@cr1ms0n/pi-subagent 0.9.0 → 0.11.0

package/docs/RELEASING.md

@@ -1,32 +1,151 @@
-# Releasing @cr1ms0n/pi-subagent
-
-This is an independent community fork of `@parke.dev/pi-subagent` by Luke Parke. Preserve the MIT license and copyright, and do not publish this fork under the upstream scope. The upstream monorepo's tag automation does not publish this package.
-
-## Prepare
-
-1. Update `package.json` and `CHANGELOG.md`; use an unpublished version.
-2. Run strict type checking against the installed Pi version and offline fake-runner/extension tests. Do not run real provider calls without permission.
-3. Run `npm pack --dry-run --json` and review the file list. Do not include authentication, user settings, machine-specific paths, local backups, session transcripts or generated test bundles.
-4. Run `npm pack --ignore-scripts`, install the resulting tarball into an isolated prefix with `--ignore-scripts --legacy-peer-deps`, then repeat the offline checks against the packed source.
-
-## Publish
-
-Use an existing npm login or a securely supplied environment-based credential. Never put tokens in command text, source files, or a committed `.npmrc`. Enable TLS verification.
-
-```bash
-npm whoami --strict-ssl=true --registry=https://registry.npmjs.org/
-npm publish ./cr1ms0n-pi-subagent-<version>.tgz --access public --ignore-scripts --strict-ssl=true --registry=https://registry.npmjs.org/
-npm view @cr1ms0n/pi-subagent@<version> name version dist.integrity --strict-ssl=true --registry=https://registry.npmjs.org/
-```
-
-A successful public release makes every file in the tarball public. Verify the package metadata and registry integrity before replacing an existing installation.
-
-## Install and replace
-
-```bash
-pi install npm:@cr1ms0n/pi-subagent@<version>
-```
-
-Do not enable this package and `@parke.dev/pi-subagent` at the same time: both register the same tool names. Back up the old package selection, activate only the new package after verification, and keep the old source for rollback. Reload or restart Pi after changing packages. Configure `~/.pi/subagent.json` `jevRouting` (candidate models plus the credential environment variable) before spawning tasks.
-
-This fork uses the same config and persisted state paths as upstream. Switching packages is not a data migration. Upgrading must not overwrite user model choices or credentials.
+# Release and repository maintenance
+
+This is an independent community fork of Luke Parke's `@parke.dev/pi-subagent`. Preserve the original [MIT license](../LICENSE), copyright and upstream attribution. Do not publish under the upstream scope. This standalone repository does not inherit the upstream monorepo's tag automation.
+
+---
+
+### Choose the scope first
+
+A README or repository-presentation update does not require a new npm version, tag, GitHub Release, package installation or binary upload. An edit to a Release body should change only that body. A new package release is a separate operation with artifact verification and explicit publication approval.
+
+Read [package.json](../package.json), [CHANGELOG.md](../CHANGELOG.md), the working tree and index before making changes. Record the original local HEAD, remote main and any remote metadata you intend to update. Preserve unrelated modifications and existing commit history by default. A separately approved single-root conversion must follow the history-replacement safeguards below; do not infer that permission from a documentation update or another project’s release rules.
+
+---
+
+### Public source-tree boundary
+
+Commit production source, the distributed [subagent skill](../skills/subagent/SKILL.md), public documentation and package metadata. Keep local maintainer tooling and private artifacts out of the public tree: `.trellis/`, `.agents/`, `.codex/`, project-local `.pi/` configuration, `AGENTS.md`, `LOCAL-PATCH.md`, Trellis-named support files, credentials, sessions, logs, dependencies, generated bundles and tarballs.
+
+The product directory [skills/](../skills/) is not the local `.agents/skills/` directory. Never remove the product skill merely because local workflow skills are excluded. No Actions workflow or contributor guide is required for this manual release process.
+
+Do not stage or discard local `.gitignore` edits. Where exclusion rules are maintained in `.git/info/exclude`, preserve its existing content and keep that file local. Ignore rules do not untrack files already in Git. When a reviewed cleanup needs to stop tracking local files, use `git rm --cached -- <explicit paths>` after backing them up and verifying their contents; never delete the working copies to clean the public tree. An ordinary commit does not erase those files from older history.
+
+---
+
+### Documentation-only source updates
+
+Keep [README.md](../README.md) and [README.zh-CN.md](../README.zh-CN.md) synchronized in the same change. Preserve the language switch, package identity, original copyright and license links. Each README ends with one Linux.do acknowledgement; do not expand it into a community/contact section. Do not add a documentation-index table, contribution guide or stale release-promotion block to the landing page.
+
+Run the relevant [development checks](DEVELOPMENT.md), including relative-link and translation review, whitespace checks and the package dry run. A fresh checkout has no bundled test runner or typecheck script; do not claim upstream/private harness commands are available.
+
+Stage only explicitly reviewed paths. For example, when both README files are the complete change:
+
+```bash
+git add -- README.md README.zh-CN.md
+```
+
+Inspect the staged names:
+
+```bash
+git diff --cached --name-status
+```
+
+Inspect the actual staged patch:
+
+```bash
+git diff --cached
+```
+
+Create an ordinary commit after reviewing and approving its scope. Do not use broad `git add -A`, `--amend -a`, history squashing or a force push for documentation maintenance.
+
