pi-goal-list-loop-audit 0.35.13 → 0.35.32

package/extensions/loops/goal-settings-ui.ts

@@ -247,6 +247,10 @@ import {
   type MultiModelPickerResult,
 } from "../multi-model-picker.js";
 import { consumeRecoveryResume } from "../goal-recovery.js"; // decomposition step 3 (v0.34.111)
+import {
+  discoverAuditorExtensions,
+  normalizeAuditorAllowedExtensions,
+} from "../auditor-extensions.js";
 import {
   createGoalHeartbeat,
   endSubagentHangProbe,
@@ -672,11 +676,25 @@ async function promptModelRef(
   ctx: ExtensionContext,
   title: string,
   emptyLabel: string,
+  // v0.35.24 (note.md Next #1): auditor-slot parity with the main agent
+  // selector — forbidden-models policy filters BOTH the picker list and the
+  // typed escape hatch. Without it the user could pin a model the resolver
+  // would silently skip at audit time (auditor_model_fallback reason:
+  // "forbidden"), a dead-end selection the main selector never offers.
+  opts: { excludeRefs?: readonly string[] } = {},
 ): Promise<{ kind: "session" } | { kind: "ref"; ref: string } | undefined> {
+  const exclude = opts.excludeRefs ?? [];
+  const validateTypedRef = (ref: string): { kind: "session" } | { kind: "ref"; ref: string } | undefined => {
+    if (exclude.length > 0 && isForbiddenModel(ref, exclude)) {
+      ctx.ui.notify(`"${ref}" matches your forbidden-models policy — the picker refuses it. Adjust /glla → Forbidden models first.`, "warning");
+      return undefined;
+    }
+    return { kind: "ref", ref };
+  };
   const inputFallback = async (): Promise<{ kind: "session" } | { kind: "ref"; ref: string } | undefined> => {
     const v = await ctx.ui.input(title, "provider/model-id — empty keeps the default");
     if (v === undefined) return undefined;
-    return v.trim() ? { kind: "ref", ref: v.trim() } : { kind: "session" };
+    return v.trim() ? validateTypedRef(v.trim()) : { kind: "session" };
   };
   if (typeof (ctx.ui as { custom?: unknown }).custom !== "function" || !ctx.modelRegistry) {
     return inputFallback();
@@ -686,7 +704,7 @@ async function promptModelRef(
   const models = ctx.modelRegistry
     .getAvailable()
     .filter((m: any) => ctx.modelRegistry.hasConfiguredAuth(m));
-  const items = buildModelPickItems(models, sessionLabel);
+  const items = buildModelPickItems(models, sessionLabel, { excludeRefs: exclude });
   let factoryInvoked = false;
   const pick = await ctx.ui.custom<ModelPickItem | undefined>((tui, theme, keybindings, done) => {
     factoryInvoked = true;
@@ -701,7 +719,7 @@ async function promptModelRef(
   // manual escape hatch — typed provider/model, validated like before
   const v = await ctx.ui.input(title, emptyLabel);
   if (v === undefined) return undefined;
-  return v.trim() ? { kind: "ref", ref: v.trim() } : { kind: "session" };
+  return v.trim() ? validateTypedRef(v.trim()) : { kind: "session" };
 }
 
 /** Multi-select counterpart to promptModelRef: returns an ordered string[] of
@@ -1089,7 +1107,11 @@ export async function handleSettingChoice(id: string, ctx: ExtensionContext): Pr
       return;
     }
     case "auditorModel": {
-      const pick = await promptModelRef(ctx, "Auditor model override", "provider/model-id — empty keeps the pi session model");
+      // v0.35.24 (note.md Next #1): parity with the main agent selector —
+      // the auditor picker filters forbidden models out of the list AND
+      // refuses typed policy matches, so a pin saved here is one the
+      // resolver will actually honor.
