pi-goal-list-loop-audit 0.31.2 → 0.31.4

package/extensions/goal-settings.ts

@@ -21,6 +21,10 @@ import type { SubagentModelStrategy } from "./goal-loop-subagents.js";
 export interface Settings {
   /** "provider/model-id" or bare "model-id". Unset → session model. */
   auditorModel?: string;
+  /** v0.31.3: auto-swap target when the session model IS auditorModel —
+   * the verifier should differ from the executor. Unset = same model stands
+   * (with a loud one-line nudge). */
+  auditorModelFallback?: string;
   auditorThinkingLevel?: "off" | "minimal" | "low" | "medium" | "high" | "xhigh";
   /** Shell command run on goal complete / goal pause / loop stop; message passed as $1. */
   notifyCmd?: string;
@@ -115,7 +119,9 @@ export const DEFAULT_SETTINGS: Settings = {
   // Unset = "high" at the call site (v0.31.2). The auditor is the
   // verification gate: its depth must NOT ride the session's coding-speed
   // thinking dial (user 2026-07-31: "we should also select its thinking
-  // level — we don't keep switching it"). /glla thinking= overrides.
+  // level — we don't keep switching it"). v0.31.4: picked alongside the
+  // model in /glla → Auditor model (no standalone menu row); /glla
+  // thinking= remains the direct path.
   auditorThinkingLevel: undefined,
   // v0.24.6: subagents inherit the session model by default — one quota
   // pool, no surprise 403s from a pinned default agent's provider.

