@yagni-app/code-staging 1.1.1-staging.1359.1 → 1.1.1-staging.1361.1

package/dist/extension/index.js

@@ -580,6 +580,64 @@ export async function registerYagni(pi, deps = {}) {
             fields,
         });
     };
+    /**
+     * The prefix-consult failure sink (L2): fire-and-forget POST of one
+     * consult's outcome to the backend intake (log + hit-rate counters + the
+     * `Prefix Consult` Sentry area). A hit/none outcome is NOT a failure —
+     * its counter rides the same POST so the dashboard has both sides.
+     * Outcomes are a closed vocabulary, never command content. Fail-soft
+     * (the failure itself is sink-logged with the status or error class —
+     * never the thrown message, which can carry provider payloads);
+     * suppressed under test/eval so a CI run never phones prod.
+     */
+    const makePrefixErrorSink = () => (ev) => {
+        if (evalMode || runningUnderTest(env))
+            return;
+        void (async () => {
+            try {
+                const body = {
+                    outcome: ev.outcome,
+                    ...(ev.rawOutput ? { rawOutput: ev.rawOutput } : {}),
+                    ...(ev.durationMs !== undefined ? { durationMs: ev.durationMs } : {}),
+                    ...(ev.tier ? { tier: ev.tier } : {}),
+                };
+                const res = await resilientFetch(`${baseUrl}/api/yagni-code/prefix-error`, {
+                    method: "POST",
+                    headers: {
+                        "content-type": "application/json",
+                        authorization: `Bearer ${getTokenFn() ?? ""}`,
+                        ...attributionHeaders(deps.env),
+                    },
+                    body: JSON.stringify(body),
+                }, {
+                    fetchImpl: authedFetch,
+                    policy: { maxAttempts: 1, backoffBaseMs: 0, backoffMaxMs: 0, timeoutMs: GUARDIAN_EVENT_TIMEOUT_MS, jitterRatio: 0 },
+                });
+                if (!res.ok) {
+                    logEvent({
+                        source: "prefix",
+                        level: "warn",
+                        event: "prefix_error_post_failed",
+                        sessionId: env.YAGNI_SESSION_ID ?? undefined,
+                        fields: { status: res.status, outcome: ev.outcome },
+                    });
+                }
+            }
+            catch (err) {
+                logEvent({
+                    source: "prefix",
+                    level: "warn",
+                    event: "prefix_error_post_failed",
+                    sessionId: env.YAGNI_SESSION_ID ?? undefined,
+                    fields: {
+                        kind: "network",
+                        outcome: ev.outcome,
+                        errorClass: err instanceof Error ? err.constructor.name : typeof err,
+                    },
+                });
+            }
+        })();
+    };
     // YAG-510: persisted "don't ask again" grants, per-repo keyed. Loaded once
     // at startup (grants added by other concurrent sessions appear next launch —
     // the startup load is the trust boundary; live reload was reviewed and
@@ -700,6 +758,20 @@ export async function registerYagni(pi, deps = {}) {
             : {}),
         guardianDisabled,
         childUsage,
+        // L2 prefix consult: enabled for interactive sessions with a live model
+        // backend (headless /go children and eval lanes never render the dialogs
+        // whose seeds it refines — the consult there is pure spend). The sink
+        // line + the failure POST live in onPrefixConsult below.
+        // YAGNI_DISABLE_PREFIX_CONSULT=1 is the runtime kill switch — a consult
+        // regression (cost spike, latency, bad seeds) disables the layer with no
+        // redeploy. Registration-scoped (read once here, like every other env
+        // gate at activation): toggling it mid-session does nothing until the
+        // session restarts. When set, the gate seeds from the L1 ladder only,
+        // byte-identical to the pre-consult behavior.
+        ...(evalMode || env.YAGNI_DISABLE_PREFIX_CONSULT === "1" || env.YAGNI_DISABLE_PREFIX_CONSULT === "true"
+            ? {}
+            : { prefixConsult: {} }),
+        onPrefixConsult: makePrefixErrorSink(),
         guardianReview: (command, deps) => reviewCommand(command, { ...deps, modelTier: guardianTier }),
         onGuardianReview: (ev) => {
             guardianLogSink(ev);

package/dist/extension/permission/approvedPrefixes.d.ts

@@ -51,7 +51,15 @@ export interface ApprovedPrefixFile {
     version: 1;
     grants: ApprovedPrefixGrant[];
 }
-/** Tools whose second token is a subcommand worth capturing in a prefix. */
+/**
+ * Tools whose second token is a subcommand worth capturing in a prefix.
+ * Kept ONLY as a fast-path marker (the flag-first fallback `pnpm --filter X
+ * test` → ["pnpm"]); the two-token rung itself is GENERIC — any clean command
+ * word + subcommand-shaped second token derives [tool, subcommand]
+ * (Claude's getCommandPrefix shape, not gated on a tool list), so
+ * `linear issue view` earns ["linear","issue"] without this repo ever
+ * having heard of `linear`.
+ */
 export declare const MULTI_SUBCOMMAND_TOOLS: Set<string>;
 /**
  * Prefixes that must never be grantable (Claude Code's BARE_SHELL_PREFIXES
@@ -173,6 +181,25 @@ export declare function validateGrantForEscape(command: string, policy: ExecPoli
     seeds: ApprovedPrefixGrant[];
     description: string;
 } | null;
+/**
+ * The GUARDIAN-ASK seed ladder (the ask-flow counterpart of
+ * {@link validateGrantForEscape}). One deliberate difference from the escape
+ * flow, a Claude mirror: READ-ONLY segments of a compound are skipped — a
+ * `cd src && npm test` ask suggests only `npm test`, because the cd/exec-allow
+ * segments are not the thing the user is being asked about (Claude's
+ * sandboxed-permission ask does the same). The escape flow keeps its
+ * stricter all-segments stance: the unit of consent THERE is running with
+ * full unsandboxed authority, so even read-only segments ride the consent.
+ *
+ * Same five rungs as the escape ladder otherwise (token patterns per
+ * uncovered segment → heredoc prefix → first line → full literal), all
+ * self-match-proved — a seed that cannot cover its own command is never
+ * offered.
+ */
+export declare function validateGrantForAsk(command: string, policy: ExecPolicy, repoKey: string): {
+    seeds: ApprovedPrefixGrant[];
+    description: string;
+} | null;
 /**
  * Compound evaluation for the escape flow (Claude's subcommandResults
  * analog): every segment must be covered — by a grant, by exec-policy