+      const pick = await promptModelRef(ctx, "Auditor model override", "provider/model-id — empty keeps the pi session model", { excludeRefs: loadSettings(ctx.cwd).forbiddenModels });
       if (pick === undefined) return;
       saveSettings("global", ctx.cwd, { auditorModel: pick.kind === "session" ? undefined : pick.ref });
       // v0.31.4: thinking is chosen WITH the model (user: "we are setting
@@ -1146,12 +1168,81 @@ export async function handleSettingChoice(id: string, ctx: ExtensionContext): Pr
       return;
     }
     case "auditorModelFallback": {
-      const pick = await promptModelRef(ctx, "Auditor fallback agent (runtime failure or same-session swap)", "provider/model-id — empty clears the fallback");
+      const pick = await promptModelRef(ctx, "Auditor fallback agent (runtime failure or same-session swap)", "provider/model-id — empty clears the fallback", { excludeRefs: loadSettings(ctx.cwd).forbiddenModels });
       if (pick === undefined) return;
       saveSettings("global", ctx.cwd, { auditorModelFallback: pick.kind === "session" ? undefined : pick.ref });
       if (pick.kind === "session") ctx.ui.notify("Auditor fallback cleared — a session on the pinned auditor model keeps that model.", "info");
       return;
     }
+    case "auditorAllowedExtensions": {
+      // v0.36.0 (GitHub issue: extension-based model providers in the
+      // detached auditor). The picker lists every extension a normal pi
+      // session would load, RESOLVED to concrete install paths (raw npm:/git:
+      // specs are not directly loadable by the detached worker — see
+      // extensions/auditor-extensions.ts); selected paths ride the auditor
+      // request and the worker passes them as `pi --extension <path>` under
+      // the still intact --no-extensions discovery off switch.
+      const currentExts = normalizeAuditorAllowedExtensions(loadGlobalSettings().auditorAllowedExtensions);
+      const discovered = discoverAuditorExtensions(os.homedir(), ctx.cwd);
+      const discoveredSpecs = new Set(discovered.map((entry) => entry.spec));
+      const extItems: ModelPickItem[] = [
+        ...discovered.map((entry) => ({
+          kind: "model" as const,
+          ref: entry.spec,
+          label: `${entry.label} · ${entry.source}`,
+          searchText: `${entry.spec} ${entry.label} ${entry.source}`,
+        })),
+        // Saved specs that discovery can no longer see (removed package,
+        // another machine's home) still render so the user can deselect
+        // them instead of a silently immortal settings entry.
+        ...currentExts.filter((spec) => !discoveredSpecs.has(spec)).map((spec) => ({
+          kind: "model" as const,
+          ref: spec,
+          label: `${spec} · saved, not discovered here`,
+          searchText: spec,
+        })),
+      ];
+      const extInputFallback = async (): Promise<string[] | undefined> => {
+        const v = await ctx.ui.input(
+          "Auditor allowed extensions — comma-separated pi extension specs",
+          currentExts.length ? currentExts.join(",") : "npm:package-name or /path/to/extension",
+        );
+        if (v === undefined) return undefined;
+        return normalizeAuditorAllowedExtensions(v.split(","));
+      };
+      let extFactoryInvoked = false;
+      const extPick = extItems.length
+        ? await ctx.ui.custom<MultiModelPickerResult>((tui, theme, keybindings, done) => {
+          extFactoryInvoked = true;
+          return new MultiModelPickerComponent(
+            {
+              title: "Auditor allowed extensions — space toggles, enter confirms; empty = fully isolated auditor (default)",
+              items: extItems,
+              initialSelected: currentExts,
+              unorderedSet: true,
+            },
+            () => tui.requestRender(),
+            theme,
+            keybindings,
+            done,
+          );
+        })
+        : undefined;
+      let pickedExts: string[] | undefined;
+      if (extPick === undefined && !extFactoryInvoked) pickedExts = await extInputFallback();
+      else if (extPick === undefined) pickedExts = undefined;
+      else pickedExts = Array.isArray(extPick) ? extPick : extPick.refs;
+      if (pickedExts === undefined) return;
