@yagni-app/code-staging 1.1.6-staging.1439.1 → 1.1.6-staging.1445.1

package/dist/extension/pipeline/goCommand.js

@@ -362,6 +362,9 @@ function formatSummaryForChat(result, costText) {
 const UNTRACKED_NOTICE = {
     disabled: "Run tracking is off for this workspace, so this /go run won't appear on the Work page.",
     unauthorized: "Run tracking is unauthorized. Run `yagni login` to refresh your token so runs appear on the Work page.",
+    // A refusal always arrives with the server's own sentence; this is the line
+    // for the rare body that carries none.
+    refused: "YAGNI declined to record this run, so it won't appear on the Work page. The pipeline ran anyway.",
     error: "Couldn't reach YAGNI to record this run, so it won't appear on the Work page. The pipeline ran anyway.",
 };
 /** Toast severity for an outcome: clean is good, round_cap warns, abort/fail are errors. */
@@ -737,9 +740,11 @@ export function registerGoCommand(pi, deps = {}) {
                     }
                     return { runId: started.runId, workItemId: started.workItemId };
                 }
-                // Recording skipped (flag off) or failed (unauthorized / unreachable):
-                // tell the user the run won't show on the Work page rather than swallowing it.
-                notify(UNTRACKED_NOTICE[started.reason], "warning");
+                // Recording skipped (flag off) or failed (unauthorized / refused /
+                // unreachable): tell the user the run won't show on the Work page
+                // rather than swallowing it. A refusal carries the server's own
+                // sentence, which says what to do about it, so it wins over our copy.
+                notify(started.message ?? UNTRACKED_NOTICE[started.reason], "warning");
                 return {};
             };
             let resumeFrom;

package/dist/extension/pipeline/runSession.d.ts

@@ -67,21 +67,27 @@ export interface RunStartResult extends RunSessionHandle {
  *                     workspace (the write endpoints 404 to hide themselves).
  *  - `unauthorized` — 401/403: the device token is missing/expired or lacks the
  *                     `yagni_code:write` scope (re-run `yagni login`).
+ *  - `refused`      — 400: the server declined for a reason a person can act on
+ *                     and said so in one sentence (this repository belongs to
+ *                     no Team). The sentence rides `message` and is what the
+ *                     caller shows.
  *  - `error`        — anything else: an over-budget 402, a 5xx, a 2xx with an
  *                     unrecognized body, or an unreachable backend / thrown
  *                     network error.
  */
-export type RunTrackingFailure = "disabled" | "unauthorized" | "error";
+export type RunTrackingFailure = "disabled" | "unauthorized" | "refused" | "error";
 /**
  * The outcome of opening a run. `tracked: true` carries the handle + gate
  * verdict; `tracked: false` carries the reason so `/go` can warn that this run
- * won't appear on the Work page. `start` never returns null and never throws.
+ * won't appear on the Work page, plus the server's own sentence when it sent
+ * one. `start` never returns null and never throws.
  */
 export type RunStartOutcome = ({
     tracked: true;
 } & RunStartResult) | {
     tracked: false;
     reason: RunTrackingFailure;
+    message?: string;
 };
 /** Arguments to open a run. */
 export interface StartArgs {

package/dist/extension/pipeline/runSession.js

@@ -25,27 +25,45 @@ function failureReason(status) {
         return "disabled";
     if (status === 401 || status === 403)
         return "unauthorized";
+    if (status === 400)
+        return "refused";
     return "error";
 }
 /** Cap a debug body excerpt so a giant HTML/JSON error never floods the channel. */
 const MAX_DEBUG_BODY = 200;
+/** Cap the sentence a refusal is allowed to print, so a stray body stays one line. */
+const MAX_REFUSAL_MESSAGE = 240;
 /**
- * A token-free, capped `: <body>` suffix for a failed-response debug line. Reads
- * the body only on the `!res.ok` branch (where `post` never reads it otherwise,
- * so there is no double-consume with the ok-path `res.json()`), and swallows any
- * read error so observability never breaks the fail-soft contract.
