@yagni-app/code 1.0.7 → 1.0.9

package/dist/extension/permissionRules/loadConfig.d.ts

@@ -1,23 +1,29 @@
 /**
  * Permission-rule settings loader.
  *
- * Reads `permissions: { allow, deny, ask }` from the two YAGNI Code settings
- * files, mirroring the hooks loader (hooks.ts) shape exactly:
- *   - user:      ~/.yagni-code/config.json — always active
- *   - project:   .yagni-code/config.json   — deny/ask always active;
- *                allow gated on workspace trust (Claude Code semantics:
- *                "deny and ask rules apply right away; allow rules from a
- *                project file wait for trust")
+ * Reads `permissions: { allow, deny, ask }` from the three YAGNI Code
+ * settings files, mirroring the hooks loader (hooks.ts) shape exactly:
+ *   - user:    ~/.yagni-code/config.json       — always active
+ *   - project: .yagni-code/config.json         — deny/ask always active;
+ *              allow gated on workspace trust (Claude Code semantics:
+ *              "deny and ask rules apply right away; allow rules from a
+ *              project file wait for trust")
+ *   - local:   .yagni-code/config.local.json   — the personal per-project
+ *              tier; trust-gated EXACTLY like project (a hostile repo can
+ *              commit a local file — the gitignore convention only covers
+ *              untracked files). Deliberately stricter than Claude Code,
+ *              which does not trust-gate localSettings.
  *
  * Lists UNION across sources (Claude Code: lists merge, never replace).
- * User-source rules are ordered before project-source rules so path-pattern
- * negation (`!exception`) behaves like gitignore lines across files.
+ * User-source rules are ordered before project-source rules, project before
+ * local, so path-pattern negation (`!exception`) behaves like gitignore
+ * lines across files — higher-precedence sources come later (later wins).
  *
  * Fail-soft: a malformed config file is skipped whole with a warning (same
  * posture as hooks.ts). Malformed individual rule strings parse as bare
  * tool names (parser degrades, never throws) and are flagged.
  */
-export type RuleSource = "user" | "project";
+export type RuleSource = "user" | "project" | "local";
 export type RuleBehavior = "allow" | "deny" | "ask";
 /** A parsed, sourced permission rule. */
 export interface PermissionRule {
@@ -40,7 +46,7 @@ export interface LoadedRules {
 }
 /** The tools a rule can actually be consulted for at the gate. */
 export declare const KNOWN_RULE_TOOLS: Set<string>;
-/** Load + union rules from both files. Pure I/O; no throw. */
+/** Load + union rules from all three files. Pure I/O; no throw. */
 export declare function loadPermissionRules(opts?: {
     cwd?: string;
     env?: NodeJS.ProcessEnv;
@@ -48,6 +54,11 @@ export declare function loadPermissionRules(opts?: {
     /** Override the user state home (tests). */
     stateHomeOverride?: string | null;
 }): LoadedRules;
-/** Filter rules by behavior + trust (project allow needs trust; deny/ask always). */
+/**
+ * Filter rules by behavior + trust. Untrusted repos keep deny/ask from every
+ * source but lose allow rules from BOTH project and local files — a
+ * committed config.local.json must not smuggle allow rules past the trust
+ * gate (see the module header; stricter than Claude Code's localSettings).
+ */
 export declare function effectiveRules(rules: readonly PermissionRule[], isProjectTrusted: boolean): PermissionRule[];
 //# sourceMappingURL=loadConfig.d.ts.map

