@yagni-app/code-staging 0.3.0-staging.1090.1 → 0.3.0-staging.1093.1

package/dist/extension/askAdvisorTool.d.ts

@@ -30,7 +30,7 @@ import { type Component } from "@earendil-works/pi-tui";
 import { Type } from "typebox";
 import { type AdvisorLimits, type AdvisorStateHandle } from "./advisor.js";
 import { runStage as defaultRunStage } from "./pipeline/runner.js";
-import type { PipelineStage } from "./pipeline/types.js";
+import { type PipelineStage } from "./pipeline/types.js";
 import { type RenderTheme, type SubagentTaskProgress } from "./subagentRender.js";
 /**
  * Read-only recon plus grounding. Mirrors the `plan` stage's allowlist for the

package/dist/extension/askAdvisorTool.js

@@ -29,7 +29,9 @@ import { Text } from "@earendil-works/pi-tui";
 import { Type } from "typebox";
 import { ADVISOR_MODEL_TIER, DEFAULT_ADVISOR_LIMITS, decideConsult, formatConsultCost, } from "./advisor.js";
 import { SPINNER_FRAMES } from "./pipeline/activityFeed.js";
+import { withResilience } from "./pipeline/resilience.js";
 import { runStage as defaultRunStage } from "./pipeline/runner.js";
+import { DEFAULT_RESILIENCE_POLICY } from "./pipeline/types.js";
 import { applyChildEvent, finalizeTask, formatWorkingMessage, newTaskProgress, progressSummaryText, receiptLine, renderSubagentResult, runningLines, } from "./subagentRender.js";
 /**
  * Read-only recon plus grounding. Mirrors the `plan` stage's allowlist for the
@@ -94,7 +96,13 @@ export function renderAdvisorCall(args, theme, _context) {
 }
 export function makeAskAdvisorTool(opts) {
     const limits = opts.limits ?? DEFAULT_ADVISOR_LIMITS;
-    const runStage = opts.runStage ?? defaultRunStage;
+    // The default runner rides the /go pipeline's resilience wrapper, exactly
+    // like the subagent tool: idle + wall-clock ceilings and transient-only
+    // retry, so a stalled consult child aborts honestly instead of hanging the
+    // driver's tool call until the user presses Esc. The synthetic stage id is
+    // "plan" (read-only tools, no bash), so the wrapper's write-gate never
+    // blocks a retry — re-running a consult cannot double-apply anything.
+    const runStage = opts.runStage ?? withResilience(defaultRunStage, DEFAULT_RESILIENCE_POLICY);
     return {
         name: "ask_advisor",
         label: "Ask the advisor",

