@yagni-app/code-staging 1.0.8-staging.1273.1 → 1.0.8-staging.1275.1

package/dist/extension/askUserQuestionTool.js

@@ -24,7 +24,11 @@ import { logAskQuestion } from "./diagnostics.js";
 const TOOL_NAME = "ask_user_question";
 /** Claude mirrors this as ASK_USER_QUESTION_TOOL_CHIP_WIDTH. */
 const CHIP_WIDTH = 12;
-/** Same fail-closed ceiling as the permission-gate ask. */
+/** Cancel an unanswered question after 2 minutes. This is the structured
+ * QUESTION tool's own UX cap — NOT the permission-ask contract (gate asks
+ * wait indefinitely per Claude Code parity; see agent-safety.md). A stale
+ * question auto-cancels so the agent's turn cannot hang on a chip nobody
+ * is looking at; the user can always re-ask. */
 const ASK_TIMEOUT_MS = 120_000;
 /** Sentinel value representing the "Other" row in the multi-select toggle set. */
 const OTHER_KEY = "__other__";
@@ -523,7 +527,8 @@ async function askOne(ctx, q, qIndex) {
             return;
         }
         ctx.signal?.addEventListener("abort", onAbort, { once: true });
-        // Best-effort timeout, mirroring the permission-gate ask fail-closed.
+        // Best-effort timeout: this surface's own 2-minute question cap (the
+        // permission-gate ask deliberately has none — see ASK_TIMEOUT_MS above).
         const timer = setTimeout(() => settle({ status: "cancelled" }), ASK_TIMEOUT_MS);
         void ctx.ui
             .custom((_tui, theme, keybindings, done) => {

package/dist/extension/permission/gate.js

@@ -513,45 +513,134 @@ export function registerPermissionGate(pi, deps = {}) {
         const flat = command.replace(/\s+/g, " ").trim();
         return flat.length <= 240 ? flat : `${flat.slice(0, 237)}…`;
     };
-    const ASK_TIMEOUT_MS = 120_000;
     const ASK_YES = "Yes, run it";
     const ASK_NO = "No";
+    /**
+     * The ask dialog now waits indefinitely, so an unanswered ask is a silent
+     * unbounded pause: a lost RPC client or an abandoned dialog hangs the
+     * session with nothing in the trail to explain why. Emit one sanitized
+     * event when the dialog OPENS — kind + tool ONLY. The sink's default-on
+     * contract is content-free (raw content is gated behind YAGNI_DEBUG), and
+     * even the rule string stays out: it is user-authored free text that can
+     * embed secret-bearing fragments (env assignments, URL credentials), and
+     * a rule ask is already fully identified by kind "rule" + the tool. Fail-
+     * soft; the sink never throws into the gate.
+     */
+    const logAskOpened = (kind, toolName) => {
+        try {
+            logEvent({
+                source: "guardian",
+                level: "info",
+                event: "guardian_ask_opened",
+                fields: { kind, tool: toolName },
+            });
+        }
+        catch {
+            /* telemetry must never affect the gate */
+        }
+    };
+    /**
+     * The paired resolution event: with no dialog timeout, the pause DURATION
+     * and its OUTCOME are the story (answered vs ESC-dismissed vs turn-aborted),
+     * and a dismissed dialog would otherwise leave no trail line of its own.
+     * kind + tool + outcome only — all enum values, nothing content-bearing.
+     * durationMs makes the pause directly readable instead of timestamp-diffing
+     * two lines. Same fail-soft contract as the open event.
+     */
+    const logAskResolved = (kind, toolName, outcome, openedAt) => {
+        try {
+            logEvent({
+                source: "guardian",
+                level: "info",
+                event: "guardian_ask_resolved",
+                fields: { kind, tool: toolName, outcome, durationMs: Date.now() - openedAt },
+            });
+        }
+        catch {
+            /* telemetry must never affect the gate */
+        }
+    };
+    /**
+     * The single choice-to-resolution mapping BOTH ask dialogs share — one
+     * place, so the two surfaces can never drift. The option labels the dialog
+     * actually offered are passed in; the rule rung is null when the plain
+     * dialog didn't offer it. An aborted turn wins over any choice value; a
+     * real user ESC maps to "dismissed" (the no-abort, no-answer bucket —
+     * ESC resolves undefined in pi). A THROWN select never reaches this
+     * function: the dialogs route it to thrownChoiceResolution, which is the
+     * ONLY source of outcome "error". Both fail closed identically
+     * downstream — only the telemetry distinguishes them.
