@yagni-app/code-staging 0.3.0-staging.1081.1 → 0.3.0-staging.1082.1

package/dist/cli.js

@@ -28,6 +28,7 @@ import { runDoctor } from "./doctor.js";
 import { installProcessCrashHandlers } from "./crashReport.js";
 import { currentCliVersion, maybeNudgeAndRefresh, upgradeCommand } from "./upgrade.js";
 import { maybeRefreshAtLaunch } from "./refresh.js";
+import { exitCodeFor, installSignalForwarding } from "./signalForward.js";
 import { PAD_X } from "./padding.js";
 import { ensureShadowPiPackage } from "./piPackage.js";
 import { resolveExtensionPath, resolvePiCliPath, resolvePiPackageDir } from "./paths.js";
@@ -262,7 +263,12 @@ async function runDefault(passthroughArgs) {
             stdio: "inherit",
             env,
         });
-        child.on("exit", (code) => resolve(code ?? 0));
+        // Forward termination signals to pi instead of dying around it (see
+        // signalForward.ts for the policy: first signal graceful, second tree-kill).
+        installSignalForwarding(child);
+        // 128+n for a signal death (bash parity), so a cancelled/killed run never
+        // reads as success to scripts or CI.
+        child.on("exit", (code, signal) => resolve(exitCodeFor(code, signal)));
         child.on("error", (err) => {
             process.stderr.write(`Failed to start YAGNI Code: ${err.message}\n`);
             resolve(1);

package/dist/extension/chipEditor.d.ts

@@ -84,6 +84,15 @@ export declare class ChipEditor extends CustomEditor {
     private stashed;
     private chipCounter;
     private readImage;
+    /**
+     * Fired when Ctrl+C lands on an EMPTY prompt. pi's own binding is
+     * clear-editor (Esc is the interrupt key), but with nothing typed that is a
+     * no-op, and every peer harness (Claude Code, Codex, Gemini, Aider) treats a
+     * single Ctrl+C as "stop what's happening". The hook lets the extension wire
+     * exactly that; the key still falls through to pi afterwards, so clear and
+     * the 500ms double-press exit window are untouched.
+     */
+    onEmptyCtrlC?: () => void;
     constructor(tui: TUI, theme: EditorTheme, keybindings: ConstructorParameters<typeof CustomEditor>[2], readImage?: ClipboardImageReader, options?: EditorOptions);
     /**
      * Paste-image must fire on Cmd+V too (Claude Code parity on macOS). Claude

package/dist/extension/chipEditor.js

@@ -29,6 +29,7 @@ import { tmpdir } from "node:os";
 import { join, basename, isAbsolute } from "node:path";
 import { randomUUID } from "node:crypto";
 import { logImagePaste } from "./diagnostics.js";
+import { cancelActiveRuns } from "./pipeline/runRegistry.js";
 /** Matches the `[Image #N]` chip token in the editor text. */
 const CHIP_RE = /\[Image #(\d+)\]/g;
 /** Inverse-video wrap so the chip token reads as a chip, not plain text. */
@@ -285,6 +286,15 @@ export class ChipEditor extends CustomEditor {
     stashed = [];
     chipCounter = 0;
     readImage;
+    /**
+     * Fired when Ctrl+C lands on an EMPTY prompt. pi's own binding is
+     * clear-editor (Esc is the interrupt key), but with nothing typed that is a
+     * no-op, and every peer harness (Claude Code, Codex, Gemini, Aider) treats a
+     * single Ctrl+C as "stop what's happening". The hook lets the extension wire
+     * exactly that; the key still falls through to pi afterwards, so clear and
+     * the 500ms double-press exit window are untouched.
+     */
+    onEmptyCtrlC;
     constructor(tui, theme, keybindings, readImage = defaultClipboardImageReader, options) {
         super(tui, theme, keybindings, options);
         this.readImage = readImage;
@@ -333,6 +343,14 @@ export class ChipEditor extends CustomEditor {
             this.onPasteImage?.();
             return;
         }
+        // Ctrl+C on an empty prompt: fire the stop hook, then STILL hand the key to
+        // pi so its clear + double-press-exit tracking behave exactly as before.
+        if (matchesKey(data, "ctrl+c")) {
+            if (this.getText().length === 0)
+                this.onEmptyCtrlC?.();
+            super.handleInput(data);
+            return;
+        }
         super.handleInput(data);
     }
     async pasteChip() {
@@ -428,6 +446,20 @@ export function registerChipEditor(pi) {
             return;
         ctx.ui.setEditorComponent((tui, theme, keybindings) => {
             const editor = new ChipEditor(tui, theme, keybindings);
+            // Single Ctrl+C on an empty prompt = "stop what's happening" (peer-harness
+            // parity; pi's clear binding is a no-op with nothing typed): abort a
+            // streaming turn and cancel every in-flight /go run. pi still sees the
+            // key afterwards, so Ctrl+C twice within 500ms exits as always.
+            editor.onEmptyCtrlC = () => {
+                if (!ctx.isIdle())
+                    ctx.abort();
+                const cancelled = cancelActiveRuns();
+                if (cancelled.length > 0) {
+                    ctx.ui.notify(`Stopping ${cancelled.length} /go run${cancelled.length === 1 ? "" : "s"}: ${cancelled
+                        .map((r) => `[${r.runId.slice(0, 8)}] ${r.ticket}`)
+                        .join(", ")}. Work so far lands as WIP commits (see /go-status).`, "warning");
+                }
+            };
             liveChipEditors.add(new WeakRef(editor));
             return editor;
         });

