@yagni-app/code 1.0.6 → 1.0.7

package/dist/extension/plugins/panel.js

@@ -0,0 +1,293 @@
+/**
+ * `/plugin` and `/reload-plugins` — Claude Code marketplace plugins managed
+ * from inside a session.
+ *
+ * `/plugin` mirrors Claude Code's panel: the installed inventory (origin,
+ * version, what loads, what is not bridged), the marketplace catalog with
+ * one-keystroke install, and per-plugin uninstall/enable/disable. Every
+ * mutation runs the launcher's `yagni plugin …` (the single owner of the
+ * ledger, trust, and discovery) and then reloads.
+ *
+ * `/reload-plugins` is pi's own `/reload` with the plugin state refreshed
+ * first: MCP servers and agents re-read their env on the new runtime, and
+ * skills/commands of plugins that were not in the launch argv reach pi
+ * through `resources_discover`. Removed plugins stop contributing MCP servers
+ * and agents at once; their skills/commands stay until a restart, and the
+ * summary says so.
+ */
+import { applyEnv, cliPath, defaultCliRunner, discoverPaths, fetchInventory, planReload, storedInventory, } from "./inventory.js";
+const USAGE = [
+    "/plugin                       Browse installed plugins and marketplaces.",
+    "/plugin list                  Show what loads here.",
+    "/plugin install <plugin>[@marketplace] [-s user|project]",
+    "/plugin uninstall <plugin>    (also: enable, disable, update [plugin])",
+    "/plugin marketplace add <owner/repo | git-url | path>   (also: list, update, remove)",
+    "/reload-plugins               Apply plugin changes without restarting.",
+].join("\n");
+const MUTATING = new Set(["install", "add", "uninstall", "remove", "enable", "disable", "update"]);
+export function describePlugin(p) {
+    const parts = [];
+    if (p.skillPaths.length)
+        parts.push(`${p.skillPaths.length} skill dir${p.skillPaths.length === 1 ? "" : "s"}`);
+    if (p.commandPaths.length)
+        parts.push(`${p.commandPaths.length} command dir${p.commandPaths.length === 1 ? "" : "s"}`);
+    if (p.agentDirs.length)
+        parts.push(`${p.agentDirs.length} agent dir${p.agentDirs.length === 1 ? "" : "s"}`);
+    if (p.mcpServers.length)
+        parts.push(`MCP: ${p.mcpServers.join(", ")}`);
+    const origin = p.origin === "yagni" ? "installed via yagni" : p.origin === "claude-code" ? "mirrored from Claude Code" : "from this repo's marketplace";
+    const lines = [`${p.key}${p.version ? `  v${p.version}` : ""}  ${origin}`, `  ${parts.length ? parts.join(" · ") : "nothing loadable"}`];
+    if (p.unsupported.length)
+        lines.push(`  not bridged: ${p.unsupported.join(", ")}`);
+    return lines.join("\n");
+}
+export function renderInventory(inventory, env) {
+    const lines = [];
+    if (inventory.plugins.length === 0) {
+        lines.push("No plugins load here.");
+        lines.push("Add a marketplace with `/plugin marketplace add <owner/repo | git-url | path>`, then `/plugin install <plugin>`.");
+    }
+    else {
+        lines.push(`Plugins (${inventory.plugins.length}):`);
+        for (const p of inventory.plugins)
+            lines.push(describePlugin(p));
+    }
+    if (inventory.pendingTrust.length > 0) {
+        lines.push(`Held back until this folder is trusted: ${inventory.pendingTrust.join(", ")}`);
+    }
+    const stale = staleSince(inventory, env);
+    if (stale.added.length > 0 || stale.removed.length > 0) {
+        lines.push(`Not yet applied to this session: ${[...stale.added.map((k) => `+${k}`), ...stale.removed.map((k) => `-${k}`)].join(", ")} — run /reload-plugins.`);
+    }
+    return lines.join("\n");
+}
+/** Plugins the inventory has that the session does not (and vice versa). */
+function staleSince(inventory, env) {
+    const plan = planReload(inventory, env);
+    return { added: plan.added.map((p) => p.key), removed: plan.removed };
+}
+export function renderReloadSummary(added, removed) {
+    const lines = [];
+    if (added.length === 0 && removed.length === 0) {
+        lines.push("Plugins reloaded — nothing changed since launch.");
+        return lines.join("\n");
+    }
+    if (added.length > 0) {
+        lines.push(`Loaded: ${added.map((p) => p.key).join(", ")}`);
+        const mcp = added.flatMap((p) => p.mcpServers);
+        if (mcp.length > 0)
