@yagni-app/code 1.0.5 → 1.0.7

package/dist/extension/plugins/inventory.js

@@ -0,0 +1,144 @@
+/**
+ * The session's view of Claude Code plugins, and how a mid-session change
+ * reaches pi without a restart.
+ *
+ * The launcher (yagni-code-cli) owns discovery, trust, and the ledger. This
+ * module only talks to it: `yagni plugin inventory --json` (via
+ * `YAGNI_CLI_PATH`) returns what would load for the cwd right now. Reload is
+ * pi's own `/reload` flow: before calling it we rewrite this process's env so
+ * the re-created extension runtime sees the fresh MCP payload and agent dirs,
+ * and `resources_discover` hands pi the skill/prompt paths of plugins that
+ * were not in the launch argv (see panel.ts). Everything is fail-soft.
+ */
+import { execFile } from "node:child_process";
+import { delimiter } from "node:path";
+import { PLUGIN_MCP_ENV } from "../mcp/config.js";
+import { CLAUDE_AGENT_DIRS_ENV } from "../subagents.js";
+/** Launcher → extension: the yagni CLI entry to run `plugin …` with. */
+export const CLI_PATH_ENV = "YAGNI_CLI_PATH";
+/** Launcher → extension: `name@marketplace` keys wired through argv at launch. */
+export const PLUGIN_KEYS_ENV = "YAGNI_CLAUDE_PLUGIN_KEYS";
+/** Set by /reload-plugins before pi reloads: the fresh inventory (JSON). */
+export const INVENTORY_ENV = "YAGNI_CLAUDE_PLUGIN_INVENTORY";
+export const defaultCliRunner = (args, opts) => new Promise((resolve) => {
+    execFile(process.execPath, [opts.cliPath, ...args], { cwd: opts.cwd, env: { ...opts.env, YAGNI_DISABLE_UPDATE_CHECK: "1" }, timeout: 120_000, maxBuffer: 8 * 1024 * 1024 }, (err, stdout, stderr) => {
+        const code = err && typeof err.code === "number" ? (err.code) : err ? 1 : 0;
+        resolve({ code, stdout: String(stdout ?? ""), stderr: String(stderr ?? (err?.message ?? "")) });
+    });
+});
+export function cliPath(env) {
+    const value = env[CLI_PATH_ENV];
+    return value && value.length > 0 ? value : null;
+}
+export function launchKeys(env) {
+    const raw = env[PLUGIN_KEYS_ENV];
+    return new Set(raw ? raw.split(delimiter).filter(Boolean) : []);
+}
+/** The inventory recorded by the last /reload-plugins in this process, if any. */
+export function storedInventory(env) {
+    const raw = env[INVENTORY_ENV];
+    if (!raw)
+        return null;
+    try {
+        return parseInventory(JSON.parse(raw));
+    }
+    catch {
+        return null;
+    }
+}
+export function parseInventory(value) {
+    if (!value || typeof value !== "object")
+        throw new Error("inventory is not an object");
+    const v = value;
+    const plugins = Array.isArray(v.plugins) ? v.plugins.filter((p) => !!p && typeof p === "object" && typeof p.key === "string") : [];
+    return {
+        plugins: plugins.map((p) => ({
+            key: p.key,
+            name: typeof p.name === "string" ? p.name : p.key,
+            origin: p.origin === "yagni" || p.origin === "repo-marketplace" ? p.origin : "claude-code",
+            version: typeof p.version === "string" ? p.version : null,
+            root: typeof p.root === "string" ? p.root : "",
+            gated: p.gated === true,
+            skillPaths: stringList(p.skillPaths),
+            commandPaths: stringList(p.commandPaths),
+            agentDirs: stringList(p.agentDirs),
+            mcpServers: stringList(p.mcpServers),
+            unsupported: stringList(p.unsupported),
+        })),
+        mcp: Array.isArray(v.mcp) ? v.mcp : [],
+        pendingTrust: stringList(v.pendingTrust),
+        agentDirs: stringList(v.agentDirs),
+    };
+}
+function stringList(value) {
+    return Array.isArray(value) ? value.filter((s) => typeof s === "string") : [];
+}
+export async function fetchInventory(opts) {
+    const path = cliPath(opts.env);
+    if (!path)
+        throw new Error("This session was not started by the yagni launcher (YAGNI_CLI_PATH is unset); run `yagni plugin …` in a terminal instead.");
+    const result = await (opts.runCli ?? defaultCliRunner)(["plugin", "inventory", "--json"], { cliPath: path, cwd: opts.cwd, env: opts.env });
+    if (result.code !== 0)
+        throw new Error(result.stderr.trim() || `yagni plugin inventory exited ${result.code}`);
+    return parseInventory(JSON.parse(result.stdout));
+}
+/**
+ * The plugins the session knows about right now: launch-time keys plus
+ * anything a previous /reload-plugins in this process brought in.
