pi-goal-x 0.33.0 → 0.34.0

package/docs/advanced-usage.md

@@ -69,7 +69,7 @@ After confirmation, a goal stopped only by its budget can continue if the revise
 
 Some Pi `openai-responses` configurations omit the wire-level `strict` flag. OpenAI Responses may normalize schemas into strict mode when that flag is omitted. This can conflict with optional goal arguments; it is separate from pi-goal-x's `strictExecutionContract` scheduling setting.
 
-For the reported OpenCode model, a narrowly scoped Pi `models.json` override makes the supported Pi 0.84.1 adapter send `strict: false` for ordinary tools:
+For the reported OpenCode model, a narrowly scoped Pi `models.json` override makes the Pi adapter send `strict: false` for ordinary tools:
 
 ```json
 {

package/docs/architecture.md

@@ -258,14 +258,12 @@ skips those snapshots. Settings are rechecked at scheduling and admission; optin
 out removes saved delay metadata without renewing consumption. Resume and genuine
 host input reset pacing; strict waits and provider recovery remain independent.
 
-`goal-prompt-profile.ts` detects Pi's native custom-turn startup protocol and
-leaves its structured prompt/tool deltas intact on Pi 1.2 and newer. On older
-affected structured hosts, it projects the current public prompt and resolved
-tools through `context_with_system`, or the full `context` event where necessary.
-That fallback fixes the first request after direct creation, drafting, resume or
-reload without changing history or tool/result pairs. Classic hosts keep their
-native path. Current `agent_settled.aborted` events stop continuation/recovery and
-pause the associated goal, including cancellation before a provider request.
+Pi 1.4 prepares goal-triggered turns natively. The extension uses
+`context_with_system` to filter its messages and add current goal state after
+Pi has restored the system prompt and tool declarations. System messages stay
+at their original history boundaries, including deltas from other extensions.
+`agent_settled.aborted` stops continuation/recovery and pauses the associated
+goal. Rejected stale checkpoints settle without changing the replacement goal.
 
 Audit display messages flush only at idle settlement and remain scoped to their
 session. If Pi has invalidated a settlement context, the handler skips it before
@@ -328,11 +326,10 @@ npm run check
 ```
 
 `test:unit`, `test:integration`, and `test:all` automatically discover test
-entries and run them in one Node process with small test-only adapters for the
+entries and run them with small test-only adapters for the
 SDK values used by handlers. This avoids loading unrelated model-provider and
-TUI media modules. The fast path requires Node 22.15+; `test:serial` remains
-the slow, real-SDK, process-isolated
-compatibility path. The suites cover: surface baselines (lifecycle-dependent goal tool
+TUI media modules. The fast path requires Node 22.19+; `test:serial` remains
+the slow, real-SDK, process-isolated alternative. The suites cover: surface baselines (lifecycle-dependent goal tool
 profile and fourteen commands), golden file/ledger fixtures, stale-continuation behavior,
 GoalService mutation boundary, runtime/accounting, token-budget transitions,
 task-tool consolidation, verification contracts, the independent auditor,

package/docs/prompt-caching.md

@@ -10,13 +10,15 @@ The request layout is:
 
 Changing goal state never rewrites the system prompt or historical messages. The full goal-state message is not persisted into the session. Old checkpoints remain until Pi compacts history; retaining small markers avoids shifting the prefix on every continuation. Display-only auditor messages are consistently excluded, and tool calls stay adjacent to their results.
 
+Goal context filtering and live-state tails use Pi's `context_with_system` event, preserving system and tool deltas in their original positions. Parent and delegated sessions use this hook from their first request.
+
 For Anthropic-style explicit caching, the extension moves Pi's existing cache_control breakpoint from the transient state message onto the preceding cacheable history block. The Bedrock equivalent moves the cachePoint. Both preserve the configured TTL and do not add breakpoints. Payloads without an existing explicit marker—including caching disabled and implicit-cache providers—receive no marker changes. The extension does not set cache keys, enable paid extended retention, or replace provider defaults.
 
 Execution tools already use an idempotent profile: goal progress, focus, and lifecycle changes do not change schemas. Explicit switches into/out of drafting and changes to disableTasks can change tools and legitimately rebuild the cache. Drafting messages are appended to conversation history. Isolated auditor and Oracle sessions already use fixed instructions/tool profiles and place goal-specific evidence in their user messages; their tool loops retain history. They have separate sessions and use Pi's cache defaults. Opting these sessions into project resources also opts into any behavior from those resources.
 
-Cache reuse can still be interrupted by Pi compaction, branch/session changes, model/provider switches, other extensions changing earlier content, changed tool schemas, provider expiry, minimum-length or breakpoint-lookback limits, or routing. The extension cannot guarantee a hit rate or a particular cost reduction. The declared host range is in `package.json`; development dependencies pin Pi 1.4.0, which requires Node 22.19 or newer. Older supported hosts retain the extension's Node 22.15 floor.
+Cache reuse can still be interrupted by Pi compaction, branch/session changes, model/provider switches, other extensions changing earlier content, changed tool schemas, provider expiry, minimum-length or breakpoint-lookback limits, or routing. The extension cannot guarantee a hit rate or a particular cost reduction. The supported host range is Pi 1.4+ within 1.x, with Node 22.19 or newer. Development dependencies pin Pi 1.4.0.
 
-Pi 1.2 and newer prepare custom-triggered turns through the same public startup protocol as user prompts. The extension leaves their structured prompt and tool deltas intact, including additional sections supplied by other extensions. On older affected structured hosts, goal requests use the public full-context boundary to project the current prompt and resolved tools from the first request after drafting, direct creation, resume or reload. That fallback leaves persisted history and conversation messages intact; earlier structured hosts expose the boundary through `context`, and classic hosts retain their native path. Explicit tool-profile changes can still rebuild the prefix.
+Pi 1.4 prepares custom-triggered turns through the same public startup protocol as user prompts. The extension leaves structured prompt and tool deltas intact, including additional sections supplied by other extensions. Direct creation, drafting, resume and reload use the host's native prompt preparation from the first request. Explicit tool-profile changes can still rebuild the prefix.
 
