@mjasnikovs/pi-task 0.39.0 → 0.39.1

package/dist/workers/model-warning.js

@@ -1,26 +1,15 @@
 import { getConfig } from '../config/config.js';
-import { setGroupWindows, setUnusableSpecs } from '../config/group-args.js';
-import { MODEL_INHERIT, splitSpec } from '../config/group-models.js';
+import { setGroupModels, setModelEndpoints } from '../config/group-args.js';
 import { CHILD_GROUPS } from '../config/groups.js';
-import { contextWindowForSpec } from '../task/context-usage.js';
+import { resolveGroupModels, resolveModelEndpoints } from '../shared/model-resolve.js';
 import { registerSessionHint } from './session-hint.js';
 const WIDGET_KEY = 'pi-task-model-warning';
-export function findModelProblems(lookup, specs) {
-    const out = [];
-    for (const group of CHILD_GROUPS) {
-        const spec = specs[group];
-        if (spec === MODEL_INHERIT)
-            continue;
-        const parts = splitSpec(spec);
-        if (!parts || lookup.find(parts.provider, parts.id) === undefined) {
-            out.push({ group, spec, why: 'unresolved' });
-            continue;
-        }
-        if (lookup.extensionProviders.has(parts.provider)) {
-            out.push({ group, spec, why: 'extension' });
-        }
-    }
-    return out;
+/** The cells worth a line, in group order. */
+export function modelProblems(snapshot) {
+    return CHILD_GROUPS.flatMap(group => {
+        const { spec, problem } = snapshot[group];
+        return problem === undefined ? [] : [{ group, spec, why: problem }];
+    });
 }
 /**
  * The hint line, or null when every cell is fine.
@@ -54,60 +43,15 @@ export function registerModelWarning(pi,
 readSpecs = () => getConfig().groupModels) {
     // TWO handlers, deliberately. The resolution pass must run in EVERY mode:
     // `registerSessionHint` returns early when `ctx.mode !== 'tui'`, so folding
-    // this into it would leave the argv drop and the churn windows disarmed for
-    // every headless and `--print` run — a guard that only works when someone is
-    // watching is not a guard.
+    // this into it would leave the argv drop, the churn windows and the
+    // dead-backend probe disarmed for every headless and `--print` run — a
+    // guard that only works when someone is watching is not a guard.
     pi.on('session_start', (_event, ctx) => {
-        resolveModelCells(ctx, readSpecs());
+        setGroupModels(resolveGroupModels(ctx, readSpecs()));
+        setModelEndpoints(resolveModelEndpoints(ctx));
     });
     registerSessionHint(pi, WIDGET_KEY, ctx => {
-        const text = formatModelWarning(findModelProblems(lookupFor(ctx), readSpecs()));
+        const text = formatModelWarning(modelProblems(resolveGroupModels(ctx, readSpecs())));
         return text === null ? null : { text };
     });
 }
-/**
- * Answer, once, what every model cell resolves to — and leave both answers where
- * the code that has no `ctx` can read them.
- *
- * `unresolved` only feeds the argv drop: an extension-provided model may well
- * work, since children load explicitly whitelisted extensions, and dropping its
- * flag would break a config that is merely fragile.
- */
-export function resolveModelCells(ctx, specs) {
-    const problems = findModelProblems(lookupFor(ctx), specs);
-    setUnusableSpecs(problems.filter(p => p.why === 'unresolved').map(p => p.spec));
-    // The SAME walk fills the window table, so the argv and the churn rule can
-    // never disagree about which model a group runs on.
-    //
-    // An `inherit` cell gets NO entry, not the parent's window. Storing one
-    // would freeze a session_start snapshot in front of the live per-run value,
-    // so a user who switches the session model with Ctrl+P to a bigger one would
-    // have every child judged against the old window — the churn rule then fires
-    // early and kills a healthy child.
-    //
-    // The whole walk is guarded because `ctx.model` and `ctx.modelRegistry` are
-    // GETTERS that call `assertActive()` and throw on a stale context. Losing the
-    // windows must not also lose the `setUnusableSpecs` above it, nor the hint.
