@yagni-app/code 0.3.4 → 1.0.0

package/dist/extension/branding.js

@@ -75,6 +75,62 @@ export const ULTRA_DELEGATION_PARAGRAPH = "Delegation (ultra mode): the user has
  * module stays a pure string, with no env dependency of its own.
  */
 export const YAGNI_IDENTITY_DRIVER = `${YAGNI_IDENTITY}\n\n${DRIVER_DELEGATION_PARAGRAPH}`;
+/**
+ * Standing rule that tickets must be read for their images, not just their
+ * text. Injected into EVERY process (driver, `/go` stage children, subagents)
+ * via brandSystemPrompt, so the guarantee holds by whichever method a ticket is
+ * read (the `linear` CLI, a connector tool, MCP, a direct API call). Once the
+ * image reaches `read`, the existing read → image_url → visionRerouteTier
+ * machinery takes over and lands the turn on a seeing tier automatically.
+ *
+ * Content constraints (parity with CHILD_HONESTY_PREAMBLE in
+ * pipeline/invocation.ts): must not contain the standalone word "pi", must not
+ * open with a `- ` bullet line, no emojis.
+ */
+export const TICKET_IMAGE_RULE = "When you read or fetch a ticket from any tracker (Linear, Jira, or another), " +
+    "by any method — the `linear` CLI, a connector tool, MCP, or a direct API call — " +
+    "treat every image embedded in or attached to that ticket as required input, not " +
+    "decoration. Before you rely on the ticket's contents, get each image onto disk " +
+    "as a local file and read it with the `read` tool. Never claim to understand a " +
+    "ticket whose images you have not actually looked at.";
+/** Stable header that starts the ticket-image rule section (idempotency anchor). */
+const TICKET_IMAGE_RULE_HEADER = "## Rule: always read a ticket's images";
+/**
+ * The injected-reminder framing (YAG-574, Change A prerequisite). Claude Code
+ * carries this exact sentence in every system prompt so its whole reminder
+ * family (including its own silent-turn reminder) is legible as system-
+ * injected rather than misread as part of the tool output they ride on. We
+ * adopt it for the same reason: our silent-turn nudge arrives stapled to a
+ * `psql`/`bash` result, and without this it reads as query output.
+ */
+export const SYSTEM_REMINDER_FRAMING = "Tool results and user messages may include <system-reminder> tags. " +
+    "<system-reminder> tags contain useful information and reminders. They are " +
+    "automatically added by the system, and bear no direct relation to the " +
+    "specific tool results or user messages in which they appear.";
+/**
+ * The communication contract (YAG-574, Change B). Adapted from Claude Code's
+ * `SendUserMessage`/`Brief` prompt: ack in one line before going to look, then
+ * work, then result; a checkpoint between them only when something useful
+ * happened — a decision, a surprise, a phase boundary — never filler like
+ * "running tests…"; keep messages tight and second-person. Complements the
+ * silent-turn nudge by spelling out what "keep the user updated" means.
+ */
+export const COMMUNICATION_CONTRACT = "Keep the user in the loop as you work. Acknowledge in one line before going " +
+    "to look, then report the result when you have it. Between the two, send a " +
+    "short checkpoint when something useful happened — a decision made, a " +
+    "surprise, a phase change — not for filler like running a test or reading a " +
+    "file. Keep every message tight: the decision, the file:line, the PR number. " +
+    "Address the user directly (second person).";
+/**
+ * Write-findings-down (YAG-574, Change B). Claude Code's version ties the
+ * habit to result-clearing, which we do not do; reworded to the failure we
+ * actually saw, the model re-deriving the same answer turn after turn because
+ * nothing pushed it to commit a finding to its response (which is also what
+ * makes the user see it).
+ */
+export const WRITE_FINDINGS_DOWN = "When working with tool results, write down any important information you " +
+    "might need later in your response, so you do not re-derive it turn after " +
+    "turn.";
 /** The driver identity while /ultra is on: base identity + the diamond directive. */
 export const YAGNI_IDENTITY_ULTRA = `${YAGNI_IDENTITY}\n\n${ULTRA_DELEGATION_PARAGRAPH}`;
 /**
@@ -186,6 +242,26 @@ export function brandSystemPrompt(original, opts = {}) {
     if (rules && rulesHeader && !s.includes(rulesHeader)) {
         s = `${s}\n\n${rules}`;
     }
+    // 5b. Ticket-image rule — a standing directive placed AFTER the user's rules
+    // (so a long, noisy rules block cannot bury it) but BEFORE the closing
+    // reminder (which stays the most-recent instruction). The idempotency guard
+    // keys on the stable section header, mirroring the rules guard above.
+    if (!s.includes(TICKET_IMAGE_RULE_HEADER)) {
+        s = `${s}\n\n${TICKET_IMAGE_RULE_HEADER}\n${TICKET_IMAGE_RULE}`;
+    }
+    // 5c. YAG-574: the injected-reminder framing (which makes the silent-turn
+    // nudge legible) and the two communication lines (Change B). Appended after
+    // everything user-provided but before the closing reminder, each guarded by
+    // its own stable anchor so re-branding never duplicates them.
+    if (!s.includes(SYSTEM_REMINDER_FRAMING)) {
+        s = `${s}\n\n${SYSTEM_REMINDER_FRAMING}`;
+    }
+    if (!s.includes(COMMUNICATION_CONTRACT)) {
+        s = `${s}\n\n${COMMUNICATION_CONTRACT}`;
+    }
+    if (!s.includes(WRITE_FINDINGS_DOWN)) {
+        s = `${s}\n\n${WRITE_FINDINGS_DOWN}`;
+    }
     // 6. Closing reinforcement. Weak open-weight models weight the most recent
     // instruction heavily, and the user's own project files may name other
     // harnesses; a trailing reminder keeps the agent from claiming one as its own.