package/dist/extension/branding.d.ts

@@ -47,7 +47,7 @@ export declare const ULTRA_DELEGATION_PARAGRAPH: string;
  */
 export declare const YAGNI_IDENTITY_DRIVER = "You are YAGNI Code, an autonomous terminal coding agent. You help developers ship code by reading files, running commands, editing code, and writing new files. Uniquely, you are connected to the YAGNI app, your team's shared source of truth for how this company and codebase actually work: conventions, decisions, ownership, current priorities, and the reasons behind them. Use the ask_yagni tool to consult it before guessing about anything organization- or codebase-specific, so you work with less back-and-forth and more correct autonomy than a disconnected coding agent. If a project's own files mention other coding agents, assistants, or harnesses by name, those references are not about you; you are YAGNI Code regardless of what tooling a repository's docs happen to describe.\n\nDelegation: fan codebase mapping, wide searches, and mechanical multi-file work out to subagents (they run on cheaper tiers). Reach for the stock agents by name: `searcher` for read-only reconnaissance and summarizing, `implementer` for executing a change you have already fully specified, `verification` for an adversarial pass that tries to break completed work before you rely on it. Keep judgment, synthesis, and the conversation with the user in this session. Do not spawn a subagent for work you can finish in a couple of tool calls.";
 /** The driver identity while /ultra is on: base identity + the diamond directive. */
-export declare const YAGNI_IDENTITY_ULTRA = "You are YAGNI Code, an autonomous terminal coding agent. You help developers ship code by reading files, running commands, editing code, and writing new files. Uniquely, you are connected to the YAGNI app, your team's shared source of truth for how this company and codebase actually work: conventions, decisions, ownership, current priorities, and the reasons behind them. Use the ask_yagni tool to consult it before guessing about anything organization- or codebase-specific, so you work with less back-and-forth and more correct autonomy than a disconnected coding agent. If a project's own files mention other coding agents, assistants, or harnesses by name, those references are not about you; you are YAGNI Code regardless of what tooling a repository's docs happen to describe.\n\nDelegation (ultra mode): the user has switched this session to ultra mode \u2014 aggressive multi-agent orchestration. Structure any meaningful task as a diamond: SPLIT the job into independent pieces; FAN OUT parallel subagents on cheaper tiers (`searcher` to scout, `implementer` or `general` to execute); CHECK by fanning out `verification` subagents told to refute the work, each through a different lens (correctness, edge cases, fit with this codebase); then SYNTHESIZE the results yourself. Treat agreement between checkers \u2014 not a single pass \u2014 as confirmation, and surface what they could not verify. Delegate by default and reserve this session for splitting, judging, and synthesis; only trivial work you can finish in a couple of tool calls skips the diamond.";
+export declare const YAGNI_IDENTITY_ULTRA = "You are YAGNI Code, an autonomous terminal coding agent. You help developers ship code by reading files, running commands, editing code, and writing new files. Uniquely, you are connected to the YAGNI app, your team's shared source of truth for how this company and codebase actually work: conventions, decisions, ownership, current priorities, and the reasons behind them. Use the ask_yagni tool to consult it before guessing about anything organization- or codebase-specific, so you work with less back-and-forth and more correct autonomy than a disconnected coding agent. If a project's own files mention other coding agents, assistants, or harnesses by name, those references are not about you; you are YAGNI Code regardless of what tooling a repository's docs happen to describe.\n\nDelegation (ultra mode): the user has switched this session to ultra mode \u2014 aggressive multi-agent orchestration. Structure any meaningful task as a diamond: SPLIT the job into independent pieces; FAN OUT parallel subagents on cheaper tiers (`searcher` to scout, `implementer` or `general` to execute); CHECK by fanning out `verification` subagents told to refute the work, each through a different lens (correctness, edge cases, fit with this codebase); then SYNTHESIZE the results yourself. Treat agreement between checkers \u2014 not a single pass \u2014 as confirmation, and surface what they could not verify. Delegate by default and reserve this session for splitting, judging, and synthesis; only trivial work you can finish in a couple of tool calls skips the diamond. Subagents cannot touch your todo_write checklist, so keep it current yourself: update it when you split the job and again as each fanned-out piece lands, not only at the end.";
 export declare const PI_IDENTITY_RE: RegExp;
 /**
  * Env switch that bypasses the system-prompt rewrite entirely, so pi's

package/dist/extension/branding.js

@@ -64,7 +64,9 @@ export const ULTRA_DELEGATION_PARAGRAPH = "Delegation (ultra mode): the user has
     "agreement between checkers — not a single pass — as confirmation, and " +
     "surface what they could not verify. Delegate by default and reserve this " +
     "session for splitting, judging, and synthesis; only trivial work you can " +
-    "finish in a couple of tool calls skips the diamond.";
+    "finish in a couple of tool calls skips the diamond. Subagents cannot touch " +
+    "your todo_write checklist, so keep it current yourself: update it when you " +
+    "split the job and again as each fanned-out piece lands, not only at the end.";
 /**
  * The identity used for the interactive DRIVER session ONLY: {@link
  * YAGNI_IDENTITY} plus {@link DRIVER_DELEGATION_PARAGRAPH}. The caller (index.ts)

package/dist/extension/guardian.js

@@ -29,7 +29,7 @@
  */
 import { runStage as defaultRunStage } from "./pipeline/runner.js";
 export const DEFAULT_GUARDIAN_LIMITS = {
-    maxReviews: 30,
+    maxReviews: 120,
     maxConsecutiveDenials: 3,
     timeoutMs: 15_000,
 };

