@yagni-app/code-staging 1.1.4-staging.1409.1 → 1.1.4-staging.1412.1

package/dist/extension/index.js

@@ -925,7 +925,16 @@ export async function registerYagni(pi, deps = {}) {
         // byte-identical to the pre-consult behavior.
         ...(evalMode || env.YAGNI_DISABLE_PREFIX_CONSULT === "1" || env.YAGNI_DISABLE_PREFIX_CONSULT === "true"
             ? {}
-            : { prefixConsult: {} }),
+            : {
+                prefixConsult: {
+                    // The in-process direct transport (no child spawn): the consult
+                    // rides /v1/chat/completions with the prefix persona as the
+                    // system prompt, the session's token, and the session's
+                    // attribution headers. The gate sets x-yagni-caller itself.
+                    transport: { baseUrl, getToken: getTokenFn },
+                },
+            }),
+        prefixConsultTransportAttribution: () => attributionHeaders(env),
         onPrefixConsult: makePrefixErrorSink(),
         guardianReview: (command, deps) => reviewCommand(command, { ...deps, modelTier: guardianTier }),
         onGuardianReview: (ev) => {
@@ -1040,6 +1049,7 @@ export async function registerYagni(pi, deps = {}) {
                         ...(ev.riskLevel ? { riskLevel: ev.riskLevel } : {}),
                         ...(ev.tier ? { tier: ev.tier } : {}),
                         ...(ev.durationMs !== undefined ? { durationMs: ev.durationMs } : {}),
+                        ...(ev.prefixConsult ? { prefixConsult: ev.prefixConsult } : {}),
                     };
                     if (guardianStorageTier === "raw") {
                         body.command = redactCommand(ev.command);

package/dist/extension/permission/gate.d.ts

@@ -137,6 +137,15 @@ export declare function decideGate(toolName: string, params: Record<string, unkn
  * call actually happened (grants/cache hits skip it).
  */
 export type GuardianGateOutcome = "prefix_allow" | "cached_allow" | "sandbox_auto_allow" | "allow" | "deny" | "ask_approved" | "ask_approved_remembered" | "ask_denied" | "ask_headless_blocked" | "breaker_ask_approved" | "breaker_blocked" | "escape_grant_allow" | "escape_cached_allow" | "escape_ask_approved" | "escape_ask_approved_remembered" | "escape_hook_allowed" | "escape_auto_sandboxed" | "escape_ask_denied" | "escape_ask_headless_blocked" | "escape_forbidden_blocked" | "escape_aborted" | "escape_ask_failed" | GuardianError;
+/** The L2 prefix fold's summary at dialog-build time (the funnel field on
+ * escape ask events): disabled — no consult layer; skipped — the consult
+ * layer is on but every segment was pre-gated out (heredoc/substitution/
+ * control flow) or already L1-token-covered; in_window — at least one
+ * validated candidate landed before the dialog opened; late — every
+ * candidate that ever landed arrived after open (or the consult was still
+ * unanswered at emit time — the dialog was unrefined either way);
+ * none_answered — the fold settled with zero candidates ever. */
+export type PrefixFoldStatus = "in_window" | "late" | "none_answered" | "skipped" | "disabled";
 /**
  * Rich per-decision event for opt-in storage (YAG-510). Carries the RAW
  * command — the wiring layer (index.ts) hashes/redacts per the workspace's
@@ -156,6 +165,11 @@ export interface GuardianGateEvent {
     durationMs?: number;
     /** Whether a Guardian LLM consult actually ran for this decision. */
     consulted: boolean;
+    /** Escape ask dialogs only: the L2 prefix fold's summary at dialog-build
+     * time — whether a validated consult candidate was visible in the dialog's
+     * options (the funnel's "displayed in-window" step). Absent on every other
+     * outcome. */
+    prefixConsult?: "in_window" | "late" | "none_answered" | "skipped" | "disabled";
     /** Present when the terminal outcome followed a Guardian error (e.g. an
      * error-fallback ask that the user then approved). */
     guardianError?: GuardianError;
@@ -349,7 +363,23 @@ export interface RegisterPermissionDeps {
      */
     prefixConsult?: {
         tier?: string;
+        /** Grace window override for the dialog open (the race's clock). The
+         * default is PREFIX_CONSULT_GRACE_MS; tests inject a small value so the
+         * in-window vs late paths are drivable in milliseconds. */
+        graceMs?: number;
+        /** The consult transport: an in-process direct HTTP call to the backend
+         * proxy (see pipeline/directConsult.ts). Absent → the transport is not
+         * wired and the consult fails soft (the dialog opens with L1 seeds) —
+         * the kill-switch shape. */
+        transport?: {
+            baseUrl: string;
+            getToken: () => string | undefined;
+        };
     };
+    /** Attribution headers for the consult transport (session/run ids from the
+     * wiring layer's env). Optional; the consult always sets x-yagni-caller
+     * itself. */
+    prefixConsultTransportAttribution?: () => Record<string, string>;
     /**
      * Injectable consult function (tests pass a stub; the default is
      * consultPrefixMemoized — the wiring layer keeps ONE memo per session).

package/dist/extension/permission/gate.js

@@ -27,7 +27,7 @@
  * the context so the model doesn't keep believing it is restricted.