+Before an authorized push, re-read remote main and compare it with the value saved at the start. Stop on an unexplained change rather than accepting a new baseline. The local branch can be named differently from remote main; target the reviewed commit deliberately:
+
+```bash
+git push origin HEAD:refs/heads/main
+```
+
+Use a normal fast-forward push for ordinary maintenance. Afterward, confirm local HEAD and remote main match, read back affected files, and verify the intended current tree no longer exposes local-only paths. Update GitHub About fields only when that specific edit was approved, and re-read them afterward. Source push and About edits can succeed separately; report their actual status separately.
+
+---
+
+### Explicitly approved history replacement
+
+Only replace the main history when the repository owner has explicitly requested that scope. Preserve the original graph in a local-only backup ref and an external Git bundle, verify the bundle in a separate repository, and retain working-file and index backups. Construct a parentless candidate from the reviewed public tree; verify its tree and that its reachable history contains exactly one commit before changing the local branch. Local maintenance files must remain on disk.
+
+Before replacing remote main, obtain approval for the exact candidate and original remote SHA. Recheck remote state and use an explicit `--force-with-lease=refs/heads/main:<original-sha>` with only `<candidate-sha>:refs/heads/main`. Stop if the lease fails; never refresh the expected SHA to bypass it. Do not push backup refs, use an unqualified force or alter tags and other branches.
+
+Read back the remote commit, parent list and tree after the update. A single-root main history does not erase old objects from GitHub caches, other clones or local backups. It also does not authorize npm publication, installation or About changes.
+
+---
+
+### Prepare an npm release
+
+Only perform this section for an approved version release:
+
+1. Choose an unpublished version and update package metadata and changelog together. Keep README install examples consistent with the intended release.
+2. Run the checks available in the actual environment, as described in [development](DEVELOPMENT.md). A syntax transform is not a semantic typecheck. Record missing tooling and any separately configured typecheck/fixture results. Do not run real provider calls without permission.
+3. Inspect the package dry-run list for unexpected files.
+4. Pack the source, record the tarball's integrity, and test the packed source in an isolated installation where suitable offline verification is available. Do not imply a missing harness was run.
+5. Review the final name, version, tarball, contents and verification results before requesting publication approval.
+
+Dry-run contents:
+
+```bash
+npm pack --dry-run --ignore-scripts --json
+```
+
+Create the release artifact only when preparing a release:
+
+```bash
+npm pack --ignore-scripts
+```
+
+Install the reviewed artifact into a separate temporary prefix using `--ignore-scripts --legacy-peer-deps` if installation checks are part of the approved release scope. Never replace the working Pi installation merely to inspect a package.
+
+---
+
+### Publish with verified TLS
+
+Use an existing npm login or a securely supplied environment-based credential. Never put tokens in command text, source files, a committed `.npmrc` or diagnostics.
+
+If the environment contains `NODE_TLS_REJECT_UNAUTHORIZED=0`, remove that override before any credential-bearing registry operation. `--strict-ssl=true` does not undo a Node-level TLS override.
+
+In Bash:
+
+```bash
+unset NODE_TLS_REJECT_UNAUTHORIZED
+```
+
+In PowerShell:
+
+```powershell
+Remove-Item Env:NODE_TLS_REJECT_UNAUTHORIZED -ErrorAction SilentlyContinue
+```
+
+Check the authenticated account without displaying credentials:
+
+```bash
+npm whoami --strict-ssl=true --registry=https://registry.npmjs.org/
+```
+
+After explicit approval, publish the reviewed tarball. Replace `<version>` with the approved version:
+
+```bash
+npm publish "./cr1ms0n-pi-subagent-<version>.tgz" --access public --ignore-scripts --strict-ssl=true --registry=https://registry.npmjs.org/
+```
+
+Read the exact version's registry metadata:
+
+```bash
+npm view "@cr1ms0n/pi-subagent@<version>" name version dist.integrity --strict-ssl=true --registry=https://registry.npmjs.org/
+```
+
+Registry propagation can lag. A successful publish is not proof that the exact version is already readable. Verify name/version/integrity against the reviewed local artifact before replacing an installation; do not repeat a publication blindly after an uncertain response. All files in a published tarball become public.
+
+GitHub tags, Releases and attachments are separate from npm publication. Do not create or modify them implicitly. If explicitly requested, inspect the existing remote objects, use a tool that actually supports the operation, update only the approved fields/assets, then read back and verify the result.
+
+---
+
+### Install and replace
+
+Installation is a separate local change. After artifact verification and approval, replace `<version>` with the verified release:
+
+```bash
+pi install "npm:@cr1ms0n/pi-subagent@<version>"
+```
+
+Back up the old package selection/source and keep it for rollback. Do not enable this fork and `@parke.dev/pi-subagent` simultaneously: both register the same tools. Verify the physical installed package version and files rather than relying only on a command's exit status or the settings entry. Reload or restart Pi after changing packages.
+
+This fork uses the same configuration and persisted-state paths as upstream. Switching packages is not a data migration. Do not overwrite model choices or credentials during upgrades. Configure `jevRouting` in `~/.pi/subagent.json` before starting new tasks, as described in the [reference](REFERENCE.md#jev-routing).
+
+Report preparation, publication, remote synchronization and local installation as distinct states, including checks that could not be performed.

