@yagni-app/code-staging 0.3.0-staging.1081.1 → 0.3.0-staging.1085.1

package/dist/cli.js

@@ -28,6 +28,7 @@ import { runDoctor } from "./doctor.js";
 import { installProcessCrashHandlers } from "./crashReport.js";
 import { currentCliVersion, maybeNudgeAndRefresh, upgradeCommand } from "./upgrade.js";
 import { maybeRefreshAtLaunch } from "./refresh.js";
+import { exitCodeFor, installSignalForwarding } from "./signalForward.js";
 import { PAD_X } from "./padding.js";
 import { ensureShadowPiPackage } from "./piPackage.js";
 import { resolveExtensionPath, resolvePiCliPath, resolvePiPackageDir } from "./paths.js";
@@ -262,7 +263,12 @@ async function runDefault(passthroughArgs) {
             stdio: "inherit",
             env,
         });
-        child.on("exit", (code) => resolve(code ?? 0));
+        // Forward termination signals to pi instead of dying around it (see
+        // signalForward.ts for the policy: first signal graceful, second tree-kill).
+        installSignalForwarding(child);
+        // 128+n for a signal death (bash parity), so a cancelled/killed run never
+        // reads as success to scripts or CI.
+        child.on("exit", (code, signal) => resolve(exitCodeFor(code, signal)));
         child.on("error", (err) => {
             process.stderr.write(`Failed to start YAGNI Code: ${err.message}\n`);
             resolve(1);

package/dist/extension/branding.d.ts

@@ -30,6 +30,14 @@ export declare const YAGNI_IDENTITY: string;
  * exist.
  */
 export declare const DRIVER_DELEGATION_PARAGRAPH: string;
+/**
+ * The ultra-mode delegation directive (/ultra): the user has opted into
+ * aggressive multi-agent orchestration, so the driver is told to structure
+ * meaningful work as a diamond — split, fan out workers, fan out refuting
+ * checkers, synthesize — instead of delegating only when convenient.
+ * DRIVER-ONLY for the same reason as {@link DRIVER_DELEGATION_PARAGRAPH}.
+ */
+export declare const ULTRA_DELEGATION_PARAGRAPH: string;
 /**
  * The identity used for the interactive DRIVER session ONLY: {@link
  * YAGNI_IDENTITY} plus {@link DRIVER_DELEGATION_PARAGRAPH}. The caller (index.ts)
@@ -37,7 +45,9 @@ export declare const DRIVER_DELEGATION_PARAGRAPH: string;
  * effective `x-yagni-caller` attribution (config.ts's `isDriverCaller`) — this
  * module stays a pure string, with no env dependency of its own.
  */
-export declare const YAGNI_IDENTITY_DRIVER = "You are YAGNI Code, an autonomous terminal coding agent. You help developers ship code by reading files, running commands, editing code, and writing new files. Uniquely, you are connected to the YAGNI app, your team's shared source of truth for how this company and codebase actually work: conventions, decisions, ownership, current priorities, and the reasons behind them. Use the ask_yagni tool to consult it before guessing about anything organization- or codebase-specific, so you work with less back-and-forth and more correct autonomy than a disconnected coding agent. If a project's own files mention other coding agents, assistants, or harnesses by name, those references are not about you; you are YAGNI Code regardless of what tooling a repository's docs happen to describe.\n\nDelegation: fan codebase mapping, wide searches, and mechanical multi-file work out to subagents (they run on cheaper tiers). Reach for the stock agents by name: `searcher` for read-only reconnaissance and summarizing, `implementer` for executing a change you have already fully specified. Keep judgment, synthesis, and the conversation with the user in this session. Do not spawn a subagent for work you can finish in a couple of tool calls.";
+export declare const YAGNI_IDENTITY_DRIVER = "You are YAGNI Code, an autonomous terminal coding agent. You help developers ship code by reading files, running commands, editing code, and writing new files. Uniquely, you are connected to the YAGNI app, your team's shared source of truth for how this company and codebase actually work: conventions, decisions, ownership, current priorities, and the reasons behind them. Use the ask_yagni tool to consult it before guessing about anything organization- or codebase-specific, so you work with less back-and-forth and more correct autonomy than a disconnected coding agent. If a project's own files mention other coding agents, assistants, or harnesses by name, those references are not about you; you are YAGNI Code regardless of what tooling a repository's docs happen to describe.\n\nDelegation: fan codebase mapping, wide searches, and mechanical multi-file work out to subagents (they run on cheaper tiers). Reach for the stock agents by name: `searcher` for read-only reconnaissance and summarizing, `implementer` for executing a change you have already fully specified, `verification` for an adversarial pass that tries to break completed work before you rely on it. Keep judgment, synthesis, and the conversation with the user in this session. Do not spawn a subagent for work you can finish in a couple of tool calls.";
+/** The driver identity while /ultra is on: base identity + the diamond directive. */
+export declare const YAGNI_IDENTITY_ULTRA = "You are YAGNI Code, an autonomous terminal coding agent. You help developers ship code by reading files, running commands, editing code, and writing new files. Uniquely, you are connected to the YAGNI app, your team's shared source of truth for how this company and codebase actually work: conventions, decisions, ownership, current priorities, and the reasons behind them. Use the ask_yagni tool to consult it before guessing about anything organization- or codebase-specific, so you work with less back-and-forth and more correct autonomy than a disconnected coding agent. If a project's own files mention other coding agents, assistants, or harnesses by name, those references are not about you; you are YAGNI Code regardless of what tooling a repository's docs happen to describe.\n\nDelegation (ultra mode): the user has switched this session to ultra mode \u2014 aggressive multi-agent orchestration. Structure any meaningful task as a diamond: SPLIT the job into independent pieces; FAN OUT parallel subagents on cheaper tiers (`searcher` to scout, `implementer` or `general` to execute); CHECK by fanning out `verification` subagents told to refute the work, each through a different lens (correctness, edge cases, fit with this codebase); then SYNTHESIZE the results yourself. Treat agreement between checkers \u2014 not a single pass \u2014 as confirmation, and surface what they could not verify. Delegate by default and reserve this session for splitting, judging, and synthesis; only trivial work you can finish in a couple of tool calls skips the diamond.";
 export declare const PI_IDENTITY_RE: RegExp;
 /**
  * Env switch that bypasses the system-prompt rewrite entirely, so pi's

