@yagni-app/code 1.0.8 → 1.1.0

package/dist/extension/sandbox/panel.js

@@ -20,6 +20,7 @@
  */
 import { Box, Container, HStack, Key, SelectList, Text, matchesKey, } from "@earendil-works/pi-tui";
 import { mergeRulesIntoSandbox } from "./config.js";
+import { resolveWorktreeGitAccess } from "./worktreeGit.js";
 // ---------------------------------------------------------------------------
 // Pure derivation helpers (unit-tested; no TUI dependency)
 // ---------------------------------------------------------------------------
@@ -335,7 +336,7 @@ export function buildPanelState(settings, sessionToggledOff, rules, paths, sessi
         sessionToggledOff,
         dependencyErrors: dependencyStatus.errors,
         dependencyWarnings: dependencyStatus.warnings,
-        merge: mergeRulesIntoSandbox(settings, rules, paths),
+        merge: mergeRulesIntoSandbox(settings, rules, paths, resolveWorktreeGitAccess(paths.cwd)),
         sessionGrants: [...sessionGrants],
     };
 }

package/dist/extension/sandbox/session.js

@@ -22,6 +22,7 @@ import { codeStateHome } from "../stateHome.js";
 import { isDebug } from "../diagnostics.js";
 import { mutateConfigJson, mutateLocalConfig } from "../settingsFiles.js";
 import { loadSandboxSettings } from "./config.js";
+import { resolveWorktreeGitAccess } from "./worktreeGit.js";
 import { annotateCommandOutput, makeSandboxSpawnHook, preWrappedCommand, shouldUseSandbox, shouldUseSandboxForUserCommand, } from "./bash.js";
 import { YagniSandboxManager } from "./manager.js";
 import { SandboxPanel, buildPanelState } from "./panel.js";
@@ -68,6 +69,12 @@ export function makeBashComposition(manager, settings, cwd) {
             ? `Network: only these domains (wildcards ok): ${allowed.join(", ")}`
             : "Network: no domains pre-allowed — the first contact to each host prompts the user");
         restrictions.push(`Filesystem writes: working directory, /tmp, and paths granted by Edit(...) allow rules`);
+        // A linked-worktree session additionally allows the shared common git
+        // dir (git operations work sandboxed there); the description must say
+        // so or the model under-reports what it can do.
+        if (resolveWorktreeGitAccess(cwd)) {
+            restrictions.push("Filesystem writes (git): the linked worktree's shared .git directory — git operations (add/commit/branch/checkout) are allowed and should run sandboxed; its hooks/ and config remain read-only");
+        }
         if (s.filesystem?.denyWrite?.length)
             restrictions.push(`Denied writes: ${s.filesystem.denyWrite.join(", ")}`);
         const strictNote = s.allowUnsandboxedCommands === false

package/dist/extension/sandbox/worktreeGit.d.ts

@@ -0,0 +1,57 @@
+/**
+ * Linked-worktree git resolution for the sandbox. When the session cwd is
+ * the root of a linked worktree, routine git writes (status/add/commit/
+ * branch/checkout) land in the MAIN repo's shared `.git` directory —
+ * outside the sandbox's default write allowlist ({cwd, tmpdir()}), so every
+ * one of them fails with EPERM and forces the dangerouslyDisableSandbox
+ * retry path. Resolving the shared common git dir here lets the sandbox
+ * allow exactly that directory (never the main checkout's working tree).
+ *
+ * Resolution chain (Claude Code's resolveCanonicalRoot, src/utils/git.ts,
+ * applied to the sandbox problem — Claude's own sandbox side only does a
+ * shape check on the gitdir path, which would trust an attacker-crafted
+ * `.git` file; the full chain here is deliberately stricter):
+ *   cwd/.git file → `gitdir:` → resolve against cwd → <gitdir>/commondir →
+ *   resolve against gitdir → common git dir. Both validation checks from
+ *   the reference are enforced before anything is returned:
+ *   1. structural — the worktree gitdir is a direct child of
+ *      <commonDir>/worktrees/ (the commondir we read lives where git put it,
+ *      not wherever an attacker's `.git` file pointed);
+ *   2. back-link — <gitdir>/gitdir points back at THIS cwd's .git (an
+ *      attacker cannot borrow an existing worktree entry of another repo).
+ *
+ * Fail-through cases (all return null, no behavior change vs the
+ * pre-worktree-allow sandbox):
+ * plain main checkout (.git is a directory → EISDIR), no repo at all,
+ * submodule (.git file but no commondir), failed structural/back-link
+ * validation, any read/parse error.
+ *
+ * Bare-repo worktrees are supported: there the common dir is the bare repo
+ * itself (`<bare>/worktrees/<name>/commondir` → `<bare>`), so the allowed
+ * directory IS the common dir (Claude's `/.git/worktrees/` shape marker
+ * silently no-ops there; ours resolves it).
+ *
+ * Root-only by design (Claude sandbox-side parity): a session started in a
+ * worktree SUBDIRECTORY keeps the pre-existing behavior — the `.git` file
+ * sits only at the worktree root.
+ */
+/** Resolved write-target facts for a linked-worktree session. */
+export interface WorktreeGitAccess {
+    /** The shared common git dir git writes actually land in. */
+    commonGitDir: string;
+    /** Realpath'd worktree root (safe.directory needs the on-disk spelling). */
+    worktreeRoot: string;
+}
+/**
+ * Resolve the shared common git dir when cwd is a linked worktree root.
+ * Returns null for every non-worktree / untrusted shape — callers treat
+ * null as "no extra entries" and never widen the sandbox.
+ *
+ * Null REASONS are surfaced (debug level, paths only) whenever a `gitdir:`
+ * .git file existed but validation refused: a legitimate worktree that
+ * silently misses the allow is indistinguishable from "not a worktree"
+ * without them. The plain-repo / no-repo fall-throughs stay silent — they
+ * are the common case and carry no signal.
+ */
+export declare function resolveWorktreeGitAccess(cwd: string): WorktreeGitAccess | null;
+//# sourceMappingURL=worktreeGit.d.ts.map

