pi-goal-list-loop-audit 0.26.6 → 0.26.8

package/extensions/goal-loop-core.ts

@@ -660,8 +660,16 @@ export function cloneGoal(goal: Goal): Goal {
  * setting for unattended restarts). One mechanical predicate; no heuristics.
  */
 export function shouldAutoResumeOnSessionStart(reason: string | undefined, autoResume: boolean | undefined): boolean {
-  if (autoResume === true) return true;
-  return reason === "resume" || reason === "reload" || reason === "fork";
+  // v0.26.8: default flipped to ON — keep pushing forward on every session
+  // start unless the user explicitly opts out (/glla autoresume=off). The
+  // "super stuck" brakes (stall escalation, stale-api terminal, pending-
+  // latch watchdog) still stop the machine loudly; a mere process restart
+  // is not a reason to hold work. Explicit off preserves the v0.21.0 gate:
+  // only sessions with history (resume/reload/fork) auto-resume.
+  if (autoResume === false) {
+    return reason === "resume" || reason === "reload" || reason === "fork";
+  }
+  return true;
 }
 
 /**
@@ -931,6 +939,15 @@ export function shouldSuppressHeartbeatForRecentShip(args: {
 
 /** Best-effort "when did work last ship" for a repo: newest of the HEAD
  * commit time and the .pi-glla state file mtime. Null when unknown. */
+/** v0.26.7: pi's exact stale-runtime error signature — thrown by every
+ * runtime-bound method after pi invalidates the extension on session
+ * replacement (newSession/fork/switchSession/reload; compaction reaches
+ * the same teardown in pi 0.82.x). See dist/core/extensions/loader.js
+ * createExtensionRuntime().invalidate. */
+export function isStaleApiError(err: unknown): boolean {
+  return err instanceof Error && err.message.includes("stale after session replacement");
+}
+
 export function lastShippedAtMs(cwd: string): number | null {
   // v0.26.6: the .pi-glla/active.jsonl MTIME term was REMOVED — the
   // heartbeat's own ledger writes refreshed it every 15s, which made the

package/extensions/loops/goal.ts

@@ -51,6 +51,7 @@ import {
   crossRecommendMode,
   formatListDepth,
   shouldEscalateStall,
+  isStaleApiError,
   mergeSettings,
   parseListImport,
 
@@ -177,6 +178,30 @@ const HELD_ON_RESTORE = "held: restored in a fresh session";
 // The ExtensionAPI captured in the factory. sendMessage lives on the API,
 // not on ExtensionContext, so continuation sends need it at module scope.
 let extensionApi: ExtensionAPI | null = null;
+// v0.26.7: pi invalidates the extension runtime on session replacement
+// (newSession/fork/switchSession/reload — and the compaction path reaches
+// it via teardownCurrent in pi 0.82.x). Once stale, every sendMessage
+// throws FOREVER in this process — retrying for hours is the hegemon
+// failure shape. Detect the stale signature once and go terminally loud.
+let extensionApiStale = false;
+
+/** v0.26.7: a stale api is terminal for this process — pause/stop loudly
+ * with restart guidance instead of retrying sends that can never land. */
+function goStaleTerminal(ctx: ExtensionContext, where: string): void {
+  if (extensionApiStale) return; // already terminal — don't re-spam
+  extensionApiStale = true;
+  appendLedger(ctx.cwd, "extension_api_stale", { where, kind: isLoopActive() ? "loop" : "goal" });
+  const guidance = "pi invalidated this session's extension handle (session replacement — compaction triggers it in pi 0.82.x). Sends can never land in this process. Restart pi (or reload extensions), then /goal resume / /loop start.";
+  if (isLoopActive()) {
+    clearLoopTimer();
+    state.loop = { ...state.loop!, active: false, stopReason: `extension api stale: ${guidance}` };
+    persistState(ctx);
+  } else if (state.goal && state.goal.status === "active") {
+    updateGoal({ status: "paused", pauseReason: "extension api stale (pi session replacement)", pauseSuggestedAction: guidance }, ctx);
+  }
+  ctx.ui.notify(`glla: ${guidance}`, "warning");
+  notifyExternal(ctx, `glla: extension api stale — restart pi. (${where})`);
+}
 
