@yagni-app/code 1.0.7 → 1.0.8

package/dist/extension/sandbox/session.js

@@ -12,18 +12,20 @@
  * for a session restart, the same way Claude persists the toggle.
  */
 import { spawn } from "node:child_process";
-import { existsSync, lstatSync, mkdirSync, readFileSync, renameSync, writeFileSync, chmodSync } from "node:fs";
-import { dirname, join } from "node:path";
+import { existsSync } from "node:fs";
+import { join } from "node:path";
 import { Type } from "typebox";
 import { Key } from "@earendil-works/pi-tui";
 import { createBashToolDefinition, getShellConfig, SettingsManager, } from "@earendil-works/pi-coding-agent";
 import { logEvent } from "../errorSink.js";
 import { codeStateHome } from "../stateHome.js";
 import { isDebug } from "../diagnostics.js";
+import { mutateConfigJson, mutateLocalConfig } from "../settingsFiles.js";
 import { loadSandboxSettings } from "./config.js";
 import { annotateCommandOutput, makeSandboxSpawnHook, preWrappedCommand, shouldUseSandbox, shouldUseSandboxForUserCommand, } from "./bash.js";
 import { YagniSandboxManager } from "./manager.js";
 import { SandboxPanel, buildPanelState } from "./panel.js";
+import { effectiveRules } from "../permissionRules/loadConfig.js";
 /**
  * Build the sandbox bash composition: given ANY stock bash definition (pi's
  * own or condensedTools'), return the sandbox-aware version — schema gains
@@ -177,6 +179,33 @@ export function registerSandbox(pi, opts) {
         if (ctx?.ui)
             uiBridge = ctx;
     };
+    // Trust snapshot for the sandbox rule merge (D3): an untrusted repo's
+    // committed allow rules (project OR local) must not widen the OS-level
+    // allowWrite/deniedDomains sets — the same filtering the permission gate
+    // applies. Captured from the latest ctx; defaults trusted (parity with
+    // the gate's fail-open posture on a missing isProjectTrusted).
+    let trustedSnapshot = true;
+    const captureTrust = (ctx) => {
+        try {
+            if (typeof ctx?.isProjectTrusted === "function")
+                trustedSnapshot = ctx.isProjectTrusted();
+        }
+        catch (err) {
+            // Keep the prior snapshot (fail-open parity with the gate) but make
+            // the throw VISIBLE: warn (not debug) — readSessionTrail filters debug
+            // lines, so a debug event would never reach /feedback; a trust-probe
+            // failure silently pinning the wrong posture must be surfacable.
+            // Scrub-safe: error class only, no thrown message.
+            logEvent({
+                source: "sandbox",
+                level: "warn",
+                event: "trust_probe_failed",
+                fields: { error: err instanceof Error ? err.constructor.name : typeof err },
+            });
+        }
+    };
+    /** Rules filtered to what the sandbox may enforce OS-wide (trust-aware). */
+    const effectiveRulesForSandbox = () => effectiveRules(rules, trustedSnapshot);
     const sessionDomainGrants = new Set();
     const askHandler = async (host) => {
         if (sessionDomainGrants.has(host))
@@ -212,9 +241,11 @@ export function registerSandbox(pi, opts) {
             try {
                 persistDomainGrant(opts.projectRoot ?? opts.cwd, host, resolvedStateHome);
             }
-            catch {
+            catch (err) {
                 // fail-soft: the session grant already holds; the persistence just
-                // did not — the user chose it, so surface it rather than stay silent.
+                // did not — the user chose it, so surface it (notify + sink, same
+                // posture as persistToggleAndNotify) rather than stay silent.
+                logGrantPersistFailure(host, "project", err);
                 ui.ui.notify?.("Could not persist the domain grant to the config file — it applies to this session only.", "warning");
             }
         }
@@ -222,12 +253,13 @@ export function registerSandbox(pi, opts) {
             try {
                 persistDomainGrant(null, host, resolvedStateHome);
             }
-            catch {
+            catch (err) {
+                logGrantPersistFailure(host, "user", err);
                 ui.ui.notify?.("Could not persist the domain grant to the config file — it applies to this session only.", "warning");
             }
         }
         // The grant must reach the live srt config before the retry.
