@yagni-app/code-staging 1.0.6-staging.1242.1 → 1.0.6-staging.1245.1

package/README.md

@@ -179,11 +179,16 @@ children and subagents — emits a per-prompt span tree: interaction → LLM
 request → tool calls, following the OTel GenAI semantic conventions. Nothing is
 exported unless you configure an endpoint.
 
-Enable it one of three ways (first match wins):
-
-- `OTEL_EXPORTER_OTLP_ENDPOINT=http://<collector>:4317` in the environment
-  (a personal override — handy for pointing one session at a scratch
-  collector), or
+Enable it one of four ways (first match wins):
+
+- `OTEL_EXPORTER_OTLP_ENDPOINT=…` in the environment (a personal override —
+  handy for pointing one session at a scratch collector), or
+- `OTEL_EXPORTER_OTLP_TRACES_ENDPOINT=…` in the environment — the per-signal
+  form Claude Code setups use (e.g.
+  `OTEL_EXPORTER_OTLP_TRACES_ENDPOINT=https://otlp.datadoghq.com/v1/traces`
+  with `OTEL_EXPORTER_OTLP_TRACES_PROTOCOL=http/protobuf`); the launcher
+  bridges it to the generic var pi-otel reads, so a Claude Code OTel env
+  lights up YAGNI Code traces with no extra config, or
 - **workspace settings** (the zero-setup path): a workspace admin sets the
   endpoint, protocol, and any collector headers (e.g. a Datadog API key) once
   in the web app under Settings → YAGNI Code → Trace export. Every session in
@@ -197,7 +202,26 @@ Enable it one of three ways (first match wins):
 Standard OTel env vars are honored (`OTEL_EXPORTER_OTLP_PROTOCOL`,
 `OTEL_EXPORTER_OTLP_HEADERS`, `OTEL_SERVICE_NAME` — defaults to `yagni-code`),
 and `PI_OTEL_DISABLED=1` is the kill switch. `yagni doctor` shows the current
-export state.
+export state and probes the endpoint live (unreachable → a warning with a
+hint, never an exit-code flip).
+
+Two recipes for common collectors:
+
+- **Datadog, direct SaaS (no agent):** endpoint
+  `https://otlp.datadoghq.com/v1/traces` (US1; other sites have their own
+  host — `otlp.us3.datadoghq.com`, `otlp.us5.datadoghq.com`,
+  `otlp.datadoghq.eu`, `otlp.ap1.datadoghq.com`), protocol `http/protobuf`
+  (Datadog's direct trace intake does not accept gRPC), header
+  `dd-api-key=<your Datadog API key>`. Use the full path, not `/v1/` — the
+  endpoint is passed through verbatim, no path is appended for you.
+- **Datadog Agent:** endpoint `http://<agent-host>:4317`, protocol `grpc`, no
+  key (the agent forwards with its own). OTLP ingest ships in the agent but
+  is off by default — enable it with
+  `otlp_config.receiver.protocols.grpc.endpoint: 0.0.0.0:4317` in
+  `datadog.yaml`.
+- **Grafana Cloud:** endpoint `https://otlp-gateway-prod-…-0.grafana.net:443/otlp`,
+  protocol `http/protobuf`, header `authorization=<the raw MTgx… value>` (the
+  `Basic ` scheme is added for you).
 
 Two things are enforced and not configurable:
 

package/dist/doctor.d.ts

@@ -13,7 +13,7 @@
  * Advisory checks (loose perms, missing `gh`) never flip the exit code.
  */
 import { type TokenExpiryStatus } from "./launch.js";
-import { type OtelLaunchConfig } from "./otel.js";
+import { probeOtelEndpoint, type OtelLaunchConfig } from "./otel.js";
 import { type Profile } from "./profiles.js";
 export type CheckStatus = "ok" | "warn" | "fail";
 export interface CheckResult {
@@ -63,10 +63,15 @@ export declare function checkCliUpdate(probe: {
 export declare function checkGh(onPath: boolean): CheckResult;
 /**
  * Advisory OTel-export line: says whether sessions will stream traces to an
- * OTLP collector, and from which config source. Never flips the exit code —
+ * OTLP collector, from which config source, and — when a collector is
+ * configured — whether the endpoint answers TCP right now (scheme-default
+ * ports included: https with no port probes 443). Never flips the exit code —
  * most machines have no collector, and that is the healthy default.
  */
-export declare function checkOtelExport(config: OtelLaunchConfig | undefined): CheckResult;
+export declare function checkOtelExport(config: OtelLaunchConfig | undefined, deps?: {
+    probeEndpoint?: typeof probeOtelEndpoint;
+    probeTimeoutMs?: number;
+}): Promise<CheckResult>;
 /** Config-only MCP snapshot (no connections — health checks live in `mcp list`/`get`). */
 export interface McpProbe {
     /** YAGNI_CODE_MCP_DISABLED kill-switch is active. */

