@yagni-app/code-staging 1.0.0-staging.1174.1 → 1.0.0-staging.1175.1

package/dist/extension/askAdvisorTool.js

@@ -32,6 +32,7 @@ import { SPINNER_FRAMES } from "./pipeline/activityFeed.js";
 import { withResilience } from "./pipeline/resilience.js";
 import { runStage as defaultRunStage } from "./pipeline/runner.js";
 import { DEFAULT_RESILIENCE_POLICY } from "./pipeline/types.js";
+import { logEvent } from "./errorSink.js";
 import { applyChildEvent, finalizeTask, formatWorkingMessage, newTaskProgress, progressSummaryText, receiptLine, renderSubagentResult, runningLines, } from "./subagentRender.js";
 /**
  * Read-only recon plus grounding. Mirrors the `plan` stage's allowlist for the
@@ -288,6 +289,7 @@ export function registerAdviseCommand(pi, tool) {
             }
             catch (err) {
                 const message = err instanceof Error ? err.message : String(err);
+                logEvent({ source: "advisor", level: "error", event: "advise_failed", fields: { kind: "consult" } });
                 notify(`/advise failed: ${message}`, "error");
                 await pi.sendUserMessage(`/advise failed: ${message}`);
             }

package/dist/extension/cmux/state.js

@@ -1,6 +1,4 @@
-import { appendFileSync, mkdirSync } from "node:fs";
-import { dirname, join } from "node:path";
-import { codeStateHome } from "../stateHome.js";
+import { logEvent } from "../errorSink.js";
 export function firstString(...values) {
     for (const value of values) {
         if (typeof value === "string" && value.trim().length > 0)
@@ -132,20 +130,15 @@ export function settleTurn(sessionStates, sessionId) {
     return completion;
 }
 export function warn(ctx, message, details = {}, notifyUser = false) {
-    const payload = { source: "yagni-cmux-bridge", level: "warning", message, ...details };
     // The TUI is in raw mode: writing to stdout/stderr corrupts the terminal (the
-    // JSON was landing at the prompt cursor). Route warnings/errors to a rotating
-    // local log instead — never to the terminal.
-    try {
-        if (!process.env.NODE_TEST_CONTEXT) {
-            const path = join(codeStateHome(null), "logs", "cmux-bridge.log");
-            mkdirSync(dirname(path), { recursive: true });
-            appendFileSync(path, JSON.stringify({ ts: new Date().toISOString(), ...payload }) + "\n", "utf8");
-        }
-    }
-    catch {
-        /* logging must never throw into the editor */
-    }
+    // JSON was landing at the prompt cursor). Route warnings/errors to the unified
+    // local sink instead — never to the terminal.
+    logEvent({
+        source: "cmux",
+        level: "warn",
+        event: "cmux_bridge",
+        fields: { message, ...details },
+    });
     if (notifyUser) {
         try {
             ctx?.notifyWarning?.();

package/dist/extension/crashReport.js

@@ -27,6 +27,7 @@
 import { spawn } from "node:child_process";
 import { scrubSecrets } from "./pipeline/scrubSecrets.js";
 import { isDesktopSurface } from "./surface.js";
+import { logEvent } from "./errorSink.js";
 const defaultSpawn = (command, args, options) => spawn(command, args, options);
 export const CRASH_REPORT_DISABLE_ENV = "YAGNI_DISABLE_CRASH_REPORTS";
 export const CRASH_REPORT_TIMEOUT_MS = 1_500;
@@ -267,6 +268,17 @@ export function reportFatalCrash(error, opts, context) {
 export function installUncaughtExceptionMonitor(opts, proc = process) {
     proc.on("uncaughtExceptionMonitor", (err) => {
         reportFatalCrash(err, opts, "uncaught-exception");
+        // Also seed the local error trail (best-effort): the crash report is a
+        // sanitized POST, but the ON-DISK trail is what /feedback binds for a
+        // report someone files next session.
+        logEvent({
+            source: "tool",
+            level: "error",
+            event: "uncaught_exception",
+            sessionId: process.env.YAGNI_SESSION_ID ?? undefined,
+            flush: "sync",
+            fields: { errorClass: err instanceof Error ? err.name || "Error" : "Error" },
+        });
     });
 }
 //# sourceMappingURL=crashReport.js.map

package/dist/extension/decisionCapture.js

@@ -17,6 +17,7 @@
  * never affects the tool call that triggered it.
  */
 import { bankDecision } from "./decisions.js";
+import { logEvent } from "./errorSink.js";
 /** At most one capture prompt per this window (spec: 10 minutes). */
 export const CAPTURE_DEBOUNCE_MS = 10 * 60 * 1000;
 /** Build a session-scoped decision capture (holds the debounce timestamp). */
@@ -54,10 +55,12 @@ export function makeDecisionCapture(deps) {
                     ctx.ui.notify("Saved the decision locally; it will sync automatically.", "info");
                 }
                 else {
+                    logEvent({ source: "decision-capture", level: "error", event: "capture_failed", fields: { kind: outcome.kind } });
                     ctx.ui.notify(outcome.message, "error");
                 }
             }
             catch {
+                logEvent({ source: "decision-capture", level: "error", event: "capture_failed", fields: { kind: "threw" } });
                 /* fail-soft: a capture failure never affects the tool call */
             }
         },

package/dist/extension/decisions.js

@@ -20,6 +20,7 @@
 import { randomUUID } from "node:crypto";
 import { friendlyFetchError, METERED_POST_FETCH_POLICY, resilientFetch } from "./resilientFetch.js";
 import { sendOrSpool } from "./spool.js";
+import { logEvent } from "./errorSink.js";
 /**
  * Bank a `cli_correction` decision durably. Every logical write carries a
  * generated idempotencyKey; the backend dedups on it, so a spool replay or a
@@ -151,6 +152,7 @@ export function registerDecisionCommands(pi, opts) {
                 notify(notice.message, notice.type);
             }
             catch (err) {
+                logEvent({ source: "decisions", level: "error", event: "decide_failed", fields: { op: "decide" } });
                 notify(`Could not record the decision: ${err instanceof Error ? err.message : String(err)}`, "error");
             }
         },
@@ -183,6 +185,7 @@ export function registerDecisionCommands(pi, opts) {
                     notify(`Superseded decision ${shortId(id)}.`, "info");
                 }
                 catch (err) {
+                    logEvent({ source: "decisions", level: "error", event: "supersede_failed", fields: { op: "supersede" } });
                     notify(`Could not supersede decision: ${err instanceof Error ? err.message : String(err)}`, "error");
                 }
                 return;
@@ -192,6 +195,7 @@ export function registerDecisionCommands(pi, opts) {
                 await pi.sendUserMessage(formatDecisionsList(items));
             }
             catch (err) {
+                logEvent({ source: "decisions", level: "error", event: "list_failed", fields: { op: "list" } });
                 notify(`Could not list decisions: ${err instanceof Error ? err.message : String(err)}`, "error");
             }
         },