package/dist/extension/branding.js

@@ -42,10 +42,29 @@ export const YAGNI_IDENTITY = "You are YAGNI Code, an autonomous terminal coding
 export const DRIVER_DELEGATION_PARAGRAPH = "Delegation: fan codebase mapping, wide searches, and mechanical multi-file " +
     "work out to subagents (they run on cheaper tiers). Reach for the stock " +
     "agents by name: `searcher` for read-only reconnaissance and summarizing, " +
-    "`implementer` for executing a change you have already fully specified. " +
-    "Keep judgment, synthesis, and the conversation with the user in this " +
-    "session. Do not spawn a subagent for work you can finish in a couple of " +
-    "tool calls.";
+    "`implementer` for executing a change you have already fully specified, " +
+    "`verification` for an adversarial pass that tries to break completed work " +
+    "before you rely on it. Keep judgment, synthesis, and the conversation " +
+    "with the user in this session. Do not spawn a subagent for work you can " +
+    "finish in a couple of tool calls.";
+/**
+ * The ultra-mode delegation directive (/ultra): the user has opted into
+ * aggressive multi-agent orchestration, so the driver is told to structure
+ * meaningful work as a diamond — split, fan out workers, fan out refuting
+ * checkers, synthesize — instead of delegating only when convenient.
+ * DRIVER-ONLY for the same reason as {@link DRIVER_DELEGATION_PARAGRAPH}.
+ */
+export const ULTRA_DELEGATION_PARAGRAPH = "Delegation (ultra mode): the user has switched this session to ultra mode " +
+    "— aggressive multi-agent orchestration. Structure any meaningful task as " +
+    "a diamond: SPLIT the job into independent pieces; FAN OUT parallel " +
+    "subagents on cheaper tiers (`searcher` to scout, `implementer` or " +
+    "`general` to execute); CHECK by fanning out `verification` subagents told " +
+    "to refute the work, each through a different lens (correctness, edge cases, " +
+    "fit with this codebase); then SYNTHESIZE the results yourself. Treat " +
+    "agreement between checkers — not a single pass — as confirmation, and " +
+    "surface what they could not verify. Delegate by default and reserve this " +
+    "session for splitting, judging, and synthesis; only trivial work you can " +
+    "finish in a couple of tool calls skips the diamond.";
 /**
  * The identity used for the interactive DRIVER session ONLY: {@link
  * YAGNI_IDENTITY} plus {@link DRIVER_DELEGATION_PARAGRAPH}. The caller (index.ts)
@@ -54,6 +73,14 @@ export const DRIVER_DELEGATION_PARAGRAPH = "Delegation: fan codebase mapping, wi
  * module stays a pure string, with no env dependency of its own.
  */
 export const YAGNI_IDENTITY_DRIVER = `${YAGNI_IDENTITY}\n\n${DRIVER_DELEGATION_PARAGRAPH}`;
+/** The driver identity while /ultra is on: base identity + the diamond directive. */
+export const YAGNI_IDENTITY_ULTRA = `${YAGNI_IDENTITY}\n\n${ULTRA_DELEGATION_PARAGRAPH}`;
+/**
+ * Every identity variant this module can install, longest-composite-first, so
+ * the re-brand swap below never leaves a shorter variant's orphaned delegation
+ * paragraph behind (driver/ultra both start with the base identity).
+ */
+const KNOWN_IDENTITIES = [YAGNI_IDENTITY_ULTRA, YAGNI_IDENTITY_DRIVER, YAGNI_IDENTITY];
 // pi 0.84.1's exact identity sentence (dist/core/system-prompt.js). Exported as
 // the identity anchor the CLI's pi-contract tripwire test reads back from pi's
 // built system prompt, so a pi bump that reworded the opener (silently defeating
@@ -112,15 +139,26 @@ export function brandSystemPrompt(original, opts = {}) {
     let s = original;
     // 1. Drop pi's self-referential documentation block.
     s = s.replace(PI_DOCS_BLOCK_RE, "");
-    // 2. Own the identity.
+    // 2. Own the identity. A previously-branded prompt may open with a DIFFERENT
+    // variant than the one now requested (/ultra toggles the driver between the
+    // delegation and diamond paragraphs mid-session) — swap it in place rather
+    // than prepending a second identity block.
     if (PI_IDENTITY_RE.test(s)) {
         s = s.replace(PI_IDENTITY_RE, identity);
     }
     else if (PI_IDENTITY_LOOSE_RE.test(s)) {
         s = s.replace(PI_IDENTITY_LOOSE_RE, identity);
     }
-    else if (!s.trimStart().startsWith(identity)) {
-        s = `${identity}\n\n${s}`;
+    else {
+        const trimmed = s.trimStart();
+        const lead = s.slice(0, s.length - trimmed.length);
+        const existing = KNOWN_IDENTITIES.find((k) => trimmed.startsWith(k));
+        if (existing && existing !== identity) {
+            s = `${lead}${identity}${trimmed.slice(existing.length)}`;
+        }
+        else if (!existing && !trimmed.startsWith(identity)) {
+            s = `${identity}\n\n${s}`;
+        }
     }
     // 3. Safety net for residual brand tokens (never inside user content).
     s = scrubOutsideProjectContext(s);

