pi-goal-list-loop-audit 0.29.11 → 0.29.13

package/extensions/goal-loop-core.ts

@@ -1045,10 +1045,15 @@ export function shouldSuppressHeartbeatForRecentShip(args: {
 /** Best-effort "when did work last ship" for a repo: newest of the HEAD
  * commit time and the .pi-glla state file mtime. Null when unknown. */
 /** v0.26.7: pi's exact stale-runtime error signature — thrown by every
- * runtime-bound method after pi invalidates the extension on session
- * replacement (newSession/fork/switchSession/reload; compaction reaches
- * the same teardown in pi 0.82.x). See dist/core/extensions/loader.js
- * createExtensionRuntime().invalidate. */
+ * runtime-bound method after pi invalidates the extension. v0.29.12 source
+ * audit (pi 0.83.0 dist): the ONLY invalidate() caller is AgentSession
+ * .dispose(), reachable solely via session replacement (newSession/
+ * switchSession/fork/quit). COMPACTION NEVER DISPOSES — manual, auto, and
+ * overflow compaction all rebuild context in place. Field note 2026-07-30:
+ * 10 stale events in 4 days in endless-td, repeatedly ~3 min after
+ * compactions with NO new session file and zombie command handlers still
+ * answering — a replacement that disposed but never re-ran factories (or
+ * a same-file switchSession); the disposing path is unidentified pi-side. */
 export function isStaleApiError(err: unknown): boolean {
   return err instanceof Error && err.message.includes("stale after session replacement");
 }

package/extensions/goal-loop-display.ts

@@ -177,7 +177,7 @@ export function buildStatusText(state: State, audit?: AuditDisplayProgress | nul
     // v0.29.11: the fresh session HOLDS it (hold-everything restore gate;
     // autoresume=on resumes for you) — name the verb, don't promise auto.
     if (g.interruptedAt) {
-      return `glla: ${g.policy} ${paint(theme, "error", "⚠ interrupted — stale handle · restart pi → /glla resume")}${heldSuffix}`;
+      return `glla: ${g.policy} ${paint(theme, "error", "⚠ interrupted — stale handle · /reload → /glla resume")}${heldSuffix}`;
     }
     // v0.24.7: list policy gets its own wording — a queue item is not a goal.
     // v0.28.11 (U10): goal policy joins it — "list 29" read as a command

package/extensions/goal-settings.ts

@@ -58,6 +58,11 @@ export interface Settings {
   /** Consecutive stuck interventions before a loop stops (default 5,
    * 10 under aggressiveMode). */
   stuckMaxInterventions?: number;
+  /** v0.29.13: on a stale-handle terminal, inject /reload into our own
+   * tmux pane (keystroke self-heal; pi walls ctx.reload() behind
+   * assertActive). Default true; only acts when TMUX and TMUX_PANE are
+   * set — pi outside tmux just gets the manual warning. */
+  autoReloadOnStale?: boolean;
   /** v0.26.1: consecutive heartbeat refires without a real turn before
    * the goal pauses / loop stops (default 5; 0 = never escalate). */
   stallEscalationRefires?: number;
@@ -186,6 +191,7 @@ export const SETTINGS_KEYS: Array<keyof Settings> = [
   "quotaRetryMinutes",
   "stuckMaxInterventions",
   "stallEscalationRefires",
+  "autoReloadOnStale",
   "stallShortWords",
   "stallSimilarityThreshold",
   "postaudit",

package/extensions/loops/goal.ts

@@ -15,6 +15,7 @@
  */
 
 import * as fs from "node:fs";
+import { exec } from "node:child_process";
 import * as os from "node:os";
 import * as path from "node:path";
 
