@yagni-app/code 1.0.6 → 1.0.8

package/dist/extension/sandbox/panel.js

@@ -0,0 +1,342 @@
+/**
+ * /sandbox interactive TUI panel — mirrors Claude Code's SandboxSettings
+ * tabs (Mode / Overrides / Config, plus Dependencies when checkDependencies
+ * reports errors). Rendered via ctx.ui.custom() in TUI mode; RPC/headless
+ * keeps the text summary (custom() is unavailable there).
+ *
+ * Structure follows Claude's components (SandboxSettings/SandboxModeTab/
+ * SandboxOverridesTab/SandboxConfigTab): tabs switched with left/right,
+ * SelectList-driven option tabs, read-only config tab, off-state
+ * placeholders on Overrides/Config. Copy mirrors Claude's where the
+ * mechanism is identical; persistence deviates deliberately (see
+ * persistSandboxMode in session.ts) until the project-local settings tier
+ * lands.
+ *
+ * Input contract (verified against pi's interactive mode): pi focuses the
+ * ROOT component and calls only root.handleInput(data). Children without
+ * their own handleInput (Box, Text) are never consulted — so the panel
+ * keeps a direct reference to the active SelectList and forwards keys to
+ * it. A Box wrapper does NOT forward input.
+ */
+import { Box, Container, HStack, Key, SelectList, Text, matchesKey, } from "@earendil-works/pi-tui";
+import { mergeRulesIntoSandbox } from "./config.js";
+// ---------------------------------------------------------------------------
+// Pure derivation helpers (unit-tested; no TUI dependency)
+// ---------------------------------------------------------------------------
+/** Current mode derived from resolved settings (Claude's currentMode). */
+export function deriveCurrentMode(settings, sessionToggledOff) {
+    if (!settings.enabled || sessionToggledOff)
+        return "disabled";
+    return settings.autoAllowBashIfSandboxed !== false ? "auto-allow" : "regular";
+}
+export function deriveCurrentOverride(settings) {
+    return settings.allowUnsandboxedCommands !== false ? "open" : "closed";
+}
+export function modeOptions(current) {
+    return [
+        { value: "auto-allow", label: `Sandbox BashTool, with auto-allow${current === "auto-allow" ? " (current)" : ""}` },
+        { value: "regular", label: `Sandbox BashTool, with regular permissions${current === "regular" ? " (current)" : ""}` },
+        { value: "disabled", label: `No Sandbox${current === "disabled" ? " (current)" : ""}` },
+    ];
+}
+export function overrideOptions(current) {
+    return [
+        { value: "open", label: `Allow unsandboxed fallback${current === "open" ? " (current)" : ""}` },
+        { value: "closed", label: `Strict sandbox mode${current === "closed" ? " (current)" : ""}` },
+    ];
+}
+/** Per-mode explanation (Claude's copy, adapted to our surfaces). */
+export function modeExplanation(mode) {
+    switch (mode) {
+        case "auto-allow":
+            return "Bash commands run inside the OS sandbox and are auto-allowed; explicit deny/ask permission rules still win. Writes stay confined to the workspace and /tmp; network follows the domain allowlist.";
+        case "regular":
+            return "Bash commands run inside the OS sandbox, but each command still goes through the normal permission flow (sandboxed execution is not auto-allowed).";
+        case "disabled":
+            return "No OS-level sandbox. Bash commands run through the ordinary permission system only.";
+    }
+}
+export function overrideExplanation(choice) {
+    return choice === "open"
+        ? "When a command fails due to sandbox restrictions, the agent can retry with dangerouslyDisableSandbox to run outside the sandbox (falling back to default permissions)."