package/dist/extension/sandbox/worktreeGit.js

@@ -0,0 +1,157 @@
+/**
+ * Linked-worktree git resolution for the sandbox. When the session cwd is
+ * the root of a linked worktree, routine git writes (status/add/commit/
+ * branch/checkout) land in the MAIN repo's shared `.git` directory —
+ * outside the sandbox's default write allowlist ({cwd, tmpdir()}), so every
+ * one of them fails with EPERM and forces the dangerouslyDisableSandbox
+ * retry path. Resolving the shared common git dir here lets the sandbox
+ * allow exactly that directory (never the main checkout's working tree).
+ *
+ * Resolution chain (Claude Code's resolveCanonicalRoot, src/utils/git.ts,
+ * applied to the sandbox problem — Claude's own sandbox side only does a
+ * shape check on the gitdir path, which would trust an attacker-crafted
+ * `.git` file; the full chain here is deliberately stricter):
+ *   cwd/.git file → `gitdir:` → resolve against cwd → <gitdir>/commondir →
+ *   resolve against gitdir → common git dir. Both validation checks from
+ *   the reference are enforced before anything is returned:
+ *   1. structural — the worktree gitdir is a direct child of
+ *      <commonDir>/worktrees/ (the commondir we read lives where git put it,
+ *      not wherever an attacker's `.git` file pointed);
+ *   2. back-link — <gitdir>/gitdir points back at THIS cwd's .git (an
+ *      attacker cannot borrow an existing worktree entry of another repo).
+ *
+ * Fail-through cases (all return null, no behavior change vs the
+ * pre-worktree-allow sandbox):
+ * plain main checkout (.git is a directory → EISDIR), no repo at all,
+ * submodule (.git file but no commondir), failed structural/back-link
+ * validation, any read/parse error.
+ *
+ * Bare-repo worktrees are supported: there the common dir is the bare repo
+ * itself (`<bare>/worktrees/<name>/commondir` → `<bare>`), so the allowed
+ * directory IS the common dir (Claude's `/.git/worktrees/` shape marker
+ * silently no-ops there; ours resolves it).
+ *
+ * Root-only by design (Claude sandbox-side parity): a session started in a
+ * worktree SUBDIRECTORY keeps the pre-existing behavior — the `.git` file
+ * sits only at the worktree root.
+ */
+import { readFileSync, realpathSync } from "node:fs";
+import { dirname, join, resolve } from "node:path";
+import { logEvent } from "../errorSink.js";
+import { isDebug } from "../diagnostics.js";
+/**
+ * Resolve the shared common git dir when cwd is a linked worktree root.
+ * Returns null for every non-worktree / untrusted shape — callers treat
+ * null as "no extra entries" and never widen the sandbox.
+ *
+ * Null REASONS are surfaced (debug level, paths only) whenever a `gitdir:`
+ * .git file existed but validation refused: a legitimate worktree that
+ * silently misses the allow is indistinguishable from "not a worktree"
+ * without them. The plain-repo / no-repo fall-throughs stay silent — they
+ * are the common case and carry no signal.
+ */
+export function resolveWorktreeGitAccess(cwd) {
+    let gitContent;
+    try {
+        gitContent = readFileSync(join(cwd, ".git"), "utf-8").trim();
+    }
+    catch {
+        // No .git, or .git is a directory (plain main checkout → EISDIR).
+        return null;
+    }
+    if (!gitContent.startsWith("gitdir:"))
+        return null;
+    // gitdir may be relative (rare, but git accepts it) — resolve against cwd.
+    const worktreeGitDir = resolve(cwd, gitContent.slice("gitdir:".length).trim());
+    const debugRefused = (reason) => {
+        if (!isDebug())
+            return;
+        logEvent({
+            source: "sandbox",
+            level: "debug",
+            event: "sandbox_worktree_git_refused",
+            fields: { reason, worktreeGitDir },
+        });
+    };
+    let commonContent;
+    try {
+        // Submodules have a .git file but no commondir (ENOENT → fall through).
+        commonContent = readFileSync(join(worktreeGitDir, "commondir"), "utf-8").trim();
+    }
+    catch {
+        debugRefused("no-commondir");
+        return null;
+    }
+    const commonDir = resolve(worktreeGitDir, commonContent);
+    // Structural check: the worktree gitdir must be a direct child of
+    // <commonDir>/worktrees — the commondir we just read must live inside the
+    // common dir it named, not at an arbitrary attacker-chosen path. win32
+    // compares case-insensitively (git preserves the casing used at worktree
+    // creation, so genuine worktrees can carry casing drift between the
+    // gitdir spelling and the commondir resolution); POSIX compares exactly.
+    const structuralMatches = process.platform === "win32"
+        ? dirname(worktreeGitDir).toLowerCase() === join(commonDir, "worktrees").toLowerCase()
+        : dirname(worktreeGitDir) === join(commonDir, "worktrees");
+    if (!structuralMatches) {
+        debugRefused("structural-mismatch");
+        return null;
+    }
+    // Back-link check: git writes <worktreeGitDir>/gitdir pointing back at
+    // this worktree's .git. Realpath the worktree root (not the .git entry —
+    // a symlinked .git must not be followed) so legitimate worktrees reached
+    // through a symlinked path (macOS /tmp → /private/tmp) still validate.
+    // win32: git's strbuf_realpath expands 8.3 short names (C:\\RUNNER~1 →
+    // runneradmin) when it writes the back-link, while Node's JS-side
+    // realpath does not — both sides go through realpathSync.native (which
+    // expands them) and compare case-insensitively, or every genuine
+    // worktree under a short-named TEMP would fail closed on spelling.
+    // POSIX compares exactly (symlinks already resolved by realpath).
+    let rawBacklink;
+    try {
+        rawBacklink = readFileSync(join(worktreeGitDir, "gitdir"), "utf-8").trim();
+    }
+    catch {
+        debugRefused("no-backlink");
+        return null;
+    }
+    let backlink;
+    try {
+        backlink = process.platform === "win32" ? realpathSync.native(rawBacklink) : realpathSync(rawBacklink);
+    }
+    catch {
+        // Exists but cannot be canonicalized: dangling symlink, permissions —
+        // a different failure than an absent back-link, and worth its own code.
+        debugRefused("backlink-unreadable");
+        return null;
+    }
+    let realCwd;
+    try {
+        realCwd = process.platform === "win32" ? realpathSync.native(cwd) : realpathSync(cwd);
+    }
+    catch {
+        return null;
+    }
+    const backlinkMatches = process.platform === "win32"
+        ? backlink.toLowerCase() === join(realCwd, ".git").toLowerCase()
+        : backlink === join(realCwd, ".git");
+    if (!backlinkMatches) {
+        debugRefused("backlink-mismatch");
+        return null;
+    }
+    return {
+        commonGitDir: safeRealpath(commonDir),
+        worktreeRoot: realCwd,
+    };
+}
+/** realpath that tolerates a vanished path (returns the input spelling) —
+ * post-validation only, so a stale spelling can never widen anything: the
+ * validation above already proved the entry structure exists. */
+function safeRealpath(p) {
+    try {
+        return realpathSync(p);
+    }
+    catch {
+        return p;
+    }
+}
+//# sourceMappingURL=worktreeGit.js.map

