bermudis-pi-goodies 0.3.0 → 0.4.0

package/README.md

@@ -11,7 +11,7 @@ extensions. One entry point, ten independent features.
 | `zed` | `/z` | Open Zed editor on the current working directory. |
 | `prefer-tools` | hook (no command) | Nudge toward modern CLIs: `rg` over `grep`, `fd` over `find`, `uv` over bare `python`/`pip`/`pytest`/`mypy`. |
 | `model-thinking` | hook + `/model-thinking` | Apply provider/model thinking defaults and explicitly save per-model defaults. |
-| `fixed-defaults` | hook + `/fixed-defaults` | Keep the global startup provider, model, and thinking defaults fixed while allowing in-session model changes; `/fixed-defaults set` pins the current model and thinking level. |
+| `fixed-defaults` | hook + `/fixed-defaults` | Keep the global startup provider and model fixed while allowing in-session model changes; `/fixed-defaults set` pins the current model. |
 | `kilo` | provider | Access Kilo Gateway models via `/login kilo` or `KILO_API_KEY`. |
 | `provider-balance` | footer (no command) | Show remaining Kilo or OpenRouter credits, z.ai token-plan quota, or OpenAI Codex quota on the right side of the working-directory footer line. |
 | `tps` | hook (no command) | Notify tokens/sec and in/out/cache token usage at the end of each agent turn. |
@@ -21,7 +21,7 @@ extensions. One entry point, ten independent features.
 After publishing the package to npm:
 
 ```bash
-pi install npm:bermudis-pi-goodies@0.3.0
+pi install npm:bermudis-pi-goodies@0.4.0
 ```
 
 Remove any old `bermudis-pi-goodies.ts` symlink before reloading Pi. Each
@@ -53,35 +53,47 @@ config and overwrites an existing entry. Manual thinking-level changes in Pi do
 not modify this file. All current Pi levels are accepted:
 `off`, `minimal`, `low`, `medium`, `high`, `xhigh`, and `max`.
 `/model-thinking` shows the active resolution and config path;
-`/model-thinking reset` deletes the whole config.
+`/model-thinking reset` deletes the whole config. A malformed config is reported
+and ignored; `/model-thinking set` refuses to overwrite it until you repair the
+file or reset it.
 
-## Fixed startup defaults
+## Fixed startup model
 
 Pi normally saves the last model and thinking level selected in the global
-settings file. The bundle pins those cross-session defaults to:
+settings file. `fixed-defaults` pins only the cross-session provider and model;
+`model-thinking` is the sole owner of model-specific thinking levels.
+
+Create `~/.pi/agent/fixed-defaults.json` to pin a startup model:
 
 ```json
 {
-  "defaultProvider": "openai-codex",
-  "defaultModel": "gpt-5.6-luna",
-  "defaultThinkingLevel": "max"
+  "provider": "openai-codex",
+  "model": "gpt-5.6-luna"
 }
 ```
 
 Selecting a different model still changes the active session and its transcript;
-`fixed-defaults` only restores the startup values after Pi persists a selection.
-
-The pinned values are the built-ins above, optionally overridden per field by
-`~/.pi/agent/fixed-defaults.json` — omit a field to keep the built-in value for
-it, and hand edits are picked up without a reload. Manage it from Pi:
-
-- `/fixed-defaults set` — pin the currently active model and thinking level as
-  the new startup defaults (written to the override file and applied to
-  `settings.json` immediately).
-- `/fixed-defaults` — show the effective pin, the active model, and the
-  override file path.
-- `/fixed-defaults reset` — delete the override file and fall back to the
-  built-in values.
+`fixed-defaults` restores the startup model after Pi persists a selection. Pi
+chooses the initial model before extensions receive `session_start`, so if you
+manually create or edit a pin for B while settings still name A, the current
+session remains on A and B starts with the next fresh session. Resuming an
+existing session restores that session's model instead.
+
+Older config files may contain `thinkingLevel`; that field is accepted for
+compatibility but ignored and should be managed in `model-thinking.json` instead.
+`fixed-defaults` logs a warning and shows the migration in its status when it
+finds the legacy field. The `/fixed-defaults set` command rewrites the file in
+the provider/model-only format.
+
+Manage the pin from Pi:
+
+- `/fixed-defaults set` — pin the currently active model as the startup model
+  (written to the override file and applied to `settings.json` immediately).
+- `/fixed-defaults` — show the active model, pinned startup model, and override
+  path.
+- `/fixed-defaults reset` — save the currently active model as Pi's last
+  selection, then delete the override file and stop pinning. With no active
+  model, it refuses to remove the pin.
 
