pi-goal-list-loop-audit 0.23.1 → 0.23.3

package/README.md

@@ -184,6 +184,7 @@ No external watchdog plugin needed.
 /glla notify='cmd "$1"'              # push on complete/pause/stop → GLOBAL
 /glla tokenlimit=10000000            # per-goal token budget (default: off) → GLOBAL
 /glla tokenlimit=0                   # explicitly no cap (the default)
+/glla wedgealert=30                  # hung-command alert minutes (default: 30, 0 = off)
 /glla project tokenlimit=500         # rare per-project override
 ```
 
@@ -202,6 +203,20 @@ value like 10000000 is a runaway threshold, not a big-goal threshold
 this cap — it has its own brakes
 (max iterations + plateau).
 
+## Wedge alert
+
+The turn-based watchdogs can't see one failure shape: the session is busy
+but silent for a long stretch because ONE unbounded command (a test suite
+that never exits, a dev server) is holding the whole goal hostage. The
+heartbeat watches the wall clock: busy + no activity for 30 minutes →
+in-session warning + your configured notify push, once per interval while
+it persists. Tune with `/glla wedgealert=<minutes>` (0 = off).
+
+Every other wait is bounded too: continuation retries are milliseconds,
+stuck backoff caps at 5 minutes then pauses, measure commands get a 10m
+hard timeout, and the auditor aborts after 10m with zero session activity
+(infrastructure error, never a verdict).
+
 ## Compatibility (what goes well, what conflicts)
 
 **The Two-Driver Rule**: any plugin that drives agent turns on `agent_end`

package/extensions/goal-loop-auditor.ts

@@ -25,6 +25,7 @@ import {
 
 import type { Goal } from "./goal-loop-core.js";
 import { renderGoalMarkdown } from "./goal-loop-core.js";
+import { AUDITOR_STALL_MS } from "./goal-loop-backoff.js";
 
 // =================================================================
 // Result type
@@ -239,7 +240,22 @@ export async function runGoalCompletionAuditor(args: {
       tools: ["read", "grep", "find", "ls", "bash"],
     });
     let streamError: string | undefined;
+    // v0.23.3 stall watchdog: any session event is activity. An auditor
+    // with NO events for AUDITOR_STALL_MS is wedged (dead stream, hung
+    // provider call) — abort it and return an ERROR, never a verdict,
+    // and never let the completion gate hang forever (the pi-goal-x
+    // failure shape: unbounded silent waits).
+    let lastEventAt = Date.now();
+    let stalled = false;
+    const stallTimer = setInterval(() => {
+      if (Date.now() - lastEventAt > AUDITOR_STALL_MS) {
+        stalled = true;
+        void session.abort();
+      }
+    }, 15_000);
+    stallTimer.unref?.();
     const unsub = session.subscribe((event) => {
+      lastEventAt = Date.now();
       // Capture provider/stream errors (401/403/429/credits) — these often
       // arrive as events rather than thrown exceptions, and without this they
       // surface as a silent empty report that looks like a disapproval.
@@ -306,9 +322,21 @@ export async function runGoalCompletionAuditor(args: {
       }
       await session.prompt(buildGoalAuditorPrompt(args.goal, args.completionSummary, args.verificationSummary));
     } finally {
+      clearInterval(stallTimer);
       unsub();
     }
 
+    if (stalled) {
+      return {
+        approved: false,
+        disapproved: false,
+        output: outputParts.join("\n\n"),
+        model: modelLabel(model),
+        thinkingLevel,
+        error: `Auditor stalled — no session activity for ${Math.round(AUDITOR_STALL_MS / 60_000)}m, aborted. This is an infrastructure failure, not a verdict; retry completion (check the auditor model with /glla model=).`,
+      };
+    }
+
     const output = outputParts.join("\n\n");
 
     // SILENT-FAILURE GUARD (v0.9.9, wild-caught): an auditor that produced

package/extensions/goal-loop-backoff.ts

@@ -68,6 +68,51 @@ export function humanMs(ms: number): string {
 export const HEARTBEAT_INTERVAL_MS = 15_000;
 export const HEARTBEAT_STALL_MS = 60_000;
 export const HEARTBEAT_MAX_NUDGES = 3;
+/** v0.23.2: default wall-clock wedge threshold — a busy session with no
+ * activity for this long is almost always a hung unbounded command
+ * (test suite / dev server) holding the whole goal hostage. The
+ * turn-based watchdogs are blind to it (it's ONE long turn); only the
+ * wall clock sees it. 0 in settings = off.