+ * The server's one-sentence refusal, if the body is the shape our own routes
+ * send (`{ error }`). Anything else, including HTML from a proxy, reads as no
+ * sentence at all, so the caller falls back to its own copy. Newlines are
+ * folded so a notice is never a stack.
  */
-async function bodyTail(res) {
+function refusalMessage(body) {
     try {
-        const t = (await res.text()).trim();
-        if (!t)
-            return "";
-        return `: ${t.length > MAX_DEBUG_BODY ? `${t.slice(0, MAX_DEBUG_BODY)} ...` : t}`;
+        const parsed = JSON.parse(body);
+        const text = typeof parsed.error === "string" ? parsed.error.trim() : "";
+        if (!text)
+            return undefined;
+        const oneLine = text.replace(/\s+/g, " ");
+        return oneLine.length > MAX_REFUSAL_MESSAGE
+            ? `${oneLine.slice(0, MAX_REFUSAL_MESSAGE)}...`
+            : oneLine;
     }
     catch {
-        return "";
+        return undefined;
     }
 }
+/**
+ * A token-free, capped `: <body>` suffix for a failed-response debug line, from
+ * a body already read once by the `!res.ok` branch.
+ */
+function bodyTail(body) {
+    const t = body.trim();
+    if (!t)
+        return "";
+    return `: ${t.length > MAX_DEBUG_BODY ? `${t.slice(0, MAX_DEBUG_BODY)} ...` : t}`;
+}
 export function makeRunSession(opts) {
     const f = opts.fetchImpl ?? fetch;
     let handle = null;
@@ -94,9 +112,21 @@ export function makeRunSession(opts) {
                 ...(opts.random ? { random: opts.random } : {}),
             });
             if (!res.ok) {
+                // Read the body ONCE on the failure branch (the ok path reads
+                // `res.json()` instead, so there is no double-consume): the debug line
+                // and the refusal sentence both come from this one read, and a body
+                // that cannot be read costs neither.
+                let body = "";
+                try {
+                    body = await res.text();
+                }
+                catch {
+                    /* a body we cannot read is a body we do not quote */
+                }
                 if (debugOn)
-                    debug(`[yagni-code] run-record ${path} -> HTTP ${res.status}${await bodyTail(res)}`);
-                return { ok: false, status: res.status };
+                    debug(`[yagni-code] run-record ${path} -> HTTP ${res.status}${bodyTail(body)}`);
+                const message = refusalMessage(body);
+                return { ok: false, status: res.status, ...(message ? { failureText: message } : {}) };
             }
             return { ok: true, data: (await res.json()) };
         }
@@ -119,8 +149,13 @@ export function makeRunSession(opts) {
             // deduped by the server (startCodeRun.findRunByIdempotencyKey) instead of
             // opening a second run + a second free-text work item.
             const r = await post("runs", { ...b, idempotencyKey: randomUUID() }, { retry: true });
-            if (!r.ok)
-                return { tracked: false, reason: failureReason(r.status) };
+            if (!r.ok) {
+                return {
+                    tracked: false,
+                    reason: failureReason(r.status),
+                    ...(r.failureText ? { message: r.failureText } : {}),
+                };
+            }
             const data = r.data;
             if (typeof data.runId === "string" && typeof data.workItemId === "string") {
                 handle = { runId: data.runId, workItemId: data.workItemId };

package/dist/extension/sandbox/bash.d.ts

@@ -62,25 +62,65 @@ export declare function makeSandboxSpawnHook(manager: YagniSandboxManager): Bash
  * when the manager is not initialized (fail-open to plain execution — the
  * permission gate still ran; the sandbox simply is not active).
  *
- * Transient shell-resolution failures (isShellResolutionFailure — srt's 1s
- * `which` spawn timing out under load) are retried once after a short
- * backoff; a second failure surfaces the original error. Any other error
- * propagates immediately, no retry.