package/dist/doctor.js

@@ -17,7 +17,7 @@ import { delimiter, join } from "node:path";
 import { credentialsDir } from "./credentials.js";
 import { currentCliVersion, fetchLatestVersion, isNewerVersion } from "./upgrade.js";
 import { classifyTokenExpiry } from "./launch.js";
-import { resolveOtelLaunchWithWorkspace } from "./otel.js";
+import { probeOtelEndpoint, resolveOtelLaunchWithWorkspace, } from "./otel.js";
 import { resolveExtensionPath, resolvePiCliPath, resolvePiPackageDir } from "./paths.js";
 import { readActiveProfile } from "./profiles.js";
 import { resolveMcpConfigPath } from "./mcpCommand.js";
@@ -202,10 +202,12 @@ export function checkGh(onPath) {
 }
 /**
  * Advisory OTel-export line: says whether sessions will stream traces to an
- * OTLP collector, and from which config source. Never flips the exit code —
+ * OTLP collector, from which config source, and — when a collector is
+ * configured — whether the endpoint answers TCP right now (scheme-default
+ * ports included: https with no port probes 443). Never flips the exit code —
  * most machines have no collector, and that is the healthy default.
  */
-export function checkOtelExport(config) {
+export async function checkOtelExport(config, deps = {}) {
     if (!config) {
         return {
             name: "otel export (optional)",
@@ -215,16 +217,41 @@ export function checkOtelExport(config) {
         };
     }
     const source = config.source === "env"
-        ? "OTEL_EXPORTER_OTLP_ENDPOINT"
+        ? (config.envVar ?? "OTEL_EXPORTER_OTLP_ENDPOINT")
         : config.source === "workspace"
             ? "workspace settings"
             : ".pi/settings.json";
-    return {
-        name: "otel export (optional)",
-        status: "ok",
-        detail: `on → ${config.endpoint} (${source}, metadata-only)`,
-        required: false,
-    };
+    const base = `on → ${config.endpoint} (${source}, metadata-only)`;
+    const doProbe = deps.probeEndpoint ?? probeOtelEndpoint;
+    try {
+        const reachable = await doProbe(config.endpoint, deps.probeTimeoutMs ?? 1_000);
+        return reachable
+            ? {
+                name: "otel export (optional)",
+                status: "ok",
+                detail: `${base}, TCP reachable`,
+                required: false,
+            }
+            : {
+                name: "otel export (optional)",
+                status: "warn",
+                detail: `${base}, endpoint not reachable`,
+                hint: "the collector is down, unreachable from this machine, or the URL is wrong — traces will not export until it answers",
+                required: false,
+            };
+    }
+    catch {
+        // The probe itself errored (not "endpoint down" — the check could not
+        // run). Distinct from a verified-healthy line so nobody reads an
+        // unverified config as checked-and-good.
+        return {
+            name: "otel export (optional)",
+            status: "warn",
+            detail: `${base}, reachability probe failed`,
+            hint: "the reachability check could not run (network error) — export is configured but unverified; traces may still export normally",
+            required: false,
+        };
+    }
 }
 /**
  * Advisory (never required) MCP line: reports config health without connecting
@@ -489,7 +516,7 @@ export async function gatherChecks(deps = {}) {
     checks.push(checkStateDir(probeStateDir()));
     checks.push(checkGh(ghOnPath()));
     checks.push(checkMcpConfig(await probeMcp()));
-    checks.push(checkOtelExport(await resolveOtelLaunchWithWorkspace({
+    checks.push(await checkOtelExport(await resolveOtelLaunchWithWorkspace({
         env: process.env,
         cwd: process.cwd(),
         creds: profile.token ? { baseUrl: profile.baseUrl, token: profile.token } : null,

