@yagni-app/code-staging 1.2.6-staging.2011.1 → 1.2.6-staging.2020.1

package/dist/extension/index.d.ts

@@ -173,8 +173,8 @@ export { recordDecision } from "./recordDecisionTool.js";
 export type { RecordDecisionParams } from "./recordDecisionTool.js";
 export { runInitPass, runTeamSetup, registerTeamSetupCommand, isFreshWorkspace, readRepoIntake, draftEngineering, summarizeDraft, FRESH_BRIEF_MIN_CHARS, } from "./initPass.js";
 export type { RunInitPassDeps, InitPassOutcome, RunTeamSetupDeps, TeamSetupOutcome, RepoIntake, RepoIntakeFs, EngineeringDraft, DraftTeam, } from "./initPass.js";
-export { isInitDone, markInitDone, initDoneMarkerFile, _setInitDoneHomeForTest } from "./initDone.js";
-export { brandSystemPrompt, YAGNI_IDENTITY, YAGNI_IDENTITY_DRIVER, YAGNI_IDENTITY_ULTRA, BRAND_NAME } from "./branding.js";
+export { isInitDone, markInitDone, initDoneMarkerFile, _setInitDoneHomeForTest, } from "./initDone.js";
+export { brandSystemPrompt, YAGNI_IDENTITY, YAGNI_IDENTITY_DRIVER, YAGNI_IDENTITY_ULTRA, BRAND_NAME, } from "./branding.js";
 export { loadHooksConfig, makeHookRunner, registerHooks, matchesMatcher, parsePreToolUseOutput, parsePermissionRequestOutput, parseAdditionalContext, parseCompactCancel, HOOK_SUPPORTED_EVENTS, } from "./hooks.js";
 export type { HookEntry, HookGroup, HooksConfig, HookEventName, HookRunner, PreToolUseHookResult, PermissionRequestHookResult, RegisterHooksDeps, } from "./hooks.js";
 export { createUltraHolder, registerUltraCommand } from "./ultra.js";
@@ -188,16 +188,16 @@ export { runPipeline } from "./pipeline/orchestrator.js";
 export type { RunPipelineDeps } from "./pipeline/orchestrator.js";
 export { HEADLESS_GO_EXIT, HEADLESS_GO_USAGE, parseHeadlessGoArgs, runHeadlessGo, validateHeadlessGoArgs, } from "./pipeline/headlessGo.js";
 export type { HeadlessGoArgs, HeadlessGoDeps, HeadlessGoOutcome, HeadlessGoResult, HeadlessStageRow, } from "./pipeline/headlessGo.js";
-export { isMissionMode, missionSeed, missionSkippedStages, normalizeMission } from "./pipeline/mission.js";
+export { isMissionMode, missionSeed, missionSkippedStages, normalizeMission, } from "./pipeline/mission.js";
 export type { MissionInputs } from "./pipeline/mission.js";
 export { clampTier, parseTierCap, resolveTierCap, TIER_CAP_ENV } from "./pipeline/tierCap.js";
 export { withResilience, classifyTransient, composeAbortSignal } from "./pipeline/resilience.js";
-export type { ResilienceAttemptRecord, ResilienceSeams, RunStageFn } from "./pipeline/resilience.js";
+export type { ResilienceAttemptRecord, ResilienceSeams, RunStageFn, } from "./pipeline/resilience.js";
 export { DEFAULT_RESILIENCE_POLICY } from "./pipeline/types.js";
 export type { ResiliencePolicy } from "./pipeline/types.js";
-export { buildVerifyEnv, detectVerifyCommand, makeRunVerify, parseVerifyFailures } from "./pipeline/verify.js";
+export { buildVerifyEnv, detectVerifyCommand, makeRunVerify, parseVerifyFailures, } from "./pipeline/verify.js";
 export type { VerifyCommand, VerifyOutcome } from "./pipeline/verify.js";
-export { blindStages, reportOnlyStages, makeGroundedVsBlindEval, formatComparisonReport } from "./pipeline/eval.js";
+export { blindStages, reportOnlyStages, makeGroundedVsBlindEval, formatComparisonReport, } from "./pipeline/eval.js";
 export type { ComparisonReport, LaneFit, LaneOutcome } from "./pipeline/eval.js";
 export { registerGoCompareCommand } from "./pipeline/goCompareCommand.js";
 export { registerSubagents, makeSubagentTool, discoverSubagents, parseAgentMarkdown, buildSubagentStage, formatAgentList, mapModelTier, SUBAGENT_TOOL_NAME, GENERAL_AGENT_NAME, MAX_PARALLEL_SUBAGENTS, MAX_PARALLEL_SUBAGENTS_ULTRA, DEFAULT_SUBAGENT_TOOLS, } from "./subagents.js";
@@ -211,9 +211,9 @@ export type { PermissionMode, PermissionPolicy, GateDecision, RegisterPermission
 export { makeBlessStore, blessPath } from "./bless.js";
 export type { BlessStore, BlessRule } from "./bless.js";
 export { bankDecision, fetchDecisions, supersedeDecision, parseDecideArgs, formatDecisionsList, shortId, registerDecisionCommands, DEFAULT_LIST_LIMIT, } from "./decisions.js";
-export type { DecisionClientOpts, DecisionListItem, BankDecisionParams, DecideArgs } from "./decisions.js";
+export type { DecisionClientOpts, DecisionListItem, BankDecisionParams, DecideArgs, } from "./decisions.js";
 export { makeDecisionCapture, CAPTURE_DEBOUNCE_MS } from "./decisionCapture.js";
-export type { DecisionCapture, DecisionCaptureDeps, BlessCaptureInfo, CaptureCtx } from "./decisionCapture.js";
+export type { DecisionCapture, DecisionCaptureDeps, BlessCaptureInfo, CaptureCtx, } from "./decisionCapture.js";
 export { registerAmbientRecall, fetchRecall, formatRecallBlock, toRepoRelativePath, normalizeRecall, RECALL_TIMEOUT_MS, RECALL_MIN_DECISIONS, } from "./recall.js";
 export type { RecallResult, RecallClientOpts, RegisterRecallDeps } from "./recall.js";
 export { makeCostAccumulator, formatCostLine, registerCostCommand, cacheHitPercent, spendTokenTotals, } from "./costHud.js";
@@ -231,5 +231,5 @@ export type { RowKind, ToolRow, ToolRowPatch } from "./toolRuns.js";
 export { registerWorkingLine, composeWorkingMessage, NULL_WORKING_LINE, WORKING_INDICATOR_FRAMES, WORKING_VERBS, } from "./workingLine.js";
 export type { WorkingLineHandle, RegisterWorkingLineDeps } from "./workingLine.js";
