@yagni-app/code 0.3.0 → 0.3.2

package/dist/extension/mineBeat.js

@@ -0,0 +1,193 @@
+/**
+ * The opt-in repo seeding beat (org plane, Run 7).
+ *
+ * On the first interactive session in a repo whose repo-scoped decision
+ * ledger is empty (`/context?repo=` reports `repoDecisionCount: 0`), YAGNI
+ * Code offers — once — to read the repo's own decision record and seed the
+ * ledger: "Read this repo's ADRs and docs and seed the decision ledger?".
+ * One keystroke, then the backend extracts, dedupes, and banks at most 12
+ * `repo_mined` asserted rows, and the beat prints the banked count plus the
+ * Library review deep link.
+ *
+ * Never automatic, never a nag: a decline writes a per-repo marker so the
+ * beat does not recur; an accepted pass marks the repo only after the server
+ * confirms (a transport failure leaves the offer available next session).
+ * The corpus is collected at git HEAD (same echo-chamber guard as
+ * repoDocs.ts) — ADR directories, agent-instruction root docs, top-level
+ * docs/*.md, and recent merge subjects — bounded client-side to the same
+ * limits the backend enforces.
+ */
+import { execFileSync } from "node:child_process";
+import * as fs from "node:fs";
+import { dirname, join } from "node:path";
+import { METERED_POST_FETCH_POLICY, resilientFetch } from "./resilientFetch.js";
+/**
+ * Client-side bounds on the mining corpus — mirror of the backend's
+ * MINE_INPUT_LIMITS so nothing is silently truncated server-side.
+ */
+export const MINE_BEAT_LIMITS = {
+    maxDocs: 40,
+    maxPathChars: 300,
+    maxExcerptChars: 8_000,
+    maxCommitSubjects: 200,
+    maxSubjectChars: 200,
+};
+const GIT_OPTS = {
+    encoding: "utf8",
+    maxBuffer: 16 * 1024 * 1024,
+    stdio: ["ignore", "pipe", "ignore"],
+};
+function git(cwd, args) {
+    try {
+        return execFileSync("git", args, { cwd, ...GIT_OPTS });
+    }
+    catch {
+        return null;
+    }
+}
+/** Parse `owner/name` from an origin remote URL (ssh or https). */
+export function parseRepoFullName(remote) {
+    if (!remote)
+        return undefined;
+    const m = remote.trim().match(/[:/]([^/:]+\/[^/]+?)(?:\.git)?$/);
+    return m ? m[1] : undefined;
+}
+export const defaultMineBeatGit = {
+    repoFullName: (cwd) => parseRepoFullName(git(cwd, ["config", "--get", "remote.origin.url"])),
+    listAtHead: (cwd) => {
+        const out = git(cwd, ["ls-tree", "-r", "--name-only", "HEAD"]);
+        return out === null ? null : out.split("\n").filter(Boolean);
+    },
+    readAtHead: (cwd, rel) => git(cwd, ["show", `HEAD:${rel}`]),
+    mergeSubjects: (cwd, max) => {
+        const merges = git(cwd, ["log", "--merges", `-n`, String(max), "--pretty=%s"]);
+        const chosen = merges && merges.trim().length > 0
+            ? merges
+            : // Squash-merge repos have no merge commits; plain subjects still
+                // carry the shipped-work trail. No further heuristics (spec flag).
+                git(cwd, ["log", `-n`, String(max), "--pretty=%s"]);
+        return (chosen ?? "").split("\n").map((s) => s.trim()).filter(Boolean).slice(0, max);
+    },
+};
+/** Is this HEAD-tracked path part of the repo's decision record? */
+export function isMineCandidate(rel) {
+    if (/^(?:docs\/)?adrs?\/[^/]+\.md$/i.test(rel))
+        return true;
+    if (/^(?:AGENTS|CLAUDE|CONTRIBUTING|CONTEXT|ARCHITECTURE)\.md$/i.test(rel))
+        return true;
+    if (/^docs\/[^/]+\.md$/i.test(rel))
+        return true;
+    return false;
+}
+/** Collect the HEAD-era mining corpus, bounded to MINE_BEAT_LIMITS. */
+export function collectMineCorpus(cwd, gitImpl = defaultMineBeatGit) {
+    const tracked = gitImpl.listAtHead(cwd);
+    if (tracked === null)
+        return { docs: [], commitSubjects: [] };
+    const docs = [];
+    for (const rel of tracked) {
+        if (docs.length >= MINE_BEAT_LIMITS.maxDocs)
+            break;
+        if (rel.length > MINE_BEAT_LIMITS.maxPathChars)
+            continue;
+        if (!isMineCandidate(rel))
+            continue;
+        const body = gitImpl.readAtHead(cwd, rel);
+        if (body === null || body.trim().length === 0)
+            continue;
+        docs.push({ path: rel, excerpt: body.trim().slice(0, MINE_BEAT_LIMITS.maxExcerptChars) });
+    }
+    const commitSubjects = gitImpl
+        .mergeSubjects(cwd, MINE_BEAT_LIMITS.maxCommitSubjects)
+        .map((s) => s.slice(0, MINE_BEAT_LIMITS.maxSubjectChars));
+    return { docs, commitSubjects };
+}
+/** Filesystem path of one repo's beat marker under the state home. */
+export function mineMarkerPath(stateHome, repoFullName) {
+    return join(stateHome, "mine-beat", `${repoFullName.replace(/[/\\]/g, "__")}.json`);
+}
+export function fileMineBeatMarkers(stateHome) {
+    return {
+        has: (repo) => {
+            try {
+                return fs.existsSync(mineMarkerPath(stateHome, repo));
+            }
+            catch {
+                return false;
+            }
+        },
+        write: (repo, status) => {
+            try {
+                const p = mineMarkerPath(stateHome, repo);
+                fs.mkdirSync(dirname(p), { recursive: true });
+                fs.writeFileSync(p, JSON.stringify({ status, at: new Date().toISOString() }), "utf8");
+            }
+            catch {
+                // A marker failure must never break the session; worst case the beat
+                // asks once more next launch.
+            }
+        },
+    };
+}
+/**
+ * Offer (once per repo) and, on yes, run the seeding pass. Fail-soft
+ * throughout: any error surfaces as a notify at most, never a broken session.
+ */
+export async function maybeOfferMiningBeat(ctx, opts) {
+    const { repoFullName } = opts;
+    // Only an EXPLICIT zero fires the beat: an absent count means an older
+    // backend or a count failure, and a nag on either would be wrong.
+    if (!repoFullName || opts.repoDecisionCount !== 0)
+        return { offered: false };
+    if (opts.markers.has(repoFullName))
+        return { offered: false };
+    if (!ctx.hasUI || typeof ctx.ui.confirm !== "function")
+        return { offered: false };
+    const collect = opts.collect ?? collectMineCorpus;
+    const corpus = collect(opts.cwd, opts.gitImpl ?? defaultMineBeatGit);
+    // Nothing to mine yet: skip WITHOUT a marker, so a later checkout that
+    // gains docs still gets its one offer.
+    if (corpus.docs.length === 0 && corpus.commitSubjects.length === 0) {
+        return { offered: false };
+    }
+    const accepted = await ctx.ui.confirm("Seed the decision ledger?", `Read this repo's ADRs and docs and bank up to 12 candidate decisions for ${repoFullName}? You review every one in the Library before it counts as confirmed.`);
+    if (!accepted) {
+        opts.markers.write(repoFullName, "declined");
+        return { offered: true, accepted: false };
+    }
+    try {
+        const res = await resilientFetch(`${opts.baseUrl}/api/yagni-code/decisions/mine`, {
+            method: "POST",
+            headers: {
+                authorization: `Bearer ${opts.getToken() ?? ""}`,
+                "content-type": "application/json",
+            },
+            body: JSON.stringify({
+                repo: repoFullName,
+                docs: corpus.docs,
+                commitSubjects: corpus.commitSubjects,
+                // Stable per repo: the write-spool replay contract makes a retry of
+                // the same pass idempotent server-side.
+                idempotencyKey: `mine:${repoFullName}`,
+            }),
+        }, { fetchImpl: opts.fetchImpl, policy: METERED_POST_FETCH_POLICY });
+        if (!res.ok) {
+            // No marker: the offer stays available next session.
+            ctx.ui.notify("Seeding the decision ledger failed; YAGNI Code will offer again next session.", "error");
+            return { offered: true, accepted: true };
+        }
+        const body = (await res.json());
+        opts.markers.write(repoFullName, "seeded");
+        if (body.alreadyMined)
+            return { offered: true, accepted: true, banked: 0 };
+        const banked = typeof body.banked === "number" ? body.banked : 0;
+        const noun = banked === 1 ? "decision" : "decisions";
+        ctx.ui.notify(`Banked ${banked} ${noun} read from this repo's docs. Review them: ${opts.baseUrl}/knowledge/decisions`, "info");
+        return { offered: true, accepted: true, banked };
+    }
+    catch {
+        ctx.ui.notify("Seeding the decision ledger failed; YAGNI Code will offer again next session.", "error");
+        return { offered: true, accepted: true };
+    }
+}
+//# sourceMappingURL=mineBeat.js.map

