pi-goal-list-loop-audit 0.34.57 → 0.34.80

package/README.md

@@ -263,8 +263,10 @@ limits and user aborts (`non-recoverable`), plus auditor watchdog timeouts
 (a hanging verification command will hang again — the stored claim waits for
 an explicit resume).
 A provider hint (`retry_after`/`reset_at`) is honored when it fits the
-five-hour probe budget; a week-long hint is shown and held instead of
-scheduling a hidden week-long timer. With global `autoResume=on`, pending
+five-hour probe budget; an over-budget hint (e.g. a week-long reset) never
+parks the goal — the bounded cadence owns the wait, and only the 24h horizon
+ends automatic probes (a `/goal resume`/`/list resume`/`/loop resume` then
+starts a fresh window). With global `autoResume=on`, pending
 probes survive a session reload. For continuous work, configure ordered
 **Main model backups** in `/glla` using a model from a different provider or
 billing/quota pool — another model on the same exhausted plan is not a real

package/docs/VISION-ASSIST.md

@@ -0,0 +1,73 @@
+# Vision Assist — see with mmx, not a model switch
+
+**v0.34.72** · note.md 2026-08-07: *"the agent is too eager when couldnt see it
+tried to use expensive mdoels. we need to special a vision setting where it
+called another model or cli like mmx vision to see if stuck. but not just this
+we need to specify that it cant be too eager to switch only preapproved."*
+
+## Policy
+
+The executor (pi's main agent) has no eyes. When a task needs it to **look**
+at something — a screenshot, a UI state, an error dialog, a rendered mockup —
+it must NOT switch models to get vision. The check routes to the **mmx vision
+CLI** (the `mmx-cli` skill, MiniMax VLM):
+
+```bash
+mmx vision describe --image <path-or-url> --prompt "<question>" --quiet --non-interactive
+```
+
+- The image is usually a screenshot the user already pasted into the
+  conversation (e.g. `/home/dracon/Pictures/Screenshots/...`). Pass its path
+  straight through.
+- Keep the question short and specific: *"What does this screenshot show?"*,
+  *"Is there an error dialog?"*, *"What is the terminal output?"*.
+- Reading the returned description is the agent's job — no model switch
+  needed. (Verified 2026-08-07: `mmx vision describe` returns clean JSON/text
+  with `status_code: 0`.)
+
+## The preapproval gate (model switches)
+
+A model switch is sanctioned **only when the target is preapproved** — i.e.
+NOT in the `forbiddenModels` policy:
+
+- Default forbidden list: `gpt-5.5`, `sonnet`, `opus` (matched
+  case-insensitively as a substring against the `provider/id` ref).
+- `/glla forbiddenModels=...` edits the list; `blockForbiddenModelSwitches`
+  (default on) reverts a forbidden selection to the previous model.
+- Every switch to a forbidden model is ledgered as `forbidden_model_switch`
+  (with `blocked: true|false`).
+- With vision assist on (default), the same event also appends a
+  `vision_assist` ledger entry — the routing alternative: `{ route:
+  "mmx-vision", blockedSwitch: <ref>, reason: "forbidden_model_switch" }`.
+
+Even a preapproved vision-capable model is a second choice: mmx vision is the
+default for every vision check.
+
+## The setting
+
+`visionAssist` (default **on** — opt-out):
+
+- **on** → every continuation prompt carries the `## VISION-ASSIST — SEE WITH
+  MMX, NOT A MODEL SWITCH` directive (`extensions/vision-assist.ts`
+  `VISION_ASSIST_GUIDANCE`), and a forbidden switch also records the
+  `vision_assist` routing entry.
+- **off** → no vision guidance is injected; the `forbiddenModels` gate still
+  stands (forbidden switches remain blocked/ledgered).
+
+Edit: `/glla` → Keep-going → Vision assist, or `/glla visionAssist=off`.
+
+## Implementation map
+
+| Piece | Where |
+|---|---|
+| Guidance block (single source of truth) | `extensions/vision-assist.ts` → `VISION_ASSIST_GUIDANCE` |
+| Command builder | `visionDescribeCommand(imagePath, question?)` |
+| Routing rule (pure) | `routeVisionCheck(request)` — mmx by default; forbidden target → mmx + `blockedSwitch`; preapproved target → `model-switch` allowed |
+| Ledger payload builder | `visionAssistLedger(route, request)` |
+| Continuation injection | `extensions/loops/goal.ts` `continuationPrompt()` (gated on `visionAssist !== false`) |
+| Forbidden-switch hook | `observeModelChange()` forbidden branch → `vision_assist` entry |
+| Setting | `extensions/goal-settings.ts` (default true), menu row in `extensions/settings-menu.ts`, editor + `/glla` row in `extensions/loops/goal.ts` |
+| Tests | `tests/vision-assist.test.ts` |
+
+The `vision_assist` ledger type is the audit trail: every entry says where the
+check routed and (when a switch was blocked) which model was refused.

