@yagni-app/code-staging 1.2.6-staging.1940.1 → 1.2.6-staging.1951.1

package/dist/extension/branding.d.ts

@@ -72,6 +72,30 @@ export declare const TICKET_IMAGE_RULE: string;
  * the standalone word "pi", must not open with a `- ` bullet line, no emojis.
  */
 export declare const GITHUB_OPERATIONS: string;
+/** Chrome for Testing in the sandbox image (`PI_RENDER_CHROME_DIR` in infra/e2b/pi/template.ts). */
+export declare const SANDBOX_CHROME_PATH = "/opt/chrome/chrome";
+/** Playwright in the sandbox image (`PI_RENDER_DIR` in infra/e2b/pi/template.ts). */
+export declare const SANDBOX_PLAYWRIGHT_DIR = "/opt/yagni/render";
+/**
+ * Commands {@link SANDBOX_SECTION} tells the model the sandbox does not have.
+ * The pi image smoke fails when the image gains one, as it fails when the
+ * image lacks a path the section names.
+ */
+export declare const SANDBOX_ABSENT_COMMANDS: readonly string[];
+/**
+ * What a session in a YAGNI sandbox (E2B or Machines) really has, in place of
+ * {@link TICKET_IMAGE_RULE} and {@link GITHUB_OPERATIONS}, which describe a
+ * developer's laptop: there is no `gh` and no GitHub or Linear token here
+ * (by design: the sandbox has open egress and the model has read untrusted
+ * ticket text), GitHub reads go through `team_read`, the ticket's images
+ * arrive as words in its evidence pack, a browser is baked in, and installs
+ * are allowed. Every path it names is checked against the image by the pi
+ * image smoke (`assertSandboxSection` in scripts/release/smokeChecks.ts).
+ *
+ * Content constraints (parity with {@link TICKET_IMAGE_RULE}): must not
+ * contain the standalone word "pi", no `- ` bullet lines, no emojis.
+ */
+export declare const SANDBOX_SECTION: string;
 /**
  * File-tool steering: prefer the first-class write/edit tools over bash file
  * writes, one write call per file instead of a heredoc batch, and never create
@@ -170,6 +194,12 @@ export interface BrandSystemPromptOptions {
      * all-or-nothing per-surface call, not user policy.
      */
     fileToolSteering?: boolean;
+    /**
+     * The session runs in a YAGNI sandbox (E2B or Machines), not on a laptop:
+     * {@link SANDBOX_SECTION} replaces the ticket-image rule and the GitHub
+     * operations section. Absent or false, the prompt is exactly the laptop's.
+     */
+    sandbox?: boolean;
 }
 /**
  * Rebrand pi's assembled system prompt as YAGNI Code's, and optionally inject a