package/dist/extension/pipeline/childRegistry.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Live child-process registry + exit sweep (the "no orphaned workers" invariant).
+ *
+ * /go stage children and verify children are spawned with raw `node:child_process`
+ * and piped stdio, so nothing in pi tracks them: pi's own shutdown paths
+ * (`/exit`, double Ctrl+C, SIGTERM/SIGHUP) call `process.exit(0)` and would
+ * orphan them into the background, still editing the repo and burning tokens
+ * until their wall-clock timeout fires.
+ *
+ * Every long-lived child is registered here instead. A single `process.on("exit")`
+ * hook (installed lazily on first track) kills whatever is still alive —
+ * `"exit"` handlers must be synchronous, and the whole sweep (including the
+ * `ps`-based descendant walk) is, so this holds on every exit path short of the
+ * pi process itself being SIGKILLed.
+ *
+ * Kills are TREE kills: a verify child like `pnpm test` fans out its own
+ * grandchildren, and killing only the direct pid would orphan those instead.
+ */
+import { type ChildProcess } from "node:child_process";
+/**
+ * PURE: given `ps -A -o pid=,ppid=` output lines, collect every descendant of
+ * the given roots (children, grandchildren, ...), breadth-first.
+ */
+export declare function descendantsOf(roots: number[], psLines: string[]): number[];
+/**
+ * Synchronously SIGKILL a process AND its descendants. POSIX walks a `ps`
+ * snapshot (the tree-kill pattern); Windows has real tree kill via
+ * `taskkill /T /F`. Throw-proof and synchronous, so it is exit-hook safe.
+ * Fail-soft: with no readable snapshot the direct pid is still killed.
+ */
+export declare function killTreeSync(pid: number): void;
+/**
+ * Register a spawned child so the exit sweep covers it. Deregisters itself on
+ * the child's real `close`/`error`, so the set only ever holds live processes.
+ */
+export declare function trackChild(proc: ChildProcess): void;
+/** Test seam: how many children are currently registered. */
+export declare function _liveChildCountForTest(): number;
+/** Test seam: run the sweep as the exit hook would. */
+export declare function _sweepForTest(): void;
+//# sourceMappingURL=childRegistry.d.ts.map

package/dist/extension/pipeline/childRegistry.js

@@ -0,0 +1,118 @@
+/**
+ * Live child-process registry + exit sweep (the "no orphaned workers" invariant).
+ *
+ * /go stage children and verify children are spawned with raw `node:child_process`
+ * and piped stdio, so nothing in pi tracks them: pi's own shutdown paths
+ * (`/exit`, double Ctrl+C, SIGTERM/SIGHUP) call `process.exit(0)` and would
+ * orphan them into the background, still editing the repo and burning tokens
+ * until their wall-clock timeout fires.
+ *
+ * Every long-lived child is registered here instead. A single `process.on("exit")`
+ * hook (installed lazily on first track) kills whatever is still alive —
+ * `"exit"` handlers must be synchronous, and the whole sweep (including the
+ * `ps`-based descendant walk) is, so this holds on every exit path short of the
+ * pi process itself being SIGKILLed.
+ *
+ * Kills are TREE kills: a verify child like `pnpm test` fans out its own
+ * grandchildren, and killing only the direct pid would orphan those instead.
+ */
+import { spawnSync } from "node:child_process";
+const live = new Set();
+let sweepInstalled = false;
+/**
+ * PURE: given `ps -A -o pid=,ppid=` output lines, collect every descendant of
+ * the given roots (children, grandchildren, ...), breadth-first.
+ */
+export function descendantsOf(roots, psLines) {
+    const childrenByParent = new Map();
+    for (const line of psLines) {
+        const m = line.trim().match(/^(\d+)\s+(\d+)$/);
+        if (!m)
+            continue;
+        const pid = Number(m[1]);
+        const ppid = Number(m[2]);
+        const list = childrenByParent.get(ppid) ?? [];
+        list.push(pid);
+        childrenByParent.set(ppid, list);
+    }
+    const found = [];
+    const queue = [...roots];
+    while (queue.length > 0) {
+        const next = queue.shift();
+        for (const child of childrenByParent.get(next) ?? []) {
+            found.push(child);
+            queue.push(child);
+        }
+    }
+    return found;
+}
+/**
+ * Synchronously SIGKILL a process AND its descendants. POSIX walks a `ps`
+ * snapshot (the tree-kill pattern); Windows has real tree kill via
+ * `taskkill /T /F`. Throw-proof and synchronous, so it is exit-hook safe.
+ * Fail-soft: with no readable snapshot the direct pid is still killed.
+ */
+export function killTreeSync(pid) {
+    if (process.platform === "win32") {
+        try {
+            spawnSync("taskkill", ["/pid", String(pid), "/T", "/F"], { stdio: "ignore" });
+        }
+        catch {
+            /* best effort */
+        }
+        return;
+    }
+    let descendants = [];
+    try {
+        const ps = spawnSync("ps", ["-A", "-o", "pid=,ppid="], { encoding: "utf8" });
+        if (ps.status === 0 && typeof ps.stdout === "string") {
+            descendants = descendantsOf([pid], ps.stdout.split("\n"));
+        }
+    }
+    catch {
+        /* no snapshot: fall through to the direct kill */
+    }
+    // Root first so it cannot spawn replacements for the descendants we listed.
+    for (const target of [pid, ...descendants]) {
+        try {
+            process.kill(target, "SIGKILL");
+        }
+        catch {
+            /* already dead */
+        }
+    }
+}
+/** Kill every still-registered child's tree. Synchronous and throw-proof (exit-hook safe). */
+function sweep() {
+    for (const proc of live) {
+        // pid guard: a child whose spawn FAILED has no pid; kill() would resolve
+        // that to pid 0 (the whole process group) and take the parent down too.
+        if (!proc.pid)
+            continue;
+        killTreeSync(proc.pid);
+    }
+    live.clear();
+}
+/**
+ * Register a spawned child so the exit sweep covers it. Deregisters itself on
+ * the child's real `close`/`error`, so the set only ever holds live processes.
+ */
+export function trackChild(proc) {
+    if (!sweepInstalled) {
+        sweepInstalled = true;
+        process.on("exit", sweep);
+    }
+    live.add(proc);
+    const drop = () => live.delete(proc);
+    proc.once("close", drop);
+    proc.once("error", drop);
+}
+/** Test seam: how many children are currently registered. */
+export function _liveChildCountForTest() {
+    return live.size;
+}
+/** Test seam: run the sweep as the exit hook would. */
+export function _sweepForTest() {
+    sweep();
+}
+//# sourceMappingURL=childRegistry.js.map

