@yagni-app/code 0.3.0 → 0.3.2

package/dist/extension/footer.js

@@ -41,11 +41,20 @@
 import { spawnSync } from "node:child_process";
 import { statSync } from "node:fs";
 import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
-import { truncateToWidth, visibleWidth } from "@earendil-works/pi-tui";
+import { matchesKey, truncateToWidth, visibleWidth } from "@earendil-works/pi-tui";
 export const BRANCH_MAX_WIDTH = 60;
 const WORKTREE_MAX_WIDTH = 30;
 /** Section separator: single space + middle dot + single space. */
 const SEP = " · ";
+const MODE_CYCLE = ["auto", "review", "plan"];
+export function cyclePermissionMode(current) {
+    const idx = MODE_CYCLE.indexOf(current);
+    return MODE_CYCLE[(idx + 1) % MODE_CYCLE.length];
+}
+export function isShiftTab(data) {
+    return matchesKey(data, "shift+tab");
+}
+export const GIT_MUTATING_PATTERN = /\bgit\s+(?:checkout|switch|branch|worktree|reset|restore|rebase|merge|cherry-pick|bisect)\b/;
 /** Default horizontal pad when the launcher didn't forward one (matches outputPad=1). */
 const DEFAULT_PAD_X = 1;
 /**
@@ -107,10 +116,10 @@ export function collectUsage(sessionManager) {
     return totals;
 }
 /** End-cut ellipsis truncation (ANSI-aware) so the branch prefix stays readable. */
-function truncateEnd(text, maxWidth) {
+function truncateEnd(text, maxWidth, ellipsis = "…") {
     if (visibleWidth(text) <= maxWidth)
         return text;
-    return truncateToWidth(text, maxWidth, "…");
+    return truncateToWidth(text, maxWidth, ellipsis);
 }
 function runGit(args, cwd) {
     try {
@@ -193,15 +202,23 @@ export function detectGitInfo(cwd, home) {
     const worktree = resolveWorktreeLabel(root, branch);
     return { folder: basename(gitMainRepoRoot(root)), inRepo: true, branch, worktree };
 }
-/** Context color: dim below 70, warning 70-90, error above 90. */
+const MODE_DISPLAY = {
+    auto: { text: "⏵⏵ auto mode", color: "accent" },
+    review: { text: "✓ review mode", color: "warning" },
+    plan: { text: "⏸ plan mode", color: "success" },
+};
+function modeDisplay(mode) {
+    return MODE_DISPLAY[mode];
+}
+/** Context color: success below 70, warning 70-90, error above 90. */
 function contextColor(percent) {
     if (percent === null)
-        return "dim";
+        return "success";
     if (percent > 90)
         return "error";
     if (percent > 70)
         return "warning";
-    return "dim";
+    return "success";
 }
 /** Pure line-builder, exported for tests. All data injected; colors via theme. */
 export function renderFooterLines(input, theme, width, padX = 0) {
@@ -218,7 +235,7 @@ export function renderFooterLines(input, theme, width, padX = 0) {
         if (input.git.worktree)
             line1Parts.push(theme.fg("warning", `[${input.git.worktree}]`));
         if (input.git.branch)
-            line1Parts.push(theme.fg("border", truncateEnd(input.git.branch, BRANCH_MAX_WIDTH)));
+            line1Parts.push(theme.fg("border", truncateEnd(input.git.branch, BRANCH_MAX_WIDTH, dim("…"))));
     }
     const line1 = pad + truncateToWidth(line1Parts.join(sep), contentWidth, dim("…"));
     // Line 2: [mode ·] model · ↑in ↓out $cost · ctx%
@@ -232,8 +249,10 @@ export function renderFooterLines(input, theme, width, padX = 0) {
     const stats = statParts.join(" ");
     const percentText = input.contextPercent === null ? "?" : `${Math.round(input.contextPercent)}%`;
     const line2Parts = [];
-    if (input.mode)
-        line2Parts.push(dim(`${input.mode} mode`));
+    if (input.mode) {
+        const modeLabel = modeDisplay(input.mode);
+        line2Parts.push(theme.fg(modeLabel.color, modeLabel.text) + dim(" (shift+tab to change)"));
+    }
     line2Parts.push(dim(input.model));
     if (stats)
         line2Parts.push(dim(stats));
@@ -247,17 +266,8 @@ export function renderFooterLines(input, theme, width, padX = 0) {
     }
     return lines;
 }
-/**
- * Create a footer factory that captures the session `ctx` (for session data)
- * and returns the component `setFooter` expects. Called from the
- * `session_start` handler in index.ts.
