@yagni-app/code-staging 1.2.6-staging.1952.1 → 1.2.6-staging.1958.1

package/dist/extension/pipeline/types.d.ts

@@ -67,6 +67,33 @@ export interface PipelineStage {
      * claimed files, sibling claims, and the shared-worktree discipline rules.
      */
     personaClause?: string;
+    /**
+     * The persona body this stage runs with, in place of its agent's. The cloud
+     * plan stage takes the host's `plan-persona.md` (Reeve's persona) here.
+     */
+    persona?: string;
+}
+/**
+ * A stage list and the loop rules that go with it. The `full` lane is what
+ * interactive /go and mission builds run; the `cloud` lane is the one-attempt
+ * session (`yagni go --headless --cloud`).
+ */
+export interface PipelineLane {
+    stages: PipelineStage[];
+    /** The review angles fanned out each round; empty is one reviewer covering every angle. */
+    reviewLenses: readonly ReviewLens[];
+    /** Review rounds before the loop stops `round_cap`. */
+    maxReviewRounds: number;
+    /** Whether implement may fan out into parallel builders (the diamond). */
+    fanout: boolean;
+    /** The plan stage ends the run: the plan goes to its gate before anything is built. */
+    stopAfterPlan: boolean;
+    /**
+     * Every stage loads the Team's skills (the launcher's `--skill` /
+     * `--prompt-template` flags), not only the ones that write code: the
+     * cloud session plans and reviews with them too (spec decision 4).
+     */
+    skillsEveryStage: boolean;
 }
 /** A single structured review finding parsed from a reviewer's output. */
 export interface Finding {
@@ -210,6 +237,8 @@ export interface PipelineResult {
      * orchestrator never sets it — commit/push live outside the LLM pipeline).
      */
     finish?: FinishInfo;
+    /** The plan the run wrote, on a lane whose plan stage ends the run (`stopAfterPlan`). */
+    plan?: string;
 }
 /**
  * The append-only resilience journal (spec: 2026-06-29-yagni-code-go-resilience).
@@ -512,6 +541,8 @@ export type PipelineProgress = {
  *  - Round two runs only when round one found a blocker (`shouldStop`); what is
  *    still open after the cap is written into the pull request body under
  *    "Left for review" for Proctor, never a third round.
+ * This is the `full` lane's cap. The cloud lane carries its own
+ * (`PipelineLane.maxReviewRounds`): one reviewer per round, so four rounds.
  */
 export declare const MAX_REVIEW_ROUNDS = 2;
 /**

package/dist/extension/pipeline/types.js

@@ -17,6 +17,8 @@
  *  - Round two runs only when round one found a blocker (`shouldStop`); what is
  *    still open after the cap is written into the pull request body under
  *    "Left for review" for Proctor, never a third round.
+ * This is the `full` lane's cap. The cloud lane carries its own
+ * (`PipelineLane.maxReviewRounds`): one reviewer per round, so four rounds.
  */
 export const MAX_REVIEW_ROUNDS = 2;
 /**

package/dist/extension/pipeline/verify.d.ts

@@ -96,7 +96,33 @@ export interface VerifyOutcome {
     findings: Finding[];
     /** Failures the clean tree already had (YAG-1003): named in `reason`, never findings. */
     preexisting?: number;
+    /** Every command the gate ran, with how it exited (the cloud session's `result.json` checks). */
+    checks?: VerifyCheckRun[];
 }
+/** One command the gate ran, and how it went. */
+export interface VerifyCheckRun {
+    name: string;
+    command: string;
+    /** Where it ran, repo-relative ("." for the root). */
+    cwd: string;
+    /** Null when the command never exited: it timed out, was aborted, or was not found. */
+    exitCode: number | null;
+    durationMs: number;
+    /**
+     * How the check stands on the unchanged code: it already failed there
+     * (the YAG-1003 baseline, or `checks.json`), the sandbox cannot run it, or
+     * neither.
+     */
+    baseline: "runnable" | "fails_on_base" | "cannot_run";
+    /** Why it has no exit code: "timed out", "aborted", "not found" or "could not run". */
+    note?: string;
+}
+/**
+ * Why a command threw instead of exiting, as its check record says it. `run`
+ * is the run's own signal (a /stop or the run's end); `capped` is the one
+ * the command ran under, which also carries its time cap.
+ */
+export declare function unexitedNote(err: unknown, run?: AbortSignal, capped?: AbortSignal): string;
 /** Injectable fs seam so detection is unit-testable without a real repo. */
 export interface DetectOpts {
     readFile?: (path: string) => string;
@@ -404,6 +430,13 @@ export interface MakeRunVerifyOpts {
      * findings. Absent: every failure is a finding, as before.
      */
     baseline?: VerifyBaseline | null;
+    /**
+     * The host's secret and binary scans over what this run added
+     * (changeScan.ts, YAG-1000), given the tree's pre-run dirt to leave out;
+     * null when git could not say what changed. A hit is a finding the fix turn
+     * removes. Absent: no scan half, as before (the cloud session sets it).
+     */
+    scanChange?: (cwd: string, signal?: AbortSignal, baselinePaths?: string[]) => Promise<Finding[] | null>;
 }
 /**
  * One workstream as the scoped checker sees it: the name its findings are

