fix(yara): repeat-block escalation + scan only edit replacement text (stacked on #804)

The YARA guard split out of #816, rebuilt on top of #804's warlock-based pi fence, plus the one surviving piece of the closed #818:

1. Repeat-block escalation: agents retry identically-blocked payloads (~4.2 blocks per affected run) despite the prompt saying not to. Both fences (pi pre-execution scan, anthropic PreToolUse Bash hook) now hash the payloads they block; an identical retry gets an escalated reason ("this exact content was ALREADY blocked — change the code, not the retry"), and from the third attempt the agent is told to note it in the setup report and move on. The escalation decorates #804's remediation-bearing block message, never replaces it. Tracker lives in yara-hooks, shared by both fences; policy denies are unaffected.

2. Edit scanning scoped to replacement text: #804 still scans JSON.stringify(input.edits), which includes each edit's oldText — pre-existing file content. That blocked edits whose surroundings contained a violation and even edits REMOVING one (field FPs: capture edits adjacent to existing identify() PII; pre-existing violations blocking their own replacement). Now scans only the joined newText, matching the anthropic path which scans new_string only.

Generated-By: PostHog Code
Task-Id: bcb96bcb-e37f-421d-841d-738647c73b8e

Author: gewenyu99

src/lib/__tests__/yara-hooks.test.ts

@@ -1,7 +1,9 @@
 import {
   createPreToolUseYaraHooks,
   createPostToolUseYaraHooks,
+  createRepeatBlockTracker,
   formatScanReport,
+  repeatBlockReason,
   writeScanReport,
   captureScanReport,
   resetScanReport,
@@ -1048,3 +1050,73 @@ describe('yara-hooks', () => {
     });
   });
 });
+
+describe('repeat-block tracker (identical retries after a block)', () => {
+  test('counts attempts per exact (tool, content) payload', () => {
+    const tracker = createRepeatBlockTracker();
+    expect(tracker.attempt('Edit', 'const a = 1;')).toBe(1);
+    expect(tracker.attempt('Edit', 'const a = 1;')).toBe(2);
+    expect(tracker.attempt('Edit', 'const a = 1;')).toBe(3);
+    // Different content or a different tool is a fresh first attempt.
+    expect(tracker.attempt('Edit', 'const a = 2;')).toBe(1);
+    expect(tracker.attempt('Write', 'const a = 1;')).toBe(1);
+  });
+
+  test('reason is unchanged on the first block', () => {
+    expect(repeatBlockReason(1, 'Edit', '[YARA] rule: bad.')).toBe(
+      '[YARA] rule: bad.',
+    );
+  });
+
+  test('second attempt says the retry can never work', () => {
+    const reason = repeatBlockReason(2, 'Edit', '[YARA] rule: bad.');
+    expect(reason).toContain('[YARA] rule: bad.');
+    expect(reason).toContain('ALREADY blocked');
+    expect(reason).toContain('Change the code');
+  });
+
+  test('third and later attempts tell the agent to report and move on', () => {
+    for (const attempt of [3, 4, 7]) {
+      const reason = repeatBlockReason(attempt, 'Write', '[YARA] rule: bad.');
+      expect(reason).toContain(`blocked ${attempt} times`);
+      expect(reason).toContain('setup report');
+      expect(reason).toContain('move on');
+    }
+  });
+
+  test('PreToolUse Bash escalates when the same blocked command is retried', async () => {
+    mockScan.mockResolvedValue({
+      matched: true,
+      matches: [
+        {
+          rule: 'destructive_rm',
+          metadata: {
+            severity: 'critical',
+            category: 'destructive_operations',
+            description: 'Detects destructive rm',
+            scan_context: 'command',
+          },
+          matchedStrings: [],
+        },
+      ],
+    });
+    const [matcher] = createPreToolUseYaraHooks();
+    const run = () =>
+      matcher.hooks[0](
+        { tool_name: 'Bash', tool_input: { command: 'rm -rf build' } },
+        undefined,
+        { signal: dummySignal },
+      );
+
+    const first = await run();
+    expect(first.decision).toBe('block');
+    expect(first.reason).not.toContain('ALREADY blocked');
+
+    const second = await run();
+    expect(second.reason).toContain('ALREADY blocked');
+
+    const third = await run();
+    expect(third.reason).toContain('blocked 3 times');
+    expect(third.reason).toContain('setup report');
+  });
+});

