@yagni-app/code-staging 0.3.0-staging.1088.1 → 0.3.0-staging.1091.1

package/dist/extension/approvedPrefixes.d.ts

@@ -73,6 +73,17 @@ export declare function matchesGrant(command: string, grants: readonly ApprovedP
 export declare function validateGrant(command: string, policy: ExecPolicy, repoKey: string): ApprovedPrefixGrant | null;
 /** Human label for the remember option: "git push …". */
 export declare function describePrefix(pattern: string[]): string;
+/**
+ * Could {@link derivePrefix} ever have produced this pattern? The persisted
+ * file is plain JSON on disk, so a row that derivation could not have written
+ * (a banned interpreter/destruction/egress prefix, a bare multi-subcommand
+ * tool, a path-prefixed word, or an over-long pattern) is treated as
+ * tampered/corrupt and dropped at load time rather than honored (PR #1698
+ * review). This is defense in depth, not the trust boundary itself — the
+ * boundary is that grants only enter the live gate at startup or through the
+ * gate's own ask flow.
+ */
+export declare function isDerivablePattern(pattern: readonly string[]): boolean;
 export declare function rulesFilePath(homeOverride?: string | null): string;
 /**
  * Resolve the grant scope key for a session cwd: the git remote origin URL,

package/dist/extension/approvedPrefixes.js

@@ -179,6 +179,35 @@ export function validateGrant(command, policy, repoKey) {
 export function describePrefix(pattern) {
     return `${pattern.join(" ")} …`;
 }
+/**
+ * Could {@link derivePrefix} ever have produced this pattern? The persisted
+ * file is plain JSON on disk, so a row that derivation could not have written
+ * (a banned interpreter/destruction/egress prefix, a bare multi-subcommand
+ * tool, a path-prefixed word, or an over-long pattern) is treated as
+ * tampered/corrupt and dropped at load time rather than honored (PR #1698
+ * review). This is defense in depth, not the trust boundary itself — the
+ * boundary is that grants only enter the live gate at startup or through the
+ * gate's own ask flow.
+ */
+export function isDerivablePattern(pattern) {
+    if (pattern.length < 1 || pattern.length > 2)
+        return false;
+    const first = pattern[0];
+    if (first.includes("/") || first.startsWith("\\"))
+        return false;
+    if (BANNED_PREFIXES.has(first))
+        return false;
+    if (pattern.length === 2) {
+        const second = pattern[1];
+        if (!MULTI_SUBCOMMAND_TOOLS.has(first))
+            return false;
+        if (second.startsWith("-") || !SAFE_SUBCOMMAND_RE.test(second))
+            return false;
+        return true;
+    }
+    // Derivation never emits a bare multi-subcommand tool ("git" alone).
+    return !MULTI_SUBCOMMAND_TOOLS.has(first);
+}
 // --- I/O half ---
 export function rulesFilePath(homeOverride = null) {
     return join(codeStateHome(homeOverride), "rules.json");
@@ -220,6 +249,7 @@ export function loadGrants(homeOverride = null) {
         return parsed.grants.filter((g) => Array.isArray(g?.pattern) &&
             g.pattern.length > 0 &&
             g.pattern.every((t) => typeof t === "string") &&
+            isDerivablePattern(g.pattern) &&
             typeof g.repoKey === "string" &&
             typeof g.addedAt === "string" &&
             typeof g.cwd === "string");

package/dist/extension/askAdvisorTool.d.ts

@@ -30,7 +30,7 @@ import { type Component } from "@earendil-works/pi-tui";
 import { Type } from "typebox";
 import { type AdvisorLimits, type AdvisorStateHandle } from "./advisor.js";
 import { runStage as defaultRunStage } from "./pipeline/runner.js";
-import type { PipelineStage } from "./pipeline/types.js";
+import { type PipelineStage } from "./pipeline/types.js";
 import { type RenderTheme, type SubagentTaskProgress } from "./subagentRender.js";
 /**
  * Read-only recon plus grounding. Mirrors the `plan` stage's allowlist for the

package/dist/extension/askAdvisorTool.js

@@ -29,7 +29,9 @@ import { Text } from "@earendil-works/pi-tui";
 import { Type } from "typebox";
 import { ADVISOR_MODEL_TIER, DEFAULT_ADVISOR_LIMITS, decideConsult, formatConsultCost, } from "./advisor.js";
 import { SPINNER_FRAMES } from "./pipeline/activityFeed.js";
+import { withResilience } from "./pipeline/resilience.js";
 import { runStage as defaultRunStage } from "./pipeline/runner.js";
+import { DEFAULT_RESILIENCE_POLICY } from "./pipeline/types.js";
 import { applyChildEvent, finalizeTask, formatWorkingMessage, newTaskProgress, progressSummaryText, receiptLine, renderSubagentResult, runningLines, } from "./subagentRender.js";
 /**
  * Read-only recon plus grounding. Mirrors the `plan` stage's allowlist for the
@@ -94,7 +96,13 @@ export function renderAdvisorCall(args, theme, _context) {
 }
 export function makeAskAdvisorTool(opts) {
     const limits = opts.limits ?? DEFAULT_ADVISOR_LIMITS;
-    const runStage = opts.runStage ?? defaultRunStage;
+    // The default runner rides the /go pipeline's resilience wrapper, exactly
+    // like the subagent tool: idle + wall-clock ceilings and transient-only
+    // retry, so a stalled consult child aborts honestly instead of hanging the
+    // driver's tool call until the user presses Esc. The synthetic stage id is
+    // "plan" (read-only tools, no bash), so the wrapper's write-gate never
+    // blocks a retry — re-running a consult cannot double-apply anything.
+    const runStage = opts.runStage ?? withResilience(defaultRunStage, DEFAULT_RESILIENCE_POLICY);
     return {
         name: "ask_advisor",
         label: "Ask the advisor",

