@yagni-app/code-staging 1.2.3-staging.1686.1 → 1.2.3-staging.1701.1

package/dist/extension/index.js

@@ -918,7 +918,7 @@ export async function registerYagni(pi, deps = {}) {
         });
     if (sandboxHandle)
         sandboxHandle.setRules(loadedRules.rules);
-    registerPermissionGate(pi, {
+    const permissionGate = registerPermissionGate(pi, {
         ...(sandboxHandle
             ? {
                 sandboxAutoAllow: (toolName, params) => sandboxAutoAllowDecision(toolName, params, sandboxHandle.manager, sandboxHandle.settings()),
@@ -1955,6 +1955,13 @@ export async function registerYagni(pi, deps = {}) {
         if (GIT_MUTATING_PATTERN.test(command)) {
             footerInvalidateHandle.invalidateGit();
         }
+        // The gate's repeat-failure streaks: every bash outcome, sandboxed or
+        // not (an allowed command failing the same way ten times is denied).
+        if (command) {
+            permissionGate.recordBashOutcome(command, event.isError === true, (event.content ?? [])
+                .map((c) => (c && typeof c === "object" && "text" in c ? String(c.text) : ""))
+                .join("\n"));
+        }
         // The auto-sandbox rung's prior-failure evidence: a SANDBOXED bash
         // result carrying a sandbox-denial signature marks this command — its
         // later escape attempts re-arm the consent dialog instead of

package/dist/extension/permission/gate.d.ts

@@ -428,6 +428,22 @@ export declare const filterStalePlanContext: typeof filterStaleModeContext;
  * pre-widening read-only shape without a release.
  */
 export declare function escapeClassifyGateKnob(env?: NodeJS.ProcessEnv): boolean;
+/**
+ * The repeat-failure denial (spec 2026-10-08 build environments, §6): an
+ * allowed bash command that has failed identically this many times in a row
+ * is denied on the next attempt. In a build sandbox a missing tool otherwise
+ * turns into dozens of identical retries until the Guardian's cap stops the
+ * run with nothing to show for it.
+ */
+export declare const REPEAT_FAILURE_LIMIT = 10;
+export declare const REPEAT_FAILURE_REASON = "This command has failed the same way ten times; the sandbox cannot do what it asks.";
+interface RepeatFailureRing {
+    /** Feed one bash outcome (the tool_result's error flag and text). */
+    record(command: string, isError: boolean, text: string): void;
+    /** Has this command failed identically REPEAT_FAILURE_LIMIT times in a row? */
+    exhausted(command: string): boolean;
+}
+export declare function createRepeatFailureRing(): RepeatFailureRing;
 /** The decision source of ONE tool_call (telemetry), carried per invocation
  * because tool calls run concurrently: refined by the user dialog, hooks,
  * and Guardian outcomes as the call moves through the gate. */
@@ -445,6 +461,15 @@ export declare function wireToolCallGate(pi: Pick<ExtensionAPI, "on">, run: (eve
  * Wire the tool_call gate + the /mode command onto a shared mode holder. Default
  * auto, so absent any /mode this is a no-op over today's behavior.
  */
-export declare function registerPermissionGate(pi: ExtensionAPI, deps?: RegisterPermissionDeps): void;
+/** What the wiring layer feeds back into the gate from its tool_result listener. */
+export interface PermissionGateHandle {
+    /**
+     * One bash outcome, from index.ts's existing tool_result listener (the
+     * gate keeps no observer of its own): the command, the result's error flag
+     * and its text. Feeds the repeat-failure streaks. Fail-soft; never throws.
+     */
+    recordBashOutcome(command: string, isError: boolean, text: string): void;
+}
+export declare function registerPermissionGate(pi: ExtensionAPI, deps?: RegisterPermissionDeps): PermissionGateHandle;
 export {};
 //# sourceMappingURL=gate.d.ts.map

