@yagni-app/code 0.2.0 → 0.3.0

package/dist/extension/costHud.d.ts

@@ -52,7 +52,20 @@ export interface Headroom {
     remaining: number;
     unit: string;
 }
-export declare function formatCostLine(snap: CostSnapshot, headroom?: Headroom | null, advisorLine?: string, source?: string, boosted?: boolean): string;
+/**
+ * Render the /cost line. Pure, no em-dashes. `headroom` null means it was
+ * unavailable. `advisorLine` is the ask_advisor subtotal (empty when the session
+ * never escalated). `source`, when given, is parenthesized right after "Session
+ * usage", used to explicitly label this as the LOCAL, driver-only fallback when
+ * the server-authoritative spend fetch is unavailable (see
+ * {@link formatServerCostLines}, the preferred path).
+ *
+ * HONESTY NOTE: this counter can only see the DRIVER session, because it is fed
+ * by pi's `turn_end`. Work that runs in a child process — every /go stage, and
+ * every advisor consult — never emits a parent `turn_end`, so it is invisible
+ * here. The advisor subtotal is threaded in explicitly for exactly that reason.
+ */
+export declare function formatCostLine(snap: CostSnapshot, headroom?: Headroom | null, advisorLine?: string, source?: string): string;
 /**
  * One row of `GET /api/yagni-code/spend`'s per-caller x rate-tier breakdown.
  * Mirrored locally rather than importing `@yagni/shared`, since this extension
@@ -102,25 +115,15 @@ export declare const usd: (millicents: number) => string;
  * (joined with "\n").
  *
  * Line order: total spend, one line per rate tier (aggregated across callers,
- * sorted by spend descending), a boosted-spend subtotal per tier that has any
- * boosted rows, a live-toggle boost line (see below), the savings line (only
+ * sorted by spend descending), the savings line (only
  * when a counterfactual total resolved), an incomplete-counterfactual note,
  * an unbilled note, a dropped-run-ids note (carry-over from the /cost
  * re-review — see sessionRuns.ts's `droppedSessionRuns`), then headroom.
  *
  * `droppedRunCount` defaults to 0 (no note) so every existing direct caller
  * of this pure function keeps behaving identically without passing it.
- *
- * `boosted` (default false) is the LIVE client-side toggle from
- * `boostCommand.ts`'s `isBoosted()`, threaded in exactly like `advisorLine`
- * is for {@link formatCostLine}. It is independent of the per-tier "Boosted
- * (tier) spend" subtotal above: that subtotal only reflects server rows
- * carrying `x-yagni-boost`, which only `/go` children (and other spawned
- * processes) ever send — the driver's own turns never do (see
- * boostCommand.ts's KNOWN-asymmetry docblock). Without this flag, a session
- * that only chats while boosted would show no boost line at all.
  */
-export declare function formatServerCostLines(spend: SpendResponse, headroom?: Headroom | null, droppedRunCount?: number, boosted?: boolean): string;
+export declare function formatServerCostLines(spend: SpendResponse, headroom?: Headroom | null, droppedRunCount?: number): string;
 export interface RegisterCostDeps {
     /** Fetch remaining credit headroom; return null when unavailable. Fail-soft. */
     fetchHeadroom?: (signal?: AbortSignal) => Promise<Headroom | null>;
@@ -132,15 +135,6 @@ export interface RegisterCostDeps {
      * ordinary caller row.
      */
     advisorSubtotal?: () => string;
-    /**
-     * Whether the session is currently boosted to Peak (boostCommand.ts's
-     * `isBoosted()`, threaded in the same way as `advisorSubtotal`). Unlike
-     * `advisorSubtotal`, this is read on BOTH the server-authoritative and the
-     * local-fallback branch: the driver's own turns never carry a server-side
-     * boost marker (see boostCommand.ts's KNOWN-asymmetry docblock), so this is
-     * the only signal that would otherwise be missing from the server branch.
-     */
-    isBoosted?: () => boolean;
     /**
      * Fetch the server-authoritative session spend (YAG-383). Absent, throwing,
      * or resolving null all fall back to the local `turn_end` accumulator, with

