@yagni-app/code 1.0.0 → 1.0.2

package/README.md

@@ -171,6 +171,43 @@ Credentials live in `~/.yagni-code/profiles/<name>.json` (mode `0600`); the acti
 environment is recorded in `~/.yagni-code/config.json`. A pre-profiles
 `~/.yagni-code/credentials.json` is migrated automatically on first run.
 
+### OTel export (opt-in)
+
+Point sessions at **your own** OpenTelemetry collector (Datadog Agent, Grafana
+Alloy, an OTLP-native backend) and every session — including `/go` stage
+children and subagents — emits a per-prompt span tree: interaction → LLM
+request → tool calls, following the OTel GenAI semantic conventions. Nothing is
+exported unless you configure an endpoint.
+
+Enable it one of three ways (first match wins):
+
+- `OTEL_EXPORTER_OTLP_ENDPOINT=http://<collector>:4317` in the environment
+  (a personal override — handy for pointing one session at a scratch
+  collector), or
+- **workspace settings** (the zero-setup path): a workspace admin sets the
+  endpoint, protocol, and any collector headers (e.g. a Datadog API key) once
+  in the web app under Settings → YAGNI Code → Trace export. Every session in
+  the workspace picks it up at launch — nothing to install or configure on
+  developer machines. Header values are encrypted at rest server-side and the
+  launch-time copy is cached at mode `0600`, the same posture as your device
+  token. Or,
+- commit `{ "otel": { "endpoint": "http://<collector>:4317" } }` to the repo's
+  `.pi/settings.json` so one repo's sessions export without per-machine setup.
+
+Standard OTel env vars are honored (`OTEL_EXPORTER_OTLP_PROTOCOL`,
+`OTEL_EXPORTER_OTLP_HEADERS`, `OTEL_SERVICE_NAME` — defaults to `yagni-code`),
+and `PI_OTEL_DISABLED=1` is the kill switch. `yagni doctor` shows the current
+export state.
+
+Two things are enforced and not configurable:
+
+- **Metadata only.** Token counts, cost, tier, finish reasons, and tool-call
+  ids export; prompt and response text never do — a settings file or env var
+  asking for content capture is overridden.
+- **Cost is your contracted rate.** `pi.cost.usd` is computed from your
+  workspace's tier rate card, and the exported model name is the opaque tier
+  id (`advanced`, `peak`, …), so traces never fingerprint the backing model.
+
 Device tokens are revocable from both ends: `yagni logout` revokes the current
 one, and a workspace admin can list every connected device and revoke any token
 from the web app (Settings, YAGNI Code, Connected devices). Tokens are stored
@@ -196,6 +233,11 @@ precisely:
   third-party crash service, so we can fix the crash before you have to report
   it. Disable with `YAGNI_DISABLE_CRASH_REPORTS=1`.
 
+A third flow exists only when you turn it on: **OTel export** (above) sends
+session *metadata* — never prompt or response text — to a collector **you**
+configure and operate. It is off unless an OTLP endpoint is set, and YAGNI
+never receives these traces.
+
 ## Troubleshooting
 