+      const normalizedExts = normalizeAuditorAllowedExtensions(pickedExts);
+      saveSettings("global", ctx.cwd, { auditorAllowedExtensions: normalizedExts.length ? normalizedExts : undefined });
+      ctx.ui.notify(
+        normalizedExts.length
+          ? `Auditor allowed extensions saved: ${normalizedExts.join(", ")}.`
+          : "Auditor allowed extensions cleared — the detached auditor runs extension-less again (default).",
+        "info",
+      );
+      return;
+    }
     case "auditorSameSessionSwap": {
       const v = await ctx.ui.select("Same-model swap — when the pinned auditor IS the session model, walk the fallback pin (a same-family model shares the executor's blind spots)", [
         "on — the verifier differs from the executor (default)",

package/extensions/loops/goal-tools.ts

@@ -410,6 +410,12 @@ async function resolveDraftActivationConflict(ctx: ExtensionContext, incoming: O
   return "proceed";
 }
 
+function verifyTaskMilestone(ctx: ExtensionContext, verificationContract?: string): { failedCommand?: string; output?: string; exitCode?: number } | null {
+  if (!verificationContract?.trim()) return null;
+  const result = runMechanicalPreAuditChecks(ctx.cwd, extractMechanicalCheckCommands(verificationContract));
+  return result.passed ? null : result;
+}
+
 function registerAgentTools(pi: any): void {
   pi.registerTool(defineTool({
     name: "complete_goal",
@@ -691,6 +697,7 @@ function registerAgentTools(pi: any): void {
           verificationSummary: p.verificationSummary,
           model: candidate.model,
           thinkingLevel: (settings.auditorThinkingLevel ?? "high") as any, // may be "max" — pi ≥0.83 understands it; the dev-types predate it
+          allowedExtensions: settings.auditorAllowedExtensions,
           runtime: { attemptId: () => newDetachedAuditJobAttemptId(completionClaim.attemptId!), logicalAttemptId: completionClaim.attemptId!, wallTimeoutMs: AUDITOR_WALL_TIMEOUT_MS },
           onProgress: (progress) => {
             publishDetachedAuditProgress(auditGeneration, auditGoalId, auditAttemptId, progress);
@@ -715,9 +722,10 @@ function registerAgentTools(pi: any): void {
       let fallbackUsed = false;
       // v0.35.7: Deterministic Fast-Fail Pre-Audit — if mechanical contract checks fail,
       // fail in 200ms with raw output rather than burning 45s on an LLM audit pass.
-      const mechanicalCmds = extractMechanicalCheckCommands(auditGoal.verificationContract ?? "");
-      const mechanicalResult = runMechanicalPreAuditChecks(ctx.cwd, mechanicalCmds);
-      if (!mechanicalResult.passed) {
+      try {
+        const mechanicalCmds = extractMechanicalCheckCommands(auditGoal.verificationContract ?? "");
+        const mechanicalResult = runMechanicalPreAuditChecks(ctx.cwd, mechanicalCmds);
+        if (!mechanicalResult.passed) {
         result = {
           approved: false,
           disapproved: true,
@@ -727,8 +735,7 @@ function registerAgentTools(pi: any): void {
           regressionShieldPassed: true,
           goalRevision: captureGoalRevision(auditGoal) ?? undefined,
         };
-      } else {
-        try {
+        } else {
           ({ result, retriedOnce, fallbackUsed } = await runDetachedCompletionWithFallback(auditorCandidates, runAudit, {
             shouldRetry: () => detachedAuditContext(auditGeneration, auditGoalId, auditAttemptId) !== null,
             forbiddenRefs: settings.forbiddenModels,
@@ -754,12 +761,15 @@ function registerAgentTools(pi: any): void {
               current.ui.notify(`Detached auditor failed on ${auditorCandidateLabel(from)} — retrying with ${auditorCandidateLabel(to)}. This is infrastructure, not a verdict.`, "warning");
             },
           }));
-        } finally {
-          if (ownsDetachedAudit(auditGeneration, auditGoalId, auditAttemptId)) {
-            clearDetachedAuditProgress(auditGeneration, auditGoalId, auditAttemptId);
-            completionAuditInFlight = false;
-            completionAuditGeneration = null;
-          }
+        }
+      } finally {
+        // Deterministic pre-audit failures take the same cleanup path as a
+        // detached worker. Otherwise the in-flight latch survives forever
+        // and recovery/status surfaces claim an auditor is still running.