package/dist/extension/branding.d.ts

@@ -47,7 +47,7 @@ export declare const ULTRA_DELEGATION_PARAGRAPH: string;
  */
 export declare const YAGNI_IDENTITY_DRIVER = "You are YAGNI Code, an autonomous terminal coding agent. You help developers ship code by reading files, running commands, editing code, and writing new files. Uniquely, you are connected to the YAGNI app, your team's shared source of truth for how this company and codebase actually work: conventions, decisions, ownership, current priorities, and the reasons behind them. Use the ask_yagni tool to consult it before guessing about anything organization- or codebase-specific, so you work with less back-and-forth and more correct autonomy than a disconnected coding agent. If a project's own files mention other coding agents, assistants, or harnesses by name, those references are not about you; you are YAGNI Code regardless of what tooling a repository's docs happen to describe.\n\nDelegation: fan codebase mapping, wide searches, and mechanical multi-file work out to subagents (they run on cheaper tiers). Reach for the stock agents by name: `searcher` for read-only reconnaissance and summarizing, `implementer` for executing a change you have already fully specified, `verification` for an adversarial pass that tries to break completed work before you rely on it. Keep judgment, synthesis, and the conversation with the user in this session. Do not spawn a subagent for work you can finish in a couple of tool calls.";
 /** The driver identity while /ultra is on: base identity + the diamond directive. */
-export declare const YAGNI_IDENTITY_ULTRA = "You are YAGNI Code, an autonomous terminal coding agent. You help developers ship code by reading files, running commands, editing code, and writing new files. Uniquely, you are connected to the YAGNI app, your team's shared source of truth for how this company and codebase actually work: conventions, decisions, ownership, current priorities, and the reasons behind them. Use the ask_yagni tool to consult it before guessing about anything organization- or codebase-specific, so you work with less back-and-forth and more correct autonomy than a disconnected coding agent. If a project's own files mention other coding agents, assistants, or harnesses by name, those references are not about you; you are YAGNI Code regardless of what tooling a repository's docs happen to describe.\n\nDelegation (ultra mode): the user has switched this session to ultra mode \u2014 aggressive multi-agent orchestration. Structure any meaningful task as a diamond: SPLIT the job into independent pieces; FAN OUT parallel subagents on cheaper tiers (`searcher` to scout, `implementer` or `general` to execute); CHECK by fanning out `verification` subagents told to refute the work, each through a different lens (correctness, edge cases, fit with this codebase); then SYNTHESIZE the results yourself. Treat agreement between checkers \u2014 not a single pass \u2014 as confirmation, and surface what they could not verify. Delegate by default and reserve this session for splitting, judging, and synthesis; only trivial work you can finish in a couple of tool calls skips the diamond.";
+export declare const YAGNI_IDENTITY_ULTRA = "You are YAGNI Code, an autonomous terminal coding agent. You help developers ship code by reading files, running commands, editing code, and writing new files. Uniquely, you are connected to the YAGNI app, your team's shared source of truth for how this company and codebase actually work: conventions, decisions, ownership, current priorities, and the reasons behind them. Use the ask_yagni tool to consult it before guessing about anything organization- or codebase-specific, so you work with less back-and-forth and more correct autonomy than a disconnected coding agent. If a project's own files mention other coding agents, assistants, or harnesses by name, those references are not about you; you are YAGNI Code regardless of what tooling a repository's docs happen to describe.\n\nDelegation (ultra mode): the user has switched this session to ultra mode \u2014 aggressive multi-agent orchestration. Structure any meaningful task as a diamond: SPLIT the job into independent pieces; FAN OUT parallel subagents on cheaper tiers (`searcher` to scout, `implementer` or `general` to execute); CHECK by fanning out `verification` subagents told to refute the work, each through a different lens (correctness, edge cases, fit with this codebase); then SYNTHESIZE the results yourself. Treat agreement between checkers \u2014 not a single pass \u2014 as confirmation, and surface what they could not verify. Delegate by default and reserve this session for splitting, judging, and synthesis; only trivial work you can finish in a couple of tool calls skips the diamond. Subagents cannot touch your todo_write checklist, so keep it current yourself: update it when you split the job and again as each fanned-out piece lands, not only at the end.";
 export declare const PI_IDENTITY_RE: RegExp;
 /**
  * Env switch that bypasses the system-prompt rewrite entirely, so pi's

package/dist/extension/branding.js

@@ -64,7 +64,9 @@ export const ULTRA_DELEGATION_PARAGRAPH = "Delegation (ultra mode): the user has
     "agreement between checkers — not a single pass — as confirmation, and " +
     "surface what they could not verify. Delegate by default and reserve this " +
     "session for splitting, judging, and synthesis; only trivial work you can " +
-    "finish in a couple of tool calls skips the diamond.";
+    "finish in a couple of tool calls skips the diamond. Subagents cannot touch " +
+    "your todo_write checklist, so keep it current yourself: update it when you " +
+    "split the job and again as each fanned-out piece lands, not only at the end.";
 /**
  * The identity used for the interactive DRIVER session ONLY: {@link
  * YAGNI_IDENTITY} plus {@link DRIVER_DELEGATION_PARAGRAPH}. The caller (index.ts)