 - **`Not logged in to environment "<name>" … Run \`yagni login\` first.`** — no

package/dist/cli.js

@@ -16,7 +16,7 @@ import { spawn } from "node:child_process";
 import { chmodSync, existsSync, lstatSync, mkdirSync, readFileSync, realpathSync, renameSync, rmSync, writeFileSync, } from "node:fs";
 import { join } from "node:path";
 import { createInterface } from "node:readline/promises";
-import { fileURLToPath } from "node:url";
+import { fileURLToPath, pathToFileURL } from "node:url";
 import { PI_CONFIG_NAME } from "./branding.js";
 import { claudeCompatArgs } from "./claudeCompat.js";
 import { agentDir, credentialsDir, piPackageDir } from "./credentials.js";
@@ -27,14 +27,18 @@ import { login } from "./login.js";
 import { logout } from "./logout.js";
 import { tokenCommand } from "./token.js";
 import { buildLaunch } from "./launch.js";
+import { resolveOtelLaunchWithWorkspace } from "./otel.js";
+import { parseOutputFormat, parseJsonEvents, buildResultObject, readGuardianEvents, } from "./outputFormat.js";
+import { feedbackCommand } from "./feedback.js";
 import { runDoctor } from "./doctor.js";
 import { installProcessCrashHandlers } from "./crashReport.js";
 import { currentCliVersion, maybeNudgeAndRefresh, upgradeCommand } from "./upgrade.js";
 import { maybeRefreshAtLaunch } from "./refresh.js";
 import { exitCodeFor, installSignalForwarding } from "./signalForward.js";
 import { PAD_X } from "./padding.js";
+import { parseWorktreeFlag, validateWorktreeLaunchArgs } from "./worktreeArgs.js";
 import { ensureShadowPiPackage } from "./piPackage.js";
-import { resolveExtensionPath, resolvePiCliPath, resolvePiPackageDir } from "./paths.js";
+import { resolveExtensionPath, resolvePiCliPath, resolvePiPackageDir, resolveSessionWorktreePath } from "./paths.js";
 import { credentialsFromProfile, getActiveProfileName, listProfiles, migrateLegacyCredentials, persistProfileTokenRotation, profilePath, readActiveProfile, useProfile, } from "./profiles.js";
 // Present as "yagni" in process listings, not "node".
 process.title = DISTRIBUTION.commandName;
@@ -159,6 +163,18 @@ export function seedHideThinkingBlock(piAgentDir) {
     return seedSetting(piAgentDir, "hideThinkingBlock", true);
 }
 async function runDefault(passthroughArgs) {
+    // `-w / --worktree [name]` is its own launch path: create/resume a worktree
+    // and enter a session there. Gate strictly on `requested` (not `name`) so a
+    // bare `-w` (random slug) is honored too. Returning early keeps the standard
+    // path below physically unreachable by any `-w` bug.
+    const worktree = parseWorktreeFlag(passthroughArgs);
+    if (worktree.requested) {
+        return runWorktreeLaunch(worktree.remainingArgs, worktree.name);
+    }
+    // Parse --output-format out of argv before passing to pi (pi doesn't know
+    // about it). The format determines how we handle pi's stdout: text = inherit,
+    // stream-json = inherit with --mode json, json = pipe + post-process.
+    const { format: outputFormat, remainingArgs } = parseOutputFormat(passthroughArgs);
     // Cache-backed update nudge (never a network wait), then a background cache
     // refresh that completes while the session runs. Both fail soft.
     await maybeNudgeAndRefresh({ current: cliVersion() });
@@ -230,6 +246,16 @@ async function runDefault(passthroughArgs) {
     catch {
         compat = { argv: [], env: {} };
     }
+    // OTel export: load pi-otel only when an OTLP endpoint is configured — the
+    // user's env, the workspace's admin-set config (fetched fail-soft, cached),
+    // or the repo's .pi/settings.json, in that order. undefined keeps the
+    // launch untouched. See otel.ts for the policy.
+    const otel = await resolveOtelLaunchWithWorkspace({
+        env: process.env,
+        cwd: process.cwd(),
+        creds,
+        profileName: profile.name,
+    });
     // buildLaunch runs the token-expiry preflight: it throws (with an actionable
     // login prompt) on an already-expired token so we never spawn a session that
     // immediately 401s, and returns non-fatal warnings (e.g. expiry approaching).
@@ -237,7 +263,7 @@ async function runDefault(passthroughArgs) {
     // re-login in another terminal is picked up here with no stale cached token.
     let plan;
     try {
-        plan = buildLaunch(creds, passthroughArgs, {
+        plan = buildLaunch(creds, remainingArgs, {
             extensionPath: resolveExtensionPath(),
             agentDir: piAgentDir,
             piPackageDir: shadowPiDir,
@@ -250,6 +276,7 @@ async function runDefault(passthroughArgs) {
             cliVersion: cliVersion(),
             baseEnv: process.env,
             ...(seededHideThinking ? { hideThinkingSeeded: true } : {}),
+            ...(otel ? { otel } : {}),
         });
     }
     catch (err) {
@@ -260,24 +287,210 @@ async function runDefault(passthroughArgs) {
         process.stderr.write(`${warning}\n`);
     }
     const { env, argv } = plan;
+    return spawnPiAndAwait({
+        argv,
+        env,
+        remainingArgs,
+        outputFormat,
+    });
+}
+/**
+ * Spawn pi and await its exit, mapping to the launcher's exit code. Extracted
+ * so `runDefault` (cwd = current) and `runWorktreeLaunch` (cwd = worktree) share
+ * the exact same json/stream-json post-processing, signal forwarding, and exit