 export { crashReportsDisabled, installNonZeroExitReporter, installUncaughtExceptionMonitor, makeCrashReporter, reportFatalCrash, sanitizeCrashError, sanitizeCrashText, } from "./crashReport.js";
-export type { CrashReporter, CrashReporterOpts, FatalCrashOpts, SanitizedCrash } from "./crashReport.js";
+export type { CrashReporter, CrashReporterOpts, FatalCrashOpts, SanitizedCrash, } from "./crashReport.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/extension/index.js

@@ -2,9 +2,9 @@ import { createHash } from "node:crypto";
 import { Text } from "@earendil-works/pi-tui";
 import { DEFAULT_ADVISOR_LIMITS, formatAdvisorSubtotal, makeAdvisorState } from "./advisor.js";
 import { makeChildUsageState } from "./childUsage.js";
-import { appendGrant, createGrantsRefresher, loadGrants, resolveRepoKey, storagePrefix } from "./permission/approvedPrefixes.js";
+import { appendGrant, createGrantsRefresher, loadGrants, resolveRepoKey, storagePrefix, } from "./permission/approvedPrefixes.js";
 import { redactCommand } from "./redact.js";
-import { formatGuardianSubtotal, GUARDIAN_MODEL_TIER, makeGuardianState, resolveGuardianLimits, reviewCommand, deriveGuardianTimeoutMs } from "./permission/guardian.js";
+import { formatGuardianSubtotal, GUARDIAN_MODEL_TIER, makeGuardianState, resolveGuardianLimits, reviewCommand, deriveGuardianTimeoutMs, } from "./permission/guardian.js";
 import { makeAskAdvisorTool, registerAdviseCommand } from "./askAdvisorTool.js";
 import { makeAskUserQuestionTool } from "./askUserQuestionTool.js";
 import { makeAskYagniTool } from "./askYagniTool.js";
@@ -18,9 +18,9 @@ import { makePrototypeVerifyTool } from "./prototypeVerify.js";
 import { makeRecordDecisionTool } from "./recordDecisionTool.js";
 import { makeSuggestNextWorkTool } from "./nextWorkTool.js";
 import { makePrototypeCreateTool, makePrototypeAttachTool, makePrototypeReadTool, makePrototypeDraftTool, makePrototypeVerificationTool, makePrototypeReviseTool, makePrototypeListTool, makePrototypeShareTool, } from "./prototypeTool.js";
-import { BRAND_NAME, brandSystemPrompt, brandingDisabled, buildMastheadString, YAGNI_IDENTITY_DRIVER, YAGNI_IDENTITY_DRIVER_GROUNDING_FREE, YAGNI_IDENTITY_GROUNDING_FREE, YAGNI_IDENTITY_ULTRA, YAGNI_IDENTITY_ULTRA_GROUNDING_FREE } from "./branding.js";
+import { BRAND_NAME, brandSystemPrompt, brandingDisabled, buildMastheadString, YAGNI_IDENTITY_DRIVER, YAGNI_IDENTITY_DRIVER_GROUNDING_FREE, YAGNI_IDENTITY_GROUNDING_FREE, YAGNI_IDENTITY_ULTRA, YAGNI_IDENTITY_ULTRA_GROUNDING_FREE, } from "./branding.js";
 import { claudeRulesSection } from "./claudeRules.js";
-import { ensureScratchpadDir, SCRATCHPAD_TMPDIR_ENV, scratchpadDir as scratchpadDirFor, scratchpadOwnerRootFor, scratchpadSection } from "./scratchpad.js";
+import { ensureScratchpadDir, SCRATCHPAD_TMPDIR_ENV, scratchpadDir as scratchpadDirFor, scratchpadOwnerRootFor, scratchpadSection, } from "./scratchpad.js";
 import { registerCostCommand } from "./costHud.js";
 import { isDebug } from "./diagnostics.js";
 import { logEvent } from "./errorSink.js";
@@ -29,25 +29,26 @@ import { droppedSessionRuns, sessionRunIds } from "./sessionRuns.js";
 import { codeStateHome } from "./stateHome.js";
 import { mutateLocalConfig } from "./settingsFiles.js";
 import { logTurnLifecycle } from "./turnLog.js";
-import { createYagniFooterFactory, cyclePermissionMode, formatCwd, GIT_MUTATING_PATTERN, isShiftTab } from "./footer.js";
+import { createYagniFooterFactory, cyclePermissionMode, formatCwd, GIT_MUTATING_PATTERN, isShiftTab, } from "./footer.js";
 import { RerouteNotifier } from "./rerouteNotice.js";
-import { isFreshWorkspace, registerTeamSetupCommand, runInitPass as defaultRunInitPass } from "./initPass.js";
-import { isInitDone as defaultIsInitDone, markInitDone as defaultMarkInitDone } from "./initDone.js";
+import { isFreshWorkspace, registerTeamSetupCommand, runInitPass as defaultRunInitPass, } from "./initPass.js";
+import { isInitDone as defaultIsInitDone, markInitDone as defaultMarkInitDone, } from "./initDone.js";
 import { looksMutating } from "./mcp/tools.js";
-import { startMcp as defaultStartMcp, wireShutdown, deriveStartupConnectivityNotices } from "./mcp/startup.js";
+import { startMcp as defaultStartMcp, wireShutdown, deriveStartupConnectivityNotices, } from "./mcp/startup.js";
 import { registerGoCommand } from "./pipeline/goCommand.js";
 import { registerGoCompareCommand } from "./pipeline/goCompareCommand.js";
-import { DEFAULT_PERMISSION_POLICY, createModeHolder, registerPermissionGate } from "./permission/gate.js";
+import { DEFAULT_PERMISSION_POLICY, createModeHolder, registerPermissionGate, } from "./permission/gate.js";
 import { setBgJobOutcomeReporter } from "./bgJobs.js";
 import { registerBgJobsUi } from "./bgJobsRender.js";
 import { registerSandbox } from "./sandbox/session.js";
-import { isSandboxDenialOutput, sandboxAutoAllowDecision, sandboxDenialSignature, shouldUseSandbox } from "./sandbox/bash.js";
+import { isSandboxDenialOutput, sandboxAutoAllowDecision, sandboxDenialSignature, shouldUseSandbox, } from "./sandbox/bash.js";
 import { sandboxFailureKey } from "./permission/approvedPrefixes.js";
 import { createEscapeTally } from "./sandbox/escapeTally.js";
 import { createGrantCensus } from "./permission/grantCensus.js";
-import { runsInSandboxHarness, toolchainSpawnHookFromEnv, toolchainUserBashOperations } from "./toolchain/spawnHook.js";