package/dist/extension/cmux/index.d.ts

@@ -1,3 +1,19 @@
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
-export declare function registerCmuxBridge(pi: ExtensionAPI): void;
+import { type SessionState } from "./state.js";
+import { type SummarizeTitleResult } from "../sessionTitle/summarize.js";
+/** Injectable seams so the bridge's state machine is testable without a child. */
+export interface CmuxBridgeDeps {
+    summarize?: (prompt: string, deps?: {
+        cwd?: string;
+    }) => Promise<SummarizeTitleResult>;
+}
+export declare function registerCmuxBridge(pi: ExtensionAPI, deps?: CmuxBridgeDeps): void;
+/**
+ * The naming half of `publishCompletion`, extracted so the placeholder→final
+ * guard is directly testable without a child process. Once a session's title
+ * has been upgraded (or the upgrade was attempted), a later settle does nothing.
+ */
+export declare function upgradeTitleOnce(state: SessionState, summarize: (prompt: string, deps?: {
+    cwd?: string;
+}) => Promise<SummarizeTitleResult>, setTitle: ((title: string) => void) | undefined, onFail: (reason: string) => void, cwd: string): Promise<void>;
 //# sourceMappingURL=index.d.ts.map

package/dist/extension/cmux/index.js

@@ -3,7 +3,9 @@ import { join } from "node:path";
 import { CmuxDispatcher } from "./dispatcher.js";
 import { stateFor, snapshotContext, beginTurn, currentTurnId, finishTurn, settleTurn, lastAssistantMessage, firstString, objectValue, warn, } from "./state.js";
 import { sendHook, ensureResumeBinding, clearResumeBinding, releaseSessionRuntime, } from "./hooks.js";
-import { renameWorkspaceFromPrompt } from "./naming.js";
+import { isDriverCaller } from "../config.js";
+import { sessionTitle } from "../sessionTitle/title.js";
+import { summarizeTitle } from "../sessionTitle/summarize.js";
 /** Remove a stale cmux-installed extension so hooks don't double-fire. */
 function removeStaleManagedExtension() {
     const agentDir = process.env.PI_CODING_AGENT_DIR || process.env.YAGNI_CODING_AGENT_DIR;
@@ -24,11 +26,17 @@ function removeStaleManagedExtension() {
     }
     catch { }
 }
-export function registerCmuxBridge(pi) {
+export function registerCmuxBridge(pi, deps = {}) {
     if (!process.env.CMUX_SURFACE_ID)
         return;
     if (process.env.CMUX_PI_HOOKS_DISABLED === "1")
         return;
+    // A child process (guardian consult, advisor, /go stage, subagent) has no
+    // direct user — reporting its internals to cmux would overwrite the driver
+    // session's card with e.g. the Guardian consult prompt/verdict.
+    if (!isDriverCaller())
+        return;
+    const summarize = deps.summarize ?? summarizeTitle;
     const dispatcher = new CmuxDispatcher();
     const sessionStates = new Map();
     const lifecycleTails = new Map();
@@ -74,6 +82,18 @@ export function registerCmuxBridge(pi) {
         if (typeof event.prompt === "string" && event.prompt.trim()) {
             st.lastPrompt = event.prompt.trim();
         }
+        // Set the terminal title to the heuristic session title immediately at the
+        // first prompt (mirroring Claude's derive-then-upgrade: the tab is named
+        // from the prompt, not the model reply). cmux freezes auto-titling on its
+        // own once the user sets a manual name (customTitle), so we never clobber it.
+        // The optional LLM upgrade happens later on agent_settled.
+        if (!st.nameState && typeof event.prompt === "string" && event.prompt.trim()) {
+            const placeholder = sessionTitle(event.prompt.trim());
+            if (placeholder) {
+                st.nameState = "placeholder";
+                context.setTitle?.(placeholder);
+            }
+        }
         enqueueLifecycleTask(sessionId, context, () => sendHook(dispatcher, "prompt-submit", context, { prompt: event.prompt, turn_id: turnId }));
     });
     pi.on("agent_end", (event, ctx) => {
@@ -104,7 +124,7 @@ export function registerCmuxBridge(pi) {
             return;
         const completion = settleTurn(sessionStates, sessionId);
         if (completion) {
-            enqueueLifecycleTask(sessionId, context, () => publishCompletion(dispatcher, sessionStates, context, sessionId, completion));
+            enqueueLifecycleTask(sessionId, context, () => publishCompletion(dispatcher, sessionStates, context, sessionId, completion, summarize));
         }
     });
     pi.on("session_shutdown", async (event, ctx) => {
@@ -133,7 +153,27 @@ export function registerCmuxBridge(pi) {
         });
     });
 }
-async function publishCompletion(dispatcher, sessionStates, context, sessionId, completion) {
+/**
+ * The naming half of `publishCompletion`, extracted so the placeholder→final
+ * guard is directly testable without a child process. Once a session's title
+ * has been upgraded (or the upgrade was attempted), a later settle does nothing.
+ */
+export async function upgradeTitleOnce(state, summarize, setTitle, onFail, cwd) {
+    if (state.nameState !== "placeholder")
+        return;
+    state.nameState = "final";
+    const prompt = state.lastPrompt;
+    if (!prompt)
+        return;
+    const result = await summarize(prompt, { cwd });
+    if (result.ok) {
+        setTitle?.(result.title);
+    }
+    else {
+        onFail(result.reason);
+    }
+}
+async function publishCompletion(dispatcher, sessionStates, context, sessionId, completion, summarize) {
     const stopPayload = {
         last_assistant_message: completion.lastAssistantMessage,
         turn_id: completion.turnId,
@@ -147,9 +187,8 @@ async function publishCompletion(dispatcher, sessionStates, context, sessionId,
         stopPayload.cmux_notification_routed = true;
     await sendHook(dispatcher, "stop", context, stopPayload);
     const state = stateFor(sessionStates, sessionId);
-    if (!state.hasNamed) {
-        renameWorkspaceFromPrompt(dispatcher, sessionStates, context, sessionId);
-        state.hasNamed = true;
-    }
+    // Upgrade the heuristic placeholder to an LLM-summarized title, once (see
+    // upgradeTitleOnce). A failed summary keeps the placeholder in place.
+    await upgradeTitleOnce(state, summarize, context.setTitle, (reason) => warn(context, "title summary failed; keeping heuristic title", { session_id: sessionId, reason }), context.cwd);
 }
 //# sourceMappingURL=index.js.map