package/dist/extension/diagnostics.d.ts

@@ -12,10 +12,10 @@
  * A support flow can tail this file and POST it with the user's consent;
  * nothing is uploaded automatically.
  */
+import { readSessionTrail } from "./errorSink.js";
 export declare function _setDiagnosticsHomeForTest(dir: string | null): void;
+/** Active unified-sink path (one rotating per-day JSONL for all sources). */
 export declare function diagnosticsLogPath(): string;
-/** Dedicated log for the ask_user_question interactive tool's state machine. */
-export declare function askQuestionLogPath(): string;
 /** Layer A: verbose mode. `YAGNI_DEBUG=1` (or "true") turns on extra detail. */
 export declare function isDebug(env?: NodeJS.ProcessEnv): boolean;
 export interface ImagePasteEvent {
@@ -56,7 +56,8 @@ export interface AskQuestionEvent {
     checked?: boolean;
 }
 /**
- * Append one sanitized ask-user-question event to `ask-question.log`.
+ * Append one sanitized ask-user-question event to the unified sink
+ * (source:"ask-question").
  * Fail-soft and hermetically gated under `node --test` exactly like
  * `logImagePaste`. Never logs user-typed text, question text, or option labels
  * — only indices, lengths, key bytes (escaped), and resolution status.
@@ -66,4 +67,6 @@ export declare function logAskQuestion(ev: AskQuestionEvent): void;
 export declare function readRecentDiagnostics(maxBytes?: number): string;
 /** List existing diagnostic log files (active + rotations), for a report. */
 export declare function listDiagnosticFiles(): string[];
+/** Re-export the session-scoped trail reader for the /feedback flow. */
+export { readSessionTrail };
 //# sourceMappingURL=diagnostics.d.ts.map

package/dist/extension/diagnostics.js

@@ -12,26 +12,19 @@
  * A support flow can tail this file and POST it with the user's consent;
  * nothing is uploaded automatically.
  */
-import { appendFileSync, mkdirSync, readFileSync, readdirSync, renameSync, statSync, } from "node:fs";
+import { readFileSync, readdirSync } from "node:fs";
 import { dirname, join, basename } from "node:path";
-import { codeStateHome } from "./stateHome.js";
+import { _setErrorSinkHomeForTest, logEvent, errorSinkPath, readSessionTrail, } from "./errorSink.js";
 /** Test seam (mirrors `_setYagniCodeHomeForTest`): point the log at a tmpdir. */
 let homeOverride = null;
 export function _setDiagnosticsHomeForTest(dir) {
     homeOverride = dir;
+    _setErrorSinkHomeForTest(dir);
 }
-function yagniCodeHome() {
-    return codeStateHome(homeOverride);
-}
+/** Active unified-sink path (one rotating per-day JSONL for all sources). */
 export function diagnosticsLogPath() {
-    return join(yagniCodeHome(), "logs", "image-paste.log");
-}
-/** Dedicated log for the ask_user_question interactive tool's state machine. */
-export function askQuestionLogPath() {
-    return join(yagniCodeHome(), "logs", "ask-question.log");
+    return errorSinkPath();
 }
-const MAX_LOG_BYTES = 256 * 1024; // rotate the active file past this
-const KEEP_ROTATIONS = 2; // keep image-paste.log.1 and .2 alongside the active file
 /** Layer A: verbose mode. `YAGNI_DEBUG=1` (or "true") turns on extra detail. */
 export function isDebug(env = process.env) {
     const v = env.YAGNI_DEBUG;
@@ -42,88 +35,55 @@ export function isDebug(env = process.env) {
  * prompt. `detail` is included only when YAGNI_DEBUG is on.
  */
 export function logImagePaste(ev) {
-    try {
-        // Hermetic under `node --test`: never touch the real home dir from a test
-        // unless the test explicitly stubbed it. Writing to the runner's $HOME made
-        // the suite's exit depend on the CI filesystem (a read-only or slow $HOME
-        // could stall the write), which is the leading suspect for the CI hang.
-        if (process.env.NODE_TEST_CONTEXT && homeOverride === null)
-            return;
-        const line = {
-            ts: new Date().toISOString(),
-            event: ev.event,
-            ...(ev.outcome !== undefined ? { outcome: ev.outcome } : {}),
-            ...(ev.mimeType !== undefined ? { mimeType: ev.mimeType } : {}),
-            ...(ev.bytes !== undefined ? { bytes: ev.bytes } : {}),
-            ...(ev.imageCount !== undefined ? { imageCount: ev.imageCount } : {}),
-            ...(ev.file !== undefined ? { file: basename(ev.file) } : {}),
-            ...(ev.detail !== undefined && isDebug() ? { detail: ev.detail } : {}),
-        };
-        const path = diagnosticsLogPath();
-        mkdirSync(dirname(path), { recursive: true });
-        rotateIfNeeded(path);
-        appendFileSync(path, JSON.stringify(line) + "\n", "utf8");
-    }
-    catch {
-        /* logging must never throw into the editor */
-    }
-}
-/** Shift image-paste.log -> .1 -> .2 once the active file passes the size cap. */
-function rotateIfNeeded(path) {
-    try {
-        if (statSync(path).size < MAX_LOG_BYTES)
-            return;
-        for (let i = KEEP_ROTATIONS; i >= 1; i--) {
-            const from = i === 1 ? path : `${path}.${i - 1}`;
-            const to = `${path}.${i}`;
-            try {
-                renameSync(from, to);
-            }
-            catch {
-                /* absent source — fine */
-            }
-        }
-    }
-    catch {
-        /* rotation is best-effort */
-    }
+    // The unified sink: content-free fields are always-on, the debug-only
+    // `detail` rides level:debug (never bound by /feedback).
+    const fields = {
+        ...(ev.outcome !== undefined ? { outcome: ev.outcome } : {}),
+        ...(ev.mimeType !== undefined ? { mimeType: ev.mimeType } : {}),
+        ...(ev.bytes !== undefined ? { bytes: ev.bytes } : {}),
+        ...(ev.imageCount !== undefined ? { imageCount: ev.imageCount } : {}),
+        ...(ev.file !== undefined ? { file: basename(ev.file) } : {}),
+        ...(ev.detail !== undefined && isDebug() ? { detail: ev.detail } : {}),
+    };
+    logEvent({
+        source: "image-paste",
+        level: ev.detail !== undefined && isDebug() ? "debug" : "info",
+        event: ev.event,
+        fields,
+    });
 }
 /**
- * Append one sanitized ask-user-question event to `ask-question.log`.
+ * Append one sanitized ask-user-question event to the unified sink
+ * (source:"ask-question").
  * Fail-soft and hermetically gated under `node --test` exactly like
  * `logImagePaste`. Never logs user-typed text, question text, or option labels
  * — only indices, lengths, key bytes (escaped), and resolution status.
  */
 export function logAskQuestion(ev) {
-    try {
-        if (process.env.NODE_TEST_CONTEXT && homeOverride === null)
-            return;
-        const line = {
-            ts: new Date().toISOString(),
-            event: ev.event,
-            ...(ev.selectedIndex !== undefined ? { selectedIndex: ev.selectedIndex } : {}),
-            ...(ev.otherIndex !== undefined ? { otherIndex: ev.otherIndex } : {}),
-            ...(ev.otherLen !== undefined ? { otherLen: ev.otherLen } : {}),
-            ...(ev.status !== undefined ? { status: ev.status } : {}),
-            ...(ev.multi !== undefined ? { multi: ev.multi } : {}),
-            ...(ev.qIndex !== undefined ? { qIndex: ev.qIndex } : {}),
-            ...(ev.checked !== undefined ? { checked: ev.checked } : {}),
-            ...(ev.key !== undefined ? { key: ev.key } : {}),
-            ...(ev.detail !== undefined && isDebug() ? { detail: ev.detail } : {}),
-        };
-        const path = askQuestionLogPath();
-        mkdirSync(dirname(path), { recursive: true });
-        rotateIfNeeded(path);
-        appendFileSync(path, JSON.stringify(line) + "\n", "utf8");
-    }
-    catch {
-        /* logging must never throw into the tool */
-    }
+    // Raw key bytes (`key`) and `detail` are content-ish: gate them behind DEBUG.
+    const debug = isDebug();
+    const fields = {
+        ...(ev.selectedIndex !== undefined ? { selectedIndex: ev.selectedIndex } : {}),
+        ...(ev.otherIndex !== undefined ? { otherIndex: ev.otherIndex } : {}),
+        ...(ev.otherLen !== undefined ? { otherLen: ev.otherLen } : {}),
+        ...(ev.status !== undefined ? { status: ev.status } : {}),
+        ...(ev.multi !== undefined ? { multi: ev.multi } : {}),
+        ...(ev.qIndex !== undefined ? { qIndex: ev.qIndex } : {}),
+        ...(ev.checked !== undefined ? { checked: ev.checked } : {}),
+        ...(ev.key !== undefined && debug ? { key: ev.key } : {}),
+        ...(ev.detail !== undefined && debug ? { detail: ev.detail } : {}),
+    };
+    logEvent({
+        source: "ask-question",
+        level: debug ? "debug" : "info",
+        event: ev.event,
+        fields,
+    });
 }
 /** Read the most recent log content (for a user-triggered report). */
 export function readRecentDiagnostics(maxBytes = 64 * 1024) {
     try {
-        const data = readFileSync(diagnosticsLogPath(), "utf8");
+        const data = readFileSync(errorSinkPath(), "utf8");
         return data.length > maxBytes ? data.slice(data.length - maxBytes) : data;
     }
     catch {
@@ -133,9 +93,9 @@ export function readRecentDiagnostics(maxBytes = 64 * 1024) {
 /** List existing diagnostic log files (active + rotations), for a report. */
 export function listDiagnosticFiles() {
     try {
-        const dir = dirname(diagnosticsLogPath());
+        const dir = dirname(errorSinkPath());
         return readdirSync(dir)
-            .filter((f) => f.startsWith("image-paste.log"))
+            .filter((f) => f.startsWith("errors-"))
             .sort()
             .map((f) => join(dir, f));
     }
@@ -143,4 +103,6 @@ export function listDiagnosticFiles() {
         return [];
     }
 }
+/** Re-export the session-scoped trail reader for the /feedback flow. */
+export { readSessionTrail };
 //# sourceMappingURL=diagnostics.js.map

