pi-goal-list-loop-audit 0.28.11 → 0.28.13

package/README.md

@@ -209,7 +209,7 @@ No external watchdog plugin needed.
 /glla quotaretryminutes=60            # minutes before auto-retrying a quota-exhausted auditor
 /glla stuckmax=10                     # consecutive stuck interventions before a loop stops (default 5)
 /glla auditfeedbackchars=800         # cap the executor-visible auditor report (default 0 = full report)
-/glla autoaccept=on                  # drafts ACTIVATE without the Confirm dialog (unattended rigs)
+/glla autoaccept=on                  # drafts ACTIVATE without the Confirm dialo... (every draft dialog also offers "always auto-accept" inline)unattended rigs)
 /glla project tokenlimit=500         # rare per-project override
 ```
 

package/extensions/loops/goal.ts

@@ -259,6 +259,36 @@ function warnIfStaleAtEntry(ctx: ExtensionContext, what: string): boolean {
   return true;
 }
 
+/** v0.28.12: draft-class confirm with the auto-accept escape hatch SURFACED.
+ * The polis incident: a user sat through a 14-item batch Confirm having
+ * already reviewed every item during drafting, never knowing /glla
+ * autoaccept=on existed — the Yes/No dialog never mentioned it. Now every
+ * draft dialog is a 3-choice select; the ALWAYS choice persists project
+ * autoAcceptDrafts=true and accepts. Returns "stale" when the dialog can't
+ * render (session replacement) so call sites keep their NOT-a-rejection
+ * handling; falls back to the plain confirm if select is unavailable. */
+type DraftChoice = "yes" | "no" | "stale";
+async function confirmDraft(ctx: ExtensionContext, title: string, body: string): Promise<DraftChoice> {
+  const ALWAYS = "Yes — and always auto-accept drafts (sets autoAcceptDrafts for this project)";
+  try {
+    const choice = await ctx.ui.select(`${title}\n\n${body}`, ["Yes", ALWAYS, "No"]);
+    if (choice === ALWAYS) {
+      saveSettings("project", ctx.cwd, { autoAcceptDrafts: true });
+      appendLedger(ctx.cwd, "draft_autoaccept_enabled", { via: title });
+      ctx.ui.notify("Draft auto-accept ON for this project — future draft confirms are skipped. Undo: /glla autoaccept=off.", "info");
+      return "yes";
+    }
+    return choice === "Yes" ? "yes" : "no";
+  } catch (err) {
+    if (isStaleApiError(err)) return "stale";
+    try {
+      return (await ctx.ui.confirm(title, body)) ? "yes" : "no";
+    } catch (err2) {
+      return isStaleApiError(err2) ? "stale" : "no";
+    }
+  }
+}
+
 // The most recent ExtensionContext seen from any event or command handler.
 // pi replaces sessions (newSession/fork/reload) and stale ctx throws on use,
 // so timers must never capture a ctx — they read lastCtx at fire time.
@@ -2615,10 +2645,11 @@ function registerAgentTools(pi: any, ctx: ExtensionContext): void {
           details: {},
         };
       }
+      const liveCtx = (execCtx as ExtensionContext | undefined) ?? ctx;
       // v0.14.0: the interview floor — no Confirm until the user replied.
       // v0.23.8: /glla autoaccept=on skips the floor AND the Confirm —
       // the seed carries the intent (unattended rigs). Default off.
-      const autoAccept = loadSettings(ctx.cwd).autoAcceptDrafts === true;
+      const autoAccept = loadSettings(liveCtx.cwd).autoAcceptDrafts === true;
       if (!autoAccept) {
         if (draftingUserReplies === 0) draftingBlockedProposals++;
         const block = draftProposalBlock(draftingUserReplies, draftingBlockedProposals);
@@ -2633,7 +2664,6 @@ function registerAgentTools(pi: any, ctx: ExtensionContext): void {
           details: {},
         };
       }
-      const liveCtx = (execCtx as ExtensionContext | undefined) ?? ctx;
       // v0.28.1 (S3): honest staleness warning before any Confirm attempt.
       warnIfStaleAtEntry(liveCtx, "goal drafting");
       // Multi-item list draft: one Confirm for the whole batch.
@@ -2648,21 +2678,19 @@ function registerAgentTools(pi: any, ctx: ExtensionContext): void {
           liveCtx.ui.notify(`List batch auto-accepted (/glla autoaccept=on): ${p.items.length} items${batchActivates ? " — item 1 ACTIVATES now" : ""}.`, "info");
           appendLedger(liveCtx.cwd, "draft_autoaccepted", { kind: "batch", count: p.items.length });
         } else {
-          try {
-            batchConfirmed = await liveCtx.ui.confirm(
-              "Confirm list batch",
-              `${p.items.length} items:\n${preview}${batchActivates ? "\n\n(List is empty — confirming ACTIVATES item 1 immediately as the active goal.)" : ""}`,
-            );
-          } catch (err) {
-            // v0.28.1 (T1): a stale confirm is NOT a rejection — nothing was
+          const c = await confirmDraft(
+            liveCtx,
+            "Confirm list batch",
+            `${p.items.length} items:\n${preview}${batchActivates ? "\n\n(List is empty — confirming ACTIVATES item 1 immediately as the active goal.)" : ""}`,
+          );
+          if (c === "stale") {
+            // v0.28.1 (T1): a stale dialog is NOT a rejection — nothing was
             // refused; the dialog simply can't render in a doomed process.
