@yagni-app/code 0.3.0 → 0.3.2

package/dist/extension/pipeline/runRegistry.js

@@ -24,8 +24,22 @@
 import { appendFileSync, mkdirSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import { codeStateHome } from "../stateHome.js";
-/** Bound on simultaneously in-flight /go runs in one process (spec §3b). */
+/** Default bound on simultaneously in-flight /go runs in one process (spec §3b). */
 export const MAX_CONCURRENT_RUNS = 3;
+/** Hard ceiling for the env override — a typo must not launch hundreds of runs. */
+export const MAX_CONCURRENT_RUNS_CEILING = 32;
+/**
+ * Resolve the in-flight /go cap from the environment. `YAGNI_MAX_CONCURRENT_RUNS`
+ * raises (or lowers) the default for fleet-scale operators; non-numeric or < 1
+ * falls back to the default, and anything above the ceiling clamps to it.
+ */
+export function resolveMaxConcurrentRuns(env = process.env) {
+    const raw = env.YAGNI_MAX_CONCURRENT_RUNS?.trim();
+    const parsed = raw ? Number.parseInt(raw, 10) : NaN;
+    if (!Number.isFinite(parsed) || parsed < 1)
+        return MAX_CONCURRENT_RUNS;
+    return Math.min(parsed, MAX_CONCURRENT_RUNS_CEILING);
+}
 /**
  * A non-terminal row whose journal has been quiet this long is treated as
  * INTERRUPTED (its process died) rather than still running elsewhere. Sits
@@ -106,6 +120,13 @@ const active = new Map();
 export function _resetRunRegistryForTest() {
     active.clear();
 }
+// NOTE on growth: the mirror is append-only and grows without bound on a
+// long-lived install. In-place compaction was reviewed and REMOVED (PR #1698):
+// a fold+rewrite without cross-process exclusion can permanently erase another
+// process's terminal settle (nothing ever re-appends a final row), which would
+// resurrect a finished run as "interrupted" and invite duplicate worktree
+// adoption. Compaction needs an inter-process lock + unique temp files —
+// tracked separately; until then, growth is the safe failure mode.
 /** Fail-soft append of one full row to the mirror (self-heals a torn previous write). */
 function appendRow(row) {
     try {

package/dist/extension/recordDecisionTool.d.ts

@@ -1,5 +1,6 @@
 import type { ToolDefinition } from "@earendil-works/pi-coding-agent";
 import { Type } from "typebox";
+import { type FlywheelState } from "./flywheel.js";
 /** Options for {@link makeRecordDecisionTool}. */
 export interface MakeRecordDecisionToolOptions {
     baseUrl: string;
@@ -7,6 +8,13 @@ export interface MakeRecordDecisionToolOptions {
     fetchImpl?: typeof fetch;
     /** Idempotency-key source (default: crypto.randomUUID); injected in tests. */
     makeIdempotencyKey?: () => string;
+    /**
+     * Shared flywheel session state (Run 7). A record_decision that follows a
+     * surfaced no-position suggestion sends `dedupe: true` — a mid-run agent
+     * has no human to adjudicate a near-duplicate. A human `/decide` never
+     * rides this state.
+     */
+    flywheel?: FlywheelState;
 }
 /** The durable fields of a recorded product-intent decision. */
 export interface RecordDecisionParams {

package/dist/extension/recordDecisionTool.js

@@ -1,5 +1,6 @@
 import { randomUUID } from "node:crypto";
 import { Type } from "typebox";
+import { consumeFlywheelAttribution } from "./flywheel.js";
 import { sendOrSpool } from "./spool.js";
 /**
  * POST a single decision to the token-scoped grounding endpoint and return its
@@ -67,12 +68,20 @@ export function makeRecordDecisionTool(opts) {
             // never bank the same decision twice. Transport failures and 5xx are
             // spooled durably instead of lost (R4 write half).
             const idempotencyKey = (opts.makeIdempotencyKey ?? randomUUID)();
+            // Run 7 flywheel attribution: a record answering the QUESTION a
+            // surfaced no-position suggestion asked about asks the backend to
+            // dedupe against active decisions first (decisive, not advisory — no
+            // human is present). An unrelated record never inherits the flag.
+            const flywheelAttributed = opts.flywheel
+                ? consumeFlywheelAttribution(opts.flywheel, params.question)
+                : false;
             const outcome = await sendOrSpool(opts, "record_decision", "/api/yagni-code/decisions", {
                 question: params.question,
                 decision: params.decision,
                 rationale: params.rationale,
                 repo: params.repo,
                 workItemId: params.workItemId,
+                ...(flywheelAttributed ? { dedupe: true } : {}),
             }, idempotencyKey, signal);
             if (outcome.kind === "rejected") {
                 throw new Error(outcome.message);
@@ -92,6 +101,21 @@ export function makeRecordDecisionTool(opts) {
                 };
             }
             const data = outcome.json;
+            if (data?.deduped) {
+                // The backend matched an existing active decision and inserted
+                // nothing; surface it so the agent leans on the recorded judgment.
+                const existing = data.existing;
+                const summary = existing?.decision ? ` ${existing.decision}` : "";
+                return {
+                    content: [
+                        {
+                            type: "text",
+                            text: `An equivalent decision is already recorded; nothing new was banked.${summary}`,
+                        },
+                    ],
+                    details: { id: existing?.id ?? null, spooled: false },
+                };
+            }
             return {
                 content: [{ type: "text", text: "Recorded the decision in YAGNI." }],
                 details: { id: data?.id ?? null, spooled: false },