-        manager.refreshConfig([...rules]);
+        manager.refreshConfig([...effectiveRulesForSandbox()]);
         return true;
     };
     // --- bash composition ---
@@ -254,7 +286,7 @@ export function registerSandbox(pi, opts) {
         },
         grantDomainSession: (domain) => {
             sessionDomainGrants.add(domain);
-            manager.refreshConfig([...rules]);
+            manager.refreshConfig([...effectiveRulesForSandbox()]);
         },
         sessionDomains: () => [...sessionDomainGrants],
         composeBash,
@@ -322,10 +354,12 @@ export function registerSandbox(pi, opts) {
     // (fired from inside bash execution, no event ctx) can prompt.
     pi.on("tool_call", async (_event, ctx) => {
         captureUi(ctx);
+        captureTrust(ctx);
         return;
     });
     pi.on("session_start", async (_event, ctx) => {
         captureUi(ctx);
+        captureTrust(ctx);
         currentSettings = load();
         // --no-sandbox skips init in EVERY mode — headless included. The notify
         // is UI-gated, the SKIP never is (a UI-only skip would silently keep the
@@ -338,7 +372,7 @@ export function registerSandbox(pi, opts) {
         if (!currentSettings.enabled)
             return;
         manager.setAskHandler(askHandler);
-        const err = await manager.initialize(rules);
+        const err = await manager.initialize(effectiveRulesForSandbox());
         if (err) {
             logEvent({
                 source: "sandbox",
@@ -391,21 +425,57 @@ export function registerSandbox(pi, opts) {
     };
     /**
      * Session-level toggle. OFF is always immediate (manager.reset unwraps the
-     * next command). ON is split by how the session started:
+     * next command) and — when the session started ENABLED — PERSISTS the
+     * disable to the local config (Claude's toggle persists both directions).
+     * ON is split by how the session started:
      *  - config-enabled session: re-initialize (force past nothing — it was on)
-      *  - default-off session: the wrapped bash may not have registered at load
+     *  - default-off session: the wrapped bash may not have registered at load
      *    (condensedTools owns the registration in the common TUI and reads disk
      *    settings, not this session's toggle). So /sandbox enable PERSISTS
-     *    sandbox.enabled=true to the user config (Claude's own panel persists
+     *    sandbox.enabled=true to the local config (Claude's own panel persists
      *    its mode choice the same way) and asks for a restart — the honest
      *    behavior; a silent no-op would be a security lie.
      */
+    /** Persist-or-notify for the enable/disable toggles — keeps
+     * setSessionToggle flat: try the local write, return the success notice
+     * on success or the failure notice on throw (the caller decides level +
+     * side effects like the sessionToggle reset). A failed persist also logs
+     * sandbox_persist_failed with the thrown message (path/reason text from
+     * mutateConfigJson) — same diagnosability posture as rule_save_failed. */
+    const persistToggleAndNotify = (enabled, ctx) => {
+        try {
+            persistEnabledFlip(enabled, opts.cwd);
+            return {
+                ok: true,
+                notice: enabled
+                    ? "Sandbox enabled in .yagni-code/config.local.json — restart the session (or /new) to apply it to the model's bash tool. Your ! commands are NOT sandboxed until then."
+                    : "Sandbox disabled for this session and set to off in .yagni-code/config.local.json",
+            };
+        }
+        catch (err) {
+            logEvent({
+                source: "sandbox",
+                level: "warn",
+                event: "sandbox_persist_failed",
+                fields: {
+                    enabled,
+                    error: err instanceof Error ? err.message : String(err),
+                },
+            });
+            return {
+                ok: false,
+                notice: enabled
+                    ? 'Could not write the sandbox enable to .yagni-code/config.local.json — set "sandbox": { "enabled": true } there and restart.'
