@ferris1225/pi-subagents 0.10.0 → 0.12.0

package/README.md

@@ -23,6 +23,10 @@ agent, and keep the workflow moving without manual polling.
   elapsed time; completion also produces a concise notification.
 - **Per-agent configuration** — enable agents, pick model and thinking strength per agent,
   tune concurrency limits, and choose discovery scope from `/subagents-setup`.
+- **Automatic model fallback** — if an agent's model fails at the provider level before
+  producing any output, the run is retried once with the main window's current model.
+  Per-run only, never persisted: a transient provider hiccup does not silently downgrade
+  the configured model.
 - **Leaf processes** — child agents cannot access the `subagent` tool, so delegation cannot
   recurse.
 
@@ -44,15 +48,198 @@ The default configuration enables `explore`, `worker`, and `reviewer`.
 
 ## Included agents
 
-| Agent | Default | Access | Purpose |
-| --- | :---: | --- | --- |
-| `explore` | Yes | Read-only | Fast codebase reconnaissance and structured findings. |
-| `worker` | Yes | Full | Implements, fixes, refactors, and tests a self-contained task. |
-| `reviewer` | Yes | Read-only | Independent adversarial review of a diff before completion. |
+| Agent | Default | Access | Default model | Thinking | Purpose |
+| --- | :---: | --- | --- | --- | --- |
+| `explore` | Yes | Read-only | `claude-haiku-4-5` | `low` | Fast codebase reconnaissance and structured findings. |
+| `worker` | Yes | Full | `claude-sonnet-4-5` | `high` | Implements, fixes, refactors, and tests a self-contained task. |
+| `reviewer` | Yes | Read-only | `claude-sonnet-4-5` | `high` | Adversarial quality gate: diff review (default), plus plan, proposed-solution, codebase-health, and PR/issue validation. |
 
 Agents are Markdown files in `agents/`. Each file contains YAML frontmatter and a system
-prompt. User and project scopes can override a built-in agent with the same name.
+prompt. User and project scopes can override a built-in agent with the same name; the
+frontmatter defaults above are overridden by `agentModels` / `agentThinkingLevels` when set.
+
+### Agent prompts
+
+The prompts below mirror `agents/*.md` — the source of truth loaded at dispatch time. They are
+the contract: each agent's role, hard constraints, and output format. Prompt drift shows up
+here first.
+
+<details>
+<summary><code>agents/explore.md</code> — reconnaissance</summary>
+
+```markdown
+---
+name: explore
+description: Fast read-only codebase reconnaissance. Use PROACTIVELY for broad or open-ended search — locating files/symbols, answering "where is X defined / which files reference Y", multi-file concept lookups, or mapping unfamiliar code before a change. Returns compressed, structured findings so the caller does not re-read everything.
+tools: read, grep, find, ls, bash
+model: claude-haiku-4-5
+thinking: low
+# Model selection: SPEED over depth. Pick the fastest available model.
+# What matters: fast grep/find/read, structured output. What doesn't: deep reasoning.
+---
+
+You are an explore agent: a fast, read-only reconnaissance specialist. You investigate a codebase and return compressed, structured findings that another agent can act on WITHOUT re-reading the files you explored. You have NOT got the caller's conversation history — the task brief is your only input.
+
+## Hard constraints
+- You are READ-ONLY. Never create, edit, or delete files; never run mutating commands.
+- Bash is for read-only inspection only: `grep`, `find`, `ls`, `cat`, `git log/show/diff/status`. No installs, builds, or state changes.
+- Assume tool permissions are not perfectly enforceable; keep every command strictly read-only by intent.
+
+## When invoked
+1. Orient with `grep`/`find` to locate the relevant code fast. Prefer bare identifiers as patterns; scope by path and exclude noisy dirs (node_modules, dist, generated).
+2. Read KEY SECTIONS, not whole files. After 1-2 greps, read the top match instead of running more greps.
+3. Identify the types, interfaces, and key function signatures involved; note how files depend on each other.
+4. Record exact paths and line ranges so the caller can jump straight in.
+
+## Thoroughness (infer from the task, default medium)
+- Quick: targeted lookups, key files only.
+- Medium: follow imports and callers, read critical sections.
+- Thorough: trace dependencies across modules; check tests and types.
+
+## Collaboration
+- Your output feeds `worker` (or the main agent directly). Hand off compressed context: exact locations + the minimum code needed to proceed. Flag anything ambiguous so the caller can decide.
+
+## Output format
+## Files Retrieved
+1. `path/to/file.ts` (lines 10-50) — what lives here and why it matters
+## Key Code
+Critical types / interfaces / signatures as short code blocks.
+## Architecture
+A brief explanation of how the pieces connect.
+## Start Here
+Which file to look at first, and why.
+
+## Quality standards
+Terse and factual. Exact paths and line numbers. Compress — do not narrate your search process or pad with prose.
