@yagni-app/code 1.0.5 → 1.0.7

package/dist/extension/sandbox/manager.d.ts

@@ -0,0 +1,98 @@
+/**
+ * Sandbox manager adapter — wraps @anthropic-ai/sandbox-runtime's
+ * SandboxManager with YAGNI Code wiring: dependency check against the
+ * vendored ripgrep, settings-derived runtime config (config.ts merge), and
+ * an injectable network ask-callback so the UI layer owns prompting (M5)
+ * while headless fails closed (deny).
+ *
+ * All state is session-scoped behind a single holder; nothing module-global
+ * is mutated except the underlying srt manager, which initialize/reset
+ * bracket. Pure functions (config building) live in config.ts.
+ */
+import { type SandboxSettings, type SandboxRuntimeMerge } from "./config.js";
+import type { PermissionRule } from "../permissionRules/loadConfig.js";
+/** Where the network ask-callback surfaces a decision. */
+export type NetworkAskHandler = (host: string) => Promise<boolean>;
+export interface SandboxDependencyStatus {
+    /** Fatal: sandbox cannot run. */
+    errors: string[];
+    warnings: string[];
+}
+export interface SandboxManagerEvents {
+    onStateChange?: (enabled: boolean) => void;
+}
+export interface SandboxSessionOptions {
+    cwd: string;
+    env?: NodeJS.ProcessEnv;
+    userHome?: string;
+    stateHomeOverride?: string | null;
+    projectRoot?: string | null;
+    /** Ripgrep binary for srt's dependency check (default: vendored rg). */
+    rgPath?: string;
+    askHandler?: NetworkAskHandler | null;
+    events?: SandboxManagerEvents;
+}
+export interface SandboxSessionState {
+    /** srt initialized and commands will be wrapped. */
+    initialized: boolean;
+    /** Last dependency status (memoized per init attempt). */
+    dependencies: SandboxDependencyStatus | null;
+    /** The settings snapshot this session initialized with. */
+    settings: SandboxSettings | null;
+}
+/** Default vendored rg shipped with the CLI install. */
+export declare function defaultRgPath(env?: NodeJS.ProcessEnv): string | undefined;
+export declare class YagniSandboxManager {
+    private state;
+    private askHandler;
+    private readonly opts;
+    constructor(opts: SandboxSessionOptions);
+    get initialized(): boolean;
+    get settings(): SandboxSettings | null;
+    get dependencies(): SandboxDependencyStatus | null;
+    setAskHandler(handler: NetworkAskHandler | null): void;
+    /** The failure-trail wrapper handed to srt — exported for tests so the
+     * catch-and-log contract (fail closed + sink line) is observable without
+     * driving a real wrapped network connection. */
+    networkAsk(host: string): Promise<boolean>;
+    checkDependencies(): SandboxDependencyStatus;
+    /**
+     * Build the runtime filesystem/network config from current settings +
+     * permission rules. Exposed for diagnostics (/sandbox config display) and
+     * tests; initialize() consumes it internally.
+     */
+    buildRuntimeMerge(rules: readonly PermissionRule[]): SandboxRuntimeMerge;
+    private runtimeConfig;
+    /**
+     * Initialize srt for this session. Returns an error string when the sandbox
+     * cannot start (deps/platform) — the caller decides fail-soft (notify) vs
+     * fail-hard (refuse to run, `failIfUnavailable`). Idempotent: a second call
+     * while initialized is a no-op.
+     *
+     * `force` bypasses the disk `enabled` check: the session-level toggle
+     * (/sandbox enable, Alt+S) must be able to START the sandbox in a
+     * default-off config — that is its entire purpose. Config-driven starts
+     * (session_start) never pass force.
+     */
+    initialize(rules: readonly PermissionRule[], opts?: {
+        force?: boolean;
+    }): Promise<string | undefined>;
+    /**
+     * Rebuild + push the srt config without reset (settings changed or a grant
+     * landed). No-op when not initialized.