  */
 import { derivePrefix, describePrefix, evaluateCompoundForEscape, matchesGrant, matchesCompoundGrants, sandboxFailureKey, storagePrefix, validateGrantForAsk, validateGrantForEscape, } from "./approvedPrefixes.js";
-import { consultPrefixMemoized, createPrefixMemo, PREFIX_CONSULT_GRACE_MS, } from "./prefixExtract.js";
+import { consultPrefixMemoized, createPrefixMemo, PREFIX_CONSULT_GRACE_MS, segmentCannotYieldCandidate, } from "./prefixExtract.js";
 import { logEvent } from "../errorSink.js";
 import { makeBlessStore as defaultMakeBlessStore } from "../bless.js";
 import { classifyCommand, DEFAULT_EXEC_POLICY } from "./execPolicy.js";
@@ -526,6 +526,17 @@ export function registerPermissionGate(pi, deps = {}) {
         cwd,
         signal,
         memo: prefixMemo,
+        ...(deps.prefixConsult?.transport
+            ? {
+                transport: {
+                    baseUrl: deps.prefixConsult.transport.baseUrl,
+                    getToken: deps.prefixConsult.transport.getToken,
+                    ...(deps.prefixConsultTransportAttribution
+                        ? { attribution: deps.prefixConsultTransportAttribution }
+                        : {}),
+                },
+            }
+            : {}),
         ...(tier ? { modelTier: tier } : {}),
         onEvent: (ev) => {
             try {
@@ -569,55 +580,106 @@ export function registerPermissionGate(pi, deps = {}) {
     const foldConsultSeeds = async (args) => {
         const { l1Seeds } = args;
         if (!deps.prefixConsult)
-            return l1Seeds;
+            return { seeds: l1Seeds, fold: () => "disabled" };
         const l1TokenPatterns = new Set((l1Seeds?.seeds ?? []).map((s) => s.pattern.join(" ")).filter((p) => p.length > 0));
         const l1LiteralSeeds = (l1Seeds?.seeds ?? []).filter((s) => s.pattern.length === 0);
         // RAW segments, deduped, capped at the seed cap.
         const segments = [...new Set(args.uncoveredSegments.map((s) => s.trim()).filter((s) => s.length > 0))].slice(0, 5);
-        const toConsult = segments.filter((seg) => !(l1TokenPatterns.size > 0 && [...l1TokenPatterns].some((p) => seg.startsWith(p))));
-        if (toConsult.length === 0)
-            return l1Seeds;
-        let answeredSegments = 0;
-        const fold = Promise.allSettled(toConsult.map((seg) => consultSegment(seg, args.cwd, args.signal, args.tier))).then((results) => {
-            // Two INDEPENDENT passes — counting and seed-filtering are different
-            // questions. `answered` counts every yielded candidate (including one
-            // duplicating an L1 token: the consult DID answer that segment), in
-            // its own pass over the results. The second pass de-dupes L1-token
-            // lookalikes from the SEED list only — the duplicate is noise there,
-            // not an unanswered segment. Comparing the de-duped `extra` against
-            // `toConsult` would misread a fully-answered fold as partial whenever
-            // an answer coincided with an L1 token.
-            const answered = results
-                .map((r) => (r.status === "fulfilled" ? r.value.candidate : null))
-                .filter((c) => c !== null);
-            answeredSegments = answered.length;
-            return answered
-                .filter((c) => !l1TokenPatterns.has(c.pattern.join(" ")))
-                .map((c) => ({ pattern: c.pattern, repoKey: "", addedAt: "", cwd: "" }));
-        }, () => []);
-        const extra = await Promise.race([
-            fold,
-            new Promise((resolve) => {
-                const t = setTimeout(() => resolve([]), PREFIX_CONSULT_GRACE_MS);
-                t.unref?.();
-            }),
-        ]);
+        // The ONLY skip rule is the syntactic pre-gate (SEGMENT level): a
+        // segment carrying heredocs, substitution, or control flow can never
+        // yield a candidate — the persona's own rules answer `none` for exactly
+        // these shapes — so spending the call proves nothing. Every OTHER
+        // uncovered segment consults, including ones an L1 token seed already
+        // covers: the consult's answer confirms or refines the seed, and its
+        // landing feeds the funnel's in-window field (an L1-covered segment
+        // whose consult answers in-window is exactly the healthy path the
+        // metric watches — skipping it would read every L1-covered compound as
+        // "no consult", and the ticket's acceptance is the opposite: clean
+        // segments inside compounds still consult).
+        const consultable = segments.filter((seg) => !segmentCannotYieldCandidate(seg));
+        if (consultable.length === 0)
+            return { seeds: l1Seeds, fold: () => "skipped" };
+        // Snapshot in-window candidates PER SEGMENT: Promise.allSettled would
+        // wait for the SLOWEST consult, so one past-window segment would sink
+        // every candidate that landed in time (the exact live failure — a 728ms
+        // curl answer invisible because a sibling took 4.5s). The window closes
+        // at the grace and the dialog opens with whatever validated by then.
+        let validatedCount = 0;
+        const inWindowCandidates = [];
+        const foldSettledAt = { done: false };
+        let windowOpen = true;
+        // close() flips the window; settleEarly lets a consult callback close it
+        // the moment the first validated candidate lands (the dialog has its
+        // refinement at that point — with the grace raised to 4s, holding the
+        // open for a slow sibling is pure latency).
