@mjasnikovs/pi-task 0.38.30 → 0.38.32

package/dist/workers/model-warning.d.ts

@@ -0,0 +1,69 @@
+/**
+ * Resolve every model cell ONCE per session, and say what does not work.
+ *
+ * WHY HERE AND NOT AT ARGV TIME
+ * -----------------------------
+ * The honest question is "can a `--no-extensions` child resolve this spec?", and
+ * only `ctx.modelRegistry` can answer it. Five of the six argv producers have no
+ * `ctx` at all, and the answer cannot be read from disk either: models.json plus
+ * models-store.json are only part of the catalogue, since pi-ai ships built-in
+ * lists for 39 providers and this project does not depend on pi-ai. So it is
+ * asked at `session_start`, where ctx exists and every task is still in the
+ * future, and the verdict is left in group-args.ts for the producers to consult.
+ *
+ * WHY DROPPING THE FLAG IS THE RIGHT DEGRADE
+ * ------------------------------------------
+ * A spec whose model is gone but whose PROVIDER still has other models does not
+ * make pi exit. `buildFallbackModel` invents a synthetic model id, forces
+ * `reasoning: true` onto it, inherits the provider's default baseUrl, and
+ * answers at exit 0 — so the child silently runs a model nobody chose. Dropping
+ * the flag runs the child exactly as it ran last week and names the cell.
+ *
+ * A SEPARATE hint from the reasoning one, with its own widget key: the two have
+ * different fixes (`models.json` vs `/task-config`) and that line is already at
+ * its length budget.
+ */
+import type { ExtensionAPI, ExtensionContext } from '@earendil-works/pi-coding-agent';
+import { type ChildGroup } from '../config/groups.js';
+/** One cell that will not do what it says. */
+export interface ModelProblem {
+    group: ChildGroup;
+    spec: string;
+    /**
+     * `unresolved` — no such model here, so the flag is dropped.
+     * `extension` — resolvable only because a host extension registered its
+     * provider. Children run `--no-extensions`, which disables DISCOVERY only,
+     * so it works exactly when that extension is in the child whitelist. We
+     * cannot tell which extension registered it: `getRegisteredProviderIds()`
+     * gives ids, and the `{name, config, extensionPath}` triples live in the
+     * runner's internal state. So this is a warning, not a drop — and getting it
+     * wrong fails loudly anyway, since the child's resolver reports "not found"
+     * and exits 1.
+     */
+    why: 'unresolved' | 'extension';
+}
+/** The registry questions this needs, so a test can answer them with a literal. */
+export interface ModelLookup {
+    find: (provider: string, id: string) => unknown;
+    extensionProviders: ReadonlySet<string>;
+}
+export declare function findModelProblems(lookup: ModelLookup, specs: Readonly<Record<ChildGroup, string>>): ModelProblem[];
+/**
+ * The hint line, or null when every cell is fine.
+ *
+ * Names at most two cells per cause and appends `(+N more)`, the same budget the
+ * reasoning line keeps and for the same reason.
+ */
+export declare function formatModelWarning(problems: readonly ModelProblem[]): string | null;
+export declare function registerModelWarning(pi: ExtensionAPI, 
+/** Injected by tests, which must not depend on the developer's saved config. */
+readSpecs?: () => Readonly<Record<ChildGroup, string>>): void;
+/**
+ * Answer, once, what every model cell resolves to — and leave both answers where
+ * the code that has no `ctx` can read them.
+ *
+ * `unresolved` only feeds the argv drop: an extension-provided model may well
+ * work, since children load explicitly whitelisted extensions, and dropping its
+ * flag would break a config that is merely fragile.
+ */
+export declare function resolveModelCells(ctx: ExtensionContext, specs: Readonly<Record<ChildGroup, string>>): ModelProblem[];