package/dist/extension/permissionRules/loadConfig.js

@@ -1,17 +1,23 @@
 /**
  * Permission-rule settings loader.
  *
- * Reads `permissions: { allow, deny, ask }` from the two YAGNI Code settings
- * files, mirroring the hooks loader (hooks.ts) shape exactly:
- *   - user:      ~/.yagni-code/config.json — always active
- *   - project:   .yagni-code/config.json   — deny/ask always active;
- *                allow gated on workspace trust (Claude Code semantics:
- *                "deny and ask rules apply right away; allow rules from a
- *                project file wait for trust")
+ * Reads `permissions: { allow, deny, ask }` from the three YAGNI Code
+ * settings files, mirroring the hooks loader (hooks.ts) shape exactly:
+ *   - user:    ~/.yagni-code/config.json       — always active
+ *   - project: .yagni-code/config.json         — deny/ask always active;
+ *              allow gated on workspace trust (Claude Code semantics:
+ *              "deny and ask rules apply right away; allow rules from a
+ *              project file wait for trust")
+ *   - local:   .yagni-code/config.local.json   — the personal per-project
+ *              tier; trust-gated EXACTLY like project (a hostile repo can
+ *              commit a local file — the gitignore convention only covers
+ *              untracked files). Deliberately stricter than Claude Code,
+ *              which does not trust-gate localSettings.
  *
  * Lists UNION across sources (Claude Code: lists merge, never replace).
- * User-source rules are ordered before project-source rules so path-pattern
- * negation (`!exception`) behaves like gitignore lines across files.
+ * User-source rules are ordered before project-source rules, project before
+ * local, so path-pattern negation (`!exception`) behaves like gitignore
+ * lines across files — higher-precedence sources come later (later wins).
  *
  * Fail-soft: a malformed config file is skipped whole with a warning (same
  * posture as hooks.ts). Malformed individual rule strings parse as bare
@@ -64,27 +70,36 @@ function readRulesFromFile(path, source, behavior, out, warnings) {
         warnings.push(`${source} settings: malformed JSON — permissions skipped (${path})`);
     }
 }
-/** Load + union rules from both files. Pure I/O; no throw. */
+/** Load + union rules from all three files. Pure I/O; no throw. */
 export function loadPermissionRules(opts = {}) {
     const warnings = [];
     const rules = [];
     const stateHome = opts.stateHomeOverride ?? codeStateHome(null, opts.env, opts.userHome);
+    const cwd = opts.cwd ?? process.cwd();
     const userPath = join(stateHome, "config.json");
-    const projectPath = join(opts.cwd ?? process.cwd(), ".yagni-code", "config.json");
-    // User first, project second — ordering matters for path-rule negation.
+    const projectPath = join(cwd, ".yagni-code", "config.json");
+    const localPath = join(cwd, ".yagni-code", "config.local.json");
+    // User, then project, then local — ordering matters for path-rule
+    // negation (later sources win, matching scalar precedence).
     for (const behavior of ["deny", "ask", "allow"]) {
         readRulesFromFile(userPath, "user", behavior, rules, warnings);
         readRulesFromFile(projectPath, "project", behavior, rules, warnings);
+        readRulesFromFile(localPath, "local", behavior, rules, warnings);
     }
     const neverConsultedTools = [
         ...new Set(rules.map((r) => r.toolName).filter((t) => !KNOWN_RULE_TOOLS.has(t) && !t.startsWith("mcp__"))),
     ];
     return { rules, diagnostics: { warnings, neverConsultedTools } };
 }
-/** Filter rules by behavior + trust (project allow needs trust; deny/ask always). */
+/**
+ * Filter rules by behavior + trust. Untrusted repos keep deny/ask from every
+ * source but lose allow rules from BOTH project and local files — a
+ * committed config.local.json must not smuggle allow rules past the trust
+ * gate (see the module header; stricter than Claude Code's localSettings).
+ */
 export function effectiveRules(rules, isProjectTrusted) {
     if (isProjectTrusted)
         return [...rules];
-    return rules.filter((r) => !(r.source === "project" && r.behavior === "allow"));
+    return rules.filter((r) => !(r.source !== "user" && r.behavior === "allow"));
 }
 //# sourceMappingURL=loadConfig.js.map

