pi-goal-list-loop-audit 0.25.5 → 0.26.0

package/extensions/goal-loop-subagents.ts

@@ -82,19 +82,81 @@ export const EXPLORE_DEFAULT_TOOLS = "read, bash, grep, find, ls";
 interface EmbeddedAgentDefault {
   description: string;
   systemPrompt: string;
+  /** "" means "all tools" (upstream omits builtinToolNames). */
   tools: string;
 }
 
-/** Embedded copies keyed by agent name. Only agents in
- * KNOWN_PINNED_DEFAULT_AGENTS need entries. */
+export const PLAN_DEFAULT_DESCRIPTION = "Software architect agent for designing implementation plans. Use this when you need to plan the implementation strategy for a task. Returns step-by-step plans, identifies critical files, and considers architectural trade-offs.";
+
+export const PLAN_DEFAULT_SYSTEM_PROMPT = `# CRITICAL: READ-ONLY MODE - NO FILE MODIFICATIONS
+You are a software architect and planning specialist.
+Your role is EXCLUSIVELY to explore the codebase and design implementation plans.
+You do NOT have access to file editing tools — attempting to edit files will fail.
+
+You are STRICTLY PROHIBITED from:
+- Creating new files
+- Modifying existing files
+- Deleting files
+- Moving or copying files
+- Creating temporary files anywhere, including /tmp
+- Using redirect operators (>, >>, |) or heredocs to write to files
+- Running ANY commands that change system state
+
+# Planning Process
+1. Understand requirements
+2. Explore thoroughly (read files, find patterns, understand architecture)
+3. Design solution based on your assigned perspective
+4. Detail the plan with step-by-step implementation strategy
+
+# Requirements
+- Consider trade-offs and architectural decisions
+- Identify dependencies and sequencing
+- Anticipate potential challenges
+- Follow existing patterns where appropriate
+
+# Tool Usage
+- Use the find tool for file pattern matching (NOT the bash find command)
+- Use the grep tool for content search (NOT bash grep/rg command)
+- Use the read tool for reading files (NOT bash cat/head/tail)
+- Use Bash ONLY for read-only operations
+
+# Output Format
+- Use absolute file paths
+- Do not use emojis
+- End your response with:
+
+### Critical Files for Implementation
+List 3-5 files most critical for implementing this plan:
+- /absolute/path/to/file.ts - [Brief reason]`;
+
+export const GENERAL_PURPOSE_DEFAULT_DESCRIPTION = "General-purpose agent for researching complex questions, searching for code, and executing multi-step tasks. When you are searching for a keyword or file and are not confident that you will find the right match in the first few tries use this agent to perform the search for you.";
+
+/** Embedded copies keyed by agent name. Explore needs an entry for the
+ * strategy-driven sync (KNOWN_PINNED_DEFAULT_AGENTS); Plan and
+ * general-purpose entries exist so users can pin them per-type via
+ * subagentModelOverrides (v0.25.6). */
 const EMBEDDED_DEFAULTS: Record<string, EmbeddedAgentDefault> = {
   Explore: {
     description: EXPLORE_DEFAULT_DESCRIPTION,
     systemPrompt: EXPLORE_DEFAULT_SYSTEM_PROMPT,
     tools: EXPLORE_DEFAULT_TOOLS,
   },
+  Plan: {
+    description: PLAN_DEFAULT_DESCRIPTION,
+    systemPrompt: PLAN_DEFAULT_SYSTEM_PROMPT,
+    tools: EXPLORE_DEFAULT_TOOLS, // same read-only set upstream
+  },
+  "general-purpose": {
+    description: GENERAL_PURPOSE_DEFAULT_DESCRIPTION,
+    systemPrompt: "", // upstream: empty prompt, promptMode append
+    tools: "", // upstream: all tools (builtinToolNames omitted)
+  },
 };
 
+/** v0.25.6: agent types the user can pin per-type via
+ * subagentModelOverrides (embedded defaults exist for each). */
+export const OVERRIDABLE_AGENT_TYPES = Object.keys(EMBEDDED_DEFAULTS);
+
 /** Default global agent dir (pi-subagents reads $PI_CODING_AGENT_DIR/agents,
  * default ~/.pi/agent/agents). Parameterized in sync for tests. */
 export function defaultAgentDir(): string {
@@ -107,12 +169,9 @@ export function buildAgentOverrideMd(name: string, model?: string): string {
   const def = EMBEDDED_DEFAULTS[name];
   if (!def) throw new Error(`no embedded default config for agent "${name}"`);
   const yamlDesc = "'" + def.description.replace(/'/g, "''") + "'";
-  const lines = [
-    "---",
-    `description: ${yamlDesc}`,
-    `tools: ${def.tools}`,
-    "prompt_mode: replace",
-  ];
+  const lines = ["---", `description: ${yamlDesc}`];
+  if (def.tools) lines.push(`tools: ${def.tools}`);
+  lines.push(def.systemPrompt ? "prompt_mode: replace" : "prompt_mode: append");
   if (model) lines.push(`model: ${model}`);
   lines.push(
     `x-managed-by: ${SUBAGENT_MANAGED_MARKER}`,
@@ -121,7 +180,7 @@ export function buildAgentOverrideMd(name: string, model?: string): string {
       : "x-glla-note: model pin removed (upstream default pins a fixed model) so this agent inherits the parent session model and its quota pool. Managed by glla — flip /glla subagent strategy to agent-default to restore upstream behavior.",
     "---",
     "",
-    def.systemPrompt,
+    def.systemPrompt || "(no system-prompt override — upstream default is an empty append-mode prompt)",
     "",
   );
   return lines.join("\n");
@@ -135,7 +194,16 @@ export interface SubagentSyncResult {
   written: string[];
   removed: string[];
   /** Files left untouched because the user owns them (no marker). */
-  skipped: Array<{ name: string; reason: string }>;
+  skipped: Array<{ name: string } & { reason: string }>;
+  /** v0.25.6: managed files that were expected (previously written) but
+   * found missing or altered, and got re-written — surface these to the
+   * user (external edit, pi update, or dracon-sync churn). */
+  repaired: string[];
+}
+
+/** State file tracking what the last sync wrote (repair detection). */
+export function subagentSyncStatePath(agentDir: string): string {
+  return path.join(agentDir, "agents", ".glla-subagent-sync.json");
 }
 
