@yagni-app/code-staging 1.2.2-staging.1563.1 → 1.2.3-staging.1575.1

package/dist/extension/askAdvisorTool.d.ts

@@ -32,13 +32,18 @@ import { type AdvisorLimits, type AdvisorStateHandle } from "./advisor.js";
 import type { ChildUsageHandle } from "./childUsage.js";
 import type { WorkingLineHandle } from "./workingLine.js";
 import { runStage as defaultRunStage } from "./pipeline/runner.js";
-import { type PipelineStage } from "./pipeline/types.js";
+import { type PipelineStage, type ResiliencePolicy } from "./pipeline/types.js";
 import { type RenderTheme, type SubagentTaskProgress } from "./subagentRender.js";
 /**
  * Read-only recon plus grounding. Mirrors the `plan` stage's allowlist for the
  * reason documented there: enough tools to navigate instead of flailing on a
  * single `read`. No `bash`.
  */
+/**
+ * A consult is one read-only question, so it keeps the 20-minute wall clock
+ * the /go stages had before their default grew to an hour.
+ */
+export declare const ADVISOR_RESILIENCE_POLICY: ResiliencePolicy;
 export declare const ADVISOR_TOOLS: string[];
 /** The consult's tool list under `grounding: false` — grounding read
  * stripped via the canonical filter (grounding.ts). */

package/dist/extension/askAdvisorTool.js

@@ -40,6 +40,11 @@ import { applyChildEvent, finalizeTask, formatWorkingMessage, newTaskProgress, p
  * reason documented there: enough tools to navigate instead of flailing on a
  * single `read`. No `bash`.
  */
+/**
+ * A consult is one read-only question, so it keeps the 20-minute wall clock
+ * the /go stages had before their default grew to an hour.
+ */
+export const ADVISOR_RESILIENCE_POLICY = { ...DEFAULT_RESILIENCE_POLICY, wallTimeoutMs: 20 * 60_000 };
 export const ADVISOR_TOOLS = ["read", "grep", "find", "ls", "ask_yagni"];
 /** The consult's tool list under `grounding: false` — grounding read
  * stripped via the canonical filter (grounding.ts). */
@@ -144,7 +149,7 @@ export function makeAskAdvisorTool(opts) {
     // driver's tool call until the user presses Esc. The synthetic stage id is
     // "plan" (read-only tools, no bash), so the wrapper's write-gate never
     // blocks a retry — re-running a consult cannot double-apply anything.
-    const runStage = opts.runStage ?? withResilience(defaultRunStage, DEFAULT_RESILIENCE_POLICY);
+    const runStage = opts.runStage ?? withResilience(defaultRunStage, ADVISOR_RESILIENCE_POLICY);
     return {
         name: "ask_advisor",
         label: "Ask the advisor",

package/dist/extension/pipeline/budget.d.ts

@@ -78,4 +78,36 @@ export declare const DEFAULT_STAGE_ESTIMATE_MS: Record<TimedStageKind, number>;
  * so the only safe place to stop is before it begins.
  */
 export declare function stageWontFit(budget: RunBudget, kind: TimedStageKind, expectedMs: number, nowMs?: number): string | null;
+/**
+ * The shortest wall clock any /go stage gets: the old fixed limit. A run close
+ * to its deadline keeps this much rather than a stage being cut off sooner than
+ * it ever was.
+ */
+export declare const STAGE_WALL_FLOOR_MS: number;
+/** Time the verify gate is allowed after the last write, on top of the stage estimates. */
+export declare const VERIFY_ALLOWANCE_MS: number;
+/**
+ * What must still run after a stage stops: a review round, one fix, and the
+ * verify gate. Held back from the stage's wall clock so a long stage still
+ * leaves the run time to review what it wrote.
+ */
+export declare const STAGE_WALL_RESERVE_MS: number;
+/**
+ * Where a stage's wall clock came from: the build's remaining time, the
+ * 20-minute floor because the deadline was close, or the no-deadline default.
+ */
+export type StageWallSource = "deadline" | "floor" | "default";
+/**
+ * The wall clock for a stage spawning at `nowMs`. With a deadline (sandbox and
+ * mission runs) a working stage gets the build's remaining time less
+ * {@link STAGE_WALL_RESERVE_MS}, never under {@link STAGE_WALL_FLOOR_MS}: the
+ * idle timer is the check for a stuck model, and stopping a live stage at a
+ * fixed limit throws away work the run had time for. Without a deadline
+ * (interactive /go, where a person can abort) `fallbackMs` applies. The
+ * source rides the stage's attempt record.
+ */
+export declare function stageWall(budget: RunBudget, fallbackMs: number, nowMs?: number): {
+    ms: number;
+    source: StageWallSource;
+};
 //# sourceMappingURL=budget.d.ts.map