 Validation includes consecutive request-prefix regressions; actual Anthropic, Anthropic-compatible Chat Completions, OpenAI Chat Completions and Responses serialization with short/long/disabled retention; Bedrock payload-shape checks; lifecycle/tool-pair safety tests; and full SDK parent/auditor/Oracle payload captures. These tests stop before HTTP dispatch. They verify request construction, not live provider hit rates.
 

package/extensions/goal-auditor.ts

@@ -10,6 +10,7 @@ import {
 	SessionManager,
 	SettingsManager,
 	type ExtensionContext,
+	type ModelRuntime,
 	type ResourceLoader,
 } from "@earendil-works/pi-coding-agent";
 import type { GoalRecord, GoalTask, GoalTaskList } from "./goal-record.ts";
@@ -277,25 +278,15 @@ export function resolveAuditorModel(ctx: ExtensionContext, config: GoalSettings)
 /**
  * Options that reuse the parent session's auth + registered providers for the nested auditor.
  *
- * Pi 0.81+ `createAgentSession` accepts `modelRuntime` (and ignores `modelRegistry`).
- * ExtensionContext still exposes `modelRegistry`, which wraps the live ModelRuntime.
+ * Pi 1.4's extension ModelRegistry wraps the live ModelRuntime.
  * Sharing that runtime keeps extension providers such as `pi-cursor-sdk`'s `cursor`
  * provider (and its auth) available. Without this, the auditor builds a fresh runtime
  * with an empty resource loader, so Cursor models fail with "No API key found for cursor"
  * even when `~/.pi/agent/auth.json` has a Cursor key.
- *
- * Older SDKs still accept `modelRegistry`; pass both for compatibility.
  */
-export function resolveAuditorSessionModelOptions(ctx: ExtensionContext): {
-	modelRegistry: ExtensionContext["modelRegistry"];
-	modelRuntime?: unknown;
-} {
-	const registry = ctx.modelRegistry as unknown as { runtime?: unknown } | undefined;
-	const runtime = registry?.runtime;
-	if (runtime) {
-		return { modelRegistry: ctx.modelRegistry, modelRuntime: runtime };
-	}
-	return { modelRegistry: ctx.modelRegistry };
+export function resolveAuditorSessionModelOptions(ctx: ExtensionContext): { modelRuntime?: ModelRuntime } {
+	const registry = ctx.modelRegistry as unknown as { runtime?: ModelRuntime } | undefined;
+	return { modelRuntime: registry?.runtime };
 }
 
 // eslint-disable-next-line @typescript-eslint/no-explicit-any -- pi SDK types Model<any> idiomatically (pi-coding-agent sdk.d.ts)

package/extensions/goal-context.ts

@@ -0,0 +1,12 @@
+import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
+
+/** Filter after Pi restores system and tool state, including on the first request. */
+export function registerGoalContext(
+	pi: ExtensionAPI,
+	transform: (messages: unknown[], ctx: ExtensionContext) => unknown[] | null,
+): void {
+	pi.on("context_with_system", (event, ctx) => {
+		const messages = transform(event.messages, ctx);
+		return messages === null ? undefined : { messages: messages as typeof event.messages };
+	});
+}

package/extensions/goal-core-tools.ts

@@ -65,6 +65,7 @@ pi.registerTool(defineTool({
 		if (core.state.goal) core.syncGoalPromptFromDisk(ctx);
 		const view = core.goalForDisplay() ?? core.state.goal;
 		const params = (_params ?? {}) as { verbose?: boolean; include_history?: boolean; section?: "summary" | GoalDetailSection; task_id?: string; cursor?: string };
+		const taskId = params.task_id?.trim() || undefined;
 		// PR E profile: legacy-v1 keeps pre-optimization verbose-by-default output;
 		// compact-v2 (default) returns a concise state line set because the full
 		// policy already lives in the injected active-goal system block.
@@ -83,10 +84,10 @@ pi.registerTool(defineTool({
   if (params.section && params.section !== "summary") {
    if (!["objective", "tasks", "history"].includes(params.section)) return {content: [{type: "text", text: "Unknown goal section."}], details: goalDetails(view)};
    const history = params.section === "history" ? readGoalLedger(ctx) : undefined;
-   const page = goalDetailPage(view, {section: params.section, task_id: params.task_id, cursor: params.cursor}, history?.events, history?.revision);
+   const page = goalDetailPage(view, {section: params.section, task_id: taskId, cursor: params.cursor}, history?.events, history?.revision);
    return {content: [{type: "text", text: page.text}], details: {...goalDetails(view), ...(page.ok ? {page: {content: page.content, nextCursor: page.nextCursor, totalChars: page.totalChars}} : {})}};
   }
-  if (params.cursor || params.task_id) return {content: [{type: "text", text: "Use section=objective, tasks, or history for detail retrieval; task_id requires tasks."}], details: goalDetails(view)};
+  if (params.cursor || taskId) return {content: [{type: "text", text: "Use section=objective, tasks, or history for detail retrieval; task_id requires tasks."}], details: goalDetails(view)};
 		if (verbose && !params.section) {
 			const lines: string[] = [`Goal ${view.id}: ${statusLabel(view)}, ${view.sisyphus ? "sisyphus" : "regular"}`, schedulerSummary(view.scheduler, loadGoalSettings(ctx.cwd).maxAutonomousRuns, loadGoalSettings(ctx.cwd).showAutonomousRuns, loadGoalSettings(ctx.cwd).idleContinuationBackoff === true, core.loadedCommands)];
 			lines.push(`Objective: ${view.objective}`, "");

package/extensions/goal-events.ts

@@ -1,6 +1,5 @@
 import { commandHint, commandInstructions } from "./goal-controls.ts";
 import { cacheGoalHistory } from "./goal-prompt-cache.ts";
-import { registerGoalPromptProfile } from "./goal-prompt-profile.ts";
 import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
 import {
 	GOAL_EVENT_ENTRY,
@@ -36,6 +35,7 @@ import { hasActiveDraft, rehydrateDraft } from "./goal-drafting.ts";
 import { syncTerminalInputPause } from "./goal-widget.ts";
 import type { GoalCore } from "./goal-state.ts";
 import { filterGoalSessionContext } from "./goal-session-safety.ts";
+import { registerGoalContext } from "./goal-context.ts";
 import type { GoalMutationOutcome } from "./goal-service.ts";
 
 /** Normalize checkpoints independently: deleting old markers shifts the cached prefix. */
@@ -64,12 +64,6 @@ export function compactGoalCheckpointContext(
  */
 export function registerGoalEvents(core: GoalCore): void {
 	const { pi } = core;
-	registerGoalPromptProfile(pi, ctx => {
-		const goal = core.state.goal;
-		const scheduler = goal?.scheduler;
-		return goal?.status === "active" && goal.autoContinue && !hasActiveDraft(core)
-			&& (!scheduler || scheduler.owner === ctx.sessionManager.getSessionId());
-	});
 	// Transients are keyed per session: the context hook of session B must never
 	// overwrite the set that session A's provider request will consume.
 	const liveRetention = new LiveTailRetention();
@@ -79,10 +73,13 @@ export function registerGoalEvents(core: GoalCore): void {
 	let continuationAfterSettleFor: string | null = null;
 	let networkErrorRecoveryAfterSettleFor: string | null = null;
 