- */
-export function createYagniFooterFactory(ctx, modeHolder) {
+export function createYagniFooterFactory(ctx, modeHolder, invalidateHandle) {
     return (_tui, theme, footerData) => {
-        // Recompute git/worktree info only when the branch actually changes. Optional-
-        // chained: onBranchChange is typed on ReadonlyFooterDataProvider, but the runtime
-        // provider is whatever pi version is installed — guard so a mismatch can't break
-        // footer construction (worst case, git info just doesn't auto-invalidate).
         let gitCache;
         const unsubscribeBranch = footerData.onBranchChange?.(() => {
             gitCache = undefined;
@@ -268,6 +278,10 @@ export function createYagniFooterFactory(ctx, modeHolder) {
             }
             return gitCache;
         };
+        if (invalidateHandle) {
+            invalidateHandle.invalidateGit = () => { gitCache = undefined; };
+            invalidateHandle.requestRender = () => { _tui?.requestRender?.(); };
+        }
         return {
             render(width) {
                 const statuses = [...footerData.getExtensionStatuses().entries()]

package/dist/extension/guardian.d.ts

@@ -37,7 +37,7 @@ export interface GuardianVerdict {
     rationale: string;
 }
 export interface GuardianLimits {
-    /** Session cap on total Guardian reviews. */
+    /** Cap on Guardian reviews within the sliding window ({@link GUARDIAN_REVIEW_WINDOW_MS}). */
     maxReviews: number;
     /** Consecutive denials per turn before the circuit breaker trips. */
     maxConsecutiveDenials: number;
@@ -47,15 +47,25 @@ export interface GuardianLimits {
 export declare const DEFAULT_GUARDIAN_LIMITS: GuardianLimits;
 /**
  * Resolve Guardian limits from the environment. `YAGNI_GUARDIAN_MAX_REVIEWS`
- * overrides the session review cap; anything non-numeric or < 1 falls back to
- * the default (a bad value must never zero out the cap and lock the session).
+ * overrides the sliding-window review cap; anything non-numeric or < 1 falls
+ * back to the default (a bad value must never zero out the cap and lock the
+ * session).
  */
 export declare function resolveGuardianLimits(env?: Record<string, string | undefined>): GuardianLimits;
 /** The model tier the Guardian runs on. Configurable via YAGNI_GUARDIAN_TIER. */
 export declare const GUARDIAN_MODEL_TIER = "efficient";
 /** Read-only tools — the Guardian can read files for context but cannot write or execute. */
 export declare const GUARDIAN_TOOLS: string[];
+/**
+ * The review-cap window. `reviews` counts consults inside a SLIDING window
+ * rather than for the session's lifetime: a 24/7 session (a fleet operator's
+ * always-on terminal) must regain review capacity as old consults age out,
+ * not hard-block forever after the first N. The cap is a cost/runaway bound,
+ * not a safety bound — safety is the verdicts themselves.
+ */
+export declare const GUARDIAN_REVIEW_WINDOW_MS: number;
 export interface GuardianState {
+    /** Guardian consults within the last {@link GUARDIAN_REVIEW_WINDOW_MS}. */
     reviews: number;
     consecutiveDenials: number;
 }
@@ -64,7 +74,7 @@ export interface GuardianStateHandle {
     recordReview(outcome: GuardianOutcome): GuardianState;
     resetTurn(): void;
 }
-export declare function makeGuardianState(): GuardianStateHandle;
+export declare function makeGuardianState(now?: () => number): GuardianStateHandle;
 export interface CircuitBreakerResult {
     tripped: boolean;
     reason?: string;

package/dist/extension/guardian.js

@@ -29,14 +29,15 @@
  */
 import { runStage as defaultRunStage } from "./pipeline/runner.js";
 export const DEFAULT_GUARDIAN_LIMITS = {
-    maxReviews: 30,
+    maxReviews: 120,
     maxConsecutiveDenials: 3,
     timeoutMs: 15_000,
 };
 /**
  * Resolve Guardian limits from the environment. `YAGNI_GUARDIAN_MAX_REVIEWS`
- * overrides the session review cap; anything non-numeric or < 1 falls back to
- * the default (a bad value must never zero out the cap and lock the session).
+ * overrides the sliding-window review cap; anything non-numeric or < 1 falls
+ * back to the default (a bad value must never zero out the cap and lock the
+ * session).
