@code-yeongyu/senpi 2026.11.10 → 2026.11.11

package/dist/core/extensions/builtin/anthropic-subscription/context-window.js

@@ -1,6 +1,29 @@
 import { longContextAvailable } from "./long-context.js";
 /** Claude Code's default window when a request does not ask for the long context. */
 export const CLAUDE_CODE_DEFAULT_CONTEXT_WINDOW = 200_000;
+/** The most of a request's output budget Claude Code holds back from its window (`zoo` in Claude Code 2.1.321). */
+const CLAUDE_CODE_OUTPUT_RESERVE_CAP = 20_000;
+/** The margin Claude Code keeps below its reserved window before it refuses a request (`Woo` in Claude Code 2.1.321). */
+const CLAUDE_CODE_BLOCKING_BUFFER = 3_000;
+/**
+ * The `CLAUDE_CODE_MAX_CONTEXT_TOKENS` that makes Claude Code accept a conversation up to `window`.
+ *
+ * With `DISABLE_COMPACT` set, Claude Code takes that variable as the model's window, then refuses a
+ * request on its own, with no API call, once the conversation passes the window minus its output reserve
+ * (the request's output budget, capped at 20k) minus a 3k buffer. Handing it the bare planned window put
+ * that limit 23k below the window senpi compacts against, so every turn between the two failed in
+ * milliseconds with "Prompt is too long", and so did the summarization request of the recovery
+ * compaction. senpi keeps its own output reserve below `window`, so the variable carries the window plus
+ * Claude Code's reserve and Claude Code's limit lands on `window` itself.
+ *
+ * `outputTokens` is the output budget Claude Code reserves for the request. Without an explicit
+ * `CLAUDE_CODE_MAX_OUTPUT_TOKENS` it is the model's own default, which is at least the cap for every
+ * Claude model, so the cap is the default here; a larger addition only lets a request reach the API's own
+ * window check, whose error senpi's overflow recovery already parses.
+ */
+export function claudeCodeMaxContextTokens(window, outputTokens = CLAUDE_CODE_OUTPUT_RESERVE_CAP) {
+    return window + Math.min(outputTokens, CLAUDE_CODE_OUTPUT_RESERVE_CAP) + CLAUDE_CODE_BLOCKING_BUFFER;
+}
 /**
  * Models whose 1M window is reachable only through Claude Code's `[1m]` opt-in, which sends the legacy
  * `context-1m-2025-08-07` beta that a subscription without extra usage refuses. These are the rows of

package/dist/core/extensions/builtin/anthropic-subscription/errors.d.ts

@@ -10,6 +10,7 @@ export type SdkErrorClassification = {
     /** Set on an auth failure that proves the login itself is gone, so the account needs a new sign-in (senpi#5350). */
     signInRequired?: "login_expired";
 };
+export declare function errorText(error: unknown): string;
 export declare function isExtraUsageExhausted(error: unknown): boolean;
 export type SdkResultUsage = Extract<SDKMessage, {
     type: "result";

package/dist/core/extensions/builtin/anthropic-subscription/errors.js

@@ -21,21 +21,30 @@ function record(value) {
         ? value
         : undefined;
 }
-function errorText(error) {
+/** `String()` throws for a null-prototype object or a throwing `toString`; the classifiers must never throw. */
+function safeString(value) {
+    try {
+        return String(value);
+    }
+    catch {
+        return Object.prototype.toString.call(value);
+    }
+}
+export function errorText(error) {
     if (typeof error === "string")
         return error;
-    if (error instanceof Error)
-        return error.message;
     const value = record(error);
     if (!value)
-        return String(error);
+        return safeString(error);
     const message = value.message;
     if (typeof message === "string")
         return message;
+    if (error instanceof Error)
+        return safeString(message);
     const code = value.error;
     if (typeof code === "string")
         return code;
-    return String(error);
+    return safeString(error);
 }
 export function isExtraUsageExhausted(error) {
     return EXTRA_USAGE_EXHAUSTED.test(errorText(error).toLowerCase());

package/dist/core/extensions/builtin/anthropic-subscription/oauth-login.js

@@ -306,17 +306,17 @@ export function createOAuthConfig(deps) {
                 cancelled();
                 callbacks.onProgress?.(check.outcome === "ok"
                     ? `Connection test passed on ${model}`
-                    : `Connection test failed on ${model} (${check.reason ?? "unknown"}); the account was kept. Retry from the account list.`);
+                    : `Connection test failed on ${model}: ${check.status === undefined ? "" : `HTTP ${check.status}: `}${check.message ?? check.reason ?? "No provider response was retained"}; the account was kept. Retry from the account list.`);
                 // The slot stays written: the caller's commit merges onto it, so the account owns its dir throughout.
                 let tested = slot;
                 const saved = await credentials.modify(ANTHROPIC_SUBSCRIPTION_PROVIDER_ID, async (stored) => {
                     const base = storedSubscription(stored) ?? withSlot(current, slot);
                     tested = base.accounts?.find((candidate) => candidate.name === name) ?? slot;
-                    return withCheck(base, name, check);
+                    return withCheck(base, name, check, dirId);
                 });
                 if (callbacks.signal !== undefined)
                     recordClaudeCliLoginOutcome(callbacks.signal, { account: { name }, check });
-                signedInCredential = withCheck(withSlot(storedSubscription(saved) ?? current, tested), name, check);
+                signedInCredential = withCheck(withSlot(storedSubscription(saved) ?? current, tested), name, check, dirId);
             }
             catch (error) {
                 try {