package/dist/extension/errorSink.d.ts

@@ -0,0 +1,64 @@
+/**
+ * The unified local error/log sink for YAGNI Code (YAG-580).
+ *
+ * Replaces the previous ~9 hand-rolled JSONL writers (image-paste.log,
+ * ask-question.log, turn-lifecycle.log, guardian.log, cost-divergence.log,
+ * auth-events.log, cmux-bridge.log, hooks.log, *.stream.log) with ONE sink.
+ *
+ * Two storage layers, purpose-named so their roles stay clear:
+ *
+ *  1. The DURABLE TRAIL — one rotating per-day JSONL under
+ *     `~/.yagni-code/logs/errors-<date>.jsonl` (size-capped + 2 rotations).
+ *     This is the crash-survivable WAL: `turn_start` without a matching
+ *     `turn_end` still leaves a record even if the process is killed. Critical
+ *     events append SYNCHRONOUSLY for exactly that reason.
+ *
+ *  2. The IN-MEMORY CAPTURE — a byte-budgeted ring buffer (not line-counted).
+ *     This is the `/feedback` binding convenience, NOT durability (an in-memory
+ *     ring does not survive a crash). Mirrors Codex's CodexFeedback ring and
+ *     Claude's inMemoryErrorLog.
+ *
+ * Every line carries a REQUIRED `sessionId` and a `source`/`level`/`event`
+ * triple so a shared file stays filterable: `jq 'select(.source=="guardian")'`
+ * reproduces today's per-file tail exactly, and /feedback reads the trail
+ * filtered by sessionId (never the raw file) so one session's report never
+ * leaks another session's errors.
+ *
+ * Default-on vs DEBUG invariant (the thing that makes "log everything by
+ * default" safe): default-on == scrub-safe == upload-safe. Any field carrying
+ * raw content (tool arguments, partial/result bodies, provider payloads, raw
+ * key bytes) must be gated behind YAGNI_DEBUG, and the /feedback reader refuses
+ * to bind any `level: debug` line. DEBUG == may-contain-content == never-uploads.
+ */
+export type SinkLevel = "error" | "warn" | "info" | "debug";
+export interface SinkEvent {
+    /** Former filename / subsystem: tool, turn, guardian, image-paste, ask-question, cost, auth, cmux, hooks. */
+    source: string;
+    level: SinkLevel;
+    /** Stable machine name (e.g. "turn_start", "bash.exit_1", "denied"). */
+    event: string;
+    /** Additional structured fields. NEVER raw content on a non-debug line. */
+    fields?: Record<string, unknown>;
+    /** Session id so the trail is filterable and scoped per feedback. Defaults to YAGNI_SESSION_ID. */
+    sessionId?: string;
+    /** "sync" flushes immediately (critical events); "buffered" is fine for high-volume debug. */
+    flush?: "sync" | "buffered";
+}
+export declare function _setErrorSinkHomeForTest(dir: string | null): void;
+export declare function errorSinkPath(now?: Date): string;
+export declare function _clearErrorSinkRingForTest(): void;
+export declare function errorSinkInMemory(): string;
+/**
+ * Append one event to both the ring and the durable trail. Fail-soft: a logging
+ * failure must never break the session. `flush: "sync"` (default for
+ * error-level events and lifecycle turns) bypasses any future buffering so a
+ * turn that starts but never ends still leaves a durable `turn_start`.
+ */
+export declare function logEvent(ev: SinkEvent): void;
+/**
+ * Read recent trail lines for ONE session, filtered by `sessionId`, up to
+ * `maxBytes`. Never returns `level: debug` lines — the default-on tier is the
+ * upload-safe tier, and DEBUG may contain content that must not leave the machine.
+ */
+export declare function readSessionTrail(sessionId: string, maxBytes?: number): string;
+//# sourceMappingURL=errorSink.d.ts.map