package/dist/extension/permission.d.ts

@@ -41,6 +41,7 @@ export type PermissionMode = "auto" | "plan" | "review";
 export interface ModeHolder {
     get(): PermissionMode;
     set(m: PermissionMode): void;
+    onSet(fn: (m: PermissionMode) => void): void;
 }
 export declare function createModeHolder(initial?: PermissionMode): ModeHolder;
 /** Which tools each tier acts on, plus the optional grounding-bless predicate. */
@@ -183,7 +184,7 @@ export interface RegisterPermissionDeps {
 export declare const MODE_CONTEXT_TYPE = "yagni-mode-context";
 /** Legacy alias — the original plan-mode tag, kept for backward compat. */
 export declare const PLAN_CONTEXT_TYPE = "yagni-mode-context";
-export declare const PLAN_CONTEXT_MESSAGE = "[PLAN MODE ACTIVE]\nYou are in plan mode: explore and design, change nothing.\n- write, edit, and bash are held by the permission gate; do not attempt them.\n- Read, search, and ask_yagni freely to ground the plan in how this company works.\n- Produce a concrete numbered plan of the steps you would take, with the files involved.\n- End by asking the user to review the plan; they run /mode auto (or /mode review) to execute it.\n- Once executing, track the plan's steps with todo_write.";
+export declare const PLAN_CONTEXT_MESSAGE = "[PLAN MODE ACTIVE]\nYou are in plan mode: explore and design, change nothing.\n- Read-only bash commands (ls, grep, git status, gh pr view, etc.) run freely to help you explore.\n- Ambiguous bash commands are reviewed by the Guardian; if non-mutating they run, if potentially mutating you will be asked.\n- write, edit, file_ticket, and update_ticket_status are held by the permission gate; do not attempt them.\n- Read, search, and ask_yagni freely to ground the plan in how this company works.\n- Produce a concrete numbered plan of the steps you would take, with the files involved.\n- End by asking the user to review the plan; they run /mode auto (or /mode review) to execute it.\n- Once executing, track the plan's steps with todo_write.";
 /** Build the mode-awareness context message for the current permission mode. */
 export declare function buildModeContextMessage(mode: PermissionMode): string;
 /**

