@hicaru/pi-rlm 0.2.1 → 0.3.0

package/src/bridge/add-context.ts

@@ -0,0 +1,322 @@
+/**
+ * Shared add_context handler for headless engine and native repl() mode.
+ *
+ * Host packs the source via resolveSource (namespaced under ctx/<id>/) and returns the
+ * payload for the worker to append into the single `context` list.
+ *
+ * Idempotency is host-side:
+ *  - prefix set (ctx/<id>/) for external sources
+ *  - cwd seed: markSeededCwd + exact-path short-circuit for add_context(".")
+ *  - subpath of seed: short-circuit only when the live context already holds un-prefixed
+ *    entries under that relative path (gitignored subtrees still pack for real)
+ *
+ * Late-bound deps (getCwd / getEmitter) keep a single handler closure correct
+ * across native repl() calls — getOrCreate only installs handlers at spawn.
+ */
+
+import { isAbsolute, relative, resolve, sep } from "node:path";
+import type { RlmEmitter } from "../tool/rlm-events.ts";
+import type { SubLlmHandlers } from "../sandbox/sandbox.ts";
+import {
+  contextNamespace,
+  isContextFile,
+} from "../context/namespace.ts";
+import { resolveSource } from "../context/resolve.ts";
+import { previewText } from "../text/preview.ts";
+
+export interface AddContextBridgeOpts {
+  /** Fixed cwd (headless). Prefer getCwd when the sandbox outlives a single invocation. */
+  readonly cwd?: string;
+  /** Late-bound cwd (native mode — sandbox handlers outlive a single repl()). */
+  readonly getCwd?: () => string;
+  readonly emitter?: RlmEmitter;
+  /** Native mode: read the live emitter each call. */
+  readonly getEmitter?: () => RlmEmitter | null | undefined;
+  readonly parentId?: string;
+  readonly signal?: AbortSignal;
+  /** Prefixes already present in context — seeds host-side idempotency after a sandbox restart. */
+  readonly loadedPrefixes?: readonly string[];
+  /**
+   * The live context this sandbox holds. Read to refuse pre-flight exactly what the worker's
+   * `_append_context` would reject, before any prefix is committed.
+   */
+  readonly getContext?: () => unknown;
+  /**
+   * Post-load hook. The engine grows its live context here; native mode grows
+   * SandboxManager.contextPayload.
+   */
+  readonly onLoaded?: (payload: unknown) => void | Promise<void>;
+}
+
+export interface AddContextHandlerBundle {
+  readonly handlers: Pick<SubLlmHandlers, "addContext">;
+  /**
+   * Reset the loaded-prefix cache (call when the sandbox is
+   * discarded and will re-spawn).
+   *
+   * `keep` re-seeds the cache from the payload that will be replayed into the fresh worker.
+   * `loaded` is a CACHE of `contextPrefixesIn(context)` plus the cwd sentinel `""`, never
+   * independent state, so it may only be cleared by re-deriving it — clearing it outright
+   * would make the host re-clone a source the recreated worker already holds.
+   */
+  readonly reset: (keep?: readonly string[]) => void;
+  /**
+   * Register a prefix as already loaded without packing. Used by the cwd seed to plant the
+   * `""` sentinel so add_context of the same tree is a no-op.
+   */
+  readonly markLoaded: (prefix: string) => void;
+  /**
+   * Record the absolute path of the cwd seed. add_context(".") resolves to a ctx/<id>/
+   * namespace, not "", so the absolute-path check is the only reliable short-circuit.
+   */
+  readonly markSeededCwd: (absPath: string) => void;
+  /** Prefixes loaded in this sandbox lifetime (for tests). */
+  readonly loadedPrefixes: () => ReadonlySet<string>;
+  /** Absolute seeded cwd, if any (for tests). */
+  readonly seededCwd: () => string | undefined;
+}
+
+/**
+ * JS runtime kind → the Python type name worker.py reports, so both sides emit exactly one
+ * message for the same refusal. Covers every shape a context payload can take after JSON
+ * transport; anything else is a plain object, which `json.load` materializes as a dict.
+ */
+const PY_TYPE_NAME: Readonly<Record<string, string>> = Object.freeze({
+  string: "str", boolean: "bool", number: "int", bigint: "int", undefined: "None",
+});
+
+function pythonKindOf(value: unknown): string {
+  if (value === null) return "None"; // matches worker.py's `if ctx is not None else "None"`
+  return PY_TYPE_NAME[typeof value] ?? "dict";
+}
+
+/**
+ * Refusal messages shared with worker.py `_append_context`. The worker is the backstop; the host
+ * pre-flights the same two conditions so it never commits a prefix for an append that
+ * will be rejected. Keep the wording identical — a comment in worker.py points back here.
+ */
+const LIST_CONTEXT_REQUIRED = (kind: string): string =>