+        if (ownsDetachedAudit(auditGeneration, auditGoalId, auditAttemptId)) {
+          clearDetachedAuditProgress(auditGeneration, auditGoalId, auditAttemptId);
+          completionAuditInFlight = false;
+          completionAuditGeneration = null;
         }
       }
       const auditContextAfterRun = freshCtxForGeneration(auditGeneration);
@@ -883,7 +893,21 @@ function registerAgentTools(pi: any): void {
           ? state.goal.completionSummary.replace(/\s+/g, " ")
           : state.goal.objective;
         const recap = displaySlice(recapSrc, 110);
-        archiveCurrentGoal(ctx, "complete", `auditor ${result.model} approved`);
+        const archived = archiveCurrentGoal(ctx, "complete", `auditor ${result.model} approved`);
+        if (!archived) {
+          // The archive helper preserves the live objective and emits the
+          // persistence warning. Stop here: an approved verdict is not a
+          // terminal success until the archive and state transition land.
+          updateGoal({
+            status: "paused",
+            pendingCompletion: undefined,
+            pauseKind: "blocked",
+            pauseReason: "completion approved but terminal archive persistence failed",
+            pauseSuggestedAction: `Fix .pi-glla disk access or resolve the archive fence, then ${activeGoalSurfaceCommand("resume")} and call complete_goal again.`,
+          }, ctx);
+          appendLedger(ctx.cwd, "goal_archive_failed_after_approval", { goalId: state.goal?.id, origin: "manual-verify", model: result.model });
+          return { content: [{ type: "text", text: "The auditor approved, but the terminal archive could not be persisted. The goal is paused; fix persistence, resume, and retry complete_goal." }], details: {} };
+        }
         ctx.ui.notify(`✓ done: ${recap} — auditor ${result.model} approved.`, "info");
         notifyExternal(ctx, `Goal complete (auditor approved): ${displaySlice(recapSrc, 120)}`);
         return { content: [{ type: "text", text: `Goal approved by auditor ${result.model}.` }], details: {} };
@@ -1082,7 +1106,7 @@ function registerAgentTools(pi: any): void {
                 void retryStoredCompletionAudit();
                 return;
               }
-              updateGoal({ status: "active", pauseKind: undefined, pauseResumeAt: undefined, pauseReason: undefined, pauseSuggestedAction: undefined }, fresh);
+              updateGoal({ status: "active", pauseKind: undefined, pauseResumeAt: undefined, pauseReason: undefined, pauseSuggestedAction: undefined, autoResumedAt: new Date().toISOString(), autoResumedEvent: "auditor provider retry elapsed" }, fresh);
               appendLedger(fresh.cwd, "goal_resumed", { via: "provider-retry" });
               if (resolveEffectiveAggressiveSettings(loadSettings(fresh.cwd)).aggressiveMode) {
                 fresh.ui.notify("Auto-resume fired (event: auditor provider retry elapsed). Continue working.", "info");
@@ -1281,7 +1305,7 @@ function registerAgentTools(pi: any): void {
   pi.registerTool(defineTool({
     name: "pause_goal",
     label: "Pause goal",
-    description: "Pause the active goal with a reason and suggested action. Use when blocked on user input or unable to make progress. When the user must CHOOSE between options, pass kind=\"decision\" with the options list (recommended = 1-based index of the best one) — decision pauses render as a prominent DECISION NEEDED card. Time-gated waits (retry at a specific time) use kind=\"wait\" with resumeAt (ISO). Operational failures use kind=\"error\". VOCABULARY (v0.28.24): decision options and reasons must reference REAL commands only — /goal resume, /goal cancel, /goal tweak \"<new text>\", /list remove N, /list next, /list resume, /loop stop, /loop resume. These all act on the ACTIVE goal/item: there is NO /goal drop and NO command takes a goal id. Never show goal ids to the user — name the thing ('the active goal', 'list item \"<short name>\"'); ids are internal plumbing the user cannot act on.",