package/dist/extension/telemetry/attrs.d.ts

@@ -56,6 +56,13 @@ export declare const ATTR_GEN_AI_CACHE_CREATION_TOKENS_LEGACY = "gen_ai.usage.ca
  * Unit is NANODOLLARS (integer), not dollars: Datadog copies the value
  * unscaled into its nanodollar cost metric. */
 export declare const ATTR_GEN_AI_COST_ESTIMATED_TOTAL = "gen_ai.cost.estimated_total";
+/** Datadog's OTLP escape hatch: a JSON-object string merged into the LLM
+ * Observability span's `meta.metadata`. Its `_dd.cost_tags` list is where
+ * Datadog's own SDKs declare which span tags the Cost page may group spend
+ * by (the SDK-only `cost_tags` parameter); sending the same shape here is
+ * what makes `user.email` a Group-by option on the vendor Cost page.
+ * Verified against live probe spans on 2026-09-04. */
+export declare const ATTR_DD_LLMOBS_METADATA = "_dd.ml_obs.metadata";
 export declare const ATTR_GEN_AI_CONVERSATION_ID = "gen_ai.conversation.id";
 export declare const ATTR_GEN_AI_AGENT_NAME = "gen_ai.agent.name";
 export declare const ATTR_GEN_AI_TOOL_NAME = "gen_ai.tool.name";

package/dist/extension/telemetry/attrs.js

@@ -58,6 +58,13 @@ export const ATTR_GEN_AI_CACHE_CREATION_TOKENS_LEGACY = "gen_ai.usage.cache_crea
  * Unit is NANODOLLARS (integer), not dollars: Datadog copies the value
  * unscaled into its nanodollar cost metric. */
 export const ATTR_GEN_AI_COST_ESTIMATED_TOTAL = "gen_ai.cost.estimated_total";
+/** Datadog's OTLP escape hatch: a JSON-object string merged into the LLM
+ * Observability span's `meta.metadata`. Its `_dd.cost_tags` list is where
+ * Datadog's own SDKs declare which span tags the Cost page may group spend
+ * by (the SDK-only `cost_tags` parameter); sending the same shape here is
+ * what makes `user.email` a Group-by option on the vendor Cost page.
+ * Verified against live probe spans on 2026-09-04. */
+export const ATTR_DD_LLMOBS_METADATA = "_dd.ml_obs.metadata";
 export const ATTR_GEN_AI_CONVERSATION_ID = "gen_ai.conversation.id";
 export const ATTR_GEN_AI_AGENT_NAME = "gen_ai.agent.name";
 export const ATTR_GEN_AI_TOOL_NAME = "gen_ai.tool.name";

