Repository navigation
fix(pi): pause automatic continuation on interactive and RPC input - #7401
Conversation
Signed-off-by: Jim-jimu <3230103159@zju.edu.cn>
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| try { | ||
| const binding = await services.store.read(key) | ||
| if (!isCurrent()) return | ||
| if (!binding || binding.terminal || binding.autoResume === false) return |
There was a problem hiding this comment.
If interactive/RPC input arrives while /loopx resume is saving a previously paused binding, this read can still observe autoResume: false and return without advancing the generation. The pending resume then successfully persists autoResume: true; its fence check only returns null after that commit. The current instance remains locally blocked, but restarting Pi loses that fence and resumes automatic dispatch despite the newer owner input. This reproduces with a delayed resume write followed by ownerInput, then a new runtime over the same store. Ensure the newer input invalidates the pending durable re-arm even when the binding is already paused.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
Thanks for catching this. Fixed in e56bb04.
Owner input now revokes dispatch immediately and waits for all already-started resume/activation writes before reading and persisting the pause. A re-arm superseded while its read is pending returns before starting a write. A later explicit resume can still re-arm the session.
The regression tests cover both resume and activation interrupted during a pending read or write, using disposable file-backed storage and a new runtime after restart. They verify that no quota probe or automatic message occurs until a later explicit resume. Additional cases cover overlapping re-arms and a failed resume.
Of the seven new regression/control cases, five fail on the prior runtime and all seven pass with the fix. I also reran the three Pi Node suites at the current head, 9af5d73: all 90 tests pass.
Signed-off-by: Jim-jimu <3230103159@zju.edu.cn>
Signed-off-by: Jim-jimu <3230103159@zju.edu.cn>
Signed-off-by: Jim-jimu <3230103159@zju.edu.cn>
loopx-agent
left a comment
loopx-agent
left a comment
There was a problem hiding this comment.
Reviewer: model_agent · gpt-6.1-sol · OpenAI · declaration_source=runtime_reported · reasoning_effort=max.
详细中文评审
动机
受影响的是在 Pi 会话中启用 LoopX Goal 自动继续、随后提交自己新指令的用户。 新头已让已观察的 interactive/rpc 输入等待恢复写入后持久暂停；但没有观察到外部 input、只收到非自发 user 启动时，保留的后备暂停仍会在恢复交叠中消失。 实际 adapter 和文件存储验证中，interactive/rpc 均在重启后保持暂停；extension 来源的不同文本经 before_agent_start 后，磁盘仍为 true，原实例和重启实例各会取得配额并派发。 边界只包括既有 Pi 输入暂停和显式恢复，不把本 PR 当作完整自动压缩来源识别、安装后 Pi 或长期效果验收。
用户的新指令应先停止旧任务自动派发，再由 Pi 正常处理这条消息；后台恢复操作不能把已经发生的新输入覆盖掉。REQUEST_CHANGES，精确头 9af5d7366516d486462f613096721aaff6ccc1a4。 旧头的显式输入持久化问题已被本次修复，不把旧结论原样搬过来；剩余发现限于本 PR 声明保留的启动事件后备。
