@yagni-app/code-staging 0.1.0-staging.997.1 → 0.2.0-staging.1025.1

package/dist/extension/index.js

@@ -1,37 +1,89 @@
+import { appendFileSync, mkdirSync } from "node:fs";
+import { dirname, join } from "node:path";
 import { Text } from "@earendil-works/pi-tui";
 import { DEFAULT_ADVISOR_LIMITS, formatAdvisorSubtotal, makeAdvisorState } from "./advisor.js";
 import { makeAskAdvisorTool, registerAdviseCommand } from "./askAdvisorTool.js";
+import { registerBoostCommand } from "./boostCommand.js";
 import { makeAskYagniTool } from "./askYagniTool.js";
 import { makeReviewBusinessMatchTool } from "./reviewTool.js";
 import { makeRecordEngineeringContextTool } from "./recordContextTool.js";
 import { makeRecordDecisionTool } from "./recordDecisionTool.js";
 import { makeSuggestNextWorkTool } from "./nextWorkTool.js";
-import { BRAND_NAME, brandSystemPrompt, buildMastheadString } from "./branding.js";
+import { BRAND_NAME, brandSystemPrompt, brandingDisabled, buildMastheadString, YAGNI_IDENTITY_DRIVER } from "./branding.js";
+import { appendClaudeRules, claudeRulesSection } from "./claudeRules.js";
 import { registerCostCommand } from "./costHud.js";
-import { isFreshWorkspace, runInitPass as defaultRunInitPass } from "./initPass.js";
+import { isDebug } from "./diagnostics.js";
+import { droppedSessionRuns, sessionRunIds } from "./sessionRuns.js";
+import { codeStateHome } from "./stateHome.js";
+import { RerouteNotifier } from "./rerouteNotice.js";
+import { isFreshWorkspace, registerTeamSetupCommand, runInitPass as defaultRunInitPass } from "./initPass.js";
 import { isInitDone as defaultIsInitDone, markInitDone as defaultMarkInitDone } from "./initDone.js";
+import { fetchMcpServers as defaultFetchMcpServers, registerMcpCommand, registerMcpTools, } from "./mcpTools.js";
 import { registerGoCommand } from "./pipeline/goCommand.js";
 import { registerGoCompareCommand } from "./pipeline/goCompareCommand.js";
-import { registerPermissionGate } from "./permission.js";
+import { DEFAULT_PERMISSION_POLICY, registerPermissionGate } from "./permission.js";
 import { registerSubagents } from "./subagents.js";
 import { registerTodos } from "./todos.js";
 import { registerDecisionCommands } from "./decisions.js";
 import { makeDecisionCapture } from "./decisionCapture.js";
 import { registerAmbientRecall } from "./recall.js";
 import { resilientFetch } from "./resilientFetch.js";
+import { installUncaughtExceptionMonitor } from "./crashReport.js";
 import { flushSpool as defaultFlushSpool } from "./spool.js";
 import { makeAuthedFetch, makeTokenProvider } from "./tokenProvider.js";
-import { fetchCatalog as defaultFetchCatalog, fetchContextBrief as defaultFetchContextBrief, getToken, getTokenExpiresAt as defaultGetTokenExpiresAt, getWorkspaceId as defaultGetWorkspaceId, resolveBaseUrl, tokenExpiryNotice, } from "./config.js";
+import { attributionHeaders, fetchCatalog as defaultFetchCatalog, fetchContextBrief as defaultFetchContextBrief, getToken, getTokenExpiresAt as defaultGetTokenExpiresAt, getWorkspaceId as defaultGetWorkspaceId, isDriverCaller, resolveBaseUrl, tokenExpiryNotice, } from "./config.js";
 import { buildYagniProvider } from "./provider.js";
 import { registerChipEditor } from "./chipEditor.js";
 function isEvalMode(env = process.env) {
     return env.YAGNI_CODE_EVAL_MODE === "1";
 }
+/**
+ * Build GET /api/yagni-code/spend's URL. Pure (no fetch), exported for tests.
+ *
+ * YAG-383: a `/go` run's dispatches bill under its OWN run id
+ * (`llm_usage.session_id` holds the run id, not the driver session id — see
+ * attributionHeaders in config.ts), so `sessionId=` alone misses every run
+ * this session launched. `runIds` (comma-separated) widens the same query to
+ * include them; empty is omitted entirely rather than sent as `runIds=`.
