@yagni-app/code-staging 1.1.0-staging.1329.1 → 1.1.0-staging.1335.1

package/dist/cli.d.ts

@@ -12,6 +12,7 @@
  * plus a configured pi spawn. Everything that makes this "YAGNI Code" lives in
  * pi-extension-yagni and the YAGNI backend.
  */
+import { promptKeepOrRemoveWorktree } from "./worktreeExitPrompt.js";
 /**
  * Seed `editorPaddingX` into the per-profile pi `settings.json` so the prompt
  * input aligns with the chat/output area (`outputPad`) and the status bar.
@@ -42,6 +43,56 @@ export declare function seedCollapseChangelog(piAgentDir: string): void;
  * persists the user's choice, so this default is always reversible.
  */
 export declare function seedHideThinkingBlock(piAgentDir: string): boolean;
+/** The structural slice of the extension's session-worktree entry (by file path). */
+interface SessionWorktreeModule {
+    createOrResume: (name: string | undefined, deps: {
+        repoCwd: string;
+    }) => Promise<{
+        worktreePath: string;
+        branch: string;
+        existed: boolean;
+    }>;
+    /** Optional so a stale bundled extension (without the exit prompt support) degrades to the durable summary. */
+    removeSessionWorktree?: (worktreePath: string, branch: string, deps: {
+        repoCwd: string;
+    }) => Promise<{
+        removed: boolean;
+        branchRemoved: boolean;
+        note?: string;
+        branchUnmerged?: boolean;
+    }>;
+}
+/** Seams `handleWorktreeExit` needs; the real one lives in the extension. */
+type WorktreeRemover = NonNullable<SessionWorktreeModule["removeSessionWorktree"]>;
+/** Minimal stream shapes for testability (process.stdin/stderr satisfy these). */
+interface WriteOnlyStream {
+    write(chunk: string): unknown;
+    isTTY?: boolean;
+}
+interface ReadablePromptStream {
+    isTTY?: boolean;
+}
+/** Pure: the one-line worktree summary for the kept path. */
+export declare function worktreeKeptSummary(worktreePath: string, branch: string, existed: boolean): string;
+/**
+ * The post-session worktree exit: prompt Keep/Remove on interactive text
+ * sessions, perform the removal when chosen, and print exactly ONE summary
+ * (kept / not removed / removed) to stderr. Fail-safe in every direction:
+ * an aborted prompt, a refused removal, or an erroring remover all leave the
+ * worktree in place with the durable resume summary printed.
+ */
+export declare function handleWorktreeExit(deps: {
+    worktreePath: string;
+    branch: string;
+    existed: boolean;
+    outputFormat: string;
+    remainingArgs: string[];
+    stdin: ReadablePromptStream;
+    stderr: WriteOnlyStream;
+    cwd: string;
+    removeWorktree?: WorktreeRemover;
+    prompt?: typeof promptKeepOrRemoveWorktree;
+}): Promise<void>;
 export declare const HELP_TEXT: string;
 /** Parse `use <name> [--base-url <url>]` argv into its parts. */
 export declare function parseUseArgs(args: string[]): {
@@ -82,4 +133,5 @@ export declare function main(argv: string[]): Promise<number>;
  * test import (argv[1] points at the test runner) does not.
  */
 export declare function isEntrypoint(argv1: string | undefined, moduleUrl: string): boolean;
+export {};
 //# sourceMappingURL=cli.d.ts.map

