@yagni-app/code 0.2.1 → 0.3.1

package/dist/extension/pipeline/childRegistry.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Live child-process registry + exit sweep (the "no orphaned workers" invariant).
+ *
+ * /go stage children and verify children are spawned with raw `node:child_process`
+ * and piped stdio, so nothing in pi tracks them: pi's own shutdown paths
+ * (`/exit`, double Ctrl+C, SIGTERM/SIGHUP) call `process.exit(0)` and would
+ * orphan them into the background, still editing the repo and burning tokens
+ * until their wall-clock timeout fires.
+ *
+ * Every long-lived child is registered here instead. A single `process.on("exit")`
+ * hook (installed lazily on first track) kills whatever is still alive —
+ * `"exit"` handlers must be synchronous, and the whole sweep (including the
+ * `ps`-based descendant walk) is, so this holds on every exit path short of the
+ * pi process itself being SIGKILLed.
+ *
+ * Kills are TREE kills: a verify child like `pnpm test` fans out its own
+ * grandchildren, and killing only the direct pid would orphan those instead.
+ */
+import { type ChildProcess } from "node:child_process";
+/**
+ * PURE: given `ps -A -o pid=,ppid=` output lines, collect every descendant of
+ * the given roots (children, grandchildren, ...), breadth-first.
+ */
+export declare function descendantsOf(roots: number[], psLines: string[]): number[];
+/**
+ * Synchronously SIGKILL a process AND its descendants. POSIX walks a `ps`
+ * snapshot (the tree-kill pattern); Windows has real tree kill via
+ * `taskkill /T /F`. Throw-proof and synchronous, so it is exit-hook safe.
+ * Fail-soft: with no readable snapshot the direct pid is still killed.
+ */
+export declare function killTreeSync(pid: number): void;
+/**
+ * Register a spawned child so the exit sweep covers it. Deregisters itself on
+ * the child's real `close`/`error`, so the set only ever holds live processes.
+ */
+export declare function trackChild(proc: ChildProcess): void;
+/** Test seam: how many children are currently registered. */
+export declare function _liveChildCountForTest(): number;
+/** Test seam: run the sweep as the exit hook would. */
+export declare function _sweepForTest(): void;
+//# sourceMappingURL=childRegistry.d.ts.map

package/dist/extension/pipeline/childRegistry.js

@@ -0,0 +1,118 @@
+/**
+ * Live child-process registry + exit sweep (the "no orphaned workers" invariant).
+ *
+ * /go stage children and verify children are spawned with raw `node:child_process`
+ * and piped stdio, so nothing in pi tracks them: pi's own shutdown paths
+ * (`/exit`, double Ctrl+C, SIGTERM/SIGHUP) call `process.exit(0)` and would
+ * orphan them into the background, still editing the repo and burning tokens
+ * until their wall-clock timeout fires.
+ *
+ * Every long-lived child is registered here instead. A single `process.on("exit")`
+ * hook (installed lazily on first track) kills whatever is still alive —
+ * `"exit"` handlers must be synchronous, and the whole sweep (including the
+ * `ps`-based descendant walk) is, so this holds on every exit path short of the
+ * pi process itself being SIGKILLed.
+ *
+ * Kills are TREE kills: a verify child like `pnpm test` fans out its own
+ * grandchildren, and killing only the direct pid would orphan those instead.
+ */
+import { spawnSync } from "node:child_process";
+const live = new Set();
+let sweepInstalled = false;
+/**
+ * PURE: given `ps -A -o pid=,ppid=` output lines, collect every descendant of
+ * the given roots (children, grandchildren, ...), breadth-first.
+ */
+export function descendantsOf(roots, psLines) {
+    const childrenByParent = new Map();
+    for (const line of psLines) {
+        const m = line.trim().match(/^(\d+)\s+(\d+)$/);
+        if (!m)
+            continue;
+        const pid = Number(m[1]);
+        const ppid = Number(m[2]);
+        const list = childrenByParent.get(ppid) ?? [];
+        list.push(pid);
+        childrenByParent.set(ppid, list);
+    }
+    const found = [];
+    const queue = [...roots];
+    while (queue.length > 0) {
+        const next = queue.shift();
+        for (const child of childrenByParent.get(next) ?? []) {
+            found.push(child);
+            queue.push(child);
+        }
+    }
+    return found;
+}
+/**
+ * Synchronously SIGKILL a process AND its descendants. POSIX walks a `ps`
+ * snapshot (the tree-kill pattern); Windows has real tree kill via
+ * `taskkill /T /F`. Throw-proof and synchronous, so it is exit-hook safe.
+ * Fail-soft: with no readable snapshot the direct pid is still killed.
+ */
+export function killTreeSync(pid) {
+    if (process.platform === "win32") {
+        try {
+            spawnSync("taskkill", ["/pid", String(pid), "/T", "/F"], { stdio: "ignore" });
+        }
+        catch {
+            /* best effort */
+        }
+        return;
+    }
+    let descendants = [];
+    try {
+        const ps = spawnSync("ps", ["-A", "-o", "pid=,ppid="], { encoding: "utf8" });
+        if (ps.status === 0 && typeof ps.stdout === "string") {
+            descendants = descendantsOf([pid], ps.stdout.split("\n"));
+        }
+    }
+    catch {
+        /* no snapshot: fall through to the direct kill */
+    }
+    // Root first so it cannot spawn replacements for the descendants we listed.
+    for (const target of [pid, ...descendants]) {
+        try {
+            process.kill(target, "SIGKILL");
+        }
+        catch {
+            /* already dead */
+        }
+    }
+}
+/** Kill every still-registered child's tree. Synchronous and throw-proof (exit-hook safe). */
+function sweep() {
+    for (const proc of live) {
+        // pid guard: a child whose spawn FAILED has no pid; kill() would resolve
+        // that to pid 0 (the whole process group) and take the parent down too.
+        if (!proc.pid)
+            continue;
+        killTreeSync(proc.pid);
+    }
+    live.clear();
+}
+/**
+ * Register a spawned child so the exit sweep covers it. Deregisters itself on
+ * the child's real `close`/`error`, so the set only ever holds live processes.
+ */
+export function trackChild(proc) {
+    if (!sweepInstalled) {
+        sweepInstalled = true;
+        process.on("exit", sweep);
+    }
+    live.add(proc);
+    const drop = () => live.delete(proc);
+    proc.once("close", drop);
+    proc.once("error", drop);
+}
+/** Test seam: how many children are currently registered. */
+export function _liveChildCountForTest() {
+    return live.size;
+}
+/** Test seam: run the sweep as the exit hook would. */
+export function _sweepForTest() {
+    sweep();
+}
+//# sourceMappingURL=childRegistry.js.map

