pi-goal-list-loop-audit 0.28.20 → 0.28.21

package/README.md

@@ -203,7 +203,7 @@ No external watchdog plugin needed.
 /glla tokenlimit=10000000            # per-goal token budget (default: off) → GLOBAL
 /glla tokenlimit=0                   # explicitly no cap (the default)
 /glla wedgealert=30                  # hung-command alert minutes (default: 30, 0 = off)
-/glla autoresume=on                  # auto-resume goals/loops on session LOAD too (default: hold on load, auto-resume on reload/fork; off: never)
+/glla autoresume=on                  # auto-resume goals/loops on ANY session start (default: load HELD, never auto-start — explicit /goal resume, /list resume, or /loop; off: never)
 /glla auditcap=5                     # pause the goal after N consecutive auditor disapprovals (default 5, 0 = unlimited)
 /glla aggressivemode=on               # keep-going defaults: autoResume, cap 10, stuck 10, wedge off, quota auto-retry, cap→TODOs
 /glla quotaretryminutes=60            # minutes before auto-retrying a quota-exhausted auditor

package/extensions/goal-loop-core.ts

@@ -728,21 +728,21 @@ export function cloneGoal(goal: Goal): Goal {
  * setting for unattended restarts). One mechanical predicate; no heuristics.
  */
 export function shouldAutoResumeOnSessionStart(reason: string | undefined, autoResume: boolean | undefined): boolean {
-  // v0.26.9 tri-state:
-  //   true      → auto-resume on EVERY session start (unattended rigs).
+  // v0.28.21: the DEFAULT flipped to hold-everything (user directive:
+  // "load it on session load but not auto start it"). Tri-state:
+  //   true      → auto-resume on EVERY session start (unattended rigs;
+  //               /glla autoresume=on — this is the ONLY auto-resume path).
   //   false     → never auto-resume; always hold for an explicit resume.
-  //   undefined → DEFAULT: a human LOADING a session ("startup"/"new"/
-  //               "resume", or old pi reporting no reason) must not trigger
-  //               work — show the held popup, they resume explicitly.
-  //               In-session MACHINERY ("reload"/"fork") auto-resumes so an
-  //               extension reload or session fork never strands work.
+  //   undefined → DEFAULT: never auto-resume either — whatever the reason
+  //               ("startup"/"new"/"resume"/"reload"/"fork"/none), the
+  //               item is LOADED (visible, state intact) but HELD until an
+  //               explicit /goal resume, /list resume, or /loop.
   // Mid-session continuation (agent_end chains, heartbeat refires,
   // post-compaction, list/loop transitions) is not gated here at all — it
   // auto-continues forever unless a super-stuck brake (stall escalation,
   // stale-api terminal, pending-latch watchdog) stops it loudly.
-  if (autoResume === true) return true;
-  if (autoResume === false) return false;
-  return reason === "reload" || reason === "fork";
+  void reason; // retained for the signature; no reason auto-resumes by default anymore
+  return autoResume === true;
 }
 
 /**

package/extensions/loops/goal.ts

@@ -1194,9 +1194,9 @@ async function cmdSet(args: string, ctx: ExtensionContext, skipDraft = false): P
   consecutiveNoToolIterations = 0;
   if (staleEntry) {
     // v0.28.1 (S3): the goal is persisted — mark the interrupt so the next
-    // fresh session auto-resumes, and tell the truth instead of "starting now".
+    // fresh session LOADS it (held by default since v0.28.21), and tell the truth instead of "starting now".
     updateGoal({ interruptedAt: nowIso(), interruptedReason: "created in a stale session" }, ctx);
-    ctx.ui.notify(`Goal saved: ${shortObj(goal.objective)} — safe in .pi-glla/, but this stale process can't send continuations. Restart pi and it auto-resumes. (id: ${goal.id})`, "warning");
+    ctx.ui.notify(`Goal saved: ${shortObj(goal.objective)} — safe in .pi-glla/, but this stale process can't send continuations. Restart pi, then /goal resume (v0.28.21: session loads no longer auto-start by default). (id: ${goal.id})`, "warning");
     return;
   }
   ctx.ui.notify(`Goal started: ${shortObj(goal.objective)} — the auditor will verify on completion. (id: ${goal.id})`, "info");
@@ -1239,6 +1239,13 @@ async function cmdPause(ctx: ExtensionContext): Promise<void> {
 
