fix(autogoal,app): stale-handoff guard — age/provenance + boot auto-expire

phixx · claude · phixx · commit ae0b00cf1238 · 2026-06-28T08:59:08.000-05:00
Root-causes the SunoSavvy runaway: a handoff written ~3 days earlier
auto-presented as a one-click "claim this handoff" in a fresh unrelated
session; claiming it resumed an 8-step chain and the auto-loop ran away.

CENTER-AUDIT wf_5e11b0c7-efe (Angle A, CONFIRMED): a handoff is intentionally
cross-session, but (1) the claim path never consulted createdAt — handoffPanelMode
returned "claim" purely on (handoff exists) &amp;&amp; (no live goal), and (2) the plugin
boot cleanup unlinked terminal state + orphan chains but never touched the
handoff file, so it lingered forever and auto-presented as claimable.

Operator chose both fixes:

Renderer guard (any age) — goal-panel-pure.ts, goal-panel.tsx, en.ts
- New pure helpers: handoffAgeMs, isHandoffStale (warn &gt;=1 day or unparseable),
  formatHandoffAge ("3 days ago"), handoffOriginLabel; MAX_HANDOFF_AGE_MS (7d) /
  HANDOFF_WARN_AGE_MS (1d).
- Claim panel now shows age + origin session + "resumes an N-step chain",
  amber-warns when stale, and requires a two-step confirm (Claim -&gt; Claim
  anyway / Cancel). A bare click can never auto-claim; the confirm resets when
  the handoff stops being claimable.

Boot auto-expire backstop (7d) — goal-state.ts, server.ts
- Export MAX_HANDOFF_AGE_MS. Boot cleanup quarantines a handoff older than 7
  days by renaming to .goal-handoff.json.stale.&lt;ts&gt; (recoverable, mirrors
  corrupt-file quarantine). Fresh handoffs (legit "resume tomorrow") preserved.

Tests
- goal-panel-pure.test.ts (+10): age parsing, stale thresholds incl. the 3-day
  incident case, format buckets, origin label, threshold ordering.
- boot-stale-handoff.test.mjs (+3): 8-day quarantined (recoverable), 1-hour
  preserved, just-under-7-days preserved.

Verification: autogoal 1421/1424 (3 unrunnable shell tests), app 196/196 +
typecheck clean, desktop tsgo clean. Incident record:
docs/audits/2026-06-28-stale-handoff-incident.md.

