@yagni-app/code-staging 1.2.3-staging.1701.1 → 1.2.3-staging.1708.1

package/dist/extension/condensedTools.d.ts

@@ -24,7 +24,7 @@
  * pattern) so tests run against plain text. Renderer exceptions are swallowed
  * by pi (degrading to the built-in fallback), so everything stays total.
  */
-import { SettingsManager, type ExtensionAPI, type ToolDefinition } from "@earendil-works/pi-coding-agent";
+import { SettingsManager, type BashSpawnHook, type ExtensionAPI, type ToolDefinition } from "@earendil-works/pi-coding-agent";
 import type { RenderTheme } from "./subagentRender.js";
 import { ToolRunTracker } from "./toolRuns.js";
 /** Lines of write content shown collapsed (mirrors Claude Code's preview). */
@@ -96,6 +96,13 @@ export interface RegisterCondensedToolsDeps {
      * model's tool calls.
      */
     wrapBash?: (def: ToolDefinition) => ToolDefinition;
+    /**
+     * A spawn hook on the base bash definition (the build sandbox's toolchain
+     * hook), so the model's commands get the repository's toolchain even when
+     * the sandbox composition is identity. The sandbox, when on, builds its own
+     * definition and composes the same hook before its proxy hook.
+     */
+    bashSpawnHook?: BashSpawnHook;
 }
 /**
  * Re-register the seven built-ins with condensed renderers. Returns the

package/dist/extension/condensedTools.js

@@ -357,6 +357,8 @@ export function registerCondensedTools(pi, deps = {}) {
     catch {
         toolOptions = { bash: {}, read: {} };
     }
+    if (deps.bashSpawnHook)
+        toolOptions.bash = { ...toolOptions.bash, spawnHook: deps.bashSpawnHook };
     const buildDefinitions = (cwd) => {
         const defs = {
             read: createReadToolDefinition(cwd, toolOptions.read),

package/dist/extension/index.js

@@ -44,6 +44,7 @@ import { isSandboxDenialOutput, sandboxAutoAllowDecision, sandboxDenialSignature
 import { sandboxFailureKey } from "./permission/approvedPrefixes.js";
 import { createEscapeTally } from "./sandbox/escapeTally.js";
 import { createGrantCensus } from "./permission/grantCensus.js";
+import { toolchainSpawnHookFromEnv, toolchainUserBashOperations } from "./toolchain/spawnHook.js";
 import { registerTelemetry as defaultRegisterTelemetry } from "./telemetry/register.js";
 import { loadHooksConfig, makeHookRunner, registerHooks } from "./hooks.js";
 import { loadPermissionRules } from "./permissionRules/loadConfig.js";
@@ -900,11 +901,17 @@ export async function registerYagni(pi, deps = {}) {
     // surfacing. Nothing is pruned, nothing is written back to rules.json.
     const grantCensus = createGrantCensus();
     grantCensus.seed(sessionGrants);
+    // A build sandbox's toolchain (spec 2026-10-08 §1): when the harness names a
+    // readable toolchain file, every bash spawn and `!` command runs on the
+    // repository's PATH and variables while this process stays on the image's
+    // Node. Composed before the sandbox's proxy hook. Absent everywhere else.
+    const toolchainHook = evalMode ? undefined : toolchainSpawnHookFromEnv(env);
     const sandboxHandle = evalMode
         ? null
         : registerSandbox(pi, {
             cwd: process.cwd(),
             env,
+            ...(toolchainHook ? { baseSpawnHook: toolchainHook } : {}),
             hasUI: (ctx) => ctx.hasUI,
             onShellResolutionRetry: (outcome) => telemetry.sandboxShellResolutionRetry(outcome),
             escapeBreakdown: () => escapeTally.breakdown(),
@@ -918,6 +925,13 @@ export async function registerYagni(pi, deps = {}) {
         });
     if (sandboxHandle)
         sandboxHandle.setRules(loadedRules.rules);
+    if (toolchainHook) {
+        // After the sandbox's own handler: a sandboxed `!` command is answered
+        // there (with this hook applied); any other runs here on the toolchain.
+        pi.on("user_bash", () => ({
+            operations: toolchainUserBashOperations(toolchainHook, process.cwd()),
+        }));
+    }
     const permissionGate = registerPermissionGate(pi, {
         ...(sandboxHandle
             ? {
@@ -1528,6 +1542,7 @@ export async function registerYagni(pi, deps = {}) {
                 // built-ins last), so the sandbox composes INTO it here. Identity when
                 // the sandbox is off.
                 ...(sandboxHandle ? { wrapBash: sandboxHandle.composeBash } : {}),
+                ...(toolchainHook ? { bashSpawnHook: toolchainHook } : {}),
             });
             condensedToolsRegistered = true;
         }