+ */
+export function buildSpendUrl(baseUrl, sessionId, runIds) {
+    const url = `${baseUrl}/api/yagni-code/spend?sessionId=${encodeURIComponent(sessionId)}`;
+    return runIds.length > 0 ? `${url}&runIds=${runIds.join(",")}` : url;
+}
+/**
+ * Build GET /api/yagni-code/spend's URL for ONE `/go` run's own spend
+ * (`?runId=`, the sibling of {@link buildSpendUrl}'s session-wide
+ * `?sessionId=&runIds=`). Pure (no fetch), exported for tests. The backend
+ * route treats `runId` and `sessionId` as aliases into the same lookup (see
+ * routes/yagniCode.ts's `/spend` handler), so this is just the more honest
+ * query param name for "this one run" rather than reusing `buildSpendUrl`
+ * with the run id awkwardly standing in for a session id.
+ */
+export function buildRunSpendUrl(baseUrl, runId) {
+    return `${baseUrl}/api/yagni-code/spend?runId=${encodeURIComponent(runId)}`;
+}
+/**
+ * Validate + narrow a `GET /api/yagni-code/spend` response body before
+ * trusting it as a {@link SpendResponse}. A network response is untyped at
+ * runtime, so this is the ONE shared guard both the session-wide `/cost`
+ * fetch and the per-run `/go` fetch rely on (drift-risk fix: they used to
+ * each carry their own copy of this same check). Pure, exported for tests.
+ * Returns null on anything that doesn't look like the real shape.
+ */
+export function parseSpendResponse(data) {
+    if (!data || typeof data !== "object")
+        return null;
+    const d = data;
+    if (typeof d.totalSellMillicents !== "number" || !Array.isArray(d.rows))
+        return null;
+    return d;
+}
 export async function registerYagni(pi, deps = {}) {
     const baseUrl = deps.baseUrl ?? resolveBaseUrl();
     const now = deps.now ?? (() => Date.now());
     const fetchCatalog = deps.fetchCatalog ?? defaultFetchCatalog;
-    const evalMode = isEvalMode(deps.env ?? process.env);
+    const env = deps.env ?? process.env;
+    const evalMode = isEvalMode(env);
     // The refreshing TokenProvider replaces the old boot-time token snapshot:
     // tools read the CURRENT token per call, a proactive unref'd timer rotates
     // it near expiry, and `authedFetch` gives every tool's 401 path a single
@@ -50,8 +102,21 @@ export async function registerYagni(pi, deps = {}) {
     const getTokenFn = () => tokenProvider.getToken();
     const authedFetch = makeAuthedFetch(tokenProvider, deps.fetchImpl);
     const flushSpoolFn = deps.flushSpool ?? defaultFlushSpool;
+    // Crash reporting (docs/superpowers/specs/2026-08-08-crash-reporting-design.md):
+    // observe a fatal crash in pi's process via the behavior-neutral
+    // uncaughtExceptionMonitor hook and deliver through a detached one-shot
+    // sender (a dying process cannot complete its own fetch). Sanitized, fail-
+    // soft, opt-out via YAGNI_DISABLE_CRASH_REPORTS=1; off in eval mode like
+    // every other external side effect.
+    if (!evalMode) {
+        installUncaughtExceptionMonitor({ baseUrl, getToken: getTokenFn, env: deps.env });
+    }
     const catalog = await fetchCatalog({ baseUrl, getToken: getTokenFn, fetchImpl: authedFetch });
-    pi.registerProvider("yagni", buildYagniProvider(catalog, baseUrl));
+    // YAG-471: the driver's own completions carry attribution headers read from
+    // this process's env (YAGNI_SESSION_ID minted by the launcher; YAGNI_CALLER
+    // defaults to "driver" when unset, i.e. every session that is not a /go
+    // child, a subagent, or an advisor consult).
+    pi.registerProvider("yagni", buildYagniProvider(catalog, baseUrl, attributionHeaders(deps.env)));
     const toolOpts = { baseUrl, getToken: getTokenFn, fetchImpl: authedFetch };
     pi.registerTool(makeAskYagniTool(toolOpts));
     // The peak-tier escalation for Balanced sessions (YAG-380). Registered
@@ -66,6 +131,12 @@ export async function registerYagni(pi, deps = {}) {
     // /advise runs the SAME tool, sharing the state handle, so a manual consult
     // draws on the same cap rather than opening a side channel around it.
     registerAdviseCommand(pi, askAdvisorTool);
+    // /boost — the sanctioned session-scoped escalation to Peak (spec §7,
+    // YAG-380 follow-on). Unlike /advise's per-call consult, this flips the
+    // DRIVER's own live model to peak until /boost off or the session ends.
+    // The returned handle threads isBoosted() into /cost below, the same way
+    // advisorState threads into advisorSubtotal.