package/extensions/confirm-draft.ts

@@ -0,0 +1,130 @@
+// pi-goal-list-loop-audit — v0.2.0
+// extensions/confirm-draft.ts
+//
+// v0.34.78 (GitHub #4): the draft-class confirm dialog as a real TUI
+// component. ctx.ui.select renders plain text with no wrapping; this
+// component renders the SAME title/body as Markdown (objective + contract
+// readable at full width) with a SelectList for the Yes / Yes-and-always /
+// No choices. Kept in its own file so tests can construct and render it
+// without dragging in the whole goal loop.
+
+import {
+  type Component,
+  Container,
+  Markdown,
+  type MarkdownTheme,
+  type SelectItem,
+  SelectList,
+  type SelectListTheme,
+  Spacer,
+  Text,
+} from "@earendil-works/pi-tui";
+import { DynamicBorder, type Theme } from "@earendil-works/pi-coding-agent";
+
+export interface ConfirmDraftFactoryDeps {
+  title: string;
+  body: string;
+  options: string[];
+}
+
+/** Structural type for the KeybindingsManager — mirrors settings-menu.ts. */
+export interface KeybindingsManagerLike {
+  matches(data: string, key: string): boolean;
+}
+
+/** Pure: the markdown rendered in the dialog. The title is the H1, the
+ * body (objective + verification contract) is the content. */
+export function buildConfirmDraftMarkdown(title: string, body: string): string {
+  return `# ${title}\n\n${body}`;
+}
+
+/** Build a MarkdownTheme from the runtime Theme's fg()/bold() primitives.
+ * Uses the theme's own md* colors so the dialog follows the active theme. */
+function markdownTheme(theme: Theme): MarkdownTheme {
+  const fg = (color: Parameters<Theme["fg"]>[0]) => (t: string) => theme.fg(color, t);
+  return {
+    heading: (t) => theme.bold(fg("mdHeading")(t)),
+    link: (t) => fg("mdLink")(t),
+    linkUrl: (t) => fg("mdLinkUrl")(t),
+    code: (t) => fg("mdCode")(t),
+    codeBlock: (t) => fg("mdCodeBlock")(t),
+    codeBlockBorder: (t) => fg("mdCodeBlockBorder")(t),
+    quote: (t) => fg("mdQuote")(t),
+    quoteBorder: (t) => fg("mdQuoteBorder")(t),
+    hr: (t) => fg("mdHr")(t),
+    listBullet: (t) => fg("mdListBullet")(t),
+    bold: (t) => theme.bold(t),
+    italic: (t) => t,
+    strikethrough: (t) => t,
+    underline: (t) => t,
+    codeBlockIndent: "  ",
+  };
+}
+
+function selectListTheme(theme: Theme): SelectListTheme {
+  return {
+    selectedPrefix: (t) => theme.fg("accent", t),
+    selectedText: (t) => theme.fg("accent", t),
+    description: (t) => theme.fg("muted", t),
+    scrollInfo: (t) => theme.fg("dim", t),
+    noMatch: (t) => theme.fg("warning", t),
+  };
+}
+
+/**
+ * The confirm dialog: DynamicBorder frame, markdown title+body, spacer, the
+ * three-choice SelectList, and a help line. Exported so tests can construct
+ * it with a fake theme and assert the rendered lines.
+ */
+export class ConfirmDraftComponent implements Component {
+  private readonly md: Markdown;
+  private readonly selectList: SelectList;
+  private readonly requestRender: () => void;
+  private readonly theme: Theme;
+  private readonly keybindings: KeybindingsManagerLike;
+
+  constructor(
+    deps: ConfirmDraftFactoryDeps,
+    requestRender: () => void,
+    theme: Theme,
+    keybindings: KeybindingsManagerLike,
+    done: (value: string | undefined) => void,
+  ) {
+    this.requestRender = requestRender;
+    this.theme = theme;
+    this.keybindings = keybindings;
+    this.md = new Markdown(buildConfirmDraftMarkdown(deps.title, deps.body), 1, 1, markdownTheme(theme));
+    const items: SelectItem[] = deps.options.map((o) => ({ value: o, label: o }));
+    this.selectList = new SelectList(items, Math.min(items.length, 10), selectListTheme(theme));
+    this.selectList.onSelect = (item) => done(item.value);
+    this.selectList.onCancel = () => done(undefined);
+  }
+
+  render(width: number): string[] {
+    const container = new Container();
+    container.addChild(new DynamicBorder((s: string) => this.theme.fg("borderAccent", s)));
+    container.addChild(this.md);
+    container.addChild(new Spacer(1));
+    container.addChild(this.selectList);
+    container.addChild(new Spacer(1));
+    container.addChild(new Text(this.theme.fg("dim", "↑↓ navigate • enter select • esc cancel"), 1, 0));
+    container.addChild(new DynamicBorder((s: string) => this.theme.fg("borderAccent", s)));
+    return container.render(width);
+  }
+
+  invalidate(): void {
+    this.md.invalidate();
+    this.selectList.invalidate();
+    this.requestRender();
+  }
+
+  handleInput(data: string): void {
+    this.selectList.handleInput(data);
+    this.requestRender();
+  }
+
+  /** Exposed for tests. */
+  getSelectedItem(): string | null {
+    return this.selectList.getSelectedItem()?.value ?? null;
+  }
+}

