@kenkaiiii/ggcoder 5.6.0 → 5.6.1

package/dist/app-sidecar.js

@@ -23,6 +23,9 @@ import { AgentSession } from "./core/agent-session.js";
 import { buildKenSystemPrompt, buildKenAutopilotSystemPrompt } from "./core/ken-prompt.js";
 import { buildKenDigest, buildKenAutopilotContext } from "./core/ken-context.js";
 import { parseAutopilotVerdict } from "./core/autopilot-verdict.js";
+import { isWorkflowCommandText, countAssistantMessages, shouldStartAutopilotCycle, } from "./core/autopilot-gate.js";
+import { driveAutopilotCycle } from "./core/autopilot-cycle.js";
+import { validateKenModelPref, effectiveKenModel } from "./core/ken-model.js";
 import { collectProjectContext } from "./system-prompt.js";
 import { AuthStorage } from "./core/auth-storage.js";
 import { MOONSHOT_OAUTH_KEY, XIAOMI_CREDITS_KEY } from "@kenkaiiii/gg-core";
@@ -82,6 +85,7 @@ async function loadAppSettings() {
             // model/thinking handlers below).
             projectModels: raw.projectModels && typeof raw.projectModels === "object" ? raw.projectModels : undefined,
             autopilot: raw.autopilot && typeof raw.autopilot === "object" ? raw.autopilot : undefined,
+            kenModels: raw.kenModels && typeof raw.kenModels === "object" ? raw.kenModels : undefined,
         };
     }
     catch {
@@ -105,6 +109,24 @@ async function saveProjectModelPrefs(cwd, prefs) {
     s.projectModels = { ...(s.projectModels ?? {}), [key]: prefs };
     await saveAppSettings(s);
 }
+/** Read this project's persisted Ken model override, if any. */
+async function loadKenModelPref(cwd) {
+    const s = await loadAppSettings();
+    return s.kenModels?.[projectModelKey(cwd)];
+}
+/** Persist (or with null, clear) this project's Ken model override via
+ *  read-modify-write so the rest of the settings file is preserved. */
+async function saveKenModelPref(cwd, pref) {
+    const s = await loadAppSettings();
+    const key = projectModelKey(cwd);
+    const next = { ...(s.kenModels ?? {}) };
+    if (pref)
+        next[key] = pref;
+    else
+        delete next[key];
+    s.kenModels = next;
+    await saveAppSettings(s);
+}
 /** Read this project's persisted autopilot flag (default off). */
 async function loadAutopilot(cwd) {
     const s = await loadAppSettings();
@@ -603,9 +625,11 @@ function lastAssistantText(messages) {
 /**
  * Assemble Ken's context digest for one `@Ken` question: project docs (up the
  * tree) + git/env + the build session's compaction summary + recent activity.
- * Prepended to the user's question as Ken's prompt body each turn.
+ * Prepended to the user's question as Ken's prompt body each turn. Workflow
+ * commands + autopilot-injected prompts are passed through so the digest
+ * labels them as what they are instead of user-authored asks.
  */
-async function buildKenContext(buildSession, cwd, gitBranch, question) {
+async function buildKenContext(buildSession, cwd, gitBranch, question, workflowCommands, injectedPrompts) {
     const projectContext = await collectProjectContext(cwd).catch(() => []);
     return buildKenDigest({
         question,
@@ -613,6 +637,8 @@ async function buildKenContext(buildSession, cwd, gitBranch, question) {
         cwd,
         gitBranch,
         messages: buildSession.getMessages(),
+        workflowCommands,
+        injectedPrompts,
     });
 }
 /**
@@ -804,6 +830,23 @@ async function createSession(deps, opts) {
     let autopilotCancelled = false;
     // Hard cap on review→prompt→review rounds per user turn (loop safety).
     const MAX_AUTOPILOT_ROUNDS = 3;
+    // Prompt bodies Autopilot Ken injected into the BUILD session this
+    // conversation. Passed into every Ken digest so injected prompts render as
+    // "Ken autopilot (injected)" instead of `**User:**` — otherwise multi-round
+    // cycles drift into Ken reviewing against his own last prompt. Cleared
+    // whenever the conversation resets (new session / plan accept / task run).
