@yagni-app/code-staging 1.1.2-staging.1370.1 → 1.1.2-staging.1372.1

package/dist/extension/index.js

@@ -36,8 +36,10 @@ import { registerGoCommand } from "./pipeline/goCommand.js";
 import { registerGoCompareCommand } from "./pipeline/goCompareCommand.js";
 import { DEFAULT_PERMISSION_POLICY, createModeHolder, registerPermissionGate } from "./permission/gate.js";
 import { registerSandbox } from "./sandbox/session.js";
-import { sandboxAutoAllowDecision } from "./sandbox/bash.js";
+import { isSandboxDenialOutput, sandboxAutoAllowDecision, sandboxDenialSignature, shouldUseSandbox } from "./sandbox/bash.js";
+import { sandboxFailureKey } from "./permission/approvedPrefixes.js";
 import { createEscapeTally } from "./sandbox/escapeTally.js";
+import { createGrantCensus } from "./permission/grantCensus.js";
 import { registerTelemetry as defaultRegisterTelemetry } from "./telemetry/register.js";
 import { loadHooksConfig, makeHookRunner, registerHooks } from "./hooks.js";
 import { loadPermissionRules } from "./permissionRules/loadConfig.js";
@@ -723,6 +725,37 @@ export async function registerYagni(pi, deps = {}) {
     // the startup load is the trust boundary; live reload was reviewed and
     // rejected as a same-session self-authorization path, PR #1698).
     const sessionGrants = evalMode ? [] : loadGrants();
+    // Prior sandboxed failures (the auto-sandbox rung's session state): a
+    // bash tool_result whose output carries a sandbox-denial signature marks
+    // the command — its later escape attempts go to the consent dialog (the
+    // sandbox genuinely cannot run it). Content stays local: only the trimmed
+    // command string is held in memory, never logged.
+    const sandboxedFailures = new Map();
+    const SANDBOXED_FAILURES_MAX = 50;
+    const recordSandboxedFailure = (command) => {
+        // The CANONICAL key (sandboxFailureKey): a retry differing by quote
+        // rendering or safe decoration must hit the same entry — raw-string
+        // keys would miss exactly the variable shapes the grants layer
+        // canonicalizes for.
+        const key = sandboxFailureKey(command);
+        if (!key)
+            return;
+        sandboxedFailures.delete(key);
+        sandboxedFailures.set(key, true);
+        if (sandboxedFailures.size > SANDBOXED_FAILURES_MAX) {
+            const oldest = sandboxedFailures.keys().next().value;
+            if (oldest !== undefined)
+                sandboxedFailures.delete(oldest);
+        }
+    };
+    const hasSandboxedFailure = (command) => sandboxedFailures.has(sandboxFailureKey(command));
+    // A mode transition is a trust-posture change — the auto-sandbox rung's
+    // prior-failure evidence clears with the gate's other session caches
+    // (the gate's own fallback map clears via modeHolder.onSet; this map is
+    // the production one, so it must clear here too).
+    modeHolder.onSet(() => {
+        sandboxedFailures.clear();
+    });
     // settings-based permission rules, loaded once at startup (same
     // trust-boundary posture as grants: no mid-session reload). User config
     // (~/.yagni-code/config.json) + project config (.yagni-code/config.json);
@@ -758,6 +791,11 @@ export async function registerYagni(pi, deps = {}) {
     // shared by the gate (record), the /sandbox panel (breakdown), and the
     // session-end summary line.
     const escapeTally = createEscapeTally();
+    // The session grant census (telemetry-only): every grant the session
+    // loaded plus every match, for the /sandbox panel's never-matched
+    // surfacing. Nothing is pruned, nothing is written back to rules.json.
+    const grantCensus = createGrantCensus();
+    grantCensus.seed(sessionGrants);
     const sandboxHandle = evalMode
         ? null
         : registerSandbox(pi, {
@@ -766,6 +804,9 @@ export async function registerYagni(pi, deps = {}) {
             hasUI: (ctx) => ctx.hasUI,
             onShellResolutionRetry: (outcome) => telemetry.sandboxShellResolutionRetry(outcome),
             escapeBreakdown: () => escapeTally.breakdown(),
+            // The grant census snapshot for the /sandbox panel's grants
+            // section (session-scoped match counts + never-matched labels).
+            grantCensus: () => grantCensus.entries(),
             // Anchors project-protected paths (.yagni-code + its config.json in
             // denyWrite) and project-sourced permission rules to the repo the
             // session runs in — same root the gate uses for its rule anchoring.
@@ -785,6 +826,18 @@ export async function registerYagni(pi, deps = {}) {
                     sandboxHandle.manager.initialized &&
                     params.dangerouslyDisableSandbox === true &&
                     sandboxHandle.settings().allowUnsandboxedCommands !== false,
+                // The auto-sandbox rung's would-run-wrapped proof: after the gate
+                // strips the flag, this command must actually be wrapped by
+                // shouldUseSandbox — an excludedCommands entry (or a manager reset)
+                // would otherwise run it UNSANDBOXED with zero consent. The gate
+                // additionally requires its own allow classification before it
+                // consults this predicate.
+                sandboxEscapeAutoSandbox: (command) => shouldUseSandbox({ command, dangerouslyDisableSandbox: false }, sandboxHandle.manager, sandboxHandle.settings()),
+                recordSandboxedFailure,
+                hasSandboxedFailure,
+                // Grant census feed: every grant match (prompt band + escape flow)
+                // counts toward the never-matched surfacing in /sandbox.
+                onGrantMatch: (grant) => grantCensus.record(grant),
                 // Escape tally: interception-time, content-free on the always-on
                 // info tier (the command prefix is command content — it rides the
                 // debug tier only, same contract as logGateOutcomeTrail; the OTel
@@ -1670,12 +1723,39 @@ export async function registerYagni(pi, deps = {}) {
     pi.on("tool_result", (event) => {
         if (event.toolName !== "bash")
             return;
-        const command = typeof event.input?.command === "string"
-            ? event.input.command
-            : "";
+        const input = (event.input ?? {});
+        const command = typeof input.command === "string" ? input.command : "";
         if (GIT_MUTATING_PATTERN.test(command)) {
             footerInvalidateHandle.invalidateGit();
         }
+        // The auto-sandbox rung's prior-failure evidence: a SANDBOXED bash
+        // result carrying a sandbox-denial signature marks this command — its
+        // later escape attempts re-arm the consent dialog instead of
+        // auto-sandboxing into the same denial forever. Only sandboxed runs
+        // count (an escaped run's failure text proves nothing about the
+        // sandbox); only the trimmed command is kept, never logged.
+        if (sandboxHandle &&
+            !input.dangerouslyDisableSandbox &&
+            event.isError &&
+            command) {
+            const text = (event.content ?? [])
+                .map((c) => (c && typeof c === "object" && "text" in c ? String(c.text) : ""))
+                .join("\n");
+            if (isSandboxDenialOutput(text)) {
+                recordSandboxedFailure(command);
+                // The seed must be observable (debug tier only — no command content,
+                // the closed signature class rides the field): a false-positive seed
+                // session-long disables auto-sandbox for a command, and without this
+                // line the only symptom would be unexplained dialogs.
+                const signature = sandboxDenialSignature(text);
+                logEvent({
+                    source: "sandbox",
+                    level: "debug",
+                    event: "sandbox_failure_seeded",
+                    fields: { signature },
+                });
+            }
+        }
     });
     // Seed the unified error trail from tool-exec failures. A tool's SUCCESS
     // is content (it lives in the transcript); its FAILURE is an error and belongs