package/dist/extension/permission.js

@@ -33,9 +33,15 @@ import { isDebug } from "./diagnostics.js";
 import { buildDiagnosticEvent, checkCircuitBreaker, DEFAULT_GUARDIAN_LIMITS, } from "./guardian.js";
 export function createModeHolder(initial = "auto") {
     let current = initial;
+    const listeners = new Set();
     return {
         get: () => current,
-        set: (m) => { current = m; },
+        set: (m) => {
+            current = m;
+            for (const fn of listeners)
+                fn(m);
+        },
+        onSet: (fn) => { listeners.add(fn); },
     };
 }
 export const DEFAULT_PERMISSION_POLICY = {
@@ -50,6 +56,42 @@ export const DEFAULT_PERMISSION_POLICY = {
  */
 export function decideGate(toolName, params, mode, policy) {
     if (mode === "plan") {
+        // Non-bash tools in planBlockTools are held outright — they are
+        // inherently mutating (write, edit, file_ticket, update_ticket_status).
+        // Bash is the exploration tool: run it through the exec policy so
+        // read-only commands (git status, ls, grep, gh pr view) work, and
+        // prompt-band commands are routed to the Guardian. The gate handler
+        // ensures Guardian-unavailable/capped/disabled states fail closed.
+        if (toolName === "bash") {
+            const command = typeof params.command === "string" ? params.command.trim() : "";
+            if (command) {
+                try {
+                    const execPolicy = policy.execPolicy ?? DEFAULT_EXEC_POLICY;
+                    const classification = classifyCommand(command, execPolicy);
+                    if (classification.decision === "allow")
+                        return { block: false };
+                    if (classification.decision === "forbidden") {
+                        return {
+                            block: true,
+                            reason: `${classification.justification}. Do not attempt the same outcome via a workaround or indirect execution — use a materially safer alternative, or ask the user.`,
+                        };
+                    }
+                    // prompt — Guardian reviews. The gate handler runs the Guardian
+                    // and handles allow/ask/deny. Grants and cache are skipped in
+                    // plan mode (they can cover writes). Guardian unavailable/capped/
+                    // disabled → block (fail closed).
+                    return { block: false, classify: "prompt", classifyJustification: classification.justification };
+                }
+                catch {
+                    // classifyCommand threw — fail closed in plan mode.
+                    return {
+                        block: true,
+                        reason: `plan mode: could not classify this bash command and it is held. Switch to /mode auto to apply changes.`,
+                    };
+                }
+            }
+            return { block: false };
+        }
         if (policy.planBlockTools.includes(toolName)) {
             return {
                 block: true,
@@ -116,7 +158,9 @@ const AUTO_MARKER = "[AUTO MODE]";
 const REVIEW_MARKER = "[REVIEW MODE]";
 export const PLAN_CONTEXT_MESSAGE = `${PLAN_MARKER}
 You are in plan mode: explore and design, change nothing.
-- write, edit, and bash are held by the permission gate; do not attempt them.
+- Read-only bash commands (ls, grep, git status, gh pr view, etc.) run freely to help you explore.
+- Ambiguous bash commands are reviewed by the Guardian; if non-mutating they run, if potentially mutating you will be asked.
+- write, edit, file_ticket, and update_ticket_status are held by the permission gate; do not attempt them.
 - Read, search, and ask_yagni freely to ground the plan in how this company works.
 - Produce a concrete numbered plan of the steps you would take, with the files involved.
 - End by asking the user to review the plan; they run /mode auto (or /mode review) to execute it.
@@ -199,11 +243,6 @@ export function filterStaleModeContext(messages, currentMode) {
 }
 /** Legacy alias — the original plan-mode filter name. */
 export const filterStalePlanContext = filterStaleModeContext;
-const MODE_STATUS = {
-    auto: undefined,
-    plan: "⏸ plan",
-    review: "✓ review",
-};
 const MODE_COPY = {
     auto: "auto: coding changes apply directly; external tracker changes ask first (default).",
     plan: "plan: write, edit, and bash are held so the agent can explore and propose only.",
@@ -257,6 +296,11 @@ export function registerPermissionGate(pi, deps = {}) {
     const basePolicy = deps.policy ?? DEFAULT_PERMISSION_POLICY;
     let mode = deps.mode ?? "auto";
     const makeStore = deps.makeBlessStore ?? defaultMakeBlessStore;
+    deps.modeHolder?.onSet((m) => {
+        if (m !== mode)
+            approvedCommands.clear();
+        mode = m;
+    });
     // The session bless store is created lazily on the first tool_call (it needs
     // the cwd). Its isBlessed backs the review-mode auto-approve, UNLESS the caller
     // injected its own isBlessed (e.g. a test policy) — that always wins.
@@ -279,6 +323,11 @@ export function registerPermissionGate(pi, deps = {}) {
     const guardianTier = deps.guardianTier;
