@selesai/code 0.13.39 → 0.14.0

package/dist/extensions/pi-subagents/src/runs/shared/model-resolution-diagnostic.ts

@@ -0,0 +1,76 @@
+export interface ChildModelResolutionDiagnostic {
+	agent?: string;
+	model?: string;
+	host?: "parent" | "runner";
+	/** The launch's resolved capability ceiling, when one is active. */
+	capabilityCeiling?: { denyExtensions: boolean; sources?: readonly string[] };
+}
+
+/**
+ * Pi core's model-resolution failure text. `resolveCliModel` reports an
+ * unknown provider or model and cannot know which extension would have
+ * registered it, so these two shapes are the ones that mean "the child's
+ * model registry was missing a provider", not "the provider is unhealthy".
+ */
+const MODEL_RESOLUTION_FAILURE_PATTERNS = [
+	/^Model .+ not found\b/i,
+	/^Unknown provider "/i,
+];
+
+/** True for a core model-resolution failure, which a missing extension can explain. */
+export function isChildModelResolutionFailure(error: string | undefined): boolean {
+	const text = typeof error === "string" ? error.trim() : "";
+	return MODEL_RESOLUTION_FAILURE_PATTERNS.some((pattern) => pattern.test(text));
+}
+
+/**
+ * A `capabilityCeiling.denyExtensions` launch loads no extension at all:
+ * ambient, listed, and MCP provider extensions are all suppressed, so neither
+ * `async: true` nor a frontmatter list can register the provider. Saying only
+ * the ambient-extension rule would direct the operator at remedies the ceiling
+ * discards.
+ */
+function capabilityCeilingDeniesExtensions(diagnostic: ChildModelResolutionDiagnostic): boolean {
+	return diagnostic.capabilityCeiling?.denyExtensions === true;
+}
+
+function denyExtensionsClause(diagnostic: ChildModelResolutionDiagnostic): string {
+	const sources = diagnostic.capabilityCeiling?.sources ?? [];
+	return `Capability ceiling from ${sources.length > 0 ? sources.join(", ") : "an unnamed source"} denies extensions`;
+}
+
+/**
+ * Explain a child model that did not resolve because the extension serving its
+ * provider never loaded: a foreground child never loads the parent's ambient
+ * extensions, an explicit `extensions` list keeps a background child from
+ * loading them, and a capability ceiling denies extensions to both. The caller
+ * keeps the core error intact and appends this explanation, so a genuinely
+ * unknown model id still reads as one.
+ */
+export function formatChildModelResolutionDiagnostic(diagnostic: ChildModelResolutionDiagnostic): string {
+	const subject = diagnostic.agent ? `Agent '${diagnostic.agent}'` : "Subagent";
+	const model = diagnostic.model ? `'${diagnostic.model}'` : "this model";
+	if (capabilityCeilingDeniesExtensions(diagnostic)) {
+		return (diagnostic.host === "parent"
+			? [
+				`${subject} ran as a foreground child, which never loads the parent's ambient extensions.`,
+				`${denyExtensionsClause(diagnostic)}, so if ${model} is served by a provider extension, that extension cannot load for this child: \`async: true\` does not help either, and listed \`subagentOnlyExtensions\` or \`extensions\` entries are suppressed.`,
+				"Relax the capability ceiling to allow extensions, or use a model that the parent's model registry already resolves.",
+			]
+			: [
+				`${subject} ran as a background child without the ambient extensions.`,
+				`${denyExtensionsClause(diagnostic)}, so if ${model} is served by a provider extension, that extension cannot load for this child: listed \`subagentOnlyExtensions\` or \`extensions\` entries are suppressed, and leaving \`extensions\` unset does not enable ambient loading.`,
+				"Relax the capability ceiling to allow extensions, or use a model that the child's model registry already resolves.",
+			]).join("\n");
+	}
+	if (diagnostic.host === "parent") {
+		return [
+			`${subject} ran as a foreground child, which never loads the parent's ambient extensions but inherits the providers they registered.`,
+			`If ${model} is served by a provider extension, check the parent's \`/model\` list and the child extension diagnostics, or load the extension for this child with \`subagentOnlyExtensions\` or \`extensions\` in the agent frontmatter.`,
+		].join("\n");
+	}
+	return [
+		`${subject} ran as a background child without the ambient extensions.`,
+		`If ${model} is served by a provider extension, that extension is not loaded for this child: list it in \`subagentOnlyExtensions\` or \`extensions\` in the agent frontmatter, or leave \`extensions\` unset so the child loads the ambient extensions.`,
+	].join("\n");
+}

package/dist/extensions/pi-subagents/src/runs/shared/{model-fallback.ts → model-resolution.ts}