 /** Sync <agentDir>/agents/<Name>.md with the desired state. Idempotent:
@@ -145,8 +213,18 @@ export function syncSubagentModelOverrides(opts: {
   strategy: SubagentModelStrategy;
   overrides?: Record<string, string>;
 }): SubagentSyncResult {
-  const result: SubagentSyncResult = { written: [], removed: [], skipped: [] };
+  const result: SubagentSyncResult = { written: [], removed: [], skipped: [], repaired: [] };
   const overrides = opts.overrides ?? {};
+  // v0.25.6: load the previous sync state for repair detection — a file
+  // we wrote before that is now MISSING or CONTENT-CHANGED was touched
+  // externally; re-writing it is a repair the user should hear about.
+  let prevWritten: string[] = [];
+  try {
+    const prev = JSON.parse(fs.readFileSync(subagentSyncStatePath(opts.agentDir), "utf-8"));
+    if (Array.isArray(prev?.written)) prevWritten = prev.written.map(String);
+  } catch {
+    /* first sync or unreadable state */
+  }
   const names = new Set<string>([...KNOWN_PINNED_DEFAULT_AGENTS, ...Object.keys(overrides)]);
 
   for (const name of names) {
@@ -159,11 +237,15 @@ export function syncSubagentModelOverrides(opts: {
       continue;
     }
     const file = path.join(opts.agentDir, "agents", `${name}.md`);
+    // v0.25.6: the strategy-driven (model-less) write applies ONLY to
+    // agents that pin a model upstream (Explore) — Plan/general-purpose
+    // don't pin, so inherit-parent needs no file for them; they get
+    // managed files only via an explicit per-type override.
     const desired = overrideModel
       ? buildAgentOverrideMd(name, overrideModel)
-      : opts.strategy === "inherit-parent"
+      : opts.strategy === "inherit-parent" && (KNOWN_PINNED_DEFAULT_AGENTS as readonly string[]).includes(name)
         ? buildAgentOverrideMd(name)
-        : undefined; // agent-default + no per-type override → file should be absent
+        : undefined; // agent-default / no pin upstream + no override → file should be absent
 
     const exists = fs.existsSync(file);
     const current = exists ? fs.readFileSync(file, "utf-8") : undefined;
@@ -186,6 +268,31 @@ export function syncSubagentModelOverrides(opts: {
     fs.mkdirSync(path.dirname(file), { recursive: true });
     fs.writeFileSync(file, desired);
     result.written.push(name);
+    if (prevWritten.includes(name)) result.repaired.push(name);
+  }
+  // Persist what we manage now (best-effort).
+  try {
+    fs.mkdirSync(path.join(opts.agentDir, "agents"), { recursive: true });
+    fs.writeFileSync(subagentSyncStatePath(opts.agentDir), JSON.stringify({ written: result.written, at: new Date().toISOString() }));
+  } catch {
+    /* repair detection is best-effort */
   }
   return result;
 }
+
+/** v0.25.6: effective model for an agent type, for the headless settings
+ * display. Per-type override wins; inherit-parent falls to the session
+ * model; agent-default means upstream's own resolution (Explore's haiku
+ * pin for Explore, session model for the others). */
+export function resolveEffectiveSubagentModel(
+  name: string,
+  settings: { subagentModelStrategy?: string; subagentModelOverrides?: Record<string, string> },
+  sessionModel?: string,
+): string {
+  const pin = settings.subagentModelOverrides?.[name];
+  if (pin) return `${pin} (per-type pin)`;
+  if ((settings.subagentModelStrategy ?? "inherit-parent") === "inherit-parent") {
+    return sessionModel ? `${sessionModel} (inherits session)` : "(session model)";
+  }
+  return name === "Explore" ? "anthropic/claude-haiku-4-5 (upstream pin)" : "(agent default)";
+}

package/extensions/goal-settings.ts

@@ -60,6 +60,9 @@ export interface Settings {
    * override without the model pin so subagents share the session model and
    * its quota; "agent-default" restores upstream behavior. Applies to NEW
    * sessions (pi-subagents registers agents at session start). */
+  /** v0.26.0: reviewer (post-completion follow-up enqueuer) config —
+   * project-scoped; see extensions/reviewer.ts DEFAULT_REVIEWER_CONFIG. */
+  reviewer?: Record<string, unknown>;
   subagentModelStrategy?: SubagentModelStrategy;
   /** v0.24.6: per-agent-type model pin, e.g. { "Explore": "minimax/MiniMax-M3" }.
    * Always wins over subagentModelStrategy — the managed override is written

