@mjasnikovs/pi-task 0.38.31 → 0.39.0

package/dist/config/register.js

@@ -1,11 +1,14 @@
 import { getKeybindings, SettingsList, visibleWidth, wrapTextWithAnsi } from '@earendil-works/pi-tui';
+import { clampToModel, supportedThinkingLevels } from '../shared/reasoning-capability.js';
+import { MODEL_INHERIT, splitSpec } from './group-models.js';
+import { PairPicker } from './option-picker.js';
 import { registerBridgeCommand } from '../remote/bridge.js';
 import { readPkgVersion } from '../shared/pkg-version.js';
 import { SEARCH_PROVIDERS, SEARCH_PROVIDER_LABELS, providerForLabel } from '../workers/search-types.js';
 import { COMMAND_TIMEOUT_OPTIONS, DEBUG_LOG_OPTIONS, getConfig, sanitizeDebugLogs, saveConfig, STREAM_INACTIVITY_OPTIONS } from './config.js';
 import { listInstalledExtensions } from './extension-list.js';
 import { listGuardableTools } from './tool-list.js';
-import { REASONING_GROUPS, REASONING_MODES, sanitizeReasoningMode, REASONING_GROUP_HELP, REASONING_SETTINGS, effectiveReasoning, resolveReasoning } from './reasoning.js';
+import { CHILD_GROUPS, REASONING_MODES, sanitizeReasoningMode, STEP_GROUP_HELP, REASONING_SETTINGS, effectiveReasoning, resolveReasoning } from './reasoning.js';
 // Version in the title so a bug report or screenshot says which build it came
 // from without anyone having to go look it up.
 const CONFIG_TITLE = `pi-task ${readPkgVersion()} settings`;
@@ -73,7 +76,20 @@ export const SECTIONS = [
     { key: 'session', title: 'session' },
     { key: 'checks', title: 'after each task' },
     { key: 'research', title: 'research' },
-    { key: 'reasoning', title: 'reasoning' },
+    // The global override gets its own heading, so it cannot be mistaken for a
+    // twelfth step. It is one row, and `renderRows` drops an empty section, so
+    // this costs a header and a blank line and nothing else.
+    //
+    // Both titles are SHORT on purpose. `SettingsList` sizes its label column
+    // from the widest item it holds — headers included — so a long heading is
+    // taken straight out of every row's value column, and the first thing to
+    // fall off the right is the thinking level.
+    { key: 'profile', title: 'profile' },
+    // ONE block for both dials. They shipped as two parallel blocks of eleven,
+    // which put a step's two settings eleven rows apart and hid the coupling
+    // between them: choosing a model re-clamps that step's thinking level, and
+    // nobody could see it happen.
+    { key: 'reasoning', title: 'steps' },
     { key: 'unattended', title: 'unattended' },
     { key: 'logging', title: 'logging' },
     { key: 'extensions', title: 'child extensions' },
@@ -83,6 +99,16 @@ export const SECTIONS = [
 ];
 /** Marks a header row, so onChange can ignore one and tests can find them. */
 export const SECTION_ID_PREFIX = 'section:';
+/**
+ * Is this row scenery rather than a setting?
+ *
+ * Reads the ID, not `values`. Those two agreed only while every real row cycled
+ * a list: a picker row has a `submenu` and may carry `values` purely for the
+ * round-trip contract, so "no values" stopped meaning "not a row". Both
+ * `sectionHeader` and `sectionGap` already stamp the prefix, so this is exact
+ * rather than a heuristic, and all three consumers ask the same question.
+ */
+export const isSectionRow = (item) => item.id.startsWith(SECTION_ID_PREFIX);
 /**
  * An inert titled row. No `values` ⇒ SettingsList's Enter handler no-ops on it,
  * and {@link SkipInertRows} steps the cursor straight over it.
