pi-goal-list-loop-audit 0.35.65 → 0.35.67

package/CHANGELOG.md

@@ -1,5 +1,32 @@
 # Changelog
 
+## 0.35.67 — in-band provider-result recovery (2026-08-26)
+
+### Fixed
+  Repeated successful tool transports that carry a strong 503/429/network
+  provider pane no longer enter loop stuck or plateau accounting as ordinary
+  work. After the same tool/result fingerprint repeats, the turn is routed
+  through the existing provider-recovery envelope; one-off status text in a
+  searched document remains ordinary output.
+
+### Tests
+  Coverage spans provider-marker classification, repeated-pane detection,
+  loop-turn exemption, durable recovery parking, and the unchanged real-error
+  and repetition paths. The full release gate remains green.
+
+## 0.35.66 — compiled-host auditor launcher (2026-08-26)
+
+### Fixed
+  Detached completion audits no longer launch the worker with a compiled Pi
+  executable. The process layer preserves explicit runtime overrides, keeps
+  Node/Node.js/Bun/Deno `process.execPath` values, and falls back to `node` for
+  compiled hosts that would otherwise parse worker flags such as `--job-dir`.
+
+### Tests
+  Runtime-resolution coverage includes Unix, Windows, Node.js aliases, Bun,
+  Deno, compiled Pi paths, and bare executable names. The existing explicit
+  runtime-override transport regression remains covered.
+
 ## 0.35.65 — status surfaces and worker liveness (2026-08-26)
 
 ### Added

package/extensions/goal-loop-auditor-process.ts

@@ -573,7 +573,7 @@ interface AuditorProgressFile {
 export type AuditorInfrastructureClass = "no-verdict" | "timeout" | "transport" | "provider";
 
 export interface AuditorProcessRuntime {
-  /** Override the worker launcher command (normally process.execPath). */
+  /** Override the worker launcher command (normally resolved from process.execPath, with a JS-runtime fallback for compiled hosts). */
   command?: string;
   /** Override the worker module (normally scripts/goal-auditor-worker.mjs). */
   workerPath?: string;
@@ -761,6 +761,17 @@ function stampToken<T extends GoalAuditorResult>(result: T, capturedToken: GoalR
   return { ...result, goalRevision: capturedToken };
 }
 
+const JAVASCRIPT_RUNTIME_BASENAMES = new Set(["node", "nodejs", "bun", "deno"]);
+
+/** Resolve the runtime that can execute the extension-less worker module.
+ * In a normal Node/Bun/Deno host, process.execPath is already a JavaScript
+ * runtime. In a compiled Pi host it is the Pi executable, which would parse
+ * worker flags such as --job-dir itself and exit before the worker starts. */
+export function resolveWorkerCommand(execPath: string): string {
+  const base = path.basename(execPath.replace(/\\/g, "/")).replace(/\.exe$/i, "").toLowerCase();
+  return JAVASCRIPT_RUNTIME_BASENAMES.has(base) ? execPath : "node";
+}
+
 /**
  * Run one completion audit in a detached, extension-less child process.
  * Infrastructure failures never become semantic disapprovals and never fall
@@ -881,7 +892,7 @@ export async function runDetachedGoalCompletionAuditor(args: {
     args.onProgress?.(asProgress(initialProgress, startedAt));
 
     const workerPath = runtime.workerPath ?? defaultWorkerPath();
-    const command = runtime.command ?? process.execPath;
+    const command = runtime.command ?? resolveWorkerCommand(process.execPath);
     const spawn = runtime.spawn ?? nodeSpawn;
     const env = { ...process.env, ...(runtime.env ?? {}) };
     if (runtime.piBinary) env.GLLA_PI_BINARY = runtime.piBinary;

package/extensions/goal-loop-forever.ts

@@ -113,8 +113,9 @@ export interface LoopState {
   recentPrints?: string[];
   /** v0.24.0: last few iteration texts (near-duplicate check + banned openings). */
   recentTexts?: string[];
-  /** v0.24.0: rolling tool-result fingerprints {tool, hash, isError}. */
-  recentToolResults?: { tool: string; hash: string; isError: boolean }[];
+  /** v0.24.0: rolling tool-result fingerprints {tool, hash, isError};
+   * providerFailure marks a repeated in-band provider/network pane. */
+  recentToolResults?: { tool: string; hash: string; isError: boolean; providerFailure?: boolean }[];
   /** v0.24.0: tool calls seen since the last completed iteration. */
   toolsThisTurn?: number;
   /** v0.24.0: consecutive iterations with zero tool calls. */

