@yagni-app/code-staging 1.1.0-staging.1334.1 → 1.1.0-staging.1335.1

package/dist/extension/index.js

@@ -541,6 +541,7 @@ export async function registerYagni(pi, deps = {}) {
             cwd: process.cwd(),
             env,
             hasUI: (ctx) => ctx.hasUI,
+            onShellResolutionRetry: (outcome) => telemetry.sandboxShellResolutionRetry(outcome),
             // Anchors project-protected paths (.yagni-code + its config.json in
             // denyWrite) and project-sourced permission rules to the repo the
             // session runs in — same root the gate uses for its rule anchoring.

package/dist/extension/sandbox/bash.d.ts

@@ -61,8 +61,27 @@ export declare function makeSandboxSpawnHook(manager: YagniSandboxManager): Bash
  * Wrap a raw command for OS-sandboxed execution. Returns the original string
  * when the manager is not initialized (fail-open to plain execution — the
  * permission gate still ran; the sandbox simply is not active).
+ *
+ * Transient shell-resolution failures (isShellResolutionFailure — srt's 1s
+ * `which` spawn timing out under load) are retried once after a short
+ * backoff; a second failure surfaces the original error. Any other error
+ * propagates immediately, no retry.
  */
-export declare function preWrappedCommand(manager: YagniSandboxManager, command: string, binShell?: string): Promise<string>;
+export interface PreWrapRetryOpts {
+    /** Abort the backoff sleep (the tool call's signal). */
+    signal?: AbortSignal;
+    /** Backoff before the single retry. Tests pass a tiny value to stay fast. */
+    backoffMs?: number;
+    /** Instrumentation: fired once, with the retry's terminal outcome. */
+    onRetry?: (outcome: "recovered" | "exhausted") => void;
+}
+export declare function preWrappedCommand(manager: YagniSandboxManager, command: string, binShell?: string, opts?: PreWrapRetryOpts): Promise<string>;
+export declare function _setShellResolutionRetryBackoffForTest(ms: number | null): void;
+/** srt's transient shell-resolution failure: `Shell '<name>' not found in
+ * PATH`, thrown from wrapCommandWithSandbox when which.js's 1s
+ * spawnSync('which') times out under load. Self-healing after ~15–30s;
+ * preWrappedCommand retries it once. */
+export declare function isShellResolutionFailure(err: unknown): boolean;
 /**
  * Detect "Operation not permitted" style sandbox denials in bash output so
  * callers (tool_result) can annotate and the model can react. Returns the

