@yagni-app/code-staging 1.1.4-staging.1416.1 → 1.1.4-staging.1420.1

package/dist/extension/index.js

@@ -17,7 +17,7 @@ import { makeRecordDecisionTool } from "./recordDecisionTool.js";
 import { makeSuggestNextWorkTool } from "./nextWorkTool.js";
 import { BRAND_NAME, brandSystemPrompt, brandingDisabled, buildMastheadString, YAGNI_IDENTITY_DRIVER, YAGNI_IDENTITY_DRIVER_GROUNDING_FREE, YAGNI_IDENTITY_GROUNDING_FREE, YAGNI_IDENTITY_ULTRA, YAGNI_IDENTITY_ULTRA_GROUNDING_FREE } from "./branding.js";
 import { claudeRulesSection } from "./claudeRules.js";
-import { ensureScratchpadDir, SCRATCHPAD_TMPDIR_ENV, scratchpadDir as scratchpadDirFor, scratchpadSection } from "./scratchpad.js";
+import { ensureScratchpadDir, SCRATCHPAD_TMPDIR_ENV, scratchpadDir as scratchpadDirFor, scratchpadOwnerRootFor, scratchpadSection } from "./scratchpad.js";
 import { registerCostCommand } from "./costHud.js";
 import { isDebug } from "./diagnostics.js";
 import { logEvent } from "./errorSink.js";
@@ -1339,24 +1339,69 @@ export async function registerYagni(pi, deps = {}) {
     // so the very first turn already carries the section. Fails closed: no
     // sessionId (a bare pi run) or a failed mkdir means no section, and the mkdir
     // failure is logged so a missing scratchpad is not silent.
+    const scratchpadTmpRoot = env[SCRATCHPAD_TMPDIR_ENV] || undefined;
     const scratchpadDirPath = scratchpadDirFor({
         sessionId: env.YAGNI_SESSION_ID ?? undefined,
         cwd: process.cwd(),
-        tmp: env[SCRATCHPAD_TMPDIR_ENV] || undefined,
+        tmp: scratchpadTmpRoot,
     });
     let scratchpadSectionText;
     if (scratchpadDirPath) {
-        const ensured = ensureScratchpadDir(scratchpadDirPath);
+        const ensured = ensureScratchpadDir(scratchpadDirPath, undefined, {
+            onError: (errorCode) => {
+                logEvent({
+                    source: "scratchpad",
+                    level: "error",
+                    event: "scratchpad_mkdir_failed",
+                    sessionId: env.YAGNI_SESSION_ID ?? undefined,
+                    fields: { path: scratchpadDirPath, errorCode },
+                });
+            },
+        });
         if (ensured) {
             scratchpadSectionText = scratchpadSection(ensured);
-        }
-        else {
-            logEvent({
-                source: "scratchpad",
-                level: "error",
-                event: "scratchpad_mkdir_failed",
-                sessionId: env.YAGNI_SESSION_ID ?? undefined,
-            });
+            // Claude Code parity: srt reads CLAUDE_CODE_TMPDIR from THIS process's
+            // env when wrapping a sandboxed bash command and forces the child's
+            // TMPDIR onto it. Point it at the per-user scratchpad OWNER ROOT (not
+            // the scratchpad itself) so sandboxed-bash temp files land in the same
+            // per-user tree the scratchpad lives in, under a path SHORT enough for
+            // named unix-socket binds (the test-runner IPC pattern — a deep
+            // scratchpad TMPDIR trips macOS's 104-char sun_path limit with EINVAL).
+            // The scratchpad remains the sanctioned staging place by PRIORITY (the
+            // prompt section outranks $TMPDIR), not by path convergence.
+            //
+            // Production note: children (subagents, /go stages) inherit this env
+            // because `env` IS process.env there and the runner spawns with it. A
+            // harness injecting deps.env sees the write only in that object —
+            // spawned children of such a harness do not, by construction of the
+            // runner's own env seam.
+            //
+            // Unset when there is no scratchpad (no session id, or the mkdir
+            // failed) — srt keeps its /tmp/claude default and nothing changes for
+            // those sessions.
+            if (!env.CLAUDE_CODE_TMPDIR) {
+                const ownerRoot = scratchpadOwnerRootFor({ tmp: scratchpadTmpRoot });
+                env.CLAUDE_CODE_TMPDIR = ownerRoot;
+                logEvent({
+                    source: "scratchpad",
+                    level: "info",
+                    event: "scratchpad_tmpdir_pinned",
+                    sessionId: env.YAGNI_SESSION_ID ?? undefined,
+                    fields: { path: ownerRoot },
+                });
+            }
+            else {
+                // The trail must distinguish "pinned" from "respected an operator
+                // override" — no path value here (the explicit value is the
+                // operator's, not ours to echo).
+                logEvent({
+                    source: "scratchpad",
+                    level: "info",
+                    event: "scratchpad_tmpdir_pin_skipped",
+                    sessionId: env.YAGNI_SESSION_ID ?? undefined,
+                    fields: {},
+                });
+            }
         }
     }
     // The condensed Claude Code-style transcript: the seven built-ins re-render

