@caupulican/pi-adaptative 0.80.99 → 0.80.102

package/CHANGELOG.md

@@ -1,3 +1,206 @@
+## [0.80.102] - 2026-07-03
+
+### Fixed
+
+- Made the FFF lazy-install test suite environment-independent. Three tests asserted that
+  `@ff-labs/fff-node` was not resolvable — which held locally (the package resolves only via the
+  managed install) but failed in CI, where the declared dependency is installed by `npm ci`,
+  blocking v0.80.101 from publishing. `loadAvailableFffNodePackage`/`ensureFffNodePackage` now take
+  an optional injectable resolver-candidate list, and those tests pass an empty list to force the
+  "not available" precondition deterministically regardless of environment. Test-only; no runtime
+  behavior change. 0.80.102 republishes the 0.80.101 changes with this fix.
+
+## [0.80.101] - 2026-07-03
+
+### Added
+
+- Skills may declare a `thinking` level in their frontmatter (parsed and validated on load, invalid
+  values ignored), so a task-specific skill can carry its intended reasoning depth. The parsed value
+  is available wherever `Skill` objects flow; turn-scoped application of an active skill's thinking
+  is a follow-up (an extension can already apply it via the existing `ctx.setThinkingLevel()` hook).
+  Complements profile-level thinking, which is applied to the session across CLI startup, SDK
+  creation, `/profile` switch, and `/reload` (explicit `--thinking` still wins) — now covered by
+  tests, including its composition with per-tier router thinking (the router override wins for the
+  routed turn and restores the profile level after).
+- Per-tier thinking level for the model router: `modelRouter` now accepts `cheapThinking`,
+  `mediumThinking`, `expensiveThinking`, `executorThinking`, and `judgeThinking`. A routed turn
+  applies the configured thinking level for its tier (clamped to the routed model), so a
+  cheap/local tier can run at `low`/`off` while the expensive tier runs at `high` — thinking level
+  is now a cost/speed lever independent of the model choice. Unset per-tier thinking reproduces
+  today's inherit-and-clamp behavior exactly; the routing judge's own bounded completion uses
+  `judgeThinking` (default `off`). Executor-direct routes are matched before the cheap tier so they
+  read `executorThinking`, not `cheapThinking`. Each tier's thinking level is settable in the Model
+  Router settings submenu (an "(inherit)" option clears it to the default behavior).
+- `/models suggest` now opens an interactive picker over the validated local-model roster instead of
+  printing a list to retype: choosing a model installs it, probes its six fitness surfaces on the
+  actual hardware, and lands the role it was shaped for already pre-selected in the assignment step —
+  so a suggested model goes from pick to installed-and-set in one flow. The suggestion's shaped
+  `assignRole` (previously unused metadata) drives the pre-selection; non-tool-calling models carry
+  curator/judge/lane roles and never pre-select the executor role.
+- The model router now auto-manages the local ollama server: when a turn routes to a local (ollama)
+  model, pi ensures the server is up first — reusing an already-running server and the user's own
+  `~/.ollama` models (never pi's owned storage; a reuse-mode start omits the `OLLAMA_MODELS` override
+  that `/models add` still uses) or booting one if needed — so a local-routed turn never fails just
+  because the server wasn't started yet. A per-session "confirmed up" cache skips the health check on
+  later turns (re-checked only after a connection error from the same model). If the local model
+  can't be made ready (binary missing, or the server won't boot) the turn does not dead-end: a
+  visible warning states why (install steps inline when the binary is missing) and which tier is now
+  handling the turn, then it escalates to the next configured tier. The runtime is owned by
+  `AgentSession`, so headless/SDK turns get the same behavior and `/models` shares the one instance.
+- When a routed local model is missing only because the ollama binary itself isn't installed (not
+  because its server is down), an interactive session now asks first: "Install Ollama?", noting it's
+  a large one-time download, before doing anything. A "yes" downloads the pinned ollama release for
+  the current platform straight into pi's own `runtimes/ollama` directory (never `curl | sh`, never
+  outside pi's own directory) and extracts it — `.tar.zst` archives decompress via Node's own
+  built-in zstd support when available, falling back to a system `zstd` binary, with an honest error
+  if neither exists — then the turn proceeds on the original local model with no fallback needed. A
+  "no", a timeout, an install that itself fails, or a headless/SDK session with no interactive prompt
+  to ask through all fall straight through to the existing graceful tier-escalation warning above,
+  worded to say so honestly (an install attempt that failed is reported as a failed install attempt,
+  never re-labeled as if nothing was tried). The confirm dialog pauses the routing working-indicator
+  while it's on screen and hands it back right after, so the spinner and the dialog never compete for
+  the terminal at the same time.