package/dist/extension/sandbox/bash.js

@@ -21,6 +21,8 @@
  * lessons (process-group kill, stdio release).
  */
 import { existsSync } from "node:fs";
+import { logEvent } from "../errorSink.js";
+import { scrubSecrets } from "../pipeline/scrubSecrets.js";
 function stripLeadingSafeEnvVars(command) {
     // Best-effort normalization for excludedCommands matching (not a security
     // boundary — the permission gate is). Strips leading VAR=val pairs whose
@@ -112,15 +114,116 @@ export function makeSandboxSpawnHook(manager) {
         env: { ...ctx.env, ...extraEnv },
     });
 }
-/**
- * Wrap a raw command for OS-sandboxed execution. Returns the original string
- * when the manager is not initialized (fail-open to plain execution — the
- * permission gate still ran; the sandbox simply is not active).
- */
-export async function preWrappedCommand(manager, command, binShell) {
+export async function preWrappedCommand(manager, command, binShell, opts = {}) {
     if (!manager.initialized)
         return command;
-    return manager.wrapWithSandbox(command, binShell);
+    try {
+        return await manager.wrapWithSandbox(command, binShell);
+    }
+    catch (err) {
+        if (!isShellResolutionFailure(err))
+            throw err;
+    }
+    // The failed attempt may have left per-command state behind (the wrap can
+    // start helpers before it throws); clear it so the retry starts clean and
+    // the exec path's cleanupAfterCommand never sees double state. Best-effort:
+    // a cleanup throw must never swallow the original error or kill the retry.
+    try {
+        manager.cleanupAfterCommand();
+    }
+    catch (err) {
+        // Best-effort cleanup failed — the retry still runs (the exec path
+        // cleans up again); a fully silent swallow would hide a leaked-helper
+        // state, so the failure gets a visible trail. The message rides the
+        // line (the error class alone is always the literal "Error" for plain
+        // throws) and is run through scrubSecrets at WRITE time so the line
+        // is credential-scrubbed before any reader. That is pattern-scrub
+        // only, not a general redactor — readSessionTrail adds the same
+        // pattern pass at read time; the durable errors-*.jsonl stays
+        // unredacted by the sink's documented design (local file, never
+        // uploaded raw). Same posture as sandbox_persist_failed.
+        logEvent({
+            source: "sandbox",
+            level: "warn",
+            event: "shell_retry_cleanup_failed",
+            fields: {
+                error: scrubSecrets(err instanceof Error ? `${err.constructor.name}: ${err.message}` : String(err)),
+            },
+        });
+    }
+    await sleep(effectiveBackoffMs(opts.backoffMs), opts.signal);
+    try {
+        const wrapped = await manager.wrapWithSandbox(command, binShell);
+        opts.onRetry?.("recovered");
+        return wrapped;
+    }
+    catch (err) {
+        // `exhausted` is the shell-resolution health signal — report it only
+        // when the second failure is the SAME transient; an unrelated retry
+        // error propagates as-is without polluting the metric.
+        if (isShellResolutionFailure(err))
+            opts.onRetry?.("exhausted");
+        throw err;
+    }
+}
+/** Default backoff before the single shell-resolution retry. The observed
+ * upstream transient self-heals in ~15–30s; this is a bounded bridge, not
+ * a guarantee — a still-failing second attempt surfaces the original error. */
+const SHELL_RESOLUTION_RETRY_BACKOFF_MS = 2000;
+/** Test seam for the backoff: session-layer tests (composition, user_bash)
+ * drive the retry without a backoffMs opt, so they shrink the module-level
+ * default instead of sleeping a real 2s. Module-scoped (never a globalThis
+ * key — a leaked value there would silently shrink the production backoff);
+ * restore in the same describe that sets it. */
+let shellRetryBackoffMsForTest = null;
+export function _setShellResolutionRetryBackoffForTest(ms) {
+    shellRetryBackoffMsForTest = ms;
+}
+function effectiveBackoffMs(override) {
+    return override ?? shellRetryBackoffMsForTest ?? SHELL_RESOLUTION_RETRY_BACKOFF_MS;
+}
+function sleep(ms, signal) {
+    // The abort rejection carries the caller's own abort reason when the
+    // signal has a real one — a context-free "aborted" would replace the
+    // meaningful error the caller (and the model) should see. Node's DEFAULT
+    // reason is a generic DOMException ("This operation was aborted") with no
+    // retry context, so it is replaced with a named message too.
+    const abortError = () => {
+        const reason = signal?.reason;
+        if (reason instanceof Error && reason.name !== "AbortError")
+            return reason;
+        // A non-Error reason is spec-legal (controller.abort("user cancelled"))
+        // — stringify it rather than silently dropping it for the generic name.
+        // The DEFAULT reason (AbortError DOMException) stays on the named
+        // message: stringifying it would read "aborted: This operation was
+        // aborted".
+        if (reason !== undefined && reason !== null && !(reason instanceof Error)) {
+            return new Error(`sandbox shell-resolution retry aborted: ${String(reason)}`);
+        }
+        return new Error("sandbox shell-resolution retry aborted");
+    };
+    return new Promise((resolve, reject) => {
+        if (signal?.aborted) {
+            reject(abortError());
+            return;
+        }
+        const t = setTimeout(() => {
+            signal?.removeEventListener("abort", onAbort);
+            resolve();
+        }, ms);
+        const onAbort = () => {
+            clearTimeout(t);
+            reject(abortError());
+        };
+        signal?.addEventListener("abort", onAbort, { once: true });
+    });
+}
+/** srt's transient shell-resolution failure: `Shell '<name>' not found in
+ * PATH`, thrown from wrapCommandWithSandbox when which.js's 1s
+ * spawnSync('which') times out under load. Self-healing after ~15–30s;
+ * preWrappedCommand retries it once. */
+export function isShellResolutionFailure(err) {
+    return err instanceof Error && /^Shell '[^']*' not found in PATH$/.test(err.message);
 }
 /**
  * Detect "Operation not permitted" style sandbox denials in bash output so