package/dist/extension/permission/approvedPrefixes.d.ts

@@ -151,6 +151,71 @@ export declare function matchesCompoundGrants(command: string, grants: readonly
 export declare function validateGrant(command: string, policy: ExecPolicy, repoKey: string): ApprovedPrefixGrant | null;
 /** Human label for the remember option: "git push …". */
 export declare function describePrefix(pattern: string[]): string;
+/**
+ * The custom-prefix field's seed (the editable input's initial value —
+ * Claude's initialValue): the prefix the user most plausibly wants to
+ * narrow. Single command → its own derived prefix; compound → the first
+ * PROMPT-BAND uncovered segment's prefix (Claude parity: their compound
+ * suggestions name only the segments needing approval — a `cd`/read-only
+ * rider is not what the user is being asked about). Falls back to the raw
+ * command only when nothing derivable exists (Claude's editable-field
+ * final fallback — the user narrows from the full text). NEVER the
+ * multi-seed join: "cd git push grep" is not a prefix of anything and
+ * editing it from scratch is the dead-end the field exists to prevent.
+ * PURE — a throwing classify counts as seedable (the LADDER fences, the
+ * seed does not).
+ */
+export declare function describeSeedPrefix(command: string, uncoveredSegments: readonly string[], policy: ExecPolicy): string;
+/**
+ * The custom-prefix acceptance unit (the decision-(a) fill): given the
+ * user's typed word (as a grant) and the command it was typed for, return
+ * the complete remember unit — the word's grant PLUS the ladder's
+ * self-match-proved seeds for every REMAINING uncovered segment — or null
+ * when the word covers nothing, a segment stays unfillable, or the filled
+ * set cannot cover the whole compound. PURE — extracted from the gate so
+ * every exclusion branch is directly testable. The unit is ONE decision
+ * (saved atomically at the gate); persistence itself is per-grant
+ * fail-soft, the same pattern as the multi-seed remember path.
+ *
+ * The user-typed grant must already carry repoKey (it matches at evaluation
+ * time); the returned unit's fill seeds carry repoKey/addedAt/cwd, ready
+ * to persist.
+ */
+export declare function computeCustomPrefixUnit(args: {
+    command: string;
+    customGrant: ApprovedPrefixGrant;
+    existingGrants: readonly ApprovedPrefixGrant[];
+    uncoveredCount: number;
+    policy: ExecPolicy;
+    repoKey: string;
+    cwd: string;
+    /** The ladder's fill preview for this command (validateGrantForEscape's
+     * token seeds, repoKey/addedAt/cwd already filled) — the SAME preview the
+     * gate uses for the title disclosure, passed in so the ladder runs ONCE
+     * per ask and disclosure/save agreement is structural, not incidental.
+     * Absent → computed here (tests can drive the seam standalone). */
+    fillSeeds?: readonly ApprovedPrefixGrant[];
+}): ApprovedPrefixGrant[] | null;
+/**
+ * The custom-prefix dialog's TITLE, derived from the SEED word (the
+ * overwhelmingly common case: the field opens pre-filled, and the user
+ * keeps or edits around it). The disclosure predicts the actual unit for
+ * the seed — running the same acceptance seam (computeCustomPrefixUnit)
+ * the save will run — so the title advertises exactly what persisting the
+ * seed would save, minus the seed's own grant. A user who types a wildly
+ * different word gets the after-the-fact save-notify naming the real unit.
+ * Returns null when no fill rides along (single commands, or the seed
+ * already covers everything) — the plain title.
+ * PURE.
+ */
+export declare function describeCustomPrefixFill(command: string, seed: string, args: {
+    existingGrants: readonly ApprovedPrefixGrant[];
+    uncoveredCount: number;
+    policy: ExecPolicy;
+    repoKey: string;
+    cwd: string;
+    fillSeeds: readonly ApprovedPrefixGrant[];
+}): string[] | null;
 /** Preserve the command and output target before a heredoc marker. */
 export declare function heredocPrefix(command: string): string | null;
 /**

