pi-goal-list-loop-audit 0.34.18 → 0.34.19

package/extensions/goal-loop-display.ts

@@ -310,17 +310,24 @@ function heldLoopLines(l: LoopState, now: number, theme?: DisplayTheme, width?:
 function goalLines(g: Goal, state: State, audit: AuditDisplayProgress | null | undefined, now: number, theme?: DisplayTheme, width?: number, extras?: WidgetExtras): string[] {
   // Head glyph is ● (not ◆): U+25C6 renders as a color-emoji diamond in some
   // terminal fonts and ignores ANSI color; ● takes the paint everywhere.
+  const interrupted = g.status === "active" && !!g.interruptedAt;
   const icon =
-    g.status === "paused"
-      ? paint(theme, pauseIsError(g) ? "error" : "warning", "⏸")
-      : g.status === "auditing"
-        ? paint(theme, "accent", "⟡")
-        : paint(theme, "success", "●");
+    interrupted
+      ? paint(theme, "error", "⚠")
+      : g.status === "paused"
+        ? paint(theme, pauseIsError(g) ? "error" : "warning", "⏸")
+        : g.status === "auditing"
+          ? paint(theme, "accent", "⟡")
+          : paint(theme, "success", "●");
   // v0.24.7: a list item is named as such and points at /list — before,
   // the widget called it "active" and hinted "/goal status", reading as if
   // queue work were a standalone goal.
   const isList = g.policy === "list";
-  const statusWord = g.status === "active" ? paint(theme, "success", "active") : g.status;
+  const statusWord = interrupted
+    ? paint(theme, "error", "interrupted")
+    : g.status === "active"
+      ? paint(theme, "success", "active")
+      : g.status;
   // v0.33.0: slim card — status folds INTO the head line as middot segments
   // (filter(Boolean).join, the universal CLI idiom). Line 2 is the live
   // "last action · next task" line; the footer stays the hint line.
@@ -351,6 +358,12 @@ function goalLines(g: Goal, state: State, audit: AuditDisplayProgress | null | u
   const objBudget = width && width > 0 ? Math.max(16, width - 1 - 2 - 3 - visibleLen(segsText)) : 48;
   const head = `${icon} ${truncate(g.objective.replace(/\s+/g, " "), objBudget)} ${paint(theme, "dim", "·")} ${segsText}`;
   const lines = [head];
+  if (interrupted) {
+    const resumeCmd = isList ? "/list resume" : "/goal resume";
+    lines.push(`├─ ${paint(theme, "error", "host session lost — waiting for fresh session_start")}`);
+    lines.push(`└─ ${paint(theme, "warning", `/reload to rebind · ${resumeCmd} if it does not resume`)}`);
+    return lines;
+  }
   if (g.status === "auditing") {
     lines.push(`├─ auditor: ${audit?.label ?? "running"}${audit?.currentTool ? ` · ${truncate(audit.currentTool, 30)}` : ""}`);
     // v0.25.4: auditor-quiet stall — progress events stopped arriving

package/extensions/length-continue.ts

@@ -35,6 +35,48 @@ export interface LengthContinueTick {
   consecutive: number;
 }
 
+export interface ContextUsageLike {
+  tokens?: number | null;
+  contextWindow?: number;
+  percent?: number | null;
+}
+
+export interface AssistantLengthMessageLike {
+  stopReason?: string;
+  usage?: {
+    output?: number;
+  };
+}
+
+export const LENGTH_CONTINUE_CONTEXT_STARVED_PERCENT = 90;
+export const LENGTH_CONTINUE_CONTEXT_STARVED_MAX_OUTPUT = 8;
+
+/**
+ * v0.34.19: distinguish a REAL overlong assistant response from pi's
+ * context-safety clamp. Near the configured context ceiling,
+ * pi-ai's clampMaxTokensToContext() can reduce max_tokens to 1; MiniMax then
+ * returns stopReason "length" with ~1 output token. That is context
+ * starvation: auto-compaction must own recovery. Sending LENGTH_CONTINUE_TEXT
+ * here queues another 1-token request before pi's post-agent_end compaction
+ * check and delays the actual cure (field: darklord 2026-08-02, 198,116 /
+ * 198,179 total tokens of a 200,000 window, output=1 twice).
+ */
+export function isContextStarvedLengthStop(
+  message: AssistantLengthMessageLike | null | undefined,
+  contextUsage: ContextUsageLike | null | undefined,
+): boolean {
+  if (message?.stopReason !== "length") return false;
+  const output = message.usage?.output;
+  if (typeof output !== "number" || !Number.isFinite(output)) return false;
+  if (output > LENGTH_CONTINUE_CONTEXT_STARVED_MAX_OUTPUT) return false;
+  const percent = typeof contextUsage?.percent === "number"
+    ? contextUsage.percent
+    : typeof contextUsage?.tokens === "number" && typeof contextUsage?.contextWindow === "number" && contextUsage.contextWindow > 0
+      ? (contextUsage.tokens / contextUsage.contextWindow) * 100
+      : null;
+  return percent !== null && Number.isFinite(percent) && percent >= LENGTH_CONTINUE_CONTEXT_STARVED_PERCENT;
+}
+
 export function makeLengthContinueTracker(max: number = LENGTH_CONTINUE_MAX) {
   let consecutive = 0;
   let gaveUp = false;

