pi-goal-list-loop-audit 0.34.79 → 0.34.80

package/extensions/loops/goal.ts

@@ -926,20 +926,36 @@ type DraftChoice = "yes" | "no" | "stale";
 let lastConfirmDialog: { title: string; body: string; options: string[] } | null = null;
 async function confirmDraft(ctx: ExtensionContext, title: string, body: string): Promise<DraftChoice> {
   const ALWAYS = "Yes — and always auto-accept drafts (sets autoAcceptDrafts for this project)";
+  const options = ["Yes", ALWAYS, "No"];
+  // v0.34.80 (GitHub #4 rework): `custom` is ALWAYS a function in real pi
+  // 0.84.1 — RPC mode resolves `undefined` WITHOUT ever invoking the factory
+  // (`async custom() { /* Custom UI not supported */ return undefined; }`),
+  // so `typeof custom === "function"` alone never fires the headless/RPC
+  // fallback and RPC drafts were silently rejected ("no" — the dialog never
+  // rendered, the host never answered). Detect unavailability by whether the
+  // builder RAN: if `custom()` settles and the factory was never invoked,
+  // treat custom as unavailable and fall through to the byte-identical
+  // select path (the host-dialog route in RPC mode).
   if (typeof (ctx.ui as { custom?: unknown }).custom === "function") {
-    const options = ["Yes", ALWAYS, "No"];
     lastConfirmDialog = { title, body, options };
+    let factoryInvoked = false;
     try {
-      const choice = await ctx.ui.custom<string | undefined>((tui, theme, keybindings, done) =>
-        new ConfirmDraftComponent({ title, body, options }, () => tui.requestRender(), theme as any, keybindings as any, done),
-      );
-      if (choice === ALWAYS) {
-        saveSettings("project", ctx.cwd, { autoAcceptDrafts: true });
-        appendLedger(ctx.cwd, "draft_autoaccept_enabled", { via: title });
-        ctx.ui.notify("Draft auto-accept ON for this project — future draft confirms are skipped. Undo in /glla settings: Auto-accept drafts = off.", "info");
-        return "yes";
+      const choice = await ctx.ui.custom<string | undefined>((tui, theme, keybindings, done) => {
+        factoryInvoked = true;
+        return new ConfirmDraftComponent({ title, body, options }, () => tui.requestRender(), theme as any, keybindings as any, done);
+      });
+      if (factoryInvoked) {
+        if (choice === ALWAYS) {
+          saveSettings("project", ctx.cwd, { autoAcceptDrafts: true });
+          appendLedger(ctx.cwd, "draft_autoaccept_enabled", { via: title });
+          ctx.ui.notify("Draft auto-accept ON for this project — future draft confirms are skipped. Undo in /glla settings: Auto-accept drafts = off.", "info");
+          return "yes";
+        }
+        return choice === "Yes" ? "yes" : "no";
       }
-      return choice === "Yes" ? "yes" : "no";
+      // real RPC/noOp stub — custom is unavailable in this mode; the
+      // select fallback below is the host-dialog path.
+      appendLedger(ctx.cwd, "confirm_dialog_fallback_select", { via: "custom-stub" });
     } catch (err) {
       if (isStaleApiError(err)) return "stale";
       // a non-stale custom failure degrades to the legacy select path
@@ -1852,6 +1868,31 @@ function heartbeatTick(): void {
   // a durable interruption marker. Keep the last context long enough for the
   // terminal path to persist the honest orphan state.
   const knownCtx = lastCtx;
+  // v0.34.80 (field: 2026-08-07 item-2 freeze): a latched-stale LIVE session
+  // (transient heartbeat-probe failures tripping goStaleTerminal) freezes an
+  // auditing goal with no in-flight audit: the completed verdict's apply path
+  // silently bails on freshCtxForGeneration()=null and the full stranded-
+  // recovery block below is unreachable while the latch holds — the queue sat
+  // blocked ~30m+ while the worker's disapproval sat on disk. Park the stuck
+  // claim via the kept last context. A heartbeat must still NEVER launch
+  // another worker; the park is the explicit-resume gate.
+  if (
+    extensionApiStale &&
+    knownCtx &&
+    state.goal?.status === "auditing" &&
+    !completionAuditInFlight &&
+    state.goal.pendingCompletion &&
+    Date.now() - lastActivityAt >= 90_000
+  ) {
+    appendLedger(knownCtx.cwd, "stranded_audit_recovered", { goalId: state.goal.id, via: "stale-latch" });
+    markCompletionAuditRecoveryPending(knownCtx, "stale-latch-recovery");
+    try {
+      knownCtx.ui.notify(`Completion audit blocked — no verdict (stale session). The stored claim is safe; ${activeGoalSurfaceCommand("resume")} starts exactly one fresh auditor.`, "warning");
+    } catch {
+      /* stale handle — the ledger + park are the durable record */
+    }
+    return;
+  }
   if (extensionApiStale || probeExtensionApiStaleRaw()) {
     if (!extensionApiStale) {
       // v0.34.62: debounce — ONE transient probe failure (pi mid-settle,
@@ -3876,7 +3917,21 @@ async function retryStoredCompletionAudit(origin: CompletionAuditOrigin = "quota
     }
   }
   const currentAfterAudit = freshCtxForGeneration(generation);
-  if (!currentAfterAudit || !state.goal || state.goal.id !== goalId) return; // replacement/stale/goal boundary — fresh session rebinds durable state
+  if (!currentAfterAudit || !state.goal || state.goal.id !== goalId) {
+    // v0.34.80 (field: 2026-08-07): NEVER drop a completed verdict silently.
+    // The gate nulls out on a latched-stale LIVE session (extensionApiStale
+    // from transient heartbeat-probe failures) — the goal then froze in
+    // "auditing" with no in-flight audit and the stranded backstop
+    // unreachable below the stale latch in heartbeatTick. The worker's
+    // verdict (result.json) sat complete on disk for 30m+ while the queue
+    // was blocked. Leave a durable marker via the kept last context so the
+    // fresh session's recovery path parks the claim for an explicit resume.
+    if (state.goal?.status === "auditing" && state.goal.pendingCompletion?.attemptId === claim.attemptId && lastCtx) {
+      appendLedger(lastCtx.cwd, "audit_verdict_deferred", { goalId, attemptId: claim.attemptId, reason: "stale-latch-apply-gate" });
+      markCompletionAuditRecoveryPending(lastCtx, "verdict-apply-gate");
+    }
+    return;
+  }
   if (state.goal.pendingCompletion?.attemptId !== claim.attemptId) return; // a newer attempt owns the durable claim
   liveCtx = currentAfterAudit;
 
