@yagni-app/code 1.0.9 → 1.1.0

package/dist/extension/hooks.js

@@ -6,8 +6,8 @@
  * at lifecycle events. The config format mirrors Claude Code's `settings.json`
  * hooks shape so a user can copy-paste between them.
  *
- * Supported events (8): SessionStart, UserPromptSubmit, PreToolUse,
- * PostToolUse, PermissionRequest, PreCompact, PostCompact, SessionEnd.
+ * Supported events (9): SessionStart, UserPromptSubmit, PreToolUse,
+ * PostToolUse, PermissionRequest, PreCompact, PostCompact, SessionEnd, Stop.
  *
  * Exit code semantics (matching Claude Code / Codex):
  *   0   = success; stdout parsed as JSON for structured decisions
@@ -21,8 +21,10 @@ import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import { homedir } from "node:os";
 import { codeStateHome } from "./stateHome.js";
+import { isDriverCaller } from "./config.js";
 import { isDebug } from "./diagnostics.js";
 import { logEvent } from "./errorSink.js";
+import { scrubSecrets } from "./pipeline/scrubSecrets.js";
 const SUPPORTED_EVENTS = [
     "SessionStart",
     "UserPromptSubmit",
@@ -32,6 +34,7 @@ const SUPPORTED_EVENTS = [
     "PreCompact",
     "PostCompact",
     "SessionEnd",
+    "Stop",
 ];
 // ---------------------------------------------------------------------------
 // Config loading
@@ -301,8 +304,72 @@ export function parseCompactCancel(stdout) {
     return parsed.continue === false;
 }
 // ---------------------------------------------------------------------------
+// Stop capture
+// ---------------------------------------------------------------------------
+/**
+ * Extract the last assistant message's text and stopReason from an
+ * agent_end event. Walks backwards (the shape cmux/state.ts walks forwards)
+ * so an aborted final turn with no text still reports its stopReason —
+ * the reason is what decides whether Stop hooks fire at all.
+ */
+function lastAssistantInfo(event) {
+    const messages = event?.messages;
+    if (!Array.isArray(messages))
+        return undefined;
+    for (let index = messages.length - 1; index >= 0; index -= 1) {
+        const message = messages[index];
+        if (!message || typeof message !== "object")
+            continue;
+        const typed = message;
+        if (typed.role !== "assistant")
+            continue;
+        const text = typeof typed.content === "string"
+            ? typed.content.trim() || undefined
+            : textFromBlocks(typed.content);
+        return { text, stopReason: typeof typed.stopReason === "string" ? typed.stopReason : undefined };
+    }
+    return undefined;
+}
+/** Join text blocks from a content array (mirrors cmux's textFromContent). */
+function textFromBlocks(content) {
+    if (!Array.isArray(content))
+        return undefined;
+    const parts = [];
+    for (const block of content) {
+        if (!block || typeof block !== "object")
+            continue;
+        const typed = block;
+        if (typed.type === "text" && typeof typed.text === "string" && typed.text.trim()) {
+            parts.push(typed.text);
+        }
+    }
+    return parts.join("\n") || undefined;
+}
+// ---------------------------------------------------------------------------
 // Diagnostic logging
 // ---------------------------------------------------------------------------
+/**
+ * A short upload-safe label for a hook-exec exception, for the always-on
+ * trail line. Tiers, in order: a Node error code ("ENOENT", "ETIMEDOUT"),
+ * the message's first token (a machine word like "spawn"), the constructor
+ * name, and typeof for non-Error throws (execImpl is an injected seam —
+ * a string throw is possible). Message-derived tiers are scrubbed — a
+ * message can begin with content (a credentials URL), and this label rides
+ * the default-on (upload-safe) tier.
+ */
+export function hookErrorLabel(err) {
+    const code = err?.code;
+    // Scrub BEFORE slicing: a secret-shaped value longer than the 40-char cap
+    // would be split first and the fragment could match no pattern.
+    if (typeof code === "string" && code)
+        return scrubSecrets(code).slice(0, 40);
+    if (err instanceof Error) {
+        if (err.message)
+            return scrubSecrets(err.message.split(/[\s:]+/)[0]).slice(0, 40);
+        return err.constructor.name;
+    }
+    return typeof err;
+}
 function logHookEvent(env, payload) {
     if (!isDebug(env))
         return;
@@ -656,6 +723,64 @@ export function registerHooks(pi, deps = {}) {
             }
         });
     }
+    // --- Stop (agent finished responding; driver turn complete) ---
+    // Two-phase capture, mirroring the cmux bridge: agent_settled carries no
+    // payload, so the last assistant message is captured at agent_end and
+    // consumed at settled. Firing is VOID, not awaited — pi awaits settled
+    // handlers before unblocking the TUI's prompt loop and RPC waitForIdle,
+    // so an awaited hook would keep a finished session looking busy for up
+    // to the full hook timeout.
+    const stopGroups = config["Stop"] ?? [];
+    if (stopGroups.length > 0 && isDriverCaller(env)) {
+        let pendingStop;
+        pi.on("agent_end", (event) => {
+            pendingStop = lastAssistantInfo(event);
+        });
+        pi.on("agent_settled", (_event, ctx) => {
+            // hasUI is fixed per session — checking it first keeps the capture
+            // consume order-independent (a headless session simply never fires).
+            if (!ctx.hasUI)
+                return;