+- New `pi-adaptative doctor` command plus an update/startup preflight that verify required tooling and
+  provision what pi owns. It checks FFF native search (managed — actually installs it if missing, via
+  the same path as lazy first-use), ripgrep, ollama (binary + server status), and python, reporting
+  each as present/missing with version/detail and, for tools pi doesn't own, guide-mode install steps
+  (printed, never executed — no `curl | sh`, no `sudo`). The preflight runs automatically after a
+  successful `pi-adaptative update` (best-effort, never fails the update), so an update actually
+  provisions the managed tooling instead of leaving it to lazy first-use — closing the "ran update on
+  another machine and FFF never got installed" gap. The interactive `doctor` shows install progress;
+  the background preflight stays quiet.
+
+### Fixed
+
+- FFF native search now provisions itself even for ordinary searches. `find`/`grep` decide
+  FFF-vs-fallback using their default result limit (1000/100), which exceeds the router's top-N
+  threshold, so the decision is "fallback" and the tool returned *before* ever calling `getFinder()`
+  — the call that triggers the lazy managed install of `@ff-labs/fff-node`. A machine that only ran
+  default-limit searches therefore never installed FFF at all (rg/fd silently handled everything, so
+  its speed was never available). Provisioning is now decoupled from the per-call routing outcome:
+  `find`/`grep` kick off the finder unconditionally via a new `safeGetFinder` that can never reject
+  (even if a custom backend's `getFinder` throws synchronously), reusing the same in-flight promise
+  when the call does route to FFF. A genuine install failure is now retryable instead of permanently
+  gating FFF out — the finder is always evicted so the next search re-enters — while a 30s cooldown
+  throttles the npm spawn itself, so repeated searches during an outage don't respawn npm each time.
+  An explicit `--offline`/`PI_OFFLINE` directive and unsupported platforms remain a stable no-retry
+  fallback. The last install outcome is recorded (`getLastFffInstallOutcome`) for a future
+  environment `doctor` check.
+- The user's prompt now appears on screen immediately when submitted, instead of appearing to hang
+  until the model router's routing judge finishes. The judge is a bounded LLM completion (seconds),
+  and the turn previously built and emitted the user message only *after* awaiting it, so the prompt
+  looked frozen right after Enter. `_promptUnserialized` now builds the user message and paints it (a
+  synthetic `message_start`) before the judge await, then reuses that same object for the turn; the
+  authoritative `message_start` emitted later is suppressed exactly once (reference-keyed via a Set),
+  so the message is still shown and persisted a single time, and extensions still observe it at the
+  real turn start (their visible behavior is unchanged).
+- While the model router's routing/prep phase runs — the gap after the prompt paints and before the
+  turn starts streaming, during which the routing judge makes a bounded LLM call — the interactive UI
+  now shows the existing "working" indicator as general processing feedback, so that gap no longer
+  looks frozen. It shows independently of the thinking level (this is routing feedback, not
+  model-thinking) and respects the user's working-indicator toggle. New UI-only `routing_start` /
+  `routing_end` session events bracket the phase and are emitted exactly once each — `routing_end`
+  fires on both the success and failure paths, so the indicator never spins on after a turn that
+  fails before it starts — and it hands off seamlessly into the normal streaming indicator.
+- Hardened the hardening sweep after a max-effort review of the working diff found nine regressions
+  and latent holes the first pass introduced or left open:
+  - `endWriteStream` (newly awaited by the bash executor) hung forever when the stream had already
+    errored or closed before the call — an errored stream never emits `finish`, so the `once`
+    listeners attached after the events fired and never resolved, hanging the bash tool on any spill
+    write error. It now resolves immediately for an already-finished/destroyed/closed/errored stream.
+  - The git-filter spill branch created its temp-file stream with no error handler, so a failed spill
+    write still advertised a "Full output:" path pointing at a partial or missing file. It now drops
+    the path on write error, matching the main capture path.
+  - The execution-time envelope path check resolved a target through `existsSync`, which reports
+    false for a DANGLING symlink — so a dangling symlink placed inside an allowed root resolved
+    lexically and escaped the envelope (the subsequent write follows the link). `safeRealpathSync`
+    now dereferences a dangling leaf via `lstat`/`readlink` with a hop cap, closing the escape.
+  - `applyWorkerActions` routed writes through an injectable fs seam while the scope check used the
+    real filesystem, so the two could disagree. The test-only seam (its sole injector) is removed;
+    scope check and write now share one filesystem of record.
