@yagni-app/code 1.0.5 → 1.0.7

package/dist/extension/permissionRules/pathRules.js

@@ -0,0 +1,120 @@
+/**
+ * Path-based permission rules — ported from Claude Code's
+ * filesystem.ts (patternWithRoot + matchingRuleForInput), powered by the
+ * vendored `ignore` package (the gitignore engine) so pattern semantics are
+ * byte-compatible with both git's .gitignore and Claude Code.
+ *
+ * Pattern anchors (Claude Code parity):
+ *   //path   absolute from filesystem root
+ *   ~/path   relative to the user's home directory
+ *   /path    relative to the SETTINGS FILE's directory (user config →
+ *            ~/.yagni-code/, project config → the project root)
+ *   path     relative to the session cwd; a bare filename matches at ANY
+ *            depth (`.env` equals `**` / `.env` in glob terms)
+ *
+ * Compile semantics: all patterns for one (tool-class, behavior) compile
+ * into ONE ordered `ignore` instance — user-source patterns first, then
+ * project — so gitignore's later-line-wins and `!exception` negation work
+ * across rules from both files (Claude Code's matchingRuleForInput builds
+ * one ignore().add(patterns) per root the same way).
+ *
+ * Behavior asymmetry (Claude Code parity): allow rules with a rootless
+ * single-segment pattern anchor at the settings dir (narrow); deny/ask
+ * rules match at any depth (broad — the fail-safe direction).
+ */
+import { homedir } from "node:os";
+import { isAbsolute, posix, sep } from "node:path";
+import ignore from "../vendor/ignore.js";
+/** Which tools a rule's toolName maps to for path purposes. */
+export function pathClassForTool(toolName) {
+    switch (toolName) {
+        case "read":
+        case "grep":
+        case "find":
+        case "ls":
+            return "read";
+        case "edit":
+        case "write":
+            return "edit";
+        default:
+            return null;
+    }
+}
+/**
+ * Split an anchored pattern into (root, relativePattern). Mirrors Claude
+ * Code's patternWithRoot. Project-source `/` anchors at the project root
+ * (passed in); user-source `/` anchors at the YAGNI Code state home
+ * (~/.yagni-code).
+ */
+export function resolvePatternRoot(pattern, source, opts) {
+    if (pattern.startsWith("//")) {
+        return { relativePattern: pattern.slice(1), root: "/", source };
+    }
+    if (pattern.startsWith("~/") || pattern === "~") {
+        const rel = pattern === "~" ? "" : pattern.slice(1);
+        return { relativePattern: rel, root: opts.homeDir ?? homedir(), source };
+    }
+    if (pattern.startsWith("/") && !pattern.startsWith("//")) {
+        const base = source === "project" ? opts.projectRoot : opts.userStateHome;
+        return { relativePattern: pattern, root: base ?? opts.userStateHome, source };
+    }
+    // Rootless: `./x` normalized to `x`; bare names keep any-depth semantics.
+    let normalized = pattern;
+    if (normalized.startsWith("./"))
+        normalized = normalized.slice(2);
+    return { relativePattern: normalized, root: null, source };
+}
+/** Strip a trailing `/**` — the ignore lib treats `path` as dir+children. */
+function forIgnore(relativePattern) {
+    if (relativePattern.endsWith("/**"))
+        return relativePattern.slice(0, -3);
+    return relativePattern;
+}
+/**
+ * Does the (absolute or cwd-relative) target path match the given patterns?
+ * Patterns are tried in order; later patterns win (gitignore semantics) —
+ * so the caller must pass user-source patterns before project-source.
+ */
+export function pathMatches(patterns, targetPath, opts) {
+    if (patterns.length === 0)
+        return false;
+    const target = toPosix(targetPath);
+    const groups = new Map();
+    for (const p of patterns) {
+        const key = p.root;
+        const list = groups.get(key) ?? [];
+        list.push(forIgnore(p.relativePattern));
+        groups.set(key, list);
+    }
+    for (const [root, plist] of groups) {
+        const ig = ignore().add(plist);
+        const base = root ?? opts.cwd;
+        // Lexical normalization BEFORE relativization: `a/../.env` and `a//b`
+        // must resolve against the same relative form the pattern matches, or a
+        // traversal-shaped spelling of a denied path slips past (probe:
+        // `/work/proj/../.env` was NOT caught by `Read(./.env)` without this).
+        // posix.normalize keeps this lexical — no filesystem access, so a
+        // symlinked target still needs its own rule (documented limitation,
+        // same as pi's own tools resolving paths literally).
+        const absTarget = isAbsolute(target) ? posix.normalize(target) : posix.normalize(posix.join(opts.cwd, target));
+        const rel = toPosix(posixRelative(base, absTarget));
+        if (rel.startsWith(".."))
+            continue; // outside this root — not matched
+        // ignore() rejects empty paths; an empty relative means the target IS
+        // the root itself (e.g. `rg` defaulting to "."). Nothing matches that
+        // unless a pattern covers "" — treat as not-matched (safe default: a
+        // cwd-wide read goes through the normal gate, not a deny).
+        if (rel === "" || rel === ".")
+            continue;
+        if (ig.ignores(rel))
+            return true;
+    }
+    return false;
+}
+function toPosix(p) {
+    return sep === "\\" ? p.replaceAll("\\", "/") : p;
+}
+function posixRelative(from, to) {
+    return posix.relative(toPosix(from), toPosix(to));
+}
+//# sourceMappingURL=pathRules.js.map