-	pi.on("context", async (event, ctx) => {
-		const filtered = filterGoalSessionContext(event.messages);
-		const messages = compactGoalCheckpointContext(filtered ?? event.messages, core.state.goal) ?? filtered;
-		const base = messages ?? event.messages;
+	registerGoalContext(pi, (input, ctx) => {
+		// Reassert startup rejection at the awaited provider boundary, before
+		// any rejected run can send a request.
+		if (core.scheduler.isDenied()) ctx.abort?.();
+		const filtered = filterGoalSessionContext(input);
+		const messages = compactGoalCheckpointContext(filtered ?? input, core.state.goal) ?? filtered;
+		const base = messages ?? input;
 		const sessionKey = sessionKeyFor(ctx);
 		if (sessionKey === "unidentified") liveRetention.clear(sessionKey);
 		const parts = currentGoalContextParts(ctx);
@@ -91,15 +88,16 @@ export function registerGoalEvents(core: GoalCore): void {
 			// request extends the previous one instead of displacing its tail.
 			// Only genuinely new state/counters content is appended.
 			const { messages: retained } = liveRetention.apply(sessionKey, base, { state: parts.state, counters: parts.counters });
-			return { messages: retained as typeof event.messages };
+			return retained;
 		}
 		liveRetention.clear(sessionKey);
-		return messages === null ? undefined : { messages: messages as typeof event.messages };
+		return messages;
 	});
 
 	pi.on("agent_start", async (_event, ctx) => { core.scheduler.begin(ctx); });
 	pi.on("message_start", async (event, ctx) => { core.scheduler.message(ctx, event.message); });
 	pi.on("turn_start", async (_event, ctx) => {
+		if (core.scheduler.isDenied()) return;
 		core.scheduler.turn(ctx);
 		// Per-turn flag resets (#4 + C9 fix).
 		core.advanceTurnSeq();
@@ -166,11 +164,13 @@ export function registerGoalEvents(core: GoalCore): void {
 	});
 
 	pi.on("tool_execution_end", async (_event, ctx) => {
+		if (core.scheduler.isDenied()) return;
 		core.touchGoalActivity(); // F5
 		core.accountProgress(ctx);
 	});
 
 	pi.on("turn_end", async (event, ctx) => {
+		if (core.scheduler.isDenied()) return;
 		const message = event.message as AssistantMessageLike;
 		const tokens = assistantTurnTokens(message);
 		core.touchGoalActivity(); // F5
@@ -264,7 +264,7 @@ export function registerGoalEvents(core: GoalCore): void {
 	pi.on("message_end", async (event, ctx) => {
 		// Signal-aware: see turn_end — only user aborts pause; provider-side
 		// aborts are handled by agent_end's recovery path.
-		if (isAbortedAssistantMessage(event.message) && ctx.signal?.aborted && !core.interruption.ignoreAbort() && !core.interruption.isHeld()) core.pauseActiveGoal(ctx);
+		if (!core.scheduler.isDenied() && isAbortedAssistantMessage(event.message) && ctx.signal?.aborted && !core.interruption.ignoreAbort() && !core.interruption.isHeld()) core.pauseActiveGoal(ctx);
 		const raw = asRecord(event.message);
 		if (raw?.role === "custom" && raw.customType === GOAL_EVENT_ENTRY && raw.display !== false) {
 			return { message: { ...event.message, display: false } as typeof event.message };
@@ -335,13 +335,7 @@ export function registerGoalEvents(core: GoalCore): void {
 		core.queueContinuation(ctx, true);
 	});
 
-	type SessionCompactFailed = { reason: "manual" | "threshold" | "overflow"; errorMessage?: string; aborted: boolean; willRetry: boolean; fromExtension: boolean };
-	// session_compact_failed is new in pi 1.0.0. The supported peer range also
-	// includes 0.83 through 0.87, where this event does not exist and is never
-	// emitted, so the registration is typed loosely enough to compile against
-	// every supported host. On those hosts the handler is simply never called.
-	type CompactFailedOn = (event: "session_compact_failed", handler: (event: SessionCompactFailed, ctx: ExtensionContext) => unknown) => unknown;
-	(pi.on as unknown as CompactFailedOn)("session_compact_failed", async (event, ctx) => {
+	pi.on("session_compact_failed", async (event, ctx) => {
 		// `session_before_compact` already charged progress to the goal, so
 		// flush the buffered transaction and persist first. Otherwise the goal
 		// record and the ledger can disagree about a compaction that never
@@ -374,11 +368,9 @@ export function registerGoalEvents(core: GoalCore): void {
 	pi.on("before_agent_start", async (event, ctx) => {
 		core.advanceTurnSeq();
   if (!hasActiveDraft(core)) core.installGoalToolProfile(!loadGoalSettings(ctx.cwd).disableTasks);
-		// Pi 1.2+ distinguishes custom triggers from user prompts. Older hosts
-		// expose only prompt, so read the shared public trigger shapes here.
-		const trigger = event as unknown as { prompt?: string; message?: { customType?: string; details?: unknown; content?: unknown } };
-		const incomingGoalId = trigger.message ? goalEventMessageId(trigger.message) : extractGoalIdFromInjectedMessage(trigger.prompt ?? "");
-		if (!trigger.message && !incomingGoalId) core.interruption.continueWithUser(ctx);
+		const incomingGoalId = event.messageType === "custom"
+			? goalEventMessageId(event.message) : extractGoalIdFromInjectedMessage(event.prompt ?? "");
+		if (event.messageType !== "custom" && !incomingGoalId) core.interruption.continueWithUser(ctx);
 
 		// If this turn was triggered by a hidden goal checkpoint that no longer
 		// matches the active goal, abort the whole turn instead of letting the
@@ -394,7 +386,7 @@ export function registerGoalEvents(core: GoalCore): void {
 			core.clearContinuationState(false);
 			if (!core.isActionableContinuationGoal(incomingGoalId)) {
 				try {
-					ctx.abort?.();
+					core.scheduler.rejectCheckpoint(ctx);
 				} catch {}
 				core.updateUI(ctx);
 				return;
@@ -417,7 +409,7 @@ export function registerGoalEvents(core: GoalCore): void {
 	/** Request-only goal state split into a rarely-changing policy block and per-turn counters. Other branches are stable-only. */
 	function currentGoalContextParts(ctx: ExtensionContext): { state: string; counters?: string } | undefined {
 		const checkpoint = core.runtime.getCheckpointGoalId();
-		if (checkpoint !== null && !core.isActionableContinuationGoal(checkpoint)) {
+		if (checkpoint !== null && (core.scheduler.isDenied() || !core.isActionableContinuationGoal(checkpoint))) {
 			return { state: staleContinuationPrompt(checkpoint, core.state.goal) };
 		}
 		// Several prompt enrichments may need the same ledger snapshot. Keep one
@@ -522,6 +514,7 @@ export function registerGoalEvents(core: GoalCore): void {
 		core.runningGoalId = null;
 		continuationAfterSettleFor = null;
 		networkErrorRecoveryAfterSettleFor = null;
+		if (core.scheduler.isDenied()) return;
 
 		// Account for any tokens from aborted in-flight assistant messages so
 		// they are not silently lost (but charge them to the original goal).
@@ -567,9 +560,8 @@ export function registerGoalEvents(core: GoalCore): void {
 		core.updateUI(ctx);
 		// agent_end runs before pi finishes retries, compaction, terminating-tool
 		// settlement, and queued messages. Starting the continuation timer here
-		// can poll a stale busy context for minutes on pi 0.84. agent_settled is
-		// available in both supported SDK lines (0.83 and 0.84) and is the first
-		// point where pi guarantees no automatic work remains.
+		// can poll a stale busy context. agent_settled is the first point where
+		// Pi guarantees no automatic work remains.
 		continuationAfterSettleFor = core.state.goal.id;
 	});
 
