pi-goal-list-loop-audit 0.27.9 → 0.28.1

package/extensions/goal-loop-core.ts

@@ -156,6 +156,12 @@ export interface Goal {
   stopReason?: string;
   pauseReason?: string;
   pauseSuggestedAction?: string;
+  /** v0.28.1 (S1/S2): stale-handle interrupt marker. Set INSTEAD of pausing
+   * when pi invalidates the extension handle mid-goal — the goal stays
+   * active so a fresh session auto-resumes it via the restore gate. Cleared
+   * on that auto-resume. */
+  interruptedAt?: string;
+  interruptedReason?: string;
   /** v0.25.0 (contract item 22): auditor objections extracted as TODOs when
    * aggressiveMode keeps the goal active past the disapproval cap. Rendered
    * into every continuation prompt until the next audit clears them. */

package/extensions/goal-loop-display.ts

@@ -137,6 +137,11 @@ export function buildStatusText(state: State, audit?: AuditDisplayProgress | nul
     return `glla: ${paint(theme, pauseIsError(g) ? "error" : "warning", label)}`;
   }
   if (g.status === "active") {
+    // v0.28.1 (S1/S2): a stale-handle interrupt keeps the goal ACTIVE (the
+    // next fresh session auto-resumes it) — say so instead of looking healthy.
+    if (g.interruptedAt) {
+      return `glla: ${g.policy} ${paint(theme, "error", "⚠ interrupted — stale handle · auto-resumes on pi restart")}`;
+    }
     // v0.24.7: list policy gets its own wording — a queue item is not a goal.
     // Before: "glla: list ● 3m 19s · list 29" (policy label AND queue counter
     // both said "list"). After: "glla: list ● 3m 19s · 29 queued". Goal

package/extensions/loops/goal.ts

@@ -141,6 +141,11 @@ import {
   syncSubagentModelOverrides,
   type SubagentModelStrategy,
 } from "../goal-loop-subagents.js";
+import {
+  buildSettingsRows,
+  SettingsMenuComponent,
+  type SettingsRow,
+} from "../settings-menu.js";
 import {
   applyMeasurement,
   applyMetriclessTick,
@@ -193,24 +198,57 @@ let extensionApi: ExtensionAPI | null = null;
 // failure shape. Detect the stale signature once and go terminally loud.
 let extensionApiStale = false;
 
-/** v0.26.7: a stale api is terminal for this process — pause/stop loudly
- * with restart guidance instead of retrying sends that can never land. */
+/** v0.26.7: a stale api is terminal for this process — go loudly with
+ * restart guidance instead of retrying sends that can never land.
+ * v0.28.1 (S1/S2): goals STAY ACTIVE with an interrupt marker instead of
+ * pausing — the restore gate only auto-resumes ACTIVE goals, so pausing
+ * here stranded goals until manual /goal resume (hegemon/sraaal shape).
+ * sendContinuation's extensionApiStale guard already stops further sends
+ * in this doomed process; the next fresh session auto-resumes. */
 function goStaleTerminal(ctx: ExtensionContext, where: string): void {
   if (extensionApiStale) return; // already terminal — don't re-spam
   extensionApiStale = true;
   appendLedger(ctx.cwd, "extension_api_stale", { where, kind: isLoopActive() ? "loop" : "goal" });
-  const guidance = "pi invalidated this session's extension handle (session replacement — compaction triggers it in pi 0.82.x). Sends can never land in this process. Restart pi (or reload extensions), then /goal resume / /loop start.";
+  const guidance = "pi invalidated this session's extension handle (session replacement — compaction triggers it in pi 0.82.x). Sends can never land in this process. Restart pi (or reload extensions) — an active goal auto-resumes on the fresh session; loops need /loop start.";
   if (isLoopActive()) {
     clearLoopTimer();
     state.loop = { ...state.loop!, active: false, stopReason: `extension api stale: ${guidance}` };
     persistState(ctx);
   } else if (state.goal && state.goal.status === "active") {
-    updateGoal({ status: "paused", pauseReason: "extension api stale (pi session replacement)", pauseSuggestedAction: guidance }, ctx);
+    updateGoal({ interruptedAt: nowIso(), interruptedReason: `extension api stale (${where})` }, ctx);
   }
   ctx.ui.notify(`glla: ${guidance}`, "warning");
   notifyExternal(ctx, `glla: extension api stale — restart pi. (${where})`);
 }
 
+/** v0.28.1 (S3): side-effect-free staleness probe — getSessionName()
+ * routes through pi's assertActive() and throws the stale signature iff
+ * pi invalidated this factory handle (session replacement). A positive
+ * result is cached in extensionApiStale. */
+function probeExtensionApiStale(): boolean {
+  if (extensionApiStale) return true;
+  if (!extensionApi) return false;
+  try {
+    extensionApi.getSessionName();
+  } catch (err) {
+    if (isStaleApiError(err)) extensionApiStale = true;
+  }
+  return extensionApiStale;
+}
+
+/** v0.28.1 (S3): command-entry staleness probe + honest warning. Returns
+ * true when the handle is stale — callers must skip send-dependent paths
+ * and must NOT claim work started (S3's "created — starting now" lie). */
+function warnIfStaleAtEntry(ctx: ExtensionContext, what: string): boolean {
+  if (!probeExtensionApiStale()) return false;
+  appendLedger(ctx.cwd, "extension_api_stale", { where: `entry probe (${what})` });
+  ctx.ui.notify(
+    `glla: this session's extension handle is stale (pi session replacement) — ${what} can't send continuations in this process. State is safe in .pi-glla/ — restart pi and the active goal auto-resumes.`,
+    "warning",
+  );
+  return true;
+}
+
 // The most recent ExtensionContext seen from any event or command handler.
 // pi replaces sessions (newSession/fork/reload) and stale ctx throws on use,
 // so timers must never capture a ctx — they read lastCtx at fire time.
@@ -837,8 +875,18 @@ async function startDrafting(ctx: ExtensionContext, target: "goal" | "list" | "l
     draftingUserReplies = 0;
     draftingBlockedProposals = 0;
     draftingSeedInFlight = true; // our injected prompt also arrives as a user message — don't count it
-  } catch {
+  } catch (err) {
     draftingTarget = null;
+    // v0.28.1 (E6): the seed send used to fail SILENTLY — the user pressed
+    // Enter on /goal and nothing happened. Now: loud, and stale handles get
+    // the honest restart guidance.
+    if (isStaleApiError(err)) {
+      extensionApiStale = true;
+      appendLedger(ctx.cwd, "extension_api_stale", { where: "startDrafting seed" });
+      ctx.ui.notify("glla: can't start the drafting interview — this session's extension handle is stale (pi session replacement). Restart pi and re-run the command.", "warning");
+    } else {
+      ctx.ui.notify(`glla: couldn't start the drafting interview (${err instanceof Error ? err.message : String(err)}) — try again.`, "warning");
+    }
   }
 }
 
