bermudis-pi-goodies 0.27.7 → 0.27.8

package/README.md

@@ -8,7 +8,7 @@ extensions. One entry point, thirteen independent features.
 | `copy-with-model`   | `/copy-with-model`            | Copy last assistant message to the clipboard in a code fence tagged with the model name.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
 | `copy-trajectory`   | `/copy-trajectory [thinking]` | Copy the whole conversation (user + assistant text, tool calls stripped) to the clipboard; `thinking` also includes assistant thinking blocks.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
 | `name-with-ai`      | `/name-with-ai [name]`        | Generate a short session name from the first user message (or set one manually).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
-| `prefer-tools`      | hook (no command)             | Blocks legacy tools: `rm` → `trash <path>` (and `trash-rm`/`trash-empty`, which delete permanently), bare `python`/`pip`/`pytest`/`mypy` → `uv`. On `glm-5.*` models it also blocks bash `rg` (they invent ripgrep flags) — the built-in grep tool still works.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
+| `prefer-tools`      | hook (no command)             | Blocks legacy tools: `rm` → `trash <path>` (and `trash-rm`/`trash-empty`, which delete permanently), bare `python`/`pip`/`pytest`/`mypy` → `uv`. Bash `rg` is allowed, except the replace flag: `-r` (including clusters like `-rn`) is blocked because it is `--replace` and silently replaces matched text — use `--replace` explicitly if you mean it. The built-in grep tool still works.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
 | `keep-model-on-new` | hook (no command)             | Keep the active model when `/new` starts a fresh session instead of reverting to pi's saved default model.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
 | `model-thinking`    | `/model-thinking`             | Per-model default thinking levels: save the current level as this model's default and get it back on every switch to that model, instead of pi's global default.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
 | `clean-tui`         | tool overrides (no command)   | Collapse built-in tool output for a cleaner TUI: back-to-back same-tool calls share one block (e.g. `read ×2`) until a boundary — visible text (assistant prose or a typed user message) or a thinking block (even an empty one, as OpenAI emits between tool calls) — so reasoning-per-call models render one block per call. Images stay visible without expanding, expand a row with ctrl+o to see the full command and results/diffs. Long bash commands get an AI-generated summary once you pick a model with `/goodies summary-model <provider/model>` (see "Smart summaries" below) — expanding a row swaps the summary back out for the raw command. While enabled, also flips `@bermudi/pi-codex`'s `apply_patch`/`web_search` into the same burst style. Long thinking runs can show a live plain-English line above the editor (`/goodies thinking-summaries on`) instead of a static `Thinking...` — see "Smart summaries". |
@@ -25,7 +25,7 @@ extensions. One entry point, thirteen independent features.
 First install, pinned to a published version:
 
 ```bash
-pi install npm:bermudis-pi-goodies@0.27.7
+pi install npm:bermudis-pi-goodies@0.27.8
 ```
 
 Picking up a new release on an existing install (`pi install` is not the

package/index.ts

@@ -6,7 +6,7 @@
  *   - copy-with-model  /copy-with-model  copy last reply tagged with the model
  *   - copy-trajectory  /copy-trajectory  copy the whole conversation (text only) to the clipboard
  *   - name-with-ai     /name-with-ai     generate a session name via the model
- *   - prefer-tools     hook              block legacy tools (trash/uv; blocks rg on glm-5.*)
+ *   - prefer-tools     hook              block legacy tools (trash/uv; blocks rg's -r replace flag)
  *   - keep-model       hook              preserve the active model across /new
  *   - model-thinking   /model-thinking   per-model default thinking levels, applied on switch
  *   - clean-tui        tool overrides    collapse built-in tool output; keep a one-line call header, hide results/diffs until expanded

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bermudis-pi-goodies",
-  "version": "0.27.7",
+  "version": "0.27.8",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/bermudi/agent-extensions.git",

package/prefer-tools.ts

@@ -16,9 +16,11 @@
  *   python/pip/pytest/  -> uv
  *     mypy
  *
- * Model-conditional: on glm-5.* models, `rg` is also blocked — they invent
- * ripgrep flags. The built-in grep tool (structured args, no raw flags) and
- * bash `grep -rn` still work.
+ * `rg` is allowed, but its replace flag is not: `-r` is ripgrep's
+ * `--replace`, so `rg -rn` silently replaces matches with "n" instead of
+ * showing line numbers. Any short-option cluster containing `r` is blocked;
+ * spell out `--replace` if you actually mean it. The built-in grep tool
+ * (structured args, no raw flags) and bash `grep -rn` still work.
  */
 import {
   isToolCallEventType,
@@ -49,24 +51,13 @@ const RULES: Rule[] = [
 ];
 
