@yagni-app/code 1.0.5 → 1.0.7

package/dist/extension/index.d.ts

@@ -1,7 +1,9 @@
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 import { type SpendResponse } from "./costHud.js";
 import { runInitPass as defaultRunInitPass } from "./initPass.js";
-import { fetchMcpServers as defaultFetchMcpServers } from "./mcpTools.js";
+import { startMcp as defaultStartMcp } from "./mcp/startup.js";
+import { type GuardianGateEvent } from "./permission/gate.js";
+import { type PluginCliRunner } from "./plugins/panel.js";
 import { type FlushOutcome, type SpoolClientOpts } from "./spool.js";
 import { type TokenProvider } from "./tokenProvider.js";
 import { type CatalogResult, type ContextBrief } from "./config.js";
@@ -53,11 +55,13 @@ export interface RegisterYagniDeps {
     /** The beat's once-per-repo marker store. Injectable (no disk in tests). */
     mineBeatMarkers?: MineBeatMarkers;
     /**
-     * Workspace MCP server list seam (YAG-446). The default hits
-     * `/api/yagni-code/mcp/servers` and is fail-soft: older backends and
-     * un-rescoped tokens yield `[]`, never a startup error.
+     * Local-MCP startup seam: injectable so tests assert the wiring (approval
+     * skip, kill-switch, mutating-tool gate) without touching real config
+     * homes or spawning servers. Default runs the real startup.
      */
-    fetchMcpServers?: typeof defaultFetchMcpServers;
+    startMcp?: typeof defaultStartMcp;
+    /** Test seam for the /plugin panel: runs `yagni plugin …` (defaults to spawning YAGNI_CLI_PATH). */
+    runPluginCli?: PluginCliRunner;
     /**
      * The CLI init pass (Onramp Door B). Injectable so tests assert it fires on a
      * fresh-workspace first-run and is skipped otherwise, without a network or disk.
@@ -115,6 +119,15 @@ export declare function buildRunSpendUrl(baseUrl: string, runId: string): string
  * Returns null on anything that doesn't look like the real shape.
  */
 export declare function parseSpendResponse(data: unknown): SpendResponse | null;
+/**
+ * Local trail for EVERY terminal gate outcome (sandbox auto-allow included),
+ * always on so e2e and support can see what the gate did even when the
+ * storage tier is off. Decision K: the always-on line carries outcome
+ * metadata ONLY — no command content. The command prefix and the exec
+ * justification are command/model content and ride the debug tier (never
+ * uploaded by /feedback) plus the opt-in storage stream.
+ */
+export declare function logGateOutcomeTrail(ev: GuardianGateEvent, env: NodeJS.ProcessEnv): void;
 export declare function registerYagni(pi: ExtensionAPI, deps?: RegisterYagniDeps): Promise<void>;
 export default function (pi: ExtensionAPI): Promise<void>;
 export { makeAskYagniTool } from "./askYagniTool.js";

package/dist/extension/index.js

@@ -1,4 +1,6 @@
 import { createHash } from "node:crypto";
+import { existsSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
 import { Text } from "@earendil-works/pi-tui";
 import { DEFAULT_ADVISOR_LIMITS, formatAdvisorSubtotal, makeAdvisorState } from "./advisor.js";
 import { makeChildUsageState } from "./childUsage.js";
@@ -29,11 +31,17 @@ import { createYagniFooterFactory, cyclePermissionMode, formatCwd, GIT_MUTATING_
 import { RerouteNotifier } from "./rerouteNotice.js";
 import { isFreshWorkspace, registerTeamSetupCommand, runInitPass as defaultRunInitPass } from "./initPass.js";
 import { isInitDone as defaultIsInitDone, markInitDone as defaultMarkInitDone } from "./initDone.js";
-import { fetchMcpServers as defaultFetchMcpServers, registerMcpCommand, registerMcpTools, } from "./mcpTools.js";
+import { looksMutating } from "./mcp/tools.js";
+import { startMcp as defaultStartMcp, wireShutdown, deriveStartupConnectivityNotices } from "./mcp/startup.js";
 import { registerGoCommand } from "./pipeline/goCommand.js";
 import { registerGoCompareCommand } from "./pipeline/goCompareCommand.js";
 import { DEFAULT_PERMISSION_POLICY, createModeHolder, registerPermissionGate } from "./permission/gate.js";
+import { registerSandbox } from "./sandbox/session.js";
+import { sandboxAutoAllowDecision } from "./sandbox/bash.js";
+import { registerTelemetry } from "./telemetry/register.js";
 import { loadHooksConfig, makeHookRunner, registerHooks } from "./hooks.js";
+import { loadPermissionRules } from "./permissionRules/loadConfig.js";
+import { registerPluginPanel } from "./plugins/panel.js";
 import { registerSubagents } from "./subagents.js";
 import { createUltraHolder, registerUltraCommand } from "./ultra.js";
 import { registerTodos } from "./todos.js";
@@ -98,6 +106,39 @@ export function parseSpendResponse(data) {
         return null;
     return d;
 }
+/**
+ * Local trail for EVERY terminal gate outcome (sandbox auto-allow included),
+ * always on so e2e and support can see what the gate did even when the
+ * storage tier is off. Decision K: the always-on line carries outcome
+ * metadata ONLY — no command content. The command prefix and the exec
+ * justification are command/model content and ride the debug tier (never
+ * uploaded by /feedback) plus the opt-in storage stream.