@@ -875,6 +923,10 @@ async function cmdGoal(args: string, ctx: ExtensionContext): Promise<void> {
 // =================================================================
 
 async function cmdSet(args: string, ctx: ExtensionContext, skipDraft = false): Promise<void> {
+  // v0.28.1 (S3): probe at the creation entry — no "created — starting now"
+  // lie in a doomed process. (The draft path's seed send has its own loud
+  // stale handling — E6.)
+  const staleEntry = warnIfStaleAtEntry(ctx, "/goal");
   let raw = args.trim();
   // Users naturally quote the objective ("/goal \"do X\""); strip one layer of
   // surrounding matching quotes so they don't leak into the goal text.
@@ -904,6 +956,13 @@ async function cmdSet(args: string, ctx: ExtensionContext, skipDraft = false): P
   iterationCounter = 0;
   consecutiveErrorIterations = 0;
   consecutiveNoToolIterations = 0;
+  if (staleEntry) {
+    // v0.28.1 (S3): the goal is persisted — mark the interrupt so the next
+    // fresh session auto-resumes, and tell the truth instead of "starting now".
+    updateGoal({ interruptedAt: nowIso(), interruptedReason: "created in a stale session" }, ctx);
+    ctx.ui.notify(`Goal ${goal.id} created and safe in .pi-glla/ — this stale process can't send continuations. Restart pi and it auto-resumes.`, "warning");
+    return;
+  }
   ctx.ui.notify(`Goal ${goal.id} created — starting now. Auditor will verify on completion.`, "info");
   scheduleContinuation(ctx, true);
 }
@@ -944,6 +1003,12 @@ async function cmdPause(ctx: ExtensionContext): Promise<void> {
 
 async function cmdResume(ctx: ExtensionContext): Promise<void> {
   if (!state.goal || state.goal.status !== "paused") return;
+  // v0.28.1 (S1/S3): resuming in a stale session used to flip status to
+  // active, claim "Resumed goal", then re-pause on the stale send failure
+  // (or zombie — S1). Now: persist the resume (the next fresh session
+  // auto-resumes ACTIVE goals), mark the interrupt, tell the truth, and
+  // skip the send that can never land.
+  const staleEntry = warnIfStaleAtEntry(ctx, "/goal resume");
   // v0.12.0: refresh the token cap from CURRENT settings on resume — goals
   // snapshot the cap at creation, so a goal paused under an old default
   // (e.g. 10M) would re-pause instantly even after the default changed.
@@ -951,7 +1016,8 @@ async function cmdResume(ctx: ExtensionContext): Promise<void> {
   const usage = state.goal.usage
     ? { tokensUsed: state.goal.usage.tokensUsed, tokensLimit: freshLimit }
     : undefined;
-  updateGoal({ status: "active", pauseReason: undefined, pauseSuggestedAction: undefined, ...(usage ? { usage } : {}) }, ctx);
+  updateGoal({ status: "active", pauseReason: undefined, pauseSuggestedAction: undefined, ...(staleEntry ? { interruptedAt: nowIso(), interruptedReason: "resumed in a stale session" } : {}), ...(usage ? { usage } : {}) }, ctx);
+  if (staleEntry) return;
   // v0.22.5: say what was resumed — with a non-empty list this also resumes
   // the queue (the active goal IS the list's head item).
   // v0.22.7: name WHAT was resumed — list items resume through /list.
@@ -1106,6 +1172,8 @@ async function bulkAddFromFile(ctx: ExtensionContext, abs: string): Promise<void
 }
 