package/dist/extension/permission/approvedPrefixes.d.ts

@@ -100,6 +100,16 @@ export declare const BANNED_PREFIXES: Set<string>;
  * (never canonicalized as one string).
  */
 export declare function canonicalizeForGrants(command: string): string;
+/**
+ * The canonical key for the prior-sandboxed-failure set (the auto-sandbox
+ * rung's session state, consumed by the gate and index.ts). Raw command
+ * strings would miss a retry that differs by quote rendering or safe
+ * decoration — exactly the variable shapes canonicalization exists for —
+ * so the key is the SAME normalization grant matching uses. Lives HERE
+ * (next to canonicalizeForGrants) so the sandbox layer never imports from
+ * permission. Pure.
+ */
+export declare function sandboxFailureKey(command: string): string;
 /**
  * Derive the grantable token prefix for a single canonical command, Claude's
  * getSimpleCommandPrefix → getFirstWordPrefix ladder:
@@ -203,6 +213,11 @@ export declare function validateGrantForAsk(command: string, policy: ExecPolicy,
 export interface CompoundSegmentVerdict {
     segment: string;
     kind: "covered" | "assignment" | "uncovered" | "forbidden" | "classify-error";
+    /** Present on `covered` verdicts: the grant that covered the segment.
+     * Carried so the census (and any other consumer) reads the match the
+     * evaluation already computed — no second matchesGrant pass, no drift
+     * between two call sites. */
+    grant?: ApprovedPrefixGrant;
 }
 export declare function evaluateCompoundForEscape(command: string, grants: readonly ApprovedPrefixGrant[], repoKey: string, policy: ExecPolicy): {
     forbidden: boolean;