+```
+
+</details>
+
+<details>
+<summary><code>agents/worker.md</code> — implementation</summary>
+
+```markdown
+---
+name: worker
+description: General-purpose implementation agent with full tools in an isolated context. Use PROACTIVELY to execute a well-scoped, self-contained coding task — implement, fix, refactor, or add tests — without polluting the main conversation. Plans internally, then implements and verifies. Give it a complete, self-contained brief.
+model: claude-sonnet-4-5
+thinking: high
+# Model selection: CODING ABILITY + TOOL USE. The primary implementation model —
+# balance quality against cost. No `tools` field => inherits all tools (full capability).
+---
+
+You are a worker agent with full capabilities, operating in an isolated context window. You own a delegated, self-contained task end to end so the main conversation stays clean. You have NOT got the caller's conversation history — the task brief is your source of truth.
+
+## Standard operating procedure
+Work in phases. Do not skip planning or verification.
+
+### Phase 1 — Context
+Read the brief fully. If it references files, read them before editing. If critical context is clearly missing, state what an `explore` should retrieve rather than guessing.
+
+### Phase 2 — Plan
+Inspect existing code and conventions first. Form the smallest coherent root-cause change that satisfies the brief. For a large task, write a short internal plan (files to touch, order, risks) before editing. Do not refactor unrelated code or create docs unless the brief asks.
+
+### Phase 3 — Implement
+Make the change. Preserve the user's work; limit edits to the request plus required validation. Follow the project's existing error handling, naming, and style.
+
+### Phase 4 — Verify
+Run the project's format/build/tests when they exist (e.g. `tsc --noEmit`, the test runner). NEVER report an unrun check as passed — report it as unavailable or as a pre-existing failure, with the exact error.
+
+### Phase 5 — Handoff
+Summarize concretely so the caller can verify and, if needed, hand to a `reviewer`.
+
+## Collaboration
+- You cannot dispatch sub-agents (children are leaf processes with no `subagent` tool). When the
+  brief lacks context that needs broad code discovery, state concretely what an `explore` should
+  retrieve for the caller — do not guess.
+- Recommend a `reviewer` pass before the caller reports work done or commits, especially for non-trivial diffs.
+
+## Output format
+## Completed
+What was done, in a few lines.
+## Files Changed
+- `path/to/file.ts` — what changed.
+## Verification
+Which checks you ACTUALLY ran and their result (e.g. `tsc --noEmit` clean; `vitest` 12 passed). State explicitly anything you could not run and why.
+## Notes (if any)
+Follow-ups, decisions made, blockers. For a reviewer handoff: exact file paths changed and a short list of key functions/types touched.
+
+## Quality standards
+Root-cause fixes over patches. No unrelated churn. Honest verification — an unrun check is never a passed check.
+```
 
+</details>
+
+<details>
+<summary><code>agents/reviewer.md</code> — quality gate</summary>
+
+```markdown
+---
+name: reviewer
+description: Adversarial code reviewer and pre-commit quality gate. Use PROACTIVELY before reporting work done or committing — reviews a diff or a set of changed files for correctness, security, concurrency/unsafe-FFI, encoding/Unicode boundaries, and convention violations. Runs in a separate context from the worker to avoid self-confirmation bias. Read-only; never edits, builds, or runs tests. Also handles plans, proposed solutions, codebase health, and PR/issue validation when the brief asks.
+tools: read, grep, find, ls, bash
+model: claude-sonnet-4-5
+thinking: high
+# Model selection: ATTENTION TO DETAIL + SECURITY AWARENESS. This is the quality gate —
+# use the strongest available reasoning model.
+---
+
+You are a senior, adversarial code reviewer. Your job is to FIND WHAT IS WRONG, not to validate. Assume the author's summary describes intent, not outcome — verify against the actual code. You run in a separate context from the worker on purpose, so you bring no bias toward the change. You have NOT got the caller's conversation history.
+
+## Hard constraints
+- You are READ-ONLY. Do NOT modify files, run builds, or run tests.
+- Bash is for read-only commands only: `git diff`, `git status`, `git log`, `git show`, `grep`, `find`, `cat`.
+- Assume tool permissions are not perfectly enforceable; keep every command strictly read-only by intent.
+
+## Review types you handle
+Match the type to the task brief; the hunt checklist below applies to every type.
+
+### 1. Code diffs (default)
+1. Run `git diff` and `git status` to see the recent changes. If a specific file set was given, read those files.
+2. Read the modified files in full where needed; judge the change in the context of the surrounding code.
+
+### 2. Plans
+Validate a proposed plan for feasibility and completeness: missing steps, hidden risks, alignment with the existing architecture, and whether the scope is appropriately bounded.
+
+### 3. Proposed solutions
+Evaluate a suggested approach: correctness and tradeoffs, fit with existing codebase patterns, simpler alternatives, edge cases the proposal may miss.
+
+### 4. Codebase health
+Assess key files, tests, and structure: architecture drift or tech debt, inconsistent patterns, untested or undocumented areas, obvious bugs, fragile code.
+
+### 5. Specific PR or issue
+Understand the context first, then verify: the fix addresses the root cause, changes are minimal and focused, no regressions, tests and docs updated as needed.
+
+## Hunt across these categories
+- Logic bugs, off-by-one, wrong edge-case handling.