package/dist/extension/permission/approvedPrefixes.js

@@ -32,7 +32,15 @@ import { classifyCommand, isSafeRedirect, shellParse, tokenize } from "./execPol
 import { SAFE_ENV_VARS } from "../permissionRules/shellRules.js";
 import { codeStateHome } from "../stateHome.js";
 // --- Derivation ---
-/** Tools whose second token is a subcommand worth capturing in a prefix. */
+/**
+ * Tools whose second token is a subcommand worth capturing in a prefix.
+ * Kept ONLY as a fast-path marker (the flag-first fallback `pnpm --filter X
+ * test` → ["pnpm"]); the two-token rung itself is GENERIC — any clean command
+ * word + subcommand-shaped second token derives [tool, subcommand]
+ * (Claude's getCommandPrefix shape, not gated on a tool list), so
+ * `linear issue view` earns ["linear","issue"] without this repo ever
+ * having heard of `linear`.
+ */
 export const MULTI_SUBCOMMAND_TOOLS = new Set([
     "git", "gh", "npm", "pnpm", "yarn", "docker", "kubectl", "fly", "cargo", "go",
 ]);
@@ -163,21 +171,24 @@ export function derivePrefix(command) {
         return null;
     if (BANNED_PREFIXES.has(first))
         return null;
-    if (MULTI_SUBCOMMAND_TOOLS.has(first)) {
-        const second = tokens[1];
-        if (second && !second.startsWith("-") && SAFE_SUBCOMMAND_RE.test(second)) {
-            return [first, second];
-        }
-        // flag-first multi-tool shape (`pnpm --filter X test`): Claude's
-        // first-word fallback applies — the editable field is the narrowing
-        // control, and a bare multi-tool grant is exactly what a human edits
-        // down from there.
-        return [first];
-    }
-    // first-word shape check (Claude's regex): rejects paths, flags, numbers,
-    // filenames; only clean lowercase command words.
-    if (!/^[a-z][a-z0-9]*(-[a-z0-9]+)*$/.test(first))
+    // GENERIC two-token rung (Claude parity): a known multi-subcommand tool
+    // short-circuits the word-shape check (its first tokens are known clean),
+    // but ANY first token passing the command-word regex earns the
+    // [tool, subcommand] pattern when the second token is subcommand-shaped —
+    // `linear issue view` → ["linear","issue"] from a tool list that does
+    // not contain `linear`.
+    const isCleanWord = MULTI_SUBCOMMAND_TOOLS.has(first)
+        || /^[a-z][a-z0-9]*(-[a-z0-9]+)*$/.test(first);
+    if (!isCleanWord)
         return null;
+    const second = tokens[1];
+    if (second && !second.startsWith("-") && SAFE_SUBCOMMAND_RE.test(second)) {
+        return [first, second];
+    }
+    // flag-first shape (`pnpm --filter X test`, `linear --json issue view`):
+    // Claude's first-word fallback applies — the editable field is the
+    // narrowing control, and a bare tool grant is exactly what a human
+    // edits down from there.
     return [first];
 }
 /**
@@ -196,7 +207,11 @@ export function storagePrefix(command) {
     const slash = rawFirst.lastIndexOf("/");
     const first = slash >= 0 ? rawFirst.slice(slash + 1) : rawFirst;
     const second = tokens[1];
-    if (MULTI_SUBCOMMAND_TOOLS.has(first) && second && SAFE_SUBCOMMAND_RE.test(second) && !second.startsWith("-")) {
+    // LOCKSTEP with derivePrefix's generic two-token rung: any clean command
+    // word + subcommand-shaped second token labels as "tool subcommand".
+    const cleanWord = MULTI_SUBCOMMAND_TOOLS.has(first)
+        || /^[a-z][a-z0-9]*(-[a-z0-9]+)*$/.test(first);
+    if (cleanWord && second && SAFE_SUBCOMMAND_RE.test(second) && !second.startsWith("-")) {
         return `${first} ${second}`;
     }
     return first;
@@ -595,6 +610,60 @@ export function validateGrantForEscape(command, policy, repoKey) {
     // offered (null = no remember option at all).
     return deriveRememberSeeds(command, [command]);
 }
+/**
+ * The GUARDIAN-ASK seed ladder (the ask-flow counterpart of
+ * {@link validateGrantForEscape}). One deliberate difference from the escape
+ * flow, a Claude mirror: READ-ONLY segments of a compound are skipped — a
+ * `cd src && npm test` ask suggests only `npm test`, because the cd/exec-allow
+ * segments are not the thing the user is being asked about (Claude's
+ * sandboxed-permission ask does the same). The escape flow keeps its
+ * stricter all-segments stance: the unit of consent THERE is running with
+ * full unsandboxed authority, so even read-only segments ride the consent.
+ *
+ * Same five rungs as the escape ladder otherwise (token patterns per
+ * uncovered segment → heredoc prefix → first line → full literal), all
+ * self-match-proved — a seed that cannot cover its own command is never
+ * offered.
+ */
+export function validateGrantForAsk(command, policy, repoKey) {
+    // Same defense-in-depth refusal as the escape ladder.
+    try {
+        if (classifyCommand(command, policy).decision === "forbidden")
+            return null;
+    }
+    catch {
+        return null;
+    }
+    // Compound: seed every segment that is neither covered by a grant,
+    // read-only (exec-policy allow — the Claude mirror skip), nor an env
+    // assignment no-op. `forbidden` was refused above; classify-error
+    // segments count as uncovered (fail closed at the seed level too).
+    const compound = evaluateCompoundForEscape(command, [], repoKey, policy);
+    const mutating = [];
+    for (const verdict of compound.segments) {
+        if (verdict.kind === "uncovered" || verdict.kind === "classify-error") {
+            mutating.push(verdict.segment);
+        }
+    }
+    if (mutating.length > 0) {
+        const res = deriveRememberSeeds(command, mutating, repoKey);
+        if (res && res.seeds.length > 0)
+            return res;
+        return null;
+    }
+    // A compound whose every segment is covered/readonly/assignment, or a
+    // single command: the single-command rungs (token → literal ladder).
+    if (isSinglePlainCommand(command)) {
+        const pattern = derivePrefix(command);
+        if (pattern) {
+            const candidate = { pattern, repoKey, addedAt: new Date().toISOString(), cwd: "" };
+            if (matchesGrant(command, [candidate], repoKey)) {
+                return { seeds: [candidate], description: describePrefix(pattern) };
+            }
+        }
+    }
+    return deriveRememberSeeds(command, [command]);
+}
 /**
  * Quote-preserving segment splitter for the ESCAPE flow (a local, faithful
  * counterpart to shellRules' splitSubcommands — which rejoins tokens with
@@ -725,8 +794,14 @@ export function isDerivablePattern(pattern) {
     if (BANNED_PREFIXES.has(first))
         return false;
     if (pattern.length === 2) {
+        // LOCKSTEP with derivePrefix's generic two-token rung: the first token
+        // only needs the command-word shape (the MULTI_SUBCOMMAND_TOOLS
+        // membership check was dropped when the rung went generic). Keeping the
+        // old set-membership check here would silently drop every
+        // generic-rung grant (["linear","issue"]) as "tampered" at next
+        // startup — the user's approval would evaporate.
         const second = pattern[1];
-        if (!MULTI_SUBCOMMAND_TOOLS.has(first))
+        if (!/^[a-z][a-z0-9]*(-[a-z0-9]+)*$/.test(first) && !MULTI_SUBCOMMAND_TOOLS.has(first))
             return false;
         if (second.startsWith("-") || !SAFE_SUBCOMMAND_RE.test(second))
             return false;

package/dist/extension/permission/gate.d.ts

@@ -28,6 +28,7 @@
  */
 import type { ExtensionAPI, ExtensionContext, ToolCallEvent, ToolCallEventResult } from "@earendil-works/pi-coding-agent";
 import { type ApprovedPrefixGrant } from "./approvedPrefixes.js";
+import { type PrefixDiagnosticEvent } from "./prefixExtract.js";
 import type { HookRunner } from "../hooks.js";
 import { type BlessStore } from "../bless.js";
 import { type ExecPolicy } from "./execPolicy.js";
@@ -304,6 +305,35 @@ export interface RegisterPermissionDeps {
      * and PermissionRequest hooks run before the confirm dialog.
      */
     hookRunner?: HookRunner;
+    /**
+     * LLM prefix-consult configuration (layer 2 of the prefix-suggestion
+     * stack). When present AND the session has a UI, an ask dialog whose L1
+     * ladder could not derive a usable token seed fires one efficient-tier
+     * consult per uncovered segment (Claude's getCommandSubcommandPrefix
+     * shape) and folds validated candidates into the remember options after
+     * a bounded grace window. Absent = disabled: dialogs seed from L1 only,
+     * byte-identical to the pre-consult behavior.
+     */
+    prefixConsult?: {
+        tier?: string;
+    };
+    /**
+     * Injectable consult function (tests pass a stub; the default is
+     * consultPrefixMemoized — the wiring layer keeps ONE memo per session).
+     * Mirrors the guardianReview seam.
+     */
+    prefixConsultFn?: (segment: string, deps: import("./prefixExtract.js").PrefixConsultDeps & {
+        onEvent?: (ev: PrefixDiagnosticEvent) => void;
+    }) => Promise<import("./prefixExtract.js").PrefixConsultResult & {
+        outcome: PrefixDiagnosticEvent["outcome"];
+    }>;
+    /**
+     * Called (fire-and-forget) after each prefix consult with a sanitized
+     * diagnostic event (the wiring layer posts client-only failures to the
+     * backend's prefix-error intake and bumps counters). Fail-soft; never
+     * blocks the gate.
+     */
+    onPrefixConsult?: (event: PrefixDiagnosticEvent) => void;
 }
 /** The customType tag on injected mode-context messages (filterable later). */
 export declare const MODE_CONTEXT_TYPE = "yagni-mode-context";

