@yagni-app/code-staging 1.0.7-staging.1268.1 → 1.0.7-staging.1272.1

package/dist/extension/sandbox/config.js

@@ -1,16 +1,17 @@
 /**
- * Sandbox settings schema + layered config load (user + project), shaped after
- * Claude Code's SandboxSettingsSchema subset so a Claude `sandbox` block
- * copied verbatim parses and resolves identically.
+ * Sandbox settings schema + layered config load (user + project + local),
+ * shaped after Claude Code's SandboxSettingsSchema subset so a Claude
+ * `sandbox` block copied verbatim parses and resolves identically.
  *
- * Files: the `sandbox` key in ~/.yagni-code/config.json (user) and
- * .yagni-code/config.json (project) — the same pair permissionRules reads,
- * so one settings file drives both the permission layer and the sandbox.
+ * Files: the `sandbox` key in ~/.yagni-code/config.json (user),
+ * .yagni-code/config.json (project), and .yagni-code/config.local.json
+ * (local — the personal per-project tier; the /sandbox panel and toggle
+ * persist HERE).
  *
- * Merge semantics (Claude parity): scalars — project wins over user over
- * defaults; arrays — union + dedupe across sources (lists merge, never
- * replace). Fail-soft: a malformed file is skipped whole with a warning
- * (same posture as permissionRules/loadConfig.ts).
+ * Merge semantics (Claude parity): scalars — local wins over project over
+ * user over defaults; arrays — union + dedupe across sources (lists merge,
+ * never replace). Fail-soft: a malformed file is skipped whole with a
+ * warning (same posture as permissionRules/loadConfig.ts).
  *
  * Read/write filesystem semantics (srt, verified in the M0 spike): reads are
  * allowed by default with denyRead regions + allowRead re-allow; writes are
@@ -68,7 +69,11 @@ export function readSandboxSettingsFromFile(configPath, warnings, unknownKeys) {
         parsed = JSON.parse(readFileSync(configPath, "utf-8"));
     }
     catch (err) {
-        warnings.push(`sandbox: could not parse ${configPath}: ${err instanceof Error ? err.message : String(err)}`);
+        // Error CLASS only, never the thrown message: V8's JSON.parse message
+        // embeds a snippet of the file's own content, and these warnings are
+        // forwarded verbatim into the error sink — a corrupt/hostile config's
+        // contents must not ride the trail. Path + class stays diagnosable.
+        warnings.push(`sandbox: could not parse ${configPath}: ${err instanceof Error ? err.constructor.name : typeof err}`);
         return undefined;
     }
     if (!isPlainObject(parsed) || parsed.sandbox === undefined)
@@ -178,54 +183,69 @@ function union(...lists) {
         return undefined;
     return [...new Set(present.flat())];
 }
-function mergeNetwork(user, project) {
+function mergeNetwork(user, project, local) {
     const u = user ?? {};
     const p = project ?? {};
+    const l = local ?? {};
     return {
-        allowedDomains: union(u.allowedDomains, p.allowedDomains) ?? [],
-        deniedDomains: union(u.deniedDomains, p.deniedDomains) ?? [],
-        allowUnixSockets: union(u.allowUnixSockets, p.allowUnixSockets),
-        allowAllUnixSockets: p.allowAllUnixSockets ?? u.allowAllUnixSockets,
-        allowLocalBinding: p.allowLocalBinding ?? u.allowLocalBinding,
-        httpProxyPort: p.httpProxyPort ?? u.httpProxyPort,
-        socksProxyPort: p.socksProxyPort ?? u.socksProxyPort,
+        allowedDomains: union(u.allowedDomains, p.allowedDomains, l.allowedDomains) ?? [],
+        deniedDomains: union(u.deniedDomains, p.deniedDomains, l.deniedDomains) ?? [],
+        allowUnixSockets: union(u.allowUnixSockets, p.allowUnixSockets, l.allowUnixSockets),
+        allowAllUnixSockets: l.allowAllUnixSockets ?? p.allowAllUnixSockets ?? u.allowAllUnixSockets,
+        allowLocalBinding: l.allowLocalBinding ?? p.allowLocalBinding ?? u.allowLocalBinding,
+        httpProxyPort: l.httpProxyPort ?? p.httpProxyPort ?? u.httpProxyPort,
+        socksProxyPort: l.socksProxyPort ?? p.socksProxyPort ?? u.socksProxyPort,
     };
 }
-function mergeFilesystem(user, project) {
+function mergeFilesystem(user, project, local) {
     const u = user ?? {};
     const p = project ?? {};
+    const l = local ?? {};
     return {
-        allowRead: union(u.allowRead, p.allowRead),
-        denyRead: union(u.denyRead, p.denyRead) ?? [],
-        allowWrite: union(u.allowWrite, p.allowWrite) ?? [],
-        denyWrite: union(u.denyWrite, p.denyWrite) ?? [],
+        allowRead: union(u.allowRead, p.allowRead, l.allowRead),
+        denyRead: union(u.denyRead, p.denyRead, l.denyRead) ?? [],
+        allowWrite: union(u.allowWrite, p.allowWrite, l.allowWrite) ?? [],
+        denyWrite: union(u.denyWrite, p.denyWrite, l.denyWrite) ?? [],
