@kenkaiiii/ggcoder 5.6.0 → 5.6.2

package/dist/app-sidecar.js

@@ -23,7 +23,9 @@ import { AgentSession } from "./core/agent-session.js";
 import { buildKenSystemPrompt, buildKenAutopilotSystemPrompt } from "./core/ken-prompt.js";
 import { buildKenDigest, buildKenAutopilotContext } from "./core/ken-context.js";
 import { parseAutopilotVerdict } from "./core/autopilot-verdict.js";
-import { collectProjectContext } from "./system-prompt.js";
+import { isWorkflowCommandText, countAssistantMessages, shouldStartAutopilotCycle, extractTurnToolCalls, isMechanicalOnlyTurn, } from "./core/autopilot-gate.js";
+import { driveAutopilotCycle } from "./core/autopilot-cycle.js";
+import { validateKenModelPref, effectiveKenModel } from "./core/ken-model.js";
 import { AuthStorage } from "./core/auth-storage.js";
 import { MOONSHOT_OAUTH_KEY, XIAOMI_CREDITS_KEY } from "@kenkaiiii/gg-core";
 import { loginAnthropic } from "./core/oauth/anthropic.js";
@@ -82,6 +84,7 @@ async function loadAppSettings() {
             // model/thinking handlers below).
             projectModels: raw.projectModels && typeof raw.projectModels === "object" ? raw.projectModels : undefined,
             autopilot: raw.autopilot && typeof raw.autopilot === "object" ? raw.autopilot : undefined,
+            kenModels: raw.kenModels && typeof raw.kenModels === "object" ? raw.kenModels : undefined,
         };
     }
     catch {
@@ -105,6 +108,24 @@ async function saveProjectModelPrefs(cwd, prefs) {
     s.projectModels = { ...(s.projectModels ?? {}), [key]: prefs };
     await saveAppSettings(s);
 }
+/** Read this project's persisted Ken model override, if any. */
+async function loadKenModelPref(cwd) {
+    const s = await loadAppSettings();
+    return s.kenModels?.[projectModelKey(cwd)];
+}
+/** Persist (or with null, clear) this project's Ken model override via
+ *  read-modify-write so the rest of the settings file is preserved. */
+async function saveKenModelPref(cwd, pref) {
+    const s = await loadAppSettings();
+    const key = projectModelKey(cwd);
+    const next = { ...(s.kenModels ?? {}) };
+    if (pref)
+        next[key] = pref;
+    else
+        delete next[key];
+    s.kenModels = next;
+    await saveAppSettings(s);
+}
 /** Read this project's persisted autopilot flag (default off). */
 async function loadAutopilot(cwd) {
     const s = await loadAppSettings();
@@ -601,18 +622,23 @@ function lastAssistantText(messages) {
     return "";
 }
 /**
- * Assemble Ken's context digest for one `@Ken` question: project docs (up the
- * tree) + git/env + the build session's compaction summary + recent activity.
- * Prepended to the user's question as Ken's prompt body each turn.
+ * Assemble Ken's context digest for one `@Ken` question: git/env + the build
+ * session's compaction summary + recent activity. Prepended to the user's
+ * question as Ken's prompt body each turn. Project docs (CLAUDE.md/AGENTS.md)
+ * are NOT here — they're folded into Ken's cached system prompt once per
+ * session instead (see ken-prompt.ts), so they hit the provider prompt cache
+ * instead of being re-sent uncached on every question. Workflow commands +
+ * autopilot-injected prompts are passed through so the digest labels them as
+ * what they are instead of user-authored asks.
  */
-async function buildKenContext(buildSession, cwd, gitBranch, question) {
-    const projectContext = await collectProjectContext(cwd).catch(() => []);
+function buildKenContext(buildSession, cwd, gitBranch, question, workflowCommands, injectedPrompts) {
     return buildKenDigest({
         question,
-        projectContext,
         cwd,
         gitBranch,
         messages: buildSession.getMessages(),
+        workflowCommands,
+        injectedPrompts,
     });
 }
 /**
@@ -804,6 +830,23 @@ async function createSession(deps, opts) {
     let autopilotCancelled = false;
     // Hard cap on review→prompt→review rounds per user turn (loop safety).
     const MAX_AUTOPILOT_ROUNDS = 3;
+    // Prompt bodies Autopilot Ken injected into the BUILD session this
+    // conversation. Passed into every Ken digest so injected prompts render as
+    // "Ken autopilot (injected)" instead of `**User:**` — otherwise multi-round
+    // cycles drift into Ken reviewing against his own last prompt. Cleared
+    // whenever the conversation resets (new session / plan accept / task run).