+        let settleEarly = () => { };
+        const consults = consultable.map((seg) => consultSegment(seg, args.cwd, args.signal, args.tier).then((r) => {
+            if (r.candidate) {
+                validatedCount += 1;
+                if (windowOpen) {
+                    inWindowCandidates.push(r.candidate);
+                    settleEarly();
+                }
+            }
+            return r;
+        }));
+        await new Promise((resolve) => {
+            const close = () => {
+                windowOpen = false;
+                resolve();
+            };
+            settleEarly = close;
+            const t = setTimeout(close, deps.prefixConsult?.graceMs ?? PREFIX_CONSULT_GRACE_MS);
+            t.unref?.();
+            // Settle EARLY when every consult landed (the common case), or on the
+            // first in-window candidate (see settleEarly above).
+            Promise.allSettled(consults).then(close);
+        });
+        // extra = in-window candidates, de-duped against L1 token patterns; the
+        // fold keeps running past the window for the memo + the fold status.
+        const extra = inWindowCandidates
+            .filter((c) => !l1TokenPatterns.has(c.pattern.join(" ")))
+            .map((c) => ({ pattern: c.pattern, repoKey: "", addedAt: "", cwd: "" }));
+        void Promise.allSettled(consults).then(() => { foldSettledAt.done = true; });
+        // foldStatus is READ AT EMIT TIME (the terminal gate event fires after
+        // the user answers the dialog), so the window is always closed by then:
+        // in_window iff a candidate landed before close (visible in the
+        // dialog); late iff validated candidates exist but all arrived after,
+        // or the fold was still pending at emit (the dialog was unrefined
+        // either way — a pending fold must never read none_answered);
+        // none_answered iff the fold settled with zero validated candidates
+        // ever. The fold keeps running past the window; whatever lands late
+        // memoizes and serves a retry instantly.
+        const foldStatus = () => {
+            if (inWindowCandidates.length > 0)
+                return "in_window";
+            if (validatedCount > 0)
+                return "late";
+            return foldSettledAt.done ? "none_answered" : "late";
+        };
         if (extra.length === 0)
-            return l1Seeds;
-        // Did every consulted segment yield a candidate? Only then do the L2
-        // tokens supersede the literal; a partial fold keeps the literal as the
-        // coverage floor (token + literal, deduped, capped at 5).
-        const complete = answeredSegments >= toConsult.length;
+            return { seeds: l1Seeds, fold: foldStatus };
+        // Did every consulted segment yield a candidate IN-WINDOW? Only then do
+        // the L2 tokens supersede the literal; a partial fold keeps the literal
+        // as the coverage floor (token + literal, deduped, capped at 5). The
+        // completeness check counts IN-WINDOW candidates only — `combined`
+        // carries exactly those, so a late-landing sibling must not flip the
+        // fold "complete" and drop the literal without its candidate present
+        // (the coverage-regression class).
+        const complete = inWindowCandidates.length >= consultable.length;
         const combined = [
             ...(l1Seeds?.seeds ?? []).filter((s) => s.pattern.length > 0),
             ...extra,
             ...(complete ? [] : l1LiteralSeeds),
         ].slice(0, 5);
         return {
-            seeds: combined,
-            description: combined
-                .map((s) => (s.pattern.length > 0 ? describePrefix(s.pattern) : (s.literal ?? "")))
-                .join(", "),
+            seeds: {
+                seeds: combined,
+                description: combined
+                    .map((s) => (s.pattern.length > 0 ? describePrefix(s.pattern) : (s.literal ?? "")))
+                    .join(", "),
+            },
+            fold: foldStatus,
         };
     };
     // Per-USER-PROMPT bounds (reset in before_agent_start, which fires once per
@@ -1255,13 +1317,13 @@ export function registerPermissionGate(pi, deps = {}) {
                         // uncovered mutating segments; failures are invisible (the
                         // dialog opens with L1 seeds).
                         const seedsForAsk = modeAtEntry === "auto"
-                            ? await foldConsultSeeds({
+                            ? (await foldConsultSeeds({
                                 l1Seeds: askSeeds,
                                 uncoveredSegments: askSeeds === null ? [] : segmentsUncoveredForAsk(command, effectivePolicy.execPolicy ?? DEFAULT_EXEC_POLICY),
                                 cwd,
                                 signal: ctx.signal,
                                 tier: deps.prefixConsult?.tier,
-                            })
+                            })).seeds
                             : askSeeds;
                         // The settings-rule option rides TOKEN seeds ONLY: a literal
                         // seed persisted as `Bash(<literal>:*)` is a prefix rule with no
@@ -1756,7 +1818,7 @@ export function registerPermissionGate(pi, deps = {}) {
         // uncovered segments, grace-bounded, literal-fallback preserved. Runs
         // only with a UI (the headless gate returned above), and consult failure
         // is invisible — the dialog opens with the L1 seeds.