  */
 export function resolveGuardianLimits(env = process.env) {
     const raw = env.YAGNI_GUARDIAN_MAX_REVIEWS?.trim();
@@ -48,25 +49,48 @@ export function resolveGuardianLimits(env = process.env) {
 export const GUARDIAN_MODEL_TIER = "efficient";
 /** Read-only tools — the Guardian can read files for context but cannot write or execute. */
 export const GUARDIAN_TOOLS = ["read"];
-export function makeGuardianState() {
-    const state = { reviews: 0, consecutiveDenials: 0 };
+// --- State ---
+/**
+ * The review-cap window. `reviews` counts consults inside a SLIDING window
+ * rather than for the session's lifetime: a 24/7 session (a fleet operator's
+ * always-on terminal) must regain review capacity as old consults age out,
+ * not hard-block forever after the first N. The cap is a cost/runaway bound,
+ * not a safety bound — safety is the verdicts themselves.
+ */
+export const GUARDIAN_REVIEW_WINDOW_MS = 60 * 60_000;
+export function makeGuardianState(now = Date.now) {
+    const reviewTimes = [];
+    let consecutiveDenials = 0;
+    const prune = () => {
+        const cutoff = now() - GUARDIAN_REVIEW_WINDOW_MS;
+        while (reviewTimes.length > 0 && reviewTimes[0] <= cutoff)
+            reviewTimes.shift();
+    };
+    const snapshot = () => ({
+        reviews: reviewTimes.length,
+        consecutiveDenials,
+    });
     return {
-        read: () => ({ ...state }),
+        read: () => {
+            prune();
+            return snapshot();
+        },
         recordReview(outcome) {
-            state.reviews += 1;
+            prune();
+            reviewTimes.push(now());
             if (outcome === "deny") {
-                state.consecutiveDenials += 1;
+                consecutiveDenials += 1;
             }
             else if (outcome === "allow") {
-                state.consecutiveDenials = 0;
+                consecutiveDenials = 0;
             }
             // "ask" leaves the denial streak UNCHANGED: it is neither a denial nor
             // an exoneration. If it reset the streak, deny/ask/deny/ask would never
             // trip the breaker (round-2 review blocker).
-            return { ...state };
+            return snapshot();
         },
         resetTurn() {
-            state.consecutiveDenials = 0;
+            consecutiveDenials = 0;
         },
     };
 }

package/dist/extension/index.d.ts

@@ -5,6 +5,7 @@ import { fetchMcpServers as defaultFetchMcpServers } from "./mcpTools.js";
 import { type FlushOutcome, type SpoolClientOpts } from "./spool.js";
 import { type TokenProvider } from "./tokenProvider.js";
 import { type CatalogResult, type ContextBrief } from "./config.js";
+import { maybeOfferMiningBeat as defaultMaybeOfferMiningBeat, type MineBeatMarkers } from "./mineBeat.js";
 /**
  * YAGNI Code extension entry point.
  *
@@ -36,7 +37,21 @@ export interface RegisterYagniDeps {
         baseUrl: string;
         getToken: () => string | undefined;
         fetchImpl?: typeof fetch;
+        repo?: string;
     }) => Promise<ContextBrief | null>;
+    /**
+     * The session repo (`owner/name`), resolved from the origin remote before
+     * the boot brief fetch so `/context` can carry `repoDecisionCount` for the
+     * mining beat. Injectable (no git in tests); undefined outside a repo.
+     */
+    resolveRepoFullName?: (cwd: string) => string | undefined;
+    /**
+     * The opt-in seeding beat itself (Run 7). Injectable so tests assert it
+     * fires only on a startup with an explicitly-zero repo ledger.