+- Error handling gaps; swallowed failures; unreported unrun checks.
+- Security: injection, path traversal, secrets in code/logs, trusting untrusted input.
+- Concurrency: shared mutable state, locks held across await, races.
+- Encoding/Unicode: assuming `char*`/files/CLI text is UTF-8; wrong `A` vs `W` Win32 APIs; boundary conversions.
+- Resource leaks; violations of the project's stated conventions.
+- Classify severity honestly. Distinguish blockers from nits; do not pad with style preferences.
+
+## Collaboration
+- Independent of `worker` by design — your verdict is the gate before commit. Fix nothing yourself; report so the caller can dispatch a worker.
+
+## Output format
+## Files Reviewed
+- `path/to/file.ts`
+## Critical (must fix)
+- `file.ts:42` — concrete issue and why it breaks.
+## Warnings (should fix)
+- `file.ts:10` — issue and suggested direction.
+## Suggestions (consider)
+- Optional improvements.
+## Verdict
+One of: APPROVE / APPROVE_WITH_NITS / REQUEST_CHANGES, plus a 2-3 sentence rationale.
+End with exactly one machine-readable line: `VERDICT: REVIEW_PASS` for APPROVE or APPROVE_WITH_NITS; `VERDICT: REVIEW_FAIL` for REQUEST_CHANGES.
+
+## Quality standards
+Specific file paths and line numbers. No vague feedback. A clean report means you looked hard, not that you found nothing to say.
+```
+
+</details>
 ## Workflow
 
 A typical flow is:
@@ -145,7 +332,8 @@ agent's default — its frontmatter `thinking`, else the global default). The gl
   "agentScope": "user",
   "maxConcurrency": 4,
   "maxParallelTasks": 8,
-  "maxSubagentDepth": 1
+  "maxSubagentDepth": 1,
+  "maxFixRounds": 2
 }
 ```
 
@@ -162,6 +350,7 @@ agent's default — its frontmatter `thinking`, else the global default). The gl
 | `maxConcurrency` | How many sub-agent processes run at once (1–16, default 4). Extra work waits in the queue. |
 | `maxParallelTasks` | Maximum tasks accepted by one parallel `subagent` call (1–32, default 8). |
 | `maxSubagentDepth` | Depth at which the `subagent` tool is no longer registered (default 1: the main session delegates, children are leaf processes). `0` disables the tool entirely. Read once at extension load. |
+| `maxFixRounds` | Auto-fix rounds when a reviewer returns `REVIEW_FAIL`: the extension dispatches a `worker` (briefed with the review's concrete findings) then a `reviewer` re-review, repeating up to this many times before waking the main agent with the full chain. `0` disables it (the main agent handles fixes itself). Default 2. The reviewer stays read-only and in its own context; the loop is orchestrated by the extension, not by the reviewer. |
 
 ### Configuration migration
 
@@ -181,6 +370,13 @@ configured agent model → current main-session model → agent frontmatter mode
 Unavailable configured models are replaced with a usable current-session model when possible
 and the repaired configuration is saved.
 
+At runtime, if an agent's model fails at the provider level before producing any output (bad
+model id, auth, thinking level, quota, ...), the run is retried **once** with the main window's
+current model. This per-run degradation is never persisted — a transient provider hiccup must
+not silently downgrade the configured model — and it does not apply to task-level failures
+(the model worked, the task failed), aborts, or timeouts. Results carry a `model fell back
+from …` note when it happened.
+
 Thinking strength uses this precedence: `agentThinkingLevels` entry → agent frontmatter `thinking` → `thinkingLevel` default.
 
 ## Agent discovery and overrides

package/agents/worker.md

@@ -28,7 +28,9 @@ Run the project's format/build/tests when they exist (e.g. `tsc --noEmit`, the t
 Summarize concretely so the caller can verify and, if needed, hand to a `reviewer`.
 
 ## Collaboration
-- Request `explore` first when the task needs broad code discovery you were not given.
+- You cannot dispatch sub-agents (children are leaf processes with no `subagent` tool). When the
+  brief lacks context that needs broad code discovery, state concretely what an `explore` should
+  retrieve for the caller — do not guess.
 - Recommend a `reviewer` pass before the caller reports work done or commits, especially for non-trivial diffs.
 
 ## Output format

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ferris1225/pi-subagents",
-  "version": "0.10.0",
+  "version": "0.12.0",
   "description": "Focused sub-agent delegation for pi: explore / worker / reviewer agents in isolated context, with proactive dispatch injection and per-agent model selection.",
   "type": "module",
   "license": "MIT",

package/src/config.ts

@@ -60,6 +60,14 @@ export const MAX_PARALLEL_TASKS_LIMIT = 32;
 export const DEFAULT_MAX_SUBAGENT_DEPTH = 1;
 /** Upper bound accepted for maxSubagentDepth (defensive clamp). */
 export const MAX_SUBAGENT_DEPTH_LIMIT = 4;
+/**
+ * How many automatic worker→reviewer fix rounds run when a reviewer returns
+ * REVIEW_FAIL before waking the main agent. 0 disables the auto-fix loop
+ * (the main agent is woken to dispatch fixes itself). Default: 2.