+            lines.push(`  MCP servers connecting: ${mcp.join(", ")} (see /mcp)`);
+        const commands = added.filter((p) => p.commandPaths.length > 0).map((p) => p.key);
+        if (commands.length > 0)
+            lines.push(`  Commands and skills from ${commands.join(", ")} are available now.`);
+    }
+    if (removed.length > 0) {
+        lines.push(`Removed: ${removed.join(", ")}`);
+        lines.push("  Their MCP servers and agents are gone now; skills and commands stay until you restart (`yagni -c` keeps this conversation).");
+    }
+    return lines.join("\n");
+}
+/** Wire /plugin, /reload-plugins, and the resources_discover contribution. */
+export function registerPluginPanel(pi, deps = {}) {
+    const env = deps.env ?? process.env;
+    const runCli = deps.runCli ?? defaultCliRunner;
+    // Skills/prompts of plugins that arrived via /reload-plugins: pi re-runs
+    // this on every reload and session start, so they persist for the process.
+    pi.on("resources_discover", async () => discoverPaths(env));
+    async function runPlugin(args, cwd, ui) {
+        const path = cliPath(env);
+        if (!path) {
+            ui.notify("Plugin management needs the yagni launcher (YAGNI_CLI_PATH is unset in this session). Run `yagni plugin …` in a terminal.", "warning");
+            return false;
+        }
+        const result = await runCli(["plugin", ...args], { cliPath: path, cwd, env });
+        const out = result.stdout.trim();
+        const err = result.stderr.trim();
+        if (result.code === 0) {
+            if (out)
+                ui.notify(out, "info");
+            if (err)
+                ui.notify(err, "warning");
+            return true;
+        }
+        ui.notify(err || out || `yagni plugin ${args.join(" ")} failed (exit ${result.code})`, "error");
+        return false;
+    }
+    async function reload(ctx) {
+        let inventory;
+        try {
+            inventory = await fetchInventory({ cwd: ctx.cwd, env, runCli });
+        }
+        catch (err) {
+            ctx.ui.notify(`Could not read the plugin inventory — ${err instanceof Error ? err.message : String(err)}`, "error");
+            return;
+        }
+        const plan = planReload(inventory, env);
+        applyEnv(env, plan.env);
+        ctx.ui.notify(renderReloadSummary(plan.added, plan.removed), "info");
+        // Treat reload as terminal for this handler (pi docs): the runtime that
+        // registered us is torn down and re-created from the rewritten env.
+        await ctx.reload();
+    }
+    async function listing(ctx) {
+        try {
+            const inventory = await fetchInventory({ cwd: ctx.cwd, env, runCli });
+            return inventory;
+        }
+        catch (err) {
+            ctx.ui.notify(err instanceof Error ? err.message : String(err), "error");
+            return null;
+        }
+    }
+    pi.registerCommand("reload-plugins", {
+        description: "Apply plugin installs/removals to this session without restarting.",
+        handler: async (_args, ctx) => {
+            await reload(ctx);
+        },
+    });
+    pi.registerCommand("plugin", {
+        description: "Manage Claude Code plugins: browse marketplaces, install, uninstall, enable/disable.",
+        handler: async (args, rawCtx) => {
+            const ctx = rawCtx;
+            const sub = args.trim().split(/\s+/).filter(Boolean);
+            const [verb] = sub;
+            if (verb === "help" || verb === "--help" || verb === "-h") {
+                ctx.ui.notify(USAGE, "info");
+                return;
+            }
+            if (verb === "list" || (!verb && !ctx.hasUI)) {
+                const inventory = await listing(ctx);
+                if (inventory)
+                    ctx.ui.notify(renderInventory(inventory, env), "info");
+                return;
+            }
+            if (!verb) {
+                await interactive(ctx);
+                return;
+            }
+            if (verb === "reload") {
+                await reload(ctx);
+                return;
+            }
+            // Everything else is the CLI's grammar verbatim (install, uninstall,
+            // enable, disable, update, marketplace …); mutations reload afterwards.