+    const boostCommand = registerBoostCommand(pi, { env });
     // The differentiated business-grounded tools (loop bricks): review a change
     // for business fit, rank the next work by business priority, and record the
     // engineering rationale back onto the work-item.
@@ -90,9 +161,32 @@ export async function registerYagni(pi, deps = {}) {
     // parallel) to fresh-context agents defined in .claude/agents / .pi/agents,
     // riding the /go pipeline's child runner. /agents lists what's available.
     registerSubagents(pi);
+    // Shared fetch timeout for the small, interactive display-path reads below
+    // (/cost's spend + headroom, and Task 8's per-run spend for /go's summary):
+    // 5s, not the 10s other boot/grounding fetches use, because the user is
+    // waiting on a prompt or a run's completion, not backgrounded work.
+    const COST_FETCH_TIMEOUT_MS = 5_000;
     // The grounded multi-agent pipeline entry point: /go <ticket> runs
     // map → plan → implement → review → fix, each child grounded by inheritance.
-    registerGoCommand(pi);
+    registerGoCommand(pi, {
+        // Task 8: /go's end-of-run summary prefers the server-priced per-stage
+        // breakdown for the ONE run that just finished (`?runId=`, aliasing the
+        // spend endpoint's `sessionId` param — see the backend route), over
+        // /cost's session-wide `?sessionId=&runIds=`. Fail-soft like every other
+        // fetch here: goCommand.ts's `resolveCostText` falls back to the local
+        // client estimate on a throw, a non-2xx, or a malformed body.
+        fetchRunSpend: async (runId, signal) => {
+            try {
+                const res = await resilientFetch(buildRunSpendUrl(baseUrl, runId), { method: "GET", headers: { authorization: `Bearer ${getTokenFn() ?? ""}` } }, { fetchImpl: authedFetch, signal, policy: { maxAttempts: 1, backoffBaseMs: 0, backoffMaxMs: 0, timeoutMs: COST_FETCH_TIMEOUT_MS, jitterRatio: 0 } });
+                if (!res.ok)
+                    return null;
+                return parseSpendResponse(await res.json());
+            }
+            catch {
+                return null;
+            }
+        },
+    });
     // M6 eval (report-only): /go-compare runs a ticket grounded vs blind and reports
     // the business-fit delta. Never wired to routing.
     registerGoCompareCommand(pi);
@@ -103,25 +197,65 @@ export async function registerYagni(pi, deps = {}) {
     const decisionCapture = evalMode ? undefined : makeDecisionCapture(decisionClientOpts);
     if (!evalMode)
         registerDecisionCommands(pi, decisionClientOpts);
+    // Workspace MCP servers (YAG-446): register one tool per enabled server
+    // tool, executing through the backend proxy, plus the /mcp listing
+    // command. Fail-soft fetch (older backend / un-rescoped token → no MCP
+    // tools); skipped in eval mode like the other external-side-effect tools.
+    const fetchMcp = deps.fetchMcpServers ?? defaultFetchMcpServers;
+    const mcpServers = evalMode
+        ? []
+        : await fetchMcp({ baseUrl, getToken: getTokenFn, fetchImpl: authedFetch });
+    const { mutatingToolNames: mcpMutatingTools } = registerMcpTools(pi, mcpServers, { baseUrl, getToken: getTokenFn, fetchImpl: authedFetch });
+    registerMcpCommand(pi, mcpServers, { baseUrl });
     // P3 + W4: interactive permission tiers + plan mode via /mode, now with a
     // session bless store (three-way review-mode select) and a capture hook that
     // drafts a decision on "don't ask again". Default auto, so still additive.
+    // Mutating MCP tools join write/edit/bash in the gate policy: plan mode
+    // holds them, review mode confirms them.
     registerPermissionGate(pi, {
+        ...(mcpMutatingTools.length > 0
+            ? {
+                policy: {
+                    planBlockTools: [
+                        ...DEFAULT_PERMISSION_POLICY.planBlockTools,
+                        ...mcpMutatingTools,
+                    ],
+                    reviewConfirmTools: [
+                        ...DEFAULT_PERMISSION_POLICY.reviewConfirmTools,
+                        ...mcpMutatingTools,
+                    ],
+                },
+            }
+            : {}),
         onBlessRemember: decisionCapture
             ? (ctx, info) => decisionCapture.captureFromBless(ctx, info)
             : undefined,
     });
-    // P2: /cost reports session usage (accumulated off turn_end) + credit headroom.
-    // The headroom fetch is fail-soft: until the backend /credits endpoint exists it
-    // resolves null and /cost still shows session usage.
