Control model and thinking beside input #13

New issue

Closed

opened 2026-08-28 19:24:43 +00:00 by dikka · 1 comment

dikka commented

2026-08-28 19:24:43 +00:00

Owner

What to build

Add compact model and thinking controls to the input footer rather than the top bar. A live session's model choices come from Pi's scoped models, and thinking choices come from levels supported by the selected model. Current values remain visible even if a scoped list changes.

Route changes through the typed producer commands established by the exact protocol and Pi's public setters. Changes affect later provider requests rather than pretending to rewrite a request already in flight, and Pi's normal durable model/thinking entries remain the history authority. Cold or stopped sessions show last-known values read-only because no live extension can apply a change.

Do not build a Pilcrow model catalog or move response appearance into Settings.

Acceptance criteria

The input footer shows current model and thinking without consuming session top-bar space.
A live picker lists Pi-scoped models and model-supported thinking levels and preserves a current out-of-scope value honestly.
Selecting a model or thinking level uses typed live authority and Pi's public setter.
External Pi model/thinking changes refresh the controls and remain represented in durable session history.
Controls are read-only with last-known values for stopped or cold sessions and explain unavailable authority accessibly.
No Pilcrow-owned global model catalog or model default setting is introduced.
Extension command, hub authority, rendered footer, and model-capability tests pass.

Blocked by

#3 — Establish the next exact producer interface
#10 — Make finalized stream responses annotation-capable

Human checkpoint note: Do not request routine per-ticket approval. The implementing agent may make the internal architecture, refactoring, testing, and UI-detail decisions needed to satisfy the acceptance criteria. Pause only if implementation requires a material product or ownership change, a destructive or hard-to-reverse action, excluded security or deployment scope, credentials or spending, or a real-browser design fork with no safe default. Forgejo completion updates may be batched with the rest of the completed frontier. The user performs final hub and Pi restart steps. Agents must not start, restart, replace, or stop the user-run Pilcrow development server.

## What to build Add compact model and thinking controls to the input footer rather than the top bar. A live session's model choices come from Pi's scoped models, and thinking choices come from levels supported by the selected model. Current values remain visible even if a scoped list changes. Route changes through the typed producer commands established by the exact protocol and Pi's public setters. Changes affect later provider requests rather than pretending to rewrite a request already in flight, and Pi's normal durable model/thinking entries remain the history authority. Cold or stopped sessions show last-known values read-only because no live extension can apply a change. Do not build a Pilcrow model catalog or move response appearance into Settings. ## Acceptance criteria - [ ] The input footer shows current model and thinking without consuming session top-bar space. - [ ] A live picker lists Pi-scoped models and model-supported thinking levels and preserves a current out-of-scope value honestly. - [ ] Selecting a model or thinking level uses typed live authority and Pi's public setter. - [ ] External Pi model/thinking changes refresh the controls and remain represented in durable session history. - [ ] Controls are read-only with last-known values for stopped or cold sessions and explain unavailable authority accessibly. - [ ] No Pilcrow-owned global model catalog or model default setting is introduced. - [ ] Extension command, hub authority, rendered footer, and model-capability tests pass. ## Blocked by - #3 — Establish the next exact producer interface - #10 — Make finalized stream responses annotation-capable > **Human checkpoint note:** Do not request routine per-ticket approval. The implementing agent may make the internal architecture, refactoring, testing, and UI-detail decisions needed to satisfy the acceptance criteria. Pause only if implementation requires a material product or ownership change, a destructive or hard-to-reverse action, excluded security or deployment scope, credentials or spending, or a real-browser design fork with no safe default. Forgejo completion updates may be batched with the rest of the completed frontier. The user performs final hub and Pi restart steps. Agents must not start, restart, replace, or stop the user-run Pilcrow development server.

dikka added the

ready-for-agent

label

2026-08-28 19:24:43 +00:00

dikka referenced this issue

2026-08-28 19:24:45 +00:00

Replace the old workspace shell #16

dikka added a new dependency

2026-08-28 19:24:46 +00:00

#3 Establish the next exact producer interface

dikka added a new dependency

2026-08-28 19:24:46 +00:00

#10 Make finalized stream responses annotation-capable

dikka added a new dependency

2026-08-28 19:25:35 +00:00

#16 Replace the old workspace shell

dikka commented

2026-08-29 07:15:07 +00:00

Author

Owner

Implemented in jj revision e736748b (feat(controls): add model and thinking controls to workspace sessions).

What changed:

Added compact Model and Thinking controls beside every production input footer: first-message, ordinary/steering stream input, structured annotation input, and finalized-response feedback.
Live choices come from Pi’s scoped models and selected-model supported thinking levels. Current out-of-scope values, no-current state, partially unknown cold facts, and capability changes where current is outside available choices render honestly without fabricating availability.
Stopped, reconnecting, quarantined, and cold sessions show last-known model/thinking read-only with a compact visible authority explanation. Durable Pi JSONL model_change and thinking_level_change metadata populates cold/imported last-known state; absent facts use explicit unknown sentinels rather than false no-model/off values.
Added same-origin typed model/thinking control endpoints with exact 8 KiB bodies, strict field validation, workspace/live-owner authority, bounded operation caches, and correlated producer results.
The extension serializes all distinct model/thinking mutations per live Pi runtime in request arrival order. Async setModel plus its scoped pinned-thinking application is one queued task; later model/thinking commands deterministically win. Duplicate IDs attach to the same pending/result cache.
Timeout/disconnect remains indeterminate and redispatchable with the same operation ID/fingerprint to the current registration. Producer pending/result cache gives exactly-once behavior; replacement owners and late/out-of-order results are fenced.
External Pi changes publish authoritative snapshots to all pages. Controls explicitly state that changes affect later requests rather than pretending to rewrite work already in flight.
Uses Pi’s public session-only setters and durable Pi history entries. Pilcrow adds no global model catalog, model default, or appearance setting.
Footer semantics use fieldset/legend grouping, visible read-only reason, honest unavailable options, and 44px narrow/touch controls.
Exact producer protocol remains v10.

