pi-goal-list-loop-audit 0.29.15 → 0.29.17

package/extensions/loops/goal.ts

@@ -152,6 +152,11 @@ import {
   SettingsMenuComponent,
   type SettingsRow,
 } from "../settings-menu.js";
+import {
+  buildModelPickItems,
+  ModelPickerComponent,
+  type ModelPickItem,
+} from "../model-picker.js";
 import {
   applyMeasurement,
   applyMetriclessTick,
@@ -424,6 +429,15 @@ const countedLoopTokenMessages = new Set<string>();
 
 // Heartbeat self-watchdog state: liveness is the loop's own job.
 let lastActivityAt = Date.now();
+// v0.29.16: zombie-run watchdog clock — updated ONLY by genuine pi stream
+// events (message_update / tool_call / agent_start / turn_start /
+// agent_end), never by heartbeat-internal bookkeeping. A session pi
+// reports as BUSY with zero stream events for N min is a hung provider
+// stream (pi has no read timeout): continuations queue into the void and
+// the busy flag conceals the wedge from every other watchdog (field:
+// hellhunter + hegemon 2026-07-30, MiniMax streams died silently).
+let lastStreamActivityAt = Date.now();
+let lastZombieAlertAt = 0;
 let lastWedgeAlertAt = 0;
 let heartbeatNudges = 0;
 // v0.28.4 (P3): skip nudge accounting for the first agent_end turns after a
@@ -445,6 +459,9 @@ let carryoverResolved = true;
 let completionAuditInFlight = false;
 let heartbeatTimer: NodeJS.Timeout | null = null;
 
+const ZOMBIE_RUN_SILENT_MS = 20 * 60_000;
+const ZOMBIE_RUN_ALERT_THROTTLE_MS = 10 * 60_000;
+
 function noteActivity(real = false): void {
   lastActivityAt = Date.now();
   if (real) consecutiveStalls = 0;
@@ -653,6 +670,20 @@ function heartbeatTick(): void {
   // escalation would PAUSE the goal — silently cancelling the
   // interruptedAt → hold-on-restart promise the footer shows.
   if (probeExtensionApiStale()) { goStaleTerminal(ctx, "heartbeat probe"); return; }
+  // v0.29.16: zombie-run watchdog. pi reports BUSY (a run is "active") but
+  // zero stream events for 20 min = the provider stream hung silently —
+  // queued continuations can't land, and every other watchdog stays quiet
+  // because busy≠wedged. Detection + loud guidance only: aborting a turn
+  // is the user's call (consent line); Esc frees the queue and the
+  // heartbeat refires the goal/loop by itself.
+  const streamSilentMs = Date.now() - lastStreamActivityAt;
+  if (isSupervising() && !idle && streamSilentMs >= ZOMBIE_RUN_SILENT_MS && Date.now() - lastZombieAlertAt >= ZOMBIE_RUN_ALERT_THROTTLE_MS) {
+    lastZombieAlertAt = Date.now();
+    appendLedger(ctx.cwd, "zombie_run_suspected", { streamSilentMs, pending });
+    ctx.ui.notify(`glla: the session has been BUSY with zero stream activity for ${Math.round(streamSilentMs / 60000)} min — the provider stream is hung (pi never times it out; queued continuations can't land). Press Esc to abort the zombie turn — the goal/loop refires itself.`, "warning");
+    notifyExternal(ctx, `glla: zombie run suspected (${Math.round(streamSilentMs / 60000)} min busy-silent) — press Esc to abort.`);
+    return;
+  }
   // v0.29.1: stranded-audit recovery. A goal left in "auditing" with NO
   // in-flight audit means the auditor's result never landed (wedged queue
   // ate the tool result; compaction/restart mid-audit). Field-observed in
@@ -3917,19 +3948,37 @@ function getSessionThinkingLevel(): "off" | "minimal" | "low" | "medium" | "high
 function resolveAuditorModel(ctx: ExtensionContext, ref?: string): { model: any; error?: string; via?: string } {
   if (ref && ref.trim()) {
     const trimmed = ref.trim();
+    // v0.29.17: an unavailable configured model (unknown id, or a provider
+    // with no configured auth) falls back LOUDLY to the session model —
+    // user request: "fall back to the session if unavailable". The v0.9.12
+    // no-SILENT-substitution law stands: the fallback notifies + ledgers.
