@yagni-app/code-staging 0.0.0 → 0.1.0-staging.997.1

package/dist/extension/permission.js

@@ -0,0 +1,236 @@
+/**
+ * P3 - interactive permission tiers + plan mode, wired to pi's tool-call gate.
+ *
+ * YAGNI Code registers no tool_call handler today, so the interactive session has
+ * no plan/approval surface. P3 adds one on pi's documented `tool_call` block seam
+ * plus a `/mode` command:
+ *   - auto   (default): never blocks. Byte-identical to today, so this is additive.
+ *   - plan   : blocks write/edit/bash so the agent can explore + propose without
+ *              touching the tree.
+ *   - review : surfaces a three-way ctx.ui.select before a write/edit/bash; a
+ *              session bless (policy.isBlessed) auto-approves an action the user
+ *              already OK'd for this tool + directory, so only novel actions
+ *              prompt. Picking "Yes, and don't ask again for <tool> in <dir>"
+ *              adds a session-scoped bless rule AND drafts a decision capture.
+ *
+ * `decideGate` is PURE; the live wiring holds the mode in a small closure (no
+ * module-global state). The default auto mode remains fail-open, but stricter
+ * modes fail closed for side-effect tools if the gate itself errors. Bless rules
+ * are session-scoped, path-prefix-bound, never persisted, and never consulted in
+ * plan mode (plan blocks outright before isBlessed is reached).
+ *
+ * Plan mode is a full mode, not just a blocker: while active, every agent turn
+ * carries a hidden [PLAN MODE ACTIVE] context message so the model plans
+ * instead of flailing against held writes, and a footer chip shows the mode.
+ * When the mode leaves plan, stale plan-context messages are filtered out of
+ * the context so the model doesn't keep believing it is restricted.
+ */
+import { makeBlessStore as defaultMakeBlessStore } from "./bless.js";
+export const DEFAULT_PERMISSION_POLICY = {
+    planBlockTools: ["write", "edit", "bash"],
+    reviewConfirmTools: ["write", "edit", "bash"],
+};
+/**
+ * Pure permission decision for one tool call under a mode + policy. auto always
+ * allows; plan blocks the write/exec set; review marks writes for confirmation
+ * unless a recorded decision blesses them.
+ */
+export function decideGate(toolName, params, mode, policy) {
+    if (mode === "auto")
+        return { block: false };
+    if (mode === "plan") {
+        if (policy.planBlockTools.includes(toolName)) {
+            return {
+                block: true,
+                reason: `plan mode: ${toolName} is a write or exec action and is held. Switch to /mode auto to apply changes.`,
+            };
+        }
+        return { block: false };
+    }
+    // review
+    if (policy.reviewConfirmTools.includes(toolName)) {
+        if (policy.isBlessed?.(toolName, params))
+            return { block: false };
+        return { block: false, confirm: true };
+    }
+    return { block: false };
+}
+/** The customType tag on injected plan-mode context (filterable later). */
+export const PLAN_CONTEXT_TYPE = "yagni-plan-context";
+const PLAN_MARKER = "[PLAN MODE ACTIVE]";
+export const PLAN_CONTEXT_MESSAGE = `${PLAN_MARKER}
+You are in plan mode: explore and design, change nothing.
+- write, edit, and bash are held by the permission gate; do not attempt them.
+- Read, search, and ask_yagni freely to ground the plan in how this company works.
+- Produce a concrete numbered plan of the steps you would take, with the files involved.
+- End by asking the user to review the plan; they run /mode auto (or /mode review) to execute it.
+- Once executing, track the plan's steps with todo_write.`;
+function mentionsPlanMarker(content) {
+    if (typeof content === "string")
+        return content.includes(PLAN_MARKER);
+    if (Array.isArray(content)) {
+        return content.some((c) => typeof c?.text === "string" &&
+            (c.text.includes(PLAN_MARKER)));
+    }
+    return false;
+}
+/**
+ * Drop previously injected plan-mode context once plan mode is off, so the
+ * model stops believing writes are held. Pure; returns the SAME array when
+ * nothing needs filtering so callers can cheaply detect a no-op.