package/extensions/loops/goal.ts

@@ -92,6 +92,7 @@ import {
 import {
   LENGTH_CONTINUE_MAX,
   LENGTH_CONTINUE_TEXT,
+  isContextStarvedLengthStop,
   resetLengthContinue,
   tickLengthContinue,
 } from "../length-continue.js";
@@ -231,6 +232,11 @@ let extensionApiStale = false;
 // path must still ledger the stale handle, stop stale work, and preserve the
 // interrupt marker so a later fresh lifecycle can restore it.
 let staleTerminalDone = false;
+// v0.34.19: delayed session-owned callbacks capture this generation. A
+// clearTimeout can race a callback already queued by Node; without a
+// generation check, an old compaction/refire callback can run after /reload
+// and schedule work against the fresh session.
+let sessionGeneration = 0;
 
 /** v0.26.7: a stale api is terminal for this process — go loudly with
  * restart guidance instead of retrying sends that can never land.
@@ -309,6 +315,10 @@ function goStaleTerminal(ctx: ExtensionContext, where: string): void {
   } else if (state.goal && state.goal.status === "active") {
     updateGoal({ interruptedAt: nowIso(), interruptedReason: `extension api stale (${where})` }, ctx);
   }
+  // The stale process loses its ticker immediately, so paint the durable
+  // interrupted state synchronously while the old UI handle can still accept
+  // updates. The next session_start paints it again from disk.
+  refreshUI(ctx);
   ctx.ui.notify(`glla: ${guidance}`, "warning");
   notifyExternal(ctx, `glla: extension api stale — waiting for a fresh session_start; restart pi normally only if no replacement arrives. (${where})`);
 }
@@ -622,6 +632,10 @@ function releaseInitialSessionLoadBarrier(): void {
 }
 
 function rememberCtx(ctx: ExtensionContext): void {
+  // Late events from a disposed session must never reclaim lastCtx after the
+  // lifecycle handoff has been declared. Only session_start clears these
+  // gates and may bind a fresh context.
+  if (sessionHandoffPending || staleTerminalDone || zombieStoodDown) return;
   let ownerLive = false;
   if (ownerSession && lastCtx) {
     try { lastCtx.isIdle(); ownerLive = true; } catch { /* owner went stale (session replaced) */ }
@@ -1210,9 +1224,19 @@ function clearContinuationTimer(): void {
 }
 
 function scheduleSessionTimeout(callback: () => void, delayMs: number): NodeJS.Timeout {
+  const generation = sessionGeneration;
   let timer: NodeJS.Timeout;
   timer = setTimeout(() => {
     sessionTimeouts.delete(timer);
+    // clearTimeout is not enough when the callback is already queued. Do not
+    // let an old session's callback re-arm work after stale/shutdown/reload.
+    if (
+      generation !== sessionGeneration ||
+      sessionHandoffPending ||
+      extensionApiStale ||
+      staleTerminalDone ||
+      zombieStoodDown
+    ) return;
     callback();
   }, delayMs);
   sessionTimeouts.add(timer);
@@ -1222,6 +1246,7 @@ function scheduleSessionTimeout(callback: () => void, delayMs: number): NodeJS.T
 