package/dist/core/extensions/builtin/anthropic-subscription/prompt-cache-ttl.d.ts

@@ -11,11 +11,17 @@ type QueryEnvironment = {
  * Pin Claude Code's prompt-cache lifetime for a one-shot query and return it, so senpi's history breakpoint uses the
  * same lifetime (senpi#2982). The Messages API rejects a 1-hour breakpoint that follows a 5-minute one, and Claude Code
  * otherwise picks its lifetime per request: 1 hour on a subscription within its usage limits, 5 minutes on an API key
- * or after the limits. `FORCE_PROMPT_CACHING_5M` wins, as it does in Claude Code; then an explicit
- * `CLAUDE_CODE_PROMPT_CACHE_TTL`. The managed subscription lanes pin 1 hour,
+ * or after the limits. `FORCE_PROMPT_CACHING_5M` wins, as it does in Claude Code; then a lifetime from a loaded
+ * settings file. The managed subscription lanes pin 1 hour,
  * Claude Code's subscription default; so does the `claude-cli` lane, whose account is a verified first-party claude.ai login. The ambient lane can be an API key or a subscription login, so nothing is
- * pinned there and the caller adds no breakpoint.
+ * pinned there unless a lifetime is set explicitly — and a lifetime set in a loaded settings file counts as explicit
+ * (senpi#2988): Claude Code applies the `env` block of the settings files it loads, so `settingsEnv` carries the
+ * effective settings env for the sources this attempt loads. Precedence is settings env, then explicit env, then the
+ * lane default: Claude Code writes each settings source's env over the process env, and launch-env keys are only
+ * protected when the session is host-orchestrated (a desktop host, or `CLAUDE_CODE_ENVIRONMENT_KIND=byoc`); an SDK
+ * spawn is neither, so a settings value wins over the process env and over `options.env`, and a settings value
+ * wins over senpi's assumption about Claude Code's default.
  */
-export declare function pinOneShotPromptCacheTtl(options: QueryEnvironment, authLane: AnthropicSubscriptionAuthLane, environment: Readonly<Record<string, string | undefined>>): PromptCacheTtl | undefined;
+export declare function pinOneShotPromptCacheTtl(options: QueryEnvironment, authLane: AnthropicSubscriptionAuthLane, environment: Readonly<Record<string, string | undefined>>, settingsEnv?: Readonly<Record<string, string | undefined>>): PromptCacheTtl | undefined;
 export {};
 //# sourceMappingURL=prompt-cache-ttl.d.ts.map

package/dist/core/extensions/builtin/anthropic-subscription/prompt-cache-ttl.js

@@ -11,14 +11,23 @@ function parsePromptCacheTtl(value) {
  * Pin Claude Code's prompt-cache lifetime for a one-shot query and return it, so senpi's history breakpoint uses the
  * same lifetime (senpi#2982). The Messages API rejects a 1-hour breakpoint that follows a 5-minute one, and Claude Code
  * otherwise picks its lifetime per request: 1 hour on a subscription within its usage limits, 5 minutes on an API key
- * or after the limits. `FORCE_PROMPT_CACHING_5M` wins, as it does in Claude Code; then an explicit
- * `CLAUDE_CODE_PROMPT_CACHE_TTL`. The managed subscription lanes pin 1 hour,
+ * or after the limits. `FORCE_PROMPT_CACHING_5M` wins, as it does in Claude Code; then a lifetime from a loaded
+ * settings file. The managed subscription lanes pin 1 hour,
  * Claude Code's subscription default; so does the `claude-cli` lane, whose account is a verified first-party claude.ai login. The ambient lane can be an API key or a subscription login, so nothing is
- * pinned there and the caller adds no breakpoint.
+ * pinned there unless a lifetime is set explicitly — and a lifetime set in a loaded settings file counts as explicit
+ * (senpi#2988): Claude Code applies the `env` block of the settings files it loads, so `settingsEnv` carries the
+ * effective settings env for the sources this attempt loads. Precedence is settings env, then explicit env, then the
+ * lane default: Claude Code writes each settings source's env over the process env, and launch-env keys are only
+ * protected when the session is host-orchestrated (a desktop host, or `CLAUDE_CODE_ENVIRONMENT_KIND=byoc`); an SDK
+ * spawn is neither, so a settings value wins over the process env and over `options.env`, and a settings value
+ * wins over senpi's assumption about Claude Code's default.
  */
-export function pinOneShotPromptCacheTtl(options, authLane, environment) {
-    const forced5m = isTruthy(options.env?.[FORCE_PROMPT_CACHING_5M_ENV]) || isTruthy(environment[FORCE_PROMPT_CACHING_5M_ENV]);
+export function pinOneShotPromptCacheTtl(options, authLane, environment, settingsEnv) {
+    const forced5m = isTruthy(options.env?.[FORCE_PROMPT_CACHING_5M_ENV]) ||
+        isTruthy(environment[FORCE_PROMPT_CACHING_5M_ENV]) ||
+        isTruthy(settingsEnv?.[FORCE_PROMPT_CACHING_5M_ENV]);
     const ttl = (forced5m ? "5m" : undefined) ??
+        parsePromptCacheTtl(settingsEnv?.[PROMPT_CACHE_TTL_ENV]) ??
         parsePromptCacheTtl(options.env?.[PROMPT_CACHE_TTL_ENV]) ??
         parsePromptCacheTtl(environment[PROMPT_CACHE_TTL_ENV]) ??
         (authLane === "ambient" ? undefined : "1h");