package/dist/extension/cmux/state.d.ts

@@ -4,18 +4,22 @@ export interface PendingCompletion {
     notificationType: string;
     turnId: string;
 }
+/** The naming lifecycle of a session's cmux workspace title. */
+export type NameState = "unnamed" | "placeholder" | "final";
 export interface SessionState {
     nextTurn: number;
     activeTurnId?: string;
     pendingCompletion?: PendingCompletion;
     stopped: boolean;
     lastPrompt?: string;
-    hasNamed?: boolean;
+    nameState?: NameState;
 }
 export interface PiExtensionContextSnapshot {
     readonly sessionId: string | null;
     readonly cwd: string;
     readonly notifyWarning?: () => void;
+    /** Set the terminal tab/window title (pi's OSC 0), mirroring Claude's title channel. */
+    readonly setTitle?: (title: string) => void;
 }
 export declare function firstString(...values: unknown[]): string | null;
 export declare function objectValue(value: unknown, keys: string[]): unknown;

package/dist/extension/cmux/state.js

@@ -1,3 +1,4 @@
+import { logEvent } from "../errorSink.js";
 export function firstString(...values) {
     for (const value of values) {
         if (typeof value === "string" && value.trim().length > 0)
@@ -67,14 +68,18 @@ export function snapshotContext(ctx) {
         return { sessionId: null, cwd: process.cwd() };
     }
     let notifyWarning;
+    let setTitle;
     try {
         const ui = ctx.ui;
         if (typeof ui?.notify === "function") {
             notifyWarning = () => ui.notify?.("cmux integration warning — check the terminal for details", "warning");
         }
+        if (typeof ui?.setTitle === "function") {
+            setTitle = (title) => ui.setTitle?.(title);
+        }
     }
     catch { }
-    return { sessionId: sessionIdFrom(ctx), cwd: cwdFrom(ctx), notifyWarning };
+    return { sessionId: sessionIdFrom(ctx), cwd: cwdFrom(ctx), notifyWarning, setTitle };
 }
 export function stateFor(sessionStates, sessionId) {
     let state = sessionStates.get(sessionId);
@@ -125,13 +130,15 @@ export function settleTurn(sessionStates, sessionId) {
     return completion;
 }
 export function warn(ctx, message, details = {}, notifyUser = false) {
-    const payload = { source: "yagni-cmux-bridge", level: "warning", message, ...details };
-    try {
-        console.warn(JSON.stringify(payload));
-    }
-    catch {
-        console.warn(`[yagni-cmux-bridge] ${message}`);
-    }
+    // The TUI is in raw mode: writing to stdout/stderr corrupts the terminal (the
+    // JSON was landing at the prompt cursor). Route warnings/errors to the unified
+    // local sink instead — never to the terminal.
+    logEvent({
+        source: "cmux",
+        level: "warn",
+        event: "cmux_bridge",
+        fields: { message, ...details },
+    });
     if (notifyUser) {
         try {
             ctx?.notifyWarning?.();

package/dist/extension/crashReport.js

@@ -27,6 +27,7 @@
 import { spawn } from "node:child_process";
 import { scrubSecrets } from "./pipeline/scrubSecrets.js";
 import { isDesktopSurface } from "./surface.js";
+import { logEvent } from "./errorSink.js";
 const defaultSpawn = (command, args, options) => spawn(command, args, options);
 export const CRASH_REPORT_DISABLE_ENV = "YAGNI_DISABLE_CRASH_REPORTS";
 export const CRASH_REPORT_TIMEOUT_MS = 1_500;
@@ -267,6 +268,17 @@ export function reportFatalCrash(error, opts, context) {
 export function installUncaughtExceptionMonitor(opts, proc = process) {
     proc.on("uncaughtExceptionMonitor", (err) => {
         reportFatalCrash(err, opts, "uncaught-exception");
+        // Also seed the local error trail (best-effort): the crash report is a
+        // sanitized POST, but the ON-DISK trail is what /feedback binds for a
+        // report someone files next session.
+        logEvent({
+            source: "tool",
+            level: "error",
+            event: "uncaught_exception",
+            sessionId: process.env.YAGNI_SESSION_ID ?? undefined,
+            flush: "sync",
+            fields: { errorClass: err instanceof Error ? err.name || "Error" : "Error" },
+        });
     });
 }
 //# sourceMappingURL=crashReport.js.map