+ * Shell-resolution failures (isShellResolutionFailure — srt's 1s `which`
+ * spawn timing out under load) carry two distinct causes that srt collapses
+ * into one message, split here by evidence:
+ *
+ *   - LOAD TIMEOUT (the common case): the attempt took ~1s (the srt hard
+ *     timeout) — `which` itself failed to spawn because the machine is
+ *     saturated. Self-heals (observed sick windows 15–22s, heals within
+ *     ~75s, 10/10 across every recorded incident). Retried on an
+ *     exponential ladder; a ladder that never heals surfaces the HONEST
+ *     transient message (the raw `Shell '…' not found in PATH` is a lie
+ *     for this cause — the shell is right there — and models flail on it).
+ *   - GENUINE MISS (rare): the attempt failed fast (<500ms — `which`
+ *     answers a real "no" in ~4ms, measured) or the shell is an absolute
+ *     path that does not exist. The original error surfaces immediately,
+ *     zero retries — for this cause the message is TRUE and retrying is
+ *     dead time against a config problem.
+ *
+ * Any other error propagates immediately, no retry. Every ladder sleep is
+ * abort-aware (Ctrl+C / tool cancel kills the wait).
  */
 export interface PreWrapRetryOpts {
-    /** Abort the backoff sleep (the tool call's signal). */
+    /** Abort the ladder sleeps (the tool call's signal). */
     signal?: AbortSignal;
-    /** Backoff before the single retry. Tests pass a tiny value to stay fast. */
-    backoffMs?: number;
     /** Instrumentation: fired once, with the retry's terminal outcome. */
     onRetry?: (outcome: "recovered" | "exhausted") => void;
+    /** Retry policy: the default ladder, or the legacy single 2s retry
+     * (background launches — a silent 35s stall on a returns-immediately
+     * call is worse than the error, and bg launches are the highest-load
+     * moments). */
+    retryPolicy?: "ladder" | "single";
+    /** Discriminator threshold: a signature failure whose wrap attempt took
+     * at least this many ms classifies as a load timeout; faster ones are
+     * genuine misses. Default SHELL_RESOLUTION_TRANSIENT_MIN_ELAPSED_MS —
+     * exported and seam-overridable; tests pass 0 to force the ladder path
+     * against instant-throwing fakes, session tests shrink the default. */
+    transientMinElapsedMs?: number;
 }
+/** The honest failure text for an exhausted ladder: says what actually
+ * happened, what it means, and what to do. Exported so tests pin the exact
+ * string. Deliberately contains no EPERM / "Operation not permitted" /
+ * `[sandbox] ` markers — it must never match isSandboxDenialOutput and
+ * poison the escape-consent flow's session denial evidence. */
+export declare const SHELL_RESOLUTION_TRANSIENT_MESSAGE: string;
+/** The discriminator threshold: a signature failure whose wrap attempt
+ * took at least this many ms classifies as a load timeout; faster ones
+ * are genuine misses. The two causes are ~4ms (a real `which` "no") vs
+ * ~1000ms (srt's hard timeout) apart, so the midpoint has wide margins
+ * on both sides. Extracted per the coupled-rollout rule — the riskiest
+ * heuristic of the feature must be independently revertible. */
+export declare const SHELL_RESOLUTION_TRANSIENT_MIN_ELAPSED_MS = 500;
+export declare function _setShellResolutionRetryBackoffsForTest(ms: readonly number[] | null): void;
+export declare function _setShellResolutionSingleRetryBackoffForTest(ms: number | null): void;
+export declare function _setShellResolutionTransientMinElapsedForTest(ms: number | null): void;
 export declare function preWrappedCommand(manager: YagniSandboxManager, command: string, binShell?: string, opts?: PreWrapRetryOpts): Promise<string>;
-export declare function _setShellResolutionRetryBackoffForTest(ms: number | null): void;
-/** srt's transient shell-resolution failure: `Shell '<name>' not found in
- * PATH`, thrown from wrapCommandWithSandbox when which.js's 1s
- * spawnSync('which') times out under load. Self-healing after ~15–30s;
- * preWrappedCommand retries it once. */
+/** srt's shell-resolution failure: `Shell '<name>' not found in PATH`,
+ * thrown from wrapCommandWithSandbox when which.js's 1s spawnSync('which')
+ * times out under load — or genuinely answers "no". preWrappedCommand
+ * splits the two by evidence (see its doc) and retries only the load
+ * timeout, on an exponential ladder. */
 export declare function isShellResolutionFailure(err: unknown): boolean;
 /**
  * Did this command output indicate the OS sandbox DENIED something? The

package/dist/extension/sandbox/bash.js

@@ -21,7 +21,7 @@
  * lessons (process-group kill, stdio release).
