@yagni-app/code-staging 0.3.4-staging.1145.1 → 0.3.4-staging.1148.1

package/dist/extension/config.d.ts

@@ -90,6 +90,14 @@ export interface CatalogResult {
      * "off" (fail toward not sending).
      */
     guardianStorage: GuardianStorageTier;
+    /**
+     * Backend-owned per-request Guardian wall ceiling (YAG-562). The client
+     * derives its whole-consult deadline from this instead of a hardcoded abort.
+     * Absent on older backends → the extension falls back to its default.
+     */
+    guardianTimeoutMs?: number;
+    /** Number of attempts the backend makes (primary + one failover). */
+    guardianMaxAttempts?: number;
 }
 /**
  * Fetch the YAGNI model catalog at startup.

package/dist/extension/config.js

@@ -91,6 +91,12 @@ export async function fetchCatalog(opts) {
         guardianStorage: data.guardianStorage === "raw" || data.guardianStorage === "hash"
             ? data.guardianStorage
             : "off",
+        ...(typeof data.guardianTimeoutMs === "number" && Number.isFinite(data.guardianTimeoutMs) && data.guardianTimeoutMs > 0
+            ? { guardianTimeoutMs: data.guardianTimeoutMs }
+            : {}),
+        ...(typeof data.guardianMaxAttempts === "number" && Number.isSafeInteger(data.guardianMaxAttempts) && data.guardianMaxAttempts >= 1
+            ? { guardianMaxAttempts: data.guardianMaxAttempts }
+            : {}),
     };
 }
 /** Shape-check for a caller label: mirrors the model proxy's own validation regex. */

package/dist/extension/index.d.ts

@@ -121,7 +121,7 @@ export { makeAskYagniTool } from "./askYagniTool.js";
 export { makeFileTicketTool, makeUpdateTicketStatusTool } from "./ticketTools.js";
 export { makeAskAdvisorTool, registerAdviseCommand } from "./askAdvisorTool.js";
 export { ADVISOR_TIER, DEFAULT_ADVISOR_LIMITS, decideConsult, formatAdvisorSubtotal, makeAdvisorState, } from "./advisor.js";
-export { DEFAULT_GUARDIAN_LIMITS, GUARDIAN_MODEL_TIER, formatGuardianSubtotal, makeGuardianState, resolveGuardianLimits, reviewCommand, } from "./permission/guardian.js";
+export { DEFAULT_GUARDIAN_LIMITS, GUARDIAN_MODEL_TIER, formatGuardianSubtotal, makeGuardianState, resolveGuardianLimits, reviewCommand, deriveGuardianTimeoutMs, } from "./permission/guardian.js";
 export type { GuardianOutcome, GuardianVerdict, GuardianState, GuardianStateHandle, GuardianLimits, ReviewResult, ReviewCommandDeps, } from "./permission/guardian.js";
 export type { Citation, MakeAskYagniToolOptions } from "./askYagniTool.js";
 export { makeReviewBusinessMatchTool } from "./reviewTool.js";