package/dist/extension/errorSink.js

@@ -0,0 +1,180 @@
+/**
+ * The unified local error/log sink for YAGNI Code (YAG-580).
+ *
+ * Replaces the previous ~9 hand-rolled JSONL writers (image-paste.log,
+ * ask-question.log, turn-lifecycle.log, guardian.log, cost-divergence.log,
+ * auth-events.log, cmux-bridge.log, hooks.log, *.stream.log) with ONE sink.
+ *
+ * Two storage layers, purpose-named so their roles stay clear:
+ *
+ *  1. The DURABLE TRAIL — one rotating per-day JSONL under
+ *     `~/.yagni-code/logs/errors-<date>.jsonl` (size-capped + 2 rotations).
+ *     This is the crash-survivable WAL: `turn_start` without a matching
+ *     `turn_end` still leaves a record even if the process is killed. Critical
+ *     events append SYNCHRONOUSLY for exactly that reason.
+ *
+ *  2. The IN-MEMORY CAPTURE — a byte-budgeted ring buffer (not line-counted).
+ *     This is the `/feedback` binding convenience, NOT durability (an in-memory
+ *     ring does not survive a crash). Mirrors Codex's CodexFeedback ring and
+ *     Claude's inMemoryErrorLog.
+ *
+ * Every line carries a REQUIRED `sessionId` and a `source`/`level`/`event`
+ * triple so a shared file stays filterable: `jq 'select(.source=="guardian")'`
+ * reproduces today's per-file tail exactly, and /feedback reads the trail
+ * filtered by sessionId (never the raw file) so one session's report never
+ * leaks another session's errors.
+ *
+ * Default-on vs DEBUG invariant (the thing that makes "log everything by
+ * default" safe): default-on == scrub-safe == upload-safe. Any field carrying
+ * raw content (tool arguments, partial/result bodies, provider payloads, raw
+ * key bytes) must be gated behind YAGNI_DEBUG, and the /feedback reader refuses
+ * to bind any `level: debug` line. DEBUG == may-contain-content == never-uploads.
+ */
+import { appendFileSync, mkdirSync, readFileSync, renameSync, statSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { codeStateHome } from "./stateHome.js";
+import { scrubSecrets } from "./pipeline/scrubSecrets.js";
+const MAX_LOG_BYTES = 256 * 1024;
+const KEEP_ROTATIONS = 2;
+const RING_MAX_BYTES = 256 * 1024;
+/** Test seam: point the log at a tmpdir (mirrors _setDiagnosticsHomeForTest). */
+let homeOverride = null;
+export function _setErrorSinkHomeForTest(dir) {
+    homeOverride = dir;
+}
+function logDir() {
+    return join(codeStateHome(homeOverride), "logs");
+}
+function dayStamp(now = new Date()) {
+    return now.toISOString().slice(0, 10); // YYYY-MM-DD
+}
+export function errorSinkPath(now = new Date()) {
+    return join(logDir(), `errors-${dayStamp(now)}.jsonl`);
+}
+/** In-memory ring buffer, byte-budgeted (trailing bytes kept when over cap). */
+class RingBuffer {
+    maxBytes;
+    chunks = [];
+    bytes = 0;
+    constructor(maxBytes) {
+        this.maxBytes = maxBytes;
+    }
+    push(line) {
+        const b = Buffer.byteLength(line, "utf8");
+        if (b >= this.maxBytes) {
+            this.chunks = [line];
+            this.bytes = b;
+            return;
+        }
+        while (this.bytes + b > this.maxBytes && this.chunks.length > 0) {
+            const dropped = this.chunks.shift();
+            this.bytes -= Buffer.byteLength(dropped, "utf8");
+        }
+        this.chunks.push(line);
+        this.bytes += b;
+    }
+    snapshot() {
+        return this.chunks.join("");
+    }
+    clear() {
+        this.chunks = [];
+        this.bytes = 0;
+    }
+}
+const ring = new RingBuffer(RING_MAX_BYTES);
+export function _clearErrorSinkRingForTest() {
+    ring.clear();
+}
+export function errorSinkInMemory() {
+    return ring.snapshot();
+}
+function rotateIfNeeded(path) {
+    try {
+        if (!statSync(path).isFile() || statSync(path).size < MAX_LOG_BYTES)
+            return;
+        for (let i = KEEP_ROTATIONS; i >= 1; i--) {
+            const from = i === 1 ? path : `${path}.${i - 1}`;
+            const to = `${path}.${i}`;
+            try {
+                renameSync(from, to);
+            }
+            catch {
+                /* absent source — fine */
+            }
+        }
+    }
+    catch {
+        /* rotation is best-effort */
+    }
+}
+function isDebug(env = process.env) {
+    const v = env.YAGNI_DEBUG;
+    return v === "1" || v === "true";
+}
+function sessionIdFor(ev) {
+    return ev.sessionId ?? process.env.YAGNI_SESSION_ID ?? "";
+}
+function serialize(ev) {
+    const line = {
+        ts: new Date().toISOString(),
+        source: ev.source,
+        level: ev.level,
+        event: ev.event,
+        sessionId: sessionIdFor(ev),
+        ...(ev.fields ?? {}),
+    };
+    return JSON.stringify(line) + "\n";
+}
+/**
+ * Append one event to both the ring and the durable trail. Fail-soft: a logging
+ * failure must never break the session. `flush: "sync"` (default for
+ * error-level events and lifecycle turns) bypasses any future buffering so a
+ * turn that starts but never ends still leaves a durable `turn_start`.
+ */
+export function logEvent(ev) {
+    try {
+        if (process.env.NODE_TEST_CONTEXT && homeOverride === null)
+            return;
+        const line = serialize(ev);
+        ring.push(line);
+        const path = errorSinkPath();
+        mkdirSync(dirname(path), { recursive: true });
+        rotateIfNeeded(path);
+        appendFileSync(path, line, "utf8");
+    }
+    catch {
+        /* logging must never throw into the editor */
+    }
+}
+/**
+ * Read recent trail lines for ONE session, filtered by `sessionId`, up to
+ * `maxBytes`. Never returns `level: debug` lines — the default-on tier is the
+ * upload-safe tier, and DEBUG may contain content that must not leave the machine.
+ */
+export function readSessionTrail(sessionId, maxBytes = 64 * 1024) {
+    try {
+        const data = readFileSync(errorSinkPath(), "utf8");
+        // Defense-in-depth: scrub each kept line so /diagnostics and /feedback
+        // never surface a secret or local path, even if a future caller slipped a
+        // content-bearing value onto an always-on line.
+        const lines = data
+            .split("\n")
+            .filter((l) => l.length > 0)
+            .filter((l) => {
+            try {
+                const obj = JSON.parse(l);
+                return obj.sessionId === sessionId && obj.level !== "debug";
+            }
+            catch {
+                return false;
+            }
+        })
+            .map((l) => scrubSecrets(l))
+            .join("\n");
+        return lines.length > maxBytes ? lines.slice(lines.length - maxBytes) : lines;
+    }
+    catch {
+        return "";
+    }
+}
+//# sourceMappingURL=errorSink.js.map