package/dist/cli.js

@@ -14,7 +14,7 @@
  */
 import { spawn } from "node:child_process";
 import { chmodSync, existsSync, lstatSync, mkdirSync, readFileSync, realpathSync, renameSync, rmSync, writeFileSync, } from "node:fs";
-import { join } from "node:path";
+import { dirname, join } from "node:path";
 import { createInterface } from "node:readline/promises";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { PI_CONFIG_NAME } from "./branding.js";
@@ -38,7 +38,8 @@ import { currentCliVersion, maybeNudgeAndRefresh, upgradeCommand } from "./upgra
 import { maybeRefreshAtLaunch } from "./refresh.js";
 import { exitCodeFor, installSignalForwarding } from "./signalForward.js";
 import { PAD_X } from "./padding.js";
-import { parseWorktreeFlag, validateWorktreeLaunchArgs } from "./worktreeArgs.js";
+import { canPromptWorktreeCleanup, parseWorktreeFlag, validateWorktreeLaunchArgs, } from "./worktreeArgs.js";
+import { promptKeepOrRemoveWorktree } from "./worktreeExitPrompt.js";
 import { ensureShadowPiPackage } from "./piPackage.js";
 import { resolveExtensionPath, resolvePiCliPath, resolvePiPackageDir, resolveSessionWorktreePath } from "./paths.js";
 import { credentialsFromProfile, getActiveProfileName, listProfiles, migrateLegacyCredentials, persistProfileTokenRotation, profilePath, readActiveProfile, useProfile, } from "./profiles.js";
@@ -371,7 +372,8 @@ async function defaultLoadSessionWorktree() {
  *
  * Delegates all git behavior to the extension's `sessionWorktree` entry; this
  * launcher path only resolves credentials, builds the plan, and spawns pi with
- * `cwd` = the worktree. The worktree is DURABLE — nothing is ever removed.
+ * `cwd` = the worktree. Durable by default: nothing is removed unless the
+ * user explicitly picks Remove at the interactive exit prompt.
  */
 async function runWorktreeLaunch(passthroughArgs, worktreeName, loadSessionWorktree = defaultLoadSessionWorktree) {
     // Validate the name + argv before any side effect (slug guard + `-c`
@@ -486,13 +488,104 @@ async function runWorktreeLaunch(passthroughArgs, worktreeName, loadSessionWorkt
         outputFormat,
         cwd: result.worktreePath,
     });
-    // Durable by default: nothing is removed. Tell the user where their work
-    // lives (stderr only — never stdout, to keep json clean).
-    process.stderr.write(`[yagni] worktree ${result.existed ? "resumed" : "created"}: ${result.worktreePath}\n` +
-        `[yagni] branch: ${result.branch}\n` +
-        `[yagni] resume: cd ${result.worktreePath} && yagni\n`);
+    // Interactive text sessions get a Keep/Remove list (Claude Code parity).
+    // Machine-readable runs (`--output-format json|stream-json`), one-shot `-p`
+    // runs, and piped stdin keep the durable-by-default behavior: no prompt,
+    // nothing removed. A stale bundled extension without
+    // `removeSessionWorktree` also degrades to the durable summary. All output
+    // is stderr — stdout stays clean for every output format.
+    await handleWorktreeExit({
+        worktreePath: result.worktreePath,
+        branch: result.branch,
+        existed: result.existed,
+        outputFormat,
+        remainingArgs,
+        stdin: process.stdin,
+        stderr: process.stderr,
+        cwd: process.cwd(),
+        removeWorktree: sessionWorktree.removeSessionWorktree,
+    });
     return exitCode;
 }
+/** Pure: the one-line worktree summary for the kept path. */
+export function worktreeKeptSummary(worktreePath, branch, existed) {
+    return (`[yagni] worktree ${existed ? "resumed" : "created"}: ${worktreePath}\n` +
+        `[yagni] branch: ${branch}\n` +
+        `[yagni] resume: cd ${worktreePath} && yagni\n`);
+}
+/**
+ * The post-session worktree exit: prompt Keep/Remove on interactive text
+ * sessions, perform the removal when chosen, and print exactly ONE summary
+ * (kept / not removed / removed) to stderr. Fail-safe in every direction:
+ * an aborted prompt, a refused removal, or an erroring remover all leave the
+ * worktree in place with the durable resume summary printed.
+ */
+export async function handleWorktreeExit(deps) {
+    const { worktreePath, branch, existed, outputFormat, remainingArgs, stdin, stderr, cwd, removeWorktree, } = deps;
+    const prompt = deps.prompt ?? promptKeepOrRemoveWorktree;
+    const canPrompt = canPromptWorktreeCleanup(outputFormat, remainingArgs, stdin.isTTY === true) &&
+        removeWorktree !== undefined;
+    let choice;
+    if (canPrompt) {
+        try {
+            choice = await prompt({
+                input: stdin,
+                output: stderr,
+                label: `${worktreePath} — keep or remove?`,
+            });
+        }
+        catch (err) {
+            // A genuine prompt failure (stdin/raw-mode error) must not read as a
+            // silent no-op: say it failed, then keep the worktree as with any abort.
+            stderr.write(`[yagni] exit prompt failed: ${err instanceof Error ? err.message : String(err)}; worktree kept\n`);
+            choice = undefined;
+        }
+    }
+    if (choice !== "remove") {
+        // Keep (default), aborted prompt, or prompt suppressed: durable summary.
+        stderr.write(worktreeKeptSummary(worktreePath, branch, existed));
+        return;
+    }
+    let outcome;
+    try {
+        outcome = await removeWorktree(worktreePath, branch, { repoCwd: cwd });
+    }
+    catch (err) {
+        // The remover throwing (vs returning removed:false) still keeps the work;
+        // never let cleanup turn a successful session into a nonzero exit.
+        stderr.write(`[yagni] worktree NOT removed: ${err instanceof Error ? err.message : String(err)}\n` +
+            worktreeKeptSummary(worktreePath, branch, existed));
+        return;
+    }
+    if (!outcome.removed) {
+        // Git refused (dirty worktree) or failed — the work and the resume path
+        // are both intact, so say so and print the kept summary (not a duplicate).
+        stderr.write(`[yagni] worktree NOT removed${outcome.note ? `: ${outcome.note}` : ""}\n` +
+            worktreeKeptSummary(worktreePath, branch, existed));
+        return;
+    }
+    stderr.write(`[yagni] worktree removed\n` +
+        branchKeptMessage(outcome, branch, worktreePath));
+}
+/**
+ * The branch-status tail of the removed summary. The extension's safe `-d`
+ * (never `-D`) keeps an unmerged branch on disk when its worktree is removed,
+ * so the recovery hint points at an ABSOLUTE path (works from any cwd; a
+ * relative .worktrees/<slug> only resolves from the main repo root). A
+ * branch kept for another reason (checked out elsewhere, git error) states
+ * that reason itself instead of the generic unmerged framing.
+ */
+function branchKeptMessage(outcome, branch, worktreePath) {
+    if (outcome.branchRemoved)
+        return "";
+    const slug = branch.replace(/^agent\//, "");
+    const recovery = `[yagni] branch ${branch} kept — recover with: ` +
+        `git worktree add "${join(dirname(worktreePath), slug)}" ${branch}\n`;
+    if (outcome.branchUnmerged)
+        return recovery;
+    const reason = (outcome.note ?? "unknown reason").replace(/\s+/g, " ").trim();
+    return `[yagni] branch ${branch} kept: ${reason}\n` + recovery;
+}
 export const HELP_TEXT = [
     "YAGNI Code — a business-context-grounded terminal coding agent.",
     "",

package/dist/extension/index.js

@@ -541,6 +541,7 @@ export async function registerYagni(pi, deps = {}) {
             cwd: process.cwd(),
             env,
             hasUI: (ctx) => ctx.hasUI,
+            onShellResolutionRetry: (outcome) => telemetry.sandboxShellResolutionRetry(outcome),
             // Anchors project-protected paths (.yagni-code + its config.json in
             // denyWrite) and project-sourced permission rules to the repo the
             // session runs in — same root the gate uses for its rule anchoring.