package/dist/extension/costHud.js

@@ -75,21 +75,18 @@ const fmt = (n) => n.toLocaleString("en-US");
  * every advisor consult — never emits a parent `turn_end`, so it is invisible
  * here. The advisor subtotal is threaded in explicitly for exactly that reason.
  */
-/** The boost-active line appended to /cost, both branches (see boostCommand.ts's docblock for why). */
-const BOOST_LINE = "Boost is on. Driver turns bill at the peak tier.";
-export function formatCostLine(snap, headroom, advisorLine, source, boosted = false) {
+export function formatCostLine(snap, headroom, advisorLine, source) {
     const turns = `${snap.turns} turn${snap.turns === 1 ? "" : "s"}`;
     const cached = snap.cacheRead > 0 ? ` (${fmt(snap.cacheRead)} cached)` : "";
     const label = source ? `Session usage (${source})` : "Session usage";
     const base = `${label}: ${turns}, ${fmt(snap.input)} in / ${fmt(snap.output)} out tokens${cached}, ` +
         `$${snap.cost.toFixed(2)} this session.`;
     const advisor = advisorLine?.trim() ? ` ${advisorLine.trim()}` : "";
-    const boost = boosted ? ` ${BOOST_LINE}` : "";
     if (headroom)
-        return `${base}${advisor}${boost} Credit headroom: ${headroom.remaining} ${headroom.unit}.`;
+        return `${base}${advisor} Credit headroom: ${headroom.remaining} ${headroom.unit}.`;
     if (headroom === null)
-        return `${base}${advisor}${boost} Credit headroom unavailable right now.`;
-    return `${base}${advisor}${boost}`;
+        return `${base}${advisor} Credit headroom unavailable right now.`;
+    return `${base}${advisor}`;
 }
 /**
  * Millicents (1/1000 of a cent) -> dollars, 2 decimals. Guards against a
@@ -115,25 +112,15 @@ export const usd = (millicents) => {
  * (joined with "\n").
  *
  * Line order: total spend, one line per rate tier (aggregated across callers,
- * sorted by spend descending), a boosted-spend subtotal per tier that has any
- * boosted rows, a live-toggle boost line (see below), the savings line (only
+ * sorted by spend descending), the savings line (only
  * when a counterfactual total resolved), an incomplete-counterfactual note,
  * an unbilled note, a dropped-run-ids note (carry-over from the /cost
  * re-review — see sessionRuns.ts's `droppedSessionRuns`), then headroom.
  *
  * `droppedRunCount` defaults to 0 (no note) so every existing direct caller
  * of this pure function keeps behaving identically without passing it.
- *
- * `boosted` (default false) is the LIVE client-side toggle from
- * `boostCommand.ts`'s `isBoosted()`, threaded in exactly like `advisorLine`
- * is for {@link formatCostLine}. It is independent of the per-tier "Boosted
- * (tier) spend" subtotal above: that subtotal only reflects server rows
- * carrying `x-yagni-boost`, which only `/go` children (and other spawned
- * processes) ever send — the driver's own turns never do (see
- * boostCommand.ts's KNOWN-asymmetry docblock). Without this flag, a session
- * that only chats while boosted would show no boost line at all.
  */
-export function formatServerCostLines(spend, headroom, droppedRunCount = 0, boosted = false) {
+export function formatServerCostLines(spend, headroom, droppedRunCount = 0) {
     const lines = [`Session spend: $${usd(spend.totalSellMillicents)} (server).`];
     const tierTotals = new Map();
     for (const row of spend.rows) {
@@ -147,23 +134,6 @@ export function formatServerCostLines(spend, headroom, droppedRunCount = 0, boos
         const calls = `${fmt(agg.dispatches)} call${agg.dispatches === 1 ? "" : "s"}`;
         lines.push(`  ${tier}: $${usd(agg.sellMillicents)} over ${calls}.`);
     }
-    const boostTotals = new Map();
-    for (const row of spend.rows) {
-        if (!row.boost)
-            continue;
-        boostTotals.set(row.rateTier, (boostTotals.get(row.rateTier) ?? 0) + row.sellMillicents);
-    }
-    if (boostTotals.size > 0) {
-        for (const [tier] of tiersSorted) {
-            const tierBoosted = boostTotals.get(tier);
-            if (tierBoosted === undefined)
-                continue;
-            lines.push(`  Boosted (${tier}) spend: $${usd(tierBoosted)}.`);
-        }
-    }
-    if (boosted) {
-        lines.push(BOOST_LINE);
-    }
     // typeof guard (not just !== null): a network response is untyped at
     // runtime, and a stray string/boolean here must never sneak "NN%" into the
     // rendered line.
@@ -233,15 +203,6 @@ export function registerCostCommand(pi, deps = {}) {
                     : Promise.resolve(null),
             ]);
             const localSnap = acc.snapshot();
-            // Read fresh on every /cost call, both branches (see RegisterCostDeps's
-            // isBoosted doc comment for why the local fallback needs it too).
-            let boosted = false;
-            try {
-                boosted = deps.isBoosted?.() ?? false;
-            }
-            catch {
-                /* a diagnostic must never break /cost */
-            }
             // Quiet divergence check: both totals must be available, and it never
             // affects what the user sees. Scoped to `caller === "driver"` rows only
             // (like-for-like with the local `turn_end` accumulator, which can only
@@ -276,7 +237,7 @@ export function registerCostCommand(pi, deps = {}) {
                 catch {
                     /* a diagnostic must never break /cost */
                 }
-                await pi.sendUserMessage(formatServerCostLines(spend, headroom, dropped, boosted));
+                await pi.sendUserMessage(formatServerCostLines(spend, headroom, dropped));
                 return;
             }
             let advisorLine = "";
@@ -286,7 +247,7 @@ export function registerCostCommand(pi, deps = {}) {
             catch {
                 /* usage accounting must never break /cost */
             }
-            await pi.sendUserMessage(formatCostLine(localSnap, headroom, advisorLine, "local, driver only", boosted));
+            await pi.sendUserMessage(formatCostLine(localSnap, headroom, advisorLine, "local, driver only"));
         },
     });
 }

