ytdb-slate 0.1.2 → 0.2.0

package/extension/threads.ts

@@ -13,6 +13,7 @@
 import { readFileSync } from "node:fs";
 import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
 import { compressEpisode } from "./episodes.ts";
+import { isAuthFailure, isFailoverCandidate, resolveMappedModel } from "./failover.ts";
 import type { EpisodeRecord, SlateConfig, SlateStore, ThreadRecord } from "./state.ts";
 import { openWorkerSession, type WorkerSession } from "./worker.ts";
 
@@ -49,6 +50,34 @@ export interface DispatchResult {
 	usage: UsageStats;
 }
 
+/** Loose shape of an assistant message as seen in session.messages / message_end. */
+interface WorkerAssistantMsg {
+	role?: string;
+	stopReason?: string;
+	errorMessage?: string;
+	usage?: { input?: number; output?: number; totalTokens?: number; cost?: { total?: number } };
+	content?: Array<{ type: string; text?: string }>;
+}
+
+/**
+ * Final assistant message of THIS action (AF3): backward scan, because the
+ * last array element can be a toolResult (e.g. after a tool abort), and pi's
+ * internal retry strips recovered errored attempts from session.messages
+ * entirely — so the last assistant message is the authoritative outcome.
+ */
+function lastAssistantMessage(messages: unknown[]): WorkerAssistantMsg | undefined {
+	for (let i = messages.length - 1; i >= 0; i--) {
+		const m = messages[i] as WorkerAssistantMsg;
+		if (m.role === "assistant") return m;
+	}
+	return undefined;
+}
+
+/** Continuation nudge for the post-failover re-prompt (same live session, context intact). */
+const FAILOVER_NUDGE =
+	"The previous attempt was interrupted by a model API failure. The conversation context is intact " +
+	"and partial changes may exist — verify the current state, then complete the original action.";
+
 class Semaphore {
 	private waiters: Array<() => void> = [];
 	private active = 0;
@@ -76,6 +105,8 @@ class Semaphore {
 
 export class ThreadManager {
 	private live = new Map<string, WorkerSession>();
+	/** threadId → "provider/id" a LIVE session was switched to by model failover (AF12). */
+	private failoverLive = new Map<string, string>();
 	private queues = new Map<string, Promise<unknown>>();
 	private semaphore: Semaphore;
 
@@ -90,6 +121,20 @@ export class ThreadManager {
 		return this.config;
 	}
 
+	/**
+	 * The "provider/id" a thread's LIVE session runs after a model failover,
+	 * undefined when none happened or the session has since been disposed.
+	 * Failover is deliberately NOT persisted to ThreadRecord.model. A reopen
+	 * normally reverts to the configured model because worker.ts passes an
+	 * explicit model (thread.model, else the host's current model) which
+	 * overrides the session file — EXCEPT when both are absent (no thread.model
+	 * and a model-less host session): the SDK then restores the session file's
+	 * last model_change, which can be the mapped model (CQ3).
+	 */
+	liveFailoverModel(threadId: string): string | undefined {
+		return this.live.has(threadId) ? this.failoverLive.get(threadId) : undefined;
+	}
+
 	async dispatch(
 		opts: DispatchOptions,
 		ctx: ExtensionContext,
@@ -191,6 +236,34 @@ export class ThreadManager {
 		let status: "ok" | "failed" = "ok";
 		let diagnostics: string | undefined;
 