@@ -211,15 +237,17 @@ export const ITEMS = [
         + 'For throwaway projects you are not watching'),
     {
         id: 'reasoningMode',
-        section: 'reasoning',
-        label: 'reasoning',
-        description: 'How much the helper sessions think before answering. "default" uses the '
-            + 'per-step table pi-task has measured, "on" and "off" force one answer '
-            + 'everywhere, and "custom" is whatever you set in the "think:" rows below. '
-            + 'Those rows always show what each step actually runs at, and changing one '
-            + 'switches this to custom. A step left on "inherit" uses whatever thinking '
-            + 'level pi itself is set to, which is what every step did before this setting '
-            + 'existed',
+        // Its OWN section, above the per-step block it governs. Sitting inside
+        // that block it read as a twelfth step called `reasoning` — a global
+        // override disguised as one more per-step row.
+        section: 'profile',
+        label: 'profile',
+        description: 'How much every step below thinks, in one word. "default" uses the per-step '
+            + 'table pi-task has measured, "on" and "off" force one answer everywhere and '
+            + 'IGNORE the rows below, and "custom" is whatever those rows say. They always '
+            + 'show what each step actually runs at, so changing one switches this to '
+            + 'custom. A step left on "inherit" uses whatever thinking level pi itself is '
+            + 'set to, which is what every step did before this setting existed',
         values: [...REASONING_MODES],
         format: cfg => String(cfg.reasoningMode),
         apply: (cfg, chosen) => {
@@ -322,9 +350,9 @@ export function applyToolToggle(exempt, toolName, watched) {
  *    though the custom table underneath is untouched, which is the honest
  *    answer to "what will my next child do".
  */
-const REASON_ID_PREFIX = 'reason:';
+const STEP_ID_PREFIX = 'step:';
 /**
- * The label for one `think:` row.
+ * The label for one step row.
  *
  * A group whose name carries a colon is a CHILD of the group before the colon —
  * `research:files` is one of the four workers `research` fans out to. Rendered
@@ -333,37 +361,206 @@ const REASON_ID_PREFIX = 'reason:';
  * parent is also a row.
  *
  * So a child is drawn as a tree branch under its parent and loses the repeated
- * `think: research:` prefix, the same text at the head of four consecutive
- * lines. `└─` on the last child, `├─` on the rest, decided from the group's
- * position in {@link REASONING_GROUPS} rather than a hand-kept list — adding a
- * fifth worker moves the corner on its own.
+ * `research:` prefix, the same text at the head of four consecutive lines. `└─`
+ * on the last child, `├─` on the rest, decided from the group's position in
+ * {@link CHILD_GROUPS} rather than a hand-kept list — adding a fifth worker
+ * moves the corner on its own.
+ *
+ * A parentless group is its own bare name. It carried a `think: ` prefix while
+ * there were two families to tell apart; with one row per step there is nothing
+ * to disambiguate, and the prefix was the widest thing in the column.
  *
  * Leading spaces survive: SettingsList pads the label right, never trims it.
  */
-export function reasoningRowLabel(group) {
+export function stepRowLabel(group) {
     const colon = group.indexOf(':');
     if (colon < 0)
-        return `think: ${group}`;
+        return group;
     const parent = group.slice(0, colon);
-    const nextIsSibling = REASONING_GROUPS[REASONING_GROUPS.indexOf(group) + 1]?.startsWith(`${parent}:`);
+    const nextIsSibling = CHILD_GROUPS[CHILD_GROUPS.indexOf(group) + 1]?.startsWith(`${parent}:`);
     return `   ${nextIsSibling ? '├─' : '└─'} ${group.slice(colon + 1)}`;
 }
-export function reasoningItems() {
-    return REASONING_GROUPS.map(group => ({
-        id: REASON_ID_PREFIX + group,
+/** No registry reachable. Every row still renders; nothing narrows. */
+export const EMPTY_CATALOG = { specs: [], facts: () => undefined };
+/**
+ * The levels a row may offer, given the model that row's group will run on.