+            const captured = pendingStop;
+            if (!captured)
+                return;
+            // Mid-retry/compaction/continuation settles are not the turn's end —
+            // pi sets isIdle only once no automatic follow-up work will run. The
+            // capture is NOT consumed here: a settle that isn't idle leaves it for
+            // the genuine end-of-turn settle (an agent_end between the two
+            // overwrites it with the continuation's own final message).
+            try {
+                if (!ctx.isIdle())
+                    return;
+            }
+            catch {
+                return;
+            }
+            pendingStop = undefined;
+            // Claude Code parity: its query loop returns before running Stop hooks
+            // when the user aborted or the model errored — "finished, your move"
+            // would be a lie for a killed turn. Retry/continuation agent_ends
+            // overwrite the capture, so an error followed by a successful retry
+            // still fires (with the retry's message).
+            if (captured.stopReason === "aborted" || captured.stopReason === "error")
+                return;
+            const cwd = ctx.cwd;
+            const inputJson = JSON.stringify({
+                session_id: sessionId,
+                cwd,
+                hook_event_name: "Stop",
+                stop_hook_active: false,
+                ...(captured.text ? { last_assistant_message: captured.text } : {}),
+            });
+            void (async () => {
+                for (const group of filterByTrust(stopGroups, trusted(ctx))) {
+                    for (const entry of group.hooks) {
+                        await runSideEffectHook(entry.command, inputJson, cwd, "Stop", ctx, env, execImpl);
+                    }
+                }
+            })();
+        });
+    }
 }
 /** Run a side-effect-only hook (no control effects, output ignored). */
 async function runSideEffectHook(command, inputJson, cwd, eventName, ctx, env, execImpl) {
@@ -665,6 +790,13 @@ async function runSideEffectHook(command, inputJson, cwd, eventName, ctx, env, e
             YAGNI_HOOK_CWD: cwd,
             YAGNI_HOOK_SESSION_ID: env.YAGNI_SESSION_ID ?? "",
         });
+        const failed = !!result.error || (result.exitCode !== 0 && result.exitCode !== null);
+        // One outcome, two tiers: the debug line carries the full detail
+        // (stderr, timing) and is YAGNI_DEBUG-gated; the warn line is always-on
+        // and upload-safe, so "hook fired and failed" is distinguishable from
+        // "hook never fired" in a default session. The command rides the warn
+        // line scrubbed (below) so N hooks on one event produce distinguishable
+        // lines without leaking anything the user embedded in the command.
         logHookEvent(env, {
             event: eventName,
             command,
@@ -674,14 +806,47 @@ async function runSideEffectHook(command, inputJson, cwd, eventName, ctx, env, e
             ...(result.error ? { error: result.error } : {}),
             ...(result.stderr.trim() ? { stderr: result.stderr.trim().slice(0, 512) } : {}),
         });
-        if (result.error || (result.exitCode !== 0 && result.exitCode !== null)) {
+        if (failed) {
+            logEvent({
+                source: "hooks",
+                level: "warn",
+                event: "hook_failed",
+                sessionId: env.YAGNI_SESSION_ID ?? undefined,
+                fields: {
+                    event_name: eventName,
+                    // Scrubbed at write time: the trail file stores lines raw (scrubbing
+                    // otherwise happens only at readSessionTrail), and a user's hook
+                    // command can embed secrets inline (curl -H "Authorization: Bearer …").
+                    // The full, unscrubbed command stays on the YAGNI_DEBUG tier.
+                    command: scrubSecrets(command).slice(0, 80),
+                    exit_code: result.exitCode,
+                    // Scrub the whole error string before taking the first colon token —
+                    // result.error embeds a raw err.message (spawn failed/err paths in
+                    // execHook), and the sibling hookErrorLabel path scrubs message-derived
+                    // tiers the same way.
+                    ...(result.error ? { error: scrubSecrets(result.error).split(":")[0] } : {}),
+                },
+            });
             if (ctx.hasUI && result.stderr.trim()) {
                 ctx.ui.notify(`Hook '${eventName}' exited with code ${result.exitCode}: ${result.stderr.trim().slice(0, 200)}`, "warning");
             }
         }
     }
-    catch {
-        // Fail-soft: a hook error never breaks the session
+    catch (err) {
+        // Fail-soft: a hook error never breaks the session — but never silent.
+        // The label distinguishes "spawn ENOENT" from a timeout (see
+        // hookErrorLabel); the command is scrubbed like the sibling path's.
+        logEvent({
+            source: "hooks",
+            level: "warn",
+            event: "hook_exec_threw",
+            sessionId: env.YAGNI_SESSION_ID ?? undefined,
+            fields: {
+                event_name: eventName,
+                command: scrubSecrets(command).slice(0, 80),
+                error: hookErrorLabel(err),
+            },
+        });
     }
 }
 // ---------------------------------------------------------------------------