@@ -1,30 +1,32 @@
 import { splitKnownThinkingSuffix as splitThinkingSuffix, type ModelInfo as AvailableModelInfo } from "../../shared/model-info.ts";
-import type { Usage } from "../../shared/types.ts";
-import { filterFallbackCandidates, findModelExclusion, parseModelKey, recordModelFailure } from "./model-exclusions.ts";
-import { checkModelScope, type ModelScopeCheckRule, type ModelScopeViolation, type ModelSource } from "./model-scope.ts";
-import { redactSecretValues } from "./permissions.ts";
+import { checkModelScope, SCOPED_PATTERN, type ModelScopeCheckRule, type ModelScopeViolation, type ModelSource } from "./model-scope.ts";
 
 export type { AvailableModelInfo };
 
-interface ModelAttemptSummary {
-	model: string;
-	success: boolean;
-	exitCode?: number | null;
-	error?: string;
-	usage?: Usage;
+export interface ModelSelectionEvidence {
+	model?: string;
+	requestedModel?: string;
 }
 
 export { splitThinkingSuffix };
 
-/** Aliases apply only to the resolved launch candidate (without its thinking suffix) and the exact raw response ID. */
+/**
+ * Aliases apply only to the resolved launch candidate (without its thinking suffix) and the exact raw response ID.
+ * When the child's live selection is a Pi virtual model, assistant messages name the physical model it dispatched
+ * to, so the virtual selection's provider/id is compared exactly with the launch candidate instead.
+ */
 export function formatSubagentModelVerificationError(
 	expectedModel: string,
 	observedModel: string,
 	availableModels: AvailableModelInfo[] | undefined,
 	modelResponseAliases?: Record<string, string[]>,
+	observedVirtualModel?: string,
 ): string | undefined {
 	if (!availableModels || availableModels.length === 0) return undefined;
 	const expectedBase = splitThinkingSuffix(expectedModel).baseModel;
+	if (observedVirtualModel !== undefined) {
+		return observedVirtualModel === expectedBase ? undefined : `model_verification_failed: native Pi child selected virtual model '${observedVirtualModel}', but the launch candidate was '${expectedModel}'. modelResponseAliases does not apply to a virtual-model selection.`;
+	}
 	if (modelResponseAliases && Object.hasOwn(modelResponseAliases, expectedBase)
 		&& modelResponseAliases[expectedBase]?.includes(observedModel)) return undefined;
 	const observedBase = splitThinkingSuffix(observedModel).baseModel;
@@ -56,6 +58,23 @@ export function normalizeParentModel(model: unknown): ParentModel | undefined {
 	return { provider: candidate.provider, id: candidate.id };
 }
 
+/**
+ * Provider/id ids of the host session's scoped-model snapshot (`ctx.scopedModels`).
+ * Pi reports an empty set when the session is unscoped (nothing configured, or no
+ * pattern matched), and then allows every model; `scoped` narrows that to `inherit`.
+ */
+export function scopedModelIdsFromContext(ctx: { scopedModels?: ReadonlyArray<{ model?: unknown }> }): string[] {
+	const scoped = ctx.scopedModels;
+	if (!Array.isArray(scoped)) return [];
+	const ids: string[] = [];
+	for (const entry of scoped) {
+		const model = entry?.model;
+		const normalized = normalizeParentModel(model);
+		if (normalized) ids.push(`${normalized.provider}/${normalized.id}`);
+	}
+	return ids;
+}
+
 /**
  * Normalize a model id or provider segment for fuzzy comparison: case-fold,
  * treat dots/underscores as dashes (so `4.5` matches `4-5`), and collapse
@@ -146,7 +165,12 @@ function resolveBaseModelCandidate(
 		if (exactId) return exactId;
 	}
 
-	return fuzzyResolveModel(baseModel, availableModels, preferredProvider);
+	const fuzzy = fuzzyResolveModel(baseModel, availableModels, preferredProvider);
+	if (fuzzy || queryProvider === undefined) return fuzzy;
+	// Some catalogs (OpenRouter's `openrouter/auto-beta`) repeat the provider inside the id.
+	const queryId = normalizeModelSegment(baseModel);
+	const prefixedIdMatches = availableModels.filter((entry) => normalizeModelSegment(entry.id) === queryId && normalizeModelSegment(entry.provider) === queryProvider);
+	return prefixedIdMatches.length === 1 ? prefixedIdMatches[0]!.fullId : undefined;
 }
 
 /**
@@ -268,12 +292,15 @@ function configuredScopes(scope: ModelScopeCheckRule | ModelScopeCheckRule[] | u
 	return scope ? (Array.isArray(scope) ? scope : [scope]) : [];
 }
 
