@yagni-app/code-staging 1.1.2-staging.1368.1 → 1.1.2-staging.1369.1

package/dist/extension/sandbox/bash.d.ts

@@ -127,13 +127,64 @@ export declare function shouldUseSandboxForUserCommand(command: string, manager:
  * advisory only, never a grant. Uninitialized manager ⇒ passthrough, no
  * hint (no annotation context, and the sink is not wired yet).
  */
-export declare function annotateCommandOutput(manager: YagniSandboxManager, command: string, output: string): {
+export declare function annotateCommandOutput(manager: YagniSandboxManager, command: string, output: string, fsScope?: {
+    cwd: string;
+    scope: FsDenialScope;
+}): {
     text: string;
     net: {
         cls: NetworkDenialClass;
         hint: string;
     } | null;
+    fs: {
+        cls: FsDenialClass;
+        hint: string;
+    } | null;
 };
+/** The filesystem denial classes this classifier knows (closed set — rides
+ * the sink line as a low-cardinality field, the same contract as
+ * NetworkDenialClass). write-scope-protected is a distinct class (not a
+ * sub-case) because its REMEDY differs: protected paths can never be
+ * admitted with an allow rule, so the hint must not point at the knob. */
+export type FsDenialClass = "write-scope" | "write-scope-protected" | "heredoc-cwd";
+/** The writable/denied root lists the fs classifier needs, passed in by the
+ * caller so the classifier stays pure (the established pattern — see
+ * networkDenialHint). allowWrite: the sandbox's writable roots (session cwd,
+ * the temp dirs, config allowWrite). denyWrite: the protected paths that are
+ * denied even when a wider allow would cover them (config files, state dirs). */
+export interface FsDenialScope {
+    allowWrite: readonly string[];
+    denyWrite: readonly string[];
+}
+/**
+ * Classify a sandbox filesystem denial from command + output. Pure;
+ * advisory-only (the fs twin of networkDenialHint — never widens anything,
+ * the remedy is model-side or a user config edit, never a grant). Matches
+ * the signatures observed live and in the session review:
+ *   - heredoc-cwd:        `cannot create temp file for here document` /
+ *                         `/dev/fd/NN: Operation not permitted` — bash 3.2
+ *                         writes heredoc temp files relative to the CURRENT
+ *                         directory, so a cd outside the writable roots makes
+ *                         every heredoc fail even when the target is writable
+ *                         (reproduced live; the e2b /dev/fd/62 case is the
+ *                         process-substitution sibling of the same mechanism)
+ *   - write-scope:         an EPERM whose line names a write TARGET path
+ *                         outside the writable roots — the literal `/tmp`
+ *                         writes observed in the sessions (`cat > /tmp/x`,
+ *                         `> /tmp/after.txt`, python PermissionError on a
+ *                         non-root path)
+ *   - write-scope-protected: same shape but the target is a PROTECTED path
+ *                         (denyWrite) — the config.json / state-dir denies.
+ *                         Protected paths can never be admitted with allow
+ *                         rules, so the hint copy differs.
+ * Returns null when the output carries no fs-denial signature — a network
+ * denial must NOT get an fs hint (the pinned negative in networkDenialHint
+ * is symmetric here).
+ */
+export declare function fsDenialHint(command: string, output: string, cwd: string, scope: FsDenialScope): {
+    cls: FsDenialClass;
+    hint: string;
+} | null;
 /** cwd must exist before spawn (guard borrowed from pi's local ops). */
 export declare function assertSpawnableCwd(cwd: string): void;
 /**

package/dist/extension/sandbox/bash.js

@@ -21,6 +21,7 @@
  * lessons (process-group kill, stdio release).
  */
 import { existsSync } from "node:fs";
+import { join } from "node:path";
 import { logEvent } from "../errorSink.js";
 import { scrubSecrets } from "../pipeline/scrubSecrets.js";
 function stripLeadingSafeEnvVars(command) {
@@ -347,18 +348,128 @@ export function shouldUseSandboxForUserCommand(command, manager, settings) {
  * advisory only, never a grant. Uninitialized manager ⇒ passthrough, no
  * hint (no annotation context, and the sink is not wired yet).