+        : "All bash commands invoked by the model must run in the sandbox unless they are explicitly listed in excludedCommands.";
+}
+export function configSections(state) {
+    const { settings, merge } = state;
+    const sections = [];
+    const excluded = settings.excludedCommands ?? [];
+    sections.push({
+        title: "Excluded Commands",
+        detail: [excluded.length > 0 ? excluded.join(", ") : "None"],
+    });
+    if (merge.filesystem.denyRead.length > 0) {
+        const detail = [`Denied: ${merge.filesystem.denyRead.join(", ")}`];
+        if (merge.filesystem.allowRead.length > 0)
+            detail.push(`Allowed within denied: ${merge.filesystem.allowRead.join(", ")}`);
+        sections.push({ title: "Filesystem Read Restrictions", detail });
+    }
+    if (merge.filesystem.allowWrite.length > 0) {
+        const detail = [`Allowed: ${merge.filesystem.allowWrite.join(", ")}`];
+        if (merge.filesystem.denyWrite.length > 0)
+            detail.push(`Denied within allowed: ${merge.filesystem.denyWrite.join(", ")}`);
+        sections.push({ title: "Filesystem Write Restrictions", detail });
+    }
+    if (merge.network.allowedDomains.length > 0 || merge.network.deniedDomains.length > 0) {
+        const detail = [];
+        if (merge.network.allowedDomains.length > 0)
+            detail.push(`Allowed: ${merge.network.allowedDomains.join(", ")}`);
+        if (merge.network.deniedDomains.length > 0)
+            detail.push(`Denied: ${merge.network.deniedDomains.join(", ")}`);
+        sections.push({ title: "Network Restrictions", detail });
+    }
+    const unixSockets = settings.network?.allowUnixSockets ?? [];
+    if (unixSockets.length > 0)
+        sections.push({ title: "Allowed Unix Sockets", detail: [unixSockets.join(", ")] });
+    if (state.sessionGrants.length > 0) {
+        sections.push({ title: "Session Grants (memory-only)", detail: [state.sessionGrants.join(", ")] });
+    }
+    return sections;
+}
+/** Tabs offered, mirroring Claude: Dependencies appears only on errors. */
+export function panelTabs(dependencyErrors) {
+    const tabs = ["mode", "overrides", "config"];
+    if (dependencyErrors.length > 0)
+        tabs.push("dependencies");
+    return tabs;
+}
+// ---------------------------------------------------------------------------
+// TUI component
+// ---------------------------------------------------------------------------
+const TAB_LABELS = {
+    mode: "Mode",
+    overrides: "Overrides",
+    config: "Config",
+    dependencies: "Dependencies",
+};
+/** Horizontal breathing room for panel content — the same left/right
+ * margin the footer chip uses. The border lines span the full width;
+ * everything between them is inset by this. */
+const CONTENT_PADDING_X = 2;
+function selectListTheme(theme) {
+    return {
+        selectedPrefix: (t) => theme.fg("accent", t),
+        selectedText: (t) => theme.fg("accent", t),
+        description: (t) => theme.fg("muted", t),
+        scrollInfo: (t) => theme.fg("muted", t),
+        noMatch: (t) => theme.fg("muted", t),
+    };
+}
+/** Full-width border line (the house DynamicBorder pattern, color fn passed
+ * explicitly — extensions never read pi's global theme). */
+class Border {
+    color;
+    constructor(color) {
+        this.color = color;
+    }
+    render(width) {
+        return [this.color("─".repeat(Math.max(1, width)))];
+    }
+    invalidate() { }
+}
+/**
+ * The /sandbox panel. Structure: top border · tab strip · blank · tab
+ * content · blank · footer · bottom border. pi focuses this root and calls
+ * its handleInput; the panel forwards keys to the active tab's SelectList
+ * (when one exists) and switches tabs on left/right.