package/dist/workers/model-warning.js

@@ -0,0 +1,113 @@
+import { getConfig } from '../config/config.js';
+import { setGroupWindows, setUnusableSpecs } from '../config/group-args.js';
+import { MODEL_INHERIT, splitSpec } from '../config/group-models.js';
+import { CHILD_GROUPS } from '../config/groups.js';
+import { contextWindowForSpec } from '../task/context-usage.js';
+import { registerSessionHint } from './session-hint.js';
+const WIDGET_KEY = 'pi-task-model-warning';
+export function findModelProblems(lookup, specs) {
+    const out = [];
+    for (const group of CHILD_GROUPS) {
+        const spec = specs[group];
+        if (spec === MODEL_INHERIT)
+            continue;
+        const parts = splitSpec(spec);
+        if (!parts || lookup.find(parts.provider, parts.id) === undefined) {
+            out.push({ group, spec, why: 'unresolved' });
+            continue;
+        }
+        if (lookup.extensionProviders.has(parts.provider)) {
+            out.push({ group, spec, why: 'extension' });
+        }
+    }
+    return out;
+}
+/**
+ * The hint line, or null when every cell is fine.
+ *
+ * Names at most two cells per cause and appends `(+N more)`, the same budget the
+ * reasoning line keeps and for the same reason.
+ */
+export function formatModelWarning(problems) {
+    if (problems.length === 0)
+        return null;
+    const list = (why) => {
+        const hits = problems.filter(p => p.why === why);
+        const shown = hits.slice(0, 2).map(p => `${p.group}→${p.spec}`);
+        return shown.join(', ') + (hits.length > 2 ? ` (+${hits.length - 2} more)` : '');
+    };
+    const parts = [];
+    if (problems.some(p => p.why === 'unresolved')) {
+        parts.push(`no such model here — ${list('unresolved')}. Those steps run on pi's default `
+            + 'instead; fix the entry in ~/.pi/agent/models.json or pick another model in '
+            + '/task-config');
+    }
+    if (problems.some(p => p.why === 'extension')) {
+        parts.push(`provider comes from an extension — ${list('extension')}. Children run `
+            + '--no-extensions, so add that extension under "child extensions" in '
+            + '/task-config or those steps exit 1');
+    }
+    return `⚠ pi-task models: ${parts.join('. Also: ')}`;
+}
+export function registerModelWarning(pi, 
+/** Injected by tests, which must not depend on the developer's saved config. */
+readSpecs = () => getConfig().groupModels) {
+    // TWO handlers, deliberately. The resolution pass must run in EVERY mode:
+    // `registerSessionHint` returns early when `ctx.mode !== 'tui'`, so folding
+    // this into it would leave the argv drop and the churn windows disarmed for
+    // every headless and `--print` run — a guard that only works when someone is
+    // watching is not a guard.
+    pi.on('session_start', (_event, ctx) => {
+        resolveModelCells(ctx, readSpecs());
+    });
+    registerSessionHint(pi, WIDGET_KEY, ctx => {
+        const text = formatModelWarning(findModelProblems(lookupFor(ctx), readSpecs()));
+        return text === null ? null : { text };
+    });
+}
+/**
+ * Answer, once, what every model cell resolves to — and leave both answers where
+ * the code that has no `ctx` can read them.
+ *
+ * `unresolved` only feeds the argv drop: an extension-provided model may well
+ * work, since children load explicitly whitelisted extensions, and dropping its
+ * flag would break a config that is merely fragile.
+ */
+export function resolveModelCells(ctx, specs) {
+    const problems = findModelProblems(lookupFor(ctx), specs);
+    setUnusableSpecs(problems.filter(p => p.why === 'unresolved').map(p => p.spec));
+    // The SAME walk fills the window table, so the argv and the churn rule can
+    // never disagree about which model a group runs on.
+    //
+    // An `inherit` cell gets NO entry, not the parent's window. Storing one
+    // would freeze a session_start snapshot in front of the live per-run value,
+    // so a user who switches the session model with Ctrl+P to a bigger one would
+    // have every child judged against the old window — the churn rule then fires
+    // early and kills a healthy child.
+    //
+    // The whole walk is guarded because `ctx.model` and `ctx.modelRegistry` are
+    // GETTERS that call `assertActive()` and throw on a stale context. Losing the
+    // windows must not also lose the `setUnusableSpecs` above it, nor the hint.
+    try {
+        setGroupWindows(Object.fromEntries(CHILD_GROUPS.filter(g => specs[g] !== MODEL_INHERIT).map(g => [g, contextWindowForSpec(ctx, specs[g])])));
+    }
+    catch {
+        setGroupWindows({});
+    }
+    return problems;
+}
+function lookupFor(ctx) {
+    try {
+        const registry = ctx.modelRegistry;
+        return {
+            find: (provider, id) => registry.find(provider, id),
+            extensionProviders: new Set(registry.getRegisteredProviderIds())
+        };
+    }
+    catch {
+        // A registry that cannot answer must not condemn every cell. Claiming
+        // every spec is unresolved would drop every --model flag on a session
+        // whose runtime simply was not ready.
+        return { find: () => ({}), extensionProviders: new Set() };
+    }
+}