+    let injectedAutopilotPrompts = [];
+    // Workflow (prompt-template) commands: built-in + the project's custom
+    // `.gg/commands/*.md`. Used to gate autopilot off command turns and to label
+    // expanded templates in Ken's digests. Loaded fresh so a newly added custom
+    // command is picked up without a restart (mirrors GET /commands).
+    async function loadWorkflowCommandSpecs() {
+        const custom = await loadCustomCommands(cwd).catch(() => []);
+        return [
+            ...PROMPT_COMMANDS.map((c) => ({ name: c.name, aliases: c.aliases, prompt: c.prompt })),
+            ...custom.map((c) => ({ name: c.name, aliases: [], prompt: c.prompt })),
+        ];
+    }
     // ── Telegram serve (remote control via Telegram) ───────────
     // A single embedded serve session lives in this sidecar process. Only the main
     // window's home screen exposes the controls, so there's one bot per app.
@@ -819,6 +862,35 @@ async function createSession(deps, opts) {
     let kenRunning = false;
     let pendingKenModel = null;
     const kenToolCallNames = new Map();
+    // Ken's per-project model override. null → Ken (chat + autopilot) follows GG
+    // Coder's model, including live switches (the historical behavior). Set → Ken
+    // is pinned to his own model and GG Coder switches no longer touch him. A
+    // stale persisted pin (model dropped from the registry / provider logged
+    // out) validates to null so Ken degrades to following instead of erroring.
+    let kenModelOverride = validateKenModelPref(await loadKenModelPref(cwd), {
+        modelExists: (id) => getModel(id) !== undefined,
+        providerConnected: () => true, // async auth checked below
+    });
+    if (kenModelOverride && !(await auth.hasProviderAuth(kenModelOverride.provider))) {
+        log("WARN", "app-sidecar", "ken model override provider not connected — following GG", {
+            provider: kenModelOverride.provider,
+            model: kenModelOverride.model,
+        });
+        kenModelOverride = null;
+    }
+    /** The model Ken uses next turn: the pin when set, else GG Coder's. */
+    function kenCurrentModel() {
+        if (kenModelOverride)
+            return kenModelOverride;
+        const st = session.getState();
+        return { provider: st.provider, model: st.model };
+    }
+    /** Footer payload: Ken's effective model + whether it's a pin. Merged into
+     *  /state, the SSE ready frame, and every ken_model_change broadcast. */
+    function kenStatePayload() {
+        const st = session.getState();
+        return effectiveKenModel(kenModelOverride, { provider: st.provider, model: st.model });
+    }
     async function syncKenModel(provider, model) {
         if (kenRunning) {
             pendingKenModel = { provider, model };
@@ -835,16 +907,19 @@ async function createSession(deps, opts) {
     async function ensureKenSession() {
         if (kenSession)
             return kenSession;
-        const st = session.getState();
+        const target = kenCurrentModel();
         const ken = new AgentSession({
-            provider: st.provider,
-            model: st.model,
+            provider: target.provider,
+            model: target.model,
             cwd,
-            systemPrompt: buildKenSystemPrompt(),
+            systemPrompt: await buildKenSystemPrompt(cwd),
             allowedTools: KEN_ALLOWED_TOOLS,
             allowedMcpServers: KEN_ALLOWED_MCP_SERVERS,
             transient: true,
             signal: kenAbort.signal,
+            // Ken's bursty, spread-out turns (chat) outlast the default 5-min cache
+            // TTL regardless of the user's global speedProfile pick.