 async function cmdList(args: string, ctx: ExtensionContext): Promise<void> {
+  // v0.28.1 (S3): honest staleness warning; read-only subcommands still work.
+  warnIfStaleAtEntry(ctx, "/list");
   const parts = args.trim().split(/\s+/);
   const sub = (parts[0] ?? "").toLowerCase();
   const rest = args.trim().slice(sub.length).trim();
@@ -2402,6 +2470,8 @@ function registerAgentTools(pi: any, ctx: ExtensionContext): void {
         };
       }
       const liveCtx = (execCtx as ExtensionContext | undefined) ?? ctx;
+      // v0.28.1 (S3): honest staleness warning before any Confirm attempt.
+      warnIfStaleAtEntry(liveCtx, "goal drafting");
       // Multi-item list draft: one Confirm for the whole batch.
       if (p.items && p.items.length > 0) {
         // v0.23.7: show ALL items in full — the user approves the whole
@@ -2419,7 +2489,14 @@ function registerAgentTools(pi: any, ctx: ExtensionContext): void {
               "Confirm list batch",
               `${p.items.length} items:\n${preview}${batchActivates ? "\n\n(List is empty — confirming ACTIVATES item 1 immediately as the active goal.)" : ""}`,
             );
-          } catch {
+          } catch (err) {
+            // v0.28.1 (T1): a stale confirm is NOT a rejection — nothing was
+            // refused; the dialog simply can't render in a doomed process.
+            if (isStaleApiError(err)) {
+              extensionApiStale = true;
+              appendLedger(liveCtx.cwd, "extension_api_stale", { where: "batch confirm" });
+              return { content: [{ type: "text", text: "The Confirm dialog could not render: pi invalidated this session's extension handle (session replacement). This is NOT a rejection — do NOT refine or re-propose. Tell the user to restart pi, then re-run the drafting flow." }], details: {} };
+            }
             batchConfirmed = false;
           }
         }
@@ -2460,7 +2537,13 @@ function registerAgentTools(pi: any, ctx: ExtensionContext): void {
       } else {
         try {
           confirmed = await liveCtx.ui.confirm(isListDraft ? "Confirm list item" : "Confirm goal", `${p.objective.trim()}${contractBlock}${activationNote}`);
-        } catch {
+        } catch (err) {
+          // v0.28.1 (T1): a stale confirm is NOT "Draft rejected by the user".
+          if (isStaleApiError(err)) {
+            extensionApiStale = true;
+            appendLedger(liveCtx.cwd, "extension_api_stale", { where: "draft confirm" });
+            return { content: [{ type: "text", text: "The Confirm dialog could not render: pi invalidated this session's extension handle (session replacement). This is NOT a rejection — do NOT refine or re-propose. Tell the user to restart pi, then re-run the drafting flow." }], details: {} };
+          }
           confirmed = false;
         }
       }
@@ -2893,173 +2976,241 @@ function resolveAuditorModel(ctx: ExtensionContext, ref?: string): { model: any;
  * Done/Esc exits. Rarely opened by design; scriptable /glla key=value remains
  * for tmux/headless.
  */
+/**
+ * v0.28.0: open the /glla settings menu as a TUI table (top tabs row +
+ * 4-column body: KEY | VALUE | SOURCE | DESCRIPTION). Loops until the user
+ * exits (Esc / undefined from confirm or cancel) or until a handler returns.
+ *
+ * The dispatcher (handleSettingChoice, below) takes a stable id and calls the
+ * per-key editor (input/select/confirm dialog) used by the pick. The prior
+ * v0.27.0 dispatcher used `choice.startsWith(label)` strings; the new id-based
+ * switch is contract-equal in behavior and unit-testable via
+ * extensions/settings-menu.ts.
+ */
 async function openSettingsUI(ctx: ExtensionContext): Promise<void> {
   for (;;) {
-    const prov = settingsProvenance(ctx.cwd);
-    const show = (k: keyof Settings, fallback: string) => {
-      const p = prov[k];
-      const v = p.value === undefined ? fallback : String(p.value);
-      return `${v}  [${p.source}]`;
-    };
     const settings = loadSettings(ctx.cwd);
-    // v0.27.0: every option on ONE screen, grouped into sections, each row
-    // carrying `label — value [provenance] — what it does` so the menu is
-    // also the documentation. Header rows are no-ops when selected.
-    const rows = [
-      "── Keep-going ──",
-      `Auto-resume on load — ${show("autoResume", "default")} — on: resume on session load too · off: never · default: hold on load, resume on reload/fork`,
-      `Auto-accept drafts — ${show("autoAcceptDrafts", "(off)")} — on: goal/loop drafts activate without the Confirm dialog (unattended rigs)`,
-      `Aggressive mode — ${show("aggressiveMode", "(off)")} — flips DEFAULTS toward keep-going (autoResume, cap 10, stuck 10, wedge off, quota auto-retry, cap→TODOs); explicit per-key settings still win`,
-      "── Auditor ──",
-      `Auditor model — ${show("auditorModel", "(pi session model)")} — provider/model override for the isolated auditor`,
-      `Auditor thinking — ${show("auditorThinkingLevel", "(session, floor high)")} — thinking level for the auditor session`,
-      `Audit cap — ${show("auditCap", "(5)")} — pause the goal after N consecutive disapprovals (0 = unlimited)`,
-      `Audit feedback chars — ${show("auditFeedbackChars", "(full report)")} — cap the executor-visible disapproval report (0 = full report)`,
-      `Quota retry minutes — ${show("quotaRetryMinutes", `(${DEFAULT_QUOTA_RETRY_MINUTES})`)} — auto-retry a quota-exhausted auditor after N minutes`,
-      "── Stall brakes ──",
-      `Wedge alert minutes — ${show("wedgeAlertMinutes", `(${WEDGE_ALERT_DEFAULT_MINUTES})`)} — hung-command alert while the session is busy (0 = off)`,
-      `Stuck max interventions — ${show("stuckMaxInterventions", "(5)")} — consecutive stuck interventions before a loop stops`,
-      `Stall escalation refires — ${show("stallEscalationRefires", "(5)")} — heartbeat refires with no turn before the goal pauses / loop stops (0 = never)`,
-      `Stall short words — ${show("stallShortWords", `(${DEFAULT_STALL_SHORT_WORDS})`)} — turns with no tools AND fewer words than this count as a nudge`,
-      `Stall similarity threshold — ${show("stallSimilarityThreshold", `(${DEFAULT_STALL_SIM_THRESHOLD})`)} — no-tool turns whose text is > this similar to the prior turn count as a nudge (0–1)`,
-      "── Subagents ──",
-      `Subagent model strategy — ${show("subagentModelStrategy", "(inherit-parent)")} — inherit-parent shares your session model+quota; agent-default pins haiku for Explore`,
-      `Subagent Explore pin — ${settings.subagentModelOverrides?.Explore ?? "(follows strategy)"} — provider/model pin; always wins over strategy`,
-      `Subagent Plan pin — ${settings.subagentModelOverrides?.Plan ?? "(follows strategy)"} — provider/model pin; always wins over strategy`,
-      `Subagent general-purpose pin — ${settings.subagentModelOverrides?.["general-purpose"] ?? "(follows strategy)"} — provider/model pin; always wins over strategy`,
-      "── Other ──",
-      `Notify command — ${show("notifyCmd", "(off)")} — desktop push command; the event message is passed as $1`,
-      `Token limit per goal — ${show("tokenLimit", "(off)")} — per-goal token budget; pause when exceeded (0 = off)`,
-      `Reviewer config… — open the reviewer menu (post-completion follow-up enqueuer: mode, triggers, cascade, caps)`,
-      "Done",
-    ];
-    let choice: string | undefined;
+    const prov = settingsProvenance(ctx.cwd);
+    const rows = buildSettingsRows(settings, prov);
+    const id = await promptSettingsMenu(ctx, rows);
+    if (!id) return;
     try {
-      choice = await ctx.ui.select(
-        `pi-goal-list-loop-audit settings — global: ${globalSettingsPath()}`,
-        rows,
-      );
+      await handleSettingChoice(id, ctx);
     } catch {
       return;
     }
-    if (!choice || choice === "Done") return;
-    if (choice.startsWith("──")) continue; // section header — no-op
-    try {
-      if (choice.startsWith("Auto-resume")) {
-        const v = await ctx.ui.select("Auto-resume goals/loops on session start", [
-          "default — HOLD when a session is loaded (popup shows what waits); auto-resume on reload/fork so machinery never strands work",
-          "on — auto-resume on EVERY session start (unattended rigs)",
-          "off — never auto-resume; always wait for an explicit resume",
-        ]);
-        if (v) saveSettings("global", ctx.cwd, { autoResume: v.startsWith("on") ? true : v.startsWith("off") ? false : undefined });
-      } else if (choice.startsWith("Auto-accept drafts")) {
-        const v = await ctx.ui.select("Auto-accept goal/loop drafts", [
-          "off — the Confirm dialog gates every draft",
-          "on — drafts activate immediately, no Confirm (unattended rigs)",
-        ]);
-        if (v) saveSettings("global", ctx.cwd, { autoAcceptDrafts: v.startsWith("on") ? true : undefined });
-      } else if (choice.startsWith("Aggressive mode")) {
-        const v = await ctx.ui.select("Aggressive mode (flips DEFAULTS toward keep-going — explicit per-key settings still win)", [
-          "off — current behavior: pause at the audit cap, wedge alerts on, manual resume",
-          "on — autoResume, audit cap 10, stuck max 10, wedge alerts off, quota auto-retry, cap disapprovals become a TODO list and the goal KEEPS GOING",