package/dist/extension/pipeline/sessionWorktree.d.ts

@@ -10,6 +10,8 @@
  *  - **Add-only creation.** Every git op is `worktree add`, `fetch`, `show-ref`,
  *    `symbolic-ref`, or `rev-parse`. Nothing deletes, force-resets, or
  *    `branch -D`s — the worktree is DURABLE by default and never auto-removed.
+ *    The ONE removal path is `removeSessionWorktree`, which runs only after an
+ *    explicit "Remove worktree" choice at session exit (never automatic).
  *  - **Get-or-resume.** An existing worktree dir is resumed, never recreated.
  *  - **Lazy fetch.** Base `origin/<default>` is read from the local ref when
  *    present; `git fetch` only runs when that ref is absent, and always with
@@ -23,6 +25,18 @@
  * (both gitignored in-repo). PR refs (`#N`, GitHub PR URLs) map to `pr-<N>` and
  * base on `FETCH_HEAD`.
  */
+export interface RemoveSessionWorktreeResult {
+    /** True when the worktree directory is gone from disk. */
+    removed: boolean;
+    /** True when the `agent/<slug>` branch was also deleted (`-d`, safe delete). */
+    branchRemoved: boolean;
+    /** Non-fatal note when cleanup was attempted but could not finish. */
+    note?: string;
+    /** True when the branch was kept because it is not fully merged (the benign
+     * case the recovery hint describes); false when it was kept for another
+     * reason (checked out elsewhere, git error) — the note carries that. */
+    branchUnmerged?: boolean;
+}
 export interface SessionWorktreeResult {
     /** Absolute destination (under `<mainRepo>/.worktrees/<slug>`). */
     worktreePath: string;
@@ -61,4 +75,29 @@ export declare function parsePRReference(input: string): number | null;
  * branch/worktree: validation happens first, and `git worktree add` is atomic.
  */
 export declare function createOrResume(name: string | undefined, deps: CreateOrResumeDeps): Promise<SessionWorktreeResult>;
+/**
+ * Remove a session worktree the user explicitly chose to discard at exit.
+ *
+ * The user's only entry into this is the launcher's "Remove worktree" prompt;
+ * it is NEVER called automatically. Cleanup checks the worktree again at exit:
+ *
+ *  - Require the original branch: removing a clean detached HEAD would discard
+ *    its only reference and reflog, even without `--force`.
+ *  - Refuse ignored content, which Git's dirty check does not protect. This
+ *    includes dependency directories and local env files; review those manually.
+ *  - `git worktree remove` without `--force` refuses tracked changes and
+ *    non-ignored untracked files. `git branch -d` retains branches Git considers
+ *    unmerged (against their upstream, or the main checkout's HEAD).
+ *
+ * These checks do not lock out concurrent edits by other sessions or Git clients.
+ *
+ * `repoCwd` is only used to locate the repo (resolved to the main repo root
+ * before any git op, same as `createOrResume`): the user may have launched
+ * `yagni -w` from inside the worktree being removed, and after `git worktree
+ * remove` that cwd no longer exists on disk.
+ */
+export declare function removeSessionWorktree(worktreePath: string, branch: string, deps: {
+    repoCwd: string;
+    gitImpl?: SessionGit;
+}): Promise<RemoveSessionWorktreeResult>;
 //# sourceMappingURL=sessionWorktree.d.ts.map

package/dist/extension/pipeline/sessionWorktree.js

@@ -10,6 +10,8 @@
  *  - **Add-only creation.** Every git op is `worktree add`, `fetch`, `show-ref`,
  *    `symbolic-ref`, or `rev-parse`. Nothing deletes, force-resets, or
  *    `branch -D`s — the worktree is DURABLE by default and never auto-removed.
+ *    The ONE removal path is `removeSessionWorktree`, which runs only after an
+ *    explicit "Remove worktree" choice at session exit (never automatic).
  *  - **Get-or-resume.** An existing worktree dir is resumed, never recreated.
  *  - **Lazy fetch.** Base `origin/<default>` is read from the local ref when
  *    present; `git fetch` only runs when that ref is absent, and always with
@@ -103,7 +105,7 @@ async function resolveMainRepo(gitImpl, repoCwd) {
         topLevel = await gitImpl(["rev-parse", "--show-toplevel"], repoCwd);
     }
     catch (err) {
-        throw new Error(`Cannot create a worktree: not inside a git repository. ` +
+        throw new Error(`Cannot resolve the repository root: not inside a git repository. ` +
             `${err instanceof Error ? err.message : String(err)}`);
     }
     const common = await gitImpl(["rev-parse", "--git-common-dir"], repoCwd);
@@ -222,4 +224,80 @@ export async function createOrResume(name, deps) {
     }
     return { worktreePath, branch, existed: false };
 }
+/**
+ * Remove a session worktree the user explicitly chose to discard at exit.
+ *
+ * The user's only entry into this is the launcher's "Remove worktree" prompt;
+ * it is NEVER called automatically. Cleanup checks the worktree again at exit:
+ *
+ *  - Require the original branch: removing a clean detached HEAD would discard
+ *    its only reference and reflog, even without `--force`.
+ *  - Refuse ignored content, which Git's dirty check does not protect. This
+ *    includes dependency directories and local env files; review those manually.
+ *  - `git worktree remove` without `--force` refuses tracked changes and
+ *    non-ignored untracked files. `git branch -d` retains branches Git considers
+ *    unmerged (against their upstream, or the main checkout's HEAD).
+ *
+ * These checks do not lock out concurrent edits by other sessions or Git clients.
+ *
+ * `repoCwd` is only used to locate the repo (resolved to the main repo root
+ * before any git op, same as `createOrResume`): the user may have launched
+ * `yagni -w` from inside the worktree being removed, and after `git worktree
+ * remove` that cwd no longer exists on disk.
+ */
+export async function removeSessionWorktree(worktreePath, branch, deps) {
+    const gitImpl = deps.gitImpl ?? defaultGit;
+    // Resolve the MAIN repo root first: every later git op must run from a cwd
+    // that survives the removal (repoCwd may be the worktree being removed).
+    const repoRoot = await resolveMainRepo(gitImpl, deps.repoCwd);
+    try {
+        const ignored = await gitImpl(["ls-files", "--others", "--ignored", "--exclude-standard", "--directory", "-z"], worktreePath);
+        if (ignored) {
+            const paths = ignored.split("\0").filter(Boolean);
+            const preview = paths.slice(0, 5).map((path) => JSON.stringify(path)).join(", ");
+            const more = paths.length > 5 ? ` (+${paths.length - 5} more)` : "";
+            return {
+                removed: false,
+                branchRemoved: false,
+                note: `worktree contains ignored content: ${preview}${more}; review and remove it manually before retrying cleanup`,
+            };
+        }
+        const headRef = await gitImpl(["rev-parse", "--symbolic-full-name", "HEAD"], worktreePath);
+        if (headRef !== `refs/heads/${branch}`) {
+            return {
+                removed: false,
+                branchRemoved: false,
+                note: headRef === "HEAD"
+                    ? "worktree HEAD is detached; preserve that work on a branch before retrying cleanup"
+                    : `worktree HEAD is ${JSON.stringify(headRef)}, no longer on branch ${branch}; preserve that work before retrying cleanup`,
+            };
+        }
+        await gitImpl(["worktree", "remove", worktreePath], repoRoot);
+    }
+    catch (err) {
+        return {
+            removed: false,
+            branchRemoved: false,
+            note: err instanceof Error ? err.message : String(err),
+        };
+    }
+    // Safe delete: only removes a fully-merged branch. Unmerged work stays
+    // recoverable on the branch — the directory is gone but the ref is not.
+    try {
+        await gitImpl(["branch", "-d", branch], repoRoot);
+        return { removed: true, branchRemoved: true };
+    }
+    catch (err) {
+        // Distinguish the benign case (unmerged branch, deliberately kept) from
+        // a git-level failure so the exit summary can say which it was.
+        const message = err instanceof Error ? err.message : String(err);
+        const unmerged = /not fully merged|unmerged/i.test(message);
+        return {
+            removed: true,
+            branchRemoved: false,
+            branchUnmerged: unmerged,
+            ...(unmerged ? {} : { note: message }),
+        };
+    }
+}
 //# sourceMappingURL=sessionWorktree.js.map