+            forceLongCacheRetention: true,
         });
         await ken.initialize();
         // Bridge Ken's bus to the shared SSE fan-out with ken_-prefixed types so the
@@ -869,7 +944,10 @@ async function createSession(deps, opts) {
             broadcastError("ken_error", "ken error", d.error);
         });
         kenSession = ken;
-        log("INFO", "app-sidecar", "ken session ready", { provider: st.provider, model: st.model });
+        log("INFO", "app-sidecar", "ken session ready", {
+            provider: target.provider,
+            model: target.model,
+        });
         return ken;
     }
     // ── Autopilot Ken (auto-reviewer) ──────────────────────────
@@ -898,24 +976,27 @@ async function createSession(deps, opts) {
     async function ensureKenAutoSession() {
         if (kenAutoSession)
             return kenAutoSession;
-        const st = session.getState();
+        const target = kenCurrentModel();
         const ken = new AgentSession({
-            provider: st.provider,
-            model: st.model,
+            provider: target.provider,
+            model: target.model,
             cwd,
-            systemPrompt: buildKenAutopilotSystemPrompt(),
+            systemPrompt: await buildKenAutopilotSystemPrompt(cwd),
             allowedTools: KEN_ALLOWED_TOOLS,
             allowedMcpServers: KEN_ALLOWED_MCP_SERVERS,
             transient: true,
             signal: kenAutoAbort.signal,
+            // Autopilot review rounds routinely span the injected GG Coder run
+            // (often >5 min) regardless of the user's global speedProfile pick.
+            forceLongCacheRetention: true,
         });
         await ken.initialize();
         // Deliberately no bus bridge: the review is silent. Errors surface via the
         // runAutopilotReview try/catch as autopilot_error frames.
         kenAutoSession = ken;
         log("INFO", "app-sidecar", "ken autopilot session ready", {
-            provider: st.provider,
-            model: st.model,
+            provider: target.provider,
+            model: target.model,
         });
         return ken;
     }
@@ -980,17 +1061,20 @@ async function createSession(deps, opts) {
     // One review = prompt the kenAuto session with the review digest, read its
     // final assistant text, parse a verdict. Returns null on failure (surfaced as
     // an autopilot_error frame) so the cycle stops rather than looping blind.
-    async function runAutopilotReview() {
+    // `originalRequest` is the user prompt that started the turn under review —
+    // pinned in the digest so it can't scroll out during multi-round cycles.
+    async function runAutopilotReview(originalRequest) {
         autopilotReviewing = true;
         broadcast("autopilot_review_start", {});
         try {
             const ken = await ensureKenAutoSession();
-            const projectContext = await collectProjectContext(cwd).catch(() => []);
             const digest = buildKenAutopilotContext({
-                projectContext,
                 cwd,
                 gitBranch,
                 messages: session.getMessages(),
+                originalRequest,
+                injectedPrompts: [...injectedAutopilotPrompts],
+                workflowCommands: await loadWorkflowCommandSpecs(),
             });
             await ken.prompt(digest);
             return parseAutopilotVerdict(lastAssistantText(ken.getMessages()));
@@ -1009,50 +1093,123 @@ async function createSession(deps, opts) {
         }
     }
     // Drive the review→prompt→review loop for one finished user turn. Only ever
-    // called from POST /prompt after the user's own run resolves — never from the
-    // task runner, resume, /ken, or error paths, so there's no recursion and no
-    // guard tangle. Bounded by MAX_AUTOPILOT_ROUNDS and cancellable between steps.
-    async function runAutopilotCycle() {
+    // called after shouldStartAutopilotCycle approves the turn (POST /prompt or
+    // the stranded-queue drain) — never from the task runner, resume, /ken, or
+    // error paths, so there's no recursion and no guard tangle. The loop's
+    // control flow lives in driveAutopilotCycle (core/autopilot-cycle.ts) so
+    // every exit path is unit-tested; this only wires the real dependencies.
+    async function runAutopilotCycle(originalRequest) {
         if (!autopilot || autopilotCancelled)
             return;
         autopilotActive = true;
         try {
-            // Lean context per user turn: wipe prior review history so each new turn
-            // starts cheap, while within this cycle the few review messages persist so
-            // Ken remembers what he already asked GG Coder to fix.
-            await kenAutoSession?.newSession().catch(() => { });
-            for (let round = 1; round <= MAX_AUTOPILOT_ROUNDS; round++) {
-                if (autopilotCancelled)
-                    return;
-                const verdict = await runAutopilotReview();
-                if (!verdict || autopilotCancelled)
-                    return;
-                if (verdict.kind === "all_clear") {
-                    broadcast("autopilot_done", {});
+            await driveAutopilotCycle({
+                maxRounds: MAX_AUTOPILOT_ROUNDS,
+                isCancelled: () => autopilotCancelled,
+                // An injected run entering plan mode halts the cycle (autopilot_human
+                // with the plan-hold reason) — Ken never prompts into a read-only
+                // plan-mode session or answers the plan modal for the user.