-function throwForUnresolvedEnforcedInheritScope(scope: ModelScopeCheckRule | ModelScopeCheckRule[] | undefined, includeMixed = false): void {
-	const unresolvedInheritScope = configuredScopes(scope)
-		.find((entry) => entry.enforce === true && (includeMixed ? entry.allow?.includes(INHERIT_MODEL) : entry.allow?.length === 1 && entry.allow[0] === INHERIT_MODEL));
-	if (!unresolvedInheritScope) return;
-	const origin = unresolvedInheritScope.origin ?? "modelScope";
-	throw new Error(`Cannot enforce subagent model scope (${origin}): 'inherit' requires a current parent session model.`);
+function throwForUnresolvedEnforcedReservedScope(scope: ModelScopeCheckRule | ModelScopeCheckRule[] | undefined, includeMixed = false): void {
+	const unresolvedReservedScope = configuredScopes(scope)
+		.find((entry) => entry.enforce === true && (includeMixed
+			? entry.allow?.some((pattern) => pattern === INHERIT_MODEL || pattern === SCOPED_PATTERN)
+			: entry.allow?.length === 1 && (entry.allow[0] === INHERIT_MODEL || entry.allow[0] === SCOPED_PATTERN)));
+	if (!unresolvedReservedScope) return;
+	const origin = unresolvedReservedScope.origin ?? "modelScope";
+	const token = unresolvedReservedScope.allow?.includes(INHERIT_MODEL) ? INHERIT_MODEL : SCOPED_PATTERN;
+	throw new Error(`Cannot enforce subagent model scope (${origin}): '${token}' requires a current parent session model.`);
 }
 
 function enforceModelScopes(
@@ -290,57 +317,6 @@ function enforceModelScopes(
 	for (const violation of violations) (onWarn ?? defaultScopeWarn)(violation);
 }
 
-const MODEL_EXCLUSION_DIAGNOSTIC_MAX_LENGTH = 240;
-const MODEL_EXCLUSION_DIAGNOSTIC_MAX_ENTRIES = 20;
-
-function sanitizeModelExclusionDiagnostic(value: string | undefined, fallback: string): string {
-	const normalized = typeof value === "string"
-		? value.replace(/[\u0000-\u001f\u007f\u2028\u2029]+/g, " ").trim()
-		: "";
-	return redactSecretValues(normalized || fallback).slice(0, MODEL_EXCLUSION_DIAGNOSTIC_MAX_LENGTH);
-}
-
-function formatModelExclusionExpiry(expiresAt: number): string {
-	if (!Number.isFinite(expiresAt)) return "unknown";
-	const date = new Date(expiresAt);
-	return Number.isNaN(date.getTime()) ? "unknown" : date.toISOString();
-}
-
-function formatExcludedCandidateEvidence(candidate: string, exclusion: NonNullable<ReturnType<typeof findModelExclusion>>): string {
-	const { provider, modelId } = parseModelKey(candidate);
-	const displayCandidate = sanitizeModelExclusionDiagnostic(candidate, "unknown");
-	const displayModel = sanitizeModelExclusionDiagnostic(modelId, "unknown");
-	const displayProvider = sanitizeModelExclusionDiagnostic(provider ?? exclusion.provider, "unspecified");
-	const reason = sanitizeModelExclusionDiagnostic(exclusion.reason, "runtime-failure");
-	return `${displayCandidate} — model: ${displayModel}; provider: ${displayProvider}; reason: ${reason}; expires: ${formatModelExclusionExpiry(exclusion.expiresAt)}`;
-}
-
-const MODEL_UNAVAILABLE_EXCLUSION_PATTERNS = [
-	/model.*not found/i,
-	/unknown model/i,
-	/model.*unavailable/i,
-	/model.*disabled/i,
-];
-
-function isCurrentRegistryModel(candidate: string, availableModels: AvailableModelInfo[] | undefined): boolean {
-	if (!availableModels || availableModels.length === 0) return false;
-	const { baseModel } = splitThinkingSuffix(candidate);
-	return availableModels.some((entry) => entry.fullId === baseModel);
-}
-
-function ignoreStaleModelUnavailableExclusion(candidate: string, exclusion: NonNullable<ReturnType<typeof findModelExclusion>>, availableModels: AvailableModelInfo[] | undefined): boolean {
-	const reason = exclusion.reason ?? "";
-	return MODEL_UNAVAILABLE_EXCLUSION_PATTERNS.some((pattern) => pattern.test(reason)) && isCurrentRegistryModel(candidate, availableModels);
-}
-
-function throwForExplicitModelExclusion(model: string): void {
-	const exclusion = findModelExclusion(model);
-	if (!exclusion) return;
-	const reason = redactSecretValues((exclusion.reason ?? "runtime-failure").replace(/[\u0000-\u001f\u007f]+/g, " ")).slice(0, 240);
-	const expiry = Number.isFinite(exclusion.expiresAt) ? `; expires: ${new Date(exclusion.expiresAt).toISOString()}` : "";
-	throw new Error(`Requested subagent model '${model}' is excluded and cannot be replaced by a fallback (reason: ${reason}${expiry}).`);
-}
-
 /**
  * Resolve the `--model` override passed to a spawned subagent.
  *
@@ -368,7 +344,7 @@ export function resolveSubagentModelOverride(
 ): string | undefined {
 	const trimmed = typeof requestedModel === "string" ? requestedModel.trim() : "";
 	const explicit = trimmed && trimmed !== INHERIT_MODEL ? trimmed : undefined;
-	if (!parentModel) throwForUnresolvedEnforcedInheritScope(options?.scope, explicit === undefined || options?.source === "inherited");
+	if (!parentModel) throwForUnresolvedEnforcedReservedScope(options?.scope, explicit === undefined || options?.source === "inherited");
 	let resolved: string | undefined;
 	let resolvedFromRegistry = explicit === undefined;
 	if (explicit === undefined) {
@@ -377,7 +353,6 @@ export function resolveSubagentModelOverride(
 		const candidate = resolveSubagentModelCandidate(explicit, availableModels, preferredProvider);
 		if (options?.source === "explicit") {
 			resolved = candidate ?? resolveRequiredSubagentModelCandidate(explicit, availableModels, preferredProvider);
-			throwForExplicitModelExclusion(resolved);
 			resolvedFromRegistry = true;
 		} else if (candidate) {
 			resolved = candidate;
@@ -421,19 +396,15 @@ export function resolveEffectiveSubagentModel(
 