package/dist/workers/pi-worker-core.d.ts

@@ -1,4 +1,6 @@
 import { type ContextSnapshot, type LoopHit, type SpawnFn } from '../shared/child-process.js';
+import { type CommandKill } from '../shared/command-watchdog.js';
+export { commandCeilingForAttempt } from '../shared/command-watchdog.js';
 import { RESTART_ORDER } from './worker-kill.js';
 import { type WorkerGuardOverride, type WorkerGuardPolicy, type WorkerPolicyInputs, type WorkerProfileId } from './worker-profiles.js';
 /**
@@ -155,15 +157,15 @@ export interface RunWorkerInput {
         promptCharsBefore: number;
     }) => void;
     /**
-     * An already-resolved `['--thinking', level]` fragment, or `[]`/omitted to
-     * inherit the session default exactly as before.
+     * An already-resolved group fragment — `--model` then `--thinking` — or
+     * `[]`/omitted to inherit both defaults exactly as before.
      *
-     * Resolved by the CALLER because runWorker serves three different reasoning
-     * groups — the research workers, the post-implementation gates, and the
-     * ad-hoc `pi-worker` tool — and has nothing in its input that tells them
-     * apart. Guessing here would give a verify gate the research workers' level.
+     * Resolved by the CALLER because runWorker serves three different groups —
+     * the research workers, the post-implementation gates, and the ad-hoc
+     * `pi-worker` tool — and has nothing in its input that tells them apart.
+     * Guessing here would give a verify gate the research workers' model.
      */
-    thinking?: readonly string[];
+    groupArgs?: readonly string[];
     /**
      * Called once per DISCARDED attempt, at the moment the worker decides to
      * re-spawn — the only window in which a restart is observable at all.
@@ -337,29 +339,6 @@ export interface RunWorkerResult {
         idleMs: number;
     };
 }
-/**
- * The per-command ceiling for attempt N, halving each time a hang recurs.
- *
- * The first attempt gets the full configured ceiling — a genuinely slow build or
- * test suite deserves it. But every hang-caused restart carries
- * commandTimeoutHint, which tells the model in as many words to bound its
- * command; a SECOND hang means it ignored an explicit instruction, and a third
- * means it ignored it twice. Giving a non-complying child the full ceiling again
- * makes the worst case three times the ceiling, resting entirely on the model
- * obeying prose. Halving bounds it at under twice the ceiling while costing a
- * complying child nothing.
- *
- * `priorHangs` counts watchdog kills specifically, NOT total restarts — the
- * restart budget is shared with loop kills, and a child restarted for LOOPING
- * never received the bound-your-command hint, so its first hang still deserves
- * the full ceiling. Only a hang after a hang is defiance.
- *
- * Floored at 30s so repeated halving cannot shrink the ceiling to something no
- * real command could finish inside — but the floor is `min(base, 30s)`, never
- * above the configured ceiling, so a caller asking for 10s keeps 10s at every
- * hang count. A base of 0 or less disables the watchdog and stays 0.
- */
-export declare function commandCeilingForAttempt(baseMs: number, priorHangs: number): number;
 /**
  * Everything the restart ladder reads about one finished attempt, plus the
  * budgets it draws on. Assembled once per attempt so the rules below can be
@@ -438,12 +417,4 @@ interface RestartRule {
  * becoming visible in `restarts`.
  */
 export declare const RESTART_RULES: readonly RestartRule[];
-/** What the command watchdog recorded when it killed an attempt. */
-interface CommandKill {
-    toolName: string;
-    timeoutMs: number;
-    /** The command line itself, when the tool carried one — quoted into the hint
-     *  so the fresh child knows which call it must not repeat unbounded. */
-    detail?: string;
-}
 export declare function runWorker(input: RunWorkerInput): Promise<RunWorkerResult>;

