@yagni-app/code-staging 1.2.6-staging.1973.1 → 1.2.6-staging.1982.1

package/dist/extension/index.js

@@ -47,6 +47,7 @@ import { createEscapeTally } from "./sandbox/escapeTally.js";
 import { createGrantCensus } from "./permission/grantCensus.js";
 import { runsInSandboxHarness, toolchainSpawnHookFromEnv, toolchainUserBashOperations } from "./toolchain/spawnHook.js";
 import { CLOUD_SESSION_ENV } from "./pipeline/cloud.js";
+import { registerStageClock } from "./pipeline/stageClock.js";
 import { registerTelemetry as defaultRegisterTelemetry } from "./telemetry/register.js";
 import { loadHooksConfig, makeHookRunner, registerHooks } from "./hooks.js";
 import { loadPermissionRules } from "./permissionRules/loadConfig.js";
@@ -159,6 +160,10 @@ export async function registerYagni(pi, deps = {}) {
     const fetchCatalog = deps.fetchCatalog ?? defaultFetchCatalog;
     const env = deps.env ?? process.env;
     const evalMode = isEvalMode(env);
+    // A timed /go stage child refuses every tool once its time is up. Order does
+    // not matter: pi runs every tool_call handler until one blocks, and an allow
+    // (a result without `block`) never ends the loop, so this block always lands.
+    registerStageClock(pi, env, now);
     // The grounding settings switch (the judgment-loop kill switch): resolved
     // ONCE at boot from the USER-tier config (default on; a malformed config
     // fails soft to on with a sink warn). Eval mode is its own carve-out and

package/dist/extension/pipeline/orchestrator.js

@@ -1074,6 +1074,13 @@ export async function runPipeline(ticket, deps) {
                 stages.push(r);
                 log("stage_done", { stageId: stage.id, exitCode: r.exitCode, attempt: 2 });
             }
+            // A stage stopped at its own clock (`stageClock.ts`) spent its time
+            // without writing an answer: the run's time budget, not a crash.
+            if (r.timedOut && !deps.signal?.aborted) {
+                log("pipeline_stop", { reason: "budget_exceeded", where: stage.id, detail: "stage_clock" });
+                progress({ kind: "done", stopReason: "budget_exceeded" });
+                return { stages, rounds, stopReason: "budget_exceeded", findings: [], decisionsRecorded };
+            }
             const credit = creditExhaustionReason(r);
             if (isFailed(r)) {
                 const why = credit ??

package/dist/extension/pipeline/personas.js

@@ -67,7 +67,7 @@ Keep it concrete; the worker executes it verbatim.`;
  * `plan-persona.md`. Its output contract rides the stage's task, so a host
  * persona that replaces this body keeps it.
  */
-const CLOUD_PLANNER_ROLE = `You are a planning specialist. You plan one ticket in the repository checked out in your working directory: it is installed, and its commands run. Your plan is what a builder executes, and your questions are what a person answers before anything is built. You do not change files. A fact you can settle by reading or running code is settled, not asked.`;
+const CLOUD_PLANNER_ROLE = `You are a planning specialist. You plan one ticket in the repository checked out in your working directory, by reading it: you run none of its commands. Your plan is what a builder executes, and your questions are what a person answers before anything is built. You do not change files. A fact you can settle by reading code is settled, not asked.`;
 const CLOUD_PLANNER_GROUNDING = `You are grounded. Call ask_yagni before inferring a convention or making any organization- or codebase-specific assumption. To check a fact outside this repository (what is deployed, what the data holds, what a ticket or page says), call team_read with the Team's connected tools before you ask a person.`;
 const CLOUD_PLANNER_FINISH = `Complete the task fully: do not gold-plate, but do not leave it half-done. Finish the job in ONE turn: do not end your turn on an interstitial like "now let me check X". Your FINAL message MUST be the complete plan in the format the task gives. Explore until you can name the files and the steps, then write the plan.`;
 const CLOUD_PLANNER_BODY = [CLOUD_PLANNER_ROLE, CLOUD_PLANNER_GROUNDING, CLOUD_PLANNER_FINISH].join("\n\n");

package/dist/extension/pipeline/runner.d.ts

@@ -96,6 +96,8 @@ export interface RunStageDeps {
     personaBody?: (stage: PipelineStage, opts: {
         grounded?: boolean;
     }) => string;
+    /** The clock a timed stage's deadline is read from; tests inject one. */
+    now?: () => number;
 }
 /**
  * Default per-line stdout ceiling (16 MiB). A legitimate NDJSON event — even one

