@yagni-app/code-staging 1.1.2-staging.1364.1 → 1.1.2-staging.1365.1

package/README.md

@@ -398,7 +398,7 @@ the two mechanisms in different releases:
 | `NODE_USE_SYSTEM_CA=1` | v22.19.0 and **v24.6.0** |
 
 So on Node **24.0–24.5** the variable is silently ignored while the flag works.
-Use `export NODE_OPTIONS=--use-system-ca` (or `setx NODE_OPTIONS --use-system-ca`)
+Use `export YAGNI_SYSTEM_CA=1` (or `setx YAGNI_SYSTEM_CA 1`) for coding sessions
 on those versions — `yagni doctor` says so explicitly when it spots this.
 
 Two more things worth knowing:
@@ -419,3 +419,10 @@ OS store are additive, and you usually want both.
 Maintainers: YAGNI Code is built on the open-source `pi` coding agent, configured
 entirely through a first-party extension (no fork). The engineering details live
 in [`ARCHITECTURE.md`](./ARCHITECTURE.md).
+
+
+System-CA opt-in reaches the coding process through a supported command-line flag
+without modifying `NODE_OPTIONS`. Automatic retry covers launcher errors; restart
+an already-running coding session with the opt-in if it encounters a TLS error.
+
+`NODE_USE_SYSTEM_CA` must be the literal `1`: Node does not enable OS trust for `true`, `yes`, or `2`. Earlier YAGNI diagnostics incorrectly treated those values as enabled; change them to `1` and restart the terminal/session.

package/dist/cli.d.ts

@@ -12,6 +12,7 @@
  * plus a configured pi spawn. Everything that makes this "YAGNI Code" lives in
  * pi-extension-yagni and the YAGNI backend.
  */
+import { type OutputFormat } from "./outputFormat.js";
 import { promptKeepOrRemoveWorktree } from "./worktreeExitPrompt.js";
 /**
  * Seed `editorPaddingX` into the per-profile pi `settings.json` so the prompt
@@ -43,6 +44,19 @@ export declare function seedCollapseChangelog(piAgentDir: string): void;
  * persists the user's choice, so this default is always reversible.
  */
 export declare function seedHideThinkingBlock(piAgentDir: string): boolean;
+/**
+ * Spawn pi and await its exit, mapping to the launcher's exit code. Extracted
+ * so `runDefault` (cwd = current) and `runWorktreeLaunch` (cwd = worktree) share
+ * the exact same json/stream-json post-processing, signal forwarding, and exit
+ * code mapping — the two paths can never drift on the output contract.
+ */
+export declare function spawnPiAndAwait(opts: {
+    argv: string[];
+    env: NodeJS.ProcessEnv;
+    remainingArgs: string[];
+    outputFormat: OutputFormat;
+    cwd?: string;
+}, resolvePiCli?: () => string): Promise<number>;
 /** The structural slice of the extension's session-worktree entry (by file path). */
 interface SessionWorktreeModule {
     createOrResume: (name: string | undefined, deps: {

package/dist/cli.js

@@ -37,7 +37,7 @@ import { installProcessCrashHandlers } from "./crashReport.js";
 import { currentCliVersion, maybeNudgeAndRefresh, upgradeCommand } from "./upgrade.js";
 import { maybeRefreshAtLaunch } from "./refresh.js";
 import { exitCodeFor, installSignalForwarding } from "./signalForward.js";
-import { altNameRemediation, describeError, findTlsCertError, isTrustStoreFixable, retryCaEnv, retryExecArgv, shouldRetryWithSystemCa, systemCaMechanism, tlsRemediation, } from "./tlsTrust.js";
+import { altNameRemediation, describeError, findTlsCertError, isTrustStoreFixable, retryCaEnv, retryExecArgv, sessionExecArgv, shouldRetryWithSystemCa, systemCaMechanism, tlsRemediation, } from "./tlsTrust.js";
 import { PAD_X } from "./padding.js";
 import { canPromptWorktreeCleanup, parseWorktreeFlag, validateWorktreeLaunchArgs, } from "./worktreeArgs.js";
 import { promptKeepOrRemoveWorktree } from "./worktreeExitPrompt.js";
@@ -304,7 +304,7 @@ async function runDefault(passthroughArgs) {
  * the exact same json/stream-json post-processing, signal forwarding, and exit
  * code mapping — the two paths can never drift on the output contract.
  */
-async function spawnPiAndAwait(opts) {
+export async function spawnPiAndAwait(opts, resolvePiCli = resolvePiCliPath) {
     const { argv, env, remainingArgs, outputFormat, cwd } = opts;
     // For json/stream-json output, inject --mode json so pi emits NDJSON events.
     const userChoseMode = remainingArgs.some((a) => a === "--mode" || a.startsWith("--mode="));
@@ -316,10 +316,10 @@ async function spawnPiAndAwait(opts) {
     const stdio = outputFormat === "json"
         ? ["inherit", "pipe", "inherit"]
         : "inherit";
-    const piCli = resolvePiCliPath();
+    const piCli = resolvePiCli();
     const startMs = Date.now();
     return await new Promise((resolve) => {
-        const child = spawn(process.execPath, [piCli, ...childArgv], {
+        const child = spawn(process.execPath, [...sessionExecArgv(env), piCli, ...childArgv], {
             stdio: stdio,
             env,
             ...(cwd ? { cwd } : {}),