package/dist/extension/permissionRules/shellRules.d.ts

@@ -0,0 +1,52 @@
+/**
+ * Bash command-rule matching — ported from Claude Code's
+ * shellRuleMatching.ts + the matching half of BashTool/bashPermissions.ts.
+ *
+ * A bash rule's content is one of:
+ *   - exact:   `npm run build`        — matches that exact command string
+ *   - prefix:  `npm install:*`        — `:*` suffix = trailing wildcard
+ *   - wildcard: `git log *`           — `*` anywhere; `*` matches any text
+ *                                         including spaces; `\*` literal
+ *
+ * Security invariants (Claude Code parity, enforced here):
+ *   - compound commands are split on ;, &&, ||, |, and newlines, and EVERY
+ *     subcommand must pass the rule check independently. Wildcards and
+ *     prefixes never run against the raw compound string (`cd /x && rm -rf`
+ *     must not ride a `cd:*` allow).
+ *   - prefix matching requires a word boundary: `ls:*` matches `ls` and
+ *     `ls -la` but never `lsof`.
+ *   - a trailing ` *` wildcard that is the rule's ONLY wildcard also matches
+ *     the bare command (`git log *` matches `git log`).
+ *   - safe wrappers (timeout/time/nice/nohup) are stripped before matching,
+ *     so `Bash(npm install:*)` matches `timeout 10 npm install foo`.
+ *   - for DENY and ASK rules, ALL leading env-var assignments are stripped
+ *     (fixed-point, mirroring Claude's stripAllLeadingEnvVars) so
+ *     `FOO=bar denied_cmd` stays denied. For ALLOW rules only the safe-list
+ *     env prefixes are stripped — an env var must never widen an allow
+ *     (Claude's asymmetry, HackerOne #3543050).
+ */
+export type ShellRuleShape = {
+    type: "exact";
+    command: string;
+} | {
+    type: "prefix";
+    prefix: string;
+} | {
+    type: "wildcard";
+    pattern: string;
+};
+export declare function parseShellRule(ruleContent: string): ShellRuleShape;
+/** Match a command string against a `*`-wildcard pattern. */
+export declare function matchWildcardPattern(pattern: string, command: string): boolean;
+/** Split a command into its subcommand strings (operators are boundaries). */
+export declare function splitSubcommands(command: string): string[];
+/** Strip ALL leading env assignments — deny/ask rules only. Fixed-point. */
+export declare function stripAllEnvVars(command: string): string;
+/**
+ * Does this bash rule match the full command? Mirrors Claude Code's
+ * matchingRulesForInput: compound commands split, every subcommand must
+ * pass, candidates include stripped variants, and deny/ask additionally
+ * try all-env-stripped variants.
+ */
+export declare function shellRuleMatches(ruleContent: string, command: string, behavior: "allow" | "deny" | "ask"): boolean;
+//# sourceMappingURL=shellRules.d.ts.map