     // --- YAG-510 gate state ---
     // Grants: in-memory list seeded from deps, appended on "don't ask again".
+    // Deliberately NOT live-reloaded from disk: auto mode can write files, so a
+    // mid-session re-read of rules.json would let the agent (or a prompt
+    // injection) author its own grants and self-authorize within the same
+    // session. New grants from concurrent sessions apply at next launch — the
+    // startup load is the trust boundary (PR #1698 review).
     const grants = [...(deps.grants ?? [])];
     // Keyed by cwd: a session can change working directory (cd, /go worktrees),
     // and a repoKey memoized from the first cwd would let repo-A grants match
@@ -403,21 +452,24 @@ export function registerPermissionGate(pi, deps = {}) {
                     }
                 }
                 // 2. Session exact-command approval cache (ticket 4.5).
-                if (command && approvedCommands.has(cacheKey(cwd, command))) {
+                // Skipped in plan mode: a cached approval can cover a write command,
+                // and plan mode's contract is no mutations without Guardian review.
+                if (modeAtEntry !== "plan" && command && approvedCommands.has(cacheKey(cwd, command))) {
                     emitGateEvent({ ...eventBase, outcome: "cached_allow", consulted: false });
                     return {};
                 }
                 const guardianAvailable = Boolean(guardianState && !guardianDisabled && guardianReview);
                 const limits = guardianLimits ?? DEFAULT_GUARDIAN_LIMITS;
                 if (guardianAvailable && guardianState.read().reviews >= limits.maxReviews) {
-                    // Session consult cap. Review mode falls through to its ordinary
-                    // confirm (no LLM cost); auto blocks.
-                    if (modeAtEntry === "auto") {
+                    // Sliding-window consult cap (capacity recovers as old reviews age
+                    // out — a long-lived session is never bricked). Review mode falls
+                    // through to its ordinary confirm (no LLM cost); auto and plan block.
+                    if (modeAtEntry === "auto" || modeAtEntry === "plan") {
                         if (ctx?.hasUI)
-                            ctx.ui.notify(`Guardian review cap reached (${limits.maxReviews} this session).`, "warning");
-                        return { block: true, reason: `Guardian review cap reached (${limits.maxReviews} this session). Switch to /mode review to approve manually.` };
+                            ctx.ui.notify(`Guardian review cap reached (${limits.maxReviews} in the last hour).`, "warning");
+                        return { block: true, reason: `Guardian review cap reached (${limits.maxReviews} in the last hour). Capacity recovers as older reviews age out; switch to /mode review to approve manually, or retry this step later.` };
                     }
-                    // fall through to decision.confirm below
+                    // review mode: fall through to decision.confirm below
                 }
                 else if (guardianAvailable) {
                     // Circuit breaker (pre-consult). With a UI, escalate to ONE ask per
@@ -447,7 +499,7 @@ export function registerPermissionGate(pi, deps = {}) {
                     }
                     // Show the reviewing chip.
                     if (ctx?.hasUI)
-                        ctx.ui.setStatus?.("yagni-guardian", "🛡 reviewing");
+                        ctx.ui.setStatus?.("yagni-guardian", "Guardian Reviewing");
                     const startMs = Date.now();
                     let reviewResult;
                     try {
@@ -663,6 +715,14 @@ export function registerPermissionGate(pi, deps = {}) {
                     // approval cache were already consulted above.
                     return {};
                 }
+                else if (modeAtEntry === "plan") {
+                    // Guardian disabled or not wired in plan mode: fail closed. Without
+                    // the Guardian to verify the command is non-mutating, the plan-mode
+                    // contract (no changes) cannot be upheld. The user can switch to
+                    // /mode auto or /mode review to proceed.
+                    emitGateEvent({ ...eventBase, outcome: "breaker_blocked", consulted: false });
+                    return { block: true, reason: "Guardian unavailable in plan mode. Switch to /mode auto to run commands, or /mode review to approve manually." };
+                }
                 // review mode with Guardian disabled/capped: fall through to confirm.
             }
             if (decision.confirm) {
@@ -740,13 +800,6 @@ export function registerPermissionGate(pi, deps = {}) {
     });
     const paintMode = (ctx) => {
         deps.modeHolder?.set(mode);
-        try {
-            if (ctx.hasUI)
-                ctx.ui.setStatus?.("yagni-mode", MODE_STATUS[mode]);
-        }
-        catch {
-            // The chip is chrome; never let it break /mode.
-        }
     };
     pi.registerCommand("mode", {
         description: "Set the permission tier: /mode auto | plan | review. No argument shows the current mode.",