package/dist/extension/index.d.ts

@@ -143,7 +143,7 @@ export type { ComparisonReport, LaneFit, LaneOutcome } from "./pipeline/eval.js"
 export { registerGoCompareCommand } from "./pipeline/goCompareCommand.js";
 export { registerSubagents, makeSubagentTool, discoverSubagents, parseAgentMarkdown, buildSubagentStage, formatAgentList, mapModelTier, SUBAGENT_TOOL_NAME, GENERAL_AGENT_NAME, MAX_PARALLEL_SUBAGENTS, MAX_PARALLEL_SUBAGENTS_ULTRA, DEFAULT_SUBAGENT_TOOLS, } from "./subagents.js";
 export type { SubagentDef, SubagentSource } from "./subagents.js";
-export { registerTodos, makeTodoTool, normalizeTodos, reconstructTodos, renderTodoWidget, formatTodoList, todoSummary, TODO_TOOL_NAME, MAX_TODOS, } from "./todos.js";
+export { registerTodos, makeTodoTool, normalizeTodos, reconstructTodos, renderTodoWidget, formatTodoList, formatTodoReminder, shouldRemindTodos, todoSummary, TODO_TOOL_NAME, TODO_REMINDER_TURNS, MAX_TODOS, } from "./todos.js";
 export type { TodoItem, TodoStatus, TodoTheme } from "./todos.js";
 export { decideGate, registerPermissionGate, filterStaleModeContext, filterStalePlanContext, buildModeContextMessage, DEFAULT_PERMISSION_POLICY, MODE_CONTEXT_TYPE, PLAN_CONTEXT_TYPE, PLAN_CONTEXT_MESSAGE, } from "./permission.js";
 export { classifyCommand, DEFAULT_EXEC_POLICY, } from "./execPolicy.js";

package/dist/extension/index.js

@@ -814,7 +814,7 @@ export { registerGoCompareCommand } from "./pipeline/goCompareCommand.js";
 // The general subagent tool: Claude Code-format agent discovery + fan-out.
 export { registerSubagents, makeSubagentTool, discoverSubagents, parseAgentMarkdown, buildSubagentStage, formatAgentList, mapModelTier, SUBAGENT_TOOL_NAME, GENERAL_AGENT_NAME, MAX_PARALLEL_SUBAGENTS, MAX_PARALLEL_SUBAGENTS_ULTRA, DEFAULT_SUBAGENT_TOOLS, } from "./subagents.js";
 // The session todo checklist: todo_write tool, widget renderer, /todos.
-export { registerTodos, makeTodoTool, normalizeTodos, reconstructTodos, renderTodoWidget, formatTodoList, todoSummary, TODO_TOOL_NAME, MAX_TODOS, } from "./todos.js";
+export { registerTodos, makeTodoTool, normalizeTodos, reconstructTodos, renderTodoWidget, formatTodoList, formatTodoReminder, shouldRemindTodos, todoSummary, TODO_TOOL_NAME, TODO_REMINDER_TURNS, MAX_TODOS, } from "./todos.js";
 // P3 + W4: the permission gate seam (decideGate is pure; policy injectable) plus
 // the session bless-with-remember capture hook.
 export { decideGate, registerPermissionGate, filterStaleModeContext, filterStalePlanContext, buildModeContextMessage, DEFAULT_PERMISSION_POLICY, MODE_CONTEXT_TYPE, PLAN_CONTEXT_TYPE, PLAN_CONTEXT_MESSAGE, } from "./permission.js";

package/dist/extension/pipeline/resilience.d.ts

@@ -4,7 +4,8 @@
  * `withResilience(runStage, policy)` is a composable higher-order function that
  * wraps the per-stage child spawn (`runner.ts#runStage`) with the one axis the
  * roadmap calls the whole competitive gap: a per-stage IDLE timeout (no NDJSON
- * event for N ms) and a total WALL-CLOCK timeout, both firing the runner's
+ * event for N ms, deferred while a tool is in flight — see the stall note at
+ * the timer wiring) and a total WALL-CLOCK timeout, both firing the runner's
  * existing SIGTERM -> SIGKILL abort; bounded exponential backoff with jitter; and
  * retry of CLASSIFIED-TRANSIENT outcomes only. One structured telemetry record is
  * emitted per attempt.

