@yagni-app/code-staging 1.2.2-staging.1528.1 → 1.2.2-staging.1537.1

package/dist/extension/pipeline/budget.d.ts

@@ -29,6 +29,14 @@ export interface RunBudget {
     maxCost: number;
     /** Max aggregate input+output tokens. */
     maxTokens: number;
+    /**
+     * Absolute wall-clock deadline (epoch ms) the run must be done by. Absent on
+     * every interactive run, where only the usage ceilings apply. The sandbox
+     * harness sets it from `YAGNI_PIPELINE_TIME_LEFT_MS`, anchored to this
+     * process's own clock, so the run stops before a step it cannot finish
+     * instead of being killed partway through one.
+     */
+    deadlineMs?: number;
 }
 /**
  * Generous default ceilings: a 3-round /go fans out review across 3 lenses on top
@@ -41,8 +49,33 @@ export declare function addRunUsage(a: RunUsage, b: RunUsage): RunUsage;
 /** Sum usage across the build/fix stages AND every review lens result. */
 export declare function aggregateRunUsage(stages: StageResult[], rounds: ReviewRound[]): RunUsage;
 /**
- * Return an honest reason string when an aggregate usage crosses any ceiling, else
- * null. Checked at each stage boundary so the run stops at the first crossing.
+ * Return an honest reason string when an aggregate usage crosses any ceiling (or
+ * the run's deadline has passed), else null. Checked at each stage boundary so
+ * the run stops at the first crossing.
  */
-export declare function exceedsBudget(usage: RunUsage, budget: RunBudget): string | null;
+export declare function exceedsBudget(usage: RunUsage, budget: RunBudget, nowMs?: number): string | null;
+/**
+ * Env var the sandbox host hands the run's time left (ms, relative) on. Relative,
+ * not an epoch: the host's clock and the sandbox VM's clock can disagree, and a
+ * skew would shift an absolute deadline one-for-one. The run anchors it to its
+ * own clock at start.
+ */
+export declare const PIPELINE_TIME_LEFT_ENV = "YAGNI_PIPELINE_TIME_LEFT_MS";
+/** A positive integer millisecond count, or undefined for anything else (absent, blank, garbage). */
+export declare function parsePipelineTimeLeft(raw: string | undefined): number | undefined;
+/** The stage kinds whose START is gated on the time left. */
+export type TimedStageKind = "review" | "fix";
+/**
+ * What a stage is assumed to take before one has been observed this run. Set
+ * from a production run (2026-09-29): a review round took 2.5 to 3 minutes and
+ * a fix 4.5 to more than 5, so each default sits just above what was seen.
+ */
+export declare const DEFAULT_STAGE_ESTIMATE_MS: Record<TimedStageKind, number>;
+/**
+ * Null when a stage expected to take `expectedMs` fits before the deadline (or
+ * there is no deadline); else an honest reason. The check is at the START of a
+ * stage: a stage already running cannot be stopped at a clean edit boundary,
+ * so the only safe place to stop is before it begins.
+ */
+export declare function stageWontFit(budget: RunBudget, kind: TimedStageKind, expectedMs: number, nowMs?: number): string | null;
 //# sourceMappingURL=budget.d.ts.map