package/extensions/goal-loop-repetition.ts

@@ -129,6 +129,18 @@ export interface ToolResultPrint {
   tool: string;
   hash: string;
   isError: boolean;
+  /** Successful tool transport can still contain a repeated provider failure. */
+  providerFailure?: boolean;
+}
+
+/** The repeated in-band provider pane is an outage signal, not loop work. */
+export function repeatedInBandProviderFailure(results: ToolResultPrint[], repeat = REPETITION.toolResultRepeat): boolean {
+  if (repeat <= 0) return false;
+  const recent = results.slice(-repeat);
+  if (recent.length !== repeat || !recent[0]?.providerFailure) return false;
+  return recent.every((result) => result.providerFailure === true
+    && result.tool === recent[0]!.tool
+    && result.hash === recent[0]!.hash);
 }
 
 export interface LoopStuckInput {

package/extensions/loops/goal-activation.ts

@@ -179,6 +179,7 @@ import {
 } from "../length-continue.js";
 import { isSubagentProviderFailure } from "../quota-retry.js";
 import {
+  classifyInBandProviderFailure,
   classifyMainModelFailure,
   isMainModelFallbackFailure,
   requiresMainModelRecovery,
@@ -229,6 +230,7 @@ import {
 import {
   REPETITION,
   isActuallyStuck,
+  repeatedInBandProviderFailure,
   loopInterventionDirective,
   continueVariant,
   textFingerprint,
@@ -456,6 +458,13 @@ const ZOMBIE_PAUSE_REASON = "automatic zero-stream abort — no provider activit
 // the park standing for manual resume — an honest degradation.
 let zombieRetryStreak: ZombieRetryStreak = { key: "", count: 0, lastAbortStreamAt: 0 };
 let zombieRetryTimer: NodeJS.Timeout | null = null;
+// An in-band provider pane is observed during tool_result and consumed at the
+// matching agent_end. Keep the raw text only in memory; the durable ledger
+// records the bounded classification, never the provider payload.
+let inBandProviderFailureRaw: string | null = null;
+function clearInBandProviderFailure(): void {
+  inBandProviderFailureRaw = null;
+}
 
 /** Arm the one-shot automatic re-dispatch after a successful zombie abort.
  * Returns true when a retry was scheduled (the caller adjusts its user-facing
@@ -951,11 +960,29 @@ export function registerGoalRuntime(pi: ExtensionAPI): void {
       const loop = state.loop!;
       const out = event?.output ?? event?.result ?? event?.details ?? "";
       const text = typeof out === "string" ? out : JSON.stringify(out) ?? "";
+      const tool = String(event?.toolName ?? "?");
+      const inBandFailure = classifyInBandProviderFailure(text);
       loop.recentToolResults = pushRepetitionCapped(
         loop.recentToolResults ?? [],
-        { tool: String(event?.toolName ?? "?"), hash: textFingerprint(text), isError: Boolean(event?.isError ?? event?.error) },
+        {
+          tool,
+          hash: textFingerprint(text),
+          isError: Boolean(event?.isError ?? event?.error) || !!inBandFailure,
+          ...(inBandFailure ? { providerFailure: true } : {}),
+        },
         REPETITION.toolWindow,
       );
+      // Successful transport is not proof of successful work: only a stable
+      // repeated provider pane becomes a loop-level recovery signal. One-off
+      // 503/429 text in a searched document remains ordinary tool output.
+      if (inBandFailure && repeatedInBandProviderFailure(loop.recentToolResults)) {
+        inBandProviderFailureRaw = text.slice(0, 800);
+        appendLedger(eventCtx.cwd, "loop_in_band_provider_failure", {
+          tool,
+          kind: inBandFailure.kind,
+          repeats: REPETITION.toolResultRepeat,
+        });
+      }
       // v0.25.1: file-write progress signal for the multi-signal stuck
       // gate — a loop that is WRITING files is shipping, not stuck.
       if (isLoopWriteTool(String(event?.toolName ?? ""))) {
@@ -1034,6 +1061,7 @@ export function registerGoalRuntime(pi: ExtensionAPI): void {
       });
     }
     appendLedger(ctx.cwd, "session_shutdown", { reason: shutdownReason });
+    clearInBandProviderFailure();
     markSessionOwnerShutdown(ctx.cwd, shutdownReason);
     writeSessionHandoff(ctx, shutdownReason);
     sessionReplacementUntil = Date.now() + SESSION_REBIND_GRACE_MS;
@@ -1136,6 +1164,7 @@ export function registerGoalRuntime(pi: ExtensionAPI): void {
     const startReason = typeof event?.reason === "string" ? event.reason : "unknown";
     initialSessionLoadPending = isBlankInitialStartup(ctx, startReason);
     rememberCtx(ctx);
+    clearInBandProviderFailure();
     startHeartbeat();
     startUITicker();
     // v0.30.0: rebind bookkeeping — claim ownership, close any replacement
@@ -1744,10 +1773,10 @@ export function registerGoalRuntime(pi: ExtensionAPI): void {
     // v0.27.3: enrich lastA with text + priorText for the smarter nudge
     // accounting below.
     const assistants = (event.messages as any[]).filter((m: any) => m.role === "assistant");
-    const rawLastA = assistants.length ? assistants[assistants.length - 1] : null;
+    let rawLastA = assistants.length ? assistants[assistants.length - 1] : null;
     const rawPriorA = assistants.length >= 2 ? assistants[assistants.length - 2] : null;
     const extractText = (m: any): string => (m && Array.isArray(m.content)) ? m.content.filter((p: any) => p.type === "text").map((p: any) => p.text).join("\n") : "";
-    const lastA = rawLastA ? { stopReason: rawLastA.stopReason, text: extractText(rawLastA), priorText: extractText(rawPriorA) } : null;
+    let lastA = rawLastA ? { stopReason: rawLastA.stopReason, text: extractText(rawLastA), priorText: extractText(rawPriorA) } : null;
     // v0.34.19: pi-ai clamps max_tokens to the remaining context before the
     // provider call. At ~99% context that clamp can be 1 token, which the
     // provider reports as stopReason "length" — but this is NOT an overlong
@@ -1835,6 +1864,23 @@ export function registerGoalRuntime(pi: ExtensionAPI): void {
       // never pass the same failure into main-goal recovery.
       return;
     }
+    // A repeated provider pane arrived through a successful tool transport,
+    // so pi reports an ordinary end_turn. Convert it into the same bounded
+    // recovery envelope as a provider error before loop measurement/stuck
+    // accounting can consume the dead turn.
+    if (inBandProviderFailureRaw && isLoopActive()) {
+      const raw = inBandProviderFailureRaw;
+      clearInBandProviderFailure();
+      const loop = state.loop!;
+      // The normal loop error branch owns the consecutive-error counter and
+      // its bounded recovery cap. Clearing the fingerprints here prevents the
+      // same pane from being reclassified before that branch runs.
+      loop.recentToolResults = [];
+      rawLastA = { ...(rawLastA ?? {}), stopReason: "error", errorMessage: raw, content: [] };
+      lastA = { stopReason: "error", text: raw, priorText: lastA?.priorText ?? "" };
+    } else if (inBandProviderFailureRaw) {
+      clearInBandProviderFailure();
+    }
     if (await handleMainModelAgentEnd(ctx, rawLastA, lastA)) return;
     // v0.25.2: per-goal turn telemetry (/glla stats).
     if (state.goal && state.goal.status === "active") {
@@ -2292,6 +2338,7 @@ export function registerGoalRuntime(pi: ExtensionAPI): void {
   });
   pi.on("agent_start", (_event: any, ctx: ExtensionContext) => {
     rememberCtx(ctx);
+    clearInBandProviderFailure();
     if (tryAbsorbHostSuccessor(ctx, "agent_start")) {
       ensureAgentToolsReady(ctx, true);
       return;