+     */
+    offerMiningBeat?: typeof defaultMaybeOfferMiningBeat;
+    /** The beat's once-per-repo marker store. Injectable (no disk in tests). */
+    mineBeatMarkers?: MineBeatMarkers;
     /**
      * Workspace MCP server list seam (YAG-446). The default hits
      * `/api/yagni-code/mcp/servers` and is fail-soft: older backends and
@@ -122,7 +137,9 @@ export type { RecordDecisionParams } from "./recordDecisionTool.js";
 export { runInitPass, runTeamSetup, registerTeamSetupCommand, isFreshWorkspace, readRepoIntake, draftEngineering, summarizeDraft, FRESH_BRIEF_MIN_CHARS, } from "./initPass.js";
 export type { RunInitPassDeps, InitPassOutcome, RunTeamSetupDeps, TeamSetupOutcome, RepoIntake, RepoIntakeFs, EngineeringDraft, DraftTeam, } from "./initPass.js";
 export { isInitDone, markInitDone, initDoneMarkerFile, _setInitDoneHomeForTest } from "./initDone.js";
-export { brandSystemPrompt, YAGNI_IDENTITY, YAGNI_IDENTITY_DRIVER, BRAND_NAME } from "./branding.js";
+export { brandSystemPrompt, YAGNI_IDENTITY, YAGNI_IDENTITY_DRIVER, YAGNI_IDENTITY_ULTRA, BRAND_NAME } from "./branding.js";
+export { createUltraHolder, registerUltraCommand } from "./ultra.js";
+export type { UltraHolder } from "./ultra.js";
 export { attributionHeaders, isDriverCaller, fetchCatalog, getToken, getWorkspaceId, resolveBaseUrl, sanitizeCallerSegment, } from "./config.js";
 export type { CatalogResult, FetchCatalogOptions, ModelEntry } from "./config.js";
 export { buildYagniProvider } from "./provider.js";
@@ -139,9 +156,9 @@ export type { VerifyCommand, VerifyOutcome } from "./pipeline/verify.js";
 export { blindStages, reportOnlyStages, makeGroundedVsBlindEval, formatComparisonReport } from "./pipeline/eval.js";
 export type { ComparisonReport, LaneFit, LaneOutcome } from "./pipeline/eval.js";
 export { registerGoCompareCommand } from "./pipeline/goCompareCommand.js";
-export { registerSubagents, makeSubagentTool, discoverSubagents, parseAgentMarkdown, buildSubagentStage, formatAgentList, mapModelTier, SUBAGENT_TOOL_NAME, GENERAL_AGENT_NAME, MAX_PARALLEL_SUBAGENTS, DEFAULT_SUBAGENT_TOOLS, } from "./subagents.js";
+export { registerSubagents, makeSubagentTool, discoverSubagents, parseAgentMarkdown, buildSubagentStage, formatAgentList, mapModelTier, SUBAGENT_TOOL_NAME, GENERAL_AGENT_NAME, MAX_PARALLEL_SUBAGENTS, MAX_PARALLEL_SUBAGENTS_ULTRA, DEFAULT_SUBAGENT_TOOLS, } from "./subagents.js";
 export type { SubagentDef, SubagentSource } from "./subagents.js";
-export { registerTodos, makeTodoTool, normalizeTodos, reconstructTodos, renderTodoWidget, formatTodoList, todoSummary, TODO_TOOL_NAME, MAX_TODOS, } from "./todos.js";
+export { registerTodos, makeTodoTool, normalizeTodos, reconstructTodos, renderTodoWidget, formatTodoList, formatTodoReminder, shouldRemindTodos, todoSummary, TODO_TOOL_NAME, TODO_REMINDER_TURNS, MAX_TODOS, } from "./todos.js";
 export type { TodoItem, TodoStatus, TodoTheme } from "./todos.js";
 export { decideGate, registerPermissionGate, filterStaleModeContext, filterStalePlanContext, buildModeContextMessage, DEFAULT_PERMISSION_POLICY, MODE_CONTEXT_TYPE, PLAN_CONTEXT_TYPE, PLAN_CONTEXT_MESSAGE, } from "./permission.js";
 export { classifyCommand, DEFAULT_EXEC_POLICY, } from "./execPolicy.js";

package/dist/extension/index.js

@@ -14,13 +14,13 @@ import { registerCmuxBridge } from "./cmux/index.js";
 import { makeRecordEngineeringContextTool } from "./recordContextTool.js";
 import { makeRecordDecisionTool } from "./recordDecisionTool.js";
 import { makeSuggestNextWorkTool } from "./nextWorkTool.js";
-import { BRAND_NAME, brandSystemPrompt, brandingDisabled, buildMastheadString, YAGNI_IDENTITY_DRIVER } from "./branding.js";
+import { BRAND_NAME, brandSystemPrompt, brandingDisabled, buildMastheadString, YAGNI_IDENTITY_DRIVER, YAGNI_IDENTITY_ULTRA } from "./branding.js";
 import { claudeRulesSection } from "./claudeRules.js";
 import { registerCostCommand } from "./costHud.js";
 import { isDebug } from "./diagnostics.js";
 import { droppedSessionRuns, sessionRunIds } from "./sessionRuns.js";
 import { codeStateHome } from "./stateHome.js";
-import { createYagniFooterFactory, formatCwd } from "./footer.js";
+import { createYagniFooterFactory, cyclePermissionMode, formatCwd, GIT_MUTATING_PATTERN, isShiftTab } from "./footer.js";
 import { RerouteNotifier } from "./rerouteNotice.js";
 import { isFreshWorkspace, registerTeamSetupCommand, runInitPass as defaultRunInitPass } from "./initPass.js";
 import { isInitDone as defaultIsInitDone, markInitDone as defaultMarkInitDone } from "./initDone.js";
@@ -29,6 +29,7 @@ import { registerGoCommand } from "./pipeline/goCommand.js";