package/dist/extension/sandbox/session.d.ts

@@ -28,7 +28,7 @@ import type { PermissionRule } from "../permissionRules/loadConfig.js";
  * here would be overwritten and the sandbox would silently never reach
  * model-driven tool calls.
  */
-export declare function makeBashComposition(manager: YagniSandboxManager, settings: () => SandboxSettings, cwd: string): (def: ToolDefinition) => ToolDefinition;
+export declare function makeBashComposition(manager: YagniSandboxManager, settings: () => SandboxSettings, cwd: string, onShellResolutionRetry?: (outcome: "recovered" | "exhausted") => void): (def: ToolDefinition) => ToolDefinition;
 export interface SandboxSessionHandle {
     manager: YagniSandboxManager;
     settings: () => SandboxSettings;
@@ -76,6 +76,10 @@ export interface RegisterSandboxOptions {
      * registration (the duplicate-name 400 + silent-unwrap lesson from M4).
      */
     registerOwnBash?: boolean;
+    /** Shell-resolution retry instrumentation (the OTel counter — index.ts
+     * wires the telemetry handle). Absent (eval mode, tests) ⇒ only the local
+     * sink line fires. */
+    onShellResolutionRetry?: (outcome: "recovered" | "exhausted") => void;
 }
 /**
  * Register the sandbox surfaces on the ExtensionAPI. Returns the session

package/dist/extension/sandbox/session.js

@@ -39,7 +39,7 @@ import { effectiveRules } from "../permissionRules/loadConfig.js";
  * here would be overwritten and the sandbox would silently never reach
  * model-driven tool calls.
  */
-export function makeBashComposition(manager, settings, cwd) {
+export function makeBashComposition(manager, settings, cwd, onShellResolutionRetry) {
     return (def) => {
         if (!settings().enabled)
             return def;
@@ -115,9 +115,13 @@ export function makeBashComposition(manager, settings, cwd) {
                 if (!useSandbox) {
                     return def.execute(id, params, signal, onUpdate, ctx);
                 }
-                const execParams = { ...input, command: await preWrappedCommand(manager, input.command, binShell) };
                 let result;
                 try {
+                    const command = await preWrappedCommand(manager, input.command, binShell, {
+                        signal: signal ?? undefined,
+                        onRetry: onShellResolutionRetry,
+                    });
+                    const execParams = { ...input, command };
                     result = await sandboxBash.execute(id, execParams, signal, onUpdate, ctx);
                 }
                 catch (err) {
@@ -309,7 +313,11 @@ export function registerSandbox(pi, opts) {
     // registration when condensed is inactive (eval mode, classic rows,
     // desktop). The composition is identity when the sandbox is disabled —
     // default-off sessions stay byte-identical.
-    const composeBash = makeBashComposition(manager, () => currentSettings, opts.cwd);
+    const onShellResolutionRetry = (outcome) => {
+        logShellResolutionRetry(outcome);
+        opts.onShellResolutionRetry?.(outcome);
+    };
+    const composeBash = makeBashComposition(manager, () => currentSettings, opts.cwd, onShellResolutionRetry);
     const registerOwnBash = () => {
         if (!currentSettings.enabled)
             return;
@@ -345,7 +353,10 @@ export function registerSandbox(pi, opts) {
             exec: async (command, cwd, { onData, signal, timeout, env }) => {
                 if (!existsSync(cwd))
                     throw new Error(`Working directory does not exist: ${cwd}`);
-                const wrapped = await manager.wrapWithSandbox(command, shell);
+                const wrapped = await preWrappedCommand(manager, command, shell, {
+                    signal,
+                    onRetry: onShellResolutionRetry,
+                });
                 const child = spawn(shell, [...args, wrapped], {
                     cwd,
                     env: env ?? process.env,
@@ -781,6 +792,19 @@ export function registerSandbox(pi, opts) {
 function isPlainRecord(v) {
     return typeof v === "object" && v !== null && !Array.isArray(v);
 }
+/** Sink line for the transient shell-resolution retry: outcome only (a
+ * closed enum, no command or shell content — scrub-safe, so it rides the
+ * default-on tier and /feedback). `recovered` = the retry healed a
+ * transient srt `which` timeout; `exhausted` = the failure surfaced to the
+ * model (warn, the break-glass signal). */
+function logShellResolutionRetry(outcome) {
+    logEvent({
+        source: "sandbox",
+        level: outcome === "recovered" ? "info" : "warn",
+        event: "shell_resolution_retry",
+        fields: { outcome },
+    });
+}
 /** Sink line when the network-posture classifier fires — the impact
  * signal (paired with tool_execute_decision's useSandbox it makes the
  * escape-rate before/after readable from the trail). Closed enum class,