package/extensions/goal-loop-auditor-process.ts

@@ -13,7 +13,7 @@ import { createHash, randomUUID } from "node:crypto";
 import * as path from "node:path";
 import { fileURLToPath } from "node:url";
 
-import { stripThinkBlocks, type Goal } from "./goal-loop-core.js";
+import { stripThinkBlocks, captureGoalRevision, type Goal, type GoalRevisionToken } from "./goal-loop-core.js";
 import { buildGoalAuditorPrompt } from "./goal-loop-auditor.js";
 import { checkRegressionShield, parseAuditorVerdict } from "./goal-loop-shield.js";
 
@@ -28,6 +28,12 @@ export interface GoalAuditorResult {
   error?: string;
   regressionShieldPassed?: boolean;
   regressionShieldMissing?: string[];
+  /** v0.34.59: focus revision token echoed from request.json. The parent
+   * compares this against the current state.goal.revision after the audit
+   * finishes; mismatch → the verdict is treated as stale-refused, not a
+   * silent overwrite. The caller decides what to do (typically: skip the
+   * verdict, log stale_revision_refused, surface the refusal in the HUD). */
+  goalRevision?: GoalRevisionToken;
 }
 
 export interface AuditorProgress {
@@ -56,6 +62,19 @@ export const READ_ONLY_TOOLS = ["read", "grep", "find", "ls", "bash"] as const;
 const PROTOCOL_VERSION = 1;
 const DEFAULT_WALL_TIMEOUT_MS = 30 * 60_000;
 const DEFAULT_POLL_INTERVAL_MS = 250;
+/** v0.34.57 (steal-list #7 / bug #1.4): heartbeat-without-progress watchdog.
+ * A worker heartbeat (`lastActivityAt`) fresher than this is "activity";
+ * older than this is "silence" (the worker's own GLLA_AUDITOR_STALL_MS
+ * brake owns that case — the parent watchdog must not double-fire it). */
+const DEFAULT_HEARTBEAT_FRESH_MS = 60_000;
+/** v0.34.57: if the heartbeat stays fresh but no NEW tool call or report
+ * output arrives for this long, the worker is alive but wedged (auto-retry
+ * loop, empty stream, hung tool). Demote to quiet, emit `auditor_stalled`,
+ * and auto-cancel the detached job. Mirrors the worker's 10m default brake
+ * on the complementary axis: silence→worker cancels, activity-without-
+ * progress→parent cancels. Both are far inside the 30m wall bound and the
+ * observed 1h50m stuck case. */
+const DEFAULT_HEARTBEAT_NO_PROGRESS_MS = 10 * 60_000;
 const ATTEMPT_ID_RE = /^[A-Za-z0-9._-]{1,100}$/;
 const activeChildren = new Map<string, ChildProcess>();
 
@@ -104,6 +123,11 @@ interface AuditorRequest {
   thinkingLevel: string;
   createdAt: string;
   wallDeadlineAt: number;