+ */
+export function knownKeys(env) {
+    const keys = launchKeys(env);
+    for (const p of storedInventory(env)?.plugins ?? [])
+        keys.add(p.key);
+    return keys;
+}
+/**
+ * Diff a fresh inventory against what the session already has, and the env
+ * rewrite that makes the reloaded runtime pick the fresh state up: the MCP
+ * payload and agent dirs are re-read by the extension on startup, and the
+ * inventory itself feeds `resources_discover` for skills/prompts.
+ */
+export function planReload(inventory, env) {
+    const before = knownKeys(env);
+    const now = new Set(inventory.plugins.map((p) => p.key));
+    const added = inventory.plugins.filter((p) => !before.has(p.key));
+    const removed = [...before].filter((key) => !now.has(key));
+    return {
+        added,
+        removed,
+        env: {
+            [PLUGIN_MCP_ENV]: inventory.mcp.length > 0 ? JSON.stringify(inventory.mcp) : undefined,
+            [CLAUDE_AGENT_DIRS_ENV]: inventory.agentDirs.length > 0 ? inventory.agentDirs.join(delimiter) : undefined,
+            [INVENTORY_ENV]: JSON.stringify(inventory),
+        },
+    };
+}
+export function applyEnv(target, values) {
+    for (const [key, value] of Object.entries(values)) {
+        if (value === undefined)
+            delete target[key];
+        else
+            target[key] = value;
+    }
+}
+/**
+ * Skill/prompt paths pi does not already hold through the launch argv: the
+ * plugins that arrived via /reload-plugins. Returned from `resources_discover`
+ * on every reason so a `/new` after a reload keeps them too.
+ */
+export function discoverPaths(env) {
+    const inventory = storedInventory(env);
+    if (!inventory)
+        return { skillPaths: [], promptPaths: [] };
+    const launched = launchKeys(env);
+    const skillPaths = [];
+    const promptPaths = [];
+    for (const plugin of inventory.plugins) {
+        if (launched.has(plugin.key))
+            continue;
+        skillPaths.push(...plugin.skillPaths);
+        promptPaths.push(...plugin.commandPaths);
+    }
+    return { skillPaths, promptPaths };
+}
+//# sourceMappingURL=inventory.js.map

package/dist/extension/plugins/panel.d.ts

@@ -0,0 +1,45 @@
+/**
+ * `/plugin` and `/reload-plugins` — Claude Code marketplace plugins managed
+ * from inside a session.
+ *
+ * `/plugin` mirrors Claude Code's panel: the installed inventory (origin,
+ * version, what loads, what is not bridged), the marketplace catalog with
+ * one-keystroke install, and per-plugin uninstall/enable/disable. Every
+ * mutation runs the launcher's `yagni plugin …` (the single owner of the
+ * ledger, trust, and discovery) and then reloads.
+ *
+ * `/reload-plugins` is pi's own `/reload` with the plugin state refreshed
+ * first: MCP servers and agents re-read their env on the new runtime, and
+ * skills/commands of plugins that were not in the launch argv reach pi
+ * through `resources_discover`. Removed plugins stop contributing MCP servers
+ * and agents at once; their skills/commands stay until a restart, and the
+ * summary says so.