package/dist/extension/pipeline/verify.js

@@ -53,7 +53,7 @@ import { readFileSync } from "node:fs";
 // APIs accept forward-slash paths — while win32 join/dirname would emit
 // backslashed strings that no longer compare equal to the git-derived repoRoot
 // and would break the walk-up termination check.
-import { basename, dirname, join } from "node:path/posix";
+import { basename, dirname, join, relative } from "node:path/posix";
 import { readToolchainFile } from "../toolchain/spawnHook.js";
 import { killTreeSync, trackChild } from "./childRegistry.js";
 import { claimCovers } from "./fanout.js";
@@ -89,6 +89,23 @@ const MAX_LOCATED_FINDINGS = 25;
 const MAX_TAIL_CHARS = 1000;
 /** The verify lens reuses `does_it_hold` (does the change build/test) to avoid widening ReviewLens. */
 const VERIFY_LENS = "does_it_hold";
+/**
+ * Why a command threw instead of exiting, as its check record says it. `run`
+ * is the run's own signal (a /stop or the run's end); `capped` is the one
+ * the command ran under, which also carries its time cap.
+ */
+export function unexitedNote(err, run, capped) {
+    if (run?.aborted)
+        return "aborted";
+    if (capped?.aborted)
+        return "timed out";
+    const shape = err;
+    if (shape?.code === "ENOENT")
+        return "not found";
+    if (shape?.name === "AbortError" || shape?.name === "TimeoutError")
+        return "timed out";
+    return "could not run";
+}
 /**
  * The priority order of package.json scripts we treat as a verify command.
  * Deliberately a SECRET-INDEPENDENT build check (`typecheck`/`lint`), NEVER the
@@ -1168,12 +1185,12 @@ export function makeRunVerify(opts = {}) {
         const steps = jobs.flatMap((job) => job.steps.map((step) => ({ job, step })));
         if (approved.length === 0 && steps.length === 0) {
             report();
-            return { findings, reasons, labels };
+            return { findings, reasons, labels, checks: [] };
         }
         const buildLeft = (opts.repoChecksBuildBudgetMs ?? REPO_CHECKS_BUILD_BUDGET_MS) - repoChecksSpentMs;
         if (buildLeft < REPO_CHECK_MIN_START_MS) {
             reasons.push("approved checks and CI steps not run again: the build's check budget is spent; the host still runs the approved checks after the build");
-            return { findings, reasons, labels };
+            return { findings, reasons, labels, checks: [] };
         }
         const callBudget = Math.min(opts.repoChecksCallBudgetMs ?? REPO_CHECKS_CALL_BUDGET_MS, timeoutMs - (now() - input.callStartedAt), buildLeft);
         const halfStartedAt = now();
@@ -1188,6 +1205,7 @@ export function makeRunVerify(opts = {}) {
             notReached: 0,
             failedJobs,
             approvedFailed: new Set(),
+            checks: [],
         };
         const before = await treeStatus(cwd, signal).catch((err) => {
             const msg = err instanceof Error ? err.message : String(err);
@@ -1221,26 +1239,47 @@ export function makeRunVerify(opts = {}) {
         if (run.notReached > 0) {
             reasons.push(`${run.notReached} approved check(s) or CI step(s) not reached in the gate's time budget; the host still runs the approved checks after the build`);
         }
-        return { findings, reasons, labels };
+        return { findings, reasons, labels, checks: run.checks };
     }
     /** One repository command's verdict: passed, a note (it could not run), or a failure with its output. */
-    async function runRepoCommand(run, command, dir, stepEnv) {
+    async function runRepoCommand(run, command, dir, stepEnv, check) {
         const capMs = Math.min(opts.repoCheckTimeoutMs ?? REPO_CHECK_TIMEOUT_MS, run.left());
         const composed = composeAbortSignal(run.signal, AbortSignal.timeout(Math.max(1, capMs)));
         const env = opts.repoChecksEnv
             ? { ...opts.repoChecksEnv, ...(stepEnv ?? {}) }
             : buildRepoCheckEnv(process.env, run.toolchainFile, stepEnv);
+        const startedAt = now();
         try {
             const { code, output: rawOutput } = await exec(repoCheckArgv(command), dir, composed, env);
-            if (code === 0)
+            const record = (baseline) => run.checks.push({
+                name: check.name,
+                command,
+                cwd: relative(run.cwd, dir) || ".",
+                exitCode: code,
+                durationMs: now() - startedAt,
+                baseline,
+            });
+            if (code === 0) {
+                record(check.baseline);
                 return { kind: "passed" };
+            }
             const output = scrubSecrets(rawOutput);
             const cls = classifyTestFailure(output, code);
+            record(cls.kind === "infra" ? "cannot_run" : check.baseline);
             if (cls.kind === "infra")