 ## Provider and balance details
 

package/fixed-defaults.ts

@@ -4,38 +4,27 @@ import {
   type ExtensionAPI,
   type ExtensionContext,
 } from "@earendil-works/pi-coding-agent";
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
 import {
-  mkdirSync,
-  readFileSync,
-  renameSync,
-  unlinkSync,
-  writeFileSync,
-} from "node:fs";
-import { dirname, join } from "node:path";
+  describeError,
+  unlinkIfPresent,
+  writeJsonFileAtomic,
+} from "./json-file.ts";
 
 const CONFIG_FILENAME = "fixed-defaults.json";
-const ALL_LEVELS = [
-  "off",
-  "minimal",
-  "low",
-  "medium",
-  "high",
-  "xhigh",
-  "max",
-] as const;
-
-type ThinkingLevel = ReturnType<ExtensionAPI["getThinkingLevel"]>;
-
 /**
- * Values read from the override file. `thinkingLevel` may layer independently;
- * `provider` and `model` are a coupled pair — a model id is meaningless without
- * its provider, so both must be present if either is. Missing fields fall back
- * to the built-in defaults.
+ * Values read from the override file. `provider` and `model` are a coupled
+ * pair — a model id is meaningless without its provider, so both must be
+ * present if either is.
+ *
+ * `thinkingLevel` was accepted by older versions. It is deliberately ignored
+ * for compatibility; model-thinking.ts is now the sole owner of thinking
+ * policy.
  */
 interface FixedDefaultsOverride {
   provider?: string;
   model?: string;
-  thinkingLevel?: ThinkingLevel;
 }
 
 interface FixedDefaultsOptions {
@@ -45,17 +34,6 @@ interface FixedDefaultsOptions {
   configPath?: string;
 }
 
-function describeError(error: unknown): string {
-  return error instanceof Error ? error.message : String(error);
-}
-
-function isThinkingLevel(value: unknown): value is ThinkingLevel {
-  return (
-    typeof value === "string" &&
-    (ALL_LEVELS as readonly string[]).includes(value)
-  );
-}
-
 function parseOverride(value: unknown): FixedDefaultsOverride {
   if (!value || typeof value !== "object" || Array.isArray(value)) {
     throw new Error("the top level must be an object");
@@ -82,18 +60,11 @@ function parseOverride(value: unknown): FixedDefaultsOverride {
     }
     override.model = input.model;
   }
-  if (input.thinkingLevel !== undefined) {
-    if (!isThinkingLevel(input.thinkingLevel)) {
-      throw new Error(
-        `\`thinkingLevel\` must be one of: ${ALL_LEVELS.join(", ")}`,
-      );
-    }
-    override.thinkingLevel = input.thinkingLevel;
-  }
 
   // provider and model are a coupled pair — a model id is meaningless without
   // its provider. Require both if either is present so a hand-edited partial
-  // file can't pin a broken default. thinkingLevel may still layer alone.
+  // file can't pin a broken default. The legacy thinkingLevel field is
+  // intentionally ignored; model-thinking.ts owns thinking policy.
   if (
     (override.provider !== undefined && override.model === undefined) ||
     (override.model !== undefined && override.provider === undefined)
@@ -106,6 +77,15 @@ function parseOverride(value: unknown): FixedDefaultsOverride {
   return override;
 }
 
+function hasLegacyThinkingLevel(value: unknown): boolean {
+  return (
+    value !== null &&
+    typeof value === "object" &&
+    !Array.isArray(value) &&
+    Object.prototype.hasOwnProperty.call(value, "thinkingLevel")
+  );
+}
+
 /**
  * Read/write the override file. Reads are uncached (the file is tiny and the
  * events are rare), so hand edits are picked up without a reload. Writes are
@@ -113,27 +93,43 @@ function parseOverride(value: unknown): FixedDefaultsOverride {
  */
 class DefaultsStore {
   readonly path: string;
+  private warnedLegacyThinkingLevel = false;
 