+    let injectedAutopilotPrompts = [];
+    // Workflow (prompt-template) commands: built-in + the project's custom
+    // `.gg/commands/*.md`. Used to gate autopilot off command turns and to label
+    // expanded templates in Ken's digests. Loaded fresh so a newly added custom
+    // command is picked up without a restart (mirrors GET /commands).
+    async function loadWorkflowCommandSpecs() {
+        const custom = await loadCustomCommands(cwd).catch(() => []);
+        return [
+            ...PROMPT_COMMANDS.map((c) => ({ name: c.name, aliases: c.aliases, prompt: c.prompt })),
+            ...custom.map((c) => ({ name: c.name, aliases: [], prompt: c.prompt })),
+        ];
+    }
     // ── Telegram serve (remote control via Telegram) ───────────
     // A single embedded serve session lives in this sidecar process. Only the main
     // window's home screen exposes the controls, so there's one bot per app.
@@ -819,6 +862,35 @@ async function createSession(deps, opts) {
     let kenRunning = false;
     let pendingKenModel = null;
     const kenToolCallNames = new Map();
+    // Ken's per-project model override. null → Ken (chat + autopilot) follows GG
+    // Coder's model, including live switches (the historical behavior). Set → Ken
+    // is pinned to his own model and GG Coder switches no longer touch him. A
+    // stale persisted pin (model dropped from the registry / provider logged
+    // out) validates to null so Ken degrades to following instead of erroring.
+    let kenModelOverride = validateKenModelPref(await loadKenModelPref(cwd), {
+        modelExists: (id) => getModel(id) !== undefined,
+        providerConnected: () => true, // async auth checked below
+    });
+    if (kenModelOverride && !(await auth.hasProviderAuth(kenModelOverride.provider))) {
+        log("WARN", "app-sidecar", "ken model override provider not connected — following GG", {
+            provider: kenModelOverride.provider,
+            model: kenModelOverride.model,
+        });
+        kenModelOverride = null;
+    }
+    /** The model Ken uses next turn: the pin when set, else GG Coder's. */
+    function kenCurrentModel() {
+        if (kenModelOverride)
+            return kenModelOverride;
+        const st = session.getState();
+        return { provider: st.provider, model: st.model };
+    }
+    /** Footer payload: Ken's effective model + whether it's a pin. Merged into
+     *  /state, the SSE ready frame, and every ken_model_change broadcast. */
+    function kenStatePayload() {
+        const st = session.getState();
+        return effectiveKenModel(kenModelOverride, { provider: st.provider, model: st.model });
+    }
     async function syncKenModel(provider, model) {
         if (kenRunning) {
             pendingKenModel = { provider, model };
@@ -835,10 +907,10 @@ async function createSession(deps, opts) {
     async function ensureKenSession() {
         if (kenSession)
             return kenSession;
-        const st = session.getState();
+        const target = kenCurrentModel();
         const ken = new AgentSession({
-            provider: st.provider,
-            model: st.model,
+            provider: target.provider,
+            model: target.model,
             cwd,
             systemPrompt: buildKenSystemPrompt(),
             allowedTools: KEN_ALLOWED_TOOLS,
@@ -869,7 +941,10 @@ async function createSession(deps, opts) {
             broadcastError("ken_error", "ken error", d.error);
         });
         kenSession = ken;
-        log("INFO", "app-sidecar", "ken session ready", { provider: st.provider, model: st.model });
+        log("INFO", "app-sidecar", "ken session ready", {
+            provider: target.provider,
+            model: target.model,
+        });
         return ken;
     }
     // ── Autopilot Ken (auto-reviewer) ──────────────────────────
@@ -898,10 +973,10 @@ async function createSession(deps, opts) {
     async function ensureKenAutoSession() {
         if (kenAutoSession)
             return kenAutoSession;
-        const st = session.getState();
+        const target = kenCurrentModel();
         const ken = new AgentSession({
-            provider: st.provider,
-            model: st.model,
+            provider: target.provider,
+            model: target.model,
             cwd,
             systemPrompt: buildKenAutopilotSystemPrompt(),
             allowedTools: KEN_ALLOWED_TOOLS,
@@ -914,8 +989,8 @@ async function createSession(deps, opts) {
         // runAutopilotReview try/catch as autopilot_error frames.