+		// AF3: status/diagnostics derive from the FINAL assistant message of this
+		// action after prompt() settles — not from a sticky message_end flag. This
+		// fixes a latent bug: pi retries transient provider errors internally and
+		// strips the recovered errored attempts from session.messages, so an
+		// errored message_end mid-run does NOT mean the action failed. Thrown
+		// prompt() exceptions and orchestrator aborts still mean failed.
+		const deriveOutcome = (thrown?: { error: unknown }) => {
+			const final = lastAssistantMessage(session ? session.messages.slice(messagesBefore) : []);
+			if (signal?.aborted) {
+				return { status: "failed" as const, diagnostics: "aborted by orchestrator", final };
+			}
+			if (thrown) {
+				const msg = thrown.error instanceof Error ? thrown.error.message : String(thrown.error);
+				return { status: "failed" as const, diagnostics: msg, final };
+			}
+			if (!final) {
+				return { status: "failed" as const, diagnostics: "worker produced no assistant message", final };
+			}
+			if (final.stopReason === "error" || final.stopReason === "aborted") {
+				return {
+					status: "failed" as const,
+					diagnostics: final.errorMessage ?? `worker stopReason: ${final.stopReason}`,
+					final,
+				};
+			}
+			return { status: "ok" as const, diagnostics: undefined, final };
+		};
+
 		try {
 			thread.status = "running";
 			thread.updatedAt = Date.now();
@@ -207,6 +280,10 @@ export class ThreadManager {
 					promptDocs: this.config.workerPromptDocs,
 				});
 				this.live.set(thread.id, session);
+				// A freshly opened session starts on its configured model — drop any
+				// stale failover marker (possible if a previous live session was
+				// disposed mid-dispatch after its marker was set).
+				this.failoverLive.delete(thread.id);
 				if (!thread.sessionFile && session.sessionFile) {
 					thread.sessionFile = session.sessionFile;
 					this.store.save();
@@ -220,7 +297,9 @@ export class ThreadManager {
 					lines.push(`→ ${(event as unknown as { toolName: string }).toolName}`);
 					emit(false);
 				} else if (event.type === "message_end") {
-					const msg = (event as unknown as { message: { role: string; content?: Array<{ type: string; text?: string }>; usage?: { input?: number; output?: number; totalTokens?: number; cost?: { total?: number } }; stopReason?: string; errorMessage?: string } }).message;
+					// Usage accumulation + progress lines ONLY — outcome is derived
+					// after prompt() settles (see deriveOutcome above, AF3).
+					const msg = (event as unknown as { message: WorkerAssistantMsg }).message;
 					if (msg.role !== "assistant") return;
 					usage.turns++;
 					usage.input += msg.usage?.input ?? 0;
@@ -233,10 +312,6 @@ export class ThreadManager {
 						.join(" ")
 						.trim();
 					if (text) lines.push(text.length > 120 ? `${text.slice(0, 120)}...` : text);
-					if (msg.stopReason === "error" || msg.stopReason === "aborted") {
-						status = "failed";
-						diagnostics = msg.errorMessage ?? `worker stopReason: ${msg.stopReason}`;
-					}
 					emit(false);
 				}
 			});
@@ -245,11 +320,80 @@ export class ThreadManager {
 			onAbort = () => void session?.abort();
 			signal?.addEventListener("abort", onAbort, { once: true });
 
-			await session.prompt(prompt);
+			// Attempt 1.
+			let thrown: { error: unknown } | undefined;
+			try {
+				await session.prompt(prompt);
+			} catch (error) {
+				thrown = { error };
+			}
+			let outcome = deriveOutcome(thrown);
+			({ status, diagnostics } = outcome);
 