+    // (Quota-exhausted keys stay on the quota-retry path — the model IS
+    // available there; the key's window is the failure, not the model.)
+    const fail = (reason: string) => {
+      const sessionModel = ctx.model as any;
+      if (sessionModel) {
+        appendLedger(ctx.cwd, "auditor_model_fallback", { configured: trimmed, reason });
+        ctx.ui.notify(`Auditor model "${trimmed}" is unavailable (${reason}) — falling back to the session model. Fix via /glla → Auditor model.`, "warning");
+        return { model: sessionModel, via: "session-fallback" };
+      }
+      return { model: undefined, error: `${reason}: ${trimmed}` };
+    };
     const slash = trimmed.indexOf("/");
     if (slash > 0) {
       const provider = trimmed.slice(0, slash);
       const id = trimmed.slice(slash + 1);
       const model = ctx.modelRegistry.find(provider, id);
-      return model ? { model, via: "setting" } : { model: undefined, error: `model not found: ${trimmed}` };
+      if (!model) return fail("model not found");
+      if (!ctx.modelRegistry.hasConfiguredAuth(model)) return fail(`no configured auth for ${provider}`);
+      return { model, via: "setting" };
     }
     const matches = ctx.modelRegistry.getAvailable().filter((m: any) => m.id === trimmed || m.name === trimmed);
-    return matches[0] ? { model: matches[0], via: "setting" } : { model: undefined, error: `no available model matching: ${trimmed}` };
+    if (matches[0]) return { model: matches[0], via: "setting" };
+    return fail("no available model matching");
   }
   const sessionModel = ctx.model as any;
   if (sessionModel) return { model: sessionModel, via: "session" };
-  return { model: undefined, error: "no session model and no auditorModel configured — set one with /glla model=provider/id" };
+  return { model: undefined, error: "no session model and no auditorModel configured — set one with /glla → Auditor model" };
 }
 
 // (v0.9.12) The auto-fallback apparatus was REMOVED: no tier ranking, no
@@ -4006,6 +4055,43 @@ async function promptSettingsMenu(
  */
 // v0.28.7 (T4): exported for the behavioral settings-editor tests
 // (tests/settings-editors.test.ts drives each editor class end-to-end).
+/**
+ * v0.29.17: /model-style fuzzy picker for model-valued settings. Builds the
+ * item list from the registry (configured-auth providers only — a pick
+ * from this list can never be a dead provider) and hosts the picker via
+ * ctx.ui.custom. Falls back to the typed input when the runtime has no
+ * custom shard (headless) — typing stays the emergency hatch there.
+ * Returns { kind: "session" } to clear the override, { kind: "ref" } with
+ * provider/id, or undefined for cancel.
+ */
+async function promptModelRef(
+  ctx: ExtensionContext,
+  title: string,
+  emptyLabel: string,
+): Promise<{ kind: "session" } | { kind: "ref"; ref: string } | undefined> {
+  if (typeof (ctx.ui as { custom?: unknown }).custom !== "function" || !ctx.modelRegistry) {
+    const v = await ctx.ui.input(title, "provider/model-id — empty keeps the default");
+    if (v === undefined) return undefined;
+    return v.trim() ? { kind: "ref", ref: v.trim() } : { kind: "session" };
+  }
+  const sessionModel = ctx.model as any;
+  const sessionLabel = sessionModel ? `${sessionModel.provider}/${sessionModel.id}` : "pi session model";
+  const models = ctx.modelRegistry
+    .getAvailable()
+    .filter((m: any) => ctx.modelRegistry.hasConfiguredAuth(m));
+  const items = buildModelPickItems(models, sessionLabel);
+  const pick = await ctx.ui.custom<ModelPickItem | undefined>((tui, theme, keybindings, done) => {
+    return new ModelPickerComponent({ title, items }, () => tui.requestRender(), theme, keybindings, done);
+  });
+  if (!pick) return undefined;
+  if (pick.kind === "session") return { kind: "session" };