+ * code mapping — the two paths can never drift on the output contract.
+ */
+async function spawnPiAndAwait(opts) {
+    const { argv, env, remainingArgs, outputFormat, cwd } = opts;
+    // For json/stream-json output, inject --mode json so pi emits NDJSON events.
+    const userChoseMode = remainingArgs.some((a) => a === "--mode" || a.startsWith("--mode="));
+    const childArgv = outputFormat === "text" || userChoseMode
+        ? argv
+        : [...argv, "--mode", "json"];
+    // text + stream-json: inherit stdout (passthrough). json: pipe stdout so we
+    // can post-process the NDJSON into a single result object.
+    const stdio = outputFormat === "json"
+        ? ["inherit", "pipe", "inherit"]
+        : "inherit";
     const piCli = resolvePiCliPath();
+    const startMs = Date.now();
     return await new Promise((resolve) => {
-        const child = spawn(process.execPath, [piCli, ...argv], {
-            stdio: "inherit",
+        const child = spawn(process.execPath, [piCli, ...childArgv], {
+            stdio: stdio,
             env,
+            ...(cwd ? { cwd } : {}),
         });
+        // Collect pi's stdout when piping for --output-format json.
+        let stdoutChunks = "";
+        if (outputFormat === "json" && child.stdout) {
+            child.stdout.setEncoding("utf8");
+            child.stdout.on("data", (chunk) => {
+                stdoutChunks += chunk;
+            });
+        }
         // Forward termination signals to pi instead of dying around it (see
         // signalForward.ts for the policy: first signal graceful, second tree-kill).
         installSignalForwarding(child);
         // 128+n for a signal death (bash parity), so a cancelled/killed run never
         // reads as success to scripts or CI.
-        child.on("exit", (code, signal) => resolve(exitCodeFor(code, signal)));
+        child.on("exit", (code, signal) => {
+            const exitCode = exitCodeFor(code, signal);
+            if (outputFormat === "json") {
+                const durationMs = Date.now() - startMs;
+                const events = parseJsonEvents(stdoutChunks);
+                const yagniSessionId = env.YAGNI_SESSION_ID ?? "";
+                const guardianEvents = readGuardianEvents(yagniSessionId);
+                const verbose = remainingArgs.includes("--verbose");
+                const result = buildResultObject({
+                    events,
+                    guardianEvents,
+                    durationMs,
+                    verbose,
+                });
+                process.stdout.write(`${JSON.stringify(result)}\n`);
+            }
+            resolve(exitCode);
+        });
         child.on("error", (err) => {
             process.stderr.write(`Failed to start YAGNI Code: ${err.message}\n`);
             resolve(1);
         });
     });
 }
+async function defaultLoadSessionWorktree() {
+    const mod = (await import(pathToFileURL(resolveSessionWorktreePath()).href));
+    if (typeof mod?.createOrResume !== "function") {
+        throw new Error("The bundled extension is missing its session-worktree entry point (is the CLI up to date?).");
+    }
+    return mod;
+}
+/**
+ * `yagni -w [name]` — create/resume a worktree and enter a session there.
+ *
+ * Delegates all git behavior to the extension's `sessionWorktree` entry; this
+ * launcher path only resolves credentials, builds the plan, and spawns pi with
+ * `cwd` = the worktree. The worktree is DURABLE — nothing is ever removed.
+ */
+async function runWorktreeLaunch(passthroughArgs, worktreeName, loadSessionWorktree = defaultLoadSessionWorktree) {
+    // Validate the name + argv before any side effect (slug guard + `-c`
+    // disallow). The extension re-validates the mapped slug for PR refs.
+    const launchError = validateWorktreeLaunchArgs(worktreeName, passthroughArgs);
+    if (launchError !== undefined) {
+        process.stderr.write(`${launchError}\n`);
+        return 1;
+    }
+    const { format: outputFormat, remainingArgs } = parseOutputFormat(passthroughArgs);
+    // Load the session-worktree entry first, so a stale bundled extension fails
+    // honestly before we mutate anything.
+    let sessionWorktree;
+    try {
+        sessionWorktree = await loadSessionWorktree();
+    }
+    catch (err) {
+        process.stderr.write(`${err instanceof Error ? err.message : String(err)}\n`);
+        return 1;
+    }
+    // Create/resume resolves the main repo root + branch + dir, and performs
+    // `git worktree add` / resume. Never throws on a normal path; catch-all maps
+    // to a clean stderr + exit 1.
+    let result;
+    try {
+        result = await sessionWorktree.createOrResume(worktreeName, {
+            repoCwd: process.cwd(),
+        });
+    }
+    catch (err) {
+        process.stderr.write(`${err instanceof Error ? err.message : String(err)}\n`);
+        return 1;
+    }
+    // Reuse the standard credential + env + plan flow (same token refresh, shadow
+    // package, compat args, preflight). The worktree becomes the project cwd, so
+    // compat assets resolve from there.
+    await maybeNudgeAndRefresh({ current: cliVersion() });
+    const profile = await readActiveProfile();
+    let creds = credentialsFromProfile(profile);
+    if (!creds?.token) {