+ */
+export function logGateOutcomeTrail(ev, env) {
+    logEvent({
+        source: "guardian",
+        level: "info",
+        event: "gate_outcome",
+        sessionId: env.YAGNI_SESSION_ID ?? undefined,
+        fields: {
+            outcome: ev.outcome,
+            mode: ev.mode,
+            consulted: ev.consulted,
+        },
+    });
+    if (isDebug(env)) {
+        logEvent({
+            source: "guardian",
+            level: "debug",
+            event: "gate_outcome",
+            sessionId: env.YAGNI_SESSION_ID ?? undefined,
+            fields: {
+                commandPrefix: storagePrefix(ev.command),
+                ...(ev.execJustification ? { execJustification: ev.execJustification } : {}),
+            },
+        });
+    }
+}
 export async function registerYagni(pi, deps = {}) {
     const baseUrl = deps.baseUrl ?? resolveBaseUrl();
     const now = deps.now ?? (() => Date.now());
@@ -238,6 +279,9 @@ export async function registerYagni(pi, deps = {}) {
     // before_agent_start handler below) and widens the tool's fan-out ceiling.
     const ultraHolder = createUltraHolder();
     registerSubagents(pi, { isUltra: () => ultraHolder.get(), workingLine, childUsage });
+    // /plugin + /reload-plugins: manage Claude Code marketplace plugins from the
+    // session, driving the launcher's `yagni plugin …` (YAGNI_CLI_PATH).
+    registerPluginPanel(pi, { env: deps.env, runCli: deps.runPluginCli });
     registerUltraCommand(pi, ultraHolder);
     // Shared fetch timeout for the small, interactive display-path reads below
     // (/cost's spend + headroom, and Task 8's per-run spend for /go's summary):
@@ -293,22 +337,100 @@ export async function registerYagni(pi, deps = {}) {
     const decisionCapture = evalMode ? undefined : makeDecisionCapture(decisionClientOpts);
     if (!evalMode)
         registerDecisionCommands(pi, decisionClientOpts);
-    // Workspace MCP servers (YAG-446): register one tool per enabled server
-    // tool, executing through the backend proxy, plus the /mcp listing
-    // command. Fail-soft fetch (older backend / un-rescoped token → no MCP
-    // tools); skipped in eval mode like the other external-side-effect tools.
-    const fetchMcp = deps.fetchMcpServers ?? defaultFetchMcpServers;
-    const mcpServers = evalMode
-        ? []
-        : await fetchMcp({ baseUrl, getToken: getTokenFn, fetchImpl: authedFetch });
-    const { mutatingToolNames: mcpMutatingTools } = registerMcpTools(pi, mcpServers, { baseUrl, getToken: getTokenFn, fetchImpl: authedFetch });
-    registerMcpCommand(pi, mcpServers, { baseUrl });
+    // Local MCP servers (standard client, replaces the backend-proxy /mcp of
+    // the YAG-446 era): load user/project/local config, approval-gate project
+    // servers, connect, register one tool per server tool plus /mcp panel.
+    // Fail-soft everywhere; skipped entirely in eval mode (external side
+    // effects) and under the YAGNI_CODE_MCP_DISABLED kill-switch.