+     */
+    refreshConfig(rules: readonly PermissionRule[]): void;
+    /**
+     * Re-init from scratch (config grant changed semantics srt can't hot-swap,
+     * or a toggle). Tears down proxies + violation store first.
+     */
+    reinitialize(rules: readonly PermissionRule[]): Promise<string | undefined>;
+    /** Tear down srt (proxies, violation store, seatbelt state). */
+    reset(): Promise<void>;
+    wrapWithSandbox(command: string, binShell?: string): Promise<string>;
+    cleanupAfterCommand(): void;
+    annotateStderrWithSandboxFailures(command: string, stderr: string): string;
+    getProxyPort(): number | undefined;
+    getSocksProxyPort(): number | undefined;
+}
+//# sourceMappingURL=manager.d.ts.map

package/dist/extension/sandbox/manager.js

@@ -0,0 +1,216 @@
+/**
+ * Sandbox manager adapter — wraps @anthropic-ai/sandbox-runtime's
+ * SandboxManager with YAGNI Code wiring: dependency check against the
+ * vendored ripgrep, settings-derived runtime config (config.ts merge), and
+ * an injectable network ask-callback so the UI layer owns prompting (M5)
+ * while headless fails closed (deny).
+ *
+ * All state is session-scoped behind a single holder; nothing module-global
+ * is mutated except the underlying srt manager, which initialize/reset
+ * bracket. Pure functions (config building) live in config.ts.
+ */
+import { SandboxManager as SrtSandboxManager } from "@anthropic-ai/sandbox-runtime";
+import { logEvent } from "../errorSink.js";
+import { codeStateHome } from "../stateHome.js";
+import { loadSandboxSettings, mergeRulesIntoSandbox, } from "./config.js";
+/** Default vendored rg shipped with the CLI install. */
+export function defaultRgPath(env = process.env) {
+    const agentDir = env.PI_CODING_AGENT_DIR;
+    if (!agentDir)
+        return undefined;
+    return `${agentDir.replace(/\/$/, "")}/bin/rg`;
+}
+export class YagniSandboxManager {
+    state = { initialized: false, dependencies: null, settings: null };
+    askHandler = null;
+    opts;
+    constructor(opts) {
+        this.opts = opts;
+        this.askHandler = opts.askHandler ?? null;
+    }
+    get initialized() { return this.state.initialized; }
+    get settings() { return this.state.settings; }
+    get dependencies() { return this.state.dependencies; }
+    setAskHandler(handler) {
+        this.askHandler = handler;
+    }
+    /** The failure-trail wrapper handed to srt — exported for tests so the
+     * catch-and-log contract (fail closed + sink line) is observable without
+     * driving a real wrapped network connection. */
+    async networkAsk(host) {
+        if (!this.askHandler)
+            return false; // fail closed (headless)
+        try {
+            return await this.askHandler(host);
+        }
+        catch (err) {
+            // Fail closed, but never silently — a denied host with no trail is
+            // undebuggable. Metadata only (host + error class): no command content.
+            logEvent({
+                source: "sandbox",
+                level: "warn",
+                event: "network_ask_failed",
+                fields: {
+                    host,
+                    errorClass: err instanceof Error ? err.constructor.name : String(err),
+                },
+            });
+            return false;
+        }
+    }
+    checkDependencies() {
+        // No explicit rgPath/PI_CODING_AGENT_DIR: fall through to srt's own check,
+        // which uses { command: 'rg' } and consults PATH — rg on PATH is a
+        // legitimate resolution (CI runners, bare-metal Linux installs). The
+        // vendored-rg case is the explicit path above.
+        const rg = this.opts.rgPath ?? defaultRgPath(this.opts.env ?? process.env);
+        const check = rg
+            ? SrtSandboxManager.checkDependencies({ command: rg, args: ["--version"] })
+            : SrtSandboxManager.checkDependencies();
+        return { errors: [...check.errors], warnings: [...check.warnings] };
+    }
+    /**
+     * Build the runtime filesystem/network config from current settings +
+     * permission rules. Exposed for diagnostics (/sandbox config display) and
+     * tests; initialize() consumes it internally.
