@yagni-app/code-staging 1.2.3-staging.1661.1 → 1.2.3-staging.1700.1

package/dist/extension/index.js

@@ -918,7 +918,7 @@ export async function registerYagni(pi, deps = {}) {
         });
     if (sandboxHandle)
         sandboxHandle.setRules(loadedRules.rules);
-    registerPermissionGate(pi, {
+    const permissionGate = registerPermissionGate(pi, {
         ...(sandboxHandle
             ? {
                 sandboxAutoAllow: (toolName, params) => sandboxAutoAllowDecision(toolName, params, sandboxHandle.manager, sandboxHandle.settings()),
@@ -1955,6 +1955,13 @@ export async function registerYagni(pi, deps = {}) {
         if (GIT_MUTATING_PATTERN.test(command)) {
             footerInvalidateHandle.invalidateGit();
         }
+        // The gate's repeat-failure streaks: every bash outcome, sandboxed or
+        // not (an allowed command failing the same way ten times is denied).
+        if (command) {
+            permissionGate.recordBashOutcome(command, event.isError === true, (event.content ?? [])
+                .map((c) => (c && typeof c === "object" && "text" in c ? String(c.text) : ""))
+                .join("\n"));
+        }
         // The auto-sandbox rung's prior-failure evidence: a SANDBOXED bash
         // result carrying a sandbox-denial signature marks this command — its
         // later escape attempts re-arm the consent dialog instead of

package/dist/extension/permission/gate.d.ts

@@ -428,6 +428,22 @@ export declare const filterStalePlanContext: typeof filterStaleModeContext;
  * pre-widening read-only shape without a release.
  */
 export declare function escapeClassifyGateKnob(env?: NodeJS.ProcessEnv): boolean;
+/**
+ * The repeat-failure denial (spec 2026-10-08 build environments, §6): an
+ * allowed bash command that has failed identically this many times in a row
+ * is denied on the next attempt. In a build sandbox a missing tool otherwise
+ * turns into dozens of identical retries until the Guardian's cap stops the
+ * run with nothing to show for it.
+ */
+export declare const REPEAT_FAILURE_LIMIT = 10;
+export declare const REPEAT_FAILURE_REASON = "This command has failed the same way ten times; the sandbox cannot do what it asks.";
+interface RepeatFailureRing {
+    /** Feed one bash outcome (the tool_result's error flag and text). */
+    record(command: string, isError: boolean, text: string): void;
+    /** Has this command failed identically REPEAT_FAILURE_LIMIT times in a row? */
+    exhausted(command: string): boolean;
+}
+export declare function createRepeatFailureRing(): RepeatFailureRing;
 /** The decision source of ONE tool_call (telemetry), carried per invocation
  * because tool calls run concurrently: refined by the user dialog, hooks,
  * and Guardian outcomes as the call moves through the gate. */
@@ -445,6 +461,15 @@ export declare function wireToolCallGate(pi: Pick<ExtensionAPI, "on">, run: (eve
  * Wire the tool_call gate + the /mode command onto a shared mode holder. Default
  * auto, so absent any /mode this is a no-op over today's behavior.
  */
-export declare function registerPermissionGate(pi: ExtensionAPI, deps?: RegisterPermissionDeps): void;
+/** What the wiring layer feeds back into the gate from its tool_result listener. */
+export interface PermissionGateHandle {
+    /**
+     * One bash outcome, from index.ts's existing tool_result listener (the
+     * gate keeps no observer of its own): the command, the result's error flag
+     * and its text. Feeds the repeat-failure streaks. Fail-soft; never throws.
+     */
+    recordBashOutcome(command: string, isError: boolean, text: string): void;
+}
+export declare function registerPermissionGate(pi: ExtensionAPI, deps?: RegisterPermissionDeps): PermissionGateHandle;
 export {};
 //# sourceMappingURL=gate.d.ts.map