         kenAutoSession = ken;
         log("INFO", "app-sidecar", "ken autopilot session ready", {
-            provider: st.provider,
-            model: st.model,
+            provider: target.provider,
+            model: target.model,
         });
         return ken;
     }
@@ -980,7 +1055,9 @@ async function createSession(deps, opts) {
     // One review = prompt the kenAuto session with the review digest, read its
     // final assistant text, parse a verdict. Returns null on failure (surfaced as
     // an autopilot_error frame) so the cycle stops rather than looping blind.
-    async function runAutopilotReview() {
+    // `originalRequest` is the user prompt that started the turn under review —
+    // pinned in the digest so it can't scroll out during multi-round cycles.
+    async function runAutopilotReview(originalRequest) {
         autopilotReviewing = true;
         broadcast("autopilot_review_start", {});
         try {
@@ -991,6 +1068,9 @@ async function createSession(deps, opts) {
                 cwd,
                 gitBranch,
                 messages: session.getMessages(),
+                originalRequest,
+                injectedPrompts: [...injectedAutopilotPrompts],
+                workflowCommands: await loadWorkflowCommandSpecs(),
             });
             await ken.prompt(digest);
             return parseAutopilotVerdict(lastAssistantText(ken.getMessages()));
@@ -1009,50 +1089,101 @@ async function createSession(deps, opts) {
         }
     }
     // Drive the review→prompt→review loop for one finished user turn. Only ever
-    // called from POST /prompt after the user's own run resolves — never from the
-    // task runner, resume, /ken, or error paths, so there's no recursion and no
-    // guard tangle. Bounded by MAX_AUTOPILOT_ROUNDS and cancellable between steps.
-    async function runAutopilotCycle() {
+    // called after shouldStartAutopilotCycle approves the turn (POST /prompt or
+    // the stranded-queue drain) — never from the task runner, resume, /ken, or
+    // error paths, so there's no recursion and no guard tangle. The loop's
+    // control flow lives in driveAutopilotCycle (core/autopilot-cycle.ts) so
+    // every exit path is unit-tested; this only wires the real dependencies.
+    async function runAutopilotCycle(originalRequest) {
         if (!autopilot || autopilotCancelled)
             return;
         autopilotActive = true;
         try {
-            // Lean context per user turn: wipe prior review history so each new turn
-            // starts cheap, while within this cycle the few review messages persist so
-            // Ken remembers what he already asked GG Coder to fix.
-            await kenAutoSession?.newSession().catch(() => { });
-            for (let round = 1; round <= MAX_AUTOPILOT_ROUNDS; round++) {
-                if (autopilotCancelled)
-                    return;
-                const verdict = await runAutopilotReview();
-                if (!verdict || autopilotCancelled)
-                    return;
-                if (verdict.kind === "all_clear") {
-                    broadcast("autopilot_done", {});
+            await driveAutopilotCycle({
+                maxRounds: MAX_AUTOPILOT_ROUNDS,
+                isCancelled: () => autopilotCancelled,
+                // An injected run entering plan mode halts the cycle (autopilot_human
+                // with the plan-hold reason) — Ken never prompts into a read-only
+                // plan-mode session or answers the plan modal for the user.
+                isPlanMode: () => session.getPlanMode(),
+                // Lean context per user turn: wipe prior review history so each new
+                // turn starts cheap, while within this cycle the few review messages
+                // persist so Ken remembers what he already asked GG Coder to fix.
+                resetReviewer: async () => {
+                    await kenAutoSession?.newSession().catch(() => { });
+                },
+                review: () => runAutopilotReview(originalRequest),
+                // prompt → record the injected body (so later digests label it as
+                // Ken's, not the user's), show a compact Ken-tinted marker (not the
+                // prompt body), then feed GG Coder bracketed by runAgent so the run
+                // streams normally; the shared finally never re-triggers autopilot,
+                // so this can't recurse.