package/dist/extension/permission/gate.js

@@ -29,6 +29,7 @@
 import { derivePrefix, describePrefix, describeSeedPrefix, evaluateCompoundForEscape, matchesGrant, matchesCompoundGrants, sandboxFailureKey, storagePrefix, validateGrantForAsk, validateGrantForEscape, } from "./approvedPrefixes.js";
 import { consultPrefixMemoized, createPrefixMemo, PREFIX_CONSULT_GRACE_MS, segmentCannotYieldCandidate, } from "./prefixExtract.js";
 import { logEvent } from "../errorSink.js";
+import { splitExitStatusError } from "../bashSemantics.js";
 import { makeBlessStore as defaultMakeBlessStore } from "../bless.js";
 import { classifyCommand, DEFAULT_EXEC_POLICY } from "./execPolicy.js";
 import { evaluateRules } from "../permissionRules/engine.js";
@@ -374,6 +375,64 @@ function guardianErrorMessage(error) {
         default: return "unknown error";
     }
 }
+/**
+ * The repeat-failure denial (spec 2026-10-08 build environments, §6): an
+ * allowed bash command that has failed identically this many times in a row
+ * is denied on the next attempt. In a build sandbox a missing tool otherwise
+ * turns into dozens of identical retries until the Guardian's cap stops the
+ * run with nothing to show for it.
+ */
+export const REPEAT_FAILURE_LIMIT = 10;
+export const REPEAT_FAILURE_REASON = "This command has failed the same way ten times; the sandbox cannot do what it asks.";
+/** Commands tracked per session; the least recently failed drops out first. */
+const REPEAT_FAILURE_RING_MAX = 50;
+/** Whitespace-insensitive, on top of the grant canonicalization. */
+function repeatFailureKey(command) {
+    return sandboxFailureKey(command).replace(/\s+/g, " ");
+}
+/**
+ * A failure's identity: exit code + the first non-empty line of its output.
+ * pi's bash tool merges stderr into the output and throws non-zero exits as
+ * `<output>\n\nCommand exited with code N`, so the first output line is the
+ * error's first line. Anything else (abort, timeout, a gate block) has no
+ * exit code and returns null: it neither extends nor breaks a streak.
+ */
+function failureIdentity(text) {
+    const parsed = splitExitStatusError(text);
+    if (!parsed)
+        return null;
+    const firstLine = parsed.output.split("\n").map((l) => l.trim()).find((l) => l !== "") ?? "";
+    return `${parsed.exitCode}\u0000${firstLine}`;
+}
+export function createRepeatFailureRing() {
+    const streaks = new Map();
+    return {
+        record(command, isError, text) {
+            const key = repeatFailureKey(command);
+            if (!key)
+                return;
+            if (!isError) {
+                streaks.delete(key);
+                return;
+            }
+            const identity = failureIdentity(text);
+            if (identity === null)
+                return;
+            const prior = streaks.get(key);
+            const count = prior && prior.identity === identity ? prior.count + 1 : 1;
+            streaks.delete(key);
+            streaks.set(key, { identity, count });
+            if (streaks.size > REPEAT_FAILURE_RING_MAX) {
+                const oldest = streaks.keys().next().value;
+                if (oldest !== undefined)
+                    streaks.delete(oldest);
+            }
+        },
+        exhausted(command) {
+            return (streaks.get(repeatFailureKey(command))?.count ?? 0) >= REPEAT_FAILURE_LIMIT;
+        },
+    };
+}
 /**
  * The pi tool_call handler wiring (crash-honest attribution). Extracted so
  * the telemetry contract is testable against the production path: a thrown
@@ -424,10 +483,6 @@ export function wireToolCallGate(pi, run, onToolDecision) {
         }
     });
 }
-/**
- * Wire the tool_call gate + the /mode command onto a shared mode holder. Default
- * auto, so absent any /mode this is a no-op over today's behavior.
- */
 export function registerPermissionGate(pi, deps = {}) {
     const basePolicy = deps.policy ?? DEFAULT_PERMISSION_POLICY;
     let mode = deps.mode ?? "auto";
@@ -589,6 +644,10 @@ export function registerPermissionGate(pi, deps = {}) {
     deps.modeHolder?.onSet(() => {
         sandboxedFailures.clear();
     });
+    // Repeat-failure streaks (spec 2026-10-08 §6): per normalised command, the
+    // identity of its last failure and how many times in a row it failed that
+    // way. Session state, bounded LRU; a success of the command clears it.
+    const repeatFailures = createRepeatFailureRing();
     /** Shared consult-call builder: routes through the injectable seam with
      * the sink line + the onPrefixConsult hook — ONE place so the escape and
      * Guardian-ask fan-outs cannot drift. */
@@ -2196,7 +2255,28 @@ export function registerPermissionGate(pi, deps = {}) {
             reason: "The permission dialog was dismissed; the command was not run. Ask the user how to proceed.",
         };
     };
-    wireToolCallGate(pi, gateToolCall, deps.onToolDecision);
+    // The repeat-failure denial rides the result side of an ALLOWED call: the
+    // gate (Guardian, rules, grants, hooks) decides first exactly as before,
+    // and only a call it would let through is checked against the streak. One
+    // missing tool must not turn into eighty identical pulls.
+    const gateWithRepeatFailure = async (event, ctx, slot) => {
+        const result = await gateToolCall(event, ctx, slot);
+        if (result?.block || event.toolName !== "bash")
+            return result;
+        const command = event.input?.command;
+        if (typeof command !== "string" || !repeatFailures.exhausted(command))
+            return result;
+        slot.source = "config";
+        logEvent({
+            source: "permission-rules",
+            level: "info",
+            event: "repeat_failure_denied",
+            // No command content on the always-on tier; the limit is the evidence.
+            fields: { limit: REPEAT_FAILURE_LIMIT },
+        });
+        return { block: true, reason: REPEAT_FAILURE_REASON };
+    };
+    wireToolCallGate(pi, gateWithRepeatFailure, deps.onToolDecision);
     // Model awareness: every agent turn carries a hidden mode-context message so
     // the model knows what it can do (auto: verify proactively, review: wait for
     // approval, plan: hold writes). The context hook strips stale mode context
@@ -2254,5 +2334,23 @@ export function registerPermissionGate(pi, deps = {}) {
             }
         },
     });
+    return {
+        recordBashOutcome: (command, isError, text) => {
+            try {
+                repeatFailures.record(command, isError, text);
+            }
+            catch (err) {
+                try {
+                    logEvent({
+                        source: "permission-rules",
+                        level: "warn",
+                        event: "repeat_failure_record_failed",
+                        fields: { error: err instanceof Error ? err.constructor.name : typeof err },
+                    });
+                }
+                catch { /* telemetry must never affect the gate */ }
+            }
+        },
+    };
 }
 //# sourceMappingURL=gate.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yagni-app/code-staging",
-  "version": "1.2.3-staging.1686.1",
+  "version": "1.2.3-staging.1701.1",
   "description": "YAGNI Code: a terminal coding agent that already knows your company. One YAGNI login routes the model and grounds the agent in your team's context.",
   "license": "SEE LICENSE IN LICENSE.md",
   "author": "YAGNI, Inc. <jack@yagni.app> (https://yagni.app)",
@@ -58,5 +58,5 @@
     "turndown": "^7.2.4",
     "typebox": "^1.3.15"
   },
-  "yagniSourceSha": "44055f7635d957d2f2f19a547cb945a6e942de62"
+  "yagniSourceSha": "17afa06cf2895ba0df94906ec0300b989ecc4d20"
 }