package/dist/extension/mcp/cliConfig.d.ts

@@ -7,6 +7,6 @@
 export { McpServerConfig, McpScope, PLUGIN_MCP_ENV, PROJECT_CONFIG_FILENAME, ScopedMcpServerConfig, expandEnvVarsInString, expandServerEnv, loadMcpServers, mcpConfigPath, readPluginMcpServers, readProjectMcpConfig, readUserMcpConfig, resolveProjectRoot, validateServerConfig, writeUserMcpConfig, } from "./config.js";
 export { ProjectApprovalState, decisionFor, readProjectApproval, recordProjectDecision, resetProjectChoices, undecidedProjectServers, } from "./approval.js";
 export { McpAuthFile, StoredOAuthEntry, deleteStoredOAuthEntry, getServerKey, getStoredOAuthEntry, mcpAuthPath, readMcpAuth, updateStoredOAuthEntry, writeMcpAuth, } from "./authStore.js";
-export { revokeTokensOnRemove } from "./auth.js";
+export { authenticate, revokeTokensOnRemove } from "./auth.js";
 export { probeServer, McpHealthResult, McpHealthStatus } from "./manager.js";
 //# sourceMappingURL=cliConfig.d.ts.map

package/dist/extension/mcp/cliConfig.js

@@ -7,6 +7,6 @@
 export { PLUGIN_MCP_ENV, PROJECT_CONFIG_FILENAME, expandEnvVarsInString, expandServerEnv, loadMcpServers, mcpConfigPath, readPluginMcpServers, readProjectMcpConfig, readUserMcpConfig, resolveProjectRoot, validateServerConfig, writeUserMcpConfig, } from "./config.js";
 export { decisionFor, readProjectApproval, recordProjectDecision, resetProjectChoices, undecidedProjectServers, } from "./approval.js";
 export { deleteStoredOAuthEntry, getServerKey, getStoredOAuthEntry, mcpAuthPath, readMcpAuth, updateStoredOAuthEntry, writeMcpAuth, } from "./authStore.js";
-export { revokeTokensOnRemove } from "./auth.js";
+export { authenticate, revokeTokensOnRemove } from "./auth.js";
 export { probeServer } from "./manager.js";
 //# sourceMappingURL=cliConfig.js.map