package/dist/extension/subagents.d.ts

@@ -20,11 +20,13 @@
 import { type ExtensionAPI, type ExtensionContext } from "@earendil-works/pi-coding-agent";
 import { Type } from "typebox";
 import { runStage } from "./pipeline/runner.js";
-import type { ModelTier, PipelineStage } from "./pipeline/types.js";
+import { type ModelTier, type PipelineStage } from "./pipeline/types.js";
 import { renderSubagentCall, renderSubagentResult } from "./subagentRender.js";
 export declare const SUBAGENT_TOOL_NAME = "subagent";
 export declare const GENERAL_AGENT_NAME = "general";
 export declare const MAX_PARALLEL_SUBAGENTS = 4;
+/** Wider fan-out ceiling while the session is in ultra mode (/ultra). */
+export declare const MAX_PARALLEL_SUBAGENTS_ULTRA = 8;
 /**
  * The default tool surface a subagent gets when its definition declares none:
  * the full working set plus grounded answers, mirroring what a Claude Code
@@ -92,6 +94,8 @@ export interface MakeSubagentToolDeps {
     runStageImpl?: typeof runStage;
     discover?: (deps: DiscoverDeps) => SubagentDef[];
     homeDir?: string;
+    /** Live ultra-mode probe (/ultra): widens the per-call fan-out ceiling. */
+    isUltra?: () => boolean;
 }
 export declare function makeSubagentTool(deps?: MakeSubagentToolDeps): {
     name: string;
@@ -135,6 +139,8 @@ export declare function makeSubagentTool(deps?: MakeSubagentToolDeps): {
 export interface RegisterSubagentsDeps {
     discover?: (deps: DiscoverDeps) => SubagentDef[];
     homeDir?: string;
+    /** Live ultra-mode probe (/ultra): widens the per-call fan-out ceiling. */
+    isUltra?: () => boolean;
 }
 /** Wire the subagent tool and the /agents listing command. */
 export declare function registerSubagents(pi: ExtensionAPI, deps?: RegisterSubagentsDeps): void;

package/dist/extension/subagents.js

@@ -23,7 +23,9 @@ import { delimiter, join } from "node:path";
 import { parseFrontmatter } from "@earendil-works/pi-coding-agent";
 import { Type } from "typebox";
 import { sanitizeCallerSegment } from "./config.js";
+import { withResilience } from "./pipeline/resilience.js";
 import { runStage } from "./pipeline/runner.js";
+import { DEFAULT_RESILIENCE_POLICY } from "./pipeline/types.js";
 import { applyChildEvent, finalizeTask, formatWorkingMessage, newTaskProgress, progressSummaryText, renderSubagentCall, renderSubagentResult, } from "./subagentRender.js";
 /**
  * YAG-471 attribution: the `x-yagni-caller` prefix for a subagent invocation.
@@ -34,6 +36,8 @@ const SUBAGENT_CALLER_PREFIX = "subagent:";
 export const SUBAGENT_TOOL_NAME = "subagent";
 export const GENERAL_AGENT_NAME = "general";
 export const MAX_PARALLEL_SUBAGENTS = 4;
+/** Wider fan-out ceiling while the session is in ultra mode (/ultra). */
+export const MAX_PARALLEL_SUBAGENTS_ULTRA = 8;
 /**
  * The default tool surface a subagent gets when its definition declares none:
  * the full working set plus grounded answers, mirroring what a Claude Code
@@ -68,6 +72,8 @@ const GENERAL_BODY = `You are a capable software-engineering subagent with a fre
 
 You are grounded in how THIS company works: call ask_yagni before inferring a convention, an ownership rule, or anything organization-specific.
 
+Never fabricate file paths, contents, or findings. If you cannot find something, say so.
+
 Your final message is your report back to the driving agent, which has NOT seen what you read or did. Make it compressed and complete: what you did, what you found, exact file paths and key excerpts, and anything the driver must know before continuing.`;
 const GENERAL_AGENT = {
     name: GENERAL_AGENT_NAME,
@@ -83,6 +89,11 @@ not write code and you do not run commands; you read and report.
 You are grounded in how THIS company works: call ask_yagni before inferring a
 convention, an ownership rule, or anything organization-specific.
 
