@yagni-app/code-staging 1.1.8-staging.1462.1 → 1.1.8-staging.1467.1

package/dist/extension/pipeline/fanoutBeats.d.ts

@@ -1,27 +1,79 @@
 /**
- * The implement diamond's RECORDING thread: pipeline progress in, run-session
- * stage beats out (spec "Recording and the run surface").
+ * The implement diamond's RECORDING thread: pipeline progress in, stage beats
+ * out (spec "Recording and the run surface").
  *
  * The pipeline already says everything the run surface needs — the partition
  * verdict, each builder starting and finishing, each bounded fix turn — on the
  * `onProgress` channel. This folds that stream into the additive
- * `fanout` / `children` / `fixTurns` payloads on `POST /runs/:id/stages`, so the
- * web run surface can render per-workstream rows without the pipeline growing a
- * second reporting path.
+ * `fanout` / `children` / `fixTurns` payloads that headless /go (the mission
+ * sandbox's `yagni go --headless`) emits as `pipeline_fanout` records on its
+ * stream, so the mission executor can render per-workstream rows without the
+ * pipeline growing a second reporting path. Interactive /go does not use it:
+ * it records no backend run.
  *
  * PURE and I/O-free, like `findings.ts` and `fanout.ts`: `apply` returns the beat
  * to send (or null when the signal is not the diamond's), and the caller decides
- * whether to POST it. Two properties are load-bearing:
+ * whether to emit it. Two properties are load-bearing:
  *
  *  1. **Recorded states only.** A child row exists only once its `stage_start`
  *     arrives, and it is `failed` only when the pipeline said the child died.
  *     There is no invented "pending", and no tick nobody earned.
  *  2. **Every beat is a copy.** The roster keeps mutating as children finish, so
- *     a beat already handed to the (async, fail-soft) session must never change
+ *     a beat already handed to the (async) stream writer must never change
  *     underneath it.
  */
-import type { StageArgs } from "./runSession.js";
 import type { PipelineProgress } from "./types.js";
+/**
+ * The implement diamond's partition verdict as the run records it: the fan and
+ * its width, or the single-writer degrade, always with the reason that produced
+ * it. Rides one implement stage beat (see {@link StageArgs}).
+ */
+export interface StageFanoutDecision {
+    mode: "fan" | "single";
+    width?: number;
+    reason: string;
+}
+/**
+ * One fan-out child on a stage beat: the workstream's name, the tier it runs on,
+ * how many paths it claimed, and the state the run has actually OBSERVED. There
+ * is no "pending" state on purpose: a child appears the moment it starts, so a
+ * surface can only ever paint children that really ran.
+ */
+export interface StageChildRow {
+    name: string;
+    tier?: "standard" | "efficient";
+    state: "running" | "done" | "failed";
+    /** How many path claims the partition gave this workstream; absent when unrecorded. */
+    files?: number;
+    note?: string;
+}
+/** One bounded fix turn: which findings it answered and which children it re-engaged. */
+export interface StageFixTurn {
+    turn: number;
+    findings: number;
+    reengaged: string[];
+}
+/**
+ * A pipeline stage boundary event.
+ *
+ * `fanout` / `children` / `fixTurns` are the implement diamond's additive
+ * payloads (spec "Recording and the run surface"). They ride INTERIM implement
+ * beats and are append-only: an older CLI simply never sends them, and a backend
+ * that does not know them ignores them, so the contract stays backwards
+ * compatible in both directions. Every beat carries at most one of them.
+ */
+export interface StageArgs {
+    stage: string;
+    phase: "start" | "finish";
+    round?: number;
+    findings?: number;
+    /** The diamond's verdict, sent once per implement stage the moment it resolves. */
+    fanout?: StageFanoutDecision;
+    /** The whole per-workstream roster, re-sent on every child state change. */
+    children?: StageChildRow[];
+    /** Every fix turn recorded so far, re-sent as each new one lands. */
+    fixTurns?: StageFixTurn[];
+}
 /** Folds the diamond's progress signals into the stage beats that record them. */
 export interface FanoutBeats {
     /** The beat this signal produces, or null when it is not the diamond's. */

package/dist/extension/pipeline/fanoutBeats.js

@@ -1,23 +1,25 @@
 /**
- * The implement diamond's RECORDING thread: pipeline progress in, run-session
- * stage beats out (spec "Recording and the run surface").
+ * The implement diamond's RECORDING thread: pipeline progress in, stage beats
+ * out (spec "Recording and the run surface").
  *
  * The pipeline already says everything the run surface needs — the partition
  * verdict, each builder starting and finishing, each bounded fix turn — on the
  * `onProgress` channel. This folds that stream into the additive
- * `fanout` / `children` / `fixTurns` payloads on `POST /runs/:id/stages`, so the
- * web run surface can render per-workstream rows without the pipeline growing a
- * second reporting path.
+ * `fanout` / `children` / `fixTurns` payloads that headless /go (the mission
+ * sandbox's `yagni go --headless`) emits as `pipeline_fanout` records on its
+ * stream, so the mission executor can render per-workstream rows without the
+ * pipeline growing a second reporting path. Interactive /go does not use it:
+ * it records no backend run.
  *
  * PURE and I/O-free, like `findings.ts` and `fanout.ts`: `apply` returns the beat
  * to send (or null when the signal is not the diamond's), and the caller decides
- * whether to POST it. Two properties are load-bearing:
+ * whether to emit it. Two properties are load-bearing:
  *
  *  1. **Recorded states only.** A child row exists only once its `stage_start`
  *     arrives, and it is `failed` only when the pipeline said the child died.
  *     There is no invented "pending", and no tick nobody earned.
  *  2. **Every beat is a copy.** The roster keeps mutating as children finish, so
- *     a beat already handed to the (async, fail-soft) session must never change
+ *     a beat already handed to the (async) stream writer must never change
  *     underneath it.
  */
 /** The stage every fan-out beat belongs to: the diamond lives INSIDE implement. */