+        process.stderr.write(`Not logged in to environment "${profile.name}" (${profile.baseUrl}). Run \`yagni login\` first.\n`);
+        return 1;
+    }
+    const refresh = await maybeRefreshAtLaunch(creds, {
+        persist: (c) => persistProfileTokenRotation(profile.name, c),
+    });
+    for (const warning of refresh.warnings) {
+        process.stderr.write(`${warning}\n`);
+    }
+    creds = refresh.creds;
+    const piAgentDir = agentDir(profile.name);
+    mkdirSync(piAgentDir, { recursive: true, mode: 0o700 });
+    seedEditorPadding(piAgentDir);
+    seedCollapseChangelog(piAgentDir);
+    seedHideThinkingBlock(piAgentDir);
+    let shadowPiDir;
+    try {
+        shadowPiDir = ensureShadowPiPackage({
+            realPiDir: resolvePiPackageDir(),
+            shadowDir: piPackageDir(),
+            name: PI_CONFIG_NAME,
+        });
+    }
+    catch {
+        shadowPiDir = undefined;
+    }
+    let compat = { argv: [], env: {} };
+    try {
+        compat = await claudeCompatArgs({
+            cwd: result.worktreePath,
+            agentDir: piAgentDir,
+            confirm: confirmOnTty,
+        });
+    }
+    catch {
+        compat = { argv: [], env: {} };
+    }
+    // OTel gate reads the WORKTREE's .pi/settings.json — that is the session's
+    // cwd, so a repo-committed otel config applies to its worktrees too.
+    const otel = await resolveOtelLaunchWithWorkspace({
+        env: process.env,
+        cwd: result.worktreePath,
+        creds,
+        profileName: profile.name,
+    });
+    let plan;
+    try {
+        plan = buildLaunch(creds, remainingArgs, {
+            extensionPath: resolveExtensionPath(),
+            agentDir: piAgentDir,
+            piPackageDir: shadowPiDir,
+            extraAgentArgs: compat.argv,
+            extraEnv: compat.env,
+            profilePath: profilePath(profile.name),
+            stateDir: credentialsDir(),
+            cliVersion: cliVersion(),
+            baseEnv: process.env,
+            ...(otel ? { otel } : {}),
+        });
+    }
+    catch (err) {
+        process.stderr.write(`${err instanceof Error ? err.message : String(err)}\n`);
+        return 1;
+    }
+    for (const warning of plan.warnings) {
+        process.stderr.write(`${warning}\n`);
+    }
+    const exitCode = await spawnPiAndAwait({
+        argv: plan.argv,
+        env: plan.env,
+        remainingArgs,
+        outputFormat,
+        cwd: result.worktreePath,
+    });
+    // Durable by default: nothing is removed. Tell the user where their work
+    // lives (stderr only — never stdout, to keep json clean).
+    process.stderr.write(`[yagni] worktree ${result.existed ? "resumed" : "created"}: ${result.worktreePath}\n` +
+        `[yagni] branch: ${result.branch}\n` +
+        `[yagni] resume: cd ${result.worktreePath} && yagni\n`);
+    return exitCode;
+}
 export const HELP_TEXT = [
     "YAGNI Code — a business-context-grounded terminal coding agent.",
     "",
@@ -285,10 +498,16 @@ export const HELP_TEXT = [
     "  yagni [args…]            Launch the agent in the current repo.",
     "  yagni -c                 Continue the most recent session.",
     "  yagni -r                 Browse and resume a previous session.",
+    "  yagni -w [name]          Create/resume a worktree and enter a session there.",
     '  yagni -p "prompt"        Print one response and exit (reads piped stdin too).',
+    '  yagni -p "prompt"        Use --output-format json for a machine-readable',
+    '    --output-format json   result object with tools, cost, guardian reviews.',
     "  yagni login              Authorize the active environment (device-code flow).",
     "  yagni logout             Revoke and clear the active environment's token.",
     "  yagni doctor             Check that everything is ready (green/red checklist).",
+    "  yagni feedback [sessionId]  File a bug report from the shell. Lists recent",
+    "                           sessions to pick, or pass a session ID directly.",
+    "                           Attaches transcript + error trail, then submits.",
     "  yagni go --headless      Run the /go pipeline without a session, for scripts",
     "                           and CI: --ticket-file <path> [--plan-file <path>]",
     "                           [--memo-file <path>] [--run-id <id>] [--json].",
@@ -307,6 +526,9 @@ export const HELP_TEXT = [
     "  --model <tier>           Model tier (fixed to advanced).",
     "  --thinking <level>       off | minimal | low | medium | high | xhigh | max",
     "  --session <id>           Open a specific session; --fork <id> branches one.",
+    "  --output-format <fmt>    Output format: text (default), json, stream-json.",
+    "                           json emits a single result object; stream-json",
+    "                           emits NDJSON events (same as --mode json).",
     "  --mode json              Emit machine-readable events (for scripts and CI).",
     "",
     "In a session:",
@@ -437,6 +659,9 @@ export async function main(argv) {
     if (command === "go") {
         return goCommand(rest, {}, cliVersion());
     }
+    if (command === "feedback") {
+        return feedbackCommand(rest, {}, cliVersion());
+    }
     if (command === "token") {
         return tokenCommand();
     }