package/dist/extension/permission/approvedPrefixes.js

@@ -441,6 +441,144 @@ export function validateGrant(command, policy, repoKey) {
 export function describePrefix(pattern) {
     return `${pattern.join(" ")} …`;
 }
+/**
+ * The custom-prefix field's seed (the editable input's initial value —
+ * Claude's initialValue): the prefix the user most plausibly wants to
+ * narrow. Single command → its own derived prefix; compound → the first
+ * PROMPT-BAND uncovered segment's prefix (Claude parity: their compound
+ * suggestions name only the segments needing approval — a `cd`/read-only
+ * rider is not what the user is being asked about). Falls back to the raw
+ * command only when nothing derivable exists (Claude's editable-field
+ * final fallback — the user narrows from the full text). NEVER the
+ * multi-seed join: "cd git push grep" is not a prefix of anything and
+ * editing it from scratch is the dead-end the field exists to prevent.
+ * PURE — a throwing classify counts as seedable (the LADDER fences, the
+ * seed does not).
+ */
+export function describeSeedPrefix(command, uncoveredSegments, policy) {
+    if (isSinglePlainCommand(command)) {
+        const pattern = derivePrefix(command);
+        if (pattern)
+            return pattern.join(" ");
+    }
+    // Compound (or a non-derivable single): the first prompt-band uncovered
+    // segment's prefix, skipping read-only riders (cd, cat, ls — the
+    // allow-classified segments the user is not being asked about). Each
+    // segment is CANONICALIZED first (the ladder's own posture): the raw
+    // segments arrive quote-preserving, so `git push 2>&1` reads as
+    // `git push 2>'&1'` — an operator-carrying string that neither
+    // classifies nor derives; canonicalization strips the safe redirect the
+    // same way matching will.
+    for (const seg of uncoveredSegments) {
+        const canonical = canonicalizeForGrants(seg);
+        if (!canonical || !isSinglePlainCommand(canonical))
+            continue;
+        let readonlySegment = false;
+        try {
+            readonlySegment = classifyCommand(canonical, policy).decision === "allow";
+        }
+        catch {
+            // classify-error counts as seedable — the ladder fences.
+        }
+        if (readonlySegment)
+            continue;
+        const pattern = derivePrefix(canonical);
+        if (pattern)
+            return pattern.join(" ");
+    }
+    return command;
+}
+/**
+ * The custom-prefix acceptance unit (the decision-(a) fill): given the
+ * user's typed word (as a grant) and the command it was typed for, return
+ * the complete remember unit — the word's grant PLUS the ladder's
+ * self-match-proved seeds for every REMAINING uncovered segment — or null
+ * when the word covers nothing, a segment stays unfillable, or the filled
+ * set cannot cover the whole compound. PURE — extracted from the gate so
+ * every exclusion branch is directly testable. The unit is ONE decision
+ * (saved atomically at the gate); persistence itself is per-grant
+ * fail-soft, the same pattern as the multi-seed remember path.
+ *
+ * The user-typed grant must already carry repoKey (it matches at evaluation
+ * time); the returned unit's fill seeds carry repoKey/addedAt/cwd, ready
+ * to persist.
+ */
+export function computeCustomPrefixUnit(args) {
+    const { command, customGrant, existingGrants, uncoveredCount, policy, repoKey, cwd } = args;
+    // Non-token (literal) custom inputs keep the single-grant proof.
+    if (customGrant.pattern.length === 0) {
+        return matchesGrant(command, [customGrant], repoKey) ? [customGrant] : null;
+    }
+    const ev = evaluateCompoundForEscape(command, [...existingGrants, customGrant], repoKey, policy);
+    if (ev.forbidden)
+        return null;
+    if (ev.uncovered.length === 0)
+        return [customGrant];
+    // The word must cover AT LEAST ONE segment of this command — a word
+    // unrelated to every segment (typed "zzz" for a pnpm compound) is a dead
+    // grant no fill can legitimize; refuse it. The fill exists to cover the
+    // SIBLINGS of the user's word, never to smuggle it in.
+    if (ev.uncovered.length >= uncoveredCount)
+        return null;
+    // Fill from the ladder: seeds for the remaining uncovered segments. The
+    // ladder's seeds are hypothetical (empty repoKey) — fill repoKey/addedAt/
+    // cwd BEFORE the recheck so grant matching sees them as real grants for
+    // THIS repo, exactly as the remember resolution does.
+    const fillSeeds = args.fillSeeds ?? (validateGrantForEscape(command, policy, repoKey)?.seeds ?? [])
+        .filter((sd) => sd.pattern.length > 0)
+        .map((sd) => ({ ...sd, repoKey, addedAt: new Date().toISOString(), cwd }));
+    // A fill with no token seeds cannot complete the unit — refuse (the
+    // ladder's literal rung is not a token fill; the shapes it covers are
+    // the heredoc class, which the honest warn + re-offer handles).
+    if (fillSeeds.length === 0)
+        return null;
+    const recheck = evaluateCompoundForEscape(command, [...existingGrants, customGrant, ...fillSeeds], repoKey, policy);
+    if (recheck.forbidden || recheck.uncovered.length > 0)
+        return null;
+    // Dedupe: when the typed word is itself the derivable prefix of its
+    // segment (the common case — typing "git push"), the fill re-derives the
+    // same pattern. One grant per distinct pattern.
+    const seen = new Set();
+    const unit = [];
+    for (const grant of [customGrant, ...fillSeeds]) {
+        const key = grant.pattern.join(" ");
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        unit.push(grant);
+    }
+    return unit;
+}
+/**
+ * The custom-prefix dialog's TITLE, derived from the SEED word (the
+ * overwhelmingly common case: the field opens pre-filled, and the user
+ * keeps or edits around it). The disclosure predicts the actual unit for
+ * the seed — running the same acceptance seam (computeCustomPrefixUnit)
+ * the save will run — so the title advertises exactly what persisting the
+ * seed would save, minus the seed's own grant. A user who types a wildly
+ * different word gets the after-the-fact save-notify naming the real unit.
+ * Returns null when no fill rides along (single commands, or the seed
+ * already covers everything) — the plain title.
+ * PURE.
+ */
+export function describeCustomPrefixFill(command, seed, args) {
+    const seedPattern = derivePrefix(seed);
+    if (!seedPattern)
+        return null;
+    const seedGrant = {
+        pattern: seedPattern,
+        repoKey: args.repoKey,
+        addedAt: new Date().toISOString(),
+        cwd: args.cwd,
+    };
+    const unit = computeCustomPrefixUnit({ command, customGrant: seedGrant, ...args });
+    if (!unit)
+        return null;
+    const fill = unit
+        .filter((g) => g.pattern.join(" ") !== seedPattern.join(" "))
+        .map((g) => g.pattern.join(" "));
+    return fill.length > 0 ? fill : null;
+}
 // --- Escape-flow derivation (the unsandboxed-retry consent ladder) ---
 /** Preserve the command and output target before a heredoc marker. */
 export function heredocPrefix(command) {