package/dist/extension/pipeline/goCommand.d.ts

@@ -20,7 +20,7 @@
  * `--pr` — push the run branch and open a PR under the user's own gh auth. A
  * FINISH failure NEVER flips a clean run to failed and never fakes a commit
  * (§0.1): every skip/failure is an honest note on the handoff. The commit/PR
- * land on `PipelineResult.finish`, `session.finish`, the registry row, a
+ * land on `PipelineResult.finish`, the registry row, the handoff, a
  * `finish_done` checkpoint record, and a `finish` row in the activity feed.
  *
  * WORKTREE BY DEFAULT (spec §3b): the run gets its own worktree + branch FIRST
@@ -36,7 +36,7 @@
  * before mutating the user's tree; `--here` is the explicit in-place escape
  * hatch.
  *
- * DETACHED BY DEFAULT: /go returns the prompt as soon as the run session opens;
+ * DETACHED BY DEFAULT: /go returns the prompt as soon as the run is registered;
  * the pipeline promise is tracked in the module-scoped run registry (mirrored to
  * ~/.yagni-code/registry.ndjson) and completion delivers the existing handoff
  * via `pi.sendUserMessage(handoff, { deliverAs: "followUp" })` (try/catch with a
@@ -52,17 +52,17 @@
  * optional-chained so headless runs degrade gracefully. `runPipeline` is
  * injected so the handler is unit-testable without spawning.
  *
- * Run tracking: the handler opens a tracked run session (a `runs` row visible on
- * the Work page) around the pipeline — `start` before, `stage` for each pipeline
- * boundary, and `finish` with an honest outcome afterwards. Every session call
- * is fail-soft, so recording can never break `/go`.
+ * No backend run: interactive /go records its run LOCALLY only (the registry
+ * row, the checkpoint journal, and the handoff). It opens no `runs` row, so its
+ * spend is attributed to the driver session. The only /go that carries a
+ * backend run id is headless (`yagni go --headless --run-id`, run by the
+ * mission sandbox), which passes it in through `checkpointMeta.runId`.
  */
 import type { ExtensionAPI, ExtensionCommandContext } from "@earendil-works/pi-coding-agent";
 import type { SpendResponse } from "../costHud.js";
 import { type CrashReporter } from "../crashReport.js";
 import { runFinish as defaultRunFinish } from "./finish.js";
 import { runPipeline as defaultRunPipeline } from "./orchestrator.js";
-import { makeRunSession as defaultMakeRunSession } from "./runSession.js";
 import { bootstrapWorktree as defaultBootstrapWorktree, createRunWorktree as defaultCreateRunWorktree } from "./worktree.js";
 import type { CheckpointRecord, CheckpointStore, WorkspaceSnapshot } from "./types.js";
 /** Best-effort git context for the current worktree (all fields optional). */
@@ -73,8 +73,6 @@ export interface RepoContext {
 }
 export interface RegisterGoDeps {
     runPipeline?: typeof defaultRunPipeline;
-    /** Injectable so the handler can be unit-tested without a network. */
-    makeRunSession?: typeof defaultMakeRunSession;
     /** Injectable so the handler can be unit-tested without spawning git. */
     resolveRepoContext?: (cwd: string | undefined, signal?: AbortSignal) => Promise<RepoContext>;
     /** Injectable durable journal (default = local file + pi-journal combined). */
@@ -114,10 +112,10 @@ export interface RegisterGoDeps {
      * (`GET /api/yagni-code/spend?runId=`, wired in index.ts reusing Task 7's
      * fetch machinery). Absent (no dep wired), throwing, or resolving null all
      * fall back to the local `runCostNote` client estimate — see
-     * `resolveCostText` below. No default here: unlike every other network dep
-     * on this interface, index.ts is the ONLY real wiring (there is nothing
-     * sensible to default to without a baseUrl/token), and every test that
-     * cares injects its own fake.
+     * `resolveCostText` below. Interactive /go opens no backend run, so today
+     * there is no run id to query and the labeled local estimate is what
+     * renders; the seam stays for a run id that arrives some other way. No
+     * default here: index.ts is the ONLY real wiring.
      */
     fetchRunSpend?: (runId: string, signal?: AbortSignal) => Promise<SpendResponse | null>;
     /**