package/extensions/loops/goal.ts

@@ -154,7 +154,6 @@ import {
 } from "../settings-menu.js";
 import {
   buildModelPickItems,
-  pickDiverseAuditorModel,
   ModelPickerComponent,
   type ModelPickItem,
 } from "../model-picker.js";
@@ -1366,7 +1365,7 @@ async function retryStoredCompletionAudit(ctx: ExtensionContext, origin: "quota-
     ? "Manual /goal verify — running the isolated auditor now (no agent turn needed)."
     : "Auditor quota window elapsed — retrying the audit with your stored completion claim (no agent turn needed).", "info");
   const settings = loadSettings(liveCtx.cwd);
-  const { model: auditorModel, error: modelError, via } = resolveAuditorModel(liveCtx, settings.auditorModel);
+  const { model: auditorModel, error: modelError, via } = resolveAuditorModel(liveCtx, settings.auditorModel, settings.auditorModelFallback);
   if (modelError) liveCtx.ui.notify(`Auditor model issue: ${modelError}`, "warning");
   latestAuditProgress = { label: "quota-retry", lastEventAt: Date.now() };
   completionAuditInFlight = true;
@@ -3174,7 +3173,7 @@ function registerAgentTools(pi: any, ctx: ExtensionContext): void {
       }
       updateGoal({ status: "auditing", pendingTasks: undefined }, ctx);
       const settings = loadSettings(ctx.cwd);
-      const { model: auditorModel, error: modelError, via } = resolveAuditorModel(ctx, settings.auditorModel);
+      const { model: auditorModel, error: modelError, via } = resolveAuditorModel(ctx, settings.auditorModel, settings.auditorModelFallback);
       if (modelError) {
         ctx.ui.notify(`Auditor model issue: ${modelError}`, "warning");
       }
@@ -4221,57 +4220,67 @@ function registerAgentTools(pi: any, ctx: ExtensionContext): void {
  * clear explanation (switch pi's model to a built-in provider, or set the
  * override) — we do NOT silently substitute a different model.
  */
-function resolveAuditorModel(ctx: ExtensionContext, ref?: string): { model: any; error?: string; via?: string } {
-  if (ref && ref.trim()) {
-    const trimmed = ref.trim();
-    // v0.31.2: "diverse" — the cross-vendor auditor (user design 2026-07-31:
-    // "there is benefit to have a different auditor"). Independent blind
-    // spots + a separate quota pool; the fresh auditor session shares no
-    // prompt cache anyway, so cross-vendor costs nothing extra.
-    if (trimmed.toLowerCase() === "diverse") {
-      const sessionModel = ctx.model as any;
-      const available = ctx.modelRegistry
-        .getAvailable()
-        .filter((m: any) => ctx.modelRegistry.hasConfiguredAuth(m));
-      const pick = pickDiverseAuditorModel(available, sessionModel?.provider);
-      if (pick) return { model: pick, via: "diverse" };
-      if (sessionModel) {
-        appendLedger(ctx.cwd, "auditor_model_fallback", { configured: "diverse", reason: "no configured-auth model outside the session's provider" });
-        ctx.ui.notify("Auditor model \"diverse\" found no model outside the session's provider — falling back to the session model (LOUD fallback; pin one via /glla → Auditor model).", "warning");
-        return { model: sessionModel, via: "session-fallback" };
-      }
-      return { model: undefined, error: "auditorModel \"diverse\": no configured-auth model at all" };
-    }
-    // v0.29.17: an unavailable configured model (unknown id, or a provider
-    // with no configured auth) falls back LOUDLY to the session model —
-    // user request: "fall back to the session if unavailable". The v0.9.12
-    // no-SILENT-substitution law stands: the fallback notifies + ledgers.
-    // (Quota-exhausted keys stay on the quota-retry path — the model IS
-    // available there; the key's window is the failure, not the model.)
-    const fail = (reason: string) => {
-      const sessionModel = ctx.model as any;
-      if (sessionModel) {
-        appendLedger(ctx.cwd, "auditor_model_fallback", { configured: trimmed, reason });
-        ctx.ui.notify(`Auditor model "${trimmed}" is unavailable (${reason}) — falling back to the session model. Fix via /glla → Auditor model.`, "warning");
-        return { model: sessionModel, via: "session-fallback" };
-      }
-      return { model: undefined, error: `${reason}: ${trimmed}` };
-    };
+/** v0.31.3: the auditor model chain — pinned primary, pinned fallback,
+ * session model LAST (user design 2026-07-31: "it can be the primary auditor
+ * and the session model is always the last; we can have a fallback auditor