Co-Authored-By: Claude Opus 4.7 &lt;noreply@anthropic.com&gt;
diff --git a/docs/audits/2026-06-28-stale-handoff-incident.md b/docs/audits/2026-06-28-stale-handoff-incident.md
@@ -0,0 +1,54 @@
+# Stale-handoff runaway — incident + fix (2026-06-28)
+
+## Incident (SunoSavvy)
+Opening a fresh session in `C:/Users/zerop/Development/SunoSavvy` showed a
+"claim this handoff" prompt already in the box. The handoff had been written
+~Jun 24 and sat **unclaimed for ~3 days**; claiming it (`resumedFromHandoffAt`,
+`metadata.setBy: "chain"`) **resumed an 8-step chain** and the auto-loop began
+nudging through it. The operator could not stop it.
+
+Emergency response: the SunoSavvy goal state was set `active → cleared` and the
+chain file removed (auto-loop only drives `active`). Backed up to
+`%TEMP%/sunosavvy-goal-backup-20260627-233705/` (reversible). Confirmed not
+re-arming over a 15s window.
+
+## Root cause (CENTER-AUDIT wf_5e11b0c7-efe, Angle A — CONFIRMED)
+A handoff is intentionally cross-session, but:
+1. **No age gate** on the claim path — `handoffPanelMode` returned `"claim"`
+   purely on `(handoff exists) && (no live goal)`; `createdAt` was never
+   consulted (`goal-panel-pure.ts`).
+2. **Not in boot cleanup** — the plugin boot block unlinked terminal state +
+   orphan chains but never touched `.goal-handoff.json` (`server.ts`), so a
+   handoff lingered forever and auto-presented as a one-click claim.
+
+(Adversarial verification of Angle A and Angles B/C did not complete — the
+workflow hit a session token limit. Angle B's orchestration concern — a late
+continuation firing at the chain — was independently addressed by the
+`stale-suppressed` continuation work shipped in v1.17.9-vc1.)
+
+## Fix (two-part, operator chose "both")
+
+### Renderer guard (any age) — `goal-panel-pure.ts`, `goal-panel.tsx`, `en.ts`
+- New pure helpers: `handoffAgeMs`, `isHandoffStale` (warn ≥ 1 day or
+  unparseable), `formatHandoffAge` ("3 days ago"), `handoffOriginLabel`
+  (short origin session id), plus `MAX_HANDOFF_AGE_MS` (7d) /
+  `HANDOFF_WARN_AGE_MS` (1d).
+- The claim panel now shows **age + origin session + "resumes an N-step chain"**,
+  amber-warns when stale, and requires a **two-step confirm** ("Claim" →
+  "Claim anyway"/"Cancel"). A bare click can never auto-claim. The confirm
+  resets if the handoff stops being claimable.
+
+### Boot auto-expire backstop (7 days) — `goal-state.ts`, `server.ts`
+- Exported `MAX_HANDOFF_AGE_MS`. Boot cleanup quarantines a handoff older than
+  7 days by renaming to `.goal-handoff.json.stale.<ts>` (recoverable, mirrors
+  corrupt-file quarantine). A fresh handoff (legit "resume tomorrow") is
+  preserved.
+
+## Tests
+- `goal-panel-pure.test.ts` (+10): age parsing, stale thresholds (incl. the
+  3-day incident case), format buckets, origin label, threshold ordering.
+- `boot-stale-handoff.test.mjs` (+3): 8-day handoff quarantined (recoverable),
+  1-hour preserved, just-under-7-days preserved.
+
+Verification: autogoal 1421/1424 (3 unrunnable shell tests), app 196/196 +
+typecheck clean, desktop tsgo clean.
diff --git a/packages/app/src/i18n/en.ts b/packages/app/src/i18n/en.ts
@@ -828,6 +828,11 @@ export const dict = {
   "session.goal.handoff.pending": "Pending handoff",
   "session.goal.handoff.liveRunPending": "Current run active. Claim becomes available when the live goal is cleared.",
   "session.goal.handoff.corrupt": "A handoff file exists but could not be read. Run doctor or remove the corrupt handoff before claiming.",
+  "session.goal.handoff.age": "Created {{age}}",
