pi-quiver 6.3.0 → 6.4.0

package/CHANGELOG.md

@@ -8,6 +8,14 @@ Published to npm as `pi-quiver` (`pi install npm:pi-quiver`). Pushing a
 via OIDC trusted publishing. The release helper at
 `.agents/skills/release/scripts/release.sh` cuts the tag; CI publishes.
 
+## v6.4.0 - 2026-09-28
+
+- provider-stall-watchdog: per-model threshold overrides via a `models` map on `quiver.providerStallWatchdog` - glob keys like `lmstudio/*` override `firstEventMs`/`warningMs`/`recoveryMs` for matching models, so slow local servers get patience without raising the global defaults (#18).
+
+## v6.3.1 - 2026-09-25
+
+- `provider-stall-watchdog` recovers again on pi >= 0.86 ([#23](https://github.com/jjuraszek/pi-quiver/issues/23)): pi's session abort now fences the run so its retry loop never runs after a watchdog abort; the watchdog omits the aborted attempt from the model's context at `turn_end` and re-drives the request itself via a hidden custom message after pi's backoff, honoring pi's `retry.enabled` / `retry.baseDelayMs` / `retry.maxAgentDelayMs` live and the existing `maxStallRetries` cap. Print/json await the backoff; TUI/RPC show `Retrying (n/m) in Ns... (Esc to cancel)` in the status bar on the timer path. In TUI, Esc, a new prompt, a tree switch, or compaction cancels the pending retry; RPC cancels on a new prompt, not Esc. Behavior guide: `doc/provider-stall-watchdog.md`. Dev dependencies on `@earendil-works/*` move to `^0.87.1`.
+
 ## v6.3.0 - 2026-09-16
 
 - `session-name` Herdr sink claims any numeric tab label (optionally behind one `* `) at any position instead of only the label equal to the tab's live position, so tabs reordered before the first auto-name - or after a `/new` restore - get named; the claim resets at every `session_start` (`/new`, resume, fork behave like a fresh process) and a tab that reverts to a bare number is re-claimed on the next turn. The extension never writes a digits-only label (`1234` -> `#1234`) and the naming prompt asks for `PR 1234` / `issue 123` / `ticket ABC-123` over a bare ID.

package/README.md

@@ -69,7 +69,7 @@ A 300 KB changelog page never touches your context window - you get a preview an
 | `extensions/session-name.ts` | `/session-name` | Manual + opt-in automatic session naming, naming rules and deny list, long-session revisits, and Ghostty/Herdr tab rename. OFF by default. |
 | `extensions/sword-header.ts` | `/builtin-header` | Themed ASCII startup header replacing pi's default logo. OFF by default. |
 | `extensions/fast-mode.ts` | `/fast` | Inject Anthropic fast-mode (`speed: "fast"` + `anthropic-beta: fast-mode-2026-02-01`) into every Claude Opus 4.8 / Opus 5 request, any thinking level. `--fast` flag + `/fast [on\|off\|status]`. OFF by default. |
-| `extensions/provider-stall-watchdog.ts` | - | Opt-in provider-stall recovery, in two tiers: a pre-first-event deadline (`firstEventMs`, 20s) on every provider request in every mode, and the mid-stream pair (warn at 2 min, recover at 4 min) in TUI runs only. Policy D offers each stall to Pi's retry loop until the stall retry budget (`maxStallRetries`, default = `retry.maxRetries`) is exhausted. OFF by default. |
+| `extensions/provider-stall-watchdog.ts` | - | Opt-in provider-stall recovery, in two tiers: a pre-first-event deadline (`firstEventMs`, 20s) on every provider request in every mode, and the mid-stream pair (warn at 2 min, recover at 4 min) in TUI runs only. Each stall is aborted; while pi's `retry.enabled` is true and the stall retry budget (`maxStallRetries`, default = `retry.maxRetries`) remains, its aborted attempt is hidden from the model and re-driven by the watchdog after pi's backoff; behavior guide: [doc/provider-stall-watchdog.md](doc/provider-stall-watchdog.md). OFF by default. |
 | `extensions/slack.ts` | `slack_search`, `slack_thread`, `slack_post`, `slack_update`, `slack_delete`, `slack_pin`, `slack_upload`, `slack_cache_refresh` | Context-safe Slack search/threads/posting with dual `user`/`bot` token identities, Block Kit flattening and optional raw JSON output for threads, a workspace-keyed channel/user name->ID cache, DM targets by `@name` / user ID, fetch-style output size gating, and a transactional headline+detail-thread announce protocol with a documented recovery path. OFF by default. Behavior lives in `lib/slack-core.ts` and `lib/slack-cache.ts`. |
 
