pi-goal-list-loop-audit 0.28.5 → 0.28.7

package/extensions/goal-loop-core.ts

@@ -498,10 +498,60 @@ export function ensureDirs(cwd: string): void {
   fs.mkdirSync(archiveDir(cwd), { recursive: true });
 }
 
+// =================================================================
+// Persistence degradation (v0.28.6, audit E1)
+// =================================================================
+// A disk failure (ENOSPC, EACCES, a wedged mount) used to THROW out of
+// appendLedger/writeGoalMd mid-handler — killing the orchestrator turn and
+// silently diverging RAM from disk. Now every persistence step runs
+// through runPersistStep: failures are caught, the session-wide degraded
+// flag latches (the TUI shows it; the first failure notifies loudly), RAM
+// state stays authoritative, and the next SUCCESSFUL step auto-clears the
+// flag (self-healing — the "dirty" marker that write-then-mutate ordering
+// cannot otherwise provide).
+
+export interface PersistenceFailure {
+  what: string;
+  error: string;
+  at: string;
+}
+
+let persistenceDegraded = false;
+let lastFailure: PersistenceFailure | null = null;
+
+export function isPersistenceDegraded(): boolean {
+  return persistenceDegraded;
+}
+
+export function lastPersistenceFailure(): PersistenceFailure | null {
+  return lastFailure;
+}
+
+/** Run one persistence step. On failure: latch the degraded flag, remember
+ * the error, return undefined (NEVER throw into an orchestrator handler).
+ * On success: clear the flag — a landing write means the disk is back. */
+export function runPersistStep<T>(what: string, fn: () => T): T | undefined {
+  try {
+    const out = fn();
+    if (persistenceDegraded) {
+      persistenceDegraded = false;
+      lastFailure = null;
+    }
+    return out;
+  } catch (err) {
+    persistenceDegraded = true;
+    lastFailure = { what, error: err instanceof Error ? err.message : String(err), at: new Date().toISOString() };
+    return undefined;
+  }
+}
+
 export function readState(cwd: string): State {
   const file = ledgerPath(cwd);
-  if (!fs.existsSync(file)) return { ...DEFAULT_STATE };
-  const lines = fs.readFileSync(file, "utf-8").split("\n").filter(Boolean);
+  // v0.28.6 (E1): an unreadable ledger (EACCES, EIO) degrades loudly
+  // instead of throwing out of session_start.
+  const raw = runPersistStep("readState", () => (fs.existsSync(file) ? fs.readFileSync(file, "utf-8") : ""));
+  if (raw === undefined || raw === "") return { ...DEFAULT_STATE };
+  const lines = raw.split("\n").filter(Boolean);
   if (lines.length === 0) return { ...DEFAULT_STATE };
   let parsed: Partial<State> = {};
   for (const line of lines) {
@@ -509,7 +559,8 @@ export function readState(cwd: string): State {
       const evt = JSON.parse(line);
       if (evt.type === "state") parsed = { ...parsed, ...evt.value };
     } catch {
-      // skip malformed lines
+      // skip malformed lines — a truncated trailing line (mid-write kill)
+      // must not lose the rest of the state
     }
   }
   return {
@@ -520,16 +571,23 @@ export function readState(cwd: string): State {
 }
 
 export function appendLedger(cwd: string, type: string, value: unknown): void {
-  ensureDirs(cwd);
-  const line = JSON.stringify({ type, value, at: new Date().toISOString() });
-  fs.appendFileSync(ledgerPath(cwd), line + "\n");
+  // v0.28.6 (E1): guarded — a disk failure degrades loudly, never throws
+  // into an orchestrator handler.
+  runPersistStep("appendLedger", () => {
+    ensureDirs(cwd);
+    const line = JSON.stringify({ type, value, at: new Date().toISOString() });
+    fs.appendFileSync(ledgerPath(cwd), line + "\n");
+  });
 }
 
 export function writeGoalMd(cwd: string, goal: Goal): string {
-  ensureDirs(cwd);
   const file = goalMdPath(cwd, goal.id);
-  const md = renderGoalMarkdown(goal);
-  fs.writeFileSync(file, md);
+  runPersistStep("writeGoalMd", () => {
+    ensureDirs(cwd);
+    fs.writeFileSync(file, renderGoalMarkdown(goal));
+  });
+  // Return the intended path even on failure so activePath stays sane —
+  // the degraded flag carries the truth that the write did not land.
   return file;
 }
 
@@ -839,7 +897,12 @@ export interface EffectiveAggressiveSettings {
   stuckMaxInterventions: number;
   /** 0 = wedge alerts off. */
   wedgeAlertMinutes: number;
-  autoResume: boolean;
+  /** Tri-state: true = always auto-resume; false = never; undefined =
+   * DEFAULT (hold on human session loads, resume on reload/fork).
+   * v0.28.7: must stay tri-state here — coercing unset→false broke the
+   * restore gate's default branch (the 0.28.3 regression the behavioral
+   * harness caught). */
+  autoResume: boolean | undefined;
   aggressiveMode: boolean;
 }
 
