@yagni-app/code-staging 1.0.7-staging.1268.1 → 1.0.7-staging.1272.1

package/README.md

@@ -203,7 +203,14 @@ prefix instead of `claude_code`:
 - **Log events:** `user_prompt`, `assistant_response`, `api_request`,
   `api_error`, `tool_result`, `tool_decision`, `permission_mode_changed`
   (as `event.name`, body `yagni_code.<name>`), with `session.id`,
-  `organization.id`, `terminal.type`, and a per-prompt `prompt.id`.
+  `organization.id`, `user.email`, `terminal.type`, and a per-prompt
+  `prompt.id`.
+
+Every signal carries `organization.id` (the workspace) and `user.email` (the
+signed-in developer's account email, learned from the backend at session
+start) so a collector can attribute sessions and spend per person.
+`OTEL_METRICS_INCLUDE_ACCOUNT_UUID=false` drops the email from all three
+signals. Prompt, response, and tool content never export.
 
 Nothing is exported unless you configure an endpoint. Enable it one of three
 ways (first match wins):

package/dist/extension/config.d.ts

@@ -127,6 +127,12 @@ export interface ContextBrief {
      * The opt-in mining beat fires ONLY on an explicit 0.
      */
     repoDecisionCount?: number;
+    /**
+     * The signed-in developer's account email (additive; absent on older
+     * backends). Feeds the OTel export's `user.email` attribute when the
+     * launcher did not already forward one.
+     */
+    userEmail?: string;
 }
 /**
  * Attribution headers for the model proxy (YAG-471). On the SERVER side these

package/dist/extension/hooks.d.ts

@@ -26,8 +26,8 @@ export interface HookEntry {
 export interface HookGroup {
     matcher?: string;
     hooks: HookEntry[];
-    /** Where this group was loaded from. Project-level groups are gated on workspace trust. */
-    _source?: "user" | "project";
+    /** Where this group was loaded from. Project AND local groups are gated on workspace trust. */
+    _source?: "user" | "project" | "local";
 }
 /** The hooks section of config.json. */
 export type HooksConfig = Record<string, HookGroup[]>;
@@ -55,7 +55,7 @@ export interface HookRunner {
     preToolUse(toolName: string, input: Record<string, unknown>, cwd: string, trusted?: boolean): Promise<PreToolUseHookResult>;
     permissionRequest(toolName: string, input: Record<string, unknown>, cwd: string, trusted?: boolean): Promise<PermissionRequestHookResult>;
 }
-/** Read and merge hooks config from user and project files. Pure I/O, fail-soft. */
+/** Read and merge hooks config from user, project, and local files. Pure I/O, fail-soft. */
 export declare function loadHooksConfig(userHome?: string, cwd?: string, env?: NodeJS.ProcessEnv): HooksConfig;
 /**
  * Check if a matcher matches a tool name. Matches Claude Code / Codex:

