@yagni-app/code 1.0.6 → 1.0.8

package/dist/claudePlugins.js

@@ -17,10 +17,19 @@
  *    relative-path source loads on the project side, unless explicitly
  *    disabled via `enabledPlugins`.
  *
- * Deliberately NOT here: network installation of any kind, plugin hooks, MCP
- * servers (standard MCP support lives in `src/mcpCommand.ts` + the extension's
- * `mcp/` module — see `yagni mcp --help`), LSP servers, themes, output styles.
- * Discovery is read-only.
+ * Three sources, first wins on the same `name@marketplace`:
+ *
+ * 0. YAGNI's own ledger (`~/.yagni-code/plugins`, written by `yagni plugin`;
+ *    see pluginStore.ts) — handed in by the caller as `yagniLedger`.
+ * 1. Claude Code's ledger + `enabledPlugins` (mirrored read-only).
+ * 2. The repo's own `.claude-plugin/marketplace.json`.
+ *
+ * Plugin MCP servers (`.mcp.json` at the plugin root, or the manifest's
+ * `mcpServers`) are collected here and bridged by the launcher into the
+ * extension's MCP client (see claudeCompat.ts). Deliberately NOT here:
+ * network installation (that is pluginStore.ts), plugin hooks, LSP servers,
+ * themes, output styles — those are reported as `unsupported` so `yagni
+ * plugin list` can say so. Discovery is read-only.
  *
  * Everything is fail-soft: malformed JSON, missing dirs, or hostile path
  * entries degrade to "that plugin absent" — never a failed launch. Path
@@ -151,10 +160,20 @@ export function readKnownMarketplaces(homeDir) {
     }
     return out;
 }
+// ── marketplace file ────────────────────────────────────────────────────────
+/**
+ * Names and versions from marketplace/plugin JSON become path segments under
+ * the plugin home (`cache/<mp>/<plugin>/<version>`), so they must be plain
+ * single segments: no separators, no `.`/`..`, nothing starting with `-`.
+ */
+export const SAFE_SEGMENT = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
+export function isSafeSegment(value) {
+    return typeof value === "string" && SAFE_SEGMENT.test(value);
+}
 /** Parse `<root>/.claude-plugin/marketplace.json`; null when absent/unusable. */
 export function readMarketplace(root) {
     const parsed = readJsonObject(join(root, ".claude-plugin", "marketplace.json"));
-    if (!parsed || typeof parsed.name !== "string" || parsed.name.length === 0)
+    if (!parsed || !isSafeSegment(parsed.name))
         return null;
     if (!Array.isArray(parsed.plugins))
         return null;
@@ -166,10 +185,16 @@ export function readMarketplace(root) {
     for (const item of parsed.plugins) {
         if (!item || typeof item !== "object" || Array.isArray(item))
             continue;
-        const name = item.name;
-        if (typeof name !== "string" || name.length === 0)
+        const entry = item;
+        const name = entry.name;
+        if (!isSafeSegment(name))
             continue;
-        plugins.push({ name, source: item.source });
+        plugins.push({
+            name,
+            source: entry.source,
+            ...(isSafeSegment(entry.version) ? { version: entry.version } : {}),
+            ...(typeof entry.description === "string" ? { description: entry.description } : {}),
+        });
     }
     return { name: parsed.name, root, pluginRoot, plugins };
 }
@@ -212,13 +237,17 @@ function asStringArray(value) {
  * discovery reads whole dirs), root `SKILL.md` fallback. Null when the plugin
  * has nothing we can bridge.
  */
-export function pluginAssets(root, name) {
+export function pluginAssets(root, name, meta = {}) {
     if (!isDirectory(root))
         return null;
-    const manifest = readJsonObject(join(root, ".claude-plugin", "plugin.json")) ?? {};
+    const manifestPath = join(root, ".claude-plugin", "plugin.json");
+    const manifest = readJsonObject(manifestPath) ?? {};
+    // Default component locations go through the same containment check as
+    // manifest-declared ones: a `skills` symlink pointing outside the plugin
+    // must not hand that directory to pi.
     const skillPaths = [];
-    const defaultSkills = join(root, "skills");
-    if (isDirectory(defaultSkills))
+    const defaultSkills = containedExistingPath(root, "skills");
+    if (defaultSkills && isDirectory(defaultSkills))
         skillPaths.push(defaultSkills);
     const manifestSkills = asStringArray(manifest.skills);
     for (const rel of manifestSkills) {
@@ -227,8 +256,8 @@ export function pluginAssets(root, name) {
             skillPaths.push(contained);
     }
     if (skillPaths.length === 0 && manifestSkills.length === 0) {
-        const rootSkill = join(root, "SKILL.md");
-        if (isFile(rootSkill))
+        const rootSkill = containedExistingPath(root, "SKILL.md");
+        if (rootSkill && isFile(rootSkill))
             skillPaths.push(rootSkill);
     }
     const componentPaths = (manifestValue, defaultDir) => {
@@ -242,14 +271,62 @@ export function pluginAssets(root, name) {
             }
             return out;
         }
-        const def = join(root, defaultDir);
-        return isDirectory(def) ? [def] : [];
+        const def = containedExistingPath(root, defaultDir);
+        return def && isDirectory(def) ? [def] : [];
     };