+    description: "Pause the active goal with a reason and suggested action. Use when blocked on user input or unable to make progress. Pausing ABORTS the current turn immediately — after this call, stop; never keep working. When the user must CHOOSE between options, pass kind=\"decision\" with the options list (recommended = 1-based index of the best one) — decision pauses render as a prominent DECISION NEEDED card and pop a picker for the user. Time-gated waits (retry at a specific time) use kind=\"wait\" with resumeAt (ISO). Operational failures use kind=\"error\". VOCABULARY (v0.28.24): decision options and reasons must reference REAL commands only — /goal resume, /goal cancel, /goal tweak \"<new text>\", /list remove N, /list next, /list resume, /loop stop, /loop resume. These all act on the ACTIVE goal/item: there is NO /goal drop and NO command takes a goal id. Never show goal ids to the user — name the thing ('the active goal', 'list item \"<short name>\"'); ids are internal plumbing the user cannot act on.",
     parameters: Type.Object({
       reason: Type.String({ description: "Why the work is paused" }),
       suggestedAction: Type.Optional(Type.String({ description: "What the user should do next" })),
@@ -1296,6 +1320,10 @@ function registerAgentTools(pi: any): void {
       const ctx = currentToolContext(execCtx);
       if (!ctx) return staleToolResult();
       const p = params as { reason: string; suggestedAction?: string; kind?: "decision" | "error" | "wait" | "blocked"; options?: string[]; recommended?: number; resumeAt?: string };
+      // v0.35.15: a model that passes options but forgets kind="decision"
+      // still gets the decision card — a non-empty options array IS the
+      // decision intent; silently dropping it left the user with no picker.
+      if (!p.kind && p.options && p.options.length > 0) p.kind = "decision";
       if (!state.goal) return { content: [{ type: "text", text: "No active goal." }], details: {} };
       // A late model/tool call from the previous turn must not overwrite a
       // paused or auditing lifecycle. That race made a genuine stop look
@@ -1387,7 +1415,7 @@ function registerAgentTools(pi: any): void {
         try {
           const hours = Math.round((resumeAtMs - Date.now()) / (60 * 60 * 1000));
           ctx.ui.notify(
-            `Pause scheduled for ~${hours}h. If the objective no longer matches your intent, run ${activeGoalSurfaceCommand("tweak")} to replace it now; otherwise ${activeGoalSurfaceCommand("resume")} continues automatically when the wait ends.`,
+            `Pause scheduled for ~${hours}h. If the objective no longer matches your intent, run ${activeGoalSurfaceCommand("tweak")} to replace it now; otherwise the wait auto-continues shortly after its resume time (heartbeat backstop), and ${activeGoalSurfaceCommand("resume")} resumes immediately.`,
             "info",
           );
           appendLedger(ctx.cwd, "pause_long_wait_offer_tweak", {
@@ -1400,12 +1428,29 @@ function registerAgentTools(pi: any): void {
           /* best-effort */
         }
       }
+      // v0.35.15: a pause ENDS the turn. Before this fix the tool result was
+      // just text — pi kept the same turn running, the model kept working
+      // past its own pause ("the agent moves on"), and the deferred decision
+      // picker lost the race: the user was never shown the options. Abort
+      // (the same mechanism /goal cancel and the zero-stream watchdog use)
+      // so the session actually stops on an idle surface where the decision
+      // picker can own the screen. The impossible-drop advance is the one
+      // exception: the queue already moved to the next item and its
+      // continuation owns this turn — aborting would kill the hand-off.
+      if (!droppedImpossible) {
+        try {
+          ctx.abort();
+          appendLedger(ctx.cwd, "pause_goal_aborted_turn", { goalId: state.goal?.id, kind: p.kind ?? "blocked" });
+        } catch (abortError) {
+          appendLedger(ctx.cwd, "pause_goal_abort_failed", { goalId: state.goal?.id, error: abortError instanceof Error ? abortError.message : String(abortError) });
+        }
+      }
       return {
         content: [{
           type: "text",
           text: droppedImpossible
             ? "The list item was auto-dropped as impossible (blocked with no resume path) — the list moved on instead of stopping."