package/dist/extension/pipeline/finish.js

@@ -28,6 +28,7 @@
  * does not apply.
  */
 import { execFile } from "node:child_process";
+import { trackChild } from "./childRegistry.js";
 import { scrubSecrets } from "./scrubSecrets.js";
 import { parseChangedPaths } from "./verify.js";
 /** Cap on the commit subject's title half (keeps `git log --oneline` readable). */
@@ -42,7 +43,7 @@ const NOTE_TAIL_MAX = 200;
  * a spawn-level error (ENOENT / abort), which callers catch into a note.
  */
 const defaultExec = (argv, cwd, signal) => new Promise((resolve, reject) => {
-    execFile(argv[0], argv.slice(1), { cwd, signal, maxBuffer: 32 * 1024 * 1024 }, (err, stdout, stderr) => {
+    const child = execFile(argv[0], argv.slice(1), { cwd, signal, maxBuffer: 32 * 1024 * 1024 }, (err, stdout, stderr) => {
         const output = `${stdout ?? ""}${stderr ?? ""}`;
         if (err) {
             const code = err.code;
@@ -52,6 +53,9 @@ const defaultExec = (argv, cwd, signal) => new Promise((resolve, reject) => {
         }
         resolve({ code: 0, output });
     });
+    // A push or PR create can run for a while; register it with the exit sweep
+    // so quitting pi mid-FINISH never leaves it running in the background.
+    trackChild(child);
 });
 // ---------------------------------------------------------------------------
 // Pure message derivation

package/dist/extension/pipeline/goCommand.d.ts

@@ -88,7 +88,7 @@ export interface RegisterGoDeps {
      * without a network; a non-identifier arg short-circuits to null (raw arg passes
      * through). Returns null on any miss / transport error (the honest blind fallback).
      */
-    resolveTicketBrief?: (rawArg: string) => Promise<string | null>;
+    resolveTicketBrief?: (rawArg: string, signal?: AbortSignal) => Promise<string | null>;
     /** Injectable worktree creation (default: real `git worktree add -b … HEAD`). */
     createWorktree?: typeof defaultCreateRunWorktree;
     /** Injectable worktree bootstrap (default: best-effort `<pm> install --prefer-offline`). */

