pi-goal-list-loop-audit 0.24.4 → 0.24.6

package/extensions/goal-loop-core.ts

@@ -1,5 +1,5 @@
 /**
- * pi-goal-list-loop-audit — v0.1.0
+ * pi-goal-list-loop-audit — v0.24.5
  * extensions/goal-loop-core.ts
  *
  * Shared types, state machine, JSONL persistence, helpers.
@@ -703,3 +703,44 @@ export function classifySessionCtx(ownerSession: unknown, ownerLive: boolean, se
   if (!ownerSession || !ownerLive) return "claim";
   return sessionManager === ownerSession ? "refresh" : "foreign";
 }
+
+// =================================================================
+// v0.24.5: tool-visibility self-heal
+// =================================================================
+//
+// Root cause (INCIDENT-COMPLETION-BLACKHOLE-2026-07-23): external
+// extensions like pi-plugin-list-selector-modlist call pi.setActiveTools
+// with a frozen tool snapshot at session_start. When glla's session_start
+// handler runs BEFORE theirs (load order), our lazily-registered agent
+// tools get registered, briefly auto-activated, then wiped from the
+// model-facing active set on the very next pi.setActiveTools call from
+// modlist. Commands, widget, watchdog keep working (they don't go
+// through the tool registry), but every agent tool — complete_goal,
+// propose_loop_draft, etc. — answers "Tool not found" to the model.
+//
+// Self-heal: any handler that triggers registerAgentTools must also
+// ensure the registered tool names are present in pi.getActiveTools(),
+// re-adding any missing ones via pi.setActiveTools. Once per session,
+// notify the user naming the external allowlist as the likely culprit
+// so they can fix their profile once and silence it.
+
+export const GLLA_TOOL_NAMES = [
+  "complete_goal",
+  "pause_goal",
+  "complete_task",
+  "update_task_status",
+  "propose_goal_draft",
+  "propose_loop_draft",
+  "propose_loop_refine",
+  "list_add",
+  "list_activate",
+  "list_status",
+  "propose_task_list",
+] as const;
+
+export type GllaToolName = (typeof GLLA_TOOL_NAMES)[number];
+
+export function missingGllaTools(activeNames: readonly string[]): readonly GllaToolName[] {
+  const active = new Set(activeNames);
+  return GLLA_TOOL_NAMES.filter((n) => !active.has(n));
+}