 // The most recent ExtensionContext seen from any event or command handler.
 // pi replaces sessions (newSession/fork/reload) and stale ctx throws on use,
@@ -486,7 +511,7 @@ function sendContinuation(goalId: string): void {
     continuationTimer.unref?.();
     return;
   }
-  if (!extensionApi) return;
+  if (!extensionApi || extensionApiStale) return;
   try {
     extensionApi.sendMessage({
       customType: GOAL_EVENT_ENTRY,
@@ -496,7 +521,9 @@ function sendContinuation(goalId: string): void {
     appendLedger(ctx.cwd, "goal_continuation_sent", { goalId });
   } catch (err) {
     appendLedger(ctx.cwd, "goal_continuation_send_failed", { goalId, error: err instanceof Error ? err.message : String(err) });
-    // API went stale mid-flight; next agent_end/session_start will reschedule.
+    // v0.26.7: stale runtime = terminal (sends can never land); anything
+    // else is transient — next agent_end/session_start reschedules.
+    if (isStaleApiError(err)) goStaleTerminal(ctx, "sendContinuation");
   }
 }
 
@@ -1268,7 +1295,7 @@ function isLoopActive(): boolean {
 
 /** Run the user's measure command. Orchestrator-side, never agent-side. */
 async function runMeasure(ctx: ExtensionContext, cmd: string): Promise<number | null> {
-  if (!extensionApi) return null;
+  if (!extensionApi || extensionApiStale) return null;
   try {
     const result = await extensionApi.exec("bash", ["-c", cmd], { cwd: ctx.cwd, timeout: MEASURE_TIMEOUT_MS });
     const stdout = (result as any)?.stdout ?? "";
@@ -1392,6 +1419,8 @@ function sendLoopTurn(): void {
     // stale API — next agent_end reschedules (but if none comes, the
     // heartbeat's stall escalation stops the spin — v0.26.1).
     appendLedger(ctx.cwd, "loop_turn_send_failed", { error: err instanceof Error ? err.message : String(err) });
+    // v0.26.7: stale runtime is terminal, not transient — go loud now.
+    if (isStaleApiError(err)) goStaleTerminal(ctx, "sendLoopTurn");
   }
 }
 
@@ -3192,7 +3221,7 @@ async function cmdSettings(args: string, ctx: ExtensionContext): Promise<void> {
         patch.autoResume = true;
         changed = true;
       } else if (["off", "false", "0", "no", "unset"].includes(value)) {
-        patch.autoResume = undefined;
+        patch.autoResume = false; // v0.26.8: explicit off must persist — undefined now means ON
         changed = true;
       } else {
         ctx.ui.notify(`autoresume must be on or off, got: ${value}`, "warning");
@@ -3300,7 +3329,7 @@ async function cmdSettings(args: string, ctx: ExtensionContext): Promise<void> {
   saveSettings(scope, ctx.cwd, patch);
   const effective = loadSettings(ctx.cwd);
   ctx.ui.notify(
-    `Saved to ${scope} config. Effective now: model=${effective.auditorModel ?? "(session model)"} thinking=${effective.auditorThinkingLevel ?? "(session)"} notify=${effective.notifyCmd ?? "(off)"} tokenLimit=${effective.tokenLimit ?? 0}${(effective.tokenLimit ?? 0) > 0 ? "" : " (off)"} autoResume=${effective.autoResume === true ? "on" : "off"} auditFeedbackChars=${effective.auditFeedbackChars ?? DEFAULT_AUDIT_FEEDBACK_CHARS}${(effective.auditFeedbackChars ?? DEFAULT_AUDIT_FEEDBACK_CHARS) === 0 ? " (full report)" : ""}\n` +
+    `Saved to ${scope} config. Effective now: model=${effective.auditorModel ?? "(session model)"} thinking=${effective.auditorThinkingLevel ?? "(session)"} notify=${effective.notifyCmd ?? "(off)"} tokenLimit=${effective.tokenLimit ?? 0}${(effective.tokenLimit ?? 0) > 0 ? "" : " (off)"} autoResume=${effective.autoResume === false ? "off" : "on (default)"} auditFeedbackChars=${effective.auditFeedbackChars ?? DEFAULT_AUDIT_FEEDBACK_CHARS}${(effective.auditFeedbackChars ?? DEFAULT_AUDIT_FEEDBACK_CHARS) === 0 ? " (full report)" : ""}\n` +
     `Note: the auditor runs without extensions — it must be a built-in provider, not an extension-registered one.`,
     "info",
   );
@@ -3380,6 +3409,7 @@ function warnOnCommandCollision(ctx: ExtensionContext): void {
 
