pi-goal-list-loop-audit 0.34.16 → 0.34.18

package/extensions/loops/goal.ts

@@ -583,6 +583,11 @@ let lastCtx: ExtensionContext | null = null;
 // timer or late event that reaches the old module must stand down until the
 // fresh session_start rebinds it.
 let sessionHandoffPending = false;
+// v0.34.18: pi's initial `session_start` fires before interactive mode
+// renders the selected transcript. A plain `pi` startup is also a fresh,
+// empty session; do not let project-scoped autoResume launch work into that
+// placeholder before the user has loaded a real session.
+let initialSessionLoadPending = false;
 const sessionTimeouts = new Set<NodeJS.Timeout>();
 // v0.23.8: the session that OWNS the loop (its sessionManager). Subagent
 // sessions (pi-subagents binds extensions there too) fire our handlers
@@ -590,6 +595,32 @@ const sessionTimeouts = new Set<NodeJS.Timeout>();
 // subagent ctx would silently kill the heartbeat/wedge machinery).
 let ownerSession: unknown = null;
 
+function sessionHasConversation(ctx: ExtensionContext): boolean | undefined {
+  try {
+    const manager = ctx.sessionManager as unknown as {
+      buildSessionContext?: () => { messages?: unknown[] };
+    };
+    if (typeof manager.buildSessionContext !== "function") return undefined;
+    return (manager.buildSessionContext().messages?.length ?? 0) > 0;
+  } catch {
+    // Older pi contexts and test doubles may not expose the session reader;
+    // preserve their existing behavior rather than guessing that they are blank.
+    return undefined;
+  }
+}
+
+function isBlankInitialStartup(ctx: ExtensionContext, reason: string): boolean {
+  if (reason !== "startup" && reason !== "unknown") return false;
+  return sessionHasConversation(ctx) === false;
+}
+
+function releaseInitialSessionLoadBarrier(): void {
+  initialSessionLoadPending = false;
+  // The factory starts the heartbeat, but a future pi/context may not. This
+  // is idempotent and makes an explicit /goal resume or /loop start usable.
+  startHeartbeat();
+}
+
 function rememberCtx(ctx: ExtensionContext): void {
   let ownerLive = false;
   if (ownerSession && lastCtx) {
@@ -927,7 +958,7 @@ function escalateStallNow(ctx: ExtensionContext, threshold: number): boolean {
 }
 
 function heartbeatTick(): void {
-  if (zombieStoodDown) return; // v0.30.0: a superseded instance stays silent forever
+  if (zombieStoodDown || initialSessionLoadPending) return; // blank startup waits for pi to bind a real session
   const ctx = freshCtx();
   if (!ctx) return;
   let idle = false;
@@ -1191,6 +1222,7 @@ function scheduleSessionTimeout(callback: () => void, delayMs: number): NodeJS.T
 
 function clearSessionOwnedTimers(): void {
   sessionHandoffPending = true;
+  initialSessionLoadPending = false;
   clearContinuationTimer();
   clearLoopTimer();
   if (queueStuckProbe) { clearTimeout(queueStuckProbe); queueStuckProbe = null; }
@@ -1208,7 +1240,7 @@ function isActionableGoal(): boolean {
 }
 
 function freshCtx(): ExtensionContext | null {
-  if (sessionHandoffPending) return null;
+  if (sessionHandoffPending || initialSessionLoadPending) return null;
   // A captured ctx throws "stale" after session replacement. Probe cheaply;
   // on stale, drop it and wait for the next event to hand us a fresh one.
   if (!lastCtx) return null;
@@ -1253,7 +1285,7 @@ function armQueueStuckProbe(sentAt: number): void {
 }
 
 function scheduleContinuation(ctx: ExtensionContext, force = false, delayMs?: number): void {
-  if (sessionHandoffPending) return;
+  if (sessionHandoffPending || initialSessionLoadPending) return;
   abortedStandDown = false; // v0.29.5: any explicit schedule ends the stand-down
   if (!isActionableGoal()) return;
   rememberCtx(ctx);
@@ -1271,7 +1303,7 @@ function scheduleContinuation(ctx: ExtensionContext, force = false, delayMs?: nu
 }
 