+Never fabricate file paths, contents, or code. Every path you cite must be
+one you actually read with a tool. If you cannot find something, say "not
+found" — a plausible-sounding invention is worse than no answer because the
+driving agent trusts your report.
+
 Your final message is your report back to the driving agent, which has NOT
 seen what you read. Make it compressed and complete: exact file paths, the
 key excerpts, and a one-paragraph map of how the pieces relate. Say what you
@@ -108,6 +119,9 @@ your final message instead of guessing.
 You are grounded in how THIS company works: call ask_yagni before inferring a
 convention, an ownership rule, or anything organization-specific.
 
+Never fabricate file paths or results. Report what you actually did and what
+you actually found.
+
 Your final message is your report back to the driving agent, which has NOT
 seen what you did. List every file you touched, what changed in each, the
 commands you ran with their outcomes, and anything you deliberately left
@@ -123,6 +137,53 @@ const IMPLEMENTER_AGENT = {
     body: IMPLEMENTER_BODY,
     source: "builtin",
 };
+const VERIFICATION_BODY = `You are an adversarial verifier. Another agent
+produced work — a change, a plan, or a claim — and your job is to try to
+BREAK it, not to summarize it. Default to skepticism: hunt for the concrete
+failure scenario (the inputs, state, or sequence that makes it wrong). Bash
+is read-only here (\`git diff\`, \`git log\`, \`git show\`); do NOT modify files
+or run builds.
+
+If your task names a lens (correctness, edge cases, codebase fit, security,
+…), judge ONLY through that lens and leave the rest to your sibling
+verifiers.
+
+You are grounded in how THIS company works: call ask_yagni before inferring
+a convention, an ownership rule, or anything organization-specific.
+
+Never fabricate file paths or findings. If you could not verify something,
+say exactly what you tried and why you could not.
+
+Your final message is your verdict back to the driving agent, which has NOT
+seen what you read. Format:
+## Verdict
+BROKEN or HOLDS, with one sentence why.
+## Findings
+Each real problem: file:line, the concrete failure scenario, severity. No
+style nits.
+## Not verified
+What you could not check, and why.
+
+A HOLDS after real digging is valuable; a rubber stamp is not. If you found
+nothing, say exactly what you tried to break and how.`;
+/** The diamond's reduce layer: refute-first review of completed work on the
+ * advanced tier (judgment is the whole job, so the premium is worth paying —
+ * the server clamps subagent children at advanced anyway). It has no
+ * edit/write tools; bash is included for `git diff`-style inspection and is
+ * restricted to read-only USE by the persona, the same prompt-level stance as
+ * /go's reviewer — not a technical guarantee. */
+const VERIFICATION_AGENT = {
+    name: "verification",
+    description: "Adversarial verification of completed work: tries to refute a change, " +
+        "plan, or claim and reports concrete failure scenarios. Does not edit " +
+        "files. Fan out 2-3 with different lenses (correctness, edge cases, " +
+        "codebase fit) for anything significant and treat agreement as " +
+        "confirmation.",
+    model: "advanced",
+    tools: ["read", "grep", "find", "ls", "bash", "ask_yagni"],
+    body: VERIFICATION_BODY,
+    source: "builtin",
+};
 // Concrete tiers a subagent can actually run on. `balanced` is deliberately NOT
 // a member here even though it is a member of `ModelTier`: a subagent needs
 // ONE model for its whole run, and balanced is a session-level routing policy,
@@ -210,7 +271,7 @@ function loadAgentsFromDir(dir, source) {
 export function discoverSubagents(deps) {
     const home = deps.homeDir ?? homedir();
     const layers = [
-        [GENERAL_AGENT, SEARCHER_AGENT, IMPLEMENTER_AGENT],
+        [GENERAL_AGENT, SEARCHER_AGENT, IMPLEMENTER_AGENT, VERIFICATION_AGENT],
         ...pluginAgentDirs(deps.env ?? process.env).map((dir) => loadAgentsFromDir(dir, "plugin")),
         loadAgentsFromDir(join(home, ".claude", "agents"), "user-claude"),
         loadAgentsFromDir(join(deps.cwd, ".pi", "agents"), "project-pi"),
@@ -261,11 +322,17 @@ const parameters = Type.Object({
         task: Type.String(),
         agent: Type.Optional(Type.String()),
     }), {
-        description: `Run several independent tasks in parallel (max ${MAX_PARALLEL_SUBAGENTS}). Use INSTEAD of task.`,
+        description: `Run several independent tasks in parallel (max ${MAX_PARALLEL_SUBAGENTS}; ${MAX_PARALLEL_SUBAGENTS_ULTRA} in ultra mode). Use INSTEAD of task.`,
     })),
 });
 export function makeSubagentTool(deps = {}) {
-    const run = deps.runStageImpl ?? runStage;
+    // The default runner rides the /go pipeline's resilience wrapper, so a chat
+    // subagent gets the same idle + wall-clock ceilings and transient-only retry
+    // as a /go stage child (previously a hung subagent hung the tool call until
+    // the user pressed Esc). The synthetic stage id is "implement", so the
+    // wrapper's write-gate already refuses to re-run a child that may have
+    // landed a partial edit.
+    const run = deps.runStageImpl ?? withResilience(runStage, DEFAULT_RESILIENCE_POLICY);
     const discover = deps.discover ?? discoverSubagents;
     return {
         name: SUBAGENT_TOOL_NAME,
@@ -293,8 +360,9 @@ export function makeSubagentTool(deps = {}) {
             if (requested.length === 0) {
                 return fail("Error: pass `task` (or a `tasks` array) describing what to do.");
             }
-            if (requested.length > MAX_PARALLEL_SUBAGENTS) {
-                return fail(`Error: at most ${MAX_PARALLEL_SUBAGENTS} parallel tasks per call.`);
+            const maxParallel = deps.isUltra?.() ? MAX_PARALLEL_SUBAGENTS_ULTRA : MAX_PARALLEL_SUBAGENTS;
+            if (requested.length > maxParallel) {
+                return fail(`Error: at most ${maxParallel} parallel tasks per call.`);
             }
             const cwd = ctx?.cwd ?? process.cwd();
             const agents = discover({ cwd, homeDir: deps.homeDir });