+  `add_context requires list context (file bundle); got ${kind}`;
+const NO_FILES_PRODUCED = "add_context produced no files";
+
+/** Absolute path with no trailing slash (except root). */
+function absKey(path: string): string {
+  const resolved = resolve(path);
+  return resolved.length > 1 && (resolved.endsWith("/") || resolved.endsWith("\\"))
+    ? resolved.slice(0, -1)
+    : resolved;
+}
+
+/**
+ * True when the live context already holds un-prefixed (cwd-seed) entries under `relPrefix`.
+ * Used so add_context("./src/context") does not double-load a subpath that the seed already
+ * has — without blocking genuinely-absent (gitignored) subtrees.
+ */
+function contextHasUnprefixedUnder(context: unknown, relPrefix: string): boolean {
+  if (!Array.isArray(context) || relPrefix === "") return false;
+  const clean = relPrefix.replace(/\\/g, "/").replace(/^\/+|\/+$/g, "");
+  if (clean === "" || clean.startsWith("..")) return false;
+  const withSlash = `${clean}/`;
+  for (let i = 0; i < context.length; i++) {
+    const entry: unknown = context[i];
+    if (!isContextFile(entry)) continue;
+    // Only cwd-seed paths are un-prefixed; ctx/<id>/… is a different source.
+    if (entry.path.startsWith("ctx/")) continue;
+    if (entry.path === clean || entry.path.startsWith(withSlash)) return true;
+  }
+  return false;
+}
+
+function alreadyLoadedResult(
+  sourceId: string,
+  pathPrefix: string,
+): Awaited<ReturnType<SubLlmHandlers["addContext"]>> {
+  return {
+    payload: Object.freeze([]),
+    files: 0,
+    chars: 0,
+    sourceId,
+    pathPrefix,
+    alreadyLoaded: true,
+    documents: 0,
+    converted: 0,
+    skipped: Object.freeze([]),
+  };
+}
+
+export function buildAddContextHandler(opts: AddContextBridgeOpts): AddContextHandlerBundle {
+  /** Prefixes already loaded in this sandbox — mirrors the worker's context state. */
+  const loaded = new Set<string>(opts.loadedPrefixes ?? []);
+  /** Absolute path of the cwd seed, if autoSeedCwd planted one successfully. */
+  let seededCwdAbs: string | undefined;
+  return {
+    reset: (keep) => {
+      const seed = keep ?? opts.loadedPrefixes ?? [];
+      loaded.clear();
+      for (const prefix of seed) loaded.add(prefix);
+      // Do NOT clear seededCwdAbs — the payload is still on disk in the manager and will be
+      // replayed; the absolute-path short-circuit must keep working after a death-recreate.
+    },
+    markLoaded: (prefix) => { loaded.add(prefix); },
+    markSeededCwd: (absPath) => {
+      seededCwdAbs = absKey(absPath);
+      loaded.add(""); // cwd sentinel — payloadPrefix never sees un-prefixed files
+    },
+    loadedPrefixes: () => loaded,
+    seededCwd: () => seededCwdAbs,
+    handlers: {
+      async addContext(source, depth) {
+        const emitter = opts.getEmitter?.() ?? opts.emitter;
+        const cwd = opts.getCwd?.() ?? opts.cwd;
+        if (cwd === undefined || cwd === "") {
+          throw new Error("add_context: no cwd configured");
+        }
+        const id = emitter?.emitSubcallCreated({
+          kind: "tool", parentId: opts.parentId,
+          label: "add_context",
+          args: previewText(source, 80),
+          depth,
+        });
+        try {
+          // Pre-flight the worker's own refusal: a non-list context cannot be appended to, and
+          // committing a prefix for it would make the NEXT load lie with already_loaded.
+          const current = opts.getContext?.();
+          if (current !== undefined && !Array.isArray(current)) {
+            throw new Error(LIST_CONTEXT_REQUIRED(pythonKindOf(current)));
+          }
+
+          const trimmed = source.trim();
+          const isLocal = trimmed !== "" && !/^(https:\/\/|git@)/.test(trimmed)
+            && !/^[a-z][a-z0-9+.-]*:\/\//i.test(trimmed);
+          const candidate = isLocal
+            ? absKey(isAbsolute(trimmed) ? trimmed : resolve(cwd, trimmed))
+            : undefined;
+          const cwdAbs = absKey(cwd);
+
+          // ── Cwd seed short-circuit / recovery ──
+          // Exact cwd: if already seeded → no-op; if seed failed (sticky, no markSeededCwd)
+          // pack un-prefixed so paths stay edit/write-friendly.
+          if (candidate !== undefined && candidate === cwdAbs) {
+            if (seededCwdAbs !== undefined) {
+              if (id) {
+                emitter?.emitSubcallUpdated({
+                  id, status: "done", resultPreview: "already loaded (cwd seed)",
+                });
+              }
+              return alreadyLoadedResult("cwd", "");
+            }