@@ -860,7 +923,7 @@ export function resolveEffectiveAggressiveSettings(s: {
     stuckMaxInterventions:
       s.stuckMaxInterventions ?? (aggressiveMode ? AGGRESSIVE_STUCK_MAX_INTERVENTIONS : BASE_STUCK_MAX_INTERVENTIONS),
     wedgeAlertMinutes: s.wedgeAlertMinutes ?? (aggressiveMode ? 0 : 30),
-    autoResume: s.autoResume ?? aggressiveMode,
+    autoResume: s.autoResume ?? (aggressiveMode ? true : undefined),
   };
 }
 

package/extensions/goal-loop-display.ts

@@ -11,6 +11,7 @@
  */
 
 import type { Goal, State } from "./goal-loop-core.js";
+import { isPersistenceDegraded, lastPersistenceFailure } from "./goal-loop-core.js";
 import type { LoopState } from "./goal-loop-forever.js";
 
 // ---- formatters ----
@@ -185,6 +186,17 @@ function countTotal(g: Goal): number {
  * Returns undefined when nothing is worth showing.
  */
 export function buildWidgetLines(state: State, audit?: AuditDisplayProgress | null, now = Date.now(), theme?: DisplayTheme, width?: number, extras?: { stalls?: number }): string[] | undefined {
+  const inner = buildWidgetLinesInner(state, audit, now, theme, width, extras);
+  // v0.28.6 (E1): a persistence failure outranks everything — first line,
+  // on every render, until a write lands again.
+  if (inner && isPersistenceDegraded()) {
+    const err = lastPersistenceFailure();
+    return [paint(theme, "error", `⚠ persistence degraded — .pi-glla writes failing (${truncate(err?.error ?? "disk error", 40)}); state in RAM`), ...inner];
+  }
+  return inner;
+}
+
+function buildWidgetLinesInner(state: State, audit?: AuditDisplayProgress | null, now = Date.now(), theme?: DisplayTheme, width?: number, extras?: { stalls?: number }): string[] | undefined {
   if (state.loop?.active) return loopLines(state.loop, now, theme, width, extras);
   const g = state.goal;
   if (!g) return undefined;

package/extensions/loops/goal.ts

@@ -85,6 +85,9 @@ import {
   statusLabel,
   writeGoalMd,
   missingGllaTools,
+  runPersistStep,
+  isPersistenceDegraded,
+  lastPersistenceFailure,
 } from "../goal-loop-core.js";
 import {
   LENGTH_CONTINUE_MAX,
@@ -221,6 +224,13 @@ function goStaleTerminal(ctx: ExtensionContext, where: string): void {
   notifyExternal(ctx, `glla: extension api stale — restart pi. (${where})`);
 }
 
+/** TEST-ONLY hook (tests/harness): the stale flag is process-terminal in
+ * production — only a pi restart clears it — so behavioral tests reset it
+ * between stale scenarios. Never called by production code. */
+export function __testOnlyResetStaleFlag(): void {
+  extensionApiStale = false;
+}
+
 /** v0.28.1 (S3): side-effect-free staleness probe — getSessionName()
  * routes through pi's assertActive() and throws the stale signature iff
  * pi invalidated this factory handle (session replacement). A positive
@@ -740,9 +750,29 @@ function createGoal(objective: string, ctx: ExtensionContext, policy: "goal" | "
 
 function persistState(ctx: ExtensionContext): void {
   appendLedger(ctx.cwd, "state", { goal: state.goal, list: state.list ?? [], loop: state.loop ?? null });
+  notifyPersistenceState(ctx); // v0.28.6 (E1): loud on the first failure, all-clear on recovery
   refreshUI(ctx); // every state transition flows through here → the TUI is always current
 }
 
