pi-goal-list-loop-audit 0.38.29 → 0.38.30

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## 0.38.30 — fresh audit pass: nine low-severity fixes (2026-09-08)
+
+### Fixed
+- Approval-render replay no longer runs before the stale/ownership fence: wrappers skip replay on stale, worker, owner-denied, handoff, and rebind handles (`shouldSkipApprovalRenderReplay`), so a superseded session running stale-allowed `/loop status` cannot mark delivery into a dead session.
+- `countDone` counts all descendants of closed parents, matching the recursive `countTotal` (a closed parent with nested grandchildren no longer under-reads done).
+- Plain-text surfaces use the ANSI-free truncator: `completion-summary.ts` width budgets and the headless settings flat rows route through `truncateCells`; the painted TUI tables keep `truncateToWidth`.
+- Narrow-terminal budgets clamp to the available width instead of the floor, and the compact recovery line takes width-aware inner budgets — provenance/fallback chains truncate indoors instead of hard-cutting mid-token.
+- The display-only objective projection additionally strips `#` headers, `>` quotes, `[label](url)` links, and `*em*` emphasis. Stored objectives unchanged.
+- The approval-render sidecar repairs a corrupt file after ledgering once, truncates objectives by code points, and caps chat lines (60 lines × 1000 chars) behind the 20-entry spillway.
+- The goal card owns goal-kind recovery episodes only: `kind:loop` episodes keep the parked/standalone cards and no longer suppress the goal's provenance; blank-primary recovery falls back to provenance instead of leaving no model fact.
+- `topOpenAuditFinding` strips aligned/tabbed boxes with the same `[ \t]+` class as its matcher, so the reprieve note never carries checkbox markup.
+- `parseLoopStartArgs` consumes known keys only with valid values — junk like unquoted `time=out` stays in the target prose instead of vanishing while defaults silently apply (`done` still always teaches its removal; `measure` accepts any non-empty command).
+- Regression coverage in `tests/audit-2026-09-08.test.ts` (11 pins); `tsc` clean; focused display/loop-forever/approval suites green.
+
 ## 0.38.29 — compact active-card recovery and judgment details (2026-09-08)
 
 ### Fixed

package/docs/INDEX.md

@@ -18,7 +18,7 @@ For shipped docs, the relevant entry points are:
   failback; v0.35.9 hardened cross-version npm tarball checks; v0.35.10
   handles multi-entry npm dry-run reports; v0.35.11 accepts both npm report
   shapes; v0.35.12 supports npm 12's keyed pack reports; v0.35.13 fixes stale-API recovery loops.
-  v0.35.14–v0.38.29 continue through the supervisor freeze (`/glla pause`),
+  v0.35.14–v0.38.30 continue through the supervisor freeze (`/glla pause`),
   load hold, auditor picker parity, Windows launch fix, zombie-watchdog
   subagent carve-out, due-wait backstop, the `/glla agents` visibility panel,
   durable state-root selection, blank-until-resume auditor context, frozen

package/extensions/approval-render-store.ts

@@ -31,6 +31,10 @@ export interface PendingApprovalRender {
  * briefly for inspection; undelivered ones are never dropped by the cap. */
 const MAX_STORED_RENDERS = 20;
 const MAX_REPLAY_PER_CONTACT = 5;
+// v0.38.30 audit: bound the sidecar behind the "each is ~1KB" comment — a
+// long approval trailer used to grow the 20-entry file without bound.
+const MAX_RENDER_CHAT_LINES = 60;
+const MAX_RENDER_LINE_CHARS = 1000;
 