package/dist/extension/decisionCapture.js

@@ -17,6 +17,7 @@
  * never affects the tool call that triggered it.
  */
 import { bankDecision } from "./decisions.js";
+import { logEvent } from "./errorSink.js";
 /** At most one capture prompt per this window (spec: 10 minutes). */
 export const CAPTURE_DEBOUNCE_MS = 10 * 60 * 1000;
 /** Build a session-scoped decision capture (holds the debounce timestamp). */
@@ -54,10 +55,12 @@ export function makeDecisionCapture(deps) {
                     ctx.ui.notify("Saved the decision locally; it will sync automatically.", "info");
                 }
                 else {
+                    logEvent({ source: "decision-capture", level: "error", event: "capture_failed", fields: { kind: outcome.kind } });
                     ctx.ui.notify(outcome.message, "error");
                 }
             }
             catch {
+                logEvent({ source: "decision-capture", level: "error", event: "capture_failed", fields: { kind: "threw" } });
                 /* fail-soft: a capture failure never affects the tool call */
             }
         },

package/dist/extension/decisions.js

@@ -20,6 +20,7 @@
 import { randomUUID } from "node:crypto";
 import { friendlyFetchError, METERED_POST_FETCH_POLICY, resilientFetch } from "./resilientFetch.js";
 import { sendOrSpool } from "./spool.js";
+import { logEvent } from "./errorSink.js";
 /**
  * Bank a `cli_correction` decision durably. Every logical write carries a
  * generated idempotencyKey; the backend dedups on it, so a spool replay or a
@@ -151,6 +152,7 @@ export function registerDecisionCommands(pi, opts) {
                 notify(notice.message, notice.type);
             }
             catch (err) {
+                logEvent({ source: "decisions", level: "error", event: "decide_failed", fields: { op: "decide" } });
                 notify(`Could not record the decision: ${err instanceof Error ? err.message : String(err)}`, "error");
             }
         },
@@ -183,6 +185,7 @@ export function registerDecisionCommands(pi, opts) {
                     notify(`Superseded decision ${shortId(id)}.`, "info");
                 }
                 catch (err) {
+                    logEvent({ source: "decisions", level: "error", event: "supersede_failed", fields: { op: "supersede" } });
                     notify(`Could not supersede decision: ${err instanceof Error ? err.message : String(err)}`, "error");
                 }
                 return;
@@ -192,6 +195,7 @@ export function registerDecisionCommands(pi, opts) {
                 await pi.sendUserMessage(formatDecisionsList(items));
             }
             catch (err) {
+                logEvent({ source: "decisions", level: "error", event: "list_failed", fields: { op: "list" } });
                 notify(`Could not list decisions: ${err instanceof Error ? err.message : String(err)}`, "error");
             }
         },