 export type ModelOrigin = ModelSource | "configured";
 
-export interface BuildModelCandidatesOptions {
-	/** Fallback models warn by default and throw when strict scope enforcement is enabled. */
+export interface ResolveModelSelectionOptions {
 	scope?: ModelScopeCheckRule | ModelScopeCheckRule[];
 	onWarn?: (violation: ModelScopeViolation) => void;
 	/** The primary model came from the running parent session, not configuration. */
 	primaryModelFromParent?: boolean;
-	/** How the primary model was selected. Explicit stays strict and does not rotate to fallbacks. */
+	/** How the model was selected. */
 	origin?: ModelOrigin;
 }
 
-const ZERO_USABLE_MODEL_CANDIDATES_ERROR =
-	"No usable subagent models remain after registry, scope, and cached-exclusion filtering.";
-
 export function resolveModelOrigin(input: {
 	explicitModel?: string | boolean;
 	agentModel?: string | boolean;
@@ -458,174 +429,30 @@ export function inheritsParentModel(
 	return Boolean(parentModel && (!trimmed || trimmed === INHERIT_MODEL));
 }
 
-export function buildModelCandidates(
-	primaryModel: string | undefined,
-	fallbackModels: string[] | undefined,
+export function resolveModelSelection(
+	model: string | undefined,
 	availableModels: AvailableModelInfo[] | undefined,
 	preferredProvider?: string,
-	options?: BuildModelCandidatesOptions,
-): string[] {
-	if (!primaryModel) throwForUnresolvedEnforcedInheritScope(options?.scope, true);
+	options?: ResolveModelSelectionOptions,
+): ModelSelectionEvidence {
+	if (!model) throwForUnresolvedEnforcedReservedScope(options?.scope, true);
 	const origin = options?.origin ?? (options?.primaryModelFromParent ? "inherited" : "configured");
+	const requestedModel = origin === "inherited" ? undefined : model;
 	const scopes = configuredScopes(options?.scope);
-	type ExcludedCandidate = { candidate: string; exclusion: NonNullable<ReturnType<typeof findModelExclusion>> };
-	const excludedCandidates: ExcludedCandidate[] = [];
-	let excludedCandidateCount = 0;
-	const warnCachedExclusion = (candidate: string, exclusion: NonNullable<ReturnType<typeof findModelExclusion>>) => {
-		excludedCandidateCount++;
-		if (excludedCandidates.length < MODEL_EXCLUSION_DIAGNOSTIC_MAX_ENTRIES) excludedCandidates.push({ candidate, exclusion });
-		const displayCandidate = sanitizeModelExclusionDiagnostic(candidate, "unknown");
-		const reason = sanitizeModelExclusionDiagnostic(exclusion.reason, "runtime-failure");
-		console.warn(`[pi-subagents] Skipping model '${displayCandidate}' due to a cached exclusion (reason: ${reason}; expires: ${formatModelExclusionExpiry(exclusion.expiresAt)}).`);
-	};
-	if (origin === "explicit" && primaryModel) {
-		const normalized = resolveRequiredSubagentModelCandidate(primaryModel.trim(), availableModels, preferredProvider);
-		throwForExplicitModelExclusion(normalized);
+	if (origin === "explicit" && model) {
+		const normalized = resolveRequiredSubagentModelCandidate(model.trim(), availableModels, preferredProvider);
 		enforceModelScopes(normalized, scopes, "explicit", options?.onWarn);
-		primaryModel = normalized;
+		model = normalized;
 	}
-	const seen = new Set<string>();
-	const candidates: string[] = [];
-	const rawCandidates = [primaryModel, ...(fallbackModels ?? [])];
-	let skippedPrimary: string | undefined;
-	let skippedFallback: string | undefined;
-	for (let index = 0; index < rawCandidates.length; index++) {
-		const raw = rawCandidates[index];
-		if (!raw) continue;
-		const model = raw.trim();
-		const normalized = index === 0 && (origin === "inherited" || origin === "explicit" || options?.primaryModelFromParent)
-			? model
-			: resolveSubagentModelCandidate(model, availableModels, preferredProvider);
-		if (!normalized) {
-			if (index === 0) skippedPrimary = model;
-			else {
-				skippedFallback ??= model;
-				console.warn(`[pi-subagents] Skipping fallback model '${model}' because it is unavailable in this environment.`);
-			}
-			continue;
-		}
-		if (seen.has(normalized)) continue;
-		if (index > 0 || scopes.some((scope) => scope.enforce === true && scope.strict === true)) {
-			enforceModelScopes(normalized, scopes, "inherited", options?.onWarn);
-		}
-		seen.add(normalized);
-		candidates.push(normalized);
-	}
-	const resolved = filterFallbackCandidates(candidates, {
-		onExcluded: warnCachedExclusion,
-		ignoreExclusion: (candidate, exclusion) => ignoreStaleModelUnavailableExclusion(candidate, exclusion, availableModels),
-	});
-	if (resolved.length === 0) {
-		if (skippedPrimary) resolveRequiredSubagentModelCandidate(skippedPrimary, availableModels, preferredProvider);
-		if (candidates.length === 0 && skippedFallback) resolveRequiredSubagentModelCandidate(skippedFallback, availableModels, preferredProvider);
-		if (candidates.length > 0) {
-			const shownExclusions = excludedCandidates;
-			const omittedExclusions = excludedCandidateCount - shownExclusions.length;
-			const evidence = shownExclusions.length > 0