 Full routing rules, size-gate mechanics, and config: [doc/fetch.md](doc/fetch.md), [doc/doc-to-md.md](doc/doc-to-md.md), [doc/slack.md](doc/slack.md).
@@ -186,7 +186,7 @@ a new setting is registered there or it warns as unknown.
 ```text
 Warning: pi-quiver settings (/Users/x/.pi/agent/settings.json): unknown or misplaced keys - unknown ones fall back to defaults
   "providerStallWatchdog" at top level - move under "quiver"
-  "quiver.providerStallWatchdog.timeoutMs" - unknown; accepted: enabled, firstEventMs, warningMs, recoveryMs, maxStallRetries
+  "quiver.providerStallWatchdog.timeoutMs" - unknown; accepted: enabled, firstEventMs, warningMs, recoveryMs, maxStallRetries, models
 ```
 
 Worked mixed-shape example: global `settings.json` has flat
@@ -218,7 +218,10 @@ not a pi-quiver setting and is never nested):
       "firstEventMs": 20000,
       "warningMs": 120000,
       "recoveryMs": 240000,
-      "maxStallRetries": 3
+      "maxStallRetries": 3,
+      "models": {
+        "lmstudio/*": { "firstEventMs": 600000, "recoveryMs": 600000 }
+      }
     }
   },
   "retry": {
@@ -236,21 +239,24 @@ not a pi-quiver setting and is never nested):
 | `warningMs` | `120000` | mid-stream, `ctx.mode === "tui"` only | Silence since the last non-empty text/thinking/toolcall delta; notifies. |
 | `recoveryMs` | `240000` | mid-stream, `ctx.mode === "tui"` only | Same clock; aborts and converts. Must be `> warningMs`. |
 | `maxStallRetries` | layered `retry.maxRetries`, else `3` | shared by both tiers | Watchdog aborts that may convert to a retryable error before stopping. |
+| `models` | `{}` | per-model overrides of the three thresholds | Glob keys match `provider/model` (case-insensitive, `*` matches any run of characters, first match wins); each entry may override `firstEventMs`, `warningMs`, and/or `recoveryMs`. |
 
 `providerStallWatchdog` is OFF by default. Once enabled it arms in two tiers per provider request:
 
-- **Pre-first-event (`firstEventMs`).** Armed at every provider request, in every mode and from every origin - including extension-triggered turns that never emit `before_agent_start` - and cleared by the first assistant `message_start`. On expiry the request is aborted and, budget permitting, converted to a retryable error, so an unresponsive request recovers in ~22s (20s detection + Pi's 2s backoff) instead of the ~240s it took when only the mid-stream tier existed.
+- **Pre-first-event (`firstEventMs`).** Armed at every provider request, in every mode and from every origin - including extension-triggered turns that never emit `before_agent_start` - and cleared by the first assistant `message_start`. On expiry the request is aborted and, budget permitting, converted to a retryable error and re-driven after pi's backoff when `retry.enabled` is true, so an unresponsive request recovers in ~22s (20s detection + 2s backoff) instead of the ~240s it took when only the mid-stream tier existed.
 - **Mid-stream (`warningMs` / `recoveryMs`).** Armed from the first assistant `message_start` onward, and only when `ctx.mode === "tui"`. Aborting mid-generation discards billed output tokens and an unattended run has nobody to read the warning, so headless mid-stream silence deliberately falls through to the transport timeout instead.
 
-**Raise `firstEventMs` if your provider is legitimately slow to first event.** Queueing gateways, throttled endpoints, and busy single-slot local model servers can hold the connection for well over 20s before their first stream event; every false abort re-uploads the whole context and spends one stall retry.
+`models` retunes the three thresholds per model. A request's effective thresholds are the base knobs overlaid with the first entry whose glob matches its `provider/model` label - `"lmstudio/*"` covers a whole local server, `"openai/gpt-5.4"` one remote model. An override that would leave the merged `warningMs >= recoveryMs` is invalid and fails closed at startup like any other invalid watchdog config.
+
+**Raise `firstEventMs` if your provider is legitimately slow to first event** - per model via `models` when only one provider is slow. Queueing gateways, throttled endpoints, and busy single-slot local model servers can hold the connection for well over 20s before their first stream event; every false abort re-uploads the whole context and spends one stall retry.
 
 **Leave pi's own `httpIdleTimeoutMs` (default `300000`) at its default.** It is the transport backstop, and a single value drives undici's `headersTimeout` *and* `bodyTimeout` - lowering it to get fast pre-stream failure also truncates legitimate mid-stream gaps. `firstEventMs` is the knob for pre-stream silence.
 