  */
 import { existsSync } from "node:fs";
-import { join } from "node:path";
+import { isAbsolute, join } from "node:path";
 import { logEvent } from "../errorSink.js";
 import { scrubSecrets } from "../pipeline/scrubSecrets.js";
 function stripLeadingSafeEnvVars(command) {
@@ -115,73 +115,193 @@ export function makeSandboxSpawnHook(manager) {
         env: { ...ctx.env, ...extraEnv },
     });
 }
+/** The honest failure text for an exhausted ladder: says what actually
+ * happened, what it means, and what to do. Exported so tests pin the exact
+ * string. Deliberately contains no EPERM / "Operation not permitted" /
+ * `[sandbox] ` markers — it must never match isSandboxDenialOutput and
+ * poison the escape-consent flow's session denial evidence. */
+export const SHELL_RESOLUTION_TRANSIENT_MESSAGE = "Transient sandbox shell-resolution timeout — the machine is under load. " +
+    "It self-heals, typically within a minute; retrying the same command shortly should work. " +
+    "Re-running the same command is usually enough.";
+/** The discriminator threshold: a signature failure whose wrap attempt
+ * took at least this many ms classifies as a load timeout; faster ones
+ * are genuine misses. The two causes are ~4ms (a real `which` "no") vs
+ * ~1000ms (srt's hard timeout) apart, so the midpoint has wide margins
+ * on both sides. Extracted per the coupled-rollout rule — the riskiest
+ * heuristic of the feature must be independently revertible. */
+export const SHELL_RESOLUTION_TRANSIENT_MIN_ELAPSED_MS = 500;
+/** Ladder backoffs between attempts after the first (2s/4s/8s/16s → 5
+ * attempts, ~30s of sleep + ~1s per failing `which`: ~35s worst case).
+ * Sized from the recorded incidents: multi-failure bursts prove sick
+ * windows of 15–22s, so the ladder absorbs the observed majority; the
+ * long tail falls through to the honest message. */
+const SHELL_RESOLUTION_LADDER_BACKOFFS_MS = [2000, 4000, 8000, 16000];
+/** Legacy single-retry backoff (retryPolicy "single"). */
+const SHELL_RESOLUTION_RETRY_BACKOFF_MS = 2000;
+/** Test seam for the ladder backoffs: session-layer tests (composition,
+ * user_bash) drive the ladder without per-call opts, so they shrink the
+ * module-level default instead of sleeping real seconds. Module-scoped
+ * (never a globalThis key — a leaked value there would silently shrink the
+ * production backoffs); restore in the same describe that sets it.