package/dist/extension/guardian.d.ts

@@ -37,7 +37,7 @@ export interface GuardianVerdict {
     rationale: string;
 }
 export interface GuardianLimits {
-    /** Session cap on total Guardian reviews. */
+    /** Cap on Guardian reviews within the sliding window ({@link GUARDIAN_REVIEW_WINDOW_MS}). */
     maxReviews: number;
     /** Consecutive denials per turn before the circuit breaker trips. */
     maxConsecutiveDenials: number;
@@ -47,15 +47,25 @@ export interface GuardianLimits {
 export declare const DEFAULT_GUARDIAN_LIMITS: GuardianLimits;
 /**
  * Resolve Guardian limits from the environment. `YAGNI_GUARDIAN_MAX_REVIEWS`
- * overrides the session review cap; anything non-numeric or < 1 falls back to
- * the default (a bad value must never zero out the cap and lock the session).
+ * overrides the sliding-window review cap; anything non-numeric or < 1 falls
+ * back to the default (a bad value must never zero out the cap and lock the
+ * session).
  */
 export declare function resolveGuardianLimits(env?: Record<string, string | undefined>): GuardianLimits;
 /** The model tier the Guardian runs on. Configurable via YAGNI_GUARDIAN_TIER. */
 export declare const GUARDIAN_MODEL_TIER = "efficient";
 /** Read-only tools — the Guardian can read files for context but cannot write or execute. */
 export declare const GUARDIAN_TOOLS: string[];
+/**
+ * The review-cap window. `reviews` counts consults inside a SLIDING window
+ * rather than for the session's lifetime: a 24/7 session (a fleet operator's
+ * always-on terminal) must regain review capacity as old consults age out,
+ * not hard-block forever after the first N. The cap is a cost/runaway bound,
+ * not a safety bound — safety is the verdicts themselves.
+ */
+export declare const GUARDIAN_REVIEW_WINDOW_MS: number;
 export interface GuardianState {
+    /** Guardian consults within the last {@link GUARDIAN_REVIEW_WINDOW_MS}. */
     reviews: number;
     consecutiveDenials: number;
 }
@@ -64,7 +74,7 @@ export interface GuardianStateHandle {
     recordReview(outcome: GuardianOutcome): GuardianState;
     resetTurn(): void;
 }
-export declare function makeGuardianState(): GuardianStateHandle;
+export declare function makeGuardianState(now?: () => number): GuardianStateHandle;
 export interface CircuitBreakerResult {
     tripped: boolean;
     reason?: string;

package/dist/extension/guardian.js

@@ -35,8 +35,9 @@ export const DEFAULT_GUARDIAN_LIMITS = {
 };
 /**
  * Resolve Guardian limits from the environment. `YAGNI_GUARDIAN_MAX_REVIEWS`
- * overrides the session review cap; anything non-numeric or < 1 falls back to
- * the default (a bad value must never zero out the cap and lock the session).
+ * overrides the sliding-window review cap; anything non-numeric or < 1 falls
+ * back to the default (a bad value must never zero out the cap and lock the
+ * session).
  */
 export function resolveGuardianLimits(env = process.env) {
     const raw = env.YAGNI_GUARDIAN_MAX_REVIEWS?.trim();
@@ -48,25 +49,48 @@ export function resolveGuardianLimits(env = process.env) {
 export const GUARDIAN_MODEL_TIER = "efficient";
 /** Read-only tools — the Guardian can read files for context but cannot write or execute. */
 export const GUARDIAN_TOOLS = ["read"];
-export function makeGuardianState() {
-    const state = { reviews: 0, consecutiveDenials: 0 };
+// --- State ---
+/**
+ * The review-cap window. `reviews` counts consults inside a SLIDING window
+ * rather than for the session's lifetime: a 24/7 session (a fleet operator's
+ * always-on terminal) must regain review capacity as old consults age out,
+ * not hard-block forever after the first N. The cap is a cost/runaway bound,
+ * not a safety bound — safety is the verdicts themselves.
+ */
+export const GUARDIAN_REVIEW_WINDOW_MS = 60 * 60_000;
+export function makeGuardianState(now = Date.now) {
+    const reviewTimes = [];
+    let consecutiveDenials = 0;
+    const prune = () => {
+        const cutoff = now() - GUARDIAN_REVIEW_WINDOW_MS;
+        while (reviewTimes.length > 0 && reviewTimes[0] <= cutoff)
+            reviewTimes.shift();
+    };
+    const snapshot = () => ({
+        reviews: reviewTimes.length,
+        consecutiveDenials,
+    });
     return {
-        read: () => ({ ...state }),
+        read: () => {
+            prune();
+            return snapshot();
+        },
         recordReview(outcome) {
-            state.reviews += 1;
+            prune();
+            reviewTimes.push(now());
             if (outcome === "deny") {
-                state.consecutiveDenials += 1;
+                consecutiveDenials += 1;
             }
             else if (outcome === "allow") {
-                state.consecutiveDenials = 0;
+                consecutiveDenials = 0;
             }
             // "ask" leaves the denial streak UNCHANGED: it is neither a denial nor
             // an exoneration. If it reset the streak, deny/ask/deny/ask would never
             // trip the breaker (round-2 review blocker).
-            return { ...state };
+            return snapshot();
         },
         resetTurn() {
-            state.consecutiveDenials = 0;
+            consecutiveDenials = 0;
         },
     };
 }