package/dist/extension/pipeline/runner.js

@@ -29,6 +29,7 @@ import { finalOutputFrom, foldEvent, newEventAccumulator } from "./events.js";
 import { logEvent } from "../errorSink.js";
 import { buildStageInvocation, groundedChildArgv } from "./invocation.js";
 import { personaBody } from "./personas.js";
+import { STAGE_WRAP_UP_AT_ENV, STAGE_WRAP_UP_GRACE_MS } from "./stageClock.js";
 import { clampTier, resolveTierCap } from "./tierCap.js";
 import { PER_TASK_OUTPUT_CAP, } from "./types.js";
 /**
@@ -159,10 +160,17 @@ export async function runStage(stage, ctx, deps) {
         // supplied one — its absence just means this child's completions attribute
         // to the session id alone.
         const callerLabel = deps.callerLabel ?? (ctx.lens ? `go:${stage.id}:${ctx.lens}` : `go:${stage.id}`);
+        // A timed stage (`stageClock.ts`): the child refuses tools from
+        // `wrapUpAt`, and is stopped a grace after it.
+        const wrapUpAt = stage.timeBudgetMs !== undefined && stage.timeBudgetMs > 0
+            ? (deps.now ?? Date.now)() + stage.timeBudgetMs
+            : undefined;
+        let timedOut = false;
         const childEnv = {
             ...envForCap,
             YAGNI_CALLER: callerLabel,
             ...(deps.attribution?.runId ? { YAGNI_RUN_ID: deps.attribution.runId } : {}),
+            ...(wrapUpAt !== undefined ? { [STAGE_WRAP_UP_AT_ENV]: String(wrapUpAt) } : {}),
         };
         // The child uses this exact Node binary. Forward only CA trust, never
         // unrelated parent loaders/inspectors or a flag in inherited NODE_OPTIONS.
@@ -221,10 +229,21 @@ export async function runStage(stage, ctx, deps) {
                 }, 5000);
                 killTimer.unref?.();
             };
+            const clock = wrapUpAt !== undefined && stage.timeBudgetMs !== undefined
+                ? setTimeout(() => {
+                    if (closed)
+                        return;
+                    timedOut = true;
+                    onAbort();
+                }, stage.timeBudgetMs + STAGE_WRAP_UP_GRACE_MS)
+                : undefined;
+            clock?.unref?.();
             const finish = (code) => {
                 closed = true;
                 if (killTimer)
                     clearTimeout(killTimer);
+                if (clock)
+                    clearTimeout(clock);
                 // Detach the abort listener on normal completion so it does not
                 // accumulate on the shared, long-lived pipeline signal across stages.
                 if (signal)
@@ -309,6 +328,8 @@ export async function runStage(stage, ctx, deps) {
             result.errorMessage = acc.errorMessage;
         if (wasAborted)
             result.stopReason = "aborted";
+        if (timedOut)
+            result.timedOut = true;
         if (overlongLinesDropped > 0)
             result.overlongLinesDropped = overlongLinesDropped;
         if (DEBUG_DIR) {

package/dist/extension/pipeline/stageClock.d.ts

@@ -0,0 +1,31 @@
+/**
+ * A stage's own clock (`PipelineStage.timeBudgetMs`). The cloud plan stage
+ * once ran 40 minutes and more building the app, starting its server and
+ * copying the repository to try route layouts (staging, 2026-10-23), with
+ * nothing but the session's 6 hour window to stop it.
+ *
+ * Two halves, the scoping session's shape (PR #1994): the runner hands the
+ * child the moment its time is up (`YAGNI_STAGE_WRAP_UP_AT`, epoch ms on the
+ * sandbox's own clock, which parent and child share), and the child's
+ * extension refuses every tool call from then on with words that tell the
+ * model to write its answer now. A grace later the runner stops the child
+ * (`runner.ts`), and the orchestrator ends the run `budget_exceeded`.
+ */
+import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
+/** The child's env: the epoch millisecond its stage's time is up. */
+export declare const STAGE_WRAP_UP_AT_ENV = "YAGNI_STAGE_WRAP_UP_AT";
+/** The cloud plan stage's time, in minutes. Plans on staging took 8 to 16 minutes. */
+export declare const CLOUD_PLAN_MINUTES = 20;
+/** How long past its time a stage child may take to write its answer before it is stopped. */
+export declare const STAGE_WRAP_UP_GRACE_MS: number;
+/** The refusal a tool call gets once the stage's time is up. */
+export declare const STAGE_TIME_UP_REASON: string;
+/** The epoch millisecond in the env, or undefined for absent or garbage. */
+export declare function stageWrapUpAt(env: NodeJS.ProcessEnv): number | undefined;
+/**
+ * Refuse every tool call once the stage's time is up. Registered by every
+ * pi process the extension loads in; a process whose env carries no time
+ * (every stage but a timed one, and every interactive session) gets nothing.
+ */
+export declare function registerStageClock(pi: Pick<ExtensionAPI, "on">, env: NodeJS.ProcessEnv, now?: () => number): void;
+//# sourceMappingURL=stageClock.d.ts.map