package/dist/workers/pi-worker-core.js

@@ -1,13 +1,15 @@
 import { getPiInvocation } from '../shared/pi-invocation.js';
 import { runChildDefault } from '../shared/child-process.js';
-import { CommandWatchdog, commandTimeoutHint, realTimerDeps } from '../shared/command-watchdog.js';
+import { commandCeilingForAttempt, commandTimeoutHint, commandWatch } from '../shared/command-watchdog.js';
+export { commandCeilingForAttempt } from '../shared/command-watchdog.js';
 import { isGroundingRetrieval as isGrounding, workerChannel } from './worker-channels.js';
 import { childBaseArgs } from '../shared/child-extensions.js';
-import { LoopDetector } from '../task/loop-detector.js';
+import { LoopDetector, MAX_LOOP_RESTARTS } from '../task/loop-detector.js';
 import { StallDetector, formatStallHint } from '../task/stall-detector.js';
-import { MAX_LOOP_RESTARTS, formatLoopHint, isConnectionError, connectionRetryBackoffMs } from '../task/child-runner.js';
+import { formatLoopHint, isConnectionError, connectionRetryBackoffMs } from '../task/child-runner.js';
 import { detectLeakedToolCall, leakedToolCallHint, MAX_LEAK_RETRIES } from '../shared/leaked-tool-call.js';
-import { discoverModelEndpoints, probeModelEndpoints } from '../shared/model-endpoint.js';
+import { childModelEndpoints, probeModelEndpoints } from '../shared/model-endpoint.js';
+import { modelSpecFromArgs } from '../config/group-models.js';
 import { streamStallHint } from '../shared/stream-watchdog.js';
 import { classifyWorkerFailure } from './worker-failure.js';
 import { CARRY_FORWARD_IDS, RESTART_ORDER } from './worker-kill.js';
@@ -216,34 +218,6 @@ absoluteCeilingMs) {
         }
     };
 }
-/**
- * The per-command ceiling for attempt N, halving each time a hang recurs.
- *
- * The first attempt gets the full configured ceiling — a genuinely slow build or
- * test suite deserves it. But every hang-caused restart carries
- * commandTimeoutHint, which tells the model in as many words to bound its
- * command; a SECOND hang means it ignored an explicit instruction, and a third
- * means it ignored it twice. Giving a non-complying child the full ceiling again
- * makes the worst case three times the ceiling, resting entirely on the model
- * obeying prose. Halving bounds it at under twice the ceiling while costing a
- * complying child nothing.
- *
- * `priorHangs` counts watchdog kills specifically, NOT total restarts — the
- * restart budget is shared with loop kills, and a child restarted for LOOPING
- * never received the bound-your-command hint, so its first hang still deserves
- * the full ceiling. Only a hang after a hang is defiance.
- *
- * Floored at 30s so repeated halving cannot shrink the ceiling to something no
- * real command could finish inside — but the floor is `min(base, 30s)`, never
- * above the configured ceiling, so a caller asking for 10s keeps 10s at every
- * hang count. A base of 0 or less disables the watchdog and stays 0.
- */
-export function commandCeilingForAttempt(baseMs, priorHangs) {
-    if (!(baseMs > 0))
-        return 0;
-    const floor = Math.min(baseMs, 30_000);
-    return Math.max(floor, Math.round(baseMs / 2 ** priorHangs));
-}
 /**
  * The restart ladder, in precedence order. FIRST MATCH WINS.
  *
@@ -360,58 +334,6 @@ export const RESTART_RULES = [