+ * Deliberately SEPARATE from the single-policy seam below: the two
+ * policies must not share a test override (a leaked ladder shrink would
+ * silently shrink the bg path's backoff). */
+let shellRetryBackoffsForTest = null;
+export function _setShellResolutionRetryBackoffsForTest(ms) {
+    shellRetryBackoffsForTest = ms;
+}
+function ladderBackoffs() {
+    return shellRetryBackoffsForTest ?? SHELL_RESOLUTION_LADDER_BACKOFFS_MS;
+}
+/** Test seam for the single-policy backoff (its own override — never the
+ * ladder's). Same module-scoped discipline. */
+let shellRetrySingleBackoffMsForTest = null;
+export function _setShellResolutionSingleRetryBackoffForTest(ms) {
+    shellRetrySingleBackoffMsForTest = ms;
+}
+/** Test seam for the discriminator threshold (session tests shrink it so
+ * their fakes need no real 600ms sleeps). Same module-scoped discipline. */
+let shellTransientMinElapsedMsForTest = null;
+export function _setShellResolutionTransientMinElapsedForTest(ms) {
+    shellTransientMinElapsedMsForTest = ms;
+}
+/** The candidate filenames `existsSync` should probe for `bin` on this
+ * platform: the bare name on POSIX, or each PATHEXT extension on Windows
+ * (the same names `where` would consider). */
+function pathCandidates(bin) {
+    if (process.platform === "win32") {
+        const exts = (process.env.PATHEXT ?? ".EXE").split(";");
+        return exts.map((e) => bin + (e.startsWith(".") ? e : "." + e));
+    }
+    return [bin];
+}
+/** Is the binary findable in the current PATH? An in-process scan (the same
+ * insight as the whole fix: answer a filesystem question with a filesystem
+ * check, never a subprocess) — and the SAME PATH srt's own `whichSync` sees:
+ * its spawnSync inherits this process's env, and the shell resolution runs
+ * in the host before the sandbox child ever starts. LOOSE by design:
+ * existence only, no X_OK — a false positive (found but not executable)
+ * errs toward the ladder, i.e. toward retrying, the safe side. For bare
+ * names the scan is an approximation of `which` (simple joins, no PATH
+ * semantics beyond the separator), so a "no" is strong but not absolute —
+ * a genuinely-broken exotic PATH shape could false-negative and surface
+ * the original error without retrying, the same posture as the fast-fail
+ * branch. */
+function foundOnPath(bin) {
+    if (bin.includes("/") || isAbsolute(bin))
+        return existsSync(bin);
+    const sep = process.platform === "win32" ? ";" : ":";
+    const dirs = (process.env.PATH ?? "").split(sep).filter(Boolean);
+    return dirs.some((dir) => pathCandidates(bin).some((name) => existsSync(join(dir, name))));
+}
 export async function preWrappedCommand(manager, command, binShell, opts = {}) {
     if (!manager.initialized)
         return command;
-    try {
-        return await manager.wrapWithSandbox(command, binShell);
-    }
-    catch (err) {
-        if (!isShellResolutionFailure(err))
-            throw err;
-    }
-    // The failed attempt may have left per-command state behind (the wrap can
-    // start helpers before it throws); clear it so the retry starts clean and
-    // the exec path's cleanupAfterCommand never sees double state. Best-effort:
-    // a cleanup throw must never swallow the original error or kill the retry.
-    try {
-        manager.cleanupAfterCommand();
-    }
-    catch (err) {
-        // Best-effort cleanup failed — the retry still runs (the exec path
-        // cleans up again); a fully silent swallow would hide a leaked-helper
-        // state, so the failure gets a visible trail. The message rides the
-        // line (the error class alone is always the literal "Error" for plain
-        // throws) and is run through scrubSecrets at WRITE time so the line
-        // is credential-scrubbed before any reader. That is pattern-scrub
-        // only, not a general redactor — readSessionTrail adds the same
-        // pattern pass at read time; the durable errors-*.jsonl stays
-        // unredacted by the sink's documented design (local file, never
-        // uploaded raw). Same posture as sandbox_persist_failed.
-        logEvent({
-            source: "sandbox",
-            level: "warn",
-            event: "shell_retry_cleanup_failed",
-            fields: {
-                error: scrubSecrets(err instanceof Error ? `${err.constructor.name}: ${err.message}` : String(err)),
-            },
+    const transientMinElapsedMs = opts.transientMinElapsedMs ?? shellTransientMinElapsedMsForTest ?? SHELL_RESOLUTION_TRANSIENT_MIN_ELAPSED_MS;
+    /** Corroboration: can this shell failure be a REAL miss? An absolute or
+     * path-bearing binShell that does not exist, or a bare name nowhere on
+     * PATH, is a true "no" regardless of machine load — never the ladder,
+     * never the honest-transient message. */
+    const provablyAbsent = () => typeof binShell === "string" && binShell.length > 0 && !foundOnPath(binShell);
+    const isGenuineMiss = (elapsedMs) => provablyAbsent() || elapsedMs < transientMinElapsedMs;
+    const attempt = () => {
+        const startedAt = Date.now();
+        return manager.wrapWithSandbox(command, binShell).then((wrapped) => ({ wrapped, elapsedMs: Date.now() - startedAt }), (err) => ({ err, elapsedMs: Date.now() - startedAt }));
+    };
+    // Best-effort cleanup between attempts: the failed wrap may have left
+    // per-command state behind (it can start helpers before it throws); clear
+    // it so the retry starts clean and the exec path's cleanupAfterCommand
+    // never sees double state. A cleanup throw must never swallow the
+    // original error or kill the retry; a fully silent swallow would hide a
+    // leaked-helper state, so the failure gets a visible trail. The message
+    // rides the line (the error class alone is always the literal "Error" for
+    // plain throws) and is run through scrubSecrets at WRITE time so the line
+    // is credential-scrubbed before any reader. That is pattern-scrub only,
+    // not a general redactor — readSessionTrail adds the same pattern pass at
+    // read time; the durable errors-*.jsonl stays unredacted by the sink's
+    // documented design (local file, never uploaded raw). Same posture as
+    // sandbox_persist_failed.