   constructor(path: string) {
     this.path = path;
   }
 
-  /** Load the override; returns { override: {}, error: null } when missing. */
+  /** Load the override; an absent file is a valid, inactive configuration. */
   load(): LoadResult {
     let raw: string;
     try {
       raw = readFileSync(this.path, "utf8");
     } catch (error) {
       if ((error as NodeJS.ErrnoException).code === "ENOENT") {
-        return { override: {}, error: null };
+        return {
+          present: false,
+          override: {},
+          error: null,
+          legacyThinkingLevel: false,
+        };
       }
       throw error;
     }
 
     try {
+      const value = JSON.parse(raw) as unknown;
+      const legacyThinkingLevel = hasLegacyThinkingLevel(value);
+      if (legacyThinkingLevel && !this.warnedLegacyThinkingLevel) {
+        console.warn(
+          `[fixed-defaults] legacy thinkingLevel found in ${this.path}; it is ignored. Add the policy to model-thinking.json instead.`,
+        );
+        this.warnedLegacyThinkingLevel = true;
+      }
       return {
-        override: parseOverride(JSON.parse(raw) as unknown),
+        present: true,
+        override: parseOverride(value),
         error: null,
+        legacyThinkingLevel,
       };
     } catch (error) {
       const message = describeError(error);
@@ -141,61 +137,51 @@ class DefaultsStore {
         `[fixed-defaults] invalid config at ${this.path}:`,
         message,
       );
-      return { override: {}, error: message };
+      return {
+        present: true,
+        override: {},
+        error: message,
+        legacyThinkingLevel: false,
+      };
     }
   }
 
   save(override: FixedDefaultsOverride): void {
-    mkdirSync(dirname(this.path), { recursive: true });
-    const temporaryPath = `${this.path}.${process.pid}.${Date.now()}.tmp`;
-
-    try {
-      writeFileSync(temporaryPath, `${JSON.stringify(override, null, 2)}\n`, {
-        encoding: "utf8",
-        mode: 0o600,
-      });
-      renameSync(temporaryPath, this.path);
-    } catch (error) {
-      try {
-        unlinkSync(temporaryPath);
-      } catch {
-        // The temporary file usually does not exist when the initial write failed.
-      }
-      throw error;
-    }
+    writeJsonFileAtomic(this.path, override);
+    this.warnedLegacyThinkingLevel = false;
   }
 
-  reset(): boolean {
-    try {
-      unlinkSync(this.path);
-      return true;
-    } catch (error) {
-      if ((error as NodeJS.ErrnoException).code === "ENOENT") return false;
-      throw error;
-    }
+  reset(): void {
+    // Deletion is intentionally idempotent: if another process removes the
+    // pin after it was loaded, reset has still reached the requested end state.
+    unlinkIfPresent(this.path);
+    this.warnedLegacyThinkingLevel = false;
   }
 }
 
 /** Result of reading the override file: the parsed values plus any error. */
 interface LoadResult {
+  /** Whether the override file existed when it was read. */
+  present: boolean;
   override: FixedDefaultsOverride;
   /** Non-null when the file existed but failed to parse or validate. */
   error: string | null;
+  /** True when an old, ignored thinkingLevel field should be migrated. */
+  legacyThinkingLevel: boolean;
 }
 
 /**
- * Keep Pi's cross-session defaults stable while still allowing model changes in
- * the current session. Pi intentionally saves the last selected model and
- * thinking level, so this runs after those notifications and restores the
- * configured startup defaults in the global settings file.
+ * Keep Pi's cross-session provider/model defaults stable while still allowing
+ * model changes in the current session. Pi intentionally saves the last
+ * selected model, so this runs after model-selection notifications and restores
+ * the configured startup model in the global settings file.
  *
  * The pin lives in `<agentDir>/fixed-defaults.json` and is the sole source of
  * truth — there are no built-in defaults, so with no override file the
  * extension is dormant and Pi's native last-selection behavior is preserved.
- * `thinkingLevel` may layer independently; `provider` and `model` are a
- * coupled pair. `/fixed-defaults set` pins the currently active model and
- * thinking level; `/fixed-defaults reset` stops pinning; `/fixed-defaults`
- * shows the active pin.
+ * `provider` and `model` are a coupled pair. Thinking policy belongs to
+ * model-thinking.ts. `/fixed-defaults set` pins the currently active model;
+ * `/fixed-defaults reset` stops pinning; `/fixed-defaults` shows the active pin.
  */
 export default function fixedDefaults(
   pi: ExtensionAPI,
@@ -207,25 +193,15 @@ export default function fixedDefaults(
   );
   let pending = Promise.resolve();
 
