@yagni-app/code-staging 1.2.13-staging.2167.1 → 1.2.13-staging.2173.1

package/dist/extension/pipeline/planOutput.d.ts

@@ -46,6 +46,15 @@ export interface PlanFile {
         repository: string;
         what: string;
     }>;
+    /**
+     * What the plan found that the ticket did not ask for (ENG-2966): kept off
+     * the plan, shown at its gate for a person to make a ticket of.
+     */
+    followUps: Array<{
+        title: string;
+        why: string;
+        repository?: string;
+    }>;
 }
 /** The plan's `wrongRepository`, or null when it names no `owner/name`. Confidence is high only when said. */
 export declare function readWrongRepository(value: unknown): PlanFile["wrongRepository"] | null;
@@ -59,6 +68,12 @@ export declare function repositoryName(value: unknown): string | null;
  * for the same repository (case-insensitive) is dropped too.
  */
 export declare function readRepositoriesNeeded(value: unknown): PlanFile["repositoriesNeeded"];
+/**
+ * The plan's `followUps`, one per distinct title in the order written. An
+ * entry with no title is dropped; a repository that is not `owner/name` is
+ * left off its entry.
+ */
+export declare function readFollowUps(value: unknown): PlanFile["followUps"];
 /** The plan's ```plan-json block as an object, or null when it has none that parses. */
 export declare function extractPlanJson(text: string): Record<string, unknown> | null;
 /** The plan for a person to read: the text without its machine-readable block. */

package/dist/extension/pipeline/planOutput.js

@@ -77,6 +77,30 @@ export function readRepositoriesNeeded(value) {
     }
     return out;
 }
+/** At most this many follow-ups; the host keeps the same number. */
+const MAX_FOLLOW_UPS = 10;
+/**
+ * The plan's `followUps`, one per distinct title in the order written. An
+ * entry with no title is dropped; a repository that is not `owner/name` is
+ * left off its entry.
+ */
+export function readFollowUps(value) {
+    const out = [];
+    const seen = new Set();
+    for (const entry of list(value)) {
+        if (!isRecord(entry))
+            continue;
+        const title = text(entry.title, 200);
+        if (!title || seen.has(title.toLowerCase()))
+            continue;
+        seen.add(title.toLowerCase());
+        const repository = repositoryName(entry.repository);
+        out.push({ title, why: text(entry.why) ?? "", ...(repository ? { repository } : {}) });
+        if (out.length === MAX_FOLLOW_UPS)
+            break;
+    }
+    return out;
+}
 /** The plan's ```plan-json block as an object, or null when it has none that parses. */
 export function extractPlanJson(text) {
     let found = null;
@@ -162,6 +186,7 @@ export function buildPlanFile(planText, fallbackPaths) {
             repositoriesNeeded,
             ...(wrongRepository ? { wrongRepository } : {}),
             dependsOn: readDependsOn(block?.dependsOn),
+            followUps: readFollowUps(block?.followUps),
         },
         found: block !== null,
     };

package/dist/extension/pipeline/sessionLane.d.ts

@@ -48,6 +48,12 @@ import type { WorktreeExec } from "./worktree.js";
 export declare const SESSION_TIER: ModelTier;
 /** The caller the model proxy attributes the session's own turns to. */
 export declare const SESSION_CALLER_LABEL = "go:session";
+/**
+ * Whether this process is a session-lane turn: the pi child {@link runSessionTurn}
+ * starts, which the runner gives the session's caller label (`YAGNI_CALLER`).
+ * A subagent it spawns gets its own label, so only the turn itself answers yes.
+ */
+export declare function isSessionLaneTurn(env?: NodeJS.ProcessEnv): boolean;
 /** The model's own account of a turn that builds, beside `result.json` in the output folder. */
 export declare const SESSION_REPORT_FILE_NAME = "session-report.json";
 /** What a plan turn may use: everything that reads or runs, nothing that edits. */