         counters: { leak: true }
     }
 ];
-/**
- * Build the child-side command watchdog for ONE attempt: a per-tool-call timer
- * machine (shared with the main session) whose `onFire` aborts `signal`, which
- * runChild turns into a process-GROUP kill — reaping the hung command itself,
- * not just the pi child holding it.
- *
- * LIMIT: the group kill only reaches processes still IN the group. A hung command
- * that detached a daemon (setsid, nohup, a background dev server) leaves it
- * running, so the fresh attempt can hit a port the dead attempt's escapee still
- * holds. There is no cheap fix from here; the restart hint's "check current state"
- * line is the mitigation.
- *
- * Returns null when the watchdog is off, so the caller keeps the plain timeout
- * signal and no per-call bookkeeping happens at all.
- */
-function commandWatch(timeoutMs) {
-    if (!(timeoutMs > 0))
-        return null;
-    const ctrl = new AbortController();
-    // pi's toolCallId pairs start↔end. When it is absent (a fake stream in a
-    // test, an older pi), fall back to one shared slot: tool executions in a
-    // child are sequential, so a single slot is still correctly paired.
-    const key = (id) => id ?? 'anon';
-    const details = new Map();
-    let killed;
-    const watchdog = new CommandWatchdog({
-        getTimeoutMs: () => timeoutMs,
-        ...realTimerDeps,
-        onFire: (toolCallId, toolName, ms) => {
-            killed = {
-                toolName,
-                timeoutMs: ms,
-                ...(details.has(toolCallId) ? { detail: details.get(toolCallId) } : {})
-            };
-            ctrl.abort();
-        }
-    });
-    return {
-        onStart: call => {
-            const id = key(call.toolCallId);
-            const args = call.args;
-            if (typeof args?.command === 'string') {
-                details.set(id, args.command.slice(0, 120));
-            }
-            watchdog.onStart(id, call.name);
-        },
-        onEnd: id => watchdog.onEnd(key(id)),
-        killed: () => killed,
-        signal: ctrl.signal,
-        clear: () => watchdog.clearAll()
-    };
-}
 export async function runWorker(input) {
     const tools = input.tools ?? DEFAULT_TOOLS;
     // `--mode json` makes pi emit structured events as they happen instead of
@@ -423,7 +345,7 @@ export async function runWorker(input) {
     // moments before close and leave workMs at nearly zero.
     const baseArgs = [
         ...childBaseArgs(input.extensions ?? []),
-        ...(input.thinking ?? []),
+        ...(input.groupArgs ?? []),
         '--mode',
         'json',
         '--tools',
@@ -528,7 +450,7 @@ export async function runWorker(input) {
                             // Kept as data so a resolved policy stays plain
                             // comparable data — see StalledGuard.probe.
                             probe: guards.stalled.probe
-                                ?? (() => probeModelEndpoints(discoverModelEndpoints()))
+                                ?? (() => probeModelEndpoints(childModelEndpoints(modelSpecFromArgs(input.groupArgs ?? []))))
                         }
                     }),
                 ...(guards['stream-stall'] ? { streamInactivityMs: guards['stream-stall'] } : {}),