+  /** v0.34.59: focus revision token captured at dispatch. Echoed in
+   * result.json; the parent re-validates against current disk state
+   * before applying the verdict. Mismatch → stale-refusal, not a silent
+   * overwrite. */
+  goalRevision?: GoalRevisionToken;
 }
 
 interface AuditorToolCall {
@@ -122,6 +146,10 @@ interface AuditorResultFile {
   thinkingLevel: string;
   toolCalls: AuditorToolCall[];
   error?: string;
+  /** v0.34.59: focus revision token echoed from request.json. The parent
+   * compares this against the current state.goal.revision; mismatch → the
+   * verdict is treated as stale-refused, not a silent overwrite. */
+  goalRevision?: GoalRevisionToken;
 }
 
 interface AuditorProgressFile {
@@ -156,12 +184,34 @@ export interface AuditorProcessRuntime {
   wallTimeoutMs?: number;
   now?: () => number;
   attemptId?: () => string;
+  /** v0.34.57: watchdog window — cancel the detached job when the worker's
+   * heartbeat stays fresh but no new tool call or report output arrives for
+   * this long (default 10m). Tests shrink this. */
+  heartbeatNoProgressMs?: number;
+  /** v0.34.57: freshness horizon for `lastActivityAt` — only heartbeats
+   * younger than this count as "activity" for the watchdog (default 60s). */
+  heartbeatFreshMs?: number;
   /** Environment is inherited by default; useful for a fake pi binary in tests. */
   env?: NodeJS.ProcessEnv;
 }
 
 export type AuditorProgressCallback = (progress: AuditorProgress) => void;
 
+/** v0.34.57: payload for the heartbeat-without-progress watchdog. The parent
+ * persists this as the `auditor_stalled` ledger event. */
+export interface AuditorStalledInfo {
+  /** When the watchdog fired. */
+  at: number;
+  /** Age of the last worker heartbeat at detection (`now - lastActivityAt`).
+   * Fresh (≤ heartbeatFreshMs) by construction — this is activity without
+   * progress, not silence. */
+  heartbeatAgeMs: number;
+  /** How long the no-progress streak had been running (≥ heartbeatNoProgressMs). */
+  noProgressMs: number;
+  /** The worker phase in the last progress snapshot. */
+  phase: AuditorProgress["phase"];
+}
+
 /** Return a stable JSON representation for request-hash validation. */
 export function stableJson(value: unknown): string {
   if (value === null || typeof value !== "object") return JSON.stringify(value);
@@ -246,8 +296,28 @@ function asProgress(file: AuditorProgressFile, startedAt: number): AuditorProgre
   };
 }
 