package/dist/extension/pipeline/goCommand.js

@@ -77,7 +77,7 @@ import { registerGoStatusCommands } from "./goStatusCommands.js";
 import { runPipeline as defaultRunPipeline } from "./orchestrator.js";
 import { composeAbortSignal } from "./resilience.js";
 import { planResume } from "./resume.js";
-import { activeRunCount, beginRun, classifyRunLiveness, findActiveRunByTicket, isRunInFlight, isTerminalStatus, lastJournalTs, loadRegistryRows, MAX_CONCURRENT_RUNS, settleRun, trackRunAbort, trackRunPromise, worktreesDir, } from "./runRegistry.js";
+import { activeRunCount, beginRun, classifyRunLiveness, findActiveRunByTicket, isRunInFlight, isTerminalStatus, lastJournalTs, loadRegistryRows, resolveMaxConcurrentRuns, settleRun, trackRunAbort, trackRunPromise, worktreesDir, } from "./runRegistry.js";
 import { makeRunSession as defaultMakeRunSession } from "./runSession.js";
 import { recordSessionRun } from "../sessionRuns.js";
 import { resolveTicketBrief as defaultResolveTicketBrief } from "./ticketResolution.js";
@@ -460,13 +460,15 @@ export function registerGoCommand(pi, deps = {}) {
                 return;
             }
             // In-flight guards: the same ticket never runs twice at once in this
-            // process, and at most MAX_CONCURRENT_RUNS runs are in flight.
+            // process, and at most resolveMaxConcurrentRuns() runs are in flight
+            // (default 3; fleet operators raise it via YAGNI_MAX_CONCURRENT_RUNS).
             if (findActiveRunByTicket(ticket)) {
                 notify(`/go ${ticket} is already running - see /go-status.`, "warning");
                 return;
             }
-            if (activeRunCount() >= MAX_CONCURRENT_RUNS) {
-                notify(`${MAX_CONCURRENT_RUNS} /go runs are already in flight; wait for one to finish (see /go-status).`, "warning");
+            const maxConcurrentRuns = resolveMaxConcurrentRuns();
+            if (activeRunCount() >= maxConcurrentRuns) {
+                notify(`${maxConcurrentRuns} /go runs are already in flight; wait for one to finish (see /go-status) or raise YAGNI_MAX_CONCURRENT_RUNS.`, "warning");
                 return;
             }
             // --- Run tree resolution: worktree by default; --here = legacy in-place.