+  - The context-GC auto-digest was fenced at RENDER time, regenerating a random boundary nonce on
+    every provider request (the GC transform re-runs per request) — a byte-unstable prompt prefix
+    that broke prefix caching, and double-wrapped/mangled an already-fenced digest. Fencing now
+    happens once at digest store time; GC renders it verbatim.
+  - A reflection write the gate marked "apply" recorded an `action:"apply"` audit with a rollback
+    plan even when the memory tool silently refused it (budget/drift/threat return `success:false`
+    without throwing) — a phantom rollback target that then failed not-found. A refused apply now
+    records an `apply_failed` audit with no rollback plan and is not rollback-eligible.
+  - The `/context` "withheld by the active resource profile" line fired even with NO active profile,
+    blaming a nonexistent profile for a plain user disable (and double-reporting alongside the
+    disable-wins warning). The count is now profile-only and empty when no profile is active.
+  - A durable `memory_replace`/`memory_remove` could never auto-apply even under a fully permissive
+    policy, because the contradiction branch short-circuited before every eligibility check — an
+    append-only incentive that degraded memory hygiene. A new `learningPolicy.autoApplySupersessions`
+    (default false, TUI-toggleable) lets a supersession fall through to the normal eligibility bars.
+  - Router-swapped turns restored the pre-turn tools/system-prompt unconditionally in `finally`,
+    silently clobbering a mid-turn extension change (e.g. `setActiveToolsByName`) that legitimately
+    replaced them. Restore now happens only when the live values are still exactly what the swap
+    assigned.
+  - The editor grant-widening guard was applied only to allow-framing: the block-framing all-enabled
+    branch still widened a closed grant to `{allow:["*"]}` for a kind the profile omitted, and the
+    editor let the literal `"*"` wildcard marker enter the working set as a fake resource id (so
+    unchecking one item under a `{allow:["*"]}` grant persisted `{allow:[…,"*"]}`, and the disabled
+    item kept loading). Both paths now gate on the same original-wildcard/grant-all check, and the
+    marker never enters the item set.
+- Fixed `executeBash` returning a full-output temp-file path before the file's write was flushed:
+  the artifact write went through an async stream that was `.end()`-ed but never awaited, so a caller
+  reading the path immediately could see partial or empty content (a load-dependent flake). The stream
+  flush is now awaited across the normal, git-filter, cancel, and error paths, so the returned path
+  always points at a complete file.
+- Fixed the context-GC auto-digest (a machine paraphrase of possibly attacker-influenced tool output)
+  being inlined into the prompt as bare prose: it is now wrapped in the standard untrusted-content
+  fence, the same boundary memory recall pages use, so an injection payload in the digest is framed as
+  data, not instructions.
+- Fixed profile-denied context files (AGENTS.md/CLAUDE.md/GEMINI.md) being read and processed as
+  content before the agents-kind profile filter: the loader now reads each candidate file's raw bytes
+  once purely to discover any embedded `<resource-profile>` blocks (unavoidable — a profile can be
+  defined in a file it then denies), and only sanitizes, threat-scans, and exposes files the profile
+  allows. A denied file's instructional content is never loaded into the session, and the redundant
+  double read of every context file is gone.
+- Fixed the profile resource editor silently widening a closed grant to a wildcard: when every id in a
+  kind's (possibly collapsed) universe was enabled, a no-change save re-encoded an enumerated grant
+  like `{allow:[alpha,beta]}` as `{allow:["*"]}`, auto-granting every future resource of that kind. The
+  save now preserves the enumerated list and only keeps `["*"]` when the grant was already a wildcard
+  (or grant-all was chosen explicitly).
+- Fixed skills, prompts, and extensions denied by the active resource profile being silently absent
+  from `/context`: it now reports "N skill(s)/prompt(s)/extension(s) withheld by the active resource
+  profile — grant the <kind> kind to restore them", the same visibility the withheld-AGENTS.md
+  warning already gave context files.
+- Fixed a silently-swallowed executor miss: when an executor-routed turn ran no toolkit command and
+  the reflex brain could not refine the request into an explicit instruction, the turn ended with no
+  retry and no explanation. It now surfaces a warning that the command did not run and no automatic
+  escalation happened (the no-frontier-fallback policy is unchanged).
+- Fixed router-swapped turns (G4) leaving the system prompt at the full tool surface: when a turn is
+  routed to a smaller model its tool set is filtered, but the system prompt still carried guidelines
+  and schemas for tools the routed model couldn't call — billed every request and confusing to a
+  cheap/local model. The prompt is now rebuilt for the routed model's filtered surface and restored
+  afterwards, including when the routed run throws.