package/dist/extension/todos.d.ts

@@ -17,6 +17,16 @@ import { Type } from "typebox";
 export declare const TODO_TOOL_NAME = "todo_write";
 export declare const MAX_TODOS = 50;
 export declare const MAX_TODO_TEXT = 300;
+/**
+ * Staleness-reminder throttle (both counters must trip): a reminder is
+ * eligible only after this many assistant turns since the last todo_write AND
+ * this many since the last reminder. The two-counter shape (staleness gate +
+ * anti-spam gate) mirrors what Claude Code ships for its own todo tool; the
+ * driver model routinely stops updating the board mid-grind (the frozen
+ * "Todos 0/8" report), and a bare description-level instruction does not
+ * survive a long run.
+ */
+export declare const TODO_REMINDER_TURNS = 10;
 /**
  * The desktop's structured state record rides its own widget key, like the
  * `/go` run state: one JSON line the app parses and renders itself, never
@@ -61,6 +71,23 @@ export interface TodoTheme {
 export declare function renderTodoWidget(todos: TodoItem[], theme: TodoTheme): string[];
 /** The desktop state record: exactly one JSON line under TODO_STATE_KEY. */
 export declare function todoStateLine(todos: TodoItem[]): string;
+/**
+ * PURE: is a staleness reminder due? Only when the board has open work (an
+ * empty or fully-completed list never nags) and BOTH throttle counters have
+ * reached {@link TODO_REMINDER_TURNS}.
+ */
+export declare function shouldRemindTodos(input: {
+    todos: TodoItem[];
+    turnsSinceWrite: number;
+    turnsSinceReminder: number;
+}): boolean;
+/**
+ * PURE: the hedged reminder block appended to a tool result when the board has
+ * gone stale. Carries the CURRENT list so the model can reconcile without a
+ * read, and explicitly licenses ignoring it, so an accurate board costs one
+ * glance rather than a spurious todo_write.
+ */
+export declare function formatTodoReminder(todos: TodoItem[]): string;
 /** Replay the branch: the last todo_write result is the canonical list. */
 export declare function reconstructTodos(entries: unknown[]): TodoItem[];
 type TodoParams = {
@@ -104,7 +131,7 @@ export declare function makeTodoTool(get: () => TodoItem[], set: (todos: TodoIte
         isError?: undefined;
     }>;
 };
-/** Wire the tool, the branch-replay events, and the /todos command. */
+/** Wire the tool, the branch-replay events, the staleness reminder, and /todos. */
 export declare function registerTodos(pi: ExtensionAPI): void;
 export {};
 //# sourceMappingURL=todos.d.ts.map