+    const startMcpImpl = deps.startMcp ?? defaultStartMcp;
+    // One-shot notices queued by startMcp at session start (the `.mcp.json`
+    // approval prompt); flushed once on the first provider response. Connectivity
+    // notices are NOT here — they are recomputed live at flush (see below).
+    const mcpApprovalNotices = [];
+    const mcpOutcome = evalMode
+        ? { manager: undefined, mutatingToolNames: [] }
+        : await startMcpImpl(pi, {
+            cwd: process.cwd(),
+            env,
+            hasUI: true,
+            notify: (msg) => mcpApprovalNotices.push(msg),
+        });
+    const mcpMutatingSet = new Set(mcpOutcome.mutatingToolNames);
+    // Wire names carry the original tool name after the second `__`: parse it
+    // out and re-run the heuristic for tools registered after startup (a
+    // reconnect can re-register tools the original classification never saw).
+    const mcpStartupIsMutating = (wireName) => {
+        const parts = wireName.split("__");
+        const original = parts.slice(2).join("__");
+        if (!original)
+            return false;
+        return looksMutating(original);
+    };
+    if (!evalMode && mcpOutcome.manager) {
+        wireShutdown(pi, mcpOutcome.manager);
+        // Startup notify (documented CC deviation): one quiet line per notice on
+        // the first provider response — never raw stdout, never blocking.
+        //
+        // Connectivity notices are recomputed against LIVE manager state at flush
+        // time (not the frozen startMcp snapshot): if the user healed a server via
+        // /mcp before the first turn, it must no longer read as broken/unauth.
+        // The static queue only carries non-connectivity notices (e.g. the
+        // `.mcp.json` approval prompt), which stay one-shot.
+        let connectivityNoticesFlushed = false;
+        // permission-rule notices are one-shot like connectivity notices.
+        let rulesNoticesFlushed = false;
+        pi.on("after_provider_response", (_event, ctx) => {
+            try {
+                if (!ctx.hasUI)
+                    return;
+                const connectivity = connectivityNoticesFlushed
+                    ? []
+                    : deriveStartupConnectivityNotices(mcpOutcome.manager);
+                connectivityNoticesFlushed = true;
+                for (const notice of connectivity)
+                    ctx.ui.notify(notice, "info");
+                while (mcpApprovalNotices.length > 0) {
+                    ctx.ui.notify(mcpApprovalNotices.shift(), "info");
+                }
+                // one-shot permission-rule config warnings (bad files,
+                // never-consulted tools). One consolidated line, never a wall.
+                if (!rulesNoticesFlushed) {
+                    rulesNoticesFlushed = true;
+                    const parts = [];
+                    if (loadedRules.diagnostics.warnings.length > 0) {
+                        parts.push(`${loadedRules.diagnostics.warnings.length} permission-rule config warning(s)`);
+                    }
+                    if (loadedRules.diagnostics.neverConsultedTools.length > 0) {
+                        parts.push(`rules for unknown tools: ${loadedRules.diagnostics.neverConsultedTools.join(", ")} (ignored)`);
+                    }
+                    if (parts.length > 0) {
+                        ctx.ui.notify(`Permission rules: ${parts.join(" · ")}`, "warning");
+                    }
+                }
+            }
+            catch {
+                // A notice must never break a turn.
+            }
+        });
+    }
     // P3 + W4: interactive permission tiers + plan mode via /mode, now with a
     // session bless store (three-way review-mode select) and a capture hook that
     // drafts a decision on "don't ask again". Default auto, so still additive.
     // Mutating MCP tools join write/edit/bash in the gate policy: plan mode
     // holds them, review mode confirms them.
     const modeHolder = createModeHolder();
+    // OTel export (traces, metrics, log events; Claude Code parity). A no-op
+    // unless the launcher's gate set YAGNI_OTEL_EXPORT=1 — see the CLI's
+    // otel.ts for the sources and src/telemetry for the exporter.
+    const telemetry = registerTelemetry(pi, { env });
+    {
+        let previousMode = modeHolder.get();
+        modeHolder.onSet((m) => {
+            if (m !== previousMode)
+                telemetry.permissionModeChanged(previousMode, m);
+            previousMode = m;
+        });
+    }
     const footerInvalidateHandle = { invalidateGit: () => { }, requestRender: () => { } };
     const guardianState = makeGuardianState();
     // Disabled by the local env override OR the workspace kill switch
@@ -336,12 +458,18 @@ export async function registerYagni(pi, deps = {}) {
     const guardianLogSink = (payload) => {
         const event = typeof payload.event === "string" ? payload.event : "guardian_event";
         const { event: _ignored, ...fields } = payload;
+        // `malformed` (repair failed — still really failing) and a failed
+        // telemetry POST are errors. `repaired: true` (the ladder salvaged the
+        // verdict) is a warn — it worked, but we keep counting it. Everything
+        // else is routine info.