+            const ok = await runPlugin(sub, ctx.cwd, ctx.ui);
+            const mutates = MUTATING.has(verb) || (verb === "marketplace" && sub[1] !== "list");
+            if (ok && mutates)
+                await reload(ctx);
+        },
+    });
+    async function interactive(ctx) {
+        const inventory = await listing(ctx);
+        if (!inventory)
+            return;
+        const choice = await ctx.ui.select("Plugins", [`Installed plugins (${inventory.plugins.length})`, "Browse marketplaces", "Update all", "Reload plugins", "Exit"], ctx.signal ? { signal: ctx.signal } : undefined);
+        if (!choice || choice === "Exit")
+            return;
+        if (choice.startsWith("Installed")) {
+            await installedMenu(ctx, inventory);
+            return;
+        }
+        if (choice === "Browse marketplaces") {
+            await browseMenu(ctx, inventory);
+            return;
+        }
+        if (choice === "Update all") {
+            if (await runPlugin(["update"], ctx.cwd, ctx.ui))
+                await reload(ctx);
+            return;
+        }
+        if (choice === "Reload plugins") {
+            await reload(ctx);
+            return;
+        }
+    }
+    async function installedMenu(ctx, inventory) {
+        if (inventory.plugins.length === 0) {
+            ctx.ui.notify(renderInventory(inventory, env), "info");
+            return;
+        }
+        const options = inventory.plugins.map((p) => `${p.key}${p.version ? ` · v${p.version}` : ""}`);
+        const choice = await ctx.ui.select("Installed plugins", [...options, "Back"], ctx.signal ? { signal: ctx.signal } : undefined);
+        if (!choice || choice === "Back")
+            return;
+        const plugin = inventory.plugins[options.indexOf(choice)];
+        if (!plugin)
+            return;
+        const actions = ["View details"];
+        if (plugin.origin === "yagni")
+            actions.push("Uninstall", "Disable");
+        actions.push("Back");
+        const action = await ctx.ui.select(describePlugin(plugin).split("\n")[0], actions, ctx.signal ? { signal: ctx.signal } : undefined);
+        if (!action || action === "Back")
+            return;
+        if (action === "View details") {
+            ctx.ui.notify(describePlugin(plugin), "info");
+            return;
+        }
+        if (action === "Uninstall") {
+            if (await runPlugin(["uninstall", plugin.key], ctx.cwd, ctx.ui))
+                await reload(ctx);
+            return;
+        }
+        if (action === "Disable") {
+            if (await runPlugin(["disable", plugin.key], ctx.cwd, ctx.ui))
+                await reload(ctx);
+        }
+    }
+    async function browseMenu(ctx, inventory) {
+        const path = cliPath(env);
+        if (!path) {
+            ctx.ui.notify("Plugin management needs the yagni launcher (YAGNI_CLI_PATH is unset in this session).", "warning");
+            return;
+        }
+        const result = await runCli(["plugin", "list", "--available"], { cliPath: path, cwd: ctx.cwd, env });
+        const catalog = parseCatalog(result.stdout);
+        if (catalog.length === 0) {
+            ctx.ui.notify(result.stdout.trim() || "No marketplaces added. Use `/plugin marketplace add <owner/repo | git-url | path>`.", "info");
+            return;
+        }
+        const installed = new Set(inventory.plugins.map((p) => p.key));
+        const entries = catalog.flatMap((mp) => mp.plugins.map((p) => ({ key: `${p.name}@${mp.name}`, label: `${p.name}@${mp.name}${p.version ? ` · v${p.version}` : ""}${installed.has(`${p.name}@${mp.name}`) ? "  (installed)" : ""}${p.installable ? "" : "  (remote source, not installable)"}` })));
+        const choice = await ctx.ui.select("Marketplace plugins", [...entries.map((e) => e.label), "Back"], ctx.signal ? { signal: ctx.signal } : undefined);
+        if (!choice || choice === "Back")
+            return;
+        const entry = entries[entries.map((e) => e.label).indexOf(choice)];
+        if (!entry)
+            return;
+        const scope = await ctx.ui.select(`Install ${entry.key}`, ["For all my projects (user)", "Only this repo (project)", "Back"], ctx.signal ? { signal: ctx.signal } : undefined);
+        if (!scope || scope === "Back")
+            return;
+        const args = ["install", entry.key, ...(scope.includes("project") ? ["-s", "project"] : [])];
+        if (await runPlugin(args, ctx.cwd, ctx.ui))
+            await reload(ctx);
+    }
+}
+/**
+ * Parse `yagni plugin list --available` text (the CLI's stable, tested
+ * shape: `<marketplace>:` headers, then `  <name>  v<ver>  [flags]` lines).