package/dist/extension/pipeline/budget.js

@@ -107,4 +107,33 @@ export function stageWontFit(budget, kind, expectedMs, nowMs = Date.now()) {
         return null;
     return `not enough time left for a ${kind} stage (${Math.max(0, Math.round(leftMs / 1000))}s left, expected ${Math.round(expectedMs / 1000)}s)`;
 }
+/**
+ * The shortest wall clock any /go stage gets: the old fixed limit. A run close
+ * to its deadline keeps this much rather than a stage being cut off sooner than
+ * it ever was.
+ */
+export const STAGE_WALL_FLOOR_MS = 20 * 60_000;
+/** Time the verify gate is allowed after the last write, on top of the stage estimates. */
+export const VERIFY_ALLOWANCE_MS = 5 * 60_000;
+/**
+ * What must still run after a stage stops: a review round, one fix, and the
+ * verify gate. Held back from the stage's wall clock so a long stage still
+ * leaves the run time to review what it wrote.
+ */
+export const STAGE_WALL_RESERVE_MS = DEFAULT_STAGE_ESTIMATE_MS.review + DEFAULT_STAGE_ESTIMATE_MS.fix + VERIFY_ALLOWANCE_MS;
+/**
+ * The wall clock for a stage spawning at `nowMs`. With a deadline (sandbox and
+ * mission runs) a working stage gets the build's remaining time less
+ * {@link STAGE_WALL_RESERVE_MS}, never under {@link STAGE_WALL_FLOOR_MS}: the
+ * idle timer is the check for a stuck model, and stopping a live stage at a
+ * fixed limit throws away work the run had time for. Without a deadline
+ * (interactive /go, where a person can abort) `fallbackMs` applies. The
+ * source rides the stage's attempt record.
+ */
+export function stageWall(budget, fallbackMs, nowMs = Date.now()) {
+    if (budget.deadlineMs === undefined)
+        return { ms: fallbackMs, source: "default" };
+    const leftMs = budget.deadlineMs - nowMs - STAGE_WALL_RESERVE_MS;
+    return leftMs > STAGE_WALL_FLOOR_MS ? { ms: leftMs, source: "deadline" } : { ms: STAGE_WALL_FLOOR_MS, source: "floor" };
+}
 //# sourceMappingURL=budget.js.map

package/dist/extension/pipeline/orchestrator.d.ts

@@ -26,10 +26,11 @@
  */
 import { type RunBudget } from "./budget.js";
 import { type MissionInputs } from "./mission.js";
+import { type ResilienceAttemptRecord, type RunStageFn } from "./resilience.js";
 import { runStage as defaultRunStage } from "./runner.js";
 import { type VerifyOutcome, type WorkstreamCheckResult, type WorkstreamCheckTarget } from "./verify.js";
 import { snapshotWorkspace as defaultSnapshotWorkspace } from "./workspace.js";
-import { type CheckpointStore, type FanoutBudgetVerdict, type FanoutMode, type PipelineStage, type JsonEvent, type PipelineProgress, type PipelineResult, type ResumePlan, type StageId, type StageResult, type StageTag } from "./types.js";
+import { type CheckpointStore, type FanoutBudgetVerdict, type FanoutMode, type PipelineStage, type JsonEvent, type PipelineProgress, type PipelineResult, type ResiliencePolicy, type ResumePlan, type StageId, type StageResult, type StageTag } from "./types.js";
 export interface RunPipelineDeps {
     cwd: string;
     signal?: AbortSignal;
@@ -174,5 +175,19 @@ export declare class PipelineStageError extends Error {
     readonly partial: StageResult[];
     constructor(stageId: string, message: string, partial: StageResult[]);
 }
+/**
+ * The resilience policy for a run's stages. With a deadline, a stage that
+ * spent its wall clock spent the build's time: a retry would only get the
+ * floor and run past the deadline, so it fails instead of retrying.
+ */
+export declare function stageRunnerPolicy(budget: RunBudget): ResiliencePolicy;
+/**
+ * The pipeline's default stage runner: `base` under the R1 resilience wrapper
+ * with {@link stageRunnerPolicy}, each stage's wall clock taken from the run's
+ * deadline when it spawns (budget.ts#stageWall). A run with no deadline keeps
+ * the policy's fixed wall clock. Exported so a test can pin the wall a stage
+ * actually gets.
+ */
+export declare function resilientStageRunner(base: RunStageFn, budget: RunBudget, clock: () => number, telemetry: (rec: ResilienceAttemptRecord) => void): RunStageFn;
 export declare function runPipeline(ticket: string, deps: RunPipelineDeps): Promise<PipelineResult>;
 //# sourceMappingURL=orchestrator.d.ts.map