+                    : "Sandbox disabled for this session (could not persist the off state to config.local.json — a restart may re-arm it)",
+            };
+        }
+    };
     const setSessionToggle = async (on, ctx) => {
         sessionToggle = on;
         if (on) {
             const startedEnabled = load().enabled;
             if (startedEnabled) {
-                const err = await manager.initialize(rules, { force: true });
+                const err = await manager.initialize(effectiveRulesForSandbox(), { force: true });
                 if (err) {
                     ctx.ui.notify(`Sandbox unavailable: ${err}`, "error");
                     sessionToggle = null;
@@ -424,13 +494,13 @@ export function registerSandbox(pi, opts) {
             else {
                 // Persist the enable (fail-soft: on write failure tell the user to
                 // edit the file — never claim success falsely).
-                try {
-                    persistEnabledFlip(true, resolvedStateHome);
+                const r = persistToggleAndNotify(true, ctx);
+                if (r.ok) {
                     ctx.ui.setStatus?.("sandbox", "sandbox on (restart to apply)");
-                    ctx.ui.notify("Sandbox enabled in ~/.yagni-code/config.json — restart the session (or /new) to apply it to the model's bash tool. Your ! commands are NOT sandboxed until then.", "warning");
+                    ctx.ui.notify(r.notice, "warning");
                 }
-                catch {
-                    ctx.ui.notify("Could not write the sandbox enable to ~/.yagni-code/config.json — set \"sandbox\": { \"enabled\": true } there and restart.", "error");
+                else {
+                    ctx.ui.notify(r.notice, "error");
                     sessionToggle = null;
                 }
             }
@@ -438,19 +508,32 @@ export function registerSandbox(pi, opts) {
         else {
             await manager.reset();
             ctx.ui.setStatus?.("sandbox", "");
-            ctx.ui.notify("Sandbox disabled for this session", "warning");
+            // Persist the disable when the session started enabled — a restart
+            // must not silently re-arm the sandbox the user just turned off.
+            // Fail-soft: the session-level reset above already applies NOW.
+            if (load().enabled) {
+                const r = persistToggleAndNotify(false, ctx);
+                // Error (not warning): a failed off-persist silently re-arms the
+                // sandbox on restart — the security-relevant direction, at least as
+                // loud as the enable failure.
+                ctx.ui.notify(r.notice, r.ok ? "warning" : "error");
+            }
+            else {
+                ctx.ui.notify("Sandbox disabled for this session", "warning");
+            }
         }
     };
     /**
      * The interactive /sandbox panel (TUI only). Selections persist to the
-     * user config (see persistSandboxMode/persistSandboxOverride for the
-     * interim-destination reasoning); the confirmation message is surfaced
-     * via notify after the panel closes, mirroring Claude's onComplete flow.
-     * enable-from-default-off keeps the honest restart advice.
+     * PROJECT-LOCAL config (.yagni-code/config.local.json — the personal
+     * per-project tier, Claude Code's own panel destination); the
+     * confirmation message is surfaced via notify after the panel closes,
+     * mirroring Claude's onComplete flow. enable-from-default-off keeps the
+     * honest restart advice.
      */
     const openSandboxPanel = async (ctx) => {
         const deps = manager.checkDependencies();
-        const state = buildPanelState(currentSettings, sessionToggle === false, rules, {
+        const state = buildPanelState(currentSettings, sessionToggle === false, effectiveRulesForSandbox(), {
             cwd: opts.cwd,
             userStateHome: resolvedStateHome,
             projectRoot: opts.projectRoot ?? null,
@@ -460,11 +543,11 @@ export function registerSandbox(pi, opts) {
             onModeSelect: async (choice) => {
                 const wasEnabled = load().enabled === true;
                 try {
-                    persistSandboxMode(choice, resolvedStateHome);
+                    persistSandboxMode(choice, opts.cwd);
                 }
                 catch {
                     return {
-                        text: `Could not write the sandbox setting to ~/.yagni-code/config.json — edit it directly ("sandbox": { "enabled": ${choice !== "disabled"} }) and restart.`,
+                        text: `Could not write the sandbox setting to .yagni-code/config.local.json — edit it directly ("sandbox": { "enabled": ${choice !== "disabled"} }) and restart.`,
                         level: "error",
                     };
                 }
@@ -484,37 +567,37 @@ export function registerSandbox(pi, opts) {
                     // the new mode to the model's bash tool.