+     */
+    buildRuntimeMerge(rules) {
+        const { settings } = loadSandboxSettings({
+            cwd: this.opts.cwd,
+            env: this.opts.env,
+            userHome: this.opts.userHome,
+            stateHomeOverride: this.opts.stateHomeOverride,
+        });
+        return mergeRulesIntoSandbox(settings, rules, {
+            cwd: this.opts.cwd,
+            userStateHome: this.opts.stateHomeOverride ?? codeStateHome(null, this.opts.env, this.opts.userHome),
+            projectRoot: this.opts.projectRoot ?? null,
+            homeDir: this.opts.userHome,
+        });
+    }
+    runtimeConfig(merge, settings) {
+        return {
+            network: {
+                allowedDomains: merge.network.allowedDomains,
+                deniedDomains: merge.network.deniedDomains,
+                allowUnixSockets: merge.network.allowUnixSockets,
+                allowAllUnixSockets: merge.network.allowAllUnixSockets,
+                allowLocalBinding: merge.network.allowLocalBinding,
+                httpProxyPort: merge.network.httpProxyPort,
+                socksProxyPort: merge.network.socksProxyPort,
+            },
+            filesystem: {
+                allowRead: merge.filesystem.allowRead,
+                denyRead: merge.filesystem.denyRead,
+                allowWrite: merge.filesystem.allowWrite,
+                denyWrite: merge.filesystem.denyWrite,
+            },
+            ignoreViolations: settings.ignoreViolations,
+            enableWeakerNestedSandbox: settings.enableWeakerNestedSandbox,
+            enableWeakerNetworkIsolation: settings.enableWeakerNetworkIsolation,
+        };
+    }
+    /**
+     * Initialize srt for this session. Returns an error string when the sandbox
+     * cannot start (deps/platform) — the caller decides fail-soft (notify) vs
+     * fail-hard (refuse to run, `failIfUnavailable`). Idempotent: a second call
+     * while initialized is a no-op.
+     *
+     * `force` bypasses the disk `enabled` check: the session-level toggle
+     * (/sandbox enable, Alt+S) must be able to START the sandbox in a
+     * default-off config — that is its entire purpose. Config-driven starts
+     * (session_start) never pass force.
+     */
+    async initialize(rules, opts = {}) {
+        if (this.state.initialized)
+            return undefined;
+        // Config-first (Claude's order): a sandbox the user did not enable must
+        // never report a dependency problem — disabled is disabled regardless of
+        // the machine's health. `force` (session toggle) reads config the same
+        // way; the dep check below still guards the actual start.
+        const load = loadSandboxSettings({
+            cwd: this.opts.cwd,
+            env: this.opts.env,
+            userHome: this.opts.userHome,
+            stateHomeOverride: this.opts.stateHomeOverride,
+        });
+        if (!load.settings.enabled && !opts.force)
+            return "sandbox disabled by config";
+        const deps = this.checkDependencies();
+        this.state.dependencies = deps;
+        if (deps.errors.length > 0)
+            return `sandbox dependencies unavailable: ${deps.errors.join(", ")}`;
+        const merge = this.buildRuntimeMerge(rules);
+        const ask = async (hostPattern) => this.networkAsk(hostPattern.host);
+        try {
+            await SrtSandboxManager.initialize(this.runtimeConfig(merge, load.settings), ask);
+        }
+        catch (err) {
+            this.state.dependencies = null;
+            return `sandbox initialization failed: ${err instanceof Error ? err.message : String(err)}`;
+        }
+        this.state.initialized = true;
+        this.state.settings = load.settings;
+        this.opts.events?.onStateChange?.(true);
+        return undefined;
+    }
+    /**
+     * Rebuild + push the srt config without reset (settings changed or a grant
+     * landed). No-op when not initialized.