package/dist/workers/pi-worker-docs.js

@@ -16,7 +16,7 @@ import { normalizeQuery } from './research-cache.js';
 import { projectDocsRaw } from './docs-project.js';
 import { projectDocsBudget, projectDocsBudgetExhausted } from '../task/research-fanout-budget.js';
 import { isAbstention } from './abstention.js';
-import { groupThinkingArgs } from '../config/reasoning-args.js';
+import { groupChildArgs } from '../config/group-args.js';
 const RENDER_QUERY_MAX = 100;
 const Params = Type.Object({
     module: Type.String({
@@ -139,7 +139,7 @@ export function registerPiWorkerDocs(pi, internals = {}) {
                 cwd: ctx.cwd,
                 signal,
                 spawn,
-                thinking: groupThinkingArgs('extraction')
+                groupArgs: groupChildArgs('extraction')
             });
             // ── Project source lookup ───────────────────────────────────────
             if (params.module === '.') {

package/dist/workers/pi-worker.js

@@ -14,9 +14,9 @@
 import { Text } from '@earendil-works/pi-tui';
 import { Type } from '@sinclair/typebox';
 import { getConfig } from '../config/config.js';
-import { groupThinkingArgs } from '../config/reasoning-args.js';
+import { groupChildArgs } from '../config/group-args.js';
 import { runWorker } from './pi-worker-core.js';
-import { getParentContextWindow } from '../task/context-usage.js';
+import { contextWindowForGroup } from '../task/context-usage.js';
 import { childFailureReason, formatChildFailure, makeWorkerTool, workerAnswer, workerUnavailable } from './shared.js';
 const RENDER_PROMPT_MAX = 120;
 const WorkerParams = Type.Object({
@@ -66,8 +66,8 @@ export function registerPiWorker(pi) {
                 // this codebase passes `-m`, so the parent's model IS the child's
                 // model and its window is the honest one. Without this the churn
                 // rule cannot fire — see RunWorkerInput.contextWindow.
-                contextWindow: getParentContextWindow(ctx) || 'unknown',
-                thinking: groupThinkingArgs('research')
+                contextWindow: contextWindowForGroup(ctx, 'research') || 'unknown',
+                groupArgs: groupChildArgs('research')
             });
             const details = { exitCode: result.exitCode };
             const failure = formatChildFailure(result, 'Worker aborted.');

package/dist/workers/reasoning-warning.d.ts

@@ -20,19 +20,22 @@
  * silences it: an all-`inherit` table yields no mismatches for any model.
  */
 import type { ExtensionAPI } from '@earendil-works/pi-coding-agent';
-import { type GroupSetting, type ReasoningGroup } from '../config/reasoning.js';
+import { type GroupSetting, type ChildGroup } from '../config/reasoning.js';
 import { type ReasoningMismatch } from '../shared/reasoning-capability.js';
 import { type ChatTemplateCaps } from '../shared/model-endpoint.js';
 /**
  * The warning line for a set of mismatches.
  *
- * Names the MODEL it checked, because children carry no `-m` and resolve pi's
- * default model, which need not be the host session's — a warning that does not
- * say what it looked at cannot be acted on. Names at most two groups and appends
- * `(+N more)` only when there are more than two, since a line long enough to list
- * every group is a line nobody reads. Null when nothing mismatched.
+ * Each item names its OWN model — `phase@acme/small medium→off` — because groups
+ * can now run on different ones. A single leading `model "X" will not run …`
+ * would be a lie about what was checked the moment two groups differ, and a
+ * warning that misdescribes its own subject cannot be acted on.
+ *
+ * Names at most two groups and appends `(+N more)` only when there are more than
+ * two, since a line long enough to list every group is a line nobody reads. Null
+ * when nothing mismatched.
  */
-export declare function formatReasoningWarning(modelName: string, mismatches: readonly ReasoningMismatch[]): string | null;
+export declare function formatReasoningWarning(mismatches: readonly ReasoningMismatch[]): string | null;
 /**
  * The extra cause line, when the SERVER disagrees with models.json.
  *
@@ -49,11 +52,16 @@ export declare function registerReasoningWarning(pi: ExtensionAPI,
  * `session_start` so a /task-config change since the last session counts.
  * Injected by tests, which must not depend on the developer's saved config.
  */
-readSettings?: () => Readonly<Record<ReasoningGroup, GroupSetting>>, 
+readSettings?: () => Readonly<Record<ChildGroup, GroupSetting>>, 
 /**
  * The server-side chat-template probe. Injected so the REFINE path — the
  * only half of this hint that talks to a network — is drivable at all; with
  * the real probe it is reachable only from a model entry carrying a
  * `baseUrl`, which no test model has.
  */
-probe?: (baseUrl: string) => Promise<ChatTemplateCaps | null>): void;
+probe?: (baseUrl: string) => Promise<ChatTemplateCaps | null>, 
+/**
+ * Which model each group runs on. Injected for the same reason `readSettings`
+ * is: a test must not depend on the developer's saved config.
+ */
+readSpecs?: () => Readonly<Record<ChildGroup, string>>): void;