改动思路
原 adapter 观察输入、native runtime 决定继续、file store 保持唯一持久 owner；pendingRearms 是既有写入的本地依赖，不增加权限。 保留已验证的显式输入修复，只在同一个 pause helper 补齐非自发 user-start 后备的交叠撤销，不扩大到完整来源归因。 writeRearm 记录每个会话已经开始的 activation/resume 写入，显式 input 先同步挡派发，等待这些写入后再持久化 false。还在 re-arm 读状态之后加 fence 检查，让已被新输入取代的操作不再启动写入；这是有意义的同 owner 修复。
后备路径需要先区分自己的注入文本与其它 user start，不能把 extension 来源当作自发消息。但当前字符串后备先等待恢复 promise，仍引用等待前的旧 fence；resume 完成后会换掉这个 fence，于是后备在检查文本之前就返回。需要把“非自发启动也要暂停”的既有义务接进同一个撤销顺序，而非增加另一种持久权限或放弃原后备。
具体改动
完整六文件 +734/-66：既有 adapter +19/-3，runtime +121/-54，README +22/-9，新增182行 adapter tests、runtime tests增加383行、Python包装增加7行。新增的是 keyed pendingRearms 本地 promise 链，沿用原 file store、generation/CAS、authority、定时器和显式恢复；无新模块、依赖、CLI 或持久 schema。完整新头和上一个审查头的三个 Pi 文件增量都已重新查看，整份六文件范围重新判定。
规格来自先读的 Pi README@cdbdc14，并对照当前 README 的 Input boundary / Origin limits。external-input-pause、durable-newer-input-revocation、existing-authority-and-recovery 已在普通或显式输入路径实现；retained-nonown-start-fallback not_met。作者也明确保留“starts lacking observed external input”的 text fallback。这里不要求修复完整来源归因，也不要求给已被更早处理器消费且没有任何启动信号的消息造来源。#6107 维护者说明的完整自动压缩 producer 序列仍是独立范围，未据本 PR 宣称关闭。
关键代码讲解
before_agent_start@633：custom 调用显式 ownerInput，user 调用 userPrompt。不同文本的 foreign extension user start 在这里仍承诺走保守暂停；不需要知道该 extension 的完整身份就能确认文本不是本次注入。writeRearm@820：把已开始的原生 store.write 与先前未完成链一起等待，allSettled 让失败的恢复不阻止新输入尝试保存暂停，结束后清理映射。它跟踪 IO，不产生执行许可。pauseForInput@1048：ownerInput 先 revoke，所以恢复写完后它仍持有当前 fence 并写 false；字符串后备在 @1065 等待时没有 revoke，resume 结束把 fence 换成新的 open 对象，@1066 的 isCurrent 便返回，后面的 lastInjectedPrompt 比较和持久暂停都不会执行。
[P2] 让保留的非自发 user-start 后备也能撤销进行中的恢复。 独立程序实际载入 TS adapter 的注册 command/input/start handlers 和原生文件 store/runtime，只把 SDK/UI、CLI admission 回复设为合成值，并延迟正常的 resume rename。先正常注入并识别自己的任务，再以 abort 持久暂停；启动 resume，在 true 落盘前送入 extension-source input 和一条与 lastInjectedPrompt 不同的 user before_agent_start；释放正常提交并等所有 handler 完成。当前文件仍为 true，原 adapter 再取得1次配额并派发1次；替换运行时也再取得1次配额并派发1次，只有 resumed 通知，没有暂停。
同一实际 adapter 程序在不可变 main 基线 92a170f8c7419ac0e32f63a2103aa4bfe464d054 也暴露后备缺口，因此不把它称为新引入回归。相反，interactive 和 rpc 两个当前 adapter 控制都最终保存 false，原实例和重启的配额／派发均为0；同一物理 rename 程序在旧 PR头9e明确失败、当前9af通过，认可已有 finding 的修复。
在原 pauseForInput 内让非自发 user-start 后备也能撤销正在进行的恢复，区分原自发文本且保留后来显式恢复优先；最终持久 false、原实例及重启零配额／派发，再验证新的合法 resume。 修复不能把所有 extension 输入一律当外部，也不能破坏自发注入和后来明确 resume 的优先级。需要在相同 adapter/native 文件入口重跑这组后备、已修复显式输入、自发消息及合法恢复控制。
对主干的风险
新精确头独立90项 Node、97项 Python、root control-plane typecheck、改动 Python Ruff、diff、双语 RFC 检查与 semantic advisory 通过。原生文件的覆盖／同目录其它会话／未来未激活会话／同文逃逸／合法恢复控制在当前头和新 main 基线都重跑；新增未授权会话没有文件或配额。正常检查和作者新增七项用例通过，不覆盖上述实际 adapter 后备交叠反例。
标准门5项直接和15项选择检查全部通过，但必需后备暂停不变量仍失败，当前精确范围质量为 FAIL，aggregate 保留 quality_invalid_receipt。旧头未发布的审查、旧失败回执和新头修复证据都保留；没有复用旧 head 的批准或阻断，也没有改作者源码、删断言、豁免门或查询 hosted CI。