-function infra(model: string, thinkingLevel: string, error: string, output = ""): GoalAuditorResult {
-  return { approved: false, disapproved: false, output, model, thinkingLevel, error };
+/** v0.34.57: the progress-bearing subset of a worker snapshot. Heartbeat
+ * events refresh `lastActivityAt` and may oscillate `phase` (running ↔
+ * thinking on message_start/agent_start) without delivering progress — this
+ * signature deliberately excludes both, so only a NEW finished tool call,
+ * new report output, or a NEW tool start counts as progress. */
+function progressSignature(file: AuditorProgressFile): string {
+  const calls = file.toolCalls;
+  const lastToolFinishedAt = calls.length > 0 ? (calls[calls.length - 1]?.finishedAt ?? 0) : 0;
+  return `${calls.length}|${lastToolFinishedAt}|${file.recentOutput.join("\u0000")}|${file.currentTool ?? ""}|${file.currentToolStartedAt ?? 0}`;
+}
+
+function infra(model: string, thinkingLevel: string, error: string, output = "", capturedToken?: GoalRevisionToken): GoalAuditorResult {
+  return { approved: false, disapproved: false, output, model, thinkingLevel, error, ...(capturedToken ? { goalRevision: capturedToken } : {}) };
+}
+
+/** v0.34.59: stamp the captured focus revision onto a successful verdict
+ * result so the parent can re-validate before applying. Mismatched tokens
+ * cause the verdict to be refused (logged as stale_revision_refused in the
+ * parent) rather than silently overwriting a goal that moved on. */
+function stampToken<T extends GoalAuditorResult>(result: T, capturedToken: GoalRevisionToken | undefined): T {
+  if (!capturedToken) return result;
+  return { ...result, goalRevision: capturedToken };
 }
 
 /**
@@ -264,6 +334,10 @@ export async function runDetachedGoalCompletionAuditor(args: {
   thinkingLevel?: string;
   signal?: AbortSignal;
   onProgress?: AuditorProgressCallback;
+  /** v0.34.57: fired once when the heartbeat-without-progress watchdog
+   * detects a wedged worker and auto-cancels the detached job. The parent
+   * persists this as the `auditor_stalled` ledger event. */
+  onStalled?: (info: AuditorStalledInfo) => void;
   runtime?: AuditorProcessRuntime;
 }): Promise<GoalAuditorResult> {
   const runtime = args.runtime ?? {};
@@ -274,11 +348,18 @@ export async function runDetachedGoalCompletionAuditor(args: {
   const now = runtime.now ?? Date.now;
   const wallTimeoutMs = runtime.wallTimeoutMs ?? DEFAULT_WALL_TIMEOUT_MS;
   const pollIntervalMs = Math.max(10, runtime.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS);
+  const heartbeatFreshMs = Math.max(10, runtime.heartbeatFreshMs ?? DEFAULT_HEARTBEAT_FRESH_MS);
+  const heartbeatNoProgressMs = Math.max(50, runtime.heartbeatNoProgressMs ?? DEFAULT_HEARTBEAT_NO_PROGRESS_MS);
   const attemptId = runtime.attemptId?.() ?? `${Date.now().toString(36)}-${randomUUID()}`;
+  // v0.34.59: capture the focus revision token at dispatch. Every result
+  // shape returned to the parent carries this token so the parent can
+  // re-validate before applying a verdict. Pre-revision goals pass through
+  // unchanged (captured is null).
+  const capturedRevisionToken: GoalRevisionToken | undefined = captureGoalRevision(args.goal) ?? undefined;
   try {
     assertAttemptId(attemptId);
   } catch (error) {
-    return infra(model, thinkingLevel, error instanceof Error ? error.message : String(error));
+    return infra(model, thinkingLevel, error instanceof Error ? error.message : String(error), "", capturedRevisionToken);
   }
 