+ * v0.23.3: 45 → 30. The alert is notification-only, so a false positive
+ * costs one notification while a false negative costs hours — that
+ * asymmetry argues tight. (pi-goal-x, the cautionary tale, had NO wall
+ * clock at all: a wedged session was silent forever.) */
+export const WEDGE_ALERT_DEFAULT_MINUTES = 30;
+/** v0.23.3: hard cap on one measure command. An unbounded measure is the
+ * same wedge shape as an unbounded test suite — it freezes the loop tick
+ * forever. Timeout → measure failure (null) → stall path → plateau stop,
+ * never a silent hang. Matches pi-loop-mode's --check-timeout default. */
+export const MEASURE_TIMEOUT_MS = 10 * 60_000;
+/** v0.23.3: auditor inactivity abort. The auditor legitimately runs the
+ * project's own verification (test suites!), so the bound is on
+ * INACTIVITY (no session events at all), not wall time. An auditor with
+ * no events for this long is wedged — abort and report an error, never
+ * disapprove, never hang the completion gate forever. */
+export const AUDITOR_STALL_MS = 10 * 60_000;
+
+export interface WedgeInput {
+  /** A goal is active (autoContinue) or a loop is running. */
+  supervising: boolean;
+  /** Session is BUSY (mid-turn). An idle quiet session is the
+   *  heartbeat's job, not the wedge alert's. */
+  sessionBusy: boolean;
+  /** Milliseconds since the last observed agent activity. */
+  silentMs: number;
+  /** Milliseconds since the last wedge alert fired (throttle). */
+  msSinceLastAlert: number;
+  /** Threshold in ms; 0 disables the alert entirely. */
+  thresholdMs: number;
+}
+
+/** Should the wedge alert fire right now? Alerts at most once per
+ *  threshold interval while the wedge persists; any activity re-arms. */
+export function shouldWedgeAlert(input: WedgeInput): boolean {
+  if (!input.supervising) return false;
+  if (!input.sessionBusy) return false;
+  if (input.thresholdMs <= 0) return false;
+  if (input.silentMs < input.thresholdMs) return false;
+  return input.msSinceLastAlert >= input.thresholdMs;
+}
 
 export interface HeartbeatInput {
   /** A goal is active (autoContinue) or a loop is running. */

package/extensions/loops/goal.ts

@@ -77,6 +77,9 @@ import {
   HEARTBEAT_MAX_NUDGES,
   HEARTBEAT_STALL_MS,
   shouldHeartbeatRefire,
+  MEASURE_TIMEOUT_MS,
+  WEDGE_ALERT_DEFAULT_MINUTES,
+  shouldWedgeAlert,
 } from "../goal-loop-backoff.js";
 
 // =================================================================
@@ -122,6 +125,7 @@ const countedLoopTokenMessages = new Set<string>();
 
 // Heartbeat self-watchdog state: liveness is the loop's own job.
 let lastActivityAt = Date.now();
+let lastWedgeAlertAt = 0;
 let heartbeatNudges = 0;
 let heartbeatTimer: NodeJS.Timeout | null = null;
 
@@ -180,6 +184,27 @@ function heartbeatTick(): void {
     msSinceActivity: Date.now() - lastActivityAt,
     stallMs: HEARTBEAT_STALL_MS,
   });
+  // Wedge alert (v0.23.2): session BUSY but silent for the threshold —
+  // the classic hung-command case (a test suite that never exits holds
+  // the entire goal hostage; field-observed at 5,056s and 6,800s on the
+  // same wedged tool call). Independent of the refire path, which only
+  // watches idle sessions.
+  const wedgeMinutes = loadSettings(ctx.cwd).wedgeAlertMinutes ?? WEDGE_ALERT_DEFAULT_MINUTES;
+  if (
+    shouldWedgeAlert({
+      supervising: isSupervising(),
+      sessionBusy: !sessionIdle,
+      silentMs: Date.now() - lastActivityAt,
+      msSinceLastAlert: Date.now() - lastWedgeAlertAt,
+      thresholdMs: wedgeMinutes * 60_000,
+    })
+  ) {
+    lastWedgeAlertAt = Date.now();
+    const msg = `Goal appears wedged: no activity for ${Math.round((Date.now() - lastActivityAt) / 60_000)}m while the session is busy — likely a hung command (test/build/dev server without a timeout). Check the session; Esc kills a stuck tool call.`;
+    appendLedger(ctx.cwd, "wedge_alert", { silentMs: Date.now() - lastActivityAt });
+    ctx.ui.notify(msg, "warning");
+    notifyExternal(ctx, msg);
+  }
   if (!fire) return;
   noteActivity();
   appendLedger(ctx.cwd, "heartbeat_refire", { nudgesSoFar: heartbeatNudges });
@@ -934,7 +959,7 @@ function isLoopActive(): boolean {
 async function runMeasure(ctx: ExtensionContext, cmd: string): Promise<number | null> {
   if (!extensionApi) return null;
   try {
-    const result = await extensionApi.exec("bash", ["-c", cmd], { cwd: ctx.cwd });
+    const result = await extensionApi.exec("bash", ["-c", cmd], { cwd: ctx.cwd, timeout: MEASURE_TIMEOUT_MS });
     const stdout = (result as any)?.stdout ?? "";
     return parseMetric(String(stdout));