+ */
+export function filterStalePlanContext(messages) {
+    const keep = messages.filter((m) => {
+        const msg = m;
+        if (msg?.customType === PLAN_CONTEXT_TYPE)
+            return false;
+        if (msg?.role === "user" && mentionsPlanMarker(msg.content))
+            return false;
+        return true;
+    });
+    return keep.length === messages.length ? messages : keep;
+}
+const MODE_STATUS = {
+    auto: undefined,
+    plan: "⏸ plan",
+    review: "✓ review",
+};
+const MODE_COPY = {
+    auto: "auto: changes apply without prompting (default).",
+    plan: "plan: write, edit, and bash are held so the agent can explore and propose only.",
+    review: "review: you confirm each write, edit, or bash command before it applies.",
+};
+function isMode(value) {
+    return value === "auto" || value === "plan" || value === "review";
+}
+function sideEffectTools(policy) {
+    return new Set([...policy.planBlockTools, ...policy.reviewConfirmTools]);
+}
+/**
+ * Wire the tool_call gate + the /mode command onto a shared mode holder. Default
+ * auto, so absent any /mode this is a no-op over today's behavior.
+ */
+export function registerPermissionGate(pi, deps = {}) {
+    const basePolicy = deps.policy ?? DEFAULT_PERMISSION_POLICY;
+    let mode = deps.mode ?? "auto";
+    const makeStore = deps.makeBlessStore ?? defaultMakeBlessStore;
+    // The session bless store is created lazily on the first tool_call (it needs
+    // the cwd). Its isBlessed backs the review-mode auto-approve, UNLESS the caller
+    // injected its own isBlessed (e.g. a test policy) — that always wins.
+    let blessStore = null;
+    const effectivePolicy = {
+        planBlockTools: basePolicy.planBlockTools,
+        reviewConfirmTools: basePolicy.reviewConfirmTools,
+        isBlessed: basePolicy.isBlessed ?? ((tool, params) => blessStore?.isBlessed(tool, params) ?? false),
+    };
+    const sideEffects = sideEffectTools(effectivePolicy);
+    pi.on("tool_call", async (event, ctx) => {
+        try {
+            const input = event.input ?? {};
+            const decision = decideGate(event.toolName, input, mode, effectivePolicy);
+            if (decision.block)
+                return { block: true, reason: decision.reason };
+            if (decision.confirm) {
+                // Review mode needs a confirmation. With no dialog-capable UI (headless),
+                // fail CLOSED: the user explicitly chose a stricter mode, so a write we
+                // cannot get consent for is held rather than silently auto-applied (this
+                // mirrors plan mode, which blocks regardless of UI).
+                if (!ctx?.hasUI) {
+                    return { block: true, reason: `review mode: ${event.toolName} held (no UI to confirm). Switch to /mode auto to apply.` };
+                }
+                // Lazily bind the bless store to this session's cwd.
+                if (!blessStore)
+                    blessStore = makeStore(ctx.cwd ?? ".");
+                // Three-way prompt (pi's confirm is boolean-only, so use select): Yes,
+                // Yes-and-remember (only when a path-prefix bless is meaningful), or No.
+                const dir = blessStore.describeDir(input);
+                const blessable = dir !== null;
+                const yes = "Yes";
+                const no = "No";
+                const remember = blessable
+                    ? `Yes, and don't ask again for ${event.toolName} in ${dir}`
+                    : undefined;
+                const options = blessable ? [yes, remember, no] : [yes, no];
+                const choice = await ctx.ui.select("YAGNI Code review mode", options);
+                if (choice === yes)
+                    return {};
+                if (blessable && choice === remember) {
+                    // Session-scoped bless, then a fire-and-forget decision capture so the
+                    // approved tool call is never delayed by the capture prompt.
+                    blessStore.add(event.toolName, input);
+                    if (deps.onBlessRemember) {
+                        void Promise.resolve(deps.onBlessRemember(ctx, { tool: event.toolName, dir: dir })).catch(() => { });
+                    }
+                    return {};
+                }
+                // "No" or a dismissed dialog (undefined) → held.
+                return { block: true, reason: `declined ${event.toolName} in review mode` };
+            }
+            return {};
+        }
+        catch {
+            if (mode !== "auto" && sideEffects.has(event.toolName)) {
+                return {
+                    block: true,
+                    reason: `permission gate failed while ${mode} mode was active; held ${event.toolName}. Switch to /mode auto to apply.`,
+                };
+            }
+            return {};
+        }
+    });
+    // Model awareness: while plan mode is on, every agent start carries a hidden
+    // plan-mode context message so the model plans instead of attempting held
+    // writes. Off-plan turns inject nothing.