+ */
+import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
+import { type CliRunner, type InventoryPlugin, type PluginInventory, storedInventory } from "./inventory.js";
+export type PluginCliRunner = CliRunner;
+export interface PluginPanelDeps {
+    env?: NodeJS.ProcessEnv;
+    runCli?: CliRunner;
+}
+export declare function describePlugin(p: InventoryPlugin): string;
+export declare function renderInventory(inventory: PluginInventory, env: NodeJS.ProcessEnv): string;
+export declare function renderReloadSummary(added: InventoryPlugin[], removed: string[]): string;
+/** Wire /plugin, /reload-plugins, and the resources_discover contribution. */
+export declare function registerPluginPanel(pi: ExtensionAPI, deps?: PluginPanelDeps): void;
+export interface CatalogMarketplace {
+    name: string;
+    plugins: {
+        name: string;
+        version: string | null;
+        installable: boolean;
+    }[];
+}
+/**
+ * Parse `yagni plugin list --available` text (the CLI's stable, tested
+ * shape: `<marketplace>:` headers, then `  <name>  v<ver>  [flags]` lines).
+ */
+export declare function parseCatalog(text: string): CatalogMarketplace[];
+/** Exported for tests: the current stored inventory, if a reload happened. */
+export { storedInventory };
+//# sourceMappingURL=panel.d.ts.map

package/dist/extension/plugins/panel.js

@@ -0,0 +1,293 @@
+/**
+ * `/plugin` and `/reload-plugins` — Claude Code marketplace plugins managed
+ * from inside a session.
+ *
+ * `/plugin` mirrors Claude Code's panel: the installed inventory (origin,
+ * version, what loads, what is not bridged), the marketplace catalog with
+ * one-keystroke install, and per-plugin uninstall/enable/disable. Every
+ * mutation runs the launcher's `yagni plugin …` (the single owner of the
+ * ledger, trust, and discovery) and then reloads.
+ *
+ * `/reload-plugins` is pi's own `/reload` with the plugin state refreshed
+ * first: MCP servers and agents re-read their env on the new runtime, and
+ * skills/commands of plugins that were not in the launch argv reach pi
+ * through `resources_discover`. Removed plugins stop contributing MCP servers
+ * and agents at once; their skills/commands stay until a restart, and the
+ * summary says so.
+ */
+import { applyEnv, cliPath, defaultCliRunner, discoverPaths, fetchInventory, planReload, storedInventory, } from "./inventory.js";
+const USAGE = [
+    "/plugin                       Browse installed plugins and marketplaces.",
+    "/plugin list                  Show what loads here.",
+    "/plugin install <plugin>[@marketplace] [-s user|project]",
+    "/plugin uninstall <plugin>    (also: enable, disable, update [plugin])",
+    "/plugin marketplace add <owner/repo | git-url | path>   (also: list, update, remove)",
+    "/reload-plugins               Apply plugin changes without restarting.",
+].join("\n");
+const MUTATING = new Set(["install", "add", "uninstall", "remove", "enable", "disable", "update"]);
+export function describePlugin(p) {
+    const parts = [];
+    if (p.skillPaths.length)
+        parts.push(`${p.skillPaths.length} skill dir${p.skillPaths.length === 1 ? "" : "s"}`);
+    if (p.commandPaths.length)
+        parts.push(`${p.commandPaths.length} command dir${p.commandPaths.length === 1 ? "" : "s"}`);
+    if (p.agentDirs.length)
+        parts.push(`${p.agentDirs.length} agent dir${p.agentDirs.length === 1 ? "" : "s"}`);
+    if (p.mcpServers.length)
+        parts.push(`MCP: ${p.mcpServers.join(", ")}`);
+    const origin = p.origin === "yagni" ? "installed via yagni" : p.origin === "claude-code" ? "mirrored from Claude Code" : "from this repo's marketplace";
+    const lines = [`${p.key}${p.version ? `  v${p.version}` : ""}  ${origin}`, `  ${parts.length ? parts.join(" · ") : "nothing loadable"}`];
+    if (p.unsupported.length)
+        lines.push(`  not bridged: ${p.unsupported.join(", ")}`);
+    return lines.join("\n");
+}
+export function renderInventory(inventory, env) {
+    const lines = [];
+    if (inventory.plugins.length === 0) {