package/dist/extension/pipeline/goCommand.js

@@ -20,7 +20,7 @@
  * `--pr` — push the run branch and open a PR under the user's own gh auth. A
  * FINISH failure NEVER flips a clean run to failed and never fakes a commit
  * (§0.1): every skip/failure is an honest note on the handoff. The commit/PR
- * land on `PipelineResult.finish`, `session.finish`, the registry row, a
+ * land on `PipelineResult.finish`, the registry row, the handoff, a
  * `finish_done` checkpoint record, and a `finish` row in the activity feed.
  *
  * WORKTREE BY DEFAULT (spec §3b): the run gets its own worktree + branch FIRST
@@ -36,7 +36,7 @@
  * before mutating the user's tree; `--here` is the explicit in-place escape
  * hatch.
  *
- * DETACHED BY DEFAULT: /go returns the prompt as soon as the run session opens;
+ * DETACHED BY DEFAULT: /go returns the prompt as soon as the run is registered;
  * the pipeline promise is tracked in the module-scoped run registry (mirrored to
  * ~/.yagni-code/registry.ndjson) and completion delivers the existing handoff
  * via `pi.sendUserMessage(handoff, { deliverAs: "followUp" })` (try/catch with a
@@ -52,10 +52,11 @@
  * optional-chained so headless runs degrade gracefully. `runPipeline` is
  * injected so the handler is unit-testable without spawning.
  *
- * Run tracking: the handler opens a tracked run session (a `runs` row visible on
- * the Work page) around the pipeline — `start` before, `stage` for each pipeline
- * boundary, and `finish` with an honest outcome afterwards. Every session call
- * is fail-soft, so recording can never break `/go`.
+ * No backend run: interactive /go records its run LOCALLY only (the registry
+ * row, the checkpoint journal, and the handoff). It opens no `runs` row, so its
+ * spend is attributed to the driver session. The only /go that carries a
+ * backend run id is headless (`yagni go --headless --run-id`, run by the
+ * mission sandbox), which passes it in through `checkpointMeta.runId`.
  */
 import { execFile } from "node:child_process";
 import { randomUUID } from "node:crypto";
@@ -64,7 +65,6 @@ import { join } from "node:path";
 import { eventToLine } from "./activity.js";
 import { ActivityFeed, SPINNER_FRAMES } from "./activityFeed.js";
 import { resolveFanoutMode } from "./fanout.js";
-import { makeFanoutBeats } from "./fanoutBeats.js";
 import { RunState } from "./runState.js";
 import { aggregateRunUsage } from "./budget.js";
 import { formatRunCostTable } from "./runCostTable.js";
@@ -72,7 +72,6 @@ import { makeCombinedCheckpointStore, makeFileCheckpointStore, makePiJournalChec
 import { getToken as defaultGetToken, resolveBaseUrl } from "../config.js";
 import { makeCrashReporter } from "../crashReport.js";
 import { logEvent } from "../errorSink.js";
-import { scrubSecrets } from "./scrubSecrets.js";
 import { isDesktopSurface } from "../surface.js";
 import { runFinish as defaultRunFinish, verifyTrailerValue, } from "./finish.js";
 import { GO_USAGE, parseGoArgs } from "./goFlags.js";
@@ -81,8 +80,6 @@ import { runPipeline as defaultRunPipeline } from "./orchestrator.js";
 import { composeAbortSignal } from "./resilience.js";
 import { planResume } from "./resume.js";
 import { activeRunCount, beginRun, classifyRunLiveness, findActiveRunByTicket, isRunInFlight, isTerminalStatus, lastJournalTs, loadRegistryRows, resolveMaxConcurrentRuns, settleRun, trackRunAbort, trackRunPromise, worktreesDir, } from "./runRegistry.js";
-import { makeRunSession as defaultMakeRunSession, } from "./runSession.js";
-import { recordSessionRun } from "../sessionRuns.js";
 import { resolveTicketBrief as defaultResolveTicketBrief } from "./ticketResolution.js";
 import { snapshotWorkspace as defaultSnapshotWorkspace } from "./workspace.js";
 import { parseChangedPaths } from "./verify.js";
@@ -215,15 +212,6 @@ const PAINT_DEBOUNCE_MS = 80;
  */
 export const ANIMATION_INTERVAL_MS = 120;
 const SPINNER_TICK_MS = 120;
-/**
- * Wall-clock liveness interval. /go pings POST /runs/:id/heartbeat on this
- * cadence for the whole run so the server-side reaper (which fails a run idle
- * past STALE_RUN_MS = 30 min) never reaps a legitimately-long run mid-flight —
- * even a single quiet stage that emits no NDJSON for many minutes. Comfortably
- * under the reaper window; fail-soft and unref'd so it never holds the process
- * (or a test worker) open.
- */
-const HEARTBEAT_INTERVAL_MS = 5 * 60_000;
 const STOP_REASON_COPY = {
     clean: "clean, no blocking findings remain",
     round_cap: "round cap reached, blocking findings remain",
@@ -233,17 +221,7 @@ const STOP_REASON_COPY = {
     budget_exceeded: "the run hit its budget ceiling (turns, cost, or tokens) and stopped before finishing. Review the partial change, then re-run /go to continue",
     partial: "a build or fix stage stopped before finishing (a timeout or transient error once it had already begun editing). The partial changes are in your working tree, uncommitted. Review them, or re-run /go to retry",
 };
-/** Map the pipeline's stop reason onto the run-session outcome enum. */
-function outcomeFor(stopReason) {
-    // `partial` is a preserved-but-incomplete run (work is in the tree), so it is a
-    // `stopped`, never a `failed` (which would imply nothing usable was produced).
-    if (stopReason === "aborted" || stopReason === "budget_exceeded" || stopReason === "partial")
-        return "stopped";
-    if (stopReason === "failed")
-        return "failed";
-    return "completed"; // clean | round_cap are both real completions
-}
-/** Stop reason + the review tally, with NO cost segment and no prefix — the shared core of `recapBody`/`recapBodyForChat` below. */
+/** Stop reason + the review tally, with NO cost segment and no prefix — the core of `recapBodyForChat` below. */
 function tallyLine(result) {
     const rounds = result.rounds.length;
     const total = result.findings.length;
@@ -254,27 +232,9 @@ function tallyLine(result) {
         `${total} finding${total === 1 ? "" : "s"} (${blocking} blocking).`);
 }
 /**
- * The bare "what was done" recap — stop reason + the review tally + the LOCAL
- * cost estimate — with NO "YAGNI Code /go finished:" prefix. This is what
- * rides `finish` as the `run_outcome` activity body (session.finish's
- * `outcomeSummary`), which must stay synchronous: it is recorded as part of
- * ending the run and must never wait on the Task 8 server spend fetch. The
- * chat-facing summary (`recapBodyForChat`, below) is the one that prefers the
- * server-priced table when it is available. The Work-page timeline already
- * labels this beat "Run outcome", so prefixing here would double up into "Run
- * outcome: YAGNI Code /go finished: ...". `formatSummaryForChat` re-adds the
- * prefix for the standalone toast + scrollback line, where the context is
- * useful on its own.
- */
-function recapBody(result) {
-    return `${tallyLine(result)}${runCostNote(result)}`;
-}
-/**
- * Chat-facing recap: the same tally as `recapBody`, but the cost segment is
- * `costText` — precomputed by `resolveCostText` (Task 8), which is either the
- * multi-line server-priced table or the labeled local-estimate fallback.
- * Kept distinct from `recapBody` because `costText` requires an async fetch
- * that `recapBody`'s caller (session.finish's outcomeSummary) cannot wait on.
+ * Chat-facing recap: the stop reason + review tally, then `costText`,
+ * precomputed by `resolveCostText` (Task 8): either the multi-line
+ * server-priced table or the labeled local-estimate fallback.
  */
 function recapBodyForChat(result, costText) {
     return `${tallyLine(result)}${costText}`;
@@ -299,21 +259,18 @@ function runCostNote(result) {
 /**
  * Task 8: resolve the cost segment for the CHAT-FACING summary (the toast +
  * the durable handoff) — the server-priced per-stage table
- * (`formatRunCostTable`) when this run is tracked and the fetch succeeds,
- * else today's local `runCostNote` estimate, explicitly labeled "(client
+ * (`formatRunCostTable`) when a run id is known and the fetch succeeds,
+ * else the local `runCostNote` estimate, explicitly labeled "(client
  * estimate)" so it is never mistaken for the priced total. Mirrors
  * `registerCostCommand`'s own fail-soft preference order in costHud.ts.
+ * Interactive /go opens no backend run, so it passes no run id and always
+ * takes the labeled local-estimate path.
  *
  * Never throws and never blocks long: `fetchRunSpend` (index.ts) already
  * carries its own request timeout (same 5s ceiling as /cost's fetches), and
- * this wraps the ENTIRE body — not just the fetch — in try/catch. That is
- * deliberate, not belt-and-braces: the caller (see `runToCompletion` below)
- * starts this promise and leaves it un-awaited for a while so session.finish
- * never waits on it, so a throw ANYWHERE in here between promise creation and
- * that later `await` — including from `runCostNote`/`formatRunCostTable` on a
- * malformed result, not just from the fetch itself — would otherwise surface
- * as a guaranteed unhandled rejection during that gap, independent of
- * whatever the caller does with the eventual value.
+ * this wraps the ENTIRE body — not just the fetch — in try/catch, so a throw
+ * from `runCostNote`/`formatRunCostTable` on a malformed result can never
+ * surface as a rejection that breaks the handoff.
  *
  * An empty-rows response is treated the same as "unavailable" (mirrors
  * registerCostCommand's `serverLooksStale` guard): a run that billed real
@@ -354,19 +311,6 @@ async function resolveCostText(result, runId, fetchRunSpend, signal) {
 function formatSummaryForChat(result, costText) {
     return `YAGNI Code /go finished: ${recapBodyForChat(result, costText)}`;
 }
-/**
- * User-facing notice when a /go run is NOT being recorded on the Work page.
- * Without this, a flag-off / unauthorized / unreachable backend fails silently
- * (the run-session swallows it) and the run vanishes with no explanation.
- */
-const UNTRACKED_NOTICE = {
-    disabled: "Run tracking is off for this workspace, so this /go run won't appear on the Work page.",
-    unauthorized: "Run tracking is unauthorized. Run `yagni login` to refresh your token so runs appear on the Work page.",
-    // A refusal always arrives with the server's own sentence; this is the line
-    // for the rare body that carries none.
-    refused: "YAGNI declined to record this run, so it won't appear on the Work page. The pipeline ran anyway.",
-    error: "Couldn't reach YAGNI to record this run, so it won't appear on the Work page. The pipeline ran anyway.",
-};
 /** Toast severity for an outcome: clean is good, round_cap warns, abort/fail are errors. */
 function summaryTone(stopReason) {
     if (stopReason === "clean")
@@ -417,7 +361,6 @@ async function defaultResolveRepoContext(cwd, signal) {
 }
 export function registerGoCommand(pi, deps = {}) {
     const runPipeline = deps.runPipeline ?? defaultRunPipeline;
-    const makeRunSession = deps.makeRunSession ?? defaultMakeRunSession;
     const resolveRepoContext = deps.resolveRepoContext ?? defaultResolveRepoContext;
     const makeCheckpointStore = deps.makeCheckpointStore ?? defaultMakeCheckpointStore;
     const resolveSnapshot = deps.resolveSnapshot ?? defaultSnapshotWorkspace;
@@ -577,14 +520,9 @@ export function registerGoCommand(pi, deps = {}) {
             const feed = ctx.hasUI && !desktop ? new ActivityFeed(ticket) : undefined;
             const startedAt = Date.now();
             const run = ctx.hasUI && desktop ? new RunState({ runId: runShortId, ticket, startedAt }) : undefined;
-            // The implement diamond's recording thread. Per RUN (never module-scoped):
-            // it holds this run's child roster and fix turns. Independent of `feed` /
-            // `run`, because the Work page's run surface is fed on headless runs too.
-            const fanoutBeats = makeFanoutBeats();
             const stateKey = `${STATE_KEY_PREFIX}${runShortId}`;
             let paintTimer;
             let animationTimer;
-            let heartbeatTimer;
             const elapsed = () => `${Math.max(0, Math.round((Date.now() - startedAt) / 1000))}s`;
             const doPaint = () => {
                 if (!ctx.hasUI)
@@ -640,10 +578,6 @@ export function registerGoCommand(pi, deps = {}) {
                     clearInterval(animationTimer);
                     animationTimer = undefined;
                 }
-                if (heartbeatTimer) {
-                    clearInterval(heartbeatTimer);
-                    heartbeatTimer = undefined;
-                }
                 if (paintTimer) {
                     clearTimeout(paintTimer);
                     paintTimer = undefined;
@@ -656,26 +590,6 @@ export function registerGoCommand(pi, deps = {}) {
                     ctx.ui.setStatus?.(uiKey, undefined);
                 }
             };
-            // Open the tracked run session (fail-soft — never blocks /go).
-            const session = makeRunSession({
-                baseUrl: deps.baseUrl ?? resolveBaseUrl(),
-                getToken: deps.getToken ?? defaultGetToken,
-            });
-            // The diamond's own recording channel is STRICTLY ORDERED, and it is the
-            // only one that has to be. Every roster beat carries the WHOLE roster and
-            // the run surface derives it last-one-wins (FanoutSection's `readFanout`),
-            // so two beats in flight at once can land in either order and a "running"
-            // that overtakes its own "done" paints a finished builder as running for
-            // the rest of the run. Chaining them through one promise makes the order
-            // the surface reads the order the pipeline produced. Still fire-and-forget
-            // (nothing on the run's critical path waits on it) and still fail-soft: a
-            // rejected beat never breaks the chain. The other stage beats stay
-            // unserialized on purpose — each names its own boundary, so their arrival
-            // order carries no state a later beat can undo.
-            let fanBeatChain = Promise.resolve();
-            const recordFanBeat = (b) => {
-                fanBeatChain = fanBeatChain.then(() => session.stage(b)).catch(() => { });
-            };
             const repoCtx = await resolveRepoContext(runCwd, ctx.signal);
             // Durable resilience journal, keyed by the RUN tree (the worktree path for
             // a default run; ctx.cwd for --here). Detect an interrupted prior /go for
@@ -730,36 +644,11 @@ export function registerGoCommand(pi, deps = {}) {
                 notify(notice, "warning");
                 await pi.sendUserMessage(notice);
             }
-            // Open or re-adopt the backend run row. A fresh run calls start(); a resume
-            // re-binds the original run (no duplicate row) when it was tracked.
-            const openFreshRun = async () => {