package/dist/extension/pipeline/invocation.d.ts

@@ -3,9 +3,17 @@
  * `buildLaunch` (no spawn, no fs).
  *
  * `buildStageInvocation` produces the per-stage pi PASSTHROUGH argv exactly as
- * the subagent example assembles it (runSingleAgent L294-330):
+ * the subagent example assembles it (runSingleAgent L294-330), with an added
+ * honesty preamble delivered as the FIRST `--append-system-prompt` so the
+ * anti-fabrication rule appears before the persona body in the child's
+ * assembled system prompt:
  *   --mode json -p --no-session --model <tier> --tools <csv>
- *   --append-system-prompt <file> 'Task: <rendered>'
+ *   --append-system-prompt <honesty> --append-system-prompt <file> 'Task: <rendered>'
+ *
+ * Pi concatenates multiple `--append-system-prompt` values with `\n\n` in
+ * array order, so the child sees: [pi base] + [honesty] + [persona] +
+ * [project_context]. The preamble is placed first so open-weight models
+ * encounter the anti-fabrication rule before their role identity.
  *
  * `groundedChildArgv` prepends the grounding pi-args the yagni-code launcher
  * would otherwise add (`-e <self> --provider yagni`) because v1 spawns pi
@@ -17,6 +25,20 @@
  * chain's `step.task.replace(/{previous}/g, …)`.
  */
 import type { PipelineStage, ReviewLens } from "./types.js";
+/**
+ * Anti-fabrication preamble injected as the first `--append-system-prompt` on
+ * every child pi process (both /go stages and subagent tool calls). The
+ * driver-only `ENGINEERING_PRACTICE_SECTION` never reaches children (it's a
+ * launcher flag, and children build their own argv); this preamble ensures
+ * the honesty rule is present in every child regardless.
+ *
+ * Content constraints (same as the enrichment section — the branding scrub's
+ * `scrubOutsideProjectContext` replaces whole-word \bpi\b and the
+ * `PI_DOCS_BLOCK_RE` regex consumes consecutive `- ` bullet lines that follow
+ * a docs header): must not contain the standalone word "pi", must not open
+ * with a `- ` bullet line, no emojis.
+ */
+export declare const CHILD_HONESTY_PREAMBLE: string;
 /** Fill {ticket}/{previous}; an absent var renders as empty string. */
 export declare function renderTemplate(tmpl: string, vars: {
     ticket?: string;