+ *
+ * The INTERSECTION with `REASONING_SETTINGS`, not `supportedThinkingLevels`
+ * directly: that returns the whole ladder including `xhigh` and `max`, which
+ * this menu excludes on purpose (see reasoning.ts) because pi's own UI may not
+ * offer them. A model declaring `xhigh` must not smuggle it in here.
+ */
+export function offeredLevels(facts) {
+    if (facts === undefined)
+        return [...REASONING_SETTINGS];
+    const supported = supportedThinkingLevels(facts);
+    return REASONING_SETTINGS.filter(s => s === 'inherit' || supported.includes(s));
+}
+/** The separator between a step row's two halves. */
+const PAIR_SEP = ' \u00b7 ';
+/**
+ * `level · provider/id`, the one string a step row shows and accepts.
+ *
+ * THE LEVEL COMES FIRST, and that is a display decision with teeth.
+ * `SettingsList` truncates a value from the RIGHT, so whatever is last is what
+ * silently disappears — and a real local model id (`local/Qwen3.8-27B-UD-Q4_K_XL
+ * .gguf`) is wide enough to consume the whole column on its own. Level-first
+ * means the half that falls off is the one still identifiable from its head, and
+ * the levels line up as a column you can read down.
+ */
+export function formatStepValue(spec, level) {
+    return `${level}${PAIR_SEP}${spec}`;
+}
+/**
+ * The two halves back out, or `undefined` for anything not of that shape.
+ *
+ * Split on the FIRST separator, because the level leads and is a closed set,
+ * while a `provider/id` could conceivably contain one.
+ */
+export function parseStepValue(value) {
+    const at = value.indexOf(PAIR_SEP);
+    if (at <= 0)
+        return undefined;
+    const level = value.slice(0, at);
+    const spec = value.slice(at + PAIR_SEP.length);
+    if (spec === '' || !REASONING_SETTINGS.includes(level))
+        return undefined;
+    return { spec, level: level };
+}
+/**
+ * One row per step, carrying BOTH dials.
+ *
+ * They were two parallel blocks of eleven, and the coupling between them was
+ * invisible: choosing a model re-clamps that step's thinking level, but the row
+ * that moved was eleven rows away from the row you touched. One row shows the
+ * pair, and the two-step picker shows the clamp happening.
+ *
+ * `values` is the LEGAL cross product — every model against only the levels that
+ * model declares. Nothing renders it: the picker offers two short lists, and the
+ * round-trip property in config-items.test.ts is its only reader. Building it
+ * from `offeredLevels` rather than the full ladder is what makes the property
+ * true, because a pair the model cannot honour would be clamped by `apply` and
+ * would not round-trip.
+ */
+export function stepItems(catalog = EMPTY_CATALOG) {
+    const specs = [MODEL_INHERIT, ...catalog.specs];
+    return CHILD_GROUPS.map(group => ({
+        id: STEP_ID_PREFIX + group,
         section: 'reasoning',
-        label: reasoningRowLabel(group),
-        headlessLabel: `think: ${group}`,
-        description: REASONING_GROUP_HELP[group],
-        values: [...REASONING_SETTINGS],
-        // The EFFECTIVE level, not cfg.reasoningLevels[group]: in default/on/off
-        // the stored table is not what runs, and a row that shows a value the
-        // run does not use is worse than no row. As a FUNCTION rather than a
-        // snapshot, so `syncRows` can re-ask after any change.
-        format: cfg => resolveReasoning(group, cfg),
-        apply: (cfg, chosen) => applyReasoningLevel(cfg, group, chosen)
+        label: stepRowLabel(group),
+        headlessLabel: `step: ${group}`,
+        description: STEP_GROUP_HELP[group],
+        values: specs.flatMap(spec => offeredLevels(catalog.facts(spec)).map(level => formatStepValue(spec, level))),
+        // Built at ENTER-time from the LIVE draft, not when the rows were made:
+        // stage two narrows to the model chosen in stage one, and the user can
+        // have changed another row since the panel opened.