-            : `Goal paused. ${activeGoalSurfaceCommand("resume")} to continue.`,
+            : `Goal paused. The turn ends here — do NOT continue working. ${activeGoalSurfaceCommand("resume")} to continue.`,
         }],
         details: {},
       };
@@ -1432,18 +1477,15 @@ function registerAgentTools(pi: any): void {
       while (queue.length > 0) {
         const t = queue.shift();
         if (t.id === p.id && t.status !== "complete") {
-          if (t.verificationContract) {
-            const checkCmds = extractMechanicalCheckCommands(t.verificationContract);
-            const checkRes = runMechanicalPreAuditChecks(ctx.cwd, checkCmds);
-            if (!checkRes.passed) {
-              return {
-                content: [{
-                  type: "text",
-                  text: `Task ${p.id} milestone verification FAILED for command \`${checkRes.failedCommand}\` (exit code ${checkRes.exitCode}):\n\n${checkRes.output}\n\nTask ${p.id} remains in_progress. Fix the failure before marking complete.`,
-                }],
-                details: {},
-              };
-            }
+          const checkRes = verifyTaskMilestone(ctx, t.verificationContract);
+          if (checkRes) {
+            return {
+              content: [{
+                type: "text",
+                text: `Task ${p.id} milestone verification FAILED for command \`${checkRes.failedCommand}\` (exit code ${checkRes.exitCode}):\n\n${checkRes.output}\n\nTask ${p.id} remains in_progress. Fix the failure before marking complete.`,
+              }],
+              details: {},
+            };
           }
           t.status = "complete";
           updateGoal({ taskList: tl }, ctx);
@@ -1477,6 +1519,18 @@ function registerAgentTools(pi: any): void {
       while (queue.length > 0) {
         const t = queue.shift();
         if (t.id === p.id) {
+          if (p.status === "complete") {
+            const checkRes = verifyTaskMilestone(ctx, t.verificationContract);
+            if (checkRes) {
+              return {
+                content: [{
+                  type: "text",
+                  text: `Task ${p.id} milestone verification FAILED for command \`${checkRes.failedCommand}\` (exit code ${checkRes.exitCode}):\n\n${checkRes.output}\n\nTask ${p.id} remains ${t.status}. Fix the failure before marking complete.`,
+                }],
+                details: {},
+              };
+            }
+          }
           t.status = p.status;
           updateGoal({ taskList: tl }, ctx);
           return { content: [{ type: "text", text: `Task ${p.id} → ${p.status}` }], details: {} };

package/extensions/loops/goal-ui.ts

@@ -114,6 +114,7 @@ import {
 isGoalRevisionCurrent,
   nextHourlyPromptMs,
   nextHourlyProbeMs,
+  supervisorPaused,
   type ModelSwitchRecord,
   type ListItem,
 } from "../goal-loop-core.js";
@@ -129,6 +130,11 @@ import {
   transitionDispatch,
   type ContinuationDispatch,
 } from "../goal-loop-dispatch.js";
+import {
+  AUDITOR_QUIET_MS,
+  auditorDisplayPhase,
+  fmtElapsed,
+} from "../goal-loop-display.js";
 import {
   createGoalContinuation,
   scheduleContinuation,
@@ -257,6 +263,8 @@ import {
   type HeartbeatDeps,
   type HeartbeatFlags,
 } from "../goal-heartbeat.js"; // decomposition step 4 (v0.34.112)
+import { getSubagentAgentsSnapshot } from "../goal-heartbeat.js";
+import { renderAgentsWidgetLine, type AgentsPanelRow } from "../goal-agents-panel.js";
 import {
   clearMainModelRecoveryTimer,
   createGoalRecovery,
@@ -664,12 +672,23 @@ function refreshUI(ctx: ExtensionContext): void {
     const extras = {
       stalls: consecutiveStalls,
       recent: recentActions,
+      // v0.35.29 (issue #15): ambient tracked-subagent segment — hidden at
+      // zero tracked children (renderAgentsWidgetLine returns undefined).