package/dist/extension/sandbox/session.d.ts

@@ -11,7 +11,7 @@
  * some providers). /sandbox (M5) toggles by rewriting settings and asking
  * for a session restart, the same way Claude persists the toggle.
  */
-import { type ExtensionAPI, type ExtensionContext, type ToolDefinition } from "@earendil-works/pi-coding-agent";
+import { type BashSpawnHook, type ExtensionAPI, type ExtensionContext, type ToolDefinition } from "@earendil-works/pi-coding-agent";
 import { type SandboxSettings } from "./config.js";
 import { YagniSandboxManager } from "./manager.js";
 import { type SandboxNetworkChoice } from "./panel.js";
@@ -31,7 +31,7 @@ import type { PermissionRule } from "../permissionRules/loadConfig.js";
 export declare function makeBashComposition(manager: YagniSandboxManager, settings: () => SandboxSettings, cwd: string, onShellResolutionRetry?: (outcome: "recovered" | "exhausted") => void, fsScope?: () => {
     allowWrite: readonly string[];
     denyWrite: readonly string[];
-} | null): (def: ToolDefinition) => ToolDefinition;
+} | null, baseSpawnHook?: BashSpawnHook): (def: ToolDefinition) => ToolDefinition;
 export interface SandboxSessionHandle {
     manager: YagniSandboxManager;
     settings: () => SandboxSettings;
@@ -94,6 +94,9 @@ export interface RegisterSandboxOptions {
      * the /sandbox panel's grants section — the never-matched surfacing.
      * Absent ⇒ no grants section. */
     grantCensus?: () => import("../permission/grantCensus.js").GrantCensusEntry[];
+    /** A spawn hook every bash spawn runs before the sandbox's own (the
+     * toolchain hook in a build sandbox). Absent: the sandbox hook alone. */
+    baseSpawnHook?: BashSpawnHook;
 }
 /**
  * Register the sandbox surfaces on the ExtensionAPI. Returns the session

