@hk_net/pi-advisor 0.1.0

package/CHANGELOG.md

@@ -0,0 +1,39 @@
+# Changelog
+
+## 0.1.1
+
+### Changed
+
+- Bumped package and pi peer/dev dependencies to `0.79.1`.
+- Added pi `0.79.1` autocomplete-provider integration for `/advisor ...` and `/advise ...` arguments.
+- Honor pi project trust for project-local `.pi/advisor.json`; untrusted projects cannot silently configure advisor or enable auto-triggers.
+
+## 0.1.0
+
+### Added
+
+- Initial release of pi-advisor
+- Added runtime config validation and pure-helper tests
+
+### Fixed
+
+- Retry advisor once with visible-text-only prompting when the reviewer returns reasoning-only output, and show diagnostics instead of the vague "returned no text" placeholder
+- Treat `timeoutMs: 0` as provider-default timeout when calling the reviewer model
+- Remove arbitrary 120-char truncation from loop-detection fingerprint
+- Reorder /advise autocomplete — steer/pipe before show
+- Robust arg parsing in /advisor autocomplete
+
+### Changed
+
+- Require an explicitly configured advisor model before sending transcripts; removed implicit latest-GPT/current-model fallback
+- Documented `/advise` default injection behavior and named transcript truncation limits
+- Hardened the reviewer prompt against transcript-borne prompt injection
+- Made /advisor model selection scrollable so long model lists stay within the terminal view
+- Refreshed the model registry before listing and resolving advisor models so OAuth/subscription-backed providers added via /login are selectable
+- Allowed advisor model resolution and execution to use header-only auth as well as API-key auth
+- Changed /advise so its default show mode is clearly UI-only and not presented as model-injected chat content; added pipe and steer modes to feed advisor feedback into the active conversation
+- Added loop detection to when-stuck trigger
+- Clarified /advisor opens interactive model picker + thinking-level selection
+- Split /advisor none/default into two lines
+- Merged /advisor picker rows into single line
+- Updated /advisor when-stuck table row to mention loop detection

package/LICENSE

@@ -0,0 +1,287 @@
+                      EUROPEAN UNION PUBLIC LICENCE v. 1.2
+                      EUPL © the European Union 2007, 2016
+
+This European Union Public Licence (the ‘EUPL’) applies to the Work (as defined
+below) which is provided under the terms of this Licence. Any use of the Work,
+other than as authorised under this Licence is prohibited (to the extent such
+use is covered by a right of the copyright holder of the Work).
+
+The Work is provided under the terms of this Licence when the Licensor (as
+defined below) has placed the following notice immediately following the
+copyright notice for the Work:
+
+        Licensed under the EUPL
+
+or has expressed by any other means his willingness to license under the EUPL.
+
+1. Definitions
+
+In this Licence, the following terms have the following meaning:
+
+- ‘The Licence’: this Licence.
+
+- ‘The Original Work’: the work or software distributed or communicated by the
+  Licensor under this Licence, available as Source Code and also as Executable
+  Code as the case may be.
+
+- ‘Derivative Works’: the works or software that could be created by the
+  Licensee, based upon the Original Work or modifications thereof. This Licence
+  does not define the extent of modification or dependence on the Original Work
+  required in order to classify a work as a Derivative Work; this extent is
+  determined by copyright law applicable in the country mentioned in Article 15.
+
+- ‘The Work’: the Original Work or its Derivative Works.
+
+- ‘The Source Code’: the human-readable form of the Work which is the most
+  convenient for people to study and modify.
+
+- ‘The Executable Code’: any code which has generally been compiled and which is
+  meant to be interpreted by a computer as a program.
+
+- ‘The Licensor’: the natural or legal person that distributes or communicates
+  the Work under the Licence.
+
+- ‘Contributor(s)’: any natural or legal person who modifies the Work under the
+  Licence, or otherwise contributes to the creation of a Derivative Work.
+
+- ‘The Licensee’ or ‘You’: any natural or legal person who makes any usage of
+  the Work under the terms of the Licence.