 function clearSessionOwnedTimers(): void {
   sessionHandoffPending = true;
+  sessionGeneration++;
   initialSessionLoadPending = false;
   clearContinuationTimer();
   clearLoopTimer();
@@ -1285,7 +1310,7 @@ function armQueueStuckProbe(sentAt: number): void {
 }
 
 function scheduleContinuation(ctx: ExtensionContext, force = false, delayMs?: number): void {
-  if (sessionHandoffPending || initialSessionLoadPending) return;
+  if (sessionHandoffPending || initialSessionLoadPending || extensionApiStale || staleTerminalDone || zombieStoodDown) return;
   abortedStandDown = false; // v0.29.5: any explicit schedule ends the stand-down
   if (!isActionableGoal()) return;
   rememberCtx(ctx);
@@ -1303,7 +1328,7 @@ function scheduleContinuation(ctx: ExtensionContext, force = false, delayMs?: nu
 }
 
 function sendContinuation(goalId: string): void {
-  if (sessionHandoffPending || initialSessionLoadPending) return;
+  if (sessionHandoffPending || initialSessionLoadPending || extensionApiStale || staleTerminalDone || zombieStoodDown) return;
   continuationTimer = null;
   continuationScheduledFor = null;
   if (!isActionableGoal()) return;
@@ -2910,7 +2935,7 @@ function loopPrompt(loop: LoopState, regressionNote: string, strategyNote: strin
 }
 
 function scheduleLoopTick(ctx: ExtensionContext): void {
-  if (sessionHandoffPending || initialSessionLoadPending || !isLoopActive()) return;
+  if (sessionHandoffPending || initialSessionLoadPending || extensionApiStale || staleTerminalDone || zombieStoodDown || !isLoopActive()) return;
   rememberCtx(ctx);
   clearLoopTimer();
   let delay = 0;
@@ -2923,7 +2948,7 @@ function scheduleLoopTick(ctx: ExtensionContext): void {
 }
 
 function sendLoopTurn(): void {
-  if (sessionHandoffPending || initialSessionLoadPending) return;
+  if (sessionHandoffPending || initialSessionLoadPending || extensionApiStale || staleTerminalDone || zombieStoodDown) return;
   loopTimer = null;
   if (!isLoopActive() || !extensionApi) return;
   const ctx = freshCtx();
@@ -6234,6 +6259,9 @@ export default function (pi: ExtensionAPI): void {
   // 60s heartbeat notices. Re-arm it as soon as pi settles post-compact.
   pi.on("session_compact", async (_event: any, ctx: ExtensionContext) => {
     if (isForeignCtx(ctx)) return;
+    // A late compact event can arrive after pi has already invalidated this
+    // extension. It must not reclaim the old ctx or schedule settle refires.
+    if (sessionHandoffPending || extensionApiStale || staleTerminalDone || zombieStoodDown) return;
     rememberCtx(ctx);
     if (!isSupervising()) return;
     appendLedger(ctx.cwd, "session_compact", {});
@@ -6299,6 +6327,7 @@ export default function (pi: ExtensionAPI): void {
   // v0.15.1: ask_user_question answers arrive as tool results, not chat
   // messages — count answered (non-cancelled) questionnaires as replies too.
   pi.on("tool_result", async (event: any) => {
+    if (sessionHandoffPending || extensionApiStale || staleTerminalDone || zombieStoodDown) return;
     noteToolResult(event); // v0.33.0: slim widget "last action" feed
     // v0.24.0: roll loop tool-result fingerprints (same-tool-same-result
     // detection) — recorded for ANY tool result while a loop is active.
@@ -6371,6 +6400,16 @@ export default function (pi: ExtensionAPI): void {
     if (isForeignCtx(ctx)) return;
     extensionApi = pi;
     sessionHandoffPending = false;
+    // Reset terminal ownership before rememberCtx: this is the only event
+    // allowed to bind a context after a stale/shutdown handoff.
+    staleTerminalDone = false; // v0.33.1: a rebound session can go terminal again
+    zombieStoodDown = false;
+    sessionGeneration++;
+    // Ephemeral watchdog counters belong to the old session, not the
+    // persisted goal. Reset them so a stale boundary cannot make the next
+    // fresh session inherit a false stall count.
+    heartbeatNudges = 0;
+    consecutiveStalls = 0;
     const startReason = typeof event?.reason === "string" ? event.reason : "unknown";
     initialSessionLoadPending = isBlankInitialStartup(ctx, startReason);
     rememberCtx(ctx);
@@ -6384,8 +6423,6 @@ export default function (pi: ExtensionAPI): void {
     // confirm the new handle actually works.
     writeOwnerFile(ctx.cwd);
     sessionReplacementUntil = 0;
-    zombieStoodDown = false;
-    staleTerminalDone = false; // v0.33.1: a rebound session must be able to go terminal AGAIN (was: one-shot for the process lifetime)
     postCompactResumeOwed = false; // v0.33.1: a compact from a previous session must not resync THIS one
     postCompactResyncPending = false;
     appendLedger(ctx.cwd, "session_rebound", { reason: startReason });
@@ -6605,6 +6642,10 @@ export default function (pi: ExtensionAPI): void {
   });
 