 export default function (pi: ExtensionAPI): void {
   extensionApi = pi;
+  extensionApiStale = false; // a fresh factory run means a fresh runtime (reload path)
   startHeartbeat();
   startUITicker();
   // Four top-level commands, that's all (v0.8.0 consolidation):
@@ -3414,7 +3444,7 @@ export default function (pi: ExtensionAPI): void {
       ["thinking=", "auditor thinking level: /glla thinking=high"],
       ["notify=", "desktop push command: /glla notify='notify-send pi \"$1\"'"],
       ["tokenlimit=", "per-goal token budget (0 = off): /glla tokenlimit=2000000"],
-      ["autoresume=", "on: auto-resume held goals/loops in fresh sessions"],
+      ["autoresume=", "on (default): auto-resume goals/loops on every session start; off: hold on fresh sessions"],
       ["auditcap=", "N: pause goal after N consecutive auditor disapprovals (default 5, 0 = unlimited)"],
       ["auditfeedbackchars=", "cap on executor-visible disapproval report chars (0 = full report, the default)"],
       ["aggressivemode=", "on: keep-going defaults — autoResume, cap 10, stuck 10, wedge off, quota auto-retry, cap→TODOs"],
@@ -3611,12 +3641,12 @@ export default function (pi: ExtensionAPI): void {
     } catch (err) {
       ctx.ui.notify(`glla subagent override sync failed: ${err instanceof Error ? err.message : String(err)}`, "warning");
     }
-    // Restore gate (v0.21.0): a fresh session ("startup"/"new", or a pi too
-    // old to report a reason) has no conversation context for the restored
-    // work — HOLD instead of auto-firing, so opening pi in a folder never
-    // starts working before you can even load your session. Sessions with
-    // history ("resume"/"reload"/"fork") auto-resume; /glla autoresume=on
-    // opts a project into auto-resume everywhere (unattended rigs).
+    // Restore gate (v0.21.0, default flipped v0.26.8): auto-resume on EVERY
+    // session start by default — keep pushing forward unless super stuck
+    // (the stall escalation / stale-api / latch brakes still stop loudly).
+    // /glla autoresume=off restores the v0.21.0 gate: fresh sessions
+    // ("startup"/"new", or a pi too old to report a reason) HOLD, only
+    // sessions with history ("resume"/"reload"/"fork") auto-resume.
     const autoResume = shouldAutoResumeOnSessionStart(event?.reason, resolveEffectiveAggressiveSettings(loadSettings(ctx.cwd)).autoResume);
     // v0.25.0 (contract item 6): aggressiveMode announces every auto-event.
     if (
@@ -3638,7 +3668,7 @@ export default function (pi: ExtensionAPI): void {
         state.loop = { ...l, active: false, stopReason: HELD_ON_RESTORE };
         persistState(ctx);
         ctx.ui.notify(
-          `Loop held on restore (fresh session, no work started): ${l.target.slice(0, 60)} — /loop to resume, /glla autoresume=on to auto-resume in this project.`,
+          `Loop held on restore (/glla autoresume=off): ${l.target.slice(0, 60)} — /loop to resume, /glla autoresume=on to auto-resume in this project.`,
           "info",
         );
       }
@@ -3657,7 +3687,7 @@ export default function (pi: ExtensionAPI): void {
         const resumeHint = `${resumeCmd} to continue${queued > 0 ? ` (+${queued} waiting in the list)` : ""} · /glla autoresume=on to auto-resume in this project`;
         updateGoal({
           status: "paused",
-          pauseReason: "restored in a fresh session — no work started",
+          pauseReason: "restored in a fresh session — held because /glla autoresume=off",
           pauseSuggestedAction: resumeHint,
         }, ctx);
         ctx.ui.notify(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-goal-list-loop-audit",
-  "version": "0.26.6",
+  "version": "0.26.8",
   "description": "Goal. Loop. Audit. Done. — a pi-coding-agent extension that supervises long-running work, with isolated auditor on each completion. Beat bamboozling by design: the auditor runs in a fresh session with no extensions, no skills, no editor — only the read tools needed to verify your goal.",
   "license": "MIT",
   "author": "dracon",