package/dist/extension/mcp/config.d.ts

@@ -36,6 +36,8 @@ export interface McpHttpServerConfig {
     url: string;
     headers?: Record<string, string>;
     oauth?: McpOAuthConfig;
+    /** Optional explicit tool names, used by the Worker connection to avoid duplicating existing context tools. */
+    tools?: string[];
 }
 export type McpServerConfig = McpStdioServerConfig | McpHttpServerConfig;
 export interface ScopedMcpServerConfig {

package/dist/extension/mcp/config.js

@@ -267,6 +267,8 @@ export function validateServerConfig(value) {
         return { ok: true };
     }
     if (type === "http" || type === "sse") {
+        if (v["tools"] !== undefined && (!Array.isArray(v["tools"]) || v["tools"].length > 100 || v["tools"].some(name => typeof name !== "string" || name.length === 0 || name.length > 128)))
+            return { ok: false, message: "tools must be an array of up to 100 tool names" };
         if (typeof v["url"] !== "string" || v["url"].length === 0) {
             return { ok: false, message: `${type} server requires a non-empty "url"` };
         }

package/dist/extension/mcp/tools.js

@@ -14,7 +14,11 @@ import { buildMcpToolName } from "./names.js";
 export const MAX_MCP_DESCRIPTION_LENGTH = 2048;
 export async function registerServerTools(pi, manager, serverName, env = process.env) {
     const server = manager.get(serverName);
-    const result = { tools: [], mutatingToolNames: [], warnings: [] };
+    const result = {
+        tools: [],
+        mutatingToolNames: [],
+        warnings: [],
+    };
     if (!server?.client)
         return result;
     let toolList;
@@ -26,7 +30,12 @@ export async function registerServerTools(pi, manager, serverName, env = process
         return result;
     }
     const toolTimeout = toolTimeoutFromEnv(env);
+    const selectedTools = server.config.type === "http" || server.config.type === "sse"
+        ? server.config.tools
+        : undefined;
     for (const tool of toolList.tools ?? []) {
+        if (selectedTools && !selectedTools.includes(tool.name))
+            continue;
         const fullToolName = buildMcpToolName(serverName, tool.name);
         if (!fullToolName) {
             result.warnings.push(`${serverName}: tool "${tool.name}" produced an empty wire name; skipped`);
@@ -45,7 +54,10 @@ export async function registerServerTools(pi, manager, serverName, env = process
                     throw new Error(`MCP server "${serverName}" is not connected (try /mcp reconnect).`);
                 }
                 const args = (params && typeof params === "object" ? params : {});
-                const call = active.client.callTool({ name: tool.name, arguments: args });
+                const call = active.client.callTool({
+                    name: tool.name,
+                    arguments: args,
+                });
                 const settled = toolTimeout
                     ? await withTimeout(call, toolTimeout, `MCP tool call timed out after ${toolTimeout}ms`)
                     : await call;
@@ -53,7 +65,12 @@ export async function registerServerTools(pi, manager, serverName, env = process
             },
         };
         pi.registerTool(definition);
-        result.tools.push({ toolName: fullToolName, serverName, originalName: tool.name, description });
+        result.tools.push({
+            toolName: fullToolName,
+            serverName,
+            originalName: tool.name,
+            description,
+        });
         if (mutating)
             result.mutatingToolNames.push(fullToolName);
     }
@@ -67,6 +84,19 @@ export function capDescription(description) {
 /** Cheap heuristic in the spirit of Claude Code's input-hint check; per-tool annotations arrive via listTools only in newer servers. */
 export function looksMutating(toolName, description) {
     const name = toolName.toLowerCase();
+    if ([
+        "critique_plan",
+        "review_pr",
+        "test_pr",
+        "validate_qa_replay",
+        "accept_qa_replay",
+        "authorize_qa_fork",
+        "engage_worker",
+        "propose_instruction_change",
+        "prepare_review_publication",
+        "resolve_decision",
+    ].includes(name))
+        return true;
     const writeHints = /^(create|add|update|edit|delete|remove|set|write|send|post|put|patch|deploy|publish|close|merge|assign|move|archive|trash|restore)/;
     if (writeHints.test(name))
         return true;
@@ -91,16 +121,49 @@ function schemaFor(inputSchema) {
 }
 function renderCallResult(settled, serverName, toolName) {
     const parts = [];
+    const images = [];
+    let imageBytes = 0;
     for (const item of settled.content ?? []) {
-        if (item && typeof item === "object" && item.type === "text") {
+        if (item &&
+            typeof item === "object" &&
+            item.type === "text") {
             parts.push(String(item.text ?? ""));
         }
+        else if (item &&
+            typeof item === "object" &&
+            "type" in item &&
+            item.type === "image") {
+            const value = item;
+            if (typeof value.data !== "string" ||
+                typeof value.mimeType !== "string" ||
+                !["image/png", "image/jpeg", "image/webp"].includes(value.mimeType) ||
+                value.data.length > 12 * 1024 * 1024 ||
+                images.length >= 8 ||
+                value.data.length % 4 !== 0 ||
+                !/^[A-Za-z0-9+/]*={0,2}$/.test(value.data))
+                throw new Error("MCP image is unsupported or exceeds its limit.");
+            const bytes = Buffer.byteLength(value.data, "base64");
+            imageBytes += bytes;
+            if (!bytes || imageBytes > 8 * 1024 * 1024)
+                throw new Error("MCP image is unsupported or exceeds its limit.");
+            images.push({
+                type: "image",
+                data: value.data,
+                mimeType: value.mimeType,
+            });
+        }
     }
-    const text = parts.join("\n") || "(no text content)";
+    const text = parts.join("\n") ||
+        (images.length
+            ? `Image returned by ${serverName}.${toolName} (untrusted tool content).`
+            : "(no text content)");
     if (settled.isError === true) {
         throw new Error(`MCP tool error from "${serverName}.${toolName}": ${text}`);
     }
-    return { content: [{ type: "text", text }], details: { server: serverName, tool: toolName } };
+    return {
+        content: [{ type: "text", text }, ...images],
+        details: { server: serverName, tool: toolName },
+    };
 }
 function withTimeout(promise, ms, message) {
     return new Promise((resolve, reject) => {