package/dist/extension/pipeline/budget.js

@@ -49,10 +49,14 @@ export function aggregateRunUsage(stages, rounds) {
     return acc;
 }
 /**
- * Return an honest reason string when an aggregate usage crosses any ceiling, else
- * null. Checked at each stage boundary so the run stops at the first crossing.
+ * Return an honest reason string when an aggregate usage crosses any ceiling (or
+ * the run's deadline has passed), else null. Checked at each stage boundary so
+ * the run stops at the first crossing.
  */
-export function exceedsBudget(usage, budget) {
+export function exceedsBudget(usage, budget, nowMs = Date.now()) {
+    if (budget.deadlineMs !== undefined && nowMs >= budget.deadlineMs) {
+        return `time budget reached (deadline passed ${Math.round((nowMs - budget.deadlineMs) / 1000)}s ago)`;
+    }
     if (usage.turns > budget.maxTurns) {
         return `turn ceiling reached (${usage.turns} of ${budget.maxTurns} model turns)`;
     }
@@ -65,4 +69,42 @@ export function exceedsBudget(usage, budget) {
     }
     return null;
 }
+/**
+ * Env var the sandbox host hands the run's time left (ms, relative) on. Relative,
+ * not an epoch: the host's clock and the sandbox VM's clock can disagree, and a
+ * skew would shift an absolute deadline one-for-one. The run anchors it to its
+ * own clock at start.
+ */
+export const PIPELINE_TIME_LEFT_ENV = "YAGNI_PIPELINE_TIME_LEFT_MS";
+/** A positive integer millisecond count, or undefined for anything else (absent, blank, garbage). */
+export function parsePipelineTimeLeft(raw) {
+    const text = raw?.trim();
+    if (!text || !/^\d+$/.test(text))
+        return undefined;
+    const value = Number(text);
+    return Number.isSafeInteger(value) && value > 0 ? value : undefined;
+}
+/**
+ * What a stage is assumed to take before one has been observed this run. Set
+ * from a production run (2026-09-29): a review round took 2.5 to 3 minutes and
+ * a fix 4.5 to more than 5, so each default sits just above what was seen.
+ */
+export const DEFAULT_STAGE_ESTIMATE_MS = {
+    review: 4 * 60_000,
+    fix: 6 * 60_000,
+};
+/**
+ * Null when a stage expected to take `expectedMs` fits before the deadline (or
+ * there is no deadline); else an honest reason. The check is at the START of a
+ * stage: a stage already running cannot be stopped at a clean edit boundary,
+ * so the only safe place to stop is before it begins.
+ */
+export function stageWontFit(budget, kind, expectedMs, nowMs = Date.now()) {
+    if (budget.deadlineMs === undefined)
+        return null;
+    const leftMs = budget.deadlineMs - nowMs;
+    if (leftMs >= expectedMs)
+        return null;
+    return `not enough time left for a ${kind} stage (${Math.max(0, Math.round(leftMs / 1000))}s left, expected ${Math.round(expectedMs / 1000)}s)`;
+}
 //# sourceMappingURL=budget.js.map

package/dist/extension/pipeline/headlessGo.d.ts

@@ -46,9 +46,12 @@
  * result object and forwarded on the child env; the clamp itself is applied
  * centrally in `runStage` (see tierCap.ts). `YAGNI_GO_FANOUT` is read the same
  * way and pins the implement diamond for a benchmark lane (see fanout.ts).
+ * `YAGNI_PIPELINE_TIME_LEFT_MS` (the sandbox host) is the run's time left,
+ * anchored to this process's clock at start: the run then stops `budget_exceeded` before a review round or fix it
+ * cannot finish, rather than being killed partway through one (see budget.ts).
  */
 import { runPipeline as defaultRunPipeline } from "./orchestrator.js";
-import type { RunBudget } from "./budget.js";
+import { type RunBudget } from "./budget.js";
 import type { Finding, JsonEvent, ModelTier, PipelineStage, StageId, StageTag, StageUsage, StopReason } from "./types.js";
 /** One-line usage copy, shared by every argument error. */
 export declare const HEADLESS_GO_USAGE = "Usage: yagni go --headless --ticket-file <path> [--plan-file <path>] [--memo-file <path>] [--run-id <id>] [--cwd <path>] [--json]";
@@ -130,6 +133,8 @@ export interface HeadlessGoDeps {
     env?: NodeJS.ProcessEnv;
     /** Environment for spawned stage children. Defaults to `env`. */
     childEnv?: NodeJS.ProcessEnv;
+    /** Wall clock (epoch ms) the host's time left is anchored to. Defaults to `Date.now`; injected in tests. */
+    now?: () => number;
     runPipeline?: typeof defaultRunPipeline;
     readFile?: (path: string) => string;
     /** stdout sink; one call per NDJSON line, newline added by the caller. */