package/dist/extension/telemetry/attrs.d.ts

@@ -85,6 +85,7 @@ export declare const METRIC_COST_USAGE = "yagni_code.cost.usage";
 export declare const METRIC_TOKEN_USAGE = "yagni_code.token.usage";
 export declare const METRIC_CODE_EDIT_DECISION = "yagni_code.code_edit_tool.decision";
 export declare const METRIC_ACTIVE_TIME = "yagni_code.active_time.total";
+export declare const METRIC_SANDBOX_SHELL_RETRY = "yagni_code.sandbox.shell_resolution_retry.count";
 export declare const EVENT_USER_PROMPT = "user_prompt";
 export declare const EVENT_ASSISTANT_RESPONSE = "assistant_response";
 export declare const EVENT_TOOL_RESULT = "tool_result";

package/dist/extension/telemetry/attrs.js

@@ -89,6 +89,7 @@ export const METRIC_COST_USAGE = `${PREFIX}.cost.usage`;
 export const METRIC_TOKEN_USAGE = `${PREFIX}.token.usage`;
 export const METRIC_CODE_EDIT_DECISION = `${PREFIX}.code_edit_tool.decision`;
 export const METRIC_ACTIVE_TIME = `${PREFIX}.active_time.total`;
+export const METRIC_SANDBOX_SHELL_RETRY = `${PREFIX}.sandbox.shell_resolution_retry.count`;
 // ── Event names (Claude Code's log events, prefixed in the body) ────────────
 export const EVENT_USER_PROMPT = "user_prompt";
 export const EVENT_ASSISTANT_RESPONSE = "assistant_response";

package/dist/extension/telemetry/register.d.ts

@@ -34,6 +34,8 @@ export interface TelemetryHandle {
      * to the `includeAccountId` gate).
      */
     setUserEmail(email: string | undefined): void;
+    /** The sandbox's shell-resolution retry calls this with its outcome. */
+    sandboxShellResolutionRetry(outcome: "recovered" | "exhausted"): void;
     /** Test/introspection seam: the live tracker once the SDK is up. */
     readonly tracker: SessionTelemetry | null;
 }

package/dist/extension/telemetry/register.js

@@ -28,6 +28,7 @@ const NOOP_HANDLE = (config) => ({
     toolDecision: () => { },
     permissionModeChanged: () => { },
     setUserEmail: () => { },
+    sandboxShellResolutionRetry: () => { },
     tracker: null,
 });
 export function registerTelemetry(pi, deps = {}) {
@@ -188,6 +189,7 @@ export function registerTelemetry(pi, deps = {}) {
         },
         toolDecision: guard("tool_decision", (input) => tracker?.toolDecision(input)),
         permissionModeChanged: guard("permission_mode_changed", (from, to) => tracker?.permissionModeChanged(from, to)),
+        sandboxShellResolutionRetry: guard("sandbox_shell_resolution_retry", (outcome) => tracker?.sandboxShellResolutionRetry(outcome)),
         // Precedence, lowest to highest: this call (the /context boot fetch) <
         // the launcher's YAGNI_USER_EMAIL, which resolveTelemetryConfig already
         // placed on `identity`. So an identity that is set is never overwritten,