package/dist/extension/permissionRules/pathRules.d.ts

@@ -8,15 +8,17 @@
  *   //path   absolute from filesystem root
  *   ~/path   relative to the user's home directory
  *   /path    relative to the SETTINGS FILE's directory (user config →
- *            ~/.yagni-code/, project config → the project root)
+ *            ~/.yagni-code/, project AND local configs → the project root —
+ *            local lives in the same .yagni-code dir as project)
  *   path     relative to the session cwd; a bare filename matches at ANY
  *            depth (`.env` equals `**` / `.env` in glob terms)
  *
  * Compile semantics: all patterns for one (tool-class, behavior) compile
  * into ONE ordered `ignore` instance — user-source patterns first, then
- * project — so gitignore's later-line-wins and `!exception` negation work
- * across rules from both files (Claude Code's matchingRuleForInput builds
- * one ignore().add(patterns) per root the same way).
+ * project, then local — so gitignore's later-line-wins and `!exception`
+ * negation work across rules from all three files (Claude Code's
+ * matchingRuleForInput builds one ignore().add(patterns) per root the same
+ * way; local patterns are the last/highest-precedence "lines").
  *
  * Behavior asymmetry (Claude Code parity): allow rules with a rootless
  * single-segment pattern anchor at the settings dir (narrow); deny/ask
@@ -40,9 +42,9 @@ export interface ResolvedPathPattern {
 }
 /**
  * Split an anchored pattern into (root, relativePattern). Mirrors Claude
- * Code's patternWithRoot. Project-source `/` anchors at the project root
- * (passed in); user-source `/` anchors at the YAGNI Code state home
- * (~/.yagni-code).
+ * Code's patternWithRoot. Project- and local-source `/` anchors at the
+ * project root (passed in) — local shares project's .yagni-code dir;
+ * user-source `/` anchors at the YAGNI Code state home (~/.yagni-code).
  */
 export declare function resolvePatternRoot(pattern: string, source: RuleSource, opts: {
     userStateHome: string;

package/dist/extension/permissionRules/pathRules.js

@@ -8,15 +8,17 @@
  *   //path   absolute from filesystem root
  *   ~/path   relative to the user's home directory
  *   /path    relative to the SETTINGS FILE's directory (user config →
- *            ~/.yagni-code/, project config → the project root)
+ *            ~/.yagni-code/, project AND local configs → the project root —
+ *            local lives in the same .yagni-code dir as project)
  *   path     relative to the session cwd; a bare filename matches at ANY
  *            depth (`.env` equals `**` / `.env` in glob terms)
  *
  * Compile semantics: all patterns for one (tool-class, behavior) compile
  * into ONE ordered `ignore` instance — user-source patterns first, then
- * project — so gitignore's later-line-wins and `!exception` negation work
- * across rules from both files (Claude Code's matchingRuleForInput builds
- * one ignore().add(patterns) per root the same way).
+ * project, then local — so gitignore's later-line-wins and `!exception`
+ * negation work across rules from all three files (Claude Code's
+ * matchingRuleForInput builds one ignore().add(patterns) per root the same
+ * way; local patterns are the last/highest-precedence "lines").
  *
  * Behavior asymmetry (Claude Code parity): allow rules with a rootless
  * single-segment pattern anchor at the settings dir (narrow); deny/ask
@@ -42,9 +44,9 @@ export function pathClassForTool(toolName) {
 }
 /**
  * Split an anchored pattern into (root, relativePattern). Mirrors Claude
- * Code's patternWithRoot. Project-source `/` anchors at the project root
- * (passed in); user-source `/` anchors at the YAGNI Code state home
- * (~/.yagni-code).
+ * Code's patternWithRoot. Project- and local-source `/` anchors at the
+ * project root (passed in) — local shares project's .yagni-code dir;
+ * user-source `/` anchors at the YAGNI Code state home (~/.yagni-code).
  */
 export function resolvePatternRoot(pattern, source, opts) {
     if (pattern.startsWith("//")) {
@@ -55,7 +57,7 @@ export function resolvePatternRoot(pattern, source, opts) {
         return { relativePattern: rel, root: opts.homeDir ?? homedir(), source };
     }
     if (pattern.startsWith("/") && !pattern.startsWith("//")) {
-        const base = source === "project" ? opts.projectRoot : opts.userStateHome;
+        const base = source === "user" ? opts.userStateHome : opts.projectRoot;
         return { relativePattern: pattern, root: base ?? opts.userStateHome, source };
     }
     // Rootless: `./x` normalized to `x`; bare names keep any-depth semantics.

