse failed — try the repair ladder on the same extracted block.
+        const repairedJson = repairVerdictJson(jsonStr);
+        if (repairedJson === null)
+            return null;
+        try {
+            const parsed = JSON.parse(repairedJson);
+            const verdict = validateVerdictObject(parsed);
+            return verdict ? { verdict, repaired: true } : null;
+        }
+        catch {
+            return null;
+        }
     }
 }
+/** Strict-shaped convenience wrapper: the verdict, or null. Callers that need
+ * the repaired signal use {@link parseVerdictDetailed}. */
+export function parseVerdict(raw) {
+    return parseVerdictDetailed(raw)?.verdict ?? null;
+}
 // --- /cost subtotal ---
 export function formatGuardianSubtotal(state, limits) {
     if (state.reviews === 0)
@@ -236,8 +361,8 @@ export async function reviewCommand(command, deps) {
             }
             return { verdict: null, error: "empty", cost };
         }
-        const verdict = parseVerdict(output);
-        if (!verdict) {
+        const parsed = parseVerdictDetailed(output);
+        if (!parsed) {
             // Scrubbed + capped so the local sink and Sentry can see the exact
             // failure shape without carrying a raw command or a secret it echoed.
             return {
@@ -247,7 +372,19 @@ export async function reviewCommand(command, deps) {
                 rawOutput: scrubSecrets(output).slice(0, GUARDIAN_RAW_OUTPUT_CAP),
             };
         }
-        return { verdict, cost };
+        if (parsed.repaired) {
+            // The repair ladder salvaged a broken-but-salvageable verdict. The
+            // verdict is real (validation is exactly as strict as the happy path);
+            // capture the pre-repair shape so telemetry can keep watching what the
+            // model is still emitting wrong.
+            return {
+                verdict: parsed.verdict,
+                cost,
+                repaired: true,
+                rawOutput: scrubSecrets(output).slice(0, GUARDIAN_RAW_OUTPUT_CAP),
+            };
+        }
+        return { verdict: parsed.verdict, cost };
     }
     catch (err) {
         // Distinguish the caller aborting (user hit ESC — must NOT be treated as
@@ -275,6 +412,7 @@ export function buildDiagnosticEvent(outcome, opts) {
         outcome,
         ...(opts.durationMs !== undefined ? { durationMs: opts.durationMs } : {}),
         ...(opts.tier !== undefined ? { tier: opts.tier } : {}),
+        ...(opts.repaired ? { repaired: true } : {}),
         ...(opts.rawOutput !== undefined ? { rawOutput: opts.rawOutput } : {}),
     };
     if (opts.debug) {

package/dist/extension/pipeline/personas.js

@@ -183,6 +183,11 @@ Rationale rules:
 Output ONLY a JSON object with this exact shape:
 {"outcome":"allow"|"ask"|"deny","riskLevel":"low"|"medium"|"high"|"critical","rationale":"see rationale rules"}
 
+Your output must parse as strict JSON on the first try:
+- Inside the rationale string, never write a bare double quote. Quote commands, flags, and paths with backticks instead: \`cat ~/.zshrc\`, not "cat ~/.zshrc".
+- A backslash inside a JSON string is legal only as the two-character JSON escapes \\, \\n, \\t, or \\uXXXX, and a quote inside the rationale as \\". Never write regex-style escapes like \\d or \\w literally — write "digit" or "word character" in words instead.
+- Output exactly one JSON object: no trailing comma, no doubled closing quote, no second object, nothing after the closing brace.
+
 Do not output anything else after the JSON. No markdown fences, only the JSON object.`;
 const TITLE_BODY = `You produce a session title from a user's prompt. Output ONLY a concise, sentence-case title of 3-7 words that captures the main topic or goal. Capitalize only the first word and proper nouns. Do not include a ticket code in the title text itself (the caller prepends it). No markdown, no prose, no quotes — just the title on one line.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yagni-app/code-staging",
-  "version": "1.0.5-staging.1238.1",
+  "version": "1.0.5-staging.1240.1",
   "description": "YAGNI Code: a terminal coding agent that already knows your company. One YAGNI login routes the model and grounds the agent in your team's context.",
   "license": "SEE LICENSE IN LICENSE.md",
   "author": "YAGNI, Inc. <jack@yagni.app> (https://yagni.app)",
@@ -42,5 +42,5 @@
     "turndown": "^7.2.4",
     "typebox": "^1.3.15"
   },
-  "yagniSourceSha": "ee5c5072300f275c0b31d554fc6c2cce5f8c416a"
+  "yagniSourceSha": "24a0ebcde7f7df67fd0fcd230caa85c0c897742b"
 }