 export function approvalRenderStorePath(cwd: string): string {
   return path.join(piGlaDir(cwd), "pending-approval-renders.json");
@@ -63,10 +67,15 @@ function readRenders(cwd: string): PendingApprovalRender[] {
         dropped: parsed.length - valid.length,
         kept: valid.length,
       });
+      // v0.38.30 audit: repair the file after ledgering once — otherwise
+      // every user command re-appended the same ledger while the file
+      // stayed corrupt. Best-effort; a failed rewrite simply ledgers again.
+      writeRenders(cwd, valid);
     }
     return valid;
   } catch {
     appendLedger(cwd, "terminal_approval_render_store_invalid", { dropped: "all", kept: 0 });
+    writeRenders(cwd, []);
     return [];
   }
 }
@@ -94,8 +103,10 @@ export function persistApprovalRender(cwd: string, render: {
   const existing = readRenders(cwd);
   const entry: PendingApprovalRender = {
     goalId: render.goalId,
-    objective: render.objective.slice(0, 300),
-    chatLines: render.chatLines,
+    // v0.38.30 audit: code-point truncation (char slice split surrogate
+    // pairs) + bounded chat lines (the 20-entry cap never bound bytes).
+    objective: [...render.objective].slice(0, 300).join(""),
+    chatLines: render.chatLines.slice(0, MAX_RENDER_CHAT_LINES).map((line) => [...line].slice(0, MAX_RENDER_LINE_CHARS).join("")),
     createdAt: at,
     ...(render.delivered ? { deliveredAt: at } : {}),
   };

package/extensions/completion-summary.ts

@@ -1,5 +1,5 @@
 import type { Goal, Status } from "./goal-loop-core.js";
-import { truncateToWidth } from "@earendil-works/pi-tui";
+import { truncateCells } from "./goal-loop-display.js";
 
 /**
  * The durable, user-facing terminal recap contract. Keep this as a small
@@ -303,7 +303,10 @@ export function completionSummaryLines(text: string | undefined, maxValueLength
     const line = `${name}: ${clipSummaryValue(rawValue || "not recorded", maxValueLength)}`;
     // Audit 2026-09-06: optional width budget for width-bound surfaces —
     // the default 240-char values previously had no width-conscious path.
-    return lineWidth && lineWidth > 0 ? truncateToWidth(line, lineWidth, "…") : line;
+    // v0.38.30 audit: plain-text surface — use the ANSI-free truncator
+    // (pi-tui truncateToWidth wraps the ellipsis in resets even for plain
+    // text, polluting notify/log/pager consumers).
+    return lineWidth && lineWidth > 0 ? truncateCells(line, lineWidth) : line;
   });
 }
 

package/extensions/goal-loop-display.ts

@@ -95,7 +95,14 @@ function displayObjective(objective: string): string {
   return compactDisplayText(objective)
     .replace(/\*\*([^*]+)\*\*/g, "$1")
     .replace(/__([^_]+)__/g, "$1")
-    .replace(/`([^`\n]*)`/g, "$1");
+    .replace(/`([^`\n]*)`/g, "$1")
+    // v0.38.30 audit: strip the remaining common single-line wrappers so the
+    // glance card keeps its plain-text promise (headers, quotes, links,
+    // single-emphasis). Display-only; prompts/archives/state keep verbatim.
+    .replace(/^#{1,6}\s+/gm, "")
+    .replace(/^>\s?/gm, "")
+    .replace(/\[([^\]]+)\]\([^)]*\)/g, "$1")
+    .replace(/\*([^*\n]+)\*/g, "$1");
 }
 
 /** v0.33.1: painted strings measure by their terminal-cell width. */
@@ -261,7 +268,11 @@ export const WORKER_TEXT_SPACER = "\u00A0";
 
 function budgetFor(width: number | undefined, prefixCols: number, floor: number): number {
   if (!width || width <= 0) return floor;
-  return Math.max(floor, width - WIDGET_HORIZONTAL_MARGIN - prefixCols);
+  // v0.38.30 audit: clamp to the available width (narrow terminals used to
+  // get the floor, so the inner truncate no-opped and the outer hard-cut
+  // sliced mid-token). Floor applies only when width is unknown; otherwise
+  // the available width wins with a small absolute minimum to avoid junk.
+  return Math.max(10, width - WIDGET_HORIZONTAL_MARGIN - prefixCols);
 }
 
 function uniqueModelRefs(refs: readonly string[] | undefined): string[] {
@@ -291,8 +302,10 @@ function modelSourceLabel(source: string): string {
   return source.trim();
 }
 