-Verified with Pi 0.80.10: each stall is aborted and offered to Pi retry until `maxStallRetries` conversions are used; further stalls stop for manual resubmission. Both tiers draw on that one budget. `maxStallRetries` defaults to the layered `retry.maxRetries` (Pi default 3, an explicit `0` honoured); `0` is valid and means "detect and stop, never auto-retry". Consecutive stall conversions consume Pi retry attempts without a success reset in between, so keep `maxStallRetries <= retry.maxRetries`. A successful assistant turn resets the stall counter (mirroring Pi's own retry counter). Automatic continuation needs enabled Pi retry with remaining capacity. Disabled, exhausted, or incompatible retry degrades to manual resubmission. Pending steering or follow-ups return to the editor and are excluded from automatic continuation. Invalid merged watchdog config fails closed.
+Verified with Pi 0.87.1: each eligible stall is aborted, its message omitted from the model's context, and the request re-driven by the watchdog after pi's backoff (`retry.baseDelayMs`, capped at `retry.maxAgentDelayMs`) until `maxStallRetries` conversions are used; further stalls stop for manual resubmission. Both tiers draw on that one budget. `maxStallRetries` defaults to the layered `retry.maxRetries` (Pi default 3, an explicit `0` honoured); `0` is valid and means "detect and stop, never auto-retry". A successful assistant turn resets the stall counter (mirroring Pi's own retry counter). pi's `retry.enabled: false` disables the re-drive and degrades to manual resubmission without omitting the aborted message. Pending steering or follow-ups return to the editor and are excluded from automatic continuation. Invalid merged watchdog config fails closed. Print/json await pi's backoff before re-driving; TUI/RPC show a timer-path countdown that a new prompt cancels. Why the watchdog re-drives instead of pi, the hidden re-drive message, and the wait behavior: [doc/provider-stall-watchdog.md](doc/provider-stall-watchdog.md).
 
 Operational notes:
 
-- **Settings are read once per session,** on the first provider request. Editing `settings.json` mid-session changes nothing until you restart the session - that includes repairing an invalid block that already disabled the extension.
+- **Settings are read once per session,** on the first provider request. Editing watchdog settings in `settings.json` mid-session changes nothing until you restart the session - that includes repairing an invalid block that already disabled the extension. The exception is pi's `retry.enabled`, `retry.baseDelayMs`, and `retry.maxAgentDelayMs`, which the re-drive reads live at each stall.
 - **A watchdog abort that the provider ignores escalates after a fixed 10s.** Any post-abort stream event re-arms that deadline (bytes prove only that the connection was alive at that instant), so a stream that emits a straggler and then wedges still escalates 10s after its last event. This reduces the hang; it cannot force the provider to stop, and undici's timeouts remain the final backstop.
 - **Headless runs report on stderr.** In `print`/`json` mode pi binds a no-op UI, so watchdog notices go out via `console.warn`. Nothing is ever written to stdout, which `json` mode uses for its protocol. In TUI and RPC the notices render as main-window notifications, not the bottom status line.
 

package/extensions/fast-mode.ts

@@ -28,7 +28,7 @@
  */
 
 import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
-import type { Context, Model, StreamOptions, Usage } from "@earendil-works/pi-ai";
+import type { Context, Model, StreamOptions, TranscriptContext, Usage } from "@earendil-works/pi-ai";
 import { resolveConfig } from "../lib/extension-config.ts";
 
 export const FAST_MODE_BETA = "fast-mode-2026-02-01";
@@ -163,7 +163,7 @@ export async function probePiBetaHeader(
 	};
 	try {
 		const { anthropicMessagesApi } = await import("@earendil-works/pi-ai/compat");
-		const stream = anthropicMessagesApi().stream(model, PROBE_CONTEXT, options);
+		const stream = anthropicMessagesApi().stream(model, PROBE_CONTEXT as TranscriptContext, options);
 		await stream.result().catch(() => {});
 	} catch {
 		return captured;

package/extensions/provider-stall-watchdog.ts

@@ -7,14 +7,20 @@ export const DEFAULT_CONFIG = {
 	firstEventMs: 20_000,
 	warningMs: 120_000,
 	recoveryMs: 240_000,
+	models: {},
 } as const;
 