+    // P2/YAG-383: /cost prefers the server-authoritative session spend (covers
+    // subagents and advisor consults directly, since they bill under this same
+    // session id — PLUS every /go run this session launched, widened in via
+    // runIds because a run's dispatches bill under its OWN run id instead; see
+    // sessionRuns.ts and buildSpendUrl below), plus credit headroom. Both
+    // fetches are fail-soft: a down backend still leaves /cost showing the
+    // local, driver-only accumulator.
+    const yagniSessionId = env.YAGNI_SESSION_ID;
+    // COST_FETCH_TIMEOUT_MS (declared above, shared with /go's fetchRunSpend):
+    // the two fetches below now run concurrently (see costHud.ts's Promise.all)
+    // rather than serially, so it bounds worst-case /cost silence to 5s, not 10-20s.
     registerCostCommand(pi, {
         // Advisor consults run in a child process, so they never reach /cost's
-        // turn_end accumulator. Thread the subtotal in explicitly (YAG-383 owns the
-        // real fix, which also covers /go's still-invisible stage spend).
+        // turn_end accumulator. Thread the subtotal in explicitly for the local
+        // fallback line; the server-authoritative line already counts advisor
+        // spend as an ordinary caller row.
         advisorSubtotal: () => formatAdvisorSubtotal(advisorState.read(), DEFAULT_ADVISOR_LIMITS),
+        // YAG-380 follow-on: a boosted session that only chats never produces a
+        // server-side boosted row (see boostCommand.ts's KNOWN-asymmetry
+        // docblock), so /cost needs the live client-side toggle on top of
+        // whatever the server rows show.
+        isBoosted: () => boostCommand.isBoosted(),
         fetchHeadroom: async (signal) => {
             try {
-                const res = await resilientFetch(`${baseUrl}/api/yagni-code/credits`, { method: "GET", headers: { authorization: `Bearer ${getTokenFn() ?? ""}` } }, { fetchImpl: authedFetch, signal, policy: { maxAttempts: 1, backoffBaseMs: 0, backoffMaxMs: 0, timeoutMs: 10_000, jitterRatio: 0 } });
+                const res = await resilientFetch(`${baseUrl}/api/yagni-code/credits`, { method: "GET", headers: { authorization: `Bearer ${getTokenFn() ?? ""}` } }, { fetchImpl: authedFetch, signal, policy: { maxAttempts: 1, backoffBaseMs: 0, backoffMaxMs: 0, timeoutMs: COST_FETCH_TIMEOUT_MS, jitterRatio: 0 } });
                 if (!res.ok)
                     return null;
                 const data = (await res.json());
@@ -133,6 +267,58 @@ export async function registerYagni(pi, deps = {}) {
                 return null;
             }
         },
+        // Skip the fetch entirely when there is no session id to ask about (e.g.
+        // a harness that never set YAGNI_SESSION_ID) rather than issuing a request
+        // guaranteed to 400.
+        fetchSpend: yagniSessionId
+            ? async (signal) => {
+                try {
+                    const res = await resilientFetch(buildSpendUrl(baseUrl, yagniSessionId, sessionRunIds()), { method: "GET", headers: { authorization: `Bearer ${getTokenFn() ?? ""}` } }, { fetchImpl: authedFetch, signal, policy: { maxAttempts: 1, backoffBaseMs: 0, backoffMaxMs: 0, timeoutMs: COST_FETCH_TIMEOUT_MS, jitterRatio: 0 } });
+                    if (!res.ok)
+                        return null;
+                    return parseSpendResponse(await res.json());
+                }
+                catch {
+                    return null;
+                }
+            }
+            : undefined,
+        // Quiet debug signal only (never user-facing): a session-scoped log under
+        // YAGNI_DEBUG, mirroring diagnostics.ts's layer-A verbose mode. No-op when
+        // YAGNI_DEBUG is unset, so a healthy session never touches disk for this.
+        onDivergence: (driverServerUsd, localUsd) => {
+            if (!isDebug(env))
+                return;
+            try {
+                const path = join(codeStateHome(null, env), "logs", "cost-divergence.log");
+                mkdirSync(dirname(path), { recursive: true });
+                const line = { ts: new Date().toISOString(), driverServerUsd, localUsd };
+                appendFileSync(path, JSON.stringify(line) + "\n", "utf8");
+            }
+            catch {
+                /* a diagnostic must never break /cost */
+            }
+        },
+        // Carry-over (/cost re-review): surfaces sessionRuns.ts's dropped-run-id
+        // count as costHud's "Excludes N earlier /go runs." note.