-            if (isStaleApiError(err)) {
-              extensionApiStale = true;
-              appendLedger(liveCtx.cwd, "extension_api_stale", { where: "batch confirm" });
-              return { content: [{ type: "text", text: "The Confirm dialog could not render: pi invalidated this session's extension handle (session replacement). This is NOT a rejection — do NOT refine or re-propose. Tell the user to restart pi, then re-run the drafting flow." }], details: {} };
-            }
-            batchConfirmed = false;
+            extensionApiStale = true;
+            appendLedger(liveCtx.cwd, "extension_api_stale", { where: "batch confirm" });
+            return { content: [{ type: "text", text: "The Confirm dialog could not render: pi invalidated this session's extension handle (session replacement). This is NOT a rejection — do NOT refine or re-propose. Tell the user to restart pi, then re-run the drafting flow." }], details: {} };
           }
+          batchConfirmed = c === "yes";
         }
         if (!batchConfirmed) {
           return {
@@ -2699,17 +2727,14 @@ function registerAgentTools(pi: any, ctx: ExtensionContext): void {
         liveCtx.ui.notify(`Draft auto-accepted (/glla autoaccept=on)${willActivate ? " — ACTIVATING now" : ""}: ${p.objective.trim().slice(0, 90)}`, "info");
         appendLedger(liveCtx.cwd, "draft_autoaccepted", { kind: isListDraft ? "list" : "goal", objective: p.objective.trim().slice(0, 200) });
       } else {
-        try {
-          confirmed = await liveCtx.ui.confirm(isListDraft ? "Confirm list item" : "Confirm goal", `${p.objective.trim()}${contractBlock}${activationNote}`);
-        } catch (err) {
-          // v0.28.1 (T1): a stale confirm is NOT "Draft rejected by the user".
-          if (isStaleApiError(err)) {
-            extensionApiStale = true;
-            appendLedger(liveCtx.cwd, "extension_api_stale", { where: "draft confirm" });
-            return { content: [{ type: "text", text: "The Confirm dialog could not render: pi invalidated this session's extension handle (session replacement). This is NOT a rejection — do NOT refine or re-propose. Tell the user to restart pi, then re-run the drafting flow." }], details: {} };
-          }
-          confirmed = false;
+        const c = await confirmDraft(liveCtx, isListDraft ? "Confirm list item" : "Confirm goal", `${p.objective.trim()}${contractBlock}${activationNote}`);
+        if (c === "stale") {
+          // v0.28.1 (T1): a stale dialog is NOT "Draft rejected by the user".
+          extensionApiStale = true;
+          appendLedger(liveCtx.cwd, "extension_api_stale", { where: "draft confirm" });
+          return { content: [{ type: "text", text: "The Confirm dialog could not render: pi invalidated this session's extension handle (session replacement). This is NOT a rejection — do NOT refine or re-propose. Tell the user to restart pi, then re-run the drafting flow." }], details: {} };
         }
+        confirmed = c === "yes";
       }
       if (!confirmed) {
         return {
@@ -2814,7 +2839,7 @@ function registerAgentTools(pi: any, ctx: ExtensionContext): void {
       // drafter path was still defaulting to 50 after v0.23.6 flipped the
       // CLI default.
       const max = p.max !== undefined && Number.isFinite(p.max) && p.max >= 0 ? Math.floor(p.max) : metricless ? 0 : 50;
-      const autoAccept = loadSettings(ctx.cwd).autoAcceptDrafts === true;
+      const autoAccept = loadSettings(liveCtx.cwd).autoAcceptDrafts === true;
       let confirmed = false;
       if (autoAccept) {
         confirmed = true;
@@ -2822,12 +2847,14 @@ function registerAgentTools(pi: any, ctx: ExtensionContext): void {
         appendLedger(liveCtx.cwd, "draft_autoaccepted", { kind: "loop", target: p.target.trim().slice(0, 200), metricless });
       } else {
         try {
-          confirmed = await liveCtx.ui.confirm(
+          const c = await confirmDraft(
+          liveCtx,
           "Confirm loop",
           metricless
             ? `Target: ${p.target.trim()}\n\nMeasure: NONE — metricless spec loop. There is NO plateau stop: the loop ends only at ${max > 0 ? `${max} iterations` : "NO iteration cap"}${typeof p.time === "number" && p.time > 0 ? ` · Time bound: ${p.time}h` : ""}${typeof p.tokens === "number" && p.tokens > 0 ? ` · Token bound: ${p.tokens.toLocaleString()}` : ""} · /loop stop.${p.branch ? "\nbranch mode: scratch branch, every iteration committed (clean tree required)" : ""}\n\nEvery iteration must make ONE real, inspectable change — cosmetic churn is the known failure mode (doorknob-polishing). Start it?`