src/lib/agent/runner/harness/pi/__tests__/security.test.ts

@@ -259,3 +259,128 @@ describe('pi-security: extension state machine (fail-closed + runaway + latch)',
     expect(state.toolCalls).toBeGreaterThan(MAX_TOOL_CALLS);
   });
 });
+
+describe('pi-security: edit scanning is scoped to the replacement text', () => {
+  test('scans only newText — oldText (pre-existing content) never reaches the scanner', async () => {
+    // Field FPs: a violation in the surrounding/replaced code blocked edits
+    // that were clean — including edits REMOVING the violation.
+    await evaluateToolCall('edit', {
+      path: 'src/analytics.ts',
+      edits: [
+        {
+          oldText: "posthog.capture('signup', { email: user.email })",
+          newText: "posthog.capture('signup', { plan: user.plan })",
+        },
+        { oldText: 'const a = 1;', newText: 'const a = 2;' },
+      ],
+    });
+    expect(mockedScan).toHaveBeenCalledTimes(1);
+    const scanned = mockedScan.mock.calls[0][0];
+    expect(scanned).toContain("posthog.capture('signup', { plan: user.plan })");
+    expect(scanned).toContain('const a = 2;');
+    expect(scanned).not.toContain('email');
+    expect(scanned).not.toContain('const a = 1;');
+  });
+
+  test('an edit whose newText introduces a violation still blocks', async () => {
+    mockedScan.mockResolvedValueOnce({ matched: true, matches: [piiMatch] });
+    const decision = await evaluateToolCall('edit', {
+      path: 'src/analytics.ts',
+      edits: [
+        {
+          oldText: "posthog.capture('signup')",
+          newText: "posthog.capture('signup', { email: user.email })",
+        },
+      ],
+    });
+    expect(decision.block).toBe(true);
+    expect(decision.reason).toContain('posthog_pii_in_capture_call');
+  });
+
+  test('an edits array with only empty newText skips the scan entirely', async () => {
+    const decision = await evaluateToolCall('edit', {
+      path: 'src/analytics.ts',
+      edits: [{ oldText: 'delete me', newText: '' }],
+    });
+    expect(decision.block).toBe(false);
+    expect(mockedScan).not.toHaveBeenCalled();
+  });
+});
+
+describe('pi-security: repeat-block escalation (identical retries after a YARA block)', () => {
+  function fakePi() {
+    const handlers: Record<string, (e: any) => any> = {};
+    const pi: PiExtensionApiLike = {
+      on: (event: string, handler: (e: any) => any) => {
+        handlers[event] = handler;
+      },
+    } as PiExtensionApiLike;
+    return { pi, handlers };
+  }
+
+  const piiWrite = {
+    toolName: 'write',
+    input: {
+      path: 'src/analytics.ts',
+      content: "posthog.capture('login', { email: user.email })",
+    },
+  };
+
+  test('an identical YARA-blocked write escalates, then says report-and-move-on', async () => {
+    const { factory } = createSecurityExtension();
+    const { pi, handlers } = fakePi();
+    factory(pi);
+
+    mockedScan.mockResolvedValueOnce({ matched: true, matches: [piiMatch] });
+    const first = await handlers.tool_call(piiWrite);
+    expect(first.block).toBe(true);
+    // The remediation still leads — escalation decorates, never replaces it.
+    expect(first.reason).toContain('identify()');
+    expect(first.reason).not.toContain('ALREADY blocked');
+
+    mockedScan.mockResolvedValueOnce({ matched: true, matches: [piiMatch] });
+    const second = await handlers.tool_call(piiWrite);
+    expect(second.block).toBe(true);
+    expect(second.reason).toContain('ALREADY blocked');
+    expect(second.reason).toContain('Change the code');
+
+    mockedScan.mockResolvedValueOnce({ matched: true, matches: [piiMatch] });
+    const third = await handlers.tool_call(piiWrite);
+    expect(third.block).toBe(true);
+    expect(third.reason).toContain('blocked 3 times');
+    expect(third.reason).toContain('setup report');
+  });
+
+  test('different blocked content is a fresh first attempt, not a repeat', async () => {
+    const { factory } = createSecurityExtension();
+    const { pi, handlers } = fakePi();
+    factory(pi);
+
+    mockedScan.mockResolvedValueOnce({ matched: true, matches: [piiMatch] });
+    await handlers.tool_call(piiWrite);
+
+    mockedScan.mockResolvedValueOnce({ matched: true, matches: [piiMatch] });
+    const other = await handlers.tool_call({
+      toolName: 'write',
+      input: {
+        path: 'src/checkout.ts',
+        content: "posthog.capture('purchase', { phone: user.phone })",
+      },
+    });
+    expect(other.block).toBe(true);
+    expect(other.reason).not.toContain('ALREADY blocked');
+  });
+
+  test('policy denies (non-YARA) never gain repeat-escalation text', async () => {
+    const { factory } = createSecurityExtension();
+    const { pi, handlers } = fakePi();
+    factory(pi);
+
+    const deny = () =>
+      handlers.tool_call({ toolName: 'bash', input: { command: 'cat .env' } });
+    await deny();
+    const second = await deny();
+    expect(second.block).toBe(true);
+    expect(second.reason).not.toContain('ALREADY blocked');
+  });
+});

