@sangyaahub/pi-marg 1.0.1 → 1.0.4

package/adapters/pi/extensions/model-router.ts

@@ -1,9 +1,17 @@
 import { Type } from "typebox";
 
 import {
+  FALLBACK_LEVELS,
   MODEL_STATE_TYPE,
   emptyModelRouteState,
+  executeAutomaticFailover,
   executeModelRoute,
+  failedModelSelector,
+  findTerminalUsageLimitFailure,
+  formatFailoverRecoveryMessage,
+  hasConfiguredFallback,
+  modelFailureKey,
+  modelToolUsageLimitFailure,
   restoreModelRouteState,
   type ModelLike,
   type ModelRouteParams,
@@ -26,24 +34,126 @@ function availableModels(ctx: any): ModelLike[] {
 
 export default function modelRouter(pi: any) {
   let state = emptyModelRouteState();
-  pi.on("session_start", (_event: unknown, ctx: any) => {
+  let recoveryToken: symbol | undefined;
+  let sessionGeneration = 0;
+  let pendingModelFailure: { selector: string; key: string } | undefined;
+  let pendingToolFailure: { selector: string; key: string } | undefined;
+  const restore = (_event: unknown, ctx: any) => {
+    sessionGeneration += 1;
+    recoveryToken = undefined;
+    pendingModelFailure = undefined;
+    pendingToolFailure = undefined;
     state = restoreModelRouteState(ctx.sessionManager.getBranch());
+  };
+
+  pi.on("session_start", restore);
+  pi.on("session_tree", restore);
+
+  const recoverFromUsageLimit = async (failure: { selector: string; key: string }, ctx: any) => {
+    if (recoveryToken) return;
+    if (!hasConfiguredFallback(state)) return;
+    const generation = sessionGeneration;
+    const token = Symbol("pi-marg-recovery");
+    recoveryToken = token;
+    try {
+      const execution = await executeAutomaticFailover(state, failure.selector, {
+        runtimeName: "Pi",
+        models: availableModels(ctx),
+        hasExternalDevin: hasExternalDevin(pi),
+        activate: (model) => pi.setModel(model),
+        persist: (nextState) => {
+          if (sessionGeneration !== generation) throw new Error("session changed during automatic recovery");
+          pi.appendEntry(MODEL_STATE_TYPE, nextState);
+        },
+      }, failure.key);
+      if (sessionGeneration !== generation) {
+        ctx.ui?.notify?.(
+          "PiMarg stopped an in-flight recovery because the session changed. Verify the active model before continuing.",
+          "warning",
+        );
+        return;
+      }
+      if (execution.ignoredDuplicate) return;
+      state = execution.state;
+      if (!execution.switched) {
+        if (!execution.stateChanged) return;
+        ctx.ui?.notify?.(
+          "PiMarg could not resume automatically because no configured backup model remains. Re-run the model chooser after restoring provider access.",
+          "error",
+        );
+        if (execution.persistenceError) {
+          ctx.ui?.notify?.(
+            `PiMarg updated recovery state only in memory because the session ledger could not be saved: ${execution.persistenceError}`,
+            "error",
+          );
+        }
+        return;
+      }
+
+      const title = execution.switched.level === "high" ? "High" : "Low";
+      ctx.ui?.notify?.(
+        execution.reusedCurrent
+          ? `PiMarg kept the ${title} backup ${execution.switched.selection.selector} active after ${failure.selector} reached its limit and is resuming safely.`
+          : `PiMarg switched ${failure.selector} to the ${title} backup ${execution.switched.selection.selector} and is resuming automatically.`,
+        "warning",
+      );
+      if (execution.persistenceError) {
+        ctx.ui?.notify?.(
+          `The model switched, but PiMarg could not save the recovery state to the session ledger: ${execution.persistenceError}`,
+          "error",
+        );
+      }
+      pi.sendUserMessage(
+        formatFailoverRecoveryMessage(
+          state,
+          failure.selector,
+          execution.switched.level,
+          execution.switched.selection.selector,
+          execution.reusedCurrent,
+        ),
+        { deliverAs: "followUp" },
+      );
+    } finally {
+      if (recoveryToken === token) recoveryToken = undefined;
+    }
+  };
+
+  pi.on("agent_end", (event: any, ctx: any) => {
+    const failed = findTerminalUsageLimitFailure(event?.messages ?? []);
+    pendingModelFailure = failed
+      ? { selector: failedModelSelector(failed, ctx.model), key: modelFailureKey(failed) }
+      : undefined;
+  });
+
+  pi.on("tool_execution_end", (event: any) => {
+    pendingToolFailure = modelToolUsageLimitFailure(event) ?? pendingToolFailure;
+  });
+
+  pi.on("agent_settled", async (_event: unknown, ctx: any) => {
+    const failure = pendingModelFailure ?? pendingToolFailure;
+    pendingModelFailure = undefined;
+    pendingToolFailure = undefined;
+    if (!failure) return;
+    await recoverFromUsageLimit(failure, ctx);
   });
 