-  async function restore(ctx: ExtensionContext): Promise<void> {
-    const { override, error } = store.load();
-    // A broken or absent override means no pin: leave settings untouched so
-    // Pi's native last-selection behavior is preserved rather than guessed at.
-    if (error) return;
-    const hasModelPin =
-      override.provider !== undefined && override.model !== undefined;
-    const hasThinkingPin = override.thinkingLevel !== undefined;
-    if (!hasModelPin && !hasThinkingPin) return;
-
+  async function persistModel(
+    ctx: ExtensionContext,
+    provider: string,
+    modelId: string,
+  ): Promise<void> {
     const settings = SettingsManager.create(ctx.cwd, agentDir, {
       projectTrusted: ctx.isProjectTrusted(),
     });
-    if (hasModelPin) {
-      settings.setDefaultModelAndProvider(override.provider!, override.model!);
-    }
-    if (hasThinkingPin) {
-      settings.setDefaultThinkingLevel(override.thinkingLevel!);
-    }
+    settings.setDefaultModelAndProvider(provider, modelId);
     await settings.flush();
 
     const errors = settings.drainErrors();
@@ -237,23 +213,47 @@ export default function fixedDefaults(
     }
   }
 
-  function schedule(ctx: ExtensionContext): Promise<void> {
-    const operation = pending.then(() => restore(ctx));
-    // Keep later notifications serviceable after one failed write. The
-    // original operation is still returned so Pi can report that failure.
-    pending = operation.catch((error: unknown) => {
-      console.error("[fixed-defaults] failed to restore defaults:", error);
-    });
-    return operation;
+  async function restore(ctx: ExtensionContext): Promise<void> {
+    const { override, error } = store.load();
+    // A broken or absent override means no pin: leave settings untouched so
+    // Pi's native last-selection behavior is preserved rather than guessed at.
+    if (error) return;
+    const hasModelPin =
+      override.provider !== undefined && override.model !== undefined;
+    if (!hasModelPin) return;
+
+    await persistModel(ctx, override.provider!, override.model!);
+  }
+
+  function enqueue<T>(
+    operation: () => Promise<T>,
+    failureMessage: string,
+  ): Promise<T> {
+    const queued = pending.then(operation);
+    // Log once at the queue boundary, then recover only the internal tail so a
+    // failed write does not prevent later operations. The returned promise
+    // still rejects, allowing commands to notify the user.
+    pending = queued.then(
+      () => undefined,
+      (error: unknown) => {
+        console.error(failureMessage, error);
+      },
+    );
+    return queued;
+  }
+
+  function schedule(
+    ctx: ExtensionContext,
+    failureMessage = "[fixed-defaults] failed to restore defaults:",
+  ): Promise<void> {
+    return enqueue(() => restore(ctx), failureMessage);
   }
 
   pi.on("session_start", (_event, ctx) => schedule(ctx));
   pi.on("model_select", (_event, ctx) => schedule(ctx));
-  pi.on("thinking_level_select", (_event, ctx) => schedule(ctx));
 
   pi.registerCommand("fixed-defaults", {
-    description:
-      "Show, set, or reset the pinned startup model/thinking defaults",
+    description: "Show, set, or reset the pinned startup model",
     handler: async (args, ctx) => {
       const command = args.trim();
 
@@ -267,11 +267,9 @@ export default function fixedDefaults(
           return;
         }
 
-        const level = pi.getThinkingLevel();
         const override: FixedDefaultsOverride = {
           provider: model.provider,
           model: model.id,
-          thinkingLevel: level,
         };
         try {
           store.save(override);
@@ -283,10 +281,9 @@ export default function fixedDefaults(
 
         try {
           // Bring settings.json in line with the new pin right away instead
-          // of waiting for the next model/thinking/session event.
-          await schedule(ctx);
-        } catch (error) {
-          console.error("[fixed-defaults] failed to apply override:", error);
+          // of waiting for the next model/session event.
+          await schedule(ctx, "[fixed-defaults] failed to apply override:");
+        } catch {
           ctx.ui.notify(
             "Defaults saved, but applying them to settings.json failed.",
             "warning",
@@ -295,31 +292,74 @@ export default function fixedDefaults(
         }
 