package/dist/core/extensions/builtin/anthropic-subscription/query-environment.d.ts

@@ -5,8 +5,9 @@ import type { Api, Model } from "@earendil-works/pi-ai";
  *
  * - Compaction (senpi owner): Claude Code's per-turn token-budget reminder changes the prompt every turn and defeats
  *   prompt-cache reuse; senpi's compaction carries its own budget reminder. With DISABLE_COMPACT set, Claude Code takes
- *   CLAUDE_CODE_MAX_CONTEXT_TOKENS over every model rule of its own, so it plans the window senpi plans (senpi#3801),
- *   and its native compaction stays off.
+ *   CLAUDE_CODE_MAX_CONTEXT_TOKENS over every model rule of its own (senpi#3801) and its native compaction stays off.
+ *   The variable carries the planned window plus the output reserve Claude Code holds back from it, so Claude Code
+ *   refuses a request only past the window senpi plans, not 23k below the window senpi compacts against.
  * - Base URL: the registration baseUrl is the api-id sentinel. Any other value is the user's models.json baseUrl
  *   (senpi#4765); Claude Code sends its requests to `ANTHROPIC_BASE_URL` and keeps the selected login as the credential.
  */

package/dist/core/extensions/builtin/anthropic-subscription/query-environment.js

@@ -1,13 +1,14 @@
 import { CLAUDE_SDK_OAUTH_API_ID } from "./api-id.js";
-import { plannedContextWindow } from "./context-window.js";
+import { claudeCodeMaxContextTokens, plannedContextWindow } from "./context-window.js";
 /**
  * Variables the lane layers over the Claude Code subprocess environment the auth lane builds; they win over the
  * host's, including the managed lanes' stripped `ANTHROPIC_BASE_URL`.
  *
  * - Compaction (senpi owner): Claude Code's per-turn token-budget reminder changes the prompt every turn and defeats
  *   prompt-cache reuse; senpi's compaction carries its own budget reminder. With DISABLE_COMPACT set, Claude Code takes
- *   CLAUDE_CODE_MAX_CONTEXT_TOKENS over every model rule of its own, so it plans the window senpi plans (senpi#3801),
- *   and its native compaction stays off.
+ *   CLAUDE_CODE_MAX_CONTEXT_TOKENS over every model rule of its own (senpi#3801) and its native compaction stays off.
+ *   The variable carries the planned window plus the output reserve Claude Code holds back from it, so Claude Code
+ *   refuses a request only past the window senpi plans, not 23k below the window senpi compacts against.
  * - Base URL: the registration baseUrl is the api-id sentinel. Any other value is the user's models.json baseUrl
  *   (senpi#4765); Claude Code sends its requests to `ANTHROPIC_BASE_URL` and keeps the selected login as the credential.
  */
@@ -15,7 +16,7 @@ export function claudeCodeQueryEnvironment(model, senpiOwnsCompaction) {
     const environment = {};
     if (senpiOwnsCompaction) {
         environment.CLAUDE_CODE_TOTAL_TOKENS_REMINDER = "off";
-        environment.CLAUDE_CODE_MAX_CONTEXT_TOKENS = String(plannedContextWindow(model));
+        environment.CLAUDE_CODE_MAX_CONTEXT_TOKENS = String(claudeCodeMaxContextTokens(plannedContextWindow(model)));
         environment.DISABLE_COMPACT = "1";
     }
     if (model.baseUrl !== CLAUDE_SDK_OAUTH_API_ID)

package/dist/core/extensions/builtin/anthropic-subscription/sdk-boundary.lazy.d.ts