-export type WatchdogConfig = {
-	enabled: boolean;
+export type WatchdogThresholds = {
 	firstEventMs: number;
 	warningMs: number;
 	recoveryMs: number;
+};
+
+export type WatchdogConfig = WatchdogThresholds & {
+	enabled: boolean;
 	maxStallRetries: number;
+	/** Per-model threshold overrides keyed by glob; see thresholdsFor. */
+	models: Record<string, Partial<WatchdogThresholds>>;
 };
 
 export type WatchdogRuntime = {
@@ -30,6 +36,7 @@ export type ConfigCandidate = {
 	warningMs?: unknown;
 	recoveryMs?: unknown;
 	maxStallRetries?: unknown;
+	models?: unknown;
 };
 
 export type ConfigValidation =
@@ -45,12 +52,17 @@ export function coerce(raw: unknown): ConfigCandidate | undefined {
 
 	const source = raw as Record<string, unknown>;
 	const candidate: ConfigCandidate = { blockIsObject: true };
-	for (const key of ["enabled", "firstEventMs", "warningMs", "recoveryMs", "maxStallRetries"] as const) {
+	for (const key of ["enabled", "firstEventMs", "warningMs", "recoveryMs", "maxStallRetries", "models"] as const) {
 		if (Object.hasOwn(source, key)) candidate[key] = source[key];
 	}
 	return candidate;
 }
 
+const THRESHOLD_KEYS = ["firstEventMs", "warningMs", "recoveryMs"] as const;
+
+const isRecord = (value: unknown): value is Record<string, unknown> =>
+	value !== null && typeof value === "object" && !Array.isArray(value);
+
 export function validateConfig(candidate: ConfigCandidate): ConfigValidation {
 	if (candidate.blockIsObject !== true) return { ok: false, error: "providerStallWatchdog must be an object" };
 	if (typeof candidate.enabled !== "boolean") return { ok: false, error: "enabled must be a boolean" };
@@ -59,6 +71,21 @@ export function validateConfig(candidate: ConfigCandidate): ConfigValidation {
 	if (!isTimerDelay(candidate.recoveryMs)) return { ok: false, error: "recoveryMs must be a positive timer delay" };
 	if (candidate.warningMs >= candidate.recoveryMs) return { ok: false, error: "warningMs must be less than recoveryMs" };
 	if (!isNonNegativeInteger(candidate.maxStallRetries)) return { ok: false, error: "maxStallRetries must be a non-negative integer" };
+	if (!isRecord(candidate.models)) return { ok: false, error: "models must be an object" };
+	for (const [pattern, override] of Object.entries(candidate.models)) {
+		if (!isRecord(override)) return { ok: false, error: `models["${pattern}"] must be an object` };
+		for (const key of Object.keys(override)) {
+			if (!(THRESHOLD_KEYS as readonly string[]).includes(key)) {
+				return { ok: false, error: `models["${pattern}"] has unknown key "${key}"; accepted: ${THRESHOLD_KEYS.join(", ")}` };
+			}
+			if (!isTimerDelay(override[key])) return { ok: false, error: `models["${pattern}"].${key} must be a positive timer delay` };
+		}
+		const mergedWarning = (override.warningMs ?? candidate.warningMs) as number;
+		const mergedRecovery = (override.recoveryMs ?? candidate.recoveryMs) as number;
+		if (mergedWarning >= mergedRecovery) {
+			return { ok: false, error: `models["${pattern}"] leaves warningMs (${mergedWarning}) >= recoveryMs (${mergedRecovery})` };
+		}
+	}
 	return {
 		ok: true,
 		config: {
@@ -67,6 +94,7 @@ export function validateConfig(candidate: ConfigCandidate): ConfigValidation {
 			warningMs: candidate.warningMs,
 			recoveryMs: candidate.recoveryMs,
 			maxStallRetries: candidate.maxStallRetries,
+			models: candidate.models as Record<string, Partial<WatchdogThresholds>>,
 		},
 	};
 }
@@ -91,6 +119,27 @@ export function resolveRetryMaxRetries(cwd: string): number {
 	return maxRetries;
 }
 