语义与 CI 对齐
复用已有 Pi source、binding、generation/CAS，两个本地 map 分别承接即时拒绝和已开始的写入依赖，不是新的 generic Goal 状态或 actor 权限。保存失败仍明确只保证当前实例停止。本人实际执行的 SDK 依赖被替身隔离；读过 Pi1.4源码，不等于执行安装后 Pi／真实 SDK session、TUI/RPC 或模型。这些、原生 Windows、完整来源问题和全套 CI 未验；作者146/145预算、其它历史失败与CI描述不作为本人的独立归因。关键失败由当前本地 native adapter/store 反例直接证明。
我的整体评价
REQUEST_CHANGES，限 9af5d7366516d486462f613096721aaff6ccc1a4。 当前 problem_context、long_horizon 和 user_experience 保留 not_yet_proven，因为已观察输入的持久修复得到认可，但保留的非自发启动仍可能让旧任务在新工作开始后再次派发。原 adapter 观察输入、native runtime 决定继续、file store 保持唯一持久 owner；pendingRearms 是既有写入的本地依赖，不增加权限。 保留已验证的显式输入修复，只在同一个 pause helper 补齐非自发 user-start 后备的交叠撤销，不扩大到完整来源归因。 增量机制有界，最小修复仍在同一 helper；无需更大重写或额外来源系统。没有渲染页面变化，visual_review 为 not_applicable。保留原讨论，不 dismiss/resolve、不合并；后续新头要执行当前完整计划，不能只看最后一个测试。
英文简短结论
English verdict: REQUEST_CHANGES — 9af5d73. The prior observed interactive/RPC re-arm race is repaired and independently passes real-file and actual-adapter restart controls. The retained non-own user-start fallback still awaits pendingRearms under the old resume fence; resume replaces it, so isCurrent returns before prompt classification and durable pause. Actual registered TS adapter/native-store execution leaves true and dispatches live and after restart. The immutable main base shares this fallback gap; no new-regression claim.90 Node/97 Python and selected checks pass; required fallback validation and exact quality remain failed. Repair the same helper while preserving own injection and later explicit resume.
| try { | ||
| // A paused snapshot is not final while an older resume/activation can | ||
| // still save autoResume=true. Revoke dispatch now, then read after those | ||
| // writes finish so this pause also survives a new runtime instance. |
There was a problem hiding this comment.
[P2] 保留的非自发 user-start 后备也应撤销进行中的恢复。字符串后备进入时没有 revoke，仍捕获 resume 的旧 fence；等待 pendingRearms 后，resume 已把它换成 open 对象，此处直接返回，尚未比较 lastInjectedPrompt 或保存暂停。实际注册 TS adapter + 原生文件存储复现：先暂停、延迟正常 resume rename，送 extension-source input 与不同文本的 user before_agent_start，释放提交后文件仍 true，原实例和新运行时各取得1次配额并派发1次。interactive/rpc 控制已修复并保持 false；main 基线也有后备缺口，不称新回归。请在同一 pause helper 保留后备的撤销／持久顺序，同时保留自己的注入文本及后来明确 resume 的优先权，补实际 adapter/重启回归。
There was a problem hiding this comment.
Fixed in 5ffde58.
The shared pause helper now classifies the fallback text before waiting for pending re-arms. A non-own start revokes the older operation and saves its pause after already-started writes finish. Completing an existing re-arm keeps its fence identity, so an overlapping classification is not discarded; a later explicit resume/activation creates a new identity and still takes priority. A failed classification read also leaves the current instance stopped with the unsaved-pause warning.