@@ -20,11 +20,12 @@
  * (`packages/ai/src/api/*.lazy.ts`); `test/startup-import-graph.test.ts` fails
  * if a static edge to the SDK reappears.
  */
-import type { createSdkMcpServer, getSessionMessages, query } from "@anthropic-ai/claude-agent-sdk";
+import type { createSdkMcpServer, getSessionMessages, query, resolveSettings } from "@anthropic-ai/claude-agent-sdk";
 export type ClaudeAgentSdkModule = {
     query: typeof query;
     createSdkMcpServer: typeof createSdkMcpServer;
     getSessionMessages: typeof getSessionMessages;
+    resolveSettings: typeof resolveSettings;
 };
 /**
  * Loads the SDK once and caches it. Concurrent callers share the in-flight

package/dist/core/extensions/builtin/anthropic-subscription/sdk-boundary.lazy.js

@@ -13,6 +13,7 @@ export function loadClaudeAgentSdk() {
             query: module.query,
             createSdkMcpServer: module.createSdkMcpServer,
             getSessionMessages: module.getSessionMessages,
+            resolveSettings: module.resolveSettings,
         };
         return loaded;
     })

package/dist/core/extensions/builtin/anthropic-subscription/stream.js

@@ -5,6 +5,7 @@ import { queryWithAuthLane } from "./auth-lane.js";
 import { markColdSeedOverflow } from "./cold-seed-budget.js";
 import { CLAUDE_CODE_DEFAULT_CONTEXT_WINDOW } from "./context-window.js";
 import { buildCustomToolServers } from "./custom-tools.js";
+import { resolveQuerySettingsEnv } from "./claude-settings-env.js";
 import { sdkAssistantFailure, sdkResultFailure, sdkResultFailureUsage } from "./errors.js";
 import { defaultExecutableDeps, resolveClaudeCodeRun } from "./executable.js";
 import { estimateLongContextFallbackTokens } from "./long-context-budget.js";
@@ -79,6 +80,10 @@ export function streamAnthropicSubscription(model, context, options) {
                 toolWatch.reconcileWithContext(sessionKey, context);
             const toolWatchNote = toolWatch.buildPromptNote(sessionKey, context, resolvedTools.customToolNameToSdk);
             const providerSettings = loadAnthropicSubscriptionProviderSettingsFromDisk(cwd);
+            // The effective `env` block of the settings files this stream's queries load (senpi#2988 item 4): a
+            // lifetime set there is what Claude Code will actually use, so the pin must see it. Resolved once per
+            // stream; the pin only receives it for attempts whose settingSources are non-empty.
+            const settingsEnv = await resolveQuerySettingsEnv(cwd, providerSettings);
             const senpiOwnsCompaction = resolveCompactionOwner(providerSettings) === "senpi";
             const toolLessRequest = options?.toolChoice === "none";
             const mcpServers = toolLessRequest ? undefined : await buildCustomToolServers(resolvedTools.customTools);
@@ -107,7 +112,12 @@ export function streamAnthropicSubscription(model, context, options) {
                     queryOptions.mcpServers = mcpServers;
                 // The one-shot prompt is built after this, for the lane this attempt resolved (senpi#2982).
                 if (!useResidentSession) {
-                    oneShotCacheTtl = pinOneShotPromptCacheTtl(queryOptions, authLane ?? providerSettings.tokenInjection ?? "ambient", { ...process.env, ...options?.env });
+                    oneShotCacheTtl = pinOneShotPromptCacheTtl(queryOptions, authLane ?? providerSettings.tokenInjection ?? "ambient", { ...process.env, ...options?.env }, 
+                    // Only the settings files this attempt loads can set its lifetime: managed lanes load
+                    // none, so nothing is passed there (senpi#2988).
+                    queryOptions.settingSources !== undefined && queryOptions.settingSources.length > 0
+                        ? settingsEnv
+                        : undefined);
                 }
                 return queryOptions;
             };

package/dist/core/extensions/builtin/config-reload/change-groups.js

@@ -7,8 +7,12 @@ export function groupChangedPaths(paths, targets, rearmedContainers) {
             if (!targetMatchesPath(activeTarget.target, path))
                 continue;
             matched = true;
-            // The project container only rearms discovery; newly discovered config files carry the change.
-            if (activeTarget.target.id === "builtin-project-presence" && rearmedContainers.includes(resolve(path)))
+            // Discovery containers only rearm their watches; discovered files carry the change.
+            // An extensions directory may contain only runtime state (e.g. a park's goal/no-session).
+            if (rearmedContainers.includes(resolve(path)) &&
+                (activeTarget.target.id === "builtin-project-presence" ||
+                    activeTarget.target.id === "builtin-global-extensions" ||
+                    activeTarget.target.id === "builtin-project-extensions"))
                 continue;
             const group = groups.get(activeTarget.registrationId) ?? [];
             if (!group.includes(path))