+ * too" + "if the session model is the same as the auditor we auto fallback").
+ * Two explicit pins and a cascade — no preference tables, no strategy
+ * resolution (the v0.31.2 diverse-strategy machinery cost more complexity than it
+ * bought; it lasted one version). Every hop is LOUD (ledger + notify): the
+ * v0.9.12 no-SILENT-substitution law.
+ */
+function resolveAuditorModel(ctx: ExtensionContext, ref?: string, fallbackRef?: string): { model: any; error?: string; via?: string } {
+  const sessionModel = ctx.model as any;
+  const tryRef = (trimmed: string): { model?: any; reason?: string } => {
     const slash = trimmed.indexOf("/");
     if (slash > 0) {
       const provider = trimmed.slice(0, slash);
-      const id = trimmed.slice(slash + 1);
-      const model = ctx.modelRegistry.find(provider, id);
-      if (!model) return fail("model not found");
-      if (!ctx.modelRegistry.hasConfiguredAuth(model)) return fail(`no configured auth for ${provider}`);
-      return { model, via: "setting" };
+      const model = ctx.modelRegistry.find(provider, trimmed.slice(slash + 1));
+      if (!model) return { reason: "model not found" };
+      // v0.29.17: an unkeyed provider counts as unavailable. (Quota-exhausted
+      // keys stay on the quota-retry path — the model IS available there;
+      // the key's window is the failure, not the model.)
+      if (!ctx.modelRegistry.hasConfiguredAuth(model)) return { reason: `no configured auth for ${provider}` };
+      return { model };
     }
     const matches = ctx.modelRegistry.getAvailable().filter((m: any) => m.id === trimmed || m.name === trimmed);
-    if (matches[0]) return { model: matches[0], via: "setting" };
-    return fail("no available model matching");
+    return matches[0] ? { model: matches[0] } : { reason: "no available model matching" };
+  };
+  const isSession = (m: any) => sessionModel && m.provider === sessionModel.provider && m.id === sessionModel.id;
+  const pins = [ref, fallbackRef].map((r) => r?.trim()).filter((r): r is string => !!r);
+  for (let i = 0; i < pins.length; i++) {
+    const pin = pins[i]!;
+    const r = tryRef(pin);
+    if (!r.model) {
+      // Unavailable pin → cascade: next pin, then the session model (LOUD).
+      appendLedger(ctx.cwd, "auditor_model_fallback", { configured: pin, reason: r.reason });
+      ctx.ui.notify(`Auditor model "${pin}" is unavailable (${r.reason}) — ${i + 1 < pins.length ? "trying the fallback pin" : "falling back to the session model"}. Fix via /glla → Auditor model.`, "warning");
+      continue;
+    }
+    if (isSession(r.model) && i + 1 < pins.length) {
+      // The pin IS the session model — the verifier would be the executor's
+      // own model; auto-swap down the chain (the user's move).
+      appendLedger(ctx.cwd, "auditor_model_same_as_session", { model: `${r.model.provider}/${r.model.id}`, fallback: pins[i + 1] });
+      ctx.ui.notify(`Session model IS the pinned auditor (${r.model.provider}/${r.model.id}) — auditor auto-swapped to ${pins[i + 1]} so the verifier differs.`, "info");
+      continue;
+    }
+    if (isSession(r.model) && !fallbackRef?.trim()) {
+      // Last resort reached and it IS the session model, with no fallback
+      // ever pinned — the model stands (the session IS the last resort);
+      // one loud nudge so the user can wire the swap.
+      appendLedger(ctx.cwd, "auditor_model_same_as_session", { model: `${r.model.provider}/${r.model.id}`, fallback: null });
+      ctx.ui.notify(`The session model IS the pinned auditor (${r.model.provider}/${r.model.id}) — pin a different /glla → Auditor fallback model so the verifier can differ.`, "warning");
+    }
+    return { model: r.model, via: i === 0 ? "setting" : "fallback-pin" };
+  }
+  if (sessionModel) {
+    if (pins.length > 0) {
+      appendLedger(ctx.cwd, "auditor_model_fallback", { configured: pins.join(" → "), reason: "all pins exhausted" });
+      ctx.ui.notify("All pinned auditor models are unavailable — falling back to the session model. Fix via /glla → Auditor model.", "warning");
+      return { model: sessionModel, via: "session-fallback" };
+    }
+    return { model: sessionModel, via: "session" };
   }
-  const sessionModel = ctx.model as any;
-  if (sessionModel) return { model: sessionModel, via: "session" };
   return { model: undefined, error: "no session model and no auditorModel configured — set one with /glla → Auditor model" };
 }
 