package/dist/extension/diagnostics.d.ts

@@ -12,7 +12,9 @@
  * A support flow can tail this file and POST it with the user's consent;
  * nothing is uploaded automatically.
  */
+import { readSessionTrail } from "./errorSink.js";
 export declare function _setDiagnosticsHomeForTest(dir: string | null): void;
+/** Active unified-sink path (one rotating per-day JSONL for all sources). */
 export declare function diagnosticsLogPath(): string;
 /** Layer A: verbose mode. `YAGNI_DEBUG=1` (or "true") turns on extra detail. */
 export declare function isDebug(env?: NodeJS.ProcessEnv): boolean;
@@ -34,8 +36,37 @@ export interface ImagePasteEvent {
  * prompt. `detail` is included only when YAGNI_DEBUG is on.
  */
 export declare function logImagePaste(ev: ImagePasteEvent): void;
+export interface AskQuestionEvent {
+    /** Stable event name: "key" | "finish" | "render" | "navigate" | "other_key". */
+    event: string;
+    /** Human-readable description; NEVER user-typed text or question content. */
+    detail?: string;
+    selectedIndex?: number;
+    otherIndex?: number;
+    otherLen?: number;
+    /** Raw key bytes, escaped (only for debug). */
+    key?: string;
+    /** Resolution status when the tool finishes: selected | other | cancelled. */
+    status?: string;
+    /** Whether the question is multiSelect at the time of the event. */
+    multi?: boolean;
+    /** 0-based index of the question within this tool call (multi-question runs). */
+    qIndex?: number;
+    /** Whether the "Other" row auto-check is on (multi-select). */
+    checked?: boolean;
+}
+/**
+ * Append one sanitized ask-user-question event to the unified sink
+ * (source:"ask-question").
+ * Fail-soft and hermetically gated under `node --test` exactly like
+ * `logImagePaste`. Never logs user-typed text, question text, or option labels
+ * — only indices, lengths, key bytes (escaped), and resolution status.
+ */
+export declare function logAskQuestion(ev: AskQuestionEvent): void;
 /** Read the most recent log content (for a user-triggered report). */
 export declare function readRecentDiagnostics(maxBytes?: number): string;
 /** List existing diagnostic log files (active + rotations), for a report. */
 export declare function listDiagnosticFiles(): string[];
+/** Re-export the session-scoped trail reader for the /feedback flow. */
+export { readSessionTrail };
 //# sourceMappingURL=diagnostics.d.ts.map

