pi-goal-list-loop-audit 0.34.6 → 0.34.8

package/README.md

@@ -312,6 +312,35 @@ stuck backoff caps at 5 minutes then pauses, measure commands get a 10m
 hard timeout, and the auditor aborts after 10m with zero session activity
 (infrastructure error, never a verdict).
 
+## Recommended companions
+
+glla is the goal plane — it drives, verifies, and notifies. It does not
+try to be the whole rig. Four plugins round it out (all optional; glla
+works without any of them):
+
+- **`@tintinweb/pi-subagents`** — the `Agent` tool: parallel Explore /
+  Plan / general-purpose subagents. glla's prompts teach fan-out with ROI
+  (parallelize real work, never ceremony spawning) and brief discipline,
+  and big audit collects genuinely assume this exists. glla's subagent
+  guarantees (the main session owns the goal; workers can't clobber it)
+  are plugin-agnostic, but this is the provider we test against.
+- **`@juicesharp/rpiv-advisor`** — a second opinion the executor model
+  can request mid-flight: the whole conversation branch is forwarded to a
+  stronger reviewer model, which answers with a plan, a correction, or a
+  stop signal. Drive the session with a cheap/fast model and buy strong
+  judgment per call. Role clarity: the advisor is *advisory*, never
+  verification — glla's isolated auditor remains the only completion
+  gate.
+- **`@juicesharp/rpiv-ask-user-question`** — structured questions with
+  multi-select and markdown previews. glla's drafting interviews and
+  DECIDE findings render through it when installed (plain prompts
+  otherwise).
+- **`@pi-unipi/notify`** — push beyond the desktop: Telegram, Gotify,
+  ntfy, with per-event routing. glla's built-in pushes cover the local
+  desktop case and fire only where there is something to DO; add this
+  for away-from-desk alerts — route it to critical events only, or every
+  glla pause/verdict pings twice.
+
 ## Compatibility (what goes well, what conflicts)
 
 **The Two-Driver Rule**: any plugin that drives agent turns on `agent_end`
@@ -325,12 +354,10 @@ contradictory turns. One driver at a time:
 - **Installed-but-don't-run-simultaneously**: `@tmustier/pi-ralph-wiggum` —
   fine to keep, never run a ralph loop while a goal/list/loop is active.
 
-**Goes well with it**: `@juicesharp/rpiv-ask-user-question` (drafting uses its
-structured forms), any subagent provider — e.g. `@tintinweb/pi-subagents` —
-(spawn research/review subagents inside goal work), `pi-chrome` (the
-research/search path for goals — logged-in browsing with no extra services;
-standalone search skills like `mmx-cli`/`pi-search-skill` are optional
-conveniences for bulk queries, not requirements).
+**Goes well with it**: see **Recommended companions** above. `pi-chrome` too
+(the research/search path for goals — logged-in browsing with no extra
+services; standalone search skills like `mmx-cli`/`pi-search-skill` are
+optional conveniences for bulk queries, not requirements).
 
 **Overlaps — pick one**: `@tintinweb/pi-tasks` is a second task list next to
 `/list`, and in practice the glla list *is* the task list (queue, statuses,

package/extensions/loops/goal.ts

@@ -411,6 +411,26 @@ function probeExtensionApiStale(): boolean {
   return extensionApiStale;
 }
 