package/docs/ROADMAP.md

@@ -1,5 +1,7 @@
 # Roadmap
 
+> **Historical upstream roadmap.** Retained for rationale and deferred ideas, not as this fork's current release schedule. Phases 2-4 are recorded as shipped in [the historical execution plan](PLAN.md); their future-tense sketches below do not mean these features are missing. Jev routing supersedes the old model-selection assumptions. Use [the current reference](REFERENCE.md), [architecture contract](ARCHITECTURE.md) and [development checks](DEVELOPMENT.md) for current behavior and available tooling. Historical test claims are not verification results for this checkout.
+
 > Execution details for the remaining phases (work breakdown, acceptance
 > criteria, test plans, release gates) live in [PLAN.md](./PLAN.md). This
 > document holds the rationale, design sketches, and deferral decisions.

package/docs/SECURITY.md

@@ -6,11 +6,11 @@ and can use tools according to their capability profile.
 
 ## What subagents can do
 
-| Profile | Default tools | Writes? |
-|---------|---------------|---------|
-| `explore` | `read`, `grep`, `find`, `ls` (+ safe extras and Pi context tools) | No project-file writes |
-| `review` | same as explore | No project-file writes |
-| `general` | Jev-chosen subset of the full available locally permitted catalog (+ Pi context tools) | Yes if the selected tools include `bash`/`edit`/`write` |
+| Profile | Finalized tools | Writes? |
+|---------|-----------------|---------|
+| `explore` | Jev-chosen subset of locally permitted read-only candidates, plus available Pi context tools | No project-file writes |
+| `review` | Same as explore | No project-file writes |
+| `general` | Jev-chosen subset of the full available locally permitted catalog, plus available Pi context tools | Yes if write-capable tools are selected |
 
 Parallel mode defaults to `explore` to avoid concurrent shared writes.
 
@@ -50,20 +50,20 @@ Parallel mode defaults to `explore` to avoid concurrent shared writes.
    (RPC mode). Extension UI dialogs raised inside a child are auto-cancelled so
    they can never hang a run — which also means a child can never obtain
    interactive consent. Prefer restricted tools for async/background runs.
-11. **Steering messages** (`action: "steer"` and the overlay `s` key) inject text
-    into a running child's conversation with user-level authority. Anything that
-    can call the subagent tool can steer any live run in the same session.
-7. **Process cleanup.** On POSIX, children run in their own process group so tree
+7. **Steering messages** (`action: "steer"` and the overlay `s` key) inject text
+   into a running child's conversation with user-level authority. Anything that
+   can call the subagent tool can steer any live run in the same session.
+8. **Process cleanup.** On POSIX, children run in their own process group so tree
    kills work for ordinary descendants. Parent (re)start reaps orphans recorded
    under `~/.pi/subagent-locks/runs/` so resume cannot race a still-alive writer.
    Grandchildren that call `setsid()` can still escape a simple process-group kill.
-8. **Resume exclusivity.** Direct resume takes a durable per-session file lock;
+9. **Resume exclusivity.** Direct resume takes a durable per-session file lock;
    concurrent parents cannot append to the same child session.
-9. **Profiles are tool-selection policy, not a sandbox.** Children inherit
+10. **Profiles are tool-selection policy, not a sandbox.** Children inherit
    `$HOME`, SSH/cloud credentials, network access, and the parent filesystem.
    Git worktrees only isolate the checkout. For untrusted tasks, use an outer
    container/cgroup/network policy.
-10. **`max_cost` is accounting, not a hard provider gate.** Usage arrives after a
+11. **`max_cost` is accounting, not a hard provider gate.** Usage arrives after a
     turn; orphans may spend money the ledger never sees. It caps provider-reported
     execution cost only: TypeSafe reports routing tokens, not currency, so selector
     cost is unreported and outside `max_cost`. Combine with provider account
@@ -81,12 +81,11 @@ and synthesis select from the new task instruction rather than the assembled
 transcript. Task text and model descriptions are user content and can themselves
 contain secrets; there is no guaranteed redaction.
 