package/dist/workers/reasoning-warning.js

@@ -22,27 +22,31 @@
 import { getConfig } from '../config/config.js';
 import { effectiveReasoning } from '../config/reasoning.js';
 import { reasoningMismatches } from '../shared/reasoning-capability.js';
+import { MODEL_INHERIT, splitSpec } from '../config/group-models.js';
 import { probeChatTemplateCaps } from '../shared/model-endpoint.js';
 import { registerSessionHint } from './session-hint.js';
 const WIDGET_KEY = 'pi-task-reasoning-warning';
 /**
  * The warning line for a set of mismatches.
  *
- * Names the MODEL it checked, because children carry no `-m` and resolve pi's
- * default model, which need not be the host session's — a warning that does not
- * say what it looked at cannot be acted on. Names at most two groups and appends
- * `(+N more)` only when there are more than two, since a line long enough to list
- * every group is a line nobody reads. Null when nothing mismatched.
+ * Each item names its OWN model — `phase@acme/small medium→off` — because groups
+ * can now run on different ones. A single leading `model "X" will not run …`
+ * would be a lie about what was checked the moment two groups differ, and a
+ * warning that misdescribes its own subject cannot be acted on.
+ *
+ * Names at most two groups and appends `(+N more)` only when there are more than
+ * two, since a line long enough to list every group is a line nobody reads. Null
+ * when nothing mismatched.
  */
-export function formatReasoningWarning(modelName, mismatches) {
+export function formatReasoningWarning(mismatches) {
     if (mismatches.length === 0)
         return null;
     const shown = mismatches
         .slice(0, 2)
-        .map(m => `${m.group} ${m.wanted}→${m.actual}`)
+        .map(m => `${m.group}@${m.modelName} ${m.wanted}→${m.actual}`)
         .join(', ');
     const rest = mismatches.length > 2 ? ` (+${mismatches.length - 2} more)` : '';
-    return (`⚠ pi-task: model "${modelName}" will not run the reasoning levels /task-config asks `
+    return ('⚠ pi-task: some steps will not run the reasoning levels /task-config asks '
         + `for — ${shown}${rest}. pi clamps to what the model declares. Fix "reasoning" / `
         + '"thinkingLevelMap" for it in ~/.pi/agent/models.json, or set those steps back to '
         + '"inherit" in /task-config');
@@ -82,31 +86,74 @@ readSettings = () => effectiveReasoning(getConfig()),
  * the real probe it is reachable only from a model entry carrying a
  * `baseUrl`, which no test model has.
  */
-probe = probeChatTemplateCaps) {
+probe = probeChatTemplateCaps, 
+/**
+ * Which model each group runs on. Injected for the same reason `readSettings`
+ * is: a test must not depend on the developer's saved config.
+ */
+readSpecs = () => getConfig().groupModels) {
     registerSessionHint(pi, WIDGET_KEY, ctx => {
-        const model = ctx.model;
-        const mismatches = reasoningMismatches(model, readSettings());
-        if (mismatches.length === 0)
-            return null;
-        const base = formatReasoningWarning(model?.name ?? model?.id ?? 'unknown', mismatches);
+        const facts = (g) => groupModelFacts(ctx, readSpecs()[g]);
+        const mismatches = reasoningMismatches(facts, readSettings());
+        const base = formatReasoningWarning(mismatches);
         if (base === null)
             return null;
         // Fire-and-forget: the server probe only ever REFINES the cause line, so it
         // must not delay the warning or be able to prevent it. `probeChatTemplateCaps`
         // carries its own short timeout and returns null on any failure, so a
         // backend that does not answer `/props` costs nothing.
-        const baseUrl = model?.baseUrl;
-        if (model === undefined || baseUrl === undefined || baseUrl === '')
+        //
+        // One probe per DISTINCT baseUrl among the mismatching groups, not one
+        // per group: eleven groups usually collapse to one or two servers, and
+        // four research workers on one server would otherwise print the same
+        // sentence four times. `allSettled`, so one dead endpoint cannot blank
+        // the line for the others.
+        const probes = distinctBackends(mismatches, facts);
+        if (probes.length === 0)
             return { text: base };
-        const declares = model.reasoning;
         return {
             text: base,
-            refine: probe(baseUrl).then(caps => {
-                if (caps === null)
-                    return null;
-                const extra = formatCapabilityConflict(caps.supportsReasoningEffort, declares);
-                return extra === null ? null : base + extra;
+            refine: Promise.allSettled(probes.map(async (b) => {
+                const caps = await probe(b.baseUrl);
+                return caps === null ? null : (formatCapabilityConflict(caps.supportsReasoningEffort, b.declares));
+            })).then(results => {
+                const causes = new Set(results.flatMap(r => r.status === 'fulfilled' && r.value !== null ? [r.value] : []));
+                return causes.size === 0 ? null : base + [...causes].join('');
             })
         };
     });
 }
+/** What one group runs on, as {@link reasoningMismatches} wants it. */
+function groupModelFacts(ctx, spec) {
+    // `inherit` is the session's model. That is decision 3 of the model table —
+    // children are NOT switched to follow the host — and the honest value is
+    // settings.json's default, which need not be the session's. Naming the
+    // session's model is still the better of the two: it is the one the user can
+    // see, and on every machine with one provider the two agree.
+    const model = spec === MODEL_INHERIT ?
+        ctx.model
+        : (() => {
+            const parts = splitSpec(spec);
+            return parts ? ctx.modelRegistry.find(parts.provider, parts.id) : undefined;
+        })();
+    if (!model)
+        return undefined;
+    return {
+        name: model.name || model.id,
+        reasoning: model.reasoning,
+        ...(model.thinkingLevelMap === undefined ? {} : { thinkingLevelMap: model.thinkingLevelMap }),
+        ...(model.baseUrl ? { baseUrl: model.baseUrl } : {})
+    };
+}
+/** The distinct servers behind a set of mismatches, deduped by URL. */
+function distinctBackends(mismatches, facts) {
+    const byUrl = new Map();
+    for (const m of mismatches) {
+        const f = facts(m.group);
+        if (!f?.baseUrl)
+            continue;
+        if (!byUrl.has(f.baseUrl))
+            byUrl.set(f.baseUrl, { baseUrl: f.baseUrl, declares: f.reasoning });
+    }
+    return [...byUrl.values()];
+}