package/dist/extension/permissionRules/shellRules.js

@@ -0,0 +1,221 @@
+/**
+ * Bash command-rule matching — ported from Claude Code's
+ * shellRuleMatching.ts + the matching half of BashTool/bashPermissions.ts.
+ *
+ * A bash rule's content is one of:
+ *   - exact:   `npm run build`        — matches that exact command string
+ *   - prefix:  `npm install:*`        — `:*` suffix = trailing wildcard
+ *   - wildcard: `git log *`           — `*` anywhere; `*` matches any text
+ *                                         including spaces; `\*` literal
+ *
+ * Security invariants (Claude Code parity, enforced here):
+ *   - compound commands are split on ;, &&, ||, |, and newlines, and EVERY
+ *     subcommand must pass the rule check independently. Wildcards and
+ *     prefixes never run against the raw compound string (`cd /x && rm -rf`
+ *     must not ride a `cd:*` allow).
+ *   - prefix matching requires a word boundary: `ls:*` matches `ls` and
+ *     `ls -la` but never `lsof`.
+ *   - a trailing ` *` wildcard that is the rule's ONLY wildcard also matches
+ *     the bare command (`git log *` matches `git log`).
+ *   - safe wrappers (timeout/time/nice/nohup) are stripped before matching,
+ *     so `Bash(npm install:*)` matches `timeout 10 npm install foo`.
+ *   - for DENY and ASK rules, ALL leading env-var assignments are stripped
+ *     (fixed-point, mirroring Claude's stripAllLeadingEnvVars) so
+ *     `FOO=bar denied_cmd` stays denied. For ALLOW rules only the safe-list
+ *     env prefixes are stripped — an env var must never widen an allow
+ *     (Claude's asymmetry, HackerOne #3543050).
+ */
+import { shellParse } from "../permission/execPolicy.js";
+/** `npm install:*` → prefix `npm install`; else null. */
+function extractPrefix(ruleContent) {
+    const m = ruleContent.match(/^(.+):\*$/);
+    return m?.[1] ?? null;
+}
+/** Any unescaped `*` that is not the `:*` trailing legacy form? */
+function hasWildcards(pattern) {
+    if (pattern.endsWith(":*"))
+        return false;
+    for (let i = 0; i < pattern.length; i++) {
+        if (pattern[i] !== "*")
+            continue;
+        let backslashes = 0;
+        let j = i - 1;
+        while (j >= 0 && pattern[j] === "\\") {
+            backslashes++;
+            j--;
+        }
+        if (backslashes % 2 === 0)
+            return true;
+    }
+    return false;
+}
+export function parseShellRule(ruleContent) {
+    const prefix = extractPrefix(ruleContent);
+    if (prefix !== null)
+        return { type: "prefix", prefix };
+    if (hasWildcards(ruleContent))
+        return { type: "wildcard", pattern: ruleContent };
+    return { type: "exact", command: ruleContent };
+}
+// --- Wildcard → regex (Claude Code shellRuleMatching.ts) ---
+const ESCAPED_STAR = "\x00ESCAPED_STAR\x00";
+const ESCAPED_BACKSLASH = "\x00ESCAPED_BACKSLASH\x00";
+/** Match a command string against a `*`-wildcard pattern. */
+export function matchWildcardPattern(pattern, command) {
+    const trimmed = pattern.trim();
+    let processed = "";
+    let i = 0;
+    while (i < trimmed.length) {
+        const ch = trimmed[i];
+        if (ch === "\\" && i + 1 < trimmed.length) {
+            const next = trimmed[i + 1];
+            if (next === "*") {
+                processed += ESCAPED_STAR;
+                i += 2;
+                continue;
+            }
+            if (next === "\\") {
+                processed += ESCAPED_BACKSLASH;
+                i += 2;
+                continue;
+            }
+        }
+        processed += ch;
+        i++;
+    }
+    const escaped = processed.replace(/[.+?^${}()|[\]\\'"]/g, "\\$&");
+    const withWildcards = escaped.replace(/\*/g, ".*");
+    let regexPattern = withWildcards
+        .replace(new RegExp(ESCAPED_STAR, "g"), "\\*")
+        .replace(new RegExp(ESCAPED_BACKSLASH, "g"), "\\\\");
+    // A trailing ` *` wildcard that is the ONLY wildcard also matches the bare
+    // command — aligns `git log *` with `git log:*` prefix semantics.
+    const starCount = (processed.match(/\*/g) ?? []).length;
+    if (regexPattern.endsWith(" .*") && starCount === 1) {
+        regexPattern = regexPattern.slice(0, -3) + "( .*)?";
+    }
+    // `s` (dotAll): `*` spans embedded newlines within a single subcommand.
+    return new RegExp(`^${regexPattern}$`, "s").test(command);
+}
+// --- Command splitting / stripping ---
+/** Split a command into its subcommand strings (operators are boundaries). */
+export function splitSubcommands(command) {
+    const tokens = shellParse(command);
+    const segments = [];
+    let current = [];