package/dist/extension/todos.js

@@ -17,6 +17,16 @@ import { isDesktopSurface } from "./surface.js";
 export const TODO_TOOL_NAME = "todo_write";
 export const MAX_TODOS = 50;
 export const MAX_TODO_TEXT = 300;
+/**
+ * Staleness-reminder throttle (both counters must trip): a reminder is
+ * eligible only after this many assistant turns since the last todo_write AND
+ * this many since the last reminder. The two-counter shape (staleness gate +
+ * anti-spam gate) mirrors what Claude Code ships for its own todo tool; the
+ * driver model routinely stops updating the board mid-grind (the frozen
+ * "Todos 0/8" report), and a bare description-level instruction does not
+ * survive a long run.
+ */
+export const TODO_REMINDER_TURNS = 10;
 const WIDGET_KEY = "yagni-todos";
 /**
  * The desktop's structured state record rides its own widget key, like the
@@ -101,6 +111,33 @@ export function renderTodoWidget(todos, theme) {
 export function todoStateLine(todos) {
     return JSON.stringify({ v: 1, todos });
 }
+/**
+ * PURE: is a staleness reminder due? Only when the board has open work (an
+ * empty or fully-completed list never nags) and BOTH throttle counters have
+ * reached {@link TODO_REMINDER_TURNS}.
+ */
+export function shouldRemindTodos(input) {
+    const { todos, turnsSinceWrite, turnsSinceReminder } = input;
+    if (todos.length === 0)
+        return false;
+    const { done, total } = todoSummary(todos);
+    if (done === total)
+        return false;
+    return turnsSinceWrite >= TODO_REMINDER_TURNS && turnsSinceReminder >= TODO_REMINDER_TURNS;
+}
+/**
+ * PURE: the hedged reminder block appended to a tool result when the board has
+ * gone stale. Carries the CURRENT list so the model can reconcile without a
+ * read, and explicitly licenses ignoring it, so an accurate board costs one
+ * glance rather than a spurious todo_write.
+ */
+export function formatTodoReminder(todos) {
+    return ("⟦YAGNI todos⟧ The todo_write checklist has not been updated for a while. " +
+        "If the work has moved on, bring it current now: mark finished steps completed, " +
+        "set the step you are on to in_progress, and add newly discovered steps. " +
+        "If the list is already accurate, ignore this.\n" +
+        formatTodoList(todos));
+}
 /** Replay the branch: the last todo_write result is the canonical list. */
 export function reconstructTodos(entries) {
     let todos = [];
@@ -186,9 +223,14 @@ export function makeTodoTool(get, set) {
         },
     };
 }
-/** Wire the tool, the branch-replay events, and the /todos command. */
+/** Wire the tool, the branch-replay events, the staleness reminder, and /todos. */
 export function registerTodos(pi) {
     let todos = [];
+    // Staleness-reminder counters (see TODO_REMINDER_TURNS). Session-local like
+    // the list cache itself; branch replay resets them so a resume/fork never
+    // opens with an instantly-due reminder.
+    let turnsSinceWrite = 0;
+    let turnsSinceReminder = 0;
     const reconstruct = (ctx) => {
         try {
             todos = reconstructTodos(ctx.sessionManager.getBranch());
@@ -196,12 +238,45 @@ export function registerTodos(pi) {
         catch {
             todos = [];
         }
+        turnsSinceWrite = 0;
+        turnsSinceReminder = 0;
         paintWidget(ctx, todos);
     };
     pi.on("session_start", async (_event, ctx) => reconstruct(ctx));
     pi.on("session_tree", async (_event, ctx) => reconstruct(ctx));
+    // Turn counting: one tick per finalized assistant message, the same "turn"
+    // the model experiences between opportunities to call todo_write.
+    pi.on("message_end", async (event) => {
+        if (event.message?.role === "assistant") {
+            turnsSinceWrite += 1;
+            turnsSinceReminder += 1;
+        }
+    });
+    // The reminder rides an existing tool result (the same result-modification
+    // seam ambient recall uses), so it reaches the model mid-run without
+    // spending a turn. Never appended to todo_write's own result, and fail-soft:
+    // a reminder must never break a tool call.
+    pi.on("tool_result", async (event) => {
+        try {
+            if (event.toolName === TODO_TOOL_NAME)
+                return;
+            if (!shouldRemindTodos({ todos, turnsSinceWrite, turnsSinceReminder }))
+                return;
+            turnsSinceReminder = 0;
+            return {
+                content: [
+                    ...event.content,
+                    { type: "text", text: `\n\n${formatTodoReminder(todos)}` },
+                ],
+            };
+        }
+        catch {
+            return;
+        }
+    });
     pi.registerTool(makeTodoTool(() => todos, (next) => {
         todos = next;
+        turnsSinceWrite = 0;
     }));
     pi.registerCommand("todos", {
         description: "Show the agent's current task list for this session.",