+                onInjected: (body, round) => {
+                    injectedAutopilotPrompts.push(body);
+                    broadcast("autopilot_prompted", { round, body });
+                },
+                runPrompt: (body) => runAgent(body, () => session.prompt(body)),
+                emit: (event) => broadcast(event.type, event.data),
+            });
+        }
+        finally {
+            autopilotActive = false;
+        }
+    }
+    // ── Stranded-queue drain ───────────────────────────────
+    // A prompt POSTed while an autopilot cycle is between injected runs (build
+    // idle, Ken reviewing) queues — but the queue only drains INTO a running
+    // turn as steering. If the cycle ends without another run (ALL_CLEAR /
+    // IGNORE / HUMAN / error), that message would sit stranded until the next
+    // unrelated prompt, then land mislabeled as "concurrent steering" of an
+    // unrelated run. Drain it here as a fresh turn of its own (with its own
+    // gated review). Also covers the non-autopilot tail window: a message queued
+    // after the run's last steering drain but before run_end.
+    let drainingStrandedQueue = false;
+    async function runStrandedQueue() {
+        if (drainingStrandedQueue)
+            return;
+        drainingStrandedQueue = true;
+        try {
+            for (;;) {
+                if (running || autopilotActive)
                     return;
-                }
-                if (verdict.kind === "ignore") {
-                    // Nothing worth reviewing (small talk, a mechanical git op, etc.) —
-                    // stop the cycle silently, no marker at all.
-                    broadcast("autopilot_ignored", {});
+                const next = session.takeNextQueuedMessage();
+                if (!next)
                     return;
+                broadcast("queued", { count: session.getQueuedCount() });
+                if (!next.text.trim() && next.attachments.length === 0)
+                    continue;
+                const workflowCommand = next.attachments.length === 0 &&
+                    isWorkflowCommandText(next.text, await loadWorkflowCommandSpecs());
+                const assistantsBefore = countAssistantMessages(session.getMessages());
+                await runAgent(next.text, async () => {
+                    if (next.attachments.length > 0) {
+                        await session.promptWithAttachments(next.text, next.attachments);
+                    }
+                    else {
+                        await session.prompt(next.text);
+                    }
+                });
+                const decision = shouldStartAutopilotCycle({
+                    enabled: autopilot,
+                    cancelled: autopilotCancelled,
+                    planMode: session.getPlanMode(),
+                    workflowCommand,
+                    assistantMessagesAdded: countAssistantMessages(session.getMessages()) - assistantsBefore,
+                });
+                if (decision.start) {
+                    await runAutopilotCycle(next.text);
                 }
-                if (verdict.kind === "human") {
-                    broadcast("autopilot_human", { reason: verdict.reason });
-                    return;
+                else if (autopilot) {
+                    log("INFO", "app-sidecar", "autopilot skipped (queued turn)", {
+                        reason: decision.reason,
+                    });
                 }
-                // prompt → show a compact Ken-tinted marker (not the prompt body), then
-                // feed GG Coder. Bracketed by runAgent so the run streams normally; the
-                // shared finally no longer re-triggers autopilot, so this can't recurse.
-                broadcast("autopilot_prompted", { round, body: verdict.body });
-                await runAgent(verdict.body, () => session.prompt(verdict.body));
-                if (autopilotCancelled)
-                    return;
             }
-            broadcast("autopilot_capped", { rounds: MAX_AUTOPILOT_ROUNDS });
         }
         finally {
-            autopilotActive = false;
+            drainingStrandedQueue = false;
         }
     }
     // ── Task runner (project task list → sessions) ──────────────
@@ -1066,6 +1197,7 @@ async function createSession(deps, opts) {
             return false;
         // Fresh session per task so one task's context never bleeds into the next.
