pi-quiver 6.3.0 → 6.3.1

package/CHANGELOG.md

@@ -8,6 +8,10 @@ Published to npm as `pi-quiver` (`pi install npm:pi-quiver`). Pushing a
 via OIDC trusted publishing. The release helper at
 `.agents/skills/release/scripts/release.sh` cuts the tag; CI publishes.
 
+## v6.3.1 - 2026-09-25
+
+- `provider-stall-watchdog` recovers again on pi >= 0.86 ([#23](https://github.com/jjuraszek/pi-quiver/issues/23)): pi's session abort now fences the run so its retry loop never runs after a watchdog abort; the watchdog omits the aborted attempt from the model's context at `turn_end` and re-drives the request itself via a hidden custom message after pi's backoff, honoring pi's `retry.enabled` / `retry.baseDelayMs` / `retry.maxAgentDelayMs` live and the existing `maxStallRetries` cap. Print/json await the backoff; TUI/RPC show `Retrying (n/m) in Ns... (Esc to cancel)` in the status bar on the timer path. In TUI, Esc, a new prompt, a tree switch, or compaction cancels the pending retry; RPC cancels on a new prompt, not Esc. Behavior guide: `doc/provider-stall-watchdog.md`. Dev dependencies on `@earendil-works/*` move to `^0.87.1`.
+
 ## v6.3.0 - 2026-09-16
 
 - `session-name` Herdr sink claims any numeric tab label (optionally behind one `* `) at any position instead of only the label equal to the tab's live position, so tabs reordered before the first auto-name - or after a `/new` restore - get named; the claim resets at every `session_start` (`/new`, resume, fork behave like a fresh process) and a tab that reverts to a bare number is re-claimed on the next turn. The extension never writes a digits-only label (`1234` -> `#1234`) and the naming prompt asks for `PR 1234` / `issue 123` / `ticket ABC-123` over a bare ID.

package/README.md

@@ -69,7 +69,7 @@ A 300 KB changelog page never touches your context window - you get a preview an
 | `extensions/session-name.ts` | `/session-name` | Manual + opt-in automatic session naming, naming rules and deny list, long-session revisits, and Ghostty/Herdr tab rename. OFF by default. |
 | `extensions/sword-header.ts` | `/builtin-header` | Themed ASCII startup header replacing pi's default logo. OFF by default. |
 | `extensions/fast-mode.ts` | `/fast` | Inject Anthropic fast-mode (`speed: "fast"` + `anthropic-beta: fast-mode-2026-02-01`) into every Claude Opus 4.8 / Opus 5 request, any thinking level. `--fast` flag + `/fast [on\|off\|status]`. OFF by default. |
-| `extensions/provider-stall-watchdog.ts` | - | Opt-in provider-stall recovery, in two tiers: a pre-first-event deadline (`firstEventMs`, 20s) on every provider request in every mode, and the mid-stream pair (warn at 2 min, recover at 4 min) in TUI runs only. Policy D offers each stall to Pi's retry loop until the stall retry budget (`maxStallRetries`, default = `retry.maxRetries`) is exhausted. OFF by default. |
+| `extensions/provider-stall-watchdog.ts` | - | Opt-in provider-stall recovery, in two tiers: a pre-first-event deadline (`firstEventMs`, 20s) on every provider request in every mode, and the mid-stream pair (warn at 2 min, recover at 4 min) in TUI runs only. Each stall is aborted; while pi's `retry.enabled` is true and the stall retry budget (`maxStallRetries`, default = `retry.maxRetries`) remains, its aborted attempt is hidden from the model and re-driven by the watchdog after pi's backoff; behavior guide: [doc/provider-stall-watchdog.md](doc/provider-stall-watchdog.md). OFF by default. |
 | `extensions/slack.ts` | `slack_search`, `slack_thread`, `slack_post`, `slack_update`, `slack_delete`, `slack_pin`, `slack_upload`, `slack_cache_refresh` | Context-safe Slack search/threads/posting with dual `user`/`bot` token identities, Block Kit flattening and optional raw JSON output for threads, a workspace-keyed channel/user name->ID cache, DM targets by `@name` / user ID, fetch-style output size gating, and a transactional headline+detail-thread announce protocol with a documented recovery path. OFF by default. Behavior lives in `lib/slack-core.ts` and `lib/slack-cache.ts`. |
 