package/dist/extension/permission/gate.js

@@ -26,7 +26,8 @@
  * When the mode leaves plan, stale plan-context messages are filtered out of
  * the context so the model doesn't keep believing it is restricted.
  */
-import { derivePrefix, describePrefix, evaluateCompoundForEscape, matchesGrant, storagePrefix, validateGrant, validateGrantForEscape, } from "./approvedPrefixes.js";
+import { derivePrefix, describePrefix, evaluateCompoundForEscape, matchesGrant, storagePrefix, validateGrantForAsk, validateGrantForEscape, } from "./approvedPrefixes.js";
+import { consultPrefixMemoized, createPrefixMemo, PREFIX_CONSULT_GRACE_MS, } from "./prefixExtract.js";
 import { logEvent } from "../errorSink.js";
 import { makeBlessStore as defaultMakeBlessStore } from "../bless.js";
 import { classifyCommand, DEFAULT_EXEC_POLICY } from "./execPolicy.js";
@@ -480,6 +481,112 @@ export function registerPermissionGate(pi, deps = {}) {
                 approvedCommands.delete(oldest);
         }
     };
+    // L2 prefix-consult memo: one LRU per session (keyed by segment string —
+    // cwd-independent by design; a `pnpm test` prefix is the same answer in
+    // any directory, and repo scoping happens at GRANT time, not consult time).
+    const prefixMemo = createPrefixMemo();
+    const runPrefixConsult = deps.prefixConsultFn ?? consultPrefixMemoized;
+    /** Shared consult-call builder: routes through the injectable seam with
+     * the sink line + the onPrefixConsult hook — ONE place so the escape and
+     * Guardian-ask fan-outs cannot drift. */
+    const consultSegment = (seg, cwd, signal, tier) => runPrefixConsult(seg, {
+        cwd,
+        signal,
+        memo: prefixMemo,
+        ...(tier ? { modelTier: tier } : {}),
+        onEvent: (ev) => {
+            try {
+                logEvent({
+                    source: "prefix",
+                    level: "info",
+                    event: "prefix_consult",
+                    fields: { outcome: ev.outcome, ...(ev.durationMs !== undefined ? { durationMs: ev.durationMs } : {}) },
+                });
+            }
+            catch { /* telemetry must never affect the gate */ }
+            try {
+                deps.onPrefixConsult?.(ev);
+            }
+            catch { /* fail-soft */ }
+        },
+    });
+    /** The uncovered MUTATING segments of a compound for the ask-flow consult
+     * fan-out — the same set validateGrantForAsk seeds, extracted so the
+     * consult does not re-derive them (one source of truth for the skip rule). */
+    const segmentsUncoveredForAsk = (command, policy) => {
+        const verdicts = evaluateCompoundForEscape(command, [], "", policy).segments;
+        return verdicts
+            .filter((v) => v.kind === "uncovered" || v.kind === "classify-error")
+            .map((v) => v.segment);
+    };
+    /**
+     * The SHARED L2 fold — ONE implementation for the escape and Guardian-ask
+     * fan-outs (extracted so the two cannot drift). Fans out over the raw
+     * uncovered segments (raw, not canonicalized: Claude consults the command
+     * as typed, the persona's spec covers env-prefixed shapes, and the memo
+     * key matches what a retry re-sends), skips segments an L1 TOKEN seed
+     * already covers, folds validated candidates into the seeds bounded by
+     * the grace window, and keeps the L1 LITERAL seed as a fallback whenever
+     * any consulted segment produced NO candidate — a partial fold that
+     * dropped the literal would cover fewer segments than the ladder did, and
+     * picking remember would then re-ask on retry (the fold-regression).
+     * L2 token candidates supersede the literal ONLY when every consulted
+     * segment yielded one; otherwise the literal keeps the coverage floor.
+     */
+    const foldConsultSeeds = async (args) => {
+        const { l1Seeds } = args;
+        if (!deps.prefixConsult)
+            return l1Seeds;
+        const l1TokenPatterns = new Set((l1Seeds?.seeds ?? []).map((s) => s.pattern.join(" ")).filter((p) => p.length > 0));
+        const l1LiteralSeeds = (l1Seeds?.seeds ?? []).filter((s) => s.pattern.length === 0);
+        // RAW segments, deduped, capped at the seed cap.
+        const segments = [...new Set(args.uncoveredSegments.map((s) => s.trim()).filter((s) => s.length > 0))].slice(0, 5);
+        const toConsult = segments.filter((seg) => !(l1TokenPatterns.size > 0 && [...l1TokenPatterns].some((p) => seg.startsWith(p))));
+        if (toConsult.length === 0)
+            return l1Seeds;
+        let answeredSegments = 0;
+        const fold = Promise.allSettled(toConsult.map((seg) => consultSegment(seg, args.cwd, args.signal, args.tier))).then((results) => {
+            // Two INDEPENDENT passes — counting and seed-filtering are different
+            // questions. `answered` counts every yielded candidate (including one
+            // duplicating an L1 token: the consult DID answer that segment), in
+            // its own pass over the results. The second pass de-dupes L1-token
+            // lookalikes from the SEED list only — the duplicate is noise there,
+            // not an unanswered segment. Comparing the de-duped `extra` against
+            // `toConsult` would misread a fully-answered fold as partial whenever
+            // an answer coincided with an L1 token.
+            const answered = results
+                .map((r) => (r.status === "fulfilled" ? r.value.candidate : null))
+                .filter((c) => c !== null);
+            answeredSegments = answered.length;
+            return answered
+                .filter((c) => !l1TokenPatterns.has(c.pattern.join(" ")))
+                .map((c) => ({ pattern: c.pattern, repoKey: "", addedAt: "", cwd: "" }));
+        }, () => []);
+        const extra = await Promise.race([
+            fold,
+            new Promise((resolve) => {
+                const t = setTimeout(() => resolve([]), PREFIX_CONSULT_GRACE_MS);
+                t.unref?.();
+            }),
+        ]);
+        if (extra.length === 0)
+            return l1Seeds;
+        // Did every consulted segment yield a candidate? Only then do the L2
+        // tokens supersede the literal; a partial fold keeps the literal as the
+        // coverage floor (token + literal, deduped, capped at 5).
+        const complete = answeredSegments >= toConsult.length;
+        const combined = [
+            ...(l1Seeds?.seeds ?? []).filter((s) => s.pattern.length > 0),
+            ...extra,
+            ...(complete ? [] : l1LiteralSeeds),
+        ].slice(0, 5);
+        return {
+            seeds: combined,
+            description: combined
+                .map((s) => (s.pattern.length > 0 ? describePrefix(s.pattern) : (s.literal ?? "")))
+                .join(", "),
+        };
+    };
     // Per-USER-PROMPT bounds (reset in before_agent_start, which fires once per
     // user prompt — NOT per LLM turn): genuine ask verdicts are uncapped (the
     // user's patience is the bound); error-fallback asks are capped so
@@ -1095,20 +1202,45 @@ export function registerPermissionGate(pi, deps = {}) {
                             }
                         }
                         // Offer "don't ask again" only when the grant would actually
-                        // cover this command (grant-time validation). adds a
-                        // third option: persist a user-level permission rule (survives
-                        // across repos, unlike the repo-scoped grant) — offered only when
-                        // a grantCandidate also exists (the same prefix discipline; the
-                        // rule is the same pattern in settings form).
-                        const grantCandidate = validateGrant(command, effectivePolicy.execPolicy ?? DEFAULT_EXEC_POLICY, resolveRepoKeyFor(cwd));
-                        const ruleCandidate = grantCandidate
+                        // cover this command (grant-time validation). The ask-flow ladder
+                        // (validateGrantForAsk — the escape flow's shape, with the
+                        // read-only segment skip Claude's ask does) provides the L1
+                        // seeds: token patterns per uncovered mutating segment → literal
+                        // rungs. The L2 prefix consult folds validated candidates in over
+                        // the same grace window as the escape flow (auto-mode only — ask
+                        // grants are auto-mode-only, so a consult in review/plan mode
+                        // buys seeds that can never be used).
+                        const askSeeds = validateGrantForAsk(command, effectivePolicy.execPolicy ?? DEFAULT_EXEC_POLICY, resolveRepoKeyFor(cwd));
+                        // L2 prefix consult (auto mode only — the seeds it refines are
+                        // auto-mode grants): the SHARED fold, over the ask-ladder's
+                        // uncovered mutating segments; failures are invisible (the
+                        // dialog opens with L1 seeds).
+                        const seedsForAsk = modeAtEntry === "auto"
+                            ? await foldConsultSeeds({
+                                l1Seeds: askSeeds,
+                                uncoveredSegments: askSeeds === null ? [] : segmentsUncoveredForAsk(command, effectivePolicy.execPolicy ?? DEFAULT_EXEC_POLICY),
+                                cwd,
+                                signal: ctx.signal,
+                                tier: deps.prefixConsult?.tier,
+                            })
+                            : askSeeds;
+                        // The settings-rule option rides TOKEN seeds ONLY: a literal
+                        // seed persisted as `Bash(<literal>:*)` is a prefix rule with no
+                        // inert-remainder fence (the grant-side literal rung HAS the
+                        // fence — approvedPrefixes) — anything starting with that
+                        // literal would be allowed in settings. Literal seeds keep the
+                        // grant path (repo-scoped, fenced).
+                        const grantCandidate = seedsForAsk && seedsForAsk.seeds.length === 1
+                            ? { pattern: seedsForAsk.seeds[0].pattern, literal: seedsForAsk.seeds[0].literal }
+                            : null;
+                        const ruleCandidate = grantCandidate && grantCandidate.pattern.length > 0
                             ? `Bash(${grantCandidate.pattern.join(" ")}:*)`
                             : null;
-                        const rememberLabel = grantCandidate
-                            ? `Yes, and don't ask again for \`${describePrefix(grantCandidate.pattern)}\` in this repo`
+                        const rememberLabel = seedsForAsk
+                            ? `Yes, and don't ask again for \`${seedsForAsk.description}\` in this repo`
                             : null;
-                        const ruleLabel = grantCandidate && deps.persistUserRule
-                            ? `Yes, and always allow \`${grantCandidate.pattern.join(" ")}\` in this project's local settings`
+                        const ruleLabel = ruleCandidate && deps.persistUserRule
+                            ? `Yes, and always allow \`${ruleCandidate.replace(/^Bash\(/, "").replace(/:\*\)$/, "")}\` in this project's local settings`
                             : null;
                         const resolution = await askUserWithOptions(ctx, buildAskTitle(command, verdict.rationale, verdict.riskLevel), rememberLabel, ruleLabel, "guardian_verdict", "bash");
                         if (resolution === "yes") {
@@ -1167,14 +1299,17 @@ export function registerPermissionGate(pi, deps = {}) {
                             });
                             return {};
                         }
-                        if (resolution === "remember" && grantCandidate) {
-                            const grantRecord = {
-                                ...grantCandidate,
-                                cwd,
-                                addedAt: new Date().toISOString(),
-                            };
-                            grants.push(grantRecord);
-                            persistGrantFailSoft(grantRecord);
+                        if (resolution === "remember" && seedsForAsk) {
+                            for (const seed of seedsForAsk.seeds) {
+                                const grantRecord = {
+                                    ...seed,
+                                    repoKey: resolveRepoKeyFor(cwd),
+                                    cwd,
+                                    addedAt: new Date().toISOString(),
+                                };
+                                grants.push(grantRecord);
+                                persistGrantFailSoft(grantRecord);
+                            }
                             emitGateEvent(slot, {
                                 ...eventBase,
                                 outcome: "ask_approved_remembered",
@@ -1497,9 +1632,28 @@ export function registerPermissionGate(pi, deps = {}) {
             }
         }
         // The remember seeds + dialog options. validateGrantForEscape owns the
-        // full ladder (token patterns → heredoc prefix → first line → full
-        // literal) with the fencing/forbidden proofs.
-        const seeds = validateGrantForEscape(command, execPolicy, repoKey);
+        // full L1 ladder (token patterns → heredoc prefix → first line → full
+        // literal) with the fencing/forbidden proofs. The L2 prefix consult
+        // (layer 2) fans out over the command's uncovered segments in parallel
+        // (Claude's getCommandSubcommandPrefix shape: full command + one consult
+        // per segment, Promise.all): a segment the L1 token rung already covers
+        // needs no consult (its seed is already as good as L2 can get); the
+        // consults keep running past the grace window — whatever lands late
+        // memoizes and serves a retry instantly, and the dialog opens after at
+        // most PREFIX_CONSULT_GRACE_MS with the best seeds available at open
+        // time. Consult failure is invisible: the dialog opens with L1 seeds.
+        const l1Seeds = validateGrantForEscape(command, execPolicy, repoKey);
+        // The shared L2 fold (see foldConsultSeeds): consult fan-out over the
+        // uncovered segments, grace-bounded, literal-fallback preserved. Runs
+        // only with a UI (the headless gate returned above), and consult failure
+        // is invisible — the dialog opens with the L1 seeds.
+        const seeds = await foldConsultSeeds({
+            l1Seeds,
+            uncoveredSegments: compound.uncovered,
+            cwd,
+            signal: ctx.signal,
+            tier: deps.prefixConsult?.tier,
+        });
         const ASK_YES_ESC = "Yes, run it";
         const ASK_NO_ESC = "No";
         const rememberLabel = seeds