 /**
- * glm-5.* model ids hallucinate ripgrep flags; bash `rg` is blocked for them.
- * Matches "glm-5" as a family token: not preceded by an alphanumeric (so
- * Meta's xglm-564M doesn't match) and not followed by a digit (so glm-50,
- * glm-500 don't match). glm-5, glm-5.5, glm-5-turbo, glm-5:free,
- * provider-prefixed "kilo/glm-5" all match. glm-4.x is unaffected.
+ * `rg -r` is ripgrep's `--replace`, not "recursive": it replaces matched text
+ * in the output, so `rg -rn` replaces with "n" and shows no line numbers
+ * (machine lore: it once spawned a phantom `[ln]` log tag). Block the short
+ * flag in any cluster, but allow the explicit long form as the escape hatch.
  */
-export function isRipgrepBlockedModel(modelId: string | undefined): boolean {
-  return (
-    typeof modelId === "string" && /(^|[^a-z0-9])glm-5(?![0-9])/i.test(modelId)
-  );
-}
-
-/** Extra rule appended when the active model is glm-5.*. */
-export const RG_RULE: Rule = {
-  names: ["rg"],
-  reason:
-    'rg is blocked for this model — it invents ripgrep flags. Use `grep -rn "pattern" path` instead (or pi\'s built-in grep tool).',
-};
+export const RG_REPLACE_REASON =
+  '`rg -r` is `--replace` — it silently replaces matched text in the output (`rg -rn` replaces with "n" instead of showing line numbers). If you really mean it, use `--replace` explicitly.';
 
 const COMMAND_PREFIX_KEYWORDS = new Set([
   "if",
@@ -97,19 +88,34 @@ function isAssignmentWord(word: string): boolean {
   return /^[A-Za-z_][A-Za-z0-9_]*\+?=/.test(word);
 }
 
-function matchCommand(
-  name: string,
-  rules: readonly Rule[],
-): string | undefined {
-  const base = name.includes("/")
-    ? name.slice(name.lastIndexOf("/") + 1)
-    : name;
-  for (const rule of rules) {
+function commandBase(name: string): string {
+  return name.includes("/") ? name.slice(name.lastIndexOf("/") + 1) : name;
+}
+
+function matchCommand(name: string): string | undefined {
+  const base = commandBase(name);
+  for (const rule of RULES) {
     if (rule.names.includes(base)) return rule.reason;
   }
   return undefined;
 }
 