package/dist/extension/sandbox/bash.d.ts

@@ -61,8 +61,27 @@ export declare function makeSandboxSpawnHook(manager: YagniSandboxManager): Bash
  * Wrap a raw command for OS-sandboxed execution. Returns the original string
  * when the manager is not initialized (fail-open to plain execution — the
  * permission gate still ran; the sandbox simply is not active).
+ *
+ * Transient shell-resolution failures (isShellResolutionFailure — srt's 1s
+ * `which` spawn timing out under load) are retried once after a short
+ * backoff; a second failure surfaces the original error. Any other error
+ * propagates immediately, no retry.
  */
-export declare function preWrappedCommand(manager: YagniSandboxManager, command: string, binShell?: string): Promise<string>;
+export interface PreWrapRetryOpts {
+    /** Abort the backoff sleep (the tool call's signal). */
+    signal?: AbortSignal;
+    /** Backoff before the single retry. Tests pass a tiny value to stay fast. */
+    backoffMs?: number;
+    /** Instrumentation: fired once, with the retry's terminal outcome. */
+    onRetry?: (outcome: "recovered" | "exhausted") => void;
+}
+export declare function preWrappedCommand(manager: YagniSandboxManager, command: string, binShell?: string, opts?: PreWrapRetryOpts): Promise<string>;
+export declare function _setShellResolutionRetryBackoffForTest(ms: number | null): void;
+/** srt's transient shell-resolution failure: `Shell '<name>' not found in
+ * PATH`, thrown from wrapCommandWithSandbox when which.js's 1s
+ * spawnSync('which') times out under load. Self-healing after ~15–30s;
+ * preWrappedCommand retries it once. */
+export declare function isShellResolutionFailure(err: unknown): boolean;
 /**
  * Detect "Operation not permitted" style sandbox denials in bash output so
  * callers (tool_result) can annotate and the model can react. Returns the

package/dist/extension/sandbox/bash.js

@@ -21,6 +21,8 @@
  * lessons (process-group kill, stdio release).
  */
 import { existsSync } from "node:fs";
+import { logEvent } from "../errorSink.js";
+import { scrubSecrets } from "../pipeline/scrubSecrets.js";
 function stripLeadingSafeEnvVars(command) {
     // Best-effort normalization for excludedCommands matching (not a security
     // boundary — the permission gate is). Strips leading VAR=val pairs whose
@@ -112,15 +114,116 @@ export function makeSandboxSpawnHook(manager) {
         env: { ...ctx.env, ...extraEnv },
     });
 }
-/**
- * Wrap a raw command for OS-sandboxed execution. Returns the original string
- * when the manager is not initialized (fail-open to plain execution — the
- * permission gate still ran; the sandbox simply is not active).
- */
-export async function preWrappedCommand(manager, command, binShell) {
+export async function preWrappedCommand(manager, command, binShell, opts = {}) {
     if (!manager.initialized)
         return command;
-    return manager.wrapWithSandbox(command, binShell);
+    try {
+        return await manager.wrapWithSandbox(command, binShell);
+    }
+    catch (err) {
+        if (!isShellResolutionFailure(err))
+            throw err;
+    }
+    // The failed attempt may have left per-command state behind (the wrap can
+    // start helpers before it throws); clear it so the retry starts clean and
+    // the exec path's cleanupAfterCommand never sees double state. Best-effort:
+    // a cleanup throw must never swallow the original error or kill the retry.
+    try {
+        manager.cleanupAfterCommand();
+    }
+    catch (err) {
+        // Best-effort cleanup failed — the retry still runs (the exec path
+        // cleans up again); a fully silent swallow would hide a leaked-helper
+        // state, so the failure gets a visible trail. The message rides the
+        // line (the error class alone is always the literal "Error" for plain
+        // throws) and is run through scrubSecrets at WRITE time so the line
+        // is credential-scrubbed before any reader. That is pattern-scrub
+        // only, not a general redactor — readSessionTrail adds the same
+        // pattern pass at read time; the durable errors-*.jsonl stays
+        // unredacted by the sink's documented design (local file, never
+        // uploaded raw). Same posture as sandbox_persist_failed.
+        logEvent({
+            source: "sandbox",
+            level: "warn",
+            event: "shell_retry_cleanup_failed",
+            fields: {
+                error: scrubSecrets(err instanceof Error ? `${err.constructor.name}: ${err.message}` : String(err)),
+            },
+        });
+    }
+    await sleep(effectiveBackoffMs(opts.backoffMs), opts.signal);
+    try {
+        const wrapped = await manager.wrapWithSandbox(command, binShell);
+        opts.onRetry?.("recovered");
+        return wrapped;
+    }
+    catch (err) {
+        // `exhausted` is the shell-resolution health signal — report it only
+        // when the second failure is the SAME transient; an unrelated retry
+        // error propagates as-is without polluting the metric.
+        if (isShellResolutionFailure(err))
+            opts.onRetry?.("exhausted");
+        throw err;
+    }
+}
+/** Default backoff before the single shell-resolution retry. The observed
+ * upstream transient self-heals in ~15–30s; this is a bounded bridge, not
+ * a guarantee — a still-failing second attempt surfaces the original error. */
+const SHELL_RESOLUTION_RETRY_BACKOFF_MS = 2000;
+/** Test seam for the backoff: session-layer tests (composition, user_bash)
+ * drive the retry without a backoffMs opt, so they shrink the module-level
+ * default instead of sleeping a real 2s. Module-scoped (never a globalThis
+ * key — a leaked value there would silently shrink the production backoff);
+ * restore in the same describe that sets it. */
+let shellRetryBackoffMsForTest = null;
+export function _setShellResolutionRetryBackoffForTest(ms) {
+    shellRetryBackoffMsForTest = ms;
+}
+function effectiveBackoffMs(override) {
+    return override ?? shellRetryBackoffMsForTest ?? SHELL_RESOLUTION_RETRY_BACKOFF_MS;
+}
+function sleep(ms, signal) {
+    // The abort rejection carries the caller's own abort reason when the
+    // signal has a real one — a context-free "aborted" would replace the
+    // meaningful error the caller (and the model) should see. Node's DEFAULT
+    // reason is a generic DOMException ("This operation was aborted") with no
+    // retry context, so it is replaced with a named message too.
+    const abortError = () => {
+        const reason = signal?.reason;
+        if (reason instanceof Error && reason.name !== "AbortError")
+            return reason;
+        // A non-Error reason is spec-legal (controller.abort("user cancelled"))
+        // — stringify it rather than silently dropping it for the generic name.
+        // The DEFAULT reason (AbortError DOMException) stays on the named
+        // message: stringifying it would read "aborted: This operation was
+        // aborted".
+        if (reason !== undefined && reason !== null && !(reason instanceof Error)) {
+            return new Error(`sandbox shell-resolution retry aborted: ${String(reason)}`);
+        }
+        return new Error("sandbox shell-resolution retry aborted");
+    };
+    return new Promise((resolve, reject) => {
+        if (signal?.aborted) {
+            reject(abortError());
+            return;
+        }
+        const t = setTimeout(() => {
+            signal?.removeEventListener("abort", onAbort);
+            resolve();
+        }, ms);
+        const onAbort = () => {
+            clearTimeout(t);
+            reject(abortError());
+        };
+        signal?.addEventListener("abort", onAbort, { once: true });
+    });
+}
+/** srt's transient shell-resolution failure: `Shell '<name>' not found in
+ * PATH`, thrown from wrapCommandWithSandbox when which.js's 1s
+ * spawnSync('which') times out under load. Self-healing after ~15–30s;
+ * preWrappedCommand retries it once. */
+export function isShellResolutionFailure(err) {
+    return err instanceof Error && /^Shell '[^']*' not found in PATH$/.test(err.message);
 }
 /**
  * Detect "Operation not permitted" style sandbox denials in bash output so