-				? ` (excluded: ${shownExclusions.map(({ candidate, exclusion }) => formatExcludedCandidateEvidence(candidate, exclusion)).join("; ")}${omittedExclusions > 0 ? `; ... and ${omittedExclusions} more` : ""})`
-				: "";
-			throw new Error(`${ZERO_USABLE_MODEL_CANDIDATES_ERROR}${evidence}`);
-		}
-		return resolved;
+	const resolved = model && (origin === "inherited" || origin === "explicit" || options?.primaryModelFromParent)
+		? model.trim()
+		: model ? resolveRequiredSubagentModelCandidate(model.trim(), availableModels, preferredProvider) : undefined;
+	if (resolved && scopes.some((scope) => scope.enforce === true && scope.strict === true)) {
+		enforceModelScopes(resolved, scopes, "inherited", options?.onWarn);
 	}
-	if (skippedPrimary) {
-		console.warn(`[pi-subagents] Skipping primary model '${skippedPrimary}' because it is unavailable in this environment.`);
-	}
-	return resolved;
+	return { ...(resolved ? { model: resolved } : {}), ...(requestedModel ? { requestedModel } : {}) };
 }
-
-const RETRYABLE_MODEL_FAILURE_PATTERNS = [
-	/^REQUEST_LIMIT_EXCEEDED$/,
-	/rate\s*limit/i,
-	/usage\s*limit/i,
-	/too many requests/i,
-	/\b429\b/,
-	/quota/i,
-	/billing/i,
-	/credit/i,
-	/auth(?:entication)?/i,
-	/unauthori[sz]ed/i,
-	/forbidden/i,
-	/api key/i,
-	/token expired/i,
-	/invalid key/i,
-	/provider.*unavailable/i,
-	/model.*unavailable/i,
-	/model.*disabled/i,
-	/model.*not found/i,
-	/unknown model/i,
-	/overloaded/i,
-	/service unavailable/i,
-	/temporar(?:ily)? unavailable/i,
-	/connection\s+(?:error|reset|closed|aborted)/i,
-	/connection refused/i,
-	/fetch failed/i,
-	/network error/i,
-	/socket hang up/i,
-	/stream ended without finish_reason/i,
-	/upstream/i,
-	/timed? out/i,
-	/timeout/i,
-	/\b500\b/,
-	/\b502\b/,
-	/\b503\b/,
-	/\b504\b/,
-	/internal server error/i,
-	/cold.?start/i,
-	/empty response/i,
-	/no output/i,
-	/model.*(?:load|fail|error)/i,
-];
-
-/**
- * Failures reported as `<tool> failed (exit N): ...` or `<tool> failed with
- * exit code N` come from a tool call inside the child's task, not from the
- * provider/model, however network-flavored their details read. Retrying a
- * different model cannot fix them and would rerun the whole task. Tool names
- * include namespaced forms like `mcp.server/write`.
- */
-const TOOL_FAILURE_PREFIX = /^[\w.:@/-]+ failed (?:(?:\(exit \d+\):)|(?:with exit code \d+))(?:\s|$)/i;
-
-export function isRetryableModelFailure(error: string | undefined): boolean {
-	if (!error) return false;
-	if (TOOL_FAILURE_PREFIX.test(error.trim())) return false;
-	return RETRYABLE_MODEL_FAILURE_PATTERNS.some((pattern) => pattern.test(error));
-}
-
-function messageError(message: unknown): string | undefined {
-	if (!message || typeof message !== "object") return undefined;
-	const value = (message as { errorMessage?: unknown }).errorMessage;
-	return typeof value === "string" ? value : undefined;
-}
-
-export function isRetryableModelFailureAttempt(input: { error: string | undefined; messages?: readonly unknown[]; toolCount?: number }): boolean {
-	if (!isRetryableModelFailure(input.error)) return false;
-	if ((input.toolCount ?? 0) > 0) return false;
-	if (input.error === "Subagent produced no output (possible model cold-start or empty response)." || /^Subagent produced no output after terminal assistant stopReason "[^"]+"\.$/.test(input.error ?? "")) return true;
-	if ((input.toolCount ?? 0) === 0 && (input.messages?.length ?? 0) === 0) return true;
-	const error = input.error?.trim();
-	return Boolean(error && input.messages?.some((message) => messageError(message)?.trim() === error));
-}
-
-// Request-shape failures can match broad fallback signals such as "upstream",
-// but do not establish that the model is unhealthy for subsequent requests.
-const REQUEST_SHAPE_FAILURE_PATTERN = /\b(?:bad[ _]request|invalid[ _]argument|invalid_request_error)\b/i;
-
-export function recordRetryableModelFailure(model: string | undefined, error: string | undefined): void {
-	if (!model || !error || !isRetryableModelFailure(error) || isContextOverflow(error)) return;
-	if (REQUEST_SHAPE_FAILURE_PATTERN.test(error)) return;
-	const { provider, modelId } = parseModelKey(model);
-	recordModelFailure({ modelId, reason: error, ...(provider ? { provider } : {}) });
-}
-
-/**
- * Context-overflow signals. These are deliberately NOT part of
- * {@link RETRYABLE_MODEL_FAILURE_PATTERNS}: an overflow means the input was too
- * large for the model's context window, so retrying the same input on another
- * model (or the same model again) cannot succeed. Callers should treat overflow
- * as a terminal, non-retryable failure and surface a clear "input too large"
- * error instead of burning fallback attempts on a guaranteed failure.
- */
+/** Context-overflow signals used to surface a clear input-too-large error. */
 const CONTEXT_OVERFLOW_PATTERNS = [
 	/context(?: length| window| limit)? (?:exceed|overflow|too long)/i,
 	/maximum context length/i,
@@ -642,13 +469,6 @@ const CONTEXT_OVERFLOW_PATTERNS = [
 