+ */
+export class SandboxPanel extends Container {
+    state;
+    actions;
+    theme;
+    done;
+    activeTab;
+    tabs;
+    /** The active tab's SelectList (mode/overrides) or null (config/deps) —
+     * input forwards here. */
+    activeList = null;
+    /** Padded content frame; children[0] = tab strip, children[1] = body. */
+    content;
+    constructor(state, actions, theme, done) {
+        super();
+        this.state = state;
+        this.actions = actions;
+        this.theme = theme;
+        this.done = done;
+        this.tabs = panelTabs(state.dependencyErrors);
+        this.activeTab = this.tabs[0];
+        this.content = new Box(CONTENT_PADDING_X, 0);
+        this.content.addChild(new Text("", 0, 0)); // tab strip placeholder
+        this.content.addChild(new Text("", 0, 0)); // body placeholder
+        this.addChild(new Border((s) => theme.fg("borderMuted", s)));
+        this.addChild(this.content);
+        this.addChild(new Border((s) => theme.fg("borderMuted", s)));
+        this.setTab(this.activeTab);
+    }
+    setTab(tab) {
+        this.activeTab = tab;
+        const t = this.theme;
+        const parts = this.tabs.map((candidate) => {
+            const active = candidate === tab;
+            return t.fg(active ? "accent" : "muted", `${active ? "[" : " "}${TAB_LABELS[candidate]}${active ? "]" : " "}`);
+        });
+        const strip = new HStack();
+        strip.addChild(new Text(parts.join(""), 0, 1));
+        this.content.children[0] = strip;
+        this.content.children[1] = this.buildBody();
+        this.invalidate();
+    }
+    buildBody() {
+        const wrap = new Container();
+        wrap.addChild(this.buildTabContent());
+        // Footer on its own line with a top margin — a distinct element, and
+        // consistent across every tab.
+        wrap.addChild(new Text(this.theme.fg("muted", "left/right to switch tabs · up/down to navigate · Enter to select · Esc to close"), 0, 1));
+        return wrap;
+    }
+    buildTabContent() {
+        const t = this.theme;
+        switch (this.activeTab) {
+            case "mode":
+                return this.buildModeTab();
+            case "overrides":
+                return this.buildOverridesTab();
+            case "config":
+                return this.buildConfigTab();
+            case "dependencies":
+                return this.buildDependenciesTab();
+        }
+    }
+    buildModeTab() {
+        const t = this.theme;
+        const current = deriveCurrentMode(this.state.settings, this.state.sessionToggledOff);
+        const options = modeOptions(current);
+        const list = new SelectList(options, 10, selectListTheme(t));
+        const preselect = options.findIndex((o) => o.value === current);
+        if (preselect >= 0)
+            list.setSelectedIndex(preselect);
+        // Top margin (paddingY=1 + the container's separator) separates the
+        // explanation from the option list — it's a distinct element and reads
+        // too tight flush to it.
+        const explanation = new Text(t.fg("muted", modeExplanation(current)), 0, 1);
+        list.onSelectionChange = (item) => {
+            explanation.setText(t.fg("muted", modeExplanation(item.value)));
+            this.invalidate();
+        };
+        list.onSelect = (item) => {
+            // The outcome (confirmation or write-failure) rides done() out of the
+            // panel; the session notifies it once custom() resolves — Claude's
+            // onComplete(message) flow. It must NOT be dropped here.
+            void this.actions
+                .onModeSelect(item.value)
+                .then((outcome) => this.done(outcome))
+                .catch(() => this.done());
+        };
+        list.onCancel = () => this.done();
+        this.activeList = list;
+        const wrap = new Container();
+        wrap.addChild(new Text(t.bold("Configure mode:"), 0, 0));
+        wrap.addChild(list);
+        wrap.addChild(explanation);
+        return wrap;
+    }
+    buildOverridesTab() {
+        const t = this.theme;
+        if (!this.state.settings.enabled) {
+            this.activeList = null;
+            return new Text(t.fg("muted", "Sandbox is not enabled. Enable sandbox to configure override settings."), 0, 0);
+        }
+        const current = deriveCurrentOverride(this.state.settings);
+        const options = overrideOptions(current);
+        const list = new SelectList(options, 10, selectListTheme(t));
+        const preselect = options.findIndex((o) => o.value === current);
+        if (preselect >= 0)
+            list.setSelectedIndex(preselect);
+        const explanation = new Text(t.fg("muted", overrideExplanation(current)), 0, 1);
+        list.onSelectionChange = (item) => {
+            explanation.setText(t.fg("muted", overrideExplanation(item.value)));
+            this.invalidate();
+        };
+        list.onSelect = (item) => {
+            void this.actions
+                .onOverrideSelect(item.value)
+                .then((outcome) => this.done(outcome))
+                .catch(() => this.done());
+        };
+        list.onCancel = () => this.done();
+        this.activeList = list;
+        const wrap = new Container();
+        wrap.addChild(new Text(t.bold("Configure Overrides:"), 0, 0));
+        wrap.addChild(list);
+        wrap.addChild(explanation);
+        return wrap;
+    }
+    buildConfigTab() {
+        const t = this.theme;
+        this.activeList = null;
+        if (!this.state.settings.enabled) {
+            const lines = [t.fg("muted", "Sandbox is not enabled")];
+            for (const w of this.state.dependencyWarnings)
+                lines.push(t.fg("muted", w));
+            return new Text(lines.join("\n"), 0, 0);
+        }
+        // One block per section, bold title + muted detail lines, with a blank
+        // line between sections — a structured read, not one dense paragraph.