-        ]);
-        if (v) {
-          saveSettings("global", ctx.cwd, { aggressiveMode: v.startsWith("on") });
-          ctx.ui.notify(`Aggressive mode ${v.startsWith("on") ? "ON — goals keep going past the audit cap; objections become TODOs" : "off"}.`, "info");
-        }
-      } else if (choice.startsWith("Auditor model")) {
-        const v = await ctx.ui.input("Auditor model override", "provider/model-id — empty keeps the pi session model");
-        if (v !== undefined) saveSettings("global", ctx.cwd, { auditorModel: v.trim() || undefined });
-      } else if (choice.startsWith("Auditor thinking")) {
-        const v = await ctx.ui.select("Auditor thinking level", ["off", "minimal", "low", "medium", "high", "xhigh"]);
-        if (v) saveSettings("global", ctx.cwd, { auditorThinkingLevel: v as Settings["auditorThinkingLevel"] });
-      } else if (choice.startsWith("Audit cap")) {
-        const v = await ctx.ui.input("Consecutive auditor disapprovals before the goal pauses", "non-negative integer; 0 = unlimited, empty = default 5");
-        if (v !== undefined) {
-          const n = Number.parseInt(v.trim(), 10);
-          if (Number.isFinite(n) && n >= 0) saveSettings("global", ctx.cwd, { auditCap: n });
-          else if (!v.trim()) saveSettings("global", ctx.cwd, { auditCap: undefined });
-          else ctx.ui.notify(`Not a non-negative integer: ${v}`, "warning");
-        }
-      } else if (choice.startsWith("Audit feedback")) {
-        const v = await ctx.ui.input("Auditor feedback returned to the executor (characters)", "non-negative integer cap; 0 or empty = full report (default)");
-        if (v !== undefined) {
-          const raw = v.trim();
-          const n = Number(raw);
-          if (/^\d+$/.test(raw) && Number.isSafeInteger(n)) saveSettings("global", ctx.cwd, { auditFeedbackChars: n });
-          else if (!v.trim()) saveSettings("global", ctx.cwd, { auditFeedbackChars: undefined });
-          else ctx.ui.notify(`Not a non-negative integer: ${v}`, "warning");
-        }
-      } else if (choice.startsWith("Quota retry minutes")) {
-        const v = await ctx.ui.input("Minutes before auto-retrying a quota-exhausted auditor", `positive integer; empty = default ${DEFAULT_QUOTA_RETRY_MINUTES}`);
-        if (v !== undefined) {
-          const n = Number.parseInt(v.trim(), 10);
-          if (Number.isFinite(n) && n > 0) saveSettings("global", ctx.cwd, { quotaRetryMinutes: n });
-          else if (!v.trim()) saveSettings("global", ctx.cwd, { quotaRetryMinutes: undefined });
-          else ctx.ui.notify(`Not a positive integer: ${v}`, "warning");
-        }
-      } else if (choice.startsWith("Wedge alert")) {
-        const v = await ctx.ui.input("Wedge alert threshold (minutes)", "non-negative integer; 0 = off, empty = default 30");
-        if (v !== undefined) {
-          const n = Number.parseInt(v.trim(), 10);
-          if (Number.isFinite(n) && n >= 0) saveSettings("global", ctx.cwd, { wedgeAlertMinutes: n });
-          else if (!v.trim()) saveSettings("global", ctx.cwd, { wedgeAlertMinutes: undefined });
-          else ctx.ui.notify(`Not a non-negative integer: ${v}`, "warning");
-        }
-      } else if (choice.startsWith("Stuck max interventions")) {
-        const v = await ctx.ui.input("Consecutive stuck interventions before a loop stops", "positive integer; empty = default 5 (10 under aggressiveMode)");
-        if (v !== undefined) {
-          const n = Number.parseInt(v.trim(), 10);
-          if (Number.isFinite(n) && n > 0) saveSettings("global", ctx.cwd, { stuckMaxInterventions: n });
-          else if (!v.trim()) saveSettings("global", ctx.cwd, { stuckMaxInterventions: undefined });
-          else ctx.ui.notify(`Not a positive integer: ${v}`, "warning");
-        }
-      } else if (choice.startsWith("Stall escalation")) {
-        const v = await ctx.ui.input("Heartbeat refires without a turn before the goal pauses / loop stops", "non-negative integer; 0 = never escalate, empty = default 5");
-        if (v !== undefined) {
-          const n = Number.parseInt(v.trim(), 10);
-          if (Number.isFinite(n) && n >= 0) saveSettings("global", ctx.cwd, { stallEscalationRefires: n });
-          else if (!v.trim()) saveSettings("global", ctx.cwd, { stallEscalationRefires: undefined });
-          else ctx.ui.notify(`Not a non-negative integer: ${v}`, "warning");
-        }
-      } else if (choice.startsWith("Subagent model strategy")) {
-        const v = await ctx.ui.select("Subagent model (pi-subagents default agents)", [
-          "inherit-parent — subagents share your session model + its quota pool (fixes separate-provider 403s; search agents may run on a pricier model)",
-          "agent-default — upstream behavior: Explore pins claude-haiku-4-5 (cheap search, but a SEPARATE provider quota from your session)",
-        ]);
-        if (v) {
-          const strategy: SubagentModelStrategy = v.startsWith("agent-default") ? "agent-default" : "inherit-parent";
-          saveSettings("global", ctx.cwd, { subagentModelStrategy: strategy });
-          ctx.ui.notify("Subagent model strategy saved — applies to NEW pi sessions (pi-subagents registers agents at session start).", "info");
-        }
-      } else if (/^Subagent (Explore|Plan|general-purpose) pin/.test(choice)) {
-        const agentType = choice.match(/^Subagent (Explore|Plan|general-purpose) pin/)![1]!;
-        const v = await ctx.ui.input(`Model pin for ${agentType} subagents`, "provider/model-id e.g. minimax/MiniMax-M3 — always wins over strategy; empty = follow strategy");
-        if (v !== undefined) {
-          const current = loadSettings(ctx.cwd).subagentModelOverrides ?? {};
-          const next = { ...current };
-          if (v.trim()) next[agentType] = v.trim();
-          else delete next[agentType];
-          saveSettings("global", ctx.cwd, { subagentModelOverrides: Object.keys(next).length > 0 ? next : undefined });
-          ctx.ui.notify(`${agentType} model pin saved — applies to NEW pi sessions.`, "info");
-        }
-      } else if (choice.startsWith("Notify command")) {
-        const v = await ctx.ui.input("Notify command — the event message is passed as $1", "e.g. a desktop-notification or push command; empty = off");
-        if (v !== undefined) saveSettings("global", ctx.cwd, { notifyCmd: v.trim() || undefined });
-      } else if (choice.startsWith("Token limit")) {
-        const v = await ctx.ui.input("Per-goal token budget", "non-negative integer; 0 or empty = off (no cap)");
-        if (v !== undefined) {
-          const n = Number.parseInt(v.trim(), 10);
-          if (Number.isFinite(n) && n >= 0) saveSettings("global", ctx.cwd, { tokenLimit: n });
-          else if (!v.trim()) saveSettings("global", ctx.cwd, { tokenLimit: undefined });
-          else ctx.ui.notify(`Not a non-negative integer: ${v}`, "warning");
-        }
-      } else if (choice.startsWith("Reviewer config")) {
-        await cmdReviewerSettings(ctx);
+  }
+}
+
+/**
+ * Show the table-rendered settings menu and return the user's pick id (or
+ * undefined for cancel). Wraps `ctx.ui.custom` so openSettingsUI stays a thin
+ * loop. Falls back to a select-based legacy menu when the runtime has no
+ * `ctx.ui.custom` (the `ctx.hasUI` guard already protects this path elsewhere;
+ * this is a second-line defense for headless custom-only shards).
+ */
+async function promptSettingsMenu(
+  ctx: ExtensionContext,
+  rows: SettingsRow[],
+): Promise<string | undefined> {
+  const title = `pi-goal-list-loop-audit settings — global: ${globalSettingsPath()}`;
+  if (typeof (ctx.ui as { custom?: unknown }).custom !== "function") {
+    // Headless / no custom shard — fall back to the legacy flat-row select
+    // for any environment that lacks the new primitive. This is rare and
+    // effectively an emergency hatch; the new UI is the supported path.
+    const flat = rows.map((r) => `${r.label} — ${r.valueText} [${r.sourceText.replace(/^\[|\]$/g, "")}] — ${r.description}`);
+    flat.push("Done");
+    const v = await ctx.ui.select(title, flat);
+    if (!v || v === "Done") return undefined;
+    return rows.find((r) => v.startsWith(r.label))?.id;
+  }
+  return await ctx.ui.custom<string | undefined>((tui, theme, keybindings, done) => {
+    return new SettingsMenuComponent({ rows, title }, () => tui.requestRender(), theme, keybindings, done);
+  });
+}
+
+/**
+ * v0.28.0: per-key dispatch for the settings menu. The id comes from
+ * `buildSettingsRows` (e.g. "autoResume", "auditorModel", "subagentModelOverrides.Explore").
+ * Same handlers as v0.27.0's if/else chain — only the trigger changed from
+ * `startsWith(label)` strings to stable ids.
+ */
+async function handleSettingChoice(id: string, ctx: ExtensionContext): Promise<void> {
+  switch (id) {
+    case "autoResume": {
+      const v = await ctx.ui.select("Auto-resume goals/loops on session start", [
+        "default — HOLD when a session is loaded (popup shows what waits); auto-resume on reload/fork so machinery never strands work",
+        "on — auto-resume on EVERY session start (unattended rigs)",
+        "off — never auto-resume; always wait for an explicit resume",