package/extensions/goal-loop-subagents.ts

@@ -0,0 +1,191 @@
+// pi-goal-list-loop-audit — v0.24.6
+// extensions/goal-loop-subagents.ts
+//
+// Subagent model inheritance fix (v0.24.6, Section I of the eager-continuation
+// contract). pi-subagents v0.14.3's default Explore agent pins
+// "anthropic/claude-haiku-4-5" (default-agents.ts:40). Its model resolution is
+// explicit option > agent config > parent model (agent-runner.ts:720), so an
+// Explore spawn NEVER inherits the session model — it silently routes to a
+// different provider with a different quota pool. On rigs where the session
+// model is local/alternative (e.g. MiniMax-M3) and claude-haiku-4-5 resolves
+// through a quota-capped key (OpenRouter), three concurrent Explore spawns
+// exhaust the key with 403 "Key limit exceeded" while the parent session is
+// unaffected.
+//
+// pi-subagents has no per-agent model setting (subagents.json covers
+// concurrency/scope/etc., not models). Its supported override mechanism is
+// user agent files: <agentDir>/agents/<Name>.md fully replaces the default
+// config of the same name (custom-agents.ts + agent-types.ts overlay by
+// exact key). A file that omits "model:" falls through to the parent model.
+//
+// This module manages exactly one override file — Explore.md — the only
+// default agent with a model pin today. It writes/updates/removes the file
+// according to glla settings, and NEVER touches a file it didn't write
+// (marker frontmatter field). If tintinweb pins more defaults later, the
+// drift test in tests/subagent-model-override.test.ts fails and prompts us
+// to add embedded copies here.
+
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+
+/** Frontmatter marker identifying files this module wrote. Files without it
+ * are user-owned: never modified, never deleted. */
+export const SUBAGENT_MANAGED_MARKER = "pi-goal-list-loop-audit";
+
+/** Default pi-subagents agents that pin a model. Today: only Explore
+ * (anthropic/claude-haiku-4-5). Plan and general-purpose already inherit the
+ * parent model. Guarded by the drift test. */
+export const KNOWN_PINNED_DEFAULT_AGENTS = ["Explore"] as const;
+
+/** Strategy for subagent model selection. Default "inherit-parent": managed
+ * override drops the model pin so subagents share the session model AND its
+ * quota pool. "agent-default": upstream behavior (Explore pins haiku). */
+export type SubagentModelStrategy = "inherit-parent" | "agent-default";
+
+// ---- Embedded default-agent copies (verbatim from pi-subagents v0.14.3
+// src/default-agents.ts; drift-tested against the installed package) ----
+
+export const EXPLORE_DEFAULT_DESCRIPTION = "Fast read-only search agent for locating code. Use it to find files by pattern (eg. \"src/components/**/*.tsx\"), grep for symbols or keywords (eg. \"API endpoints\"), or answer \"where is X defined / which files reference Y.\" Do NOT use it for code review, design-doc auditing, cross-file consistency checks, or open-ended analysis \u2014 it reads excerpts rather than whole files and will miss content past its read window. When calling, specify search breadth: \"quick\" for a single targeted lookup, \"medium\" for moderate exploration, or \"very thorough\" to search across multiple locations and naming conventions.";
+
+export const EXPLORE_DEFAULT_SYSTEM_PROMPT = `# CRITICAL: READ-ONLY MODE - NO FILE MODIFICATIONS
+You are a file search specialist. You excel at thoroughly navigating and exploring codebases.
+Your role is EXCLUSIVELY to search and analyze existing code. You do NOT have access to file editing tools.
+
+You are STRICTLY PROHIBITED from:
+- Creating new files
+- Modifying existing files
+- Deleting files
+- Moving or copying files
+- Creating temporary files anywhere, including /tmp
+- Using redirect operators (>, >>, |) or heredocs to write to files
+- Running ANY commands that change system state
+
+Use Bash ONLY for read-only operations: ls, git status, git log, git diff, find, cat, head, tail.
+
+# Tool Usage
+- Use the find tool for file pattern matching (NOT the bash find command)
+- Use the grep tool for content search (NOT bash grep/rg command)
+- Use the read tool for reading files (NOT bash cat/head/tail)
+- Use Bash ONLY for read-only operations
+- Make independent tool calls in parallel for efficiency
+- Adapt search approach based on thoroughness level specified
+
+# Output