package/dist/extension/pipeline/sessionLane.js

@@ -56,6 +56,14 @@ import { snapshotWorkspace } from "./workspace.js";
 export const SESSION_TIER = "peak";
 /** The caller the model proxy attributes the session's own turns to. */
 export const SESSION_CALLER_LABEL = "go:session";
+/**
+ * Whether this process is a session-lane turn: the pi child {@link runSessionTurn}
+ * starts, which the runner gives the session's caller label (`YAGNI_CALLER`).
+ * A subagent it spawns gets its own label, so only the turn itself answers yes.
+ */
+export function isSessionLaneTurn(env = process.env) {
+    return env.YAGNI_CALLER === SESSION_CALLER_LABEL;
+}
 /** The model's own account of a turn that builds, beside `result.json` in the output folder. */
 export const SESSION_REPORT_FILE_NAME = "session-report.json";
 /** What a plan turn may use: everything that reads or runs, nothing that edits. */

package/dist/extension/pipeline/stages.d.ts

@@ -74,6 +74,14 @@ export declare const DOCUMENTATION_REPOSITORY_RULE: string;
  * without another repository is named, not left as a Risks bullet.
  */
 export declare const RIGHT_REPOSITORY_RULE: string;
+/**
+ * What the planner does with what it finds that the ticket did not ask for
+ * (ENG-2966): a nearby bug, a leak, a refactor is a follow-up a person can
+ * make a ticket of, never a question, a decision or a step of this plan. And
+ * nothing the ticket asked for is put off: work it needs in another
+ * repository goes in repositoriesNeeded, so the host offers the split.
+ */
+export declare const FOLLOW_UPS_RULE: string;
 export declare const PLAN_JSON_CONTRACT: string;
 /**
  * The one-attempt lane's session (`yagni go --headless --cloud`): plan,

package/dist/extension/pipeline/stages.js

@@ -167,6 +167,20 @@ export const RIGHT_REPOSITORY_RULE = '- "wrongRepository" is for a ticket whose
     '- "dependsOn" lists every other repository that needs a change before this one can work, each ' +
     "with one line on what it needs there, whether or not the Other repositories section lists it. " +
     "Such a dependency is never only a Risks bullet. Never list a repository the change only reads.";
+/**
+ * What the planner does with what it finds that the ticket did not ask for
+ * (ENG-2966): a nearby bug, a leak, a refactor is a follow-up a person can
+ * make a ticket of, never a question, a decision or a step of this plan. And
+ * nothing the ticket asked for is put off: work it needs in another
+ * repository goes in repositoriesNeeded, so the host offers the split.
+ */
+export const FOLLOW_UPS_RULE = '- "followUps" lists what you found that the ticket did not ask for: a nearby bug, a security ' +
+    "leak, a refactor. Each is a title, one line on why it matters, and its repository when that is " +
+    "not this one. A follow-up is never a question, a decision or a step of this plan, however real " +
+    "it is: a person makes a ticket of it if they want one. Leave it out when you found nothing.\n" +
+    '- Never put off the ticket\'s own work ("for another session", "in a later ticket"). Plan all of ' +
+    "what it asked for. Work it needs in another repository goes in repositoriesNeeded, so the ticket " +
+    "is split, and is never left out of the plan.";
 export const PLAN_JSON_CONTRACT = "End your answer with a fenced ```plan-json block and nothing after it:\n" +
     "```plan-json\n" +
     "{\n" +
@@ -181,12 +195,14 @@ export const PLAN_JSON_CONTRACT = "End your answer with a fenced ```plan-json bl
     '  "paths": ["apps/web"],\n' +
     '  "repositoriesNeeded": [{"repository": "owner/name", "summary": "one line on what changes there"}],\n' +
     '  "wrongRepository": {"repository": "owner/name", "why": "one line", "confidence": "high|low"},\n' +
-    '  "dependsOn": [{"repository": "owner/name", "what": "one line on what it needs there"}]\n' +
+    '  "dependsOn": [{"repository": "owner/name", "what": "one line on what it needs there"}],\n' +
+    '  "followUps": [{"title": "...", "why": "one line", "repository": "owner/name"}]\n' +
     "}\n" +
     "```\n" +
     "Rules the host enforces, so getting them wrong loses the question:\n" +
     '- "kind" is "fact" when the answer could be looked up and "decision" when it is a person\'s call. ' +
-    'A decision you would make yourself carries your recommendation and is stated, not asked; mark "oneWay": true only when it cannot be undone.\n' +
+    'A decision you would make yourself carries your recommendation and is stated, not asked; mark "oneWay": true only when it cannot be undone. ' +
+    "A recommendation whose planChange adds acceptance criteria widens the ticket, so a person is asked it.\n" +
     '- On a fact, "checked" says in at most 4 short lines what you read or ran for it and what it showed, and what you could not read. ' +
     "A fact whose every answer plans the same work (no option carries a planChange) is stated as your assumption, not asked.\n" +
     "- At most two alternatives per question. A planChange only adds or rewords; it never removes.\n" +
@@ -200,7 +216,9 @@ export const PLAN_JSON_CONTRACT = "End your answer with a fenced ```plan-json bl
     "never list a repository the change only reads. " +
     DOCUMENTATION_REPOSITORY_RULE +
     "\n" +
-    RIGHT_REPOSITORY_RULE;
+    RIGHT_REPOSITORY_RULE +
+    "\n" +
+    FOLLOW_UPS_RULE;
 /**
  * The cloud plan stage's task: the input folder the host wrote, read first,
  * then a plan grounded in the installed checkout, inside the stage's own