package/dist/extension/chipEditor.d.ts

@@ -84,6 +84,15 @@ export declare class ChipEditor extends CustomEditor {
     private stashed;
     private chipCounter;
     private readImage;
+    /**
+     * Fired when Ctrl+C lands on an EMPTY prompt. pi's own binding is
+     * clear-editor (Esc is the interrupt key), but with nothing typed that is a
+     * no-op, and every peer harness (Claude Code, Codex, Gemini, Aider) treats a
+     * single Ctrl+C as "stop what's happening". The hook lets the extension wire
+     * exactly that; the key still falls through to pi afterwards, so clear and
+     * the 500ms double-press exit window are untouched.
+     */
+    onEmptyCtrlC?: () => void;
     constructor(tui: TUI, theme: EditorTheme, keybindings: ConstructorParameters<typeof CustomEditor>[2], readImage?: ClipboardImageReader, options?: EditorOptions);
     /**
      * Paste-image must fire on Cmd+V too (Claude Code parity on macOS). Claude

package/dist/extension/chipEditor.js

@@ -29,6 +29,7 @@ import { tmpdir } from "node:os";
 import { join, basename, isAbsolute } from "node:path";
 import { randomUUID } from "node:crypto";
 import { logImagePaste } from "./diagnostics.js";
+import { cancelActiveRuns } from "./pipeline/runRegistry.js";
 /** Matches the `[Image #N]` chip token in the editor text. */
 const CHIP_RE = /\[Image #(\d+)\]/g;
 /** Inverse-video wrap so the chip token reads as a chip, not plain text. */
@@ -285,6 +286,15 @@ export class ChipEditor extends CustomEditor {
     stashed = [];
     chipCounter = 0;
     readImage;
+    /**
+     * Fired when Ctrl+C lands on an EMPTY prompt. pi's own binding is
+     * clear-editor (Esc is the interrupt key), but with nothing typed that is a
+     * no-op, and every peer harness (Claude Code, Codex, Gemini, Aider) treats a
+     * single Ctrl+C as "stop what's happening". The hook lets the extension wire
+     * exactly that; the key still falls through to pi afterwards, so clear and
+     * the 500ms double-press exit window are untouched.
+     */
+    onEmptyCtrlC;
     constructor(tui, theme, keybindings, readImage = defaultClipboardImageReader, options) {
         super(tui, theme, keybindings, options);
         this.readImage = readImage;
@@ -333,6 +343,14 @@ export class ChipEditor extends CustomEditor {
             this.onPasteImage?.();
             return;
         }
+        // Ctrl+C on an empty prompt: fire the stop hook, then STILL hand the key to
+        // pi so its clear + double-press-exit tracking behave exactly as before.
+        if (matchesKey(data, "ctrl+c")) {
+            if (this.getText().length === 0)
+                this.onEmptyCtrlC?.();
+            super.handleInput(data);
+            return;
+        }
         super.handleInput(data);
     }
     async pasteChip() {
@@ -428,6 +446,20 @@ export function registerChipEditor(pi) {
             return;
         ctx.ui.setEditorComponent((tui, theme, keybindings) => {
             const editor = new ChipEditor(tui, theme, keybindings);
+            // Single Ctrl+C on an empty prompt = "stop what's happening" (peer-harness
+            // parity; pi's clear binding is a no-op with nothing typed): abort a
+            // streaming turn and cancel every in-flight /go run. pi still sees the
+            // key afterwards, so Ctrl+C twice within 500ms exits as always.
+            editor.onEmptyCtrlC = () => {
+                if (!ctx.isIdle())
+                    ctx.abort();
+                const cancelled = cancelActiveRuns();
+                if (cancelled.length > 0) {
+                    ctx.ui.notify(`Stopping ${cancelled.length} /go run${cancelled.length === 1 ? "" : "s"}: ${cancelled
+                        .map((r) => `[${r.runId.slice(0, 8)}] ${r.ticket}`)
+                        .join(", ")}. Work so far lands as WIP commits (see /go-status).`, "warning");
+                }
+            };
             liveChipEditors.add(new WeakRef(editor));
             return editor;
         });