-    try {
-        setGroupWindows(Object.fromEntries(CHILD_GROUPS.filter(g => specs[g] !== MODEL_INHERIT).map(g => [g, contextWindowForSpec(ctx, specs[g])])));
-    }
-    catch {
-        setGroupWindows({});
-    }
-    return problems;
-}
-function lookupFor(ctx) {
-    try {
-        const registry = ctx.modelRegistry;
-        return {
-            find: (provider, id) => registry.find(provider, id),
-            extensionProviders: new Set(registry.getRegisteredProviderIds())
-        };
-    }
-    catch {
-        // A registry that cannot answer must not condemn every cell. Claiming
-        // every spec is unresolved would drop every --model flag on a session
-        // whose runtime simply was not ready.
-        return { find: () => ({}), extensionProviders: new Set() };
-    }
-}

package/dist/workers/pi-worker-core.d.ts

@@ -3,6 +3,29 @@ import { type CommandKill } from '../shared/command-watchdog.js';
 export { commandCeilingForAttempt } from '../shared/command-watchdog.js';
 import { RESTART_ORDER } from './worker-kill.js';
 import { type WorkerGuardOverride, type WorkerGuardPolicy, type WorkerPolicyInputs, type WorkerProfileId } from './worker-profiles.js';
+/**
+ * The argv of one model child.
+ *
+ * `--mode json` puts the child into the structured event stream the runner
+ * parses. Without it the child emits plain text, every line fails JSON.parse,
+ * finalText stays empty, and every caller fails with "produced no output". A
+ * refactor has dropped it once already; do not remove it again.
+ *
+ * An empty `tools` string means "no tools at all" — `--no-tools`, never
+ * `--tools ''`, which pi rejects. A no-tools child cannot make a tool call, so
+ * it carries no in-run guard extension either: the guards all hang off pi's
+ * `tool_call` hook.
+ *
+ * The prompt is NOT an argv element: it goes over stdin (getPiInvocation), so a
+ * large prompt cannot exceed the OS argv ceiling, which fails the spawn outright
+ * rather than truncating (`E2BIG` on this platform).
+ *
+ * `groupArgs` is the child's group fragment, `--model` then `--thinking`, either
+ * half possibly absent. Resolved by the CALLER: both are properties of the
+ * child's ROLE, and this function is handed tools, not a name. One field rather
+ * than a `model` beside a `thinking` so nothing composes the halves by hand.
+ */
+export declare function childArgs(tools: string, extensions?: readonly string[], groupArgs?: readonly string[]): string[];
 /**
  * Tool calls that can GROUND an APIS claim — i.e. return content a signature or
  * command could be cited from. `pi-worker-docs` (the primary), `read` and `grep`
@@ -66,10 +89,29 @@ export interface RunWorkerInput {
     cwd: string;
     signal?: AbortSignal;
     spawn?: SpawnFn;
-    /** Comma-separated tool whitelist passed to `pi --tools`. Defaults to read,grep,find,ls. */
+    /**
+     * Comma-separated tool whitelist passed to `pi --tools`. Defaults to
+     * read,grep,find,ls; `''` means `--no-tools` (see childArgs).
+     */
     tools?: string;
     /** Internal extension entry-point paths to load via `-e <path>` (see childBaseArgs). */
-    extensions?: string[];
+    extensions?: readonly string[];
+    /**
+     * ONE more attempt after the loop budget is spent, with different tools and
+     * a terminal hint, instead of returning the loop kill. It is not a retry:
+     * no restart rule runs on it, and its result is the run's result.
+     *
+     * For a child whose deliverable is a text rewrite that never strictly
+     * needed a read (refine): a model that thrashed re-reading files is stripped
+     * of its tools and ordered to emit from what it has, because a hard fail
+     * there kills a whole /task-auto run for a model that merely over-explored.
+     * A child whose output depends on real reads must NOT carry one — with no
+     * tools it would fabricate.
+     */
+    rescue?: {
+        tools: string;
+        hint: (hit: LoopHit) => string;
+    };
     /** Called for each tool execution start and text-writing event inside the worker. */
     onLine?: (line: string) => void;
     /** Called when a tool call FINISHES, with its (truncatable) result — lets a caller
@@ -197,6 +239,13 @@ export interface WorkerRestart {
     workMs: number;
     /** Reason-specific diagnosis: the looping call, the hung tool, the error text. */
     detail?: string;
+    /** The hit itself on a `loop` restart, for a consumer that records the call. */
+    loopHit?: LoopHit;
+    /**
+     * This attempt was discarded for the RESCUE, not a retry: the loop budget
+     * was spent, and what follows runs under `rescue`'s tools and hint.