package/dist/extension/pipeline/invocation.js

@@ -3,9 +3,17 @@
  * `buildLaunch` (no spawn, no fs).
  *
  * `buildStageInvocation` produces the per-stage pi PASSTHROUGH argv exactly as
- * the subagent example assembles it (runSingleAgent L294-330):
+ * the subagent example assembles it (runSingleAgent L294-330), with an added
+ * honesty preamble delivered as the FIRST `--append-system-prompt` so the
+ * anti-fabrication rule appears before the persona body in the child's
+ * assembled system prompt:
  *   --mode json -p --no-session --model <tier> --tools <csv>
- *   --append-system-prompt <file> 'Task: <rendered>'
+ *   --append-system-prompt <honesty> --append-system-prompt <file> 'Task: <rendered>'
+ *
+ * Pi concatenates multiple `--append-system-prompt` values with `\n\n` in
+ * array order, so the child sees: [pi base] + [honesty] + [persona] +
+ * [project_context]. The preamble is placed first so open-weight models
+ * encounter the anti-fabrication rule before their role identity.
  *
  * `groundedChildArgv` prepends the grounding pi-args the yagni-code launcher
  * would otherwise add (`-e <self> --provider yagni`) because v1 spawns pi
@@ -16,6 +24,24 @@
  * `renderTemplate` does the {ticket}/{previous} substitution, mirroring the
  * chain's `step.task.replace(/{previous}/g, …)`.
  */
+/**
+ * Anti-fabrication preamble injected as the first `--append-system-prompt` on
+ * every child pi process (both /go stages and subagent tool calls). The
+ * driver-only `ENGINEERING_PRACTICE_SECTION` never reaches children (it's a
+ * launcher flag, and children build their own argv); this preamble ensures
+ * the honesty rule is present in every child regardless.
+ *
+ * Content constraints (same as the enrichment section — the branding scrub's
+ * `scrubOutsideProjectContext` replaces whole-word \bpi\b and the
+ * `PI_DOCS_BLOCK_RE` regex consumes consecutive `- ` bullet lines that follow
+ * a docs header): must not contain the standalone word "pi", must not open
+ * with a `- ` bullet line, no emojis.
+ */
+export const CHILD_HONESTY_PREAMBLE = "Never fabricate file paths, file contents, function signatures, enum values, or code. " +
+    "If you cannot find something, say so explicitly — an honest \"not found\" is more valuable " +
+    "than a plausible-sounding invention. Every file path you cite must be a path you actually " +
+    "read with a tool. If you are uncertain whether something exists, say you are uncertain " +
+    "rather than presenting a guess as a finding.";
 /** Fill {ticket}/{previous}; an absent var renders as empty string. */
 export function renderTemplate(tmpl, vars) {
     return tmpl
@@ -41,6 +67,8 @@ export function buildStageInvocation(stage, ctx) {
         "--tools",
         stage.tools.join(","),
         "--append-system-prompt",
+        CHILD_HONESTY_PREAMBLE,
+        "--append-system-prompt",
         ctx.promptFilePath,
         `Task: ${task}`,
     ];

package/dist/extension/pipeline/personas.js

@@ -57,7 +57,7 @@ Budget discipline: you have a hard output budget, and a plan that gets cut off m
 Keep it concrete; the worker executes it verbatim.`;
 const WORKER_BODY = `You are a worker with full capabilities, operating in an isolated context to implement a plan. Work autonomously and use the tools as needed.
 
-You are grounded. Call ask_yagni before guessing about anything organization- or codebase-specific. Critically: for ANY product-intent call you are forced to make that the plan did not settle — a behavior choice, a tradeoff, an interpretation of intent — call record_decision so the company's decision corpus captures it and the next agent inherits the call instead of re-litigating it.
+You are grounded. Call ask_yagni before guessing about anything organization- or codebase-specific. Treat a confirmed answer as settled; when an answer is an unverified assumption or an inference and your change leans on it, say so in your Notes so the reviewer knows what to check. Critically: for ANY product-intent call you are forced to make that the plan did not settle — a behavior choice, a tradeoff, an interpretation of intent — call record_decision so the company's decision corpus captures it and the next agent inherits the call instead of re-litigating it. When ask_yagni reports no recorded position, follow its instruction and record the assumption you proceed on.
 
 You MUST make the change. If the plan is missing, partial, or appears cut off, do not stop at exploring: implement the ticket directly from the ticket text and the code, calling record_decision for any intent you infer. Ending your turn with no write/edit is a failure.
 
@@ -107,7 +107,7 @@ Risk taxonomy:
 Outcome rules:
 - "deny" is reserved for actions you are VERY CONFIDENT are very dangerous: irreversible destruction, exfiltration of sensitive data, credential probing, production-impacting security weakening. If you are not sure it is that bad, do not deny.
 - "allow" when you are confident the action is safe: read-only, routine dev-loop, or clearly scoped and reversible.
-- "ask" for everything in between — the action might be fine but a human should decide. This is the correct outcome whenever your confidence is middling; prefer ask over deny for anything short of the very-dangerous bar, and prefer allow over ask for routine work (do not hedge routine commands into ask).
+- "ask" for actions where a specific, concrete risk makes you unsure — the action has a plausible path to harm that you cannot rule out by reading the command. Do not ask just because a command "might" do something; ask when you can name the specific thing you are worried about. If you cannot articulate a concrete risk, allow. Prefer allow over ask: routine dev-loop operations, local file writes within a project, and standard git operations (add, commit, fetch) are safe — the agent is already operating in the user's repository with their consent.
 