+      ]);
+      if (v) saveSettings("global", ctx.cwd, { autoResume: v.startsWith("on") ? true : v.startsWith("off") ? false : undefined });
+      return;
+    }
+    case "autoAcceptDrafts": {
+      const v = await ctx.ui.select("Auto-accept goal/loop drafts", [
+        "off — the Confirm dialog gates every draft",
+        "on — drafts activate immediately, no Confirm (unattended rigs)",
+      ]);
+      if (v) saveSettings("global", ctx.cwd, { autoAcceptDrafts: v.startsWith("on") ? true : undefined });
+      return;
+    }
+    case "aggressiveMode": {
+      const v = await ctx.ui.select("Aggressive mode (flips DEFAULTS toward keep-going — explicit per-key settings still win)", [
+        "off — current behavior: pause at the audit cap, wedge alerts on, manual resume",
+        "on — autoResume, audit cap 10, stuck max 10, wedge alerts off, quota auto-retry, cap disapprovals become a TODO list and the goal KEEPS GOING",
+      ]);
+      if (v) {
+        saveSettings("global", ctx.cwd, { aggressiveMode: v.startsWith("on") });
+        ctx.ui.notify(`Aggressive mode ${v.startsWith("on") ? "ON — goals keep going past the audit cap; objections become TODOs" : "off"}.`, "info");
       }
-    } catch {
       return;
     }
+    case "auditorModel": {
+      const v = await ctx.ui.input("Auditor model override", "provider/model-id — empty keeps the pi session model");
+      if (v !== undefined) saveSettings("global", ctx.cwd, { auditorModel: v.trim() || undefined });
+      return;
+    }
+    case "auditorThinkingLevel": {
+      const v = await ctx.ui.select("Auditor thinking level", ["off", "minimal", "low", "medium", "high", "xhigh"]);
+      if (v) saveSettings("global", ctx.cwd, { auditorThinkingLevel: v as Settings["auditorThinkingLevel"] });
+      return;
+    }
+    case "auditCap": {
+      const v = await ctx.ui.input("Consecutive auditor disapprovals before the goal pauses", "non-negative integer; 0 = unlimited, empty = default 5");
+      if (v !== undefined) {
+        const n = Number.parseInt(v.trim(), 10);
+        if (Number.isFinite(n) && n >= 0) saveSettings("global", ctx.cwd, { auditCap: n });
+        else if (!v.trim()) saveSettings("global", ctx.cwd, { auditCap: undefined });
+        else ctx.ui.notify(`Not a non-negative integer: ${v}`, "warning");
+      }
+      return;
+    }
+    case "auditFeedbackChars": {
+      const v = await ctx.ui.input("Auditor feedback returned to the executor (characters)", "non-negative integer cap; 0 or empty = full report (default)");
+      if (v !== undefined) {
+        const raw = v.trim();
+        const n = Number(raw);
+        if (/^\d+$/.test(raw) && Number.isSafeInteger(n)) saveSettings("global", ctx.cwd, { auditFeedbackChars: n });
+        else if (!v.trim()) saveSettings("global", ctx.cwd, { auditFeedbackChars: undefined });
+        else ctx.ui.notify(`Not a non-negative integer: ${v}`, "warning");
+      }
+      return;
+    }
+    case "quotaRetryMinutes": {
+      const v = await ctx.ui.input("Minutes before auto-retrying a quota-exhausted auditor", `positive integer; empty = default ${DEFAULT_QUOTA_RETRY_MINUTES}`);
+      if (v !== undefined) {
+        const n = Number.parseInt(v.trim(), 10);
+        if (Number.isFinite(n) && n > 0) saveSettings("global", ctx.cwd, { quotaRetryMinutes: n });
+        else if (!v.trim()) saveSettings("global", ctx.cwd, { quotaRetryMinutes: undefined });
+        else ctx.ui.notify(`Not a positive integer: ${v}`, "warning");
+      }
+      return;
+    }
+    case "wedgeAlertMinutes": {
+      const v = await ctx.ui.input("Wedge alert threshold (minutes)", "non-negative integer; 0 = off, empty = default 30");
+      if (v !== undefined) {
+        const n = Number.parseInt(v.trim(), 10);
+        if (Number.isFinite(n) && n >= 0) saveSettings("global", ctx.cwd, { wedgeAlertMinutes: n });
+        else if (!v.trim()) saveSettings("global", ctx.cwd, { wedgeAlertMinutes: undefined });
+        else ctx.ui.notify(`Not a non-negative integer: ${v}`, "warning");
+      }
+      return;
+    }
+    case "stuckMaxInterventions": {
+      const v = await ctx.ui.input("Consecutive stuck interventions before a loop stops", "positive integer; empty = default 5 (10 under aggressiveMode)");
+      if (v !== undefined) {
+        const n = Number.parseInt(v.trim(), 10);
+        if (Number.isFinite(n) && n > 0) saveSettings("global", ctx.cwd, { stuckMaxInterventions: n });
+        else if (!v.trim()) saveSettings("global", ctx.cwd, { stuckMaxInterventions: undefined });
+        else ctx.ui.notify(`Not a positive integer: ${v}`, "warning");
+      }
+      return;
+    }
+    case "stallEscalationRefires": {
+      const v = await ctx.ui.input("Heartbeat refires without a turn before the goal pauses / loop stops", "non-negative integer; 0 = never escalate, empty = default 5");
+      if (v !== undefined) {
+        const n = Number.parseInt(v.trim(), 10);
+        if (Number.isFinite(n) && n >= 0) saveSettings("global", ctx.cwd, { stallEscalationRefires: n });
+        else if (!v.trim()) saveSettings("global", ctx.cwd, { stallEscalationRefires: undefined });
+        else ctx.ui.notify(`Not a non-negative integer: ${v}`, "warning");
+      }
+      return;
+    }
+    case "stallShortWords": {
+      const v = await ctx.ui.input("Stall short words threshold", "non-negative integer; 0 = off, empty = default 15");
+      if (v !== undefined) {
+        const n = Number.parseInt(v.trim(), 10);
+        if (Number.isFinite(n) && n >= 0) saveSettings("global", ctx.cwd, { stallShortWords: n });
+        else if (!v.trim()) saveSettings("global", ctx.cwd, { stallShortWords: undefined });
+        else ctx.ui.notify(`Not a non-negative integer: ${v}`, "warning");
+      }
+      return;
+    }
+    case "stallSimilarityThreshold": {
+      const v = await ctx.ui.input("Stall similarity threshold (0..1)", "decimal between 0 and 1; empty = default 0.6");
+      if (v !== undefined) {
+        const n = Number(v.trim());
+        if (Number.isFinite(n) && n >= 0 && n <= 1) saveSettings("global", ctx.cwd, { stallSimilarityThreshold: n });
+        else if (!v.trim()) saveSettings("global", ctx.cwd, { stallSimilarityThreshold: undefined });
+        else ctx.ui.notify(`Not a decimal between 0 and 1: ${v}`, "warning");
+      }
+      return;
+    }
+    case "subagentModelStrategy": {
+      const v = await ctx.ui.select("Subagent model (pi-subagents default agents)", [
+        "inherit-parent — share your session model + quota pool (recommended)",
+        "agent-default — use the upstream pi-subagents default agents",
+      ]);
+      if (v) {
+        const strategy: SubagentModelStrategy = v.startsWith("agent-default") ? "agent-default" : "inherit-parent";
+        saveSettings("global", ctx.cwd, { subagentModelStrategy: strategy });
+        ctx.ui.notify("Subagent model strategy saved — applies to NEW pi sessions (pi-subagents registers agents at session start).", "info");
+      }
+      return;
+    }
+    case "subagentModelOverrides.Explore":
+    case "subagentModelOverrides.Plan":
+    case "subagentModelOverrides.general-purpose": {
+      const agentType = id.slice("subagentModelOverrides.".length);
+      const v = await ctx.ui.input(`Model pin for ${agentType} subagents`, "provider/model-id e.g. minimax/MiniMax-M3 — always wins over strategy; empty = follow strategy");
+      if (v !== undefined) {
+        const current = loadSettings(ctx.cwd).subagentModelOverrides ?? {};
+        const next = { ...current };
+        if (v.trim()) next[agentType] = v.trim();
+        else delete next[agentType];
+        saveSettings("global", ctx.cwd, { subagentModelOverrides: Object.keys(next).length > 0 ? next : undefined });
+        ctx.ui.notify(`${agentType} model pin saved — applies to NEW pi sessions.`, "info");
+      }
+      return;
+    }
+    case "subagentResolved":
+      // Read-only (effective resolution row) — no editor; row just shows the
+      // current effective subagent models. Treat as no-op.
+      return;
+    case "notifyCmd": {
+      const v = await ctx.ui.input("Notify command — the event message is passed as $1", "e.g. a desktop-notification or push command; empty = off");
+      if (v !== undefined) saveSettings("global", ctx.cwd, { notifyCmd: v.trim() || undefined });
+      return;
+    }
+    case "tokenLimit": {
+      const v = await ctx.ui.input("Per-goal token budget", "non-negative integer; 0 or empty = off (no cap)");
+      if (v !== undefined) {
+        const n = Number.parseInt(v.trim(), 10);
+        if (Number.isFinite(n) && n >= 0) saveSettings("global", ctx.cwd, { tokenLimit: n });
+        else if (!v.trim()) saveSettings("global", ctx.cwd, { tokenLimit: undefined });
+        else ctx.ui.notify(`Not a non-negative integer: ${v}`, "warning");
+      }
+      return;
+    }
+    case "postaudit":
+      await cmdReviewerSettings(ctx);
+      return;
+    default:
+      // Unknown id — keep the menu looping. Surface a soft warning so the
+      // user knows a row existed but had no handler (better than silently
+      // swallowing it).
+      ctx.ui.notify(`/glla: unknown setting id "${id}" — please report this.`, "warning");
+      return;
   }
 }
 