         ctx.ui.notify(
-          `Pinned ${model.provider}/${model.id} · thinking ${level} as startup defaults`,
+          `Pinned ${model.provider}/${model.id} as the startup model`,
           "info",
         );
         return;
       }
 
       if (command === "reset") {
-        let removed: boolean;
+        type ResetResult =
+          | { status: "missing" }
+          | { status: "removed-inactive" }
+          | { status: "no-active-model" }
+          | {
+              status: "removed";
+              model: NonNullable<ExtensionContext["model"]>;
+            };
+
         try {
-          removed = store.reset();
-        } catch (error) {
-          console.error("[fixed-defaults] failed to reset override:", error);
-          ctx.ui.notify("Failed to reset fixed defaults.", "error");
-          return;
+          const result = await enqueue<ResetResult>(async () => {
+            // Load and validate before touching settings. Invalid, legacy-only,
+            // and partial files are inactive, so remove them without replacing
+            // Pi's last selection with the currently active model.
+            const loaded = store.load();
+            if (!loaded.present) return { status: "missing" };
+
+            const hasModelPin =
+              loaded.error === null &&
+              loaded.override.provider !== undefined &&
+              loaded.override.model !== undefined;
+            if (!hasModelPin) {
+              store.reset();
+              return { status: "removed-inactive" };
+            }
+
+            const model = ctx.model;
+            if (!model) return { status: "no-active-model" };
+
+            // Save the active model before removing the valid pin. Otherwise
+            // the old pinned model remains in settings.json and wins at the
+            // next fresh start.
+            await persistModel(ctx, model.provider, model.id);
+            store.reset();
+            return { status: "removed", model };
+          }, "[fixed-defaults] failed to reset override:");
+
+          if (result.status === "missing") {
+            ctx.ui.notify("No fixed-defaults override file to reset.", "info");
+          } else if (result.status === "removed-inactive") {
+            ctx.ui.notify(
+              "Inactive or invalid fixed-defaults override removed; settings were left unchanged.",
+              "info",
+            );
+          } else if (result.status === "no-active-model") {
+            ctx.ui.notify(
+              "Cannot reset fixed defaults without an active model; the pin was left in place.",
+              "warning",
+            );
+          } else {
+            ctx.ui.notify(
+              `Fixed-defaults pin removed. Pi will use ${result.model.provider}/${result.model.id} as its last selection.`,
+              "info",
+            );
+          }
+        } catch {
+          ctx.ui.notify(
+            "Failed to reset fixed defaults. Pin removal could not be confirmed; settings may already reflect the active model.",
+            "error",
+          );
         }
-
-        // Removing the override makes future events no-ops; there is nothing
-        // to apply to settings.json now. Existing defaults are left as-is so
-        // reset means "stop pinning," not "revert to an earlier state."
-        ctx.ui.notify(
-          removed
-            ? "Fixed-defaults pin removed. Pi will use your last selection."
-            : "No fixed-defaults override file to reset.",
-          "info",
-        );
         return;
       }
 
@@ -328,11 +368,10 @@ export default function fixedDefaults(
         return;
       }
 
-      const { override, error } = store.load();
+      const { override, error, legacyThinkingLevel } = store.load();
       const model = ctx.model;
       const lines = [
         `model: ${model ? `${model.provider}/${model.id}` : "none"}`,
-        `thinking: ${pi.getThinkingLevel()}`,
         "",
       ];
       if (error) {
@@ -344,14 +383,17 @@ export default function fixedDefaults(
           lines.push(`pinned provider: ${override.provider}`);
           lines.push(`pinned model: ${override.model}`);
         }
-        if (override.thinkingLevel !== undefined) {
-          lines.push(`pinned thinking: ${override.thinkingLevel}`);
-        }
+      }
+      if (legacyThinkingLevel) {
+        lines.push(
+          "",
+          "⚠ legacy thinkingLevel is present but ignored; manage it with /model-thinking",
+        );
       }
       lines.push("", `override file: ${store.path}`);
       lines.push(
         "",
-        "run `/fixed-defaults set` to pin the current model and thinking level; `/fixed-defaults reset` to stop pinning",
+        "run `/fixed-defaults set` to pin the current model; `/fixed-defaults reset` to stop pinning",
       );
       const message = lines.join("\n");
 