+/**
+ * Match a command word, plus the one argument-sensitive rule: an `rg`
+ * invocation that uses the replace flag. `argStart` is the offset just past
+ * the command word, where its arguments begin.
+ */
+function matchCommandAt(
+  command: string,
+  word: string,
+  argStart: number,
+): string | undefined {
+  if (commandBase(word) === "rg" && rgUsesReplaceFlag(command, argStart)) {
+    return RG_REPLACE_REASON;
+  }
+  return matchCommand(word);
+}
+
 function readWord(s: string, i: number): { word: string; next: number } {
   // Build the word char by char so backslash escapes strip the backslash:
   // `\rm` → `rm`, `foo\ bar` → `foo bar`. The old slice-based version kept
@@ -253,7 +259,6 @@ function scanExecutedSubs(
   s: string,
   start: number,
   end: number,
-  rules: readonly Rule[],
   mode: "plain" | "double",
 ): string | undefined {
   let i = start;
@@ -273,7 +278,7 @@ function scanExecutedSubs(
       if (c === '"') {
         const stop = readQuote(s, i, '"', true);
         const innerEnd = s[stop - 1] === '"' ? stop - 1 : stop;
-        const reason = scanExecutedSubs(s, i + 1, innerEnd, rules, "double");
+        const reason = scanExecutedSubs(s, i + 1, innerEnd, "double");
         if (reason) return reason;
         i = stop;
         continue;
@@ -293,7 +298,7 @@ function scanExecutedSubs(
     if (c === "`") {
       const stop = readQuote(s, i, "`", true);
       const innerEnd = s[stop - 1] === "`" ? stop - 1 : stop;
-      const reason = detectLegacyTool(s.slice(i + 1, innerEnd), rules);
+      const reason = detectLegacyTool(s.slice(i + 1, innerEnd));
       if (reason) return reason;
       i = stop;
       continue;
@@ -306,7 +311,7 @@ function scanExecutedSubs(
       const stop = skipBalancedParens(s, i, 3);
       const innerEnd =
         s[stop - 1] === ")" && s[stop - 2] === ")" ? stop - 2 : stop;
-      const reason = scanExecutedSubs(s, i + 3, innerEnd, rules, mode);
+      const reason = scanExecutedSubs(s, i + 3, innerEnd, mode);
       if (reason) return reason;
       i = stop;
       continue;
@@ -314,7 +319,7 @@ function scanExecutedSubs(
     if (c === "$" && s.startsWith("$(", i)) {
       const stop = skipBalancedParens(s, i, 2);
       const innerEnd = s[stop - 1] === ")" ? stop - 1 : stop;
-      const reason = detectLegacyTool(s.slice(i + 2, innerEnd), rules);
+      const reason = detectLegacyTool(s.slice(i + 2, innerEnd));
       if (reason) return reason;
       i = stop;
       continue;
@@ -327,7 +332,7 @@ function scanExecutedSubs(
       // substitution runs (`"${X:-'$(rm)'}"` executes).
       const stop = skipBalancedBraces(s, i);
       const innerEnd = s[stop - 1] === "}" ? stop - 1 : stop;
-      const reason = scanExecutedSubs(s, i + 2, innerEnd, rules, mode);
+      const reason = scanExecutedSubs(s, i + 2, innerEnd, mode);
       if (reason) return reason;
       i = stop;
       continue;
@@ -340,7 +345,6 @@ function scanExecutedSubs(
 function readDollar(
   s: string,