+    const flush = () => {
+        if (current.length > 0) {
+            segments.push(current.join(" "));
+            current = [];
+        }
+    };
+    for (const t of tokens) {
+        if (typeof t === "object" && ("op" in t) && (t.op === "pipe" || t.op === "and" || t.op === "or" || t.op === "semi" || t.op === "substitution")) {
+            flush();
+            continue;
+        }
+        // Redirects/background are constructs, not boundaries — a subcommand
+        // carrying them is matched WITH the construct (the exec policy's
+        // construct floor handles the safety side; for rules we keep the segment).
+        current.push(typeof t === "string" ? t : renderOp(t));
+    }
+    flush();
+    return segments;
+}
+function renderOp(t) {
+    if (t.op === "redirect" && "target" in t)
+        return `>${t.target}`;
+    return "";
+}
+/**
+ * Safe wrappers stripped before rule matching (Claude Code parity):
+ * timeout <n>, time, nice, nohup. Allow rules ALSO strip safe env prefixes
+ * (NODE_ENV=test go build). Deny/ask use stripAllEnvVars instead.
+ */
+const SAFE_WRAPPER_RE = /^(?:timeout\s+\d+(?:\.\d+)?[a-z]*)?/;
+function stripSafeWrappers(cmd) {
+    let s = cmd.trim();
+    for (;;) {
+        const next = s
+            .replace(/^timeout\s+\S+\s+/, "")
+            .replace(/^(?:time|nice|nohup)\s+/, "")
+            .replace(SAFE_WRAPPER_RE, "");
+        if (next === s)
+            return s;
+        s = next.trim();
+    }
+}
+const SAFE_ENV_VARS = new Set([
+    "NODE_ENV", "CI", "FORCE_COLOR", "NO_COLOR", "DEBUG", "VERBOSE",
+    "GOOS", "GOARCH", "CGO_ENABLED", "PWD", "LANG", "LC_ALL", "TERM",
+]);
+function stripSafeEnvPrefixes(cmd) {
+    let s = cmd.trim();
+    for (;;) {
+        const m = s.match(/^([A-Za-z_][A-Za-z0-9_]*)=(\S*)\s+/);
+        if (!m || !SAFE_ENV_VARS.has(m[1]))
+            return s;
+        s = s.slice(m[0].length).trim();
+    }
+}
+/** Broader env-assignment pattern for deny/ask stripping (Claude parity). */
+const ENV_VAR_PATTERN = /^([A-Za-z_][A-Za-z0-9_]*(?:\[[^\]]*\])?)\+?=(?:'[^'\n\r]*'|"(?:\\.|[^"$`\\\n\r])*"|\\.|[^ \t\n\r$`;|&()<>\\'"])*[ \t]+/;
+/** Strip ALL leading env assignments — deny/ask rules only. Fixed-point. */
+export function stripAllEnvVars(command) {
+    let stripped = command.trim();
+    for (;;) {
+        const m = stripped.match(ENV_VAR_PATTERN);
+        if (!m)
+            return stripped;
+        stripped = stripped.slice(m[0].length).trim();
+    }
+}
+/** Prepare a subcommand for matching: candidate strings to try. */
+function candidatesFor(segment, behavior) {
+    const stripped = stripSafeWrappers(stripSafeEnvPrefixes(segment));
+    const base = [segment, stripped];
+    if (behavior === "deny" || behavior === "ask") {
+        base.push(stripAllEnvVars(stripped));
+        // fixed-point: env prefix may reveal another wrapper (`nohup FOO=bar …`)
+        base.push(stripSafeWrappers(stripAllEnvVars(stripped)));
+    }
+    return [...new Set(base.filter((c) => c.length > 0))];
+}
+/** Match one prepared candidate against one parsed rule. */
+function matchOne(rule, candidate) {
+    switch (rule.type) {
+        case "exact":
+            return rule.command === candidate;
+        case "prefix":
+            if (candidate === rule.prefix)
+                return true;
+            return candidate.startsWith(rule.prefix + " ");
+        case "wildcard":
+            return matchWildcardPattern(rule.pattern, candidate);
+    }
+}
+/**
+ * Does this bash rule match the full command? Mirrors Claude Code's
+ * matchingRulesForInput: compound commands split, every subcommand must
+ * pass, candidates include stripped variants, and deny/ask additionally
+ * try all-env-stripped variants.
+ */
+export function shellRuleMatches(ruleContent, command, behavior) {
+    const rule = parseShellRule(ruleContent);
+    const trimmed = command.trim();
+    if (!trimmed)
+        return false;
+    const segments = splitSubcommands(trimmed);
+    if (segments.length === 0)
+        return false;
+    // Compound: EVERY segment must match (a deny rule needs only ONE matching
+    // segment to deny the whole; an allow rule must clear every segment).
+    if (segments.length > 1) {
+        if (behavior === "allow") {
+            return segments.every((seg) => candidatesFor(seg, behavior).some((c) => matchOne(rule, c)));
+        }
+        return segments.some((seg) => candidatesFor(seg, behavior).some((c) => matchOne(rule, c)));
+    }
+    return candidatesFor(segments[0], behavior).some((c) => matchOne(rule, c));
+}
+//# sourceMappingURL=shellRules.js.map