-function compactMainModelRecoveryLine(recovery: MainModelRecovery | undefined, configuredBackups: string[] = [], now = Date.now()): string | undefined {
+function compactMainModelRecoveryLine(recovery: MainModelRecovery | undefined, configuredBackups: string[] = [], now = Date.now(), width?: number): string | undefined {
   if (!recovery || !recovery.primary.trim()) return undefined;
+  // v0.38.30 audit: width-aware inner budgets (fixed 48/56 silently dropped
+  // the attempts/skipped tail at narrow widths when the outer hard-cut ran).
   const primary = recovery.primary.trim();
   const current = (recovery.active ?? primary).trim() || primary;
   const backups = uniqueModelRefs(configuredBackups).slice(0, 10);
@@ -308,7 +321,7 @@ function compactMainModelRecoveryLine(recovery: MainModelRecovery | undefined, c
   const phase = recovery.manualResumeRequired
     ? "manual hold"
     : recovery.pendingModelSwitch
-      ? `switching → ${truncate(recovery.pendingModelSwitch, 48)}`
+      ? `switching → ${truncate(recovery.pendingModelSwitch, budgetFor(width, 20, 48))}`
       : Number.isFinite(retryMs)
         ? retryMs <= 0 ? "retrying now" : `retrying in ${fmtElapsed(retryMs)}`
         : recovery.primaryProbeInFlight
@@ -330,12 +343,12 @@ function compactMainModelRecoveryLine(recovery: MainModelRecovery | undefined, c
   // A recovery object can briefly survive the successful primary selection.
   // Do not label that normal state as an incident, but keep the selected model
   // on the card when no separate provenance row is available.
-  if (!hasEpisode) return `model: ${truncate(current, 56)} · primary`;
+  if (!hasEpisode) return `model: ${truncate(current, budgetFor(width, 12, 56))} · primary`;
   const history = [
     recovery.attempts > 0 ? `attempts ${recovery.attempts}` : "",
     skipped > 0 ? `skipped ${skipped}` : "",
   ].filter(Boolean);
-  return `recovery: ${phase} · ${selected} ${truncate(current, 48)}${history.length > 0 ? ` · ${history.join(" · ")}` : ""}`;
+  return `recovery: ${phase} · ${selected} ${truncate(current, budgetFor(width, 20, 48))}${history.length > 0 ? ` · ${history.join(" · ")}` : ""}`;
 }
 
 function modelProvenanceLines(provenance: ModelProvenanceDisplay | undefined, width?: number): string[] {
@@ -1340,6 +1353,12 @@ function buildStatusTextBase(state: State, audit?: AuditDisplayProgress | null,
 