+        picker: cfg => stepPicker(group, cfg, catalog),
+        // The model half VERBATIM even when the catalog no longer offers it — the
+        // vanished-model case, where the row is the only place the user can see
+        // what their config actually holds. The thinking half is the EFFECTIVE
+        // level, not the stored cell: in mode default/on/off the stored table is
+        // not what runs, and a row showing a value the run does not use is worse
+        // than no row.
+        format: cfg => formatStepValue(cfg.groupModels[group], resolveReasoning(group, cfg)),
+        apply: (cfg, chosen) => applyStepValue(cfg, group, chosen, catalog)
     }));
 }
+/**
+ * The two lists behind one step row.
+ *
+ * Stage two is where the coupling becomes visible. It offers only the levels the
+ * chosen model declares, and it OPENS on the level that will actually run — the
+ * current one when that model can honour it, otherwise the clamp, with the
+ * reason written beside it. Picking a model that cannot think is therefore not a
+ * silent downgrade discovered later; it is the option the cursor is already on.
+ */
+function stepPicker(group, cfg, catalog) {
+    const held = cfg.groupModels[group];
+    // The row's CURRENT model leads stage one when the catalog cannot offer it.
+    // Without this, opening the row to nudge only the level would silently
+    // rewrite the model to `inherit`: `FilterList` falls back to index 0 when
+    // the preselect matches nothing, and the two dials are one row now, so there
+    // is no way to touch the level without confirming a model. That would erase
+    // a spec set on the user's other machine — the one thing the loader, the
+    // format function and the startup hint all go out of their way to preserve.
+    const missing = held !== MODEL_INHERIT && !catalog.specs.includes(held);
+    return {
+        first: [
+            ...(missing ?
+                [{ value: held, label: held, description: 'not available here — kept as-is' }]
+                : []),
+            { value: MODEL_INHERIT, label: MODEL_INHERIT, description: "pi's own default" },
+            ...catalog.specs.map(spec => ({
+                value: spec,
+                label: spec,
+                ...(catalog.note?.(spec) === undefined ? {} : { description: catalog.note(spec) })
+            }))
+        ],
+        second: spec => {
+            const facts = catalog.facts(spec);
+            const offered = offeredLevels(facts);
+            const wanted = resolveReasoning(group, cfg);
+            const clamped = facts === undefined || wanted === 'inherit' ?
+                wanted
+                : clampToModel(facts, wanted);
+            // Back inside the menu's own vocabulary. `clampToModel` walks UP
+            // first and knows the whole ladder, so a model declaring `xhigh`
+            // can land on a level `offeredLevels` deliberately excludes — and
+            // then stage two would open on `inherit` with the explanation
+            // attached to no row at all.
+            const runs = offered.includes(clamped) ? clamped : (offered.at(-1) ?? 'inherit');
+            return {
+                options: offered.map(level => ({
+                    value: level,
+                    label: level,
+                    ...(level === runs && runs !== wanted ?
+                        { description: `${spec} cannot do ${wanted}` }
+                        : {})
+                })),
+                preselect: runs
+            };
+        },
+        firstOf: value => parseStepValue(value)?.spec ?? value,
+        join: (spec, level) => formatStepValue(spec, level)
+    };
+}
+/**
+ * Write both halves of a step row, atomically.
+ *
+ * Atomically matters for the round-trip property, which starts from a FRESH
+ * config every iteration: a value that wrote only one half would leave the other
+ * at its default and render as something else.
+ *
+ * The level is re-clamped even though the picker only ever offers legal pairs.
+ * The picker is not the only door — `values` is built when the panel opens, and
+ * a registry that moved underneath it would otherwise let an unhonourable level
+ * through.
+ */
+export function applyStepValue(cfg, group, chosen, catalog) {
+    const pair = parseStepValue(chosen);
+    if (pair === undefined)
+        return;
+    // MEMBERSHIP, not just shape: the panel may only ever write what the picker
+    // showed. That is `inherit`, the catalog's own specs, and — when the catalog
+    // cannot offer it — the spec this cell ALREADY holds, which stage one keeps
+    // at its head precisely so the level can be changed without discarding it.