                 return { kind: "note", reason: `could not run: ${cls.reason}` };
             return { kind: "failed", output, code };
         }
         catch (err) {
+            run.checks.push({
+                name: check.name,
+                command,
+                cwd: relative(run.cwd, dir) || ".",
+                exitCode: null,
+                durationMs: now() - startedAt,
+                baseline: check.baseline,
+                note: unexitedNote(err, run.signal, composed),
+            });
             const msg = err instanceof Error ? err.message : String(err);
             return { kind: "note", reason: `could not run: ${scrubSecrets(msg)}` };
         }
@@ -1271,7 +1310,10 @@ export function makeRunVerify(opts = {}) {
                 continue;
             }
             const label = check.command.length > 80 ? `${check.command.slice(0, 77)}...` : check.command;
-            const verdict = await runRepoCommand(run, check.command, run.cwd, undefined);
+            const verdict = await runRepoCommand(run, check.command, run.cwd, undefined, {
+                name: label,
+                baseline: check.status,
+            });
             if (verdict.kind === "failed")
                 run.approvedFailed.add(check.command.trim());
             if (verdict.kind === "note") {
@@ -1336,7 +1378,10 @@ export function makeRunVerify(opts = {}) {
             const dir = step.workingDirectory
                 ? join(run.cwd, step.workingDirectory.replace(/^\.\/+/, ""))
                 : run.cwd;
-            const verdict = await runRepoCommand(run, step.run, dir, step.env);
+            const verdict = await runRepoCommand(run, step.run, dir, step.env, {
+                name: `CI ${job.name}: ${step.name}`,
+                baseline: "runnable",
+            });
             if (verdict.kind === "passed") {
                 lastCiFailure.delete(key);
                 run.labels.push(`CI ${job.name}: ${step.name}`);
@@ -1374,7 +1419,7 @@ export function makeRunVerify(opts = {}) {
         // The approved checks carry the plan's approval, not the repository's own
         // choice of how to verify, so an override never takes them out of the loop.
         const repoFile = opts.repoChecks?.() ?? null;
-        if (commands.length === 0 && testCommands.length === 0 && !repoFile) {
+        if (commands.length === 0 && testCommands.length === 0 && !repoFile && !opts.scanChange) {
             return {
                 ran: false,
                 ok: true,
@@ -1391,6 +1436,21 @@ export function makeRunVerify(opts = {}) {
             if (n > 0)
                 preexisting.set(label, (preexisting.get(label) ?? 0) + n);
         };
+        const checks = [];
+        // A detected command's standing on the clean tree, from the baseline run.
+        const standing = (command) => {
+            const counts = opts.baseline?.get(verifyCommandKey(command));
+            return counts && [...counts.values()].some((n) => n > 0) ? "fails_on_base" : "runnable";
+        };
+        const recordCommand = (command, code, startedAt, baseline, note) => checks.push({
+            name: command.label,
+            command: command.argv.join(" "),
+            cwd: relative(cwd, command.cwd) || ".",
+            exitCode: code,
+            durationMs: now() - startedAt,
+            baseline,
+            ...(note ? { note } : {}),
+        });
         // TYPECHECK HALF (frozen behavior, §0.2): run every changed package's build
         // check; union the findings. One package that cannot spawn fails OPEN (a
         // recorded reason, no finding) without sinking the verdict for the packages
@@ -1398,6 +1458,7 @@ export function makeRunVerify(opts = {}) {
         const typecheckLabels = [];
         for (const command of commands) {
             const composed = composeAbortSignal(signal, AbortSignal.timeout(timeoutMs));
+            const startedAt = now();
             try {
                 const { code, output: rawOutput } = await exec(command.argv, command.cwd, composed);
                 const output = scrubSecrets(rawOutput);
@@ -1409,9 +1470,11 @@ export function makeRunVerify(opts = {}) {
                     const infra = classifyVerifyInfraFailure(output, code);
                     if (infra) {
                         reasons.push(`verify (${command.label}) could not run: ${infra}`);
+                        recordCommand(command, code, startedAt, "cannot_run");
                         continue;
                     }
                 }
+                recordCommand(command, code, startedAt, standing(command));
                 anyRan = true;
                 typecheckLabels.push(command.label);
                 if (code !== 0) {
@@ -1422,6 +1485,7 @@ export function makeRunVerify(opts = {}) {
                 }
             }