@@ -3959,8 +4110,12 @@ export default function (pi: ExtensionAPI): void {
       }
     } else if (state.goal && state.goal.status === "active" && state.goal.autoContinue) {
       if (autoResume) {
+        // v0.28.1 (S2): clear the stale-handle interrupt marker — this IS
+        // the auto-resume the marker promised.
+        const wasInterrupted = !!state.goal.interruptedAt;
+        if (wasInterrupted) updateGoal({ interruptedAt: undefined, interruptedReason: undefined }, ctx);
         ctx.ui.notify(
-          `Resuming ${state.goal.policy === "list" ? "list item" : "goal"} [${state.goal.id}]: ${state.goal.objective.slice(0, 70)}${listQueue().length > 0 ? ` (+${listQueue().length} queued)` : ""}`,
+          `Resuming ${state.goal.policy === "list" ? "list item" : "goal"} [${state.goal.id}]: ${state.goal.objective.slice(0, 70)}${listQueue().length > 0 ? ` (+${listQueue().length} queued)` : ""}${wasInterrupted ? " — auto-resumed after the stale-handle interrupt" : ""}`,
           "info",
         );
         scheduleContinuation(ctx, true);

package/extensions/settings-menu.ts

@@ -0,0 +1,571 @@
+// pi-goal-list-loop-audit — v0.28.0
+// extensions/settings-menu.ts
+//
+// The /glla settings menu as a real TUI table (v0.28.0).
+//
+// Pre-0.28.0 used `ctx.ui.select` with flat single-line rows; v0.28.0
+// replaces it with a `ctx.ui.custom` Container/Text layout featuring:
+//   • a top TABS row listing all 5 sections (left/right to switch sections)
+//   • a 4-column table for the active section (KEY | VALUE | SOURCE | DESCRIPTION)
+//   • up/down navigation scoped to the active section's rows
+//   • Enter → emit the selected row's id (caller dispatches handler)
+//   • Esc / Ctrl+C → emit undefined (caller exits)
+//
+// Sections (5 total) map to the pre-0.28.0 menu groupings:
+//   keep-going | auditor | stall-brakes | subagents | other
+//
+// Extracted into its own module so tests can import `buildSettingsRows` directly
+// (mirrors how `readState` lives in goal-loop-core.ts) and so the renderer is
+// unit-testable via synthetic handleInput calls (no live TUI needed).
+//
+// The pre-v0.28.0 headless fallback (`/glla` with no args and no UI) keeps its
+// existing text rendering — that's still the right shape for tmux/cron. Only
+// the TUI menu becomes a table.
+
+import {
+  type Component,
+  truncateToWidth,
+  visibleWidth,
+} from "@earendil-works/pi-tui";
+
+import {
+  DEFAULT_AUDIT_FEEDBACK_CHARS,
+  DEFAULT_QUOTA_RETRY_MINUTES,
+  DEFAULT_STALL_ESCALATION_REFIRES,
+} from "./goal-loop-core.ts";
+import {
+  DEFAULT_STALL_SIM_THRESHOLD,
+  DEFAULT_STALL_SHORT_WORDS,
+  WEDGE_ALERT_DEFAULT_MINUTES,
+} from "./goal-loop-backoff.ts";
+import type { Settings } from "./goal-settings.ts";
+import { resolveEffectiveSubagentModel } from "./goal-loop-subagents.ts";
+
+// =================================================================
+// Pure row builder (testable + reusable from the headless fallback)
+// =================================================================
+
+export type SettingsSectionId =
+  | "keep-going"
+  | "auditor"
+  | "stall-brakes"
+  | "subagents"
+  | "other";
+
+export const SETTINGS_SECTIONS: readonly { id: SettingsSectionId; label: string }[] = [
+  { id: "keep-going", label: "Keep-going" },
+  { id: "auditor", label: "Auditor" },
+  { id: "stall-brakes", label: "Stall brakes" },
+  { id: "subagents", label: "Subagents" },
+  { id: "other", label: "Other" },
+];
+
+/** One menu row. `id` is the stable dispatch key (caller switch(id) → handler). */
+export interface SettingsRow {
+  /** Stable dispatch key — used both as the table id and as the switch(id) case. */
+  id: string;
+  /** Which section this row belongs to. */
+  section: SettingsSectionId;
+  /** KEY column — the setting name (left-aligned, padded to keyW). */
+  label: string;
+  /** VALUE column — current effective value, e.g. `true` / `(off)` / `60`. */
+  valueText: string;
+  /** SOURCE column — provenance tag, one of `[project]` / `[global]` / `[default]`. */
+  sourceText: string;
+  /** DESCRIPTION column — one-line explanation; truncated with ellipsis when narrow. */
+  description: string;
+}
+
+export type ProvenanceSource = "project" | "global" | "default";
+
+export interface MenuProvenance {
+  value: unknown;
+  source: ProvenanceSource;
+}
+
+/** Defaults surfaced in the menu when the user has not set a value. */
+export interface MenuDefaults {
+  auditCap: number;
+  stuckMaxInterventions: number;
+}
+
+export const DEFAULT_MENU_DEFAULTS: MenuDefaults = {
+  auditCap: 5,
+  stuckMaxInterventions: 5,
+};
+
+/** Subagent model provenance context needed to render the subagent pins column. */
+export interface MenuSubagentContext {
+  /** Active session model id (provider/model) — used by inherit-parent resolution. */
+  sessionModel?: string;
+}
+
+/**
+ * Build the full ordered list of menu rows for every section.
+ * Pure: no I/O, no extension context; the renderer composes sections onto rows.
+ */
+export function buildSettingsRows(
+  settings: Settings,
+  prov: Partial<Record<keyof Settings, MenuProvenance>>,
+  subagent: MenuSubagentContext = {},
+  defaults: MenuDefaults = DEFAULT_MENU_DEFAULTS,
+): SettingsRow[] {
+  const provFor = (k: keyof Settings): MenuProvenance =>
+    prov[k] ?? { value: undefined, source: "default" };
+  const show = (k: keyof Settings, fallback: string): string => {
+    const p = provFor(k);
+    return p.value === undefined ? fallback : String(p.value);
+  };
+  const src = (k: keyof Settings): string => `[${provFor(k).source}]`;
+
+  const rows: SettingsRow[] = [];
+
+  // ── Keep-going ──
+  rows.push(
+    {
+      id: "autoResume",
+      section: "keep-going",
+      label: "Auto-resume on load",
+      valueText: show("autoResume", "default"),
+      sourceText: src("autoResume"),
+      description:
+        "on: resume on session load too · off: never · default: hold on load, resume on reload/fork",
+    },
+    {
+      id: "autoAcceptDrafts",
+      section: "keep-going",
+      label: "Auto-accept drafts",
+      valueText: show("autoAcceptDrafts", "(off)"),
+      sourceText: src("autoAcceptDrafts"),
+      description: "on: goal/loop drafts activate without the Confirm dialog (unattended rigs)",
+    },
+    {
+      id: "aggressiveMode",
+      section: "keep-going",
+      label: "Aggressive mode",
+      valueText: show("aggressiveMode", "(off)"),
+      sourceText: src("aggressiveMode"),
+      description:
+        "flips DEFAULTS toward keep-going (autoResume, cap 10, stuck 10, wedge off, quota auto-retry, cap→TODOs); explicit per-key settings still win",
+    },
+  );
+
+  // ── Auditor ──
+  rows.push(
+    {
+      id: "auditorModel",
+      section: "auditor",
+      label: "Auditor model",
+      valueText: show("auditorModel", "(pi session model)"),
+      sourceText: src("auditorModel"),
+      description: "provider/model override for the isolated auditor",
+    },
+    {
+      id: "auditorThinkingLevel",
+      section: "auditor",
+      label: "Auditor thinking",
+      valueText: show("auditorThinkingLevel", "(session, floor high)"),
+      sourceText: src("auditorThinkingLevel"),
+      description: "thinking level for the auditor session",