@@ -579,10 +571,15 @@ export function registerGoalEvents(core: GoalCore): void {
 		continuationAfterSettleFor = null;
 		const networkErrorGoalId = networkErrorRecoveryAfterSettleFor;
 		networkErrorRecoveryAfterSettleFor = null;
+		if (core.scheduler.isDenied()) {
+			core.runningGoalId = null;
+			core.runtime.setCheckpoint(null);
+			core.scheduler.settled(ctx, false);
+			return;
+		}
 		const resumedInterruptedTurn = core.interruption.ignoreAbort() && !core.interruption.isHeld();
-		// Current Pi reports startup cancellation even when no assistant message
-		// or live request signal remains. Older hosts omit this field.
-		if ((event as unknown as { aborted?: boolean }).aborted === true) {
+		// Startup cancellation may leave no assistant message or request signal.
+		if (event.aborted) {
 			const abortedGoalId = goalId ?? networkErrorGoalId ?? core.runningGoalId;
 			core.runningGoalId = null;
 			if (abortedGoalId && !core.interruption.ignoreAbort(abortedGoalId) && !core.interruption.isHeld(abortedGoalId) && core.state.goal?.id === abortedGoalId && core.state.goal.status === "active") core.pauseActiveGoal(ctx);

package/extensions/goal-ledger.ts

@@ -3,6 +3,7 @@ import { indexedActivityEvents } from "./goal-activity.ts";
 import { buildLedgerIndex, indexLedgerEvent, type GoalLedgerIndex } from "./goal-ledger-index.ts";
 import * as fs from "node:fs";
 import * as path from "node:path";
+import { renameAtomicSync } from "./storage/atomic-rename.ts";
 import { nowIso, safeIdPart, type GoalRecord } from "./goal-record.ts";
 
 export const GOAL_LEDGER_FILE = ".pi/goals/goal_events.jsonl";
@@ -452,12 +453,15 @@ function checkpointFromJson(value: unknown): LedgerCheckpoint | null {
 
 /** Atomic checkpoint write: temp file + rename in the ledger directory. Best-effort. */
 function writeLedgerCheckpointAtomic(filePath: string, cp: LedgerCheckpoint): void {
+  const tmp = `${checkpointPathFor(filePath)}.tmp-${process.pid}`;
+  let written = false;
   try {
     const cpPath = checkpointPathFor(filePath);
-    const tmp = `${cpPath}.tmp-${process.pid}`;
     fs.writeFileSync(tmp, JSON.stringify(checkpointToJson(cp)), "utf8");
-    fs.renameSync(tmp, cpPath);
+    written = true;
+    renameAtomicSync(tmp, cpPath);
   } catch (err) {
+    if (written) { try { fs.unlinkSync(tmp); } catch { /* best effort */ } }
     // The checkpoint is an optimization; a failed write only costs a full
     // parse on the next cold read.
     console.error("[goal-ledger] checkpoint write failed:", err);

package/extensions/goal-questionnaire.ts

@@ -40,7 +40,7 @@ export type ProposalDecision = "confirm" | "continue" | "cancel";
 
 /**
  * Bound a custom dialog using the regular renderer's frame cache when
- * available. The pi 0.84 fullscreen renderer does not expose that cache, so
+ * available. When the fullscreen renderer does not expose that cache,
  * reserve four rows for host chrome and use the remaining terminal height.
  */
 export function computeDialogLineLimit(args: { terminalRows?: number; baseFrameLines?: number }): number | undefined {

package/extensions/goal-scheduler.ts

@@ -115,11 +115,11 @@ export class GoalScheduler {
 			if (raw && this.ctx) this.signal(this.ctx, raw.goalId, raw.waitToken);
 		});
 	}
-	shutdown(): void { this.cancelTimer(); this.unsubscribe?.(); this.unsubscribe = undefined; this.ctx = undefined; }
+	shutdown(): void { this.cancelTimer(); this.unsubscribe?.(); this.unsubscribe = undefined; this.ctx = undefined; this.denied = false; }
 
 	restore(ctx: ExtensionContext): void {
 		this.attach(ctx);
-		this.inRun = false; this.declared = false; this.runGoalId = undefined;
+		this.inRun = false; this.declared = false; this.runGoalId = undefined; this.denied = false;
 		this.cancelTimer();
 		this.safe(ctx, () => {
 			this.core.reconcileFocusedGoalFromDisk(ctx);
@@ -171,7 +171,9 @@ export class GoalScheduler {
 		} catch (error) { ctx.ui.notify(String(error), "warning"); return false; }
 	}
 	kickoff(ctx: ExtensionContext): void {
-		if (this.inRun) return; // creating a goal within a user run needs no extra run
+		// A goal created in ordinary user work can finish in that run. Replacing
+		// another run's goal needs its own saved kickoff and fresh attribution.
+		if (this.inRun && (!this.runGoalId || this.runGoalId === this.core.state.goal?.id)) return;
 		this.safe(ctx, () => {
 			const goal = this.core.state.goal;
 			if (!goal || goal.status !== "active" || !goal.autoContinue) return;
@@ -219,10 +221,22 @@ export class GoalScheduler {
 		} catch (error) { return { content: [{ type: "text", text: `Scheduling decision NOT saved: ${error instanceof Error ? error.message : String(error)}` }], details: { error: true }, terminate: false }; }
 	}
 