+ */
+export function parseCatalog(text) {
+    const out = [];
+    let current = null;
+    for (const raw of text.split("\n")) {
+        const header = /^(\S.*):$/.exec(raw);
+        if (header) {
+            current = { name: header[1], plugins: [] };
+            out.push(current);
+            continue;
+        }
+        const entry = /^  (\S+)(?:\s+v(\S+))?(?:\s+\[([^\]]*)\])?\s*$/.exec(raw);
+        if (entry && current) {
+            current.plugins.push({
+                name: entry[1],
+                version: entry[2] ?? null,
+                installable: !(entry[3] ?? "").includes("not installable"),
+            });
+        }
+    }
+    return out;
+}
+/** Exported for tests: the current stored inventory, if a reload happened. */
+export { storedInventory };
+//# sourceMappingURL=panel.js.map

package/dist/extension/sandbox/bash.d.ts

@@ -0,0 +1,99 @@
+/**
+ * Bash-tool sandbox wiring: decides whether a bash command runs
+ * sandboxed, and provides the spawnHook that wraps the command with the OS
+ * sandbox (srt) while pi's local exec backend keeps owning process
+ * lifecycle, timeout, and abort handling.
+ *
+ * The wrap uses pi's BashToolOptions.spawnHook (command/cwd/env rewrite
+ * before spawn) rather than replacing BashOperations wholesale — pi's
+ * battle-tested exec backend stays in charge; only the command string and
+ * proxy env change. user_bash (! commands) routes through the same wrap.
+ *
+ `dangerouslyDisableSandbox` mirrors Claude Code's bash tool parameter: the
+ * model may set it when it has evidence a sandbox restriction caused a
+ * failure; the parameter NEVER skips the permission gate (gate.ts routes the
+ * retry through the normal execPolicy/Guardian flow) — it only skips the OS
+ * wrap, and only when sandbox.allowUnsandboxedCommands is true.
+ *
+ * Child-process stdio-grace handling derived from pi-sandbox (MIT,
+ * carderne/pi-sandbox src/sandbox-runtime.ts) — not needed here because pi's
+ * local backend owns the child; the reference is credited for the operational
+ * lessons (process-group kill, stdio release).
+ */
+import type { BashSpawnHook, BashToolInput } from "@earendil-works/pi-coding-agent";
+import type { YagniSandboxManager } from "./manager.js";
+import type { SandboxSettings } from "./config.js";
+export interface SandboxBashInput extends BashToolInput {
+    /** Claude Code parity: model-requested unsandboxed retry. */
+    dangerouslyDisableSandbox?: boolean;
+}
+/**
+ * Does an excludedCommands pattern match any segment of the command?
+ * (Compound-aware: "echo hi && docker ps" must not ride an "echo:*" exclude.)
+ */
+export declare function commandHasExcludedSegment(command: string, excludedPatterns: readonly string[]): boolean;
+/**
+ * Should this bash tool call run inside the OS sandbox?
+ * Pure — reads the decision inputs, no I/O.