+            // Recovery after failed seed (or autoSeedCwd off): pack as primary, un-prefixed.
+            const recovered = await resolveSource(source, {
+              cwd, pathPrefix: "", signal: opts.signal,
+            });
+            if (!recovered.ok) throw new Error(recovered.error);
+            const r = recovered.value;
+            if (r.payload.length === 0) throw new Error(NO_FILES_PRODUCED);
+            if (opts.onLoaded) await opts.onLoaded(r.payload);
+            seededCwdAbs = cwdAbs;
+            loaded.add("");
+            if (id) {
+              emitter?.emitSubcallUpdated({
+                id, status: "done",
+                resultPreview: `+${r.files} file(s) → context (cwd seed recovery, ${r.chars.toLocaleString()} chars)`,
+              });
+            }
+            return {
+              payload: r.payload,
+              files: r.files,
+              chars: r.chars,
+              sourceId: r.sourceId,
+              pathPrefix: "",
+              alreadyLoaded: false,
+              documents: r.documents,
+              converted: r.converted,
+              skipped: r.skipped,
+            };
+          }
+
+          // Subpath of the seeded cwd: only short-circuit when those files are already in
+          // context (un-prefixed). A gitignored subtree that the seed never had still packs.
+          if (candidate !== undefined && seededCwdAbs !== undefined
+            && candidate !== seededCwdAbs
+            && (candidate.startsWith(seededCwdAbs + sep) || candidate.startsWith(seededCwdAbs + "/"))) {
+            const rel = relative(seededCwdAbs, candidate).split(sep).join("/");
+            if (rel !== "" && !rel.startsWith("..") && contextHasUnprefixedUnder(current, rel)) {
+              if (id) {
+                emitter?.emitSubcallUpdated({
+                  id, status: "done",
+                  resultPreview:
+                    `already in cwd seed under '${rel}/' — filter context by path prefix`,
+                });
+              }
+              return alreadyLoadedResult("cwd", "");
+            }
+          }
+
+          // Cheap pre-check BEFORE cloning/packing: same namespace ⇒ nothing to do.
+          const { sourceId: preId, pathPrefix: prefix } = contextNamespace(source, cwd);
+          if (loaded.has(prefix)) {
+            if (id) {
+              emitter?.emitSubcallUpdated({
+                id,
+                status: "done",
+                resultPreview: `already loaded (${prefix}*)`,
+              });
+            }
+            return alreadyLoadedResult(preId, prefix);
+          }
+
+          const resolved = await resolveSource(source, { cwd, signal: opts.signal });
+          if (!resolved.ok) throw new Error(resolved.error);
+          const { payload, files, chars, sourceId, pathPrefix, documents, converted, skipped } =
+            resolved.value;
+          // The worker's other refusal, pre-flighted for the same reason.
+          if (payload.length === 0) throw new Error(NO_FILES_PRODUCED);
+
+          // Race: another concurrent load of the same prefix finished while we packed.
+          if (loaded.has(pathPrefix)) {
+            if (id) {
+              emitter?.emitSubcallUpdated({
+                id,
+                status: "done",
+                resultPreview: `already loaded (${pathPrefix}*)`,
+              });
+            }
+            return alreadyLoadedResult(sourceId, pathPrefix);
+          }
+
+          // Mark loaded only after the host has grown its own copy of the context.
+          if (opts.onLoaded) {
+            await opts.onLoaded(payload);
+          }
+          loaded.add(pathPrefix);
+
+          if (id) {
+            const docNote = documents > 0
+              ? `, ${documents} doc(s)${converted > 0 ? ` (${converted} fresh)` : " (cached)"}`
+              : "";
+            emitter?.emitSubcallUpdated({
+              id,
+              status: "done",
+              resultPreview:
+                `+${files} file(s) → context (${pathPrefix}*, ${chars.toLocaleString()} chars${docNote})`,
+            });
+          }
+          return {
+            payload,
+            files,
+            chars,
+            sourceId,
+            pathPrefix,
+            alreadyLoaded: false,
+            documents,
+            converted,
+            skipped,
+          };
+        } catch (err) {
+          if (id) emitter?.emitSubcallUpdated({ id, status: "error", detail: String(err) });
+          throw err;   // serviceInterrupt catch → {error} reply → "Error: …" in the REPL
+        }
+      },
+    },
+  };
+}