+ */
+export const DEFAULT_MAX_FIX_ROUNDS = 2;
+/** Upper bound accepted for maxFixRounds (defensive clamp). 0 disables the loop. */
+export const MAX_FIX_ROUNDS_LIMIT = 5;
 
 export interface SubagentsConfig {
 	/** Agent names that are discoverable and injected. Default: explore, worker, reviewer. */
@@ -91,6 +99,14 @@ export interface SubagentsConfig {
 	maxParallelTasks: number;
 	/** Depth at which the subagent tool is no longer registered. Default: 1. */
 	maxSubagentDepth: number;
+	/**
+	 * Auto-fix rounds when a reviewer returns REVIEW_FAIL: the extension dispatches
+	 * a worker (briefed with the review's concrete findings) then a reviewer
+	 * re-review, repeating up to this many times before waking the main agent with
+	 * the full chain. 0 disables it (the main agent handles fixes itself).
+	 * Default: 2.
+	 */
+	maxFixRounds: number;
 }
 
 export const DEFAULT_CONFIG: SubagentsConfig = {
@@ -105,6 +121,7 @@ export const DEFAULT_CONFIG: SubagentsConfig = {
 	maxConcurrency: DEFAULT_MAX_CONCURRENCY,
 	maxParallelTasks: DEFAULT_MAX_PARALLEL_TASKS,
 	maxSubagentDepth: DEFAULT_MAX_SUBAGENT_DEPTH,
+	maxFixRounds: DEFAULT_MAX_FIX_ROUNDS,
 };
 
 export function getConfigPath(agentDir: string = getAgentDir()): string {
@@ -151,6 +168,7 @@ export function normalizeConfig(raw: unknown): SubagentsConfig {
 		maxConcurrency: DEFAULT_CONFIG.maxConcurrency,
 		maxParallelTasks: DEFAULT_CONFIG.maxParallelTasks,
 		maxSubagentDepth: DEFAULT_CONFIG.maxSubagentDepth,
+		maxFixRounds: DEFAULT_CONFIG.maxFixRounds,
 	};
 
 	if (Array.isArray(raw.enabledAgents)) {
@@ -213,6 +231,11 @@ export function normalizeConfig(raw: unknown): SubagentsConfig {
 		config.maxSubagentDepth = Math.max(0, Math.min(MAX_SUBAGENT_DEPTH_LIMIT, Math.round(raw.maxSubagentDepth)));
 	}
 
+	// 0 disables the auto-fix loop (main agent handles fixes itself).
+	if (typeof raw.maxFixRounds === "number" && Number.isFinite(raw.maxFixRounds)) {
+		config.maxFixRounds = Math.max(0, Math.min(MAX_FIX_ROUNDS_LIMIT, Math.round(raw.maxFixRounds)));
+	}
+
 	return config;
 }
 

package/src/fixloop.ts

@@ -0,0 +1,76 @@
+/**
+ * Auto-fix loop: when a reviewer returns REVIEW_FAIL, the extension dispatches a
+ * worker (briefed with the review's concrete findings) and then a reviewer
+ * re-review, repeating up to maxFixRounds times before waking the main agent with
+ * the full chain. The reviewer stays read-only and in its own context; the loop
+ * is orchestrated by the extension layer, not by the reviewer itself, so the
+ * independence guarantee (no self-confirmation bias) is preserved.
+ *
+ * The main agent is never woken mid-loop: the reviewer's FAIL result is intercepted
+ * before delivery, the chain runs in the background, and only the final group
+ * (initial review → worker fixes → re-reviews) is delivered at the end.
+ */
+
+import { getResultOutput, isFailedResult, reviewVerdict, type SingleResult } from "./spawn.ts";
+import type { SubagentsConfig } from "./config.ts";
+
+/**
+ * Whether a completed result should trigger the auto-fix loop instead of being
+ * delivered to the main agent. Only a REVIEW_FAIL verdict from a healthy
+ * reviewer run counts; failed processes and passing reviews are delivered
+ * normally. Loop-internal re-review results never reach this path (they are
+ * awaited inside the loop, not delivered through the completion flow).
+ */
+export function shouldTriggerFixLoop(result: SingleResult, config: SubagentsConfig): boolean {
+	if (config.maxFixRounds <= 0) return false;
+	if (result.agent !== "reviewer") return false;
+	if (isFailedResult(result)) return false;
+	return reviewVerdict(getResultOutput(result)) === "fail";
+}
+
+/**
+ * Build the worker task brief for one fix round from a reviewer's findings.
+ * The worker gets the full review text so it can address concrete file:line
+ * issues, with instructions to fix only blockers and self-verify.