 export function isContextOverflow(error: string | undefined): boolean {
 	if (!error) return false;
-	if (TOOL_FAILURE_PREFIX.test(error.trim())) return false;
+	if (/^[\w.:@/-]+ failed (?:(?:\(exit \d+\):)|(?:with exit code \d+))(?:\s|$)/i.test(error.trim())) return false;
 	return CONTEXT_OVERFLOW_PATTERNS.some((pattern) => pattern.test(error));
 }
-
-export function formatModelAttemptNote(attempt: ModelAttemptSummary, nextModel?: string): string {
-	const failure = attempt.error?.trim() || `exit ${attempt.exitCode ?? 1}`;
-	return nextModel
-		? `[fallback] ${attempt.model} failed: ${failure}. Retrying with ${nextModel}.`
-		: `[fallback] ${attempt.model} failed: ${failure}.`;
-}

package/dist/extensions/pi-subagents/src/runs/shared/model-scope.ts

@@ -17,7 +17,7 @@ import { splitKnownThinkingSuffix } from "../../shared/model-info.ts";
 
 export interface ModelScopeRule {
 	enforce?: boolean;
-	/** Reject inherited and fallback models outside the allowlist instead of warning. */
+	/** Reject inherited models outside the allowlist instead of warning. */
 	strict?: boolean;
 	/** Glob-style allow patterns (only `*` is special), matched against `provider/id`. */
 	allow?: string[];
@@ -48,6 +48,10 @@ export interface ModelScopeViolation {
 	origin: string;
 }
 