+import { runsInSandboxHarness, toolchainBashToolDefinition, toolchainSpawnHookFromEnv, toolchainUserBashOperations, } from "./toolchain/spawnHook.js";
 import { CLOUD_SESSION_ENV } from "./pipeline/cloud.js";
 import { registerStageClock } from "./pipeline/stageClock.js";
+import { scrubSecrets } from "./pipeline/scrubSecrets.js";
 import { registerTelemetry as defaultRegisterTelemetry } from "./telemetry/register.js";
 import { loadHooksConfig, makeHookRunner, registerHooks } from "./hooks.js";
 import { loadPermissionRules } from "./permissionRules/loadConfig.js";
@@ -63,11 +64,11 @@ import { registerAmbientRecall } from "./recall.js";
 import { resilientFetch } from "./resilientFetch.js";
 import { installNonZeroExitReporter, installUncaughtExceptionMonitor, makeCrashReporter, runningUnderTest, } from "./crashReport.js";
 import { createToolOutcomeBatcher } from "./toolOutcomes.js";
-import { flushSpool as defaultFlushSpool } from "./spool.js";
+import { flushSpool as defaultFlushSpool, } from "./spool.js";
 import { makeAuthedFetch, makeTokenProvider } from "./tokenProvider.js";
 import { attributionHeaders, fetchCatalog as defaultFetchCatalog, fetchContextBrief as defaultFetchContextBrief, getToken, getTokenExpiresAt as defaultGetTokenExpiresAt, getWorkspaceId as defaultGetWorkspaceId, isDriverCaller, resolveBaseUrl, tokenExpiryNotice, } from "./config.js";
 import { buildYagniProvider } from "./provider.js";
-import { orderDriverCatalog, registerStartTierGuard, registerTierCommand, trailReason } from "./tierCommand.js";
+import { orderDriverCatalog, registerStartTierGuard, registerTierCommand, trailReason, } from "./tierCommand.js";
 import { makeModelPickerListener } from "./modelPicker.js";
 import { registerChipEditor } from "./chipEditor.js";
 import { registerSlashCommandFilter } from "./slashCommandFilter.js";
@@ -160,6 +161,17 @@ export async function registerYagni(pi, deps = {}) {
     const fetchCatalog = deps.fetchCatalog ?? defaultFetchCatalog;
     const env = deps.env ?? process.env;
     const evalMode = isEvalMode(env);
+    // A stage child of `yagni go --headless --cloud` (the one-attempt lane):
+    // headlessGo sets the variable where it parses the flag, and the lane's
+    // launch line exports the toolchain file. It runs outside eval mode, so it
+    // is told its sandbox and gets team_read on these two signals alone; the
+    // flag outside a sandbox changes nothing.
+    const cloudSession = runsInSandboxHarness(env) && env[CLOUD_SESSION_ENV] === "1";
+    // A sandbox session is told what its sandbox has instead of a laptop's
+    // `gh` recipes: a cloud session, or a legacy build or scoping session (eval
+    // mode under the harness, where team_read is registered). A local eval
+    // compare sets eval mode without the harness, so it keeps the laptop's.
+    const sandboxSession = cloudSession || (evalMode && runsInSandboxHarness(env));
     // A timed /go stage child refuses every tool once its time is up. Order does
     // not matter: pi runs every tool_call handler until one blocks, and an allow
     // (a result without `block`) never ends the loop, so this block always lands.
@@ -238,7 +250,9 @@ export async function registerYagni(pi, deps = {}) {
             logAttributionProvenance(attributionState.load);
             return;
         }
-        attributionState.load = loadAttributionSettings(undefined, ctx.cwd || process.cwd(), env, { trusted });
+        attributionState.load = loadAttributionSettings(undefined, ctx.cwd || process.cwd(), env, {
+            trusted,
+        });
         logAttributionProvenance(attributionState.load);
     };
     // The refreshing TokenProvider replaces the old boot-time token snapshot:
@@ -279,7 +293,12 @@ export async function registerYagni(pi, deps = {}) {
     // like every other external side effect; injectable for tests.
     const authReporter = deps.authReporter ??
         (!evalMode
-            ? makeCrashReporter({ baseUrl, getToken: getTokenFn, fetchImpl: deps.fetchImpl, env: deps.env })
+            ? makeCrashReporter({
+                baseUrl,
+                getToken: getTokenFn,
+                fetchImpl: deps.fetchImpl,
+                env: deps.env,
+            })
             : async () => { });
     // YAG-500 Fix A+C: the model-path 401 recovery outcome, set by the
     // message_end handler so it can produce the right user-facing message. The
@@ -372,8 +391,9 @@ export async function registerYagni(pi, deps = {}) {
     // standard-tier extraction, replacing the bash + curl + python dance.
     pi.registerTool(makeWebFetchTool(toolOpts));
     // The Team's connected tools, read through YAGNI as the Team. Only a run's
-    // sandbox holds the run token the route requires, so only it gets the tool.
-    if (evalMode) {
+    // sandbox holds the run token the route requires, so only it gets the tool:
+    // a legacy build or scoping session (eval mode) or a cloud session.
+    if (evalMode || cloudSession) {
         pi.registerTool(makeTeamReadTool(toolOpts));
     }
     // Ticket write-back (spec 2026-08-09): explicit user-intent writes to the
@@ -397,7 +417,12 @@ export async function registerYagni(pi, deps = {}) {
     // model escalation, not a judgment read); the consult just runs BLIND —
     // the existing grounding-free advisor persona + the ask_yagni-free tool
     // list — so no recorded decision reaches the consult either.