package/dist/doctor.d.ts

@@ -63,6 +63,7 @@ export interface CaTrustProbe {
     systemCaFlag: boolean;
     /** Whether this Node honours the variable at all (v22.19+ / v24.6+). */
     systemCaEnvHonoured: boolean;
+    systemCaFlagAvailable?: boolean;
     /** The running Node version, for the "your Node ignores it" message. */
     nodeVersion: string;
     /**
@@ -188,7 +189,9 @@ export interface DoctorDeps {
 }
 export declare function defaultProbeBackend(baseUrl: string, token: string): Promise<BackendProbe>;
 /** Read the process's CA configuration, checking the extra bundle really loads. */
-export declare function defaultProbeCaTrust(env?: NodeJS.ProcessEnv, nodeVersion?: string): CaTrustProbe;
+export declare function defaultProbeCaTrust(env?: NodeJS.ProcessEnv, nodeVersion?: string, execArgv?: readonly string[], allowedFlags?: {
+    has(flag: string): boolean;
+}): CaTrustProbe;
 /** Whether a `gh` executable is resolvable on PATH (no subprocess spawn). */
 export declare function ghOnPathDefault(env?: NodeJS.ProcessEnv): boolean;
 /**

package/dist/doctor.js

@@ -22,7 +22,7 @@ import { resolveExtensionPath, resolvePiCliPath, resolvePiPackageDir, resolveTel
 import { readActiveProfile } from "./profiles.js";
 import { resolveMcpConfigPath } from "./mcpCommand.js";
 import { MIN_NODE_VERSION, nodeVersionSatisfies } from "./nodeVersion.js";
-import { EXTRA_CA_ENV, SYSTEM_CA_ENV, SYSTEM_CA_FLAG, childCaEnv, findTlsCertError, nodeOptionsHaveSystemCa, systemCaEnabled, systemCaEnvSupported, } from "./tlsTrust.js";
+import { EXTRA_CA_ENV, SYSTEM_CA_ENV, SYSTEM_CA_FLAG, childCaEnv, sessionExecArgv, findTlsCertError, nodeOptionsHaveSystemCa, systemCaEnabled, systemCaEnvSupported, systemCaFlagSupported, } from "./tlsTrust.js";
 // ── Pure check builders ─────────────────────────────────────────────────────
 /**
  * The Node floor, first in the list because every other check is moot
@@ -129,11 +129,9 @@ export function checkBackend(probe) {
             name: "backend",
             status: "fail",
             detail: `TLS certificate verification failed (${probe.code})`,
-            hint: `a TLS-inspecting proxy (Cloudflare WARP, Zscaler, Netskope) is re-signing HTTPS — ` +
-                (systemCaEnvSupported()
-                    ? `set ${SYSTEM_CA_ENV}=1 to trust your OS certificate store`
-                    : `set NODE_OPTIONS=${SYSTEM_CA_FLAG} to trust your OS certificate store ` +
-                        `(this Node ignores ${SYSTEM_CA_ENV})`),
+            hint: probe.code === "ERR_TLS_CERT_ALTNAME_INVALID"
+                ? "the certificate hostname does not match the backend URL — check the URL, DNS, and proxy configuration; adding CAs cannot fix a hostname mismatch"
+                : "a TLS-inspecting proxy (Cloudflare WARP, Zscaler, Netskope) may be re-signing HTTPS — " + caRemediation(process.versions.node, systemCaFlagSupported()),
             required: true,
         };
     }
@@ -218,7 +216,7 @@ export function checkCaTrust(probe) {
             name: "ca trust",
             status: "warn",
             detail: `${SYSTEM_CA_ENV} is set, but Node v${probe.nodeVersion} ignores it`,
-            hint: `that variable needs Node v24.6.0+ or v22.19.0+ — use NODE_OPTIONS=${SYSTEM_CA_FLAG} instead, which this Node accepts`,
+            hint: caRemediation(probe.nodeVersion, probe.systemCaFlagAvailable),
             required: false,
         };
     }
@@ -227,7 +225,7 @@ export function checkCaTrust(probe) {
             name: "ca trust",
             status: "warn",
             detail: `${EXTRA_CA_ENV} points at ${probe.extraCertsPath}, which can't be read`,
-            hint: `Node ignores an unreadable bundle with only a warning — fix the path, or use ${SYSTEM_CA_ENV}=1 instead`,