 import { registerGoCompareCommand } from "./pipeline/goCompareCommand.js";
 import { DEFAULT_PERMISSION_POLICY, createModeHolder, registerPermissionGate } from "./permission.js";
 import { registerSubagents } from "./subagents.js";
+import { createUltraHolder, registerUltraCommand } from "./ultra.js";
 import { registerTodos } from "./todos.js";
 import { registerDecisionCommands } from "./decisions.js";
 import { makeDecisionCapture } from "./decisionCapture.js";
@@ -40,6 +41,8 @@ import { makeAuthedFetch, makeTokenProvider } from "./tokenProvider.js";
 import { attributionHeaders, fetchCatalog as defaultFetchCatalog, fetchContextBrief as defaultFetchContextBrief, getToken, getTokenExpiresAt as defaultGetTokenExpiresAt, getWorkspaceId as defaultGetWorkspaceId, isDriverCaller, resolveBaseUrl, tokenExpiryNotice, } from "./config.js";
 import { buildYagniProvider } from "./provider.js";
 import { registerChipEditor } from "./chipEditor.js";
+import { defaultMineBeatGit, fileMineBeatMarkers, maybeOfferMiningBeat as defaultMaybeOfferMiningBeat, } from "./mineBeat.js";
+import { makeFlywheelState } from "./flywheel.js";
 function isEvalMode(env = process.env) {
     return env.YAGNI_CODE_EVAL_MODE === "1";
 }
@@ -143,7 +146,11 @@ export async function registerYagni(pi, deps = {}) {
     // child, a subagent, or an advisor consult).
     pi.registerProvider("yagni", buildYagniProvider(catalog, baseUrl, attributionHeaders(deps.env)));
     const toolOpts = { baseUrl, getToken: getTokenFn, fetchImpl: authedFetch };
-    pi.registerTool(makeAskYagniTool(toolOpts));
+    // One flywheel state per session, shared by ask_yagni (caps how many
+    // no-position record suggestions reach the model) and record_decision
+    // (flywheel-attributed records send dedupe: true). Run 7.
+    const flywheelState = makeFlywheelState();
+    pi.registerTool(makeAskYagniTool({ ...toolOpts, flywheel: flywheelState, getRepo: () => sessionRepo }));
     // Ticket write-back (spec 2026-08-09): explicit user-intent writes to the
     // workspace tracker, attributed to the developer via per-user credentials.
     if (!evalMode) {
@@ -171,7 +178,7 @@ export async function registerYagni(pi, deps = {}) {
         pi.registerTool(makeRecordEngineeringContextTool(toolOpts));
         // The capture half of the judgment loop: bank a product-intent decision so
         // ask_yagni answers the same question next time instead of interrupting a human.
-        pi.registerTool(makeRecordDecisionTool(toolOpts));
+        pi.registerTool(makeRecordDecisionTool({ ...toolOpts, flywheel: flywheelState }));
     }
     // The visible checklist for multi-step work: the todo_write tool, its
     // above-editor widget, and /todos. Branch-replayed, so forks and resumes
@@ -185,7 +192,12 @@ export async function registerYagni(pi, deps = {}) {
     // The general subagent tool: delegate self-contained tasks (optionally in
     // parallel) to fresh-context agents defined in .claude/agents / .pi/agents,
     // riding the /go pipeline's child runner. /agents lists what's available.
-    registerSubagents(pi);
+    // Ultra mode (/ultra) is an explicit orchestration dial: it swaps the
+    // driver's delegation identity for the diamond directive (see the
+    // before_agent_start handler below) and widens the tool's fan-out ceiling.
+    const ultraHolder = createUltraHolder();
+    registerSubagents(pi, { isUltra: () => ultraHolder.get() });
+    registerUltraCommand(pi, ultraHolder);
     // Shared fetch timeout for the small, interactive display-path reads below
     // (/cost's spend + headroom, and Task 8's per-run spend for /go's summary):
     // 5s, not the 10s other boot/grounding fetches use, because the user is
@@ -238,6 +250,7 @@ export async function registerYagni(pi, deps = {}) {
     // Mutating MCP tools join write/edit/bash in the gate policy: plan mode
     // holds them, review mode confirms them.
     const modeHolder = createModeHolder();
+    const footerInvalidateHandle = { invalidateGit: () => { }, requestRender: () => { } };
     const guardianState = makeGuardianState();
     // Disabled by the local env override OR the workspace kill switch
     // (yagni_code.guardian, read from the catalog response at launch). The env
@@ -262,7 +275,9 @@ export async function registerYagni(pi, deps = {}) {
         catch { /* logging must never break the session */ }
     };
     // YAG-510: persisted "don't ask again" grants, per-repo keyed. Loaded once
-    // at startup (grants added by other concurrent sessions appear next launch).