package/dist/core/extensions/builtin/goal/continuation.d.ts

@@ -33,6 +33,12 @@ export type GoalContinuationInput = {
     readonly continuationPending: boolean;
     /** The last turn was rejected (or silently starved) by context size and recovery did not shrink it. */
     readonly lastTurnStuckOnContextOverflow: boolean;
+    /**
+     * The wake re-checks a provider that refused for a usage or rate limit, either on the armed provider retry or as
+     * the first wake of a session opened in the middle of that wait. Waiting out a limit is not a stall, so it spends
+     * neither the continuation cap nor the no-progress budget (senpi#4085).
+     */
+    readonly limitWait?: boolean;
 };
 export type GoalContinuationVerdict = {
     kind: "continue";

package/dist/core/extensions/builtin/goal/continuation.js

@@ -67,9 +67,10 @@ export function evaluateGoalContinuation(input) {
         return { kind: "deny", reason: "single-flight" };
     if (hasRepeatedNormalizedOutputHash(input.recentNormalizedOutputHashes))
         return { kind: "deny", reason: "repetition" };
-    if (isNoProgressBudgetExhausted(input))
+    const limitWait = (input.path === "providerRecovery" || input.path === "sessionStart") && input.limitWait === true;
+    if (!limitWait && isNoProgressBudgetExhausted(input))
         return { kind: "deny", reason: "no-progress" };
-    if (input.consecutiveContinuations >= GOAL_CONTINUATION_CAP) {
+    if (!limitWait && input.consecutiveContinuations >= GOAL_CONTINUATION_CAP) {
         return { kind: "deny", reason: "cap" };
     }
     if ((input.path === "immediate" || input.path === "userGrace") &&