 function countDone(g: Goal): number {
   let n = 0;
+  const countAllDescendants = (ts?: any[]): number => {
+    if (!ts) return 0;
+    let c = 0;
+    for (const s of ts) c += 1 + countAllDescendants(s.subtasks);
+    return c;
+  };
   const walk = (ts: Array<{ status: string; subtasks?: any[] }>) => {
     for (const t of ts) {
       if (t.status === "complete") {
@@ -1347,7 +1366,9 @@ function countDone(g: Goal): number {
         // (field: 2 closed parents with pending subtasks displayed "2/24"
         // for 6 real tasks). Mid-flight parents still count done subtasks
         // independently via the walk below.
-        n += 1 + (t.subtasks?.length ?? 0);
+        // v0.38.30 audit: count ALL descendants, not just direct children
+        // (a closed parent with nested grandchildren under-read done).
+        n += 1 + countAllDescendants(t.subtasks);
       } else if (t.subtasks) {
         walk(t.subtasks);
       }
@@ -1648,9 +1669,15 @@ function goalLines(g: Goal, state: State, audit: AuditDisplayProgress | null | u
   // active. Keep that fact visible, but do not print the full recovery report
   // into the glance card; it made the card taller than the space below the
   // editor. `/goal status` remains the detailed recovery surface.
+  // v0.38.30 audit: goal card owns goal-kind episodes only (a kind:loop
+  // episode beside an active goal used to misattribute loop recovery here
+  // and hide the goal's own provenance; loop kinds keep the parked /
+  // standalone cards). Fall back to provenance when the compact line is
+  // undefined (blank-primary edge left no model fact at all).
+  const goalRecovery = state.mainModelRecovery?.kind === "goal" ? state.mainModelRecovery : undefined;
   let recoveryLine: string | undefined;
-  if (g.status === "active" && state.mainModelRecovery) {
-    recoveryLine = compactMainModelRecoveryLine(state.mainModelRecovery, extras?.mainModelFallbacks, now);
+  if (g.status === "active" && goalRecovery) {
+    recoveryLine = compactMainModelRecoveryLine(goalRecovery, extras?.mainModelFallbacks, now, width);
     if (recoveryLine) lines.push(`├─ ${paint(theme, "dim", recoveryLine)}`);
   }
   // Model provenance is a card fact, not a notification: keep it visible
@@ -1658,7 +1685,7 @@ function goalLines(g: Goal, state: State, audit: AuditDisplayProgress | null | u
   // active recovery the compact recovery row owns the model fact, so do not
   // print a second primary/current row beside it. The full chain and skipped
   // refs remain available through `/goal status`.
-  const provenance = state.mainModelRecovery
+  const provenance = recoveryLine
     ? []
     : modelProvenanceLines(extras?.modelProvenance, width);
   const provenanceStart = lines.length;

package/extensions/goal-loop-forever.ts

@@ -431,8 +431,23 @@ export function parseLoopStartArgs(raw: string): {
   const spans: Array<[number, number]> = [];
   while ((m = kvRe.exec(rest)) !== null) {
     if (insideQuote(m.index)) continue; // key-looking text inside the target's quotes — leave it
-    if (!KNOWN_KEYS.has(m[1]!.toLowerCase())) continue; // unknown key — leave it in the target
-    kv.set(m[1]!.toLowerCase(), m[2] ?? m[3] ?? m[4] ?? "");
+    const key = m[1]!.toLowerCase();
+    if (!KNOWN_KEYS.has(key)) continue; // unknown key — leave it in the target
+    const value = m[2] ?? m[3] ?? m[4] ?? "";
+    // v0.38.30 audit: only consume known keys with VALID values — junk like
+    // unquoted `time=out` used to be stripped from the target while silently
+    // falling back to defaults. Invalid values stay in the target prose.
+    // `done` always consumes (any use teaches the v0.15.0 removal); `measure`
+    // accepts any non-empty command string.
+    let valid = true;
+    if (key === "direction") valid = value.toLowerCase() === "min" || value.toLowerCase() === "max";
+    else if (key === "window") { const n = Number.parseInt(value, 10); valid = Number.isFinite(n) && n > 0; }
+    else if (key === "max") { const n = Number.parseInt(value, 10); valid = Number.isFinite(n) && n >= 0; }
+    else if (key === "branch" || key === "force") valid = ["1", "true", "yes", "0", "false", "no"].includes(value.toLowerCase());
+    else if (key === "time" || key === "cadence") { const n = Number.parseFloat(value); valid = Number.isFinite(n) && n > 0; }
+    else if (key === "tokens" || key === "toolsamerepeat") { const n = Number.parseInt(value, 10); valid = Number.isInteger(n) && n >= 0; }
+    if (!valid) continue; // junk value — leave the span in the target
+    kv.set(key, value);
     spans.push([m.index, m.index + m[0].length]);
   }
   // Remove kv spans from the target text.
@@ -601,7 +616,9 @@ export function topOpenAuditFinding(cwd: string): string | null {
     const p = join(piGlaDir(cwd), "audit-loop/findings.md");
     if (!existsSync(p)) return null;
     const line = readFileSync(p, "utf-8").split("\n").find((l) => /^- \[[ \t]+\]/.test(l));
-    return line ? line.replace(/^- \[ \]\s*/, "").trim().slice(0, 120) : null;
+    // v0.38.30 audit: strip with the same [ \t]+ class as the matcher
+    // (an aligned `- [  ]` box used to leak markup into the reprieve note).
+    return line ? line.replace(/^- \[[ \t]+\]\s*/, "").trim().slice(0, 120) : null;
   } catch {
     return null;
   }