   pi.registerTool({
     name: "auto_model_route",
     label: "PiMarg Model Router",
-    description: "Discover, select, and activate live A/B/C/D model choices while enforcing A different from C and B different from D.",
+    description: "Discover, select, and activate live A/B/C/D models plus distinct high/low automatic usage-limit backups.",
     parameters: Type.Object({
       action: Type.Union([
         Type.Literal("catalog"),
         Type.Literal("select"),
+        Type.Literal("select_fallback"),
         Type.Literal("activate"),
         Type.Literal("status"),
       ]),
       stage: Type.Optional(Type.Union([Type.Literal("A"), Type.Literal("B"), Type.Literal("C"), Type.Literal("D")])),
+      fallback: Type.Optional(Type.Union(FALLBACK_LEVELS.map((level) => Type.Literal(level)))),
       target: Type.Optional(Type.String()),
       workType: Type.Optional(Type.Number()),
+      provider: Type.Optional(Type.String()),
     }),
     async execute(_toolCallId: string, params: ModelRouteParams, _signal: unknown, _onUpdate: unknown, ctx: any) {
       const models = availableModels(ctx);

package/adapters/pi/prompts/auto-models.md

@@ -1,12 +1,12 @@
 ---
-description: List or change the active Auto Mode A/B/C/D model selections from Pi's live authenticated catalog.
+description: List or change A/B/C/D models and the high/low automatic recovery pair from Pi's live authenticated catalog.
 argument-hint: [status | choose]
 ---
 
 Load `auto-mode-router` and read its model-routing reference.
 
-- With no argument or `status`, call `auto_model_route` with `action: status`, then show the saved A/B/C/D selectors and separation checks.
-- With `choose`, call `auto_model_route` with `action: catalog` and the active work type. Present only required stages and exact available selectors. Save each answer with `action: select`.
+- With no argument or `status`, call `auto_model_route` with `action: status`, then show the saved A/B/C/D selectors, separation checks, high/low backups, active fallback, and last failover.
+- With `choose`, call `auto_model_route` with `action: catalog` and the active work type. Present required stages and exact available selectors. Save each stage with `action: select`, then save two distinct runtime models with `action: select_fallback`, first `fallback: high`, then `fallback: low`.
 - Do not type or persist a model ID that the live catalog did not return.
 - Treat any model returned by Pi's registry as a normal in-session route. Treat Devin or another external coding-agent session as a capability-gated external route; creating one requires `post-web` approval.
 - C/D are the authoritative independent review selectors. Any detected advisor or watcher is supplemental and must not weaken the A≠C or B≠D checks.

package/agents/auto-intake.md

@@ -7,4 +7,4 @@ blocking: true
 autoloadSkills: [auto-mode-router]
 ---
 
-Complete only the intake and availability checks from `auto-mode-router`. Ask in the required order: work context, work type, skill mode, live A/B/C/D selections, then add-ons. Call `auto_runtime_status` before recommending runtime capabilities. Return the proposed `[AUTO-MODE]` state. Do not plan, implement, or change project files.
+Complete only the intake and availability checks from `auto-mode-router`. Ask in the required order: work context, work type, skill mode, live A/B/C/D selections, high and low runtime backups, then add-ons. Call `auto_runtime_status` before recommending runtime capabilities. Return the proposed `[AUTO-MODE]` state. Do not plan, implement, or change project files.

package/commands/auto-models.md

@@ -1,12 +1,12 @@
 ---
-description: List or change the active Auto Mode A/B/C/D model selections from OMP's live authenticated catalog.
+description: List or change A/B/C/D models and the high/low automatic recovery pair from OMP's live authenticated catalog.
 argument-hint: [status | choose]
 ---
 
 Load `auto-mode-router` and read its model-routing reference.
 
-- With no argument or `status`, call `auto_model_route` with `action: status`, then show the saved A/B/C/D selectors and separation checks.
-- With `choose`, call `auto_model_route` with `action: catalog` and the active work type. Present only required stages and exact available selectors. Save each answer with `action: select`.
+- With no argument or `status`, call `auto_model_route` with `action: status`, then show the saved A/B/C/D selectors, separation checks, high/low backups, active fallback, and last failover.
+- With `choose`, call `auto_model_route` with `action: catalog` and the active work type. Present required stages and exact available selectors. Save each stage with `action: select`, then save two distinct runtime models with `action: select_fallback`, first `fallback: high`, then `fallback: low`.
 - Do not type or persist a model ID that the live catalog did not return.
 - Distinguish native `devin/swe-*` OMP models from the optional external `devin/mcp-session` route. Only creating the external session requires `post-web` approval.
 - C/D are the authoritative independent review selectors. A configured OMP advisor is supplemental and must not weaken the A≠C or B≠D checks.