     const commandPaths = componentPaths(manifest.commands, "commands");
     const agentDirs = componentPaths(manifest.agents, "agents").filter(isDirectory);
-    if (skillPaths.length === 0 && commandPaths.length === 0 && agentDirs.length === 0)
+    const mcp = pluginMcp(root, manifest, manifestPath);
+    const unsupported = [];
+    if (manifest.hooks !== undefined || isDirectory(join(root, "hooks")) || isFile(join(root, "hooks.json")))
+        unsupported.push("hooks");
+    if (manifest.lspServers !== undefined || isFile(join(root, ".lsp.json")))
+        unsupported.push("lsp");
+    if (manifest.outputStyles !== undefined)
+        unsupported.push("output styles");
+    if (skillPaths.length === 0 && commandPaths.length === 0 && agentDirs.length === 0 && !mcp)
         return null;
-    return { name, root, skillPaths, commandPaths, agentDirs };
+    const version = meta.version ?? (typeof manifest.version === "string" ? manifest.version : null);
+    return {
+        name,
+        key: meta.key ?? name,
+        origin: meta.origin ?? "claude-code",
+        version,
+        root,
+        skillPaths,
+        commandPaths,
+        agentDirs,
+        mcp,
+        unsupported,
+    };
+}
+/**
+ * A plugin's MCP servers, per Claude Code's rules: the manifest `mcpServers`
+ * field (an inline map, or a contained path to a JSON file with one), else
+ * `.mcp.json` at the plugin root. Malformed → null (fail-soft).
+ */
+function pluginMcp(root, manifest, manifestPath) {
+    const field = manifest.mcpServers;
+    if (field && typeof field === "object" && !Array.isArray(field)) {
+        return { sourcePath: manifestPath, servers: field };
+    }
+    const candidates = [];
+    if (typeof field === "string") {
+        const contained = containedExistingPath(root, field);
+        if (contained && isFile(contained))
+            candidates.push(contained);
+    }
+    const rootFile = containedExistingPath(root, ".mcp.json");
+    if (rootFile && isFile(rootFile))
+        candidates.push(rootFile);
+    for (const path of candidates) {
+        const parsed = readJsonObject(path);
+        const servers = parsed?.mcpServers;
+        if (servers && typeof servers === "object" && !Array.isArray(servers)) {
+            return { sourcePath: path, servers: servers };
+        }
+    }
+    return null;
 }
 function resolveInstalledRoot(key, installed, marketplaces, realCwd) {
     const entries = (installed.get(key) ?? []).filter((e) => isDirectory(e.installPath));
@@ -295,14 +372,40 @@ export function discoverClaudePlugins(deps) {
         const user = [];
         const project = [];
         const seen = new Set();
+        // YAGNI-installed plugins are the user's own explicit action (`yagni
+        // plugin install`), so both scopes load without ceremony; a project-scope
+        // install applies only inside its repo.
+        for (const [key, entries] of Object.entries(deps.yagniLedger?.plugins ?? {})) {
+            const applicable = entries.filter((e) => {
+                if (!e.enabled || !isDirectory(e.installPath))
+                    return false;
+                if (e.scope === "user")
+                    return true;
+                const real = typeof e.projectPath === "string" ? realOrNull(e.projectPath) : null;
+                return !!real && (realCwd === real || realCwd.startsWith(real + sep));
+            });
+            const chosen = applicable.find((e) => e.scope === "project") ?? applicable[0];
+            if (!chosen)
+                continue;
+            const at = key.lastIndexOf("@");
+            const assets = pluginAssets(chosen.installPath, at > 0 ? key.slice(0, at) : key, {
+                key,
+                origin: "yagni",
+                version: chosen.version,
+            });
+            if (!assets)
+                continue;
+            seen.add(key);
+            user.push(assets);
+        }
         for (const [key, state] of enabled) {
-            if (!state.enabled)
+            if (!state.enabled || seen.has(key))
                 continue;
             const root = resolveInstalledRoot(key, installed, marketplaces, realCwd);
             if (!root)
                 continue;
             const at = key.lastIndexOf("@");
-            const assets = pluginAssets(root, at > 0 ? key.slice(0, at) : key);
+            const assets = pluginAssets(root, at > 0 ? key.slice(0, at) : key, { key, origin: "claude-code" });
             if (!assets)
                 continue;
             seen.add(key);
@@ -322,7 +425,12 @@ export function discoverClaudePlugins(deps) {
                     resolveInstalledRoot(key, installed, marketplaces, realCwd);
                 if (!root)
                     continue;
-                const assets = pluginAssets(root, entry.name);
+                const declared = entry.version;
+                const assets = pluginAssets(root, entry.name, {
+                    key,
+                    origin: "repo-marketplace",
+                    version: typeof declared === "string" ? declared : null,
+                });
                 if (!assets)
                     continue;
                 seen.add(key);