+	/** Reject an internal dispatch without giving its cancellation to the focused goal. */
+	rejectCheckpoint(ctx: ExtensionContext): void {
+		this.denied = true;
+		this.cancelTimer();
+		this.core.runtime.clearContinuationTimer();
+		this.core.runningGoalId = null;
+		ctx.abort?.();
+	}
+
 	/** One logical run can contain multiple agent_start events during native retry/compaction. */
 	begin(ctx: ExtensionContext): void {
 		this.ctx = ctx;
-		if (this.inRun) { this.core.runningGoalId = this.core.state.goal?.id ?? null; return; }
+		// Native custom-turn preparation can reject a checkpoint before agent_start.
+		// Its later lifecycle events still belong to that rejected dispatch.
+		if (this.denied) return;
+		if (this.inRun) { this.core.runningGoalId = this.runGoalId ?? null; return; }
 		this.inRun = true; this.declared = false; this.denied = false;
 		this.runGoalId = this.core.state.goal?.id;
 		this.runPacingEnabled = loadGoalSettings(ctx.cwd).idleContinuationBackoff === true;
@@ -239,6 +253,7 @@ export class GoalScheduler {
 		this.safe(ctx, () => this.update(ctx, s => { s.decision = undefined; s.phase = "idle"; s.dispatch = undefined; }));
 	}
 	message(ctx: ExtensionContext, rawMessage: unknown): void {
+		if (this.denied) return;
 		const msg = asRecord(rawMessage);
 		if (!msg || !["user", "custom"].includes(String(msg.role))) return;
 		if (msg.customType === "pi-goal-audit-event") return;
@@ -252,9 +267,8 @@ export class GoalScheduler {
 					s.phase = "running";
 				});
 			} catch (error) {
-				this.denied = true;
+				this.rejectCheckpoint(ctx);
 				this.core.runtime.setCheckpoint(String(d?.goalId ?? "invalid"));
-				ctx.abort?.();
 				ctx.ui.notify(`Goal checkpoint rejected: ${String(error)}`, "warning");
 			}
 			return;
@@ -275,7 +289,15 @@ export class GoalScheduler {
 	}
 	settled(ctx: ExtensionContext, successful = true): void {
 		this.inRun = false;
-		if (this.denied || (this.runGoalId && this.core.state.goal?.id !== this.runGoalId)) return;
+		if (this.denied) {
+			this.denied = false;
+			this.runGoalId = undefined;
+			// A rejected message creates no scheduling intent. Resume only intent
+			// that the currently focused goal already saved before the rejection.
+			this.schedule(ctx);
+			return;
+		}
+		if (this.runGoalId && this.core.state.goal?.id !== this.runGoalId) { this.schedule(ctx); return; }
 		invalidateGoalSettingsCache();
 		this.safe(ctx, () => {
 			const goal = this.core.state.goal;
@@ -330,7 +352,7 @@ export class GoalScheduler {
 		loadGoalSettings(ctx.cwd);
 	}
 	schedule(ctx: ExtensionContext): void {
-		if (this.inRun || this.core.interruption.isHeld()) return;
+		if (this.inRun || this.denied || this.core.interruption.isHeld()) return;
 		invalidateGoalSettingsCache();
 		this.safe(ctx, () => {
 			this.core.reconcileFocusedGoalFromDisk(ctx);

package/extensions/goal-settings.ts

@@ -27,6 +27,7 @@
 import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
+import { renameAtomicSync } from "./storage/atomic-rename.ts";
 import { GOAL_COMMANDS, GOAL_KEY_ACTIONS, PAUSE_ORDERS, parseCommandPaths, parseGoalKeybinding, type GoalCommands, type GoalKeybinding, type PauseOrder } from "./goal-controls.ts";
 
 export const GOAL_THINKING_LEVELS = ["off", "minimal", "low", "medium", "high", "xhigh", "max"] as const;
@@ -1101,7 +1102,7 @@ function atomicWriteJson(target: string, value: unknown, options: { defaultMode:
 		fs.fsyncSync(fd);
 		fs.closeSync(fd);
 		fd = undefined;
-		fs.renameSync(temp, target);
+		renameAtomicSync(temp, target);
 	} catch (error) {
 		if (fd !== undefined) {
 			try {

package/extensions/goal-state.ts

@@ -475,6 +475,7 @@ export function createGoalCore(
 	}
 
 	function beginAccounting(): void {
+		if (scheduler?.isDenied() || (runningGoalId && runningGoalId !== state.goal?.id)) { clearActiveAccounting(); return; }
 		if (scheduler?.isWaiting() || interruption?.isHeld()) { clearActiveAccounting(); return; }
 		if (!state.goal || (state.goal.status !== "active")) {
 			clearActiveAccounting();
@@ -489,6 +490,7 @@ export function createGoalCore(
 	}
 
 	function accountProgress(ctx: ExtensionContext, opts: { completedTurnTokens?: number } = {}): void {
+		if (scheduler?.isDenied() || (runningGoalId && runningGoalId !== state.goal?.id)) { clearActiveAccounting(); return; }
 		// Skip disk reconciliation for complete goals — they are pending archival at turn_end.
 		if (state.goal?.activePath && state.goal?.status !== "complete" && !reconcileFocusedGoalFromDisk(ctx, { preserveMemoryUsage: true })) return;
 		if (!state.goal || state.goal.status !== "active" || !accounting.isActiveFor(state.goal.id)) {

package/extensions/goal-task-tools.ts

@@ -17,6 +17,8 @@ import { statusLabel, truncateText } from "./goal-core.ts";
 import { loadGoalSettings } from "./goal-settings.ts";
 import { buildTaskSummary, checkSubtasksComplete, findSubtaskDepthViolation, findTaskInTree, skipAllSubtasks } from "./goal-policy.ts";
 import { showTaskConfirmation, type TaskConfirmationResult } from "./goal-task-confirmation.ts";
+import { normalizeTaskProgress, type TaskProgressInput } from "./goal-tool-inputs.ts";
+export type { TaskProgressInput } from "./goal-tool-inputs.ts";
 import {
 	SET_GOAL_TASKS_TOOL_NAME,
 	UPDATE_GOAL_TASK_TOOL_NAME,
@@ -199,12 +201,6 @@ export function countTasks(tasks: readonly GoalTask[] | undefined): number {
 	return total;
 }
 