package/dist/extension/permission/prefixExtract.d.ts

@@ -0,0 +1,171 @@
+/**
+ * Prefix consult — LLM extraction of "don't ask again" prefix suggestions
+ * (Claude Code's createCommandPrefixExtractor, ported to our consult
+ * infrastructure). The second layer of the prefix-suggestion stack:
+ *
+ *   Layer 1 — syntactic prefix ladder (approvedPrefixes.ts, pure, always first)
+ *   Layer 2 — THIS module (LLM extraction, memoized, validated, optional)
+ *   Layer 3 — the dialog (gate.ts; seeded from L1, refined by L2)
+ *
+ * Same pure/IO split as guardian.ts: the parser and the validation ladder are
+ * pure and exhaustively testable; the consult spawns a locked-down child pi
+ * on the efficient tier with no tools (the prefix persona answers from the
+ * command text alone).
+ *
+ * The LLM proposes, pure code disposes: every candidate must pass ALL of —
+ *   1. the first-line parser (prose/degenerate tokens → no candidate)
+ *   2. command_injection_detected → no candidate
+ *   3. the banned-shape check (BANNED_PREFIXES)
+ *   4. the word-shape check (clean command words, subcommand-shaped seconds)
+ *   5. the self-coverage proof (a seed that cannot cover THIS command via
+ *      matchesGrant is dropped — a `git push` seed for `git push origin
+ *      +main:main` never reaches the dialog)
+ * …and nothing saves until the user picks the option. The LLM's blast radius
+ * is capped at "wasted a suggestion".
+ */
+import { runStage as defaultRunStage } from "../pipeline/runner.js";
+import type { PipelineStage } from "../pipeline/types.js";
+export type PrefixConsultError = "timeout" | "malformed" | "network" | "empty" | "aborted";
+/** A validated suggestion: token pattern + the label the dialog shows. */
+export interface PrefixCandidate {
+    pattern: string[];
+    description: string;
+}
+export interface PrefixConsultResult {
+    candidate: PrefixCandidate | null;
+    error?: PrefixConsultError;
+    cost: number;
+    /** True when the model answered command_injection_detected (the candidate
+     * is null but the outcome class is injection, not a plain decline). */
+    injection?: boolean;
+    /**
+     * Scrubbed + capped copy of the unparseable model output (malformed shape),
+     * so the sink and Sentry can see the exact failure. Never the raw command.
+     */
+    rawOutput?: string;
+    /** Error CLASS only (constructor name) when the consult threw — never the
+     * thrown message (it can carry command content or provider payloads). */
+    errorClass?: string;
+}
+/** Cap on the malformed-output capture (same size discipline as the Guardian). */
+export declare const PREFIX_RAW_OUTPUT_CAP = 1024;
+/** The model tier the prefix consult runs on (Haiku-equivalent, like the Guardian). */
+export declare const PREFIX_MODEL_TIER = "efficient";
+/**
+ * Grace window for the dialog open: the consult fires at interception and the
+ * dialog opens after at most this delay with whatever seeds have landed (p50
+ * ~1s measured on prod; the window trades a bounded open delay for a much
+ * better remember label). Fails open instantly on any consult error.
+ */
+export declare const PREFIX_CONSULT_GRACE_MS = 1500;
+/** Consult deadline (the consult keeps running past the grace window — its
+ * result memoizes and serves any retry of the same segment). */
+export declare const PREFIX_CONSULT_TIMEOUT_MS = 15000;
+/**
+ * First-line parser: the first non-empty line of the model's output, with
+ * quotes, bullets, and markdown fences stripped, then SHAPE-CHECKED — the
+ * answer must look like 1-2 command words (the persona's contract). Prose
+ * sentences, degenerate tokens (`<|open|>`), and glue symbols parse to
+ * null: unparseable → no suggestion, nothing downstream sees it.
+ */
+export declare function parsePrefixAnswer(raw: string): string | null;
+/**
+ * Validate a parsed answer against a command. Returns a candidate the dialog
+ * may offer, or null (which is NOT an error — `none` and rejection-by-ladder
+ * are expected outcomes). `injectionDetected` is surfaced separately from
+ * null because the counters distinguish it.
+ */
+export declare function validatePrefixAnswer(answer: string, command: string): {
+    kind: "candidate";
+    candidate: PrefixCandidate;
+} | {
+    kind: "injection";
+} | {
+    kind: "reject";
+};
+/** A settled memo entry: successes AND settled rejections (both are stable
+ * answers — `none` must not re-consult forever, and a malformed answer is a
+ * stable property of the model+segment pair). The terminal OUTCOME CLASS is
+ * stored verbatim and replayed — a malformed answer must keep counting as
+ * `unparseable` on every memoized retry, not silently become `none`
+ * (the hit-rate dashboard undercounts the exact segments the parser chokes
+ * on otherwise). */
+export interface PrefixMemoEntry {
+    candidate: PrefixCandidate | null;
+    injection: boolean;
+    /** The terminal outcome the consult settled to (hit/none/injection_rejected/
+     * unparseable) — replayed as-is on memoized hits. */
+    outcome: Exclude<PrefixDiagnosticEvent["outcome"], PrefixConsultError>;
+}
+/** The memo's stored value: either a settled entry or a shared in-flight promise. */
+export type PrefixMemoValue = PrefixMemoEntry | Promise<PrefixConsultResult & {
+    outcome: PrefixDiagnosticEvent["outcome"];
+}>;
+/**
+ * LRU memo (Claude's memoizeWithLRU shape, reject-evict): caches SETTLED
+ * consults keyed by the command segment string. In-flight promises are
+ * shared (the same key consults once, however many askers race); a
+ * thrown/rejected promise is evicted so a transient outage never poisons
+ * the key.
+ */
+export declare function createPrefixMemo(capacity?: number): {
+    get(key: string): PrefixMemoValue | undefined;
+    set(key: string, entry: PrefixMemoValue): void;
+    delete(key: string): void;
+    size(): number;
+};
+export interface PrefixConsultDeps {
+    runStage?: typeof defaultRunStage;
+    cwd: string;
+    signal?: AbortSignal;
+    modelTier?: string;
+    timeoutMs?: number;
+    memo?: ReturnType<typeof createPrefixMemo>;
+}
+/**
+ * The synthetic stage a prefix consult runs as. Borrows the `plan` StageId
+ * (same pattern as the guardian) so it doesn't ripple into feed/reducers.
+ * The `prefix` agent selects the persona; no tools — the persona answers
+ * from the command text alone.
+ */
+export declare function prefixStage(modelTier?: string): PipelineStage;
+/** Sanitized per-consult diagnostic event for the sink (never the raw command). */
+export interface PrefixDiagnosticEvent {
+    event: "prefix_consult";
+    outcome: "hit" | "none" | "injection_rejected" | "invalid" | "unparseable" | PrefixConsultError;
+    durationMs?: number;
+    tier?: string;
+    /** Debug-only: segment hash for correlation (never the segment text). */
+    segmentHash?: string;
+    /** Scrubbed + capped copy of the unparseable model output (malformed shape). */
+    rawOutput?: string;
+    /** Error CLASS only (constructor name) when the consult threw — never the
+     * thrown message (it can carry command content or provider payloads). */
+    errorClass?: string;
+}
+export declare function buildPrefixDiagnosticEvent(outcome: PrefixDiagnosticEvent["outcome"], opts: {
+    durationMs?: number;
+    tier?: string;
+    segmentHash?: string;
+    rawOutput?: string;
+    errorClass?: string;
+    debug?: boolean;
+}): PrefixDiagnosticEvent;
+/**
+ * Run ONE prefix consult on a single command segment. Pure on top of an
+ * injectable runStage; the caller (the gate) fans out per-segment and races
+ * the grace window. Memoized by the caller's memo (keyed by segment string).
+ */
+export declare function consultPrefix(segment: string, deps: PrefixConsultDeps): Promise<PrefixConsultResult>;
+/**
+ * Memoized consult for one segment: consults at most once per settled key,
+ * shares in-flight promises across concurrent askers, evicts rejections so a
+ * transient outage never poisons the key, and retries once on the empty
+ * (502-shape) error — the backend's own error body invites a retry.
+ */
+export declare function consultPrefixMemoized(segment: string, deps: PrefixConsultDeps & {
+    onEvent?: (ev: PrefixDiagnosticEvent) => void;
+}): Promise<PrefixConsultResult & {
+    outcome: PrefixDiagnosticEvent["outcome"];
+}>;
+//# sourceMappingURL=prefixExtract.d.ts.map