+     */
+    refreshConfig(rules) {
+        if (!this.state.initialized)
+            return;
+        const merge = this.buildRuntimeMerge(rules);
+        SrtSandboxManager.updateConfig(this.runtimeConfig(merge, loadSandboxSettings({
+            cwd: this.opts.cwd,
+            env: this.opts.env,
+            userHome: this.opts.userHome,
+            stateHomeOverride: this.opts.stateHomeOverride,
+        }).settings));
+    }
+    /**
+     * Re-init from scratch (config grant changed semantics srt can't hot-swap,
+     * or a toggle). Tears down proxies + violation store first.
+     */
+    async reinitialize(rules) {
+        if (this.state.initialized) {
+            await this.reset();
+        }
+        return this.initialize(rules);
+    }
+    /** Tear down srt (proxies, violation store, seatbelt state). */
+    async reset() {
+        this.state = { initialized: false, dependencies: null, settings: null };
+        try {
+            await SrtSandboxManager.reset();
+        }
+        catch {
+            // teardown errors are non-fatal; state is already cleared
+        }
+        this.opts.events?.onStateChange?.(false);
+    }
+    // --- command wrapping (thin, typed passthroughs) ---
+    async wrapWithSandbox(command, binShell) {
+        if (!this.state.initialized)
+            return command;
+        return SrtSandboxManager.wrapWithSandbox(command, binShell);
+    }
+    cleanupAfterCommand() {
+        if (!this.state.initialized)
+            return;
+        SrtSandboxManager.cleanupAfterCommand();
+    }
+    annotateStderrWithSandboxFailures(command, stderr) {
+        if (!this.state.initialized)
+            return stderr;
+        return SrtSandboxManager.annotateStderrWithSandboxFailures(command, stderr);
+    }
+    getProxyPort() {
+        return this.state.initialized ? SrtSandboxManager.getProxyPort() : undefined;
+    }
+    getSocksProxyPort() {
+        return this.state.initialized ? SrtSandboxManager.getSocksProxyPort() : undefined;
+    }
+}
+//# sourceMappingURL=manager.js.map

package/dist/extension/sandbox/panel.d.ts

@@ -0,0 +1,111 @@
+/**
+ * /sandbox interactive TUI panel — mirrors Claude Code's SandboxSettings
+ * tabs (Mode / Overrides / Config, plus Dependencies when checkDependencies
+ * reports errors). Rendered via ctx.ui.custom() in TUI mode; RPC/headless
+ * keeps the text summary (custom() is unavailable there).
+ *
+ * Structure follows Claude's components (SandboxSettings/SandboxModeTab/
+ * SandboxOverridesTab/SandboxConfigTab): tabs switched with left/right,
+ * SelectList-driven option tabs, read-only config tab, off-state
+ * placeholders on Overrides/Config. Copy mirrors Claude's where the
+ * mechanism is identical; persistence deviates deliberately (see
+ * persistSandboxMode in session.ts) until the project-local settings tier
+ * lands.
+ *
+ * Input contract (verified against pi's interactive mode): pi focuses the
+ * ROOT component and calls only root.handleInput(data). Children without
+ * their own handleInput (Box, Text) are never consulted — so the panel
+ * keeps a direct reference to the active SelectList and forwards keys to
+ * it. A Box wrapper does NOT forward input.