+ */
+export function buildFixTaskBrief(reviewerResult: SingleResult, round: number, maxRounds: number): string {
+	const review = getResultOutput(reviewerResult);
+	const remaining = maxRounds - round;
+	return [
+		`Auto-fix round ${round} of ${maxRounds} (triggered by a failed review).`,
+		``,
+		`A reviewer ran in an isolated context and returned REQUEST_CHANGES. Its full report:`,
+		`---`,
+		review,
+		`---`,
+		``,
+		`Fix the concrete blockers the reviewer flagged. Do NOT refactor unrelated code.`,
+		`Address every "Critical" item; address "Warnings" only if they are genuine.`,
+		`After editing, run the project's format/build/tests when they exist and report`,
+		`exactly what you changed (paths + short rationale) so a reviewer can verify.`,
+		remaining > 0
+			? `A reviewer will re-review your changes automatically after you finish.`
+			: `This is the last auto-fix round; the main agent will be woken with the full chain.`,
+	].join("\n");
+}
+
+/**
+ * The re-review brief handed to the reviewer after a worker fix round. Includes
+ * the prior review so the reviewer can verify the fixes without re-discovering
+ * the original issues.
+ */
+export function buildReReviewBrief(reviewerResult: SingleResult, round: number): string {
+	const review = getResultOutput(reviewerResult);
+	return [
+		`Re-review after auto-fix round ${round}.`,
+		``,
+		`The previous review (REQUEST_CHANGES) found these issues:`,
+		`---`,
+		review,
+		`---`,
+		``,
+		`Verify the worker's fixes address each blocker. Run \`git diff\` to see what changed.`,
+		`Classify honestly: APPROVE if blockers are resolved, REQUEST_CHANGES if not.`,
+		`End with your machine-readable verdict line as usual (VERDICT: REVIEW_PASS / REVIEW_FAIL).`,
+	].join("\n");
+}

package/src/index.ts

@@ -34,7 +34,8 @@ import {
 	getFinalOutput,
 	getResultOutput,
 	isFailedResult,
-	runSingleAgent,
+	reviewVerdict,
+	runSingleAgentWithModelFallback,
 	truncateResultOutput,
 	writeResultArtifact,
 	type SingleResult,
@@ -42,7 +43,8 @@ import {
 	type SubagentLiveEvent,
 	type UsageStats,
 } from "./spawn.ts";
-import { formatTaskSummary, formatToolActivity, monitor, statusColor, statusIcon, statusLabel } from "./monitor.ts";
+import { buildFixTaskBrief, buildReReviewBrief, shouldTriggerFixLoop } from "./fixloop.ts";
+import { formatTaskSummary, formatToolActivity, monitor, statusColor, statusIcon, statusLabel, type RunChainMeta } from "./monitor.ts";
 
 const NON_BLANK_TASK_OPTIONS = { minLength: 1, pattern: "\\S" } as const;
 
@@ -129,7 +131,10 @@ function formatCompletionBlock(result: SingleResult, maxResultLines: number): st
 	const usage = formatUsage(result.usage);
 	const output = getResultOutput(result);
 	const { text, truncated } = truncateResultOutput(output, maxResultLines);
-	const lines = [`### [${result.agent}] ${status}${usage ? ` (${usage})` : ""}`, "", `Task: ${formatTaskSummary(result.task)}`, "", text];
+	const fallbackNote = result.modelFallbackFrom
+		? ` (model fell back from ${result.modelFallbackFrom} to ${result.model ?? "main-window model"})`
+		: "";
+	const lines = [`### [${result.agent}] ${status}${usage ? ` (${usage})` : ""}${fallbackNote}`, "", `Task: ${formatTaskSummary(result.task)}`, "", text];
 	if (truncated) {
 		// The full text lives on disk so the main agent can read it on demand.
 		lines.push("", `(output truncated to ${maxResultLines} lines; full result: ${writeResultArtifact(output, result.agent)})`);
@@ -333,6 +338,98 @@ export default function (pi: ExtensionAPI): void {
 				};
 			}
 
+			/**
+			 * Dispatch one agent inside an auto-fix chain: tracked in the widget with a
+			 * groupId/relationLabel, but NOT delivered through the completion flow — the
+			 * chain owner assembles and delivers the whole group at the end.
+			 */
+			const launchInLoop = async (
+				agentName: string,
+				task: string,
+				signal: AbortSignal,
+				meta: RunChainMeta,
+			): Promise<SingleResult> => {
+				const agent = agents.find((candidate) => candidate.name === agentName);
+				if (!agent) return failedStartResult(agentName, task, `Unknown agent: "${agentName}".`);
+				const thinkingLevel = config.agentThinkingLevels[agent.name] ?? agent.thinking ?? config.thinkingLevel;
+				const runId = monitor.addRun(agent.name, task, agent.model, thinkingLevel, meta);
+				const onLive = makeLiveHandler(runId);
+				try {
+					const result = await runSingleAgentWithModelFallback(
+						{
+							defaultCwd: ctx.cwd,
+							agent,
+							agentName,
+							task,
+							thinkingLevel,
+							signal,
+							onLive,
+							makeDetails: makeDetails("single", true),
+						},
+						sessionRef,
+					);
+					finishRun(runId, isFailedResult(result) ? "failed" : "done");
+					return result;
+				} catch (error) {
+					finishRun(runId, "failed");
+					const errorMessage = error instanceof Error ? error.message : String(error);
+					return {
+						...queuedResult(agent, task, thinkingLevel),
+						exitCode: 1,
+						stderr: errorMessage,
+						stopReason: signal.aborted ? "aborted" : "error",
+						errorMessage,
+					};
+				}
+			};
+
+			/**
+			 * Run the auto-fix chain in the background: worker (briefed with the review's
+			 * findings) → reviewer re-review, up to maxFixRounds times. The main agent is
+			 * not woken mid-loop; the full chain is delivered as one group at the end.