-                const started = await session.start({ arg: ticket, repo: repoCtx.repo, branch: repoCtx.branch });
-                if (started.tracked) {
-                    if (started.gated) {
-                        notify("This ticket needs approval in the YAGNI app before it shows as executing.", "warning");
-                    }
-                    return { runId: started.runId, workItemId: started.workItemId };
-                }
-                // Recording skipped (flag off) or failed (unauthorized / refused /
-                // unreachable): tell the user the run won't show on the Work page
-                // rather than swallowing it. A refusal carries the server's own
-                // sentence, which says what to do about it, so it wins over our copy.
-                notify(started.message ?? UNTRACKED_NOTICE[started.reason], "warning");
-                return {};
-            };
             let resumeFrom;
-            let handle = {};
             if (plan.mode === "resume_loop") {
                 notify(`Resuming /go for "${ticket}" from review round ${plan.round} — picking up the interrupted run instead of starting over.`, "info");
                 await pi.sendUserMessage(`Resuming an interrupted /go for "${ticket}" at review round ${plan.round}. The build is already in ${worktreeMode ? "the run worktree" : "your working tree"}; continuing the review loop.`);
                 resumeFrom = plan;
-                // Open a FRESH run attempt rather than re-binding the original handle.
-                // An interrupted run that slept past the reaper window is already a
-                // terminal 'failed' server-side, and binding it would strand THIS
-                // completed resume as a permanent phantom failure (failed is terminal —
-                // finish can't promote it). A fresh attempt records the resumed pass
-                // honestly; the original crashed attempt settles on its own (reaper).
-                handle = await openFreshRun();
             }
             else {
                 if (plan.mode === "warn_partial") {
@@ -783,31 +672,15 @@ export function registerGoCommand(pi, deps = {}) {
                 }
                 // Fresh run: drop any stale/partial journal so the new run writes clean.
                 store.clear();
-                handle = await openFreshRun();
             }
+            // No backend run id: interactive /go opens no `runs` row, so its child
+            // dispatches carry no run attribution and bill to this driver session.
+            // (Headless /go passes the mission's --run-id through its own meta.)
             const checkpointMeta = {
                 sessionKey,
-                ...(handle.runId ? { runId: handle.runId } : {}),
-                ...(handle.workItemId ? { workItemId: handle.workItemId } : {}),
                 ...(repoCtx.repo ? { repo: repoCtx.repo } : {}),
                 ...(repoCtx.branch ? { branch: repoCtx.branch } : {}),
             };
-            // YAG-383: this run's dispatches bill under handle.runId, not this
-            // driver session's id (see attributionHeaders in config.ts), so /cost's
-            // server-authoritative spend fetch would never see them without being
-            // told this run id explicitly. Record it the moment it is known (same
-            // gate as the attribution header above: only when the run is tracked).
-            if (handle.runId)
-                recordSessionRun(handle.runId);
-            // Desktop parity (Task 9): the desktop's /spend join needs this same
-            // server UUID (`run.runId` on the wire record is the LOCAL 8-char short
-            // id used for widget/status keys, never the join key). Stamp it the
-            // moment it is known and paint IMMEDIATELY — not the trailing-edge
-            // debounce — so a fast-finishing run's last few paints still carry it.
-            if (handle.runId && run) {
-                run.setServerRunId(handle.runId);
-                paint(true);
-            }
             // Mark the journal terminal (fail-soft). A run_finish makes the key read as
             // a COMPLETED run (so the next /go starts fresh, not a bogus resume); its
             // absence is exactly what marks a crashed run resumable.
@@ -819,8 +692,6 @@ export function registerGoCommand(pi, deps = {}) {
                         sessionKey,
                         ts: Date.now(),
                         ticket,
-                        ...(handle.runId ? { runId: handle.runId } : {}),
-                        ...(handle.workItemId ? { workItemId: handle.workItemId } : {}),
                         stopReason: stopReason,
                     });
                 }
@@ -828,9 +699,9 @@ export function registerGoCommand(pi, deps = {}) {
                     /* fail-soft */
                 }
             };
-            // The run registry row (the LOCAL run identity — the backend handle lives
-            // on the checkpoint meta). Registered before the run detaches so the
-            // in-flight guards and /go-status see it immediately.
+            // The run registry row (the LOCAL run identity; interactive /go has no
+            // backend run). Registered before the run detaches so the in-flight
+            // guards and /go-status see it immediately.
             const registryRow = {
                 runId,
                 ticket,
@@ -841,11 +712,6 @@ export function registerGoCommand(pi, deps = {}) {
                 status: "running",
                 startedAt: now(),
             };
-            // Wall-clock liveness heartbeat for the whole run; cleared in clearUI. Each
-            // tick is fail-soft and no-ops until the run is bound. Unref'd so it never
-            // keeps the process (or a test worker) alive.
-            heartbeatTimer = setInterval(() => void session.heartbeat(), HEARTBEAT_INTERVAL_MS);
-            heartbeatTimer.unref?.();
             // Deliver the durable end-of-run handoff. A detached run completes while
             // the agent may be mid-turn, so pi requires deliverAs; a delivery failure
             // falls back to a notify (and /go-status remains the pull path).
@@ -926,13 +792,6 @@ export function registerGoCommand(pi, deps = {}) {
                         onProgress: (p) => {
                             feed?.applyProgress(p);
                             run?.applyProgress(p, Date.now());
-                            // The implement diamond's own beats (the partition verdict, each
-                            // child's state, each fix turn) ride the SAME fail-soft stage
-                            // channel as every other boundary, additively: a signal that is not
-                            // the diamond's produces no beat at all.
-                            const fanBeat = fanoutBeats.apply(p);
-                            if (fanBeat)
-                                recordFanBeat(fanBeat);
                             // The ribbon replaces the status chip on the desktop, so the chip is
                             // only set for the terminal's status-line fallback.
                             if (ctx.hasUI && !desktop) {
@@ -960,14 +819,10 @@ export function registerGoCommand(pi, deps = {}) {
                             paint(false);
                         },
                         onStage: (s) => {
-                            // The plan text rides ONLY the plan-finish boundary; strip it from the
-                            // stage beat (which never carries full text) and record the plan onto
-                            // the work item instead. Both calls are fail-soft inside the session.
-                            const { output, ...stageArgs } = s;
-                            void session.stage(stageArgs);
-                            if (s.stage === "plan" && s.phase === "finish" && output) {
-                                planText = output;
-                                void session.recordPlan({ stage: "plan", body: output });
+                            // The plan text rides ONLY the plan-finish boundary; keep it for
+                            // the FINISH commit message's summary.
+                            if (s.stage === "plan" && s.phase === "finish" && s.output) {
+                                planText = s.output;
                             }
                         },
                         checkpoint: store,
@@ -1001,7 +856,6 @@ export function registerGoCommand(pi, deps = {}) {
                         if (ctx.hasUI && !desktop)
                             ctx.ui.setStatus?.(uiKey, "finish…");
                         paint(true);
-                        void session.stage({ stage: "finish", phase: "start" });
                         try {
                             finish = await runFinishFn({
                                 cwd: runCwd,
@@ -1034,7 +888,6 @@ export function registerGoCommand(pi, deps = {}) {
                                 notes: [`FINISH failed: ${msg}. The run itself is still clean; the changes are left in ${runCwd}.`],
                             };
                         }
-                        void session.stage({ stage: "finish", phase: "finish" });
                         feed?.applyProgress({ kind: "stage_done", stageId: "finish" });
                         run?.applyProgress({ kind: "stage_done", stageId: "finish" }, Date.now());
                         paint(true);
@@ -1046,8 +899,6 @@ export function registerGoCommand(pi, deps = {}) {
                                 sessionKey,
                                 ts: Date.now(),
                                 ticket,
-                                ...(handle.runId ? { runId: handle.runId } : {}),
-                                ...(handle.workItemId ? { workItemId: handle.workItemId } : {}),
                                 ...(finish.commitSha ? { commitSha: finish.commitSha } : {}),
                                 ...(finish.prUrl ? { prUrl: finish.prUrl } : {}),
                             });
@@ -1077,46 +928,22 @@ export function registerGoCommand(pi, deps = {}) {
                         }
                         : undefined;
                     const finalResult = { ...result, ...(finishInfo ? { finish: finishInfo } : {}) };
-                    const outcome = outcomeFor(finalResult.stopReason);
-                    // The end-of-run recap: "what was done" (rounds, findings, stop reason).
-                    // The bare `recapBody` rides `finish` as the run_outcome activity (the
-                    // timeline labels that beat "Run outcome"); the prefixed
-                    // `formatSummaryForChat` is the standalone toast + scrollback line
-                    // shown to the user below.
                     // Non-clean terminal outcome in worktree mode: preserve the work as a
                     // WIP commit so it is never lost and the worktree becomes removable.
                     // (A clean outcome's commit is the FINISH stage's, captured above.)
-                    // Computed BEFORE session.finish so the run reports the sha that actually
-                    // holds its work — not the pre-run base HEAD (a base-HEAD fallback would
-                    // both misattribute the commit and spuriously advance a work-less run).
+                    // The registry row reports the sha that actually holds the run's
+                    // work, never the pre-run base HEAD.
                     const wipSha = finalResult.stopReason === "clean" ? undefined : await preserveWip(finalResult.stopReason);
                     const runCommitSha = finishInfo?.commitSha ?? wipSha;
-                    // Task 8: START the server-priced fetch here but do NOT await it —
-                    // session.finish (the durable finish POST) and everything gated on
-                    // it below (recordRunFinish's journal write, settleRun clearing the
-                    // in-flight guard) must land regardless of how long this fetch
-                    // takes. Only the chat-facing summary/handoff, built after, needs
-                    // the resolved value (awaited just below, right before it is used).
-                    const costTextPromise = resolveCostText(finalResult, handle.runId, fetchRunSpend, ctx.signal);
-                    await session.finish({
-                        outcome,
-                        stopReason: outcome === "completed" ? undefined : STOP_REASON_COPY[finalResult.stopReason],
-                        branch: finishInfo?.branch ?? repoCtx.branch,
-                        ...(runCommitSha ? { commitSha: runCommitSha } : {}),
-                        ...(finishInfo?.prUrl ? { prUrl: finishInfo.prUrl } : {}),
-                        ...(finishInfo?.prNumber != null ? { prNumber: finishInfo.prNumber } : {}),
-                        rounds: finalResult.rounds.length,
-                        outcomeSummary: recapBody(finalResult),
-                    });
                     recordRunFinish(finalResult.stopReason);
                     settleRun(runId, {
                         status: finalResult.stopReason,
                         ...(runCommitSha ? { commitSha: runCommitSha } : {}),
                         ...(finishInfo?.prUrl ? { prUrl: finishInfo.prUrl } : {}),
                     });
-                    // Only the chat-facing summary/handoff waits on the cost fetch,
-                    // now that the durable finish above has already landed.
-                    const costText = await costTextPromise;
+                    // The chat-facing cost segment. Interactive /go has no backend run id,
+                    // so this is the labeled local client estimate.
+                    const costText = await resolveCostText(finalResult, undefined, fetchRunSpend, ctx.signal);
                     const summary = formatSummaryForChat(finalResult, costText);
                     notify(summary, summaryTone(finalResult.stopReason));
                     // The DURABLE record surfaces the unresolved blocking findings IN FULL
@@ -1131,10 +958,6 @@ export function registerGoCommand(pi, deps = {}) {
                     // reporter never rejects; the catch guards an injected one.
                     void reportCrash(err, "go", runCwd).catch(() => { });
                     logEvent({ source: "go", level: "error", event: "go_failed", fields: { runId } });
-                    // The stopReason travels to the backend run record; scrub it like
-                    // every other captured text (a raw error can echo a connection
-                    // string or key).
-                    await session.finish({ outcome: "failed", stopReason: scrubSecrets(message) });
                     recordRunFinish("failed");
                     const wipSha = await preserveWip("failed");
                     settleRun(runId, { status: "failed", ...(wipSha ? { commitSha: wipSha } : {}) });