+        const level = event === "guardian_event_post_failed" || payload.outcome === "malformed"
+            ? "error"
+            : payload.repaired === true && payload.outcome !== undefined
+                ? "warn"
+                : "info";
         logEvent({
             source: "guardian",
-            // `malformed` is a real failure (this is the "unclear verdict" bug the
-            // whole capture exists to diagnose) — an error, not routine info. The
-            // failed-telemetry event is already an error.
-            level: event === "guardian_event_post_failed" || payload.outcome === "malformed" ? "error" : "info",
+            level,
             event,
             sessionId: env.YAGNI_SESSION_ID ?? undefined,
             fields,
@@ -352,6 +480,25 @@ export async function registerYagni(pi, deps = {}) {
     // the startup load is the trust boundary; live reload was reviewed and
     // rejected as a same-session self-authorization path, PR #1698).
     const sessionGrants = evalMode ? [] : loadGrants();
+    // settings-based permission rules, loaded once at startup (same
+    // trust-boundary posture as grants: no mid-session reload). User config
+    // (~/.yagni-code/config.json) + project config (.yagni-code/config.json);
+    // project allow rules are trust-gated at evaluation time, deny/ask always.
+    const loadedRules = evalMode
+        ? { rules: [], diagnostics: { warnings: [], neverConsultedTools: [] } }
+        : loadPermissionRules({ cwd: process.cwd() });
+    for (const w of loadedRules.diagnostics.warnings) {
+        logEvent({ source: "permission-rules", level: "warn", event: "config_warning", fields: { warning: w } });
+    }
+    if (loadedRules.diagnostics.neverConsultedTools.length > 0) {
+        logEvent({
+            source: "permission-rules",
+            level: "warn",
+            event: "never_consulted_tools",
+            fields: { tools: loadedRules.diagnostics.neverConsultedTools.join(", ") },
+        });
+    }
+    const rulesStateHome = codeStateHome(null, env);
     const GUARDIAN_EVENT_TIMEOUT_MS = 5_000;
     // YAG-506: load user-configurable lifecycle hooks config and create the
     // hook runner for the permission gate. Skipped in eval mode.
@@ -359,25 +506,75 @@ export async function registerYagni(pi, deps = {}) {
     const hookRunner = evalMode ? null : makeHookRunner({ config: hooksConfig });
     if (!evalMode)
         registerHooks(pi, { config: hooksConfig });
+    // OS-level bash sandboxing. Registers the sandbox-aware bash tool
+    // (dangerouslyDisableSandbox param + wrap + violation annotation) and the
+    // session lifecycle (init/reset, fail-soft unless failIfUnavailable).
+    // Null on unsupported platforms — stock bash stays. Shares the loaded
+    // permission rules so sandbox config and the gate read one rule source.
+    const sandboxHandle = evalMode
+        ? null
+        : registerSandbox(pi, {
+            cwd: process.cwd(),
+            env,
+            hasUI: (ctx) => ctx.hasUI,
+            // Anchors project-protected paths (.yagni-code + its config.json in
+            // denyWrite) and project-sourced permission rules to the repo the
+            // session runs in — same root the gate uses for its rule anchoring.
+            projectRoot: process.cwd(),
+        });
+    if (sandboxHandle)
+        sandboxHandle.setRules(loadedRules.rules);
     registerPermissionGate(pi, {
+        ...(sandboxHandle
+            ? {
+                sandboxAutoAllow: (toolName, params) => sandboxAutoAllowDecision(toolName, params, sandboxHandle.manager, sandboxHandle.settings()),
+            }
+            : {}),
         modeHolder,
         guardianState,
         guardianLimits,
         guardianTier,
+        onToolDecision: (ev) => telemetry.toolDecision(ev),
+        ...(loadedRules.rules.length > 0
+            ? {
+                permissionRules: loadedRules.rules,
+                rulesUserStateHome: rulesStateHome,
+                rulesProjectRoot: process.cwd(),
+                onRuleVerdict: (ev) => {
+                    logEvent({
+                        source: "permission-rules",
+                        level: "debug",
+                        event: `rule_${ev.verdict}`,
+                        sessionId: env.YAGNI_SESSION_ID ?? undefined,
+                        fields: {
+                            tool: ev.toolName,
+                            via: ev.matchedVia,
+                            source: ev.rule.source,
+                            rule: ev.rule.raw,
+                        },
+                    });
+                },
+            }
+            : {}),
         guardianDisabled,
         childUsage,
         guardianReview: (command, deps) => reviewCommand(command, { ...deps, modelTier: guardianTier }),
         onGuardianReview: (ev) => {
             guardianLogSink(ev);
-            // A malformed verdict is a real failure on our side that must reach
-            // Sentry for EVERY workspace (independent of the opt-in storage tier).
