@yagni-app/code-staging 1.2.3-staging.1632.1 → 1.2.3-staging.1661.1

package/dist/extension/pipeline/budget.d.ts

@@ -10,8 +10,8 @@
  *
  * The turn cap is enforced here via aggregated `usage.turns` (not a pi --max-turns
  * flag, which is unverified in the pi flag set; that is on the upstream-pi
- * wishlist). Ceilings are generous safety bounds, not tight budgets, so a normal
- * run never trips them.
+ * wishlist). Ceilings are generous safety bounds, not tight budgets: they catch
+ * a runaway, not a normal run.
  */
 import type { ReviewRound, StageResult } from "./types.js";
 /** Aggregated usage across a whole run. */
@@ -39,11 +39,21 @@ export interface RunBudget {
     deadlineMs?: number;
 }
 /**
- * Generous default ceilings: a 3-round /go fans out review across 3 lenses on top
- * of the build half, so dozens of turns and millions of tokens are normal; these
- * only catch a runaway. Tunable per lane.
+ * Generous default ceilings for interactive /go: review fans out across 3 lenses
+ * on top of the build half, so hundreds of turns and millions of tokens are
+ * normal; these only catch a runaway. Tunable per lane.
  */
 export declare const DEFAULT_RUN_BUDGET: RunBudget;
+/**
+ * The sandbox lane's ceilings (a run with a deadline). A sandbox build runs
+ * unattended through build, review, fix and review again, and production builds
+ * took up to 532 turns on that normal path (2026-10), so 400 stopped them before
+ * their last review. 1,200 is over twice the worst seen. Cost and tokens keep the
+ * default ceilings, and the build's window and its model capability's request
+ * limit still bound the run; the turn ceiling stays a hard stop for a model that
+ * loops.
+ */
+export declare const SANDBOX_RUN_BUDGET: RunBudget;
 export declare const EMPTY_RUN_USAGE: RunUsage;
 export declare function addRunUsage(a: RunUsage, b: RunUsage): RunUsage;
 /** Sum usage across the build/fix stages AND every review lens result. */

package/dist/extension/pipeline/budget.js

@@ -10,19 +10,32 @@
  *
  * The turn cap is enforced here via aggregated `usage.turns` (not a pi --max-turns
  * flag, which is unverified in the pi flag set; that is on the upstream-pi
- * wishlist). Ceilings are generous safety bounds, not tight budgets, so a normal
- * run never trips them.
+ * wishlist). Ceilings are generous safety bounds, not tight budgets: they catch
+ * a runaway, not a normal run.
  */
 /**
- * Generous default ceilings: a 3-round /go fans out review across 3 lenses on top
- * of the build half, so dozens of turns and millions of tokens are normal; these
- * only catch a runaway. Tunable per lane.
+ * Generous default ceilings for interactive /go: review fans out across 3 lenses
+ * on top of the build half, so hundreds of turns and millions of tokens are
+ * normal; these only catch a runaway. Tunable per lane.
  */
 export const DEFAULT_RUN_BUDGET = {
     maxTurns: 400,
     maxCost: 50,
     maxTokens: 8_000_000,
 };
+/**
+ * The sandbox lane's ceilings (a run with a deadline). A sandbox build runs
+ * unattended through build, review, fix and review again, and production builds
+ * took up to 532 turns on that normal path (2026-10), so 400 stopped them before
+ * their last review. 1,200 is over twice the worst seen. Cost and tokens keep the
+ * default ceilings, and the build's window and its model capability's request
+ * limit still bound the run; the turn ceiling stays a hard stop for a model that
+ * loops.
+ */
+export const SANDBOX_RUN_BUDGET = {
+    ...DEFAULT_RUN_BUDGET,
+    maxTurns: 1_200,
+};
 export const EMPTY_RUN_USAGE = { turns: 0, cost: 0, input: 0, output: 0 };
 export function addRunUsage(a, b) {
     return {

package/dist/extension/pipeline/headlessGo.d.ts

@@ -55,7 +55,8 @@
  * way and pins the implement diamond for a benchmark lane (see fanout.ts).
  * `YAGNI_PIPELINE_TIME_LEFT_MS` (the sandbox host) is the run's time left,
  * anchored to this process's clock at start: the run then stops `budget_exceeded` before a review round or fix it
- * cannot finish, rather than being killed partway through one (see budget.ts).
+ * cannot finish, rather than being killed partway through one (see budget.ts). Such a run gets the sandbox lane's
+ * ceilings (`SANDBOX_RUN_BUDGET`), not interactive /go's.
  */
 import { type TreeSnapshotDeps } from "./treeSnapshot.js";
 import { runPipeline as defaultRunPipeline } from "./orchestrator.js";