package/dist/extension/sandbox/config.d.ts

@@ -1,16 +1,17 @@
 /**
- * Sandbox settings schema + layered config load (user + project), shaped after
- * Claude Code's SandboxSettingsSchema subset so a Claude `sandbox` block
- * copied verbatim parses and resolves identically.
+ * Sandbox settings schema + layered config load (user + project + local),
+ * shaped after Claude Code's SandboxSettingsSchema subset so a Claude
+ * `sandbox` block copied verbatim parses and resolves identically.
  *
- * Files: the `sandbox` key in ~/.yagni-code/config.json (user) and
- * .yagni-code/config.json (project) — the same pair permissionRules reads,
- * so one settings file drives both the permission layer and the sandbox.
+ * Files: the `sandbox` key in ~/.yagni-code/config.json (user),
+ * .yagni-code/config.json (project), and .yagni-code/config.local.json
+ * (local — the personal per-project tier; the /sandbox panel and toggle
+ * persist HERE).
  *
- * Merge semantics (Claude parity): scalars — project wins over user over
- * defaults; arrays — union + dedupe across sources (lists merge, never
- * replace). Fail-soft: a malformed file is skipped whole with a warning
- * (same posture as permissionRules/loadConfig.ts).
+ * Merge semantics (Claude parity): scalars — local wins over project over
+ * user over defaults; arrays — union + dedupe across sources (lists merge,
+ * never replace). Fail-soft: a malformed file is skipped whole with a
+ * warning (same posture as permissionRules/loadConfig.ts).
  *
  * Read/write filesystem semantics (srt, verified in the M0 spike): reads are
  * allowed by default with denyRead regions + allowRead re-allow; writes are
@@ -64,10 +65,10 @@ export interface LoadedSandboxConfig {
  */
 export declare function readSandboxSettingsFromFile(configPath: string, warnings: string[], unknownKeys: string[]): SandboxSettings | undefined;
 /**
- * Load + merge sandbox settings from both config files. Scalars: project
- * beats user; arrays: union. Defaults for scalars land here too (Claude
- * parity): autoAllowBashIfSandboxed true, allowUnsandboxedCommands true,
- * everything else unset/false.
+ * Load + merge sandbox settings from all three config files. Scalars: local
+ * beats project beats user; arrays: union. Defaults for scalars land here
+ * too (Claude parity): autoAllowBashIfSandboxed true, allowUnsandboxedCommands
+ * true, everything else unset/false.
  */
 export declare function loadSandboxSettings(opts?: {
     cwd?: string;