package/dist/extension/telemetry/tracker.js

@@ -20,7 +20,7 @@
 import { randomUUID } from "node:crypto";
 import { context as otelContext, SpanStatusCode, trace, } from "@opentelemetry/api";
 import { SeverityNumber } from "@opentelemetry/api-logs";
-import { ATTR_APP_ENTRYPOINT, ATTR_APP_VERSION, ATTR_ERROR_TYPE, ATTR_GEN_AI_AGENT_NAME, ATTR_GEN_AI_CACHE_CREATION_TOKENS_LEGACY, ATTR_GEN_AI_CACHE_READ_TOKENS, ATTR_GEN_AI_CACHE_READ_TOKENS_LEGACY, ATTR_GEN_AI_CACHE_WRITE_TOKENS, ATTR_GEN_AI_CONVERSATION_ID, ATTR_GEN_AI_COST_ESTIMATED_TOTAL, ATTR_GEN_AI_FINISH_REASONS, ATTR_GEN_AI_INPUT_TOKENS, ATTR_GEN_AI_OPERATION_NAME, ATTR_GEN_AI_OUTPUT_TOKENS, ATTR_GEN_AI_TOTAL_TOKENS, ATTR_GEN_AI_PROVIDER_NAME, ATTR_GEN_AI_REQUEST_MODEL, ATTR_GEN_AI_RESPONSE_ID, ATTR_GEN_AI_RESPONSE_MODEL, ATTR_GEN_AI_SYSTEM, ATTR_GEN_AI_TOOL_CALL_ID, ATTR_GEN_AI_TOOL_NAME, ATTR_GEN_AI_TOOL_TYPE, ATTR_HTTP_STATUS_CODE, ATTR_ORGANIZATION_ID, ATTR_SESSION_ID, ATTR_TERMINAL_TYPE, ATTR_USER_EMAIL, EVENT_API_ERROR, EVENT_API_REQUEST, EVENT_ASSISTANT_RESPONSE, EVENT_PERMISSION_MODE_CHANGED, EVENT_TOOL_DECISION, EVENT_TOOL_RESULT, EVENT_USER_PROMPT, GEN_AI_PROVIDER, languageFromPath, METRIC_ACTIVE_TIME, METRIC_CODE_EDIT_DECISION, METRIC_COMMIT_COUNT, METRIC_COST_USAGE, METRIC_LINES_OF_CODE, METRIC_PULL_REQUEST_COUNT, METRIC_SESSION_COUNT, METRIC_TOKEN_USAGE, PREFIX, SPAN_INTERACTION, SPAN_LLM_REQUEST, SPAN_TOOL, SPAN_TURN, } from "./attrs.js";
+import { ATTR_APP_ENTRYPOINT, ATTR_APP_VERSION, ATTR_ERROR_TYPE, ATTR_GEN_AI_AGENT_NAME, ATTR_GEN_AI_CACHE_CREATION_TOKENS_LEGACY, ATTR_GEN_AI_CACHE_READ_TOKENS, ATTR_GEN_AI_CACHE_READ_TOKENS_LEGACY, ATTR_GEN_AI_CACHE_WRITE_TOKENS, ATTR_DD_LLMOBS_METADATA, ATTR_GEN_AI_CONVERSATION_ID, ATTR_GEN_AI_COST_ESTIMATED_TOTAL, ATTR_GEN_AI_FINISH_REASONS, ATTR_GEN_AI_INPUT_TOKENS, ATTR_GEN_AI_OPERATION_NAME, ATTR_GEN_AI_OUTPUT_TOKENS, ATTR_GEN_AI_TOTAL_TOKENS, ATTR_GEN_AI_PROVIDER_NAME, ATTR_GEN_AI_REQUEST_MODEL, ATTR_GEN_AI_RESPONSE_ID, ATTR_GEN_AI_RESPONSE_MODEL, ATTR_GEN_AI_SYSTEM, ATTR_GEN_AI_TOOL_CALL_ID, ATTR_GEN_AI_TOOL_NAME, ATTR_GEN_AI_TOOL_TYPE, ATTR_HTTP_STATUS_CODE, ATTR_ORGANIZATION_ID, ATTR_SESSION_ID, ATTR_TERMINAL_TYPE, ATTR_USER_EMAIL, EVENT_API_ERROR, EVENT_API_REQUEST, EVENT_ASSISTANT_RESPONSE, EVENT_PERMISSION_MODE_CHANGED, EVENT_TOOL_DECISION, EVENT_TOOL_RESULT, EVENT_USER_PROMPT, GEN_AI_PROVIDER, languageFromPath, METRIC_ACTIVE_TIME, METRIC_CODE_EDIT_DECISION, METRIC_COMMIT_COUNT, METRIC_COST_USAGE, METRIC_LINES_OF_CODE, METRIC_PULL_REQUEST_COUNT, METRIC_SESSION_COUNT, METRIC_TOKEN_USAGE, PREFIX, SPAN_INTERACTION, SPAN_LLM_REQUEST, SPAN_TOOL, SPAN_TURN, } from "./attrs.js";
 /** Idle cutoff for user active time: gaps longer than this are not "active". */
 export const USER_ACTIVE_IDLE_CUTOFF_MS = 5 * 60 * 1000;
 const EDIT_TOOLS = new Set(["edit", "write", "multi_edit", "notebook_edit"]);
@@ -238,6 +238,13 @@ export class SessionTelemetry {
             attrs[ATTR_GEN_AI_REQUEST_MODEL] = model;
             attrs.model = model;
         }
+        // Declare `user.email` as a cost-breakdown tag for Datadog's Cost page.
+        // Only when the tag is actually on the span (same account gate): Datadog
+        // skips entries that reference a missing tag, but an empty declaration
+        // is noise. Bounded cardinality by construction: one value per seat.
+        if (ATTR_USER_EMAIL in attrs) {
+            attrs[ATTR_DD_LLMOBS_METADATA] = JSON.stringify({ _dd: { cost_tags: [ATTR_USER_EMAIL] } });
+        }
         const span = this.tracer.startSpan(SPAN_LLM_REQUEST, { attributes: attrs }, parent);
         this.llm = {
             span,