+export type RetrySettings = { enabled: boolean; baseDelayMs: number; maxAgentDelayMs: number };
+
+export function resolveRetrySettings(cwd: string): RetrySettings {
+	const settings: RetrySettings = { enabled: true, baseDelayMs: 2_000, maxAgentDelayMs: 60_000 };
+	for (const path of settingsPaths(cwd)) {
+		const retry = readSettings(path)?.retry;
+		if (retry === null || typeof retry !== "object" || Array.isArray(retry)) continue;
+		const source = retry as Record<string, unknown>;
+		if (typeof source.enabled === "boolean") settings.enabled = source.enabled;
+		if (isNonNegativeInteger(source.baseDelayMs)) settings.baseDelayMs = source.baseDelayMs;
+		if (isNonNegativeInteger(source.maxAgentDelayMs)) settings.maxAgentDelayMs = source.maxAgentDelayMs;
+	}
+	return settings;
+}
+
+export function redriveDelayMs(settings: Pick<RetrySettings, "baseDelayMs" | "maxAgentDelayMs">, attempt: number): number {
+	const delay = settings.baseDelayMs * 2 ** Math.max(0, attempt - 1);
+	const safeDelay = Number.isSafeInteger(delay) ? delay : Number.MAX_SAFE_INTEGER;
+	return Math.min(safeDelay, settings.maxAgentDelayMs, MAX_TIMER_MS);
+}
+
 export function resolveWatchdogConfig(cwd: string, warn?: (msg: string) => void): ConfigValidation {
 	const candidate = resolveConfig(cwd, "providerStallWatchdog", DEFAULT_CANDIDATE, coerce, warn);
 	if (candidate.blockIsObject === true && candidate.maxStallRetries === undefined) {
@@ -105,6 +154,9 @@ const defaultRuntime: WatchdogRuntime = {
 	clearTimeout: (handle) => clearTimeout(handle as ReturnType<typeof setTimeout>),
 };
 
+const REDRIVE_TEXT = "The previous provider request stalled before completing and was retried automatically. Continue.";
+const RETRY_CANCELLED_NOTICE = "Automatic retry cancelled; submit the message again to retry manually.";
+const STATUS_KEY = "providerStallWatchdog";
 const DEGRADATION_NOTICE = "The stalled request was stopped, but Pi did not start an automatic retry. Retry may be disabled, exhausted, or incompatible; submit the message again to retry manually.";
 // Reduces, but cannot eliminate, the hang when an aborted provider operation never terminates;
 // undici's headersTimeout/bodyTimeout stay the backstop past this point.
@@ -120,20 +172,41 @@ function formatElapsed(ms: number): string {
 
 const ABORT_STUCK_NOTICE = `The stalled request did not stop within ${formatElapsed(ABORT_GRACE_MS)} of being aborted; the provider connection is unresponsive. No automatic retry will run - the turn will not end until the HTTP idle timeout expires.`;
 
-function warningNotice(config: WatchdogConfig): string {
-	return `No model progress for ${formatElapsed(config.warningMs)}; aborting and asking Pi to retry in ${formatElapsed(config.recoveryMs - config.warningMs)} (Esc aborts now)`;
+function warningNotice(thresholds: WatchdogThresholds): string {
+	return `No model progress for ${formatElapsed(thresholds.warningMs)}; aborting and asking Pi to retry in ${formatElapsed(thresholds.recoveryMs - thresholds.warningMs)} (Esc aborts now)`;
 }
 
 function exhaustedNotice(config: WatchdogConfig): string {
 	return `Stall retry budget (${config.maxStallRetries}) exhausted; aborting without another automatic retry. Submit the message again manually.`;
 }
 
-function firstEventRetryNotice(config: WatchdogConfig): string {
-	return `Provider sent no response for ${formatElapsed(config.firstEventMs)}; stopping and retrying the request.`;
+function firstEventRetryNotice(thresholds: WatchdogThresholds): string {
+	return `Provider sent no response for ${formatElapsed(thresholds.firstEventMs)}; stopping and retrying the request.`;
+}
+
+function firstEventExhaustedNotice(thresholds: WatchdogThresholds): string {
+	return `Provider sent no response for ${formatElapsed(thresholds.firstEventMs)} and the stall-retry budget is spent; the request was stopped.`;
 }
 
-function firstEventExhaustedNotice(config: WatchdogConfig): string {
-	return `Provider sent no response for ${formatElapsed(config.firstEventMs)} and the stall-retry budget is spent; the request was stopped.`;
+/** A glob where `*` matches any run of characters; matching is case-insensitive. */
+function modelPattern(pattern: string): RegExp {
+	const source = pattern.split("*").map((part) => part.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join(".*");
+	return new RegExp(`^${source}$`, "i");
+}
+
+/**
+ * Effective thresholds for one request: the base knobs overlaid with the
+ * first `models` entry whose glob matches the request's `provider/model`
+ * label. First match wins; later entries for the same model are ignored.
+ */
+export function thresholdsFor(config: WatchdogConfig, model: { provider: string; id: string } | undefined): WatchdogThresholds {
+	const base: WatchdogThresholds = { firstEventMs: config.firstEventMs, warningMs: config.warningMs, recoveryMs: config.recoveryMs };
+	if (model === undefined) return base;
+	const label = `${model.provider}/${model.id}`;
+	for (const [pattern, override] of Object.entries(config.models)) {
+		if (modelPattern(pattern).test(label)) return { ...base, ...override };
+	}
+	return base;
 }
 