package/dist/extension/branding.js

@@ -155,6 +155,58 @@ export const GITHUB_OPERATIONS = "## GitHub Operations\n" +
     "multi-paragraph.";
 /** Stable header that starts the GitHub operations section (idempotency anchor). */
 const GITHUB_OPERATIONS_HEADER = "## GitHub Operations";
+/** Chrome for Testing in the sandbox image (`PI_RENDER_CHROME_DIR` in infra/e2b/pi/template.ts). */
+export const SANDBOX_CHROME_PATH = "/opt/chrome/chrome";
+/** Playwright in the sandbox image (`PI_RENDER_DIR` in infra/e2b/pi/template.ts). */
+export const SANDBOX_PLAYWRIGHT_DIR = "/opt/yagni/render";
+/**
+ * Commands {@link SANDBOX_SECTION} tells the model the sandbox does not have.
+ * The pi image smoke fails when the image gains one, as it fails when the
+ * image lacks a path the section names.
+ */
+export const SANDBOX_ABSENT_COMMANDS = ["gh"];
+/** Stable header that starts the sandbox section (idempotency anchor). */
+const SANDBOX_SECTION_HEADER = "## Your sandbox";
+/**
+ * What a session in a YAGNI sandbox (E2B or Machines) really has, in place of
+ * {@link TICKET_IMAGE_RULE} and {@link GITHUB_OPERATIONS}, which describe a
+ * developer's laptop: there is no `gh` and no GitHub or Linear token here
+ * (by design: the sandbox has open egress and the model has read untrusted
+ * ticket text), GitHub reads go through `team_read`, the ticket's images
+ * arrive as words in its evidence pack, a browser is baked in, and installs
+ * are allowed. Every path it names is checked against the image by the pi
+ * image smoke (`assertSandboxSection` in scripts/release/smokeChecks.ts).
+ *
+ * Content constraints (parity with {@link TICKET_IMAGE_RULE}): must not
+ * contain the standalone word "pi", no `- ` bullet lines, no emojis.
+ */
+export const SANDBOX_SECTION = `${SANDBOX_SECTION_HEADER}\n` +
+    "\n" +
+    "This session runs in a YAGNI sandbox, not on a developer's laptop. Four things " +
+    "are true here.\n" +
+    "\n" +
+    "GitHub: this image has no `gh` command and the session has no GitHub or " +
+    "Linear token. Read GitHub through team_read with the Team's GitHub tools, " +
+    "such as `github_get_pull_request`, `github_list_pull_requests`, " +
+    "`github_list_issues` and `github_list_workflow_runs`; `github_get_file` and " +
+    "`github_search_code` read the other repositories the ticket touches (this " +
+    'one is your checkout). Call team_read with tool "list" first: it shows which ' +
+    "of these this Team can read. YAGNI pushes your branch and posts the pull " +
+    "request's comments after you finish; you do neither.\n" +
+    "\n" +
+    "Ticket images: the ticket's screenshots are not on disk here. Each one is " +
+    "described in words in the ticket's evidence pack, the \"Evidence behind the " +
+    "ticket\" section of the ticket you were given. Trust that description; a " +
+    "screenshot named there as not read could not be described.\n" +
+    "\n" +
+    `A browser: Chrome is at \`${SANDBOX_CHROME_PATH}\` and Playwright is installed ` +
+    `at \`${SANDBOX_PLAYWRIGHT_DIR}\`. Load Playwright from ` +
+    `\`${SANDBOX_PLAYWRIGHT_DIR}/node_modules/playwright\` and launch Chrome with ` +
+    `\`executablePath: "${SANDBOX_CHROME_PATH}"\` to open a page, click through it, ` +
+    "or take a screenshot.\n" +
+    "\n" +
+    "Installs: the network is open, and you may install what the work needs. The " +
+    "mission file says what to install.";
 /**
  * File-tool steering: prefer the first-class write/edit tools over bash file
  * writes, one write call per file instead of a heredoc batch, and never create
@@ -364,14 +416,26 @@ export function brandSystemPrompt(original, opts = {}) {
     // (so a long, noisy rules block cannot bury it) but BEFORE the closing
     // reminder (which stays the most-recent instruction). The idempotency guard
     // keys on the stable section header, mirroring the rules guard above.
-    if (!s.includes(TICKET_IMAGE_RULE_HEADER)) {
+    // A sandbox session gets the "Your sandbox" section in the same place
+    // instead: both laptop sections name tools the sandbox does not have.
+    if (opts.sandbox) {
+        // A prompt an earlier pass branded for a laptop loses both laptop
+        // sections, so the two never sit beside the sandbox's.
+        s = s
+            .replace(`\n\n${TICKET_IMAGE_RULE_HEADER}\n${TICKET_IMAGE_RULE}`, "")
+            .replace(`\n\n${GITHUB_OPERATIONS}`, "");
+        if (!s.includes(SANDBOX_SECTION_HEADER)) {
+            s = `${s}\n\n${SANDBOX_SECTION}`;
+        }
+    }
+    else if (!s.includes(TICKET_IMAGE_RULE_HEADER)) {
         s = `${s}\n\n${TICKET_IMAGE_RULE_HEADER}\n${TICKET_IMAGE_RULE}`;
     }
     // 5b2. GitHub operations — a standing directive added alongside
     // the ticket-image rule (same placement, same idempotency shape). It is
     // universal knowledge, not user policy, so it rides the branded prompt
-    // instead of the repository-rules section.
-    if (!s.includes(GITHUB_OPERATIONS_HEADER)) {
+    // instead of the repository-rules section. Laptop only (see 5b).
+    if (!opts.sandbox && !s.includes(GITHUB_OPERATIONS_HEADER)) {
         s = `${s}\n\n${GITHUB_OPERATIONS}`;
     }
     // 5b2b. File-tool steering — same standing-directive placement and