package/dist/extension/telemetry/tracker.d.ts

@@ -110,6 +110,10 @@ export declare class SessionTelemetry {
     }): void;
     /** Lines added/removed by an edit or write, from pi's tool_result details. */
     linesOfCode(added: number, removed: number): void;
+    /** Transient sandbox shell-resolution failure retried by the wrap seam —
+     * `recovered` (retry healed it) vs `exhausted` (error surfaced to the
+     * model). The post-deploy health signal for the retry feature. */
+    sandboxShellResolutionRetry(outcome: "recovered" | "exhausted"): void;
     /** A successful bash command: count commits and PR creations. */
     bashSucceeded(command: string | undefined): void;
     permissionModeChanged(fromMode: string, toMode: string): void;

package/dist/extension/telemetry/tracker.js

@@ -20,7 +20,7 @@
 import { randomUUID } from "node:crypto";
 import { context as otelContext, SpanStatusCode, trace, } from "@opentelemetry/api";
 import { SeverityNumber } from "@opentelemetry/api-logs";
-import { ATTR_APP_ENTRYPOINT, ATTR_APP_VERSION, ATTR_ERROR_TYPE, ATTR_GEN_AI_AGENT_NAME, ATTR_GEN_AI_CACHE_CREATION_TOKENS_LEGACY, ATTR_GEN_AI_CACHE_READ_TOKENS, ATTR_GEN_AI_CACHE_READ_TOKENS_LEGACY, ATTR_GEN_AI_CACHE_WRITE_TOKENS, ATTR_DD_LLMOBS_METADATA, ATTR_GEN_AI_CONVERSATION_ID, ATTR_GEN_AI_COST_ESTIMATED_TOTAL, ATTR_GEN_AI_FINISH_REASONS, ATTR_GEN_AI_INPUT_TOKENS, ATTR_GEN_AI_OPERATION_NAME, ATTR_GEN_AI_OUTPUT_TOKENS, ATTR_GEN_AI_TOTAL_TOKENS, ATTR_GEN_AI_PROVIDER_NAME, ATTR_GEN_AI_REQUEST_MODEL, ATTR_GEN_AI_RESPONSE_ID, ATTR_GEN_AI_RESPONSE_MODEL, ATTR_GEN_AI_SYSTEM, ATTR_GEN_AI_TOOL_CALL_ID, ATTR_GEN_AI_TOOL_NAME, ATTR_GEN_AI_TOOL_TYPE, ATTR_HTTP_STATUS_CODE, ATTR_ORGANIZATION_ID, ATTR_SESSION_ID, ATTR_TERMINAL_TYPE, ATTR_USER_EMAIL, EVENT_API_ERROR, EVENT_API_REQUEST, EVENT_ASSISTANT_RESPONSE, EVENT_PERMISSION_MODE_CHANGED, EVENT_TOOL_DECISION, EVENT_TOOL_RESULT, EVENT_USER_PROMPT, GEN_AI_PROVIDER, languageFromPath, METRIC_ACTIVE_TIME, METRIC_CODE_EDIT_DECISION, METRIC_COMMIT_COUNT, METRIC_COST_USAGE, METRIC_LINES_OF_CODE, METRIC_PULL_REQUEST_COUNT, METRIC_SESSION_COUNT, METRIC_TOKEN_USAGE, PREFIX, SPAN_INTERACTION, SPAN_LLM_REQUEST, SPAN_TOOL, SPAN_TURN, } from "./attrs.js";
