pi-goal-list-loop-audit 0.31.1 → 0.31.3

package/extensions/goal-settings.ts

@@ -21,6 +21,10 @@ import type { SubagentModelStrategy } from "./goal-loop-subagents.js";
 export interface Settings {
   /** "provider/model-id" or bare "model-id". Unset → session model. */
   auditorModel?: string;
+  /** v0.31.3: auto-swap target when the session model IS auditorModel —
+   * the verifier should differ from the executor. Unset = same model stands
+   * (with a loud one-line nudge). */
+  auditorModelFallback?: string;
   auditorThinkingLevel?: "off" | "minimal" | "low" | "medium" | "high" | "xhigh";
   /** Shell command run on goal complete / goal pause / loop stop; message passed as $1. */
   notifyCmd?: string;
@@ -112,9 +116,10 @@ export interface Settings {
 }
 
 export const DEFAULT_SETTINGS: Settings = {
-  // Unset = follow the pi session thinking level (user selects thinking in
-  // pi, auditor follows), floor "high" — the auditor is the verification
-  // gate, depth is worth more there than speed. /glla thinking= overrides.
+  // Unset = "high" at the call site (v0.31.2). The auditor is the
+  // verification gate: its depth must NOT ride the session's coding-speed
+  // thinking dial (user 2026-07-31: "we should also select its thinking
+  // level — we don't keep switching it"). /glla thinking= overrides.
   auditorThinkingLevel: undefined,
   // v0.24.6: subagents inherit the session model by default — one quota
   // pool, no surprise 403s from a pinned default agent's provider.