+            hint: `Node ignores an unreadable bundle with only a warning — fix the path, or ${caRemediation(probe.nodeVersion, probe.systemCaFlagAvailable)}`,
             required: false,
         };
     }
@@ -553,14 +551,19 @@ export async function defaultProbeBackend(baseUrl, token) {
     }
 }
 /** Read the process's CA configuration, checking the extra bundle really loads. */
-export function defaultProbeCaTrust(env = process.env, nodeVersion = process.versions.node) {
+export function defaultProbeCaTrust(env = process.env, nodeVersion = process.versions.node, execArgv = process.execArgv, allowedFlags = process.allowedNodeEnvironmentFlags) {
+    const processHasSystemCa = nodeOptionsHaveSystemCa(env) || execArgv.includes(SYSTEM_CA_FLAG) ||
+        (systemCaEnabled(env) && systemCaEnvSupported(nodeVersion));
+    const sessionAddsFlag = sessionExecArgv(env, execArgv, allowedFlags).length > 0;
+    const sessionAddsEnv = systemCaEnvSupported(nodeVersion) && Object.keys(childCaEnv(env)).length > 0;
     const base = {
         systemCa: systemCaEnabled(env),
-        systemCaFlag: nodeOptionsHaveSystemCa(env),
+        systemCaFlag: nodeOptionsHaveSystemCa(env) || execArgv.includes(SYSTEM_CA_FLAG),
         systemCaEnvHonoured: systemCaEnvSupported(nodeVersion),
+        systemCaFlagAvailable: systemCaFlagSupported(allowedFlags),
         nodeVersion,
         // Exactly what buildLaunch will decide for the session, asked the same way.
-        launchAddsSystemCa: Object.keys(childCaEnv(env)).length > 0,
+        launchAddsSystemCa: !processHasSystemCa && (sessionAddsFlag || sessionAddsEnv),
     };
     const extraCertsPath = env[EXTRA_CA_ENV]?.trim();
     if (!extraCertsPath)
@@ -686,4 +689,13 @@ export async function runDoctor(deps = {}) {
     log(formatDoctorReport(report));
     return report.exitCode;
 }
+function caRemediation(nodeVersion, flagAvailable) {
+    if (systemCaEnvSupported(nodeVersion))
+        return `set ${SYSTEM_CA_ENV}=1 to trust your OS certificate store`;
+    const [major, minor] = nodeVersion.replace(/^v/, "").split(".").map(Number);
+    if (flagAvailable ?? (major >= 24 || (major === 23 && minor >= 8) || (major === 22 && minor >= 19))) {
+        return `set YAGNI_SYSTEM_CA=1 for coding sessions, or run node ${SYSTEM_CA_FLAG} with the YAGNI entry point; this Node ignores ${SYSTEM_CA_ENV}`;
+    }
+    return `upgrade to Node v24.6.0+ or provide an IT-approved PEM bundle through ${EXTRA_CA_ENV}`;
+}
 //# sourceMappingURL=doctor.js.map

package/dist/extension/attribution.d.ts

@@ -43,7 +43,7 @@ export interface AttributionSettings {
     pr: string;
 }
 export declare const DEFAULT_COMMIT_ATTRIBUTION = "Co-Authored-By: YAGNI Code <code@yagni.app>";
-export declare const DEFAULT_PR_ATTRIBUTION = "Generated with [YAGNI Code](https://yagni.app/code)";
+export declare const DEFAULT_PR_ATTRIBUTION = "Co-authored with [YAGNI Code](https://yagni.app/code)";
 export declare const DEFAULT_ATTRIBUTION: AttributionSettings;
 export type AttributionSource = "claude-user" | "claude-project" | "claude-local" | "user" | "project" | "local";
 export interface AttributionLoad {

package/dist/extension/attribution.js

@@ -42,7 +42,7 @@ import { join } from "node:path";
 import { logEvent } from "./errorSink.js";
 import { codeStateHome } from "./stateHome.js";
 export const DEFAULT_COMMIT_ATTRIBUTION = "Co-Authored-By: YAGNI Code <code@yagni.app>";
-export const DEFAULT_PR_ATTRIBUTION = "Generated with [YAGNI Code](https://yagni.app/code)";
+export const DEFAULT_PR_ATTRIBUTION = "Co-authored with [YAGNI Code](https://yagni.app/code)";
 export const DEFAULT_ATTRIBUTION = {
     commit: DEFAULT_COMMIT_ATTRIBUTION,
     pr: DEFAULT_PR_ATTRIBUTION,