package/dist/extension/pipeline/headlessGo.js

@@ -267,9 +267,9 @@ export async function runHeadlessGo(argv, deps = {}) {
     // A blank plan or memo file is NOT mission context: it must never read as an
     // approved plan (which would skip the pipeline's planning on nothing at all).
     const mission = normalizeMission({ plan: files.plan, memo: files.memo });
-    // The implement diamond's recording thread, per RUN. Interactive /go hands
-    // these beats to its run session; there is no session here, so they ride the
-    // NDJSON stream and the mission collector folds them onto the Run instead.
+    // The implement diamond's recording thread, per RUN. The beats ride the
+    // NDJSON stream as `pipeline_fanout` records, and the mission collector
+    // folds them onto the Run.
     const fanoutBeats = makeFanoutBeats();
     const pipelineDeps = {
         cwd,

package/dist/extension/pipeline/orchestrator.js

@@ -214,13 +214,13 @@ export async function runPipeline(ticket, deps) {
     // stay attributed to review/<lens>. The tap is ALWAYS installed (the
     // decisionsRecorded count must not depend on a caller wiring onEvent);
     // forwarding to the caller's onEvent stays optional.
-    // YAG-471 attribution: the tracked run's server-assigned id (a UUID, set once
-    // `runSession.start` returns) rides every child spawn from here on, so every
-    // stage's completions attribute to this run in `llm_usage` — the stage loop,
-    // the review lens fan-out, AND the format-recovery reask (it goes through
-    // this same seam). Absent when the run isn't tracked (flag off, unauthorized,
-    // backend unreachable) — attribution then degrades to the caller label alone,
-    // never blocking the pipeline.
+    // YAG-471 attribution: the backend run's id (a UUID) rides every child spawn
+    // from here on, so every stage's completions attribute to this run in
+    // `llm_usage` — the stage loop, the review lens fan-out, AND the
+    // format-recovery reask (it goes through this same seam). It arrives only
+    // from headless /go's `--run-id` (the mission sandbox's run). Interactive /go
+    // opens no backend run, so it is absent there and attribution degrades to
+    // the driver session plus the caller label, never blocking the pipeline.
     const runId = deps.checkpointMeta?.runId;
     // `callerLabel` is set only by the implement diamond's children (the
     // partitioner's `go:implement:partition` and each builder's

