@yagni-app/code 1.0.0 → 1.0.2

package/dist/extension/footer.js

@@ -42,6 +42,7 @@ import { spawnSync } from "node:child_process";
 import { statSync } from "node:fs";
 import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { matchesKey, truncateToWidth, visibleWidth } from "@earendil-works/pi-tui";
+import { createDiffStatCache, formatDiffStat } from "./diffStat.js";
 export const BRANCH_MAX_WIDTH = 60;
 const WORKTREE_MAX_WIDTH = 30;
 /** Section separator: single space + middle dot + single space. */
@@ -229,23 +230,34 @@ export function renderFooterLines(input, theme, width, padX = 0) {
     // terminal edge. Truncation runs against the reduced content width.
     const pad = " ".repeat(Math.max(0, Math.min(3, Math.floor(padX))));
     const contentWidth = Math.max(1, width - pad.length);
-    // Line 1: folder · [worktree] · branch
+    // Line 1: folder · [worktree] · branch [+N -M]
     const line1Parts = [theme.fg("accent", input.git.folder)];
     if (input.git.inRepo) {
         if (input.git.worktree)
             line1Parts.push(theme.fg("warning", `[${input.git.worktree}]`));
-        if (input.git.branch)
-            line1Parts.push(theme.fg("border", truncateEnd(input.git.branch, BRANCH_MAX_WIDTH, dim("…"))));
+        if (input.git.branch) {
+            const branchSpan = theme.fg("border", truncateEnd(input.git.branch, BRANCH_MAX_WIDTH, dim("…")));
+            // Diff badge rides the branch segment (Kimi's `branch [ +N -M ]` shape),
+            // colored dim — the same grey as the cost stats on line 2.
+            const diffSpan = input.diff ? ` ${dim(`[${input.diff}]`)}` : "";
+            line1Parts.push(branchSpan + diffSpan);
+        }
     }
     const line1 = pad + truncateToWidth(line1Parts.join(sep), contentWidth, dim("…"));
     // Line 2: [mode ·] model · ↑in ↓out $cost · ctx%
+    // Child-process spend (subagents, advisor, /go) joins the driver totals so
+    // the footer matches the per-child receipts and /cost's session scope.
+    const child = input.childUsage;
+    const totalIn = input.usage.input + (child?.input ?? 0);
+    const totalOut = input.usage.output + (child?.output ?? 0);
+    const totalCost = input.usage.cost + (child?.cost ?? 0);
     const statParts = [];
-    if (input.usage.input)
-        statParts.push(`↑${formatTokens(input.usage.input)}`);
-    if (input.usage.output)
-        statParts.push(`↓${formatTokens(input.usage.output)}`);
-    if (input.usage.cost)
-        statParts.push(`$${input.usage.cost.toFixed(3)}`);
+    if (totalIn)
+        statParts.push(`↑${formatTokens(totalIn)}`);
+    if (totalOut)
+        statParts.push(`↓${formatTokens(totalOut)}`);
+    if (totalCost)
+        statParts.push(`$${totalCost.toFixed(3)}`);
     const stats = statParts.join(" ");
     const percentText = input.contextPercent === null ? "?" : `${Math.round(input.contextPercent)}%`;
     const line2Parts = [];
@@ -266,20 +278,26 @@ export function renderFooterLines(input, theme, width, padX = 0) {
     }
     return lines;
 }
-export function createYagniFooterFactory(ctx, modeHolder, invalidateHandle) {
+export function createYagniFooterFactory(ctx, modeHolder, invalidateHandle, childUsage) {
     return (_tui, theme, footerData) => {
         let gitCache;
-        const unsubscribeBranch = footerData.onBranchChange?.(() => {
+        let diffStatCache;
+        const clearCaches = () => {
             gitCache = undefined;
-        });
+            diffStatCache = undefined;
+        };
+        const unsubscribeBranch = footerData.onBranchChange?.(clearCaches);
         const gitInfo = () => {
             if (!gitCache) {
-                gitCache = detectGitInfo(ctx.sessionManager.getCwd(), process.env.HOME || process.env.USERPROFILE);
+                // Read cwd once; both the git info and the diff cache key off it.
+                const dir = ctx.sessionManager.getCwd();
+                gitCache = detectGitInfo(dir, process.env.HOME || process.env.USERPROFILE);
+                diffStatCache = createDiffStatCache(dir);
             }
             return gitCache;
         };
         if (invalidateHandle) {
-            invalidateHandle.invalidateGit = () => { gitCache = undefined; };
+            invalidateHandle.invalidateGit = clearCaches;
             invalidateHandle.requestRender = () => { _tui?.requestRender?.(); };
         }
         return {
@@ -291,13 +309,15 @@ export function createYagniFooterFactory(ctx, modeHolder, invalidateHandle) {
                     git: gitInfo(),
                     model: ctx.model?.id ?? "no-model",
                     mode: modeHolder?.get() ?? null,
+                    diff: formatDiffStat(diffStatCache?.get() ?? null),
                     usage: collectUsage(ctx.sessionManager),
+                    childUsage: childUsage?.read(),
                     contextPercent: ctx.getContextUsage()?.percent ?? null,
                     statuses,
                 }, theme, width, resolveFooterPadX());
             },
             invalidate() {
-                gitCache = undefined;
+                clearCaches();
             },
             dispose() {
                 unsubscribeBranch?.();