   pi.on("agent_end", async (event: any, ctx: ExtensionContext) => {
+    // A late agent_end from the disposed session is not a fresh turn. Do not
+    // account it, run length continuation, or schedule another send after a
+    // stale terminal/handoff.
+    if (sessionHandoffPending || extensionApiStale || staleTerminalDone || zombieStoodDown) return;
     rememberCtx(ctx);
     // v0.23.8: a subagent finishing must not drive the main session's
     // continuation loop.
@@ -6625,7 +6666,30 @@ export default function (pi: ExtensionAPI): void {
     const rawPriorA = assistants.length >= 2 ? assistants[assistants.length - 2] : null;
     const extractText = (m: any): string => (m && Array.isArray(m.content)) ? m.content.filter((p: any) => p.type === "text").map((p: any) => p.text).join("\n") : "";
     const lastA = rawLastA ? { stopReason: rawLastA.stopReason, text: extractText(rawLastA), priorText: extractText(rawPriorA) } : null;
-    const lc = tickLengthContinue(lastA?.stopReason === "length");
+    // v0.34.19: pi-ai clamps max_tokens to the remaining context before the
+    // provider call. At ~99% context that clamp can be 1 token, which the
+    // provider reports as stopReason "length" — but this is NOT an overlong
+    // assistant response. Extension agent_end runs BEFORE pi's own
+    // auto-compaction check (agent-session.js _handlePostAgentRun), so sending
+    // LENGTH_CONTINUE_TEXT here queues another 1-token request and delays the
+    // real cure. Defer to pi compaction; session_compact's resume debt owns
+    // the next continuation. Older pi/test doubles without getContextUsage()
+    // fail open to the legacy true-length path.
+    const contextUsage = (() => {
+      try { return typeof ctx.getContextUsage === "function" ? ctx.getContextUsage() : undefined; } catch { return undefined; }
+    })();
+    const contextStarvedLength = isContextStarvedLengthStop(rawLastA, contextUsage);
+    const lc = tickLengthContinue(lastA?.stopReason === "length" && !contextStarvedLength);
+    if (contextStarvedLength) {
+      appendLedger(ctx.cwd, "length_continue_deferred_context_full", {
+        outputTokens: rawLastA?.usage?.output,
+        contextTokens: contextUsage?.tokens ?? null,
+        contextWindow: contextUsage?.contextWindow ?? null,
+        contextPercent: contextUsage?.percent ?? null,
+      });
+      ctx.ui.notify("glla: output-token stop was context starvation (tiny output at a nearly full context) — yielding to pi auto-compaction instead of re-sending.", "info");
+      return;
+    }
     if (lc.giveUpNow) {
       ctx.ui.notify(`glla: response hit the output-token cap ${LENGTH_CONTINUE_MAX}× in a row — stepping aside. Ask the model to split the work into smaller pieces.`, "warning");
       notifyExternal(ctx, "Response truncated 3× in a row — giving up auto-continue.");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-goal-list-loop-audit",
-  "version": "0.34.18",
+  "version": "0.34.19",
   "description": "Mission control for autonomous pi: interview-drafted goals, an audited task queue, and forever-loops (metric, spec, project-audit) that run for hours. An isolated extension-less auditor re-verifies every completion with raw evidence; confirmed drafts, decision pauses and consent gates keep you in charge.",
   "license": "MIT",
   "author": "dracon",