package/dist/extension/ultra.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Ultra mode (/ultra) — an explicit, session-scoped dial for aggressive
+ * multi-agent orchestration ("the diamond": fan out → reduce → synthesize).
+ *
+ * Off by default so the trial-default behavior is unchanged; toggling on swaps
+ * the driver's delegation paragraph for the diamond directive (branding.ts's
+ * YAGNI_IDENTITY_ULTRA) and widens the subagent tool's per-call fan-out
+ * ceiling (subagents.ts). The two halves take effect at different moments:
+ * the fan-out ceiling is probed live on every subagent call, but the identity
+ * is read in index.ts's before_agent_start handler, which pi fires only when
+ * a NEW user prompt is submitted — a toggle mid-run leaves the running task on
+ * its existing instructions until the next message (the handler notifies when
+ * that is the case). Ultra is a prompt + ceiling change only: it never touches
+ * the permission mode, the model tier, or the /go pipeline.
+ */
+import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
+export interface UltraHolder {
+    get(): boolean;
+    set(on: boolean): void;
+}
+export declare function createUltraHolder(initial?: boolean): UltraHolder;
+/**
+ * Wire the /ultra command onto a shared holder. No argument toggles; `on` /
+ * `off` set explicitly; `status` reports without changing anything.
+ */
+export declare function registerUltraCommand(pi: ExtensionAPI, holder: UltraHolder): void;
+//# sourceMappingURL=ultra.d.ts.map

package/dist/extension/ultra.js

@@ -0,0 +1,76 @@
+/**
+ * Ultra mode (/ultra) — an explicit, session-scoped dial for aggressive
+ * multi-agent orchestration ("the diamond": fan out → reduce → synthesize).
+ *
+ * Off by default so the trial-default behavior is unchanged; toggling on swaps
+ * the driver's delegation paragraph for the diamond directive (branding.ts's
+ * YAGNI_IDENTITY_ULTRA) and widens the subagent tool's per-call fan-out
+ * ceiling (subagents.ts). The two halves take effect at different moments:
+ * the fan-out ceiling is probed live on every subagent call, but the identity
+ * is read in index.ts's before_agent_start handler, which pi fires only when
+ * a NEW user prompt is submitted — a toggle mid-run leaves the running task on
+ * its existing instructions until the next message (the handler notifies when
+ * that is the case). Ultra is a prompt + ceiling change only: it never touches
+ * the permission mode, the model tier, or the /go pipeline.
+ */
+export function createUltraHolder(initial = false) {
+    let on = initial;
+    return {
+        get: () => on,
+        set: (v) => {
+            on = v;
+        },
+    };
+}
+/** Status chip shown while ultra is on (same footer surface as the /mode chip). */
+const ULTRA_STATUS = "◆ ultra";
+const ULTRA_ON_COPY = "Ultra mode ON: meaningful work fans out to parallel subagents, adversarial " +
+    "verification agents try to break the result, then the agent synthesizes. " +
+    "Expect more subagent spend per task.";
+const ULTRA_OFF_COPY = "Ultra mode OFF: back to delegate-when-useful.";
+/**
+ * Appended when the toggle lands mid-run: the identity swap only applies when
+ * the next prompt is submitted (see the module docblock), so without this note
+ * the chip flips while the running task visibly keeps its old behavior — which
+ * reads as ultra mode being broken.
+ */
+const MID_RUN_NOTE = " The task currently running keeps its existing instructions; the change takes full effect on your next message.";
+/**
+ * Wire the /ultra command onto a shared holder. No argument toggles; `on` /
+ * `off` set explicitly; `status` reports without changing anything.
+ */
+export function registerUltraCommand(pi, holder) {
+    pi.registerCommand("ultra", {
+        description: "Toggle ultra mode: aggressive fan-out/verify/synthesize orchestration. /ultra on | off | status.",
+        handler: async (args, ctx) => {
+            const notify = (m, t) => {
+                if (ctx.hasUI)
+                    ctx.ui.notify(m, t);
+            };
+            const arg = args.trim().toLowerCase();
+            if (arg && arg !== "on" && arg !== "off" && arg !== "status") {
+                notify(`Unknown argument "${arg}". Use /ultra, /ultra on, /ultra off, or /ultra status.`, "warning");
+                return;
+            }
+            if (arg === "status") {
+                notify(holder.get() ? ULTRA_ON_COPY : ULTRA_OFF_COPY, "info");
+                return;
+            }
+            const next = arg === "on" ? true : arg === "off" ? false : !holder.get();
+            holder.set(next);
+            try {
+                if (ctx.hasUI)
+                    ctx.ui.setStatus?.("yagni-ultra", next ? ULTRA_STATUS : undefined);
+            }
+            catch {
+                // The chip is chrome; never let it break /ultra.
+            }
+            // Guarded probe: test fakes (and any minimal harness ctx) may not carry
+            // isIdle, and its absence must read as idle, never as busy.
+            const midRun = typeof ctx.isIdle === "function" && !ctx.isIdle();
+            const copy = next ? ULTRA_ON_COPY : ULTRA_OFF_COPY;
+            notify(midRun ? copy + MID_RUN_NOTE : copy, "info");
+        },
+    });
+}
+//# sourceMappingURL=ultra.js.map