+- Fixed the learning gate's contradiction branch being unreachable dead code: the reflection call site
+  hardcoded `contradictions: 0`, so a durable `memory_replace`/`memory_remove` — which overwrites or
+  deletes an existing memory fact (the reflection engine's confront-before-write conflict signal) —
+  could auto-apply and silently destroy prior knowledge. Such supersessions now route through the
+  contradiction branch (approval-gated proposal, audited); purely additive writes are unaffected.
+- Fixed a learning-policy cliff where enabling the policy with stock settings silently disabled
+  learning entirely: a below-confidence-threshold cue with no evidence returned a silent no-op
+  (reflectionSourceConfidence 50 < confidenceThreshold 90, reflection writes carry no evidence), so
+  every durable write was dropped with no apply and no audit trail. Below-threshold cues now degrade
+  to an approval-gated proposal that is audited and visible in `/autonomy diagnostics`, while staying
+  fail-closed — nothing auto-applies below the threshold.
+
+## [0.80.100] - 2026-07-02
+
+### Added
+
+- Added `/models suggest`: a curated roster of local models validated during pi's own small-model
+  research, each with the role it was shaped for — qwen3:1.7b as the toolkit executor/reflex
+  muscle, qwen3:0.6b as a minimal fast executor, and the Ternary-Bonsai family (1.7B search scout,
+  4B context-curator/reflex-brain, 8B routing-judge for larger machines) marked as non-tool-calling
+  lane/brain models. Each suggestion is a ready `/models add` ref; the roster is surfaced when no
+  local models are installed. No per-model score is baked in — fitness is host-dependent, so
+  `/models add` still auto-probes on the actual machine and the roster only encodes each model's
+  validated role.
+
 ## [0.80.99] - 2026-07-02
 
 ### Added

package/dist/core/agent-session.d.ts

@@ -29,6 +29,7 @@ import { type CustomMessage } from "./messages.ts";
 import { type ModelCapabilityProfile } from "./model-capability.ts";
 import type { ModelRegistry } from "./model-registry.ts";
 import { type StoredFitnessReport } from "./models/fitness-store.ts";
+import { type LocalRuntimeDeps, OllamaRuntime } from "./models/local-runtime.ts";
 import { type PromptTemplate } from "./prompt-templates.ts";
 import { type ModelFitnessReport } from "./research/model-fitness.ts";
 import { type ResearchRunResult } from "./research/research-runner.ts";
@@ -91,6 +92,10 @@ export type AgentSessionEvent = Exclude<AgentEvent, {
     success: boolean;
     attempt: number;
     finalError?: string;
+} | {
+    type: "routing_start";
+} | {
+    type: "routing_end";
 };
 /** Listener function for agent session events */
 export type AgentSessionEventListener = (event: AgentSessionEvent) => void;
@@ -148,6 +153,12 @@ export interface AgentSessionConfig {
      * defaults to the real, best-effort collector.
      */
     collectWorkspaceSources?: typeof collectWorkspaceSources;
+    /**
+     * Injected fetch/spawn/exists for the local (Ollama) runtime health-check + boot used by the
+     * model router before a turn routed to a local model (see _ensureLocalModelReady). Unit tests
+     * inject fakes so they never hit a real network/process; production defaults to the real ones.
+     */
+    localRuntimeDeps?: LocalRuntimeDeps;
 }
 export interface ExtensionBindings {
     uiContext?: ExtensionUIContext;
@@ -345,6 +356,8 @@ export declare class AgentSession {
     private readonly _brainCurator;
     private _lastCurationSkipReason;
     private _inertExtensionWarnings;
+    /** Extensions the active resource profile removed from the runtime set (surfaced in /context). */
+    private _profileDeniedExtensionCount;
     private _lastPreDigestSkipReason;
     private _unboundToolGrantWarnings;
     private _toolArtifactStore;
@@ -370,6 +383,12 @@ export declare class AgentSession {
     private _cwd;
     private _agentDir;
     private _collectWorkspaceSources;
+    private _localRuntimeDeps?;
+    /** Lazy, cached by baseUrl so the router path and any other caller share one instance per server. */
+    private _localRuntimes;
+    /** Server URLs confirmed reachable THIS session — skips the health-check round trip on every
+     * local-routed turn once warm. Keyed the same way as _localRuntimes. */
+    private _localRuntimeConfirmedUp;
     private _extensionRunnerRef?;
     private _initialActiveToolNames?;
     private _allowedToolNames?;
@@ -673,6 +692,16 @@ export declare class AgentSession {
     private _emit;
     private _emitQueueUpdate;
     private _lastAssistantMessage;
+    /**
+     * User messages already painted to the UI by an early, synthetic `message_start` fired from
+     * `_promptUnserialized` — before the model-router judge's bounded LLM call — so the prompt
+     * appears immediately instead of hanging until routing finishes. The real agent-loop run emits
+     * its own authoritative `message_start` for the SAME message object once the turn actually
+     * starts; `_handleAgentEvent` consumes (deletes) it from this set to suppress that one duplicate
+     * listener notification. Persistence is untouched: it stays keyed off `message_end`, which is
+     * never added here and never suppressed.