+        lines.push("No plugins load here.");
+        lines.push("Add a marketplace with `/plugin marketplace add <owner/repo | git-url | path>`, then `/plugin install <plugin>`.");
+    }
+    else {
+        lines.push(`Plugins (${inventory.plugins.length}):`);
+        for (const p of inventory.plugins)
+            lines.push(describePlugin(p));
+    }
+    if (inventory.pendingTrust.length > 0) {
+        lines.push(`Held back until this folder is trusted: ${inventory.pendingTrust.join(", ")}`);
+    }
+    const stale = staleSince(inventory, env);
+    if (stale.added.length > 0 || stale.removed.length > 0) {
+        lines.push(`Not yet applied to this session: ${[...stale.added.map((k) => `+${k}`), ...stale.removed.map((k) => `-${k}`)].join(", ")} — run /reload-plugins.`);
+    }
+    return lines.join("\n");
+}
+/** Plugins the inventory has that the session does not (and vice versa). */
+function staleSince(inventory, env) {
+    const plan = planReload(inventory, env);
+    return { added: plan.added.map((p) => p.key), removed: plan.removed };
+}
+export function renderReloadSummary(added, removed) {
+    const lines = [];
+    if (added.length === 0 && removed.length === 0) {
+        lines.push("Plugins reloaded — nothing changed since launch.");
+        return lines.join("\n");
+    }
+    if (added.length > 0) {
+        lines.push(`Loaded: ${added.map((p) => p.key).join(", ")}`);
+        const mcp = added.flatMap((p) => p.mcpServers);
+        if (mcp.length > 0)
+            lines.push(`  MCP servers connecting: ${mcp.join(", ")} (see /mcp)`);
+        const commands = added.filter((p) => p.commandPaths.length > 0).map((p) => p.key);
+        if (commands.length > 0)
+            lines.push(`  Commands and skills from ${commands.join(", ")} are available now.`);
+    }
+    if (removed.length > 0) {
+        lines.push(`Removed: ${removed.join(", ")}`);
+        lines.push("  Their MCP servers and agents are gone now; skills and commands stay until you restart (`yagni -c` keeps this conversation).");
+    }
+    return lines.join("\n");
+}
+/** Wire /plugin, /reload-plugins, and the resources_discover contribution. */
+export function registerPluginPanel(pi, deps = {}) {
+    const env = deps.env ?? process.env;
+    const runCli = deps.runCli ?? defaultCliRunner;
+    // Skills/prompts of plugins that arrived via /reload-plugins: pi re-runs
+    // this on every reload and session start, so they persist for the process.
+    pi.on("resources_discover", async () => discoverPaths(env));
+    async function runPlugin(args, cwd, ui) {
+        const path = cliPath(env);
+        if (!path) {
+            ui.notify("Plugin management needs the yagni launcher (YAGNI_CLI_PATH is unset in this session). Run `yagni plugin …` in a terminal.", "warning");
+            return false;
+        }
+        const result = await runCli(["plugin", ...args], { cliPath: path, cwd, env });
+        const out = result.stdout.trim();
+        const err = result.stderr.trim();
+        if (result.code === 0) {
+            if (out)
+                ui.notify(out, "info");
+            if (err)
+                ui.notify(err, "warning");
+            return true;
+        }
+        ui.notify(err || out || `yagni plugin ${args.join(" ")} failed (exit ${result.code})`, "error");
+        return false;
+    }
+    async function reload(ctx) {
+        let inventory;
+        try {
+            inventory = await fetchInventory({ cwd: ctx.cwd, env, runCli });
+        }
+        catch (err) {
+            ctx.ui.notify(`Could not read the plugin inventory — ${err instanceof Error ? err.message : String(err)}`, "error");
+            return;
+        }
+        const plan = planReload(inventory, env);
+        applyEnv(env, plan.env);
+        ctx.ui.notify(renderReloadSummary(plan.added, plan.removed), "info");
+        // Treat reload as terminal for this handler (pi docs): the runtime that
+        // registered us is torn down and re-created from the rewritten env.