package/dist/extension/permission/gate.js

@@ -26,7 +26,7 @@
  * When the mode leaves plan, stale plan-context messages are filtered out of
  * the context so the model doesn't keep believing it is restricted.
  */
-import { derivePrefix, describePrefix, evaluateCompoundForEscape, matchesGrant, matchesCompoundGrants, sandboxFailureKey, storagePrefix, validateGrantForAsk, validateGrantForEscape, } from "./approvedPrefixes.js";
+import { derivePrefix, describePrefix, describeSeedPrefix, evaluateCompoundForEscape, matchesGrant, matchesCompoundGrants, sandboxFailureKey, storagePrefix, validateGrantForAsk, validateGrantForEscape, } from "./approvedPrefixes.js";
 import { consultPrefixMemoized, createPrefixMemo, PREFIX_CONSULT_GRACE_MS, segmentCannotYieldCandidate, } from "./prefixExtract.js";
 import { logEvent } from "../errorSink.js";
 import { makeBlessStore as defaultMakeBlessStore } from "../bless.js";
@@ -34,6 +34,8 @@ import { classifyCommand, DEFAULT_EXEC_POLICY } from "./execPolicy.js";
 import { evaluateRules } from "../permissionRules/engine.js";
 import { isDebug } from "../diagnostics.js";
 import { buildDiagnosticEvent, checkCircuitBreaker, DEFAULT_GUARDIAN_LIMITS, } from "./guardian.js";
+import { askCustomPrefix, CUSTOM_PREFIX_CANCELLED } from "./prefixInput.js";
+import { computeCustomPrefixUnit, describeCustomPrefixFill } from "./approvedPrefixes.js";
 export function createModeHolder(initial = "auto") {
     let current = initial;
     const listeners = new Set();
@@ -1865,18 +1867,63 @@ export function registerPermissionGate(pi, deps = {}) {
         // dismissed/user_reject.
         let retryErrored = false;
         if (!selectThrew && choice === customLabel) {
-            const seedText = seeds
-                ? (seeds.seeds[0]?.literal ?? seeds.seeds.map((s) => s.pattern.join(" ")).join(" "))
-                : command;
+            // The seed is the honest single suggestion (Claude's initialValue):
+            // the derived prefix for a single command, the first prompt-band
+            // segment's prefix for a compound — never the multi-seed join
+            // ("cd git push grep" is a prefix of nothing; the join made the
+            // field unrecognizable AND uneditable from a useful base).
+            const seedText = describeSeedPrefix(command, compound.uncovered, execPolicy);
+            // The title DISCLOSES the fill up front (informed consent, no extra
+            // click) — derived from the SEED word: the field opens pre-filled,
+            // so the disclosure predicts the actual unit the acceptance seam
+            // would save for that seed (sibling families only, minus the seed's
+            // own grant). A user who types a wildly different word still gets the
+            // after-the-fact save-notify naming the real unit. ONE ladder preview
+            // feeds both the title and the seam's fill (the gate computes it;
+            // computeCustomPrefixUnit consumes it) — the ladder runs once per
+            // ask, and disclosure/save agreement is structural.
+            const fillPreview = (validateGrantForEscape(command, execPolicy, repoKey)?.seeds ?? [])
+                .filter((sd) => sd.pattern.length > 0)
+                .map((sd) => ({ ...sd, repoKey, addedAt: new Date().toISOString(), cwd }));
+            const fillLabels = describeCustomPrefixFill(command, seedText, {
+                existingGrants: grants,
+                uncoveredCount: compound.uncovered.length,
+                policy: execPolicy,
+                repoKey,
+                cwd,
+                fillSeeds: fillPreview,
+            });
+            const unitTitle = fillLabels !== null
+                ? `Don't ask again for commands starting with (also saving: ${fillLabels.join(", ")})`
+                : "Don't ask again for commands starting with";
             let custom;
+            let cancelledInput = false;
             let inputThrew = false;
             try {
-                custom = await ctx.ui.input("Don't ask again for commands starting with", seedText, { ...(ctx.signal ? { signal: ctx.signal } : {}) });
+                const resolution = await askCustomPrefix(ctx, unitTitle, seedText);
+                if (resolution === CUSTOM_PREFIX_CANCELLED)
+                    cancelledInput = true;
+                else if (resolution !== undefined)
+                    custom = resolution;
             }
-            catch {
+            catch (err) {
                 inputThrew = true;
+                // Same discipline as every sibling dialog failure in this flow —
+                // a thrown ask (the fallback ctx.ui.input included) must leave a
+                // trail, error class only (never the thrown message). The phase
+                // discriminator is a stable non-message field so multiple ask
+                // failure lines in one turn are tellable apart.
+                logEvent({
+                    source: "permission-rules",
+                    level: "warn",
+                    event: "gate_dialog_error",