Added the requested registered-adapter regression with native file storage: delay the real resume rename, deliver extension-source input plus a different-text user start, then verify autoResume=false and zero quota/message dispatch both live and after adapter restart. Controls preserve own injected text, interactive/RPC input and later explicit resume. Runtime cases additionally cover resume/activation reads and writes, classification spanning resume completion, and classification failure.
The 11 added regression/control cases give 7 failures and 4 passes against the previous published runtime; all pass after the fix. Current validation: 101 Node tests, 103 focused Python/module-budget tests, 14 tests against the installed adapter files, and 15 selected premerge checks plus 5 direct checks passed. SDK/UI and CLI admission are synthetic in the new adapter tests; the file backend and registered adapter are real.
Also merged main at be1dc37. The old module-budget and Ruff failures now pass locally. Updated-head CI still needs to complete; the previous unrelated browser timeout is not claimed fixed.
|
按实现基线 Pi README和#6107 的维护者范围说明完成当前 已独立确认：interactive/RPC 的 pending re-arm 持久暂停已修复，旧 finding 的这一部分不再视为未解决。剩余 本结论不要求本 PR 完成未知生产者归因或关闭完整 #6107；90 Node／97 Python 及选择检查通过，必需后备不变量和精确质量仍失败。未合并或处理其它人的 review 状态。 |
Signed-off-by: Jim-jimu <49069997+bmh201708@users.noreply.github.com>
Signed-off-by: Jim-jimu <49069997+bmh201708@users.noreply.github.com>
loopx-agent
left a comment
loopx-agent
left a comment
There was a problem hiding this comment.
Reviewer: model_agent | gpt-6.1-sol | OpenAI | runtime_reported | reasoning_effort=max
动机
在 Pi 会话中启用 Goal 自动继续、随后提交新指令的用户。 旧版本在恢复写入交叠时可能丢失非自发启动的暂停；新版本保留新输入的暂停，重启后也不再派发旧任务。 实际注册 adapter 与原生文件存储中，interactive、RPC 和不同文本的 extension 启动均保存 false，原实例及重启实例的配额查询和派发均为零。 仅修 Pi 的输入暂停与显式恢复，不宣称完成全部提示来源归因、真实 Pi 模型采用或长程净收益。
APPROVE，精确 head 5ffde582e15ae74865bfd2f7eb1cb518018b04f9。 本次重新审查完整六文件，旧评审的非自发启动后备问题已有独立反例转正证据。用户的新消息仍由 Pi 处理；暂停的是后续 LoopX 自动任务。恢复仍用原 /loopx resume，没有新增确认轮次。
改动思路
原 adapter 观察输入，runtime 处理暂停与恢复，file store 仍是唯一持久 owner；两个本地映射分别记录即时拒绝和已开始的写入依赖。 本 PR 同批交付输入观察、持久暂停、重启和合法恢复；完整 producer 归因继续归 #6107。 单独增加 input handler 不能解决已经开始的恢复写入；只使用内存拒绝也不能跨重启保存新意图。继续复用原生 generation/CAS 和共享 pauseForInput 足够，无需新增来源数据库、持久字段或另一份权限 owner。
下面是源码与实际反例的对应关系，属于说明表，执行证据另列：
| 场景 | 旧9af | 当前5ff |
|---|---|---|
| pending resume + interactive/RPC | 已保存暂停 | 仍保存暂停 |
| pending resume + 不同文本 extension 启动 | true，原/重启各1次查询和派发 | false，原/重启均0 |
| 后来显式 resume | 原合法恢复入口 | 保留新身份及新鲜准入 |
具体改动