+    // Re-writing the value that is already there is not a new unresolvable spec.
+    if (pair.spec !== MODEL_INHERIT
+        && pair.spec !== cfg.groupModels[group]
+        && !catalog.specs.includes(pair.spec)) {
+        return;
+    }
+    cfg.groupModels = { ...cfg.groupModels, [group]: pair.spec };
+    const facts = catalog.facts(pair.spec);
+    const level = facts === undefined || pair.level === 'inherit' ?
+        pair.level
+        : clampToModel(facts, pair.level);
+    // Only when it MOVES something: `applyReasoningLevel` flips the whole table
+    // to `custom`, and picking a pair the config already runs must not do that
+    // as a side effect.
+    if (level !== resolveReasoning(group, cfg))
+        applyReasoningLevel(cfg, group, level);
+}
 /**
  * Apply one group row's new value.
  *
@@ -441,18 +638,29 @@ const DOWN_KEY = '\x1b[B';
  *
  * It drives the list through its own public `handleInput` — pressing the very
  * key the user pressed, N times — rather than reaching for the private
- * `selectedIndex`. The mirror it keeps cannot drift: with search off and no
- * submenus, up and down are the only two things that move that index.
+ * `selectedIndex`. With search off, up and down are the only two things that
+ * move that index — EXCEPT while a submenu is open, when `SettingsList` forwards
+ * everything to the submenu and returns without moving it at all. So a picker
+ * suspends this entirely; see `suspended`.
  */
 class SkipInertRows {
     list;
     selectable;
+    suspended;
     index = 0;
     constructor(list, 
     /** True where a row can be selected, in the list's own order. */
-    selectable) {
+    selectable, 
+    /**
+     * True while a picker is open. The list then owns every key, so this
+     * must not intercept — see the flag's own comment in
+     * {@link createSettingsPanel}. Defaulted so the constructor's own
+     * opening walk, and every existing test, are unaffected.
+     */
+    suspended = () => false) {
         this.list = list;
         this.selectable = selectable;
+        this.suspended = suspended;
         // The first row is a header, so the panel would open on it. Only
         // synthesise the keypress if it is actually bound to "down" — feeding
         // a key the list ignores would move the mirror and not the cursor.
@@ -471,9 +679,10 @@ class SkipInertRows {
     }
     handleInput(data) {
         const kb = getKeybindings();
-        const step = kb.matches(data, 'tui.select.down') ? 1
-            : kb.matches(data, 'tui.select.up') ? -1
-                : 0;
+        const step = this.suspended() ? 0
+            : kb.matches(data, 'tui.select.down') ? 1
+                : kb.matches(data, 'tui.select.up') ? -1
+                    : 0;
         if (step === 0) {
             this.list.handleInput(data);
             return;
@@ -502,16 +711,37 @@ export function createSettingsPanel(items, theme,
  * Called with the row's id, its new value, and the LIST ITSELF.
  *
  * The list is handed back because some rows change what OTHER rows display:
- * flipping `reasoning` to off means every `think:` row now runs at off, and
- * a row's `currentValue` is a snapshot taken when the panel was built.
- * Without a way to write the others back, the menu would show
- * `reasoning off` beside rows still claiming `inherit`.
+ * flipping `profile` to off means every `step:` row now runs at off, and a
+ * row's `currentValue` is a snapshot taken when the panel was built. Without
+ * a way to write the others back, the menu would show `profile off` beside
+ * rows still claiming `inherit`.
  */
 onChange, onCancel) {
-    // A row with no `values` is a header or the blank line above one.