package/dist/extension/permission/gate.js

@@ -29,6 +29,7 @@
 import { derivePrefix, describePrefix, describeSeedPrefix, evaluateCompoundForEscape, matchesGrant, matchesCompoundGrants, sandboxFailureKey, storagePrefix, validateGrantForAsk, validateGrantForEscape, } from "./approvedPrefixes.js";
 import { consultPrefixMemoized, createPrefixMemo, PREFIX_CONSULT_GRACE_MS, segmentCannotYieldCandidate, } from "./prefixExtract.js";
 import { logEvent } from "../errorSink.js";
+import { splitExitStatusError } from "../bashSemantics.js";
 import { makeBlessStore as defaultMakeBlessStore } from "../bless.js";
 import { classifyCommand, DEFAULT_EXEC_POLICY } from "./execPolicy.js";
 import { evaluateRules } from "../permissionRules/engine.js";
@@ -374,6 +375,64 @@ function guardianErrorMessage(error) {
         default: return "unknown error";
     }
 }
+/**
+ * The repeat-failure denial (spec 2026-10-08 build environments, §6): an
+ * allowed bash command that has failed identically this many times in a row
+ * is denied on the next attempt. In a build sandbox a missing tool otherwise
+ * turns into dozens of identical retries until the Guardian's cap stops the
+ * run with nothing to show for it.
+ */
+export const REPEAT_FAILURE_LIMIT = 10;
+export const REPEAT_FAILURE_REASON = "This command has failed the same way ten times; the sandbox cannot do what it asks.";
+/** Commands tracked per session; the least recently failed drops out first. */
+const REPEAT_FAILURE_RING_MAX = 50;
+/** Whitespace-insensitive, on top of the grant canonicalization. */
+function repeatFailureKey(command) {
+    return sandboxFailureKey(command).replace(/\s+/g, " ");
+}
+/**
+ * A failure's identity: exit code + the first non-empty line of its output.
+ * pi's bash tool merges stderr into the output and throws non-zero exits as
+ * `<output>\n\nCommand exited with code N`, so the first output line is the
+ * error's first line. Anything else (abort, timeout, a gate block) has no
+ * exit code and returns null: it neither extends nor breaks a streak.
+ */
+function failureIdentity(text) {
+    const parsed = splitExitStatusError(text);
+    if (!parsed)
+        return null;
+    const firstLine = parsed.output.split("\n").map((l) => l.trim()).find((l) => l !== "") ?? "";
+    return `${parsed.exitCode}\u0000${firstLine}`;
+}
+export function createRepeatFailureRing() {
+    const streaks = new Map();
+    return {
+        record(command, isError, text) {
+            const key = repeatFailureKey(command);
+            if (!key)
+                return;
+            if (!isError) {
+                streaks.delete(key);
+                return;
+            }
+            const identity = failureIdentity(text);
+            if (identity === null)
+                return;
+            const prior = streaks.get(key);
+            const count = prior && prior.identity === identity ? prior.count + 1 : 1;
+            streaks.delete(key);
+            streaks.set(key, { identity, count });
+            if (streaks.size > REPEAT_FAILURE_RING_MAX) {
+                const oldest = streaks.keys().next().value;
+                if (oldest !== undefined)
+                    streaks.delete(oldest);
+            }
+        },
+        exhausted(command) {
+            return (streaks.get(repeatFailureKey(command))?.count ?? 0) >= REPEAT_FAILURE_LIMIT;
+        },
+    };
+}
 /**
  * The pi tool_call handler wiring (crash-honest attribution). Extracted so
  * the telemetry contract is testable against the production path: a thrown
@@ -424,10 +483,6 @@ export function wireToolCallGate(pi, run, onToolDecision) {
         }
     });
 }
-/**
- * Wire the tool_call gate + the /mode command onto a shared mode holder. Default
- * auto, so absent any /mode this is a no-op over today's behavior.
- */
 export function registerPermissionGate(pi, deps = {}) {
     const basePolicy = deps.policy ?? DEFAULT_PERMISSION_POLICY;
     let mode = deps.mode ?? "auto";
@@ -589,6 +644,10 @@ export function registerPermissionGate(pi, deps = {}) {
     deps.modeHolder?.onSet(() => {
         sandboxedFailures.clear();
     });
+    // Repeat-failure streaks (spec 2026-10-08 §6): per normalised command, the
+    // identity of its last failure and how many times in a row it failed that
+    // way. Session state, bounded LRU; a success of the command clears it.
+    const repeatFailures = createRepeatFailureRing();
     /** Shared consult-call builder: routes through the injectable seam with
      * the sink line + the onPrefixConsult hook — ONE place so the escape and
      * Guardian-ask fan-outs cannot drift. */
@@ -2196,7 +2255,28 @@ export function registerPermissionGate(pi, deps = {}) {
             reason: "The permission dialog was dismissed; the command was not run. Ask the user how to proceed.",
         };
     };
-    wireToolCallGate(pi, gateToolCall, deps.onToolDecision);
+    // The repeat-failure denial rides the result side of an ALLOWED call: the
+    // gate (Guardian, rules, grants, hooks) decides first exactly as before,
+    // and only a call it would let through is checked against the streak. One
+    // missing tool must not turn into eighty identical pulls.
+    const gateWithRepeatFailure = async (event, ctx, slot) => {
+        const result = await gateToolCall(event, ctx, slot);
+        if (result?.block || event.toolName !== "bash")
+            return result;
+        const command = event.input?.command;
+        if (typeof command !== "string" || !repeatFailures.exhausted(command))
+            return result;
+        slot.source = "config";
+        logEvent({
+            source: "permission-rules",
+            level: "info",
+            event: "repeat_failure_denied",
+            // No command content on the always-on tier; the limit is the evidence.
+            fields: { limit: REPEAT_FAILURE_LIMIT },
+        });
+        return { block: true, reason: REPEAT_FAILURE_REASON };
+    };
+    wireToolCallGate(pi, gateWithRepeatFailure, deps.onToolDecision);
     // Model awareness: every agent turn carries a hidden mode-context message so
     // the model knows what it can do (auto: verify proactively, review: wait for
     // approval, plan: hold writes). The context hook strips stale mode context
@@ -2254,5 +2334,23 @@ export function registerPermissionGate(pi, deps = {}) {
             }
         },
     });
+    return {
+        recordBashOutcome: (command, isError, text) => {
+            try {
+                repeatFailures.record(command, isError, text);
+            }
+            catch (err) {
+                try {
+                    logEvent({
+                        source: "permission-rules",
+                        level: "warn",
+                        event: "repeat_failure_record_failed",
+                        fields: { error: err instanceof Error ? err.constructor.name : typeof err },
+                    });
+                }
+                catch { /* telemetry must never affect the gate */ }
+            }
+        },
+    };
 }
 //# sourceMappingURL=gate.js.map