   i: number,
-  rules: readonly Rule[],
 ): { next: number; reason?: string } | null {
   if (i >= s.length || s[i] !== "$") return null;
 
@@ -354,14 +358,14 @@ function readDollar(
     const innerEnd = s[end - 1] === ")" && s[end - 2] === ")" ? end - 2 : end;
     return {
       next: end,
-      reason: scanExecutedSubs(s, i + 3, innerEnd, rules, "plain"),
+      reason: scanExecutedSubs(s, i + 3, innerEnd, "plain"),
     };
   }
   if (s.startsWith("(", i + 1)) {
     const end = skipBalancedParens(s, i, 2);
     const closeParen = end > 0 && s[end - 1] === ")" ? 1 : 0;
     const inner = s.slice(i + 2, end - closeParen);
-    const reason = detectLegacyTool(inner, rules);
+    const reason = detectLegacyTool(inner);
     return { next: end, reason };
   }
   if (s.startsWith("{", i + 1)) {
@@ -370,7 +374,7 @@ function readDollar(
     const innerEnd = s[end - 1] === "}" ? end - 1 : end;
     return {
       next: end,
-      reason: scanExecutedSubs(s, i + 2, innerEnd, rules, "plain"),
+      reason: scanExecutedSubs(s, i + 2, innerEnd, "plain"),
     };
   }
   if (i + 1 < s.length && /[0-9?@*#\-!$]/.test(s[i + 1])) {
@@ -447,10 +451,7 @@ function readHeredocDelimiter(
  * backslash suppresses expansion (`\$(rm)` is literal). Returns the matched
  * rule's reason if a blocked tool is found, undefined otherwise.
  */
-function scanHeredocLineForCommandSubs(
-  line: string,
-  rules: readonly Rule[],
-): string | undefined {
+function scanHeredocLineForCommandSubs(line: string): string | undefined {
   let i = 0;
   while (i < line.length) {
     const c = line[i];
@@ -461,7 +462,7 @@ function scanHeredocLineForCommandSubs(
     if (line.startsWith("$(", i)) {
       const end = skipBalancedParens(line, i, 2);
       const inner = line.slice(i + 2, end - 1);
-      const reason = detectLegacyTool(inner, rules);
+      const reason = detectLegacyTool(inner);
       if (reason) return reason;
       i = end;
       continue;
@@ -469,7 +470,7 @@ function scanHeredocLineForCommandSubs(
     if (c === "`") {
       const end = readQuote(line, i, "`", true);
       const inner = line.slice(i + 1, end - 1);
-      const reason = detectLegacyTool(inner, rules);
+      const reason = detectLegacyTool(inner);
       if (reason) return reason;
       i = end;
       continue;
@@ -485,7 +486,6 @@ function skipHeredocBody(
   delimiter: string,
   indented: boolean,
   quoted: boolean,
-  rules: readonly Rule[],
 ): { next: number; reason?: string } {
   let pos = i;
   while (pos <= s.length) {
@@ -499,7 +499,7 @@ function skipHeredocBody(
     // In unquoted heredocs, command substitutions execute — scan for
     // blocked tools inside $(...) and backticks.
     if (!quoted) {
-      const reason = scanHeredocLineForCommandSubs(line, rules);
+      const reason = scanHeredocLineForCommandSubs(line);
       if (reason) return { next: end, reason };
     }
     if (nl === -1) break;
@@ -530,11 +530,157 @@ const SUDO_OPTS_WITH_ARG = new Set([
   "--user",
 ]);
 