-    const headerLabels = new Set(items.filter(i => i.values === undefined).map(i => i.label));
-    const list = new SettingsList(items, MAX_VISIBLE, makeTheme(theme, label => headerLabels.has(label.trimEnd())), (id, newValue) => onChange(id, newValue, list), onCancel);
-    return new BorderedBox(new SkipInertRows(list, items.map(i => (i.values?.length ?? 0) > 0)), CONFIG_TITLE, s => theme.fg('borderMuted', s), s => theme.fg('accent', theme.bold(s)), settingsBodyHeight(items.map(i => i.description), MAX_VISIBLE, OVERLAY_WIDTH - 8));
+    const headerLabels = new Set(items.filter(isSectionRow).map(i => i.label));
+    /**
+     * True while a picker is open, so SkipInertRows stops intercepting arrows.
+     *
+     * `SettingsList.handleInput` delegates to an open submenu and RETURNS, so
+     * `selectedIndex` never moves while one is up. SkipInertRows keeps its own
+     * mirror of that index and replays the key once per row it skips — so
+     * without this flag, one arrow press inside a picker moves the mirror off
+     * the real cursor AND arrives in the picker two or three times when the walk
+     * crosses a section boundary.
+     */
+    let submenuOpen = false;
+    const settingItems = items.map(({ pickerOptions, ...row }) => pickerOptions === undefined ? row : ({
+        ...row,
+        submenu: (currentValue, done) => {
+            submenuOpen = true;
+            return new PairPicker(pickerOptions(), currentValue, theme, v => {
+                submenuOpen = false;
+                done(v);
+            });
+        }
+    }));
+    const list = new SettingsList(settingItems, MAX_VISIBLE, makeTheme(theme, label => headerLabels.has(label.trimEnd())), (id, newValue) => onChange(id, newValue, list), onCancel);
+    return new BorderedBox(new SkipInertRows(list, items.map(i => !isSectionRow(i)
+        && ((i.values?.length ?? 0) > 0 || i.pickerOptions !== undefined)), () => submenuOpen), CONFIG_TITLE, s => theme.fg('borderMuted', s), s => theme.fg('accent', theme.bold(s)), settingsBodyHeight(items.map(i => i.description), MAX_VISIBLE, OVERLAY_WIDTH - 8));
 }
 /**
  * Every settings row for this session, fixed and DISCOVERED, in menu order.
@@ -524,11 +754,14 @@ onChange, onCancel) {
  * Fixed rows come before discovered ones within a section, so a freshly
  * installed extension appends rather than reshuffling the menu.
  */
-export function configRows(installed, tools = []) {
+export function configRows(installed, tools = [], 
+// A third positional with a default, exactly like `tools`, so every existing
+// test stays deterministic and no test has to know a registry exists.
+catalog = EMPTY_CATALOG) {
     // The discovered rows carry a section like every other row — the per-tool
     // watchdog exemptions under `timeouts` (they are exemptions FROM that
     // timeout), and the per-extension toggles under their own heading.
-    return [...ITEMS, ...reasoningItems(), ...toolItems(tools), ...extensionItems(installed)];
+    return [...ITEMS, ...stepItems(catalog), ...toolItems(tools), ...extensionItems(installed)];
 }
 /** Render `rows` for the current config, grouped under their section headers. */
 export function renderRows(cfg, rows) {
@@ -542,6 +775,7 @@ export function renderRows(cfg, rows) {
             description: i.description,
             currentValue: i.format(cfg),
             values: i.values ?? ['on', 'off'],
+            ...(i.picker === undefined ? {} : { pickerOptions: () => i.picker(cfg) }),
             ...(i.headlessLabel === undefined ? {} : { headlessLabel: i.headlessLabel })
         }));
         // An empty section prints no header. `extensions` has no fixed rows at
@@ -555,15 +789,15 @@ export function renderRows(cfg, rows) {
     return out;
 }
 /** The full settings row list for the current config, in menu order. */
-export function panelItems(cfg, installed, tools = []) {
-    return renderRows(cfg, configRows(installed, tools));
+export function panelItems(cfg, installed, tools = [], catalog = EMPTY_CATALOG) {
+    return renderRows(cfg, configRows(installed, tools, catalog));
 }
 /**
  * Re-ask every row what it now displays, and write the answers back.