+        await ctx.reload();
+    }
+    async function listing(ctx) {
+        try {
+            const inventory = await fetchInventory({ cwd: ctx.cwd, env, runCli });
+            return inventory;
+        }
+        catch (err) {
+            ctx.ui.notify(err instanceof Error ? err.message : String(err), "error");
+            return null;
+        }
+    }
+    pi.registerCommand("reload-plugins", {
+        description: "Apply plugin installs/removals to this session without restarting.",
+        handler: async (_args, ctx) => {
+            await reload(ctx);
+        },
+    });
+    pi.registerCommand("plugin", {
+        description: "Manage Claude Code plugins: browse marketplaces, install, uninstall, enable/disable.",
+        handler: async (args, rawCtx) => {
+            const ctx = rawCtx;
+            const sub = args.trim().split(/\s+/).filter(Boolean);
+            const [verb] = sub;
+            if (verb === "help" || verb === "--help" || verb === "-h") {
+                ctx.ui.notify(USAGE, "info");
+                return;
+            }
+            if (verb === "list" || (!verb && !ctx.hasUI)) {
+                const inventory = await listing(ctx);
+                if (inventory)
+                    ctx.ui.notify(renderInventory(inventory, env), "info");
+                return;
+            }
+            if (!verb) {
+                await interactive(ctx);
+                return;
+            }
+            if (verb === "reload") {
+                await reload(ctx);
+                return;
+            }
+            // Everything else is the CLI's grammar verbatim (install, uninstall,
+            // enable, disable, update, marketplace …); mutations reload afterwards.
+            const ok = await runPlugin(sub, ctx.cwd, ctx.ui);
+            const mutates = MUTATING.has(verb) || (verb === "marketplace" && sub[1] !== "list");
+            if (ok && mutates)
+                await reload(ctx);
+        },
+    });
+    async function interactive(ctx) {
+        const inventory = await listing(ctx);
+        if (!inventory)
+            return;
+        const choice = await ctx.ui.select("Plugins", [`Installed plugins (${inventory.plugins.length})`, "Browse marketplaces", "Update all", "Reload plugins", "Exit"], ctx.signal ? { signal: ctx.signal } : undefined);
+        if (!choice || choice === "Exit")
+            return;
+        if (choice.startsWith("Installed")) {
+            await installedMenu(ctx, inventory);
+            return;
+        }
+        if (choice === "Browse marketplaces") {
+            await browseMenu(ctx, inventory);
+            return;
+        }
+        if (choice === "Update all") {
+            if (await runPlugin(["update"], ctx.cwd, ctx.ui))
+                await reload(ctx);
+            return;
+        }
+        if (choice === "Reload plugins") {
+            await reload(ctx);
+            return;
+        }
+    }
+    async function installedMenu(ctx, inventory) {
+        if (inventory.plugins.length === 0) {
+            ctx.ui.notify(renderInventory(inventory, env), "info");
+            return;
+        }
+        const options = inventory.plugins.map((p) => `${p.key}${p.version ? ` · v${p.version}` : ""}`);
+        const choice = await ctx.ui.select("Installed plugins", [...options, "Back"], ctx.signal ? { signal: ctx.signal } : undefined);
+        if (!choice || choice === "Back")
+            return;
+        const plugin = inventory.plugins[options.indexOf(choice)];
+        if (!plugin)
+            return;
+        const actions = ["View details"];
+        if (plugin.origin === "yagni")
+            actions.push("Uninstall", "Disable");
+        actions.push("Back");
+        const action = await ctx.ui.select(describePlugin(plugin).split("\n")[0], actions, ctx.signal ? { signal: ctx.signal } : undefined);
+        if (!action || action === "Back")
+            return;
+        if (action === "View details") {
+            ctx.ui.notify(describePlugin(plugin), "info");
+            return;
+        }
+        if (action === "Uninstall") {
+            if (await runPlugin(["uninstall", plugin.key], ctx.cwd, ctx.ui))
+                await reload(ctx);
+            return;
+        }
+        if (action === "Disable") {
+            if (await runPlugin(["disable", plugin.key], ctx.cwd, ctx.ui))
+                await reload(ctx);
+        }
+    }
+    async function browseMenu(ctx, inventory) {