package/src/bridge/subcall-handlers.ts

@@ -20,6 +20,7 @@ import { displayModelRef, modelRef, resolveModelId } from "../config/settings.ts
 import { type ChatMsg, modelComplete } from "./model.ts";
 import { previewText } from "../text/preview.ts";
 import { checkResourceLimits } from "../core/resource-limits.ts";
+import { filterContextByPaths } from "../context/merge.ts";
 import type { RlmInput, RlmResult, Sampling } from "../core/types.ts";
 import type { SubcallGates } from "../util/concurrency.ts";
 import type { SubcallOpts, SubLlmHandlers } from "../sandbox/sandbox.ts";
@@ -28,11 +29,10 @@ import { errorMessage, formatError, isErrorText } from "../util/errors.ts";
 
 /**
  * The slice of LimitGuard these handlers need. Narrow on purpose: the headless bridge is
- * constructed from a `remainingBudget()` callback rather than owning a guard, and both
+ * constructed from a remaining-timeout callback rather than owning a guard, and both
  * shapes satisfy this.
  */
 export interface InvocationLimits {
-  remainingBudgetUsd(): number | undefined;
   remainingTimeoutMs(): number | undefined;
   addUsage(usage: Usage): void;
   addRaw(costUsd: number, inputTokens: number, outputTokens: number): void;
@@ -45,10 +45,9 @@ export interface InvocationLimits {
  * `onChildUsage`, so the accounting methods here are deliberately inert.
  */
 export function limitsFromRemaining(
-  remaining?: () => { readonly budgetUsd?: number; readonly timeoutMs?: number },
+  remaining?: () => { readonly timeoutMs?: number },
 ): InvocationLimits {
   return {
-    remainingBudgetUsd: () => remaining?.().budgetUsd,
     remainingTimeoutMs: () => remaining?.().timeoutMs,
     addUsage: () => {},
     addRaw: () => {},
@@ -60,7 +59,7 @@ export function limitsFromRemaining(
  *
  * Captured at interrupt entry and threaded down, never re-read: once handlers can outlive
  * their exec, re-reading mutable tool state after an await would attribute a sub-call to
- * whichever turn happens to be current when it resumes.
+ * whichever turn happens to be current when it settles.
  */
 export interface Invocation {
   readonly emitter: RlmEmitter;
@@ -91,7 +90,7 @@ export interface SubcallHandlerDeps {
   /** Session-wide admission control. Required — a per-caller default would silently unbound it. */
   readonly gates: SubcallGates;
   readonly registry: ModelRegistry;
-  readonly getWorkerModel: () => Model<Api>;
+  readonly getLlmModel: () => Model<Api>;
   /** Live accessor — `/rlm-config` replaces the config object, so never capture the value. */
   readonly getConfig: () => SubcallConfig;
   readonly signal?: AbortSignal;
@@ -107,6 +106,15 @@ export interface SubcallHandlerDeps {
    * one emitter is what lets the session registry drain the subtree intact.
    */
   readonly runChild?: (input: RlmInput, inv: Invocation) => Promise<RlmResult>;
+  /**
+   * The parent's live context, read at spawn time and never captured: a library loaded on turn 3
+   * must reach a child spawned on turn 4. `undefined`/`null` ⇒ no inheritance, and the child falls
+   * back to prompt-as-context.
+   *
+   * This is the ONLY inheritance seam. Adding a second construction path for a child's world
+   * would re-open issue #4 on whichever path forgets to grow.
+   */
+  readonly getChildContext?: () => unknown;
   readonly getModel?: () => Model<Api>;
   /**
    * What rlm_query degrades to at the depth cap. A child RLM there would just be an LM, so
@@ -141,10 +149,18 @@ function emptyResult(answer: string): RlmResult {
   return { answer, iterations: 0, costUsd: 0, inputTokens: 0, outputTokens: 0, durationMs: 0 };
 }
 