package/dist/extension/pipeline/runState.d.ts

@@ -113,14 +113,12 @@ export interface GoRunState {
     stopReason?: StopReason;
     agents: AgentNode[];
     /**
-     * The backend's run UUID (`handle.runId` from `POST /runs`, goCommand.ts's
-     * `openFreshRun`) — NOT `runId` above, which is the local 8-char short id
+     * A backend run UUID — NOT `runId` above, which is the local 8-char short id
      * (`runId.slice(0, 8)`) used for widget/status keys. `/api/yagni-code/spend`
      * joins on the server UUID, so the desktop needs this to ever widen its
-     * spend query with a /go run's own dispatches. Absent until `openFreshRun`
-     * resolves (a beat after the run starts), and absent for good on an
-     * untracked run (flag off, unauthorized, or unreachable — see
-     * `UNTRACKED_NOTICE` in goCommand.ts): there is no server id to give it.
+     * spend query with a /go run's own dispatches. Interactive /go no longer
+     * opens a backend run (P0.12), so nothing sets it today and it stays absent;
+     * the field is kept for the desktop reader until that follow-up lands.
      */
     serverRunId?: string;
     /**
@@ -186,10 +184,10 @@ export declare class RunState {
     /** Stamp the run's end. Separate from `done` because FINISH runs after the pipeline returns. */
     markEnded(at: number): void;
     /**
-     * Record the backend's run UUID once `openFreshRun` resolves (goCommand.ts,
-     * a beat after the run starts — never known at construction). The caller is
-     * responsible for repainting immediately after this so the desktop learns
-     * it as soon as possible rather than on the next debounced paint.
+     * Record a backend run UUID for the desktop's spend join. Interactive /go
+     * no longer opens a backend run (P0.12), so nothing calls this today; it
+     * stays until the inert run-id readers are removed in a follow-up. A caller
+     * must repaint right after it so the desktop learns the id immediately.
      */
     setServerRunId(id: string): void;
     /**

package/dist/extension/pipeline/runState.js

@@ -246,10 +246,10 @@ export class RunState {
         this.endedAt = at;
     }
     /**
-     * Record the backend's run UUID once `openFreshRun` resolves (goCommand.ts,
-     * a beat after the run starts — never known at construction). The caller is
-     * responsible for repainting immediately after this so the desktop learns
-     * it as soon as possible rather than on the next debounced paint.
+     * Record a backend run UUID for the desktop's spend join. Interactive /go
+     * no longer opens a backend run (P0.12), so nothing calls this today; it
+     * stays until the inert run-id readers are removed in a follow-up. A caller
+     * must repaint right after it so the desktop learns the id immediately.
      */
     setServerRunId(id) {
         this.serverRunId = id;

package/dist/extension/pipeline/ticketResolution.d.ts

@@ -8,8 +8,8 @@
  * formatted brief carrying the VERBATIM ticket title + description (the
  * acceptance criteria live inside the body) for the {ticket} slot.
  *
- * It is the read-path twin of {@link makeRunSession}'s fetch seam (baseUrl +
- * injectable getToken + fetchImpl, via resilientFetch). The server resolves the
+ * It uses the same fetch seam as the other resilientFetch callers (baseUrl +
+ * injectable getToken + fetchImpl). The server resolves the
  * ticket with a live, workspace-scoped connector READ, never an LLM call, so
  * this never bills the ask compose path and never risks a model-rewritten body.
  *

package/dist/extension/pipeline/ticketResolution.js

@@ -8,8 +8,8 @@
  * formatted brief carrying the VERBATIM ticket title + description (the
  * acceptance criteria live inside the body) for the {ticket} slot.
  *
- * It is the read-path twin of {@link makeRunSession}'s fetch seam (baseUrl +
- * injectable getToken + fetchImpl, via resilientFetch). The server resolves the
+ * It uses the same fetch seam as the other resilientFetch callers (baseUrl +
+ * injectable getToken + fetchImpl). The server resolves the
  * ticket with a live, workspace-scoped connector READ, never an LLM call, so
  * this never bills the ask compose path and never risks a model-rewritten body.
  *

package/dist/extension/sessionRuns.d.ts

@@ -22,8 +22,9 @@
  * trailing off into a 400 from the server).
  */
 /**
- * Record a `/go` run id once it is known (the goCommand.ts seam right after
- * `runSession.start()` resolves). Ignores anything that is not UUID-shaped
+ * Record a `/go` run id once it is known. Interactive /go no longer opens a
+ * backend run (P0.12), so nothing calls this today; it stays until the inert
+ * run-id readers are removed in a follow-up. Ignores anything that is not UUID-shaped
  * and de-dupes a repeat call for the same run (a resumed/re-adopted run can
  * report the same id twice) — both defensive, since a malformed value here
  * must never corrupt /cost's query string.

package/dist/extension/sessionRuns.js

@@ -36,8 +36,9 @@ let runIds = [];
  */
 let dropped = 0;
 /**
- * Record a `/go` run id once it is known (the goCommand.ts seam right after
- * `runSession.start()` resolves). Ignores anything that is not UUID-shaped
+ * Record a `/go` run id once it is known. Interactive /go no longer opens a
+ * backend run (P0.12), so nothing calls this today; it stays until the inert
+ * run-id readers are removed in a follow-up. Ignores anything that is not UUID-shaped
  * and de-dupes a repeat call for the same run (a resumed/re-adopted run can
  * report the same id twice) — both defensive, since a malformed value here
  * must never corrupt /cost's query string.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yagni-app/code-staging",
-  "version": "1.1.8-staging.1462.1",
+  "version": "1.1.8-staging.1467.1",
   "description": "YAGNI Code: a terminal coding agent that already knows your company. One YAGNI login routes the model and grounds the agent in your team's context.",
   "license": "SEE LICENSE IN LICENSE.md",
   "author": "YAGNI, Inc. <jack@yagni.app> (https://yagni.app)",
@@ -58,5 +58,5 @@
     "turndown": "^7.2.4",
     "typebox": "^1.3.15"
   },
-  "yagniSourceSha": "0e26ef63bbeeecaf5b7a945f048d72f80dcc5414"
+  "yagniSourceSha": "405d3059a5defa8759713338e4d43322ea3c8c0f"
 }