package/dist/extension/pipeline/finish.js

@@ -28,6 +28,7 @@
  * does not apply.
  */
 import { execFile } from "node:child_process";
+import { trackChild } from "./childRegistry.js";
 import { scrubSecrets } from "./scrubSecrets.js";
 import { parseChangedPaths } from "./verify.js";
 /** Cap on the commit subject's title half (keeps `git log --oneline` readable). */
@@ -42,7 +43,7 @@ const NOTE_TAIL_MAX = 200;
  * a spawn-level error (ENOENT / abort), which callers catch into a note.
  */
 const defaultExec = (argv, cwd, signal) => new Promise((resolve, reject) => {
-    execFile(argv[0], argv.slice(1), { cwd, signal, maxBuffer: 32 * 1024 * 1024 }, (err, stdout, stderr) => {
+    const child = execFile(argv[0], argv.slice(1), { cwd, signal, maxBuffer: 32 * 1024 * 1024 }, (err, stdout, stderr) => {
         const output = `${stdout ?? ""}${stderr ?? ""}`;
         if (err) {
             const code = err.code;
@@ -52,6 +53,9 @@ const defaultExec = (argv, cwd, signal) => new Promise((resolve, reject) => {
         }
         resolve({ code: 0, output });
     });
+    // A push or PR create can run for a while; register it with the exit sweep
+    // so quitting pi mid-FINISH never leaves it running in the background.
+    trackChild(child);
 });
 // ---------------------------------------------------------------------------
 // Pure message derivation

package/dist/extension/pipeline/goCommand.d.ts

@@ -88,7 +88,7 @@ export interface RegisterGoDeps {
      * without a network; a non-identifier arg short-circuits to null (raw arg passes
      * through). Returns null on any miss / transport error (the honest blind fallback).
      */
-    resolveTicketBrief?: (rawArg: string) => Promise<string | null>;
+    resolveTicketBrief?: (rawArg: string, signal?: AbortSignal) => Promise<string | null>;
     /** Injectable worktree creation (default: real `git worktree add -b … HEAD`). */
     createWorktree?: typeof defaultCreateRunWorktree;
     /** Injectable worktree bootstrap (default: best-effort `<pm> install --prefer-offline`). */