 Full routing rules, size-gate mechanics, and config: [doc/fetch.md](doc/fetch.md), [doc/doc-to-md.md](doc/doc-to-md.md), [doc/slack.md](doc/slack.md).
@@ -239,18 +239,18 @@ not a pi-quiver setting and is never nested):
 
 `providerStallWatchdog` is OFF by default. Once enabled it arms in two tiers per provider request:
 
-- **Pre-first-event (`firstEventMs`).** Armed at every provider request, in every mode and from every origin - including extension-triggered turns that never emit `before_agent_start` - and cleared by the first assistant `message_start`. On expiry the request is aborted and, budget permitting, converted to a retryable error, so an unresponsive request recovers in ~22s (20s detection + Pi's 2s backoff) instead of the ~240s it took when only the mid-stream tier existed.
+- **Pre-first-event (`firstEventMs`).** Armed at every provider request, in every mode and from every origin - including extension-triggered turns that never emit `before_agent_start` - and cleared by the first assistant `message_start`. On expiry the request is aborted and, budget permitting, converted to a retryable error and re-driven after pi's backoff when `retry.enabled` is true, so an unresponsive request recovers in ~22s (20s detection + 2s backoff) instead of the ~240s it took when only the mid-stream tier existed.
 - **Mid-stream (`warningMs` / `recoveryMs`).** Armed from the first assistant `message_start` onward, and only when `ctx.mode === "tui"`. Aborting mid-generation discards billed output tokens and an unattended run has nobody to read the warning, so headless mid-stream silence deliberately falls through to the transport timeout instead.
 
 **Raise `firstEventMs` if your provider is legitimately slow to first event.** Queueing gateways, throttled endpoints, and busy single-slot local model servers can hold the connection for well over 20s before their first stream event; every false abort re-uploads the whole context and spends one stall retry.
 
 **Leave pi's own `httpIdleTimeoutMs` (default `300000`) at its default.** It is the transport backstop, and a single value drives undici's `headersTimeout` *and* `bodyTimeout` - lowering it to get fast pre-stream failure also truncates legitimate mid-stream gaps. `firstEventMs` is the knob for pre-stream silence.
 
-Verified with Pi 0.80.10: each stall is aborted and offered to Pi retry until `maxStallRetries` conversions are used; further stalls stop for manual resubmission. Both tiers draw on that one budget. `maxStallRetries` defaults to the layered `retry.maxRetries` (Pi default 3, an explicit `0` honoured); `0` is valid and means "detect and stop, never auto-retry". Consecutive stall conversions consume Pi retry attempts without a success reset in between, so keep `maxStallRetries <= retry.maxRetries`. A successful assistant turn resets the stall counter (mirroring Pi's own retry counter). Automatic continuation needs enabled Pi retry with remaining capacity. Disabled, exhausted, or incompatible retry degrades to manual resubmission. Pending steering or follow-ups return to the editor and are excluded from automatic continuation. Invalid merged watchdog config fails closed.
+Verified with Pi 0.87.1: each eligible stall is aborted, its message omitted from the model's context, and the request re-driven by the watchdog after pi's backoff (`retry.baseDelayMs`, capped at `retry.maxAgentDelayMs`) until `maxStallRetries` conversions are used; further stalls stop for manual resubmission. Both tiers draw on that one budget. `maxStallRetries` defaults to the layered `retry.maxRetries` (Pi default 3, an explicit `0` honoured); `0` is valid and means "detect and stop, never auto-retry". A successful assistant turn resets the stall counter (mirroring Pi's own retry counter). pi's `retry.enabled: false` disables the re-drive and degrades to manual resubmission without omitting the aborted message. Pending steering or follow-ups return to the editor and are excluded from automatic continuation. Invalid merged watchdog config fails closed. Print/json await pi's backoff before re-driving; TUI/RPC show a timer-path countdown that a new prompt cancels. Why the watchdog re-drives instead of pi, the hidden re-drive message, and the wait behavior: [doc/provider-stall-watchdog.md](doc/provider-stall-watchdog.md).
 