package/extensions/loops/goal.ts

@@ -1365,7 +1365,7 @@ async function retryStoredCompletionAudit(ctx: ExtensionContext, origin: "quota-
     ? "Manual /goal verify — running the isolated auditor now (no agent turn needed)."
     : "Auditor quota window elapsed — retrying the audit with your stored completion claim (no agent turn needed).", "info");
   const settings = loadSettings(liveCtx.cwd);
-  const { model: auditorModel, error: modelError, via } = resolveAuditorModel(liveCtx, settings.auditorModel);
+  const { model: auditorModel, error: modelError, via } = resolveAuditorModel(liveCtx, settings.auditorModel, settings.auditorModelFallback);
   if (modelError) liveCtx.ui.notify(`Auditor model issue: ${modelError}`, "warning");
   latestAuditProgress = { label: "quota-retry", lastEventAt: Date.now() };
   completionAuditInFlight = true;
@@ -1380,7 +1380,7 @@ async function retryStoredCompletionAudit(ctx: ExtensionContext, origin: "quota-
           completionSummary: claim.completionSummary,
           verificationSummary: claim.verificationSummary,
           model: auditorModel,
-          thinkingLevel: settings.auditorThinkingLevel ?? getSessionThinkingLevel(),
+          thinkingLevel: settings.auditorThinkingLevel ?? "high",
           onProgress: (progress) => {
             latestAuditProgress = { currentTool: progress.currentTool, label: progress.label, elapsedMs: progress.elapsedMs, lastEventAt: Date.now() };
             refreshUI(liveCtx);
@@ -3173,7 +3173,7 @@ function registerAgentTools(pi: any, ctx: ExtensionContext): void {
       }
       updateGoal({ status: "auditing", pendingTasks: undefined }, ctx);
       const settings = loadSettings(ctx.cwd);
-      const { model: auditorModel, error: modelError, via } = resolveAuditorModel(ctx, settings.auditorModel);
+      const { model: auditorModel, error: modelError, via } = resolveAuditorModel(ctx, settings.auditorModel, settings.auditorModelFallback);
       if (modelError) {
         ctx.ui.notify(`Auditor model issue: ${modelError}`, "warning");
       }
@@ -3188,7 +3188,7 @@ function registerAgentTools(pi: any, ctx: ExtensionContext): void {
           completionSummary: p.completionSummary,
           verificationSummary: p.verificationSummary,
           model: auditorModel,
-          thinkingLevel: settings.auditorThinkingLevel ?? getSessionThinkingLevel(),
+          thinkingLevel: settings.auditorThinkingLevel ?? "high",
           signal: signal ?? undefined,
           onProgress: (progress) => {
             latestAuditProgress = {
@@ -4207,18 +4207,6 @@ function registerAgentTools(pi: any, ctx: ExtensionContext): void {
  * the thinking level the user selected in pi; if none is set, audits run at
  * "high" — the auditor is the verification gate, depth beats speed there.
  */
-function getSessionThinkingLevel(): "off" | "minimal" | "low" | "medium" | "high" | "xhigh" {
-  try {
-    const level = extensionApi?.getThinkingLevel?.();
-    if (level && ["off", "minimal", "low", "medium", "high", "xhigh"].includes(level)) {
-      return level as "off" | "minimal" | "low" | "medium" | "high" | "xhigh";
-    }
-  } catch {
-    // fall through to the floor
-  }
-  return "high";
-}
-
 /**
  * Resolve the auditor model (v0.6.2). The principle: **the user selects the
  * model in pi; the auditor uses it.** The plugin never picks a model itself.
@@ -4232,39 +4220,67 @@ function getSessionThinkingLevel(): "off" | "minimal" | "low" | "medium" | "high
  * clear explanation (switch pi's model to a built-in provider, or set the
  * override) — we do NOT silently substitute a different model.
  */
-function resolveAuditorModel(ctx: ExtensionContext, ref?: string): { model: any; error?: string; via?: string } {
-  if (ref && ref.trim()) {
-    const trimmed = ref.trim();
-    // v0.29.17: an unavailable configured model (unknown id, or a provider
-    // with no configured auth) falls back LOUDLY to the session model —
-    // user request: "fall back to the session if unavailable". The v0.9.12
-    // no-SILENT-substitution law stands: the fallback notifies + ledgers.
-    // (Quota-exhausted keys stay on the quota-retry path — the model IS
-    // available there; the key's window is the failure, not the model.)
-    const fail = (reason: string) => {
-      const sessionModel = ctx.model as any;
-      if (sessionModel) {
-        appendLedger(ctx.cwd, "auditor_model_fallback", { configured: trimmed, reason });
-        ctx.ui.notify(`Auditor model "${trimmed}" is unavailable (${reason}) — falling back to the session model. Fix via /glla → Auditor model.`, "warning");
-        return { model: sessionModel, via: "session-fallback" };
-      }
-      return { model: undefined, error: `${reason}: ${trimmed}` };
-    };
+/** v0.31.3: the auditor model chain — pinned primary, pinned fallback,
+ * session model LAST (user design 2026-07-31: "it can be the primary auditor
+ * and the session model is always the last; we can have a fallback auditor
+ * too" + "if the session model is the same as the auditor we auto fallback").
+ * Two explicit pins and a cascade — no preference tables, no strategy
+ * resolution (the v0.31.2 diverse-strategy machinery cost more complexity than it
+ * bought; it lasted one version). Every hop is LOUD (ledger + notify): the
+ * v0.9.12 no-SILENT-substitution law.
+ */
+function resolveAuditorModel(ctx: ExtensionContext, ref?: string, fallbackRef?: string): { model: any; error?: string; via?: string } {
+  const sessionModel = ctx.model as any;
+  const tryRef = (trimmed: string): { model?: any; reason?: string } => {
     const slash = trimmed.indexOf("/");
     if (slash > 0) {
       const provider = trimmed.slice(0, slash);
-      const id = trimmed.slice(slash + 1);
-      const model = ctx.modelRegistry.find(provider, id);
-      if (!model) return fail("model not found");
-      if (!ctx.modelRegistry.hasConfiguredAuth(model)) return fail(`no configured auth for ${provider}`);
-      return { model, via: "setting" };
+      const model = ctx.modelRegistry.find(provider, trimmed.slice(slash + 1));
+      if (!model) return { reason: "model not found" };
+      // v0.29.17: an unkeyed provider counts as unavailable. (Quota-exhausted
+      // keys stay on the quota-retry path — the model IS available there;
+      // the key's window is the failure, not the model.)
+      if (!ctx.modelRegistry.hasConfiguredAuth(model)) return { reason: `no configured auth for ${provider}` };
+      return { model };
     }
     const matches = ctx.modelRegistry.getAvailable().filter((m: any) => m.id === trimmed || m.name === trimmed);
-    if (matches[0]) return { model: matches[0], via: "setting" };
-    return fail("no available model matching");
+    return matches[0] ? { model: matches[0] } : { reason: "no available model matching" };
+  };
+  const isSession = (m: any) => sessionModel && m.provider === sessionModel.provider && m.id === sessionModel.id;
+  const pins = [ref, fallbackRef].map((r) => r?.trim()).filter((r): r is string => !!r);
+  for (let i = 0; i < pins.length; i++) {
+    const pin = pins[i]!;
+    const r = tryRef(pin);
+    if (!r.model) {
+      // Unavailable pin → cascade: next pin, then the session model (LOUD).
+      appendLedger(ctx.cwd, "auditor_model_fallback", { configured: pin, reason: r.reason });
+      ctx.ui.notify(`Auditor model "${pin}" is unavailable (${r.reason}) — ${i + 1 < pins.length ? "trying the fallback pin" : "falling back to the session model"}. Fix via /glla → Auditor model.`, "warning");
+      continue;
+    }
+    if (isSession(r.model) && i + 1 < pins.length) {
+      // The pin IS the session model — the verifier would be the executor's
+      // own model; auto-swap down the chain (the user's move).
+      appendLedger(ctx.cwd, "auditor_model_same_as_session", { model: `${r.model.provider}/${r.model.id}`, fallback: pins[i + 1] });
+      ctx.ui.notify(`Session model IS the pinned auditor (${r.model.provider}/${r.model.id}) — auditor auto-swapped to ${pins[i + 1]} so the verifier differs.`, "info");
+      continue;
+    }
+    if (isSession(r.model) && !fallbackRef?.trim()) {
+      // Last resort reached and it IS the session model, with no fallback
+      // ever pinned — the model stands (the session IS the last resort);
+      // one loud nudge so the user can wire the swap.
+      appendLedger(ctx.cwd, "auditor_model_same_as_session", { model: `${r.model.provider}/${r.model.id}`, fallback: null });
+      ctx.ui.notify(`The session model IS the pinned auditor (${r.model.provider}/${r.model.id}) — pin a different /glla → Auditor fallback model so the verifier can differ.`, "warning");
+    }
+    return { model: r.model, via: i === 0 ? "setting" : "fallback-pin" };
+  }
+  if (sessionModel) {
+    if (pins.length > 0) {
+      appendLedger(ctx.cwd, "auditor_model_fallback", { configured: pins.join(" → "), reason: "all pins exhausted" });
+      ctx.ui.notify("All pinned auditor models are unavailable — falling back to the session model. Fix via /glla → Auditor model.", "warning");
+      return { model: sessionModel, via: "session-fallback" };
+    }
+    return { model: sessionModel, via: "session" };
   }
-  const sessionModel = ctx.model as any;
-  if (sessionModel) return { model: sessionModel, via: "session" };
   return { model: undefined, error: "no session model and no auditorModel configured — set one with /glla → Auditor model" };
 }
 