package/dist/extension/index.js

@@ -678,7 +678,6 @@ export async function registerYagni(pi, deps = {}) {
             try {
                 const body = {
                     outcome: ev.outcome,
-                    ...(ev.rawOutput ? { rawOutput: ev.rawOutput } : {}),
                     ...(ev.durationMs !== undefined ? { durationMs: ev.durationMs } : {}),
                     ...(ev.tier ? { tier: ev.tier } : {}),
                 };
@@ -1534,6 +1533,7 @@ export async function registerYagni(pi, deps = {}) {
                 }
             }
         }
+        resolveAttributionForSession(ctx);
         // Best-effort, once at session start: if the token is at or near expiry, say
         // so via a single notice so a long session does not silently start 401-ing
         // mid-flight (both completions and grounding tools). The provider's expiry
@@ -1585,7 +1585,6 @@ export async function registerYagni(pi, deps = {}) {
             // malformed file, or a repo tier ignored until the folder is trusted —
             // so the org's trailer never silently falls back to the default. Same
             // one-shot posture; never breaks session start.
-            resolveAttributionForSession(ctx);
             for (const warning of attributionState.load.warnings) {
                 try {
                     ctx.ui.notify(warning, "warning");

package/dist/extension/permission/approvedPrefixes.d.ts

@@ -130,6 +130,8 @@ export declare function storagePrefix(command: string): string;
  * invariant); literal grants match with startsWith against the raw command.
  */
 export declare function matchesGrant(command: string, grants: readonly ApprovedPrefixGrant[], repoKey: string): ApprovedPrefixGrant | null;
+/** Sequence grants are valid only when every unchanged-scope segment is covered. */
+export declare function matchesCompoundGrants(command: string, grants: readonly ApprovedPrefixGrant[], repoKey: string, policy: ExecPolicy): boolean;
 /**
  * Grant-time validation: only offer/accept a grant when the current command
  * would actually auto-run under it — classification is "prompt" AND the
@@ -139,16 +141,7 @@ export declare function matchesGrant(command: string, grants: readonly ApprovedP
 export declare function validateGrant(command: string, policy: ExecPolicy, repoKey: string): ApprovedPrefixGrant | null;
 /** Human label for the remember option: "git push …". */
 export declare function describePrefix(pattern: string[]): string;
-/** Claude's suggestionForExactCommand: stable prefix before a heredoc
- * operator — heredoc bodies change every invocation, so the exact command
- * would be a dead rule; the pre-<< prefix is the remember unit.
- *
- * OUR refinement over Claude: when the pre-<< prefix carries an OUTPUT
- * REDIRECT (`cat > "$S/r1.txt" <<EOF`), the redirect TARGET varies between
- * invocations as much as the body does (r1.txt, r2.txt, …) — so the prefix
- * cuts at the redirect operator. `cat >` seeds `…\ncat`; a redirect-free
- * heredoc (`gh api … <<EOF`) keeps Claude's full pre-<< prefix. The
- * editable field is the narrowing control on top of either. */
+/** Preserve the command and output target before a heredoc marker. */
 export declare function heredocPrefix(command: string): string | null;
 /**
  * The FULL remember ladder for one ask, in order (all five rungs — a shape