                     ctx.ui.setStatus?.("sandbox", "sandbox on (restart to apply)");
                     return {
-                        text: `${message} — saved to user settings (~/.yagni-code/config.json); restart the session (or /new) to apply it to the model's bash tool.`,
+                        text: `${message} — saved to project-local settings (.yagni-code/config.local.json); restart the session (or /new) to apply it to the model's bash tool.`,
                         level: "info",
                     };
                 }
                 // Already-enabled session changing autoAllow only: refresh the
                 // live merge so the next bash call sees the new decision posture.
                 if (manager.initialized)
-                    manager.refreshConfig(rules);
+                    manager.refreshConfig(effectiveRulesForSandbox());
                 ctx.ui.setStatus?.("sandbox", "sandbox on");
                 return {
-                    text: `${message} — saved to user settings (~/.yagni-code/config.json).`,
+                    text: `${message} — saved to project-local settings (.yagni-code/config.local.json).`,
                     level: "info",
                 };
             },
             onOverrideSelect: async (choice) => {
                 try {
-                    persistSandboxOverride(choice, resolvedStateHome);
+                    persistSandboxOverride(choice, opts.cwd);
                 }
                 catch {
                     return {
-                        text: `Could not write the sandbox override to ~/.yagni-code/config.json — edit it directly (\"sandbox\": { \"allowUnsandboxedCommands\": ... }) and restart.`,
+                        text: `Could not write the sandbox override to .yagni-code/config.local.json — edit it directly ("sandbox": { "allowUnsandboxedCommands": ... }) and restart.`,
                         level: "error",
                     };
                 }
                 currentSettings = load();
                 if (manager.initialized)
-                    manager.refreshConfig(rules);
+                    manager.refreshConfig(effectiveRulesForSandbox());
                 return {
                     text: choice === "open"
-                        ? "✓ Unsandboxed fallback allowed — commands can run outside the sandbox when necessary — saved to user settings"
-                        : "✓ Strict sandbox mode — all commands must run in the sandbox or be excluded via the excludedCommands option — saved to user settings",
+                        ? "✓ Unsandboxed fallback allowed — commands can run outside the sandbox when necessary — saved to project-local settings"
+                        : "✓ Strict sandbox mode — all commands must run in the sandbox or be excluded via the excludedCommands option — saved to project-local settings",
                     level: "info",
                 };
             },
@@ -580,55 +663,25 @@ export function registerSandbox(pi, opts) {
  * Persist a domain grant to the user or project sandbox config (fail-soft:
  * the session grant already applies even if the write fails).
  */
-/**
- * Shared safe config mutation for the isolated user/project config.json:
- *  - a PARSE FAILURE aborts (never treats a corrupt/half-written file as
- *    empty — that would wipe activeProfile/permissions);
- *  - the write is ATOMIC (tmp file + rename) so a crash never truncates;
- *  - symlinked targets are rejected (a hostile repo's config symlink must
- *    not redirect grants to arbitrary paths);
- *  - the mutator runs only on a parsed object; a thrown mutator aborts.
- * Throws on any failure — callers decide fail-soft messaging.