+     */
+    rescue?: true;
     /**
      * Characters of ANSWER TEXT this attempt had produced at the moment it was
      * thrown away.
@@ -324,10 +373,13 @@ export interface RunWorkerResult {
      *
      * Check BEFORE `aborted`, same reasoning as `stalled`: the kill aborts too.
      */
-    commandTimedOut?: {
-        toolName: string;
-        timeoutMs: number;
-    };
+    commandTimedOut?: CommandKill;
+    /**
+     * The final attempt was the `rescue`. Its text is the run's answer; a
+     * rescue that produced none is honestly the loop kill it stood in for, and
+     * the caller reports it as one.
+     */
+    rescued?: true;
     /**
      * Set when the stream watchdog killed the worker's FINAL attempt: the model
      * stream produced nothing for the configured window while no tool was running.
@@ -350,9 +402,16 @@ interface RestartState {
     streamStalled?: {
         idleMs: number;
     };
+    stalled: boolean;
+    /** The profile's `stalled.restart` switch. */
+    restartOnStalled: boolean;
     timedOut: boolean;
     modelError?: string;
     leaked: string | null;
+    /** A clean, complete run that answered with no text at all. */
+    empty: boolean;
+    /** The profile's `empty-answer` switch. */
+    restartOnEmpty: boolean;
     /** The cap this attempt actually died against, not the configured one:
      *  `extend`/`progress` can push the deadline out during the attempt. */
     effectiveCapMs: number;
@@ -402,19 +461,5 @@ interface RestartRule {
     /** Backoff before re-spawning, in ms. Only the connection rule waits. */
     backoffMs?: (s: RestartState) => number;
 }
-/**
- * The restart ladder, in precedence order. FIRST MATCH WINS.
- *
- * Read the `!loopHit` guards as "a loop kill outranks me even when it has no
- * budget left". They are not redundant with row order: when a loop is detected
- * but the shared budget is spent, row 1 declines, and without those guards row 2
- * or 4 would then restart the same runaway child under a hint that does not
- * describe why it died.
- *
- * The whole ritual — check the budget, set the hint, spend the counters, record
- * and announce the discarded attempt, sleep, re-spawn — belongs to the loop in
- * `runWorker`, so a new failure mode is one row here and cannot be added without
- * becoming visible in `restarts`.
- */
 export declare const RESTART_RULES: readonly RestartRule[];
 export declare function runWorker(input: RunWorkerInput): Promise<RunWorkerResult>;

package/dist/workers/pi-worker-core.js

@@ -4,9 +4,9 @@ import { commandCeilingForAttempt, commandTimeoutHint, commandWatch } from '../s
 export { commandCeilingForAttempt } from '../shared/command-watchdog.js';
 import { isGroundingRetrieval as isGrounding, workerChannel } from './worker-channels.js';
 import { childBaseArgs } from '../shared/child-extensions.js';
-import { LoopDetector, MAX_LOOP_RESTARTS } from '../task/loop-detector.js';
+import { LoopDetector, MAX_LOOP_RESTARTS, formatLoopHint } from '../task/loop-detector.js';
 import { StallDetector, formatStallHint } from '../task/stall-detector.js';
-import { formatLoopHint, isConnectionError, connectionRetryBackoffMs } from '../task/child-runner.js';
+import { isConnectionError, connectionRetryBackoffMs } from '../shared/connection-error.js';
 import { detectLeakedToolCall, leakedToolCallHint, MAX_LEAK_RETRIES } from '../shared/leaked-tool-call.js';
 import { childModelEndpoints, probeModelEndpoints } from '../shared/model-endpoint.js';
 import { modelSpecFromArgs } from '../config/group-models.js';
@@ -16,6 +16,33 @@ import { CARRY_FORWARD_IDS, RESTART_ORDER } from './worker-kill.js';
 import { applyOverride, WORKER_PROFILES } from './worker-profiles.js';
 /** The tool whitelist a caller gets when it names none. */
 const DEFAULT_TOOLS = 'read,grep,find,ls';
+/**
+ * The argv of one model child.