 Operational notes:
 
-- **Settings are read once per session,** on the first provider request. Editing `settings.json` mid-session changes nothing until you restart the session - that includes repairing an invalid block that already disabled the extension.
+- **Settings are read once per session,** on the first provider request. Editing watchdog settings in `settings.json` mid-session changes nothing until you restart the session - that includes repairing an invalid block that already disabled the extension. The exception is pi's `retry.enabled`, `retry.baseDelayMs`, and `retry.maxAgentDelayMs`, which the re-drive reads live at each stall.
 - **A watchdog abort that the provider ignores escalates after a fixed 10s.** Any post-abort stream event re-arms that deadline (bytes prove only that the connection was alive at that instant), so a stream that emits a straggler and then wedges still escalates 10s after its last event. This reduces the hang; it cannot force the provider to stop, and undici's timeouts remain the final backstop.
 - **Headless runs report on stderr.** In `print`/`json` mode pi binds a no-op UI, so watchdog notices go out via `console.warn`. Nothing is ever written to stdout, which `json` mode uses for its protocol. In TUI and RPC the notices render as main-window notifications, not the bottom status line.
 

package/extensions/fast-mode.ts

@@ -28,7 +28,7 @@
  */
 
 import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
-import type { Context, Model, StreamOptions, Usage } from "@earendil-works/pi-ai";
+import type { Context, Model, StreamOptions, TranscriptContext, Usage } from "@earendil-works/pi-ai";
 import { resolveConfig } from "../lib/extension-config.ts";
 
 export const FAST_MODE_BETA = "fast-mode-2026-02-01";
@@ -163,7 +163,7 @@ export async function probePiBetaHeader(
 	};
 	try {
 		const { anthropicMessagesApi } = await import("@earendil-works/pi-ai/compat");
-		const stream = anthropicMessagesApi().stream(model, PROBE_CONTEXT, options);
+		const stream = anthropicMessagesApi().stream(model, PROBE_CONTEXT as TranscriptContext, options);
 		await stream.result().catch(() => {});
 	} catch {
 		return captured;

package/extensions/provider-stall-watchdog.ts

@@ -91,6 +91,27 @@ export function resolveRetryMaxRetries(cwd: string): number {
 	return maxRetries;
 }
 
+export type RetrySettings = { enabled: boolean; baseDelayMs: number; maxAgentDelayMs: number };
+
+export function resolveRetrySettings(cwd: string): RetrySettings {
+	const settings: RetrySettings = { enabled: true, baseDelayMs: 2_000, maxAgentDelayMs: 60_000 };
+	for (const path of settingsPaths(cwd)) {
+		const retry = readSettings(path)?.retry;
+		if (retry === null || typeof retry !== "object" || Array.isArray(retry)) continue;
+		const source = retry as Record<string, unknown>;
+		if (typeof source.enabled === "boolean") settings.enabled = source.enabled;
+		if (isNonNegativeInteger(source.baseDelayMs)) settings.baseDelayMs = source.baseDelayMs;
+		if (isNonNegativeInteger(source.maxAgentDelayMs)) settings.maxAgentDelayMs = source.maxAgentDelayMs;
+	}
+	return settings;
+}
+
+export function redriveDelayMs(settings: Pick<RetrySettings, "baseDelayMs" | "maxAgentDelayMs">, attempt: number): number {
+	const delay = settings.baseDelayMs * 2 ** Math.max(0, attempt - 1);
+	const safeDelay = Number.isSafeInteger(delay) ? delay : Number.MAX_SAFE_INTEGER;
+	return Math.min(safeDelay, settings.maxAgentDelayMs, MAX_TIMER_MS);
+}
+
 export function resolveWatchdogConfig(cwd: string, warn?: (msg: string) => void): ConfigValidation {
 	const candidate = resolveConfig(cwd, "providerStallWatchdog", DEFAULT_CANDIDATE, coerce, warn);
 	if (candidate.blockIsObject === true && candidate.maxStallRetries === undefined) {
@@ -105,6 +126,9 @@ const defaultRuntime: WatchdogRuntime = {
 	clearTimeout: (handle) => clearTimeout(handle as ReturnType<typeof setTimeout>),
 };
 
+const REDRIVE_TEXT = "The previous provider request stalled before completing and was retried automatically. Continue.";
+const RETRY_CANCELLED_NOTICE = "Automatic retry cancelled; submit the message again to retry manually.";
+const STATUS_KEY = "providerStallWatchdog";
 const DEGRADATION_NOTICE = "The stalled request was stopped, but Pi did not start an automatic retry. Retry may be disabled, exhausted, or incompatible; submit the message again to retry manually.";
 // Reduces, but cannot eliminate, the hang when an aborted provider operation never terminates;
 // undici's headersTimeout/bodyTimeout stay the backstop past this point.
@@ -157,6 +181,16 @@ export function createProviderStallWatchdog(runtime: WatchdogRuntime = defaultRu
 		let stallRetriesUsed = 0;
 		let continuationStarted = false;
 		let convertedTimeout = false;
+		let redrivePending = false;
+		let redriveResolve: ((fired: boolean) => void) | undefined;
+		let exhaustedAbortGeneration: number | undefined;
+		let redriveEligible = false;
+		let redriveDelay = 0;
+		let redriveTimer: unknown;
+		let statusTimer: unknown;
+		let redriveInFlight = false;
+		let removeTerminalInput: (() => void) | undefined;
+		let statusUI: { setStatus(key: string, text: string | undefined): void } | undefined;
 