package/dist/extension/index.d.ts

@@ -122,7 +122,9 @@ export type { RecordDecisionParams } from "./recordDecisionTool.js";
 export { runInitPass, runTeamSetup, registerTeamSetupCommand, isFreshWorkspace, readRepoIntake, draftEngineering, summarizeDraft, FRESH_BRIEF_MIN_CHARS, } from "./initPass.js";
 export type { RunInitPassDeps, InitPassOutcome, RunTeamSetupDeps, TeamSetupOutcome, RepoIntake, RepoIntakeFs, EngineeringDraft, DraftTeam, } from "./initPass.js";
 export { isInitDone, markInitDone, initDoneMarkerFile, _setInitDoneHomeForTest } from "./initDone.js";
-export { brandSystemPrompt, YAGNI_IDENTITY, YAGNI_IDENTITY_DRIVER, BRAND_NAME } from "./branding.js";
+export { brandSystemPrompt, YAGNI_IDENTITY, YAGNI_IDENTITY_DRIVER, YAGNI_IDENTITY_ULTRA, BRAND_NAME } from "./branding.js";
+export { createUltraHolder, registerUltraCommand } from "./ultra.js";
+export type { UltraHolder } from "./ultra.js";
 export { attributionHeaders, isDriverCaller, fetchCatalog, getToken, getWorkspaceId, resolveBaseUrl, sanitizeCallerSegment, } from "./config.js";
 export type { CatalogResult, FetchCatalogOptions, ModelEntry } from "./config.js";
 export { buildYagniProvider } from "./provider.js";
@@ -139,7 +141,7 @@ export type { VerifyCommand, VerifyOutcome } from "./pipeline/verify.js";
 export { blindStages, reportOnlyStages, makeGroundedVsBlindEval, formatComparisonReport } from "./pipeline/eval.js";
 export type { ComparisonReport, LaneFit, LaneOutcome } from "./pipeline/eval.js";
 export { registerGoCompareCommand } from "./pipeline/goCompareCommand.js";
-export { registerSubagents, makeSubagentTool, discoverSubagents, parseAgentMarkdown, buildSubagentStage, formatAgentList, mapModelTier, SUBAGENT_TOOL_NAME, GENERAL_AGENT_NAME, MAX_PARALLEL_SUBAGENTS, DEFAULT_SUBAGENT_TOOLS, } from "./subagents.js";
+export { registerSubagents, makeSubagentTool, discoverSubagents, parseAgentMarkdown, buildSubagentStage, formatAgentList, mapModelTier, SUBAGENT_TOOL_NAME, GENERAL_AGENT_NAME, MAX_PARALLEL_SUBAGENTS, MAX_PARALLEL_SUBAGENTS_ULTRA, DEFAULT_SUBAGENT_TOOLS, } from "./subagents.js";
 export type { SubagentDef, SubagentSource } from "./subagents.js";
 export { registerTodos, makeTodoTool, normalizeTodos, reconstructTodos, renderTodoWidget, formatTodoList, todoSummary, TODO_TOOL_NAME, MAX_TODOS, } from "./todos.js";
 export type { TodoItem, TodoStatus, TodoTheme } from "./todos.js";