+        // Sections are one Text block each (bold title + detail lines), and
+        // Text(paddingY) pads ABOVE and below — so section 1 stays flush and
+        // every later section carries the blank-line separation. No doubling:
+        // Container adds no separator of its own.
+        const wrap = new Container();
+        let first = true;
+        for (const section of configSections(this.state)) {
+            const block = [t.bold(section.title), ...section.detail.map((d) => t.fg("muted", d))].join("\n");
+            wrap.addChild(new Text(block, 0, first ? 0 : 1));
+            first = false;
+        }
+        if (this.state.dependencyWarnings.length > 0) {
+            wrap.addChild(new Text(this.state.dependencyWarnings.map((w) => t.fg("warning", w)).join("\n"), 0, 1));
+        }
+        return wrap;
+    }
+    buildDependenciesTab() {
+        const t = this.theme;
+        this.activeList = null;
+        const lines = this.state.dependencyErrors.map((e) => t.fg("error", e));
+        lines.push(...this.state.dependencyWarnings.map((w) => t.fg("warning", w)));
+        return new Text(lines.join("\n"), 0, 0);
+    }
+    handleInput(data) {
+        // Tab switching first — works from every tab (Claude's </> + arrows).
+        if (matchesKey(data, Key.left) || matchesKey(data, "<")) {
+            const i = this.tabs.indexOf(this.activeTab);
+            this.setTab(this.tabs[(i - 1 + this.tabs.length) % this.tabs.length]);
+            return;
+        }
+        if (matchesKey(data, Key.right) || matchesKey(data, ">")) {
+            const i = this.tabs.indexOf(this.activeTab);
+            this.setTab(this.tabs[(i + 1) % this.tabs.length]);
+            return;
+        }
+        if (matchesKey(data, Key.escape)) {
+            this.done();
+            return;
+        }
+        // Everything else (up/down/enter) goes to the active SelectList.
+        this.activeList?.handleInput(data);
+        this.invalidate();
+    }
+}
+/**
+ * Build the panel state from the pieces session.ts already holds. Exported
+ * for unit tests; the TUI component consumes it.
+ */
+export function buildPanelState(settings, sessionToggledOff, rules, paths, sessionGrants, dependencyStatus) {
+    return {
+        settings,
+        sessionToggledOff,
+        dependencyErrors: dependencyStatus.errors,
+        dependencyWarnings: dependencyStatus.warnings,
+        merge: mergeRulesIntoSandbox(settings, rules, paths),
+        sessionGrants: [...sessionGrants],
+    };
+}
+//# sourceMappingURL=panel.js.map

package/dist/extension/sandbox/session.d.ts

@@ -0,0 +1,85 @@
+/**
+ * Sandbox session wiring: owns the per-session YagniSandboxManager
+ * and hooks it into pi — bash tool re-registration with the sandbox
+ * spawnHook, user_bash (! commands) routing, session lifecycle, and the
+ * network ask flow (interactive prompt in TUI/RPC, fail-closed in
+ * print/headless).
+ *
+ * Registration model: the sandbox re-registers the bash tool ONLY when
+ * sandbox.enabled is true in the loaded settings — default-off sessions keep
+ * pi's stock bash byte-identical (a duplicate tool name is a hard 400 on
+ * some providers). /sandbox (M5) toggles by rewriting settings and asking
+ * for a session restart, the same way Claude persists the toggle.