+        const path = cliPath(env);
+        if (!path) {
+            ctx.ui.notify("Plugin management needs the yagni launcher (YAGNI_CLI_PATH is unset in this session).", "warning");
+            return;
+        }
+        const result = await runCli(["plugin", "list", "--available"], { cliPath: path, cwd: ctx.cwd, env });
+        const catalog = parseCatalog(result.stdout);
+        if (catalog.length === 0) {
+            ctx.ui.notify(result.stdout.trim() || "No marketplaces added. Use `/plugin marketplace add <owner/repo | git-url | path>`.", "info");
+            return;
+        }
+        const installed = new Set(inventory.plugins.map((p) => p.key));
+        const entries = catalog.flatMap((mp) => mp.plugins.map((p) => ({ key: `${p.name}@${mp.name}`, label: `${p.name}@${mp.name}${p.version ? ` · v${p.version}` : ""}${installed.has(`${p.name}@${mp.name}`) ? "  (installed)" : ""}${p.installable ? "" : "  (remote source, not installable)"}` })));
+        const choice = await ctx.ui.select("Marketplace plugins", [...entries.map((e) => e.label), "Back"], ctx.signal ? { signal: ctx.signal } : undefined);
+        if (!choice || choice === "Back")
+            return;
+        const entry = entries[entries.map((e) => e.label).indexOf(choice)];
+        if (!entry)
+            return;
+        const scope = await ctx.ui.select(`Install ${entry.key}`, ["For all my projects (user)", "Only this repo (project)", "Back"], ctx.signal ? { signal: ctx.signal } : undefined);
+        if (!scope || scope === "Back")
+            return;
+        const args = ["install", entry.key, ...(scope.includes("project") ? ["-s", "project"] : [])];
+        if (await runPlugin(args, ctx.cwd, ctx.ui))
+            await reload(ctx);
+    }
+}
+/**
+ * Parse `yagni plugin list --available` text (the CLI's stable, tested
+ * shape: `<marketplace>:` headers, then `  <name>  v<ver>  [flags]` lines).
+ */
+export function parseCatalog(text) {
+    const out = [];
+    let current = null;
+    for (const raw of text.split("\n")) {
+        const header = /^(\S.*):$/.exec(raw);
+        if (header) {
+            current = { name: header[1], plugins: [] };
+            out.push(current);
+            continue;
+        }
+        const entry = /^  (\S+)(?:\s+v(\S+))?(?:\s+\[([^\]]*)\])?\s*$/.exec(raw);
+        if (entry && current) {
+            current.plugins.push({
+                name: entry[1],
+                version: entry[2] ?? null,
+                installable: !(entry[3] ?? "").includes("not installable"),
+            });
+        }
+    }
+    return out;
+}
+/** Exported for tests: the current stored inventory, if a reload happened. */
+export { storedInventory };
+//# sourceMappingURL=panel.js.map

package/dist/extension/sandbox/bash.d.ts

@@ -0,0 +1,99 @@
+/**
+ * Bash-tool sandbox wiring: decides whether a bash command runs
+ * sandboxed, and provides the spawnHook that wraps the command with the OS
+ * sandbox (srt) while pi's local exec backend keeps owning process
+ * lifecycle, timeout, and abort handling.
+ *
+ * The wrap uses pi's BashToolOptions.spawnHook (command/cwd/env rewrite
+ * before spawn) rather than replacing BashOperations wholesale — pi's
+ * battle-tested exec backend stays in charge; only the command string and
+ * proxy env change. user_bash (! commands) routes through the same wrap.
+ *
+ `dangerouslyDisableSandbox` mirrors Claude Code's bash tool parameter: the
+ * model may set it when it has evidence a sandbox restriction caused a
+ * failure; the parameter NEVER skips the permission gate (gate.ts routes the
+ * retry through the normal execPolicy/Guardian flow) — it only skips the OS
+ * wrap, and only when sandbox.allowUnsandboxedCommands is true.
+ *
+ * Child-process stdio-grace handling derived from pi-sandbox (MIT,
+ * carderne/pi-sandbox src/sandbox-runtime.ts) — not needed here because pi's
+ * local backend owns the child; the reference is credited for the operational
+ * lessons (process-group kill, stdio release).
+ */
+import type { BashSpawnHook, BashToolInput } from "@earendil-works/pi-coding-agent";
+import type { YagniSandboxManager } from "./manager.js";
+import type { SandboxSettings } from "./config.js";
+export interface SandboxBashInput extends BashToolInput {
+    /** Claude Code parity: model-requested unsandboxed retry. */
+    dangerouslyDisableSandbox?: boolean;
+}
+/**
+ * Does an excludedCommands pattern match any segment of the command?