package/dist/extension/subagents.d.ts

@@ -69,6 +69,15 @@ export interface SubagentDef {
  * not a second build (on staging 2026-10-28, advanced-tier verifiers ran 34
  * minutes after an 11-minute build). */
 export declare const VERIFICATION_WALL_TIMEOUT_MS: number;
+/**
+ * The tier the built-in verification agent asks for: `peak` in a session-lane
+ * turn (`pipeline/sessionLane.ts`), the one place the proxy serves a verifier
+ * above its advanced ceiling for subagents, and `advanced` everywhere else (the
+ * CLI, desktop, the attempt lane's stage graph), so a request never asks for a
+ * tier it would not be served. A repo's own `verification` agent keeps the tier
+ * it declares.
+ */
+export declare function verificationTier(env?: NodeJS.ProcessEnv): ModelTier;
 /** Claude Code model names → YAGNI tiers; YAGNI tiers pass through. */
 export declare function mapModelTier(model: string | undefined): ModelTier;
 /**
@@ -80,7 +89,7 @@ export declare function parseAgentMarkdown(content: string, fallbackName: string
 export interface DiscoverDeps {
     cwd: string;
     homeDir?: string;
-    /** Env seam for the plugin agent dirs (defaults to process.env). */
+    /** Env seam for the plugin agent dirs and the verification agent's tier (defaults to process.env). */
     env?: NodeJS.ProcessEnv;
 }
 /**
@@ -112,7 +121,7 @@ export interface MakeSubagentToolDeps {
     runStageImpl?: typeof runStage;
     discover?: (deps: DiscoverDeps) => SubagentDef[];
     homeDir?: string;
-    /** Env seam for the telemetry sessionId read (defaults to process.env). */
+    /** Env seam for discovery and the telemetry sessionId read (defaults to process.env). */
     env?: NodeJS.ProcessEnv;
     /** Live ultra-mode probe (/ultra): widens the per-call fan-out ceiling. */
     isUltra?: () => boolean;