+                isPlanMode: () => session.getPlanMode(),
+                // Lean context per user turn: wipe prior review history so each new
+                // turn starts cheap, while within this cycle the few review messages
+                // persist so Ken remembers what he already asked GG Coder to fix.
+                resetReviewer: async () => {
+                    await kenAutoSession?.newSession().catch(() => { });
+                },
+                review: () => runAutopilotReview(originalRequest),
+                // prompt → record the injected body (so later digests label it as
+                // Ken's, not the user's), show a compact Ken-tinted marker (not the
+                // prompt body), then feed GG Coder bracketed by runAgent so the run
+                // streams normally; the shared finally never re-triggers autopilot,
+                // so this can't recurse.
+                onInjected: (body, round) => {
+                    injectedAutopilotPrompts.push(body);
+                    broadcast("autopilot_prompted", { round, body });
+                    void session.persistAutopilotMarker("prompted", { body });
+                },
+                runPrompt: (body) => runAgent(body, () => session.prompt(body)),
+                emit: (event) => {
+                    broadcast(event.type, event.data);
+                    // Persist the terminal verdict marker so a resumed session renders the
+                    // same Ken bubble the live run showed instead of dropping it or
+                    // falling back to the raw verdict text (e.g. ALL_CLEAR).
+                    if (event.type === "autopilot_done") {
+                        void session.persistAutopilotMarker("done");
+                    }
+                    else if (event.type === "autopilot_human") {
+                        void session.persistAutopilotMarker("human", { reason: event.data.reason });
+                    }
+                    else if (event.type === "autopilot_capped") {
+                        void session.persistAutopilotMarker("capped");
+                    }
+                    // autopilot_ignored renders nothing live, so nothing is persisted either.
+                },
+            });
+        }
+        finally {
+            autopilotActive = false;
+        }
+    }
+    // ── Stranded-queue drain ───────────────────────────────
+    // A prompt POSTed while an autopilot cycle is between injected runs (build
+    // idle, Ken reviewing) queues — but the queue only drains INTO a running
+    // turn as steering. If the cycle ends without another run (ALL_CLEAR /
+    // IGNORE / HUMAN / error), that message would sit stranded until the next
+    // unrelated prompt, then land mislabeled as "concurrent steering" of an
+    // unrelated run. Drain it here as a fresh turn of its own (with its own
+    // gated review). Also covers the non-autopilot tail window: a message queued
+    // after the run's last steering drain but before run_end.
+    let drainingStrandedQueue = false;
+    async function runStrandedQueue() {
+        if (drainingStrandedQueue)
+            return;
+        drainingStrandedQueue = true;
+        try {
+            for (;;) {
+                if (running || autopilotActive)
                     return;
-                }
-                if (verdict.kind === "ignore") {
-                    // Nothing worth reviewing (small talk, a mechanical git op, etc.) —
-                    // stop the cycle silently, no marker at all.
-                    broadcast("autopilot_ignored", {});
+                const next = session.takeNextQueuedMessage();
+                if (!next)
                     return;
+                broadcast("queued", { count: session.getQueuedCount() });
+                if (!next.text.trim() && next.attachments.length === 0)
+                    continue;
+                const workflowCommand = next.attachments.length === 0 &&
+                    isWorkflowCommandText(next.text, await loadWorkflowCommandSpecs());
+                const assistantsBefore = countAssistantMessages(session.getMessages());
+                const messagesBefore = session.getMessages().length;
+                await runAgent(next.text, async () => {
+                    if (next.attachments.length > 0) {
+                        await session.promptWithAttachments(next.text, next.attachments);
+                    }
+                    else {
+                        await session.prompt(next.text);
+                    }
+                });
+                const decision = shouldStartAutopilotCycle({
+                    enabled: autopilot,
+                    cancelled: autopilotCancelled,
+                    planMode: session.getPlanMode(),
+                    workflowCommand,
+                    assistantMessagesAdded: countAssistantMessages(session.getMessages()) - assistantsBefore,
+                    // Skip the review API call outright for turns that only started a
+                    // background process (dev server/watcher), ran a read-only lookup, or
+                    // committed/pushed — Ken's autopilot contract already IGNOREs these,
+                    // so there's no reason to pay for that verdict.