package/dist/mcpCommand.d.ts

@@ -38,6 +38,13 @@ export interface McpDeps {
 }
 /** The structural slice of the extension's mcp config surface this file needs. */
 export interface McpCliModule {
+    authenticate?(serverName: string, config: {
+        type: "http";
+        url: string;
+        tools: string[];
+    }): Promise<{
+        result: "AUTHORIZED";
+    }>;
     loadMcpServers(cwd: string, env: NodeJS.ProcessEnv): McpLoadResult;
     mcpConfigPath(): string;
     PROJECT_CONFIG_FILENAME: string;

package/dist/mcpCommand.js

@@ -21,7 +21,7 @@ import { fileURLToPath } from "node:url";
 import { CLAUDE_PLUGIN_MCP_ENV, claudeCompatArgs } from "./claudeCompat.js";
 import { agentDir } from "./credentials.js";
 import { DISTRIBUTION } from "./distribution.js";
-import { getActiveProfileName } from "./profiles.js";
+import { getActiveProfileName, readActiveProfile } from "./profiles.js";
 export function resolveMcpConfigPath() {
     const bundled = fileURLToPath(new URL("./extension/mcp/cliConfig.js", import.meta.url));
     if (existsSync(bundled))
@@ -55,6 +55,9 @@ Scopes:
   user     available in all your projects (~/.yagni-code/mcp.json)
   project  shared via .mcp.json at the repo root (approval-gated)
 