 function sendContinuation(goalId: string): void {
-  if (sessionHandoffPending) return;
+  if (sessionHandoffPending || initialSessionLoadPending) return;
   continuationTimer = null;
   continuationScheduledFor = null;
   if (!isActionableGoal()) return;
@@ -1321,7 +1353,7 @@ function sendContinuation(goalId: string): void {
 // what closes the turn: complete_goal if done, pause_goal if blocked, a tool
 // call otherwise. display: true — the user should see the warning too.
 function sendStallEscalation(ctx: ExtensionContext, nudges: number): void {
-  if (sessionHandoffPending || !extensionApi || extensionApiStale) return;
+  if (sessionHandoffPending || initialSessionLoadPending || !extensionApi || extensionApiStale) return;
   const remaining = HEARTBEAT_MAX_NUDGES - nudges;
   const text = [
     `[STALL WARNING ${nudges}/${HEARTBEAT_MAX_NUDGES}] The last turn produced no tool calls.`,
@@ -1343,7 +1375,7 @@ function sendStallEscalation(ctx: ExtensionContext, nudges: number): void {
 // sendContinuation (stale api = terminal), independent of goal state —
 // plain sessions truncate too.
 function sendLengthContinue(ctx: ExtensionContext, consecutive: number): void {
-  if (sessionHandoffPending || !extensionApi || extensionApiStale) return;
+  if (sessionHandoffPending || initialSessionLoadPending || !extensionApi || extensionApiStale) return;
   try {
     extensionApi.sendMessage({
       customType: GOAL_EVENT_ENTRY,
@@ -1913,6 +1945,9 @@ function listQueue(): NonNullable<State["list"]> {
 }
 
 function activateNextListItem(ctx: ExtensionContext, n = 1): boolean {
+  // An explicit list activation is user consent even when pi initially
+  // reported a blank startup context; automatic restore never reaches here.
+  releaseInitialSessionLoadBarrier();
   // v0.28.14: one-active-thing choke point — NO call site (session_start,
   // completion cascade, /list next, list_activate, list-draft auto-activate)
   // may activate a list item over a live loop, present or future.
@@ -2100,6 +2135,7 @@ async function cmdGoal(args: string, ctx: ExtensionContext): Promise<void> {
 // =================================================================
 
 async function cmdSet(args: string, ctx: ExtensionContext, skipDraft = false): Promise<void> {
+  releaseInitialSessionLoadBarrier();
   // v0.28.1 (S3): probe at the creation entry — no "created — starting now"
   // lie in a doomed process. (The draft path's seed send has its own loud
   // stale handling — E6.)
@@ -2180,6 +2216,7 @@ async function cmdPause(ctx: ExtensionContext): Promise<void> {
 }
 
 async function cmdResume(ctx: ExtensionContext): Promise<void> {
+  releaseInitialSessionLoadBarrier();
   // v0.34.3: /goal resume on an ACTIVE-but-idle goal re-kicks its
   // continuation (was: silent return — the user got NOTHING while the
   // widget said "active"). One-active-thing still holds: an active loop
@@ -2776,6 +2813,9 @@ function probeAutoNotify(ctx: ExtensionContext): void {
 
 function notifyExternal(ctx: ExtensionContext, message: string): void {
   try {
+    // A stale or handoff-bound runtime has no valid pi exec API. The TUI
+    // warning may still be best-effort, but never call the old pi handle.
+    if (sessionHandoffPending || extensionApiStale) return;
     const settings = loadSettings(ctx.cwd);
     if (settings.notifyCmd === "off" || !extensionApi) return;
     const cmd = settings.notifyCmd ?? autoNotifyCmd;
@@ -2870,7 +2910,7 @@ function loopPrompt(loop: LoopState, regressionNote: string, strategyNote: strin
 }
 
 function scheduleLoopTick(ctx: ExtensionContext): void {
-  if (sessionHandoffPending || !isLoopActive()) return;
+  if (sessionHandoffPending || initialSessionLoadPending || !isLoopActive()) return;
   rememberCtx(ctx);
   clearLoopTimer();
   let delay = 0;
@@ -2883,7 +2923,7 @@ function scheduleLoopTick(ctx: ExtensionContext): void {
 }
 
 function sendLoopTurn(): void {
-  if (sessionHandoffPending) return;
+  if (sessionHandoffPending || initialSessionLoadPending) return;
   loopTimer = null;
   if (!isLoopActive() || !extensionApi) return;
   const ctx = freshCtx();
@@ -3252,6 +3292,7 @@ interface LoopConfig {
 
 /** Shared loop-start path: /loop start AND propose_loop_draft (after Confirm). */
 async function startLoopFromConfig(ctx: ExtensionContext, cfg: LoopConfig): Promise<boolean> {
+  releaseInitialSessionLoadBarrier();
   // branch=1 mode: scratch branch ONLY. Refuse on non-git or dirty tree —
   // we never mix uncommitted user work into the loop's branch.
   let branchName: string | undefined;
@@ -3340,6 +3381,7 @@ async function cmdLoop(args: string, ctx: ExtensionContext): Promise<void> {
   const rest = args.trim().slice(sub.length).trim();
 
