@yagni-app/code-staging 1.1.6-staging.1448.1 → 1.1.6-staging.1454.1

package/dist/extension/index.js

@@ -773,31 +773,70 @@ export async function registerYagni(pi, deps = {}) {
     // the command — its later escape attempts go to the consent dialog (the
     // sandbox genuinely cannot run it). Content stays local: only the trimmed
     // command string is held in memory, never logged.
-    const sandboxedFailures = new Map();
     const SANDBOXED_FAILURES_MAX = 50;
+    /** Bounded LRU map keyed by the CANONICAL command (sandboxFailureKey): a
+     * retry differing by quote rendering or safe decoration must hit the same
+     * entry — raw-string keys would miss exactly the variable shapes the
+     * grants layer canonicalizes for. Shared by both brake maps (the boolean
+     * seed set and the escalation counter) so the refresh + eviction policy
+     * lives in ONE place — the two copies drifted once already (the counter
+     * missed the delete-then-set refresh and evicted a hot key at the cap).
+     * upsert performs the delete-then-set refresh (a re-touched key moves to
+     * the END of insertion order, so the evicted key is always the
+     * least-recently-touched one) and evicts at the cap. A null key (an
+     * uncanonicalizable command) is a no-op returning undefined. */
+    const makeSandboxFailureMap = (nextValue) => {
+        const map = new Map();
+        return {
+            has: (key) => map.has(key),
+            get: (key) => map.get(key),
+            /** Canonical-keyed upsert: refresh LRU order, compute the value from
+             * the existing one, evict at the cap. */
+            upsert: (command) => {
+                const key = sandboxFailureKey(command);
+                if (!key)
+                    return undefined;
+                const value = nextValue(map.get(key), key);
+                map.delete(key);
+                map.set(key, value);
+                if (map.size > SANDBOXED_FAILURES_MAX) {
+                    const oldest = map.keys().next().value;
+                    if (oldest !== undefined)
+                        map.delete(oldest);
+                }
+                return { key, value };
+            },
+            clear: () => { map.clear(); },
+        };
+    };
+    const sandboxedFailures = makeSandboxFailureMap(() => true);
     const recordSandboxedFailure = (command) => {
-        // The CANONICAL key (sandboxFailureKey): a retry differing by quote
-        // rendering or safe decoration must hit the same entry — raw-string
-        // keys would miss exactly the variable shapes the grants layer
-        // canonicalizes for.
-        const key = sandboxFailureKey(command);
-        if (!key)
-            return;
-        sandboxedFailures.delete(key);
-        sandboxedFailures.set(key, true);
-        if (sandboxedFailures.size > SANDBOXED_FAILURES_MAX) {
-            const oldest = sandboxedFailures.keys().next().value;
-            if (oldest !== undefined)
-                sandboxedFailures.delete(oldest);
-        }
+        sandboxedFailures.upsert(command);
     };
     const hasSandboxedFailure = (command) => sandboxedFailures.has(sandboxFailureKey(command));
+    // Unrecognized-failure escalation (the generic backstop behind the
+    // signature vocabulary): a sandboxed failure whose output matches NO
+    // known signature counts per canonical key; the SECOND occurrence seeds
+    // the brake. Arithmetic lands on the rung's documented contract — first
+    // failure (count 1, no seed), the escape's one silent sandboxed retry
+    // fails (count 2, seed), every further escape dialogs — for every
+    // failure shape, not just the enumerated ones. Worst case is a command
+    // failing twice for non-sandbox reasons: one dialog the user declines
+    // (the code's documented fail-safe direction). Recognized signatures
+    // still seed at 1 — the escalation never weakens the existing valve.
+    const unrecognizedSandboxFailures = makeSandboxFailureMap((existing) => (existing ?? 0) + 1);
+    const countSandboxedFailure = (command) => {
+        // The shared map's upsert refreshes LRU order, increments the count,
+        // and evicts at the cap — the same policy the seed set uses.