package/dist/extension/pipeline/goCommand.js

@@ -75,8 +75,9 @@ import { runFinish as defaultRunFinish, verifyTrailerValue, } from "./finish.js"
 import { GO_USAGE, parseGoArgs } from "./goFlags.js";
 import { registerGoStatusCommands } from "./goStatusCommands.js";
 import { runPipeline as defaultRunPipeline } from "./orchestrator.js";
+import { composeAbortSignal } from "./resilience.js";
 import { planResume } from "./resume.js";
-import { activeRunCount, beginRun, classifyRunLiveness, findActiveRunByTicket, isRunInFlight, isTerminalStatus, lastJournalTs, loadRegistryRows, MAX_CONCURRENT_RUNS, settleRun, trackRunPromise, worktreesDir, } from "./runRegistry.js";
+import { activeRunCount, beginRun, classifyRunLiveness, findActiveRunByTicket, isRunInFlight, isTerminalStatus, lastJournalTs, loadRegistryRows, resolveMaxConcurrentRuns, settleRun, trackRunAbort, trackRunPromise, worktreesDir, } from "./runRegistry.js";
 import { makeRunSession as defaultMakeRunSession } from "./runSession.js";
 import { recordSessionRun } from "../sessionRuns.js";
 import { resolveTicketBrief as defaultResolveTicketBrief } from "./ticketResolution.js";
@@ -426,7 +427,11 @@ export function registerGoCommand(pi, deps = {}) {
     // back to the local client estimate).
     const fetchRunSpend = deps.fetchRunSpend;
     const resolveTicketBrief = deps.resolveTicketBrief ??
-        ((rawArg) => defaultResolveTicketBrief({ baseUrl: deps.baseUrl ?? resolveBaseUrl(), getToken: deps.getToken ?? defaultGetToken }, rawArg));
+        ((rawArg, signal) => defaultResolveTicketBrief({
+            baseUrl: deps.baseUrl ?? resolveBaseUrl(),
+            getToken: deps.getToken ?? defaultGetToken,
+            ...(signal ? { signal } : {}),
+        }, rawArg));
     const reportCrash = deps.reportCrash ??
         makeCrashReporter({
             baseUrl: deps.baseUrl ?? resolveBaseUrl(),
@@ -455,13 +460,15 @@ export function registerGoCommand(pi, deps = {}) {
                 return;
             }
             // In-flight guards: the same ticket never runs twice at once in this
-            // process, and at most MAX_CONCURRENT_RUNS runs are in flight.
+            // process, and at most resolveMaxConcurrentRuns() runs are in flight
+            // (default 3; fleet operators raise it via YAGNI_MAX_CONCURRENT_RUNS).
             if (findActiveRunByTicket(ticket)) {
                 notify(`/go ${ticket} is already running - see /go-status.`, "warning");
                 return;
             }
-            if (activeRunCount() >= MAX_CONCURRENT_RUNS) {
-                notify(`${MAX_CONCURRENT_RUNS} /go runs are already in flight; wait for one to finish (see /go-status).`, "warning");
+            const maxConcurrentRuns = resolveMaxConcurrentRuns();
+            if (activeRunCount() >= maxConcurrentRuns) {
+                notify(`${maxConcurrentRuns} /go runs are already in flight; wait for one to finish (see /go-status) or raise YAGNI_MAX_CONCURRENT_RUNS.`, "warning");
                 return;
             }
             // --- Run tree resolution: worktree by default; --here = legacy in-place.
@@ -830,6 +837,13 @@ export function registerGoCommand(pi, deps = {}) {
                     return undefined;
                 }
             };
+            // The run's OWN abort controller. `ctx.signal` is undefined here (/go only
+            // starts while the agent is idle, and pi's signal is the active turn's), so
+            // without this the pipeline runs unstoppable until its wall-clock timeout.
+            // /stop fires it via the registry (trackRunAbort below); composed with
+            // ctx.signal for the resumed-command case where one does exist.
+            const runAbort = new AbortController();
+            const runSignal = composeAbortSignal(ctx.signal, runAbort.signal);
             const runToCompletion = async () => {
                 try {
                     // Steady animation ticker: keeps the spinner + elapsed clock live between
@@ -843,7 +857,9 @@ export function registerGoCommand(pi, deps = {}) {
                     // the agents plan on the actual ticket, not the bare "YAG-234". Fail-soft:
                     // null keeps the raw arg (the honest blind fallback). The raw `ticket` stays
                     // the session key, the run row's arg, and the handoff/re-run copy.
-                    const ticketBrief = await resolveTicketBrief(ticket);
+                    // Signalled so /stop lands immediately instead of waiting out the
+                    // resolver's retry/timeout budget (up to ~90s of network patience).
+                    const ticketBrief = await resolveTicketBrief(ticket, runSignal);
                     // The plan stage's output, captured off the onStage boundary for the
                     // FINISH commit message's 2-3 sentence summary (absent on a resume).
                     let planText;
@@ -861,9 +877,9 @@ export function registerGoCommand(pi, deps = {}) {
                     catch {
                         /* fail-soft: leave baseline empty */
                     }
-                    const result = await runPipeline(ticket, {
+                    let result = await runPipeline(ticket, {
                         cwd: runCwd,
-                        signal: ctx.signal,
+                        signal: runSignal,
                         ...(ticketBrief ? { ticketBrief } : {}),
                         onProgress: (p) => {
                             feed?.applyProgress(p);
@@ -909,6 +925,12 @@ export function registerGoCommand(pi, deps = {}) {
                         checkpointMeta,
                         ...(resumeFrom ? { resumeFrom } : {}),
                     });
+                    // /stop can land in the race between the pipeline's last abort check
+                    // and its clean return: honor it BEFORE FINISH, so a stopped run never
+                    // starts committing and the promised WIP-preserve path runs instead.
+                    if (result.stopReason === "clean" && runSignal.aborted) {
+                        result = { ...result, stopReason: "aborted" };
+                    }
                     // FINISH stage (spec §3c): ONLY on a clean stop. Commit the run's work
                     // (worktree always; --here only over a clean pre-run baseline) with the
                     // provenance trailer, and push + PR when --pr asked for it. Iron
@@ -939,7 +961,7 @@ export function registerGoCommand(pi, deps = {}) {
                                 openPr: parsed.flags.pr,
                                 remainingFindings: result.findings.filter((f) => f.severity === "medium" || f.severity === "low"),
                                 ...(finishBaselinePaths.length > 0 ? { baselinePaths: finishBaselinePaths } : {}),
-                                ...(ctx.signal ? { signal: ctx.signal } : {}),
+                                signal: runSignal,
                             });
                         }
                         catch (err) {
@@ -972,6 +994,14 @@ export function registerGoCommand(pi, deps = {}) {
                         }
                     }
                     clearUI();
+                    // /stop DURING FINISH: the abort degrades FINISH mid-way (its execs
+                    // share runSignal). If no commit landed, the aborted status + WIP
+                    // preservation the user was promised win over "clean"; a commit that
+                    // DID land means the work is durable and the clean report stays honest.
+                    if (result.stopReason === "clean" && runSignal.aborted && !finish?.commitSha) {
+                        result = { ...result, stopReason: "aborted" };
+                        finish = undefined;
+                    }
                     // Fold what FINISH landed onto a NEW result (never mutate the pipeline's
                     // return). `finish` is present ONLY when a commit really happened (§0.1).
                     const finishBranch = finish?.branch ?? repoCtx.branch;
@@ -1049,6 +1079,7 @@ export function registerGoCommand(pi, deps = {}) {
                 }
             };
             beginRun(registryRow);
+            trackRunAbort(runId, runAbort);
             if (parsed.flags.fg) {
                 // --fg: the legacy blocking behavior — the prompt returns when the run does.
                 await runToCompletion();