+
+- ‘Distribution’ or ‘Communication’: any act of selling, giving, lending,
+  renting, distributing, communicating, transmitting, or otherwise making
+  available, online or offline, copies of the Work or providing access to its
+  essential functionalities at the disposal of any other natural or legal
+  person.
+
+2. Scope of the rights granted by the Licence
+
+The Licensor hereby grants You a worldwide, royalty-free, non-exclusive,
+sublicensable licence to do the following, for the duration of copyright vested
+in the Original Work:
+
+- use the Work in any circumstance and for all usage,
+- reproduce the Work,
+- modify the Work, and make Derivative Works based upon the Work,
+- communicate to the public, including the right to make available or display
+  the Work or copies thereof to the public and perform publicly, as the case may
+  be, the Work,
+- distribute the Work or copies thereof,
+- lend and rent the Work or copies thereof,
+- sublicense rights in the Work or copies thereof.
+
+Those rights can be exercised on any media, supports and formats, whether now
+known or later invented, as far as the applicable law permits so.
+
+In the countries where moral rights apply, the Licensor waives his right to
+exercise his moral right to the extent allowed by law in order to make effective
+the licence of the economic rights here above listed.
+
+The Licensor grants to the Licensee royalty-free, non-exclusive usage rights to
+any patents held by the Licensor, to the extent necessary to make use of the
+rights granted on the Work under this Licence.
+
+3. Communication of the Source Code
+
+The Licensor may provide the Work either in its Source Code form, or as
+Executable Code. If the Work is provided as Executable Code, the Licensor
+provides in addition a machine-readable copy of the Source Code of the Work
+along with each copy of the Work that the Licensor distributes or indicates, in
+a notice following the copyright notice attached to the Work, a repository where
+the Source Code is easily and freely accessible for as long as the Licensor
+continues to distribute or communicate the Work.
+
+4. Limitations on copyright
+
+Nothing in this Licence is intended to deprive the Licensee of the benefits from
+any exception or limitation to the exclusive rights of the rights owners in the
+Work, of the exhaustion of those rights or of other applicable limitations
+thereto.
+
+5. Obligations of the Licensee
+
+The grant of the rights mentioned above is subject to some restrictions and
+obligations imposed on the Licensee. Those obligations are the following:
+
+Attribution right: The Licensee shall keep intact all copyright, patent or
+trademarks notices and all notices that refer to the Licence and to the
+disclaimer of warranties. The Licensee must include a copy of such notices and a
+copy of the Licence with every copy of the Work he/she distributes or
+communicates. The Licensee must cause any Derivative Work to carry prominent
+notices stating that the Work has been modified and the date of modification.
+
+Copyleft clause: If the Licensee distributes or communicates copies of the
+Original Works or Derivative Works, this Distribution or Communication will be
+done under the terms of this Licence or of a later version of this Licence
+unless the Original Work is expressly distributed only under this version of the
+Licence — for example by communicating ‘EUPL v. 1.2 only’. The Licensee
+(becoming Licensor) cannot offer or impose any additional terms or conditions on
+the Work or Derivative Work that alter or restrict the terms of the Licence.
+
+Compatibility clause: If the Licensee Distributes or Communicates Derivative
+Works or copies thereof based upon both the Work and another work licensed under
+a Compatible Licence, this Distribution or Communication can be done under the
+terms of this Compatible Licence. For the sake of this clause, ‘Compatible
+Licence’ refers to the licences listed in the appendix attached to this Licence.
+Should the Licensee's obligations under the Compatible Licence conflict with
+his/her obligations under this Licence, the obligations of the Compatible
+Licence shall prevail.
+
+Provision of Source Code: When distributing or communicating copies of the Work,
+the Licensee will provide a machine-readable copy of the Source Code or indicate
+a repository where this Source will be easily and freely available for as long
+as the Licensee continues to distribute or communicate the Work.
+
+Legal Protection: This Licence does not grant permission to use the trade names,
+trademarks, service marks, or names of the Licensor, except as required for
+reasonable and customary use in describing the origin of the Work and
+reproducing the content of the copyright notice.