+    // at startup (grants added by other concurrent sessions appear next launch —
+    // the startup load is the trust boundary; live reload was reviewed and
+    // rejected as a same-session self-authorization path, PR #1698).
     const sessionGrants = evalMode ? [] : loadGrants();
     const GUARDIAN_EVENT_TIMEOUT_MS = 5_000;
     registerPermissionGate(pi, {
@@ -452,11 +467,27 @@ export async function registerYagni(pi, deps = {}) {
     // must never block the agent), then inject it into the system prompt so the
     // very first turn already knows how this company and codebase work.
     const fetchBrief = deps.fetchContextBrief ?? defaultFetchContextBrief;
+    // Resolved BEFORE the brief fetch so /context can answer repoDecisionCount
+    // in the same round-trip (the mining beat's signal). Best-effort: undefined
+    // outside a git repo or without an origin remote.
+    const resolveRepoFn = deps.resolveRepoFullName ?? ((cwd) => defaultMineBeatGit.repoFullName(cwd));
+    let sessionRepo;
+    try {
+        sessionRepo = evalMode ? undefined : resolveRepoFn(process.cwd());
+    }
+    catch {
+        sessionRepo = undefined;
+    }
     let contextBrief;
     let briefResult = null;
     if (!evalMode) {
         try {
-            briefResult = await fetchBrief({ baseUrl, getToken: getTokenFn, fetchImpl: authedFetch });
+            briefResult = await fetchBrief({
+                baseUrl,
+                getToken: getTokenFn,
+                fetchImpl: authedFetch,
+                repo: sessionRepo,
+            });
             contextBrief = briefResult?.brief?.trim() ? briefResult.brief : undefined;
         }
         catch {
@@ -517,13 +548,19 @@ export async function registerYagni(pi, deps = {}) {
     // assembled prompt passes through byte-exact (no rewrite, no brief
     // injection, no rules section, no delegation identity).
     const noBranding = brandingDisabled(env);
-    const identity = isDriverCaller(env) ? YAGNI_IDENTITY_DRIVER : undefined;
+    // Resolved per turn (not once at activation): /ultra can flip the driver
+    // between the delegation and diamond identities mid-session.
+    const isDriver = isDriverCaller(env);
     pi.on("before_agent_start", (event) => noBranding
         ? undefined
         : {
             systemPrompt: brandSystemPrompt(event.systemPrompt, {
                 contextBrief,
-                identity,
+                identity: isDriver
+                    ? ultraHolder.get()
+                        ? YAGNI_IDENTITY_ULTRA
+                        : YAGNI_IDENTITY_DRIVER
+                    : undefined,
                 rulesSection,
             }),
         });
@@ -681,7 +718,15 @@ export async function registerYagni(pi, deps = {}) {
             // context % on line 2, and extension statuses (brand, todos, mode) on
             // line 3. The factory captures ctx so the footer can read session data
             // (token stats, context usage) that isn't on the footerData provider.
-            ctx.ui?.setFooter?.((tui, theme, footerData) => createYagniFooterFactory(ctx, modeHolder)(tui, theme, footerData));
+            ctx.ui?.setFooter?.((tui, theme, footerData) => createYagniFooterFactory(ctx, modeHolder, footerInvalidateHandle)(tui, theme, footerData));
+            ctx.ui?.onTerminalInput?.((data) => {
+                if (isShiftTab(data)) {
+                    modeHolder.set(cyclePermissionMode(modeHolder.get()));
+                    footerInvalidateHandle.requestRender();
+                    return { consume: true };
+                }
+                return undefined;
+            });
             // Label the collapsed chain-of-thought line so users know it is reasoning
             // and how to reveal the full trace. Harmless when reasoning is expanded
             // (the label only shows on hidden thinking blocks). Fails closed to pi's
@@ -755,6 +800,38 @@ export async function registerYagni(pi, deps = {}) {
                 // The init pass is best-effort; a failure never blocks the session.
             }
         }
+        // Run 7: the opt-in repo seeding beat. Fires only on a genuine startup
+        // when /context reported an explicitly-empty repo-scoped ledger, once per
+        // repo (marker store). Fully fail-soft — a beat failure never blocks the
+        // session.