  */
-export function annotateCommandOutput(manager, command, output) {
+export function annotateCommandOutput(manager, command, output, fsScope) {
     if (!manager.initialized)
-        return { text: output, net: null };
+        return { text: output, net: null, fs: null };
     const net = networkDenialHint(output);
     if (!output.includes("Operation not permitted") && !net)
-        return { text: output, net: null };
+        return { text: output, net: null, fs: null };
     const annotated = output.includes("Operation not permitted")
         ? manager.annotateStderrWithSandboxFailures(command, output)
         : output;
-    if (!net)
-        return { text: annotated, net: null };
-    return { text: `${annotated}\n\n[sandbox] ${net.hint}`, net };
+    // The fs classification: same regex surface, same composition position,
+    // but the NETWORK hint wins when both classify (network denials have a
+    // user-flippable knob; fs remedies are model-side). When net wins, fs
+    // returns null — the callers log BOTH returns unconditionally, so a
+    // non-null loser would emit a second census line for one denial.
+    const fs = net
+        ? null
+        : fsScope
+            ? fsDenialHint(command, output, fsScope.cwd, fsScope.scope)
+            : null;
+    const hint = net ?? fs;
+    if (!hint)
+        return { text: annotated, net: null, fs: null };
+    return { text: `${annotated}\n\n[sandbox] ${hint.hint}`, net, fs };
+}
+/** Is `p` at or under one of the roots? Prefix match on path-segment
+ * boundaries (`/var/folders/T` must not admit `/var/folders/T-evil`). */
+function underRoot(p, roots) {
+    return roots.some((r) => {
+        if (p === r)
+            return true;
+        return p.startsWith(r.endsWith("/") ? r : r + "/");
+    });
+}
+/** Does the command carry a heredoc marker or a process substitution, plus a
+ * cd to a directory outside the writable roots? The discriminator for the
+ * heredoc-cwd drift shape: the temp-file write follows the shell's CURRENT
+ * directory, so a heredoc from inside the roots never has this failure —
+ * only the cd-drifted form does. */
+function hasHeredocCwdDrift(command, cwd, scope) {
+    if (!/<<|<\(/.test(command))
+        return false;
+    // find every cd target and require at least one OUTSIDE the writable roots
+    const cdRe = /(^|[\n;&|(\s])cd\s+([^\n;&|)\s]+)/g;
+    let m;
+    while ((m = cdRe.exec(command)) !== null) {
+        const target = m[2].replace(/^("|')+|("|')+$/g, "");
+        // Resolve the same way a shell would for the classification question:
+        // absolute as-is, ~ against HOME (the common drift target), relative
+        // against the session cwd (a relative cd stays inside the roots only if
+        // the resolved path is under them).
+        let resolved = null;
+        if (target.startsWith("/"))
+            resolved = target;
+        else if (target.startsWith("~"))
+            resolved = target.replace(/^~/, process.env.HOME ?? "~");
+        else if (target !== "-" && !target.startsWith("$"))
+            resolved = join(cwd, target);
+        if (resolved && !underRoot(resolved, scope.allowWrite))
+            return true;
+    }
+    return false;
+}
+/**
+ * Classify a sandbox filesystem denial from command + output. Pure;
+ * advisory-only (the fs twin of networkDenialHint — never widens anything,
+ * the remedy is model-side or a user config edit, never a grant). Matches
+ * the signatures observed live and in the session review:
+ *   - heredoc-cwd:        `cannot create temp file for here document` /
+ *                         `/dev/fd/NN: Operation not permitted` — bash 3.2
+ *                         writes heredoc temp files relative to the CURRENT
+ *                         directory, so a cd outside the writable roots makes
+ *                         every heredoc fail even when the target is writable
+ *                         (reproduced live; the e2b /dev/fd/62 case is the
+ *                         process-substitution sibling of the same mechanism)
+ *   - write-scope:         an EPERM whose line names a write TARGET path
+ *                         outside the writable roots — the literal `/tmp`
+ *                         writes observed in the sessions (`cat > /tmp/x`,
+ *                         `> /tmp/after.txt`, python PermissionError on a
+ *                         non-root path)
+ *   - write-scope-protected: same shape but the target is a PROTECTED path
+ *                         (denyWrite) — the config.json / state-dir denies.