package/dist/extension/feedbackCommand.d.ts

@@ -0,0 +1,38 @@
+/**
+ * The `/feedback` (alias `/bug`) command + the `/diagnostics` companion
+ * (YAG-580).
+ *
+ * `/feedback` captures the session transcript (pi's own append-only JSONL, read
+ * via `ctx.sessionManager` — never reconstructed from YAGNI_SESSION_ID, which is
+ * the proxy-attribution id), the session-scoped error trail (from the unified
+ * sink), any child `/go` run transcripts, a sanitized `yagni doctor` report, and
+ * git metadata — sanitizes the whole bundle with the shared scrub contract, and
+ * POSTs it to the YAGNI backend (opt-in, gated, named-human).
+ *
+ * `/diagnostics` is the read-only companion: it prints the last N sink lines for
+ * THIS session so the user can see what failed before deciding to attach it.
+ *
+ * Both treat the transcript as best-effort enrichment: pi's flush-to-file timing
+ * at command-invoke is not guaranteed, so a report never claims the reporting
+ * turn is captured unless it verifiably is.
+ */
+import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
+export interface FeedbackDeps {
+    baseUrl: string;
+    getToken: () => string | undefined;
+    fetchImpl?: typeof fetch;
+    env?: NodeJS.ProcessEnv;
+    /** Sanitized `yagni doctor` output (string), or undefined to omit. */
+    getDoctorReport?: () => Promise<string | undefined>;
+    /** Git facts for the report; undefined fields are omitted. */
+    getGitState?: (cwd: string) => Promise<{
+        branch?: string;
+        commit?: string;
+        remote?: string;
+        dirty?: boolean;
+    }>;
+    /** Child `/go` run transcripts keyed by run id, for the current run tree. */
+    getChildTranscripts?: (cwd: string, sessionFile: string | undefined) => Promise<Record<string, string>>;
+}
+export declare function registerFeedbackCommands(pi: ExtensionAPI, deps: FeedbackDeps): void;
+//# sourceMappingURL=feedbackCommand.d.ts.map

package/dist/extension/feedbackCommand.js

@@ -0,0 +1,151 @@
+/**
+ * The `/feedback` (alias `/bug`) command + the `/diagnostics` companion
+ * (YAG-580).
+ *
+ * `/feedback` captures the session transcript (pi's own append-only JSONL, read
+ * via `ctx.sessionManager` — never reconstructed from YAGNI_SESSION_ID, which is
+ * the proxy-attribution id), the session-scoped error trail (from the unified
+ * sink), any child `/go` run transcripts, a sanitized `yagni doctor` report, and
+ * git metadata — sanitizes the whole bundle with the shared scrub contract, and
+ * POSTs it to the YAGNI backend (opt-in, gated, named-human).
+ *
+ * `/diagnostics` is the read-only companion: it prints the last N sink lines for
+ * THIS session so the user can see what failed before deciding to attach it.
+ *
+ * Both treat the transcript as best-effort enrichment: pi's flush-to-file timing
+ * at command-invoke is not guaranteed, so a report never claims the reporting
+ * turn is captured unless it verifiably is.
+ */
+import { readFileSync } from "node:fs";
+import { scrubSecrets } from "./pipeline/scrubSecrets.js";
+import { readSessionTrail } from "./errorSink.js";
+const MAX_DESCRIPTION = 512;
+const MAX_TRANSCRIPT_READ_BYTES = 512 * 1024;
+const notify = (ctx, message, type) => {
+    if (ctx.hasUI)
+        ctx.ui.notify(message, type);
+};
+function redact(text) {
+    return scrubSecrets(text);
+}
+/**
+ * Read the durable transcript, clamped by byte size. Returns empty on any
+ * failure or when too large (mirrors Claude's MAX_TRANSCRIPT_READ_BYTES guard).
+ */
+function readTranscript(sessionFile) {
+    if (!sessionFile)
+        return "";
+    try {
+        const data = readFileSync(sessionFile, "utf8");
+        if (Buffer.byteLength(data, "utf8") > MAX_TRANSCRIPT_READ_BYTES)
+            return "";
+        return data;
+    }
+    catch {
+        return "";
+    }
+}
+async function handleFeedback(args, ctx, deps) {
+    const sessionId = ctx.sessionManager.getSessionId?.() ?? deps.env?.YAGNI_SESSION_ID ?? "";
+    const sessionFile = ctx.sessionManager.getSessionFile?.();
+    const cwd = ctx.cwd;
+    const description = args.trim()
+        ? args.trim()
+        : await ctx.ui.input("Describe the issue", "What went wrong, in one or two lines?");
+    if (!description || description.trim().length === 0) {
+        notify(ctx, "Feedback cancelled.", "info");
+        return;
+    }
+    if (!ctx.isIdle()) {
+        notify(ctx, "YAGNI Code is busy; wait for the current turn to finish before /feedback.", "warning");
+        return;
+    }
+    const transcript = readTranscript(sessionFile);
+    const trail = readSessionTrail(sessionId);
+    const doctorReport = deps.getDoctorReport
+        ? await deps.getDoctorReport().catch(() => undefined)
+        : undefined;
+    const git = deps.getGitState
+        ? await deps.getGitState(cwd).catch(() => ({}))
+        : {};
+    const childTranscripts = deps.getChildTranscripts
+        ? await deps.getChildTranscripts(cwd, sessionFile).catch(() => ({}))
+        : {};
+    // Consent: enumerate exactly what is about to leave the machine.
+    const lines = [
+        "Your feedback description",
+        `This session's transcript${transcript ? "" : " (could not be read — possibly one turn stale)"}`,
+        `${Object.keys(childTranscripts).length} child run transcript(s)`,
+        "Recent error trail for this session",
+        ...(doctorReport ? ["Sanitized yagni doctor report"] : []),
+        ...(git.branch ? ["Git metadata (branch/commit/remote/dirty)"] : []),
+    ];
+    const ok = await ctx.ui.confirm("Submit feedback?", lines.join("\n     - ") + "\n\nSend this report?");
+    if (!ok) {
+        notify(ctx, "Feedback cancelled.", "info");
+        return;
+    }
+    const payload = {
+        client: "cli",
+        clientVersion: deps.env?.YAGNI_CODE_VERSION?.trim() || "unknown",
+        platform: `${process.platform} ${process.arch}`,
+        description: redact(description).slice(0, MAX_DESCRIPTION),
+        sessionId,
+        ...(transcript ? { transcriptJsonl: redact(transcript) } : {}),
+        ...(trail ? { errorTrailJsonl: redact(trail) } : {}),
+        ...(Object.keys(childTranscripts).length > 0
+            ? { childTranscripts: Object.fromEntries(Object.entries(childTranscripts).map(([k, v]) => [k, redact(v)])) }
+            : {}),
+        ...(doctorReport ? { doctorReport: redact(doctorReport) } : {}),
+        ...(git.branch ? { gitBranch: git.branch } : {}),
+        ...(git.commit ? { gitCommit: git.commit } : {}),
+        ...(git.remote ? { gitRemote: git.remote } : {}),
+        ...(git.dirty !== undefined ? { gitDirty: git.dirty } : {}),
+    };
+    try {
+        const fetchImpl = deps.fetchImpl ?? fetch;
+        const res = await fetchImpl(`${deps.baseUrl.replace(/\/$/, "")}/api/yagni-code/feedback`, {
+            method: "POST",
+            headers: {
+                "content-type": "application/json",
+                authorization: `Bearer ${deps.getToken() ?? ""}`,
+            },
+            body: JSON.stringify(payload),
+            signal: AbortSignal.timeout(30_000),
+        });
+        if (res.ok) {
+            notify(ctx, "Feedback submitted. Thank you!", "info");
+        }
+        else {
+            notify(ctx, "Could not submit feedback. Please try again.", "error");
+        }
+    }
+    catch {
+        notify(ctx, "Could not submit feedback (network error). Please try again.", "error");
+    }
+}
+export function registerFeedbackCommands(pi, deps) {
+    pi.registerCommand("feedback", {
+        description: "File a bug report with your session transcript + error trail attached.",
+        handler: (args, ctx) => handleFeedback(args, ctx, deps),
+    });
+    pi.registerCommand("bug", {
+        description: "Alias for /feedback.",
+        handler: (args, ctx) => handleFeedback(args, ctx, deps),
+    });
+    pi.registerCommand("diagnostics", {
+        description: "Show recent error-trail lines for this session.",
+        handler: async (_args, ctx) => {
+            const sessionId = ctx.sessionManager.getSessionId?.() ?? deps.env?.YAGNI_SESSION_ID ?? "";
+            const trail = readSessionTrail(sessionId, 16 * 1024);
+            if (!trail) {
+                notify(ctx, "No recent diagnostics for this session.", "info");
+                return;
+            }
+            const lines = trail.split("\n").filter(Boolean);
+            const tail = lines.slice(-20);
+            notify(ctx, `Recent diagnostics (${lines.length} events):\n${tail.join("\n")}`, "info");
+        },
+    });
+}
+//# sourceMappingURL=feedbackCommand.js.map