+ *
+ * `--mode json` puts the child into the structured event stream the runner
+ * parses. Without it the child emits plain text, every line fails JSON.parse,
+ * finalText stays empty, and every caller fails with "produced no output". A
+ * refactor has dropped it once already; do not remove it again.
+ *
+ * An empty `tools` string means "no tools at all" — `--no-tools`, never
+ * `--tools ''`, which pi rejects. A no-tools child cannot make a tool call, so
+ * it carries no in-run guard extension either: the guards all hang off pi's
+ * `tool_call` hook.
+ *
+ * The prompt is NOT an argv element: it goes over stdin (getPiInvocation), so a
+ * large prompt cannot exceed the OS argv ceiling, which fails the spawn outright
+ * rather than truncating (`E2BIG` on this platform).
+ *
+ * `groupArgs` is the child's group fragment, `--model` then `--thinking`, either
+ * half possibly absent. Resolved by the CALLER: both are properties of the
+ * child's ROLE, and this function is handed tools, not a name. One field rather
+ * than a `model` beside a `thinking` so nothing composes the halves by hand.
+ */
+export function childArgs(tools, extensions = [], groupArgs = []) {
+    const toolFlags = tools === '' ? ['--no-tools'] : ['--tools', tools];
+    const internal = tools === '' ? [] : extensions;
+    return [...childBaseArgs(internal), ...groupArgs, '--mode', 'json', ...toolFlags];
+}
 /**
  * The one place `'unknown'` becomes the 0 both consumers already treat as
  * "no window". Written once so a future reader cannot re-introduce the optional
@@ -232,21 +259,22 @@ absoluteCeilingMs) {
  * `runWorker`, so a new failure mode is one row here and cannot be added without
  * becoming visible in `restarts`.
  */
+/**
+ * A stall hit carries no meaningful windowSize (rule 1 sets it to 0), so
+ * printing the loop shape would misname why the attempt died.
+ */
+function loopDetail(hit) {
+    return hit.stall ?
+        `${hit.call.name} ${hit.stall} ×${hit.count}`
+        : `${hit.call.name} ×${hit.count}/${hit.windowSize}`;
+}
 export const RESTART_RULES = [
     {
-        // A loop-kill gets the same restart-with-hint treatment every other phase
-        // already gets (runPhaseChild) — name the offending call so the
+        // A loop-kill is restarted with a hint naming the offending call so the
         // re-spawn avoids it. Bounded by the shared restart budget.
         reason: 'loop',
         detect: s => s.loopHit && s.restartBudgetSpent < MAX_LOOP_RESTARTS ?
-            {
-                // A stall hit carries no meaningful windowSize (rule 1 sets
-                // it to 0), so printing the loop shape would misname why the
-                // attempt died.
-                detail: s.loopHit.stall ?
-                    `${s.loopHit.call.name} ${s.loopHit.stall} ×${s.loopHit.count}`
-                    : `${s.loopHit.call.name} ×${s.loopHit.count}/${s.loopHit.windowSize}`
-            }
+            { detail: loopDetail(s.loopHit) }
             : null,
         hint: s => s.loopHit.stall ? formatStallHint(s.loopHit.stall) : formatLoopHint(s.loopHit),
         counters: { shared: true }
@@ -284,6 +312,19 @@ export const RESTART_RULES = [
         hint: s => streamStallHint(s.streamStalled.idleMs),
         counters: { shared: true }
     },
+    {
+        // A dead-backend kill, for the profiles that would rather earn the
+        // verdict on every attempt than trust one probe sample. No hint: nothing
+        // the model did caused it, and a hint in flight must survive the retry.
+        reason: 'stalled',
+        detect: s => (s.stalled
+            && !s.loopHit
+            && s.restartOnStalled
+            && s.restartBudgetSpent < MAX_LOOP_RESTARTS) ?
+            { detail: 'no output for the stall window and no endpoint answered' }
+            : null,
+        counters: { shared: true }
+    },
     {
         // A wall-clock timeout (the backstop for varied thrash the exact-match
         // detector misses) is also restartable, sharing the same budget. Skip when
@@ -332,25 +373,22 @@ export const RESTART_RULES = [
             : null,
         hint: s => leakedToolCallHint(s.leaked),
         counters: { leak: true }
+    },
+    {
+        // An empty completion on a clean run, for the profiles that treat it as
+        // a swallowed provider error rather than an answer. No hint: there is
+        // nothing to correct, and one already in flight must survive.