+ *                         Protected paths can never be admitted with allow
+ *                         rules, so the hint copy differs.
+ * Returns null when the output carries no fs-denial signature — a network
+ * denial must NOT get an fs hint (the pinned negative in networkDenialHint
+ * is symmetric here).
+ */
+export function fsDenialHint(command, output, cwd, scope) {
+    // heredoc-cwd first (most specific): the temp-file EPERM signatures, gated
+    // on the command actually carrying the drift shape.
+    if (/(cannot create temp file for here document|\/dev\/fd\/\d+: Operation not permitted)/.test(output) &&
+        hasHeredocCwdDrift(command, cwd, scope)) {
+        return {
+            cls: "heredoc-cwd",
+            hint: "This looks like a heredoc temp-file denial — bash writes heredoc temp files relative to the current directory, and a cd outside the writable roots makes every heredoc fail even when the heredoc target is writable. " +
+                "Run the heredoc from the working directory (no cd first), or use printf or a file in the working directory instead. Retrying with dangerouslyDisableSandbox is NOT needed.",
+        };
+    }
+    // write-target EPERM: the bash line shape (reusing extractBlockedWritePath's
+    // regex family) plus the python PermissionError shape.
+    const blocked = extractBlockedWritePath(output) ??
+        (output.match(/PermissionError: \[Errno \d+\] Operation not permitted: '([^']+)'/)?.[1] ?? null);
+    if (!blocked)
+        return null;
+    // A target inside the writable roots is NOT a write-scope denial — the
+    // scratchpad lives under the temp dir and its writes never hit the fence
+    // (the observed non-bug; pinned by test).
+    if (underRoot(blocked, scope.allowWrite))
+        return null;
+    if (underRoot(blocked, scope.denyWrite)) {
+        return {
+            cls: "write-scope-protected",
+            hint: "This looks like a sandbox write to a protected path — this path is denied even with allow rules (it holds the agent's own configuration). " +
+                "Do not write here; ask the user or use a different location. Retrying with dangerouslyDisableSandbox will still ask for permission and is the wrong tool for this — the protection is deliberate.",
+        };
+    }
+    return {
+        cls: "write-scope",
+        hint: "This looks like a sandbox write-scope denial — the target is outside the writable roots (the working directory and $TMPDIR). " +
+            "Use $TMPDIR or the project directory for temporary files. To write here anyway, add the path to sandbox.filesystem.allowWrite in your settings (the /sandbox panel's Config tab shows the current scope). " +
+            "Retrying with dangerouslyDisableSandbox is usually NOT needed — move the target inside the scope instead.",
+    };
 }
 /** cwd must exist before spawn (guard borrowed from pi's local ops). */
 export function assertSpawnableCwd(cwd) {

package/dist/extension/sandbox/session.d.ts

@@ -28,7 +28,10 @@ import type { PermissionRule } from "../permissionRules/loadConfig.js";
  * here would be overwritten and the sandbox would silently never reach
  * model-driven tool calls.
  */
-export declare function makeBashComposition(manager: YagniSandboxManager, settings: () => SandboxSettings, cwd: string, onShellResolutionRetry?: (outcome: "recovered" | "exhausted") => void): (def: ToolDefinition) => ToolDefinition;
+export declare function makeBashComposition(manager: YagniSandboxManager, settings: () => SandboxSettings, cwd: string, onShellResolutionRetry?: (outcome: "recovered" | "exhausted") => void, fsScope?: () => {
+    allowWrite: readonly string[];
+    denyWrite: readonly string[];
+} | null): (def: ToolDefinition) => ToolDefinition;
 export interface SandboxSessionHandle {
     manager: YagniSandboxManager;
     settings: () => SandboxSettings;

package/dist/extension/sandbox/session.js

@@ -23,7 +23,7 @@ import { isDebug } from "../diagnostics.js";
 import { mutateConfigJson, mutateLocalConfig } from "../settingsFiles.js";
 import { loadSandboxSettings } from "./config.js";
 import { resolveWorktreeGitAccess } from "./worktreeGit.js";
-import { annotateCommandOutput, makeSandboxSpawnHook, networkDenialHint, preWrappedCommand, shouldUseSandbox, shouldUseSandboxForUserCommand, } from "./bash.js";
+import { annotateCommandOutput, fsDenialHint, makeSandboxSpawnHook, networkDenialHint, preWrappedCommand, shouldUseSandbox, shouldUseSandboxForUserCommand, } from "./bash.js";
 import { YagniSandboxManager } from "./manager.js";
 import { SandboxPanel, buildPanelState, engineeringPresetBlock } from "./panel.js";
 import { effectiveRules } from "../permissionRules/loadConfig.js";
@@ -39,7 +39,7 @@ import { effectiveRules } from "../permissionRules/loadConfig.js";
  * here would be overwritten and the sandbox would silently never reach
  * model-driven tool calls.