package/dist/extension/diagnostics.js

@@ -12,22 +12,19 @@
  * A support flow can tail this file and POST it with the user's consent;
  * nothing is uploaded automatically.
  */
-import { appendFileSync, mkdirSync, readFileSync, readdirSync, renameSync, statSync, } from "node:fs";
+import { readFileSync, readdirSync } from "node:fs";
 import { dirname, join, basename } from "node:path";
-import { codeStateHome } from "./stateHome.js";
+import { _setErrorSinkHomeForTest, logEvent, errorSinkPath, readSessionTrail, } from "./errorSink.js";
 /** Test seam (mirrors `_setYagniCodeHomeForTest`): point the log at a tmpdir. */
 let homeOverride = null;
 export function _setDiagnosticsHomeForTest(dir) {
     homeOverride = dir;
+    _setErrorSinkHomeForTest(dir);
 }
-function yagniCodeHome() {
-    return codeStateHome(homeOverride);
-}
+/** Active unified-sink path (one rotating per-day JSONL for all sources). */
 export function diagnosticsLogPath() {
-    return join(yagniCodeHome(), "logs", "image-paste.log");
+    return errorSinkPath();
 }
-const MAX_LOG_BYTES = 256 * 1024; // rotate the active file past this
-const KEEP_ROTATIONS = 2; // keep image-paste.log.1 and .2 alongside the active file
 /** Layer A: verbose mode. `YAGNI_DEBUG=1` (or "true") turns on extra detail. */
 export function isDebug(env = process.env) {
     const v = env.YAGNI_DEBUG;
@@ -38,56 +35,55 @@ export function isDebug(env = process.env) {
  * prompt. `detail` is included only when YAGNI_DEBUG is on.
  */
 export function logImagePaste(ev) {
-    try {
-        // Hermetic under `node --test`: never touch the real home dir from a test
-        // unless the test explicitly stubbed it. Writing to the runner's $HOME made
-        // the suite's exit depend on the CI filesystem (a read-only or slow $HOME
-        // could stall the write), which is the leading suspect for the CI hang.
-        if (process.env.NODE_TEST_CONTEXT && homeOverride === null)
-            return;
-        const line = {
-            ts: new Date().toISOString(),
-            event: ev.event,
-            ...(ev.outcome !== undefined ? { outcome: ev.outcome } : {}),
-            ...(ev.mimeType !== undefined ? { mimeType: ev.mimeType } : {}),
-            ...(ev.bytes !== undefined ? { bytes: ev.bytes } : {}),
-            ...(ev.imageCount !== undefined ? { imageCount: ev.imageCount } : {}),
-            ...(ev.file !== undefined ? { file: basename(ev.file) } : {}),
-            ...(ev.detail !== undefined && isDebug() ? { detail: ev.detail } : {}),
-        };
-        const path = diagnosticsLogPath();
-        mkdirSync(dirname(path), { recursive: true });
-        rotateIfNeeded(path);
-        appendFileSync(path, JSON.stringify(line) + "\n", "utf8");
-    }
-    catch {
-        /* logging must never throw into the editor */
-    }
+    // The unified sink: content-free fields are always-on, the debug-only
+    // `detail` rides level:debug (never bound by /feedback).
+    const fields = {
+        ...(ev.outcome !== undefined ? { outcome: ev.outcome } : {}),
+        ...(ev.mimeType !== undefined ? { mimeType: ev.mimeType } : {}),
+        ...(ev.bytes !== undefined ? { bytes: ev.bytes } : {}),
+        ...(ev.imageCount !== undefined ? { imageCount: ev.imageCount } : {}),
+        ...(ev.file !== undefined ? { file: basename(ev.file) } : {}),
