@yagni-app/code-staging 0.3.0-staging.1081.1 → 0.3.0-staging.1085.1

package/dist/extension/pipeline/goStatusCommands.js

@@ -22,9 +22,25 @@
  */
 import { existsSync } from "node:fs";
 import { makeFileCheckpointStore } from "./checkpoint.js";
-import { classifyRunLiveness, isRunInFlight, isTerminalStatus, lastJournalTs, loadRegistryRows, settleRun, } from "./runRegistry.js";
+import { activeRunRows, cancelActiveRuns, cancelRun, classifyRunLiveness, isRunInFlight, isTerminalStatus, lastJournalTs, loadRegistryRows, settleRun, } from "./runRegistry.js";
 import { removeWorktree as defaultRemoveWorktree } from "./worktree.js";
 import { snapshotWorkspace as defaultSnapshotWorkspace } from "./workspace.js";
+/**
+ * PURE: resolve a /stop argument against the in-flight rows. Matches the ticket
+ * (case-insensitive exact) first, then a runId prefix of at least 4 chars (the
+ * short id /go-status prints is 8).
+ */
+export function matchStopTarget(rows, arg) {
+    const needle = arg.trim().toLowerCase();
+    if (!needle)
+        return undefined;
+    const byTicket = rows.find((r) => r.ticket.toLowerCase() === needle);
+    if (byTicket)
+        return byTicket;
+    if (needle.length < 4)
+        return undefined;
+    return rows.find((r) => r.runId.toLowerCase().startsWith(needle));
+}
 /**
  * PURE: where an in-flight/interrupted run got to, read off its checkpoint
  * journal. The journal is append-only, so the latest applicable boundary wins.
@@ -90,6 +106,50 @@ export function registerGoStatusCommands(pi, deps = {}) {
     const resolveRepo = deps.resolveRepo ?? (async () => undefined);
     const exists = deps.exists ?? existsSync;
     const now = deps.now ?? Date.now;
+    const activeRows = deps.activeRows ?? activeRunRows;
+    const cancelOne = deps.cancelOne ?? cancelRun;
+    const cancelAll = deps.cancelAll ?? cancelActiveRuns;
+    pi.registerCommand("stop", {
+        description: "Hard-stop /go runs in this session: /stop cancels them all, /stop <ticket|run id> cancels one. Work so far is preserved as a WIP commit.",
+        handler: async (args, ctx) => {
+            const say = async (message, type = "info") => {
+                if (ctx.hasUI)
+                    ctx.ui.notify(message, type);
+                else
+                    await pi.sendUserMessage(message);
+            };
+            const label = (row) => `[${row.runId.slice(0, 8)}] ${row.ticket}`;
+            const rows = activeRows();
+            if (rows.length === 0) {
+                await say("No /go runs are in flight in this session. (Esc interrupts the interactive agent; /go-status lists runs from other sessions.)");
+                return;
+            }
+            const arg = args.trim();
+            if (arg) {
+                const target = matchStopTarget(rows, arg);
+                if (!target) {
+                    await say(`No in-flight run matches "${arg}". Running here: ${rows.map(label).join(", ")}.`, "warning");
+                    return;
+                }
+                if (!cancelOne(target.runId)) {
+                    await say(`${label(target)} is still starting and cannot be signalled yet; try /stop again.`, "warning");
+                    return;
+                }
+                await say(`Stopping ${label(target)}. Its workers are being killed; any work lands as a WIP commit and the handoff will report the aborted run.`);
+                return;
+            }
+            const cancelled = cancelAll();
+            if (cancelled.length === 0) {
+                // The window between beginRun and trackRunAbort is one tick wide, but be
+                // honest if we hit it rather than claiming a stop that did not fire.
+                await say("Could not signal any run yet (they are still starting); try /stop again.", "warning");
+                return;
+            }
+            await say(`Stopping ${cancelled.length} /go run${cancelled.length === 1 ? "" : "s"}: ${cancelled
+                .map(label)
+                .join(", ")}. Workers are being killed; work so far lands as WIP commits (see /go-status).`);
+        },
+    });
     pi.registerCommand("go-status", {
         description: "List /go runs: active (stage/round), finished (outcome + branch/commit/PR), and interrupted (resumable).",
         handler: async (_args, ctx) => {