+// v0.28.6 (E1): persistence-degradation notify — once per failure streak,
+// once per recovery. The TUI flag (buildWidgetLines) carries the standing
+// state; these notifies are the LOUD part.
+let persistenceDegradedNotified = false;
+function notifyPersistenceState(ctx: ExtensionContext): void {
+  if (isPersistenceDegraded() && !persistenceDegradedNotified) {
+    persistenceDegradedNotified = true;
+    const err = lastPersistenceFailure();
+    ctx.ui.notify(
+      `⚠ Persistence degraded: ${err?.what ?? "disk write"} failed (${(err?.error ?? "unknown").slice(0, 80)}). State lives in RAM and re-syncs on the next successful write — .pi-glla may be missing recent entries. Fix the disk (space/permissions) and it self-heals.`,
+      "warning",
+    );
+    notifyExternal(ctx, "pi-goal-list-loop-audit: persistence degraded — .pi-glla writes failing.");
+  } else if (!isPersistenceDegraded() && persistenceDegradedNotified) {
+    persistenceDegradedNotified = false;
+    ctx.ui.notify("Persistence recovered — .pi-glla writes are landing again.", "info");
+  }
+}
+
 function setGoal(goal: Goal, ctx: ExtensionContext): void {
   state = { goal, list: state.list ?? [] }; // preserve the list!
   const file = writeGoalMd(ctx.cwd, goal);
@@ -765,9 +795,16 @@ function archiveCurrentGoal(ctx: ExtensionContext, status: Status, stopReason?:
   ensureDirs(ctx.cwd);
   const target = archivedGoalPath(ctx.cwd, goal.id);
   const md = renderGoalMarkdown({ ...goal, status, stopReason });
-  fs.writeFileSync(target, md);
-  // Remove active md file
-  try { fs.unlinkSync(goalMdPath(ctx.cwd, goal.id)); } catch {}
+  // v0.28.6 (E1): guarded — and the active md is only removed when the
+  // archive actually LANDED (degraded mode must not destroy the only copy).
+  const archived = runPersistStep("archiveCurrentGoal", () => {
+    ensureDirs(ctx.cwd);
+    fs.writeFileSync(target, md);
+    return true;
+  }) === true;
+  if (archived) {
+    try { fs.unlinkSync(goalMdPath(ctx.cwd, goal.id)); } catch {}
+  }
   state = { goal: { ...goal, status, archivedPath: path.relative(ctx.cwd, target) || target, stopReason }, list: state.list ?? [] };
   appendLedger(ctx.cwd, "goal_archived", { goalId: goal.id, status, stopReason });
   persistState(ctx);
@@ -2493,11 +2530,12 @@ function registerAgentTools(pi: any, ctx: ExtensionContext): void {
   pi.registerTool(defineTool({
     name: "complete_task",
     label: "Complete task",
-    description: "Mark a task in the active goal's task list as complete (does not stop the turn).",
-    parameters: Type.Object({
+    description: "Mark a task in the active goal's task list as complete (does not stop the turn).",    parameters: Type.Object({
       id: Type.String({ description: "Task id to complete" }),
     }),
-    async execute(_id, params) {
+    async execute(_id, params, _signal, _onUpdate, execCtx) {
+      const foreign7 = foreignToolGuard(execCtx);
+      if (foreign7) return { content: [{ type: "text", text: foreign7 }], details: {} };
       const p = params as { id: string };
       if (!state.goal || !state.goal.taskList) {
         return { content: [{ type: "text", text: "No task list in this goal." }], details: {} };
@@ -2525,7 +2563,9 @@ function registerAgentTools(pi: any, ctx: ExtensionContext): void {
       id: Type.String(),
       status: Type.Union([Type.Literal("pending"), Type.Literal("in_progress"), Type.Literal("complete")]),
     }),
-    async execute(_id, params) {
+    async execute(_id, params, _signal, _onUpdate, execCtx) {
+      const foreign8 = foreignToolGuard(execCtx);
+      if (foreign8) return { content: [{ type: "text", text: foreign8 }], details: {} };
       const p = params as { id: string; status: "pending" | "in_progress" | "complete" };
       if (!state.goal || !state.goal.taskList) {
         return { content: [{ type: "text", text: "No task list in this goal." }], details: {} };
@@ -2982,6 +3022,8 @@ function registerAgentTools(pi: any, ctx: ExtensionContext): void {
       })),
     }),
     async execute(_id, params, _signal, _onUpdate, execCtx) {
+      const foreign9 = foreignToolGuard(execCtx);
+      if (foreign9) return { content: [{ type: "text", text: foreign9 }], details: {} };
       if (!state.goal || state.goal.status !== "active") {
         return { content: [{ type: "text", text: "No active goal to break down." }], details: {} };
       }
@@ -3149,7 +3191,9 @@ async function promptSettingsMenu(
  * Same handlers as v0.27.0's if/else chain — only the trigger changed from
  * `startsWith(label)` strings to stable ids.
  */
-async function handleSettingChoice(id: string, ctx: ExtensionContext): Promise<void> {
+// v0.28.7 (T4): exported for the behavioral settings-editor tests
+// (tests/settings-editors.test.ts drives each editor class end-to-end).
+export async function handleSettingChoice(id: string, ctx: ExtensionContext): Promise<void> {
   switch (id) {
     case "autoResume": {
       const v = await ctx.ui.select("Auto-resume goals/loops on session start", [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-goal-list-loop-audit",
-  "version": "0.28.5",
+  "version": "0.28.7",
   "description": "Goal. Loop. Audit. Done. \u2014 a pi-coding-agent extension that supervises long-running work, with isolated auditor on each completion. Beat bamboozling by design: the auditor runs in a fresh session with no extensions, no skills, no editor \u2014 only the read tools needed to verify your goal.",
   "license": "MIT",
   "author": "dracon",