+        droppedSessionRuns,
+    });
+    // YAG-471: surface the backend's vision reroute header as a quiet notice
+    // (see rerouteNotice.ts for the event/header contract). One notifier per
+    // session dedupes on the from->to pair so a long session does not repeat
+    // itself on every image turn.
+    const rerouteNotifier = new RerouteNotifier();
+    pi.on("after_provider_response", (event, ctx) => {
+        try {
+            if (!ctx.hasUI)
+                return;
+            const message = rerouteNotifier.observe(event.headers);
+            if (message)
+                ctx.ui.notify(message, "info");
+        }
+        catch {
+            // A notice must never break a turn.
+        }
     });
     // /exit — alias for pi's built-in /quit. Delegates to ctx.shutdown() which
     // performs graceful TUI teardown (restores terminal state, emits
@@ -173,21 +359,26 @@ export async function registerYagni(pi, deps = {}) {
         decisionsCount: briefResult?.counts?.decisions ?? 0,
         evalMode,
     });
-    // Onramp Door B (spec §5B/§7): on a FRESH workspace (empty/thin grounding
-    // corpus), the first run reads the repo, drafts the engineering-half brief + a
-    // proposed Engineering Team, and seeds decisions — instead of a bare prompt. We
-    // reuse the brief we just fetched (no double round-trip). Skipped in eval mode.
+    // ADR-0033: the Team-drafting flow is an explicit command, never a first-run
+    // ceremony. /setup-team drafts the Engineering Team + engineering brief from
+    // the repo and banks the brief as one decision on approval.
+    registerTeamSetupCommand(pi, { baseUrl, getToken: getTokenFn, fetchImpl: authedFetch });
+    // Onramp Door B (spec §5B/§7, as amended by ADR-0033): on a FRESH workspace
+    // (empty/thin grounding corpus), the first run shows a short welcome + one
+    // next-work offer, with free text first-class — instead of a bare prompt. It
+    // records nothing; Team drafting lives behind /setup-team. We reuse the brief
+    // we just fetched (no double round-trip). Skipped in eval mode.
     const runInitPassFn = deps.runInitPass ?? defaultRunInitPass;
     const getWorkspaceIdFn = deps.getWorkspaceId ?? (() => defaultGetWorkspaceId(deps.env));
     const isInitDoneFn = deps.isInitDone ?? defaultIsInitDone;
     const markInitDoneFn = deps.markInitDone ?? defaultMarkInitDone;
     const workspaceId = getWorkspaceIdFn();
-    // F2a — one-time marker (idempotency): the init pass writes only to
-    // `yagni_code_decisions`, which the context endpoint never reads back (it reads
-    // Vision + Goals), so a Vision/Goals-less workspace looks "fresh" forever and
-    // would re-seed duplicate decisions on every launch. A per-workspace marker
-    // short-circuits the pass after its first real run — regardless of brief
-    // emptiness. (Degrades to freshness-only when the workspace id is unknown.)
+    // F2a — one-time marker (idempotency): the context endpoint never reflects
+    // the welcome (it reads Vision + Goals), so a Vision/Goals-less workspace
+    // looks "fresh" forever and would re-welcome on every launch. A per-workspace
+    // marker short-circuits the pass after its first real run — regardless of
+    // brief emptiness. (Degrades to freshness-only when the workspace id is
+    // unknown.)
     const alreadyInit = !evalMode && !!workspaceId && isInitDoneFn(workspaceId);
     // F2b — fail CLOSED: a FAILED context fetch (network / non-2xx / throw) surfaces
     // as a `null` brief here (fetchContextBrief and the catch above both map failure
@@ -195,10 +386,27 @@ export async function registerYagni(pi, deps = {}) {
     // must NOT be treated as fresh, or a transient outage would spuriously re-seed.
     // Only a genuinely-empty SUCCESSFUL response (non-null, thin) counts as fresh.
     const freshWorkspace = !evalMode && !alreadyInit && briefResult !== null && isFreshWorkspace(briefResult);
-    // Own the identity + inject live company context on every turn.
-    pi.on("before_agent_start", (event) => ({
-        systemPrompt: brandSystemPrompt(event.systemPrompt, { contextBrief }),
-    }));
+    // Claude Code `.claude/rules` compat: the launcher passes the trusted rules
+    // dirs via env; unscoped rules inline, path-scoped rules become read-first
+    // pointers. Computed once per activation (rules are launch-time state, like
+    // pi's own skill discovery); fail-soft to null.