+        reason: 'empty-answer',
+        detect: s => s.empty && !s.loopHit && s.restartOnEmpty && s.restartBudgetSpent < MAX_LOOP_RESTARTS ?
+            { detail: 'no assistant text' }
+            : null,
+        counters: { shared: true }
     }
 ];
 export async function runWorker(input) {
-    const tools = input.tools ?? DEFAULT_TOOLS;
-    // `--mode json` makes pi emit structured events as they happen instead of
-    // buffering the assistant text and flushing on exit. Its print-mode source
-    // shows both halves: under `json` a session subscriber writes every event to
-    // stdout as it arrives, while under `text` NOTHING is written until after the
-    // prompt resolves, when the last assistant message is printed once. That is
-    // what makes the wait/work split real — onFirstByte would otherwise fire
-    // moments before close and leave workMs at nearly zero.
-    const baseArgs = [
-        ...childBaseArgs(input.extensions ?? []),
-        ...(input.groupArgs ?? []),
-        '--mode',
-        'json',
-        '--tools',
-        tools
-    ];
+    // Reassigned once at most, by the rescue.
+    let tools = input.tools ?? DEFAULT_TOOLS;
+    let rescued = false;
     // ONE resolution, before the first attempt. Every guard read below goes
     // through `policy`, so "which knobs is this child running" has exactly one
     // answer and it is observable (`onPolicy`) rather than inferable.
@@ -404,7 +442,11 @@ export async function runWorker(input) {
         const prompt = [hint, carried, input.prompt]
             .filter((p) => p !== null)
             .join('\n\n');
-        const invocation = getPiInvocation([...baseArgs], prompt);
+        // `--mode json` (childArgs) makes pi emit events as they happen instead
+        // of buffering the assistant text and flushing on exit, which is what
+        // makes the wait/work split below real — onFirstByte would otherwise
+        // fire moments before close and leave workMs at nearly zero.
+        const invocation = getPiInvocation(childArgs(tools, input.extensions ?? [], input.groupArgs ?? []), prompt);
         const tAttemptStart = Date.now();
         let tFirstByte = null;
         // loop === false turns the guard off entirely (detector is null and no
@@ -423,11 +465,6 @@ export async function runWorker(input) {
         // context event at all, so waiting for one leaves the rule permanently
         // disarmed. The parent knows the window at spawn time.
         stallDetector?.noteContext(contextWindowTokens(input.contextWindow));
-        // Capture the hit the detector reports (it also returns it to the unified
-        // runner, which kills the child on a hit). Without capturing it here the
-        // SIGTERM that kill produces would surface as a bare non-zero exit the
-        // caller couldn't distinguish from a crash.
-        let loopHit;
         // Reset EACH attempt: on a restart the previous attempt's calls are
         // discarded with its text, so the count must describe only the attempt
         // whose text this call returns.
@@ -472,11 +509,9 @@ export async function runWorker(input) {
                     // Loop detector first: it names the offending call and its
                     // hint is the more specific one. The stall detector is the
                     // backstop for the thrash shapes a 20-call argument window
-                    // cannot see.
-                    const hit = loopDetector?.record(call) ?? stallDetector?.record(call) ?? null;
-                    if (hit && !loopHit)
-                        loopHit = hit;
-                    return hit;
+                    // cannot see. A hit is returned to the runner, which kills
+                    // the child and reports it as `kill.by === 'loop'`.
+                    return loopDetector?.record(call) ?? stallDetector?.record(call) ?? null;
                 },
                 // Output is the other half of "still working": a worker
                 // writing its answer is making progress even when it has no
@@ -517,7 +552,7 @@ export async function runWorker(input) {
         const workMs = tFirstByte === null ? 0 : tEnd - tFirstByte;
         // Record + announce a discarded attempt. Called from every `continue`
         // branch below, so a restart cannot be added without becoming visible.