package/dist/core/extensions/builtin/goal/index.js

@@ -1,5 +1,4 @@
 import { MANUAL_CONTINUE_CUSTOM_TYPE } from "../../../manual-continue.js";
-import { GOAL_CONTINUATION_MESSAGE_TYPE } from "../../../messages.js";
 import { buildDeadlineStopNotice, deadlineStopPendingSinceLastTurn, TURN_DEADLINE_ENTRY_TYPE, } from "../../../turn-deadline.js";
 import { noticeEntryRenderer } from "../../notice/index.js";
 import { continueGoalAfterAgentEnd } from "./agent-end-continuation.js";
@@ -11,10 +10,11 @@ import { GoalDirectInputLifecycle } from "./direct-input-lifecycle.js";
 import { GoalElapsedTicker } from "./elapsed-ticker.js";
 import { formatGoalForTool, goalStatusLabel } from "./format.js";
 import { goalLifecycleChanged, registerGoalLifecycleCollector } from "./lifecycle-facts.js";
-import { GOAL_STALE_STOP_NOTICE, isResumeOfStoppedGoal, queueGoalContinuation } from "./lifecycle-helpers.js";
+import { GOAL_STALE_STOP_NOTICE, isResumeOfStoppedGoal, recoverMissingGoalContinuationStop, } from "./lifecycle-helpers.js";
 import { GOAL_CONTINUATION_SCHEDULED_EVENT, MonitorAwareGoalContinuation } from "./monitor-continuation.js";
 import { reengageGoalAfterReload } from "./reload-reengagement.js";
 import { registerGoalFireNowRequest } from "./rpc-wait-surface.js";
+import { queueGoalContinuation, readTrailingGoalContinuations } from "./session-start-continuation.js";
 import { isStaleExtensionContextError } from "./stale-context.js";
 import { interruptedRunHeld, markStopPaused, markStopResumed, pausedByStop, stopHoldLive } from "./stop-pause.js";
 import { accountGoalUsage, migrateLegacyGoal, readGoal, updateGoal } from "./store.js";
@@ -156,6 +156,10 @@ export default function goalExtension(pi) {
         const ref = goalStoreRef(ctx);
         await migrateLegacyGoal(ref);
         let goal = await readGoal(goalStoreRef(ctx));
+        // senpi#3015: a crash between the stop claim and the session append leaves the claim
+        // without its entries; re-append the missing ones once on reopen.
+        if (goal)
+            await recoverMissingGoalContinuationStop(pi, ctx, goal);
         // A process that died mid-turn never ran the quit-time abort that stops an active goal (senpi#5753). Stop it the
         // same way here, so the resume prompt below asks before any continuation runs (senpi#5755). Opening that session
         // at launch (`--continue`, `--session`) is the same resume, so it asks too.
@@ -202,26 +206,26 @@ export default function goalExtension(pi) {
                 ctx,
                 goal,
                 monitor: monitorContinuation,
-                countTrailingContinuations: () => countTrailingGoalContinuationEntries(ctx.sessionManager.getBranch()),
-                queueContinuation: () => queueGoalContinuationForCurrentSession(pi, ctx, goal),
+                readTrailingContinuations: () => readTrailingGoalContinuations(ctx.sessionManager.getBranch()),
+                queueContinuation: (limitWait) => queueGoalContinuationForCurrentSession(pi, ctx, goal, limitWait),
             });
         }
         else if (goal) {
             // Migration-lite admission: a resumed session carrying a trailing flood of
             // historical continuations must not reignite on load. Skip the auto-queue,
             // leave the goal active (no status rewrite), and tell the user how to resume.
-            const trailingContinuations = countTrailingGoalContinuationEntries(ctx.sessionManager.getBranch());
-            if (trailingContinuations >= GOAL_CONTINUATION_CAP) {
+            const trailing = readTrailingGoalContinuations(ctx.sessionManager.getBranch());
+            if (trailing.counted >= GOAL_CONTINUATION_CAP) {
                 // The load-time flood suppression parks the goal without rewriting its
                 // status, so the only resume signal left is the user's next message.
                 // Arm the one-shot latch the direct-input lifecycle fires when that
                 // message is accepted; without it the promise in the notice is a lie
                 // and the resumed session sits idle until the goal is recreated.
                 directInputLifecycle.armSuppressedLoadResume();
-                ctx.ui.notify(`Goal auto-continuation suppressed for this resumed session (${trailingContinuations} historical continuations). Send a message to resume.`, "info");