package/dist/cli.js

@@ -24,6 +24,7 @@ import { DISTRIBUTION } from "./distribution.js";
 import { connectCommand } from "./connectClaudeCode.js";
 import { goCommand } from "./goHeadless.js";
 import { mcpCommand } from "./mcpCommand.js";
+import { pluginCommand } from "./pluginCommand.js";
 import { login } from "./login.js";
 import { logout } from "./logout.js";
 import { tokenCommand } from "./token.js";
@@ -247,10 +248,10 @@ async function runDefault(passthroughArgs) {
     catch {
         compat = { argv: [], env: {} };
     }
-    // OTel export: load pi-otel only when an OTLP endpoint is configured — the
-    // user's env, the workspace's admin-set config (fetched fail-soft, cached),
-    // or the repo's .pi/settings.json, in that order. undefined keeps the
-    // launch untouched. See otel.ts for the policy.
+    // OTel export: on only when an OTLP endpoint is configured — the user's
+    // env, the workspace's admin-set config (fetched fail-soft, cached), or the
+    // repo's .pi/settings.json, in that order. undefined keeps the launch
+    // untouched. See otel.ts for the policy.
     const otel = await resolveOtelLaunchWithWorkspace({
         env: process.env,
         cwd: process.cwd(),
@@ -520,6 +521,10 @@ export const HELP_TEXT = [
     "                           add-from-claude, and more — run `yagni mcp` for",
     "                           details. OAuth servers authenticate via the",
     "                           /mcp panel in a session.",
+    "  yagni plugin <subcommand> Claude Code plugins from a marketplace: marketplace",
+    "                           add, install, uninstall, update, list — run",
+    "                           `yagni plugin` for details. Skills, commands,",
+    "                           agents, and bundled MCP servers load on launch.",
     "  yagni token              Output the active environment's API token (for helpers).",
     "  yagni use <name>         Switch the active environment (sticky).",
     "                           Presets: prod, local. Others need --base-url <url>.",
@@ -542,6 +547,8 @@ export const HELP_TEXT = [
     "  /todos                   Show the agent's live task list.",
     "  /cost                    Session usage and credit headroom.",
     "  /mcp                     Manage MCP servers; authenticate OAuth servers.",
+    "  /plugin                  Browse, install, and remove Claude Code plugins.",
+    "  /reload-plugins          Apply plugin changes without restarting.",
     "",
     "The active environment is sticky; `use` switches it (prod is the default).",
     "Set YAGNI_BASE_URL to override the base URL for a single run.",
@@ -665,6 +672,11 @@ export async function main(argv) {
     if (command === "mcp") {
         return mcpCommand(rest);
     }
+    // Claude Code plugin marketplaces: install/remove/update from YAGNI itself
+    // (state under ~/.yagni-code/plugins; Claude Code's own installs still mirror).
+    if (command === "plugin") {
+        return pluginCommand(rest);
+    }
     // The headless pipeline entry. `go` is a real subcommand, not passthrough:
     // the interactive run stays `/go` inside a session, and a `yagni go` without
     // --headless is refused with usage rather than launched as an agent prompt.