   const jobDir = path.resolve(args.cwd, ".pi-glla", "audit-jobs", attemptId);
@@ -292,6 +373,13 @@ export async function runDetachedGoalCompletionAuditor(args: {
   let lockHeld = false;
   let child: ChildProcess | undefined;
   let lastProgressSerialized = "";
+  // v0.34.57: heartbeat-without-progress watchdog state. `lastProgressAt` is
+  // reset whenever the progress signature changes; the watchdog fires when
+  // the worker heartbeat stays fresh but the signature has not changed for
+  // `heartbeatNoProgressMs` — the worker is alive but wedged.
+  let lastProgressAt = startedAt;
+  let lastProgressSignature = "";
+  let lastProgress: AuditorProgressFile | undefined;
 
   try {
     await fs.mkdir(jobsRoot, { recursive: true, mode: 0o700 });
@@ -308,6 +396,11 @@ export async function runDetachedGoalCompletionAuditor(args: {
       thinkingLevel,
       createdAt: new Date(startedAt).toISOString(),
       wallDeadlineAt,
+      // v0.34.59: capture the focus revision token at dispatch. The
+      // worker echoes it in result.json; the parent re-validates before
+      // applying the verdict. A stale-handle ghost can no longer silently
+      // overwrite a goal that moved on.
+      goalRevision: capturedRevisionToken,
     };
     const request: AuditorRequest = { ...requestWithoutHash, requestHash: requestHash(requestWithoutHash) };
     await writeAtomicJson(requestPath, request);
@@ -336,37 +429,38 @@ export async function runDetachedGoalCompletionAuditor(args: {
     args.signal?.addEventListener("abort", abort, { once: true });
     try {
       while (true) {
-        if (args.signal?.aborted) return infra(model, thinkingLevel, "Auditor aborted.");
+        if (args.signal?.aborted) return infra(model, thinkingLevel, "Auditor aborted.", "", capturedRevisionToken);
         if (now() >= wallDeadlineAt) {
           if (childAlive(child)) child.kill("SIGTERM");
-          return infra(model, thinkingLevel, `Auditor exceeded its ${Math.round(wallTimeoutMs / 60_000)}m wall-clock bound and was aborted.`);
+          return infra(model, thinkingLevel, `Auditor exceeded its ${Math.round(wallTimeoutMs / 60_000)}m wall-clock bound and was aborted.`, "", capturedRevisionToken);
         }
         try {
           const progress = await readJson<AuditorProgressFile>(progressPath);
           if (progress.protocolVersion !== PROTOCOL_VERSION || progress.attemptId !== attemptId || progress.requestHash !== request.requestHash) {
-            return infra(model, thinkingLevel, "auditor progress identity/request-hash mismatch");
+            return infra(model, thinkingLevel, "auditor progress identity/request-hash mismatch", "", capturedRevisionToken);
           }
+          lastProgress = progress;
           const serialized = stableJson(progress);
           if (serialized !== lastProgressSerialized) {
             lastProgressSerialized = serialized;
             args.onProgress?.(asProgress(progress, startedAt));
           }
         } catch (error) {
-          if ((error as NodeJS.ErrnoException).code !== "ENOENT") return infra(model, thinkingLevel, `invalid auditor progress: ${error instanceof Error ? error.message : String(error)}`);
+          if ((error as NodeJS.ErrnoException).code !== "ENOENT") return infra(model, thinkingLevel, `invalid auditor progress: ${error instanceof Error ? error.message : String(error)}`, "", capturedRevisionToken);
         }
         try {
           const result = await readJson<AuditorResultFile>(resultPath);
           if (result.protocolVersion !== PROTOCOL_VERSION || result.attemptId !== attemptId || result.requestHash !== request.requestHash) {
-            return infra(model, thinkingLevel, "auditor result identity/request-hash mismatch");
+            return infra(model, thinkingLevel, "auditor result identity/request-hash mismatch", "", capturedRevisionToken);