package/dist/extension/hooks.js

@@ -36,7 +36,7 @@ const SUPPORTED_EVENTS = [
 // ---------------------------------------------------------------------------
 // Config loading
 // ---------------------------------------------------------------------------
-/** Read and merge hooks config from user and project files. Pure I/O, fail-soft. */
+/** Read and merge hooks config from user, project, and local files. Pure I/O, fail-soft. */
 export function loadHooksConfig(userHome = homedir(), cwd = process.cwd(), env = process.env) {
     if (env.YAGNI_CODE_EVAL_MODE === "1")
         return {};
@@ -47,6 +47,13 @@ export function loadHooksConfig(userHome = homedir(), cwd = process.cwd(), env =
     // Project-level: .yagni-code/config.json — tagged for trust gating at execution time
     const projectPath = join(cwd, ".yagni-code", "config.json");
     mergeHooksFromFile(merged, projectPath, "project");
+    // Local-level: .yagni-code/config.local.json — the personal per-project
+    // tier. Trust-gated like project (NOT always-trusted): a hostile repo can
+    // COMMIT a local file — the gitignore convention only covers untracked
+    // files. Deliberately stricter than Claude Code, which does not
+    // trust-gate its localSettings hooks.
+    const localPath = join(cwd, ".yagni-code", "config.local.json");
+    mergeHooksFromFile(merged, localPath, "local");
     return merged;
 }
 function mergeHooksFromFile(merged, path, source) {
@@ -68,8 +75,20 @@ function mergeHooksFromFile(merged, path, source) {
             }
         }
     }
-    catch {
-        // Fail-soft: missing or malformed config is logged and skipped.
+    catch (err) {
+        // Fail-soft: missing or malformed config is skipped — and LOGGED: a
+        // corrupt local/project config silently dropping its hooks (including
+        // deny-enforcing ones) with zero signal is undiagnosable. Path + error
+        // class only, matching loadConfig.ts's warning behavior.
+        logEvent({
+            source: "hooks",
+            level: "warn",
+            event: "config_warning",
+            fields: {
+                path,
+                error: err instanceof Error ? err.constructor.name : typeof err,
+            },
+        });
     }
 }
 function isValidHookGroup(value) {
@@ -297,11 +316,17 @@ function logHookEvent(env, payload) {
         fields,
     });
 }
-/** Filter hook groups by workspace trust: project-level groups are skipped when untrusted. */
+/**
+ * Filter hook groups by workspace trust: project AND local groups are
+ * skipped when untrusted. Local is gated exactly like project (not like the
+ * always-trusted user tier) because a hostile repo can COMMIT a
+ * config.local.json — the global-gitignore convention only covers
+ * untracked files. Deliberately stricter than Claude Code's localSettings.
+ */
 function filterByTrust(groups, isTrusted) {
     if (isTrusted)
         return groups;
-    return groups.filter((g) => g._source !== "project");
+    return groups.filter((g) => g._source !== "project" && g._source !== "local");
 }
 /**
  * Create a HookRunner for injection into the permission gate. The `isTrusted`

package/dist/extension/index.d.ts

@@ -3,6 +3,7 @@ import { type SpendResponse } from "./costHud.js";
 import { runInitPass as defaultRunInitPass } from "./initPass.js";
 import { startMcp as defaultStartMcp } from "./mcp/startup.js";
 import { type GuardianGateEvent } from "./permission/gate.js";
+import { registerTelemetry as defaultRegisterTelemetry } from "./telemetry/register.js";
 import { type PluginCliRunner } from "./plugins/panel.js";
 import { type FlushOutcome, type SpoolClientOpts } from "./spool.js";
 import { type TokenProvider } from "./tokenProvider.js";
@@ -67,6 +68,11 @@ export interface RegisterYagniDeps {
      * fresh-workspace first-run and is skipped otherwise, without a network or disk.
      */
     runInitPass?: typeof defaultRunInitPass;
+    /**
+     * OTel export registration. Injectable so tests assert the boot handoff of
+     * the /context `userEmail` into the telemetry identity without an SDK.
+     */
+    registerTelemetry?: typeof defaultRegisterTelemetry;
     /** The workspace id the token is bound to (keys the one-time init marker). */
     getWorkspaceId?: () => string | undefined;
     /** Has the init pass already run once for this workspace? Injectable (no disk in tests). */