package/dist/extension/crashReport.js

@@ -125,8 +125,6 @@ export function makeCrashReporter(opts) {
             if (crashReportsDisabled(env))
                 return;
             const token = opts.getToken();
-            if (!token)
-                return;
             const sanitized = sanitizeCrashError(error, { env, repoRoot });
             const payload = {
                 client: isDesktopSurface() ? "desktop" : "cli",
@@ -148,7 +146,7 @@ export function makeCrashReporter(opts) {
                     method: "POST",
                     headers: {
                         "content-type": "application/json",
-                        authorization: `Bearer ${token}`,
+                        ...(token ? { authorization: `Bearer ${token}` } : {}),
                     },
                     body: JSON.stringify(payload),
                     signal: controller.signal,

package/dist/extension/execPolicy.d.ts

@@ -0,0 +1,119 @@
+/**
+ * Exec policy engine — classifies bash commands via prefix rules + lightweight
+ * shell tokenization (YAG-504, restructured in YAG-510).
+ *
+ * Pure: no I/O, no network, no model. Loads at startup and classifies
+ * synchronously. The curated default set auto-allows read-only commands
+ * (ls, cat, rg, git status/log/diff), forbids destructive ones (rm -rf,
+ * git reset --hard, git push --force, pipe-to-shell), and prompts for the
+ * ambiguous middle band (npm install, git commit, curl, …).
+ *
+ * The `prompt` band is what the Guardian arbitrates — see guardian.ts.
+ *
+ * Classification composes three signals and takes the STRICTEST:
+ *   1. prefix-rule matching on every segment (newlines, ;, &&, ||, | split);
+ *   2. a construct floor — commands using redirects, substitution, or
+ *      background & can never be auto-allowed (floor: prompt);
+ *   3. dangerScan — a best-effort sweep of command-substitution inner text
+ *      ($(...) and backticks, including inside double quotes) against the
+ *      FORBIDDEN rules only. Danger anywhere upgrades to forbidden; the scan
+ *      can never make anything more permissive.
+ * This is the codex two-parser lesson: fail closed to prove safety, scan
+ * best-effort to prove danger. A forbidden match must win even when the
+ * command also carries constructs (`rm -rf / &` is forbidden, not prompt).
+ *
+ * Command words are matched through a leading-token strip (env assignments,
+ * sudo/env/command wrappers, shell reserved words, a leading backslash) and
+ * basename normalization (/bin/rm → rm) — both applied ASYMMETRICALLY: they
+ * can make a command land on forbidden/prompt rules, but a stripped or
+ * path-prefixed command is never auto-allowed (`sudo ls` and `./ls` stay in
+ * the prompt band; an attacker-named local `./rm` binary must not ride the
+ * allow list, and `/bin/ls` pays the same price by design).
+ *
+ * Tokenization is a lightweight inline parser — not shell-quote — because the
+ * extension is bundled into @yagni-app/code's dist (a file copy, not a real
+ * bundler), and external dependencies aren't resolvable from the bundled path.
+ */
+export type TokenEntry = string | {
+    op: "pipe" | "and" | "or" | "semi" | "redirect" | "substitution";
+};
+/**
+ * Parse a shell command string into tokens and control operators.
+ *
+ * Handles:
+ * - Single and double quoted strings (preserves spaces inside)
+ * - Control operators: |, &&, ||, ;, and newlines (a newline separates
+ *   commands exactly like `;` — treating it as whitespace let multiline