package/dist/extension/index.js

@@ -14,7 +14,7 @@ import { registerCmuxBridge } from "./cmux/index.js";
 import { makeRecordEngineeringContextTool } from "./recordContextTool.js";
 import { makeRecordDecisionTool } from "./recordDecisionTool.js";
 import { makeSuggestNextWorkTool } from "./nextWorkTool.js";
-import { BRAND_NAME, brandSystemPrompt, brandingDisabled, buildMastheadString, YAGNI_IDENTITY_DRIVER } from "./branding.js";
+import { BRAND_NAME, brandSystemPrompt, brandingDisabled, buildMastheadString, YAGNI_IDENTITY_DRIVER, YAGNI_IDENTITY_ULTRA } from "./branding.js";
 import { claudeRulesSection } from "./claudeRules.js";
 import { registerCostCommand } from "./costHud.js";
 import { isDebug } from "./diagnostics.js";
@@ -29,6 +29,7 @@ import { registerGoCommand } from "./pipeline/goCommand.js";
 import { registerGoCompareCommand } from "./pipeline/goCompareCommand.js";
 import { DEFAULT_PERMISSION_POLICY, createModeHolder, registerPermissionGate } from "./permission.js";
 import { registerSubagents } from "./subagents.js";
+import { createUltraHolder, registerUltraCommand } from "./ultra.js";
 import { registerTodos } from "./todos.js";
 import { registerDecisionCommands } from "./decisions.js";
 import { makeDecisionCapture } from "./decisionCapture.js";
@@ -185,7 +186,12 @@ export async function registerYagni(pi, deps = {}) {
     // The general subagent tool: delegate self-contained tasks (optionally in
     // parallel) to fresh-context agents defined in .claude/agents / .pi/agents,
     // riding the /go pipeline's child runner. /agents lists what's available.
-    registerSubagents(pi);
+    // Ultra mode (/ultra) is an explicit orchestration dial: it swaps the
+    // driver's delegation identity for the diamond directive (see the
+    // before_agent_start handler below) and widens the tool's fan-out ceiling.
+    const ultraHolder = createUltraHolder();
+    registerSubagents(pi, { isUltra: () => ultraHolder.get() });
+    registerUltraCommand(pi, ultraHolder);
     // Shared fetch timeout for the small, interactive display-path reads below
     // (/cost's spend + headroom, and Task 8's per-run spend for /go's summary):
     // 5s, not the 10s other boot/grounding fetches use, because the user is
@@ -517,13 +523,19 @@ export async function registerYagni(pi, deps = {}) {
     // assembled prompt passes through byte-exact (no rewrite, no brief
     // injection, no rules section, no delegation identity).
     const noBranding = brandingDisabled(env);
-    const identity = isDriverCaller(env) ? YAGNI_IDENTITY_DRIVER : undefined;
+    // Resolved per turn (not once at activation): /ultra can flip the driver
+    // between the delegation and diamond identities mid-session.
+    const isDriver = isDriverCaller(env);
     pi.on("before_agent_start", (event) => noBranding
         ? undefined
         : {
             systemPrompt: brandSystemPrompt(event.systemPrompt, {
                 contextBrief,
-                identity,
+                identity: isDriver
+                    ? ultraHolder.get()
+                        ? YAGNI_IDENTITY_ULTRA
+                        : YAGNI_IDENTITY_DRIVER
+                    : undefined,
                 rulesSection,
             }),
         });
@@ -781,7 +793,9 @@ export { recordDecision } from "./recordDecisionTool.js";
 export { runInitPass, runTeamSetup, registerTeamSetupCommand, isFreshWorkspace, readRepoIntake, draftEngineering, summarizeDraft, FRESH_BRIEF_MIN_CHARS, } from "./initPass.js";
 // Onramp Door B (F2a): the one-time init-pass idempotency marker.
 export { isInitDone, markInitDone, initDoneMarkerFile, _setInitDoneHomeForTest } from "./initDone.js";
-export { brandSystemPrompt, YAGNI_IDENTITY, YAGNI_IDENTITY_DRIVER, BRAND_NAME } from "./branding.js";
+export { brandSystemPrompt, YAGNI_IDENTITY, YAGNI_IDENTITY_DRIVER, YAGNI_IDENTITY_ULTRA, BRAND_NAME } from "./branding.js";
+// Ultra mode (/ultra): the aggressive fan-out/verify/synthesize dial.
+export { createUltraHolder, registerUltraCommand } from "./ultra.js";
 export { attributionHeaders, isDriverCaller, fetchCatalog, getToken, getWorkspaceId, resolveBaseUrl, sanitizeCallerSegment, } from "./config.js";
 export { buildYagniProvider } from "./provider.js";
 export { registerGoCommand } from "./pipeline/goCommand.js";
@@ -796,7 +810,7 @@ export { buildVerifyEnv, detectVerifyCommand, makeRunVerify, parseVerifyFailures
 export { blindStages, reportOnlyStages, makeGroundedVsBlindEval, formatComparisonReport } from "./pipeline/eval.js";
 export { registerGoCompareCommand } from "./pipeline/goCompareCommand.js";
 // The general subagent tool: Claude Code-format agent discovery + fan-out.
-export { registerSubagents, makeSubagentTool, discoverSubagents, parseAgentMarkdown, buildSubagentStage, formatAgentList, mapModelTier, SUBAGENT_TOOL_NAME, GENERAL_AGENT_NAME, MAX_PARALLEL_SUBAGENTS, DEFAULT_SUBAGENT_TOOLS, } from "./subagents.js";
+export { registerSubagents, makeSubagentTool, discoverSubagents, parseAgentMarkdown, buildSubagentStage, formatAgentList, mapModelTier, SUBAGENT_TOOL_NAME, GENERAL_AGENT_NAME, MAX_PARALLEL_SUBAGENTS, MAX_PARALLEL_SUBAGENTS_ULTRA, DEFAULT_SUBAGENT_TOOLS, } from "./subagents.js";
 // The session todo checklist: todo_write tool, widget renderer, /todos.
 export { registerTodos, makeTodoTool, normalizeTodos, reconstructTodos, renderTodoWidget, formatTodoList, todoSummary, TODO_TOOL_NAME, MAX_TODOS, } from "./todos.js";
 // P3 + W4: the permission gate seam (decideGate is pure; policy injectable) plus