+ * (Compound-aware: "echo hi && docker ps" must not ride an "echo:*" exclude.)
+ */
+export declare function commandHasExcludedSegment(command: string, excludedPatterns: readonly string[]): boolean;
+/**
+ * Should this bash tool call run inside the OS sandbox?
+ * Pure — reads the decision inputs, no I/O.
+ */
+export declare function shouldUseSandbox(input: Pick<SandboxBashInput, "command" | "dangerouslyDisableSandbox">, manager: Pick<YagniSandboxManager, "initialized">, settings: Pick<SandboxSettings, "allowUnsandboxedCommands" | "excludedCommands">): boolean;
+/**
+ * Build the spawnHook that wraps the command with the sandbox. The hook is
+ * async-ignoring by design: spawnHook is sync in pi's interface, so the
+ * command wrap must already be resolved — use preWrappedCommand() below to
+ * pre-wrap and stash, or build the hook from a pre-wrapped string.
+ *
+ * In practice we pre-wrap in tool_call (async, where we can await the wrap)
+ * by mutating event.input.command to the wrapped string, and the spawnHook
+ * only injects proxy env. That keeps a single code path for tool calls.
+ */
+/**
+ * Env additions every sandboxed process needs (srt injects proxy vars into
+ * the WRAPPED command's env; the spawnHook passes them through).
+ */
+export declare function sandboxSpawnEnv(manager: YagniSandboxManager): Record<string, string>;
+/**
+ * spawnHook for the sandboxed bash tool: injects proxy-support env vars.
+ * The command itself was already wrapped (pre-wrap in tool_call, async).
+ */
+export declare function makeSandboxSpawnHook(manager: YagniSandboxManager): BashSpawnHook;
+/**
+ * Wrap a raw command for OS-sandboxed execution. Returns the original string
+ * when the manager is not initialized (fail-open to plain execution — the
+ * permission gate still ran; the sandbox simply is not active).
+ */
+export declare function preWrappedCommand(manager: YagniSandboxManager, command: string, binShell?: string): Promise<string>;
+/**
+ * Detect "Operation not permitted" style sandbox denials in bash output so
+ * callers (tool_result) can annotate and the model can react. Returns the
+ * offending path when found (pi-sandbox's regex, credited MIT).
+ */
+export declare function extractBlockedWritePath(output: string): string | null;
+/**
+ * Wrap decision for user_bash (! commands): same rules as the tool, minus
+ * the dangerouslyDisableSandbox parameter (users running ! commands are
+ * already the principal, not the model).
+ */
+export declare function shouldUseSandboxForUserCommand(command: string, manager: Pick<YagniSandboxManager, "initialized">, settings: Pick<SandboxSettings, "excludedCommands">): boolean;
+/**
+ * Post-execution violation annotation: annotate a command's combined output
+ * with sandbox violation details when the sandbox is active. Returns the
+ * annotated output (or the original when nothing to annotate).
+ */
+export declare function annotateCommandOutput(manager: YagniSandboxManager, command: string, output: string): string;
+/** cwd must exist before spawn (guard borrowed from pi's local ops). */
+export declare function assertSpawnableCwd(cwd: string): void;
+/**
+ * The gate's sandbox auto-allow decision — the production predicate index.ts
+ * wires into registerPermissionGate's sandboxAutoAllow dep. Exported so the
+ * precedence table is pinned by real tests, not mirrored tautologies.
+ *
+ * Declines (returns false): non-bash tools, autoAllow disabled by setting,
+ * manager not initialized, empty command, and — critically —
+ * dangerouslyDisableSandbox retries that will run UNSANDBOXED (they must pay
+ * the normal permission price; only strict-mode-forced sandboxing rides the
+ * auto-allow). Otherwise: shouldUseSandbox's decision (excludedCommands
+ * included — an excluded command runs unsandboxed through the ordinary flow).
+ */
+export declare function sandboxAutoAllowDecision(toolName: string, params: Record<string, unknown>, manager: Pick<YagniSandboxManager, "initialized">, settings: Pick<SandboxSettings, "autoAllowBashIfSandboxed" | "allowUnsandboxedCommands" | "excludedCommands">): boolean;
+//# sourceMappingURL=bash.d.ts.map