         await session.newSession();
+        injectedAutopilotPrompts = [];
         titleGenerated = false;
         broadcast("session_reset", {});
         markTaskInProgress(cwd, task.id);
@@ -1173,6 +1305,7 @@ async function createSession(deps, opts) {
                 supportedThinkingLevels: getSupportedThinkingLevels(st.provider, st.model),
                 supportsVideo: getModel(st.model)?.supportsVideo ?? false,
                 autopilot,
+                ...kenStatePayload(),
                 ...footerExtras(),
             });
             return;
@@ -1197,6 +1330,7 @@ async function createSession(deps, opts) {
                     supportedThinkingLevels: getSupportedThinkingLevels(st.provider, st.model),
                     supportsVideo: getModel(st.model)?.supportsVideo ?? false,
                     autopilot,
+                    ...kenStatePayload(),
                     ...footerExtras(),
                 },
             })}\n\n`);
@@ -1537,6 +1671,13 @@ async function createSession(deps, opts) {
                 // Fresh user turn: clear any cancel flag left from a prior cycle so this
                 // turn's autopilot review can run.
                 autopilotCancelled = false;
+                // Gate inputs captured around the run: whether this turn is a workflow
+                // slash command (attachment prompts skip slash expansion entirely), and
+                // how many assistant messages the run actually adds. Computed even when
+                // autopilot is currently off — the toggle can flip ON mid-run, and the
+                // gate reads the post-run value.
+                const workflowCommand = attachments.length === 0 && isWorkflowCommandText(text, await loadWorkflowCommandSpecs());
+                const assistantsBefore = countAssistantMessages(session.getMessages());
                 await runAgent(text, async () => {
                     if (attachments.length > 0) {
                         // Persist each attachment under .gg/uploads so files are inspectable
@@ -1552,11 +1693,31 @@ async function createSession(deps, opts) {
                         await session.prompt(text);
                     }
                 });
-                // After the user's run settles, kick off Ken's auto-review loop. This is
-                // the ONLY entry point into the cycle — it drives any follow-up GG Coder
-                // runs itself, so the shared runAgent finally never recurses.
-                if (autopilot && !autopilotCancelled)
-                    await runAutopilotCycle();
+                // After the user's run settles, kick off Ken's auto-review loop — but
+                // only when the turn is actually reviewable (shouldStartAutopilotCycle):
+                // workflow commands (/compare, /bullet-proof, …) end with reports or
+                // A/B/C choices reserved for the USER; registry commands (/help) and
+                // failed runs add no assistant work to judge; a turn that ended in plan
+                // mode has a pending Accept/Reject modal Ken must not preempt. This is
+                // the ONLY entry point into the cycle besides the stranded-queue drain —
+                // it drives any follow-up GG Coder runs itself, so the shared runAgent
+                // finally never recurses.
+                const decision = shouldStartAutopilotCycle({
+                    enabled: autopilot,
+                    cancelled: autopilotCancelled,
+                    planMode: session.getPlanMode(),
+                    workflowCommand,
+                    assistantMessagesAdded: countAssistantMessages(session.getMessages()) - assistantsBefore,
+                });
+                if (decision.start) {
+                    await runAutopilotCycle(text);
+                }
+                else if (autopilot) {
+                    log("INFO", "app-sidecar", "autopilot skipped", { reason: decision.reason });
+                }
+                // A prompt sent while Ken was reviewing (build idle) queued but had no
+                // run to steer into — run it now as a fresh turn so it never strands.
+                await runStrandedQueue();
             });
             return;
         }
@@ -1587,7 +1748,7 @@ async function createSession(deps, opts) {
                 broadcast("ken_run_start", { text });
                 try {
                     const ken = await ensureKenSession();
-                    const digest = await buildKenContext(session, cwd, gitBranch, text);
+                    const digest = await buildKenContext(session, cwd, gitBranch, text, await loadWorkflowCommandSpecs(), injectedAutopilotPrompts);
                     await ken.prompt(digest);
                     // Record the turn against the BUILD session so it persists + survives
                     // resume (advisory custom entry, never an LLM message). Reply is Ken's
@@ -1785,8 +1946,12 @@ async function createSession(deps, opts) {
                     return;
                 }
                 await session.switchModel(target.provider, target.id);
-                await syncKenModel(target.provider, target.id);
-                await syncKenAutoModel(target.provider, target.id);
+                // Ken follows GG Coder's model only while un-pinned; a user-set Ken
+                // override survives GG model switches untouched.