+        return unrecognizedSandboxFailures.upsert(command)?.value ?? 0;
+    };
     // A mode transition is a trust-posture change — the auto-sandbox rung's
     // prior-failure evidence clears with the gate's other session caches
     // (the gate's own fallback map clears via modeHolder.onSet; this map is
     // the production one, so it must clear here too).
     modeHolder.onSet(() => {
         sandboxedFailures.clear();
+        unrecognizedSandboxFailures.clear();
     });
     // settings-based permission rules, loaded once at startup (same
     // trust-boundary posture as grants: no mid-session reload). User config
@@ -1909,18 +1948,41 @@ export async function registerYagni(pi, deps = {}) {
                 .join("\n");
             if (isSandboxDenialOutput(text)) {
                 recordSandboxedFailure(command);
-                // The seed must be observable (debug tier only — no command content,
-                // the closed signature class rides the field): a false-positive seed
-                // session-long disables auto-sandbox for a command, and without this
-                // line the only symptom would be unexplained dialogs.
+                // The seed must be observable (info tier — readSessionTrail filters
+                // debug, and an invisible seed made the incident session
+                // undebuggable; no command content, the closed signature class
+                // rides the field): a false-positive seed session-long disables
+                // auto-sandbox for a command, and without this line the only
+                // symptom would be unexplained dialogs.
                 const signature = sandboxDenialSignature(text);
                 logEvent({
                     source: "sandbox",
-                    level: "debug",
+                    level: "info",
                     event: "sandbox_failure_seeded",
                     fields: { signature },
                 });
             }
+            else {
+                // Unrecognized-failure escalation: no known signature — count it;
+                // the second unrecognized failure of the same canonical command
+                // seeds the brake (the rung then dialogs instead of auto-sandboxing
+                // into the same failure forever). Seed fires only on the 1→2
+                // transition — a later third failure never re-seeds.
+                const count = countSandboxedFailure(command);
+                if (count === 2) {
+                    recordSandboxedFailure(command);
+                    logEvent({
+                        source: "sandbox",
+                        level: "info",
+                        event: "sandbox_failure_seeded",
+                        // count rides the field so the trail distinguishes the
+                        // escalation's seed (always 2) from a recognized seed (1) —
+                        // closed vocabulary only; no failure text (content stays out of
+                        // the always-on trail, the recognized branch's contract).
+                        fields: { signature: "unrecognized", count },
+                    });
+                }
+            }
         }
     });
     // Seed the unified error trail from tool-exec failures. A tool's SUCCESS

package/dist/extension/sandbox/bash.d.ts

@@ -148,9 +148,9 @@ export declare function isSandboxDenialOutput(output: string): boolean;
  * offending path when found (pi-sandbox's regex, credited MIT).
  */
 export declare function extractBlockedWritePath(output: string): string | null;
-/** The three network-posture denial classes this classifier knows (closed
+/** The network-posture denial classes this classifier knows (closed
  * set — rides the sink line as a low-cardinality field). */
-export type NetworkDenialClass = "ipc-listen" | "tls-trustd" | "loopback";
+export type NetworkDenialClass = "ipc-listen" | "tls-trustd" | "loopback" | "dns" | "ssh-proxy";
 /**
  * Classify a sandbox network-posture denial from command output. Pure;
  * advisory-only (never widens anything — the fix is a knob the USER flips,
@@ -164,6 +164,20 @@ export type NetworkDenialClass = "ipc-listen" | "tls-trustd" | "loopback";
  *   - loopback:     EPERM/"not permitted" on a connect to 127.0.0.1/
  *                   localhost/::1 (loopback bypasses the proxy via
  *                   no_proxy, so the allowlist can never admit it)
+ *   - dns:          raw name-resolution failure (getaddrinfo/nslookup/ping
+ *                   spellings). The profile denies DNS by design — proxy-
+ *                   aware tools ride the mux where the PARENT resolves;
+ *                   raw resolvers fail. This class exists so the failure
+ *                   reads as the fence working (not the machine losing
+ *                   connectivity) and seeds the rung's brake — a
+ *                   DNS-shaped sandboxed failure re-arms the consent
+ *                   dialog, never loops silently.