package/dist/extension/index.d.ts

@@ -186,6 +186,12 @@ export { makeTokenProvider, makeAuthedFetch, persistRotationToProfile, PROACTIVE
 export type { TokenProvider, TokenProviderDeps, ScheduleFn } from "./tokenProvider.js";
 export { appendToSpool, loadSpool, flushSpool, sendOrSpool, spoolFile, MAX_SPOOL_AGE_MS, _setSpoolHomeForTest, } from "./spool.js";
 export type { SpoolEntry, SpoolClientOpts, FlushOutcome, JudgmentWriteOutcome } from "./spool.js";
+export { registerCondensedTools, displayPath, isScratchpadPath, primaryArg, formatRowTitle, formatWriteBody, formatEditBody, formatBashErrorBody, formatBashPartialBody, formatExpandedOutput, splitBashError, countPatchAdditions, WRITE_PREVIEW_LINES, DIFF_PREVIEW_LINES, } from "./condensedTools.js";
+export type { RegisterCondensedToolsDeps, RowStatus } from "./condensedTools.js";
+export { ToolRunTracker, summarizeRun, isQuiet, kindForTool } from "./toolRuns.js";
+export type { RowKind, ToolRow, ToolRowPatch } from "./toolRuns.js";
+export { registerWorkingLine, composeWorkingMessage, NULL_WORKING_LINE, WORKING_INDICATOR_FRAMES, WORKING_VERBS, } from "./workingLine.js";
+export type { WorkingLineHandle, RegisterWorkingLineDeps } from "./workingLine.js";
 export { crashReportsDisabled, installUncaughtExceptionMonitor, makeCrashReporter, reportFatalCrash, sanitizeCrashError, sanitizeCrashText, } from "./crashReport.js";
 export type { CrashReporter, CrashReporterOpts, FatalCrashOpts, SanitizedCrash } from "./crashReport.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/extension/index.js