+/** What a child RLM will see, plus any `paths=` prefix that selected nothing. */
+interface ChildContext {
+  readonly context: unknown;
+  readonly unmatched: readonly string[];
+}
+
+const NO_UNMATCHED: readonly string[] = Object.freeze([]);
+
 export function createSubcallHandlers(deps: SubcallHandlerDeps): SubcallHandlers {
   /** DRY #3 — the one display-model resolution. */
   const displayModel = (model: string | null): string =>
-    displayModelRef(deps.registry, model, deps.getWorkerModel());
+    displayModelRef(deps.registry, model, deps.getLlmModel());
 
   /** Detached work is counted by the session registry; attached work runs as-is. */
   const detachable = <T>(opts: SubcallOpts, run: () => Promise<T>): Promise<T> =>
@@ -159,7 +175,6 @@ export function createSubcallHandlers(deps: SubcallHandlerDeps): SubcallHandlers
   ): Promise<string> {
     const config = deps.getConfig();
     const limitError = checkResourceLimits({
-      budgetUsd: inv.limits.remainingBudgetUsd(),
       timeoutMs: inv.limits.remainingTimeoutMs(),
     });
     if (limitError !== undefined) return limitError;
@@ -174,7 +189,7 @@ export function createSubcallHandlers(deps: SubcallHandlerDeps): SubcallHandlers
     try {
       const messages: ChatMsg[] = [{ role: "user", content: prompt }];
       const res = await deps.gates.leaf.run(() => modelComplete(messages, {
-        model: resolved ?? deps.getWorkerModel(),
+        model: resolved ?? deps.getLlmModel(),
         registry: deps.registry,
         system: config.subSystemPrompt,
         maxTokens: config.subSampling?.maxTokens,
@@ -236,11 +251,38 @@ export function createSubcallHandlers(deps: SubcallHandlerDeps): SubcallHandlers
     return out;
   }
 
+  /**
+   * Resolve the child's world: the parent's live context, optionally narrowed by path prefixes.
+   *
+   * Falls back to prompt-as-context when nothing is wired, and to the FULL context when `paths`
+   * matched nothing — a silently blind child is exactly the bug this fixes, so a bad prefix
+   * degrades loudly (see the note childRun folds into rootPrompt) rather than quietly.
+   */
+  function childContextFor(prompt: string, paths: readonly string[] | undefined): ChildContext {
+    const inherited = deps.getChildContext?.();
+    if (inherited === undefined || inherited === null) {
+      return Object.freeze({ context: prompt, unmatched: NO_UNMATCHED });
+    }
+    if (paths === undefined || paths.length === 0) {
+      return Object.freeze({ context: inherited, unmatched: NO_UNMATCHED });
+    }
+    const filtered = filterContextByPaths(inherited, paths);
+    return Object.freeze({
+      context: filtered.files.length > 0 ? filtered.files : inherited,
+      unmatched: filtered.unmatched,
+    });
+  }
+
   /**
    * One child RLM run: depth cap → resource guard → spawn engine → debit parent.
    * Emits its own subcall node, so callers must not wrap it in another.
    */
-  async function childRun(inv: Invocation, prompt: string, model: string | null): Promise<RlmResult> {
+  async function childRun(
+    inv: Invocation,
+    prompt: string,
+    model: string | null,
+    paths: readonly string[] | undefined,
+  ): Promise<RlmResult> {
     const childDepth = inv.depth + 1;
     const run = deps.runChild;
     const maxDepth = deps.getConfig().maxDepth;
@@ -254,9 +296,8 @@ export function createSubcallHandlers(deps: SubcallHandlerDeps): SubcallHandlers
       return emptyResult(answer);
     }
 