+                    mechanicalOnly: isMechanicalOnlyTurn(extractTurnToolCalls(session.getMessages(), messagesBefore)),
+                });
+                if (decision.start) {
+                    await runAutopilotCycle(next.text);
                 }
-                if (verdict.kind === "human") {
-                    broadcast("autopilot_human", { reason: verdict.reason });
-                    return;
+                else if (autopilot) {
+                    log("INFO", "app-sidecar", "autopilot skipped (queued turn)", {
+                        reason: decision.reason,
+                    });
                 }
-                // prompt → show a compact Ken-tinted marker (not the prompt body), then
-                // feed GG Coder. Bracketed by runAgent so the run streams normally; the
-                // shared finally no longer re-triggers autopilot, so this can't recurse.
-                broadcast("autopilot_prompted", { round, body: verdict.body });
-                await runAgent(verdict.body, () => session.prompt(verdict.body));
-                if (autopilotCancelled)
-                    return;
             }
-            broadcast("autopilot_capped", { rounds: MAX_AUTOPILOT_ROUNDS });
         }
         finally {
-            autopilotActive = false;
+            drainingStrandedQueue = false;
         }
     }
     // ── Task runner (project task list → sessions) ──────────────
@@ -1066,6 +1223,7 @@ async function createSession(deps, opts) {
             return false;
         // Fresh session per task so one task's context never bleeds into the next.
         await session.newSession();
+        injectedAutopilotPrompts = [];
         titleGenerated = false;
         broadcast("session_reset", {});
         markTaskInProgress(cwd, task.id);
@@ -1173,6 +1331,7 @@ async function createSession(deps, opts) {
                 supportedThinkingLevels: getSupportedThinkingLevels(st.provider, st.model),
                 supportsVideo: getModel(st.model)?.supportsVideo ?? false,
                 autopilot,
+                ...kenStatePayload(),
                 ...footerExtras(),
             });
             return;
@@ -1197,6 +1356,7 @@ async function createSession(deps, opts) {
                     supportedThinkingLevels: getSupportedThinkingLevels(st.provider, st.model),
                     supportsVideo: getModel(st.model)?.supportsVideo ?? false,
                     autopilot,
+                    ...kenStatePayload(),
                     ...footerExtras(),
                 },
             })}\n\n`);
@@ -1371,9 +1531,37 @@ async function createSession(deps, opts) {
                         history.push({ role: "assistant", text: turn.reply, ken: true });
                     }
                 };
+                // Autopilot verdict markers to interleave, same anchor scheme as Ken
+                // turns — each becomes a single assistant row the webview renders
+                // exactly like the live `autopilot` item (never a raw verdict string).
+                const autopilotByCount = new Map();
+                for (const marker of session.getAutopilotMarkers()) {
+                    const list = autopilotByCount.get(marker.afterMessageCount) ?? [];
+                    list.push(marker);
+                    autopilotByCount.set(marker.afterMessageCount, list);
+                }
+                const flushAutopilot = (count) => {
+                    const markers = autopilotByCount.get(count);
+                    if (!markers)
+                        return;
+                    autopilotByCount.delete(count);
+                    for (const marker of markers) {
+                        history.push({
+                            role: "assistant",
+                            text: "",
+                            autopilot: {
+                                phase: marker.phase,
+                                ...(marker.reason !== undefined ? { reason: marker.reason } : {}),
+                                ...(marker.body !== undefined ? { body: marker.body } : {}),
+                            },
+                        });
+                    }
+                };
                 let nonSystemCount = 0;
-                // Turns recorded before any build message (anchor 0) render at the top.
+                // Turns/markers recorded before any build message (anchor 0) render at
+                // the top.
                 flushKen(0);
+                flushAutopilot(0);
                 for (const msg of messages) {
                     if (msg.role === "system")
                         continue;
@@ -1467,14 +1655,19 @@ async function createSession(deps, opts) {
                             });
                         }
                     }
-                    // Interleave any Ken turns recorded right after this message.