package/dist/extension/pipeline/headlessGo.js

@@ -55,7 +55,8 @@
  * way and pins the implement diamond for a benchmark lane (see fanout.ts).
  * `YAGNI_PIPELINE_TIME_LEFT_MS` (the sandbox host) is the run's time left,
  * anchored to this process's clock at start: the run then stops `budget_exceeded` before a review round or fix it
- * cannot finish, rather than being killed partway through one (see budget.ts).
+ * cannot finish, rather than being killed partway through one (see budget.ts). Such a run gets the sandbox lane's
+ * ceilings (`SANDBOX_RUN_BUDGET`), not interactive /go's.
  */
 import { readFileSync } from "node:fs";
 import { continuationResumePlan, parseContinuation } from "./continuation.js";
@@ -67,7 +68,7 @@ import { runPipeline as defaultRunPipeline } from "./orchestrator.js";
 import { loadGroundingEnabled } from "../grounding.js";
 import { codeStateHome } from "../stateHome.js";
 import { parseTierCap, TIER_CAP_ENV } from "./tierCap.js";
-import { DEFAULT_RUN_BUDGET, parsePipelineTimeLeft, PIPELINE_TIME_LEFT_ENV } from "./budget.js";
+import { parsePipelineTimeLeft, PIPELINE_TIME_LEFT_ENV, SANDBOX_RUN_BUDGET } from "./budget.js";
 /** One-line usage copy, shared by every argument error. */
 export const HEADLESS_GO_USAGE = "Usage: yagni go --headless --ticket-file <path> [--plan-file <path>] [--memo-file <path>] [--continue-file <path>] [--run-id <id>] [--cwd <path>] [--json]";
 /**
@@ -272,8 +273,9 @@ export async function runHeadlessGo(argv, deps = {}) {
         writeErr(`Ignoring ${TIER_CAP_ENV}="${rawCap}": not a tier (peak, advanced, standard, efficient). Running uncapped.`);
     }
     // The sandbox host's time left for this run, anchored to THIS process's clock
-    // (the host's may be skewed from the VM's). Absent (every local run, and a
-    // host that predates it) leaves the budget exactly as it was.
+    // (the host's may be skewed from the VM's). Its presence is what makes this a
+    // sandbox run, so it also brings the sandbox lane's ceilings. Absent (every
+    // local run, and a host that predates it) leaves the budget exactly as it was.
     const rawTimeLeft = env[PIPELINE_TIME_LEFT_ENV];
     const timeLeftMs = parsePipelineTimeLeft(rawTimeLeft);
     if (rawTimeLeft?.trim() && timeLeftMs === undefined) {
@@ -282,7 +284,7 @@ export async function runHeadlessGo(argv, deps = {}) {
     const deadlineMs = timeLeftMs === undefined ? undefined : (deps.now ?? Date.now)() + timeLeftMs;
     const budget = deadlineMs === undefined
         ? deps.budget
-        : { ...(deps.budget ?? DEFAULT_RUN_BUDGET), deadlineMs: deps.budget?.deadlineMs ?? deadlineMs };
+        : { ...(deps.budget ?? SANDBOX_RUN_BUDGET), deadlineMs: deps.budget?.deadlineMs ?? deadlineMs };
     const cwd = args.cwd ?? deps.cwd ?? process.cwd();
     const emit = (obj) => write(JSON.stringify(obj));
     const stream = args.json;