+ *   commands smuggle anything behind an allow-listed first line)
+ * - `#` comments (start-of-word to end-of-line, outside quotes)
+ * - Shell constructs we flag as unanalyzable: $(), backticks (INCLUDING
+ *   inside double quotes — bash executes those), >, <, background &
+ *
+ * Does NOT handle: variable expansion, glob patterns, heredocs beyond the
+ * redirect flag, nested subshells beyond depth tracking. Commands using
+ * those are classified as "prompt" at minimum (construct floor).
+ */
+export declare function shellParse(command: string): TokenEntry[];
+/**
+ * Extract the inner text of every command substitution — $(...) and
+ * backticks — respecting single-quote literalness and backslash escapes.
+ * Includes substitutions inside double quotes (bash executes those).
+ * Best-effort, used ONLY by dangerScan to prove danger, never safety.
+ */
+export declare function extractSubstitutions(command: string): string[];
+export type ExecDecision = "allow" | "prompt" | "forbidden";
+export interface PrefixRule {
+    /** Ordered tokens; a string[] element means alternatives (any match). */
+    pattern: (string | string[])[];
+    decision: ExecDecision;
+    justification: string;
+    /**
+     * Escape hatch for allow rules whose command has a mutating flag: if any
+     * token AFTER the matched prefix equals one of these (or, for entries ending
+     * in "*", starts with the part before the star), the rule does NOT match and
+     * evaluation falls through to later rules (usually landing in the prompt
+     * band). Example: sed is read-only except with -i/--in-place.
+     */
+    unlessTokens?: string[];
+    /**
+     * Position-independent flag requirement: the rule matches only when, in
+     * addition to the pattern prefix, at least one token AFTER the prefix
+     * matches an entry (same "*"-suffix glob convention as unlessTokens).
+     * Used by forbidden rules to catch permuted flags: `git push origin
+     * --force` and `rm x -rf` place the dangerous flag after positional args,
+     * where exact-position patterns never see it.
+     */
+    flagsAnywhere?: string[];
+    /** Positive test invocations (validated at load if present). */
+    match?: string[][];
+    /** Negative test invocations (validated at load if present). */
+    notMatch?: string[][];
+}
+export interface ExecPolicy {
+    rules: PrefixRule[];
+}
+export interface ExecClassification {
+    decision: ExecDecision;
+    justification: string;
+    matchedRule?: PrefixRule;
+}
+/**
+ * Parse a command string into tokens using our lightweight tokenizer. Returns
+ * string tokens only (control operators and constructs are filtered out —
+ * detected separately).
+ */
+export declare function tokenize(command: string): string[];
+/**
+ * Classify a full bash command string against the exec policy.
+ *
+ * Compound commands (pipes, &&, ||, ;, newlines) are split into segments and
+ * each is classified independently; the strictest decision wins (forbidden >
+ * prompt > allow). Commands with shell constructs (substitution, redirects,
+ * background &) have a floor of `prompt`, and their substitution inner text
+ * is danger-scanned against the forbidden rules. Pipe-to-shell is always
+ * forbidden.
+ */
+export declare function classifyCommand(command: string, policy: ExecPolicy): ExecClassification;
+/** Curated default rules — the shipped safety floor. */
+export declare const DEFAULT_EXEC_POLICY: ExecPolicy;
+//# sourceMappingURL=execPolicy.d.ts.map