+                    fields: {
+                        error: err instanceof Error ? err.constructor.name : typeof err,
+                        phase: "custom-ask",
+                    },
+                });
             }
-            if (!inputThrew && custom !== undefined && custom.trim().length > 0) {
+            if (!inputThrew && !cancelledInput && custom !== undefined && custom.trim().length > 0) {
                 const trimmedCustom = custom.trim();
                 // The custom field accepts two shapes:
                 //  (a) a derivable token pattern — a clean command word (`npx`,
@@ -1897,24 +1944,50 @@ export function registerPermissionGate(pi, deps = {}) {
                 const customGrant = tokenPattern
                     ? { pattern: tokenPattern, repoKey, addedAt: new Date().toISOString(), cwd }
                     : { pattern: [], literal: trimmedCustom, repoKey, addedAt: new Date().toISOString(), cwd };
-                // Validation must be compound-aware: the escaped command is often a
-                // compound (`S=…; curl … && echo done`), and matchesGrant alone can
-                // never match a single token grant against a compound. A bare-word
-                // token grant is valid when EVERY segment of the compound is covered
-                // — by the token grant or an existing grant — exactly the ladder's
-                // rung-1 self-match, applied to the user's custom word.
-                const customValid = tokenPattern
-                    ? (() => {
-                        const evalPolicy = deps.policy?.execPolicy ?? DEFAULT_EXEC_POLICY;
-                        const ev = evaluateCompoundForEscape(command, [...grants, customGrant], repoKey, evalPolicy);
-                        return !ev.forbidden && ev.uncovered.length === 0;
-                    })()
-                    : matchesGrant(command, [customGrant], repoKey);
-                if (customValid) {
-                    grants.push(customGrant);
-                    persistGrantFailSoft(customGrant);
+                // Compound acceptance is FILLING, not all-or-nothing (Claude
+                // parity — their compound per-subcommand rules save as one
+                // decision; our analog: the custom word is the grant for the
+                // segment it covers, and the ladder's own self-match-proved seeds
+                // fill every REMAINING uncovered segment). Under the old
+                // all-or-nothing validation a bare word could NEVER satisfy a
+                // compound (the sibling segments stayed uncovered), so an
+                // honestly-answered field was rejected and the ask re-fired
+                // forever — the live failure this flow fixes. The unit is ONE
+                // decision saved here; persistence itself is per-grant fail-soft,
+                // the same pattern as the multi-seed remember path (a mid-loop
+                // persist failure leaves earlier grants saved — the warn trail
+                // records it). The unit computation is PURE and every exclusion
+                // branch is unit-tested directly (computeCustomPrefixUnit); a
+                // segment the ladder cannot seed (heredoc/quoted shapes) still
+                // refuses: fail closed, warn honestly, one re-offer (below).
+                const customUnit = computeCustomPrefixUnit({
+                    command,
+                    customGrant,
+                    existingGrants: grants,
+                    uncoveredCount: compound.uncovered.length,
+                    policy: execPolicy,
+                    repoKey,
+                    cwd,
+                    fillSeeds: fillPreview,
+                });
+                if (customUnit) {
+                    for (const grantRecord of customUnit) {
+                        grants.push(grantRecord);
+                        persistGrantFailSoft(grantRecord);
+                    }
                     rememberApproved(cwd, command);
                     emitGateEvent(slot, { ...eventBase, outcome: "escape_ask_approved_remembered", consulted: false, prefixConsult: foldStatus() });
+                    // Save-confirmation: the old flow's only success feedback was
+                    // silence, leaving the user asking "did it work?". Name what was
+                    // saved — the unit (custom word + filled siblings) — one line,
+                    // info tier, fail-soft.
+                    if (ctx.hasUI) {
+                        try {
+                            const savedLabels = customUnit.map((g) => g.pattern.length > 0 ? g.pattern.join(" ") : (g.literal ?? ""));
+                            ctx.ui.notify(`Saved "don't ask again" for: ${savedLabels.join(", ")}`, "info");
+                        }
+                        catch { /* notify must never gate */ }
+                    }
                     return {};
                 }
                 // A custom prefix that does not cover this command is a dead rule —