package/dist/extension/index.js

@@ -1,6 +1,4 @@
 import { createHash } from "node:crypto";
-import { existsSync, readFileSync, renameSync, writeFileSync } from "node:fs";
-import { join } from "node:path";
 import { Text } from "@earendil-works/pi-tui";
 import { DEFAULT_ADVISOR_LIMITS, formatAdvisorSubtotal, makeAdvisorState } from "./advisor.js";
 import { makeChildUsageState } from "./childUsage.js";
@@ -26,6 +24,7 @@ import { logEvent } from "./errorSink.js";
 import { registerFeedbackCommands } from "./feedbackCommand.js";
 import { droppedSessionRuns, sessionRunIds } from "./sessionRuns.js";
 import { codeStateHome } from "./stateHome.js";
+import { mutateLocalConfig } from "./settingsFiles.js";
 import { logTurnLifecycle } from "./turnLog.js";
 import { createYagniFooterFactory, cyclePermissionMode, formatCwd, GIT_MUTATING_PATTERN, isShiftTab } from "./footer.js";
 import { RerouteNotifier } from "./rerouteNotice.js";
@@ -38,7 +37,7 @@ import { registerGoCompareCommand } from "./pipeline/goCompareCommand.js";
 import { DEFAULT_PERMISSION_POLICY, createModeHolder, registerPermissionGate } from "./permission/gate.js";
 import { registerSandbox } from "./sandbox/session.js";
 import { sandboxAutoAllowDecision } from "./sandbox/bash.js";
-import { registerTelemetry } from "./telemetry/register.js";
+import { registerTelemetry as defaultRegisterTelemetry } from "./telemetry/register.js";
 import { loadHooksConfig, makeHookRunner, registerHooks } from "./hooks.js";
 import { loadPermissionRules } from "./permissionRules/loadConfig.js";
 import { registerPluginPanel } from "./plugins/panel.js";
@@ -422,7 +421,7 @@ export async function registerYagni(pi, deps = {}) {
     // OTel export (traces, metrics, log events; Claude Code parity). A no-op
     // unless the launcher's gate set YAGNI_OTEL_EXPORT=1 — see the CLI's
     // otel.ts for the sources and src/telemetry for the exporter.
-    const telemetry = registerTelemetry(pi, { env });
+    const telemetry = (deps.registerTelemetry ?? defaultRegisterTelemetry)(pi, { env });
     {
         let previousMode = modeHolder.get();
         modeHolder.onSet((m) => {
@@ -607,45 +606,41 @@ export async function registerYagni(pi, deps = {}) {
             if (!evalMode)
                 appendGrant(grant);
         },
-        // persist a user-level allow rule (Guardian ask dialog's third
-        // option). Atomic write, never overwrites other keys, fail-soft.
-        persistUserRule: (ruleString) => {
-            if (evalMode)
-                return;
-            try {
-                const userPath = join(rulesStateHome, "config.json");
-                let parsed = {};
-                if (existsSync(userPath)) {
-                    parsed = JSON.parse(readFileSync(userPath, "utf-8"));
-                    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
-                        return;
-                }
-                const perms = (parsed.permissions ?? {});
-                const allow = Array.isArray(perms.allow) ? perms.allow : [];
-                if (!allow.includes(ruleString))
-                    allow.push(ruleString);
-                perms.allow = allow;
-                parsed.permissions = perms;
-                const tmp = join(rulesStateHome, `.config.json.yagni-${process.pid}-${Date.now()}.tmp`);
-                writeFileSync(tmp, `${JSON.stringify(parsed, null, 2)}\n`, { mode: 0o600 });
-                renameSync(tmp, userPath);
+        // persist a project-local allow rule (Guardian ask dialog's third
+        // option — Claude Code's own default save destination for personal
+        // rules is localSettings; ours matches). Atomic write, never overwrites
+        // other keys. THROWS on failure — the gate's catch owns the fail-soft
+        // behavior (notify the user, record ask_approved not remembered); a
+        // catch HERE would swallow the throw and make that path unreachable,
+        // leaving the user believing a rule saved that will not survive restart.
+        // Local writes fire-and-forget the global gitignore helper so the file
+        // is never committed by accident.
+        //
+        // The cwd is the GATE's per-call session cwd (a session can switch
+        // directories; process.cwd() would silently land the rule in another
+        // project's local settings while the dialog claims this one). Not
+        // registered in eval mode: the gate hides the save option when the dep
+        // is absent, so a no-op implementation that would still emit
+        // ask_approved_remembered never exists.
+        ...(evalMode ? {} : {
+            persistUserRule: (ruleString, cwd) => {
+                mutateLocalConfig(cwd, (config) => {
+                    const perms = (config.permissions ?? {});
+                    const allow = Array.isArray(perms.allow) ? [...perms.allow] : [];
+                    if (!allow.includes(ruleString))
+                        allow.push(ruleString);
+                    perms.allow = allow;
+                    config.permissions = perms;
+                });
                 logEvent({
                     source: "permission-rules",
                     level: "info",
-                    event: "user_rule_saved",
+                    event: "rule_saved",
                     sessionId: env.YAGNI_SESSION_ID ?? undefined,
-                    fields: { rule: ruleString },
-                });
-            }
-            catch (err) {
-                logEvent({
-                    source: "permission-rules",
-                    level: "warn",
-                    event: "user_rule_save_failed",
-                    fields: { message: err instanceof Error ? err.message : "unknown" },
+                    fields: { rule: ruleString, destination: "local" },
                 });
-            }
-        },
+            },
+        }),
         // Opt-in storage stream (YAG-510). Tier decides what leaves the machine:
         // "off" → nothing (not even sent); "hash" → sha256 + family prefix +
         // metadata, no command content; "raw" → adds client-REDACTED command and
@@ -845,6 +840,29 @@ export async function registerYagni(pi, deps = {}) {
             contextBrief = undefined;
         }
     }
+    // The developer's account email for the OTel export (`user.email`), so a
+    // collector can attribute sessions per person. Set before session_start
+    // fires, so even the session.count metric carries it. No-op when export is
+    // off or the launcher already forwarded YAGNI_USER_EMAIL.
+    const bootUserEmail = typeof briefResult?.userEmail === "string" ? briefResult.userEmail : undefined;
+    telemetry.setUserEmail(bootUserEmail);
+    if (telemetry.enabled && !bootUserEmail && !telemetry.config.identity.userEmail) {
+        // Attribution would otherwise degrade silently: leave a trail in the local
+        // error sink so "why is user.email missing in the collector" is answerable.
+        // Info, not warn: one line per session start, and an account with no
+        // email hits it by design. The fields name each way the email can be
+        // absent — the boot fetch failed or lacked the field, and whether the
+        // launcher's YAGNI_USER_EMAIL was unset or forwarded blank.
+        logEvent({
+            source: "telemetry",
+            level: "info",
+            event: "user_email_missing",
+            fields: {
+                contextFetch: briefResult === null ? "failed_or_skipped" : "no_email_field",
+                launcherEmail: env.YAGNI_USER_EMAIL === undefined ? "unset" : "blank",
+            },
+        });
+    }
     // M1 ambient judgment recall: after a `read`, append the recorded judgment for
     // that path to the tool result (result modification is supported on pi's
     // `tool_result` event — verified against 0.80.2). No-op when the corpus is thin