+/** v0.34.7: orchestrator-path sendUserMessage that can NEVER crash the
+ * process. Darklord 2026-08-01: fanOutListAuditFindings ran on a stale
+ * handle (a /reload landed mid-collect), assertActive threw, the floating
+ * promise from sync archiveCurrentGoal turned it into an uncaughtException
+ * and pi EXITED mid-audit. Probe first, catch anyway, ledger the skip. */
+function safeSteerUser(ctx: ExtensionContext, text: string): boolean {
+  if (probeExtensionApiStale()) {
+    appendLedger(ctx.cwd, "steer_skipped_stale", { chars: text.length });
+    return false;
+  }
+  try {
+    extensionApi?.sendUserMessage(text, { deliverAs: ctx.isIdle() ? "followUp" : "steer" });
+    return true;
+  } catch (err) {
+    if (isStaleApiError(err)) extensionApiStale = true;
+    appendLedger(ctx.cwd, "steer_skipped_stale", { chars: text.length, threw: true });
+    return false;
+  }
+}
+
 /** v0.28.1 (S3): command-entry staleness probe + honest warning. Returns
  * true when the handle is stale — callers must skip send-dependent paths
  * and must NOT claim work started (S3's "created — starting now" lie). */
@@ -1407,11 +1427,9 @@ async function fanOutListAuditFindings(ctx: ExtensionContext): Promise<void> {
   // queued or the fan-out was declined.
   if (decisions.length > 0) {
     const decList = decisions.slice(0, 8).map((d, i) => `${i + 1}. ${d.slice(0, 500)}`).join("\n");
-    extensionApi?.sendUserMessage(
-      `[DECIDE FINDINGS — user decisions needed] The audit surfaced ${decisions.length} DECIDE finding(s) — direction calls only the user can make (a decision is not a task, so they were NOT queued):\n${decList}\nRaise them to the user NOW with ask_user_question — one question per finding, options from the finding's own two sides plus "Defer" (prose numbered list if ask_user_question is unavailable; Esc = Defer). Then record every answer in ${AUDIT_FINDINGS_REL}: replace the "- [?]" line with "- [x] DECIDED: <what was chosen> (<date>)" (or "- [x] DEFERRED") so it stops re-surfacing, and queue any chosen work with list_add — do NOT start the work inline.`,
-      { deliverAs: ctx.isIdle() ? "followUp" : "steer" },
-    );
-    appendLedger(ctx.cwd, "list_audit_decisions_raised", { decisions: decisions.length });
+    if (safeSteerUser(ctx,
+      `[DECIDE FINDINGS — user decisions needed] The audit surfaced ${decisions.length} DECIDE finding(s) — direction calls only the user can make (a decision is not a task, so they were NOT queued):\n${decList}\nRaise them to the user NOW with ask_user_question — one question per finding, options from the finding's own two sides plus "Defer" (prose numbered list if ask_user_question is unavailable; Esc = Defer). Then record every answer in ${AUDIT_FINDINGS_REL}: replace the "- [?]" line with "- [x] DECIDED: <what was chosen> (<date>)" (or "- [x] DEFERRED") so it stops re-surfacing, and queue any chosen work with list_add — do NOT start the work inline.`))
+      appendLedger(ctx.cwd, "list_audit_decisions_raised", { decisions: decisions.length });
   }
   const decideNote =
     decisions.length > 0
@@ -1481,7 +1499,12 @@ function archiveCurrentGoal(ctx: ExtensionContext, status: Status, stopReason?:
     // was empty, enqueueItems activates the first fix itself, so the
     // list-complete / reviewer noise below must NOT fire for this item.
     const isListAuditCollect = goal.objective.includes(LIST_AUDIT_COLLECT_MARKER);
-    if (isListAuditCollect) void fanOutListAuditFindings(ctx);
+    // v0.34.7: the float gets a catch — ANY rejection here used to become
+    // an uncaughtException and kill pi (darklord 2026-08-01).
+    if (isListAuditCollect)
+      void fanOutListAuditFindings(ctx).catch((err) => {
+        appendLedger(ctx.cwd, "list_audit_fanout_error", { error: String(err).slice(0, 200) });
+      });
     const advanced = activateNextListItem(ctx);
     // v0.26.0: the queue just EMPTIED on a completion → list-complete.
     if (!advanced && !isListAuditCollect) {
@@ -1699,10 +1722,8 @@ function fireReviewer(