@@ -219,7 +220,7 @@ function goStaleTerminal(ctx: ExtensionContext, where: string): void {
   if (extensionApiStale) return; // already terminal — don't re-spam
   extensionApiStale = true;
   appendLedger(ctx.cwd, "extension_api_stale", { where, kind: isLoopActive() ? "loop" : "goal" });
-  const guidance = "pi invalidated this session's extension handle (session replacement — compaction triggers it in pi 0.82.x). Sends can never land in this process. Restart pi (or reload extensions) — the goal/loop holds on the fresh session: /glla resume continues it (autoresume=on resumes for you).";
+  const guidance = "pi invalidated this session's extension handle (session replacement — the session was disposed and this process's sends can never land). Run /reload — extensions rebuild IN PLACE, no pi restart needed — then /glla resume (autoresume=on resumes for you). Restart pi only if /reload itself fails.";
   if (isLoopActive()) {
     clearLoopTimer();
     state.loop = { ...state.loop!, active: false, stopReason: `extension api stale: ${guidance}` };
@@ -229,6 +230,29 @@ function goStaleTerminal(ctx: ExtensionContext, where: string): void {
   }
   ctx.ui.notify(`glla: ${guidance}`, "warning");
   notifyExternal(ctx, `glla: extension api stale — restart pi. (${where})`);
+  attemptTmuxAutoReload(ctx, where);
+}
+
+/** v0.29.13: automatic recovery — the zombie handle can't call ctx.reload()
+ * (pi walls EVERY runtime method behind assertActive), but fs/child_process
+ * are extension-side and still work. When pi runs inside tmux (this rig's
+ * shape), inject /reload as keystrokes into our own pane: pi rebuilds the
+ * extension runtime in place, the fresh instance loads .pi-glla state and
+ * holds (autoresume=on resumes for you). Opt out: autoReloadOnStale=false.
+ * Best-effort: the manual warning already fired, so failures cost nothing. */
+function attemptTmuxAutoReload(ctx: ExtensionContext, where: string): void {
+  try {
+    if (loadSettings(ctx.cwd).autoReloadOnStale === false) return;
+    const pane = process.env.TMUX_PANE;
+    if (!process.env.TMUX || !pane || !/^%\d+$/.test(pane)) return;
+    appendLedger(ctx.cwd, "auto_reload_injected", { where, pane });
+    ctx.ui.notify("glla: injecting /reload into this pane via tmux — extensions rebuild in place and the fresh instance holds state. /glla resume after (automatic with autoresume=on).", "info");
+    // Escape dismisses any overlay; the dead session sits at an empty prompt.
+    const cmd = `tmux send-keys -t ${pane} Escape && sleep 0.3 && tmux send-keys -t ${pane} -l '/reload' && tmux send-keys -t ${pane} Enter`;
+    exec(cmd, () => { /* best-effort */ });
+  } catch {
+    /* never let recovery take the warning path down */
+  }
 }
 
 /** TEST-ONLY hook (tests/harness): the stale flag is process-terminal in
@@ -260,7 +284,7 @@ function warnIfStaleAtEntry(ctx: ExtensionContext, what: string): boolean {
   if (!probeExtensionApiStale()) return false;
   appendLedger(ctx.cwd, "extension_api_stale", { where: `entry probe (${what})` });
   ctx.ui.notify(
-    `glla: this session's extension handle is stale (pi session replacement) — ${what} can't send continuations in this process. State is safe in .pi-glla/ — restart pi, then /glla resume (autoresume=on resumes for you).`,
+    `glla: this session's extension handle is stale (pi session replacement) — ${what} can't send continuations in this process. State is safe in .pi-glla/ — run /reload (extensions rebuild in place), then /glla resume. Restart pi only if /reload fails.`,
     "warning",
   );
   return true;
@@ -4503,6 +4527,10 @@ async function cmdGllaWipe(ctx: ExtensionContext): Promise<void> {
  * genuinely differ per type (tweak/finish/next/decide/refine) stay typed.
  */
 async function cmdGllaResume(ctx: ExtensionContext): Promise<void> {
+  // v0.29.12: a zombie instance (handle dead after session replacement)
+  // used to answer "Nothing to resume" — the resume path must name the
+  // real recovery (/reload rebuilds extensions in place), not mislead.
+  if (warnIfStaleAtEntry(ctx, "/glla resume")) return;
   const g = state.goal;
   const goalResumable = g && g.status === "paused";
   const loopResumable = state.loop && !state.loop.active && state.loop.stopReason === HELD_ON_RESTORE;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-goal-list-loop-audit",
-  "version": "0.29.11",
+  "version": "0.29.13",
   "description": "Goal. Loop. Audit. Done. \u2014 a pi-coding-agent extension that supervises long-running work, with isolated auditor on each completion. Beat bamboozling by design: the auditor runs in a fresh session with no extensions, no skills, no editor \u2014 only the read tools needed to verify your goal.",
   "license": "MIT",
   "author": "dracon",