-    const askAdvisorTool = makeAskAdvisorTool({ state: advisorState, workingLine, childUsage, grounded: grounding });
+    const askAdvisorTool = makeAskAdvisorTool({
+        state: advisorState,
+        workingLine,
+        childUsage,
+        grounded: grounding,
+    });
     pi.registerTool(askAdvisorTool);
     // /advise runs the SAME tool, sharing the state handle, so a manual consult
     // draws on the same cap rather than opening a side channel around it.
@@ -464,7 +489,12 @@ export async function registerYagni(pi, deps = {}) {
     // driver's delegation identity for the diamond directive (see the
     // before_agent_start handler below) and widens the tool's fan-out ceiling.
     const ultraHolder = createUltraHolder();
-    registerSubagents(pi, { isUltra: () => ultraHolder.get(), workingLine, childUsage, grounded: grounding });
+    registerSubagents(pi, {
+        isUltra: () => ultraHolder.get(),
+        workingLine,
+        childUsage,
+        grounded: grounding,
+    });
     // /plugin + /reload-plugins: manage Claude Code marketplace plugins from the
     // session, driving the launcher's `yagni plugin …` (YAGNI_CLI_PATH).
     registerPluginPanel(pi, { env: deps.env, runCli: deps.runPluginCli });
@@ -497,7 +527,17 @@ export async function registerYagni(pi, deps = {}) {
         // client estimate on a throw, a non-2xx, or a malformed body.
         fetchRunSpend: async (runId, signal) => {
             try {
-                const res = await resilientFetch(buildRunSpendUrl(baseUrl, runId), { method: "GET", headers: { authorization: `Bearer ${getTokenFn() ?? ""}` } }, { fetchImpl: authedFetch, signal, policy: { maxAttempts: 1, backoffBaseMs: 0, backoffMaxMs: 0, timeoutMs: COST_FETCH_TIMEOUT_MS, jitterRatio: 0 } });
+                const res = await resilientFetch(buildRunSpendUrl(baseUrl, runId), { method: "GET", headers: { authorization: `Bearer ${getTokenFn() ?? ""}` } }, {
+                    fetchImpl: authedFetch,
+                    signal,
+                    policy: {
+                        maxAttempts: 1,
+                        backoffBaseMs: 0,
+                        backoffMaxMs: 0,
+                        timeoutMs: COST_FETCH_TIMEOUT_MS,
+                        jitterRatio: 0,
+                    },
+                });
                 if (!res.ok)
                     return null;
                 return parseSpendResponse(await res.json());
@@ -658,7 +698,9 @@ export async function registerYagni(pi, deps = {}) {
             try {
                 ctx?.ui?.notify?.(summary, "info");
             }
-            catch { /* fail-soft */ }
+            catch {
+                /* fail-soft */
+            }
             logEvent({
                 source: "sandbox",
                 level: "info",
@@ -686,7 +728,10 @@ export async function registerYagni(pi, deps = {}) {
         }
         await toolOutcomes.close();
     });
-    const footerInvalidateHandle = { invalidateGit: () => { }, requestRender: () => { } };
+    const footerInvalidateHandle = {
+        invalidateGit: () => { },
+        requestRender: () => { },
+    };
     const guardianState = makeGuardianState();
     // Disabled by the local env override OR the workspace kill switch
     // (yagni_code.guardian, read from the catalog response at launch). The env
@@ -703,8 +748,12 @@ export async function registerYagni(pi, deps = {}) {
     // hard-aborting at 15s and preempting the backend's retry. Absent an
     // advertisement (older backend) this keeps the default.
     const guardianTimeoutMs = deriveGuardianTimeoutMs(guardianLimits, {
-        ...(guardianTimeoutAdvertisedMs !== undefined ? { timeoutMs: guardianTimeoutAdvertisedMs } : {}),
-        ...(guardianMaxAttemptsAdvertised !== undefined ? { maxAttempts: guardianMaxAttemptsAdvertised } : {}),
+        ...(guardianTimeoutAdvertisedMs !== undefined
+            ? { timeoutMs: guardianTimeoutAdvertisedMs }
+            : {}),
+        ...(guardianMaxAttemptsAdvertised !== undefined
+            ? { maxAttempts: guardianMaxAttemptsAdvertised }
+            : {}),
     });
     guardianLimits.timeoutMs = guardianTimeoutMs;
     // YAG-510: Guardian events go to the unified sink under source:"guardian"
@@ -760,7 +809,13 @@ export async function registerYagni(pi, deps = {}) {
                     body: JSON.stringify(body),
                 }, {
                     fetchImpl: authedFetch,
-                    policy: { maxAttempts: 1, backoffBaseMs: 0, backoffMaxMs: 0, timeoutMs: GUARDIAN_EVENT_TIMEOUT_MS, jitterRatio: 0 },
+                    policy: {
+                        maxAttempts: 1,
+                        backoffBaseMs: 0,
+                        backoffMaxMs: 0,
+                        timeoutMs: GUARDIAN_EVENT_TIMEOUT_MS,
+                        jitterRatio: 0,
+                    },
                 });
                 if (!res.ok) {
                     logEvent({
@@ -841,7 +896,9 @@ export async function registerYagni(pi, deps = {}) {
                 }
                 return { key, value };
             },
-            clear: () => { map.clear(); },
+            clear: () => {
+                map.clear();
+            },
         };
     };
     const sandboxedFailures = makeSandboxFailureMap(() => true);
@@ -881,7 +938,12 @@ export async function registerYagni(pi, deps = {}) {
         ? { rules: [], diagnostics: { warnings: [], neverConsultedTools: [] } }
         : loadPermissionRules({ cwd: process.cwd() });
     for (const w of loadedRules.diagnostics.warnings) {
-        logEvent({ source: "permission-rules", level: "warn", event: "config_warning", fields: { warning: w } });
+        logEvent({
+            source: "permission-rules",
+            level: "warn",
+            event: "config_warning",
+            fields: { warning: w },
+        });
     }
     if (loadedRules.diagnostics.neverConsultedTools.length > 0) {
         logEvent({
@@ -916,8 +978,10 @@ export async function registerYagni(pi, deps = {}) {
     // A build sandbox's toolchain (spec 2026-10-08 §1): when the harness names a
     // readable toolchain file, every bash spawn and `!` command runs on the
     // repository's PATH and variables while this process stays on the image's
-    // Node. Composed before the sandbox's proxy hook. Absent everywhere else.