package/dist/extension/pipeline/goStatusCommands.d.ts

@@ -44,7 +44,17 @@ export interface RegisterGoStatusDeps {
     resolveRepo?: (cwd: string, signal?: AbortSignal) => Promise<string | undefined>;
     exists?: (path: string) => boolean;
     now?: () => number;
+    /** Injectable cancel seams for /stop (default: the module-scoped registry). */
+    activeRows?: () => RunRegistryRow[];
+    cancelOne?: (runId: string) => RunRegistryRow | undefined;
+    cancelAll?: () => RunRegistryRow[];
 }
+/**
+ * PURE: resolve a /stop argument against the in-flight rows. Matches the ticket
+ * (case-insensitive exact) first, then a runId prefix of at least 4 chars (the
+ * short id /go-status prints is 8).
+ */
+export declare function matchStopTarget(rows: RunRegistryRow[], arg: string): RunRegistryRow | undefined;
 /**
  * PURE: where an in-flight/interrupted run got to, read off its checkpoint
  * journal. The journal is append-only, so the latest applicable boundary wins.

package/dist/extension/pipeline/goStatusCommands.js

@@ -22,9 +22,25 @@
  */
 import { existsSync } from "node:fs";
 import { makeFileCheckpointStore } from "./checkpoint.js";
-import { classifyRunLiveness, isRunInFlight, isTerminalStatus, lastJournalTs, loadRegistryRows, settleRun, } from "./runRegistry.js";
+import { activeRunRows, cancelActiveRuns, cancelRun, classifyRunLiveness, isRunInFlight, isTerminalStatus, lastJournalTs, loadRegistryRows, settleRun, } from "./runRegistry.js";
 import { removeWorktree as defaultRemoveWorktree } from "./worktree.js";
 import { snapshotWorkspace as defaultSnapshotWorkspace } from "./workspace.js";
+/**
+ * PURE: resolve a /stop argument against the in-flight rows. Matches the ticket
+ * (case-insensitive exact) first, then a runId prefix of at least 4 chars (the
+ * short id /go-status prints is 8).
+ */
+export function matchStopTarget(rows, arg) {
+    const needle = arg.trim().toLowerCase();
+    if (!needle)
+        return undefined;
+    const byTicket = rows.find((r) => r.ticket.toLowerCase() === needle);
+    if (byTicket)
+        return byTicket;
+    if (needle.length < 4)
+        return undefined;
+    return rows.find((r) => r.runId.toLowerCase().startsWith(needle));
+}
 /**
  * PURE: where an in-flight/interrupted run got to, read off its checkpoint
  * journal. The journal is append-only, so the latest applicable boundary wins.
@@ -90,6 +106,50 @@ export function registerGoStatusCommands(pi, deps = {}) {
     const resolveRepo = deps.resolveRepo ?? (async () => undefined);
     const exists = deps.exists ?? existsSync;
     const now = deps.now ?? Date.now;
+    const activeRows = deps.activeRows ?? activeRunRows;
+    const cancelOne = deps.cancelOne ?? cancelRun;
+    const cancelAll = deps.cancelAll ?? cancelActiveRuns;
+    pi.registerCommand("stop", {
+        description: "Hard-stop /go runs in this session: /stop cancels them all, /stop <ticket|run id> cancels one. Work so far is preserved as a WIP commit.",
+        handler: async (args, ctx) => {
+            const say = async (message, type = "info") => {
+                if (ctx.hasUI)
+                    ctx.ui.notify(message, type);
+                else
+                    await pi.sendUserMessage(message);
+            };
+            const label = (row) => `[${row.runId.slice(0, 8)}] ${row.ticket}`;
+            const rows = activeRows();
+            if (rows.length === 0) {
+                await say("No /go runs are in flight in this session. (Esc interrupts the interactive agent; /go-status lists runs from other sessions.)");
+                return;
+            }
+            const arg = args.trim();
+            if (arg) {
+                const target = matchStopTarget(rows, arg);
+                if (!target) {
+                    await say(`No in-flight run matches "${arg}". Running here: ${rows.map(label).join(", ")}.`, "warning");
+                    return;
+                }
+                if (!cancelOne(target.runId)) {
+                    await say(`${label(target)} is still starting and cannot be signalled yet; try /stop again.`, "warning");
+                    return;
+                }
+                await say(`Stopping ${label(target)}. Its workers are being killed; any work lands as a WIP commit and the handoff will report the aborted run.`);
+                return;
+            }
+            const cancelled = cancelAll();
+            if (cancelled.length === 0) {
+                // The window between beginRun and trackRunAbort is one tick wide, but be
+                // honest if we hit it rather than claiming a stop that did not fire.
+                await say("Could not signal any run yet (they are still starting); try /stop again.", "warning");
+                return;
+            }
+            await say(`Stopping ${cancelled.length} /go run${cancelled.length === 1 ? "" : "s"}: ${cancelled
+                .map(label)
+                .join(", ")}. Workers are being killed; work so far lands as WIP commits (see /go-status).`);
+        },
+    });
     pi.registerCommand("go-status", {
         description: "List /go runs: active (stage/round), finished (outcome + branch/commit/PR), and interrupted (resumable).",
         handler: async (_args, ctx) => {

package/dist/extension/pipeline/personas.js

@@ -57,7 +57,7 @@ Budget discipline: you have a hard output budget, and a plan that gets cut off m
 Keep it concrete; the worker executes it verbatim.`;
 const WORKER_BODY = `You are a worker with full capabilities, operating in an isolated context to implement a plan. Work autonomously and use the tools as needed.
 