package/dist/extension/sandbox/config.js

@@ -1,16 +1,17 @@
 /**
- * Sandbox settings schema + layered config load (user + project), shaped after
- * Claude Code's SandboxSettingsSchema subset so a Claude `sandbox` block
- * copied verbatim parses and resolves identically.
+ * Sandbox settings schema + layered config load (user + project + local),
+ * shaped after Claude Code's SandboxSettingsSchema subset so a Claude
+ * `sandbox` block copied verbatim parses and resolves identically.
  *
- * Files: the `sandbox` key in ~/.yagni-code/config.json (user) and
- * .yagni-code/config.json (project) — the same pair permissionRules reads,
- * so one settings file drives both the permission layer and the sandbox.
+ * Files: the `sandbox` key in ~/.yagni-code/config.json (user),
+ * .yagni-code/config.json (project), and .yagni-code/config.local.json
+ * (local — the personal per-project tier; the /sandbox panel and toggle
+ * persist HERE).
  *
- * Merge semantics (Claude parity): scalars — project wins over user over
- * defaults; arrays — union + dedupe across sources (lists merge, never
- * replace). Fail-soft: a malformed file is skipped whole with a warning
- * (same posture as permissionRules/loadConfig.ts).
+ * Merge semantics (Claude parity): scalars — local wins over project over
+ * user over defaults; arrays — union + dedupe across sources (lists merge,
+ * never replace). Fail-soft: a malformed file is skipped whole with a
+ * warning (same posture as permissionRules/loadConfig.ts).
  *
  * Read/write filesystem semantics (srt, verified in the M0 spike): reads are
  * allowed by default with denyRead regions + allowRead re-allow; writes are
@@ -68,7 +69,11 @@ export function readSandboxSettingsFromFile(configPath, warnings, unknownKeys) {
         parsed = JSON.parse(readFileSync(configPath, "utf-8"));
     }
     catch (err) {
-        warnings.push(`sandbox: could not parse ${configPath}: ${err instanceof Error ? err.message : String(err)}`);
+        // Error CLASS only, never the thrown message: V8's JSON.parse message
+        // embeds a snippet of the file's own content, and these warnings are
+        // forwarded verbatim into the error sink — a corrupt/hostile config's
+        // contents must not ride the trail. Path + class stays diagnosable.
+        warnings.push(`sandbox: could not parse ${configPath}: ${err instanceof Error ? err.constructor.name : typeof err}`);
         return undefined;
     }
     if (!isPlainObject(parsed) || parsed.sandbox === undefined)
@@ -178,54 +183,69 @@ function union(...lists) {
         return undefined;
     return [...new Set(present.flat())];
 }
-function mergeNetwork(user, project) {
+function mergeNetwork(user, project, local) {
     const u = user ?? {};
     const p = project ?? {};
+    const l = local ?? {};
     return {
-        allowedDomains: union(u.allowedDomains, p.allowedDomains) ?? [],
-        deniedDomains: union(u.deniedDomains, p.deniedDomains) ?? [],
-        allowUnixSockets: union(u.allowUnixSockets, p.allowUnixSockets),
-        allowAllUnixSockets: p.allowAllUnixSockets ?? u.allowAllUnixSockets,
-        allowLocalBinding: p.allowLocalBinding ?? u.allowLocalBinding,
-        httpProxyPort: p.httpProxyPort ?? u.httpProxyPort,
-        socksProxyPort: p.socksProxyPort ?? u.socksProxyPort,
+        allowedDomains: union(u.allowedDomains, p.allowedDomains, l.allowedDomains) ?? [],
+        deniedDomains: union(u.deniedDomains, p.deniedDomains, l.deniedDomains) ?? [],
+        allowUnixSockets: union(u.allowUnixSockets, p.allowUnixSockets, l.allowUnixSockets),
+        allowAllUnixSockets: l.allowAllUnixSockets ?? p.allowAllUnixSockets ?? u.allowAllUnixSockets,
+        allowLocalBinding: l.allowLocalBinding ?? p.allowLocalBinding ?? u.allowLocalBinding,
+        httpProxyPort: l.httpProxyPort ?? p.httpProxyPort ?? u.httpProxyPort,
+        socksProxyPort: l.socksProxyPort ?? p.socksProxyPort ?? u.socksProxyPort,
     };
 }
-function mergeFilesystem(user, project) {
+function mergeFilesystem(user, project, local) {
     const u = user ?? {};
     const p = project ?? {};
+    const l = local ?? {};
     return {
-        allowRead: union(u.allowRead, p.allowRead),
-        denyRead: union(u.denyRead, p.denyRead) ?? [],
-        allowWrite: union(u.allowWrite, p.allowWrite) ?? [],
-        denyWrite: union(u.denyWrite, p.denyWrite) ?? [],
+        allowRead: union(u.allowRead, p.allowRead, l.allowRead),
+        denyRead: union(u.denyRead, p.denyRead, l.denyRead) ?? [],
+        allowWrite: union(u.allowWrite, p.allowWrite, l.allowWrite) ?? [],
+        denyWrite: union(u.denyWrite, p.denyWrite, l.denyWrite) ?? [],
     };
 }
 /**