 export function createProviderStallWatchdog(runtime: WatchdogRuntime = defaultRuntime): (pi: ExtensionAPI) => void {
@@ -147,6 +220,7 @@ export function createProviderStallWatchdog(runtime: WatchdogRuntime = defaultRu
 		let config: WatchdogConfig | undefined;
 		let generation = 0;
 		let activeGeneration: number | undefined;
+		let activeModel: { provider: string; id: string } | undefined;
 		let lastSemanticAt = 0;
 		let warned = false;
 		let deadlineEpoch = 0;
@@ -157,6 +231,16 @@ export function createProviderStallWatchdog(runtime: WatchdogRuntime = defaultRu
 		let stallRetriesUsed = 0;
 		let continuationStarted = false;
 		let convertedTimeout = false;
+		let redrivePending = false;
+		let redriveResolve: ((fired: boolean) => void) | undefined;
+		let exhaustedAbortGeneration: number | undefined;
+		let redriveEligible = false;
+		let redriveDelay = 0;
+		let redriveTimer: unknown;
+		let statusTimer: unknown;
+		let redriveInFlight = false;
+		let removeTerminalInput: (() => void) | undefined;
+		let statusUI: { setStatus(key: string, text: string | undefined): void } | undefined;
 
 		const clearTimers = () => {
 			for (const key of ["firstEvent", "warning", "recovery", "abortGuard"] as const) {
@@ -175,7 +259,24 @@ export function createProviderStallWatchdog(runtime: WatchdogRuntime = defaultRu
 			activeGeneration = undefined;
 		};
 		const disarm = () => { clear(); warned = false; };
+		const cancelRedrive = () => {
+			if (redriveTimer !== undefined) runtime.clearTimeout(redriveTimer);
+			redriveTimer = undefined;
+			redriveResolve?.(false);
+			redriveResolve = undefined;
+			if (statusTimer !== undefined) runtime.clearTimeout(statusTimer);
+			statusTimer = undefined;
+			statusUI?.setStatus(STATUS_KEY, undefined);
+			statusUI = undefined;
+			removeTerminalInput?.();
+			removeTerminalInput = undefined;
+		};
 		const resetRunState = () => {
+			cancelRedrive();
+			redrivePending = false;
+			exhaustedAbortGeneration = undefined;
+			redriveEligible = false;
+			redriveInFlight = false;
 			disarm();
 			activeRun = false;
 			stallRetriesUsed = 0;
@@ -217,6 +318,7 @@ export function createProviderStallWatchdog(runtime: WatchdogRuntime = defaultRu
 			// the generation check makes the callback a no-op if that teardown disarmed the watchdog.
 			armAbortGuard(capturedGeneration);
 			if (stallRetriesUsed >= config.maxStallRetries) {
+				exhaustedAbortGeneration = capturedGeneration;
 				announce(notices.exhausted());
 				ctx.abort();
 				return;
@@ -229,9 +331,10 @@ export function createProviderStallWatchdog(runtime: WatchdogRuntime = defaultRu
 		const armFirstEvent = (ctx: { abort(): void }) => {
 			if (activeGeneration === undefined || !config) return;
 			const cfg = config;
+			const thresholds = thresholdsFor(cfg, activeModel);
 			const capturedGeneration = activeGeneration;
 			const capturedDeadlineEpoch = ++deadlineEpoch;
-			const threshold = cfg.firstEventMs;
+			const threshold = thresholds.firstEventMs;
 			const run = () => {
 				if (capturedGeneration !== activeGeneration || capturedDeadlineEpoch !== deadlineEpoch || !activeRun || firstEventSeen) return;
 				const elapsed = runtime.now() - lastSemanticAt;
@@ -240,15 +343,16 @@ export function createProviderStallWatchdog(runtime: WatchdogRuntime = defaultRu
 					return;
 				}
 				abortStall(ctx, capturedGeneration, {
-					retry: () => firstEventRetryNotice(cfg),
-					exhausted: () => firstEventExhaustedNotice(cfg),
-				}, `Provider first-event timeout after ${cfg.firstEventMs} ms without a stream event`);
+					retry: () => firstEventRetryNotice(thresholds),
+					exhausted: () => firstEventExhaustedNotice(thresholds),
+				}, `Provider first-event timeout after ${thresholds.firstEventMs} ms without a stream event`);
 			};
 			timers.firstEvent = runtime.setTimeout(run, threshold);
 		};
 		const schedule = (ctx: { abort(): void }) => {
 			if (activeGeneration === undefined || !config) return;
 			const cfg = config;
+			const thresholds = thresholdsFor(cfg, activeModel);
 			const capturedGeneration = activeGeneration;
 			const capturedDeadlineEpoch = ++deadlineEpoch;
 			const run = (kind: "warning" | "recovery", threshold: number) => () => {
@@ -260,20 +364,25 @@ export function createProviderStallWatchdog(runtime: WatchdogRuntime = defaultRu
 				}
 				if (kind === "warning" && !warned) {
 					warned = true;
-					announce(warningNotice(cfg), "warning");
+					announce(warningNotice(thresholds), "warning");
 				}
 				if (kind === "recovery") {
 					abortStall(ctx, capturedGeneration, {
 						retry: () => `No model progress for ${formatElapsed(elapsed)}; aborting now. Pi will retry (${stallRetriesUsed}/${cfg.maxStallRetries}) if retry is enabled and capacity remains. Pending follow-ups are returned to the editor.`,
 						exhausted: () => exhaustedNotice(cfg),
-					}, `Provider semantic timeout after ${cfg.recoveryMs} ms without progress`);
+					}, `Provider semantic timeout after ${thresholds.recoveryMs} ms without progress`);
 				}
 			};
-			timers.warning = runtime.setTimeout(run("warning", cfg.warningMs), cfg.warningMs);
-			timers.recovery = runtime.setTimeout(run("recovery", cfg.recoveryMs), cfg.recoveryMs);
+			timers.warning = runtime.setTimeout(run("warning", thresholds.warningMs), thresholds.warningMs);
+			timers.recovery = runtime.setTimeout(run("recovery", thresholds.recoveryMs), thresholds.recoveryMs);
 		};
 