- */
-function mutateConfigJson(target, mutate) {
-    let parsed;
-    try {
-        parsed = JSON.parse(readFileSync(target, "utf-8"));
-    }
-    catch (err) {
-        if (err.code === "ENOENT") {
-            parsed = {}; // genuinely fresh file — fine
-        }
-        else {
-            throw new Error(`config.json at ${target} is not valid JSON — refusing to rewrite it`);
-        }
-    }
-    if (!isPlainRecord(parsed))
-        throw new Error(`config.json at ${target} is not an object`);
-    const config = { ...parsed };
-    mutate(config);
-    mkdirSync(dirname(target), { recursive: true });
-    // Reject symlinked targets: lstat must show a regular file (or absent).
-    try {
-        const st = lstatSync(target);
-        if (!st.isFile())
-            throw new Error(`${target} is not a regular file (symlink?) — refusing`);
-    }
-    catch (err) {
-        if (err.code !== "ENOENT")
-            throw err;
-    }
-    const tmp = `${target}.sandbox-tmp-${process.pid}`;
-    writeFileSync(tmp, JSON.stringify(config, null, 2) + "\n", { mode: 0o600 });
-    // chmod: writeFile honors mode only on create — guarantee 0600 even when a
-    // same-pid retry reuses an existing tmp file (same posture as
-    // persistUserRule's config write).
-    chmodSync(tmp, 0o600);
-    renameSync(tmp, target);
-}
+/** Local helper for the grant/target writers below (shared shape). */
 function isPlainRecord(v) {
     return typeof v === "object" && v !== null && !Array.isArray(v);
 }
+/** Sink line for a failed domain-grant persist — the thrown message is
+ * mutateConfigJson's own path/reason text (diagnosable, no file content),
+ * same posture as sandbox_persist_failed / rule_save_failed. */
+function logGrantPersistFailure(host, scope, err) {
+    logEvent({
+        source: "sandbox",
+        level: "warn",
+        event: "sandbox_persist_failed",
+        fields: {
+            grant: host,
+            scope,
+            error: err instanceof Error ? err.message : String(err),
+        },
+    });
+}
 /** Persist a domain grant to the user or project sandbox config. */
 function persistDomainGrant(projectRoot, domain, stateHome) {
     const target = projectRoot
@@ -645,25 +698,27 @@ function persistDomainGrant(projectRoot, domain, stateHome) {
         config.sandbox = sandbox;
     });
 }
-/** Persist sandbox.enabled for the /sandbox enable-from-default-off path. */
-function persistEnabledFlip(enabled, stateHome) {
-    const target = join(stateHome, "config.json");
-    mutateConfigJson(target, (config) => {
+/**
+ * Persist sandbox.enabled to the PROJECT-LOCAL config — the personal
+ * per-project tier, Claude Code's own destination for these writes
+ * (settings.local.json). Local writes fire-and-forget the global-gitignore
+ * helper so the file is never committed by accident.
+ */
+function persistEnabledFlip(enabled, cwd) {
+    mutateLocalConfig(cwd, (config) => {
         const sandbox = isPlainRecord(config.sandbox) ? { ...config.sandbox } : {};
         sandbox.enabled = enabled;
         config.sandbox = sandbox;
-    });
+    }, "sandbox");
 }
 /**
  * Persist a panel Mode choice (enabled + autoAllowBashIfSandboxed pair) to
- * the USER config. Claude persists these to settings.local.json (personal
- * per-project); our project-local tier does not exist yet, so the user
- * config is the interim destination — cross-project by nature, which the
- * confirmation message states honestly.
+ * the PROJECT-LOCAL config — Claude Code's own panel persists its mode
+ * choice to settings.local.json; ours now matches. Also fire-and-forgets
+ * the global-gitignore helper on first write.