+import { ATTR_APP_ENTRYPOINT, ATTR_APP_VERSION, ATTR_ERROR_TYPE, ATTR_GEN_AI_AGENT_NAME, ATTR_GEN_AI_CACHE_CREATION_TOKENS_LEGACY, ATTR_GEN_AI_CACHE_READ_TOKENS, ATTR_GEN_AI_CACHE_READ_TOKENS_LEGACY, ATTR_GEN_AI_CACHE_WRITE_TOKENS, ATTR_DD_LLMOBS_METADATA, ATTR_GEN_AI_CONVERSATION_ID, ATTR_GEN_AI_COST_ESTIMATED_TOTAL, ATTR_GEN_AI_FINISH_REASONS, ATTR_GEN_AI_INPUT_TOKENS, ATTR_GEN_AI_OPERATION_NAME, ATTR_GEN_AI_OUTPUT_TOKENS, ATTR_GEN_AI_TOTAL_TOKENS, ATTR_GEN_AI_PROVIDER_NAME, ATTR_GEN_AI_REQUEST_MODEL, ATTR_GEN_AI_RESPONSE_ID, ATTR_GEN_AI_RESPONSE_MODEL, ATTR_GEN_AI_SYSTEM, ATTR_GEN_AI_TOOL_CALL_ID, ATTR_GEN_AI_TOOL_NAME, ATTR_GEN_AI_TOOL_TYPE, ATTR_HTTP_STATUS_CODE, ATTR_ORGANIZATION_ID, ATTR_SESSION_ID, ATTR_TERMINAL_TYPE, ATTR_USER_EMAIL, EVENT_API_ERROR, EVENT_API_REQUEST, EVENT_ASSISTANT_RESPONSE, EVENT_PERMISSION_MODE_CHANGED, EVENT_TOOL_DECISION, EVENT_TOOL_RESULT, EVENT_USER_PROMPT, GEN_AI_PROVIDER, languageFromPath, METRIC_ACTIVE_TIME, METRIC_CODE_EDIT_DECISION, METRIC_COMMIT_COUNT, METRIC_COST_USAGE, METRIC_LINES_OF_CODE, METRIC_PULL_REQUEST_COUNT, METRIC_SANDBOX_SHELL_RETRY, METRIC_SESSION_COUNT, METRIC_TOKEN_USAGE, PREFIX, SPAN_INTERACTION, SPAN_LLM_REQUEST, SPAN_TOOL, SPAN_TURN, } from "./attrs.js";
 /** Idle cutoff for user active time: gaps longer than this are not "active". */
 export const USER_ACTIVE_IDLE_CUTOFF_MS = 5 * 60 * 1000;
 const EDIT_TOOLS = new Set(["edit", "write", "multi_edit", "notebook_edit"]);
@@ -463,6 +463,12 @@ export class SessionTelemetry {
         this.add(METRIC_LINES_OF_CODE, "1", "Count of lines of code modified", added, { type: "added" });
         this.add(METRIC_LINES_OF_CODE, "1", "Count of lines of code modified", removed, { type: "removed" });
     }
+    /** Transient sandbox shell-resolution failure retried by the wrap seam —
+     * `recovered` (retry healed it) vs `exhausted` (error surfaced to the
+     * model). The post-deploy health signal for the retry feature. */
+    sandboxShellResolutionRetry(outcome) {
+        this.add(METRIC_SANDBOX_SHELL_RETRY, "1", "Sandbox shell-resolution transient failures, by retry outcome", 1, { outcome });
+    }
     /** A successful bash command: count commits and PR creations. */
     bashSucceeded(command) {
         if (typeof command !== "string")

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yagni-app/code-staging",
-  "version": "1.1.0-staging.1334.1",
+  "version": "1.1.0-staging.1335.1",
   "description": "YAGNI Code: a terminal coding agent that already knows your company. One YAGNI login routes the model and grounds the agent in your team's context.",
   "license": "SEE LICENSE IN LICENSE.md",
   "author": "YAGNI, Inc. <jack@yagni.app> (https://yagni.app)",
@@ -58,5 +58,5 @@
     "turndown": "^7.2.4",
     "typebox": "^1.3.15"
   },
-  "yagniSourceSha": "b7b91c0bf94f197fc16643cb9a5c5f580e896001"
+  "yagniSourceSha": "fe89db90856f43da8d645abeb16d448c83bb8e33"
 }