package/dist/login.d.ts

@@ -34,8 +34,10 @@ type OpenRunner = (cmd: string, args: string[]) => Promise<void>;
  *
  *   macOS:   open <url>
  *   Linux:   xdg-open <url>
- *   Windows: cmd /c start "" <url>   (the empty "" is start's window-title slot;
- *            without it `start` swallows the URL as the title and opens nothing)
+ *   Windows: rundll32 url.dll,FileProtocolHandler <url>   (opens the default
+ *            browser without going through cmd.exe — `cmd /c start <url>`
+ *            re-parses its arguments as a shell line, so a hostile URL with
+ *            `&`/`^` metacharacters could execute commands)
  */
 export declare function resolveOpenCommand(url: string, platform?: NodeJS.Platform): {
     cmd: string;

package/dist/login.js

@@ -31,14 +31,17 @@ function isTimeoutError(err) {
  *
  *   macOS:   open <url>
  *   Linux:   xdg-open <url>
- *   Windows: cmd /c start "" <url>   (the empty "" is start's window-title slot;
- *            without it `start` swallows the URL as the title and opens nothing)
+ *   Windows: rundll32 url.dll,FileProtocolHandler <url>   (opens the default
+ *            browser without going through cmd.exe — `cmd /c start <url>`
+ *            re-parses its arguments as a shell line, so a hostile URL with
+ *            `&`/`^` metacharacters could execute commands)
  */
 export function resolveOpenCommand(url, platform = process.platform) {
     if (platform === "darwin")
         return { cmd: "open", args: [url] };
-    if (platform === "win32")
-        return { cmd: "cmd", args: ["/c", "start", "", url] };
+    if (platform === "win32") {
+        return { cmd: "rundll32", args: ["url.dll,FileProtocolHandler", url] };
+    }
     return { cmd: "xdg-open", args: [url] };
 }
 const spawnRunner = (cmd, args) => new Promise((resolve, reject) => {
@@ -50,6 +53,18 @@ const spawnRunner = (cmd, args) => new Promise((resolve, reject) => {
  * URL is still printed for manual copy. `runner` is injectable for tests.
  */
 export const realOpenUrl = (url, runner = spawnRunner) => {
+    // Only ever hand http(s) URLs to the OS opener — refuse file:, javascript:,
+    // or custom schemes a compromised server response could try to smuggle in.
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        return Promise.resolve();
+    }
+    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+        return Promise.resolve();
+    }
     const { cmd, args } = resolveOpenCommand(url);
     return runner(cmd, args).catch(() => {
         // Silently fail — the user can still copy the URL manually.