package/dist/extension/subagents.js

@@ -20,13 +20,14 @@
 import * as fs from "node:fs";
 import { homedir } from "node:os";
 import { delimiter, join } from "node:path";
-import { parseFrontmatter } from "@earendil-works/pi-coding-agent";
+import { parseFrontmatter, } from "@earendil-works/pi-coding-agent";
 import { Type } from "typebox";
 import { sanitizeCallerSegment } from "./config.js";
 import { logEvent } from "./errorSink.js";
 import { withResilience } from "./pipeline/resilience.js";
 import { runStage } from "./pipeline/runner.js";
-import { DEFAULT_RESILIENCE_POLICY } from "./pipeline/types.js";
+import { isSessionLaneTurn } from "./pipeline/sessionLane.js";
+import { DEFAULT_RESILIENCE_POLICY, } from "./pipeline/types.js";
 import { applyChildEvent, finalizeTask, formatWorkingMessage, newTaskProgress, progressSummaryText, renderSubagentCall, renderSubagentResult, } from "./subagentRender.js";
 /**
  * pi's tool contract signals an error by THROWING, and a normally-returned
@@ -216,26 +217,38 @@ nothing, say exactly what you tried to break and how.`;
  * not a second build (on staging 2026-10-28, advanced-tier verifiers ran 34
  * minutes after an 11-minute build). */
 export const VERIFICATION_WALL_TIMEOUT_MS = 15 * 60_000;
-/** The diamond's reduce layer: refute-first review of completed work on the
- * peak tier (judgment is the whole job, so the premium is worth paying; the
- * server exempts this caller from its advanced ceiling for subagents). One by
- * default, on a fifteen-minute clock. It has no edit/write tools; bash is
- * included for `git diff`-style inspection and is restricted to read-only USE
- * by the persona, the same prompt-level stance as /go's reviewer — not a
- * technical guarantee. */
-const VERIFICATION_AGENT = {
-    name: "verification",
-    description: "Adversarial verification of completed work: tries to refute a change, " +
-        "plan, or claim and reports concrete failure scenarios. Does not edit " +
-        "files. Send one; send two or three with different lenses (correctness, " +
-        "edge cases, codebase fit) only for a risky change such as a migration, " +
-        "auth or money, and treat agreement as confirmation.",
-    model: "peak",
-    tools: ["read", "grep", "find", "ls", "bash", "ask_yagni"],
-    body: VERIFICATION_BODY,
-    source: "builtin",
-    wallTimeoutMs: VERIFICATION_WALL_TIMEOUT_MS,
-};
+/**
+ * The tier the built-in verification agent asks for: `peak` in a session-lane
+ * turn (`pipeline/sessionLane.ts`), the one place the proxy serves a verifier
+ * above its advanced ceiling for subagents, and `advanced` everywhere else (the
+ * CLI, desktop, the attempt lane's stage graph), so a request never asks for a
+ * tier it would not be served. A repo's own `verification` agent keeps the tier
+ * it declares.
+ */
+export function verificationTier(env = process.env) {
+    return isSessionLaneTurn(env) ? "peak" : "advanced";
+}
+/** The diamond's reduce layer: refute-first review of completed work, on
+ * {@link verificationTier} (judgment is the whole job, so the premium is worth
+ * paying where the lane serves it). One by default, on a fifteen-minute clock.
+ * It has no edit/write tools; bash is included for `git diff`-style inspection
+ * and is restricted to read-only USE by the persona, the same prompt-level
+ * stance as /go's reviewer, not a technical guarantee. */
+function verificationAgent(env) {
+    return {
+        name: "verification",
+        description: "Adversarial verification of completed work: tries to refute a change, " +
+            "plan, or claim and reports concrete failure scenarios. Does not edit " +
+            "files. Send one; send two or three with different lenses (correctness, " +
+            "edge cases, codebase fit) only for a risky change such as a migration, " +
+            "auth or money, and treat agreement as confirmation.",
+        model: verificationTier(env),
+        tools: ["read", "grep", "find", "ls", "bash", "ask_yagni"],
+        body: VERIFICATION_BODY,
+        source: "builtin",
+        wallTimeoutMs: VERIFICATION_WALL_TIMEOUT_MS,