package/dist/doctor.d.ts

@@ -13,7 +13,7 @@
  * Advisory checks (loose perms, missing `gh`) never flip the exit code.
  */
 import { type TokenExpiryStatus } from "./launch.js";
-import { probeOtelEndpoint, type OtelLaunchConfig } from "./otel.js";
+import { type OtelLaunchConfig } from "./otel.js";
 import { type Profile } from "./profiles.js";
 export type CheckStatus = "ok" | "warn" | "fail";
 export interface CheckResult {
@@ -61,16 +61,25 @@ export declare function checkCliUpdate(probe: {
     latest: string | null;
 }): CheckResult;
 export declare function checkGh(onPath: boolean): CheckResult;
+/** One signal's verdict from the extension's probe (see telemetry/probe.ts). */
+export interface OtelProbeSignal {
+    signal: "traces" | "metrics" | "logs";
+    url: string;
+    protocol: string;
+    ok: boolean;
+    error?: string;
+}
 /**
- * Advisory OTel-export line: says whether sessions will stream traces to an
- * OTLP collector, from which config source, and — when a collector is
- * configured — whether the endpoint answers TCP right now (scheme-default
- * ports included: https with no port probes 443). Never flips the exit code —
- * most machines have no collector, and that is the healthy default.
+ * Advisory OTel-export line: says whether sessions will stream telemetry to
+ * an OTLP collector, from which config source, and — when a collector is
+ * configured — whether it ACCEPTED a real record on each signal (a wrong API
+ * key, a wrong path, or a protocol mismatch shows up as the collector's own
+ * error). Never flips the exit code — most machines have no collector, and
+ * that is the healthy default.
  */
 export declare function checkOtelExport(config: OtelLaunchConfig | undefined, deps?: {
-    probeEndpoint?: typeof probeOtelEndpoint;
-    probeTimeoutMs?: number;
+    probe?: (env: NodeJS.ProcessEnv) => Promise<OtelProbeSignal[]>;
+    baseEnv?: NodeJS.ProcessEnv;
 }): Promise<CheckResult>;
 /** Config-only MCP snapshot (no connections — health checks live in `mcp list`/`get`). */
 export interface McpProbe {
@@ -120,6 +129,10 @@ export interface DoctorDeps {
     probeLatestVersion?: () => Promise<string | null>;
     /** MCP config snapshot (config-only, no connections). */
     probeMcp?: () => Promise<McpProbe>;
+    /** OTel gate resolution (env / workspace / repo settings); tests stub it. */
+    resolveOtel?: (profile: Profile) => Promise<OtelLaunchConfig | undefined>;
+    /** OTel export probe: one real record per signal against the session env. */
+    probeOtel?: (env: NodeJS.ProcessEnv) => Promise<OtelProbeSignal[]>;
     log?: (msg: string) => void;
 }
 /** Whether a `gh` executable is resolvable on PATH (no subprocess spawn). */