+      ...(() => {
+        try {
+          const { agents } = getSubagentAgentsSnapshot();
+          const line = renderAgentsWidgetLine(agents as AgentsPanelRow[]);
+          return line ? { agents: { line } } : {};
+        } catch { return {}; }
+      })(),
+      ...activity,
       ...activity,
       turnPending: pendingContinuationDispatchRef() !== null,
       auditorSilent: loadSettings(ctx.cwd).auditorSilent !== false,
       auditorProgressSignals: settings.auditorProgressSignals !== false,
       mainModelFallbacks: fallbackRefs,
       modelProvenance,
+      ...(lastAuditorQuietStretch ? { auditorQuietStretch: lastAuditorQuietStretch } : {}),
     };
     // Settings are loaded once for the remaining projections; the explicit
     // auditorSilent expression preserves the source-level contract.
@@ -700,6 +719,57 @@ function scheduleUIRefresh(): void {
   deferredUIRefresh.unref?.();
 }
 
+// v0.35.15: proactive auditor quiet reporting (runtime-only state).
+// The seed complaint (2026-08-21): an auditor sat silent for 8 minutes and
+// the user only learned about it afterwards from the status line — nothing
+// ever NOTIFIED. The phase chip recolors at ~3 min, but a chip is not a
+// report. The watcher below fires exactly ONE notify when a detached audit
+// crosses into the quiet phase, then records the ended stretch so the
+// footer can show "silent Xm then resumed" afterwards. `/glla pause`
+// suppresses the notify (it is automatic machinery), never the recording.
+let auditorQuietSince: number | null = null;
+let auditorQuietNotified = false;
+let lastAuditorQuietStretch: { ms: number; endedAt: number } | null = null;
+
+/** Drive the quiet watcher once per UI tick. Returns a warning message to
+ * deliver, or null. Split out for testability. */
+export function __auditorQuietWatchTick(now = Date.now()): string | null {
+  const g = state.goal;
+  if (!g || g.status !== "auditing") {
+    // No live audit — reset any open stretch so a stale silence cannot leak
+    // into a later goal's display.
+    if (auditorQuietSince !== null) {
+      const ms = now - auditorQuietSince;
+      if (ms >= AUDITOR_QUIET_MS) lastAuditorQuietStretch = { ms, endedAt: now };
+      auditorQuietSince = null;
+      auditorQuietNotified = false;
+    }
+    return null;
+  }
+  const phase = auditorDisplayPhase(g, latestAuditProgress, now);
+  if (phase === "quiet") {
+    // Entering quiet: anchor the stretch at the worker's last activity.
+    if (auditorQuietSince === null) {
+      auditorQuietSince = typeof latestAuditProgress?.lastActivityAt === "number"
+        ? latestAuditProgress.lastActivityAt
+        : now;
+    }
+    if (!auditorQuietNotified && !supervisorPaused(state)) {
+      auditorQuietNotified = true;
+      return `glla: the detached auditor shows NO worker activity for ${fmtElapsed(now - auditorQuietSince)} — it may be stuck (or doing one long read). The status footer keeps counting. /glla pause freezes all supervisor machinery; /goal cancel discards the claim.`;
+    }
+    return null;
+  }
+  // Left the quiet phase: record the ended stretch for the footer summary.
+  if (auditorQuietSince !== null) {
+    const ms = now - auditorQuietSince;
+    if (ms >= AUDITOR_QUIET_MS) lastAuditorQuietStretch = { ms, endedAt: now };
+    auditorQuietSince = null;
+  }
+  auditorQuietNotified = false;
+  return null;
+}
+
 function startUITicker(): void {
   if (uiTicker) return;
   uiTicker = setInterval(() => {
@@ -707,7 +777,17 @@ function startUITicker(): void {
     // v0.34.12: keep ticking during a timed wait-pause too — the status
     // line counts down to resumeAt live (pully field request 2026-08-01).
     const auditVisible = state.goal?.status === "auditing";
-    if (ctx && (isSupervising() || auditVisible || (state.goal?.status === "paused" && !!state.goal.pauseResumeAt))) refreshUI(ctx);
+    if (!ctx) return;
+    if (!(isSupervising() || auditVisible || (state.goal?.status === "paused" && !!state.goal.pauseResumeAt))) return;
+    // v0.35.15: proactive quiet-phase notification (once per stretch).