package/dist/extension/permission/approvedPrefixes.js

@@ -259,59 +259,28 @@ function hasGrantFencedFlag(pattern, tokens) {
     }
     return false;
 }
-/**
- * Is the text AFTER a literal grant's prefix inert (nothing new runs)?
- *
- * The literal rung's isSinglePlainCommand analog. A literal grant covers
- * commands that start with its string; whatever follows must not introduce
- * a NEW command. The dangerous remainders are command separators — `&&`,
- * `||`, `|`, `;`, newline, background `&` — and extra words (a longer
- * command). Allowed remainders, and ONLY these:
- *
- *   - empty / whitespace (the literal IS the command)
- *   - redirects (incl. a target — the heredoc rung cuts its seed BEFORE the
- *     varying target, so the target legitimately rides the remainder) as
- *     long as a heredoc marker follows and swallows the rest as data: the
- *     scratchpad reply shape `…\ncat > \"$S/r1.txt\" <<'EOF'\nbody\nEOF`
- *   - safe redirects without a heredoc: fd merges (`2>&1`) and /dev/null
- *     discards — decorations that change nothing about what runs
- *
- * The check: find the first top-level heredoc marker. Before it: only
- * whitespace + redirect operators (no words, no command separators — a
- * tokenizer pass proves both). After the marker, inertness is STRICT —
- * shell semantics do NOT make everything after `<<` data:
- *   - the marker must END ITS LINE: same-line text after the delimiter
- *     word is still the command line (`… <<EOF; curl evil.com` runs curl)
- *   - the heredoc BODY runs to the line that is exactly the closing
- *     delimiter; any NON-EMPTY line after that closer is a new command
- *     (`… <<'EOF'\nbody\nEOF\nrm -rf /` runs rm)
- * So the remainder's shape must be: [redirects] `<<` delimiter NEWLINE
- * body… NEWLINE delimiter NEWLINE? (end of input). No marker → the whole
- * remainder must be safe redirects.
- */
+/** Literal suffixes may add safe redirects or a quoted data-only heredoc. */
 function isInertLiteralRemainder(remainder) {
     if (remainder.trim().length === 0)
         return true;
     const heredocIdx = findTopLevelHeredoc(remainder);
     const pre = heredocIdx >= 0 ? remainder.slice(0, heredocIdx) : remainder;
-    // Before the heredoc (or the whole remainder): every token must be a
-    // redirect operator (target-bearing ok — the rung's own shape), and
-    // WITHOUT a heredoc the redirects must additionally be safe ones
-    // (fd merges / /dev/null) — a bare `literal > file` is a longer command
-    // with a write target, not a decoration.
+    // Output targets belong to the approved literal, never to a varying suffix.
     const parsed = shellParse(pre);
     if (!parsed.every((t) => typeof t === "object" && t.op === "redirect"))
         return false;
+    if (!parsed.every((t) => isSafeRedirect(t)))
+        return false;
     if (heredocIdx < 0)
-        return parsed.every((t) => isSafeRedirect(t));
+        return true;
     // STRICT heredoc tail: from the marker to end of input, the text must be
     // exactly [ws] << [-~]? [ws] DELIM rest-of-line \n …body… \n DELIM [ws] \n?
     // — nothing on the marker's line after the delimiter word, and nothing
     // non-blank after the closing delimiter line.
     const tail = remainder.slice(heredocIdx);
     const m = tail.match(/^<<-?~?\s*(["']?)(\w+)\1[ \t]*\r?\n/);
-    if (!m)
-        return false; // marker not at end of line (or no newline): refuse
+    if (!m || !m[1])
+        return false; // Unquoted heredocs execute substitutions.
     const delimiter = m[2];
     const lines = tail.slice(m[0].length).split("\n");
     // The closer: the first line equal to the delimiter (possibly with
@@ -365,6 +334,8 @@ export function matchesGrant(command, grants, repoKey) {
         if (grant.literal) {
             if (grant.pattern.length === 0 && command.trim().startsWith(grant.literal)) {
                 const remainder = command.trim().slice(grant.literal.length);
+                if (findTopLevelHeredoc(remainder) >= 0 && !heredocBodyIsData(grant.literal))
+                    continue;
                 if (isInertLiteralRemainder(remainder))
                     return grant;
             }
@@ -384,6 +355,37 @@ export function matchesGrant(command, grants, repoKey) {
     }
     return null;
 }
+/** Only plain cat consumes a variable heredoc as data, never as a program. */
+function heredocBodyIsData(prefix) {
+    const parsed = shellParse(prefix);
+    if (parsed.some((token) => typeof token !== "string" && token.op !== "semi" && !(token.op === "redirect" && token.direction === "out")))
+        return false;
+    const segments = splitSubcommandsQuoted(prefix);
+    if (segments.length === 0 || segments.slice(0, -1).some((segment) => !isAssignmentOnly(segment)))
+        return false;
+    const words = shellParse(segments[segments.length - 1]).filter((token) => typeof token === "string");
+    return words.length === 1 && words[0] === "cat";
+}
+/** Sequence grants are valid only when every unchanged-scope segment is covered. */
+export function matchesCompoundGrants(command, grants, repoKey, policy) {
+    const parsed = shellParse(command);
+    const operators = parsed.filter((token) => typeof token !== "string");
+    if (operators.length === 0 || operators.some((token) => !["and", "or", "semi"].includes(token.op)))
+        return false;
+    const segments = splitSubcommandsQuoted(command);
+    return segments.length > 1 && segments.every((segment) => {
+        const first = tokenize(canonicalizeForGrants(segment))[0];
+        if (["cd", "pushd", "popd", "export", "unset", "set", "shopt", "alias", "unalias", "hash", "enable", "umask", "ulimit"].includes(first))
+            return false;
+        try {
+            const match = matchesGrant(segment, grants, repoKey);
+            return classifyCommand(segment, policy).decision !== "forbidden" && Boolean(match && match.pattern.length > 0);
+        }
+        catch {
+            return false;
+        }
+    });
+}
 /**
  * Grant-time validation: only offer/accept a grant when the current command
  * would actually auto-run under it — classification is "prompt" AND the
@@ -412,41 +414,12 @@ export function describePrefix(pattern) {
     return `${pattern.join(" ")} …`;
 }
 // --- Escape-flow derivation (the unsandboxed-retry consent ladder) ---
-/** Claude's suggestionForExactCommand: stable prefix before a heredoc
- * operator — heredoc bodies change every invocation, so the exact command
- * would be a dead rule; the pre-<< prefix is the remember unit.
- *
- * OUR refinement over Claude: when the pre-<< prefix carries an OUTPUT
- * REDIRECT (`cat > "$S/r1.txt" <<EOF`), the redirect TARGET varies between
- * invocations as much as the body does (r1.txt, r2.txt, …) — so the prefix
- * cuts at the redirect operator. `cat >` seeds `…\ncat`; a redirect-free
- * heredoc (`gh api … <<EOF`) keeps Claude's full pre-<< prefix. The
- * editable field is the narrowing control on top of either. */
+/** Preserve the command and output target before a heredoc marker. */
 export function heredocPrefix(command) {
     const m = command.match(/^([\s\S]*?)<<[-~]?\s*(["']?)(\w+)\2/);
     if (!m)
         return null;
-    let prefix = m[1].trimEnd();
-    if (prefix.length === 0)
-        return null;
-    // cut at the first top-level (unquoted, uncommented) output-redirect
-    // operator — the target varies between invocations as much as the body
-    // does (`r1.txt`, `r2.txt`, …). Quote-aware char scan (not the tokenizer,
-    // which normalizes quotes and loses position); the literal seed preserves
-    // the ORIGINAL formatting because literal matching is verbatim startsWith.
-    let inSingle = false;
-    let inDouble = false;
-    for (let i = 0; i < prefix.length; i++) {
-        const ch = prefix[i];
-        if (ch === "'" && !inDouble)
-            inSingle = !inSingle;
-        else if (ch === '"' && !inSingle)
-            inDouble = !inDouble;
-        else if (ch === ">" && !inSingle && !inDouble) {
-            prefix = prefix.slice(0, i).trimEnd();
-            break;
-        }
-    }
+    const prefix = m[1].trimEnd();
     return prefix.length > 0 ? prefix : null;
 }
 /**

