@yagni-app/code 0.1.0 → 0.2.1

package/dist/extension/crashReport.js

@@ -0,0 +1,241 @@
+/**
+ * Crash reporting for the pi extension: a sanitized, fire-and-forget POST to
+ * the YAGNI backend's /api/yagni-code/crash. No third-party telemetry SDK —
+ * crash reports are the only thing that phones home, they contain no code and
+ * no prompts, and `YAGNI_DISABLE_CRASH_REPORTS=1` turns them off.
+ *
+ * Two report paths use this module:
+ *   - `uncaughtExceptionMonitor` (installed by index.ts): the MONITOR hook is
+ *     chosen deliberately — unlike an `uncaughtException` listener it never
+ *     changes crash semantics in pi's process (which YAGNI does not own); it
+ *     only observes the crash that is already happening. This is also the
+ *     "tool error that indicates a crash, not a user error" discriminator:
+ *     a user-visible tool failure is caught and rendered by pi, while
+ *     anything reaching the monitor was about to kill the session.
+ *   - the /go pipeline's terminal catch (goCommand.ts), where a thrown error
+ *     — not a verdict-shaped failure — ends the run.
+ *
+ * Everything is fail-soft: never throws, never retries, single short-timeout
+ * attempt, and reporting can never affect the user's session.
+ *
+ * The sanitizer (env-value redaction + path collapse + caps around the shared
+ * scrubSecrets patterns) is kept in sync with
+ * `yagni-code-cli/src/crashReport.ts`; the backend re-runs its own copy in
+ * `backend/src/yagniCode/crashReports.ts`. Spec:
+ * docs/superpowers/specs/2026-08-08-crash-reporting-design.md
+ */
+import { spawn } from "node:child_process";
+import { scrubSecrets } from "./pipeline/scrubSecrets.js";
+import { isDesktopSurface } from "./surface.js";
+const defaultSpawn = (command, args, options) => spawn(command, args, options);
+export const CRASH_REPORT_DISABLE_ENV = "YAGNI_DISABLE_CRASH_REPORTS";
+export const CRASH_REPORT_TIMEOUT_MS = 1_500;
+export const MAX_CRASH_MESSAGE = 512;
+export const MAX_CRASH_ERROR_CLASS = 128;
+export const MAX_CRASH_STACK = 8_000;
+export const MAX_CRASH_STACK_FRAMES = 40;
+export const MAX_CRASH_PAYLOAD_BYTES = 16_384;
+/** Same truthiness rule as the CLI's YAGNI_DISABLE_* family. */
+export function crashReportsDisabled(env = process.env) {
+    const value = env[CRASH_REPORT_DISABLE_ENV];
+    return value !== undefined && value !== "" && value !== "0";
+}
+const HOME_DIR_RE = /(?:\/(?:Users|home)\/|[A-Za-z]:\\Users\\)[^\s/\\]+/g;
+// Spaces deliberately allowed inside the token (real directories contain
+// them); prose after a path may fold into the kept basename — over-redacts
+// rather than under-redacts. Keep in sync with the CLI copy.
+const PATH_TOKEN_RE = /(?<![\w.~/\\])(?:~\/|\/|[A-Za-z]:\\)[^\n():'",]+/g;
+const MIN_ENV_VALUE_LENGTH = 8;
+function isPathLikeValue(value) {
+    return value.startsWith("/") || value.startsWith("~") || /^[A-Za-z]:\\/.test(value);
+}
+function collapsePathToken(token) {
+    const nm = token.lastIndexOf("node_modules/");
+    if (nm >= 0)
+        return token.slice(nm);
+    const cut = Math.max(token.lastIndexOf("/"), token.lastIndexOf("\\"));
+    const base = cut >= 0 ? token.slice(cut + 1) : token;
+    return base.length > 0 ? base : token;
+}
+/** Env values → [ENV:NAME], scrubSecrets patterns, ~-collapse, repo-relative, basename. */
+export function sanitizeCrashText(text, opts = {}) {
+    let out = text;
+    const env = opts.env ?? process.env;
+    const entries = Object.entries(env)
+        .filter((entry) => typeof entry[1] === "string" &&
+        entry[1].length >= MIN_ENV_VALUE_LENGTH &&
+        !isPathLikeValue(entry[1]))
+        .sort((a, b) => b[1].length - a[1].length);
+    for (const [name, value] of entries) {
+        if (out.includes(value))
+            out = out.split(value).join(`[ENV:${name}]`);
+    }
+    out = scrubSecrets(out);
+    out = out.replace(HOME_DIR_RE, "~");
+    if (opts.repoRoot) {