package/dist/doctor.js

@@ -17,8 +17,8 @@ import { delimiter, join } from "node:path";
 import { credentialsDir } from "./credentials.js";
 import { currentCliVersion, fetchLatestVersion, isNewerVersion } from "./upgrade.js";
 import { classifyTokenExpiry } from "./launch.js";
-import { probeOtelEndpoint, resolveOtelLaunchWithWorkspace, } from "./otel.js";
-import { resolveExtensionPath, resolvePiCliPath, resolvePiPackageDir } from "./paths.js";
+import { otelChildEnv, resolveOtelLaunchWithWorkspace } from "./otel.js";
+import { resolveExtensionPath, resolvePiCliPath, resolvePiPackageDir, resolveTelemetryProbePath } from "./paths.js";
 import { readActiveProfile } from "./profiles.js";
 import { resolveMcpConfigPath } from "./mcpCommand.js";
 // ── Pure check builders ─────────────────────────────────────────────────────
@@ -201,11 +201,22 @@ export function checkGh(onPath) {
     };
 }
 /**
- * Advisory OTel-export line: says whether sessions will stream traces to an
- * OTLP collector, from which config source, and — when a collector is
- * configured — whether the endpoint answers TCP right now (scheme-default
- * ports included: https with no port probes 443). Never flips the exit code —
- * most machines have no collector, and that is the healthy default.
+ * Run the extension's telemetry probe against the exact env a session would
+ * get: one real span, one metric point, one log record, each reported with
+ * the collector's actual verdict. Dynamic import so `doctor` on a machine
+ * with no collector never loads the OTel SDK graph.
+ */
+async function defaultProbeOtel(env) {
+    const mod = (await import(resolveTelemetryProbePath()));
+    return (await mod.probeTelemetryExport(env)).results;
+}
+/**
+ * Advisory OTel-export line: says whether sessions will stream telemetry to
+ * an OTLP collector, from which config source, and — when a collector is
+ * configured — whether it ACCEPTED a real record on each signal (a wrong API
+ * key, a wrong path, or a protocol mismatch shows up as the collector's own
+ * error). Never flips the exit code — most machines have no collector, and
+ * that is the healthy default.
  */
 export async function checkOtelExport(config, deps = {}) {
     if (!config) {
@@ -222,23 +233,32 @@ export async function checkOtelExport(config, deps = {}) {
             ? "workspace settings"
             : ".pi/settings.json";
     const base = `on → ${config.endpoint} (${source}, metadata-only)`;
-    const doProbe = deps.probeEndpoint ?? probeOtelEndpoint;
+    const baseEnv = deps.baseEnv ?? process.env;
+    const env = { ...baseEnv, ...otelChildEnv(config, baseEnv) };
+    const doProbe = deps.probe ?? defaultProbeOtel;
     try {
-        const reachable = await doProbe(config.endpoint, deps.probeTimeoutMs ?? 1_000);
-        return reachable
-            ? {
+        const results = await doProbe(env);
+        const accepted = results.filter((r) => r.ok).map((r) => r.signal);
+        const failed = results.filter((r) => !r.ok);
+        const summary = results.map((r) => `${r.signal} ${r.ok ? "accepted" : "FAILED"}`).join(", ");
+        if (failed.length === 0) {
+            return {
                 name: "otel export (optional)",
                 status: "ok",
-                detail: `${base}, TCP reachable`,
-                required: false,
-            }
-            : {
-                name: "otel export (optional)",
-                status: "warn",
-                detail: `${base}, endpoint not reachable`,
-                hint: "the collector is down, unreachable from this machine, or the URL is wrong — traces will not export until it answers",
+                detail: `${base}; ${summary}`,
                 required: false,
             };
+        }
+        const reasons = failed.map((r) => `${r.signal} → ${r.url} (${r.protocol}): ${r.error ?? "rejected"}`).join("; ");
+        return {
+            name: "otel export (optional)",
+            status: "warn",
+            detail: `${base}; ${summary}`,
+            hint: `${reasons}. A 401/403 means the collector key is wrong, a 404 the path or site is wrong, ` +
+                `a connection error the collector is unreachable from this machine` +
+                (accepted.length > 0 ? `; ${accepted.join(" and ")} still export` : ""),
+            required: false,
+        };
     }
     catch {
         // The probe itself errored (not "endpoint down" — the check could not
@@ -247,8 +267,8 @@ export async function checkOtelExport(config, deps = {}) {
         return {
             name: "otel export (optional)",
             status: "warn",
-            detail: `${base}, reachability probe failed`,
-            hint: "the reachability check could not run (network error) — export is configured but unverified; traces may still export normally",
+            detail: `${base}, export probe failed`,
+            hint: "the export probe could not run (the bundled extension is missing or the OTel SDK failed to load) — export is configured but unverified; sessions may still export normally",
             required: false,
         };
     }
@@ -402,7 +422,7 @@ async function defaultProbeMcp(env = process.env) {
         const repoRoot = mod.resolveProjectRoot(process.cwd());
         const { state } = mod.readProjectApproval(repoRoot);
         const undecided = loaded.servers
-            .filter((s) => s.scope === "project" && mod.decisionFor(state, s.name) === "undecided")
+            .filter((s) => (s.scope === "project" || s.gated === true) && mod.decisionFor(state, s.name) === "undecided")
             .map((s) => s.name);
         return {
             disabled: false,
@@ -516,12 +536,17 @@ export async function gatherChecks(deps = {}) {
     checks.push(checkStateDir(probeStateDir()));
     checks.push(checkGh(ghOnPath()));
     checks.push(checkMcpConfig(await probeMcp()));
-    checks.push(await checkOtelExport(await resolveOtelLaunchWithWorkspace({
-        env: process.env,
-        cwd: process.cwd(),
-        creds: profile.token ? { baseUrl: profile.baseUrl, token: profile.token } : null,
-        profileName: profile.name,
-    })));
+    const resolveOtel = deps.resolveOtel ??
+        ((p) => resolveOtelLaunchWithWorkspace({
+            env: process.env,
+            cwd: process.cwd(),
+            creds: p.token ? { baseUrl: p.baseUrl, token: p.token } : null,
+            profileName: p.name,
+        }));
+    checks.push(await checkOtelExport(await resolveOtel(profile), {
+        ...(deps.probeOtel ? { probe: deps.probeOtel } : {}),
+        baseEnv: process.env,
+    }));
     return checks;
 }
 /**