-export interface TaskProgressInput {
- task_id: string;
- status: "start" | "complete" | "skipped" | "pending";
- evidence?: string;
- reason?: string;
-}
 function progressSpec(input: TaskProgressInput, core: import("./goal-state.ts").GoalCore, ctx: ExtensionContext): GoalTaskUpdateSpec {
  const settings = loadGoalSettings(ctx.cwd);
  const now = nowIso();
@@ -397,19 +393,19 @@ pi.registerTool(defineTool({
 	promptSnippet: "Start, complete, skip, or reopen tasks; batch related progress.",
 	promptGuidelines: ["start requires pending and sets current task. complete requires evidence for contracted tasks and completed/skipped non-lightweight children. skipped requires a reason and explicit user direction or a hard contradiction; never skip to avoid work. pending reopens skipped tasks only; completed tasks are immutable. Completing/skipping the current task clears focus."],
 	parameters: Type.Object({
-		task_id: Type.Optional(Type.String({ description: "Single-task form; omit with updates." })),
-		status: Type.Optional(StringEnum(["start", "complete", "skipped", "pending"] as const)),
- updates: Type.Optional(Type.Array(Type.Object({task_id: Type.String(), status: StringEnum(["start", "complete", "skipped", "pending"] as const), evidence: Type.Optional(Type.String()), reason: Type.Optional(Type.String())}, {additionalProperties: false}), {minItems: 1, maxItems: 100, description: "Ordered atomic batch; omit all single-task fields."})),
+		task_id: Type.Optional(Type.String({ description: "Single-task form; with updates, any non-empty root fields must repeat one batch entry." })),
+		status: Type.Optional(StringEnum(["start", "complete", "skipped", "pending", ""] as const)),
+ updates: Type.Optional(Type.Array(Type.Object({task_id: Type.String(), status: StringEnum(["start", "complete", "skipped", "pending"] as const), evidence: Type.Optional(Type.String()), reason: Type.Optional(Type.String())}, {additionalProperties: false}), {maxItems: 100, description: "Ordered atomic batch. An empty array is allowed only with valid single-task fields."})),
 		evidence: Type.Optional(Type.String({ description: "Completion evidence; max 200 chars." })),
 		reason: Type.Optional(Type.String({ description: "Required for skipped." })),
 	}, { additionalProperties: false }),
 	executionMode: "sequential",
 	async execute(_toolCallId, rawParams, _signal, _onUpdate, ctx) {
-  if (rawParams.updates !== undefined) {
-   const fail = (text: string) => ({content: [{type: "text" as const, text}], details: goalDetails(core.state.goal)});
-   if ([rawParams.task_id, rawParams.status, rawParams.evidence, rawParams.reason].some(v => v !== undefined)) return fail("Use either updates or single-task fields, never both.");
-   const updates = rawParams.updates;
-   if (!Array.isArray(updates) || updates.length < 1 || updates.length > 100 || updates.some(u => !u || typeof u.task_id !== "string" || !u.task_id.trim() || !["start", "complete", "skipped", "pending"].includes(u.status) || (u.evidence !== undefined && typeof u.evidence !== "string") || (u.reason !== undefined && typeof u.reason !== "string"))) return fail("updates must contain 1–100 valid task updates.");
+  const fail = (text: string) => ({content: [{type: "text" as const, text}], details: goalDetails(core.state.goal)});
+  const normalized = normalizeTaskProgress(rawParams);
+  if (!normalized.ok) return fail(normalized.message);
+  if (normalized.batch) {
+   const updates = normalized.updates;
    core.reconcileFocusedGoalFromDisk(ctx);
    if (loadGoalSettings(ctx.cwd).disableTasks) return fail("update_goal_task is disabled by settings (disableTasks: true).");
    if (!core.state.goal) return fail("No goal is focused.");
@@ -419,8 +415,7 @@ pi.registerTool(defineTool({
    core.updateUI(ctx);
    return fail(`${updates.map(u => `${u.task_id} ${u.status}`).join("; ")}. ${buildTaskSummary(result.goal.taskList!)}.`);
   }
-  if (!rawParams.task_id || !rawParams.status) return {content: [{type: "text", text: "Provide task_id and status, or an updates batch."}], details: goalDetails(core.state.goal)};
-  const params = rawParams as TaskProgressInput;
+  const params = normalized.updates[0]!;
 		core.reconcileFocusedGoalFromDisk(ctx);
 		if (loadGoalSettings(ctx.cwd).disableTasks) {
 			return {
@@ -589,7 +584,8 @@ pi.registerTool(defineTool({
 		};
 	},
 	renderCall(args, theme) {
-		return new Text(theme.fg("toolTitle", "update_goal_task ") + theme.fg("muted", `${args?.task_id ?? ""} ${args?.status ?? ""}`), 0, 0);
+		const summary = args?.updates?.length ? `${args.updates.length} updates` : `${args?.task_id ?? ""} ${args?.status ?? ""}`;
+		return new Text(theme.fg("toolTitle", "update_goal_task ") + theme.fg("muted", summary), 0, 0);
 	},
 	renderResult(result, _options, theme) {
 		return renderGoalResult(result, _options, theme);

package/extensions/goal-tool-inputs.ts

@@ -0,0 +1,47 @@
+export interface TaskProgressInput {
+	task_id: string;
+	status: "start" | "complete" | "skipped" | "pending";
+	evidence?: string;
+	reason?: string;
+}
+
+type Result = {ok: true; updates: TaskProgressInput[]; batch: boolean} | {ok: false; message: string};
+const fields = ["task_id", "status", "evidence", "reason"] as const;
+const statuses = new Set(["start", "complete", "skipped", "pending"]);
+const object = (value: unknown): value is Record<string, unknown> => !!value && typeof value === "object" && !Array.isArray(value);
+
+/** Normalize transport noise without discarding a meaningful task instruction. */
+export function normalizeTaskProgress(input: unknown): Result {
+	const fail = (message: string): Result => ({ok: false, message});
+	if (!object(input)) return fail("Provide task_id and status, or an updates batch.");
+	const normalize = (raw: Record<string, unknown>): Partial<TaskProgressInput> | undefined => {
+		const result: Record<string, string> = {};
+		for (const field of fields) {
+			const value = raw[field];
+			if (value === undefined) continue;
+			if (typeof value !== "string") return;
+			if (value.trim()) result[field] = value.trim();
+		}
+		if (result.status && !statuses.has(result.status)) return;
+		return result as Partial<TaskProgressInput>;
+	};
+	const complete = (value: Partial<TaskProgressInput>): value is TaskProgressInput => !!value.task_id && !!value.status;
+	const root = normalize(input);
+	if (!root) return fail("Task fields must be strings; status must be start, complete, skipped, or pending.");
+	if (input.updates === undefined || (Array.isArray(input.updates) && input.updates.length === 0)) {
+		return complete(root) ? {ok: true, updates: [root], batch: false}
+			: fail("Provide task_id and status, or a non-empty updates batch.");
+	}
+	if (!Array.isArray(input.updates) || input.updates.length > 100) return fail("updates must contain 1–100 valid task updates.");
+	const updates: TaskProgressInput[] = [];
+	for (const entry of input.updates) {
+		if (!object(entry) || Object.keys(entry).some(key => !fields.includes(key as typeof fields[number]))) return fail("updates must contain 1–100 valid task updates.");
+		const normalized = normalize(entry);
+		if (!normalized || !complete(normalized)) return fail("updates must contain 1–100 valid task updates.");
+		updates.push(normalized);
+	}
+	if (!updates.some(entry => fields.every(field => root[field] === undefined || root[field] === entry[field]))) {
+		return fail("Top-level task fields conflict with updates. Put each instruction in updates and omit the top-level task fields.");
+	}
+	return {ok: true, updates, batch: true};
+}

package/extensions/goal-widget.ts

@@ -142,13 +142,13 @@ export function syncTerminalInputPause(core: GoalCore, ctx: ExtensionContext): v
 				// Preserve Pi's ordinary Escape handling for the default combined stop.
 				return matchesKey(data, "escape") && settings.pauseOrder === "together" ? undefined : { consume: true };
 			}
-			// Follow Pi's configured interrupt key (older hosts use the legacy ID).
+			// Follow Pi's configured interrupt key.
 			let hostInterrupt = matchesKey(data, "escape");
 			try {
 				const manager = getKeybindings();
-				const keys = [...manager.getKeys("app.interrupt"), ...manager.getKeys("interrupt" as never)];
+				const keys = manager.getKeys("app.interrupt");
 				if (keys.length) hostInterrupt = keys.some(key => matchesKey(data, key));
-			} catch { /* Hosts without an app keymap retain Escape. */ }
+			} catch { /* Embeddings without an app keymap retain Escape. */ }
 			if (hostInterrupt && !matches("pause") && core.state.goal?.status === "active" && core.state.goal.autoContinue) {
 				core.interruption.interruptTurn(ctx); return { consume: true };
 			}

package/extensions/goal.ts

@@ -13,6 +13,7 @@ import type { GoalEventDetails } from "./goal-record.ts";
 import { createGoalCore } from "./goal-state.ts";
 import { registerGoalTools } from "./goal-tools.ts";
 import { filterGoalSessionContext, isDelegatedGoalSession } from "./goal-session-safety.ts";
+import { registerGoalContext } from "./goal-context.ts";
 