+    },
+    {
+      id: "auditCap",
+      section: "auditor",
+      label: "Audit cap",
+      valueText: show("auditCap", `(${defaults.auditCap})`),
+      sourceText: src("auditCap"),
+      description: "pause the goal after N consecutive disapprovals (0 = unlimited)",
+    },
+    {
+      id: "auditFeedbackChars",
+      section: "auditor",
+      label: "Audit feedback chars",
+      valueText: show(
+        "auditFeedbackChars",
+        DEFAULT_AUDIT_FEEDBACK_CHARS === 0 ? "(full report)" : `(${DEFAULT_AUDIT_FEEDBACK_CHARS})`,
+      ),
+      sourceText: src("auditFeedbackChars"),
+      description: "cap the executor-visible disapproval report (0 = full report)",
+    },
+    {
+      id: "quotaRetryMinutes",
+      section: "auditor",
+      label: "Quota retry minutes",
+      valueText: show("quotaRetryMinutes", `(${DEFAULT_QUOTA_RETRY_MINUTES})`),
+      sourceText: src("quotaRetryMinutes"),
+      description: "auto-retry a quota-exhausted auditor after N minutes",
+    },
+  );
+
+  // ── Stall brakes ──
+  rows.push(
+    {
+      id: "wedgeAlertMinutes",
+      section: "stall-brakes",
+      label: "Wedge alert minutes",
+      valueText: show("wedgeAlertMinutes", `(${WEDGE_ALERT_DEFAULT_MINUTES})`),
+      sourceText: src("wedgeAlertMinutes"),
+      description: "hung-command alert while the session is busy (0 = off)",
+    },
+    {
+      id: "stuckMaxInterventions",
+      section: "stall-brakes",
+      label: "Stuck max interventions",
+      valueText: show("stuckMaxInterventions", `(${defaults.stuckMaxInterventions})`),
+      sourceText: src("stuckMaxInterventions"),
+      description: "consecutive stuck interventions before a loop stops",
+    },
+    {
+      id: "stallEscalationRefires",
+      section: "stall-brakes",
+      label: "Stall escalation refires",
+      valueText: show("stallEscalationRefires", `(${DEFAULT_STALL_ESCALATION_REFIRES})`),
+      sourceText: src("stallEscalationRefires"),
+      description:
+        "heartbeat refires with no turn before the goal pauses / loop stops (0 = never)",
+    },
+    {
+      id: "stallShortWords",
+      section: "stall-brakes",
+      label: "Stall short words",
+      valueText: show("stallShortWords", `(${DEFAULT_STALL_SHORT_WORDS})`),
+      sourceText: src("stallShortWords"),
+      description: "turns with no tools AND fewer words than this count as a nudge",
+    },
+    {
+      id: "stallSimilarityThreshold",
+      section: "stall-brakes",
+      label: "Stall similarity threshold",
+      valueText: show("stallSimilarityThreshold", `(${DEFAULT_STALL_SIM_THRESHOLD})`),
+      sourceText: src("stallSimilarityThreshold"),
+      description:
+        "no-tool turns whose text is > this similar to the prior turn count as a nudge (0–1)",
+    },
+  );
+
+  // ── Subagents ──
+  rows.push(
+    {
+      id: "subagentModelStrategy",
+      section: "subagents",
+      label: "Subagent model strategy",
+      valueText: show("subagentModelStrategy", "(inherit-parent)"),
+      sourceText: src("subagentModelStrategy"),
+      description:
+        "inherit-parent shares your session model + quota pool; agent-default uses the upstream pi-subagents default agents",
+    },
+    {
+      id: "subagentModelOverrides.Explore",
+      section: "subagents",
+      label: "Subagent Explore pin",
+      valueText: settings.subagentModelOverrides?.Explore ?? "(follows strategy)",
+      sourceText:
+        settings.subagentModelOverrides?.Explore !== undefined
+          ? src("subagentModelOverrides")
+          : "[default]",
+      description: "provider/model pin; always wins over strategy",
+    },
+    {
+      id: "subagentModelOverrides.Plan",
+      section: "subagents",
+      label: "Subagent Plan pin",
+      valueText: settings.subagentModelOverrides?.Plan ?? "(follows strategy)",
+      sourceText:
+        settings.subagentModelOverrides?.Plan !== undefined
+          ? src("subagentModelOverrides")
+          : "[default]",
+      description: "provider/model pin; always wins over strategy",
+    },
+    {
+      id: "subagentModelOverrides.general-purpose",
+      section: "subagents",
+      label: "Subagent general-purpose pin",
+      valueText: settings.subagentModelOverrides?.["general-purpose"] ?? "(follows strategy)",
+      sourceText:
+        settings.subagentModelOverrides?.["general-purpose"] !== undefined
+          ? src("subagentModelOverrides")
+          : "[default]",
+      description: "provider/model pin; always wins over strategy",
+    },
+    {
+      id: "subagentResolved",
+      section: "subagents",
+      label: "Effective resolution",
+      valueText: [
+        resolveEffectiveSubagentModel("Explore", settings, subagent.sessionModel),
+        resolveEffectiveSubagentModel("Plan", settings, subagent.sessionModel),
+        resolveEffectiveSubagentModel("general-purpose", settings, subagent.sessionModel),
+      ].join(" · "),
+      sourceText: "[runtime]",
+      description: "effective Explore / Plan / general-purpose model given current settings",
+    },
+  );
+
+  // ── Other ──
+  rows.push(
+    {
+      id: "notifyCmd",
+      section: "other",
+      label: "Notify command",
+      valueText: show("notifyCmd", "(off)"),
+      sourceText: src("notifyCmd"),
+      description: "desktop push command; the event message is passed as $1",
+    },
+    {
+      id: "tokenLimit",
+      section: "other",
+      label: "Token limit per goal",
+      valueText: show("tokenLimit", "(off)"),
+      sourceText: src("tokenLimit"),
+      description: "per-goal token budget; pause when exceeded (0 = off)",
+    },
+    {
+      id: "postaudit",
+      section: "other",
+      label: "Postaudit config…",
+      valueText: "open sub-menu",
+      sourceText: "[—]",
+      description:
+        "post-completion follow-up enqueuer: mode, triggers, cascade, caps (postaudit / reviewer)",
+    },
+  );
+
+  return rows;
+}
+
+// =================================================================
+// TUI table component
+// =================================================================
+
+/** Padding + gutter between columns. */
+const COL_GUTTER = 2;
+
+/** Maximum width for each fixed column before truncation kicks in. */
+const MAX_KEY_W = 32;
+const MAX_VALUE_W = 24;
+const MAX_SOURCE_W = 10;
+const MIN_DESC_W = 12;
+
+/** A minimal subset of pi-tui's Theme interface used by the renderer. */
+export interface SettingsMenuTheme {
+  fg(color: "accent" | "muted" | "dim" | "warning" | "success", text: string): string;
+  bold(text: string): string;
+}
+
+/** Structural type for the KeybindingsManager — avoids pulling in the
+ * full class so callers can supply any compatible implementation.
+ * (Top-level and nested pi-tui ship separate KeybindingsManager classes
+ * with private fields; structural typing sidesteps the cross-package type
+ * incompatibility entirely.) */
+export interface KeybindingsManagerLike {
+  matches(data: string, key: string): boolean;
+}
+
+export interface SettingsMenuFactoryDeps {
+  rows: SettingsRow[];
+  title: string;
+}
+
+/**
+ * TUI Component for the /glla settings menu. Renders a top tabs row + a