package/dist/workers/single-read-guard.d.ts

@@ -21,10 +21,10 @@
  *
  *   - RepeatedCallGuard: "no identical search twice", for grep/find/ls — the
  *     shapes the read guard cannot see, such as the same grep pattern re-run
- *     against the same path. Keyed on `${toolName}\0${stableStringify(args)}`,
- *     byte-identical to the key `LoopDetector.record` builds, so argument key
- *     order never causes a miss and only an identical repeat trips. A different
- *     pattern on the same file still passes.
+ *     against the same path. Keyed with `loopKey`, the same identity
+ *     `LoopDetector.record` uses, so argument key order never causes a miss and
+ *     only an identical repeat trips. A different pattern on the same file still
+ *     passes.
  *
  * Pure logic, no I/O — the extension does path resolution and tool routing.
  */
@@ -62,8 +62,8 @@ export declare class RepeatedCallGuard {
     /**
      * Record a `toolName` call with `args`. Returns a ReadBlock the second time
      * the same (toolName, stable-stringified args) pair is seen (and every time
-     * after), else null on the first. Uses the LoopDetector's stableStringify so
-     * argument key-order never causes a miss; only byte-identical calls collapse.
+     * after), else null on the first. Shares the LoopDetector's key, so argument
+     * key-order never causes a miss; only byte-identical calls collapse.
      */
     check(toolName: string, args: unknown): ReadBlock | null;
 }