package/dist/extension/sandbox/session.js

@@ -19,6 +19,7 @@ import { Key } from "@earendil-works/pi-tui";
 import { createBashToolDefinition, getShellConfig, SettingsManager, } from "@earendil-works/pi-coding-agent";
 import { bgLaunchResult, startBackgroundJob } from "../bgJobs.js";
 import { logEvent } from "../errorSink.js";
+import { composeSpawnHooks } from "../toolchain/spawnHook.js";
 import { codeStateHome } from "../stateHome.js";
 import { isDebug } from "../diagnostics.js";
 import { mutateConfigJson, mutateLocalConfig } from "../settingsFiles.js";
@@ -40,13 +41,14 @@ import { effectiveRules } from "../permissionRules/loadConfig.js";
  * here would be overwritten and the sandbox would silently never reach
  * model-driven tool calls.
  */
-export function makeBashComposition(manager, settings, cwd, onShellResolutionRetry, fsScope) {
+export function makeBashComposition(manager, settings, cwd, onShellResolutionRetry, fsScope, baseSpawnHook) {
     return (def) => {
         if (!settings().enabled)
             return def;
         const userShellPath = SettingsManager.create(cwd).getShellPath();
         const { shell: binShell } = getShellConfig(userShellPath);
-        const spawnHook = makeSandboxSpawnHook(manager);
+        // The toolchain hook (when the session has one) first, then the proxy env on top.
+        const spawnHook = composeSpawnHooks(baseSpawnHook, makeSandboxSpawnHook(manager));
         const sandboxBash = createBashToolDefinition(cwd, {
             shellPath: userShellPath,
             spawnHook,
@@ -460,10 +462,17 @@ export function registerSandbox(pi, opts) {
         logShellResolutionRetry(outcome);
         opts.onShellResolutionRetry?.(outcome);
     };
-    const composeBash = makeBashComposition(manager, () => currentSettings, opts.cwd, onShellResolutionRetry, fsScope);
+    const composeBash = makeBashComposition(manager, () => currentSettings, opts.cwd, onShellResolutionRetry, fsScope, opts.baseSpawnHook);
     const registerOwnBash = () => {
-        if (!currentSettings.enabled)
+        if (!currentSettings.enabled) {
+            // Sandbox off: stock bash stays, except that a base hook (the build
+            // sandbox's toolchain) still has to reach the model's spawns.
+            if (!opts.baseSpawnHook)
+                return;
+            const userShellPath = SettingsManager.create(opts.cwd).getShellPath();
+            pi.registerTool(createBashToolDefinition(opts.cwd, { shellPath: userShellPath, spawnHook: opts.baseSpawnHook }));
             return;
+        }
         const userShellPath = SettingsManager.create(opts.cwd).getShellPath();
         const stockBash = createBashToolDefinition(opts.cwd, { shellPath: userShellPath });
         pi.registerTool(composeBash(stockBash));
@@ -500,9 +509,11 @@ export function registerSandbox(pi, opts) {
                     signal,
                     onRetry: onShellResolutionRetry,
                 });
+                const baseEnv = env ?? process.env;
                 const child = spawn(shell, [...args, wrapped], {
                     cwd,
-                    env: env ?? process.env,
+                    // The toolchain's PATH and variables when the session has a base hook.
+                    env: opts.baseSpawnHook ? opts.baseSpawnHook({ command, cwd, env: baseEnv }).env : baseEnv,
                     detached: true,
                     stdio: ["ignore", "pipe", "pipe"],
                 });