+        ...(ev.detail !== undefined && isDebug() ? { detail: ev.detail } : {}),
+    };
+    logEvent({
+        source: "image-paste",
+        level: ev.detail !== undefined && isDebug() ? "debug" : "info",
+        event: ev.event,
+        fields,
+    });
 }
-/** Shift image-paste.log -> .1 -> .2 once the active file passes the size cap. */
-function rotateIfNeeded(path) {
-    try {
-        if (statSync(path).size < MAX_LOG_BYTES)
-            return;
-        for (let i = KEEP_ROTATIONS; i >= 1; i--) {
-            const from = i === 1 ? path : `${path}.${i - 1}`;
-            const to = `${path}.${i}`;
-            try {
-                renameSync(from, to);
-            }
-            catch {
-                /* absent source — fine */
-            }
-        }
-    }
-    catch {
-        /* rotation is best-effort */
-    }
+/**
+ * Append one sanitized ask-user-question event to the unified sink
+ * (source:"ask-question").
+ * Fail-soft and hermetically gated under `node --test` exactly like
+ * `logImagePaste`. Never logs user-typed text, question text, or option labels
+ * — only indices, lengths, key bytes (escaped), and resolution status.
+ */
+export function logAskQuestion(ev) {
+    // Raw key bytes (`key`) and `detail` are content-ish: gate them behind DEBUG.
+    const debug = isDebug();
+    const fields = {
+        ...(ev.selectedIndex !== undefined ? { selectedIndex: ev.selectedIndex } : {}),
+        ...(ev.otherIndex !== undefined ? { otherIndex: ev.otherIndex } : {}),
+        ...(ev.otherLen !== undefined ? { otherLen: ev.otherLen } : {}),
+        ...(ev.status !== undefined ? { status: ev.status } : {}),
+        ...(ev.multi !== undefined ? { multi: ev.multi } : {}),
+        ...(ev.qIndex !== undefined ? { qIndex: ev.qIndex } : {}),
+        ...(ev.checked !== undefined ? { checked: ev.checked } : {}),
+        ...(ev.key !== undefined && debug ? { key: ev.key } : {}),
+        ...(ev.detail !== undefined && debug ? { detail: ev.detail } : {}),
+    };
+    logEvent({
+        source: "ask-question",
+        level: debug ? "debug" : "info",
+        event: ev.event,
+        fields,
+    });
 }
 /** Read the most recent log content (for a user-triggered report). */
 export function readRecentDiagnostics(maxBytes = 64 * 1024) {
     try {
-        const data = readFileSync(diagnosticsLogPath(), "utf8");
+        const data = readFileSync(errorSinkPath(), "utf8");
         return data.length > maxBytes ? data.slice(data.length - maxBytes) : data;
     }
     catch {
@@ -97,9 +93,9 @@ export function readRecentDiagnostics(maxBytes = 64 * 1024) {
 /** List existing diagnostic log files (active + rotations), for a report. */
 export function listDiagnosticFiles() {
     try {
-        const dir = dirname(diagnosticsLogPath());
+        const dir = dirname(errorSinkPath());
         return readdirSync(dir)
-            .filter((f) => f.startsWith("image-paste.log"))
+            .filter((f) => f.startsWith("errors-"))
             .sort()
             .map((f) => join(dir, f));
     }
@@ -107,4 +103,6 @@ export function listDiagnosticFiles() {
         return [];
     }
 }
+/** Re-export the session-scoped trail reader for the /feedback flow. */
+export { readSessionTrail };
 //# sourceMappingURL=diagnostics.js.map