package/dist/extension/hooks.js

@@ -17,11 +17,12 @@
  * Fail-soft: a broken hook degrades to "no hook," never to "broken session."
  */
 import { spawn } from "node:child_process";
-import { mkdirSync, appendFileSync, existsSync, readFileSync } from "node:fs";
-import { dirname, join } from "node:path";
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
 import { homedir } from "node:os";
 import { codeStateHome } from "./stateHome.js";
 import { isDebug } from "./diagnostics.js";
+import { logEvent } from "./errorSink.js";
 const SUPPORTED_EVENTS = [
     "SessionStart",
     "UserPromptSubmit",
@@ -286,16 +287,15 @@ export function parseCompactCancel(stdout) {
 function logHookEvent(env, payload) {
     if (!isDebug(env))
         return;
-    try {
-        if (process.env.NODE_TEST_CONTEXT)
-            return;
-        const logPath = join(codeStateHome(null, env), "logs", "hooks.log");
-        mkdirSync(dirname(logPath), { recursive: true });
-        appendFileSync(logPath, JSON.stringify({ ts: new Date().toISOString(), ...payload }) + "\n", "utf8");
-    }
-    catch {
-        // logging must never break the session
-    }
+    const event = typeof payload.event === "string" ? payload.event : "hook_event";
+    const { event: _ignored, ...fields } = payload;
+    logEvent({
+        source: "hooks",
+        level: "debug",
+        event,
+        sessionId: env.YAGNI_SESSION_ID ?? undefined,
+        fields,
+    });
 }
 /** Filter hook groups by workspace trust: project-level groups are skipped when untrusted. */
 function filterByTrust(groups, isTrusted) {