package/dist/extension/sandbox/session.d.ts

@@ -28,7 +28,7 @@ import type { PermissionRule } from "../permissionRules/loadConfig.js";
  * here would be overwritten and the sandbox would silently never reach
  * model-driven tool calls.
  */
-export declare function makeBashComposition(manager: YagniSandboxManager, settings: () => SandboxSettings, cwd: string): (def: ToolDefinition) => ToolDefinition;
+export declare function makeBashComposition(manager: YagniSandboxManager, settings: () => SandboxSettings, cwd: string, onShellResolutionRetry?: (outcome: "recovered" | "exhausted") => void): (def: ToolDefinition) => ToolDefinition;
 export interface SandboxSessionHandle {
     manager: YagniSandboxManager;
     settings: () => SandboxSettings;
@@ -76,6 +76,10 @@ export interface RegisterSandboxOptions {
      * registration (the duplicate-name 400 + silent-unwrap lesson from M4).
      */
     registerOwnBash?: boolean;
+    /** Shell-resolution retry instrumentation (the OTel counter — index.ts
+     * wires the telemetry handle). Absent (eval mode, tests) ⇒ only the local
+     * sink line fires. */
+    onShellResolutionRetry?: (outcome: "recovered" | "exhausted") => void;
 }
 /**
  * Register the sandbox surfaces on the ExtensionAPI. Returns the session

package/dist/extension/sandbox/session.js

@@ -39,7 +39,7 @@ import { effectiveRules } from "../permissionRules/loadConfig.js";
  * here would be overwritten and the sandbox would silently never reach
  * model-driven tool calls.
  */
-export function makeBashComposition(manager, settings, cwd) {
+export function makeBashComposition(manager, settings, cwd, onShellResolutionRetry) {
     return (def) => {
         if (!settings().enabled)
             return def;
@@ -115,9 +115,13 @@ export function makeBashComposition(manager, settings, cwd) {
                 if (!useSandbox) {
                     return def.execute(id, params, signal, onUpdate, ctx);
                 }
-                const execParams = { ...input, command: await preWrappedCommand(manager, input.command, binShell) };
                 let result;
                 try {
+                    const command = await preWrappedCommand(manager, input.command, binShell, {
+                        signal: signal ?? undefined,
+                        onRetry: onShellResolutionRetry,
+                    });
+                    const execParams = { ...input, command };
                     result = await sandboxBash.execute(id, execParams, signal, onUpdate, ctx);
                 }
                 catch (err) {
@@ -309,7 +313,11 @@ export function registerSandbox(pi, opts) {
     // registration when condensed is inactive (eval mode, classic rows,
     // desktop). The composition is identity when the sandbox is disabled —
     // default-off sessions stay byte-identical.
-    const composeBash = makeBashComposition(manager, () => currentSettings, opts.cwd);
+    const onShellResolutionRetry = (outcome) => {
+        logShellResolutionRetry(outcome);
+        opts.onShellResolutionRetry?.(outcome);
+    };
+    const composeBash = makeBashComposition(manager, () => currentSettings, opts.cwd, onShellResolutionRetry);
     const registerOwnBash = () => {
         if (!currentSettings.enabled)
             return;
@@ -345,7 +353,10 @@ export function registerSandbox(pi, opts) {
             exec: async (command, cwd, { onData, signal, timeout, env }) => {
                 if (!existsSync(cwd))
                     throw new Error(`Working directory does not exist: ${cwd}`);
-                const wrapped = await manager.wrapWithSandbox(command, shell);
+                const wrapped = await preWrappedCommand(manager, command, shell, {
+                    signal,
+                    onRetry: onShellResolutionRetry,
+                });
                 const child = spawn(shell, [...args, wrapped], {
                     cwd,
                     env: env ?? process.env,
@@ -781,6 +792,19 @@ export function registerSandbox(pi, opts) {
 function isPlainRecord(v) {
     return typeof v === "object" && v !== null && !Array.isArray(v);
 }
+/** Sink line for the transient shell-resolution retry: outcome only (a
+ * closed enum, no command or shell content — scrub-safe, so it rides the
+ * default-on tier and /feedback). `recovered` = the retry healed a
+ * transient srt `which` timeout; `exhausted` = the failure surfaced to the
+ * model (warn, the break-glass signal). */
+function logShellResolutionRetry(outcome) {
+    logEvent({
+        source: "sandbox",
+        level: outcome === "recovered" ? "info" : "warn",
+        event: "shell_resolution_retry",
+        fields: { outcome },
+    });
+}
 /** Sink line when the network-posture classifier fires — the impact
  * signal (paired with tool_execute_decision's useSandbox it makes the
  * escape-rate before/after readable from the trail). Closed enum class,