+                ctx.ui.notify(`Goal auto-continuation suppressed for this resumed session (${trailing.counted} historical continuations). Send a message to resume.`, "info");
             }
             else {
-                await queueGoalContinuationForCurrentSession(pi, ctx, goal);
+                await queueGoalContinuationForCurrentSession(pi, ctx, goal, trailing.waitingOutLimit);
             }
         }
     });
@@ -407,12 +411,13 @@ export default function goalExtension(pi) {
         await queueGoalContinuationForCurrentSession(pi, ctx, resumed);
         return true;
     }
-    async function queueGoalContinuationForCurrentSession(extensionApi, ctx, goal) {
+    async function queueGoalContinuationForCurrentSession(extensionApi, ctx, goal, limitWait = false) {
         const continuedGoal = await queueGoalContinuation(extensionApi, ctx, goal, {
             continuationPending,
             markContinuationPending: () => {
                 continuationPending = true;
             },
+            limitWait,
         });
         if (continuedGoal === null) {
             clearAgentGoalAccounting();
@@ -533,23 +538,6 @@ export default function goalExtension(pi) {
         return goal;
     }
 }
-/**
- * Counts goal-continuation entries queued since the most recent real user message
- * in the current branch (mirrors the todo-gate / todo-bridge backward branch read).
- * A real user message is the only reset: the assistant turns in between are exactly
- * the unattended loop this admission guard exists to stop.
- */
-function countTrailingGoalContinuationEntries(entries) {
-    let count = 0;
-    for (let index = entries.length - 1; index >= 0; index--) {
-        const entry = entries[index];
-        if (entry?.type === "message" && entry.message.role === "user")
-            break;
-        if (entry?.type === "custom_message" && entry.customType === GOAL_CONTINUATION_MESSAGE_TYPE)
-            count += 1;
-    }
-    return count;
-}
 function goalStoreRef(ctx) {
     return buildGoalStoreRef(ctx.sessionManager, ctx.cwd);
 }

package/dist/core/extensions/builtin/goal/lifecycle-helpers.d.ts

@@ -11,10 +11,6 @@ type GoalContinuationDeliveryOptions = {
     readonly content: (verdict: ContinuingGoalContinuationVerdict) => string;
     readonly markContinuationPending: () => void;
 };
-export type SessionStartContinuationOptions = {
-    readonly continuationPending: boolean;
-    readonly markContinuationPending: () => void;
-};
 /**
  * Mirrors codex `maybe_prompt_resume_paused_goal_after_resume`
  * (codex-rs/tui/src/app/thread_goal_actions.rs), which prompts on resume for every
@@ -24,13 +20,19 @@ export type SessionStartContinuationOptions = {
 export declare function isResumeOfStoppedGoal(ctx: ExtensionContext, sessionStartReason: string, goal: Goal | null): goal is Goal;
 /** Evaluates and delivers a continuation only after all guardrail checks admit it. */
 export declare function admitAndQueueGoalContinuation(pi: ExtensionAPI, ctx: ExtensionContext, goal: Goal, options: GoalContinuationDeliveryOptions): Promise<Goal | null>;
-/** Routes startup and resume continuations through the same verdict and delivery accounting as agent-end paths. */
-export declare function queueGoalContinuation(pi: ExtensionAPI, ctx: ExtensionContext, goal: Goal, options: SessionStartContinuationOptions): Promise<Goal | null>;
 export declare function buildCurrentGoalContinuationSignature(ctx: ExtensionContext, goal: Goal, lastAssistantText: string): string;
 export declare function lastAssistantText(messages: readonly AgentMessage[]): string;
 export declare function isLastTurnStuckOnContextOverflow(ctx: ExtensionContext, lastAssistant: Extract<AgentMessage, {
     role: "assistant";
 }> | undefined): boolean;
+/**
+ * senpi#3015: the stop claim and the session entries are two separate writes, so a crash
+ * between them leaves the claim without its entries. On session start the claim still
+ * stands, so re-append the missing entries once from the payload the claim captured.
+ * A claim whose entries already landed is left alone; a claim recorded before the
+ * payload existed cannot be rebuilt and is left alone too.
+ */
+export declare function recoverMissingGoalContinuationStop(pi: ExtensionAPI, ctx: ExtensionContext, goal: Goal): Promise<void>;
 export declare function queueHiddenGoalPrompt(pi: ExtensionAPI, content: string): void;
 export {};
 //# sourceMappingURL=lifecycle-helpers.d.ts.map