package/dist/extension/index.d.ts

@@ -143,7 +143,7 @@ export type { ComparisonReport, LaneFit, LaneOutcome } from "./pipeline/eval.js"
 export { registerGoCompareCommand } from "./pipeline/goCompareCommand.js";
 export { registerSubagents, makeSubagentTool, discoverSubagents, parseAgentMarkdown, buildSubagentStage, formatAgentList, mapModelTier, SUBAGENT_TOOL_NAME, GENERAL_AGENT_NAME, MAX_PARALLEL_SUBAGENTS, MAX_PARALLEL_SUBAGENTS_ULTRA, DEFAULT_SUBAGENT_TOOLS, } from "./subagents.js";
 export type { SubagentDef, SubagentSource } from "./subagents.js";
-export { registerTodos, makeTodoTool, normalizeTodos, reconstructTodos, renderTodoWidget, formatTodoList, todoSummary, TODO_TOOL_NAME, MAX_TODOS, } from "./todos.js";
+export { registerTodos, makeTodoTool, normalizeTodos, reconstructTodos, renderTodoWidget, formatTodoList, formatTodoReminder, shouldRemindTodos, todoSummary, TODO_TOOL_NAME, TODO_REMINDER_TURNS, MAX_TODOS, } from "./todos.js";
 export type { TodoItem, TodoStatus, TodoTheme } from "./todos.js";
 export { decideGate, registerPermissionGate, filterStaleModeContext, filterStalePlanContext, buildModeContextMessage, DEFAULT_PERMISSION_POLICY, MODE_CONTEXT_TYPE, PLAN_CONTEXT_TYPE, PLAN_CONTEXT_MESSAGE, } from "./permission.js";
 export { classifyCommand, DEFAULT_EXEC_POLICY, } from "./execPolicy.js";

package/dist/extension/index.js

@@ -268,7 +268,9 @@ export async function registerYagni(pi, deps = {}) {
         catch { /* logging must never break the session */ }
     };
     // YAG-510: persisted "don't ask again" grants, per-repo keyed. Loaded once
-    // at startup (grants added by other concurrent sessions appear next launch).
+    // at startup (grants added by other concurrent sessions appear next launch —
+    // the startup load is the trust boundary; live reload was reviewed and
+    // rejected as a same-session self-authorization path, PR #1698).
     const sessionGrants = evalMode ? [] : loadGrants();
     const GUARDIAN_EVENT_TIMEOUT_MS = 5_000;
     registerPermissionGate(pi, {
@@ -812,7 +814,7 @@ export { registerGoCompareCommand } from "./pipeline/goCompareCommand.js";
 // The general subagent tool: Claude Code-format agent discovery + fan-out.
 export { registerSubagents, makeSubagentTool, discoverSubagents, parseAgentMarkdown, buildSubagentStage, formatAgentList, mapModelTier, SUBAGENT_TOOL_NAME, GENERAL_AGENT_NAME, MAX_PARALLEL_SUBAGENTS, MAX_PARALLEL_SUBAGENTS_ULTRA, DEFAULT_SUBAGENT_TOOLS, } from "./subagents.js";
 // The session todo checklist: todo_write tool, widget renderer, /todos.
-export { registerTodos, makeTodoTool, normalizeTodos, reconstructTodos, renderTodoWidget, formatTodoList, todoSummary, TODO_TOOL_NAME, MAX_TODOS, } from "./todos.js";
+export { registerTodos, makeTodoTool, normalizeTodos, reconstructTodos, renderTodoWidget, formatTodoList, formatTodoReminder, shouldRemindTodos, todoSummary, TODO_TOOL_NAME, TODO_REMINDER_TURNS, MAX_TODOS, } from "./todos.js";
 // P3 + W4: the permission gate seam (decideGate is pure; policy injectable) plus
 // the session bless-with-remember capture hook.
 export { decideGate, registerPermissionGate, filterStaleModeContext, filterStalePlanContext, buildModeContextMessage, DEFAULT_PERMISSION_POLICY, MODE_CONTEXT_TYPE, PLAN_CONTEXT_TYPE, PLAN_CONTEXT_MESSAGE, } from "./permission.js";

package/dist/extension/permission.js

@@ -279,6 +279,11 @@ export function registerPermissionGate(pi, deps = {}) {
     const guardianTier = deps.guardianTier;
     // --- YAG-510 gate state ---
     // Grants: in-memory list seeded from deps, appended on "don't ask again".
+    // Deliberately NOT live-reloaded from disk: auto mode can write files, so a
+    // mid-session re-read of rules.json would let the agent (or a prompt
+    // injection) author its own grants and self-authorize within the same
+    // session. New grants from concurrent sessions apply at next launch — the
+    // startup load is the trust boundary (PR #1698 review).
     const grants = [...(deps.grants ?? [])];
     // Keyed by cwd: a session can change working directory (cd, /go worktrees),
     // and a repoKey memoized from the first cwd would let repo-A grants match
@@ -410,12 +415,13 @@ export function registerPermissionGate(pi, deps = {}) {
                 const guardianAvailable = Boolean(guardianState && !guardianDisabled && guardianReview);
                 const limits = guardianLimits ?? DEFAULT_GUARDIAN_LIMITS;
                 if (guardianAvailable && guardianState.read().reviews >= limits.maxReviews) {
-                    // Session consult cap. Review mode falls through to its ordinary
-                    // confirm (no LLM cost); auto blocks.
+                    // Sliding-window consult cap (capacity recovers as old reviews age
+                    // out — a long-lived session is never bricked). Review mode falls
+                    // through to its ordinary confirm (no LLM cost); auto blocks.
                     if (modeAtEntry === "auto") {
                         if (ctx?.hasUI)
-                            ctx.ui.notify(`Guardian review cap reached (${limits.maxReviews} this session).`, "warning");
-                        return { block: true, reason: `Guardian review cap reached (${limits.maxReviews} this session). Switch to /mode review to approve manually.` };
+                            ctx.ui.notify(`Guardian review cap reached (${limits.maxReviews} in the last hour).`, "warning");
+                        return { block: true, reason: `Guardian review cap reached (${limits.maxReviews} in the last hour). Capacity recovers as older reviews age out; switch to /mode review to approve manually, or retry this step later.` };
                     }
                     // fall through to decision.confirm below
                 }