+Connect YAGNI Workers:
+  ${DISTRIBUTION.commandName} mcp connect-workers   Browser consent for the active environment
+
 Examples:
   ${DISTRIBUTION.commandName} mcp add --transport http sentry https://mcp.sentry.dev/mcp
   ${DISTRIBUTION.commandName} mcp add -e API_KEY=xxx my-server -- npx my-mcp-server
@@ -90,7 +93,10 @@ export function parseMcpArgs(argv) {
             rest.push(...after.slice(i + 1));
             break;
         }
-        if (flag === "s" || flag === "t" || flag === "client-id" || flag === "callback-port") {
+        if (flag === "s" ||
+            flag === "t" ||
+            flag === "client-id" ||
+            flag === "callback-port") {
             if (flag === "s") {
                 scope = scopeFrom(arg);
                 scopeExplicit = true;
@@ -204,11 +210,28 @@ export function parseMcpArgs(argv) {
         }
         rest.push(arg);
     }
-    if (flag === "s" || flag === "t" || flag === "client-id" || flag === "callback-port") {
+    if (flag === "s" ||
+        flag === "t" ||
+        flag === "client-id" ||
+        flag === "callback-port") {
         throw new Error("Missing flag value.");
     }
     const [name, ...commandArgs] = rest;
-    return { subcommand, name, rest, scope, scopeExplicit, transport, transportExplicit, env, headers, commandArgs, clientId, clientSecret, callbackPort };
+    return {
+        subcommand,
+        name,
+        rest,
+        scope,
+        scopeExplicit,
+        transport,
+        transportExplicit,
+        env,
+        headers,
+        commandArgs,
+        clientId,
+        clientSecret,
+        callbackPort,
+    };
 }
 function scopeFrom(value) {
     if (value === "local" || value === "user" || value === "project")
@@ -236,7 +259,11 @@ function describeScopePath(scope, cwd) {
 async function defaultPluginMcpEnv(cwd) {
     try {
         const profile = await getActiveProfileName();
-        const compat = await claudeCompatArgs({ cwd, agentDir: agentDir(profile), interactive: false });
+        const compat = await claudeCompatArgs({
+            cwd,
+            agentDir: agentDir(profile),
+            interactive: false,
+        });
         return compat.env[CLAUDE_PLUGIN_MCP_ENV];
     }
     catch {
@@ -272,6 +299,8 @@ export async function mcpCommand(args, deps = {}) {
         return 1;
     }
     switch (parsed.subcommand) {
+        case "connect-workers":
+            return connectWorkers(mod, parsed, { cwd, stdout, stderr }, deps.env ?? process.env);
         case undefined:
         case "help":
             stdout(USAGE);
@@ -283,18 +312,105 @@ export async function mcpCommand(args, deps = {}) {
         case "remove":
             return mcpRemove(mod, parsed, { cwd, stdout, stderr });
         case "list":
-            return mcpList(mod, { cwd, stdout, stderr, env: await envWithPluginMcp(deps, cwd), probeServer: deps.probeServer });
+            return mcpList(mod, {
+                cwd,
+                stdout,
+                stderr,
+                env: await envWithPluginMcp(deps, cwd),
+                probeServer: deps.probeServer,
+            });
         case "get":
-            return mcpGet(mod, parsed, { cwd, stdout, stderr, env: await envWithPluginMcp(deps, cwd), probeServer: deps.probeServer });
+            return mcpGet(mod, parsed, {
+                cwd,
+                stdout,
+                stderr,
+                env: await envWithPluginMcp(deps, cwd),
+                probeServer: deps.probeServer,
+            });
         case "reset-project-choices":
             return mcpResetChoices(mod, { cwd, stdout, stderr });
         case "add-from-claude":
-            return mcpAddFromClaude(mod, parsed, { cwd, stdout, stderr, home: deps.home ?? homedir() });
+            return mcpAddFromClaude(mod, parsed, {
+                cwd,
+                stdout,
+                stderr,
+                home: deps.home ?? homedir(),
+            });
         default:
             stderr(`Unknown mcp subcommand "${parsed.subcommand}".\n${USAGE}`);
             return 1;
     }
 }
+const WORKER_TOOL_NAMES = [
+    "get_context",
+    "create_team",
+    "engage_worker",
+    "critique_plan",
+    "review_pr",
+    "test_pr",
+    "get_qa_evidence",
+    "get_qa_replay",
+    "validate_qa_replay",
+    "accept_qa_replay",
+    "authorize_qa_fork",
+    "list_work",
+    "get_work",
+    "add_feedback",
+    "propose_instruction_change",
+    "prepare_review_publication",
+    "resolve_decision",
+];
+async function connectWorkers(mod, parsed, io, env) {
+    if (parsed.rest.length ||
+        parsed.scopeExplicit ||
+        parsed.transportExplicit ||
+        Object.keys(parsed.headers).length ||
+        Object.keys(parsed.env).length ||
+        parsed.clientId ||
+        parsed.clientSecret ||
+        parsed.callbackPort) {
+        io.stderr("Usage: yagni mcp connect-workers (uses your active environment and private user configuration)\n");
+        return 1;
+    }
+    try {
+        if (!mod.authenticate)
+            throw new Error("Update YAGNI Code to connect Workers");
+        const profile = await readActiveProfile(env);
+        const url = new URL("/mcp", profile.baseUrl);
+        if (url.username ||
+            url.password ||
+            (url.protocol !== "https:" &&
+                !(url.protocol === "http:" &&
+                    ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname))))
+            throw new Error("Worker connections require HTTPS or a local development server");
+        const config = {