+ */
+export declare function shouldUseSandbox(input: Pick<SandboxBashInput, "command" | "dangerouslyDisableSandbox">, manager: Pick<YagniSandboxManager, "initialized">, settings: Pick<SandboxSettings, "allowUnsandboxedCommands" | "excludedCommands">): boolean;
+/**
+ * Build the spawnHook that wraps the command with the sandbox. The hook is
+ * async-ignoring by design: spawnHook is sync in pi's interface, so the
+ * command wrap must already be resolved — use preWrappedCommand() below to
+ * pre-wrap and stash, or build the hook from a pre-wrapped string.
+ *
+ * In practice we pre-wrap in tool_call (async, where we can await the wrap)
+ * by mutating event.input.command to the wrapped string, and the spawnHook
+ * only injects proxy env. That keeps a single code path for tool calls.
+ */
+/**
+ * Env additions every sandboxed process needs (srt injects proxy vars into
+ * the WRAPPED command's env; the spawnHook passes them through).
+ */
+export declare function sandboxSpawnEnv(manager: YagniSandboxManager): Record<string, string>;
+/**
+ * spawnHook for the sandboxed bash tool: injects proxy-support env vars.
+ * The command itself was already wrapped (pre-wrap in tool_call, async).
+ */
+export declare function makeSandboxSpawnHook(manager: YagniSandboxManager): BashSpawnHook;
+/**
+ * Wrap a raw command for OS-sandboxed execution. Returns the original string
+ * when the manager is not initialized (fail-open to plain execution — the
+ * permission gate still ran; the sandbox simply is not active).
+ */
+export declare function preWrappedCommand(manager: YagniSandboxManager, command: string, binShell?: string): Promise<string>;
+/**
+ * Detect "Operation not permitted" style sandbox denials in bash output so
+ * callers (tool_result) can annotate and the model can react. Returns the
+ * offending path when found (pi-sandbox's regex, credited MIT).
+ */
+export declare function extractBlockedWritePath(output: string): string | null;
+/**
+ * Wrap decision for user_bash (! commands): same rules as the tool, minus
+ * the dangerouslyDisableSandbox parameter (users running ! commands are
+ * already the principal, not the model).
+ */
+export declare function shouldUseSandboxForUserCommand(command: string, manager: Pick<YagniSandboxManager, "initialized">, settings: Pick<SandboxSettings, "excludedCommands">): boolean;
+/**
+ * Post-execution violation annotation: annotate a command's combined output
+ * with sandbox violation details when the sandbox is active. Returns the
+ * annotated output (or the original when nothing to annotate).
+ */
+export declare function annotateCommandOutput(manager: YagniSandboxManager, command: string, output: string): string;
+/** cwd must exist before spawn (guard borrowed from pi's local ops). */
+export declare function assertSpawnableCwd(cwd: string): void;
+/**
+ * The gate's sandbox auto-allow decision — the production predicate index.ts
+ * wires into registerPermissionGate's sandboxAutoAllow dep. Exported so the
+ * precedence table is pinned by real tests, not mirrored tautologies.
+ *
+ * Declines (returns false): non-bash tools, autoAllow disabled by setting,
+ * manager not initialized, empty command, and — critically —
+ * dangerouslyDisableSandbox retries that will run UNSANDBOXED (they must pay
+ * the normal permission price; only strict-mode-forced sandboxing rides the
+ * auto-allow). Otherwise: shouldUseSandbox's decision (excludedCommands
+ * included — an excluded command runs unsandboxed through the ordinary flow).
+ */
+export declare function sandboxAutoAllowDecision(toolName: string, params: Record<string, unknown>, manager: Pick<YagniSandboxManager, "initialized">, settings: Pick<SandboxSettings, "autoAllowBashIfSandboxed" | "allowUnsandboxedCommands" | "excludedCommands">): boolean;
+//# sourceMappingURL=bash.d.ts.map

package/dist/extension/sandbox/bash.js

@@ -0,0 +1,190 @@
+/**
+ * Bash-tool sandbox wiring: decides whether a bash command runs
+ * sandboxed, and provides the spawnHook that wraps the command with the OS
+ * sandbox (srt) while pi's local exec backend keeps owning process
+ * lifecycle, timeout, and abort handling.