package/dist/extension/permission/prefixInput.d.ts

@@ -0,0 +1,58 @@
+/**
+ * The custom-prefix field (the escape consent flow's editable input):
+ * pi's OWN shipped ExtensionInputComponent with exactly one delta — the
+ * input is pre-filled with the derived seed (Claude's initialValue; pi's
+ * stock component drops its placeholder, so the old `ctx.ui.input` dialog
+ * arrived empty and unlabeled while the turn's working indicator kept
+ * animating — a blocked turn cosplaying as a live one, the ticket's
+ * "the model went back to work" symptom).
+ *
+ * The gate's askCustomPrefix seam: TUI mounts the seeded surface via
+ * ctx.ui.custom; every other mode (RPC, desktop, headless harnesses)
+ * falls back to plain ctx.ui.input, where the corrected seed rides the
+ * placeholder (desktop's DialogCard renders it). ctx.mode is a hard
+ * guard — pi's RPC custom() RESOLVES undefined instantly (never throws),
+ * so an unguarded call would read as a cancelled input. A THROWN or
+ * no-mount custom() falls back to the plain input dialog WITH a
+ * gate_dialog_error trail line (error class only) — a broken mount must
+ * degrade visibly, not silently.
+ */
+import { ExtensionInputComponent } from "@earendil-works/pi-coding-agent";
+import type { Component } from "@earendil-works/pi-tui";
+/** pi's input dialog, seeded. Subclass — not a reimplementation. */
+export declare class SeededExtensionInput extends ExtensionInputComponent {
+    constructor(title: string, seed: string, onSubmit: (value: string) => void, onCancel: () => void);
+}
+/**
+ * The mount's resolution. A plain string is the typed prefix; CANCELLED is
+ * the user's Esc — DISTINCT from undefined, which pi's custom() resolves
+ * with when the harness has no custom mount (a bare `return undefined`
+ * path in rpc/custom-less hosts). Conflating the two made cancel re-open
+ * the plain input dialog (the cancel-twice bug).
+ */
+export declare const CUSTOM_PREFIX_CANCELLED: unique symbol;
+export type CustomPrefixResolution = string | typeof CUSTOM_PREFIX_CANCELLED | undefined;
+/**
+ * The PRODUCTION submit mapping (shared, not duplicated): pi's component
+ * submits the raw field; this wrapper trims and maps an emptied field to
+ * the cancel sentinel (Claude's allowEmptySubmitToCancel). Exported so the
+ * gate's askCustomPrefix mount and the live-mount test install the SAME
+ * function — a production regression breaks both, per the review round.
+ */
+export declare function mapCustomPrefixSubmit(value: string): string | typeof CUSTOM_PREFIX_CANCELLED;
+type CustomMount = <T>(factory: (tui: unknown, theme: unknown, keybindings: unknown, done: (r: T) => void) => Component) => Promise<T>;
+interface AskCustomPrefixCtx {
+    mode?: string;
+    hasUI?: boolean;
+    signal?: AbortSignal;
+    ui: {
+        input: (title: string, placeholder?: string, opts?: {
+            signal?: AbortSignal;
+        }) => Promise<string | undefined>;
+        custom?: CustomMount;
+        setWorkingVisible?: (visible: boolean) => void;
+    };
+}
+export declare function askCustomPrefix(ctx: AskCustomPrefixCtx, title: string, seed: string): Promise<CustomPrefixResolution>;
+export {};
+//# sourceMappingURL=prefixInput.d.ts.map