+  "session.goal.handoff.fromSession": "from {{session}}",
+  "session.goal.handoff.resumesChain": "Resumes a {{total}}-step chain.",
+  "session.goal.handoff.staleWarn": "This handoff has been waiting a while. Confirm before resuming.",
+  "session.goal.handoff.claimConfirm": "Claim anyway",
   "session.goal.progress": "Progress",
   "session.goal.runControls": "Run Controls",
   "session.goal.constraints": "Constraints",
diff --git a/packages/app/src/pages/session/goal-panel-pure.test.ts b/packages/app/src/pages/session/goal-panel-pure.test.ts
@@ -839,3 +839,68 @@ describe("C3: createOrderedChainRefresh backpressure option", () => {
     refresh.dispose();
   });
 });
+
+import {
+  handoffAgeMs,
+  isHandoffStale,
+  formatHandoffAge,
+  handoffOriginLabel,
+  MAX_HANDOFF_AGE_MS,
+  HANDOFF_WARN_AGE_MS,
+} from "./goal-panel-pure";
+
+describe("handoff staleness guard (SunoSavvy incident)", () => {
+  const NOW = 1_782_621_146_968; // fixed reference
+  const iso = (ms: number) => new Date(ms).toISOString();
+
+  test("handoffAgeMs: parses ISO and returns positive age", () => {
+    expect(handoffAgeMs(iso(NOW - 3 * 86_400_000), NOW)).toBe(3 * 86_400_000);
+  });
+
+  test("handoffAgeMs: unparseable createdAt → null", () => {
+    expect(handoffAgeMs("not-a-date", NOW)).toBeNull();
+    expect(handoffAgeMs("", NOW)).toBeNull();
+  });
+
+  test("handoffAgeMs: future timestamp (clock skew) clamps to 0", () => {
+    expect(handoffAgeMs(iso(NOW + 60_000), NOW)).toBe(0);
+  });
+
+  test("isHandoffStale: 3-day-old handoff is stale (the incident case)", () => {
+    expect(isHandoffStale(iso(NOW - 3 * 86_400_000), NOW)).toBe(true);
+  });
+
+  test("isHandoffStale: a 10-minute-old handoff is NOT stale", () => {
+    expect(isHandoffStale(iso(NOW - 10 * 60_000), NOW)).toBe(false);
+  });
+
+  test("isHandoffStale: unparseable age is treated as stale (suspicious)", () => {
+    expect(isHandoffStale("garbage", NOW)).toBe(true);
+  });
+
+  test("isHandoffStale: exactly at the warn threshold is stale", () => {
+    expect(isHandoffStale(iso(NOW - HANDOFF_WARN_AGE_MS), NOW)).toBe(true);
+    expect(isHandoffStale(iso(NOW - (HANDOFF_WARN_AGE_MS - 1)), NOW)).toBe(false);
+  });
+
+  test("formatHandoffAge: human-readable buckets", () => {
+    expect(formatHandoffAge(iso(NOW - 30_000), NOW)).toBe("just now");
+    expect(formatHandoffAge(iso(NOW - 5 * 60_000), NOW)).toBe("5m ago");
+    expect(formatHandoffAge(iso(NOW - 3 * 3_600_000), NOW)).toBe("3h ago");
+    expect(formatHandoffAge(iso(NOW - 1 * 86_400_000), NOW)).toBe("1 day ago");
+    expect(formatHandoffAge(iso(NOW - 3 * 86_400_000), NOW)).toBe("3 days ago");
+    expect(formatHandoffAge("nope", NOW)).toBe("unknown age");
+  });
+
+  test("handoffOriginLabel: shortens a long session id, null when absent", () => {
+    expect(handoffOriginLabel({ metadata: { sessionId: "ses_107bcba1dffen0VQjFx4El1ryQ" } } as never)).toBe("ses_107bcba1d…");
+    expect(handoffOriginLabel({ metadata: {} } as never)).toBeNull();
+    expect(handoffOriginLabel(null)).toBeNull();
+  });
+
+  test("thresholds: boot expiry is generous (7d) vs warn (1d)", () => {
+    expect(MAX_HANDOFF_AGE_MS).toBe(7 * 24 * 60 * 60 * 1000);
+    expect(HANDOFF_WARN_AGE_MS).toBe(24 * 60 * 60 * 1000);
+    expect(MAX_HANDOFF_AGE_MS).toBeGreaterThan(HANDOFF_WARN_AGE_MS);
+  });
+});
diff --git a/packages/app/src/pages/session/goal-panel-pure.ts b/packages/app/src/pages/session/goal-panel-pure.ts
@@ -1372,6 +1372,57 @@ export function handoffPanelMode(liveGoal: GoalState | null, store: GoalHandoffS
   return liveGoal ? "pending" : "claim"
 }
 