package/dist/extension/pipeline/headlessGo.js

@@ -46,6 +46,9 @@
  * result object and forwarded on the child env; the clamp itself is applied
  * centrally in `runStage` (see tierCap.ts). `YAGNI_GO_FANOUT` is read the same
  * way and pins the implement diamond for a benchmark lane (see fanout.ts).
+ * `YAGNI_PIPELINE_TIME_LEFT_MS` (the sandbox host) is the run's time left,
+ * anchored to this process's clock at start: the run then stops `budget_exceeded` before a review round or fix it
+ * cannot finish, rather than being killed partway through one (see budget.ts).
  */
 import { readFileSync } from "node:fs";
 import { resolveFanoutMode } from "./fanout.js";
@@ -55,6 +58,7 @@ import { runPipeline as defaultRunPipeline } from "./orchestrator.js";
 import { loadGroundingEnabled } from "../grounding.js";
 import { codeStateHome } from "../stateHome.js";
 import { parseTierCap, TIER_CAP_ENV } from "./tierCap.js";
+import { DEFAULT_RUN_BUDGET, parsePipelineTimeLeft, PIPELINE_TIME_LEFT_ENV } from "./budget.js";
 /** One-line usage copy, shared by every argument error. */
 export const HEADLESS_GO_USAGE = "Usage: yagni go --headless --ticket-file <path> [--plan-file <path>] [--memo-file <path>] [--run-id <id>] [--cwd <path>] [--json]";
 /**
@@ -257,6 +261,18 @@ export async function runHeadlessGo(argv, deps = {}) {
     if (rawCap?.trim() && !tierCap) {
         writeErr(`Ignoring ${TIER_CAP_ENV}="${rawCap}": not a tier (peak, advanced, standard, efficient). Running uncapped.`);
     }
+    // The sandbox host's time left for this run, anchored to THIS process's clock
+    // (the host's may be skewed from the VM's). Absent (every local run, and a
+    // host that predates it) leaves the budget exactly as it was.
+    const rawTimeLeft = env[PIPELINE_TIME_LEFT_ENV];
+    const timeLeftMs = parsePipelineTimeLeft(rawTimeLeft);
+    if (rawTimeLeft?.trim() && timeLeftMs === undefined) {
+        writeErr(`Ignoring ${PIPELINE_TIME_LEFT_ENV}="${rawTimeLeft}": not a millisecond count. Running without a deadline.`);
+    }
+    const deadlineMs = timeLeftMs === undefined ? undefined : (deps.now ?? Date.now)() + timeLeftMs;
+    const budget = deadlineMs === undefined
+        ? deps.budget
+        : { ...(deps.budget ?? DEFAULT_RUN_BUDGET), deadlineMs: deps.budget?.deadlineMs ?? deadlineMs };
     const cwd = args.cwd ?? deps.cwd ?? process.cwd();
     const emit = (obj) => write(JSON.stringify(obj));
     const stream = args.json;
@@ -284,7 +300,7 @@ export async function runHeadlessGo(argv, deps = {}) {
             ...(args.runId ? { runId: args.runId } : {}),
         },
         ...(deps.signal ? { signal: deps.signal } : {}),
-        ...(deps.budget ? { budget: deps.budget } : {}),
+        ...(budget ? { budget } : {}),
         ...(deps.stages ? { stages: deps.stages } : {}),
         grounded: deps.grounded ?? grounding,
         ...(mission ? { mission } : {}),

package/dist/extension/pipeline/orchestrator.d.ts

@@ -65,6 +65,8 @@ export interface RunPipelineDeps {
      * with `budget_exceeded` rather than spending on. Tunable per lane / per caller.
      */
     budget?: RunBudget;
+    /** Wall clock for the budget's deadline checks (epoch ms). Defaults to `Date.now`; injected in tests. */
+    now?: () => number;
     /**
      * M6 eval: the stage list to run. Defaults to selectStages("full"); the blind
      * lane passes a grounding-tool-stripped copy (see eval.ts#blindStages).