package/dist/extension/pipeline/goCommand.js

@@ -77,7 +77,7 @@ import { registerGoStatusCommands } from "./goStatusCommands.js";
 import { runPipeline as defaultRunPipeline } from "./orchestrator.js";
 import { composeAbortSignal } from "./resilience.js";
 import { planResume } from "./resume.js";
-import { activeRunCount, beginRun, classifyRunLiveness, findActiveRunByTicket, isRunInFlight, isTerminalStatus, lastJournalTs, loadRegistryRows, MAX_CONCURRENT_RUNS, settleRun, trackRunAbort, trackRunPromise, worktreesDir, } from "./runRegistry.js";
+import { activeRunCount, beginRun, classifyRunLiveness, findActiveRunByTicket, isRunInFlight, isTerminalStatus, lastJournalTs, loadRegistryRows, resolveMaxConcurrentRuns, settleRun, trackRunAbort, trackRunPromise, worktreesDir, } from "./runRegistry.js";
 import { makeRunSession as defaultMakeRunSession } from "./runSession.js";
 import { recordSessionRun } from "../sessionRuns.js";
 import { resolveTicketBrief as defaultResolveTicketBrief } from "./ticketResolution.js";
@@ -460,13 +460,15 @@ export function registerGoCommand(pi, deps = {}) {
                 return;
             }
             // In-flight guards: the same ticket never runs twice at once in this
-            // process, and at most MAX_CONCURRENT_RUNS runs are in flight.
+            // process, and at most resolveMaxConcurrentRuns() runs are in flight
+            // (default 3; fleet operators raise it via YAGNI_MAX_CONCURRENT_RUNS).
             if (findActiveRunByTicket(ticket)) {
                 notify(`/go ${ticket} is already running - see /go-status.`, "warning");
                 return;
             }
-            if (activeRunCount() >= MAX_CONCURRENT_RUNS) {
-                notify(`${MAX_CONCURRENT_RUNS} /go runs are already in flight; wait for one to finish (see /go-status).`, "warning");
+            const maxConcurrentRuns = resolveMaxConcurrentRuns();
+            if (activeRunCount() >= maxConcurrentRuns) {
+                notify(`${maxConcurrentRuns} /go runs are already in flight; wait for one to finish (see /go-status) or raise YAGNI_MAX_CONCURRENT_RUNS.`, "warning");
                 return;
             }
             // --- Run tree resolution: worktree by default; --here = legacy in-place.

package/dist/extension/pipeline/resilience.d.ts

@@ -4,7 +4,8 @@
  * `withResilience(runStage, policy)` is a composable higher-order function that
  * wraps the per-stage child spawn (`runner.ts#runStage`) with the one axis the
  * roadmap calls the whole competitive gap: a per-stage IDLE timeout (no NDJSON
- * event for N ms) and a total WALL-CLOCK timeout, both firing the runner's
+ * event for N ms, deferred while a tool is in flight — see the stall note at
+ * the timer wiring) and a total WALL-CLOCK timeout, both firing the runner's
  * existing SIGTERM -> SIGKILL abort; bounded exponential backoff with jitter; and
  * retry of CLASSIFIED-TRANSIENT outcomes only. One structured telemetry record is
  * emitted per attempt.

package/dist/extension/pipeline/resilience.js

@@ -4,7 +4,8 @@
  * `withResilience(runStage, policy)` is a composable higher-order function that
  * wraps the per-stage child spawn (`runner.ts#runStage`) with the one axis the
  * roadmap calls the whole competitive gap: a per-stage IDLE timeout (no NDJSON
- * event for N ms) and a total WALL-CLOCK timeout, both firing the runner's
+ * event for N ms, deferred while a tool is in flight — see the stall note at
+ * the timer wiring) and a total WALL-CLOCK timeout, both firing the runner's
  * existing SIGTERM -> SIGKILL abort; bounded exponential backoff with jitter; and
  * retry of CLASSIFIED-TRANSIENT outcomes only. One structured telemetry record is
  * emitted per attempt.
@@ -100,19 +101,37 @@ export function withResilience(base, policy, opts = {}) {
                 if (!timeoutController.signal.aborted)
                     timeoutController.abort();
             };
+            // Tools the child has started but not finished. The idle window measures
+            // STALL, not silence: a long quiet tool (a 6-minute test suite, a slow
+            // build) emits no NDJSON between its start and end events, and that is
+            // progress, not a hang. While a tool is in flight the idle expiry defers
+            // and re-arms instead of aborting; the wall-clock timer stays the
+            // backstop for a tool that is genuinely hung.
+            let inFlightTools = 0;
             let idleTimer;
             const armIdle = () => {
                 if (idleTimer)
                     clearTimeout(idleTimer);
-                idleTimer = setTimeout(fireTimeout, policy.idleTimeoutMs);
+                idleTimer = setTimeout(fireIdle, policy.idleTimeoutMs);
                 idleTimer.unref?.();
             };
+            const fireIdle = () => {
+                if (inFlightTools > 0) {
+                    armIdle();
+                    return;
+                }
+                fireTimeout();
+            };
             const wallTimer = setTimeout(fireTimeout, policy.wallTimeoutMs);
             wallTimer.unref?.();
             armIdle();
             const originalOnEvent = deps.onEvent;
             const onEvent = (ev) => {
                 sawAnyEvent = true;
+                if (ev.type === "tool_execution_start")
+                    inFlightTools += 1;
+                else if (ev.type === "tool_execution_end")
+                    inFlightTools = Math.max(0, inFlightTools - 1);
                 armIdle(); // reset the idle window on every live event
                 originalOnEvent?.(ev);
             };