+- Use absolute file paths in all references
+- Report findings as regular messages
+- Do not use emojis
+- Be thorough and precise`;
+
+export const EXPLORE_DEFAULT_TOOLS = "read, bash, grep, find, ls";
+
+interface EmbeddedAgentDefault {
+  description: string;
+  systemPrompt: string;
+  tools: string;
+}
+
+/** Embedded copies keyed by agent name. Only agents in
+ * KNOWN_PINNED_DEFAULT_AGENTS need entries. */
+const EMBEDDED_DEFAULTS: Record<string, EmbeddedAgentDefault> = {
+  Explore: {
+    description: EXPLORE_DEFAULT_DESCRIPTION,
+    systemPrompt: EXPLORE_DEFAULT_SYSTEM_PROMPT,
+    tools: EXPLORE_DEFAULT_TOOLS,
+  },
+};
+
+/** Default global agent dir (pi-subagents reads $PI_CODING_AGENT_DIR/agents,
+ * default ~/.pi/agent/agents). Parameterized in sync for tests. */
+export function defaultAgentDir(): string {
+  return path.join(os.homedir(), ".pi", "agent");
+}
+
+/** Build the override .md file content. With `model`, the pin is written;
+ * without, the file falls through to the parent session model. */
+export function buildAgentOverrideMd(name: string, model?: string): string {
+  const def = EMBEDDED_DEFAULTS[name];
+  if (!def) throw new Error(`no embedded default config for agent "${name}"`);
+  const yamlDesc = "'" + def.description.replace(/'/g, "''") + "'";
+  const lines = [
+    "---",
+    `description: ${yamlDesc}`,
+    `tools: ${def.tools}`,
+    "prompt_mode: replace",
+  ];
+  if (model) lines.push(`model: ${model}`);
+  lines.push(
+    `x-managed-by: ${SUBAGENT_MANAGED_MARKER}`,
+    model
+      ? `x-glla-note: model pinned to ${model} by glla subagentModelOverrides. Remove the file or change /glla subagent settings to inherit the session model.`
+      : "x-glla-note: model pin removed (upstream default pins a fixed model) so this agent inherits the parent session model and its quota pool. Managed by glla — flip /glla subagent strategy to agent-default to restore upstream behavior.",
+    "---",
+    "",
+    def.systemPrompt,
+    "",
+  );
+  return lines.join("\n");
+}
+
+function hasManagedMarker(content: string): boolean {
+  return content.includes(`x-managed-by: ${SUBAGENT_MANAGED_MARKER}`);
+}
+
+export interface SubagentSyncResult {
+  written: string[];
+  removed: string[];
+  /** Files left untouched because the user owns them (no marker). */
+  skipped: Array<{ name: string; reason: string }>;
+}
+
+/** Sync <agentDir>/agents/<Name>.md with the desired state. Idempotent:
+ * writes only when content differs. Never touches non-managed files. */
+export function syncSubagentModelOverrides(opts: {
+  agentDir: string;
+  strategy: SubagentModelStrategy;
+  overrides?: Record<string, string>;
+}): SubagentSyncResult {
+  const result: SubagentSyncResult = { written: [], removed: [], skipped: [] };
+  const overrides = opts.overrides ?? {};
+  const names = new Set<string>([...KNOWN_PINNED_DEFAULT_AGENTS, ...Object.keys(overrides)]);
+
+  for (const name of names) {
+    const overrideModel = overrides[name];
+    if (overrideModel !== undefined && !EMBEDDED_DEFAULTS[name]) {
+      result.skipped.push({
+        name,
+        reason: `no embedded default config for "${name}" — create ${name}.md manually (only ${KNOWN_PINNED_DEFAULT_AGENTS.join("/")} are glla-managed)`,
+      });
+      continue;
+    }
+    const file = path.join(opts.agentDir, "agents", `${name}.md`);
+    const desired = overrideModel
+      ? buildAgentOverrideMd(name, overrideModel)
+      : opts.strategy === "inherit-parent"
+        ? buildAgentOverrideMd(name)
+        : undefined; // agent-default + no per-type override → file should be absent
+
+    const exists = fs.existsSync(file);
+    const current = exists ? fs.readFileSync(file, "utf-8") : undefined;
+
+    if (desired === undefined) {
+      if (exists && hasManagedMarker(current!)) {
+        fs.unlinkSync(file);
+        result.removed.push(name);
+      } else if (exists) {
+        result.skipped.push({ name, reason: "user-owned file (no glla marker) — left untouched" });
+      }
+      continue;
+    }
+
+    if (exists && !hasManagedMarker(current!)) {
+      result.skipped.push({ name, reason: "user-owned file (no glla marker) — left untouched" });
+      continue;
+    }
+    if (current === desired) continue; // idempotent no-op
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    fs.writeFileSync(file, desired);
+    result.written.push(name);
+  }
+  return result;
+}