package/dist/extension/permission/prefixExtract.js

@@ -0,0 +1,342 @@
+/**
+ * Prefix consult — LLM extraction of "don't ask again" prefix suggestions
+ * (Claude Code's createCommandPrefixExtractor, ported to our consult
+ * infrastructure). The second layer of the prefix-suggestion stack:
+ *
+ *   Layer 1 — syntactic prefix ladder (approvedPrefixes.ts, pure, always first)
+ *   Layer 2 — THIS module (LLM extraction, memoized, validated, optional)
+ *   Layer 3 — the dialog (gate.ts; seeded from L1, refined by L2)
+ *
+ * Same pure/IO split as guardian.ts: the parser and the validation ladder are
+ * pure and exhaustively testable; the consult spawns a locked-down child pi
+ * on the efficient tier with no tools (the prefix persona answers from the
+ * command text alone).
+ *
+ * The LLM proposes, pure code disposes: every candidate must pass ALL of —
+ *   1. the first-line parser (prose/degenerate tokens → no candidate)
+ *   2. command_injection_detected → no candidate
+ *   3. the banned-shape check (BANNED_PREFIXES)
+ *   4. the word-shape check (clean command words, subcommand-shaped seconds)
+ *   5. the self-coverage proof (a seed that cannot cover THIS command via
+ *      matchesGrant is dropped — a `git push` seed for `git push origin
+ *      +main:main` never reaches the dialog)
+ * …and nothing saves until the user picks the option. The LLM's blast radius
+ * is capped at "wasted a suggestion".
+ */
+import { runStage as defaultRunStage } from "../pipeline/runner.js";
+import { scrubSecrets } from "../pipeline/scrubSecrets.js";
+import { BANNED_PREFIXES, canonicalizeForGrants, matchesGrant, } from "./approvedPrefixes.js";
+/** Cap on the malformed-output capture (same size discipline as the Guardian). */
+export const PREFIX_RAW_OUTPUT_CAP = 1024;
+/** The model tier the prefix consult runs on (Haiku-equivalent, like the Guardian). */
+export const PREFIX_MODEL_TIER = "efficient";
+/**
+ * Grace window for the dialog open: the consult fires at interception and the
+ * dialog opens after at most this delay with whatever seeds have landed (p50
+ * ~1s measured on prod; the window trades a bounded open delay for a much
+ * better remember label). Fails open instantly on any consult error.
+ */
+export const PREFIX_CONSULT_GRACE_MS = 1_500;
+/** Consult deadline (the consult keeps running past the grace window — its
+ * result memoizes and serves any retry of the same segment). */
+export const PREFIX_CONSULT_TIMEOUT_MS = 15_000;
+// --- Pure half: parsing + validation ---
+const INJECTION_TOKEN = "command_injection_detected";
+const NONE_TOKEN = "none";
+/** The command-word shape derivePrefix requires (Claude's first-word regex). */
+const COMMAND_WORD_RE = /^[a-z][a-z0-9]*(-[a-z0-9]+)*$/;
+/** Second tokens must look like plain subcommand words (no URLs, no secrets). */
+const SAFE_SUBCOMMAND_RE = /^[A-Za-z0-9:_-]+$/;
+/**
+ * First-line parser: the first non-empty line of the model's output, with
+ * quotes, bullets, and markdown fences stripped, then SHAPE-CHECKED — the
+ * answer must look like 1-2 command words (the persona's contract). Prose
+ * sentences, degenerate tokens (`<|open|>`), and glue symbols parse to
+ * null: unparseable → no suggestion, nothing downstream sees it.
+ */
+export function parsePrefixAnswer(raw) {
+    const firstLine = raw
+        .split("\n")
+        .map((l) => l.trim())
+        // skip fence-only lines — the persona contract is one line, but the
+        // efficient tier loves wrapping it in a ``` block whose OPENING fence
+        // would otherwise be the "first line"
+        .find((l) => l.length > 0 && !/^```[a-z]*$/i.test(l));
+    if (!firstLine)
+        return null;
+    let s = firstLine;
+    // strip markdown fences and bullets the efficient tier likes to add. An
+    // inline fully-fenced token (```psql```) loses BOTH fences in one pass; a
+    // fence-opener prefix (```psql) loses the opening fence only (the closing
+    // fence, if any, was a later line the first-line scan never picked).
+    s = s.replace(/^```([a-z]*)\s*/i, "$1").replace(/```$/, "").trim();
+    s = s.replace(/^[-*•]\s*/, "").trim();
+    // strip wrapping quotes
+    s = s.replace(/^["'`]+/, "").replace(/["'`]+$/, "").trim();
+    if (s.length === 0 || s.length > 64)
+        return null;
+    // SHAPE CHECK — the answer must be 1-2 plain command words. Prose (spaces
+    // inside words, punctuation, sentences), degenerate special-token glue,
+    // and anything the word ladder could never consume parse to null here.
+    if (!/^[A-Za-z][A-Za-z0-9:_.-]*( [A-Za-z0-9:_.-]+)?$/.test(s))
+        return null;
+    if (/\s.{20,}/.test(s))
+        return null; // a second "word" 20+ chars is prose, not a subcommand
+    return s.toLowerCase();
+}
+/**
+ * Validate a parsed answer against a command. Returns a candidate the dialog
+ * may offer, or null (which is NOT an error — `none` and rejection-by-ladder
+ * are expected outcomes). `injectionDetected` is surfaced separately from
+ * null because the counters distinguish it.
+ */
+export function validatePrefixAnswer(answer, command) {
+    if (answer === INJECTION_TOKEN)
+        return { kind: "injection" };
+    if (answer === NONE_TOKEN)
+        return { kind: "reject" };
+    const words = answer.split(/\s+/);
+    if (words.length < 1 || words.length > 2)
+        return { kind: "reject" };
+    const [first, second] = words;
+    if (BANNED_PREFIXES.has(first))
+        return { kind: "reject" };
+    if (!COMMAND_WORD_RE.test(first))
+        return { kind: "reject" };
+    if (second !== undefined) {
+        if (second.startsWith("-") || !SAFE_SUBCOMMAND_RE.test(second))
+            return { kind: "reject" };
+    }
+    // The self-coverage proof: a candidate that cannot cover THIS command via
+    // matchesGrant is never offered. The candidate is tokenized-shape already
+    // (≤2 clean words), so the proof runs against the canonical form the
+    // matcher will see at match time.
+    const canonical = canonicalizeForGrants(command);
+    const grant = {
+        pattern: words,
+        repoKey: "",
+        addedAt: "",
+        cwd: "",
+    };
+    if (matchesGrant(canonical, [grant], "") === null)
+        return { kind: "reject" };
+    return {
+        kind: "candidate",
+        candidate: { pattern: words, description: `${words.join(" ")} …` },
+    };
+}
+/**
+ * LRU memo (Claude's memoizeWithLRU shape, reject-evict): caches SETTLED
+ * consults keyed by the command segment string. In-flight promises are
+ * shared (the same key consults once, however many askers race); a
+ * thrown/rejected promise is evicted so a transient outage never poisons
+ * the key.
+ */
+export function createPrefixMemo(capacity = 200) {
+    const map = new Map();
+    const get = (key) => map.get(key);
+    const set = (key, entry) => {
+        map.delete(key);
+        map.set(key, entry);
+        if (map.size > capacity) {
+            const oldest = map.keys().next().value;
+            if (oldest !== undefined)
+                map.delete(oldest);
+        }
+    };
+    const del = (key) => {
+        map.delete(key);
+    };
+    return {
+        get,
+        set,
+        delete: del,
+        size: () => map.size,
+    };
+}
+/**
+ * The synthetic stage a prefix consult runs as. Borrows the `plan` StageId
+ * (same pattern as the guardian) so it doesn't ripple into feed/reducers.