           }
           const output = stripThinkBlocks(result.output);
-          if (!result.ok) return infra(model, thinkingLevel, result.error || "detached auditor failed", output);
-          if (!output.trim()) return infra(model, thinkingLevel, "auditor produced no output");
+          if (!result.ok) return infra(model, thinkingLevel, result.error || "detached auditor failed", output, capturedRevisionToken);
+          if (!output.trim()) return infra(model, thinkingLevel, "auditor produced no output", output, capturedRevisionToken);
           const parsed = parseAuditorVerdict(output);
-          if (!parsed.approved && !parsed.disapproved && !parsed.impossible) return infra(model, thinkingLevel, "auditor produced no verdict marker");
+          if (!parsed.approved && !parsed.disapproved && !parsed.impossible) return infra(model, thinkingLevel, "auditor produced no verdict marker", output, capturedRevisionToken);
           const usedReadTool = result.toolCalls.some((call) => (READ_ONLY_TOOLS as readonly string[]).includes(call.name));
           if (parsed.approved && !usedReadTool) {
-            return { approved: false, disapproved: true, output, model, thinkingLevel, error: "Auditor approved without calling any read-only tool; treated as disapproved." };
+            return stampToken({ approved: false, disapproved: true, output, model, thinkingLevel, error: "Auditor approved without calling any read-only tool; treated as disapproved." }, capturedRevisionToken);
           }
           if (parsed.approved && args.goal.verificationContract?.trim()) {
             const shield = checkRegressionShield(output, args.goal.verificationContract);
@@ -375,27 +469,66 @@ export async function runDetachedGoalCompletionAuditor(args: {
               // regression shield blocked acceptance because the report did
               // not cite every contract item. Keep that outcome distinct from
               // both a work disapproval and infrastructure failure.
-              return {
+              return stampToken({
                 approved: true, disapproved: false, output, model, thinkingLevel,
                 regressionShieldPassed: false, regressionShieldMissing: shield.missingItems,
-              };
+              }, capturedRevisionToken);
             }
             args.onProgress?.({ phase: "complete", elapsedMs: now() - startedAt, recentOutput: output.split("\n").filter(Boolean).slice(-8), toolCalls: result.toolCalls, unmatchedToolStarts: [], unmatchedToolEnds: [] });
-            return { approved: true, disapproved: false, output, model, thinkingLevel, regressionShieldPassed: true };
+            return stampToken({ approved: true, disapproved: false, output, model, thinkingLevel, regressionShieldPassed: true }, capturedRevisionToken);
           }
           args.onProgress?.({ phase: "complete", elapsedMs: now() - startedAt, recentOutput: output.split("\n").filter(Boolean).slice(-8), toolCalls: result.toolCalls, unmatchedToolStarts: [], unmatchedToolEnds: [] });
-          return { approved: parsed.approved, disapproved: parsed.disapproved, impossible: parsed.impossible, impossibleReason: parsed.impossibleReason, output, model, thinkingLevel };
+          return stampToken({ approved: parsed.approved, disapproved: parsed.disapproved, impossible: parsed.impossible, impossibleReason: parsed.impossibleReason, output, model, thinkingLevel }, capturedRevisionToken);
         } catch (error) {
-          if ((error as NodeJS.ErrnoException).code !== "ENOENT") return infra(model, thinkingLevel, `invalid auditor result: ${error instanceof Error ? error.message : String(error)}`);
+          if ((error as NodeJS.ErrnoException).code !== "ENOENT") return infra(model, thinkingLevel, `invalid auditor result: ${error instanceof Error ? error.message : String(error)}`, "", capturedRevisionToken);