package/dist/extension/pipeline/runRegistry.d.ts

@@ -22,8 +22,16 @@
  * candidate).
  */
 import type { CheckpointRecord, StopReason } from "./types.js";
-/** Bound on simultaneously in-flight /go runs in one process (spec §3b). */
+/** Default bound on simultaneously in-flight /go runs in one process (spec §3b). */
 export declare const MAX_CONCURRENT_RUNS = 3;
+/** Hard ceiling for the env override — a typo must not launch hundreds of runs. */
+export declare const MAX_CONCURRENT_RUNS_CEILING = 32;
+/**
+ * Resolve the in-flight /go cap from the environment. `YAGNI_MAX_CONCURRENT_RUNS`
+ * raises (or lowers) the default for fleet-scale operators; non-numeric or < 1
+ * falls back to the default, and anything above the ceiling clamps to it.
+ */
+export declare function resolveMaxConcurrentRuns(env?: Record<string, string | undefined>): number;
 /**
  * A non-terminal row whose journal has been quiet this long is treated as
  * INTERRUPTED (its process died) rather than still running elsewhere. Sits

package/dist/extension/pipeline/runRegistry.js

@@ -24,8 +24,22 @@
 import { appendFileSync, mkdirSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import { codeStateHome } from "../stateHome.js";
-/** Bound on simultaneously in-flight /go runs in one process (spec §3b). */
+/** Default bound on simultaneously in-flight /go runs in one process (spec §3b). */
 export const MAX_CONCURRENT_RUNS = 3;
+/** Hard ceiling for the env override — a typo must not launch hundreds of runs. */
+export const MAX_CONCURRENT_RUNS_CEILING = 32;
+/**
+ * Resolve the in-flight /go cap from the environment. `YAGNI_MAX_CONCURRENT_RUNS`
+ * raises (or lowers) the default for fleet-scale operators; non-numeric or < 1
+ * falls back to the default, and anything above the ceiling clamps to it.
+ */
+export function resolveMaxConcurrentRuns(env = process.env) {
+    const raw = env.YAGNI_MAX_CONCURRENT_RUNS?.trim();
+    const parsed = raw ? Number.parseInt(raw, 10) : NaN;
+    if (!Number.isFinite(parsed) || parsed < 1)
+        return MAX_CONCURRENT_RUNS;
+    return Math.min(parsed, MAX_CONCURRENT_RUNS_CEILING);
+}
 /**
  * A non-terminal row whose journal has been quiet this long is treated as
  * INTERRUPTED (its process died) rather than still running elsewhere. Sits
@@ -106,6 +120,13 @@ const active = new Map();
 export function _resetRunRegistryForTest() {
     active.clear();
 }
+// NOTE on growth: the mirror is append-only and grows without bound on a
+// long-lived install. In-place compaction was reviewed and REMOVED (PR #1698):
+// a fold+rewrite without cross-process exclusion can permanently erase another
+// process's terminal settle (nothing ever re-appends a final row), which would
+// resurrect a finished run as "interrupted" and invite duplicate worktree
+// adoption. Compaction needs an inter-process lock + unique temp files —
+// tracked separately; until then, growth is the safe failure mode.
 /** Fail-soft append of one full row to the mirror (self-heals a torn previous write). */
 function appendRow(row) {
     try {