package/dist/extension/pipeline/runRegistry.d.ts

@@ -85,6 +85,20 @@ export declare function _resetRunRegistryForTest(): void;
 export declare function beginRun(row: RunRegistryRow): void;
 /** Attach the detached completion promise to an in-flight run (fail-soft no-op when absent). */
 export declare function trackRunPromise(runId: string, promise: Promise<void>): void;
+/** Attach the run's abort controller so /stop can cancel it (fail-soft no-op when absent). */
+export declare function trackRunAbort(runId: string, abort: AbortController): void;
+/**
+ * Cancel one in-flight run in THIS process: fire its abort controller and return
+ * its row. The run itself settles through the normal pipeline path (the abort
+ * propagates to every stage child as SIGTERM→SIGKILL, the orchestrator stops with
+ * an honest `aborted`, and runToCompletion preserves WIP + settles the registry).
+ * Returns undefined for an unknown/foreign runId or a run with no controller yet.
+ */
+export declare function cancelRun(runId: string): RunRegistryRow | undefined;
+/** Cancel EVERY in-flight run in this process (the /stop no-arg path). Returns the rows fired. */
+export declare function cancelActiveRuns(): RunRegistryRow[];
+/** The in-flight rows in THIS process (newest first), for /stop's matching + messaging. */
+export declare function activeRunRows(): RunRegistryRow[];
 /**
  * Settle an in-flight run: merge the terminal patch, drop it from the in-memory
  * active set, and mirror the final row. Safe to call for an unknown runId: the

package/dist/extension/pipeline/runRegistry.js

@@ -137,6 +137,41 @@ export function trackRunPromise(runId, promise) {
     if (entry)
         entry.promise = promise;
 }
+/** Attach the run's abort controller so /stop can cancel it (fail-soft no-op when absent). */
+export function trackRunAbort(runId, abort) {
+    const entry = active.get(runId);
+    if (entry)
+        entry.abort = abort;
+}
+/**
+ * Cancel one in-flight run in THIS process: fire its abort controller and return
+ * its row. The run itself settles through the normal pipeline path (the abort
+ * propagates to every stage child as SIGTERM→SIGKILL, the orchestrator stops with
+ * an honest `aborted`, and runToCompletion preserves WIP + settles the registry).
+ * Returns undefined for an unknown/foreign runId or a run with no controller yet.
+ */
+export function cancelRun(runId) {
+    const entry = active.get(runId);
+    if (!entry?.abort)
+        return undefined;
+    entry.abort.abort();
+    return entry.row;
+}
+/** Cancel EVERY in-flight run in this process (the /stop no-arg path). Returns the rows fired. */
+export function cancelActiveRuns() {
+    const cancelled = [];
+    for (const entry of active.values()) {
+        if (!entry.abort)
+            continue;
+        entry.abort.abort();
+        cancelled.push(entry.row);
+    }
+    return cancelled;
+}
+/** The in-flight rows in THIS process (newest first), for /stop's matching + messaging. */
+export function activeRunRows() {
+    return [...active.values()].map((e) => e.row).sort((a, b) => b.startedAt - a.startedAt);
+}
 /**
  * Settle an in-flight run: merge the terminal patch, drop it from the in-memory
  * active set, and mirror the final row. Safe to call for an unknown runId: the

package/dist/extension/pipeline/runner.js

@@ -23,6 +23,7 @@ import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
 import { fileURLToPath } from "node:url";
+import { trackChild } from "./childRegistry.js";
 import { finalOutputFrom, foldEvent, newEventAccumulator } from "./events.js";
 import { buildStageInvocation, groundedChildArgv } from "./invocation.js";
 import { personaBody } from "./personas.js";
@@ -151,6 +152,9 @@ export async function runStage(stage, ctx, deps) {
                 shell: false,
                 stdio: ["ignore", "pipe", "pipe"],
             });
+            // Register with the exit sweep so quitting pi (/exit, double Ctrl+C,
+            // SIGTERM) can never orphan a stage child into the background.
+            trackChild(proc);
             let buffer = "";
             // `overlong` = we are mid-way through a line that already blew the cap; we
             // discard incoming bytes until its terminating newline, then drop the line.