package/dist/extension/toolchain/spawnHook.d.ts

@@ -0,0 +1,63 @@
+/**
+ * The toolchain spawn hook (spec 2026-10-08 §1, "Two runtimes, one hand-off").
+ *
+ * In Wright's sandbox our CLI and pi run on the image's own Node (the harness
+ * puts `/opt/yagni/runtime-bin` first on their PATH), while the commands the
+ * model runs belong on the repository's toolchain: its Node 20, its Go 1.24.
+ * The backend writes the plan's PATH and environment to a toolchain file
+ * before setup, and the harness names it in `YAGNI_TOOLCHAIN_FILE`. This hook
+ * hands that PATH and environment to every bash spawn (and `user_bash`); the
+ * command string is never touched, so the Guardian reviews exactly what the
+ * model wrote. It composes before the sandbox's proxy hook, so the proxy
+ * variables still layer on top.
+ *
+ * Without the variable (a developer's own terminal) nothing changes.
+ *
+ * The format's producer is `toolchainFileContents` in
+ * `packages/shared/src/toolchainFile.ts`; this package does not depend on
+ * @yagni/shared, so it reads the same `{ version: 1, path, env, tools }` with
+ * its own parser. A change there is a change here.
+ */
+import { type BashOperations, type BashSpawnHook } from "@earendil-works/pi-coding-agent";
+import { type SinkEvent } from "../errorSink.js";
+export interface ToolchainFile {
+    version: 1;
+    /** The plan's whole PATH, system directories included. */
+    path: string;
+    /** Every other toolchain variable; never PATH. */
+    env: Record<string, string>;
+    tools: Array<{
+        name: string;
+        version: string;
+        origin: string;
+    }>;
+}
+type Log = (event: SinkEvent) => void;
+/** The file, or null when the text is not a well-formed version 1 file. */
+export declare function parseToolchainFile(text: string): ToolchainFile | null;
+/**
+ * Read the toolchain file synchronously (activation is sync). Fail-soft: a
+ * missing, unreadable or malformed file is one `toolchain.file_unreadable`
+ * line and null, and the session runs exactly as it would without the file.
+ */
+export declare function readToolchainFile(path: string, log?: Log): ToolchainFile | null;
+/**
+ * `env.PATH` becomes the file's PATH and the file's other variables merge
+ * beneath the spawn's own environment. `command` and `cwd` pass through.
+ */
+export declare function makeToolchainSpawnHook(file: ToolchainFile): BashSpawnHook;
+/** The hooks applied in order (first to last), skipping absent ones; undefined when none is present. */
+export declare function composeSpawnHooks(...hooks: Array<BashSpawnHook | undefined>): BashSpawnHook | undefined;
+/**
+ * The hook for this process: present only when `YAGNI_TOOLCHAIN_FILE` names a
+ * readable, well-formed file. Unset is silent (not a sandbox); set but
+ * unreadable logs once.
+ */
+export declare function toolchainSpawnHookFromEnv(env?: NodeJS.ProcessEnv, log?: Log): BashSpawnHook | undefined;
+/**
+ * `user_bash` (`!` commands) through pi's own local backend, with the hook's
+ * environment: the same toolchain the model's bash tool gets.
+ */
+export declare function toolchainUserBashOperations(hook: BashSpawnHook, cwd: string): BashOperations;
+export {};
+//# sourceMappingURL=spawnHook.d.ts.map