+ *   - ssh-proxy:   git-over-SSH through the sandbox's SSH bridge (nc
+ *                   ProxyCommand): the bridge carries no credential, so
+ *                   the mux policy-refuses it even for granted domains;
+ *                   ssh renders the refusal as a dispatch fatal on
+ *                   "UNKNOWN port 65535" (nc's rewrite of the proxied
+ *                   endpoint — a real server renders its own address).
  * Returns null when the output carries no network-posture signature — a
  * plain file-write EPERM must NOT get a network hint.
  */

package/dist/extension/sandbox/bash.js

@@ -437,6 +437,20 @@ export function extractBlockedWritePath(output) {
  *   - loopback:     EPERM/"not permitted" on a connect to 127.0.0.1/
  *                   localhost/::1 (loopback bypasses the proxy via
  *                   no_proxy, so the allowlist can never admit it)
+ *   - dns:          raw name-resolution failure (getaddrinfo/nslookup/ping
+ *                   spellings). The profile denies DNS by design — proxy-
+ *                   aware tools ride the mux where the PARENT resolves;
+ *                   raw resolvers fail. This class exists so the failure
+ *                   reads as the fence working (not the machine losing
+ *                   connectivity) and seeds the rung's brake — a
+ *                   DNS-shaped sandboxed failure re-arms the consent
+ *                   dialog, never loops silently.
+ *   - ssh-proxy:   git-over-SSH through the sandbox's SSH bridge (nc
+ *                   ProxyCommand): the bridge carries no credential, so
+ *                   the mux policy-refuses it even for granted domains;
+ *                   ssh renders the refusal as a dispatch fatal on
+ *                   "UNKNOWN port 65535" (nc's rewrite of the proxied
+ *                   endpoint — a real server renders its own address).
  * Returns null when the output carries no network-posture signature — a
  * plain file-write EPERM must NOT get a network hint.
  */
@@ -513,6 +527,52 @@ export function networkDenialHint(output) {
                 "The local-binding knob is ON by default — this denial means it was turned off; the user can re-enable it in the /sandbox panel (Network tab). Retrying with dangerouslyDisableSandbox is NOT needed once the knob is on.",
         };
     }
+    // ssh-proxy: the SSH-bridge policy refusal — matched BEFORE dns (the
+    // ordering pin): a DNS-shaped failure from an ssh prefix classifies as
+    // dns (the more honest diagnosis — alias resolution failed), while the
+    // bridge refusal is the UNKNOWN-port dispatch fatal or the mux's own
+    // refusal sentence. "UNKNOWN port 65535" is nc's rewrite of the
+    // proxied destination; a refusing-but-real server renders its own
+    // address there, so the UNKNOWN shape is proxy-specific by construction.
+    if (/ssh_dispatch_run_fatal: Connection to UNKNOWN port \d+: (Broken pipe|Connection reset)/i.test(output) ||
+        /kex_exchange_identification: Connection (?:closed|reset) by UNKNOWN port \d+/i.test(output) ||
+        /This proxy requires authentication[^.]*\bdid not offer an authentication method/i.test(output) ||
+        /SSH-2\.0-policy_refusal/.test(output)) {
+        return {
+            cls: "ssh-proxy",
+            hint: "This looks like a sandbox git-over-SSH denial (the SSH bridge routes ssh through the sandbox proxy, which carries no credential — git over SSH cannot ride it even for granted domains). " +
+                "Use the HTTPS remote for this operation, or retry outside the sandbox (the user will be asked). Do not treat this as a network outage.",
+        };
+    }
+    // dns: raw name-resolution failure — the fence denies DNS by design;
+    // proxy-aware tools ride the mux (parent-side resolution), raw
+    // resolvers do not. Per-line discipline matches the EPERM branch
+    // (numbered grep hits, quoted text, and prose-initial lines are data):
+    // "Could not resolve host" is prose-likely enough that a bare
+    // substring match would fire on quoted log lines.