@@ -1,6 +1,7 @@
 import { createHash } from "node:crypto";
 import { Text } from "@earendil-works/pi-tui";
 import { DEFAULT_ADVISOR_LIMITS, formatAdvisorSubtotal, makeAdvisorState } from "./advisor.js";
+import { makeChildUsageState } from "./childUsage.js";
 import { appendGrant, loadGrants, resolveRepoKey, storagePrefix } from "./permission/approvedPrefixes.js";
 import { redactCommand } from "./redact.js";
 import { formatGuardianSubtotal, GUARDIAN_MODEL_TIER, makeGuardianState, resolveGuardianLimits, reviewCommand, deriveGuardianTimeoutMs } from "./permission/guardian.js";
@@ -16,6 +17,7 @@ import { makeRecordDecisionTool } from "./recordDecisionTool.js";
 import { makeSuggestNextWorkTool } from "./nextWorkTool.js";
 import { BRAND_NAME, brandSystemPrompt, brandingDisabled, buildMastheadString, YAGNI_IDENTITY_DRIVER, YAGNI_IDENTITY_ULTRA } from "./branding.js";
 import { claudeRulesSection } from "./claudeRules.js";
+import { ensureScratchpadDir, SCRATCHPAD_TMPDIR_ENV, scratchpadDir as scratchpadDirFor, scratchpadSection } from "./scratchpad.js";
 import { registerCostCommand } from "./costHud.js";
 import { isDebug } from "./diagnostics.js";
 import { logEvent } from "./errorSink.js";
@@ -39,15 +41,19 @@ import { registerDecisionCommands } from "./decisions.js";
 import { makeDecisionCapture } from "./decisionCapture.js";
 import { registerAmbientRecall } from "./recall.js";
 import { resilientFetch } from "./resilientFetch.js";
-import { installUncaughtExceptionMonitor, makeCrashReporter } from "./crashReport.js";
+import { installUncaughtExceptionMonitor, makeCrashReporter, runningUnderTest } from "./crashReport.js";
 import { flushSpool as defaultFlushSpool } from "./spool.js";
 import { makeAuthedFetch, makeTokenProvider } from "./tokenProvider.js";
 import { attributionHeaders, fetchCatalog as defaultFetchCatalog, fetchContextBrief as defaultFetchContextBrief, getToken, getTokenExpiresAt as defaultGetTokenExpiresAt, getWorkspaceId as defaultGetWorkspaceId, isDriverCaller, resolveBaseUrl, tokenExpiryNotice, } from "./config.js";
 import { buildYagniProvider } from "./provider.js";
 import { registerChipEditor } from "./chipEditor.js";
+import { registerSlashCommandFilter } from "./slashCommandFilter.js";
 import { defaultMineBeatGit, fileMineBeatMarkers, maybeOfferMiningBeat as defaultMaybeOfferMiningBeat, } from "./mineBeat.js";
 import { makeFlywheelState } from "./flywheel.js";
 import { registerSilentTurnReminder } from "./silentTurnReminder.js";
+import { registerCondensedTools } from "./condensedTools.js";
+import { isDesktopSurface } from "./surface.js";
+import { registerWorkingLine, WORKING_INDICATOR_FRAMES } from "./workingLine.js";
 function isEvalMode(env = process.env) {
     return env.YAGNI_CODE_EVAL_MODE === "1";
 }
@@ -160,6 +166,11 @@ export async function registerYagni(pi, deps = {}) {
     // no-position record suggestions reach the model) and record_decision
     // (flywheel-attributed records send dedupe: true). Run 7.
     const flywheelState = makeFlywheelState();
+    // The composed streaming status line ("Shaping… (12m 54s · ↓ 47.5k tokens)").
+    // Registered before the subagent/advisor tools: they publish their live
+    // progress through this handle so the elapsed/token suffix survives their
+    // overrides. TUI-gated internally (agent_start checks ctx.mode).
+    const workingLine = registerWorkingLine(pi);
     pi.registerTool(makeAskYagniTool({ ...toolOpts, flywheel: flywheelState, getRepo: () => sessionRepo }));
     // WebFetch (YAG-578): read an arbitrary URL as clean markdown + a
     // standard-tier extraction, replacing the bash + curl + python dance.
@@ -177,7 +188,11 @@ export async function registerYagni(pi, deps = {}) {
     // hide it forever from a session that switched TO Advanced. One state handle
     // per session, shared with /advise so they draw on the same cap.
     const advisorState = makeAdvisorState();
-    const askAdvisorTool = makeAskAdvisorTool({ state: advisorState });
+    // Session child-usage accumulator: every child process's spend (subagent
+    // tasks, advisor consults, Guardian reviews, /go runs) lands here so the
+    // footer's session totals include what the per-child receipts print.
+    const childUsage = makeChildUsageState();
+    const askAdvisorTool = makeAskAdvisorTool({ state: advisorState, workingLine, childUsage });
     pi.registerTool(askAdvisorTool);
     // /advise runs the SAME tool, sharing the state handle, so a manual consult
     // draws on the same cap rather than opening a side channel around it.
@@ -210,6 +225,11 @@ export async function registerYagni(pi, deps = {}) {
     // temp path, and registers the input transform that turns chips into image
     // attachments for the model. No-op outside TUI mode.
     registerChipEditor(pi);
+    // Hide pi's built-in slash commands that contradict YAGNI's single-provider,
+    // single-identity model (e.g. /share gist upload, /login <provider>) from
+    // slash-discovery. TUI autocomplete only; the desktop palette already
+    // excludes built-ins, and this is a no-op in RPC/print modes.
+    registerSlashCommandFilter(pi);
     // The general subagent tool: delegate self-contained tasks (optionally in
