pi-daddy 0.43.0 → 0.44.0

package/extensions/session-model-prompt.ts

@@ -1,4 +1,4 @@
-import { readFile } from "node:fs/promises";
+import { BoundedReadCleanupError, readBoundedFile } from "../src/kernel/bounded-read.ts";
 import { appendLedgerEvent, buildSessionConfigEvent } from "../src/governance/ledger.ts";
 import { readRecords } from "../src/governance/record.ts";
 import {
@@ -16,9 +16,6 @@ export interface SessionModelPromptState {
   definitions: Map<string, { name: string }>;
   definitionRuntimeSettings: DefinitionRuntimeSettings;
   definitionRuntimeOverrides: Map<string, DefinitionRuntimeChoice>;
-  sessionModelPrompt: "ask" | "never";
-  sessionModelPrompted: boolean;
-  sessionModelPromptInFlight?: Promise<void>;
 }
 export interface SessionModelPromptUI {
   hasUI: boolean;
@@ -26,19 +23,27 @@ export interface SessionModelPromptUI {
   notify(message: string, type?: "info" | "warning" | "error"): void;
 }
 
-async function historicalDefinitions(path: string | undefined): Promise<string[]> {
+/** Trusted composition only; no requester or environment can supply these lifecycle/I/O ports. */
+export interface ManualModelControl {
+  read?: typeof readBoundedFile;
+  assertHealthy?: () => void;
+  onReadCleanup?: (error: BoundedReadCleanupError) => void;
+}
+async function historicalDefinitions(path: string | undefined, read = readBoundedFile): Promise<string[]> {
   if (!path) return [];
-  try {
-    const parsed = readRecords(await readFile(path, "utf8"));
-    return parsed.records
-      .map((record) => record.body as { event?: unknown; agentType?: unknown })
-      .filter((body) => body.event === "capability_decision" && typeof body.agentType === "string")
-      .map((body) => body.agentType as string)
-      .filter((name) => name !== "delegate");
-  } catch (error) {
-    if ((error as NodeJS.ErrnoException).code === "ENOENT") return [];
-    throw error;
+  const result = await read(path, { maxBytes: 64 * 1024 * 1024, timeoutMs: 3000 });
+  if (!result.ok) {
+    if ("code" in result && result.code === "ENOENT") return [];
+    throw new Error(`manual model history unavailable: ${result.detail}`);
   }
+  const parsed = readRecords(result.text);
+  if (parsed.damage)
+    throw new Error(`manual model history damaged at line ${parsed.damage.line}: ${parsed.damage.reason}`);
+  return parsed.records
+    .map((record) => record.body as { event?: unknown; agentType?: unknown })
+    .filter((body) => body.event === "capability_decision" && typeof body.agentType === "string")
+    .map((body) => body.agentType as string)
+    .filter((name) => name !== "delegate");
 }
 
 export function sessionModelRows(state: SessionModelPromptState, names: readonly string[]) {
@@ -115,9 +120,11 @@ async function choose(
   current: readonly string[],
   ui: SessionModelPromptUI,
   trigger: "first-delegation" | "grants-models",
+  control: ManualModelControl,
 ): Promise<void> {
-  const names = [...new Set([...(await historicalDefinitions(state.ledgerPath)), ...current])].sort();
-  if (state.sessionModelPrompt === "never" || !ui.hasUI) {
+  const names = [...new Set([...(await historicalDefinitions(state.ledgerPath, control.read)), ...current])].sort();
+  control.assertHealthy?.();
+  if (!ui.hasUI) {
     await record(state, "kept", trigger);
     return;
   }
@@ -126,6 +133,7 @@ async function choose(
       `Child model defaults\n\n${table(state, names)}\n\nPress Enter to keep, or enter edits one per line.`,
       "<definition> <provider:model> <thinking> | all <provider:model> <thinking>",
     );
+    control.assertHealthy?.();
     if (answer === undefined) throw new Error("session model selection was dismissed; no child was spawned");
     if (!answer.trim()) {
       await record(state, "kept", trigger);
@@ -152,28 +160,21 @@ export async function saveSessionModelEdits(
   return null;
 }
 