-You are grounded. Call ask_yagni before guessing about anything organization- or codebase-specific. Critically: for ANY product-intent call you are forced to make that the plan did not settle — a behavior choice, a tradeoff, an interpretation of intent — call record_decision so the company's decision corpus captures it and the next agent inherits the call instead of re-litigating it.
+You are grounded. Call ask_yagni before guessing about anything organization- or codebase-specific. Treat a confirmed answer as settled; when an answer is an unverified assumption or an inference and your change leans on it, say so in your Notes so the reviewer knows what to check. Critically: for ANY product-intent call you are forced to make that the plan did not settle — a behavior choice, a tradeoff, an interpretation of intent — call record_decision so the company's decision corpus captures it and the next agent inherits the call instead of re-litigating it. When ask_yagni reports no recorded position, follow its instruction and record the assumption you proceed on.
 
 You MUST make the change. If the plan is missing, partial, or appears cut off, do not stop at exploring: implement the ticket directly from the ticket text and the code, calling record_decision for any intent you infer. Ending your turn with no write/edit is a failure.
 
@@ -95,6 +95,29 @@ The reasoning, grounded in what you actually read. Cite files and lines.
 The specific evidence that would flip this. If you were not able to verify something load-bearing, say so here rather than hedging the recommendation.
 
 Be terse and decisive. The caller is mid-task and paying peak rates for your turn.`;
+const GUARDIAN_BODY = `You are a safety reviewer. You review shell commands before they run and decide one of three outcomes: allow, ask, or deny. You may read files for context (a script the command runs, a config it touches) but you never write or execute anything. Your final output is ONLY a JSON verdict — no prose around it.
+
+Risk taxonomy:
+- Data exfiltration: sensitive data sent to untrusted destinations. High risk.
+- Credential probing: extracting credentials from unintended sources (browser profiles, logs, env files). High risk.
+- Persistent security weakening: broad or production-impact security changes. High risk.
+- Destructive actions: irreversible data loss, production breaks, broad git cleanup. High risk.
+- Low-risk actions: benign local reads, routine dev-loop operations (build, test, lint, install), operations clearly part of the stated task. Low risk.
+
+Outcome rules:
+- "deny" is reserved for actions you are VERY CONFIDENT are very dangerous: irreversible destruction, exfiltration of sensitive data, credential probing, production-impacting security weakening. If you are not sure it is that bad, do not deny.
+- "allow" when you are confident the action is safe: read-only, routine dev-loop, or clearly scoped and reversible.
+- "ask" for everything in between — the action might be fine but a human should decide. This is the correct outcome whenever your confidence is middling; prefer ask over deny for anything short of the very-dangerous bar, and prefer allow over ask for routine work (do not hedge routine commands into ask).
+
+Rationale rules:
+- For "ask", the rationale MUST be a specific question addressed to the user, naming the concrete effect that made you unsure — e.g. "This pushes 3 commits to the shared main branch — do you want to publish them now?". You may be told why the static policy routed the command to you; your rationale must ADD information beyond that policy text, not restate it.
+- For "deny", one sentence naming the irreversible/dangerous effect.
+- For "allow", one short sentence.
+
+Output ONLY a JSON object with this exact shape:
+{"outcome":"allow"|"ask"|"deny","riskLevel":"low"|"medium"|"high"|"critical","rationale":"see rationale rules"}
+
+Do not output anything else after the JSON. No markdown fences, only the JSON object.`;
 /** Persona body keyed by the agent name referenced in `stages.ts`. */
 export const PERSONA_BODIES = {
     scout: SCOUT_BODY,
@@ -102,6 +125,7 @@ export const PERSONA_BODIES = {
     worker: WORKER_BODY,
     reviewer: REVIEWER_BODY,
     advisor: ADVISOR_BODY,
+    guardian: GUARDIAN_BODY,
 };
 /**
  * Grounding-FREE persona bodies for the M6 grounded-vs-blind eval ONLY. These are
@@ -192,6 +216,7 @@ export const BLIND_PERSONA_BODIES = {
     worker: WORKER_BLIND,
     reviewer: REVIEWER_BLIND,
     advisor: ADVISOR_BLIND,
+    guardian: GUARDIAN_BODY,
 };
 /** The lens-specific clause appended to the reviewer body, one per review angle. */
 const LENS_CLAUSES = {

package/dist/extension/pipeline/resilience.d.ts

@@ -4,7 +4,8 @@
  * `withResilience(runStage, policy)` is a composable higher-order function that
  * wraps the per-stage child spawn (`runner.ts#runStage`) with the one axis the
  * roadmap calls the whole competitive gap: a per-stage IDLE timeout (no NDJSON
- * event for N ms) and a total WALL-CLOCK timeout, both firing the runner's
+ * event for N ms, deferred while a tool is in flight — see the stall note at
+ * the timer wiring) and a total WALL-CLOCK timeout, both firing the runner's
  * existing SIGTERM -> SIGKILL abort; bounded exponential backoff with jitter; and
  * retry of CLASSIFIED-TRANSIENT outcomes only. One structured telemetry record is
  * emitted per attempt.