package/dist/extension/index.js

@@ -1,4 +1,6 @@
 import { createHash } from "node:crypto";
+import { existsSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
 import { Text } from "@earendil-works/pi-tui";
 import { DEFAULT_ADVISOR_LIMITS, formatAdvisorSubtotal, makeAdvisorState } from "./advisor.js";
 import { makeChildUsageState } from "./childUsage.js";
@@ -35,6 +37,7 @@ import { registerGoCommand } from "./pipeline/goCommand.js";
 import { registerGoCompareCommand } from "./pipeline/goCompareCommand.js";
 import { DEFAULT_PERMISSION_POLICY, createModeHolder, registerPermissionGate } from "./permission/gate.js";
 import { loadHooksConfig, makeHookRunner, registerHooks } from "./hooks.js";
+import { loadPermissionRules } from "./permissionRules/loadConfig.js";
 import { registerSubagents } from "./subagents.js";
 import { createUltraHolder, registerUltraCommand } from "./ultra.js";
 import { registerTodos } from "./todos.js";
@@ -334,6 +337,8 @@ export async function registerYagni(pi, deps = {}) {
         // The static queue only carries non-connectivity notices (e.g. the
         // `.mcp.json` approval prompt), which stay one-shot.
         let connectivityNoticesFlushed = false;
+        // permission-rule notices are one-shot like connectivity notices.
+        let rulesNoticesFlushed = false;
         pi.on("after_provider_response", (_event, ctx) => {
             try {
                 if (!ctx.hasUI)
@@ -347,6 +352,21 @@ export async function registerYagni(pi, deps = {}) {
                 while (mcpApprovalNotices.length > 0) {
                     ctx.ui.notify(mcpApprovalNotices.shift(), "info");
                 }
+                // one-shot permission-rule config warnings (bad files,
+                // never-consulted tools). One consolidated line, never a wall.
+                if (!rulesNoticesFlushed) {
+                    rulesNoticesFlushed = true;
+                    const parts = [];
+                    if (loadedRules.diagnostics.warnings.length > 0) {
+                        parts.push(`${loadedRules.diagnostics.warnings.length} permission-rule config warning(s)`);
+                    }
+                    if (loadedRules.diagnostics.neverConsultedTools.length > 0) {
+                        parts.push(`rules for unknown tools: ${loadedRules.diagnostics.neverConsultedTools.join(", ")} (ignored)`);
+                    }
+                    if (parts.length > 0) {
+                        ctx.ui.notify(`Permission rules: ${parts.join(" · ")}`, "warning");
+                    }
+                }
             }
             catch {
                 // A notice must never break a turn.
@@ -408,6 +428,25 @@ export async function registerYagni(pi, deps = {}) {
     // the startup load is the trust boundary; live reload was reviewed and
     // rejected as a same-session self-authorization path, PR #1698).
     const sessionGrants = evalMode ? [] : loadGrants();
+    // settings-based permission rules, loaded once at startup (same
+    // trust-boundary posture as grants: no mid-session reload). User config
+    // (~/.yagni-code/config.json) + project config (.yagni-code/config.json);
+    // project allow rules are trust-gated at evaluation time, deny/ask always.
+    const loadedRules = evalMode
+        ? { rules: [], diagnostics: { warnings: [], neverConsultedTools: [] } }
+        : loadPermissionRules({ cwd: process.cwd() });
+    for (const w of loadedRules.diagnostics.warnings) {
+        logEvent({ source: "permission-rules", level: "warn", event: "config_warning", fields: { warning: w } });
+    }
+    if (loadedRules.diagnostics.neverConsultedTools.length > 0) {
+        logEvent({
+            source: "permission-rules",
+            level: "warn",
+            event: "never_consulted_tools",
+            fields: { tools: loadedRules.diagnostics.neverConsultedTools.join(", ") },
+        });
+    }
+    const rulesStateHome = codeStateHome(null, env);
     const GUARDIAN_EVENT_TIMEOUT_MS = 5_000;
     // YAG-506: load user-configurable lifecycle hooks config and create the
     // hook runner for the permission gate. Skipped in eval mode.
@@ -420,6 +459,27 @@ export async function registerYagni(pi, deps = {}) {
         guardianState,
         guardianLimits,
         guardianTier,
+        ...(loadedRules.rules.length > 0
+            ? {
+                permissionRules: loadedRules.rules,
+                rulesUserStateHome: rulesStateHome,
+                rulesProjectRoot: process.cwd(),
+                onRuleVerdict: (ev) => {
+                    logEvent({
+                        source: "permission-rules",
+                        level: "debug",
+                        event: `rule_${ev.verdict}`,
+                        sessionId: env.YAGNI_SESSION_ID ?? undefined,
+                        fields: {
+                            tool: ev.toolName,
+                            via: ev.matchedVia,
+                            source: ev.rule.source,
+                            rule: ev.rule.raw,
+                        },
+                    });
+                },
+            }
+            : {}),
         guardianDisabled,
         childUsage,
         guardianReview: (command, deps) => reviewCommand(command, { ...deps, modelTier: guardianTier }),
@@ -471,6 +531,45 @@ export async function registerYagni(pi, deps = {}) {
             if (!evalMode)
                 appendGrant(grant);
         },
+        // persist a user-level allow rule (Guardian ask dialog's third
+        // option). Atomic write, never overwrites other keys, fail-soft.
+        persistUserRule: (ruleString) => {
+            if (evalMode)
+                return;
+            try {
+                const userPath = join(rulesStateHome, "config.json");
+                let parsed = {};
+                if (existsSync(userPath)) {
+                    parsed = JSON.parse(readFileSync(userPath, "utf-8"));
+                    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+                        return;
+                }
+                const perms = (parsed.permissions ?? {});
+                const allow = Array.isArray(perms.allow) ? perms.allow : [];
+                if (!allow.includes(ruleString))
+                    allow.push(ruleString);
+                perms.allow = allow;
+                parsed.permissions = perms;
+                const tmp = join(rulesStateHome, `.config.json.yagni-${process.pid}-${Date.now()}.tmp`);
+                writeFileSync(tmp, `${JSON.stringify(parsed, null, 2)}\n`, { mode: 0o600 });
+                renameSync(tmp, userPath);
+                logEvent({
+                    source: "permission-rules",
+                    level: "info",
+                    event: "user_rule_saved",
+                    sessionId: env.YAGNI_SESSION_ID ?? undefined,
+                    fields: { rule: ruleString },
+                });
+            }
+            catch (err) {
+                logEvent({
+                    source: "permission-rules",
+                    level: "warn",
+                    event: "user_rule_save_failed",
+                    fields: { message: err instanceof Error ? err.message : "unknown" },
+                });
+            }
+        },
         // Opt-in storage stream (YAG-510). Tier decides what leaves the machine:
         // "off" → nothing (not even sent); "hash" → sha256 + family prefix +
         // metadata, no command content; "raw" → adds client-REDACTED command and