+                    // Interleave any Ken turns / autopilot markers recorded right after
+                    // this message.
                     flushKen(nonSystemCount);
+                    flushAutopilot(nonSystemCount);
                 }
-                // Flush remaining Ken turns whose anchor is at/after the message count
-                // (e.g. asked before any build message, or anchors beyond the current
-                // count after compaction shrank the history) so none are dropped.
+                // Flush remaining Ken turns / autopilot markers whose anchor is at/after
+                // the message count (e.g. recorded before any build message, or anchors
+                // beyond the current count after compaction shrank the history) so none
+                // are dropped.
                 for (const count of [...kenByCount.keys()].sort((a, b) => a - b))
                     flushKen(count);
+                for (const count of [...autopilotByCount.keys()].sort((a, b) => a - b))
+                    flushAutopilot(count);
                 json(res, 200, { history });
             })();
             return;
@@ -1537,6 +1730,14 @@ async function createSession(deps, opts) {
                 // Fresh user turn: clear any cancel flag left from a prior cycle so this
                 // turn's autopilot review can run.
                 autopilotCancelled = false;
+                // Gate inputs captured around the run: whether this turn is a workflow
+                // slash command (attachment prompts skip slash expansion entirely), and
+                // how many assistant messages the run actually adds. Computed even when
+                // autopilot is currently off — the toggle can flip ON mid-run, and the
+                // gate reads the post-run value.
+                const workflowCommand = attachments.length === 0 && isWorkflowCommandText(text, await loadWorkflowCommandSpecs());
+                const assistantsBefore = countAssistantMessages(session.getMessages());
+                const messagesBefore = session.getMessages().length;
                 await runAgent(text, async () => {
                     if (attachments.length > 0) {
                         // Persist each attachment under .gg/uploads so files are inspectable
@@ -1552,11 +1753,36 @@ async function createSession(deps, opts) {
                         await session.prompt(text);
                     }
                 });
-                // After the user's run settles, kick off Ken's auto-review loop. This is
-                // the ONLY entry point into the cycle — it drives any follow-up GG Coder
-                // runs itself, so the shared runAgent finally never recurses.
-                if (autopilot && !autopilotCancelled)
-                    await runAutopilotCycle();
+                // After the user's run settles, kick off Ken's auto-review loop — but
+                // only when the turn is actually reviewable (shouldStartAutopilotCycle):
+                // workflow commands (/compare, /bullet-proof, …) end with reports or
+                // A/B/C choices reserved for the USER; registry commands (/help) and
+                // failed runs add no assistant work to judge; a turn that ended in plan
+                // mode has a pending Accept/Reject modal Ken must not preempt. This is
+                // the ONLY entry point into the cycle besides the stranded-queue drain —
+                // it drives any follow-up GG Coder runs itself, so the shared runAgent
+                // finally never recurses.
+                const decision = shouldStartAutopilotCycle({
+                    enabled: autopilot,
+                    cancelled: autopilotCancelled,
+                    planMode: session.getPlanMode(),
+                    workflowCommand,
+                    assistantMessagesAdded: countAssistantMessages(session.getMessages()) - assistantsBefore,
+                    // Skip the review API call outright for turns that only started a
+                    // background process (dev server/watcher), ran a read-only lookup, or
+                    // committed/pushed — Ken's autopilot contract already IGNOREs these,
+                    // so there's no reason to pay for that verdict.
+                    mechanicalOnly: isMechanicalOnlyTurn(extractTurnToolCalls(session.getMessages(), messagesBefore)),
+                });
+                if (decision.start) {
+                    await runAutopilotCycle(text);
+                }
+                else if (autopilot) {
+                    log("INFO", "app-sidecar", "autopilot skipped", { reason: decision.reason });
+                }
+                // A prompt sent while Ken was reviewing (build idle) queued but had no
+                // run to steer into — run it now as a fresh turn so it never strands.