package/dist/extension/permission/gate.d.ts

@@ -231,7 +231,11 @@ export interface RegisterPermissionDeps {
      * Wired by index.ts; offered as a third option on Guardian ask dialogs.
      * Fail-soft: the in-session approval applies even if the write fails.
      */
-    persistUserRule?: (ruleString: string) => void;
+    /** Persist an allow rule for the caller; the cwd is the SESSION cwd of
+     * the gate call (may differ from process.cwd() when the session switches
+     * directories) — the rule must land in the project the user is working
+     * in, the same cwd the gate uses for grants and approvals. */
+    persistUserRule?: (ruleString: string, cwd: string) => void;
     /**
      * Called (fire-and-forget) at every terminal prompt-band outcome with the
      * rich storage event (raw command — the wiring layer redacts/hashes).

package/dist/extension/permission/gate.js

@@ -642,7 +642,7 @@ export function registerPermissionGate(pi, deps = {}) {
                 }
                 catch { /* logging must never affect the gate */ }
                 if (ruleVerdict.verdict === "deny") {
-                    const origin = ruleVerdict.rule.source === "project" ? "the project's settings" : "your user settings";
+                    const origin = ruleVerdict.rule.source === "user" ? "your user settings" : ruleVerdict.rule.source === "local" ? "the project's local settings" : "the project's settings";
                     return {
                         block: true,
                         reason: `${event.toolName} was denied by a permission rule in ${origin} (${ruleVerdict.rule.raw}). Do not attempt the same outcome via a workaround or indirect execution — ask the user to change the rule if this action is genuinely needed.`,
@@ -665,7 +665,7 @@ export function registerPermissionGate(pi, deps = {}) {
                     const askKey = ruleAskKey(event.toolName, ruleVerdict.rule.raw, input);
                     if (ruleAskApprovals.has(askKey))
                         return {};
-                    const origin = ruleVerdict.rule.source === "project" ? "the project's settings" : "your user settings";
+                    const origin = ruleVerdict.rule.source === "user" ? "your user settings" : ruleVerdict.rule.source === "local" ? "the project's local settings" : "the project's settings";
                     const choice = await askUser(ctx, `Permission rule (ask) in ${origin}:\n${ruleVerdict.rule.raw}\nAllow ${event.toolName}?`, null);
                     if (choice === "yes") {
                         if (ruleAskApprovals.size > APPROVED_CACHE_MAX)
@@ -982,7 +982,7 @@ export function registerPermissionGate(pi, deps = {}) {
                             ? `Yes, and don't ask again for \`${describePrefix(grantCandidate.pattern)}\` in this repo`
                             : null;
                         const ruleLabel = grantCandidate && deps.persistUserRule
-                            ? `Yes, and always allow \`${grantCandidate.pattern.join(" ")}\` in my user settings`
+                            ? `Yes, and always allow \`${grantCandidate.pattern.join(" ")}\` in this project's local settings`
                             : null;
                         const resolution = await askUserWithOptions(ctx, buildAskTitle(command, verdict.rationale, verdict.riskLevel), rememberLabel, ruleLabel);
                         if (resolution === "yes") {
@@ -1000,29 +1000,35 @@ export function registerPermissionGate(pi, deps = {}) {
                         if (resolution === "rule" && ruleCandidate && deps.persistUserRule) {
                             let persisted = false;
                             try {
-                                deps.persistUserRule(ruleCandidate);
+                                deps.persistUserRule(ruleCandidate, cwd);
                                 persisted = true;
                                 // Also covers this session like a grant would:
                                 rememberApproved(cwd, command);
                             }
                             catch (err) {
-                                // Fail-soft: the in-memory approval still applies THIS
-                                // session. But the user just made an explicit durable choice
-                                // in the dialog — a silent failure would leave them believing
-                                // a rule exists that will not survive restart. Log the
-                                // failure (rule string only, it is user-configured text, plus
-                                // error class — never the thrown message) and tell the user.
+                                // Fail-soft: the in-memory approval covers ONLY this call —
+                                // rememberApproved sits after the throwing call, so a failed
+                                // persist does NOT remember the command for the session (a
+                                // narrower fallback than a grant, deliberately: the user's
+                                // durable choice did not land). But the user just made an
+                                // explicit durable choice in the dialog — a silent failure