-        const seeds = await foldConsultSeeds({
+        const { seeds, fold: foldStatus } = await foldConsultSeeds({
             l1Seeds,
             uncoveredSegments: compound.uncovered,
             cwd,
@@ -1852,7 +1914,7 @@ export function registerPermissionGate(pi, deps = {}) {
                     grants.push(customGrant);
                     persistGrantFailSoft(customGrant);
                     rememberApproved(cwd, command);
-                    emitGateEvent(slot, { ...eventBase, outcome: "escape_ask_approved_remembered", consulted: false });
+                    emitGateEvent(slot, { ...eventBase, outcome: "escape_ask_approved_remembered", consulted: false, prefixConsult: foldStatus() });
                     return {};
                 }
                 // A custom prefix that does not cover this command is a dead rule —
@@ -1911,7 +1973,7 @@ export function registerPermissionGate(pi, deps = {}) {
         }
         if (resolution === "yes") {
             rememberApproved(cwd, command);
-            emitGateEvent(slot, { ...eventBase, outcome: "escape_ask_approved", consulted: false });
+            emitGateEvent(slot, { ...eventBase, outcome: "escape_ask_approved", consulted: false, prefixConsult: foldStatus() });
             return {};
         }
         if (resolution === "remember" && seeds) {
@@ -1926,7 +1988,7 @@ export function registerPermissionGate(pi, deps = {}) {
                 persistGrantFailSoft(grantRecord);
             }
             rememberApproved(cwd, command);
-            emitGateEvent(slot, { ...eventBase, outcome: "escape_ask_approved_remembered", consulted: false });
+            emitGateEvent(slot, { ...eventBase, outcome: "escape_ask_approved_remembered", consulted: false, prefixConsult: foldStatus() });
             return {};
         }
         // A dialog-layer FAILURE (a select threw for a non-abort reason — RPC
@@ -1941,6 +2003,7 @@ export function registerPermissionGate(pi, deps = {}) {
                 ...eventBase,
                 outcome: resolution === "error" ? "escape_ask_failed" : "escape_ask_denied",
                 consulted: false,
+                prefixConsult: foldStatus(),
             });
             return {
                 block: true,
@@ -1949,7 +2012,7 @@ export function registerPermissionGate(pi, deps = {}) {
                     : "The permission dialog was dismissed; the command was not run. Ask the user how to proceed.",
             };
         }
-        emitGateEvent(slot, { ...eventBase, outcome: "escape_ask_denied", consulted: false });
+        emitGateEvent(slot, { ...eventBase, outcome: "escape_ask_denied", consulted: false, prefixConsult: foldStatus() });
         if (resolution === "no") {
             return {
                 block: true,

package/dist/extension/permission/prefixExtract.d.ts

@@ -38,19 +38,38 @@ export interface PrefixConsultResult {
     /** True when the model answered command_injection_detected (the candidate
      * is null but the outcome class is injection, not a plain decline). */
     injection?: boolean;
+    /** True when the model ANSWERED but the validation ladder rejected it
+     * (banned shape, word shape, self-coverage) — the `invalid` outcome class,
+     * distinct from `none` (the model declined) and from the error classes. */
+    invalid?: boolean;
     /** Error CLASS only (constructor name) when the consult threw — never the
      * thrown message (it can carry command content or provider payloads). */
     errorClass?: string;
 }
 /** The model tier the prefix consult runs on (Haiku-equivalent, like the Guardian). */
 export declare const PREFIX_MODEL_TIER = "efficient";
+export declare function _setPrefixPersonaBodyResolverForTest(resolver: (() => string) | null): void;
 /**
  * Grace window for the dialog open: the consult fires at interception and the
- * dialog opens after at most this delay with whatever seeds have landed (p50
- * ~1s measured on prod; the window trades a bounded open delay for a much
- * better remember label). Fails open instantly on any consult error.
+ * dialog opens after at most this delay with whatever seeds have landed. The
+ * window races the CLIENT-side total (transport + LLM round trip), NOT the
+ * server-side llm_call_log.duration_ms (the LLM call alone) — the old 1500ms
+ * constant was tuned against the wrong clock, and the child-spawn transport
+ * (~4s boot before the first event) made every first-encounter consult lose
+ * the race. 4000ms is a ceiling we hope the in-process transport's in-window
+ * rate never needs (post-fix server durations: p50 ~1.1s, ~87% under 2s).
+ * Fails open instantly on any consult error.
  */
-export declare const PREFIX_CONSULT_GRACE_MS = 1500;
+export declare const PREFIX_CONSULT_GRACE_MS = 4000;
+/**
+ * The syntactic pre-gate (SEGMENT level): a command segment carrying
+ * heredocs, command substitution, or control flow can never yield a
+ * validated candidate — the prefix persona's own rules answer `none` for
+ * exactly these shapes, and the ladder would dispose the answer anyway.
+ * Consulting such a segment spends the call to learn nothing. Clean
+ * segments inside compounds still consult.
+ */
+export declare function segmentCannotYieldCandidate(segment: string): boolean;
 /** Consult deadline (the consult keeps running past the grace window — its
  * result memoizes and serves any retry of the same segment). */
 export declare const PREFIX_CONSULT_TIMEOUT_MS = 15000;
@@ -76,6 +95,23 @@ export declare function validatePrefixAnswer(answer: string, command: string): {
 } | {
     kind: "reject";
 };
+/**
+ * Classify ONE model answer (already fetched, whatever the transport) against
+ * a command segment: parse → injection → none → ladder → candidate. The
+ * SINGLE ladder both transports feed — the child-spawn path and the direct
+ * HTTP path differ only in how they obtain the text, never in how the answer
+ * is disposed (the two copies had already begun to drift when `invalid`
+ * landed; this is the fix for that).