 		const clearTimers = () => {
 			for (const key of ["firstEvent", "warning", "recovery", "abortGuard"] as const) {
@@ -175,7 +209,24 @@ export function createProviderStallWatchdog(runtime: WatchdogRuntime = defaultRu
 			activeGeneration = undefined;
 		};
 		const disarm = () => { clear(); warned = false; };
+		const cancelRedrive = () => {
+			if (redriveTimer !== undefined) runtime.clearTimeout(redriveTimer);
+			redriveTimer = undefined;
+			redriveResolve?.(false);
+			redriveResolve = undefined;
+			if (statusTimer !== undefined) runtime.clearTimeout(statusTimer);
+			statusTimer = undefined;
+			statusUI?.setStatus(STATUS_KEY, undefined);
+			statusUI = undefined;
+			removeTerminalInput?.();
+			removeTerminalInput = undefined;
+		};
 		const resetRunState = () => {
+			cancelRedrive();
+			redrivePending = false;
+			exhaustedAbortGeneration = undefined;
+			redriveEligible = false;
+			redriveInFlight = false;
 			disarm();
 			activeRun = false;
 			stallRetriesUsed = 0;
@@ -217,6 +268,7 @@ export function createProviderStallWatchdog(runtime: WatchdogRuntime = defaultRu
 			// the generation check makes the callback a no-op if that teardown disarmed the watchdog.
 			armAbortGuard(capturedGeneration);
 			if (stallRetriesUsed >= config.maxStallRetries) {
+				exhaustedAbortGeneration = capturedGeneration;
 				announce(notices.exhausted());
 				ctx.abort();
 				return;
@@ -274,6 +326,11 @@ export function createProviderStallWatchdog(runtime: WatchdogRuntime = defaultRu
 		};
 