package/dist/extension/askUserQuestionTool.js

@@ -24,7 +24,11 @@ import { logAskQuestion } from "./diagnostics.js";
 const TOOL_NAME = "ask_user_question";
 /** Claude mirrors this as ASK_USER_QUESTION_TOOL_CHIP_WIDTH. */
 const CHIP_WIDTH = 12;
-/** Same fail-closed ceiling as the permission-gate ask. */
+/** Cancel an unanswered question after 2 minutes. This is the structured
+ * QUESTION tool's own UX cap — NOT the permission-ask contract (gate asks
+ * wait indefinitely per Claude Code parity; see agent-safety.md). A stale
+ * question auto-cancels so the agent's turn cannot hang on a chip nobody
+ * is looking at; the user can always re-ask. */
 const ASK_TIMEOUT_MS = 120_000;
 /** Sentinel value representing the "Other" row in the multi-select toggle set. */
 const OTHER_KEY = "__other__";
@@ -523,7 +527,8 @@ async function askOne(ctx, q, qIndex) {
             return;
         }
         ctx.signal?.addEventListener("abort", onAbort, { once: true });
-        // Best-effort timeout, mirroring the permission-gate ask fail-closed.
+        // Best-effort timeout: this surface's own 2-minute question cap (the
+        // permission-gate ask deliberately has none — see ASK_TIMEOUT_MS above).
         const timer = setTimeout(() => settle({ status: "cancelled" }), ASK_TIMEOUT_MS);
         void ctx.ui
             .custom((_tui, theme, keybindings, done) => {