+ */
+export declare function classifyPrefixAnswer(output: string, segment: string, cost: number): PrefixConsultResult;
+/**
+ * Classify a transport THREW error into the consult's error classes —
+ * shared by both transports. The caller's abort wins, then the consult's
+ * own deadline, then everything else is `network` with the error class
+ * (constructor name only — never the thrown message, which can carry
+ * command content or provider payloads).
+ */
+export declare function classifyPrefixConsultThrow(err: unknown, callerAborted: boolean, deadlineAborted: boolean): PrefixConsultResult;
 /** A settled memo entry: successes AND settled rejections (both are stable
  * answers — `none` must not re-consult forever, and a malformed answer is a
  * stable property of the model+segment pair). The terminal OUTCOME CLASS is
@@ -108,12 +144,26 @@ export declare function createPrefixMemo(capacity?: number): {
     size(): number;
 };
 export interface PrefixConsultDeps {
+    /** Legacy child-spawn transport seam — retained for the existing test
+     * stubs. When `transport` is absent but `runStage` is injected, the
+     * stubbed runStage path still runs (the unit tests' seam). */
     runStage?: typeof defaultRunStage;
     cwd: string;
     signal?: AbortSignal;
     modelTier?: string;
     timeoutMs?: number;
     memo?: ReturnType<typeof createPrefixMemo>;
+    /** The in-process direct transport. The gate supplies it from its
+     * prefixConsult config; when BOTH transport and runStage are absent, the
+     * consult fails soft (network class — the dialog opens with L1 seeds). */
+    transport?: {
+        baseUrl: string;
+        getToken: () => string | undefined;
+        /** Attribution headers (session/run ids); the consult sets its own
+         * x-yagni-caller. */
+        attribution?: () => Record<string, string>;
+        fetchImpl?: typeof fetch;
+    };
 }
 /**
  * The synthetic stage a prefix consult runs as. Borrows the `plan` StageId
@@ -141,6 +191,14 @@ export declare function buildPrefixDiagnosticEvent(outcome: PrefixDiagnosticEven
     errorClass?: string;
     debug?: boolean;
 }): PrefixDiagnosticEvent;
+/**
+ * The consult's terminal outcome class, flat (no nested ternaries — the
+ * workspace TS rules prohibit them): a candidate is a hit; a malformed
+ * answer is unparseable; an answered-but-disposed ladder rejection is
+ * invalid; an injection flag is injection_rejected; a plain decline is
+ * none; everything else is the transport error class verbatim.
+ */
+export declare function prefixOutcomeClass(res: PrefixConsultResult): PrefixDiagnosticEvent["outcome"];
 /**
  * Run ONE prefix consult on a single command segment. Pure on top of an
  * injectable runStage; the caller (the gate) fans out per-segment and races

package/dist/extension/permission/prefixExtract.js

@@ -24,16 +24,93 @@
  * is capped at "wasted a suggestion".
  */
 import { runStage as defaultRunStage } from "../pipeline/runner.js";
+import { directConsult } from "../pipeline/directConsult.js";
+import { PERSONA_BODIES } from "../pipeline/personas.js";
+import { logEvent } from "../errorSink.js";
 import { BANNED_PREFIXES, canonicalizeForGrants, matchesGrant, } from "./approvedPrefixes.js";
 /** The model tier the prefix consult runs on (Haiku-equivalent, like the Guardian). */
 export const PREFIX_MODEL_TIER = "efficient";
+/**
+ * The prefix persona body — the system prompt on the direct transport. A
+ * missing/renamed persona must never silently degrade to an empty system
+ * prompt (every consult would run unprompted and the funnel would just
+ * read as a low hit-rate), so a warn fires ONCE when it resolves empty.
+ */
+let prefixPersonaBodyWarned = false;
+/** The persona-body resolver — injectable so tests can drive the
+ * missing-persona branch (the memo's reset-export pattern). */
+let resolvePrefixPersonaBody = () => PERSONA_BODIES.prefix ?? "";
+export function _setPrefixPersonaBodyResolverForTest(resolver) {
+    resolvePrefixPersonaBody = resolver ?? (() => PERSONA_BODIES.prefix ?? "");
+    prefixPersonaBodyWarned = false;
+}
+function prefixPersonaBody() {
+    const body = resolvePrefixPersonaBody();
+    if (body.length === 0 && !prefixPersonaBodyWarned) {
+        prefixPersonaBodyWarned = true;
+        // logEvent is failure-isolated end to end (errorSink never throws), so
+        // no guard here: the consult path must never pay for telemetry.
+        logEvent({
+            source: "prefix",
+            level: "warn",
+            event: "prefix_persona_body_missing",
+        });
+    }
+    return body;
+}
 /**
  * Grace window for the dialog open: the consult fires at interception and the
- * dialog opens after at most this delay with whatever seeds have landed (p50
- * ~1s measured on prod; the window trades a bounded open delay for a much
- * better remember label). Fails open instantly on any consult error.