package/extensions/loops/goal.ts

@@ -87,6 +87,7 @@ import {
 } from "../goal-loop-core.js";
 import {
   isQuotaError,
+  isSubagentQuotaResult,
   parseQuotaError,
   scheduleQuotaRetry,
   cancelQuotaRetry,
@@ -101,6 +102,13 @@ import {
   settingsProvenance,
   type Settings,
 } from "../goal-settings.js";
+import {
+  DEFAULT_REVIEWER_CONFIG,
+  resolveReviewerConfig,
+  reviewerMenuOptions,
+  runReviewer,
+  type ReviewerConfig,
+} from "../reviewer.js";
 import {
   discoverGllaProjects,
   parseLedgerEntries,
@@ -122,6 +130,7 @@ import {
 import { buildStatusText, buildWidgetLines, type AuditDisplayProgress } from "../goal-loop-display.js";
 import {
   defaultAgentDir,
+  resolveEffectiveSubagentModel,
   syncSubagentModelOverrides,
   type SubagentModelStrategy,
 } from "../goal-loop-subagents.js";
@@ -515,7 +524,73 @@ function archiveCurrentGoal(ctx: ExtensionContext, status: Status, stopReason?:
   // (v0.2.0 bug: bare /list next silently consumed TWO items, found by the
   // pick-any-item verification in v0.10.0).
   if (goal.policy === "list" && status === "complete") {
-    activateNextListItem(ctx);
+    const advanced = activateNextListItem(ctx);
+    // v0.26.0: the queue just EMPTIED on a completion → list-complete.
+    if (!advanced) fireReviewer(ctx, { kind: "list", goalId: goal.id, objective: goal.objective, terminal: "goal-complete" });
+    return;
+  }
+  // v0.26.0: a /goal (non-list) reached a terminal state → maybe fire.
+  if (goal.policy !== "list") {
+    fireReviewer(ctx, { kind: "goal", goalId: goal.id, objective: goal.objective, terminal: status === "complete" ? "goal-complete" : status === "aborted" ? "goal-aborted" : "goal-paused" });
+  }
+}
+
+/**
+ * v0.26.0: bind the reviewer to the live session. Sources for finding
+ * extraction: the archived goal markdown + its audit reports + the
+ * durable audit log entries for this goal. List items are enqueued via
+ * the ONE enqueue path; /goal proposals go through the agent (which
+ * calls propose_goal_draft → the user's Confirm dialog).
+ */
+function fireReviewer(
+  ctx: ExtensionContext,
+  source: { kind: "goal" | "list"; goalId: string; objective: string; terminal: string },
+  opts: { manual?: boolean } = {},
+): void {
+  try {
+    const settings = loadSettings(ctx.cwd);
+    const config = resolveReviewerConfig(settings.reviewer as Partial<ReviewerConfig> | undefined);
+    const sources: Array<{ name: string; text: string }> = [];
+    try {
+      sources.push({ name: "archive", text: fs.readFileSync(archivedGoalPath(ctx.cwd, source.goalId), "utf-8") });
+    } catch {
+      /* archive md may not exist for manual review of a live goal */
+    }
+    const auditTexts = readAuditLog(ctx.cwd)
+      .filter((e) => e.goalId === source.goalId)
+      .map((e) => e.report);
+    for (const t of auditTexts) sources.push({ name: "audit", text: t });
+    let ledgerEntries: Array<{ type: string; at?: string; value?: any }> = [];
+    try {
+      ledgerEntries = parseLedgerEntries(fs.readFileSync(ledgerPath(ctx.cwd), "utf-8"));
+    } catch {
+      /* no ledger yet */
+    }
+    const outcome = runReviewer(config, source, {
+      cwd: ctx.cwd,
+      nowMs: Date.now(),
+      manual: opts.manual,
+      ledgerEntries,
+      sources,
+      enqueueListItems: (objectives) => enqueueItems(ctx, objectives, "reviewer"),
+      proposeGoal: (objective, reason) => {
+        try {
+          extensionApi?.sendUserMessage(
+            `[REVIEWER FOLLOW-UP — ${reason}. Propose this as a /goal via propose_goal_draft (the user Confirms or rejects): ${objective}]`,
+            { deliverAs: ctx.isIdle() ? "followUp" : "steer" },
+          );
+        } catch {
+          /* proposal best-effort */
+        }
+      },
+      notify: (message, level) => ctx.ui.notify(message, level),
+      ledger: (type, value) => appendLedger(ctx.cwd, type, value),
+    });
+    if (!outcome.fired && outcome.suppressedReason && opts.manual) {
+      ctx.ui.notify(`Reviewer suppressed: ${outcome.suppressedReason}`, "info");
+    }
+  } catch (err) {
+    ctx.ui.notify(`Reviewer failed (non-fatal): ${err instanceof Error ? err.message : String(err)}`, "warning");
   }
 }
 