+            type: "http",
+            url: url.href,
+            tools: WORKER_TOOL_NAMES,
+        };
+        const { file, errors } = mod.readUserMcpConfig();
+        if (errors.length)
+            throw new Error("Fix the existing MCP configuration before connecting Workers");
+        const previous = file
+            .mcpServers?.["yagni-workers"];
+        if (previous && JSON.stringify(previous) !== JSON.stringify(config))
+            throw new Error("An existing yagni-workers connection uses different settings. Remove it with yagni mcp remove yagni-workers before reconnecting");
+        const shadow = mod
+            .loadMcpServers(io.cwd, env)
+            .servers.find((server) => server.name === "yagni-workers" && server.scope !== "user");
+        if (shadow)
+            throw new Error("A project or local yagni-workers entry would override this connection. Remove that entry before connecting");
+        io.stdout("Opening YAGNI in your browser. Choose your workspace and permissions; paid Worker requests use that workspace's balance.\n");
+        await mod.authenticate("yagni-workers", config);
+        writeServerToScope(mod, "yagni-workers", config, "user", io.cwd);
+        io.stdout("Workers connected. Start a new YAGNI Code session to use them; /mcp shows connection status.\n");
+        return 0;
+    }
+    catch {
+        io.stderr("Worker connection did not complete. Check your environment and existing yagni-workers configuration, then retry browser consent.\n");
+        return 1;
+    }
+}
 function mcpAdd(mod, parsed, io) {
     const { name, rest } = parsed;
     const commandOrUrl = rest[1];
@@ -308,7 +424,9 @@ function mcpAdd(mod, parsed, io) {
         serverConfig = {
             type: parsed.transport,
             url: commandOrUrl,
-            ...(Object.keys(parsed.headers).length > 0 ? { headers: parsed.headers } : {}),
+            ...(Object.keys(parsed.headers).length > 0
+                ? { headers: parsed.headers }
+                : {}),
             ...(oauthBlock(parsed) ? { oauth: oauthBlock(parsed) } : {}),
         };
     }
@@ -398,18 +516,29 @@ function readClientSecret(io) {
 function validateConfigShape(config) {
     const type = config["type"];
     if (type === undefined || type === "stdio") {
-        if (typeof config["command"] !== "string" || config["command"].length === 0) {
-            return { ok: false, message: 'stdio server requires a non-empty "command"' };
+        if (typeof config["command"] !== "string" ||
+            config["command"].length === 0) {
+            return {
+                ok: false,
+                message: 'stdio server requires a non-empty "command"',
+            };
         }
         return { ok: true };
     }
     if (type === "http" || type === "sse") {
-        if (typeof config["url"] !== "string" || config["url"].length === 0) {
-            return { ok: false, message: `${type} server requires a non-empty "url"` };
+        if (typeof config["url"] !== "string" ||
+            config["url"].length === 0) {
+            return {
+                ok: false,
+                message: `${type} server requires a non-empty "url"`,
+            };
         }
         return { ok: true };
     }
-    return { ok: false, message: 'unknown "type" — expected stdio, http, or sse' };
+    return {
+        ok: false,
+        message: 'unknown "type" — expected stdio, http, or sse',
+    };
 }
 function writeServerToScope(mod, name, config, scope, cwd) {
     if (scope === "project") {
@@ -584,7 +713,9 @@ async function mcpGet(mod, parsed, io) {
     else {
         io.stdout(`  Type: stdio\n`);
         io.stdout(`  Command: ${config["command"]}\n`);
-        const args = Array.isArray(config["args"]) ? config["args"] : [];
+        const args = Array.isArray(config["args"])
+            ? config["args"]
+            : [];
         if (args.length > 0)
             io.stdout(`  Args: ${args.join(" ")}\n`);
         for (const [key, value] of Object.entries(config["env"] ?? {})) {
@@ -610,7 +741,9 @@ function printOAuthDetail(mod, name, config, stdout) {
     const cfg = config;
     const oauth = cfg["oauth"] ?? {};
     const clientId = typeof oauth["clientId"] === "string" ? oauth["clientId"] : undefined;
-    const callbackPort = typeof oauth["callbackPort"] === "number" ? oauth["callbackPort"] : undefined;
+    const callbackPort = typeof oauth["callbackPort"] === "number"
+        ? oauth["callbackPort"]
+        : undefined;
     const stored = mod.getStoredOAuthEntry(name, config);
     if (clientId || callbackPort || stored?.clientSecret) {
         stdout(`  OAuth: client_id ${clientId ? "configured" : "(DCR)"}, client_secret ${stored?.clientSecret ? "configured" : "not set"}${callbackPort ? `, callback_port ${callbackPort}` : ""}\n`);
@@ -642,10 +775,20 @@ async function mcpList(mod, io) {
         return 0;
     }
     const lines = [];
-    const byScope = { user: [], project: [], local: [], plugin: [] };
+    const byScope = {
+        user: [],
+        project: [],
+        local: [],
+        plugin: [],
+    };
     for (const s of servers)
         (byScope[s.scope] ??= []).push(s);
-    const labels = { local: "Local", project: "Project", user: "User", plugin: "Plugin" };
+    const labels = {
+        local: "Local",
+        project: "Project",
+        user: "User",
+        plugin: "Plugin",
+    };
     for (const scope of ["local", "project", "user", "plugin"]) {
         const group = byScope[scope];
         if (!group?.length)