+    {
+        const dnsPhrases = /Could not resolve host(?:name)?|nodename nor servname provided|Name or service not known|Temporary failure in name resolution|getaddrinfo (?:ENOTFOUND|EAI_AGAIN|EAI_NONAME)|cannot resolve \S+: Unknown host|no servers could be reached|no DNS configuration/i;
+        for (const line of output.split("\n")) {
+            const t = line.trim();
+            if (!dnsPhrases.test(t))
+                continue;
+            if (/^\d+:/.test(t))
+                continue; // numbered grep/log hit — data
+            if (/^["']/.test(t))
+                continue; // quoted text — data
+            // Prose-initial: the phrase behind an article/conjunction opener is
+            // data ("if the host could not resolve…"). A `tool:` prefix or the
+            // bare phrase at line head is the diagnostic shape (same split as
+            // the EPERM branch's prose exclusion).
+            if (/^(the|a|an|this|that|it|when|if|note|tip|for|some)\b/i.test(t))
+                continue;
+            return {
+                cls: "dns",
+                hint: "This looks like a sandbox DNS-resolution denial (raw name resolution is unavailable inside the sandbox by design — proxy-aware tools ride the network proxy, where the parent resolves). " +
+                    "This is NOT evidence the machine lost connectivity; do not diagnose network health from inside the sandbox. If this command genuinely needs direct network, retry with dangerouslyDisableSandbox (the user will be asked).",
+            };
+        }
+    }
     return null;
 }
 /**

package/dist/extension/sandbox/session.js

@@ -128,9 +128,15 @@ export function makeBashComposition(manager, settings, cwd, onShellResolutionRet
         // auto-allow, and the escape rung at once. Stated here so the model
         // never mints one.
         const envPrefixNote = "Do not prepend environment variables you have not verified exist (grep the tool's binary/docs/help first) — an unverified prefix defeats grants, auto-allow, and the sandbox retry rung; write the plain command instead.";
+        // The git-over-SSH caveat: the SSH bridge carries no credential, so a
+        // granted domain does NOT make git-over-SSH work — the model that
+        // expects the grant to cover an SSH remote reads the bridge refusal as
+        // a network outage and probes (the incident session burned 10 minutes
+        // on exactly that). The HTTPS remote is the in-sandbox cure.
+        const gitSshNote = "Git commands that talk to a remote over SSH (git@… URLs) cannot ride the sandbox's network proxy on macOS — expect an SSH-bridge or DNS failure and either use the HTTPS remote, or retry outside the sandbox (the user will be asked). A granted domain does not make git-over-SSH work.";
         const wrapped = {
             ...def,
-            description: `${def.description}\n\n## Command sandbox\nCommands run inside an OS sandbox: ${restrictions.join("; ")}. ${strictNote}\n${heredocNote}\n${tmpdirNote}\n${envPrefixNote}`,
+            description: `${def.description}\n\n## Command sandbox\nCommands run inside an OS sandbox: ${restrictions.join("; ")}. ${strictNote}\n${heredocNote}\n${tmpdirNote}\n${envPrefixNote}\n${gitSshNote}`,
             parameters: schema,
             async execute(id, params, signal, onUpdate, ctx) {
                 const input = params;
@@ -358,10 +364,14 @@ export function registerSandbox(pi, opts) {
         if (sessionDomainGrants.has(host))
             return true;
         const ui = uiBridge;
-        if (!ui?.hasUI)
+        if (!ui?.hasUI) {
+            logNetworkAsk(host, "headless", null);
             return false; // headless: fail closed (never grant silently)
-        if (ui.signal?.aborted)
+        }
+        if (ui.signal?.aborted) {
+            logNetworkAsk(host, "aborted", null);
             return false;
+        }
         // Claude-parity grant options. Session grant is memory-only and
         // agent-invisible; project/user write the sandbox config file.
         const dialogOpts = {
@@ -378,13 +388,36 @@ export function registerSandbox(pi, opts) {
                 "Block",
             ], dialogOpts);
         }
-        catch {
+        catch (err) {
+            // A real 600s timeout vs an immediate UI-bridge error are different
+            // failures; the deny behavior is identical, but the trail says which:
+            // the dialog's own timeout throws a name-matched abort/timeout error
+            // (pi's select timeout shape), anything else is a bridge failure.