+    const rulesSection = claudeRulesSection(deps.env ?? process.env);
+    // Own the identity + inject live company context (and repo rules) on every
+    // turn. The extension loads identically in every pi process this app spawns —
+    // the interactive driver AND every `/go` stage child, subagent, and advisor
+    // consult — so the delegation-first paragraph (which assumes a `subagent`
+    // tool that only the driver has registered) is gated to the driver's own
+    // identity variant via isDriverCaller's env.YAGNI_CALLER check (config.ts).
+    // Under YAGNI_DISABLE_BRANDING the handler returns nothing, so pi's
+    // assembled prompt passes through byte-exact (no rewrite, no brief
+    // injection, no rules section, no delegation identity).
+    const noBranding = brandingDisabled(env);
+    const identity = isDriverCaller(env) ? YAGNI_IDENTITY_DRIVER : undefined;
+    pi.on("before_agent_start", (event) => noBranding
+        ? undefined
+        : {
+            systemPrompt: appendClaudeRules(brandSystemPrompt(event.systemPrompt, { contextBrief, identity }), rulesSection),
+        });
     // Two finalized-message guards share this handler (their conditions are
     // mutually exclusive: YAG-460 takes error-stopped messages, YAG-466 takes
     // stop/length ones without an errorMessage).
@@ -343,13 +551,13 @@ export { makeRecordEngineeringContextTool } from "./recordContextTool.js";
 export { makeRecordDecisionTool } from "./recordDecisionTool.js";
 export { makeSuggestNextWorkTool, defaultNextAction } from "./nextWorkTool.js";
 export { recordDecision } from "./recordDecisionTool.js";
-// Onramp Door B: the CLI init pass (fresh-workspace detection + repo intake +
-// engineering-half drafting + decision seeding + one default next action).
-export { runInitPass, isFreshWorkspace, readRepoIntake, draftEngineering, summarizeDraft, FRESH_BRIEF_MIN_CHARS, } from "./initPass.js";
+// Onramp Door B (as amended by ADR-0033): the first-run welcome (write-free,
+// free text first-class) + the explicit /setup-team drafting flow.
+export { runInitPass, runTeamSetup, registerTeamSetupCommand, isFreshWorkspace, readRepoIntake, draftEngineering, summarizeDraft, FRESH_BRIEF_MIN_CHARS, } from "./initPass.js";
 // Onramp Door B (F2a): the one-time init-pass idempotency marker.
 export { isInitDone, markInitDone, initDoneMarkerFile, _setInitDoneHomeForTest } from "./initDone.js";
-export { brandSystemPrompt, YAGNI_IDENTITY, BRAND_NAME } from "./branding.js";
-export { fetchCatalog, getToken, getWorkspaceId, resolveBaseUrl } from "./config.js";
+export { brandSystemPrompt, YAGNI_IDENTITY, YAGNI_IDENTITY_DRIVER, BRAND_NAME } from "./branding.js";
+export { attributionHeaders, isDriverCaller, fetchCatalog, getToken, getWorkspaceId, resolveBaseUrl, sanitizeCallerSegment, } from "./config.js";
 export { buildYagniProvider } from "./provider.js";
 export { registerGoCommand } from "./pipeline/goCommand.js";
 export { runPipeline } from "./pipeline/orchestrator.js";
@@ -385,4 +593,5 @@ export { makeTokenProvider, makeAuthedFetch, persistRotationToProfile, PROACTIVE
 // W4 trust plumbing: the durable write-spool for the judgment-capture tools
 // (idempotencyKey-replayed; server-side dedup makes flush safe).
 export { appendToSpool, loadSpool, flushSpool, sendOrSpool, spoolFile, MAX_SPOOL_AGE_MS, _setSpoolHomeForTest, } from "./spool.js";
+export { crashReportsDisabled, installUncaughtExceptionMonitor, makeCrashReporter, reportFatalCrash, sanitizeCrashError, sanitizeCrashText, } from "./crashReport.js";
 //# sourceMappingURL=index.js.map

package/dist/extension/initPass.d.ts

@@ -1,26 +1,26 @@
 /**
- * The CLI init pass (Onramp Door B, spec §5B/§7).
+ * The CLI first-run experience (Onramp Door B, spec §5B/§7, as amended by
+ * ADR-0033: first run is a welcome, not a Team ceremony).
  *
- * On a FRESH workspace, the first `yagni` run in a repo should not drop the
- * user into a bare prompt. Instead it runs a one-time init pass:
- *   1. detect a fresh workspace (an empty/thin grounding corpus, via the existing
- *      `GET /api/yagni-code/context` brief),
- *   2. read the repo (README, AGENTS.md/CLAUDE.md, package.json scripts, ADRs),
- *   3. draft the ENGINEERING HALF of the company brief + a proposed Engineering
- *      Team, and record the salient ADRs/conventions as decisions so the corpus
- *      is non-empty for the very first `/go`,
- *   4. present the draft for approve/edit in-terminal (mirrored to the app via the
- *      recorded decisions), NEVER auto-committing the Team, and
- *   5. offer the ONE default next action (`suggest_next_work`) with escape hatches.
