@yagni-app/code-staging 1.1.4-staging.1384.1 → 1.1.4-staging.1387.1

package/dist/extension/condensedTools.js

@@ -28,6 +28,7 @@ import * as os from "node:os";
 import * as path from "node:path";
 import { createBashToolDefinition, createEditToolDefinition, createFindToolDefinition, createGrepToolDefinition, createLsToolDefinition, createReadToolDefinition, createWriteToolDefinition, getAgentDir, getLanguageFromPath, highlightCode, renderDiff, SettingsManager, } from "@earendil-works/pi-coding-agent";
 import { Container, Text } from "@earendil-works/pi-tui";
+import { logEvent } from "./errorSink.js";
 import { ReadStateTracker, READ_FIRST_ERROR, readIsPartial, readTextOf, STALE_ERROR } from "./fileGuards.js";
 import { isQuiet, kindForTool, ToolRunTracker } from "./toolRuns.js";
 /** Lines of write content shown collapsed (mirrors Claude Code's preview). */
@@ -388,8 +389,23 @@ export function registerCondensedTools(pi, deps = {}) {
                 // nothing — its content is error text, not the file — and must not
                 // clobber a prior good record of the same path.
                 if (name === "read" && target && !isErrorResult(result)) {
-                    const partial = readIsPartial({ path: args.path, offset: args.offset, limit: args.limit }, result.details ?? undefined);
-                    await readState.recordRead(target, cwd, readTextOf(result), partial);
+                    // An image read carries an image part whose "content" is a
+                    // processing note, not the file — never record it (Claude Code
+                    // never stores image reads in readFileState either). The skip
+                    // rides the trail so a later read-first refusal on an image-read
+                    // path is diagnosable instead of confusing.
+                    if (hasImages(result)) {
+                        logEvent({
+                            source: "condensedTools",
+                            level: "info",
+                            event: "read_record_skipped_image",
+                            fields: {},
+                        });
+                    }
+                    else {
+                        const partial = readIsPartial({ path: args.path, offset: args.offset, limit: args.limit }, result.details ?? undefined);
+                        await readState.recordRead(target, cwd, readTextOf(result), partial);
+                    }
                 }
                 else if (name === "write" && target && typeof args.content === "string" && !isErrorResult(result)) {
                     await readState.recordWrite(target, cwd, args.content);

package/dist/extension/config.d.ts

@@ -206,12 +206,15 @@ export declare function sanitizeCallerSegment(name: string, maxLength?: number):
  * Attribution headers for the boot-time /context fetch. Extends
  * {@link attributionHeaders} (session id + caller) with the surface the
  * session is painting for (the desktop driver sets YAGNI_SURFACE=desktop;
- * the terminal CLI sets nothing) and the shipping client version. The server
- * uses these to emit its "YAGNI Code Session Started" analytics event —
- * labels only on that side: a missing or malformed value can never fail the
- * fetch, it just goes uncounted or unversioned.
+ * the terminal CLI sets nothing), the shipping client version, and — when
+ * known — whether the OS-level bash sandbox was active at session start
+ * ("1"/"0"; omitted when the resolved state is unknown, e.g. eval mode or an
+ * unsupported platform, so the server never reads "off" as "unknown"). The
+ * server uses these to emit its "YAGNI Code Session Started" analytics
+ * event — labels only on that side: a missing or malformed value can never
+ * fail the fetch, it just goes uncounted or unversioned.
  */
-export declare function sessionTelemetryHeaders(env?: NodeJS.ProcessEnv): Record<string, string>;
+export declare function sessionTelemetryHeaders(env?: NodeJS.ProcessEnv, sandboxActive?: boolean): Record<string, string>;
 /** Options for {@link fetchContextBrief}. */
 export interface FetchContextBriefOptions {
     baseUrl: string;
@@ -219,6 +222,12 @@ export interface FetchContextBriefOptions {
     fetchImpl?: typeof fetch;
     /** Env seam for the telemetry headers; defaults to process.env. */
     env?: NodeJS.ProcessEnv;
+    /**
+     * Whether the OS-level bash sandbox was active at session start. Absent
+     * (undefined) when unknown — eval mode, unsupported platform, or a null
+     * sandbox handle — so the header is omitted rather than misreporting off.
+     */
+    sandboxActive?: boolean;
     /**
      * The session repo (`owner/name`), when resolvable. Rides as `?repo=` so
      * the response can carry `repoDecisionCount` for the mining beat — no