package/dist/extension/pipeline/scrubSecrets.js

@@ -22,6 +22,11 @@ const PATTERNS = [
     [/\b([A-Za-z0-9_]*(?:secret|password|passwd|api[_-]?key|token|private[_-]?key|access[_-]?key)[A-Za-z0-9_]*)\b(\s*[:=]\s*)("[^"]+"|'[^']+'|`[^`]+`|[^\s"']+)/gi, "$1$2[REDACTED]"],
     // Long base64-ish blobs (likely keys/JWTs)
     [/\b[A-Za-z0-9+/]{40,}={0,2}\b/g, "[REDACTED]"],
+    // Opaque bearer tokens in Authorization headers: no provider prefix, no
+    // secret-named key, and usually under the base64 length threshold — none of
+    // the patterns above catch them. Keep the scheme, redact the token. Header
+    // names and auth schemes are case-insensitive (RFC 9110) — hence the flag.
+    [/(\bauthorization\s*[:=]\s*["']?bearer\s+)([a-z0-9._~+/=-]+)/gi, "$1[REDACTED]"],
 ];
 export function scrubSecrets(text) {
     let out = text;

package/dist/extension/resilientFetch.d.ts

@@ -52,9 +52,9 @@ export interface ResilientFetchOpts {
 export declare function resilientFetch(url: string, init: RequestInit, opts?: ResilientFetchOpts): Promise<Response>;
 /**
  * Map a non-ok response to a friendly, body-truncated message for a tool's throw.
- * Auth statuses get an actionable re-login hint; everything else carries the
- * status plus a capped slice of the body so a giant HTML error never floods the
- * agent. No em-dashes (house copy rule).
+ * Authentication failures get a re-login hint; permission denials stay distinct.
+ * Other failures carry the status plus a capped slice of the body so a giant
+ * HTML error never floods the agent. No em-dashes (house copy rule).
  */
 export declare function friendlyFetchError(label: string, res: Response): Promise<string>;
 //# sourceMappingURL=resilientFetch.d.ts.map