-            // Fire-and-forget to the dedicated telemetry endpoint; fail-soft, and
+            // A malformed verdict (repair FAILED — still really failing) is a real
+            // failure on our side that must reach Sentry for EVERY workspace
+            // (independent of the opt-in storage tier). A REPAIRED verdict (repair
+            // salvaged it) posts too, with outcome "malformed_repaired" so the
+            // backend can count salvage hits on their own Sentry issue. Both
+            // fire-and-forget to the dedicated telemetry endpoint; fail-soft, and
             // suppressed under test/eval so a CI run never phones prod.
-            if (ev.outcome === "malformed" && !evalMode && !runningUnderTest(env)) {
+            const isMalformed = ev.outcome === "malformed";
+            const isRepaired = ev.outcome !== "malformed" && ev.repaired === true;
+            if ((isMalformed || isRepaired) && !evalMode && !runningUnderTest(env)) {
                 void (async () => {
                     try {
                         const body = {
-                            outcome: ev.outcome,
+                            outcome: isRepaired ? "malformed_repaired" : ev.outcome,
                             ...(ev.rawOutput ? { rawOutput: ev.rawOutput } : {}),
                             ...(ev.durationMs !== undefined ? { durationMs: ev.durationMs } : {}),
                             ...(ev.tier ? { tier: ev.tier } : {}),
@@ -410,69 +607,106 @@ export async function registerYagni(pi, deps = {}) {
             if (!evalMode)
                 appendGrant(grant);
         },
+        // persist a user-level allow rule (Guardian ask dialog's third
+        // option). Atomic write, never overwrites other keys, fail-soft.
+        persistUserRule: (ruleString) => {
+            if (evalMode)
+                return;
+            try {
+                const userPath = join(rulesStateHome, "config.json");
+                let parsed = {};
+                if (existsSync(userPath)) {
+                    parsed = JSON.parse(readFileSync(userPath, "utf-8"));
+                    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+                        return;
+                }
+                const perms = (parsed.permissions ?? {});
+                const allow = Array.isArray(perms.allow) ? perms.allow : [];
+                if (!allow.includes(ruleString))
+                    allow.push(ruleString);
+                perms.allow = allow;
+                parsed.permissions = perms;
+                const tmp = join(rulesStateHome, `.config.json.yagni-${process.pid}-${Date.now()}.tmp`);
+                writeFileSync(tmp, `${JSON.stringify(parsed, null, 2)}\n`, { mode: 0o600 });
+                renameSync(tmp, userPath);
+                logEvent({
+                    source: "permission-rules",
+                    level: "info",
+                    event: "user_rule_saved",
+                    sessionId: env.YAGNI_SESSION_ID ?? undefined,
+                    fields: { rule: ruleString },
+                });
+            }
+            catch (err) {
+                logEvent({
+                    source: "permission-rules",
+                    level: "warn",
+                    event: "user_rule_save_failed",
+                    fields: { message: err instanceof Error ? err.message : "unknown" },
+                });
+            }
+        },
         // Opt-in storage stream (YAG-510). Tier decides what leaves the machine:
         // "off" → nothing (not even sent); "hash" → sha256 + family prefix +
         // metadata, no command content; "raw" → adds client-REDACTED command and
         // rationale. Fire-and-forget: one attempt, short timeout, failures logged
         // fail-soft to the unified sink (source:"guardian") — a storage outage
         // never touches the session.
