@yagni-app/code-staging 1.2.12-staging.2152.1 → 1.2.12-staging.2153.1

package/dist/extension/branding.d.ts

@@ -101,11 +101,12 @@ export declare const SANDBOX_SECTION: string;
  * --cloud`, the one-attempt lane), in place of {@link SANDBOX_SECTION}: `gh`
  * works through YAGNI's forwarder (the run token stands in for a GitHub
  * token, and the forwarder holds the real one), ticket images are files, and
- * sibling repositories clone on demand. The only absolute paths it names are
- * the browser's, which {@link SANDBOX_SECTION} names too, so the pi image
- * smoke's check of that section covers them; the input folder and the clone
- * folder are named relative to the ticket and the home directory, since the
- * host creates them per session and they are not on the image.
+ * sibling repositories are read with `gh api` on demand: the session holds no
+ * git credential, so a clone of one fails (ENG-3033). The only absolute paths
+ * it names are the browser's, which {@link SANDBOX_SECTION} names too, so the
+ * pi image smoke's check of that section covers them; the input folder is
+ * named relative to the ticket, since the host creates it per session and it
+ * is not on the image.
  *
  * Content constraints (parity with {@link TICKET_IMAGE_RULE}): must not
  * contain the standalone word "pi", no `- ` bullet lines, no emojis.

package/dist/extension/branding.js

@@ -212,11 +212,12 @@ export const SANDBOX_SECTION = `${SANDBOX_SECTION_HEADER}\n` +
  * --cloud`, the one-attempt lane), in place of {@link SANDBOX_SECTION}: `gh`
  * works through YAGNI's forwarder (the run token stands in for a GitHub
  * token, and the forwarder holds the real one), ticket images are files, and
- * sibling repositories clone on demand. The only absolute paths it names are
- * the browser's, which {@link SANDBOX_SECTION} names too, so the pi image
- * smoke's check of that section covers them; the input folder and the clone
- * folder are named relative to the ticket and the home directory, since the
- * host creates them per session and they are not on the image.
+ * sibling repositories are read with `gh api` on demand: the session holds no
+ * git credential, so a clone of one fails (ENG-3033). The only absolute paths
+ * it names are the browser's, which {@link SANDBOX_SECTION} names too, so the
+ * pi image smoke's check of that section covers them; the input folder is
+ * named relative to the ticket, since the host creates it per session and it
+ * is not on the image.
  *
  * Content constraints (parity with {@link TICKET_IMAGE_RULE}): must not
  * contain the standalone word "pi", no `- ` bullet lines, no emojis.
@@ -228,7 +229,7 @@ export const SANDBOX_CLOUD_SECTION = `${SANDBOX_SECTION_HEADER}\n` +
     "\n" +
     "GitHub: `gh` works. It talks to YAGNI's forwarder, which makes each call as " +
     "this Team's GitHub App, so no token you could write with is in this " +
-    "sandbox. It reads the repositories the installation can see, and it writes " +
+    "sandbox. It reads this Team's repositories, and it writes " +
     "only to this attempt's branch and pull request; merging and approving a " +
     "review are refused. Commit your work and do not push: YAGNI pushes the " +
     "branch and opens the pull request after you finish.\n" +
@@ -246,10 +247,12 @@ export const SANDBOX_CLOUD_SECTION = `${SANDBOX_SECTION_HEADER}\n` +
     "Installs: the network is open, and you may install what the work needs.\n" +
     "\n" +
     "Other repositories: the ticket lists this account's other repositories. When " +
-    "the work depends on one, clone it read-only on demand with " +
-    "`git clone --filter=blob:none --depth 1` into `~/context/<repo>`: file " +
-    "contents arrive as you read them, so a clone takes seconds. Nothing there is " +
-    "part of your change.";
+    "the work depends on one, read it with gh on demand, never with git clone: " +
+    "this sandbox has no git credential, so a clone fails. List its files with " +
+    "`gh api 'repos/<owner>/<repo>/git/trees/HEAD?recursive=1' --jq '.tree[].path'` " +
+    "and read one with " +
+    "`gh api -H 'Accept: application/vnd.github.raw' 'repos/<owner>/<repo>/contents/<path>'`. " +
+    "Nothing there is part of your change.";
 /**
  * File-tool steering: prefer the first-class write/edit tools over bash file
  * writes, one write call per file instead of a heredoc batch, and never create

package/dist/extension/pipeline/stages.js

@@ -206,7 +206,7 @@ function cloudPlanTask(inputDir) {
         `- ${at("checks.json")}: the repository's checks, and which already fail on the unchanged code.\n` +
         `- ${at("playbook.md")}: the Team's planning rules. Always follow them.\n` +
         `- ${at("plan-line.md")}: this Team's instructions for planning.\n` +
-        `- The repositories under "Read these repositories first" in ${at("ticket.md")}: clone each read-only ` +
+        `- The repositories under "Read these repositories first" in ${at("ticket.md")}: read each with gh ` +
         "as it says, and read the pages it names before you plan; they are this team's own account of how " +
         "the code works.\n\n" +
         "Planning is reading code, nothing else. Settle a fact by reading files, grepping, listing folders, and " +
@@ -217,8 +217,10 @@ function cloudPlanTask(inputDir) {
         "plan's checks, which the build runs.\n\n" +
         'If a command fails with "no space left on device", the disk is full: stop there. Do not delete files, ' +
         "prune Docker or retry. Write the plan and say what you could not check.\n\n" +
-        "When the work depends on another repository the ticket's Other repositories section lists, clone it " +
-        "read-only on demand with `git clone --filter=blob:none --depth 1` into ~/context/<repo> and read it there. " +
+        "When the work depends on another repository the ticket's Other repositories section lists, read it on " +
+        "demand with gh, never git clone (this session has no git credential): list its files with " +
+        "`gh api 'repos/<owner>/<repo>/git/trees/HEAD?recursive=1' --jq '.tree[].path'`, then read one with " +
+        "`gh api -H 'Accept: application/vnd.github.raw' 'repos/<owner>/<repo>/contents/<path>'`. " +
         "When the change itself needs writes in one of those repositories (an API this repository calls, a " +
         "package it consumes), say so in the plan's repositoriesNeeded, in build order: the ticket is then " +
         "split into one ticket per repository, built in that order, and each step for another repository " +

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yagni-app/code-staging",
-  "version": "1.2.12-staging.2152.1",
+  "version": "1.2.12-staging.2153.1",
   "description": "YAGNI Code: a terminal coding agent that already knows your company. One YAGNI login routes the model and grounds the agent in your team's context.",
   "license": "SEE LICENSE IN LICENSE.md",
   "author": "YAGNI, Inc. <jack@yagni.app> (https://yagni.app)",
@@ -58,5 +58,5 @@
     "turndown": "^7.2.4",
     "typebox": "^1.3.15"
   },
-  "yagniSourceSha": "c3ae13f6e1610823d8be87de23f2ac67f1b65f83"
+  "yagniSourceSha": "fdf464d8acc19ee17793ac575b7d93ec29f5e984"
 }