package/dist/extension/permission/approvedPrefixes.js

@@ -129,13 +129,41 @@ export function canonicalizeForGrants(command) {
     // purpose: isSinglePlainCommand then fails, token grants never match, and
     // the shape falls to the literal rungs (an escaped command with a write
     // target must never silently ride a prefix grant).
+    //
+    // The re-join RE-QUOTES metachar-bearing tokens (the renderString idiom
+    // from splitSubcommandsQuoted below): a quoted `|`/`;`/`&` inside a data
+    // argument (a jq -q filter, an SQL body, an awk script) is TEXT, not an
+    // operator — a plain-string re-join used to emit it BARE, so every real
+    // command carrying `2>&1` plus quoted data canonicalized into a compound
+    // and EVERY token grant died (the escape-consent dead-grant bug: 5 dialogs
+    // for read-only gh commands in one session). Tokens containing a single
+    // quote cannot be re-quoted losslessly (the `'\''` idiom is not
+    // implemented on re-parse) — such a token makes the re-join REFUSE (the
+    // raw string is returned; matching then fails closed, the documented lossy
+    // case — the command word never carries one).
     const parsed = shellParse(s);
     const onlySafeOps = parsed.every((t) => typeof t === "string" || (t.op === "redirect" && isSafeRedirect(t)));
     if (onlySafeOps && parsed.some((t) => typeof t === "object")) {
-        s = parsed.filter((t) => typeof t === "string").join(" ");
+        const strings = parsed.filter((t) => typeof t === "string");
+        const renderQuoted = (t) => /[\s;|&<>"'\\$`]/.test(t) ? `'${t.replace(/'/g, "'\\''")}'` : t;
+        if (strings.every((t) => !t.includes("'"))) {
+            s = strings.map(renderQuoted).join(" ");
+        }
     }
     return s.trim();
 }
+/**
+ * The canonical key for the prior-sandboxed-failure set (the auto-sandbox
+ * rung's session state, consumed by the gate and index.ts). Raw command
+ * strings would miss a retry that differs by quote rendering or safe
+ * decoration — exactly the variable shapes canonicalization exists for —
+ * so the key is the SAME normalization grant matching uses. Lives HERE
+ * (next to canonicalizeForGrants) so the sandbox layer never imports from
+ * permission. Pure.
+ */
+export function sandboxFailureKey(command) {
+    return canonicalizeForGrants(command);
+}
 /**
  * A command qualifies for grant coverage only when it is one plain command:
  * no operators, no constructs (checked via the quote-aware tokenizer, so
@@ -724,10 +752,16 @@ export function evaluateCompoundForEscape(command, grants, repoKey, policy) {
         // exists for (gh/test/psql all classify allow). Coverage = grants only
         // (+ assignment no-ops); readonly classification is irrelevant to the
         // escape consent. (Claude parity: their sandboxOverride ask fires for the
-        // whole call regardless of subcommand read-only-ness.)
+        // whole call regardless of subcommand read-only-ness.) The gate's
+        // auto-sandbox rung (gateSandboxEscape) sits ABOVE this evaluation for
+        // all-`allow`-classified commands with no prior sandboxed failure: the
+        // command runs INSIDE the sandbox with no ask — running a read-only
+        // command sandboxed is not an exercise of unsandboxed authority, so
+        // the consent this flow guards is never owed for it.
         const canonical = canonicalizeForGrants(trimmed);
-        if (matchesGrant(trimmed, grants, repoKey)) {
-            segments.push({ segment: trimmed, kind: "covered" });
+        const matched = matchesGrant(trimmed, grants, repoKey);
+        if (matched) {
+            segments.push({ segment: trimmed, kind: "covered", grant: matched });
             continue;
         }
         segments.push({ segment: canonical, kind: "uncovered" });

package/dist/extension/permission/gate.d.ts

@@ -136,7 +136,7 @@ export declare function decideGate(toolName: string, params: Record<string, unkn
  * is emitted per terminal outcome; `consulted` says whether a Guardian LLM
  * call actually happened (grants/cache hits skip it).
  */
-export type GuardianGateOutcome = "prefix_allow" | "cached_allow" | "sandbox_auto_allow" | "allow" | "deny" | "ask_approved" | "ask_approved_remembered" | "ask_denied" | "ask_headless_blocked" | "breaker_ask_approved" | "breaker_blocked" | "escape_grant_allow" | "escape_cached_allow" | "escape_ask_approved" | "escape_ask_approved_remembered" | "escape_hook_allowed" | "escape_ask_denied" | "escape_ask_headless_blocked" | "escape_forbidden_blocked" | "escape_aborted" | "escape_ask_failed" | GuardianError;
+export type GuardianGateOutcome = "prefix_allow" | "cached_allow" | "sandbox_auto_allow" | "allow" | "deny" | "ask_approved" | "ask_approved_remembered" | "ask_denied" | "ask_headless_blocked" | "breaker_ask_approved" | "breaker_blocked" | "escape_grant_allow" | "escape_cached_allow" | "escape_ask_approved" | "escape_ask_approved_remembered" | "escape_hook_allowed" | "escape_auto_sandboxed" | "escape_ask_denied" | "escape_ask_headless_blocked" | "escape_forbidden_blocked" | "escape_aborted" | "escape_ask_failed" | GuardianError;
 /**
  * Rich per-decision event for opt-in storage (YAG-510). Carries the RAW
  * command — the wiring layer (index.ts) hashes/redacts per the workspace's
@@ -246,6 +246,13 @@ export interface RegisterPermissionDeps {
      * Fail-soft; never blocks.
      */
     onGuardianEvent?: (event: GuardianGateEvent) => void;
+    /**
+     * Called (fire-and-forget) when a grant MATCHED — at the prompt-band
+     * prefix_allow site and at the escape flow's grant allow sites. Feeds the
+     * session grant census (never-matched surfacing in /sandbox). Fail-soft;
+     * never blocks, never widens anything (telemetry-only).
+     */
+    onGrantMatch?: (grant: ApprovedPrefixGrant) => void;
     /**
      * Called (fire-and-forget) at EVERY terminal tool_call outcome, for every
      * tool, with the Claude Code-shaped decision (accept/reject + source).
@@ -299,6 +306,32 @@ export interface RegisterPermissionDeps {
      * escaped command. Fail-soft contract: never blocks the gate.
      */
     onSandboxEscape?: (prefix: string) => void;
+    /**
+     * Auto-sandbox escape rung: when true, a dangerouslyDisableSandbox call
+     * whose command classifies `allow` will run INSIDE the sandbox instead of
+     * prompting — the gate strips the flag from event.input in place and the
+     * bash tool wraps it (strictly less authority than the "Yes, run it"
+     * button it replaces). The session owns the decision — it must verify the
+     * command WILL actually run wrapped after the strip (manager initialized,
+     * not in excludedCommands). When absent or false the rung is inert and
+     * every escape asks as before.
+     */
+    sandboxEscapeAutoSandbox?: (command: string) => boolean;
+    /**
+     * Record that this command's SANDBXED run failed a sandbox denial this
+     * session (the prior-failure gate: the FIRST genuine sandbox denial of a
+     * command sends its later escape attempts back to the consent dialog —
+     * the auto-sandbox rung would otherwise loop a denied command forever).
+     * Wired by index.ts from a tool_result listener; fail-soft.
+     */
+    recordSandboxedFailure?: (command: string) => void;
+    /**
+     * Has this command failed a sandboxed run this session? Consulted by the
+     * auto-sandbox rung AFTER the allow classification (a prior denial means
+     * the sandbox genuinely cannot run this command — the human dialog is
+     * the only remaining path). Absent → no prior failures known.
+     */
+    hasSandboxedFailure?: (command: string) => boolean;
     /**
      * User-configurable lifecycle hooks (YAG-506). When present, PreToolUse
      * hooks run before decideGate and can short-circuit (allow/deny/ask),