-The TypeSafe credential is read from the environment variable named by
-`jevRouting.apiKeyEnv` (default `TYPESAFE_API_KEY`) and sent only as an
-`Authorization` header to the fixed official HTTPS endpoint, with redirects
-disabled. It is never stored in the config file, prompts, argv, logs or results.
-Rotate any credential that has been pasted into a transcript or shared in
-conversation.
+Version `0.10.0` reads the TypeSafe credential from `jevRouting.apiKey` in the private user-level `~/.pi/subagent.json`. This is plaintext storage: restrict file access and protect editor backups and synchronized copies. Same-user processes, including children with filesystem access, may read it. Profiles and worktrees do not protect this file from those processes.
+
+The transport sends the key only as an `Authorization` header to the fixed official HTTPS endpoint, with redirects disabled. It does not automatically copy the key into prompts, selector JSON bodies, argv, child manifests, logs, receipts or results. Never serialize or log the complete routing configuration. Rotate any credential pasted into a transcript or shared in conversation.
+
+Published npm `0.9.0` uses the older environment-based mechanism. In `0.10.0`, `apiKeyEnv` is rejected with manual migration guidance and no environment fallback. Unrelated `PI_SUBAGENT_*` runtime settings remain supported.
 
 New extension-managed dispatch is Pi-only. A `backend: "codex"` or
 `backend: "claude"` new task is rejected before any selector or provider work,

package/docs/UX.md

@@ -41,14 +41,9 @@ The standalone pi-subagent provides rich TUI support for monitoring, inspecting,
   per-task stats, and a one-line tail (live activity or first output line).
 - Expanded (Ctrl+O / `app.tools.expand`): full task output capped with a dim
   `… +N lines` trailer pointing at the artifact/child session.
-- Expanded detail adds one bounded route line for Jev-routed runs: selected
-  execution model, selected tools (plus locally added control-plane tools),
-  selector version, confidence, outcome and selection latency. Legacy runs
-  simply have no route line.
+- Expanded detail adds a bounded route summary for Jev-routed runs: original selection, ranked probabilities, shared selected tools (plus locally added control-plane tools), selector version, answer-level confidence, outcome and selection latency. The actual execution model stays separate from the original choice. Large lists show a preview and total count; old runs without new fields remain readable. Compact results and completion notifications show at most the last five attempt models and label a shortened chain with its total attempt count.
 - Durations freeze at `endedAt`; running durations tick at render time.
-- Reliability annotations render inline: `[attempt 2]` during a same-model
-  retry, `[stalled 2m]` while the stall watchdog is flagging silence, and
-  `◐ wrapped up` on budget-stopped runs that concluded gracefully.
+- Reliability annotations render inline: `[attempt 2]` during retry/failover, the actual attempt model and bounded attempt chain, `[stalled 2m]` while the stall watchdog is flagging silence, and `◐ wrapped up` on budget-stopped runs that concluded gracefully. Availability failures can switch models only before tools begin; a stalled indicator is not a promise of another attempt.
 
 ### Footer status
 Terse and actionable only: `⚙ 2 running · 1 ready · /subagents`. Cleared when
@@ -80,6 +75,7 @@ text with run ids and a `wait { id }` pointer.
   failures bypass batching and flush immediately, carrying held successes.
 - A `wait` that already delivered the run suppresses the redundant
   notification (delivered-state is re-checked at flush time).
+- Model/attempt annotations use the actual execution history, not the immutable original Jev choice. Fallback creates no extra completion notification or delivery path.
 
 ### `/subagents` overlay
 - Header: title + running/ready counters + full usage ledger + rule.
@@ -129,11 +125,11 @@ usage and a bounded `Optional synthesis blocked: …` diagnostic instead of
 discarding or re-routing them.
 
 ### Plan results (tool output, not TUI)
-`action:"plan"` returns the resolved model/tools and the selector usage it
-incurred, and states that a later dispatch selects again. It starts no child and
-creates no run entry, so plan never adds an overlay row or ambient widget. A
-plan whose optional synthesis selection fails still returns the valid worker plan
-and labels only that synthetic stage blocked with its diagnostic.
+`action:"plan"` returns the initial model, a bounded probability-ranked candidate preview, common tools, effective total attempt limit and selector usage. Probabilities are selector preferences, not uptime estimates, and `confidence` belongs to the original answer. A plan reports no actual attempts; a later invocation selects again. It starts no child and creates no run entry, so plan never adds an overlay row or ambient widget. A plan whose optional synthesis selection fails still returns the valid worker plan and labels only that stage blocked with its diagnostic.
+
+### Failed-attempt output
+
+Earlier attempts retain bounded, attributed output previews and child-session pointers. If all attempts fail, the final state, failure reason, model and session stay authoritative; earlier text does not become that model's answer or a successful structured result. A human-readable earlier preview names its source attempt. Successful final JSON is never concatenated with failed JSON. Full output remains in existing child sessions, which are retained while referenced on the active branch. Compact views remain within their existing output limits.
 