     };
 }
 /**
- * Load + merge sandbox settings from both config files. Scalars: project
- * beats user; arrays: union. Defaults for scalars land here too (Claude
- * parity): autoAllowBashIfSandboxed true, allowUnsandboxedCommands true,
- * everything else unset/false.
+ * Load + merge sandbox settings from all three config files. Scalars: local
+ * beats project beats user; arrays: union. Defaults for scalars land here
+ * too (Claude parity): autoAllowBashIfSandboxed true, allowUnsandboxedCommands
+ * true, everything else unset/false.
  */
 export function loadSandboxSettings(opts = {}) {
     const warnings = [];
     const unknownKeys = [];
     const stateHome = opts.stateHomeOverride ?? codeStateHome(null, opts.env, opts.userHome);
+    const cwd = opts.cwd ?? process.cwd();
     const userPath = join(stateHome, "config.json");
-    const projectPath = join(opts.cwd ?? process.cwd(), ".yagni-code", "config.json");
+    const projectPath = join(cwd, ".yagni-code", "config.json");
+    const localPath = join(cwd, ".yagni-code", "config.local.json");
     const userSettings = readSandboxSettingsFromFile(userPath, warnings, unknownKeys);
     const projectSettings = readSandboxSettingsFromFile(projectPath, warnings, unknownKeys);
+    const localSettings = readSandboxSettingsFromFile(localPath, warnings, unknownKeys);
     const settings = {
-        enabled: projectSettings?.enabled ?? userSettings?.enabled ?? false,
-        autoAllowBashIfSandboxed: projectSettings?.autoAllowBashIfSandboxed ?? userSettings?.autoAllowBashIfSandboxed ?? true,
-        allowUnsandboxedCommands: projectSettings?.allowUnsandboxedCommands ?? userSettings?.allowUnsandboxedCommands ?? true,
-        failIfUnavailable: projectSettings?.failIfUnavailable ?? userSettings?.failIfUnavailable ?? false,
-        excludedCommands: union(userSettings?.excludedCommands, projectSettings?.excludedCommands) ?? [],
-        network: mergeNetwork(userSettings?.network, projectSettings?.network),
-        filesystem: mergeFilesystem(userSettings?.filesystem, projectSettings?.filesystem),
-        ignoreViolations: projectSettings?.ignoreViolations ?? userSettings?.ignoreViolations,
-        enableWeakerNestedSandbox: projectSettings?.enableWeakerNestedSandbox ?? userSettings?.enableWeakerNestedSandbox,
-        enableWeakerNetworkIsolation: projectSettings?.enableWeakerNetworkIsolation ?? userSettings?.enableWeakerNetworkIsolation,
+        enabled: localSettings?.enabled ?? projectSettings?.enabled ?? userSettings?.enabled ?? false,
+        autoAllowBashIfSandboxed: localSettings?.autoAllowBashIfSandboxed ??
+            projectSettings?.autoAllowBashIfSandboxed ??
+            userSettings?.autoAllowBashIfSandboxed ??
+            true,
+        allowUnsandboxedCommands: localSettings?.allowUnsandboxedCommands ??
+            projectSettings?.allowUnsandboxedCommands ??
+            userSettings?.allowUnsandboxedCommands ??
+            true,
+        failIfUnavailable: localSettings?.failIfUnavailable ?? projectSettings?.failIfUnavailable ?? userSettings?.failIfUnavailable ?? false,
+        excludedCommands: union(userSettings?.excludedCommands, projectSettings?.excludedCommands, localSettings?.excludedCommands) ?? [],
+        network: mergeNetwork(userSettings?.network, projectSettings?.network, localSettings?.network),
+        filesystem: mergeFilesystem(userSettings?.filesystem, projectSettings?.filesystem, localSettings?.filesystem),
+        ignoreViolations: localSettings?.ignoreViolations ?? projectSettings?.ignoreViolations ?? userSettings?.ignoreViolations,
+        enableWeakerNestedSandbox: localSettings?.enableWeakerNestedSandbox ??
+            projectSettings?.enableWeakerNestedSandbox ??
+            userSettings?.enableWeakerNestedSandbox,
+        enableWeakerNetworkIsolation: localSettings?.enableWeakerNetworkIsolation ??
+            projectSettings?.enableWeakerNetworkIsolation ??
+            userSettings?.enableWeakerNetworkIsolation,
     };
     return { settings, diagnostics: { warnings, unknownKeys } };
 }
@@ -343,8 +363,10 @@ export function mergeRulesIntoSandbox(settings, rules, base) {
     // Protected paths: always denyWrite, never exempted (Claude parity + our
     // own surfaces). Note srt denyWrite also denies read-of-ignored writes.
     denyWrite.add(join(base.userStateHome, "config.json"));
-    if (base.projectRoot)
+    if (base.projectRoot) {
         denyWrite.add(join(base.projectRoot, ".yagni-code", "config.json"));
+        denyWrite.add(join(base.projectRoot, ".yagni-code", "config.local.json"));
+    }
     denyWrite.add(base.userStateHome);
     if (base.projectRoot)
         denyWrite.add(join(base.projectRoot, ".yagni-code"));