package/dist/extension/pipeline/verify.d.ts

@@ -239,6 +239,10 @@ export declare function buildVerifyEnv(source?: NodeJS.ProcessEnv): NodeJS.Proce
  * once instead of parking in watch mode until the 10-min cap kills it.
  */
 export declare function buildTestEnv(source?: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
+export declare function makeDefaultExec(opts?: {
+    graceMs?: number;
+    killTree?: (pid: number) => void;
+}): VerifyExec;
 export interface MakeRunVerifyOpts {
     detect?: (cwd: string, changedDirs: string[]) => VerifyCommand[];
     /**

package/dist/extension/pipeline/verify.js

@@ -52,6 +52,7 @@ import { readFileSync } from "node:fs";
 // backslashed strings that no longer compare equal to the git-derived repoRoot
 // and would break the walk-up termination check.
 import { basename, dirname, join } from "node:path/posix";
+import { killTreeSync, trackChild } from "./childRegistry.js";
 import { composeAbortSignal } from "./resilience.js";
 import { scrubSecrets } from "./scrubSecrets.js";
 import { snapshotWorkspace } from "./workspace.js";
@@ -595,33 +596,54 @@ export function buildTestEnv(source = process.env) {
 // — signalling the WHOLE process group and killing the parent. Abort is wired
 // manually with an explicit pid guard; a killed child reaches the callback with
 // a code-less error, which stays the same fail-open rejection as before.
-const defaultExec = (argv, cwd, signal, env) => new Promise((resolve, reject) => {
-    if (signal.aborted)
-        return reject(new Error("verify aborted before start"));
-    const child = execFile(argv[0], argv.slice(1), { cwd, env: env ?? buildVerifyEnv(), maxBuffer: 32 * 1024 * 1024 }, (err, stdout, stderr) => {
-        signal.removeEventListener("abort", onAbort);
-        const output = `${stdout ?? ""}${stderr ?? ""}`;
-        if (err) {
-            // A non-zero EXIT is a verify failure (carries a numeric code); a spawn
-            // error (ENOENT) or an abort has no numeric code and is a fail-open.
-            const code = err.code;
-            if (typeof code === "number")
-                return resolve({ code, output });
-            return reject(err);
-        }
-        resolve({ code: 0, output });
+//
+// Abort escalates: SIGTERM first (a test runner gets its grace to flush), then
+// after `graceMs` a TREE SIGKILL — a stubborn runner (or a descendant it
+// spawned that holds the stdio pipes open) would otherwise leave the promise
+// pending forever, hanging /stop and the run with it.
+export function makeDefaultExec(opts = {}) {
+    const graceMs = opts.graceMs ?? 5000;
+    const killTree = opts.killTree ?? killTreeSync;
+    return (argv, cwd, signal, env) => new Promise((resolve, reject) => {
+        if (signal.aborted)
+            return reject(new Error("verify aborted before start"));
+        let settled = false;
+        let killTimer;
+        const child = execFile(argv[0], argv.slice(1), { cwd, env: env ?? buildVerifyEnv(), maxBuffer: 32 * 1024 * 1024 }, (err, stdout, stderr) => {
+            settled = true;
+            if (killTimer)
+                clearTimeout(killTimer);
+            signal.removeEventListener("abort", onAbort);
+            const output = `${stdout ?? ""}${stderr ?? ""}`;
+            if (err) {
+                // A non-zero EXIT is a verify failure (carries a numeric code); a spawn
+                // error (ENOENT) or an abort has no numeric code and is a fail-open.
+                const code = err.code;
+                if (typeof code === "number")
+                    return resolve({ code, output });
+                return reject(err);
+            }
+            resolve({ code: 0, output });
+        });
+        trackChild(child);
+        const onAbort = () => {
+            try {
+                if (child.pid)
+                    child.kill("SIGTERM");
+            }
+            catch {
+                /* ignore */
+            }
+            killTimer = setTimeout(() => {
+                if (!settled && child.pid)
+                    killTree(child.pid);
+            }, graceMs);
+            killTimer.unref?.();
+        };
+        signal.addEventListener("abort", onAbort, { once: true });
     });
-    const onAbort = () => {
-        try {
-            if (child.pid)
-                child.kill("SIGTERM");
-        }
-        catch {
-            /* ignore */
-        }
-    };
-    signal.addEventListener("abort", onAbort, { once: true });
-});
+}
+const defaultExec = makeDefaultExec();
 /**
  * Build the runVerify function injected into the orchestrator. It discovers the
  * changed package(s) (scoped to this run's diff via `baselinePaths`), detects a