package/dist/extension/permission/gate.js

@@ -26,7 +26,7 @@
  * When the mode leaves plan, stale plan-context messages are filtered out of
  * the context so the model doesn't keep believing it is restricted.
  */
-import { derivePrefix, describePrefix, evaluateCompoundForEscape, matchesGrant, storagePrefix, validateGrantForAsk, validateGrantForEscape, } from "./approvedPrefixes.js";
+import { derivePrefix, describePrefix, evaluateCompoundForEscape, matchesGrant, matchesCompoundGrants, storagePrefix, validateGrantForAsk, validateGrantForEscape, } from "./approvedPrefixes.js";
 import { consultPrefixMemoized, createPrefixMemo, PREFIX_CONSULT_GRACE_MS, } from "./prefixExtract.js";
 import { logEvent } from "../errorSink.js";
 import { makeBlessStore as defaultMakeBlessStore } from "../bless.js";
@@ -435,6 +435,7 @@ export function registerPermissionGate(pi, deps = {}) {
     // injection) author its own grants and self-authorize within the same
     // session. New grants from concurrent sessions apply at next launch — the
     // startup load is the trust boundary (PR #1698 review).
+    const compoundPrefixGrantsEnabled = process.env.YAGNI_COMPOUND_PREFIX_GRANTS !== "0";
     const grants = [...(deps.grants ?? [])];
     // Keyed by cwd: a session can change working directory (cd, /go worktrees),
     // and a repoKey memoized from the first cwd would let repo-A grants match
@@ -1002,7 +1003,7 @@ export function registerPermissionGate(pi, deps = {}) {
                 // decideGate already returned block for those.
                 if (modeAtEntry === "auto" && command) {
                     const grant = matchesGrant(command, grants, resolveRepoKeyFor(cwd));
-                    if (grant) {
+                    if (grant || (compoundPrefixGrantsEnabled && matchesCompoundGrants(command, grants, resolveRepoKeyFor(cwd), effectivePolicy.execPolicy ?? DEFAULT_EXEC_POLICY))) {
                         emitGateEvent(slot, { ...eventBase, outcome: "prefix_allow", consulted: false });
                         return {};
                     }