- * Load + merge sandbox settings from both config files. Scalars: project
- * beats user; arrays: union. Defaults for scalars land here too (Claude
- * parity): autoAllowBashIfSandboxed true, allowUnsandboxedCommands true,
- * everything else unset/false.
+ * Load + merge sandbox settings from all three config files. Scalars: local
+ * beats project beats user; arrays: union. Defaults for scalars land here
+ * too (Claude parity): autoAllowBashIfSandboxed true, allowUnsandboxedCommands
+ * true, everything else unset/false.
  */
 export function loadSandboxSettings(opts = {}) {
     const warnings = [];
     const unknownKeys = [];
     const stateHome = opts.stateHomeOverride ?? codeStateHome(null, opts.env, opts.userHome);
+    const cwd = opts.cwd ?? process.cwd();
     const userPath = join(stateHome, "config.json");
-    const projectPath = join(opts.cwd ?? process.cwd(), ".yagni-code", "config.json");
+    const projectPath = join(cwd, ".yagni-code", "config.json");
+    const localPath = join(cwd, ".yagni-code", "config.local.json");
     const userSettings = readSandboxSettingsFromFile(userPath, warnings, unknownKeys);
     const projectSettings = readSandboxSettingsFromFile(projectPath, warnings, unknownKeys);
+    const localSettings = readSandboxSettingsFromFile(localPath, warnings, unknownKeys);
     const settings = {
-        enabled: projectSettings?.enabled ?? userSettings?.enabled ?? false,
-        autoAllowBashIfSandboxed: projectSettings?.autoAllowBashIfSandboxed ?? userSettings?.autoAllowBashIfSandboxed ?? true,
-        allowUnsandboxedCommands: projectSettings?.allowUnsandboxedCommands ?? userSettings?.allowUnsandboxedCommands ?? true,
-        failIfUnavailable: projectSettings?.failIfUnavailable ?? userSettings?.failIfUnavailable ?? false,
-        excludedCommands: union(userSettings?.excludedCommands, projectSettings?.excludedCommands) ?? [],
-        network: mergeNetwork(userSettings?.network, projectSettings?.network),
-        filesystem: mergeFilesystem(userSettings?.filesystem, projectSettings?.filesystem),
-        ignoreViolations: projectSettings?.ignoreViolations ?? userSettings?.ignoreViolations,
-        enableWeakerNestedSandbox: projectSettings?.enableWeakerNestedSandbox ?? userSettings?.enableWeakerNestedSandbox,
-        enableWeakerNetworkIsolation: projectSettings?.enableWeakerNetworkIsolation ?? userSettings?.enableWeakerNetworkIsolation,
+        enabled: localSettings?.enabled ?? projectSettings?.enabled ?? userSettings?.enabled ?? false,
+        autoAllowBashIfSandboxed: localSettings?.autoAllowBashIfSandboxed ??
+            projectSettings?.autoAllowBashIfSandboxed ??
+            userSettings?.autoAllowBashIfSandboxed ??
+            true,
+        allowUnsandboxedCommands: localSettings?.allowUnsandboxedCommands ??
+            projectSettings?.allowUnsandboxedCommands ??
+            userSettings?.allowUnsandboxedCommands ??
+            true,
+        failIfUnavailable: localSettings?.failIfUnavailable ?? projectSettings?.failIfUnavailable ?? userSettings?.failIfUnavailable ?? false,
+        excludedCommands: union(userSettings?.excludedCommands, projectSettings?.excludedCommands, localSettings?.excludedCommands) ?? [],
+        network: mergeNetwork(userSettings?.network, projectSettings?.network, localSettings?.network),
+        filesystem: mergeFilesystem(userSettings?.filesystem, projectSettings?.filesystem, localSettings?.filesystem),
+        ignoreViolations: localSettings?.ignoreViolations ?? projectSettings?.ignoreViolations ?? userSettings?.ignoreViolations,
+        enableWeakerNestedSandbox: localSettings?.enableWeakerNestedSandbox ??
+            projectSettings?.enableWeakerNestedSandbox ??
+            userSettings?.enableWeakerNestedSandbox,
+        enableWeakerNetworkIsolation: localSettings?.enableWeakerNetworkIsolation ??
+            projectSettings?.enableWeakerNetworkIsolation ??
+            userSettings?.enableWeakerNetworkIsolation,
     };
     return { settings, diagnostics: { warnings, unknownKeys } };
 }
@@ -343,8 +363,10 @@ export function mergeRulesIntoSandbox(settings, rules, base) {
     // Protected paths: always denyWrite, never exempted (Claude parity + our
     // own surfaces). Note srt denyWrite also denies read-of-ignored writes.
     denyWrite.add(join(base.userStateHome, "config.json"));
-    if (base.projectRoot)
+    if (base.projectRoot) {
         denyWrite.add(join(base.projectRoot, ".yagni-code", "config.json"));
+        denyWrite.add(join(base.projectRoot, ".yagni-code", "config.local.json"));
+    }
     denyWrite.add(base.userStateHome);
     if (base.projectRoot)
         denyWrite.add(join(base.projectRoot, ".yagni-code"));