+ * dialog opens after at most this delay with whatever seeds have landed. The
+ * window races the CLIENT-side total (transport + LLM round trip), NOT the
+ * server-side llm_call_log.duration_ms (the LLM call alone) — the old 1500ms
+ * constant was tuned against the wrong clock, and the child-spawn transport
+ * (~4s boot before the first event) made every first-encounter consult lose
+ * the race. 4000ms is a ceiling we hope the in-process transport's in-window
+ * rate never needs (post-fix server durations: p50 ~1.1s, ~87% under 2s).
+ * Fails open instantly on any consult error.
+ */
+export const PREFIX_CONSULT_GRACE_MS = 4_000;
+/**
+ * The syntactic pre-gate (SEGMENT level): a command segment carrying
+ * heredocs, command substitution, or control flow can never yield a
+ * validated candidate — the prefix persona's own rules answer `none` for
+ * exactly these shapes, and the ladder would dispose the answer anyway.
+ * Consulting such a segment spends the call to learn nothing. Clean
+ * segments inside compounds still consult.
  */
-export const PREFIX_CONSULT_GRACE_MS = 1_500;
+export function segmentCannotYieldCandidate(segment) {
+    // Heredoc — the gate's compound splitter refuses to split heredoc bodies,
+    // so a heredoc-carrying command arrives as ONE segment that is all body.
+    if (/<<[-~]?\s*("|')?(\w+)/.test(segment))
+        return true;
+    // Command substitution — $(...) or `...` feeding another command.
+    if (/\$\(/.test(segment) || /`/.test(segment))
+        return true;
+    // Control flow — the shell reserved words that make a command multi-part.
+    // ANCHORED to command positions (the segment start, or after a statement
+    // separator): the words must be what makes the COMMAND multi-part, not
+    // any word anywhere — `git commit -m "do the thing"`, `man while`, and
+    // `grep in file` are plain single commands the persona can answer for,
+    // and over-skipping them is the false-positive class the acceptance
+    // criteria argue against.
+    const first = segment.trim().split(/[\s;|&]+/)[0] ?? "";
+    if (/^(if|then|elif|else|fi|for|while|until|do|done|case|esac)$/.test(first))
+        return true;
+    // A reserved word after a statement separator (`; done`, `&& do`) — a
+    // segment can carry a trailing control-flow clause only via ; & | &&.
+    // QUOTE-AWARE: quoted argument bodies are data, not shell structure —
+    // `curl 'https://x/a;if=1'` is a plain single command (its separator-like
+    // text lives inside quotes), so the scan runs on the segment with quoted
+    // spans blanked out.
+    // PAIRED spans only: an unpaired apostrophe (`echo don't; done`) is prose,
+    // not an opening quote — blanking through it would hide a real separator
+    // and fail the pre-gate open (extra consult spend). A paired span with no
+    // closing quote is left intact for the same reason.
+    const unquoted = segment.replace(/"[^"]*"|'[^']*'/g, (m) => " ".repeat(m.length));
+    if (/(?:^|[;|&]{1,2})\s*(?:if|then|elif|else|fi|for|while|until|do|done|case|esac)\b/.test(unquoted))
+        return true;
+    return false;
+}
 /** Consult deadline (the consult keeps running past the grace window — its
  * result memoizes and serves any retry of the same segment). */
 export const PREFIX_CONSULT_TIMEOUT_MS = 15_000;
@@ -122,6 +199,54 @@ export function validatePrefixAnswer(answer, command) {
         candidate: { pattern: words, description: `${words.join(" ")} …` },
     };
 }
+/**
+ * Classify ONE model answer (already fetched, whatever the transport) against
+ * a command segment: parse → injection → none → ladder → candidate. The
+ * SINGLE ladder both transports feed — the child-spawn path and the direct
+ * HTTP path differ only in how they obtain the text, never in how the answer
+ * is disposed (the two copies had already begun to drift when `invalid`
+ * landed; this is the fix for that).
+ */
+export function classifyPrefixAnswer(output, segment, cost) {
+    const parsed = parsePrefixAnswer(output);
+    if (!parsed) {
+        return { candidate: null, error: "malformed", cost };
+    }
+    const verdict = validatePrefixAnswer(parsed, segment);
+    if (verdict.kind === "candidate") {
+        return { candidate: verdict.candidate, cost };
+    }
+    if (verdict.kind === "injection") {
+        return { candidate: null, injection: true, cost };
+    }
+    // Rejection by the ladder — an expected outcome, not an error, but a
+    // DISTINCT class from the model's own `none`: the counters must be able
+    // to say "the model answered and pure code disposed" (invalid) vs "the
+    // model declined" (none). The literal `none` answer is the decline.
+    if (parsed === NONE_TOKEN) {
+        return { candidate: null, cost };
+    }
+    return { candidate: null, invalid: true, cost };
+}
+/**
+ * Classify a transport THREW error into the consult's error classes —
+ * shared by both transports. The caller's abort wins, then the consult's
+ * own deadline, then everything else is `network` with the error class
+ * (constructor name only — never the thrown message, which can carry
+ * command content or provider payloads).