@@ -4362,7 +4371,6 @@ async function promptModelRef(
   ctx: ExtensionContext,
   title: string,
   emptyLabel: string,
-  extraTop: ModelPickItem[] = [],
 ): Promise<{ kind: "session" } | { kind: "ref"; ref: string } | undefined> {
   if (typeof (ctx.ui as { custom?: unknown }).custom !== "function" || !ctx.modelRegistry) {
     const v = await ctx.ui.input(title, "provider/model-id — empty keeps the default");
@@ -4374,7 +4382,7 @@ async function promptModelRef(
   const models = ctx.modelRegistry
     .getAvailable()
     .filter((m: any) => ctx.modelRegistry.hasConfiguredAuth(m));
-  const items = buildModelPickItems(models, sessionLabel, extraTop);
+  const items = buildModelPickItems(models, sessionLabel);
   const pick = await ctx.ui.custom<ModelPickItem | undefined>((tui, theme, keybindings, done) => {
     return new ModelPickerComponent({ title, items }, () => tui.requestRender(), theme, keybindings, done);
   });
@@ -4426,26 +4434,25 @@ export async function handleSettingChoice(id: string, ctx: ExtensionContext): Pr
       return;
     }
     case "auditorModel": {
-      // v0.31.2: "diverse" sits at the top — the cross-vendor auditor
-      // (independent blind spots + a separate quota pool from the coding
-      // session). Picked like a model; resolution happens per-audit so
-      // provider availability is re-checked every time.
-      const diverseItem: ModelPickItem = {
-        kind: "model",
-        ref: "diverse",
-        label: "diverse — cross-vendor auditor: a different provider than the session, picked fresh per audit (Recommended)",
-        searchText: "diverse cross vendor independent different provider quota strategy recommended",
-      };
-      const pick = await promptModelRef(ctx, "Auditor model override", "provider/model-id — empty keeps the pi session model", [diverseItem]);
+      const pick = await promptModelRef(ctx, "Auditor model override", "provider/model-id — empty keeps the pi session model");
       if (pick === undefined) return;
       saveSettings("global", ctx.cwd, { auditorModel: pick.kind === "session" ? undefined : pick.ref });
-      if (pick.kind === "session") ctx.ui.notify("Auditor model override cleared — the auditor follows the pi session model.", "info");
-      if (pick.kind === "ref" && pick.ref === "diverse") ctx.ui.notify("Auditor model: DIVERSE — each audit picks a configured model outside the session's provider (deepseek ↔ MiniMax first).", "info");
+      // v0.31.4: thinking is chosen WITH the model (user: "we are setting
+      // the thinking when we select the model now or we should") — there is
+      // no standalone thinking row to forget about. Esc keeps the level.
+      const t = await ctx.ui.select("Auditor thinking level (the verification gate — depth over speed)", [
+        "high — recommended: the gate must not ride the session's coding dial",
+        "medium", "low", "minimal", "xhigh", "off",
+      ]);
+      if (t) saveSettings("global", ctx.cwd, { auditorThinkingLevel: t.split(" ")[0] as Settings["auditorThinkingLevel"] });
+      ctx.ui.notify(`Auditor model: ${pick.kind === "session" ? "session model (override cleared)" : pick.ref}${t ? ` · thinking ${t.split(" ")[0]}` : ""}`, "info");
       return;
     }
-    case "auditorThinkingLevel": {
-      const v = await ctx.ui.select("Auditor thinking level", ["off", "minimal", "low", "medium", "high", "xhigh"]);
-      if (v) saveSettings("global", ctx.cwd, { auditorThinkingLevel: v as Settings["auditorThinkingLevel"] });
+    case "auditorModelFallback": {
+      const pick = await promptModelRef(ctx, "Auditor fallback model (used when the session model IS the auditor)", "provider/model-id — empty clears the fallback");
+      if (pick === undefined) return;
+      saveSettings("global", ctx.cwd, { auditorModelFallback: pick.kind === "session" ? undefined : pick.ref });
+      if (pick.kind === "session") ctx.ui.notify("Auditor fallback cleared — a session on the pinned auditor model keeps that model.", "info");
       return;
     }
     case "auditCap": {