+ * The `prefix` agent selects the persona; no tools — the persona answers
+ * from the command text alone.
+ */
+export function prefixStage(modelTier = PREFIX_MODEL_TIER) {
+    return {
+        id: "plan",
+        agent: "prefix",
+        model: modelTier,
+        tools: [],
+        taskTemplate: "{ticket}",
+    };
+}
+export function buildPrefixDiagnosticEvent(outcome, opts) {
+    const ev = {
+        event: "prefix_consult",
+        outcome,
+        ...(opts.durationMs !== undefined ? { durationMs: opts.durationMs } : {}),
+        ...(opts.tier !== undefined ? { tier: opts.tier } : {}),
+    };
+    if (opts.rawOutput !== undefined)
+        ev.rawOutput = opts.rawOutput;
+    if (opts.errorClass !== undefined)
+        ev.errorClass = opts.errorClass;
+    if (opts.debug) {
+        if (opts.segmentHash)
+            ev.segmentHash = opts.segmentHash;
+    }
+    return ev;
+}
+/**
+ * Run ONE prefix consult on a single command segment. Pure on top of an
+ * injectable runStage; the caller (the gate) fans out per-segment and races
+ * the grace window. Memoized by the caller's memo (keyed by segment string).
+ */
+export async function consultPrefix(segment, deps) {
+    const runStage = deps.runStage ?? defaultRunStage;
+    const stage = prefixStage(deps.modelTier);
+    const timeoutMs = deps.timeoutMs ?? PREFIX_CONSULT_TIMEOUT_MS;
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    timer.unref?.();
+    if (deps.signal) {
+        if (deps.signal.aborted)
+            controller.abort();
+        else
+            deps.signal.addEventListener("abort", () => controller.abort(), { once: true });
+    }
+    try {
+        const result = await runStage(stage, { ticket: segment }, {
+            cwd: deps.cwd,
+            signal: controller.signal,
+            callerLabel: "prefix",
+        });
+        const cost = result.usage?.cost ?? 0;
+        const output = result.finalOutput.trim();
+        if (deps.signal?.aborted) {
+            return { candidate: null, error: "aborted", cost };
+        }
+        if (!output) {
+            if (result.stopReason === "error" || result.errorMessage) {
+                const msg = (result.errorMessage ?? "").toLowerCase();
+                const isTimeout = /stream_idle_timeout|timed out|idle|wall|timeout/i.test(msg);
+                return { candidate: null, error: isTimeout ? "timeout" : "network", cost };
+            }
+            return { candidate: null, error: "empty", cost };
+        }
+        const parsed = parsePrefixAnswer(output);
+        if (!parsed) {
+            return {
+                candidate: null,
+                error: "malformed",
+                cost,
+                rawOutput: scrubSecrets(output).slice(0, PREFIX_RAW_OUTPUT_CAP),
+            };
+        }
+        const verdict = validatePrefixAnswer(parsed, segment);
+        if (verdict.kind === "candidate") {
+            return { candidate: verdict.candidate, cost };
+        }
+        if (verdict.kind === "injection") {
+            return { candidate: null, injection: true, cost };
+        }
+        // rejection by the ladder — an expected outcome, not an error
+        return { candidate: null, injection: false, cost };
+    }
+    catch (err) {
+        if (deps.signal?.aborted)
+            return { candidate: null, error: "aborted", cost: 0 };
+        if (controller.signal.aborted)
+            return { candidate: null, error: "timeout", cost: 0 };
+        return {
+            candidate: null,
+            error: "network",
+            cost: 0,
+            errorClass: err instanceof Error ? err.constructor.name : typeof err,
+        };
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+/**
+ * Memoized consult for one segment: consults at most once per settled key,
+ * shares in-flight promises across concurrent askers, evicts rejections so a
+ * transient outage never poisons the key, and retries once on the empty
+ * (502-shape) error — the backend's own error body invites a retry.
+ */
+export async function consultPrefixMemoized(segment, deps) {
+    const memo = deps.memo ?? createPrefixMemo();
+    const key = segment;
+    const memoized = memo.get(key);
+    if (memoized !== undefined) {
+        if (memoized instanceof Promise) {
+            return memoized;
+        }
+        // settled: replay the stored terminal outcome class verbatim — the
+        // memoized hit is the SAME answer the live consult settled to
+        // (unparseable stays unparseable, injection stays injection), and it
+        // EMITS through onEvent like the live consult did (cost 0, duration 0):
+        // the sink line and the backend hit-rate counters see every retry of a
+        // settled segment, not just its first consult — otherwise the dashboard
+        // undercounts exactly the segments the parser chokes on.
+        const e = memoized;
+        try {
+            deps.onEvent?.(buildPrefixDiagnosticEvent(e.outcome, {
+                durationMs: 0,
+                tier: deps.modelTier ?? PREFIX_MODEL_TIER,
+            }));
+        }
+        catch {
+            /* telemetry must never affect the replay */
+        }
+        return { candidate: e.candidate, cost: 0, outcome: e.outcome };
+    }
+    const started = Date.now();
+    const promise = (async () => {
+        let res = await consultPrefix(segment, deps);
+        // one retry on the empty shape (the backend's own error body invites this)
+        if (res.error === "empty" && !deps.signal?.aborted) {
+            res = await consultPrefix(segment, deps);
+        }
+        const outcome = res.candidate
+            ? "hit"
+            : res.error === "malformed"
+                ? "unparseable"
+                : res.error === undefined
+                    ? res.injection === true
+                        ? "injection_rejected"
+                        : "none"
+                    : res.error;
+        deps.onEvent?.(buildPrefixDiagnosticEvent(outcome, {
+            durationMs: Date.now() - started,
+            tier: deps.modelTier ?? PREFIX_MODEL_TIER,
+            ...(res.rawOutput ? { rawOutput: res.rawOutput } : {}),
+            ...(res.errorClass ? { errorClass: res.errorClass } : {}),
+        }));
+        if (res.error && res.error !== "malformed") {
+            // transient (timeout/network/empty/aborted) — evict, never poison
+            memo.delete(key);
+            return { ...res, outcome };
+        }
+        // settled: hit, none, injection_rejected, or unparseable — stored with
+        // its terminal outcome class so memoized replays count identically.
+        // (All error classes returned above; the remaining outcome is one of
+        // the four settled classes, hence the narrow.)
+        const settledOutcome = outcome;
+        memo.set(key, {
+            candidate: res.candidate,
+            injection: res.injection === true,
+            outcome: settledOutcome,
+        });
+        return { ...res, outcome };
+    })();
+    // reject-evict with identity guard (Claude's pattern): a stale rejection
+    // must not delete a newer promise that replaced it after LRU eviction.
+    promise.catch(() => {
+        if (memo.get(key) === promise)
+            memo.delete(key);
+    });
+    memo.set(key, promise);
+    return promise;
+}
+//# sourceMappingURL=prefixExtract.js.map