+ */
+import { Container, type SelectItem } from "@earendil-works/pi-tui";
+import { type SandboxRuntimeMerge, type SandboxRuntimePaths, type SandboxSettings } from "./config.js";
+import type { RenderTheme } from "../subagentRender.js";
+import type { PermissionRule } from "../permissionRules/loadConfig.js";
+export type SandboxPanelTab = "mode" | "overrides" | "config" | "dependencies";
+export type SandboxModeChoice = "auto-allow" | "regular" | "disabled";
+export type SandboxOverrideChoice = "open" | "closed";
+/** Everything the panel needs, resolved by the caller (session.ts). */
+export interface SandboxPanelState {
+    settings: SandboxSettings;
+    /** Session-only toggle state (false = forced off this session). */
+    sessionToggledOff: boolean;
+    /** Dependencies status for the Dependencies tab + warnings on Config. */
+    dependencyErrors: string[];
+    dependencyWarnings: string[];
+    /** Runtime merge output (rules + settings) for the Config tab. */
+    merge: SandboxRuntimeMerge;
+    /** Domains granted this session (memory-only). */
+    sessionGrants: string[];
+}
+export interface SandboxPanelActions {
+    /** Persist a mode choice. Resolves with the confirmation to surface
+     * after the panel closes (Claude's onComplete(message) contract). */
+    onModeSelect: (choice: SandboxModeChoice) => Promise<SandboxPanelOutcome>;
+    /** Persist an override choice. Same contract. */
+    onOverrideSelect: (choice: SandboxOverrideChoice) => Promise<SandboxPanelOutcome>;
+}
+/** What the panel hands back when it closes: the confirmation (or error)
+ * the session surfaces via notify once custom() resolves. */
+export interface SandboxPanelOutcome {
+    text: string;
+    level: "info" | "error";
+}
+/** Current mode derived from resolved settings (Claude's currentMode). */
+export declare function deriveCurrentMode(settings: SandboxSettings, sessionToggledOff: boolean): SandboxModeChoice;
+export declare function deriveCurrentOverride(settings: SandboxSettings): SandboxOverrideChoice;
+export declare function modeOptions(current: SandboxModeChoice): SelectItem[];
+export declare function overrideOptions(current: SandboxOverrideChoice): SelectItem[];
+/** Per-mode explanation (Claude's copy, adapted to our surfaces). */
+export declare function modeExplanation(mode: SandboxModeChoice): string;
+export declare function overrideExplanation(choice: SandboxOverrideChoice): string;
+/**
+ * Config tab sections, conditional like Claude's SandboxConfigTab: empty
+ * sections are omitted entirely (Excluded Commands — Claude's one always-on
+ * section — shows None). Structured as title + detail lines so the tab can
+ * space sections apart instead of rendering one dense text block.
+ */
+export interface ConfigSection {
+    title: string;
+    detail: string[];
+}
+export declare function configSections(state: SandboxPanelState): ConfigSection[];
+/** Tabs offered, mirroring Claude: Dependencies appears only on errors. */
+export declare function panelTabs(dependencyErrors: string[]): SandboxPanelTab[];
+/**
+ * The /sandbox panel. Structure: top border · tab strip · blank · tab
+ * content · blank · footer · bottom border. pi focuses this root and calls
+ * its handleInput; the panel forwards keys to the active tab's SelectList
+ * (when one exists) and switches tabs on left/right.
+ */
+export declare class SandboxPanel extends Container {
+    private readonly state;
+    private readonly actions;
+    private readonly theme;
+    private readonly done;
+    private activeTab;
+    private readonly tabs;
+    /** The active tab's SelectList (mode/overrides) or null (config/deps) —
+     * input forwards here. */
+    private activeList;
+    /** Padded content frame; children[0] = tab strip, children[1] = body. */
+    private readonly content;
+    constructor(state: SandboxPanelState, actions: SandboxPanelActions, theme: RenderTheme, done: (outcome?: SandboxPanelOutcome) => void);
+    private setTab;
+    private buildBody;
+    private buildTabContent;
+    private buildModeTab;
+    private buildOverridesTab;
+    private buildConfigTab;
+    private buildDependenciesTab;
+    handleInput(data: string): void;
+}
+/**
+ * Build the panel state from the pieces session.ts already holds. Exported
+ * for unit tests; the TUI component consumes it.
+ */
+export declare function buildPanelState(settings: SandboxSettings, sessionToggledOff: boolean, rules: readonly PermissionRule[], paths: SandboxRuntimePaths, sessionGrants: readonly string[], dependencyStatus: {
+    errors: string[];
+    warnings: string[];
+}): SandboxPanelState;
+//# sourceMappingURL=panel.d.ts.map