+ *
+ * The wrap uses pi's BashToolOptions.spawnHook (command/cwd/env rewrite
+ * before spawn) rather than replacing BashOperations wholesale — pi's
+ * battle-tested exec backend stays in charge; only the command string and
+ * proxy env change. user_bash (! commands) routes through the same wrap.
+ *
+ `dangerouslyDisableSandbox` mirrors Claude Code's bash tool parameter: the
+ * model may set it when it has evidence a sandbox restriction caused a
+ * failure; the parameter NEVER skips the permission gate (gate.ts routes the
+ * retry through the normal execPolicy/Guardian flow) — it only skips the OS
+ * wrap, and only when sandbox.allowUnsandboxedCommands is true.
+ *
+ * Child-process stdio-grace handling derived from pi-sandbox (MIT,
+ * carderne/pi-sandbox src/sandbox-runtime.ts) — not needed here because pi's
+ * local backend owns the child; the reference is credited for the operational
+ * lessons (process-group kill, stdio release).
+ */
+import { existsSync } from "node:fs";
+function stripLeadingSafeEnvVars(command) {
+    // Best-effort normalization for excludedCommands matching (not a security
+    // boundary — the permission gate is). Strips leading VAR=val pairs whose
+    // name can't affect binary resolution.
+    const SAFE = /^[A-Z_][A-Z0-9_]*=(?:[A-Za-z0-9_@./:+~-]+|"[^"\n]*"|'[^'\n]*')/;
+    let out = command.trimStart();
+    for (;;) {
+        const m = out.match(SAFE);
+        if (!m)
+            return out;
+        out = out.slice(m[0].length).trimStart();
+    }
+}
+function commandSegments(command) {
+    // Split on shell separators for excludedCommands matching against compound
+    // commands. Deliberately naive (no quote-awareness beyond the safe-env
+    // strip): excludedCommands is a convenience, never a security boundary.
+    // & (background) joins ;, &&, ||, | — a compound rider must not smuggle an
+    // excluded command's segment past the match.
+    return command
+        .split(/(?:\n|&&|\|\||;|\||&)/)
+        .map((s) => stripLeadingSafeEnvVars(s).trim())
+        .filter(Boolean);
+}
+function matchesExcludedPattern(pattern, candidate) {
+    if (pattern.endsWith(":*")) {
+        const prefix = pattern.slice(0, -2);
+        return candidate === prefix || candidate.startsWith(prefix + " ");
+    }
+    return candidate === pattern;
+}
+/**
+ * Does an excludedCommands pattern match any segment of the command?
+ * (Compound-aware: "echo hi && docker ps" must not ride an "echo:*" exclude.)
+ */
+export function commandHasExcludedSegment(command, excludedPatterns) {
+    if (excludedPatterns.length === 0)
+        return false;
+    const segments = commandSegments(command);
+    return segments.some((seg) => excludedPatterns.some((p) => matchesExcludedPattern(p, seg)));
+}
+/**
+ * Should this bash tool call run inside the OS sandbox?
+ * Pure — reads the decision inputs, no I/O.
+ */
+export function shouldUseSandbox(input, manager, settings) {
+    if (!manager.initialized)
+        return false;
+    if (!input.command)
+        return false;
+    if (input.dangerouslyDisableSandbox && settings.allowUnsandboxedCommands !== false)
+        return false;
+    if (commandHasExcludedSegment(input.command, settings.excludedCommands ?? []))
+        return false;
+    return true;
+}
+/**
+ * Build the spawnHook that wraps the command with the sandbox. The hook is
+ * async-ignoring by design: spawnHook is sync in pi's interface, so the
+ * command wrap must already be resolved — use preWrappedCommand() below to
+ * pre-wrap and stash, or build the hook from a pre-wrapped string.
+ *
+ * In practice we pre-wrap in tool_call (async, where we can await the wrap)
+ * by mutating event.input.command to the wrapped string, and the spawnHook
+ * only injects proxy env. That keeps a single code path for tool calls.
+ */
+/**
+ * Env additions every sandboxed process needs (srt injects proxy vars into
+ * the WRAPPED command's env; the spawnHook passes them through).
+ */
+export function sandboxSpawnEnv(manager) {
+    const env = {};
+    // Node >= 22.21 / >= 24: make undici honor proxy env vars, so fetch() in
+    // sandboxed node processes routes through the srt proxy like curl/git do.