package/dist/extension/pipeline/childRegistry.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Live child-process registry + exit sweep (the "no orphaned workers" invariant).
+ *
+ * /go stage children and verify children are spawned with raw `node:child_process`
+ * and piped stdio, so nothing in pi tracks them: pi's own shutdown paths
+ * (`/exit`, double Ctrl+C, SIGTERM/SIGHUP) call `process.exit(0)` and would
+ * orphan them into the background, still editing the repo and burning tokens
+ * until their wall-clock timeout fires.
+ *
+ * Every long-lived child is registered here instead. A single `process.on("exit")`
+ * hook (installed lazily on first track) kills whatever is still alive —
+ * `"exit"` handlers must be synchronous, and the whole sweep (including the
+ * `ps`-based descendant walk) is, so this holds on every exit path short of the
+ * pi process itself being SIGKILLed.
+ *
+ * Kills are TREE kills: a verify child like `pnpm test` fans out its own
+ * grandchildren, and killing only the direct pid would orphan those instead.
+ */
+import { type ChildProcess } from "node:child_process";
+/**
+ * PURE: given `ps -A -o pid=,ppid=` output lines, collect every descendant of
+ * the given roots (children, grandchildren, ...), breadth-first.
+ */
+export declare function descendantsOf(roots: number[], psLines: string[]): number[];
+/**
+ * Synchronously SIGKILL a process AND its descendants. POSIX walks a `ps`
+ * snapshot (the tree-kill pattern); Windows has real tree kill via
+ * `taskkill /T /F`. Throw-proof and synchronous, so it is exit-hook safe.
+ * Fail-soft: with no readable snapshot the direct pid is still killed.
+ */
+export declare function killTreeSync(pid: number): void;
+/**
+ * Register a spawned child so the exit sweep covers it. Deregisters itself on
+ * the child's real `close`/`error`, so the set only ever holds live processes.
+ */
+export declare function trackChild(proc: ChildProcess): void;
+/** Test seam: how many children are currently registered. */
+export declare function _liveChildCountForTest(): number;
+/** Test seam: run the sweep as the exit hook would. */
+export declare function _sweepForTest(): void;
+//# sourceMappingURL=childRegistry.d.ts.map

package/dist/extension/pipeline/childRegistry.js

@@ -0,0 +1,118 @@
+/**
+ * Live child-process registry + exit sweep (the "no orphaned workers" invariant).
+ *
+ * /go stage children and verify children are spawned with raw `node:child_process`
+ * and piped stdio, so nothing in pi tracks them: pi's own shutdown paths
+ * (`/exit`, double Ctrl+C, SIGTERM/SIGHUP) call `process.exit(0)` and would
+ * orphan them into the background, still editing the repo and burning tokens
+ * until their wall-clock timeout fires.
+ *
+ * Every long-lived child is registered here instead. A single `process.on("exit")`
+ * hook (installed lazily on first track) kills whatever is still alive —
+ * `"exit"` handlers must be synchronous, and the whole sweep (including the
+ * `ps`-based descendant walk) is, so this holds on every exit path short of the
+ * pi process itself being SIGKILLed.
+ *
+ * Kills are TREE kills: a verify child like `pnpm test` fans out its own
+ * grandchildren, and killing only the direct pid would orphan those instead.
+ */
+import { spawnSync } from "node:child_process";
+const live = new Set();
+let sweepInstalled = false;
+/**
+ * PURE: given `ps -A -o pid=,ppid=` output lines, collect every descendant of
+ * the given roots (children, grandchildren, ...), breadth-first.
+ */
+export function descendantsOf(roots, psLines) {
+    const childrenByParent = new Map();
+    for (const line of psLines) {
+        const m = line.trim().match(/^(\d+)\s+(\d+)$/);
+        if (!m)
+            continue;
+        const pid = Number(m[1]);
+        const ppid = Number(m[2]);
+        const list = childrenByParent.get(ppid) ?? [];
+        list.push(pid);
+        childrenByParent.set(ppid, list);
+    }
+    const found = [];
+    const queue = [...roots];
+    while (queue.length > 0) {
+        const next = queue.shift();
+        for (const child of childrenByParent.get(next) ?? []) {
+            found.push(child);
+            queue.push(child);
+        }
+    }
+    return found;
+}
+/**
+ * Synchronously SIGKILL a process AND its descendants. POSIX walks a `ps`
+ * snapshot (the tree-kill pattern); Windows has real tree kill via
+ * `taskkill /T /F`. Throw-proof and synchronous, so it is exit-hook safe.
+ * Fail-soft: with no readable snapshot the direct pid is still killed.
+ */
+export function killTreeSync(pid) {
+    if (process.platform === "win32") {
+        try {
+            spawnSync("taskkill", ["/pid", String(pid), "/T", "/F"], { stdio: "ignore" });
+        }
+        catch {
+            /* best effort */
+        }
+        return;
+    }
+    let descendants = [];
+    try {
+        const ps = spawnSync("ps", ["-A", "-o", "pid=,ppid="], { encoding: "utf8" });
+        if (ps.status === 0 && typeof ps.stdout === "string") {
+            descendants = descendantsOf([pid], ps.stdout.split("\n"));
+        }
+    }
+    catch {
+        /* no snapshot: fall through to the direct kill */
+    }
+    // Root first so it cannot spawn replacements for the descendants we listed.
+    for (const target of [pid, ...descendants]) {
+        try {
+            process.kill(target, "SIGKILL");
+        }
+        catch {
+            /* already dead */
+        }
+    }
+}
+/** Kill every still-registered child's tree. Synchronous and throw-proof (exit-hook safe). */
+function sweep() {
+    for (const proc of live) {
+        // pid guard: a child whose spawn FAILED has no pid; kill() would resolve
+        // that to pid 0 (the whole process group) and take the parent down too.
+        if (!proc.pid)
+            continue;
+        killTreeSync(proc.pid);
+    }
+    live.clear();
+}
+/**
+ * Register a spawned child so the exit sweep covers it. Deregisters itself on
+ * the child's real `close`/`error`, so the set only ever holds live processes.
+ */
+export function trackChild(proc) {
+    if (!sweepInstalled) {
+        sweepInstalled = true;
+        process.on("exit", sweep);
+    }
+    live.add(proc);
+    const drop = () => live.delete(proc);
+    proc.once("close", drop);
+    proc.once("error", drop);
+}
+/** Test seam: how many children are currently registered. */
+export function _liveChildCountForTest() {
+    return live.size;
+}
+/** Test seam: run the sweep as the exit hook would. */
+export function _sweepForTest() {
+    sweep();
+}
+//# sourceMappingURL=childRegistry.js.map