+
+6. Chain of Authorship
+
+The original Licensor warrants that the copyright in the Original Work granted
+hereunder is owned by him/her or licensed to him/her and that he/she has the
+power and authority to grant the Licence.
+
+Each Contributor warrants that the copyright in the modifications he/she brings
+to the Work are owned by him/her or licensed to him/her and that he/she has the
+power and authority to grant the Licence.
+
+Each time You accept the Licence, the original Licensor and subsequent
+Contributors grant You a licence to their contributions to the Work, under the
+terms of this Licence.
+
+7. Disclaimer of Warranty
+
+The Work is a work in progress, which is continuously improved by numerous
+Contributors. It is not a finished work and may therefore contain defects or
+‘bugs’ inherent to this type of development.
+
+For the above reason, the Work is provided under the Licence on an ‘as is’ basis
+and without warranties of any kind concerning the Work, including without
+limitation merchantability, fitness for a particular purpose, absence of defects
+or errors, accuracy, non-infringement of intellectual property rights other than
+copyright as stated in Article 6 of this Licence.
+
+This disclaimer of warranty is an essential part of the Licence and a condition
+for the grant of any rights to the Work.
+
+8. Disclaimer of Liability
+
+Except in the cases of wilful misconduct or damages directly caused to natural
+persons, the Licensor will in no event be liable for any direct or indirect,
+material or moral, damages of any kind, arising out of the Licence or of the use
+of the Work, including without limitation, damages for loss of goodwill, work
+stoppage, computer failure or malfunction, loss of data or any commercial
+damage, even if the Licensor has been advised of the possibility of such damage.
+However, the Licensor will be liable under statutory product liability laws as
+far such laws apply to the Work.
+
+9. Additional agreements
+
+While distributing the Work, You may choose to conclude an additional agreement,
+defining obligations or services consistent with this Licence. However, if
+accepting obligations, You may act only on your own behalf and on your sole
+responsibility, not on behalf of the original Licensor or any other Contributor,
+and only if You agree to indemnify, defend, and hold each Contributor harmless
+for any liability incurred by, or claims asserted against such Contributor by
+the fact You have accepted any warranty or additional liability.
+
+10. Acceptance of the Licence
+
+The provisions of this Licence can be accepted by clicking on an icon ‘I agree’
+placed under the bottom of a window displaying the text of this Licence or by
+affirming consent in any other similar way, in accordance with the rules of
+applicable law. Clicking on that icon indicates your clear and irrevocable
+acceptance of this Licence and all of its terms and conditions.
+
+Similarly, you irrevocably accept this Licence and all of its terms and
+conditions by exercising any rights granted to You by Article 2 of this Licence,
+such as the use of the Work, the creation by You of a Derivative Work or the
+Distribution or Communication by You of the Work or copies thereof.
+
+11. Information to the public
+
+In case of any Distribution or Communication of the Work by means of electronic
+communication by You (for example, by offering to download the Work from a
+remote location) the distribution channel or media (for example, a website) must
+at least provide to the public the information requested by the applicable law
+regarding the Licensor, the Licence and the way it may be accessible, concluded,
+stored and reproduced by the Licensee.
+
+12. Termination of the Licence
+
+The Licence and the rights granted hereunder will terminate automatically upon
+any breach by the Licensee of the terms of the Licence.
+
+Such a termination will not terminate the licences of any person who has
+received the Work from the Licensee under the Licence, provided such persons
+remain in full compliance with the Licence.
+
+13. Miscellaneous
+
+Without prejudice of Article 9 above, the Licence represents the complete
+agreement between the Parties as to the Work.
+
+If any provision of the Licence is invalid or unenforceable under applicable
+law, this will not affect the validity or enforceability of the Licence as a
+whole. Such provision will be construed or reformed so as necessary to make it
+valid and enforceable.
+
+The European Commission may publish other linguistic versions or new versions of
+this Licence or updated versions of the Appendix, so far this is required and
+reasonable, without reducing the scope of the rights granted by the Licence. New
+versions of the Licence will be published with a unique version number.
