@yagni-app/code 1.0.4 → 1.0.6

package/dist/extension/permission/guardian.d.ts

@@ -99,6 +99,14 @@ export interface CircuitBreakerResult {
     reason?: string;
 }
 export declare function checkCircuitBreaker(state: GuardianState, limits: GuardianLimits): CircuitBreakerResult;
+export interface ParsedVerdict {
+    verdict: GuardianVerdict;
+    /** True when the strict parse failed and the lenient repair ladder salvaged it. */
+    repaired: boolean;
+}
+export declare function parseVerdictDetailed(raw: string): ParsedVerdict | null;
+/** Strict-shaped convenience wrapper: the verdict, or null. Callers that need
+ * the repaired signal use {@link parseVerdictDetailed}. */
 export declare function parseVerdict(raw: string): GuardianVerdict | null;
 export declare function formatGuardianSubtotal(state: GuardianState, limits: GuardianLimits): string;
 export type GuardianError = "timeout" | "malformed" | "network" | "empty" | "aborted";
@@ -106,11 +114,17 @@ export interface ReviewResult {
     verdict: GuardianVerdict | null;
     error?: GuardianError;
     cost: number;
+    /** True when the verdict came from the lenient repair ladder (strict parse
+     * failed first). The verdict is real and flows through the normal
+     * allow/ask/deny handling; this flag only marks it for telemetry. */
+    repaired?: boolean;
     /**
      * Scrubbed + capped copy of the model output when the verdict failed to
-     * parse (`error: "malformed"`). Present so the sink can capture the exact
-     * failure shape. Never contains the raw command unredacted: `scrubSecrets`
-     * removes secret-shaped values before this is stored.
+     * parse (`error: "malformed"`), or of the pre-repair extracted block when
+     * the repair ladder salvaged it (`repaired: true`). Present so the sink can
+     * capture the exact failure shape either way. Never contains the raw
+     * command unredacted: `scrubSecrets` removes secret-shaped values before
+     * this is stored.
      */
     rawOutput?: string;
 }
@@ -152,14 +166,18 @@ export interface GuardianDiagnosticEvent {
     outcome: GuardianOutcome | GuardianError;
     durationMs?: number;
     tier?: string;
+    /** True when the lenient repair ladder salvaged a broken verdict — the
+     * outcome is still the REAL verdict (allow/ask/deny); this flag marks it
+     * for telemetry so repair hit-rate is measurable. */
+    repaired?: true;
     /** Debug-only: command hash for correlation (never the raw command). */
     commandHash?: string;
     /** Debug-only: the Guardian's rationale. */
     rationale?: string;
     /**
      * Scrubbed + capped copy of the unparseable model output, present only for
-     * `outcome: "malformed"`. Always-on (NOT debug-gated): it is already
-     * `scrubSecrets`-redacted and size-capped at the source.
+     * `outcome: "malformed"` or `repaired: true`. Always-on (NOT debug-gated):
+     * it is already `scrubSecrets`-redacted and size-capped at the source.
      */
     rawOutput?: string;
 }
@@ -170,6 +188,7 @@ export interface GuardianDiagnosticEvent {
 export declare function buildDiagnosticEvent(outcome: GuardianOutcome | GuardianError, opts: {
     durationMs?: number;
     tier?: string;
+    repaired?: boolean;
     rationale?: string;
     commandHash?: string;
     rawOutput?: string;

