@yagni-app/code 1.0.4 → 1.0.5

package/dist/extension/index.js

@@ -885,9 +885,12 @@ export async function registerYagni(pi, deps = {}) {
         // Surface Pi's native find/grep/ls on the driver. These are Pi's
         // equivalents of Claude Code's Glob/Grep/LS; the /go stages and subagents
         // already pass them explicitly, but the driver defaults to read/bash/edit/write
-        // and otherwise reaches for `bash` find/grep/ls.
+        // and otherwise reaches for `bash` find/grep/ls. Dedupe against the active
+        // set — condensedTools re-registers these built-ins, so they can already be
+        // active here, and a duplicated name in the request's tool list is a hard
+        // 400 on some providers (Baseten: "Tool names must be unique.").
         try {
-            pi.setActiveTools([...pi.getActiveTools(), "grep", "find", "ls"]);
+            pi.setActiveTools([...new Set([...pi.getActiveTools(), "grep", "find", "ls"])]);
         }
         catch {
             // Tool enrichment must never break session start.

package/dist/extension/permission/execPolicy.js

@@ -616,10 +616,20 @@ function classifySegmentTokens(rawTokens, policy, opts) {
     }
     const { tokens: strippedTokens, stripped } = stripLeadingTokens(rawTokens);
     if (strippedTokens.length === 0) {
+        // A segment made only of environment assignments (`FOO=bar`) is a no-op: it
+        // sets shell variables and executes nothing. Recognize it so a compound like
+        // `SF="$F"; echo hi` is not floored by its leading assignment. Safety holds
+        // because classifyCommand's construct floor + substitution danger scan run
+        // afterward: an assignment whose value is a `$(...)` substitution frees the
+        // inner text for the danger scan and downgrades the overall result to prompt
+        // or forbidden there.
+        if (!opts.forbiddenOnly && rawTokens.length > 0 && rawTokens.every((t) => ENV_ASSIGNMENT_RE.test(t))) {
+            return { decision: "allow", justification: "no-op environment assignment" };
+        }
         // env standalone: `env` or `env VAR=val` with no following command prints
         // environment variables — a read-only operation. stripLeadingTokens removes
         // `env` as a wrapper word, leaving empty tokens. Recognize this case instead
-        // of returning "empty command segment" (YAG-549).
+        // of returning "empty command segment".
         if (!opts.forbiddenOnly && rawTokens.length > 0 && basenameToken(rawTokens[0]) === "env") {
             const onlyEnvAndAssignments = rawTokens.every((t) => basenameToken(t) === "env" || ENV_ASSIGNMENT_RE.test(t));
             if (onlyEnvAndAssignments) {
@@ -951,6 +961,9 @@ export const DEFAULT_EXEC_POLICY = {
         { pattern: ["printf"], decision: "allow", justification: "print formatted text" },
         { pattern: ["whoami"], decision: "allow", justification: "show current user" },
         { pattern: ["uname"], decision: "allow", justification: "show system info" },
+        { pattern: ["ps"], decision: "allow", justification: "list processes (read-only)" },
+        { pattern: ["lsof"], decision: "allow", justification: "list open files and ports (read-only)" },
+        { pattern: ["sleep"], decision: "allow", justification: "no-op delay" },
         { pattern: ["git", "status"], decision: "allow", justification: "show working tree status" },
         { pattern: ["git", "log"], decision: "allow", justification: "show commit log" },
         { pattern: ["git", "diff"], decision: "allow", justification: "show changes" },
@@ -989,6 +1002,9 @@ export const DEFAULT_EXEC_POLICY = {
         },
         { pattern: ["linear", ["--help", "-h"]], decision: "allow", justification: "show Linear CLI help" },
         { pattern: ["linear", ["--version", "-V"]], decision: "allow", justification: "show Linear CLI version" },
+        { pattern: ["linear", "user", "list"], decision: "allow", justification: "list Linear workspace members (read-only)" },
+        { pattern: ["linear", "team", ["list", "members", "states", "id"]], decision: "allow", justification: "read Linear team data (read-only)" },
+        { pattern: ["linear", "project", ["list", "view"]], decision: "allow", justification: "read Linear project data (read-only)" },
         // gh api — REST GET (no params, no method override) and GraphQL queries (no mutation)
         // gh api defaults to POST when -f/-F params are present, so params are disqualifying.
         // GraphQL is always POST, but queries are reads; mutations/subscriptions are disqualifying.
@@ -1065,7 +1081,6 @@ export const DEFAULT_EXEC_POLICY = {
         { pattern: ["tar"], decision: "prompt", justification: "archive operation" },
         { pattern: ["zip"], decision: "prompt", justification: "archive operation" },
         { pattern: ["unzip"], decision: "prompt", justification: "archive operation" },
-        { pattern: ["ps"], decision: "prompt", justification: "lists processes" },
         { pattern: ["kill"], decision: "prompt", justification: "sends a signal to a process" },
         { pattern: ["chmod"], decision: "prompt", justification: "permission change — review the mode" },
         { pattern: ["chown"], decision: "prompt", justification: "ownership change" },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yagni-app/code",
-  "version": "1.0.4",
+  "version": "1.0.5",
   "description": "YAGNI Code: a terminal coding agent that already knows your company. One YAGNI login routes the model and grounds the agent in your team's context.",
   "license": "SEE LICENSE IN LICENSE.md",
   "author": "YAGNI, Inc. <jack@yagni.app> (https://yagni.app)",
@@ -41,5 +41,5 @@
     "turndown": "^7.2.4",
     "typebox": "^1.3.15"
   },
-  "yagniSourceSha": "58371f52233aaff50f140f858c9018d3e500e4e1"
+  "yagniSourceSha": "5bd359dcd98d8104d425f698a65ed60d780df0af"
 }