  *
  * A row's `currentValue` in the live list is a snapshot taken when the panel was
  * built, and rows describe each other: cycling `reasoning` to `off` changes what
- * every `think:` row runs at, and cycling one group row flips the mode, which
+ * every `step:` row runs at, and setting one step row flips the profile, which
  * changes all the others.
  *
  * This runs after ANY change, over EVERY row. Re-reading a `format` costs
@@ -574,6 +808,59 @@ export function syncRows(cfg, rows, list) {
     for (const row of rows)
         list.updateValue(row.id, row.format(cfg));
 }
+/**
+ * The step rows' model offer list, read live when the menu opens.
+ *
+ * `getAvailable()`, never `getAll()`: an unauthed model would spawn a child that
+ * exits 1 on every phase of that group, and offering it would be offering a
+ * config that cannot work.
+ *
+ * A provider registered by a host EXTENSION is offered with a note rather than
+ * hidden. Children run `--no-extensions`, which disables discovery only — pi
+ * still loads every explicit `-e` path, and `childBaseArgs` injects one per
+ * whitelisted extension. So such a model works in a child exactly when its
+ * extension is whitelisted, and we cannot tell which extension that is:
+ * `getRegisteredProviderIds()` gives ids, and the `{name, config, extensionPath}`
+ * triples live in the runner's internal state, drained at bind. Choosing it with
+ * the wrong whitelist fails LOUDLY — the child sees no such provider, so pi's
+ * resolver reports "not found" and exits 1 — which is why a note is enough.
+ */
+function liveCatalog(ctx) {
+    // Same contract as the tool enumeration above, for the same reason: the
+    // model runtime is not guaranteed usable at the moment a command runs, and a
+    // registry that cannot answer must cost the model rows, never the menu.
+    // Every row below still renders; `EMPTY_CATALOG` offers only `inherit` and
+    // narrows nothing, which is exactly the pre-feature panel.
+    let registry;
+    let available;
+    let fromExtension;
+    try {
+        registry = ctx.modelRegistry;
+        available = registry.getAvailable();
+        fromExtension = new Set(registry.getRegisteredProviderIds());
+    }
+    catch {
+        return EMPTY_CATALOG;
+    }
+    return {
+        specs: available.map(m => `${m.provider}/${m.id}`),
+        note: spec => {
+            const parts = splitSpec(spec);
+            return parts && fromExtension.has(parts.provider) ?
+                'provider comes from an extension — whitelist it under child extensions, '
+                    + "or this group's children exit 1"
+                : undefined;
+        },
+        facts: spec => {
+            // `inherit` means the session's own model, which is what a child
+            // resolves today. Its facts are what the thinking row must narrow to.
+            if (spec === MODEL_INHERIT)
+                return ctx.model;
+            const parts = splitSpec(spec);
+            return parts ? registry.find(parts.provider, parts.id) : undefined;
+        }
+    };
+}
 async function handleTaskConfig(_args, ctx, getTools = () => []) {
     const cfg = {
         ...getConfig(),
@@ -582,7 +869,8 @@ async function handleTaskConfig(_args, ctx, getTools = () => []) {
         // Copied for the same reason as the two arrays above: the panel mutates
         // its own draft, and sharing the live object would apply half-made
         // choices to running children before the user finished choosing.
-        reasoningLevels: { ...getConfig().reasoningLevels }
+        reasoningLevels: { ...getConfig().reasoningLevels },
+        groupModels: { ...getConfig().groupModels }
     };
     // Enumerated live at open so an installed extension appears and an
     // uninstalled one vanishes without pi-task doing any bookkeeping. A failed
@@ -592,17 +880,18 @@ async function handleTaskConfig(_args, ctx, getTools = () => []) {
     // one: getAllTools() throws until the extension runtime is initialized, so
     // it can only be read here, when the menu opens, never at registration.
     const tools = getTools();
+    const catalog = liveCatalog(ctx);
     if (ctx.mode !== 'tui') {
         // Built from panelItems and reading the SAME `format` the panel does,
         // so the two renderings cannot disagree about what a setting says. A
         // second walk of the same tables is the one place nobody would notice
         // them drifting, because a headless run has no panel to compare against.