package/dist/extension/permission/prefixExtract.d.ts

@@ -38,17 +38,10 @@ export interface PrefixConsultResult {
     /** True when the model answered command_injection_detected (the candidate
      * is null but the outcome class is injection, not a plain decline). */
     injection?: boolean;
-    /**
-     * Scrubbed + capped copy of the unparseable model output (malformed shape),
-     * so the sink and Sentry can see the exact failure. Never the raw command.
-     */
-    rawOutput?: string;
     /** Error CLASS only (constructor name) when the consult threw — never the
      * thrown message (it can carry command content or provider payloads). */
     errorClass?: string;
 }
-/** Cap on the malformed-output capture (same size discipline as the Guardian). */
-export declare const PREFIX_RAW_OUTPUT_CAP = 1024;
 /** The model tier the prefix consult runs on (Haiku-equivalent, like the Guardian). */
 export declare const PREFIX_MODEL_TIER = "efficient";
 /**
@@ -137,8 +130,6 @@ export interface PrefixDiagnosticEvent {
     tier?: string;
     /** Debug-only: segment hash for correlation (never the segment text). */
     segmentHash?: string;
-    /** Scrubbed + capped copy of the unparseable model output (malformed shape). */
-    rawOutput?: string;
     /** Error CLASS only (constructor name) when the consult threw — never the
      * thrown message (it can carry command content or provider payloads). */
     errorClass?: string;
@@ -147,7 +138,6 @@ export declare function buildPrefixDiagnosticEvent(outcome: PrefixDiagnosticEven
     durationMs?: number;
     tier?: string;
     segmentHash?: string;
-    rawOutput?: string;
     errorClass?: string;
     debug?: boolean;
 }): PrefixDiagnosticEvent;

package/dist/extension/permission/prefixExtract.js

@@ -24,10 +24,7 @@
  * is capped at "wasted a suggestion".
  */
 import { runStage as defaultRunStage } from "../pipeline/runner.js";
-import { scrubSecrets } from "../pipeline/scrubSecrets.js";
 import { BANNED_PREFIXES, canonicalizeForGrants, matchesGrant, } from "./approvedPrefixes.js";
-/** Cap on the malformed-output capture (same size discipline as the Guardian). */
-export const PREFIX_RAW_OUTPUT_CAP = 1024;
 /** The model tier the prefix consult runs on (Haiku-equivalent, like the Guardian). */
 export const PREFIX_MODEL_TIER = "efficient";
 /**
@@ -176,8 +173,6 @@ export function buildPrefixDiagnosticEvent(outcome, opts) {
         ...(opts.durationMs !== undefined ? { durationMs: opts.durationMs } : {}),
         ...(opts.tier !== undefined ? { tier: opts.tier } : {}),
     };
-    if (opts.rawOutput !== undefined)
-        ev.rawOutput = opts.rawOutput;
     if (opts.errorClass !== undefined)
         ev.errorClass = opts.errorClass;
     if (opts.debug) {
@@ -229,7 +224,6 @@ export async function consultPrefix(segment, deps) {
                 candidate: null,
                 error: "malformed",
                 cost,
-                rawOutput: scrubSecrets(output).slice(0, PREFIX_RAW_OUTPUT_CAP),
             };
         }
         const verdict = validatePrefixAnswer(parsed, segment);
@@ -310,7 +304,6 @@ export async function consultPrefixMemoized(segment, deps) {
         deps.onEvent?.(buildPrefixDiagnosticEvent(outcome, {
             durationMs: Date.now() - started,
             tier: deps.modelTier ?? PREFIX_MODEL_TIER,
-            ...(res.rawOutput ? { rawOutput: res.rawOutput } : {}),
             ...(res.errorClass ? { errorClass: res.errorClass } : {}),
         }));
         if (res.error && res.error !== "malformed") {

package/dist/extension/pipeline/runner.js

@@ -23,6 +23,7 @@ import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
 import { fileURLToPath } from "node:url";
+import { sessionExecArgv } from "../systemCa.js";
 import { trackChild } from "./childRegistry.js";
 import { finalOutputFrom, foldEvent, newEventAccumulator } from "./events.js";
 import { logEvent } from "../errorSink.js";
@@ -159,8 +160,11 @@ export async function runStage(stage, ctx, deps) {
             YAGNI_CALLER: callerLabel,
             ...(deps.attribution?.runId ? { YAGNI_RUN_ID: deps.attribution.runId } : {}),
         };
+        // The child uses this exact Node binary. Forward only CA trust, never
+        // unrelated parent loaders/inspectors or a flag in inherited NODE_OPTIONS.
+        const nodeArgs = [...sessionExecArgv(childEnv), ...argv];
         const exitCode = await new Promise((resolve) => {
-            const proc = spawnFn(process.execPath, argv, {
+            const proc = spawnFn(process.execPath, nodeArgs, {
                 cwd: deps.cwd,
                 env: childEnv,
                 shell: false,