package/dist/extension/pipeline/budget.d.ts

@@ -94,12 +94,17 @@ export declare function stageWontFit(budget: RunBudget, kind: TimedStageKind, ex
  * than the time actually left, since the host stops the run at the deadline.
  */
 export declare const STAGE_WALL_FLOOR_MS: number;
-/** Time the verify gate is allowed after the last write, on top of the stage estimates. */
+/**
+ * Time the verify gate is allowed after the last write, on top of the stage
+ * estimates: the verify run's own ceiling (`VERIFY_TIMEOUT_MS`, twenty
+ * minutes). Five until 2026-10-09, when verify could run ten, so a long stage
+ * could leave the gate less time than it may take.
+ */
 export declare const VERIFY_ALLOWANCE_MS: number;
 /**
  * What must still run after a stage stops: a review round, one fix, and the
- * verify gate. Held back from the stage's wall clock so a long stage still
- * leaves the run time to review what it wrote.
+ * verify gate (4 + 6 + 20 = 30 minutes). Held back from the stage's wall clock
+ * so a long stage still leaves the run time to review and verify what it wrote.
  */
 export declare const STAGE_WALL_RESERVE_MS: number;
 /**

package/dist/extension/pipeline/budget.js

@@ -126,12 +126,17 @@ export function stageWontFit(budget, kind, expectedMs, nowMs = Date.now()) {
  * than the time actually left, since the host stops the run at the deadline.
  */
 export const STAGE_WALL_FLOOR_MS = 20 * 60_000;
-/** Time the verify gate is allowed after the last write, on top of the stage estimates. */
-export const VERIFY_ALLOWANCE_MS = 5 * 60_000;
+/**
+ * Time the verify gate is allowed after the last write, on top of the stage
+ * estimates: the verify run's own ceiling (`VERIFY_TIMEOUT_MS`, twenty
+ * minutes). Five until 2026-10-09, when verify could run ten, so a long stage
+ * could leave the gate less time than it may take.
+ */
+export const VERIFY_ALLOWANCE_MS = 20 * 60_000;
 /**
  * What must still run after a stage stops: a review round, one fix, and the
- * verify gate. Held back from the stage's wall clock so a long stage still
- * leaves the run time to review what it wrote.
+ * verify gate (4 + 6 + 20 = 30 minutes). Held back from the stage's wall clock
+ * so a long stage still leaves the run time to review and verify what it wrote.
  */
 export const STAGE_WALL_RESERVE_MS = DEFAULT_STAGE_ESTIMATE_MS.review + DEFAULT_STAGE_ESTIMATE_MS.fix + VERIFY_ALLOWANCE_MS;
 /**

package/dist/extension/pipeline/types.d.ts

@@ -544,9 +544,10 @@ export interface ResiliencePolicy {
 }
 /**
  * Default resilience policy. Generous timeouts so a legitimately long but live
- * stage is never killed: the idle window (well under the 5-min run heartbeat) is
- * the check for a stuck model, and the wall window only bounds a runaway that
- * keeps emitting events. The wall is 60 minutes for an interactive /go, where a
+ * stage is never killed: the idle window is the check for a stuck model (four
+ * minutes until 2026-10-09; fifteen now, since a long test run or a slow
+ * model turn emits nothing for minutes and is not stuck), and the wall window
+ * only bounds a runaway that keeps emitting events. The wall is 60 minutes for an interactive /go, where a
  * person can abort; a run with a deadline replaces it per stage with the time
  * left (budget.ts#stageWall). Three attempts with short, jittered
  * backoff so a single transient blip across the up-to-8 child spawns no longer