package/extensions/loops/goal-activation.ts

@@ -227,6 +227,7 @@ import {
   type ProjectRollup,
 } from "../goal-loop-stats.js";
 import { releaseAuditorSurface, suppressAuditorSurfaceAfterColdRestore } from "./goal-auditor-surface.js";
+import { shouldSkipApprovalRenderReplay } from "./goal-session.js";
 import {
   cancelDetachedGoalCompletionAuditor,
   newDetachedAuditJobAttemptId,
@@ -781,7 +782,10 @@ export function registerGoalRuntime(pi: ExtensionAPI): void {
       if (refuseForeignCommand(ctx)) return Promise.resolve();
       // v0.38.25: live contact — replay any approval render that landed
       // with no live turn (persist-first, never silent).
-      replayUndeliveredApprovalRenders(ctx);
+      // v0.38.30 audit: skip on stale/worker handles — the wrappers run
+      // before the inner stale fence, and a superseded session used to mark
+      // delivery into a dead session (stale-allowed /loop status included).
+      if (!shouldSkipApprovalRenderReplay(ctx)) replayUndeliveredApprovalRenders(ctx);
       return cmdGoal(args, ctx);
     },
   });
@@ -790,7 +794,8 @@ export function registerGoalRuntime(pi: ExtensionAPI): void {
     if (refuseForeignCommand(ctx)) return Promise.resolve();
     // v0.38.25: live contact — replay any approval render that landed
     // with no live turn (persist-first, never silent).
-    replayUndeliveredApprovalRenders(ctx);
+    // v0.38.30 audit: skip on stale/worker handles (see /goal wrapper).
+    if (!shouldSkipApprovalRenderReplay(ctx)) replayUndeliveredApprovalRenders(ctx);
     return cmdSettings(args, ctx);
   };
   pi.registerCommand("glla", {
@@ -821,7 +826,8 @@ export function registerGoalRuntime(pi: ExtensionAPI): void {
       if (refuseForeignCommand(ctx)) return Promise.resolve();
       // v0.38.25: live contact — replay any approval render that landed
       // with no live turn (persist-first, never silent).
-      replayUndeliveredApprovalRenders(ctx);
+      // v0.38.30 audit: skip on stale/worker handles (see /goal wrapper).
+      if (!shouldSkipApprovalRenderReplay(ctx)) replayUndeliveredApprovalRenders(ctx);
       return cmdReview(args, ctx);
     },
   });
@@ -850,7 +856,8 @@ export function registerGoalRuntime(pi: ExtensionAPI): void {
       if (refuseForeignCommand(ctx)) return Promise.resolve();
       // v0.38.25: live contact — replay any approval render that landed
       // with no live turn (persist-first, never silent).
-      replayUndeliveredApprovalRenders(ctx);
+      // v0.38.30 audit: skip on stale/worker handles (see /goal wrapper).
+      if (!shouldSkipApprovalRenderReplay(ctx)) replayUndeliveredApprovalRenders(ctx);
       return cmdList(args, ctx);
     },
   });
@@ -875,7 +882,8 @@ export function registerGoalRuntime(pi: ExtensionAPI): void {
       if (refuseForeignCommand(ctx)) return Promise.resolve();
       // v0.38.25: live contact — replay any approval render that landed
       // with no live turn (persist-first, never silent).
-      replayUndeliveredApprovalRenders(ctx);
+      // v0.38.30 audit: skip on stale/worker handles (see /goal wrapper).
+      if (!shouldSkipApprovalRenderReplay(ctx)) replayUndeliveredApprovalRenders(ctx);
       return cmdLoop(args, ctx);
     },
   });