 		pi.on("before_provider_request", (_event, ctx) => {
+			if (redriveTimer !== undefined) resetRunState();
+			if (redriveInFlight) {
+				redriveInFlight = false;
+				continuationStarted = true;
+			} else if (convertedTimeout) continuationStarted = true;
 			if (disabled) return;
 			ui = ctx.ui;
 			hasUI = ctx.hasUI;
@@ -289,8 +398,8 @@ export function createProviderStallWatchdog(runtime: WatchdogRuntime = defaultRu
 			activeRun = config.enabled;
 			if (!activeRun) return;
 			disarm();
-			if (convertedTimeout) continuationStarted = true;
 			activeGeneration = ++generation;
+			activeModel = ctx.model;
 			lastSemanticAt = runtime.now();
 			const target = ctx.signal;
 			if (target) {
@@ -338,17 +447,67 @@ export function createProviderStallWatchdog(runtime: WatchdogRuntime = defaultRu
 				&& activeGeneration === watchdogAbortedGeneration;
 			disarm();
 			// Mirror Pi's retry loop, which resets its attempt counter on any successful assistant turn.
-			if (event.message.stopReason !== "aborted" && event.message.stopReason !== "error") stallRetriesUsed = 0;
+			if (event.message.stopReason !== "aborted" && event.message.stopReason !== "error") { stallRetriesUsed = 0; convertedTimeout = false; redrivePending = false; redriveEligible = false; }
 			if (!matchesWatchdogAbort) return;
 			convertedTimeout = true;
+			redrivePending = true;
+			redriveEligible = false;
 			continuationStarted = false;
 			return { message: { ...event.message, stopReason: "error", errorMessage } };
 		});
+		pi.on("turn_end", (event, ctx) => {
+			// The converted generation is watchdogAbortedGeneration until this turn ends.
+			if (!redrivePending) return;
+			redrivePending = false;
+			const settings = resolveRetrySettings(ctx.cwd);
+			redriveEligible = settings.enabled;
+			if (!redriveEligible) return;
+			redriveDelay = redriveDelayMs(settings, stallRetriesUsed);
+			return { entries: [...event.entries, { type: "context_edit" as const, targetId: event.messageEntryId, replacement: null }] };
+		});
+		// Re-drive exists because pi >= 0.86 fences the whole run on session abort; delete it once pi offers a request-scoped abort.
+		const sendRedrive = () => {
+			cancelRedrive();
+			redriveInFlight = true;
+			redriveEligible = false;
+			try { pi.sendMessage({ customType: "provider-stall-watchdog", content: REDRIVE_TEXT, display: false }, { triggerTurn: true }); }
+			catch (error) { resetRunState(); announce(`providerStallWatchdog: automatic retry failed to start: ${error instanceof Error ? error.message : String(error)}`, "error"); }
+		};
+		const awaitRedriveDelay = () => new Promise<boolean>((resolve) => {
+			redriveResolve = resolve;
+			redriveTimer = runtime.setTimeout(() => { redriveTimer = undefined; redriveResolve = undefined; resolve(true); }, redriveDelay);
+		});
+		const armRedrive = (ctx: { ui: { setStatus(key: string, text: string | undefined): void; onTerminalInput(handler: (data: string) => any): () => void } }) => {
+			statusUI = ctx.ui;
+			const deadline = runtime.now() + redriveDelay;
+			const tick = () => {
+				if (redriveTimer === undefined || !config) return;
+				ctx.ui.setStatus(STATUS_KEY, `Retrying (${stallRetriesUsed}/${config.maxStallRetries}) in ${Math.ceil(Math.max(0, deadline - runtime.now()) / 1000)}s... (Esc to cancel)`);
+				if (deadline - runtime.now() > 1000) statusTimer = runtime.setTimeout(tick, 1000);
+			};
+			redriveTimer = runtime.setTimeout(sendRedrive, redriveDelay);
+			removeTerminalInput = ctx.ui.onTerminalInput((data) => {
+				if (data !== "\x1b") return;
+				resetRunState(); announce(RETRY_CANCELLED_NOTICE);
+				return { consume: true };
+			});
+			tick();
+		};
 		pi.on("agent_end", () => disarm());
-		pi.on("agent_settled", () => {
-			if (convertedTimeout && !continuationStarted) announce(DEGRADATION_NOTICE);
+		pi.on("agent_settled", async (_event, ctx) => {
+			if (exhaustedAbortGeneration !== undefined && exhaustedAbortGeneration === watchdogAbortedGeneration) { announce(DEGRADATION_NOTICE); resetRunState(); return; }
+			if (convertedTimeout && continuationStarted) { resetRunState(); return; }
+			if (convertedTimeout && !redriveEligible) { announce(DEGRADATION_NOTICE); resetRunState(); return; }
+			if (redriveEligible) {
+				if (ctx.mode === "tui" || ctx.mode === "rpc") armRedrive(ctx);
+				else { if (await awaitRedriveDelay()) sendRedrive(); }
+				return;
+			}
 			resetRunState();
 		});
+		pi.on("input", () => { if (redriveTimer !== undefined || redriveInFlight) resetRunState(); });
+		pi.on("session_before_tree", () => { if (redriveTimer !== undefined) resetRunState(); });
+		pi.on("session_before_compact", () => { if (redriveTimer !== undefined) resetRunState(); });
 		pi.on("session_shutdown", () => {
 			resetRunState();
 			config = undefined;