 /**
  * pi-goal thin installer. All state lives in the GoalCore (goal-state.ts);
@@ -26,10 +27,7 @@ export default function goalExtension(
 ): void {
 	if (isDelegatedGoalSession()) {
 		// Inherit conversation without inheriting ownership of the parent's goal.
-		pi.on("context", async event => {
-			const messages = filterGoalSessionContext(event.messages, true);
-			return messages === null ? undefined : { messages };
-		});
+		registerGoalContext(pi, messages => filterGoalSessionContext(messages, true));
 		return;
 	}
 	pi.registerMessageRenderer<GoalEventDetails>(GOAL_EVENT_ENTRY, renderGoalEvent);

package/extensions/storage/atomic-rename.ts

@@ -0,0 +1,52 @@
+import * as fs from "node:fs";
+
+interface RenameIO {
+	renameSync(source: string, target: string): void;
+	rename(source: string, target: string): Promise<void>;
+	isDirectorySync(target: string): boolean;
+	isDirectory(target: string): Promise<boolean>;
+	sleepSync(ms: number): void;
+	sleep(ms: number): Promise<void>;
+}
+
+let sleeper: Int32Array | undefined;
+const native: RenameIO = {
+	renameSync: (source, target) => fs.renameSync(source, target),
+	rename: (source, target) => fs.promises.rename(source, target),
+	isDirectorySync: target => { try { return fs.lstatSync(target).isDirectory(); } catch { return false; } },
+	isDirectory: async target => { try { return (await fs.promises.lstat(target)).isDirectory(); } catch { return false; } },
+	sleepSync: ms => { sleeper ??= new Int32Array(new SharedArrayBuffer(4)); Atomics.wait(sleeper, 0, 0, ms); },
+	sleep: ms => new Promise(resolve => setTimeout(resolve, ms)),
+};
+const transient = new Set(["EPERM", "EACCES", "EBUSY"]);
+// Existing critical writers are synchronous. Cap their added sleep at 75ms;
+// asynchronous metadata writers can wait longer without blocking Pi's input.
+const syncDelays = [5, 10, 20, 40];
+const asyncDelays = [...syncDelays, 80, 160];
+
+/** File replacement only: no destination deletion, no retries of ordinary permission errors on POSIX. */
+export function atomicRenamer(platform = process.platform, io: RenameIO = native) {
+	const retryable = (error: unknown) => platform === "win32" && transient.has((error as NodeJS.ErrnoException | null)?.code ?? "");
+	return {
+		renameSync(source: string, target: string): void {
+			for (let attempt = 0; ; attempt++) {
+				try { io.renameSync(source, target); return; }
+				catch (error) {
+					if (!retryable(error) || attempt >= syncDelays.length || io.isDirectorySync(target)) throw error;
+					io.sleepSync(syncDelays[attempt]!);
+				}
+			}
+		},
+		async rename(source: string, target: string): Promise<void> {
+			for (let attempt = 0; ; attempt++) {
+				try { await io.rename(source, target); return; }
+				catch (error) {
+					if (!retryable(error) || attempt >= asyncDelays.length || await io.isDirectory(target)) throw error;
+					await io.sleep(asyncDelays[attempt]!);
+				}
+			}
+		},
+	};
+}
+
+export const {renameSync: renameAtomicSync, rename: renameAtomic} = atomicRenamer();

package/extensions/storage/goal-files.ts

@@ -1,6 +1,7 @@
 import { goalStoragePath, goalPoolSnapshotPath, isExternalGoalStorage, ensureGoalStorageDirectory, type GoalStorageContext } from "./goal-root.ts";
 import * as fs from "node:fs";
 import * as path from "node:path";
+import { renameAtomic, renameAtomicSync } from "./atomic-rename.ts";
 
 import {
 	formatDuration,
@@ -156,7 +157,8 @@ function writePoolSnapshotSync(ctx: GoalFileContext, root: string, goals: GoalRe
 		const target = goalPoolSnapshotPath(ctx);
 		const tempPath = `${target}.${process.pid}.${Date.now()}.tmp`;
 		fs.writeFileSync(tempPath, JSON.stringify(snapshot), "utf8");
-		fs.renameSync(tempPath, target);
+		try { renameAtomicSync(tempPath, target); }
+		catch (error) { try { fs.unlinkSync(tempPath); } catch { /* best effort */ } throw error; }
 		removeLegacyPoolSnapshot(root);
 	} catch {
 		// best-effort: a missing/stale snapshot just costs a full scan next cold read
@@ -171,7 +173,8 @@ async function writePoolSnapshotAsync(ctx: GoalFileContext, root: string, goals:
 		const target = goalPoolSnapshotPath(ctx);
 		const tempPath = `${target}.${process.pid}.${Date.now()}.tmp`;
 		await fs.promises.writeFile(tempPath, JSON.stringify(snapshot), "utf8");
-		await fs.promises.rename(tempPath, target);
+		try { await renameAtomic(tempPath, target); }
+		catch (error) { try { await fs.promises.unlink(tempPath); } catch { /* best effort */ } throw error; }
 		removeLegacyPoolSnapshot(root);
 	} catch {
 		// best-effort
@@ -190,7 +193,8 @@ function updatePoolSnapshotSync(ctx: GoalFileContext, root: string, mutate: (goa
 		const target = goalPoolSnapshotPath(ctx);
 		const tempPath = `${target}.${process.pid}.${Date.now()}.tmp`;
 		fs.writeFileSync(tempPath, JSON.stringify(snapshot), "utf8");
-		fs.renameSync(tempPath, target);
+		try { renameAtomicSync(tempPath, target); }
+		catch (error) { try { fs.unlinkSync(tempPath); } catch { /* best effort */ } throw error; }
 		removeLegacyPoolSnapshot(root);
 	} catch {
 		// best-effort
@@ -270,12 +274,27 @@ export function resolveGoalPath(ctx: GoalFileContext, rootRel: string, relPath:
 export function atomicWriteGoalFile(ctx: GoalFileContext, rootRel: string, relPath: string, content: string): void {
 	ensureDirectory(ctx, rootRel);
 	const filePath = resolveGoalPath(ctx, rootRel, relPath);
-	if (statIfPresent(filePath)?.isSymbolicLink()) {
+	const prior = statIfPresent(filePath);
+	if (prior?.isSymbolicLink()) {
 		throw new Error(`Refusing to write symlinked goal file: ${relPath}`);
 	}
 	const tempPath = `${filePath}.${process.pid}.${Date.now()}.tmp`;
-	fs.writeFileSync(tempPath, content, "utf8");
-	fs.renameSync(tempPath, filePath);
+	let fd: number | undefined;
+	let created = false;
+	try {
+		fd = fs.openSync(tempPath, "wx", prior ? prior.mode & 0o777 : 0o666);
+		created = true;
+		// open() applies the process umask even when replacing an existing file.
+		if (prior && process.platform !== "win32" && (prior.mode & 0o777 & process.umask())) fs.fchmodSync(fd, prior.mode & 0o777);
+		fs.writeFileSync(fd, content, "utf8");
+		fs.closeSync(fd);
+		fd = undefined;
+		renameAtomicSync(tempPath, filePath);
+	} catch (error) {
+		if (fd !== undefined) { try { fs.closeSync(fd); } catch { /* best effort */ } }
+		if (created) { try { fs.unlinkSync(tempPath); } catch { /* best effort */ } }
+		throw error;
+	}
 	invalidateGoalPathCaches(filePath);
 	invalidateGoalDirCache(goalStoragePath(ctx, rootRel));
 }