package/dist/extension/subagents.d.ts

@@ -20,11 +20,13 @@
 import { type ExtensionAPI, type ExtensionContext } from "@earendil-works/pi-coding-agent";
 import { Type } from "typebox";
 import { runStage } from "./pipeline/runner.js";
-import type { ModelTier, PipelineStage } from "./pipeline/types.js";
+import { type ModelTier, type PipelineStage } from "./pipeline/types.js";
 import { renderSubagentCall, renderSubagentResult } from "./subagentRender.js";
 export declare const SUBAGENT_TOOL_NAME = "subagent";
 export declare const GENERAL_AGENT_NAME = "general";
 export declare const MAX_PARALLEL_SUBAGENTS = 4;
+/** Wider fan-out ceiling while the session is in ultra mode (/ultra). */
+export declare const MAX_PARALLEL_SUBAGENTS_ULTRA = 8;
 /**
  * The default tool surface a subagent gets when its definition declares none:
  * the full working set plus grounded answers, mirroring what a Claude Code
@@ -92,6 +94,8 @@ export interface MakeSubagentToolDeps {
     runStageImpl?: typeof runStage;
     discover?: (deps: DiscoverDeps) => SubagentDef[];
     homeDir?: string;
+    /** Live ultra-mode probe (/ultra): widens the per-call fan-out ceiling. */
+    isUltra?: () => boolean;
 }
 export declare function makeSubagentTool(deps?: MakeSubagentToolDeps): {
     name: string;
@@ -135,6 +139,8 @@ export declare function makeSubagentTool(deps?: MakeSubagentToolDeps): {
 export interface RegisterSubagentsDeps {
     discover?: (deps: DiscoverDeps) => SubagentDef[];
     homeDir?: string;
+    /** Live ultra-mode probe (/ultra): widens the per-call fan-out ceiling. */
+    isUltra?: () => boolean;
 }
 /** Wire the subagent tool and the /agents listing command. */
 export declare function registerSubagents(pi: ExtensionAPI, deps?: RegisterSubagentsDeps): void;