+        const root = opts.repoRoot.replace(HOME_DIR_RE, "~").replace(/\/+$/, "");
+        if (root.length > 1)
+            out = out.split(`${root}/`).join("");
+    }
+    out = out.replace(PATH_TOKEN_RE, collapsePathToken);
+    return out;
+}
+/** Reads ONLY name/message/stack; custom error fields are never touched. */
+export function sanitizeCrashError(err, opts = {}) {
+    let errorClass = "Error";
+    let message;
+    let stack;
+    if (err instanceof Error) {
+        errorClass = err.name || "Error";
+        message = err.message;
+        stack = typeof err.stack === "string" ? err.stack : undefined;
+    }
+    else {
+        try {
+            message = String(err);
+        }
+        catch {
+            message = "unstringifiable thrown value";
+        }
+    }
+    const cappedStack = stack !== undefined
+        ? sanitizeCrashText(stack, opts)
+            .split("\n")
+            .slice(0, MAX_CRASH_STACK_FRAMES)
+            .join("\n")
+            .slice(0, MAX_CRASH_STACK)
+        : undefined;
+    return {
+        errorClass: sanitizeCrashText(errorClass, opts).slice(0, MAX_CRASH_ERROR_CLASS),
+        message: sanitizeCrashText(message, opts).slice(0, MAX_CRASH_MESSAGE),
+        ...(cappedStack !== undefined ? { stack: cappedStack } : {}),
+    };
+}
+/**
+ * Build the fail-soft reporter. The extension runs inside pi's process, so
+ * the client label follows the surface: `desktop` under the desktop shell
+ * (YAGNI_SURFACE=desktop), `cli` in the terminal. Version comes from
+ * `YAGNI_CODE_VERSION` (forwarded by the launcher; the bundled extension has
+ * no package.json on disk). Resolves on every outcome; never throws.
+ */
+export function makeCrashReporter(opts) {
+    return async (error, context, repoRoot) => {
+        try {
+            const env = opts.env ?? process.env;
+            if (crashReportsDisabled(env))
+                return;
+            const token = opts.getToken();
+            if (!token)
+                return;
+            const sanitized = sanitizeCrashError(error, { env, repoRoot });
+            const payload = {
+                client: isDesktopSurface() ? "desktop" : "cli",
+                clientVersion: env.YAGNI_CODE_VERSION?.trim() || "unknown",
+                platform: `${process.platform} ${process.arch}`,
+                ...sanitized,
+                ...(context !== undefined ? { context } : {}),
+                timestamp: new Date().toISOString(),
+            };
+            if (JSON.stringify(payload).length > MAX_CRASH_PAYLOAD_BYTES) {
+                delete payload.stack;
+            }
+            const fetchImpl = opts.fetchImpl ?? fetch;
+            const controller = new AbortController();
+            const timer = setTimeout(() => controller.abort(), opts.timeoutMs ?? CRASH_REPORT_TIMEOUT_MS);
+            timer.unref?.();
+            try {
+                await fetchImpl(`${opts.baseUrl.replace(/\/$/, "")}/api/yagni-code/crash`, {
+                    method: "POST",
+                    headers: {
+                        "content-type": "application/json",
+                        authorization: `Bearer ${token}`,
+                    },
+                    body: JSON.stringify(payload),
+                    signal: controller.signal,
+                });
+            }
+            finally {
+                clearTimeout(timer);
+            }
+        }
+        catch {
+            // fail-soft by contract
+        }
+    };
+}
+/**
+ * One-shot sender source for the detached delivery child. A fatal uncaught
+ * exception kills pi's process before any in-process fetch could connect, so
+ * the monitor path hands the (already sanitized) payload to a detached
+ * `node -e` child that survives the parent's death, POSTs once with a hard
+ * timeout, and exits. No retries, nothing written to disk. The payload, URL
+ * and token travel via the child's env — the same channel the launcher
+ * already uses to hand pi its YAGNI_TOKEN.