-    const remBudget = inv.limits.remainingBudgetUsd();
     const remTimeout = inv.limits.remainingTimeoutMs();
-    const limitError = checkResourceLimits({ budgetUsd: remBudget, timeoutMs: remTimeout });
+    const limitError = checkResourceLimits({ timeoutMs: remTimeout });
     if (limitError) return emptyResult(limitError);
 
     const rootModel = deps.getModel?.();
@@ -268,14 +309,19 @@ export function createSubcallHandlers(deps: SubcallHandlerDeps): SubcallHandlers
       kind: "rlm", parentId: inv.parentId, label: "rlm_query",
       model: modelLabel, detail: prompt.slice(0, 60), depth: childDepth,
     });
+    // The child's context is the parent's world, not the prompt text. The prompt becomes the
+    // child's rootPrompt, exactly as a depth-0 run takes the user's question.
+    const child = childContextFor(prompt, paths);
+    const rootPrompt = child.unmatched.length === 0
+      ? prompt
+      : `${prompt}\n\n[rlm] paths=${child.unmatched.join(", ")} matched no files; you received the full context.`;
     try {
       const res = await deps.gates.rlm.at(childDepth).run(() => run({
-        rootPrompt: "",
-        context: prompt,
+        rootPrompt,
+        context: child.context,
         depth: childDepth,
         parentNodeId: subId,
         modelOverride: model ?? undefined,
-        remainingBudgetUsd: remBudget,
         remainingTimeoutMs: remTimeout,
       }, inv));
       inv.limits.addRaw(res.costUsd, res.inputTokens, res.outputTokens);
@@ -320,7 +366,7 @@ export function createSubcallHandlers(deps: SubcallHandlerDeps): SubcallHandlers
     async rlmQuery(prompt, model, depth, opts) {
       const inv = deps.resolve(opts, depth);
       if (inv === null) return UNWIRED;
-      return detachable(opts, async () => (await childRun(inv, prompt, model)).answer);
+      return detachable(opts, async () => (await childRun(inv, prompt, model, opts.paths)).answer);
     },
 
     async rlmQueryBatched(prompts, model, depth, opts) {
@@ -328,7 +374,7 @@ export function createSubcallHandlers(deps: SubcallHandlerDeps): SubcallHandlers
       if (inv === null) return prompts.map(() => UNWIRED);
       // Bounded by the per-depth rlm gate inside childRun, not by an outer pool.
       return detachable(opts, async () => {
-        const results = await Promise.all(prompts.map((p) => childRun(inv, p, model)));
+        const results = await Promise.all(prompts.map((p) => childRun(inv, p, model, opts.paths)));
         return results.map((r) => r.answer);
       });
     },

package/src/commands/rlm-config.ts

@@ -1,47 +1,76 @@
-/** `/rlm-config` — choose worker model, reasoning level, and run settings (smart is always pi's active model). */
+/** `/rlm-config` — choose the sub-LLM model, reasoning level, and run settings.
+ *  The root model is always pi's active model; only the sub-LLM is configurable here. */
 