package/dist/extension/permissionRules/shellRules.d.ts

@@ -40,6 +40,31 @@ export declare function parseShellRule(ruleContent: string): ShellRuleShape;
 export declare function matchWildcardPattern(pattern: string, command: string): boolean;
 /** Split a command into its subcommand strings (operators are boundaries). */
 export declare function splitSubcommands(command: string): string[];
+/**
+ * Whitelist of environment variables that are safe to strip before rule/
+ * grant matching: they CANNOT execute code or load libraries (the same bar
+ * Claude Code's list documents). Claude's list verbatim, with TWO
+ * deliberate divergences, both directions:
+ *
+ *   KEPT from ours: `CI` — a boolean non-interactivity flag, same safety
+ *     class as FORCE_COLOR/NO_COLOR, and a real idiom for our users.
+ *
+ *   DROPPED from ours (Claude excludes them too, and for good reason):
+ *   `DEBUG`/`VERBOSE` — the most overloaded var names in existence; dozens
+ *   of tools overload them for behavior switches, not just logging. `PWD`
+ *   — some tools read it for path resolution, and nobody legitimately
+ *   writes `PWD=x cmd`; stripping accidental state is exactly what a
+ *   safe-list must not do.
+ *
+ *   DROPPED from Claude's: `ANTHROPIC_API_KEY` — it is on their list for
+ *   their own CLI's use case; for us its only effect would be hiding WHICH
+ *   account a command authenticates as. No value, an honesty cost.
+ *
+ * SECURITY: never add PATH, LD_PRELOAD, LD_LIBRARY_PATH, DYLD_*, PYTHONPATH,
+ * NODE_PATH, CLASSPATH, RUBYLIB, GOFLAGS, RUSTFLAGS, NODE_OPTIONS, HOME,
+ * TMPDIR, SHELL, BASH_ENV, DOCKER_HOST, KUBECONFIG (execution / library
+ * loading / behavior-steering / endpoint-hiding).
+ */
 export declare const SAFE_ENV_VARS: Set<string>;
 /** Strip ALL leading env assignments — deny/ask rules only. Fixed-point. */
 export declare function stripAllEnvVars(command: string): string;