package/dist/extension/pipeline/goCommand.js

@@ -75,8 +75,9 @@ import { runFinish as defaultRunFinish, verifyTrailerValue, } from "./finish.js"
 import { GO_USAGE, parseGoArgs } from "./goFlags.js";
 import { registerGoStatusCommands } from "./goStatusCommands.js";
 import { runPipeline as defaultRunPipeline } from "./orchestrator.js";
+import { composeAbortSignal } from "./resilience.js";
 import { planResume } from "./resume.js";
-import { activeRunCount, beginRun, classifyRunLiveness, findActiveRunByTicket, isRunInFlight, isTerminalStatus, lastJournalTs, loadRegistryRows, MAX_CONCURRENT_RUNS, settleRun, trackRunPromise, worktreesDir, } from "./runRegistry.js";
+import { activeRunCount, beginRun, classifyRunLiveness, findActiveRunByTicket, isRunInFlight, isTerminalStatus, lastJournalTs, loadRegistryRows, MAX_CONCURRENT_RUNS, settleRun, trackRunAbort, trackRunPromise, worktreesDir, } from "./runRegistry.js";
 import { makeRunSession as defaultMakeRunSession } from "./runSession.js";
 import { recordSessionRun } from "../sessionRuns.js";
 import { resolveTicketBrief as defaultResolveTicketBrief } from "./ticketResolution.js";
@@ -426,7 +427,11 @@ export function registerGoCommand(pi, deps = {}) {
     // back to the local client estimate).
     const fetchRunSpend = deps.fetchRunSpend;
     const resolveTicketBrief = deps.resolveTicketBrief ??
-        ((rawArg) => defaultResolveTicketBrief({ baseUrl: deps.baseUrl ?? resolveBaseUrl(), getToken: deps.getToken ?? defaultGetToken }, rawArg));
+        ((rawArg, signal) => defaultResolveTicketBrief({
+            baseUrl: deps.baseUrl ?? resolveBaseUrl(),
+            getToken: deps.getToken ?? defaultGetToken,
+            ...(signal ? { signal } : {}),
+        }, rawArg));
     const reportCrash = deps.reportCrash ??
         makeCrashReporter({
             baseUrl: deps.baseUrl ?? resolveBaseUrl(),
@@ -830,6 +835,13 @@ export function registerGoCommand(pi, deps = {}) {
                     return undefined;
                 }
             };
+            // The run's OWN abort controller. `ctx.signal` is undefined here (/go only
+            // starts while the agent is idle, and pi's signal is the active turn's), so
+            // without this the pipeline runs unstoppable until its wall-clock timeout.
+            // /stop fires it via the registry (trackRunAbort below); composed with
+            // ctx.signal for the resumed-command case where one does exist.
+            const runAbort = new AbortController();
+            const runSignal = composeAbortSignal(ctx.signal, runAbort.signal);
             const runToCompletion = async () => {
                 try {
                     // Steady animation ticker: keeps the spinner + elapsed clock live between
@@ -843,7 +855,9 @@ export function registerGoCommand(pi, deps = {}) {
                     // the agents plan on the actual ticket, not the bare "YAG-234". Fail-soft:
                     // null keeps the raw arg (the honest blind fallback). The raw `ticket` stays
                     // the session key, the run row's arg, and the handoff/re-run copy.
-                    const ticketBrief = await resolveTicketBrief(ticket);
+                    // Signalled so /stop lands immediately instead of waiting out the
+                    // resolver's retry/timeout budget (up to ~90s of network patience).
+                    const ticketBrief = await resolveTicketBrief(ticket, runSignal);
                     // The plan stage's output, captured off the onStage boundary for the
                     // FINISH commit message's 2-3 sentence summary (absent on a resume).
                     let planText;
@@ -861,9 +875,9 @@ export function registerGoCommand(pi, deps = {}) {
                     catch {
                         /* fail-soft: leave baseline empty */
                     }
-                    const result = await runPipeline(ticket, {
+                    let result = await runPipeline(ticket, {
                         cwd: runCwd,
-                        signal: ctx.signal,
+                        signal: runSignal,
                         ...(ticketBrief ? { ticketBrief } : {}),
                         onProgress: (p) => {
                             feed?.applyProgress(p);
@@ -909,6 +923,12 @@ export function registerGoCommand(pi, deps = {}) {
                         checkpointMeta,
                         ...(resumeFrom ? { resumeFrom } : {}),
                     });
+                    // /stop can land in the race between the pipeline's last abort check
+                    // and its clean return: honor it BEFORE FINISH, so a stopped run never
+                    // starts committing and the promised WIP-preserve path runs instead.
+                    if (result.stopReason === "clean" && runSignal.aborted) {
+                        result = { ...result, stopReason: "aborted" };
+                    }
                     // FINISH stage (spec §3c): ONLY on a clean stop. Commit the run's work
                     // (worktree always; --here only over a clean pre-run baseline) with the
                     // provenance trailer, and push + PR when --pr asked for it. Iron
@@ -939,7 +959,7 @@ export function registerGoCommand(pi, deps = {}) {
                                 openPr: parsed.flags.pr,
                                 remainingFindings: result.findings.filter((f) => f.severity === "medium" || f.severity === "low"),
                                 ...(finishBaselinePaths.length > 0 ? { baselinePaths: finishBaselinePaths } : {}),
-                                ...(ctx.signal ? { signal: ctx.signal } : {}),
+                                signal: runSignal,
                             });
                         }
                         catch (err) {
@@ -972,6 +992,14 @@ export function registerGoCommand(pi, deps = {}) {
                         }
                     }
                     clearUI();
+                    // /stop DURING FINISH: the abort degrades FINISH mid-way (its execs
+                    // share runSignal). If no commit landed, the aborted status + WIP
+                    // preservation the user was promised win over "clean"; a commit that
+                    // DID land means the work is durable and the clean report stays honest.
+                    if (result.stopReason === "clean" && runSignal.aborted && !finish?.commitSha) {
+                        result = { ...result, stopReason: "aborted" };
+                        finish = undefined;
+                    }
                     // Fold what FINISH landed onto a NEW result (never mutate the pipeline's
                     // return). `finish` is present ONLY when a commit really happened (§0.1).
                     const finishBranch = finish?.branch ?? repoCtx.branch;
@@ -1049,6 +1077,7 @@ export function registerGoCommand(pi, deps = {}) {
                 }
             };
             beginRun(registryRow);
+            trackRunAbort(runId, runAbort);
             if (parsed.flags.fg) {
                 // --fg: the legacy blocking behavior — the prompt returns when the run does.
                 await runToCompletion();

package/dist/extension/pipeline/goStatusCommands.d.ts

@@ -44,7 +44,17 @@ export interface RegisterGoStatusDeps {
     resolveRepo?: (cwd: string, signal?: AbortSignal) => Promise<string | undefined>;
     exists?: (path: string) => boolean;
     now?: () => number;
+    /** Injectable cancel seams for /stop (default: the module-scoped registry). */
+    activeRows?: () => RunRegistryRow[];
+    cancelOne?: (runId: string) => RunRegistryRow | undefined;
+    cancelAll?: () => RunRegistryRow[];
 }
+/**
+ * PURE: resolve a /stop argument against the in-flight rows. Matches the ticket
+ * (case-insensitive exact) first, then a runId prefix of at least 4 chars (the
+ * short id /go-status prints is 8).
+ */
+export declare function matchStopTarget(rows: RunRegistryRow[], arg: string): RunRegistryRow | undefined;
 /**
  * PURE: where an in-flight/interrupted run got to, read off its checkpoint
  * journal. The journal is append-only, so the latest applicable boundary wins.