+ */
+const DETACHED_SENDER_SRC = [
+    "const done = () => process.exit(0);",
+    "setTimeout(done, 5000).unref?.();",
+    "fetch(process.env.YAGNI_CRASH_URL, {",
+    "  method: 'POST',",
+    "  headers: {",
+    "    'content-type': 'application/json',",
+    "    authorization: 'Bearer ' + process.env.YAGNI_CRASH_TOKEN,",
+    "  },",
+    "  body: process.env.YAGNI_CRASH_PAYLOAD,",
+    "  signal: AbortSignal.timeout(4000),",
+    "}).catch(() => {}).finally(done);",
+].join("\n");
+/**
+ * Deliver a crash report from a process that is about to die: build the
+ * sanitized payload in-process (cheap, synchronous), then spawn a detached
+ * one-shot sender that outlives the crash. Never throws.
+ */
+export function reportFatalCrash(error, opts, context) {
+    try {
+        const env = opts.env ?? process.env;
+        if (crashReportsDisabled(env))
+            return;
+        const token = opts.getToken();
+        if (!token)
+            return;
+        const sanitized = sanitizeCrashError(error, { env });
+        const payload = {
+            client: isDesktopSurface() ? "desktop" : "cli",
+            clientVersion: env.YAGNI_CODE_VERSION?.trim() || "unknown",
+            platform: `${process.platform} ${process.arch}`,
+            ...sanitized,
+            ...(context !== undefined ? { context } : {}),
+            timestamp: new Date().toISOString(),
+        };
+        if (JSON.stringify(payload).length > MAX_CRASH_PAYLOAD_BYTES) {
+            delete payload.stack;
+        }
+        const spawnImpl = opts.spawnImpl ?? defaultSpawn;
+        const child = spawnImpl(process.execPath, ["-e", DETACHED_SENDER_SRC], {
+            detached: true,
+            stdio: "ignore",
+            env: {
+                // Minimal env: the sender needs nothing from the parent beyond these.
+                YAGNI_CRASH_URL: `${opts.baseUrl.replace(/\/$/, "")}/api/yagni-code/crash`,
+                YAGNI_CRASH_TOKEN: token,
+                YAGNI_CRASH_PAYLOAD: JSON.stringify(payload),
+            },
+        });
+        child.unref();
+    }
+    catch {
+        // a crash reporter must never add its own crash
+    }
+}
+/**
+ * Observe (never alter) a fatal crash in pi's process. Uses
+ * `uncaughtExceptionMonitor`, which fires before the process dies without
+ * installing a handler that would change node's default crash behavior —
+ * YAGNI does not own pi's process, so crash semantics must stay untouched.
+ */
+export function installUncaughtExceptionMonitor(opts, proc = process) {
+    proc.on("uncaughtExceptionMonitor", (err) => {
+        reportFatalCrash(err, opts, "uncaught-exception");
+    });
+}
+//# sourceMappingURL=crashReport.js.map

package/dist/extension/decisionCapture.d.ts

@@ -0,0 +1,52 @@
+/**
+ * Decision capture at the human gate (spec §4, M3 — conservative).
+ *
+ * When the user picks "Yes, and don't ask again for <tool> in <dir>" at the
+ * review gate, that is a piece of durable judgment worth banking so YAGNI
+ * answers the same question next time instead of interrupting a human. Capture
+ * is deliberately conservative:
+ *
+ *  - HEADLESS never auto-banks (no consent surface; review-mode bless is itself
+ *    fail-closed headless, but this guards regardless).
+ *  - TUI ALWAYS confirms via `ctx.ui.confirm` before banking.
+ *  - DEBOUNCED to at most one capture PROMPT per 10 minutes, so a burst of
+ *    blesses never nags.
+ *
+ * The bank goes through {@link bankDecision} (source `cli_correction`,
+ * idempotency-keyed, spool-durable). Everything is fail-soft: a capture problem
+ * never affects the tool call that triggered it.