+    const cleanup = () => {
+        try {
+            manager.cleanupAfterCommand();
+        }
+        catch (err) {
+            logEvent({
+                source: "sandbox",
+                level: "warn",
+                event: "shell_retry_cleanup_failed",
+                fields: {
+                    error: scrubSecrets(err instanceof Error ? `${err.constructor.name}: ${err.message}` : String(err)),
+                },
+            });
+        }
+    };
+    const first = await attempt();
+    if (first.wrapped !== undefined)
+        return first.wrapped;
+    if (!isShellResolutionFailure(first.err))
+        throw first.err;
+    if (isGenuineMiss(first.elapsedMs)) {
+        logShellResolutionClassification({
+            classification: "genuine-miss",
+            elapsedMs: first.elapsedMs,
+            absoluteShell: typeof binShell === "string" && isAbsolute(binShell),
+            provablyAbsent: provablyAbsent(),
         });
+        throw first.err;
     }
-    await sleep(effectiveBackoffMs(opts.backoffMs), opts.signal);
-    try {
-        const wrapped = await manager.wrapWithSandbox(command, binShell);
-        opts.onRetry?.("recovered");
-        return wrapped;
+    cleanup();
+    const backoffs = opts.retryPolicy === "single"
+        ? [shellRetrySingleBackoffMsForTest ?? SHELL_RESOLUTION_RETRY_BACKOFF_MS]
+        : ladderBackoffs();
+    let lastErr = first.err;
+    let lastWasSignature = true;
+    for (const backoffMs of backoffs) {
+        await sleep(backoffMs, opts.signal);
+        const next = await attempt();
+        if (next.wrapped !== undefined) {
+            opts.onRetry?.("recovered");
+            return next.wrapped;
+        }
+        if (!isShellResolutionFailure(next.err)) {
+            // An unrelated mid-ladder error propagates as-is and does NOT fire
+            // `exhausted` — the health signal stays clean (only the terminal
+            // same-signature failure reports exhausted). The failed attempt
+            // still gets its cleanup (uniform with every other failed attempt).
+            cleanup();
+            lastErr = next.err;
+            lastWasSignature = false;
+            break;
+        }
+        lastErr = next.err;
+        lastWasSignature = true;
+        cleanup();
     }
-    catch (err) {
-        // `exhausted` is the shell-resolution health signal — report it only
-        // when the second failure is the SAME transient; an unrelated retry
-        // error propagates as-is without polluting the metric.
-        if (isShellResolutionFailure(err))
-            opts.onRetry?.("exhausted");
-        throw err;
+    if (lastWasSignature) {
+        opts.onRetry?.("exhausted");
+        // The honest message replaces the lie on the discriminated-timeout
+        // path only; a genuine miss (surfaced above) keeps the original —
+        // there the "not found in PATH" text is accurate. The ORIGINAL error
+        // rides as `cause` so the terminal classification (shell name,
+        // signature) survives for diagnostics from the thrown value alone.