-        onGuardianEvent: guardianStorageTier === "off" || evalMode
-            ? undefined
-            : (ev) => {
-                void (async () => {
-                    try {
-                        const body = {
-                            sessionId: env.YAGNI_SESSION_ID ?? null,
-                            commandHash: createHash("sha256").update(ev.command).digest("hex"),
-                            commandPrefix: storagePrefix(ev.command),
-                            outcome: ev.outcome,
-                            mode: ev.mode,
-                            ...(ev.execJustification ? { execJustification: ev.execJustification } : {}),
-                            ...(ev.riskLevel ? { riskLevel: ev.riskLevel } : {}),
-                            ...(ev.tier ? { tier: ev.tier } : {}),
-                            ...(ev.durationMs !== undefined ? { durationMs: ev.durationMs } : {}),
-                        };
-                        if (guardianStorageTier === "raw") {
-                            body.command = redactCommand(ev.command);
-                            if (ev.rationale)
-                                body.rationale = redactCommand(ev.rationale);
-                        }
-                        const res = await resilientFetch(`${baseUrl}/api/yagni-code/guardian-events`, {
-                            method: "POST",
-                            headers: {
-                                "content-type": "application/json",
-                                authorization: `Bearer ${getTokenFn() ?? ""}`,
-                                ...attributionHeaders(deps.env),
-                            },
-                            body: JSON.stringify(body),
-                        }, {
-                            fetchImpl: authedFetch,
-                            policy: { maxAttempts: 1, backoffBaseMs: 0, backoffMaxMs: 0, timeoutMs: GUARDIAN_EVENT_TIMEOUT_MS, jitterRatio: 0 },
-                        });
-                        if (!res.ok) {
-                            guardianLogSink({ event: "guardian_event_post_failed", status: res.status });
-                        }
+        onGuardianEvent: (ev) => {
+            logGateOutcomeTrail(ev, env);
+            // Opt-in storage stream (YAG-510): tier decides what leaves the machine.
+            if (guardianStorageTier === "off" || evalMode)
+                return;
+            void (async () => {
+                try {
+                    const body = {
+                        sessionId: env.YAGNI_SESSION_ID ?? null,
+                        commandHash: createHash("sha256").update(ev.command).digest("hex"),
+                        commandPrefix: storagePrefix(ev.command),
+                        outcome: ev.outcome,
+                        mode: ev.mode,
+                        ...(ev.execJustification ? { execJustification: ev.execJustification } : {}),
+                        ...(ev.riskLevel ? { riskLevel: ev.riskLevel } : {}),
+                        ...(ev.tier ? { tier: ev.tier } : {}),
+                        ...(ev.durationMs !== undefined ? { durationMs: ev.durationMs } : {}),
+                    };
+                    if (guardianStorageTier === "raw") {
+                        body.command = redactCommand(ev.command);
+                        if (ev.rationale)
+                            body.rationale = redactCommand(ev.rationale);
                     }
-                    catch {
-                        guardianLogSink({
-                            event: "guardian_event_post_failed",
-                            kind: "network",
-                        });
+                    const res = await resilientFetch(`${baseUrl}/api/yagni-code/guardian-events`, {
+                        method: "POST",
+                        headers: {
+                            "content-type": "application/json",
+                            authorization: `Bearer ${getTokenFn() ?? ""}`,
+                            ...attributionHeaders(deps.env),
+                        },
+                        body: JSON.stringify(body),
+                    }, {
+                        fetchImpl: authedFetch,
+                        policy: { maxAttempts: 1, backoffBaseMs: 0, backoffMaxMs: 0, timeoutMs: GUARDIAN_EVENT_TIMEOUT_MS, jitterRatio: 0 },
+                    });
+                    if (!res.ok) {
+                        guardianLogSink({ event: "guardian_event_post_failed", status: res.status });
                     }
-                })();
-            },
-        ...(mcpMutatingTools.length > 0
+                }
+                catch {
+                    guardianLogSink({ event: "guardian_event_post_failed", kind: "network" });
+                }
+            })();
+        },
+        ...(mcpMutatingSet.size > 0 || mcpOutcome.manager
             ? {
                 policy: {
-                    planBlockTools: [
-                        ...DEFAULT_PERMISSION_POLICY.planBlockTools,
-                        ...mcpMutatingTools,
-                    ],
-                    reviewConfirmTools: [
-                        ...DEFAULT_PERMISSION_POLICY.reviewConfirmTools,
-                        ...mcpMutatingTools,
-                    ],
+                    planBlockTools: [...DEFAULT_PERMISSION_POLICY.planBlockTools],
+                    reviewConfirmTools: [...DEFAULT_PERMISSION_POLICY.reviewConfirmTools],
                     alwaysConfirmTools: DEFAULT_PERMISSION_POLICY.alwaysConfirmTools,
+                    // Predicate (not a static spread): matches any registered
+                    // mcp__* tool that startup classified as mutating, including
+                    // tools re-registered after a /mcp reconnect.