+  if (pick.kind === "model" && pick.ref) return { kind: "ref", ref: pick.ref };
+  // manual escape hatch — typed provider/model, validated like before
+  const v = await ctx.ui.input(title, emptyLabel);
+  if (v === undefined) return undefined;
+  return v.trim() ? { kind: "ref", ref: v.trim() } : { kind: "session" };
+}
+
 export async function handleSettingChoice(id: string, ctx: ExtensionContext): Promise<void> {
   switch (id) {
     case "autoResume": {
@@ -4045,8 +4131,10 @@ export async function handleSettingChoice(id: string, ctx: ExtensionContext): Pr
       return;
     }
     case "auditorModel": {
-      const v = await ctx.ui.input("Auditor model override", "provider/model-id — empty keeps the pi session model");
-      if (v !== undefined) saveSettings("global", ctx.cwd, { auditorModel: v.trim() || undefined });
+      const pick = await promptModelRef(ctx, "Auditor model override", "provider/model-id — empty keeps the pi session model");
+      if (pick === undefined) return;
+      saveSettings("global", ctx.cwd, { auditorModel: pick.kind === "session" ? undefined : pick.ref });
+      if (pick.kind === "session") ctx.ui.notify("Auditor model override cleared — the auditor follows the pi session model.", "info");
       return;
     }
     case "auditorThinkingLevel": {
@@ -4151,15 +4239,14 @@ export async function handleSettingChoice(id: string, ctx: ExtensionContext): Pr
     case "subagentModelOverrides.Plan":
     case "subagentModelOverrides.general-purpose": {
       const agentType = id.slice("subagentModelOverrides.".length);
-      const v = await ctx.ui.input(`Model pin for ${agentType} subagents`, "provider/model-id e.g. minimax/MiniMax-M3 — always wins over strategy; empty = follow strategy");
-      if (v !== undefined) {
-        const current = loadSettings(ctx.cwd).subagentModelOverrides ?? {};
-        const next = { ...current };
-        if (v.trim()) next[agentType] = v.trim();
-        else delete next[agentType];
-        saveSettings("global", ctx.cwd, { subagentModelOverrides: Object.keys(next).length > 0 ? next : undefined });
-        ctx.ui.notify(`${agentType} model pin saved — applies to NEW pi sessions.`, "info");
-      }
+      const pick = await promptModelRef(ctx, `Model pin for ${agentType} subagents`, "provider/model-id e.g. minimax/MiniMax-M3 — always wins over strategy; empty = follow strategy");
+      if (pick === undefined) return;
+      const current = loadSettings(ctx.cwd).subagentModelOverrides ?? {};
+      const next = { ...current };
+      if (pick.kind === "ref") next[agentType] = pick.ref;
+      else delete next[agentType];
+      saveSettings("global", ctx.cwd, { subagentModelOverrides: Object.keys(next).length > 0 ? next : undefined });
+      ctx.ui.notify(`${agentType} model pin saved — applies to NEW pi sessions.`, "info");
       return;
     }
     case "subagentResolved":
@@ -5467,6 +5554,7 @@ export default function (pi: ExtensionAPI): void {
     // continuation loop.
     if (isForeignCtx(ctx)) return;
     noteActivity(true);
+    lastStreamActivityAt = Date.now();
     // v0.27.2: folded-in length-continue (standalone pi-length-continue is
     // deprecated). A response cut by the per-response output cap is NOT a
     // completed turn (no telemetry), NOT a stall (no no-tool nudge), and
@@ -5734,9 +5822,22 @@ export default function (pi: ExtensionAPI): void {
   pi.on("tool_call", () => {
     toolCallsThisTurn++;
     noteActivity(true);
+    lastStreamActivityAt = Date.now();
     // v0.24.0: count loop-iteration tool calls (narration-only detection).
     if (isLoopActive()) {
       state.loop!.toolsThisTurn = (state.loop!.toolsThisTurn ?? 0) + 1;
     }
   });
+
+  // v0.29.16: stream liveness for the zombie-run watchdog — deltas, run
+  // starts, and turn starts all prove the provider stream is alive.