@@ -2666,6 +2741,8 @@ async function openSettingsUI(ctx: ExtensionContext): Promise<void> {
           `Stuck max interventions — ${show("stuckMaxInterventions", "(5 default)")}`,
           `Subagent model strategy — ${show("subagentModelStrategy", "(inherit-parent)")}`,
           `Subagent Explore model pin — ${loadSettings(ctx.cwd).subagentModelOverrides?.Explore ?? "(follows strategy)"}`,
+          `Subagent Plan model pin — ${loadSettings(ctx.cwd).subagentModelOverrides?.Plan ?? "(follows strategy)"}`,
+          `Subagent general-purpose model pin — ${loadSettings(ctx.cwd).subagentModelOverrides?.["general-purpose"] ?? "(follows strategy)"}`,
           `Audit feedback characters — ${show("auditFeedbackChars", "(full report)")}`,
           "Done",
         ],
@@ -2735,15 +2812,16 @@ async function openSettingsUI(ctx: ExtensionContext): Promise<void> {
           saveSettings("global", ctx.cwd, { subagentModelStrategy: strategy });
           ctx.ui.notify("Subagent model strategy saved — applies to NEW pi sessions (pi-subagents registers agents at session start).", "info");
         }
-      } else if (choice.startsWith("Subagent Explore model pin")) {
-        const v = await ctx.ui.input("Model pin for Explore subagents", "provider/model-id e.g. minimax/MiniMax-M3 — always wins over strategy; empty = follow strategy");
+      } else if (/^Subagent (Explore|Plan|general-purpose) model pin/.test(choice)) {
+        const agentType = choice.match(/^Subagent (Explore|Plan|general-purpose) model pin/)![1]!;
+        const v = await ctx.ui.input(`Model pin for ${agentType} subagents`, "provider/model-id e.g. minimax/MiniMax-M3 — always wins over strategy; empty = follow strategy");
         if (v !== undefined) {
           const current = loadSettings(ctx.cwd).subagentModelOverrides ?? {};
           const next = { ...current };
-          if (v.trim()) next.Explore = v.trim();
-          else delete next.Explore;
+          if (v.trim()) next[agentType] = v.trim();
+          else delete next[agentType];
           saveSettings("global", ctx.cwd, { subagentModelOverrides: Object.keys(next).length > 0 ? next : undefined });
-          ctx.ui.notify("Explore model pin saved — applies to NEW pi sessions.", "info");
+          ctx.ui.notify(`${agentType} model pin saved — applies to NEW pi sessions.`, "info");
         }
       } else if (choice.startsWith("Audit feedback")) {
         const v = await ctx.ui.input("Auditor feedback returned to the executor (characters)", "non-negative integer cap; 0 or empty = full report (default)");
@@ -2761,6 +2839,73 @@ async function openSettingsUI(ctx: ExtensionContext): Promise<void> {
   }
 }
 