package/dist/extension/resilientFetch.js

@@ -105,9 +105,9 @@ export async function resilientFetch(url, init, opts = {}) {
 }
 /**
  * Map a non-ok response to a friendly, body-truncated message for a tool's throw.
- * Auth statuses get an actionable re-login hint; everything else carries the
- * status plus a capped slice of the body so a giant HTML error never floods the
- * agent. No em-dashes (house copy rule).
+ * Authentication failures get a re-login hint; permission denials stay distinct.
+ * Other failures carry the status plus a capped slice of the body so a giant
+ * HTML error never floods the agent. No em-dashes (house copy rule).
  */
 export async function friendlyFetchError(label, res) {
     let body = "";
@@ -119,9 +119,12 @@ export async function friendlyFetchError(label, res) {
     }
     if (body.length > MAX_ERROR_BODY)
         body = `${body.slice(0, MAX_ERROR_BODY)} ...`;
-    if (res.status === 401 || res.status === 403) {
+    if (res.status === 401) {
         return `${label} is not authorized (HTTP ${res.status}). Run \`yagni login\` to re-authenticate.`;
     }
+    if (res.status === 403) {
+        return `${label} does not have permission (HTTP 403). Report the permission limitation if it blocks the task.`;
+    }
     if (res.status === 429) {
         return `${label} was rate limited (HTTP 429). Try again in a moment.`;
     }

package/dist/extension/sandbox/config.d.ts

@@ -19,6 +19,7 @@
  * allowlist; loopback needs allowLocalBinding (allowedDomains cannot open it
  * — loopback bypasses the proxy via no_proxy).
  */
+import { type WorktreeGitAccess } from "./worktreeGit.js";
 import type { PermissionRule } from "../permissionRules/loadConfig.js";
 export interface SandboxNetworkSettings {
     allowedDomains?: string[];
@@ -95,6 +96,10 @@ export interface SandboxRuntimeMerge {
         allowWrite: string[];
         denyWrite: string[];
     };
+    /** git safe.directory entries for srt (GIT_CONFIG_* env): the worktree
+     * root + common git dir, so bwrap's uid-mapping does not trip "dubious
+     * ownership" on the main-repo path. Empty when not a worktree session. */
+    gitSafeDirectories: string[];
     /** Permission rules that could not map into sandbox restrictions (surfaced
      * in diagnostics — never silently dropped). */
     droppedRules: string[];
@@ -111,5 +116,5 @@ export interface SandboxRuntimeMerge {
  * cwd-relative bare) resolved per-source; sandbox.filesystem.* uses standard
  * path semantics (/ = absolute) exactly like Claude's two resolvers.
  */
-export declare function mergeRulesIntoSandbox(settings: SandboxSettings, rules: readonly PermissionRule[], base: SandboxRuntimePaths): SandboxRuntimeMerge;
+export declare function mergeRulesIntoSandbox(settings: SandboxSettings, rules: readonly PermissionRule[], base: SandboxRuntimePaths, worktreeGit?: WorktreeGitAccess | null): SandboxRuntimeMerge;
 //# sourceMappingURL=config.d.ts.map