package/lib/extension-config.ts

@@ -46,7 +46,7 @@ export const QUIVER_CONFIG_KEYS: Record<string, readonly string[]> = {
 	fastMode: ["enabled"],
 	sessionAutoName: ["enabled", "ghosttyTab", "herdrTab", "rules", "deny", "revisitFirstTurn", "revisitEveryTurns"],
 	swordHeader: ["enabled"],
-	providerStallWatchdog: ["enabled", "firstEventMs", "warningMs", "recoveryMs", "maxStallRetries"],
+	providerStallWatchdog: ["enabled", "firstEventMs", "warningMs", "recoveryMs", "maxStallRetries", "models"],
 	slack: ["enabled", "cachePath", "policyPath", "userTokenEnv", "userTokenCommand", "userTokenCommandTimeoutSeconds", "botTokenEnv", "uploadThresholdChars"],
 	docToMd: DOC_TO_MD_OPTIONS.filter((o) => o.settable).map((o) => o.key),
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-quiver",
-  "version": "6.3.0",
+  "version": "6.4.0",
   "description": "Personal pack of Pi coding-agent extensions: context-safe fetch, doc_to_md PDF/DOCX/PPTX-to-Markdown conversion, session naming, a themed ASCII startup header, Opus 4.8 fast mode, and a provider-stall watchdog.",
   "author": "Jacek Juraszek",
   "license": "MIT",
@@ -87,9 +87,9 @@
     "unpdf": "^1.8.1"
   },
   "devDependencies": {
-    "@earendil-works/pi-ai": "^0.84.2",
-    "@earendil-works/pi-coding-agent": "^0.84.2",
-    "@earendil-works/pi-tui": "^0.84.2",
+    "@earendil-works/pi-ai": "^0.87.1",
+    "@earendil-works/pi-coding-agent": "^0.87.1",
+    "@earendil-works/pi-tui": "^0.87.1",
     "@sinclair/typebox": "^0.34.49",
     "@types/jsdom": "^28.0.3",
     "@types/node": "^26.1.0",