package/dist/extension/permission/gate.js

@@ -26,7 +26,7 @@
  * When the mode leaves plan, stale plan-context messages are filtered out of
  * the context so the model doesn't keep believing it is restricted.
  */
-import { derivePrefix, describePrefix, evaluateCompoundForEscape, matchesGrant, matchesCompoundGrants, storagePrefix, validateGrantForAsk, validateGrantForEscape, } from "./approvedPrefixes.js";
+import { derivePrefix, describePrefix, evaluateCompoundForEscape, matchesGrant, matchesCompoundGrants, sandboxFailureKey, storagePrefix, validateGrantForAsk, validateGrantForEscape, } from "./approvedPrefixes.js";
 import { consultPrefixMemoized, createPrefixMemo, PREFIX_CONSULT_GRACE_MS, } from "./prefixExtract.js";
 import { logEvent } from "../errorSink.js";
 import { makeBlessStore as defaultMakeBlessStore } from "../bless.js";
@@ -487,6 +487,38 @@ export function registerPermissionGate(pi, deps = {}) {
     // any directory, and repo scoping happens at GRANT time, not consult time).
     const prefixMemo = createPrefixMemo();
     const runPrefixConsult = deps.prefixConsultFn ?? consultPrefixMemoized;
+    // Prior sandboxed failures (the auto-sandbox rung's session state): a
+    // command whose SANDBOXED run already hit a sandbox denial this session
+    // never auto-sandboxes on an escape attempt again — the consent dialog is
+    // the honest path for a command the sandbox genuinely cannot run. The
+    // PRODUCTION state lives in index.ts (its tool_result listener records,
+    // its map keys CANONICALLY via sandboxFailureKey and clears on /mode
+    // transitions via the shared modeHolder); the fallback map here backs
+    // only test wiring that injects no deps — same canonical key, same
+    // onSet clear, so the two can never drift.
+    const sandboxedFailures = new Map();
+    const recordSandboxedFailure = deps.recordSandboxedFailure ?? ((command) => {
+        const key = sandboxFailureKey(command);
+        if (!key)
+            return;
+        sandboxedFailures.delete(key);
+        sandboxedFailures.set(key, true);
+        if (sandboxedFailures.size > APPROVED_CACHE_MAX) {
+            const oldest = sandboxedFailures.keys().next().value;
+            if (oldest !== undefined)
+                sandboxedFailures.delete(oldest);
+        }
+    });
+    const hasSandboxedFailure = deps.hasSandboxedFailure ?? ((command) => sandboxedFailures.has(sandboxFailureKey(command)));
+    // UNCONDITIONAL clear — the production map (index.ts) clears on every
+    // onSet, so returning to the SAME mode (auto → review → auto) drops the
+    // evidence there too; this fallback mirrors that contract exactly (the
+    // other caches keep their m !== mode guard deliberately: an approved
+    // command's meaning does not change when a mode flip round-trips, but
+    // prior-failure evidence is environmental, not per-mode).
+    deps.modeHolder?.onSet(() => {
+        sandboxedFailures.clear();
+    });
     /** Shared consult-call builder: routes through the injectable seam with
      * the sink line + the onPrefixConsult hook — ONE place so the escape and
      * Guardian-ask fan-outs cannot drift. */
@@ -1004,6 +1036,12 @@ export function registerPermissionGate(pi, deps = {}) {
                 if (modeAtEntry === "auto" && command) {
                     const grant = matchesGrant(command, grants, resolveRepoKeyFor(cwd));
                     if (grant || (compoundPrefixGrantsEnabled && matchesCompoundGrants(command, grants, resolveRepoKeyFor(cwd), effectivePolicy.execPolicy ?? DEFAULT_EXEC_POLICY))) {
+                        if (grant) {
+                            try {
+                                deps.onGrantMatch?.(grant);
+                            }
+                            catch { /* telemetry must never affect the gate */ }
+                        }
                         emitGateEvent(slot, { ...eventBase, outcome: "prefix_allow", consulted: false });
                         return {};
                     }
@@ -1577,6 +1615,17 @@ export function registerPermissionGate(pi, deps = {}) {
         // unsandboxed during plan mode; the ask is the only allow path here.
         if (!inPlanMode) {
             if (compound.uncovered.length === 0) {
+                // Census: the evaluation already computed WHICH grant covered each
+                // segment (the verdict carries it) — feed the census from that, no
+                // second matching pass, no drift between call sites.
+                try {
+                    for (const verdict of compound.segments) {
+                        if (verdict.kind === "covered" && verdict.grant) {
+                            deps.onGrantMatch?.(verdict.grant);
+                        }
+                    }
+                }
+                catch { /* telemetry must never affect the gate */ }
                 emitGateEvent(slot, { ...eventBase, outcome: "escape_grant_allow", consulted: false });
                 return {};
             }
@@ -1586,6 +1635,65 @@ export function registerPermissionGate(pi, deps = {}) {
                 return {};
             }
         }
+        // Auto-sandbox rung: an all-`allow`-classified escape attempt with no
+        // prior sandboxed failure of this same command runs INSIDE the sandbox
+        // instead of prompting. This covers the pipeline/`||`/awk shapes the
+        // token system deliberately can't (per-stage grants for grep/head would