package/dist/extension/recordDecisionTool.js

@@ -108,14 +108,13 @@ export function makeRecordDecisionTool(opts) {
             const data = outcome.json;
             if (data?.deduped) {
                 // The backend matched an existing active decision and inserted
-                // nothing; surface it so the agent leans on the recorded judgment.
+                // nothing. A duplicate may still be unconfirmed; do not inject it as guidance.
                 const existing = data.existing;
-                const summary = existing?.decision ? ` ${existing.decision}` : "";
                 return {
                     content: [
                         {
                             type: "text",
-                            text: `An equivalent decision is already recorded; nothing new was banked.${summary}`,
+                            text: `An equivalent decision is already recorded; nothing new was banked. Review and confirm it in Decisions before using it as guidance.`,
                         },
                     ],
                     details: { id: existing?.id ?? null, spooled: false },

package/dist/extension/systemCa.d.ts

@@ -0,0 +1,5 @@
+/** Kept in sync with the standalone CLI by its cross-package parity test. */
+export declare function sessionExecArgv(env: NodeJS.ProcessEnv, execArgv?: readonly string[], allowedFlags?: {
+    has(flag: string): boolean;
+}): string[];
+//# sourceMappingURL=systemCa.d.ts.map

package/dist/extension/systemCa.js

@@ -0,0 +1,10 @@
+/** Kept in sync with the standalone CLI by its cross-package parity test. */
+export function sessionExecArgv(env, execArgv = process.execArgv, allowedFlags = process.allowedNodeEnvironmentFlags) {
+    const flag = "--use-system-ca";
+    if (!allowedFlags.has(flag) || env.YAGNI_SYSTEM_CA === "0" || env.NODE_USE_SYSTEM_CA === "0")
+        return [];
+    if (execArgv.includes("--no-use-system-ca") || /(?:^|\s)["']?--no-use-system-ca["']?(?:\s|$)/.test(env.NODE_OPTIONS ?? ""))
+        return [];
+    return execArgv.includes(flag) || env.NODE_USE_SYSTEM_CA === "1" || env.YAGNI_SYSTEM_CA === "1" ? [flag] : [];
+}
+//# sourceMappingURL=systemCa.js.map

package/dist/tlsTrust.d.ts

@@ -185,4 +185,8 @@ export declare function tlsRemediation(platform?: NodeJS.Platform, nodeVersion?:
  * just isn't the host we asked for, so adding CAs changes nothing.
  */
 export declare function altNameRemediation(): string[];
+/** Only this same-binary child gets the flag; never widen NODE_OPTIONS. */
+export declare function sessionExecArgv(env: NodeJS.ProcessEnv, execArgv?: readonly string[], allowedFlags?: {
+    has(flag: string): boolean;
+}): string[];
 //# sourceMappingURL=tlsTrust.d.ts.map

package/dist/tlsTrust.js

@@ -153,7 +153,7 @@ export function redactCredentials(text) {
 /** Whether the env var asks for the OS store (which some Node versions ignore). */
 export function systemCaEnabled(env) {
     const value = env[SYSTEM_CA_ENV];
-    return value !== undefined && value !== "" && value !== "0";
+    return value === "1";
 }
 /**
  * Whether this Node honours `NODE_USE_SYSTEM_CA`. Added in v22.19.0 and
@@ -372,4 +372,14 @@ export function altNameRemediation() {
         "",
     ];
 }
+/** Only this same-binary child gets the flag; never widen NODE_OPTIONS. */
+export function sessionExecArgv(env, execArgv = process.execArgv, allowedFlags) {
+    if (!systemCaFlagSupported(allowedFlags) || systemCaOptedOut(env) || env[SYSTEM_CA_ENV] === "0")
+        return [];
+    if (execArgv.includes("--no-use-system-ca") || /(?:^|\s)[\"\']?--no-use-system-ca(?:[\"\']?)(?:\s|$)/.test(env.NODE_OPTIONS ?? ""))
+        return [];
+    return execArgv.includes(SYSTEM_CA_FLAG) || systemCaEnabled(env) || systemCaOptedIn(env)
+        ? [SYSTEM_CA_FLAG]
+        : [];
+}
 //# sourceMappingURL=tlsTrust.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yagni-app/code-staging",
-  "version": "1.1.2-staging.1364.1",
+  "version": "1.1.2-staging.1365.1",
   "description": "YAGNI Code: a terminal coding agent that already knows your company. One YAGNI login routes the model and grounds the agent in your team's context.",
   "license": "SEE LICENSE IN LICENSE.md",
   "author": "YAGNI, Inc. <jack@yagni.app> (https://yagni.app)",
@@ -58,5 +58,5 @@
     "turndown": "^7.2.4",
     "typebox": "^1.3.15"
   },
-  "yagniSourceSha": "2e7b08bce22637cd7dd696a547bcf0cfd3fa806b"
+  "yagniSourceSha": "696c88e118688cb45dca88c0b821ff90e1db2c4c"
 }