package/dist/extension/pipeline/goStatusCommands.js

@@ -22,9 +22,25 @@
  */
 import { existsSync } from "node:fs";
 import { makeFileCheckpointStore } from "./checkpoint.js";
-import { classifyRunLiveness, isRunInFlight, isTerminalStatus, lastJournalTs, loadRegistryRows, settleRun, } from "./runRegistry.js";
+import { activeRunRows, cancelActiveRuns, cancelRun, classifyRunLiveness, isRunInFlight, isTerminalStatus, lastJournalTs, loadRegistryRows, settleRun, } from "./runRegistry.js";
 import { removeWorktree as defaultRemoveWorktree } from "./worktree.js";
 import { snapshotWorkspace as defaultSnapshotWorkspace } from "./workspace.js";
+/**
+ * PURE: resolve a /stop argument against the in-flight rows. Matches the ticket
+ * (case-insensitive exact) first, then a runId prefix of at least 4 chars (the
+ * short id /go-status prints is 8).
+ */
+export function matchStopTarget(rows, arg) {
+    const needle = arg.trim().toLowerCase();
+    if (!needle)
+        return undefined;
+    const byTicket = rows.find((r) => r.ticket.toLowerCase() === needle);
+    if (byTicket)
+        return byTicket;
+    if (needle.length < 4)
+        return undefined;
+    return rows.find((r) => r.runId.toLowerCase().startsWith(needle));
+}
 /**
  * PURE: where an in-flight/interrupted run got to, read off its checkpoint
  * journal. The journal is append-only, so the latest applicable boundary wins.
@@ -90,6 +106,50 @@ export function registerGoStatusCommands(pi, deps = {}) {
     const resolveRepo = deps.resolveRepo ?? (async () => undefined);
     const exists = deps.exists ?? existsSync;
     const now = deps.now ?? Date.now;
+    const activeRows = deps.activeRows ?? activeRunRows;
+    const cancelOne = deps.cancelOne ?? cancelRun;
+    const cancelAll = deps.cancelAll ?? cancelActiveRuns;
+    pi.registerCommand("stop", {
+        description: "Hard-stop /go runs in this session: /stop cancels them all, /stop <ticket|run id> cancels one. Work so far is preserved as a WIP commit.",
+        handler: async (args, ctx) => {
+            const say = async (message, type = "info") => {
+                if (ctx.hasUI)
+                    ctx.ui.notify(message, type);
+                else
+                    await pi.sendUserMessage(message);
+            };
+            const label = (row) => `[${row.runId.slice(0, 8)}] ${row.ticket}`;
+            const rows = activeRows();
+            if (rows.length === 0) {
+                await say("No /go runs are in flight in this session. (Esc interrupts the interactive agent; /go-status lists runs from other sessions.)");
+                return;
+            }
+            const arg = args.trim();
+            if (arg) {
+                const target = matchStopTarget(rows, arg);
+                if (!target) {
+                    await say(`No in-flight run matches "${arg}". Running here: ${rows.map(label).join(", ")}.`, "warning");
+                    return;
+                }
+                if (!cancelOne(target.runId)) {
+                    await say(`${label(target)} is still starting and cannot be signalled yet; try /stop again.`, "warning");
+                    return;
+                }
+                await say(`Stopping ${label(target)}. Its workers are being killed; any work lands as a WIP commit and the handoff will report the aborted run.`);
+                return;
+            }
+            const cancelled = cancelAll();
+            if (cancelled.length === 0) {
+                // The window between beginRun and trackRunAbort is one tick wide, but be
+                // honest if we hit it rather than claiming a stop that did not fire.
+                await say("Could not signal any run yet (they are still starting); try /stop again.", "warning");
+                return;
+            }
+            await say(`Stopping ${cancelled.length} /go run${cancelled.length === 1 ? "" : "s"}: ${cancelled
+                .map(label)
+                .join(", ")}. Workers are being killed; work so far lands as WIP commits (see /go-status).`);
+        },
+    });
     pi.registerCommand("go-status", {
         description: "List /go runs: active (stage/round), finished (outcome + branch/commit/PR), and interrupted (resumable).",
         handler: async (_args, ctx) => {

package/dist/extension/pipeline/runRegistry.d.ts

@@ -85,6 +85,20 @@ export declare function _resetRunRegistryForTest(): void;
 export declare function beginRun(row: RunRegistryRow): void;
 /** Attach the detached completion promise to an in-flight run (fail-soft no-op when absent). */
 export declare function trackRunPromise(runId: string, promise: Promise<void>): void;
+/** Attach the run's abort controller so /stop can cancel it (fail-soft no-op when absent). */
+export declare function trackRunAbort(runId: string, abort: AbortController): void;
+/**
+ * Cancel one in-flight run in THIS process: fire its abort controller and return
+ * its row. The run itself settles through the normal pipeline path (the abort
+ * propagates to every stage child as SIGTERM→SIGKILL, the orchestrator stops with
+ * an honest `aborted`, and runToCompletion preserves WIP + settles the registry).
+ * Returns undefined for an unknown/foreign runId or a run with no controller yet.
+ */
+export declare function cancelRun(runId: string): RunRegistryRow | undefined;
+/** Cancel EVERY in-flight run in this process (the /stop no-arg path). Returns the rows fired. */
+export declare function cancelActiveRuns(): RunRegistryRow[];
+/** The in-flight rows in THIS process (newest first), for /stop's matching + messaging. */
+export declare function activeRunRows(): RunRegistryRow[];
 /**
  * Settle an in-flight run: merge the terminal patch, drop it from the in-memory
  * active set, and mirror the final row. Safe to call for an unknown runId: the