package/dist/crashReport.d.ts

@@ -41,6 +41,7 @@ export declare function crashReportsDisabled(env?: NodeJS.ProcessEnv): boolean;
 export declare function runningUnderTest(env?: NodeJS.ProcessEnv): boolean;
 /** Reporting is off when the user disabled it OR this is a test process. */
 export declare function crashReportsSuppressed(env?: NodeJS.ProcessEnv): boolean;
+export declare const SECRET_PATTERNS: Array<[RegExp, string]>;
 export interface SanitizeCrashOptions {
     /** Environment whose values get redacted (defaults to process.env). */
     env?: NodeJS.ProcessEnv;
@@ -57,6 +58,13 @@ export interface SanitizeCrashOptions {
  *      `node_modules/` on, so dependency frames stay diagnosable)
  * Over-redacts rather than under-redacts; pure; never throws.
  */
+/**
+ * Lightweight secret-only scrub — applies SECRET_PATTERNS and nothing else.
+ * Matches the extension's `scrubSecrets` exactly (no path collapse, no env
+ * redaction). Use this for feedback transcripts where file paths and code
+ * context must stay readable; the backend re-normalizes home paths on receipt.
+ */
+export declare function scrubSecrets(text: string): string;
 export declare function sanitizeCrashText(text: string, opts?: SanitizeCrashOptions): string;
 export interface SanitizedCrash {
     errorClass: string;