+        // be a UX dead-end) and it does NOT widen unsandboxed authority — the
+        // command runs with strictly less authority than the "Yes, run it"
+        // button the dialog would have offered. The prior-failure gate keeps
+        // the honest path: once the sandbox genuinely DENIES this command
+        // (EPERM/locked network), its later escapes go to the consent dialog.
+        // The predicate ALSO verifies the command will actually run wrapped
+        // after the flag strip — an excludedCommands entry would otherwise run
+        // unsandboxed with zero consent (the silent-escape hole).
+        // The rung's conditions, in order — the FIRST failure names the decline
+        // reason in the trail ("why did this escape ask instead of
+        // auto-sandboxing?" must be answerable): closed vocabulary, no command
+        // content, debug tier.
+        const declineTrace = (reason) => {
+            try {
+                logEvent({
+                    source: "sandbox",
+                    level: "debug",
+                    event: "escape_rung_declined",
+                    fields: { reason },
+                });
+            }
+            catch { /* telemetry must never affect the gate */ }
+        };
+        let classifyAllowForAutoSandbox = false;
+        try {
+            classifyAllowForAutoSandbox =
+                classifyCommand(command, execPolicy).decision === "allow";
+        }
+        catch {
+            classifyAllowForAutoSandbox = false; // classifier crash → dialog (fail closed)
+        }
+        if (!classifyAllowForAutoSandbox)
+            declineTrace("classify_not_allow");
+        else if (hasSandboxedFailure(command))
+            declineTrace("prior_failure");
+        else if (!deps.sandboxEscapeAutoSandbox || !deps.sandboxEscapeAutoSandbox(command))
+            declineTrace("predicate_declined");
+        else {
+            // strip the flag in place — pi's documented arg-mutation seam: the
+            // bash tool's shouldUseSandbox then wraps this command.
+            try {
+                delete event.input?.dangerouslyDisableSandbox;
+            }
+            catch { /* a frozen input would fail the strip — fall through to ask */ }
+            if (event.input?.dangerouslyDisableSandbox !== true) {
+                emitGateEvent(slot, { ...eventBase, outcome: "escape_auto_sandboxed", consulted: false });
+                if (ctx?.hasUI) {
+                    try {
+                        ctx.ui.notify("Ran this command inside the sandbox instead of unsandboxed (read-only; ask if a sandbox restriction blocks it).", "info");
+                    }
+                    catch { /* notify must never block */ }
+                }
+                return {};
+            }
+        }
         // Headless (incl. every /go child stage): fail closed — same contract as
         // the Guardian ask path (ask_headless_blocked).
         if (!ctx?.hasUI) {
@@ -1709,19 +1817,19 @@ export function registerPermissionGate(pi, deps = {}) {
             if (!inputThrew && custom !== undefined && custom.trim().length > 0) {
                 const trimmedCustom = custom.trim();
                 // The custom field accepts two shapes:
-                //  (a) a clean command word (`npx`, `psql`) — the first-word rung of
-                //      the ladder — validated by derivePrefix's shape check and
-                //      self-matched as a TOKEN grant (covers every later `npx …` /
-                //      `psql …` regardless of arguments; Claude's `psql:*` semantics).
-                //      A bare word can never pass the literal-remainder check (the
-                //      words after it are "not inert"), which is why the field used
-                //      to reject exactly this input with a dead-rule warning. The
-                //      git-push force/refspec fence is pattern-length-aware (a
-                //      bare `git` grant covers pushes too) — see matchesGrant.
-                //  (b) anything longer — a literal string prefix, validated as
-                //      before (must cover THIS command, banned/fenced shapes
+                //  (a) a derivable token pattern — a clean command word (`npx`,
+                //      `psql`) OR a word pair (`gh pr`) — derivePrefix's own ladder
+                //      (two-token for subcommand-shaped second words), then the
+                //      compound-coverage self-match. Multi-word inputs used to route
+                //      to the literal path (anything containing a space), whose
+                //      remainder can never pass the inert-remainder check — the
+                //      Sep-14 dead-end where NO input could fix the decorated
+                //      shapes. The git-push force/refspec fence is pattern-length-
+                //      aware (a bare `git` grant covers pushes too) — matchesGrant.
+                //  (b) anything non-derivable — a literal string prefix, validated
+                //      as before (must cover THIS command, banned/fenced shapes
                 //      refused the same way every rung does).
-                const tokenPattern = trimmedCustom.includes(" ") || trimmedCustom.includes("\n")
+                const tokenPattern = trimmedCustom.includes("\n")
                     ? null
                     : derivePrefix(trimmedCustom);
                 const customGrant = tokenPattern