package/dist/extension/pipeline/runRegistry.js

@@ -137,6 +137,41 @@ export function trackRunPromise(runId, promise) {
     if (entry)
         entry.promise = promise;
 }
+/** Attach the run's abort controller so /stop can cancel it (fail-soft no-op when absent). */
+export function trackRunAbort(runId, abort) {
+    const entry = active.get(runId);
+    if (entry)
+        entry.abort = abort;
+}
+/**
+ * Cancel one in-flight run in THIS process: fire its abort controller and return
+ * its row. The run itself settles through the normal pipeline path (the abort
+ * propagates to every stage child as SIGTERM→SIGKILL, the orchestrator stops with
+ * an honest `aborted`, and runToCompletion preserves WIP + settles the registry).
+ * Returns undefined for an unknown/foreign runId or a run with no controller yet.
+ */
+export function cancelRun(runId) {
+    const entry = active.get(runId);
+    if (!entry?.abort)
+        return undefined;
+    entry.abort.abort();
+    return entry.row;
+}
+/** Cancel EVERY in-flight run in this process (the /stop no-arg path). Returns the rows fired. */
+export function cancelActiveRuns() {
+    const cancelled = [];
+    for (const entry of active.values()) {
+        if (!entry.abort)
+            continue;
+        entry.abort.abort();
+        cancelled.push(entry.row);
+    }
+    return cancelled;
+}
+/** The in-flight rows in THIS process (newest first), for /stop's matching + messaging. */
+export function activeRunRows() {
+    return [...active.values()].map((e) => e.row).sort((a, b) => b.startedAt - a.startedAt);
+}
 /**
  * Settle an in-flight run: merge the terminal patch, drop it from the in-memory
  * active set, and mirror the final row. Safe to call for an unknown runId: the

package/dist/extension/pipeline/runner.js

@@ -23,6 +23,7 @@ import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
 import { fileURLToPath } from "node:url";
+import { trackChild } from "./childRegistry.js";
 import { finalOutputFrom, foldEvent, newEventAccumulator } from "./events.js";
 import { buildStageInvocation, groundedChildArgv } from "./invocation.js";
 import { personaBody } from "./personas.js";
@@ -151,6 +152,9 @@ export async function runStage(stage, ctx, deps) {
                 shell: false,
                 stdio: ["ignore", "pipe", "pipe"],
             });
+            // Register with the exit sweep so quitting pi (/exit, double Ctrl+C,
+            // SIGTERM) can never orphan a stage child into the background.
+            trackChild(proc);
             let buffer = "";
             // `overlong` = we are mid-way through a line that already blew the cap; we
             // discard incoming bytes until its terminating newline, then drop the line.

package/dist/extension/pipeline/verify.d.ts

@@ -239,6 +239,10 @@ export declare function buildVerifyEnv(source?: NodeJS.ProcessEnv): NodeJS.Proce
  * once instead of parking in watch mode until the 10-min cap kills it.
  */
 export declare function buildTestEnv(source?: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
+export declare function makeDefaultExec(opts?: {
+    graceMs?: number;
+    killTree?: (pid: number) => void;
+}): VerifyExec;
 export interface MakeRunVerifyOpts {
     detect?: (cwd: string, changedDirs: string[]) => VerifyCommand[];
     /**

package/dist/extension/pipeline/verify.js

@@ -52,6 +52,7 @@ import { readFileSync } from "node:fs";
 // backslashed strings that no longer compare equal to the git-derived repoRoot
 // and would break the walk-up termination check.
 import { basename, dirname, join } from "node:path/posix";
+import { killTreeSync, trackChild } from "./childRegistry.js";
 import { composeAbortSignal } from "./resilience.js";
 import { scrubSecrets } from "./scrubSecrets.js";
 import { snapshotWorkspace } from "./workspace.js";
@@ -595,33 +596,54 @@ export function buildTestEnv(source = process.env) {
 // — signalling the WHOLE process group and killing the parent. Abort is wired
 // manually with an explicit pid guard; a killed child reaches the callback with
 // a code-less error, which stays the same fail-open rejection as before.
-const defaultExec = (argv, cwd, signal, env) => new Promise((resolve, reject) => {
-    if (signal.aborted)
-        return reject(new Error("verify aborted before start"));
-    const child = execFile(argv[0], argv.slice(1), { cwd, env: env ?? buildVerifyEnv(), maxBuffer: 32 * 1024 * 1024 }, (err, stdout, stderr) => {
-        signal.removeEventListener("abort", onAbort);
-        const output = `${stdout ?? ""}${stderr ?? ""}`;
-        if (err) {
-            // A non-zero EXIT is a verify failure (carries a numeric code); a spawn
-            // error (ENOENT) or an abort has no numeric code and is a fail-open.
-            const code = err.code;
-            if (typeof code === "number")
-                return resolve({ code, output });
-            return reject(err);
-        }
-        resolve({ code: 0, output });
+//
+// Abort escalates: SIGTERM first (a test runner gets its grace to flush), then
+// after `graceMs` a TREE SIGKILL — a stubborn runner (or a descendant it
+// spawned that holds the stdio pipes open) would otherwise leave the promise
+// pending forever, hanging /stop and the run with it.
+export function makeDefaultExec(opts = {}) {
+    const graceMs = opts.graceMs ?? 5000;
+    const killTree = opts.killTree ?? killTreeSync;
+    return (argv, cwd, signal, env) => new Promise((resolve, reject) => {
+        if (signal.aborted)
+            return reject(new Error("verify aborted before start"));
+        let settled = false;
+        let killTimer;
+        const child = execFile(argv[0], argv.slice(1), { cwd, env: env ?? buildVerifyEnv(), maxBuffer: 32 * 1024 * 1024 }, (err, stdout, stderr) => {
+            settled = true;
+            if (killTimer)
+                clearTimeout(killTimer);
+            signal.removeEventListener("abort", onAbort);
+            const output = `${stdout ?? ""}${stderr ?? ""}`;
+            if (err) {
+                // A non-zero EXIT is a verify failure (carries a numeric code); a spawn
+                // error (ENOENT) or an abort has no numeric code and is a fail-open.
+                const code = err.code;
+                if (typeof code === "number")
+                    return resolve({ code, output });
+                return reject(err);
+            }
+            resolve({ code: 0, output });
+        });
+        trackChild(child);
+        const onAbort = () => {
+            try {
+                if (child.pid)
+                    child.kill("SIGTERM");
+            }
+            catch {
+                /* ignore */
+            }
+            killTimer = setTimeout(() => {
+                if (!settled && child.pid)
+                    killTree(child.pid);
+            }, graceMs);
+            killTimer.unref?.();
+        };
+        signal.addEventListener("abort", onAbort, { once: true });
     });
-    const onAbort = () => {
-        try {
-            if (child.pid)
-                child.kill("SIGTERM");
-        }
-        catch {
-            /* ignore */
-        }
-    };
-    signal.addEventListener("abort", onAbort, { once: true });
-});
+}
+const defaultExec = makeDefaultExec();
 /**
  * Build the runVerify function injected into the orchestrator. It discovers the
  * changed package(s) (scoped to this run's diff via `baselinePaths`), detects a