+ */
+export function classifyPrefixConsultThrow(err, callerAborted, deadlineAborted) {
+    if (callerAborted)
+        return { candidate: null, error: "aborted", cost: 0 };
+    if (deadlineAborted)
+        return { candidate: null, error: "timeout", cost: 0 };
+    return {
+        candidate: null,
+        error: "network",
+        cost: 0,
+        errorClass: err instanceof Error ? err.constructor.name : typeof err,
+    };
+}
 /**
  * LRU memo (Claude's memoizeWithLRU shape, reject-evict): caches SETTLED
  * consults keyed by the command segment string. In-flight promises are
@@ -181,6 +306,26 @@ export function buildPrefixDiagnosticEvent(outcome, opts) {
     }
     return ev;
 }
+/**
+ * The consult's terminal outcome class, flat (no nested ternaries — the
+ * workspace TS rules prohibit them): a candidate is a hit; a malformed
+ * answer is unparseable; an answered-but-disposed ladder rejection is
+ * invalid; an injection flag is injection_rejected; a plain decline is
+ * none; everything else is the transport error class verbatim.
+ */
+export function prefixOutcomeClass(res) {
+    if (res.candidate)
+        return "hit";
+    if (res.error === "malformed")
+        return "unparseable";
+    if (res.error !== undefined)
+        return res.error;
+    if (res.injection === true)
+        return "injection_rejected";
+    if (res.invalid === true)
+        return "invalid";
+    return "none";
+}
 /**
  * Run ONE prefix consult on a single command segment. Pure on top of an
  * injectable runStage; the caller (the gate) fans out per-segment and races
@@ -199,6 +344,40 @@ export async function consultPrefix(segment, deps) {
         else
             deps.signal.addEventListener("abort", () => controller.abort(), { once: true });
     }
+    // The in-process direct transport (the production path): one
+    // /v1/chat/completions POST with the prefix persona as the system prompt
+    // and the raw segment as the user content — no child spawn, no grounded
+    // context, ~1k input tokens. The result flows through the SAME parser +
+    // ladder + error classes as the child path.
+    if (deps.transport) {
+        const t = deps.transport;
+        try {
+            const res = await directConsult({ systemPrompt: prefixPersonaBody(), userContent: segment, modelTier: deps.modelTier ?? PREFIX_MODEL_TIER }, {
+                baseUrl: t.baseUrl,
+                getToken: t.getToken,
+                attribution: t.attribution ?? (() => ({})),
+                callerLabel: "prefix",
+                signal: controller.signal,
+                ...(t.fetchImpl ? { fetchImpl: t.fetchImpl } : {}),
+            });
+            const output = res.text.trim();
+            if (deps.signal?.aborted) {
+                return { candidate: null, error: "aborted", cost: res.cost };
+            }
+            if (!output) {
+                return { candidate: null, error: "empty", cost: res.cost };
+            }
+            return classifyPrefixAnswer(output, segment, res.cost);
+        }
+        catch (err) {
+            return classifyPrefixConsultThrow(err, deps.signal?.aborted === true, controller.signal.aborted);
+        }
+        finally {
+            clearTimeout(timer);
+        }
+    }
+    // Legacy child-spawn path (retained for the injectable test seam; no
+    // production wiring uses it once the gate supplies `transport`).
     try {
         const result = await runStage(stage, { ticket: segment }, {
             cwd: deps.cwd,
@@ -218,35 +397,10 @@ export async function consultPrefix(segment, deps) {
             }
             return { candidate: null, error: "empty", cost };
         }
-        const parsed = parsePrefixAnswer(output);
-        if (!parsed) {
-            return {
-                candidate: null,
-                error: "malformed",
-                cost,
-            };
-        }
-        const verdict = validatePrefixAnswer(parsed, segment);
-        if (verdict.kind === "candidate") {
-            return { candidate: verdict.candidate, cost };
-        }
-        if (verdict.kind === "injection") {
-            return { candidate: null, injection: true, cost };
-        }
-        // rejection by the ladder — an expected outcome, not an error
-        return { candidate: null, injection: false, cost };
+        return classifyPrefixAnswer(output, segment, cost);
     }
     catch (err) {
-        if (deps.signal?.aborted)
-            return { candidate: null, error: "aborted", cost: 0 };
-        if (controller.signal.aborted)
-            return { candidate: null, error: "timeout", cost: 0 };
-        return {
-            candidate: null,
-            error: "network",
-            cost: 0,
-            errorClass: err instanceof Error ? err.constructor.name : typeof err,
-        };
+        return classifyPrefixConsultThrow(err, deps.signal?.aborted === true, controller.signal.aborted);
     }
     finally {
         clearTimeout(timer);
@@ -292,15 +446,7 @@ export async function consultPrefixMemoized(segment, deps) {
         if (res.error === "empty" && !deps.signal?.aborted) {
             res = await consultPrefix(segment, deps);
         }
-        const outcome = res.candidate
-            ? "hit"
-            : res.error === "malformed"
-                ? "unparseable"
-                : res.error === undefined
-                    ? res.injection === true
-                        ? "injection_rejected"
-                        : "none"
-                    : res.error;
+        const outcome = prefixOutcomeClass(res);
         deps.onEvent?.(buildPrefixDiagnosticEvent(outcome, {
             durationMs: Date.now() - started,
             tier: deps.modelTier ?? PREFIX_MODEL_TIER,

package/dist/extension/pipeline/directConsult.d.ts

@@ -0,0 +1,47 @@
+/**
+ * In-process direct LLM consult transport (the replacement for spawning a
+ * child pi per consult): one non-streaming /v1/chat/completions POST to the
+ * backend proxy with a system prompt + user content, Bearer auth, and the
+ * session's attribution headers (caller label included).