+            const isTimeout = err instanceof Error && /timeout|abort/i.test(err.name);
+            logNetworkAsk(host, isTimeout ? "timeout" : "error", null);
             return false; // dialog error / timeout: never grant
         }
-        if (choice === undefined || choice === "Block")
+        // A signal abort while the dialog was open resolves select to undefined
+        // — that is the session tearing down, not the user choosing Block.
+        if (ui.signal?.aborted) {
+            logNetworkAsk(host, "aborted", null);
             return false;
-        sessionDomainGrants.add(host);
-        if (choice.startsWith("Allow for this project")) {
+        }
+        if (choice === undefined || choice === "Block") {
+            logNetworkAsk(host, "block", null);
+            return false;
+        }
+        // FAIL-CLOSED choice dispatch: every branch matches its option label
+        // explicitly — an unrecognized choice (a renamed/added dialog option in
+        // a future version) never silently grants; it denies with its own
+        // outcome in the trail.
+        if (choice.startsWith("Allow for this session")) {
+            sessionDomainGrants.add(host);
+            logNetworkAsk(host, "session", null);
+        }
+        else if (choice.startsWith("Allow for this project")) {
+            sessionDomainGrants.add(host);
+            logNetworkAsk(host, "allow", "project");
             try {
                 persistDomainGrant(opts.projectRoot ?? opts.cwd, host, resolvedStateHome);
             }
@@ -397,6 +430,8 @@ export function registerSandbox(pi, opts) {
             }
         }
         else if (choice.startsWith("Allow for all projects")) {
+            sessionDomainGrants.add(host);
+            logNetworkAsk(host, "allow", "user");
             try {
                 persistDomainGrant(null, host, resolvedStateHome);
             }
@@ -405,6 +440,10 @@ export function registerSandbox(pi, opts) {
                 ui.ui.notify?.("Could not persist the domain grant to the config file — it applies to this session only.", "warning");
             }
         }
+        else {
+            logNetworkAsk(host, "unknown", null);
+            return false; // an unrecognized choice never grants
+        }
         // The grant must reach the live srt config before the retry.
         manager.refreshConfig([...effectiveRulesForSandbox()]);
         return true;
@@ -945,6 +984,23 @@ function logFsDenialHint(fs, surface) {
         return;
     logEvent({ source: "sandbox", level: "info", event: "fs_denial_hint", fields: { class: fs.cls, surface } });
 }
+/** Sink line for every network-ask resolution. The ask was invisible in the
+ * incident session's trail — whether the dialog fired, which option was
+ * picked, and where the grant persisted had to be reconstructed from the
+ * config file by hand. outcome: session | allow | block | timeout |
+ * aborted | headless | unknown | error (the closed resolution vocabulary);
+ * tier: where a persistent grant landed (project | user) or null. The
+ * host rides the field (same exposure class as logGrantPersistFailure's
+ * `grant`) — the sink scrubs each line, and the transcript carries hosts
+ * anyway. */
+function logNetworkAsk(host, outcome, tier) {
+    logEvent({
+        source: "sandbox",
+        level: "info",
+        event: "network_ask",
+        fields: { host, outcome, tier },
+    });
+}
 /** Sink line for a failed domain-grant persist — the thrown message is
  * mutateConfigJson's own path/reason text (diagnosable, no file content),
  * same posture as sandbox_persist_failed / rule_save_failed. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yagni-app/code-staging",
-  "version": "1.1.6-staging.1448.1",
+  "version": "1.1.6-staging.1454.1",
   "description": "YAGNI Code: a terminal coding agent that already knows your company. One YAGNI login routes the model and grounds the agent in your team's context.",
   "license": "SEE LICENSE IN LICENSE.md",
   "author": "YAGNI, Inc. <jack@yagni.app> (https://yagni.app)",
@@ -58,5 +58,5 @@
     "turndown": "^7.2.4",
     "typebox": "^1.3.15"
   },
-  "yagniSourceSha": "54c5688071d09fa6a6fee1dbea2b44066352678f"
+  "yagniSourceSha": "d2f1a9de6f763b2144382fb42fed7cf36efa431a"
 }