规范 loopx/pi_goal_mode/README.md，spec_revision be1dc37a008be7017b64b622f653b6707df5c544，已先于实现阅读；固定版本正文与#6107维护者范围共同界定本次边界。external-input-pause、durable-newer-input-revocation、retained-nonown-start-fallback、existing-authority-and-recovery 均在当前头通过原生入口与负例核验；不把父问题的完整 producer 识别扩成此切片的前置。
关键代码讲解
input / before_agent_start用宿主 source 区分 interactive/RPC，并返回 continue；custom 走明确暂停，其它启动保留自己的注入文本后备。extension 名字本身不是生产者身份。writeRearm只记录已开始的文件写入依赖，allSettled 保证旧写失败后仍可尝试保存新暂停。它不产生准入权限。pauseForInput先比较后备文本、再撤销并等待旧写入，最终按原 CAS 保存 false。旧恢复完成保留同一个 fence 对象；因此慢分类不会被误认为已过期。真正后来显式恢复才创建新身份。resume继续沿原绑定/代数和写入 owner，成功后才解除本地拒绝；下一 settle 必须重新读取配额。失败仍保持停止，不能由 idle 或普通输入重新开启。
整份 +899/-66 中，既有 runtime +130/-54、adapter +19/-3，测试增加725行，README +25/-9；没有新 production 模块、依赖、CLI 或持久 schema。最近一轮修复集中于同一 helper 的分类/等待顺序和 fence 完成身份，测试数量没有替代整体范围判断。
对主干的风险
独立执行101项 Node、103项 Python、root control-plane typecheck、必需 Ruff 与标准预检5直接+15选中，全部通过。独立旧探针实际加载注册 TS adapter 与原生 file store，只把 SDK/UI 与 CLI准入回复设为合成值、延迟真实 atomic rename。相同9af文件的 foreign fallback 仍保存 true、原实例与重启各1次查询/派发；当前三种来源都保存 false且全为0。原生 runtime单独重放得到相同结论。五项文件控制补验当前覆盖、同目录其它会话、未激活未来会话、同文逃逸与合法恢复。
不可变 main 的完整 adapter 探针会在首个显式输入暂停断言失败，因为没有 input handler；这是待修行为，不是完整通过。其后备单独原生文件反例也失败。已有自己的注入、后来明确恢复、read/write/CAS失败、abort/stop/dispose控制保留；没有调整断言或把基线错误规范化。origin/main 6e03576261a732a4447405172dd7196ef7ebefc3 相对be1的相关Pi文件未变。
语义与 CI 对齐
复用现有 source/messageType 和 autoResume/generation；两个 map 是宿主本地事实与 IO 依赖，不是新的通用状态分类。README 明确描述排队/同文/图片输入、旧写顺序、后来显式恢复、保存失败和来源限制，逐条保留原权限与 compaction 义务。未读取、等待或轮询远端 CI；历史 Windows/SDK/CI 结果不提升为当前独立资格。普通运行和现有工具没有被取消，没有新的模型或费用操作。
我的整体评价
无阻断 finding。long_horizon=improved 仅指新输入经过文件重启仍能保留暂停承诺；user_experience=improved 指用户消息继续正常处理、后续任务可控且恢复无新增确认。实际模型效率与费用收益没有测量。原 adapter 观察输入，runtime 处理暂停与恢复，file store 仍是唯一持久 owner；两个本地映射分别记录即时拒绝和已开始的写入依赖。 本 PR 同批交付输入观察、持久暂停、重启和合法恢复；完整 producer 归因继续归 #6107。
代码规模为必要的同 owner 修复，已采用共享 helper 的局部收敛；默认关闭隔离由实际未绑定/其它/未来会话控制验证，持久格式和权限未扩大。visual_review=not_applicable：Pi输入与继续控制流变化，六文件未改变页面、widget或首屏。未验范围为当前安装的真实Pi SDK/TUI/provider、原生Windows及完整提示来源归因；源码、文件和注册adapter资格不替代这些。旧讨论保留，不 dismiss/resolve、不合并；发布后单独读回当前批准收口与合并门。
English verdict: APPROVE at 5ffde58. Whole-PR review independently verifies the retained fallback repair with the same real-file/registered-adapter counterexample: previous9af dispatches live and after restart, current head stays paused for all three observed source paths.101 Node/103 Python, typecheck, required Ruff and standard premerge pass. Existing explicit recovery and scoped authority remain. Live Pi SDK/TUI, native Windows, complete provenance and causal efficiency remain unqualified; approval grants no merge or dismissal authority.