+ */
+import { type DecisionClientOpts } from "./decisions.js";
+import type { JudgmentWriteOutcome } from "./spool.js";
+/** At most one capture prompt per this window (spec: 10 minutes). */
+export declare const CAPTURE_DEBOUNCE_MS: number;
+/** The minimal context the capture needs (a subset of pi's ExtensionContext). */
+export interface CaptureCtx {
+    hasUI: boolean;
+    signal?: AbortSignal;
+    ui: {
+        confirm(title: string, message: string): Promise<boolean>;
+        notify(message: string, type?: "info" | "warning" | "error"): void;
+    };
+}
+/** What was blessed: the tool and a human-readable directory label. */
+export interface BlessCaptureInfo {
+    tool: string;
+    dir: string;
+}
+export interface DecisionCapture {
+    /** On a bless-with-remember: debounced, TUI-confirmed decision capture. */
+    captureFromBless(ctx: CaptureCtx, info: BlessCaptureInfo): Promise<void>;
+}
+/** Injectable seams for {@link makeDecisionCapture}. */
+export interface DecisionCaptureDeps extends DecisionClientOpts {
+    now?: () => number;
+    /** Bank implementation (default: {@link bankDecision}); injected in tests. */
+    bank?: (opts: DecisionClientOpts, params: {
+        question: string;
+        decision: string;
+    }, signal?: AbortSignal) => Promise<JudgmentWriteOutcome>;
+}
+/** Build a session-scoped decision capture (holds the debounce timestamp). */
+export declare function makeDecisionCapture(deps: DecisionCaptureDeps): DecisionCapture;
+//# sourceMappingURL=decisionCapture.d.ts.map

package/dist/extension/decisionCapture.js

@@ -0,0 +1,66 @@
+/**
+ * Decision capture at the human gate (spec §4, M3 — conservative).
+ *
+ * When the user picks "Yes, and don't ask again for <tool> in <dir>" at the
+ * review gate, that is a piece of durable judgment worth banking so YAGNI
+ * answers the same question next time instead of interrupting a human. Capture
+ * is deliberately conservative:
+ *
+ *  - HEADLESS never auto-banks (no consent surface; review-mode bless is itself
+ *    fail-closed headless, but this guards regardless).
+ *  - TUI ALWAYS confirms via `ctx.ui.confirm` before banking.
+ *  - DEBOUNCED to at most one capture PROMPT per 10 minutes, so a burst of
+ *    blesses never nags.
+ *
+ * The bank goes through {@link bankDecision} (source `cli_correction`,
+ * idempotency-keyed, spool-durable). Everything is fail-soft: a capture problem
+ * never affects the tool call that triggered it.
+ */
+import { bankDecision } from "./decisions.js";
+/** At most one capture prompt per this window (spec: 10 minutes). */
+export const CAPTURE_DEBOUNCE_MS = 10 * 60 * 1000;
+/** Build a session-scoped decision capture (holds the debounce timestamp). */
+export function makeDecisionCapture(deps) {
+    const now = deps.now ?? (() => Date.now());
+    const bank = deps.bank ?? bankDecision;
+    let lastPromptAt = Number.NEGATIVE_INFINITY;
+    return {
+        async captureFromBless(ctx, info) {
+            // Headless never auto-banks: there is no consent surface.
+            if (!ctx.hasUI)
+                return;
+            // Debounce: hold if we prompted within the window (whatever the answer).
+            const t = now();
+            if (t - lastPromptAt < CAPTURE_DEBOUNCE_MS)
+                return;
+            lastPromptAt = t;
+            const question = `Can the agent run ${info.tool} within ${info.dir} without asking each time?`;
+            const decision = `Yes, ${info.tool} within ${info.dir} is approved for this repository.`;
+            let ok = false;
+            try {
+                ok = await ctx.ui.confirm("Record this as a YAGNI decision?", `You approved ${info.tool} in ${info.dir}. Record it so YAGNI answers the same question next time instead of asking a human?`);
+            }
+            catch {
+                return; // a failed prompt never banks
+            }
+            if (!ok)
+                return;
+            try {
+                const outcome = await bank(deps, { question, decision }, ctx.signal);
+                if (outcome.kind === "ok") {
+                    ctx.ui.notify("Recorded the decision in YAGNI.", "info");
+                }
+                else if (outcome.kind === "spooled") {
+                    ctx.ui.notify("Saved the decision locally; it will sync automatically.", "info");
+                }
+                else {
+                    ctx.ui.notify(outcome.message, "error");
+                }
+            }
+            catch {
+                /* fail-soft: a capture failure never affects the tool call */
+            }
+        },
+    };
+}
+//# sourceMappingURL=decisionCapture.js.map

package/dist/extension/decisions.d.ts

@@ -0,0 +1,83 @@
+/**
+ * The client-side decisions surface (spec §4, W4): the `/decide` and
+ * `/decisions` commands plus the shared write helper the bless-capture flow
+ * reuses.