+/** v0.26.0: /review <archived-goal-id> — manual reviewer invocation. */
+async function cmdReview(args: string, ctx: ExtensionContext): Promise<void> {
+  const id = args.trim();
+  if (!id) {
+    ctx.ui.notify("Usage: /review <goal-id> — see /goal archive for ids.", "info");
+    return;
+  }
+  // Resolve the id against the archive (suffix match allowed).
+  let goalId = id;
+  let objective = "(archived goal)";
+  try {
+    const files = fs.readdirSync(archiveDir(ctx.cwd)).filter((f) => f.endsWith(".md"));
+    const match = files.find((f) => f === `${id}.md`) ?? files.find((f) => f.includes(id));
+    if (!match) {
+      ctx.ui.notify(`No archived goal matching "${id}". /goal archive lists them.`, "warning");
+      return;
+    }
+    goalId = match.replace(/\.md$/, "");
+    const md = fs.readFileSync(path.join(archiveDir(ctx.cwd), match), "utf-8");
+    const objMatch = md.match(/## Objective\n\n> ([\s\S]*?)(?:\n\n|$)/);
+    if (objMatch) objective = objMatch[1]!.replace(/\n/g, " ").slice(0, 300);
+  } catch {
+    ctx.ui.notify(`No archive found for ${id}.`, "warning");
+    return;
+  }
+  fireReviewer(ctx, { kind: "goal", goalId, objective, terminal: "goal-complete" }, { manual: true });
+}
+
+/** v0.26.0: /glla reviewer — the reviewer config menu (project-scoped). */
+async function cmdReviewerSettings(ctx: ExtensionContext): Promise<void> {
+  if (!ctx.hasUI) {
+    const cfg = resolveReviewerConfig(loadSettings(ctx.cwd).reviewer as Partial<ReviewerConfig> | undefined);
+    ctx.ui.notify(`reviewer (project): ${JSON.stringify(cfg, null, 2)}`, "info");
+    return;
+  }
+  const load = () => resolveReviewerConfig(loadSettings(ctx.cwd).reviewer as Partial<ReviewerConfig> | undefined);
+  const save = (patch: Partial<ReviewerConfig>) => saveSettings("project", ctx.cwd, { reviewer: { ...load(), ...patch } as Record<string, unknown> });
+  for (;;) {
+    const cfg = load();
+    let choice: string | undefined;
+    try {
+      choice = await ctx.ui.select("Reviewer — post-completion follow-up enqueuer (project settings)", reviewerMenuOptions(cfg));
+    } catch {
+      return;
+    }
+    if (!choice || choice === "Done") return;
+    try {
+      if (choice.startsWith("Enabled")) save({ enabled: !cfg.enabled });
+      else if (choice.startsWith("Leverage mode")) save({ leverageMode: cfg.leverageMode === "fix-without-confirm" ? "confirm-all" : "fix-without-confirm" });
+      else if (choice.startsWith("Fire on goal-complete")) save({ fireOn: cfg.fireOn.includes("goal-complete") ? cfg.fireOn.filter((e) => e !== "goal-complete") : [...cfg.fireOn, "goal-complete"] });
+      else if (choice.startsWith("Fire on list-complete")) save({ fireOn: cfg.fireOn.includes("list-complete") ? cfg.fireOn.filter((e) => e !== "list-complete") : [...cfg.fireOn, "list-complete"] });
+      else if (choice.startsWith("Cascade: audit-on-clean")) save({ cascade: cfg.cascade.includes("fire-audit-on-clean") ? cfg.cascade.filter((c) => c !== "fire-audit-on-clean") : [...cfg.cascade, "fire-audit-on-clean"] });
+      else if (choice.startsWith("Max findings")) {
+        const v = await ctx.ui.input("Max findings per review", "1-50");
+        const n = Number(v?.trim());
+        if (Number.isSafeInteger(n) && n >= 1 && n <= 50) save({ maxFindingsPerReview: n });
+      } else if (choice.startsWith("Max reviews")) {
+        const v = await ctx.ui.input("Max reviewer fires per day", "1-100");
+        const n = Number(v?.trim());
+        if (Number.isSafeInteger(n) && n >= 1 && n <= 100) save({ maxReviewsPerDay: n });
+      }
+    } catch {
+      /* individual save failures are non-fatal */
+    }
+  }
+}
+
 /**
  * v0.25.2: /glla stats — one command, every project's rollup. Args:
  *   (none)            markdown table, all discovered projects
@@ -2853,6 +2998,10 @@ async function cmdSettings(args: string, ctx: ExtensionContext): Promise<void> {
     cmdAudits(trimmed.slice("audits".length).trim(), ctx);
     return;
   }
+  if (/^reviewer\b/.test(trimmed)) {
+    await cmdReviewerSettings(ctx);
+    return;
+  }
   if (!trimmed) {
     if (ctx.hasUI) {
       await openSettingsUI(ctx);
@@ -2878,6 +3027,10 @@ async function cmdSettings(args: string, ctx: ExtensionContext): Promise<void> {
         fmt("aggressiveMode", "aggressiveMode"),
         fmt("quotaRetryMinutes", "quotaRetryMinutes"),
         fmt("stuckMaxInterventions", "stuckMaxInterventions"),
+        // v0.25.6: effective per-type subagent model resolution.
+        ...["Explore", "Plan", "general-purpose"].map(