package/dist/extension/sandbox/manager.d.ts

@@ -46,7 +46,17 @@ export declare class YagniSandboxManager {
     private state;
     private askHandler;
     private readonly opts;
+    /** Config warnings already logged this process — buildRuntimeMerge runs
+     * per grant/setRules refresh, and re-logging the same corrupt-file warning
+     * per call would flood the trail with one line per grant. */
+    private loggedConfigWarnings;
     constructor(opts: SandboxSessionOptions);
+    /** Surface loader diagnostics (warnings + unknown keys) once per string
+     * per process: a corrupt or wrong-shaped sandbox block in any of the
+     * three config files is skipped whole (fail-soft), and a silently ignored
+     * config (or a typo'd key) needs its signal — same posture as index.ts
+     * surfacing the rule-loader warnings. */
+    private surfaceConfigDiagnostics;
     get initialized(): boolean;
     get settings(): SandboxSettings | null;
     get dependencies(): SandboxDependencyStatus | null;

package/dist/extension/sandbox/manager.js

@@ -24,10 +24,33 @@ export class YagniSandboxManager {
     state = { initialized: false, dependencies: null, settings: null };
     askHandler = null;
     opts;
+    /** Config warnings already logged this process — buildRuntimeMerge runs
+     * per grant/setRules refresh, and re-logging the same corrupt-file warning
+     * per call would flood the trail with one line per grant. */
+    loggedConfigWarnings = new Set();
     constructor(opts) {
         this.opts = opts;
         this.askHandler = opts.askHandler ?? null;
     }
+    /** Surface loader diagnostics (warnings + unknown keys) once per string
+     * per process: a corrupt or wrong-shaped sandbox block in any of the
+     * three config files is skipped whole (fail-soft), and a silently ignored
+     * config (or a typo'd key) needs its signal — same posture as index.ts
+     * surfacing the rule-loader warnings. */
+    surfaceConfigDiagnostics(diagnostics) {
+        const messages = [
+            ...diagnostics.warnings,
+            ...(diagnostics.unknownKeys.length > 0
+                ? [`sandbox: unknown keys ignored: ${diagnostics.unknownKeys.join(", ")}`]
+                : []),
+        ];
+        for (const message of messages) {
+            if (this.loggedConfigWarnings.has(message))
+                continue;
+            this.loggedConfigWarnings.add(message);
+            logEvent({ source: "sandbox", level: "warn", event: "sandbox_config_warning", fields: { warning: message } });
+        }
+    }
     get initialized() { return this.state.initialized; }
     get settings() { return this.state.settings; }
     get dependencies() { return this.state.dependencies; }
@@ -75,12 +98,13 @@ export class YagniSandboxManager {
      * tests; initialize() consumes it internally.
      */
     buildRuntimeMerge(rules) {
-        const { settings } = loadSandboxSettings({
+        const { settings, diagnostics } = loadSandboxSettings({
             cwd: this.opts.cwd,
             env: this.opts.env,
             userHome: this.opts.userHome,
             stateHomeOverride: this.opts.stateHomeOverride,
         });
+        this.surfaceConfigDiagnostics(diagnostics);
         return mergeRulesIntoSandbox(settings, rules, {
             cwd: this.opts.cwd,
             userStateHome: this.opts.stateHomeOverride ?? codeStateHome(null, this.opts.env, this.opts.userHome),
@@ -134,6 +158,9 @@ export class YagniSandboxManager {
             userHome: this.opts.userHome,
             stateHomeOverride: this.opts.stateHomeOverride,
         });
+        // Same warning surfacing as buildRuntimeMerge — initialize() skips
+        // buildRuntimeMerge on the disabled path, so its own load reports too.
+        this.surfaceConfigDiagnostics(load.diagnostics);
         if (!load.settings.enabled && !opts.force)
             return "sandbox disabled by config";
         const deps = this.checkDependencies();