package/dist/extension/permission/guardian.js

@@ -128,33 +128,158 @@ export function checkCircuitBreaker(state, limits) {
     }
     return { tripped: false };
 }
-// --- Verdict parsing (fail closed on malformed) ---
-export function parseVerdict(raw) {
+const VALID_RISK_LEVELS = ["low", "medium", "high", "critical"];
+/** Validate an already-parsed object into a verdict. The SINGLE validation
+ * gate: strict and repaired parses both end here, so the enum checks stay
+ * exactly as strict after repair as before. */
+function validateVerdictObject(parsed) {
+    if (!parsed)
+        return null;
+    const outcome = parsed.outcome;
+    if (outcome !== "allow" && outcome !== "ask" && outcome !== "deny")
+        return null;
+    const riskLevel = parsed.riskLevel;
+    return {
+        outcome,
+        riskLevel: typeof riskLevel === "string" && VALID_RISK_LEVELS.includes(riskLevel)
+            ? riskLevel
+            : "medium",
+        rationale: typeof parsed.rationale === "string" && parsed.rationale.trim().length > 0
+            ? parsed.rationale.trim()
+            : "No rationale provided.",
+    };
+}
+/** Extract the first {...} block (efficient-tier models may wrap JSON in
+ * markdown fences despite instructions to output raw JSON). */
+function extractJsonBlock(raw) {
+    const jsonMatch = raw.match(/\{[\s\S]*\}/);
+    return jsonMatch ? jsonMatch[0] : raw;
+}
+/**
+ * The lenient repair ladder — applied ONLY after a strict `JSON.parse` of the
+ * extracted block has already thrown. Each rung fixes one observed model
+ * failure shape and immediately retries the strict parse; the ladder runs in
+ * cheapest-first order and the content-synthesizing re-quote is always LAST.
+ * Every rung is end-anchored or last-occurrence-anchored and linear-time.
+ * Returns the repaired JSON string (parsable) or null if no rung fits.
+ *
+ * Observed shapes (captured live on deepseek-v4-flash, all previously "unclear
+ * verdict"): illegal backslash escapes (\d written literally), a doubled
+ * closing quote, and unescaped quotes inside the rationale. The trailing
+ * comma is the most common LLM JSON slip in the wild, not (yet) observed here.
+ *
+ * What the ladder deliberately does NOT fix (all fail closed):
+ * single quotes as structure (ambiguous with English apostrophes), glued
+ * multi-object output (never pick one verdict of two), raw newlines inside
+ * strings (indistinguishable from legal pretty-printed whitespace without
+ * parsing), a broken prefix before the rationale anchor, and truncations.
+ */
+function repairVerdictJson(s) {
+    // The ladder is SEQUENTIAL: each rung transforms the previous result and
+    // immediately retries the strict parse. Composing matters — a blob can
+    // carry more than one failure shape (an illegal backslash escape AND a
+    // trailing comma, say), and each rung alone would leave the other broken.
+    let cur = s;
+    // Rung 1 — illegal backslash escapes (\d, \w, \( … become \\d). Legal JSON
+    // escapes (" \\ \/ b f n r t and \uXXXX) are left untouched by the lookahead.
+    const escapedBackslashes = cur.replace(/\\(?!["\\\/bfnrtu])/g, "\\\\");
+    if (escapedBackslashes !== cur) {
+        try {
+            JSON.parse(escapedBackslashes);
+            return escapedBackslashes;
+        }
+        catch {
+            cur = escapedBackslashes;
+        }
+    }
+    // Rung 2 — doubled closing quote before }: anchored to END so a doubled
+    // quote mid-rationale is untouched (the re-quote rung handles that shape).
+    const collapsedQuote = cur.replace(/""(\s*\})$/, '"$1');
+    if (collapsedQuote !== cur) {
+        try {
+            JSON.parse(collapsedQuote);
+            return collapsedQuote;
+        }
+        catch {
+            cur = collapsedQuote;
+        }
+    }
+    // Rung 3 — trailing comma before }: anchored to END so a comma inside a
+    // rationale value ("a, b") can never be stripped.
+    const strippedComma = cur.replace(/,(\s*\})$/, '$1');
+    if (strippedComma !== cur) {
+        try {
+            JSON.parse(strippedComma);
+            return strippedComma;
+        }
+        catch {
+            cur = strippedComma;
+        }
+    }
+    // Rung 4 (last resort, the only rung that synthesizes content) — re-quote
+    // the trailing rationale value. Applies only when the shape is
+    // {…"rationale":"<rest-to-end>}: the prefix before the anchor must carry no
+    // closing brace (rules out prose and glued multi-object output — an earlier
+    // sibling object always leaves a } behind), and the extracted rationale text
+    // must carry no braces either (rules out a glued TAIL). Every " and \ in the
+    // tail is escaped in ONE pass so whatever the model wrote inside the
+    // rationale becomes literal text. Anchor ambiguity resolves to the LAST
+    // "rationale":" occurrence; single pass, no loops.