+ * On a FRESH workspace (an empty/thin grounding corpus, via the existing
+ * `GET /api/yagni-code/context` brief), the first interactive `yagni` run shows
+ * a short WELCOME: how to work with YAGNI in one notice, then one offer (ask
+ * @yagni what to work on next) with free text as a first-class choice.
+ * Escape/cancel land in an empty editor ready to type into, never a forced
+ * prompt. The welcome records NOTHING and reads nothing from the repo.
  *
- * Honesty rails (non-negotiable, spec §9): when a repo has no README/AGENTS/ADRs
- * the engineering half stays THIN and SAYS SO — nothing is fabricated, and no
- * decision is seeded from thin air. The proposed Team is only ever a DRAFT; it is
- * never created/committed automatically.
+ * The Team-drafting flow (repo intake -> engineering-half draft -> approve/edit
+ * -> bank the brief as ONE decision) lives behind the explicit `/setup-team`
+ * command ({@link registerTeamSetupCommand}) so onboarding can invoke it
+ * deliberately. Honesty rails are unchanged (spec §9, F2/F13): approval-gated
+ * writes, honest-when-thin (nothing fabricated), the Team is only ever a DRAFT
+ * and never created automatically, and the repo intake reads only universal
+ * signals (README, AGENTS.md/CLAUDE.md, package.json scripts) so it behaves
+ * the same on any customer repo.
  *
  * No new backend transport: the only writes are through the existing token-scoped
  * `record_decision` endpoint (reused via {@link recordDecision}). Every seam is
- * injectable so the whole pass is unit-testable without a network or a filesystem.
+ * injectable so both flows are unit-testable without a network or a filesystem.
  */
 import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
 import { fetchContextBrief as defaultFetchContextBrief, type ContextBrief } from "./config.js";
@@ -39,16 +39,12 @@ export declare const FRESH_BRIEF_MIN_CHARS = 40;
  * populated and the init pass must be skipped.
  */
 export declare function isFreshWorkspace(brief: ContextBrief | null | undefined): boolean;
-/** A single architecture-decision record found in the repo. */
-export interface RepoAdr {
-    /** Repo-relative path, e.g. `docs/adr/0001-use-fly.md`. */
-    path: string;
-    /** The record's title (its first heading, or the filename when headingless). */
-    title: string;
-    /** A short first-paragraph summary, when present. */
-    summary?: string;
-}
-/** What the repo intake could find. All fields are best-effort / optional. */
+/**
+ * What the repo intake could find. All fields are best-effort / optional, and
+ * every signal is a UNIVERSAL repo convention (README, agents file, package
+ * scripts) — never a house-specific layout like docs/adr, so the intake
+ * behaves the same on any customer repo.
+ */
 export interface RepoIntake {
     /** README body (capped), when present. */
     readme?: string;
@@ -56,8 +52,6 @@ export interface RepoIntake {
     agents?: string;
     /** package.json `scripts` map (empty when absent/unparseable). */
     packageScripts: Record<string, string>;
-    /** Architecture decision records found under docs/adr (etc.). */
-    adrs: RepoAdr[];
     /** The literal test command (package.json `scripts.test`), when present. */
     testCommand?: string;
     /** The literal build command (package.json `scripts.build`), when present. */
@@ -66,7 +60,6 @@ export interface RepoIntake {
 /** Injectable filesystem seam so repo intake is unit-testable without disk. */
 export interface RepoIntakeFs {
     readFile(p: string): Promise<string>;
-    readdir(p: string): Promise<string[]>;
 }
 /**
  * Read the repo at `cwd` for the signals that seed the engineering half of the
@@ -81,13 +74,12 @@ export interface DraftTeam {
     playbookRules: string[];
     testCommand?: string;
     buildCommand?: string;
-    riskAreas: string[];
 }
 /** The drafted engineering half: the brief, seeded decisions, and a Team draft. */
 export interface EngineeringDraft {
     /** The engineering-half brief text (honest-when-thin). */
     brief: string;
-    /** True when the repo had no README/AGENTS/ADRs — the brief says so, nothing is fabricated. */
+    /** True when the repo had no README/AGENTS — the brief says so, nothing is fabricated. */
     thin: boolean;
     /** Decisions to seed into the corpus. EMPTY when thin (no fabrication). */
     decisions: RecordDecisionParams[];
@@ -96,10 +88,10 @@ export interface EngineeringDraft {
 }
 /**
  * Draft the engineering half of the brief from repo intake. PURE. Honest-when-thin:
- * with no README/AGENTS/ADRs the brief says so and NO decision is seeded.