package/dist/extension/pipeline/invocation.d.ts

@@ -66,15 +66,12 @@ export declare function buildStageInvocation(stage: PipelineStage, ctx: {
  * `userChoseProvider` guard so a passthrough that already chose a provider is
  * left untouched.
  *
- * `otelExtensionPath` (absent on a non-exporting launch) additionally loads
- * pi-otel so child LLM spend is traced too — stage children are the bulk of a
- * /go run's cost, and an OTel export that misses them undercounts. The path
- * arrives via `YAGNI_OTEL_EXTENSION_PATH` from the launcher's gate (see the
- * CLI's otel.ts); the capture-mode and endpoint env rides the inherited env.
+ * OTel export rides the inherited env (the launcher's `YAGNI_OTEL_EXPORT`
+ * gate plus the OTLP variables): our extension exports child LLM spend too,
+ * so stage children — the bulk of a /go run's cost — are never undercounted.
  */
 export declare function groundedChildArgv(stageArgv: string[], opts: {
     piCli: string;
     extensionPath: string;
-    otelExtensionPath?: string;
 }): string[];
 //# sourceMappingURL=invocation.d.ts.map

package/dist/extension/pipeline/invocation.js

@@ -85,11 +85,9 @@ export function buildStageInvocation(stage, ctx) {
  * `userChoseProvider` guard so a passthrough that already chose a provider is
  * left untouched.
  *
- * `otelExtensionPath` (absent on a non-exporting launch) additionally loads
- * pi-otel so child LLM spend is traced too — stage children are the bulk of a
- * /go run's cost, and an OTel export that misses them undercounts. The path
- * arrives via `YAGNI_OTEL_EXTENSION_PATH` from the launcher's gate (see the
- * CLI's otel.ts); the capture-mode and endpoint env rides the inherited env.
+ * OTel export rides the inherited env (the launcher's `YAGNI_OTEL_EXPORT`
+ * gate plus the OTLP variables): our extension exports child LLM spend too,
+ * so stage children — the bulk of a /go run's cost — are never undercounted.
  */
 export function groundedChildArgv(stageArgv, opts) {
     const userChoseProvider = stageArgv.includes("--provider");
@@ -97,7 +95,6 @@ export function groundedChildArgv(stageArgv, opts) {
         opts.piCli,
         "-e",
         opts.extensionPath,
-        ...(opts.otelExtensionPath ? ["-e", opts.otelExtensionPath] : []),
         ...(userChoseProvider ? [] : ["--provider", "yagni"]),
         ...stageArgv,
     ];

package/dist/extension/pipeline/personas.js

@@ -183,6 +183,11 @@ Rationale rules:
 Output ONLY a JSON object with this exact shape:
 {"outcome":"allow"|"ask"|"deny","riskLevel":"low"|"medium"|"high"|"critical","rationale":"see rationale rules"}
 