+import type { Api, Model } from "@earendil-works/pi-ai";
 import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
 import { modelRef } from "../config/settings.ts";
-import { cheapestModel, type RlmController } from "../mode/rlm-mode.ts";
+import type { RlmController } from "../mode/rlm-mode.ts";
+import { cheapestModel } from "../mode/llm-model.ts";
 import { setRlmModeStatus } from "../ui/status.ts";
 import { showConfigPanel } from "../ui/config-panel.ts";
-import { selectModel } from "../ui/model-picker.ts";
+import { pickableModels, selectModel } from "../ui/model-picker.ts";
+
+/** Newer Pi hosts expose session-scoped models; 0.79 peers do not — duck-type safely. */
+function sessionScopedModels(
+  ctx: ExtensionContext,
+): readonly { readonly model: Model<Api> }[] | undefined {
+  const scoped: unknown = Reflect.get(ctx, "scopedModels");
+  return Array.isArray(scoped) ? scoped as readonly { readonly model: Model<Api> }[] : undefined;
+}
 
 export async function runRlmConfig(controller: RlmController, ctx: ExtensionContext): Promise<boolean> {
-  const models = ctx.modelRegistry.getAvailable();
+  // Match Pi's native list: refresh so a just-added key appears, then use scoped models when
+  // the session narrowed them, else every available (auth-configured) model. Never getAll().
+  try {
+    await ctx.modelRegistry.refresh();
+  } catch {
+    // Fail-soft: show the cached available snapshot rather than aborting config.
+  }
+  const models = pickableModels(ctx.modelRegistry, sessionScopedModels(ctx));
 
-  const worker = await selectModel(ctx, "Worker model (sub-LLM / llm_query)", models, controller.workerModel, controller.config.subSampling.reasoning);
-  if (worker !== undefined) {
-    controller.workerModel = worker?.model;
+  const llm = await selectModel(
+    ctx,
+    "LLM model (sub-calls: llm_query / map_files / rlm_query)",
+    models,
+    controller.llmModel,
+    controller.config.subSampling.reasoning,
+  );
+  if (llm !== undefined) {
+    controller.llmModel = llm?.model;
     controller.setConfig(Object.freeze({
       ...controller.config,
-      subSampling: Object.freeze({ ...controller.config.subSampling, reasoning: worker?.thinkingLevel }),
+      subSampling: Object.freeze({ ...controller.config.subSampling, reasoning: llm?.thinkingLevel }),
     }));
   }
 
   controller.setConfig(await showConfigPanel(ctx, controller.config));
 
-  if (worker === null) {
-    controller.savedWorkerRef = undefined;
-  } else {
-    const effectiveWorker = controller.workerModel ?? cheapestModel(ctx.modelRegistry);
-    controller.savedWorkerRef = modelRef(controller.workerModel) ?? modelRef(effectiveWorker);
-  }
+  // Only an explicit choice touches the persisted pin. ESC (`undefined`) used to fall through
+  // here and freeze whatever cheapest resolved to at that moment, which silently ended
+  // "cheapest (auto)" for every later session — including once a cheaper model appeared.
+  if (llm === null) controller.savedLlmRef = undefined;          // "⟳ cheapest (auto)"
+  else if (llm !== undefined) controller.savedLlmRef = modelRef(llm.model);
+
   const persisted = await controller.persist();
   if (!persisted) ctx.ui.notify("RLM: failed to save settings to ~/.pi/agent/rlm.json", "error");
   setRlmModeStatus(ctx.ui, controller, ctx.getContextUsage());
 
-  const w = controller.workerModel;
+  // Name the model that actually resolved, not "(cheapest)" — otherwise there is no way to
+  // tell whether the free model in the catalog was the one picked.
+  const pinned = controller.llmModel;
+  const effective = pinned ?? cheapestModel(ctx.modelRegistry);
+  const reasoning = controller.config.subSampling.reasoning;
   ctx.ui.notify(
-    `RLM: worker=${w ? `${w.provider}/${w.id}` : "(cheapest)"}${controller.config.subSampling.reasoning ? `/${controller.config.subSampling.reasoning}` : ""}`,
+    `RLM: llm=${modelRef(effective) ?? "(none available)"}`
+    + `${pinned ? "" : " (cheapest, auto)"}${reasoning ? `/${reasoning}` : ""}`,
     "info",
   );
-  return worker !== undefined;
+  return llm !== undefined;
 }
 
 export function registerRlmConfigCommand(pi: ExtensionAPI, controller: RlmController): void {
   pi.registerCommand("rlm-config", {
-    description: "Configure RLM worker model and run settings.",
+    description: "Configure the RLM sub-LLM model and run settings.",
     handler: async (_args, ctx) => {
       await runRlmConfig(controller, ctx);
     },