@@ -4424,6 +4440,13 @@ export async function handleSettingChoice(id: string, ctx: ExtensionContext): Pr
       if (pick.kind === "session") ctx.ui.notify("Auditor model override cleared — the auditor follows the pi session model.", "info");
       return;
     }
+    case "auditorModelFallback": {
+      const pick = await promptModelRef(ctx, "Auditor fallback model (used when the session model IS the auditor)", "provider/model-id — empty clears the fallback");
+      if (pick === undefined) return;
+      saveSettings("global", ctx.cwd, { auditorModelFallback: pick.kind === "session" ? undefined : pick.ref });
+      if (pick.kind === "session") ctx.ui.notify("Auditor fallback cleared — a session on the pinned auditor model keeps that model.", "info");
+      return;
+    }
     case "auditorThinkingLevel": {
       const v = await ctx.ui.select("Auditor thinking level", ["off", "minimal", "low", "medium", "high", "xhigh"]);
       if (v) saveSettings("global", ctx.cwd, { auditorThinkingLevel: v as Settings["auditorThinkingLevel"] });

package/extensions/settings-menu.ts

@@ -169,13 +169,21 @@ export function buildSettingsRows(
       sourceText: src("auditorModel"),
       description: "provider/model override for the isolated auditor",
     },
+    {
+      id: "auditorModelFallback",
+      section: "auditor",
+      label: "Auditor fallback model",
+      valueText: show("auditorModelFallback", "none — same-model sessions keep the pinned auditor"),
+      sourceText: src("auditorModelFallback"),
+      description: "auto-swap target when the session model IS the auditor model — the verifier should differ from the executor",
+    },
     {
       id: "auditorThinkingLevel",
       section: "auditor",
       label: "Auditor thinking",
-      valueText: show("auditorThinkingLevel", "session, floor high"),
+      valueText: show("auditorThinkingLevel", "high (fixed — never the session coding dial)"),
       sourceText: src("auditorThinkingLevel"),
-      description: "thinking level for the auditor session",
+      description: "thinking level for the auditor session — unset = high (the verification gate does not ride the session thinking dial)",
     },
     {
       id: "auditCap",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-goal-list-loop-audit",
-  "version": "0.31.1",
+  "version": "0.31.3",
   "description": "Goal. Loop. Audit. Done. \u2014 a pi-coding-agent extension that supervises long-running work, with isolated auditor on each completion. Beat bamboozling by design: the auditor runs in a fresh session with no extensions, no skills, no editor \u2014 only the read tools needed to verify your goal.",
   "license": "MIT",
   "author": "dracon",