+// ── Handoff staleness (CENTER-AUDIT 2026-06-27, SunoSavvy incident) ──────────
+// A handoff is intentionally cross-session, but one left unclaimed for a long
+// time and then auto-presented as a one-click "Claim" in an unrelated new
+// session is the stale-handoff surprise that resumed an 8-step chain. The
+// renderer surfaces the age + origin and requires an explicit confirm at any
+// age; the plugin boot cleanup quarantines a handoff older than MAX.
+/** Boot-expiry threshold: a handoff older than this is quarantined at startup. */
+export const MAX_HANDOFF_AGE_MS = 7 * 24 * 60 * 60 * 1000
+/** Soft threshold: older than this, the claim panel shows an amber warning. */
+export const HANDOFF_WARN_AGE_MS = 24 * 60 * 60 * 1000
+
+/** Age of a handoff in ms, or null when createdAt is unparseable. Negative
+ *  (clock skew / future timestamp) clamps to 0. */
+export function handoffAgeMs(createdAt: string, now: number): number | null {
+  const created = Date.parse(createdAt)
+  if (!Number.isFinite(created)) return null
+  return Math.max(0, now - created)
+}
+
+/** True when the handoff is old enough to warrant a warning before claiming
+ *  (or its createdAt is unparseable — treat unknown age as suspicious). */
+export function isHandoffStale(createdAt: string, now: number, threshold = HANDOFF_WARN_AGE_MS): boolean {
+  const age = handoffAgeMs(createdAt, now)
+  if (age === null) return true
+  return age >= threshold
+}
+
+/** Human-readable handoff age, e.g. "just now", "5m ago", "3h ago",
+ *  "3 days ago". Returns "unknown age" when createdAt is unparseable. */
+export function formatHandoffAge(createdAt: string, now: number): string {
+  const age = handoffAgeMs(createdAt, now)
+  if (age === null) return "unknown age"
+  if (age < 60_000) return "just now"
+  const mins = Math.floor(age / 60_000)
+  if (mins < 60) return `${mins}m ago`
+  const hours = Math.floor(age / 3_600_000)
+  if (hours < 24) return `${hours}h ago`
+  const days = Math.floor(age / 86_400_000)
+  return days === 1 ? "1 day ago" : `${days} days ago`
+}
+
+/** Short, display-safe origin-session label for handoff provenance, e.g.
+ *  "ses_107bcba1…". Returns null when there's no session id. */
+export function handoffOriginLabel(state: GoalState | null | undefined): string | null {
+  const sid = (state as (GoalState & { metadata?: { sessionId?: unknown } }) | null | undefined)?.metadata?.sessionId
+  if (typeof sid !== "string") return null
+  const clean = cleanText(sid).trim()
+  if (!clean) return null
+  return clean.length > 14 ? `${clean.slice(0, 13)}…` : clean
+}
+
 export type SteerDraftDisposition = "retain" | "clear"
 