package/dist/extension/pipeline/resilience.js

@@ -4,7 +4,8 @@
  * `withResilience(runStage, policy)` is a composable higher-order function that
  * wraps the per-stage child spawn (`runner.ts#runStage`) with the one axis the
  * roadmap calls the whole competitive gap: a per-stage IDLE timeout (no NDJSON
- * event for N ms) and a total WALL-CLOCK timeout, both firing the runner's
+ * event for N ms, deferred while a tool is in flight — see the stall note at
+ * the timer wiring) and a total WALL-CLOCK timeout, both firing the runner's
  * existing SIGTERM -> SIGKILL abort; bounded exponential backoff with jitter; and
  * retry of CLASSIFIED-TRANSIENT outcomes only. One structured telemetry record is
  * emitted per attempt.
@@ -100,19 +101,37 @@ export function withResilience(base, policy, opts = {}) {
                 if (!timeoutController.signal.aborted)
                     timeoutController.abort();
             };
+            // Tools the child has started but not finished. The idle window measures
+            // STALL, not silence: a long quiet tool (a 6-minute test suite, a slow
+            // build) emits no NDJSON between its start and end events, and that is
+            // progress, not a hang. While a tool is in flight the idle expiry defers
+            // and re-arms instead of aborting; the wall-clock timer stays the
+            // backstop for a tool that is genuinely hung.
+            let inFlightTools = 0;
             let idleTimer;
             const armIdle = () => {
                 if (idleTimer)
                     clearTimeout(idleTimer);
-                idleTimer = setTimeout(fireTimeout, policy.idleTimeoutMs);
+                idleTimer = setTimeout(fireIdle, policy.idleTimeoutMs);
                 idleTimer.unref?.();
             };
+            const fireIdle = () => {
+                if (inFlightTools > 0) {
+                    armIdle();
+                    return;
+                }
+                fireTimeout();
+            };
             const wallTimer = setTimeout(fireTimeout, policy.wallTimeoutMs);
             wallTimer.unref?.();
             armIdle();
             const originalOnEvent = deps.onEvent;
             const onEvent = (ev) => {
                 sawAnyEvent = true;
+                if (ev.type === "tool_execution_start")
+                    inFlightTools += 1;
+                else if (ev.type === "tool_execution_end")
+                    inFlightTools = Math.max(0, inFlightTools - 1);
                 armIdle(); // reset the idle window on every live event
                 originalOnEvent?.(ev);
             };

package/dist/extension/todos.d.ts

@@ -17,6 +17,16 @@ import { Type } from "typebox";
 export declare const TODO_TOOL_NAME = "todo_write";
 export declare const MAX_TODOS = 50;
 export declare const MAX_TODO_TEXT = 300;
+/**
+ * Staleness-reminder throttle (both counters must trip): a reminder is
+ * eligible only after this many assistant turns since the last todo_write AND
+ * this many since the last reminder. The two-counter shape (staleness gate +
+ * anti-spam gate) mirrors what Claude Code ships for its own todo tool; the
+ * driver model routinely stops updating the board mid-grind (the frozen
+ * "Todos 0/8" report), and a bare description-level instruction does not
+ * survive a long run.
+ */
+export declare const TODO_REMINDER_TURNS = 10;
 /**
  * The desktop's structured state record rides its own widget key, like the
  * `/go` run state: one JSON line the app parses and renders itself, never
@@ -61,6 +71,23 @@ export interface TodoTheme {
 export declare function renderTodoWidget(todos: TodoItem[], theme: TodoTheme): string[];
 /** The desktop state record: exactly one JSON line under TODO_STATE_KEY. */
 export declare function todoStateLine(todos: TodoItem[]): string;
+/**
+ * PURE: is a staleness reminder due? Only when the board has open work (an
+ * empty or fully-completed list never nags) and BOTH throttle counters have
+ * reached {@link TODO_REMINDER_TURNS}.
+ */
+export declare function shouldRemindTodos(input: {
+    todos: TodoItem[];
+    turnsSinceWrite: number;
+    turnsSinceReminder: number;
+}): boolean;
+/**
+ * PURE: the hedged reminder block appended to a tool result when the board has
+ * gone stale. Carries the CURRENT list so the model can reconcile without a
+ * read, and explicitly licenses ignoring it, so an accurate board costs one
+ * glance rather than a spurious todo_write.
+ */
+export declare function formatTodoReminder(todos: TodoItem[]): string;
 /** Replay the branch: the last todo_write result is the canonical list. */
 export declare function reconstructTodos(entries: unknown[]): TodoItem[];
 type TodoParams = {
@@ -104,7 +131,7 @@ export declare function makeTodoTool(get: () => TodoItem[], set: (todos: TodoIte
         isError?: undefined;
     }>;
 };
-/** Wire the tool, the branch-replay events, and the /todos command. */
+/** Wire the tool, the branch-replay events, the staleness reminder, and /todos. */
 export declare function registerTodos(pi: ExtensionAPI): void;
 export {};
 //# sourceMappingURL=todos.d.ts.map