     // parallel) to fresh-context agents defined in .claude/agents / .pi/agents,
     // riding the /go pipeline's child runner. /agents lists what's available.
@@ -217,7 +237,7 @@ export async function registerYagni(pi, deps = {}) {
     // driver's delegation identity for the diamond directive (see the
     // before_agent_start handler below) and widens the tool's fan-out ceiling.
     const ultraHolder = createUltraHolder();
-    registerSubagents(pi, { isUltra: () => ultraHolder.get() });
+    registerSubagents(pi, { isUltra: () => ultraHolder.get(), workingLine, childUsage });
     registerUltraCommand(pi, ultraHolder);
     // Shared fetch timeout for the small, interactive display-path reads below
     // (/cost's spend + headroom, and Task 8's per-run spend for /go's summary):
@@ -227,6 +247,7 @@ export async function registerYagni(pi, deps = {}) {
     // The grounded multi-agent pipeline entry point: /go <ticket> runs
     // map → plan → implement → review → fix, each child grounded by inheritance.
     registerGoCommand(pi, {
+        childUsage,
         // /ultra is one dial for the whole session: the same holder the subagent
         // tool reads widens the implement diamond's parallel ceiling (4 -> 8) for
         // the fan and its fix turns. Read per run, so a toggle lands on the next /go.
@@ -317,7 +338,10 @@ export async function registerYagni(pi, deps = {}) {
         const { event: _ignored, ...fields } = payload;
         logEvent({
             source: "guardian",
-            level: event === "guardian_event_post_failed" ? "error" : "info",
+            // `malformed` is a real failure (this is the "unclear verdict" bug the
+            // whole capture exists to diagnose) — an error, not routine info. The
+            // failed-telemetry event is already an error.
+            level: event === "guardian_event_post_failed" || payload.outcome === "malformed" ? "error" : "info",
             event,
             sessionId: env.YAGNI_SESSION_ID ?? undefined,
             fields,
@@ -341,8 +365,45 @@ export async function registerYagni(pi, deps = {}) {
         guardianLimits,
         guardianTier,
         guardianDisabled,
+        childUsage,
         guardianReview: (command, deps) => reviewCommand(command, { ...deps, modelTier: guardianTier }),
-        onGuardianReview: (ev) => guardianLogSink(ev),
+        onGuardianReview: (ev) => {
+            guardianLogSink(ev);
+            // A malformed verdict is a real failure on our side that must reach
+            // Sentry for EVERY workspace (independent of the opt-in storage tier).
+            // Fire-and-forget to the dedicated telemetry endpoint; fail-soft, and
+            // suppressed under test/eval so a CI run never phones prod.
+            if (ev.outcome === "malformed" && !evalMode && !runningUnderTest(env)) {
+                void (async () => {
+                    try {
+                        const body = {
+                            outcome: ev.outcome,
+                            ...(ev.rawOutput ? { rawOutput: ev.rawOutput } : {}),
+                            ...(ev.durationMs !== undefined ? { durationMs: ev.durationMs } : {}),
+                            ...(ev.tier ? { tier: ev.tier } : {}),
+                        };
+                        const res = await resilientFetch(`${baseUrl}/api/yagni-code/guardian-error`, {
+                            method: "POST",
+                            headers: {
+                                "content-type": "application/json",
+                                authorization: `Bearer ${getTokenFn() ?? ""}`,
+                                ...attributionHeaders(deps.env),
+                            },
+                            body: JSON.stringify(body),
+                        }, {
+                            fetchImpl: authedFetch,
+                            policy: { maxAttempts: 1, backoffBaseMs: 0, backoffMaxMs: 0, timeoutMs: GUARDIAN_EVENT_TIMEOUT_MS, jitterRatio: 0 },
+                        });
+                        if (!res.ok) {
+                            guardianLogSink({ event: "guardian_error_post_failed", status: res.status });
+                        }
+                    }
+                    catch {
+                        guardianLogSink({ event: "guardian_error_post_failed", kind: "network" });
+                    }
+                })();
+            }
+        },
         grants: sessionGrants,
         resolveRepoKey,
         persistGrant: (grant) => {
@@ -593,6 +654,51 @@ export async function registerYagni(pi, deps = {}) {
     // pointers. Computed once per activation (rules are launch-time state, like
     // pi's own skill discovery); fail-soft to null.
     const rulesSection = claudeRulesSection(deps.env ?? process.env);
+    // YAG-575: session scratchpad — a permission-free dir the agent writes its
+    // working state to. Computed + ensured once at activation (like rulesSection,
+    // which must exist before the first before_agent_start), not on session_start,
+    // so the very first turn already carries the section. Fails closed: no
+    // sessionId (a bare pi run) or a failed mkdir means no section, and the mkdir