package/dist/extension/sandbox/manager.d.ts

@@ -46,7 +46,17 @@ export declare class YagniSandboxManager {
     private state;
     private askHandler;
     private readonly opts;
+    /** Config warnings already logged this process — buildRuntimeMerge runs
+     * per grant/setRules refresh, and re-logging the same corrupt-file warning
+     * per call would flood the trail with one line per grant. */
+    private loggedConfigWarnings;
     constructor(opts: SandboxSessionOptions);
+    /** Surface loader diagnostics (warnings + unknown keys) once per string
+     * per process: a corrupt or wrong-shaped sandbox block in any of the
+     * three config files is skipped whole (fail-soft), and a silently ignored
+     * config (or a typo'd key) needs its signal — same posture as index.ts
+     * surfacing the rule-loader warnings. */
+    private surfaceConfigDiagnostics;
     get initialized(): boolean;
     get settings(): SandboxSettings | null;
     get dependencies(): SandboxDependencyStatus | null;

package/dist/extension/sandbox/manager.js

@@ -24,10 +24,33 @@ export class YagniSandboxManager {
     state = { initialized: false, dependencies: null, settings: null };
     askHandler = null;
     opts;
+    /** Config warnings already logged this process — buildRuntimeMerge runs
+     * per grant/setRules refresh, and re-logging the same corrupt-file warning
+     * per call would flood the trail with one line per grant. */
+    loggedConfigWarnings = new Set();
     constructor(opts) {
         this.opts = opts;
         this.askHandler = opts.askHandler ?? null;
     }
+    /** Surface loader diagnostics (warnings + unknown keys) once per string
+     * per process: a corrupt or wrong-shaped sandbox block in any of the
+     * three config files is skipped whole (fail-soft), and a silently ignored
+     * config (or a typo'd key) needs its signal — same posture as index.ts
+     * surfacing the rule-loader warnings. */
+    surfaceConfigDiagnostics(diagnostics) {
+        const messages = [
+            ...diagnostics.warnings,
+            ...(diagnostics.unknownKeys.length > 0
+                ? [`sandbox: unknown keys ignored: ${diagnostics.unknownKeys.join(", ")}`]
+                : []),
+        ];
+        for (const message of messages) {
+            if (this.loggedConfigWarnings.has(message))
+                continue;
+            this.loggedConfigWarnings.add(message);
+            logEvent({ source: "sandbox", level: "warn", event: "sandbox_config_warning", fields: { warning: message } });
+        }
+    }
     get initialized() { return this.state.initialized; }
     get settings() { return this.state.settings; }
     get dependencies() { return this.state.dependencies; }
@@ -75,12 +98,13 @@ export class YagniSandboxManager {
      * tests; initialize() consumes it internally.
      */
     buildRuntimeMerge(rules) {
-        const { settings } = loadSandboxSettings({
+        const { settings, diagnostics } = loadSandboxSettings({
             cwd: this.opts.cwd,
             env: this.opts.env,
             userHome: this.opts.userHome,
             stateHomeOverride: this.opts.stateHomeOverride,
         });
+        this.surfaceConfigDiagnostics(diagnostics);
         return mergeRulesIntoSandbox(settings, rules, {
             cwd: this.opts.cwd,
             userStateHome: this.opts.stateHomeOverride ?? codeStateHome(null, this.opts.env, this.opts.userHome),
@@ -134,6 +158,9 @@ export class YagniSandboxManager {
             userHome: this.opts.userHome,
             stateHomeOverride: this.opts.stateHomeOverride,
         });
+        // Same warning surfacing as buildRuntimeMerge — initialize() skips
+        // buildRuntimeMerge on the disabled path, so its own load reports too.
+        this.surfaceConfigDiagnostics(load.diagnostics);
         if (!load.settings.enabled && !opts.force)
             return "sandbox disabled by config";
         const deps = this.checkDependencies();