+                await runStrandedQueue();
             });
             return;
         }
@@ -1587,7 +1813,7 @@ async function createSession(deps, opts) {
                 broadcast("ken_run_start", { text });
                 try {
                     const ken = await ensureKenSession();
-                    const digest = await buildKenContext(session, cwd, gitBranch, text);
+                    const digest = await buildKenContext(session, cwd, gitBranch, text, await loadWorkflowCommandSpecs(), injectedAutopilotPrompts);
                     await ken.prompt(digest);
                     // Record the turn against the BUILD session so it persists + survives
                     // resume (advisory custom entry, never an LLM message). Reply is Ken's
@@ -1785,8 +2011,12 @@ async function createSession(deps, opts) {
                     return;
                 }
                 await session.switchModel(target.provider, target.id);
-                await syncKenModel(target.provider, target.id);
-                await syncKenAutoModel(target.provider, target.id);
+                // Ken follows GG Coder's model only while un-pinned; a user-set Ken
+                // override survives GG model switches untouched.
+                if (!kenModelOverride) {
+                    await syncKenModel(target.provider, target.id);
+                    await syncKenAutoModel(target.provider, target.id);
+                }
                 // Clamp the reasoning level to what the new model supports (mirrors the
                 // CLI): keep thinking on at the first supported tier if it was on but
                 // the prior level is unsupported here; leave it off if it was off.
@@ -1813,6 +2043,12 @@ async function createSession(deps, opts) {
                 // model_change is emitted by switchModel; follow with thinking_change so
                 // the footer toggle reflects the new model's supported levels.
                 broadcast("thinking_change", payload);
+                // Un-pinned Ken just followed the switch — update his footer chip too.
+                // When Ken is pinned, his effective model did not change, so skip the
+                // no-op event (keeps footer/event tests from treating a GG switch as a
+                // Ken switch).
+                if (!kenModelOverride)
+                    broadcast("ken_model_change", kenStatePayload());
                 // The new model usually has a different context window — push extras so
                 // the footer's context meter rescales immediately.
                 broadcast("extras", footerExtras());
@@ -1820,6 +2056,54 @@ async function createSession(deps, opts) {
             });
             return;
         }
+        // Set or clear Ken's model pin. Body: { model: "<id>" } to pin, or
+        // { model: null } / "" to clear (Ken resumes following GG Coder). Applies
+        // to BOTH Ken sessions (chat + autopilot reviewer); a switch landing while
+        // either is mid-run defers via the pending-model mechanics.
+        if (method === "POST" && url === "/ken/model") {
+            void readBody(req).then(async (raw) => {
+                let modelId;
+                try {
+                    const parsed = JSON.parse(raw).model;
+                    modelId = typeof parsed === "string" && parsed.trim() ? parsed.trim() : null;
+                }
+                catch {
+                    json(res, 400, { error: "invalid JSON body" });
+                    return;
+                }
+                if (modelId === null) {
+                    // Clear the pin → follow GG Coder again, syncing both sessions back.
+                    kenModelOverride = null;
+                    await saveKenModelPref(cwd, null);
+                    const st = session.getState();
+                    await syncKenModel(st.provider, st.model);
+                    await syncKenAutoModel(st.provider, st.model);
+                    log("INFO", "app-sidecar", "ken model pin cleared — following GG", {
+                        provider: st.provider,
+                        model: st.model,
+                    });
+                }
+                else {
+                    const target = getModel(modelId);
+                    if (!target) {
+                        json(res, 404, { error: `unknown model: ${modelId}` });
+                        return;
+                    }
+                    kenModelOverride = { provider: target.provider, model: target.id };
+                    await saveKenModelPref(cwd, kenModelOverride);
+                    await syncKenModel(target.provider, target.id);
+                    await syncKenAutoModel(target.provider, target.id);
+                    log("INFO", "app-sidecar", "ken model pinned", {
+                        provider: target.provider,
+                        model: target.id,
+                    });
+                }
+                const payload = kenStatePayload();
+                broadcast("ken_model_change", payload);
+                json(res, 200, payload);
+            });
+            return;
+        }
         if (method === "POST" && url === "/kill") {
             void readBody(req).then(async (raw) => {
                 let id;
@@ -1891,6 +2175,7 @@ async function createSession(deps, opts) {
             void session
                 .newSession()
                 .then(() => {
+                injectedAutopilotPrompts = [];
                 broadcast("session_reset", {});
                 json(res, 200, { ok: true });
             })
@@ -1924,6 +2209,7 @@ async function createSession(deps, opts) {
                 }
                 try {
                     await session.newSession();
+                    injectedAutopilotPrompts = [];
                     titleGenerated = false;
                     await session.setApprovedPlan(planPath);
                     broadcast("session_reset", {});