+  pi.on("message_update", () => {
+    lastStreamActivityAt = Date.now();
+  });
+  pi.on("agent_start", () => {
+    lastStreamActivityAt = Date.now();
+  });
+  pi.on("turn_start", () => {
+    lastStreamActivityAt = Date.now();
+  });
 }

package/extensions/model-picker.ts

@@ -0,0 +1,208 @@
+// pi-goal-list-loop-audit — v0.29.17
+// extensions/model-picker.ts
+//
+// A /model-style fuzzy picker for model-valued settings (Auditor model,
+// subagent model pins). Why this exists:
+//   • ctx.ui.select renders EVERY option unsorted with no search — a full
+//     model registry is hundreds of rows; unusable (field: the auditor
+//     model was left on a quota-dead openrouter key partly because fixing
+//     it meant hand-typing provider/model into a bare input).
+//   • pi's own /model dialog (ModelSelectorComponent) needs ModelRuntime
+//     and SettingsManager internals that extensions never receive.
+//   So we rebuild the same interaction shape — a search line with a
+//   fuzzy-filtered list — from pi-tui primitives (fuzzyFilter) over
+//   ctx.modelRegistry, hosted via ctx.ui.custom, exactly like the v0.28.0
+//   settings table. Unit-testable via synthetic handleInput calls.
+//
+// Item order: "session model" (clear override) first, then every
+// configured-auth model sorted by provider/id, then "type manually…" last.
+
+import { fuzzyFilter, truncateToWidth, visibleWidth } from "@earendil-works/pi-tui";
+import type { SettingsMenuTheme, KeybindingsManagerLike } from "./settings-menu.ts";
+
+export type ModelPickKind = "session" | "model" | "manual";
+
+export interface ModelPickItem {
+  kind: ModelPickKind;
+  /** provider/model-id for kind === "model". */
+  ref?: string;
+  /** Row label shown in the list. */
+  label: string;
+  /** Text the fuzzy filter matches against. */
+  searchText: string;
+}
+
+export interface RegistryModelLike {
+  provider: string;
+  id: string;
+  name?: string;
+}
+
+/** Build the picker's static item list from registry models (already
+ * filtered to configured-auth providers by the caller). Session row first,
+ * manual-entry row last; models sorted by provider then id. */
+export function buildModelPickItems(models: RegistryModelLike[], sessionLabel: string): ModelPickItem[] {
+  const sorted = [...models].sort((a, b) =>
+    a.provider === b.provider ? a.id.localeCompare(b.id) : a.provider.localeCompare(b.provider),
+  );
+  return [
+    {
+      kind: "session",
+      label: `session model (${sessionLabel}) — clear the override`,
+      searchText: "session model default clear override follow",
+    },
+    ...sorted.map((m) => {
+      const ref = `${m.provider}/${m.id}`;
+      return {
+        kind: "model" as const,
+        ref,
+        label: m.name && m.name !== m.id ? `${ref} — ${m.name}` : ref,
+        searchText: `${ref} ${m.name ?? ""}`,
+      };
+    }),
+    {
+      kind: "manual",
+      label: "type provider/model manually…",
+      searchText: "manual type custom provider model id",
+    },
+  ];
+}
+
+export interface ModelPickerFactoryDeps {
+  title: string;
+  items: ModelPickItem[];
+  /** Cap on visible list rows (window scrolls with the selection). */
+  maxVisibleRows?: number;
+}
+
+export class ModelPickerComponent {
+  private readonly title: string;
+  private readonly items: ModelPickItem[];
+  private readonly maxRows: number;
+  private readonly requestRender: () => void;
+  private readonly theme: SettingsMenuTheme;
+  private readonly keybindings: KeybindingsManagerLike;
+  private readonly done: (item: ModelPickItem | undefined) => void;
+
+  private query = "";
+  private selectedIdx = 0;
+
+  constructor(
+    deps: ModelPickerFactoryDeps,
+    requestRender: () => void,
+    theme: SettingsMenuTheme,
+    keybindings: KeybindingsManagerLike,
+    done: (item: ModelPickItem | undefined) => void,
+  ) {
+    this.title = deps.title;
+    this.items = deps.items;
+    this.maxRows = deps.maxVisibleRows ?? 12;
+    this.requestRender = requestRender;
+    this.theme = theme;
+    this.keybindings = keybindings;