+Your output must parse as strict JSON on the first try:
+- Inside the rationale string, never write a bare double quote. Quote commands, flags, and paths with backticks instead: \`cat ~/.zshrc\`, not "cat ~/.zshrc".
+- A backslash inside a JSON string is legal only as the two-character JSON escapes \\, \\n, \\t, or \\uXXXX, and a quote inside the rationale as \\". Never write regex-style escapes like \\d or \\w literally — write "digit" or "word character" in words instead.
+- Output exactly one JSON object: no trailing comma, no doubled closing quote, no second object, nothing after the closing brace.
+
 Do not output anything else after the JSON. No markdown fences, only the JSON object.`;
 const TITLE_BODY = `You produce a session title from a user's prompt. Output ONLY a concise, sentence-case title of 3-7 words that captures the main topic or goal. Capitalize only the first word and proper nouns. Do not include a ticket code in the title text itself (the caller prepends it). No markdown, no prose, no quotes — just the title on one line.
 

package/dist/extension/pipeline/runner.d.ts

@@ -32,7 +32,6 @@ export interface RunStageDeps {
     resolveChild?: () => {
         piCli: string;
         extensionPath: string;
-        otelExtensionPath?: string;
     };
     /** Optional environment for spawned child stages. Defaults to Node's inherited env. */
     env?: NodeJS.ProcessEnv;

package/dist/extension/pipeline/runner.js

@@ -62,18 +62,14 @@ async function defaultWritePrompt(body) {
  * Default child resolution: the parent process IS pi (so `process.argv[1]` is
  * pi's cli), and our compiled extension entry sits one dir up from this module.
  *
- * `otelExtensionPath` comes from `YAGNI_OTEL_EXTENSION_PATH`, set by the
- * launcher only when an OTLP endpoint is configured (see the CLI's otel.ts) —
- * children then load pi-otel so their LLM spend is traced. Guarded with
- * existsSync so a stale env value degrades to an untraced child, never a
- * child that fails to boot.
+ * OTel export needs no extra child argv: the extension itself exports when
+ * the inherited env carries the launcher's `YAGNI_OTEL_EXPORT` gate (see the
+ * CLI's otel.ts), so stage children's LLM spend is traced automatically.
  */
 function defaultResolveChild() {
     const piCli = process.argv[1] ?? "pi";
     const extensionPath = fileURLToPath(new URL("../index.js", import.meta.url));
-    const otelPath = process.env.YAGNI_OTEL_EXTENSION_PATH;
-    const otelExtensionPath = otelPath && fs.existsSync(otelPath) ? otelPath : undefined;
-    return { piCli, extensionPath, ...(otelExtensionPath ? { otelExtensionPath } : {}) };
+    return { piCli, extensionPath };
 }
 const EMPTY_USAGE = { input: 0, output: 0, cacheRead: 0, cacheWrite: 0, cost: 0, turns: 0 };
 /** Truncate to PER_TASK_OUTPUT_CAP bytes, never exceeding the cap. */
@@ -124,12 +120,8 @@ export async function runStage(stage, ctx, deps) {
             lens: ctx.lens,
             ...(tierCap ? { tierCap } : {}),
         });
-        const { piCli, extensionPath, otelExtensionPath } = resolveChild();
-        const argv = groundedChildArgv(passthrough, {
-            piCli,
-            extensionPath,
-            ...(otelExtensionPath ? { otelExtensionPath } : {}),
-        });
+        const { piCli, extensionPath } = resolveChild();
+        const argv = groundedChildArgv(passthrough, { piCli, extensionPath });
         // Fold events into a fixed-size accumulator as they stream — never retain
         // the full array (that OOMs on a verbose stage; YAG-317 follow-up).
         const acc = newEventAccumulator();