 export function steerDraftDisposition(input: {
diff --git a/packages/app/src/pages/session/goal-panel.tsx b/packages/app/src/pages/session/goal-panel.tsx
@@ -83,6 +83,9 @@ import {
   GOAL_TEMPLATE_TONES,
   actionCategoryShortLabel,
   handoffPanelMode,
+  formatHandoffAge,
+  isHandoffStale,
+  handoffOriginLabel,
   goalInterruptionWarningKey,
   isGoalPinnedModel,
   steerDraftDisposition,
@@ -1541,6 +1544,9 @@ export function GoalPanel(props: { goal: { store: GoalStore; refresh: () => Prom
   const [now, setNow] = createSignal(Date.now())
   const [controlError, setControlError] = createSignal<string | null>(null)
   const [confirmingClear, setConfirmingClear] = createSignal(false)
+  // Stale-handoff guard (SunoSavvy incident): claiming a handoff is a two-step
+  // confirm so a stale handoff cannot silently auto-claim into a new session.
+  const [confirmingClaim, setConfirmingClaim] = createSignal(false)
   const [newCommand, setNewCommand] = createSignal("")
   const [steerOpen, setSteerOpen] = createSignal(false)
   const [steerText, setSteerText] = createSignal("")
@@ -2633,6 +2639,12 @@ export function GoalPanel(props: { goal: { store: GoalStore; refresh: () => Prom
   //     null and the run is already in the history timeline.
   const liveGoal = createMemo(() => liveGoalOf(state()))
   const pendingHandoffMode = createMemo(() => handoffPanelMode(liveGoal(), handoff()))
+  // Reset the claim confirm whenever the handoff is no longer claimable
+  // (claimed elsewhere, cleared, or a live goal started) so the confirm
+  // never sticks across a state change.
+  createEffect(() => {
+    if (pendingHandoffMode() !== "claim") setConfirmingClaim(false)
+  })
   const terminalGoal = createMemo(() => terminalGoalOf(state()))
   const runnableChainSteps = () => {
     if (liveGoal()) return []
@@ -4898,12 +4910,40 @@ export function GoalPanel(props: { goal: { store: GoalStore; refresh: () => Prom
                         <div class="text-11-regular font-bold uppercase tracking-[0.08em] text-indigo-50">
                           {language.t("session.goal.handoff.pending")}
                         </div>
+                        {/* Provenance + age so a stale/foreign handoff is never
+                            mistaken for a fresh one. (SunoSavvy incident.) */}
+                        <div
+                          data-component="goal-handoff-provenance"
+                          class="mt-1 flex flex-wrap items-center gap-x-2 gap-y-0.5 text-[10px] leading-4"
+                          classList={{
+                            "text-amber-200/90": isHandoffStale(pending().createdAt, now()),
+                            "text-indigo-100/60": !isHandoffStale(pending().createdAt, now()),
+                          }}
+                        >
+                          <span class="font-semibold tabular-nums">
+                            {isHandoffStale(pending().createdAt, now()) ? "⚠ " : ""}
+                            {language.t("session.goal.handoff.age", { age: formatHandoffAge(pending().createdAt, now()) })}
+                          </span>
+                          <Show when={handoffOriginLabel(pending().state)}>
+                            {(origin) => (
+                              <span class="truncate">{language.t("session.goal.handoff.fromSession", { session: origin() })}</span>
+                            )}
+                          </Show>
+                          <Show when={Number(pending().state.metadata?.chainTotal ?? 0) > 1}>
+                            <span>{language.t("session.goal.handoff.resumesChain", { total: String(Number(pending().state.metadata?.chainTotal ?? 0)) })}</span>
+                          </Show>
+                        </div>
                         <div class="mt-1 truncate text-12-regular text-indigo-100/78">
                           {cleanText(pending().state.condition)}
                         </div>
                         <Show when={pending().note}>
                           {(note) => <div class="mt-1 truncate text-11-regular text-indigo-100/62">{note()}</div>}
                         </Show>
+                        <Show when={pendingHandoffMode() === "claim" && confirmingClaim() && isHandoffStale(pending().createdAt, now())}>
+                          <div class="mt-1 text-[10px] leading-4 text-amber-200/80">
+                            {language.t("session.goal.handoff.staleWarn")}
+                          </div>
+                        </Show>
                       </div>
                       <Show
                         when={pendingHandoffMode() === "claim"}
@@ -4913,14 +4953,39 @@ export function GoalPanel(props: { goal: { store: GoalStore; refresh: () => Prom
                           </div>
                         }
                       >
-                        <ActionButton
-                          label={language.t("session.goal.action.claim")}
-                          variant="primary"
-                          busy={busy() === "claim"}
-                          disabled={busy() !== null || !props.sessionID}
-                          class="h-8 shrink-0 px-3"
-                          onClick={() => void claimGoalHandoff()}
-                        />
+                        {/* Two-step confirm: a bare click never claims; the
+                            operator must confirm after seeing age + origin. */}
+                        <Show
+                          when={confirmingClaim()}
+                          fallback={
+                            <ActionButton
+                              label={language.t("session.goal.action.claim")}
+                              variant="primary"
+                              disabled={busy() !== null || !props.sessionID}
+                              class="h-8 shrink-0 px-3"
+                              onClick={() => setConfirmingClaim(true)}
+                            />
+                          }
+                        >
+                          <div class="flex shrink-0 items-center gap-1">
+                            <ActionButton
+                              label={language.t("session.goal.handoff.claimConfirm")}
+                              variant="primary"
+                              tone="danger"
+                              busy={busy() === "claim"}
+                              disabled={busy() !== null || !props.sessionID}
+                              class="h-8 shrink-0 px-3"
+                              onClick={() => void claimGoalHandoff()}
+                            />
+                            <ActionButton
+                              label={language.t("session.goal.action.cancel")}
+                              variant="ghost"
+                              disabled={busy() !== null}
+                              class="h-8 shrink-0 px-2.5"
+                              onClick={() => setConfirmingClaim(false)}
+                            />
+                          </div>
+                        </Show>
                       </Show>
                     </div>
                   </div>
diff --git a/packages/autogoal/src/goal-state.ts b/packages/autogoal/src/goal-state.ts
@@ -1618,6 +1618,13 @@ export function clearSteering(directory: string, now: number = Date.now()): { ok
 