-export function detectLegacyTool(
-  command: string,
-  extraRules: readonly Rule[] = [],
-): string | undefined {
-  const rules = extraRules.length > 0 ? [...RULES, ...extraRules] : RULES;
+/**
+ * Short rg options that consume a value: the rest of the cluster is their
+ * value, or — at cluster end — the next word is. `r` is handled separately
+ * (and blocked) before this set is consulted.
+ */
+const RG_SHORT_VALUE_OPTS = new Set([
+  "A",
+  "B",
+  "C",
+  "d",
+  "E",
+  "e",
+  "f",
+  "g",
+  "j",
+  "M",
+  "m",
+  "t",
+  "T",
+]);
+
+/**
+ * Long rg options that consume the next word as a value. Values are skipped
+ * before flag inspection, so `--field-match-separator -r` (ripgrep accepts
+ * `-r` there as literal output text) is not mistaken for the replace flag.
+ */
+const RG_LONG_VALUE_OPTS = new Set([
+  "--after-context",
+  "--before-context",
+  "--context",
+  "--encoding",
+  "--field-context-separator",
+  "--field-match-separator",
+  "--file",
+  "--glob",
+  "--iglob",
+  "--max-columns",
+  "--max-count",
+  "--max-depth",
+  "--max-filesize",
+  "--path-separator",
+  "--pre",
+  "--regexp",
+  "--replace",
+  "--sort",
+  "--sortr",
+  "--threads",
+  "--type",
+  "--type-add",
+  "--type-clear",
+  "--type-not",
+]);
+
+/**
+ * Read one shell word after an `rg` command, keeping quoted content as part
+ * of the token so `rg "-r"` and `rg '-rn'` are caught like their unquoted
+ * twins. Stops at whitespace or an unquoted operator.
+ */
+function readArgWord(s: string, i: number): { word: string; next: number } {
+  let word = "";
+  while (i < s.length) {
+    const c = s[i];
+    if (c === " " || c === "\t" || c === "\r" || c === "\n") break;
+    if (readOperator(s, i)) break;
+    if (c === "'" || c === '"') {
+      const end = readQuote(s, i, c, c === '"');
+      const innerEnd = s[end - 1] === c ? end - 1 : end;
+      word += s.slice(i + 1, innerEnd);
+      i = end;
+      continue;
+    }
+    if (c === "\\" && i + 1 < s.length) {
+      word += s[i + 1];
+      i += 2;
+      continue;
+    }
+    if (c === "$") {
+      const d = readDollar(s, i);
+      if (d) {
+        word += s.slice(i, d.next);
+        i = d.next;
+        continue;
+      }
+    }
+    word += c;
+    i++;
+  }
+  return { word, next: i };
+}
+
+/**
+ * True when the `rg` invocation starting at `start` uses the replace flag in
+ * short form, including clusters (`-rn`, `-rln`, `-nr`). The explicit
+ * `--replace` long form stays allowed. Value-taking options are skipped so a
+ * pattern/replacement that merely looks like `-r` is not a false hit.
+ */
+function rgUsesReplaceFlag(s: string, start: number): boolean {
+  let i = start;
+  let skipValue = false;
+  while (i < s.length) {
+    const c = s[i];
+    if (c === " " || c === "\t" || c === "\r") {
+      i++;
+      continue;
+    }
+    if (c === "\n") break;
+    // Unquoted `#` at the start of a word begins a shell comment: bash never
+    // passes it (or anything after it) to rg, so `rg -n foo . # avoid -rn`
+    // must not be blocked for what its comment merely mentions. Mid-word `#`
+    // (`rg foo#bar`) stays inside the word read below, matching bash.
+    if (c === "#") break;
+    const op = readOperator(s, i);
+    if (op) {
+      if (op.type !== "redirect") break;
+      // Redirections may appear among a command's arguments; consume the
+      // target (`>out`) and keep looking at the real rg options after it.
+      i = op.next;
+      while (i < s.length && (s[i] === " " || s[i] === "\t")) i++;
+      if (i < s.length) i = readArgWord(s, i).next;
+      continue;
+    }
+    const { word, next } = readArgWord(s, i);
+    if (next === i) {
+      i++;
+      continue;
+    }
+    i = next;
+    if (skipValue) {
+      skipValue = false;
+      continue;
+    }
+    if (word === "--") break;
+    if (word.startsWith("--")) {
+      if (!word.includes("=") && RG_LONG_VALUE_OPTS.has(word)) skipValue = true;
+      continue;
+    }
+    if (!word.startsWith("-") || word === "-") continue;
+    for (let k = 1; k < word.length; k++) {
+      const flag = word[k];
+      if (flag === "r") return true;
+      if (RG_SHORT_VALUE_OPTS.has(flag)) {
+        // The rest of the cluster (or the next word) is this option's value.
+        if (k === word.length - 1) skipValue = true;
+        break;
+      }
+    }
+  }
+  return false;
+}
+
+export function detectLegacyTool(command: string): string | undefined {
   let i = 0;
   let commandPos = true;
   // Set once an env-var assignment word is seen in the current simple
@@ -560,7 +706,6 @@ export function detectLegacyTool(
         heredoc.delimiter,
         heredoc.indented,
         heredoc.quoted,
-        rules,
       );
       if (result.reason) return result.reason;
       i = result.next;
@@ -671,17 +816,11 @@ export function detectLegacyTool(
       // their unquoted twin.
       if (quote === '"') {
         const innerEnd = command[end - 1] === '"' ? end - 1 : end;
-        const reason = scanExecutedSubs(
-          command,
-          i + 1,
-          innerEnd,
-          rules,
-          "double",
-        );
+        const reason = scanExecutedSubs(command, i + 1, innerEnd, "double");
         if (reason) return reason;
       } else if (quote === "`") {
         const innerEnd = command[end - 1] === "`" ? end - 1 : end;
-        const reason = detectLegacyTool(command.slice(i + 1, innerEnd), rules);
+        const reason = detectLegacyTool(command.slice(i + 1, innerEnd));
         if (reason) return reason;
       }
       i = end;
@@ -694,7 +833,7 @@ export function detectLegacyTool(
     }
 