package/dist/refresh.js

@@ -108,8 +108,11 @@ export async function maybeRefreshAtLaunch(creds, deps = {}) {
             await deps.persist(next);
         }
         catch {
-            // A failed write shouldn't block the spawn; the rotated token is still
-            // used for this session, and a later launch re-attempts persistence.
+            return {
+                creds: next,
+                refreshed: true,
+                warnings: ["Your refreshed YAGNI Code session could not be saved. Check disk space and profile permissions, then run yagni login before the next session."],
+            };
         }
     }
     return { creds: next, refreshed: true, warnings: [] };

package/dist/token.d.ts

@@ -15,11 +15,12 @@ import type { Credentials } from "./credentials.js";
 import { type Profile } from "./profiles.js";
 export interface TokenCommandDeps {
     readProfile?: () => Promise<Profile>;
+    readNamedProfile?: (name: string) => Promise<Profile | null>;
     refresh?: typeof maybeRefreshAtLaunch;
     persist?: (name: string, creds: Credentials) => Promise<void>;
     now?: () => number;
     stdout?: (text: string) => void;
     stderr?: (text: string) => void;
 }
-export declare function tokenCommand(deps?: TokenCommandDeps): Promise<number>;
+export declare function tokenCommand(deps?: TokenCommandDeps, args?: string[]): Promise<number>;
 //# sourceMappingURL=token.d.ts.map