+    // failure is logged so a missing scratchpad is not silent.
+    const scratchpadDirPath = scratchpadDirFor({
+        sessionId: env.YAGNI_SESSION_ID ?? undefined,
+        cwd: process.cwd(),
+        tmp: env[SCRATCHPAD_TMPDIR_ENV] || undefined,
+    });
+    let scratchpadSectionText;
+    if (scratchpadDirPath) {
+        const ensured = ensureScratchpadDir(scratchpadDirPath);
+        if (ensured) {
+            scratchpadSectionText = scratchpadSection(ensured);
+        }
+        else {
+            logEvent({
+                source: "scratchpad",
+                level: "error",
+                event: "scratchpad_mkdir_failed",
+                sessionId: env.YAGNI_SESSION_ID ?? undefined,
+            });
+        }
+    }
+    // The condensed Claude Code-style transcript: the seven built-ins re-render
+    // as flat "● Tool(arg)" rows, quiet runs collapse into one "Read 2 files,
+    // ran 2 shell commands" summary line, and project writes/edits keep visible
+    // previews. Execution delegates to the same factory-made built-ins pi would
+    // have used (settings-honoring), so ONLY presentation changes — which is why
+    // eval mode keeps pi's stock registration (measured behavior stays
+    // byte-identical) and the desktop surface keeps the structured pipeline.
+    // YAGNI_CLASSIC_TOOL_ROWS=1 is the debugging escape hatch back to pi's
+    // boxed renderers.
+    if (!evalMode && !isDesktopSurface() && env.YAGNI_CLASSIC_TOOL_ROWS !== "1") {
+        try {
+            registerCondensedTools(pi, {
+                ...(scratchpadDirPath ? { scratchpadDir: scratchpadDirPath } : {}),
+            });
+        }
+        catch {
+            // Rendering must never break activation; pi's built-ins remain.
+        }
+    }
     // Own the identity + inject live company context (and repo rules) on every
     // turn. The extension loads identically in every pi process this app spawns —
     // the interactive driver AND every `/go` stage child, subagent, and advisor
@@ -617,6 +723,7 @@ export async function registerYagni(pi, deps = {}) {
                         : YAGNI_IDENTITY_DRIVER
                     : undefined,
                 rulesSection,
+                scratchpadSection: scratchpadSectionText,
             }),
         });
     // Turn-lifecycle WAL: a `turn_start` with no matching `turn_end` is the
@@ -800,7 +907,7 @@ export async function registerYagni(pi, deps = {}) {
             // context % on line 2, and extension statuses (brand, todos, mode) on
             // line 3. The factory captures ctx so the footer can read session data
             // (token stats, context usage) that isn't on the footerData provider.
-            ctx.ui?.setFooter?.((tui, theme, footerData) => createYagniFooterFactory(ctx, modeHolder, footerInvalidateHandle)(tui, theme, footerData));
+            ctx.ui?.setFooter?.((tui, theme, footerData) => createYagniFooterFactory(ctx, modeHolder, footerInvalidateHandle, childUsage)(tui, theme, footerData));
             ctx.ui?.onTerminalInput?.((data) => {
                 if (isShiftTab(data)) {
                     modeHolder.set(cyclePermissionMode(modeHolder.get()));
@@ -819,6 +926,14 @@ export async function registerYagni(pi, deps = {}) {
             catch {
                 // A label must never disrupt session start.
             }
+            // The pulsing star indicator that pairs with the composed working line.
+            // Fails closed to pi's default spinner.
+            try {
+                ctx.ui?.setWorkingIndicator?.({ frames: [...WORKING_INDICATOR_FRAMES], intervalMs: 140 });
+            }
+            catch {
+                // An indicator must never disrupt session start.
+            }
             // One-time hint naming what changed now that reasoning is collapsed by
             // default (option 2). Gated on the launcher's YAGNI_HIDE_THINKING_SEEDED
             // marker so it fires only on the launch that actually seeded the key — it
@@ -1015,5 +1130,10 @@ export { makeTokenProvider, makeAuthedFetch, persistRotationToProfile, PROACTIVE
 // W4 trust plumbing: the durable write-spool for the judgment-capture tools
 // (idempotencyKey-replayed; server-side dedup makes flush safe).
 export { appendToSpool, loadSpool, flushSpool, sendOrSpool, spoolFile, MAX_SPOOL_AGE_MS, _setSpoolHomeForTest, } from "./spool.js";
+// The condensed Claude Code-style transcript: flat tool rows, run summaries,
+// and the composed streaming status line.
+export { registerCondensedTools, displayPath, isScratchpadPath, primaryArg, formatRowTitle, formatWriteBody, formatEditBody, formatBashErrorBody, formatBashPartialBody, formatExpandedOutput, splitBashError, countPatchAdditions, WRITE_PREVIEW_LINES, DIFF_PREVIEW_LINES, } from "./condensedTools.js";
+export { ToolRunTracker, summarizeRun, isQuiet, kindForTool } from "./toolRuns.js";
+export { registerWorkingLine, composeWorkingMessage, NULL_WORKING_LINE, WORKING_INDICATOR_FRAMES, WORKING_VERBS, } from "./workingLine.js";
 export { crashReportsDisabled, installUncaughtExceptionMonitor, makeCrashReporter, reportFatalCrash, sanitizeCrashError, sanitizeCrashText, } from "./crashReport.js";
 //# sourceMappingURL=index.js.map