package/dist/extension/permission/grantCensus.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Session grant census — per-grant match counts for the /sandbox panel
+ * (telemetry-only; no permission power). Mirrors escapeTally's shape: pure
+ * bookkeeping the gate records into and the panel renders.
+ *
+ * The "never matched" surfacing is deliberately SESSION-SCOPED: "dead" is
+ * shape-dependent, not grant-dependent (a literal that cannot cover a
+ * multiline body today could cover a single-line one tomorrow), so nothing
+ * is pruned and nothing is persisted back to rules.json. The count answers
+ * the operator's question at the panel: which of my saved grants actually
+ * fired this session, and which have never fired — with the grant's stored
+ * cwd provenance alongside for a future revoke UI.
+ */
+import type { ApprovedPrefixGrant } from "./approvedPrefixes.js";
+export interface GrantCensusEntry {
+    /** The grant's display label: token pattern joined, or the literal. */
+    label: string;
+    /** Times this grant matched a command this session. */
+    matches: number;
+    /** The grant's stored cwd (provenance for a future revoke UI). */
+    cwd: string;
+    /** When the grant was persisted (ISO), from the grant record. */
+    addedAt: string;
+}
+export interface GrantCensus {
+    /** Seed the census with the session's loaded grants (idempotent per grant
+     * identity: pattern or literal — a re-seed never resets the count). */
+    seed(grants: readonly ApprovedPrefixGrant[]): void;
+    /** Record one match of a grant (matched grants are auto-seeded). */
+    record(grant: ApprovedPrefixGrant): void;
+    /** Snapshot, most-matched first; never-matched grants keep their seed order. */
+    entries(): GrantCensusEntry[];
+    /** Count of grants that have never matched this session. */
+    neverMatchedCount(): number;
+}
+export declare function createGrantCensus(): GrantCensus;
+//# sourceMappingURL=grantCensus.d.ts.map

package/dist/extension/permission/grantCensus.js

@@ -0,0 +1,52 @@
+/**
+ * Session grant census — per-grant match counts for the /sandbox panel
+ * (telemetry-only; no permission power). Mirrors escapeTally's shape: pure
+ * bookkeeping the gate records into and the panel renders.
+ *
+ * The "never matched" surfacing is deliberately SESSION-SCOPED: "dead" is
+ * shape-dependent, not grant-dependent (a literal that cannot cover a
+ * multiline body today could cover a single-line one tomorrow), so nothing
+ * is pruned and nothing is persisted back to rules.json. The count answers
+ * the operator's question at the panel: which of my saved grants actually
+ * fired this session, and which have never fired — with the grant's stored
+ * cwd provenance alongside for a future revoke UI.
+ */
+const grantLabel = (grant) => grant.pattern.length > 0 ? grant.pattern.join(" ") : (grant.literal ?? "");
+const grantKey = (grant) => grant.pattern.length > 0 ? `t:${grant.pattern.join(" ")}` : `l:${grant.literal ?? ""}`;
+export function createGrantCensus() {
+    const counts = new Map();
+    const upsert = (grant) => {
+        const key = grantKey(grant);
+        let entry = counts.get(key);
+        if (!entry) {
+            entry = {
+                label: grantLabel(grant),
+                matches: 0,
+                cwd: grant.cwd,
+                addedAt: grant.addedAt,
+            };
+            counts.set(key, entry);
+        }
+        return entry;
+    };
+    return {
+        seed(grants) {
+            for (const grant of grants)
+                upsert(grant);
+        },
+        record(grant) {
+            upsert(grant).matches += 1;
+        },
+        entries() {
+            return [...counts.values()].sort((a, b) => b.matches - a.matches);
+        },
+        neverMatchedCount() {
+            let n = 0;
+            for (const entry of counts.values())
+                if (entry.matches === 0)
+                    n += 1;
+            return n;
+        },
+    };
+}
+//# sourceMappingURL=grantCensus.js.map

package/dist/extension/sandbox/bash.d.ts

@@ -82,6 +82,26 @@ export declare function _setShellResolutionRetryBackoffForTest(ms: number | null
  * spawnSync('which') times out under load. Self-healing after ~15–30s;
  * preWrappedCommand retries it once. */
 export declare function isShellResolutionFailure(err: unknown): boolean;
+/**
+ * Did this command output indicate the OS sandbox DENIED something? The
+ * session-wide evidence the escape-consent flow keys its auto-sandbox rung
+ * on: an all-allow-classified escape runs inside the sandbox UNLESS this
+ * same command already failed sandboxed this session (then the consent
+ * dialog — the denial hint informs the retry). Wraps the same signatures the
+ * annotation path uses: the fs EPERM marker and the network-posture
+ * classifier. The `[sandbox]` annotation prefix also counts — the output
+ * reaching tool_result on a denial already carries the advisory hint.
+ * Pure; matches TEXT ONLY (never widens anything by itself).
+ */
+/** The signature classes the seed-site trace reports (closed vocabulary,
+ * low cardinality — never command content). `network` outranks `annotation`
+ * for an annotated NETWORK denial (every hint text begins "[sandbox] This
+ * looks like a sandbox …", so checking the annotation first would mislabel
+ * the most common class); an annotated non-network denial (fs/write) is
+ * `annotation`; a bare EPERM line with no class markers is `epem`. Null when
+ * the output carries no denial signature at all. */
+export declare function sandboxDenialSignature(output: string): "network" | "annotation" | "epem" | null;
+export declare function isSandboxDenialOutput(output: string): boolean;
 /**
  * Detect "Operation not permitted" style sandbox denials in bash output so
  * callers (tool_result) can annotate and the model can react. Returns the