  */
-export function makeBashComposition(manager, settings, cwd, onShellResolutionRetry) {
+export function makeBashComposition(manager, settings, cwd, onShellResolutionRetry, fsScope) {
     return (def) => {
         if (!settings().enabled)
             return def;
@@ -50,6 +50,12 @@ export function makeBashComposition(manager, settings, cwd, onShellResolutionRet
             shellPath: userShellPath,
             spawnHook,
         });
+        // The fs-denial classification scope (advisory hint only): resolved
+        // lazily per annotation — a denial is rare, the merge is not free.
+        const fsScopeForAnnotate = () => {
+            const scope = fsScope?.();
+            return scope ? { cwd, scope } : undefined;
+        };
         const schema = Type.Object({
             command: Type.String({ description: "The bash command to execute" }),
             timeout: Type.Optional(Type.Number({ description: "Optional timeout in seconds" })),
@@ -138,9 +144,11 @@ export function makeBashComposition(manager, settings, cwd, onShellResolutionRet
                         // The thrown-message gate matches the result-text gate: a
                         // network-signature denial in EITHER surface gets the
                         // annotation + hint (node throws lowercase "operation not
-                        // permitted", which the bare substring misses).
-                        const annotated = annotateCommandOutput(manager, input.command, err.message);
+                        // permitted", which the bare substring misses). The fs hint
+                        // composes under the same gate (one diagnosis, network wins).
+                        const annotated = annotateCommandOutput(manager, input.command, err.message, fsScopeForAnnotate());
                         logNetworkDenialHint(annotated.net);
+                        logFsDenialHint(annotated.fs, "thrown");
                         throw new Error(annotated.text);
                     }
                     throw err;
@@ -151,8 +159,9 @@ export function makeBashComposition(manager, settings, cwd, onShellResolutionRet
                 if (result?.content) {
                     const text = result.content.map((c) => (c.type === "text" ? c.text : "")).join("\n");
                     if (text.includes("Operation not permitted") || networkDenialHint(text)) {
-                        const annotated = annotateCommandOutput(manager, input.command, text);
+                        const annotated = annotateCommandOutput(manager, input.command, text, fsScopeForAnnotate());
                         logNetworkDenialHint(annotated.net);
+                        logFsDenialHint(annotated.fs, "result");
                         result = { ...result, content: [{ type: "text", text: annotated.text }] };
                     }
                 }
@@ -179,6 +188,33 @@ export function registerSandbox(pi, opts) {
     }).settings;
     let currentSettings = load();
     let rules = [];
+    // The fs-denial classification scope for the advisory hint (the roots
+    // the runtime merge resolves: cwd + tmpdir + config allowWrite, denied:
+    // the protected paths). Lazy + memo-invalidated per call — a denial is
+    // rare and buildRuntimeMerge is not free; re-reading per annotation also
+    // picks up rules/settings changes without a cache to invalidate.
+    const fsScope = () => {
+        if (!manager.initialized)
+            return null;
+        try {
+            const merge = manager.buildRuntimeMerge(rules);
+            return { allowWrite: merge.filesystem.allowWrite, denyWrite: merge.filesystem.denyWrite };
+        }
+        catch (err) {
+            // Never the thrown message (it can carry command content) — error
+            // class only, same posture as the gate's classify-error line. Without
+            // this trace a persistently-throwing merge would silently strip fs
+            // hints from all three surfaces and the only symptom would be "hints
+            // disappeared" from the census the measurement depends on.