+     */
+    private _earlyDisplayedUserMessages;
     /** Internal handler for agent events - shared by subscribe and reconnect */
     private _handleAgentEvent;
     private _willRetryAfterAgentEnd;
@@ -797,13 +826,41 @@ export declare class AgentSession {
     private _buildSituationSoulPrompt;
     private _buildSelfModificationPrompt;
     private _buildAutonomyPrompt;
+    private _buildSystemPromptOptionsForToolNames;
     private _rebuildSystemPrompt;
+    /**
+     * Build a system prompt for a specific tool surface WITHOUT touching the session's base prompt
+     * state. Used for a router-swapped turn (G4): the routed model runs against a filtered tool set,
+     * so it must also receive a system prompt whose tool guidelines/snippets match that filtered
+     * surface — but the change is per-turn, so it must not mutate `_baseSystemPromptOptions` (which
+     * later turns and extension events read).
+     */
+    private _buildSystemPromptForToolNames;
     private _runAgentPrompt;
     private _isModelAvailableAndAuthed;
     private _resolveExecutorRoute;
     /** True if a run_toolkit_script tool result since `fromIndex` actually EXECUTED (not error/ambiguous). */
     private _executorTurnExecutedScript;
     private _buildExecutorRefinedPrompt;
+    /**
+     * Shared {@link OllamaRuntime} for a given server, lazily created and cached by baseUrl so every
+     * caller — the router's readiness gate below and any host UI's own model-lifecycle commands
+     * (e.g. `/models`) — sees and can stop the SAME pi-managed process instead of each tracking its
+     * own untracked child.
+     */
+    getLocalRuntime(baseUrl?: string): OllamaRuntime;
+    /** models.json registers a local model's baseUrl as `<server>/v1` (OpenAI-compat); the runtime's
+     * own health/boot endpoints are on the Ollama-native server root. */
+    private _deriveOllamaServerUrl;
+    /**
+     * If the last assistant message in this session was an error from THIS exact local server, a
+     * cached "confirmed up" flag would be stale (the server may have died mid-session) — drop it so
+     * the next ensure-check is a real one instead of trusting stale state.
+     */
+    private _invalidateLocalRuntimeIfLastCallFailed;
+    private _ensureLocalModelReady;
+    private _maybeInstallOllamaOnConsent;
+    private _ensureRouteModelReady;
     private _resolveModelRouterTurnRoute;
     private _resolveModelRouterModelForIntent;
     private _resolveConfiguredTierModel;
@@ -1021,6 +1078,21 @@ export declare class AgentSession {
     private _isToolOrCommandAllowedByProfile;
     private _hasToolOrCommandProfileGate;
     private _filterExtensionsForRuntime;
+    /**
+     * /context observations for skills/prompts/extensions the active resource profile removed from
+     * listings — the analog of the withheld-AGENTS.md warning. Strict UAC makes these silently absent,
+     * so a lean profile's effect on the resource surface stays visible. Counts are profile-scoped
+     * (skills/prompts via the profile-independent discovery universe filtered by the live profile
+     * filter; extensions via the runtime filter's denied tally). Empty when nothing is withheld.
+     *
+     * Uses `isResourceDeniedByActiveProfile` (profile-only), not `isResourceAllowedByProfile` (which
+     * also folds in the user's own legacy `disabledResources` list): a plain user-disabled resource
+     * must never be misattributed to "the active resource profile" — that case is already surfaced by
+     * the G14 disable-wins warning. With no active profile at all, the helper always reports nothing
+     * denied, so this naturally stays silent (extensions keep their own runtime-filter-derived count,
+     * which is already correctly zero absent a profile).
+     */
+    private _profileDeniedResourceObservations;
     private _reapplyActiveProfileModelSettings;
     private _initializeMemory;
     /** Register a memory provider contributed by an extension; applied on the next memory (re)init. */