+ * with no README/AGENTS the brief says so and NO decision is seeded.
  */
 export declare function draftEngineering(intake: RepoIntake): EngineeringDraft;
-/** Injectable dependencies for {@link runInitPass}. */
+/** Injectable dependencies for {@link runInitPass} (the first-run welcome). */
 export interface RunInitPassDeps {
     baseUrl: string;
     getToken: () => string | undefined;
@@ -111,23 +103,34 @@ export interface RunInitPassDeps {
      */
     brief?: ContextBrief | null;
     fetchContextBrief?: typeof defaultFetchContextBrief;
-    readRepoIntake?: (cwd: string) => Promise<RepoIntake>;
-    recordDecision?: typeof defaultRecordDecision;
 }
-/** The outcome of an init-pass attempt. */
+/** The outcome of a first-run welcome attempt. The welcome never writes. */
 export type InitPassOutcome = {
     ran: false;
     reason: "not_fresh" | "non_interactive";
+} | {
+    ran: true;
+    /** What the user picked; `free_text` covers the typing option AND escape/cancel. */
+    chosenAction: NextActionOption["id"] | "free_text";
+};
+/** Injectable dependencies for {@link runTeamSetup} (the `/setup-team` flow). */
+export interface RunTeamSetupDeps {
+    baseUrl: string;
+    getToken: () => string | undefined;
+    fetchImpl?: typeof fetch;
+    readRepoIntake?: (cwd: string) => Promise<RepoIntake>;
+    recordDecision?: typeof defaultRecordDecision;
+}
+/** The outcome of a `/setup-team` run. */
+export type TeamSetupOutcome = {
+    ran: false;
+    reason: "non_interactive";
 } | {
     ran: true;
     thin: boolean;
     decisionsRecorded: number;
-    /** The Team was drafted for the user. */
-    teamDrafted: true;
     /** The Team is NEVER created/committed automatically. Always false. */
     teamCommitted: false;
-    /** Which next action the user picked (undefined in headless mode). */
-    chosenAction?: NextActionOption["id"];
 };
 /**
  * Compact one-screen PREVIEW of the draft for the approve/edit dialog.
@@ -141,12 +144,27 @@ export type InitPassOutcome = {
  */
 export declare function summarizeDraft(draft: EngineeringDraft): string;
 /**
- * Run the init pass. Guards on fresh-workspace detection (defensive — the caller
- * also guards), reads the repo, drafts the engineering half, presents it for
- * approve/edit, and ONLY THEN seeds the corpus (approval-gated: an approve banks
- * the drafted decisions, an edit banks the correction, a decline writes nothing),
- * before offering the one default next action. Fully fail-soft: a UI or network
- * hiccup never throws (it must never break session start).
+ * Run the first-run welcome (ADR-0033). Guards on fresh-workspace detection
+ * (defensive — the caller also guards), shows a short how-to-work-with-YAGNI
+ * notice, and offers ONE default next action (ask @yagni what to work on next)
+ * with free text as a first-class choice. Picking "Just start typing",
+ * pressing escape, or cancelling all leave the editor untouched so the user
+ * can type whatever they want to start on. Records NOTHING, reads nothing from
+ * the repo, and is fully fail-soft (it must never break session start).
  */
 export declare function runInitPass(pi: ExtensionAPI, ctx: ExtensionContext, deps: RunInitPassDeps): Promise<InitPassOutcome>;
+/**
+ * Run the `/setup-team` flow: read the repo's universal signals, draft the
+ * engineering half + a proposed Team, present it for approve/edit, and ONLY
+ * THEN bank the brief as one decision (approval-gated: an approve banks the
+ * draft, an edit banks the correction, a decline writes nothing). Fully
+ * fail-soft; the Team itself is never created automatically.
+ */
+export declare function runTeamSetup(pi: ExtensionAPI, ctx: ExtensionContext, deps: RunTeamSetupDeps): Promise<TeamSetupOutcome>;
+/**
+ * Register `/setup-team`: the explicit, approval-gated flow that drafts the
+ * Engineering Team + engineering brief from the repo. Deliberately NOT part of
+ * first-run (ADR-0033) — onboarding invokes it when the workspace is ready.
+ */
+export declare function registerTeamSetupCommand(pi: ExtensionAPI, opts: RunTeamSetupDeps): void;
 //# sourceMappingURL=initPass.d.ts.map