package/dist/extension/subagents.js

@@ -23,7 +23,9 @@ import { delimiter, join } from "node:path";
 import { parseFrontmatter } from "@earendil-works/pi-coding-agent";
 import { Type } from "typebox";
 import { sanitizeCallerSegment } from "./config.js";
+import { withResilience } from "./pipeline/resilience.js";
 import { runStage } from "./pipeline/runner.js";
+import { DEFAULT_RESILIENCE_POLICY } from "./pipeline/types.js";
 import { applyChildEvent, finalizeTask, formatWorkingMessage, newTaskProgress, progressSummaryText, renderSubagentCall, renderSubagentResult, } from "./subagentRender.js";
 /**
  * YAG-471 attribution: the `x-yagni-caller` prefix for a subagent invocation.
@@ -34,6 +36,8 @@ const SUBAGENT_CALLER_PREFIX = "subagent:";
 export const SUBAGENT_TOOL_NAME = "subagent";
 export const GENERAL_AGENT_NAME = "general";
 export const MAX_PARALLEL_SUBAGENTS = 4;
+/** Wider fan-out ceiling while the session is in ultra mode (/ultra). */
+export const MAX_PARALLEL_SUBAGENTS_ULTRA = 8;
 /**
  * The default tool surface a subagent gets when its definition declares none:
  * the full working set plus grounded answers, mirroring what a Claude Code
@@ -123,6 +127,50 @@ const IMPLEMENTER_AGENT = {
     body: IMPLEMENTER_BODY,
     source: "builtin",
 };
+const VERIFICATION_BODY = `You are an adversarial verifier. Another agent
+produced work — a change, a plan, or a claim — and your job is to try to
+BREAK it, not to summarize it. Default to skepticism: hunt for the concrete
+failure scenario (the inputs, state, or sequence that makes it wrong). Bash
+is read-only here (\`git diff\`, \`git log\`, \`git show\`); do NOT modify files
+or run builds.
+
+If your task names a lens (correctness, edge cases, codebase fit, security,
+…), judge ONLY through that lens and leave the rest to your sibling
+verifiers.
+
+You are grounded in how THIS company works: call ask_yagni before inferring
+a convention, an ownership rule, or anything organization-specific.
+
+Your final message is your verdict back to the driving agent, which has NOT
+seen what you read. Format:
+## Verdict
+BROKEN or HOLDS, with one sentence why.
+## Findings
+Each real problem: file:line, the concrete failure scenario, severity. No
+style nits.
+## Not verified
+What you could not check, and why.
+
+A HOLDS after real digging is valuable; a rubber stamp is not. If you found
+nothing, say exactly what you tried to break and how.`;
+/** The diamond's reduce layer: refute-first review of completed work on the
+ * advanced tier (judgment is the whole job, so the premium is worth paying —
+ * the server clamps subagent children at advanced anyway). It has no
+ * edit/write tools; bash is included for `git diff`-style inspection and is
+ * restricted to read-only USE by the persona, the same prompt-level stance as
+ * /go's reviewer — not a technical guarantee. */
+const VERIFICATION_AGENT = {
+    name: "verification",
+    description: "Adversarial verification of completed work: tries to refute a change, " +
+        "plan, or claim and reports concrete failure scenarios. Does not edit " +
+        "files. Fan out 2-3 with different lenses (correctness, edge cases, " +
+        "codebase fit) for anything significant and treat agreement as " +
+        "confirmation.",
+    model: "advanced",
+    tools: ["read", "grep", "find", "ls", "bash", "ask_yagni"],
+    body: VERIFICATION_BODY,
+    source: "builtin",
+};
 // Concrete tiers a subagent can actually run on. `balanced` is deliberately NOT
 // a member here even though it is a member of `ModelTier`: a subagent needs
 // ONE model for its whole run, and balanced is a session-level routing policy,
@@ -210,7 +258,7 @@ function loadAgentsFromDir(dir, source) {
 export function discoverSubagents(deps) {
     const home = deps.homeDir ?? homedir();
     const layers = [
-        [GENERAL_AGENT, SEARCHER_AGENT, IMPLEMENTER_AGENT],
+        [GENERAL_AGENT, SEARCHER_AGENT, IMPLEMENTER_AGENT, VERIFICATION_AGENT],
         ...pluginAgentDirs(deps.env ?? process.env).map((dir) => loadAgentsFromDir(dir, "plugin")),
         loadAgentsFromDir(join(home, ".claude", "agents"), "user-claude"),
         loadAgentsFromDir(join(deps.cwd, ".pi", "agents"), "project-pi"),
@@ -261,11 +309,17 @@ const parameters = Type.Object({
         task: Type.String(),
         agent: Type.Optional(Type.String()),
     }), {
-        description: `Run several independent tasks in parallel (max ${MAX_PARALLEL_SUBAGENTS}). Use INSTEAD of task.`,
+        description: `Run several independent tasks in parallel (max ${MAX_PARALLEL_SUBAGENTS}; ${MAX_PARALLEL_SUBAGENTS_ULTRA} in ultra mode). Use INSTEAD of task.`,
     })),
 });
 export function makeSubagentTool(deps = {}) {
-    const run = deps.runStageImpl ?? runStage;
+    // The default runner rides the /go pipeline's resilience wrapper, so a chat
+    // subagent gets the same idle + wall-clock ceilings and transient-only retry
+    // as a /go stage child (previously a hung subagent hung the tool call until
+    // the user pressed Esc). The synthetic stage id is "implement", so the
+    // wrapper's write-gate already refuses to re-run a child that may have
+    // landed a partial edit.
+    const run = deps.runStageImpl ?? withResilience(runStage, DEFAULT_RESILIENCE_POLICY);
     const discover = deps.discover ?? discoverSubagents;
     return {
         name: SUBAGENT_TOOL_NAME,
@@ -293,8 +347,9 @@ export function makeSubagentTool(deps = {}) {
             if (requested.length === 0) {
                 return fail("Error: pass `task` (or a `tasks` array) describing what to do.");
             }
-            if (requested.length > MAX_PARALLEL_SUBAGENTS) {
-                return fail(`Error: at most ${MAX_PARALLEL_SUBAGENTS} parallel tasks per call.`);
+            const maxParallel = deps.isUltra?.() ? MAX_PARALLEL_SUBAGENTS_ULTRA : MAX_PARALLEL_SUBAGENTS;
+            if (requested.length > maxParallel) {
+                return fail(`Error: at most ${maxParallel} parallel tasks per call.`);
             }
             const cwd = ctx?.cwd ?? process.cwd();
             const agents = discover({ cwd, homeDir: deps.homeDir });