package/dist/extension/permission/prefixInput.js

@@ -0,0 +1,101 @@
+/**
+ * The custom-prefix field (the escape consent flow's editable input):
+ * pi's OWN shipped ExtensionInputComponent with exactly one delta — the
+ * input is pre-filled with the derived seed (Claude's initialValue; pi's
+ * stock component drops its placeholder, so the old `ctx.ui.input` dialog
+ * arrived empty and unlabeled while the turn's working indicator kept
+ * animating — a blocked turn cosplaying as a live one, the ticket's
+ * "the model went back to work" symptom).
+ *
+ * The gate's askCustomPrefix seam: TUI mounts the seeded surface via
+ * ctx.ui.custom; every other mode (RPC, desktop, headless harnesses)
+ * falls back to plain ctx.ui.input, where the corrected seed rides the
+ * placeholder (desktop's DialogCard renders it). ctx.mode is a hard
+ * guard — pi's RPC custom() RESOLVES undefined instantly (never throws),
+ * so an unguarded call would read as a cancelled input. A THROWN or
+ * no-mount custom() falls back to the plain input dialog WITH a
+ * gate_dialog_error trail line (error class only) — a broken mount must
+ * degrade visibly, not silently.
+ */
+import { ExtensionInputComponent } from "@earendil-works/pi-coding-agent";
+import { logEvent } from "../errorSink.js";
+/** pi's input dialog, seeded. Subclass — not a reimplementation. */
+export class SeededExtensionInput extends ExtensionInputComponent {
+    constructor(title, seed, onSubmit, onCancel) {
+        super(title, undefined, onSubmit, onCancel, undefined);
+        // The seed is the EDITABLE INITIAL VALUE (Claude's initialValue), not a
+        // placeholder: the user narrows from a real suggestion. The only delta
+        // from pi's component.
+        this.input.setValue(seed);
+    }
+}
+/**
+ * The mount's resolution. A plain string is the typed prefix; CANCELLED is
+ * the user's Esc — DISTINCT from undefined, which pi's custom() resolves
+ * with when the harness has no custom mount (a bare `return undefined`
+ * path in rpc/custom-less hosts). Conflating the two made cancel re-open
+ * the plain input dialog (the cancel-twice bug).
+ */
+export const CUSTOM_PREFIX_CANCELLED = Symbol("custom-prefix-cancelled");
+/**
+ * The PRODUCTION submit mapping (shared, not duplicated): pi's component
+ * submits the raw field; this wrapper trims and maps an emptied field to
+ * the cancel sentinel (Claude's allowEmptySubmitToCancel). Exported so the
+ * gate's askCustomPrefix mount and the live-mount test install the SAME
+ * function — a production regression breaks both, per the review round.
+ */
+export function mapCustomPrefixSubmit(value) {
+    const trimmed = value.trim();
+    return trimmed.length > 0 ? trimmed : CUSTOM_PREFIX_CANCELLED;
+}
+export async function askCustomPrefix(ctx, title, seed) {
+    const fallbackInput = () => ctx.ui.input(title, seed, { ...(ctx.signal ? { signal: ctx.signal } : {}) });
+    // A dialog waiting on the human must not animate a working spinner —
+    // the ticket's "turn resumed" illusion. Suppress while the dialog is
+    // up; restore ONLY if the suppression call actually exists and ran
+    // (a host without the API — RPC — has no spinner to restore). Fail-soft
+    // both ways: UI calls never gate the consent flow.
+    let spinnerSuppressed = false;
+    try {
+        ctx.ui.setWorkingVisible?.(false);
+        spinnerSuppressed = true;
+    }
+    catch { /* UI must never gate */ }
+    try {
+        if (ctx.mode === "tui" && ctx.hasUI && typeof ctx.ui.custom === "function") {
+            try {
+                const result = await ctx.ui.custom((_tui, _theme, _kb, done) => {
+                    return new SeededExtensionInput(title, seed, (value) => done(mapCustomPrefixSubmit(value)), () => done(CUSTOM_PREFIX_CANCELLED));
+                });
+                // undefined = the harness has NO custom mount (pi resolves
+                // custom() with undefined there) — fall back to the plain input.
+                // A real cancel arrives as the sentinel, never undefined.
+                if (result !== undefined)
+                    return result;
+                return await fallbackInput();
+            }
+            catch (err) {
+                // A THROWN custom() is a broken mount degrading every escape ask —
+                // never silent. Error class only (never the thrown message; it can
+                // carry dialog-layer content), mirroring the gate's gate_dialog_error.
+                logEvent({
+                    source: "permission-rules",
+                    level: "warn",
+                    event: "gate_dialog_error",
+                    fields: { error: err instanceof Error ? err.constructor.name : typeof err, phase: "custom-mount" },
+                });
+                return await fallbackInput();
+            }
+        }
+        return await fallbackInput();
+    }
+    finally {
+        if (spinnerSuppressed) {
+            try {
+                ctx.ui.setWorkingVisible?.(true);
+            }
+            catch { /* UI must never gate */ }
+        }
+    }
+}
+//# sourceMappingURL=prefixInput.js.map

package/dist/extension/sandbox/session.js

@@ -118,8 +118,10 @@ export function makeBashComposition(manager, settings, cwd, onShellResolutionRet
         const heredocNote = "Caveat: heredocs (<<EOF) write temp files relative to the current directory on macOS bash 3.2 — from an unwritable cwd they fail; prefer printf or redirect from a file in the working directory.";
         // $TMPDIR guidance (Claude Code parity, always-on): the sandbox sets
         // TMPDIR to the per-user sandbox-writable temp dir; /tmp itself is NOT
-        // writable.
-        const tmpdirNote = "For temporary files, always use the $TMPDIR environment variable. TMPDIR is automatically set to the correct sandbox-writable directory in sandbox mode. Do NOT use /tmp directly - use $TMPDIR instead.";
+        // writable. When the system prompt names a scratchpad directory, that
+        // directory takes priority for temporary files — stated here so the two
+        // guidance lines never read as mutually exclusive always-rules.
+        const tmpdirNote = "For temporary files, use the $TMPDIR environment variable unless your system prompt names a scratchpad directory — the scratchpad takes priority for temporary files. TMPDIR is automatically set to the correct sandbox-writable directory in sandbox mode. Do NOT use /tmp directly - use $TMPDIR instead.";
         const wrapped = {
             ...def,
             description: `${def.description}\n\n## Command sandbox\nCommands run inside an OS sandbox: ${restrictions.join("; ")}. ${strictNote}\n${heredocNote}\n${tmpdirNote}`,