package/extensions/loops/goal.ts

@@ -63,6 +63,7 @@ import {
   shouldAutoResumeOnSessionStart,
   statusLabel,
   writeGoalMd,
+  missingGllaTools,
 } from "../goal-loop-core.js";
 import { runGoalCompletionAuditor } from "../goal-loop-auditor.js";
 import {
@@ -74,6 +75,11 @@ import {
   pushCapped as pushRepetitionCapped,
 } from "../goal-loop-repetition.js";
 import { buildStatusText, buildWidgetLines, type AuditDisplayProgress } from "../goal-loop-display.js";
+import {
+  defaultAgentDir,
+  syncSubagentModelOverrides,
+  type SubagentModelStrategy,
+} from "../goal-loop-subagents.js";
 import {
   applyMeasurement,
   applyMetriclessTick,
@@ -2263,6 +2269,18 @@ interface Settings {
    * interview floor is skipped — the seed carries the intent (unattended
    * rigs). Default off: nothing activates before the user confirms. */
   autoAcceptDrafts?: boolean;
+  /** v0.24.6: subagent model strategy for pi-subagents default agents that
+   * pin a model (Explore pins claude-haiku-4-5, which silently routes
+   * subagents to a different provider/quota pool than the session).
+   * "inherit-parent" (default) writes a managed ~/.pi/agent/agents/Explore.md
+   * override without the model pin so subagents share the session model and
+   * its quota; "agent-default" restores upstream behavior. Applies to NEW
+   * sessions (pi-subagents registers agents at session start). */
+  subagentModelStrategy?: SubagentModelStrategy;
+  /** v0.24.6: per-agent-type model pin, e.g. { "Explore": "minimax/MiniMax-M3" }.
+   * Always wins over subagentModelStrategy — the managed override is written
+   * WITH this pin regardless of strategy. */
+  subagentModelOverrides?: Record<string, string>;
 }
 
 const DEFAULT_SETTINGS: Settings = {
@@ -2270,6 +2288,9 @@ const DEFAULT_SETTINGS: Settings = {
   // pi, auditor follows), floor "high" — the auditor is the verification
   // gate, depth is worth more there than speed. /glla thinking= overrides.
   auditorThinkingLevel: undefined,
+  // v0.24.6: subagents inherit the session model by default — one quota
+  // pool, no surprise 403s from a pinned default agent's provider.
+  subagentModelStrategy: "inherit-parent",
 };
 
 // Two-tier config (v0.7.0): GLOBAL is the normal home — you set things once
@@ -2407,6 +2428,8 @@ async function openSettingsUI(ctx: ExtensionContext): Promise<void> {
           `Notify command — ${show("notifyCmd", "(off)")}`,
           `Token limit per goal — ${show("tokenLimit", "(off)")}`,
           `Wedge alert minutes — ${show("wedgeAlertMinutes", `(${WEDGE_ALERT_DEFAULT_MINUTES}m default)`)}`,
+          `Subagent model strategy — ${show("subagentModelStrategy", "(inherit-parent)")}`,
+          `Subagent Explore model pin — ${loadSettings(ctx.cwd).subagentModelOverrides?.Explore ?? "(follows strategy)"}`,
           "Done",
         ],
       );
@@ -2440,6 +2463,26 @@ async function openSettingsUI(ctx: ExtensionContext): Promise<void> {
           else if (!v.trim()) saveSettings("global", ctx.cwd, { wedgeAlertMinutes: undefined });
           else ctx.ui.notify(`Not a non-negative integer: ${v}`, "warning");
         }
+      } else if (choice.startsWith("Subagent model strategy")) {
+        const v = await ctx.ui.select("Subagent model (pi-subagents default agents)", [
+          "inherit-parent — subagents share your session model + its quota pool (fixes separate-provider 403s; search agents may run on a pricier model)",
+          "agent-default — upstream behavior: Explore pins claude-haiku-4-5 (cheap search, but a SEPARATE provider quota from your session)",
+        ]);
+        if (v) {
+          const strategy: SubagentModelStrategy = v.startsWith("agent-default") ? "agent-default" : "inherit-parent";
+          saveSettings("global", ctx.cwd, { subagentModelStrategy: strategy });
+          ctx.ui.notify("Subagent model strategy saved — applies to NEW pi sessions (pi-subagents registers agents at session start).", "info");
+        }
+      } else if (choice.startsWith("Subagent Explore model pin")) {
+        const v = await ctx.ui.input("Model pin for Explore subagents", "provider/model-id e.g. minimax/MiniMax-M3 — always wins over strategy; empty = follow strategy");
+        if (v !== undefined) {
+          const current = loadSettings(ctx.cwd).subagentModelOverrides ?? {};
+          const next = { ...current };
+          if (v.trim()) next.Explore = v.trim();
+          else delete next.Explore;
+          saveSettings("global", ctx.cwd, { subagentModelOverrides: Object.keys(next).length > 0 ? next : undefined });
+          ctx.ui.notify("Explore model pin saved — applies to NEW pi sessions.", "info");
+        }
       }
     } catch {
       return;
@@ -2729,6 +2772,29 @@ export default function (pi: ExtensionAPI): void {
   // "no active goal" if called).
   let registeredCtx: ExtensionContext | null = null;
 