package/dist/extension/plugins/inventory.d.ts

@@ -0,0 +1,88 @@
+/**
+ * The session's view of Claude Code plugins, and how a mid-session change
+ * reaches pi without a restart.
+ *
+ * The launcher (yagni-code-cli) owns discovery, trust, and the ledger. This
+ * module only talks to it: `yagni plugin inventory --json` (via
+ * `YAGNI_CLI_PATH`) returns what would load for the cwd right now. Reload is
+ * pi's own `/reload` flow: before calling it we rewrite this process's env so
+ * the re-created extension runtime sees the fresh MCP payload and agent dirs,
+ * and `resources_discover` hands pi the skill/prompt paths of plugins that
+ * were not in the launch argv (see panel.ts). Everything is fail-soft.
+ */
+import { type PluginMcpEnvEntry } from "../mcp/config.js";
+/** Launcher → extension: the yagni CLI entry to run `plugin …` with. */
+export declare const CLI_PATH_ENV = "YAGNI_CLI_PATH";
+/** Launcher → extension: `name@marketplace` keys wired through argv at launch. */
+export declare const PLUGIN_KEYS_ENV = "YAGNI_CLAUDE_PLUGIN_KEYS";
+/** Set by /reload-plugins before pi reloads: the fresh inventory (JSON). */
+export declare const INVENTORY_ENV = "YAGNI_CLAUDE_PLUGIN_INVENTORY";
+export interface InventoryPlugin {
+    key: string;
+    name: string;
+    origin: "yagni" | "claude-code" | "repo-marketplace";
+    version: string | null;
+    root: string;
+    gated: boolean;
+    skillPaths: string[];
+    commandPaths: string[];
+    agentDirs: string[];
+    mcpServers: string[];
+    unsupported: string[];
+}
+export interface PluginInventory {
+    plugins: InventoryPlugin[];
+    mcp: PluginMcpEnvEntry[];
+    pendingTrust: string[];
+    agentDirs: string[];
+}
+export interface CliResult {
+    code: number;
+    stdout: string;
+    stderr: string;
+}
+export type CliRunner = (args: string[], opts: {
+    cliPath: string;
+    cwd: string;
+    env: NodeJS.ProcessEnv;
+}) => Promise<CliResult>;
+export declare const defaultCliRunner: CliRunner;
+export declare function cliPath(env: NodeJS.ProcessEnv): string | null;
+export declare function launchKeys(env: NodeJS.ProcessEnv): Set<string>;
+/** The inventory recorded by the last /reload-plugins in this process, if any. */
+export declare function storedInventory(env: NodeJS.ProcessEnv): PluginInventory | null;
+export declare function parseInventory(value: unknown): PluginInventory;
+export declare function fetchInventory(opts: {
+    cwd: string;
+    env: NodeJS.ProcessEnv;
+    runCli?: CliRunner;
+}): Promise<PluginInventory>;
+/**
+ * The plugins the session knows about right now: launch-time keys plus
+ * anything a previous /reload-plugins in this process brought in.
+ */
+export declare function knownKeys(env: NodeJS.ProcessEnv): Set<string>;
+export interface ReloadPlan {
+    added: InventoryPlugin[];
+    removed: string[];
+    /** Env values to set on this process before pi reloads. */
+    env: Record<string, string | undefined>;
+}
+/**
+ * Diff a fresh inventory against what the session already has, and the env
+ * rewrite that makes the reloaded runtime pick the fresh state up: the MCP
+ * payload and agent dirs are re-read by the extension on startup, and the
+ * inventory itself feeds `resources_discover` for skills/prompts.
+ */
+export declare function planReload(inventory: PluginInventory, env: NodeJS.ProcessEnv): ReloadPlan;
+export declare function applyEnv(target: NodeJS.ProcessEnv, values: Record<string, string | undefined>): void;
+/**
+ * Skill/prompt paths pi does not already hold through the launch argv: the
+ * plugins that arrived via /reload-plugins. Returned from `resources_discover`
+ * on every reason so a `/new` after a reload keeps them too.
+ */
+export declare function discoverPaths(env: NodeJS.ProcessEnv): {
+    skillPaths: string[];
+    promptPaths: string[];
+};
+//# sourceMappingURL=inventory.d.ts.map