   } catch {
@@ -1976,6 +2001,9 @@ interface Settings {
   /** Per-goal token budget; crossing it pauses the goal. Off by default
    * (opt-in guard, v0.12.0): unset/0 = no budget. */
   tokenLimit?: number;
+  /** v0.23.2: minutes of busy-but-silent before the wedge alert fires
+   * (hung-command detector). Unset = 45; 0 = off. */
+  wedgeAlertMinutes?: number;
   /** on → restored goals/loops/lists auto-resume even in fresh sessions
    * (unattended rigs). Default off: restore holds until /goal resume. */
   autoResume?: boolean;
@@ -2023,7 +2051,7 @@ function settingsProvenance(cwd: string): Record<keyof Settings, { value: unknow
   const glob = readSettingsFile(globalSettingsPath());
   const effective = loadSettings(cwd);
   const out: Record<string, { value: unknown; source: "project" | "global" | "default" }> = {};
-  const keys: Array<keyof Settings> = ["auditorModel", "auditorThinkingLevel", "notifyCmd", "tokenLimit", "autoResume"];
+  const keys: Array<keyof Settings> = ["auditorModel", "auditorThinkingLevel", "notifyCmd", "tokenLimit", "wedgeAlertMinutes", "autoResume"];
   for (const k of keys) {
     if ((proj as Record<string, unknown>)[k] !== undefined) out[k] = { value: (proj as any)[k], source: "project" };
     else if ((glob as Record<string, unknown>)[k] !== undefined) out[k] = { value: (glob as any)[k], source: "global" };
@@ -2122,6 +2150,7 @@ async function openSettingsUI(ctx: ExtensionContext): Promise<void> {
           `Auditor thinking — ${show("auditorThinkingLevel", "(session, floor high)")}`,
           `Notify command — ${show("notifyCmd", "(off)")}`,
           `Token limit per goal — ${show("tokenLimit", "(off)")}`,
+          `Wedge alert minutes — ${show("wedgeAlertMinutes", `(${WEDGE_ALERT_DEFAULT_MINUTES}m default)`)}`,
           "Done",
         ],
       );
@@ -2147,6 +2176,14 @@ async function openSettingsUI(ctx: ExtensionContext): Promise<void> {
           else if (!v.trim()) saveSettings("global", ctx.cwd, { tokenLimit: undefined });
           else ctx.ui.notify(`Not a non-negative integer: ${v}`, "warning");
         }
+      } else if (choice.startsWith("Wedge alert")) {
+        const v = await ctx.ui.input("Wedge alert threshold (minutes)", "non-negative integer; 0 = off, empty = default 45");
+        if (v !== undefined) {
+          const n = Number.parseInt(v.trim(), 10);
+          if (Number.isFinite(n) && n >= 0) saveSettings("global", ctx.cwd, { wedgeAlertMinutes: n });
+          else if (!v.trim()) saveSettings("global", ctx.cwd, { wedgeAlertMinutes: undefined });
+          else ctx.ui.notify(`Not a non-negative integer: ${v}`, "warning");
+        }
       }
     } catch {
       return;
@@ -2161,6 +2198,7 @@ async function cmdSettings(args: string, ctx: ExtensionContext): Promise<void> {
   //   /glla thinking=high        write to GLOBAL config
   //   /glla notify='cmd $1'      write to GLOBAL config
   //   /glla tokenlimit=2000000   write to GLOBAL config
+  //   /glla wedgealert=30         hung-command alert minutes (0=off, unset=30)
   //   /glla project model=...    write to PROJECT override (rare)
   //   /glla model=unset          remove key (from global; project model=unset for project)
   const trimmed = args.trim();
@@ -2221,6 +2259,19 @@ async function cmdSettings(args: string, ctx: ExtensionContext): Promise<void> {
       } else {
         ctx.ui.notify(`tokenlimit must be a positive integer, got: ${value}`, "warning");
       }
+    } else if (key === "wedgealert") {
+      if (value === "unset") {
+        patch.wedgeAlertMinutes = undefined;
+        changed = true;
+      } else {
+        const n = Number.parseInt(value, 10);
+        if (Number.isFinite(n) && n >= 0) {
+          patch.wedgeAlertMinutes = n; // 0 = off; unset = default 45
+          changed = true;
+        } else {
+          ctx.ui.notify(`wedgealert must be a non-negative integer (minutes, 0 = off), got: ${value}`, "warning");
+        }
+      }
     } else if (key === "autoresume") {
       if (["on", "true", "1", "yes"].includes(value)) {
         patch.autoResume = true;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-goal-list-loop-audit",
-  "version": "0.23.1",
+  "version": "0.23.3",
   "description": "Goal. Loop. Audit. Done. — a pi-coding-agent extension that supervises long-running work, with isolated auditor on each completion. Beat bamboozling by design: the auditor runs in a fresh session with no extensions, no skills, no editor — only the read tools needed to verify your goal.",
   "license": "MIT",
   "author": "dracon",