       enqueueListItems: (objectives) => enqueueItems(ctx, objectives, "reviewer", { autoActivate: loadGlobalSettings().autoResume === true }),
       proposeGoal: (objective, reason) => {
         try {
-          extensionApi?.sendUserMessage(
-            `[REVIEWER FOLLOW-UP — ${reason}. Propose this as a /goal via propose_goal_draft (the user Confirms or rejects): ${objective}]`,
-            { deliverAs: ctx.isIdle() ? "followUp" : "steer" },
-          );
+          safeSteerUser(ctx, 
+            `[REVIEWER FOLLOW-UP — ${reason}. Propose this as a /goal via propose_goal_draft (the user Confirms or rejects): ${objective}]`);
           return true;
         } catch (err) {
           // v0.28.8 (E4): the phantom-reviewer hole — a swallowed throw used
@@ -1833,7 +1854,7 @@ async function startDrafting(ctx: ExtensionContext, target: "goal" | "list" | "l
     }
   }
   try {
-    extensionApi?.sendUserMessage(tmpl, { deliverAs: ctx.isIdle() ? "followUp" : "steer" });
+    safeSteerUser(ctx, tmpl);
     draftingUserReplies = 0;
     draftingBlockedProposals = 0;
     draftingSeedInFlight = true; // our injected prompt also arrives as a user message — don't count it
@@ -2025,6 +2046,7 @@ async function cmdResume(ctx: ExtensionContext): Promise<void> {
       return;
     }
     appendLedger(ctx.cwd, "resume_rekick", { goalId: state.goal.id, policy: state.goal.policy, via: "/goal resume" });
+    if (state.goal.interruptedAt) updateGoal({ interruptedAt: undefined, interruptedReason: undefined }, ctx); // v0.34.7: same marker law here
     ctx.ui.notify(
       `The ${state.goal.policy === "list" ? "list item" : "goal"} is ACTIVE but idle — re-firing its continuation: ${state.goal.objective.replace(/\s+/g, " ").slice(0, 70)}`,
       "info",
@@ -2134,13 +2156,13 @@ async function showDecisionPrompt(ctx: ExtensionContext): Promise<boolean> {
       else if (group === "loop" && verb === "stop") await cmdLoop("stop", ctx);
       else if (group === "loop" && verb === "resume") await cmdLoop("resume", ctx);
       else {
-        extensionApi?.sendUserMessage(`Decision for the paused goal "${g.objective}": ${label} — continue on this path.`);
+        safeSteerUser(ctx, `Decision for the paused goal "${g.objective}": ${label} — continue on this path.`);
         await cmdResume(ctx);
       }
       return true;
     }
     // Content choice — deliver to the agent, then resume.
-    extensionApi?.sendUserMessage(`Decision for the paused goal "${g.objective}": ${label} — continue on this path.`);
+    safeSteerUser(ctx, `Decision for the paused goal "${g.objective}": ${label} — continue on this path.`);
     await cmdResume(ctx);
     return true;
   } finally {
@@ -5352,6 +5374,12 @@ async function cmdGllaResume(ctx: ExtensionContext): Promise<void> {
   // resume"). Re-kick the continuation instead of shrugging.
   if (g && g.status === "active") {
     appendLedger(ctx.cwd, "resume_rekick", { goalId: g.id, policy: g.policy });
+    // v0.34.7: the re-kick fulfills the stale-handle marker's promise too
+    // (junk-runner/polis/neonbreak 2026-08-01: actively working with the
+    // ⚠ interrupted banner still screaming — the v0.34.2 clear only lived
+    // in the paused-resume path; the staleness entry-guard above already
+    // filtered out a stale session reaching this branch).
+    if (g.interruptedAt) updateGoal({ interruptedAt: undefined, interruptedReason: undefined }, ctx);
     ctx.ui.notify(
       `The ${g.policy === "list" ? "list item" : "goal"} is ACTIVE but idle — re-firing its continuation: ${g.objective.replace(/\s+/g, " ").slice(0, 70)}`,
       "info",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-goal-list-loop-audit",
-  "version": "0.34.6",
+  "version": "0.34.8",
   "description": "Mission control for autonomous pi: interview-drafted goals, an audited task queue, and forever-loops (metric, spec, project-audit) that run for hours. An isolated extension-less auditor re-verifies every completion with raw evidence; confirmed drafts, decision pauses and consent gates keep you in charge.",
   "license": "MIT",
   "author": "dracon",