+        if (event.reason === "startup" && !evalMode) {
+            try {
+                const offerBeat = deps.offerMiningBeat ?? defaultMaybeOfferMiningBeat;
+                const markers = deps.mineBeatMarkers ?? fileMineBeatMarkers(codeStateHome(null, env));
+                await offerBeat(ctx, {
+                    repoFullName: sessionRepo,
+                    repoDecisionCount: briefResult?.repoDecisionCount,
+                    cwd: process.cwd(),
+                    baseUrl,
+                    getToken: getTokenFn,
+                    fetchImpl: authedFetch,
+                    markers,
+                });
+            }
+            catch {
+                // Seeding is best-effort; a failure never blocks the session.
+            }
+        }
+    });
+    pi.on("tool_result", (event) => {
+        if (event.toolName !== "bash")
+            return;
+        const command = typeof event.input?.command === "string"
+            ? event.input.command
+            : "";
+        if (GIT_MUTATING_PATTERN.test(command)) {
+            footerInvalidateHandle.invalidateGit();
+        }
     });
 }
 export default async function (pi) {
@@ -781,7 +858,9 @@ export { recordDecision } from "./recordDecisionTool.js";
 export { runInitPass, runTeamSetup, registerTeamSetupCommand, isFreshWorkspace, readRepoIntake, draftEngineering, summarizeDraft, FRESH_BRIEF_MIN_CHARS, } from "./initPass.js";
 // Onramp Door B (F2a): the one-time init-pass idempotency marker.
 export { isInitDone, markInitDone, initDoneMarkerFile, _setInitDoneHomeForTest } from "./initDone.js";
-export { brandSystemPrompt, YAGNI_IDENTITY, YAGNI_IDENTITY_DRIVER, BRAND_NAME } from "./branding.js";
+export { brandSystemPrompt, YAGNI_IDENTITY, YAGNI_IDENTITY_DRIVER, YAGNI_IDENTITY_ULTRA, BRAND_NAME } from "./branding.js";
+// Ultra mode (/ultra): the aggressive fan-out/verify/synthesize dial.
+export { createUltraHolder, registerUltraCommand } from "./ultra.js";
 export { attributionHeaders, isDriverCaller, fetchCatalog, getToken, getWorkspaceId, resolveBaseUrl, sanitizeCallerSegment, } from "./config.js";
 export { buildYagniProvider } from "./provider.js";
 export { registerGoCommand } from "./pipeline/goCommand.js";
@@ -796,9 +875,9 @@ export { buildVerifyEnv, detectVerifyCommand, makeRunVerify, parseVerifyFailures
 export { blindStages, reportOnlyStages, makeGroundedVsBlindEval, formatComparisonReport } from "./pipeline/eval.js";
 export { registerGoCompareCommand } from "./pipeline/goCompareCommand.js";
 // The general subagent tool: Claude Code-format agent discovery + fan-out.
-export { registerSubagents, makeSubagentTool, discoverSubagents, parseAgentMarkdown, buildSubagentStage, formatAgentList, mapModelTier, SUBAGENT_TOOL_NAME, GENERAL_AGENT_NAME, MAX_PARALLEL_SUBAGENTS, DEFAULT_SUBAGENT_TOOLS, } from "./subagents.js";
+export { registerSubagents, makeSubagentTool, discoverSubagents, parseAgentMarkdown, buildSubagentStage, formatAgentList, mapModelTier, SUBAGENT_TOOL_NAME, GENERAL_AGENT_NAME, MAX_PARALLEL_SUBAGENTS, MAX_PARALLEL_SUBAGENTS_ULTRA, DEFAULT_SUBAGENT_TOOLS, } from "./subagents.js";
 // The session todo checklist: todo_write tool, widget renderer, /todos.
-export { registerTodos, makeTodoTool, normalizeTodos, reconstructTodos, renderTodoWidget, formatTodoList, todoSummary, TODO_TOOL_NAME, MAX_TODOS, } from "./todos.js";
+export { registerTodos, makeTodoTool, normalizeTodos, reconstructTodos, renderTodoWidget, formatTodoList, formatTodoReminder, shouldRemindTodos, todoSummary, TODO_TOOL_NAME, TODO_REMINDER_TURNS, MAX_TODOS, } from "./todos.js";
 // P3 + W4: the permission gate seam (decideGate is pure; policy injectable) plus
 // the session bless-with-remember capture hook.
 export { decideGate, registerPermissionGate, filterStaleModeContext, filterStalePlanContext, buildModeContextMessage, DEFAULT_PERMISSION_POLICY, MODE_CONTEXT_TYPE, PLAN_CONTEXT_TYPE, PLAN_CONTEXT_MESSAGE, } from "./permission.js";

package/dist/extension/mineBeat.d.ts

@@ -0,0 +1,95 @@
+/**
+ * The opt-in repo seeding beat (org plane, Run 7).