src/lib/agent/runner/harness/pi/security.ts

@@ -20,8 +20,11 @@
 import type { LLMProvider, ScanMatch } from '@posthog/warlock';
 import { wizardCanUseTool } from '@lib/agent/agent-interface';
 import {
+  createRepeatBlockTracker,
   isWizardDocumentationPath,
+  repeatBlockReason,
   scanAndTriage,
+  type RepeatBlockTracker,
   type ScanContext,
 } from '@lib/yara-hooks';
 import {
@@ -44,6 +47,14 @@ export interface ToolGateContext {
    * on (fail-closed, but no false-positive filtering).
    */
   triageAuth?: TriageGatewayAuth;
+  /**
+   * Per-run tracker of YARA-blocked payloads. When the agent retries content
+   * that was already blocked, the block reason escalates ("change the code,
+   * not the retry" → "report it and move on"). The extension wires one in;
+   * absent (tests calling `evaluateToolCall` directly) every block reads as
+   * a first attempt.
+   */
+  repeatTracker?: RepeatBlockTracker;
 }
 
 export interface GateDecision {
@@ -110,6 +121,7 @@ async function preExecutionYaraBlock(
   toolName: string,
   input: Record<string, unknown>,
   llmProvider: LLMProvider | undefined,
+  repeatTracker?: RepeatBlockTracker,
 ): Promise<string | undefined> {
   let content: string;
   let ctx: ScanContext;
@@ -126,7 +138,15 @@ async function preExecutionYaraBlock(
       triage = llmProvider;
       break;
     case 'edit':
-      content = JSON.stringify(input.edits ?? '');
+      // Scan ONLY the replacement text. `edits` is [{oldText, newText}] and
+      // oldText is pre-existing file content the agent is changing — scanning
+      // it blocks edits whose *surroundings* contain a violation, and even
+      // edits that are removing one (field FPs: capture edits adjacent to
+      // existing identify() PII; pre-existing violations blocking their own
+      // replacement). Matches the anthropic path, which scans new_string only.
+      content = (Array.isArray(input.edits) ? input.edits : [])
+        .map((e) => str((e as Record<string, unknown>)?.newText))
+        .join('\n');
       ctx = 'output';
       triage = llmProvider;
       break;
@@ -141,7 +161,8 @@ async function preExecutionYaraBlock(
   }
   if (matches.length === 0) return undefined;
 
-  return blockMessage(matches[0]);
+  const attempt = repeatTracker?.attempt(toolName, content) ?? 1;
+  return repeatBlockReason(attempt, toolName, blockMessage(matches[0]));
 }
 
 /**
@@ -169,6 +190,7 @@ export async function evaluateToolCall(
       toolName,
       input,
       llmProvider,
+      ctx.repeatTracker,
     );
     if (yaraReason) return { block: true, reason: yaraReason };
 
@@ -213,6 +235,13 @@ export function createSecurityExtension(ctx: ToolGateContext = {}): {
   // triage is skipped and every flagged match is acted on — fail closed.
   const llmProvider = createTriageLLMProvider(ctx.triageAuth);
 
+  // One tracker per extension = per (sub)agent session, so an identical
+  // payload retried after a block gets the escalating reason.
+  const gateCtx: ToolGateContext = {
+    ...ctx,
+    repeatTracker: ctx.repeatTracker ?? createRepeatBlockTracker(),
+  };
+
   const factory = (pi: PiExtensionApiLike): void => {
     pi.on('tool_call', async (event) => {
       // A latched post-scan violation blocks everything that follows.
@@ -232,7 +261,7 @@ export function createSecurityExtension(ctx: ToolGateContext = {}): {
       const decision = await evaluateToolCall(
         event.toolName,
         event.input ?? {},
-        ctx,
+        gateCtx,
         llmProvider,
       );
       if (decision.block) {