package/dist/extension/permission/execPolicy.js

@@ -727,12 +727,59 @@ function isPipeToShell(command) {
  * backticks, including inside double quotes). Matches FORBIDDEN rules only —
  * can upgrade the classification, never relax it.
  */
+const QUOTED_HEREDOC_OPEN = /^cat[ \t]+<<[ \t]*(?:'([^']+)'|"([^"]+)"|\\([A-Za-z_][A-Za-z0-9_]*))[ \t]*\r?\n/;
+/**
+ * Recognize the `cat <<'QUOTED' … QUOTED` idiom inside a command substitution.
+ *
+ * This is the one way to pass multi-line body content to `gh`/`git` as a
+ * literal string: the quoted delimiter (`<<'EOF'`, `<<"EOF"`, or `<<\EOF`)
+ * makes the heredoc body literal — no `$`/backtick expansion — and `cat` merely
+ * prints it. A body like `rm -rf /tmp/test-db` inside such a heredoc is PROSE,
+ * not a command; sweeping it for forbidden rules is a false positive.
+ *
+ * Returns true ONLY for the exact safe shape: the whole substitution is `cat`
+ * with no arguments, followed by a heredoc whose delimiter is quoted and whose
+ * terminator is the delimiter on its own final line. Any deviation (unquoted
+ * delimiter, extra args to `cat`, a second command after the terminator)
+ * returns false and falls through to the ordinary danger scan. Safety does not
+ * hinge on this exemption: the outer command (the `gh pr create`, the `rm`) is
+ * still classified on its own merits, heredoc or not.
+ */
+function isLiteralQuotedCatHeredoc(inner) {
+    const text = inner.trim();
+    const m = QUOTED_HEREDOC_OPEN.exec(text);
+    if (!m)
+        return false;
+    const delim = m[1] ?? m[2] ?? m[3];
+    const bodyStart = m[0].length;
+    const lines = text.slice(bodyStart).split(/\r?\n/);
+    if (lines.length === 0)
+        return false;
+    // The final line must be the bare delimiter (the closing `)` is already
+    // stripped by extractSubstitutions).
+    if (lines[lines.length - 1].trim() !== delim)
+        return false;
+    // No line BEFORE the terminator may equal the delimiter: in real bash, a
+    // delimiter line terminates the heredoc there, turning everything after it
+    // into an executed command (e.g. a body with a bare `EOF` line followed by
+    // `rm -rf /x` would run the `rm`). Reject that shape and fall to the scan.
+    for (const line of lines.slice(0, -1)) {
+        if (line.trim() === delim)
+            return false;
+    }
+    return true;
+}
 function dangerScanSubstitutions(command, policy, depth) {
     if (depth > MAX_SCAN_DEPTH)
         return null;
     for (const inner of extractSubstitutions(command)) {
         if (inner.trim().length === 0)
             continue;
+        // Quoted-heredoc cat: the body is literal data, not an executable
+        // command — skipping it avoids false "forbidden" hits on prose that happens
+        // to contain a forbidden-looking token. The outer command still classifies.
+        if (isLiteralQuotedCatHeredoc(inner))
+            continue;
         if (isPipeToShell(inner)) {
             return {
                 decision: "forbidden",

package/dist/extension/permission/gate.d.ts

@@ -151,6 +151,12 @@ export interface RegisterPermissionDeps {
     guardianState?: import("./guardian.js").GuardianStateHandle;
     /** Guardian limits (timeouts, circuit breaker). Defaults to DEFAULT_GUARDIAN_LIMITS. */
     guardianLimits?: import("./guardian.js").GuardianLimits;
+    /**
+     * Session child-usage accumulator (childUsage.ts): each completed Guardian
+     * review's spend is recorded so the footer's session totals include it.
+     * Absent = not wired: no recording, nothing else changes.
+     */
+    childUsage?: import("../childUsage.js").ChildUsageHandle;
     /** Override the Guardian model tier (default: efficient). */
     guardianTier?: string;
     /** Injectable Guardian review function (tests pass a stub). */