             : `Target: ${p.target.trim()}\n\nMeasure: ${p.measureCmd}\nTest-run output: ${rawOutput.slice(0, 200)}\nParsed number: ${parsed} (${p.direction === "min" ? "lower is better" : "higher is better"})\n\nPlateau stop: ${window} non-improving iterations · Cap: ${max > 0 ? `${max} iterations` : "none (unbounded)"}${typeof p.time === "number" && p.time > 0 ? ` · Time bound: ${p.time}h` : ""}${typeof p.tokens === "number" && p.tokens > 0 ? ` · Token bound: ${p.tokens.toLocaleString()}` : ""}${p.branch ? "\nbranch mode: scratch branch (clean tree required)" : ""}\n\nThe loop never completes — it runs until one of these bounds, plateau, or /loop stop. Start it?`,
           );
+          confirmed = c === "yes";
         } catch {
           confirmed = false;
         }
@@ -2907,13 +2934,20 @@ function registerAgentTools(pi: any, ctx: ExtensionContext): void {
         }
       }
       let confirmed = false;
-      try {
-        confirmed = await liveCtx.ui.confirm(
-          "Confirm loop spec refinement",
+      if (loadSettings(liveCtx.cwd).autoAcceptDrafts === true) {
+        confirmed = true;
+        liveCtx.ui.notify("Loop spec refinement auto-accepted (/glla autoaccept=on).", "info");
+        appendLedger(liveCtx.cwd, "draft_autoaccepted", { kind: "loop-refine" });
+      } else {
+        try {
+          confirmed = (await confirmDraft(
+            liveCtx,
+            "Confirm loop spec refinement",
           `Rationale: ${p.rationale}\n\nTarget:\n  old: ${loop.target.slice(0, 120)}\n  new: ${newTarget.slice(0, 120)}\n\nMeasure:\n  old: ${loop.measureCmd}\n  new: ${newMeasure}${newMeasure !== loop.measureCmd ? `\n  test-run: ${testOutput.slice(0, 120)} → ${newBaseline}` : ""}\n\nThe loop keeps running against the refined spec (iteration ${loop.iteration} so far). Apply?`,
-        );
-      } catch {
-        confirmed = false;
+          )) === "yes";
+        } catch {
+          confirmed = false;
+        }
       }
       if (!confirmed) {
         return { content: [{ type: "text", text: "Refinement rejected by the user. The loop continues against the current spec — keep improving the metric as defined." }], details: {} };
@@ -3051,7 +3085,7 @@ function registerAgentTools(pi: any, ctx: ExtensionContext): void {
         const subs = (t.subtasks ?? []).map((s, j) => `   ${i + 1}.${j + 1} ${s}`).join("\n");
         return `${i + 1}. ${t.title}` + (subs ? `\n${subs}` : "");
       }).join("\n");
-      const autoAcceptTasks = loadSettings(ctx.cwd).autoAcceptDrafts === true;
+      const autoAcceptTasks = loadSettings(liveCtx.cwd).autoAcceptDrafts === true;
       let confirmed = false;
       if (autoAcceptTasks) {
         confirmed = true;
@@ -3059,7 +3093,7 @@ function registerAgentTools(pi: any, ctx: ExtensionContext): void {
         appendLedger(liveCtx.cwd, "draft_autoaccepted", { kind: "tasks", count: p.tasks.length });
       } else {
         try {
-          confirmed = await liveCtx.ui.confirm("Confirm task list", preview);
+          confirmed = (await confirmDraft(liveCtx, "Confirm task list", preview)) === "yes";
         } catch {
           confirmed = false;
         }
@@ -4390,6 +4424,14 @@ export default function (pi: ExtensionAPI): void {
         // them toward the stall brake paused restored goals mid-recovery.
         postRestoreGraceTurns--;
         appendLedger(ctx.cwd, "post_restore_grace", { remaining: postRestoreGraceTurns });
+      } else if (lastA?.stopReason === "error") {
+        // v0.28.13 (endless-td 429 incident 2026-07-28): provider-error
+        // turns (429 quota exhaustion, 5xx) are NOT model unproductivity —
+        // the model never got a say. Counting them tripped the brake on a
+        // healthy goal mid-CDP-capture (4 MiniMax-M3 429s → wrong
+        // "unproductive turns" pause). pi's own retry owns the backoff;
+        // the nudge counter neither increments nor resets on these turns.
+        appendLedger(ctx.cwd, "stall_nudge_exempt_error", { nudgesSoFar: heartbeatNudges });
       } else {
       const s = loadSettings(ctx.cwd);
       const shortWordsThr = s.stallShortWords ?? DEFAULT_STALL_SHORT_WORDS;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-goal-list-loop-audit",
-  "version": "0.28.11",
+  "version": "0.28.13",
   "description": "Goal. Loop. Audit. Done. \u2014 a pi-coding-agent extension that supervises long-running work, with isolated auditor on each completion. Beat bamboozling by design: the auditor runs in a fresh session with no extensions, no skills, no editor \u2014 only the read tools needed to verify your goal.",
   "license": "MIT",
   "author": "dracon",