+  // v0.24.5 tool-visibility self-heal: surface the notify exactly once
+  // per session so the user learns about an external allowlist once and
+  // can fix their profile to silence it.
+  let toolHealNotified = false;
+  function ensureAgentToolsActive(pi: ExtensionAPI, ctx: ExtensionContext): void {
+    try {
+      const active = pi.getActiveTools();
+      const missing = missingGllaTools(active);
+      if (missing.length === 0) return;
+      pi.setActiveTools([...active, ...missing]);
+      if (!toolHealNotified) {
+        toolHealNotified = true;
+        const list = missing.join(", ");
+        ctx.ui.notify(
+          `glla: ${missing.length} agent tool(s) were hidden by an external tool allowlist (e.g. a modlist profile) and have been re-activated (${list}). Add them to your allowlist profile to silence this.`,
+          "warning",
+        );
+      }
+    } catch {
+      // Older pi without getActiveTools/setActiveTools — nothing we can do.
+    }
+  }
+
   pi.on("message_start", async (event: any, _ctx: ExtensionContext) => {
     // v0.14.0 drafting floor: count real user replies while drafting. Our
     // own injected draft prompt arrives as a user message — skip that one.
@@ -2773,8 +2839,25 @@ export default function (pi: ExtensionAPI): void {
       registerAgentTools(pi, ctx);
       registeredCtx = ctx;
     }
+    ensureAgentToolsActive(pi, ctx);
     warnOnCommandCollision(ctx);
     warnIfAuditorProviderRisky(ctx);
+    // v0.24.6: sync the pi-subagents model override (managed Explore.md) with
+    // settings. Idempotent; applies to NEW sessions (pi-subagents registers
+    // its agents at its own session start).
+    try {
+      const s = loadSettings(ctx.cwd);
+      const sync = syncSubagentModelOverrides({
+        agentDir: defaultAgentDir(),
+        strategy: s.subagentModelStrategy ?? "inherit-parent",
+        overrides: s.subagentModelOverrides,
+      });
+      for (const skip of sync.skipped) {
+        ctx.ui.notify(`glla subagent override skipped [${skip.name}]: ${skip.reason}`, "warning");
+      }
+    } catch (err) {
+      ctx.ui.notify(`glla subagent override sync failed: ${err instanceof Error ? err.message : String(err)}`, "warning");
+    }
     // Restore gate (v0.21.0): a fresh session ("startup"/"new", or a pi too
     // old to report a reason) has no conversation context for the restored
     // work — HOLD instead of auto-firing, so opening pi in a folder never
@@ -2853,6 +2936,7 @@ export default function (pi: ExtensionAPI): void {
       registerAgentTools(pi, ctx);
       registeredCtx = ctx;
     }
+    ensureAgentToolsActive(pi, ctx);
     // Nudge accounting: a supervising turn with zero tool calls is a nudge
     // (no real progress); 3 consecutive → pause. Tool-use turns reset it.
     if (isSupervising()) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-goal-list-loop-audit",
-  "version": "0.24.4",
+  "version": "0.24.6",
   "description": "Goal. Loop. Audit. Done. — a pi-coding-agent extension that supervises long-running work, with isolated auditor on each completion. Beat bamboozling by design: the auditor runs in a fresh session with no extensions, no skills, no editor — only the read tools needed to verify your goal.",
   "license": "MIT",
   "author": "dracon",