+ *
+ * On the first interactive session in a repo whose repo-scoped decision
+ * ledger is empty (`/context?repo=` reports `repoDecisionCount: 0`), YAGNI
+ * Code offers — once — to read the repo's own decision record and seed the
+ * ledger: "Read this repo's ADRs and docs and seed the decision ledger?".
+ * One keystroke, then the backend extracts, dedupes, and banks at most 12
+ * `repo_mined` asserted rows, and the beat prints the banked count plus the
+ * Library review deep link.
+ *
+ * Never automatic, never a nag: a decline writes a per-repo marker so the
+ * beat does not recur; an accepted pass marks the repo only after the server
+ * confirms (a transport failure leaves the offer available next session).
+ * The corpus is collected at git HEAD (same echo-chamber guard as
+ * repoDocs.ts) — ADR directories, agent-instruction root docs, top-level
+ * docs/*.md, and recent merge subjects — bounded client-side to the same
+ * limits the backend enforces.
+ */
+/**
+ * Client-side bounds on the mining corpus — mirror of the backend's
+ * MINE_INPUT_LIMITS so nothing is silently truncated server-side.
+ */
+export declare const MINE_BEAT_LIMITS: {
+    readonly maxDocs: 40;
+    readonly maxPathChars: 300;
+    readonly maxExcerptChars: 8000;
+    readonly maxCommitSubjects: 200;
+    readonly maxSubjectChars: 200;
+};
+/** One document offered to the mining pass. */
+export interface MineBeatDoc {
+    path: string;
+    excerpt: string;
+}
+/** Injectable git seam (default: execFileSync; every call fail-soft). */
+export interface MineBeatGit {
+    /** `owner/name` from the origin remote, or undefined outside a repo. */
+    repoFullName: (cwd: string) => string | undefined;
+    /** Tracked paths at HEAD, or null when cwd is not a usable git tree. */
+    listAtHead: (cwd: string) => string[] | null;
+    /** One file's HEAD content, or null when unreadable. */
+    readAtHead: (cwd: string, rel: string) => string | null;
+    /** Recent merge-commit subjects (fallback: plain subjects on squash repos). */
+    mergeSubjects: (cwd: string, max: number) => string[];
+}
+/** Parse `owner/name` from an origin remote URL (ssh or https). */
+export declare function parseRepoFullName(remote: string | null | undefined): string | undefined;
+export declare const defaultMineBeatGit: MineBeatGit;
+/** Is this HEAD-tracked path part of the repo's decision record? */
+export declare function isMineCandidate(rel: string): boolean;
+/** Collect the HEAD-era mining corpus, bounded to MINE_BEAT_LIMITS. */
+export declare function collectMineCorpus(cwd: string, gitImpl?: MineBeatGit): {
+    docs: MineBeatDoc[];
+    commitSubjects: string[];
+};
+/** Injectable marker-store seam (default: a JSON file per repo on disk). */
+export interface MineBeatMarkers {
+    has: (repoFullName: string) => boolean;
+    write: (repoFullName: string, status: "declined" | "seeded") => void;
+}
+/** Filesystem path of one repo's beat marker under the state home. */
+export declare function mineMarkerPath(stateHome: string, repoFullName: string): string;
+export declare function fileMineBeatMarkers(stateHome: string): MineBeatMarkers;
+/** The subset of the session-start ctx the beat needs. */
+export interface MineBeatUi {
+    hasUI: boolean;
+    ui: {
+        confirm?: (title: string, message: string) => Promise<boolean>;
+        notify: (message: string, level: "info" | "error") => void;
+    };
+}
+export interface OfferMiningBeatOptions {
+    repoFullName: string | undefined;
+    /** From `/context?repo=`; the beat fires ONLY on an explicit 0. */
+    repoDecisionCount: number | undefined;
+    cwd: string;
+    baseUrl: string;
+    getToken: () => string | undefined;
+    fetchImpl?: typeof fetch;
+    markers: MineBeatMarkers;
+    gitImpl?: MineBeatGit;
+    collect?: typeof collectMineCorpus;
+}
+export interface MiningBeatOutcome {
+    offered: boolean;
+    accepted?: boolean;
+    banked?: number;
+}
+/**
+ * Offer (once per repo) and, on yes, run the seeding pass. Fail-soft
+ * throughout: any error surfaces as a notify at most, never a broken session.
+ */
+export declare function maybeOfferMiningBeat(ctx: MineBeatUi, opts: OfferMiningBeatOptions): Promise<MiningBeatOutcome>;
+//# sourceMappingURL=mineBeat.d.ts.map