package/dist/extension/permission/gate.js

@@ -366,6 +366,10 @@ export function registerPermissionGate(pi, deps = {}) {
     const ERROR_ASK_CAP = 3;
     let errorFallbackAsks = 0;
     let breakerEscalationOffered = false;
+    // Uniquifies each Guardian review's childUsage key: parallel gated tool
+    // calls can start their reviews in the same millisecond, and a timestamp
+    // alone would silently drop the second review's spend as a "duplicate".
+    let reviewSpendSeq = 0;
     const emitGateEvent = (event) => {
         if (!deps.onGuardianEvent)
             return;
@@ -561,13 +565,18 @@ export function registerPermissionGate(pi, deps = {}) {
                             ctx.ui.setStatus?.("yagni-guardian", undefined);
                     }
                     const durationMs = Date.now() - startMs;
-                    const emitDiag = (outcome, rationale) => {
+                    // Footer session totals include the review's spend. Each review
+                    // records exactly once, right here, so the key only has to be unique
+                    // per review — the seq keeps same-millisecond parallel reviews apart.
+                    deps.childUsage?.record("guardian", `${startMs}#${reviewSpendSeq++}`, { cost: reviewResult.cost });
+                    const emitDiag = (outcome, rationale, rawOutput) => {
                         if (!deps.onGuardianReview)
                             return;
                         void Promise.resolve(deps.onGuardianReview(buildDiagnosticEvent(outcome, {
                             durationMs,
                             tier: guardianTier,
                             ...(rationale ? { rationale } : {}),
+                            ...(rawOutput ? { rawOutput } : {}),
                             debug: isDebug(),
                         }))).catch(() => { });
                     };
@@ -734,7 +743,7 @@ export function registerPermissionGate(pi, deps = {}) {
                     }
                     // Guardian failed (timeout/malformed/network/empty/aborted).
                     const error = reviewResult.error ?? "network";
-                    emitDiag(error);
+                    emitDiag(error, undefined, reviewResult.rawOutput);
                     if (error === "aborted" || ctx?.signal?.aborted) {
                         // The user aborted mid-consult — silent block: no dialog, no
                         // "Guardian unavailable" warning on a turn they deliberately

package/dist/extension/permission/guardian.d.ts

@@ -106,7 +106,20 @@ export interface ReviewResult {
     verdict: GuardianVerdict | null;
     error?: GuardianError;
     cost: number;
+    /**
+     * Scrubbed + capped copy of the model output when the verdict failed to
+     * parse (`error: "malformed"`). Present so the sink can capture the exact
+     * failure shape. Never contains the raw command unredacted: `scrubSecrets`
+     * removes secret-shaped values before this is stored.
+     */
+    rawOutput?: string;
 }
+/**
+ * Cap on the malformed-output capture. The model's unparseable verdict is
+ * usually a single short JSON-ish blob; this bounds a pathological output so
+ * it cannot balloon a log line or a Sentry payload.
+ */
+export declare const GUARDIAN_RAW_OUTPUT_CAP = 2048;
 export interface ReviewCommandDeps {
     runStage?: typeof defaultRunStage;
     cwd: string;
@@ -143,6 +156,12 @@ export interface GuardianDiagnosticEvent {
     commandHash?: string;
     /** Debug-only: the Guardian's rationale. */
     rationale?: string;
+    /**
+     * Scrubbed + capped copy of the unparseable model output, present only for
+     * `outcome: "malformed"`. Always-on (NOT debug-gated): it is already
+     * `scrubSecrets`-redacted and size-capped at the source.
+     */
+    rawOutput?: string;
 }
 /**
  * Create a sanitized diagnostic event. Never includes the raw command text
@@ -153,6 +172,7 @@ export declare function buildDiagnosticEvent(outcome: GuardianOutcome | Guardian
     tier?: string;
     rationale?: string;
     commandHash?: string;
+    rawOutput?: string;
     debug?: boolean;
 }): GuardianDiagnosticEvent;
 //# sourceMappingURL=guardian.d.ts.map

package/dist/extension/permission/guardian.js

@@ -28,6 +28,7 @@
  * alternating deny/ask.
  */
 import { runStage as defaultRunStage } from "../pipeline/runner.js";
+import { scrubSecrets } from "../pipeline/scrubSecrets.js";
 export const DEFAULT_GUARDIAN_LIMITS = {
     maxReviews: 120,
     maxConsecutiveDenials: 3,
@@ -161,6 +162,12 @@ export function formatGuardianSubtotal(state, limits) {
     const plural = state.reviews === 1 ? "review" : "reviews";
     return `Guardian: ${state.reviews} ${plural}.`;
 }
+/**
+ * Cap on the malformed-output capture. The model's unparseable verdict is
+ * usually a single short JSON-ish blob; this bounds a pathological output so
+ * it cannot balloon a log line or a Sentry payload.
+ */
+export const GUARDIAN_RAW_OUTPUT_CAP = 2048;
 /**
  * The synthetic stage a Guardian consult runs as. Borrows the `plan` StageId
  * (same pattern as the advisor) so it doesn't ripple into feed/reducers. The
@@ -231,7 +238,14 @@ export async function reviewCommand(command, deps) {
         }
         const verdict = parseVerdict(output);
         if (!verdict) {
-            return { verdict: null, error: "malformed", cost };
+            // Scrubbed + capped so the local sink and Sentry can see the exact
+            // failure shape without carrying a raw command or a secret it echoed.
+            return {
+                verdict: null,
+                error: "malformed",
+                cost,
+                rawOutput: scrubSecrets(output).slice(0, GUARDIAN_RAW_OUTPUT_CAP),
+            };
         }
         return { verdict, cost };
     }
@@ -261,6 +275,7 @@ export function buildDiagnosticEvent(outcome, opts) {
         outcome,
         ...(opts.durationMs !== undefined ? { durationMs: opts.durationMs } : {}),
         ...(opts.tier !== undefined ? { tier: opts.tier } : {}),
+        ...(opts.rawOutput !== undefined ? { rawOutput: opts.rawOutput } : {}),
     };
     if (opts.debug) {
         if (opts.rationale)