+ *
+ * The pattern is webFetch.ts's extract() — the extension's existing
+ * in-process proxy call — generalized so any consult (the prefix persona
+ * today; the Guardian's, tracked separately, can adopt the same seam) runs
+ * without paying the ~4s child-boot tax that made every first-encounter
+ * consult lose the dialog's grace race.
+ *
+ * The caller owns parsing/validation/timeout policy; this module only moves
+ * the request. Every error throws — the consult's own error classifier
+ * (timeout/network) derives the outcome class from the failure mode.
+ */
+export interface DirectConsultRequest {
+    /** The system prompt (the persona body). */
+    systemPrompt: string;
+    /** The user content (the consulted material — a command segment, a verdict
+     * request, …). */
+    userContent: string;
+    /** Model tier label the proxy resolves (efficient/standard/advanced). */
+    modelTier: string;
+}
+export interface DirectConsultOptions {
+    baseUrl: string;
+    /** Bearer token source (the session's token provider). */
+    getToken: () => string | undefined;
+    /** Attribution headers (x-yagni-session-id / x-yagni-run-id /
+     * x-yagni-caller). The consult overrides the caller label. */
+    attribution: () => Record<string, string>;
+    /** The caller label (x-yagni-caller) — attribution, labeling the consult's
+     * spend and failures in the backend's dashboards. */
+    callerLabel: string;
+    signal?: AbortSignal;
+    /** Injectable for tests (defaults to the global fetch). */
+    fetchImpl?: typeof fetch;
+}
+export interface DirectConsultResult {
+    /** The model's reply text (trimmed by the caller, not here). */
+    text: string;
+    /** Cost in USD when the response carries usage, else 0. */
+    cost: number;
+}
+export declare function directConsult(req: DirectConsultRequest, opts: DirectConsultOptions): Promise<DirectConsultResult>;
+//# sourceMappingURL=directConsult.d.ts.map

package/dist/extension/pipeline/directConsult.js

@@ -0,0 +1,52 @@
+/**
+ * In-process direct LLM consult transport (the replacement for spawning a
+ * child pi per consult): one non-streaming /v1/chat/completions POST to the
+ * backend proxy with a system prompt + user content, Bearer auth, and the
+ * session's attribution headers (caller label included).
+ *
+ * The pattern is webFetch.ts's extract() — the extension's existing
+ * in-process proxy call — generalized so any consult (the prefix persona
+ * today; the Guardian's, tracked separately, can adopt the same seam) runs
+ * without paying the ~4s child-boot tax that made every first-encounter
+ * consult lose the dialog's grace race.
+ *
+ * The caller owns parsing/validation/timeout policy; this module only moves
+ * the request. Every error throws — the consult's own error classifier
+ * (timeout/network) derives the outcome class from the failure mode.
+ */
+export async function directConsult(req, opts) {
+    const fetchImpl = opts.fetchImpl ?? fetch;
+    const res = await fetchImpl(`${opts.baseUrl}/v1/chat/completions`, {
+        method: "POST",
+        headers: {
+            "content-type": "application/json",
+            authorization: `Bearer ${opts.getToken() ?? ""}`,
+            ...opts.attribution(),
+            "x-yagni-caller": opts.callerLabel,
+        },
+        body: JSON.stringify({
+            model: req.modelTier,
+            messages: [
+                { role: "system", content: req.systemPrompt },
+                { role: "user", content: req.userContent },
+            ],
+        }),
+        signal: opts.signal,
+    });
+    if (!res.ok) {
+        // The status rides the message (the consult keeps thrown messages out of
+        // telemetry; the local sink line + errorClass carry it) so a persistent
+        // 401/403 is distinguishable from a transient gateway blip when reading
+        // the sink — the closed outcome vocabulary stays untouched.
+        throw new Error(`direct consult failed: HTTP ${res.status}`);
+    }
+    const data = (await res.json());
+    // A 200 with no/blank content is an EMPTY result, not a transport error:
+    // the consult's error classifier treats `empty` as retryable-once (the
+    // backend's own 502-shape body invites exactly that), and a thrown error
+    // here would misclassify that shape as `network`. A genuinely malformed
+    // (non-JSON) body still throws below.
+    const text = data.choices?.[0]?.message?.content ?? "";
+    return { text, cost: typeof data.usage?.cost === "number" ? data.usage.cost : 0 };
+}
+//# sourceMappingURL=directConsult.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yagni-app/code-staging",
-  "version": "1.1.4-staging.1409.1",
+  "version": "1.1.4-staging.1412.1",
   "description": "YAGNI Code: a terminal coding agent that already knows your company. One YAGNI login routes the model and grounds the agent in your team's context.",
   "license": "SEE LICENSE IN LICENSE.md",
   "author": "YAGNI, Inc. <jack@yagni.app> (https://yagni.app)",
@@ -58,5 +58,5 @@
     "turndown": "^7.2.4",
     "typebox": "^1.3.15"
   },
-  "yagniSourceSha": "2c19a54882fb77c6231aac923b4654b7ffa836a3"
+  "yagniSourceSha": "4266630468e144c9ac86fc902b44a9de1b05409f"
 }