package/dist/extension/scratchpad.d.ts

@@ -48,6 +48,18 @@ export declare function scratchpadDir(opts?: {
     uid?: number;
     tmp?: string;
 }): string | null;
+/**
+ * PURE: the per-user scratchpad OWNER ROOT, recomputed from the SAME inputs
+ * `scratchpadDir` resolves from (never derived by stripping segments off a
+ * built path — a layout change would silently shift a stripped spelling).
+ * The value the sandbox forces TMPDIR onto (Claude parity): per-user, shared
+ * across sessions, and short enough for named unix-socket binds where the
+ * deep scratchpad path would trip macOS's 104-char sun_path limit.
+ */
+export declare function scratchpadOwnerRootFor(opts?: {
+    uid?: number;
+    tmp?: string;
+}): string;
 /**
  * IMPURE: ensure the scratchpad dir exists (owner-only), failing soft. Returns
  * the path on success and null on failure — a null result means "no scratchpad
@@ -56,7 +68,9 @@ export declare function scratchpadDir(opts?: {
 export declare function ensureScratchpadDir(path: string, mkdir?: (p: string, o: {
     mode: number;
     recursive: boolean;
-}) => void): string | null;
+}) => void, opts?: {
+    onError?: (errorCode: string) => void;
+}): string | null;
 /**
  * PURE: the prompt section naming the scratchpad. Gated by the caller on the
  * dir existing; when present, it tells the agent where to put intermediate

package/dist/extension/scratchpad.js

@@ -61,17 +61,39 @@ export function scratchpadDir(opts = {}) {
     const cwd = sanitizeCwdSegment(opts.cwd ?? ".");
     return join(tmp, scratchpadOwnerDir(uid), cwd, sessionId, "scratchpad");
 }
+/**
+ * PURE: the per-user scratchpad OWNER ROOT, recomputed from the SAME inputs
+ * `scratchpadDir` resolves from (never derived by stripping segments off a
+ * built path — a layout change would silently shift a stripped spelling).
+ * The value the sandbox forces TMPDIR onto (Claude parity): per-user, shared
+ * across sessions, and short enough for named unix-socket binds where the
+ * deep scratchpad path would trip macOS's 104-char sun_path limit.
+ */
+export function scratchpadOwnerRootFor(opts = {}) {
+    const tmp = opts.tmp ?? tmpdir();
+    const uid = opts.uid ?? (typeof process.getuid === "function" ? process.getuid() ?? 0 : 0);
+    return join(tmp, scratchpadOwnerDir(uid));
+}
 /**
  * IMPURE: ensure the scratchpad dir exists (owner-only), failing soft. Returns
  * the path on success and null on failure — a null result means "no scratchpad
  * this session", which the caller turns into an omitted prompt section.
  */
-export function ensureScratchpadDir(path, mkdir = mkdirSync) {
+export function ensureScratchpadDir(path, mkdir = mkdirSync, opts = {}) {
     try {
         mkdir(path, { recursive: true, mode: 0o700 });
         return path;
     }
-    catch {
+    catch (err) {
+        // The errno CODE (never the thrown message — the message can carry a
+        // path or system detail, and the caller forwards this to the sink).
+        // fs errors are plain Error instances whose distinguishing value is
+        // .code (ENOTDIR vs EACCES vs EPERM...); the constructor name would
+        // always read "Error" and distinguish nothing. The fallback keeps the
+        // class name for codeless throws (a non-fs throw), so the callback's
+        // value is "errno code, or class name when there is no code".
+        const code = err?.code;
+        opts.onError?.(code ?? (err instanceof Error ? err.constructor.name : typeof err));
         return null;
     }
 }
@@ -82,12 +104,13 @@ export function ensureScratchpadDir(path, mkdir = mkdirSync) {
  */
 export function scratchpadSection(dir) {
     return ("# Scratchpad directory\n\n" +
-        `Use this session scratchpad directory for files that do not belong in the user's project:\n` +
+        `IMPORTANT: Always use this scratchpad directory for temporary files instead of /tmp or other system temp directories (including $TMPDIR in sandboxed bash):\n` +
         `${dir}\n\n` +
+        "Use this directory for ALL temporary file needs:\n" +
         "- Store intermediate results or data during multi-step tasks.\n" +
         "- Write temporary scripts or configuration files.\n" +
         "- Save outputs that don't belong in the user's project.\n" +
-        "- Anything that would otherwise go to /tmp.\n\n" +
+        "- Staging files for subagents: paths in this directory are readable by every subagent of this session, so hand subagents scratchpad paths rather than $TMPDIR or /tmp paths.\n\n" +
         "The directory is session-specific and isolated from the user's project.");
 }
 //# sourceMappingURL=scratchpad.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yagni-app/code-staging",
-  "version": "1.1.4-staging.1416.1",
+  "version": "1.1.4-staging.1420.1",
   "description": "YAGNI Code: a terminal coding agent that already knows your company. One YAGNI login routes the model and grounds the agent in your team's context.",
   "license": "SEE LICENSE IN LICENSE.md",
   "author": "YAGNI, Inc. <jack@yagni.app> (https://yagni.app)",
@@ -58,5 +58,5 @@
     "turndown": "^7.2.4",
     "typebox": "^1.3.15"
   },
-  "yagniSourceSha": "f17aa2f61573701f8a9b62da1d99ca022b96a7bd"
+  "yagniSourceSha": "651ed1d5bda0a76c0ce1257e0dc1a47769e2fe5c"
 }