+    pi.on("before_agent_start", async () => {
+        if (mode !== "plan")
+            return;
+        return {
+            message: { customType: PLAN_CONTEXT_TYPE, content: PLAN_CONTEXT_MESSAGE, display: false },
+        };
+    });
+    // Once plan mode is off, strip the stale plan context so the model does not
+    // keep believing writes are held.
+    pi.on("context", async (event) => {
+        if (mode === "plan")
+            return;
+        const filtered = filterStalePlanContext(event.messages);
+        if (filtered === event.messages)
+            return;
+        return { messages: filtered };
+    });
+    const paintMode = (ctx) => {
+        try {
+            if (ctx.hasUI)
+                ctx.ui.setStatus?.("yagni-mode", MODE_STATUS[mode]);
+        }
+        catch {
+            // The chip is chrome; never let it break /mode.
+        }
+    };
+    pi.registerCommand("mode", {
+        description: "Set the permission tier: /mode auto | plan | review. No argument shows the current mode.",
+        handler: async (args, ctx) => {
+            const notify = (m, t) => {
+                if (ctx.hasUI)
+                    ctx.ui.notify(m, t);
+            };
+            const arg = args.trim().toLowerCase();
+            if (!arg) {
+                notify(`Permission mode is ${mode}. ${MODE_COPY[mode]}`, "info");
+                return;
+            }
+            if (!isMode(arg)) {
+                notify(`Unknown mode "${arg}". Use auto, plan, or review.`, "warning");
+                return;
+            }
+            const leavingPlan = mode === "plan" && arg !== "plan";
+            mode = arg;
+            paintMode(ctx);
+            notify(`Permission mode set to ${mode}. ${MODE_COPY[mode]}`, "info");
+            if (leavingPlan) {
+                notify("Plan mode off. Tell the agent to execute the plan; it tracks steps with /todos.", "info");
+            }
+        },
+    });
+}
+//# sourceMappingURL=permission.js.map

package/dist/extension/pipeline/activity.d.ts

@@ -0,0 +1,37 @@
+/**
+ * PURE curation layer for the live `/go` activity feed (spec §3).
+ *
+ * Mirrors `events.ts`: deterministic functions over canned `JsonEvent`s, with no
+ * clock, no I/O, and no model call. This is where "summary, not every event" is
+ * enforced — we surface assistant narration and concrete tool actions and drop
+ * everything else. Every function is defensive on missing / oddly-shaped data:
+ * it never throws, only ever reads basenames (no absolute paths leak into the
+ * feed), and falls back to the bare tool name when args are unusable.
+ */
+import { type ActivityLine, type JsonEvent, type StageTag } from "./types.js";
+/**
+ * Deterministic, defensive label for a tool action. Reads only the fields the
+ * spec table names, only ever surfaces a basename, and falls back to the bare
+ * tool name whenever the expected arg is missing or not a usable string.
+ */
+export declare function toolLabel(toolName: string, args?: Record<string, unknown>): string;
+/**
+ * The first non-empty line of an assistant text part, collapsed and clipped to
+ * `NARRATION_MAX`. Returns null when there is no usable headline.
+ */
+export declare function narrationHeadline(text: string): string | null;
+/**
+ * Curate one raw NDJSON event into an `ActivityLine`, or null to drop it.
+ *
+ * - assistant `message_end` with a text part -> narration (drops pure tool-call
+ *   turns and empty headlines)
+ * - `tool_execution_start` -> running action carrying its `toolCallId` + label
+ * - `tool_execution_end` -> resolving action (done / error) with no text; the
+ *   feed model resolves it against the running line by `toolCallId`
+ * - everything else -> null
+ *
+ * `tag` travels alongside the line (the feed attributes it to a stage / lens);
+ * the curated line content itself is stage-agnostic, so `tag` is not read here.
+ */
+export declare function eventToLine(ev: JsonEvent, _tag: StageTag): ActivityLine | null;
+//# sourceMappingURL=activity.d.ts.map

package/dist/extension/pipeline/activity.js

@@ -0,0 +1,151 @@
+/**
+ * PURE curation layer for the live `/go` activity feed (spec §3).