 async function cmdResume(ctx: ExtensionContext): Promise<void> {
   if (!state.goal || state.goal.status !== "paused") return;
+  // v0.28.21: one-active-thing — the LAST unguarded activation path. A
+  // paused goal/list-item must not resume over a live loop (covers
+  // /goal resume AND /list resume, which routes here).
+  if (isLoopActive()) {
+    ctx.ui.notify("A loop is active — one active thing at a time. /loop stop it first, then resume the goal.", "warning");
+    return;
+  }
   // v0.28.1 (S1/S3): resuming in a stale session used to flip status to
   // active, claim "Resumed goal", then re-pause on the stale send failure
   // (or zombie — S1). Now: persist the resume (the next fresh session
@@ -4460,12 +4467,13 @@ export default function (pi: ExtensionAPI): void {
         );
       }
     } else if (state.goal && state.goal.status === "active" && state.goal.autoContinue) {
-      // v0.28.3 (S2 completed): an infra interrupt outranks the DEFAULT
-      // hold — the goal never chose to stop; pi killed its handle. With
-      // autoresume unset, an interrupted goal auto-resumes even on a human
-      // session load; explicit /glla autoresume=off still holds.
       const wasInterrupted = !!state.goal.interruptedAt;
-      if (autoResume || (wasInterrupted && autoResumeSetting !== false)) {
+      // v0.28.21: the 0.28.3 interrupted-goal exemption is SUPERSEDED —
+      // the default is now hold-everything on session load (user directive:
+      // "load it but not auto start it"). Interrupted goals hold like
+      // everything else; autoresume=on (unattended rigs) still auto-resumes
+      // them, and the marker is cleared only on that promised auto-resume.
+      if (autoResume) {
         // v0.28.1 (S2): clear the stale-handle interrupt marker — this IS
         // the auto-resume the marker promised.
         if (wasInterrupted) updateGoal({ interruptedAt: undefined, interruptedReason: undefined }, ctx);
@@ -4506,6 +4514,22 @@ export default function (pi: ExtensionAPI): void {
         ctx.ui.notify(`List has ${listQueue().length} item(s) waiting — /list next to activate the head.`, "info");
       }
     }
+    // v0.28.21: enforce one-active-thing at the restore boundary for DIRTY
+    // legacy states — pre-guard versions could persist an active goal AND
+    // an active/held loop; the chain above handles the loop first, and the
+    // goal would otherwise stay active and fire on agent_end. Pause it:
+    // at most one thing owns the active slot, and nothing auto-starts.
+    if (state.loop && state.goal && state.goal.status === "active") {
+      updateGoal({
+        status: "paused",
+        pauseReason: "held on session load — the loop owns the active slot (one active thing at a time)",
+        pauseSuggestedAction: "/loop to work the loop, or /loop stop then /goal resume to work the goal",
+      }, ctx);
+      ctx.ui.notify(
+        `Goal [${state.goal.id}] held — a loop also exists; one active thing at a time. /loop to resume the loop, or /loop stop then /goal resume.`,
+        "info",
+      );
+    }
     // Always paint on session load (v0.22.1): the branches above only reach
     // refreshUI via persistState, so a goal that was ALREADY paused (or any
     // state that doesn't mutate on load) rendered nothing — "can't tell if

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-goal-list-loop-audit",
-  "version": "0.28.20",
+  "version": "0.28.21",
   "description": "Goal. Loop. Audit. Done. \u2014 a pi-coding-agent extension that supervises long-running work, with isolated auditor on each completion. Beat bamboozling by design: the auditor runs in a fresh session with no extensions, no skills, no editor \u2014 only the read tools needed to verify your goal.",
   "license": "MIT",
   "author": "dracon",