package/dist/signalForward.d.ts

@@ -0,0 +1,60 @@
+/**
+ * Termination-signal forwarding: launcher → pi child.
+ *
+ * In the interactive TUI the tty is in raw mode, so Ctrl+C never raises
+ * SIGINT; this path covers `yagni -p`/piped/CI runs and an external
+ * `kill <launcher pid>`. Policy:
+ *
+ *  - The FIRST signal asks pi to shut down cleanly. SIGINT is translated to
+ *    SIGTERM because pi installs a graceful handler for SIGTERM (it kills its
+ *    tracked children) but none for SIGINT — a raw SIGINT would drop pi on the
+ *    default disposition with no cleanup.
+ *  - Any SECOND signal hard-kills pi's whole process TREE. A bare SIGKILL to
+ *    pi's pid would bypass its exit sweep (SIGKILL runs no handlers) and leave
+ *    /go workers alive, so the launcher enumerates and kills the descendants
+ *    itself: `ps` walk on POSIX, `taskkill /T /F` on Windows.
+ */
+/** The minimal child surface the forwarder needs (ChildProcess satisfies it). */
+export interface KillableChild {
+    pid?: number | undefined;
+    kill(signal: NodeJS.Signals): boolean;
+}
+/** The launcher-terminating signals that are forwarded rather than obeyed. */
+export declare const FORWARDED_SIGNALS: readonly NodeJS.Signals[];
+/**
+ * PURE policy for the FIRST signal: which signal the child receives when the
+ * launcher gets `received` (SIGINT is translated, the rest pass through).
+ * Escalation is not expressed here — a second signal goes through the tree
+ * kill, not a forwarded signal.
+ */
+export declare function forwardedSignal(received: NodeJS.Signals): NodeJS.Signals;
+/**
+ * PURE: the launcher's own exit code for the child's (code, signal) exit tuple.
+ * A signal-terminated child maps to the conventional 128+n (bash parity:
+ * SIGTERM→143, SIGKILL→137, SIGINT→130), so a cancelled run never reads as
+ * success to scripts or CI.
+ */
+export declare function exitCodeFor(code: number | null, signal: NodeJS.Signals | null): number;
+/**
+ * PURE: given `ps -A -o pid=,ppid=` output lines, collect every descendant of
+ * the given roots (children, grandchildren, ...), breadth-first. Mirrored in
+ * pi-extension-yagni's childRegistry (the packages are intentionally
+ * independent); keep the two in sync.
+ */
+export declare function descendantsOf(roots: number[], psLines: string[]): number[];
+/**
+ * Synchronously SIGKILL a process AND its descendants (POSIX `ps` walk /
+ * Windows `taskkill /T /F`). Throw-proof; fail-soft to a direct kill when no
+ * process snapshot is readable.
+ */
+export declare function killTreeSync(pid: number): void;
+/**
+ * Subscribe the forwarding policy for every signal in {@link FORWARDED_SIGNALS}.
+ * `subscribe` and `killTree` default to the real process surfaces and are
+ * injectable so tests never install real handlers, raise real signals, or kill
+ * real processes. Returns the forward function itself (also for tests).
+ * pid guard: a child whose spawn failed has no pid, and `kill()` would resolve
+ * that to the whole process group.
+ */
+export declare function installSignalForwarding(child: KillableChild, subscribe?: (sig: NodeJS.Signals, handler: () => void) => void, killTree?: (pid: number) => void): (sig: NodeJS.Signals) => void;
+//# sourceMappingURL=signalForward.d.ts.map