-			if (signal?.aborted) {
-				status = "failed";
-				diagnostics = diagnostics ?? "aborted by orchestrator";
+			// Model failover — single hop, at most ONCE per dispatch: when the
+			// attempt failed with a model-API error (never an abort or a context
+			// overflow — see failover.ts) or prompt() threw AND the current model
+			// now fails its auth check (state-based classification, AF10), switch
+			// the LIVE session to the mapped model and re-prompt once. Usage keeps
+			// accumulating through the same subscriber, and messagesBefore is
+			// unchanged (same session), so the episode covers both attempts.
+			const current = session.model;
+			if (status === "failed" && !signal?.aborted && current) {
+				// CN1/BG1 + CN2: every await below is a window in which the dispatch
+				// can be aborted or this manager disposed. The abort listener cannot
+				// cover it — session.abort() no-ops on an idle session — and a
+				// DISPOSED worker session does not throw on setModel/prompt (workers
+				// load no extensions, so the SDK's assertActive guard never fires on
+				// this path). Re-check both hazards before each side effect; an abort
+				// or disposal anywhere in the window means NO retry.
+				const retryBlocked = () => signal?.aborted === true || this.live.get(thread.id) !== session;
+				const candidate =
+					isFailoverCandidate(outcome.final, current.contextWindow) ||
+					(thrown !== undefined && (await isAuthFailure(ctx, current)));
+				const mapped = candidate
+					? await resolveMappedModel(ctx, this.config.modelFailover ?? {}, current.provider, current.id)
+					: undefined;
+				if (mapped && !retryBlocked()) {
+					lines.push(`⚠ failover ${current.provider}/${current.id} ⇒ ${mapped.provider}/${mapped.id}`);
+					emit(false);
+					let switched = false;
+					try {
+						await session.setModel(mapped); // can throw on a failed live auth check
+						switched = true;
+					} catch {
+						/* keep the original failure */
+					}
+					if (switched) {
+						// The live session now runs the mapped model — sticky until the
+						// session is disposed (ThreadRecord.model stays as configured);
+						// record it for the threads listing (AF12).
+						this.failoverLive.set(thread.id, `${mapped.provider}/${mapped.id}`);
+					}
+					// Re-check after the setModel await. If the signal has NOT fired,
+					// the once-listener is still armed, so a retry that does start
+					// remains abortable (a fire in the microtask gap between this check
+					// and prompt() startup is the residual race inherent to
+					// AbortSignal listeners).
+					if (switched && !retryBlocked()) {
+						thrown = undefined;
+						try {
+							await session.prompt(FAILOVER_NUDGE);
+						} catch (error) {
+							thrown = { error };
+						}
+						outcome = deriveOutcome(thrown);
+						({ status, diagnostics } = outcome);
+						// CQ2: an aborted retry is an abort, not a failover failure.
+						if (status === "failed" && !signal?.aborted) {
+							diagnostics = `${diagnostics} (failover to ${mapped.provider}/${mapped.id} also failed)`;
+						}
+					}
+				}
+				// CQ2: an abort that landed anywhere in this failover window surfaces
+				// as an abort (deriveOutcome checks the signal first) — never as the
+				// stale attempt-1 error or a "failover also failed". Disposal without
+				// abort keeps the attempt-1 outcome.
+				if (signal?.aborted) ({ status, diagnostics } = deriveOutcome(thrown));
 			}
 		} catch (error) {
 			status = "failed";
@@ -273,6 +417,7 @@ export class ThreadManager {
 			messages: actionMessages as unknown[],
 			workerModel: session?.model ? { provider: session.model.provider, id: session.model.id } : undefined,
 			configuredModel: this.config.episodeModel,
+			modelFailover: this.config.modelFailover,
 			signal: signal?.aborted ? undefined : signal,
 		});
 
@@ -307,5 +452,6 @@ export class ThreadManager {
 			}
 		}
 		this.live.clear();
+		this.failoverLive.clear(); // markers describe live sessions only (see liveFailoverModel)
 	}
 }

package/extension/tools.ts

@@ -105,7 +105,19 @@ export function registerSlateTools(pi: ExtensionAPI, store: SlateStore, getManag
 			}
 			const lines = threads.map((t) => {
 				const episodes = t.episodeIds.length > 0 ? t.episodeIds.join(", ") : "(none)";
-				return `${t.id} "${t.name}" [${t.status}]${t.model ? ` model=${t.model}` : ""} — episodes: ${episodes} — updated ${new Date(t.updatedAt).toISOString()}`;
+				// AF12: after a model failover the LIVE cached session runs a
+				// different model than configured — show "model=A ⇒B (live)", or
+				// "model=B (live)" when no model was configured (the live model is
+				// otherwise just the host default and not worth showing). The marker
+				// disappears when the session is disposed: a reopen reverts to the
+				// configured model because failover is not persisted.
+				const live = getManager().liveFailoverModel(t.id);
+				const model = live
+					? ` model=${t.model ? `${t.model} ⇒` : ""}${live} (live)`
+					: t.model
+						? ` model=${t.model}`
+						: "";
+				return `${t.id} "${t.name}" [${t.status}]${model} — episodes: ${episodes} — updated ${new Date(t.updatedAt).toISOString()}`;
 			});
 			return { content: [{ type: "text", text: lines.join("\n") }], details: { count: threads.length } };
 		},