package/dist/extension/ultra.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Ultra mode (/ultra) — an explicit, session-scoped dial for aggressive
+ * multi-agent orchestration ("the diamond": fan out → reduce → synthesize).
+ *
+ * Off by default so the trial-default behavior is unchanged; toggling on swaps
+ * the driver's delegation paragraph for the diamond directive (branding.ts's
+ * YAGNI_IDENTITY_ULTRA, read live per turn in index.ts) and widens the
+ * subagent tool's per-call fan-out ceiling (subagents.ts). Ultra is a prompt +
+ * ceiling change only: it never touches the permission mode, the model tier,
+ * or the /go pipeline.
+ */
+import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
+export interface UltraHolder {
+    get(): boolean;
+    set(on: boolean): void;
+}
+export declare function createUltraHolder(initial?: boolean): UltraHolder;
+/**
+ * Wire the /ultra command onto a shared holder. No argument toggles; `on` /
+ * `off` set explicitly; `status` reports without changing anything.
+ */
+export declare function registerUltraCommand(pi: ExtensionAPI, holder: UltraHolder): void;
+//# sourceMappingURL=ultra.d.ts.map

package/dist/extension/ultra.js

@@ -0,0 +1,61 @@
+/**
+ * Ultra mode (/ultra) — an explicit, session-scoped dial for aggressive
+ * multi-agent orchestration ("the diamond": fan out → reduce → synthesize).
+ *
+ * Off by default so the trial-default behavior is unchanged; toggling on swaps
+ * the driver's delegation paragraph for the diamond directive (branding.ts's
+ * YAGNI_IDENTITY_ULTRA, read live per turn in index.ts) and widens the
+ * subagent tool's per-call fan-out ceiling (subagents.ts). Ultra is a prompt +
+ * ceiling change only: it never touches the permission mode, the model tier,
+ * or the /go pipeline.
+ */
+export function createUltraHolder(initial = false) {
+    let on = initial;
+    return {
+        get: () => on,
+        set: (v) => {
+            on = v;
+        },
+    };
+}
+/** Status chip shown while ultra is on (same footer surface as the /mode chip). */
+const ULTRA_STATUS = "◆ ultra";
+const ULTRA_ON_COPY = "Ultra mode ON: meaningful work fans out to parallel subagents, adversarial " +
+    "verification agents try to break the result, then the agent synthesizes. " +
+    "Expect more subagent spend per task.";
+const ULTRA_OFF_COPY = "Ultra mode OFF: back to delegate-when-useful.";
+/**
+ * Wire the /ultra command onto a shared holder. No argument toggles; `on` /
+ * `off` set explicitly; `status` reports without changing anything.
+ */
+export function registerUltraCommand(pi, holder) {
+    pi.registerCommand("ultra", {
+        description: "Toggle ultra mode: aggressive fan-out/verify/synthesize orchestration. /ultra on | off | status.",
+        handler: async (args, ctx) => {
+            const notify = (m, t) => {
+                if (ctx.hasUI)
+                    ctx.ui.notify(m, t);
+            };
+            const arg = args.trim().toLowerCase();
+            if (arg && arg !== "on" && arg !== "off" && arg !== "status") {
+                notify(`Unknown argument "${arg}". Use /ultra, /ultra on, /ultra off, or /ultra status.`, "warning");
+                return;
+            }
+            if (arg === "status") {
+                notify(holder.get() ? ULTRA_ON_COPY : ULTRA_OFF_COPY, "info");
+                return;
+            }
+            const next = arg === "on" ? true : arg === "off" ? false : !holder.get();
+            holder.set(next);
+            try {
+                if (ctx.hasUI)
+                    ctx.ui.setStatus?.("yagni-ultra", next ? ULTRA_STATUS : undefined);
+            }
+            catch {
+                // The chip is chrome; never let it break /ultra.
+            }
+            notify(next ? ULTRA_ON_COPY : ULTRA_OFF_COPY, "info");
+        },
+    });
+}
+//# sourceMappingURL=ultra.js.map