package/dist/extension/todos.d.ts

@@ -17,6 +17,16 @@ import { Type } from "typebox";
 export declare const TODO_TOOL_NAME = "todo_write";
 export declare const MAX_TODOS = 50;
 export declare const MAX_TODO_TEXT = 300;
+/**
+ * Staleness-reminder throttle (both counters must trip): a reminder is
+ * eligible only after this many assistant turns since the last todo_write AND
+ * this many since the last reminder. The two-counter shape (staleness gate +
+ * anti-spam gate) mirrors what Claude Code ships for its own todo tool; the
+ * driver model routinely stops updating the board mid-grind (the frozen
+ * "Todos 0/8" report), and a bare description-level instruction does not
+ * survive a long run.
+ */
+export declare const TODO_REMINDER_TURNS = 10;
 /**
  * The desktop's structured state record rides its own widget key, like the
  * `/go` run state: one JSON line the app parses and renders itself, never
@@ -61,6 +71,23 @@ export interface TodoTheme {
 export declare function renderTodoWidget(todos: TodoItem[], theme: TodoTheme): string[];
 /** The desktop state record: exactly one JSON line under TODO_STATE_KEY. */
 export declare function todoStateLine(todos: TodoItem[]): string;
+/**
+ * PURE: is a staleness reminder due? Only when the board has open work (an
+ * empty or fully-completed list never nags) and BOTH throttle counters have
+ * reached {@link TODO_REMINDER_TURNS}.
+ */
+export declare function shouldRemindTodos(input: {
+    todos: TodoItem[];
+    turnsSinceWrite: number;
+    turnsSinceReminder: number;
+}): boolean;
+/**
+ * PURE: the hedged reminder block appended to a tool result when the board has
+ * gone stale. Carries the CURRENT list so the model can reconcile without a
+ * read, and explicitly licenses ignoring it, so an accurate board costs one
+ * glance rather than a spurious todo_write.
+ */
+export declare function formatTodoReminder(todos: TodoItem[]): string;
 /** Replay the branch: the last todo_write result is the canonical list. */
 export declare function reconstructTodos(entries: unknown[]): TodoItem[];
 type TodoParams = {
@@ -104,7 +131,7 @@ export declare function makeTodoTool(get: () => TodoItem[], set: (todos: TodoIte
         isError?: undefined;
     }>;
 };
-/** Wire the tool, the branch-replay events, and the /todos command. */
+/** Wire the tool, the branch-replay events, the staleness reminder, and /todos. */
 export declare function registerTodos(pi: ExtensionAPI): void;
 export {};
 //# sourceMappingURL=todos.d.ts.map

package/dist/extension/todos.js

@@ -17,6 +17,16 @@ import { isDesktopSurface } from "./surface.js";
 export const TODO_TOOL_NAME = "todo_write";
 export const MAX_TODOS = 50;
 export const MAX_TODO_TEXT = 300;
+/**
+ * Staleness-reminder throttle (both counters must trip): a reminder is
+ * eligible only after this many assistant turns since the last todo_write AND
+ * this many since the last reminder. The two-counter shape (staleness gate +
+ * anti-spam gate) mirrors what Claude Code ships for its own todo tool; the
+ * driver model routinely stops updating the board mid-grind (the frozen
+ * "Todos 0/8" report), and a bare description-level instruction does not
+ * survive a long run.
+ */
+export const TODO_REMINDER_TURNS = 10;
 const WIDGET_KEY = "yagni-todos";
 /**
  * The desktop's structured state record rides its own widget key, like the
@@ -101,6 +111,33 @@ export function renderTodoWidget(todos, theme) {
 export function todoStateLine(todos) {
     return JSON.stringify({ v: 1, todos });
 }
+/**
+ * PURE: is a staleness reminder due? Only when the board has open work (an
+ * empty or fully-completed list never nags) and BOTH throttle counters have
+ * reached {@link TODO_REMINDER_TURNS}.
+ */
+export function shouldRemindTodos(input) {
+    const { todos, turnsSinceWrite, turnsSinceReminder } = input;
+    if (todos.length === 0)
+        return false;
+    const { done, total } = todoSummary(todos);
+    if (done === total)
+        return false;
+    return turnsSinceWrite >= TODO_REMINDER_TURNS && turnsSinceReminder >= TODO_REMINDER_TURNS;
+}
+/**
+ * PURE: the hedged reminder block appended to a tool result when the board has
+ * gone stale. Carries the CURRENT list so the model can reconcile without a
+ * read, and explicitly licenses ignoring it, so an accurate board costs one
+ * glance rather than a spurious todo_write.
+ */
+export function formatTodoReminder(todos) {
+    return ("⟦YAGNI todos⟧ The todo_write checklist has not been updated for a while. " +
+        "If the work has moved on, bring it current now: mark finished steps completed, " +
+        "set the step you are on to in_progress, and add newly discovered steps. " +
+        "If the list is already accurate, ignore this.\n" +
+        formatTodoList(todos));
+}
 /** Replay the branch: the last todo_write result is the canonical list. */
 export function reconstructTodos(entries) {
     let todos = [];
@@ -186,9 +223,14 @@ export function makeTodoTool(get, set) {
         },
     };
 }
-/** Wire the tool, the branch-replay events, and the /todos command. */
+/** Wire the tool, the branch-replay events, the staleness reminder, and /todos. */
 export function registerTodos(pi) {
     let todos = [];
+    // Staleness-reminder counters (see TODO_REMINDER_TURNS). Session-local like
+    // the list cache itself; branch replay resets them so a resume/fork never
+    // opens with an instantly-due reminder.
+    let turnsSinceWrite = 0;
+    let turnsSinceReminder = 0;
     const reconstruct = (ctx) => {
         try {
             todos = reconstructTodos(ctx.sessionManager.getBranch());
@@ -196,12 +238,45 @@ export function registerTodos(pi) {
         catch {
             todos = [];
         }
+        turnsSinceWrite = 0;
+        turnsSinceReminder = 0;
         paintWidget(ctx, todos);
     };
     pi.on("session_start", async (_event, ctx) => reconstruct(ctx));
     pi.on("session_tree", async (_event, ctx) => reconstruct(ctx));
+    // Turn counting: one tick per finalized assistant message, the same "turn"
+    // the model experiences between opportunities to call todo_write.
+    pi.on("message_end", async (event) => {
+        if (event.message?.role === "assistant") {
+            turnsSinceWrite += 1;
+            turnsSinceReminder += 1;
+        }
+    });
+    // The reminder rides an existing tool result (the same result-modification
+    // seam ambient recall uses), so it reaches the model mid-run without
+    // spending a turn. Never appended to todo_write's own result, and fail-soft:
+    // a reminder must never break a tool call.
+    pi.on("tool_result", async (event) => {
+        try {
+            if (event.toolName === TODO_TOOL_NAME)
+                return;
+            if (!shouldRemindTodos({ todos, turnsSinceWrite, turnsSinceReminder }))
+                return;
+            turnsSinceReminder = 0;
+            return {
+                content: [
+                    ...event.content,
+                    { type: "text", text: `\n\n${formatTodoReminder(todos)}` },
+                ],
+            };
+        }
+        catch {
+            return;
+        }
+    });
     pi.registerTool(makeTodoTool(() => todos, (next) => {
         todos = next;
+        turnsSinceWrite = 0;
     }));
     pi.registerCommand("todos", {
         description: "Show the agent's current task list for this session.",