+
+All linguistic versions of this Licence, approved by the European Commission,
+have identical value. Parties can take advantage of the linguistic version of
+their choice.
+
+14. Jurisdiction
+
+Without prejudice to specific agreement between parties,
+
+- any litigation resulting from the interpretation of this License, arising
+  between the European Union institutions, bodies, offices or agencies, as a
+  Licensor, and any Licensee, will be subject to the jurisdiction of the Court
+  of Justice of the European Union, as laid down in article 272 of the Treaty on
+  the Functioning of the European Union,
+
+- any litigation arising between other parties and resulting from the
+  interpretation of this License, will be subject to the exclusive jurisdiction
+  of the competent court where the Licensor resides or conducts its primary
+  business.
+
+15. Applicable Law
+
+Without prejudice to specific agreement between parties,
+
+- this Licence shall be governed by the law of the European Union Member State
+  where the Licensor has his seat, resides or has his registered office,
+
+- this licence shall be governed by Belgian law if the Licensor has no seat,
+  residence or registered office inside a European Union Member State.
+
+Appendix
+
+‘Compatible Licences’ according to Article 5 EUPL are:
+
+- GNU General Public License (GPL) v. 2, v. 3
+- GNU Affero General Public License (AGPL) v. 3
+- Open Software License (OSL) v. 2.1, v. 3.0
+- Eclipse Public License (EPL) v. 1.0
+- CeCILL v. 2.0, v. 2.1
+- Mozilla Public Licence (MPL) v. 2
+- GNU Lesser General Public Licence (LGPL) v. 2.1, v. 3
+- Creative Commons Attribution-ShareAlike v. 3.0 Unported (CC BY-SA 3.0) for
+  works other than software
+- European Union Public Licence (EUPL) v. 1.1, v. 1.2
+- Québec Free and Open-Source Licence — Reciprocity (LiLiQ-R) or Strong
+  Reciprocity (LiLiQ-R+).
+
+The European Commission may update this Appendix to later versions of the above
+licences without producing a new version of the EUPL, as long as they provide
+the rights granted in Article 2 of this Licence and protect the covered Source
+Code from exclusive appropriation.
+
+All other changes or additions to this Appendix require the production of a new
+EUPL version.

package/README.md

@@ -0,0 +1,171 @@
+# pi-advisor
+
+A [pi](https://www.npmjs.com/package/@earendil-works/pi-coding-agent) extension that offers a
+parameterless `advisor` tool — inspired by Claude Code's advisor, but expanded with additional
+nudges and a manual review procedure. The regular model calls `advisor` to get a second opinion
+from an explicitly configured **stronger reviewer model** that sees the *entire* conversation transcript. Beyond the
+callable tool, the extension can also **auto-consult** the reviewer when the agent seems stuck
+or finishes a task, and the human can invoke a manual review via `/advise`.
+
+## What it does
+
+When the model calls `advisor` (no arguments), the extension serializes the full active branch —
+user/assistant text, assistant **reasoning**, every **tool call (with args)** and its **result** —
+and forwards it to a stronger reviewer model with a reviewer system prompt. The reviewer returns
+direct, actionable advice (flag wrong assumptions, name what's likely to bite, scrutinize "I'm
+done" claims). Individual tool-call arguments are truncated at 800 characters and tool results at
+2,000 characters so huge outputs do not dominate the review; after that, the transcript is truncated
+oldest-first only if it would overflow the reviewer's context window.
+
+Beyond the callable tool, the extension provides two additional ways to get advice:
+
+- **Automatic nudges** — the tool's `promptGuidelines` encourage the model to call advisor
+  *before substantive work*, *when stuck*, and *when it believes the task is complete*. Two
+  opt-in deterministic triggers (`onDone`, `whenStuck`) go further: they auto-consult the
+  reviewer and inject the feedback directly into the conversation so the agent sees it.
+- **Manual review via `/advise`** — the human can invoke a one-off review at any time. Feedback
+  can be shown UI-only (informal, for the human), piped into the chat as a user message, or
+  injected as a steering message so the running agent sees and acts on it.