+			 * Failures short-circuit: a crashed worker skips its re-review and delivers.
+			 */
+			const startFixLoop = (initialReviewerResult: SingleResult, parentGroupId: string): void => {
+				backgroundQueue.enqueue(
+					async (signal) => {
+						const chain: SingleResult[] = [initialReviewerResult];
+						let lastReviewer = initialReviewerResult;
+						for (let round = 1; round <= config.maxFixRounds; round++) {
+							if (!sessionActive) break;
+							const fixBrief = buildFixTaskBrief(lastReviewer, round, config.maxFixRounds);
+							const workerResult = await launchInLoop("worker", fixBrief, signal, {
+								groupId: parentGroupId,
+								relationLabel: `fix round ${round}`,
+							});
+							chain.push(workerResult);
+							if (!sessionActive || isFailedResult(workerResult)) break;
+							const reReviewBrief = buildReReviewBrief(lastReviewer, round);
+							const reviewResult = await launchInLoop("reviewer", reReviewBrief, signal, {
+								groupId: parentGroupId,
+								relationLabel: `re-review round ${round}`,
+							});
+							chain.push(reviewResult);
+							lastReviewer = reviewResult;
+							if (!sessionActive) break;
+							if (reviewVerdict(getResultOutput(reviewResult)) === "pass") break;
+						}
+						if (!sessionActive) return;
+						// Deliver the whole chain as one group; the loop's outcome always wakes
+						// the main agent (a passing chain reports success, a stuck one needs a human).
+						const items: CompletionMessageItem[] = chain.map((r) => ({
+							agent: r.agent,
+							block: formatCompletionBlock(r, config.maxResultLines),
+							triggerTurn: true,
+						}));
+						sendCompletionGroup(items);
+						completionBatcher.flush();
+					},
+					() => {
+						// Cancelled: each in-flight run was already finished by its launchInLoop path.
+					},
+				);
+			};
+
 			const startBackground = (agentName: string, task: string, cwd?: string): SingleResult => {
 				const agent = agents.find((candidate) => candidate.name === agentName);
 				if (!agent) return failedStartResult(agentName, task, `Unknown agent: "${agentName}".`);
@@ -347,17 +444,20 @@ export default function (pi: ExtensionAPI): void {
 					async (backgroundSignal) => {
 						let result: SingleResult;
 						try {
-							result = await runSingleAgent({
-								defaultCwd: ctx.cwd,
-								agent,
-								agentName,
-								task,
-								cwd,
-								thinkingLevel,
-								signal: backgroundSignal,
-								onLive,
-								makeDetails: makeDetails("single", true),
-							});
+							result = await runSingleAgentWithModelFallback(
+								{
+									defaultCwd: ctx.cwd,
+									agent,
+									agentName,
+									task,
+									cwd,
+									thinkingLevel,
+									signal: backgroundSignal,
+									onLive,
+									makeDetails: makeDetails("single", true),
+								},
+								sessionRef,
+							);
 						} catch (error) {
 							const errorMessage = error instanceof Error ? error.message : String(error);
 							result = {
@@ -371,6 +471,15 @@ export default function (pi: ExtensionAPI): void {
 						}
 
 						if (!sessionActive) return;
+						// Auto-fix loop: a REVIEW_FAIL from a main-agent-dispatched reviewer
+						// triggers a worker→reviewer chain (up to maxFixRounds) without waking
+						// the main agent. Loop-internal re-reviews never reach here (they are
+						// awaited inside launchInLoop); the initial review is delivered with
+						// the chain at the end.