package/dist/extension/pipeline/stageClock.js

@@ -0,0 +1,43 @@
+/**
+ * A stage's own clock (`PipelineStage.timeBudgetMs`). The cloud plan stage
+ * once ran 40 minutes and more building the app, starting its server and
+ * copying the repository to try route layouts (staging, 2026-10-23), with
+ * nothing but the session's 6 hour window to stop it.
+ *
+ * Two halves, the scoping session's shape (PR #1994): the runner hands the
+ * child the moment its time is up (`YAGNI_STAGE_WRAP_UP_AT`, epoch ms on the
+ * sandbox's own clock, which parent and child share), and the child's
+ * extension refuses every tool call from then on with words that tell the
+ * model to write its answer now. A grace later the runner stops the child
+ * (`runner.ts`), and the orchestrator ends the run `budget_exceeded`.
+ */
+/** The child's env: the epoch millisecond its stage's time is up. */
+export const STAGE_WRAP_UP_AT_ENV = "YAGNI_STAGE_WRAP_UP_AT";
+/** The cloud plan stage's time, in minutes. Plans on staging took 8 to 16 minutes. */
+export const CLOUD_PLAN_MINUTES = 20;
+/** How long past its time a stage child may take to write its answer before it is stopped. */
+export const STAGE_WRAP_UP_GRACE_MS = 10 * 60_000;
+/** The refusal a tool call gets once the stage's time is up. */
+export const STAGE_TIME_UP_REASON = "Your time for this stage is up, so no more tools run. Write your final answer now from what you " +
+    "have already read, in the format the task gives. State anything you could not check as an " +
+    "assumption the build verifies.";
+/** The epoch millisecond in the env, or undefined for absent or garbage. */
+export function stageWrapUpAt(env) {
+    const raw = env[STAGE_WRAP_UP_AT_ENV]?.trim();
+    if (!raw || !/^\d+$/.test(raw))
+        return undefined;
+    const value = Number(raw);
+    return Number.isSafeInteger(value) && value > 0 ? value : undefined;
+}
+/**
+ * Refuse every tool call once the stage's time is up. Registered by every
+ * pi process the extension loads in; a process whose env carries no time
+ * (every stage but a timed one, and every interactive session) gets nothing.
+ */
+export function registerStageClock(pi, env, now = Date.now) {
+    const wrapUpAt = stageWrapUpAt(env);
+    if (wrapUpAt === undefined)
+        return;
+    pi.on("tool_call", async () => now() >= wrapUpAt ? { block: true, reason: STAGE_TIME_UP_REASON } : undefined);
+}
+//# sourceMappingURL=stageClock.js.map

