pi-goal-list-loop-audit 0.28.5 → 0.28.6

package/extensions/goal-loop-core.ts

@@ -498,10 +498,60 @@ export function ensureDirs(cwd: string): void {
   fs.mkdirSync(archiveDir(cwd), { recursive: true });
 }
 
+// =================================================================
+// Persistence degradation (v0.28.6, audit E1)
+// =================================================================
+// A disk failure (ENOSPC, EACCES, a wedged mount) used to THROW out of
+// appendLedger/writeGoalMd mid-handler — killing the orchestrator turn and
+// silently diverging RAM from disk. Now every persistence step runs
+// through runPersistStep: failures are caught, the session-wide degraded
+// flag latches (the TUI shows it; the first failure notifies loudly), RAM
+// state stays authoritative, and the next SUCCESSFUL step auto-clears the
+// flag (self-healing — the "dirty" marker that write-then-mutate ordering
+// cannot otherwise provide).
+
+export interface PersistenceFailure {
+  what: string;
+  error: string;
+  at: string;
+}
+
+let persistenceDegraded = false;
+let lastFailure: PersistenceFailure | null = null;
+
+export function isPersistenceDegraded(): boolean {
+  return persistenceDegraded;
+}
+
+export function lastPersistenceFailure(): PersistenceFailure | null {
+  return lastFailure;
+}
+
+/** Run one persistence step. On failure: latch the degraded flag, remember
+ * the error, return undefined (NEVER throw into an orchestrator handler).
+ * On success: clear the flag — a landing write means the disk is back. */
+export function runPersistStep<T>(what: string, fn: () => T): T | undefined {
+  try {
+    const out = fn();
+    if (persistenceDegraded) {
+      persistenceDegraded = false;
+      lastFailure = null;
+    }
+    return out;
+  } catch (err) {
+    persistenceDegraded = true;
+    lastFailure = { what, error: err instanceof Error ? err.message : String(err), at: new Date().toISOString() };
+    return undefined;
+  }
+}
+
 export function readState(cwd: string): State {
   const file = ledgerPath(cwd);
-  if (!fs.existsSync(file)) return { ...DEFAULT_STATE };
-  const lines = fs.readFileSync(file, "utf-8").split("\n").filter(Boolean);
+  // v0.28.6 (E1): an unreadable ledger (EACCES, EIO) degrades loudly
+  // instead of throwing out of session_start.
+  const raw = runPersistStep("readState", () => (fs.existsSync(file) ? fs.readFileSync(file, "utf-8") : ""));
+  if (raw === undefined || raw === "") return { ...DEFAULT_STATE };
+  const lines = raw.split("\n").filter(Boolean);
   if (lines.length === 0) return { ...DEFAULT_STATE };
   let parsed: Partial<State> = {};
   for (const line of lines) {
@@ -509,7 +559,8 @@ export function readState(cwd: string): State {
       const evt = JSON.parse(line);
       if (evt.type === "state") parsed = { ...parsed, ...evt.value };
     } catch {
-      // skip malformed lines
+      // skip malformed lines — a truncated trailing line (mid-write kill)
+      // must not lose the rest of the state
     }
   }
   return {
@@ -520,16 +571,23 @@ export function readState(cwd: string): State {
 }
 
 export function appendLedger(cwd: string, type: string, value: unknown): void {
-  ensureDirs(cwd);
-  const line = JSON.stringify({ type, value, at: new Date().toISOString() });
-  fs.appendFileSync(ledgerPath(cwd), line + "\n");
+  // v0.28.6 (E1): guarded — a disk failure degrades loudly, never throws
+  // into an orchestrator handler.
+  runPersistStep("appendLedger", () => {
+    ensureDirs(cwd);
+    const line = JSON.stringify({ type, value, at: new Date().toISOString() });
+    fs.appendFileSync(ledgerPath(cwd), line + "\n");
+  });
 }
 
 export function writeGoalMd(cwd: string, goal: Goal): string {
-  ensureDirs(cwd);
   const file = goalMdPath(cwd, goal.id);
-  const md = renderGoalMarkdown(goal);
-  fs.writeFileSync(file, md);
+  runPersistStep("writeGoalMd", () => {
+    ensureDirs(cwd);
+    fs.writeFileSync(file, renderGoalMarkdown(goal));
+  });
+  // Return the intended path even on failure so activePath stays sane —
+  // the degraded flag carries the truth that the write did not land.
   return file;
 }
 

package/extensions/goal-loop-display.ts

@@ -11,6 +11,7 @@
  */
 
 import type { Goal, State } from "./goal-loop-core.js";
+import { isPersistenceDegraded, lastPersistenceFailure } from "./goal-loop-core.js";
 import type { LoopState } from "./goal-loop-forever.js";
 