package/dist/extension/pipeline/orchestrator.js

@@ -24,7 +24,7 @@
  * (an aborted/crashed child has empty output, which otherwise parses to zero
  * findings — i.e. a false "reviewed and clean").
  */
-import { addRunUsage, aggregateRunUsage, DEFAULT_RUN_BUDGET, EMPTY_RUN_USAGE, exceedsBudget } from "./budget.js";
+import { addRunUsage, aggregateRunUsage, DEFAULT_RUN_BUDGET, DEFAULT_STAGE_ESTIMATE_MS, EMPTY_RUN_USAGE, exceedsBudget, stageWontFit, } from "./budget.js";
 import { attributeFindings, checkerFindings, composeFixNote, composeResidue, composeSynthesizerInput, mergeFindings, parseOpenFindings, renderFindings, stripOpenFindings, } from "./checker.js";
 import { auditClaims, parsePartition } from "./fanout.js";
 import { extractFindingsBlock, hasBlockingFindings, parseFindings, shouldStop, unionFindings } from "./findings.js";
@@ -329,7 +329,14 @@ export async function runPipeline(ticket, deps) {
     let baselinePaths;
     const priorUsage = resume?.priorUsage ?? EMPTY_RUN_USAGE;
     const currentUsage = () => addRunUsage(priorUsage, aggregateRunUsage(stages, rounds));
-    const overBudget = () => exceedsBudget(currentUsage(), budget);
+    const clock = deps.now ?? Date.now;
+    const overBudget = () => exceedsBudget(currentUsage(), budget, clock());
+    // How long each timed stage kind last took THIS run. With a deadline, a review
+    // round or fix is only started when its last observed duration (or the
+    // conservative default, before one has run) still fits: a stage killed partway
+    // through by the harness leaves a half-edited tree and no verdict at all.
+    const observedMs = {};
+    const wontFit = (kind) => stageWontFit(budget, kind, observedMs[kind] ?? DEFAULT_STAGE_ESTIMATE_MS[kind], clock());
     // The map stage's brief, kept for the partitioner's repo context. Absent on a
     // mission run (map is skipped there — the injected memo stands in) and on any
     // run whose map stage did not produce one; the partition contract is explicit
@@ -848,6 +855,13 @@ export async function runPipeline(ticket, deps) {
         writeCheckpoint(mkRecord("build_done", { snapshot: afterBuild, reviewInput, usage: currentUsage() }));
     }
     while (true) {
+        const reviewWontFit = wontFit("review");
+        if (reviewWontFit) {
+            stopReason = "budget_exceeded";
+            log("pipeline_stop", { reason: "budget_exceeded", phase: "review", round, detail: reviewWontFit });
+            break;
+        }
+        const reviewStartedAt = clock();
         progress({ kind: "stage_start", stageId: "review", round });
         stageEvent("review", "start", { round });
         // P4 verify runs CONCURRENTLY with the lens fan-out: it is deterministic,
@@ -1003,6 +1017,7 @@ export async function runPipeline(ticket, deps) {
         if (degradedLenses)
             log("review_degraded", { round, degradedLenses });
         progress({ kind: "stage_done", stageId: "review", round });
+        observedMs.review = clock() - reviewStartedAt;
         // R3-b: stop honestly if the review fan-out pushed the run over budget, before
         // spending another fix + round. The round's findings are already recorded.
         const overAfterReview = overBudget();
@@ -1016,9 +1031,19 @@ export async function runPipeline(ticket, deps) {
             stopReason = decision.reason;
             break;
         }
+        // The review's findings are recorded; a fix that cannot finish in time would
+        // only leave them half-applied.
+        const fixWontFit = wontFit("fix");
+        if (fixWontFit) {
+            stopReason = "budget_exceeded";
+            log("pipeline_stop", { reason: "budget_exceeded", phase: "fix", round, detail: fixWontFit });
+            break;
+        }
+        const fixStartedAt = clock();
         progress({ kind: "stage_start", stageId: "fix", round });
         stageEvent("fix", "start", { round });
         const fixResult = await runStageFn(fix, { ticket: promptTicket, previous: serializeBlocking(findings), grounded }, stageDepsFor({ stageId: "fix", round }));
+        observedMs.fix = clock() - fixStartedAt;
         stages.push(fixResult);
         log("stage_done", { stageId: "fix", exitCode: fixResult.exitCode });
         if (deps.signal?.aborted) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yagni-app/code-staging",
-  "version": "1.2.2-staging.1528.1",
+  "version": "1.2.2-staging.1537.1",
   "description": "YAGNI Code: a terminal coding agent that already knows your company. One YAGNI login routes the model and grounds the agent in your team's context.",
   "license": "SEE LICENSE IN LICENSE.md",
   "author": "YAGNI, Inc. <jack@yagni.app> (https://yagni.app)",
@@ -58,5 +58,5 @@
     "turndown": "^7.2.4",
     "typebox": "^1.3.15"
   },
-  "yagniSourceSha": "ba1fbd6d109af460fa18b44f41f33b432465e25e"
+  "yagniSourceSha": "4213ac8b3bfc84b5ba97f3163242f943fb9bde9a"
 }