package/dist/extension/pipeline/runSession.d.ts

@@ -1,202 +0,0 @@
-/**
- * The `/go` run-session adapter.
- *
- * Wraps the device-token `/api/yagni-code/runs*` endpoints so a YAGNI Code
- * pipeline run becomes a tracked `runs` row visible on the Work page: open the
- * run (`start`), stream each pipeline stage (`stage`), bank an in-loop
- * correction (`correction`), and close it with an honest outcome (`finish`).
- *
- * CRITICAL invariant: recording must NEVER break the pipeline. Every call is
- * fail-soft — it never throws. `start` resolves to a typed outcome that
- * distinguishes a tracked run from an untracked one (flag off, unauthorized, or
- * the backend unreachable/erroring) so the caller can surface a notice instead
- * of failing silently; the post-start verbs (`stage`/`correction`/`finish`) stay
- * silent no-ops. `/go` runs to completion regardless of the recording outcome.
- *
- * Mirrors the fetch-seam shape of {@link makeRecordEngineeringContextTool}
- * (`baseUrl` + injectable `getToken` + `fetchImpl`) so it is unit-testable
- * without a network and reuses the same auth convention.
- */
-/** Options for {@link makeRunSession}. */
-export interface RunSessionOptions {
-    baseUrl: string;
-    getToken: () => string | undefined;
-    fetchImpl?: typeof fetch;
-    /**
-     * Backoff sleep + jitter seams, threaded into {@link resilientFetch} so the
-     * retry path is deterministic and instant under test. Default to the real
-     * timer / Math.random in production.
-     */
-    sleep?: (ms: number) => Promise<void>;
-    random?: () => number;
-    /**
-     * Opt-in debug sink for diagnosing a recording failure (the fail-soft path
-     * otherwise collapses 402/5xx/2xx-bad-body/unreachable into one silent
-     * "error"). Only ever receives a token-free line: the path, the numeric HTTP
-     * status, a capped slice of the SERVER response body, or a network error
-     * message. NEVER the request headers (the bearer token) or the request body.
-     * Injected for deterministic tests; defaults to an env-gated stderr writer.
-     */
-    debug?: (line: string) => void;
-    /**
-     * Environment seam for the debug gate, matching `config.ts`/`verify.ts`. The
-     * debug sink only fires when `YAGNI_CODE_DEBUG` is set here (default
-     * `process.env`), so existing callers that inject neither `debug` nor `env`
-     * stay silent unless the operator opts in.
-     */
-    env?: NodeJS.ProcessEnv;
-}
-/** The handle returned by a successful `start` (or supplied via `bind`). */
-export interface RunSessionHandle {
-    runId: string;
-    workItemId: string;
-}
-/**
- * The result of a successful `start`: the handle plus the server's governance
- * verdict (`gated` = the work item needs approval in the app before it shows as
- * executing, so /go should warn rather than silently proceed).
- */
-export interface RunStartResult extends RunSessionHandle {
-    gated: boolean;
-    gatedReason?: string;
-}
-/**
- * Why a run could not be recorded, derived from the endpoint's HTTP status so
- * the caller can show an actionable notice:
- *  - `disabled`     — 404: the `yagni_code.work_tracking` flag is off for this
- *                     workspace (the write endpoints 404 to hide themselves).
- *  - `unauthorized` — 401/403: the device token is missing/expired or lacks the
- *                     `yagni_code:write` scope (re-run `yagni login`).
- *  - `refused`      — 400: the server declined for a reason a person can act on
- *                     and said so in one sentence (this repository belongs to
- *                     no Team). The sentence rides `message` and is what the
- *                     caller shows.
- *  - `error`        — anything else: an over-budget 402, a 5xx, a 2xx with an
- *                     unrecognized body, or an unreachable backend / thrown
- *                     network error.
- */
-export type RunTrackingFailure = "disabled" | "unauthorized" | "refused" | "error";
-/**
- * The outcome of opening a run. `tracked: true` carries the handle + gate
- * verdict; `tracked: false` carries the reason so `/go` can warn that this run
- * won't appear on the Work page, plus the server's own sentence when it sent
- * one. `start` never returns null and never throws.
- */
-export type RunStartOutcome = ({
-    tracked: true;
-} & RunStartResult) | {
-    tracked: false;
-    reason: RunTrackingFailure;
-    message?: string;
-};
-/** Arguments to open a run. */
-export interface StartArgs {
-    arg: string;
-    repo?: string;
-    branch?: string;
-}
-/**
- * The implement diamond's partition verdict as the run records it: the fan and
- * its width, or the single-writer degrade, always with the reason that produced
- * it. Rides one implement stage beat (see {@link StageArgs}).
- */
-export interface StageFanoutDecision {
-    mode: "fan" | "single";
-    width?: number;
-    reason: string;
-}
-/**
- * One fan-out child on a stage beat: the workstream's name, the tier it runs on,
- * how many paths it claimed, and the state the run has actually OBSERVED. There
- * is no "pending" state on purpose: a child appears the moment it starts, so a
- * surface can only ever paint children that really ran.
- */
-export interface StageChildRow {
-    name: string;
-    tier?: "standard" | "efficient";
-    state: "running" | "done" | "failed";
-    /** How many path claims the partition gave this workstream; absent when unrecorded. */
-    files?: number;
-    note?: string;
-}
-/** One bounded fix turn: which findings it answered and which children it re-engaged. */
-export interface StageFixTurn {
-    turn: number;
-    findings: number;
-    reengaged: string[];
-}
-/**
- * A pipeline stage boundary event.
- *
- * `fanout` / `children` / `fixTurns` are the implement diamond's additive
- * payloads (spec "Recording and the run surface"). They ride INTERIM implement
- * beats and are append-only: an older CLI simply never sends them, and a backend
- * that does not know them ignores them, so the contract stays backwards
- * compatible in both directions. Every beat carries at most one of them.
- */
-export interface StageArgs {
-    stage: string;
-    phase: "start" | "finish";
-    round?: number;
-    findings?: number;
-    /** The diamond's verdict, sent once per implement stage the moment it resolves. */
-    fanout?: StageFanoutDecision;
-    /** The whole per-workstream roster, re-sent on every child state change. */
-    children?: StageChildRow[];
-    /** Every fix turn recorded so far, re-sent as each new one lands. */
-    fixTurns?: StageFixTurn[];
-}
-/** An in-loop correction captured during the run. */
-export interface CorrectionArgs {
-    stage?: string;
-    question: string;
-    decision: string;
-    rationale?: string;
-}
-/**
- * The /go PLAN, recorded onto the work item (a `plan_recorded` activity beat) so
- * it is clear what the run set out to do. `body` is the plan markdown; the server
- * scrubs secrets + caps it before persisting.
- */
-export interface RecordPlanArgs {
-    stage: string;
-    body: string;
-}
-/** How a run ended; maps to the run-status enum server-side. */
-export interface FinishArgs {
-    outcome: "completed" | "stopped" | "failed";
-    stopReason?: string;
-    prUrl?: string;
-    prNumber?: number;
-    branch?: string;
-    commitSha?: string;
-    rounds?: number;
-    /**
-     * Short "what was done" recap; the server records it as a `run_outcome`
-     * activity (the end-of-run beat on the Work-page timeline). Optional + additive:
-     * `finish` already spreads the whole args object, so it flows through untouched.
-     */
-    outcomeSummary?: string;
-}
-/** The run-session object returned by {@link makeRunSession}. */
-export interface RunSession {
-    /** Adopt an externally-known handle (used by tests + cloud callers). */
-    bind(h: RunSessionHandle): void;
-    /** Open the run; resolves to a tracked outcome (handle + gate verdict) or an untracked reason. Never throws. */
-    start(b: StartArgs): Promise<RunStartOutcome>;
-    /** Stream a stage boundary; no-op until a handle exists. */
-    stage(b: StageArgs): Promise<void>;
-    /** Bank an in-loop correction; no-op until a handle exists. */
-    correction(b: CorrectionArgs): Promise<void>;
-    /** Record the /go plan onto the work item; no-op until a handle exists. */
-    recordPlan(b: RecordPlanArgs): Promise<void>;
-    /**
-     * Bump the run's server-side last-activity heartbeat so a long-but-alive run is
-     * not reaped as stale. No-op until a handle exists; never throws.
-     */
-    heartbeat(): Promise<void>;
-    /** Close the run with an outcome; no-op until a handle exists. */
-    finish(b: FinishArgs): Promise<void>;
-}
-export declare function makeRunSession(opts: RunSessionOptions): RunSession;
-//# sourceMappingURL=runSession.d.ts.map