+						if (shouldTriggerFixLoop(result, config)) {
+							startFixLoop(result, `fix-${runId}`);
+							return;
+						}
 						const failed = isFailedResult(result);
 						const completion: CompletionMessageItem = {
 							agent: result.agent,
@@ -470,7 +579,7 @@ export default function (pi: ExtensionAPI): void {
 				const pending = r.exitCode === -1;
 				const icon = statusIcon(pending ? "running" : isFailedResult(r) ? "failed" : "done", theme);
 				const usage = formatUsage(r.usage);
-				const model = r.model ?? "?";
+				const model = `${r.model ?? "?"}${r.modelFallbackFrom ? ` (fell back from ${r.modelFallbackFrom})` : ""}`;
 				const line = `${theme.fg("toolTitle", theme.bold("subagent "))}${icon} ${theme.fg("accent", r.agent)} ${theme.fg("dim", `· ${model}${r.thinking ? ` · thinking ${r.thinking}` : ""}${pending ? " · background" : ""}${usage ? ` · ${usage}` : ""}`)}`;
 				return new Text(line, 0, 0);
 			}
@@ -483,7 +592,7 @@ export default function (pi: ExtensionAPI): void {
 				const pending = r.exitCode === -1;
 				const icon = statusIcon(pending ? "running" : isFailedResult(r) ? "failed" : "done", theme);
 				const usage = formatUsage(r.usage);
-				const model = r.model ?? "?";
+				const model = `${r.model ?? "?"}${r.modelFallbackFrom ? ` (fell back from ${r.modelFallbackFrom})` : ""}`;
 				lines.push(`  ${icon} ${theme.fg("accent", r.agent)} ${theme.fg("dim", `· ${model}${r.thinking ? ` · thinking ${r.thinking}` : ""}${pending ? " · background" : ""}${usage ? ` · ${usage}` : ""}`)}`);
 			}
 			return new Text(lines.join("\n"), 0, 0);
@@ -518,7 +627,10 @@ export default function (pi: ExtensionAPI): void {
 						for (const r of runs) {
 							const icon = statusIcon(r.status, theme);
 							const label = theme.fg(statusColor(r.status), statusLabel(r.status));
-							lines.push(truncateToWidth(` ${icon} ${monitor.summarize(r)} · ${label}`, width, ""));
+							// Chain-internal runs (auto-fix worker/reviewer) indent under their
+							// parent reviewer; summarize() already carries the relationLabel.
+							const head = r.groupId ? theme.fg("dim", "  ↳ ") : " ";
+							lines.push(truncateToWidth(`${head}${icon} ${monitor.summarize(r)} · ${label}`, width, ""));
 							if (r.status === "queued" || r.status === "running") {
 								lines.push(truncateToWidth(theme.fg("dim", `     task: ${formatTaskSummary(r.task)}`), width, ""));
 							}

package/src/monitor.ts

@@ -36,6 +36,16 @@ export interface RunView {
 	startedAt?: number;
 	/** Epoch ms when the run finished (set on "done"/"failed"). */
 	endedAt?: number;
+	/** When set, this run belongs to an auto-fix chain (e.g. worker fixing a reviewer's findings). */
+	groupId?: string;
+	/** Human-readable role within a chain, e.g. "fix round 1" or "re-review round 1". */
+	relationLabel?: string;
+}
+
+/** Optional chain metadata for runs spawned by an auto-fix loop. */
+export interface RunChainMeta {
+	groupId?: string;
+	relationLabel?: string;
 }
 
 // ---------------------------------------------------------------------------
@@ -168,7 +178,7 @@ export class MonitorStore {
 		this.notify();
 	}
 
-	addRun(agent: string, task: string, model?: string, thinking?: string): number {
+	addRun(agent: string, task: string, model?: string, thinking?: string, meta?: RunChainMeta): number {
 		const id = this.nextId++;
 		this.runs.push({
 			id,
@@ -178,6 +188,8 @@ export class MonitorStore {
 			thinking,
 			status: "queued",
 			usage: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0, cost: 0, contextTokens: 0, turns: 0 },
+			...(meta?.groupId ? { groupId: meta.groupId } : {}),
+			...(meta?.relationLabel ? { relationLabel: meta.relationLabel } : {}),
 		});
 		this.notify();
 		return id;
@@ -233,6 +245,7 @@ export class MonitorStore {
 	summarize(run: RunView): string {
 		const usage = formatUsageCompact(run.usage);
 		const parts = [run.agent];
+		if (run.relationLabel) parts.push(run.relationLabel);
 		if (run.model) parts.push(run.model);
 		if (run.thinking) parts.push(`thinking ${run.thinking}`);
 		if (usage) parts.push(usage);

package/src/setup.ts

@@ -15,6 +15,7 @@ import {
 	DEFAULT_CONFIG,
 	DEFAULT_ENABLED_AGENTS,
 	DEFAULT_MAX_CONCURRENCY,
+	DEFAULT_MAX_FIX_ROUNDS,
 	DEFAULT_MAX_PARALLEL_TASKS,
 	THINKING_LEVEL_VALUES,
 	type AgentScope,
@@ -196,6 +197,8 @@ async function pickInjection(ctx: ExtensionCommandContext, current: boolean): Pr
 /** Preset steps offered for the two numeric limits (selection-only wizard). */
 const CONCURRENCY_STEPS = [1, 2, 3, 4, 6, 8, 12, 16];
 const PARALLEL_TASK_STEPS = [2, 4, 6, 8, 12, 16, 24, 32];
+/** Preset rounds offered for the auto-fix loop (0 disables it). */
+const FIX_ROUNDS_STEPS = [0, 1, 2, 3, 5];
 
 async function pickCount(
 	ctx: ExtensionCommandContext,