  */
-function persistSandboxMode(choice, stateHome) {
-    const target = join(stateHome, "config.json");
-    mutateConfigJson(target, (config) => {
+function persistSandboxMode(choice, cwd) {
+    mutateLocalConfig(cwd, (config) => {
         const sandbox = isPlainRecord(config.sandbox) ? { ...config.sandbox } : {};
         if (choice === "auto-allow") {
             sandbox.enabled = true;
@@ -678,17 +733,16 @@ function persistSandboxMode(choice, stateHome) {
             sandbox.autoAllowBashIfSandboxed = false;
         }
         config.sandbox = sandbox;
-    });
+    }, "sandbox");
 }
 /** Persist a panel Overrides choice (allowUnsandboxedCommands) — same
  * destination + honesty contract as persistSandboxMode. */
-function persistSandboxOverride(choice, stateHome) {
-    const target = join(stateHome, "config.json");
-    mutateConfigJson(target, (config) => {
+function persistSandboxOverride(choice, cwd) {
+    mutateLocalConfig(cwd, (config) => {
         const sandbox = isPlainRecord(config.sandbox) ? { ...config.sandbox } : {};
         sandbox.allowUnsandboxedCommands = choice === "open";
         config.sandbox = sandbox;
-    });
+    }, "sandbox");
 }
 /**
  * Wait for a spawned child's exit without hanging on inherited stdio —

package/dist/extension/settingsFiles.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Shared settings-file plumbing for the three YAGNI Code settings tiers:
+ *   user    ~/.yagni-code/config.json                 (always trusted)
+ *   project .yagni-code/config.json under the cwd    (shared, committed)
+ *   local   .yagni-code/config.local.json under cwd  (personal, gitignored)
+ *
+ * Owns the atomic config mutation (promoted from sandbox/session.ts, the
+ * single copy now) and the global-gitignore helper (Claude Code
+ * addFileGlobRuleToGitignore parity): on the first write to the local file,
+ * the LOCAL_GITIGNORE_ENTRY glob lands in the GLOBAL git ignore file so
+ * personal settings are never committed. Fail-soft by design — a gitignore
+ * failure never fails the settings write.
+ */
+export declare function mutateConfigJson(target: string, mutate: (config: Record<string, unknown>) => void): void;
+/** The project-local settings path for a session cwd. */
+export declare function localConfigPath(cwd: string): string;
+/**
+ * Mutate the project-local settings file. Every write fire-and-forgets
+ * ensureLocalGitignored (Claude parity: the local tier is added to the
+ * global git ignore on write, not on session start). The helper is
+ * fire-and-forget BY DESIGN — the write's success notice is not gated on
+ * two git spawns; when the gitignore step is skipped or fails, the sink
+ * warn (gitignore_skipped / gitignore_update_failed) is the designed
+ * signal, surfaced via the diagnostics trail.
+ *
+ * `sinkSource` attributes those sink events to the caller's surface
+ * ("permission-rules" for rule saves, "sandbox" for panel/toggle writes) —
+ * the diagnostics trail then says which surface's write failed to get
+ * ignore-protected, not a blanket permission-rules line for every write.
+ */
+export declare function mutateLocalConfig(cwd: string, mutate: (config: Record<string, unknown>) => void, sinkSource?: string): void;
+/**
+ * The global git ignore path git actually reads. Git consults
+ * $XDG_CONFIG_HOME/git/ignore (defaulting ~/.config/git/ignore) — honoring
+ * XDG is a deliberate divergence from Claude (which hardcodes ~/.config):
+ * writing a file git will not read when XDG is set would be a silent no-op.
+ */
+export declare function globalGitignorePath(env?: NodeJS.ProcessEnv): string;
+/**
+ * Ensure the LOCAL_GITIGNORE_ENTRY glob (covering config.local.json at any
+ * depth) is ignored by the user's GLOBAL git config so local settings are
+ * never committed. Skip when:
+ *  - cwd is not inside a git repo (nothing to protect);
+ *  - `git check-ignore` already matches (local or global patterns cover it);
+ *  - the global ignore file already carries the literal entry.
+ * Any failure logs one warn sink event and returns — the settings write it
+ * accompanies has already succeeded and must not be walked back.
+ */
+export declare function ensureLocalGitignored(cwd: string, env?: NodeJS.ProcessEnv, sinkSource?: string): Promise<void>;
+//# sourceMappingURL=settingsFiles.d.ts.map