+ *
+ * Mirrors `events.ts`: deterministic functions over canned `JsonEvent`s, with no
+ * clock, no I/O, and no model call. This is where "summary, not every event" is
+ * enforced — we surface assistant narration and concrete tool actions and drop
+ * everything else. Every function is defensive on missing / oddly-shaped data:
+ * it never throws, only ever reads basenames (no absolute paths leak into the
+ * feed), and falls back to the bare tool name when args are unusable.
+ */
+import { NARRATION_MAX } from "./types.js";
+/** ~40 chars of a bash command is enough to recognize it without flooding the row. */
+const BASH_LABEL_MAX = 40;
+/** First usable non-empty string among the candidates, else undefined. */
+function firstString(...vals) {
+    for (const v of vals) {
+        if (typeof v === "string" && v.trim())
+            return v;
+    }
+    return undefined;
+}
+/** Last path segment only — never an absolute path. Empty string if unusable. */
+function basename(value) {
+    if (typeof value !== "string")
+        return "";
+    const parts = value.split(/[/\\]/).filter(Boolean);
+    return parts.length > 0 ? parts[parts.length - 1] : "";
+}
+/** Collapse whitespace and clip to `max`, appending an ellipsis when cut. */
+function clip(text, max) {
+    const collapsed = text.replace(/\s+/g, " ").trim();
+    if (collapsed.length <= max)
+        return collapsed;
+    return `${collapsed.slice(0, max - 1)}…`;
+}
+/** Turn `record_decision` into a readable `record decision`. */
+function humanize(toolName) {
+    return toolName.replace(/_/g, " ");
+}
+/**
+ * Deterministic, defensive label for a tool action. Reads only the fields the
+ * spec table names, only ever surfaces a basename, and falls back to the bare
+ * tool name whenever the expected arg is missing or not a usable string.
+ */
+export function toolLabel(toolName, args) {
+    const a = args ?? {};
+    switch (toolName) {
+        case "read": {
+            const f = firstString(a.path, a.file_path);
+            return f ? `read ${basename(f)}` : toolName;
+        }
+        case "edit":
+        case "write": {
+            const f = firstString(a.path, a.file_path);
+            return f ? `edit ${basename(f)}` : toolName;
+        }
+        case "bash": {
+            const cmd = firstString(a.command);
+            return cmd ? `bash ${clip(cmd, BASH_LABEL_MAX)}` : toolName;
+        }
+        case "grep": {
+            const pattern = firstString(a.pattern);
+            return pattern ? `grep "${clip(pattern, BASH_LABEL_MAX)}"` : toolName;
+        }
+        case "find":
+        case "ls": {
+            const target = firstString(a.path, a.pattern);
+            return target ? `find ${basename(target) || target}` : toolName;
+        }
+        case "ask_yagni":
+        case "review_business_match":
+        case "record_decision":
+            return humanize(toolName);
+        default:
+            return toolName;
+    }
+}
+/**
+ * The first non-empty line of an assistant text part, collapsed and clipped to
+ * `NARRATION_MAX`. Returns null when there is no usable headline.
+ */
+export function narrationHeadline(text) {
+    if (typeof text !== "string")
+        return null;
+    const firstLine = text.split("\n").find((l) => l.trim().length > 0);
+    if (!firstLine)
+        return null;
+    const headline = clip(firstLine, NARRATION_MAX);
+    return headline.length > 0 ? headline : null;
+}
+/** The last text part of an assistant `message_end`, if any. */
+function lastAssistantText(ev) {
+    if (ev.message?.role !== "assistant")
+        return undefined;
+    const parts = ev.message.content ?? [];
+    for (let i = parts.length - 1; i >= 0; i--) {
+        const part = parts[i];
+        if (part.type === "text" && typeof part.text === "string")
+            return part.text;
+    }
+    return undefined;
+}
+/**
+ * Curate one raw NDJSON event into an `ActivityLine`, or null to drop it.
+ *
+ * - assistant `message_end` with a text part -> narration (drops pure tool-call
+ *   turns and empty headlines)
+ * - `tool_execution_start` -> running action carrying its `toolCallId` + label
+ * - `tool_execution_end` -> resolving action (done / error) with no text; the
+ *   feed model resolves it against the running line by `toolCallId`
+ * - everything else -> null
+ *
+ * `tag` travels alongside the line (the feed attributes it to a stage / lens);
+ * the curated line content itself is stage-agnostic, so `tag` is not read here.