-    const toolchainHook = evalMode ? undefined : toolchainSpawnHookFromEnv(env);
+    // Node. Composed before the sandbox's proxy hook. Eval mode too: a legacy
+    // build runs in it, and its shell needs the repository's toolchain as much
+    // as a lane session's. Absent everywhere else.
+    const toolchainHook = toolchainSpawnHookFromEnv(env);
     const sandboxHandle = evalMode
         ? null
         : registerSandbox(pi, {
@@ -954,7 +1018,8 @@ export async function registerYagni(pi, deps = {}) {
                 // ignores the flag entirely — the command runs wrapped, no ask.
                 sandboxEscape: (toolName, params) => toolName === "bash" &&
                     sandboxHandle.manager.initialized &&
-                    params.dangerouslyDisableSandbox === true &&
+                    params.dangerouslyDisableSandbox ===
+                        true &&
                     sandboxHandle.settings().allowUnsandboxedCommands !== false,
                 // The auto-sandbox rung's would-run-wrapped proof: after the gate
                 // strips the flag, this command must actually be wrapped by
@@ -1031,7 +1096,9 @@ export async function registerYagni(pi, deps = {}) {
         // gate at activation): toggling it mid-session does nothing until the
         // session restarts. When set, the gate seeds from the L1 ladder only,
         // byte-identical to the pre-consult behavior.
-        ...(evalMode || env.YAGNI_DISABLE_PREFIX_CONSULT === "1" || env.YAGNI_DISABLE_PREFIX_CONSULT === "true"
+        ...(evalMode ||
+            env.YAGNI_DISABLE_PREFIX_CONSULT === "1" ||
+            env.YAGNI_DISABLE_PREFIX_CONSULT === "true"
             ? {}
             : {
                 prefixConsult: {
@@ -1097,7 +1164,13 @@ export async function registerYagni(pi, deps = {}) {
                             body: JSON.stringify(body),
                         }, {
                             fetchImpl: authedFetch,
-                            policy: { maxAttempts: 1, backoffBaseMs: 0, backoffMaxMs: 0, timeoutMs: GUARDIAN_EVENT_TIMEOUT_MS, jitterRatio: 0 },
+                            policy: {
+                                maxAttempts: 1,
+                                backoffBaseMs: 0,
+                                backoffMaxMs: 0,
+                                timeoutMs: GUARDIAN_EVENT_TIMEOUT_MS,
+                                jitterRatio: 0,
+                            },
                         });
                         if (!res.ok) {
                             guardianLogSink({ event: "guardian_error_post_failed", status: res.status });
@@ -1132,25 +1205,27 @@ export async function registerYagni(pi, deps = {}) {
         // registered in eval mode: the gate hides the save option when the dep
         // is absent, so a no-op implementation that would still emit
         // ask_approved_remembered never exists.
-        ...(evalMode ? {} : {
-            persistUserRule: (ruleString, cwd) => {
-                mutateLocalConfig(cwd, (config) => {
-                    const perms = (config.permissions ?? {});
-                    const allow = Array.isArray(perms.allow) ? [...perms.allow] : [];
-                    if (!allow.includes(ruleString))
-                        allow.push(ruleString);
-                    perms.allow = allow;
-                    config.permissions = perms;
-                });
-                logEvent({
-                    source: "permission-rules",
-                    level: "info",
-                    event: "rule_saved",
-                    sessionId: env.YAGNI_SESSION_ID ?? undefined,
-                    fields: { rule: ruleString, destination: "local" },
-                });
-            },
-        }),
+        ...(evalMode
+            ? {}
+            : {
+                persistUserRule: (ruleString, cwd) => {
+                    mutateLocalConfig(cwd, (config) => {
+                        const perms = (config.permissions ?? {});
+                        const allow = Array.isArray(perms.allow) ? [...perms.allow] : [];
+                        if (!allow.includes(ruleString))
+                            allow.push(ruleString);
+                        perms.allow = allow;
+                        config.permissions = perms;
+                    });
+                    logEvent({
+                        source: "permission-rules",
+                        level: "info",
+                        event: "rule_saved",
+                        sessionId: env.YAGNI_SESSION_ID ?? undefined,
+                        fields: { rule: ruleString, destination: "local" },
+                    });
+                },
+            }),
         // Opt-in storage stream (YAG-510). Tier decides what leaves the machine:
         // "off" → nothing (not even sent); "hash" → sha256 + family prefix +
         // metadata, no command content; "raw" → adds client-REDACTED command and
@@ -1197,7 +1272,13 @@ export async function registerYagni(pi, deps = {}) {
                         body: JSON.stringify(body),
                     }, {
                         fetchImpl: authedFetch,
-                        policy: { maxAttempts: 1, backoffBaseMs: 0, backoffMaxMs: 0, timeoutMs: GUARDIAN_EVENT_TIMEOUT_MS, jitterRatio: 0 },
+                        policy: {
+                            maxAttempts: 1,
+                            backoffBaseMs: 0,
+                            backoffMaxMs: 0,
+                            timeoutMs: GUARDIAN_EVENT_TIMEOUT_MS,
+                            jitterRatio: 0,
+                        },
                     });
                     if (!res.ok) {
                         guardianLogSink({ event: "guardian_event_post_failed", status: res.status });
@@ -1250,13 +1331,26 @@ export async function registerYagni(pi, deps = {}) {
         },
         fetchHeadroom: async (signal) => {
             try {
-                const res = await resilientFetch(`${baseUrl}/api/yagni-code/credits`, { method: "GET", headers: { authorization: `Bearer ${getTokenFn() ?? ""}` } }, { fetchImpl: authedFetch, signal, policy: { maxAttempts: 1, backoffBaseMs: 0, backoffMaxMs: 0, timeoutMs: COST_FETCH_TIMEOUT_MS, jitterRatio: 0 } });