 export const HANDOFF_FILE = ".opencode/.goal-handoff.json";
 
+/** Boot-expiry threshold for an unclaimed handoff. A handoff is intentionally
+ *  cross-session, but one left unclaimed this long is abandoned; the plugin
+ *  quarantines it at boot so it can't auto-present as claimable in an unrelated
+ *  new session. (CENTER-AUDIT 2026-06-27, SunoSavvy stale-handoff incident.)
+ *  Mirrors the renderer's MAX_HANDOFF_AGE_MS in goal-panel-pure.ts. */
+export const MAX_HANDOFF_AGE_MS = 7 * 24 * 60 * 60 * 1000;
+
 export interface HandoffPayload {
   /** ISO-8601 timestamp of when the handoff was created. */
   createdAt: string;
diff --git a/packages/autogoal/src/server.ts b/packages/autogoal/src/server.ts
@@ -20,7 +20,7 @@ import { tool } from "./plugin-api.js";
 import { exec } from "node:child_process";
 import { promisify } from "node:util";
 import { resolve, relative, isAbsolute } from "node:path";
-import { readFileSync, statSync, unlinkSync, existsSync } from "node:fs";
+import { readFileSync, statSync, unlinkSync, existsSync, renameSync } from "node:fs";
 import {
   readGoalStateResult,
   listCorruptArtifacts,
@@ -43,6 +43,9 @@ import {
   COMPLETE_RE,
   BLOCKED_RE,
   goalStatePath,
+  handoffPath,
+  readHandoffResult,
+  MAX_HANDOFF_AGE_MS,
   type GoalState,
   type GoalEvaluation,
   type GoalStatus,
@@ -1197,6 +1200,44 @@ export const server: Plugin = async ({ client, directory }) => {
     log("debug", "boot clear: chain check failed (non-fatal)", { error: String(err) });
   }
 
+  // Handoff file: quarantine an unclaimed handoff older than MAX_HANDOFF_AGE_MS.
+  // A handoff is intentionally cross-session (hand a goal to a future session),
+  // so it is NOT removed merely for being from another session. But one left
+  // unclaimed for >7 days is abandoned; presenting it as a one-click "Claim" in
+  // an unrelated new session is the stale-handoff surprise that resumed an
+  // 8-step chain (SunoSavvy 2026-06-27). The renderer also age-gates the claim
+  // (formatHandoffAge + two-step confirm); this backstop stops a truly-
+  // abandoned handoff from lingering as claimable across app restarts. Quarantine
+  // (rename to .stale.<ts>) rather than delete, mirroring corrupt-file handling,
+  // so it is recoverable.
+  try {
+    const hp = handoffPath(directory);
+    if (existsSync(hp)) {
+      const h = readHandoffResult(directory);
+      if (h.kind === "ok") {
+        const createdMs = Date.parse(h.value.createdAt);
+        const ageMs = Number.isFinite(createdMs) ? Date.now() - createdMs : Number.POSITIVE_INFINITY;
+        // Quarantine when older than the threshold OR when createdAt is
+        // unparseable (unknown age is treated as suspicious, same as the
+        // renderer's isHandoffStale).
+        if (ageMs > MAX_HANDOFF_AGE_MS) {
+          try {
+            const stamp = new Date().toISOString().replace(/[:.]/g, "-");
+            renameSync(hp, `${hp}.stale.${stamp}`);
+            log("info", "boot clear: quarantined stale handoff", {
+              ageDays: Number.isFinite(ageMs) ? Math.floor(ageMs / 86_400_000) : null,
+              createdAt: h.value.createdAt,
+            });
+          } catch (err) {
+            log("debug", "boot clear: handoff quarantine failed (non-fatal)", { error: String(err) });
+          }
+        }
+      }
+    }
+  } catch (err) {
+    log("debug", "boot clear: handoff check failed (non-fatal)", { error: String(err) });
+  }
+
   // ── User-facing notifications, frontend-agnostic ─────────────────────────
   // `client.tui.showToast` only renders in the terminal TUI; on the Desktop
   // (Electron) app it is a no-op. The conversation is the one shared surface, so
diff --git a/packages/autogoal/test/boot-stale-handoff.test.mjs b/packages/autogoal/test/boot-stale-handoff.test.mjs