+
+## Files & install
+
+- `advisor.ts` — canonical source (this repo).
+- Package-installed copy: loaded from this package's `pi.extensions` manifest after `pi install`.
+
+Install just this extension from npm:
+
+```bash
+pi install npm:@hk_net/pi-advisor
+```
+
+Or install the full collection from GitHub:
+
+```bash
+pi install git:git@github.com:hknet/pi-extensions@main
+pi install https://github.com/hknet/pi-extensions
+```
+
+Or install manually (copy just this extension):
+
+```bash
+cp packages/pi-advisor/advisor.ts ~/.pi/agent/extensions/advisor.ts
+```
+
+> When installed as an npm package, pi loads `advisor.ts` through this package's `pi.extensions`
+> manifest. When installed through the GitHub collection, pi loads it through the root package
+> manifest. If you manually copy the file instead, that copied production file is separate from this
+> source; re-copy it after edits and run `/reload`.
+
+## Configuration
+
+JSON, resolved **project-over-global** (first scope that defines a key wins):
+
+- Project: `<cwd>/.pi/advisor.json` (honored only when pi considers the project trusted)
+- Global:  `~/.pi/agent/advisor.json`
+
+```jsonc
+{
+  "model":     "openai-codex/gpt-5.5",      // "provider/id", or "none" to disable + hide the tool
+  "thinking":  "high",                      // off|minimal|low|medium|high|xhigh (default high)
+  "onDone":    false,                       // auto-review when the agent finishes a task
+  "whenStuck": 0,                           // auto-consult after N consecutive errors or N repeated identical tool calls (0 = off)
+  "timeoutMs": 120000                       // advisor call timeout in ms (0 = use provider default)
+}
+```
+
+**Model precedence:** env `PI_ADVISOR_MODEL` > project > global. If no model is explicitly
+configured, advisor remains discoverable but sends no transcript and asks the user to choose a
+trusted reviewer model with `/advisor`. Thinking level uses the same order via
+`PI_ADVISOR_EFFORT` / project / global, default `high`. Timeout uses env
+`PI_ADVISOR_TIMEOUT_MS` > project > global, default 120 000 ms (2 minutes).
+
+**Why the timeout?** When the running model calls `advisor`, it waits for the tool result.
+Without a timeout, a slow reviewer model or dropped connection would hang the entire turn.
+The timeout ensures the running model always makes progress.
+
+**No implicit reviewer fallback:** the extension does not auto-pick a reviewer model. This avoids
+surprising cross-provider transcript sharing. The model picker refreshes the registry before listing
+so API-key models and OAuth/subscription-backed models (for example providers added with `/login`)
+are selectable.
+
+## Commands
+
+| Command | Effect |
+|---|---|
+| `/advisor <enter>` | Open the interactive model-picker dialog (scrollable list of available models), then choose project vs global scope, then pick a thinking level |
+| `/advisor none` | Disable advisor for a scope → choose scope |
+| `/advisor default` | Clear a scope; if no env/lower-scope model remains, advisor becomes not configured |
+| `/advisor on-done on\|off` | Toggle auto-review-on-finish → choose scope |
+| `/advisor when-stuck off\|<N>` | Trigger advisor on N consecutive errors or N repeated identical tool calls → choose scope |
+| `/advisor status` | Show the resolved configuration |
+| `/advise [show\|pipe\|steer]` | Run a one-off review now; default is `pipe` when idle and `steer` while the agent is running |
+
+### `/advise` modes
+
+- **`/advise`** — quick advice injection: sends feedback as a user message when idle, or as a
+  steering message while the agent is running.
+- **`/advise show`** — display advisor feedback to the human only. Clearly marked as
+  **not sent to the model** — useful for informal review.
+- **`/advise pipe`** — inject the advisor feedback into the active chat as a user message. If the
+  agent is already running, it is queued as a follow-up so the agent sees it in the next turn.
+- **`/advise steer`** — inject the advisor feedback as a steering message when the agent is running,
+  so the agent sees it immediately without waiting for the current turn to complete.