+                const res = await resilientFetch(`${baseUrl}/api/yagni-code/credits`, { method: "GET", headers: { authorization: `Bearer ${getTokenFn() ?? ""}` } }, {
+                    fetchImpl: authedFetch,
+                    signal,
+                    policy: {
+                        maxAttempts: 1,
+                        backoffBaseMs: 0,
+                        backoffMaxMs: 0,
+                        timeoutMs: COST_FETCH_TIMEOUT_MS,
+                        jitterRatio: 0,
+                    },
+                });
                 if (!res.ok)
                     return null;
                 const data = (await res.json());
                 if (typeof data.remaining !== "number")
                     return null;
-                return { remaining: data.remaining, unit: typeof data.unit === "string" ? data.unit : "credits" };
+                return {
+                    remaining: data.remaining,
+                    unit: typeof data.unit === "string" ? data.unit : "credits",
+                };
             }
             catch {
                 return null;
@@ -1268,7 +1362,17 @@ export async function registerYagni(pi, deps = {}) {
         fetchSpend: yagniSessionId
             ? async (signal) => {
                 try {
-                    const res = await resilientFetch(buildSpendUrl(baseUrl, yagniSessionId, sessionRunIds()), { method: "GET", headers: { authorization: `Bearer ${getTokenFn() ?? ""}` } }, { fetchImpl: authedFetch, signal, policy: { maxAttempts: 1, backoffBaseMs: 0, backoffMaxMs: 0, timeoutMs: COST_FETCH_TIMEOUT_MS, jitterRatio: 0 } });
+                    const res = await resilientFetch(buildSpendUrl(baseUrl, yagniSessionId, sessionRunIds()), { method: "GET", headers: { authorization: `Bearer ${getTokenFn() ?? ""}` } }, {
+                        fetchImpl: authedFetch,
+                        signal,
+                        policy: {
+                            maxAttempts: 1,
+                            backoffBaseMs: 0,
+                            backoffMaxMs: 0,
+                            timeoutMs: COST_FETCH_TIMEOUT_MS,
+                            jitterRatio: 0,
+                        },
+                    });
                     if (!res.ok)
                         return null;
                     return parseSpendResponse(await res.json());
@@ -1571,6 +1675,34 @@ export async function registerYagni(pi, deps = {}) {
         // the sandbox to reach bash, so the hatch is the one carve-out.
         sandboxHandle.registerOwnBash();
     }
+    else if (toolchainHook) {
+        // Nothing above takes bash over (eval mode, the classic-rows hatch), so
+        // the toolchain reaches the model's spawns through pi's own bash
+        // definition: its schema and rendering unchanged, its PATH the file's.
+        // Fail-soft like the condensed registration: pi's stock bash remains, and
+        // the trail says which step threw (building the definition from the
+        // user's shell settings, or pi's registry taking it) and why.
+        let step = "definition";
+        try {
+            const bash = toolchainBashToolDefinition(toolchainHook, process.cwd());
+            step = "register";
+            pi.registerTool(bash);
+        }
+        catch (err) {
+            logEvent({
+                source: "toolchain",
+                level: "warn",
+                event: "bash_register_failed",
+                fields: {
+                    step,
+                    errorClass: err instanceof Error ? err.constructor.name : typeof err,
+                    // Scrubbed, then cut. A thrown value that is no Error gives no text:
+                    // coercing one can itself throw (a null-prototype object).
+                    message: err instanceof Error ? scrubSecrets(err.message).slice(0, 300) : "",
+                },
+            });
+        }
+    }
     // Own the identity + inject live company context (and repo rules) on every
     // turn. The extension loads identically in every pi process this app spawns —
     // the interactive driver AND every `/go` stage child, subagent, and advisor
@@ -1584,15 +1716,8 @@ export async function registerYagni(pi, deps = {}) {
     // Resolved per turn (not once at activation): /ultra can flip the driver
     // between the delegation and diamond identities mid-session.
     const isDriver = isDriverCaller(env);
-    // A sandbox session is told what its sandbox has instead of a laptop's
-    // `gh` recipes. Both signals are the ones the sandbox already rides: the
-    // harness's toolchain file, and eval mode, which is where team_read (the
-    // tool the section sends GitHub reads to) is registered. A local eval
-    // compare sets eval mode without the harness, so it keeps the laptop's.
-    const sandboxSession = evalMode && runsInSandboxHarness(env);
-    // A stage child of `yagni go --headless --cloud`: headlessGo sets the env
-    // where it parses the flag, and the session is told the cloud sandbox.
-    const cloudSession = sandboxSession && env[CLOUD_SESSION_ENV] === "1";
+    // `sandboxSession` and `cloudSession` (above, beside eval mode) pick the
+    // "Your sandbox" section in place of the laptop's.
     pi.on("before_agent_start", (event) => noBranding
         ? undefined
         : {
@@ -1629,7 +1754,11 @@ export async function registerYagni(pi, deps = {}) {
     const sessionIdForLog = () => deps.env?.YAGNI_SESSION_ID;
     pi.on("turn_start", (event) => {
         turnStartMs.set(event.turnIndex, Date.now());
-        logTurnLifecycle({ kind: "turn_start", sessionId: sessionIdForLog(), turnIndex: event.turnIndex });
+        logTurnLifecycle({
+            kind: "turn_start",
+            sessionId: sessionIdForLog(),
+            turnIndex: event.turnIndex,
+        });
     });
     pi.on("turn_end", (event) => {
         const startedAt = turnStartMs.get(event.turnIndex);
@@ -1683,8 +1812,8 @@ export async function registerYagni(pi, deps = {}) {
             // only place to detect it and trigger recovery. The regex matches
             // "yagni login" (the backend's auth-error message) but NOT
             // "request_too_large" (YAG-460's overflow marker).