package/dist/extension/sandbox/config.js

@@ -295,7 +295,7 @@ homeDirDefault = homeDirDefaultFn;
  * cwd-relative bare) resolved per-source; sandbox.filesystem.* uses standard
  * path semantics (/ = absolute) exactly like Claude's two resolvers.
  */
-export function mergeRulesIntoSandbox(settings, rules, base) {
+export function mergeRulesIntoSandbox(settings, rules, base, worktreeGit) {
     const homeDir = base.homeDir ?? homeDirDefault();
     const allowWrite = new Set([base.cwd, tmpdir()]);
     const denyWrite = new Set();
@@ -360,6 +360,23 @@ export function mergeRulesIntoSandbox(settings, rules, base) {
         denyRead.add(resolveSandboxFsPath(p, base));
     for (const p of settings.filesystem?.allowRead ?? [])
         allowRead.add(resolveSandboxFsPath(p, base));
+    // Linked-worktree git access: allow writes to the shared common git dir
+    // only (routine worktree git — index.lock, refs, objects — never writes
+    // outside it), and pin hooks + config read-only within the newly allowed
+    // dir. The explicit config/hooks denies are redundant on macOS (srt's
+    // mandatory globs already cover **/.git/hooks and **/.git/config) but
+    // load-bearing on Linux, where srt's deny enforcement only ro-binds
+    // denies WITHIN allowWrite paths and its cwd-anchored mandatory sweep
+    // never sees the main repo — and for bare-repo worktrees, where the
+    // `.git` globs match nothing. Pure-merge contract: the caller passes the
+    // resolved value; this function never touches the filesystem.
+    const gitSafeDirectories = [];
+    if (worktreeGit) {
+        allowWrite.add(worktreeGit.commonGitDir);
+        denyWrite.add(join(worktreeGit.commonGitDir, "hooks"));
+        denyWrite.add(join(worktreeGit.commonGitDir, "config"));
+        gitSafeDirectories.push(worktreeGit.worktreeRoot, worktreeGit.commonGitDir);
+    }
     // Protected paths: always denyWrite, never exempted (Claude parity + our
     // own surfaces). Note srt denyWrite also denies read-of-ignored writes.
     denyWrite.add(join(base.userStateHome, "config.json"));
@@ -382,6 +399,7 @@ export function mergeRulesIntoSandbox(settings, rules, base) {
             allowWrite: [...allowWrite],
             denyWrite: [...denyWrite],
         },
+        gitSafeDirectories,
         droppedRules,
     };
 }

package/dist/extension/sandbox/manager.d.ts

@@ -10,6 +10,7 @@
  * bracket. Pure functions (config building) live in config.ts.
  */
 import { type SandboxSettings, type SandboxRuntimeMerge } from "./config.js";
+import { type WorktreeGitAccess } from "./worktreeGit.js";
 import type { PermissionRule } from "../permissionRules/loadConfig.js";
 /** Where the network ask-callback surfaces a decision. */
 export type NetworkAskHandler = (host: string) => Promise<boolean>;
@@ -39,6 +40,9 @@ export interface SandboxSessionState {
     dependencies: SandboxDependencyStatus | null;
     /** The settings snapshot this session initialized with. */
     settings: SandboxSettings | null;
+    /** Cached linked-worktree git resolution — resolved once at initialize()
+     * (worktree linkage does not change mid-session), undefined until then. */
+    worktreeGit: WorktreeGitAccess | null | undefined;
 }
 /** Default vendored rg shipped with the CLI install. */
 export declare function defaultRgPath(env?: NodeJS.ProcessEnv): string | undefined;
@@ -69,7 +73,9 @@ export declare class YagniSandboxManager {
     /**
      * Build the runtime filesystem/network config from current settings +
      * permission rules. Exposed for diagnostics (/sandbox config display) and
-     * tests; initialize() consumes it internally.
+     * tests; initialize() consumes it internally. Uses the cached worktree
+     * resolution when initialize() already ran; a pre-init caller (tests,
+     * panel) resolves live if the cwd is a linked worktree root.
      */
     buildRuntimeMerge(rules: readonly PermissionRule[]): SandboxRuntimeMerge;
     private runtimeConfig;
@@ -94,7 +100,8 @@ export declare class YagniSandboxManager {
     refreshConfig(rules: readonly PermissionRule[]): void;
     /**
      * Re-init from scratch (config grant changed semantics srt can't hot-swap,
-     * or a toggle). Tears down proxies + violation store first.
+     * or a toggle). Tears down proxies + violation store first. The worktree
+     * cache clears with the state reset and re-resolves on the next init.
      */
     reinitialize(rules: readonly PermissionRule[]): Promise<string | undefined>;
     /** Tear down srt (proxies, violation store, seatbelt state). */