package/dist/extension/condensedTools.d.ts

@@ -24,7 +24,7 @@
  * pattern) so tests run against plain text. Renderer exceptions are swallowed
  * by pi (degrading to the built-in fallback), so everything stays total.
  */
-import { SettingsManager, type ExtensionAPI } from "@earendil-works/pi-coding-agent";
+import { SettingsManager, type ExtensionAPI, type ToolDefinition } from "@earendil-works/pi-coding-agent";
 import type { RenderTheme } from "./subagentRender.js";
 import { ToolRunTracker } from "./toolRuns.js";
 /** Lines of write content shown collapsed (mirrors Claude Code's preview). */
@@ -87,6 +87,17 @@ export interface RegisterCondensedToolsDeps {
      * image autoResize. Injectable so tests never touch the config dir.
      */
     loadSettings?: (cwd: string) => SettingsManager;
+    /**
+     * sandbox composition: when present, the bash definition is passed
+     * through this wrap before registration — the sandbox adds its schema field
+     * (dangerouslyDisableSandbox), wrap-on-execute, and violation annotation
+     * while condensed keeps its rendering. The compose fn is built by
+     * sandbox/session.ts (makeSandboxBashComposition) and is a no-op when the
+     * sandbox is disabled. Condensed registers LAST among the bash-defining
+     * sites, so composing HERE is what makes the sandbox actually reach the
+     * model's tool calls.
+     */
+    wrapBash?: (def: ToolDefinition) => ToolDefinition;
 }
 /**
  * Re-register the seven built-ins with condensed renderers. Returns the

package/dist/extension/condensedTools.js

@@ -291,15 +291,23 @@ export function registerCondensedTools(pi, deps = {}) {
     catch {
         toolOptions = { bash: {}, read: {} };
     }
-    const buildDefinitions = (cwd) => ({
-        read: createReadToolDefinition(cwd, toolOptions.read),
-        bash: createBashToolDefinition(cwd, toolOptions.bash),
-        edit: createEditToolDefinition(cwd),
-        write: createWriteToolDefinition(cwd),
-        grep: createGrepToolDefinition(cwd),
-        find: createFindToolDefinition(cwd),
-        ls: createLsToolDefinition(cwd),
-    });
+    const buildDefinitions = (cwd) => {
+        const defs = {
+            read: createReadToolDefinition(cwd, toolOptions.read),
+            bash: createBashToolDefinition(cwd, toolOptions.bash),
+            edit: createEditToolDefinition(cwd),
+            write: createWriteToolDefinition(cwd),
+            grep: createGrepToolDefinition(cwd),
+            find: createFindToolDefinition(cwd),
+            ls: createLsToolDefinition(cwd),
+        };
+        // the sandbox wraps the bash DEFINITION (not the registration
+        // wrapper) so the cwd-delegating execute below still lands on the
+        // sandbox-aware tool for every cwd the session visits.
+        if (defs.bash && deps.wrapBash)
+            defs.bash = deps.wrapBash(defs.bash);
+        return defs;
+    };
     const definitionsByCwd = new Map();
     const definitionsFor = (cwd) => {
         let defs = definitionsByCwd.get(cwd);

package/dist/extension/config.d.ts

@@ -127,6 +127,12 @@ export interface ContextBrief {
      * The opt-in mining beat fires ONLY on an explicit 0.
      */
     repoDecisionCount?: number;
+    /**
+     * The signed-in developer's account email (additive; absent on older
+     * backends). Feeds the OTel export's `user.email` attribute when the
+     * launcher did not already forward one.
+     */
+    userEmail?: string;
 }
 /**
  * Attribution headers for the model proxy (YAG-471). On the SERVER side these