+                                // would leave them believing a rule exists that will not
+                                // survive restart. Log the failure (rule string + the thrown
+                                // message — it is mutateConfigJson's own path/reason text,
+                                // never the raw parse error or file content) and tell the
+                                // user.
                                 logEvent({
                                     source: "permission-rules",
                                     level: "warn",
-                                    event: "user_rule_save_failed",
+                                    event: "rule_save_failed",
                                     fields: {
                                         rule: ruleCandidate,
-                                        error: err instanceof Error ? err.constructor.name : typeof err,
+                                        destination: "local",
+                                        error: err instanceof Error ? err.message : String(err),
                                     },
                                 });
                                 if (ctx?.hasUI) {
-                                    ctx.ui.notify(`Could not save the permission rule to your settings — it applies to this session only.`, "warning");
+                                    ctx.ui.notify(`Could not save the permission rule to your settings — it did not persist; you'll be asked again on the next identical command.`, "warning");
                                 }
                             }
                             emitGateEvent(slot, {

package/dist/extension/permissionRules/loadConfig.d.ts

@@ -1,23 +1,29 @@
 /**
  * Permission-rule settings loader.
  *
- * Reads `permissions: { allow, deny, ask }` from the two YAGNI Code settings
- * files, mirroring the hooks loader (hooks.ts) shape exactly:
- *   - user:      ~/.yagni-code/config.json — always active
- *   - project:   .yagni-code/config.json   — deny/ask always active;
- *                allow gated on workspace trust (Claude Code semantics:
- *                "deny and ask rules apply right away; allow rules from a
- *                project file wait for trust")
+ * Reads `permissions: { allow, deny, ask }` from the three YAGNI Code
+ * settings files, mirroring the hooks loader (hooks.ts) shape exactly:
+ *   - user:    ~/.yagni-code/config.json       — always active
+ *   - project: .yagni-code/config.json         — deny/ask always active;
+ *              allow gated on workspace trust (Claude Code semantics:
+ *              "deny and ask rules apply right away; allow rules from a
+ *              project file wait for trust")
+ *   - local:   .yagni-code/config.local.json   — the personal per-project
+ *              tier; trust-gated EXACTLY like project (a hostile repo can
+ *              commit a local file — the gitignore convention only covers
+ *              untracked files). Deliberately stricter than Claude Code,
+ *              which does not trust-gate localSettings.
  *
  * Lists UNION across sources (Claude Code: lists merge, never replace).
- * User-source rules are ordered before project-source rules so path-pattern
- * negation (`!exception`) behaves like gitignore lines across files.
+ * User-source rules are ordered before project-source rules, project before
+ * local, so path-pattern negation (`!exception`) behaves like gitignore
+ * lines across files — higher-precedence sources come later (later wins).
  *
  * Fail-soft: a malformed config file is skipped whole with a warning (same
  * posture as hooks.ts). Malformed individual rule strings parse as bare
  * tool names (parser degrades, never throws) and are flagged.
  */
-export type RuleSource = "user" | "project";
+export type RuleSource = "user" | "project" | "local";
 export type RuleBehavior = "allow" | "deny" | "ask";
 /** A parsed, sourced permission rule. */
 export interface PermissionRule {
@@ -40,7 +46,7 @@ export interface LoadedRules {
 }
 /** The tools a rule can actually be consulted for at the gate. */
 export declare const KNOWN_RULE_TOOLS: Set<string>;
-/** Load + union rules from both files. Pure I/O; no throw. */
+/** Load + union rules from all three files. Pure I/O; no throw. */
 export declare function loadPermissionRules(opts?: {
     cwd?: string;
     env?: NodeJS.ProcessEnv;
@@ -48,6 +54,11 @@ export declare function loadPermissionRules(opts?: {
     /** Override the user state home (tests). */
     stateHomeOverride?: string | null;
 }): LoadedRules;
-/** Filter rules by behavior + trust (project allow needs trust; deny/ask always). */
+/**
+ * Filter rules by behavior + trust. Untrusted repos keep deny/ask from every
+ * source but lose allow rules from BOTH project and local files — a
+ * committed config.local.json must not smuggle allow rules past the trust
+ * gate (see the module header; stricter than Claude Code's localSettings).
+ */
 export declare function effectiveRules(rules: readonly PermissionRule[], isProjectTrusted: boolean): PermissionRule[];
 //# sourceMappingURL=loadConfig.d.ts.map