+ *
+ *  - `bankDecision` POSTs a `source: 'cli_correction'` decision with a generated
+ *    idempotencyKey through the durable write-spool (part A), so a transport
+ *    failure or 5xx spools it for replay instead of losing it, and a replay can
+ *    never double-bank (server dedups on the key).
+ *  - `fetchDecisions` / `supersedeDecision` reuse the shared authed-fetch seam,
+ *    so a GET/PATCH inherits the one 401-refresh-then-retry-once behaviour.
+ *  - `/decide <question> => <decision>` records ONE decision directly (the user
+ *    typed it — explicit intent, no extra confirm or debounce).
+ *  - `/decisions` lists recent decisions (id-prefixed, compact); `/decisions
+ *    supersede <id>` flips one to superseded.
+ *
+ * Formatters and the arg parser are pure; the network calls are injectable via
+ * the shared `SpoolClientOpts` so tests never touch disk or the network.
+ */
+import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
+import { type JudgmentWriteOutcome, type SpoolClientOpts } from "./spool.js";
+/** Transport + idempotency seams for the decisions surface. */
+export interface DecisionClientOpts extends SpoolClientOpts {
+    /** Idempotency-key source (default: crypto.randomUUID); injected in tests. */
+    makeIdempotencyKey?: () => string;
+}
+/** The durable fields banked by `/decide` or a bless-with-remember capture. */
+export interface BankDecisionParams {
+    question: string;
+    decision: string;
+    rationale?: string;
+    repo?: string;
+}
+/**
+ * Bank a `cli_correction` decision durably. Every logical write carries a
+ * generated idempotencyKey; the backend dedups on it, so a spool replay or a
+ * 401 retry can never bank the same decision twice. Transport failures and 5xx
+ * are spooled for replay instead of lost (R4 write half). Never throws.
+ */
+export declare function bankDecision(opts: DecisionClientOpts, params: BankDecisionParams, signal?: AbortSignal): Promise<JudgmentWriteOutcome>;
+/** One row from GET /decisions (mirrors the backend DecisionListItem). */
+export interface DecisionListItem {
+    id: string;
+    question: string;
+    decision: string;
+    rationale: string | null;
+    repoFullName: string | null;
+    source: string;
+    status: string;
+    createdAt: string;
+    citedCount: number;
+}
+/** Options for {@link fetchDecisions}. */
+export interface FetchDecisionsOpts {
+    limit?: number;
+    repo?: string;
+}
+export declare const DEFAULT_LIST_LIMIT = 20;
+/** GET recent decisions (any read scope). Throws a friendly error on non-2xx. */
+export declare function fetchDecisions(opts: DecisionClientOpts, list?: FetchDecisionsOpts, signal?: AbortSignal): Promise<DecisionListItem[]>;
+/**
+ * PATCH one decision to `superseded` (scope yagni_code:write). Idempotent flip,
+ * so a single attempt is enough — no client retry (invariant §0.8). Throws a
+ * friendly error on non-2xx.
+ */
+export declare function supersedeDecision(opts: DecisionClientOpts, id: string, supersededBy?: string, signal?: AbortSignal): Promise<void>;
+/** The parsed `/decide` argument: `<question> => <decision>`. */
+export interface DecideArgs {
+    question: string;
+    decision: string;
+}
+/** Pure: parse `<question> => <decision>`; null when either half is missing. */
+export declare function parseDecideArgs(raw: string): DecideArgs | null;
+/** Pure: a short id prefix for compact display. */
+export declare function shortId(id: string): string;
+/** Pure: render the compact, id-prefixed decisions list (no em-dashes). */
+export declare function formatDecisionsList(items: DecisionListItem[]): string;
+/**
+ * Wire the `/decide` and `/decisions` commands. Both are fail-soft: any
+ * transport error surfaces as an honest notice, never a thrown command.
+ */
+export declare function registerDecisionCommands(pi: ExtensionAPI, opts: DecisionClientOpts): void;
+//# sourceMappingURL=decisions.d.ts.map

package/dist/extension/decisions.js

@@ -0,0 +1,200 @@
+/**
+ * The client-side decisions surface (spec §4, W4): the `/decide` and
+ * `/decisions` commands plus the shared write helper the bless-capture flow
+ * reuses.
+ *
+ *  - `bankDecision` POSTs a `source: 'cli_correction'` decision with a generated
+ *    idempotencyKey through the durable write-spool (part A), so a transport
+ *    failure or 5xx spools it for replay instead of losing it, and a replay can
+ *    never double-bank (server dedups on the key).