package/dist/extension/sandbox/bash.js

@@ -226,6 +226,74 @@ function sleep(ms, signal) {
 export function isShellResolutionFailure(err) {
     return err instanceof Error && /^Shell '[^']*' not found in PATH$/.test(err.message);
 }
+/**
+ * Did this command output indicate the OS sandbox DENIED something? The
+ * session-wide evidence the escape-consent flow keys its auto-sandbox rung
+ * on: an all-allow-classified escape runs inside the sandbox UNLESS this
+ * same command already failed sandboxed this session (then the consent
+ * dialog — the denial hint informs the retry). Wraps the same signatures the
+ * annotation path uses: the fs EPERM marker and the network-posture
+ * classifier. The `[sandbox]` annotation prefix also counts — the output
+ * reaching tool_result on a denial already carries the advisory hint.
+ * Pure; matches TEXT ONLY (never widens anything by itself).
+ */
+/** The signature classes the seed-site trace reports (closed vocabulary,
+ * low cardinality — never command content). `network` outranks `annotation`
+ * for an annotated NETWORK denial (every hint text begins "[sandbox] This
+ * looks like a sandbox …", so checking the annotation first would mislabel
+ * the most common class); an annotated non-network denial (fs/write) is
+ * `annotation`; a bare EPERM line with no class markers is `epem`. Null when
+ * the output carries no denial signature at all. */
+export function sandboxDenialSignature(output) {
+    if (!isSandboxDenialOutput(output))
+        return null;
+    if (networkDenialHint(output) !== null)
+        return "network";
+    if (/^\[sandbox\] (this looks like a (sandbox|heredoc))/im.test(output))
+        return "annotation";
+    return "epem";
+}
+export function isSandboxDenialOutput(output) {
+    // The [sandbox] annotation: only the advisory hint's OWN fixed sentence
+    // shape counts ("[sandbox] This looks like a sandbox/heredoc …" — the
+    // annotation vocabulary is ours and closed). Data text merely containing
+    // a bracketed marker (a cat of a log file, a grep hit) does not match.
+    if (/^\[sandbox\] (this looks like a (sandbox|heredoc))/im.test(output))
+        return true;
+    // EPERM / "Operation not permitted": only on an ERROR-DIAGNOSTIC line.
+    // The qualifying shapes — the error forms the OS and its tools emit:
+    //   `tool: … phrase`     a shell/tool prefix with a separator (`bash:`,
+    //                        `a.out:`, `sandbox-exec:` — ANY word followed
+    //                        by the separator, so a binary whose name starts
+    //                        with a filter word still qualifies)
+    //   `phrase at head`     the bare denial line itself
+    //   `code:`/`syscall:`   a node error-object detail line
+    // The data shapes — numbered grep hits (`120: bash: …`), prose (the
+    // phrase mid-sentence behind an article), quoted text — are excluded.
+    // Cheap line-local checks; fail-safe either way (a false negative means
+    // the rung fires once more; a false positive means one dialog too many).
+    for (const line of output.split("\n")) {
+        const t = line.trim();
+        if (!/operation not permitted|\bEPERM\b/i.test(t))
+            continue;
+        // Numbered log/grep hit lines quote the denial; they are data.
+        if (/^\d+:/.test(t))
+            continue;
+        // Quoted text (the phrase inside a leading quote mark) — data.
+        if (/^["']/.test(t))
+            continue;
+        // Prose: the phrase sits mid-sentence behind an article/conjunction
+        // with NO word-separator before it (`the sandbox may print operation
+        // not permitted…`). A `word:` separator anywhere before the phrase
+        // is the diagnostic shape and overrides the prose read.
+        const phraseAt = t.search(/operation not permitted|\bEPERM\b/i);
+        const before = phraseAt > 0 ? t.slice(0, phraseAt) : "";
+        if (!/^["']?[\w.+-]+:/.test(before) && /^(the|a|an|this|that|it|when|if|note|tip|for|some)\b/i.test(t))
+            continue;
+        return true;
+    }
+    return networkDenialHint(output) !== null;
+}
 /**
  * Detect "Operation not permitted" style sandbox denials in bash output so
  * callers (tool_result) can annotate and the model can react. Returns the

package/dist/extension/sandbox/panel.d.ts

@@ -47,6 +47,9 @@ export interface SandboxPanelState {
         prefix: string;
         n: number;
     }[];
+    /** Session grant census (telemetry-only): per-grant match counts for the
+     * never-matched surfacing. Absent/empty ⇒ no grants section. */
+    grantCensus?: import("../permission/grantCensus.js").GrantCensusEntry[];
 }
 export interface SandboxPanelActions {
     /** Persist a mode choice. Resolves with the confirmation to surface
@@ -151,7 +154,10 @@ export declare function buildPanelState(settings: SandboxSettings, sessionToggle
 }, escapes?: {
     prefix: string;
     n: number;
-}[]): SandboxPanelState;
+}[], grantCensus?: import("../permission/grantCensus.js").GrantCensusEntry[]): SandboxPanelState;
+/** The grants section rows: match counts + the never-matched label. Null
+ * when the census is empty (no saved grants — the section stays hidden). */
+export declare function grantCensusRows(census: import("../permission/grantCensus.js").GrantCensusEntry[] | undefined): string[] | null;
 /** The /sandbox row for the escape tally: null when no escapes (silent). */
 export declare function escapeTallyRow(escapes: {
     prefix: string;