+ */
+export function eventToLine(ev, _tag) {
+    switch (ev.type) {
+        case "message_end": {
+            const text = lastAssistantText(ev);
+            if (text === undefined)
+                return null;
+            const headline = narrationHeadline(text);
+            if (!headline)
+                return null;
+            return { kind: "narration", text: headline, state: "done" };
+        }
+        case "tool_execution_start": {
+            const line = {
+                kind: "action",
+                text: toolLabel(ev.toolName ?? "", ev.args),
+                state: "running",
+            };
+            if (ev.toolCallId !== undefined)
+                line.toolCallId = ev.toolCallId;
+            return line;
+        }
+        case "tool_execution_end": {
+            const line = {
+                kind: "action",
+                text: "",
+                state: ev.isError ? "error" : "done",
+            };
+            if (ev.toolCallId !== undefined)
+                line.toolCallId = ev.toolCallId;
+            return line;
+        }
+        default:
+            return null;
+    }
+}
+//# sourceMappingURL=activity.js.map

package/dist/extension/pipeline/activityFeed.d.ts

@@ -0,0 +1,59 @@
+/**
+ * The TERMINAL renderer for the live `/go` feed (spec §4).
+ *
+ * State lives in {@link RunState}; this file is presentation only. It renders
+ * the boxed panel painted above the editor, owning no I/O and no clock: the
+ * caller (the `/go` handler) injects the elapsed string and the spinner frame so
+ * `render` stays a pure function of current state and is fully deterministic in
+ * tests.
+ *
+ * Every constraint here is a TUI constraint and stays here rather than moving
+ * into the model: `ROW_MAX` (terminal width), `MAX_VISIBLE_ACTIONS` (pi's
+ * 10-line widget cap), and the flat ring buffer's `FEED_WINDOW` bound. The
+ * desktop renders the same state into a scrolling pane where none of them apply.
+ */
+import { type ActivityLine, type PipelineProgress, type PipelineResult, type StageTag } from "./types.js";
+/** The minimal slice of pi's `Theme` the feed styles with (a subset, like the masthead). */
+export interface FeedTheme {
+    bold(s: string): string;
+    fg(color: string, s: string): string;
+}
+/** Spinner frames advanced by the caller; `render` is handed one frame, never a timer. */
+export declare const SPINNER_FRAMES: string[];
+/**
+ * Cap on the action rows actually rendered for the buffer stage. The ring buffer
+ * still holds up to FEED_WINDOW entries (state), but pi's aboveEditor widget keeps
+ * only the first MAX_WIDGET_LINES (10) lines and appends a "(widget truncated)"
+ * marker above that, dropping the NEWEST rows. We paint at most this many of the
+ * most-recent rows so the panel is header(1) + 5 stage rows + 4 actions = exactly
+ * 10 lines: at pi's ceiling (it truncates only ABOVE 10), and showing the newest
+ * actions rather than pi's first-10 (which would keep the oldest and add the marker).
+ */
+export declare const MAX_VISIBLE_ACTIONS = 4;
+export declare class ActivityFeed {
+    private readonly run;
+    /**
+     * The stage whose actions the ring buffer currently holds, and the buffer
+     * itself. Terminal-only: this flat, arrival-ordered ring is what lets the panel
+     * paint interleaved rows from the parallel review lenses under one `review`
+     * row, and it is bounded by FEED_WINDOW — the "can't get noisy" guarantee.
+     */
+    private bufferStageId;
+    private actions;
+    constructor(ticket: string);
+    /** Fold a structured progress signal into stage transitions + the header tally. */
+    applyProgress(p: PipelineProgress): void;
+    /** Fold one curated line: narration updates a stage summary; actions ride the ring buffer. */
+    applyEvent(line: ActivityLine, tag: StageTag): void;
+    /** The boxed panel lines (spec §4). Pure: spinner frame + elapsed are injected. */
+    render(theme: FeedTheme, elapsed?: string, spinnerFrame?: string): string[];
+    /**
+     * One compact line summarizing the finished run (spec §4). This is the feed's
+     * own terse outcome glyph-line and is intentionally DISTINCT from goCommand's
+     * `formatSummary`: that one is the durable `sendUserMessage` record and must
+     * also work on headless (no-feed) runs, so the two carry deliberately different
+     * phrasings rather than sharing one outcome-copy source.