+ *  - `fetchDecisions` / `supersedeDecision` reuse the shared authed-fetch seam,
+ *    so a GET/PATCH inherits the one 401-refresh-then-retry-once behaviour.
+ *  - `/decide <question> => <decision>` records ONE decision directly (the user
+ *    typed it — explicit intent, no extra confirm or debounce).
+ *  - `/decisions` lists recent decisions (id-prefixed, compact); `/decisions
+ *    supersede <id>` flips one to superseded.
+ *
+ * Formatters and the arg parser are pure; the network calls are injectable via
+ * the shared `SpoolClientOpts` so tests never touch disk or the network.
+ */
+import { randomUUID } from "node:crypto";
+import { friendlyFetchError, METERED_POST_FETCH_POLICY, resilientFetch } from "./resilientFetch.js";
+import { sendOrSpool } from "./spool.js";
+/**
+ * Bank a `cli_correction` decision durably. Every logical write carries a
+ * generated idempotencyKey; the backend dedups on it, so a spool replay or a
+ * 401 retry can never bank the same decision twice. Transport failures and 5xx
+ * are spooled for replay instead of lost (R4 write half). Never throws.
+ */
+export function bankDecision(opts, params, signal) {
+    const idempotencyKey = (opts.makeIdempotencyKey ?? randomUUID)();
+    return sendOrSpool(opts, "record_decision", "/api/yagni-code/decisions", {
+        question: params.question,
+        decision: params.decision,
+        rationale: params.rationale,
+        repo: params.repo,
+        source: "cli_correction",
+    }, idempotencyKey, signal);
+}
+export const DEFAULT_LIST_LIMIT = 20;
+/** GET recent decisions (any read scope). Throws a friendly error on non-2xx. */
+export async function fetchDecisions(opts, list = {}, signal) {
+    const limit = list.limit ?? DEFAULT_LIST_LIMIT;
+    const query = new URLSearchParams({ limit: String(limit) });
+    if (list.repo)
+        query.set("repo", list.repo);
+    const res = await resilientFetch(`${opts.baseUrl}/api/yagni-code/decisions?${query.toString()}`, { method: "GET", headers: { authorization: `Bearer ${opts.getToken() ?? ""}` } }, { fetchImpl: opts.fetchImpl, signal });
+    if (!res.ok)
+        throw new Error(await friendlyFetchError("list decisions", res));
+    const data = (await res.json());
+    return Array.isArray(data.decisions) ? data.decisions : [];
+}
+/**
+ * PATCH one decision to `superseded` (scope yagni_code:write). Idempotent flip,
+ * so a single attempt is enough — no client retry (invariant §0.8). Throws a
+ * friendly error on non-2xx.
+ */
+export async function supersedeDecision(opts, id, supersededBy, signal) {
+    const res = await resilientFetch(`${opts.baseUrl}/api/yagni-code/decisions/${encodeURIComponent(id)}`, {
+        method: "PATCH",
+        headers: {
+            "content-type": "application/json",
+            authorization: `Bearer ${opts.getToken() ?? ""}`,
+        },
+        body: JSON.stringify({ status: "superseded", ...(supersededBy ? { supersededBy } : {}) }),
+    }, { fetchImpl: opts.fetchImpl, signal, policy: METERED_POST_FETCH_POLICY });
+    if (!res.ok)
+        throw new Error(await friendlyFetchError("supersede decision", res));
+}
+/** Pure: parse `<question> => <decision>`; null when either half is missing. */
+export function parseDecideArgs(raw) {
+    const idx = raw.indexOf("=>");
+    if (idx < 0)
+        return null;
+    const question = raw.slice(0, idx).trim();
+    const decision = raw.slice(idx + 2).trim();
+    if (!question || !decision)
+        return null;
+    return { question, decision };
+}
+/** Pure: a short id prefix for compact display. */
+export function shortId(id) {
+    return id.slice(0, 8);
+}
+/** Pure: render the compact, id-prefixed decisions list (no em-dashes). */
+export function formatDecisionsList(items) {
+    if (items.length === 0) {
+        return "No decisions recorded yet. Use /decide <question> => <decision> to bank one.";
+    }
+    const header = `Recorded decisions (${items.length}):`;
+    const lines = items.map((d) => {
+        const flag = d.status === "active" ? "" : ` [${d.status}]`;
+        const cited = d.citedCount > 0 ? ` (cited ${d.citedCount})` : "";
+        return `${shortId(d.id)}${flag} ${d.question} => ${d.decision}${cited}`;
+    });
+    return [header, ...lines].join("\n");
+}
+/**
+ * Resolve a displayed short-id prefix (or a full id) to the full decision id by
+ * matching against the current list. Returns the full id, the raw arg when no
+ * match is found (let the backend answer an honest 404), or "ambiguous" when
+ * more than one decision shares the prefix. Fail-soft: a list error falls back
+ * to the raw arg.