-        const noteRestart = (reason, detail) => {
+        const noteRestart = (reason, detail, extra = {}) => {
             const record = {
                 attempt: restarts.length + 1,
                 reason,
@@ -525,7 +560,8 @@ export async function runWorker(input) {
                 waitMs,
                 workMs,
                 partialChars: text.trim().length,
-                ...(detail ? { detail } : {})
+                ...(detail ? { detail } : {}),
+                ...extra
             };
             restarts.push(record);
             input.onRestart?.(record);
@@ -545,22 +581,33 @@ export async function runWorker(input) {
         };
         const text = result.text ?? '';
         const timedOut = timeout.timedOut();
-        const commandKill = cmdWatch?.killed();
-        const streamStalled = result.streamStalled;
+        const kill = result.kill;
+        const loopHit = kill?.by === 'loop' ? kill.hit : undefined;
+        const commandKill = kill?.by === 'command-timeout' ? kill : undefined;
+        const streamStalled = kill?.by === 'stream-stall' ? { idleMs: kill.idleMs } : undefined;
+        const stalled = kill?.by === 'stalled';
         // Only treat output as a leak on a clean, complete run — a non-zero exit
         // or abort yields partial text the caller already handles, and detecting
         // there would just mislabel the real failure.
-        const leaked = result.exitCode === 0 && !result.aborted ? detectLeakedToolCall(text) : null;
+        const clean = result.exitCode === 0 && !result.aborted;
+        const leaked = clean ? detectLeakedToolCall(text) : null;
         // THE RESTART LADDER. Precedence is RESTART_RULES' row order; this loop
         // owns the ritual every rule would otherwise repeat: budget, hint, counters,
         // record-and-announce, backoff, re-spawn.
+        //
+        // Not run on the rescue attempt, which is final by contract, nor after a
+        // cancel: a user who pressed ESC between attempts must not buy a spawn.
         const state = {
             ...(loopHit ? { loopHit } : {}),
             ...(commandKill ? { commandKill } : {}),
             ...(streamStalled ? { streamStalled } : {}),
+            stalled,
+            restartOnStalled: guards.stalled !== false && guards.stalled.restart,
             timedOut,
             ...(result.modelError !== undefined ? { modelError: result.modelError } : {}),
             leaked,
+            empty: clean && result.modelError === undefined && text.trim().length === 0,
+            restartOnEmpty: guards['empty-answer'],
             effectiveCapMs,
             tools,
             restartBudgetSpent,
@@ -568,8 +615,9 @@ export async function runWorker(input) {
             connectionRetries: guards['connection-error'],
             leakRetries
         };
+        const ladderOpen = !rescued && input.signal?.aborted !== true;
         let restarted = false;
-        for (const rule of RESTART_RULES) {
+        for (const rule of ladderOpen ? RESTART_RULES : []) {
             const hit = rule.detect(state);
             if (!hit)
                 continue;
@@ -585,7 +633,7 @@ export async function runWorker(input) {
                 connRetries++;
             // Noted BEFORE any backoff sleep, so the record's wallMs stays the
             // attempt's own clock; the sleep lands in totalWallMs, where it belongs.
-            noteRestart(rule.reason, hit.detail);
+            noteRestart(rule.reason, hit.detail, loopHit ? { loopHit } : {});
             if (rule.backoffMs)
                 await (input.sleepFor ?? defaultSleep)(rule.backoffMs(state));
             restarted = true;
@@ -593,6 +641,15 @@ export async function runWorker(input) {
         }
         if (restarted)
             continue;
+        // Reached only with the loop rule out of budget: the rules above all
+        // decline a loop-killed attempt once the shared budget is spent.
+        if (ladderOpen && loopHit && input.rescue) {
+            rescued = true;
+            hint = input.rescue.hint(loopHit);
+            tools = input.rescue.tools;
+            noteRestart('loop', loopDetail(loopHit), { loopHit, rescue: true });
+            continue;
+        }
         // SALVAGE. Returning the LAST attempt's text unconditionally makes a
         // worker whose final attempt was killed early report nothing at all — even
         // when a discarded attempt produced a usable answer that was still in hand
@@ -617,7 +674,7 @@ export async function runWorker(input) {
             exitCode: result.exitCode,
             aborted: result.aborted,
             timedOut,
-            ...(result.stalled === true ? { stalled: true } : {}),
+            ...(stalled ? { stalled: true } : {}),
             ...(loopHit ? { loopHit } : {}),
             ...(leaked ? { leakedToolCall: leaked } : {}),
             ...(commandKill ? { commandTimedOut: commandKill } : {}),
@@ -646,16 +703,18 @@ export async function runWorker(input) {
             ...(leaked ? { leakedToolCall: leaked } : {}),
             ...(loopHit ? { loopHit } : {}),
             ...(timedOut ? { timedOut: true } : {}),
-            ...(result.stalled ? { stalled: true } : {}),
+            ...(stalled ? { stalled: true } : {}),
             ...(streamStalled ? { streamStalled } : {}),
             ...(commandKill ?