     if (c === "$") {
-      const d = readDollar(command, i, rules);
+      const d = readDollar(command, i);
       if (d) {
         if (d.reason) return d.reason;
         i = d.next;
@@ -746,7 +885,7 @@ export function detectLegacyTool(
           skipNextWord = false;
           continue;
         }
-        const reason = matchCommand(word, rules);
+        const reason = matchCommandAt(command, word, i);
         if (reason) return reason;
         sudoNext = false;
       } else {
@@ -754,7 +893,7 @@ export function detectLegacyTool(
           skipNextWord = false;
           continue;
         }
-        const reason = matchCommand(word, rules);
+        const reason = matchCommandAt(command, word, i);
         if (reason) return reason;
       }
       if (!COMMAND_PREFIX_KEYWORDS.has(word)) {
@@ -769,13 +908,10 @@ export function detectLegacyTool(
 }
 
 export default function preferTools(pi: ExtensionAPI) {
-  pi.on("tool_call", async (event, ctx) => {
+  pi.on("tool_call", async (event) => {
     if (!isToolCallEventType("bash", event)) return;
 
-    // Model-conditional rule: glm-5.* gets bash `rg` blocked (live model,
-    // read per call — model switches mid-session take effect immediately).
-    const extraRules = isRipgrepBlockedModel(ctx.model?.id) ? [RG_RULE] : [];
-    const reason = detectLegacyTool(event.input.command ?? "", extraRules);
+    const reason = detectLegacyTool(event.input.command ?? "");
     if (reason) {
       return { block: true, reason };
     }

package/provider-balance.ts

@@ -1733,10 +1733,19 @@ export default function providerBalance(
         return;
       }
 
-      // Do not render a cached value while credentials are being resolved. The
-      // same provider can represent a different account after login/logout.
-      identityPending = true;
-      requestRender?.();
+      // Hide the balance while credentials are being resolved — but only when
+      // nothing is displayed yet (cold start, provider switch, post-logout).
+      // A same-account refresh keeps its last value on screen: blanking on
+      // every refresh would flicker the footer for the full duration of
+      // keychain reads and OAuth token refreshes (seconds under lock
+      // contention). If resolution reveals a different account, the
+      // displayedCacheKey mismatch below still clears it, so a foreign
+      // reading is never painted. Same principle as the post-fetch re-check
+      // below: never blank a displayed same-account value.
+      if (!balance) {
+        identityPending = true;
+        requestRender?.();
+      }
 
       // Preserve a known same-account value during routine credential refresh,
       // but clear it if identity resolution fails or reveals another account.
@@ -1831,6 +1840,14 @@ export default function providerBalance(
       );
       const observedAtMs = now();
       if (generation !== refreshGeneration) return;
+      if (nextBalance.length === 0) {
+        // An empty reading would render as an empty string — visually
+        // identical to the balance vanishing — and parseCachedBalance already
+        // refuses to serve empty entries from the cache. Treat it as a failed
+        // observation: the catch below keeps the previous display and records
+        // the failure.
+        throw new Error("provider returned no balance segments");
+      }
 
       // Login/logout does not emit model_select. Re-resolve identity before
       // committing so an account switch during the request cannot paint the
@@ -1910,7 +1927,14 @@ export default function providerBalance(
           companionTokenAfter,
         );
       }
-      // Recovery detected: clear the marker so sibling idle polls resume.
+      // Recovery detected: tell the log once, then clear the marker so
+      // sibling idle polls resume.
+      if (readBalanceFailureAt(cacheKey, now(), cacheDir) !== null) {
+        logGoodiesEvent({
+          type: "provider_balance_refresh_recovered",
+          provider: providerId,
+        });
+      }
       clearBalanceFailureMarker(cacheKey, cacheDir);
       const persisted = writeCachedBalance(
         cacheKey,
@@ -1929,12 +1953,28 @@ export default function providerBalance(
         return;
       }
       identityPending = false;
-      clearBalance();
+      // A failed fetch does not make the displayed value wrong — it stays
+      // TTL-gated at render time. Keep a same-account reading on screen
+      // instead of blanking the footer for the whole backoff window; clear
+      // only when the failure landed before any account was identified.
+      if (cacheKey === undefined || cacheKey !== displayedCacheKey) {
+        clearBalance();
+      }
       // Record the failure machine-wide so sibling sessions' idle polls back
       // off instead of stacking their own timeouts onto the same outage.
+      const firstFailureOfStreak =
+        cacheKey === undefined ||
+        readBalanceFailureAt(cacheKey, now(), cacheDir) === null;
       if (cacheKey !== undefined) {
         writeBalanceFailureMarker(cacheKey, now(), cacheDir);
       }
+      if (firstFailureOfStreak) {
+        logGoodiesEvent({
+          type: "provider_balance_refresh_failed",
+          provider: providerId,
+          message: describeError(error),
+        });
+      }
       // This is a best-effort background refresh. Writing to stdout/stderr while
       // Pi owns the terminal corrupts the TUI (the text appears in the editor),
       // so expose failures to other extensions without producing terminal output.