+     */
+    finalLine(result: PipelineResult): string;
+}
+//# sourceMappingURL=activityFeed.d.ts.map

package/dist/extension/pipeline/activityFeed.js

@@ -0,0 +1,175 @@
+/**
+ * The TERMINAL renderer for the live `/go` feed (spec §4).
+ *
+ * State lives in {@link RunState}; this file is presentation only. It renders
+ * the boxed panel painted above the editor, owning no I/O and no clock: the
+ * caller (the `/go` handler) injects the elapsed string and the spinner frame so
+ * `render` stays a pure function of current state and is fully deterministic in
+ * tests.
+ *
+ * Every constraint here is a TUI constraint and stays here rather than moving
+ * into the model: `ROW_MAX` (terminal width), `MAX_VISIBLE_ACTIONS` (pi's
+ * 10-line widget cap), and the flat ring buffer's `FEED_WINDOW` bound. The
+ * desktop renders the same state into a scrolling pane where none of them apply.
+ */
+import { BRAND_NAME } from "../branding.js";
+import { RunState } from "./runState.js";
+import { FEED_WINDOW, } from "./types.js";
+/** Spinner frames advanced by the caller; `render` is handed one frame, never a timer. */
+export const SPINNER_FRAMES = ["⠋", "⠙", "⠹", "⠸", "⠼", "⠴", "⠦", "⠧", "⠇", "⠏"];
+/** Defensive cap so a row never blows the terminal width even with a long summary. */
+const ROW_MAX = 96;
+/**
+ * Cap on the action rows actually rendered for the buffer stage. The ring buffer
+ * still holds up to FEED_WINDOW entries (state), but pi's aboveEditor widget keeps
+ * only the first MAX_WIDGET_LINES (10) lines and appends a "(widget truncated)"
+ * marker above that, dropping the NEWEST rows. We paint at most this many of the
+ * most-recent rows so the panel is header(1) + 5 stage rows + 4 actions = exactly
+ * 10 lines: at pi's ceiling (it truncates only ABOVE 10), and showing the newest
+ * actions rather than pi's first-10 (which would keep the oldest and add the marker).
+ */
+export const MAX_VISIBLE_ACTIONS = 4;
+/** Compact outcome phrasing per stop reason (no em-dashes). */
+const FINAL_REASON = {
+    clean: "clean, no blockers remain",
+    round_cap: "round cap reached, blockers remain",
+    aborted: "aborted before review completed",
+    failed: "a stage failed before completing",
+    no_changes: "no changes produced, the implement stage wrote nothing. Re-run /go",
+    budget_exceeded: "budget ceiling reached, stopped before finishing",
+    partial: "a stage stopped early, partial changes left in your working tree",
+};
+function glyphForStatus(status, spinnerFrame) {
+    switch (status) {
+        case "done":
+            return "✔";
+        case "active":
+            return spinnerFrame;
+        case "failed":
+            return "✗";
+        default:
+            return "○";
+    }
+}
+function glyphForAction(state, spinnerFrame) {
+    if (state === "done")
+        return "✔";
+    if (state === "error")
+        return "✗";
+    return spinnerFrame;
+}
+const themeColorForStatus = {
+    done: "success",
+    active: "accent",
+    failed: "error",
+    pending: "dim",
+};
+function plural(n, word) {
+    return `${n} ${word}${n === 1 ? "" : "s"}`;
+}
+function clipRow(text, max) {
+    if (text.length <= max)
+        return text;
+    return `${text.slice(0, max - 1)}…`;
+}
+function countBlocking(result) {
+    return result.findings.filter((f) => f.severity === "critical" || f.severity === "high").length;
+}
+export class ActivityFeed {
+    run;
+    /**
+     * The stage whose actions the ring buffer currently holds, and the buffer
+     * itself. Terminal-only: this flat, arrival-ordered ring is what lets the panel
+     * paint interleaved rows from the parallel review lenses under one `review`
+     * row, and it is bounded by FEED_WINDOW — the "can't get noisy" guarantee.
+     */
+    bufferStageId;
+    actions = [];
+    constructor(ticket) {
+        // The terminal surface has no run id and no clock: `render` is handed the
+        // elapsed string and spinner frame, so timestamps are never read here.
+        this.run = new RunState({ runId: "", ticket, startedAt: 0 });
+    }
+    /** Fold a structured progress signal into stage transitions + the header tally. */
+    applyProgress(p) {
+        // A per-lens signal is a desktop concern: it must not steal the buffer from
+        // the review stage that owns it, nor reset it mid fan-out.