                 {
                     commandTimedOut: {
                         toolName: commandKill.toolName,
-                        timeoutMs: commandKill.timeoutMs
+                        timeoutMs: commandKill.timeoutMs,
+                        ...(commandKill.detail ? { detail: commandKill.detail } : {})
                     }
                 }
-                : {})
+                : {}),
+            ...(rescued ? { rescued: true } : {})
         };
     }
 }

package/dist/workers/reasoning-warning.js

@@ -22,7 +22,7 @@
 import { getConfig } from '../config/config.js';
 import { effectiveReasoning } from '../config/reasoning.js';
 import { reasoningMismatches } from '../shared/reasoning-capability.js';
-import { MODEL_INHERIT, splitSpec } from '../config/group-models.js';
+import { resolveModel } from '../shared/model-resolve.js';
 import { probeChatTemplateCaps } from '../shared/model-endpoint.js';
 import { registerSessionHint } from './session-hint.js';
 const WIDGET_KEY = 'pi-task-reasoning-warning';
@@ -93,7 +93,7 @@ probe = probeChatTemplateCaps,
  */
 readSpecs = () => getConfig().groupModels) {
     registerSessionHint(pi, WIDGET_KEY, ctx => {
-        const facts = (g) => groupModelFacts(ctx, readSpecs()[g]);
+        const facts = (g) => resolveModel(ctx, readSpecs()[g]);
         const mismatches = reasoningMismatches(facts, readSettings());
         const base = formatReasoningWarning(mismatches);
         if (base === null)
@@ -123,28 +123,6 @@ readSpecs = () => getConfig().groupModels) {
         };
     });
 }
-/** What one group runs on, as {@link reasoningMismatches} wants it. */
-function groupModelFacts(ctx, spec) {
-    // `inherit` is the session's model. That is decision 3 of the model table —
-    // children are NOT switched to follow the host — and the honest value is
-    // settings.json's default, which need not be the session's. Naming the
-    // session's model is still the better of the two: it is the one the user can
-    // see, and on every machine with one provider the two agree.
-    const model = spec === MODEL_INHERIT ?
-        ctx.model
-        : (() => {
-            const parts = splitSpec(spec);
-            return parts ? ctx.modelRegistry.find(parts.provider, parts.id) : undefined;
-        })();
-    if (!model)
-        return undefined;
-    return {
-        name: model.name || model.id,
-        reasoning: model.reasoning,
-        ...(model.thinkingLevelMap === undefined ? {} : { thinkingLevelMap: model.thinkingLevelMap }),
-        ...(model.baseUrl ? { baseUrl: model.baseUrl } : {})
-    };
-}
 /** The distinct servers behind a set of mismatches, deduped by URL. */
 function distinctBackends(mismatches, facts) {
     const byUrl = new Map();

package/dist/workers/worker-failure.d.ts

@@ -44,6 +44,7 @@ export interface WorkerFailureInput {
     commandTimedOut?: {
         toolName: string;
         timeoutMs: number;
+        detail?: string;
     };
     streamStalled?: {
         idleMs: number;
@@ -64,6 +65,7 @@ export type WorkerFailure = {
     kind: 'command-timeout';
     toolName: string;
     timeoutMs: number;
+    detail?: string;
 } | {
     kind: 'stream-stall';
     idleMs: number;

package/dist/workers/worker-failure.js

@@ -59,7 +59,8 @@ export const FAILURE_RULES = [
             {
                 kind: 'command-timeout',
                 toolName: r.commandTimedOut.toolName,
-                timeoutMs: r.commandTimedOut.timeoutMs
+                timeoutMs: r.commandTimedOut.timeoutMs,
+                ...(r.commandTimedOut.detail ? { detail: r.commandTimedOut.detail } : {})
             }
             : null
     },