+ */
+import { type ExtensionAPI, type ExtensionContext, type ToolDefinition } from "@earendil-works/pi-coding-agent";
+import { type SandboxSettings } from "./config.js";
+import { YagniSandboxManager } from "./manager.js";
+import type { PermissionRule } from "../permissionRules/loadConfig.js";
+/**
+ * Build the sandbox bash composition: given ANY stock bash definition (pi's
+ * own or condensedTools'), return the sandbox-aware version — schema gains
+ * dangerouslyDisableSandbox, execute wraps via the manager when the decision
+ * says so, and EPERM output is annotated. Identity when the sandbox is
+ * disabled at load time (default-off sessions stay byte-identical).
+ *
+ * Exported so condensedTools consumes it through its wrapBash seam — the
+ * M4 e2e lesson: condensed registers bash LAST, so a competing registration
+ * here would be overwritten and the sandbox would silently never reach
+ * model-driven tool calls.
+ */
+export declare function makeBashComposition(manager: YagniSandboxManager, settings: () => SandboxSettings, cwd: string): (def: ToolDefinition) => ToolDefinition;
+export interface SandboxSessionHandle {
+    manager: YagniSandboxManager;
+    settings: () => SandboxSettings;
+    /** Latest permission rules snapshot (updated by the gate on load). */
+    setRules: (rules: readonly PermissionRule[]) => void;
+    /** Session-scoped network grants (memory-only, agent-invisible). */
+    grantDomainSession: (domain: string) => void;
+    sessionDomains: () => readonly string[];
+    /** The bash-definition composition (identity when disabled). condensedTools
+     * consumes this via its wrapBash seam; index.ts passes it through. */
+    composeBash: (def: ToolDefinition) => ToolDefinition;
+    /**
+     * Register the sandbox-wrapped bash directly on pi (the fallback path when
+     * condensedTools is NOT active: eval mode, classic rows, desktop). No-op
+     * when the sandbox is disabled. index.ts calls this in the else-branch so
+     * the two bash-defining sites never double-register.
+     */
+    registerOwnBash: () => void;
+}
+export interface RegisterSandboxOptions {
+    cwd: string;
+    env?: NodeJS.ProcessEnv;
+    userHome?: string;
+    stateHomeOverride?: string | null;
+    projectRoot?: string | null;
+    rgPath?: string;
+    /** Injectable manager factory (tests simulate init failure / disabled
+     * platforms without touching the real srt singleton). */
+    makeManager?: (opts: {
+        cwd: string;
+        env?: NodeJS.ProcessEnv;
+        userHome?: string;
+        stateHomeOverride?: string | null;
+        projectRoot?: string | null;
+        rgPath?: string;
+    }) => Pick<YagniSandboxManager, "initialized" | "initialize" | "reset" | "refreshConfig" | "setAskHandler" | "wrapWithSandbox" | "cleanupAfterCommand" | "annotateStderrWithSandboxFailures"> & YagniSandboxManager;
+    /** Whether interactive prompts are possible (TUI/RPC). */
+    hasUI: (ctx: ExtensionContext) => boolean;
+    /**
+     * When true, the sandbox registers its OWN wrapped bash tool at extension
+     * load (the fallback path — index.ts decides and calls registerOwnBash
+     * explicitly when condensedTools is inactive). Default false: the common
+     * path composes through condensedTools' wrapBash seam instead, because
+     * condensed registers last and would otherwise overwrite a competing
+     * registration (the duplicate-name 400 + silent-unwrap lesson from M4).
+     */
+    registerOwnBash?: boolean;
+}
+/**
+ * Register the sandbox surfaces on the ExtensionAPI. Returns the session
+ * handle (manager + accessors) or null when the platform can never run the
+ * sandbox (no-op registration, stock bash stays).
+ */
+export declare function registerSandbox(pi: ExtensionAPI, opts: RegisterSandboxOptions): SandboxSessionHandle | null;
+//# sourceMappingURL=session.d.ts.map