+    this.done = done;
+  }
+
+  /** Current search query. Exposed for tests. */
+  getQuery(): string {
+    return this.query;
+  }
+
+  /** Index into the filtered list. Exposed for tests. */
+  getSelectedIdx(): number {
+    return this.selectedIdx;
+  }
+
+  /** Filtered items for the current query. Exposed for tests. */
+  filteredItems(): ModelPickItem[] {
+    if (!this.query.trim()) return this.items;
+    return fuzzyFilter(this.items, this.query.trim(), (it) => it.searchText);
+  }
+
+  private refresh(): void {
+    this.requestRender();
+  }
+
+  private move(delta: number): void {
+    const n = this.filteredItems().length;
+    if (n === 0) return;
+    this.selectedIdx = ((this.selectedIdx + delta) % n + n) % n;
+    this.refresh();
+  }
+
+  render(width: number): string[] {
+    const w = Math.max(20, width - 2);
+    const lines: string[] = [];
+    lines.push(this.theme.fg("accent", this.theme.bold(this.title)));
+    lines.push("");
+    const searchLine = `search: ${this.query}`;
+    lines.push(this.theme.fg("muted", truncateToWidth(searchLine, w, "…") + "▏"));
+    lines.push("");
+    const filtered = this.filteredItems();
+    if (filtered.length === 0) {
+      lines.push(this.theme.fg("warning", "  no matches — keep typing, or Esc to cancel"));
+    } else {
+      const sel = Math.min(this.selectedIdx, filtered.length - 1);
+      const half = Math.floor(this.maxRows / 2);
+      const start = Math.max(0, Math.min(sel - half, filtered.length - this.maxRows));
+      const window = filtered.slice(start, start + this.maxRows);
+      if (start > 0) lines.push(this.theme.fg("dim", `  ↑ ${start} more`));
+      for (let i = 0; i < window.length; i++) {
+        const idx = start + i;
+        const it = window[i]!;
+        const row = truncateToWidth(it.label, w - 2, "…");
+        lines.push(idx === sel ? this.theme.fg("accent", `→ ${row}`) : `  ${row}`);
+      }
+      const remaining = filtered.length - (start + window.length);
+      if (remaining > 0) lines.push(this.theme.fg("dim", `  ↓ ${remaining} more`));
+    }
+    lines.push("");
+    lines.push(this.theme.fg("dim", "type to filter · ↑/↓ move · enter select · esc cancel"));
+    return lines;
+  }
+
+  handleInput(data: string): void {
+    if (this.keybindings.matches(data, "tui.select.confirm")) {
+      const it = this.filteredItems()[this.selectedIdx];
+      this.done(it);
+      return;
+    }
+    if (this.keybindings.matches(data, "tui.select.cancel") || data === "\x1b") {
+      this.done(undefined);
+      return;
+    }
+    if (this.keybindings.matches(data, "tui.select.up")) {
+      this.move(-1);
+      return;
+    }
+    if (this.keybindings.matches(data, "tui.select.down")) {
+      this.move(+1);
+      return;
+    }
+    if (data === "\x7f" || data === "\b") {
+      if (this.query.length > 0) {
+        this.query = this.query.slice(0, -1);
+        this.selectedIdx = 0;
+        this.refresh();
+      }
+      return;
+    }
+    // Printable input (single keystrokes and pasted runs alike). Ignore
+    // escape/CSI sequences — they start with \x1b and were handled above.
+    if (!data.startsWith("\x1b")) {
+      const printable = [...data].filter((ch) => ch >= " ").join("");
+      if (printable.length > 0) {
+        this.query += printable;
+        this.selectedIdx = 0;
+        this.refresh();
+      }
+    }
+  }
+
+  invalidate(): void {
+    // Stateless beyond the query/selection — nothing to clear.
+  }
+}
+
+// Re-export for callers that only need the width helper's type signature.
+export { visibleWidth };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-goal-list-loop-audit",
-  "version": "0.29.15",
+  "version": "0.29.17",
   "description": "Goal. Loop. Audit. Done. \u2014 a pi-coding-agent extension that supervises long-running work, with isolated auditor on each completion. Beat bamboozling by design: the auditor runs in a fresh session with no extensions, no skills, no editor \u2014 only the read tools needed to verify your goal.",
   "license": "MIT",
   "author": "dracon",