package/dist/extension/index.js

@@ -5,7 +5,7 @@ import { Text } from "@earendil-works/pi-tui";
 import { DEFAULT_ADVISOR_LIMITS, formatAdvisorSubtotal, makeAdvisorState } from "./advisor.js";
 import { appendGrant, loadGrants, resolveRepoKey, storagePrefix } from "./permission/approvedPrefixes.js";
 import { redactCommand } from "./redact.js";
-import { formatGuardianSubtotal, GUARDIAN_MODEL_TIER, makeGuardianState, resolveGuardianLimits, reviewCommand } from "./permission/guardian.js";
+import { formatGuardianSubtotal, GUARDIAN_MODEL_TIER, makeGuardianState, resolveGuardianLimits, reviewCommand, deriveGuardianTimeoutMs } from "./permission/guardian.js";
 import { makeAskAdvisorTool, registerAdviseCommand } from "./askAdvisorTool.js";
 import { makeAskYagniTool } from "./askYagniTool.js";
 import { makeFileTicketTool, makeUpdateTicketStatusTool } from "./ticketTools.js";
@@ -135,7 +135,7 @@ export async function registerYagni(pi, deps = {}) {
     // after_provider_response event does NOT fire on a 401 (the OpenAI SDK throws
     // before onResponse is reached), so message_end is the only seam.
     let lastAuthRecovery = null;
-    const { models: fullCatalog, guardianEnabled: workspaceGuardianEnabled, guardianStorage: guardianStorageTier, } = await fetchCatalog({ baseUrl, getToken: getTokenFn, fetchImpl: authedFetch });
+    const { models: fullCatalog, guardianEnabled: workspaceGuardianEnabled, guardianStorage: guardianStorageTier, guardianTimeoutMs: guardianTimeoutAdvertisedMs, guardianMaxAttempts: guardianMaxAttemptsAdvertised, } = await fetchCatalog({ baseUrl, getToken: getTokenFn, fetchImpl: authedFetch });
     // Lock the interactive session to the `advanced` tier only. The backend
     // catalog returns all tiers, but only `advanced` is registered with the
     // `yagni` provider, so /model and Ctrl+P show a single entry. Child
@@ -272,6 +272,16 @@ export async function registerYagni(pi, deps = {}) {
         !workspaceGuardianEnabled;
     const guardianTier = env.YAGNI_GUARDIAN_TIER ?? GUARDIAN_MODEL_TIER;
     const guardianLimits = resolveGuardianLimits(env);
+    // YAG-562: the backend owns the Guardian timeout and retries once. The client
+    // derives its whole-consult deadline from the catalog's advertised wall
+    // ceiling + attempt count (plus a boot/tool overhead margin) rather than
+    // hard-aborting at 15s and preempting the backend's retry. Absent an
+    // advertisement (older backend) this keeps the default.
+    const guardianTimeoutMs = deriveGuardianTimeoutMs(guardianLimits, {
+        ...(guardianTimeoutAdvertisedMs !== undefined ? { timeoutMs: guardianTimeoutAdvertisedMs } : {}),
+        ...(guardianMaxAttemptsAdvertised !== undefined ? { maxAttempts: guardianMaxAttemptsAdvertised } : {}),
+    });
+    guardianLimits.timeoutMs = guardianTimeoutMs;
     // YAG-510: guardian.log stays the sanitized local debug sink (hash-only,
     // never the command). The remote guardian-events stream below is the
     // separate, opt-in, per-workspace analytics sink; the two are independent.
@@ -887,7 +897,7 @@ export { makeAskYagniTool } from "./askYagniTool.js";
 export { makeFileTicketTool, makeUpdateTicketStatusTool } from "./ticketTools.js";
 export { makeAskAdvisorTool, registerAdviseCommand } from "./askAdvisorTool.js";
 export { ADVISOR_TIER, DEFAULT_ADVISOR_LIMITS, decideConsult, formatAdvisorSubtotal, makeAdvisorState, } from "./advisor.js";
-export { DEFAULT_GUARDIAN_LIMITS, GUARDIAN_MODEL_TIER, formatGuardianSubtotal, makeGuardianState, resolveGuardianLimits, reviewCommand, } from "./permission/guardian.js";
+export { DEFAULT_GUARDIAN_LIMITS, GUARDIAN_MODEL_TIER, formatGuardianSubtotal, makeGuardianState, resolveGuardianLimits, reviewCommand, deriveGuardianTimeoutMs, } from "./permission/guardian.js";
 export { makeReviewBusinessMatchTool } from "./reviewTool.js";
 export { makeRecordEngineeringContextTool } from "./recordContextTool.js";
 export { makeRecordDecisionTool } from "./recordDecisionTool.js";

package/dist/extension/permission/guardian.d.ts

@@ -45,13 +45,32 @@ export interface GuardianLimits {
     timeoutMs: number;
 }
 export declare const DEFAULT_GUARDIAN_LIMITS: GuardianLimits;
+/**
+ * Client-side safety margin on top of the backend's advertised wall ceiling
+ * (YAG-562). The backend now owns the real timeout (first-output + wall) and
+ * retries once, so the client must NOT pre-empt it; it derives its own
+ * deadline from the catalog's `guardianTimeoutMs * attempts` plus this margin
+ * for child boot + read-tool round-trips + teardown, and treats that bound as
+ * a last-resort floor, not the normal path.
+ */
+export declare const GUARDIAN_CLIENT_OVERHEAD_MS = 10000;
 /**
  * Resolve Guardian limits from the environment. `YAGNI_GUARDIAN_MAX_REVIEWS`
  * overrides the sliding-window review cap; anything non-numeric or < 1 falls
  * back to the default (a bad value must never zero out the cap and lock the
- * session).
+ * session). `YAGNI_GUARDIAN_TIMEOUT_MS` overrides the consult deadline for a
+ * single developer (previously documented but unwired).
  */
 export declare function resolveGuardianLimits(env?: Record<string, string | undefined>): GuardianLimits;
+/**
+ * Derive the client's whole-consult deadline from the backend's advertised
+ * wall ceiling and attempt count (YAG-562). Falls back to the resolved limit
+ * when the catalog omitted the fields (older backend).
+ */
+export declare function deriveGuardianTimeoutMs(base: GuardianLimits, advertised: {
+    timeoutMs?: number;
+    maxAttempts?: number;
+}): number;
 /** The model tier the Guardian runs on. Configurable via YAGNI_GUARDIAN_TIER. */
 export declare const GUARDIAN_MODEL_TIER = "efficient";
 /** Read-only tools — the Guardian can read files for context but cannot write or execute. */