+ */
+async function resolveDecisionId(opts, arg, signal) {
+    let items = [];
+    try {
+        items = await fetchDecisions(opts, {}, signal);
+    }
+    catch {
+        return arg; // cannot resolve → let the PATCH itself surface the outcome
+    }
+    const matches = items.filter((d) => d.id === arg || d.id.startsWith(arg));
+    if (matches.length === 1)
+        return matches[0].id;
+    if (matches.length > 1)
+        return "ambiguous";
+    return arg;
+}
+/** A friendly one-liner for a bank outcome, or null when nothing to say. */
+function bankOutcomeNotice(outcome) {
+    if (outcome.kind === "ok")
+        return { message: "Recorded the decision in YAGNI.", type: "info" };
+    if (outcome.kind === "spooled") {
+        return {
+            message: `Could not reach YAGNI (${outcome.reason}). Saved the decision locally; it will sync automatically.`,
+            type: "warning",
+        };
+    }
+    return { message: outcome.message, type: "error" };
+}
+/**
+ * Wire the `/decide` and `/decisions` commands. Both are fail-soft: any
+ * transport error surfaces as an honest notice, never a thrown command.
+ */
+export function registerDecisionCommands(pi, opts) {
+    pi.registerCommand("decide", {
+        description: "Record a product-intent decision directly: /decide <question> => <decision>. YAGNI answers the same question next time.",
+        handler: async (args, ctx) => {
+            const notify = (m, t) => {
+                if (ctx.hasUI)
+                    ctx.ui.notify(m, t);
+            };
+            const parsed = parseDecideArgs(args);
+            if (!parsed) {
+                notify("Usage: /decide <question> => <decision>", "warning");
+                return;
+            }
+            try {
+                const outcome = await bankDecision(opts, { question: parsed.question, decision: parsed.decision }, ctx.signal);
+                const notice = bankOutcomeNotice(outcome);
+                notify(notice.message, notice.type);
+            }
+            catch (err) {
+                notify(`Could not record the decision: ${err instanceof Error ? err.message : String(err)}`, "error");
+            }
+        },
+    });
+    pi.registerCommand("decisions", {
+        description: "List recent recorded decisions. /decisions supersede <id> marks one superseded.",
+        handler: async (args, ctx) => {
+            const notify = (m, t) => {
+                if (ctx.hasUI)
+                    ctx.ui.notify(m, t);
+            };
+            const trimmed = args.trim();
+            if (trimmed.toLowerCase().startsWith("supersede")) {
+                const arg = trimmed.slice("supersede".length).trim();
+                if (!arg) {
+                    notify("Usage: /decisions supersede <id>", "warning");
+                    return;
+                }
+                try {
+                    // The list shows short id prefixes, so resolve the argument against
+                    // the current list to the full UUID the backend PATCH requires. A
+                    // failed lookup falls through with the raw arg (the backend then
+                    // answers an honest 404).
+                    const id = await resolveDecisionId(opts, arg, ctx.signal);
+                    if (id === "ambiguous") {
+                        notify(`Ambiguous decision id "${arg}"; use more characters.`, "warning");
+                        return;
+                    }
+                    await supersedeDecision(opts, id, undefined, ctx.signal);
+                    notify(`Superseded decision ${shortId(id)}.`, "info");
+                }
+                catch (err) {
+                    notify(`Could not supersede decision: ${err instanceof Error ? err.message : String(err)}`, "error");
+                }
+                return;
+            }
+            try {
+                const items = await fetchDecisions(opts, {}, ctx.signal);
+                await pi.sendUserMessage(formatDecisionsList(items));
+            }
+            catch (err) {
+                notify(`Could not list decisions: ${err instanceof Error ? err.message : String(err)}`, "error");
+            }
+        },
+    });
+}
+//# sourceMappingURL=decisions.js.map