package/dist/extension/pipeline/finish.js

@@ -28,6 +28,7 @@
  * does not apply.
  */
 import { execFile } from "node:child_process";
+import { trackChild } from "./childRegistry.js";
 import { scrubSecrets } from "./scrubSecrets.js";
 import { parseChangedPaths } from "./verify.js";
 /** Cap on the commit subject's title half (keeps `git log --oneline` readable). */
@@ -42,7 +43,7 @@ const NOTE_TAIL_MAX = 200;
  * a spawn-level error (ENOENT / abort), which callers catch into a note.
  */
 const defaultExec = (argv, cwd, signal) => new Promise((resolve, reject) => {
-    execFile(argv[0], argv.slice(1), { cwd, signal, maxBuffer: 32 * 1024 * 1024 }, (err, stdout, stderr) => {
+    const child = execFile(argv[0], argv.slice(1), { cwd, signal, maxBuffer: 32 * 1024 * 1024 }, (err, stdout, stderr) => {
         const output = `${stdout ?? ""}${stderr ?? ""}`;
         if (err) {
             const code = err.code;
@@ -52,6 +53,9 @@ const defaultExec = (argv, cwd, signal) => new Promise((resolve, reject) => {
         }
         resolve({ code: 0, output });
     });
+    // A push or PR create can run for a while; register it with the exit sweep
+    // so quitting pi mid-FINISH never leaves it running in the background.
+    trackChild(child);
 });
 // ---------------------------------------------------------------------------
 // Pure message derivation

package/dist/extension/pipeline/goCommand.d.ts

@@ -88,7 +88,7 @@ export interface RegisterGoDeps {
      * without a network; a non-identifier arg short-circuits to null (raw arg passes
      * through). Returns null on any miss / transport error (the honest blind fallback).
      */
-    resolveTicketBrief?: (rawArg: string) => Promise<string | null>;
+    resolveTicketBrief?: (rawArg: string, signal?: AbortSignal) => Promise<string | null>;
     /** Injectable worktree creation (default: real `git worktree add -b … HEAD`). */
     createWorktree?: typeof defaultCreateRunWorktree;
     /** Injectable worktree bootstrap (default: best-effort `<pm> install --prefer-offline`). */