+export const SCOPED_PATTERN = "scoped";
+
+const MAX_RENDERED_PATTERNS = 8;
+
 function stripThinkingSuffix(model: string): string {
 	return splitKnownThinkingSuffix(model).baseModel;
 }
@@ -86,6 +90,9 @@ export function checkModelScope(
 	const baseModel = stripThinkingSuffix(model);
 	const severity: ModelScopeViolation["severity"] = source === "explicit" || scope.strict === true ? "error" : "warn";
 	const origin = scope.origin ?? "modelScope";
+	const rendered = allow.length <= MAX_RENDERED_PATTERNS
+		? allow.join(", ")
+		: `${allow.slice(0, MAX_RENDERED_PATTERNS).join(", ")}, … (${allow.length} patterns total)`;
 	return {
 		model: baseModel,
 		severity,
@@ -93,12 +100,22 @@ export function checkModelScope(
 		origin,
 		message:
 			`Model '${baseModel}' is outside the configured subagent model scope (${origin}). ` +
-			`Allowed patterns: ${allow.join(", ")}.`,
+			`Allowed patterns: ${rendered}.`,
 	};
 }
 
-function expandInheritPattern(pattern: string, parentModel: { provider: string; id: string } | undefined): string {
-	return pattern === "inherit" && parentModel ? `${parentModel.provider}/${parentModel.id}` : pattern;
+/** An empty scoped snapshot degrades `scoped` to `inherit`; absent inputs stay literal so enforced resolution fails closed. */
+function expandReservedPatterns(
+	pattern: string,
+	parentModel: { provider: string; id: string } | undefined,
+	scopedModelIds: readonly string[] | undefined,
+): string[] {
+	if (pattern === SCOPED_PATTERN) {
+		if (scopedModelIds?.length) return [...scopedModelIds];
+		return parentModel ? [`${parentModel.provider}/${parentModel.id}`] : [pattern];
+	}
+	if (pattern === "inherit") return parentModel ? [`${parentModel.provider}/${parentModel.id}`] : [pattern];
+	return [pattern];
 }
 
 function assertRecord(value: unknown, field: string, meta: { filePath: string }, expected = "an object"): Record<string, unknown> {
@@ -145,23 +162,25 @@ export function resolveModelScopesForAgent(
 	config: ModelScopeConfig | undefined,
 	agentName: string,
 	parentModel: { provider: string; id: string } | undefined,
+	scopedModelIds?: readonly string[],
 ): ResolvedModelScope[] {
 	if (!config) return [];
 	const scopes: ResolvedModelScope[] = [];
 	if (config.allow) {
-		scopes.push({
-			...(config.enforce !== undefined ? { enforce: config.enforce } : {}),
-			...(config.strict !== undefined ? { strict: config.strict } : {}),
-			allow: config.allow.map((pattern) => expandInheritPattern(pattern, parentModel)),
+		const globalScope: ResolvedModelScope = {
+			allow: config.allow.flatMap((pattern) => expandReservedPatterns(pattern, parentModel, scopedModelIds)),
 			origin: "modelScope",
-		});
+		};
+		if (config.enforce !== undefined) globalScope.enforce = config.enforce;
+		if (config.strict !== undefined) globalScope.strict = config.strict;
+		scopes.push(globalScope);
 	}
 	const agentScope = config.agents?.[agentName];
 	if (agentScope?.allow) {
 		scopes.push({
 			enforce: agentScope.enforce ?? config.enforce,
 			strict: agentScope.strict ?? config.strict,
-			allow: agentScope.allow.map((pattern) => expandInheritPattern(pattern, parentModel)),
+			allow: agentScope.allow.flatMap((pattern) => expandReservedPatterns(pattern, parentModel, scopedModelIds)),
 			origin: `modelScope.agents.${agentName}`,
 		});
 	}
@@ -202,4 +221,4 @@ export function parseModelScopeConfig(
 	}
 
 	return Object.keys(config).length > 0 ? config : undefined;
-}
+}

package/dist/extensions/pi-subagents/src/runs/shared/nested-events.ts

@@ -232,10 +232,12 @@ function sanitizeLaunchResolvedExtensions(value: unknown): LaunchResolvedChildEx
 		disableAmbientExtensions: raw.disableAmbientExtensions,
 		runtime: stringList(raw.runtime),
 		configured: stringList(raw.configured),
+		required: Array.isArray(raw.required) ? raw.required.filter((item): item is string => typeof item === "string" && /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(item)).slice(0, 32) : [],
 		effective: stringList(raw.effective),
 		omitted: {
 			runtime: omittedCount("runtime"),
 			configured: omittedCount("configured"),
+			required: omittedCount("required"),
 			effective: omittedCount("effective"),
 		},
 	};
@@ -611,6 +613,18 @@ export interface NestedRunMatch {
 	run: NestedRunSummary;
 }
 