package/extensions/model-picker.ts

@@ -41,7 +41,7 @@ export interface RegistryModelLike {
 /** Build the picker's static item list from registry models (already
  * filtered to configured-auth providers by the caller). Session row first,
  * manual-entry row last; models sorted by provider then id. */
-export function buildModelPickItems(models: RegistryModelLike[], sessionLabel: string, extraTop: ModelPickItem[] = []): ModelPickItem[] {
+export function buildModelPickItems(models: RegistryModelLike[], sessionLabel: string): ModelPickItem[] {
   const sorted = [...models].sort((a, b) =>
     a.provider === b.provider ? a.id.localeCompare(b.id) : a.provider.localeCompare(b.provider),
   );
@@ -51,7 +51,6 @@ export function buildModelPickItems(models: RegistryModelLike[], sessionLabel: s
       label: `session model (${sessionLabel}) — clear the override`,
       searchText: "session model default clear override follow",
     },
-    ...extraTop,
     ...sorted.map((m) => {
       const ref = `${m.provider}/${m.id}`;
       return {
@@ -207,47 +206,3 @@ export class ModelPickerComponent {
 
 // Re-export for callers that only need the width helper's type signature.
 export { visibleWidth };
-
-/** v0.31.2: provider preference for the "diverse" auditor strategy (user
- * design 2026-07-31: "there is benefit to have a different auditor — M3's
- * auditor could be deepseek and vice versa"). A cross-vendor auditor reads
- * the executor's claims with INDEPENDENT blind spots (same-family models
- * share failure modes), and it spends a DIFFERENT provider's quota pool —
- * audits stop eating the coding session's MiniMax window. The auditor is
- * already a fresh session (no prompt-cache sharing), so cross-vendor costs
- * nothing in cache terms.
- *
- * Order: deepseek-via-openrouter first, MiniMax second, then the other
- * providers seen on this rig. The session's own provider is EXCLUDED
- * entirely (openrouter hosts everything — family-level reasoning about its
- * catalogue isn't reliable, so exclusion is at provider granularity).
- */
-export const DIVERSE_AUDITOR_PREFERENCE: Array<{ provider: string; match?: string }> = [
-  { provider: "openrouter", match: "deepseek/deepseek-chat" },
-  { provider: "openrouter", match: "deepseek" },
-  { provider: "minimax", match: "MiniMax-M3" },
-  { provider: "minimax" },
-  { provider: "kimi-coding" },
-  { provider: "kimi" },
-  { provider: "xai-auth" },
-  { provider: "opencode" },
-  { provider: "zenmux" },
-];
-
-/** Pure selection: the first preference entry (outside the session's
- * provider) with at least one available model wins; within an entry the
- * models arrive pre-filtered (auth checked by the caller) and sorted.
- * Returns undefined when nothing outside the session provider is available
- * — the caller falls back LOUDLY to the session model.
- */
-export function pickDiverseAuditorModel(
-  models: RegistryModelLike[],
-  sessionProvider: string | undefined,
-): RegistryModelLike | undefined {
-  for (const pref of DIVERSE_AUDITOR_PREFERENCE) {
-    if (pref.provider === sessionProvider) continue;
-    const hit = models.find((m) => m.provider === pref.provider && (!pref.match || m.id.includes(pref.match)));
-    if (hit) return hit;
-  }
-  return undefined;
-}

package/extensions/settings-menu.ts

@@ -165,17 +165,17 @@ export function buildSettingsRows(
       id: "auditorModel",
       section: "auditor",
       label: "Auditor model",
-      valueText: show("auditorModel", "pi session model"),
+      valueText: show("auditorModel", "session model"),
       sourceText: src("auditorModel"),
-      description: "provider/model override for the isolated auditor",
+      description: "provider/model override for the isolated auditor — you pick its thinking level right after the model",
     },
     {
-      id: "auditorThinkingLevel",
+      id: "auditorModelFallback",
       section: "auditor",
-      label: "Auditor thinking",
-      valueText: show("auditorThinkingLevel", "high (fixed — never the session coding dial)"),
-      sourceText: src("auditorThinkingLevel"),
-      description: "thinking level for the auditor session — unset = high (the verification gate does not ride the session thinking dial)",
+      label: "Auditor fallback model",
+      valueText: show("auditorModelFallback", "none"),
+      sourceText: src("auditorModelFallback"),
+      description: "auto-swap target when the session model IS the auditor model — the verifier should differ from the executor",
     },
     {
       id: "auditCap",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-goal-list-loop-audit",
-  "version": "0.31.2",
+  "version": "0.31.4",
   "description": "Goal. Loop. Audit. Done. \u2014 a pi-coding-agent extension that supervises long-running work, with isolated auditor on each completion. Beat bamboozling by design: the auditor runs in a fresh session with no extensions, no skills, no editor \u2014 only the read tools needed to verify your goal.",
   "license": "MIT",
   "author": "dracon",