+    };
+}
 // Concrete tiers a subagent can actually run on. `balanced` is deliberately NOT
 // a member here even though it is a member of `ModelTier`: a subagent needs
 // ONE model for its whole run, and balanced is a session-level routing policy,
@@ -331,9 +344,10 @@ function loadAgentsFromDir(dir, source) {
  */
 export function discoverSubagents(deps) {
     const home = deps.homeDir ?? homedir();
+    const env = deps.env ?? process.env;
     const layers = [
-        [GENERAL_AGENT, SEARCHER_AGENT, IMPLEMENTER_AGENT, VERIFICATION_AGENT],
-        ...pluginAgentDirs(deps.env ?? process.env).map((dir) => loadAgentsFromDir(dir, "plugin")),
+        [GENERAL_AGENT, SEARCHER_AGENT, IMPLEMENTER_AGENT, verificationAgent(env)],
+        ...pluginAgentDirs(env).map((dir) => loadAgentsFromDir(dir, "plugin")),
         loadAgentsFromDir(join(home, ".claude", "agents"), "user-claude"),
         loadAgentsFromDir(join(deps.cwd, ".pi", "agents"), "project-pi"),
         loadAgentsFromDir(join(deps.cwd, ".claude", "agents"), "project-claude"),
@@ -353,9 +367,7 @@ const SOURCE_LABEL = {
     "project-claude": ".claude/agents",
 };
 export function formatAgentList(agents) {
-    return agents
-        .map((a) => `${a.name} (${SOURCE_LABEL[a.source]}): ${a.description}`)
-        .join("\n");
+    return agents.map((a) => `${a.name} (${SOURCE_LABEL[a.source]}): ${a.description}`).join("\n");
 }
 /**
  * A subagent invocation is a synthetic pipeline stage: the task rides in as
@@ -450,7 +462,9 @@ export function buildSubagentStage(def, task, opts = {}) {
             id: "implement",
             agent: def.name,
             model: def.model,
-            tools: grounded ? def.tools ?? DEFAULT_SUBAGENT_TOOLS : stripGroundingTool(def.tools ?? DEFAULT_SUBAGENT_TOOLS),
+            tools: grounded
+                ? (def.tools ?? DEFAULT_SUBAGENT_TOOLS)
+                : stripGroundingTool(def.tools ?? DEFAULT_SUBAGENT_TOOLS),
             taskTemplate: "{ticket}",
         },
         ctx: { ticket: task, grounded },
@@ -463,7 +477,9 @@ const parameters = Type.Object({
     agent: Type.Optional(Type.String({ description: "Agent name (see /agents). Defaults to general." })),
     tasks: Type.Optional(Type.Array(Type.Object({
         task: Type.String(),
-        agent: Type.Optional(Type.String({ description: "Agent name; defaults to the top-level `agent`, then general." })),
+        agent: Type.Optional(Type.String({
+            description: "Agent name; defaults to the top-level `agent`, then general.",
+        })),
     }), {
         description: `Run several independent tasks in parallel (max ${MAX_PARALLEL_SUBAGENTS}; ${MAX_PARALLEL_SUBAGENTS_ULTRA} in ultra mode). Use INSTEAD of task. Entries without their own agent run as the top-level agent.`,
     })),
@@ -504,7 +520,11 @@ export function subagentRunPolicy(wallTimeoutMs = SUBAGENT_WALL_TIMEOUT_MS) {
 export function subagentTelemetry(env) {
     return (rec) => logEvent({
         source: "subagent",
-        level: rec.outcome === "ok" ? "info" : rec.outcome === "timeout" || rec.outcome === "fatal" ? "error" : "warn",
+        level: rec.outcome === "ok"
+            ? "info"
+            : rec.outcome === "timeout" || rec.outcome === "fatal"
+                ? "error"
+                : "warn",
         event: `attempt_${rec.outcome}`,
         sessionId: env.YAGNI_SESSION_ID,
         fields: {
@@ -563,7 +583,7 @@ export function makeSubagentTool(deps = {}) {
     // Fails soft: discovery problems never block the tool.
     let agentListBlock = "";
     try {
-        const discovered = discover({ cwd: process.cwd(), homeDir: deps.homeDir });
+        const discovered = discover({ cwd: process.cwd(), homeDir: deps.homeDir, env: deps.env });
         if (discovered.length > 0) {
             agentListBlock =
                 " Available agents (first sentence only; /agents lists them in full):\n" +
@@ -589,7 +609,8 @@ export function makeSubagentTool(deps = {}) {
             "spell out the task completely. Agents come from this repo's .claude/agents and .pi/agents " +