-            const isAuthError = /yagni login/i.test(msg.errorMessage)
-                && !/request_too_large|context_too_large/i.test(msg.errorMessage);
+            const isAuthError = /yagni login/i.test(msg.errorMessage) &&
+                !/request_too_large|context_too_large/i.test(msg.errorMessage);
             if (isAuthError) {
                 lastAuthRecovery = null;
                 let rotated = false;
@@ -1738,9 +1867,9 @@ export async function registerYagni(pi, deps = {}) {
             const isContextTooLarge = /request_too_large|context_too_large/i.test(msg.errorMessage);
             if (!isContextTooLarge)
                 return;
-            const explanation = "The conversation context is too large for the model (request_too_large). "
-                + "YAGNI Code is compacting the session and retrying automatically — "
-                + "if it does not recover, run /compact or start a new session.";
+            const explanation = "The conversation context is too large for the model (request_too_large). " +
+                "YAGNI Code is compacting the session and retrying automatically — " +
+                "if it does not recover, run /compact or start a new session.";
             if (ctx.hasUI) {
                 try {
                     ctx.ui.notify(explanation, "warning");
@@ -1997,7 +2126,7 @@ export async function registerYagni(pi, deps = {}) {
         // not (an allowed command failing the same way ten times is denied).
         if (command) {
             permissionGate.recordBashOutcome(command, event.isError === true, (event.content ?? [])
-                .map((c) => (c && typeof c === "object" && "text" in c ? String(c.text) : ""))
+                .map((c) => c && typeof c === "object" && "text" in c ? String(c.text) : "")
                 .join("\n"));
         }
         // The auto-sandbox rung's prior-failure evidence: a SANDBOXED bash
@@ -2006,12 +2135,9 @@ export async function registerYagni(pi, deps = {}) {
         // auto-sandboxing into the same denial forever. Only sandboxed runs
         // count (an escaped run's failure text proves nothing about the
         // sandbox); only the trimmed command is kept, never logged.
-        if (sandboxHandle &&
-            !input.dangerouslyDisableSandbox &&
-            event.isError &&
-            command) {
+        if (sandboxHandle && !input.dangerouslyDisableSandbox && event.isError && command) {
             const text = (event.content ?? [])
-                .map((c) => (c && typeof c === "object" && "text" in c ? String(c.text) : ""))
+                .map((c) => c && typeof c === "object" && "text" in c ? String(c.text) : "")
                 .join("\n");
             if (isSandboxDenialOutput(text)) {
                 recordSandboxedFailure(command);
@@ -2064,9 +2190,7 @@ export async function registerYagni(pi, deps = {}) {
         // (a tool's own failure text). Keep the always-on trail content-free: use
         // ONLY the Error subclass name, never the message or a String() of the
         // result's error payload.
-        const errorClass = event.result instanceof Error
-            ? event.result.name || "Error"
-            : "tool_error";
+        const errorClass = event.result instanceof Error ? event.result.name || "Error" : "tool_error";
         logEvent({
             source: "tool",
             level: "error",
@@ -2103,8 +2227,8 @@ export { recordDecision } from "./recordDecisionTool.js";
 // free text first-class) + the explicit /setup-team drafting flow.
 export { runInitPass, runTeamSetup, registerTeamSetupCommand, isFreshWorkspace, readRepoIntake, draftEngineering, summarizeDraft, FRESH_BRIEF_MIN_CHARS, } from "./initPass.js";
 // Onramp Door B (F2a): the one-time init-pass idempotency marker.
-export { isInitDone, markInitDone, initDoneMarkerFile, _setInitDoneHomeForTest } from "./initDone.js";
-export { brandSystemPrompt, YAGNI_IDENTITY, YAGNI_IDENTITY_DRIVER, YAGNI_IDENTITY_ULTRA, BRAND_NAME } from "./branding.js";
+export { isInitDone, markInitDone, initDoneMarkerFile, _setInitDoneHomeForTest, } from "./initDone.js";
+export { brandSystemPrompt, YAGNI_IDENTITY, YAGNI_IDENTITY_DRIVER, YAGNI_IDENTITY_ULTRA, BRAND_NAME, } from "./branding.js";
 // YAG-506: user-configurable lifecycle hooks.
 export { loadHooksConfig, makeHookRunner, registerHooks, matchesMatcher, parsePreToolUseOutput, parsePermissionRequestOutput, parseAdditionalContext, parseCompactCancel, HOOK_SUPPORTED_EVENTS, } from "./hooks.js";
 // Ultra mode (/ultra): the aggressive fan-out/verify/synthesize dial.
@@ -2118,7 +2242,7 @@ export { runPipeline } from "./pipeline/orchestrator.js";
 export { HEADLESS_GO_EXIT, HEADLESS_GO_USAGE, parseHeadlessGoArgs, runHeadlessGo, validateHeadlessGoArgs, } from "./pipeline/headlessGo.js";
 // Mission mode: the pure rules for entering the pipeline on an already-approved
 // plan (map/plan skipped, memo as the stand-in repo brief, FINISH not ours).
-export { isMissionMode, missionSeed, missionSkippedStages, normalizeMission } from "./pipeline/mission.js";
+export { isMissionMode, missionSeed, missionSkippedStages, normalizeMission, } from "./pipeline/mission.js";
 // The eval/smoke tier ceiling (YAGNI_GO_TIER_CAP), clamped centrally in runStage.
 export { clampTier, parseTierCap, resolveTierCap, TIER_CAP_ENV } from "./pipeline/tierCap.js";
 // R1: the in-loop resilience HOF a dev can compose with (or replace at) the
@@ -2126,9 +2250,9 @@ export { clampTier, parseTierCap, resolveTierCap, TIER_CAP_ENV } from "./pipelin
 export { withResilience, classifyTransient, composeAbortSignal } from "./pipeline/resilience.js";
 export { DEFAULT_RESILIENCE_POLICY } from "./pipeline/types.js";
 // P4: the deterministic verify gate seam (override the command via .yagni-code/verify).
-export { buildVerifyEnv, detectVerifyCommand, makeRunVerify, parseVerifyFailures } from "./pipeline/verify.js";
+export { buildVerifyEnv, detectVerifyCommand, makeRunVerify, parseVerifyFailures, } from "./pipeline/verify.js";
 // M6: the report-only grounded-vs-blind eval engine.
-export { blindStages, reportOnlyStages, makeGroundedVsBlindEval, formatComparisonReport } from "./pipeline/eval.js";
+export { blindStages, reportOnlyStages, makeGroundedVsBlindEval, formatComparisonReport, } from "./pipeline/eval.js";
 export { registerGoCompareCommand } from "./pipeline/goCompareCommand.js";
 // The general subagent tool: Claude Code-format agent discovery + fan-out.
 export { registerSubagents, makeSubagentTool, discoverSubagents, parseAgentMarkdown, buildSubagentStage, formatAgentList, mapModelTier, SUBAGENT_TOOL_NAME, GENERAL_AGENT_NAME, MAX_PARALLEL_SUBAGENTS, MAX_PARALLEL_SUBAGENTS_ULTRA, DEFAULT_SUBAGENT_TOOLS, } from "./subagents.js";

package/dist/extension/toolchain/spawnHook.d.ts

@@ -18,7 +18,7 @@
  * @yagni/shared, so it reads the same `{ version: 1, path, env, tools }` with
  * its own parser. A change there is a change here.