package/dist/extension/toolchain/spawnHook.js

@@ -0,0 +1,127 @@
+/**
+ * The toolchain spawn hook (spec 2026-10-08 §1, "Two runtimes, one hand-off").
+ *
+ * In Wright's sandbox our CLI and pi run on the image's own Node (the harness
+ * puts `/opt/yagni/runtime-bin` first on their PATH), while the commands the
+ * model runs belong on the repository's toolchain: its Node 20, its Go 1.24.
+ * The backend writes the plan's PATH and environment to a toolchain file
+ * before setup, and the harness names it in `YAGNI_TOOLCHAIN_FILE`. This hook
+ * hands that PATH and environment to every bash spawn (and `user_bash`); the
+ * command string is never touched, so the Guardian reviews exactly what the
+ * model wrote. It composes before the sandbox's proxy hook, so the proxy
+ * variables still layer on top.
+ *
+ * Without the variable (a developer's own terminal) nothing changes.
+ *
+ * The format's producer is `toolchainFileContents` in
+ * `packages/shared/src/toolchainFile.ts`; this package does not depend on
+ * @yagni/shared, so it reads the same `{ version: 1, path, env, tools }` with
+ * its own parser. A change there is a change here.
+ */
+import { readFileSync } from "node:fs";
+import { createLocalBashOperations, SettingsManager, } from "@earendil-works/pi-coding-agent";
+import { logEvent } from "../errorSink.js";
+const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+/** The file, or null when the text is not a well-formed version 1 file. */
+export function parseToolchainFile(text) {
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch {
+        // Not JSON: the caller logs the null.
+        return null;
+    }
+    if (!isRecord(parsed) || parsed.version !== 1)
+        return null;
+    const { path, env, tools } = parsed;
+    if (typeof path !== "string" || path.length === 0)
+        return null;
+    if (!isRecord(env) || "PATH" in env)
+        return null;
+    const parsedEnv = {};
+    for (const [name, value] of Object.entries(env)) {
+        if (typeof value !== "string")
+            return null;
+        parsedEnv[name] = value;
+    }
+    if (!Array.isArray(tools))
+        return null;
+    const parsedTools = [];
+    for (const tool of tools) {
+        if (!isRecord(tool))
+            return null;
+        const { name, version, origin } = tool;
+        if (typeof name !== "string" || typeof version !== "string" || typeof origin !== "string")
+            return null;
+        parsedTools.push({ name, version, origin });
+    }
+    return { version: 1, path, env: parsedEnv, tools: parsedTools };
+}
+/**
+ * Read the toolchain file synchronously (activation is sync). Fail-soft: a
+ * missing, unreadable or malformed file is one `toolchain.file_unreadable`
+ * line and null, and the session runs exactly as it would without the file.
+ */
+export function readToolchainFile(path, log = logEvent) {
+    let text;
+    try {
+        text = readFileSync(path, "utf8");
+    }
+    catch (err) {
+        const code = isRecord(err) && typeof err.code === "string" ? err.code : "read_failed";
+        log({ source: "toolchain", level: "warn", event: "file_unreadable", fields: { path, reason: code } });
+        return null;
+    }
+    const file = parseToolchainFile(text);
+    if (!file)
+        log({ source: "toolchain", level: "warn", event: "file_unreadable", fields: { path, reason: "malformed" } });
+    return file;
+}
+/**
+ * `env.PATH` becomes the file's PATH and the file's other variables merge
+ * beneath the spawn's own environment. `command` and `cwd` pass through.
+ */
+export function makeToolchainSpawnHook(file) {
+    return (ctx) => ({
+        ...ctx,
+        env: { ...file.env, ...ctx.env, PATH: file.path },
+    });
+}
+/** The hooks applied in order (first to last), skipping absent ones; undefined when none is present. */
+export function composeSpawnHooks(...hooks) {
+    const present = hooks.filter((hook) => hook !== undefined);
+    if (present.length === 0)
+        return undefined;
+    if (present.length === 1)
+        return present[0];
+    return (ctx) => present.reduce((acc, hook) => hook(acc), ctx);
+}
+/**
+ * The hook for this process: present only when `YAGNI_TOOLCHAIN_FILE` names a
+ * readable, well-formed file. Unset is silent (not a sandbox); set but
+ * unreadable logs once.
+ */
+export function toolchainSpawnHookFromEnv(env = process.env, log = logEvent) {
+    const path = env.YAGNI_TOOLCHAIN_FILE?.trim();
+    if (!path)
+        return undefined;
+    const file = readToolchainFile(path, log);
+    return file ? makeToolchainSpawnHook(file) : undefined;
+}
+/**
+ * `user_bash` (`!` commands) through pi's own local backend, with the hook's
+ * environment: the same toolchain the model's bash tool gets.
+ */
+export function toolchainUserBashOperations(hook, cwd) {
+    // The user's configured shell, as the sandbox's own `!` path resolves it.
+    const shellPath = SettingsManager.create(cwd).getShellPath();
+    const local = createLocalBashOperations(shellPath ? { shellPath } : undefined);
+    return {
+        exec: (command, cwd, options) => local.exec(command, cwd, {
+            ...options,
+            env: hook({ command, cwd, env: options.env ?? process.env }).env,
+        }),
+    };
+}
+//# sourceMappingURL=spawnHook.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yagni-app/code-staging",
-  "version": "1.2.3-staging.1701.1",
+  "version": "1.2.3-staging.1708.1",
   "description": "YAGNI Code: a terminal coding agent that already knows your company. One YAGNI login routes the model and grounds the agent in your team's context.",
   "license": "SEE LICENSE IN LICENSE.md",
   "author": "YAGNI, Inc. <jack@yagni.app> (https://yagni.app)",
@@ -58,5 +58,5 @@
     "turndown": "^7.2.4",
     "typebox": "^1.3.15"
   },
-  "yagniSourceSha": "17afa06cf2895ba0df94906ec0300b989ecc4d20"
+  "yagniSourceSha": "78225de1501acd6df6c53f8419800e89c68d71e2"
 }