package/dist/extension/pipeline/goCommand.js

@@ -75,8 +75,9 @@ import { runFinish as defaultRunFinish, verifyTrailerValue, } from "./finish.js"
 import { GO_USAGE, parseGoArgs } from "./goFlags.js";
 import { registerGoStatusCommands } from "./goStatusCommands.js";
 import { runPipeline as defaultRunPipeline } from "./orchestrator.js";
+import { composeAbortSignal } from "./resilience.js";
 import { planResume } from "./resume.js";
-import { activeRunCount, beginRun, classifyRunLiveness, findActiveRunByTicket, isRunInFlight, isTerminalStatus, lastJournalTs, loadRegistryRows, MAX_CONCURRENT_RUNS, settleRun, trackRunPromise, worktreesDir, } from "./runRegistry.js";
+import { activeRunCount, beginRun, classifyRunLiveness, findActiveRunByTicket, isRunInFlight, isTerminalStatus, lastJournalTs, loadRegistryRows, MAX_CONCURRENT_RUNS, settleRun, trackRunAbort, trackRunPromise, worktreesDir, } from "./runRegistry.js";
 import { makeRunSession as defaultMakeRunSession } from "./runSession.js";
 import { recordSessionRun } from "../sessionRuns.js";
 import { resolveTicketBrief as defaultResolveTicketBrief } from "./ticketResolution.js";
@@ -426,7 +427,11 @@ export function registerGoCommand(pi, deps = {}) {
     // back to the local client estimate).
     const fetchRunSpend = deps.fetchRunSpend;
     const resolveTicketBrief = deps.resolveTicketBrief ??
-        ((rawArg) => defaultResolveTicketBrief({ baseUrl: deps.baseUrl ?? resolveBaseUrl(), getToken: deps.getToken ?? defaultGetToken }, rawArg));
+        ((rawArg, signal) => defaultResolveTicketBrief({
+            baseUrl: deps.baseUrl ?? resolveBaseUrl(),
+            getToken: deps.getToken ?? defaultGetToken,
+            ...(signal ? { signal } : {}),
+        }, rawArg));
     const reportCrash = deps.reportCrash ??
         makeCrashReporter({
             baseUrl: deps.baseUrl ?? resolveBaseUrl(),
@@ -830,6 +835,13 @@ export function registerGoCommand(pi, deps = {}) {
                     return undefined;
                 }
             };
+            // The run's OWN abort controller. `ctx.signal` is undefined here (/go only
+            // starts while the agent is idle, and pi's signal is the active turn's), so
+            // without this the pipeline runs unstoppable until its wall-clock timeout.
+            // /stop fires it via the registry (trackRunAbort below); composed with
+            // ctx.signal for the resumed-command case where one does exist.
+            const runAbort = new AbortController();
+            const runSignal = composeAbortSignal(ctx.signal, runAbort.signal);
             const runToCompletion = async () => {
                 try {
                     // Steady animation ticker: keeps the spinner + elapsed clock live between
@@ -843,7 +855,9 @@ export function registerGoCommand(pi, deps = {}) {
                     // the agents plan on the actual ticket, not the bare "YAG-234". Fail-soft:
                     // null keeps the raw arg (the honest blind fallback). The raw `ticket` stays
                     // the session key, the run row's arg, and the handoff/re-run copy.
-                    const ticketBrief = await resolveTicketBrief(ticket);
+                    // Signalled so /stop lands immediately instead of waiting out the
+                    // resolver's retry/timeout budget (up to ~90s of network patience).
+                    const ticketBrief = await resolveTicketBrief(ticket, runSignal);
                     // The plan stage's output, captured off the onStage boundary for the
                     // FINISH commit message's 2-3 sentence summary (absent on a resume).
                     let planText;
@@ -861,9 +875,9 @@ export function registerGoCommand(pi, deps = {}) {
                     catch {
                         /* fail-soft: leave baseline empty */
                     }
-                    const result = await runPipeline(ticket, {
+                    let result = await runPipeline(ticket, {
                         cwd: runCwd,
-                        signal: ctx.signal,
+                        signal: runSignal,
                         ...(ticketBrief ? { ticketBrief } : {}),
                         onProgress: (p) => {
                             feed?.applyProgress(p);
@@ -909,6 +923,12 @@ export function registerGoCommand(pi, deps = {}) {
                         checkpointMeta,
                         ...(resumeFrom ? { resumeFrom } : {}),
                     });
+                    // /stop can land in the race between the pipeline's last abort check
+                    // and its clean return: honor it BEFORE FINISH, so a stopped run never
+                    // starts committing and the promised WIP-preserve path runs instead.
+                    if (result.stopReason === "clean" && runSignal.aborted) {
+                        result = { ...result, stopReason: "aborted" };
+                    }
                     // FINISH stage (spec §3c): ONLY on a clean stop. Commit the run's work
                     // (worktree always; --here only over a clean pre-run baseline) with the
                     // provenance trailer, and push + PR when --pr asked for it. Iron
@@ -939,7 +959,7 @@ export function registerGoCommand(pi, deps = {}) {
                                 openPr: parsed.flags.pr,
                                 remainingFindings: result.findings.filter((f) => f.severity === "medium" || f.severity === "low"),
                                 ...(finishBaselinePaths.length > 0 ? { baselinePaths: finishBaselinePaths } : {}),
-                                ...(ctx.signal ? { signal: ctx.signal } : {}),
+                                signal: runSignal,
                             });
                         }
                         catch (err) {
@@ -972,6 +992,14 @@ export function registerGoCommand(pi, deps = {}) {
                         }
                     }
                     clearUI();
+                    // /stop DURING FINISH: the abort degrades FINISH mid-way (its execs
+                    // share runSignal). If no commit landed, the aborted status + WIP
+                    // preservation the user was promised win over "clean"; a commit that
+                    // DID land means the work is durable and the clean report stays honest.
+                    if (result.stopReason === "clean" && runSignal.aborted && !finish?.commitSha) {
+                        result = { ...result, stopReason: "aborted" };
+                        finish = undefined;
+                    }
                     // Fold what FINISH landed onto a NEW result (never mutate the pipeline's
                     // return). `finish` is present ONLY when a commit really happened (§0.1).
                     const finishBranch = finish?.branch ?? repoCtx.branch;
@@ -1049,6 +1077,7 @@ export function registerGoCommand(pi, deps = {}) {
                 }
             };
             beginRun(registryRow);
+            trackRunAbort(runId, runAbort);
             if (parsed.flags.fg) {
                 // --fg: the legacy blocking behavior — the prompt returns when the run does.
                 await runToCompletion();

package/dist/extension/pipeline/goStatusCommands.d.ts

@@ -44,7 +44,17 @@ export interface RegisterGoStatusDeps {
     resolveRepo?: (cwd: string, signal?: AbortSignal) => Promise<string | undefined>;
     exists?: (path: string) => boolean;
     now?: () => number;
+    /** Injectable cancel seams for /stop (default: the module-scoped registry). */
+    activeRows?: () => RunRegistryRow[];
+    cancelOne?: (runId: string) => RunRegistryRow | undefined;
+    cancelAll?: () => RunRegistryRow[];
 }
+/**
+ * PURE: resolve a /stop argument against the in-flight rows. Matches the ticket
+ * (case-insensitive exact) first, then a runId prefix of at least 4 chars (the
+ * short id /go-status prints is 8).
+ */
+export declare function matchStopTarget(rows: RunRegistryRow[], arg: string): RunRegistryRow | undefined;
 /**
  * PURE: where an in-flight/interrupted run got to, read off its checkpoint
  * journal. The journal is append-only, so the latest applicable boundary wins.