package/dist/extension/permissionRules/loadConfig.js

@@ -1,17 +1,23 @@
 /**
  * Permission-rule settings loader.
  *
- * Reads `permissions: { allow, deny, ask }` from the two YAGNI Code settings
- * files, mirroring the hooks loader (hooks.ts) shape exactly:
- *   - user:      ~/.yagni-code/config.json — always active
- *   - project:   .yagni-code/config.json   — deny/ask always active;
- *                allow gated on workspace trust (Claude Code semantics:
- *                "deny and ask rules apply right away; allow rules from a
- *                project file wait for trust")
+ * Reads `permissions: { allow, deny, ask }` from the three YAGNI Code
+ * settings files, mirroring the hooks loader (hooks.ts) shape exactly:
+ *   - user:    ~/.yagni-code/config.json       — always active
+ *   - project: .yagni-code/config.json         — deny/ask always active;
+ *              allow gated on workspace trust (Claude Code semantics:
+ *              "deny and ask rules apply right away; allow rules from a
+ *              project file wait for trust")
+ *   - local:   .yagni-code/config.local.json   — the personal per-project
+ *              tier; trust-gated EXACTLY like project (a hostile repo can
+ *              commit a local file — the gitignore convention only covers
+ *              untracked files). Deliberately stricter than Claude Code,
+ *              which does not trust-gate localSettings.
  *
  * Lists UNION across sources (Claude Code: lists merge, never replace).
- * User-source rules are ordered before project-source rules so path-pattern
- * negation (`!exception`) behaves like gitignore lines across files.
+ * User-source rules are ordered before project-source rules, project before
+ * local, so path-pattern negation (`!exception`) behaves like gitignore
+ * lines across files — higher-precedence sources come later (later wins).
  *
  * Fail-soft: a malformed config file is skipped whole with a warning (same
  * posture as hooks.ts). Malformed individual rule strings parse as bare
@@ -64,27 +70,36 @@ function readRulesFromFile(path, source, behavior, out, warnings) {
         warnings.push(`${source} settings: malformed JSON — permissions skipped (${path})`);
     }
 }
-/** Load + union rules from both files. Pure I/O; no throw. */
+/** Load + union rules from all three files. Pure I/O; no throw. */
 export function loadPermissionRules(opts = {}) {
     const warnings = [];
     const rules = [];
     const stateHome = opts.stateHomeOverride ?? codeStateHome(null, opts.env, opts.userHome);
+    const cwd = opts.cwd ?? process.cwd();
     const userPath = join(stateHome, "config.json");
-    const projectPath = join(opts.cwd ?? process.cwd(), ".yagni-code", "config.json");
-    // User first, project second — ordering matters for path-rule negation.
+    const projectPath = join(cwd, ".yagni-code", "config.json");
+    const localPath = join(cwd, ".yagni-code", "config.local.json");
+    // User, then project, then local — ordering matters for path-rule
+    // negation (later sources win, matching scalar precedence).
     for (const behavior of ["deny", "ask", "allow"]) {
         readRulesFromFile(userPath, "user", behavior, rules, warnings);
         readRulesFromFile(projectPath, "project", behavior, rules, warnings);
+        readRulesFromFile(localPath, "local", behavior, rules, warnings);
     }
     const neverConsultedTools = [
         ...new Set(rules.map((r) => r.toolName).filter((t) => !KNOWN_RULE_TOOLS.has(t) && !t.startsWith("mcp__"))),
     ];
     return { rules, diagnostics: { warnings, neverConsultedTools } };
 }
-/** Filter rules by behavior + trust (project allow needs trust; deny/ask always). */
+/**
+ * Filter rules by behavior + trust. Untrusted repos keep deny/ask from every
+ * source but lose allow rules from BOTH project and local files — a
+ * committed config.local.json must not smuggle allow rules past the trust
+ * gate (see the module header; stricter than Claude Code's localSettings).
+ */
 export function effectiveRules(rules, isProjectTrusted) {
     if (isProjectTrusted)
         return [...rules];
-    return rules.filter((r) => !(r.source === "project" && r.behavior === "allow"));
+    return rules.filter((r) => !(r.source !== "user" && r.behavior === "allow"));
 }
 //# sourceMappingURL=loadConfig.js.map