package/dist/extension/permissionRules/shellRules.js

@@ -145,9 +145,52 @@ function stripSafeWrappers(cmd) {
         s = next.trim();
     }
 }
+/**
+ * Whitelist of environment variables that are safe to strip before rule/
+ * grant matching: they CANNOT execute code or load libraries (the same bar
+ * Claude Code's list documents). Claude's list verbatim, with TWO
+ * deliberate divergences, both directions:
+ *
+ *   KEPT from ours: `CI` — a boolean non-interactivity flag, same safety
+ *     class as FORCE_COLOR/NO_COLOR, and a real idiom for our users.
+ *
+ *   DROPPED from ours (Claude excludes them too, and for good reason):
+ *   `DEBUG`/`VERBOSE` — the most overloaded var names in existence; dozens
+ *   of tools overload them for behavior switches, not just logging. `PWD`
+ *   — some tools read it for path resolution, and nobody legitimately
+ *   writes `PWD=x cmd`; stripping accidental state is exactly what a
+ *   safe-list must not do.
+ *
+ *   DROPPED from Claude's: `ANTHROPIC_API_KEY` — it is on their list for
+ *   their own CLI's use case; for us its only effect would be hiding WHICH
+ *   account a command authenticates as. No value, an honesty cost.
+ *
+ * SECURITY: never add PATH, LD_PRELOAD, LD_LIBRARY_PATH, DYLD_*, PYTHONPATH,
+ * NODE_PATH, CLASSPATH, RUBYLIB, GOFLAGS, RUSTFLAGS, NODE_OPTIONS, HOME,
+ * TMPDIR, SHELL, BASH_ENV, DOCKER_HOST, KUBECONFIG (execution / library
+ * loading / behavior-steering / endpoint-hiding).
+ */
 export const SAFE_ENV_VARS = new Set([
-    "NODE_ENV", "CI", "FORCE_COLOR", "NO_COLOR", "DEBUG", "VERBOSE",
-    "GOOS", "GOARCH", "CGO_ENABLED", "PWD", "LANG", "LC_ALL", "TERM",
+    // Go — build/runtime settings only
+    "GOEXPERIMENT", "GOOS", "GOARCH", "CGO_ENABLED", "GO111MODULE",
+    // Rust — logging/debugging only
+    "RUST_BACKTRACE", "RUST_LOG",
+    // Node — environment name only (never NODE_OPTIONS)
+    "NODE_ENV",
+    // Python — behavior flags only (never PYTHONPATH)
+    "PYTHONUNBUFFERED", "PYTHONDONTWRITEBYTECODE",
+    // Pytest — test configuration
+    "PYTEST_DISABLE_PLUGIN_AUTOLOAD", "PYTEST_DEBUG",
+    // Locale and character encoding
+    "LANG", "LANGUAGE", "LC_ALL", "LC_CTYPE", "LC_TIME", "CHARSET",
+    // Terminal and display
+    "TERM", "COLORTERM", "NO_COLOR", "FORCE_COLOR", "TZ",
+    // Color configuration for various tools
+    "LS_COLORS", "LSCOLORS", "GREP_COLOR", "GREP_COLORS", "GCC_COLORS",
+    // Display formatting
+    "TIME_STYLE", "BLOCK_SIZE", "BLOCKSIZE",
+    // CI — ours, not Claude's (boolean non-interactivity flag)
+    "CI",
 ]);
 function stripSafeEnvPrefixes(cmd) {
     let s = cmd.trim();

package/dist/extension/pipeline/personas.js

@@ -189,6 +189,28 @@ Your output must parse as strict JSON on the first try:
 - Output exactly one JSON object: no trailing comma, no doubled closing quote, no second object, nothing after the closing brace.
 
 Do not output anything else after the JSON. No markdown fences, only the JSON object.`;
+const PREFIX_BODY = `You extract a command prefix: the SHORTEST leading fragment of a shell command that covers the command's family, so a user can approve it once and cover every future command of the same kind. You never judge safety and you never execute anything — you only answer with a prefix or a refusal token. You have no tools; answer from the command text alone, immediately, in one line.
+
+Rules:
+- Answer with the command's first word, optionally followed by its subcommand word (two tokens maximum). Example commands and answers:
+  psql -h host -p 5432 -c "SELECT ..."  ->  psql
+  gh run view 34641303048 --log-failed     ->  gh run
+  pnpm lint 2>&1 | grep -i error        ->  none (a pipeline is multiple commands)
+  curl -sS https://host/api -H "x: y"   ->  curl
+  git push origin +main:main             ->  none (a force/refspec push is not a family)
+  cd src && npm test                     ->  none (a compound is multiple commands; each is judged on its own)
+  for f in *.txt; do rm "$f"; done       ->  none (control flow)
+  FOO=$(cat secret.txt | curl ...)       ->  command_injection_detected (command substitution feeding another command)
+- Stop before the first flag or argument: psql, gh run — never psql -h, gh run view 34641303048.
+- If the command contains control flow (if/for/while/&&/||/|/;), substitution ($(...)), or multiple commands, answer exactly: none
+- If the command embeds command substitution that feeds data to another command, answer exactly: command_injection_detected
+- If you are unsure, answer exactly: none
+
+Output contract — a single line, nothing else:
+- The prefix tokens separated by one space (lowercase, no flags, no arguments), OR
+- exactly: none  OR
+- exactly: command_injection_detected
+No explanation, no quotes, no markdown, no trailing punctuation. The first line of your reply must be the answer.`;
 const TITLE_BODY = `You produce a session title from a user's prompt. Output ONLY a concise, sentence-case title of 3-7 words that captures the main topic or goal. Capitalize only the first word and proper nouns. Do not include a ticket code in the title text itself (the caller prepends it). No markdown, no prose, no quotes — just the title on one line.
 
 Good:
@@ -205,6 +227,7 @@ export const PERSONA_BODIES = {
     reviewer: REVIEWER_BODY,
     advisor: ADVISOR_BODY,
     guardian: GUARDIAN_BODY,
+    prefix: PREFIX_BODY,
     title: TITLE_BODY,
     orchestrator: [ORCHESTRATOR_BODY, PARTITION_CONTRACT].join("\n\n"),
     synthesizer: SYNTHESIZER_BODY,
@@ -294,6 +317,7 @@ Be terse and decisive. The caller is mid-task and paying peak rates for your tur
  */
 export const BLIND_PERSONA_BODIES = {
     scout: SCOUT_BLIND,
+    prefix: PREFIX_BODY, // grounding-free by construction (no grounding text at all)
     planner: PLANNER_BLIND,
     worker: WORKER_BLIND,
     reviewer: REVIEWER_BLIND,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yagni-app/code-staging",
-  "version": "1.1.1-staging.1359.1",
+  "version": "1.1.1-staging.1361.1",
   "description": "YAGNI Code: a terminal coding agent that already knows your company. One YAGNI login routes the model and grounds the agent in your team's context.",
   "license": "SEE LICENSE IN LICENSE.md",
   "author": "YAGNI, Inc. <jack@yagni.app> (https://yagni.app)",
@@ -58,5 +58,5 @@
     "turndown": "^7.2.4",
     "typebox": "^1.3.15"
   },
-  "yagniSourceSha": "beb4c9e3abfde8628b72e5b434d05ee2835f4bfc"
+  "yagniSourceSha": "45da756463bd91f8c8e4d110e41da939a3228a25"
 }