package/dist/extension/sandbox/manager.js

@@ -13,6 +13,7 @@ import { SandboxManager as SrtSandboxManager } from "@anthropic-ai/sandbox-runti
 import { logEvent } from "../errorSink.js";
 import { codeStateHome } from "../stateHome.js";
 import { loadSandboxSettings, mergeRulesIntoSandbox, } from "./config.js";
+import { resolveWorktreeGitAccess } from "./worktreeGit.js";
 /** Default vendored rg shipped with the CLI install. */
 export function defaultRgPath(env = process.env) {
     const agentDir = env.PI_CODING_AGENT_DIR;
@@ -21,7 +22,7 @@ export function defaultRgPath(env = process.env) {
     return `${agentDir.replace(/\/$/, "")}/bin/rg`;
 }
 export class YagniSandboxManager {
-    state = { initialized: false, dependencies: null, settings: null };
+    state = { initialized: false, dependencies: null, settings: null, worktreeGit: undefined };
     askHandler = null;
     opts;
     /** Config warnings already logged this process — buildRuntimeMerge runs
@@ -95,7 +96,9 @@ export class YagniSandboxManager {
     /**
      * Build the runtime filesystem/network config from current settings +
      * permission rules. Exposed for diagnostics (/sandbox config display) and
-     * tests; initialize() consumes it internally.
+     * tests; initialize() consumes it internally. Uses the cached worktree
+     * resolution when initialize() already ran; a pre-init caller (tests,
+     * panel) resolves live if the cwd is a linked worktree root.
      */
     buildRuntimeMerge(rules) {
         const { settings, diagnostics } = loadSandboxSettings({
@@ -105,12 +108,15 @@ export class YagniSandboxManager {
             stateHomeOverride: this.opts.stateHomeOverride,
         });
         this.surfaceConfigDiagnostics(diagnostics);
+        const worktreeGit = this.state.worktreeGit !== undefined
+            ? this.state.worktreeGit
+            : resolveWorktreeGitAccess(this.opts.cwd);
         return mergeRulesIntoSandbox(settings, rules, {
             cwd: this.opts.cwd,
             userStateHome: this.opts.stateHomeOverride ?? codeStateHome(null, this.opts.env, this.opts.userHome),
             projectRoot: this.opts.projectRoot ?? null,
             homeDir: this.opts.userHome,
-        });
+        }, worktreeGit);
     }
     runtimeConfig(merge, settings) {
         return {
@@ -129,6 +135,9 @@ export class YagniSandboxManager {
                 allowWrite: merge.filesystem.allowWrite,
                 denyWrite: merge.filesystem.denyWrite,
             },
+            ...(merge.gitSafeDirectories.length > 0
+                ? { git: { safeDirectories: merge.gitSafeDirectories } }
+                : {}),
             ignoreViolations: settings.ignoreViolations,
             enableWeakerNestedSandbox: settings.enableWeakerNestedSandbox,
             enableWeakerNetworkIsolation: settings.enableWeakerNetworkIsolation,
@@ -176,6 +185,21 @@ export class YagniSandboxManager {
             this.state.dependencies = null;
             return `sandbox initialization failed: ${err instanceof Error ? err.message : String(err)}`;
         }
+        // Cache the worktree resolution only after a successful init — a failed
+        // init leaves it undefined so buildRuntimeMerge keeps resolving live.
+        this.state.worktreeGit = resolveWorktreeGitAccess(this.opts.cwd);
+        // Security-relevant allow widening needs its trail: one line when the
+        // session's git writes were allowed outside cwd (path-only metadata,
+        // same exposure class as sandbox_config_warning fields; silent when
+        // null — that is every non-worktree session).
+        if (this.state.worktreeGit) {
+            logEvent({
+                source: "sandbox",
+                level: "info",
+                event: "sandbox_worktree_git_allow",
+                fields: { commonGitDir: this.state.worktreeGit.commonGitDir },
+            });
+        }
         this.state.initialized = true;
         this.state.settings = load.settings;
         this.opts.events?.onStateChange?.(true);
@@ -198,7 +222,8 @@ export class YagniSandboxManager {
     }
     /**
      * Re-init from scratch (config grant changed semantics srt can't hot-swap,
-     * or a toggle). Tears down proxies + violation store first.
+     * or a toggle). Tears down proxies + violation store first. The worktree
+     * cache clears with the state reset and re-resolves on the next init.
      */
     async reinitialize(rules) {
         if (this.state.initialized) {
@@ -208,7 +233,7 @@ export class YagniSandboxManager {
     }
     /** Tear down srt (proxies, violation store, seatbelt state). */
     async reset() {
-        this.state = { initialized: false, dependencies: null, settings: null };
+        this.state = { initialized: false, dependencies: null, settings: null, worktreeGit: undefined };
         try {
             await SrtSandboxManager.reset();
         }