+    const anchor = cur.lastIndexOf('"rationale":"');
+    if (anchor !== -1) {
+        const prefix = cur.slice(0, anchor);
+        const tail = cur.slice(anchor + '"rationale":"'.length);
+        // The tail must be the trailing value closing the object: non-empty
+        // content, an optional-whitespace + } at the very end.
+        const tailMatch = tail.match(/^(.+?)(\s*\})$/);
+        if (tailMatch && !prefix.includes("}")) {
+            const rawRationale = tailMatch[1].replace(/"+$/, "");
+            if (rawRationale.length > 0 &&
+                !rawRationale.includes("{") &&
+                !rawRationale.includes("}")) {
+                const reQuoted = prefix +
+                    '"rationale":"' +
+                    rawRationale.replace(/["\\]/g, "\\$&") +
+                    '"}';
+                try {
+                    JSON.parse(reQuoted);
+                    return reQuoted;
+                }
+                catch {
+                    /* fail closed */
+                }
+            }
+        }
+    }
+    return null;
+}
+export function parseVerdictDetailed(raw) {
+    const jsonStr = extractJsonBlock(raw);
     try {
-        // Efficient-tier models may wrap JSON in markdown fences despite
-        // instructions to output raw JSON. Extract the first {...} block.
-        const jsonMatch = raw.match(/\{[\s\S]*\}/);
-        const jsonStr = jsonMatch ? jsonMatch[0] : raw;
         const parsed = JSON.parse(jsonStr);
-        const outcome = parsed?.outcome;
-        if (outcome !== "allow" && outcome !== "ask" && outcome !== "deny")
-            return null;
-        const riskLevel = parsed.riskLevel;
-        const validLevels = ["low", "medium", "high", "critical"];
-        return {
-            outcome,
-            riskLevel: typeof riskLevel === "string" && validLevels.includes(riskLevel)
-                ? riskLevel
-                : "medium",
-            rationale: typeof parsed.rationale === "string" && parsed.rationale.trim().length > 0
-                ? parsed.rationale.trim()
-                : "No rationale provided.",
-        };
+        const verdict = validateVerdictObject(parsed);
+        return verdict ? { verdict, repaired: false } : null;
     }
     catch {
-        return null;
+        // Strict parse failed — try the repair ladder on the same extracted block.
+        const repairedJson = repairVerdictJson(jsonStr);
+        if (repairedJson === null)
+            return null;
+        try {
+            const parsed = JSON.parse(repairedJson);
+            const verdict = validateVerdictObject(parsed);
+            return verdict ? { verdict, repaired: true } : null;
+        }
+        catch {
+            return null;
+        }
     }
 }
+/** Strict-shaped convenience wrapper: the verdict, or null. Callers that need
+ * the repaired signal use {@link parseVerdictDetailed}. */
+export function parseVerdict(raw) {
+    return parseVerdictDetailed(raw)?.verdict ?? null;
+}
 // --- /cost subtotal ---
 export function formatGuardianSubtotal(state, limits) {
     if (state.reviews === 0)
@@ -236,8 +361,8 @@ export async function reviewCommand(command, deps) {
             }
             return { verdict: null, error: "empty", cost };
         }
-        const verdict = parseVerdict(output);
-        if (!verdict) {
+        const parsed = parseVerdictDetailed(output);
+        if (!parsed) {
             // Scrubbed + capped so the local sink and Sentry can see the exact
             // failure shape without carrying a raw command or a secret it echoed.
             return {
@@ -247,7 +372,19 @@ export async function reviewCommand(command, deps) {
                 rawOutput: scrubSecrets(output).slice(0, GUARDIAN_RAW_OUTPUT_CAP),
             };
         }
-        return { verdict, cost };
+        if (parsed.repaired) {
+            // The repair ladder salvaged a broken-but-salvageable verdict. The
+            // verdict is real (validation is exactly as strict as the happy path);
+            // capture the pre-repair shape so telemetry can keep watching what the
+            // model is still emitting wrong.
+            return {
+                verdict: parsed.verdict,
+                cost,
+                repaired: true,
+                rawOutput: scrubSecrets(output).slice(0, GUARDIAN_RAW_OUTPUT_CAP),
+            };
+        }
+        return { verdict: parsed.verdict, cost };
     }
     catch (err) {
         // Distinguish the caller aborting (user hit ESC — must NOT be treated as
@@ -275,6 +412,7 @@ export function buildDiagnosticEvent(outcome, opts) {
         outcome,
         ...(opts.durationMs !== undefined ? { durationMs: opts.durationMs } : {}),
         ...(opts.tier !== undefined ? { tier: opts.tier } : {}),
+        ...(opts.repaired ? { repaired: true } : {}),
         ...(opts.rawOutput !== undefined ? { rawOutput: opts.rawOutput } : {}),
     };
     if (opts.debug) {