             "(list them with /agents); omit `agent` for the general-purpose one. The list below was " +
             "captured at session launch — if the session's cwd differs from the launch cwd it may be " +
-            "stale; an unknown name is a hard error, so trust /agents over this list when they differ." + agentListBlock,
+            "stale; an unknown name is a hard error, so trust /agents over this list when they differ." +
+            agentListBlock,
         promptSnippet: "subagent: delegate a self-contained task (or parallel tasks) to a fresh-context agent; returns its report.",
         parameters,
         // Self-framed: the condensed transcript look has no tinted tool boxes.
@@ -619,7 +640,7 @@ export function makeSubagentTool(deps = {}) {
                 return fail(`Error: at most ${maxParallel} parallel tasks per call.`);
             }
             const cwd = ctx?.cwd ?? process.cwd();
-            const agents = discover({ cwd, homeDir: deps.homeDir });
+            const agents = discover({ cwd, homeDir: deps.homeDir, env: deps.env });
             const resolved = [];
             for (const req of requested) {
                 // A tasks[] entry names its own agent first; absent that, it inherits
@@ -647,7 +668,11 @@ export function makeSubagentTool(deps = {}) {
                 onUpdate?.({
                     content: [{ type: "text", text: progressSummaryText(progresses, now) }],
                     details: {
-                        tasks: progresses.map((p) => ({ ...p, actions: [...p.actions], usage: { ...p.usage } })),
+                        tasks: progresses.map((p) => ({
+                            ...p,
+                            actions: [...p.actions],
+                            usage: { ...p.usage },
+                        })),
                     },
                 });
                 const working = formatWorkingMessage(progresses, now);
@@ -678,7 +703,7 @@ export function makeSubagentTool(deps = {}) {
                         // Computed from the tools the runner will actually pass the
                         // child (`--tools`), so a custom definition cannot opt out by
                         // name.
-                        stageWriteCapable: (stage.tools).some((t) => t === "edit" || t === "write"),
+                        stageWriteCapable: stage.tools.some((t) => t === "edit" || t === "write"),
                         // Content-free task discriminator: which entry of THIS call's
                         // task list the attempt belongs to (parallel same-agent
                         // failures stay attributable without leaking task text).
@@ -727,7 +752,10 @@ export function makeSubagentTool(deps = {}) {
                 // The verification agent's contract is a `## Verdict` header; an
                 // output without it is not a verdict, and the driver must not treat
                 // a truncated probe log as "HOLDS".
-                const missingVerdict = o.def.source === "builtin" && o.agent === "verification" && o.result.exitCode === 0 && !output.includes("## Verdict")
+                const missingVerdict = o.def.source === "builtin" &&
+                    o.agent === "verification" &&
+                    o.result.exitCode === 0 &&
+                    !output.includes("## Verdict")
                     ? "\n\n(no verdict — the verification run did not produce its verdict section)"
                     : "";
                 return outcomes.length === 1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yagni-app/code-staging",
-  "version": "1.2.13-staging.2167.1",
+  "version": "1.2.13-staging.2173.1",
   "description": "YAGNI Code: a terminal coding agent that already knows your company. One YAGNI login routes the model and grounds the agent in your team's context.",
   "license": "SEE LICENSE IN LICENSE.md",
   "author": "YAGNI, Inc. <jack@yagni.app> (https://yagni.app)",
@@ -58,5 +58,5 @@
     "turndown": "^7.2.4",
     "typebox": "^1.3.15"
   },
-  "yagniSourceSha": "eacf9167a622d9ff9a977d0fde9d29040a78aa60"
+  "yagniSourceSha": "d6206a240e12cff30f8e2e5e8975adfe67e52e83"
 }