package/index.ts

@@ -9,7 +9,7 @@
  *   - zed              /z                open Zed on cwd
  *   - prefer-tools     hook              block legacy tools (use trash/rg/fd/uv)
  *   - model-thinking   hook + command    remember thinking levels by provider/model
- *   - fixed-defaults   hook + command    keep startup defaults stable; /fixed-defaults set pins the current model
+ *   - fixed-defaults   hook + command    keep startup provider/model stable; /fixed-defaults set pins the current model
  *   - kilo             provider          access Kilo Gateway models
  *   - provider-balance footer            show Kilo credits or Codex quota in the footer
  *   - tps              hook              notify tokens/sec and usage at each agent turn end

package/json-file.ts

@@ -0,0 +1,44 @@
+import { randomUUID } from "node:crypto";
+import { mkdirSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
+import { dirname } from "node:path";
+
+export function describeError(error: unknown): string {
+  return error instanceof Error ? error.message : String(error);
+}
+
+/** Write JSON atomically without exposing a partially written config file. */
+export function writeJsonFileAtomic(path: string, value: unknown): void {
+  mkdirSync(dirname(path), { recursive: true });
+  const temporaryPath = `${path}.${process.pid}.${randomUUID()}.tmp`;
+
+  try {
+    writeFileSync(temporaryPath, `${JSON.stringify(value, null, 2)}\n`, {
+      encoding: "utf8",
+      mode: 0o600,
+    });
+    renameSync(temporaryPath, path);
+  } catch (writeError) {
+    try {
+      unlinkSync(temporaryPath);
+    } catch (cleanupError) {
+      if ((cleanupError as NodeJS.ErrnoException).code !== "ENOENT") {
+        throw new AggregateError(
+          [writeError, cleanupError],
+          `failed to write ${path} and clean up ${temporaryPath}`,
+        );
+      }
+    }
+    throw writeError;
+  }
+}
+
+/** Delete a file if present; surface every error except an absent file. */
+export function unlinkIfPresent(path: string): boolean {
+  try {
+    unlinkSync(path);
+    return true;
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === "ENOENT") return false;
+    throw error;
+  }
+}

package/model-thinking.ts

@@ -3,15 +3,13 @@ import {
   type ExtensionAPI,
   type ExtensionContext,
 } from "@earendil-works/pi-coding-agent";
+import { readFileSync, statSync } from "node:fs";
+import { join } from "node:path";
 import {
-  mkdirSync,
-  readFileSync,
-  renameSync,
-  statSync,
-  unlinkSync,
-  writeFileSync,
-} from "node:fs";
-import { dirname, join } from "node:path";
+  describeError,
+  unlinkIfPresent,
+  writeJsonFileAtomic,
+} from "./json-file.ts";
 
 const CONFIG_FILENAME = "model-thinking.json";
 const ALL_LEVELS = [
@@ -99,86 +97,81 @@ function fileStamp(path: string): string | undefined {
   }
 }
 
+interface ConfigLoadResult {
+  config: ModelThinkingConfig;
+  /** Non-null when the file exists but could not be read or validated. */
+  error: string | null;
+}
+
 class ConfigStore {
   readonly path: string;
   private initialized = false;
   private cachedStamp: string | undefined;
-  private cachedConfig: ModelThinkingConfig = {};
+  private cachedResult: ConfigLoadResult = { config: {}, error: null };
 
   constructor(path: string) {
     this.path = path;
   }
 
-  load(): ModelThinkingConfig {
+  load(): ConfigLoadResult {
     let stamp: string | undefined;
     try {
       stamp = fileStamp(this.path);
     } catch (error) {
-      console.error(`[model-thinking] failed to stat ${this.path}:`, error);
-      return {};
+      const message = describeError(error);
+      console.error(`[model-thinking] failed to stat ${this.path}:`, message);
+      return { config: {}, error: message };
     }
 
-    if (this.initialized && stamp === this.cachedStamp) {
-      return this.cachedConfig;
+    // Keep retrying a file that previously failed to load. A repair can leave
+    // its size and mtime unchanged, so an error result must not be cached by
+    // the same stamp as a successful read.
+    if (
+      this.initialized &&
+      stamp === this.cachedStamp &&
+      this.cachedResult.error === null
+    ) {
+      return this.cachedResult;
     }
 
     this.initialized = true;
     this.cachedStamp = stamp;
     if (stamp === undefined) {
-      this.cachedConfig = {};
-      return this.cachedConfig;
+      this.cachedResult = { config: {}, error: null };
+      return this.cachedResult;
     }
 