package/dist/extension/pipeline/orchestrator.js

@@ -128,6 +128,14 @@ function incompleteHandoff(r) {
  * against stderr/errorMessage only — never a stage's real output.
  */
 const CREDIT_EXHAUSTION_RE = /out of credits|insufficient_quota|payment required|\b402\b/;
+/**
+ * The run-scoped budget shapes: a Run's own approved budget or model-request
+ * limit, which the proxy refuses with a 429 typed `insufficient_quota`. The
+ * workspace can have plenty of credits when this fires, so it is checked first
+ * and never reported as the workspace's credits (production 2026-10-08: a $25
+ * run budget read as "the workspace ran out of credits").
+ */
+const RUN_BUDGET_EXHAUSTION_RE = /run_budget_exhausted|run_request_limit_exhausted|This Run has reached its model-request or approved packet budget|This Run has used its \d+ model requests/;
 /**
  * The silent-402 landmine: when the workspace runs out of credits mid-run, the
  * proxy 402s every model request, the child pi exits 0 with an EMPTY transcript,
@@ -135,12 +143,16 @@ const CREDIT_EXHAUSTION_RE = /out of credits|insufficient_quota|payment required
  * "clean" stop with the real cause buried in stderr. Detect it and stop with an
  * actionable message instead. Gated on the stage having produced no real output
  * (or having failed outright) so a healthy stage whose stderr happens to contain
- * a matching token can never trip it.
+ * a matching token can never trip it. A Run that spent its own budget stops the
+ * same way, with its own message.
  */
 function creditExhaustionReason(r) {
     if (r.finalOutput.trim().length > 0 && !isFailed(r))
         return undefined;
     const hay = `${r.errorMessage ?? ""}\n${r.stderr}`;
+    if (RUN_BUDGET_EXHAUSTION_RE.test(hay)) {
+        return "this run reached its approved budget (the model proxy refused further calls). Raise the Team's run budget or revise the plan, then re-run /go.";
+    }
     if (!CREDIT_EXHAUSTION_RE.test(hay))
         return undefined;
     return "the workspace is out of YAGNI credits (the model proxy returned 402). Top up credits, then re-run /go.";
@@ -1069,6 +1081,13 @@ export async function runPipeline(ticket, deps) {
             log("review_degraded", { round, degradedLenses });
         progress({ kind: "stage_done", stageId: "review", round });
         observedMs.review = clock() - reviewStartedAt;
+        // The verdict first: a clean review is clean and a capped one is capped, even
+        // past a ceiling, since neither spends anything more.
+        const decision = shouldStop(findings, round);
+        if (decision.stop && decision.reason) {
+            stopReason = decision.reason;
+            break;
+        }
         // R3-b: stop honestly if the review fan-out pushed the run over budget, before
         // spending another fix + round. The round's findings are already recorded.
         const overAfterReview = overBudget();
@@ -1077,11 +1096,6 @@ export async function runPipeline(ticket, deps) {
             log("pipeline_stop", { reason: "budget_exceeded", phase: "review", round, detail: overAfterReview });
             break;
         }
-        const decision = shouldStop(findings, round);
-        if (decision.stop && decision.reason) {
-            stopReason = decision.reason;
-            break;
-        }
         // The review's findings are recorded; a fix that cannot finish in time would
         // only leave them half-applied.
         const fixWontFit = wontFit("fix");
@@ -1132,13 +1146,10 @@ export async function runPipeline(ticket, deps) {
         }
         progress({ kind: "stage_done", stageId: "fix", round });
         stageEvent("fix", "finish", { round });
-        // R3-b: stop honestly if this round crossed the budget, before the next round.
-        const overAfterFix = overBudget();
-        if (overAfterFix) {
-            stopReason = "budget_exceeded";
-            log("pipeline_stop", { reason: "budget_exceeded", phase: "fix", round, detail: overAfterFix });
-            break;
-        }
+        // No usage check here: a fix always gets its review, or the run would hand
+        // over a change no review saw. The bound holds anyway: past a ceiling, that
+        // review is the last stage, since the check after it stops the loop (and the
+        // review's own time is still checked at the top of the loop).
         // This whole round (review + fix) completed and the loop will continue, so a
         // crash now can resume at the NEXT round against this fix's output. Snapshot
         // the post-fix tree as the resume consistency key.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yagni-app/code-staging",
-  "version": "1.2.3-staging.1632.1",
+  "version": "1.2.3-staging.1661.1",
   "description": "YAGNI Code: a terminal coding agent that already knows your company. One YAGNI login routes the model and grounds the agent in your team's context.",
   "license": "SEE LICENSE IN LICENSE.md",
   "author": "YAGNI, Inc. <jack@yagni.app> (https://yagni.app)",
@@ -58,5 +58,5 @@
     "turndown": "^7.2.4",
     "typebox": "^1.3.15"
   },
-  "yagniSourceSha": "3275eb7ef2a6e502e47bd2e835aa38bd4fb28b37"
+  "yagniSourceSha": "78db828d4bed8121dd01039b1ee8ef846f2136a7"
 }