package/dist/extension/todos.js

@@ -17,6 +17,16 @@ import { isDesktopSurface } from "./surface.js";
 export const TODO_TOOL_NAME = "todo_write";
 export const MAX_TODOS = 50;
 export const MAX_TODO_TEXT = 300;
+/**
+ * Staleness-reminder throttle (both counters must trip): a reminder is
+ * eligible only after this many assistant turns since the last todo_write AND
+ * this many since the last reminder. The two-counter shape (staleness gate +
+ * anti-spam gate) mirrors what Claude Code ships for its own todo tool; the
+ * driver model routinely stops updating the board mid-grind (the frozen
+ * "Todos 0/8" report), and a bare description-level instruction does not
+ * survive a long run.
+ */
+export const TODO_REMINDER_TURNS = 10;
 const WIDGET_KEY = "yagni-todos";
 /**
  * The desktop's structured state record rides its own widget key, like the
@@ -101,6 +111,33 @@ export function renderTodoWidget(todos, theme) {
 export function todoStateLine(todos) {
     return JSON.stringify({ v: 1, todos });
 }
+/**
+ * PURE: is a staleness reminder due? Only when the board has open work (an
+ * empty or fully-completed list never nags) and BOTH throttle counters have
+ * reached {@link TODO_REMINDER_TURNS}.
+ */
+export function shouldRemindTodos(input) {
+    const { todos, turnsSinceWrite, turnsSinceReminder } = input;
+    if (todos.length === 0)
+        return false;
+    const { done, total } = todoSummary(todos);
+    if (done === total)
+        return false;
+    return turnsSinceWrite >= TODO_REMINDER_TURNS && turnsSinceReminder >= TODO_REMINDER_TURNS;
+}
+/**
+ * PURE: the hedged reminder block appended to a tool result when the board has
+ * gone stale. Carries the CURRENT list so the model can reconcile without a
+ * read, and explicitly licenses ignoring it, so an accurate board costs one
+ * glance rather than a spurious todo_write.
+ */
+export function formatTodoReminder(todos) {
+    return ("⟦YAGNI todos⟧ The todo_write checklist has not been updated for a while. " +
+        "If the work has moved on, bring it current now: mark finished steps completed, " +
+        "set the step you are on to in_progress, and add newly discovered steps. " +
+        "If the list is already accurate, ignore this.\n" +
+        formatTodoList(todos));
+}
 /** Replay the branch: the last todo_write result is the canonical list. */
 export function reconstructTodos(entries) {
     let todos = [];
@@ -186,9 +223,14 @@ export function makeTodoTool(get, set) {
         },
     };
 }
-/** Wire the tool, the branch-replay events, and the /todos command. */
+/** Wire the tool, the branch-replay events, the staleness reminder, and /todos. */
 export function registerTodos(pi) {
     let todos = [];
+    // Staleness-reminder counters (see TODO_REMINDER_TURNS). Session-local like
+    // the list cache itself; branch replay resets them so a resume/fork never
+    // opens with an instantly-due reminder.
+    let turnsSinceWrite = 0;
+    let turnsSinceReminder = 0;
     const reconstruct = (ctx) => {
         try {
             todos = reconstructTodos(ctx.sessionManager.getBranch());
@@ -196,12 +238,45 @@ export function registerTodos(pi) {
         catch {
             todos = [];
         }
+        turnsSinceWrite = 0;
+        turnsSinceReminder = 0;
         paintWidget(ctx, todos);
     };
     pi.on("session_start", async (_event, ctx) => reconstruct(ctx));
     pi.on("session_tree", async (_event, ctx) => reconstruct(ctx));
+    // Turn counting: one tick per finalized assistant message, the same "turn"
+    // the model experiences between opportunities to call todo_write.
+    pi.on("message_end", async (event) => {
+        if (event.message?.role === "assistant") {
+            turnsSinceWrite += 1;
+            turnsSinceReminder += 1;
+        }
+    });
+    // The reminder rides an existing tool result (the same result-modification
+    // seam ambient recall uses), so it reaches the model mid-run without
+    // spending a turn. Never appended to todo_write's own result, and fail-soft:
+    // a reminder must never break a tool call.
+    pi.on("tool_result", async (event) => {
+        try {
+            if (event.toolName === TODO_TOOL_NAME)
+                return;
+            if (!shouldRemindTodos({ todos, turnsSinceWrite, turnsSinceReminder }))
+                return;
+            turnsSinceReminder = 0;
+            return {
+                content: [
+                    ...event.content,
+                    { type: "text", text: `\n\n${formatTodoReminder(todos)}` },
+                ],
+            };
+        }
+        catch {
+            return;
+        }
+    });
     pi.registerTool(makeTodoTool(() => todos, (next) => {
         todos = next;
+        turnsSinceWrite = 0;
     }));
     pi.registerCommand("todos", {
         description: "Show the agent's current task list for this session.",