package/dist/extension/hooks.d.ts

@@ -26,8 +26,8 @@ export interface HookEntry {
 export interface HookGroup {
     matcher?: string;
     hooks: HookEntry[];
-    /** Where this group was loaded from. Project-level groups are gated on workspace trust. */
-    _source?: "user" | "project";
+    /** Where this group was loaded from. Project AND local groups are gated on workspace trust. */
+    _source?: "user" | "project" | "local";
 }
 /** The hooks section of config.json. */
 export type HooksConfig = Record<string, HookGroup[]>;
@@ -55,7 +55,7 @@ export interface HookRunner {
     preToolUse(toolName: string, input: Record<string, unknown>, cwd: string, trusted?: boolean): Promise<PreToolUseHookResult>;
     permissionRequest(toolName: string, input: Record<string, unknown>, cwd: string, trusted?: boolean): Promise<PermissionRequestHookResult>;
 }
-/** Read and merge hooks config from user and project files. Pure I/O, fail-soft. */
+/** Read and merge hooks config from user, project, and local files. Pure I/O, fail-soft. */
 export declare function loadHooksConfig(userHome?: string, cwd?: string, env?: NodeJS.ProcessEnv): HooksConfig;
 /**
  * Check if a matcher matches a tool name. Matches Claude Code / Codex:

package/dist/extension/hooks.js

@@ -36,7 +36,7 @@ const SUPPORTED_EVENTS = [
 // ---------------------------------------------------------------------------
 // Config loading
 // ---------------------------------------------------------------------------
-/** Read and merge hooks config from user and project files. Pure I/O, fail-soft. */
+/** Read and merge hooks config from user, project, and local files. Pure I/O, fail-soft. */
 export function loadHooksConfig(userHome = homedir(), cwd = process.cwd(), env = process.env) {
     if (env.YAGNI_CODE_EVAL_MODE === "1")
         return {};
@@ -47,6 +47,13 @@ export function loadHooksConfig(userHome = homedir(), cwd = process.cwd(), env =
     // Project-level: .yagni-code/config.json — tagged for trust gating at execution time
     const projectPath = join(cwd, ".yagni-code", "config.json");
     mergeHooksFromFile(merged, projectPath, "project");
+    // Local-level: .yagni-code/config.local.json — the personal per-project
+    // tier. Trust-gated like project (NOT always-trusted): a hostile repo can
+    // COMMIT a local file — the gitignore convention only covers untracked
+    // files. Deliberately stricter than Claude Code, which does not
+    // trust-gate its localSettings hooks.
+    const localPath = join(cwd, ".yagni-code", "config.local.json");
+    mergeHooksFromFile(merged, localPath, "local");
     return merged;
 }
 function mergeHooksFromFile(merged, path, source) {
@@ -68,8 +75,20 @@ function mergeHooksFromFile(merged, path, source) {
             }
         }
     }
-    catch {
-        // Fail-soft: missing or malformed config is logged and skipped.
+    catch (err) {
+        // Fail-soft: missing or malformed config is skipped — and LOGGED: a
+        // corrupt local/project config silently dropping its hooks (including
+        // deny-enforcing ones) with zero signal is undiagnosable. Path + error
+        // class only, matching loadConfig.ts's warning behavior.
+        logEvent({
+            source: "hooks",
+            level: "warn",
+            event: "config_warning",
+            fields: {
+                path,
+                error: err instanceof Error ? err.constructor.name : typeof err,
+            },
+        });
     }
 }
 function isValidHookGroup(value) {
@@ -297,11 +316,17 @@ function logHookEvent(env, payload) {
         fields,
     });
 }
-/** Filter hook groups by workspace trust: project-level groups are skipped when untrusted. */
+/**
+ * Filter hook groups by workspace trust: project AND local groups are
+ * skipped when untrusted. Local is gated exactly like project (not like the
+ * always-trusted user tier) because a hostile repo can COMMIT a
+ * config.local.json — the global-gitignore convention only covers
+ * untracked files. Deliberately stricter than Claude Code's localSettings.
+ */
 function filterByTrust(groups, isTrusted) {
     if (isTrusted)
         return groups;
-    return groups.filter((g) => g._source !== "project");
+    return groups.filter((g) => g._source !== "project" && g._source !== "local");
 }
 /**
  * Create a HookRunner for injection into the permission gate. The `isTrusted`