     try {
-      this.cachedConfig = parseConfig(
-        JSON.parse(readFileSync(this.path, "utf8")) as unknown,
-      );
+      this.cachedResult = {
+        config: parseConfig(
+          JSON.parse(readFileSync(this.path, "utf8")) as unknown,
+        ),
+        error: null,
+      };
     } catch (error) {
+      const message = describeError(error);
       console.error(
         `[model-thinking] invalid config at ${this.path}:`,
-        error instanceof Error ? error.message : error,
+        message,
       );
-      this.cachedConfig = {};
+      this.cachedResult = { config: {}, error: message };
     }
-    return this.cachedConfig;
+    return this.cachedResult;
   }
 
   save(config: ModelThinkingConfig): void {
-    mkdirSync(dirname(this.path), { recursive: true });
-    const temporaryPath = `${this.path}.${process.pid}.${Date.now()}.tmp`;
-
-    try {
-      writeFileSync(temporaryPath, `${JSON.stringify(config, null, 2)}\n`, {
-        encoding: "utf8",
-        mode: 0o600,
-      });
-      renameSync(temporaryPath, this.path);
-    } catch (error) {
-      try {
-        unlinkSync(temporaryPath);
-      } catch {
-        // The temporary file usually does not exist when the initial write failed.
-      }
-      throw error;
-    }
-
-    this.cachedConfig = config;
+    writeJsonFileAtomic(this.path, config);
+    this.cachedResult = { config, error: null };
     this.cachedStamp = fileStamp(this.path);
     this.initialized = true;
   }
 
   reset(): boolean {
-    try {
-      unlinkSync(this.path);
-    } catch (error) {
-      if ((error as NodeJS.ErrnoException).code === "ENOENT") return false;
-      throw error;
-    }
-
+    const removed = unlinkIfPresent(this.path);
     this.initialized = true;
     this.cachedStamp = undefined;
-    this.cachedConfig = {};
-    return true;
+    this.cachedResult = { config: {}, error: null };
+    return removed;
   }
 }
 
@@ -207,8 +200,13 @@ export default function modelThinking(
   );
   function apply(ctx: ExtensionContext, silent: boolean): void {
     const model = ctx.model;
-    const level = resolveThinkingLevel(store.load(), model);
-    if (!model || level === undefined) return;
+    const loaded = store.load();
+    // Never treat a broken file as an empty policy: doing so would hide the
+    // error and make a later `/model-thinking set` overwrite it.
+    if (loaded.error || !model) return;
+
+    const level = resolveThinkingLevel(loaded.config, model);
+    if (level === undefined) return;
 
     const before = pi.getThinkingLevel();
     pi.setThinkingLevel(level);
@@ -246,10 +244,18 @@ export default function modelThinking(
         const key = modelKey(model);
         const level = pi.getThinkingLevel();
         try {
-          const config = store.load();
+          const loaded = store.load();
+          if (loaded.error) {
+            ctx.ui.notify(
+              `Cannot save model-thinking config: ${loaded.error}. Repair ${store.path} or run /model-thinking reset first.`,
+              "error",
+            );
+            return;
+          }
+
           store.save({
-            ...config,
-            models: { ...config.models, [key]: level },
+            ...loaded.config,
+            models: { ...loaded.config.models, [key]: level },
           });
           ctx.ui.notify(`Saved ${key}: ${level}`, "info");
         } catch (error) {
@@ -284,14 +290,19 @@ export default function modelThinking(
       }
 
       const model = ctx.model;
-      const config = store.load();
-      const resolved = resolveThinkingLevel(config, model);
+      const loaded = store.load();
+      const resolved = loaded.error
+        ? undefined
+        : resolveThinkingLevel(loaded.config, model);
       const lines = [
         `model: ${model ? modelKey(model) : "none"}`,
         `managed: ${resolved === undefined ? "no" : "yes"}`,
         `file: ${store.path}`,
         `saved: ${resolved ?? "none — pi handles this model natively"}`,
         `current: ${pi.getThinkingLevel()}`,
+        ...(loaded.error
+          ? [`⚠ config invalid — no policy applied: ${loaded.error}`]
+          : []),
         "",
         "run `/model-thinking set` to save this model and level; `/model-thinking reset` to clear all configured levels",
       ];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bermudis-pi-goodies",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "private": false,
   "description": "A bundle of small, frequently-used Pi extensions.",
   "keywords": ["pi-package"],