package/dist/extension/pipeline/orchestrator.js

@@ -24,7 +24,7 @@
  * (an aborted/crashed child has empty output, which otherwise parses to zero
  * findings — i.e. a false "reviewed and clean").
  */
-import { addRunUsage, aggregateRunUsage, DEFAULT_RUN_BUDGET, DEFAULT_STAGE_ESTIMATE_MS, EMPTY_RUN_USAGE, exceedsBudget, stageWontFit, } from "./budget.js";
+import { addRunUsage, aggregateRunUsage, DEFAULT_RUN_BUDGET, DEFAULT_STAGE_ESTIMATE_MS, EMPTY_RUN_USAGE, exceedsBudget, stageWall, stageWontFit, } from "./budget.js";
 import { attributeFindings, checkerFindings, composeFixNote, composeResidue, composeSynthesizerInput, mergeFindings, parseOpenFindings, renderFindings, stripOpenFindings, } from "./checker.js";
 import { auditClaims, parsePartition } from "./fanout.js";
 import { extractFindingsBlock, hasBlockingFindings, parseFindings, shouldStop, unionFindings } from "./findings.js";
@@ -188,6 +188,27 @@ async function mapWithConcurrencyLimit(items, concurrency, fn) {
     await Promise.all(workers);
     return results;
 }
+/**
+ * The resilience policy for a run's stages. With a deadline, a stage that
+ * spent its wall clock spent the build's time: a retry would only get the
+ * floor and run past the deadline, so it fails instead of retrying.
+ */
+export function stageRunnerPolicy(budget) {
+    return budget.deadlineMs === undefined ? DEFAULT_RESILIENCE_POLICY : { ...DEFAULT_RESILIENCE_POLICY, retryWallTimeout: false };
+}
+/**
+ * The pipeline's default stage runner: `base` under the R1 resilience wrapper
+ * with {@link stageRunnerPolicy}, each stage's wall clock taken from the run's
+ * deadline when it spawns (budget.ts#stageWall). A run with no deadline keeps
+ * the policy's fixed wall clock. Exported so a test can pin the wall a stage
+ * actually gets.
+ */
+export function resilientStageRunner(base, budget, clock, telemetry) {
+    return withResilience(base, stageRunnerPolicy(budget), {
+        telemetry,
+        wallFor: () => stageWall(budget, DEFAULT_RESILIENCE_POLICY.wallTimeoutMs, clock()),
+    });
+}
 export async function runPipeline(ticket, deps) {
     const log = (event, data) => deps.logger?.(event, data);
     // R1: wrap the real child runner with in-loop resilience (idle/wall timeout +
@@ -195,10 +216,11 @@ export async function runPipeline(ticket, deps) {
     // across its up-to-8 spawns. A caller that injects its own `runStage` (the unit
     // tests, a custom lane) bypasses the wrapper untouched. Per-attempt telemetry
     // rides the existing logger seam, so resume + the checkpoint journal are unaffected.
+    // With a deadline (sandbox / mission runs) each stage's wall clock is the
+    // time left less a reserve for review, a fix and verify, so a live stage is
+    // not killed at a fixed limit the run had room to exceed.
     const runStageFn = deps.runStage ??
-        withResilience(defaultRunStage, DEFAULT_RESILIENCE_POLICY, {
-            telemetry: (rec) => log("resilience_attempt", rec),
-        });
+        resilientStageRunner(defaultRunStage, deps.budget ?? DEFAULT_RUN_BUDGET, deps.now ?? Date.now, (rec) => log("resilience_attempt", rec));
     const snapshotFn = deps.snapshotWorkspace ?? defaultSnapshotWorkspace;
     const runVerifyFn = deps.runVerify ?? makeRunVerify();
     const runWorkstreamCheckFn = deps.runWorkstreamCheck ?? makeWorkstreamCheck();