package/dist/extension/permissionRules/pathRules.d.ts

@@ -8,15 +8,17 @@
  *   //path   absolute from filesystem root
  *   ~/path   relative to the user's home directory
  *   /path    relative to the SETTINGS FILE's directory (user config →
- *            ~/.yagni-code/, project config → the project root)
+ *            ~/.yagni-code/, project AND local configs → the project root —
+ *            local lives in the same .yagni-code dir as project)
  *   path     relative to the session cwd; a bare filename matches at ANY
  *            depth (`.env` equals `**` / `.env` in glob terms)
  *
  * Compile semantics: all patterns for one (tool-class, behavior) compile
  * into ONE ordered `ignore` instance — user-source patterns first, then
- * project — so gitignore's later-line-wins and `!exception` negation work
- * across rules from both files (Claude Code's matchingRuleForInput builds
- * one ignore().add(patterns) per root the same way).
+ * project, then local — so gitignore's later-line-wins and `!exception`
+ * negation work across rules from all three files (Claude Code's
+ * matchingRuleForInput builds one ignore().add(patterns) per root the same
+ * way; local patterns are the last/highest-precedence "lines").
  *
  * Behavior asymmetry (Claude Code parity): allow rules with a rootless
  * single-segment pattern anchor at the settings dir (narrow); deny/ask
@@ -40,9 +42,9 @@ export interface ResolvedPathPattern {
 }
 /**
  * Split an anchored pattern into (root, relativePattern). Mirrors Claude
- * Code's patternWithRoot. Project-source `/` anchors at the project root
- * (passed in); user-source `/` anchors at the YAGNI Code state home
- * (~/.yagni-code).
+ * Code's patternWithRoot. Project- and local-source `/` anchors at the
+ * project root (passed in) — local shares project's .yagni-code dir;
+ * user-source `/` anchors at the YAGNI Code state home (~/.yagni-code).
  */
 export declare function resolvePatternRoot(pattern: string, source: RuleSource, opts: {
     userStateHome: string;