package/dist/extension/errorSink.d.ts

@@ -0,0 +1,64 @@
+/**
+ * The unified local error/log sink for YAGNI Code (YAG-580).
+ *
+ * Replaces the previous ~9 hand-rolled JSONL writers (image-paste.log,
+ * ask-question.log, turn-lifecycle.log, guardian.log, cost-divergence.log,
+ * auth-events.log, cmux-bridge.log, hooks.log, *.stream.log) with ONE sink.
+ *
+ * Two storage layers, purpose-named so their roles stay clear:
+ *
+ *  1. The DURABLE TRAIL — one rotating per-day JSONL under
+ *     `~/.yagni-code/logs/errors-<date>.jsonl` (size-capped + 2 rotations).
+ *     This is the crash-survivable WAL: `turn_start` without a matching
+ *     `turn_end` still leaves a record even if the process is killed. Critical
+ *     events append SYNCHRONOUSLY for exactly that reason.
+ *
+ *  2. The IN-MEMORY CAPTURE — a byte-budgeted ring buffer (not line-counted).
+ *     This is the `/feedback` binding convenience, NOT durability (an in-memory
+ *     ring does not survive a crash). Mirrors Codex's CodexFeedback ring and
+ *     Claude's inMemoryErrorLog.
+ *
+ * Every line carries a REQUIRED `sessionId` and a `source`/`level`/`event`
+ * triple so a shared file stays filterable: `jq 'select(.source=="guardian")'`
+ * reproduces today's per-file tail exactly, and /feedback reads the trail
+ * filtered by sessionId (never the raw file) so one session's report never
+ * leaks another session's errors.
+ *
+ * Default-on vs DEBUG invariant (the thing that makes "log everything by
+ * default" safe): default-on == scrub-safe == upload-safe. Any field carrying
+ * raw content (tool arguments, partial/result bodies, provider payloads, raw
+ * key bytes) must be gated behind YAGNI_DEBUG, and the /feedback reader refuses
+ * to bind any `level: debug` line. DEBUG == may-contain-content == never-uploads.
+ */
+export type SinkLevel = "error" | "warn" | "info" | "debug";
+export interface SinkEvent {
+    /** Former filename / subsystem: tool, turn, guardian, image-paste, ask-question, cost, auth, cmux, hooks. */
+    source: string;
+    level: SinkLevel;
+    /** Stable machine name (e.g. "turn_start", "bash.exit_1", "denied"). */
+    event: string;
+    /** Additional structured fields. NEVER raw content on a non-debug line. */
+    fields?: Record<string, unknown>;
+    /** Session id so the trail is filterable and scoped per feedback. Defaults to YAGNI_SESSION_ID. */
+    sessionId?: string;
+    /** "sync" flushes immediately (critical events); "buffered" is fine for high-volume debug. */
+    flush?: "sync" | "buffered";
+}
+export declare function _setErrorSinkHomeForTest(dir: string | null): void;
+export declare function errorSinkPath(now?: Date): string;
+export declare function _clearErrorSinkRingForTest(): void;
+export declare function errorSinkInMemory(): string;
+/**
+ * Append one event to both the ring and the durable trail. Fail-soft: a logging
+ * failure must never break the session. `flush: "sync"` (default for
+ * error-level events and lifecycle turns) bypasses any future buffering so a
+ * turn that starts but never ends still leaves a durable `turn_start`.
+ */
+export declare function logEvent(ev: SinkEvent): void;
+/**
+ * Read recent trail lines for ONE session, filtered by `sessionId`, up to
+ * `maxBytes`. Never returns `level: debug` lines — the default-on tier is the
+ * upload-safe tier, and DEBUG may contain content that must not leave the machine.
+ */
+export declare function readSessionTrail(sessionId: string, maxBytes?: number): string;
+//# sourceMappingURL=errorSink.d.ts.map