 		pi.on("before_provider_request", (_event, ctx) => {
+			if (redriveTimer !== undefined) resetRunState();
+			if (redriveInFlight) {
+				redriveInFlight = false;
+				continuationStarted = true;
+			} else if (convertedTimeout) continuationStarted = true;
 			if (disabled) return;
 			ui = ctx.ui;
 			hasUI = ctx.hasUI;
@@ -289,7 +346,6 @@ export function createProviderStallWatchdog(runtime: WatchdogRuntime = defaultRu
 			activeRun = config.enabled;
 			if (!activeRun) return;
 			disarm();
-			if (convertedTimeout) continuationStarted = true;
 			activeGeneration = ++generation;
 			lastSemanticAt = runtime.now();
 			const target = ctx.signal;
@@ -338,17 +394,67 @@ export function createProviderStallWatchdog(runtime: WatchdogRuntime = defaultRu
 				&& activeGeneration === watchdogAbortedGeneration;
 			disarm();
 			// Mirror Pi's retry loop, which resets its attempt counter on any successful assistant turn.
-			if (event.message.stopReason !== "aborted" && event.message.stopReason !== "error") stallRetriesUsed = 0;
+			if (event.message.stopReason !== "aborted" && event.message.stopReason !== "error") { stallRetriesUsed = 0; convertedTimeout = false; redrivePending = false; redriveEligible = false; }
 			if (!matchesWatchdogAbort) return;
 			convertedTimeout = true;
+			redrivePending = true;
+			redriveEligible = false;
 			continuationStarted = false;
 			return { message: { ...event.message, stopReason: "error", errorMessage } };
 		});
+		pi.on("turn_end", (event, ctx) => {
+			// The converted generation is watchdogAbortedGeneration until this turn ends.
+			if (!redrivePending) return;
+			redrivePending = false;
+			const settings = resolveRetrySettings(ctx.cwd);
+			redriveEligible = settings.enabled;
+			if (!redriveEligible) return;
+			redriveDelay = redriveDelayMs(settings, stallRetriesUsed);
+			return { entries: [...event.entries, { type: "context_edit" as const, targetId: event.messageEntryId, replacement: null }] };
+		});
+		// Re-drive exists because pi >= 0.86 fences the whole run on session abort; delete it once pi offers a request-scoped abort.
+		const sendRedrive = () => {
+			cancelRedrive();
+			redriveInFlight = true;
+			redriveEligible = false;
+			try { pi.sendMessage({ customType: "provider-stall-watchdog", content: REDRIVE_TEXT, display: false }, { triggerTurn: true }); }
+			catch (error) { resetRunState(); announce(`providerStallWatchdog: automatic retry failed to start: ${error instanceof Error ? error.message : String(error)}`, "error"); }
+		};
+		const awaitRedriveDelay = () => new Promise<boolean>((resolve) => {
+			redriveResolve = resolve;
+			redriveTimer = runtime.setTimeout(() => { redriveTimer = undefined; redriveResolve = undefined; resolve(true); }, redriveDelay);
+		});
+		const armRedrive = (ctx: { ui: { setStatus(key: string, text: string | undefined): void; onTerminalInput(handler: (data: string) => any): () => void } }) => {
+			statusUI = ctx.ui;
+			const deadline = runtime.now() + redriveDelay;
+			const tick = () => {
+				if (redriveTimer === undefined || !config) return;
+				ctx.ui.setStatus(STATUS_KEY, `Retrying (${stallRetriesUsed}/${config.maxStallRetries}) in ${Math.ceil(Math.max(0, deadline - runtime.now()) / 1000)}s... (Esc to cancel)`);
+				if (deadline - runtime.now() > 1000) statusTimer = runtime.setTimeout(tick, 1000);
+			};
+			redriveTimer = runtime.setTimeout(sendRedrive, redriveDelay);
+			removeTerminalInput = ctx.ui.onTerminalInput((data) => {
+				if (data !== "\x1b") return;
+				resetRunState(); announce(RETRY_CANCELLED_NOTICE);
+				return { consume: true };
+			});
+			tick();
+		};
 		pi.on("agent_end", () => disarm());
-		pi.on("agent_settled", () => {
-			if (convertedTimeout && !continuationStarted) announce(DEGRADATION_NOTICE);
+		pi.on("agent_settled", async (_event, ctx) => {
+			if (exhaustedAbortGeneration !== undefined && exhaustedAbortGeneration === watchdogAbortedGeneration) { announce(DEGRADATION_NOTICE); resetRunState(); return; }
+			if (convertedTimeout && continuationStarted) { resetRunState(); return; }
+			if (convertedTimeout && !redriveEligible) { announce(DEGRADATION_NOTICE); resetRunState(); return; }
+			if (redriveEligible) {
+				if (ctx.mode === "tui" || ctx.mode === "rpc") armRedrive(ctx);
+				else { if (await awaitRedriveDelay()) sendRedrive(); }
+				return;
+			}
 			resetRunState();
 		});
+		pi.on("input", () => { if (redriveTimer !== undefined || redriveInFlight) resetRunState(); });
+		pi.on("session_before_tree", () => { if (redriveTimer !== undefined) resetRunState(); });
+		pi.on("session_before_compact", () => { if (redriveTimer !== undefined) resetRunState(); });
 		pi.on("session_shutdown", () => {
 			resetRunState();
 			config = undefined;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-quiver",
-  "version": "6.3.0",
+  "version": "6.3.1",
   "description": "Personal pack of Pi coding-agent extensions: context-safe fetch, doc_to_md PDF/DOCX/PPTX-to-Markdown conversion, session naming, a themed ASCII startup header, Opus 4.8 fast mode, and a provider-stall watchdog.",
   "author": "Jacek Juraszek",
   "license": "MIT",
@@ -87,9 +87,9 @@
     "unpdf": "^1.8.1"
   },
   "devDependencies": {
-    "@earendil-works/pi-ai": "^0.84.2",
-    "@earendil-works/pi-coding-agent": "^0.84.2",
-    "@earendil-works/pi-tui": "^0.84.2",
+    "@earendil-works/pi-ai": "^0.87.1",
+    "@earendil-works/pi-coding-agent": "^0.87.1",
+    "@earendil-works/pi-tui": "^0.87.1",
     "@sinclair/typebox": "^0.34.49",
     "@types/jsdom": "^28.0.3",
     "@types/node": "^26.1.0",