+            logEvent({
+                source: "sandbox",
+                level: "warn",
+                event: "fs_scope_error",
+                fields: { error: err instanceof Error ? err.constructor.name : typeof err },
+            });
+            return null; // fail-soft: no scope, no hint (the network hint still rides)
+        }
+    };
     // Optional-chained: some harnesses/mocks don't implement flag APIs; the
     // flag simply reads as unset there. Real pi registers it normally.
     pi.registerFlag?.("no-sandbox", {
@@ -326,7 +362,7 @@ export function registerSandbox(pi, opts) {
         logShellResolutionRetry(outcome);
         opts.onShellResolutionRetry?.(outcome);
     };
-    const composeBash = makeBashComposition(manager, () => currentSettings, opts.cwd, onShellResolutionRetry);
+    const composeBash = makeBashComposition(manager, () => currentSettings, opts.cwd, onShellResolutionRetry, fsScope);
     const registerOwnBash = () => {
         if (!currentSettings.enabled)
             return;
@@ -409,11 +445,22 @@ export function registerSandbox(pi, opts) {
                         throw new Error(`timeout:${timeout}`);
                     // Post-run hint: same advisory as the tool path, appended after
                     // the child's own output so the user sees the fix pointer inline.
+                    // One diagnosis per denial: the network hint wins when both
+                    // classify (network has a user knob; fs remedies are model-side).
+                    // A null fsScope() (uninitialized manager, merge error) skips the
+                    // fs classification entirely — an empty-roots fallback would
+                    // misclassify in-roots and protected targets as write-scope.
                     const net = networkDenialHint(tail);
+                    const scope = net ? null : fsScope();
+                    const fs = scope ? fsDenialHint(event.command, tail, opts.cwd, scope) : null;
                     if (net) {
                         logEvent({ source: "sandbox", level: "info", event: "network_denial_hint", fields: { class: net.cls } });
                         onData(Buffer.from(`\n[sandbox] ${net.hint}`));
                     }
+                    else if (fs) {
+                        logEvent({ source: "sandbox", level: "info", event: "fs_denial_hint", fields: { class: fs.cls, surface: "user-bash" } });
+                        onData(Buffer.from(`\n[sandbox] ${fs.hint}`));
+                    }
                     return { exitCode };
                 }
                 finally {
@@ -825,6 +872,15 @@ function logNetworkDenialHint(net) {
         return;
     logEvent({ source: "sandbox", level: "info", event: "network_denial_hint", fields: { class: net.cls } });
 }
+/** Sink line for the fs-denial hint (same low-cardinality contract as the
+ * network one — the before/after escape census reads these lines). The
+ * surface field distinguishes the tool-call thrown-error / result-text /
+ * !-command call sites in the log stream. */
+function logFsDenialHint(fs, surface) {
+    if (!fs)
+        return;
+    logEvent({ source: "sandbox", level: "info", event: "fs_denial_hint", fields: { class: fs.cls, surface } });
+}
 /** Sink line for a failed domain-grant persist — the thrown message is
  * mutateConfigJson's own path/reason text (diagnosable, no file content),
  * same posture as sandbox_persist_failed / rule_save_failed. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yagni-app/code-staging",
-  "version": "1.1.2-staging.1368.1",
+  "version": "1.1.2-staging.1369.1",
   "description": "YAGNI Code: a terminal coding agent that already knows your company. One YAGNI login routes the model and grounds the agent in your team's context.",
   "license": "SEE LICENSE IN LICENSE.md",
   "author": "YAGNI, Inc. <jack@yagni.app> (https://yagni.app)",
@@ -58,5 +58,5 @@
     "turndown": "^7.2.4",
     "typebox": "^1.3.15"
   },
-  "yagniSourceSha": "a5f338426410c8549a0b85f6e0ac39fd3fdd3e78"
+  "yagniSourceSha": "806c992d00925d279ff5aa7beda45682c3875513"
 }