package/dist/extension/pipeline/goCommand.d.ts

@@ -110,6 +110,14 @@ export interface RegisterGoDeps {
      * cares injects its own fake.
      */
     fetchRunSpend?: (runId: string, signal?: AbortSignal) => Promise<SpendResponse | null>;
+    /**
+     * Session child-usage accumulator (childUsage.ts). Each attempt's newly-run
+     * stage usage is recorded (keyed by runId + attempt start, because a resumed
+     * attempt's stages are new spend, never a replay) so the footer's session
+     * totals include /go spend — the same figure `runCostNote` already prints.
+     * Absent = not wired.
+     */
+    childUsage?: import("../childUsage.js").ChildUsageHandle;
     /** Injectable fs existence check (worktree adoption on resume). */
     exists?: (path: string) => boolean;
     /** Clock seam for registry rows + staleness. */

package/dist/extension/pipeline/goCommand.js

@@ -969,6 +969,14 @@ export function registerGoCommand(pi, deps = {}) {
                     if (result.stopReason === "clean" && runSignal.aborted) {
                         result = { ...result, stopReason: "aborted" };
                     }
+                    // Footer session totals include this run's spend. Keyed per ATTEMPT
+                    // (runId + this invocation's start), not per runId: `result.stages`
+                    // only ever holds the stages THIS attempt actually ran (a resume's
+                    // replayed spend lives in the checkpoint's priorUsage, never here),
+                    // so an abort → same-session resume must record both attempts — a
+                    // runId-only key would silently drop the resume's new spend. Partial
+                    // spend on an aborted attempt is still real spend worth counting.
+                    deps.childUsage?.record("go", `${runId}@${startedAt}`, aggregateRunUsage(result.stages, result.rounds));
                     // FINISH stage (spec §3c): ONLY on a clean stop. Commit the run's work
                     // (worktree always; --here only over a clean pre-run baseline) with the
                     // provenance trailer, and push + PR when --pr asked for it. Iron

package/dist/extension/pipeline/invocation.d.ts

@@ -65,9 +65,16 @@ export declare function buildStageInvocation(stage: PipelineStage, ctx: {
  * `yagni` provider) before a stage passthrough. Mirrors buildLaunch's
  * `userChoseProvider` guard so a passthrough that already chose a provider is
  * left untouched.
+ *
+ * `otelExtensionPath` (absent on a non-exporting launch) additionally loads
+ * pi-otel so child LLM spend is traced too — stage children are the bulk of a
+ * /go run's cost, and an OTel export that misses them undercounts. The path
+ * arrives via `YAGNI_OTEL_EXTENSION_PATH` from the launcher's gate (see the
+ * CLI's otel.ts); the capture-mode and endpoint env rides the inherited env.
  */
 export declare function groundedChildArgv(stageArgv: string[], opts: {
     piCli: string;
     extensionPath: string;
+    otelExtensionPath?: string;
 }): string[];
 //# sourceMappingURL=invocation.d.ts.map

package/dist/extension/pipeline/invocation.js

@@ -84,6 +84,12 @@ export function buildStageInvocation(stage, ctx) {
  * `yagni` provider) before a stage passthrough. Mirrors buildLaunch's
  * `userChoseProvider` guard so a passthrough that already chose a provider is
  * left untouched.
+ *
+ * `otelExtensionPath` (absent on a non-exporting launch) additionally loads
+ * pi-otel so child LLM spend is traced too — stage children are the bulk of a
+ * /go run's cost, and an OTel export that misses them undercounts. The path
+ * arrives via `YAGNI_OTEL_EXTENSION_PATH` from the launcher's gate (see the
+ * CLI's otel.ts); the capture-mode and endpoint env rides the inherited env.
  */
 export function groundedChildArgv(stageArgv, opts) {
     const userChoseProvider = stageArgv.includes("--provider");
@@ -91,6 +97,7 @@ export function groundedChildArgv(stageArgv, opts) {
         opts.piCli,
         "-e",
         opts.extensionPath,
+        ...(opts.otelExtensionPath ? ["-e", opts.otelExtensionPath] : []),
         ...(userChoseProvider ? [] : ["--provider", "yagni"]),
         ...stageArgv,
     ];