@@ -295,9 +298,18 @@ async function runFullSetup(ctx: ExtensionCommandContext, configPath: string, ba
 		base.maxParallelTasks,
 		DEFAULT_MAX_PARALLEL_TASKS,
 	);
-	if (maxParallelTasks === undefined) return notifyCancelled(ctx);
+		if (maxParallelTasks === undefined) return notifyCancelled(ctx);
+
+		const maxFixRounds = await pickCount(
+			ctx,
+			"Auto-fix rounds when a reviewer returns REQUEST_CHANGES? (0 = main agent handles fixes)",
+			FIX_ROUNDS_STEPS,
+			base.maxFixRounds,
+			DEFAULT_MAX_FIX_ROUNDS,
+		);
+		if (maxFixRounds === undefined) return notifyCancelled(ctx);
 
-	const next: SubagentsConfig = {
+		const next: SubagentsConfig = {
 		enabledAgents: enabled,
 		agentModels: repairStaleModels(ctx, picked.models),
 		agentThinkingLevels: picked.strengths,
@@ -309,6 +321,7 @@ async function runFullSetup(ctx: ExtensionCommandContext, configPath: string, ba
 		maxConcurrency,
 		maxParallelTasks,
 		maxSubagentDepth: base.maxSubagentDepth,
+		maxFixRounds,
 	};
 	await saveConfig(next, configPath);
 	ctx.ui.notify(`pi-subagents configured. Saved to ${configPath}`, "info");
@@ -323,6 +336,7 @@ async function runMenu(ctx: ExtensionCommandContext, configPath: string, config:
 		"Change agent scope",
 		"Change max concurrent sub-agents",
 		"Change max parallel tasks",
+		"Change max fix rounds",
 		"Full re-setup",
 	]);
 	if (choice === undefined) return notifyCancelled(ctx);
@@ -384,6 +398,16 @@ async function runMenu(ctx: ExtensionCommandContext, configPath: string, config:
 		);
 		if (maxParallelTasks === undefined) return notifyCancelled(ctx);
 		next.maxParallelTasks = maxParallelTasks;
+	} else if (choice.startsWith("Change max fix")) {
+		const maxFixRounds = await pickCount(
+			ctx,
+			"Auto-fix rounds when a reviewer returns REQUEST_CHANGES? (0 = main agent handles fixes)",
+			FIX_ROUNDS_STEPS,
+			config.maxFixRounds,
+			DEFAULT_MAX_FIX_ROUNDS,
+		);
+		if (maxFixRounds === undefined) return notifyCancelled(ctx);
+		next.maxFixRounds = maxFixRounds;
 	}
 
 	await saveConfig(next, configPath);

package/src/spawn.ts

@@ -55,6 +55,8 @@ export interface SingleResult {
 	thinking?: string;
 	stopReason?: string;
 	errorMessage?: string;
+	/** Model the run degraded from: set when a failed run was retried with the main-window model. */
+	modelFallbackFrom?: string;
 }
 
 export interface SubagentDetails {
@@ -142,6 +144,23 @@ export function isFailedResult(result: SingleResult): boolean {
 	return result.exitCode !== 0 || result.stopReason === "error" || result.stopReason === "aborted";
 }
 
+/**
+ * True when a failed run never got usable output from its model: the provider
+ * rejected the call before the model produced any text (bad model id, auth,
+ * thinking level, quota, ...). Task-level failures — the model worked and the
+ * task failed — and aborts/timeouts are NOT model-level and must not degrade.
+ */
+export function isModelLevelFailure(result: SingleResult): boolean {
+	if (!isFailedResult(result)) return false;
+	if (result.stopReason === "aborted") return false;
+	// The model produced text: the failure belongs to the task, not the model.
+	if (getFinalOutput(result.messages)) return false;
+	if (result.errorMessage?.includes("timed out")) return false;
+	// Require evidence the failure came from the model/provider (an error
+	// message or stderr), not from the child process failing to start.
+	return result.messages.length > 0 || result.stderr.trim().length > 0;
+}
+
 export function getResultOutput(result: SingleResult): string {
 	if (isFailedResult(result)) {
 		return result.errorMessage || result.stderr || getFinalOutput(result.messages) || "(no output)";
@@ -525,3 +544,24 @@ export async function runSingleAgent(options: RunSingleOptions): Promise<SingleR
 			}
 	}
 }
+
+/**
+ * Run one agent; when the configured model fails at the provider level before
+ * producing any output (see isModelLevelFailure), retry once with the main
+ * window's current model. The retried result is returned with `modelFallbackFrom`
+ * set so callers can surface the degradation. The fallback is per-run only and
+ * never persisted: a transient provider hiccup must not silently downgrade the
+ * configured agent model.
+ */
+export async function runSingleAgentWithModelFallback(
+	options: RunSingleOptions,
+	fallbackModelRef?: string,
+): Promise<SingleResult> {
+	const result = await runSingleAgent(options);
+	const agent = options.agent;
+	const launchedRef = agent?.model;
+	if (!agent || !launchedRef || !fallbackModelRef || launchedRef === fallbackModelRef) return result;
+	if (!isModelLevelFailure(result)) return result;
+	const retried = await runSingleAgent({ ...options, agent: { ...agent, model: fallbackModelRef } });
+	return { ...retried, modelFallbackFrom: launchedRef };
+}