-        const lines = panelItems(cfg, installed, tools)
+        const lines = panelItems(cfg, installed, tools, catalog)
             // The blank rows between sections are there to give the TUI air.
             // One line of `|`-joined text has none to give, and an empty label
             // would print as a stray `[]`.
             .filter(i => i.label !== '')
-            .map(i => i.values === undefined ?
+            .map(i => isSectionRow(i) ?
             `[${i.label.trim()}]`
             : `${(i.headlessLabel ?? i.label).padEnd(22)} ${i.currentValue}`);
         ctx.ui.notify(lines.join('  |  '), 'info');
@@ -610,7 +899,7 @@ async function handleTaskConfig(_args, ctx, getTools = () => []) {
     }
     // Built ONCE and shared by the renderer, the dispatch and the refresh, so
     // all three necessarily agree about which rows exist.
-    const rows = configRows(installed, tools);
+    const rows = configRows(installed, tools, catalog);
     await ctx.ui.custom((_tui, theme, _kb, done) => createSettingsPanel(renderRows(cfg, rows), theme, (id, newValue, list) => {
         // Every row parses its own value. There is no generic
         // fallback and no prefix ladder, so a row that forgets to

package/dist/index.js

@@ -7,6 +7,7 @@ import { registerRemote } from './remote/register.js';
 import { registerCommandWatchdog } from './task/command-watchdog.js';
 import { registerStreamWatchdog } from './task/stream-watchdog.js';
 import { registerImplementationGuards } from './task/implementation-guards.js';
+import { registerModelHoldRestore } from './task/model-hold-stash.js';
 export default function (pi) {
     registerConfig(pi);
     registerTask(pi);
@@ -17,4 +18,5 @@ export default function (pi) {
     registerCommandWatchdog(pi);
     registerStreamWatchdog(pi);
     registerImplementationGuards(pi);
+    registerModelHoldRestore(pi);
 }

package/dist/remote/push.js

@@ -1,13 +1,7 @@
 import { appendFileSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
-import os from 'node:os';
 import path from 'node:path';
 import webpush from 'web-push';
-/** Resolve the XDG data-home base. Same env-or-homedir shape the docs cache uses
- *  (workers/docs-core.ts), but rooted at data-home rather than cache-home: what
- *  lives under here is not reconstructible by re-fetching. */
-function dataHome() {
-    return process.env.XDG_DATA_HOME?.trim() || path.join(os.homedir(), '.local', 'share');
-}
+import { dataHome } from '../shared/data-home.js';
 /** Where the VAPID keypair is persisted. The browser subscribes with this
  *  public key as its applicationServerKey (see ui-script.ts), so the pair has to
  *  outlive the process that created it. */

package/dist/shared/data-home.d.ts

@@ -0,0 +1,8 @@
+/**
+ * The XDG data-home base. Same env-or-homedir shape the docs cache uses
+ * (workers/docs-core.ts), but rooted at data-home rather than cache-home: what
+ * lives under here is not reconstructible by re-fetching.
+ */
+export declare function dataHome(): string;
+/** A file under this machine's pi-task state directory. */
+export declare function stateFile(name: string): string;

package/dist/shared/data-home.js

@@ -0,0 +1,14 @@
+import * as os from 'node:os';
+import * as path from 'node:path';
+/**
+ * The XDG data-home base. Same env-or-homedir shape the docs cache uses
+ * (workers/docs-core.ts), but rooted at data-home rather than cache-home: what
+ * lives under here is not reconstructible by re-fetching.
+ */
+export function dataHome() {
+    return process.env.XDG_DATA_HOME?.trim() || path.join(os.homedir(), '.local', 'share');
+}
+/** A file under this machine's pi-task state directory. */
+export function stateFile(name) {
+    return path.join(dataHome(), 'pi-task', name);
+}