+
+## Automatic triggers
+
+Default **off** — out of the box the regular model decides when to call `advisor`, nudged by the
+tool's `promptGuidelines`. Two opt-in deterministic triggers, configurable per project and global:
+
+- **`onDone`** — on `agent_end`, auto-review and steer one follow-up so the agent addresses any
+  issues before truly stopping (guarded to at most once per user prompt).
+- **`whenStuck: N`** — after N consecutive tool errors **or** N repeated identical tool calls
+  (same tool name + same arguments), auto-consult the reviewer and inject the advice as a
+  steering message to get unstuck.
+
+## Privacy & security
+
+- **No transcript is sent until a reviewer model is explicitly configured.** Out of the box,
+  advisor is discoverable but unconfigured; calls return setup guidance instead of falling back to
+  another model.
+- **Project config follows pi project trust.** A global install ignores `<cwd>/.pi/advisor.json`
+  while the current project is untrusted, so an untrusted checkout cannot silently choose a reviewer
+  model or enable auto-triggers.
+- **Auto-triggers are off by default.** The `onDone` and `whenStuck` features must be explicitly
+  enabled in configuration, and they do nothing unless a reviewer model is configured.
+- **Data sent to the reviewer model.** When `advisor` is called, the extension sends the full
+  active conversation branch to the configured reviewer model via the provider's API. This
+  includes:
+  - User messages and assistant text
+  - Assistant reasoning/thinking blocks
+  - Tool call names, arguments, and results (file paths, command output, etc.; tool-call arguments
+    are truncated at 800 characters and tool results at 2,000 characters)
+  - Tool result errors
+- **You control which model receives the data.** Configure `model` in `advisor.json` to point
+  to a provider/model you trust. If no model is configured, no reviewer API call is made.
+- **No data is stored or logged by this extension.** The transcript is sent in-memory to the
+  reviewer model's API and not persisted locally.
+- **Be mindful of secrets.** Tool results may contain secrets (API keys, credentials, tokens)
+  from `bash` output or file contents. If your project contains sensitive data, consider
+  configuring advisor to use a provider with a strong privacy policy, or disable auto-triggers.
+
+## Implementation notes (pi extension API)
+
+- **Call a model from an extension:** `complete(model, { systemPrompt, messages }, { apiKey, headers,
+  signal, reasoningEffort, maxTokens })` from `@earendil-works/pi-ai`. Resolve auth with
+  `ctx.modelRegistry.find(provider, id)` → `await ctx.modelRegistry.getApiKeyAndHeaders(model)`
+  (`{ ok, apiKey, headers }`). `getAvailable()` lists only auth-configured models; `ctx.model` is the
+  current one; `Model` carries `.contextWindow` / `.maxTokens`. `reasoningEffort` is a passthrough
+  extra, not in the typed `StreamOptions`.
+- **Read the conversation:** `ctx.sessionManager.getBranch()` (active path). Entries are
+  `{ type:"message", message }` with `role` `user|assistant|toolResult`; assistant content blocks are
+  `text` / `thinking` / `toolCall`; toolResult has `toolName`, `content`, `isError`.
+- **Show output to the human without injecting it:** `pi.sendMessage({ customType, content, display:true })` +
+  `pi.registerMessageRenderer(customType, …)`. To make the agent *act* on injected advice, use
+  `pi.sendUserMessage(text, { deliverAs })` (it reaches the LLM and triggers a turn).
+- **Hide/show a tool:** `pi.setActiveTools(pi.getActiveTools()…)`. `promptSnippet`/`promptGuidelines`
+  only appear while the tool is active.
+- **Argument autocomplete:** the extension keeps `getArgumentCompletions` for command metadata and
+  also layers a `ctx.ui.addAutocompleteProvider()` on `session_start` so `/advisor ...` and
+  `/advise ...` completions replace the whole argument segment and suppress irrelevant path
+  completion while typing command arguments (pi ≥ 0.79.1).
+- The package's `examples/extensions/summarize.ts` is the canonical reference for `complete()`.