+ * 4-column table for the active section. The host (extensions/loops/goal.ts)
+ * constructs it via `ctx.ui.custom(...)` and dispatches the returned id
+ * with `switch (id)` instead of the pre-v0.28.0 `startsWith` strings.
+ */
+export class SettingsMenuComponent implements Component {
+  private readonly rows: SettingsRow[];
+  private readonly title: string;
+  private readonly requestRender: () => void;
+  private readonly theme: SettingsMenuTheme;
+  private readonly keybindings: KeybindingsManagerLike;
+  private readonly done: (id: string | undefined) => void;
+
+  private activeSectionIdx: number;
+  private selectedIdx: number;
+  private cachedWidth?: number;
+  private cachedLines?: string[];
+
+  constructor(
+    deps: SettingsMenuFactoryDeps,
+    requestRender: () => void,
+    theme: SettingsMenuTheme,
+    keybindings: KeybindingsManagerLike,
+    done: (id: string | undefined) => void,
+  ) {
+    this.rows = deps.rows;
+    this.title = deps.title;
+    this.requestRender = requestRender;
+    this.theme = theme;
+    this.keybindings = keybindings;
+    this.done = done;
+    this.activeSectionIdx = 0;
+    this.selectedIdx = 0;
+  }
+
+  /** Index into `SETTINGS_SECTIONS`. Exposed for tests. */
+  getActiveSectionIdx(): number {
+    return this.activeSectionIdx;
+  }
+
+  /** Index into the active-section's visible rows. Exposed for tests. */
+  getSelectedIdx(): number {
+    return this.selectedIdx;
+  }
+
+  /** Rows in the active section. Exposed for tests. */
+  visibleRows(): SettingsRow[] {
+    return this.rows.filter(
+      (r) => r.section === SETTINGS_SECTIONS[this.activeSectionIdx]!.id,
+    );
+  }
+
+  private refresh(): void {
+    this.cachedWidth = undefined;
+    this.cachedLines = undefined;
+    this.requestRender();
+  }
+
+  /** Move within the active section, wrapping at ends. Exposed for tests. */
+  move(delta: number): void {
+    const vs = this.visibleRows();
+    if (vs.length === 0) return;
+    const n = vs.length;
+    this.selectedIdx = ((this.selectedIdx + delta) % n + n) % n;
+    this.refresh();
+  }
+
+  /** Switch section. -1 = left, +1 = right; wraps at ends. Exposed for tests. */
+  switchSection(delta: number): void {
+    const n = SETTINGS_SECTIONS.length;
+    this.activeSectionIdx = ((this.activeSectionIdx + delta) % n + n) % n;
+    this.selectedIdx = 0;
+    this.refresh();
+  }
+
+  private resolveSelectedId(): string | undefined {
+    return this.visibleRows()[this.selectedIdx]?.id;
+  }
+
+  private widths(width: number) {
+    let keyW = visibleWidth(this.theme.bold("KEY"));
+    let valueW = visibleWidth(this.theme.bold("VALUE"));
+    let sourceW = visibleWidth(this.theme.bold("SOURCE"));
+    for (const r of this.visibleRows()) {
+      if (visibleWidth(r.label) > keyW) keyW = visibleWidth(r.label);
+      if (visibleWidth(r.valueText) > valueW) valueW = visibleWidth(r.valueText);
+      if (visibleWidth(r.sourceText) > sourceW) sourceW = visibleWidth(r.sourceText);
+    }
+    keyW = Math.min(keyW, MAX_KEY_W);
+    valueW = Math.min(valueW, MAX_VALUE_W);
+    sourceW = Math.min(sourceW, MAX_SOURCE_W);
+    const descW = Math.max(MIN_DESC_W, width - keyW - valueW - sourceW - 3 * COL_GUTTER);
+    return { keyW, valueW, sourceW, descW };
+  }
+
+  private padEnd(text: string, width: number): string {
+    const w = visibleWidth(text);
+    return w >= width ? text : text + " ".repeat(width - w);
+  }
+
+  private renderBody(width: number): string[] {
+    const { keyW, valueW, sourceW, descW } = this.widths(width);
+    const gutter = " ".repeat(COL_GUTTER);
+
+    const lines: string[] = [];
+
+    lines.push(this.theme.fg("accent", this.theme.bold(this.title)));
+
+    lines.push(
+      SETTINGS_SECTIONS.map((s, i) =>
+        i === this.activeSectionIdx
+          ? this.theme.fg("accent", `[${s.label}]`)
+          : this.theme.fg("dim", s.label),
+      ).join("  "),
+    );
+
+    lines.push(
+      [
+        this.padEnd(this.theme.bold("KEY"), keyW),
+        this.padEnd(this.theme.bold("VALUE"), valueW),
+        this.padEnd(this.theme.bold("SOURCE"), sourceW),
+        this.theme.bold("DESCRIPTION"),
+      ].join(gutter),
+    );
+
+    const vs = this.visibleRows();
+    if (vs.length === 0) {
+      lines.push(this.theme.fg("muted", "(no settings in this section)"));
+    } else {
+      vs.forEach((r, i) => {
+        const selected = i === this.selectedIdx;
+        const prefix = selected ? "▶ " : "  ";
+        const row = [
+          this.padEnd(prefix + r.label, keyW),
+          this.padEnd(r.valueText, valueW),
+          this.padEnd(r.sourceText, sourceW),
+          truncateToWidth(r.description, descW, "…"),
+        ].join(gutter);
+        lines.push(selected ? this.theme.fg("accent", row) : row);
+      });
+    }
+
+    lines.push(
+      this.theme.fg(
+        "dim",
+        "←/→ tab · ↑/↓ move · enter drill-in · esc exit",
+      ),
+    );
+
+    return lines;
+  }
+
+  render(width: number): string[] {
+    if (this.cachedLines && this.cachedWidth === width) return this.cachedLines;
+    this.cachedWidth = width;
+    this.cachedLines = this.renderBody(width);
+    return this.cachedLines;
+  }
+
+  handleInput(data: string): void {
+    if (this.keybindings.matches(data, "tui.select.confirm")) {
+      this.done(this.resolveSelectedId());
+      return;
+    }
+    if (this.keybindings.matches(data, "tui.select.cancel") || data === "\x1b") {
+      this.done(undefined);
+      return;
+    }
+    if (this.keybindings.matches(data, "tui.select.up")) {
+      this.move(-1);
+      return;
+    }
+    if (this.keybindings.matches(data, "tui.select.down")) {
+      this.move(+1);
+      return;
+    }
+    // Left/right cycle sections. The Keybindings type only has up/down, so we
+    // match the raw CSI arrow-key sequences directly. Some terminals emit
+    // SS3 ("\x1bOD"/"\x1bOC") instead — fall back to those too.
+    if (data === "\x1b[D" || data === "\x1bOD") {
+      this.switchSection(-1);
+      return;
+    }
+    if (data === "\x1b[C" || data === "\x1bOC") {
+      this.switchSection(+1);
+      return;
+    }
+    if (data === "\t") {
+      this.switchSection(+1);
+      return;
+    }
+    if (data === "\x1b[Z") {
+      this.switchSection(-1);
+      return;
+    }
+  }
+
+  invalidate(): void {
+    this.cachedWidth = undefined;
+    this.cachedLines = undefined;
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-goal-list-loop-audit",
-  "version": "0.27.9",
+  "version": "0.28.1",
   "description": "Goal. Loop. Audit. Done. \u2014 a pi-coding-agent extension that supervises long-running work, with isolated auditor on each completion. Beat bamboozling by design: the auditor runs in a fresh session with no extensions, no skills, no editor \u2014 only the read tools needed to verify your goal.",
   "license": "MIT",
   "author": "dracon",

package/schemas/goal.schema.json

@@ -46,6 +46,8 @@
     "stopReason": { "type": "string" },
     "pauseReason": { "type": "string" },
     "pauseSuggestedAction": { "type": "string" },
+    "interruptedAt": { "type": "string" },
+    "interruptedReason": { "type": "string" },
     "activePath": { "type": "string" },
     "archivedPath": { "type": "string" },
     "usage": {