package/extensions/loops/goal-session.ts

@@ -1315,6 +1315,38 @@ function warnIfStaleAtEntry(ctx: ExtensionContext, what: string): boolean {
   return true;
 }
 
+/** v0.38.30 audit: non-notifying stale probe for the approval-render replay.
+ * The command wrappers replay undelivered renders on every live contact, but
+ * they run BEFORE the inner warnIfStaleAtEntry fence — a superseded session
+ * running stale-allowed `/loop status` (or any refused command) used to
+ * rewrite pending-approval-renders.json + ledger and notify into a dead
+ * session, marking delivery the user never saw. Workers are never live
+ * contact either. Passive flags only (no absorb side effects); fail closed. */
+export function shouldSkipApprovalRenderReplay(ctx: ExtensionContext): boolean {
+  try {
+    if (isWorkerSessionCtx(ctx)) return true;
+  } catch {
+    return true;
+  }
+  try {
+    if (processOwnerDeniedCwd === ctx.cwd) return true;
+  } catch {
+    return true;
+  }
+  if (sessionHandoffPending) return true;
+  try {
+    if (Date.now() < sessionReplacementUntil) return true;
+  } catch {
+    return true;
+  }
+  try {
+    if (probeExtensionApiStale()) return true;
+  } catch {
+    return true;
+  }
+  return false;
+}
+
 /** v0.28.12: draft-class confirm with the auto-accept escape hatch SURFACED.
  * The polis incident: a user sat through a 14-item batch Confirm having
  * already reviewed every item during drafting, never knowing /glla

package/extensions/loops/goal-settings-ui.ts

@@ -23,6 +23,7 @@ import * as path from "node:path";
 
 import { defineTool, type ExtensionAPI, type ExtensionContext } from "@earendil-works/pi-coding-agent";
 import { truncateToWidth } from "@earendil-works/pi-tui";
+import { truncateCells } from "../goal-loop-display.js";
 import { Type } from "typebox";
 
 // v0.34.109 (decomposition step 1): the state singleton and the persistence
@@ -742,7 +743,9 @@ async function promptSettingsMenu(
   // Audit 2026-09-06: bound the flat option strings — full VALUE +
   // DESCRIPTION previously rendered unbounded. The resolution prefix
   // (`[section] label —`) sits at the head, so tail truncation is safe.
-  const flat = rows.map((r) => truncateToWidth(`[${r.section}] ${r.label} — ${r.valueText} [${r.sourceText.replace(/^\[|\]$/g, "")}] — ${r.description}`, 120, "…"));
+  // v0.38.30 audit: headless select values are plain-text — use the
+  // ANSI-free truncator (truncateToWidth stays for the painted TUI table).
+  const flat = rows.map((r) => truncateCells(`[${r.section}] ${r.label} — ${r.valueText} [${r.sourceText.replace(/^\[|\]$/g, "")}] — ${r.description}`, 120));
   flat.push("Done");
   const v = await ctx.ui.select(title, flat);
   if (!v || v === "Done") return undefined;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-goal-list-loop-audit",
-  "version": "0.38.29",
+  "version": "0.38.30",
   "description": "Mission control for autonomous pi: interview-drafted goals, an audited task queue, and forever-loops (metric, spec, project-audit) that run for hours. A detached extension-less auditor process re-verifies every completion with raw evidence without holding the main pi turn; confirmed drafts, decision pauses and consent gates keep you in charge.",
   "license": "AGPL-3.0-only",
   "author": "dracon",