 ## States
 - **Queued/Running**: spinner + live stats + activity tail from live text.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cr1ms0n/pi-subagent",
-  "version": "0.9.0",
+  "version": "0.11.0",
   "description": "Community fork of Luke Parke's pi-subagent with Jev model/tool routing and verified Pi child capabilities",
   "type": "module",
   "license": "MIT",
@@ -10,6 +10,13 @@
     "cr1ms0n (fork maintainer)"
   ],
   "homepage": "https://www.npmjs.com/package/@cr1ms0n/pi-subagent",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/awoaCrim/pi-smart-subagents.git"
+  },
+  "bugs": {
+    "url": "https://github.com/awoaCrim/pi-smart-subagents/issues"
+  },
   "keywords": [
     "pi-package",
     "pi",
@@ -31,6 +38,7 @@
     "skills",
     "docs",
     "README.md",
+    "README.zh-CN.md",
     "CHANGELOG.md",
     "LICENSE"
   ],

package/skills/subagent/SKILL.md

@@ -109,7 +109,7 @@ Pi path are **refused**, not silently degraded:
 - Prefer `max_turns`, `max_cost`, and/or `timeout_ms` on long or write-capable runs.
   `timeout_ms` is absolute: local preflight, Jev selection, setup, queue and
   runtime all count against it.
-- `output_schema` asks the child for a fenced `json:result` block (one repair round).
+- `output_schema` asks the child for a fenced `json:result` block. An otherwise successful invalid answer gets one repair round; a failed provider attempt neither repairs nor publishes structured output.
 - `context: "fork"` continues from a fork of the parent session.
 - Do not poll `status` in a tight loop. Use `wait` / `subagent_wait`, or let the
   completion notification arrive for `async: true` runs.
@@ -121,22 +121,27 @@ Pi path are **refused**, not silently degraded:
 
 Omit `model` and `fallback_models` on every new call: both are legacy fields,
 and an explicit value is rejected rather than bypassing selection. Jev chooses
-one execution model from the user's dedicated candidate list plus an individual
-include/exclude decision per eligible tool. The local policy then re-validates
+an initial execution model and probabilities for the user's eligible candidates, plus one task-based include/exclude decision per eligible tool shared by all attempts. The local policy then re-validates
 the answer: unknown or unsafe tools cannot launch, explore/review stay read-only,
 and management actions need no routing config or credential.
 
-There are no emergency or fallback models, and low confidence is accepted rather
-than treated as a threshold. A Jev timeout or API failure stops the affected new
-dispatch with an actionable error; existing runs stay queryable and cancellable.
-Transient child failures retry the already selected model and tool set within the
-original deadline, up to `max_retries`; a quality failure never reselects.
+A Jev timeout or invalid decision still stops new dispatch; there is no emergency model. A valid route retains every candidate probability and tries higher values first. Tied maxima keep the returned choice first; other ties follow configured order. Low confidence and zero probability are accepted, not thresholds. Per-model probability is a selector preference, not uptime or a separate confidence score.
+
+Recognized settled model-unavailable, temporary rate-limit/service and transport errors can advance to the next candidate only before any tool execution begins in the current invocation. Once a tool starts, or protocol evidence is uncertain, do not restart the child on another or the same model. Auth/configuration, quota/billing, context, invalid requests, task/schema quality, cancellation and exhausted budgets never trigger model switching. Historical resume/fork messages are not new tool execution.
+
+`max_retries` limits all extension-level extra attempts: 0 means one initial attempt; 2 means at most three attempts. The built-in default remains 1. Availability failure advances directly to the next candidate; candidate exhaustion never wraps. Conclusively pre-work infrastructure failures may retry the same model within that budget. Every attempt shares tools, absolute deadline and cumulative reported cost/turn budgets, with fresh exact-model/tool startup verification. Switching makes no extra Jev call. Pi's internal provider retries are separate, unchanged and may delay fallback.
+
+Plan/status distinguish original choice, ranked alternatives and actual attempts. Earlier failed output is retained as attributed previews/session pointers, not mixed into a later structured answer. All-failed tasks keep their final failure. Existing runs remain manageable without selector configuration or a credential.
 
 An optional candidate `thinking` value is an opaque Pi thinking-level string;
 common values include `off`, `minimal`, `low`, `medium`, `high`, `xhigh`, and
 `max`, but model-specific values are passed through unchanged. It is a default:
 explicit task, agent, and profile `taskDefaults.thinking` values override it.
-The extension re-reads `jevRouting` on each dispatch and injects the current
-routing guidance into the parent prompt. If `jevRouting` is missing or invalid,
-or the credential environment variable is unset, management remains available but
-new spawns, `/btw`, plan, resume, fork and synthesis are rejected.
+The extension re-reads `jevRouting` on each dispatch and injects non-secret
+routing guidance into the parent prompt. The user stores the TypeSafe credential
+in `jevRouting.apiKey` in the private `~/.pi/subagent.json`; do not read, display
+or copy the key into task text, prompts or output. Legacy `apiKeyEnv` is rejected
+with migration guidance; there is no environment fallback. If the config or key
+is missing or invalid, management remains available but new spawns, `/btw`, plan,
+resume, fork and synthesis are rejected. This config-file credential contract ships in
+npm 0.10.0; published npm 0.9.0 uses the old environment mechanism.