   if (!sub || sub === "resume") {
+    releaseInitialSessionLoadBarrier();
     // /loop with no args (or /loop resume, v0.28.22) → resume a held loop
     // if one is waiting; otherwise draft the loop config (metric design is
     // the whole game for a long-running loop; never start one blind).
@@ -4279,6 +4321,9 @@ function registerAgentTools(pi: any, ctx: ExtensionContext): void {
       const confirmedTarget = draftingTarget;
       draftingTarget = null;
       const full = p.objective.trim() + (normContract ? `\nDone when:\n${normContract}` : "");
+      // The user has just confirmed this activation; release the blank-start
+      // barrier before the direct goal path schedules its first continuation.
+      releaseInitialSessionLoadBarrier();
       // v0.28.14: one-active-thing — no goal/list activation over a live loop.
       if (isLoopActive()) {
         return { content: [{ type: "text", text: "A loop is active — one active thing at a time. The user must /loop stop it before a goal or list item can activate; do not re-propose until then." }], details: {} };
@@ -5485,6 +5530,7 @@ async function cmdGllaResume(ctx: ExtensionContext): Promise<void> {
   // used to answer "Nothing to resume" — the resume path must name the
   // real recovery (/reload rebuilds extensions in place), not mislead.
   if (warnIfStaleAtEntry(ctx, "/glla resume")) return;
+  releaseInitialSessionLoadBarrier();
   const g = state.goal;
   const goalResumable = g && g.status === "paused";
   const loopResumable = state.loop && !state.loop.active && state.loop.stopReason === HELD_ON_RESTORE;
@@ -6325,6 +6371,8 @@ export default function (pi: ExtensionAPI): void {
     if (isForeignCtx(ctx)) return;
     extensionApi = pi;
     sessionHandoffPending = false;
+    const startReason = typeof event?.reason === "string" ? event.reason : "unknown";
+    initialSessionLoadPending = isBlankInitialStartup(ctx, startReason);
     rememberCtx(ctx);
     startHeartbeat();
     startUITicker();
@@ -6340,7 +6388,6 @@ export default function (pi: ExtensionAPI): void {
     staleTerminalDone = false; // v0.33.1: a rebound session must be able to go terminal AGAIN (was: one-shot for the process lifetime)
     postCompactResumeOwed = false; // v0.33.1: a compact from a previous session must not resync THIS one
     postCompactResyncPending = false;
-    const startReason = typeof event?.reason === "string" ? event.reason : "unknown";
     appendLedger(ctx.cwd, "session_rebound", { reason: startReason });
     if (extensionApiStale) {
       extensionApiStale = false; // fresh ctx delivered — re-probe
@@ -6394,6 +6441,21 @@ export default function (pi: ExtensionAPI): void {
     } catch (err) {
       ctx.ui.notify(`glla subagent override sync failed: ${err instanceof Error ? err.message : String(err)}`, "warning");
     }
+    // Consume ownership markers before the startup barrier so a later loaded
+    // session cannot mistake this placeholder runtime for a rebind.
+    const recoveryResume = consumeRecoveryResume(ctx.cwd);
+    const rebindResume = claimSessionOwnerAndDetectRebind(ctx.cwd);
+    if (rebindResume) appendLedger(ctx.cwd, "rebind_resume", { pid: process.pid });
+    const explicitRecovery = handoffResume || recoveryResume || rebindResume;
+    if (initialSessionLoadPending && !explicitRecovery) {
+      appendLedger(ctx.cwd, "session_waiting_for_load", { reason: startReason });
+      ctx.ui.notify("glla: pi has not loaded a conversation yet — waiting before auto-resume. Load/resume the session, or explicitly run /goal resume or /loop start.", "info");
+      return;
+    }
+    // An explicit lifecycle handoff/rebind is continuation consent even if
+    // pi reported a blank startup context. Release the barrier before any
+    // scheduling path below can observe it.
+    initialSessionLoadPending = false;
     // v0.29.6: stacked-state auto-arbitration FIRST — one live artifact
     // survives before the restore gate decides hold-vs-resume for it.
     autoArbitrateStackedState(ctx);
@@ -6450,14 +6512,8 @@ export default function (pi: ExtensionAPI): void {
       persistState(ctx);
       appendLedger(ctx.cwd, "audit_loop_target_migrated", { from: "audit-every-iteration", to: "fix-first" });
     }
-    // v0.34.15 compatibility: consume one legacy recovery marker if an older
-    // process wrote it before this lifecycle-first build landed.
-    const recoveryResume = consumeRecoveryResume(ctx.cwd);
-    // v0.34.16: a same-process lifecycle handoff is explicit continuation
-    // debt, so it resumes independently of the cold-boot autoResume setting.
-    // A same-pid owner rebind is the second same-process signal.
-    const rebindResume = claimSessionOwnerAndDetectRebind(ctx.cwd);
-    if (rebindResume) appendLedger(ctx.cwd, "rebind_resume", { pid: process.pid });
+    // v0.34.15 compatibility: the legacy recovery marker and v0.34.16
+    // rebind marker were consumed before the startup barrier above.
     if (isLoopActive()) {
       const l = state.loop!;
       if (autoResume || recoveryResume || rebindResume || handoffResume) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-goal-list-loop-audit",
-  "version": "0.34.16",
+  "version": "0.34.18",
   "description": "Mission control for autonomous pi: interview-drafted goals, an audited task queue, and forever-loops (metric, spec, project-audit) that run for hours. An isolated extension-less auditor re-verifies every completion with raw evidence; confirmed drafts, decision pauses and consent gates keep you in charge.",
   "license": "MIT",
   "author": "dracon",