-export async function ensureSessionModelPrompt(
+export async function changeSessionModels(
   state: SessionModelPromptState,
-  current: readonly string[],
   ui: SessionModelPromptUI,
+  control: ManualModelControl = {},
 ): Promise<void> {
-  if (state.sessionModelPrompted) return;
-  if (!state.sessionModelPromptInFlight) {
-    state.sessionModelPromptInFlight = choose(state, current, ui, "first-delegation").then(() => {
-      state.sessionModelPrompted = true;
-    });
-  }
   try {
-    await state.sessionModelPromptInFlight;
-  } finally {
-    state.sessionModelPromptInFlight = undefined;
+    control.assertHealthy?.();
+    await choose(state, [...state.definitions.keys()], ui, "grants-models", control);
+    control.assertHealthy?.();
+  } catch (error) {
+    if (error instanceof BoundedReadCleanupError) control.onReadCleanup?.(error);
+    throw error;
   }
 }
 
-export async function changeSessionModels(state: SessionModelPromptState, ui: SessionModelPromptUI): Promise<void> {
-  await choose(state, [...state.definitions.keys()], ui, "grants-models");
-}
-
 export function renderSessionModels(state: SessionModelPromptState): string {
   return table(state, [...state.definitions.keys()].sort());
 }

package/extensions/session-report.ts

@@ -47,6 +47,7 @@ export interface SessionReportContext {
 }
 
 export async function reportSessionStart(session: GrantsSession, ctx: SessionReportContext): Promise<void> {
+  if (session.capacityRefusal) ctx.ui.notify(`grants: ${session.capacityRefusal.message}`, "warning");
   // A malformed bound is now loud as well as safe. Silently disabling spawning would be just as
   // confusing as silently disabling the limit was dangerous — the operator set the variable, so
   // they need to know it did not take effect (G7 / A-S4).
@@ -277,17 +278,7 @@ export async function reportSessionStart(session: GrantsSession, ctx: SessionRep
     // exactly — one added `await` inside the blanket catch cancelling every control below it in
     // silence.
     try {
-      const line = renderSpawnableSummary(
-        await summariseSpawnable(
-          session.definitions,
-          (name) => planWithApprovals(session, { task: "(preview)", agent: name }, {}, null),
-          // The session facts that make every per-definition verdict identical. `mayDelegate` in
-          // particular: without `tool:delegate` there is no delegate tool at all, and the line used to
-          // report definitions as spawnable in the one session where nothing can ever be spawned.
-          { mayDelegate: session.mayDelegate, depth: session.depth, maxDepth: session.maxDepth },
-        ),
-        session.definitions.size,
-      );
+      const line = await selectedDefinitionsSummary(session);
       if (line) info.push(line);
     } catch (error) {
       ctx.ui.notify(
@@ -303,3 +294,29 @@ export async function reportSessionStart(session: GrantsSession, ctx: SessionRep
   // multi-line status screen has always survived while these separate lines did not.
   if (info.length > 0) ctx.ui.notify(info.join("\n"), "info");
 }
+
+/** Public selected resources become available after session start; report their frozen snapshot then. */
+export async function reportSelectedDefinitions(session: GrantsSession, ctx: SessionReportContext): Promise<void> {
+  for (const reason of session.definitionSkips)
+    ctx.ui.notify(`grants: a definition was not loaded — ${reason}`, "warning");
+  if (!session.governed) return;
+  try {
+    const line = await selectedDefinitionsSummary(session);
+    if (line) ctx.ui.notify(line, "info");
+  } catch (error) {
+    ctx.ui.notify(
+      `grants: selected definitions could not be summarized (${String(error)}) — run /grants for detail.`,
+      "warning",
+    );
+  }
+}
+function selectedDefinitionsSummary(session: GrantsSession): Promise<string | null> {
+  return summariseSpawnable(
+    session.definitions,
+    (name) => planWithApprovals(session, { task: "(preview)", agent: name }, {}, null),
+    // The session facts that make every per-definition verdict identical. `mayDelegate` in
+    // particular: without `tool:delegate` there is no delegate tool at all, and the line used to
+    // report definitions as spawnable in the one session where nothing can ever be spawned.
+    { mayDelegate: session.mayDelegate, depth: session.depth, maxDepth: session.maxDepth },
+  ).then((summary) => renderSpawnableSummary(summary, session.definitions.size));
+}