package/src/backend.ts

@@ -24,7 +24,7 @@
  */
 
 import type { ProtocolUpdate } from "./protocol.js";
-import type { TaskResult, TaskSpec } from "./types.js";
+import type { TaskResult, TaskSpec, ToolActivity } from "./types.js";
 
 /** Normalized event-stream parser contract, implemented per backend. */
 export interface BackendParser {
@@ -40,6 +40,21 @@ export interface BackendParser {
   getLiveText(): string;
   /** Completed messages so far. */
   getMessages(): import("@earendil-works/pi-ai").Message[];
+  /**
+   * Optional sticky current-invocation tool-activity observation used by the
+   * ranked failover gate. Parsers that do not implement it provide no
+   * conclusive evidence (callers must treat activity as unknown on the ranked
+   * path); the legacy unranked path is unaffected.
+   */
+  getToolActivity?(): ToolActivity | undefined;
+  /**
+   * Optional stop reason of the latest completed assistant message, used to
+   * suppress the ranked structured-output repair prompt and final publication
+   * after a settled provider error/abort. Absent means "not observable".
+   */
+  getAssistantStopReason?(): string | undefined;
+  /** Latest completed assistant text; empty must not fall back to earlier turns. */
+  getAssistantText?(): string | undefined;
 }
 
 export interface BackendInvocation {

package/src/config.ts

@@ -61,7 +61,7 @@ export interface SubagentConfig {
   lockRetentionDays: number;
   /** Legacy per-profile defaults. Model/fallback fields are retained for config compatibility but ignored by Jev routing. */
   taskDefaults?: TaskDefaultsByProfile;
-  /** Mandatory, user-owned Jev candidate configuration. Never contains a credential. */
+  /** Private Jev configuration including apiKey. Never log or serialize the whole config. */
   jevRouting?: JevRoutingConfig;
   /** Safe migration or parse failure; existing-run management remains available. */
   jevRoutingError?: string;

package/src/extension.ts

@@ -8,10 +8,13 @@ import { Value } from "typebox/value";
 import { defaultConfig, loadConfig, readConfigFile, type SubagentConfig } from "./config.js";
 import {
   formatDuration,
+  formatRankedPreview,
   formatStatusPreview,
   formatTokens,
   isActiveState,
   oneLine,
+  projectRoutingForDisplay,
+  projectAttemptsForDisplay,
   renderCallLine,
   renderRunLines,
   SPINNERS,
@@ -25,7 +28,7 @@ import { runTasks } from "./orchestrator.js";
 import { OutputManager } from "./output.js";
 import { parseDepth, parseSpawnPolicy, SPAWNS_ENV_VAR, validateSubagentRequest, type PreparedTask, type ParentContext, type PreparationOptions, type ResolvedTask } from "./policy.js";
 import type { ChildRunner } from "./runner.js";
-import { ProcessLockManager } from "./process-lock.js";
+import { ProcessLockManager, runRecordSessionIds } from "./process-lock.js";
 import { SessionScopedRunRegistry, snapshotFromLiveRun } from "./registry.js";
 import {
   ProviderSubagentParamsSchema,
@@ -49,6 +52,7 @@ import { eligibleModelCandidates, formatJevRoutingPrompt, toToolCandidates } fro
 import { JevRouter } from "./jev-router.js";
 import { routePreparedTasks, type RoutingCatalog } from "./dispatch-routing.js";
 import { runLocalPreflights } from "./dispatch-preflight.js";
+import { rankedMaxAttempts } from "./model-failover.js";
 import type { RoutingReceipt } from "./routing-types.js";
 import { buildRoutingEvent, foldRoutingReceipts, MAX_ROUTING_DELIVERY_IDS, ROUTING_ENTRY_TYPE, type PersistedRoutingEvent } from "./persistence.js";
 
@@ -318,7 +322,7 @@ function compactDetails(
       errorMessage: result.errorMessage?.slice(0, 1_000),
       usage: result.usage ?? emptyUsage(),
       model: result.model,
-      routing: result.routing,
+      routing: projectRoutingForDisplay(result.routing),
       thinking: result.thinking,
       profile: result.profile,
       canWrite: result.canWrite,
@@ -332,7 +336,8 @@ function compactDetails(
       wrappedUp: result.wrappedUp,
       stalledSince: result.stalledSince,
       attempts: result.attempts,
-      attemptedModels: result.attemptedModels,
+      ...projectAttemptsForDisplay(result, Math.min(4_096, perResultText)),
+      toolActivity: result.toolActivity,
       structuredOutput: result.structuredOutput,
       structuredError: result.structuredError,
     })),
@@ -430,7 +435,7 @@ async function runPlanPreflights(
   });
 }
 