package/dist/extension/pipeline/runSession.js

@@ -1,202 +0,0 @@
-/**
- * The `/go` run-session adapter.
- *
- * Wraps the device-token `/api/yagni-code/runs*` endpoints so a YAGNI Code
- * pipeline run becomes a tracked `runs` row visible on the Work page: open the
- * run (`start`), stream each pipeline stage (`stage`), bank an in-loop
- * correction (`correction`), and close it with an honest outcome (`finish`).
- *
- * CRITICAL invariant: recording must NEVER break the pipeline. Every call is
- * fail-soft — it never throws. `start` resolves to a typed outcome that
- * distinguishes a tracked run from an untracked one (flag off, unauthorized, or
- * the backend unreachable/erroring) so the caller can surface a notice instead
- * of failing silently; the post-start verbs (`stage`/`correction`/`finish`) stay
- * silent no-ops. `/go` runs to completion regardless of the recording outcome.
- *
- * Mirrors the fetch-seam shape of {@link makeRecordEngineeringContextTool}
- * (`baseUrl` + injectable `getToken` + `fetchImpl`) so it is unit-testable
- * without a network and reuses the same auth convention.
- */
-import { randomUUID } from "node:crypto";
-import { DEFAULT_FETCH_POLICY, METERED_POST_FETCH_POLICY, resilientFetch, } from "../resilientFetch.js";
-/** Map a failed POST's HTTP status onto a user-facing tracking-failure reason. */
-function failureReason(status) {
-    if (status === 404)
-        return "disabled";
-    if (status === 401 || status === 403)
-        return "unauthorized";
-    if (status === 400)
-        return "refused";
-    return "error";
-}
-/** Cap a debug body excerpt so a giant HTML/JSON error never floods the channel. */
-const MAX_DEBUG_BODY = 200;
-/** Cap the sentence a refusal is allowed to print, so a stray body stays one line. */
-const MAX_REFUSAL_MESSAGE = 240;
-/**
- * The server's one-sentence refusal, if the body is the shape our own routes
- * send (`{ error }`). Anything else, including HTML from a proxy, reads as no
- * sentence at all, so the caller falls back to its own copy. Newlines are
- * folded so a notice is never a stack.
- */
-function refusalMessage(body) {
-    try {
-        const parsed = JSON.parse(body);
-        const text = typeof parsed.error === "string" ? parsed.error.trim() : "";
-        if (!text)
-            return undefined;
-        const oneLine = text.replace(/\s+/g, " ");
-        return oneLine.length > MAX_REFUSAL_MESSAGE
-            ? `${oneLine.slice(0, MAX_REFUSAL_MESSAGE)}...`
-            : oneLine;
-    }
-    catch {
-        return undefined;
-    }
-}
-/**
- * A token-free, capped `: <body>` suffix for a failed-response debug line, from
- * a body already read once by the `!res.ok` branch.
- */
-function bodyTail(body) {
-    const t = body.trim();
-    if (!t)
-        return "";
-    return `: ${t.length > MAX_DEBUG_BODY ? `${t.slice(0, MAX_DEBUG_BODY)} ...` : t}`;
-}
-export function makeRunSession(opts) {
-    const f = opts.fetchImpl ?? fetch;
-    let handle = null;
-    // Opt-in observability: the default sink writes to stderr, and the `YAGNI_CODE_DEBUG`
-    // gate governs an injected sink too, so callers that pass neither stay silent. The
-    // resolved sink is wrapped so it can NEVER throw out of `debug`: an injected sink
-    // that throws must not breach the fail-soft never-throw contract (in the `!res.ok`
-    // branch an unguarded throw would land in the surrounding catch and re-fire debug,
-    // escaping `post` and rejecting the recording call).
-    const sink = opts.debug ??
-        ((line) => {
-            try {
-                process.stderr.write(`${line}\n`);
-            }
-            catch {
-                /* never break recording */
-            }
-        });
-    const debug = (line) => {
-        try {
-            sink(line);
-        }
-        catch {
-            /* observability never breaks recording */
-        }
-    };
-    const debugOn = !!(opts.env ?? process.env).YAGNI_CODE_DEBUG;
-    // A run-open (`start`) is the one recording call worth retrying: if it is lost,
-    // the WHOLE run goes untracked. It is made replay-safe by an idempotency key (the
-    // server dedups a re-sent create), so it uses the retrying policy. Every other
-    // verb is append-only / terminal and stays single-attempt (METERED) so a recorded
-    // judgment (a correction) is never duplicated by a client replay.
-    const post = async (path, body, postOpts = {}) => {
-        try {
-            const res = await resilientFetch(`${opts.baseUrl}/api/yagni-code/${path}`, {
-                method: "POST",
-                headers: {
-                    "content-type": "application/json",
-                    authorization: `Bearer ${opts.getToken() ?? ""}`,
-                },
-                body: JSON.stringify(body),
-            }, {
-                fetchImpl: f,
-                policy: postOpts.retry ? DEFAULT_FETCH_POLICY : METERED_POST_FETCH_POLICY,
-                ...(opts.sleep ? { sleep: opts.sleep } : {}),
-                ...(opts.random ? { random: opts.random } : {}),
-            });
-            if (!res.ok) {
-                // Read the body ONCE on the failure branch (the ok path reads
-                // `res.json()` instead, so there is no double-consume): the debug line
-                // and the refusal sentence both come from this one read, and a body
-                // that cannot be read costs neither.
-                let body = "";
-                try {
-                    body = await res.text();
-                }
-                catch {
-                    /* a body we cannot read is a body we do not quote */
-                }
-                if (debugOn)
-                    debug(`[yagni-code] run-record ${path} -> HTTP ${res.status}${bodyTail(body)}`);
-                const message = refusalMessage(body);
-                return { ok: false, status: res.status, ...(message ? { failureText: message } : {}) };
-            }
-            return { ok: true, data: (await res.json()) };
-        }
-        catch (err) {
-            // fail-soft: recording must never break the pipeline (no status = unreachable
-            // after retries).
-            if (debugOn) {
-                debug(`[yagni-code] run-record ${path} unreachable: ${err instanceof Error ? err.message : String(err)}`);
-            }
-            return { ok: false };
-        }
-    };
-    return {
-        bind(h) {
-            handle = h;
-        },
-        async start(b) {
-            // One idempotency key per open attempt: resilientFetch replays the SAME
-            // request body across retries, so a create whose 201 was lost to a blip is
-            // deduped by the server (startCodeRun.findRunByIdempotencyKey) instead of
-            // opening a second run + a second free-text work item.
-            const r = await post("runs", { ...b, idempotencyKey: randomUUID() }, { retry: true });
-            if (!r.ok) {
-                return {
-                    tracked: false,
-                    reason: failureReason(r.status),
-                    ...(r.failureText ? { message: r.failureText } : {}),
-                };
-            }
-            const data = r.data;
-            if (typeof data.runId === "string" && typeof data.workItemId === "string") {
-                handle = { runId: data.runId, workItemId: data.workItemId };
-                return {
-                    tracked: true,
-                    runId: handle.runId,
-                    workItemId: handle.workItemId,
-                    gated: data.gated === true,
-                    gatedReason: typeof data.gatedReason === "string" ? data.gatedReason : undefined,
-                };
-            }
-            // A 2xx with an unrecognized body: we can't bind a handle, so it's untracked.
-            if (debugOn)
-                debug("[yagni-code] run-record runs -> 2xx but body had no runId/workItemId");
-            return { tracked: false, reason: "error" };
-        },
-        async stage(b) {
-            if (!handle)
-                return;
-            await post(`runs/${handle.runId}/stages`, { ...b, workItemId: handle.workItemId });
-        },
-        async correction(b) {
-            if (!handle)
-                return;
-            await post(`runs/${handle.runId}/correction`, { ...b, workItemId: handle.workItemId });
-        },
-        async recordPlan(b) {
-            if (!handle)
-                return;
-            await post(`runs/${handle.runId}/plan`, { ...b, workItemId: handle.workItemId });
-        },
-        async heartbeat() {
-            if (!handle)
-                return;
-            await post(`runs/${handle.runId}/heartbeat`, { workItemId: handle.workItemId });
-        },
-        async finish(b) {
-            if (!handle)
-                return;
-            await post(`runs/${handle.runId}/finish`, { ...b, workItemId: handle.workItemId });
-        },
-    };
-}
-//# sourceMappingURL=runSession.js.map