+        }
+        // v0.34.57: heartbeat-without-progress watchdog (steal-list #7 /
+        // bug #1.4). The worker's own stall brake only fires on TOTAL silence
+        // (and skips it while a read-only tool is running); a worker that
+        // keeps emitting RPC events — auto-retry loops, empty message
+        // updates, a hung tool — refreshes `lastActivityAt` forever without
+        // delivering any new tool call or report output. That is the 1h50m
+        // "alive but wedged" class: fail fast instead.
+        if (lastProgress && lastProgress.lastActivityAt !== undefined && now() - lastProgress.lastActivityAt <= heartbeatFreshMs) {
+          const signature = progressSignature(lastProgress);
+          if (signature !== lastProgressSignature) {
+            lastProgressSignature = signature;
+            lastProgressAt = now();
+          }
+          const noProgressMs = now() - lastProgressAt;
+          if (noProgressMs >= heartbeatNoProgressMs) {
+            // Demote to quiet first: a final progress snapshot WITHOUT the
+            // live heartbeat, so the HUD cannot render LIVE + "worker activity
+            // 0s ago" for the wedged worker.
+            args.onProgress?.({
+              phase: "running",
+              elapsedMs: now() - startedAt,
+              recentOutput: lastProgress.recentOutput,
+              toolCalls: lastProgress.toolCalls,
+              unmatchedToolStarts: lastProgress.unmatchedToolStarts ?? [],
+              unmatchedToolEnds: lastProgress.unmatchedToolEnds ?? [],
+            });
+            const stallLabel = heartbeatNoProgressMs >= 60_000
+              ? `${Math.max(1, Math.round(heartbeatNoProgressMs / 60_000))}m`
+              : `${Math.max(1, Math.round(heartbeatNoProgressMs / 1_000))}s`;
+            args.onStalled?.({
+              at: now(),
+              heartbeatAgeMs: now() - lastProgress.lastActivityAt,
+              noProgressMs,
+              phase: lastProgress.phase,
+            });
+            if (child && childAlive(child)) child.kill("SIGTERM");
+            return infra(model, thinkingLevel, `Auditor stalled — heartbeats without progress for ${stallLabel} (no new tool call or output); the detached job was auto-cancelled.`, "", capturedRevisionToken);
+          }
         }
-        if (child && !childAlive(child)) return infra(model, thinkingLevel, "auditor worker exited without an atomic result");
+        if (child && !childAlive(child)) return infra(model, thinkingLevel, "auditor worker exited without an atomic result", "", capturedRevisionToken);
         await new Promise((resolve) => setTimeout(resolve, pollIntervalMs));
       }
     } finally {
       args.signal?.removeEventListener("abort", abort);
     }
   } catch (error) {
-    return infra(model, thinkingLevel, error instanceof Error ? error.message : String(error));
+    return infra(model, thinkingLevel, error instanceof Error ? error.message : String(error), "", capturedRevisionToken);
   } finally {
     activeChildren.delete(childKey(args.cwd, attemptId));
     if (lockHeld) await fs.unlink(lockPath).catch(() => {});

package/extensions/goal-loop-auditor.ts

@@ -259,7 +259,10 @@ export function buildGoalAuditorPrompt(goal: Goal, completionSummary: string | n
           "<raw command output here>",
           "</evidence>",
           "",
-          "An approval without a complete <evidence> section will be rejected automatically.",
+          "v0.34.77: quote each item VERBATIM in the contract's ORIGINAL language — a translated",
+          "or paraphrased item (e.g. an English gloss of a Chinese line) cannot be matched by the",
+          "shield and the approval will be rejected automatically. An approval without a complete",
+          "<evidence> section will be rejected automatically.",
         ]
       : []),
   ].join("\n");