package/dist/signalForward.d.ts

@@ -0,0 +1,60 @@
+/**
+ * Termination-signal forwarding: launcher → pi child.
+ *
+ * In the interactive TUI the tty is in raw mode, so Ctrl+C never raises
+ * SIGINT; this path covers `yagni -p`/piped/CI runs and an external
+ * `kill <launcher pid>`. Policy:
+ *
+ *  - The FIRST signal asks pi to shut down cleanly. SIGINT is translated to
+ *    SIGTERM because pi installs a graceful handler for SIGTERM (it kills its
+ *    tracked children) but none for SIGINT — a raw SIGINT would drop pi on the
+ *    default disposition with no cleanup.
+ *  - Any SECOND signal hard-kills pi's whole process TREE. A bare SIGKILL to
+ *    pi's pid would bypass its exit sweep (SIGKILL runs no handlers) and leave
+ *    /go workers alive, so the launcher enumerates and kills the descendants
+ *    itself: `ps` walk on POSIX, `taskkill /T /F` on Windows.
+ */
+/** The minimal child surface the forwarder needs (ChildProcess satisfies it). */
+export interface KillableChild {
+    pid?: number | undefined;
+    kill(signal: NodeJS.Signals): boolean;
+}
+/** The launcher-terminating signals that are forwarded rather than obeyed. */
+export declare const FORWARDED_SIGNALS: readonly NodeJS.Signals[];
+/**
+ * PURE policy for the FIRST signal: which signal the child receives when the
+ * launcher gets `received` (SIGINT is translated, the rest pass through).
+ * Escalation is not expressed here — a second signal goes through the tree
+ * kill, not a forwarded signal.
+ */
+export declare function forwardedSignal(received: NodeJS.Signals): NodeJS.Signals;
+/**
+ * PURE: the launcher's own exit code for the child's (code, signal) exit tuple.
+ * A signal-terminated child maps to the conventional 128+n (bash parity:
+ * SIGTERM→143, SIGKILL→137, SIGINT→130), so a cancelled run never reads as
+ * success to scripts or CI.
+ */
+export declare function exitCodeFor(code: number | null, signal: NodeJS.Signals | null): number;
+/**
+ * PURE: given `ps -A -o pid=,ppid=` output lines, collect every descendant of
+ * the given roots (children, grandchildren, ...), breadth-first. Mirrored in
+ * pi-extension-yagni's childRegistry (the packages are intentionally
+ * independent); keep the two in sync.
+ */
+export declare function descendantsOf(roots: number[], psLines: string[]): number[];
+/**
+ * Synchronously SIGKILL a process AND its descendants (POSIX `ps` walk /
+ * Windows `taskkill /T /F`). Throw-proof; fail-soft to a direct kill when no
+ * process snapshot is readable.
+ */
+export declare function killTreeSync(pid: number): void;
+/**
+ * Subscribe the forwarding policy for every signal in {@link FORWARDED_SIGNALS}.
+ * `subscribe` and `killTree` default to the real process surfaces and are
+ * injectable so tests never install real handlers, raise real signals, or kill
+ * real processes. Returns the forward function itself (also for tests).
+ * pid guard: a child whose spawn failed has no pid, and `kill()` would resolve
+ * that to the whole process group.
+ */
+export declare function installSignalForwarding(child: KillableChild, subscribe?: (sig: NodeJS.Signals, handler: () => void) => void, killTree?: (pid: number) => void): (sig: NodeJS.Signals) => void;
+//# sourceMappingURL=signalForward.d.ts.map