package/dist/extension/index.js

@@ -1,6 +1,4 @@
 import { createHash } from "node:crypto";
-import { appendFileSync, mkdirSync } from "node:fs";
-import { dirname, join } from "node:path";
 import { Text } from "@earendil-works/pi-tui";
 import { DEFAULT_ADVISOR_LIMITS, formatAdvisorSubtotal, makeAdvisorState } from "./advisor.js";
 import { appendGrant, loadGrants, resolveRepoKey, storagePrefix } from "./permission/approvedPrefixes.js";
@@ -20,6 +18,8 @@ import { BRAND_NAME, brandSystemPrompt, brandingDisabled, buildMastheadString, Y
 import { claudeRulesSection } from "./claudeRules.js";
 import { registerCostCommand } from "./costHud.js";
 import { isDebug } from "./diagnostics.js";
+import { logEvent } from "./errorSink.js";
+import { registerFeedbackCommands } from "./feedbackCommand.js";
 import { droppedSessionRuns, sessionRunIds } from "./sessionRuns.js";
 import { codeStateHome } from "./stateHome.js";
 import { logTurnLifecycle } from "./turnLog.js";
@@ -252,6 +252,19 @@ export async function registerYagni(pi, deps = {}) {
     // M6 eval (report-only): /go-compare runs a ticket grounded vs blind and reports
     // the business-fit delta. Never wired to routing.
     registerGoCompareCommand(pi);
+    // YAG-580: /feedback (alias /bug) + /diagnostics. The capture/upload is the
+    // whole point, so it is gated to non-eval mode like every external side
+    // effect; the command's deps (doctor report, git state, child transcripts)
+    // are injected so the handler stays unit-testable without spawning git or
+    // reading the real session dir.
+    if (!evalMode) {
+        registerFeedbackCommands(pi, {
+            baseUrl,
+            getToken: getTokenFn,
+            fetchImpl: deps.fetchImpl,
+            env: deps.env,
+        });
+    }
     // W4 judgment loop: the decisions surface (/decide + /decisions) and the
     // bless-with-remember capture are the same product-intent write as the record
     // tools, so both are gated together (skipped in eval mode).
@@ -296,18 +309,19 @@ export async function registerYagni(pi, deps = {}) {
         ...(guardianMaxAttemptsAdvertised !== undefined ? { maxAttempts: guardianMaxAttemptsAdvertised } : {}),
     });
     guardianLimits.timeoutMs = guardianTimeoutMs;
-    // YAG-510: guardian.log stays the sanitized local debug sink (hash-only,
-    // never the command). The remote guardian-events stream below is the
-    // separate, opt-in, per-workspace analytics sink; the two are independent.
+    // YAG-510: Guardian events go to the unified sink under source:"guardian"
+    // (hash-only, never the command). The remote guardian-events stream below is
+    // the separate, opt-in, per-workspace analytics sink; the two are independent.
     const guardianLogSink = (payload) => {
-        try {
-            if (process.env.NODE_TEST_CONTEXT)
-                return;
-            const logPath = join(codeStateHome(null), "logs", "guardian.log");
-            mkdirSync(dirname(logPath), { recursive: true });
-            appendFileSync(logPath, JSON.stringify({ ts: new Date().toISOString(), ...payload }) + "\n", "utf8");
-        }
-        catch { /* logging must never break the session */ }
+        const event = typeof payload.event === "string" ? payload.event : "guardian_event";
+        const { event: _ignored, ...fields } = payload;
+        logEvent({
+            source: "guardian",
+            level: event === "guardian_event_post_failed" ? "error" : "info",
+            event,
+            sessionId: env.YAGNI_SESSION_ID ?? undefined,
+            fields,
+        });
     };
     // YAG-510: persisted "don't ask again" grants, per-repo keyed. Loaded once
     // at startup (grants added by other concurrent sessions appear next launch —
@@ -339,7 +353,8 @@ export async function registerYagni(pi, deps = {}) {
         // "off" → nothing (not even sent); "hash" → sha256 + family prefix +
         // metadata, no command content; "raw" → adds client-REDACTED command and
         // rationale. Fire-and-forget: one attempt, short timeout, failures logged
-        // fail-soft to guardian.log — a storage outage never touches the session.
+        // fail-soft to the unified sink (source:"guardian") — a storage outage
+        // never touches the session.
         onGuardianEvent: guardianStorageTier === "off" || evalMode
             ? undefined
             : (ev) => {
@@ -377,10 +392,10 @@ export async function registerYagni(pi, deps = {}) {
                             guardianLogSink({ event: "guardian_event_post_failed", status: res.status });
                         }
                     }
-                    catch (err) {
+                    catch {
                         guardianLogSink({
                             event: "guardian_event_post_failed",
-                            error: err instanceof Error ? err.message : "unknown",
+                            kind: "network",
                         });
                     }
                 })();
@@ -462,15 +477,13 @@ export async function registerYagni(pi, deps = {}) {
         onDivergence: (driverServerUsd, localUsd) => {
             if (!isDebug(env))
                 return;
-            try {
-                const path = join(codeStateHome(null, env), "logs", "cost-divergence.log");
-                mkdirSync(dirname(path), { recursive: true });
-                const line = { ts: new Date().toISOString(), driverServerUsd, localUsd };
-                appendFileSync(path, JSON.stringify(line) + "\n", "utf8");
-            }
-            catch {
-                /* a diagnostic must never break /cost */
-            }
+            logEvent({
+                source: "cost",
+                level: "debug",
+                event: "cost_divergence",
+                sessionId: env.YAGNI_SESSION_ID ?? undefined,
+                fields: { driverServerUsd, localUsd },
+            });
         },
         // Carry-over (/cost re-review): surfaces sessionRuns.ts's dropped-run-id
         // count as costHud's "Excludes N earlier /go runs." note.
@@ -699,21 +712,16 @@ export async function registerYagni(pi, deps = {}) {
                 // session token is expired and refresh failed — the most critical
                 // failure signal is no longer silently dropped.
                 void authReporter(new Error(`auth_401 on model path; refresh=${rotated ? "succeeded" : "failed"}`), "auth-failure").catch(() => { });
-                // YAG-500 Fix F: local diagnostics log under YAGNI_DEBUG.
-                if (isDebug(env)) {
-                    try {
-                        const logPath = join(codeStateHome(null, env), "logs", "auth-events.log");
-                        mkdirSync(dirname(logPath), { recursive: true });
-                        appendFileSync(logPath, JSON.stringify({
-                            ts: new Date().toISOString(),
-                            status: 401,
-                            refresh: rotated ? "succeeded" : "failed",
-                        }) + "\n", "utf8");
-                    }
-                    catch {
-                        // A diagnostic must never break the session.
-                    }
-                }
+                // YAG-500 Fix F: auth-401 signal is content-free (status + refresh
+                // boolean), so it is always-on and upload-safe by the default-on
+                // invariant. No message content, no tokens, no headers.
+                logEvent({
+                    source: "auth",
+                    level: "info",
+                    event: "auth_401",
+                    sessionId: env.YAGNI_SESSION_ID ?? undefined,
+                    fields: { status: 401, refresh: rotated ? "succeeded" : "failed" },
+                });
                 return { message: { ...msg, errorMessage: explanation } };
             }
             // YAG-460: the backend proxy answers an oversized conversation with an
@@ -907,6 +915,30 @@ export async function registerYagni(pi, deps = {}) {
             footerInvalidateHandle.invalidateGit();
         }
     });
+    // Seed the unified error trail from tool-exec failures. A tool's SUCCESS
+    // is content (it lives in the transcript); its FAILURE is an error and belongs
+    // in the sink. We log only the tool name + error class — never args, partial
+    // results, or result bodies (those are content and stay out of the upload-safe
+    // tier). This is the tool-failure half of the error trail the ticket asks for.
+    pi.on("tool_execution_end", (event) => {
+        if (!event.isError)
+            return;
+        // `event.result` is any; its `.error`/message can echo a path or secret
+        // (a tool's own failure text). Keep the always-on trail content-free: use
+        // ONLY the Error subclass name, never the message or a String() of the
+        // result's error payload.
+        const errorClass = event.result instanceof Error
+            ? event.result.name || "Error"
+            : "tool_error";
+        logEvent({
+            source: "tool",
+            level: "error",
+            event: "tool_failed",
+            sessionId: sessionIdForLog(),
+            flush: "sync",
+            fields: { toolName: event.toolName, errorClass },
+        });
+    });
 }
 export default async function (pi) {
     await registerYagni(pi);

package/dist/extension/mineBeat.js

@@ -20,6 +20,7 @@
 import { execFileSync } from "node:child_process";
 import * as fs from "node:fs";
 import { dirname, join } from "node:path";
+import { logEvent } from "./errorSink.js";
 import { METERED_POST_FETCH_POLICY, resilientFetch } from "./resilientFetch.js";
 /**
  * Client-side bounds on the mining corpus — mirror of the backend's
@@ -173,6 +174,12 @@ export async function maybeOfferMiningBeat(ctx, opts) {
         }, { fetchImpl: opts.fetchImpl, policy: METERED_POST_FETCH_POLICY });
         if (!res.ok) {
             // No marker: the offer stays available next session.
+            logEvent({
+                source: "mine-beat",
+                level: "error",
+                event: "mine_failed",
+                fields: { status: res.status },
+            });
             ctx.ui.notify("Seeding the decision ledger failed; YAGNI Code will offer again next session.", "error");
             return { offered: true, accepted: true };
         }
@@ -186,6 +193,12 @@ export async function maybeOfferMiningBeat(ctx, opts) {
         return { offered: true, accepted: true, banked };
     }
     catch {
+        logEvent({
+            source: "mine-beat",
+            level: "error",
+            event: "mine_failed",
+            fields: { kind: "network" },
+        });
         ctx.ui.notify("Seeding the decision ledger failed; YAGNI Code will offer again next session.", "error");
         return { offered: true, accepted: true };
     }

package/dist/extension/pipeline/goCommand.js

@@ -71,6 +71,7 @@ import { formatRunCostTable } from "./runCostTable.js";
 import { makeCombinedCheckpointStore, makeFileCheckpointStore, makePiJournalCheckpointStore, } from "./checkpoint.js";
 import { getToken as defaultGetToken, resolveBaseUrl } from "../config.js";
 import { makeCrashReporter } from "../crashReport.js";
+import { logEvent } from "../errorSink.js";
 import { scrubSecrets } from "./scrubSecrets.js";
 import { isDesktopSurface } from "../surface.js";
 import { runFinish as defaultRunFinish, verifyTrailerValue, } from "./finish.js";
@@ -1104,6 +1105,7 @@ export function registerGoCommand(pi, deps = {}) {
                     // return results instead) — report it, fire-and-forget. The default
                     // reporter never rejects; the catch guards an injected one.
                     void reportCrash(err, "go", runCwd).catch(() => { });
+                    logEvent({ source: "go", level: "error", event: "go_failed", fields: { runId } });
                     // The stopReason travels to the backend run record; scrub it like
                     // every other captured text (a raw error can echo a connection
                     // string or key).