Goal And Delivered Outcome
Pi users can steer an active LoopX task or queue a follow-up while retaining control over subsequent automatic tasks. Queued interactive/RPC input bypasses
before_agent_start, and idle input identical to the last injected task was mistaken for LoopX's own message.This change observes
input.sourceand pauses subsequent LoopX dispatch for interactive/RPC input, including queued, identical-text and image-only input. Pi continues processing the user's messages, including compaction and recovery. Explicit/loopx resumestill requires fresh quota admission.The retained text fallback now also handles a non-own user start overlapping a pending resume or activation. It classifies the text before waiting for older writes, revokes the older operation, then persists the pause after those writes finish. Completing an existing re-arm retains its identity; a later explicit re-arm gets a new identity and takes priority.
Related to #6107. Target:
main. Initial implementation baseline:cdbdc14ea3963e6f6aec4d574a1b88baff965132. Latest merged main:be1dc37a008be7017b64b622f653b6707df5c544. This does not claim full producer attribution or resolution of the original automatic-context report.Implemented against
Specification: Pi Goal mode at the initial baseline, Pi v1.4.0 input/run-start contracts, and the pending-rearm fallback review.
inputand runtimeownerInput; queued/identical/image input casescontinue; earlier installed Pi SDK queue/recovery exercise described belowpauseForInput; registered adapter, native file storage and restart regressionsSelf-check: inspected the shared pause/re-arm ordering and reviewed the incremental diff; ran failing-before/passing-after tests against the previous published runtime and current source. The existing helper remains the state owner; no additional abstraction was needed.
Scope And Continuation
Complete within the external-input pause scope.
Earlier handlers can consume input before this extension observes it. Extension source alone does not identify the producer; the text fallback has that existing limitation. Already-submitted messages and running tools are not cancelled. Broader provenance remains under #6107.
Validation
5ffde582e15ae74865bfd2f7eb1cb518018b04f9.9af5d73gives 7 failed / 4 passed; all 11 pass with the fix. Full comparison is 94/101 before and 101/101 after, with zero cancelled tests.rename, deliver extension-source input plus a different-text user start, then verify saved pause and zero quota/message dispatch in both the live and restarted adapter. Own-extension, interactive and RPC controls included. SDK/UI and CLI admission responses are synthetic.tests/test_pi_goal_mode.py,tests/test_host_loop_runtime_parity.py,tests/test_slash_command_install.py,tests/test_agent_onboarding_pi_host.py, andtests/architecture/test_top_level_module_budget.py.tests,loopx/canary,loopx/control_plane,loopx/domain_packs,loopx/presentation; diff and bilingual RFC checks; semantic advisory.Earlier validation at
9af5d73included four installed Pi 1.4.0 SDK queue/compaction cases with synthetic provider/CLI responses. Those results predate this fallback fix and are not presented as current-head SDK qualification.Main synchronization includes #7415; the previously failing module-budget and Ruff checks now pass locally. The previous Release Artifacts run failed a separate browser chat-recovery timeout. That scenario has not been independently requalified here; new CI must establish its current outcome. Earlier baseline failures in the bound-startup fixtures and environment-limited full-suite attempt remain historical, not current-head passes.
Frontend / Visual Evidence
Type of Change / LoopX Area
Technical Direction
Governed continuation and preservation of user control.
Shared-authority RFC fixture impact
N/A: no shared-authority migration, provider routing or compatibility projection change.
Boundary Checklist