package/dist/extension/pipeline/resilience.js

@@ -4,7 +4,8 @@
  * `withResilience(runStage, policy)` is a composable higher-order function that
  * wraps the per-stage child spawn (`runner.ts#runStage`) with the one axis the
  * roadmap calls the whole competitive gap: a per-stage IDLE timeout (no NDJSON
- * event for N ms) and a total WALL-CLOCK timeout, both firing the runner's
+ * event for N ms, deferred while a tool is in flight — see the stall note at
+ * the timer wiring) and a total WALL-CLOCK timeout, both firing the runner's
  * existing SIGTERM -> SIGKILL abort; bounded exponential backoff with jitter; and
  * retry of CLASSIFIED-TRANSIENT outcomes only. One structured telemetry record is
  * emitted per attempt.
@@ -100,19 +101,37 @@ export function withResilience(base, policy, opts = {}) {
                 if (!timeoutController.signal.aborted)
                     timeoutController.abort();
             };
+            // Tools the child has started but not finished. The idle window measures
+            // STALL, not silence: a long quiet tool (a 6-minute test suite, a slow
+            // build) emits no NDJSON between its start and end events, and that is
+            // progress, not a hang. While a tool is in flight the idle expiry defers
+            // and re-arms instead of aborting; the wall-clock timer stays the
+            // backstop for a tool that is genuinely hung.
+            let inFlightTools = 0;
             let idleTimer;
             const armIdle = () => {
                 if (idleTimer)
                     clearTimeout(idleTimer);
-                idleTimer = setTimeout(fireTimeout, policy.idleTimeoutMs);
+                idleTimer = setTimeout(fireIdle, policy.idleTimeoutMs);
                 idleTimer.unref?.();
             };
+            const fireIdle = () => {
+                if (inFlightTools > 0) {
+                    armIdle();
+                    return;
+                }
+                fireTimeout();
+            };
             const wallTimer = setTimeout(fireTimeout, policy.wallTimeoutMs);
             wallTimer.unref?.();
             armIdle();
             const originalOnEvent = deps.onEvent;
             const onEvent = (ev) => {
                 sawAnyEvent = true;
+                if (ev.type === "tool_execution_start")
+                    inFlightTools += 1;
+                else if (ev.type === "tool_execution_end")
+                    inFlightTools = Math.max(0, inFlightTools - 1);
                 armIdle(); // reset the idle window on every live event
                 originalOnEvent?.(ev);
             };

package/dist/extension/pipeline/runRegistry.d.ts

@@ -22,8 +22,16 @@
  * candidate).
  */
 import type { CheckpointRecord, StopReason } from "./types.js";
-/** Bound on simultaneously in-flight /go runs in one process (spec §3b). */
+/** Default bound on simultaneously in-flight /go runs in one process (spec §3b). */
 export declare const MAX_CONCURRENT_RUNS = 3;
+/** Hard ceiling for the env override — a typo must not launch hundreds of runs. */
+export declare const MAX_CONCURRENT_RUNS_CEILING = 32;
+/**
+ * Resolve the in-flight /go cap from the environment. `YAGNI_MAX_CONCURRENT_RUNS`
+ * raises (or lowers) the default for fleet-scale operators; non-numeric or < 1
+ * falls back to the default, and anything above the ceiling clamps to it.
+ */
+export declare function resolveMaxConcurrentRuns(env?: Record<string, string | undefined>): number;
 /**
  * A non-terminal row whose journal has been quiet this long is treated as
  * INTERRUPTED (its process died) rather than still running elsewhere. Sits
@@ -85,6 +93,20 @@ export declare function _resetRunRegistryForTest(): void;
 export declare function beginRun(row: RunRegistryRow): void;
 /** Attach the detached completion promise to an in-flight run (fail-soft no-op when absent). */
 export declare function trackRunPromise(runId: string, promise: Promise<void>): void;
+/** Attach the run's abort controller so /stop can cancel it (fail-soft no-op when absent). */
+export declare function trackRunAbort(runId: string, abort: AbortController): void;
+/**
+ * Cancel one in-flight run in THIS process: fire its abort controller and return
+ * its row. The run itself settles through the normal pipeline path (the abort
+ * propagates to every stage child as SIGTERM→SIGKILL, the orchestrator stops with
+ * an honest `aborted`, and runToCompletion preserves WIP + settles the registry).
+ * Returns undefined for an unknown/foreign runId or a run with no controller yet.
+ */
+export declare function cancelRun(runId: string): RunRegistryRow | undefined;
+/** Cancel EVERY in-flight run in this process (the /stop no-arg path). Returns the rows fired. */
+export declare function cancelActiveRuns(): RunRegistryRow[];
+/** The in-flight rows in THIS process (newest first), for /stop's matching + messaging. */
+export declare function activeRunRows(): RunRegistryRow[];
 /**
  * Settle an in-flight run: merge the terminal patch, drop it from the in-memory
  * active set, and mirror the final row. Safe to call for an unknown runId: the