package/dist/extension/pipeline/runner.js

@@ -25,6 +25,7 @@ import * as path from "node:path";
 import { fileURLToPath } from "node:url";
 import { trackChild } from "./childRegistry.js";
 import { finalOutputFrom, foldEvent, newEventAccumulator } from "./events.js";
+import { logEvent } from "../errorSink.js";
 import { buildStageInvocation, groundedChildArgv } from "./invocation.js";
 import { personaBody } from "./personas.js";
 import { clampTier, resolveTierCap } from "./tierCap.js";
@@ -311,6 +312,14 @@ export async function runStage(stage, ctx, deps) {
                     final_output: finalOut,
                 }, null, 2));
                 dbgLog("stage_end");
+                if (overlongLinesDropped > 0) {
+                    logEvent({
+                        source: "pipeline",
+                        level: "debug",
+                        event: "overlong_lines_dropped",
+                        fields: { stage: stage.id, dropped: overlongLinesDropped },
+                    });
+                }
             }
             catch { /* ignore */ }
         }

package/dist/extension/turnLog.js

@@ -12,41 +12,20 @@
  * rotating file under `~/.yagni-code/logs/`, fail-soft, hermetic under
  * `node --test`.
  */
-import { appendFileSync, mkdirSync, readdirSync, renameSync, statSync } from "node:fs";
+import { readdirSync } from "node:fs";
 import { dirname, join } from "node:path";
-import { codeStateHome } from "./stateHome.js";
+import { _setErrorSinkHomeForTest, logEvent, errorSinkPath, } from "./errorSink.js";
 /** Test seam: point the log at a tmpdir (mirrors _setDiagnosticsHomeForTest). */
 let homeOverride = null;
 export function _setTurnLogHomeForTest(dir) {
     homeOverride = dir;
+    _setErrorSinkHomeForTest(dir);
 }
 function turnLogDir() {
-    return join(codeStateHome(homeOverride), "logs");
+    return dirname(errorSinkPath());
 }
 export function turnLogPath() {
-    return join(turnLogDir(), "turn-lifecycle.log");
-}
-const MAX_LOG_BYTES = 256 * 1024;
-const KEEP_ROTATIONS = 2;
-/** Shift turn-lifecycle.log -> .1 -> .2 once the active file passes the cap. */
-function rotateIfNeeded(path) {
-    try {
-        if (!statSync(path).isFile() || statSync(path).size < MAX_LOG_BYTES)
-            return;
-        for (let i = KEEP_ROTATIONS; i >= 1; i--) {
-            const from = i === 1 ? path : `${path}.${i - 1}`;
-            const to = `${path}.${i}`;
-            try {
-                renameSync(from, to);
-            }
-            catch {
-                /* absent source — fine */
-            }
-        }
-    }
-    catch {
-        /* rotation is best-effort */
-    }
+    return errorSinkPath();
 }
 /**
  * Append one sanitized lifecycle record. Fail-soft — a logging failure must
@@ -54,16 +33,15 @@ function rotateIfNeeded(path) {
  * raw error message.
  */
 export function logTurnLifecycle(ev) {
-    try {
-        // Hermetic under `node --test`: never touch the real home dir unless a test
-        // explicitly overrode it (same rule as diagnostics.ts, which prevents the
-        // suite's exit from depending on the CI filesystem).
-        if (process.env.NODE_TEST_CONTEXT && homeOverride === null)
-            return;
-        const line = {
-            ts: new Date().toISOString(),
-            event: ev.kind,
-            ...(ev.sessionId ? { sessionId: ev.sessionId } : {}),
+    // Turn lifecycle is the crash-survivable WAL: it must flush SYNCHRONOUSLY so
+    // a turn that starts but never ends still leaves a durable turn_start.
+    logEvent({
+        source: "turn",
+        level: "info",
+        event: ev.kind,
+        sessionId: ev.sessionId,
+        flush: "sync",
+        fields: {
             ...((ev.kind === "turn_start" || ev.kind === "turn_end") && ev.turnIndex !== undefined ? { turnIndex: ev.turnIndex } : {}),
             ...(ev.kind === "turn_end" && ev.stopReason !== undefined ? { stopReason: ev.stopReason } : {}),
             ...(ev.kind === "turn_end" && ev.elapsedMs !== undefined ? { elapsedMs: ev.elapsedMs } : {}),
@@ -71,22 +49,15 @@ export function logTurnLifecycle(ev) {
             ...(ev.kind === "silent_turn" && ev.turnsSinceSpoke !== undefined ? { turnsSinceSpoke: ev.turnsSinceSpoke } : {}),
             ...(ev.kind === "silent_turn_nudge" && ev.nudgesInStretch !== undefined ? { nudgesInStretch: ev.nudgesInStretch } : {}),
             ...(ev.kind === "silent_turn_nudge" && ev.secondsSinceSpoke !== undefined ? { secondsSinceSpoke: ev.secondsSinceSpoke } : {}),
-        };
-        const path = turnLogPath();
-        mkdirSync(dirname(path), { recursive: true });
-        rotateIfNeeded(path);
-        appendFileSync(path, JSON.stringify(line) + "\n", "utf8");
-    }
-    catch {
-        /* logging must never throw into the editor */
-    }
+        },
+    });
 }
 /** List existing lifecycle log files (active + rotations), for a report. */
 export function listTurnLogFiles() {
     try {
         const dir = turnLogDir();
         return readdirSync(dir)
-            .filter((f) => f.startsWith("turn-lifecycle.log"))
+            .filter((f) => f.startsWith("errors-"))
             .sort()
             .map((f) => join(dir, f));
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yagni-app/code-staging",
-  "version": "1.0.0-staging.1174.1",
+  "version": "1.0.0-staging.1175.1",
   "description": "YAGNI Code: a terminal coding agent that already knows your company. One YAGNI login routes the model and grounds the agent in your team's context.",
   "license": "SEE LICENSE IN LICENSE.md",
   "author": "YAGNI, Inc. <jack@yagni.app> (https://yagni.app)",
@@ -40,5 +40,5 @@
     "turndown": "^7.2.4",
     "typebox": "^1.3.15"
   },
-  "yagniSourceSha": "6aea96149e19ec563f629898ed7be21311aa3d76"
+  "yagniSourceSha": "15a46cded8f9e0d2555d02772ca2b0a658684109"
 }