package/dist/extension/config.js

@@ -193,17 +193,23 @@ const CLIENT_VERSION_RE = /^[0-9a-z][0-9a-z.+-]{0,31}$/i;
  * Attribution headers for the boot-time /context fetch. Extends
  * {@link attributionHeaders} (session id + caller) with the surface the
  * session is painting for (the desktop driver sets YAGNI_SURFACE=desktop;
- * the terminal CLI sets nothing) and the shipping client version. The server
- * uses these to emit its "YAGNI Code Session Started" analytics event —
- * labels only on that side: a missing or malformed value can never fail the
- * fetch, it just goes uncounted or unversioned.
+ * the terminal CLI sets nothing), the shipping client version, and — when
+ * known — whether the OS-level bash sandbox was active at session start
+ * ("1"/"0"; omitted when the resolved state is unknown, e.g. eval mode or an
+ * unsupported platform, so the server never reads "off" as "unknown"). The
+ * server uses these to emit its "YAGNI Code Session Started" analytics
+ * event — labels only on that side: a missing or malformed value can never
+ * fail the fetch, it just goes uncounted or unversioned.
  */
-export function sessionTelemetryHeaders(env = process.env) {
+export function sessionTelemetryHeaders(env = process.env, sandboxActive) {
     const headers = attributionHeaders(env);
     headers["x-yagni-surface"] = env.YAGNI_SURFACE === "desktop" ? "desktop" : "cli";
     const version = env.YAGNI_CODE_VERSION ?? "";
     if (CLIENT_VERSION_RE.test(version))
         headers["x-yagni-client-version"] = version;
+    if (sandboxActive !== undefined) {
+        headers["x-yagni-sandbox-active"] = sandboxActive ? "1" : "0";
+    }
     return headers;
 }
 /**
@@ -220,7 +226,7 @@ export async function fetchContextBrief(opts) {
             method: "GET",
             headers: {
                 authorization: `Bearer ${opts.getToken() ?? ""}`,
-                ...sessionTelemetryHeaders(opts.env),
+                ...sessionTelemetryHeaders(opts.env, opts.sandboxActive),
             },
         }, { fetchImpl: opts.fetchImpl });
         if (!res.ok)

package/dist/extension/fileGuards.d.ts

@@ -9,10 +9,17 @@
  * model has not read in this session, and refuse again when the file
  * changed on disk since that read (mtime, with a content-compare fallback
  * so a spurious timestamp bump — cloud sync, antivirus, `utimes` noise —
- * does not produce a false refusal on a full read). New-file creates and
- * partial reads follow Claude Code exactly: a create needs no prior read;
- * an offset/limit or truncated read does NOT satisfy the read-first
- * requirement (`isPartialView`).
+ * does not produce a false refusal on a full read). New-file creates
+ * follow Claude Code exactly: a create needs no prior read. ANY
+ * successful read — windowed (offset/limit) or truncated — satisfies
+ * read-first, matching Claude Code, whose Read tool never marks a
+ * partial view (its `isPartialView` exists only for auto-injected memory
+ * content that differs from disk, a path this tracker does not record).
+ * The `partial` classification instead selects the staleness strategy:
+ * a full read's record holds the whole file, so a bumped mtime can be
+ * content-compared before refusing; a partial record holds only a slice
+ * (with pi's continuation notice appended), so a bumped mtime refuses
+ * outright — Claude Code's exact stance for offset/limit reads.
  *
  * Fail-open contract: any guard-internal filesystem error that is not one
  * of the two refusals (EACCES, EMFILE, a racing delete, ...) delegates