             catch (err) {
+                recordCommand(command, null, startedAt, standing(command), unexitedNote(err, signal, composed));
                 const msg = err instanceof Error ? err.message : String(err);
                 reasons.push(`verify (${command.label}) could not run: ${scrubSecrets(msg)}`);
             }
@@ -1445,10 +1509,12 @@ export function makeRunVerify(opts = {}) {
                 for (const command of testCommands) {
                     const where = basename(command.cwd) || command.cwd;
                     const composed = composeAbortSignal(signal, AbortSignal.timeout(testTimeoutMs));
+                    const startedAt = now();
                     try {
                         const { code, output: rawOutput } = await exec(command.argv, command.cwd, composed, testEnv);
                         const output = scrubSecrets(rawOutput);
                         const cls = classifyTestFailure(output, code, Number.POSITIVE_INFINITY);
+                        recordCommand(command, code, startedAt, cls.kind === "infra" ? "cannot_run" : standing(command));
                         if (cls.kind === "infra") {
                             reasons.push(`tests (${where}) could not run: ${cls.reason}; 'clean' reflects typecheck + review only`);
                             continue;
@@ -1471,6 +1537,7 @@ export function makeRunVerify(opts = {}) {
                         }
                     }
                     catch (err) {
+                        recordCommand(command, null, startedAt, standing(command), unexitedNote(err, signal, composed));
                         const msg = err instanceof Error ? err.message : String(err);
                         reasons.push(`tests (${where}) could not run: ${scrubSecrets(msg)}`);
                     }
@@ -1495,11 +1562,33 @@ export function makeRunVerify(opts = {}) {
                 });
                 reasons.push(...repo.reasons);
                 repoLabels.push(...repo.labels);
+                checks.push(...repo.checks);
                 if (repo.labels.length > 0)
                     anyRan = true;
                 findings.push(...repo.findings);
             }
         }
+        // SCAN HALF (YAG-1000): what this run added, against the host's own stop
+        // rules, whatever the other halves found: a credential is never the
+        // compile error's root cause, and it must not reach the host.
+        const scanLabels = [];
+        if (opts.scanChange) {
+            try {
+                const hits = await opts.scanChange(cwd, signal, baselinePaths);
+                if (hits === null) {
+                    reasons.push("the secret and binary scan could not read the change; the host still scans it");
+                }
+                else {
+                    anyRan = true;
+                    scanLabels.push("secret and binary scan");
+                    findings.push(...hits.slice(0, MAX_LOCATED_FINDINGS));
+                }
+            }
+            catch (err) {
+                const msg = err instanceof Error ? err.message : String(err);
+                reasons.push(`the secret and binary scan could not run: ${scrubSecrets(msg)}; the host still scans the change`);
+            }
+        }
         const note = preexistingNote(preexisting);
         if (note)
             reasons.push(note);
@@ -1511,6 +1600,7 @@ export function makeRunVerify(opts = {}) {
             ...new Set(typecheckLabels),
             ...new Set(testLabels),
             ...new Set(repoLabels),
+            ...scanLabels,
         ].join(", ");
         if (!anyRan) {
             return {
@@ -1519,6 +1609,7 @@ export function makeRunVerify(opts = {}) {
                 command,
                 reason: reasons.join("; ") || "verify skipped",
                 findings: [],
+                checks,
             };
         }
         return {
@@ -1528,6 +1619,7 @@ export function makeRunVerify(opts = {}) {
             findings,
             ...(reasons.length ? { reason: reasons.join("; ") } : {}),
             ...(preexistingTotal > 0 ? { preexisting: preexistingTotal } : {}),
+            checks,
         };
     };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yagni-app/code-staging",
-  "version": "1.2.6-staging.1952.1",
+  "version": "1.2.6-staging.1958.1",
   "description": "YAGNI Code: a terminal coding agent that already knows your company. One YAGNI login routes the model and grounds the agent in your team's context.",
   "license": "SEE LICENSE IN LICENSE.md",
   "author": "YAGNI, Inc. <jack@yagni.app> (https://yagni.app)",
@@ -58,5 +58,5 @@
     "turndown": "^7.2.4",
     "typebox": "^1.3.15"
   },
-  "yagniSourceSha": "b25d4f380aa71b29777808fe149c71d8d0e3c4ce"
+  "yagniSourceSha": "419ce23e2c9fb464a83e7ffba0f48cdd5238126b"
 }