package/extensions/widgets/goal-controls-dialog.ts

@@ -156,7 +156,7 @@ export class GoalControlsDialog implements Component {
 					const conflict = main.find(([, binding]) => bindingKeys(binding).some(bound => sameGoalKey(bound, key, isKittyProtocolActive())));
 					if (conflict && row.action?.context !== "expanded" && row.action?.context !== "audit" && row.action?.context !== "dialog") problems.push(`${formatGoalKeybinding(key)} is used by Pi (${conflict[0]}). Choose a free key or change it in Pi's keybindings.json.`);
 				}
-			} catch { /* Older hosts expose fewer keymap inspection methods. */ }
+			} catch { /* Embeddings may omit keymap inspection. */ }
 		}
 		if (problems.length) { this.error = problems[0]!; return; }
 		this.mutate({ op: "set", path: row.path, value });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-goal-x",
-  "version": "0.33.0",
+  "version": "0.34.0",
   "description": "Adds /goal to pi: conversational goal planning, flexible or ordered goals, persistent progress, and an independent completion auditor.",
   "license": "MIT",
   "author": "pi-goal-x contributors",
@@ -76,9 +76,9 @@
     "test:controls-cli": "node experiments/controls/cli-walkthrough.mjs"
   },
   "peerDependencies": {
-    "@earendil-works/pi-ai": ">=0.83.0 <2.0.0",
-    "@earendil-works/pi-coding-agent": ">=0.83.0 <2.0.0",
-    "@earendil-works/pi-tui": ">=0.83.0 <2.0.0",
+    "@earendil-works/pi-ai": ">=1.4.0 <2.0.0",
+    "@earendil-works/pi-coding-agent": ">=1.4.0 <2.0.0",
+    "@earendil-works/pi-tui": ">=1.4.0 <2.0.0",
     "typebox": "^1.3.11"
   },
   "devDependencies": {
@@ -112,6 +112,6 @@
     }
   },
   "engines": {
-    "node": ">=22.15.0"
+    "node": ">=22.19.0"
   }
 }

package/extensions/goal-prompt-profile.ts

@@ -1,77 +0,0 @@
-import * as piAI from "@earendil-works/pi-ai";
-import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
-
-type Message = { role: string; content?: unknown; sections?: Record<string, string | null>; [key: string]: unknown };
-type SystemState = Message & { toolsAdded?: unknown[] };
-const transcript = piAI as unknown as {
-	getCurrentSystemMessage?: (messages: readonly Message[]) => SystemState | undefined;
-};
-const hostSections = new Set(["preamble", "tools", "rules", "docs", "addendum", "project_context", "skills", "cwd"]);
-const messageText = (content: unknown): string => typeof content === "string" ? content : Array.isArray(content)
-	? content.map(part => typeof part?.text === "string" ? part.text : "").join("") : "";
-
-/**
- * Pi 1.0's custom-trigger path skips prompt preparation until the first tool
- * response. Project the current public host prompt and transcript tool state at
- * its documented full-context boundary; never change persisted host history.
- */
-export function alignGoalPromptProfile(messages: readonly Message[], prompt: string): Message[] | undefined {
-	if (!transcript.getCurrentSystemMessage || !prompt) return;
-	const current = transcript.getCurrentSystemMessage(messages);
-	const firstSystem = messages[0]?.role === "system" ? messages[0] : undefined;
-	const firstText = messageText(firstSystem?.content);
-	// A content-only head can be an explicit override from another full-context
-	// handler. Respect it. Extra content alongside SDK sections is additive.
-	const content = firstText && !firstSystem?.sections ? firstSystem!.content
-		: firstText && !prompt.includes(firstText)
-			? Array.isArray(firstSystem?.content) ? [{ type: "text", text: `${prompt}\n\n` }, ...firstSystem.content] : `${prompt}\n\n${firstText}`
-			: prompt;
-	const extraSections = Object.fromEntries(Object.entries(current?.sections ?? {}).filter(([name, value]) =>
-		!hostSections.has(name) && typeof value === "string" && !prompt.includes(value)));
-	const head: Message = {
-		...firstSystem, role: "system", content, timestamp: firstSystem?.timestamp ?? 0,
-		sections: Object.keys(extraSections).length ? extraSections : undefined,
-		toolsAdded: current?.toolsAdded, toolsRemoved: undefined,
-	};
-	const output = [head];
-	for (const message of messages) {
-		if (message.role !== "system") { output.push(message); continue; }
-		if (message === firstSystem) continue;
-		// Additional instructions from other extensions stay at their original
-		// history boundary. Only host prompt/tool deltas have been replayed.
-		const text = messageText(message.content);
-		if (text && !prompt.includes(text)) output.push({ ...message, sections: undefined, toolsAdded: undefined, toolsRemoved: undefined });
-	}
-	return output;
-}
-
-export function registerGoalPromptProfile(
-	pi: ExtensionAPI,
-	isGoalContinuation: (ctx: ExtensionContext) => boolean,
-): void {
-	// Classic hosts have no transcript helpers. Structured hosts before the
-	// full-context event expose system messages through the ordinary hook.
-	if (!transcript.getCurrentSystemMessage) return;
-	let hostPreparesCustomTurns = false;
-	pi.on("before_agent_start", event => {
-		// Pi 1.2 introduced this public protocol together with native custom-
-		// turn preparation. Keep its structured prompt/tool deltas untouched.
-		const kind = (event as unknown as { messageType?: string }).messageType;
-		if (kind === "user" || kind === "custom") hostPreparesCustomTurns = true;
-	});
-	type FullContextOn = (event: "context_with_system", handler: (event: { messages: Message[] }, ctx: ExtensionContext) => unknown) => unknown;
-	(pi.on as unknown as FullContextOn)("context_with_system", (event, ctx) => {
-		if (hostPreparesCustomTurns || !isGoalContinuation(ctx)) return;
-		const messages = alignGoalPromptProfile(event.messages, ctx.getSystemPrompt());
-		return messages ? { messages } : undefined;
-	});
-	pi.on("context", (event, ctx) => {
-		if (hostPreparesCustomTurns) return;
-		// Modern hosts strip system messages from this event and restore them
-		// before context_with_system; let that public boundary own the repair.
-		const full = event.messages as unknown as Message[];
-		if (!full.some(message => message.role === "system") || !isGoalContinuation(ctx)) return;
-		const messages = alignGoalPromptProfile(full, ctx.getSystemPrompt());
-		return messages ? { messages: messages as unknown as typeof event.messages } : undefined;
-	});
-}