+          (t) => `subagent ${t}: ${resolveEffectiveSubagentModel(t, loadSettings(ctx.cwd), (ctx.model as any)?.id ? `${(ctx.model as any).provider}/${(ctx.model as any).id}` : undefined)}`,
+        ),
         `\nglobal:  ${globalSettingsPath()}`,
         `project: ${projectSettingsPath(ctx.cwd)}`,
         `Set with: /glla key=value (global) · /glla project key=value (project override)`,
@@ -3152,10 +3305,15 @@ export default function (pi: ExtensionAPI): void {
       ["stats", "per-project ledger rollups: /glla stats [json|premature|project=<path>]"],
       ["audits", "audit-log browser: /glla audits [N|full] — recent verdicts from .pi-glla/audits.jsonl"],
       ["autoaccept=", "on: drafts activate without the Confirm dialog (unattended rigs)"],
+      ["reviewer", "reviewer config menu (post-completion follow-up enqueuer)"],
       ["project", "write a project override: /glla project key=value"],
     ]),
     handler: settingsHandler,
   });
+  pi.registerCommand("review", {
+    description: "Manually run the reviewer on an archived goal: /review <goal-id> — extracts findings, writes a report to .pi-glla/reviews/, enqueues bug-class fixes to /list, proposes architectural items as /goal. Bypasses the trigger gates (explicit user request).",
+    handler: (args: string, ctx: ExtensionContext) => { rememberCtx(ctx); return cmdReview(args, ctx); },
+  });
   pi.registerCommand("list", {
     description: "Loop 2: the list of audited goals — order is the default, not the law. /list <describe tasks or name a plan file> (dumps get shaped into items, files import, 'Done when:' adds directly) | /list show | /list resume | /list next [n] | /list remove <n> | /list clear | /list cancel",
     getArgumentCompletions: completions([
@@ -3164,6 +3322,7 @@ export default function (pi: ExtensionAPI): void {
       ["next", "activate the next item (or /list next <n> for position n)"],
       ["remove", "remove an item: /list remove <n>"],
       ["clear", "empty the list"],
+      ["depth", "queue depth, oldest item age, average item duration"],
       ["cancel", "stop the whole list: abort the active item + drop all waiting"],
     ]),
     handler: (args: string, ctx: ExtensionContext) => { rememberCtx(ctx); return cmdList(args, ctx); },
@@ -3252,6 +3411,18 @@ export default function (pi: ExtensionAPI): void {
         state.goal.telemetry = t;
       }
     }
+    // v0.25.6: subagent quota errors (the pi-subagents#175 shape —
+    // Explore's upstream haiku pin 403s on shared keys). Surface the
+    // repair path immediately; the continuation prompt's WHEN SUBAGENTS
+    // HIT QUOTA ERRORS section carries the full guidance.
+    if (isSubagentQuotaResult(String(event?.toolName ?? ""), Boolean(event?.isError ?? event?.error), event?.output ?? event?.result ?? event?.details ?? "")) {
+      const errText = typeof (event?.output ?? event?.result) === "string" ? (event?.output ?? event?.result) : JSON.stringify(event?.output ?? event?.result ?? event?.details ?? "");
+      appendLedger(registeredCtx?.cwd ?? process.cwd(), "subagent_quota_error", { error: String(errText).slice(0, 200) });
+      registeredCtx?.ui.notify(
+        "Subagent hit a quota error (403/limit). Repair: re-spawn with an explicit model= on your quota pool, or do the work inline — see the continuation prompt's WHEN SUBAGENTS HIT QUOTA ERRORS. Explore's upstream haiku pin is the usual cause (pi-subagents#175); glla's inherit-parent strategy removes it for NEW sessions.",
+        "warning",
+      );
+    }
     if (draftingTarget === null) return;
     if (askUserQuestionAnswered(String(event?.toolName ?? ""), event?.details)) {
       draftingUserReplies++;
@@ -3285,6 +3456,15 @@ export default function (pi: ExtensionAPI): void {
       for (const skip of sync.skipped) {
         ctx.ui.notify(`glla subagent override skipped [${skip.name}]: ${skip.reason}`, "warning");
       }
+      // v0.25.6: notify-with-repair — a managed override that went missing
+      // or was altered externally (pi update, manual edit, sync churn) is
+      // re-written AND surfaced, not silently restored.
+      if (sync.repaired.length > 0) {
+        ctx.ui.notify(
+          `glla repaired managed subagent override(s): ${sync.repaired.join(", ")} — the file(s) were missing or altered externally; re-written per your subagent settings.`,
+          "warning",
+        );
+      }
     } catch (err) {
       ctx.ui.notify(`glla subagent override sync failed: ${err instanceof Error ? err.message : String(err)}`, "warning");
     }