  */
-import { type BashOperations, type BashSpawnHook } from "@earendil-works/pi-coding-agent";
+import { createBashToolDefinition, type BashOperations, type BashSpawnHook } from "@earendil-works/pi-coding-agent";
 import { type SinkEvent } from "../errorSink.js";
 export interface ToolchainFile {
     version: 1;
@@ -51,8 +51,8 @@ export declare function composeSpawnHooks(...hooks: Array<BashSpawnHook | undefi
 /**
  * This process runs under the sandbox harness (`infra/e2b/pi/pi-harness.sh`
  * exports `YAGNI_TOOLCHAIN_FILE` on every E2B and Machines session, Reeve's
- * and Wright's alike, and `/go` children inherit it). A developer's own
- * terminal never sets it.
+ * and Wright's alike, the one-attempt lane's launch line does too, and `/go`
+ * children inherit it). A developer's own terminal never sets it.
  */
 export declare function runsInSandboxHarness(env?: NodeJS.ProcessEnv): boolean;
 /**
@@ -61,6 +61,16 @@ export declare function runsInSandboxHarness(env?: NodeJS.ProcessEnv): boolean;
  * unreadable logs once.
  */
 export declare function toolchainSpawnHookFromEnv(env?: NodeJS.ProcessEnv, log?: Log): BashSpawnHook | undefined;
+/**
+ * pi's own bash tool as its session builds it (the user's shell and command
+ * prefix), with the hook on every spawn. For a session where no other
+ * registration takes bash over (eval mode, the classic-rows hatch): its name,
+ * description, parameters and rendering stay pi's, and only the spawn's PATH
+ * and variables change. The shell settings are the user's own, never the
+ * repository's: pi's session reads a repository's settings only once the
+ * folder is trusted, and nothing in a sandbox trusts one.
+ */
+export declare function toolchainBashToolDefinition(hook: BashSpawnHook, cwd: string): ReturnType<typeof createBashToolDefinition>;
 /**
  * `user_bash` (`!` commands) through pi's own local backend, with the hook's
  * environment: the same toolchain the model's bash tool gets.

package/dist/extension/toolchain/spawnHook.js

@@ -19,7 +19,7 @@
  * its own parser. A change there is a change here.
  */
 import { readFileSync } from "node:fs";
-import { createLocalBashOperations, SettingsManager, } from "@earendil-works/pi-coding-agent";
+import { createBashToolDefinition, createLocalBashOperations, getAgentDir, SettingsManager, } from "@earendil-works/pi-coding-agent";
 import { logEvent } from "../errorSink.js";
 const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 /** The file, or null when the text is not a well-formed version 1 file. */
@@ -70,12 +70,22 @@ export function readToolchainFile(path, log = logEvent) {
     }
     catch (err) {
         const code = isRecord(err) && typeof err.code === "string" ? err.code : "read_failed";
-        log({ source: "toolchain", level: "warn", event: "file_unreadable", fields: { path, reason: code } });
+        log({
+            source: "toolchain",
+            level: "warn",
+            event: "file_unreadable",
+            fields: { path, reason: code },
+        });
         return null;
     }
     const file = parseToolchainFile(text);
     if (!file)
-        log({ source: "toolchain", level: "warn", event: "file_unreadable", fields: { path, reason: "malformed" } });
+        log({
+            source: "toolchain",
+            level: "warn",
+            event: "file_unreadable",
+            fields: { path, reason: "malformed" },
+        });
     return file;
 }
 /**
@@ -100,8 +110,8 @@ export function composeSpawnHooks(...hooks) {
 /**
  * This process runs under the sandbox harness (`infra/e2b/pi/pi-harness.sh`
  * exports `YAGNI_TOOLCHAIN_FILE` on every E2B and Machines session, Reeve's
- * and Wright's alike, and `/go` children inherit it). A developer's own
- * terminal never sets it.
+ * and Wright's alike, the one-attempt lane's launch line does too, and `/go`
+ * children inherit it). A developer's own terminal never sets it.
  */
 export function runsInSandboxHarness(env = process.env) {
     return Boolean(env.YAGNI_TOOLCHAIN_FILE?.trim());
@@ -118,6 +128,23 @@ export function toolchainSpawnHookFromEnv(env = process.env, log = logEvent) {
     const file = readToolchainFile(path, log);
     return file ? makeToolchainSpawnHook(file) : undefined;
 }
+/**
+ * pi's own bash tool as its session builds it (the user's shell and command
+ * prefix), with the hook on every spawn. For a session where no other
+ * registration takes bash over (eval mode, the classic-rows hatch): its name,
+ * description, parameters and rendering stay pi's, and only the spawn's PATH
+ * and variables change. The shell settings are the user's own, never the
+ * repository's: pi's session reads a repository's settings only once the
+ * folder is trusted, and nothing in a sandbox trusts one.
+ */
+export function toolchainBashToolDefinition(hook, cwd) {
+    const settings = SettingsManager.create(cwd, getAgentDir(), { projectTrusted: false });
+    return createBashToolDefinition(cwd, {
+        shellPath: settings.getShellPath(),
+        commandPrefix: settings.getShellCommandPrefix(),
+        spawnHook: hook,
+    });
+}
 /**
  * `user_bash` (`!` commands) through pi's own local backend, with the hook's
  * environment: the same toolchain the model's bash tool gets.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yagni-app/code-staging",
-  "version": "1.2.6-staging.2011.1",
+  "version": "1.2.6-staging.2020.1",
   "description": "YAGNI Code: a terminal coding agent that already knows your company. One YAGNI login routes the model and grounds the agent in your team's context.",
   "license": "SEE LICENSE IN LICENSE.md",
   "author": "YAGNI, Inc. <jack@yagni.app> (https://yagni.app)",
@@ -58,5 +58,5 @@
     "turndown": "^7.2.4",
     "typebox": "^1.3.15"
   },
-  "yagniSourceSha": "898cdc35e3f5a6cfce58e4c4fcc8b95a9e0a5386"
+  "yagniSourceSha": "e3bb7574f09420b1c1a9a25a971db7ae109f468f"
 }