+     */
+    const resolveChoice = (choice, opts) => {
+        if (opts.aborted)
+            return "aborted";
+        if (choice === ASK_YES)
+            return "yes";
+        if (opts.rememberLabel !== null && choice === opts.rememberLabel)
+            return "remember";
+        if (opts.ruleLabel != null && choice === opts.ruleLabel)
+            return "rule";
+        if (choice === ASK_NO)
+            return "no";
+        // No abort and no recognizable answer — a real ESC (pi resolves a
+        // dismissed dialog as undefined) or any unmatched value. NEVER the
+        // thrown-select path: that maps to "error" in thrownChoiceResolution.
+        return "dismissed";
+    };
+    /**
+     * Map a THROWN select to its resolution: the UI/RPC layer failed (dead
+     * client, disposed dialog) — never a human answer. Distinct from ESC in
+     * the trail so a lost client is attributable; blocks exactly like a
+     * dismissal downstream (fail closed).
+     */
+    const thrownChoiceResolution = (aborted) => aborted ? "aborted" : "error";
     /**
      * The single human-in-the-loop ask surface (YAG-510): used for ask
      * verdicts, Guardian-unavailable/disabled fallbacks, and the breaker
      * escalation — one UI, one cache, one event stream. Always passes the
-     * turn's abort signal (without it a turn-abort leaves the dialog hanging)
-     * and a timeout (pi renders a countdown; expiry fails closed).
+     * turn's abort signal (without it a turn-abort leaves the dialog hanging).
+     *
+     * No dialog timeout — Claude Code parity: a permission ask waits
+     * indefinitely for the human. The only dismissal paths are the user
+     * answering, dismissing the dialog (ESC), the turn aborting (Ctrl-C /
+     * interrupt), or the UI layer failing (outcome "error", fail closed).
+     * The old 120s auto-fail-closed cap is gone; an unattended dialog pauses
+     * the session rather than denying the command.
      */
-    const askUser = async (ctx, title, rememberLabel) => {
+    const askUser = async (ctx, title, rememberLabel, kind = "guardian_verdict", toolName = "bash") => {
         if (ctx.signal?.aborted)
             return "aborted";
+        logAskOpened(kind, toolName);
+        const openedAt = Date.now();
         const options = rememberLabel ? [ASK_YES, rememberLabel, ASK_NO] : [ASK_YES, ASK_NO];
         let choice;
+        let selectThrew = false;
         try {
             choice = await ctx.ui.select(title, options, {
                 ...(ctx.signal ? { signal: ctx.signal } : {}),
-                timeout: ASK_TIMEOUT_MS,
             });
         }
         catch {
-            choice = undefined;
+            selectThrew = true;
         }
-        if (choice === ASK_YES)
-            return "yes";
-        if (rememberLabel !== null && choice === rememberLabel)
-            return "remember";
-        if (choice === ASK_NO)
-            return "no";
-        return ctx.signal?.aborted ? "aborted" : "dismissed";
+        const resolution = selectThrew
+            ? thrownChoiceResolution(ctx.signal?.aborted ?? false)
+            : resolveChoice(choice, { rememberLabel, aborted: ctx.signal?.aborted ?? false });
+        logAskResolved(kind, toolName, resolution, openedAt);
+        return resolution;
     };
     /**
      * variant: the Guardian ask dialog with an optional third option
-     * (persist a user-level permission rule). Same semantics as askUser.
+     * (persist a user-level permission rule). Same semantics as askUser
+     * (indefinite wait, turn-abort signal only). kind/toolName are threaded
+     * through — never hardcoded here — so a future non-bash caller cannot
+     * silently misattribute the dialog in the trail.
      */
-    const askUserWithOptions = async (ctx, title, rememberLabel, ruleLabel) => {
+    const askUserWithOptions = async (ctx, title, rememberLabel, ruleLabel, kind = "guardian_verdict", toolName = "bash") => {
         if (ctx.signal?.aborted)
             return "aborted";
+        logAskOpened(kind, toolName);
+        const openedAt = Date.now();
         const options = [
             ASK_YES,
             ...(rememberLabel ? [rememberLabel] : []),
@@ -559,24 +648,20 @@ export function registerPermissionGate(pi, deps = {}) {
             ASK_NO,
         ];
         let choice;
+        let selectThrew = false;
         try {
             choice = await ctx.ui.select(title, options, {
                 ...(ctx.signal ? { signal: ctx.signal } : {}),
-                timeout: ASK_TIMEOUT_MS,
             });
         }
         catch {
-            choice = undefined;
+            selectThrew = true;
         }
-        if (choice === ASK_YES)
-            return "yes";
-        if (rememberLabel !== null && choice === rememberLabel)
-            return "remember";
-        if (ruleLabel !== null && choice === ruleLabel)
-            return "rule";
-        if (choice === ASK_NO)
-            return "no";
-        return ctx.signal?.aborted ? "aborted" : "dismissed";
+        const resolution = selectThrew
+            ? thrownChoiceResolution(ctx.signal?.aborted ?? false)