package/dist/extension/telemetry/attrs.d.ts

@@ -85,6 +85,7 @@ export declare const METRIC_COST_USAGE = "yagni_code.cost.usage";
 export declare const METRIC_TOKEN_USAGE = "yagni_code.token.usage";
 export declare const METRIC_CODE_EDIT_DECISION = "yagni_code.code_edit_tool.decision";
 export declare const METRIC_ACTIVE_TIME = "yagni_code.active_time.total";
+export declare const METRIC_SANDBOX_SHELL_RETRY = "yagni_code.sandbox.shell_resolution_retry.count";
 export declare const EVENT_USER_PROMPT = "user_prompt";
 export declare const EVENT_ASSISTANT_RESPONSE = "assistant_response";
 export declare const EVENT_TOOL_RESULT = "tool_result";

package/dist/extension/telemetry/attrs.js

@@ -89,6 +89,7 @@ export const METRIC_COST_USAGE = `${PREFIX}.cost.usage`;
 export const METRIC_TOKEN_USAGE = `${PREFIX}.token.usage`;
 export const METRIC_CODE_EDIT_DECISION = `${PREFIX}.code_edit_tool.decision`;
 export const METRIC_ACTIVE_TIME = `${PREFIX}.active_time.total`;
+export const METRIC_SANDBOX_SHELL_RETRY = `${PREFIX}.sandbox.shell_resolution_retry.count`;
 // ── Event names (Claude Code's log events, prefixed in the body) ────────────
 export const EVENT_USER_PROMPT = "user_prompt";
 export const EVENT_ASSISTANT_RESPONSE = "assistant_response";

package/dist/extension/telemetry/register.d.ts

@@ -34,6 +34,8 @@ export interface TelemetryHandle {
      * to the `includeAccountId` gate).
      */
     setUserEmail(email: string | undefined): void;
+    /** The sandbox's shell-resolution retry calls this with its outcome. */
+    sandboxShellResolutionRetry(outcome: "recovered" | "exhausted"): void;
     /** Test/introspection seam: the live tracker once the SDK is up. */
     readonly tracker: SessionTelemetry | null;
 }

package/dist/extension/telemetry/register.js

@@ -28,6 +28,7 @@ const NOOP_HANDLE = (config) => ({
     toolDecision: () => { },
     permissionModeChanged: () => { },
     setUserEmail: () => { },
+    sandboxShellResolutionRetry: () => { },
     tracker: null,
 });
 export function registerTelemetry(pi, deps = {}) {
@@ -188,6 +189,7 @@ export function registerTelemetry(pi, deps = {}) {
         },
         toolDecision: guard("tool_decision", (input) => tracker?.toolDecision(input)),
         permissionModeChanged: guard("permission_mode_changed", (from, to) => tracker?.permissionModeChanged(from, to)),
+        sandboxShellResolutionRetry: guard("sandbox_shell_resolution_retry", (outcome) => tracker?.sandboxShellResolutionRetry(outcome)),
         // Precedence, lowest to highest: this call (the /context boot fetch) <
         // the launcher's YAGNI_USER_EMAIL, which resolveTelemetryConfig already
         // placed on `identity`. So an identity that is set is never overwritten,

package/dist/extension/telemetry/tracker.d.ts

@@ -110,6 +110,10 @@ export declare class SessionTelemetry {
     }): void;
     /** Lines added/removed by an edit or write, from pi's tool_result details. */
     linesOfCode(added: number, removed: number): void;
+    /** Transient sandbox shell-resolution failure retried by the wrap seam —
+     * `recovered` (retry healed it) vs `exhausted` (error surfaced to the
+     * model). The post-deploy health signal for the retry feature. */
+    sandboxShellResolutionRetry(outcome: "recovered" | "exhausted"): void;
     /** A successful bash command: count commits and PR creations. */
     bashSucceeded(command: string | undefined): void;
     permissionModeChanged(fromMode: string, toMode: string): void;