package/dist/extension/ultra.d.ts

@@ -4,10 +4,14 @@
  *
  * Off by default so the trial-default behavior is unchanged; toggling on swaps
  * the driver's delegation paragraph for the diamond directive (branding.ts's
- * YAGNI_IDENTITY_ULTRA, read live per turn in index.ts) and widens the
- * subagent tool's per-call fan-out ceiling (subagents.ts). Ultra is a prompt +
- * ceiling change only: it never touches the permission mode, the model tier,
- * or the /go pipeline.
+ * YAGNI_IDENTITY_ULTRA) and widens the subagent tool's per-call fan-out
+ * ceiling (subagents.ts). The two halves take effect at different moments:
+ * the fan-out ceiling is probed live on every subagent call, but the identity
+ * is read in index.ts's before_agent_start handler, which pi fires only when
+ * a NEW user prompt is submitted — a toggle mid-run leaves the running task on
+ * its existing instructions until the next message (the handler notifies when
+ * that is the case). Ultra is a prompt + ceiling change only: it never touches
+ * the permission mode, the model tier, or the /go pipeline.
  */
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 export interface UltraHolder {

package/dist/extension/ultra.js

@@ -4,10 +4,14 @@
  *
  * Off by default so the trial-default behavior is unchanged; toggling on swaps
  * the driver's delegation paragraph for the diamond directive (branding.ts's
- * YAGNI_IDENTITY_ULTRA, read live per turn in index.ts) and widens the
- * subagent tool's per-call fan-out ceiling (subagents.ts). Ultra is a prompt +
- * ceiling change only: it never touches the permission mode, the model tier,
- * or the /go pipeline.
+ * YAGNI_IDENTITY_ULTRA) and widens the subagent tool's per-call fan-out
+ * ceiling (subagents.ts). The two halves take effect at different moments:
+ * the fan-out ceiling is probed live on every subagent call, but the identity
+ * is read in index.ts's before_agent_start handler, which pi fires only when
+ * a NEW user prompt is submitted — a toggle mid-run leaves the running task on
+ * its existing instructions until the next message (the handler notifies when
+ * that is the case). Ultra is a prompt + ceiling change only: it never touches
+ * the permission mode, the model tier, or the /go pipeline.
  */
 export function createUltraHolder(initial = false) {
     let on = initial;
@@ -24,6 +28,13 @@ const ULTRA_ON_COPY = "Ultra mode ON: meaningful work fans out to parallel subag
     "verification agents try to break the result, then the agent synthesizes. " +
     "Expect more subagent spend per task.";
 const ULTRA_OFF_COPY = "Ultra mode OFF: back to delegate-when-useful.";
+/**
+ * Appended when the toggle lands mid-run: the identity swap only applies when
+ * the next prompt is submitted (see the module docblock), so without this note
+ * the chip flips while the running task visibly keeps its old behavior — which
+ * reads as ultra mode being broken.
+ */
+const MID_RUN_NOTE = " The task currently running keeps its existing instructions; the change takes full effect on your next message.";
 /**
  * Wire the /ultra command onto a shared holder. No argument toggles; `on` /
  * `off` set explicitly; `status` reports without changing anything.
@@ -54,7 +65,11 @@ export function registerUltraCommand(pi, holder) {
             catch {
                 // The chip is chrome; never let it break /ultra.
             }
-            notify(next ? ULTRA_ON_COPY : ULTRA_OFF_COPY, "info");
+            // Guarded probe: test fakes (and any minimal harness ctx) may not carry
+            // isIdle, and its absence must read as idle, never as busy.
+            const midRun = typeof ctx.isIdle === "function" && !ctx.isIdle();
+            const copy = next ? ULTRA_ON_COPY : ULTRA_OFF_COPY;
+            notify(midRun ? copy + MID_RUN_NOTE : copy, "info");
         },
     });
 }