package/dist/extension/pipeline/types.js

@@ -21,16 +21,17 @@ export const MAX_REVIEW_ROUNDS = 2;
 export const MAX_FIX_TURNS = 3;
 /**
  * Default resilience policy. Generous timeouts so a legitimately long but live
- * stage is never killed: the idle window (well under the 5-min run heartbeat) is
- * the check for a stuck model, and the wall window only bounds a runaway that
- * keeps emitting events. The wall is 60 minutes for an interactive /go, where a
+ * stage is never killed: the idle window is the check for a stuck model (four
+ * minutes until 2026-10-09; fifteen now, since a long test run or a slow
+ * model turn emits nothing for minutes and is not stuck), and the wall window
+ * only bounds a runaway that keeps emitting events. The wall is 60 minutes for an interactive /go, where a
  * person can abort; a run with a deadline replaces it per stage with the time
  * left (budget.ts#stageWall). Three attempts with short, jittered
  * backoff so a single transient blip across the up-to-8 child spawns no longer
  * terminates the whole run.
  */
 export const DEFAULT_RESILIENCE_POLICY = {
-    idleTimeoutMs: 4 * 60_000,
+    idleTimeoutMs: 15 * 60_000,
     wallTimeoutMs: 60 * 60_000,
     maxAttempts: 3,
     backoffBaseMs: 1_000,

package/dist/extension/pipeline/verify.d.ts

@@ -47,9 +47,13 @@
  * findings, handoffs, or run records (§0.9).
  */
 import type { Finding } from "./types.js";
-/** Total wall-clock budget for a single verify run before it is abandoned (fail-open). */
+/**
+ * Total wall-clock budget for a single verify run before it is abandoned
+ * (fail-open). Ten minutes until 2026-10-09; twenty now, matching the run
+ * budget's `VERIFY_ALLOWANCE_MS`.
+ */
 export declare const VERIFY_TIMEOUT_MS: number;
-/** Per-PACKAGE wall-clock budget for the test half (spec §3d); overrun fails open. */
+/** Per-PACKAGE wall-clock budget for the test half (spec §3d); overrun fails open. Ten minutes until 2026-10-09. */
 export declare const VERIFY_TEST_TIMEOUT_MS: number;
 /** A resolved verify command plus how it was found. */
 export interface VerifyCommand {

package/dist/extension/pipeline/verify.js

@@ -59,10 +59,14 @@ import { claimCovers } from "./fanout.js";
 import { composeAbortSignal } from "./resilience.js";
 import { scrubSecrets } from "./scrubSecrets.js";
 import { snapshotWorkspace } from "./workspace.js";
-/** Total wall-clock budget for a single verify run before it is abandoned (fail-open). */
-export const VERIFY_TIMEOUT_MS = 10 * 60_000;
-/** Per-PACKAGE wall-clock budget for the test half (spec §3d); overrun fails open. */
-export const VERIFY_TEST_TIMEOUT_MS = 10 * 60_000;
+/**
+ * Total wall-clock budget for a single verify run before it is abandoned
+ * (fail-open). Ten minutes until 2026-10-09; twenty now, matching the run
+ * budget's `VERIFY_ALLOWANCE_MS`.
+ */
+export const VERIFY_TIMEOUT_MS = 20 * 60_000;
+/** Per-PACKAGE wall-clock budget for the test half (spec §3d); overrun fails open. Ten minutes until 2026-10-09. */
+export const VERIFY_TEST_TIMEOUT_MS = 20 * 60_000;
 /** Cap on located findings parsed from one failing run, and on the opaque-tail message. */
 const MAX_LOCATED_FINDINGS = 25;
 const MAX_TAIL_CHARS = 1000;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yagni-app/code-staging",
-  "version": "1.2.3-staging.1661.1",
+  "version": "1.2.3-staging.1700.1",
   "description": "YAGNI Code: a terminal coding agent that already knows your company. One YAGNI login routes the model and grounds the agent in your team's context.",
   "license": "SEE LICENSE IN LICENSE.md",
   "author": "YAGNI, Inc. <jack@yagni.app> (https://yagni.app)",
@@ -58,5 +58,5 @@
     "turndown": "^7.2.4",
     "typebox": "^1.3.15"
   },
-  "yagniSourceSha": "78db828d4bed8121dd01039b1ee8ef846f2136a7"
+  "yagniSourceSha": "ca2b75c6072f31b7a6c2ee58fa166ce63b0cefca"
 }