+        throw new Error(SHELL_RESOLUTION_TRANSIENT_MESSAGE, { cause: lastErr });
     }
+    throw lastErr;
 }
-/** Default backoff before the single shell-resolution retry. The observed
- * upstream transient self-heals in ~15–30s; this is a bounded bridge, not
- * a guarantee — a still-failing second attempt surfaces the original error. */
-const SHELL_RESOLUTION_RETRY_BACKOFF_MS = 2000;
-/** Test seam for the backoff: session-layer tests (composition, user_bash)
- * drive the retry without a backoffMs opt, so they shrink the module-level
- * default instead of sleeping a real 2s. Module-scoped (never a globalThis
- * key — a leaked value there would silently shrink the production backoff);
- * restore in the same describe that sets it. */
-let shellRetryBackoffMsForTest = null;
-export function _setShellResolutionRetryBackoffForTest(ms) {
-    shellRetryBackoffMsForTest = ms;
-}
-function effectiveBackoffMs(override) {
-    return override ?? shellRetryBackoffMsForTest ?? SHELL_RESOLUTION_RETRY_BACKOFF_MS;
+/** Sink line for the discriminator's classification — the auditability of
+ * the 500ms threshold: a mis-tuned threshold would otherwise look like "no
+ * retries happened" in prod. Fires only on the GENUINE-MISS classification
+ * (the rare path — one line per surfaced config problem); the load-timeout
+ * path is already counted by shell_resolution_retry's recovered/exhausted
+ * census. Closed-enum classification + elapsed ms + the corroboration
+ * booleans: no command or shell content. */
+function logShellResolutionClassification(fields) {
+    logEvent({
+        source: "sandbox",
+        level: "info",
+        event: "shell_resolution_genuine_miss",
+        fields,
+    });
 }
 function sleep(ms, signal) {
     // The abort rejection carries the caller's own abort reason when the
@@ -219,10 +339,11 @@ function sleep(ms, signal) {
         signal?.addEventListener("abort", onAbort, { once: true });
     });
 }
-/** srt's transient shell-resolution failure: `Shell '<name>' not found in
- * PATH`, thrown from wrapCommandWithSandbox when which.js's 1s
- * spawnSync('which') times out under load. Self-healing after ~15–30s;
- * preWrappedCommand retries it once. */
+/** srt's shell-resolution failure: `Shell '<name>' not found in PATH`,
+ * thrown from wrapCommandWithSandbox when which.js's 1s spawnSync('which')
+ * times out under load — or genuinely answers "no". preWrappedCommand
+ * splits the two by evidence (see its doc) and retries only the load
+ * timeout, on an exponential ladder. */
 export function isShellResolutionFailure(err) {
     return err instanceof Error && /^Shell '[^']*' not found in PATH$/.test(err.message);
 }

package/dist/extension/sandbox/session.js

@@ -161,9 +161,14 @@ export function makeBashComposition(manager, settings, cwd, onShellResolutionRet
                     let bgCommand = input.command;
                     let bgEnv;
                     if (useSandbox) {
+                        // retryPolicy "single": the bg launch ack is returns-
+                        // immediately, and bg launches are precisely the high-load
+                        // moments — a silent 35s ladder stall on the ack is worse than
+                        // the error, so the legacy one-quick-retry stands here.
                         bgCommand = await preWrappedCommand(manager, input.command, binShell, {
                             signal: signal ?? undefined,
                             onRetry: onShellResolutionRetry,
+                            retryPolicy: "single",
                         });
                         bgEnv = { ...process.env, ...sandboxSpawnEnv(manager) };
                         manager.cleanupAfterCommand();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yagni-app/code-staging",
-  "version": "1.1.6-staging.1439.1",
+  "version": "1.1.6-staging.1445.1",
   "description": "YAGNI Code: a terminal coding agent that already knows your company. One YAGNI login routes the model and grounds the agent in your team's context.",
   "license": "SEE LICENSE IN LICENSE.md",
   "author": "YAGNI, Inc. <jack@yagni.app> (https://yagni.app)",
@@ -58,5 +58,5 @@
     "turndown": "^7.2.4",
     "typebox": "^1.3.15"
   },
-  "yagniSourceSha": "aef6a54c459365b8fcb575ca230209ca0bd47f38"
+  "yagniSourceSha": "df1d49933fa6a71d3b18754a183b5e400a45053a"
 }