+        if (p.kind === "stage_start" && !p.lens && p.stageId !== this.bufferStageId) {
+            this.bufferStageId = p.stageId;
+            this.actions = [];
+        }
+        this.run.applyProgress(p);
+    }
+    /** Fold one curated line: narration updates a stage summary; actions ride the ring buffer. */
+    applyEvent(line, tag) {
+        this.run.applyLine(line, tag);
+        if (line.kind !== "action")
+            return;
+        if (line.state === "running") {
+            if (this.bufferStageId === undefined)
+                this.bufferStageId = tag.stageId;
+            this.actions.push({ ...line });
+            if (this.actions.length > FEED_WINDOW)
+                this.actions.shift();
+            return;
+        }
+        if (line.toolCallId === undefined)
+            return;
+        const match = this.actions.find((a) => a.toolCallId === line.toolCallId);
+        if (match)
+            match.state = line.state;
+    }
+    /** The boxed panel lines (spec §4). Pure: spinner frame + elapsed are injected. */
+    render(theme, elapsed, spinnerFrame = SPINNER_FRAMES[0]) {
+        const { ticket, round, findingsTotal, findingsBlocking } = this.run.header();
+        const headerParts = [`${BRAND_NAME} · /go ${ticket}`, `round ${round}`, plural(findingsTotal, "finding")];
+        if (findingsBlocking > 0)
+            headerParts.push(`${findingsBlocking} blocking`);
+        if (elapsed)
+            headerParts.push(elapsed);
+        const header = theme.bold(clipRow(headerParts.join(" · "), ROW_MAX));
+        const lines = [header];
+        // Only the lens-less stage rows: the review fan-out's per-lens children are
+        // the desktop's business, and surfacing them here would break the 10-line cap.
+        for (const s of this.run.stageAgents()) {
+            // The FINISH row only exists once the stage actually starts (a clean stop):
+            // hiding it while pending keeps every non-clean run's panel byte-identical
+            // to the pre-FINISH layout and inside pi's 10-line widget cap.
+            if (s.id === "finish" && s.status === "pending")
+                continue;
+            const glyph = glyphForStatus(s.status, spinnerFrame);
+            const label = s.stageId.padEnd(9);
+            const row = clipRow(`${glyph} ${label}${s.summary}`.trimEnd(), ROW_MAX);
+            lines.push(theme.fg(themeColorForStatus[s.status], row));
+            // The ring buffer renders under its OWNING stage (see RunState), so a
+            // just-finished stage's resolved actions stay briefly visible beneath its ✔
+            // row. This keeps the immediate stage_done paint useful rather than blanking
+            // the actions the instant the stage flips to "done".
+            if (s.stageId === this.bufferStageId) {
+                // Only the most-recent rows render. A taller panel trips pi's
+                // MAX_WIDGET_LINES=10 truncation, which keeps the FIRST 10 lines and
+                // drops the newest actions plus a "(widget truncated)" marker; capping
+                // here keeps the newest actions visible and avoids the marker.
+                for (const a of this.actions.slice(-MAX_VISIBLE_ACTIONS)) {
+                    const aGlyph = glyphForAction(a.state, spinnerFrame);
+                    lines.push(theme.fg("dim", clipRow(`   ↳ ${aGlyph} ${a.text}`, ROW_MAX)));
+                }
+            }
+        }
+        return lines;
+    }
+    /**
+     * One compact line summarizing the finished run (spec §4). This is the feed's
+     * own terse outcome glyph-line and is intentionally DISTINCT from goCommand's
+     * `formatSummary`: that one is the durable `sendUserMessage` record and must
+     * also work on headless (no-feed) runs, so the two carry deliberately different
+     * phrasings rather than sharing one outcome-copy source.
+     */
+    finalLine(result) {
+        const glyph = result.stopReason === "clean" ? "✔" : result.stopReason === "round_cap" ? "⚠" : "✗";
+        const blocking = countBlocking(result);
+        return (`${glyph} ${BRAND_NAME} /go ${this.run.header().ticket}: ${FINAL_REASON[result.stopReason]} · ` +
+            `${plural(result.rounds.length, "round")} · ${plural(result.findings.length, "finding")} (${blocking} blocking)`);
+    }
+}
+//# sourceMappingURL=activityFeed.js.map