package/dist/crashReport.js

@@ -62,7 +62,7 @@ export function crashReportsSuppressed(env = process.env) {
 }
 // Mirrors scrubSecrets (backend yagniCode/scrubSecrets.ts and
 // pi-extension-yagni pipeline/scrubSecrets.ts) — keep in sync.
-const SECRET_PATTERNS = [
+export const SECRET_PATTERNS = [
     [/\b([a-z][a-z0-9+.\-]*:\/\/[^\s:@/]+):[^\s:@/]+@/gi, "$1:[REDACTED]@"],
     [/\b(sk-[A-Za-z0-9]{16,}|sk_(?:live|test)_[A-Za-z0-9]{16,}|rk_(?:live|test)_[A-Za-z0-9]{16,}|gh[pousr]_[A-Za-z0-9]{20,}|xox[baprs]-[A-Za-z0-9-]{10,}|AKIA[0-9A-Z]{16}|AIza[0-9A-Za-z_\-]{20,})\b/g, "[REDACTED]"],
     [/\b([A-Za-z0-9_]*(?:secret|password|passwd|api[_-]?key|token|private[_-]?key|access[_-]?key)[A-Za-z0-9_]*)\b(\s*[:=]\s*)("[^"]+"|'[^']+'|`[^`]+`|[^\s"']+)/gi, "$1$2[REDACTED]"],
@@ -106,6 +106,18 @@ function collapsePathToken(token) {
  *      `node_modules/` on, so dependency frames stay diagnosable)
  * Over-redacts rather than under-redacts; pure; never throws.
  */
+/**
+ * Lightweight secret-only scrub — applies SECRET_PATTERNS and nothing else.
+ * Matches the extension's `scrubSecrets` exactly (no path collapse, no env
+ * redaction). Use this for feedback transcripts where file paths and code
+ * context must stay readable; the backend re-normalizes home paths on receipt.
+ */
+export function scrubSecrets(text) {
+    let out = text;
+    for (const [re, repl] of SECRET_PATTERNS)
+        out = out.replace(re, repl);
+    return out;
+}
 export function sanitizeCrashText(text, opts = {}) {
     let out = text;
     const env = opts.env ?? process.env;

package/dist/doctor.d.ts

@@ -13,6 +13,7 @@
  * Advisory checks (loose perms, missing `gh`) never flip the exit code.
  */
 import { type TokenExpiryStatus } from "./launch.js";
+import { type OtelLaunchConfig } from "./otel.js";
 import { type Profile } from "./profiles.js";
 export type CheckStatus = "ok" | "warn" | "fail";
 export interface CheckResult {
@@ -60,6 +61,12 @@ export declare function checkCliUpdate(probe: {
     latest: string | null;
 }): CheckResult;
 export declare function checkGh(onPath: boolean): CheckResult;
+/**
+ * Advisory OTel-export line: says whether sessions will stream traces to an
+ * OTLP collector, and from which config source. Never flips the exit code —
+ * most machines have no collector, and that is the healthy default.
+ */
+export declare function checkOtelExport(config: OtelLaunchConfig | undefined): CheckResult;
 /** What the Windows bash probe found (pi needs a bash — Git Bash — on win32). */
 export interface BashProbe {
     found: boolean;