package/dist/login.d.ts

@@ -34,8 +34,10 @@ type OpenRunner = (cmd: string, args: string[]) => Promise<void>;
  *
  *   macOS:   open <url>
  *   Linux:   xdg-open <url>
- *   Windows: cmd /c start "" <url>   (the empty "" is start's window-title slot;
- *            without it `start` swallows the URL as the title and opens nothing)
+ *   Windows: rundll32 url.dll,FileProtocolHandler <url>   (opens the default
+ *            browser without going through cmd.exe — `cmd /c start <url>`
+ *            re-parses its arguments as a shell line, so a hostile URL with
+ *            `&`/`^` metacharacters could execute commands)
  */
 export declare function resolveOpenCommand(url: string, platform?: NodeJS.Platform): {
     cmd: string;

package/dist/login.js

@@ -31,14 +31,17 @@ function isTimeoutError(err) {
  *
  *   macOS:   open <url>
  *   Linux:   xdg-open <url>
- *   Windows: cmd /c start "" <url>   (the empty "" is start's window-title slot;
- *            without it `start` swallows the URL as the title and opens nothing)
+ *   Windows: rundll32 url.dll,FileProtocolHandler <url>   (opens the default
+ *            browser without going through cmd.exe — `cmd /c start <url>`
+ *            re-parses its arguments as a shell line, so a hostile URL with
+ *            `&`/`^` metacharacters could execute commands)
  */
 export function resolveOpenCommand(url, platform = process.platform) {
     if (platform === "darwin")
         return { cmd: "open", args: [url] };
-    if (platform === "win32")
-        return { cmd: "cmd", args: ["/c", "start", "", url] };
+    if (platform === "win32") {
+        return { cmd: "rundll32", args: ["url.dll,FileProtocolHandler", url] };
+    }
     return { cmd: "xdg-open", args: [url] };
 }
 const spawnRunner = (cmd, args) => new Promise((resolve, reject) => {
@@ -50,6 +53,18 @@ const spawnRunner = (cmd, args) => new Promise((resolve, reject) => {
  * URL is still printed for manual copy. `runner` is injectable for tests.
  */
 export const realOpenUrl = (url, runner = spawnRunner) => {
+    // Only ever hand http(s) URLs to the OS opener — refuse file:, javascript:,
+    // or custom schemes a compromised server response could try to smuggle in.
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        return Promise.resolve();
+    }
+    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+        return Promise.resolve();
+    }
     const { cmd, args } = resolveOpenCommand(url);
     return runner(cmd, args).catch(() => {
         // Silently fail — the user can still copy the URL manually.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yagni-app/code-staging",
-  "version": "0.3.0-staging.1090.1",
+  "version": "0.3.0-staging.1093.1",
   "description": "YAGNI Code: a terminal coding agent that already knows your company. One YAGNI login routes the model and grounds the agent in your team's context.",
   "license": "SEE LICENSE IN LICENSE.md",
   "author": "YAGNI, Inc. <jack@yagni.app> (https://yagni.app)",
@@ -38,5 +38,5 @@
     "@earendil-works/pi-tui": "0.84.1",
     "typebox": "^1.3.11"
   },
-  "yagniSourceSha": "79e1523affbd694ad96a236da6aefe33000497d8"
+  "yagniSourceSha": "189159f08a0b5f7ab5cf10221f8238782ff7d1f7"
 }