package/dist/core/extensions/builtin/goal/lifecycle-helpers.js

@@ -1,11 +1,11 @@
 import { isTurnStuckOnContextOverflow } from "../../../compaction/stuck-overflow.js";
-import { enginePauseSinceLastTurn } from "../../../engine-paused.js";
+import { ENGINE_PAUSED_ENTRY_TYPE, enginePauseSinceLastTurn } from "../../../engine-paused.js";
 import { GOAL_CONTINUATION_MESSAGE_TYPE } from "../../../messages.js";
 import { createSessionLogger } from "../../../session-log.js";
+import { isRecord } from "../../../work-custody-record.js";
 import { getLatestPhasesFromBranchEntries } from "../todotools/state.js";
 import { buildGoalContinuationSignature, evaluateGoalContinuation, hashAssistantText, } from "./continuation.js";
 import { CONTEXT_OVERFLOW_BLOCKED_REASON, CONTINUATION_CAP_BLOCKED_REASON, continuationCapRecoveryHint, LENGTH_EXHAUSTED_BLOCKED_REASON, NO_PROGRESS_BLOCKED_REASON, REPETITION_BLOCKED_REASON, } from "./continuation-recovery.js";
-import { buildContinuationPrompt } from "./prompt.js";
 import { recordContinuationDelivered, recordGoalContinuationStopped } from "./store.js";
 import { goalStoreRef } from "./store-ref.js";
 import { openTodoTaskContents } from "./todo-gate.js";
@@ -41,36 +41,15 @@ export async function admitAndQueueGoalContinuation(pi, ctx, goal, options) {
     if (options.input.currentSignature === undefined) {
         throw new Error("Cannot queue a goal continuation without a progress signature");
     }
-    const recordedGoal = await recordContinuationDelivered(goalStoreRef(ctx.sessionManager, ctx.cwd), options.input.currentSignature, goal.id, { countUnattended: options.input.path !== "monitorDelayed" });
+    const recordedGoal = await recordContinuationDelivered(goalStoreRef(ctx.sessionManager, ctx.cwd), options.input.currentSignature, goal.id, options.input.limitWait === true
+        ? { countUnattended: false, countStreak: false }
+        : { countUnattended: options.input.path !== "monitorDelayed" });
     if (recordedGoal === null)
         return null;
     options.markContinuationPending();
     queueHiddenGoalPrompt(pi, options.content(verdict));
     return recordedGoal;
 }
-/** Routes startup and resume continuations through the same verdict and delivery accounting as agent-end paths. */
-export async function queueGoalContinuation(pi, ctx, goal, options) {
-    const signature = buildCurrentGoalContinuationSignature(ctx, goal, lastAssistantTextFromEntries(ctx.sessionManager.getBranch()));
-    return admitAndQueueGoalContinuation(pi, ctx, goal, {
-        input: {
-            isIdle: ctx.isIdle(),
-            hasPendingMessages: ctx.hasPendingMessages(),
-            path: "sessionStart",
-            lastStopReason: undefined,
-            lastTurnWasMalformedToolUse: false,
-            consecutiveContinuations: goal.consecutiveContinuations ?? 0,
-            lastContinuationSignature: goal.lastContinuationSignature,
-            currentSignature: signature,
-            consecutiveLengthRecoveries: 0,
-            recentNormalizedOutputHashes: [],
-            toollessContinuationStreak: 0,
-            continuationPending: options.continuationPending,
-            lastTurnStuckOnContextOverflow: isLastTurnStuckOnContextOverflow(ctx, lastAssistantFromEntries(ctx.sessionManager.getBranch())),
-        },
-        content: () => buildContinuationPrompt(goal, { modelId: ctx.model?.id }),
-        markContinuationPending: options.markContinuationPending,
-    });
-}
 export function buildCurrentGoalContinuationSignature(ctx, goal, lastAssistantText) {
     const entries = ctx.sessionManager.getBranch();
     const openTodos = openTodoTaskContents(entries).length;
@@ -85,18 +64,6 @@ export function lastAssistantText(messages) {
     }
     return "";
 }
-function lastAssistantTextFromEntries(entries) {
-    const assistant = lastAssistantFromEntries(entries);
-    return assistant === undefined ? "" : textContent(assistant);
-}
-function lastAssistantFromEntries(entries) {
-    for (let index = entries.length - 1; index >= 0; index--) {
-        const entry = entries[index];
-        if (entry?.type === "message" && entry.message.role === "assistant")
-            return entry.message;
-    }
-    return undefined;
-}
 export function isLastTurnStuckOnContextOverflow(ctx, lastAssistant) {
     return lastAssistant !== undefined && isTurnStuckOnContextOverflow(lastAssistant, ctx.model?.contextWindow ?? 0);
 }
@@ -112,7 +79,12 @@ async function handleDeniedContinuation(pi, ctx, goal, input, reason) {
     const logger = createSessionLogger(ctx.agentDir);
     const at = Date.now();
     const blockedReason = blockedReasonForContinuationGuard(reason);
-    const stopped = await recordGoalContinuationStopped(goalStoreRef(ctx.sessionManager, ctx.cwd), goal, at, blockedReason);
+    const stopped = await recordGoalContinuationStopped(goalStoreRef(ctx.sessionManager, ctx.cwd), goal, at, blockedReason, {
+        reason,
+        consecutiveContinuations: input.consecutiveContinuations,
+        unattendedContinuations: goal.unattendedContinuations ?? 0,
+        noProgressContinuations: goal.noProgressContinuations ?? 0,
+    });
     if (!stopped.recorded)
         return stopped.goal;
     // Preserve the guard's existing side effects even if publishing the additive entries fails.
@@ -164,6 +136,72 @@ async function handleDeniedContinuation(pi, ctx, goal, input, reason) {
     }
     return stopped.goal;
 }
+/**
+ * senpi#3015: the stop claim and the session entries are two separate writes, so a crash
+ * between them leaves the claim without its entries. On session start the claim still
+ * stands, so re-append the missing entries once from the payload the claim captured.
+ * A claim whose entries already landed is left alone; a claim recorded before the
+ * payload existed cannot be rebuilt and is left alone too.
+ */
+export async function recoverMissingGoalContinuationStop(pi, ctx, goal) {
+    const at = goal.continuationStoppedAt;
+    const detail = goal.continuationStoppedDetail;
+    if (at === undefined || detail === undefined)
+        return;
+    const branch = ctx.sessionManager.getBranch();
+    const logger = createSessionLogger(ctx.agentDir);
+    if (!hasStopEntrySince(branch, goal.id, at)) {
+        try {
+            pi.appendEntry("goal-continuation-stopped", {
+                goalId: goal.id,
+                reason: detail.reason,
+                consecutiveContinuations: detail.consecutiveContinuations,
+                unattendedContinuations: detail.unattendedContinuations,
+                noProgressContinuations: detail.noProgressContinuations,
+                at,
+            });
+        }
+        catch (error) {
+            logger.warn("goal_continuation_record_write_failed", {
+                kind: "goal-continuation-stopped",
+                error: error instanceof Error ? error.message : String(error),
+            });
+        }
+    }
+    if (detail.reason !== "stale" && detail.reason !== "repetition")
+        return;
+    if (hasEnginePausedEntrySince(branch, at) || enginePauseSinceLastTurn(branch))
+        return;
+    try {
+        pi.appendEntry(ENGINE_PAUSED_ENTRY_TYPE, {
+            reason: detail.reason === "stale" ? "goal-stale" : "goal-repeat",
+            customType: GOAL_CONTINUATION_MESSAGE_TYPE,
+            count: detail.consecutiveContinuations,
+            at,
+        });
+    }
+    catch (error) {
+        logger.warn("goal_continuation_record_write_failed", {
+            kind: ENGINE_PAUSED_ENTRY_TYPE,
+            error: error instanceof Error ? error.message : String(error),
+        });
+    }
+}
+function hasStopEntrySince(branch, goalId, sinceAt) {
+    return branch.some((entry) => entry?.type === "custom" &&
+        entry.customType === "goal-continuation-stopped" &&
+        isRecord(entry.data) &&
+        entry.data.goalId === goalId &&
+        typeof entry.data.at === "number" &&
+        entry.data.at >= sinceAt);
+}
+function hasEnginePausedEntrySince(branch, sinceAt) {
+    return branch.some((entry) => entry?.type === "custom" &&
+        entry.customType === ENGINE_PAUSED_ENTRY_TYPE &&
+        isRecord(entry.data) &&
+        typeof entry.data.at === "number" &&
+        entry.data.at >= sinceAt);
+}
 function blockedReasonForContinuationGuard(reason) {
     switch (reason) {
         case "cap":