Audit and regression coverage:

Fresh review found concurrent commands applying out of order, permanently cached timeout/disconnect results, valid capability changes rejected by v10, fabricated cold model/off facts, oversized control bodies, and inaccessible small disabled controls. All findings were fixed before closure.
Added reversed async model/model+thinking ordering, busy changes, same-ID pending/reconnect/timeout/late-result/replacement owner, parser→hub→browser capability refresh, two-page SSE/external refresh, cold JSONL model/thinking import and unknown facts, full Origin/content-type/malformed/oversize/field matrices, first-message/stream/structured/finalized/stopped footer modes, narrow accessibility, and draft/follow preservation tests.
Hub+extension command race stress passed five consecutive runs.

Validation:

Supervisor full suite passed: 71 files / 652 tests.
Focused final suite passed: 244 tests; race stress passed 81 tests × five runs.
vp check passes all 206 formatted files with 0 errors and four existing non-blocking launcher/registry warnings.
TypeScript no-emit checks, hub build, production browser builds, and git diff --check passed.
Real-browser/live-Pi QA was unavailable because no user-run Pilcrow server was active; project policy correctly prevented starting one. Fixture-driven multi-page and real JSONL metadata tests cover those seams.

No producer schema change or v9 compatibility path was added. No server was managed. Loading the new HTTP routes requires the user-run hub restart already required by the broader v10 rollout.

Implemented in jj revision `e736748b` (`feat(controls): add model and thinking controls to workspace sessions`). What changed: - Added compact Model and Thinking controls beside every production input footer: first-message, ordinary/steering stream input, structured annotation input, and finalized-response feedback. - Live choices come from Pi’s scoped models and selected-model supported thinking levels. Current out-of-scope values, no-current state, partially unknown cold facts, and capability changes where current is outside available choices render honestly without fabricating availability. - Stopped, reconnecting, quarantined, and cold sessions show last-known model/thinking read-only with a compact visible authority explanation. Durable Pi JSONL `model_change` and `thinking_level_change` metadata populates cold/imported last-known state; absent facts use explicit unknown sentinels rather than false no-model/off values. - Added same-origin typed model/thinking control endpoints with exact 8 KiB bodies, strict field validation, workspace/live-owner authority, bounded operation caches, and correlated producer results. - The extension serializes all distinct model/thinking mutations per live Pi runtime in request arrival order. Async setModel plus its scoped pinned-thinking application is one queued task; later model/thinking commands deterministically win. Duplicate IDs attach to the same pending/result cache. - Timeout/disconnect remains indeterminate and redispatchable with the same operation ID/fingerprint to the current registration. Producer pending/result cache gives exactly-once behavior; replacement owners and late/out-of-order results are fenced. - External Pi changes publish authoritative snapshots to all pages. Controls explicitly state that changes affect later requests rather than pretending to rewrite work already in flight. - Uses Pi’s public session-only setters and durable Pi history entries. Pilcrow adds no global model catalog, model default, or appearance setting. - Footer semantics use fieldset/legend grouping, visible read-only reason, honest unavailable options, and 44px narrow/touch controls. - Exact producer protocol remains v10. Audit and regression coverage: - Fresh review found concurrent commands applying out of order, permanently cached timeout/disconnect results, valid capability changes rejected by v10, fabricated cold model/off facts, oversized control bodies, and inaccessible small disabled controls. All findings were fixed before closure. - Added reversed async model/model+thinking ordering, busy changes, same-ID pending/reconnect/timeout/late-result/replacement owner, parser→hub→browser capability refresh, two-page SSE/external refresh, cold JSONL model/thinking import and unknown facts, full Origin/content-type/malformed/oversize/field matrices, first-message/stream/structured/finalized/stopped footer modes, narrow accessibility, and draft/follow preservation tests. - Hub+extension command race stress passed five consecutive runs. Validation: - Supervisor full suite passed: 71 files / 652 tests. - Focused final suite passed: 244 tests; race stress passed 81 tests × five runs. - `vp check` passes all 206 formatted files with 0 errors and four existing non-blocking launcher/registry warnings. - TypeScript no-emit checks, hub build, production browser builds, and `git diff --check` passed. - Real-browser/live-Pi QA was unavailable because no user-run Pilcrow server was active; project policy correctly prevented starting one. Fixture-driven multi-page and real JSONL metadata tests cover those seams. No producer schema change or v9 compatibility path was added. No server was managed. Loading the new HTTP routes requires the user-run hub restart already required by the broader v10 rollout.

dikka closed this issue

2026-08-29 07:15:07 +00:00