@@ -7824,22 +7879,34 @@ async function promptSettingsMenu(
   initialSection?: SettingsSectionId,
 ): Promise<string | undefined> {
   const title = `pi-goal-list-loop-audit settings — global: ${globalSettingsPath()}`;
-  if (typeof (ctx.ui as { custom?: unknown }).custom !== "function") {
-    // Headless / no custom shard — fall back to the legacy flat-row select
-    // for any environment that lacks the new primitive. This is rare and
-    // effectively an emergency hatch; the new UI is the supported path.
-    const flat = rows.map((r) => `[${r.section}] ${r.label} — ${r.valueText} [${r.sourceText.replace(/^\[|\]$/g, "")}] — ${r.description}`);
-    flat.push("Done");
-    const v = await ctx.ui.select(title, flat);
-    if (!v || v === "Done") return undefined;
-    // v0.34.25: resolve by the full constructed prefix (section + label),
-    // not a bare startsWith(label) — a label-prefix collision used to be
-    // able to open the wrong editor silently.
-    return rows.find((r) => v.startsWith(`[${r.section}] ${r.label} —`))?.id;
-  }
-  return await ctx.ui.custom<string | undefined>((tui, theme, keybindings, done) => {
-    return new SettingsMenuComponent({ rows, title, initialSection }, () => tui.requestRender(), theme, keybindings, done);
-  });
+  // v0.34.80: `custom` is a function in EVERY pi 0.84.1 mode — RPC/noOp
+  // resolve `undefined` without invoking the builder. Detect availability by
+  // whether the factory RAN; a settled stub falls through to the flat-row
+  // select (the host-dialog path in RPC mode).
+  if (typeof (ctx.ui as { custom?: unknown }).custom === "function") {
+    let factoryInvoked = false;
+    try {
+      const v = await ctx.ui.custom<string | undefined>((tui, theme, keybindings, done) => {
+        factoryInvoked = true;
+        return new SettingsMenuComponent({ rows, title, initialSection }, () => tui.requestRender(), theme, keybindings, done);
+      });
+      if (factoryInvoked) return v;
+      appendLedger(ctx.cwd, "settings_menu_fallback_select", { via: "custom-stub" });
+    } catch {
+      // a non-stale custom failure degrades to the legacy select path
+    }
+  }
+  // Headless / no custom shard — fall back to the legacy flat-row select
+  // for any environment that lacks the new primitive. This is rare and
+  // effectively an emergency hatch; the new UI is the supported path.
+  const flat = rows.map((r) => `[${r.section}] ${r.label} — ${r.valueText} [${r.sourceText.replace(/^\[|\]$/g, "")}] — ${r.description}`);
+  flat.push("Done");
+  const v = await ctx.ui.select(title, flat);
+  if (!v || v === "Done") return undefined;
+  // v0.34.25: resolve by the full constructed prefix (section + label),
+  // not a bare startsWith(label) — a label-prefix collision used to be
+  // able to open the wrong editor silently.
+  return rows.find((r) => v.startsWith(`[${r.section}] ${r.label} —`))?.id;
 }
 
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-goal-list-loop-audit",
-  "version": "0.34.79",
+  "version": "0.34.80",
   "description": "Mission control for autonomous pi: interview-drafted goals, an audited task queue, and forever-loops (metric, spec, project-audit) that run for hours. A detached extension-less auditor process re-verifies every completion with raw evidence without holding the main pi turn; confirmed drafts, decision pauses and consent gates keep you in charge.",
   "license": "MIT",
   "author": "dracon",