package/dist/extension/sandbox/panel.js

@@ -210,6 +210,10 @@ export function configSections(state) {
     if (escapeRow) {
         sections.push({ title: "Unsandboxed Retries", detail: [escapeRow] });
     }
+    const grantRows = grantCensusRows(state.grantCensus);
+    if (grantRows) {
+        sections.push({ title: "Saved Grants (this session)", detail: grantRows });
+    }
     return sections;
 }
 /** Tabs offered, mirroring Claude plus our Network tab (the deliberate
@@ -493,7 +497,7 @@ export class SandboxPanel extends Container {
  * Build the panel state from the pieces session.ts already holds. Exported
  * for unit tests; the TUI component consumes it.
  */
-export function buildPanelState(settings, sessionToggledOff, rules, paths, sessionGrants, dependencyStatus, escapes) {
+export function buildPanelState(settings, sessionToggledOff, rules, paths, sessionGrants, dependencyStatus, escapes, grantCensus) {
     return {
         settings,
         sessionToggledOff,
@@ -502,8 +506,20 @@ export function buildPanelState(settings, sessionToggledOff, rules, paths, sessi
         merge: mergeRulesIntoSandbox(settings, rules, paths, resolveWorktreeGitAccess(paths.cwd)),
         sessionGrants: [...sessionGrants],
         ...(escapes && escapes.length > 0 ? { escapes } : {}),
+        ...(grantCensus && grantCensus.length > 0 ? { grantCensus } : {}),
     };
 }
+/** The grants section rows: match counts + the never-matched label. Null
+ * when the census is empty (no saved grants — the section stays hidden). */
+export function grantCensusRows(census) {
+    if (!census || census.length === 0)
+        return null;
+    const rows = census.slice(0, 8).map((entry) => entry.matches > 0
+        ? `${entry.label}: matched ${entry.matches}${entry.matches === 1 ? " time" : " times"} this session`
+        : `${entry.label}: never matched this session`);
+    const more = census.length > 8 ? [`+${census.length - 8} more`] : [];
+    return [...rows, ...more];
+}
 /** The /sandbox row for the escape tally: null when no escapes (silent). */
 export function escapeTallyRow(escapes) {
     if (!escapes || escapes.length === 0)

package/dist/extension/sandbox/session.d.ts

@@ -90,6 +90,10 @@ export interface RegisterSandboxOptions {
         prefix: string;
         n: number;
     }[];
+    /** The session grant census (telemetry-only): per-grant match counts for
+     * the /sandbox panel's grants section — the never-matched surfacing.
+     * Absent ⇒ no grants section. */
+    grantCensus?: () => import("../permission/grantCensus.js").GrantCensusEntry[];
 }
 /**
  * Register the sandbox surfaces on the ExtensionAPI. Returns the session

package/dist/extension/sandbox/session.js

@@ -25,7 +25,7 @@ import { loadSandboxSettings } from "./config.js";
 import { resolveWorktreeGitAccess } from "./worktreeGit.js";
 import { annotateCommandOutput, fsDenialHint, makeSandboxSpawnHook, networkDenialHint, preWrappedCommand, shouldUseSandbox, shouldUseSandboxForUserCommand, } from "./bash.js";
 import { YagniSandboxManager } from "./manager.js";
-import { SandboxPanel, buildPanelState, engineeringPresetBlock } from "./panel.js";
+import { SandboxPanel, buildPanelState, engineeringPresetBlock, grantCensusRows } from "./panel.js";
 import { effectiveRules } from "../permissionRules/loadConfig.js";
 /**
  * Build the sandbox bash composition: given ANY stock bash definition (pi's
@@ -558,6 +558,11 @@ export function registerSandbox(pi, opts) {
             lines.push(`session grants: ${[...sessionDomainGrants].join(", ")} (memory-only)`);
         if (s.excludedCommands?.length)
             lines.push(`excludedCommands: ${s.excludedCommands.join(", ")}`);
+        // The grant census rows (never-matched surfacing) — same content the
+        // panel's grants section renders.
+        const grantRows = grantCensusRows(opts.grantCensus?.());
+        if (grantRows)
+            lines.push(...grantRows);
         return lines;
     };
     /**
@@ -675,7 +680,7 @@ export function registerSandbox(pi, opts) {
             userStateHome: resolvedStateHome,
             projectRoot: opts.projectRoot ?? null,
             homeDir: opts.userHome,
-        }, [...sessionDomainGrants], deps, opts.escapeBreakdown?.());
+        }, [...sessionDomainGrants], deps, opts.escapeBreakdown?.(), opts.grantCensus?.());
         const actions = {
             onModeSelect: async (choice) => {
                 const wasEnabled = load().enabled === true;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yagni-app/code-staging",
-  "version": "1.1.2-staging.1370.1",
+  "version": "1.1.2-staging.1372.1",
   "description": "YAGNI Code: a terminal coding agent that already knows your company. One YAGNI login routes the model and grounds the agent in your team's context.",
   "license": "SEE LICENSE IN LICENSE.md",
   "author": "YAGNI, Inc. <jack@yagni.app> (https://yagni.app)",
@@ -58,5 +58,5 @@
     "turndown": "^7.2.4",
     "typebox": "^1.3.15"
   },
-  "yagniSourceSha": "2f7255058068c24ee9b070aec43e23b4fc32fb39"
+  "yagniSourceSha": "2eb361867f2478b0c87963dd560acde18ff5ecf6"
 }