+    const [major, minor] = process.versions.node.split(".").map(Number);
+    if ((major === 22 && minor >= 21) || major >= 24) {
+        env.NODE_USE_ENV_PROXY = "1";
+    }
+    return env;
+}
+/**
+ * spawnHook for the sandboxed bash tool: injects proxy-support env vars.
+ * The command itself was already wrapped (pre-wrap in tool_call, async).
+ */
+export function makeSandboxSpawnHook(manager) {
+    const extraEnv = sandboxSpawnEnv(manager);
+    return (ctx) => ({
+        ...ctx,
+        env: { ...ctx.env, ...extraEnv },
+    });
+}
+/**
+ * Wrap a raw command for OS-sandboxed execution. Returns the original string
+ * when the manager is not initialized (fail-open to plain execution — the
+ * permission gate still ran; the sandbox simply is not active).
+ */
+export async function preWrappedCommand(manager, command, binShell) {
+    if (!manager.initialized)
+        return command;
+    return manager.wrapWithSandbox(command, binShell);
+}
+/**
+ * Detect "Operation not permitted" style sandbox denials in bash output so
+ * callers (tool_result) can annotate and the model can react. Returns the
+ * offending path when found (pi-sandbox's regex, credited MIT).
+ */
+export function extractBlockedWritePath(output) {
+    const match = output.match(/(?:\/bin\/bash|bash|sh): (?:line \d+: )?(\/[^\s:]+): Operation not permitted/);
+    return match ? match[1] : null;
+}
+/**
+ * Wrap decision for user_bash (! commands): same rules as the tool, minus
+ * the dangerouslyDisableSandbox parameter (users running ! commands are
+ * already the principal, not the model).
+ */
+export function shouldUseSandboxForUserCommand(command, manager, settings) {
+    if (!manager.initialized)
+        return false;
+    if (!command)
+        return false;
+    return !commandHasExcludedSegment(command, settings.excludedCommands ?? []);
+}
+/**
+ * Post-execution violation annotation: annotate a command's combined output
+ * with sandbox violation details when the sandbox is active. Returns the
+ * annotated output (or the original when nothing to annotate).
+ */
+export function annotateCommandOutput(manager, command, output) {
+    if (!manager.initialized)
+        return output;
+    if (!output.includes("Operation not permitted"))
+        return output;
+    return manager.annotateStderrWithSandboxFailures(command, output);
+}
+/** cwd must exist before spawn (guard borrowed from pi's local ops). */
+export function assertSpawnableCwd(cwd) {
+    if (!existsSync(cwd))
+        throw new Error(`Working directory does not exist: ${cwd}`);
+}
+/**
+ * The gate's sandbox auto-allow decision — the production predicate index.ts
+ * wires into registerPermissionGate's sandboxAutoAllow dep. Exported so the
+ * precedence table is pinned by real tests, not mirrored tautologies.
+ *
+ * Declines (returns false): non-bash tools, autoAllow disabled by setting,
+ * manager not initialized, empty command, and — critically —
+ * dangerouslyDisableSandbox retries that will run UNSANDBOXED (they must pay
+ * the normal permission price; only strict-mode-forced sandboxing rides the
+ * auto-allow). Otherwise: shouldUseSandbox's decision (excludedCommands
+ * included — an excluded command runs unsandboxed through the ordinary flow).
+ */
+export function sandboxAutoAllowDecision(toolName, params, manager, settings) {
+    if (toolName !== "bash")
+        return false;
+    if (settings.autoAllowBashIfSandboxed === false)
+        return false;
+    if (!manager.initialized)
+        return false;
+    const command = typeof params.command === "string" ? params.command : "";
+    if (!command)
+        return false;
+    const retryUnsandboxed = params.dangerouslyDisableSandbox === true && settings.allowUnsandboxedCommands !== false;
+    if (retryUnsandboxed)
+        return false;
+    return shouldUseSandbox({ command, dangerouslyDisableSandbox: params.dangerouslyDisableSandbox === true }, manager, settings);
+}
+//# sourceMappingURL=bash.js.map