 // ---- formatters ----
@@ -185,6 +186,17 @@ function countTotal(g: Goal): number {
  * Returns undefined when nothing is worth showing.
  */
 export function buildWidgetLines(state: State, audit?: AuditDisplayProgress | null, now = Date.now(), theme?: DisplayTheme, width?: number, extras?: { stalls?: number }): string[] | undefined {
+  const inner = buildWidgetLinesInner(state, audit, now, theme, width, extras);
+  // v0.28.6 (E1): a persistence failure outranks everything — first line,
+  // on every render, until a write lands again.
+  if (inner && isPersistenceDegraded()) {
+    const err = lastPersistenceFailure();
+    return [paint(theme, "error", `⚠ persistence degraded — .pi-glla writes failing (${truncate(err?.error ?? "disk error", 40)}); state in RAM`), ...inner];
+  }
+  return inner;
+}
+
+function buildWidgetLinesInner(state: State, audit?: AuditDisplayProgress | null, now = Date.now(), theme?: DisplayTheme, width?: number, extras?: { stalls?: number }): string[] | undefined {
   if (state.loop?.active) return loopLines(state.loop, now, theme, width, extras);
   const g = state.goal;
   if (!g) return undefined;

package/extensions/loops/goal.ts

@@ -85,6 +85,9 @@ import {
   statusLabel,
   writeGoalMd,
   missingGllaTools,
+  runPersistStep,
+  isPersistenceDegraded,
+  lastPersistenceFailure,
 } from "../goal-loop-core.js";
 import {
   LENGTH_CONTINUE_MAX,
@@ -740,9 +743,29 @@ function createGoal(objective: string, ctx: ExtensionContext, policy: "goal" | "
 
 function persistState(ctx: ExtensionContext): void {
   appendLedger(ctx.cwd, "state", { goal: state.goal, list: state.list ?? [], loop: state.loop ?? null });
+  notifyPersistenceState(ctx); // v0.28.6 (E1): loud on the first failure, all-clear on recovery
   refreshUI(ctx); // every state transition flows through here → the TUI is always current
 }
 
+// v0.28.6 (E1): persistence-degradation notify — once per failure streak,
+// once per recovery. The TUI flag (buildWidgetLines) carries the standing
+// state; these notifies are the LOUD part.
+let persistenceDegradedNotified = false;
+function notifyPersistenceState(ctx: ExtensionContext): void {
+  if (isPersistenceDegraded() && !persistenceDegradedNotified) {
+    persistenceDegradedNotified = true;
+    const err = lastPersistenceFailure();
+    ctx.ui.notify(
+      `⚠ Persistence degraded: ${err?.what ?? "disk write"} failed (${(err?.error ?? "unknown").slice(0, 80)}). State lives in RAM and re-syncs on the next successful write — .pi-glla may be missing recent entries. Fix the disk (space/permissions) and it self-heals.`,
+      "warning",
+    );
+    notifyExternal(ctx, "pi-goal-list-loop-audit: persistence degraded — .pi-glla writes failing.");
+  } else if (!isPersistenceDegraded() && persistenceDegradedNotified) {
+    persistenceDegradedNotified = false;
+    ctx.ui.notify("Persistence recovered — .pi-glla writes are landing again.", "info");
+  }
+}
+
 function setGoal(goal: Goal, ctx: ExtensionContext): void {
   state = { goal, list: state.list ?? [] }; // preserve the list!
   const file = writeGoalMd(ctx.cwd, goal);
@@ -765,9 +788,16 @@ function archiveCurrentGoal(ctx: ExtensionContext, status: Status, stopReason?:
   ensureDirs(ctx.cwd);
   const target = archivedGoalPath(ctx.cwd, goal.id);
   const md = renderGoalMarkdown({ ...goal, status, stopReason });
-  fs.writeFileSync(target, md);
-  // Remove active md file
-  try { fs.unlinkSync(goalMdPath(ctx.cwd, goal.id)); } catch {}
+  // v0.28.6 (E1): guarded — and the active md is only removed when the
+  // archive actually LANDED (degraded mode must not destroy the only copy).
+  const archived = runPersistStep("archiveCurrentGoal", () => {
+    ensureDirs(ctx.cwd);
+    fs.writeFileSync(target, md);
+    return true;
+  }) === true;
+  if (archived) {
+    try { fs.unlinkSync(goalMdPath(ctx.cwd, goal.id)); } catch {}
+  }
   state = { goal: { ...goal, status, archivedPath: path.relative(ctx.cwd, target) || target, stopReason }, list: state.list ?? [] };
   appendLedger(ctx.cwd, "goal_archived", { goalId: goal.id, status, stopReason });
   persistState(ctx);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-goal-list-loop-audit",
-  "version": "0.28.5",
+  "version": "0.28.6",
   "description": "Goal. Loop. Audit. Done. \u2014 a pi-coding-agent extension that supervises long-running work, with isolated auditor on each completion. Beat bamboozling by design: the auditor runs in a fresh session with no extensions, no skills, no editor \u2014 only the read tools needed to verify your goal.",
   "license": "MIT",
   "author": "dracon",