+                    isMutating: (toolName) => mcpMutatingSet.has(toolName) ||
+                        (toolName.startsWith("mcp__") && mcpStartupIsMutating(toolName)),
                 },
             }
             : {}),
@@ -693,12 +927,25 @@ export async function registerYagni(pi, deps = {}) {
         try {
             registerCondensedTools(pi, {
                 ...(scratchpadDirPath ? { scratchpadDir: scratchpadDirPath } : {}),
+                // condensed owns the FINAL bash registration (it re-registers
+                // built-ins last), so the sandbox composes INTO it here. Identity when
+                // the sandbox is off.
+                ...(sandboxHandle ? { wrapBash: sandboxHandle.composeBash } : {}),
             });
         }
         catch {
             // Rendering must never break activation; pi's built-ins remain.
         }
     }
+    else if (sandboxHandle && env.YAGNI_CLASSIC_TOOL_ROWS !== "1") {
+        // Condensed inactive (eval mode / desktop): the sandbox's own
+        // registration is the one that reaches the tool registry. NOT under the
+        // classic-rows escape hatch — classic bash must stay pi's stock
+        // registration (the hatch's contract); a competing one would replace
+        // classic rendering with the sandbox's wrap. Desktop/eval still need
+        // the sandbox to reach bash, so the hatch is the one carve-out.
+        sandboxHandle.registerOwnBash();
+    }
     // Own the identity + inject live company context (and repo rules) on every
     // turn. The extension loads identically in every pi process this app spawns —
     // the interactive driver AND every `/go` stage child, subagent, and advisor

package/dist/extension/mcp/approval.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Approval gate for project-scope `.mcp.json` servers, mirroring Claude Code's
+ * decision shape: a `.mcp.json` in the repo (shared, VCS-controlled) cannot
+ * spawn processes until the user has approved it. Choices live in the
+ * per-project entry of `~/.yagni-code/mcp.json` under Claude Code's exact key
+ * names (`enabledMcpjsonServers` / `disabledMcpjsonServers` /
+ * `enableAllProjectMcpServers`), so a decision made in one tool is respected
+ * by the other.
+ */
+import { McpConfigError, UserMcpProjectEntry } from "./config.js";
+export type ProjectApprovalDecision = "enabled" | "disabled" | "undecided";
+export interface ProjectApprovalState {
+    enabledMcpjsonServers: string[];
+    disabledMcpjsonServers: string[];
+    enableAllProjectMcpServers: boolean;
+}
+/** Read the approval state for one project (abs path). Missing file/entry → fresh state. */
+export declare function readProjectApproval(repoRoot: string): {
+    state: ProjectApprovalState;
+    errors: McpConfigError[];
+};
+/** Effective decision for one project-scope server. Undecided by default. */
+export declare function decisionFor(state: ProjectApprovalState, serverName: string): ProjectApprovalDecision;
+/** Which configured project servers await a decision (drives the session-start prompt). */
+export declare function undecidedProjectServers(state: ProjectApprovalState, projectServerNames: string[]): string[];
+/**
+ * Record a decision. `enableAll: true` mirrors Claude Code's "Yes, approve all
+ * project servers in this repo" (sets the blanket flag); a single enable/disable
+ * appends to the corresponding list. Idempotent.
+ */
+export declare function recordProjectDecision(repoRoot: string, serverName: string | "all", decision: "enabled" | "disabled"): {
+    errors: McpConfigError[];
+};
+/** Clear this project's `.mcp.json` decisions (`yagni mcp reset-project-choices`). */
+export declare function resetProjectChoices(repoRoot: string): {
+    errors: McpConfigError[];
+};
+/**
+ * Mutate `~/.yagni-code/mcp.json`'s per-project entry under a read-modify-write
+ * helper shared with CLI commands (add/remove at local scope).
+ */
+export declare function updateProjectEntry(repoRoot: string, mutate: (entry: UserMcpProjectEntry) => void): {
+    errors: McpConfigError[];
+};
+//# sourceMappingURL=approval.d.ts.map