-function formatPlanEntry(task: ResolvedTask, index: number) {
+function formatPlanEntry(task: ResolvedTask, index: number, maxRetriesDefault: number) {
   const agentNote = task.resolutionNotes.find((note) => note.startsWith("agent="));
   const agent = agentNote?.slice("agent=".length);
   return {
@@ -438,12 +443,16 @@ function formatPlanEntry(task: ResolvedTask, index: number) {
     label: task.label,
     agent,
     model: task.model,
-    fallbackModels: task.fallbackModels,
+    // The ranked route replaces legacy fallback semantics for this path: show
+    // the bounded ranked preview and the effective extension attempt budget.
+    rankedPreview: formatRankedPreview(task.routing?.rankedModels),
+    rankedTotal: task.routing?.rankedModels?.length,
+    maxAttempts: rankedMaxAttempts(task.maxRetries ?? maxRetriesDefault),
     thinking: task.thinking,
     profile: task.profile,
     access: task.canWrite ? "RW" : "RO" as const,
     tools: task.effectiveTools,
-    routing: task.routing,
+    routing: projectRoutingForDisplay(task.routing),
     budgets: {
       timeoutMs: task.timeoutMs,
       maxTurns: task.maxTurns,
@@ -466,8 +475,10 @@ function formatPlanText(mode: "single" | "parallel", plan: ReturnType<typeof for
     ].filter(Boolean).join(" ");
     return [
       `${entry.index + 1}. ${entry.label}${entry.agent ? ` [agent:${entry.agent}]` : ""} (${entry.profile}/${entry.access})`,
-      `   model=${entry.model ?? "(none)"} fallback_models=[${(entry.fallbackModels ?? []).join(", ")}] thinking=${entry.thinking ?? "(default)"} isolation=${entry.isolation}`,
-      `   tools=[${entry.tools.join(",")}]`,
+      `   model=${entry.model ?? "(none)"} thinking=${entry.thinking ?? "(default)"} isolation=${entry.isolation}`,
+      `   ranked_models=[${entry.rankedPreview ?? entry.model ?? "(none)"}]${entry.rankedTotal && entry.rankedTotal > 5 ? ` (total ${entry.rankedTotal})` : ""}`,
+      `   attempt_budget=${entry.maxAttempts} (max_retries limits EXTRA extension-level attempts; pre-tool availability failure advances the ranking, never wraps)`,
+      `   shared_tools=[${entry.tools.join(",")}]`,
       `   ${budgets}`,
       `   notes: ${entry.resolutionNotes.join(", ")}`,
     ].join("\n");
@@ -502,7 +513,7 @@ function guidelines(catalog?: Map<string, AgentDefinition>): string[] {
     "Profiles: explore/review are strictly read-only (safe for fanout); general offers the full available locally permitted catalog to Jev and may write. Explicit tools are a ceiling; agent tool defaults do not narrow candidates. Single tasks default to general, parallel tasks to explore.",
     "Parallel writers need isolation:'worktree' (each gets an isolated checkout; changed work lands on a branch). After a worktree run finishes, use action:'diff' to inspect, then 'apply' to bring changes into the main checkout or 'discard' to drop them.",
     "Set budgets: at max_turns/max_cost the child is steered to wrap up and given grace turns for a final answer (grace_turns tunes this); results end as 'partial' with wrappedUp:true when the child concluded. timeout_ms includes Jev selection, setup, queue and retries; max_cost excludes unreported TypeSafe currency; timeout results report the phase.",
-    "Transient child failures may retry on the already selected model/tools within the original deadline; no selector retries or fallback models. Task-quality failures never retry.",
+    "Transient child failures may retry within the same invocation: ranked Jev routes advance to the next probability-ranked candidate only for a recognized model-availability failure that settles before any tool execution, sharing one task-based tool set and the total max_retries attempt budget (0 = first attempt only; never wraps back). A tool that started, uncertain evidence, or auth/quota/context/schema failures stop without switching. No selector retries or emergency models are used. Task-quality failures never retry.",
     "context:'fork' starts a single child from a branched copy of this conversation — use it when the task depends on discussion context instead of re-explaining. Single-task only.",
     "Use async:true only when you have independent work meanwhile; then use action:'wait' with the run id (interruptible, does not cancel). action:'steer' injects mid-run guidance into a running child instead of cancel + retry.",
     "For parallel research, add synthesis:'<instruction>' to have one read-only child fold all outputs into a single brief, delivered first.",
@@ -614,7 +625,8 @@ function buildCompletionDetails(runtime: SessionRuntime, runIds: string[]): Comp
         tokens: (result.usage?.input ?? 0) + (result.usage?.output ?? 0),
         cost: result.usage?.cost ?? 0,
         model: result.model,
-        attemptedModels: result.attemptedModels,
+        attempts: result.attempts,
+        attemptedModels: projectAttemptsForDisplay({ attemptedModels: result.attemptedModels }).attemptedModels,
         pointers: taskPointers,
       };
     });
@@ -632,6 +644,7 @@ function buildCompletionDetails(runtime: SessionRuntime, runIds: string[]): Comp
       // Preserve the old top-level fields only for single-task consumers. The