package/dist/extension/fileGuards.js

@@ -9,10 +9,17 @@
  * model has not read in this session, and refuse again when the file
  * changed on disk since that read (mtime, with a content-compare fallback
  * so a spurious timestamp bump — cloud sync, antivirus, `utimes` noise —
- * does not produce a false refusal on a full read). New-file creates and
- * partial reads follow Claude Code exactly: a create needs no prior read;
- * an offset/limit or truncated read does NOT satisfy the read-first
- * requirement (`isPartialView`).
+ * does not produce a false refusal on a full read). New-file creates
+ * follow Claude Code exactly: a create needs no prior read. ANY
+ * successful read — windowed (offset/limit) or truncated — satisfies
+ * read-first, matching Claude Code, whose Read tool never marks a
+ * partial view (its `isPartialView` exists only for auto-injected memory
+ * content that differs from disk, a path this tracker does not record).
+ * The `partial` classification instead selects the staleness strategy:
+ * a full read's record holds the whole file, so a bumped mtime can be
+ * content-compared before refusing; a partial record holds only a slice
+ * (with pi's continuation notice appended), so a bumped mtime refuses
+ * outright — Claude Code's exact stance for offset/limit reads.
  *
  * Fail-open contract: any guard-internal filesystem error that is not one
  * of the two refusals (EACCES, EMFILE, a racing delete, ...) delegates
@@ -167,38 +174,43 @@ export class ReadStateTracker {
             throw error; // unknown fs failure — the wrapper fails open
         }
         const record = this.reads.get(key);
-        if (!record || record.partial) {
+        if (!record) {
             throw new Error(READ_FIRST_ERROR);
         }
-        if (Math.floor(mtimeMs) > record.mtimeMs) {
-            // Timestamp moved, but on some platforms (cloud sync, antivirus) it
-            // moves without content changes. For a full read, compare content
-            // before refusing — Claude Code's exact fallback. The record holds
-            // the read tool's exact output and pi returns file bytes verbatim,
-            // so identical content compares byte-equal.
-            let onDisk;
-            try {
-                onDisk = await (this.io.readFile ?? readTextFile)(key);
-            }
-            catch (error) {
-                // Unreadable now, but the read succeeded then — stale — but the real
-                // cause (EACCES/EIO on the re-read, not an edit) rides the trail so
-                // the refusal is not misdiagnosed as a content change.
-                logEvent({
-                    source: "fileGuards",
-                    level: "info",
-                    event: "staleness_reread_failed",
-                    fields: { code: error?.code ?? "unknown" },
-                });
-                throw new Error(STALE_ERROR);
-            }
-            if (onDisk !== record.content) {
-                throw new Error(STALE_ERROR);
-            }
-            // Content-identical: refresh the record so the next write's mtime
-            // comparison uses the bumped timestamp instead of refusing again.
-            this.reads.set(key, { ...record, mtimeMs: Math.floor(mtimeMs) });
+        if (Math.floor(mtimeMs) <= record.mtimeMs)
+            return; // not stale
+        // The timestamp moved. A partial record holds only a slice (plus pi's
+        // continuation notice), so it cannot be content-compared — refuse
+        // outright, Claude Code's stance for offset/limit reads.
+        if (record.partial) {
+            throw new Error(STALE_ERROR);
+        }
+        // For a full read, compare content before refusing — Claude Code's exact
+        // fallback: on some platforms (cloud sync, antivirus) the timestamp moves
+        // without content changes. The record holds the read tool's exact output
+        // and pi returns file bytes verbatim, so identical content compares equal.
+        let onDisk;
+        try {
+            onDisk = await (this.io.readFile ?? readTextFile)(key);
+        }
+        catch (error) {
+            // Unreadable now, but the read succeeded then — stale — but the real
+            // cause (EACCES/EIO on the re-read, not an edit) rides the trail so
+            // the refusal is not misdiagnosed as a content change.
+            logEvent({
+                source: "fileGuards",
+                level: "info",
+                event: "staleness_reread_failed",
+                fields: { code: error?.code ?? "unknown" },
+            });
+            throw new Error(STALE_ERROR);
+        }
+        if (onDisk !== record.content) {
+            throw new Error(STALE_ERROR);
         }
+        // Content-identical: refresh the record so the next write's mtime
+        // comparison uses the bumped timestamp instead of refusing again.
+        this.reads.set(key, { ...record, mtimeMs: Math.floor(mtimeMs) });
     }
     isInside(absolute, base) {
         const slashed = (p) => p.replace(/\\/g, "/");

package/dist/extension/index.d.ts

@@ -42,6 +42,7 @@ export interface RegisterYagniDeps {
         getToken: () => string | undefined;
         fetchImpl?: typeof fetch;
         repo?: string;
+        sandboxActive?: boolean;
     }) => Promise<ContextBrief | null>;
     /**
      * The session repo (`owner/name`), resolved from the origin remote before

package/dist/extension/index.js

@@ -1192,6 +1192,21 @@ export async function registerYagni(pi, deps = {}) {
     }
     let contextBrief;
     let briefResult = null;
+    // Session-start sandbox snapshot: a CONFIGURED-ENABLED snapshot, with the
+    // one divergence that is knowable at factory time folded in — the
+    // passthrough --no-sandbox flag, read from pi's own command line (pi
+    // applies extension flag values AFTER extension load, so pi.getFlag
+    // reads unset here; argv is the one reliable pre-session view). Omitted
+    // (undefined) when there is no handle — eval mode or an unsupported
+    // platform — so the telemetry header is absent rather than misreporting
+    // off. Known remainders, both accepted: a sandbox init FAILURE at
+    // session_start (missing deps) still reports true here (logged as
+    // init_failed in the local sink; rare broken-deps territory), and
+    // mid-session /sandbox toggles are out of scope — the per-call Guardian
+    // events remain the ground truth for both.
+    const sandboxActive = sandboxHandle && !process.argv.includes("--no-sandbox")
+        ? sandboxHandle.settings().enabled === true
+        : undefined;
     if (!evalMode) {
         try {
             briefResult = await fetchBrief({
@@ -1199,6 +1214,7 @@ export async function registerYagni(pi, deps = {}) {
                 getToken: getTokenFn,
                 fetchImpl: authedFetch,
                 repo: sessionRepo,
+                sandboxActive,
             });
             contextBrief = briefResult?.brief?.trim() ? briefResult.brief : undefined;
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yagni-app/code-staging",
-  "version": "1.1.4-staging.1384.1",
+  "version": "1.1.4-staging.1387.1",
   "description": "YAGNI Code: a terminal coding agent that already knows your company. One YAGNI login routes the model and grounds the agent in your team's context.",
   "license": "SEE LICENSE IN LICENSE.md",
   "author": "YAGNI, Inc. <jack@yagni.app> (https://yagni.app)",
@@ -58,5 +58,5 @@
     "turndown": "^7.2.4",
     "typebox": "^1.3.15"
   },
-  "yagniSourceSha": "b8f4ca30233d5e288a98b18dca6931a6da9973dc"
+  "yagniSourceSha": "e8e7f5d88707ad223e9cbeb16216b80239af3224"
 }