package/dist/extension/pipeline/stages.js

@@ -28,6 +28,7 @@
  */
 import { sanitizeCallerSegment } from "../config.js";
 import { builderPersonaClause } from "./personas.js";
+import { CLOUD_PLAN_MINUTES } from "./stageClock.js";
 import { MAX_REVIEW_ROUNDS, } from "./types.js";
 /** The three adversarial review angles, fanned out per round (spec §3). */
 export const REVIEW_LENSES = ["correctness", "business_fit", "does_it_hold"];
@@ -169,21 +170,34 @@ export const PLAN_JSON_CONTRACT = "End your answer with a fenced ```plan-json bl
     '- "decisionsCited" lists only decisions the read returned that the plan relies on. Omit what you do not use.';
 /**
  * The cloud plan stage's task: the input folder the host wrote, read first,
- * then a plan proven on the installed checkout. `inputDir` is the folder the
- * ticket file sits in.
+ * then a plan grounded in the installed checkout, inside the stage's own
+ * clock (`stageClock.ts`). Planning is reading: on staging (2026-10-23) one
+ * plan stage built the app and copied the repository for 40 minutes and more,
+ * and another started Docker and Supabase until the disk was full and then
+ * pruned images to go on. `inputDir` is the folder the ticket file sits in.
  */
 function cloudPlanTask(inputDir) {
     const at = (file) => `${inputDir.replace(/\/+$/, "")}/${file}`;
-    return ("Plan this ticket on the repository checked out in your working directory. It is installed and its " +
-        "commands run. Nothing is built until the plan is approved, so change nothing in the repository.\n\n" +
+    return ("Plan this ticket on the repository checked out in your working directory. Nothing is built or run " +
+        "until the plan is approved, so change nothing in the repository.\n\n" +
+        `You have about ${CLOUD_PLAN_MINUTES} minutes. Past them every tool call is refused and you write the plan ` +
+        "from what you have already read, so read first and write the plan as soon as you can name the files " +
+        "and the steps.\n\n" +
         "Read first:\n" +
         `- ${at("ticket.md")}: the ticket and the evidence behind it. Open every image it names with the read tool.\n` +
         `- ${at("design.md")} and ${at("images")}: the linked design and its frames, when they exist.\n` +
         `- ${at("memo.md")}: what runs in this repository.\n` +
         `- ${at("checks.json")}: the repository's checks, and which already fail on the unchanged code.\n` +
-        `- ${at("playbook.md")}: the Team's planning rules, when it exists. Always follow them.\n` +
-        `- ${at("plan-line.md")}: this Team's instructions for planning, when it exists.\n\n` +
-        "Prove facts by running code here (a check, a test, a script) before you state what the code does. " +
+        `- ${at("playbook.md")}: the Team's planning rules. Always follow them.\n` +
+        `- ${at("plan-line.md")}: this Team's instructions for planning.\n\n` +
+        "Planning is reading code, nothing else. Settle a fact by reading files, grepping, listing folders, and " +
+        "reading the git history and the config. Run no tests and no type checks, build nothing, start no server, " +
+        "no Docker and no database (`supabase start` included), and do not copy the repository: those are the " +
+        "build's, and here they spend the time the plan needs and fill the sandbox's disk. When only running " +
+        "something would settle a fact, state it as an assumption and put the command that settles it in the " +
+        "plan's checks, which the build runs.\n\n" +
+        'If a command fails with "no space left on device", the disk is full: stop there. Do not delete files, ' +
+        "prune Docker or retry. Write the plan and say what you could not check.\n\n" +
         "When the work depends on another repository the ticket's Other repositories section lists, clone it " +
         "read-only on demand with `git clone --filter=blob:none --depth 1` into ~/context/<repo> and read it there.\n\n" +
         `Call team_read with tool "${DECISIONS_READ_TOOL}" before you ask a person anything: a question an earlier ` +
@@ -215,6 +229,7 @@ export function cloudLane(inputDir) {
                 model: "peak",
                 tools: ["read", "grep", "find", "ls", "bash", "ask_yagni", "team_read", "prototype_read"],
                 taskTemplate: cloudPlanTask(inputDir),
+                timeBudgetMs: CLOUD_PLAN_MINUTES * 60_000,
             },
             { ...implementStage(), model: "advanced" },
             reviewStage(),

package/dist/extension/pipeline/types.d.ts

@@ -72,6 +72,13 @@ export interface PipelineStage {
      * plan stage takes the host's `plan-persona.md` (Reeve's persona) here.
      */
     persona?: string;
+    /**
+     * The stage's own clock, in milliseconds (`stageClock.ts`). Past it the
+     * child refuses every tool call, so the model writes its answer from what it
+     * has; a grace later the runner stops the child and the result says
+     * `timedOut`. Absent on every stage but the cloud plan stage.
+     */
+    timeBudgetMs?: number;
 }
 /**
  * A stage list and the loop rules that go with it. The `full` lane is what
@@ -148,6 +155,8 @@ export interface StageResult {
      * whole pipeline. Absent/undefined when nothing was dropped (the normal case).
      */
     overlongLinesDropped?: number;
+    /** Set when the runner stopped the child at its {@link PipelineStage.timeBudgetMs} plus the grace. */
+    timedOut?: boolean;
 }
 /** One round of the bounded review→fix loop. */
 export interface ReviewRound {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yagni-app/code-staging",
-  "version": "1.2.6-staging.1973.1",
+  "version": "1.2.6-staging.1982.1",
   "description": "YAGNI Code: a terminal coding agent that already knows your company. One YAGNI login routes the model and grounds the agent in your team's context.",
   "license": "SEE LICENSE IN LICENSE.md",
   "author": "YAGNI, Inc. <jack@yagni.app> (https://yagni.app)",
@@ -58,5 +58,5 @@
     "turndown": "^7.2.4",
     "typebox": "^1.3.15"
   },
-  "yagniSourceSha": "0cc9459eb25b5a357e700f90b803ff0adf194a0e"
+  "yagniSourceSha": "444aad8e6af41a68786645595b40d828477d3bff"
 }