package/extension/worker.ts

@@ -71,9 +71,37 @@ export async function openWorkerSession(opts: {
 	// settings and the <config dir>/SYSTEM.md override even in projects the
 	// user has NOT trusted. Carry the host session's actual trust decision into
 	// both the resource loader and the session.
-	const settingsManager = SettingsManager.create(ctx.cwd, agentDir, {
-		projectTrusted: ctx.isProjectTrusted(),
-	});
+	//
+	// READ-ONLY view (AF8/AF9): model failover may call session.setModel on a
+	// live worker, and setModel persists the new model as the default via
+	// SettingsManager (setThinkingLevel likewise). A file-backed manager would
+	// write a worker's failover model into the USER'S global settings.json.
+	// Instead, snapshot the settings once here and serve them through a custom
+	// SettingsStorage whose withLock discards the callback's return value —
+	// the supported no-op write path (persistScopedSettings only hands the new
+	// JSON back as that return value; there is no error path). Reads, merge
+	// semantics, and trust gating are identical to a file-backed manager.
+	//
+	// CN4: the snapshot is taken via a throwaway file-backed SettingsManager,
+	// NOT a raw readFileSync — pi's settings writer holds a lockfile during
+	// its non-atomic writes (e.g. the orchestrator's own failover setModel
+	// persisting a new global default), so an unlocked read could tear. The
+	// throwaway does the locked, error-tolerant read; its per-scope snapshots
+	// are re-serialized for the storage below (fromStorage re-parses and
+	// re-migrates them — idempotent), and it never writes: no setter is ever
+	// called on it.
+	const trusted = ctx.isProjectTrusted();
+	const snapshot = SettingsManager.create(ctx.cwd, agentDir, { projectTrusted: trusted });
+	const globalJson = JSON.stringify(snapshot.getGlobalSettings());
+	const projectJson = JSON.stringify(snapshot.getProjectSettings());
+	const settingsManager = SettingsManager.fromStorage(
+		{
+			withLock(scope, fn) {
+				fn(scope === "global" ? globalJson : projectJson); // return discarded → writes dropped
+			},
+		},
+		{ projectTrusted: trusted },
+	);
 
 	// Role-guideline doc content is captured when this session object is
 	// created: a live session keeps its system prompt until disposed; a
@@ -111,6 +139,15 @@ export async function openWorkerSession(opts: {
 		cwd: ctx.cwd,
 		agentDir,
 		model: model ?? undefined,
+		// Explicit thinkingLevel (AF9): a live failover to a weaker model
+		// re-clamps the thinking level and appends thinking_level_change to the
+		// worker's session file; on reopen the SDK restores that clamped value
+		// (resolution: explicit option > session file > settings default), which
+		// would permanently downgrade the thread after the mapped model is
+		// abandoned. Passing the settings default explicitly on every open makes
+		// the SDK re-clamp against the CURRENT model instead. "medium" mirrors
+		// the SDK's DEFAULT_THINKING_LEVEL (not exported).
+		thinkingLevel: settingsManager.getDefaultThinkingLevel() ?? "medium",
 		tools: opts.tools && opts.tools.length > 0 ? opts.tools : DEFAULT_WORKER_TOOLS,
 		resourceLoader: loader,
 		sessionManager,

package/package.json

@@ -1,8 +1,13 @@
 {
   "name": "ytdb-slate",
-  "version": "0.1.2",
-  "description": "Slate: a thread-weaving orchestration extension for the pi coding agent — bounded worker actions, compressed episodes, mandatory research/design/adversarial/track review workflow, optional draft-PR publishing.",
+  "version": "0.2.0",
+  "description": "Slate: a thread-weaving orchestration extension for the pi coding agent — bounded worker actions, compressed episodes, mandatory research/design/adversarial/track review workflow, optional draft-PR publishing, a configurable model-failover map for high availability across orchestrator, workers, and episode compression, and an absolute orchestrator context-token budget with per-model overrides and orchestrator-mode compaction.",
   "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/JetBrains/ytdb-slate.git"
+  },
+  "homepage": "https://github.com/JetBrains/ytdb-slate#readme",
   "keywords": [
     "pi-package"
   ],