package/extensions/quota-retry.ts

@@ -88,3 +88,13 @@ export function scheduleQuotaRetry(
     "info",
   );
 }
+
+/** v0.25.6: detect a SUBAGENT quota failure in a tool_result — the
+ * pi-subagents#175 shape (Explore's upstream haiku pin 403s on shared
+ * keys). Tool must be an Agent spawn and the payload a quota error. */
+export function isSubagentQuotaResult(toolName: string, isError: boolean, payload: unknown): boolean {
+  if (!isError) return false;
+  if (toolName !== "Agent" && toolName !== "agent") return false;
+  const text = typeof payload === "string" ? payload : JSON.stringify(payload ?? "");
+  return isQuotaError(text);
+}

package/extensions/reviewer.ts

@@ -0,0 +1,276 @@
+// pi-goal-list-loop-audit — v0.26.0
+// extensions/reviewer.ts
+//
+// The Reviewer: post-completion follow-up enqueuer. Fires after a /goal
+// completes or a /list queue empties, extracts findings from the archive
+// + ledger, classifies them by leverage, writes a review report, and
+// cascades: bug/refactor findings → /list items (no Confirm, per the
+// leverage principle), architectural findings → /goal proposal (Confirm),
+// clean completions → audit /goal proposal, strategic-only → notify+idle.
+//
+// Deterministic by design (REVIEWER-DESIGN-2026-07-24: "makes NO new tool
+// calls — purely analytical"). All side effects are injected so tests
+// drive it without a pi host. /loop completions never trigger it.
+
+import * as fs from "node:fs";
+import * as path from "node:path";
+
+export interface ReviewerConfig {
+  enabled: boolean;
+  fireOn: Array<"goal-complete" | "list-complete">;
+  doNotFireOn: string[];
+  cascade: Array<"convert-findings-to-list" | "queue-leftovers" | "fire-audit-on-clean" | "notify-and-idle">;
+  auditCadence: string;
+  auditScope: string;
+  leverageMode: "fix-without-confirm" | "confirm-all";
+  confirmOn: string[];
+  maxFindingsPerReview: number;
+  maxReviewsPerDay: number;
+}
+
+export const DEFAULT_REVIEWER_CONFIG: ReviewerConfig = {
+  enabled: true,
+  fireOn: ["goal-complete", "list-complete"],
+  doNotFireOn: ["goal-aborted", "goal-paused"],
+  cascade: ["convert-findings-to-list", "queue-leftovers", "fire-audit-on-clean", "notify-and-idle"],
+  auditCadence: "every-clean-completion",
+  auditScope: "regression-scan",
+  leverageMode: "fix-without-confirm",
+  confirmOn: ["architectural-decision", "new-dependency", "schema-change"],
+  maxFindingsPerReview: 10,
+  maxReviewsPerDay: 20,
+};
+
+/** Merge a partial project-settings block over the defaults. */
+export function resolveReviewerConfig(block?: Partial<ReviewerConfig>): ReviewerConfig {
+  return { ...DEFAULT_REVIEWER_CONFIG, ...(block ?? {}) };
+}
+
+export type FindingClass = "bug" | "refactor" | "architectural" | "strategic";
+
+export interface Finding {
+  text: string;
+  source: string;
+  class: FindingClass;
+}
+
+/** Leverage classification (contract item 5). Order matters: strategic
+ * and architectural win over bug/refactor — "should we rewrite this
+ * broken schema" is a decision, not a fix. */
+const CLASS_PATTERNS: Array<{ class: FindingClass; re: RegExp }> = [
+  { class: "strategic", re: /\bshould we\b|\bdeprecat|ship this\??|strategic/i },
+  { class: "architectural", re: /\brewrite\b|new dependency|schema change|architectural|redesign/i },
+  { class: "bug", re: /\bTODO\b|\bFIXME\b|\bbug\b|\bissue\b|regression|broken|\bfixme\b/i },
+  { class: "refactor", re: /could be cleaner|consider refactoring|duplicat|refactor|left ?out|follow[\s-]?up|deferred/i },
+];
+
+export function classifyFindingText(line: string): FindingClass | undefined {
+  const t = line.trim();
+  if (t.length < 8) return undefined;
+  for (const { class: cls, re } of CLASS_PATTERNS) {
+    if (re.test(t)) return cls;
+  }
+  return undefined;
+}
+
+/** Scan source texts line-by-line for finding-shaped content. */
+export function extractFindings(sources: Array<{ name: string; text: string }>, max: number): Finding[] {
+  const out: Finding[] = [];
+  const seen = new Set<string>();
+  for (const { name, text } of sources) {
+    for (const line of text.split("\n")) {
+      const cls = classifyFindingText(line);
+      if (!cls) continue;
+      const clean = line.trim().replace(/^[-*>\s\[\]x]+/, "").slice(0, 200);
+      if (clean.length < 8 || seen.has(clean)) continue;
+      seen.add(clean);
+      out.push({ text: clean, source: name, class: cls });
+      if (out.length >= max) return out;
+    }
+  }
+  return out;
+}
+
+/** Runaway prevention (contract item 6/9): a reviewer fire in the last
+ * `windowMs` suppresses re-firing — reviewer-created work completing
+ * immediately must not recursively fire the reviewer. */
+export function reviewerFiredRecently(entries: Array<{ type: string; at?: string }>, windowMs: number, nowMs: number): boolean {
+  return entries.some((e) => e.type === "reviewer_fired" && e.at !== undefined && nowMs - Date.parse(e.at) < windowMs);
+}
+
+/** Per-day cap (contract item 10). */
+export function reviewsToday(entries: Array<{ type: string; at?: string }>, nowMs: number): number {
+  const day = new Date(nowMs).toISOString().slice(0, 10);
+  return entries.filter((e) => e.type === "reviewer_fired" && e.at?.startsWith(day)).length;
+}
+
+export interface ReviewReport {
+  goalId: string;
+  kind: "goal" | "list";
+  objective: string;
+  findings: Finding[];
+  cascadeStep: string;
+  at: string;
+}
+
+export function formatReviewReport(r: ReviewReport): string {
+  const byClass = (c: FindingClass) => r.findings.filter((f) => f.class === c);
+  const section = (title: string, items: Finding[]) =>
+    items.length === 0 ? "" : `\n## ${title}\n\n${items.map((f) => `- ${f.text} _(${f.source})_`).join("\n")}\n`;
+  return [
+    `# Review — ${r.goalId}`,
+    "",
+    `**Kind**: ${r.kind} · **At**: ${r.at}`,
+    "",
+    "## Summary",
+    "",
+    `Completed: ${r.objective.slice(0, 300)}`,
+    "",
+    `**Cascade step**: ${r.cascadeStep}`,
+    "",
+    `## Findings (${r.findings.length})`,
+    section("Bug-class (enqueued to /list, no Confirm)", byClass("bug")),
+    section("Refactor-class (enqueued to /list, no Confirm)", byClass("refactor")),
+    section("Architectural-class (proposed as /goal, Confirm required)", byClass("architectural")),
+    section("Strategic-class (notify only)", byClass("strategic")),
+    r.findings.length === 0 ? "\n(none — completion looks clean)\n" : "",
+  ].join("\n");
+}
+