package/dist/extension/permissionRules/pathRules.js

@@ -8,15 +8,17 @@
  *   //path   absolute from filesystem root
  *   ~/path   relative to the user's home directory
  *   /path    relative to the SETTINGS FILE's directory (user config →
- *            ~/.yagni-code/, project config → the project root)
+ *            ~/.yagni-code/, project AND local configs → the project root —
+ *            local lives in the same .yagni-code dir as project)
  *   path     relative to the session cwd; a bare filename matches at ANY
  *            depth (`.env` equals `**` / `.env` in glob terms)
  *
  * Compile semantics: all patterns for one (tool-class, behavior) compile
  * into ONE ordered `ignore` instance — user-source patterns first, then
- * project — so gitignore's later-line-wins and `!exception` negation work
- * across rules from both files (Claude Code's matchingRuleForInput builds
- * one ignore().add(patterns) per root the same way).
+ * project, then local — so gitignore's later-line-wins and `!exception`
+ * negation work across rules from all three files (Claude Code's
+ * matchingRuleForInput builds one ignore().add(patterns) per root the same
+ * way; local patterns are the last/highest-precedence "lines").
  *
  * Behavior asymmetry (Claude Code parity): allow rules with a rootless
  * single-segment pattern anchor at the settings dir (narrow); deny/ask
@@ -42,9 +44,9 @@ export function pathClassForTool(toolName) {
 }
 /**
  * Split an anchored pattern into (root, relativePattern). Mirrors Claude
- * Code's patternWithRoot. Project-source `/` anchors at the project root
- * (passed in); user-source `/` anchors at the YAGNI Code state home
- * (~/.yagni-code).
+ * Code's patternWithRoot. Project- and local-source `/` anchors at the
+ * project root (passed in) — local shares project's .yagni-code dir;
+ * user-source `/` anchors at the YAGNI Code state home (~/.yagni-code).
  */
 export function resolvePatternRoot(pattern, source, opts) {
     if (pattern.startsWith("//")) {
@@ -55,7 +57,7 @@ export function resolvePatternRoot(pattern, source, opts) {
         return { relativePattern: rel, root: opts.homeDir ?? homedir(), source };
     }
     if (pattern.startsWith("/") && !pattern.startsWith("//")) {
-        const base = source === "project" ? opts.projectRoot : opts.userStateHome;
+        const base = source === "user" ? opts.userStateHome : opts.projectRoot;
         return { relativePattern: pattern, root: base ?? opts.userStateHome, source };
     }
     // Rootless: `./x` normalized to `x`; bare names keep any-depth semantics.

package/dist/extension/sandbox/config.d.ts

@@ -1,16 +1,17 @@
 /**
- * Sandbox settings schema + layered config load (user + project), shaped after
- * Claude Code's SandboxSettingsSchema subset so a Claude `sandbox` block
- * copied verbatim parses and resolves identically.
+ * Sandbox settings schema + layered config load (user + project + local),
+ * shaped after Claude Code's SandboxSettingsSchema subset so a Claude
+ * `sandbox` block copied verbatim parses and resolves identically.
  *
- * Files: the `sandbox` key in ~/.yagni-code/config.json (user) and
- * .yagni-code/config.json (project) — the same pair permissionRules reads,
- * so one settings file drives both the permission layer and the sandbox.
+ * Files: the `sandbox` key in ~/.yagni-code/config.json (user),
+ * .yagni-code/config.json (project), and .yagni-code/config.local.json
+ * (local — the personal per-project tier; the /sandbox panel and toggle
+ * persist HERE).
  *
- * Merge semantics (Claude parity): scalars — project wins over user over
- * defaults; arrays — union + dedupe across sources (lists merge, never
- * replace). Fail-soft: a malformed file is skipped whole with a warning
- * (same posture as permissionRules/loadConfig.ts).
+ * Merge semantics (Claude parity): scalars — local wins over project over
+ * user over defaults; arrays — union + dedupe across sources (lists merge,
+ * never replace). Fail-soft: a malformed file is skipped whole with a
+ * warning (same posture as permissionRules/loadConfig.ts).
  *
  * Read/write filesystem semantics (srt, verified in the M0 spike): reads are
  * allowed by default with denyRead regions + allowRead re-allow; writes are
@@ -64,10 +65,10 @@ export interface LoadedSandboxConfig {
  */
 export declare function readSandboxSettingsFromFile(configPath: string, warnings: string[], unknownKeys: string[]): SandboxSettings | undefined;
 /**
- * Load + merge sandbox settings from both config files. Scalars: project
- * beats user; arrays: union. Defaults for scalars land here too (Claude
- * parity): autoAllowBashIfSandboxed true, allowUnsandboxedCommands true,
- * everything else unset/false.
+ * Load + merge sandbox settings from all three config files. Scalars: local
+ * beats project beats user; arrays: union. Defaults for scalars land here
+ * too (Claude parity): autoAllowBashIfSandboxed true, allowUnsandboxedCommands
+ * true, everything else unset/false.
  */
 export declare function loadSandboxSettings(opts?: {
     cwd?: string;