package/dist/extension/telemetry/tracker.js

@@ -20,7 +20,7 @@
 import { randomUUID } from "node:crypto";
 import { context as otelContext, SpanStatusCode, trace, } from "@opentelemetry/api";
 import { SeverityNumber } from "@opentelemetry/api-logs";
-import { ATTR_APP_ENTRYPOINT, ATTR_APP_VERSION, ATTR_ERROR_TYPE, ATTR_GEN_AI_AGENT_NAME, ATTR_GEN_AI_CACHE_CREATION_TOKENS_LEGACY, ATTR_GEN_AI_CACHE_READ_TOKENS, ATTR_GEN_AI_CACHE_READ_TOKENS_LEGACY, ATTR_GEN_AI_CACHE_WRITE_TOKENS, ATTR_DD_LLMOBS_METADATA, ATTR_GEN_AI_CONVERSATION_ID, ATTR_GEN_AI_COST_ESTIMATED_TOTAL, ATTR_GEN_AI_FINISH_REASONS, ATTR_GEN_AI_INPUT_TOKENS, ATTR_GEN_AI_OPERATION_NAME, ATTR_GEN_AI_OUTPUT_TOKENS, ATTR_GEN_AI_TOTAL_TOKENS, ATTR_GEN_AI_PROVIDER_NAME, ATTR_GEN_AI_REQUEST_MODEL, ATTR_GEN_AI_RESPONSE_ID, ATTR_GEN_AI_RESPONSE_MODEL, ATTR_GEN_AI_SYSTEM, ATTR_GEN_AI_TOOL_CALL_ID, ATTR_GEN_AI_TOOL_NAME, ATTR_GEN_AI_TOOL_TYPE, ATTR_HTTP_STATUS_CODE, ATTR_ORGANIZATION_ID, ATTR_SESSION_ID, ATTR_TERMINAL_TYPE, ATTR_USER_EMAIL, EVENT_API_ERROR, EVENT_API_REQUEST, EVENT_ASSISTANT_RESPONSE, EVENT_PERMISSION_MODE_CHANGED, EVENT_TOOL_DECISION, EVENT_TOOL_RESULT, EVENT_USER_PROMPT, GEN_AI_PROVIDER, languageFromPath, METRIC_ACTIVE_TIME, METRIC_CODE_EDIT_DECISION, METRIC_COMMIT_COUNT, METRIC_COST_USAGE, METRIC_LINES_OF_CODE, METRIC_PULL_REQUEST_COUNT, METRIC_SESSION_COUNT, METRIC_TOKEN_USAGE, PREFIX, SPAN_INTERACTION, SPAN_LLM_REQUEST, SPAN_TOOL, SPAN_TURN, } from "./attrs.js";
+import { ATTR_APP_ENTRYPOINT, ATTR_APP_VERSION, ATTR_ERROR_TYPE, ATTR_GEN_AI_AGENT_NAME, ATTR_GEN_AI_CACHE_CREATION_TOKENS_LEGACY, ATTR_GEN_AI_CACHE_READ_TOKENS, ATTR_GEN_AI_CACHE_READ_TOKENS_LEGACY, ATTR_GEN_AI_CACHE_WRITE_TOKENS, ATTR_DD_LLMOBS_METADATA, ATTR_GEN_AI_CONVERSATION_ID, ATTR_GEN_AI_COST_ESTIMATED_TOTAL, ATTR_GEN_AI_FINISH_REASONS, ATTR_GEN_AI_INPUT_TOKENS, ATTR_GEN_AI_OPERATION_NAME, ATTR_GEN_AI_OUTPUT_TOKENS, ATTR_GEN_AI_TOTAL_TOKENS, ATTR_GEN_AI_PROVIDER_NAME, ATTR_GEN_AI_REQUEST_MODEL, ATTR_GEN_AI_RESPONSE_ID, ATTR_GEN_AI_RESPONSE_MODEL, ATTR_GEN_AI_SYSTEM, ATTR_GEN_AI_TOOL_CALL_ID, ATTR_GEN_AI_TOOL_NAME, ATTR_GEN_AI_TOOL_TYPE, ATTR_HTTP_STATUS_CODE, ATTR_ORGANIZATION_ID, ATTR_SESSION_ID, ATTR_TERMINAL_TYPE, ATTR_USER_EMAIL, EVENT_API_ERROR, EVENT_API_REQUEST, EVENT_ASSISTANT_RESPONSE, EVENT_PERMISSION_MODE_CHANGED, EVENT_TOOL_DECISION, EVENT_TOOL_RESULT, EVENT_USER_PROMPT, GEN_AI_PROVIDER, languageFromPath, METRIC_ACTIVE_TIME, METRIC_CODE_EDIT_DECISION, METRIC_COMMIT_COUNT, METRIC_COST_USAGE, METRIC_LINES_OF_CODE, METRIC_PULL_REQUEST_COUNT, METRIC_SANDBOX_SHELL_RETRY, METRIC_SESSION_COUNT, METRIC_TOKEN_USAGE, PREFIX, SPAN_INTERACTION, SPAN_LLM_REQUEST, SPAN_TOOL, SPAN_TURN, } from "./attrs.js";
 /** Idle cutoff for user active time: gaps longer than this are not "active". */
 export const USER_ACTIVE_IDLE_CUTOFF_MS = 5 * 60 * 1000;
 const EDIT_TOOLS = new Set(["edit", "write", "multi_edit", "notebook_edit"]);
@@ -463,6 +463,12 @@ export class SessionTelemetry {
         this.add(METRIC_LINES_OF_CODE, "1", "Count of lines of code modified", added, { type: "added" });
         this.add(METRIC_LINES_OF_CODE, "1", "Count of lines of code modified", removed, { type: "removed" });
     }
+    /** Transient sandbox shell-resolution failure retried by the wrap seam —
+     * `recovered` (retry healed it) vs `exhausted` (error surfaced to the
+     * model). The post-deploy health signal for the retry feature. */
+    sandboxShellResolutionRetry(outcome) {
+        this.add(METRIC_SANDBOX_SHELL_RETRY, "1", "Sandbox shell-resolution transient failures, by retry outcome", 1, { outcome });
+    }
     /** A successful bash command: count commits and PR creations. */
     bashSucceeded(command) {
         if (typeof command !== "string")

package/dist/worktreeArgs.d.ts

@@ -33,6 +33,17 @@ export declare function parsePRReference(input: string): number | null;
  * with a clear message (surfaced by the caller).
  */
 export declare function validateWorktreeSlug(slug: string): void;
+/**
+ * Whether a `-w` session exit can show the interactive Keep/Remove prompt.
+ *
+ * The prompt is an interactive-TUI-only affordance. It is suppressed for:
+ *  - `--output-format json|stream-json` (machine-readable stdout must stay a
+ *    single clean result object; a trailing readline prompt would corrupt it);
+ *  - `-p`/`--print` one-shot runs (they exit, they never linger for a prompt);
+ *  - non-TTY stdin (piped/CI runs must not hang on a question nobody answers).
+ * The default `text` format with a TTY is the only path that prompts.
+ */
+export declare function canPromptWorktreeCleanup(outputFormat: string, remainingArgs: string[], isTTY: boolean): boolean;
 /**
  * Validate the `-w` name + argv before any side effect. Returns a user-facing
  * error message when the launch should be refused, or `undefined` to proceed.

package/dist/worktreeArgs.js

@@ -73,6 +73,23 @@ export function validateWorktreeSlug(slug) {
         }
     }
 }
+/**
+ * Whether a `-w` session exit can show the interactive Keep/Remove prompt.
+ *
+ * The prompt is an interactive-TUI-only affordance. It is suppressed for:
+ *  - `--output-format json|stream-json` (machine-readable stdout must stay a
+ *    single clean result object; a trailing readline prompt would corrupt it);
+ *  - `-p`/`--print` one-shot runs (they exit, they never linger for a prompt);
+ *  - non-TTY stdin (piped/CI runs must not hang on a question nobody answers).
+ * The default `text` format with a TTY is the only path that prompts.
+ */
+export function canPromptWorktreeCleanup(outputFormat, remainingArgs, isTTY) {
+    if (outputFormat !== "text")
+        return false;
+    if (!isTTY)
+        return false;
+    return !remainingArgs.some((a) => a === "-p" || a === "--print" || a.startsWith("--print="));
+}
 /**
  * Validate the `-w` name + argv before any side effect. Returns a user-facing
  * error message when the launch should be refused, or `undefined` to proceed.