+export function writeReviewReport(cwd: string, report: ReviewReport): string {
+  const dir = path.join(cwd, ".pi-glla", "reviews");
+  fs.mkdirSync(dir, { recursive: true });
+  const ts = report.at.replace(/[:.]/g, "-");
+  const file = path.join(dir, `${report.goalId}-${ts}.md`);
+  fs.writeFileSync(file, formatReviewReport(report));
+  return file;
+}
+
+/** Injectable side effects — goal.ts binds these to the live session. */
+export interface ReviewerDeps {
+  cwd: string;
+  nowMs: number;
+  /** /review <id> manual invocation — bypasses fireOn/doNotFireOn gates,
+   * the refire window, and the day cap (the user asked explicitly). */
+  manual?: boolean;
+  ledgerEntries: Array<{ type: string; at?: string; value?: any }>;
+  /** Source texts for finding extraction (archive md, audit reports). */
+  sources: Array<{ name: string; text: string }>;
+  enqueueListItems: (objectives: string[]) => void;
+  proposeGoal: (objective: string, reason: string) => void;
+  notify: (message: string, level: "info" | "warning") => void;
+  ledger: (type: string, value: Record<string, unknown>) => void;
+}
+
+export interface ReviewerOutcome {
+  fired: boolean;
+  suppressedReason?: string;
+  report?: ReviewReport;
+  reportPath?: string;
+  enqueued: number;
+  proposed: number;
+}
+
+export const REVIEWER_REFIRE_WINDOW_MS = 5 * 60_000;
+
+/** The reviewer lifecycle (contract item 1). */
+export function runReviewer(
+  config: ReviewerConfig,
+  source: { kind: "goal" | "list"; goalId: string; objective: string; terminal: string },
+  deps: ReviewerDeps,
+): ReviewerOutcome {
+  const none = (suppressedReason: string): ReviewerOutcome => ({ fired: false, suppressedReason, enqueued: 0, proposed: 0 });
+  if (!config.enabled && !deps.manual) return none("reviewer disabled");
+  const event = source.kind === "goal" ? `${source.terminal}` : "list-complete";
+  if (!deps.manual) {
+    if (config.doNotFireOn.includes(event)) return none(`doNotFireOn: ${event}`);
+    if (source.kind === "goal" && source.terminal !== "goal-complete") return none(`not a completion: ${source.terminal}`);
+    if (!config.fireOn.includes(source.kind === "goal" ? "goal-complete" : "list-complete")) return none("fireOn excludes this event");
+    if (reviewerFiredRecently(deps.ledgerEntries, REVIEWER_REFIRE_WINDOW_MS, deps.nowMs)) {
+      deps.ledger("reviewer_suppressed", { reason: "refire-window", goalId: source.goalId });
+      return none("reviewer fired within the last 5 minutes (runaway prevention)");
+    }
+    const today = reviewsToday(deps.ledgerEntries, deps.nowMs);
+    if (today >= config.maxReviewsPerDay) {
+      deps.ledger("reviewer_suppressed", { reason: "day-cap", count: today, cap: config.maxReviewsPerDay, goalId: source.goalId });
+      return none(`day cap reached (${today}/${config.maxReviewsPerDay})`);
+    }
+  }
+
+  const findings = extractFindings(deps.sources, config.maxFindingsPerReview);
+  const bugs = findings.filter((f) => f.class === "bug" || f.class === "refactor");
+  const architectural = findings.filter((f) => f.class === "architectural");
+  const strategic = findings.filter((f) => f.class === "strategic");
+
+  let enqueued = 0;
+  let proposed = 0;
+  let cascadeStep = "notify-and-idle";
+
+  // Cascade: findings → list items (leverage: fix-without-confirm).
+  const convertStep = source.kind === "goal" ? "convert-findings-to-list" : "queue-leftovers";
+  if (bugs.length > 0 && config.cascade.includes(convertStep)) {
+    deps.enqueueListItems(bugs.map((f) => f.text));
+    enqueued = bugs.length;
+    cascadeStep = convertStep;
+  }
+  // Architectural findings → /goal proposal WITH Confirm.
+  if (architectural.length > 0) {
+    deps.proposeGoal(
+      architectural.map((f) => f.text).join("; "),
+      `reviewer found ${architectural.length} architectural-class finding(s) — needs your Confirm`,
+    );
+    proposed += architectural.length;
+    cascadeStep = "propose-goal";
+  }
+  // Clean completion → audit /goal (opt-in cascade step).
+  if (findings.length === 0 && config.cascade.includes("fire-audit-on-clean")) {
+    deps.proposeGoal(
+      `Post-completion regression scan after ${source.goalId} (${config.auditScope})`,
+      "reviewer: completion looks clean — firing the audit step",
+    );
+    proposed++;
+    cascadeStep = "fire-audit-on-clean";
+  }
+
+  const report: ReviewReport = {
+    goalId: source.goalId,
+    kind: source.kind,
+    objective: source.objective,
+    findings,
+    cascadeStep,
+    at: new Date(deps.nowMs).toISOString(),
+  };
+  const reportPath = writeReviewReport(deps.cwd, report);
+  deps.ledger("reviewer_fired", {
+    goalId: source.goalId,
+    kind: source.kind,
+    findings: findings.length,
+    enqueued,
+    proposed,
+    cascadeStep,
+    report: path.relative(deps.cwd, reportPath),
+  });
+  deps.notify(
+    `Reviewer: ${findings.length} finding(s) — ${enqueued} enqueued to /list, ${proposed} proposed as /goal (${cascadeStep}). Report: ${path.relative(deps.cwd, reportPath)}`,
+    "info",
+  );
+  if (strategic.length > 0) {
+    deps.notify(`Reviewer: ${strategic.length} strategic finding(s) need YOUR call — see the report's Strategic section.`, "warning");
+  }
+  return { fired: true, report, reportPath, enqueued, proposed };
+}
+
+/** /glla reviewer menu options, derived from the config — extracted so
+ * the menu surface is unit-testable without a pi host. */
+export function reviewerMenuOptions(cfg: ReviewerConfig): string[] {
+  return [
+    `Enabled — ${cfg.enabled ? "ON" : "OFF"}`,
+    `Leverage mode — ${cfg.leverageMode} (bug/refactor findings)`,
+    `Fire on goal-complete — ${cfg.fireOn.includes("goal-complete") ? "ON" : "OFF"}`,
+    `Fire on list-complete — ${cfg.fireOn.includes("list-complete") ? "ON" : "OFF"}`,
+    `Cascade: audit-on-clean — ${cfg.cascade.includes("fire-audit-on-clean") ? "ON" : "OFF"}`,
+    `Max findings per review — ${cfg.maxFindingsPerReview}`,
+    `Max reviews per day — ${cfg.maxReviewsPerDay}`,
+    "Done",
+  ];
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-goal-list-loop-audit",
-  "version": "0.25.5",
+  "version": "0.26.0",
   "description": "Goal. Loop. Audit. Done. — a pi-coding-agent extension that supervises long-running work, with isolated auditor on each completion. Beat bamboozling by design: the auditor runs in a fresh session with no extensions, no skills, no editor — only the read tools needed to verify your goal.",
   "license": "MIT",
   "author": "dracon",