package/dist/extension/index.js

@@ -45,7 +45,7 @@ import { isSandboxDenialOutput, sandboxAutoAllowDecision, sandboxDenialSignature
 import { sandboxFailureKey } from "./permission/approvedPrefixes.js";
 import { createEscapeTally } from "./sandbox/escapeTally.js";
 import { createGrantCensus } from "./permission/grantCensus.js";
-import { toolchainSpawnHookFromEnv, toolchainUserBashOperations } from "./toolchain/spawnHook.js";
+import { runsInSandboxHarness, toolchainSpawnHookFromEnv, toolchainUserBashOperations } from "./toolchain/spawnHook.js";
 import { registerTelemetry as defaultRegisterTelemetry } from "./telemetry/register.js";
 import { loadHooksConfig, makeHookRunner, registerHooks } from "./hooks.js";
 import { loadPermissionRules } from "./permissionRules/loadConfig.js";
@@ -1578,6 +1578,12 @@ export async function registerYagni(pi, deps = {}) {
     // Resolved per turn (not once at activation): /ultra can flip the driver
     // between the delegation and diamond identities mid-session.
     const isDriver = isDriverCaller(env);
+    // A sandbox session is told what its sandbox has instead of a laptop's
+    // `gh` recipes. Both signals are the ones the sandbox already rides: the
+    // harness's toolchain file, and eval mode, which is where team_read (the
+    // tool the section sends GitHub reads to) is registered. A local eval
+    // compare sets eval mode without the harness, so it keeps the laptop's.
+    const sandboxSession = evalMode && runsInSandboxHarness(env);
     pi.on("before_agent_start", (event) => noBranding
         ? undefined
         : {
@@ -1601,6 +1607,7 @@ export async function registerYagni(pi, deps = {}) {
                 scratchpadSection: scratchpadSectionText,
                 attributionSection: attributionPromptSection(attribution()),
                 fileToolSteering: condensedToolsRegistered,
+                ...(sandboxSession ? { sandbox: true } : {}),
             }),
         });
     // Turn-lifecycle WAL: a `turn_start` with no matching `turn_end` is the

package/dist/extension/toolchain/spawnHook.d.ts

@@ -48,6 +48,13 @@ export declare function readToolchainFile(path: string, log?: Log): ToolchainFil
 export declare function makeToolchainSpawnHook(file: ToolchainFile): BashSpawnHook;
 /** The hooks applied in order (first to last), skipping absent ones; undefined when none is present. */
 export declare function composeSpawnHooks(...hooks: Array<BashSpawnHook | undefined>): BashSpawnHook | undefined;
+/**
+ * This process runs under the sandbox harness (`infra/e2b/pi/pi-harness.sh`
+ * exports `YAGNI_TOOLCHAIN_FILE` on every E2B and Machines session, Reeve's
+ * and Wright's alike, and `/go` children inherit it). A developer's own
+ * terminal never sets it.
+ */
+export declare function runsInSandboxHarness(env?: NodeJS.ProcessEnv): boolean;
 /**
  * The hook for this process: present only when `YAGNI_TOOLCHAIN_FILE` names a
  * readable, well-formed file. Unset is silent (not a sandbox); set but

package/dist/extension/toolchain/spawnHook.js

@@ -97,6 +97,15 @@ export function composeSpawnHooks(...hooks) {
         return present[0];
     return (ctx) => present.reduce((acc, hook) => hook(acc), ctx);
 }
+/**
+ * This process runs under the sandbox harness (`infra/e2b/pi/pi-harness.sh`
+ * exports `YAGNI_TOOLCHAIN_FILE` on every E2B and Machines session, Reeve's
+ * and Wright's alike, and `/go` children inherit it). A developer's own
+ * terminal never sets it.
+ */
+export function runsInSandboxHarness(env = process.env) {
+    return Boolean(env.YAGNI_TOOLCHAIN_FILE?.trim());
+}
 /**
  * The hook for this process: present only when `YAGNI_TOOLCHAIN_FILE` names a
  * readable, well-formed file. Unset is silent (not a sandbox); set but

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yagni-app/code-staging",
-  "version": "1.2.6-staging.1940.1",
+  "version": "1.2.6-staging.1951.1",
   "description": "YAGNI Code: a terminal coding agent that already knows your company. One YAGNI login routes the model and grounds the agent in your team's context.",
   "license": "SEE LICENSE IN LICENSE.md",
   "author": "YAGNI, Inc. <jack@yagni.app> (https://yagni.app)",
@@ -58,5 +58,5 @@
     "turndown": "^7.2.4",
     "typebox": "^1.3.15"
   },
-  "yagniSourceSha": "3f6e449b2bf568cf6c1b6001dbfb8894f26b6cb7"
+  "yagniSourceSha": "0985f34f33f3c59e0fb7ed50af520abbcbb2466c"
 }