package/dist/doctor.js

@@ -17,6 +17,7 @@ import { delimiter, join } from "node:path";
 import { credentialsDir } from "./credentials.js";
 import { currentCliVersion, fetchLatestVersion, isNewerVersion } from "./upgrade.js";
 import { classifyTokenExpiry } from "./launch.js";
+import { resolveOtelLaunchWithWorkspace } from "./otel.js";
 import { resolveExtensionPath, resolvePiCliPath, resolvePiPackageDir } from "./paths.js";
 import { readActiveProfile } from "./profiles.js";
 // ── Pure check builders ─────────────────────────────────────────────────────
@@ -198,6 +199,32 @@ export function checkGh(onPath) {
         required: false,
     };
 }
+/**
+ * Advisory OTel-export line: says whether sessions will stream traces to an
+ * OTLP collector, and from which config source. Never flips the exit code —
+ * most machines have no collector, and that is the healthy default.
+ */
+export function checkOtelExport(config) {
+    if (!config) {
+        return {
+            name: "otel export (optional)",
+            status: "ok",
+            detail: "off (no OTLP endpoint configured)",
+            required: false,
+        };
+    }
+    const source = config.source === "env"
+        ? "OTEL_EXPORTER_OTLP_ENDPOINT"
+        : config.source === "workspace"
+            ? "workspace settings"
+            : ".pi/settings.json";
+    return {
+        name: "otel export (optional)",
+        status: "ok",
+        detail: `on → ${config.endpoint} (${source}, metadata-only)`,
+        required: false,
+    };
+}
 export function checkBash(probe) {
     if (!probe.found) {
         return {
@@ -379,6 +406,12 @@ export async function gatherChecks(deps = {}) {
     checks.push(checkBackend(backend));
     checks.push(checkStateDir(probeStateDir()));
     checks.push(checkGh(ghOnPath()));
+    checks.push(checkOtelExport(await resolveOtelLaunchWithWorkspace({
+        env: process.env,
+        cwd: process.cwd(),
+        creds: profile.token ? { baseUrl: profile.baseUrl, token: profile.token } : null,
+        profileName: profile.name,
+    })));
     return checks;
 }
 /**

package/dist/extension/askAdvisorTool.d.ts

@@ -29,6 +29,8 @@ import type { ExtensionAPI, ToolDefinition } from "@earendil-works/pi-coding-age
 import { type Component } from "@earendil-works/pi-tui";
 import { Type } from "typebox";
 import { type AdvisorLimits, type AdvisorStateHandle } from "./advisor.js";
+import type { ChildUsageHandle } from "./childUsage.js";
+import type { WorkingLineHandle } from "./workingLine.js";
 import { runStage as defaultRunStage } from "./pipeline/runner.js";
 import { type PipelineStage } from "./pipeline/types.js";
 import { type RenderTheme, type SubagentTaskProgress } from "./subagentRender.js";
@@ -49,6 +51,18 @@ export interface MakeAskAdvisorToolOptions {
     limits?: AdvisorLimits;
     /** Injectable so tests never spawn a child. */
     runStage?: typeof defaultRunStage;
+    /**
+     * The session working-line manager (workingLine.ts). When present, live
+     * consult progress goes through it (so the elapsed/token suffix survives);
+     * absent, the tool falls back to ui.setWorkingMessage directly.
+     */
+    workingLine?: WorkingLineHandle;
+    /**
+     * Session child-usage accumulator (childUsage.ts), so the footer's session
+     * totals include advisor consults — the spend the consult-cost line already
+     * prints. Absent = not wired (tests/harnesses): no recording.
+     */
+    childUsage?: ChildUsageHandle;
 }
 /**
  * Assemble the consult brief. The advisor's persona already tells it not to take