+    if (auditVisible) {
+      const warning = __auditorQuietWatchTick();
+      if (warning && !supervisorPaused(state)) {
+        try { ctx.ui.notify(warning, "warning"); } catch { /* stale handle — next tick retries the notify gate honestly */ }
+        scheduleUIRefresh();
+      }
+    }
+    refreshUI(ctx);
   }, 1_000);
   uiTicker.unref?.();
 }
@@ -803,6 +883,30 @@ export function __testOnlyRegisterAgentTools(pi: any): void {
 export function __testOnlyRememberCtx(ctx: ExtensionContext): void {
   rememberCtx(ctx);
 }
+
+/** v0.35.15 test-only: drive the auditor quiet watcher with a controlled
+ * progress snapshot + clock. Pass null progress to simulate no audit.
+ * Returns the tick's notify message (null = silent) exactly like the
+ * production ticker consumes it. */
+export function __testOnlyAuditorQuietWatchTick(
+  progress: import("../goal-loop-display.js").AuditDisplayProgress | null,
+  now = Date.now(),
+): string | null {
+  latestAuditProgress = progress;
+  return __auditorQuietWatchTick(now);
+}
+
+/** v0.35.15 test-only: reset the quiet-watcher runtime state between tests. */
+export function __testOnlyResetAuditorQuietWatch(): void {
+  auditorQuietSince = null;
+  auditorQuietNotified = false;
+  lastAuditorQuietStretch = null;
+}
+
+/** v0.35.15 test-only: the last ended quiet stretch the footer extras carry. */
+export function __testOnlyLastAuditorQuietStretch(): { ms: number; endedAt: number } | null {
+  return lastAuditorQuietStretch;
+}
 // v0.32.1 (pi-goal-x's lesson — "recover from compacts smarter"): a compact
 // leaves a RESUME DEBT, not just two fixed-offset settle probes that can both
 // lose (field: hellhunter 4-min dangle 2026-07-31; polis stall same day).

package/extensions/loops/goal.ts

@@ -47,7 +47,6 @@ import {
 } from "../goal-continuation.js";
 export { __testOnlySetContinuationStartTimeout, __testOnlySetContinuationRetryBackoff } from "../goal-continuation.js";
 
-import { resetLengthContinue } from "../length-continue.js";
 import {
   clearMainModelRecoveryTimer,
   createGoalRecovery,
@@ -60,7 +59,7 @@ import {
   type RecoveryDeps,
   type RecoveryFlags,
 } from "../goal-recovery.js";
-import { createGoalHeartbeat, startHeartbeat, type HeartbeatDeps, type HeartbeatFlags } from "../goal-heartbeat.js";
+import { createGoalHeartbeat, getSubagentAgentsSnapshot, type HeartbeatDeps, type HeartbeatFlags } from "../goal-heartbeat.js";
 import { createGoalCommands, type CommandDeps, type CommandFlags } from "../goal-commands.js";
 import { clearLoopTimer, createGoalLoop, type LoopDeps, type LoopFlags } from "../goal-loop.js";
 
@@ -154,6 +153,9 @@ const commandDeps: CommandDeps = {
   persistState,
   updateGoal,
   setGoal,
+  // v0.35.29 (issue #15): /glla agents reads the heartbeat's tracked-subagent
+  // snapshot via injection (goal-commands must not import goal-heartbeat).
+  agentsSnapshot: () => getSubagentAgentsSnapshot(),
   archiveCurrentGoal,
   healGoalPolicy,
   startDrafting,
@@ -404,10 +406,8 @@ createGoalHeartbeat(heartbeatFlags, heartbeatDeps);
 
 
 export default function (pi: ExtensionAPI): void {
-  extensionApi = pi;
-  extensionApiStale = false; // a fresh factory run means a fresh runtime (reload path)
-  resetLengthContinue(); // v0.27.2: fresh runtime, fresh truncation streak
-  startHeartbeat();
-  startUITicker();
+  // Factory evaluation can also happen inside pi-subagents child sessions.
+  // Registration must not claim the shared host API or start session timers;
+  // the admitted host session_start below owns both lifecycle resources.
   registerGoalRuntime(pi);
 }