package/dist/signalForward.js

@@ -0,0 +1,130 @@
+/**
+ * Termination-signal forwarding: launcher → pi child.
+ *
+ * In the interactive TUI the tty is in raw mode, so Ctrl+C never raises
+ * SIGINT; this path covers `yagni -p`/piped/CI runs and an external
+ * `kill <launcher pid>`. Policy:
+ *
+ *  - The FIRST signal asks pi to shut down cleanly. SIGINT is translated to
+ *    SIGTERM because pi installs a graceful handler for SIGTERM (it kills its
+ *    tracked children) but none for SIGINT — a raw SIGINT would drop pi on the
+ *    default disposition with no cleanup.
+ *  - Any SECOND signal hard-kills pi's whole process TREE. A bare SIGKILL to
+ *    pi's pid would bypass its exit sweep (SIGKILL runs no handlers) and leave
+ *    /go workers alive, so the launcher enumerates and kills the descendants
+ *    itself: `ps` walk on POSIX, `taskkill /T /F` on Windows.
+ */
+import { spawnSync } from "node:child_process";
+import { constants as osConstants } from "node:os";
+/** The launcher-terminating signals that are forwarded rather than obeyed. */
+export const FORWARDED_SIGNALS = ["SIGINT", "SIGTERM", "SIGHUP"];
+/**
+ * PURE policy for the FIRST signal: which signal the child receives when the
+ * launcher gets `received` (SIGINT is translated, the rest pass through).
+ * Escalation is not expressed here — a second signal goes through the tree
+ * kill, not a forwarded signal.
+ */
+export function forwardedSignal(received) {
+    return received === "SIGINT" ? "SIGTERM" : received;
+}
+/**
+ * PURE: the launcher's own exit code for the child's (code, signal) exit tuple.
+ * A signal-terminated child maps to the conventional 128+n (bash parity:
+ * SIGTERM→143, SIGKILL→137, SIGINT→130), so a cancelled run never reads as
+ * success to scripts or CI.
+ */
+export function exitCodeFor(code, signal) {
+    if (code != null)
+        return code;
+    if (signal)
+        return 128 + (osConstants.signals[signal] ?? 15);
+    return 0;
+}
+/**
+ * PURE: given `ps -A -o pid=,ppid=` output lines, collect every descendant of
+ * the given roots (children, grandchildren, ...), breadth-first. Mirrored in
+ * pi-extension-yagni's childRegistry (the packages are intentionally
+ * independent); keep the two in sync.
+ */
+export function descendantsOf(roots, psLines) {
+    const childrenByParent = new Map();
+    for (const line of psLines) {
+        const m = line.trim().match(/^(\d+)\s+(\d+)$/);
+        if (!m)
+            continue;
+        const pid = Number(m[1]);
+        const ppid = Number(m[2]);
+        const list = childrenByParent.get(ppid) ?? [];
+        list.push(pid);
+        childrenByParent.set(ppid, list);
+    }
+    const found = [];
+    const queue = [...roots];
+    while (queue.length > 0) {
+        const next = queue.shift();
+        for (const child of childrenByParent.get(next) ?? []) {
+            found.push(child);
+            queue.push(child);
+        }
+    }
+    return found;
+}
+/**
+ * Synchronously SIGKILL a process AND its descendants (POSIX `ps` walk /
+ * Windows `taskkill /T /F`). Throw-proof; fail-soft to a direct kill when no
+ * process snapshot is readable.
+ */
+export function killTreeSync(pid) {
+    if (process.platform === "win32") {
+        try {
+            spawnSync("taskkill", ["/pid", String(pid), "/T", "/F"], { stdio: "ignore" });
+        }
+        catch {
+            /* best effort */
+        }
+        return;
+    }
+    let descendants = [];
+    try {
+        const ps = spawnSync("ps", ["-A", "-o", "pid=,ppid="], { encoding: "utf8" });
+        if (ps.status === 0 && typeof ps.stdout === "string") {
+            descendants = descendantsOf([pid], ps.stdout.split("\n"));
+        }
+    }
+    catch {
+        /* no snapshot: fall through to the direct kill */
+    }
+    for (const target of [pid, ...descendants]) {
+        try {
+            process.kill(target, "SIGKILL");
+        }
+        catch {
+            /* already dead */
+        }
+    }
+}
+/**
+ * Subscribe the forwarding policy for every signal in {@link FORWARDED_SIGNALS}.
+ * `subscribe` and `killTree` default to the real process surfaces and are
+ * injectable so tests never install real handlers, raise real signals, or kill
+ * real processes. Returns the forward function itself (also for tests).
+ * pid guard: a child whose spawn failed has no pid, and `kill()` would resolve
+ * that to the whole process group.
+ */
+export function installSignalForwarding(child, subscribe = (sig, handler) => process.on(sig, handler), killTree = killTreeSync) {
+    let received = 0;
+    const forward = (sig) => {
+        const prior = received;
+        received += 1;
+        if (!child.pid)
+            return;
+        if (prior > 0)
+            killTree(child.pid);
+        else
+            child.kill(forwardedSignal(sig));
+    };
+    for (const sig of FORWARDED_SIGNALS)
+        subscribe(sig, () => forward(sig));
+    return forward;
+}
+//# sourceMappingURL=signalForward.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yagni-app/code-staging",
-  "version": "0.3.0-staging.1081.1",
+  "version": "0.3.0-staging.1082.1",
   "description": "YAGNI Code: a terminal coding agent that already knows your company. One YAGNI login routes the model and grounds the agent in your team's context.",
   "license": "SEE LICENSE IN LICENSE.md",
   "author": "YAGNI, Inc. <jack@yagni.app> (https://yagni.app)",
@@ -38,5 +38,5 @@
     "@earendil-works/pi-tui": "0.84.1",
     "typebox": "^1.3.11"
   },
-  "yagniSourceSha": "dd068fdb7b8bcb1207ff4f2fe803bf26b2e3eec3"
+  "yagniSourceSha": "a1967e7624f741b033c68d83acd29b3a47262b7c"
 }