+            : resolveChoice(choice, { rememberLabel, ruleLabel, aborted: ctx.signal?.aborted ?? false });
+        logAskResolved(kind, toolName, resolution, openedAt);
+        return resolution;
     };
     const buildAskTitle = (command, rationale, riskLevel) => {
         const risk = riskLevel ? ` (risk: ${riskLevel})` : "";
@@ -666,7 +751,7 @@ export function registerPermissionGate(pi, deps = {}) {
                     if (ruleAskApprovals.has(askKey))
                         return {};
                     const origin = ruleVerdict.rule.source === "user" ? "your user settings" : ruleVerdict.rule.source === "local" ? "the project's local settings" : "the project's settings";
-                    const choice = await askUser(ctx, `Permission rule (ask) in ${origin}:\n${ruleVerdict.rule.raw}\nAllow ${event.toolName}?`, null);
+                    const choice = await askUser(ctx, `Permission rule (ask) in ${origin}:\n${ruleVerdict.rule.raw}\nAllow ${event.toolName}?`, null, "rule", event.toolName);
                     if (choice === "yes") {
                         if (ruleAskApprovals.size > APPROVED_CACHE_MAX)
                             ruleAskApprovals.clear();
@@ -816,7 +901,7 @@ export function registerPermissionGate(pi, deps = {}) {
                         if (ctx?.hasUI && !breakerEscalationOffered && !ctx.signal?.aborted) {
                             breakerEscalationOffered = true;
                             const title = `Guardian denied ${guardianState.read().consecutiveDenials} commands in a row.\nAllow the latest command anyway?\n$ ${boundedCommand(command)}`;
-                            const resolution = await askUser(ctx, title, null);
+                            const resolution = await askUser(ctx, title, null, "breaker");
                             if (resolution === "yes") {
                                 guardianState.resetTurn();
                                 rememberApproved(cwd, command);
@@ -984,7 +1069,7 @@ export function registerPermissionGate(pi, deps = {}) {
                         const ruleLabel = grantCandidate && deps.persistUserRule
                             ? `Yes, and always allow \`${grantCandidate.pattern.join(" ")}\` in this project's local settings`
                             : null;
-                        const resolution = await askUserWithOptions(ctx, buildAskTitle(command, verdict.rationale, verdict.riskLevel), rememberLabel, ruleLabel);
+                        const resolution = await askUserWithOptions(ctx, buildAskTitle(command, verdict.rationale, verdict.riskLevel), rememberLabel, ruleLabel, "guardian_verdict", "bash");
                         if (resolution === "yes") {
                             rememberApproved(cwd, command);
                             emitGateEvent(slot, {
@@ -1084,7 +1169,10 @@ export function registerPermissionGate(pi, deps = {}) {
                                 reason: "The user declined this command. Ask what they would like to do differently, or take a different approach.",
                             };
                         }
-                        // dismissed / dialog timeout — neutral reason, no "denied" spin.
+                        // dismissed or UI-layer error — neutral reason, no "denied"
+                        // spin. (No timeout can land here anymore: the dialog waits
+                        // indefinitely, so this is only a real ESC/dismiss — or the
+                        // select itself failed, which fails closed the same way.)
                         return {
                             block: true,
                             reason: "The permission dialog was dismissed; the command was not run. Ask the user how to proceed.",
@@ -1112,7 +1200,7 @@ export function registerPermissionGate(pi, deps = {}) {
                         // bounded per prompt so an outage can't become an ask storm.
                         errorFallbackAsks += 1;
                         const errorMsg = guardianErrorMessage(error);
-                        const resolution = await askUser(ctx, `Guardian unavailable (${errorMsg}).\nRun this command anyway?\n$ ${boundedCommand(command)}`, null);
+                        const resolution = await askUser(ctx, `Guardian unavailable (${errorMsg}).\nRun this command anyway?\n$ ${boundedCommand(command)}`, null, "error_fallback");
                         if (resolution === "yes") {
                             rememberApproved(cwd, command);
                             emitGateEvent(slot, { ...eventBase, outcome: "ask_approved", guardianError: error, durationMs, consulted: false });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yagni-app/code-staging",
-  "version": "1.0.8-staging.1273.1",
+  "version": "1.0.8-staging.1275.1",
   "description": "YAGNI Code: a terminal coding agent that already knows your company. One YAGNI login routes the model and grounds the agent in your team's context.",
   "license": "SEE LICENSE IN LICENSE.md",
   "author": "YAGNI, Inc. <jack@yagni.app> (https://yagni.app)",
@@ -58,5 +58,5 @@
     "turndown": "^7.2.4",
     "typebox": "^1.3.15"
   },
-  "yagniSourceSha": "bb2c4a103e2db69e8dcc6eec98c7343ddefca05c"
+  "yagniSourceSha": "c49131c2a11910eedfa3b14012735b1e593769df"
 }