+export function retainNestedLookupRoute(
+	state: Pick<SubagentState, "currentSessionId" | "retainedNestedLookupRoutes">,
+	route: NestedRouteInfo | undefined,
+	sessionId: string | undefined,
+): void {
+	if (!route || !sessionId || sessionId !== state.currentSessionId) return;
+	if (state.retainedNestedLookupRoutes?.sessionId !== sessionId) {
+		state.retainedNestedLookupRoutes = { sessionId, routes: new Map() };
+	}
+	state.retainedNestedLookupRoutes.routes.set(route.rootRunId, route);
+}
+
 export interface NestedRunResolutionScope {
 	routes: NestedRoute[];
 	descendantOf?: { parentRunId: string; parentStepIndex?: number };
@@ -1063,8 +1077,15 @@ export function isTopLevelAsyncDir(asyncDir: string): boolean {
 	return containedPath(DIRS.async, resolved) && !containedPath(path.join(TEMP_ROOT_DIR, "nested-subagent-runs"), resolved);
 }
 
-export function nestedResultsPath(rootRunId: string, id: string): string {
+export function nestedRunScope(rootRunId: string) {
 	assertSafeId("rootRunId", rootRunId);
+	return {
+		asyncDirRoot: path.join(TEMP_ROOT_DIR, "nested-subagent-runs", rootRunId),
+		resultsDir: path.join(DIRS.results, "nested", rootRunId),
+	};
+}
+
+export function nestedResultsPath(rootRunId: string, id: string): string {
 	assertSafeId("id", id);
-	return path.join(DIRS.results, "nested", rootRunId, `${id}.json`);
-}
+	return path.join(nestedRunScope(rootRunId).resultsDir, `${id}.json`);
+}

package/dist/extensions/pi-subagents/src/runs/shared/orca-progress-tabs.ts

@@ -29,7 +29,7 @@ const ORCA_CREATE_WATCHDOG_SCRIPT = [
 	"function exists(file){try{return fs.existsSync(file)}catch{return false}}",
 	"function keepQueued(){try{const now=new Date();fs.utimesSync(done,now,now)}catch{}}",
 	"function predecessorReady(){if(previous==='-')return true;if(exists(previous.replace(/\\.pending$/,'.ready')))return true;try{return Date.now()-fs.statSync(previous).mtimeMs>=waitTimeout}catch{return true}}",
-	"function updateManifest(state,stdout=''){if(manifest==='-')return;try{const payload=JSON.parse(fs.readFileSync(manifest,'utf8'));payload.state=state;payload.updatedAt=new Date().toISOString();const raw=stdout.trim().split(/\\r?\\n/).filter(Boolean).at(-1);if(raw){try{payload.orca=JSON.parse(raw)}catch{payload.orcaRaw=raw.slice(0,4096)}}fs.writeFileSync(manifest,JSON.stringify(payload,null,2)+'\\n')}catch{}}",
+	"function updateManifest(state,stdout=''){if(manifest==='-')return;try{const payload=JSON.parse(fs.readFileSync(manifest,'utf8'));payload.state=state;payload.updatedAt=new Date().toISOString();const raw=stdout.trim();if(raw){try{payload.orca=JSON.parse(raw)}catch{payload.orcaRaw=raw.slice(0,4096)}}fs.writeFileSync(manifest,JSON.stringify(payload,null,2)+'\\n')}catch{}}",
 	"function start(){",
 	" try{",
 	"  const child=spawn(command,args,{stdio:['ignore','pipe','ignore'],windowsHide:true});",
@@ -105,9 +105,10 @@ const VIEWER_SCRIPT = [
 	"if(state==='escape'){if(char==='[')state='csi';else if(char===']')state='osc';else if(char==='P'||char==='X'||char==='^'||char==='_')state='string';else if(code<32||code>47)state='text';continue}",
 	"if(state==='csi'){if(code>=64&&code<=126)state='text';continue}",
 	"if(state==='osc'){if(code===7)state='text';else if(code===27)state='osc-escape';continue}",
-	"if(state==='osc-escape'){state=char==='\\\\'?'text':code===27?'osc-escape':'osc';continue}",
+	"const BACKSLASH=String.fromCharCode(92);",
+	"if(state==='osc-escape'){state=char===BACKSLASH?'text':code===27?'osc-escape':'osc';continue}",
 	"if(state==='string'){if(code===27)state='string-escape';continue}",
-	"if(state==='string-escape')state=char==='\\\\'?'text':code===27?'string-escape':'string';",
+	"if(state==='string-escape')state=char===BACKSLASH?'text':code===27?'string-escape':'string';",
 	"}return output}",
 	"function write(buffer){const output=sanitize(decoder.write(buffer));if(output)process.stdout.write(output)}",
 	"function pump(){",
@@ -507,4 +508,4 @@ export function createOrcaProgressTab(input: {
 			});
 		},
 	};
-}
+}