package/dist/worktreeExitPrompt.d.ts

@@ -0,0 +1,54 @@
+/**
+ * The arrow-key Keep/Remove list shown after an interactive `-w` session exits.
+ *
+ * Claude Code parity: a two-option list navigated with the up/down arrows and
+ * confirmed with Enter — not a y/N question. Keep is the default (highlighted
+ * first), and every escape hatch — Esc, q, Ctrl+C, EOF, a non-TTY stream —
+ * fails safe to Keep (resolves `undefined`, which callers treat as keep).
+ *
+ * This module owns the raw-TTY interaction only. The gating (which launches
+ * may prompt at all) lives in `canPromptWorktreeCleanup` (worktreeArgs.ts),
+ * and the git behavior lives in the extension's `removeSessionWorktree`.
+ */
+export type WorktreeExitChoice = "keep" | "remove";
+/** Minimal stream shape the prompt needs (satisfied by process.stdin/stderr). */
+export interface ExitPromptStream {
+    write(chunk: string): unknown;
+    isTTY?: boolean;
+}
+/** The structural slice of a readline keypress event. */
+export interface ExitPromptKey {
+    name?: string;
+    ctrl?: boolean;
+}
+export type ExitPromptAction = {
+    type: "toggle";
+} | {
+    type: "confirm";
+} | {
+    type: "abort";
+} | {
+    type: "noop";
+};
+/**
+ * Map a keypress to its prompt action (pure, unit-tested). Arrows (plus
+ * k/j/tab) toggle between the two options; Enter or Space confirms; Esc, q,
+ * Ctrl+C, and Ctrl+D abort (fail-safe to Keep); anything else is ignored so
+ * stray keys can neither confirm nor abort by accident.
+ */
+export declare function exitPromptAction(key: ExitPromptKey): ExitPromptAction;
+/**
+ * Show the Keep/Remove list and resolve with the user's choice.
+ *
+ * Resolves `"keep"`/`"remove"` on Enter, or `undefined` when aborted
+ * (Esc/q/Ctrl+C/Ctrl+D/EOF) or when either stream is not a TTY — callers treat
+ * `undefined` exactly like `"keep"`: nothing is removed.
+ */
+export declare function promptKeepOrRemoveWorktree(opts: {
+    input: NodeJS.ReadStream & {
+        isTTY?: boolean;
+    };
+    output: ExitPromptStream;
+    label: string;
+}): Promise<WorktreeExitChoice | undefined>;
+//# sourceMappingURL=worktreeExitPrompt.d.ts.map

package/dist/worktreeExitPrompt.js

@@ -0,0 +1,108 @@
+/**
+ * The arrow-key Keep/Remove list shown after an interactive `-w` session exits.
+ *
+ * Claude Code parity: a two-option list navigated with the up/down arrows and
+ * confirmed with Enter — not a y/N question. Keep is the default (highlighted
+ * first), and every escape hatch — Esc, q, Ctrl+C, EOF, a non-TTY stream —
+ * fails safe to Keep (resolves `undefined`, which callers treat as keep).
+ *
+ * This module owns the raw-TTY interaction only. The gating (which launches
+ * may prompt at all) lives in `canPromptWorktreeCleanup` (worktreeArgs.ts),
+ * and the git behavior lives in the extension's `removeSessionWorktree`.
+ */
+import { emitKeypressEvents } from "node:readline";
+const OPTION_KEEP = "Keep worktree";
+const OPTION_REMOVE = "Remove worktree";
+/**
+ * Map a keypress to its prompt action (pure, unit-tested). Arrows (plus
+ * k/j/tab) toggle between the two options; Enter or Space confirms; Esc, q,
+ * Ctrl+C, and Ctrl+D abort (fail-safe to Keep); anything else is ignored so
+ * stray keys can neither confirm nor abort by accident.
+ */
+export function exitPromptAction(key) {
+    if (key.ctrl && (key.name === "c" || key.name === "d"))
+        return { type: "abort" };
+    switch (key.name) {
+        case "up":
+        case "down":
+        case "k":
+        case "j":
+        case "tab":
+            return { type: "toggle" };
+        case "return":
+        case "enter":
+        case "space":
+            return { type: "confirm" };
+        case "escape":
+        case "q":
+            return { type: "abort" };
+        default:
+            return { type: "noop" };
+    }
+}
+function renderOptions(output, index) {
+    const marker = (i) => (i === index ? "❯ " : "  ");
+    output.write(`\r\x1b[2K${marker(0)}${OPTION_KEEP}\n`);
+    output.write(`\r\x1b[2K${marker(1)}${OPTION_REMOVE}\n`);
+}
+/** Erase the two option lines, leaving the cursor just below where they were. */
+function eraseOptions(output) {
+    output.write("\x1b[2A\r\x1b[2K\x1b[1B\r\x1b[2K\x1b[1B");
+}
+/**
+ * Show the Keep/Remove list and resolve with the user's choice.
+ *
+ * Resolves `"keep"`/`"remove"` on Enter, or `undefined` when aborted
+ * (Esc/q/Ctrl+C/Ctrl+D/EOF) or when either stream is not a TTY — callers treat
+ * `undefined` exactly like `"keep"`: nothing is removed.
+ */
+export async function promptKeepOrRemoveWorktree(opts) {
+    const { input, output, label } = opts;
+    // Fail safe when the terminal cannot render an interactive list.
+    if (input.isTTY !== true || output.isTTY !== true)
+        return undefined;
+    let index = 0; // Keep is the default
+    output.write(`\n[yagni] ${label}\n`);
+    renderOptions(output, index);
+    const canRawMode = typeof input.setRawMode === "function";
+    const wasRaw = canRawMode ? input.isRaw === true : false;
+    if (canRawMode)
+        input.setRawMode(true);
+    emitKeypressEvents(input);
+    input.resume();
+    try {
+        return await new Promise((resolve) => {
+            const cleanup = () => {
+                input.removeListener("keypress", onKeypress);
+                input.removeListener("end", onEnd);
+            };
+            const onKeypress = (_str, key) => {
+                const action = exitPromptAction(key ?? {});
+                if (action.type === "noop")
+                    return;
+                if (action.type === "toggle") {
+                    index = index === 0 ? 1 : 0;
+                    eraseOptions(output);
+                    renderOptions(output, index);
+                    return;
+                }
+                cleanup();
+                eraseOptions(output);
+                resolve(action.type === "confirm" ? (index === 0 ? "keep" : "remove") : undefined);
+            };
+            // EOF (Ctrl+D is caught above as abort; a closed stdin arrives here).
+            const onEnd = () => {
+                cleanup();
+                resolve(undefined);
+            };
+            input.on("keypress", onKeypress);
+            input.on("end", onEnd);
+        });
+    }
+    finally {
+        if (canRawMode)
+            input.setRawMode(wasRaw);
+        input.pause();
+    }
+}
+//# sourceMappingURL=worktreeExitPrompt.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yagni-app/code-staging",
-  "version": "1.1.0-staging.1329.1",
+  "version": "1.1.0-staging.1335.1",
   "description": "YAGNI Code: a terminal coding agent that already knows your company. One YAGNI login routes the model and grounds the agent in your team's context.",
   "license": "SEE LICENSE IN LICENSE.md",
   "author": "YAGNI, Inc. <jack@yagni.app> (https://yagni.app)",
@@ -58,5 +58,5 @@
     "turndown": "^7.2.4",
     "typebox": "^1.3.15"
   },
-  "yagniSourceSha": "36a0344047224a979e0714451f6e710658d1454b"
+  "yagniSourceSha": "fe89db90856f43da8d645abeb16d448c83bb8e33"
 }