package/dist/extension/pipeline/resilience.d.ts

@@ -27,6 +27,7 @@
  * Pure-ish: all impurity (timers, sleep, clock, randomness) sits behind injectable
  * seams so the wrapper is unit-tested without real waits.
  */
+import type { StageWallSource } from "./budget.js";
 import type { RunStageDeps } from "./runner.js";
 import { type PipelineStage, type ResiliencePolicy, type ReviewLens, type StageResult } from "./types.js";
 export type { ResiliencePolicy } from "./types.js";
@@ -54,6 +55,13 @@ export interface ResilienceAttemptRecord {
     /** 1-based attempt number. */
     attempt: number;
     outcome: "ok" | "transient" | "fatal" | "timeout" | "aborted";
+    /** The wall clock this attempt was given (ms). */
+    wallTimeoutMs?: number;
+    /**
+     * Where that wall clock came from, when the caller said: the build's time
+     * left, the floor because the deadline was close, or the no-deadline default.
+     */
+    wallSource?: StageWallSource;
     /** Which timer fired, when the attempt timed out. */
     timeoutKind?: "idle" | "wall";
     /** On a timeout: ms the attempt spent with a tool running (the rest went to the model). */
@@ -76,6 +84,16 @@ export interface ResilienceSeams {
 }
 export interface WithResilienceOpts {
     telemetry?: (rec: ResilienceAttemptRecord) => void;
+    /**
+     * The wall clock for one attempt, asked when the attempt spawns so a later
+     * stage (or a retry) gets the time actually left. Absent, every attempt gets
+     * `policy.wallTimeoutMs`. The idle window always comes from the policy.
+     * `source` rides the attempt record as `wallSource`.
+     */
+    wallFor?: (stage: PipelineStage) => {
+        ms: number;
+        source?: StageWallSource;
+    };
     seams?: ResilienceSeams;
 }
 /**

package/dist/extension/pipeline/resilience.js

@@ -163,7 +163,9 @@ export function withResilience(base, policy, opts = {}) {
                 }
                 fireTimeout("idle");
             };
-            const wallTimer = setTimeout(() => fireTimeout("wall"), policy.wallTimeoutMs);
+            const wall = opts.wallFor?.(stage);
+            const wallTimeoutMs = wall?.ms ?? policy.wallTimeoutMs;
+            const wallTimer = setTimeout(() => fireTimeout("wall"), wallTimeoutMs);
             wallTimer.unref?.();
             armIdle();
             const originalOnEvent = deps.onEvent;
@@ -207,6 +209,8 @@ export function withResilience(base, policy, opts = {}) {
                     ...(deps.taskIndex !== undefined ? { taskIndex: deps.taskIndex } : {}),
                     attempt,
                     outcome,
+                    wallTimeoutMs,
+                    ...(wall?.source ? { wallSource: wall.source } : {}),
                     ...(timedOut && timeoutKind ? { timeoutKind } : {}),
                     ...(timedOut ? { toolMs, modelBound } : {}),
                     exitCode: last.exitCode,
@@ -229,7 +233,7 @@ export function withResilience(base, policy, opts = {}) {
             const transient = classifyTransient(last, timedOut);
             // A wall-clock exhaustion is a "task too big" signal, not a stall: a
             // lane that opts out (subagents) fails honestly instead of re-burning
-            // the same 20 minutes per attempt. Idle stalls stay retryable.
+            // the same wall clock per attempt. Idle stalls stay retryable.
             const wallNotRetryable = timedOut && timeoutKind === "wall" && policy.retryWallTimeout === false;
             // No double-apply: a write stage that already started working is never re-run.
             const blockedByWriteGate = isWriteStage && sawAnyEvent;