package/dist/extension/pipeline/personas.js

@@ -183,6 +183,11 @@ Rationale rules:
 Output ONLY a JSON object with this exact shape:
 {"outcome":"allow"|"ask"|"deny","riskLevel":"low"|"medium"|"high"|"critical","rationale":"see rationale rules"}
 
+Your output must parse as strict JSON on the first try:
+- Inside the rationale string, never write a bare double quote. Quote commands, flags, and paths with backticks instead: \`cat ~/.zshrc\`, not "cat ~/.zshrc".
+- A backslash inside a JSON string is legal only as the two-character JSON escapes \\, \\n, \\t, or \\uXXXX, and a quote inside the rationale as \\". Never write regex-style escapes like \\d or \\w literally — write "digit" or "word character" in words instead.
+- Output exactly one JSON object: no trailing comma, no doubled closing quote, no second object, nothing after the closing brace.
+
 Do not output anything else after the JSON. No markdown fences, only the JSON object.`;
 const TITLE_BODY = `You produce a session title from a user's prompt. Output ONLY a concise, sentence-case title of 3-7 words that captures the main topic or goal. Capitalize only the first word and proper nouns. Do not include a ticket code in the title text itself (the caller prepends it). No markdown, no prose, no quotes — just the title on one line.
 

package/dist/mcpCommand.d.ts

@@ -0,0 +1,113 @@
+/**
+ * `yagni mcp …` — configure MCP servers for YAGNI Code, mirroring Claude
+ * Code's CLI surface (add / add-json / remove / get / list /
+ * reset-project-choices / add-from-claude).
+ *
+ * The config module itself lives in pi-extension-yagni (`src/mcp/config.ts`)
+ * so the extension session and this CLI read and write the exact same files
+ * through the exact same code — loaded here by file path, the same pattern as
+ * the session-worktree and headless-go entries. `list` and `get` run real
+ * health-check connections (stdio servers are spawned), so they carry the
+ * same caution Claude Code prints: only run in directories you trust.
+ *
+ * Not implemented (deliberate deviations from Claude Code):
+ *   serve   — the YAGNI backend already exposes an MCP endpoint
+ *   login   — enterprise-IdP only in Claude Code; not applicable
+ */
+export interface McpDeps {
+    cwd?: string;
+    home?: string;
+    env?: NodeJS.ProcessEnv;
+    stdout?: (text: string) => void;
+    stderr?: (text: string) => void;
+    /** Test seam: the extension module to import (defaults to the built copy). */
+    loadMcpModule?: () => Promise<McpCliModule>;
+    /** Test seam: health probe override (defaults to mod.probeServer). */
+    probeServer?: (name: string, config: unknown, opts?: {
+        env?: NodeJS.ProcessEnv;
+    }) => Promise<{
+        status: "connected" | "needs_auth" | "failed";
+        error?: string;
+    }>;
+}
+/** The structural slice of the extension's mcp config surface this file needs. */
+export interface McpCliModule {
+    loadMcpServers(cwd: string, env: NodeJS.ProcessEnv): McpLoadResult;
+    mcpConfigPath(): string;
+    PROJECT_CONFIG_FILENAME: string;
+    writeUserMcpConfig(file: unknown): void;
+    readUserMcpConfig(): {
+        file: unknown;
+        errors: unknown[];
+    };
+    resolveProjectRoot(cwd: string): string;
+    resetProjectChoices(repoRoot: string): {
+        errors: unknown[];
+    };
+    decisionFor(state: unknown, serverName: string): "enabled" | "disabled" | "undecided";
+    readProjectApproval(repoRoot: string): {
+        state: unknown;
+        errors: unknown[];
+    };
+    updateStoredOAuthEntry(serverName: string, config: unknown, mutate: (entry: {
+        clientSecret?: string;
+    }) => void): {
+        errors: unknown[];
+    };
+    revokeTokensOnRemove(serverName: string, config: unknown, deps?: {
+        fetch?: typeof fetch;
+    }): Promise<void>;
+    getStoredOAuthEntry(serverName: string, config: unknown): {
+        clientSecret?: string;
+    } | undefined;
+    probeServer(name: string, config: unknown, opts?: {
+        connectTimeoutMs?: number;
+        env?: NodeJS.ProcessEnv;
+    }): Promise<{
+        status: "connected" | "needs_auth" | "failed";
+        error?: string;
+    }>;
+    /** ${VAR} expansion over a full server config (url, headers, command, args, env values). */
+    expandServerEnv?(config: unknown, env?: NodeJS.ProcessEnv): {
+        config: unknown;
+        missingVars: string[];
+    };
+}
+export interface McpLoadResult {
+    servers: {
+        name: string;
+        scope: "user" | "project" | "local";
+        config: Record<string, unknown>;
+        sourcePath: string;
+    }[];
+    errors: {
+        sourcePath: string;
+        serverName?: string;
+        message: string;
+    }[];
+}
+export declare function resolveMcpConfigPath(): string;
+export interface ParsedMcpArgs {
+    subcommand: string | undefined;
+    name?: string;
+    rest: string[];
+    scope: "local" | "user" | "project";
+    /** Whether -s/--scope appeared explicitly (remove without it acts across scopes). */
+    scopeExplicit: boolean;
+    transport: "stdio" | "sse" | "http";
+    /** Whether -t/--transport appeared explicitly (drives the URL-misread warning). */
+    transportExplicit: boolean;
+    env: Record<string, string>;
+    headers: Record<string, string>;
+    /** Positionals after the subcommand's own first two (stdio command args). */
+    commandArgs: string[];
+    /** OAuth client id (-only). */
+    clientId?: string;
+    /** Whether --client-secret was passed (prompt/env-read the secret). */
+    clientSecret: boolean;
+    /** Fixed loopback callback port. */
+    callbackPort?: number;
+}
+export declare function parseMcpArgs(argv: string[]): ParsedMcpArgs;
+export declare function mcpCommand(args: string[], deps?: McpDeps): Promise<number>;
+//# sourceMappingURL=mcpCommand.d.ts.map