package/dist/extension/askAdvisorTool.js

@@ -125,9 +125,11 @@ export function makeAskAdvisorTool(opts) {
             "The advice comes back as plain text: act on it, and call record_decision when it settles a product-intent call so the next agent inherits it.",
         ],
         parameters,
+        // Self-framed: the condensed transcript look has no tinted tool boxes.
+        renderShell: "self",
         renderCall: renderAdvisorCall,
         renderResult: renderSubagentResult,
-        async execute(_toolCallId, params, signal, onUpdate, ctx) {
+        async execute(toolCallId, params, signal, onUpdate, ctx) {
             // Read the LIVE session model: pi's picker can change it after this tool
             // was registered, in both directions.
             const decision = decideConsult({
@@ -159,9 +161,12 @@ export function makeAskAdvisorTool(opts) {
                     },
                 });
                 const working = formatWorkingMessage([progress], now);
-                if (ui && working !== lastWorking) {
+                if (working !== lastWorking) {
                     lastWorking = working;
-                    ui.setWorkingMessage?.(working);
+                    if (opts.workingLine)
+                        opts.workingLine.setActivity(working);
+                    else
+                        ui?.setWorkingMessage?.(working);
                 }
             };
             emit();
@@ -181,11 +186,18 @@ export function makeAskAdvisorTool(opts) {
             }
             finally {
                 // Restore the default "Working…" text whether we resolved or threw.
-                ui?.setWorkingMessage?.();
+                if (opts.workingLine)
+                    opts.workingLine.setActivity(undefined);
+                else
+                    ui?.setWorkingMessage?.();
             }
             const cost = result.usage?.cost ?? 0;
             const state = opts.state.record(cost);
             finalizeTask(progress, result, Date.now());
+            // Footer session totals include the consult. Keyed by toolCallId — one
+            // consult per call, unique even for parallel consults minted in the same
+            // millisecond — so a re-fired finalize for the same call is a no-op.
+            opts.childUsage?.record("advisor", toolCallId, result.usage);
             if (result.exitCode !== 0 && !result.finalOutput.trim()) {
                 // Fail honestly rather than returning an empty recommendation. The
                 // consult still counts: it spawned, and it may well have spent.

package/dist/extension/askYagniTool.d.ts

@@ -12,7 +12,7 @@ export interface Citation {
  * AskStanding — mirrored locally by this extension's no-workspace-imports
  * convention, see costHud.ts).
  */
-export type AskStanding = "confirmed" | "asserted" | "inferred" | "no_position";
+export type AskStanding = "confirmed" | "asserted" | "inferred" | "no_position" | "contested";
 /** One line the TUI shows above the answer, per standing. */
 export declare const STANDING_LINES: Record<AskStanding, string>;
 /** Options for {@link makeAskYagniTool}. */

package/dist/extension/askYagniTool.js

@@ -10,6 +10,7 @@ export const STANDING_LINES = {
     asserted: "Grounded in a recorded assumption, not yet verified",
     inferred: "Inferred from workspace context, not a recorded decision",
     no_position: "No recorded position in this workspace",
+    contested: "Two recorded decisions conflict — escalate to a human",
 };
 function standingLine(value) {
     return typeof value === "string" && value in STANDING_LINES
@@ -56,6 +57,8 @@ export function makeAskYagniTool(opts) {
             "Answers carry a standing: treat a confirmed decision as settled; when you lean on an unverified assumption or an inference, say so where the work is reviewed; when there is no recorded position, follow the answer's instruction to record the assumption you proceed on.",
         ],
         parameters,
+        // Self-framed: the condensed transcript look has no tinted tool boxes.
+        renderShell: "self",
         renderCall(args, theme) {
             const t = theme;
             let text = `${t.fg("toolTitle", t.bold("ask_yagni"))} ${t.fg("dim", clipLine(args?.question ?? "…", 100))}`;
@@ -139,11 +142,29 @@ export function makeAskYagniTool(opts) {
                     text = `${text}\n\n${suggestion}`;
                 }
             }
+            // P0 (Run 8 review): a contested answer must reach the MODEL, not just
+            // the TUI. The backend composes an ordinary answer and only overrides
+            // standing client-side, so without this the coding agent can act on one
+            // conflicting side without ever seeing the do-not-proceed instruction.
+            // The refusal + both positions are appended VERBATIM to tool content.
+            if (data.standing === "contested") {
+                const lines = [];
+                if (data.contestedInstruction)
+                    lines.push(data.contestedInstruction);
+                for (const p of data.contestedPositions ?? []) {
+                    lines.push(`- (${p.id}) ${p.question}: ${p.decision}`);
+                }
+                if (lines.length > 0) {
+                    text = `${data.answer}\n\n${lines.join("\n")}`;
+                }
+            }
             return {
                 content: [{ type: "text", text }],
                 details: {
                     citations: data.citations ?? [],
                     ...(data.standing ? { standing: data.standing } : {}),
+                    ...(data.contestedInstruction ? { contestedInstruction: data.contestedInstruction } : {}),
+                    ...(data.contestedPositions ? { contestedPositions: data.contestedPositions } : {}),
                 },
             };
         },