       // complete per-task model/attempt data lives in tasks[].
       model: tasks.length === 1 ? first?.model : undefined,
+      attempts: tasks.length === 1 ? first?.attempts : undefined,
       attemptedModels: tasks.length === 1 ? first?.attemptedModels : undefined,
       pointers,
       tasks,
@@ -665,7 +678,7 @@ function scheduleMaintenance(runtime: SessionRuntime): void {
     const keep = new Set(runtime.registry.planSessionRetention().keep);
     const busy = new Set<string>();
     for (const record of runtime.locks.listRunRecords()) {
-      if (record.state === "running" && record.childSessionId) busy.add(record.childSessionId);
+      if (record.state === "running") for (const id of runRecordSessionIds(record)) busy.add(id);
     }
     for (const run of runtime.registry.getLiveRuns(runtime.key)) {
       for (const id of run.childSessionIds) busy.add(id);
@@ -912,6 +925,7 @@ export default function registerSubagent(pi: ExtensionAPI): void {
             state: run.state,
             preview: run.preview,
             model: run.model,
+            attempts: run.attempts,
             attemptedModels: run.attemptedModels,
             pointers: run.pointers,
             turns: run.turns,
@@ -920,7 +934,7 @@ export default function registerSubagent(pi: ExtensionAPI): void {
           }];
           return tasks.map((task) => {
             const attemptText = task.attemptedModels && task.attemptedModels.length > 1
-              ? `; attempts: ${task.attemptedModels.join(" → ")}`
+              ? `; attempts${task.attempts ? ` (${task.attempts} total)` : ""}: ${task.attemptedModels.join(" → ")}`
               : "";
             const label = tasks.length > 1 ? `${run.label}/${task.label}` : task.label;
             return `- [${run.id.slice(0, 8)}] ${label}: ${task.state}${task.model ? ` on ${task.model}` : ""}${attemptText}${task.preview ? ` — ${task.preview}` : ""}${task.pointers.length ? ` (${task.pointers.join(", ")})` : ""}`;
@@ -1025,6 +1039,7 @@ export default function registerSubagent(pi: ExtensionAPI): void {
           tokens: run.tokens,
           cost: run.cost,
           model: run.model,
+          attempts: run.attempts,
           attemptedModels: run.attemptedModels,
           pointers: run.pointers,
         }];
@@ -1041,7 +1056,7 @@ export default function registerSubagent(pi: ExtensionAPI): void {
           lines.push(truncateToWidth(`${glyph} ${theme.fg("dim", task.model ?? "model unknown")} · ${theme.bold(theme.fg("toolTitle", label))} ${theme.fg("dim", `[${run.id.slice(0, 8)}] ${stats}`)}`, width));
           if (task.preview) lines.push(truncateToWidth(`  ${theme.fg("dim", "⎿")} ${theme.fg("toolOutput", task.preview)}`, width));
           if (task.attemptedModels && task.attemptedModels.length > 1) {
-            lines.push(truncateToWidth(`  ${theme.fg("warning", `models: ${task.attemptedModels.join(" → ")}`)}`, width));
+            lines.push(truncateToWidth(`  ${theme.fg("warning", `models: ${task.attemptedModels.join(" → ")}${task.attempts && task.attempts > task.attemptedModels.length ? ` (last ${task.attemptedModels.length} of ${task.attempts})` : ""}`)}`, width));
           }
           if ((expanded || tasks.length === 1) && task.pointers.length) {
             lines.push(truncateToWidth(theme.fg("dim", `  ${task.pointers.join(" · ")}`), width));
@@ -1339,7 +1354,7 @@ export default function registerSubagent(pi: ExtensionAPI): void {
             const planned = await routePreparedTasks(synthetic, catalog, router, {
               purpose: "plan", signal: routingScope.controller.signal, assertOwner: routingScope.assertOwner,
             });
-            synthesis = { state: "resolved", plan: formatPlanEntry(planned[0]!, 0) };
+            synthesis = { state: "resolved", plan: formatPlanEntry(planned[0]!, 0, runtime.config.maxRetries) };
           } catch (error) {
             routingScope.assertOwner();
             synthesis = { state: "blocked", error: error instanceof Error ? error.message : "Optional synthesis routing failed." };
@@ -1348,7 +1363,7 @@ export default function registerSubagent(pi: ExtensionAPI): void {
         routingScope.assertOwner();
         await requireRoutingPersistence(runtime);
         routingScope.assertOwner();
-        const plan = resolved.map((task, index) => formatPlanEntry(task, index));
+        const plan = resolved.map((task, index) => formatPlanEntry(task, index, runtime.config.maxRetries));
         const mode = validated.mode as "single" | "parallel";
         const receipts = [...routingScope.receipts.values()];
         const selectorUsage = await claimRoutingUsage(runtime, { ids: new Set(receipts.map((receipt) => receipt.requestId)) });
@@ -1612,6 +1627,9 @@ export default function registerSubagent(pi: ExtensionAPI): void {
           wrappedUp: task.wrappedUp,
           stalledSince: task.stalledSince,
           attempts: task.attempts,
+          attemptedModels: task.attemptedModels,
+          toolActivity: task.toolActivity,
+          modelAttempts: task.modelAttempts,
           structuredOutput: task.structuredOutput,
           structuredError: task.structuredError,
         })),