package/dist/extension/ultra.d.ts

@@ -4,10 +4,14 @@
  *
  * Off by default so the trial-default behavior is unchanged; toggling on swaps
  * the driver's delegation paragraph for the diamond directive (branding.ts's
- * YAGNI_IDENTITY_ULTRA, read live per turn in index.ts) and widens the
- * subagent tool's per-call fan-out ceiling (subagents.ts). Ultra is a prompt +
- * ceiling change only: it never touches the permission mode, the model tier,
- * or the /go pipeline.
+ * YAGNI_IDENTITY_ULTRA) and widens the subagent tool's per-call fan-out
+ * ceiling (subagents.ts). The two halves take effect at different moments:
+ * the fan-out ceiling is probed live on every subagent call, but the identity
+ * is read in index.ts's before_agent_start handler, which pi fires only when
+ * a NEW user prompt is submitted — a toggle mid-run leaves the running task on
+ * its existing instructions until the next message (the handler notifies when
+ * that is the case). Ultra is a prompt + ceiling change only: it never touches
+ * the permission mode, the model tier, or the /go pipeline.
  */
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 export interface UltraHolder {

package/dist/extension/ultra.js

@@ -4,10 +4,14 @@
  *
  * Off by default so the trial-default behavior is unchanged; toggling on swaps
  * the driver's delegation paragraph for the diamond directive (branding.ts's
- * YAGNI_IDENTITY_ULTRA, read live per turn in index.ts) and widens the
- * subagent tool's per-call fan-out ceiling (subagents.ts). Ultra is a prompt +
- * ceiling change only: it never touches the permission mode, the model tier,
- * or the /go pipeline.
+ * YAGNI_IDENTITY_ULTRA) and widens the subagent tool's per-call fan-out
+ * ceiling (subagents.ts). The two halves take effect at different moments:
+ * the fan-out ceiling is probed live on every subagent call, but the identity
+ * is read in index.ts's before_agent_start handler, which pi fires only when
+ * a NEW user prompt is submitted — a toggle mid-run leaves the running task on
+ * its existing instructions until the next message (the handler notifies when
+ * that is the case). Ultra is a prompt + ceiling change only: it never touches
+ * the permission mode, the model tier, or the /go pipeline.
  */
 export function createUltraHolder(initial = false) {
     let on = initial;
@@ -24,6 +28,13 @@ const ULTRA_ON_COPY = "Ultra mode ON: meaningful work fans out to parallel subag
     "verification agents try to break the result, then the agent synthesizes. " +
     "Expect more subagent spend per task.";
 const ULTRA_OFF_COPY = "Ultra mode OFF: back to delegate-when-useful.";
+/**
+ * Appended when the toggle lands mid-run: the identity swap only applies when
+ * the next prompt is submitted (see the module docblock), so without this note
+ * the chip flips while the running task visibly keeps its old behavior — which
+ * reads as ultra mode being broken.
+ */
+const MID_RUN_NOTE = " The task currently running keeps its existing instructions; the change takes full effect on your next message.";
 /**
  * Wire the /ultra command onto a shared holder. No argument toggles; `on` /
  * `off` set explicitly; `status` reports without changing anything.
@@ -54,7 +65,11 @@ export function registerUltraCommand(pi, holder) {
             catch {
                 // The chip is chrome; never let it break /ultra.
             }
-            notify(next ? ULTRA_ON_COPY : ULTRA_OFF_COPY, "info");
+            // Guarded probe: test fakes (and any minimal harness ctx) may not carry
+            // isIdle, and its absence must read as idle, never as busy.
+            const midRun = typeof ctx.isIdle === "function" && !ctx.isIdle();
+            const copy = next ? ULTRA_ON_COPY : ULTRA_OFF_COPY;
+            notify(midRun ? copy + MID_RUN_NOTE : copy, "info");
         },
     });
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yagni-app/code-staging",
-  "version": "0.3.0-staging.1088.1",
+  "version": "0.3.0-staging.1091.1",
   "description": "YAGNI Code: a terminal coding agent that already knows your company. One YAGNI login routes the model and grounds the agent in your team's context.",
   "license": "SEE LICENSE IN LICENSE.md",
   "author": "YAGNI, Inc. <jack@yagni.app> (https://yagni.app)",
@@ -38,5 +38,5 @@
     "@earendil-works/pi-tui": "0.84.1",
     "typebox": "^1.3.11"
   },
-  "yagniSourceSha": "eebceee1a0d1673dd4b2755942aa027a89f18611"
+  "yagniSourceSha": "50ccbb69838d6ee20a0b0d7a7b7259105158f215"
 }