 Rationale rules:
 - For "ask", the rationale MUST be a specific question addressed to the user, naming the concrete effect that made you unsure — e.g. "This pushes 3 commits to the shared main branch — do you want to publish them now?". You may be told why the static policy routed the command to you; your rationale must ADD information beyond that policy text, not restate it.

package/dist/extension/pipeline/resilience.d.ts

@@ -4,7 +4,8 @@
  * `withResilience(runStage, policy)` is a composable higher-order function that
  * wraps the per-stage child spawn (`runner.ts#runStage`) with the one axis the
  * roadmap calls the whole competitive gap: a per-stage IDLE timeout (no NDJSON
- * event for N ms) and a total WALL-CLOCK timeout, both firing the runner's
+ * event for N ms, deferred while a tool is in flight — see the stall note at
+ * the timer wiring) and a total WALL-CLOCK timeout, both firing the runner's
  * existing SIGTERM -> SIGKILL abort; bounded exponential backoff with jitter; and
  * retry of CLASSIFIED-TRANSIENT outcomes only. One structured telemetry record is
  * emitted per attempt.

package/dist/extension/pipeline/resilience.js

@@ -4,7 +4,8 @@
  * `withResilience(runStage, policy)` is a composable higher-order function that
  * wraps the per-stage child spawn (`runner.ts#runStage`) with the one axis the
  * roadmap calls the whole competitive gap: a per-stage IDLE timeout (no NDJSON
- * event for N ms) and a total WALL-CLOCK timeout, both firing the runner's
+ * event for N ms, deferred while a tool is in flight — see the stall note at
+ * the timer wiring) and a total WALL-CLOCK timeout, both firing the runner's
  * existing SIGTERM -> SIGKILL abort; bounded exponential backoff with jitter; and
  * retry of CLASSIFIED-TRANSIENT outcomes only. One structured telemetry record is
  * emitted per attempt.
@@ -100,19 +101,37 @@ export function withResilience(base, policy, opts = {}) {
                 if (!timeoutController.signal.aborted)
                     timeoutController.abort();
             };
+            // Tools the child has started but not finished. The idle window measures
+            // STALL, not silence: a long quiet tool (a 6-minute test suite, a slow
+            // build) emits no NDJSON between its start and end events, and that is
+            // progress, not a hang. While a tool is in flight the idle expiry defers
+            // and re-arms instead of aborting; the wall-clock timer stays the
+            // backstop for a tool that is genuinely hung.
+            let inFlightTools = 0;
             let idleTimer;
             const armIdle = () => {
                 if (idleTimer)
                     clearTimeout(idleTimer);
-                idleTimer = setTimeout(fireTimeout, policy.idleTimeoutMs);
+                idleTimer = setTimeout(fireIdle, policy.idleTimeoutMs);
                 idleTimer.unref?.();
             };
+            const fireIdle = () => {
+                if (inFlightTools > 0) {
+                    armIdle();
+                    return;
+                }
+                fireTimeout();
+            };
             const wallTimer = setTimeout(fireTimeout, policy.wallTimeoutMs);
             wallTimer.unref?.();
             armIdle();
             const originalOnEvent = deps.onEvent;
             const onEvent = (ev) => {
                 sawAnyEvent = true;
+                if (ev.type === "tool_execution_start")
+                    inFlightTools += 1;
+                else if (ev.type === "tool_execution_end")
+                    inFlightTools = Math.max(0, inFlightTools - 1);
                 armIdle(); // reset the idle window on every live event
                 originalOnEvent?.(ev);
             };

package/dist/extension/pipeline/runRegistry.d.ts

@@ -22,8 +22,16 @@
  * candidate).
  */
 import type { CheckpointRecord, StopReason } from "./types.js";
-/** Bound on simultaneously in-flight /go runs in one process (spec §3b). */
+/** Default bound on simultaneously in-flight /go runs in one process (spec §3b). */
 export declare const MAX_CONCURRENT_RUNS = 3;
+/** Hard ceiling for the env override — a typo must not launch hundreds of runs. */
+export declare const MAX_CONCURRENT_RUNS_CEILING = 32;
+/**
+ * Resolve the in-flight /go cap from the environment. `YAGNI_MAX_CONCURRENT_RUNS`
+ * raises (or lowers) the default for fleet-scale operators; non-numeric or < 1
+ * falls back to the default, and anything above the ceiling clamps to it.
+ */
+export declare function resolveMaxConcurrentRuns(env?: Record<string, string | undefined>): number;
 /**
  * A non-terminal row whose journal has been quiet this long is treated as
  * INTERRUPTED (its process died) rather than still running elsewhere. Sits