package/dist/extension/permission/gate.d.ts

@@ -94,6 +94,33 @@ export interface GateDecision {
      */
     classifyJustification?: string;
 }
+/**
+ * What the hard floors say about an ALLOW-rule verdict — the three invariants
+ * that outrank any user/project permission rule. Extracted from the inline
+ * allow path so the gate reads linearly and the floors are directly testable.
+ * PURE — no I/O, no session state:
+ *
+ *   "allow"   no floor applies — the rule's allow short-circuits everything
+ *   "block"   the exec-policy forbidden band holds despite the allow rule
+ *   "confirm" alwaysConfirmTools keeps its fresh-consent contract
+ *   "hold"    plan mode's no-mutation contract outranks the allow rule —
+ *             fall through to the normal plan-mode gate
+ *
+ * Order is deliberate: plan-mode first (its outcome routes to the EXISTING
+ * plan-mode machinery, not a bespoke block); then the terminal forbidden-band
+ * block; then the confirm deferral.
+ */
+export type AllowRuleFloorOutcome = {
+    kind: "allow";
+} | {
+    kind: "block";
+    reason: string;
+} | {
+    kind: "confirm";
+} | {
+    kind: "hold";
+};
+export declare function allowRuleFloorVerdict(toolName: string, params: Record<string, unknown>, mode: PermissionMode, policy: PermissionPolicy): AllowRuleFloorOutcome;
 /**
  * Pure permission decision for one tool call under a mode + policy. Auto allows
  * ordinary tools; plan blocks the write/exec set; review marks writes for confirmation
@@ -187,12 +214,38 @@ export interface RegisterPermissionDeps {
     /** Persist a new grant (fire-and-forget; the in-memory list is updated
      * either way). index.ts wires approvedPrefixes.appendGrant. */
     persistGrant?: (grant: ApprovedPrefixGrant) => void;
+    /**
+     * persist a user-level permission rule string (e.g.
+     * `Bash(git push:*)`) into ~/.yagni-code/config.json permissions.allow.
+     * Wired by index.ts; offered as a third option on Guardian ask dialogs.
+     * Fail-soft: the in-session approval applies even if the write fails.
+     */
+    persistUserRule?: (ruleString: string) => void;
     /**
      * Called (fire-and-forget) at every terminal prompt-band outcome with the
      * rich storage event (raw command — the wiring layer redacts/hashes).
      * Fail-soft; never blocks.
      */
     onGuardianEvent?: (event: GuardianGateEvent) => void;
+    /**
+     * settings-based permission rules (user + project config.json).
+     * When present, evaluated at the TOP of the tool_call handler, before
+     * hooks: deny → ask → allow, first match wins. Deny/ask are final; allow
+     * short-circuits the Guardian but can never lift the exec-policy forbidden
+     * band or the alwaysConfirmTools contract (both re-checked below).
+     */
+    permissionRules?: readonly import("../permissionRules/loadConfig.js").PermissionRule[];
+    /** ~/.yagni-code — the user `/`-anchor base for path rules. */
+    rulesUserStateHome?: string;
+    /** Project root for project-source `/`-anchored path rules; null outside a repo. */
+    rulesProjectRoot?: string | null;
+    /** Overrides ~ expansion for path rules (tests). */
+    rulesHomeDir?: string;
+    /** Called (fire-and-soft) after every rule verdict for debug logging. */
+    onRuleVerdict?: (event: import("../permissionRules/engine.js").RuleEvaluation & {
+        toolName: string;
+        cwd: string;
+    }) => void;
     /**
      * User-configurable lifecycle hooks (YAG-506). When present, PreToolUse
      * hooks run before decideGate and can short-circuit (allow/deny/ask),