package/dist/promptEnrichment.d.ts

@@ -36,5 +36,5 @@ export declare function promptEnrichmentDisabled(env: NodeJS.ProcessEnv): boolea
  * model, and the load-bearing instructions (ask_yagni contract, delegation)
  * live elsewhere in the prompt.
  */
-export declare const ENGINEERING_PRACTICE_SECTION = "Engineering practice:\n\nBias to action: when the user asks you to implement, fix, or change something, use your tools to make the actual edits and run the actual commands \u2014 do not answer with a description of what you would do, or with code for the user to apply themselves. When the user asks HOW to approach something, answer the question first; do not jump into making changes they have not asked for.\n\nConventions:\n- Never assume a library is available, however well known. Before using one, confirm the project already depends on it (its package manifest, or imports in neighboring files).\n- When editing, read the surrounding code and its imports first; match the file's existing style, naming, and patterns rather than introducing your own.\n- When creating a new file or component, study an existing sibling first and follow its structure.\n- Never write code that logs or exposes secrets, keys, or credentials.\n\nVerification:\n- Consider what the code you are changing is supposed to do (from its name, location, and callers) before you change it.\n- Verify changes with the project's own tests when possible. Never assume a test framework or command \u2014 check the README, package scripts, or neighboring tests for the real one.\n- After completing a task, run the project's lint and typecheck commands if you know them; if you cannot find them, ask the user and suggest recording them in AGENTS.md for next time.\n\nVersion control:\n- No unsolicited commits: commit only when the user asked for one or the task at hand clearly calls for it.\n\nGit safety:\n- You may be in a dirty git worktree. Never revert existing changes you did not make unless explicitly asked \u2014 these were made by the user.\n- If there are unrelated changes in files you are touching, read and work with them rather than reverting.\n- If changes appear in unrelated files, ignore them and do not revert.\n- Do not amend a commit unless explicitly asked.\n- If you notice unexpected changes you did not make while working, stop immediately and ask the user.\n- Never use destructive git commands (git reset --hard, git checkout --) unless the user explicitly requests or approves them.\n\nTodo discipline:\n- Track multi-step work with todo_write: keep exactly one item in_progress at a time, mark items completed the moment they are done, and add newly discovered steps as pending.\n- Do not batch-complete items or create single-step plans. Skip planning for trivially small work (~25% of tasks).\n\nMode awareness:\n- In auto mode, proactively run tests, lint, and typecheck after your changes.\n- In review mode, propose verification steps but wait for approval before running them.\n- In plan mode, explore and design only \u2014 the gate holds all writes.\n\nCommunication:\n- Answer directly, without preamble or postamble (\"Here is what I will do next...\", \"Based on the information provided...\"). Match the length of your answer to the question.\n- After making edits, report the outcome briefly; do not restate the diff or explain the code you just wrote unless asked.\n- Do not add code comments that narrate what you changed or why the change is correct; comments are for future readers of the code.\n- Reference code as file_path:line_number so the user can jump to it.\n- Before running a non-trivial command that changes state, say in one line what it does and why.\n- Never guess or fabricate URLs. Only use URLs the user provided or that appear in local files.\n- No emojis unless the user asks for them.";
+export declare const ENGINEERING_PRACTICE_SECTION = "Engineering practice:\n\nAnswering vs acting: distinguish what the user is asking for before responding. When the user asks you to analyze, investigate, find a root cause, study how something works, explore an approach, or asks a strategic or advisory question (\"should we...\", \"what's your read on...\", \"go/no-go on...\"), answer in prose \u2014 do not start coding or editing files. When the user asks you to implement, fix, or change something, use your tools to make the actual edits and run the actual commands \u2014 do not answer with a description of what you would do, or with code for the user to apply themselves.\n\nConventions:\n- Never assume a library is available, however well known. Before using one, confirm the project already depends on it (its package manifest, or imports in neighboring files).\n- When editing, read the surrounding code and its imports first; match the file's existing style, naming, and patterns rather than introducing your own.\n- When creating a new file or component, study an existing sibling first and follow its structure.\n- Never write code that logs or exposes secrets, keys, or credentials.\n\nVerification:\n- Consider what the code you are changing is supposed to do (from its name, location, and callers) before you change it.\n- Verify changes with the project's own tests when possible. Never assume a test framework or command \u2014 check the README, package scripts, or neighboring tests for the real one.\n- After completing a task, run the project's lint and typecheck commands if you know them; if you cannot find them, ask the user and suggest recording them in AGENTS.md for next time.\n\nVersion control:\n- No unsolicited commits: commit only when the user asked for one or the task at hand clearly calls for it.\n\nGit safety:\n- You may be in a dirty git worktree. Never revert existing changes you did not make unless explicitly asked \u2014 these were made by the user.\n- If there are unrelated changes in files you are touching, read and work with them rather than reverting.\n- If changes appear in unrelated files, ignore them and do not revert.\n- Do not amend a commit unless explicitly asked.\n- If you notice unexpected changes you did not make while working, stop immediately and ask the user.\n- Never use destructive git commands (git reset --hard, git checkout --) unless the user explicitly requests or approves them.\n\nTodo discipline:\n- Track multi-step work with todo_write: keep exactly one item in_progress at a time, mark items completed the moment they are done, and add newly discovered steps as pending.\n- Do not batch-complete items or create single-step plans. Skip planning for trivially small work (~25% of tasks).\n\nMode awareness:\n- In auto mode, proactively run tests, lint, and typecheck after your changes.\n- In review mode, propose verification steps but wait for approval before running them.\n- In plan mode, explore and design only \u2014 the gate holds all writes.\n\nCommunication:\n- Answer directly, without preamble or postamble (\"Here is what I will do next...\", \"Based on the information provided...\"). Match the length of your answer to the question.\n- After making edits, report the outcome briefly; do not restate the diff or explain the code you just wrote unless asked.\n- Do not add code comments that narrate what you changed or why the change is correct; comments are for future readers of the code.\n- Reference code as file_path:line_number so the user can jump to it.\n- Before running a non-trivial command that changes state, say in one line what it does and why.\n- Never guess or fabricate URLs. Only use URLs the user provided or that appear in local files.\n- No emojis unless the user asks for them.";
 //# sourceMappingURL=promptEnrichment.d.ts.map

package/dist/promptEnrichment.js

@@ -41,7 +41,7 @@ export function promptEnrichmentDisabled(env) {
  */
 export const ENGINEERING_PRACTICE_SECTION = `Engineering practice:
 
-Bias to action: when the user asks you to implement, fix, or change something, use your tools to make the actual edits and run the actual commands — do not answer with a description of what you would do, or with code for the user to apply themselves. When the user asks HOW to approach something, answer the question first; do not jump into making changes they have not asked for.
+Answering vs acting: distinguish what the user is asking for before responding. When the user asks you to analyze, investigate, find a root cause, study how something works, explore an approach, or asks a strategic or advisory question ("should we...", "what's your read on...", "go/no-go on..."), answer in prose — do not start coding or editing files. When the user asks you to implement, fix, or change something, use your tools to make the actual edits and run the actual commands — do not answer with a description of what you would do, or with code for the user to apply themselves.
 
 Conventions:
 - Never assume a library is available, however well known. Before using one, confirm the project already depends on it (its package manifest, or imports in neighboring files).