package/dist/extension/pipeline/runRegistry.js

@@ -24,8 +24,22 @@
 import { appendFileSync, mkdirSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import { codeStateHome } from "../stateHome.js";
-/** Bound on simultaneously in-flight /go runs in one process (spec §3b). */
+/** Default bound on simultaneously in-flight /go runs in one process (spec §3b). */
 export const MAX_CONCURRENT_RUNS = 3;
+/** Hard ceiling for the env override — a typo must not launch hundreds of runs. */
+export const MAX_CONCURRENT_RUNS_CEILING = 32;
+/**
+ * Resolve the in-flight /go cap from the environment. `YAGNI_MAX_CONCURRENT_RUNS`
+ * raises (or lowers) the default for fleet-scale operators; non-numeric or < 1
+ * falls back to the default, and anything above the ceiling clamps to it.
+ */
+export function resolveMaxConcurrentRuns(env = process.env) {
+    const raw = env.YAGNI_MAX_CONCURRENT_RUNS?.trim();
+    const parsed = raw ? Number.parseInt(raw, 10) : NaN;
+    if (!Number.isFinite(parsed) || parsed < 1)
+        return MAX_CONCURRENT_RUNS;
+    return Math.min(parsed, MAX_CONCURRENT_RUNS_CEILING);
+}
 /**
  * A non-terminal row whose journal has been quiet this long is treated as
  * INTERRUPTED (its process died) rather than still running elsewhere. Sits
@@ -106,6 +120,13 @@ const active = new Map();
 export function _resetRunRegistryForTest() {
     active.clear();
 }
+// NOTE on growth: the mirror is append-only and grows without bound on a
+// long-lived install. In-place compaction was reviewed and REMOVED (PR #1698):
+// a fold+rewrite without cross-process exclusion can permanently erase another
+// process's terminal settle (nothing ever re-appends a final row), which would
+// resurrect a finished run as "interrupted" and invite duplicate worktree
+// adoption. Compaction needs an inter-process lock + unique temp files —
+// tracked separately; until then, growth is the safe failure mode.
 /** Fail-soft append of one full row to the mirror (self-heals a torn previous write). */
 function appendRow(row) {
     try {
@@ -137,6 +158,41 @@ export function trackRunPromise(runId, promise) {
     if (entry)
         entry.promise = promise;
 }
+/** Attach the run's abort controller so /stop can cancel it (fail-soft no-op when absent). */
+export function trackRunAbort(runId, abort) {
+    const entry = active.get(runId);
+    if (entry)
+        entry.abort = abort;
+}
+/**
+ * Cancel one in-flight run in THIS process: fire its abort controller and return
+ * its row. The run itself settles through the normal pipeline path (the abort
+ * propagates to every stage child as SIGTERM→SIGKILL, the orchestrator stops with
+ * an honest `aborted`, and runToCompletion preserves WIP + settles the registry).
+ * Returns undefined for an unknown/foreign runId or a run with no controller yet.
+ */
+export function cancelRun(runId) {
+    const entry = active.get(runId);
+    if (!entry?.abort)
+        return undefined;
+    entry.abort.abort();
+    return entry.row;
+}
+/** Cancel EVERY in-flight run in this process (the /stop no-arg path). Returns the rows fired. */
+export function cancelActiveRuns() {
+    const cancelled = [];
+    for (const entry of active.values()) {
+        if (!entry.abort)
+            continue;
+        entry.abort.abort();
+        cancelled.push(entry.row);
+    }
+    return cancelled;
+}
+/** The in-flight rows in THIS process (newest first), for /stop's matching + messaging. */
+export function activeRunRows() {
+    return [...active.values()].map((e) => e.row).sort((a, b) => b.startedAt - a.startedAt);
+}
 /**
  * Settle an in-flight run: merge the terminal patch, drop it from the in-memory
  * active set, and mirror the final row. Safe to call for an unknown runId: the