package/dist/extension/pipeline/types.d.ts

@@ -527,18 +527,21 @@ export interface ResiliencePolicy {
     /**
      * Whether a WALL-clock exhaustion is retryable. Default true (the /go
      * doctrine: a wedged stage is worth another attempt). A lane whose children
-     * run read-only, fast work (subagents) sets false: a 20-minute burn means
-     * the task is too big, and re-running it just multiplies the spend before
+     * run read-only, fast work (subagents) sets false: a full wall-clock burn
+     * means the task is too big, and re-running it just multiplies the spend before
      * the same honest fail. Idle-stall timeouts stay retryable either way.
      */
     retryWallTimeout?: boolean;
 }
 /**
  * Default resilience policy. Generous timeouts so a legitimately long but live
- * stage is never killed (the idle window sits well under the 5-min run heartbeat,
- * and the wall window bounds a truly wedged child); three attempts with short,
- * jittered backoff so a single transient blip across the up-to-8 child spawns no
- * longer terminates the whole run.
+ * stage is never killed: the idle window (well under the 5-min run heartbeat) is
+ * the check for a stuck model, and the wall window only bounds a runaway that
+ * keeps emitting events. The wall is 60 minutes for an interactive /go, where a
+ * person can abort; a run with a deadline replaces it per stage with the time
+ * left (budget.ts#stageWall). Three attempts with short, jittered
+ * backoff so a single transient blip across the up-to-8 child spawns no longer
+ * terminates the whole run.
  */
 export declare const DEFAULT_RESILIENCE_POLICY: ResiliencePolicy;
 /**

package/dist/extension/pipeline/types.js

@@ -17,14 +17,17 @@ export const MAX_REVIEW_ROUNDS = 3;
 export const MAX_FIX_TURNS = 3;
 /**
  * Default resilience policy. Generous timeouts so a legitimately long but live
- * stage is never killed (the idle window sits well under the 5-min run heartbeat,
- * and the wall window bounds a truly wedged child); three attempts with short,
- * jittered backoff so a single transient blip across the up-to-8 child spawns no
- * longer terminates the whole run.
+ * stage is never killed: the idle window (well under the 5-min run heartbeat) is
+ * the check for a stuck model, and the wall window only bounds a runaway that
+ * keeps emitting events. The wall is 60 minutes for an interactive /go, where a
+ * person can abort; a run with a deadline replaces it per stage with the time
+ * left (budget.ts#stageWall). Three attempts with short, jittered
+ * backoff so a single transient blip across the up-to-8 child spawns no longer
+ * terminates the whole run.
  */
 export const DEFAULT_RESILIENCE_POLICY = {
     idleTimeoutMs: 4 * 60_000,
-    wallTimeoutMs: 20 * 60_000,
+    wallTimeoutMs: 60 * 60_000,
     maxAttempts: 3,
     backoffBaseMs: 1_000,
     backoffMaxMs: 30_000,

package/dist/extension/subagents.d.ts

@@ -134,8 +134,9 @@ export interface MakeSubagentToolDeps {
 /**
  * The subagent lane's wall-clock ceiling: two hours per child.
  *
- * The /go stage default (20 minutes) is sized for one pipeline step; a chat
- * subagent is routinely handed a whole review, and at 20 minutes the runner
+ * The /go stage default (20 minutes when this was set, an hour since) is
+ * sized for one pipeline step; a chat subagent is routinely handed a whole
+ * review, and at 20 minutes the runner
  * killed three parallel reviewers mid-report and threw their findings away
  * as "PARTIAL output". The wall clock is not the stall guard — the idle timer
  * (4 minutes, deferred while a tool is in flight) is what catches a hung

package/dist/extension/subagents.js

@@ -465,8 +465,9 @@ const parameters = Type.Object({
 /**
  * The subagent lane's wall-clock ceiling: two hours per child.
  *
- * The /go stage default (20 minutes) is sized for one pipeline step; a chat
- * subagent is routinely handed a whole review, and at 20 minutes the runner
+ * The /go stage default (20 minutes when this was set, an hour since) is
+ * sized for one pipeline step; a chat subagent is routinely handed a whole
+ * review, and at 20 minutes the runner
  * killed three parallel reviewers mid-report and threw their findings away
  * as "PARTIAL output". The wall clock is not the stall guard — the idle timer
  * (4 minutes, deferred while a tool is in flight) is what catches a hung

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yagni-app/code-staging",
-  "version": "1.2.2-staging.1563.1",
+  "version": "1.2.3-staging.1575.1",
   "description": "YAGNI Code: a terminal coding agent that already knows your company. One YAGNI login routes the model and grounds the agent in your team's context.",
   "license": "SEE LICENSE IN LICENSE.md",
   "author": "YAGNI, Inc. <jack@yagni.app> (https://yagni.app)",
@@ -58,5 +58,5 @@
     "turndown": "^7.2.4",
     "typebox": "^1.3.15"
   },
-  "yagniSourceSha": "a55a45e07d5aa97ca696dcf692ec7c6507882a81"
+  "yagniSourceSha": "ce56b0f74cd9190953e1fc22901d340ff765793a"
 }