+                if (!kenModelOverride) {
+                    await syncKenModel(target.provider, target.id);
+                    await syncKenAutoModel(target.provider, target.id);
+                }
                 // Clamp the reasoning level to what the new model supports (mirrors the
                 // CLI): keep thinking on at the first supported tier if it was on but
                 // the prior level is unsupported here; leave it off if it was off.
@@ -1813,6 +1978,12 @@ async function createSession(deps, opts) {
                 // model_change is emitted by switchModel; follow with thinking_change so
                 // the footer toggle reflects the new model's supported levels.
                 broadcast("thinking_change", payload);
+                // Un-pinned Ken just followed the switch — update his footer chip too.
+                // When Ken is pinned, his effective model did not change, so skip the
+                // no-op event (keeps footer/event tests from treating a GG switch as a
+                // Ken switch).
+                if (!kenModelOverride)
+                    broadcast("ken_model_change", kenStatePayload());
                 // The new model usually has a different context window — push extras so
                 // the footer's context meter rescales immediately.
                 broadcast("extras", footerExtras());
@@ -1820,6 +1991,54 @@ async function createSession(deps, opts) {
             });
             return;
         }
+        // Set or clear Ken's model pin. Body: { model: "<id>" } to pin, or
+        // { model: null } / "" to clear (Ken resumes following GG Coder). Applies
+        // to BOTH Ken sessions (chat + autopilot reviewer); a switch landing while
+        // either is mid-run defers via the pending-model mechanics.
+        if (method === "POST" && url === "/ken/model") {
+            void readBody(req).then(async (raw) => {
+                let modelId;
+                try {
+                    const parsed = JSON.parse(raw).model;
+                    modelId = typeof parsed === "string" && parsed.trim() ? parsed.trim() : null;
+                }
+                catch {
+                    json(res, 400, { error: "invalid JSON body" });
+                    return;
+                }
+                if (modelId === null) {
+                    // Clear the pin → follow GG Coder again, syncing both sessions back.
+                    kenModelOverride = null;
+                    await saveKenModelPref(cwd, null);
+                    const st = session.getState();
+                    await syncKenModel(st.provider, st.model);
+                    await syncKenAutoModel(st.provider, st.model);
+                    log("INFO", "app-sidecar", "ken model pin cleared — following GG", {
+                        provider: st.provider,
+                        model: st.model,
+                    });
+                }
+                else {
+                    const target = getModel(modelId);
+                    if (!target) {
+                        json(res, 404, { error: `unknown model: ${modelId}` });
+                        return;
+                    }
+                    kenModelOverride = { provider: target.provider, model: target.id };
+                    await saveKenModelPref(cwd, kenModelOverride);
+                    await syncKenModel(target.provider, target.id);
+                    await syncKenAutoModel(target.provider, target.id);
+                    log("INFO", "app-sidecar", "ken model pinned", {
+                        provider: target.provider,
+                        model: target.id,
+                    });
+                }
+                const payload = kenStatePayload();
+                broadcast("ken_model_change", payload);
+                json(res, 200, payload);
+            });
+            return;
+        }
         if (method === "POST" && url === "/kill") {
             void readBody(req).then(async (raw) => {
                 let id;
@@ -1891,6 +2110,7 @@ async function createSession(deps, opts) {
             void session
                 .newSession()
                 .then(() => {
+                injectedAutopilotPrompts = [];
                 broadcast("session_reset", {});
                 json(res, 200, { ok: true });
             })
@@ -1924,6 +2144,7 @@ async function createSession(deps, opts) {
                 }
                 try {
                     await session.newSession();
+                    injectedAutopilotPrompts = [];
                     titleGenerated = false;
                     await session.setApprovedPlan(planPath);
                     broadcast("session_reset", {});