package/extensions/main-model-recovery.ts

@@ -159,6 +159,20 @@ export function classifyMainModelFailure(error: string | undefined, opts?: { isC
   return { kind: "unknown", raw };
 }
 
+/** A successful tool invocation can still carry a provider/network failure
+ * in its output. Only strong pane-shaped markers are eligible here; the loop
+ * caller additionally requires the same tool/result fingerprint to repeat
+ * before turning this into model recovery, so a one-off `503` in a searched
+ * document is not enough to park a loop. */
+const IN_BAND_PROVIDER_FAILURE_PATTERN = /\b(?:http\s*)?(?:429|5\d\d)\b|rate[_ -]?limit|too many requests|network[_ -]?error|upstream(?:\s+(?:error|failure|unavailable))?|service unavailable|fetch failed|econn(?:reset|refused)|gateway(?:\s+(?:error|timeout))?/i;
+
+export function classifyInBandProviderFailure(output: string | undefined): MainModelFailure | undefined {
+  const raw = typeof output === "string" ? output.trim() : "";
+  if (!raw || !IN_BAND_PROVIDER_FAILURE_PATTERN.test(raw)) return undefined;
+  const failure = classifyMainModelFailure(raw);
+  return failure.kind === "non-recoverable" ? undefined : failure;
+}
+
 /** v0.34.116: detect when a length-context failure happened AFTER the
  * session_compact already failed. The classifier maps this to
  * `context-overflow` (rollback path: rotate to a larger-context ref). The

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-goal-list-loop-audit",
-  "version": "0.35.65",
+  "version": "0.35.67",
   "description": "Mission control for autonomous pi: interview-drafted goals, an audited task queue, and forever-loops (metric, spec, project-audit) that run for hours. A detached extension-less auditor process re-verifies every completion with raw evidence without holding the main pi turn; confirmed drafts, decision pauses and consent gates keep you in charge.",
   "license": "AGPL-3.0-only",
   "author": "dracon",