package/dist/extension/permission/guardian.js

@@ -33,17 +33,41 @@ export const DEFAULT_GUARDIAN_LIMITS = {
     maxConsecutiveDenials: 3,
     timeoutMs: 15_000,
 };
+/**
+ * Client-side safety margin on top of the backend's advertised wall ceiling
+ * (YAG-562). The backend now owns the real timeout (first-output + wall) and
+ * retries once, so the client must NOT pre-empt it; it derives its own
+ * deadline from the catalog's `guardianTimeoutMs * attempts` plus this margin
+ * for child boot + read-tool round-trips + teardown, and treats that bound as
+ * a last-resort floor, not the normal path.
+ */
+export const GUARDIAN_CLIENT_OVERHEAD_MS = 10_000;
 /**
  * Resolve Guardian limits from the environment. `YAGNI_GUARDIAN_MAX_REVIEWS`
  * overrides the sliding-window review cap; anything non-numeric or < 1 falls
  * back to the default (a bad value must never zero out the cap and lock the
- * session).
+ * session). `YAGNI_GUARDIAN_TIMEOUT_MS` overrides the consult deadline for a
+ * single developer (previously documented but unwired).
  */
 export function resolveGuardianLimits(env = process.env) {
-    const raw = env.YAGNI_GUARDIAN_MAX_REVIEWS?.trim();
-    const parsed = raw ? Number.parseInt(raw, 10) : NaN;
-    const maxReviews = Number.isFinite(parsed) && parsed >= 1 ? parsed : DEFAULT_GUARDIAN_LIMITS.maxReviews;
-    return { ...DEFAULT_GUARDIAN_LIMITS, maxReviews };
+    const rawReviews = env.YAGNI_GUARDIAN_MAX_REVIEWS?.trim();
+    const parsedReviews = rawReviews ? Number.parseInt(rawReviews, 10) : NaN;
+    const maxReviews = Number.isFinite(parsedReviews) && parsedReviews >= 1 ? parsedReviews : DEFAULT_GUARDIAN_LIMITS.maxReviews;
+    const rawTimeout = env.YAGNI_GUARDIAN_TIMEOUT_MS?.trim();
+    const parsedTimeout = rawTimeout ? Number.parseInt(rawTimeout, 10) : NaN;
+    const timeoutMs = Number.isFinite(parsedTimeout) && parsedTimeout >= 1 ? parsedTimeout : DEFAULT_GUARDIAN_LIMITS.timeoutMs;
+    return { ...DEFAULT_GUARDIAN_LIMITS, maxReviews, timeoutMs };
+}
+/**
+ * Derive the client's whole-consult deadline from the backend's advertised
+ * wall ceiling and attempt count (YAG-562). Falls back to the resolved limit
+ * when the catalog omitted the fields (older backend).
+ */
+export function deriveGuardianTimeoutMs(base, advertised) {
+    if (advertised.timeoutMs !== undefined && advertised.maxAttempts !== undefined) {
+        return advertised.timeoutMs * advertised.maxAttempts + GUARDIAN_CLIENT_OVERHEAD_MS;
+    }
+    return base.timeoutMs;
 }
 /** The model tier the Guardian runs on. Configurable via YAGNI_GUARDIAN_TIER. */
 export const GUARDIAN_MODEL_TIER = "efficient";
@@ -190,7 +214,19 @@ export async function reviewCommand(command, deps) {
         if (deps.signal?.aborted) {
             return { verdict: null, error: "aborted", cost };
         }
+        // The backend now owns the timeout (YAG-562) and streams a terminal error
+        // frame when the consult fails; a result with a `stopReason: "error"` or an
+        // `errorMessage` is a real backend failure, NOT the silent-empty shape. Map
+        // it to a concrete error so the gate shows "review timed out" / "service
+        // unavailable" instead of the misleading "no response". A timeout-shaped
+        // message (stream_idle_timeout / "timed out") is distinguished so the gate
+        // can add its timeout-specific note.
         if (!output) {
+            if (result.stopReason === "error" || result.errorMessage) {
+                const msg = (result.errorMessage ?? "").toLowerCase();
+                const isTimeout = /stream_idle_timeout|timed out|idle|wall|timeout/i.test(msg);
+                return { verdict: null, error: isTimeout ? "timeout" : "network", cost };
+            }
             return { verdict: null, error: "empty", cost };
         }
         const verdict = parseVerdict(output);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yagni-app/code-staging",
-  "version": "0.3.4-staging.1145.1",
+  "version": "0.3.4-staging.1148.1",
   "description": "YAGNI Code: a terminal coding agent that already knows your company. One YAGNI login routes the model and grounds the agent in your team's context.",
   "license": "SEE LICENSE IN LICENSE.md",
   "author": "YAGNI, Inc. <jack@yagni.app> (https://yagni.app)",
@@ -37,7 +37,7 @@
     "@earendil-works/pi-coding-agent": "0.84.1",
     "@earendil-works/pi-tui": "0.84.1",
     "smol-toml": "^1.8.0",
-    "typebox": "^1.3.11"
+    "typebox": "^1.3.15"
   },
-  "yagniSourceSha": "23495abda59558b06033f88e56f41c8e2417e294"
+  "yagniSourceSha": "eefde6e0c0646de0dd81cb9d6ed81df228909d54"
 }